Function at 0x140001ab0
Capabilities:
Create thread
Get session user name
Query environment variable
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x548]
sub rsp, 0x620
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14000b010]
xor rax, rsp
mov qword [rbp + 0x500], rax
xor r14d, r14d
mov dword [rbp], r14d
lea rcx, str.WINNT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140003e80
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], r14b
mov dword [rbp - 0x10], 0x101
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140002e7f
lea rdx, [rbp + 0x2f0]
lea rcx, [rsp + 0x60]
call fcn.1400017d0
mov rbx, rax
lea rax, [rbp - 0x40]
cmp rax, rbx
je 0x140001bc5
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140001b97
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001bf9
call fcn.14000521c
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140001c05
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c00
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000521c
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov ecx, 0xe
mov qword [rbp - 0x50], rcx
mov r9d, 0xf
mov qword [rbp - 0x48], r9
movsd xmm0, qword [str.VirtualMachine]
movsd qword [rbp - 0x60], xmm0
mov eax, dword [0x1400076b0]
mov dword [rbp - 0x58], eax
movzx eax, word [0x1400076b4]
mov word [rbp - 0x54], ax
lea rdx, [rbp - 0x40]
mov rax, qword [rbp - 0x40]
mov r8, qword [rbp - 0x30]
cmp qword [rbp - 0x28], 0x10
jb 0x140001c5f
lea rbx, [r8 + rax]
mov rsi, rax
mov rdi, rax
jmp 0x140001c6b
lea rbx, [r8 + rdx]
lea rsi, [rbp - 0x40]
lea rdi, [rbp - 0x40]
cmp rdi, rbx
je 0x140001c97
sub rsi, rdi
movzx ecx, byte [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rsi + rdi], al
inc rdi
cmp rdi, rbx
jne 0x140001c73
mov r8, qword [rbp - 0x30]
mov rax, qword [rbp - 0x40]
mov r9, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
lea rsi, [rbp - 0x60]
mov rdx, qword [rbp - 0x60]
cmp r9, 0x10
jb 0x140001cb1
mov rsi, rdx
lea rbx, [rcx + rdx]
mov rdi, rdx
jmp 0x140001cbc
lea rbx, [rbp - 0x60]
add rbx, rcx
lea rdi, [rbp - 0x60]
cmp rdi, rbx
je 0x140001cec
sub rsi, rdi
movzx ecx, byte [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rdi + rsi], al
inc rdi
cmp rdi, rbx
jne 0x140001cc4
mov r8, qword [rbp - 0x30]
mov rax, qword [rbp - 0x40]
mov r9, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x60]
lea r10, [rbp - 0x60]
cmp r9, 0x10
cmovae r10, rdx
lea r9, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae r9, rax
cmp r8, rcx
jne 0x140002d51
mov rdx, r10
mov rcx, r9
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140002d51
lea rdx, str.Username_is_correct_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400043d0
mov rcx, rax
lea rdx, [0x140004390]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140001d80
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002dd0
call fcn.14000521c
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 5
mov qword [rsp + 0x78], 0xf
mov eax, dword [str.STOP_]
mov dword [rsp + 0x60], eax
movzx eax, byte [0x1400077a0]
mov byte [rsp + 0x64], al
lea rcx, [rsp + 0x60]
call fcn.1400012b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 6
mov qword [rsp + 0x78], 0xf
mov eax, dword [str.STOP__]
mov dword [rsp + 0x60], eax
movzx eax, word [0x1400077a8]
mov word [rsp + 0x64], ax
lea rcx, [rsp + 0x60]
call fcn.1400012b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x78], 0xf
mov eax, dword [str.STOP___]
mov dword [rsp + 0x60], eax
movzx eax, word [0x1400077b4]
mov word [rsp + 0x64], ax
movzx eax, byte [0x1400077b6]
mov byte [rsp + 0x66], al
lea rcx, [rsp + 0x60]
call fcn.1400012b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 8
mov qword [rsp + 0x78], 0xf
mov rax, qword [str.STOP____]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
call fcn.1400012b0
movabs rcx, 0x7fffffffffffffff
mov r15, rcx
mov r13, qword [rbp + 0x20]
sub r15, r13
cmp r15, 1
jb 0x140002f98
lea r14, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
setae byte [rsp + 0x30]
mov r12, qword [rbp + 0x10]
cmovae r14, r12
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x48], 0
lea rdi, [r13 + 1]
mov ebx, 0xf
lea rsi, [rbp - 0x60]
movabs rax, 0x8000000000000000
lea edx, [rbx + 7]
cmp rdi, rbx
jbe 0x140001f3f
mov rbx, rdi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001f00
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.140005110
test rax, rax
je 0x140001f23
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001f3b
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001f2a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002f7a
jmp 0x140001ee5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001f39
call fcn.140005110
mov rsi, rax
jmp 0x140001f3b
xor esi, esi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rbx
movzx eax, byte [0x1400077d8]
mov byte [rsi], al
lea rcx, [rsi + 1]
mov r8, r13
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rdi], 0
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0xc
jb 0x140001fae
lea rax, [rcx + 0xc]
mov qword [rbp - 0x50], rax
lea rbx, [rbp - 0x60]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x60]
add rbx, rcx
mov r8d, 0xc
lea rdx, str.dllmgr.exe_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xc], 0
lea rax, [rbp - 0x60]
jmp 0x140001fcc
mov qword [rsp + 0x20], 0xc
lea r9, str.dllmgr.exe_
mov edx, 0xc
lea rcx, [rbp - 0x60]
call fcn.140004810
xorps xmm0, xmm0
movups xmmword [rbp + 0x270], xmm0
xor ebx, ebx
mov qword [rbp + 0x280], rbx
mov qword [rbp + 0x288], rbx
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x270], xmm0
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp + 0x280], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140002047
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002042
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002042
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000521c
mov byte [rbp - 0x60], 0
mov qword [rbp - 0x48], 0xf
mov qword [rbp - 0x50], rbx
lea r14, [rbp + 0x10]
cmp byte [rsp + 0x30], 0
cmovne r14, r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov ebx, 0xf
lea rsi, [rsp + 0x40]
cmp rdi, rbx
jbe 0x140002111
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x1400020cb
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140005110
test rax, rax
je 0x1400020f4
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000210c
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400020fb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002f80
jmp 0x1400020b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14000210a
call fcn.140005110
mov rsi, rax
jmp 0x14000210c
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rbx
movzx eax, byte [0x1400077d8]
mov byte [rsi], al
lea rcx, [rsi + 1]
mov r8, r13
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rdi], 0
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 0xe
jb 0x140002188
lea rax, [rcx + 0xe]
mov qword [rsp + 0x50], rax
lea rbx, [rsp + 0x40]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x40]
add rbx, rcx
mov r8d, 0xe
lea rdx, str._taskhost.exe_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xe], 0
lea rax, [rsp + 0x40]
jmp 0x1400021a7
mov qword [rsp + 0x20], 0xe
lea r9, str._taskhost.exe_
mov edx, 0xe
lea rcx, [rsp + 0x40]
call fcn.140004810
xorps xmm0, xmm0
movups xmmword [rbp + 0x290], xmm0
xor ebx, ebx
mov qword [rbp + 0x2a0], rbx
mov qword [rbp + 0x2a8], rbx
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x290], xmm0
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp + 0x2a0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140002224
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000221f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000221f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000521c
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], rbx
lea r14, [rbp + 0x10]
cmp byte [rsp + 0x30], 0
cmovne r14, r12
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rbx
mov ebx, 0xf
lea rsi, [rbp - 0x60]
cmp rdi, rbx
jbe 0x1400022ec
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x1400022a7
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140005110
test rax, rax
je 0x1400022d0
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400022e8
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400022d7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002f86
jmp 0x14000228c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400022e6
call fcn.140005110
mov rsi, rax
jmp 0x1400022e8
xor esi, esi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rbx
movzx eax, byte [0x1400077d8]
mov byte [rsi], al
lea rcx, [rsi + 1]
mov r8, r13
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rdi], 0
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0xc
jb 0x14000235b
lea rax, [rcx + 0xc]
mov qword [rbp - 0x50], rax
lea rbx, [rbp - 0x60]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x60]
add rbx, rcx
mov r8d, 0xc
lea rdx, str.expmgr.exe_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xc], 0
lea rax, [rbp - 0x60]
jmp 0x140002379
mov qword [rsp + 0x20], 0xc
lea r9, str.expmgr.exe_
mov edx, 0xc
lea rcx, [rbp - 0x60]
call fcn.140004810
xorps xmm0, xmm0
movups xmmword [rbp + 0x2b0], xmm0
xor ebx, ebx
mov qword [rbp + 0x2c0], rbx
mov qword [rbp + 0x2c8], rbx
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x2b0], xmm0
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp + 0x2c0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x1400023f4
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400023ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400023ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000521c
mov byte [rbp - 0x60], 0
mov qword [rbp - 0x48], 0xf
mov qword [rbp - 0x50], rbx
lea r14, [rbp + 0x10]
cmp byte [rsp + 0x30], 0
cmovne r14, r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov ebx, 0xf
lea rsi, [rsp + 0x40]
cmp rdi, rbx
jbe 0x1400024bb
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x14000247c
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140005110
test rax, rax
je 0x1400025ca
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400024b6
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400024a5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002f8c
jmp 0x14000245d
test rcx, rcx
je 0x1400024b4
call fcn.140005110
mov rsi, rax
jmp 0x1400024b6
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rbx
movzx eax, byte [0x1400077d8]
mov byte [rsi], al
lea rcx, [rsi + 1]
mov r8, r13
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rdi], 0
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 0xe
jb 0x140002532
lea rax, [rcx + 0xe]
mov qword [rsp + 0x50], rax
lea rbx, [rsp + 0x40]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x40]
add rbx, rcx
mov r8d, 0xe
lea rdx, str._rundll64.exe_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xe], 0
lea rax, [rsp + 0x40]
jmp 0x140002551
mov qword [rsp + 0x20], 0xe
lea r9, str._rundll64.exe_
mov edx, 0xe
lea rcx, [rsp + 0x40]
call fcn.140004810
xorps xmm0, xmm0
movups xmmword [rbp + 0x2d0], xmm0
xor r14d, r14d
mov qword [rbp + 0x2e0], r14
mov qword [rbp + 0x2e8], r14
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x2d0], xmm0
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp + 0x2e0], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov r12d, 0xff0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1400025d7
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400025d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000521c
nop
mov esi, r14d
lea rbx, [rbp + 0x270]
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400025ee
mov rax, qword [rbx]
mov qword [rbp - 0x20], rax
mov ecx, 8
call fcn.140005110
lea rcx, [rbp - 0x20]
mov qword [rax], rcx
or r12d, 4
mov qword [rbp], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140005040]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140002d40
cmp dword [rsp + 0x48], 0
je 0x140002d34
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x60], xmm0
lea rcx, [rbp - 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140002d2b
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x14000268a
imul rax, rax, 0x64
jmp 0x1400026a5
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
movabs rcx, 0x7fffffffe2329aff
cmp rax, rcx
jge 0x1400026bc
add rax, 0x1dcd6500
jmp 0x1400026c6
movabs rax, 0x7fffffffffffffff
mov qword [rbp], rax
lea rcx, [rbp]
call fcn.140004bf0
inc esi
add rbx, 0x20
cmp esi, 4
jb 0x1400025e1
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x160]
call sub.VCRUNTIME140.dll_memset
cmp r15, 0xa
jb 0x140002f9e
lea rsi, [rbp + 0x10]
cmp byte [rsp + 0x30], 0
mov r15, qword [rbp + 0x10]
cmovne rsi, r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
lea r14, [r13 + 0xa]
mov ebx, 0xf
lea rdi, [rsp + 0x60]
cmp r14, rbx
jbe 0x1400027c2
mov rbx, r14
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x14000277c
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140005110
test rax, rax
je 0x1400027a5
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400027bd
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400027ac
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002f92
jmp 0x140002761
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400027bb
call fcn.140005110
mov rdi, rax
jmp 0x1400027bd
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rbx
mov r8, r13
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.data0.bin]
movsd qword [rdi + r13], xmm0
movzx eax, word [0x140007818]
mov word [rdi + r13 + 8], ax
mov byte [rdi + r14], 0
or r12d, 8
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x160]
call fcn.140003c80
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140002850
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000284b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000284b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000521c
xor edi, edi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], dil
lea rdx, [0x14000781c]
lea rcx, [rbp + 0x160]
call fcn.1400043d0
lea rcx, [rbp + 0x168]
call fcn.1400041a0
test rax, rax
jne 0x1400028aa
mov rax, qword [rbp + 0x160]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x160]
add rcx, rax
xor r8d, r8d
lea edx, [rdi + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov r8d, 0x110
xor edx, edx
lea rcx, [rbp + 0x50]
call sub.VCRUNTIME140.dll_memset
lea rsi, [rbp + 0x10]
cmp byte [rsp + 0x30], 0
cmovne rsi, r15
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
mov ebx, 0xf
lea rdi, [rbp - 0x80]
cmp r14, rbx
jbe 0x14000296d
mov rbx, r14
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140002912
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140002939
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140002958
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002f74
mov rcx, rax
call fcn.140005110
test rax, rax
je 0x140002d05
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002969
test rcx, rcx
je 0x140002967
call fcn.140005110
mov rdi, rax
jmp 0x140002969
xor edi, edi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], rbx
mov r8, r13
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.data0.bin]
movsd qword [rdi + r13], xmm0
movzx eax, word [0x140007818]
mov word [rdi + r13 + 8], ax
mov byte [rdi + r14], 0
or r12d, 2
lea rbx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rbx, qword [rbp - 0x80]
lea rax, [0x1400078d0]
mov qword [rbp + 0x50], rax
lea rcx, [rbp + 0x100]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
or r12d, 1
mov dword [rbp], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x50]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea rsi, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x50], rsi
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x4c], edx
lea rax, [rbp + 0x60]
mov qword [rbp - 0x20], rax
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x60], rax
mov byte [rbp + 0xdc], 0
mov byte [rbp + 0xd1], 0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
xor edi, edi
mov qword [rbp + 0xe0], rdi
mov rax, qword [0x14000b980]
mov qword [rbp + 0xd4], rax
mov qword [rbp + 0xc8], rdi
lea r8d, [rdi + 0x21]
mov rdx, rbx
lea rcx, [rbp + 0x60]
call fcn.140004250
test rax, rax
jne 0x140002a96
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x50]
add rcx, rax
xor r8d, r8d
lea edx, [rdi + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x50], rsi
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x4c], edx
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x140002af0
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002aeb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002d0c
call fcn.14000521c
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov qword [rbp - 0x60], rdi
mov word [rbp - 0x58], 1
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
mov rcx, qword [rbp + rcx + 0x98]
mov qword [rsp + 0x40], rcx
test rcx, rcx
sete byte [rsp + 0x48]
mov byte [rsp + 0x49], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], rdi
movaps xmm0, xmmword [rsp + 0x40]
movaps xmmword [rbp - 0x20], xmm0
movaps xmm6, xmmword [rbp - 0x60]
test rcx, rcx
je 0x140002b7a
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::sgetc_void____ptr64]
cmp eax, 0xffffffff
je 0x140002b69
mov byte [rbp - 0x17], al
mov rax, qword [rbp - 0x20]
mov byte [rbp - 0x18], 1
movaps xmm0, xmmword [rbp - 0x20]
jmp 0x140002b7f
mov rax, rdi
mov qword [rbp - 0x20], rax
mov byte [rbp - 0x18], 1
movaps xmm0, xmmword [rbp - 0x20]
jmp 0x140002b7f
movq rax, xmm0
test rax, rax
movq rax, xmm6
jne 0x140002bfc
test rax, rax
je 0x140002c01
movdqa xmmword [rbp - 0x20], xmm6
movdqa xmmword [rbp], xmm0
lea r8, [rbp - 0x20]
lea rdx, [rbp]
lea rcx, [rbp + 0x30]
call fcn.140004d30
nop
lea rcx, [rbp + 0x60]
call fcn.1400041a0
test rax, rax
jne 0x140002bd4
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x50]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rax, [rbp + 0x30]
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
setae r8b
mov rcx, qword [rbp + 0x30]
cmovae rax, rcx
cmp qword [rbp + 0x40], 1
jne 0x140002c20
cmp byte [rax], 0x32
jne 0x140002c13
mov eax, edi
jmp 0x140002c18
test rax, rax
je 0x140002b8e
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
jmp 0x140002baa
sbb eax, eax
or eax, 1
test eax, eax
je 0x140002d13
test r8b, r8b
je 0x140002c52
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002d24
call fcn.14000521c
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x50], rsi
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x4c], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x60], rax
cmp qword [rbp + 0xe0], 0
je 0x140002ccc
mov rax, qword [rbp + 0x78]
lea rcx, [rbp + 0xd0]
cmp qword [rax], rcx
jne 0x140002ccc
mov rdx, qword [rbp + 0xf0]
mov rcx, qword [rbp + 0xe8]
mov qword [rax], rcx
mov rax, qword [rbp + 0x98]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0xb0]
mov dword [rax], edx
cmp byte [rbp + 0xdc], 0
je 0x140002cde
lea rcx, [rbp + 0x60]
call fcn.1400041a0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x68]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x100]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x1400028aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001360
mov ecx, 0x20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x48], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rdx, str.Username_is_uncorrect__Please_create_an_account_for_the_VM_with_the_name__VirtualMachine_.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400043d0
mov rcx, rax
lea rdx, [0x140004390]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.After_start_this_program_again._Press_any_key__to_exit_from_program
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400043d0
mov rcx, rax
lea rdx, [0x140004390]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140002ddc
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002dd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002dd7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000521c
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140002e2a
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000521c
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140002e78
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e73
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000521c
xor eax, eax
jmp 0x140002f3f
lea rdx, str.UserName_isn_t_detected__close...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400043d0
mov rcx, rax
lea rdx, [0x140004390]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140002eec
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ee7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002ee7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000521c
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140002f3a
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002f35
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000521c
mov eax, 1
mov rcx, qword [rbp + 0x500]
xor rcx, rsp
call fcn.1400050f0
lea r11, [rsp + 0x620]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001110
nop
call fcn.140001110
nop
call fcn.140001110
nop
call fcn.140001110
nop
call fcn.140001110
nop
call fcn.140001110
nop
call fcn.1400011b0
nop
call fcn.1400011b0
int3