Function at 0x140010830
Capabilities:
Parse pe header
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x140060060]
xor rax, rsp
mov qword [rbp + 0x100], rax
xor r13d, r13d
mov dword [rbp + 0x70], r13d
lea rdx, [0x14004fa53]
xor ecx, ecx
call fcn.140024c64
movabs r12, 0xbfad9e82731c66a7
mov qword [rbp + 0x30], r12
movabs r14, 0x7394a90b2f05b78c
mov qword [rbp + 0x38], r14
movabs rbx, 0xa81402b8ff620569
mov qword [rbp + 0x40], rbx
movabs r15, 0x91602f197780d946
mov qword [rbp + 0x48], r15
movabs rax, 0x53fe5dd67f41d5bb
mov qword [rbp + 0x50], rax
movabs rcx, 0x800a394fb182ca80
mov qword [rbp + 0x58], rcx
movabs rax, 0xcbc4f0cb53414dfc
mov qword [rbp], rax
movabs rax, 0x14fac0714669d6e5
mov qword [rbp + 8], rax
movabs rax, 0xc16063ca9a126a49
mov qword [rbp + 0x10], rax
movabs rax, 0xf30c437814a0b729
mov qword [rbp + 0x18], rax
movabs rax, 0x53f473f8512ab6da
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rcx
movdqa xmm0, xmmword [rbp + 0x30]
pxor xmm0, xmmword [rbp]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [rbp + 0x40]
pxor xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm0, xmmword [rbp + 0x50]
pxor xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x20], xmm0
lea rcx, [rbp]
call fcn.140001210
lea rax, [rbp + 0x30]
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], r15
movabs rax, 0xd8c3dbeb175b12e9
mov qword [rsp + 0x30], rax
movabs rax, 0x12c4cc7f4e60c5cf
mov qword [rsp + 0x38], rax
movabs rax, 0xa81402dd8b166005
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r15
movdqa xmm0, xmmword [rbp + 0x30]
pxor xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rbp + 0x40]
pxor xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm1
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], 0xf
lea rax, [rsp + 0x30]
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x1400109e0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x30]
call fcn.140009390
nop
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], r14
movabs rax, 0xbfadebb040720fd0
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], r14
movdqa xmm0, xmmword [rbp + 0x60]
pxor xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x60], xmm0
mov qword [rbp], r13
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], 0xf
lea rax, [rbp + 0x60]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140010a40
lea rdx, [rbp + 0x60]
lea rcx, [rbp]
call fcn.140009390
nop
lea rdx, [rbp + 0x30]
lea rcx, [rbp]
call fcn.140001260
mov rdi, rax
test rax, rax
jne 0x140010b4c
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], r15
movabs rax, 0x53fe5dd67f41d5bb
mov qword [rbp - 0x80], rax
movabs rcx, 0x800a394fb182ca80
mov qword [rbp - 0x78], rcx
movabs rax, 0xd3c4ffc453414dfc
mov qword [rsp + 0x30], rax
movabs rax, 0x1dfd89645b25d3e9
mov qword [rsp + 0x38], rax
movabs rax, 0xc96667c890427100
mov qword [rsp + 0x40], rax
movabs rax, 0xfd014c3919efb032
mov qword [rsp + 0x48], rax
movabs rax, 0x53fe5dbd1c20b7d7
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
movdqa xmm0, xmmword [rsp + 0x30]
pxor xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
pxor xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
pxor xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x30]
call fcn.140001210
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], r14
movabs rax, 0xdcceebd153414dfc
mov qword [rsp + 0x60], rax
movabs rax, 0x7394a3010e76c4e9
mov qword [rsp + 0x68], rax
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call fcn.140001210
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
mov word [rsp + 0x60], 0x20c
mov dword [rsp + 0x64], 0xbeed0fea
lea rdx, [0x140001580]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov rbx, rax
test rax, rax
je 0x140010ca2
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 1
mov r9d, 0xbeed0fea
lea r8, [rsp + 0x60]
mov edx, 0x128
mov ecx, 4
call rdi
test eax, eax
jne 0x140010fb8
movabs rax, 0xbec2cc48bf8490bb
mov qword [rbp], rax
movabs rax, 0xf86b9e35617cf298
mov qword [rbp + 8], rax
movabs rax, 0xe6eb317ee0bfc22d
mov qword [rbp + 0x10], rax
movabs rax, 0x3e66d3bae15901a
mov qword [rbp + 0x18], rax
movabs rax, 0xcab1a91c9fd9bbe0
mov qword [rsp + 0x30], rax
movabs rax, 0x911fff47040c9db8
mov qword [rsp + 0x38], rax
movabs rax, 0x8387581f869fac42
mov qword [rsp + 0x40], rax
movabs rax, 0x3e66d3bae1fbe7e
mov qword [rsp + 0x48], rax
movdqa xmm0, xmmword [rsp + 0x30]
pxor xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
pxor xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm1
lea rcx, [rsp + 0x30]
call fcn.140001210
mov qword [rbp], r12
mov qword [rbp + 8], r14
movabs rbx, 0xa81402b8ff620569
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], r15
movabs rax, 0xc9c4ecc653414bfc
mov qword [rsp + 0x30], rax
movabs rax, 0x1fb4dd644125c5e9
mov qword [rsp + 0x38], rax
movabs rax, 0xa81e2cdc9a066406
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r15
movdqa xmm0, xmmword [rsp + 0x30]
pxor xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
pxor xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm1
lea rcx, [rsp + 0x30]
call fcn.140001210
call fcn.140012f50
mov ecx, 0x4b0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp], r12
mov qword [rbp + 8], r14
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], r15
movabs rax, 0xfac9f7ed017808e6
mov qword [rsp + 0x30], rax
movabs rax, 0x36e6c67f4e69c2e1
mov qword [rsp + 0x38], rax
movabs rax, 0xa81402dd87072b07
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r15
movdqa xmm0, xmmword [rsp + 0x30]
pxor xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
pxor xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm1
mov dword [rbp + 0x70], r13d
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140010db4
lea rdx, [rbp + 0x70]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp + 0x60], eax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [rbp + 0x70]
test ebx, ebx
je 0x140010d92
mov qword [rbp], r12
mov qword [rbp + 8], r14
movabs rax, 0xa81402b8ff620569
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r15
movabs rax, 0xd5c3d7a22e373dad
mov qword [rsp + 0x30], rax
movabs rax, 0x5dbace654671d4e9
mov qword [rsp + 0x38], rax
movabs rax, 0xa81402b8ff620547
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r15
movdqa xmm0, xmmword [rsp + 0x30]
pxor xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
pxor xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm1
lea rdx, [rsp + 0x30]
lea rcx, [0x1403b5b20]
call fcn.14000a920
mov ecx, 0x10
call fcn.140019444
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax], rdi
mov qword [rax + 8], rbx
mov qword [0x1403b7410], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r13w
mov dword [rbp + 0x70], 1
lea rcx, [rsp + 0x30]
call fcn.14000f3d0
test eax, eax
jne 0x140011fa8
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x30]
call fcn.14000eec0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140010eeb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010ee6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011fb0
call fcn.140018f00
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r13w
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], r14
movabs rax, 0xbfadf2ee173257fb
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r14
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rsp + 0x60], xmm0
mov r12, qword [rbp - 0x18]
lea rax, [rsp + 0x60]
mov rbx, rsi
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140010f40
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r12
cmp rax, rbx
jb 0x140011fb6
lea r13, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae r13, qword [rbp - 0x28]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
lea r15, [r12 + rbx]
mov edi, 0xf
lea r14, [rbp - 0x48]
cmp r15, rdi
jbe 0x1400110b0
mov rdi, r15
cmp r15, 0x10
cmovb rdi, qword [0x1400588c8]
or rdi, 0xf
cmp rdi, rcx
jbe 0x140011051
mov rdi, rcx
jmp 0x14001105f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
test eax, eax
je 0x140010ca2
cmp byte [rsp + 0x68], 0
je 0x140010ca2
mov qword [rbp], r12
mov qword [rbp + 8], r14
movabs rbx, 0xa81402b8ff620569
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], r15
movabs rax, 0xc9c4ecc653414dfc
mov qword [rsp + 0x30], rax
movabs rax, 0x16f0c8644325c5e9
mov qword [rsp + 0x38], rax
movabs rax, 0xa81402b8ff68240d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r15
movdqa xmm0, xmmword [rsp + 0x30]
pxor xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
pxor xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm1
lea rcx, [rsp + 0x30]
call fcn.140001210
jmp 0x140010d1f
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
xor eax, eax
mov rcx, rdi
add rcx, 1
cmovb rcx, rsi
cmp rcx, 0x1000
jb 0x14001109f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140011fbc
mov rcx, rax
call fcn.140019444
test rax, rax
je 0x140011fce
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400110ac
test rcx, rcx
je 0x1400110a9
call fcn.140019444
mov r14, rax
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], rdi
mov r8, r12
mov rdx, r13
mov rcx, r14
call fcn.14001b0c0
lea rcx, [r12 + r14]
mov r8, rbx
lea rdx, [rsp + 0x60]
call fcn.14001b0c0
mov byte [r14 + r15], 0
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rcx, qword [rbp - 0x48]
call fcn.14000f550
test eax, eax
jne 0x14001110f
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x1403b7408]
movabs r15, 0xbfad9e82731c66a7
movabs rdi, 0x7394a90b2f05b78c
movabs r12, 0x91602f197780d946
test rcx, rcx
jne 0x1400111e2
mov qword [rbp], r15
mov qword [rbp + 8], rdi
movabs rax, 0xa81402b8ff620569
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r12
movabs rax, 0xd8ccf3cb53414bfc
mov qword [rsp + 0x30], rax
movabs rax, 0x1f1cf6d5a6797e9
mov qword [rsp + 0x38], rax
movabs rax, 0xdc646fdddf116c49
mov qword [rsp + 0x40], rax
movabs rax, 0x91602f197780f73f
mov qword [rsp + 0x48], rax
movdqa xmm0, xmmword [rsp + 0x30]
pxor xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
pxor xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rsp + 0x40], xmm1
lea rcx, [rsp + 0x30]
call fcn.140001210
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x1403b7408]
movups xmm0, xmmword [str.QRUVSWAPAQARASATAUAVAWH]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [0x1400587d0]
movups xmmword [rbp + 0x90], xmm1
movups xmm0, xmmword [0x1400587e0]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [0x1400587f0]
movups xmmword [rbp + 0xb0], xmm1
movups xmm0, xmmword [0x140058800]
movups xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [0x140058810]
movups xmmword [rbp + 0xd0], xmm1
movups xmm0, xmmword [0x140058820]
movups xmmword [rbp + 0xe0], xmm0
movzx eax, word [0x140058830]
mov word [rbp + 0xf0], ax
movzx eax, byte [0x140058832]
mov byte [rbp + 0xf2], al
mov rbx, rcx
mov eax, 0x5a4d
movabs r13, 0xdedbf0cb53414bfc
cmp word [rcx], ax
je 0x1400112d0
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], rdi
mov qword [rsp + 0x60], r13
movabs rax, 0x73baec5b0f61dee0
mov qword [rsp + 0x68], rax
movdqa xmm0, xmmword [rsp + 0x60]
pxor xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call fcn.140001210
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x1403b7408]
movsxd r14, dword [rbx + 0x3c]
add r14, rcx
movabs rbx, 0xa81402b8ff620569
cmp dword [r14], 0x4550
je 0x14001136e
mov qword [rbp], r15
mov qword [rbp + 8], rdi
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], r12
mov qword [rsp + 0x30], r13
movabs rax, 0x1bb4fd450f61dee0
mov qword [rsp + 0x38], rax
movabs rax, 0xa8142cca9a06640c
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r12
movdqa xmm0, xmmword [rsp + 0x30]
pxor xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
pxor xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rsp + 0x40], xmm1
lea rcx, [rsp + 0x30]
call fcn.140001210
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [r14 + 0x50]
call fcn.1400136b0
mov r13, rax
mov qword [rbp + 0x70], rax
movabs rax, 0xd3c4ffc453414bfc
movabs rcx, 0x1ff589645b25d3e9
movabs rdx, 0xc53467cc9e016a05
movabs r8, 0xfe060f6005efb423
test r13, r13
jne 0x140011459
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], r12
movabs r9, 0x53fe5dd67f41d5bb
mov qword [rbp + 0x50], r9
movabs r9, 0x800a394fb182ca80
mov qword [rbp + 0x58], r9
mov qword [rbp], rax
mov qword [rbp + 8], rcx
mov qword [rbp + 0x10], rdx
mov qword [rbp + 0x18], r8
movabs rax, 0x73923cb5102df5c9
mov qword [rbp + 0x20], rax
movabs rax, 0x800a172ad6e3a7e9
mov qword [rbp + 0x28], rax
movdqa xmm0, xmmword [rbp]
pxor xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
pxor xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm0, xmmword [rbp + 0x20]
pxor xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp + 0x20], xmm0
lea rcx, [rbp]
call fcn.140001210
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov qword [rbp], r15
mov qword [rbp + 8], rdi
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], r12
movabs rax, 0xdcc2d2a22e373dad
mov qword [rsp + 0x30], rax
movabs rax, 0x16f3c8664625dbed
mov qword [rsp + 0x38], rax
movabs rax, 0x8d3438dd8c036749
mov qword [rsp + 0x40], rax
movabs rax, 0x91602f197780d336
mov qword [rsp + 0x48], rax
movdqa xmm0, xmmword [rsp + 0x30]
pxor xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
pxor xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rsp + 0x40], xmm1
mov rdx, r13
lea rcx, [rsp + 0x30]
call fcn.140001210
mov edx, 0x73
call fcn.1400136b0
mov qword [rbp - 0x50], rax
test rax, rax
jne 0x1400115c1
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], r12
movabs rax, 0x53fe5dd67f41d5bb
mov qword [rbp + 0x50], rax
movabs rax, 0x800a394fb182ca80
mov qword [rbp + 0x58], rax
movabs rax, 0xd3c4ffc453414bfc
mov qword [rbp], rax
movabs rax, 0x1ff589645b25d3e9
mov qword [rbp + 8], rax
movabs rax, 0xc53467cc9e016a05
mov qword [rbp + 0x10], rax
movabs rax, 0xfe060f6005efb423
mov qword [rbp + 0x18], rax
movabs rax, 0x309231b31732f5c9
mov qword [rbp + 0x20], rax
movabs rax, 0x800a394f9fe7aeef
mov qword [rbp + 0x28], rax
movdqa xmm0, xmmword [rbp + 0x30]
pxor xmm0, xmmword [rbp]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [rbp + 0x40]
pxor xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm0, xmmword [rbp + 0x50]
pxor xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x20], xmm0
lea rcx, [rbp]
call fcn.140001210
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rax, qword [rbp - 0x50]
mov qword [rbp], r15
mov qword [rbp + 8], rdi
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], r12
movabs rcx, 0xd0d9fde719722ffc
mov qword [rsp + 0x30], rcx
movabs rcx, 0x1ff8cc637c25eafe
mov qword [rsp + 0x38], rcx
movabs rcx, 0xdb7560989a066a0a
mov qword [rsp + 0x40], rcx
movabs rcx, 0x916a256952a0e323
mov qword [rsp + 0x48], rcx
movdqa xmm0, xmmword [rbp]
pxor xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
pxor xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm1
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140001210
cmp dword [r14 + 0xb4], 0
je 0x1400116cd
mov qword [rbp], r15
mov qword [rbp + 8], rdi
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], r12
movabs rax, 0xd6d5f7c453414dfc
mov qword [rsp + 0x60], rax
movabs rax, 0x10fbc56e5d25d0e2
mov qword [rsp + 0x68], rax
movabs rax, 0x863a71d6900b7108
mov qword [rsp + 0x70], rax
movabs rax, 0x91602f197780d368
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [rbp]
pxor xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
pxor xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm1
lea rcx, [rsp + 0x60]
call fcn.140001210
mov r8, r14
mov rdx, r13
call fcn.140010280
mov r8d, dword [rbp + 0x60]
mov rcx, r14
call fcn.14000ff60
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 7
lea r8d, [rax + 0xa]
lea rdx, str.user32.dll
lea rcx, [rsp + 0x30]
call fcn.1400090a0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov rbx, qword [0x1403b7410]
lea rdx, [rsp + 0x30]
lea rcx, [rbp]
call fcn.140012230
mov r8, rax
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx]
call fcn.1400016a0
mov rbx, rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140011776
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011771
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011fc2
call fcn.140018f00
movabs rcx, 0xd6ccd8a22e313dad
test rbx, rbx
jne 0x140011847
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], rdi
movabs rax, 0xa81402b8ff620569
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], r12
movabs r8, 0x53fe5dd67f41d5bb
mov qword [rbp + 0x50], r8
movabs rdx, 0x800a394fb182ca80
mov qword [rbp + 0x58], rdx
mov qword [rbp], rcx
movabs rax, 0x14b4c67f0f61d2e0
mov qword [rbp + 8], rax
movabs rax, 0xcd776dca8f42710c
mov qword [rbp + 0x10], rax
movabs rax, 0xbf055c7815a0aa35
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], rdx
movdqa xmm0, xmmword [rbp + 0x30]
pxor xmm0, xmmword [rbp]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [rbp + 0x40]
pxor xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm0, xmmword [rbp + 0x50]
pxor xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x20], xmm0
lea rcx, [rbp]
call fcn.140001210
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov qword [rbp], r15
mov qword [rbp + 8], rdi
movabs rax, 0xa81402b8ff620569
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r12
movabs rax, 0xd0d9fde719722ffc
mov qword [rsp + 0x30], rax
movabs rax, 0x1ae7db6a7f25eafe
mov qword [rsp + 0x38], rax
movabs rax, 0xda7b72d596426207
mov qword [rsp + 0x40], rax
movabs rax, 0x9160253759aeaa32
mov qword [rsp + 0x48], rax
movdqa xmm0, xmmword [rbp]
pxor xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
pxor xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm1
lea rcx, [rsp + 0x30]
call fcn.140001210
mov rcx, rbx
call fcn.140010420
test eax, eax
jne 0x140011977
mov qword [rbp], r15
mov qword [rbp + 8], rdi
movabs rax, 0xa81402b8ff620569
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r12
movabs rax, 0xd6ccd8a22e313dad
mov qword [rsp + 0x30], rax
movabs rax, 0x3b4c67f0f61d2e0
mov qword [rsp + 0x38], rax
movabs rax, 0xd8796b989a117708
mov qword [rsp + 0x40], rax
movabs rax, 0x91602f3704f4ab29
mov qword [rsp + 0x48], rax
movdqa xmm0, xmmword [rbp]
pxor xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
pxor xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm1
lea rcx, [rsp + 0x30]
call fcn.140001210
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov qword [rbp], r15
mov qword [rbp + 8], rdi
movabs rax, 0xa81402b8ff620569
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r12
movabs rax, 0xdaeaece7004912e9
mov qword [rsp + 0x60], rax
movabs rax, 0x1ce6ce6e5d6af1f8
mov qword [rsp + 0x68], rax
movabs rax, 0xc7706cd1a8066b1c
mov qword [rsp + 0x70], rax
movabs rax, 0x91602f197780d931
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [rbp]
pxor xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
pxor xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm1
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], bl
lea rax, [rsp + 0x60]
nop dword [rax]
inc rsi
cmp byte [rax + rsi], bl
jne 0x140011a10
mov r8, rsi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140009390
nop
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x60]
call fcn.1400126e0
mov rcx, qword [rax]
mov r15, qword [rcx + 0x40]
mov qword [rsp + 0x60], r15
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140011a82
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011a7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011fc8
call fcn.140018f00
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
movabs rsi, 0xbfad9e82731c66a7
test r15, r15
jne 0x140011b3d
mov qword [rbp], rsi
mov qword [rbp + 8], rdi
movabs rax, 0xa81402b8ff620569
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r12
movabs rax, 0xd8dfffd653414bfc
mov qword [rbp + 0x30], rax
movabs rax, 0x1fbd9664625c3e9
mov qword [rbp + 0x38], rax
movabs rax, 0xc77222cc900c251d
mov qword [rbp + 0x40], rax
movabs rax, 0x91602f1959e4b733
mov qword [rbp + 0x48], rax
movdqa xmm0, xmmword [rbp]
pxor xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
pxor xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x40], xmm1
lea rcx, [rbp + 0x30]
call fcn.140001210
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdx, r15
call fcn.140012480
mov rbx, rax
mov qword [rbp], rsi
mov qword [rbp + 8], rdi
movabs rax, 0xa81402b8ff620569
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r12
movabs rax, 0xebecd7a22e373dad
mov qword [rbp + 0x30], rax
movabs rax, 0x1f1dd65466ac7ac
mov qword [rbp + 0x38], rax
movabs rax, 0xa81402b28f472553
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], r12
movdqa xmm0, xmmword [rbp]
pxor xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
pxor xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x40], xmm1
mov rdx, r15
lea rcx, [rbp + 0x30]
call fcn.140001210
mov qword [rbp + 0x98], r15
mov qword [rbp + 0xa2], rbx
movzx edi, word [r14 + 0x14]
add rdi, 0x18
mov r12, qword [0x1403b7408]
mov rsi, qword [0x1403b7410]
test r12, r12
je 0x140011c08
mov rbx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r13
mov r9, rbx
mov r8, r12
mov rcx, qword [rsi]
call fcn.1400015a0
movabs rax, 0xbfad9e82731c66a7
mov qword [rbp], rax
movabs rbx, 0x7394a90b2f05b78c
mov qword [rbp + 8], rbx
movabs rax, 0xa81402b8ff620569
mov qword [rbp + 0x10], rax
movabs rsi, 0x91602f197780d946
mov qword [rbp + 0x18], rsi
movabs rax, 0xcfccd3a22e373dad
mov qword [rbp + 0x30], rax
movabs rax, 0x10f1da2b486bdefc
mov qword [rbp + 0x38], rax
movabs rax, 0x863a2ccb910d6c1d
mov qword [rbp + 0x40], rax
movabs rax, 0x91602f197780d94c
mov qword [rbp + 0x48], rax
movdqa xmm0, xmmword [rbp]
pxor xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
pxor xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x40], xmm1
lea rcx, [rbp + 0x30]
call fcn.140001210
movzx edi, word [r14 + 0x14]
add rdi, 0x24
xor r12d, r12d
cmp word [r14 + 6], r12w
je 0x140011d45
add rdi, r14
nop dword [rax]
mov eax, dword [r14 + 0x50]
cmp r12, rax
jae 0x140011d2c
mov eax, dword [rdi + 4]
mov qword [rbp + 0x60], rax
mov esi, dword [rdi + 8]
mov eax, dword [rdi]
lea r15, [rax + r13]
mov r13, qword [0x1403b7410]
add rsi, qword [0x1403b7408]
je 0x140011d14
mov rbx, qword [r13 + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9, rbx
mov r8, rsi
mov rcx, qword [r13]
call fcn.1400015a0
mov eax, dword [rdi]
add rdi, 0x28
mov ecx, dword [rdi]
sub rcx, rax
add r12, rcx
cmp word [r14 + 6], 0
mov r13, qword [rbp + 0x70]
jne 0x140011cc0
mov r15, qword [rsp + 0x60]
movabs rbx, 0x7394a90b2f05b78c
movabs rsi, 0x91602f197780d946
mov edx, dword [r14 + 0x28]
add rdx, r13
mov qword [rbp + 0xb9], r13
mov qword [rbp + 0xca], rdx
movabs r14, 0xbfad9e82731c66a7
mov qword [rbp], r14
mov qword [rbp + 8], rbx
movabs rax, 0xa81402b8ff620569
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rsi
movabs rax, 0xcbc3dba22e373dad
mov qword [rbp + 0x30], rax
movabs rax, 0x7fac0647f25cefe
mov qword [rbp + 0x38], rax
movabs rax, 0xa81402b28f472553
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rsi
movdqa xmm0, xmmword [rbp]
pxor xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
pxor xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x40], xmm1
lea rcx, [rbp + 0x30]
call fcn.140001210
mov rsi, qword [rbp - 0x50]
mov rbx, qword [0x1403b7410]
mov rdi, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov qword [rsp + 0x28], 0x73
mov qword [rsp + 0x20], rsi
mov r9, rdi
lea r8, [rbp + 0x80]
mov rcx, qword [rbx]
call fcn.1400015a0
mov r9d, 4
mov rdx, r15
call fcn.1400138a0
mov rbx, qword [0x1403b7410]
mov rdi, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov qword [rsp + 0x28], 8
mov qword [rsp + 0x20], r15
mov r9, rdi
lea r8, [rbp - 0x50]
mov rcx, qword [rbx]
call fcn.1400015a0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
test r15, r15
je 0x140011eea
mov r9d, 2
mov rdx, r15
call fcn.1400138a0
mov rbx, qword [0x1403b7408]
mov rcx, rbx
call fcn.140018f00
mov rax, qword [0x1403b7408]
mov ecx, 0x8123
test rbx, rbx
cmovne rax, rcx
mov qword [0x1403b7408], rax
mov qword [rbp + 0x60], r14
movabs rax, 0x7394a90b2f05b78c
mov qword [rbp + 0x68], rax
movabs rax, 0xd1c2daa22e373dad
mov qword [rsp + 0x60], rax
movabs rax, 0x7394a90b2f0596e9
mov qword [rsp + 0x68], rax
movdqa xmm0, xmmword [rbp + 0x60]
pxor xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call fcn.140001210
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140011f25
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011f20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011fce
call fcn.140018f00
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140011f70
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011f6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011fa2
call fcn.140018f00
xor eax, eax
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.140018ee0
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400226a0
nop
mov edx, eax
call fcn.14000f2e0
nop
call fcn.1400226a0
int3
call fcn.140001c50
int3
call fcn.140001bb0
nop
call fcn.1400226a0
int3
call fcn.1400226a0
nop
call fcn.1400226a0
int3