Function at 0x140002e80
Capabilities:
Authenticate hmac
Check if file exists
Create process on windows
Encode data using xor
Enumerate processes
Execute command
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x368]
sub rsp, 0x440
movaps xmmword [rax - 0x38], xmm6
xor r12d, r12d
mov r14d, r12d
mov dword [rbp + 0x388], r12d
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_BlueStacks_nxtHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [0x1400064f8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_BlueStacksHD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [0x1400064f8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_BlueStacks_msi2HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [0x1400064f8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_BlueStacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [0x1400064f8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramData_BlueStacks_msi5HD_Player.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [0x1400064f8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
lea rcx, str.netsh_advfirewall_firewall_delete_rule_nameall_program__ProgramFiles_x86__SmartGaGaProjectTitanEngineProjectTitan.exe_
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [0x1400064f8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x12c
mov r9d, 0x1f4
mov r8d, dword [rbp - 0x1c]
mov edx, dword [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.USER32.dll_MoveWindow]
lea rcx, [0x1400064f8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x140006798]
movups xmmword [rsp + 0x30], xmm0
movsd xmm0, qword [0x1400067a8]
movsd qword [rsp + 0x40], xmm0
cmp byte [0x1400067af], r12b
je 0x140003153
cmp dword [0x140009008], 2
jl 0x140003117
movdqa xmm5, xmmword [0x140006870]
mov edx, r12d
movdqa xmm4, xmmword [0x1400068b0]
movdqa xmm6, xmmword [str.::::]
movdqa xmm0, xmmword [str.6666666666666666_t]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rsp + 0x34]
mov r8d, dword [rbp - 0x50]
nop dword [rax]
movd xmm2, edx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140006890]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [rdx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140006890]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add edx, 8
lea rcx, [rcx + 8]
cmp edx, 0x18
jl 0x140003010
jmp 0x140003153
lea r9, [rsp + 0x30]
mov r8d, r12d
nop
mov eax, 0x8d3dcb09
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x3a
movzx eax, r8b
sub al, dl
add al, 0x36
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x18
jl 0x140003120
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003ff0
lea rdx, [0x1400041c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r13d, 0xf
xorps xmm0, xmm0
mov r10d, 0x16
movabs r9, 0x8000000000000000
movabs r8, 0x7fffffffffffffff
lea r11, [0x140009090]
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], 3
mov qword [rbp - 0x28], r13
mov eax, dword [0x140006740]
mov word [rbp - 0x40], ax
movzx eax, byte [0x140006742]
mov byte [rbp - 0x3e], al
mov byte [rbp - 0x3d], 0
cmp qword [0x1400090a8], 0xf
seta dl
mov r15, r11
cmova r15, qword [0x140009090]
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
mov rdi, qword [0x1400090a0]
mov rsi, r11
test dl, dl
cmovne rsi, qword [0x140009090]
cmp rdi, r8
ja 0x140003b77
cmp rdi, 0xf
ja 0x140003223
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], r13
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x68], xmm0
jmp 0x1400032a9
mov rbx, rdi
or rbx, 0xf
cmp rbx, r8
jbe 0x140003238
mov rbx, r8
lea rax, [r9 + 0x27]
jmp 0x14000325a
cmp rbx, 0x16
cmovb rbx, r10
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000327c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003b7d
mov rcx, rax
call fcn.140004638
mov rcx, rax
test rax, rax
je 0x1400038a2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000328b
test rcx, rcx
je 0x140003288
call fcn.140004638
jmp 0x14000328b
mov rax, r12
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
mov ecx, 0x20
call fcn.140004638
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea rbx, [rax + 0x20]
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x30]
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
lea rcx, [rsp + 0x30]
mov qword [rbp - 0x68], rcx
lea rdx, [rsp + 0x68]
mov rcx, rax
call fcn.140003c80
nop
mov rdx, rbx
mov rcx, rbx
call fcn.1400044a0
mov qword [rsp + 0x38], rbx
lea r9, [0x140003c20]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rsp + 0x68]
call fcn.140004674
mov dword [rbp + 0xf0], 0x130
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140003a7b
lea rdx, [rbp + 0xf0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140003a71
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r13
mov byte [rsp + 0x48], 0
nop word [rax + rax]
mov rdx, r15
lea rcx, [rbp + 0x11c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x1400033b0
mov r8d, dword [rbp + 0xf8]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x1400033c9
lea rdx, [rbp + 0xf0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140003380
jmp 0x140003549
mov r9d, 0x104
lea r8, [rbp + 0x220]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
test eax, eax
je 0x140003540
lea rax, [rbp + 0x220]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003400
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x48]
call fcn.140003e80
lea rdi, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
seta r13b
mov r12, qword [rsp + 0x48]
cmova rdi, r12
mov r15, qword [rsp + 0x58]
test r15, r15
je 0x1400034aa
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rax
mov dword [rbp + 0x48], eax
xor edx, edx
mov r8d, 0xa3
lea rcx, [rbp + 0x4d]
call sub.VCRUNTIME140.dll_memset
mov byte [rbp + 0x4c], 1
lea rax, [r15 - 1]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
add r8, rdi
movzx eax, byte [r8]
cmp byte [rbp + rax - 0x10], 0
jne 0x1400034a5
cmp r8, rdi
je 0x1400034aa
dec r8
movzx eax, byte [r8]
cmp byte [rbp + rax - 0x10], 0
je 0x140003492
sub r8, rdi
jmp 0x1400034b1
mov r8, 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
cmp r15, r8
cmovb r8, r15
lea rdx, [rsp + 0x48]
test r13b, r13b
cmovne rdx, r12
lea rcx, [rsp + 0x68]
call fcn.140004390
or r14d, 4
mov dword [rbp + 0x388], r14d
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140003529
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003524
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038a9
call fcn.140004984
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rsp + 0x78]
movups xmmword [rsp + 0x58], xmm1
xor r12d, r12d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13d, r12d
mov r14, qword [rsp + 0x58]
test r14, r14
je 0x140003776
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rbp - 0x50], rax
cmp rsi, rax
je 0x140003776
nop word [rax + rax]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 1
jb 0x140003b71
lea r12, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova r12, qword [rsp + 0x48]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
lea r15, [r14 + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x68]
cmp r15, rbx
jbe 0x140003648
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400035f0
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140003617
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140003636
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003b83
mov rcx, rax
call fcn.140004638
test rax, rax
je 0x1400038b0
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140003643
test rcx, rcx
je 0x140003640
call fcn.140004638
mov rdi, rax
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], rbx
mov r8, r14
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0x5c
mov byte [rdi + r15], 0
mov r14d, dword [rbp + 0x388]
or r14d, 1
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x140003681
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x68]
call fcn.140003ba0
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xor r12d, r12d
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r12
mov r15d, 0xf
mov qword [rax + 0x18], r15
mov byte [rax], r12b
or r14d, 2
mov dword [rbp + 0x388], r14d
mov rdx, qword [rbp - 0x80]
cmp rdx, r15
jbe 0x140003707
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003702
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038b0
call fcn.140004984
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0xf
cmova rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140003727
test al, 0x10
jne 0x140003727
inc r13d
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140003762
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000375d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038b7
call fcn.140004984
add rsi, 0x20
cmp rsi, qword [rbp - 0x50]
je 0x140003783
mov r14, qword [rsp + 0x58]
jmp 0x140003580
mov r15d, 0xf
mov r14d, dword [rbp + 0x388]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rsp + 0x60]
cmp r13d, 1
je 0x1400038be
cmp rdx, 0xf
jbe 0x1400037d6
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038ed
call fcn.140004984
mov qword [rsp + 0x58], r12
mov r13d, 0xf
mov qword [rsp + 0x60], r13
mov byte [rsp + 0x48], 0
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x14000389d
mov rdi, qword [rsp + 0x38]
cmp rbx, rdi
je 0x140003856
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000383d
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140003838
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003b0f
mov rcx, r8
call fcn.140004984
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r13
mov byte [rbx], 0
add rbx, 0x20
cmp rbx, rdi
jne 0x140003803
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x140003887
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b0f
mov rcx, rbx
call fcn.140004984
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
jmp 0x14000317a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
cmp rdx, 0xf
jbe 0x1400038f9
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400038f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400038f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004984
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r15
mov byte [rsp + 0x48], 0
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1400039ba
mov rdi, qword [rsp + 0x38]
cmp rbx, rdi
je 0x140003973
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000395a
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140003955
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003b0f
mov rcx, r8
call fcn.140004984
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r15
mov byte [rbx], 0
add rbx, 0x20
cmp rbx, rdi
jne 0x140003920
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400039a4
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b0f
mov rcx, rbx
call fcn.140004984
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
cmp r15, 0xf
jbe 0x1400039f2
lea rdx, [r15 + 1]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400039ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b5b
call fcn.140004984
mov dword [0x1400091d0], r12d
call fcn.140002300
mov dword [0x1400091d0], 1
call fcn.140002300
mov dword [0x1400091d0], 2
call fcn.140002300
mov dword [0x1400091d0], 3
call fcn.140002300
mov dword [0x1400091d0], 4
call fcn.140002300
mov dword [0x1400091d0], 5
call fcn.140002300
xor eax, eax
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x140003b2c
mov rdi, qword [rsp + 0x38]
cmp rbx, rdi
je 0x140003ae2
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140003ac9
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140003ac4
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003b0f
mov rcx, r8
call fcn.140004984
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r13
mov byte [rbx], 0
add rbx, 0x20
cmp rbx, rdi
jne 0x140003a93
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x140003b16
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140004984
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
cmp r13, 0xf
jbe 0x140003b67
lea rdx, [r13 + 1]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004984
mov eax, 1
jmp 0x140003a4b
call fcn.140001ad0
nop
call fcn.140001ad0
int3
call fcn.140001a30
nop
call fcn.140001a30
int3