Function at 0x1400019f0
Capabilities:
Create process on windows
Create process suspended
Execute command
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
xor r15d, r15d
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, str.kerber.exe
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea ebx, [r15 + 9]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._________________________________________________________________________________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c50
mov rcx, rax
lea rdx, str.________________::____________________________________________::_________________n
call fcn.140003c50
mov rcx, rax
lea rdx, str._______________:5:::____________________________________:::5:________________n
call fcn.140003c50
mov rcx, rax
lea rdx, str._____________.B_BGP_.7:________________________________:7._PGB_B.______________n
call fcn.140003c50
mov rcx, rax
lea rdx, str.____________.5_B_:B_B57:_____:____________:_____:75B_B:__5______________n
call fcn.140003c50
mov rcx, rax
lea rdx, str.__________5___BGPB______G_.:7Y__________57:._G______GPGB___5___________n
call fcn.140003c50
mov rcx, rax
lea rdx, str.________.P__B__B5___BGB____B.7__.__.___.____BGB___5B__B__P._________n
call fcn.140003c50
mov rcx, rax
lea rdx, str.________75___5_____GGB__5.:GBBG:_5__BGG_____5___57_________n
call fcn.140003c50
mov rcx, rax
lea rdx, str._______7_____________BY_JB________BJ_YB_____________7________n
call fcn.140003c50
mov rcx, rax
lea rdx, str.____:7B_____BGBB_________GB____________________GG_________BBGB_____B7:_____n
call fcn.140003c50
mov rcx, rax
lea rdx, str.___75___P_:__G________YB_5G________G5_BY________G__:_P___57____n
call fcn.140003c50
mov rcx, rax
lea rdx, str.____:G_J:_7:7__P___JJG__7__BB__7__GJJ___P_77:7_:J_G:_____n
call fcn.140003c50
mov rcx, rax
lea rdx, str.______._JP_BB_Y.JBPY7.:B__GBBBBG__B:.7YPBJ.Y_BB_PJ_._______n
call fcn.140003c50
lea ebx, [r15 + 0xe]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___________PGGY__________J7___BB___7J__________YGGP___________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c50
mov rcx, rax
lea rdx, str.___________________:5______P_G____G7..7G____G_P______5:____________________n
call fcn.140003c50
mov rcx, rax
lea rdx, str._________________5_______P_YGPB_Y7G77P7Y_BPPY_P_______5__________________n
call fcn.140003c50
mov rcx, rax
lea rdx, str._________________5_________J_YP7___JJJJ___7PY_J__________5__________________n
call fcn.140003c50
mov rcx, rax
lea rdx, str._________________.P_________5_BBPJPPJPBB_5_________P.__________________n
call fcn.140003c50
mov rcx, rax
lea rdx, str.____________________P______B_.J_BGBBGB__._B______P_____________________n
call fcn.140003c50
mov rcx, rax
lea rdx, str._____________________:_J5PB____P._5BB5_.P____BP5J_.______________________n
call fcn.140003c50
mov rcx, rax
lea rdx, str.___________________________Y_____BJ::::JB_____Y____________________________n
call fcn.140003c50
mov rcx, rax
lea rdx, str.____________________________G______GPYYPG______G_____________________________n
call fcn.140003c50
mov rcx, rax
lea rdx, str._______________________________P______________5_______________________________n
call fcn.140003c50
mov rcx, rax
lea rdx, str.________________________________._YB______BY_._________________________________n
call fcn.140003c50
mov rcx, rax
lea rdx, str.____________________________________:7__7:_____________________________________n
call fcn.140003c50
mov rcx, rax
lea rdx, str._________________________________________________________________________________n
call fcn.140003c50
mov rcx, rax
lea rdx, [0x140003e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
movdqa xmm1, xmmword [0x1400071d0]
movdqu xmmword [rbp - 0x38], xmm1
mov byte [rbp - 0x48], r15b
movups xmmword [rbp + 0x70], xmm0
movdqu xmmword [rbp + 0x80], xmm1
mov byte [rbp + 0x70], r15b
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r15
mov r13d, 0xf
mov qword [rsp + 0x70], r13
mov byte [rsp + 0x58], r15b
movups xmmword [rbp - 0x68], xmm0
movdqu xmmword [rbp - 0x58], xmm1
mov byte [rbp - 0x68], r15b
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r13w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Want:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c50
lea esi, [rbx - 4]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, si
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Encrypt_C_or_E
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c50
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r13w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._or
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c50
lea ebx, [rsi - 6]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Decrypt_D
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c50
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
mov edi, eax
lea ecx, [rax - 0x43]
test cl, 0xdd
je 0x140002a2c
lea ecx, [rax - 0x44]
test cl, 0xdf
je 0x140001fc0
lea rcx, [0x140007024]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea ebx, [rsi + 2]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Choice__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c50
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r13w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movzx edx, dil
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003a80
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___is_Incorrect..._____Next_time_choose:_C_or_E_for_Encryption_or_D_for_Decryption_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c50
mov rcx, rax
lea rdx, [0x140003e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
lea r12d, [r15 + 8]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r12w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r8d, 0x104
lea rdx, [rbp + 0xb0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
movups xmmword [rbp + 0x54], xmm0
mov dword [rbp + 0x64], eax
mov dword [rbp], 0x68
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140001f96
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, [0x140007070]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003c50
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140003e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, r13
jbe 0x140001ef1
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001eec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001eec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004a7c
movdqa xmm0, xmmword [0x1400071d0]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140001f42
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f3d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004a7c
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r13
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x1400029c8
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400029c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002da2
lea rcx, str.kerber.exe_d___start
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfffffff5
mov r12d, 8
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r12w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__Enter_text_to_DECRYPT__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c50
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, si
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._n____
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c50
lea ebx, [r12 - 1]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
movzx edx, sil
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp - 0x48]
mov rcx, rbx
call fcn.140004400
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r12w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.1400018d0
nop
mov eax, dword [rbp - 0x18]
sub eax, 1
movsxd r14, eax
lea rbx, [0x140000000]
js 0x140002127
nop dword [rax + rax]
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova rax, qword [rbp - 0x28]
movsx edi, byte [r14 + rax]
lea eax, [rdi - 0x20]
cmp eax, 0x5e
ja case.0x1400020e3.49
cdqe
movzx eax, byte [rbx + rax + 0x2e00]
mov ecx, dword [rbx + rax*4 + 0x2db8]
add rcx, rbx
jmp rcx
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x140002114
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov word [rcx + rax], 0x5e
jmp 0x140002121
mov r9b, 0x5e
lea rcx, [rsp + 0x58]
call fcn.140003ec0
sub r14, 1
jns 0x1400020b0
mov r8, qword [rsp + 0x68]
test r8, r8
je 0x14000271a
lea rdi, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rdi, qword [rsp + 0x58]
lea rsi, [rsp + 0x58]
cmova rsi, qword [rsp + 0x58]
add rsi, r8
cmp rdi, rsi
je 0x140002179
nop dword [rax]
movsx ecx, byte [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isxdigit]
test eax, eax
je 0x14000271a
inc rdi
cmp rdi, rsi
jne 0x140002160
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.140001510
nop
lea rcx, [rsp + 0x78]
call fcn.140003710
mov r14, rax
sub r14d, 1
js 0x140002644
movsxd r15, r14d
mov rdx, r15
lea rcx, [rsp + 0x78]
call fcn.140003720
movsx edi, byte [rax]
lea eax, [rdi - 0x20]
cmp eax, 0x5e
ja case.0x1400021d3.49
cdqe
movzx eax, byte [rbx + rax + 0x2ea8]
mov ecx, dword [rbx + rax*4 + 0x2e60]
add rcx, rbx
jmp rcx
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x140002207
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov word [rax + rcx], 0x20
jmp 0x140002121
mov r9b, 0x20
jmp 0x140002117
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x140002241
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov word [rax + rcx], 0x25
jmp 0x140002121
mov r9b, 0x25
jmp 0x140002117
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x14000227b
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov word [rcx + rax], 0x2e
jmp 0x140002121
mov r9b, 0x2e
jmp 0x140002117
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x1400022b5
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov word [rax + rcx], 0x2a
jmp 0x140002121
mov r9b, 0x2a
jmp 0x140002117
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x1400022ef
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov word [rax + rcx], 0x2c
jmp 0x140002121
mov r9b, 0x2c
jmp 0x140002117
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x140002329
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov word [rax + rcx], 0x7e
jmp 0x140002121
mov r9b, 0x7e
jmp 0x140002117
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x140002363
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov word [rax + rcx], 0x3d
jmp 0x140002121
mov r9b, 0x3d
jmp 0x140002117
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x14000239d
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov word [rax + rcx], 0x60
jmp 0x140002121
mov r9b, 0x60
jmp 0x140002117
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x1400023d7
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov word [rax + rcx], 0x2b
jmp 0x140002121
mov r9b, 0x2b
jmp 0x140002117
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x140002411
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov word [rax + rcx], 0x2f
jmp 0x140002121
mov r9b, 0x2f
jmp 0x140002117
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x14000244b
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov word [rax + rcx], 0x2d
jmp 0x140002121
mov r9b, 0x2d
jmp 0x140002117
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x140002485
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov word [rax + rcx], 0x23
jmp 0x140002121
mov r9b, 0x23
jmp 0x140002117
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x1400024bf
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov word [rax + rcx], 0x3a
jmp 0x140002121
mov r9b, 0x3a
jmp 0x140002117
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x1400024f9
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov word [rax + rcx], 0x26
jmp 0x140002121
mov r9b, 0x26
jmp 0x140002117
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x140002533
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov word [rax + rcx], 0x3b
jmp 0x140002121
mov r9b, 0x3b
jmp 0x140002117
mov r9d, 0x69
sub r9b, dil
jmp 0x140002578
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_islower]
test eax, eax
je 0x14000255d
mov r9d, 0xffffffdb
sub r9b, dil
jmp 0x140002578
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isupper]
test eax, eax
je 0x140002574
mov r9d, 0xffffff9b
sub r9b, dil
jmp 0x140002578
movzx r9d, dil
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
cmp rcx, rdx
jae 0x140002117
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + rcx + 1], 0
mov byte [rax + rcx], r9b
jmp 0x140002121
mov al, 0x5e
jmp 0x14000262b
mov al, 0x20
jmp 0x14000262b
mov al, 0x25
jmp 0x14000262b
mov al, 0x2e
jmp 0x14000262b
mov al, 0x2a
jmp 0x14000262b
mov al, 0x2c
jmp 0x14000262b
mov al, 0x7e
jmp 0x14000262b
mov al, 0x3d
jmp 0x14000262b
mov al, 0x60
jmp 0x14000262b
mov al, 0x2b
jmp 0x14000262b
mov al, 0x2f
jmp 0x14000262b
mov al, 0x2d
jmp 0x14000262b
mov al, 0x23
jmp 0x14000262b
mov al, 0x3a
jmp 0x14000262b
mov al, 0x26
jmp 0x14000262b
mov al, 0x3b
jmp 0x14000262b
mov eax, 0x69
sub al, dil
jmp 0x14000262b
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_islower]
test eax, eax
je 0x140002611
mov eax, 0xffffffdb
sub al, dil
jmp 0x14000262b
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isupper]
test eax, eax
je 0x140002627
mov eax, 0xffffff9b
sub al, dil
jmp 0x14000262b
movzx eax, dil
movzx edx, al
lea rcx, [rbp - 0x68]
call fcn.140003740
dec r15
sub r14d, 1
jns 0x1400021a3
lea rcx, str.kerber.exe_d___done
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ebx, 0xc
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c50
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea edx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp - 0x68]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003ea0
mov rcx, rax
lea rdx, [0x140003e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r13w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._n__Done._Text_Decrypted.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c50
mov rcx, rax
lea rdx, [0x140003e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r12w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
lea rcx, [rsp + 0x78]
call fcn.140003790
jmp 0x140002a23
lea rcx, [0x140007024]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ebx, 0xc
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Error__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c50
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r13w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x68]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400045a0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___is_Incorrect_to_Decryption__Please_try_again.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c50
mov rcx, rax
lea rdx, [0x140003e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r12w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r8d, 0x104
lea rdx, [rbp + 0xb0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
movups xmmword [rbp + 0x54], xmm0
mov dword [rbp + 0x64], eax
mov dword [rbp], 0x68
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400029fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, [0x140007070]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003c50
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140003e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1400028e0
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400028db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004a7c
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], r13
mov byte [rbp - 0x28], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x14000292a
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002925
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002925
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004a7c
movdqa xmm0, xmmword [0x1400071d0]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14000297b
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002976
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002976
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004a7c
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r13
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x1400029c8
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400029c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004a7c
mov eax, 1
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1400047e0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x28]
jmp 0x140002d9d
lea rcx, str.kerber.exe_e___start
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfffffff5
mov r12d, 8
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r12w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__Enter_text_to_ENCRYPT__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c50
lea ebx, [r12 + 4]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._n____
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c50
lea ebx, [r12 - 1]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp - 0x48]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140003e60
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r12w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp - 0x48]
call fcn.140003710
mov r14, rax
lea rbx, [0x140000000]
sub r14d, 1
js 0x140002bc1
movsxd r15, r14d
nop dword [rax]
mov rdx, r15
lea rcx, [rbp - 0x48]
call fcn.140003720
movsx edi, byte [rax]
lea eax, [rdi - 0x20]
cmp eax, 0x5e
ja case.0x140002b2b.49
cdqe
movzx eax, byte [rbx + rax + 0x2f50]
mov ecx, dword [rbx + rax*4 + 0x2f08]
add rcx, rbx
jmp rcx
mov al, 0x5e
jmp 0x140002ba7
mov al, 0x20
jmp 0x140002ba7
mov al, 0x25
jmp 0x140002ba7
mov al, 0x2e
jmp 0x140002ba7
mov al, 0x2a
jmp 0x140002ba7
mov al, 0x2c
jmp 0x140002ba7
mov al, 0x7e
jmp 0x140002ba7
mov al, 0x3d
jmp 0x140002ba7
mov al, 0x60
jmp 0x140002ba7
mov al, 0x2b
jmp 0x140002ba7
mov al, 0x2f
jmp 0x140002ba7
mov al, 0x2d
jmp 0x140002ba7
mov al, 0x23
jmp 0x140002ba7
mov al, 0x3a
jmp 0x140002ba7
mov al, 0x26
jmp 0x140002ba7
mov al, 0x3b
jmp 0x140002ba7
mov eax, 0x69
sub al, dil
jmp 0x140002ba7
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_islower]
test eax, eax
je 0x140002b8d
mov eax, 0xffffffdb
sub al, dil
jmp 0x140002ba7
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isupper]
test eax, eax
je 0x140002ba3
mov eax, 0xffffff9b
sub al, dil
jmp 0x140002ba7
movzx eax, dil
movzx edx, al
lea rcx, [rsp + 0x58]
call fcn.140003740
dec r15
sub r14d, 1
jns 0x140002b00
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.140001220
nop
lea rcx, [rsp + 0x78]
call fcn.140003710
mov r14, rax
sub r14d, 1
js 0x140002cb1
movsxd r15, r14d
nop dword [rax + rax]
mov rdx, r15
lea rcx, [rsp + 0x78]
call fcn.140003720
movsx edi, byte [rax]
lea eax, [rdi - 0x20]
cmp eax, 0x5e
ja case.0x140002c1c.49
cdqe
movzx eax, byte [rbx + rax + 0x2ff8]
mov ecx, dword [rbx + rax*4 + 0x2fb0]
add rcx, rbx
jmp rcx
mov al, 0x5e
jmp 0x140002c98
mov al, 0x20
jmp 0x140002c98
mov al, 0x25
jmp 0x140002c98
mov al, 0x2e
jmp 0x140002c98
mov al, 0x2a
jmp 0x140002c98
mov al, 0x2c
jmp 0x140002c98
mov al, 0x7e
jmp 0x140002c98
mov al, 0x3d
jmp 0x140002c98
mov al, 0x60
jmp 0x140002c98
mov al, 0x2b
jmp 0x140002c98
mov al, 0x2f
jmp 0x140002c98
mov al, 0x2d
jmp 0x140002c98
mov al, 0x23
jmp 0x140002c98
mov al, 0x3a
jmp 0x140002c98
mov al, 0x26
jmp 0x140002c98
mov al, 0x3b
jmp 0x140002c98
mov eax, 0x69
sub al, dil
jmp 0x140002c98
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_islower]
test eax, eax
je 0x140002c7e
mov eax, 0xffffffdb
sub al, dil
jmp 0x140002c98
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isupper]
test eax, eax
je 0x140002c94
mov eax, 0xffffff9b
sub al, dil
jmp 0x140002c98
movzx eax, dil
movzx edx, al
lea rcx, [rbp - 0x68]
call fcn.140003740
dec r15
sub r14d, 1
jns 0x140002bf0
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x90]
call fcn.1400016f0
nop
lea rcx, str.kerber.exe_e___done
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xa
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c50
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xe
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp + 0x90]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003ea0
mov rcx, rax
lea rdx, [0x140003e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r13w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._n__Done._Text_Encrypted.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003c50
mov rcx, rax
lea rdx, [0x140003e20]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r12w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
lea rcx, [rbp + 0x90]
call fcn.140003790
nop
lea rcx, [rsp + 0x78]
call fcn.140003790
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3