Function at 0x140045ae0
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create reverse shell
Create two anonymous pipes
Delete file
Execute command
Get common file path
Read file on windows
Self delete
Write and execute a file
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x14e0]
mov eax, 0x15e0
call fcn.1400b74c0
sub rsp, rax
mov rbx, rdx
mov rsi, rcx
mov rax, qword [rcx]
mov rdi, qword [rcx + 8]
cmp rax, rdi
je 0x14004737e
sub rdi, rax
mov r14d, edi
mov r9d, 4
mov r8d, 0x1000
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14004737e
mov r8d, r14d
mov rdx, qword [rsi]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rbp + 0x1538]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov edx, r14d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14004737e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], rax
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rax
lea rdx, [rbp + 0x12d0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rbp + 0xc0]
xor r8d, r8d
lea rdx, [0x1400d6fd0]
lea rcx, [rbp + 0x12d0]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14004736d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x1530]
mov r8d, edi
mov rdx, qword [rsi]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + Ordinal_30], 0x18
mov dword [rbp + 0x28], 1
mov qword [rbp + 0x20], r12
mov qword [rsp + 0x70], r12
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x40], r12
xor r9d, r9d
lea r8, [rbp + 0x18]
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x14004739b
xor r9d, r9d
lea r8, [rbp + 0x18]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x14004739b
xor r8d, r8d
lea edx, [r12 + 1]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor r8d, r8d
lea edx, [r12 + 1]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [rbp + 0x50], 0x68
mov dword [rbp + 0x8c], 0x101
mov rax, qword [rbp - 0x30]
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp - 0x38]
mov qword [rbp + 0xa8], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp + 0xb0], rax
mov word [rbp + 0x90], r12w
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x30]
call fcn.14004f340
nop
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x28]
call fcn.1400458e0
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova rdx, qword [rbp - 0x28]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400472db
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140045d85
mov rbx, qword [rbx]
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x1530]
mov rdx, rbx
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x68], 0
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x1520]
mov r8d, 0x1000
lea rdx, [rbp + 0x2d0]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004657a
mov r14, 0xffffffffffffffff
movzx ebx, byte [rbp + 0x1520]
xor r15d, r15d
nop dword [rax]
mov eax, dword [rbp + 0x1520]
test eax, eax
je 0x140046575
mov byte [rbp + rax + 0x2d0], 0
lea rax, [rbp + 0x2d0]
mov rsi, r14
inc rsi
cmp byte [rax + rsi], 0
jne 0x140045e20
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x50]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x140045e6c
lea rax, [rsi + rcx]
mov qword [rbp - 0x58], rax
lea rdi, [rbp - 0x68]
cmp rdx, 0xf
cmova rdi, qword [rbp - 0x68]
add rdi, rcx
mov r8, rsi
lea rdx, [rbp + 0x2d0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rsi], 0
jmp 0x140045e88
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x2d0]
movzx r8d, bl
mov rdx, rsi
lea rcx, [rbp - 0x68]
call fcn.1400504a0
lea rdi, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
seta r12b
cmova rdi, qword [rbp - 0x68]
mov r13, qword [rbp - 0x58]
cmp r13, 6
jb 0x140045f2f
lea rsi, [rdi + r13]
lea r8, [rsi - 5]
sub r8, rdi
mov edx, 0x46
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
je 0x140045f2f
nop dword [rax + rax]
mov rdx, r15
lea rax, str.Found.
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc rdx
cmp cl, byte [rax + rdx - 1]
jne 0x140045ef9
cmp rdx, 6
jne 0x140045ee0
mov eax, r15d
jmp 0x140045efe
sbb eax, eax
or eax, 1
test eax, eax
je 0x140045f23
inc r9
lea r8, [rsi - 5]
sub r8, r9
mov edx, 0x46
mov rcx, r9
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
jne 0x140045ed0
jmp 0x140045f2f
sub r9, rdi
cmp r9, r14
jne 0x14004660e
lea rsi, [rbp - 0x68]
test r12b, r12b
cmovne rsi, qword [rbp - 0x68]
cmp r13, 0xc
jb 0x140045fb6
lea r15, [rsi + r13]
lea r8, [r15 - 0xb]
sub r8, rsi
mov edx, 0x53
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
je 0x140045fb6
nop dword [rax]
nop word [rax + rax]
mov r8d, ntohs
lea rdx, str.Successfully
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140045faa
inc rdi
lea r8, [r15 - 0xb]
sub r8, rdi
mov edx, 0x53
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
jne 0x140045f70
jmp 0x140045fb6
sub rdi, rsi
cmp rdi, r14
jne 0x140046744
lea rdi, [rbp - 0x68]
test r12b, r12b
cmovne rdi, qword [rbp - 0x68]
cmp r13, 4
jb 0x1400460d6
lea rsi, [rdi + r13]
lea r8, [rsi - 3]
sub r8, rdi
mov edx, reloc.WS2_32.dll_WSAStartup
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
xor r15d, r15d
test rax, rax
je 0x1400460d9
nop dword [rax]
nop word [rax + rax]
mov rdx, r15
lea rax, str.sync
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc rdx
cmp cl, byte [rax + rdx - 1]
jne 0x140046029
cmp rdx, 4
jne 0x140046010
mov eax, r15d
jmp 0x14004602e
sbb eax, eax
or eax, 1
test eax, eax
je 0x140046056
inc r9
lea r8, [rsi - 3]
sub r8, r9
mov edx, reloc.WS2_32.dll_WSAStartup
mov rcx, r9
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
jne 0x140046000
jmp 0x1400460d9
sub r9, rdi
cmp r9, r14
je 0x1400460d9
lea rcx, str.del_8H2E9Cp4__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rax, [rbp + 0x2d0]
inc r14
cmp byte [rax + r14], r15b
jne 0x140046084
movabs rbx, 0x7fffffffffffffff
cmp r14, rbx
ja 0x1400473fd
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
cmp r14, 0xf
ja 0x140046876
mov qword [rsp + 0x60], r14
mov r8, r14
lea rdx, [rbp + 0x2d0]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + r14 + 0x50], r15b
jmp 0x1400471c1
xor r15d, r15d
lea rdi, [rbp - 0x68]
test r12b, r12b
mov r12, qword [rbp - 0x68]
cmovne rdi, r12
cmp r13, 4
jb 0x14004617f
lea rsi, [rdi + r13]
lea r8, [rsi - 3]
sub r8, rdi
mov edx, 0x48
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
je 0x14004617f
nop dword [rax]
nop word [rax + rax]
mov rdx, r15
lea rax, str.HWID
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc rdx
cmp cl, byte [rax + rdx - 1]
jne 0x140046149
cmp rdx, 4
jne 0x140046130
mov eax, r15d
jmp 0x14004614e
sbb eax, eax
or eax, 1
test eax, eax
je 0x140046173
inc r9
lea r8, [rsi - 3]
sub r8, r9
mov edx, 0x48
mov rcx, r9
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
jne 0x140046120
jmp 0x14004617f
sub r9, rdi
cmp r9, r14
jne 0x1400468e3
lea rdi, [rbp - 0x68]
mov rsi, qword [rbp - 0x50]
cmp rsi, 0xf
cmova rdi, r12
cmp r13, 6
jb 0x140046223
lea rsi, [rdi + r13]
lea r8, [rsi - 5]
sub r8, rdi
mov edx, 0x62
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
je 0x14004621f
nop dword [rax]
mov rdx, r15
lea rax, str.banned
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc rdx
cmp cl, byte [rax + rdx - 1]
jne 0x1400461e9
cmp rdx, 6
jne 0x1400461d0
mov eax, r15d
jmp 0x1400461ee
sbb eax, eax
or eax, 1
test eax, eax
je 0x140046213
inc r9
lea r8, [rsi - 5]
sub r8, r9
mov edx, 0x62
mov rcx, r9
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
jne 0x1400461c0
jmp 0x14004621f
sub r9, rdi
cmp r9, r14
jne 0x140046a88
mov rsi, qword [rbp - 0x50]
lea rdi, [rbp - 0x68]
cmp rsi, 0xf
cmova rdi, r12
cmp r13, 6
jb 0x1400462bf
lea rsi, [rdi + r13]
lea r8, [rsi - 5]
sub r8, rdi
mov edx, 0x68
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
je 0x1400462bf
nop dword [rax]
mov rdx, r15
lea rax, str.hyperV
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc rdx
cmp cl, byte [rax + rdx - 1]
jne 0x140046289
cmp rdx, 6
jne 0x140046270
mov eax, r15d
jmp 0x14004628e
sbb eax, eax
or eax, 1
test eax, eax
je 0x1400462b3
inc r9
lea r8, [rsi - 5]
sub r8, r9
mov edx, 0x68
mov rcx, r9
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
jne 0x140046260
jmp 0x1400462bf
sub r9, rdi
cmp r9, r14
jne 0x140046c47
lea rsi, [rbp - 0x68]
mov rax, qword [rbp - 0x50]
cmp rax, 0xf
cmova rsi, r12
cmp r13, 8
jb 0x14004634a
lea r15, [rsi + r13]
lea r8, [r15 - 7]
sub r8, rsi
mov edx, 0x63
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
je 0x140046346
nop word [rax + rax]
mov r8d, 8
lea rdx, str.c035001e
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004633a
inc rdi
lea r8, [r15 - 7]
sub r8, rdi
mov edx, 0x63
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
jne 0x140046300
jmp 0x140046346
sub rdi, rsi
cmp rdi, r14
jne 0x140046d73
mov rax, qword [rbp - 0x50]
lea rsi, [rbp - 0x68]
cmp rax, 0xf
cmova rsi, r12
cmp r13, 0x11
jb 0x1400463ca
lea r15, [rsi + r13]
lea r8, [r15 - 0x10]
sub r8, rsi
mov edx, 0x56
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
je 0x1400463c6
nop dword [rax]
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.Vulnerable_Driver
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400463ba
inc rdi
lea r8, [r15 - 0x10]
sub r8, rdi
mov edx, 0x56
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
jne 0x140046380
jmp 0x1400463c6
sub rdi, rsi
cmp rdi, r14
jne 0x140046e6b
mov rax, qword [rbp - 0x50]
lea rsi, [rbp - 0x68]
cmp rax, 0xf
cmova rsi, r12
cmp r13, 8
jb 0x14004644a
lea r15, [rsi + r13]
lea r8, [r15 - 7]
sub r8, rsi
mov edx, 0x63
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
je 0x140046446
nop dword [rax]
mov r8d, 8
lea rdx, str.c0000041
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004643a
inc rdi
lea r8, [r15 - 7]
sub r8, rdi
mov edx, 0x63
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
jne 0x140046400
jmp 0x140046446
sub rdi, rsi
cmp rdi, r14
jne 0x140046f5b
mov rax, qword [rbp - 0x50]
lea rsi, [rbp - 0x68]
cmp rax, 0xf
cmova rsi, r12
cmp r13, 7
jb 0x1400464ca
lea r15, [rsi + r13]
lea r8, [r15 - 6]
sub r8, rsi
mov edx, reloc.WS2_32.dll_WSAStartup
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
je 0x1400464c6
nop dword [rax]
mov r8d, 7
lea rdx, str.support
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400464ba
inc rdi
lea r8, [r15 - 6]
sub r8, rdi
mov edx, reloc.WS2_32.dll_WSAStartup
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
jne 0x140046480
jmp 0x1400464c6
sub rdi, rsi
cmp rdi, r14
jne 0x14004704b
mov rax, qword [rbp - 0x50]
lea rsi, [rbp - 0x68]
cmp rax, 0xf
cmova rsi, r12
cmp r13, 8
jb 0x140046546
lea r15, [rsi + r13]
lea r8, [r15 - 7]
sub r8, rsi
mov edx, 0x63
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
je 0x140046546
nop dword [rax]
mov r8d, 8
lea rdx, str.c0000138
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004653a
inc rdi
lea r8, [r15 - 7]
sub r8, rdi
mov edx, 0x63
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
jne 0x140046500
jmp 0x140046546
sub rdi, rsi
cmp rdi, r14
jne 0x1400470a1
xor r15d, r15d
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x1520]
mov r8d, 0x1000
lea rdx, [rbp + 0x2d0]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140045e00
mov r15, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
mov r8d, 0x8000
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r15d, r15d
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x14004722f
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004722a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004722a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Key_not_Found
lea rcx, [0x1408d2678]
call fcn.14004fdd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rax, [rbp + 0x2d0]
inc r14
cmp byte [rax + r14], 0
jne 0x140046640
movabs rbx, 0x7fffffffffffffff
cmp r14, rbx
ja 0x140047403
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
cmp r14, 0xf
ja 0x140046690
mov qword [rsp + 0x60], r14
mov r8, r14
lea rdx, [rbp + 0x2d0]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + r14 + 0x50], 0
jmp 0x14004672e
mov rcx, r14
or rcx, 0xf
cmp rcx, rbx
jbe 0x1400466c5
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400b6dd4
test rax, rax
je 0x1400466ef
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140046708
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rcx, rax
cmovb rcx, rax
mov rbx, rcx
inc rcx
cmp rcx, 0x1000
jb 0x1400466f6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400473c1
jmp 0x1400466aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140046705
call fcn.1400b6dd4
mov rdi, rax
jmp 0x140046708
mov rdi, r15
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rbx
mov r8, r14
lea rdx, [rbp + 0x2d0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
lea rdx, [rsp + 0x50]
lea rcx, [0x1408d37c0]
call fcn.140061390
jmp 0x1400471d7
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.Successfully_Spoofed
lea rcx, [0x1408d2678]
call fcn.14004fdd0
lea rcx, str.del_8H2E9Cp4__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r15d, r15d
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rax, [rbp + 0x2d0]
inc r14
cmp byte [rax + r14], r15b
jne 0x140046786
movabs rbx, 0x7fffffffffffffff
cmp r14, rbx
ja 0x140047409
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
cmp r14, 0xf
ja 0x1400467d4
mov qword [rsp + 0x60], r14
mov r8, r14
lea rdx, [rbp + 0x2d0]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + r14 + 0x50], r15b
jmp 0x1400471c1
mov rcx, r14
or rcx, 0xf
cmp rcx, rbx
jbe 0x140046809
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400b6dd4
test rax, rax
je 0x140046833
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14004684c
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rcx, rax
cmovb rcx, rax
mov rbx, rcx
inc rcx
cmp rcx, 0x1000
jb 0x14004683a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400473c7
jmp 0x1400467ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140046849
call fcn.1400b6dd4
mov rdi, rax
jmp 0x14004684c
mov rdi, r15
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rbx
mov r8, r14
lea rdx, [rbp + 0x2d0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], r15b
jmp 0x1400471c1
mov rcx, r14
or rcx, 0xf
cmp rcx, rbx
jbe 0x1400468ae
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400b6dd4
test rax, rax
je 0x1400468dc
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14004719c
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rcx, rax
cmovb rcx, rax
mov rbx, rcx
inc rcx
cmp rcx, 0x1000
jb 0x14004718a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400473cd
jmp 0x140046890
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], select
mov qword [rbp + 0x10], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.HWID_Failed_]
movsd qword [rbp - 8], xmm0
mov eax, dword [0x1400d7048]
mov dword [rbp], eax
mov byte [rbp + 4], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rax, [rbp + 0x2d0]
nop dword [rax]
inc r14
cmp byte [rax + r14], 0
jne 0x140046930
movabs rbx, 0x7fffffffffffffff
cmp r14, rbx
ja 0x14004740f
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
cmp r14, 0xf
ja 0x140046980
mov qword [rsp + 0x60], r14
mov r8, r14
lea rdx, [rbp + 0x2d0]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + r14 + 0x50], 0
jmp 0x140046a1e
mov rcx, r14
or rcx, 0xf
cmp rcx, rbx
jbe 0x1400469b5
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400b6dd4
test rax, rax
je 0x1400469df
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400469f8
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rcx, rax
cmovb rcx, rax
mov rbx, rcx
inc rcx
cmp rcx, 0x1000
jb 0x1400469e6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400473d3
jmp 0x14004699a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400469f5
call fcn.1400b6dd4
mov rdi, rax
jmp 0x1400469f8
mov rdi, r15
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rbx
mov r8, r14
lea rdx, [rbp + 0x2d0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
lea rdx, [rsp + 0x50]
lea rcx, [0x1408d37c0]
call fcn.140061390
call fcn.1400452d0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
jmp 0x1400465c9
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400b6dd4
mov rsi, rax
mov qword [rbp - 8], rax
mov qword [rbp + 8], reloc.WS2_32.dll_select
mov qword [rbp + 0x10], Ordinal_35
movups xmm0, xmmword [str.The_User_is_Banned]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400d7068]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rax, [rbp + 0x2d0]
inc r14
cmp byte [rax + r14], 0
jne 0x140046ae2
movabs rbx, 0x7fffffffffffffff
cmp r14, rbx
ja 0x140047415
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
cmp r14, 0xf
ja 0x140046b32
mov qword [rsp + 0x60], r14
mov r8, r14
lea rdx, [rbp + 0x2d0]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + r14 + 0x50], 0
jmp 0x140046bd0
mov rcx, r14
or rcx, 0xf
cmp rcx, rbx
jbe 0x140046b67
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400b6dd4
test rax, rax
je 0x140046b91
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140046baa
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rcx, rax
cmovb rcx, rax
mov rbx, rcx
inc rcx
cmp rcx, 0x1000
jb 0x140046b98
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400473d9
jmp 0x140046b4c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140046ba7
call fcn.1400b6dd4
mov rdi, rax
jmp 0x140046baa
mov rdi, r15
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rbx
mov r8, r14
lea rdx, [rbp + 0x2d0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
lea rdx, [rsp + 0x50]
lea rcx, [0x1408d37c0]
call fcn.140061390
call fcn.1400452d0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, rsi
call fcn.1400b6c3c
jmp 0x1400465c9
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.HyperV_Enabled_
lea rcx, [0x1408d2678]
call fcn.14004fdd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rax, [rbp + 0x2d0]
nop dword [rax]
inc r14
cmp byte [rax + r14], 0
jne 0x140046c80
movabs rbx, 0x7fffffffffffffff
cmp r14, rbx
ja 0x14004741b
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
cmp r14, 0xf
ja 0x140046cd0
mov qword [rsp + 0x60], r14
mov r8, r14
lea rdx, [rbp + 0x2d0]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + r14 + 0x50], 0
jmp 0x1400471c1
mov rcx, r14
or rcx, 0xf
cmp rcx, rbx
jbe 0x140046d05
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400b6dd4
test rax, rax
je 0x140046d2f
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140046d48
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rcx, rax
cmovb rcx, rax
mov rbx, rcx
inc rcx
cmp rcx, 0x1000
jb 0x140046d36
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400473df
jmp 0x140046cea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140046d45
call fcn.1400b6dd4
mov rdi, rax
jmp 0x140046d48
mov rdi, r15
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rbx
mov r8, r14
lea rdx, [rbp + 0x2d0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
jmp 0x1400471c1
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.HyperV_Enabled_
lea rcx, [0x1408d2678]
call fcn.14004fdd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r15d, r15d
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rax, [rbp + 0x2d0]
nop dword [rax + rax]
inc r14
cmp byte [rax + r14], r15b
jne 0x140046db0
movabs rbx, 0x7fffffffffffffff
cmp r14, rbx
ja 0x140047421
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
cmp r14, 0xf
ja 0x140046dfe
mov qword [rsp + 0x60], r14
mov r8, r14
lea rdx, [rbp + 0x2d0]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + r14 + 0x50], r15b
jmp 0x1400471c1
mov rcx, r14
or rcx, 0xf
cmp rcx, rbx
jbe 0x140046e36
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400b6dd4
test rax, rax
je 0x140046e64
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14004684c
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rcx, rax
cmovb rcx, rax
mov rbx, rcx
inc rcx
cmp rcx, 0x1000
jb 0x14004683a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400473e5
jmp 0x140046e18
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.Vulnerable_Driver_Error
lea rcx, [0x1408d2678]
call fcn.14004fdd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r15d, r15d
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rax, [rbp + 0x2d0]
inc r14
cmp byte [rax + r14], r15b
jne 0x140046ea0
movabs rbx, 0x7fffffffffffffff
cmp r14, rbx
ja 0x140047427
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
cmp r14, 0xf
ja 0x140046eee
mov qword [rsp + 0x60], r14
mov r8, r14
lea rdx, [rbp + 0x2d0]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + r14 + 0x50], r15b
jmp 0x1400471c1
mov rcx, r14
or rcx, 0xf
cmp rcx, rbx
jbe 0x140046f26
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400b6dd4
test rax, rax
je 0x140046f54
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14004684c
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rcx, rax
cmovb rcx, rax
mov rbx, rcx
inc rcx
cmp rcx, 0x1000
jb 0x14004683a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400473eb
jmp 0x140046f08
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Error:_C0000041
lea rcx, [0x1408d2678]
call fcn.14004fdd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r15d, r15d
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rax, [rbp + 0x2d0]
inc r14
cmp byte [rax + r14], r15b
jne 0x140046f90
movabs rbx, 0x7fffffffffffffff
cmp r14, rbx
ja 0x14004742d
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
cmp r14, 0xf
ja 0x140046fde
mov qword [rsp + 0x60], r14
mov r8, r14
lea rdx, [rbp + 0x2d0]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + r14 + 0x50], r15b
jmp 0x1400471c1
mov rcx, r14
or rcx, 0xf
cmp rcx, rbx
jbe 0x140047016
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400b6dd4
test rax, rax
je 0x140047044
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14004684c
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rcx, rax
cmovb rcx, rax
mov rbx, rcx
inc rcx
cmp rcx, 0x1000
jb 0x14004683a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400473f1
jmp 0x140046ff8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str.please_contact_support
lea rcx, [0x1408d2678]
call fcn.14004fdd0
call fcn.1400452d0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
jmp 0x1400465ab
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Error:_C0000138
lea rcx, [0x1408d2678]
call fcn.14004fdd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r15d, r15d
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
lea rax, [rbp + 0x2d0]
inc r14
cmp byte [rax + r14], r15b
jne 0x1400470d6
movabs rbx, 0x7fffffffffffffff
cmp r14, rbx
ja 0x1400473bb
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
cmp r14, 0xf
ja 0x140047124
mov qword [rsp + 0x60], r14
mov r8, r14
lea rdx, [rbp + 0x2d0]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + r14 + 0x50], r15b
jmp 0x1400471c1
mov rcx, r14
or rcx, 0xf
cmp rcx, rbx
jbe 0x140047159
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400b6dd4
test rax, rax
je 0x140047183
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14004719c
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rcx, rax
cmovb rcx, rax
mov rbx, rcx
inc rcx
cmp rcx, 0x1000
jb 0x14004718a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400473f7
jmp 0x14004713e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140047199
call fcn.1400b6dd4
mov rdi, rax
jmp 0x14004719c
mov rdi, r15
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rbx
mov r8, r14
lea rdx, [rbp + 0x2d0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rdi], r15b
lea rdx, [rsp + 0x50]
lea rcx, [0x1408d37c0]
call fcn.140061390
call fcn.1400452d0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400465c9
call fcn.1400b6c3c
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x14004727d
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047278
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047278
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6c3c
movdqa xmm0, xmmword [0x1400d7f40]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x1400472d1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400472cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400472cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6c3c
mov eax, 1
jmp 0x140047380
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x140047319
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047314
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047314
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6c3c
movdqa xmm0, xmmword [0x1400d7f40]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x14004736d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047368
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047368
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b6c3c
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbx, qword [rsp + 0x1628]
add rsp, 0x15e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14004737e
call fcn.140044060
nop
call fcn.140035c80
int3
call fcn.140035c80
int3
call fcn.140035c80
nop
call fcn.140035c80
nop
call fcn.140035c80
nop
call fcn.140035c80
int3
call fcn.140035c80
int3
call fcn.140035c80
int3
call fcn.140035c80
int3
call fcn.140035c80
int3
call fcn.140044060
int3
call fcn.140044060
int3
call fcn.140044060
nop
call fcn.140044060
nop
call fcn.140044060
nop
call fcn.140044060
int3
call fcn.140044060
int3
call fcn.140044060
int3
call fcn.140044060
int3