Function at 0x14000cfa0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x108]
sub rsp, 0x1d0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
mov rax, qword [0x140052040]
xor rax, rsp
mov qword [rbp + 0x88], rax
mov rdi, rcx
mov qword [rbp - 8], rcx
mov dword [rbp + 0x10], 0
movsd xmm0, qword [rcx + 8]
movsd qword [rbp + 0x50], xmm0
mov rsi, qword [0x1400b2bb0]
add rsi, 0x1ed0
xorps xmm0, xmm0
cvtss2sd xmm0, xmm1
mulsd xmm0, qword [0x140047f90]
cvtpd2ps xmm0, xmm0
movss xmm1, dword [0x1400b2d6c]
addss xmm1, xmm0
movss dword [0x1400b2d6c], xmm1
xorps xmm9, xmm9
movss xmm6, dword [0x140047fc4]
comiss xmm1, xmm6
jbe 0x14000d04b
mov dword [0x1400b2d6c], 0
lea rcx, [rbp + 0x78]
call fcn.1400029a0
xor ebx, ebx
movss xmm7, dword [0x140047f5c]
nop
movd xmm0, ebx
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm7
subss xmm0, dword [0x1400b2d6c]
comiss xmm9, xmm0
jbe 0x14000d07d
addss xmm0, xmm6
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 8]
movaps xmm2, xmm6
movaps xmm1, xmm6
call fcn.140019170
movss dword [rsp + 0x20], xmm6
movss xmm3, dword [rbp + 0x10]
movss xmm2, dword [rbp]
movss xmm1, dword [rbp + 8]
lea rcx, [rbp + 0x40]
call fcn.140002a00
movups xmm0, xmmword [rbp + 0x40]
movups xmmword [rbp + 0x78], xmm0
inc ebx
cmp ebx, 0xa
jl 0x14000d060
movaps xmm0, xmmword [0x140048260]
movups xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0x40]
call fcn.1400190c0
mov qword [rbp + 0x10], 0
movss xmm0, dword [0x140047fd4]
movss dword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0xf
movss dword [rsp + 0x20], xmm9
mov r9d, eax
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x10]
mov rcx, rsi
call fcn.140034350
mov qword [rbp + 0x58], rsi
mov edx, 0x48
lea rcx, [0x1400b2c58]
call fcn.1400135b0
mov rcx, rax
call fcn.140023070
mov dword [rsp + 0x20], 0xff
mov edx, 0xff
mov r9d, edx
mov r8d, edx
lea rcx, [rbp + 0x18]
call fcn.1400029b0
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x40], xmm0
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
movss xmm0, dword [rbp + 0x50]
movss dword [rsp + 0x20], xmm0
movss xmm8, dword [0x140048014]
movaps xmm3, xmm8
lea r8, str.diablo
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x58]
call fcn.14000ea70
call fcn.140023110
mov edx, 0x20
lea rcx, [0x1400b2c68]
call fcn.140013670
mov rcx, rax
call fcn.140023070
mov dword [rsp + 0x20], 0xff
mov edx, 0xa8
mov r9d, edx
mov r8d, edx
lea rcx, [rbp + 0x18]
call fcn.1400029b0
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x40], xmm0
movss xmm3, dword [rbp + 0x64]
addss xmm3, xmm8
subss xmm3, dword [0x140047ffc]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
movss xmm0, dword [rbp + 0x50]
movss dword [rsp + 0x20], xmm0
lea r8, str.play_different
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x58]
call fcn.14000ea70
call fcn.140023110
mov edx, 0x18
lea rcx, [0x1400b2c68]
call fcn.140013670
mov rcx, rax
call fcn.140023070
mov dword [rsp + 0x20], 0xff
mov edx, 0xff
mov r9d, edx
mov r8d, edx
lea rcx, [rbp + 0x18]
call fcn.1400029b0
movups xmm6, xmmword [rax]
lea rcx, [rdi + 0x10]
call fcn.140001b70
movdqa xmmword [rbp + 0x40], xmm6
movss xmm3, dword [rbp + 0x64]
addss xmm3, xmm8
addss xmm3, dword [rbp + 0x6c]
addss xmm3, dword [0x140047ffc]
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x28], rcx
movss xmm0, dword [rbp + 0x50]
movss dword [rsp + 0x20], xmm0
mov r8, rax
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x58]
call fcn.14000ea70
call fcn.140023110
movss xmm0, dword [rbp + 0x64]
addss xmm0, xmm8
addss xmm0, dword [rbp + 0x6c]
addss xmm0, dword [rbp + 0x74]
addss xmm0, xmm8
call fcn.140023910
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x18]
call fcn.140001e60
nop
mov r8d, 7
lea rdx, str.nullify
lea rcx, [rbp + 0x18]
call fcn.140001e80
nop
mov dword [rbp + 0x10], 1
call qword [0x1400b2b48]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140001a10
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.1400157b0
lea rcx, [rsp + 0x50]
call fcn.1400019a0
nop
lea rcx, [rbp + 0x18]
call fcn.1400019a0
cmp qword [0x1400b2b78], 0
jne 0x14000d326
mov rcx, qword [0x1400b2af0]
call fcn.14000cbc0
movss xmm0, dword [0x140048018]
call fcn.1400238c0
xor sil, sil
mov dword [rbp - 0x24], esi
xor r14b, r14b
mov dword [rbp - 0x20], r14d
xor r15b, r15b
mov dword [rbp + 8], r15d
xor r12b, r12b
mov dword [rbp], r12d
xor r13b, r13b
mov dword [rbp - 0x58], r13d
xor bl, bl
mov dword [rbp - 0x54], ebx
mov byte [rbp - 0x50], bl
mov byte [rbp - 0x28], bl
mov byte [rbp + 0x10], bl
mov rcx, qword [rdi + 0x30]
mov qword [rbp - 0x60], rcx
mov rax, qword [rdi + 0x38]
mov qword [rbp - 0x18], rax
cmp rcx, rax
je 0x14000d6e7
movzx ebx, byte [rsp + 0x40]
movzx edi, byte [rsp + 0x40]
movzx esi, byte [rsp + 0x40]
movzx r14d, byte [rsp + 0x40]
movzx r15d, byte [rsp + 0x40]
movzx r12d, byte [rsp + 0x40]
movzx r13d, byte [rsp + 0x40]
mov rdx, rcx
lea rcx, [rbp + 0x18]
call fcn.140001a50
nop
movzx edx, bl
lea rcx, [rbp - 0x48]
call fcn.140001e60
nop
mov r8d, 0xb
lea rdx, str.diablo_rust
lea rcx, [rbp - 0x48]
call fcn.140001e80
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.1400157b0
mov byte [rsp + 0x40], al
lea rcx, [rbp - 0x48]
call fcn.1400019a0
mov eax, dword [rbp - 0x24]
movzx eax, al
cmp byte [rsp + 0x40], 0
mov ecx, 1
cmovne eax, ecx
mov dword [rbp - 0x24], eax
movzx edx, sil
lea rcx, [rbp - 0x48]
call fcn.140001e60
nop
mov r8d, 0x13
lea rdx, str.diablo_rust_private
lea rcx, [rbp - 0x48]
call fcn.140001e80
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.1400157b0
mov byte [rsp + 0x40], al
lea rcx, [rbp - 0x48]
call fcn.1400019a0
mov eax, dword [rbp - 0x20]
movzx eax, al
cmp byte [rsp + 0x40], 0
mov ecx, 1
cmovne eax, ecx
mov dword [rbp - 0x20], eax
movzx edx, r12b
lea rcx, [rbp - 0x48]
call fcn.140001e60
nop
mov r8d, 0xb
lea rdx, str.diablo_apex
lea rcx, [rbp - 0x48]
call fcn.140001e80
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.1400157b0
mov byte [rsp + 0x40], al
lea rcx, [rbp - 0x48]
call fcn.1400019a0
mov eax, dword [rbp + 8]
movzx eax, al
cmp byte [rsp + 0x40], 0
mov ecx, 1
cmovne eax, ecx
mov dword [rbp + 8], eax
movzx edx, dil
lea rcx, [rbp - 0x48]
call fcn.140001e60
nop
mov r8d, 0x10
lea rdx, str.diablo_rust_test
lea rcx, [rbp - 0x48]
call fcn.140001e80
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.1400157b0
mov byte [rsp + 0x40], al
lea rcx, [rbp - 0x48]
call fcn.1400019a0
mov eax, dword [rbp]
movzx eax, al
cmp byte [rsp + 0x40], 0
mov ecx, 1
cmovne eax, ecx
mov dword [rbp], eax
movzx edx, r14b
lea rcx, [rbp - 0x48]
call fcn.140001e60
nop
mov r8d, 0x10
lea rdx, str.diablo_apex_test
lea rcx, [rbp - 0x48]
call fcn.140001e80
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.1400157b0
mov byte [rsp + 0x40], al
lea rcx, [rbp - 0x48]
call fcn.1400019a0
mov eax, dword [rbp - 0x58]
movzx eax, al
cmp byte [rsp + 0x40], 0
mov ecx, 1
cmovne eax, ecx
mov dword [rbp - 0x58], eax
movzx edx, r15b
lea rcx, [rbp - 0x48]
call fcn.140001e60
nop
mov r8d, 0x10
lea rdx, str.diablo_csgo_test
lea rcx, [rbp - 0x48]
call fcn.140001e80
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.1400157b0
mov byte [rsp + 0x40], al
lea rcx, [rbp - 0x48]
call fcn.1400019a0
mov eax, dword [rbp - 0x54]
movzx eax, al
cmp byte [rsp + 0x40], 0
mov ecx, 1
cmovne eax, ecx
mov dword [rbp - 0x54], eax
movzx edx, r13b
lea rcx, [rbp - 0x48]
call fcn.140001e60
nop
mov r8d, 0xb
lea rdx, str.diablo_csgo
lea rcx, [rbp - 0x48]
call fcn.140001e80
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.1400157b0
mov byte [rsp + 0x40], al
lea rcx, [rbp - 0x48]
call fcn.1400019a0
mov eax, dword [rbp - 0x50]
movzx eax, al
cmp byte [rsp + 0x40], 0
mov ecx, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x48]
call fcn.140001e60
nop
mov r8d, 0xa
lea rdx, str.diablo_r6s
lea rcx, [rbp - 0x48]
call fcn.140001e80
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.1400157b0
mov byte [rsp + 0x40], al
lea rcx, [rbp - 0x48]
call fcn.1400019a0
mov eax, dword [rbp - 0x28]
movzx eax, al
cmp byte [rsp + 0x40], 0
mov ecx, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x48]
call fcn.140001e60
nop
mov r8d, 0xd
lea rdx, str.diablo_finals
lea rcx, [rbp - 0x48]
call fcn.140001e80
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.1400157b0
mov byte [rsp + 0x40], al
lea rcx, [rbp - 0x48]
call fcn.1400019a0
mov eax, dword [rbp + 0x10]
movzx eax, al
cmp byte [rsp + 0x40], 0
mov ecx, 1
cmovne eax, ecx
mov dword [rbp + 0x10], eax
lea rcx, [rbp + 0x18]
call fcn.1400019a0
mov rcx, qword [rbp - 0x60]
add rcx, 0x20
mov qword [rbp - 0x60], rcx
cmp rcx, qword [rbp - 0x18]
jne 0x14000d3a3
mov rdi, qword [rbp - 8]
mov esi, dword [rbp - 0x24]
mov r14d, dword [rbp - 0x20]
mov r15d, dword [rbp + 8]
mov r12d, dword [rbp]
mov r13d, dword [rbp - 0x58]
mov ebx, dword [rbp - 0x54]
lea rcx, [rbp + 0x40]
call fcn.140023800
cmp byte [rdi + 0x4c], 0
jne 0x14000d708
test r12b, r12b
jne 0x14000d708
test r13b, r13b
jne 0x14000d708
test bl, bl
je 0x14000d7e4
mov edx, 0x10
lea rcx, [0x1400b2c58]
call fcn.1400135b0
mov rcx, rax
call fcn.140023070
mov dword [rbp - 0x60], 0x41200000
mov dword [rbp - 0x5c], 0x41200000
lea rcx, [rbp - 0x60]
call fcn.140023840
lea rdx, [0x1400b2d21]
lea rcx, str.Test_Build_
call fcn.14003cca0
call fcn.140023110
test bl, bl
je 0x14000d7e4
mov dword [rbp - 0x60], 0x41200000
mov dword [rbp - 0x5c], 0x420c0000
lea rcx, [rbp - 0x60]
call fcn.140023840
mov dword [rbp - 0x60], 0x42c80000
mov dword [rbp - 0x5c], 0x41a00000
xor r8d, r8d
lea rdx, [rbp - 0x60]
lea rcx, str.Test_Module
call fcn.14003ba70
test al, al
je 0x14000d7e4
mov ecx, 0xb8
call fcn.14003e960
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movzx edx, r13b
movzx ecx, r12b
add edx, ecx
movzx ecx, r15b
add edx, ecx
movzx ecx, r14b
add edx, ecx
movzx eax, sil
add edx, eax
mov r8, rdi
mov rcx, rbx
call fcn.14000c330
nop
mov qword [0x1400b2b00], rax
lea rcx, [rbp + 0x40]
call fcn.140023840
movaps xmm0, xmmword [0x140048260]
movups xmmword [rbp - 0x18], xmm0
lea rdx, [rbp - 0x18]
mov ecx, 0x15
call fcn.140019400
movaps xmm0, xmmword [0x1400482b0]
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x18], xmm1
mov dword [rbp - 0x60], 0x3f800000
mov dword [rbp - 0x5c], 0x3f800000
mov qword [rbp], 0
mov dword [rbp + 8], 0x43160000
mov dword [rbp + 0xc], 0x43480000
lea rax, [rbp - 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
lea r9, [rbp - 0x60]
lea r8, [rbp]
lea rdx, [rbp + 8]
mov rcx, qword [0x1400b2b78]
call fcn.14003cb90
test al, al
je 0x14000db67
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140001e60
nop
mov r8d, 0xc
lea rdx, str.mpnotify.exe
lea rcx, [rsp + 0x50]
call fcn.140001e80
nop
lea rcx, [rsp + 0x50]
call fcn.14000ca50
nop
lea rcx, [rsp + 0x50]
call fcn.1400019a0
mov ecx, 0x28
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm1, xmmword [str.D__]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140048130]
movdqu xmmword [rsp + 0x60], xmm2
mov dl, 0x1b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
xor dl, cl
mov byte [rsp + 0x70], dl
mov byte [rsp + 0x71], 0
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x51]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
test r12b, r12b
je 0x14000d9fb
cmp byte [0x1400b2d21], 0
je 0x14000d9fb
mov ecx, 0xb8
call fcn.14003e960
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movzx edx, r15b
movzx ecx, r14b
add edx, ecx
movzx ecx, sil
add edx, ecx
mov r8, rdi
mov rcx, rbx
call fcn.14000c330
nop
mov qword [0x1400b2b00], rax
jmp 0x14000db67
test r14b, r14b
je 0x14000da3d
mov ecx, 0xb8
call fcn.14003e960
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movzx edx, sil
mov r8, rdi
mov rcx, rbx
call fcn.14000c330
nop
mov qword [0x1400b2b00], rax
jmp 0x14000db67
test sil, sil
je 0x14000da7d
mov ecx, 0xb8
call fcn.14003e960
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.14000c330
nop
mov qword [0x1400b2b00], rax
jmp 0x14000db67
movdqa xmm0, xmmword [0x140048320]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140048220]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400481b0]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140048200]
movdqa xmmword [rbp - 0x80], xmm1
mov word [rbp - 0x70], 0x6932
xor eax, eax
mov byte [rbp - 0x6e], al
xor ecx, ecx
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x51], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x52], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x53], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x54], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x55], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x56], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x57], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x58], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x59], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5a], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5b], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5c], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5d], al
add rcx, 0xd
cmp rcx, 0x41
jb 0x14000dac1
mov byte [rbp - 0x6e], 0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x51]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movss xmm6, dword [0x140048070]
movaps xmm1, xmm6
movaps xmm0, xmm9
call fcn.140023750
movaps xmm0, xmmword [0x1400482b0]
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x48], xmm1
mov dword [rbp - 0x60], 0x3f800000
mov dword [rbp - 0x5c], 0x3f800000
mov qword [rbp], 0
mov dword [rbp + 8], 0x43160000
mov dword [rbp + 0xc], 0x43480000
lea rax, [rbp + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
lea r9, [rbp - 0x60]
lea r8, [rbp]
lea rdx, [rbp + 8]
mov rcx, qword [0x1400b2ae0]
call fcn.14003cb90
test al, al
je 0x14000def6
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140001e60
nop
mov r8d, 0xc
lea rdx, str.mpnotify.exe
lea rcx, [rsp + 0x50]
call fcn.140001e80
nop
lea rcx, [rsp + 0x50]
call fcn.14000ca50
nop
lea rcx, [rsp + 0x50]
call fcn.1400019a0
mov ecx, 0x28
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm1, xmmword [0x1400481e0]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x1400481a0]
movdqu xmmword [rsp + 0x60], xmm2
mov dl, 0x3c
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
xor dl, cl
mov byte [rsp + 0x70], dl
mov byte [rsp + 0x71], 0
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x51]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
test r13b, r13b
je 0x14000dd76
cmp byte [0x1400b2d21], 0
je 0x14000dd76
mov ecx, 0xb8
call fcn.14003e960
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movzx edx, r12b
movzx ecx, r15b
add edx, ecx
movzx ecx, r14b
add edx, ecx
movzx ecx, sil
add edx, ecx
mov r8, rdi
mov rcx, rbx
call fcn.14000c330
nop
mov qword [0x1400b2b00], rax
jmp 0x14000def6
test r15b, r15b
je 0x14000de03
movzx r13d, r14b
movzx eax, sil
add r13d, eax
mov ecx, 0xb8
cmp byte [rdi + 0x4c], 0
je 0x14000ddcc
call fcn.14003e960
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r8, rdi
mov edx, r13d
mov rcx, rbx
call fcn.14000c330
nop
mov qword [0x1400b2b00], rax
jmp 0x14000def6
call fcn.14003e960
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r8, rdi
mov edx, r13d
mov rcx, rbx
call fcn.14000c330
nop
mov qword [0x1400b2b00], rax
jmp 0x14000def6
movdqa xmm0, xmmword [0x140048380]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400481c0]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x140048210]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1400481f0]
movdqa xmmword [rbp - 0x80], xmm1
mov word [rbp - 0x70], 0x7229
xor eax, eax
mov byte [rbp - 0x6e], al
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x51], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x52], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x53], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x54], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x55], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x56], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x57], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x58], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x59], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5a], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5b], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5c], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5d], al
add rcx, 0xd
cmp rcx, 0x41
jb 0x14000de50
mov byte [rbp - 0x6e], 0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x51]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movaps xmm1, xmm6
movaps xmm0, xmm9
call fcn.140023750
movaps xmm0, xmmword [0x1400482b0]
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x48], xmm1
mov dword [rbp - 0x60], 0x3f800000
mov dword [rbp - 0x5c], 0x3f800000
mov qword [rbp], 0
mov dword [rbp + 8], 0x43160000
mov dword [rbp + 0xc], 0x43480000
lea rax, [rbp + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
lea r9, [rbp - 0x60]
lea r8, [rbp]
lea rdx, [rbp + 8]
mov rcx, qword [0x1400b2b10]
call fcn.14003cb90
test al, al
je 0x14000e1f7
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140001e60
nop
mov r8d, 0xc
lea rdx, str.mpnotify.exe
lea rcx, [rsp + 0x50]
call fcn.140001e80
nop
lea rcx, [rsp + 0x50]
call fcn.14000ca50
nop
lea rcx, [rsp + 0x50]
call fcn.1400019a0
mov ecx, 0x28
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm1, xmmword [0x1400483b0]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140048370]
movdqu xmmword [rsp + 0x60], xmm2
mov dl, 0x6c
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
xor dl, cl
mov byte [rsp + 0x70], dl
mov byte [rsp + 0x71], 0
mov dword [rsp + 0x28], 0xa
xor ebx, ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x51]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp byte [rbp - 0x50], bl
je 0x14000e109
mov ecx, 0xb8
call fcn.14003e960
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movzx edx, byte [rbp - 0x54]
mov r13d, dword [rbp - 0x58]
movzx ecx, r13b
add edx, ecx
movzx ecx, r12b
add edx, ecx
movzx ecx, r15b
add edx, ecx
movzx eax, r14b
add edx, eax
movzx eax, sil
add edx, eax
mov r8, rdi
mov rcx, rbx
call fcn.14000c330
nop
mov byte [rax + 0x81], 1
mov qword [0x1400b2b00], rax
jmp 0x14000e1fb
movdqa xmm0, xmmword [0x1400481d0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140048360]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x140048340]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1400483a0]
movdqa xmmword [rbp - 0x80], xmm1
mov word [rbp - 0x70], 0x277c
xor eax, eax
mov byte [rbp - 0x6e], al
mov rcx, rbx
nop
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x51], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x52], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x53], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x54], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x55], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x56], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x57], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x58], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x59], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5a], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5b], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5c], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5d], al
add rcx, 0xd
cmp rcx, 0x41
jb 0x14000e150
mov byte [rbp - 0x6e], bl
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x51]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov r13d, dword [rbp - 0x58]
jmp 0x14000e1fd
mov r13d, dword [rbp - 0x58]
xor ebx, ebx
movaps xmm1, xmm6
movaps xmm0, xmm9
call fcn.140023750
movaps xmm0, xmmword [0x1400482b0]
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x48], xmm1
mov dword [rbp - 0x60], 0x3f800000
mov dword [rbp - 0x5c], 0x3f800000
mov qword [rbp], 0
mov dword [rbp + 8], 0x43160000
mov dword [rbp + 0xc], 0x43480000
lea rax, [rbp + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
lea r9, [rbp - 0x60]
lea r8, [rbp]
lea rdx, [rbp + 8]
mov rcx, qword [0x1400b2b80]
call fcn.14003cb90
test al, al
je 0x14000e633
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140001e60
nop
mov r8d, 0xb
lea rdx, str.Notepad.exe
lea rcx, [rsp + 0x50]
call fcn.140001e80
nop
lea rcx, [rsp + 0x50]
call fcn.14000ca50
nop
lea rcx, [rsp + 0x50]
call fcn.1400019a0
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140001e60
nop
mov r8d, 0xb
lea rdx, str.notepad.exe
lea rcx, [rsp + 0x50]
call fcn.140001e80
nop
lea rcx, [rsp + 0x50]
call fcn.14000ca50
nop
lea rcx, [rsp + 0x50]
call fcn.1400019a0
mov ecx, 0x28
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm1, xmmword [0x1400482e0]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140048300]
movdqu xmmword [rsp + 0x60], xmm2
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
mov byte [rsp + 0x70], 0
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x51]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.Notepad
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14000e410
mov edi, 1
nop dword [rax]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, str.Notepad
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14000e3f0
mov rdi, qword [rbp - 8]
cmp byte [rbp - 0x28], 0
je 0x14000e47e
mov ecx, 0xb8
call fcn.14003e960
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movzx edx, byte [rbp - 0x50]
movzx ecx, byte [rbp - 0x54]
add edx, ecx
movzx ecx, r13b
add edx, ecx
movzx ecx, r12b
add edx, ecx
movzx eax, r15b
add edx, eax
movzx eax, r14b
add edx, eax
movzx eax, sil
add edx, eax
mov r8, rdi
mov rcx, rbx
call fcn.14000c330
nop
mov byte [rax + 0x80], 1
mov qword [0x1400b2b00], rax
jmp 0x14000e633
movdqa xmm0, xmmword [0x140048190]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140048390]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x140048330]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140048350]
movdqa xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x70], 0x7a7e677c
mov word [rbp - 0x6c], 0x21
mov rcx, rbx
nop word [rax + rax]
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x51], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x52], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x53], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x54], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x55], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x56], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x57], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x58], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x59], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5a], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5b], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5c], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5d], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5e], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5f], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x60], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x61], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x62], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x63], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x64], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x65], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x66], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x67], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x68], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x69], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x6a], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x6b], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x6c], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x6d], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x6e], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x6f], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x70], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x71], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x72], al
add rcx, 0x22
cmp rcx, 0x44
jb 0x14000e4d0
mov byte [rbp - 0x6b], 0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x51]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movaps xmm1, xmm6
movaps xmm0, xmm9
call fcn.140023750
movaps xmm0, xmmword [0x1400482b0]
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x48], xmm1
mov dword [rbp - 8], 0x3f800000
mov dword [rbp - 4], 0x3f800000
mov qword [rbp - 0x60], 0
mov dword [rbp], 0x43160000
mov dword [rbp + 4], 0x43480000
lea rax, [rbp + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
lea r9, [rbp - 8]
lea r8, [rbp - 0x60]
lea rdx, [rbp]
mov rcx, qword [0x1400b2a90]
call fcn.14003cb90
test al, al
je 0x14000ea23
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140001e60
nop
mov r8d, 0xc
lea rdx, str.mpnotify.exe
lea rcx, [rsp + 0x50]
call fcn.140001e80
nop
lea rcx, [rsp + 0x50]
call fcn.14000ca50
nop
lea rcx, [rsp + 0x50]
call fcn.1400019a0
mov ecx, 0x28
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm1, xmmword [str.f_:1]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140048180]
movdqu xmmword [rsp + 0x60], xmm2
mov r8b, 3
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
xor r8b, cl
mov byte [rsp + 0x70], r8b
mov byte [rsp + 0x71], 0
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x51]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rbp + 0x10], 0
je 0x14000e85f
mov ecx, 0xb8
call fcn.14003e960
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movzx edx, byte [rbp - 0x28]
movzx ecx, byte [rbp - 0x50]
add edx, ecx
movzx ecx, byte [rbp - 0x54]
add edx, ecx
movzx ecx, r13b
add edx, ecx
movzx eax, r12b
add edx, eax
movzx eax, r15b
add edx, eax
movzx eax, r14b
add edx, eax
movzx eax, sil
add edx, eax
mov r8, rdi
mov rcx, rbx
call fcn.14000c330
nop
mov byte [rax + 0x82], 1
mov qword [0x1400b2b00], rax
jmp 0x14000ea23
movdqa xmm1, xmmword [str._EYY_]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140048310]
movdqa xmmword [rsp + 0x60], xmm2
movdqa xmm3, xmmword [0x1400482f0]
movdqa xmmword [rsp + 0x70], xmm3
movdqa xmm4, xmmword [0x1400482d0]
movdqa xmmword [rbp - 0x80], xmm4
mov cl, 0x5e
xor r8b, r8b
movzx r9d, cl
mov r10b, 0x4e
mov r11b, 0x5f
mov bl, 0x44
mov dil, 0x5d
mov sil, 0x59
mov r14b, 2
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], dl
xor byte [rsp + 0x53], dl
xor byte [rsp + 0x54], dl
xor byte [rsp + 0x55], dl
xor byte [rsp + 0x56], dl
xor byte [rsp + 0x57], dl
xor byte [rsp + 0x58], dl
xor byte [rsp + 0x59], dl
xor byte [rsp + 0x5a], dl
xor byte [rsp + 0x5b], dl
xor byte [rsp + 0x5c], dl
xor byte [rsp + 0x5d], dl
xor byte [rsp + 0x5e], dl
xor byte [rsp + 0x5f], dl
movd eax, xmm2
xor al, dl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], dl
xor byte [rsp + 0x62], dl
xor byte [rsp + 0x63], dl
xor byte [rsp + 0x64], dl
xor byte [rsp + 0x65], dl
xor byte [rsp + 0x66], dl
xor byte [rsp + 0x67], dl
xor byte [rsp + 0x68], dl
xor byte [rsp + 0x69], dl
xor byte [rsp + 0x6a], dl
xor byte [rsp + 0x6b], dl
xor byte [rsp + 0x6c], dl
xor byte [rsp + 0x6d], dl
xor byte [rsp + 0x6e], dl
xor byte [rsp + 0x6f], dl
movd eax, xmm3
xor al, dl
mov byte [rsp + 0x70], al
xor byte [rsp + 0x71], dl
xor byte [rsp + 0x72], dl
xor byte [rsp + 0x73], dl
xor byte [rsp + 0x74], dl
xor byte [rsp + 0x75], dl
xor byte [rsp + 0x76], dl
xor byte [rsp + 0x77], dl
xor byte [rsp + 0x78], dl
xor byte [rsp + 0x79], dl
xor byte [rsp + 0x7a], dl
xor byte [rsp + 0x7b], dl
xor byte [rsp + 0x7c], dl
xor byte [rsp + 0x7d], dl
xor byte [rsp + 0x7e], dl
xor byte [rsp + 0x7f], dl
movd eax, xmm4
xor al, dl
mov byte [rbp - 0x80], al
xor byte [rbp - 0x7f], dl
xor byte [rbp - 0x7e], dl
xor byte [rbp - 0x7d], dl
xor byte [rbp - 0x7c], dl
xor byte [rbp - 0x7b], dl
xor byte [rbp - 0x7a], dl
xor byte [rbp - 0x79], dl
xor byte [rbp - 0x78], dl
xor byte [rbp - 0x77], dl
xor byte [rbp - 0x76], dl
xor byte [rbp - 0x75], dl
xor byte [rbp - 0x74], dl
xor byte [rbp - 0x73], dl
xor byte [rbp - 0x72], dl
xor byte [rbp - 0x71], dl
xor cl, dl
mov byte [rbp - 0x70], cl
xor r8b, dl
mov byte [rbp - 0x6f], r8b
xor r9b, dl
mov byte [rbp - 0x6e], r9b
xor r10b, dl
mov byte [rbp - 0x6d], r10b
xor r11b, dl
mov byte [rbp - 0x6c], r11b
xor bl, dl
mov byte [rbp - 0x6b], bl
xor dil, dl
mov byte [rbp - 0x6a], dil
xor sil, dl
mov byte [rbp - 0x69], sil
xor r14b, dl
mov byte [rbp - 0x68], r14b
mov byte [rbp - 0x67], 0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x51]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 1
call fcn.140019460
mov rcx, qword [rbp + 0x88]
xor rcx, rsp
call fcn.14003e940
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret