Function at 0x140057590
Capabilities:
Access peb ldr_data
Check mutex on windows
Encode data using xor
Generate random numbers using a mersenne twister
Log keystrokes via polling
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x250
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400b8100]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor r15d, r15d
mov ebx, 4
mov rax, qword gs:[0x58]
add rbx, qword [rax]
lea r14, [0x1400bb000]
mov eax, dword [rbx]
cmp dword [0x1400bafe0], eax
jle 0x140057667
lea rcx, [0x1400bafe0]
call fcn.14005b41c
cmp dword [0x1400bafe0], 0xffffffff
jne 0x140057667
xor ecx, ecx
call fcn.14006d7a0
mov rdx, rax
mov dword [0x1400bc384], 0xffffffff
mov dword [0x1400bb004], eax
mov r8d, 1
nop dword [rax]
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, r8d
mov dword [r14 + r8*4 + 4], edx
inc r8
cmp r8, 0x270
jb 0x140057630
mov dword [0x1400bb000], 0x270
lea rcx, [0x1400bafe0]
call fcn.14005b3b0
mov eax, dword [rbx]
cmp dword [0x1400bc388], eax
jle 0x1400576a4
lea rcx, [0x1400bc388]
call fcn.14005b41c
cmp dword [0x1400bc388], 0xffffffff
jne 0x1400576a4
mov qword [0x1400bafd0], r15
mov qword [0x1400bafd8], 0x3d
lea rcx, [0x1400bc388]
call fcn.14005b3b0
mov rdi, r15
lea r13, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
lea r12, [0x1400bafe8]
nop word [rax + rax]
mov qword [rbp + 0xa0], r14
mov rsi, qword [0x1400bafd0]
mov rdx, qword [0x1400bafd8]
sub rdx, rsi
cmp rdx, 0xffffffffffffffff
jne 0x1400576fb
mov rcx, r14
call fcn.140059870
mov ebx, eax
shl rbx, 0x20
mov rcx, r14
call fcn.140059870
mov eax, eax
or rbx, rax
jmp 0x14005770d
inc rdx
lea rcx, [rbp + 0xa0]
call fcn.140059680
mov rbx, rax
lea rax, [rbx + rsi]
movzx eax, byte [rax + r13]
mov byte [rdi + r12], al
inc rdi
cmp rdi, 0xf
jb 0x1400576c0
mov byte [0x1400baff7], r15b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
movabs rax, 0xb42f359a504d1f8a
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x140], rax
movabs rax, 0x4a8010f30ad899e6
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x148], rax
movabs rax, 0xe81cf3e11789e8d2
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x150], rax
movabs r12, 0xefe9ec50d9ee1758
mov qword [rbp + 0xa0], r12
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x158], rax
movabs r13, 0xce7359fb322273cd
mov qword [rbp + 0xa0], r13
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x160], rax
movabs rax, 0x15e562927dabe08e
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x168], rax
movabs rax, 0xe81cf39972fd9dbf
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0xa0], r12
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x178], rax
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x140], ymm1
lea r8, [rbp + 0x140]
xor edx, edx
xor ecx, ecx
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x1400baed0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs rbx, 0xd4dc658617b700c6
movabs rdi, 0x9fb7d0df96a975e9
cmp eax, 0xb7
jne 0x140057c9d
movabs rax, 0x9fb7d0adf9db07ac
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 8], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x148], rax
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp], xmm0
movabs rax, 0xecdef0bae4cc1dbd
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x20], rax
movabs rax, 0xadb804e365db61e6
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x28], rax
movabs rax, 0x699d2d88efc3fafb
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x30], rax
movabs rax, 0x330ba7881fa9a929
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x38], rax
movabs rax, 0xb3da25b3cb3a2a59
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x40], rax
movabs rax, 0xad7675dfdbcd232b
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x48], rax
movabs rax, 0x9dd5571cec58de01
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x50], rax
movabs rax, 0x58304ecd23e7a223
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x58], rax
movabs rax, 0x7cfb9a392fb70f65
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x60], rax
movabs rax, 0xcfd3d1515fbad6e6
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x68], rax
movabs rax, 0x830d3d4afc340cc3
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x70], rax
movabs rax, 0x93fce9c416fdbca9
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x78], rax
movabs rax, 0xe2e2ee4ae638786c
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x80], rax
movabs r8, 0xf18600c2932f6312
mov qword [rbp + 0xa0], r8
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x88], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x160], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x168], rax
movabs r14, 0x1dee43e1cfad9bdb
mov qword [rbp + 0xa0], r14
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x170], rax
movabs rsi, 0x136dc8a87acac748
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x178], rax
movabs rcx, 0xd6b24693b853422d
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x180], rax
movabs rdx, 0xc4181baaa9ed574a
mov qword [rbp + 0xa0], rdx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x188], rax
movabs rax, 0xe4f53175cc74b96f
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x190], rax
movabs rax, 0x784420ac54c7d74c
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x198], rax
movabs rax, 0x8dbfe574a976011
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x1a0], rax
movabs rax, 0xe3b6bf3e7fceb78e
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x1a8], rax
movabs rax, 0xc52d4e3999467ce3
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x1b0], rax
movabs rax, 0xe188c9a0789c9c90
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x1b8], rax
movabs rax, 0xe28c872b81595815
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0xa0], r8
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x1c8], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x180]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqa xmm2, xmmword [rbp + 0x80]
vxorps xmm2, xmm2, xmmword [rbp + 0x1c0]
vmovdqa xmmword [rbp + 0x80], xmm2
xor r9d, r9d
lea rdx, [rbp + 0x20]
lea r8, [rbp]
xor ecx, ecx
vzeroupper
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.14005b390
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movabs rax, 0x9febd0f196f575b5
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x160], rax
movabs rax, 0xd4b265f417d2008d
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x168], rax
movabs rax, 0x1d9c43a5cfc19bbe
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x170], rax
movabs rax, 0x131fc8cd7abcc721
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x178], rax
movabs rcx, 0xd6b24693b853422d
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x180], rax
movabs rdx, 0xc4181baaa9ed574a
mov qword [rbp + 0xa0], rdx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x188], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x108], rax
movabs r14, 0x1dee43e1cfad9bdb
mov qword [rbp + 0xa0], r14
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x110], rax
movabs rsi, 0x136dc8a87acac748
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x118], rax
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0xa0], rdx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x128], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x160], ymm1
vmovdqa xmm0, xmmword [rbp + 0x180]
vxorps xmm0, xmm0, xmmword [rbp + 0x120]
vmovdqa xmmword [rbp + 0x180], xmm0
lea rcx, [rbp + 0x160]
vzeroupper
call fcn.140058f80
test al, al
je 0x140057c68
movabs rax, 0x9f99d0ed96da758a
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp], rax
movabs rax, 0xd4dc65e317cf00a3
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 8], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x148], rax
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp], xmm0
lea rcx, [rbp]
call fcn.140058d80
mov dword [0x1400baed8], eax
movabs rcx, 0xee143792464b12ba
movabs rdx, 0x3bd711f15dd98fe8
test eax, eax
jne 0x140058137
movabs r8, 0xe81cf3997898e5da
nop dword [rax + rax]
cmp byte [0x1400baeb2], r15b
jne 0x140057fde
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x160], rax
mov qword [rbp + 0xa0], rdx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x168], rax
mov qword [rbp + 0xa0], r8
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0xa0], r12
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x178], rax
mov qword [rbp + 0xa0], r13
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x100], rax
movabs rax, 0x15e562927dabe08e
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x108], rax
movabs rax, 0xe81cf39972fd9dbf
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0xa0], r12
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm0, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x160], ymm0
lea rdx, [rbp + 0x160]
lea rcx, [0x1400b9570]
vzeroupper
call fcn.14004fa40
mov byte [0x1400baeb2], 1
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140058808
movabs rax, 0xce5d59c9325173ae
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp], rax
movabs rax, 0x15e562f77dd3e0eb
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 8], rax
mov qword [rbp + 0xa0], r13
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x140], rax
movabs rax, 0x15e562927dabe08e
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x148], rax
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp], xmm0
lea rcx, [rbp]
call fcn.140058d80
mov dword [0x1400baed8], eax
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x1400baed8], r15d
movabs rcx, 0xee143792464b12ba
movabs rdx, 0x3bd711f15dd98fe8
movabs r8, 0xe81cf3997898e5da
je 0x140057ee0
movabs rax, 0xecd4f0bbf8dc1a8f
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp], rax
movabs rax, 0xd4dc6fe36fd22ef4
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 8], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x148], rax
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp], xmm0
lea rdx, [rbp]
lea rcx, [0x1400b9570]
call fcn.14004fa40
movabs rax, 0x9fd2d0b696c5758a
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x160], rax
movabs rax, 0xd4b865a817c300a8
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x168], rax
movabs rax, 0x1dee43e1cfc19bb7
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x178], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x108], rax
mov qword [rbp + 0xa0], r14
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqu ymmword [rbp + 0x160], ymm1
lea rdx, [rbp + 0x160]
mov ecx, dword [0x1400baed8]
vzeroupper
call fcn.140058e80
mov qword [0x1400baef0], rax
test rax, rax
jne 0x14005864e
movabs rdx, 0x843c9ced5298e5da
movabs rcx, 0xd30c726bf675ab2
movabs r8, 0x8a808033f98a7637
movabs r9, 0x5ec890234b612c6f
movabs r10, 0x5ec2fc4f2f4f5801
nop dword [rax]
cmp byte [0x1400baeb1], r15b
jne 0x1400583ee
movabs rax, 0xee143792464b12ba
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x160], rax
movabs rax, 0x3bd711f15dd98fe8
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x168], rax
mov qword [rbp + 0xa0], rdx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0xa0], r8
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x178], rax
mov qword [rbp + 0xa0], r9
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x180], rax
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x188], rax
mov qword [rbp + 0xa0], r13
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x100], rax
movabs rax, 0x15e562927dabe08e
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x108], rax
movabs rax, 0xe81cf39972fd9dbf
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0xa0], r12
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x118], rax
mov qword [rbp + 0xa0], r10
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x128], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x160], ymm1
vmovdqa xmm2, xmmword [rbp + 0x180]
vxorps xmm2, xmm2, xmmword [rbp + 0x120]
vmovdqa xmmword [rbp + 0x180], xmm2
lea rdx, [rbp + 0x160]
lea rcx, [0x1400b9570]
vzeroupper
call fcn.14004fa40
mov byte [0x1400baeb1], 1
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140058808
movabs rax, 0xce165992324e73ae
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x160], rax
movabs rax, 0x158162bc7ddfe0e0
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x168], rax
movabs rax, 0xe81cf39972919dd3
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0xa0], r12
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x178], rax
mov qword [rbp + 0xa0], r13
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x100], rax
movabs rax, 0x15e562927dabe08e
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x108], rax
movabs rax, 0xe81cf39972fd9dbf
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0xa0], r12
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqu ymmword [rbp + 0x160], ymm1
lea rdx, [rbp + 0x160]
mov ecx, dword [0x1400baed8]
vzeroupper
call fcn.140058e80
mov qword [0x1400baef0], rax
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x1400baef0], r15
movabs rcx, 0xd30c726bf675ab2
movabs rdx, 0x843c9ced5298e5da
movabs r8, 0x8a808033f98a7637
movabs r9, 0x5ec890234b612c6f
movabs r10, 0x5ec2fc4f2f4f5801
je 0x140058270
movabs rax, 0xf3d4f0bbf8dc1a8f
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x160], rax
movabs rax, 0xb8b001a863d965af
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x168], rax
movabs rax, 0x1dee43e1cfad9bd1
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x178], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x108], rax
mov qword [rbp + 0xa0], r14
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x160], ymm1
lea rdx, [rbp + 0x160]
lea rcx, [0x1400b9570]
vzeroupper
call fcn.14004fa40
mov eax, dword [0x1400baed8]
mov qword [rbp + 0x100], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x28
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
lea r8, [rbp + 0x100]
mov edx, 0x221a58
mov rcx, qword [0x1400baee8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140058911
call fcn.1400595f0
movabs rax, 0x9fb7d0adf9db078c
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 8], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x148], rax
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp], xmm0
movabs rax, 0xeb97b4bafac0148f
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x160], rax
movabs rax, 0xbcbf04f263d620a9
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x168], rax
movabs rax, 0x7e813191efc2effb
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x170], rax
movabs rax, 0x136dc8a87ab9b42d
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x178], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x108], rax
mov qword [rbp + 0xa0], r14
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x160], ymm1
mov r9d, 0x40000
lea rdx, [rbp + 0x160]
jmp 0x140057c59
movabs rax, 0xf6c0a3fffac51c82
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x160], rax
movabs rax, 0xa7b917f637df63b2
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x168], rax
movabs rax, 0x1dee43e1c5c9fea8
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x178], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x108], rax
mov qword [rbp + 0xa0], r14
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x160], ymm1
lea rdx, [rbp + 0x160]
lea rcx, [0x1400b9570]
vzeroupper
call fcn.14004fa40
call fcn.1400595f0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140057c68
mov ecx, 8
call fcn.14005b9a8
lea rcx, [0x140010340]
mov qword [rax], rcx
mov qword [rbp + 0xa0], rax
lea rcx, [rbp + 0xe8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x140058d50]
xor edx, edx
xor ecx, ecx
call fcn.14006d4c8
mov qword [rbp + 0xe0], rax
test rax, rax
je 0x140058cb5
mov qword [rbp + 0xa0], r15
mov ecx, 8
call fcn.14005b9a8
lea rcx, [0x14000f970]
mov qword [rax], rcx
mov qword [rbp + 0xa0], rax
lea rcx, [rbp + 0xd8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x140058d50]
xor edx, edx
xor ecx, ecx
call fcn.14006d4c8
mov qword [rbp + 0xd0], rax
test rax, rax
je 0x140058ca3
mov qword [rbp + 0xa0], r15
mov ecx, 8
call fcn.14005b9a8
lea rcx, [0x14004b2b0]
mov qword [rax], rcx
mov qword [rbp + 0xa0], rax
lea rcx, [rbp + 0xc8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x140058d50]
xor edx, edx
xor ecx, ecx
call fcn.14006d4c8
mov qword [rbp + 0xc0], rax
test rax, rax
je 0x140058d12
mov qword [rbp + 0xa0], r15
mov ecx, 8
call fcn.14005b9a8
lea rcx, [0x14004a6c0]
mov qword [rax], rcx
mov qword [rbp + 0xa0], rax
lea rcx, [rbp + 0xb8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x140058d50]
xor edx, edx
xor ecx, ecx
call fcn.14006d4c8
mov qword [rbp + 0xb0], rax
test rax, rax
je 0x140058d00
mov qword [rbp + 0xa0], r15
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140058b25
movabs rsi, 0x9f99d0ed96da758a
movabs r14, 0xd4dc65e317cf00a3
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp], rax
mov qword [rbp + 0xa0], r14
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 8], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x148], rax
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp], xmm0
lea rcx, [rbp]
call fcn.140058d80
test eax, eax
je 0x140058b25
cmp byte [0x1400baeb4], 0
jne 0x140058b25
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140058a91
mov byte [0x1400baeb7], 1
mov byte [0x1400baeb6], 1
mov byte [0x1400baeb5], 1
mov byte [0x1400b8d60], 0
cmp dword [rbp + 0xe8], 0
je 0x140058cf5
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp + 0xe8], eax
je 0x140058cea
movaps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rbp + 0x140], xmm0
xor edx, edx
lea rcx, [rbp + 0x140]
call fcn.14005ac6c
test eax, eax
jne 0x140058cdf
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xe0], xmm0
cmp dword [rbp + 0xd8], eax
je 0x140058cf5
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp + 0xd8], eax
je 0x140058cea
movaps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0x140], xmm0
xor edx, edx
lea rcx, [rbp + 0x140]
call fcn.14005ac6c
test eax, eax
jne 0x140058cdf
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xd0], xmm0
cmp dword [rbp + 0xc8], eax
je 0x140058cf5
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp + 0xc8], eax
je 0x140058cea
movaps xmm0, xmmword [rbp + 0xc0]
movdqa xmmword [rbp + 0x140], xmm0
xor edx, edx
lea rcx, [rbp + 0x140]
call fcn.14005ac6c
test eax, eax
jne 0x140058cdf
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xc0], xmm0
cmp dword [rbp + 0xb8], eax
je 0x140058cf5
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp + 0xb8], eax
je 0x140058cea
movaps xmm0, xmmword [rbp + 0xb0]
movdqa xmmword [rbp + 0x140], xmm0
xor edx, edx
lea rcx, [rbp + 0x140]
call fcn.14005ac6c
test eax, eax
jne 0x140058cdf
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xb0], xmm0
call fcn.1400595f0
nop
cmp dword [rbp + 0xb8], 0
jne 0x140058cc7
cmp dword [rbp + 0xc8], 0
jne 0x140058ccd
cmp dword [rbp + 0xd8], 0
jne 0x140058cd3
cmp dword [rbp + 0xe8], 0
jne 0x140058cd9
xor eax, eax
jmp 0x140057c6d
mov dword [rbp + 0xd8], r15d
mov ecx, 6
call fcn.14005ab28
nop
mov dword [rbp + 0xe8], r15d
mov ecx, 6
call fcn.14005ab28
nop
call fcn.14006d5b4
nop
call fcn.14006d5b4
nop
call fcn.14006d5b4
nop
call fcn.14006d5b4
nop
mov ecx, 2
call fcn.14005ab28
int3
mov ecx, 5
call fcn.14005ab28
int3
mov ecx, 1
call fcn.14005ab28
nop
mov dword [rbp + 0xb8], r15d
mov ecx, 6
call fcn.14005ab28
nop
mov dword [rbp + 0xc8], r15d
mov ecx, 6
call fcn.14005ab28
int3