Function at 0x14006ba40
Capabilities:
Enumerate processes
Log keystrokes via polling
Manipulate console buffer

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x430
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14015f0c8]
xor rax, rsp
mov qword [rbp + 0x368], rax
call fcn.14006b9a0
movabs r13, 0x54e8af5233ef977b
movabs r12, 0x99982697c34d7b00
test al, al
jne 0x14006bc5a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x30c8ca21528afb2b
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x280], rax
movabs rax, 0xb9fc47f8af230c6f
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x288], rax
movabs rax, 0x9244aafe69147299
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x290], rax
movabs rax, 0x20c7b910c58b5411
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x298], rax
movabs rax, 0x9c420a8e519f24a0
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x2a0], rax
movabs rdx, 0xc9b6a00343303484
mov qword [rbp + 0xe8], rdx
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x2a8], rax
mov qword [rbp + 0xe8], r13
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x240], rax
mov qword [rbp + 0xe8], r12
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x248], rax
movabs r14, 0xf733cf9049711aed
mov qword [rbp + 0xe8], r14
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x250], rax
movabs rsi, 0x49b4cb75b3ab2062
mov qword [rbp + 0xe8], rsi
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x258], rax
movabs rax, 0x9c420a8e51954acf
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x260], rax
mov qword [rbp + 0xe8], rdx
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x268], rax
vmovdqu ymm0, ymmword [rbp + 0x240]
vpxor ymm1, ymm0, ymmword [rbp + 0x280]
vmovdqa ymmword [rbp + 0x280], ymm1
vmovdqa xmm2, xmmword [rbp + 0x2a0]
vxorps xmm2, xmm2, xmmword [rbp + 0x260]
vmovdqa xmmword [rbp + 0x2a0], xmm2
lea rdx, [rbp + 0x280]
jmp 0x14006ca52
movabs rax, 0x548dd7371ddde418
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x2c0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x2c8], rax
movdqa xmm0, xmmword [rbp + 0x40]
xorps xmm0, xmmword [rbp + 0x2c0]
movdqa xmmword [rbp + 0x40], xmm0
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x104]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x100], 0x130
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
xor r15d, r15d
mov edi, r15d
lea rdx, [rbp + 0x100]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x14006bd54
lea rdx, [rbp + 0x100]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x14006bd54
nop word [rax + rax]
lea rax, [rbp + 0x12c]
lea r8, [rbp + 0x40]
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14006bd33
inc rax
test ecx, ecx
jne 0x14006bd20
test edx, edx
je 0x14006bd4e
lea rdx, [rbp + 0x100]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x14006bd10
jmp 0x14006bd54
mov edi, dword [rbp + 0x108]
test edi, edi
jne 0x14006be31
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x20c8cb375f86f63d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
movabs rax, 0xfab842f9aa2b5b6f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
movabs rax, 0xf733cf90497b289e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x250], rax
movabs rsi, 0x49b4cb75b3ab2062
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x258], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x288], rax
movabs r14, 0xf733cf9049711aed
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x290], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x298], rax
vmovdqu ymm0, ymmword [rbp + 0x280]
vpxor ymm1, ymm0, ymmword [rbp + 0x240]
vmovdqa ymmword [rbp + 0x240], ymm1
lea rdx, [rbp + 0x240]
jmp 0x14006ca52
mov dword [0x140161518], edi
movabs rax, 0x30c69d61418ae40e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rsi, 0x99982697c34d176c
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x2d0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x2d8], rax
movdqa xmm0, xmmword [rbp + 0x50]
xorps xmm0, xmmword [rbp + 0x2d0]
movdqa xmmword [rbp + 0x50], xmm0
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movabs rbx, 0x30c6da600081fe0c
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x2e0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x2e8], rax
movdqa xmm0, xmmword [rbp + 0x60]
xorps xmm0, xmmword [rbp + 0x2e0]
movdqa xmmword [rbp + 0x60], xmm0
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x2f0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x2f8], rax
movdqa xmm0, xmmword [rbp + 0x70]
xorps xmm0, xmmword [rbp + 0x2f0]
movdqa xmmword [rbp + 0x70], xmm0
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8, rax
movabs rsi, 0x49b4cb75b3ab2062
movabs r14, 0xf733cf9049711aed
test rax, rax
je 0x14006c97b
movabs rax, 0x31bbdd3740bae335
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x20], rcx
movabs rax, 0xfcea53e3b0283c74
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x28], rcx
movabs rax, 0xf733a8f92f1f75ae
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x340], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x348], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x350], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x358], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x340]
vmovdqa ymmword [rbp + 0x20], ymm1
lea rdx, [rbp + 0x20]
mov rcx, r8
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140161510], rax
test rax, rax
je 0x14006c97b
call fcn.14006b200
test al, al
jne 0x14006c18d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x3ac8dd374586e51f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0xfcfc47f8af6d0f6f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x995aabf1263d1089
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x3bd1bd1cc1ef0005
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0x9c420a8e51954ac5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rdx, 0xc9b6a00343303484
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x300], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x308], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x310], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x318], rax
movabs rax, 0x9c420a8e51954acf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x320], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x328], rax
vmovdqu ymm0, ymmword [rbp + 0x300]
vpxor ymm0, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0xa0], ymm0
vmovdqa xmm1, xmmword [rbp + 0xc0]
vxorps xmm1, xmm1, xmmword [rbp + 0x320]
vmovdqa xmmword [rbp + 0xc0], xmm1
lea rdx, [rbp + 0xa0]
vzeroupper
call fcn.140009820
call fcn.14006b450
test al, al
jne 0x14006c18d
lea rdx, str.Failed_to_load_driver_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jmp 0x14006ca55
mov ecx, edi
call fcn.140068f80
test al, al
jne 0x14006c25d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x20c8cb375f86f63d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
movabs rax, 0xf1b852fead245b6f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
movabs rax, 0xf733cf90431a798c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x250], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x258], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x288], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x290], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x298], rax
vmovdqu ymm0, ymmword [rbp + 0x280]
vpxor ymm1, ymm0, ymmword [rbp + 0x240]
vmovdqa ymmword [rbp + 0x240], ymm1
lea rdx, [rbp + 0x240]
jmp 0x14006ca52
call fcn.1400864a0
test al, al
je 0x14006c8b0
call fcn.1400871f0
test al, al
je 0x14006c8b0
mov rbx, qword [0x140161300]
mov rcx, qword [rbx + 0x58]
call fcn.14004c850
mov rdi, rax
mov qword [0x140161460], rax
mov dword [rbp + 0x360], 0xf8ffe000
mov word [rbp + 0x364], r15w
lea rax, [rbp + 0x360]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
movss xmm3, dword [0x140149838]
lea rdx, [0x1400e1940]
mov rcx, qword [rbx + 0x58]
call fcn.14004c9c0
mov qword [0x140161458], rax
test rax, rax
setne cl
test rdi, rdi
setne al
test al, cl
je 0x14006c8b0
call fcn.140010710
test al, al
jne 0x14006c3c2
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x20c8cb375f86f63d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
movabs rax, 0xfab852fead245b6f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
movabs rax, 0xf733c5f720177482
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x250], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x258], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x288], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x290], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x298], rax
vmovdqu ymm0, ymmword [rbp + 0x280]
vpxor ymm1, ymm0, ymmword [rbp + 0x240]
vmovdqa ymmword [rbp + 0x240], ymm1
lea rdx, [rbp + 0x240]
vzeroupper
call fcn.140009820
call fcn.140087630
jmp 0x14006ca5a
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14006c3e0
imul rdi, rax, 0x64
jmp 0x14006c3fb
cqo
idiv rbx
imul rdi, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rdi, rax
lea r12, [0x1401610f0]
mov r14d, 0xffffffff
movsd xmm8, qword [0x1401497c8]
movsd xmm9, qword [0x1401497e8]
xorps xmm11, xmm11
movsd xmm12, qword [0x1401498d8]
movsd xmm10, qword [0x140149810]
cmp byte [0x140161508], 0
jne 0x14006c832
cmp byte [0x1401614c8], 0
je 0x14006c44d
mov byte [0x140161508], 1
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14006c46b
imul rsi, rax, 0x64
jmp 0x14006c486
cqo
idiv rbx
imul rsi, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rsi, rax
mov rax, rsi
sub rax, rdi
xorps xmm7, xmm7
cvtsi2sd xmm7, rax
divsd xmm7, xmm8
comisd xmm9, xmm7
jbe 0x14006c4fa
movaps xmm6, xmm9
subsd xmm6, xmm7
divsd xmm6, xmm8
comisd xmm11, xmm6
ja 0x14006c4fa
cmp byte [0x14015f170], 0
je 0x14006c4d8
lea r8, [rbp + 0xe8]
mov dl, 1
mov ecx, 1
call qword [0x1401613a8]
mov byte [0x14015f170], 0
mulsd xmm6, xmm12
cvttsd2si eax, xmm6
movsxd rcx, eax
mov qword [rbp + 0xe0], rcx
lea rdx, [rbp + 0xe0]
xor ecx, ecx
call qword [0x1401613a0]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14006c518
imul rdi, rax, 0x64
jmp 0x14006c533
cqo
idiv rbx
imul rdi, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rdi, rax
mov qword [rbp], rdi
mov rax, rdi
sub rax, rsi
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm0, xmm8
addsd xmm7, xmm0
movsd qword [rbp + 0x280], xmm7
movaps xmm0, xmm10
divsd xmm0, xmm7
call fcn.140069ea0
cmp byte [0x14015f148], 0
je 0x14006c58e
mov eax, r15d
mov dword [rbp + 0x10], eax
movsxd rcx, eax
cmp rcx, 0x100
jae 0x14006c587
mov word [r12 + rcx*2], r14w
inc eax
jmp 0x14006c56f
mov byte [0x14015f148], 0
mov r14, qword [0x14015f238]
mov r13, qword [0x14015f240]
mov qword [rbp + 0x80], r14
cmp r14, r13
je 0x14006c6b0
movsxd rax, dword [r14]
lea rsi, [rax + rax*8]
mov rax, qword [0x14015f250]
lea rsi, [rsi + 1]
lea rsi, [rax + rsi*8]
test rsi, rsi
je 0x14006c5e6
mov rcx, qword [rsi + 0x38]
and rcx, 0xfffffffffffffffc
je 0x14006c5e6
add rcx, 8
lea rdx, [0x14015f680]
call qword [sym.imp.VCRUNTIME140.dll___std_type_info_compare]
test eax, eax
je 0x14006c5e9
mov rsi, r15
cmp dword [rsi + 4], 2
jne 0x14006c5f5
mov byte [rsi + 0xc], 1
jmp 0x14006c65d
mov ecx, dword [rsi]
lea eax, [rcx - 1]
cmp eax, 0xfe
ja 0x14006c65d
movzx ebx, word [r12 + rcx*2]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ecx, ax
mov word [rbp + 0xc], ax
mov r8d, 0xffff8000
cmp bx, r8w
jne 0x14006c62d
test ax, ax
jne 0x14006c62d
mov ecx, 1
mov word [rbp + 0xc], cx
mov eax, dword [rsi]
mov word [r12 + rax*2], cx
mov edx, dword [rsi + 4]
test edx, edx
je 0x14006c653
cmp edx, 1
jne 0x14006c65d
cmp cx, dx
jne 0x14006c65d
mov byte [0x140161524], dl
movzx eax, byte [rsi + 0xc]
xor al, dl
jmp 0x14006c65a
cmp cx, r8w
sete al
mov byte [rsi + 0xc], al
movsxd rax, dword [rsi + 8]
cmp eax, 0xffffffff
je 0x14006c6a7
movzx esi, byte [rsi + 0xc]
lea rbx, [rax + rax*8]
mov rax, qword [0x14015f250]
lea rbx, [rbx + 1]
lea rbx, [rax + rbx*8]
test rbx, rbx
je 0x14006c6a1
mov rcx, qword [rbx + 0x38]
and rcx, 0xfffffffffffffffc
je 0x14006c6a1
add rcx, 8
lea rdx, [0x14015f778]
call qword [sym.imp.VCRUNTIME140.dll___std_type_info_compare]
test eax, eax
je 0x14006c6a4
mov rbx, r15
mov byte [rbx], sil
add r14, 4
jmp 0x14006c59c
movzx eax, byte [0x140161524]
mov byte [0x140161524], 0
test al, al
je 0x14006c7bc
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140170dbc], eax
jle 0x14006c715
lea rcx, [0x140170dbc]
call fcn.1400ceb88
cmp dword [0x140170dbc], 0xffffffff
jne 0x14006c715
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x140170db0], rax
lea rcx, [0x140170dbc]
call fcn.1400ceb1c
mov dword [rbp + 0x360], 0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
lea rdx, [rbp + 0x240]
mov rcx, qword [0x140170db0]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x14006c74a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
movsx esi, word [rbp + 0x242]
movsx eax, word [rbp + 0x240]
imul esi, eax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
mov ebx, dword [rbp + 0x360]
mov r9d, ebx
mov r8d, esi
mov dl, 0x20
mov rcx, qword [0x140170db0]
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8d, esi
movzx edx, word [rbp + 0x248]
mov rcx, qword [0x140170db0]
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
mov edx, ebx
mov rcx, qword [0x140170db0]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
call fcn.140072ae0
mov r14d, 0xffffffff
jmp 0x14006c82d
jmp 0x14006c430
mov rcx, qword [0x140170b38]
test rcx, rcx
je 0x14006c844
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov rcx, qword [0x140170b40]
test rcx, rcx
je 0x14006c856
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
cmp dword [0x140170658], 0
je 0x14006c8a4
movups xmm0, xmmword [0x140170650]
movaps xmmword [rbp + 0x280], xmm0
lea rcx, [rbp + 0x280]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14006c8a4
xorps xmm0, xmm0
movups xmmword [0x140170650], xmm0
call fcn.140087630
mov edx, 0x12c
mov ecx, 0x1b8
call qword [sym.imp.KERNEL32.dll_Beep]
xor eax, eax
jmp 0x14006ca5f
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x20c8cb375f86f63d
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x240], rax
movabs rax, 0xf6b852fead245b6f
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x248], rax
movabs rax, 0xf739b6f125037f9b
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x250], rax
mov qword [rbp + 0xe0], rsi
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x258], rax
mov qword [rbp + 0xe0], r13
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x280], rax
mov qword [rbp + 0xe0], r12
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x288], rax
mov qword [rbp + 0xe0], r14
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x290], rax
mov qword [rbp + 0xe0], rsi
mov rax, qword [rbp + 0xe0]
jmp 0x14006be06
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x20c8cb375f86f63d
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x20], rax
movabs rax, 0xb9e853e3a63e5b6f
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x28], rax
movabs rax, 0xf739bdf53f186889
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0xe0], rsi
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0xe0], r13
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x240], rax
mov qword [rbp + 0xe0], r12
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x248], rax
mov qword [rbp + 0xe0], r14
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x250], rax
mov qword [rbp + 0xe0], rsi
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x258], rax
vmovdqu ymm0, ymmword [rbp + 0x240]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
lea rdx, [rbp + 0x20]
vzeroupper
call fcn.140009820
mov eax, 1
mov rcx, qword [rbp + 0x368]
xor rcx, rsp
call fcn.1400ceac0
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret