Function at 0x1400b5c10
Capabilities:
Contain obfuscated stackstrings
Create http request
Create thread
Encode data using xor
Read data from internet
Receive data
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
lea rbp, [rsp - 0x1170]
mov eax, 0x1270
call fcn.1400c8750
sub rsp, rax
mov rax, qword [0x140170028]
xor rax, rsp
mov qword [rbp + 0x1160], rax
xor r13d, r13d
mov rdi, r8
mov qword [rsp + 0x28], r13
lea r8, [0x1400b5070]
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rbx, rax
call fcn.1400b52a0
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__difftime64]
comisd xmm0, xmmword [0x140157048]
jbe 0x1400b5cda
lea rdx, [rbp - 0x10]
call fcn.1400b6a90
mov rcx, rax
call fcn.1400066f0
lea rdx, [rbp - 0x70]
mov rbx, rax
call fcn.1400b69e0
mov rcx, rax
call fcn.1400066f0
mov rdx, rax
xor r9d, r9d
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rbp - 0x70]
call fcn.140006700
lea rcx, [rbp - 0x10]
call fcn.140006700
lea rcx, [r13 - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
mov qword [rsp + 0x12a8], r14
xorps xmm1, xmm1
mov qword [rsp + 0x12b8], r15
mov rsi, 0xffffffffffffffff
movups xmmword [rbp + 0x118], xmm0
mov r8, rsi
movdqu xmmword [rbp + 0x128], xmm1
nop dword [rax]
inc r8
cmp byte [rdi + r8], r13b
jne 0x1400b5d10
mov rdx, rdi
lea rcx, [rbp + 0x118]
call fcn.140003c30
lea rdx, [rbp + 0xf8]
lea rcx, [0x1401747c8]
call fcn.140003930
cmp qword [rbp + 0x110], 0x10
lea rcx, [rbp + 0xf8]
mov dword [rsp + 0x20], r13d
cmovae rcx, qword [rbp + 0xf8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WININET.dll_InternetOpenA]
lea rcx, [rbp + 0xf8]
mov r15, rax
call fcn.140006940
test r15, r15
jne 0x1400b5f33
movdqa xmm1, xmmword [0x1401571f0]
lea rbx, [0x1401746f0]
mov rdi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea r14, [0x140174711]
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
mov byte [rbp + 0x138], r13b
movdqu xmmword [rbp + 0x148], xmm1
nop dword [rax]
nop word [rax + rax]
movzx r9d, byte [rbx]
mov rcx, qword [rbp + 0x148]
xor r9b, 0x44
mov rdx, qword [rbp + 0x150]
cmp rcx, rdx
jae 0x1400b5e04
lea rax, [rcx + 1]
cmp rdx, 0x10
mov qword [rbp + 0x148], rax
lea rax, [rbp + 0x138]
cmovae rax, qword [rbp + 0x138]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r13b
jmp 0x1400b5e10
lea rcx, [rbp + 0x138]
call fcn.140006e50
inc rbx
cmp rbx, r14
jne 0x1400b5dc0
cmp qword [rbp + 0x150], 0x10
lea rdx, [rbp + 0x138]
mov r8, qword [rbp + 0x148]
mov rcx, rdi
cmovae rdx, qword [rbp + 0x138]
call fcn.14000dca0
lea rcx, [rbp + 0x138]
call fcn.140006940
lea rdx, [rsp + 0x50]
lea rcx, [0x140174724]
call fcn.1400037d0
cmp qword [rsp + 0x68], 0x10
lea rdi, [rsp + 0x50]
movdqa xmm1, xmmword [0x1401571f0]
lea rbx, str._a_0_d
cmovae rdi, qword [rsp + 0x50]
lea r14, [0x140174781]
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
mov byte [rbp + 0x138], r13b
movdqu xmmword [rbp + 0x148], xmm1
nop dword [rax + rax]
movzx r9d, byte [rbx]
mov rcx, qword [rbp + 0x148]
xor r9b, 0x44
mov rdx, qword [rbp + 0x150]
cmp rcx, rdx
jae 0x1400b5ee4
lea rax, [rcx + 1]
cmp rdx, 0x10
mov qword [rbp + 0x148], rax
lea rax, [rbp + 0x138]
cmovae rax, qword [rbp + 0x138]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r13b
jmp 0x1400b5ef0
lea rcx, [rbp + 0x138]
call fcn.140006e50
inc rbx
cmp rbx, r14
jne 0x1400b5ea0
cmp qword [rbp + 0x150], 0x10
lea rdx, [rbp + 0x138]
mov r8, rdi
cmovae rdx, qword [rbp + 0x138]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rbp + 0x138]
call fcn.140006940
lea rcx, [rsp + 0x50]
call fcn.140006940
lea rcx, [rbp - 0x70]
call fcn.1400c5500
movdqa xmm1, xmmword [0x1401571f0]
lea rbx, str.___8_rgg_8_f___f__.g_____f8_8w__:___uH
xorps xmm0, xmm0
lea r14, [0x140174815]
movups xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x30], r13b
mov rdi, rax
movdqu xmmword [rsp + 0x40], xmm1
nop dword [rax + rax]
movzx r9d, byte [rbx]
mov rcx, qword [rsp + 0x40]
xor r9b, 0x48
mov rdx, qword [rsp + 0x48]
cmp rcx, rdx
jae 0x1400b5faa
lea rax, [rcx + 1]
cmp rdx, 0x10
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
cmovae rax, qword [rsp + 0x30]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r13b
jmp 0x1400b5fb4
lea rcx, [rsp + 0x30]
call fcn.140006e50
inc rbx
cmp rbx, r14
jne 0x1400b5f70
mov r9, rdi
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000d6a0
cmp qword [rsp + 0x68], 0x10
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x28], r13
mov rcx, r15
cmovae rdx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x400100
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea rcx, [rsp + 0x50]
mov r14, rax
call fcn.140006940
lea rcx, [rsp + 0x30]
call fcn.140006940
lea rcx, [rbp - 0x70]
call fcn.140006940
test r14, r14
jne 0x1400b61bb
mov qword [rsp + 0x12a0], r12
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm1, xmmword [0x1401571f0]
lea rdi, [0x1401746b0]
mov r12, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
mov byte [rbp + 0x138], r13b
mov ebx, eax
movdqu xmmword [rbp + 0x148], xmm1
nop dword [rax]
nop word [rax + rax]
movzx r9d, byte [rdi]
mov rcx, qword [rbp + 0x148]
xor r9b, 0x79
mov rdx, qword [rbp + 0x150]
cmp rcx, rdx
jae 0x1400b60b4
lea rax, [rcx + 1]
cmp rdx, 0x10
mov qword [rbp + 0x148], rax
lea rax, [rbp + 0x138]
cmovae rax, qword [rbp + 0x138]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r13b
jmp 0x1400b60c0
lea rcx, [rbp + 0x138]
call fcn.140006e50
inc rdi
lea rax, [0x1401746ce]
cmp rdi, rax
jne 0x1400b6070
cmp qword [rbp + 0x150], 0x10
lea rdx, [rbp + 0x138]
mov r8, qword [rbp + 0x148]
mov rcx, r12
cmovae rdx, qword [rbp + 0x138]
call fcn.14000dca0
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rcx, [rbp + 0x138]
call fcn.140006940
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [rbp - 0x50]
lea rcx, [0x140174754]
call fcn.1400037d0
cmp qword [rbp - 0x38], 0x10
lea rdi, [rbp - 0x50]
mov r12, qword [rsp + 0x12a0]
lea r9, [rbp + 0x14d]
cmovae rdi, qword [rbp - 0x50]
nop dword [rax]
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov ebx, edx
test edx, edx
jne 0x1400b6150
lea r8, [rbp + 0x14d]
mov rdx, r9
lea rcx, [rsp + 0x70]
call fcn.14000db70
cmp qword [rbp - 0x78], 0x10
lea rdx, [rsp + 0x70]
mov r8, rdi
cmovae rdx, qword [rsp + 0x70]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rsp + 0x70]
call fcn.140006940
lea rcx, [rbp - 0x50]
call fcn.140006940
xorps xmm0, xmm0
mov dword [rbp + 0xb0], r13d
xor r8d, r8d
mov qword [rbp + 0xe8], r13
lea rdx, [0x1400f32b0]
mov qword [rbp + 0xf0], r13
lea rcx, [rbp + 0xd8]
movups xmmword [rbp + 0xd8], xmm0
call fcn.140003c30
lea r9, [rbp + 0xb0]
mov r8d, 0x1000
lea rdx, [rbp + 0x160]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400b6261
cmp dword [rbp + 0xb0], r13d
je 0x1400b6261
lea rax, [rbp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], r13b
jne 0x1400b6224
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0xd8]
call fcn.14000c7f0
lea r9, [rbp + 0xb0]
mov r8d, 0x1000
lea rdx, [rbp + 0x160]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400b6211
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, 0x20
mov qword [rbp + 0x100], r13
call fcn.1400c7798
movaps xmm0, xmmword [rbp + 0x160]
lea rdx, [rbp + 0xd8]
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x108], 0x14
movups xmmword [rax], xmm0
mov ecx, dword [rbp + 0x170]
mov dword [rax + 0x10], ecx
lea rcx, [rbp + 0xb8]
mov qword [rbp + 0x110], 0x1f
mov byte [rax + 0x14], r13b
mov dword [rbp + 0x138], 0x63616c62
mov dword [rbp + 0x13c], 0x74756f6b
mov dword [rbp + 0x140], 0x77746f64
mov word [rbp + 0x144], 0x6674
call fcn.1400067a0
mov r15, qword [rsp + 0x12b8]
mov r10d, r13d
cmp qword [rbp + 0xe8], r10
jbe 0x1400b6390
mov r9, r13
mov rcx, r13
movabs r11, 0x2492492492492493
nop word [rax + rax]
cmp qword [rbp + 0xf0], 0x10
lea r8, [rbp + 0xd8]
mov rax, r11
lea r9, [r9 + 1]
cmovae r8, qword [rbp + 0xd8]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 3
imul rax, rax, 0xe
sub rcx, rax
lea rax, [rbp + 0xb8]
movzx ecx, byte [rbp + rcx + 0x138]
xor cl, byte [r8 + r9 - 1]
cmp qword [rbp + 0xd0], 0x10
cmovae rax, qword [rbp + 0xb8]
inc r10d
mov byte [rax + r9 - 1], cl
movsxd rcx, r10d
cmp rcx, qword [rbp + 0xe8]
jb 0x1400b6320
mov r9, qword [rbp + 0xd0]
lea rdx, [rbp + 0xb8]
mov r8, qword [rbp + 0xb8]
cmp r9, 0x10
mov rdi, qword [rbp + 0xc8]
cmovae rdx, r8
test rdi, rdi
je 0x1400b63e2
lea rax, [rdi - 1]
mov rcx, rsi
cmp rax, rsi
cmovb rcx, rax
add rcx, rdx
cmp byte [rcx], 0x23
jne 0x1400b63dd
nop
cmp rcx, rdx
je 0x1400b63e2
dec rcx
cmp byte [rcx], 0x23
je 0x1400b63d0
sub rcx, rdx
jmp 0x1400b63e5
mov rcx, rsi
lea rdx, [rcx + 1]
cmp rdi, rdx
jb 0x1400b69da
mov rax, rdi
lea rcx, [rbp + 0xb8]
sub rax, rdx
cmp rax, rsi
cmovb rsi, rax
cmp r9, 0x10
cmovae rcx, r8
sub rdi, rsi
add rcx, rdx
mov r8, rdi
sub r8, rdx
inc r8
lea rdx, [rcx + rsi]
call fcn.1400c8588
lea rcx, [rbp - 0x30]
mov qword [rbp + 0xc8], rdi
call fcn.1400c5500
lea rcx, [rbp - 0x30]
mov rbx, qword [rax + 0x10]
call fcn.140006940
cmp rbx, rdi
jae 0x1400b64fe
nop dword [rax]
mov r8, qword [rbp + 0xd0]
lea r10, [rbp + 0xb8]
mov r9, qword [rbp + 0xb8]
lea rcx, [rbp + 0xb8]
mov rdi, qword [rbp + 0xc8]
lea rax, [rbp + 0xb8]
cmp r8, 0x10
cmovae r10, r9
add r10, rdi
cmp r8, 0x10
cmovae rcx, r9
dec rcx
add rcx, rdi
cmp r8, 0x10
mov rdx, rcx
cmovae rax, r9
sub r10, rcx
sub rdx, rax
lea rcx, [rbp + 0xb8]
mov rax, rdi
sub rax, rdx
cmp rax, r10
cmovb r10, rax
cmp r8, 0x10
cmovae rcx, r9
sub rdi, r10
add rcx, rdx
mov r8, rdi
sub r8, rdx
inc r8
lea rdx, [rcx + r10]
call fcn.1400c8588
lea rcx, [rbp - 0x30]
mov qword [rbp + 0xc8], rdi
call fcn.1400c5500
lea rcx, [rbp - 0x30]
mov rbx, qword [rax + 0x10]
call fcn.140006940
cmp rbx, rdi
jb 0x1400b6450
lea rcx, [rbp - 0x70]
call fcn.1400c5500
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400b6514
mov rdx, qword [rax]
cmp qword [rbp + 0xd0], 0x10
lea rcx, [rbp + 0xb8]
cmovae rcx, qword [rbp + 0xb8]
sub rdx, rcx
nop
movzx eax, byte [rcx]
cmp al, byte [rcx + rdx]
jne 0x1400b6544
inc rcx
test al, al
jne 0x1400b6530
mov ebx, r13d
jmp 0x1400b6549
sbb ebx, ebx
or ebx, 1
lea rcx, [rbp - 0x70]
call fcn.140006940
test ebx, ebx
je 0x1400b695d
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1400b6578
imul rax, rax, 0x64
jmp 0x1400b6596
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffff88ca6bfe
cmp rax, rcx
jg 0x1400b65ad
add rax, 0x77359400
jmp 0x1400b65b7
movabs rax, 0x7fffffffffffffff
lea rcx, [rbp + 0x138]
mov qword [rbp + 0x138], rax
call fcn.1400070a0
lea rcx, [rbp - 0x70]
call fcn.1400c5500
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400b65e0
mov rdx, qword [rax]
cmp qword [rbp + 0xd0], 0x10
lea rcx, [rbp + 0xb8]
cmovae rcx, qword [rbp + 0xb8]
sub rdx, rcx
nop word [rax + rax]
movzx eax, byte [rcx]
cmp al, byte [rcx + rdx]
jne 0x1400b6614
inc rcx
test al, al
jne 0x1400b6600
mov ebx, r13d
jmp 0x1400b6619
sbb ebx, ebx
or ebx, 1
lea rcx, [rbp - 0x70]
call fcn.140006940
test ebx, ebx
je 0x1400b695d
lea rdx, [rbp - 0x30]
lea rcx, [0x1401747d4]
call fcn.1400037d0
cmp qword [rbp - 0x18], 0x10
lea rdi, [rbp - 0x30]
mov r8, qword [rbp + 0xc8]
lea r9, [rbp + 0x14d]
cmovae rdi, qword [rbp - 0x30]
movabs rsi, 0xcccccccccccccccd
dec r9
mov rax, rsi
mul r8
shr rdx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8, rdx
test rdx, rdx
jne 0x1400b6660
lea r8, [rbp + 0x14d]
mov rdx, r9
lea rcx, [rbp - 0x70]
call fcn.14000db70
lea rcx, [rbp + 0x90]
lea rbx, [rbp + 0x14d]
call fcn.1400c5500
mov r8, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
dec rbx
mov rax, rsi
mul r8
shr rdx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [rbx], r8b
mov r8, rdx
test rdx, rdx
jne 0x1400b66c0
lea r8, [rbp + 0x14d]
mov rdx, rbx
lea rcx, [rbp - 0x10]
call fcn.14000db70
lea rcx, [rbp + 0x70]
call fcn.1400c5500
movdqa xmm1, xmmword [0x1401571f0]
lea rbx, [0x1401747a0]
xorps xmm0, xmm0
lea r14, [0x1401747c4]
movups xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x30], r13b
mov rsi, rax
movdqu xmmword [rsp + 0x40], xmm1
movzx r9d, byte [rbx]
mov rcx, qword [rsp + 0x40]
xor r9b, 0x43
mov rdx, qword [rsp + 0x48]
cmp rcx, rdx
jae 0x1400b676c
lea rax, [rcx + 1]
cmp rdx, 0x10
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
cmovae rax, qword [rsp + 0x30]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], r13b
jmp 0x1400b6776
lea rcx, [rsp + 0x30]
call fcn.140006e50
inc rbx
cmp rbx, r14
jne 0x1400b6732
mov r9, rsi
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x50]
call fcn.14000d6a0
mov r8d, 1
lea rdx, [0x14014ffc4]
lea rcx, [rbp + 0x50]
call fcn.14000c7f0
lea r9, [rbp - 0x10]
lea r8, [rbp + 0x10]
lea rcx, [rbp + 0x30]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], r13b
call fcn.14000d6a0
mov r8d, 1
lea rdx, [0x14014ffc4]
lea rcx, [rbp + 0x30]
call fcn.14000c7f0
xorps xmm0, xmm0
lea rdx, [rbp + 0xb8]
movups xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], r13b
cmp qword [rbp + 0xd0], 0x10
mov r8, qword [rbp + 0xc8]
cmovae rdx, qword [rbp + 0xb8]
call fcn.14000c7f0
xorps xmm0, xmm0
lea rdx, [0x14014ffc4]
movups xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
mov r8d, 1
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], r13b
call fcn.14000c7f0
lea r9, [rbp - 0x70]
lea r8, [rbp + 0x138]
lea rcx, [rbp - 0x50]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x138], xmm0
movups xmmword [rbp + 0x148], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], r13b
call fcn.14000d6a0
cmp qword [rbp - 0x38], 0x10
lea rdx, [rbp - 0x50]
mov r8, rdi
cmovae rdx, qword [rbp - 0x50]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rbp - 0x50]
call fcn.140006940
lea rcx, [rbp + 0x138]
call fcn.140006940
lea rcx, [rsp + 0x70]
call fcn.140006940
lea rcx, [rsp + 0x50]
call fcn.140006940
lea rcx, [rbp + 0x30]
call fcn.140006940
lea rcx, [rbp + 0x10]
call fcn.140006940
lea rcx, [rbp + 0x50]
call fcn.140006940
lea rcx, [rsp + 0x30]
call fcn.140006940
lea rcx, [rbp + 0x70]
call fcn.140006940
lea rcx, [rbp - 0x10]
call fcn.140006940
lea rcx, [rbp + 0x90]
call fcn.140006940
lea rcx, [rbp - 0x70]
call fcn.140006940
lea rcx, [rbp - 0x30]
call fcn.140006940
jmp 0x1400b6983
call fcn.1400bb620
xor r9d, r9d
mov qword [rsp + 0x28], r13
lea r8, [fcn.1400161f0]
mov dword [rsp + 0x20], r13d
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rbp + 0xb8]
call fcn.140006940
lea rcx, [rbp + 0xf8]
call fcn.140006940
lea rcx, [rbp + 0xd8]
call fcn.140006940
lea rcx, [rbp + 0x118]
call fcn.140006940
mov r14, qword [rsp + 0x12a8]
xor eax, eax
mov rcx, qword [rbp + 0x1160]
xor rcx, rsp
call fcn.1400c74e0
add rsp, 0x1270
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14000ca50
int3