Function at 0x14003c000
Capabilities:
Create directory
Create process on windows
Delete file
Execute command
Persist via windows service
Set current directory
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x370]
sub rsp, 0x470
vmovaps xmmword [rsp + 0x460], xmm6
xor esi, esi
mov dword [rbp + 0x3b0], esi
lea rcx, str.sc_delete_voxkernel
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rbx, [0x1401da1e0]
mov rcx, rbx
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rcx, qword [0x1401da1e0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x14003c0a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14003c0a8
lea rdx, str.Failed_to_create_the_application_directory
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002e70
mov rcx, rax
mov rdx, rbx
call fcn.140002c10
lea rdx, [0x140003c00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea ecx, [rsi + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, rbx
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rcx, qword [0x1401da1e0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x14003c0ff
lea rdx, str.Failed_to_change_the_current_directory_to
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002e70
mov rcx, rax
mov rdx, rbx
call fcn.140002c10
lea rdx, [0x140003c00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 6
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov eax, dword [str.980770]
mov dword [rsp + 0x50], eax
movzx eax, word [0x14018ca88]
mov word [rsp + 0x54], ax
mov byte [rsp + 0x56], sil
lea r8, [rsp + 0x50]
lea rdx, [rbp + 8]
lea rcx, [0x1402ed7f0]
call fcn.1400bf700
nop
cmp byte [0x1402eda00], 0
jne 0x14003c19e
lea rdx, str._n_n_Status:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002e70
mov rcx, rax
lea rdx, [0x1402eda08]
call fcn.140002c10
lea rdx, [0x140003c00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x78], reloc.WS2_32.dll_ntohs
vmovsd xmm0, qword [str.magdrvamd64.sys]
vmovsd qword [rsp + 0x70], xmm0
mov eax, dword [0x14018caa8]
mov dword [rsp + 0x78], eax
movzx eax, word [0x14018caac]
mov word [rsp + 0x7c], ax
movzx eax, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rsp + 0x7e], al
mov byte [rsp + 0x7f], 0
lea rax, [0x14018c778]
mov qword [rbp + 0x80], rax
lea rcx, [rbp + 0x128]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0x3b0], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x80]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x80]
movsxd rcx, dword [rax + 4]
lea r14, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x80], r14
mov rax, qword [rbp + 0x80]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x7c], edx
lea rcx, [rbp + 0x88]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x88], rax
mov byte [rbp + 0x104], 0
mov byte [rbp + 0xf9], 0
lea rcx, [rbp + 0x88]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x108], rsi
mov rax, qword [0x1402edd28]
mov qword [rbp + 0xfc], rax
mov qword [rbp + 0xf0], rsi
mov r9d, 0x40
lea r8d, [r9 - 0x1e]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x88]
call fcn.14003b5d0
test rax, rax
jne 0x14003c2f1
mov rax, qword [rbp + 0x80]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x80]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x80]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x80], r14
mov rax, qword [rbp + 0x80]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x7c], edx
cmp qword [rbp + 0x108], 0
jne 0x14003c498
lea rdx, str.Failed_to_open_file_for_writing:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002e70
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0xf
mov r8, qword [rbp - 0x80]
cmova rdx, qword [rsp + 0x70]
mov rcx, rax
call fcn.140003470
lea rdx, [0x140003c00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Error_code:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002e70
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140003c00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rax, qword [rbp + 0x80]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x80], r14
mov rax, qword [rbp + 0x80]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x7c], edx
lea rcx, [rbp + 0x88]
call fcn.140004990
lea rcx, [rbp + 0x90]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x128]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14003c429
inc rdx
mov rcx, qword [rsp + 0x70]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14003c424
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d1fd
call fcn.140181b28
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x70], 0
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x14003c474
mov rdx, qword [rbp + 0x18]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c46f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d257
call fcn.140181b28
mov rbx, qword [rsp + 0x4c8]
vmovaps xmm6, xmmword [rsp + 0x460]
add rsp, 0x470
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8, qword [rbp + 0x10]
mov rdx, qword [rbp + 8]
sub r8, rdx
lea rcx, [rbp + 0x80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
mov rdi, 0xffffffffffffffff
lea rcx, [rbp + 0x88]
cmp qword [rbp + 0x108], 0
je 0x14003c653
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rbp + 0xf8]
cmp rax, rcx
jne 0x14003c4fc
mov r9, qword [rbp + 0x118]
mov rdx, qword [rbp + 0x110]
mov r8, rdx
lea rcx, [rbp + 0x88]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
cmp qword [rbp + 0xf0], 0
je 0x14003c598
cmp byte [rbp + 0xf9], 0
je 0x14003c598
mov rax, qword [rbp + 0x88]
mov r8, qword [rax + 0x18]
lea rax, [fcn.14003b710]
mov edx, edi
lea rcx, [rbp + 0x88]
cmp r8, rax
jne 0x14003c53e
call fcn.14003b710
jmp 0x14003c541
call r8
cmp eax, edi
jne 0x14003c549
xor bl, bl
jmp 0x14003c59a
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1e0]
lea r8, [rbp + 0x1c0]
lea rdx, [rbp + 0xfc]
mov rcx, qword [rbp + 0xf0]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14003c602
sub eax, 1
je 0x14003c609
cmp eax, 2
je 0x14003c591
xor bl, bl
jmp 0x14003c59a
mov byte [rbp + 0xf9], 0
mov bl, 1
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, [rbp + 0x88]
test bl, bl
cmove rcx, rsi
mov rbx, rsi
test eax, eax
cmove rbx, rcx
mov byte [rbp + 0x104], 0
mov byte [rbp + 0xf9], 0
lea rcx, [rbp + 0x88]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x108], rsi
mov rax, qword [0x1402edd28]
mov qword [rbp + 0xfc], rax
mov qword [rbp + 0xf0], rsi
test rbx, rbx
jne 0x14003c6a5
jmp 0x14003c683
mov byte [rbp + 0xf9], 0
lea rax, [rbp + 0x1c0]
mov rbx, qword [rbp + 0x3b0]
sub rbx, rax
je 0x14003c644
mov r9, qword [rbp + 0x108]
mov r8, rbx
mov edx, 1
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
je 0x14003c644
xor bl, bl
jmp 0x14003c59a
cmp byte [rbp + 0xf9], 0
sete bl
jmp 0x14003c59a
mov byte [rbp + 0x104], 0
mov byte [rbp + 0xf9], 0
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x108], rsi
mov rax, qword [0x1402edd28]
mov qword [rbp + 0xfc], rax
mov qword [rbp + 0xf0], rsi
mov rax, qword [rbp + 0x80]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x80]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rax, qword [rbp + 0x80]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x80]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
je 0x14003c6d0
lea rdx, str.Failed_to_write_to_file:
jmp 0x14003c32e
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x60], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x70], xmm1
mov r8d, 0x42
lea rdx, str.sc_create_voxkernel_binPath_C:VoxFNmagdrvamd64.sys_type_kernel
lea rcx, [rbp + 0x60]
call fcn.1400031e0
nop
vpxor xmm0, xmm0, xmm0
xor eax, eax
vmovups ymmword [rbp + 0x1e4], ymm0
vmovups ymmword [rbp + 0x204], ymm0
vmovups ymmword [rbp + 0x224], ymm0
mov dword [rbp + 0x244], eax
mov dword [rbp + 0x1e0], WSASetLastError
vmovups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova rdx, qword [rbp + 0x60]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14003c7bd
lea rdx, str.Failed_to_create_process:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002e70
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140003c00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.sc_start_voxkernel
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
vpxor xmm6, xmm6, xmm6
vmovdqu xmmword [rbp + 0x190], xmm6
mov r15, rsi
mov qword [rbp + 0x1a0], rsi
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 6
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov eax, dword [str.442525]
mov dword [rbp - 0x50], eax
movzx eax, word [0x14018cbd0]
mov word [rbp - 0x4c], ax
mov byte [rbp - 0x4a], 0
lea r8, [rbp - 0x50]
lea rdx, [rsp + 0x50]
lea rcx, [0x1402ed7f0]
call fcn.1400bf700
lea rcx, [rbp + 0x190]
cmp rcx, rax
je 0x14003c877
vmovdqu xmm6, xmmword [rax]
vmovdqu xmmword [rbp + 0x190], xmm6
mov r15, qword [rax + 0x10]
mov qword [rbp + 0x1a0], r15
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14003c8b6
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c8b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003c8b1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140181b28
cmp byte [0x1402eda00], 0
jne 0x14003c8fd
lea rdx, str.Download_failed:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002e70
mov rcx, rax
lea rdx, [0x1402eda08]
call fcn.140002c10
lea rdx, [0x140003c00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x14018cbf0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
vmovq r14, xmm6
test rax, rax
je 0x14003caa3
lea rdx, [0x14018cc00]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
lea rdx, str.WriteFile
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, [0x14018c6c8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test r13, r13
je 0x14003ca9a
test rsi, rsi
je 0x14003ca9a
test rax, rax
je 0x14003ca9a
vmovups xmm0, xmmword [str.s_vne_Mpyd_HJ]
vmovups xmmword [rsp + 0x50], xmm0
mov eax, dword [str._9C]
mov dword [rsp + 0x60], eax
cmp byte [0x14018ca0b], 0
je 0x14003c9f4
mov byte [rsp + 0x50], 0x43
xor byte [rsp + 0x51], 0x31
xor byte [rsp + 0x52], 0x32
xor byte [rsp + 0x53], 0x33
xor byte [rsp + 0x54], 0x34
xor byte [rsp + 0x55], 0x35
xor byte [rsp + 0x56], 0x36
xor byte [rsp + 0x57], 0x37
xor byte [rsp + 0x58], 0x38
xor byte [rsp + 0x59], 0x39
xor byte [rsp + 0x5a], 0x3a
xor byte [rsp + 0x5b], 0x3b
xor byte [rsp + 0x5c], 0x3c
xor byte [rsp + 0x5d], 0x3d
xor byte [rsp + 0x5e], 0x3e
xor byte [rsp + 0x5f], 0x3f
xor byte [rsp + 0x60], 0x40
xor byte [rsp + 0x61], 0x41
xor byte [rsp + 0x62], 0x42
xor byte [rsp + 0x63], 0x43
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x50], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp - 0x40], xmm1
lea rax, [rsp + 0x50]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14003ca10
mov r8, rdi
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x50]
call fcn.1400030d0
nop
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rcx, qword [rbp - 0x50]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call r13
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14003ca91
vpextrq r8, xmm6, 1
sub r8, r14
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x3b0]
mov rdx, r14
mov rcx, rax
call rsi
mov rcx, rdi
call r12
nop
lea rcx, [rbp - 0x50]
call fcn.140004a00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], 9
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
vmovsd xmm6, qword [str.C:VoxFN_]
vmovsd qword [rbp - 0x50], xmm6
movzx eax, byte [0x14018c310]
mov byte [rbp + 0x3b0], al
mov byte [rbp - 0x48], al
mov byte [rbp - 0x47], 0
lea rcx, [rbp + 0x1a8]
call fcn.140008380
nop
lea rcx, [rbp + 0x40]
call fcn.1400387e0
nop
mov r13, qword [rbp + 0x50]
movabs rax, 0x7ffffffffffffff6
cmp r13, rax
ja 0x14003d25e
lea r12, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova r12, qword [rbp + 0x40]
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x70], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp - 0x60], xmm1
lea rsi, [r13 + 9]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp - 0x70]
cmp rsi, rbx
jbe 0x14003cbc3
mov rax, rsi
or rax, rbx
movabs rbx, 0x7fffffffffffffff
cmp rax, rbx
jbe 0x14003cb83
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140181aec
test rax, rax
je 0x14003d0b4
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14003cbbf
mov rbx, rax
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14003cbae
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003d264
jmp 0x14003cb64
test rcx, rcx
je 0x14003cbbd
call fcn.140181aec
mov rdi, rax
jmp 0x14003cbbf
xor edi, edi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rbx
vmovsd qword [rdi], xmm6
movzx eax, byte [rbp + 0x3b0]
mov byte [rdi + 8], al
lea rcx, [rdi + 9]
mov r8, r13
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x1e]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x250]
call fcn.140004110
nop
mov r8, qword [rbp + 0x1b0]
mov rdx, qword [rbp + 0x1a8]
sub r8, rdx
lea rcx, [rbp + 0x250]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x258]
call fcn.140008290
test rax, rax
jne 0x14003cc60
mov rax, qword [rbp + 0x250]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x250]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
vpxor xmm0, xmm0, xmm0
xor eax, eax
vmovups ymmword [rbp + 0x1e4], ymm0
vmovups ymmword [rbp + 0x204], ymm0
vmovups ymmword [rbp + 0x224], ymm0
mov dword [rbp + 0x244], eax
mov dword [rbp + 0x1e0], WSASetLastError
vmovups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rdx, qword [rbp - 0x70]
mov r10, qword [rbp - 0x60]
add r10, rdx
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rdx, qword [rbp - 0x70]
vmovups xmmword [rbp - 0x30], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp - 0x20], xmm1
cmp rdx, r10
jne 0x14003cce4
vmovdqu xmm0, xmmword [0x14018cd70]
vmovdqu xmmword [rbp - 0x20], xmm0
xor r12d, r12d
mov word [rbp - 0x30], r12w
jmp 0x14003ccfc
mov r9, r10
sub r9, rdx
mov r8, r10
lea rcx, [rbp - 0x30]
vzeroupper
call fcn.140003310
xor r12d, r12d
mov r8, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
sub rax, r8
lea rsi, str.C:VoxFN_bfsvc1.exe
cmp rax, 0x14
jb 0x14003cda6
lea rax, [r8 + 0x14]
mov qword [rbp - 0x20], rax
lea rdi, [rbp - 0x30]
cmp rcx, 7
cmova rdi, qword [rbp - 0x30]
lea rax, [0x14018cc48]
cmp rax, rdi
jbe 0x14003cd5a
lea rax, [rdi + r8*2]
cmp rsi, rax
ja 0x14003cd5a
cmp rdi, rsi
ja 0x14003cd4f
mov rbx, r12
jmp 0x14003cd5f
mov rbx, rdi
sub rbx, rsi
sar rbx, 1
jmp 0x14003cd5f
mov ebx, reloc.WS2_32.dll_sendto
lea rcx, [rdi + 0x28]
lea r8, [r8*2 + 2]
mov rdx, rdi
vzeroupper
call sub.VCRUNTIME140.dll_memmove
add rbx, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8d, Ordinal_45
sub r8, rbx
lea rdx, [rsi + 0x28]
add rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x30]
jmp 0x14003cdc9
mov ebx, reloc.WS2_32.dll_sendto
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
lea rcx, [rbp - 0x30]
vzeroupper
call fcn.140003880
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x20], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x30], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x20], ymm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14003ce3d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ce35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003ce35
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.140181b28
vmovdqu xmm0, xmmword [0x14018cd70]
vmovdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r12w
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rdx, qword [rbp + 0x20]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14003cede
lea rdx, str.Failed_to_create_process:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002e70
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140003c00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x3b8]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp dword [rbp + 0x3b8], 0
jne 0x14003cf85
lea rdx, str.Mapping_command_executed_successfully.
call fcn.140002e70
lea rdx, [0x140003c00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
je 0x14003cfd4
lea rdx, str.Failed_to_delete_the_driver_file:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002e70
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rdx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x60]
mov rcx, rax
call fcn.140003470
lea rdx, [0x140003c00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14003cfd4
lea rdx, str.Mapping_command_failed__exit_code:
call fcn.140002e70
mov edx, dword [rbp + 0x3b8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x14018cc9c]
call fcn.140002e70
lea rdx, [0x140003c00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x14003d017
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d012
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003d012
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140181b28
vmovdqu xmm0, xmmword [0x14018cd70]
vmovdqu xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x20], r12w
mov rax, qword [rbp + 0x250]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x250], rax
mov rax, qword [rbp + 0x250]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x24c], edx
lea rcx, [rbp + 0x258]
call fcn.140004990
lea rcx, [rbp + 0x260]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x2f8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x14003d0c0
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d0bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003d0bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140181b28
vmovdqu xmm0, xmmword [0x14018cd80]
vmovdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14003d10f
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d10a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003d10a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140181b28
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x40], 0
lea rcx, [rbp + 0x1a8]
call fcn.140004b80
nop
test r14, r14
je 0x14003d168
sub r15, r14
mov rax, r14
cmp r15, 0x1000
jb 0x14003d15c
add r15, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003d15c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r15
mov rcx, r14
call fcn.140181b28
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 7
jbe 0x14003d1ab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d1a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003d1a6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140181b28
vmovdqu xmm0, xmmword [0x14018cd70]
vmovdqu xmmword [rbp + 0x70], xmm0
mov word [rbp + 0x60], r12w
lea rcx, [rbp + 0x80]
call fcn.140005760
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14003d209
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d204
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003d204
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140181b28
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x70], 0
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x14003c474
mov rdx, qword [rbp + 0x18]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c46f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003c46f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140006080
int3
call fcn.140005df0
int3