Function at 0x140005cb0
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Create thread
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x398]
sub rsp, 0x480
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x14006a020]
xor rax, rsp
mov qword [rbp + 0x350], rax
xor r12d, r12d
mov dword [rbp + 0x60], r12d
lea ecx, [r12 + 8]
call fcn.140025ba0
lea rcx, [0x140009830]
mov qword [rax], rcx
mov qword [rbp + 0xa0], rax
lea rcx, [rbp + 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x1400180f0]
xor edx, edx
xor ecx, ecx
call fcn.14002f920
mov qword [rbp + 0x70], rax
test rax, rax
je 0x140006d2e
cmp dword [rbp + 0x78], r12d
je 0x140006d3d
movaps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0xf0], xmm0
lea rcx, [rbp + 0xf0]
call fcn.140023c3c
test eax, eax
jne 0x140006d48
cmp qword [0x14006d3a0], 0xa
jne 0x140006cb2
cmp qword [0x14006d3c0], 0x40
jne 0x140006cb2
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
mov qword [rbp + 0x1e0], r12
mov ebx, r12d
mov qword [rbp + 0x1f0], rbx
mov edi, 0xf
mov qword [rbp + 0x1f8], rdi
mov byte [rbp + 0x1e0], bl
lea rcx, [rbp + 0x200]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
mov qword [rsp + 0x40], r12
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x200]
call qword [sym.imp.RPCRT4.dll_UuidToStringA]
test eax, eax
jne 0x140005e15
mov rdx, qword [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140005de6
lea rcx, [rbp + 0x1e0]
call fcn.14000d6c0
lea rcx, [rsp + 0x40]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeA]
mov rdi, qword [rbp + 0x1f8]
mov rbx, qword [rbp + 0x1f0]
mov qword [rbp + 0x180], r12
mov qword [rbp + 0x190], r12
mov qword [rbp + 0x198], 0xf
mov byte [rbp + 0x180], 0
mov qword [rbp + 0x160], r12
mov qword [rbp + 0x170], r12
mov qword [rbp + 0x178], 0xf
mov r8d, 0x10
cmp rbx, r8
cmovb r8, rbx
lea rdx, [rbp + 0x1e0]
cmp rdi, 0x10
cmovae rdx, qword [rbp + 0x1e0]
lea rcx, [rbp + 0x160]
call fcn.14000d6c0
movups xmm6, xmmword [rbp + 0x160]
movups xmmword [rbp + 0x180], xmm6
movups xmm7, xmmword [rbp + 0x170]
movups xmmword [rbp + 0x190], xmm7
mov word [rbp + 0x60], 0x2d
mov byte [rbp + 0x62], 0
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xb8], r12
mov qword [rbp + 0xc0], 0xf
mov byte [rbp + 0xa8], 0
mov r8d, 1
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0xa8]
call fcn.14000d6c0
nop
lea r8, [rbp + 0x180]
movq rcx, xmm6
movdqa xmm0, xmm7
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
cmovae r8, rcx
movq r9, xmm7
lea rcx, [rbp + 0xa8]
call fcn.1400121b0
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0x10
jb 0x140005f7e
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d50
call fcn.140025930
mov qword [rbp + 0xb8], r12
mov qword [rbp + 0xc0], 0xf
mov byte [rbp + 0xa8], 0
lea rdx, [0x14006d3b0]
cmp qword [0x14006d3c8], 0x10
cmovae rdx, qword [0x14006d3b0]
mov r8, qword [0x14006d3c0]
lea rcx, [rbp + 0x70]
call fcn.14000b4c0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1b0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0x1a0]
lea rcx, [0x14006d5c8]
call fcn.14000b5b0
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0x10
jb 0x140006037
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006031
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d56
call fcn.140025930
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x140006075
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006070
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d5c
call fcn.140025930
lea rcx, [rbp + 0x290]
call fcn.1400093e0
nop
mov dword [rbp + 0x70], 0x6e8891db
mov dword [rbp + 0x74], 0x606a7064
mov word [rbp + 0x78], 0x38
mov byte [rbp + 0x7a], 1
mov dword [rbp + 0xa0], 0x6d9e90db
mov dword [rbp + 0xa4], 0x1003f64
mov dword [rbp + 0x90], 0x63919bdb
mov dword [rbp + 0x94], 0x397a676a
mov word [rbp + 0x98], 0x100
mov dword [rbp + 0xc8], 0x739e96db
mov dword [rbp + 0xcc], 0x1003f69
mov dword [rbp + 0x60], 0x729a88db
mov word [rbp + 0x64], 0x3c
mov byte [rbp + 0x66], 1
mov dword [rbp + 0xf0], 0x658f8789
mov dword [rbp + 0xf4], 0x6d6d6b3c
mov word [rbp + 0xf8], 0x71
mov byte [rbp + 0xfa], 1
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x1a0]
call fcn.140006fa0
nop
lea rdx, [0x14006d3d0]
cmp qword [0x14006d3e8], 0x10
cmovae rdx, qword [0x14006d3d0]
mov r8, qword [0x14006d3e0]
mov rcx, rax
call fcn.14000b4c0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rbp + 0xc8]
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x270]
call fcn.140007130
nop
lea rdx, [rbp + 0x290]
cmp qword [rbp + 0x2a8], 0x10
cmovae rdx, qword [rbp + 0x290]
mov r8, qword [rbp + 0x2a0]
mov rcx, rax
call fcn.14000b4c0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rbp + 0x90]
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x250]
call fcn.140007250
nop
lea rdx, [rbp + 0x180]
cmp qword [rbp + 0x198], 0x10
cmovae rdx, qword [rbp + 0x180]
mov r8, qword [rbp + 0x190]
mov rcx, rax
call fcn.14000b4c0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2b0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2c0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rbp + 0xa0]
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x230]
call fcn.140007130
nop
lea rdx, [0x14006d370]
cmp qword [0x14006d388], 0x10
cmovae rdx, qword [0x14006d370]
mov r8, qword [0x14006d380]
mov rcx, rax
call fcn.14000b4c0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xa8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xb8], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x210]
call fcn.140007370
nop
lea rdx, [0x14006d390]
cmp qword [0x14006d3a8], 0x10
cmovae rdx, qword [0x14006d390]
mov r8, qword [0x14006d3a0]
mov rcx, rax
call fcn.14000b4c0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x160], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x170], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r15d, 0x7ff
mov rdx, qword [rbp + 0x228]
cmp rdx, 0x10
jb 0x14000634e
inc rdx
mov rcx, qword [rbp + 0x210]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006349
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d62
call fcn.140025930
mov qword [rbp + 0x220], r12
mov qword [rbp + 0x228], 0xf
mov byte [rbp + 0x210], 0
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0x10
jb 0x1400063a9
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400063a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d68
call fcn.140025930
nop
mov rdx, qword [rbp + 0x248]
cmp rdx, 0x10
jb 0x1400063ea
inc rdx
mov rcx, qword [rbp + 0x230]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400063e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d6e
call fcn.140025930
mov qword [rbp + 0x240], r12
mov qword [rbp + 0x248], 0xf
mov byte [rbp + 0x230], 0
mov rdx, qword [rbp + 0x2c8]
cmp rdx, 0x10
jb 0x140006445
inc rdx
mov rcx, qword [rbp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000643f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d74
call fcn.140025930
nop
mov rdx, qword [rbp + 0x268]
cmp rdx, 0x10
jb 0x140006486
inc rdx
mov rcx, qword [rbp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006481
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d7a
call fcn.140025930
mov qword [rbp + 0x260], r12
mov qword [rbp + 0x268], 0xf
mov byte [rbp + 0x250], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0x10
jb 0x1400064e1
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400064db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d80
call fcn.140025930
nop
mov rdx, qword [rbp + 0x288]
cmp rdx, 0x10
jb 0x140006522
inc rdx
mov rcx, qword [rbp + 0x270]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000651d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d86
call fcn.140025930
mov qword [rbp + 0x280], r12
mov qword [rbp + 0x288], 0xf
mov byte [rbp + 0x270], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x14000657d
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006577
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d8c
call fcn.140025930
nop
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0x10
jb 0x1400065be
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d92
call fcn.140025930
mov qword [rbp + 0x1b0], r12
mov qword [rbp + 0x1b8], 0xf
mov byte [rbp + 0x1a0], 0
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x48], rax
lea rdx, [0x14006d3f0]
lea rcx, [rbp + 0xd0]
call fcn.14000b690
mov r14, rax
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xb8], r12
mov qword [rbp + 0xc0], r12
lea rsi, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae rsi, qword [rbp + 0x160]
mov rdi, qword [rbp + 0x170]
cmp rdi, 0x10
jae 0x14000664c
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xc0], 0xf
jmp 0x1400066cc
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400066a0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140006d98
mov rcx, rax
call fcn.140025ba0
mov rcx, rax
test rax, rax
je 0x140006d9e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400066af
test rcx, rcx
je 0x1400066ac
call fcn.140025ba0
jmp 0x1400066af
mov rax, r12
mov qword [rbp + 0xa8], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.140027df0
mov qword [rbp + 0xc0], rbx
mov qword [rbp + 0xb8], rdi
mov r8, r14
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x1c0]
call fcn.140008a80
nop
movdqa xmm0, xmmword [0x1400613e0]
movdqu xmmword [rbp + 0x70], xmm0
mov byte [rbp + 0x80], 1
cmp qword [rbp + 0x1d0], 0x10
jne 0x1400067ae
mov rcx, r12
nop
lea eax, [rcx - 3]
xor byte [rbp + rcx + 0x70], al
inc rcx
cmp rcx, 0xf
jb 0x140006710
mov byte [rbp + 0x80], 0
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x108], 0xf
mov r8d, 0xf
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0xf0]
call fcn.14000d6c0
mov r15d, 0x1fff
lea rdx, [rbp + 0xf0]
mov rbx, qword [rbp + 0xf0]
mov rdi, qword [rbp + 0x108]
cmp rdi, 0x10
cmovae rdx, rbx
lea rcx, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 0x10
cmovae rcx, qword [rbp + 0x1c0]
mov r8, qword [rbp + 0x1d0]
cmp r8, qword [rbp + 0x100]
jne 0x1400067bc
call fcn.1400286e0
test eax, eax
jne 0x1400067bc
mov sil, 1
jmp 0x1400067c6
mov rdi, qword [rbp + 0x108]
mov rbx, qword [rbp + 0xf0]
xor sil, sil
bt r15d, 0xb
jae 0x140006806
cmp rdi, 0x10
jb 0x1400067fd
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400067f5
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006da4
mov rcx, rbx
call fcn.140025930
test sil, sil
jne 0x140006daa
mov qword [rbp + 0x148], r12
lea r8, [rbp + 0x110]
lea rdx, [rbp + 0x1c0]
lea rcx, [rsp + 0x30]
call fcn.14000f570
nop
mov dword [rbp + 0x50], 0x738c9b90
mov dword [rbp + 0x54], 0x666560
mov byte [rbp + 0x58], 1
mov rcx, r12
nop dword [rax + rax]
lea eax, [rcx - 3]
xor byte [rbp + rcx + 0x50], al
inc rcx
cmp rcx, 7
jb 0x140006840
mov byte [rbp + 0x58], 0
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xb8], r12
mov qword [rbp + 0xc0], 0xf
mov byte [rbp + 0xa8], 0
lea r8, [rbp + 0x57]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0xa8]
call fcn.140011260
nop
lea rdx, [rbp + 0xa8]
lea rcx, [rsp + 0x30]
call fcn.14000ab20
lea rdx, [rbp + 0x330]
mov rcx, rax
call fcn.14000f2f0
nop
lea rcx, [rbp + 0xa8]
call fcn.14000b550
lea rcx, [rsp + 0x50]
call fcn.14000a390
nop
lea rcx, [rbp + 0xa8]
call fcn.14000b190
nop
mov r14, qword [rbp + 0xb0]
mov rdi, r14
mov rsi, qword [rbp + 0xa8]
sub rdi, rsi
lea rcx, [rbp + 0x1c0]
call fcn.14000b4b0
mov rbx, rax
lea rcx, [0x14006d3b0]
call fcn.14000b4b0
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
mov r9, qword [rbp + 0x1d0]
mov r8, rbx
mov rdx, qword [0x14006d3c0]
mov rcx, rax
call fcn.14001b040
cmp rsi, r14
je 0x14000697c
nop word [rax + rax]
movzx edi, byte [rsi]
lea rcx, [rsp + 0x60]
call fcn.14000b100
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0x30
call fcn.140011050
mov edx, 2
lea rcx, [rbp + 0x70]
call fcn.140023758
mov rdx, rax
mov rcx, rbx
call fcn.14000f6c0
mov edx, edi
mov rcx, rax
call fcn.14000ae60
inc rsi
cmp rsi, r14
jne 0x140006930
lea rcx, [0x14006ac40]
call fcn.14000b4b0
mov rbx, rax
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x50]
call fcn.14000a2d0
mov rcx, rax
call fcn.14000b4b0
mov rdx, rbx
mov rcx, rax
call fcn.1400097b0
movzx ebx, al
lea rcx, [rbp + 0xd0]
call fcn.14000b550
test bl, bl
jne 0x1400069e4
lea r8, [rbp + 0x330]
lea rdx, str.Signature_checksum_failed._Request_was_tampered_with_or_session_ended_most_likely.__echo:__echo_Message:
lea rcx, [rbp + 0xd0]
call fcn.14000f130
mov rcx, rax
call fcn.140008e90
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x70]
call fcn.14000ace0
mov rdx, rax
lea rcx, [0x14006d370]
call fcn.140005300
mov dword [rbp + 0x50], 0x639c8b8e
mov dword [rbp + 0x54], 0x707164
mov byte [rbp + 0x58], 1
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x50]
call fcn.14000a530
nop
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x30]
call fcn.14000ab20
lea rcx, [rax + 8]
cmp byte [rax], 4
cmovne rcx, r12
movzx ebx, byte [rcx]
lea rcx, [rbp + 0xd0]
call fcn.14000b550
test bl, bl
je 0x140006c19
mov dword [rbp + 0x70], 0x53889b93
mov dword [rbp + 0x74], 0x6d707164
mov dword [rbp + 0x78], 0x100686a
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x70]
call fcn.140009c30
nop
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x30]
call fcn.14000ab20
lea rcx, [rax + 8]
cmp byte [rax], 4
cmovne rcx, r12
movzx ebx, byte [rcx]
lea rcx, [rbp + 0xd0]
call fcn.14000b550
test bl, bl
je 0x140006ab7
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x70], 0x738c9b8e
mov dword [rbp + 0x74], 0x6d6d6d68
mov word [rbp + 0x78], 0x61
mov byte [rbp + 0x7a], 1
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x70]
call fcn.14000a680
nop
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x30]
call fcn.14000ab20
mov rdx, rax
lea rcx, [0x14006d5a8]
call fcn.14000f2d0
nop
lea rcx, [rbp + 0xd0]
call fcn.14000b550
mov byte [0x14006d350], 1
mov dword [rbp + 0x50], 0x698f8e9c
mov dword [rbp + 0x54], 0x6c646f
mov byte [rbp + 0x58], 1
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x50]
call fcn.14000a530
nop
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x30]
call fcn.14000ab20
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.14000ace0
mov rdx, rax
call fcn.1400048e0
nop
lea rcx, [rbp + 0xd0]
call fcn.14000b550
nop
lea rcx, [rbp + 0xa8]
call fcn.14000b130
nop
lea rcx, [rsp + 0x50]
call fcn.140007520
nop
lea rcx, [rbp + 0x330]
call fcn.14000b550
nop
movzx edx, byte [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.14000cff0
nop
lea rcx, [rbp + 0x1c0]
call fcn.14000b550
nop
lea rcx, [rbp + 0x160]
call fcn.14000b550
nop
lea rcx, [rbp + 0x290]
call fcn.14000b550
nop
lea rcx, [rbp + 0x180]
call fcn.14000b550
nop
lea rcx, [rbp + 0x1e0]
call fcn.14000b550
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.140025910
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov dword [rbp + 0x70], 0x61899094
mov dword [rbp + 0x74], 0x72676b6d
mov dword [rbp + 0x78], 0x1007460
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0xf0]
call fcn.14000f6f0
nop
mov dword [rbp + 0x50], 0x738c9b90
mov dword [rbp + 0x54], 0x666560
mov byte [rbp + 0x58], 1
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x50]
call fcn.14000a530
nop
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x30]
call fcn.14000ab20
mov rcx, rax
lea rdx, [rbp + 0xf0]
call fcn.14000a6f0
movzx ebx, al
lea rcx, [rbp + 0xd0]
call fcn.14000b550
nop
movzx edx, byte [rbp + 0xf0]
lea rcx, [rbp + 0xf8]
call fcn.14000cff0
test bl, bl
jne 0x140006e23
jmp 0x140006b6a
movdqa xmm0, xmmword [0x140061420]
movdqa xmmword [rbp + 0x110], xmm0
movdqa xmm1, xmmword [0x140061440]
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmm0, xmmword [0x1400614b0]
movdqa xmmword [rbp + 0x130], xmm0
movdqa xmm1, xmmword [0x140061510]
movdqa xmmword [rbp + 0x140], xmm1
mov dword [rbp + 0x150], 0x23115054
mov dword [rbp + 0x154], 0x1003231
lea rcx, [rbp + 0x110]
call fcn.140006f70
mov rdx, rax
mov r9d, 0x10
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call fcn.14002c1d4
nop
mov dword [rbp + 0x78], r12d
mov ecx, 6
call fcn.140022ec0
nop
mov ecx, 1
call fcn.140022ec0
int3
mov ecx, eax
call fcn.140022e84
nop
call fcn.140033344
nop
call fcn.140033344
nop
call fcn.140033344
nop
call fcn.140033344
nop
call fcn.140033344
nop
call fcn.140033344
nop
call fcn.140033344
nop
call fcn.140033344
nop
call fcn.140033344
nop
call fcn.140033344
nop
call fcn.140033344
nop
call fcn.140033344
nop
call fcn.140001b80
int3
call fcn.140033344
nop
call fcn.140033344
int3
movdqa xmm0, xmmword [0x140061430]
movdqa xmmword [rbp + 0x110], xmm0
movdqa xmm1, xmmword [0x140061530]
movdqa xmmword [rbp + 0x120], xmm1
movdqa xmm0, xmmword [0x1400614c0]
movdqa xmmword [rbp + 0x130], xmm0
movdqa xmm1, xmmword [0x140061500]
movdqa xmmword [rbp + 0x140], xmm1
mov dword [rbp + 0x150], 0x115a4f
mov byte [rbp + 0x154], 1
lea rcx, [rbp + 0x110]
call fcn.140007490
mov rdx, rax
mov r9d, 0x10
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call fcn.14002c1d4
nop
mov dword [rbp + 0x90], 0x6e889199
mov dword [rbp + 0x94], 0x60626d6d
mov word [rbp + 0x98], 0x100
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x90]
call fcn.14000a610
nop
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x30]
call fcn.14000ab20
lea rdx, [rbp + 0x110]
mov rcx, rax
call fcn.14000f2f0
nop
lea rcx, [rbp + 0xd0]
call fcn.14000b550
lea rdx, [0x14005f41b]
lea rcx, [rbp + 0x110]
call fcn.14000f280
test al, al
je 0x140006f1f
movdqa xmm0, xmmword [0x140061520]
movdqa xmmword [rbp + 0x2d0], xmm0
movdqa xmm1, xmmword [0x140061480]
movdqa xmmword [rbp + 0x2e0], xmm1
movdqa xmm0, xmmword [0x1400614a0]
movdqa xmmword [rbp + 0x2f0], xmm0
movdqa xmm1, xmmword [0x1400614e0]
movdqa xmmword [rbp + 0x300], xmm1
movdqa xmm0, xmmword [0x140061470]
movdqa xmmword [rbp + 0x310], xmm0
mov dword [rbp + 0x320], 0x212139
mov byte [rbp + 0x324], 1
lea rcx, [rbp + 0x2d0]
call fcn.1400074c0
mov rdx, rax
mov r9d, 0x10
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140006f5f
lea rcx, [rbp + 0x110]
call fcn.14000b4b0
mov r8, rax
mov dword [rbp + 0x60], 0x6e9a8e92
mov word [rbp + 0x64], 0x100
lea rcx, [rbp + 0x60]
call fcn.1400074f0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.14002c1d4
int3