Function at 0x1400108c0
Capabilities:
Parse pe header
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x14005b080]
xor rax, rsp
mov qword [rbp + 0xf0], rax
xor r13d, r13d
lea rdx, [0x14004a905]
xor ecx, ecx
call fcn.140024e48
movabs r14, 0x21aa586b256200cd
mov qword [rbp - 0x10], r14
movabs rsi, 0xce8ce92e7ace3736
mov qword [rbp - 8], rsi
movabs rbx, 0x7472dbb1903a238f
mov qword [rbp], rbx
movabs r12, 0x25f5730c0c424d38
mov qword [rbp + 8], r12
movabs rax, 0x1585392709a52cd1
mov qword [rbp + 0x10], rax
movabs rcx, 0xf701df7a772c6d0a
mov qword [rbp + 0x18], rcx
movabs rax, 0x55c33622053f2b96
mov qword [rbp + 0x20], rax
movabs rax, 0xa9e2805413a2565f
mov qword [rbp + 0x28], rax
movabs rax, 0x1d06bac3f54a4caf
mov qword [rbp + 0x30], rax
movabs rax, 0x47991f6d6f622357
mov qword [rbp + 0x38], rax
movabs rax, 0x158f170927ce4fb0
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rcx
movups xmm0, xmmword [rbp + 0x20]
movups xmm1, xmmword [rbp + 0x30]
movups xmm2, xmmword [rbp + 0x40]
xorps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp + 0x20], xmm0
xorps xmm1, xmmword [rbp]
movdqa xmmword [rbp + 0x30], xmm1
xorps xmm2, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x40], xmm2
lea rcx, [rbp + 0x20]
call fcn.140001280
lea rax, [rbp - 0x30]
mov qword [rbp + 0x50], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r12
movabs rax, 0x46c41d0241257483
mov qword [rbp - 0x30], rax
movabs rax, 0xafdc8c5a1bab4575
mov qword [rbp - 0x28], rax
movabs rax, 0x7472dbd4e44e46e3
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], r12
movups xmm1, xmmword [rbp - 0x30]
movups xmm2, xmmword [rbp - 0x20]
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmm1
movdqa xmmword [rbp + 0x20], xmm0
xorps xmm2, xmmword [rsp + 0x40]
movdqa xmmword [rbp + 0x30], xmm2
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r13
lea rax, [rbp + 0x20]
mov r15, 0xffffffffffffffff
mov r8, r15
nop
inc r8
cmp byte [rax + r8], r13b
jne 0x140010a60
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x30]
call fcn.14000ba80
nop
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rsi
movabs rax, 0x21aa2d59160c69ba
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rsi
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rsp + 0x30], xmm0
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r13
mov qword [rbp + 8], r13
lea rax, [rsp + 0x30]
mov r8, r15
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140010ac0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x10]
call fcn.14000ba80
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x10]
call fcn.1400012d0
mov rdi, rax
test rax, rax
jne 0x140010bc1
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r12
movabs rax, 0x1585392709a52cd1
mov qword [rsp + 0x50], rax
movabs rcx, 0xf701df7a772c6d0a
mov qword [rsp + 0x58], rcx
movabs rax, 0x4dc3392d053f2b96
mov qword [rbp + 0x20], rax
movabs rax, 0xa0e5c9410eee5353
mov qword [rbp + 0x28], rax
movabs rax, 0x1500bec1ff1a57e6
mov qword [rbp + 0x30], rax
movabs rax, 0x4994102c622d244c
mov qword [rbp + 0x38], rax
movabs rax, 0x1585394c6ac44ebd
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rcx
movups xmm1, xmmword [rbp + 0x20]
movups xmm2, xmmword [rbp + 0x30]
movups xmm3, xmmword [rbp + 0x40]
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmm1
movdqa xmmword [rbp + 0x20], xmm0
xorps xmm2, xmmword [rsp + 0x40]
movdqa xmmword [rbp + 0x30], xmm2
xorps xmm3, xmmword [rsp + 0x50]
movdqa xmmword [rbp + 0x40], xmm3
lea rcx, [rbp + 0x20]
call fcn.140001280
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], rsi
movabs rax, 0x42c92d38053f2b96
mov qword [rsp + 0x30], rax
movabs rax, 0xce8ce3245bbd4453
mov qword [rsp + 0x38], rax
movdqa xmm0, xmmword [rbp + 0x50]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x50], xmm0
lea rcx, [rbp + 0x50]
call fcn.140001280
xor eax, eax
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rax
mov word [rsp + 0x30], 0x20c
mov dword [rsp + 0x34], 0xbeed0fea
lea rdx, [0x140001690]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov rbx, rax
test rax, rax
je 0x140010d15
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 1
mov r9d, 0xbeed0fea
lea r8, [rsp + 0x30]
mov edx, 0x128
mov ecx, 4
call rdi
test eax, eax
jne 0x140010fda
movabs rax, 0x51be2bb392a1848d
mov qword [rbp - 0x30], rax
movabs rax, 0x9e7915e6908c1ec6
mov qword [rbp - 0x28], rax
movabs rax, 0x445f0869c2d2f93f
mov qword [rbp - 0x20], rax
movabs rax, 0xf5e19fc41b84c7f8
mov qword [rbp - 0x18], rax
movabs rax, 0x25cd4ee7b2fcafd6
mov qword [rbp - 0x10], rax
movabs rax, 0xf70d7494f5fc71e6
mov qword [rbp - 8], rax
movabs rax, 0x21336108a4f29750
mov qword [rbp], rax
movabs rax, 0xf5e19fc41b8ee99c
mov qword [rbp + 8], rax
movups xmm1, xmmword [rbp - 0x10]
movups xmm2, xmmword [rbp]
movdqa xmm0, xmmword [rbp - 0x30]
xorps xmm0, xmm1
movdqa xmmword [rbp + 0x20], xmm0
xorps xmm2, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x30], xmm2
lea rcx, [rbp + 0x20]
call fcn.140001280
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], rsi
movabs rax, 0x7472dbb1903a238f
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], r12
movabs rax, 0x57c32a2f053f2d96
mov qword [rbp - 0x10], rax
movabs rax, 0xa2ac9d4114ee4553
mov qword [rbp - 8], rax
movabs rax, 0x7478f5d5f55e42e0
mov qword [rbp], rax
mov qword [rbp + 8], r12
movups xmm0, xmmword [rbp - 0x10]
movups xmm1, xmmword [rbp]
xorps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x20], xmm0
xorps xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x30], xmm1
lea rcx, [rbp + 0x20]
call fcn.140001280
call fcn.1400131c0
mov ecx, 0x4b0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rsi
movabs rax, 0x6f8a0f24612c499a
mov qword [rbp + 0x50], rax
movabs rax, 0xce8ce92e7a8b7a77
mov qword [rbp + 0x58], rax
movaps xmm0, xmmword [rbp + 0x50]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x60], r13d
nop dword [rax + rax]
lea rdx, [rbp + 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140010df2
lea rdx, [rbp + 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rsp + 0x30], eax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, dword [rbp + 0x60]
test ebx, ebx
je 0x140010dd0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], rsi
movabs rax, 0x7472dbb1903a238f
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], r12
movabs rax, 0x4bc4114b78495bc7
mov qword [rbp - 0x10], rax
movabs rax, 0xe0a28e4013ba5453
mov qword [rbp - 8], rax
movabs rax, 0x7472dbb1903a23a1
mov qword [rbp], rax
mov qword [rbp + 8], r12
movups xmm0, xmmword [rbp - 0x10]
movups xmm1, xmmword [rbp]
xorps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x20], xmm0
xorps xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x30], xmm1
lea rdx, [rbp + 0x20]
lea rcx, [0x1403b0b90]
call fcn.14000a3f0
mov ecx, 0x10
call fcn.140019a40
mov qword [rbp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax], rdi
mov qword [rax + 8], rbx
mov qword [0x1403b2370], rax
lea rcx, [rbp - 0x10]
call fcn.14000f390
nop
lea rdx, [rbp - 0x58]
mov rcx, rax
call fcn.14000ee90
nop
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x140010eef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010eea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011f52
call fcn.140019670
mov qword [rbp], r13
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r13w
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x68], rsi
movabs rax, 0x4dce761f56077491
mov qword [rbp + 0x50], rax
movabs rax, 0xce8ce92e7ace375a
mov qword [rbp + 0x58], rax
movaps xmm0, xmmword [rbp + 0x50]
xorps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp + 0x50], xmm0
mov r12, qword [rbp - 0x48]
lea rax, [rbp + 0x50]
mov rbx, r15
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140010f40
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r12
cmp rax, rbx
jb 0x140011f58
lea r13, [rbp - 0x58]
cmp qword [rbp - 0x40], 0xf
cmova r13, qword [rbp - 0x58]
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xor edx, edx
mov qword [rbp - 0x68], rdx
mov qword [rbp - 0x60], rdx
lea r14, [rbx + r12]
mov esi, 0xf
lea rdi, [rbp - 0x78]
cmp r14, rsi
jbe 0x1400110a7
mov rsi, r14
or rsi, 0xf
cmp rsi, rcx
jbe 0x140011066
mov rsi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140019a40
test rax, rax
je 0x140011f6a
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400110a3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
test eax, eax
je 0x140010d15
cmp byte [rsp + 0x38], 0
je 0x140010d15
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], rsi
movabs rax, 0x7472dbb1903a238f
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], r12
movabs rax, 0x57c32a2f053f2b96
mov qword [rbp - 0x10], rax
movabs rax, 0xabe8884116ee4553
mov qword [rbp - 8], rax
movabs rax, 0x7472dbb1903002eb
mov qword [rbp], rax
mov qword [rbp + 8], r12
movups xmm0, xmmword [rbp - 0x10]
movups xmm1, xmmword [rbp]
xorps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x20], xmm0
xorps xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x30], xmm1
lea rcx, [rbp + 0x20]
call fcn.140001280
jmp 0x140010d85
mov eax, 0x16
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
test rcx, rcx
jne 0x140011080
mov rdi, rdx
jmp 0x1400110a3
cmp rcx, 0x1000
jb 0x14001109b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140011f4c
jmp 0x140010fb8
call fcn.140019a40
mov rdi, rax
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], rsi
mov r8, r12
mov rdx, r13
mov rcx, rdi
call fcn.14003cab0
lea rcx, [rdi + r12]
mov r8, rbx
lea rdx, [rbp + 0x50]
call fcn.14003cab0
mov byte [rdi + r14], 0
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0xf
cmova rcx, qword [rbp - 0x78]
call fcn.14000f520
test eax, eax
jne 0x140011105
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x1403b2368]
movabs rsi, 0x21aa586b256200cd
movabs rdi, 0xce8ce92e7ace3736
movabs r12, 0x25f5730c0c424d38
test rcx, rcx
jne 0x1400111cb
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rdi
movabs rax, 0x7472dbb1903a238f
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], r12
movabs rax, 0x46cb3522053f2d96
mov qword [rbp - 0x10], rax
movabs rax, 0xbce98f480fac1753
mov qword [rbp - 8], rax
movabs rax, 0x2b6d4b0494aaf
mov qword [rbp], rax
movabs rax, 0x25f5730c0c426341
mov qword [rbp + 8], rax
movups xmm0, xmmword [rbp - 0x10]
movups xmm1, xmmword [rbp]
xorps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x20], xmm0
xorps xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x30], xmm1
lea rcx, [rbp + 0x20]
call fcn.140001280
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x1403b2368]
movups xmm0, xmmword [str.QRUVSWAPAQARASATAUAVAWH]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [0x140053630]
movups xmmword [rbp + 0x80], xmm1
movups xmm0, xmmword [0x140053640]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [0x140053650]
movups xmmword [rbp + 0xa0], xmm1
movups xmm0, xmmword [0x140053660]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [0x140053670]
movups xmmword [rbp + 0xc0], xmm1
movups xmm0, xmmword [0x140053680]
movups xmmword [rbp + 0xd0], xmm0
movzx eax, word [0x140053690]
mov word [rbp + 0xe0], ax
movzx eax, byte [0x140053692]
mov byte [rbp + 0xe2], al
mov rbx, rcx
mov eax, 0x5a4d
movabs r13, 0x40dc3622053f2d96
cmp word [rcx], ax
je 0x1400112af
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x50], r13
movabs rax, 0xcea2ac7e5aaa5e5a
mov qword [rbp + 0x58], rax
movaps xmm0, xmmword [rbp + 0x50]
xorps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp + 0x50], xmm0
lea rcx, [rbp + 0x50]
call fcn.140001280
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x1403b2368]
movsxd r14, dword [rbx + 0x3c]
add r14, rcx
movabs rbx, 0x7472dbb1903a238f
cmp dword [r14], 0x4550
je 0x140011340
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], r13
movabs rax, 0xa6acbd605aaa5e5a
mov qword [rbp - 8], rax
movabs rax, 0x7472f5c3f55e42ea
mov qword [rbp], rax
mov qword [rbp + 8], r12
movups xmm0, xmmword [rbp - 0x10]
movups xmm1, xmmword [rbp]
xorps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm0, xmmword [rbp - 0x20]
xorps xmm0, xmm1
movdqa xmmword [rbp + 0x30], xmm0
lea rcx, [rbp + 0x20]
call fcn.140001280
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [r14 + 0x50]
call fcn.140013970
mov r13, rax
mov qword [rbp + 0x60], rax
movabs rax, 0x4dc3392d053f2d96
movabs rcx, 0xa2edc9410eee5353
movabs rdx, 0x1952bec5f1594ce3
movabs r8, 0x4a9353757e2d205d
test r13, r13
jne 0x140011431
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rdi
mov qword [rbp], rbx
mov qword [rbp + 8], r12
movabs r9, 0x1585392709a52cd1
mov qword [rbp + 0x10], r9
movabs r9, 0xf701df7a772c6d0a
mov qword [rbp + 0x18], r9
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], rdx
mov qword [rbp + 0x38], r8
movabs rax, 0x35e9584466c90ca3
mov qword [rbp + 0x40], rax
movabs rax, 0xf701f11f104d0063
mov qword [rbp + 0x48], rax
movups xmm1, xmmword [rbp + 0x20]
movups xmm2, xmmword [rbp + 0x30]
movups xmm3, xmmword [rbp + 0x40]
movdqa xmm0, xmmword [rbp - 0x10]
xorps xmm0, xmm1
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [rbp]
xorps xmm1, xmm2
movdqa xmmword [rbp + 0x30], xmm1
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmm3
movdqa xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0x20]
call fcn.140001280
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], r12
movabs rax, 0x42c5144b78495bc7
mov qword [rbp - 0x10], rax
movabs rax, 0xabeb884313ee5b57
mov qword [rbp - 8], rax
movabs rax, 0x5152e1d4e35b41af
mov qword [rbp], rax
movabs rax, 0x25f5730c0c424748
mov qword [rbp + 8], rax
movups xmm1, xmmword [rbp - 0x10]
movups xmm2, xmmword [rbp]
movdqa xmm0, xmmword [rbp - 0x30]
xorps xmm0, xmm1
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [rbp - 0x20]
xorps xmm1, xmm2
movdqa xmmword [rbp + 0x30], xmm1
mov rdx, r13
lea rcx, [rbp + 0x20]
call fcn.140001280
mov edx, 0x73
call fcn.140013970
mov qword [rbp - 0x80], rax
test rax, rax
jne 0x14001159a
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rdi
mov qword [rbp], rbx
mov qword [rbp + 8], r12
movabs rax, 0x1585392709a52cd1
mov qword [rbp + 0x10], rax
movabs rax, 0xf701df7a772c6d0a
mov qword [rbp + 0x18], rax
movabs rax, 0x4dc3392d053f2d96
mov qword [rbp + 0x20], rax
movabs rax, 0xa2edc9410eee5353
mov qword [rbp + 0x28], rax
movabs rax, 0x1952bec5f1594ce3
mov qword [rbp + 0x30], rax
movabs rax, 0x4a9353757e2d205d
mov qword [rbp + 0x38], rax
movabs rax, 0x76e9554261d60ca3
mov qword [rbp + 0x40], rax
movabs rax, 0xf701df7a59490965
mov qword [rbp + 0x48], rax
movups xmm1, xmmword [rbp + 0x20]
movups xmm2, xmmword [rbp + 0x30]
movups xmm3, xmmword [rbp + 0x40]
movdqa xmm0, xmmword [rbp - 0x10]
xorps xmm0, xmm1
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [rbp]
xorps xmm1, xmm2
movdqa xmmword [rbp + 0x30], xmm1
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmm3
movdqa xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0x20]
call fcn.140001280
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], r12
movabs rcx, 0x4ede3b0e4f0c4996
mov qword [rbp - 0x10], rcx
movabs rcx, 0xa2e08c4629ee6a44
mov qword [rbp - 8], rcx
movabs rcx, 0x713b991f55e4cec
mov qword [rbp], rcx
movabs rcx, 0x25ff797c2962775d
mov qword [rbp + 8], rcx
movups xmm1, xmmword [rbp - 0x10]
movups xmm2, xmmword [rbp]
movdqa xmm0, xmmword [rbp - 0x30]
xorps xmm0, xmm1
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [rbp - 0x20]
xorps xmm1, xmm2
movdqa xmmword [rbp + 0x30], xmm1
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.140001280
cmp dword [r14 + 0xb4], 0
je 0x140011694
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], r12
movabs rax, 0x48d2312d053f2b96
mov qword [rbp - 0x10], rax
movabs rax, 0xade3854b08ee5058
mov qword [rbp - 8], rax
movabs rax, 0x5a5ca8dfff5357ee
mov qword [rbp], rax
movabs rax, 0x25f5730c0c424716
mov qword [rbp + 8], rax
movups xmm1, xmmword [rbp - 0x10]
movups xmm2, xmmword [rbp]
movdqa xmm0, xmmword [rbp - 0x30]
xorps xmm0, xmm1
movdqa xmmword [rbp - 0x10], xmm0
xorps xmm2, xmmword [rbp - 0x20]
movdqa xmmword [rbp], xmm2
lea rcx, [rbp - 0x10]
call fcn.140001280
mov r8, r14
mov rdx, r13
call fcn.140010170
mov r8d, dword [rsp + 0x30]
mov rcx, r14
call fcn.14000fe20
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xor eax, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov r8d, 0xa
lea rdx, str.user32.dll
lea rcx, [rbp - 0x30]
call fcn.14000b950
lea rax, [rbp - 0x30]
mov qword [rbp + 0x50], rax
mov rbx, qword [0x1403b2370]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x20]
call fcn.1400125e0
mov r8, rax
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx]
call fcn.1400017b0
mov rbx, rax
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x140011736
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011731
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011f5e
call fcn.140019670
movabs rcx, 0x48cb1e4b784f5bc7
test rbx, rbx
jne 0x14001180d
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rdi
movabs rax, 0x7472dbb1903a238f
mov qword [rbp], rax
mov qword [rbp + 8], r12
movabs r8, 0x1585392709a52cd1
mov qword [rbp + 0x10], r8
movabs rdx, 0xf701df7a772c6d0a
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], rcx
movabs rax, 0xa9ac865a5aaa525a
mov qword [rbp + 0x28], rax
movabs rax, 0x1111b4c3e01a57ea
mov qword [rbp + 0x30], rax
movabs rax, 0xb90006d6e623e4b
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], r8
mov qword [rbp + 0x48], rdx
movups xmm1, xmmword [rbp + 0x20]
movups xmm2, xmmword [rbp + 0x30]
movups xmm3, xmmword [rbp + 0x40]
movdqa xmm0, xmmword [rbp - 0x10]
xorps xmm0, xmm1
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [rbp]
xorps xmm1, xmm2
movdqa xmmword [rbp + 0x30], xmm1
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmm3
movdqa xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0x20]
call fcn.140001280
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rdi
movabs rax, 0x7472dbb1903a238f
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], r12
movabs rax, 0x4ede3b0e4f0c4996
mov qword [rbp - 0x10], rax
movabs rax, 0xa7ff9b4f2aee6a44
mov qword [rbp - 8], rax
movabs rax, 0x61dabdcf91a44e1
mov qword [rbp], rax
movabs rax, 0x25f57922226c3e4c
mov qword [rbp + 8], rax
movups xmm1, xmmword [rbp - 0x10]
movups xmm2, xmmword [rbp]
movdqa xmm0, xmmword [rbp - 0x30]
xorps xmm0, xmm1
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [rbp - 0x20]
xorps xmm1, xmm2
movdqa xmmword [rbp + 0x30], xmm1
lea rcx, [rbp + 0x20]
call fcn.140001280
mov rcx, rbx
call fcn.140010340
test eax, eax
jne 0x140011933
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rdi
movabs rax, 0x7472dbb1903a238f
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], r12
movabs rax, 0x48cb1e4b784f5bc7
mov qword [rbp - 0x10], rax
movabs rax, 0xbeac865a5aaa525a
mov qword [rbp - 8], rax
movabs rax, 0x41fb291f54951ee
mov qword [rbp], rax
movabs rax, 0x25f573227f363f57
mov qword [rbp + 8], rax
movups xmm1, xmmword [rbp - 0x10]
movups xmm2, xmmword [rbp]
movdqa xmm0, xmmword [rbp - 0x30]
xorps xmm0, xmm1
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [rbp - 0x20]
xorps xmm1, xmm2
movdqa xmmword [rbp + 0x30], xmm1
lea rcx, [rbp + 0x20]
call fcn.140001280
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rdi
movabs rax, 0x7472dbb1903a238f
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], r12
movabs rax, 0x44ed2a0e56377483
mov qword [rbp - 0x10], rax
movabs rax, 0xa1fe8e4b08a17142
mov qword [rbp - 8], rax
movabs rax, 0x1b16b5d8c75e4dfa
mov qword [rbp], rax
movabs rax, 0x25f5730c0c424d4f
mov qword [rbp + 8], rax
movups xmm1, xmmword [rbp - 0x10]
movups xmm2, xmmword [rbp]
movdqa xmm0, xmmword [rbp - 0x30]
xorps xmm0, xmm1
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [rbp - 0x20]
xorps xmm1, xmm2
movdqa xmmword [rbp + 0x30], xmm1
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xor ebx, ebx
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
lea rax, [rbp + 0x20]
nop dword [rax]
inc r15
cmp byte [rax + r15], bl
jne 0x1400119c0
mov r8, r15
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x30]
call fcn.14000ba80
nop
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x30]
call fcn.140012930
mov rcx, qword [rax]
mov r15, qword [rcx + 0x40]
mov qword [rbp + 0x50], r15
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140011a2e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011a29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011f64
call fcn.140019670
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
test r15, r15
jne 0x140011adc
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], rdi
movabs rax, 0x7472dbb1903a238f
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], r12
movabs rax, 0x46d8393f053f2d96
mov qword [rbp - 0x10], rax
movabs rax, 0xbce3994313ee4353
mov qword [rbp - 8], rax
movabs rax, 0x1b14fbc5ff5403fb
mov qword [rbp], rax
movabs rax, 0x25f5730c2226234d
mov qword [rbp + 8], rax
movups xmm0, xmmword [rbp - 0x10]
movups xmm1, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmm0, xmmword [rbp + 0x30]
xorps xmm0, xmm1
movdqa xmmword [rbp], xmm0
lea rcx, [rbp - 0x10]
call fcn.140001280
mov ecx, 0x708
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdx, r15
call fcn.1400128b0
mov rbx, rax
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rdi
movabs rax, 0x7472dbb1903a238f
mov qword [rbp], rax
mov qword [rbp + 8], r12
movabs rax, 0x75eb114b78495bc7
mov qword [rbp + 0x20], rax
movabs rax, 0xbce99d4013a14716
mov qword [rbp + 0x28], rax
movabs rax, 0x7472dbbbe01f03b5
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], r12
movups xmm1, xmmword [rbp + 0x20]
movups xmm2, xmmword [rbp + 0x30]
movdqa xmm0, xmmword [rbp - 0x10]
xorps xmm0, xmm1
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [rbp]
xorps xmm1, xmm2
movdqa xmmword [rbp + 0x30], xmm1
mov rdx, r15
lea rcx, [rbp + 0x20]
call fcn.140001280
mov qword [rbp + 0x88], r15
mov qword [rbp + 0x92], rbx
movzx edi, word [r14 + 0x14]
add rdi, 0x18
mov r12, qword [0x1403b2368]
mov rsi, qword [0x1403b2370]
test r12, r12
je 0x140011bab
mov rbx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r13
mov r9, rbx
mov r8, r12
mov rcx, qword [rsi]
call fcn.1400016b0
movabs rsi, 0x21aa586b256200cd
mov qword [rbp - 0x10], rsi
movabs rbx, 0xce8ce92e7ace3736
mov qword [rbp - 8], rbx
movabs rax, 0x7472dbb1903a238f
mov qword [rbp], rax
movabs rax, 0x25f5730c0c424d38
mov qword [rbp + 8], rax
movabs rax, 0x51cb154b78495bc7
mov qword [rbp + 0x20], rax
movabs rax, 0xade99a0e1da05e46
mov qword [rbp + 0x28], rax
movabs rax, 0x5a5cf5c2fe554afb
mov qword [rbp + 0x30], rax
movabs rax, 0x25f5730c0c424d32
mov qword [rbp + 0x38], rax
movups xmm1, xmmword [rbp + 0x20]
movups xmm2, xmmword [rbp + 0x30]
movdqa xmm0, xmmword [rbp - 0x10]
xorps xmm0, xmm1
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [rbp]
xorps xmm1, xmm2
movdqa xmmword [rbp + 0x30], xmm1
lea rcx, [rbp + 0x20]
call fcn.140001280
movzx edi, word [r14 + 0x14]
add rdi, 0x24
xor r12d, r12d
cmp word [r14 + 6], r12w
je 0x140011ce6
add rdi, r14
mov eax, dword [r14 + 0x50]
cmp r12, rax
jae 0x140011cce
mov eax, dword [rdi + 4]
mov qword [rsp + 0x30], rax
mov esi, dword [rdi + 8]
mov r15d, dword [rdi]
add r15, r13
mov r13, qword [0x1403b2370]
add rsi, qword [0x1403b2368]
je 0x140011cb4
mov rbx, qword [r13 + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9, rbx
mov r8, rsi
mov rcx, qword [r13]
call fcn.1400016b0
mov eax, dword [rdi]
add rdi, 0x28
mov ecx, dword [rdi]
sub rcx, rax
add r12, rcx
cmp word [r14 + 6], 0
mov r13, qword [rbp + 0x60]
jne 0x140011c60
mov r15, qword [rbp + 0x50]
movabs rbx, 0xce8ce92e7ace3736
movabs rsi, 0x21aa586b256200cd
mov edx, dword [r14 + 0x28]
add rdx, r13
mov qword [rbp + 0xa9], r13
mov qword [rbp + 0xba], rdx
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rbx
movabs rax, 0x7472dbb1903a238f
mov qword [rbp], rax
movabs rcx, 0x25f5730c0c424d38
mov qword [rbp + 8], rcx
movabs rax, 0x55c41d4b78495bc7
mov qword [rbp + 0x20], rax
movabs rax, 0xbae280412aee4e44
mov qword [rbp + 0x28], rax
movabs rax, 0x7472dbbbe01f03b5
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rcx
movups xmm1, xmmword [rbp + 0x20]
movups xmm2, xmmword [rbp + 0x30]
movdqa xmm0, xmmword [rbp - 0x10]
xorps xmm0, xmm1
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [rbp]
xorps xmm1, xmm2
movdqa xmmword [rbp + 0x30], xmm1
lea rcx, [rbp + 0x20]
call fcn.140001280
mov rsi, qword [rbp - 0x80]
mov rbx, qword [0x1403b2370]
mov rdi, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov qword [rsp + 0x28], 0x73
mov qword [rsp + 0x20], rsi
mov r9, rdi
lea r8, [rbp + 0x70]
mov rcx, qword [rbx]
call fcn.1400016b0
mov r9d, 4
mov rdx, r15
call fcn.140013b60
mov rbx, qword [0x1403b2370]
mov rdi, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov qword [rsp + 0x28], 8
mov qword [rsp + 0x20], r15
mov r9, rdi
lea r8, [rbp - 0x80]
mov rcx, qword [rbx]
call fcn.1400016b0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
test r15, r15
je 0x140011e8e
mov r9d, 2
mov rdx, r15
call fcn.140013b60
mov rbx, qword [0x1403b2368]
mov rcx, rbx
call fcn.140019670
test rbx, rbx
je 0x140011e30
mov qword [0x1403b2368], 0x8123
nop dword [rax + rax]
movabs rax, 0x21aa586b256200cd
mov qword [rbp + 0x50], rax
movabs rax, 0xce8ce92e7ace3736
mov qword [rbp + 0x58], rax
movabs rax, 0x4fc51c4b78495bc7
mov qword [rsp + 0x30], rax
movabs rax, 0xce8ce92e7ace1653
mov qword [rsp + 0x38], rax
movdqa xmm0, xmmword [rbp + 0x50]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp + 0x50], xmm0
lea rcx, [rbp + 0x50]
call fcn.140001280
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140011ec9
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011ec4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011f6a
call fcn.140019670
mov qword [rbp - 0x68], 0
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140011f14
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011f0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011f46
call fcn.140019670
xor eax, eax
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.140019650
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400226a4
nop
call fcn.140001ca0
nop
call fcn.1400226a4
int3
call fcn.140001d40
nop
call fcn.1400226a4
int3
call fcn.1400226a4
nop
call fcn.1400226a4
int3