Function at 0x140080ca0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Enumerate gui resources
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x440]
sub rsp, 0x540
mov rax, qword [0x1401503a8]
xor rax, rsp
mov qword [rbp + 0x430], rax
movdqa xmm0, xmmword [0x14012e7c0]
movdqu xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x80], 0x642f7276
mov word [rbp - 0x7c], 0x6479
xor eax, eax
mov byte [rbp - 0x7a], al
xor r12d, r12d
mov ecx, r12d
nop
movzx eax, byte [rsp + 0x70]
xor byte [rsp + rcx + 0x71], al
inc rcx
cmp rcx, 0x15
jb 0x140080d00
mov byte [rbp - 0x7a], r12b
movdqa xmm0, xmmword [0x14012e810]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x6d71567b
mov dword [rsp + 0x64], 0x667b306a
mov word [rsp + 0x68], 0x7b
mov rcx, r12
nop
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x51], al
inc rcx
cmp rcx, 0x18
jb 0x140080d40
mov byte [rsp + 0x69], r12b
lea rcx, [rsp + 0x71]
call fcn.14006d570
mov dword [0x140150db0], eax
test eax, eax
je 0x14008207a
mov edx, eax
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov dword [rbp - 0x70], 0x238
cmp rax, 0xffffffffffffffff
je 0x140080dcc
lea rdx, [rbp - 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x140080dc3
nop dword [rax + rax]
lea rdx, [rsp + 0x71]
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
test eax, eax
je 0x140080dc3
lea rdx, [rbp - 0x70]
mov rcx, rbx
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x140080da0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x1d0]
lea rax, [rbp - 0x70]
mov edx, 4
nop dword [rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x140080de0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov r8d, dword [0x140150db0]
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
mov qword [0x140150da8], rax
xorps xmm0, xmm0
mov edi, dword [rbp - 0x50]
movdqu xmmword [rbp + 0x418], xmm0
mov qword [rbp + 0x428], r12
test rdi, rdi
je 0x140080ee9
cmp rdi, 0x1000
jb 0x140080ebb
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x1400820b0
call fcn.1400e1f00
mov rcx, rax
test rax, rax
je 0x14008206e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140080ec3
mov rcx, rdi
call fcn.1400e1f00
mov qword [rbp + 0x418], rax
lea rbx, [rax + rdi]
mov qword [rbp + 0x428], rbx
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x420], rbx
mov qword [rsp + 0x20], r12
mov r9, rdi
mov r8, qword [rbp + 0x418]
mov rdx, qword [rbp - 0x58]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
nop
lea rcx, [rsp + 0x51]
call fcn.14006d570
mov edx, eax
lea rcx, [0x140073060]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rbp + 0x1e8]
mov qword [0x140150db8], rax
lea rax, [rsp + 0x70]
mov qword [rbp + 0x410], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r12
mov rsi, qword [0x140150fb0]
mov rdi, qword [0x140150fb8]
cmp rsi, rdi
je 0x140080f95
sub rdi, rsi
mov rbx, rdi
sar rbx, 2
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.14006f830
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
lea rbx, [rax + rbx*4]
mov qword [rbp - 0x80], rbx
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x78], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov rsi, qword [rbp + 0x418]
mov r14, qword [rbp + 0x420]
cmp rsi, r14
je 0x140081032
mov rdi, r14
sub rdi, rsi
cmp rdi, 0x1000
jb 0x140080ff1
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x1400820b6
call fcn.1400e1f00
test rax, rax
je 0x140080fea
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140081006
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rdi, rdi
je 0x140081003
mov rcx, rdi
call fcn.1400e1f00
mov rbx, rax
jmp 0x140081006
mov rbx, r12
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
lea rax, [rbx + rdi]
mov qword [rsp + 0x48], rax
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
sub rbx, rsi
add rbx, r14
mov qword [rsp + 0x40], rbx
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14006d630
mov qword [0x140150dc0], rax
test rax, rax
je 0x14008141a
movss xmm0, dword [0x140150168]
movss dword [rbp + 0x410], xmm0
cmp dword [0x140150d2c], 0
jne 0x14008141a
mov rax, qword [0x140150e98]
cmp qword [0x140150e90], rax
jne 0x14008141a
mov rdx, qword [0x140150ed8]
mov eax, dword [rbp + 0x410]
movzx ecx, al
mov dword [rdx + 0x14], ecx
mov rdx, qword [0x140150ed8]
mov ecx, eax
shr ecx, 8
movzx ecx, cl
mov dword [rdx + 0x18], ecx
mov rdx, qword [0x140150ed8]
mov ecx, eax
shr ecx, 0x10
movzx ecx, cl
mov dword [rdx + 0x1c], ecx
mov rcx, qword [0x140150ed8]
shr eax, 0x18
mov dword [rcx + 0x20], eax
lea rdx, [0x140150f20]
lea rcx, [rsp + 0x70]
call fcn.14006b610
mov r8, qword [0x140150dc0]
add r8, qword [0x140150db8]
mov r9, rax
mov rdx, qword [0x140150da8]
lea rcx, [rsp + 0x38]
call fcn.14006d330
mov rdx, rax
lea rcx, [0x140150f20]
call fcn.14006c570
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140081153
mov rax, qword [rsp + 0x48]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008114e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008114e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e1f3c
lea rcx, [rbp - 0x70]
lea rax, [rbp + 0x1d0]
mov edx, 4
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x140081170
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov qword [rsp + 0x20], 1
lea r9d, [rdx + 4]
mov r8, qword [0x140150dc0]
lea rdx, [rbp - 0x70]
mov rcx, qword [0x140150da8]
call fcn.14006d470
mov rbx, rax
lea rdx, [0x140150ed8]
lea rcx, [rsp + 0x70]
call fcn.14006b610
mov r10, rax
mov word [rbp + 0x410], bx
mov rdx, r12
mov r8, qword [rax + 8]
mov r11, qword [rax]
mov rax, r8
sub rax, r11
sar rax, 2
mov r9, r11
movzx ecx, bx
test rax, rax
je 0x140081263
cmp dword [r11 + rdx*4], 0xfffffffe
je 0x140081252
inc rdx
cmp rdx, rax
jb 0x140081241
jmp 0x140081263
movzx eax, cl
mov dword [r11 + rdx*4], eax
mov r8, qword [r10 + 8]
mov r11, qword [r10]
mov r9, r11
mov rdx, r12
mov rax, r8
sub rax, r9
sar rax, 2
test rax, rax
je 0x1400812a0
mov rbx, r9
cmp dword [r9 + rdx*4], 0xfffffffe
je 0x140081293
inc rdx
mov r8, qword [r10 + 8]
mov rbx, r11
cmp rdx, rax
jb 0x140081278
mov r9, r11
jmp 0x1400812a0
movzx eax, cl
mov dword [rbx + rdx*4], eax
mov r8, qword [r10 + 8]
mov r9, qword [r10]
mov rdx, r12
sub r8, r9
sar r8, 2
test r8, r8
je 0x1400812c8
nop
cmp dword [r9 + rdx*4], 0xfffffffe
je 0x1400812c1
inc rdx
cmp rdx, r8
jb 0x1400812b0
jmp 0x1400812c8
movzx eax, cl
mov dword [r9 + rdx*4], eax
mov rdx, qword [r10 + 0x10]
mov qword [r10 + 0x10], r12
mov rcx, qword [r10 + 8]
mov qword [r10 + 8], r12
mov rax, qword [r10]
mov qword [r10], r12
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
lea rdx, [rsp + 0x38]
lea rcx, [0x140150ed8]
call fcn.14006c570
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140081349
mov rax, qword [rsp + 0x48]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140081344
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140081344
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e1f3c
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rdx, [0x140150f20]
lea rcx, [rsp + 0x70]
call fcn.14006b610
mov rbx, rax
lea rdx, [0x140150ed8]
lea rcx, [rsp + 0x50]
call fcn.14006b610
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14006d920
mov rdx, rax
lea rcx, [0x140150ed8]
call fcn.14006c570
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400813e3
mov rax, qword [rsp + 0x48]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400813de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400813de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e1f3c
cmp byte [0x140150c9f], 0
jne 0x14008141a
lea rdx, [0x140150ed8]
lea rcx, [rsp + 0x50]
call fcn.14006b610
mov rdx, qword [0x140150db8]
add rdx, qword [0x140150dc0]
mov r8, rax
mov rcx, qword [0x140150da8]
call fcn.14008b360
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r12
mov rsi, qword [0x140150e78]
mov rdi, qword [0x140150e80]
cmp rsi, rdi
je 0x140081480
sub rdi, rsi
mov rbx, rdi
sar rbx, 2
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.14006f830
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
lea rbx, [rax + rbx*4]
mov qword [rbp - 0x80], rbx
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x78], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov rsi, qword [rbp + 0x418]
mov r14, qword [rbp + 0x420]
cmp rsi, r14
je 0x14008151d
mov rdi, r14
sub rdi, rsi
cmp rdi, 0x1000
jb 0x1400814dc
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x1400820bc
call fcn.1400e1f00
test rax, rax
je 0x1400814d5
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400814f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rdi, rdi
je 0x1400814ee
mov rcx, rdi
call fcn.1400e1f00
mov rbx, rax
jmp 0x1400814f1
mov rbx, r12
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
lea rax, [rbx + rdi]
mov qword [rsp + 0x48], rax
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
sub rbx, rsi
add rbx, r14
mov qword [rsp + 0x40], rbx
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14006d630
mov qword [0x140150dc8], rax
mov r15, 0xfffffffffffffffb
test rax, rax
je 0x140081bea
lea rcx, [rax + 2]
mov qword [0x140150dc8], rcx
cmp dword [0x140150d3c], 2
jne 0x140081bea
mov rax, qword [0x140150fe8]
cmp qword [0x140150fe0], rax
je 0x140081bea
mov rsi, qword [0x140150db8]
add rsi, rcx
lea rdx, [0x140150f98]
lea rcx, [rsp + 0x50]
call fcn.14006b610
mov rdx, rax
mov rcx, rsi
call fcn.14007b110
mov rdi, rax
lea rcx, [rbp - 0x70]
lea rax, [rbp + 0x1d0]
lea edx, [r15 + 9]
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1400815b0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov r9, qword [0x140150fe8]
sub r9, qword [0x140150fe0]
sar r9, 2
mov dword [rsp + 0x28], 4
mov eax, dword [0x140150d3c]
mov dword [rsp + 0x20], eax
mov r8, qword [0x140150dc8]
lea rdx, [rbp - 0x70]
mov rcx, qword [0x140150da8]
call fcn.14006f560
mov r14, rax
lea rdx, [0x140150fe0]
lea rcx, [rsp + 0x50]
call fcn.14006b610
mov rdx, rax
mov rcx, r14
call fcn.140071560
mov rcx, rsi
sub rcx, r14
mov rbx, r15
sub rbx, rcx
sub rax, rdi
mov rdi, r15
sub rdi, rax
lea rax, [r14 + 0x1000]
mov qword [0x140150df0], rax
add rax, 4
mov qword [0x140150df8], rax
mov qword [0x140150e00], rsi
mov qword [0x140150e08], r14
lea rdx, [0x140150fc8]
lea rcx, [rsp + 0x50]
call fcn.14006b610
mov r9, rax
mov r8, rsi
mov rdx, qword [0x140150da8]
lea rcx, [rsp + 0x38]
call fcn.14006d330
mov rdx, rax
lea rcx, [0x140150fc8]
call fcn.14006c570
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140081738
mov rax, qword [rsp + 0x48]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140081733
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140081733
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e1f3c
lea rdx, [0x140150f98]
lea rcx, [rsp + 0x50]
call fcn.14006b610
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.14006da50
mov rdx, rax
lea rcx, [0x140150f98]
call fcn.14006c570
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400817b3
mov rax, qword [rsp + 0x48]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400817ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400817ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e1f3c
lea rdx, [0x140150fe0]
lea rcx, [rsp + 0x50]
call fcn.14006b610
mov r8, rax
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.14006da50
mov rdx, rax
lea rcx, [0x140150fe0]
call fcn.14006c570
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14008182e
mov rax, qword [rsp + 0x48]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140081829
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140081829
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e1f3c
lea rcx, [rbp - 0x70]
lea rax, [rbp + 0x1d0]
mov edx, 4
nop
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x140081840
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov qword [rsp + 0x20], 1
lea r9d, [rdx + 5]
mov r8, qword [0x140150dc8]
lea rdx, [rbp - 0x70]
mov rcx, qword [0x140150da8]
call fcn.14006d470
mov rbx, rax
lea rdx, [0x140150fe0]
lea rcx, [rsp + 0x50]
call fcn.14006b610
mov r8, rax
mov word [rbp + 0x410], bx
mov rcx, r12
mov r9, qword [rax]
mov rdx, qword [rax + 8]
sub rdx, r9
sar rdx, 2
test rdx, rdx
je 0x140081924
cmp dword [r9 + rcx*4], 0xfffffffe
je 0x140081919
inc rcx
cmp rcx, rdx
jb 0x140081908
jmp 0x140081924
movzx eax, byte [rbp + 0x410]
mov dword [r9 + rcx*4], eax
mov rdx, qword [r8 + 0x10]
mov qword [r8 + 0x10], r12
mov rcx, qword [r8 + 8]
mov qword [r8 + 8], r12
mov rax, qword [r8]
mov qword [r8], r12
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
lea rdx, [rsp + 0x38]
lea rcx, [0x140150fe0]
call fcn.14006c570
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400819a5
mov rax, qword [rsp + 0x48]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400819a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400819a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e1f3c
lea rdx, [0x140150fe0]
lea rcx, [rsp + 0x50]
call fcn.14006b610
mov r8, rax
lea rcx, [rbx + 4]
mov word [rbp + 0x410], cx
mov rcx, r12
mov r9, qword [rax]
mov rdx, qword [rax + 8]
sub rdx, r9
sar rdx, 2
test rdx, rdx
je 0x1400819fc
nop word [rax + rax]
cmp dword [r9 + rcx*4], 0xfffffffe
je 0x1400819f1
inc rcx
cmp rcx, rdx
jb 0x1400819e0
jmp 0x1400819fc
movzx eax, byte [rbp + 0x410]
mov dword [r9 + rcx*4], eax
mov rdx, qword [r8 + 0x10]
mov qword [r8 + 0x10], r12
mov rcx, qword [r8 + 8]
mov qword [r8 + 8], r12
mov rax, qword [r8]
mov qword [r8], r12
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
lea rdx, [rsp + 0x38]
lea rcx, [0x140150fe0]
call fcn.14006c570
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140081a7d
mov rax, qword [rsp + 0x48]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140081a78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140081a78
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e1f3c
lea rdx, [0x140150fe0]
lea rcx, [rsp + 0x50]
call fcn.14006b610
mov r8, rax
lea rcx, [rbx + 8]
mov word [rbp + 0x410], cx
mov rcx, r12
mov r9, qword [rax]
mov rdx, qword [rax + 8]
sub rdx, r9
sar rdx, 2
test rdx, rdx
je 0x140081ace
cmp dword [r9 + rcx*4], 0xfffffffe
je 0x140081ac3
inc rcx
cmp rcx, rdx
jb 0x140081ab2
jmp 0x140081ace
movzx eax, byte [rbp + 0x410]
mov dword [r9 + rcx*4], eax
mov rdx, qword [r8 + 0x10]
mov qword [r8 + 0x10], r12
mov rcx, qword [r8 + 8]
mov qword [r8 + 8], r12
mov rax, qword [r8]
mov qword [r8], r12
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
lea rdx, [rsp + 0x38]
lea rcx, [0x140150fe0]
call fcn.14006c570
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140081b4f
mov rax, qword [rsp + 0x48]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140081b4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140081b4a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e1f3c
cmp byte [0x140150caf], 0
jne 0x140081ba4
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [0x14015016c]
mov rdx, qword [0x140150df0]
mov rcx, qword [0x140150da8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [0x140150170]
mov rdx, qword [0x140150df8]
mov rcx, qword [0x140150da8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [0x140150fe0]
lea rcx, [rsp + 0x50]
call fcn.14006b610
mov r8, rax
mov rdx, r14
mov rcx, qword [0x140150da8]
call fcn.14008b360
lea rdx, [0x140150f98]
lea rcx, [rsp + 0x50]
call fcn.14006b610
mov r8, rax
mov rdx, rsi
mov rcx, qword [0x140150da8]
call fcn.14008b360
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r12
mov rsi, qword [0x140150f50]
mov rdi, qword [0x140150f58]
cmp rsi, rdi
je 0x140081c50
sub rdi, rsi
mov rbx, rdi
sar rbx, 2
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.14006f830
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
lea rbx, [rax + rbx*4]
mov qword [rbp - 0x80], rbx
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x78], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov rsi, qword [rbp + 0x418]
mov r14, qword [rbp + 0x420]
cmp rsi, r14
je 0x140081ced
mov rdi, r14
sub rdi, rsi
cmp rdi, 0x1000
jb 0x140081cac
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x1400820aa
call fcn.1400e1f00
test rax, rax
je 0x140081ca5
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140081cc1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rdi, rdi
je 0x140081cbe
mov rcx, rdi
call fcn.1400e1f00
mov rbx, rax
jmp 0x140081cc1
mov rbx, r12
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
lea rax, [rbx + rdi]
mov qword [rsp + 0x48], rax
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
sub rbx, rsi
add rbx, r14
mov qword [rsp + 0x40], rbx
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.14006d630
mov qword [0x140150dd0], rax
test rax, rax
je 0x140082037
cmp dword [0x140150d4c], 1
jne 0x140082037
mov rcx, qword [0x140150eb0]
cmp qword [0x140150ea8], rcx
je 0x140082037
mov rbx, qword [0x140150db8]
add rbx, rax
lea rdx, [0x140150f80]
lea rcx, [rsp + 0x50]
call fcn.14006b610
mov rdx, rax
mov rcx, rbx
call fcn.14007b110
mov r14, rax
lea rcx, [rbp - 0x70]
lea rax, [rbp + 0x1d0]
mov edx, 4
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x140081d70
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov r9, qword [0x140150eb0]
sub r9, qword [0x140150ea8]
sar r9, 2
mov dword [rsp + 0x28], 4
mov eax, dword [0x140150d4c]
mov dword [rsp + 0x20], eax
mov r8, qword [0x140150dd0]
lea rdx, [rbp - 0x70]
mov rcx, qword [0x140150da8]
call fcn.14006f560
mov rsi, rax
lea rdx, [0x140150ea8]
lea rcx, [rsp + 0x50]
call fcn.14006b610
mov rdx, rax
mov rcx, rsi
call fcn.140071560
mov rcx, rbx
sub rcx, rsi
mov rdi, r15
sub rdi, rcx
sub rax, r14
sub r15, rax
lea rax, [rsi + 0x1000]
mov qword [0x140150dd8], rax
mov qword [0x140150de0], rbx
mov qword [0x140150de8], rsi
lea rdx, [0x140150f38]
lea rcx, [rsp + 0x50]
call fcn.14006b610
mov r9, rax
mov r8, rbx
mov rdx, qword [0x140150da8]
lea rcx, [rsp + 0x38]
call fcn.14006d330
mov rdx, rax
lea rcx, [0x140150f38]
call fcn.14006c570
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140081eea
mov rax, qword [rsp + 0x48]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140081ee5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140081ee5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e1f3c
lea rdx, [0x140150f80]
lea rcx, [rsp + 0x50]
call fcn.14006b610
mov r8, rax
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.14006da50
mov rdx, rax
lea rcx, [0x140150f80]
call fcn.14006c570
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140081f65
mov rax, qword [rsp + 0x48]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140081f60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140081f60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e1f3c
lea rdx, [0x140150ea8]
lea rcx, [rsp + 0x50]
call fcn.14006b610
mov r8, rax
mov rdx, r15
lea rcx, [rsp + 0x38]
call fcn.14006da50
mov rdx, rax
lea rcx, [0x140150ea8]
call fcn.14006c570
lea rcx, [rsp + 0x38]
call fcn.14006c330
mov dword [0x140150d7c], 0x41a00000
cmp byte [0x140150da0], 0
jne 0x140081fca
movss xmm0, dword [0x140150174]
mulss xmm0, dword [0x1400ea3f4]
movss dword [0x140150d7c], xmm0
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [0x140150d7c]
mov rdx, qword [0x140150dd8]
mov rcx, qword [0x140150da8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [0x140150ea8]
lea rcx, [rsp + 0x50]
call fcn.14006b610
mov r8, rax
mov rdx, rsi
mov rcx, qword [0x140150da8]
call fcn.14008b360
lea rdx, [0x140150f80]
lea rcx, [rsp + 0x50]
call fcn.14006b610
mov r8, rax
mov rdx, rbx
mov rcx, qword [0x140150da8]
call fcn.14008b360
nop
mov rcx, qword [rbp + 0x418]
test rcx, rcx
je 0x14008207a
mov rdx, qword [rbp + 0x428]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140082075
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140082075
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e1f3c
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.1400e2050
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140003d80
nop
call fcn.140003d80
nop
call fcn.140003d80
nop
call fcn.140003d80
int3