Function at 0x14001df40
Capabilities:
Execute command
Hash data using fnv
Self delete

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov byte [rsp + 8], cl
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x8c0
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rsp + 0x8b0], rax
xor r14d, r14d
mov r15d, r14d
mov dword [rsp + 0x30], r14d
test cl, cl
jne 0x14001dfc6
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [r14 + 0xe]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Memory_Scanner__Loading_USNJournal_into_memory..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006b20
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, ds:[r14 + 7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xorps xmm0, xmm0
movups xmmword [rsp + 0x670], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x680], xmm1
mov r8d, 0x55
lea rdx, str.fsutil_usn_readjournal_c:_csv__findstr__i__c:0x80000200__c:0x00001000____journal.txt
lea rcx, [rsp + 0x670]
call fcn.140006d20
nop
lea rcx, [rsp + 0x670]
cmp qword [rsp + 0x688], 8
cmovae rcx, qword [rsp + 0x670]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wsystem]
nop dword [rax + rax]
test eax, eax
jne 0x14001e477
lea rcx, [rsp + 0x160]
call fcn.1400085c0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x5b0], xmm0
mov qword [rsp + 0x5c0], r14
mov qword [rsp + 0x5c8], 7
mov word [rsp + 0x5b0], r14w
movups xmmword [rsp + 0x590], xmm0
mov qword [rsp + 0x5a0], r14
mov qword [rsp + 0x5a8], 7
mov word [rsp + 0x590], r14w
movups xmmword [rsp + 0x5f0], xmm0
mov qword [rsp + 0x600], 0xb
mov qword [rsp + 0x608], 0xf
movsd xmm0, qword [0x140057068]
movsd qword [rsp + 0x5f0], xmm0
movzx eax, word [0x140057070]
mov word [rsp + 0x5f8], ax
movzx eax, byte [0x140057072]
mov byte [rsp + 0x5fa], al
mov byte [rsp + 0x5fb], 0
lea rdx, str.Dump_the__csrss.exe__process_with_the_MOST_private_bytes_using_System_Informer_and_save_the_results_to_any_directory._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006b20
xorps xmm0, xmm0
movups xmmword [rsp + 0x770], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x780], xmm1
mov r8d, 0x99
lea rdx, str.After_doing_this__enter_here_the_full_path_of_the_results_file._Type_cancel_to_exit_this_check_if_you_cant_dump_csrss_or_theres_no_strings_inside_it:
lea rcx, [rsp + 0x770]
call fcn.140006d20
nop
lea rdx, [rsp + 0x770]
lea rcx, [rsp + 0x830]
call fcn.14001d880
mov rbx, rax
lea rax, [rsp + 0x5b0]
cmp rax, rbx
je 0x14001e1d5
mov rdx, qword [rsp + 0x5c8]
cmp rdx, 8
jb 0x14001e191
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x5b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e18c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e21e
call fcn.140048710
mov qword [rsp + 0x5c0], r14
mov qword [rsp + 0x5c8], 7
mov word [rsp + 0x5b0], r14w
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x5b0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x5c0], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword ds:[rsp + 0x848]
cmp rdx, 8
jb 0x14001e22c
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rsp + 0x830]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e227
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001e227
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048710
movdqa xmm0, xmmword [0x14005c320]
movdqu xmmword [rsp + 0x840], xmm0
mov word [rsp + 0x830], r14w
mov rdx, qword [rsp + 0x788]
cmp rdx, 8
jb 0x14001e292
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x770]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e28d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001e28d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048710
cmp qword ds:[rsp + 0x5c0], 0
jne 0x14001e4fc
lea rax, [rsp + 0x5f0]
cmp qword [rsp + 0x608], 0x10
cmovae rax, qword [rsp + 0x5f0]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x600]
mov qword [rsp + 0xe8], rax
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x810]
call fcn.140022800
nop
lea rcx, [rsp + 0x810]
cmp qword [rsp + 0x828], 8
cmovae rcx, qword [rsp + 0x810]
call fcn.140047f4c
shr rax, 0x20
test eax, eax
jne 0x140020538
lea rcx, [rsp + 0x810]
call fcn.140005e00
nop
mov rdx, qword [rsp + 0x608]
cmp rdx, 0x10
jb 0x14001e36f
inc rdx
mov rcx, qword [rsp + 0x5f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e36a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140020432
call fcn.140048710
mov qword [rsp + 0x600], r14
mov qword [rsp + 0x608], 0xf
mov byte [rsp + 0x5f0], 0
mov rdx, qword [rsp + 0x5a8]
cmp rdx, 8
jb 0x14001e3d6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x590]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e3d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001e3d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048710
mov qword ds:[rsp + 0x5a0], r14
mov qword [rsp + 0x5a8], 7
mov word [rsp + 0x590], r14w
mov rdx, qword [rsp + 0x5c8]
cmp rdx, 8
jb 0x14001e44c
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rsp + 0x5b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e447
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001e447
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048710
mov qword [rsp + 0x5c0], r14
mov qword [rsp + 0x5c8], 7
mov word [rsp + 0x5b0], r14w
lea rcx, [rsp + 0x160]
call fcn.140008540
nop
mov rdx, qword ds:[rsp + 0x688]
cmp rdx, 8
jb 0x14001e4cf
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rsp + 0x670]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e4ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140020531
call fcn.140048710
mov rcx, qword [rsp + 0x8b0]
xor rcx, rsp
call fcn.1400486f0
lea r11, [rsp + 0x8c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rdx, str.Now__repeat_the_same_process_again__but_now_dump_the__csrss.exe__process_with_the_LESS_private_bytes._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006b20
xorps xmm0, xmm0
movups xmmword [rsp + 0x790], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x7a0], xmm1
mov r8d, 0x8e
lea rdx, str.Enter_here_the_full_path_of_the_second_results_file._Type_cancel_to_exit_this_check_if_you_cant_dump_csrss_or_theres_no_strings_inside_it:
lea rcx, [rsp + 0x790]
call fcn.140006d20
nop
lea rdx, [rsp + 0x790]
lea rcx, [rsp + 0x890]
call fcn.14001d880
mov rbx, rax
lea rax, [rsp + 0x590]
cmp rax, rbx
je 0x14001e5fe
mov rdx, qword [rsp + 0x5a8]
cmp rdx, 8
jb 0x14001e5ba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x590]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e5b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001e5b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048710
mov qword [rsp + 0x5a0], r14
mov qword [rsp + 0x5a8], 7
mov word [rsp + 0x590], r14w
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x590], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x5a0], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
lea rcx, [rsp + 0x890]
call fcn.140005e00
nop
mov rdx, qword [rsp + 0x7a8]
cmp rdx, 8
jb 0x14001e657
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x790]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e652
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001e652
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048710
cmp qword [rsp + 0x5a0], 0
jne 0x14001e7ff
lea rax, [rsp + 0x5f0]
cmp qword [rsp + 0x608], 0x10
cmovae rax, qword [rsp + 0x5f0]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x600]
mov qword [rsp + 0xf8], rax
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x7b0]
call fcn.140022800
nop
lea rcx, [rsp + 0x7b0]
cmp qword [rsp + 0x7c8], 8
cmovae rcx, qword [rsp + 0x7b0]
call fcn.140047f4c
shr rax, 0x20
test eax, eax
jne 0x14002054f
lea rcx, [rsp + 0x7b0]
call fcn.140005e00
nop
mov rdx, qword [rsp + 0x608]
cmp rdx, 0x10
jb 0x14001e72f
inc rdx
mov rcx, qword [rsp + 0x5f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e72a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140020432
call fcn.140048710
mov qword [rsp + 0x600], r14
mov qword [rsp + 0x608], 0xf
mov byte [rsp + 0x5f0], 0
mov r8, qword [rsp + 0x5a8]
cmp r8, 8
jb 0x14001e769
inc r8
mov rdx, qword [rsp + 0x590]
call fcn.140006640
mov qword [rsp + 0x5a0], r14
mov qword [rsp + 0x5a8], 7
mov word [rsp + 0x590], r14w
mov r8, qword [rsp + 0x5c8]
cmp r8, 8
jb 0x14001e7a5
inc r8
mov rdx, qword [rsp + 0x5b0]
call fcn.140006640
mov qword [rsp + 0x5c0], r14
mov qword [rsp + 0x5c8], 7
mov word [rsp + 0x5b0], r14w
lea rcx, [rsp + 0x160]
call fcn.140008540
nop
mov r8, qword [rsp + 0x688]
cmp r8, 8
jb 0x14001e4cf
inc r8
mov rdx, qword [rsp + 0x670]
call fcn.140006640
jmp 0x14001e4cf
lea rdx, [rsp + 0x5b0]
cmp qword [rsp + 0x5c8], 8
cmovae rdx, qword [rsp + 0x5b0]
lea rcx, [rsp + 0x350]
call fcn.140021160
nop
lea rdx, [rsp + 0x590]
cmp qword [rsp + 0x5a8], 8
cmovae rdx, qword [rsp + 0x590]
lea rcx, [rsp + 0x460]
call fcn.140021160
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x850], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x860], xmm1
mov r8d, 0xb
lea rdx, str.journal.txt
lea rcx, [rsp + 0x850]
call fcn.140006d20
nop
lea rdx, [rsp + 0x850]
lea rcx, [rsp + 0x1a0]
call fcn.14001d5e0
nop
lea rcx, [rsp + 0x850]
call fcn.140005e00
lea rdx, str.___._.exe.dll.dll...config.exe.config____A_Z_:...
lea rcx, [rsp + 0x2a0]
call fcn.140020600
nop
lea rdx, str._A_Za_z_:._.dll
lea rcx, [rsp + 0x278]
call fcn.140020600
nop
lea rdx, str._A_Za_z_:._.exe
lea rcx, [rsp + 0x250]
call fcn.140020600
nop
lea rdx, str._A_Za_z_:__:_.___.__
lea rcx, [rsp + 0x228]
call fcn.140020600
nop
lea rdx, str.____:_.___.__
lea rcx, [rsp + 0x200]
call fcn.140020600
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x610], xmm0
mov qword [rsp + 0x620], r14
mov qword [rsp + 0x628], 7
mov word [rsp + 0x610], r14w
xor bl, bl
mov byte [rsp + 0x34], bl
lea r12, [0x14006b078]
movabs r13, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop dword [rax + rax]
test bl, bl
jne 0x140020370
cmp byte [rsp + 0x8f0], bl
jne 0x14001e9ff
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Memory_Scanner__Scanning_DLL_Injections..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006b20
lea rdx, str._Memory_Scanner__Scanning_executed_files_with_modified_extensions..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006b20
lea rdx, str._Memory_Scanner__Scanning_executed_files_without_extension..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006b20
lea rdx, str._Memory_Scanner__Scanning_executed_files_without_name..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop dword [rax + rax]
call fcn.140006b20
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
nop
mov rax, qword [rsp + 0x350]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x350]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
movzx r8d, ax
lea rdx, [rsp + 0x610]
lea rcx, [rsp + 0x350]
call fcn.140021f40
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x14001face
mov r8, qword [rsp + 0x620]
cmp r8, 0x190
ja 0x14001ea00
lea rdx, [rsp + 0x610]
cmp qword [rsp + 0x628], 8
cmovae rdx, qword [rsp + 0x610]
test r8, r8
je 0x14001ea00
mov rax, r8
mov rcx, rdx
mov rdi, r14
cmp word [rdx], 0x3a
je 0x14001eaa3
nop dword [rax]
cmp rax, 1
je 0x14001eaa6
dec rax
add rcx, 2
cmp word [rcx], 0x3a
jne 0x14001ea90
mov rdi, rcx
test rdi, rdi
je 0x14001ea00
sub rdi, rdx
sar rdi, 1
cmp rdi, 0xffffffffffffffff
je 0x14001ea00
lea rcx, [rdi + 2]
cmp rcx, r8
jae 0x14001ea00
xorps xmm0, xmm0
movups xmmword [rsp + 0x570], xmm0
mov qword [rsp + 0x580], r14
mov qword [rsp + 0x588], r14
ja 0x140020566
lfence
mov rax, qword [rsp + 0x620]
sub rax, rcx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rax, [rsp + 0x610]
cmp qword [rsp + 0x628], 8
cmovae rax, qword [rsp + 0x610]
lea rdx, [rax + rcx*2]
lea rcx, [rsp + 0x570]
call fcn.140006d20
mov r15d, dword [rsp + 0x30]
or r15d, 0x10
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rcx, qword [rsp + 0x570]
mov rax, qword [rsp + 0x580]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x2a0]
call fcn.140022120
nop dword [rax]
test al, al
je 0x14001f2c5
lea r8, [rsp + 0x570]
mov rdi, qword [rsp + 0x570]
mov rsi, qword [rsp + 0x588]
cmp rsi, 8
cmovae r8, rdi
movabs rdx, 0xcbf29ce484222325
mov rbx, qword [rsp + 0x580]
lea r9, [rbx + rbx]
mov rcx, r14
test r9, r9
je 0x14001ebe5
nop word [rax + rax]
movzx eax, byte ds:[rcx + r8]
xor rdx, rax
imul rdx, r13
inc rcx
cmp rcx, r9
jb 0x14001ebd0
mov rcx, qword [rsp + 0x190]
and rcx, rdx
add rcx, rcx
mov rax, qword [rsp + 0x178]
mov r9, qword [rax + rcx*8 + 8]
mov r10, qword [rsp + 0x168]
cmp r9, r10
je 0x14001ec71
mov r11, qword [rax + rcx*8]
lea rcx, ds:[r9 + 0x10]
mov rax, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x14001ec25
mov rcx, qword [rcx]
lea r8, [rsp + 0x570]
cmp rsi, 8
cmovae r8, rdi
cmp rbx, rax
jne 0x14001ec68
mov rdx, rbx
test rbx, rbx
je 0x14001ec74
sub r8, rcx
nop dword [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x14001ec68
add rcx, 2
sub rdx, 1
jne 0x14001ec50
jmp 0x14001ec74
cmp r9, r11
jne 0x14001f2bb
mov r9, r14
mov rax, r10
test r9, r9
cmovne rax, r9
cmp rax, r10
jne 0x14001efd3
lea rdx, ds:[rsp + 0x570]
cmp rsi, 8
cmovae rdx, rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x6f0], xmm0
mov qword [rsp + 0x700], r14
mov qword [rsp + 0x708], r14
mov r8, rbx
lea rcx, [rsp + 0x6f0]
call fcn.140006d20
or r15d, 0x3000
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x6f0]
call fcn.140004fb0
test al, al
sete bl
mov rdx, qword [rsp + 0x708]
cmp rdx, 8
jb 0x14001ed32
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x6f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ed2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ed2d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048710
mov qword [rsp + 0x700], r14
mov qword [rsp + 0x708], 7
mov word [rsp + 0x6f0], r14w
test bl, bl
je 0x14001efbb
lea rax, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rax, qword [rsp + 0x570]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x580]
mov qword [rsp + 0x88], rax
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x130], xmm0
lea rcx, [rsp + 0x130]
call fcn.140005120
test al, al
jne 0x14001efbb
lea rcx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rcx, qword [rsp + 0x570]
mov qword [rsp + 0x20], 3
lea r9, [0x1400521c8]
xor r8d, r8d
mov rdx, qword [rsp + 0x580]
call fcn.140009040
cmp rax, 0xffffffffffffffff
jne 0x14001eeaa
lea rcx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rcx, qword [rsp + 0x570]
mov qword [rsp + 0x20], 3
lea r9, [0x140057940]
xor r8d, r8d
mov rdx, qword [rsp + 0x580]
call fcn.140009040
cmp rax, 0xffffffffffffffff
jne 0x14001eeaa
lea rdx, str.___Executed__Deleted_file_with_a_modified_extension:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006b20
lea rdx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rdx, qword [rsp + 0x570]
mov r8, qword [rsp + 0x580]
mov rcx, rax
call fcn.140009300
lea rdx, [0x140008c60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, ds:[rsp + 0x570]
lea rdx, [rsp + 0x2c8]
lea rcx, [0x14006e8e0]
call fcn.1400068a0
jmp 0x14001efbb
lea rdx, [rsp + 0x570]
mov rdi, qword [rsp + 0x570]
mov rsi, qword [rsp + 0x588]
cmp rsi, 8
cmovae rdx, rdi
movabs r9, 0xcbf29ce484222325
mov rbx, qword [rsp + 0x580]
lea r8, [rbx + rbx]
mov rcx, r14
test r8, r8
je 0x14001ef05
nop dword [rax + rax]
movzx eax, byte ds:[rcx + rdx]
xor r9, rax
imul r9, r13
inc rcx
cmp rcx, r8
jb 0x14001eef0
lea r8, ds:[rsp + 0x570]
lea rdx, [rsp + 0x2d8]
lea rcx, [rsp + 0x1a0]
call fcn.140007240
mov rcx, qword ds:[rax + 8]
mov rax, qword [rsp + 0x1a8]
test rcx, rcx
cmovne rax, rcx
cmp rax, qword [rsp + 0x1a8]
je 0x14001efd3
lea rdx, str.___Executed__Deleted_file_with_a_modified_extension:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop dword [rax]
call fcn.140006b20
lea rdx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rdx, qword [rsp + 0x570]
mov r8, qword [rsp + 0x580]
mov rcx, rax
call fcn.140009300
lea rdx, [0x140008c60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rsp + 0x570]
lea rdx, [rsp + 0x2e8]
lea rcx, [0x14006e8e0]
call fcn.1400068a0
mov rdi, qword [rsp + 0x570]
mov rbx, qword [rsp + 0x580]
mov rsi, qword [rsp + 0x588]
lea rdx, [rsp + 0x570]
cmp rsi, 8
cmovae rdx, rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x630], xmm0
mov qword [rsp + 0x640], r14
mov qword [rsp + 0x648], r14
mov r8, rbx
lea rcx, [rsp + 0x630]
call fcn.140006d20
or r15d, 0xc00
or r15d, 1
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x630]
cmp qword [rsp + 0x648], 8
cmovae rcx, qword [rsp + 0x630]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rsp + 0x870]
call fcn.140047bcc
mov r8d, eax
test eax, eax
jne 0x14001f09c
mov edx, dword [rsp + 0x880]
bt edx, 0xa
jae 0x14001f08e
mov eax, dword [rsp + 0x884]
cmp eax, 0xa000000c
jne 0x14001f079
lea eax, [r8 + 4]
jmp 0x14001f0c3
nop dword [rax]
cmp eax, 0xa0000003
jne 0x14001f08e
mov eax, 0xa
jmp 0x14001f0c3
movzx eax, dl
and eax, 0x10
or eax, 0x20
shr eax, 4
jmp 0x14001f0c3
mov dword [rsp + 0x104], 0xffff
sub eax, 2
je 0x14001f0be
sub eax, 1
je 0x14001f0be
sub eax, 0x32
je 0x14001f0be
cmp eax, 0x46
mov eax, r14d
jne 0x14001f0c3
mov eax, 1
mov dword [rsp + 0xb0], r8d
mov qword [rsp + 0xb8], r12
movaps xmm0, xmmword [rsp + 0xb0]
movdqa xmmword [rsp + 0x50], xmm0
test eax, eax
je 0x14001f139
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x58], r12
cmp eax, 1
je 0x14001f149
mov dword [rsp + 0x38], r14d
lea rcx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rcx, qword [rsp + 0x570]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
nop
test eax, eax
je 0x14001f149
lea rdx, [rsp + 0x570]
call fcn.140046b00
test al, al
jne 0x14001f149
mov bl, 1
jmp 0x14001f14b
nop dword [rax]
test r8d, r8d
jne 0x14002056c
xor bl, bl
test r15b, 1
je 0x14001f1c9
and r15d, 0xfffffffe
mov dword [rsp + 0x30], r15d
mov rdx, qword [rsp + 0x648]
cmp rdx, 8
jb 0x14001f1ac
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rsp + 0x630]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f1a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001f1a7
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048710
mov qword [rsp + 0x640], r14
mov qword [rsp + 0x648], 7
mov word [rsp + 0x630], r14w
test bl, bl
je 0x14001f21f
lea rdx, str.___Executed__Unsigned_file_with_a_modified_extension:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop dword [rax + rax]
call fcn.140006b20
lea rdx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rdx, qword [rsp + 0x570]
mov r8, qword [rsp + 0x580]
mov rcx, rax
call fcn.140009300
lea rdx, [0x140008c60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rsp + 0x570]
lea rdx, [rsp + 0x2f8]
lea rcx, [rsp + 0x160]
call fcn.1400068a0
nop
mov rdx, qword [rsp + 0x588]
cmp rdx, 8
jb 0x14001f28f
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rsp + 0x570]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f28a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001fa9e
call fcn.140048710
mov qword [rsp + 0x580], r14
mov qword [rsp + 0x588], 7
mov word [rsp + 0x570], r14w
movabs rsi, 0xcbf29ce484222325
jmp 0x14001ea00
mov r9, qword ds:[r9 + 8]
jmp 0x14001ec11
lea rcx, ds:[rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rcx, qword [rsp + 0x570]
mov rax, qword [rsp + 0x580]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x278]
call fcn.140022120
test al, al
je 0x14001f4b1
lea rax, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rax, qword [rsp + 0x570]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x580]
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x140], xmm0
lea rcx, [rsp + 0x140]
call fcn.140005120
nop dword [rax]
test al, al
jne 0x14001f4b1
lea rdx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rdx, qword [rsp + 0x570]
xorps xmm0, xmm0
movups xmmword [rsp + 0x7d0], xmm0
mov qword [rsp + 0x7e0], r14
mov qword [rsp + 0x7e8], r14
mov r8, qword [rsp + 0x580]
lea rcx, [rsp + 0x7d0]
call fcn.140006d20
or r15d, 0x600000
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x7d0]
call fcn.140004fb0
movzx ebx, al
lea rcx, [rsp + 0x7d0]
call fcn.140005e00
test bl, bl
je 0x14001f448
lea rdx, [rsp + 0x570]
call fcn.140046b00
test al, al
jne 0x14001f495
lea rdx, [0x140052490]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006b20
lea rdx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rdx, qword [rsp + 0x570]
mov r8, qword [rsp + 0x580]
mov rcx, rax
call fcn.140009300
lea rdx, [0x140008c60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x14001f495
lea rdx, [0x140057948]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006b20
lea rdx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rdx, qword [rsp + 0x570]
mov r8, qword [rsp + 0x580]
mov rcx, rax
call fcn.140009300
lea rdx, [0x140008c60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rsp + 0x570]
lea rdx, [rsp + 0x308]
lea rcx, [0x14006e8e0]
call fcn.1400068a0
lea rax, ds:[rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rax, qword [rsp + 0x570]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x580]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0x150], xmm0
lea rcx, [rsp + 0x150]
call fcn.140005120
test al, al
jne 0x14001fa54
lea rcx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rcx, qword [rsp + 0x570]
mov rax, qword [rsp + 0x580]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x228]
call fcn.140022120
test al, al
jne 0x14001f58f
lea rcx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rcx, qword [rsp + 0x570]
mov rax, qword [rsp + 0x580]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x200]
call fcn.140022120
test al, al
je 0x14001fa37
lea rdx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rdx, qword [rsp + 0x570]
xorps xmm0, xmm0
movups xmmword [rsp + 0x690], xmm0
mov qword [rsp + 0x6a0], r14
mov qword [rsp + 0x6a8], r14
mov r8, qword [rsp + 0x580]
lea rcx, [rsp + 0x690]
call fcn.140006d20
or r15d, 0x180000
or r15d, 2
mov dword [rsp + 0x30], r15d
lea rdx, [rsp + 0x690]
lea rcx, [rsp + 0x1e0]
call fcn.140005020
movsd xmm0, qword [rax]
movsd qword [rsp + 0x70], xmm0
mov edx, dword [rax + 8]
mov ecx, dword [rsp + 0x70]
test edx, edx
je 0x14001f62b
lea eax, ds:[rcx - 1]
test eax, 0xfffffff7
jne 0x14002057f
cmp ecx, 3
je 0x14001f69f
lea rdx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rdx, qword [rsp + 0x570]
xorps xmm0, xmm0
movups xmmword [rsp + 0x710], xmm0
mov qword [rsp + 0x720], r14
mov qword [rsp + 0x728], r14
mov r8, qword [rsp + 0x580]
lea rcx, [rsp + 0x710]
call fcn.140006d20
or r15d, 0x3000000
or r15d, 4
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x710]
call fcn.140004fb0
test al, al
je 0x14001f69f
mov bl, 1
jmp 0x14001f6a1
xor bl, bl
test r15b, 4
je 0x14001f6eb
and r15d, 0xfffffffb
mov dword [rsp + 0x30], r15d
mov r8, qword [rsp + 0x728]
cmp r8, 8
jb 0x14001f6ce
inc r8
mov rdx, qword [rsp + 0x710]
call fcn.140006640
mov qword [rsp + 0x720], r14
mov qword [rsp + 0x728], 7
mov word [rsp + 0x710], r14w
test r15b, 2
je 0x14001f735
and r15d, 0xfffffffd
mov dword [rsp + 0x30], r15d
mov r8, qword [rsp + 0x6a8]
cmp r8, 8
jb 0x14001f718
inc r8
mov rdx, qword [rsp + 0x690]
call fcn.140006640
mov qword [rsp + 0x6a0], r14
mov qword [rsp + 0x6a8], 7
mov word [rsp + 0x690], r14w
test bl, bl
je 0x14001f786
lea rdx, str.___Executed_file_without_extension:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006b20
lea rdx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rdx, qword [rsp + 0x570]
mov r8, qword [rsp + 0x580]
mov rcx, rax
call fcn.140009300
lea rdx, [0x140008c60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rdx, qword [rsp + 0x570]
xorps xmm0, xmm0
movups xmmword [rsp + 0x730], xmm0
mov qword [rsp + 0x740], r14
mov qword [rsp + 0x748], r14
mov r8, qword [rsp + 0x580]
lea rcx, [rsp + 0x730]
call fcn.140006d20
or r15d, 0x60000
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x730]
call fcn.140004fb0
test al, al
sete bl
mov r8, qword [rsp + 0x748]
cmp r8, 8
jb 0x14001f80c
inc r8
mov rdx, qword [rsp + 0x730]
call fcn.140006640
mov qword [rsp + 0x740], r14
mov qword [rsp + 0x748], 7
mov word [rsp + 0x730], r14w
test bl, bl
je 0x14001fa37
lea rcx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rcx, qword [rsp + 0x570]
mov qword [rsp + 0x20], 3
lea r9, [0x1400521c8]
xor r8d, r8d
mov rdx, qword [rsp + 0x580]
call fcn.140009040
cmp rax, 0xffffffffffffffff
jne 0x14001f950
lea rcx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rcx, qword [rsp + 0x570]
mov qword [rsp + 0x20], 3
lea r9, [0x140057940]
xor r8d, r8d
mov rdx, qword [rsp + 0x580]
call fcn.140009040
cmp rax, 0xffffffffffffffff
jne 0x14001f950
lea rcx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rcx, qword [rsp + 0x570]
lea r8, [rdi + 1]
mov qword [rsp + 0x20], 1
lea r9, [0x140051450]
mov rdx, qword [rsp + 0x580]
call fcn.140009040
cmp rax, 0xffffffffffffffff
je 0x14001fa37
lea rdx, str.___Executed__Deleted_file_without_extension__false_flags_here_cant_be_fixed_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006b20
lea rdx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rdx, qword [rsp + 0x570]
mov r8, qword [rsp + 0x580]
mov rcx, rax
call fcn.140009300
lea rdx, [0x140008c60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x14001fa37
lea rdx, ds:[rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rdx, qword [rsp + 0x570]
mov r9, rsi
mov rax, qword [rsp + 0x580]
lea r8, [rax + rax]
mov rcx, r14
test r8, r8
je 0x14001f9a5
nop word [rax + rax]
movzx eax, byte ds:[rcx + rdx]
xor r9, rax
imul r9, r13
inc rcx
cmp rcx, r8
jb 0x14001f990
lea r8, ds:[rsp + 0x570]
lea rdx, [rsp + 0x318]
lea rcx, [rsp + 0x1a0]
call fcn.140007240
mov rcx, qword ds:[rax + 8]
mov rax, qword [rsp + 0x1a8]
test rcx, rcx
cmovne rax, rcx
cmp rax, qword [rsp + 0x1a8]
je 0x14001fa37
lea rdx, str.___Executed__Deleted_file_without_extension:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006b20
lea rdx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rdx, qword [rsp + 0x570]
mov r8, qword [rsp + 0x580]
mov rcx, rax
call fcn.140009300
lea rdx, [0x140008c60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rsp + 0x570]
lea rdx, [rsp + 0x328]
lea rcx, [0x14006e8e0]
call fcn.1400068a0
nop
mov rdx, qword ds:[rsp + 0x588]
cmp rdx, 8
jb 0x14001faac
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rsp + 0x570]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001faa7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001faa7
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048710
mov qword [rsp + 0x580], r14
mov qword [rsp + 0x588], 7
mov word [rsp + 0x570], r14w
jmp 0x14001ea00
lea rcx, [rsp + 0x360]
call fcn.140021820
nop dword [rax + rax]
test rax, rax
jne 0x14001fb09
mov rax, qword [rsp + 0x350]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x350]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool____ptr64]
lea rdx, [rsp + 0x5b0]
cmp qword [rsp + 0x5c8], 8
cmovae rdx, qword [rsp + 0x5b0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x750], xmm0
mov qword [rsp + 0x760], r14
mov qword [rsp + 0x768], r14
mov r8, qword [rsp + 0x5c0]
lea rcx, [rsp + 0x750]
call fcn.140006d20
or r15d, 0x60
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x750]
cmp qword [rsp + 0x768], 8
cmovae rcx, qword [rsp + 0x750]
call fcn.140047f4c
shr rax, 0x20
test eax, eax
jne 0x140020594
lea rcx, [rsp + 0x750]
call fcn.140005e00
lea rdi, [0x140057068]
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xd8], 0xb
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x7f0]
call fcn.140022800
bts r15d, 9
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x7f0]
cmp qword [rsp + 0x808], 8
cmovae rcx, qword [rsp + 0x7f0]
call fcn.140047f4c
shr rax, 0x20
test eax, eax
jne 0x1400205ab
lea rcx, [rsp + 0x7f0]
call fcn.140005e00
nop
jmp 0x14001fc2d
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0xe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Memory_Scanner__Scanning_executed_and_unsigned_files..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006b20
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
nop word [rax + rax]
mov rax, qword [rsp + 0x460]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x460]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
movzx r8d, ax
lea rdx, [rsp + 0x610]
lea rcx, [rsp + 0x460]
call fcn.140021f40
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x14002022e
mov r9, qword [rsp + 0x620]
cmp r9, 0x190
ja 0x14001fc80
lea r8, [rsp + 0x610]
cmp qword [rsp + 0x628], 8
cmovae r8, qword [rsp + 0x610]
test r9, r9
je 0x14001fc80
mov rax, r9
mov rcx, r8
mov rdx, r14
cmp word [r8], 0x3a
je 0x14001fd23
nop word [rax + rax]
cmp rax, 1
je 0x14001fd26
dec rax
add rcx, 2
cmp word [rcx], 0x3a
jne 0x14001fd10
mov rdx, rcx
test rdx, rdx
je 0x14001fc80
sub rdx, r8
sar rdx, 1
cmp rdx, 0xffffffffffffffff
je 0x14001fc80
add rdx, 2
cmp rdx, r9
jae 0x14001fc80
xorps xmm0, xmm0
movups xmmword [rsp + 0x5d0], xmm0
mov qword [rsp + 0x5e0], r14
mov qword [rsp + 0x5e8], r14
ja 0x1400205c6
lfence
mov rax, qword [rsp + 0x620]
sub rax, rdx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rax, [rsp + 0x610]
cmp qword [rsp + 0x628], 8
cmovae rax, qword [rsp + 0x610]
lea rdx, [rax + rdx*2]
lea rcx, [rsp + 0x5d0]
call fcn.140006d20
mov r15d, dword [rsp + 0x30]
or r15d, 8
mov dword [rsp + 0x30], r15d
lea rdx, [rsp + 0x5d0]
cmp qword [rsp + 0x5e8], 8
cmovae rdx, qword [rsp + 0x5d0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x6b0], xmm0
mov qword [rsp + 0x6c0], r14
mov qword [rsp + 0x6c8], r14
mov r8, qword [rsp + 0x5e0]
lea rcx, [rsp + 0x6b0]
call fcn.140006d20
lea r8, ds:[rsp + 0x6b0]
mov r10, qword [rsp + 0x6b0]
mov r11, qword [rsp + 0x6c8]
cmp r11, 8
cmovae r8, r10
mov rcx, rsi
mov rbx, qword [rsp + 0x6c0]
lea r9, [rbx + rbx]
mov rdx, r14
test r9, r9
je 0x14001fe65
nop word [rax + rax]
movzx eax, byte ds:[rdx + r8]
xor rcx, rax
imul rcx, r13
inc rdx
cmp rdx, r9
jb 0x14001fe50
and rcx, qword [0x14006e910]
add rcx, rcx
mov rax, qword [0x14006e8f8]
mov r9, qword [rax + rcx*8 + 8]
mov rsi, qword [0x14006e8e8]
cmp r9, rsi
je 0x14001fee9
mov rdi, qword [rax + rcx*8]
nop dword [rax + rax]
lea rax, [r9 + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14001fea2
mov rax, qword [rax]
lea r8, [rsp + 0x6b0]
cmp r11, 8
cmovae r8, r10
cmp rbx, rcx
jne 0x14001fed8
mov rdx, rbx
test rbx, rbx
je 0x14001feec
sub r8, rax
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x14001fed8
add rax, 2
sub rdx, 1
jne 0x14001fec2
jmp 0x14001feec
nop dword [rax + rax]
cmp r9, rdi
jne 0x140020225
mov r9, r14
mov rbx, rsi
test r9, r9
cmovne rbx, r9
cmp r11, 8
jb 0x14001ff35
lea rdx, [r11*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x14001ff2d
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ff2d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r10
call fcn.140048710
mov qword [rsp + 0x6c0], r14
mov qword [rsp + 0x6c8], 7
mov word [rsp + 0x6b0], r14w
cmp rbx, rsi
jne 0x1400201ac
lea rcx, [rsp + 0x5d0]
cmp qword [rsp + 0x5e8], 8
cmovae rcx, qword [rsp + 0x5d0]
mov rax, qword [rsp + 0x5e0]
lea rdx, [rcx + rax*2]
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x250]
call fcn.140022120
test al, al
je 0x1400201ac
lea rdx, [rsp + 0x5d0]
cmp qword [rsp + 0x5e8], 8
cmovae rdx, qword [rsp + 0x5d0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x6d0], xmm0
mov qword [rsp + 0x6e0], r14
mov qword [rsp + 0x6e8], r14
mov r8, qword [rsp + 0x5e0]
lea rcx, [rsp + 0x6d0]
call fcn.140006d20
or r15d, 0xc000
mov dword [rsp + 0x30], r15d
lea rdx, [rsp + 0x6d0]
lea rcx, [rsp + 0x1f0]
call fcn.140005020
movsd xmm0, qword ds:[rax]
movsd qword [rsp + 0x110], xmm0
mov ecx, dword [rax + 8]
mov dword [rsp + 0x90], ecx
mov qword [rsp + 0x98], r12
movaps xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x60], xmm0
mov eax, dword [rsp + 0x110]
test eax, eax
je 0x1400200a7
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x68], r12
cmp eax, 1
setne bl
mov rdx, qword ds:[rsp + 0x6e8]
cmp rdx, 8
jb 0x1400200b8
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rsp + 0x6d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400200b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400200b3
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor bl, bl
test ecx, ecx
jne 0x1400205cc
jmp 0x140020054
call fcn.140048710
mov qword [rsp + 0x6e0], r14
mov qword [rsp + 0x6e8], 7
mov word [rsp + 0x6d0], r14w
test bl, bl
je 0x140020142
lea rdx, [rsp + 0x5d0]
call fcn.140046b00
test al, al
jne 0x14002018f
lea rdx, [0x140052490]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop dword [rax]
call fcn.140006b20
lea rdx, [rsp + 0x5d0]
cmp qword [rsp + 0x5e8], 8
cmovae rdx, qword [rsp + 0x5d0]
mov r8, qword [rsp + 0x5e0]
mov rcx, rax
call fcn.140009300
lea rdx, [0x140008c60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
jmp 0x14002018f
lea rdx, [0x140057948]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006b20
lea rdx, [rsp + 0x5d0]
cmp qword [rsp + 0x5e8], 8
cmovae rdx, qword [rsp + 0x5d0]
mov r8, qword [rsp + 0x5e0]
mov rcx, rax
call fcn.140009300
lea rdx, [0x140008c60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rsp + 0x5d0]
lea rdx, [rsp + 0x338]
lea rcx, [0x14006e8e0]
call fcn.1400068a0
nop
mov rdx, qword [rsp + 0x5e8]
cmp rdx, 8
jb 0x1400201f7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x5d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400201f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400201f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048710
mov qword ds:[rsp + 0x5e0], r14
mov qword [rsp + 0x5e8], 7
mov word [rsp + 0x5d0], r14w
movabs rsi, 0xcbf29ce484222325
jmp 0x14001fc80
mov r9, qword [r9 + 8]
jmp 0x14001fe90
lea rcx, [rsp + 0x470]
call fcn.140021820
nop dword [rax + rax]
test rax, rax
jne 0x140020269
mov rax, qword [rsp + 0x460]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x460]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool____ptr64]
mov bl, 1
mov byte [rsp + 0x34], bl
lea rdx, [rsp + 0x590]
cmp qword [rsp + 0x5a8], 8
cmovae rdx, qword [rsp + 0x590]
xorps xmm0, xmm0
movups xmmword [rsp + 0x650], xmm0
mov qword [rsp + 0x660], r14
mov qword [rsp + 0x668], r14
mov r8, qword [rsp + 0x5a0]
lea rcx, [rsp + 0x650]
call fcn.140006d20
or r15d, 0x180
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x650]
cmp qword [rsp + 0x668], 8
cmovae rcx, qword [rsp + 0x650]
call fcn.140047f4c
shr rax, 0x20
test eax, eax
jne 0x1400205df
mov rdx, qword [rsp + 0x668]
cmp rdx, 8
jb 0x14002033c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x650]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020337
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020337
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048710
mov qword [rsp + 0x660], r14
mov qword [rsp + 0x668], 7
mov word [rsp + 0x650], r14w
jmp 0x14001e960
lea rcx, [rsp + 0x610]
call fcn.140005e00
nop
lea rcx, [rsp + 0x200]
call fcn.140016620
nop
lea rcx, [rsp + 0x228]
call fcn.140016620
nop
lea rcx, [rsp + 0x250]
call fcn.140016620
nop
lea rcx, [rsp + 0x278]
call fcn.140016620
nop
lea rcx, [rsp + 0x2a0]
call fcn.140016620
nop
lea rcx, [rsp + 0x1a0]
call fcn.140008540
nop
lea rcx, [rsp + 0x460]
call fcn.14001d800
nop
lea rcx, [rsp + 0x350]
call fcn.14001d800
nop
mov rdx, qword [rsp + 0x608]
cmp rdx, 0x10
jb 0x14002043e
inc rdx
mov rcx, qword [rsp + 0x5f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020439
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020439
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048710
mov qword [rsp + 0x600], r14
mov qword [rsp + 0x608], 0xf
mov byte [rsp + 0x5f0], 0
mov r8, qword [rsp + 0x5a8]
cmp r8, 8
jb 0x140020478
inc r8
mov rdx, qword [rsp + 0x590]
call fcn.140006640
mov qword ds:[rsp + 0x5a0], r14
mov qword [rsp + 0x5a8], 7
mov word [rsp + 0x590], r14w
mov r8, qword [rsp + 0x5c8]
cmp r8, 8
jb 0x1400204b6
inc r8
mov rdx, qword [rsp + 0x5b0]
call fcn.140006640
mov qword ds:[rsp + 0x5c0], r14
mov qword [rsp + 0x5c8], 7
mov word [rsp + 0x5b0], r14w
lea rcx, [rsp + 0x160]
call fcn.140008540
nop
mov rdx, qword [rsp + 0x688]
cmp rdx, 8
jb 0x14001e4cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x670]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e4ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001e4ca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea r8, [rsp + 0x810]
mov edx, eax
lea rcx, [0x140056d10]
call fcn.14000a180
nop
lea r8, [rsp + 0x7b0]
mov edx, eax
lea rcx, [0x140056d10]
call fcn.14000a180
nop
call fcn.1400089a0
nop
lea r8, [rsp + 0x630]
lea rdx, [rsp + 0x50]
call fcn.140004f50
nop
lea r8, [rsp + 0x690]
lea rcx, str.status
call fcn.14000a180
nop
lea r8, [rsp + 0x750]
mov edx, eax
lea rcx, [0x140056d10]
call fcn.14000a180
nop
lea r8, ds:[rsp + 0x7f0]
mov edx, eax
lea rcx, [0x140056d10]
call fcn.14000a180
nop
call fcn.1400089a0
nop
lea r8, [rsp + 0x6d0]
lea rdx, [rsp + 0x60]
call fcn.140004f50
nop
lea r8, [rsp + 0x650]
mov edx, eax
lea rcx, [0x140056d10]
call fcn.14000a180
int3
movzx ecx, dl
jmp 0x14001df40