Function at 0x140023090
Capabilities:
Contain obfuscated stackstrings
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended
Read file on windows
Self delete

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x14c0]
mov eax, 0x15c0
call fcn.14002ecc0
sub rsp, rax
movaps xmmword [rsp + 0x15b0], xmm6
mov rax, qword [0x140043040]
xor rax, rsp
mov qword [rbp + 0x14a0], rax
mov ebx, ecx
xor r15d, r15d
mov r13d, r15d
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
lea ecx, [r15 + 0x40]
call fcn.14002e3f8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x58], rax
mov qword [rbp - 0x60], r15
lea rax, [rbp - 0x58]
mov qword [rsp + 0x70], rax
mov cl, 1
call qword [sym.imp.MSVCP140.dll_private:_static_class_std::locale::_Locimp____ptr64___cdecl_std::locale::_Init_bool_]
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x48]
call fcn.14000f740
mov qword [rbp - 0x58], rax
lea rcx, [rbp - 0x48]
call fcn.14000f230
mov qword [rbp - 0x50], rax
lea r8, [0x140037202]
lea rdx, str.___A_Za_z_:___r_n__._dllexebatjarvbs__b
lea rcx, [rbp - 0x60]
call fcn.14000f320
nop
mov edx, ebx
lea rcx, [rbp + 0x480]
call fcn.14000a160
nop
mov r8, rax
lea rdx, str.memory.exe__p
lea rcx, [rbp + 0x460]
call fcn.14000ac20
nop
lea rcx, [rbp + 0x480]
call fcn.140002fa0
mov qword [rbp - 0x18], 0x18
mov qword [rbp - 8], 1
mov qword [rbp - 0x10], r15
xor r9d, r9d
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xor r8d, r8d
lea edx, [r15 + 1]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [rbp + 0xf0], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
movups xmmword [rbp + 0x108], xmm0
movups xmmword [rbp + 0x118], xmm0
movups xmmword [rbp + 0x128], xmm0
movups xmmword [rbp + 0x138], xmm0
movups xmmword [rbp + 0x148], xmm0
mov rax, qword [rbp - 0x68]
mov qword [rbp + 0x148], rax
psrldq xmm0, 4
movd eax, xmm0
or eax, 0x101
mov dword [rbp + 0x12c], eax
mov word [rbp + 0x130], r15w
lea rdx, [rbp + 0x460]
cmp qword [rbp + 0x478], 7
cmova rdx, qword [rbp + 0x460]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
lea r12, [r15 - 1]
test eax, eax
je 0x1400242f8
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x4a0]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rbp + 0x300], xmm0
mov qword [rbp + 0x310], r15
mov qword [rbp + 0x318], 0xf
mov byte [rbp + 0x300], r15b
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x68]
mov r8d, 0x1000
lea rdx, [rbp + 0x4a0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400242c8
lea rdi, [0x1400361a8]
lea rbx, vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
lea rsi, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x1400242c8
mov r8d, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x360], xmm0
mov qword [rbp + 0x370], r15
mov qword [rbp + 0x378], r15
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp + 0x360]
call fcn.140009020
nop
mov qword [rbp + 0x160], rdi
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
or r13d, 8
mov dword [rsp + 0x50], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x160]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x160], rbx
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx + 0x15c], edx
lea rax, [rbp + 0x170]
mov qword [rsp + 0x70], rax
lea rcx, [rbp + 0x170]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov qword [rbp + 0x170], rsi
lea rdx, [rbp + 0x360]
cmp qword [rbp + 0x378], 0xf
cmova rdx, qword [rbp + 0x360]
mov r9d, 2
mov r8, qword [rbp + 0x370]
lea rcx, [rbp + 0x170]
call fcn.140021b10
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2c0], xmm0
mov qword [rbp + 0x2d0], r15
mov qword [rbp + 0x2d8], 0xf
mov byte [rbp + 0x2c0], 0
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x160]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x160]
call fcn.140021e70
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x1400241d9
lea rax, [rbp - 0x80]
mov qword [rbp + 0xd0], rax
nop
lea rbx, [rbp + 0x2c0]
mov rdx, qword [rbp + 0x2d8]
cmp rdx, 0xf
seta cl
mov r8, qword [rbp + 0x2c0]
cmova rbx, r8
mov rsi, qword [rbp + 0x2d0]
add rbx, rsi
lea rdi, [rbp + 0x2c0]
test cl, cl
cmovne rdi, r8
cmp rdi, rbx
je 0x1400234da
nop dword [rax]
movzx ecx, byte [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x1400234c5
inc rdi
cmp rdi, rbx
jne 0x1400234b0
mov rdx, qword [rbp + 0x2d8]
mov rsi, qword [rbp + 0x2d0]
mov r8, qword [rbp + 0x2c0]
lea r14, [rbp + 0x2c0]
cmp rdx, 0xf
seta cl
cmova r14, r8
lea rbx, [rbp + 0x2c0]
test cl, cl
cmovne rbx, r8
add rbx, rsi
cmp rbx, r14
je 0x14002352f
lea rsi, [rbx - 1]
movzx ecx, byte [rsi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x14002351a
mov rbx, rsi
cmp rsi, r14
jne 0x140023501
mov rdx, qword [rbp + 0x2d8]
mov rsi, qword [rbp + 0x2d0]
mov r8, qword [rbp + 0x2c0]
lea rax, [rbp + 0x2c0]
cmp rdx, 0xf
seta cl
cmova rax, r8
lea rdx, [rax + rsi]
lea rax, [rbp + 0x2c0]
mov r9, rbx
sub rdx, rbx
test cl, cl
je 0x14002355b
sub r9, r8
jmp 0x140023565
sub r9, rax
lea r8, [rbp + 0x2c0]
mov rax, rsi
sub rax, r9
cmp rax, rdx
cmovb rdx, rax
lea rcx, [r8 + r9]
sub rsi, rdx
mov r8, rsi
sub r8, r9
inc r8
add rdx, rcx
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x2d0], rsi
lea r8, [rbp + 0x2c0]
cmp qword [rbp + 0x2d8], 0xf
seta cl
mov r9, qword [rbp + 0x2c0]
cmova r8, r9
lea rax, [rbp + 0x2c0]
mov rdx, r8
sub rdi, r8
test cl, cl
je 0x1400235c4
sub rdx, r9
jmp 0x1400235ce
sub rdx, rax
lea r9, [rbp + 0x2c0]
mov rax, rsi
sub rax, rdx
cmp rax, rdi
cmovb rdi, rax
lea rcx, [r9 + rdx]
sub rsi, rdi
mov r8, rsi
sub r8, rdx
inc r8
lea rdx, [rcx + rdi]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x2d0], rsi
xorps xmm0, xmm0
movups xmmword [rbp + 0x380], xmm0
mov qword [rbp + 0x390], 4
mov qword [rbp + 0x398], 0xf
mov dword [rbp + 0x380], 0x6578652e
mov byte [rbp + 0x384], 0
movups xmmword [rbp + 0x3a0], xmm0
mov qword [rbp + 0x3b0], 4
mov qword [rbp + 0x3b8], 0xf
mov dword [rbp + 0x3a0], 0x6c6c642e
mov byte [rbp + 0x3a4], 0
movups xmmword [rbp + 0x3c0], xmm0
mov qword [rbp + 0x3d0], 4
mov qword [rbp + 0x3d8], 0xf
mov dword [rbp + 0x3c0], 0x7461622e
mov byte [rbp + 0x3c4], 0
movups xmmword [rbp + 0x3e0], xmm0
mov qword [rbp + 0x3f0], 4
mov qword [rbp + 0x3f8], 0xf
mov dword [rbp + 0x3e0], 0x7362762e
mov byte [rbp + 0x3e4], 0
movups xmmword [rbp + 0x400], xmm0
mov qword [rbp + 0x410], 4
mov qword [rbp + 0x418], 0xf
mov dword [rbp + 0x400], 0x72616a2e
mov byte [rbp + 0x404], 0
movups xmmword [rbp + 0x420], xmm0
mov qword [rbp + 0x430], 4
mov qword [rbp + 0x438], 0xf
mov dword [rbp + 0x420], 0x3173702e
mov byte [rbp + 0x424], 0
movups xmmword [rbp + 0x440], xmm0
mov qword [rbp + 0x450], 3
mov qword [rbp + 0x458], 0xf
mov eax, dword [0x140037204]
mov word [rbp + 0x440], ax
movzx eax, byte [0x140037206]
mov byte [rbp + 0x442], al
mov byte [rbp + 0x443], 0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r15
mov ecx, 0xe0
call fcn.14002e3f8
mov rbx, rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
lea rcx, [rax + 0xe0]
mov qword [rbp - 0x70], rcx
lea rdi, [rbp + 0x380]
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], rax
lea rax, [rbp - 0x80]
mov qword [rbp + 0x58], rax
mov rdx, rdi
mov rcx, rbx
call fcn.140008730
add rbx, 0x20
mov qword [rbp + 0x50], rbx
add rdi, 0x20
lea rax, [rbp + 0x460]
cmp rdi, rax
jne 0x140023790
mov qword [rbp - 0x78], rbx
lea r9, [fcn.140008690]
mov edx, 0x20
lea r8d, [rdx - 0x19]
lea rcx, [rbp + 0x380]
call fcn.14002e6b0
lea r15, [rbp + 0x2c0]
mov r14, qword [rbp + 0x2d8]
cmp r14, 0xf
seta r12b
mov rsi, qword [rbp + 0x2c0]
cmova r15, rsi
mov rdi, qword [rbp + 0x2d0]
test rdi, rdi
je 0x14002381d
mov r8, rdi
mov edx, 0x3a
mov rcx, r15
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x14002381d
sub rbx, r15
jmp 0x140023824
mov rbx, 0xffffffffffffffff
lea r15, [rbp + 0x2c0]
test r12b, r12b
cmovne r15, rsi
cmp rbx, rdi
jae 0x14002385c
mov r8, rdi
sub r8, rbx
lea rcx, [r15 + rbx]
mov edx, 0x5c
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14002385c
sub rax, r15
mov r12, 0xffffffffffffffff
jmp 0x140023866
mov r12, 0xffffffffffffffff
mov rax, r12
cmp rbx, 0xffffffffffffffff
je 0x1400239da
cmp rax, 0xffffffffffffffff
je 0x1400239da
lea rax, [rbp + 0x300]
cmp qword [rbp + 0x318], 0xf
cmova rax, qword [rbp + 0x300]
mov rcx, qword [rbp + 0x310]
cmp rcx, 1
jb 0x1400239da
cmp byte [rax + rcx - 1], 0x5c
jne 0x1400238b1
xor r15d, r15d
mov eax, r15d
jmp 0x1400238b6
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
je 0x1400239da
mov rbx, qword [rbp - 0x80]
mov r15, qword [rbp - 0x78]
cmp rbx, r15
je 0x1400239da
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400238e1
mov rdx, qword [rbx]
lea rcx, [rbp + 0x2c0]
cmp r14, 0xf
cmova rcx, rsi
cmp rdi, qword [rbx + 0x10]
jne 0x140023902
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140023910
add rbx, 0x20
cmp rbx, r15
jne 0x1400238d4
jmp 0x1400239da
lea rdx, str.____Detected_file_executed_with_special_characters.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009ab0
lea rdx, [0x140009c80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.____Line_1:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009ab0
lea rdx, [rbp + 0x300]
cmp qword [rbp + 0x318], 0xf
cmova rdx, qword [rbp + 0x300]
mov r8, qword [rbp + 0x310]
mov rcx, rax
call fcn.140024600
lea rdx, [0x140009c80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.____Line_2:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009ab0
lea rdx, [rbp + 0x2c0]
cmp qword [rbp + 0x2d8], 0xf
cmova rdx, qword [rbp + 0x2c0]
mov r8, qword [rbp + 0x2d0]
mov rcx, rax
call fcn.140024600
lea rdx, [0x140009c80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r14, qword [rbp + 0x2d8]
mov rdi, qword [rbp + 0x2d0]
mov rsi, qword [rbp + 0x2c0]
xor eax, eax
mov qword [rbp + 0x60], rax
mov byte [rbp + 0x68], al
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x80], xmm1
mov qword [rbp + 0x90], rax
mov byte [rbp + 0x98], al
movdqa xmmword [rbp + 0xa0], xmm0
mov byte [rbp + 0xb0], al
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xc0], rax
mov byte [rbp + 0xc8], al
test rdi, rdi
je 0x140024051
lea r8, [rbp + 0x2c0]
lea rdx, [rbp + 0x260]
lea rcx, [rsp + 0x58]
call fcn.140024ad0
mov rbx, qword [rbp + 0x270]
cmp byte [rbx + 0x19], 0
jne 0x140023a72
lea r8, [rbx + 0x20]
lea rdx, [rbp + 0x2c0]
call fcn.140024c70
test al, al
jne 0x140023a72
cmp rbx, qword [rsp + 0x58]
jne 0x140024051
lea rcx, [rbp + 0x2c0]
cmp r14, 0xf
seta al
cmova rcx, rsi
lea rdx, [rbp + 0x2c0]
test al, al
je 0x140023a95
lea rdx, [rsi + rdi]
jmp 0x140023a9f
add rdx, rdi
lea rsi, [rbp + 0x2c0]
mov qword [rsp + 0x28], rcx
lea r9, [rbp - 0x60]
lea r8, [rbp + 0x60]
mov rcx, rsi
call fcn.1400247c0
mov r15, qword [rbp + 0x70]
test al, al
je 0x14002403a
cmp qword [rbp + 0x78], r15
lea rcx, [rbp + 0xb8]
cmovne rcx, r15
cmp byte [rcx + 0x10], 0
je 0x140023ade
movups xmm0, xmmword [rcx]
movups xmmword [rbp - 0x38], xmm0
jmp 0x140023ae6
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x2e0], xmm0
xor r14d, r14d
mov qword [rbp + 0x2f0], r14
mov qword [rbp + 0x2f8], r14
mov rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x30]
cmp rdx, r8
jne 0x140023b2d
mov edx, r14d
mov qword [rbp + 0x2f0], rdx
mov r8d, 0xf
mov qword [rbp + 0x2f8], r8
mov byte [rbp + 0x2e0], dl
jmp 0x140023b4a
sub r8, rdx
lea rcx, [rbp + 0x2e0]
call fcn.140009020
mov r8, qword [rbp + 0x2f8]
mov rdx, qword [rbp + 0x2f0]
or r13d, 7
mov dword [rsp + 0x50], r13d
lea rsi, [rbp + 0x2e0]
cmp r8, 0xf
seta cl
mov r9, qword [rbp + 0x2e0]
cmova rsi, r9
add rsi, rdx
lea rax, [rbp + 0x2e0]
test cl, cl
je 0x140023b80
lea rbx, [rdx + r9]
jmp 0x140023b8b
lea rbx, [rax + rdx]
lea r9, [rbp + 0x2e0]
mov r8b, 0x22
mov rdx, rbx
mov rcx, r9
call fcn.14002dd80
mov r10, rax
cmp rax, rbx
je 0x140023bc6
inc rax
cmp rax, rbx
je 0x140023bc6
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, 0x22
je 0x140023bbe
mov byte [r10], cl
inc r10
inc rax
cmp rax, rbx
jne 0x140023bb0
lea rcx, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], 0xf
seta r8b
cmova rcx, qword [rbp + 0x2e0]
mov r9, r10
sub r9, rcx
sub rsi, r10
mov rdi, qword [rbp + 0x2f0]
mov rax, rdi
sub rax, r9
cmp rax, rsi
cmovb rsi, rax
lea rcx, [rbp + 0x2e0]
test r8b, r8b
cmovne rcx, qword [rbp + 0x2e0]
add rcx, r9
sub rdi, rsi
mov r8, rdi
sub r8, r9
inc r8
lea rdx, [rcx + rsi]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x2f0], rdi
lea r8, [rbp + 0x2e0]
lea rdx, [rbp + 0x278]
lea rcx, [rsp + 0x58]
call fcn.140024ad0
mov rbx, qword [rbp + 0x288]
cmp byte [rbx + 0x19], 0
jne 0x140023c73
lea r8, [rbx + 0x20]
lea rdx, [rbp + 0x2e0]
call fcn.140024c70
test al, al
jne 0x140023c73
cmp rbx, qword [rsp + 0x58]
jne 0x140023ff9
lea rax, [rbp + 0x320]
mov qword [rbp], rax
lea rsi, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], 0xf
cmova rsi, qword [rbp + 0x2e0]
call fcn.14002d53c
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x320], xmm0
xor eax, eax
mov qword [rbp + 0x330], rax
mov qword [rbp + 0x338], 7
mov word [rbp + 0x320], ax
or r13d, 0x40
mov dword [rsp + 0x50], r13d
test rdi, rdi
je 0x140023d4f
cmp rdi, 0x7fffffff
ja 0x140024413
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov ecx, r14d
call fcn.14002d564
mov rbx, rax
mov qword [rsp + 0x70], rax
shr rax, 0x20
test eax, eax
jne 0x140024409
movsxd rdx, ebx
lea rcx, [rbp + 0x320]
call fcn.140019190
lea r9, [rbp + 0x320]
cmp qword [rbp + 0x338], 7
cmova r9, qword [rbp + 0x320]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, rsi
mov ecx, r14d
call fcn.14002d564
mov qword [rsp + 0x70], rax
shr rax, 0x20
test eax, eax
jne 0x1400243ff
and r13d, 0xffffffbf
or r13d, 0x30
mov dword [rsp + 0x50], r13d
lea rdx, [rbp + 0x320]
lea rcx, [rbp + 0x250]
call fcn.140007ba0
movsd xmm0, qword [rax]
movsd qword [rbp + 0x20], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 0x10], ecx
lea rax, [0x1400430c8]
mov qword [rbp + 0x18], rax
movaps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp], xmm0
mov eax, dword [rbp + 0x20]
test eax, eax
je 0x140023da1
cmp eax, 1
setne bl
jmp 0x140023dab
xor bl, bl
test ecx, ecx
jne 0x1400243ee
mov r8, qword [rbp + 0x338]
cmp r8, 7
jbe 0x140023dc4
mov rdx, qword [rbp + 0x320]
call fcn.140003220
test bl, bl
je 0x140023eea
xorps xmm0, xmm0
movups xmmword [rbp + 0x340], xmm0
xor r14d, r14d
mov qword [rbp + 0x350], r14
mov qword [rbp + 0x358], 7
mov word [rbp + 0x340], r14w
lea r8, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], 0xf
cmova r8, qword [rbp + 0x2e0]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, r12d
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
test eax, eax
jle 0x140023e82
lea rdx, [rbx - 1]
lea rcx, [rbp + 0x340]
call fcn.140019190
lea rcx, [rbp + 0x340]
cmp qword [rbp + 0x358], 7
cmova rcx, qword [rbp + 0x340]
lea r8, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], 0xf
cmova r8, qword [rbp + 0x2e0]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
mov r9d, r12d
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdx, [rbp + 0x340]
call fcn.14002c8a0
test al, al
jne 0x140023edc
lea rdx, [0x140031eb8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009ab0
lea rdx, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], 0xf
cmova rdx, qword [rbp + 0x2e0]
mov r8, qword [rbp + 0x2f0]
mov rcx, rax
call fcn.140024600
lea rdx, [0x140009c80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x340]
call fcn.140002fa0
jmp 0x140023f36
lea rdx, str.___Executed__Deleted_file:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009ab0
lea rdx, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], 0xf
cmova rdx, qword [rbp + 0x2e0]
mov r8, qword [rbp + 0x2f0]
mov rcx, rax
call fcn.140024600
lea rdx, [0x140009c80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r14d, r14d
lea r8, [rbp + 0x2e0]
lea rdx, [rbp + 0x2a8]
lea rcx, [rsp + 0x58]
call fcn.140024ad0
movups xmm6, xmmword [rax]
movsd xmm0, qword [rax + 0x10]
movsd qword [rbp + 0x2a0], xmm0
mov r8, qword [rbp + 0x2a0]
cmp byte [r8 + 0x19], 0
jne 0x140023f80
add r8, 0x20
lea rdx, [rbp + 0x2e0]
call fcn.140024c70
test al, al
je 0x140023ff9
movabs rax, 0x3ffffffffffffff
cmp qword [rsp + 0x60], rax
je 0x140024419
mov rdi, qword [rsp + 0x58]
lea rax, [rsp + 0x58]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], r14
mov ecx, 0x40
call fcn.14002e3f8
mov rbx, rax
mov qword [rbp - 0x20], rax
lea rcx, [rax + 0x20]
lea rdx, [rbp + 0x2e0]
call fcn.140008730
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov word [rbx + 0x18], 0
mov qword [rbp - 0x20], r14
movaps xmmword [rbp + 0xe0], xmm6
mov r8, rbx
lea rdx, [rbp + 0xe0]
lea rcx, [rsp + 0x58]
call fcn.140003f10
nop
mov rdx, qword [rbp + 0x2f8]
cmp rdx, 0xf
jbe 0x14002403a
inc rdx
mov rcx, qword [rbp + 0x2e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024035
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400243d2
call fcn.14002e2d0
mov r14, qword [rbp + 0x2d8]
mov rdi, qword [rbp + 0x2d0]
mov rsi, qword [rbp + 0x2c0]
jmp 0x140024055
mov r15, qword [rbp + 0x70]
lea rdx, [rbp + 0x2c0]
cmp r14, 0xf
cmova rdx, rsi
mov r8, rdi
lea rcx, [rbp + 0x300]
call fcn.140012320
nop
test r15, r15
je 0x1400240cb
mov rax, qword [rbp + 0x80]
sub rax, r15
sar rax, 3
movabs rcx, 0xaaaaaaaaaaaaaaab
imul rax, rcx
lea rdx, [rax + rax*2]
shl rdx, 3
mov rax, r15
cmp rdx, 0x1000
jb 0x1400240c2
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400243d9
mov rcx, r15
call fcn.14002e2d0
nop
mov rbx, qword [rbp - 0x80]
test rbx, rbx
je 0x140024172
mov rdi, qword [rbp - 0x78]
cmp rbx, rdi
je 0x14002413a
xor r15d, r15d
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14002411e
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140024119
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400243e0
mov rcx, r8
call fcn.14002e2d0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r15b
add rbx, 0x20
cmp rbx, rdi
jne 0x1400240e4
mov rbx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x70]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x14002416a
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400243e0
mov rcx, rbx
call fcn.14002e2d0
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x160]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x160]
call fcn.140021e70
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
mov r15d, 0
jne 0x140023470
lea rbx, vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
lea rdi, [0x1400361a8]
lea rsi, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov rdx, qword [rbp + 0x2d8]
cmp rdx, 0xf
jbe 0x14002421a
inc rdx
mov rcx, qword [rbp + 0x2c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024215
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400243e7
call fcn.14002e2d0
mov qword [rbp + 0x2d0], r15
mov qword [rbp + 0x2d8], 0xf
mov byte [rbp + 0x2c0], 0
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x160], rbx
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x90]
mov dword [rbp + rcx + 0x15c], edx
lea rcx, [rbp + 0x170]
call fcn.140021760
lea rcx, [rbp + 0x178]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov r8, qword [rbp + 0x378]
cmp r8, 0xf
jbe 0x14002429e
mov rdx, qword [rbp + 0x360]
call fcn.1400089f0
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x68]
mov r8d, 0x1000
lea rdx, [rbp + 0x4a0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140023303
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x300]
call fcn.140008690
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x460]
call fcn.140002fa0
nop
mov rax, qword [rbp - 0x60]
test rax, rax
je 0x14002434c
lock xadd dword [rax + 0x2c], r12d
cmp r12d, 1
jne 0x14002434c
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x14002434c
nop
mov rcx, rbx
lea rax, [rbx + 0x10]
mov rbx, qword [rax]
mov qword [rax], r15
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
test rbx, rbx
jne 0x140024330
mov qword [rbp - 0x60], r15
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140024376
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x140024376
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
nop
mov r8, qword [rsp + 0x58]
mov r8, qword [r8 + 8]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.140024ba0
mov edx, 0x40
mov rcx, qword [rsp + 0x58]
call fcn.14002e2d0
mov rcx, qword [rbp + 0x14a0]
xor rcx, rsp
call fcn.14002e2b0
lea r11, [rsp + 0x15c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea r8, [rbp + 0x320]
lea rdx, [rbp]
call fcn.140007ad0
nop
mov ecx, dword [rsp + 0x74]
call fcn.140007360
int3
mov ecx, dword [rsp + 0x74]
call fcn.140007360
int3
call fcn.140007080
nop
call fcn.140002070
int3