Function at 0x140007f90
Capabilities:
Delete file
Download url
Enumerate processes
Execute command
Get common file path
Receive data
Self delete
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x620]
sub rsp, 0x720
mov rax, qword [0x14001d040]
xor rax, rsp
mov qword [rbp + 0x610], rax
xor edi, edi
mov dword [rbp + 0x10], edi
lea rcx, [rsp + 0x50]
call fcn.140006ec0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140008014
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000800f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008814
call fcn.140010a98
lea rdx, [rbp + 0x3f0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea rax, [rbp + 0x3f0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x140008045
lea rdx, [rbp + 0x3f0]
lea rcx, [rsp + 0x30]
call fcn.14000e670
nop
mov r8d, 0x11
lea rdx, str.celery_reader.txt
lea rcx, [rsp + 0x30]
call fcn.14000cdf0
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x88], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x88], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400080ea
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400080e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400080e5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010a98
movdqa xmm0, xmmword [0x140015fb0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], rdi
mov qword [rbp + 0x30], rdi
mov r8d, 0x1f
lea rdx, str.C:WindowsSystem32message.txt
lea rcx, [rbp + 0x18]
call fcn.14000e670
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x68], xmm1
mov r8d, 0x40
lea rdx, str.https:__github.com_Jaxploit_Injecotr_raw_main_message_20_13_.txt
lea rcx, [rbp + 0x58]
call fcn.14000e670
nop
call fcn.140001d70
lea rax, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova rax, qword [rbp + 0x18]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x38], rax
call fcn.14000fca0
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x78]
call fcn.140001ff0
nop
lea rcx, [rsp + 0x78]
call fcn.140002fa0
movzx ebx, al
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x1400081dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400081d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400081d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010a98
test bl, bl
jne 0x140008286
lea r8, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova r8, qword [rbp + 0x18]
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], 0xf
cmova rdx, qword [rbp + 0x58]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jns 0x140008286
call fcn.1400033a0
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
lea rdx, [0x140014900]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d100
call fcn.1400033d0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Failed_to_load_GUI
lea rcx, [rsp + 0x50]
call fcn.14000c6d0
mov dword [rsp + 0x70], 0x19
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140003800
nop
lea rcx, [rsp + 0x50]
call fcn.140005d30
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x38]
call fcn.1400067a0
nop
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x78]
cmp qword [rbp + 0x90], 0xf
cmova rdx, qword [rbp + 0x78]
lea rcx, [rbp + 0xa0]
call fcn.14000ae80
nop
cmp qword [rbp + 0x128], 0
je 0x140008335
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0xf
cmova rdx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x48]
lea rcx, [rbp + 0xa0]
call fcn.14000f350
lea rcx, [rbp + 0xa8]
call fcn.14000cbf0
test rax, rax
jne 0x140008322
mov rax, qword [rbp + 0xa0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xa0]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rdx, str._n_n_____Loaded_GUI__Status:_UNREADY
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d100
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova rcx, qword [rbp + 0x18]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x1b0], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rbp + 0x1b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x140008873
lea rdx, [rbp + 0x1b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x140008873
mov qword [rbp + 0x10], rdi
mov qword [rsp + 0x20], 0xffffffffffffffff
lea r9, [rbp + 0x1dc]
mov r8d, 0x104
lea rdx, [rbp + 0x500]
lea rcx, [rbp + 0x10]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
test eax, eax
jne 0x140008850
lea rdx, str.jdbsjwmskfna.exe
lea rcx, [rbp + 0x500]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
mov rcx, rbx
test eax, eax
je 0x140008404
lea rdx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x1400083a0
jmp 0x140008873
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140007650
lea rdx, str._n_n_____Loaded_RENC__Status:_UNREADY
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d100
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
lea rdx, str._n_n_____Allowing_Userinput
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d100
lea rdx, str._n_n_____DONE
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d100
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400142f8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call fcn.140003400
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._n___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d100
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
mov r8d, 0xa
lea rdx, str.Loaded_GUI
lea rcx, [rbp - 0x68]
call fcn.14000e670
mov dword [rbp - 0x48], 0x19
lea rsi, [rbp - 0x68]
mov r12, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
cmova rsi, r12
lea r13, [rbp - 0x68]
cmova r13, r12
add r13, qword [rbp - 0x58]
cmp rsi, r13
je 0x1400086af
movabs rdi, 0x7ffffffffe8287bf
movabs rbx, 0x7fffffffffffffff
movabs r14, 0xb2f4fc0794908cf3
movabs r15, 0x4e94914f0000
mov r12, qword [rbp + 0x10]
nop word [rax + rax]
movzx edx, byte [rsi]
mov rcx, r12
call fcn.14000d2e0
lea rdx, [0x14000d770]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0x30]
call fcn.140001c90
mov rax, qword [rsp + 0x30]
cmp rax, rdi
lea rdi, [rax + 0x17d7840]
jl 0x140008599
mov rdi, rbx
movabs r12, 0x431bde82d7b634db
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x1400085c4
imul rax, rcx, 0x64
jmp 0x140008633
cmp rbx, 0x16e3600
jne 0x140008618
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r9, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul r8, rcx, 0x3b9aca00
mov rax, r14
imul r8
add rdx, r8
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r9
jmp 0x140008633
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rdi
jge 0x140008681
mov rcx, rdi
sub rcx, rax
cmp rcx, r15
jl 0x140008652
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x1400085a3
mov rax, r12
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140008675
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x1400085a3
inc rsi
cmp rsi, r13
mov r12, qword [rbp + 0x10]
movabs rbx, 0x7fffffffffffffff
movabs rdi, 0x7ffffffffe8287bf
jne 0x140008560
mov r12, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x50]
xor edi, edi
cmp rdx, 0xf
jbe 0x1400086e7
inc rdx
mov rax, r12
cmp rdx, 0x1000
jb 0x1400086de
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008d2b
mov rcx, r12
call fcn.140010a98
nop
lea rcx, [rbp + 0xa0]
call fcn.140007590
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x140008732
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000872d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000872d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010a98
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x50], 0xf
mov byte [rbp + 0x38], 0
mov rdx, qword [rbp + 0x70]
cmp rdx, 0xf
jbe 0x140008780
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000877b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000877b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010a98
movdqa xmm0, xmmword [0x140015fb0]
movdqu xmmword [rbp + 0x68], xmm0
mov byte [rbp + 0x58], 0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x1400087cf
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400087ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400087ca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010a98
mov qword [rbp + 0x28], rdi
mov qword [rbp + 0x30], 0xf
mov byte [rbp + 0x18], 0
mov rdx, qword [rbp + 0x90]
cmp rdx, 0xf
jbe 0x140008820
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000881b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000881b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010a98
mov rcx, qword [rbp + 0x610]
xor rcx, rsp
call fcn.140010290
lea r11, [rsp + 0x720]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, str.Error_converting_wide_string_to_multibyte_string.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000d100
lea rdx, [0x14000d4b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x1400142f8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call fcn.140003400
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
lea rdx, [0x140013a34]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d100
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rbp + 0x10], rbx
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
mov r8d, 0x10
lea rdx, str.Injection_failed
lea rcx, [rbp - 0x40]
call fcn.14000e670
mov dword [rbp - 0x20], 0x19
lea rsi, [rbp - 0x40]
mov r8, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
cmova rsi, r8
lea r13, [rbp - 0x40]
cmova r13, r8
add r13, qword [rbp - 0x30]
movabs rdi, 0x7fffffffffffffff
movabs r14, 0xb2f4fc0794908cf3
movabs r15, 0x4e94914f0000
movabs r12, 0x431bde82d7b634db
cmp rsi, r13
je 0x140008ac0
nop dword [rax]
movzx edx, byte [rsi]
mov rcx, rbx
call fcn.14000d2e0
lea rdx, [0x14000d770]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0x30]
call fcn.140001c90
mov rax, qword [rsp + 0x30]
movabs rcx, 0x7ffffffffe8287bf
cmp rax, rcx
jge 0x1400089c0
lea rdi, [rax + 0x17d7840]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x1400089e1
imul rax, rcx, 0x64
jmp 0x140008a50
cmp rbx, 0x16e3600
jne 0x140008a35
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r8, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r8
jmp 0x140008a50
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rdi
jge 0x140008a9e
mov rcx, rdi
sub rcx, rax
cmp rcx, r15
jl 0x140008a6f
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x1400089c0
mov rax, r12
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140008a92
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x1400089c0
inc rsi
cmp rsi, r13
mov rbx, qword [rbp + 0x10]
movabs rdi, 0x7fffffffffffffff
jne 0x140008980
mov r8, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140008af6
inc rdx
mov rax, r8
cmp rdx, 0x1000
jb 0x140008aee
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008d2b
mov rcx, r8
call fcn.140010a98
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._n_n____
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d100
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 8], xmm1
mov r8d, 0x11
lea rdx, str.Deleting_cache...
lea rcx, [rbp - 0x18]
call fcn.14000e670
mov dword [rbp + 8], 0x19
lea rsi, [rbp - 0x18]
mov r12, qword [rbp - 0x18]
mov rdx, qword [rbp]
cmp rdx, 0xf
cmova rsi, r12
lea rcx, [rbp - 0x18]
cmova rcx, r12
mov r13, qword [rbp - 8]
add r13, rcx
cmp rsi, r13
je 0x140008d00
mov r12, qword [rbp + 0x10]
nop dword [rax]
movzx edx, byte [rsi]
mov rcx, r12
call fcn.14000d2e0
lea rdx, [0x14000d770]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0x30]
call fcn.140001c90
mov rax, qword [rsp + 0x30]
movabs rcx, 0x7ffffffffe8287bf
cmp rax, rcx
jge 0x140008bf0
lea rdi, [rax + 0x17d7840]
movabs r12, 0x431bde82d7b634db
nop word [rax + rax]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x140008c21
imul rax, rcx, 0x64
jmp 0x140008c90
cmp rbx, 0x16e3600
jne 0x140008c75
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r8, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r8
jmp 0x140008c90
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rdi
jge 0x140008cde
mov rcx, rdi
sub rcx, rax
cmp rcx, r15
jl 0x140008caf
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140008c00
mov rax, r12
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140008cd2
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140008c00
inc rsi
cmp rsi, r13
mov r12, qword [rbp + 0x10]
movabs rdi, 0x7fffffffffffffff
jne 0x140008bb0
mov r12, qword [rbp - 0x18]
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x140008d3a
inc rdx
mov rax, r12
cmp rdx, 0x1000
jb 0x140008d32
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008d32
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.140010a98
lea rbx, str.DEL_C:WindowsSystem32jdbsjwmskfna.exe
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdi, str.DEL_C:WindowsSystem32db1scya5.dat
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], 0x28
call fcn.14000fca0
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.140001ff0
nop
mov ebx, 0x7d
mov dword [rbp + 0x10], ebx
lea rcx, [rsp + 0x50]
call fcn.140002fa0
test al, al
jne 0x140008df6
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 0x24
call fcn.14000fca0
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x78]
call fcn.140001ff0
nop
mov ebx, 0x1ff
mov dword [rbp + 0x10], ebx
lea rcx, [rsp + 0x78]
call fcn.140002fa0
test al, al
jne 0x140008df6
mov dil, 1
jmp 0x140008df9
xor dil, dil
test bl, 2
je 0x140008e59
and ebx, 0xfffffffd
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x140008e45
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008e40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010a98
movdqa xmm0, xmmword [0x140015fa0]
movdqu xmmword [rbp - 0x78], xmm0
xor eax, eax
mov word [rsp + 0x78], ax
test bl, 1
je 0x140008ea3
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140008ea3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008e9e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010a98
lea rcx, [0x1400142f8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140003370
call fcn.140003400
test dil, dil
je 0x140008f8c
call fcn.140007f60
lea rdx, str._n___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d100
call fcn.1400033d0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Deleted_cache
lea rcx, [rsp + 0x50]
call fcn.14000c6d0
mov dword [rsp + 0x70], 0x19
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140003800
nop
lea rcx, [rsp + 0x50]
call fcn.140005d30
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003370
lea rdx, str._n_n____
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d100
call fcn.1400033d0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Reboot_your_PC_to_make_the_injector_work_again
lea rcx, [rsp + 0x50]
call fcn.14000c6d0
mov dword [rsp + 0x70], 0x19
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140003800
nop
lea rcx, [rsp + 0x50]
call fcn.140005d30
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400033a0
lea rdx, [0x140013a34]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d100
call fcn.1400033d0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Cache_deleting_failed._Maybe_this_exe_is_corrupted
lea rcx, [rsp + 0x50]
call fcn.14000c6d0
mov dword [rsp + 0x70], 0x19
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140003800
nop
lea rcx, [rsp + 0x50]
call fcn.140005d30
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3