Function at 0x1400103a0
Capabilities:
Check if file exists
Check internet connectivity via wininet
Create thread
Encode data using xor
Get common file path
Get file attributes
Get graphical window text
Inject dll
Inject thread
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x8b8]
sub rsp, 0x990
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
mov rax, qword [0x14003a040]
xor rax, rsp
mov qword [rbp + 0x830], rax
mov r14, rcx
xor r13d, r13d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rax
mov dword [rbp + 0x118], eax
xor edx, edx
lea rcx, [rbp + 0x90]
call qword [sym.imp.WININET.dll_InternetGetConnectedState]
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
test eax, eax
je 0x140013a44
mov dword [rbp + 0xc0], 0x5c
mov dword [rbp + 0xc4], 0x40000000
mov dword [rbp + 0xd4], 0xffff
call qword [sym.imp.USER32.dll_SendMessageW]
movups xmm0, xmmword [0x140030b88]
movups xmmword [rbp + 0x1b0], xmm0
mov eax, dword [0x140030b98]
mov dword [rbp + 0x1c0], eax
movzx eax, byte [0x140030b9c]
mov byte [rbp + 0x1c4], al
mov r8d, r13d
movdqa xmm9, xmmword [0x140030c70]
movdqa xmm10, xmmword [0x140030c90]
movdqa xmm7, xmmword [0x140030c60]
movdqa xmm6, xmmword [0x140030ca0]
movdqa xmm8, xmmword [0x140030c40]
mov r15d, dword [0x14003a0a0]
cmp r15d, 2
jl 0x1400105e3
movdqa xmmword [rbp - 0x60], xmm10
lea rcx, [rbp + 0x1b0]
mov edx, dword [rbp - 0x60]
nop
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm8
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm6
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
andps xmm3, xmm9
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, edx
paddb xmm3, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm3, xmm0
movd dword [rcx + 4], xmm3
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x10
jl 0x1400104f0
cmp r8d, 0x15
jge 0x140010623
movsxd rax, r8d
lea r9, [rbp + 0x1b0]
add r9, rax
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x38
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x15
jl 0x1400105f0
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov rsi, 0xffffffffffffffff
mov r9d, esi
lea r8, [rbp + 0x1b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
cmovb rax, rsi
mov rcx, rax
call fcn.14002869c
mov rbx, rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, [rbp + 0x1b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9, rbx
xor r8d, r8d
mov edx, 0xc2
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rcx, qword [0x14003b148]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, 1
jne 0x140011fac
mov r8d, 0x100
lea rdx, [rbp + 0x410]
mov rcx, qword [0x14003b368]
call qword [sym.imp.USER32.dll_GetWindowTextW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r13
mov qword [rbp], r13
lea rax, [rbp + 0x410]
mov r8, rsi
inc r8
cmp word [rax + r8*2], r13w
jne 0x1400106f3
lea rdx, [rbp + 0x410]
lea rcx, [rbp - 0x18]
call fcn.1400246e0
nop
lea rdx, [rbp - 0x18]
cmp qword [rbp], 7
cmova rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 8]
lea r8, [rdx + rax*2]
lea rdx, [rbp - 0x18]
cmova rdx, qword [rbp - 0x18]
lea rcx, [rbp + 0x140]
call fcn.140022950
nop
mov r8d, 0x104
lea rdx, [rbp + 0x620]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r13
mov qword [rbp + 0xb8], r13
lea rax, [rbp + 0x620]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140010771
lea rdx, [rbp + 0x620]
lea rcx, [rbp + 0xa0]
call fcn.140004070
nop
lea rbx, [rbp + 0xa0]
mov r15, qword [rbp + 0xa0]
mov r12, qword [rbp + 0xb8]
cmp r12, 0xf
cmova rbx, r15
mov rdi, qword [rbp + 0xb0]
test rdi, rdi
je 0x14001082d
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x200]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x14002efe8]
lea rdx, [0x14002efea]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rbp + rax + 0x200], 1
inc rcx
cmp rcx, rdx
jne 0x1400107e0
lea rax, [rdi - 1]
mov r8, rsi
cmp rax, rsi
cmovb r8, rax
add r8, rbx
movzx eax, byte [r8]
cmp byte [rbp + rax + 0x200], 0
jne 0x140010828
cmp r8, rbx
je 0x14001082d
dec r8
movzx eax, byte [r8]
cmp byte [rbp + rax + 0x200], 0
je 0x140010812
sub r8, rbx
jmp 0x140010830
mov r8, rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
cmp rdi, r8
cmovb r8, rdi
lea rdx, [rbp + 0xa0]
cmp r12, 0xf
cmova rdx, r15
lea rcx, [rsp + 0x40]
call fcn.140004070
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x1400108a3
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001089e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011ea1
call fcn.140028340
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rbp + 0xa0], xmm1
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp + 0xb0], xmm0
movq r15, xmm0
movabs r8, 0x7fffffffffffffff
mov rax, r8
sub rax, r15
cmp rax, 1
jb 0x140013b1c
lea r13, [rbp + 0xa0]
movq rcx, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova r13, rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xor edx, edx
mov qword [rbp - 0x70], rdx
mov qword [rbp - 0x68], rdx
lea r12, [r15 + 1]
mov ebx, 0xf
lea rdi, [rbp - 0x80]
movabs rax, 0x8000000000000000
mov ecx, 0x16
cmp r12, rbx
jbe 0x140010998
mov rbx, r12
or rbx, 0xf
cmp rbx, r8
jbe 0x140010958
mov rbx, r8
add rax, 0x27
mov rcx, rax
call fcn.140028348
test rax, rax
je 0x140010985
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140010994
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14001096d
mov rdi, rdx
jmp 0x140010994
cmp rcx, 0x1000
jb 0x14001098c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140013ae5
jmp 0x14001093d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028348
mov rdi, rax
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], rbx
mov r8, r15
mov rdx, r13
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movzx ecx, word [0x14002efec]
mov byte [rdi + r15], cl
mov byte [rdi + r12], 0
lea rdx, [rbp + 0x140]
cmp qword [rbp + 0x158], 0xf
cmova rdx, qword [rbp + 0x140]
mov r8, qword [rbp + 0x150]
lea rcx, [rbp - 0x80]
call fcn.1400212c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor r12d, r12d
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140010a58
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010a53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010a53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovb rax, rsi
mov rcx, rax
call fcn.14002869c
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rbx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140011e3f
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
mov r8, rsi
inc r8
cmp byte [rbx + r8], 0
jne 0x140010b03
mov rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.140004070
nop
lea rcx, [rbp - 0x60]
call fcn.14000d810
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140010b62
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010b5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010b5d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov dword [rbp + 0xd4], 0xff00
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
movups xmm0, xmmword [str.hHVUNMV__1c7_2g_________zXW]
movups xmmword [rbp + 0x1e0], xmm0
movups xmm1, xmmword [0x140030718]
movups xmmword [rbp + 0x1f0], xmm1
psrldq xmm1, 0xf
movd eax, xmm1
mov r15d, dword [0x14003a0a0]
test al, al
je 0x140010d13
cmp r15d, 2
jl 0x140010ccd
mov edx, r12d
movdqa xmmword [rbp - 0x60], xmm10
lea rcx, [rbp + 0x1e0]
mov r8d, dword [rbp - 0x60]
nop dword [rax]
movd xmm2, edx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [rdx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm8
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm6
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
andps xmm3, xmm9
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, r8d
paddb xmm3, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm3, xmm0
movd dword [rcx + 4], xmm3
add edx, 8
lea rcx, [rcx + 8]
cmp edx, 0x20
jl 0x140010be0
jmp 0x140010d13
lea r9, [rbp + 0x1e0]
mov r8d, r12d
nop word [rax + rax]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x38
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x20
jl 0x140010ce0
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, esi
lea r8, [rbp + 0x1e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
cmovb rax, rsi
mov rcx, rax
call fcn.14002869c
mov rbx, rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, [rbp + 0x1e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9, rbx
xor r8d, r8d
mov edx, 0xc2
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rax, qword [rsp + 0x60]
mov qword [rbp - 0x60], rax
mov rax, qword [rsp + 0x70]
mov qword [rbp - 0x58], rax
call fcn.1400274e4
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
lea r8, [rbp - 0x60]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.140002320
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.1400039a0
movsd xmm0, qword [rax]
movsd qword [rbp + 0x90], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp - 0x60], ecx
lea rax, [0x14003a0e8]
mov qword [rbp - 0x58], rax
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
mov eax, dword [rbp + 0x90]
test eax, eax
je 0x140010e3d
cmp eax, 1
sete bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140010e4e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010e49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010e49
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov bl, 1
test ecx, ecx
jne 0x140013aeb
jmp 0x140010dfd
call fcn.140028340
test bl, bl
je 0x14001105c
movups xmm0, xmmword [0x1400301c0]
movups xmmword [rbp + 0x160], xmm0
movups xmm1, xmmword [0x1400301d0]
movups xmmword [rbp + 0x170], xmm1
movups xmm0, xmmword [0x1400301e0]
movups xmmword [rbp + 0x180], xmm0
movsd xmm0, qword [0x1400301f0]
movsd qword [rbp + 0x190], xmm0
movzx eax, byte [0x1400301f8]
mov byte [rbp + 0x198], al
mov r8d, r12d
cmp r15d, 2
jl 0x140010fb3
movdqa xmmword [rbp - 0x60], xmm10
lea rcx, [rbp + 0x160]
mov edx, dword [rbp - 0x60]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm8
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm6
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
andps xmm3, xmm9
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, edx
paddb xmm3, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm3, xmm0
movd dword [rcx + 4], xmm3
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x38
jl 0x140010ec0
cmp r8d, 0x39
jge 0x140010ff3
movsxd rax, r8d
lea r9, [rbp + 0x160]
add r9, rax
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x38
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x39
jl 0x140010fc0
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, esi
lea r8, [rbp + 0x160]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
cmovb rax, rsi
mov rcx, rax
call fcn.14002869c
mov rbx, rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, [rbp + 0x160]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9, rbx
xor r8d, r8d
mov edx, 0xc2
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rbp + 0xd4], 0xffff
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
movups xmm0, xmmword [0x140030608]
movups xmmword [rbp + 0x120], xmm0
mov eax, dword [0x140030618]
mov dword [rbp + 0x130], eax
cmp byte [0x14003061b], 0
je 0x140011203
mov r8d, r12d
cmp r15d, 2
jl 0x1400111c3
movdqa xmmword [rbp - 0x60], xmm10
lea rcx, [rbp + 0x120]
mov edx, dword [rbp - 0x60]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm8
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm6
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
andps xmm3, xmm9
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, edx
paddb xmm3, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm3, xmm0
movd dword [rcx + 4], xmm3
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x10
jl 0x1400110d0
cmp r8d, 0x14
jge 0x140011203
movsxd rax, r8d
lea r9, [rbp + 0x120]
add r9, rax
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x38
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x14
jl 0x1400111d0
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, esi
lea r8, [rbp + 0x120]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovb rax, rsi
mov rcx, rax
call fcn.14002869c
mov rdi, rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, [rbp + 0x120]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9, rdi
xor r8d, r8d
mov edx, 0xc2
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rdi
call fcn.140028340
mov dword [rbp + 0xd4], 0xff00
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8d, 0x104
lea rdx, [rbp + 0x200]
mov rcx, qword [0x14003b140]
call qword [sym.imp.USER32.dll_GetWindowTextW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
lea rax, [rbp + 0x200]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400112d0
lea rdx, [rbp + 0x200]
lea rcx, [rbp - 0x60]
call fcn.1400246e0
nop
lea r8, [rbp - 0x60]
lea rdx, [0x14002eff0]
lea rcx, [rbp + 0x68]
call fcn.140023460
nop
mov r8d, 2
lea rdx, [0x14002eb3c]
mov rcx, rax
call fcn.140020fe0
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x18], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp + 0x80]
cmp rdx, 7
jbe 0x14001138a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011385
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011385
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp + 0x78], r12
mov qword [rbp + 0x80], 7
mov word [rbp + 0x68], r12w
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x1400113e1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400113dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400113dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r12w
lea r9, [rbp + 8]
cmp qword [rbp + 0x20], 7
cmova r9, qword [rbp + 8]
xor r8d, r8d
mov edx, 0xc2
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbp + 0x200]
call fcn.1400043a0
mov ebx, eax
test eax, eax
je 0x140011c79
mov dword [rbp + 0xd4], 0xff00
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea r9, [rbp + 0x18a]
mov r8d, ebx
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x140011460
lea r8, [rbp + 0x18a]
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.1400256f0
nop
lea r8, [rsp + 0x40]
lea rdx, str.Process_ID:
lea rcx, [rbp - 0x40]
call fcn.140023460
nop
mov r8d, 5
lea rdx, str._r_n__r_n
mov rcx, rax
call fcn.140020fe0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140011541
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001153c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001153c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r12w
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140011597
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011592
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011592
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r12w
lea r9, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova r9, qword [rbp - 0x80]
xor r8d, r8d
mov edx, 0xc2
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140013b69
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x14001162e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011629
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011629
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r12w
mov edi, dword [rsp + 0x70]
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovb rax, rsi
mov rcx, rax
call fcn.14002869c
mov r12, rax
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
xor r13d, r13d
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], r13
inc rsi
cmp word [r12 + rsi*2], r13w
jne 0x1400116c0
mov r8, rsi
mov rdx, r12
lea rcx, [rbp + 0x48]
call fcn.1400246e0
mov rcx, r12
call fcn.140028340
nop
lea rdi, [rbp + 0x48]
cmp qword [rbp + 0x60], 7
cmova rdi, qword [rbp + 0x48]
mov r8, qword [rbp + 0x58]
lea r8, [r8*2 + 2]
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
jne 0x140011749
lea rcx, [0x14002f068]
call fcn.14000d290
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp + 0xd4], 0xff00
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r14
call fcn.140007850
mov r9, qword [rbp + 0x58]
lea r9, [r9*2 + 2]
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
mov r8, rdi
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400117cd
lea rcx, [0x14002f078]
call fcn.14000d290
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp + 0xd4], 0xff00
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r14
call fcn.140007ae0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x14001183b
lea rcx, str.GetModuleHandle
call fcn.14000d290
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp + 0xd4], 0xff00
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r14
call fcn.140007d70
lea rdx, [0x14002f0c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x1400118ac
lea rcx, [0x14002f0d0]
call fcn.14000d290
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp + 0xd4], 0xff00
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r14
call fcn.140008000
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rbx
mov r9, rdi
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
je 0x140013b22
mov dword [rbp + 0xd4], 0xff00
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
movups xmm0, xmmword [str.53ySYJ]
movups xmmword [rbp + 0x1c8], xmm0
movsd xmm0, qword [0x1400301b8]
movsd qword [rbp + 0x1d8], xmm0
lea rdx, [rbp + 0x1c8]
mov rcx, r14
call fcn.140023a50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140011970
lea rcx, str.CloseHandle_hThread
call fcn.14000d290
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140011989
lea rcx, str.CloseHandle_hProc
call fcn.14000d290
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x40]
call fcn.140004520
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r12, qword [rbp - 0x30]
sub rax, r12
cmp rax, 9
jb 0x140013b63
lea rax, [rbp - 0x40]
mov rsi, qword [rbp - 0x40]
mov r13, qword [rbp - 0x28]
cmp r13, 0xf
cmova rax, rsi
mov qword [rbp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xor edx, edx
mov qword [rbp - 0x70], rdx
mov qword [rbp - 0x68], rdx
lea r15, [r12 + 9]
mov edi, 0xf
lea rbx, [rbp - 0x80]
cmp r15, rdi
jbe 0x140011a84
mov rdi, r15
or rdi, 0xf
cmp rdi, rcx
jbe 0x140011a37
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140028348
test rax, rax
je 0x140011a6a
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140011a79
cmp rdi, 0x16
mov ecx, 0x16
cmovb rdi, rcx
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140011a52
mov rbx, rdx
jmp 0x140011a80
cmp rcx, 0x1000
jb 0x140011a71
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140013b01
jmp 0x140011a1c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028348
mov rbx, rax
mov rax, qword [rbp + 0x90]
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], rdi
movsd xmm0, qword [str.C:Users_]
movsd qword [rbx], xmm0
movzx ecx, byte [0x14002eef8]
mov byte [rbx + 8], cl
lea rcx, [rbx + 9]
mov r8, r12
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r15], 0
mov r8d, 0x58
lea rdx, str.AppDataLocalPackagesStudioWildcard.4558480580BB9_1w2mm55455e38ACWeedCheatDebug.txt
lea rcx, [rbp - 0x80]
call fcn.1400212c0
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xor r12d, r12d
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x40], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140011b3a
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011b35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011b35
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
lea rdx, [rbp + 0x28]
mov rcx, r14
call fcn.140010020
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x140011b95
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011b90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011b90
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x40], 0xf
mov byte [rbp + 0x28], 0
cmp r13, 0xf
jbe 0x140011be0
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140011bd7
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011bd7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140028340
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 7
jbe 0x140011c23
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011c1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011c1e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], 7
mov word [rbp + 0x48], r12w
mov rdx, qword [rbp + 0x20]
cmp rdx, 7
jbe 0x140011e6d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011c6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011ce3
call fcn.140028340
jmp 0x140011e6d
call fcn.14000f7e0
mov dword [rbp + 0xd4], 0xff
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r14
call fcn.140008290
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 7
jbe 0x140011cef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011cea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011cea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], 7
mov word [rbp + 8], r12w
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140011d40
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011d3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011d3b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x140011d97
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011d92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011d92
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x140011df5
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011def
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
nop
mov rdx, qword [rbp]
cmp rdx, 7
jbe 0x140013653
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001364e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001364e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov dword [rbp + 0xd4], 0xff
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r14
call fcn.140008a10
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140011ead
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011ea8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011ea8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x140011f04
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011eff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011eff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x140011f62
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011f5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140011f5c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
nop
mov rdx, qword [rbp]
cmp rdx, 7
jbe 0x140013a5c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013a3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013a3d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, [rbp + 0x140]
call fcn.140004520
nop
lea rcx, [rbp + 0x140]
call fcn.14000f250
call fcn.14000ee20
call fcn.14000e9f0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
movups xmm0, xmmword [str.o__qXP_nu]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [0x140030a80]
movups xmmword [rbp - 0x30], xmm1
mov eax, dword [0x140030a90]
mov dword [rbp - 0x20], eax
movzx eax, word [0x140030a94]
mov word [rbp - 0x1c], ax
mov r8d, r13d
movdqa xmm4, xmmword [0x140030c80]
cmp r15d, 2
jl 0x140012119
lea rcx, [rbp - 0x40]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm4
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm4
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x140012020
cmp r8d, 0x13
jge 0x140012167
movsxd rax, r8d
lea r9, [rbp - 0x40]
lea r9, [r9 + rax*2]
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x39
movzx eax, r8w
sub ax, cx
add ax, 0x38
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x13
jl 0x140012130
movups xmm0, xmmword [0x140030100]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [0x140030110]
movups xmmword [rbp + 0x78], xmm1
mov eax, dword [0x140030120]
mov dword [rbp + 0x88], eax
movzx eax, word [0x140030124]
mov word [rbp + 0x8c], ax
mov r8d, r13d
cmp r15d, 2
jl 0x1400122a9
lea rcx, [rbp + 0x68]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm4
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm4
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add r8d, 8
lea rcx, [rcx + 0x10]
cmp r8d, 0x10
jl 0x1400121b0
cmp r8d, 0x13
jge 0x1400122f7
movsxd rax, r8d
lea r9, [rbp + 0x68]
lea r9, [r9 + rax*2]
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x39
movzx eax, r8w
sub ax, cx
add ax, 0x38
xor word [r9], ax
inc r8d
lea r9, [r9 + 2]
cmp r8d, 0x13
jl 0x1400122c0
lea rax, [rbp + 0x620]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1400139fe
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
lea rax, [rbp - 0x40]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x140012334
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x80]
call fcn.1400246e0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
lea rax, [rbp + 0x68]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x140012363
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x28]
call fcn.1400246e0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r13
mov qword [rbp], r13
lea rax, [rbp + 0x620]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x140012395
lea rdx, [rbp + 0x620]
lea rcx, [rbp - 0x18]
call fcn.1400246e0
nop
mov r8d, 1
lea rdx, [0x14002f1ac]
lea rcx, [rbp - 0x18]
call fcn.140020fe0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea r9, [rbp + 0x28]
lea r8, [rbp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.140025170
nop
mov r8d, 1
lea rdx, [0x14002f1ac]
lea rcx, [rsp + 0x40]
call fcn.140020fe0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea r9, [rbp - 0x80]
lea r8, [rbp - 0x40]
lea rcx, [rbp + 8]
call fcn.140025170
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140012485
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001247f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001247f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x1400124ca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400124c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400124c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r13w
mov rdx, qword [rbp + 0x80]
cmp rdx, 7
jbe 0x140012525
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001251f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001251f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
nop
mov rdx, qword [rbp]
cmp rdx, 7
jbe 0x140012568
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012563
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012563
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp - 8], r13
mov qword [rbp], 7
mov word [rbp - 0x18], r13w
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x1400125bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400125b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400125b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x140012600
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400125fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400125fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
lea rcx, [rbp + 8]
cmp qword [rbp + 0x20], 7
cmova rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140013939
lea rdx, [rbp + 8]
lea rcx, [rsp + 0x60]
call fcn.140004170
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rdx, qword [rsp + 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov r8, rsi
inc r8
cmp byte [rdx + r8], 0
jne 0x140012652
lea rcx, [rsp + 0x40]
call fcn.140004070
nop
lea rcx, [rsp + 0x40]
call fcn.14000d810
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400126b4
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400126af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400126af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
test bl, bl
je 0x14001365a
mov dword [rbp + 0xd4], 0xff00
call qword [sym.imp.USER32.dll_SendMessageW]
movups xmm0, xmmword [str.hHVUNMV__1c7_2g_________zXW]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [0x140030718]
movups xmmword [rbp - 0x30], xmm1
psrldq xmm1, 0xf
movd eax, xmm1
test al, al
je 0x140012863
cmp r15d, 2
jl 0x14001281d
mov edx, r13d
movdqa xmmword [rbp - 0x60], xmm10
lea rcx, [rbp - 0x40]
mov r8d, dword [rbp - 0x60]
nop dword [rax]
nop word [rax + rax]
movd xmm2, edx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [rdx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm8
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm6
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
andps xmm3, xmm9
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, r8d
paddb xmm3, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm3, xmm0
movd dword [rcx + 4], xmm3
add edx, 8
lea rcx, [rcx + 8]
cmp edx, 0x20
jl 0x140012730
jmp 0x140012863
lea r9, [rbp - 0x40]
mov r8d, r13d
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x38
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x20
jl 0x140012830
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r9d, esi
lea r8, [rbp - 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
cmovb rax, rsi
mov rcx, rax
call fcn.14002869c
mov rbx, rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, [rbp - 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9, rbx
xor r8d, r8d
mov edx, 0xc2
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rbp + 0xd4], 0xff00
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rbp + 0xd4], 0xffff
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rax, qword [rsp + 0x60]
mov qword [rbp - 0x60], rax
mov rax, qword [rsp + 0x70]
mov qword [rbp - 0x58], rax
call fcn.1400274e4
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
lea r8, [rbp - 0x60]
mov edx, eax
lea rcx, [rbp - 0x40]
call fcn.140002320
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x60]
call fcn.1400039a0
movsd xmm0, qword [rax]
movsd qword [rbp + 0x1a0], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp - 0x60], ecx
lea rax, [0x14003a0e8]
mov qword [rbp - 0x58], rax
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
mov eax, dword [rbp + 0x1a0]
test eax, eax
je 0x1400129cd
cmp eax, 1
sete bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x1400129de
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400129d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400129d9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov bl, 1
test ecx, ecx
jne 0x140013b07
jmp 0x14001298f
call fcn.140028340
test bl, bl
je 0x140012bec
movups xmm0, xmmword [0x1400301c0]
movups xmmword [rbp + 0x160], xmm0
movups xmm1, xmmword [0x1400301d0]
movups xmmword [rbp + 0x170], xmm1
movups xmm0, xmmword [0x1400301e0]
movups xmmword [rbp + 0x180], xmm0
movsd xmm0, qword [0x1400301f0]
movsd qword [rbp + 0x190], xmm0
movzx eax, byte [0x1400301f8]
mov byte [rbp + 0x198], al
mov r8d, r13d
cmp r15d, 2
jl 0x140012b43
movdqa xmmword [rbp - 0x60], xmm10
lea rcx, [rbp + 0x160]
mov edx, dword [rbp - 0x60]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm8
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm6
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
andps xmm3, xmm9
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, edx
paddb xmm3, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm3, xmm0
movd dword [rcx + 4], xmm3
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x38
jl 0x140012a50
cmp r8d, 0x39
jge 0x140012b83
movsxd rax, r8d
lea r9, [rbp + 0x160]
add r9, rax
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x38
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x39
jl 0x140012b50
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r9d, esi
lea r8, [rbp + 0x160]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
cmovb rax, rsi
mov rcx, rax
call fcn.14002869c
mov rbx, rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, [rbp + 0x160]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9, rbx
xor r8d, r8d
mov edx, 0xc2
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rbp + 0xd4], 0xffff
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r14
call fcn.140008f50
mov dword [rbp + 0xd4], 0xff00
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8d, 0x104
lea rdx, [rbp + 0x410]
mov rcx, qword [0x14003b140]
call qword [sym.imp.USER32.dll_GetWindowTextW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], r13
mov qword [rbp + 0x138], r13
lea rax, [rbp + 0x410]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140012c80
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0x120]
call fcn.1400246e0
nop
lea r8, [rbp + 0x120]
lea rdx, [0x14002eff0]
lea rcx, [rbp - 0x40]
call fcn.140023460
nop
mov r8d, 2
lea rdx, [0x14002eb3c]
mov rcx, rax
call fcn.140020fe0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140012d3d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012d38
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012d38
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp + 0x138]
cmp rdx, 7
jbe 0x140012d97
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012d92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012d92
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp + 0x130], r13
mov qword [rbp + 0x138], 7
mov word [rbp + 0x120], r13w
lea r9, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova r9, qword [rbp - 0x80]
xor r8d, r8d
mov edx, 0xc2
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbp + 0x410]
call fcn.1400043a0
mov ebx, eax
test eax, eax
je 0x1400134e1
mov dword [rbp + 0xd4], 0xff00
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
lea r9, [rbp + 0x18a]
mov r8d, ebx
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x140012e20
lea r8, [rbp + 0x18a]
mov rdx, r9
lea rcx, [rsp + 0x40]
call fcn.1400256f0
nop
lea r8, [rsp + 0x40]
lea rdx, str.Process_ID:
lea rcx, [rbp + 0x68]
call fcn.140023460
nop
mov r8d, 5
lea rdx, str._r_n__r_n
mov rcx, rax
call fcn.140020fe0
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r13
mov qword [rbp], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rbp + 0x80]
cmp rdx, 7
jbe 0x140012f04
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012eff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012eff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x80], 7
mov word [rbp + 0x68], r13w
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x140012f5d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012f58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012f58
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r13w
lea r9, [rbp - 0x18]
cmp qword [rbp], 7
cmova r9, qword [rbp - 0x18]
xor r8d, r8d
mov edx, 0xc2
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140013aa7
mov rdx, qword [rbp]
cmp rdx, 7
jbe 0x140012ff4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012fef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140012fef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp - 8], r13
mov qword [rbp], 7
mov word [rbp - 0x18], r13w
mov edi, dword [rsp + 0x70]
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovb rax, rsi
mov rcx, rax
call fcn.14002869c
mov r12, rax
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova r8, qword [rsp + 0x60]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], r13
inc rsi
cmp word [r12 + rsi*2], 0
jne 0x140013083
mov r8, rsi
mov rdx, r12
lea rcx, [rbp + 0x48]
call fcn.1400246e0
mov rcx, r12
call fcn.140028340
nop
lea rdi, [rbp + 0x48]
cmp qword [rbp + 0x60], 7
cmova rdi, qword [rbp + 0x48]
mov r8, qword [rbp + 0x58]
lea r8, [r8*2 + 2]
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
jne 0x14001310d
lea rcx, [0x14002f068]
call fcn.14000d290
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp + 0xd4], 0xff00
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r14
call fcn.140007850
mov r9, qword [rbp + 0x58]
lea r9, [r9*2 + 2]
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
mov r8, rdi
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140013191
lea rcx, [0x14002f078]
call fcn.14000d290
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp + 0xd4], 0xff00
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r14
call fcn.140007ae0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x1400131ff
lea rcx, str.GetModuleHandle
call fcn.14000d290
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp + 0xd4], 0xff00
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r14
call fcn.140007d70
lea rdx, [0x14002f0c0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x140013270
lea rcx, [0x14002f0d0]
call fcn.14000d290
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp + 0xd4], 0xff00
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r14
call fcn.140008000
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rbx
mov r9, rdi
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
je 0x140013ba1
mov dword [rbp + 0xd4], 0xff00
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
movups xmm0, xmmword [str.53ySYJ]
movups xmmword [rbp + 0x1c8], xmm0
movsd xmm0, qword [0x1400301b8]
movsd qword [rbp + 0x1d8], xmm0
lea rdx, [rbp + 0x1c8]
mov rcx, r14
call fcn.140023a50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140013334
lea rcx, str.CloseHandle_hThread
call fcn.14000d290
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14001334d
lea rcx, str.CloseHandle_hProc
call fcn.14000d290
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x68]
call fcn.140004520
nop
lea r8, [rbp + 0x68]
lea rdx, str.C:Users_
lea rcx, [rbp - 0x40]
call fcn.140022a80
nop
mov r8d, 0x58
lea rdx, str.AppDataLocalPackagesStudioWildcard.4558480580BB9_1w2mm55455e38ACWeedCheatDebug.txt
mov rcx, rax
call fcn.1400212c0
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x1400133f7
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400133f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400133f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
lea rdx, [rbp + 0x28]
mov rcx, r14
call fcn.140010020
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x140013452
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001344d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001344d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 0xf
mov byte [rbp + 0x28], 0
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x1400134a4
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001349e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001349e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
nop
mov r8, qword [rbp + 0x60]
cmp r8, 7
jbe 0x1400134b7
mov rdx, qword [rbp + 0x48]
call fcn.140022090
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x60], 7
mov word [rbp + 0x48], r13w
lea rcx, [rbp - 0x80]
call fcn.1400028a0
nop
lea rcx, [rsp + 0x60]
call fcn.140021340
jmp 0x140013967
call fcn.14000f7e0
mov dword [rbp + 0xd4], 0xff
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r14
call fcn.140008290
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x140013557
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013552
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013552
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r13w
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x1400135a8
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400135a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400135a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp + 0x20]
cmp rdx, 7
jbe 0x1400135fe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400135f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400135f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], 7
mov word [rbp + 8], r13w
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x140013653
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001364e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001364e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
xor al, al
jmp 0x140013a5e
mov dword [rbp + 0xd4], 0xff
call qword [sym.imp.USER32.dll_SendMessageW]
movups xmm0, xmmword [0x1400300d8]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [0x1400300e8]
movups xmmword [rbp - 0x30], xmm1
movzx eax, byte [0x1400300f8]
mov byte [rbp - 0x20], al
mov r8d, r13d
cmp r15d, 2
jl 0x1400137a3
movdqa xmmword [rbp - 0x60], xmm10
lea rcx, [rbp - 0x40]
mov edx, dword [rbp - 0x60]
nop dword [rax]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm8
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
andps xmm2, xmm9
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm8
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm6
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
andps xmm3, xmm9
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, edx
paddb xmm3, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm3, xmm0
movd dword [rcx + 4], xmm3
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x20
jl 0x1400136b0
cmp r8d, 0x21
jge 0x1400137e3
movsxd rax, r8d
lea r9, [rbp - 0x40]
add r9, rax
nop dword [rax]
mov eax, 0x8fb823ef
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x38
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x21
jl 0x1400137b0
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r9d, esi
lea r8, [rbp - 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov eax, 2
mul rdi
cmovb rax, rsi
mov rcx, rax
call fcn.14002869c
mov rbx, rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, [rbp - 0x40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r9, rbx
xor r8d, r8d
mov edx, 0xc2
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140013887
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013882
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013882
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp + 0x20]
cmp rdx, 7
jbe 0x1400138dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400138d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400138d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], 7
mov word [rbp + 8], r13w
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x140013a5c
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013a3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013a3d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov dword [rbp + 0xd4], 0xff
lea r9, [rbp + 0xc0]
mov edx, 0x444
mov r8d, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r14
call fcn.140008790
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 7
jbe 0x1400139aa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400139a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400139a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], 7
mov word [rbp + 8], r13w
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x140013a5c
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013a3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013a3d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x140013a5c
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013a3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140013a3d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140028340
jmp 0x140013a5c
mov dword [rbp + 0xd4], 0xff
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r14
call fcn.140008cc0
mov al, 1
mov rcx, qword [rbp + 0x830]
xor rcx, rsp
call fcn.140028320
lea r11, [rsp + 0x990]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, [0x14002f040]
call fcn.14000d290
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.OpenProcess_failed
lea rcx, [rbp + 0x120]
call fcn.1400018f0
lea rdx, [0x1400362d0]
lea rcx, [rbp + 0x120]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call fcn.140001830
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x60]
lea rcx, str.exists
call fcn.1400032c0
nop
call fcn.140001830
nop
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x60]
lea rcx, str.exists
call fcn.1400032c0
nop
call fcn.1400018d0
nop
lea rcx, [0x14002f0e0]
call fcn.14000d290
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.CreateRemoteThread_failed
lea rcx, [rbp - 0x60]
call fcn.1400018f0
lea rdx, [0x1400362d0]
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call fcn.1400018d0
nop
lea rcx, [0x14002f040]
call fcn.14000d290
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.OpenProcess_failed
lea rcx, [rbp - 0x60]
call fcn.1400018f0
lea rdx, [0x1400362d0]
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [0x14002f0e0]
call fcn.14000d290
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.CreateRemoteThread_failed
lea rcx, [rbp + 0x120]
call fcn.1400018f0
lea rdx, [0x1400362d0]
lea rcx, [rbp + 0x120]
call sub.VCRUNTIME140.dll__CxxThrowException
int3