Function at 0x557a49
Capabilities:
Encode data using xor
Enumerate processes via ntquerysysteminformation
Get memory capacity
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x398
movaps xmmword [rsp + 0x380], xmm6
mov r12, rdx
mov rbp, rcx
call fcn.0042c66f
mov rsi, rax
mov r14, rdx
mov ecx, 0x56410
mov edx, 0x10
call fcn.00414fe0
test rax, rax
je 0x558a86
mov r15, rax
add r15, 0x56000
mov r8d, 0x410
mov rcx, r15
mov dl, 0xff
call sub.msvcrt.dll_memset
mov ecx, 9
call fcn.004d0988
movabs rcx, 0x5043206c61746f54
mov qword [rdx], rcx
mov byte [rdx + 8], 0x55
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rdx
mov qword [rbp + 0xa0], 9
xor eax, eax
mov qword [rbp + 0xa8], rax
mov ecx, 1
mov qword [rbp + 0xb0], rcx
movups xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], rcx
mov qword [rbp + 0xd0], rax
mov dword [rbp + 0xd8], 0
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], 8
mov qword [rbp + 0xf0], rax
mov byte [rbp + 0xf8], 0
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x40], 0x3ff
mov qword [rbp + 0x48], 0x380
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], r14
mov al, byte [r12]
cmp al, 2
je 0x557c58
mov bl, byte [r12 + 1]
test al, al
je 0x557bbe
lea rcx, [rsp + 0xf0]
movaps xmmword [rcx], xmm0
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
mov dword [rcx], 0x40
call sub.KERNEL32.dll_GlobalMemoryStatusEx
test eax, eax
jne 0x557baf
call sub.KERNEL32.dll_GetLastError
movups xmm0, xmmword [rsp + 0xf8]
movups xmmword [rbp + 0x100], xmm0
test bl, bl
je 0x557c58
xorps xmm0, xmm0
lea rcx, [rsp + 0xf0]
movaps xmmword [rcx + 0x50], xmm0
movaps xmmword [rcx + 0x40], xmm0
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
mov qword [rcx + 0x60], 0
mov edx, 0x68
call sub.KERNEL32.dll_K32GetPerformanceInfo
test eax, eax
je 0x557c58
mov r8, qword [rsp + 0x110]
mov r9, qword [rsp + 0x100]
xor r10d, r10d
sub r9, r8
cmovb r9, r10
mov rcx, qword [rsp + 0x140]
mov rax, rcx
mul r9
mov r9, 0xffffffffffffffff
cmovo rax, r9
mov r11, qword [rsp + 0xf8]
sub r11, r8
cmovb r11, r10
mov qword [rbp + 0x110], rax
mov rax, rcx
mul r11
cmovo rax, r9
mov qword [rbp + 0x118], rax
lea r13, [rbp + 0x70]
cmp byte [r12 + 2], 2
je 0x558044
mov r14b, byte [r12 + 3]
cmp qword [rbp + 0x18], 0
je 0x557db4
mov rcx, qword [rbp + 0x30]
call sub.pdh.dll_PdhCollectQueryData
mov rdx, qword [rbp + 0x78]
test rdx, rdx
je 0x557cb5
mov r8, qword [rbp + 0x80]
mov rcx, rbp
call fcn.00559c17
test eax, eax
je 0x558abd
movss xmm1, dword [0x005b84b0]
subss xmm1, xmm0
movss dword [rbp + 0xd8], xmm1
test r14b, r14b
setne dl
mov rcx, r13
call fcn.00558ad2
mov rax, qword [rbp + 0xf0]
test rax, rax
je 0x557d19
mov rsi, qword [rbp + 0xe8]
imul rdi, rax, 0x70
xor ebx, ebx
movss xmm6, dword [0x005b84b0]
mov rdx, qword [rsi + rbx + 8]
test rdx, rdx
je 0x557d10
mov r8, qword [rsi + rbx + 0x10]
mov rcx, rbp
call fcn.00559c17
test eax, eax
je 0x558a6c
movaps xmm1, xmm6
subss xmm1, xmm0
movss dword [rsi + rbx + 0x68], xmm1
add rbx, 0x70
cmp rdi, rbx
jne 0x557ce4
test r14b, r14b
je 0x558044
cmp byte [rbp + 0xf8], 0
jne 0x558044
mov r14, qword [rbp + 0xf0]
lea r15, [rsp + 0xf0]
mov rcx, r15
mov rdx, r14
call fcn.0055933c
mov rsi, qword [rbp + 0xe8]
mov rcx, qword [r15]
mov rdx, qword [r15 + 8]
test r14, r14
je 0x557d9d
mov r8, qword [rsp + 0x100]
test r8, r8
je 0x557d9d
imul rax, r14, 0x70
add rax, 0xffffffffffffff90
lea r8, [r8*8 - 8]
xor r9d, r9d
xor r10d, r10d
mov r11, qword [rdx + r9]
mov qword [rsi + r10 + 0x18], r11
cmp rax, r10
je 0x557d9d
add r10, 0x70
lea r11, [r9 + 8]
cmp r8, r9
mov r9, r11
jne 0x557d7f
call fcn.00556560
test r14, r14
je 0x558034
mov rax, qword [rsi + 0x18]
jmp 0x558036
mov rbx, rbp
lea r8, [rsp + 0x248]
mov qword [r8], 0
xor edi, edi
xor ecx, ecx
xor edx, edx
call sub.pdh.dll_PdhOpenQueryA
mov ebp, eax
test ebp, ebp
jne 0x557e02
mov rsi, qword [rsp + 0x248]
call fcn.0042c66f
xorps xmm0, xmm0
movaps xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x100], 0
lea rdi, [0x00616390]
mov rcx, qword [rsp + 0x100]
mov qword [rbx + 0x10], rcx
movaps xmm0, xmmword [rsp + 0xf0]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rdx
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x38], 0
test ebp, ebp
mov rbp, rbx
jne 0x558044
mov qword [rsp + 0x80], r12
mov byte [rsp + 0x98], r14b
test r14b, r14b
mov rsi, rbp
setne bpl
mov ecx, 0x1e
call fcn.004d0988
lea r14, [rsp + 0x248]
mov qword [r14], rax
mov qword [r14 + 8], rdx
movups xmm0, xmmword [str.Processor__Total___Idle_Timetot_0Processor____Idle_Time]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [0x005f0846]
movups xmmword [rdx + 0xe], xmm0
mov qword [r14 + 0x10], 0x1e
mov ecx, 5
call fcn.004d0988
lea r9, [rsp + 0xf0]
mov qword [r9], rax
mov qword [r9 + 8], rdx
mov dword [rdx], 0x5f746f74
mov byte [rdx + 4], 0x30
mov qword [r9 + 0x10], 5
mov rcx, r14
mov rdx, rsi
mov r8, r13
call fcn.00559491
mov qword [rsp + 0x88], r13
mov rcx, r13
mov edx, ebp
call fcn.00558ad2
mov qword [rsp + 0x48], rsi
mov rax, qword [rsi + 0xf0]
test rax, rax
je 0x55800a
mov rcx, qword [rsp + 0x48]
mov r15, qword [rcx + 0xe8]
imul rbx, rax, 0x70
xor edi, edi
mov ebp, 2
mov r12d, 1
lea rax, [r15 + 0x70]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0xa0], rdi
inc rdi
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x248], rax
lea rax, [fcn.00428c20]
mov qword [rsp + 0x250], rax
lea rax, [0x005f0878]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rbp
xor esi, esi
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0x110], r14
mov qword [rsp + 0x118], r12
lea rcx, [rsp + 0x300]
lea r13, [rsp + 0xf0]
mov rdx, r13
call fcn.004179e0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x50], rax
lea rax, [fcn.00428c20]
mov qword [rsp + 0x58], rax
lea rax, str.combase.dll
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rbp
mov qword [rsp + 0xf0], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], r12
mov rcx, r14
mov rdx, r13
call fcn.004179e0
lea rcx, [rsp + 0x300]
mov rdx, qword [rsp + 0x48]
mov r8, r15
mov r9, r14
call fcn.00559491
mov r15, qword [rsp + 0x90]
add rbx, 0xffffffffffffff90
jne 0x557f09
mov rbp, qword [rsp + 0x48]
cmp qword [rbp + 0x18], 0
mov r13, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
mov r14b, byte [rsp + 0x98]
jne 0x557c78
jmp 0x558044
xor eax, eax
mov qword [rbp + 0x88], rax
mov byte [rbp + 0xf8], 1
mov al, byte [r12 + 0xa]
cmp al, 2
je 0x558a41
lea rsi, [rbp + 0x60]
movzx ecx, word [r12 + 0xb]
movzx edx, word [r12 + 8]
mov word [rsp + 0x6c], dx
mov edx, dword [r12 + 4]
mov dword [rsp + 0x68], edx
mov byte [rsp + 0x6e], al
mov word [rsp + 0x6f], cx
mov r14d, 0x80000
mov ecx, 0x80000
call fcn.004d0988
mov rdi, rdx
lea r15, [rsp + 0xc0]
mov qword [r15], rax
mov qword [r15 + 8], rdx
mov qword [r15 + 0x10], 0
xor edx, edx
lea r12, [rsp + 0xf0]
mov dword [rsp + 0xf0], 0
sub rax, rdx
cmp rax, r14
jb 0x55814f
mov ecx, 5
mov rdx, rdi
mov r8d, r14d
mov r9, r12
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jns 0x558167
or eax, 0x10000000
mov ecx, eax
call fcn.0058cb20
cmp edx, 0xd0000004
jne 0x55822e
mov ecx, dword [rsp + 0xf0]
test ecx, ecx
je 0x55810c
add ecx, 0x2800
mov r14, rcx
jmp 0x55812c
mov rcx, r14
and rcx, 0xfffffffffffffffd
mov edx, r14d
and edx, 2
or r14, 2
imul r14, rdx
xor rdx, 2
imul rdx, rcx
add r14, rdx
test rax, rax
je 0x55813a
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov rax, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xd0]
jmp 0x5580ac
mov rcx, r15
mov r8, r14
call fcn.0058c61b
mov rdi, qword [rsp + 0xc8]
jmp 0x5580c3
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xd0], r14
mov ecx, 0xfa0
mov edx, 8
call fcn.00414fe0
test rax, rax
je 0x558a92
lea r14, [rsp + 0xa0]
mov qword [r14], 0x1f4
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], 0
xor edx, edx
xor esi, esi
lea r15, [rdi + rsi]
mov ebx, dword [rdi + rsi]
cmp rdx, qword [rsp + 0xa0]
jne 0x5581d7
mov rcx, r14
call fcn.00556c3b
mov rax, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xb0]
mov qword [rax + rdx*8], r15
mov rcx, qword [rsp + 0xb0]
mov edx, ecx
and edx, 1
xor rcx, 1
lea rdx, [rcx + rdx*2]
mov qword [rsp + 0xb0], rdx
add rsi, rbx
test rbx, rbx
jne 0x5581ae
lea rax, [rbp + 0x40]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xe0], rax
cmp byte [rsp + 0x6e], 0
je 0x55825c
mov rcx, r13
xor edx, edx
call fcn.00558ad2
mov rax, qword [rbp + 0xf0]
jmp 0x55825e
test rax, rax
je 0x55823c
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
cmp qword [rsp + 0xc0], 0
je 0x558a41
mov rcx, qword [0x00677420]
xor edx, edx
mov r8, rdi
jmp 0x558a3c
xor eax, eax
mov qword [rsp + 0xe8], rax
lea rsi, [rsp + 0xf0]
mov qword [rsi], 0
mov rax, qword [0x005b71f0]
mov rcx, rsi
call rax
mov rax, qword [rsi]
movabs rcx, 0x19db1ded53e8000
cmp rax, rcx
jl 0x5582b3
movabs rcx, 0xfe624e212ac18000
add rax, rcx
movabs rcx, 0xd6bf94d5e57a42bd
mul rcx
shr rdx, 0x17
jmp 0x5582b5
xor edx, edx
lea rax, [rsp + 0x240]
mov qword [rax], rdx
mov r15, qword [rsp + 0xb0]
mov qword [rsp + 0x120], r15
movups xmm0, xmmword [rsp + 0xa0]
movups xmmword [rsp + 0x110], xmm0
xor ecx, ecx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], 8
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0xe0]
mov qword [rsp + 0xf0], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0xf8], rcx
lea rcx, [rsp + 0xe8]
mov qword [rsp + 0x100], rcx
mov qword [rsp + 0x108], rax
mov rbx, qword [rsp + 0x110]
cmp rbx, r15
jb 0x558aa3
mov r14, qword [rsp + 0x118]
call fcn.004d214b
xor r9d, r9d
cmp r15, 0xffffffffffffffff
sete r9b
cmp rax, r9
cmova r9, rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 1
lea rdi, [rsp + 0x248]
mov rcx, rdi
mov rdx, r15
xor r8d, r8d
call fcn.00552b91
test rbx, rbx
je 0x5583bf
mov eax, ebx
and eax, 8
mov rcx, rbx
or rbx, 8
imul rbx, rax
xor rax, 8
and rcx, 0xfffffffffffffff7
imul rcx, rax
add rbx, rcx
je 0x5583bf
mov rcx, qword [0x00677420]
xor edx, edx
mov r8, r14
call fcn.005ab9d4
mov rax, qword [rsp + 0x258]
test rax, rax
je 0x5583f6
xor r8d, r8d
mov rdi, qword [rdi]
test rdi, rdi
je 0x5583e0
add r8, qword [rdi + 0x20]
dec rax
jne 0x5583cf
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x60]
sub rax, rdx
cmp rax, r8
jb 0x558a5d
mov rax, qword [rsp + 0x258]
mov qword [rsp + 0x100], rax
movdqu xmm0, xmmword [rsp + 0x248]
movdqa xmmword [rsp + 0xf0], xmm0
lea rdi, [rsp + 0x50]
mov r8, qword [rsp + 0xf0]
test r8, r8
je 0x5584c9
mov rax, qword [r8]
mov qword [rsp + 0xf0], rax
test rax, rax
cmove rax, rsi
mov qword [rax + 8], 0
dec qword [rsp + 0x100]
mov r14, qword [r8 + 0x10]
mov r15, qword [r8 + 0x18]
mov r12, qword [r8 + 0x20]
mov rcx, qword [0x00677420]
xor edx, edx
call fcn.005ab9d4
test r15, r15
je 0x5584c9
mov rax, qword [rsp + 0x50]
mov r13, qword [rsp + 0x60]
sub rax, r13
cmp rax, r12
jb 0x5584b4
imul rcx, r13, 0x150
add rcx, qword [rsp + 0x58]
imul r8, r12, 0x150
mov rdx, r15
call sub.msvcrt.dll_memcpy
add r13, r12
mov qword [rsp + 0x60], r13
mov rcx, r14
mov rdx, r15
call fcn.005528eb
jmp 0x55841d
mov rcx, rdi
mov rdx, r13
mov r8, r12
call fcn.0055690d
mov r13, qword [rsp + 0x60]
jmp 0x558481
mov qword [rsp + 0x48], rbp
lea rcx, [rsp + 0xf0]
call fcn.0055378b
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x98], rax
mov r14, qword [rsp + 0x58]
mov rax, qword [rsp + 0x60]
imul rcx, rax, 0x150
add rcx, r14
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x80], r14
test rax, rax
je 0x558891
lea rdi, [rsp + 0x248]
pcmpeqd xmm6, xmm6
mov r14, qword [rsp + 0x80]
mov rsi, r14
add r14, 0x150
mov rbp, qword [rsi + 0x80]
cmp rbp, 2
je 0x558891
mov rax, qword [rsi + 0x88]
mov qword [rsp + 0x90], rax
mov r15, qword [rsi + 0x90]
lea r13, [rsi + 0x98]
mov r8d, 0xb8
mov rcx, rdi
mov rdx, r13
call sub.msvcrt.dll_memcpy
mov rdi, qword [rsp + 0x48]
mov rcx, qword [rdi + 0x60]
mov rdx, qword [rdi + 0x68]
mov r8, r15
call fcn.00555f0c
mov r10, rax
shr r10, 0x39
mov r12, qword [rdi + 0x40]
mov rbx, qword [rdi + 0x58]
movd xmm0, r10d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
lea rdi, [rbx - 0x158]
xor r11d, r11d
mov rcx, rax
and rcx, r12
movdqu xmm1, xmmword [rbx + rcx]
movdqa xmm2, xmm1
pcmpeqb xmm2, xmm0
pmovmskb edx, xmm2
test dx, dx
je 0x5585fb
bsf r8d, edx
lea r9d, [rdx - 1]
and r9d, edx
add r8, rcx
not r8
mov rdx, r12
or rdx, r8
sub r8, rdx
imul r8, r8, 0x158
mov edx, r9d
cmp qword [rdi + r8], r15
jne 0x5585ca
jmp 0x558618
pcmpeqb xmm1, xmm6
pmovmskb edx, xmm1
test edx, edx
jne 0x5586ae
add rcx, r11
add rcx, 0x10
add r11, 0x10
jmp 0x5585b6
add rdi, r8
lea r12, [rdi + 8]
mov r8d, 0x150
lea rcx, [rsp + 0xf0]
mov rdx, r12
call sub.msvcrt.dll_memcpy
mov r8d, pe_nt_image_headers64
mov rcx, r12
mov rdx, rsi
call sub.msvcrt.dll_memmove
mov qword [rdi + 0x88], rbp
mov rax, qword [rsp + 0x90]
mov qword [rdi + 0x90], rax
mov qword [rdi + 0x98], r15
add rdi, 0xa0
mov r8d, 0xb8
mov rcx, rdi
lea rdi, [rsp + 0x248]
mov rdx, rdi
call sub.msvcrt.dll_memcpy
cmp qword [rsp + 0x170], 2
je 0x55869b
lea rcx, [rsp + 0xf0]
call fcn.0055292a
cmp r14, qword [rsp + 0x88]
jne 0x558529
jmp 0x5588db
mov qword [rsp + 0x78], r10
mov ecx, 0x10
lea rdi, [rsp + 0x300]
rep movsq qword [rdi], qword [rsi]
mov r8d, 0xb8
lea rcx, [rsp + 0xf0]
mov rdx, r13
mov rdi, rax
call sub.msvcrt.dll_memcpy
mov rcx, rdi
mov rax, r12
and rax, rdi
movdqu xmm0, xmmword [rbx + rax]
pmovmskb ecx, xmm0
test ecx, ecx
jne 0x55870e
mov edx, 0x10
add rax, rdx
and rax, r12
movdqu xmm0, xmmword [rbx + rax]
pmovmskb ecx, xmm0
add rdx, 0x10
test ecx, ecx
je 0x5586f7
mov r9, qword [rsp + 0x78]
bsf ecx, ecx
add rcx, rax
mov rax, rcx
not rax
or rax, r12
lea rdx, [rcx + rax]
mov sil, byte [rbx + rdx + 1]
test sil, sil
js 0x558741
movdqa xmm0, xmmword [rbx]
pmovmskb eax, xmm0
bsf eax, eax
mov sil, byte [rbx + rax]
jmp 0x558747
add rax, rcx
inc rax
and sil, 1
mov rcx, qword [rsp + 0x48]
cmp qword [rcx + 0x48], 0
jne 0x558760
test sil, sil
jne 0x558809
movzx ecx, sil
mov r8, qword [rsp + 0x48]
sub qword [r8 + 0x48], rcx
mov rcx, rax
xor rcx, 0xffffffffffffffef
mov rdx, rax
and rdx, 0xffffffffffffffef
lea rcx, [rcx + rdx*2]
inc rcx
and rcx, r12
mov byte [rbx + rax], r9b
mov byte [rcx + rbx + 0x10], r9b
inc qword [r8 + 0x50]
mov rdx, qword [r8 + 0x58]
neg rax
imul r8, rax, 0x158
lea rax, [rdx + r8]
add rax, 0xfffffffffffffeb0
mov qword [rax - 8], r15
mov ecx, 0x10
mov rdi, rax
lea rsi, [rsp + 0x300]
rep movsq qword [rdi], qword [rsi]
mov qword [rax + 0x80], rbp
mov rcx, qword [rsp + 0x90]
mov qword [rax + 0x88], rcx
mov qword [rax + 0x90], r15
lea rcx, [rdx + r8]
add rcx, 0xffffffffffffff48
mov r8d, 0xb8
lea rdx, [rsp + 0xf0]
call sub.msvcrt.dll_memcpy
lea rdi, [rsp + 0x248]
jmp 0x55869b
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xd8]
call fcn.005573cb
mov rax, qword [rsp + 0x48]
mov r12, qword [rax + 0x40]
mov rbx, qword [rax + 0x58]
and rdi, r12
movdqu xmm0, xmmword [rbx + rdi]
pmovmskb eax, xmm0
test eax, eax
jne 0x558857
mov ecx, 0x10
add rdi, rcx
and rdi, r12
movdqu xmm0, xmmword [rbx + rdi]
pmovmskb eax, xmm0
add rcx, 0x10
test eax, eax
je 0x558840
mov r9, qword [rsp + 0x78]
bsf eax, eax
add rax, rdi
mov rcx, rax
not rcx
or rcx, r12
lea rdx, [rax + rcx]
cmp byte [rbx + rdx + 1], 0
js 0x558886
movdqa xmm0, xmmword [rbx]
pmovmskb eax, xmm0
bsf eax, eax
jmp 0x558760
add rax, rcx
inc rax
jmp 0x558760
mov r8, qword [rsp + 0x88]
mov rax, r8
sub rax, r14
shr rax, 4
movabs rcx, 0xc30c30c30c30c31
mul rcx
cmp r8, r14
je 0x5588db
mov rsi, rdx
xor edi, edi
imul rcx, rdi, 0x150
add rcx, r14
mov eax, edi
and eax, 1
xor rdi, 1
lea rdi, [rdi + rax*2]
call fcn.0055292a
cmp rdi, rsi
jne 0x5588ba
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x80]
call fcn.005528eb
mov r12, qword [rsp + 0x48]
mov rdi, qword [r12 + 0x58]
mov rax, qword [r12 + 0x40]
mov rbx, qword [r12 + 0x50]
lea rax, [rax + rdi + 1]
movdqa xmm0, xmmword [rdi]
pmovmskb ecx, xmm0
not ecx
lea rdx, [rdi + 0x10]
lea rsi, [rsp + 0xf0]
mov qword [rsi], rdx
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rdi
mov word [rsi + 0x18], cx
mov qword [rsi + 0x20], rbx
mov r14, rdi
not r14
movabs r15, 0x82fa0be82fa0be83
pcmpeqd xmm6, xmm6
mov rcx, rsi
call fcn.00556e39
test rax, rax
je 0x558a20
cmp byte [rax - 4], 0
mov byte [rax - 4], 0
jne 0x558946
mov rcx, rax
not rcx
and rcx, rdi
mov rdx, rax
and rdx, r14
sub rcx, rdx
sar rcx, 3
imul rcx, r15
mov rdx, qword [rsp + 0xb8]
mov rdx, qword [rdx]
lea r8, [rcx - 0x10]
and r8, rdx
movdqu xmm0, xmmword [rdi + r8]
pcmpeqb xmm0, xmm6
psllw xmm0, 7
pmovmskb r8d, xmm0
test r8d, r8d
je 0x5589b1
bsr r8w, r8w
xor r8d, 0xf
jmp 0x5589b6
mov r8w, 0x10
movdqu xmm0, xmmword [rdi + rcx]
pcmpeqb xmm0, xmm6
pmovmskb r9d, xmm0
or r9d, 0x10000
bsf r9d, r9d
add r8d, r9d
mov r9b, pe_nt_image_headers64
cmp r8w, 0xf
ja 0x5589e4
inc qword [r12 + 0x48]
mov r9b, 0xff
mov r8, rcx
xor r8, 0xffffffffffffffef
mov r10, rcx
and r10, 0xffffffffffffffef
lea r8, [r8 + r10*2]
inc r8
and r8, rdx
mov byte [rdi + rcx], r9b
mov byte [r8 + rdi + 0x10], r9b
dec rbx
mov qword [r12 + 0x50], rbx
add rax, 0xfffffffffffffeb0
mov rcx, rax
call fcn.0055292a
jmp 0x558946
cmp qword [rsp + 0xc0], 0
je 0x558a41
mov r8, qword [rsp + 0xc8]
mov rcx, qword [0x00677420]
xor edx, edx
call fcn.005ab9d4
movaps xmm6, xmmword [rsp + 0x380]
add rsp, 0x398
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x50]
call fcn.0055690d
jmp 0x5583f6
lea rcx, str.key_used_disappeared
lea r8, [0x005f0968]
mov edx, 0x14
call fcn.0041f810
ud2
mov ecx, 0x56410
mov edx, 0x10
jmp 0x558a9c
mov ecx, 0xfa0
mov edx, 8
call fcn.00417bf0
ud2
lea rcx, str.assertion_failed:_vec.capacity_____start___lenregistry_src_octopus.retort.com_8754fae0eb2f08f1_obese_1.10.0_src_vec.rs
lea r8, [0x005f0460]
mov edx, 0x2f
call fcn.00426370
ud2
lea rcx, str.global_key_idle_disappearedregistry_src_octopus.retort.com_8754fae0eb2f08f1_whether_0.30.13_src_windows_system.rs
lea r8, [0x005f0938]
mov edx, 0x1b
jmp 0x558a7f