Function at 0x14008e240
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x6a8]
sub rsp, 0x790
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
movaps xmmword [rax - 0x58], xmm9
movaps xmmword [rax - 0x68], xmm10
movaps xmmword [rax - 0x78], xmm11
mov rax, qword [0x14013e040]
xor rax, rsp
mov qword [rbp + 0x620], rax
mov rbx, qword [0x14017b540]
mov rdi, qword [0x14017b548]
cmp rbx, rdi
je 0x14008e2c8
mov rcx, rbx
call fcn.140001560
add rbx, 0x110
cmp rbx, rdi
jne 0x14008e2a6
mov rax, qword [0x14017b540]
mov qword [0x14017b548], rax
mov rbx, qword [0x14017b418]
mov rdi, qword [0x14017b420]
cmp rbx, rdi
je 0x14008e2ff
nop dword [rax + rax]
mov rcx, rbx
call fcn.1400015f0
add rbx, 0x68
cmp rbx, rdi
jne 0x14008e2e0
mov rax, qword [0x14017b418]
mov qword [0x14017b420], rax
xor r12d, r12d
mov qword [rbp + 0xc0], r12
mov rdx, qword [0x14017b588]
add rdx, 0x19f2488
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0xc0]
mov qword [0x14017c7c8], rdx
mov dword [rbp + 0xc0], r12d
add rdx, 0x1520
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0xc0]
mov dword [0x14017c7c0], eax
mov qword [rbp + 0xc0], r12
mov rdx, qword [0x14017b588]
add rdx, 0x1a41fd0
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0xc0]
mov qword [0x14017b438], rdx
test rdx, rdx
je 0x14008ea04
mov qword [rbp + 0xc0], r12
add rdx, 0x80c
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rbp + 0xc0]
call fcn.14008fb60
mov qword [0x14017b448], rax
mov qword [rbp + 0xc0], r12
mov rdx, qword [0x14017b588]
add rdx, 0x1855ce8
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0xc0]
mov qword [0x14017b440], rdx
mov qword [rbp + 0xc0], r12
add rdx, 0x328
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0xc0]
mov qword [0x14017b450], rax
mov dword [rbp + 0xc0], r12d
mov rdx, qword [0x14017b440]
add rdx, 0x3e3
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0xc0]
mov dword [0x14017b478], eax
mov dword [rbp + 0xc0], r12d
mov rdx, qword [0x14017b440]
add rdx, 0x344
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0xc0]
mov dword [0x14017b46c], eax
mov dword [rbp + 0xc0], r12d
mov rdx, qword [0x14017b440]
add rdx, 0x241c
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0xc0]
mov dword [0x14017b474], eax
mov qword [rbp + 0xf0], r12
mov dword [rbp + 0xf8], r12d
mov rdx, qword [0x14017b450]
add rdx, 0xd0
mov qword [rsp + 0x20], r12
mov r9d, 0xc
lea r8, [rbp + 0xf0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp + 0xf0]
movss dword [0x14017b480], xmm0
movss xmm1, dword [rbp + 0xf4]
movss dword [0x14017b484], xmm1
movss xmm0, dword [rbp + 0xf8]
movss dword [0x14017b488], xmm0
mov dword [rbp + 0xc0], r12d
mov rdx, qword [0x14017b440]
add rdx, 0x23fc
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0xc0]
mov dword [0x14017b47c], eax
mov byte [rbp + 0xc0], r12b
mov rdx, qword [0x14017b440]
add rdx, 0x23e8
mov qword [rsp + 0x20], r12
mov r9d, 1
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, byte [rbp + 0xc0]
mov byte [0x14017b46b], al
mov qword [rbp + 0xc0], r12
mov rdx, qword [0x14017b440]
add rdx, 0x23dc
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0xc0]
mov qword [0x14017b460], rax
mov qword [rbp + 0xc0], r12
mov rdx, qword [0x14017b440]
add rdx, 0x13a0
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0xc0]
mov qword [0x14017b4d8], rax
test rax, rax
je 0x14008e9b0
mov byte [rbp + 0xc0], r12b
mov rdx, qword [0x14017b440]
add rdx, 0x23e8
mov qword [rsp + 0x20], r12
mov r9d, 1
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, byte [rbp + 0xc0]
mov byte [0x14017b46b], al
mov word [rbp + 0xc0], r12w
mov rdx, qword [0x14017b4d8]
add rdx, 0x1352
mov qword [rsp + 0x20], r12
mov r9d, 2
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx edx, word [rbp + 0xc0]
mov dword [0x14017b4e8], edx
lea rcx, [rbp + 0xd0]
call fcn.14008b140
mov rbx, rax
lea rax, [0x14017b520]
cmp rax, rbx
je 0x14008e7d4
mov rdx, qword [0x14017b538]
cmp rdx, 0xf
jbe 0x14008e799
inc rdx
mov rcx, qword [0x14017b520]
cmp rdx, 0x1000
jb 0x14008e794
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14008e80c
mov rcx, r8
call fcn.1400fb3b4
movdqa xmm0, xmmword [0x140126560]
movdqu xmmword [0x14017b530], xmm0
mov byte [0x14017b520], r12b
movups xmm0, xmmword [rbx]
movups xmmword [0x14017b520], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x14017b530], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r12b
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x14008e818
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008e813
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008e813
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fb3b4
mov edx, dword [0x14017b4e8]
lea rcx, [rbp + 0xd0]
call fcn.140084e80
mov rbx, rax
lea rax, [0x14017b500]
cmp rax, rbx
je 0x14008e8b1
mov rdx, qword [0x14017b518]
cmp rdx, 0xf
jbe 0x14008e876
inc rdx
mov rcx, qword [0x14017b500]
cmp rdx, 0x1000
jb 0x14008e871
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14008e8e9
mov rcx, r8
call fcn.1400fb3b4
movdqa xmm0, xmmword [0x140126560]
movdqu xmmword [0x14017b510], xmm0
mov byte [0x14017b500], r12b
movups xmm0, xmmword [rbx]
movups xmmword [0x14017b500], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x14017b510], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r12b
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x14008e8f5
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008e8f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008e8f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fb3b4
mov dword [rbp + 0xc0], r12d
mov rdx, qword [0x14017b4d8]
add rdx, 0x1678
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0xc0]
mov dword [0x14017b4ec], eax
mov qword [rbp + 0xc0], r12
mov rdx, qword [0x14017b4d8]
add rdx, 0x380
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0xc0]
mov qword [0x14017b4e0], rdx
mov dword [rbp + 0xc0], r12d
add rdx, 0x2f4
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0xc0]
mov dword [0x14017b4f0], eax
mov byte [rbp + 0xc0], r12b
mov rdx, qword [0x14017b438]
add rdx, 0x814
mov qword [rsp + 0x20], r12
mov r9d, 1
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [rbp + 0xc0], r12b
je 0x14008e9fd
cmp dword [0x14017b46c], r12d
mov byte [0x14017b469], 1
jg 0x14008ea04
mov byte [0x14017b469], r12b
mov esi, r12d
nop word [rax + rax]
mov dword [rbp - 0x50], 0xffffffff
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movups xmmword [rbp], xmm1
mov qword [rbp + 0x10], r12
mov dword [rbp + 0x18], r12d
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
xor r8d, r8d
lea rdx, [0x14011cb4a]
lea rcx, [rbp + 0x20]
call fcn.140001460
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], r12
mov dword [rbp + 0x68], 0xffffffff
mov qword [rbp + 0x6c], r12
mov qword [rbp + 0x74], r12
mov dword [rbp + 0x7c], r12d
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], r12
xor r8d, r8d
lea rdx, [0x14011cb4a]
lea rcx, [rbp + 0x80]
call fcn.140001460
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], r12
xor r8d, r8d
lea rdx, [0x14011cb4a]
lea rcx, [rbp + 0xa0]
call fcn.140001460
mov qword [rbp + 0xc0], r12
mov ecx, esi
sar ecx, 9
and ecx, 0x3f
shl ecx, 3
mov rdx, qword [0x14017c7c8]
add rdx, 0x10
add rdx, rcx
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rbp + 0xc0]
test rcx, rcx
jne 0x14008eb8b
lea rcx, [rbp + 0x58]
call fcn.1400015f0
lea rcx, [rbp + 0x40]
call fcn.140002a90
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14008f47c
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008f477
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008f477
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov qword [rbp + 0xc8], r12
mov eax, esi
and eax, 0x1ff
imul edx, eax, 0x78
add rdx, rcx
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0xc8]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0xc8]
mov qword [rbp - 0x48], rdx
test rdx, rdx
je 0x14008eb34
cmp rdx, qword [0x14017b438]
jne 0x14008edc4
mov dword [0x14017b410], esi
mov dword [0x14017b430], esi
mov rax, qword [0x14017b440]
mov qword [rbp - 0x40], rax
mov qword [rbp + 0xc8], r12
mov rdx, qword [rbp - 0x40]
add rdx, 0x328
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0xc8]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0xc8]
mov qword [rbp - 0x30], rdx
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x38], r12d
add rdx, 0xd0
mov qword [rsp + 0x20], r12
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rsp + 0x30]
movss dword [rbp], xmm0
movss xmm1, dword [rsp + 0x34]
movss dword [rbp + 4], xmm1
movss xmm0, dword [rsp + 0x38]
movss dword [rbp + 8], xmm0
mov qword [rbp + 0xc8], r12
mov rdx, qword [rbp - 0x30]
add rdx, 0x1f0
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0xc8]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0xc8]
mov qword [rbp - 0x28], rax
xor edx, edx
mov r8d, 0x3c0
lea rcx, [rbp + 0x110]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x110]
call fcn.14008fc10
lea rdx, [rbp + 0x100]
mov qword [rsp + 0x20], rdx
mov r9d, 0x3c0
lea r8, [rbp + 0x110]
mov rdx, qword [rbp - 0x28]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14008f42f
cmp qword [rbp + 0x100], 0x3c0
sete al
test al, al
je 0x14008f42f
lea rbx, [rbp + 0x118]
mov edi, 0x1e
mov r9, qword [rbp + 0x48]
nop word [rax + rax]
mov qword [rbp + 0xdc], r12
mov byte [rbp + 0xe4], r12b
movss xmm0, dword [rbx - 8]
movss dword [rbp + 0xd0], xmm0
movss xmm1, dword [rbx - 4]
movss dword [rbp + 0xd4], xmm1
movss xmm0, dword [rbx]
movss dword [rbp + 0xd8], xmm0
lea rdx, [rbp + 0xdc]
lea rcx, [rbp + 0xd0]
call fcn.140084d20
test al, al
setne byte [rbp + 0xe4]
cmp r9, qword [rbp + 0x50]
je 0x14008ee6e
movups xmm0, xmmword [rbp + 0xd0]
movups xmmword [r9], xmm0
movsd xmm1, qword [rbp + 0xe0]
movsd qword [r9 + 0x10], xmm1
mov r9, qword [rbp + 0x48]
add r9, 0x18
mov qword [rbp + 0x48], r9
jmp 0x14008ee85
mov dword [rbp - 0x50], esi
cmp esi, dword [0x14017b410]
je 0x14008ebeb
mov qword [rbp + 0xc8], r12
add rdx, 0x62c
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0xc8]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rbp + 0xc8]
call fcn.14008fb60
mov qword [rbp - 0x40], rax
mov dword [rbp + 0xc0], r12d
lea rdx, [rax + 0x3e3]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [rbp + 0xc0]
mov dword [rbp - 8], ecx
mov rax, qword [0x14017b580]
cmp byte [rax + 0x500], r12b
jne 0x14008ee65
cmp dword [0x14017b478], ecx
setne byte [rbp - 0x18]
jmp 0x14008ebf6
mov byte [rbp - 0x18], 1
jmp 0x14008ebf6
lea r8, [rbp + 0xd0]
mov rdx, r9
lea rcx, [rbp + 0x40]
call fcn.140090230
mov r9, qword [rbp + 0x48]
add rbx, 0x20
sub rdi, 1
jne 0x14008ed40
mov dword [rbp + 0xc0], r12d
mov rdx, qword [rbp - 0x40]
add rdx, 0x344
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0xc0]
mov dword [rbp - 0x14], eax
mov dword [rbp + 0xc0], r12d
mov rdx, qword [rbp - 0x40]
add rdx, 0x340
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0xc0]
mov dword [rbp - 0x10], eax
mov dword [rbp + 0xc0], r12d
mov rdx, qword [rbp - 0x40]
add rdx, 0x241c
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0xc0]
mov dword [rbp - 0xc], eax
mov byte [rbp + 0xc0], r12b
mov rdx, qword [rbp - 0x40]
add rdx, 0x156f
mov qword [rsp + 0x20], r12
mov r9d, 1
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, byte [rbp + 0xc0]
mov byte [rbp - 0x16], al
mov dword [rbp + 0xc0], r12d
mov rdx, qword [rbp - 0x40]
add rdx, 0x23fc
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0xc0]
mov dword [rbp - 4], eax
mov qword [rbp + 0xc8], r12
mov rdx, qword [rbp - 0x40]
add rdx, 0x23dc
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0xc8]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0xc8]
mov qword [rbp - 0x20], rax
mov byte [rbp + 0xc0], r12b
mov rdx, qword [rbp - 0x48]
add rdx, 0x814
mov qword [rsp + 0x20], r12
mov r9d, 1
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [rbp + 0xc0], r12b
je 0x14008f036
cmp dword [rbp - 0x14], r12d
mov byte [rbp - 0x17], 1
jg 0x14008f03a
mov byte [rbp - 0x17], r12b
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x510]
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rbp - 0x48]
add rdx, 0x660
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 0x104
lea r8, [rbp + 0x510]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14008eb34
cmp qword [rbp + 0xf0], 0x104
sete al
test al, al
je 0x14008eb34
lea rax, [rbp + 0x510]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x14008f0b0
lea rdx, [rbp + 0x510]
lea rcx, [rbp + 0x20]
call fcn.140002b10
cmp qword [rbp + 0x30], r12
je 0x14008eb34
mov qword [rbp + 0xc8], r12
mov rdx, qword [rbp - 0x40]
add rdx, 0x13a0
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0xc8]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0x58], rax
test rax, rax
je 0x14008f3f2
mov byte [rbp + 0xc0], r12b
mov rdx, qword [rbp - 0x40]
add rdx, 0x23e8
mov qword [rsp + 0x20], r12
mov r9d, 1
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, byte [rbp + 0xc0]
mov byte [rbp - 0x15], al
mov word [rbp + 0xc0], r12w
mov rdx, qword [rbp + 0x58]
add rdx, 0x1352
mov qword [rsp + 0x20], r12
mov r9d, 2
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx edx, word [rbp + 0xc0]
mov dword [rbp + 0x68], edx
lea rcx, [rbp + 0xd0]
call fcn.14008b140
mov rbx, rax
lea rax, [rbp + 0xa0]
cmp rax, rbx
je 0x14008f228
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x14008f1eb
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008f1e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008f6f8
call fcn.1400fb3b4
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], r12b
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0xb0], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r12b
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x14008f269
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008f264
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008f6f8
call fcn.1400fb3b4
mov edx, dword [rbp + 0x68]
lea rcx, [rbp + 0xd0]
call fcn.140084e80
mov rbx, rax
lea rax, [rbp + 0x80]
cmp rax, rbx
je 0x14008f305
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x14008f2c8
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008f2c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008f6ff
call fcn.1400fb3b4
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], 0xf
mov byte [rbp + 0x80], r12b
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x90], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r12b
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x14008f346
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008f341
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008f6ff
call fcn.1400fb3b4
mov dword [rbp + 0xc0], r12d
mov rdx, qword [rbp + 0x58]
add rdx, 0x1678
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0xc0]
mov dword [rbp + 0x6c], eax
mov qword [rbp + 0xc8], r12
mov rdx, qword [rbp + 0x58]
add rdx, 0x380
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0xc8]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0xc8]
mov qword [rbp + 0x60], rdx
mov dword [rbp + 0xc0], r12d
add rdx, 0x2f4
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0xc0]
mov dword [rbp + 0x70], eax
mov rax, qword [0x14017b548]
cmp rax, qword [0x14017b550]
je 0x14008f41e
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.1400024f0
add qword [0x14017b548], 0x110
jmp 0x14008eb34
lea r8, [rbp - 0x50]
mov rdx, rax
call fcn.14008fd50
jmp 0x14008eb34
lea rcx, [rbp + 0x58]
call fcn.1400015f0
lea rcx, [rbp + 0x40]
call fcn.140002a90
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14008f47c
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008f477
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008f706
call fcn.1400fb3b4
inc esi
cmp esi, 0x40
jl 0x14008ea10
mov r14d, 0x41
cmp dword [0x14017c7c0], r14d
jl 0x14008faef
mov r15d, dword [0x14013e098]
movdqa xmm9, xmmword [0x1401266c0]
movdqa xmm6, xmmword [0x1401265c0]
movdqa xmm7, xmmword [0x1401265a0]
movdqa xmm10, xmmword [0x140126720]
movdqa xmm11, xmmword [0x140126620]
movdqa xmm8, xmmword [0x140126a60]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], 0xffffffff
mov qword [rsp + 0x54], r12
mov qword [rsp + 0x5c], r12
mov dword [rsp + 0x64], r12d
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
xor r8d, r8d
lea rdx, [0x14011cb4a]
lea rcx, [rsp + 0x68]
call fcn.140001460
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r12
xor r8d, r8d
lea rdx, [0x14011cb4a]
lea rcx, [rbp - 0x78]
call fcn.140001460
movsxd rcx, r14d
call fcn.14008fb60
mov rdi, rax
mov qword [rsp + 0x40], rax
mov qword [rbp + 0xc8], r12
lea rdx, [rax + 0x10]
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0xc8]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0xc8]
test rdx, rdx
je 0x14008fa6c
mov qword [rbp + 0xc0], r12
add rdx, 0x20
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0xc0]
test rdx, rdx
je 0x14008fa6c
xorps xmm0, xmm0
movups xmmword [rbp + 0x4d0], xmm0
movups xmmword [rbp + 0x4e0], xmm0
movups xmmword [rbp + 0x4f0], xmm0
movups xmmword [rbp + 0x500], xmm0
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8, [rbp + 0x4d0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [0x1401260b0]
mov qword [rbp + 0xc0], rax
cmp byte [0x1401260b7], r12b
je 0x14008f749
mov r8d, r12d
cmp r15d, 2
jl 0x14008f70d
movdqa xmm1, xmm7
punpckldq xmm1, xmm7
pmuldq xmm1, xmm8
movdqa xmm0, xmm7
punpckhdq xmm0, xmm7
pmuldq xmm0, xmm8
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm11
movdqa xmm1, xmm7
psubd xmm1, xmm0
andps xmm1, xmm9
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm10
movd xmm0, dword [rbp + 0xc0]
xorps xmm1, xmm0
movd dword [rbp + 0xc0], xmm1
movdqa xmm1, xmm6
punpckldq xmm1, xmm6
pmuldq xmm1, xmm8
movdqa xmm0, xmm6
punpckhdq xmm0, xmm6
pmuldq xmm0, xmm8
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm11
movdqa xmm1, xmm6
psubd xmm1, xmm0
andps xmm1, xmm9
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm10
movd xmm0, dword [rbp + 0xc4]
xorps xmm1, xmm0
movd dword [rbp + 0xc4], xmm1
jmp 0x14008f749
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea r9, [rbp + 0xc0]
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x38
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 8
jl 0x14008f720
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x4d0]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14008fa6c
mov qword [rbp + 0xc8], r12
lea rdx, [rdi + 0x328]
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0xc8]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x38], r12d
mov rdx, qword [rbp + 0xc8]
add rdx, 0xd0
mov qword [rsp + 0x20], r12
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rsp + 0x30]
movss dword [rsp + 0x5c], xmm0
movss xmm1, dword [rsp + 0x34]
movss dword [rsp + 0x60], xmm1
movss xmm0, dword [rsp + 0x38]
movss dword [rsp + 0x64], xmm0
mov word [rbp + 0xc0], r12w
lea rdx, [rdi + 0x1352]
mov qword [rsp + 0x20], r12
mov r9d, 2
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx esi, word [rbp + 0xc0]
mov dword [rsp + 0x50], esi
mov edx, esi
lea rcx, [rbp + 0xd0]
call fcn.14008b140
mov rbx, rax
lea rax, [rbp - 0x78]
cmp rax, rbx
je 0x14008f898
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14008f87a
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008f875
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008fb3d
call fcn.1400fb3b4
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r12b
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x14008f8d9
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008f8d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008fb3d
call fcn.1400fb3b4
mov edx, esi
lea rcx, [rbp + 0xd0]
call fcn.140084e80
mov rbx, rax
lea rax, [rsp + 0x68]
cmp rax, rbx
je 0x14008f950
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x14008f930
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008f92b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008fb44
call fcn.1400fb3b4
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r12b
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x14008f991
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008f98c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008fb44
call fcn.1400fb3b4
mov dword [rbp + 0xc0], r12d
lea rdx, [rdi + 0x1678]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0xc0]
mov dword [rsp + 0x54], eax
mov qword [rbp + 0xc8], r12
lea rdx, [rdi + 0x380]
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp + 0xc8]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rbp + 0xc8]
mov qword [rsp + 0x48], rdx
mov dword [rbp + 0xc0], r12d
add rdx, 0x2f4
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0xc0]
mov rcx, qword [0x14017b578]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rbp + 0xc0]
mov dword [rsp + 0x58], eax
mov rax, qword [0x14017b420]
cmp rax, qword [0x14017b428]
je 0x14008fa5f
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.1400025d0
add qword [0x14017b420], 0x68
jmp 0x14008fa6c
lea r8, [rsp + 0x40]
mov rdx, rax
call fcn.14008ffd0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14008faa7
inc rdx
mov rcx, qword [rbp - 0x78]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14008faa2
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008fb4b
call fcn.1400fb3b4
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x14008fadf
inc rdx
mov rcx, qword [rsp + 0x68]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14008fada
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008fb4b
call fcn.1400fb3b4
inc r14d
cmp r14d, dword [0x14017c7c0]
jle 0x14008f4d5
mov rcx, qword [rbp + 0x620]
xor rcx, rsp
call fcn.1400fb110
lea r11, [rsp + 0x790]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3