Function at 0x1400064e0
Capabilities:
Check if file exists
Create http request
Encode data using xor
Enumerate processes
Execute command
Get file attributes
Get graphical window text
Get system information on windows
Read data from internet
Receive data
Set console window title
Terminate process
Terminate process by name

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb48]
sub rsp, 0xc20
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140015040]
xor rax, rsp
mov qword [rbp + 0xb00], rax
xor r12d, r12d
mov dword [rbp + 0x230], r12d
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rax, qword gs:[0x58]
mov r13, qword [rax]
mov ecx, 0x3c8
mov eax, dword [rcx + r13]
mov ebx, 0x1c8
add rbx, r13
test al, 1
jne 0x140006580
or eax, 1
mov dword [rcx + r13], eax
mov dword [rbx + 0xc], 0x1abbfca
mov dword [rbx], 0xf2c6afc4
mov dword [rbx + 4], 0x22efedd1
mov dword [rbx + 8], 0xe7c0a2f3
lea rcx, [0x14000f1e0]
call fcn.14000b9b8
nop
cmp byte [rbx + 0xf], 0
je 0x1400065c5
xor byte [rbx], 0x87
xor byte [rbx + 1], 0xc7
xor byte [rbx + 2], 0xa3
xor byte [rbx + 3], 0x93
xor byte [rbx + 4], 0xa5
xor byte [rbx + 5], 0xcd
xor byte [rbx + 6], 0xab
xor byte [rbx + 7], 0x47
xor byte [rbx + 8], 0x87
xor byte [rbx + 9], 0xc7
xor byte [rbx + 0xa], 0xa3
xor byte [rbx + 0xb], 0x93
xor byte [rbx + 0xc], 0xa5
xor byte [rbx + 0xd], 0xcd
xor byte [rbx + 0xe], 0xab
mov byte [rbx + 0xf], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x2e8], xmm0
mov qword [rbp + 0x2f8], r12
mov qword [rbp + 0x300], 0xf
mov byte [rbp + 0x2e8], 0
movups xmm0, xmmword [str.ZG_EE_r]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [0x140010698]
movups xmmword [rsp + 0x48], xmm1
movzx eax, word [0x1400106a8]
mov word [rsp + 0x58], ax
mov r8d, r12d
cmp dword [0x140015088], 2
jl 0x140006765
movdqa xmm5, xmmword [0x140010770]
movdqa xmm4, xmmword [0x1400107d0]
movdqa xmm6, xmmword [0x140010790]
movdqa xmm0, xmmword [0x140010830]
movdqa xmmword [rbp + 0x320], xmm0
lea rcx, [rsp + 0x3c]
mov edx, dword [rbp + 0x320]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400107c0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400107c0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x20
jl 0x140006660
cmp r8d, 0x22
jge 0x14000679f
movsxd rax, r8d
lea r9, [rsp + 0x38]
add r9, rax
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x22
jl 0x140006770
lea rax, [rsp + 0x38]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400067b0
lea rcx, [rbp + 0x2e8]
cmp rbx, 0xf
ja 0x1400067e4
mov qword [rbp + 0x2f8], rbx
mov r8, rbx
lea rdx, [rsp + 0x38]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0x2e8], 0
jmp 0x1400067f1
lea r9, [rsp + 0x38]
mov rdx, rbx
call fcn.14000abf0
xorps xmm0, xmm0
movups xmmword [rbp + 0x2a0], xmm0
mov qword [rbp + 0x2b0], r12
mov qword [rbp + 0x2b8], 0xf
mov byte [rbp + 0x2a0], 0
mov ecx, 0x370
mov eax, dword [rcx + r13]
mov edx, 0x2b0
test al, 1
jne 0x140006854
or eax, 1
mov dword [rcx + r13], eax
lea rbx, [rdx + r13]
mov dword [rbx + 8], 0x1cf8d4b
mov dword [rbx], 0x77a08557
mov dword [rbx + 4], 0xacab85c8
lea rcx, [0x14000f1b0]
call fcn.14000b9b8
nop
jmp 0x140006858
lea rbx, [rdx + r13]
cmp byte [rbx + 0xb], 0
je 0x14000688d
xor byte [rbx], 0x2d
xor byte [rbx + 1], 0xe3
xor byte [rbx + 2], 0xcf
xor byte [rbx + 3], 0x19
xor byte [rbx + 4], 0xbb
xor byte [rbx + 5], 0xef
xor byte [rbx + 6], 0x93
xor byte [rbx + 7], 0xd9
xor byte [rbx + 8], 0x2d
xor byte [rbx + 9], 0xe3
xor byte [rbx + 0xa], 0xcf
mov byte [rbx + 0xb], 0
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rbx, rax
mov qword [rbp + 0x278], rax
test rax, rax
jne 0x140006ad0
movdqa xmm0, xmmword [0x140010a60]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140010b30]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0xa8b0aeb7
mov dword [rsp + 0x5c], 0x100cfe5
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x60]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 0x26
jb 0x1400068f0
mov byte [rsp + 0x5f], 0
lea r8, [rsp + 0x5e]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x238]
call fcn.140004150
nop
mov esi, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, si
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edi, r12d
mov r14, qword [rbp + 0x250]
mov rsi, qword [rbp + 0x238]
mov r15, qword [rbp + 0x248]
test r15, r15
je 0x140006998
mov rbx, r12
nop dword [rax + rax]
lea rdx, [rbp + 0x238]
cmp r14, 0xf
cmova rdx, rsi
movzx edx, byte [rdx + rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a2e0
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
lea rbx, [rbx + 1]
movsxd rax, edi
cmp rax, r15
jb 0x140006960
mov edi, 8
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
cmp r14, 0xf
jbe 0x1400069ef
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400069e7
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400069e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14000b564
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 0xf
jbe 0x140006a3c
inc rdx
mov rcx, qword [rbp + 0x2a0]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140006a37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000873c
call fcn.14000b564
mov qword [rbp + 0x2b0], r12
mov qword [rbp + 0x2b8], 0xf
mov byte [rbp + 0x2a0], 0
mov rdx, qword [rbp + 0x300]
cmp rdx, 0xf
jbe 0x140006a96
inc rdx
mov rcx, qword [rbp + 0x2e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400087a9
call fcn.14000b564
mov eax, 1
mov rcx, qword [rbp + 0xb00]
xor rcx, rsp
call fcn.14000b500
lea r11, [rsp + 0xc20]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, [rbp + 0x2e8]
cmp qword [rbp + 0x300], 0xf
cmova rdx, qword [rbp + 0x2e8]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov r14, rax
test rax, rax
jne 0x140006c60
movdqa xmm0, xmmword [0x140010a60]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140010b30]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0xa8b0aeb7
mov dword [rsp + 0x5c], 0x100cfe5
mov rcx, r12
nop
lea eax, [rcx - 0x60]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 0x26
jb 0x140006b40
mov byte [rsp + 0x5f], 0
lea r8, [rsp + 0x5e]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x238]
call fcn.140004150
nop
mov esi, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, si
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edi, r12d
mov r14, qword [rbp + 0x250]
mov rsi, qword [rbp + 0x238]
mov r15, qword [rbp + 0x248]
test r15, r15
je 0x140006bef
mov rbx, r12
nop dword [rax + rax]
lea rdx, [rbp + 0x238]
cmp r14, 0xf
cmova rdx, rsi
movzx edx, byte [rbx + rdx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a2e0
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
lea rbx, [rbx + 1]
movsxd rax, edi
cmp rax, r15
jb 0x140006bb0
mov rbx, qword [rbp + 0x278]
mov edi, 8
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
cmp r14, 0xf
jbe 0x140006c46
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140006c3e
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006c3e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14000b564
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x1400069ef
lea r9, [rbp + 0x2c0]
mov r8d, 0x400
lea rdx, [rbp + 0x700]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400085ae
mov eax, dword [rbp + 0x2c0]
test eax, eax
je 0x140006cae
mov r8d, eax
lea rdx, [rbp + 0x700]
lea rcx, [rbp + 0x2a0]
call fcn.140009e80
cmp dword [rbp + 0x2c0], 0
ja 0x140006c60
mov dword [rbp + 0x230], 0x928f91
mov byte [rbp + 0x234], 1
mov rcx, r12
lea eax, [rcx - 0x60]
xor byte [rbp + rcx + 0x230], al
inc rcx
cmp rcx, 3
jb 0x140006cc2
mov byte [rbp + 0x234], 0
lea rcx, [rbp + 0x230]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140006cf0
lea rcx, [rbp + 0x2a0]
cmp qword [rbp + 0x2b8], 0xf
cmova rcx, qword [rbp + 0x2a0]
mov r8, qword [rbp + 0x2b0]
cmp r8, rax
jne 0x1400083da
lea rdx, [rbp + 0x230]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400083da
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
movdqa xmm0, xmmword [0x140010c80]
movdqu xmmword [rbp + 0x258], xmm0
mov dword [rbp + 0x268], 0xdcc6d2d5
mov dword [rbp + 0x26c], 0x100bfc6
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 0x60]
xor byte [rbp + rcx + 0x258], al
inc rcx
cmp rcx, 0x16
jb 0x140006d70
mov byte [rbp + 0x26f], 0
lea r8, [rbp + 0x26e]
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x238]
call fcn.140004150
mov r15d, 0x180
mov edi, 8
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edi, r12d
mov r14, qword [rbp + 0x250]
mov rsi, qword [rbp + 0x238]
mov r12, qword [rbp + 0x248]
test r12, r12
je 0x140006e28
xor ebx, ebx
nop word [rax + rax]
lea rdx, [rbp + 0x238]
cmp r14, 0xf
cmova rdx, rsi
movzx edx, byte [rdx + rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a2e0
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
lea rbx, [rbx + 1]
movsxd rax, edi
cmp rax, r12
jb 0x140006df0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov r12d, 8
movzx edx, r12w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
cmp r14, 0xf
jbe 0x140006e81
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140006e79
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006e79
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14000b564
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r12w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor edi, edi
cmp qword [rbp + 0x2b0], rdi
jbe 0x140006ef4
xor ebx, ebx
nop word [rax + rax]
lea rdx, [rbp + 0x2a0]
cmp qword [rbp + 0x2b8], 0xf
cmova rdx, qword [rbp + 0x2a0]
movzx edx, byte [rdx + rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a2e0
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
lea rbx, [rbx + 1]
movsxd rax, edi
cmp rax, qword [rbp + 0x2b0]
jb 0x140006eb0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r12w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call fcn.140005d50
mov ecx, 0x390
mov eax, dword [rcx + r13]
mov edx, 0x368
test al, 1
jne 0x140006f4c
or eax, 1
mov dword [rcx + r13], eax
lea rbx, [rdx + r13]
mov word [rbx + 3], 0x19f
mov word [rbx], 0x61b8
mov byte [rbx + 2], 0x3a
lea rcx, [0x14000f190]
call fcn.14000b9b8
nop
jmp 0x140006f50
lea rbx, [rdx + r13]
cmp byte [rbx + 4], 0
je 0x140006f69
xor byte [rbx], 0xdb
xor byte [rbx + 1], 0xd
xor byte [rbx + 2], 0x49
xor byte [rbx + 3], 0x9f
mov byte [rbx + 4], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExA]
mov r14, rax
mov qword [rbp + 0x278], rax
test rax, rax
je 0x140007123
nop word [rax + rax]
mov r8d, pe_nt_image_headers64
lea rdx, [rbp + 0x600]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowTextA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x238], xmm0
mov qword [rbp + 0x248], 0
mov qword [rbp + 0x250], 0
lea rax, [rbp + 0x600]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140006fe4
lea rdx, [rbp + 0x600]
lea rcx, [rbp + 0x238]
call fcn.140004280
nop
or r15d, 1
mov dword [rbp + 0x230], r15d
mov rbx, qword [0x140015bb0]
mov r14, qword [0x140015bb8]
cmp rbx, r14
je 0x1400070a3
mov rsi, qword [rbp + 0x250]
mov r12, qword [rbp + 0x248]
mov rdi, qword [rbp + 0x238]
nop dword [rax]
mov rax, qword [rbx + 0x10]
mov r9, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140007051
mov r9, qword [rbx]
lea rcx, [rbp + 0x238]
cmp rsi, 0xf
cmova rcx, rdi
mov qword [rsp + 0x20], rax
mov rdx, r12
call fcn.14000a880
cmp rax, 0xffffffffffffffff
jne 0x14000707e
add rbx, 0x20
cmp rbx, r14
jne 0x140007040
jmp 0x1400070b1
mov r14, qword [rbp + 0x278]
mov rcx, r14
call fcn.140006300
test al, al
je 0x1400070a3
mov bl, 1
mov rsi, qword [rbp + 0x250]
mov rdi, qword [rbp + 0x238]
jmp 0x1400070ba
mov rsi, qword [rbp + 0x250]
mov rdi, qword [rbp + 0x238]
xor bl, bl
mov r14, qword [rbp + 0x278]
test r15b, 1
je 0x1400070fb
and r15d, 0xfffffffe
cmp rsi, 0xf
jbe 0x1400070fb
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400070f3
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400071a2
mov rcx, rdi
call fcn.14000b564
test bl, bl
jne 0x140007123
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExA]
mov r14, rax
mov qword [rbp + 0x278], rax
test rax, rax
jne 0x140006fa0
movdqa xmm0, xmmword [0x1400107f0]
mov dword [rbp + 0x2d8], 0xfea395a5
mov dword [rbp + 0x2dc], 0x59ab3251
mov word [rbp + 0x2e0], 0xbffe
mov ecx, 0x4c4
mov eax, dword [rcx + r13]
mov ebx, 0x420
test al, 1
jne 0x1400071d1
or eax, 1
mov dword [rcx + r13], eax
lea rcx, [rbx + r13]
mov byte [rcx + 0x1a], 1
lea rax, [rcx + 0x19]
lea rdx, [rbp + 0x2e1]
cmp rcx, rdx
ja 0x1400071a9
lea rdx, [rbp + 0x2c8]
cmp rax, rdx
jb 0x1400071a9
movups xmmword [rcx], xmm0
movsd xmm0, qword [rbp + 0x2d8]
movsd qword [rcx + 0x10], xmm0
movzx eax, word [rbp + 0x2e0]
mov word [rcx + 0x18], ax
jmp 0x1400071c4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
movups xmmword [rcx], xmm0
movsd xmm0, qword [rbp + 0x2d8]
movsd qword [rcx + 0x10], xmm0
movzx eax, word [rbp + 0x2e0]
mov word [rcx + 0x18], ax
lea rcx, [0x14000f160]
call fcn.14000b9b8
nop
lea rdx, [rbx + r13]
cmp byte [rdx + 0x1a], 0
je 0x140007246
xor byte [rdx], 0xcb
xor byte [rdx + 1], 0xbf
xor byte [rdx + 2], 0x83
xor byte [rdx + 3], 0xcf
xor byte [rdx + 4], 0x7f
xor byte [rdx + 5], 3
xor byte [rdx + 6], 0x9d
xor byte [rdx + 7], 0x77
xor byte [rdx + 8], 0xcb
xor byte [rdx + 9], 0xbf
xor byte [rdx + 0xa], 0x83
xor byte [rdx + 0xb], 0xcf
xor byte [rdx + 0xc], 0x7f
xor byte [rdx + 0xd], 3
xor byte [rdx + 0xe], 0x9d
xor byte [rdx + 0xf], 0x77
xor byte [rdx + 0x10], 0xcb
xor byte [rdx + 0x11], 0xbf
xor byte [rdx + 0x12], 0x83
xor byte [rdx + 0x13], 0xcf
xor byte [rdx + 0x14], 0x7f
xor byte [rdx + 0x15], 3
xor byte [rdx + 0x16], 0x9d
xor byte [rdx + 0x17], 0x77
xor byte [rdx + 0x18], 0xcb
xor byte [rdx + 0x19], 0xbf
mov byte [rdx + 0x1a], 0
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x1400087b0
movdqa xmm0, xmmword [0x1400107f0]
mov word [rbp + 0x360], 0xbfa5
mov ecx, 0x470
mov eax, dword [rcx + r13]
mov ebx, 0x238
test al, 1
jne 0x1400072d0
or eax, 1
mov dword [rcx + r13], eax
lea rcx, [rbx + r13]
mov byte [rcx + 0x12], 1
lea rax, [rcx + 0x11]
lea rdx, [rbp + 0x361]
cmp rcx, rdx
ja 0x1400072b5
lea rdx, [rbp + 0x350]
cmp rax, rdx
jb 0x1400072b5
movups xmmword [rcx], xmm0
movzx eax, word [rbp + 0x360]
mov word [rcx + 0x10], ax
jmp 0x1400072c3
movups xmmword [rcx], xmm0
movzx eax, word [rbp + 0x360]
mov word [rcx + 0x10], ax
lea rcx, [0x14000f140]
call fcn.14000b9b8
nop
lea rdx, [rbx + r13]
cmp byte [rdx + 0x12], 0
je 0x140007325
xor byte [rdx], 0xcb
xor byte [rdx + 1], 0xbf
xor byte [rdx + 2], 0x83
xor byte [rdx + 3], 0xcf
xor byte [rdx + 4], 0x7f
xor byte [rdx + 5], 3
xor byte [rdx + 6], 0x9d
xor byte [rdx + 7], 0x77
xor byte [rdx + 8], 0xcb
xor byte [rdx + 9], 0xbf
xor byte [rdx + 0xa], 0x83
xor byte [rdx + 0xb], 0xcf
xor byte [rdx + 0xc], 0x7f
xor byte [rdx + 0xd], 3
xor byte [rdx + 0xe], 0x9d
xor byte [rdx + 0xf], 0x77
xor byte [rdx + 0x10], 0xcb
xor byte [rdx + 0x11], 0xbf
mov byte [rdx + 0x12], 0
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x1400087b0
lea rcx, [0x140015ca0]
cmp qword [0x140015cb8], 7
cmova rcx, qword [0x140015ca0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140007362
shr eax, 1
test al, 1
jne 0x140008836
movdqa xmm0, xmmword [0x140010860]
movdqa xmm1, xmmword [0x140010810]
mov dword [rbp + 0x388], 0xa1da370d
mov word [rbp + 0x38c], 0xe83
mov ecx, 0x2bc
mov eax, dword [rcx + r13]
mov ebx, 0x340
test al, 1
jne 0x14000740f
or eax, 1
mov dword [rcx + r13], eax
lea rcx, [rbx + r13]
mov byte [rcx + 0x27], 1
lea rax, [rcx + 0x26]
lea rdx, [rbp + 0x38e]
cmp rcx, rdx
ja 0x1400073e3
lea rdx, [rbp + 0x368]
cmp rax, rdx
jb 0x1400073e3
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [rbp + 0x388]
mov dword [rcx + 0x20], eax
movzx eax, word [rbp + 0x38c]
mov word [rcx + 0x24], ax
mov byte [rcx + 0x26], 0xc1
jmp 0x140007402
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [rbp + 0x388]
mov dword [rcx + 0x20], eax
movzx eax, word [rbp + 0x38c]
mov word [rcx + 0x24], ax
mov byte [rcx + 0x26], 0xc1
lea rcx, [0x14000f0d0]
call fcn.14000b9b8
nop
lea rcx, [rbx + r13]
call fcn.1400094b0
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x1400089ba
movdqa xmm0, xmmword [0x140010860]
movdqa xmm1, xmmword [0x140010810]
mov dword [rbp + 0x3b0], 0xa1da370d
mov word [rbp + 0x3b4], 0xf83
mov ecx, 0x31c
mov eax, dword [rcx + r13]
mov ebx, 0x1f8
test al, 1
jne 0x1400074d9
or eax, 1
mov dword [rcx + r13], eax
lea rcx, [rbx + r13]
mov byte [rcx + 0x27], 1
lea rax, [rcx + 0x26]
lea rdx, [rbp + 0x3b6]
cmp rcx, rdx
ja 0x1400074ad
lea rdx, [rbp + 0x390]
cmp rax, rdx
jb 0x1400074ad
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [rbp + 0x3b0]
mov dword [rcx + 0x20], eax
movzx eax, word [rbp + 0x3b4]
mov word [rcx + 0x24], ax
mov byte [rcx + 0x26], 0xc1
jmp 0x1400074cc
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [rbp + 0x3b0]
mov dword [rcx + 0x20], eax
movzx eax, word [rbp + 0x3b4]
mov word [rcx + 0x24], ax
mov byte [rcx + 0x26], 0xc1
lea rcx, [0x14000f0a0]
call fcn.14000b9b8
nop
lea rcx, [rbx + r13]
call fcn.1400094b0
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x1400089ba
mov rdi, qword [0x140015a40]
mov dword [rbp + 0x3c0], 0x238
xor edx, edx
mov r13d, 2
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rbp + 0x3c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x140007590
lea rdx, [rbp + 0x3c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x140007590
nop word [rax + rax]
lea rax, [rbp + 0x3ec]
mov r8, rdi
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140007573
add rax, r13
test ecx, ecx
jne 0x140007560
test edx, edx
je 0x1400076da
lea rdx, [rbp + 0x3c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140007550
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [0x1400159f4], eax
mov esi, 4
test eax, eax
je 0x140007a2c
movdqa xmm0, xmmword [0x140010d10]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140010920]
movdqu xmmword [rsp + 0x48], xmm1
movdqa xmm0, xmmword [0x140010950]
movdqu xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x68], 0xd9fcfffe
mov word [rsp + 0x6c], pe_nt_image_headers64
xor ecx, ecx
nop dword [rax]
lea eax, [rcx - 0x60]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 0x34
jb 0x1400075f0
mov byte [rsp + 0x6d], 0
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x238]
call fcn.140004150
nop
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, si
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor edi, edi
mov r13, qword [rbp + 0x250]
mov r15, qword [rbp + 0x238]
mov r12, qword [rbp + 0x248]
test r12, r12
je 0x140007689
xor ebx, ebx
lea rdx, [rbp + 0x238]
cmp r13, 0xf
cmova rdx, r15
movzx edx, byte [rdx + rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a2e0
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
lea rbx, [rbx + 1]
movsxd rax, edi
cmp rax, r12
jb 0x140007651
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov r12d, 8
movzx edx, r12w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
cmp r13, 0xf
jbe 0x1400076ed
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400076e5
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400076e5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov eax, dword [rbp + 0x3c8]
jmp 0x14000759b
mov rcx, r15
call fcn.14000b564
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x610], xmm0
movups xmmword [rbp + 0x620], xmm0
movups xmmword [rbp + 0x630], xmm0
movups xmmword [rbp + 0x640], xmm0
movups xmmword [rbp + 0x650], xmm0
movups xmmword [rbp + 0x660], xmm0
movups xmmword [rbp + 0x670], xmm0
mov ebx, dword [0x1400159f4]
movdqu xmmword [rbp + 0x600], xmm0
mov qword [rbp + 0x610], rax
mov qword [rbp + 0x680], rax
lea rcx, [rbp + 0x650]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x648], rax
lea rdx, [0x140015b68]
lea rcx, [rbp + 0x600]
call fcn.140003970
lea rdx, [rbp + 0x600]
lea rcx, [rbp + 0x308]
call fcn.140003de0
nop
mov rbx, qword [rbp + 0x308]
mov r15, qword [rbp + 0x310]
cmp rbx, r15
je 0x140007a00
mov r13d, dword [0x140010740]
movsd xmm6, qword [str.sF_Z]
movzx eax, word [0x140010744]
mov word [rsp + 0x34], ax
movzx eax, byte [0x140010746]
mov dword [rsp + 0x30], r13d
mov byte [rsp + 0x30], 0x32
xor byte [rsp + 0x31], 0x33
xor byte [rsp + 0x32], 0x34
xor byte [rsp + 0x33], 0x35
xor byte [rsp + 0x34], 0x36
xor byte [rsp + 0x35], 0x37
xor al, 0x38
mov byte [rsp + 0x36], al
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140007800
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000781a
mov rcx, qword [rbx]
cmp r8, rax
jne 0x140007831
lea rdx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400088bc
movsd qword [rbp + 0x280], xmm6
mov eax, dword [0x140010680]
mov dword [rbp + 0x288], eax
cmp byte [0x140010683], 0
je 0x1400079af
xor r8d, r8d
cmp dword [0x140015088], 2
jl 0x140007967
movdqa xmm4, xmmword [0x1400107d0]
movdqa xmm2, xmmword [0x140010770]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140010790]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400107c0]
packuswb xmm2, xmm2
mov eax, dword [0x140010830]
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [str.sF_Z]
xorps xmm2, xmm1
movd dword [rbp + 0x280], xmm2
movdqa xmm3, xmmword [0x140010780]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140010790]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400107c0]
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [rbp + 0x284]
xorps xmm2, xmm1
movd dword [rbp + 0x284], xmm2
mov r8d, r12d
movsxd rax, r8d
lea r9, [rbp + 0x280]
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xc
jl 0x140007980
lea rcx, [rbp + 0x280]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400079c0
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400079da
mov rcx, qword [rbx]
cmp r8, rax
jne 0x1400079f3
lea rdx, [rbp + 0x280]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140008910
add rbx, 0x28
cmp rbx, r15
jne 0x1400077b0
lea rcx, [rbp + 0x308]
call fcn.1400040a0
nop
mov rcx, qword [rbp + 0x648]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x600]
call fcn.1400040a0
mov r13d, 2
test r14, r14
jne 0x140007abd
call fcn.140008b60
mov rcx, rax
call fcn.140009430
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140010a30]
movdqu xmmword [rbp + 0x238], xmm0
mov dword [rbp + 0x248], 0xdcd491c4
mov dword [rbp + 0x24c], 0xbdd2dbc1
mov word [rbp + 0x250], pe_nt_image_headers64
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x238]
call fcn.1400093f0
nop
mov edx, esi
lea rcx, [rbp + 0x330]
call fcn.140006190
nop
lea rcx, [rbp + 0x330]
call fcn.140003d50
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [r14 - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [rbp + 0x230]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rbp + 0x230]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
jne 0x140007b6c
call fcn.140008bc0
mov rcx, rax
call fcn.1400093d0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140010b50]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140010b40]
movdqu xmmword [rsp + 0x48], xmm1
mov word [rsp + 0x58], 0xca
mov byte [rsp + 0x5a], 1
lea rdx, [rbp + 0x238]
lea rcx, [rsp + 0x38]
call fcn.140009390
nop
mov edx, esi
lea rcx, [rbp + 0x238]
call fcn.140006190
nop
lea rcx, [rbp + 0x238]
call fcn.140003d50
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x2f0
mov eax, dword [rcx + rdi]
mov ebx, 0x308
test al, 1
jne 0x140007bae
or eax, 1
mov dword [rcx + rdi], eax
mov word [rbx + rdi + 3], 0x107
mov word [rbx + rdi], 0x27ae
mov byte [rbx + rdi + 2], 0xb0
lea rcx, [0x14000f020]
call fcn.14000b9b8
nop
lea rcx, [rbx + rdi]
cmp byte [rcx + 4], 0
je 0x140007bcb
xor byte [rcx], 0xcd
xor byte [rcx + 1], 0x4b
xor byte [rcx + 2], 0xc3
xor byte [rcx + 3], 7
mov byte [rcx + 4], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140010a50]
movdqu xmmword [rbp + 0x258], xmm0
mov dword [rbp + 0x268], 0x93d6dfc5
mov dword [rbp + 0x26c], 0xdfc2dcc3
mov dword [rbp + 0x270], 0xfff3e998
mov dword [rbp + 0x274], 0x1009d86
xor ecx, ecx
nop dword [rax + rax]
lea eax, [rcx - 0x60]
xor byte [rbp + rcx + 0x258], al
inc rcx
cmp rcx, 0x1e
jb 0x140007c10
mov byte [rbp + 0x277], 0
lea r8, [rbp + 0x276]
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x280]
call fcn.140004150
nop
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r13w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor edi, edi
mov r15, qword [rbp + 0x298]
mov r14, qword [rbp + 0x280]
mov r12, qword [rbp + 0x290]
test r12, r12
je 0x140007cb8
xor ebx, ebx
nop dword [rax + rax]
lea rdx, [rbp + 0x280]
cmp r15, 0xf
cmova rdx, r14
movzx edx, byte [rbx + rdx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a2e0
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
lea rbx, [rbx + 1]
movsxd rax, edi
cmp rax, r12
jb 0x140007c80
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edi, 8
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
cmp r15, 0xf
jbe 0x140007d0f
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140007d07
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007d07
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14000b564
mov ebx, dword [rbp + 0x230]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r13w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, ebx
call fcn.140005eb0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rbp + 0x230], 0
jne 0x140007df3
call fcn.140008c20
mov rcx, rax
call fcn.140009370
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140010b80]
movdqu xmmword [rbp + 0x238], xmm0
mov dword [rbp + 0x248], 0xc1c7c5c0
mov dword [rbp + 0x24c], 0xfee695d1
mov word [rbp + 0x250], 0xfc
mov byte [rbp + 0x252], 1
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x238]
call fcn.140009330
nop
mov edx, esi
lea rcx, [rbp + 0x258]
call fcn.140006190
nop
lea rcx, [rbp + 0x258]
call fcn.140003d50
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140008c80
mov rcx, rax
call fcn.140009310
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x308]
call fcn.140008e80
lea rdx, [0x140015c10]
lea rcx, [rbp - 0x40]
call fcn.140009760
nop
lea rdx, [0x140015c40]
lea rcx, [rbp - 0x28]
call fcn.140009760
nop
lea rdx, [0x140015a28]
lea rcx, [rbp - 0x10]
call fcn.140009760
nop
lea rdx, [0x1400159f8]
lea rcx, [rbp + 8]
call fcn.140009760
nop
lea rdx, [0x140015c28]
lea rcx, [rbp + 0x20]
call fcn.140009760
nop
lea rdx, [0x140015b50]
lea rcx, [rbp + 0x38]
call fcn.140009760
nop
lea rdx, [0x140015af0]
lea rcx, [rbp + 0x50]
call fcn.140009760
nop
lea rdx, [0x140015a78]
lea rcx, [rbp + 0x68]
call fcn.140009760
nop
lea rdx, [0x140015a90]
lea rcx, [rbp + 0x80]
call fcn.140009760
nop
lea rdx, [0x140015be0]
lea rcx, [rbp + 0x98]
call fcn.140009760
nop
lea rdx, [0x140015c70]
lea rcx, [rbp + 0xb0]
call fcn.140009760
nop
lea rdx, [0x140015ad8]
lea rcx, [rbp + 0xc8]
call fcn.140009760
nop
lea rdx, [0x140015c58]
lea rcx, [rbp + 0xe0]
call fcn.140009760
nop
lea rdx, [0x140015b08]
lea rcx, [rbp + 0xf8]
call fcn.140009760
nop
lea rdx, [0x140015b20]
lea rcx, [rbp + 0x110]
call fcn.140009760
nop
lea rdx, [0x140015a48]
lea rcx, [rbp + 0x128]
call fcn.140009760
nop
lea rdx, [0x140015ac0]
lea rcx, [rbp + 0x140]
call fcn.140009760
nop
lea rdx, [0x140015c88]
lea rcx, [rbp + 0x158]
call fcn.140009760
nop
lea rdx, [0x140015b98]
lea rcx, [rbp + 0x170]
call fcn.140009760
nop
lea rdx, [0x140015bc8]
lea rcx, [rbp + 0x188]
call fcn.140009760
nop
lea rdx, [0x140015a60]
lea rcx, [rbp + 0x1a0]
call fcn.140009760
nop
lea rdx, [0x140015b80]
lea rcx, [rbp + 0x1b8]
call fcn.140009760
nop
lea rdx, [0x140015b38]
lea rcx, [rbp + 0x1d0]
call fcn.140009760
nop
lea rdx, [0x140015bf8]
lea rcx, [rbp + 0x1e8]
call fcn.140009760
nop
lea rdx, [0x140015a10]
lea rcx, [rbp + 0x200]
call fcn.140009760
nop
lea rdx, [0x140015aa8]
lea rcx, [rbp + 0x218]
call fcn.140009760
nop
lea r8, [rbp + 0x230]
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x78]
call fcn.140009140
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x280], xmm0
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x308]
call fcn.1400091c0
nop
lea r9, [0x1400096f0]
mov edx, 0x18
lea r8d, [rdx + 2]
lea rcx, [rbp - 0x40]
call fcn.14000b600
lea rcx, [rbp + 0x600]
call fcn.140008e50
mov edx, dword [rbp + 0x230]
lea rcx, [rbp + 0x600]
call fcn.140003900
nop
lea rcx, [rbp + 0x238]
call fcn.140008e80
lea rcx, [rbp + 0x238]
call fcn.140009120
nop
lea rcx, [rbp + 0x308]
call fcn.140009190
mov r14, rax
lea rcx, [rbp + 0x308]
call fcn.1400091a0
mov rbx, rax
cmp rax, r14
je 0x1400080d8
nop word [rax + rax]
mov rdx, rbx
lea rcx, [rbp + 0x600]
call fcn.140003970
add rbx, 0x18
cmp rbx, r14
jne 0x1400080c0
lea rcx, [rbp + 0x320]
call fcn.140008ec0
lea rcx, [rbp + 0x320]
call fcn.140008ff0
nop
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x600]
call fcn.140003db0
nop
mov dword [rbp + 0x280], 0xf1e3f5f3
mov dword [rbp + 0x284], 0xe0e8ecf0
mov dword [rbp + 0x288], 0xeae9fa88
mov word [rbp + 0x28c], 0xe2
mov byte [rbp + 0x28e], 1
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x280]
call fcn.140009610
nop
mov edx, edi
lea rcx, [rbp + 0x258]
call fcn.140006190
nop
lea rcx, [rbp + 0x258]
call fcn.140003d50
lea rcx, [rbp + 0x330]
call fcn.140009190
mov r14, rax
lea rcx, [rbp + 0x330]
call fcn.1400091a0
mov rdi, rax
cmp rax, r14
je 0x14000825b
nop dword [rax]
xor ebx, ebx
lea rcx, [rbp + 0x308]
call fcn.140009160
test rax, rax
je 0x14000824e
nop word [rax + rax]
mov rdx, rbx
lea rcx, [rbp + 0x308]
call fcn.140009150
mov r10, rax
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140008ce0
mov r8, qword [rax]
lea rdx, [rsp + 0x78]
mov rcx, r10
call fcn.1400096d0
mov r9, qword [rax]
lea rdx, [rbp + 0x280]
call fcn.1400096e0
mov rdx, r9
mov rcx, qword [rax]
call fcn.14000a4b0
test al, al
jne 0x140008213
inc rbx
lea rcx, [rbp + 0x308]
call fcn.140009160
cmp rbx, rax
jb 0x1400081b0
jmp 0x14000824e
mov ecx, ebx
call fcn.140004940
lea rcx, [0x1400150b8]
call fcn.140003f50
mov qword [rbp + 0x278], rax
lea r8, [rbp + 0x278]
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x320]
call fcn.14000a550
mov byte [0x1400159f0], 1
add rdi, 0x28
cmp rdi, r14
jne 0x140008190
lea rcx, [rbp + 0x320]
call fcn.140009030
test al, al
jne 0x140008964
lea rcx, [rbp + 0x280]
call fcn.140004080
nop
lea rcx, [rbp + 0x258]
call fcn.140004080
nop
call fcn.140008cf0
mov rcx, rax
call fcn.140008f00
mov rdx, rax
lea rcx, [rbp + 0x258]
call fcn.140009fb0
lea rcx, [rbp + 0x278]
call fcn.140008ed0
lea rdx, [rbp + 0x278]
lea rcx, [rbp + 0x320]
call fcn.140009040
lea rcx, [rbp + 0x278]
call fcn.140008f60
test al, al
jne 0x1400083a3
nop dword [rax + rax]
lea rcx, [rbp + 0x278]
call fcn.140008fe0
mov r8, rax
mov word [rsp + 0x70], 0xaa
mov byte [rsp + 0x72], 1
lea rcx, [rsp + 0x70]
call fcn.140008dd0
mov rbx, rax
mov dword [rsp + 0x30], 0x83ff8cfb
mov word [rsp + 0x34], pe_nt_image_headers64
lea rcx, [rsp + 0x30]
call fcn.140008da0
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000a580
nop
lea r8, [rbp + 0x258]
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.14000a280
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14000a210
nop
mov rdx, rax
lea rcx, [rbp + 0x280]
call fcn.140009fa0
nop
lea rcx, [rsp + 0x78]
call fcn.140003d50
nop
lea rcx, [rbp - 0x68]
call fcn.140003d50
nop
lea rcx, [rsp + 0x38]
call fcn.140003d50
lea rcx, [rbp + 0x278]
call fcn.140008f70
lea rcx, [rbp + 0x278]
call fcn.140008f60
test al, al
je 0x1400082e0
call fcn.140008df0
mov rcx, rax
call fcn.140008ee0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, esi
lea rcx, [rbp + 0x280]
call fcn.140006190
nop
lea rcx, [rbp + 0x258]
call fcn.140003d50
nop
jmp 0x1400089a8
movdqa xmm0, xmmword [0x1400108c0]
movdqu xmmword [rbp + 0x258], xmm0
mov word [rbp + 0x268], 0xba
mov byte [rbp + 0x26a], 1
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 0x60]
xor byte [rbp + rcx + 0x258], al
inc rcx
cmp rcx, 0x11
jb 0x140008400
mov byte [rbp + 0x26a], 0
lea r8, [rbp + 0x269]
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x238]
call fcn.140004150
nop
mov esi, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, si
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edi, r12d
mov r14, qword [rbp + 0x250]
mov rsi, qword [rbp + 0x238]
mov r15, qword [rbp + 0x248]
test r15, r15
je 0x1400084a9
mov rbx, r12
lea rdx, [rbp + 0x238]
cmp r14, 0xf
cmova rdx, rsi
movzx edx, byte [rdx + rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a2e0
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
lea rbx, [rbx + 1]
movsxd rax, edi
cmp rax, r15
jb 0x140008471
mov edi, 8
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
cmp r14, 0xf
jbe 0x140008500
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400084f8
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400084f8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14000b564
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 0xf
jbe 0x14000854d
inc rdx
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008548
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000873c
call fcn.14000b564
mov qword [rbp + 0x2b0], r12
mov qword [rbp + 0x2b8], 0xf
mov byte [rbp + 0x2a0], 0
mov rdx, qword [rbp + 0x300]
cmp rdx, 0xf
jbe 0x1400085a7
inc rdx
mov rcx, qword [rbp + 0x2e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400085a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400087a9
call fcn.14000b564
xor eax, eax
jmp 0x140006a9b
movdqa xmm0, xmmword [0x140010a60]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140010b30]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0xa8b0aeb7
mov dword [rsp + 0x5c], 0x100cfe5
mov rcx, r12
nop dword [rax]
lea eax, [rcx - 0x60]
xor byte [rsp + rcx + 0x38], al
inc rcx
cmp rcx, 0x26
jb 0x1400085e0
mov byte [rsp + 0x5f], 0
lea r8, [rsp + 0x5e]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x238]
call fcn.140004150
nop
mov esi, 4
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, si
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edi, r12d
mov r15, qword [rbp + 0x250]
mov rsi, qword [rbp + 0x238]
mov r12, qword [rbp + 0x248]
test r12, r12
je 0x14000868f
xor ebx, ebx
nop word [rax + rax]
lea rdx, [rbp + 0x238]
cmp r15, 0xf
cmova rdx, rsi
movzx edx, byte [rbx + rdx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000a2e0
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
lea rbx, [rbx + 1]
movsxd rax, edi
cmp rax, r12
jb 0x140008650
mov rbx, qword [rbp + 0x278]
mov edi, 8
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
cmp r15, 0xf
jbe 0x1400086e6
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400086de
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400086de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14000b564
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 0xf
jbe 0x140008748
inc rdx
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008743
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008743
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b564
mov qword [rbp + 0x2b0], 0
mov qword [rbp + 0x2b8], 0xf
mov byte [rbp + 0x2a0], 0
mov rdx, qword [rbp + 0x300]
cmp rdx, 0xf
jbe 0x140006a96
inc rdx
mov rcx, qword [rbp + 0x2e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006a91
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140008a40
mov rcx, rax
call fcn.1400095c0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140010ab0]
movdqu xmmword [rbp + 0x238], xmm0
mov dword [rbp + 0x248], 0xc7dcd4d9
mov dword [rbp + 0x24c], 0xc3d3f194
mov dword [rbp + 0x250], 0xdecedadd
mov dword [rbp + 0x254], 0x100b7d8
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x238]
call fcn.140009580
nop
mov edx, 4
lea rcx, [rbp + 0x330]
call fcn.140006190
nop
lea rcx, [rbp + 0x330]
call fcn.140003d50
call fcn.140006230
int3
call fcn.140008aa0
mov rcx, rax
call fcn.140009560
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140010ab0]
movdqu xmmword [rbp + 0x238], xmm0
mov dword [rbp + 0x248], 0xc7dcd4d9
mov dword [rbp + 0x24c], 0xc3d3f194
mov dword [rbp + 0x250], 0xdecedadd
mov dword [rbp + 0x254], 0x100b7d8
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x238]
call fcn.140009580
nop
mov edx, 4
lea rcx, [rbp + 0x330]
call fcn.140006190
nop
lea rcx, [rbp + 0x330]
call fcn.140003d50
call fcn.140006230
nop
movdqa xmm0, xmmword [0x140010aa0]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x1400107a0]
movdqu xmmword [rsp + 0x48], xmm1
mov byte [rsp + 0x58], 1
lea rdx, [rbp + 0x238]
lea rcx, [rsp + 0x38]
call fcn.140009690
nop
mov edx, esi
lea rcx, [rbp + 0x238]
call fcn.140006190
nop
lea rcx, [rbp + 0x238]
call fcn.140003d50
call fcn.140006230
int3
movdqa xmm0, xmmword [0x140010aa0]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x1400107a0]
movdqu xmmword [rsp + 0x48], xmm1
mov byte [rsp + 0x58], 1
lea rdx, [rbp + 0x238]
lea rcx, [rsp + 0x38]
call fcn.140009690
nop
mov edx, esi
lea rcx, [rbp + 0x238]
call fcn.140006190
nop
lea rcx, [rbp + 0x238]
call fcn.140003d50
call fcn.140006230
nop
movdqa xmm0, xmmword [0x1400108e0]
movdqu xmmword [rbp + 0x258], xmm0
mov word [rbp + 0x268], 0xba
mov byte [rbp + 0x26a], 1
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x258]
call fcn.140009650
nop
mov edx, r13d
lea rcx, [rbp + 0x280]
call fcn.140006190
nop
lea rcx, [rbp + 0x280]
call fcn.140003d50
call fcn.140006230
nop
call fcn.140008b00
mov rcx, rax
call fcn.140009490
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140010d00]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140010cc0]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0xc9a6a4b4
mov word [rsp + 0x5c], pe_nt_image_headers64
lea rdx, [rbp + 0x238]
lea rcx, [rsp + 0x38]
call fcn.140009450
nop
mov edx, 4
lea rcx, [rbp + 0x238]
call fcn.140006190
nop
lea rcx, [rbp + 0x238]
call fcn.140003d50
call fcn.140006230
int3