Function at 0x14000d740
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Resume thread
Terminate process
Use process replacement

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x6a0
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rbp + 0x620], rax
call fcn.14000d500
test al, al
jne 0x14000d911
call fcn.14000ce60
test al, al
jne 0x14000d911
movabs rcx, 0x11da2ff0aae74424
movabs rax, 0x8609323cb7d7ff0f
mov qword [rbp + 0x10], rcx
movabs rdi, 0x682044c8ac0d367b
movabs rcx, 0xae55b17bbf5b1688
mov qword [rbp + 0x5a0], rax
mov qword [rbp + 0x18], rcx
movabs rax, 0xe0afbb410f6a2b64
movabs rcx, 0x4d1c1687fe5f7320
mov qword [rbp + 0x5a8], rax
movdqa xmm2, xmmword [rbp + 0x5a0]
movabs rsi, 0xdbd6865d89316e50
mov qword [rbp + 0x5c0], rcx
movabs r14, 0x74b64b9ecbaf2845
movabs rcx, 0x9df6db63ed145423
mov qword [rbp + 0x600], rdi
mov qword [rbp + 0x5c8], rcx
movabs r15, 0xae55b17bbf5b16b2
movabs rcx, 0x1bc26bfaaec34124
mov qword [rbp + 0x608], rsi
mov qword [rbp + 0x5d0], rcx
movabs r12, 0x1e52219bd87f5338
movabs rcx, 0xdd75d40fd6296192
mov qword [rbp + 0x610], r14
mov qword [rbp + 0x5d8], rcx
movabs r13, 0xbea2d567b3540d39
movabs rcx, 0x8609575fdea18d6a
mov qword [rbp + 0x618], r15
vmovdqu ymm0, ymmword [rbp + 0x600]
mov qword [rbp + 0x5e0], rcx
mov r8d, 0x35
mov qword [rbp + 0x5e8], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x5e0]
mov qword [rbp + 8], r13
lea rdx, [rbp]
mov qword [rbp], r12
lea rcx, [rbp + 0x5c0]
vpxor ymm1, ymm0, ymmword [rbp]
vmovdqa ymmword [rbp], ymm1
mov qword [rbp + 0x580], rdi
mov qword [rbp + 0x588], rsi
mov qword [rbp + 0x590], r14
mov qword [rbp + 0x598], r15
vmovdqu ymm0, ymmword [rbp + 0x580]
vpxor ymm1, ymm0, ymmword [rbp + 0x5c0]
vmovdqa ymmword [rbp + 0x5c0], ymm1
vmovdqa xmmword [rbp + 0x5e0], xmm2
vzeroupper
call fcn.140008c00
int3
xor eax, eax
lea rcx, [rbp + 0x580]
mov qword [rbp + 0xa0], rax
xorps xmm0, xmm0
mov qword [rbp + 0x30], rax
xor r12d, r12d
movabs rax, 0x8609323cb7d7ff0f
movabs rdi, 0x682044c8ac0d367b
mov qword [rbp + 0x5e0], rax
movabs rsi, 0xdbd6865d89316e50
movups xmmword [rbp + 0x40], xmm0
movabs rax, 0x8aa48c225eb19d49
movabs r14, 0x74b64b9ecbaf2845
mov qword [rbp + 0x5f0], rax
movabs r15, 0xae55b17bbf5b16b2
movups xmmword [rbp + 0x50], xmm0
movabs rax, 0x4c96833f35d8ff26
mov qword [rbp + 0x5c0], rdi
mov qword [rbp + 0x5f8], rax
movabs rbx, 0xe0afbb410f6a2b64
movups xmmword [rbp + 0x60], xmm0
movabs rax, 0x1a472bbafc510c38
mov qword [rbp + 0x5c8], rsi
mov qword [rbp + 0x580], rax
xor r9d, r9d
movups xmmword [rbp + 0x70], xmm0
movabs rax, 0xa8b3ea34cf110331
mov qword [rbp + 0x5d0], r14
mov qword [rbp + 0x588], rax
xor r8d, r8d
movups xmmword [rbp + 0x80], xmm0
movabs rax, 0x35ea62a8f3d70065
mov qword [rbp + 0x5d8], r15
mov qword [rbp + 0x590], rax
xor edx, edx
movups xmmword [rbp + 0x90], xmm0
movabs rax, 0xdd20c23ae30843e1
mov qword [rbp + 0x5e8], rbx
mov qword [rbp + 0x598], rax
movabs rax, 0xf07b576fc3a59a4c
mov qword [rbp + 0x5a0], rax
movabs rax, 0x93dac800530f480d
mov qword [rbp + 0x5a8], rax
movabs rax, 0xfcd6e9712ac3f80a
mov qword [rbp + 0x5b0], rax
movabs rax, 0x4cf3fb5a1bbd9c4f
mov qword [rbp + 0x5b8], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rax
movups xmmword [rbp + 0x20], xmm0
vmovdqu ymm0, ymmword [rbp + 0x5c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x580]
vmovdqu ymm0, ymmword [rbp + 0x5e0]
mov qword [rsp + 0x38], r12
vmovdqa ymmword [rbp + 0x580], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x5a0]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r12d
vmovdqa ymmword [rbp + 0x5a0], ymm1
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14000dc68
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs rcx, 0x11da2ff0aae74424
mov qword [rbp + 0x5e8], rbx
mov qword [rbp + 0x10], rcx
mov r9d, eax
movabs rcx, 0xae55b17bbf5b1688
mov r8d, 0x3e
mov qword [rbp + 0x18], rcx
movabs rcx, 0x8609323cb7d7ff0f
mov qword [rbp + 0x5e0], rcx
movabs rcx, 0x8aa48c225eb19d49
mov qword [rbp + 0x5f0], rcx
movabs rcx, 0x4d1c1687fe5f7320
mov qword [rbp + 0x580], rcx
movabs rcx, 0x9df6db63ed145423
mov qword [rbp + 0x588], rcx
movabs rcx, 0x1bc26bfaaec34124
mov qword [rbp + 0x590], rcx
movabs rcx, 0xdd75c509de2f6592
mov qword [rbp + 0x598], rcx
movabs rcx, 0xca29575fdea18d6a
mov qword [rbp + 0x5a0], rcx
movabs rcx, 0x92c0c9334a1e5805
mov qword [rbp + 0x5a8], rcx
movabs rcx, 0x8aa48c2203d5b812
mov qword [rbp + 0x5b0], rcx
movabs rdx, 0x4c96833f35d8ff26
mov qword [rbp + 0x5b8], rdx
mov qword [rbp + 0x5f8], rdx
lea rcx, [rbp + 0x580]
mov qword [rbp + 0x600], rdi
lea rdx, [rbp]
mov qword [rbp + 0x608], rsi
movabs r12, 0x1e52219bd87f5338
mov qword [rbp], r12
movabs r13, 0xbea2d567b3540d39
mov qword [rbp + 8], r13
mov qword [rbp + 0x610], r14
mov qword [rbp + 0x618], r15
vmovdqu ymm0, ymmword [rbp + 0x600]
vpxor ymm1, ymm0, ymmword [rbp]
vmovdqa ymmword [rbp], ymm1
mov qword [rbp + 0x5d8], r15
mov qword [rbp + 0x5d0], r14
mov qword [rbp + 0x5c8], rsi
mov qword [rbp + 0x5c0], rdi
vmovdqu ymm0, ymmword [rbp + 0x5c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x580]
vmovdqu ymm0, ymmword [rbp + 0x5e0]
vmovdqa ymmword [rbp + 0x580], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x5a0]
vmovdqa ymmword [rbp + 0x5a0], ymm1
vzeroupper
call fcn.140008c00
int3
mov rcx, qword [rbp + 0x20]
xor edx, edx
mov r9d, 0x1000
mov dword [rsp + 0x20], 0x40
mov r8d, 0x648
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x600], rax
mov r13, rax
test rax, rax
jne 0x14000dd83
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x20]
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movabs rcx, 0x11da2ff0aae74424
movabs rax, 0xe0afbb410f6a2b64
mov qword [rbp + 0x10], rcx
mov r9d, ebx
mov qword [rbp + 0x5e8], rax
movabs rcx, 0xae55b17bbf5b1688
mov qword [rbp + 0x18], rcx
movabs rax, 0xda34d214d3377792
mov qword [rbp + 0x598], rax
movabs rcx, 0x8609323cb7d7ff0f
mov qword [rbp + 0x5e0], rcx
movabs rax, 0xff7b5d51d2badf6a
movabs rcx, 0x8aa48c225eb19d49
mov qword [rbp + 0x5a0], rax
mov qword [rbp + 0x5f0], rcx
movabs rax, 0x92ddfe357c0b6744
movabs rcx, 0x4d1c1687fe5f7320
mov qword [rbp + 0x5a8], rax
mov qword [rbp + 0x580], rcx
movabs rax, 0x8aa4d1467beaef26
movabs rcx, 0x9df6db63ed145423
mov qword [rbp + 0x5b0], rax
mov qword [rbp + 0x588], rcx
mov r8d, 0x48
movabs rcx, 0x1bc26bfaaec34124
mov qword [rbp + 0x590], rcx
jmp 0x14000db9a
mov rcx, qword [rbp + 0x20]
lea rbx, [rax + 4]
mov rdx, rbx
mov qword [rsp + 0x20], r12
mov r9d, 0x644
lea r8, [0x1400258a0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14000de74
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x20]
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movabs rcx, 0x11da2ff0aae74424
movabs rax, 0xe0afbb410f6a2b64
mov qword [rbp + 0x10], rcx
mov r9d, ebx
movabs rcx, 0xae55b17bbf5b1688
mov qword [rbp + 0x5e8], rax
mov qword [rbp + 0x18], rcx
movabs rax, 0xde75d40fd6296192
movabs rcx, 0x8609323cb7d7ff0f
mov qword [rbp + 0x598], rax
mov qword [rbp + 0x5e0], rcx
movabs rax, 0xca29565dd8bb866e
movabs rcx, 0x8aa48c225eb19d49
mov qword [rbp + 0x5a0], rax
mov qword [rbp + 0x5f0], rcx
mov r8d, 0x51
movabs rcx, 0x4d1c1687fe5f7320
mov qword [rbp + 0x580], rcx
movabs rcx, 0x9df6db63ed145423
mov qword [rbp + 0x588], rcx
movabs rcx, 0x1bc26bfaaec34124
mov qword [rbp + 0x590], rcx
jmp 0x14000db78
xor edx, edx
lea rcx, [rbp + 0xb0]
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0xb0]
mov dword [rbp + 0xe0], 0x10001f
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x14000dfae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x20]
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movabs rcx, 0x11da2ff0aae74424
movabs rax, 0xe0afbb410f6a2b64
mov qword [rbp + 0x10], rcx
movabs rdx, 0x4c96833f35d8ff26
mov qword [rbp + 0x5e8], rax
movabs rcx, 0xae55b17bbf5b1688
mov qword [rbp + 0x18], rcx
movabs rax, 0xdc3dc55bcb3e7192
mov qword [rbp + 0x598], rax
movabs rcx, 0x8609323cb7d7ff0f
mov qword [rbp + 0x5e0], rcx
movabs rax, 0xf2675d5f97b39e6a
mov qword [rbp + 0x5a0], rax
movabs rcx, 0x8aa48c225eb19d49
mov qword [rbp + 0x5f0], rcx
movabs rax, 0x94dcda0d2f1e5301
movabs rcx, 0x4d1c1687fe5f7320
mov qword [rbp + 0x5a8], rax
mov qword [rbp + 0x580], rcx
movabs rax, 0xee81d75031c3ef0c
movabs rcx, 0x9df6db63ed145423
mov qword [rbp + 0x5b0], rax
mov qword [rbp + 0x588], rcx
movabs rax, 0x4c96833f35d8ff7b
movabs rcx, 0x1bc26bfaaec34124
mov qword [rbp + 0x5b8], rax
mov qword [rbp + 0x590], rcx
mov r9d, ebx
mov r8d, 0x5c
jmp 0x14000dbab
mov qword [rbp + 0x1a8], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rbp + 0x28]
lea rdx, [rbp + 0xb0]
mov eax, eax
mov qword [rbp + 0x130], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x14000e0e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x20]
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movabs rcx, 0x11da2ff0aae74424
movabs rax, 0xe0afbb410f6a2b64
mov qword [rbp + 0x10], rcx
movabs rdx, 0x4c96833f35d8ff26
mov qword [rbp + 0x5e8], rax
movabs rcx, 0xae55b17bbf5b1688
mov qword [rbp + 0x18], rcx
movabs rax, 0xda75d40fd6296192
mov qword [rbp + 0x598], rax
movabs rcx, 0x8609323cb7d7ff0f
mov qword [rbp + 0x5e0], rcx
movabs rax, 0xe96a1258d6b28d67
mov qword [rbp + 0x5a0], rax
movabs rcx, 0x8aa48c225eb19d49
mov qword [rbp + 0x5f0], rcx
movabs rax, 0x81e39b35770f5f0a
movabs rcx, 0x4d1c1687fe5f7320
mov qword [rbp + 0x5a8], rax
mov qword [rbp + 0x580], rcx
movabs rax, 0xd1d6e3502cf4e93a
movabs rcx, 0x9df6db63ed145423
mov qword [rbp + 0x5b0], rax
mov qword [rbp + 0x588], rcx
movabs rax, 0x4c96833f35859b03
movabs rcx, 0x1bc26bfaaec34124
mov qword [rbp + 0x5b8], rax
mov qword [rbp + 0x590], rcx
mov r9d, ebx
mov r8d, 0x68
jmp 0x14000dbab
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x14000e1f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x20]
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movabs rcx, 0x11da2ff0aae74424
movabs rax, 0xe0afbb410f6a2b64
mov qword [rbp + 0x10], rcx
movabs rdx, 0x4c96833f35d8ff26
mov qword [rbp + 0x5e8], rax
movabs rcx, 0xae55b17bbf5b1688
mov qword [rbp + 0x18], rcx
movabs rax, 0x8e30dc0ecc3e6492
mov qword [rbp + 0x598], rax
movabs rcx, 0x8609323cb7d7ff0f
mov qword [rbp + 0x5e0], rcx
movabs rax, 0xe529565dd2a5977b
mov qword [rbp + 0x5a0], rax
movabs rcx, 0x8aa48c225eb19d49
mov qword [rbp + 0x5f0], rcx
movabs rax, 0xac8fcf396a1e450b
movabs rcx, 0x4d1c1687fe5f7320
mov qword [rbp + 0x5a8], rax
mov qword [rbp + 0x580], rcx
movabs rax, 0xf8cbfe501bc5ee28
movabs rcx, 0x9df6db63ed145423
mov qword [rbp + 0x5b0], rax
mov qword [rbp + 0x588], rcx
movabs rax, 0x4c96833f68bcda7d
movabs rcx, 0x1bc26bfaaec34124
mov qword [rbp + 0x5b8], rax
mov qword [rbp + 0x590], rcx
mov r9d, ebx
mov r8d, 0x71
jmp 0x14000dbab
mov rcx, qword [rbp + 0x20]
lea r8, [rbp + 0x38]
mov r9d, 4
mov dword [rbp + 0x38], r12d
mov rdx, r13
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movabs rcx, 0x11da2ff0aae74424
movabs rdx, 0xae55b17bbf5b1688
movabs r12, 0x1e52219bd87f5338
movabs r13, 0xbea2d567b3540d39
movabs r8, 0x4d1c1687fe5f7320
test eax, eax
je 0x14000ebb2
movabs rbx, 0xea607459c3b69a7d
movabs r9, 0x9df6db63ed145423
movabs r10, 0x1bc26bfaaec34124
movabs r11, 0xed21ff5bcb3e7192
nop word [rax + rax]
mov eax, dword [rbp + 0x38]
cmp eax, 0x1badd00d
je 0x14000e2e0
cmp eax, 0xc001f00d
je 0x14000e2e0
test eax, eax
je 0x14000e2e0
mov rcx, qword [rbp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [rbp + 0x38]
movabs rcx, 0x11da2ff0aae74424
movabs rdx, 0xae55b17bbf5b1688
movabs r8, 0x4d1c1687fe5f7320
movabs r9, 0x9df6db63ed145423
movabs r10, 0x1bc26bfaaec34124
movabs r11, 0xed21ff5bcb3e7192
cmp eax, 5
ja 0x14000e834
je 0x14000e735
sub eax, 1
je 0x14000e640
sub eax, 1
je 0x14000e555
sub eax, 1
je 0x14000e41c
cmp eax, 1
jne 0x14000eb4a
mov qword [rbp + 0x580], rdi
movabs rax, 0x8609323cb7d7ff0f
mov qword [rbp + 0x588], rsi
movabs rbx, 0xe0afbb410f6a2b64
mov qword [rbp + 0x590], r14
mov qword [rbp + 0x598], r15
vmovdqu ymm0, ymmword [rbp + 0x580]
mov qword [rbp + 0x5c0], r8
mov r8d, 0x96
mov qword [rbp + 0x5a0], rax
movabs rax, 0x8609323cd2a49063
mov qword [rbp], r12
mov qword [rbp + 8], r13
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
vpxor ymm1, ymm0, ymmword [rbp]
mov qword [rbp + 0x5e0], rax
mov qword [rbp + 0x5c8], r9
mov qword [rbp + 0x5d0], r10
mov qword [rbp + 0x5d8], r11
mov qword [rbp + 0x5e8], rbx
mov qword [rbp + 0x580], rdi
mov qword [rbp + 0x588], rsi
mov qword [rbp + 0x590], r14
mov qword [rbp + 0x598], r15
vmovdqu ymm0, ymmword [rbp + 0x580]
mov qword [rbp + 0x5a8], rbx
vmovdqa xmm2, xmmword [rbp + 0x5a0]
vxorps xmm2, xmm2, xmmword [rbp + 0x5e0]
vmovdqa ymmword [rbp], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x5c0]
vmovdqa ymmword [rbp + 0x5c0], ymm1
vmovdqa xmmword [rbp + 0x5e0], xmm2
lea rdx, [rbp]
lea rcx, [rbp + 0x5c0]
vzeroupper
call fcn.140008c00
int3
mov qword [rbp + 0x580], rdi
movabs rax, 0x8609323cb7d7ff0f
mov qword [rbp + 0x5a0], rax
movabs rbx, 0x4c96833f35d8ff26
mov qword [rbp + 0x588], rsi
movabs rax, 0xe0afbb410f6a2b64
mov qword [rbp + 0x5a8], rax
movabs rax, 0x8aa48c225eb19d49
mov qword [rbp + 0x5b0], rax
movabs rax, 0xea21ff5bcb3e7192
mov qword [rbp + 0x5d8], rax
movabs rax, 0xc5667b59d4be896a
mov qword [rbp + 0x5e0], rax
movabs rax, 0x89e9d72e7d1e450b
mov qword [rbp + 0x590], r14
mov qword [rbp + 0x598], r15
vmovdqu ymm0, ymmword [rbp + 0x580]
mov qword [rbp + 0x5e8], rax
movabs rax, 0x8aa48c225eb1f825
mov qword [rbp + 0x5c0], r8
mov r8d, 0x91
mov qword [rbp], r12
mov qword [rbp + 8], r13
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
vpxor ymm1, ymm0, ymmword [rbp]
vmovdqa ymmword [rbp], ymm1
mov qword [rbp + 0x5c8], r9
mov qword [rbp + 0x5d0], r10
mov qword [rbp + 0x5f0], rax
mov qword [rbp + 0x5f8], rbx
mov qword [rbp + 0x580], rdi
mov qword [rbp + 0x588], rsi
mov qword [rbp + 0x590], r14
mov qword [rbp + 0x598], r15
vmovdqu ymm0, ymmword [rbp + 0x580]
vpxor ymm1, ymm0, ymmword [rbp + 0x5c0]
mov qword [rbp + 0x5b8], rbx
vmovdqu ymm0, ymmword [rbp + 0x5a0]
vmovdqa ymmword [rbp + 0x5c0], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x5e0]
vmovdqa ymmword [rbp + 0x5e0], ymm1
jmp 0x14000e3f9
mov qword [rbp + 0x580], rdi
movabs rax, 0x8609323cb7d7ff0f
mov qword [rbp + 0x5a0], rax
movabs rax, 0xe0afbb410f6a2b64
mov qword [rbp + 0x588], rsi
mov qword [rbp + 0x590], r14
mov qword [rbp + 0x598], r15
vmovdqu ymm0, ymmword [rbp + 0x580]
mov qword [rbp + 0x5c0], r8
mov r8d, 0x8c
mov qword [rbp + 0x5a8], rax
movabs rax, 0xe0afbb410f6a2b01
vmovdqa xmm2, xmmword [rbp + 0x5a0]
mov qword [rbp], r12
mov qword [rbp + 8], r13
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
vpxor ymm1, ymm0, ymmword [rbp]
mov qword [rbp + 0x5e8], rax
mov qword [rbp + 0x5c8], r9
mov qword [rbp + 0x5d0], r10
mov qword [rbp + 0x5d8], r11
mov qword [rbp + 0x5e0], rbx
vxorps xmm2, xmm2, xmmword [rbp + 0x5e0]
mov qword [rbp + 0x580], rdi
mov qword [rbp + 0x588], rsi
mov qword [rbp + 0x590], r14
mov qword [rbp + 0x598], r15
vmovdqu ymm0, ymmword [rbp + 0x580]
vmovdqa ymmword [rbp], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x5c0]
vmovdqa xmmword [rbp + 0x5e0], xmm2
vmovdqa ymmword [rbp + 0x5c0], ymm1
jmp 0x14000eb36
mov qword [rbp + 0x10], rcx
movabs rax, 0x8609323cb7d7ff0f
mov qword [rbp + 0x580], rdi
movabs rcx, 0xca21ff5bcb3e7192
mov qword [rbp + 0x588], rsi
mov qword [rbp + 0x590], r14
mov qword [rbp + 0x598], r15
vmovdqu ymm0, ymmword [rbp + 0x580]
mov qword [rbp + 0x5d8], rcx
movabs rcx, 0x866c415dd5f79363
mov qword [rbp + 0x5c0], r8
mov r8d, 0x87
mov qword [rbp + 0x5a0], rax
movabs rax, 0xe0afbb410f6a2b64
mov qword [rbp], r12
mov qword [rbp + 8], r13
mov qword [rbp + 0x18], rdx
vpxor ymm1, ymm0, ymmword [rbp]
mov qword [rbp + 0x5c8], r9
mov qword [rbp + 0x5d0], r10
mov qword [rbp + 0x5e0], rcx
mov qword [rbp + 0x5e8], rax
mov qword [rbp + 0x5a8], rax
vmovdqa xmm2, xmmword [rbp + 0x5a0]
vxorps xmm2, xmm2, xmmword [rbp + 0x5e0]
mov qword [rbp + 0x580], rdi
mov qword [rbp + 0x588], rsi
mov qword [rbp + 0x590], r14
mov qword [rbp + 0x598], r15
vmovdqu ymm0, ymmword [rbp + 0x580]
vmovdqa ymmword [rbp], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x5c0]
vmovdqa xmmword [rbp + 0x5e0], xmm2
vmovdqa ymmword [rbp + 0x5c0], ymm1
jmp 0x14000eb36
mov qword [rbp + 0x580], rdi
movabs rax, 0x8609323cb7d7ff0f
mov qword [rbp + 0x5a0], rax
movabs rax, 0xe0afbb410f6a2b64
mov qword [rbp + 0x5a8], rax
movabs rax, 0xfa21ff5bcb3e7192
mov qword [rbp + 0x5d8], rax
movabs rax, 0xe37d5352deba8d6a
mov qword [rbp + 0x5e0], rax
movabs rax, 0xe0dcc8246c055934
mov qword [rbp + 0x588], rsi
mov qword [rbp + 0x590], r14
mov qword [rbp + 0x598], r15
vmovdqu ymm0, ymmword [rbp + 0x580]
mov qword [rbp + 0x5c0], r8
mov r8d, 0x9b
mov qword [rbp], r12
mov qword [rbp + 8], r13
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
vpxor ymm1, ymm0, ymmword [rbp]
mov qword [rbp + 0x5e8], rax
vmovdqa xmm2, xmmword [rbp + 0x5e0]
vxorps xmm2, xmm2, xmmword [rbp + 0x5a0]
mov qword [rbp + 0x5c8], r9
mov qword [rbp + 0x5d0], r10
mov qword [rbp + 0x580], rdi
mov qword [rbp + 0x588], rsi
mov qword [rbp + 0x590], r14
mov qword [rbp + 0x598], r15
vmovdqu ymm0, ymmword [rbp + 0x580]
vmovdqa ymmword [rbp], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x5c0]
vmovdqa xmmword [rbp + 0x5e0], xmm2
vmovdqa ymmword [rbp + 0x5c0], ymm1
jmp 0x14000eb36
cmp eax, 6
je 0x14000ea0c
cmp eax, 7
je 0x14000e90d
cmp eax, 0xc001f00d
jne 0x14000eb4a
mov rcx, qword [rbp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0x1b553789f0236a27
mov qword [rsp + 0x30], 0
mov qword [rbp], rax
lea rcx, [rbp]
movabs rax, 0xdbd6865dba5e0737
mov qword [rbp + 0x600], rdi
mov qword [rbp + 8], rax
xor r9d, r9d
mov qword [rbp + 0x608], rsi
mov edx, 0xc0000000
movdqa xmm0, xmmword [rbp + 0x600]
mov r8d, 3
xorps xmm0, xmmword [rbp]
mov dword [rsp + 0x28], 0
movdqa xmmword [rbp], xmm0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, qword [rbp + 0x620]
xor rcx, rsp
call fcn.14000f5e0
lea r11, [rsp + 0x6a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rbp + 0x580], rdi
movabs rax, 0x8609323cb7d7ff0f
mov qword [rbp + 0x5a0], rax
movabs rax, 0xe0afbb410f6a2b64
mov qword [rbp + 0x5a8], rax
movabs rax, 0xc13c911fd13e6592
mov qword [rbp + 0x5d8], rax
movabs rax, 0xe2295d4897bb8b6c
mov qword [rbp + 0x5e0], rax
movabs rax, 0xe0afbb336a1c4216
mov qword [rbp + 0x588], rsi
mov qword [rbp + 0x590], r14
mov qword [rbp + 0x598], r15
vmovdqu ymm0, ymmword [rbp + 0x580]
mov qword [rbp + 0x5c0], r8
mov r8d, 0xa5
mov qword [rbp], r12
mov qword [rbp + 8], r13
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
vpxor ymm1, ymm0, ymmword [rbp]
mov qword [rbp + 0x5e8], rax
vmovdqa xmm2, xmmword [rbp + 0x5e0]
vxorps xmm2, xmm2, xmmword [rbp + 0x5a0]
mov qword [rbp + 0x5c8], r9
mov qword [rbp + 0x5d0], r10
mov qword [rbp + 0x580], rdi
mov qword [rbp + 0x588], rsi
mov qword [rbp + 0x590], r14
mov qword [rbp + 0x598], r15
vmovdqu ymm0, ymmword [rbp + 0x580]
vmovdqa ymmword [rbp], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x5c0]
vmovdqa xmmword [rbp + 0x5e0], xmm2
vmovdqa ymmword [rbp + 0x5c0], ymm1
jmp 0x14000eb36
mov qword [rbp + 0x18], rdx
movabs rax, 0x8609323cb7d7ff0f
mov qword [rbp + 0x5a0], rax
movabs rdx, 0x8e30c51ada297592
mov qword [rbp + 0x5d8], rdx
movabs rax, 0xe0afbb410f6a2b64
mov qword [rbp + 0x580], rdi
movabs rdx, 0xf2295750d3b99e67
mov qword [rbp + 0x588], rsi
mov qword [rbp + 0x590], r14
mov qword [rbp + 0x598], r15
vmovdqu ymm0, ymmword [rbp + 0x580]
mov qword [rbp + 0x10], rcx
movabs rcx, 0x8aa48c225eb19d49
mov qword [rbp + 0x5c0], r8
mov r8d, 0xa0
mov qword [rbp + 0x5e0], rdx
movabs rdx, 0x92cacd287d0e0b0b
mov qword [rbp], r12
mov qword [rbp + 8], r13
vpxor ymm1, ymm0, ymmword [rbp]
mov qword [rbp + 0x5a8], rax
movabs rax, 0x4c96833f35d8ff26
vmovdqa ymmword [rbp], ymm1
mov qword [rbp + 0x5c8], r9
mov qword [rbp + 0x5d0], r10
mov qword [rbp + 0x5e8], rdx
mov qword [rbp + 0x5f0], rcx
mov qword [rbp + 0x5f8], rax
mov qword [rbp + 0x580], rdi
mov qword [rbp + 0x588], rsi
mov qword [rbp + 0x590], r14
mov qword [rbp + 0x598], r15
vmovdqu ymm0, ymmword [rbp + 0x580]
vpxor ymm1, ymm0, ymmword [rbp + 0x5c0]
mov qword [rbp + 0x5b8], rax
mov qword [rbp + 0x5b0], rcx
vmovdqu ymm0, ymmword [rbp + 0x5a0]
vmovdqa ymmword [rbp + 0x5c0], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x5e0]
vmovdqa ymmword [rbp + 0x5e0], ymm1
lea rdx, [rbp]
lea rcx, [rbp + 0x5c0]
vzeroupper
call fcn.140008c00
int3
mov rdx, qword [rbp + 0x600]
lea r8, [rbp + 0x38]
mov rcx, qword [rbp + 0x20]
mov r9d, 4
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movabs rcx, 0x11da2ff0aae74424
movabs rdx, 0xae55b17bbf5b1688
movabs r8, 0x4d1c1687fe5f7320
movabs r9, 0x9df6db63ed145423
movabs r10, 0x1bc26bfaaec34124
movabs r11, 0xed21ff5bcb3e7192
test eax, eax
jne 0x14000e280
mov eax, dword [rbp + 0x38]
cmp eax, 0xc001f00d
je 0x14000e851
movabs rax, 0x8609323cb7d7ff0f
mov qword [rbp + 0x580], rdi
mov qword [rbp + 0x5a0], rax
movabs rax, 0xe0afbb410f6a2b64
mov qword [rbp + 0x5a8], rax
movabs rax, 0x8bf6db63ed145423
mov qword [rbp + 0x5c8], rax
movabs rax, 0x10962fffa4c35124
mov qword [rbp + 0x5d0], rax
movabs rax, 0xdc75c514d17b72db
mov qword [rbp + 0x5d8], rax
movabs rax, 0xe36a5149c4f7917a
mov qword [rbp + 0x5e0], rax
movabs rax, 0xe0d6d72d7a0c5817
mov qword [rbp + 0x5e8], rax
movdqa xmm2, xmmword [rbp + 0x5e0]
xorps xmm2, xmmword [rbp + 0x5a0]
mov qword [rbp + 0x588], rsi
mov qword [rbp + 0x590], r14
mov qword [rbp + 0x598], r15
vmovdqu ymm0, ymmword [rbp + 0x580]
mov qword [rbp + 0x5c0], r8
mov r8d, 0xb2
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
jmp 0x14000d8a3