Function at 0x140002a30
Capabilities:
Create process on windows
Create thread
Execute command
Log keystrokes via polling
Self delete
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x330]
sub rsp, 0x430
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x320], rax
xor r12d, r12d
lea ecx, [r12 + 0x10]
call fcn.140007110
lea rcx, str.Cleaner
mov qword [rax], rcx
lea rcx, [0x140002820]
mov qword [rax + 8], rcx
mov qword [rbp + 0x80], rax
lea rcx, [rbp + 0xb8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x140006930]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0xb0], rax
test rax, rax
je 0x14000370e
cmp dword [rbp + 0xb8], r12d
je 0x140003702
movaps xmm0, xmmword [rbp + 0xb0]
movdqa xmmword [rbp + 0x80], xmm0
lea rcx, [rbp + 0x80]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140003702
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xb0], xmm0
mov r8d, 0x104
lea rdx, [rbp + 0x110]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rbp + 0x110]
mov qword [rbp + 0x80], rax
lea rcx, [rbp + 0x110]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140002b33
mov qword [rbp + 0x88], rax
movaps xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rbp + 0x80], xmm0
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x50]
call fcn.1400067f0
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
lea r11, [rcx + rax*2]
mov r10, r11
mov rdx, r11
call fcn.140001b60
cmp rax, r11
je 0x140002bab
nop
lea rcx, [r10 - 2]
movzx edx, word [rcx]
cmp dx, 0x5c
je 0x140002bab
cmp dx, 0x2f
je 0x140002bab
mov r10, rcx
cmp rax, rcx
jne 0x140002b90
sub r11, r10
sar r11, 1
mov qword [rbp + 0x80], r10
mov qword [rbp + 0x88], r11
movaps xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rbp + 0x80], xmm0
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x30]
call fcn.1400067f0
nop
lea rdi, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
lea rdx, [rdi + rax*2]
mov rbx, rdx
mov rcx, rdi
call fcn.140001b60
cmp rax, rdx
je 0x140002c2e
nop word [rax + rax]
lea rcx, [rbx - 2]
movzx r8d, word [rcx]
cmp r8w, 0x5c
je 0x140002c2e
cmp r8w, 0x2f
je 0x140002c2e
mov rbx, rcx
cmp rax, rcx
jne 0x140002c10
mov r8d, 0x3a
mov rcx, rbx
call fcn.140007010
mov rcx, rax
cmp rbx, rax
je 0x140002c65
add rax, 0xfffffffffffffffe
cmp rbx, rax
je 0x140002c65
cmp word [rax], 0x2e
jne 0x140002c78
lea rdx, [rax - 2]
cmp rbx, rdx
jne 0x140002c62
cmp word [rdx], 0x2e
je 0x140002c65
mov rcx, rax
sub rcx, rdi
sar rcx, 1
cmp qword [rsp + 0x40], rcx
jae 0x140002c92
call fcn.140005340
int3
sub rax, 2
cmp rbx, rax
je 0x140002c65
cmp word [rax], 0x2e
je 0x140002c62
sub rax, 2
cmp rbx, rax
jne 0x140002c81
jmp 0x140002c65
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rax, qword [rsp + 0x30]
mov word [rax + rcx*2], r12w
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xe8]
call fcn.140004b50
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140002d04
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002cff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002cff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007154
mov qword [rsp + 0x40], r12
mov ebx, 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x30], r12w
mov rdx, qword [rsp + 0x68]
cmp rdx, rbx
jbe 0x140002d5d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002d58
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007154
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rbx
mov word [rsp + 0x50], r12w
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
mov rsi, qword [rbp + 0xf8]
sub rax, rsi
cmp rax, 4
jae 0x140002d90
call fcn.1400011b0
int3
lea r15, [rbp + 0xe8]
cmp qword [rbp + 0x100], 7
cmova r15, qword [rbp + 0xe8]
xorps xmm0, xmm0
movups xmmword [rbp + 0xc8], xmm0
mov qword [rbp + 0xd8], r12
mov qword [rbp + 0xe0], r12
lea r14, [rsi + 4]
lea rdi, [rbp + 0xc8]
cmp r14, 7
jbe 0x140002e6a
mov rbx, r14
or rbx, 7
cmp rbx, rcx
jbe 0x140002df3
mov rbx, rcx
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x140002e22
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140002f78
add rcx, rcx
cmp rcx, 0x1000
jb 0x140002e51
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002f78
mov rcx, rax
call fcn.140007110
test rax, rax
je 0x140002e4a
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002e63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140002e60
call fcn.140007110
mov rdi, rax
jmp 0x140002e63
mov rdi, r12
mov qword [rbp + 0xc8], rdi
mov qword [rbp + 0xd8], r14
mov qword [rbp + 0xe0], rbx
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [str..exe]
mov qword [rdi + rbx], rax
mov word [rdi + r14*2], r12w
lea rdx, str._n_______________Cleaner_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, str._n____F1__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, str.____F2__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, str.____F3__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, str.____F4__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
mov r13d, 0x8001
nop
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r13w, ax
je 0x1400031c9
mov qword [rbp + 0x80], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x80]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140002f91
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp + 0xa0]
lea edx, [r9 + 0xe]
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbp + 0x80]
test eax, eax
jne 0x140002f7e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002f91
call fcn.140001110
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 0xa0], 2
je 0x140003074
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
mov r8d, 0x35
lea rdx, [0x1400099b0]
lea rcx, [rsp + 0x70]
call fcn.140005fe0
nop
lea rbx, [rsp + 0x70]
mov r14, qword [rbp - 0x78]
cmp r14, 0xf
seta r15b
mov rdi, qword [rsp + 0x70]
jbe 0x140002fdc
mov rbx, rdi
mov rcx, rdi
mov rdx, rdi
jmp 0x140002fe4
lea rcx, [rsp + 0x70]
mov rdx, rbx
mov rsi, qword [rbp - 0x80]
add rsi, rcx
cmp rdx, rsi
je 0x140003033
mov qword [rbp + 0x80], 0x11
nop dword [rax + rax]
movzx edx, byte [rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400054b0
lea rdx, [0x140005680]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x80]
call fcn.1400056a0
inc rbx
cmp rbx, rsi
jne 0x140003000
test r15b, r15b
je 0x140003069
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140003061
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036fb
mov rcx, rdi
call fcn.140007154
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.del__F__Q___userprofile_AppDataRoamingMicrosoftWindowsRecent_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400099e8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_______________Cleaner_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, str._n____F1__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, str.____F2__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, str.____F3__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, str.____F4__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r12
mov r8d, 0x19
lea rdx, str.____JournalTrace
lea rcx, [rbp - 0x70]
call fcn.140005fe0
nop
lea rbx, [rbp - 0x70]
mov r14, qword [rbp - 0x58]
cmp r14, 0xf
seta r15b
mov rdi, qword [rbp - 0x70]
jbe 0x140003134
mov rbx, rdi
mov rcx, rdi
mov rdx, rdi
jmp 0x14000313b
lea rcx, [rbp - 0x70]
mov rdx, rbx
mov rsi, qword [rbp - 0x60]
add rsi, rcx
cmp rdx, rsi
je 0x140003193
mov qword [rbp + 0x80], 0x11
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400054b0
lea rdx, [0x140005680]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x80]
call fcn.1400056a0
inc rbx
cmp rbx, rsi
jne 0x140003160
test r15b, r15b
je 0x1400031c9
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400031c1
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036fb
mov rcx, rdi
call fcn.140007154
mov ecx, 0x71
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r13w, ax
je 0x140003329
lea rcx, str.del__F__Q___userprofile_AppDataRoamingMicrosoftWindowsRecent_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400099e8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_______________Cleaner_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, str._n____F1__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, str.____F2__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, str.____F3__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, str.____F4__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
mov r8d, 0x13
lea rdx, str.____Recent
lea rcx, [rbp - 0x50]
call fcn.140005fe0
nop
lea rbx, [rbp - 0x50]
mov r14, qword [rbp - 0x38]
cmp r14, 0xf
seta r15b
mov rdi, qword [rbp - 0x50]
jbe 0x14000329e
mov rbx, rdi
mov rcx, rdi
mov rdx, rdi
jmp 0x1400032a5
lea rcx, [rbp - 0x50]
mov rdx, rbx
mov rsi, qword [rbp - 0x40]
add rsi, rcx
cmp rdx, rsi
je 0x1400032f3
mov qword [rbp + 0x80], 0x11
nop dword [rax]
movzx edx, byte [rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400054b0
lea rdx, [0x140005680]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x80]
call fcn.1400056a0
inc rbx
cmp rbx, rsi
jne 0x1400032c0
test r15b, r15b
je 0x140003329
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140003321
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036fb
mov rcx, rdi
call fcn.140007154
mov ecx, 0x72
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r13w, ax
je 0x140003499
lea rcx, str.set_username_username___del__q__s__f__temp_._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.set_username_username___del__q__s__f_C:WindowsTemp._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400099e8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_______________Cleaner_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, str._n____F1__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, str.____F2__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, str.____F3__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, str.____F4__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r12
mov r8d, 0x11
lea rdx, str.____Temp
lea rcx, [rbp - 0x30]
call fcn.140005fe0
nop
lea rbx, [rbp - 0x30]
mov r14, qword [rbp - 0x18]
cmp r14, 0xf
seta r15b
mov rdi, qword [rbp - 0x30]
jbe 0x14000340b
mov rbx, rdi
mov rcx, rdi
mov rdx, rdi
jmp 0x140003412
lea rcx, [rbp - 0x30]
mov rdx, rbx
mov rsi, qword [rbp - 0x20]
add rsi, rcx
cmp rdx, rsi
je 0x140003463
mov qword [rbp + 0x80], 0x11
nop dword [rax]
movzx edx, byte [rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400054b0
lea rdx, [0x140005680]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x80]
call fcn.1400056a0
inc rbx
cmp rbx, rsi
jne 0x140003430
test r15b, r15b
je 0x140003499
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140003491
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036fb
mov rcx, rdi
call fcn.140007154
mov ecx, 0x73
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r13w, ax
je 0x140003609
lea rcx, str.rd__s__q_c:_Recycle.Bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rd__s__q_d:_Recycle.Bin
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400099e8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._n_______________Cleaner_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, str._n____F1__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, str.____F2__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, str.____F3__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
lea rdx, str.____F4__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005810
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r12
mov qword [rbp + 8], r12
mov r8d, 0x15
lea rdx, str.
lea rcx, [rbp - 0x10]
call fcn.140005fe0
nop
lea rbx, [rbp - 0x10]
mov r14, qword [rbp + 8]
cmp r14, 0xf
seta r15b
mov rdi, qword [rbp - 0x10]
jbe 0x14000357b
mov rbx, rdi
mov rcx, rdi
mov rdx, rdi
jmp 0x140003582
lea rcx, [rbp - 0x10]
mov rdx, rbx
mov rsi, qword [rbp]
add rsi, rcx
cmp rdx, rsi
je 0x1400035d3
mov qword [rbp + 0x80], 0x11
nop dword [rax]
movzx edx, byte [rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400054b0
lea rdx, [0x140005680]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x80]
call fcn.1400056a0
inc rbx
cmp rbx, rsi
jne 0x1400035a0
test r15b, r15b
je 0x140003609
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140003601
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400036fb
mov rcx, rdi
call fcn.140007154
mov ecx, 0x76
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r13w, ax
je 0x140002f00
mov dword [rbp + 0x10], 0x70
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
movups xmmword [rbp + 0x54], xmm0
movups xmmword [rbp + 0x64], xmm0
mov qword [rbp + 0x74], rax
mov dword [rbp + 0x7c], eax
lea rax, [0x140009a58]
mov qword [rbp + 0x20], rax
lea rcx, [rbp + 0xc8]
call fcn.140004b40
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], r12
mov dword [rbp + 0x40], 1
lea rdx, str._n______
lea rcx, [rbp + 0x80]
call fcn.140004ce0
nop
lea rcx, [rbp + 0x80]
call fcn.1400027a0
nop
lea rcx, [rbp + 0x80]
call fcn.140004c80
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x10]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1400036ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
jne 0x1400036ef
lea rdx, str._n
lea rcx, [rbp + 0x80]
call fcn.140004ce0
nop
lea rcx, [rbp + 0x80]
call fcn.1400027a0
nop
lea rcx, [rbp + 0x80]
call fcn.140004c80
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0xb8], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3