Function at 0x140169660
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create process on windows
Create process suspended
Create thread
Enumerate processes
Execute command
Hide graphical window
Inject thread
Resume thread
Spawn thread to rwx shellcode
Terminate process
Use process replacement

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10c0]
mov eax, 0x11c0
call fcn.140473cc0
sub rsp, rax
mov rax, qword [0x140545d00]
xor rax, rsp
mov qword [rbp + 0x10b0], rax
xor ebx, ebx
mov dword [rbp + 0xb0], 0x6c756d65
mov dword [rbp + 0xb4], 0x2e657461
mov word [rbp + 0xb8], 0x6363
movsd xmm0, qword [rbp + 0xb0]
movsd qword [rsp + 0x70], xmm0
movzx eax, word [rbp + 0xb8]
mov word [rsp + 0x78], ax
mov byte [rsp + 0x7a], bl
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x5d0]
call fcn.14016c6f0
mov rcx, rax
call fcn.140179b50
call fcn.1401c9a50
call fcn.14017de80
call fcn.140179180
call fcn.14019e1b0
lea ecx, [rbx + 8]
call fcn.140473230
lea rcx, [0x140169200]
mov qword [rax], rcx
mov qword [rbp + 0x5a0], rax
lea rcx, [rbp + 0xb8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14016e0c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0xb0], rax
test rax, rax
je 0x14016b35b
cmp dword [rbp + 0xb8], ebx
je 0x14016b34f
movaps xmm0, xmmword [rbp + 0xb0]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14016b34f
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xb0], xmm0
movdqa xmm0, xmmword [0x140532180]
mov dword [rbp + 0x5c0], 0x61684320
mov dword [rbp + 0x5c4], 0xa7269
movups xmmword [rbp + 0xb0], xmm0
movsd xmm0, qword [rbp + 0x5c0]
movsd qword [rbp + 0xc0], xmm0
lea rdx, [rbp + 0xb0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14016cfc0
movdqa xmm0, xmmword [str.Enter_License:]
movdqa xmmword [rbp + 0xb0], xmm0
lea rdx, [rbp + 0xb0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14016cfc0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14016d3d0
lea rax, [rbp + 0x5d0]
mov qword [rbp + 0x5a0], rax
lea rdx, [0x1405f6690]
lea rcx, [rbp + 0x5d0]
call fcn.14016c810
mov r15, rax
lea rax, [rbp + 0x5b0]
mov qword [rbp + 0x5a8], rax
lea rdx, [0x1405f9ad0]
lea rcx, [rbp + 0x5b0]
call fcn.14016c810
mov r14, rax
lea rax, [rbp + 0xb0]
mov qword [rbp - 0x10], rax
lea rdx, [0x1405f9a80]
lea rcx, [rbp + 0xb0]
call fcn.14016c810
mov rsi, rax
lea rax, [rbp + 8]
mov qword [rbp - 8], rax
lea rdx, [0x1405f9d68]
lea rcx, [rbp + 8]
call fcn.14016c810
mov rdi, rax
lea rax, [rbp + 0x28]
mov qword [rbp], rax
lea rdx, [0x1405f9ab0]
lea rcx, [rbp + 0x28]
call fcn.14016c810
mov rbx, rax
lea rdx, [0x1405f9d48]
lea rcx, [rbp + 0x48]
call fcn.14016c810
nop
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r9, rsi
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1401aabe0
test al, al
je 0x14016b253
lea rcx, [0x14052919c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1405321e0]
mov dword [rbp + 0xc0], 0xa216e
movups xmmword [rsp + 0x70], xmm0
mov eax, dword [rbp + 0xc0]
mov dword [rbp - 0x80], eax
lea rdx, [rsp + 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14016cfc0
movdqa xmm0, xmmword [0x1405321c0]
mov dword [rbp + 0x5c0], 0x73646e6f
mov dword [rbp + 0x5c4], 0x2e2e2e
movups xmmword [rbp + 0xb0], xmm0
movsd xmm0, qword [rbp + 0x5c0]
movsd qword [rbp + 0xc0], xmm0
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.14016c6f0
nop
mov edx, 5
lea rcx, [rsp + 0x70]
call fcn.140169460
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1401699a6
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401699a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401699a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1404734ac
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14016cfc0
mov byte [rsp + 0x51], 0
lea rcx, [rsp + 0x51]
call fcn.140167f90
movsxd rcx, eax
mov eax, dword [rcx]
mov dword [0x1405f98cc], eax
mov byte [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
call fcn.140168080
cmp dword [0x1405f98cc], eax
jb 0x14016b36d
mov ecx, Ordinal_35
mov dword [rbp + 0x5a8], ecx
mov word [rbp - 0x40], cx
lea edi, [rcx + 0x2c]
lea r13d, [rcx + 0x29]
movzx esi, cx
movzx r15d, word [0x14052916e]
xor r15w, cx
movzx r14d, word [reloc.WLDAP32.dll_Ordinal_50]
xor r14w, cx
movzx ebx, word [0x140529172]
xor bx, cx
movzx r11d, word [0x140529174]
xor r11w, cx
movzx r10d, word [0x140529176]
xor r10w, cx
movzx r9d, word [0x140529178]
xor r9w, cx
movzx r8d, word [reloc.WS2_32.dll_WSACleanup]
xor r8w, cx
movzx edx, word [0x14052917c]
xor dx, cx
movzx ecx, word [0x14052917e]
xor cx, si
movzx eax, word [0x140529180]
xor ax, si
mov r12d, 0x55
xor r12w, word [rbp + 0x5a8]
mov word [rbp - 0x3e], r12w
xor r13w, si
mov word [rbp - 0x3c], r13w
mov r12d, Ordinal_79
mov r13d, Ordinal_35
xor r12w, r13w
mov word [rbp - 0x3a], r12w
mov r12d, reloc.WS2_32.dll_recvfrom
xor r12w, r13w
mov word [rbp - 0x38], r12w
mov r12d, reloc.WS2_32.dll_recv
xor r12w, r13w
mov word [rbp - 0x36], r12w
mov r12d, 0x57
xor r12w, r13w
mov word [rbp - 0x34], r12w
mov r12d, reloc.WS2_32.dll_inet_ntoa
xor r12w, r13w
mov word [rbp - 0x32], r12w
mov r12d, 0x46
xor r12w, r13w
mov word [rbp - 0x30], r12w
mov r12d, edi
xor r12w, r13w
mov word [rbp - 0x2e], r12w
xor di, r13w
mov word [rbp - 0x2c], di
xor si, r13w
mov word [rbp - 0x2a], si
xor r15w, r13w
mov word [rbp - 0x28], r15w
xor r14w, r13w
mov word [rbp - 0x26], r14w
xor bx, r13w
mov word [rbp - 0x24], bx
xor r11w, r13w
mov word [rbp - 0x22], r11w
xor r10w, r13w
mov word [rbp - 0x20], r10w
xor r9w, r13w
mov word [rbp - 0x1e], r9w
xor r8w, r13w
mov word [rbp - 0x1c], r8w
xor dx, r13w
mov word [rbp - 0x1a], dx
xor cx, r13w
mov word [rbp - 0x18], cx
xor ax, r13w
mov word [rbp - 0x16], ax
xor r13d, r13d
mov word [rbp - 0x14], r13w
lea rcx, [rbp - 0x3e]
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov r9, rax
test rax, rax
jne 0x140169d18
mov ecx, 0x4a
mov dword [rbp + 0x5a8], ecx
mov word [rbp - 0x70], cx
lea edi, [rax + 0x26]
lea r13d, [rax + 0x23]
movzx esi, cx
movzx r15d, word [0x14052916e]
xor r15w, cx
movzx r14d, word [reloc.WLDAP32.dll_Ordinal_50]
xor r14w, cx
movzx ebx, word [0x140529172]
xor bx, cx
movzx r11d, word [0x140529174]
xor r11w, cx
movzx r10d, word [0x140529176]
xor r10w, cx
movzx r9d, word [0x140529178]
xor r9w, cx
movzx r8d, word [reloc.WS2_32.dll_WSACleanup]
xor r8w, cx
movzx edx, word [0x14052917c]
xor dx, cx
movzx ecx, word [0x14052917e]
xor cx, si
movzx eax, word [0x140529180]
xor ax, si
mov r12d, 0x3d
xor r12w, word [rbp + 0x5a8]
mov word [rbp - 0x6e], r12w
xor r13w, si
mov word [rbp - 0x6c], r13w
mov r12d, Ordinal_41
mov r13d, Ordinal_79
xor r12w, r13w
mov word [rbp - 0x6a], r12w
mov r12d, 0x79
xor r12w, r13w
mov word [rbp - 0x68], r12w
mov r12d, 0x78
xor r12w, r13w
mov word [rbp - 0x66], r12w
mov r12d, 0x3f
xor r12w, r13w
mov word [rbp - 0x64], r12w
mov r12d, 0x64
xor r12w, r13w
mov word [rbp - 0x62], r12w
mov r12d, reloc.WLDAP32.dll_Ordinal_46
xor r12w, r13w
mov word [rbp - 0x60], r12w
mov r12d, edi
xor r12w, r13w
mov word [rbp - 0x5e], r12w
xor di, r13w
mov word [rbp - 0x5c], di
xor si, r13w
mov word [rbp - 0x5a], si
xor r15w, r13w
mov word [rbp - 0x58], r15w
xor r14w, r13w
mov word [rbp - 0x56], r14w
xor bx, r13w
mov word [rbp - 0x54], bx
xor r11w, r13w
mov word [rbp - 0x52], r11w
xor r10w, r13w
mov word [rbp - 0x50], r10w
xor r9w, r13w
mov word [rbp - 0x4e], r9w
xor r8w, r13w
mov word [rbp - 0x4c], r8w
xor dx, r13w
mov word [rbp - 0x4a], dx
xor cx, r13w
mov word [rbp - 0x48], cx
xor ax, r13w
mov word [rbp - 0x46], ax
xor r13d, r13d
mov word [rbp - 0x44], r13w
lea rcx, [rbp - 0x6e]
call qword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov r9, rax
test rax, rax
je 0x14016b36d
movdqa xmm1, xmmword [0x140532160]
movdqu xmmword [rbp + 0xb0], xmm1
mov dl, reloc.WS2_32.dll_send
mov r8b, 5
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp + 0xb1], al
xor byte [rbp + 0xb2], cl
xor byte [rbp + 0xb3], cl
xor byte [rbp + 0xb4], cl
xor byte [rbp + 0xb5], cl
xor byte [rbp + 0xb6], cl
xor byte [rbp + 0xb7], cl
xor byte [rbp + 0xb8], cl
xor byte [rbp + 0xb9], cl
xor byte [rbp + 0xba], cl
xor byte [rbp + 0xbb], cl
xor byte [rbp + 0xbc], cl
xor byte [rbp + 0xbd], cl
xor byte [rbp + 0xbe], cl
xor byte [rbp + 0xbf], cl
xor dl, cl
mov byte [rbp + 0xc0], dl
xor r8b, cl
mov byte [rbp + 0xc1], r8b
mov byte [rbp + 0xc2], 0
lea rdx, [rbp + 0xb1]
mov rcx, r9
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x14016b36d
mov qword [0x1405f98c0], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x5f0], xmm0
movups xmmword [rbp + 0x600], xmm0
movups xmmword [rbp + 0x610], xmm0
movups xmmword [rbp + 0x620], xmm0
movups xmmword [rbp + 0x630], xmm0
movups xmmword [rbp + 0x640], xmm0
movups xmmword [rbp + 0x650], xmm0
movups xmmword [rbp + 0x660], xmm0
lea rdx, [rbp + 0x5f0]
xor ecx, ecx
call fcn.140168120
test al, al
je 0x140169ebc
mov byte [rsp + 0x58], 0x3d
mov al, reloc.WS2_32.dll_inet_addr
mov cl, 8
mov dl, 9
mov r8b, reloc.WS2_32.dll_ntohl
mov r9b, reloc.WS2_32.dll_inet_ntoa
mov r10b, 0x3d
xor r10b, 0xf
mov byte [rsp + 0x59], r10b
xor al, 0x3d
mov byte [rsp + 0x5a], al
xor cl, 0x3d
mov byte [rsp + 0x5b], cl
xor dl, 0x3d
mov byte [rsp + 0x5c], dl
xor r8b, 0x3d
mov byte [rsp + 0x5d], r8b
xor r9b, 0x3d
mov byte [rsp + 0x5e], r9b
mov byte [rsp + 0x5f], 0
lea r8, [rsp + 0x59]
mov ecx, 2
call fcn.140167f20
mov r9, rax
cmp r10b, 0x30
jl 0x140169eaf
cmp r10b, 0x39
jg 0x140169eaf
mov ecx, 0x404
call fcn.140167f20
imul eax, r9d
movsx r9d, r10b
add eax, 0xffffffd0
add r9d, eax
inc r8
movzx r10d, byte [r8]
cmp r10b, 0x30
jge 0x140169e84
cmp dword [rbp + 0x5f8], r9d
je 0x14016a2ff
mov dword [rbp + 0x5a8], r13d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rax
xorps xmm1, xmm1
movups xmmword [rbp + 0x5f0], xmm1
movups xmmword [rbp + 0x600], xmm1
movups xmmword [rbp + 0x610], xmm1
movups xmmword [rbp + 0x620], xmm1
movups xmmword [rbp + 0x630], xmm1
movups xmmword [rbp + 0x640], xmm1
mov qword [rbp + 0x650], rax
mov r8d, 0x104
lea rdx, [rbp + 0x670]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
je 0x14016a209
xor edx, edx
mov r8d, 0x904
lea rcx, [rbp + 0x7a0]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x670]
mov rbx, 0xffffffffffffffff
nop dword [rax]
lea rbx, [rbx + 1]
cmp byte [rax + rbx], 0
jne 0x140169f50
lea r8, [rbx + rbx]
lea rdx, [rbp + 0x670]
lea rcx, [rbp + 0x7a0]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0x7a0], reloc.WLDAP32.dll_Ordinal_32
mov word [rbp + rbx + 0x7a1], r13w
movsxd rdi, dword [0x140545e7c]
lea r14, [0x140545e40]
add rdi, r14
cmp dword [rdi], 0x4550
jne 0x14016a209
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x5f0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x7a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x14016a209
xor edx, edx
mov r8d, 0x4d0
lea rcx, [rbp + 0xd0]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x100], 0x10000b
lea rdx, [rbp + 0xd0]
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.DLL_GetThreadContext]
mov rcx, qword [rbp + 0xb0]
test eax, eax
jne 0x14016a03b
mov edx, 0xfffffffc
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
jmp 0x14016a209
mov r8d, dword [rdi + 0x50]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov rdx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
mov qword [rbp + 0x5a0], rax
mov rcx, qword [rbp + 0xb0]
test rax, rax
jne 0x14016a07a
mov edx, 0xfffffffb
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
jmp 0x14016a209
mov r9d, dword [rdi + 0x54]
mov qword [rsp + 0x20], r13
mov r8, r14
mov rdx, rax
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
test eax, eax
jne 0x14016a0aa
mov edx, 0xfffffffa
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
jmp 0x14016a209
mov rbx, r13
cmp r13w, word [rdi + 6]
jae 0x14016a112
mov rsi, r13
nop word [rax + rax]
movsxd rax, dword [0x140545e7c]
add rax, rsi
mov r9d, dword [rax + r14 + 0x118]
mov r8d, dword [rax + r14 + 0x11c]
add r8, r14
mov edx, dword [rax + r14 + 0x114]
add rdx, qword [rbp + 0x5a0]
mov qword [rsp + 0x20], r13
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
test eax, eax
je 0x14016a157
inc rbx
add rsi, 0x28
movzx eax, word [rdi + 6]
cmp rbx, rax
jb 0x14016a0c0
mov rdx, qword [rbp + 0x158]
add rdx, 0x10
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x5a0]
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
test eax, eax
jne 0x14016a16e
mov edx, 0xfffffff8
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
jmp 0x14016a209
mov edx, 0xfffffff9
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
jmp 0x14016a209
mov eax, dword [rdi + 0x28]
add rax, qword [rbp + 0x5a0]
mov qword [rbp + 0x150], rax
lea rdx, [rbp + 0xd0]
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.DLL_SetThreadContext]
test eax, eax
jne 0x14016a1ab
mov edx, 0xfffffff7
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
jmp 0x14016a209
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.DLL_ResumeThread]
mov rcx, qword [rbp + 0xb0]
test eax, eax
jne 0x14016a1d0
mov edx, 0xfffffff6
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
jmp 0x14016a209
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea rdx, [rbp + 0x5a8]
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rcx, [0x14052919c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0x5f0], xmm0
movups xmmword [rbp + 0x600], xmm0
movups xmmword [rbp + 0x610], xmm0
movups xmmword [rbp + 0x620], xmm0
movups xmmword [rbp + 0x630], xmm0
movups xmmword [rbp + 0x640], xmm0
movups xmmword [rbp + 0x650], xmm0
movups xmmword [rbp + 0x660], xmm0
lea rdx, [rbp + 0x5f0]
xor ecx, ecx
call fcn.140168120
test al, al
je 0x14016b48a
mov byte [rsp + 0x60], 0x3d
mov al, reloc.WS2_32.dll_inet_addr
mov cl, 8
mov dl, 9
mov r8b, reloc.WS2_32.dll_ntohl
mov r9b, reloc.WS2_32.dll_inet_ntoa
mov r10b, 0x3d
xor r10b, 0xf
mov byte [rsp + 0x61], r10b
xor al, 0x3d
mov byte [rsp + 0x62], al
xor cl, 0x3d
mov byte [rsp + 0x63], cl
xor dl, 0x3d
mov byte [rsp + 0x64], dl
xor r8b, 0x3d
mov byte [rsp + 0x65], r8b
xor r9b, 0x3d
mov byte [rsp + 0x66], r9b
mov byte [rsp + 0x67], 0
lea r8, [rsp + 0x61]
mov ecx, 2
call fcn.140167f20
mov r9, rax
cmp r10b, 0x30
jl 0x14016a2f2
cmp r10b, 0x39
jg 0x14016a2f2
mov ecx, 0x404
call fcn.140167f20
imul eax, r9d
movsx r9d, r10b
add eax, 0xffffffd0
add r9d, eax
inc r8
movzx r10d, byte [r8]
cmp r10b, 0x30
jge 0x14016a2c7
cmp dword [rbp + 0x5f8], r9d
jne 0x14016b48a
call qword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rbp + 0x5a8], 0x38373535
mov word [rbp + 0x5ac], 0x3735
mov eax, dword [rbp + 0x5a8]
mov dword [rbp + 0x5a0], eax
movzx eax, word [rbp + 0x5ac]
mov word [rbp + 0x5a4], ax
mov byte [rbp + 0x5a6], 0
lea rdx, [rbp + 0x5a0]
lea rcx, [rbp + 0x5d0]
call fcn.14016c6f0
nop
lea rax, [rbp + 0x48]
mov qword [rsp + 0x70], rax
lea rdx, [0x1405f6690]
lea rcx, [rbp + 0x48]
call fcn.14016c810
mov r12, rax
lea rax, [rbp + 0x28]
mov qword [rbp], rax
lea rdx, [rbp + 0x5d0]
lea rcx, [rbp + 0x28]
call fcn.14016c810
mov r15, rax
lea rax, [rbp + 8]
mov qword [rbp - 8], rax
lea rdx, [0x1405f9ad0]
lea rcx, [rbp + 8]
call fcn.14016c810
mov r14, rax
lea rax, [rbp + 0x68]
mov qword [rbp - 0x10], rax
lea rdx, [0x1405f9a80]
lea rcx, [rbp + 0x68]
call fcn.14016c810
mov rsi, rax
lea rax, [rbp + 0x88]
mov qword [rbp + 0x5a0], rax
lea rdx, [0x1405f9d68]
lea rcx, [rbp + 0x88]
call fcn.14016c810
mov rdi, rax
lea rax, [rbp - 0x70]
mov qword [rbp + 0x5a8], rax
lea rdx, [0x1405f9ab0]
lea rcx, [rbp - 0x70]
call fcn.14016c810
mov rbx, rax
lea rdx, [0x1405f9d48]
lea rcx, [rbp - 0x40]
call fcn.14016c810
nop
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x5b0]
call fcn.14017fba0
mov rbx, rax
lea rax, [0x1405f9c08]
cmp rax, rbx
je 0x14016a4c9
mov rcx, qword [0x1405f9c08]
test rcx, rcx
je 0x14016a49e
mov rdx, qword [0x1405f9c18]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x14016a487
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14016a500
mov rcx, r8
call fcn.1404734ac
xorps xmm0, xmm0
movdqu xmmword [0x1405f9c08], xmm0
mov qword [0x1405f9c18], r13
mov rax, qword [rbx]
mov qword [0x1405f9c08], rax
mov rax, qword [rbx + 8]
mov qword [0x1405f9c10], rax
mov rax, qword [rbx + 0x10]
mov qword [0x1405f9c18], rax
mov qword [rbx], r13
mov qword [rbx + 8], r13
mov qword [rbx + 0x10], r13
mov rcx, qword [rbp + 0x5b0]
test rcx, rcx
je 0x14016a50c
mov rdx, qword [rbp + 0x5c0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14016a507
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14016a507
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1404734ac
xorps xmm0, xmm0
mov rdi, qword [0x1405f9c10]
mov rbx, rdi
mov r12, qword [0x1405f9c08]
sub rbx, r12
movdqu xmmword [rbp + 0x5b0], xmm0
mov r15, r13
mov qword [rbp + 0x5c0], r13
je 0x14016a5c7
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x14016b47e
cmp rbx, 0x1000
jb 0x14016a583
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14016b484
call fcn.140473230
test rax, rax
je 0x14016a57c
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14016a58e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140473230
mov rsi, rax
mov qword [rbp + 0x5b0], rsi
lea r15, [rsi + rbx]
mov qword [rbp + 0x5c0], r15
mov r8, rbx
xor edx, edx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
mov rbx, r15
mov qword [rbp + 0x5b8], rbx
mov rdi, qword [0x1405f9c10]
mov r12, qword [0x1405f9c08]
jmp 0x14016a5d5
mov rbx, qword [rbp + 0x5b8]
mov rsi, qword [rbp + 0x5b0]
sub rdi, r12
call fcn.14023d150
mov r14, rax
test rax, rax
je 0x14016a639
call fcn.140245c10
mov rdx, rax
xor r9d, r9d
lea r8, [0x1405291e8]
mov rcx, r14
call fcn.14023e1d0
mov dword [rsp + 0x20], edi
mov r9, r12
lea r8, [rbp + 0x5a8]
mov rdx, rsi
mov rcx, r14
call fcn.14023e280
movsxd rdx, dword [rbp + 0x5a8]
add rdx, rsi
lea r8, [rbp + 0x5a8]
mov rcx, r14
call fcn.14023dcd0
mov rcx, r14
call fcn.14023d050
mov r8, rbx
sub r8, rsi
mov rdx, rsi
call fcn.14016d6f0
cmp rsi, rbx
cmovne rbx, rsi
mov qword [rbp + 0x5b8], rbx
sub rbx, rsi
mov r8, rbx
xor edx, edx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
mov qword [0x1405f9d58], r13
cmp qword [0x1405f9d60], 0xf
lea rax, [0x1405f9d48]
cmova rax, qword [0x1405f9d48]
mov byte [rax], 0
mov qword [0x1405f9ac0], r13
cmp qword [0x1405f9ac8], 0xf
lea rax, [0x1405f9ab0]
cmova rax, qword [0x1405f9ab0]
mov byte [rax], 0
mov qword [0x1405f9d78], r13
cmp qword [0x1405f9d80], 0xf
lea rax, [0x1405f9d68]
cmova rax, qword [0x1405f9d68]
mov byte [rax], 0
mov qword [0x1405f9a90], r13
cmp qword [0x1405f9a98], 0xf
lea rax, [0x1405f9a80]
cmova rax, qword [0x1405f9a80]
mov byte [rax], 0
mov qword [0x1405f9ae0], r13
cmp qword [0x1405f9ae8], 0xf
lea rax, [0x1405f9ad0]
cmova rax, qword [0x1405f9ad0]
mov byte [rax], 0
movdqa xmm0, xmmword [str.Open_the_game__n]
movdqa xmmword [rbp + 0xb0], xmm0
lea rdx, [rbp + 0xb0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14016cfc0
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x140169260]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
cmp byte [0x1405f9944], 0
jne 0x14016a768
mov ecx, 0x2134
call qword [sym.imp.KERNEL32.DLL_Sleep]
cmp byte [0x1405f9944], 0
je 0x14016a754
mov dword [rbp + 0xb0], 0x656d6147
mov dword [rbp + 0xb4], 0x756f4620
mov dword [rbp + 0xb8], 0xa21646e
movsd xmm0, qword [rbp + 0xb0]
movsd qword [rsp + 0x70], xmm0
mov eax, dword [rbp + 0xb8]
mov dword [rsp + 0x78], eax
mov byte [rsp + 0x7c], 0
lea rdx, [rsp + 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14016cfc0
mov dword [rbp + 0xb0], 0x656a6e49
mov dword [rbp + 0xb4], 0x6e697463
mov dword [rbp + 0xb8], 0x2e2e2e67
mov word [rbp + 0xbc], 0xa
movsd xmm0, qword [rbp + 0xb0]
movsd qword [rsp + 0x70], xmm0
mov eax, dword [rbp + 0xb8]
mov dword [rsp + 0x78], eax
movzx eax, word [rbp + 0xbc]
mov word [rsp + 0x7c], ax
lea rdx, [rsp + 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14016cfc0
mov ecx, 0xdac
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [rbp + 0x5a0], 0x2e646f63
mov dword [rbp + 0x5a4], 0x657865
mov rax, qword [rbp + 0x5a0]
mov qword [rbp + 0x5a0], rax
lea rdx, [rbp + 0x5a0]
lea rcx, [rbp + 0xb0]
call fcn.14016c6f0
mov dword [rbp + 0x670], pe_nt_image_headers64
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov r14, rax
mov r12, qword [rbp + 0xb0]
cmp rax, 0xffffffffffffffff
je 0x14016a977
lea rdx, [rbp + 0x670]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_Process32First]
lea rax, [rbp + 0x69c]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x14016a897
lea rcx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
seta byte [rsp + 0x50]
cmova rcx, r12
mov rdi, qword [rbp + 0xc0]
mov r8, rdi
cmp rbx, rdi
cmovb r8, rbx
lea rdx, [rbp + 0x69c]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14016a8f5
cmp rdi, rbx
jb 0x14016a8f5
ja 0x14016a8f5
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov r13d, dword [rbp + 0x678]
jmp 0x14016a977
lea rdx, [rbp + 0x670]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_Process32Next]
test eax, eax
je 0x14016a96e
nop dword [rax]
lea rax, [rbp + 0x69c]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x14016a920
lea rcx, [rbp + 0xb0]
cmp byte [rsp + 0x50], 0
cmovne rcx, r12
mov r8, rdi
cmp rbx, rdi
cmovb r8, rbx
lea rdx, [rbp + 0x69c]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14016a95a
cmp rdi, rbx
jb 0x14016a95a
jbe 0x14016a8e0
lea rdx, [rbp + 0x670]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_Process32Next]
test eax, eax
jne 0x14016a910
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rax, qword [rbp + 0xc8]
cmp rax, 0xf
jbe 0x14016a9c0
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x14016a9b1
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14016a9b1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.1404734ac
nop dword [rax]
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov dword [0x1405f98c8], r13d
xor edx, edx
mov ecx, r13d
call fcn.140168f30
movsxd rbx, eax
mov rcx, qword [0x1405f9c08]
mov r8, qword [0x1405f9c10]
cmp rcx, r8
je 0x14016a9fc
mov r8, rcx
mov qword [0x1405f9c10], rcx
sub r8, rcx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rcx, reloc.WS2_32.dll_ioctlsocket
call fcn.140167b10
cmp ebx, 6
ja case.default.0x14016aa2c
lea rdx, [0x140000000]
mov ecx, dword [rdx + rbx*4 + 0x16b594]
add rcx, rdx
jmp rcx
lea rdx, [rsp + 0x70]
call fcn.14016b610
mov rdx, rax
movzx ecx, byte [rax]
xor cl, 0x65
mov byte [rbp + 0xb0], cl
movzx ecx, byte [rax + 1]
xor cl, 0x65
mov byte [rbp + 0xb1], cl
movzx ecx, byte [rax + 2]
xor cl, 0x65
mov byte [rbp + 0xb2], cl
movzx ecx, byte [rax + 3]
xor cl, 0x65
mov byte [rbp + 0xb3], cl
movzx ecx, byte [rax + 4]
xor cl, 0x65
mov byte [rbp + 0xb4], cl
movzx eax, byte [rax + 5]
xor al, 0x65
mov byte [rbp + 0xb5], al
movzx eax, byte [rdx + 6]
xor al, 0x65
mov byte [rbp + 0xb6], al
movzx eax, byte [rdx + 7]
xor al, 0x65
mov byte [rbp + 0xb7], al
movzx eax, byte [rdx + 8]
xor al, 0x65
mov byte [rbp + 0xb8], al
movzx eax, byte [rdx + 9]
xor al, 0x65
mov byte [rbp + 0xb9], al
movzx eax, byte [rdx + 0xa]
xor al, 0x65
mov byte [rbp + 0xba], al
movzx eax, byte [rdx + 0xb]
xor al, 0x65
mov byte [rbp + 0xbb], al
movzx eax, byte [rdx + 0xc]
xor al, 0x65
mov byte [rbp + 0xbc], al
movzx eax, byte [rdx + 0xd]
xor al, 0x65
mov byte [rbp + 0xbd], al
movzx eax, byte [rdx + 0xe]
xor al, 0x65
mov byte [rbp + 0xbe], al
movzx eax, byte [rdx + 0xf]
xor al, 0x65
mov byte [rbp + 0xbf], al
movzx eax, byte [rdx + 0x10]
xor al, 0x65
mov byte [rbp + 0xc0], al
movzx eax, byte [rdx + 0x11]
xor al, 0x65
mov byte [rbp + 0xc1], al
movups xmm0, xmmword [rbp + 0xb0]
movups xmmword [rdx], xmm0
movzx eax, word [rbp + 0xc0]
mov word [rdx + 0x10], ax
mov rcx, rdx
call fcn.140167b10
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
lea rdx, [rsp + 0x70]
call fcn.14016b640
mov rdx, rax
movzx ecx, byte [rax]
xor cl, 0x6c
mov byte [rbp + 0xb0], cl
movzx ecx, byte [rax + 1]
xor cl, 0x6c
mov byte [rbp + 0xb1], cl
movzx ecx, byte [rax + 2]
xor cl, 0x6c
mov byte [rbp + 0xb2], cl
movzx ecx, byte [rax + 3]
xor cl, 0x6c
mov byte [rbp + 0xb3], cl
movzx ecx, byte [rax + 4]
xor cl, 0x6c
mov byte [rbp + 0xb4], cl
movzx eax, byte [rax + 5]
xor al, 0x6c
mov byte [rbp + 0xb5], al
movzx eax, byte [rdx + 6]
xor al, 0x6c
mov byte [rbp + 0xb6], al
movzx eax, byte [rdx + 7]
xor al, 0x6c
mov byte [rbp + 0xb7], al
movzx eax, byte [rdx + 8]
xor al, 0x6c
mov byte [rbp + 0xb8], al
movzx eax, byte [rdx + 9]
xor al, 0x6c
mov byte [rbp + 0xb9], al
movzx eax, byte [rdx + 0xa]
xor al, 0x6c
mov byte [rbp + 0xba], al
movzx eax, byte [rdx + 0xb]
xor al, 0x6c
mov byte [rbp + 0xbb], al
movzx eax, byte [rdx + 0xc]
xor al, 0x6c
mov byte [rbp + 0xbc], al
movzx eax, byte [rdx + 0xd]
xor al, 0x6c
mov byte [rbp + 0xbd], al
movzx eax, byte [rdx + 0xe]
xor al, 0x6c
mov byte [rbp + 0xbe], al
movzx eax, byte [rdx + 0xf]
xor al, 0x6c
mov byte [rbp + 0xbf], al
movzx eax, byte [rdx + 0x10]
xor al, 0x6c
mov byte [rbp + 0xc0], al
movzx eax, byte [rdx + 0x11]
xor al, 0x6c
mov byte [rbp + 0xc1], al
movups xmm0, xmmword [rbp + 0xb0]
movups xmmword [rdx], xmm0
movzx eax, word [rbp + 0xc0]
mov word [rdx + 0x10], ax
mov rcx, rdx
call fcn.140167b10
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
lea rdx, [rsp + 0x70]
call fcn.14016b670
mov rdx, rax
movzx ecx, byte [rax]
xor cl, 0x73
mov byte [rbp + 0xb0], cl
movzx ecx, byte [rax + 1]
xor cl, 0x73
mov byte [rbp + 0xb1], cl
movzx ecx, byte [rax + 2]
xor cl, 0x73
mov byte [rbp + 0xb2], cl
movzx ecx, byte [rax + 3]
xor cl, 0x73
mov byte [rbp + 0xb3], cl
movzx ecx, byte [rax + 4]
xor cl, 0x73
mov byte [rbp + 0xb4], cl
movzx eax, byte [rax + 5]
xor al, 0x73
mov byte [rbp + 0xb5], al
movzx eax, byte [rdx + 6]
xor al, 0x73
mov byte [rbp + 0xb6], al
movzx eax, byte [rdx + 7]
xor al, 0x73
mov byte [rbp + 0xb7], al
movzx eax, byte [rdx + 8]
xor al, 0x73
mov byte [rbp + 0xb8], al
movzx eax, byte [rdx + 9]
xor al, 0x73
mov byte [rbp + 0xb9], al
movzx eax, byte [rdx + 0xa]
xor al, 0x73
mov byte [rbp + 0xba], al
movzx eax, byte [rdx + 0xb]
xor al, 0x73
mov byte [rbp + 0xbb], al
movzx eax, byte [rdx + 0xc]
xor al, 0x73
mov byte [rbp + 0xbc], al
movzx eax, byte [rdx + 0xd]
xor al, 0x73
mov byte [rbp + 0xbd], al
movzx eax, byte [rdx + 0xe]
xor al, 0x73
mov byte [rbp + 0xbe], al
movzx eax, byte [rdx + 0xf]
xor al, 0x73
mov byte [rbp + 0xbf], al
movzx eax, byte [rdx + 0x10]
xor al, 0x73
mov byte [rbp + 0xc0], al
movzx eax, byte [rdx + 0x11]
xor al, 0x73
mov byte [rbp + 0xc1], al
movups xmm0, xmmword [rbp + 0xb0]
movups xmmword [rdx], xmm0
movzx eax, word [rbp + 0xc0]
mov word [rdx + 0x10], ax
mov rcx, rdx
call fcn.140167b10
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
lea rdx, [rsp + 0x70]
call fcn.14016b6a0
mov rdx, rax
movzx ecx, byte [rax]
xor cl, 0x7a
mov byte [rbp + 0xb0], cl
movzx ecx, byte [rax + 1]
xor cl, 0x7a
mov byte [rbp + 0xb1], cl
movzx ecx, byte [rax + 2]
xor cl, 0x7a
mov byte [rbp + 0xb2], cl
movzx ecx, byte [rax + 3]
xor cl, 0x7a
mov byte [rbp + 0xb3], cl
movzx ecx, byte [rax + 4]
xor cl, 0x7a
mov byte [rbp + 0xb4], cl
movzx eax, byte [rax + 5]
xor al, 0x7a
mov byte [rbp + 0xb5], al
movzx eax, byte [rdx + 6]
xor al, 0x7a
mov byte [rbp + 0xb6], al
movzx eax, byte [rdx + 7]
xor al, 0x7a
mov byte [rbp + 0xb7], al
movzx eax, byte [rdx + 8]
xor al, 0x7a
mov byte [rbp + 0xb8], al
movzx eax, byte [rdx + 9]
xor al, 0x7a
mov byte [rbp + 0xb9], al
movzx eax, byte [rdx + 0xa]
xor al, 0x7a
mov byte [rbp + 0xba], al
movzx eax, byte [rdx + 0xb]
xor al, 0x7a
mov byte [rbp + 0xbb], al
movzx eax, byte [rdx + 0xc]
xor al, 0x7a
mov byte [rbp + 0xbc], al
movzx eax, byte [rdx + 0xd]
xor al, 0x7a
mov byte [rbp + 0xbd], al
movzx ecx, byte [rdx + 0xe]
xor cl, 0x7a
movsd xmm0, qword [rbp + 0xb0]
movsd qword [rdx], xmm0
mov eax, dword [rbp + 0xb8]
mov dword [rdx + 8], eax
movzx eax, word [rbp + 0xbc]
mov word [rdx + 0xc], ax
mov byte [rdx + 0xe], cl
mov rcx, rdx
call fcn.140167b10
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
lea rdx, [rsp + 0x70]
call fcn.14016b6d0
mov rdx, rax
movzx ecx, byte [rax]
xor cl, 0x81
mov byte [rbp + 0xb0], cl
movzx ecx, byte [rax + 1]
xor cl, 0x81
mov byte [rbp + 0xb1], cl
movzx ecx, byte [rax + 2]
xor cl, 0x81
mov byte [rbp + 0xb2], cl
movzx ecx, byte [rax + 3]
xor cl, 0x81
mov byte [rbp + 0xb3], cl
movzx ecx, byte [rax + 4]
xor cl, 0x81
mov byte [rbp + 0xb4], cl
movzx eax, byte [rax + 5]
xor al, 0x81
mov byte [rbp + 0xb5], al
movzx eax, byte [rdx + 6]
xor al, 0x81
mov byte [rbp + 0xb6], al
movzx eax, byte [rdx + 7]
xor al, 0x81
mov byte [rbp + 0xb7], al
movzx eax, byte [rdx + 8]
xor al, 0x81
mov byte [rbp + 0xb8], al
movzx eax, byte [rdx + 9]
xor al, 0x81
mov byte [rbp + 0xb9], al
movzx eax, byte [rdx + 0xa]
xor al, 0x81
mov byte [rbp + 0xba], al
movzx eax, byte [rdx + 0xb]
xor al, 0x81
mov byte [rbp + 0xbb], al
movzx eax, byte [rdx + 0xc]
xor al, 0x81
mov byte [rbp + 0xbc], al
movzx eax, byte [rdx + 0xd]
xor al, 0x81
mov byte [rbp + 0xbd], al
movzx ecx, byte [rdx + 0xe]
xor cl, 0x81
movsd xmm0, qword [rbp + 0xb0]
movsd qword [rdx], xmm0
mov eax, dword [rbp + 0xb8]
mov dword [rdx + 8], eax
movzx eax, word [rbp + 0xbc]
mov word [rdx + 0xc], ax
mov byte [rdx + 0xe], cl
mov rcx, rdx
call fcn.140167b10
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
lea rdx, [rsp + 0x70]
call fcn.14016b700
mov rdx, rax
movzx ecx, byte [rax]
xor cl, 0x88
mov byte [rbp + 0xb0], cl
movzx ecx, byte [rax + 1]
xor cl, 0x88
mov byte [rbp + 0xb1], cl
movzx ecx, byte [rax + 2]
xor cl, 0x88
mov byte [rbp + 0xb2], cl
movzx ecx, byte [rax + 3]
xor cl, 0x88
mov byte [rbp + 0xb3], cl
movzx ecx, byte [rax + 4]
xor cl, 0x88
mov byte [rbp + 0xb4], cl
movzx eax, byte [rax + 5]
xor al, 0x88
mov byte [rbp + 0xb5], al
movzx eax, byte [rdx + 6]
xor al, 0x88
mov byte [rbp + 0xb6], al
movzx eax, byte [rdx + 7]
xor al, 0x88
mov byte [rbp + 0xb7], al
movzx eax, byte [rdx + 8]
xor al, 0x88
mov byte [rbp + 0xb8], al
movzx eax, byte [rdx + 9]
xor al, 0x88
mov byte [rbp + 0xb9], al
movzx eax, byte [rdx + 0xa]
xor al, 0x88
mov byte [rbp + 0xba], al
movzx eax, byte [rdx + 0xb]
xor al, 0x88
mov byte [rbp + 0xbb], al
movzx eax, byte [rdx + 0xc]
xor al, 0x88
mov byte [rbp + 0xbc], al
movzx eax, byte [rdx + 0xd]
xor al, 0x88
mov byte [rbp + 0xbd], al
movzx eax, byte [rdx + 0xe]
xor al, 0x88
mov byte [rbp + 0xbe], al
movzx eax, byte [rdx + 0xf]
xor al, 0x88
mov byte [rbp + 0xbf], al
movzx eax, byte [rdx + 0x10]
xor al, 0x88
mov byte [rbp + 0xc0], al
movzx eax, byte [rdx + 0x11]
xor al, 0x88
mov byte [rbp + 0xc1], al
movzx eax, byte [rdx + 0x12]
xor al, 0x88
mov byte [rbp + 0xc2], al
movzx eax, byte [rdx + 0x13]
xor al, 0x88
mov byte [rbp + 0xc3], al
movzx eax, byte [rdx + 0x14]
xor al, 0x88
mov byte [rbp + 0xc4], al
movzx eax, byte [rdx + 0x15]
xor al, 0x88
mov byte [rbp + 0xc5], al
movups xmm0, xmmword [rbp + 0xb0]
movups xmmword [rdx], xmm0
mov eax, dword [rbp + 0xc0]
mov dword [rdx + 0x10], eax
movzx eax, word [rbp + 0xc4]
mov word [rdx + 0x14], ax
mov rcx, rdx
call fcn.140167b10
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
lea rdx, [rsp + 0x70]
call fcn.14016b730
mov rdx, rax
movzx ecx, byte [rax]
xor cl, 0x8f
mov byte [rbp + 0xb0], cl
movzx ecx, byte [rax + 1]
xor cl, 0x8f
mov byte [rbp + 0xb1], cl
movzx ecx, byte [rax + 2]
xor cl, 0x8f
mov byte [rbp + 0xb2], cl
movzx ecx, byte [rax + 3]
xor cl, 0x8f
mov byte [rbp + 0xb3], cl
movzx ecx, byte [rax + 4]
xor cl, 0x8f
mov byte [rbp + 0xb4], cl
movzx eax, byte [rax + 5]
xor al, 0x8f
mov byte [rbp + 0xb5], al
movzx eax, byte [rdx + 6]
xor al, 0x8f
mov byte [rbp + 0xb6], al
movzx eax, byte [rdx + 7]
xor al, 0x8f
mov byte [rbp + 0xb7], al
movzx eax, byte [rdx + 8]
xor al, 0x8f
mov byte [rbp + 0xb8], al
movzx eax, byte [rdx + 9]
xor al, 0x8f
mov byte [rbp + 0xb9], al
movzx eax, byte [rdx + 0xa]
xor al, 0x8f
mov byte [rbp + 0xba], al
movzx eax, byte [rdx + 0xb]
xor al, 0x8f
mov byte [rbp + 0xbb], al
movzx eax, byte [rdx + 0xc]
xor al, 0x8f
mov byte [rbp + 0xbc], al
movzx eax, byte [rdx + 0xd]
xor al, 0x8f
mov byte [rbp + 0xbd], al
movzx ecx, byte [rdx + 0xe]
xor cl, 0x8f
movsd xmm0, qword [rbp + 0xb0]
movsd qword [rdx], xmm0
mov eax, dword [rbp + 0xb8]
mov dword [rdx + 8], eax
movzx eax, word [rbp + 0xbc]
mov word [rdx + 0xc], ax
mov byte [rdx + 0xe], cl
mov rcx, rdx
call fcn.140167b10
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
test rsi, rsi
je 0x14016b208
sub r15, rsi
mov rax, rsi
cmp r15, 0x1000
jb 0x14016b1fc
add r15, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14016b1fc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r15
mov rcx, rsi
call fcn.1404734ac
nop
mov rdx, qword [rbp + 0x5e8]
cmp rdx, 0xf
jbe 0x14016b31d
inc rdx
mov rcx, qword [rbp + 0x5d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14016b318
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14016b318
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
movdqa xmm0, xmmword [0x1405321f0]
mov dword [rbp + 0x5c0], 0x726f2f64
mov dword [rbp + 0x5c4], 0x70784520
mov dword [rbp + 0x5c8], 0x64657269
mov word [rbp + 0x5cc], reloc.WLDAP32.dll_Ordinal_33
movups xmmword [rbp + 0xb0], xmm0
movsd xmm0, qword [rbp + 0x5c0]
movsd qword [rbp + 0xc0], xmm0
mov eax, dword [rbp + 0x5c8]
mov dword [rbp + 0xc8], eax
movzx eax, word [rbp + 0x5cc]
mov word [rbp + 0xcc], ax
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x5d0]
call fcn.14016c6f0
nop
mov edx, 3
lea rcx, [rbp + 0x5d0]
call fcn.140169460
nop
mov rdx, qword [rbp + 0x5e8]
cmp rdx, 0xf
jbe 0x14016b31d
inc rdx
mov rcx, qword [rbp + 0x5d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14016b318
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14016b318
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1404734ac
xor eax, eax
mov rcx, qword [rbp + 0x10b0]
xor rcx, rsp
call fcn.140473210
lea r11, [rsp + 0x11c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0xb8], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rdx, [rsp + 0x70]
call fcn.14016b5b0
mov rdx, rax
movzx ecx, byte [rax]
xor cl, 0xb
mov byte [rbp + 0xb0], cl
movzx ecx, byte [rax + 1]
xor cl, 0xb
mov byte [rbp + 0xb1], cl
movzx ecx, byte [rax + 2]
xor cl, 0xb
mov byte [rbp + 0xb2], cl
movzx ecx, byte [rax + 3]
xor cl, 0xb
mov byte [rbp + 0xb3], cl
movzx ecx, byte [rax + 4]
xor cl, 0xb
mov byte [rbp + 0xb4], cl
movzx eax, byte [rax + 5]
xor al, 0xb
mov byte [rbp + 0xb5], al
movzx eax, byte [rdx + 6]
xor al, 0xb
mov byte [rbp + 0xb6], al
movzx eax, byte [rdx + 7]
xor al, 0xb
mov byte [rbp + 0xb7], al
movzx eax, byte [rdx + 8]
xor al, 0xb
mov byte [rbp + 0xb8], al
movzx eax, byte [rdx + 9]
xor al, 0xb
mov byte [rbp + 0xb9], al
movzx eax, byte [rdx + 0xa]
xor al, 0xb
mov byte [rbp + 0xba], al
movzx eax, byte [rdx + 0xb]
xor al, 0xb
mov byte [rbp + 0xbb], al
movzx eax, byte [rdx + 0xc]
xor al, 0xb
mov byte [rbp + 0xbc], al
movzx eax, byte [rdx + 0xd]
xor al, 0xb
mov byte [rbp + 0xbd], al
movzx eax, byte [rdx + 0xe]
xor al, 0xb
mov byte [rbp + 0xbe], al
movzx eax, byte [rdx + 0xf]
xor al, 0xb
mov byte [rbp + 0xbf], al
movzx eax, byte [rdx + 0x10]
xor al, 0xb
mov byte [rbp + 0xc0], al
movzx eax, byte [rdx + 0x11]
xor al, 0xb
mov byte [rbp + 0xc1], al
movzx ecx, byte [rdx + 0x12]
xor cl, 0xb
movups xmm0, xmmword [rbp + 0xb0]
movups xmmword [rdx], xmm0
movzx eax, word [rbp + 0xc0]
mov word [rdx + 0x10], ax
mov byte [rdx + 0x12], cl
mov rcx, rdx
call fcn.140169380
nop
call fcn.14016dce0
int3
call fcn.140167c70
nop
lea rdx, [rsp + 0x70]
call fcn.14016b5e0
mov rdx, rax
movzx ecx, byte [rax]
xor cl, 0x14
mov byte [rbp + 0xb0], cl
movzx ecx, byte [rax + 1]
xor cl, 0x14
mov byte [rbp + 0xb1], cl
movzx ecx, byte [rax + 2]
xor cl, 0x14
mov byte [rbp + 0xb2], cl
movzx ecx, byte [rax + 3]
xor cl, 0x14
mov byte [rbp + 0xb3], cl
movzx ecx, byte [rax + 4]
xor cl, 0x14
mov byte [rbp + 0xb4], cl
movzx eax, byte [rax + 5]
xor al, 0x14
mov byte [rbp + 0xb5], al
movzx eax, byte [rdx + 6]
xor al, 0x14
mov byte [rbp + 0xb6], al
movzx eax, byte [rdx + 7]
xor al, 0x14
mov byte [rbp + 0xb7], al
movzx eax, byte [rdx + 8]
xor al, 0x14
mov byte [rbp + 0xb8], al
movzx eax, byte [rdx + 9]
xor al, 0x14
mov byte [rbp + 0xb9], al
movzx eax, byte [rdx + 0xa]
xor al, 0x14
mov byte [rbp + 0xba], al
movzx eax, byte [rdx + 0xb]
xor al, 0x14
mov byte [rbp + 0xbb], al
movzx eax, byte [rdx + 0xc]
xor al, 0x14
mov byte [rbp + 0xbc], al
movzx eax, byte [rdx + 0xd]
xor al, 0x14
mov byte [rbp + 0xbd], al
movzx eax, byte [rdx + 0xe]
xor al, 0x14
mov byte [rbp + 0xbe], al
movzx eax, byte [rdx + 0xf]
xor al, 0x14
mov byte [rbp + 0xbf], al
movzx eax, byte [rdx + 0x10]
xor al, 0x14
mov byte [rbp + 0xc0], al
movzx eax, byte [rdx + 0x11]
xor al, 0x14
mov byte [rbp + 0xc1], al
movups xmm0, xmmword [rbp + 0xb0]
movups xmmword [rdx], xmm0
movzx eax, word [rbp + 0xc0]
mov word [rdx + 0x10], ax
mov rcx, rdx
call fcn.140169380
int3