Function at 0x14004ae40
Capabilities:
Acquire debug privileges
Check if file exists
Contain obfuscated stackstrings
Create thread
Encode data using xor
Enumerate gui resources
Enumerate processes
Get file attributes
Get process image filename
Hide thread from debugger
Set global application hook

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x4b0]
sub rsp, 0x5b0
mov rax, qword [0x140149040]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
xor edi, edi
call fcn.140007070
call fcn.140006980
call fcn.140007170
call fcn.140006f20
call fcn.140006ae0
call fcn.140006c30
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14004aed7
lea rdx, str.NtSetInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14004aed7
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0x11]
call rbx
call fcn.140007890
call fcn.140007640
call fcn.1400077a0
call fcn.140007a70
call fcn.140007ba0
mov cl, 0x22
mov word [rsp + 0x38], 0x22
movsx r8d, cl
movzx eax, r8w
xor ax, 0x61
mov word [rsp + 0x3a], ax
movzx eax, r8w
xor ax, 0x4d
mov word [rsp + 0x3c], ax
movzx eax, r8w
xor ax, 0x4f
mov word [rsp + 0x3e], ax
movzx eax, r8w
xor ax, 0x40
mov word [rsp + 0x40], ax
movzx ecx, r8w
xor cx, 0x43
mov word [rsp + 0x42], cx
movzx edx, r8w
xor dx, 0x56
mov word [rsp + 0x44], dx
movzx eax, r8w
xor ax, 0x6f
mov word [rsp + 0x46], ax
mov word [rsp + 0x48], cx
movzx eax, r8w
xor ax, 0x51
mov word [rsp + 0x4a], ax
mov word [rsp + 0x4c], dx
movzx ecx, r8w
xor cx, 0x47
mov word [rsp + 0x4e], cx
movzx eax, r8w
xor ax, 0x50
mov word [rsp + 0x50], ax
movzx eax, r8w
xor ax, 0xc
mov word [rsp + 0x52], ax
mov word [rsp + 0x54], cx
xor r8w, 0x5a
mov word [rsp + 0x56], r8w
mov word [rsp + 0x58], cx
mov word [rsp + 0x5a], di
lea rsi, [0x1401490e0]
cmp qword [0x1401490f8], 0xf
cmova rsi, qword [0x1401490e0]
movdqa xmm0, xmmword [str._DLL_Injector__nCDNE_YbEEAoR]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x10], dil
lea rcx, [rbp - 0x1f]
call fcn.140006860
lea rdx, [rsp + 0x3a]
lea rcx, [0x14013dffc]
call fcn.14004ad50
lea rcx, [0x140054368]
call fcn.140006860
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14004bf71
test al, 0x10
jne 0x14004bf71
mov r14d, edi
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14004bf24
mov dword [rbp + 0x50], 0x238
lea rdx, [rbp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004b07a
nop dword [rax + rax]
lea rdx, [rsp + 0x3a]
lea rcx, [rbp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14004b076
lea rdx, [rbp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004b050
jmp 0x14004b07a
mov r14d, dword [rbp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x14004bf24
mov edx, r14d
lea rcx, [0x14004adb0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov dword [rbp + 0x20], edi
lea rdx, [rbp + 0x20]
mov rcx, qword [0x140149d80]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r15d, eax
test eax, eax
jne 0x14004b17a
lea edx, [rax + 4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004c1c0
movdqa xmm0, xmmword [0x14013e910]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x14013e420]
movdqu xmmword [rsp + 0x48], xmm1
movdqa xmm0, xmmword [0x14013e690]
movdqu xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x68], 0x49414620
mov dword [rsp + 0x6c], 0x2044454c
mov word [rsp + 0x70], 0x5d
lea rdx, [rsp + 0x39]
mov rcx, rax
call fcn.1400035b0
lea rdx, [0x140003780]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724546
movdqa xmm0, xmmword [0x14013e900]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x14013e420]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0x67726174
mov dword [rsp + 0x5c], 0x77207465
mov dword [rsp + 0x60], 0x6f646e69
mov word [rsp + 0x64], 0x2e77
mov byte [rsp + 0x66], dil
lea rdx, [rsp + 0x39]
jmp 0x14004bfc0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rsi + r8], dil
jne 0x14004b192
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140003a60
nop
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
test eax, eax
jne 0x14004b1f5
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], rdi
mov eax, 7
mov qword [rbp + 0x40], rax
mov word [rbp + 0x28], di
jmp 0x14004b260
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8, rbx
lea rcx, [rbp - 0x20]
call fcn.14004c7a0
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rax, qword [rbp - 0x20]
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [rbp + 0x38], xmm1
psrldq xmm1, 8
movq rax, xmm1
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14004b2a4
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b29b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b29b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400510bc
mov rax, qword [rbp + 0x40]
movdqa xmm0, xmmword [0x14013e2e0]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
lea rcx, [rbp + 0x28]
cmp rax, 7
cmova rcx, qword [rbp + 0x28]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r14, rax
test rax, rax
jne 0x14004b35d
lea edx, [rax + 4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004c1c0
movdqa xmm0, xmmword [0x14013e860]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x14013e5e0]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0x454c4941
mov dword [rbp + 4], 0x5d2044
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400035b0
lea rdx, [0x140003780]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724543
movdqa xmm0, xmmword [0x14013e850]
mov dword [rbp - 0x10], 0x6220746f
mov dword [rbp - 0xc], 0x6f662065
mov dword [rbp - 8], 0x2e646e75
mov byte [rbp - 4], r14b
jmp 0x14004beaf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14004bd8d
lea r8, [rbp - 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14004bc21
mov dword [rbp - 0x20], 4
lea r8, [rbp - 0x1c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14004b3be
mov dword [rbp - 0x14], 2
lea r8, [rbp - 0x10]
lea rdx, str.SeLoadDriverPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea r8, [rbp - 4]
lea rdx, str.SeRemoteShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea r8, [rbp + 8]
lea rdx, str.SeCreateGlobalPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov r9d, 0x10
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14004ba9f
mov cl, 0x67
mov word [rbp - 0x80], 0x67
movsx ebx, cl
movzx eax, bx
xor ax, 0x37
mov word [rbp - 0x7e], ax
movzx eax, bx
xor ax, 0x15
mov word [rbp - 0x7c], ax
movzx ecx, bx
xor cx, 0xe
mov word [rbp - 0x7a], cx
movzx eax, bx
xor ax, 0x11
mov word [rbp - 0x78], ax
mov word [rbp - 0x76], cx
movzx r11d, bx
xor r11w, 0xb
mov word [rbp - 0x74], r11w
movzx r10d, bx
xor r10w, 2
mov word [rbp - 0x72], r10w
mov word [rbp - 0x70], bx
mov word [rbp - 0x6e], r10w
movzx r9d, bx
xor r9w, 0x14
mov word [rbp - 0x6c], r9w
movzx edx, bx
xor dx, 0x47
mov word [rbp - 0x6a], dx
movzx eax, bx
xor ax, 6
mov word [rbp - 0x68], ax
movzx ecx, bx
xor cx, 3
mov word [rbp - 0x66], cx
movzx eax, bx
xor ax, 0xd
mov word [rbp - 0x64], ax
movzx r8d, bx
xor r8w, 0x12
mov word [rbp - 0x62], r8w
mov word [rbp - 0x60], r9w
movzx eax, bx
xor ax, 0x13
mov word [rbp - 0x5e], ax
mov word [rbp - 0x5c], r10w
mov word [rbp - 0x5a], cx
mov word [rbp - 0x58], dx
mov word [rbp - 0x56], r9w
mov word [rbp - 0x54], r8w
movzx eax, bx
xor ax, 4
mov word [rbp - 0x52], ax
mov word [rbp - 0x50], ax
mov word [rbp - 0x4e], r10w
mov word [rbp - 0x4c], r9w
mov word [rbp - 0x4a], r9w
movzx eax, bx
xor ax, 1
mov word [rbp - 0x48], ax
mov word [rbp - 0x46], r8w
mov word [rbp - 0x44], r11w
mov word [rbp - 0x42], r11w
movzx eax, bx
xor ax, 0x1e
mov word [rbp - 0x40], ax
xor bx, 0x49
mov word [rbp - 0x3e], bx
mov word [rbp - 0x3c], di
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14004c310
lea rdx, [0x14004c4f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x104
lea rdx, [rbp + 0x290]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x14004b6e3
mov rsi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov ebx, 4
mov rax, qword gs:[0x58]
add rbx, qword [rax]
mov eax, dword [rbx]
cmp dword [0x140149fc4], eax
jle 0x14004b5e5
lea rcx, [0x140149fc4]
call fcn.14005139c
cmp dword [0x140149fc4], 0xffffffff
jne 0x14004b5e5
xor ecx, ecx
call fcn.140006780
mov word [0x140149fd0], ax
lea rcx, [0x140149fc4]
call fcn.140051330
mov eax, dword [rbx]
cmp dword [0x140149fd4], eax
jle 0x14004b626
lea rcx, [0x140149fd4]
call fcn.14005139c
cmp dword [0x140149fd4], 0xffffffff
jne 0x14004b626
movzx eax, word [0x140149fd0]
mov edx, 0xf0
and ax, dx
mov word [0x140149fc0], ax
lea rcx, [0x140149fd4]
call fcn.140051330
mov eax, dword [rbx]
cmp dword [0x140149fcc], eax
jle 0x14004b663
lea rcx, [0x140149fcc]
call fcn.14005139c
cmp dword [0x140149fcc], 0xffffffff
jne 0x14004b663
movzx eax, word [0x140149fd0]
and ax, 0xf
mov word [0x140149fc8], ax
lea rcx, [0x140149fcc]
call fcn.140051330
movzx ebx, di
mov ecx, 7
call fcn.140006780
test al, 0xf0
je 0x14004b687
mov word [0x140149fc0], ax
movzx ebx, ax
or bx, word [0x140149fc8]
jmp 0x14004b69c
test al, 0xf
je 0x14004b69c
mov word [0x140149fc8], ax
movzx ebx, ax
or bx, word [0x140149fc0]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, rsi
call fcn.14004c530
mov rcx, rax
lea rdx, [rbp + 0x290]
call fcn.14004c310
lea rdx, [0x14004c4f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.NextHook
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rax, rax
jne 0x14004b790
lea edx, [rax + 4]
call fcn.14004c1c0
movdqa xmm0, xmmword [0x14013e700]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x14013e5f0]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0x454c4941
mov dword [rbp + 4], 0x5d2044
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400035b0
lea rdx, [0x140003780]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724518
movdqa xmm0, xmmword [0x14013e6f0]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x14013e5f0]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0x454c4941
mov dword [rsp + 0x5c], 0x5d2044
lea rdx, [rsp + 0x39]
jmp 0x14004beb8
mov edx, 7
call fcn.14004c1c0
movdqa xmm0, xmmword [0x14013e710]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x14013e450]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0x72656874
mov word [rbp + 4], 0x2165
mov byte [rbp + 6], 0
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400035b0
lea rdx, [0x140003780]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, r15d
mov r8, r14
mov rdx, rbx
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rax, rax
jne 0x14004b9ac
lea edx, [rax + 4]
call fcn.14004c1c0
mov r8, rax
movdqa xmm0, xmmword [0x14013e4b0]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x14013e3b0]
movdqu xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x14013e740]
movdqu xmmword [rbp], xmm0
mov dword [rbp + 0x10], 0x80d0502
mov dword [rbp + 0x14], 0x19640001
mov byte [rbp + 0x18], 0
mov rcx, rdi
nop dword [rax]
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1f], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1e], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1d], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1c], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1b], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1a], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x19], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x18], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x17], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x16], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x15], al
add rcx, 0xb
cmp rcx, 0x37
jb 0x14004b850
mov byte [rbp + 0x18], 0
lea rdx, [rbp - 0x1f]
mov rcx, r8
call fcn.1400035b0
lea rdx, [0x140003780]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x7272453b
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x14013e5b0]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x14013e9a0]
movdqu xmmword [rsp + 0x48], xmm1
movdqa xmm0, xmmword [0x14013e390]
movdqu xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x68], 0x66636b6c
mov dword [rsp + 0x6c], 0x770a6e6f
mov byte [rsp + 0x70], 0
nop word [rax + rax]
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x39], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x3a], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x3b], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x3c], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x3d], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x3e], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x3f], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x40], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x41], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x42], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x43], al
add rdi, 0xb
cmp rdi, 0x37
jb 0x14004b930
mov byte [rsp + 0x70], 0
lea rdx, [rsp + 0x39]
jmp 0x14004bec4
mov edx, 7
call fcn.14004c1c0
movdqa xmm0, xmmword [0x14013e940]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x2e70
mov byte [rbp - 0xe], 0
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400035b0
lea rdx, [0x140003780]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r15d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov byte [0x1401490d8], 0
movdqa xmm0, xmmword [0x14013e8d0]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x6c756673
mov dword [rbp - 0xc], 0xa21796c
mov byte [rbp - 8], 0
lea rcx, [rbp - 0x1f]
call fcn.140006860
mov dword [rbp - 0x30], 0x6375533f
mov dword [rbp - 0x2c], 0x73736563
mov byte [rbp - 0x28], 0
movdqa xmm0, xmmword [0x14013e830]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x6c20796c
mov dword [rbp - 0xc], 0x6564616f
mov word [rbp - 8], 0x2164
mov byte [rbp - 6], 0
mov r9d, 0x40
lea r8, [rbp - 0x2f]
lea rdx, [rbp - 0x1f]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x14004c010]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x1401490d8], 0
jmp 0x14004bed8
mov cl, 0x72
mov word [rbp - 0x80], 0x72
movsx r10d, cl
movzx eax, r10w
xor ax, 0x37
mov word [rbp - 0x7e], ax
mov word [rbp - 0x7c], r10w
mov word [rbp - 0x7a], r10w
movzx eax, r10w
xor ax, 0x1d
mov word [rbp - 0x78], ax
mov word [rbp - 0x76], r10w
movzx r9d, r10w
xor r9w, 0x52
mov word [rbp - 0x74], r9w
movzx eax, r10w
xor ax, 0x13
mov word [rbp - 0x72], ax
movzx eax, r10w
xor ax, 0x16
mov word [rbp - 0x70], ax
movzx eax, r10w
xor ax, 0x18
mov word [rbp - 0x6e], ax
movzx eax, r10w
xor ax, 7
mov word [rbp - 0x6c], ax
movzx r8d, r10w
xor r8w, 1
mov word [rbp - 0x6a], r8w
movzx eax, r10w
xor ax, 6
mov word [rbp - 0x68], ax
movzx ecx, r10w
xor cx, 0x1b
mov word [rbp - 0x66], cx
movzx eax, r10w
xor ax, 0x1c
mov word [rbp - 0x64], ax
movzx edx, r10w
xor dx, 0x15
mov word [rbp - 0x62], dx
mov word [rbp - 0x60], r9w
movzx eax, r10w
xor ax, 2
mov word [rbp - 0x5e], ax
mov word [rbp - 0x5c], r10w
mov word [rbp - 0x5a], cx
movzx eax, r10w
xor ax, 4
mov word [rbp - 0x58], ax
mov word [rbp - 0x56], cx
movzx eax, r10w
xor ax, 0x1e
mov word [rbp - 0x54], ax
movzx eax, r10w
xor ax, 0x17
mov word [rbp - 0x52], ax
mov word [rbp - 0x50], dx
mov word [rbp - 0x4e], ax
mov word [rbp - 0x4c], r8w
xor r10w, 0x48
mov word [rbp - 0x4a], r10w
mov word [rbp - 0x48], r9w
mov word [rbp - 0x46], di
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14004c310
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14004c4f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724514
movdqa xmm0, xmmword [0x14013e7a0]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x69727020
mov dword [rsp + 0x4c], 0x656c6976
mov dword [rsp + 0x50], 0x2e736567
mov byte [rsp + 0x54], 0
lea rdx, [rsp + 0x39]
jmp 0x14004beb8
mov cl, 0x55
mov word [rbp - 0x80], 0x55
movsx ebx, cl
movzx eax, bx
xor ax, 0x10
mov word [rbp - 0x7e], ax
movzx r9d, bx
xor r9w, 0x27
mov word [rbp - 0x7c], r9w
mov word [rbp - 0x7a], r9w
movzx r10d, bx
xor r10w, 0x3a
mov word [rbp - 0x78], r10w
mov word [rbp - 0x76], r9w
movzx r11d, bx
xor r11w, 0x75
mov word [rbp - 0x74], r11w
mov word [rbp - 0x72], r10w
movzx ecx, bx
xor cx, 0x25
mov word [rbp - 0x70], cx
movzx r8d, bx
xor r8w, 0x30
mov word [rbp - 0x6e], r8w
movzx edx, bx
xor dx, 0x3b
mov word [rbp - 0x6c], dx
movzx eax, bx
xor ax, 0x3c
mov word [rbp - 0x6a], ax
mov word [rbp - 0x68], dx
movzx eax, bx
xor ax, 0x32
mov word [rbp - 0x66], ax
mov word [rbp - 0x64], r11w
mov word [rbp - 0x62], cx
mov word [rbp - 0x60], r9w
mov word [rbp - 0x5e], r10w
movzx eax, bx
xor ax, 0x36
mov word [rbp - 0x5c], ax
mov word [rbp - 0x5a], r8w
movzx eax, bx
xor ax, 0x26
mov word [rbp - 0x58], ax
mov word [rbp - 0x56], ax
mov word [rbp - 0x54], r11w
movzx eax, bx
xor ax, 0x21
mov word [rbp - 0x52], ax
mov word [rbp - 0x50], r10w
movzx eax, bx
xor ax, 0x3e
mov word [rbp - 0x4e], ax
mov word [rbp - 0x4c], r8w
mov word [rbp - 0x4a], dx
xor bx, 0x6f
mov word [rbp - 0x48], bx
mov word [rbp - 0x46], r11w
mov word [rbp - 0x44], di
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14004c310
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14004c4f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724521
movdqa xmm0, xmmword [0x14013e8b0]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x65636f72
mov dword [rsp + 0x4c], 0x74207373
mov dword [rsp + 0x50], 0x6e656b6f
mov word [rsp + 0x54], 0x2e
lea rdx, [rsp + 0x39]
jmp 0x14004beb8
mov cl, 0x77
mov word [rbp - 0x20], 0x77
movsx ebx, cl
movzx eax, bx
xor ax, 0x32
mov word [rbp - 0x1e], ax
movzx r10d, bx
xor r10w, 5
mov word [rbp - 0x1c], r10w
mov word [rbp - 0x1a], r10w
movzx r9d, bx
xor r9w, 0x18
mov word [rbp - 0x18], r9w
mov word [rbp - 0x16], r10w
movzx r11d, bx
xor r11w, 0x57
mov word [rbp - 0x14], r11w
mov word [rbp - 0x12], r9w
movzx edx, bx
xor dx, 7
mov word [rbp - 0x10], dx
movzx r8d, bx
xor r8w, 0x12
mov word [rbp - 0xe], r8w
movzx ecx, bx
xor cx, 0x19
mov word [rbp - 0xc], cx
movzx eax, bx
xor ax, 0x1e
mov word [rbp - 0xa], ax
mov word [rbp - 8], cx
movzx eax, bx
xor ax, 0x10
mov word [rbp - 6], ax
mov word [rbp - 4], r11w
mov word [rbp - 2], dx
mov word [rbp], r10w
mov word [rbp + 2], r9w
movzx eax, bx
xor ax, 0x14
mov word [rbp + 4], ax
mov word [rbp + 6], r8w
movzx eax, bx
xor ax, 4
mov word [rbp + 8], ax
mov word [rbp + 0xa], ax
xor bx, 0x4d
mov word [rbp + 0xc], bx
mov word [rbp + 0xe], r11w
mov word [rbp + 0x10], di
lea rdx, [rbp - 0x1e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14004c310
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14004c4f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724502
movdqa xmm0, xmmword [0x14013e8c0]
mov dword [rbp - 0x10], 0x65636f72
mov dword [rbp - 0xc], 0x2e7373
movdqu xmmword [rbp - 0x20], xmm0
lea rdx, [rbp - 0x1f]
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
mov r9d, 0x10
lea r8, [rsp + 0x31]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x14004bfdf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bf1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004bf1a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400510bc
jmp 0x14004bfdf
movdqa xmm0, xmmword [0x14013e960]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x2e646e
lea rdx, [rbp - 0x1f]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400035b0
lea rdx, [0x140003780]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x7272452a
movdqa xmm0, xmmword [0x14013e950]
mov dword [rbp - 0x10], 0x2e646e
jmp 0x14004bfb7
movdqa xmm0, xmmword [0x14013e980]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x2e747369
mov word [rbp - 0xc], 0xa
lea rcx, [rbp - 0x1f]
call fcn.140006860
mov rcx, rsi
call fcn.140006860
mov dword [rsp + 0x30], 0x7272451d
movdqa xmm0, xmmword [0x14013e970]
mov dword [rbp - 0x10], 0x2e747369
mov byte [rbp - 0xc], dil
lea rdx, [rbp - 0x1f]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], dil
mov r9d, 0x10
lea r8, [rsp + 0x31]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.140051060
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret