Function at 0x140001684
Capabilities:
Encrypt data using salsa20 or chacha
Get system information on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc98
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xc00], xmm13
movaps xmmword [rbp + 0xbf0], xmm12
movaps xmmword [rbp + 0xbe0], xmm11
movaps xmmword [rbp + 0xbd0], xmm10
movaps xmmword [rbp + 0xbc0], xmm9
movdqa xmmword [rbp + 0xbb0], xmm8
movaps xmmword [rbp + 0xba0], xmm7
movaps xmmword [rbp + 0xb90], xmm6
and rsp, 0xffffffffffffffe0
lea rax, [0x14002d4af]
mov rcx, rax
shr rcx, 0x38
mov byte [rsp + 0x467], cl
mov rcx, rax
shr rcx, 0x28
mov word [rsp + 0x465], cx
mov rcx, rax
shr rcx, 8
mov dword [rsp + 0x461], ecx
push 0x20
pop rbx
mov qword [rsp + 0x468], rbx
lea r14, [0x14002d4db]
mov qword [rsp + 0x470], r14
mov qword [rsp + 0x478], rbx
lea rdi, str.expand_32_byte_kymmxmmzmm
mov qword [rsp + 0x480], rdi
and qword [rsp + 0x488], 0
mov qword [rsp + 0x490], rdi
and qword [rsp + 0x498], 0
movdqa xmm0, xmmword [0x140015060]
movdqu xmmword [rsp + 0x4a0], xmm0
mov word [rsp + 0x4b0], 0x113
movabs rcx, 0x100000001000
mov qword [rsp + 0x4b8], rcx
mov dword [rsp + 0x4c0], 0x400
mov byte [rsp + 0x460], al
mov byte [rsp + 0x4b2], 0
mov ecx, 0x400000
call fcn.140003309
test rax, rax
je 0x140002bf6
mov rsi, rax
xor r15d, r15d
lea rcx, [rsi + r15]
cmp r15, 0x3ffc00
je 0x1400017e2
mov r8d, 0x400
xor edx, edx
call sub.msvcrt.dll_memset
add r15, 0x400
jmp 0x1400017bf
xor r15d, r15d
mov r8d, 0x400
xor edx, edx
call sub.msvcrt.dll_memset
mov qword [rsp + 0xb0], 1
mov eax, 0x1000
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rax
push 1
pop r11
lea rax, [rsp + 0x120]
mov dword [rax], r11d
push 0x20
pop rcx
lea rdx, [rsp + 0x160]
mov dword [rdx], ecx
lea r9, [rsp + 0x1e0]
mov dword [r9], ecx
lea r10, [rsp + 0x220]
mov dword [r10], ecx
lea r8, [rsp + 0x800]
mov qword [r8], rax
push 4
pop rax
mov qword [r8 + 8], rax
mov qword [r8 + 0x10], rdx
lea rcx, [rsp + 0x180]
mov dword [rcx], 0x1000
mov qword [r8 + 0x18], rax
mov qword [r8 + 0x20], rcx
lea rcx, [rsp + 0x1a0]
mov dword [rcx], 3
mov qword [r8 + 0x28], rax
mov qword [r8 + 0x30], rcx
lea rcx, [rsp + 0x1c0]
mov dword [rcx], 0x13
mov qword [r8 + 0x38], rax
mov qword [r8 + 0x40], rcx
lea rcx, [rsp + 0x100]
mov qword [r8 + 0x48], rax
mov qword [r8 + 0x50], rcx
mov qword [r8 + 0x58], rax
mov qword [r8 + 0x60], r9
mov rdx, qword [rsp + 0x460]
mov qword [r8 + 0x68], rax
mov qword [r8 + 0x70], rdx
mov qword [r8 + 0x78], rbx
mov qword [r8 + 0x80], r10
lea rdx, [rsp + 0x260]
and dword [rdx], 0
mov qword [r8 + 0x88], rax
mov qword [r8 + 0x90], r14
mov qword [r8 + 0x98], rbx
mov qword [r8 + 0xa0], rdx
lea rdx, [rsp + 0x2a0]
and dword [rdx], 0
mov qword [r8 + 0xa8], rax
mov qword [r8 + 0xb0], rdi
and qword [r8 + 0xb8], 0
mov dword [rcx], r11d
mov qword [r8 + 0xc0], rdx
mov qword [r8 + 0xc8], rax
mov qword [r8 + 0xd0], rdi
and qword [r8 + 0xd8], 0
pxor xmm0, xmm0
lea rdi, [rsp + 0x6f0]
movdqa xmmword [rdi + 0x30], xmm0
movdqa xmmword [rdi + 0x20], xmm0
movdqa xmmword [rdi + 0x10], xmm0
movdqa xmmword [rdi], xmm0
and qword [rdi + 0x40], 0
push 0x40
pop rdx
push 0xe
pop r9
mov rcx, rdi
call fcn.140003f5a
movdqa xmm0, xmmword [rdi]
movaps xmm1, xmmword [rdi + 0x10]
movaps xmm2, xmmword [rdi + 0x20]
movaps xmm3, xmmword [rdi + 0x30]
lea rdi, [rsp + 0x330]
movaps xmmword [rdi + 0x30], xmm3
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movdqa xmmword [rdi], xmm0
push 0x48
pop rbx
cmp r15, 1
je 0x1400019f9
lea r14, [r15 + 1]
and dword [rsp + 0x370], 0
mov dword [rsp + 0x374], r15d
mov edx, 0x400
mov rcx, rsi
mov r8, rdi
mov r9, rbx
call fcn.140004297
mov dword [rsp + 0x370], 1
lea rcx, [rsi + 0x400]
mov edx, 0x400
mov r8, rdi
mov r9, rbx
call fcn.140004297
add rsi, 0x400000
mov r15, r14
jmp 0x14000199e
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
xor r15d, r15d
lea rbx, [rsp + 0x460]
lea r14, [rsp + 0x800]
cmp r15d, 3
je 0x140001a74
xor r12d, r12d
cmp r12d, 4
je 0x140001a6f
xor r13d, r13d
cmp r13d, 1
je 0x140001a6a
mov dword [rsp + 0x800], r15d
mov dword [rsp + 0x804], r13d
inc r13d
mov dword [rsp + 0x808], r12d
and dword [rsp + 0x80c], 0
mov rcx, rbx
mov rdx, r14
mov r8, rsi
mov r9, rdi
call fcn.140003324
jmp 0x140001a2e
inc r12d
jmp 0x140001a25
inc r15d
jmp 0x140001a1c
cmp qword [rsp + 0xa8], 0xfff
jbe 0x140002bf6
mov edx, 0x3ffc00
add rdx, qword [rsp + 0xa0]
lea rsi, [rsp + 0x800]
mov r8d, 0x400
mov rcx, rsi
call sub.msvcrt.dll_memcpy
push 0x20
pop rdi
mov rcx, rdi
mov dl, 1
call fcn.1400030e3
mov r15, rdx
mov r9d, 0x400
mov qword [rsp + 0x78], rax
mov rcx, rax
mov rdx, rdi
mov r8, rsi
call fcn.140004297
mov r8, qword [rsp + 0xa8]
test r8, r8
je 0x140001af3
shl r8, 0xa
mov rcx, qword [rsp + 0xa0]
push 8
pop rdx
call fcn.1400032ff
mov rax, qword [rsp + 0x78]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rsi, [rsp + 0x330]
movaps xmmword [rsi - 0x10], xmm1
movaps xmmword [rsi - 0x20], xmm0
mov ecx, 0x17c0f
call fcn.14000312e
mov r12, rax
mov r13, rdx
lea rdx, [0x1400158a0]
mov r8d, 0x17c0f
mov rcx, rax
call sub.msvcrt.dll_memcpy
lea rdx, [rsp + 0x700]
xorps xmm0, xmm0
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea rax, [rsp + 0x310]
lea r9, [rsp + 0x2a0]
mov qword [r9], rax
mov qword [r9 + 8], 0x20
mov qword [r9 + 0x10], rsi
and qword [r9 + 0x18], 0
movdqu xmm0, xmmword [str.expand_32_byte_kymmxmmzmm]
movdqa xmmword [rdx - 0x10], xmm0
mov qword [r9 + 0x20], 4
lea r8, [rsp + 0x720]
lea rsi, [rsp + 0x460]
mov rcx, rsi
call fcn.140008b07
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x30]
mov r8, qword [rsi + 0x38]
mov r9, qword [rsi + 0x40]
cmp r8, r9
jae 0x140001bca
cmp rdx, 4
jne 0x140002bf6
mov r10d, dword [rcx + r8*4]
mov dword [rax + r8*4], r10d
inc r8
jmp 0x140001bae
lea rax, str.:yXV_
lea r9, [rsp + 0xa0]
mov qword [r9], rax
mov qword [r9 + 8], 0xc
lea rax, [0x14002d4db]
mov qword [r9 + 0x10], rax
and qword [r9 + 0x18], 0
mov qword [r9 + 0x20], 4
lea rdx, [rsp + 0x724]
lea r8, [rsp + 0x730]
lea rsi, [rsp + 0x460]
mov rcx, rsi
call fcn.140008b07
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x30]
mov r8, qword [rsi + 0x38]
mov r9, qword [rsi + 0x40]
cmp r8, r9
jae 0x140001c4b
cmp rdx, 4
jne 0x140002bf6
mov r10d, dword [rcx + r8*4]
mov dword [rax + r8*4], r10d
inc r8
jmp 0x140001c2f
mov al, byte [0x140014010]
cmp al, 0xff
jne 0x140001d1b
lea rsi, [rsp + 0x330]
mov rcx, rsi
call fcn.1400073fd
lea rdi, [rsp + 0x460]
mov rcx, rdi
call fcn.14000741f
mov esi, dword [rsi + 8]
mov edi, dword [rdi + 4]
lea rcx, [0x14002d6a0]
lea rdx, [0x14002d6a3]
call fcn.1400085ae
mov ebx, esi
not ebx
test al, al
je 0x140001cae
test ebx, 0xc000000
jne 0x140001d05
call fcn.14000985c
and eax, 2
shr eax, 1
jmp 0x140001d07
lea rcx, [0x14002d6a0]
mov rdx, rcx
call fcn.1400085ae
test al, al
je 0x140001cd4
test ebx, 0xc000000
jne 0x140001d05
call fcn.14000985c
not eax
test al, 6
jmp 0x140001d00
lea rcx, [0x14002d6a0]
lea rdx, [0x14002d6a6]
call fcn.1400085ae
mov ecx, eax
mov al, 1
test cl, cl
je 0x140001d07
test ebx, 0xc000000
jne 0x140001d05
call fcn.14000985c
not eax
test al, 0xe6
sete al
jmp 0x140001d07
xor eax, eax
shr dil, 5
and dil, al
shr esi, 0x1c
and sil, dil
mov byte [0x140014010], sil
movaps xmm0, xmmword [rsp + 0x6f0]
movaps xmm1, xmmword [rsp + 0x700]
movaps xmm2, xmmword [rsp + 0x710]
movaps xmm3, xmmword [rsp + 0x720]
lea rsi, [rsp + 0x370]
movaps xmmword [rsi - 0x10], xmm3
movaps xmmword [rsi - 0x20], xmm2
movaps xmmword [rsi - 0x30], xmm1
movaps xmmword [rsi - 0x40], xmm0
mov rcx, rsi
call fcn.140008af4
mov byte [rsi + 0x40], 0
xorps xmm0, xmm0
lea rdx, [rsp + 0xe0]
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x330]
push 0x20
pop r8
call fcn.140008eff
mov al, byte [0x140014011]
cmp al, 0xff
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x60], r13
je 0x14000243c
cmp al, 1
jne 0x140002504
lea rsi, [rsp + 0x460]
lea rdx, [rsp + 0xe0]
mov rcx, rsi
call fcn.14000b839
movaps xmm6, xmmword [rsi]
movaps xmm7, xmmword [rsi + 0x10]
movaps xmm0, xmmword [rsi + 0x20]
movaps xmm1, xmmword [rsi + 0x30]
lea rdx, [rsp + 0x2a0]
movaps xmmword [rdx], xmm0
movaps xmmword [rdx + 0x10], xmm1
movaps xmm0, xmmword [rsi + 0x40]
movaps xmmword [rdx + 0x20], xmm0
movaps xmm0, xmmword [rsi + 0x50]
movaps xmmword [rdx + 0x30], xmm0
lea rsi, [rsp + 0xa0]
mov rcx, rsi
mov r8, rdx
call fcn.140009950
movaps xmm10, xmmword [rsi]
movaps xmm11, xmmword [rsi + 0x10]
movaps xmm8, xmmword [rsi + 0x20]
movaps xmm9, xmmword [rsi + 0x30]
mov eax, 0x3ffffff
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x6a0]
push 0xffffffffffffffff
pop rdx
mov r8d, 0x3ffffff
mov r9d, 0x3ffffff
mov rcx, rdi
call fcn.140009ed3
lea rdx, [rsp + 0x3c0]
movaps xmmword [rdx + 0x10], xmm11
movaps xmmword [rdx], xmm10
lea rsi, [rsp + 0x420]
mov rcx, rsi
mov r8, rdi
call fcn.14000a173
push 0x1a
pop r8
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x6c0]
push 0x40
pop rdx
mov rcx, rdi
mov r9, r8
call fcn.140009ed3
lea rdx, [rsp + 0x3e0]
movaps xmmword [rdx + 0x10], xmm11
movaps xmmword [rdx], xmm10
lea rbx, [rsp + 0x400]
mov rcx, rbx
mov r8, rdi
call fcn.14000b8b7
lea r14, [rsp + 0x440]
mov rcx, r14
mov rdx, rbx
call fcn.14000a184
lea r15, [rsp + 0x460]
mov rcx, r15
mov rdx, rsi
mov r8, r14
call fcn.140009f24
movaps xmm10, xmmword [r15]
movaps xmm11, xmmword [r15 + 0x10]
lea r12, [rsp + 0x120]
movaps xmmword [r12 + 0x10], xmm11
movaps xmmword [r12], xmm10
lea r15, [rsp + 0x160]
mov rcx, r15
mov rdx, r12
call fcn.14000b7b8
lea rsi, [rsp + 0x1a0]
mov rcx, rsi
mov rdx, r15
call fcn.14000a184
lea rdx, [rsp + 0x180]
movaps xmmword [rdx + 0x10], xmm9
movaps xmmword [rdx], xmm8
lea rcx, [rsp + 0x460]
mov r8, rsi
call fcn.140009f24
or qword [rsp + 0x20], 0xffffffffffffffff
lea r13, [rsp + 0x100]
mov edx, 0x3ffffff
mov rcx, r13
push 0xffffffffffffffff
pop r8
mov r9, r8
call fcn.140009ed3
lea rsi, [rsp + 0x1c0]
movaps xmmword [rsi + 0x10], xmm11
movaps xmmword [rsi], xmm10
lea rdi, [rsp + 0x480]
mov rcx, rdi
mov rdx, rsi
mov r8, r13
call fcn.14000a173
movaps xmm8, xmmword [rdi - 0x20]
movaps xmm9, xmmword [rdi - 0x10]
movaps xmm10, xmmword [rdi]
movaps xmm11, xmmword [rdi + 0x10]
push 0x1a
pop rax
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x420]
mov rcx, rdi
push 0x40
pop rdx
mov r8, rdx
mov r9, rdx
call fcn.140009ed3
movaps xmmword [rbx + 0x10], xmm9
movaps xmmword [rbx], xmm8
lea rbx, [rsp + 0x460]
lea rdx, [rsp + 0x400]
mov rcx, rbx
mov r8, rdi
call fcn.14000b8b7
movaps xmm12, xmmword [rbx]
movaps xmm13, xmmword [rbx + 0x10]
movaps xmmword [r14 + 0x10], xmm11
movaps xmmword [r14], xmm10
movaps xmmword [r12 + 0x10], xmm13
movaps xmmword [r12], xmm12
lea r12, [rsp + 0x180]
lea rdx, [rsp + 0x440]
lea r8, [rsp + 0x120]
mov rcx, r12
call fcn.140009f24
movaps xmmword [r15 + 0x10], xmm13
movaps xmmword [r15], xmm12
lea rbx, [rsp + 0x1a0]
lea rdx, [rsp + 0x160]
mov rcx, rbx
call fcn.14000b8c8
lea r15, [rsp + 0x460]
mov rcx, r15
mov rdx, r12
mov r8, rbx
call fcn.140009f24
movaps xmm10, xmmword [r15]
movaps xmm11, xmmword [r15 + 0x10]
mov r13d, 0x3ffffff
mov qword [rsp + 0x20], r13
xor edi, edi
lea r15, [rsp + 0x100]
mov rcx, r15
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.140009ed3
movaps xmmword [rsi + 0x10], xmm9
movaps xmmword [rsi], xmm8
lea rsi, [rsp + 0x460]
lea rbx, [rsp + 0x1c0]
mov rcx, rsi
mov rdx, rbx
mov r8, r15
call fcn.14000a173
movaps xmm8, xmmword [rsi]
movaps xmm9, xmmword [rsi + 0x10]
mov qword [rsp + 0x20], r13
lea r15, [rsp + 0x6a0]
mov r8d, 0x3ffffff
mov r9d, 0x3ffffff
mov rcx, r15
push 0xffffffffffffffff
pop rdx
call fcn.140009ed3
lea rax, [rsp + 0x3c0]
movaps xmmword [rax + 0x10], xmm11
movaps xmmword [rax], xmm10
lea rsi, [rsp + 0x420]
lea rdx, [rsp + 0x3c0]
mov rcx, rsi
mov r8, r15
call fcn.14000a173
push 0x1a
pop r8
mov qword [rsp + 0x20], r8
lea r15, [rsp + 0x6c0]
mov rcx, r15
push 0x40
pop rdx
mov r9, r8
call fcn.140009ed3
lea rax, [rsp + 0x3e0]
movaps xmmword [rax + 0x10], xmm11
movaps xmmword [rax], xmm10
lea r13, [rsp + 0x400]
lea rdx, [rsp + 0x3e0]
mov rcx, r13
mov r8, r15
call fcn.14000b8b7
lea r15, [rsp + 0x440]
mov rcx, r15
mov rdx, r13
call fcn.14000a184
lea r13, [rsp + 0x460]
mov rcx, r13
mov rdx, rsi
mov r8, r15
call fcn.140009f24
movaps xmm10, xmmword [r13]
movaps xmm11, xmmword [r13 + 0x10]
lea rax, [rsp + 0x120]
movaps xmmword [rax + 0x10], xmm11
movaps xmmword [rax], xmm10
lea r15, [rsp + 0x160]
lea rdx, [rsp + 0x120]
mov rcx, r15
call fcn.14000b7b8
lea r14, [rsp + 0x1a0]
mov rcx, r14
mov rdx, r15
call fcn.14000a184
movaps xmmword [r12 + 0x10], xmm9
movaps xmmword [r12], xmm8
lea rcx, [rsp + 0x460]
lea rdx, [rsp + 0x180]
mov r8, r14
call fcn.140009f24
or qword [rsp + 0x20], 0xffffffffffffffff
lea rsi, [rsp + 0x100]
mov edx, 0x3ffffff
mov rcx, rsi
push 0xffffffffffffffff
pop r8
mov r9, r8
call fcn.140009ed3
movaps xmmword [rbx + 0x10], xmm11
movaps xmmword [rbx], xmm10
lea rbx, [rsp + 0x480]
lea rdx, [rsp + 0x1c0]
mov rcx, rbx
mov r8, rsi
call fcn.14000a173
movdqa xmm8, xmmword [rbx - 0x20]
movaps xmm9, xmmword [rbx - 0x10]
movaps xmm10, xmmword [rbx]
movaps xmm11, xmmword [rbx + 0x10]
push 2
pop rbx
mov dword [rsp + 0x38], ebx
push 4
pop rsi
mov dword [rsp + 0x30], esi
push 6
pop r12
mov dword [rsp + 0x28], r12d
and dword [rsp + 0x40], 0
and dword [rsp + 0x20], 0
lea r13, [rsp + 0x180]
mov rcx, r13
xor edx, edx
mov r8d, r12d
mov r9d, esi
call fcn.1400098df
movaps xmmword [r15 + 0x10], xmm11
movaps xmmword [r15], xmm10
lea rcx, [rsp + 0x100]
lea rdx, [rsp + 0x160]
mov r8, r13
call fcn.14000991f
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], r12d
and dword [rsp + 0x40], 0
and dword [rsp + 0x20], 0
lea r15, [rsp + 0x1c0]
mov rcx, r15
xor edx, edx
mov r8d, r12d
mov r9d, esi
call fcn.1400098df
movaps xmmword [r14 + 0x10], xmm9
movdqa xmmword [r14], xmm8
lea rsi, [rsp + 0x460]
lea rdx, [rsp + 0x1a0]
mov rcx, rsi
mov r8, r15
call fcn.14000991f
lea r15, [rsp + 0x120]
mov rcx, r15
lea rdx, [rsp + 0x100]
mov r8, rsi
call fcn.14000b8d9
lea rcx, [rsp + 0xa0]
mov rdx, r15
call fcn.14000b67a
lea rcx, [rsp + 0x100]
call fcn.140009873
cmp rdi, 0x40
je 0x14000232d
movdqu xmm0, xmmword [rsp + 0x100]
movdqu xmmword [rsp + rdi + 0x460], xmm0
add rdi, 0x10
jmp 0x14000230f
movaps xmm0, xmmword [rsp + 0x2a0]
movaps xmm1, xmmword [rsp + 0x2b0]
movaps xmm2, xmmword [rsp + 0x2c0]
movaps xmm3, xmmword [rsp + 0x2d0]
movaps xmmword [rsp + 0x260], xmm0
movaps xmmword [rsp + 0x270], xmm1
movaps xmmword [rsp + 0x280], xmm2
movaps xmmword [rsp + 0x290], xmm3
movaps xmm0, xmmword [rsp + 0xa0]
movaps xmm1, xmmword [rsp + 0xb0]
movaps xmm2, xmmword [rsp + 0xc0]
movaps xmm3, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x220], xmm0
movaps xmmword [rsp + 0x230], xmm1
movaps xmmword [rsp + 0x240], xmm2
movaps xmmword [rsp + 0x250], xmm3
lea rdx, [rsp + 0x460]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
movups xmm3, xmmword [rdx + 0x30]
movaps xmmword [rsp + 0x210], xmm3
movaps xmmword [rsp + 0x200], xmm2
movaps xmmword [rsp + 0x1f0], xmm1
movaps xmmword [rsp + 0x1e0], xmm0
mov eax, dword [rsp + 0x2b0]
mov dword [rsp + 0x90], eax
movups xmm0, xmmword [rsp + 0x2a0]
movaps xmmword [rsp + 0x80], xmm0
lea rcx, [rsp + 0x6f0]
mov r8d, 0x108
call sub.msvcrt.dll_memcpy
movups xmm0, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x140], xmm0
mov rax, qword [rsp + 0xaf]
mov qword [rsp + 0x14f], rax
xor edi, edi
jmp 0x140002590
lea rsi, [rsp + 0x6f0]
mov rcx, rsi
call fcn.1400073fd
lea rdi, [rsp + 0x460]
mov rcx, rdi
call fcn.14000741f
mov esi, dword [rsi + 8]
mov edi, dword [rdi + 4]
lea rcx, [0x14002d6a0]
lea rdx, [0x14002d6a3]
call fcn.1400085ae
mov ebx, esi
not ebx
test al, al
je 0x140002491
test ebx, 0xc000000
jne 0x1400024e8
call fcn.14000985c
and eax, 2
shr eax, 1
jmp 0x1400024ea
lea rcx, [0x14002d6a0]
mov rdx, rcx
call fcn.1400085ae
test al, al
je 0x1400024b7
test ebx, 0xc000000
jne 0x1400024e8
call fcn.14000985c
not eax
test al, 6
jmp 0x1400024e3
lea rcx, [0x14002d6a0]
lea rdx, [0x14002d6a6]
call fcn.1400085ae
mov ecx, eax
mov al, 1
test cl, cl
je 0x1400024ea
test ebx, 0xc000000
jne 0x1400024e8
call fcn.14000985c
not eax
test al, 0xe6
sete al
jmp 0x1400024ea
xor eax, eax
shr dil, 5
and dil, al
shr esi, 0x1c
and sil, dil
mov byte [0x140014011], sil
jne 0x140001da7
xorps xmm0, xmm0
and dword [rsp + 0x90], 0
movaps xmmword [rsp + 0x80], xmm0
mov r14d, 0x3ffffff
and r14d, dword [rsp + 0xe0]
mov ebx, dword [rsp + 0xe3]
mov r15d, dword [rsp + 0xe6]
shr ebx, 2
and ebx, 0x3ffff03
shr r15d, 4
and r15d, 0x3ffc0ff
mov r12d, dword [rsp + 0xe9]
shr r12d, 6
and r12d, 0x3f03fff
mov r13d, dword [rsp + 0xec]
shr r13d, 8
and r13d, 0xfffff
movdqa xmm8, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x300], xmm8
mov dil, byte [rsp + 0x300]
psrldq xmm8, 1
mov eax, dword [rsp + 0x90]
lea rsi, [rsp + 0x838]
mov dword [rsi - 4], eax
movaps xmm0, xmmword [rsp + 0x80]
movups xmmword [rsi - 0x14], xmm0
lea rdx, [rsp + 0x6f0]
mov r8d, 0x108
mov rcx, rsi
call sub.msvcrt.dll_memcpy
movaps xmm0, xmmword [rsp + 0x260]
movaps xmm1, xmmword [rsp + 0x270]
movaps xmm2, xmmword [rsp + 0x280]
movaps xmm3, xmmword [rsp + 0x290]
movaps xmmword [rsi + 0x128], xmm0
movaps xmmword [rsi + 0x138], xmm1
movaps xmmword [rsi + 0x148], xmm2
movaps xmmword [rsi + 0x158], xmm3
movaps xmm0, xmmword [rsp + 0x220]
movaps xmm1, xmmword [rsp + 0x230]
movaps xmm2, xmmword [rsp + 0x240]
movaps xmm3, xmmword [rsp + 0x250]
movaps xmmword [rsi + 0x168], xmm0
movaps xmmword [rsi + 0x178], xmm1
movaps xmmword [rsi + 0x188], xmm2
movaps xmmword [rsi + 0x198], xmm3
movaps xmm0, xmmword [rsp + 0x1e0]
movaps xmm1, xmmword [rsp + 0x1f0]
movaps xmm2, xmmword [rsp + 0x200]
movaps xmm3, xmmword [rsp + 0x210]
movaps xmmword [rsi + 0x1a8], xmm0
movaps xmmword [rsi + 0x1b8], xmm1
movaps xmmword [rsi + 0x1c8], xmm2
movaps xmmword [rsi + 0x1d8], xmm3
mov rax, qword [rsp + 0x14f]
mov qword [rsi + 0x200], rax
movaps xmm0, xmmword [rsp + 0x140]
movups xmmword [rsi + 0x1f1], xmm0
mov byte [rsi - 0x38], dil
movdqa xmmword [rsp + 0x2f0], xmm8
movq qword [rsi - 0x37], xmm8
pshufd xmm0, xmm8, 0xee
movd dword [rsi - 0x2f], xmm0
pextrw eax, xmm8, 6
mov word [rsi - 0x2b], ax
mov al, byte [rsp + 0x2fe]
mov byte [rsi - 0x29], al
mov dword [rsi - 0x28], r14d
mov dword [rsi - 0x24], ebx
mov dword [rsi - 0x20], r15d
mov dword [rsi - 0x1c], r12d
mov dword [rsi - 0x18], r13d
movaps xmmword [rsi + 0x108], xmm6
movaps xmmword [rsi + 0x118], xmm7
and qword [rsi + 0x1e8], 0
xor edi, edi
mov byte [rsi + 0x1f0], dil
lea rcx, [rsp + 0xe0]
push 0x20
pop rdx
call fcn.14000d06e
lea rdx, [rsp + 0x330]
mov dword [rdx + 0x30], 1
mov byte [rdx + 0x80], dil
lea rcx, [rsp + 0xa40]
mov r8d, 0x84
call sub.msvcrt.dll_memcpy
lea rdx, str.expand_32_byte_kymmxmmzmm
lea rsi, [rsp + 0x800]
mov rcx, rsi
xor r8d, r8d
call fcn.140008e9d
mov r8d, 0x17bff
mov rcx, rsi
mov r13, qword [rsp + 0x70]
mov rdx, r13
call fcn.140008e9d
lea rdi, [rsp + 0x6f0]
mov rcx, rdi
call fcn.140009873
and qword [rdi], 0
mov qword [rdi + 8], 0x17bff
mov rax, qword [rdi]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x460]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
push 1
pop r12
mov rcx, rsi
mov r8, r12
call fcn.140008b61
lea rcx, [rsp + 0x460]
mov r8d, 0x240
mov rdx, rsi
call sub.msvcrt.dll_memcpy
mov al, byte [0x140014011]
cmp al, 1
jne 0x1400027df
lea rcx, [rsp + 0x330]
lea rdx, [rsp + 0x460]
call fcn.14000a192
jmp 0x140002957
mov esi, dword [rsp + 0x488]
mov eax, esi
shr eax, 0x1a
mov edx, 0x3ffffff
and esi, edx
add eax, dword [rsp + 0x48c]
mov ecx, eax
shr ecx, 0x1a
and eax, edx
add ecx, dword [rsp + 0x490]
mov r9d, ecx
shr r9d, 0x1a
add r9d, dword [rsp + 0x494]
and ecx, edx
mov r10d, r9d
shr r10d, 0x1a
mov r8d, r9d
and r8d, edx
lea r11d, [r10 + r10*4]
add r11d, dword [rsp + 0x484]
mov r10d, r11d
shr r10d, 0x1a
add r10d, esi
and r11d, edx
lea ebx, [r11 + 5]
mov esi, ebx
shr esi, 0x1a
add esi, r10d
mov r13d, esi
shr r13d, 0x1a
add r13d, eax
mov edi, r13d
shr edi, 0x1a
add edi, ecx
mov r14d, edi
shr r14d, 0x1a
lea r15d, [r14 + r8]
add r15d, 0xfc000000
add r14d, r8d
mov r8d, r15d
sar r8d, 0x1f
shr r15d, 0x1f
dec r15d
and edx, r15d
and ebx, edx
and esi, edx
and r13d, edx
and edx, edi
and r15d, r14d
and r11d, r8d
or r11d, ebx
and r10d, r8d
or r10d, esi
and eax, r8d
or eax, r13d
mov r13, qword [rsp + 0x70]
and ecx, r8d
or ecx, edx
and r8d, r9d
or r8d, r15d
mov edi, r10d
shl edi, 0x1a
or edi, r11d
shr r10d, 6
mov edx, eax
shl edx, 0x14
or edx, r10d
shr eax, 0xc
mov r9d, ecx
shl r9d, 0xe
or r9d, eax
shr ecx, 0x12
shl r8d, 8
or r8d, ecx
add edi, dword [rsp + 0x460]
mov ebx, dword [rsp + 0x464]
mov eax, dword [rsp + 0x468]
adc rbx, rdx
add rax, r9
mov r14, rbx
shr r14, 0x20
add r8d, dword [rsp + 0x46c]
add r14, rax
mov r15, r14
shr r15, 0x20
add r15d, r8d
lea rsi, [rsp + 0x6f0]
mov rcx, rsi
call fcn.140009873
mov dword [rsi], edi
mov dword [rsi + 4], ebx
mov dword [rsi + 8], r14d
mov dword [rsi + 0xc], r15d
mov eax, dword [rsi]
mov dword [rsp + 0x330], eax
mov eax, dword [rsi + 4]
mov dword [rsp + 0x334], eax
mov eax, dword [rsi + 8]
mov dword [rsp + 0x338], eax
mov eax, dword [rsi + 0xc]
mov dword [rsp + 0x33c], eax
mov r15, qword [rsp + 0x68]
mov bl, 1
xor eax, eax
cmp rax, 0x10
je 0x140002990
lea rsi, [rax + 1]
mov dl, byte [r13 + rax + 0x17bff]
xor dl, byte [rsp + rax + 0x330]
mov ecx, edx
neg cl
or cl, dl
not cl
shr cl, 7
call fcn.14000d063
and bl, al
mov rax, rsi
jmp 0x140002960
mov ecx, ebx
call fcn.14000d063
test al, al
je 0x1400029e0
mov r8d, 0x17bff
lea rcx, [rsp + 0xa40]
mov rdx, r13
call fcn.140008eff
lea rcx, [rsp + 0x800]
call fcn.1400093ed
mov rdi, qword [rsp + 0x60]
mov rsi, rdi
and rsi, 0xffffffffffffff00
lea rcx, [rsp + 0x310]
call fcn.140009869
movzx edi, dil
jmp 0x140002a0f
lea rcx, [rsp + 0x800]
call fcn.1400093ed
mov rcx, r13
mov rdx, qword [rsp + 0x60]
call fcn.1400030cf
lea rcx, [rsp + 0x310]
call fcn.140009869
push 0x13
pop rdi
xor esi, esi
xor r13d, r13d
mov rcx, qword [rsp + 0x78]
mov rdx, r15
call fcn.1400030cf
test r13, r13
je 0x140002bf6
or rsi, rdi
mov r15d, 0x17bff
mov ecx, 0x17bff
xor edx, edx
call fcn.1400030e3
mov rdi, rax
mov r8d, 0x17bff
mov rcx, rax
mov rdx, r13
call sub.msvcrt.dll_memcpy
mov rcx, r13
mov rdx, rsi
call fcn.1400030cf
pxor xmm0, xmm0
lea rsi, [rsp + 0x800]
movdqa xmmword [rsi + 0x20], xmm0
movdqa xmmword [rsi + 0x10], xmm0
movdqa xmmword [rsi], xmm0
mov rcx, rsi
call sub.kernel32.dll_GetSystemInfo
mov ecx, dword [rsi + 4]
test rcx, rcx
je 0x140002bf6
xor r8d, r8d
mov eax, 0x17bff
xor edx, edx
div rcx
mov rbx, rcx
sub rbx, rdx
add rbx, r15
test rdx, rdx
cmove rbx, r15
test rbx, rbx
cmove rbx, rcx
lea r9, [0x14002d500]
lea r10, str.NulError
lea r11, [0x140015070]
xor edx, edx
xor r14d, r14d
xor r15d, r15d
xor esi, esi
xor eax, eax
cmp r9, r10
je case.default.0x140002adf
mov r13d, dword [r9]
add r9, 0x10
movsxd r13, dword [r11 + r13*4]
add r13, r11
jmp r13
mov sil, 1
jmp case.0x140002adf.6
mov dl, 1
jmp case.0x140002adf.6
mov r15b, 1
jmp case.0x140002adf.6
mov rax, qword [r9 - 8]
jmp case.0x140002adf.6
mov rcx, qword [r9 - 8]
mov r8, r12
jmp case.0x140002adf.6
mov r14, qword [r9 - 8]
jmp case.0x140002adf.6
test r15b, r15b
jne 0x140002b25
test sil, sil
jne 0x140002b41
test dl, dl
push 1
pop r9
jne 0x140002bf6
test r8, r8
je 0x140002b7d
jmp 0x140002bf6
test sil, sil
jne 0x140002b67
test dl, dl
jne 0x140002bf6
test r8, r8
jne 0x140002bf6
push 0x10
pop r9
jmp 0x140002b7d
xor r9d, r9d
test dl, dl
setne r9b
lea r9d, [r9*2 + 2]
test r8, r8
je 0x140002b7d
xor eax, eax
test dl, dl
sete al
lea esi, [rax*2 + 2]
jmp 0x140002ba3
xor r9d, r9d
test dl, dl
setne r9b
shl r9d, 5
add r9d, 0x20
test r8, r8
jne 0x140002b95
test r14, r14
jne 0x140002bf6
mov rcx, rax
mov rdx, rbx
mov r8d, 0x3000
call sub.kernel32.dll_VirtualAlloc
jmp 0x140002be9
xor eax, eax
test dl, dl
sete al
lea esi, [rax*2 + 0x22]
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor edx, edx
mov r8d, r9d
xor r9d, r9d
call sub.kernel32.dll_CreateFileMappingW
mov r15, rax
call sub.kernel32.dll_GetLastError
test r15, r15
je 0x140002bf6
cmp eax, 0xb7
je 0x140002bf6
shr rbx, 0x20
and qword [rsp + 0x20], 0
mov rcx, r15
mov edx, esi
mov r8d, ebx
mov r9d, r14d
call sub.kernel32.dll_MapViewOfFile
mov rsi, rax
test rax, rax
jne 0x140002bfa
call sub.kernel32.dll_GetLastError
ud2
mov r8d, 0x17bff
mov rcx, rsi
mov rdx, rdi
call sub.msvcrt.dll_memmove
call rsi
ud2