Function at 0x140001a00
Capabilities:
Access pe header
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x78]
sub rsp, 0x140
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rbp], rax
mov rax, rdx
mov qword [rsp + 0x70], r9
mov rsi, r8
mov qword [rbp - 0x78], r8
mov r15, rcx
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140001ae9
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r13d, 4
mov edx, eax
xor ecx, ecx
mov edi, eax
mov r9d, r13d
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov rdx, rax
mov qword [rbp - 0x60], rax
mov r8d, edi
mov rcx, r14
mov r12, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140001ad7
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12, r12
jne 0x140001c79
cmp dword [0x140007018], 2
mov eax, dword [str.WP7_]
movsd xmm0, qword [0x1400054c8]
mov dword [rsp + 0x78], eax
movzx eax, byte [0x1400054d4]
mov byte [rsp + 0x7c], al
movsd qword [rsp + 0x70], xmm0
jl 0x140001c2a
movdqa xmm2, xmmword [0x140005600]
mov esi, 5
movdqa xmm3, xmmword [0x140005610]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x140005680]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
mov eax, 0x1f
punpckldq xmm1, xmm2
mov ebx, 8
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movd xmm6, esi
movd xmm5, eax
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140005640]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [0x1400054c8]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140005650]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140005670]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rsp + 0x70], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140005640]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x74]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140005650]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140005670]
xorps xmm2, xmm0
movd dword [rsp + 0x74], xmm2
movsxd rax, ebx
lea r8, [rsp + 0x70]
add r8, rax
nop word [rax + rax]
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, bl
inc ebx
sub al, cl
add al, 0x32
xor byte [r8 - 1], al
cmp ebx, 0xd
jl 0x140001c40
lea rcx, [rsp + 0x70]
jmp 0x140002ba4
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r14, rax
test rax, rax
jne 0x140001e58
cmp dword [0x140007018], 2
movzx eax, word [0x140005548]
movups xmm0, xmmword [str._BTZ_]
mov word [rbp - 8], ax
movzx eax, byte [0x14000554a]
mov byte [rbp - 6], al
movups xmmword [rbp - 0x18], xmm0
jl 0x140001e0a
movdqa xmm0, xmmword [0x140005670]
lea rcx, [rbp - 0x14]
movdqa xmm5, xmmword [0x140005600]
mov esi, 5
movdqa xmm4, xmmword [0x140005680]
mov eax, 0x1f
movdqa xmm7, xmmword [0x140005640]
movdqa xmmword [rsp + 0x70], xmm0
mov edx, dword [rsp + 0x70]
movd xmm6, esi
movd xmm8, eax
nop dword [rax]
movd xmm2, ebx
lea eax, [rbx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ebx, 8
pmuldq xmm1, xmm4
mov eax, ebx
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140005650]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140005650]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp ebx, 0x10
jl 0x140001d00
cmp eax, 0x13
jge 0x140001e4f
movsxd rax, ebx
lea r8, [rbp - 0x18]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, bl
inc ebx
sub al, cl
add al, 0x32
xor byte [r8 - 1], al
cmp ebx, 0x13
jl 0x140001e20
lea rcx, [rbp - 0x18]
jmp 0x140002ba4
mov dword [rsp + 0x40], ebx
nop dword [rax]
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, 0x14
mov dword [rbp - 0x50], eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x140001e60
test edi, edi
je 0x1400029de
mov rax, qword [rbp + 0xa0]
mov qword [rbp - 0x80], rbx
cmp byte [rax], 0x31
jne 0x140001f02
cmp byte [rax + 1], bl
jne 0x140001f02
call fcn.1400030d0
mov qword [rbp - 0x80], rax
mov rcx, rax
test rax, rax
je 0x140001f74
mov eax, dword [rsp + 0x40]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea rdx, [rbp - 0x70]
mov eax, dword [r14 + 0x50]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x18]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x58], rcx
mov dword [rbp - 0x14], 0xb
mov qword [rsp + 0x48], rbx
jmp 0x140001f5e
mov qword [rsp + 0x50], rcx
lea rax, [rbp - 0x80]
movzx ecx, byte [rsi]
mov qword [rsp + 0x58], rax
mov eax, dword [r14 + 0x50]
mov dword [rsp + 0x60], eax
sub ecx, 0x31
jne 0x140001f29
movzx ecx, byte [rsi + 1]
movzx eax, bl
sub ecx, eax
mov eax, 0x40
mov dword [rbp - 0x14], 3
test ecx, ecx
mov qword [rbp - 0x70], rbx
lea r8, [rbp - 0x70]
cmove eax, r13d
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x64], eax
lea rax, [rsp + 0x50]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov dword [rbp - 0x18], 0x3262
xor ecx, ecx
call qword [0x140007728]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
jne 0x140002159
cmp byte [0x140005569], bl
movups xmm0, xmmword [str.tR_YSS]
movzx eax, word [0x140005568]
mov word [rsp + 0x68], ax
movups xmmword [rsp + 0x50], xmm0
movsd xmm0, qword [0x140005560]
movsd qword [rsp + 0x60], xmm0
je 0x14000214f
cmp dword [0x140007018], 2
jl 0x14000210a
movdqa xmm0, xmmword [0x140005670]
lea rcx, [rsp + 0x54]
movdqa xmm5, xmmword [0x140005600]
mov esi, 5
movdqa xmm4, xmmword [0x140005680]
mov eax, 0x1f
movdqa xmm7, xmmword [0x140005640]
movdqa xmmword [rsp + 0x70], xmm0
mov edx, dword [rsp + 0x70]
movd xmm6, esi
movd xmm8, eax
nop
movd xmm2, ebx
lea eax, [rbx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ebx, 8
pmuldq xmm1, xmm4
mov eax, ebx
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140005650]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140005650]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp ebx, 0x18
jl 0x140002000
cmp eax, 0x1a
jge 0x14000214f
movsxd rax, ebx
lea r8, [rsp + 0x50]
add r8, rax
nop word [rax + rax]
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, bl
inc ebx
sub al, cl
add al, 0x32
xor byte [r8 - 1], al
cmp ebx, 0x1a
jl 0x140002120
lea rcx, [rsp + 0x50]
jmp 0x140002ba4
mov r8, r14
mov rdx, r12
call fcn.140001620
test eax, eax
jne 0x140002399
mov eax, dword [rsp + 0x40]
lea r8, [rbp - 0x70]
mov qword [rsp + 0x70], rax
lea rdx, [rbp - 0x50]
mov rax, qword [rbp - 0x80]
xor r9d, r9d
mov qword [rsp + 0x78], rax
xor ecx, ecx
lea rax, [rsp + 0x70]
mov dword [rbp - 0x18], 0x3262
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x18]
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x14], r13d
mov qword [rbp - 0x70], rbx
call qword [0x140007728]
cmp byte [0x140005511], bl
movups xmm0, xmmword [0x1400054f8]
movzx eax, word [0x140005510]
mov word [rsp + 0x68], ax
movups xmmword [rsp + 0x50], xmm0
movsd xmm0, qword [0x140005508]
movsd qword [rsp + 0x60], xmm0
je 0x14000214f
cmp dword [0x140007018], 2
jl 0x14000234e
movdqa xmm0, xmmword [0x140005670]
lea rcx, [rsp + 0x54]
movdqa xmm5, xmmword [0x140005600]
mov esi, 5
movdqa xmm4, xmmword [0x140005680]
mov eax, 0x1f
movdqa xmm7, xmmword [0x140005640]
movdqa xmmword [rsp + 0x70], xmm0
mov edx, dword [rsp + 0x70]
movd xmm6, esi
movd xmm8, eax
nop dword [rax]
nop word [rax + rax]
movd xmm2, ebx
lea eax, [rbx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ebx, 8
pmuldq xmm1, xmm4
mov eax, ebx
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140005650]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140005650]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp ebx, 0x18
jl 0x140002240
cmp eax, 0x1a
jge 0x14000214f
movsxd rax, ebx
lea r8, [rsp + 0x50]
add r8, rax
nop dword [rax]
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, bl
inc ebx
sub al, cl
add al, 0x32
xor byte [r8 - 1], al
cmp ebx, 0x1a
jl 0x140002360
lea rcx, [rsp + 0x50]
jmp 0x140002ba4
mov r9, r14
mov r8, r12
call fcn.1400017b0
test eax, eax
jne 0x1400025d9
mov eax, dword [rsp + 0x40]
lea r8, [rbp - 0x70]
mov qword [rsp + 0x70], rax
lea rdx, [rbp - 0x50]
mov rax, qword [rbp - 0x80]
xor r9d, r9d
mov qword [rsp + 0x78], rax
xor ecx, ecx
lea rax, [rsp + 0x70]
mov dword [rbp - 0x18], 0x3262
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x18]
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x14], r13d
mov qword [rbp - 0x70], rbx
call qword [0x140007728]
cmp dword [0x140007018], 2
movups xmm0, xmmword [0x140005518]
movzx eax, word [0x140005530]
mov word [rsp + 0x68], ax
movzx eax, byte [0x140005532]
movups xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x6a], al
movsd xmm0, qword [0x140005528]
movsd qword [rsp + 0x60], xmm0
jl 0x14000258a
movdqa xmm0, xmmword [0x140005670]
lea rcx, [rsp + 0x54]
movdqa xmm5, xmmword [0x140005600]
mov esi, 5
movdqa xmm4, xmmword [0x140005680]
mov eax, 0x1f
movdqa xmm7, xmmword [0x140005640]
movdqa xmmword [rsp + 0x70], xmm0
mov edx, dword [rsp + 0x70]
movd xmm6, esi
movd xmm8, eax
nop dword [rax]
nop word [rax + rax]
movd xmm2, ebx
lea eax, [rbx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ebx, 8
pmuldq xmm1, xmm4
mov eax, ebx
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140005650]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140005650]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp ebx, 0x18
jl 0x140002480
cmp eax, 0x1b
jge 0x1400025cf
movsxd rax, ebx
lea r8, [rsp + 0x50]
add r8, rax
nop word [rax + rax]
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, bl
inc ebx
sub al, cl
add al, 0x32
xor byte [r8 - 1], al
cmp ebx, 0x1b
jl 0x1400025a0
lea rcx, [rsp + 0x50]
jmp 0x140002ba4
movzx edi, word [r14 + 0x14]
movzx esi, bx
movzx eax, word [r14 + 6]
add rdi, 0x28
mov r13, qword [rbp - 0x80]
cmp bx, ax
jae 0x14000266e
mov r15d, dword [rsp + 0x40]
add rdi, r14
nop dword [rax + rax]
mov eax, dword [rdi - 4]
lea r8, [rbp - 0x70]
add rax, r13
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x48]
mov eax, dword [rdi]
xor r9d, r9d
mov dword [rsp + 0x60], eax
xor ecx, ecx
mov eax, dword [rdi + 4]
add rax, r12
mov dword [rbp - 0x18], 0x3262
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x50]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x48], rax
mov dword [rbp - 0x14], 1
mov qword [rbp - 0x70], rbx
call qword [0x140007728]
movzx eax, word [r14 + 6]
lea rdi, [rdi + 0x28]
inc si
cmp si, ax
jb 0x140002600
mov r13, qword [rbp - 0x80]
movzx esi, word [r14 + 0x14]
movzx r15d, bx
mov ecx, dword [rsp + 0x40]
add rsi, 0x28
cmp bx, ax
jae 0x140002735
add rsi, r14
mov r12d, ecx
nop
mov eax, dword [rsi]
test eax, eax
je 0x14000271e
test dword [rsi + 0x14], 0x2000000
je 0x14000271e
xor ecx, ecx
mov edx, eax
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [rsi - 4]
lea r8, [rbp - 0x70]
add rcx, r13
mov qword [rsp + 0x68], rax
mov rdi, rax
mov qword [rsp + 0x58], rcx
mov ecx, dword [rsi]
lea rax, [rsp + 0x50]
mov qword [rbp - 0x10], rax
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x60], ecx
lea rax, [rbp - 0x18]
xor ecx, ecx
mov qword [rsp + 0x50], r12
xor r9d, r9d
mov dword [rbp - 0x18], 0x3262
mov dword [rbp - 0x14], 1
mov qword [rsp + 0x48], rax
mov qword [rbp - 0x70], rbx
call qword [0x140007728]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
inc r15w
add rsi, 0x28
cmp r15w, word [r14 + 6]
jb 0x140002690
mov r12, qword [rbp - 0x60]
lea rcx, str.___udman_X_damage___Injected__
call fcn.140001010
mov rax, qword [rbp - 0x78]
cmp byte [rax], 0x31
jne 0x14000289a
cmp byte [rax + 1], bl
jne 0x14000289a
mov rax, qword [rbp - 0x80]
lea r8, [rbp - 0x78]
mov r15d, dword [rsp + 0x40]
lea rdx, [rbp - 0x60]
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
lea rax, [rbp - 0x48]
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov dword [rbp - 0x18], 0x3262
mov qword [rbp - 0x10], rax
xor ecx, ecx
lea rax, [rbp - 0x18]
mov dword [rbp - 0x14], 7
mov qword [rbp - 0x60], rax
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x78], rbx
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
call qword [0x140007728]
mov rdi, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x30]
add rcx, rdi
cmp rdi, rcx
jae 0x14000295f
mov esi, 5
movabs r13, 0x7fffffffffffffff
nop dword [rax + rax]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x60], rax
lea r8, [rbp - 0x78]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r15
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x58], rdi
xor r9d, r9d
mov qword [rbp - 0x60], rax
xor ecx, ecx
mov dword [rbp - 0x18], 0x3262
mov dword [rbp - 0x14], esi
mov qword [rbp - 0x78], rbx
call qword [0x140007728]
mov rax, qword [rsp + 0x48]
lea r8, [rbp - 0x78]
and rax, r13
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], rax
lea rdx, [rbp - 0x60]
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x58], rdi
mov qword [rbp - 0x68], rax
xor ecx, ecx
lea rax, [rbp - 0x70]
mov dword [rbp - 0x70], 0x3262
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x6c], 6
mov qword [rbp - 0x78], rbx
call qword [0x140007728]
mov rcx, qword [rbp - 0x48]
add rdi, 0x1000
add rcx, qword [rbp - 0x30]
cmp rdi, rcx
jb 0x1400027e0
jmp 0x14000295f
cmp byte [rax], 0x32
jne 0x14000295f
cmp byte [rax + 1], bl
jne 0x14000295f
mov eax, dword [rsp + 0x40]
lea r8, [rbp - 0x78]
mov qword [rsp + 0x50], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp - 0x80]
xor r9d, r9d
mov qword [rsp + 0x58], rax
xor ecx, ecx
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x18]
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x18], 0x3262
mov dword [rbp - 0x14], 8
mov qword [rbp - 0x78], rbx
call qword [0x140007728]
mov eax, dword [rsp + 0x48]
lea r8, [rbp - 0x78]
mov ecx, dword [rsp + 0x40]
lea rdx, [rbp - 0x60]
and eax, 0xfffff27f
mov qword [rsp + 0x50], rcx
mov rcx, qword [rbp - 0x80]
bts eax, 9
mov dword [rsp + 0x48], eax
xor r9d, r9d
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x50]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x58], rcx
xor ecx, ecx
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x18], 0x3262
mov dword [rbp - 0x14], 9
mov qword [rbp - 0x78], rbx
call qword [0x140007728]
mov r8, qword [rbp - 0x80]
mov r9, r14
mov edx, dword [rbp - 0x50]
mov ecx, dword [rsp + 0x40]
call fcn.140002bf0
mov rax, qword [rsp + 0x70]
cmp byte [rax], 0x31
jne 0x1400029c8
cmp byte [rax + 1], bl
jne 0x1400029c8
mov eax, dword [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x78]
mov rax, qword [rbp - 0x80]
xor r9d, r9d
mov qword [rbp - 0x58], rax
xor ecx, ecx
lea rax, [rbp - 0x60]
mov dword [rbp - 0x18], 0x3262
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x18]
mov qword [rbp - 0x78], rax
mov dword [rbp - 0x14], 0xa
mov qword [rsp + 0x70], rbx
call qword [0x140007728]
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140002bb0
movups xmm1, xmmword [0x1400054e8]
movups xmm0, xmmword [0x1400054d8]
movups xmmword [rsp + 0x60], xmm1
psrldq xmm1, 0xf
movd eax, xmm1
movups xmmword [rsp + 0x50], xmm0
test al, al
je 0x140002b9f
cmp dword [0x140007018], 2
jl 0x140002b65
movdqa xmm0, xmmword [0x140005670]
lea rcx, [rsp + 0x54]
movdqa xmm5, xmmword [0x140005600]
mov esi, 5
movdqa xmm4, xmmword [0x140005680]
mov eax, 0x1f
movdqa xmm7, xmmword [0x140005640]
movdqa xmmword [rsp + 0x70], xmm0
mov edx, dword [rsp + 0x70]
movd xmm6, esi
movd xmm8, eax
nop word [rax + rax]
movd xmm2, ebx
lea eax, [rbx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ebx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140005650]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140005650]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp ebx, 0x20
jl 0x140002a60
jmp 0x140002b9f
lea r8, [rsp + 0x50]
nop word [rax + rax]
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, bl
inc ebx
sub al, cl
add al, 0x32
xor byte [r8 - 1], al
cmp ebx, 0x20
jl 0x140002b70
lea rcx, [rsp + 0x50]
call fcn.140001010
nop dword [rax]
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140003840
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x58]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret