Function at 0x140004e40
Capabilities:
Delete file
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x350
mov rax, qword [0x140133080]
xor rax, rsp
mov qword [rsp + 0x340], rax
xor r12d, r12d
mov dword [rsp + 0x1a8], r12d
lea rcx, [0x1401d33d0]
call fcn.14009f010
cmp byte [0x1401d35e0], r12b
jne 0x140004f1e
mov r8, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [rsp + 0x30]
call fcn.140005770
movzx ecx, byte [rax + 0xa]
test cl, cl
je 0x140004edd
xor byte [rax], 0x35
xor byte [rax + 1], 0x36
xor byte [rax + 2], 0x37
xor byte [rax + 3], 0x38
xor byte [rax + 4], 0x39
xor byte [rax + 5], 0x3a
xor byte [rax + 6], 0x3b
xor byte [rax + 7], 0x3c
xor byte [rax + 8], 0x3d
xor byte [rax + 9], 0x3e
xor cl, 0x3f
mov byte [rax + 0xa], cl
mov rdx, rax
mov rcx, r8
call fcn.14000c550
lea rdx, [0x1401d35e8]
mov rcx, rax
call fcn.14000c920
lea rdx, [0x14000c720]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdi, str.cortex_login.txt
mov qword [rsp + 0x170], rdi
mov qword [rsp + 0x178], reloc.WS2_32.dll_recv
call fcn.1400f29c8
movaps xmm0, xmmword [rsp + 0x170]
movdqa xmmword [rsp + 0x170], xmm0
lea r8, [rsp + 0x170]
mov edx, eax
lea rcx, [rsp + 0x1c8]
call fcn.1400030f0
nop
lea rdx, [rsp + 0x1c8]
lea rcx, [rsp + 0x1a8]
call fcn.140003840
movsd xmm0, qword [rax]
movsd qword [rsp + 0x30], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0x170], ecx
lea rax, [0x140133118]
mov qword [rsp + 0x178], rax
movaps xmm0, xmmword [rsp + 0x170]
movdqa xmmword [rsp + 0x170], xmm0
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140005150
cmp eax, 1
setne bl
lea rcx, [rsp + 0x1c8]
call fcn.140009260
test bl, bl
je 0x140005372
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x230]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x230]
call fcn.140006ac0
nop
xor edx, edx
lea rcx, [rsp + 0x188]
call fcn.1400090e0
nop
mov qword [rsp + 0x200], r12
lea rax, [rsp + 0x230]
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x230]
movsxd rcx, dword [rax + 4]
mov rax, qword [rsp + rcx + 0x278]
mov qword [rsp + 0x178], rax
lea r8, [rsp + 0x1c8]
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x80]
call fcn.14000cc60
nop
lea r8, [rsp + 0x188]
mov rcx, rax
call fcn.140008530
nop
lea rcx, [rsp + 0xc8]
call fcn.140007740
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x14000509b
mov rax, qword [rcx]
lea rdx, [rsp + 0x80]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
movzx r15d, byte [rsp + 0x188]
cmp r15b, 1
jne 0x1400052fe
mov rax, qword [rsp + 0x190]
mov r13, qword [rax]
mov rbx, qword [r13 + 8]
mov rsi, r13
mov r14d, 9
cmp byte [rbx + 0x19], 0
jne 0x140005111
nop dword [rax]
lea rcx, [rbx + 0x20]
mov rdi, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x1400050e2
mov rcx, qword [rcx]
mov r8, rdi
cmp rdi, r14
cmova r8, r14
lea rdx, str.login_key
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000515f
js 0x140005164
mov rsi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1400050d0
lea rdi, str.cortex_login.txt
cmp byte [rsi + 0x19], 0
jne 0x1400052fe
lea rcx, [rsi + 0x20]
mov rbx, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x14000512d
mov rcx, qword [rcx]
mov r8, rbx
cmp rbx, 9
cmova r8, r14
lea rdx, str.login_key
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000516a
jns 0x1400052fe
jmp 0x140005174
xor bl, bl
test ecx, ecx
jne 0x14000570a
jmp 0x140004fc2
cmp rdi, r14
jae 0x1400050fe
mov rbx, qword [rbx + 0x10]
jmp 0x140005104
cmp rbx, 9
ja 0x1400052fe
cmp rsi, r13
je 0x1400052fe
xorps xmm0, xmm0
movups xmmword [rsp + 0x1c8], xmm0
mov qword [rsp + 0x1d8], r12
mov qword [rsp + 0x1e0], r12
mov r8, r14
lea rdx, str.login_key
lea rcx, [rsp + 0x1c8]
call fcn.1400045f0
lea rdx, [rsp + 0x1c8]
lea rcx, [rsp + 0x188]
call fcn.140006bd0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x208], xmm0
movdqa xmm1, xmmword [0x14011a7a0]
movdqu xmmword [rsp + 0x218], xmm1
mov byte [rsp + 0x208], 0
mov dword [rsp + 0x1a8], reloc.WS2_32.dll_send
cmp byte [rax], 3
jne 0x140005727
mov rdx, qword [rax + 8]
lea rax, [rsp + 0x208]
cmp rax, rdx
je 0x14000522a
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14000521c
mov rdx, qword [rdx]
lea rcx, [rsp + 0x208]
call fcn.1400162f0
nop
lea rdx, [rsp + 0x208]
lea rcx, [rsp + 0x1c8]
call fcn.140007410
mov rdx, rax
lea rcx, [0x1401d33d0]
call fcn.1400a0700
cmp byte [0x1401d35e0], 0
jne 0x1400052e8
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [rsp + 0x30]
call fcn.140005770
movzx edx, byte [rax + 0xa]
test dl, dl
je 0x1400052aa
xor byte [rax], 0x35
xor byte [rax + 1], 0x36
xor byte [rax + 2], 0x37
xor byte [rax + 3], 0x38
xor byte [rax + 4], 0x39
xor byte [rax + 5], 0x3a
xor byte [rax + 6], 0x3b
xor byte [rax + 7], 0x3c
xor byte [rax + 8], 0x3d
xor byte [rax + 9], 0x3e
xor dl, 0x3f
mov byte [rax + 0xa], dl
mov rdx, rax
call fcn.14000c550
lea rdx, [0x1401d35e8]
mov rcx, rax
call fcn.14000c920
lea rdx, [0x14000c720]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [rsp + 0x208]
call fcn.1400092d0
movzx r15d, byte [rsp + 0x188]
movzx edx, r15b
lea rcx, [rsp + 0x190]
call fcn.140008bc0
nop
mov rax, qword [rsp + 0x230]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x230], rax
mov rax, qword [rsp + 0x230]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x22c], edx
lea rcx, [rsp + 0x240]
call fcn.140006a50
lea rcx, [rsp + 0x248]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x2e0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x1400056d8
xorps xmm0, xmm0
movups xmmword [rsp + 0x1c8], xmm0
movdqa xmm1, xmmword [0x14011a7a0]
movdqu xmmword [rsp + 0x1d8], xmm1
mov byte [rsp + 0x1c8], 0
movsd xmm0, qword [0x140109b88]
movsd qword [rsp + 0x30], xmm0
movzx edx, word [0x140109b90]
mov word [rsp + 0x38], dx
movzx eax, byte [0x140109b92]
mov byte [rsp + 0x30], 0x5b
xor byte [rsp + 0x31], 0x36
xor byte [rsp + 0x32], 0x37
xor byte [rsp + 0x33], 0x38
xor byte [rsp + 0x34], 0x39
xor byte [rsp + 0x35], 0x3a
xor byte [rsp + 0x36], 0x3b
xor byte [rsp + 0x37], 0x3c
xor dl, 0x3d
mov byte [rsp + 0x38], dl
xor byte [rsp + 0x39], 0x3e
xor al, 0x3f
mov byte [rsp + 0x3a], al
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000c550
lea rdx, [rsp + 0x1c8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000c940
lea rdx, [rsp + 0x1c8]
lea rcx, [rsp + 0x188]
call fcn.140007410
mov rdx, rax
lea rcx, [0x1401d33d0]
call fcn.1400a0700
cmp byte [0x1401d35e0], 0
jmp 0x1400054cb
xor edx, edx
lea rcx, [rsp + 0x170]
call fcn.1400090e0
nop
lea rax, [rsp + 0x188]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x188], 0
xor eax, eax
mov qword [rsp + 0x190], rax
xor edx, edx
lea rcx, [rsp + 0x190]
call fcn.140008bc0
mov byte [rsp + 0x188], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0x1a8], xmm0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400f15a0
mov rbx, rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x1a8], rax
mov qword [rsp + 0x1b0], rbx
lea rdx, [rsp + 0x1c8]
mov rcx, rbx
call fcn.140007410
nop
mov qword [rsp + 0x190], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x1a8], xmm0
mov qword [rsp + 0x1b8], r12
mov qword [rsp + 0x1c0], r12
mov r8d, 0xa
lea rdx, str.cortex_key
lea rcx, [rsp + 0x1a8]
call fcn.1400045f0
lea rdx, [rsp + 0x1a8]
lea rcx, [rsp + 0x170]
call fcn.140006bd0
nop
movzx edx, byte [rax]
movzx ecx, byte [rsp + 0x188]
mov byte [rax], cl
mov byte [rsp + 0x188], dl
mov rcx, qword [rax + 8]
mov rdx, qword [rsp + 0x190]
mov qword [rax + 8], rdx
mov qword [rsp + 0x190], rcx
movzx edx, byte [rsp + 0x188]
lea rcx, [rsp + 0x190]
call fcn.140008bc0
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x230]
call sub.VCRUNTIME140.dll_memset
mov r8d, 2
mov rdx, rdi
lea rcx, [rsp + 0x230]
call fcn.140005d80
nop
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x170]
call fcn.140006dc0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140005637
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x230]
call fcn.1400117a0
nop
lea rcx, [rsp + 0x188]
call fcn.1400092d0
nop
mov rax, qword [rsp + 0x230]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x230], rax
mov rax, qword [rsp + 0x230]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x22c], edx
lea rcx, [rsp + 0x238]
call fcn.140006a50
lea rcx, [rsp + 0x240]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0x2d8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
movzx edx, byte [rsp + 0x170]
lea rcx, [rsp + 0x178]
call fcn.140008bc0
nop
lea rcx, [rsp + 0x1c8]
call fcn.1400092d0
nop
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.1400f1580
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
lea r8, [rsp + 0x1c8]
lea rdx, [rsp + 0x170]
lea rcx, str.exists
call fcn.1400037e0
nop
mov rcx, rax
call fcn.140009050
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x1c8]
call fcn.140016450
nop
mov r8, rax
lea rcx, [rsp + 0x48]
call fcn.140016510
lea rdx, [0x14012e048]
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll__CxxThrowException
int3