Function at 0x14004e380
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x1400d0040]
xor rax, rsp
mov qword [rbp + 0x200], rax
xor esi, esi
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
mov qword [rbp + 0x90], rsi
lea rdi, [0x1400b8d00]
lea r14, [0x1400b3230]
sub rdi, r14
movabs r15, 0x7fffffffffffffff
je 0x14004e458
cmp rdi, r15
ja 0x14004f64c
cmp rdi, 0x1000
jb 0x14004e427
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x14004f652
call fcn.1400a4368
mov rcx, rax
test rax, rax
je 0x14004f63f
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14004e42f
mov rcx, rdi
call fcn.1400a4368
mov qword [rbp + 0x80], rax
lea rbx, [rax + rdi]
mov qword [rbp + 0x90], rbx
mov r8, rdi
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x88], rbx
jmp 0x14004e45f
mov rbx, qword [rbp + 0x88]
sub rbx, qword [rbp + 0x80]
jne 0x14004e49c
movdqa xmm0, xmmword [0x1400bd690]
movdqu xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x1400bd660]
movdqu xmmword [rsp + 0x58], xmm1
mov dword [rsp + 0x68], 0xa657a
lea rcx, [rsp + 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
jmp 0x14004ebfc
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], rax
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rsi
cmp rbx, r15
ja 0x14004f658
cmp rbx, 0x1000
jb 0x14004e4fc
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14004f646
call fcn.1400a4368
test rax, rax
je 0x14004e4f5
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14004e507
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400a4368
mov r14, rax
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
lea rcx, [r14 + rbx]
mov qword [rbp - 0x30], rcx
mov rbx, qword [rbp + 0x80]
mov rdi, qword [rbp + 0x88]
mov r8, rdi
sub r8, rbx
mov rdx, rbx
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
sub rdi, rbx
add rdi, r14
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x38], rsi
mov rcx, qword [rbp - 0x40]
mov qword [rbp - 0x40], rsi
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x70], rsi
mov qword [rbp + 0x60], rcx
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
mov qword [rbp + 0x68], rcx
movzx eax, word [rcx + 0x14]
add rcx, 0x18
add rcx, rax
mov qword [rbp + 0x70], rcx
call fcn.14004ddb0
test al, al
jne 0x14004e5bb
movdqa xmm0, xmmword [0x1400bd6a0]
movdqa xmm1, xmmword [0x1400bd6e0]
mov dword [rsp + 0x68], 0x2e2e2e2e
mov word [rsp + 0x6c], 0xa
jmp 0x14004eb58
lea rcx, [rbp + 0x98]
call fcn.140048700
mov eax, 0x5a4d
cmp word [0x1400b5680], ax
jne 0x14004e5ec
movsxd r8, dword [0x1400b56bc]
lea rcx, [0x1400b5680]
add r8, 8
add r8, rcx
jmp 0x14004e5f2
mov r8d, 4
mov r8d, dword [r8]
call fcn.140048db0
test al, al
jne 0x14004e62b
movdqa xmm0, xmmword [0x1400bd640]
movdqa xmm1, xmmword [0x1400bd5c0]
mov dword [rsp + 0x68], 0x68636143
mov dword [rsp + 0x6c], 0x62615465
mov dword [rsp + 0x70], 0xa656c
jmp 0x14004eb58
lea rax, vtable.std::_Func_impl_no_alloc_class__bool___cdecl_antagonist::roblox::init_void_::_2::_lambda_4___unsigned_long_long_unsigned___int64___char_const____ptr64__char_const____ptr64_.0
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov qword [rbp - 0x80], rax
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x30]
call fcn.1400479f0
mov r9, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
cmp r9, rdi
je 0x14004e662
mov rdi, r9
mov qword [rbp + 0x50], r9
mov r8, qword [rbp + 0x68]
mov ebx, dword [r8 + 0x50]
mov rcx, rdi
sub rcx, r9
cmp rbx, rcx
jae 0x14004e67b
lea rax, [r9 + rbx]
jmp 0x14004e6bb
jbe 0x14004e6bf
mov rax, qword [rbp + 0x58]
sub rax, r9
cmp rbx, rax
jbe 0x14004e69f
mov rdx, rbx
lea rcx, [rbp + 0x48]
call fcn.140047be0
mov r8, qword [rbp + 0x68]
mov r9, qword [rbp + 0x48]
jmp 0x14004e6bf
sub rbx, rcx
mov r8, rbx
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
lea rax, [rbx + rdi]
mov r8, qword [rbp + 0x68]
mov r9, qword [rbp + 0x48]
mov qword [rbp + 0x50], rax
mov eax, dword [r8 + 0x54]
test eax, eax
je 0x14004e6de
mov r8d, eax
mov rdx, qword [rbp + 0x30]
mov rcx, r9
call sub.VCRUNTIME140.dll_memmove
mov r8, qword [rbp + 0x68]
mov r9, qword [rbp + 0x48]
mov rbx, rsi
cmp si, word [r8 + 6]
jae 0x14004e72e
mov rdi, rsi
nop dword [rax + rax]
mov rdx, qword [rbp + 0x70]
mov ecx, dword [rdx + rdi + 0xc]
add rcx, r9
mov r10d, dword [rdx + rdi + 0x10]
mov edx, dword [rdx + rdi + 0x14]
add rdx, qword [rbp + 0x30]
test r10d, r10d
je 0x14004e71d
mov r8d, r10d
call sub.VCRUNTIME140.dll_memmove
mov r8, qword [rbp + 0x68]
mov r9, qword [rbp + 0x48]
inc rbx
add rdi, 0x28
movzx eax, word [r8 + 6]
cmp rbx, rax
jb 0x14004e6f0
mov r14d, dword [r8 + 0x50]
mov r13d, 8
mov ebx, r13d
mov rax, qword gs:[0x58]
add rbx, qword [rax]
mov eax, dword [rbx]
cmp dword [0x1400d26f0], eax
jle 0x14004e788
lea rcx, [0x1400d26f0]
call fcn.1400a42f0
cmp dword [0x1400d26f0], 0xffffffff
jne 0x14004e788
xor r8d, r8d
lea rdx, [0x1400b3108]
call fcn.140047ee0
mov qword [0x1400d2690], rax
lea rcx, [0x1400d26f0]
call fcn.1400a4284
mov rdi, qword [0x1400d2690]
mov eax, dword [rbx]
cmp dword [0x1400d26d0], eax
jle 0x14004e7de
lea rcx, [0x1400d26d0]
call fcn.1400a42f0
cmp dword [0x1400d26d0], 0xffffffff
jne 0x14004e7de
lea rcx, [0x1400b3068]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400d26a0], rax
lea rcx, [0x1400d26d0]
call fcn.1400a4284
mov rcx, qword [0x1400d1cb8]
mov rdx, rdi
call fcn.140048400
mov rax, qword [0x1400d26a0]
mov rdx, r14
xor ecx, ecx
call rax
mov r12, rax
mov rcx, qword [0x1400d1cb8]
call fcn.140048600
mov rcx, qword [rbp + 0x68]
test byte [rcx + 0x16], 1
jne 0x14004e912
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.dbghelp.dll_ImageNtHeader]
mov r15, rax
mov r8d, 5
lea r9, [rbp + 0xa0]
mov dl, 1
mov rcx, rax
call qword [sym.imp.dbghelp.dll_ImageDirectoryEntryToData]
mov rbx, rax
mov rdi, r12
sub rdi, qword [r15 + 0x30]
je 0x14004e904
mov ecx, dword [rbp + 0xa0]
test ecx, ecx
je 0x14004e904
lea r14, [rax + rcx]
cmp rax, r14
jae 0x14004e904
lea r13, [0x140000000]
nop
xor r9d, r9d
mov r8d, dword [rbx]
mov rdx, qword [rbp + 0x48]
mov rcx, r15
call qword [sym.imp.dbghelp.dll_ImageRvaToVa]
mov r8, rax
mov r9d, dword [rbx + 4]
sub r9d, 8
shr r9d, 1
lea rbx, [rbx + 8]
mov r10d, esi
je 0x14004e8f5
nop word [rax + rax]
movzx edx, word [rbx]
mov ecx, edx
shr ecx, 0xc
cmp ecx, 0xa
ja case.0x14004e8b8.5
mov ecx, dword [r13 + rcx*4 + 0x4f660]
add rcx, r13
jmp rcx
and edx, 0xfff
add rdx, r8
mov rax, rdi
shr rax, 0x10
add word [rdx], ax
jmp case.0x14004e8b8.0
and edx, 0xfff
add rdx, r8
add word [rdx], di
jmp case.0x14004e8b8.0
and edx, 0xfff
add rdx, r8
add qword [rdx], rdi
inc r10d
add rbx, 2
cmp r10d, r9d
jb 0x14004e8a0
cmp rbx, r14
jb 0x14004e870
mov r13d, 8
mov rcx, qword [rbp + 0x68]
movabs r15, 0x7fffffffffffffff
mov ebx, dword [rcx + 0x50]
mov r14, qword [rbp + 0x48]
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov eax, r13d
mov ecx, dword [rax + rdi]
cmp dword [0x1400d26d4], ecx
jle 0x14004e96a
lea rcx, [0x1400d26d4]
call fcn.1400a42f0
cmp dword [0x1400d26d4], 0xffffffff
jne 0x14004e96a
xor r8d, r8d
lea rdx, str.RtlCopyMemory
call fcn.140047ee0
mov qword [0x1400d26e0], rax
lea rcx, [0x1400d26d4]
call fcn.1400a4284
mov qword [rsp + 0x20], rbx
mov r9, r14
mov r8, r12
mov rdx, qword [0x1400d26e0]
call fcn.14004a8c0
mov rax, qword [rbp + 0x68]
mov ebx, dword [rax + 0x28]
add rbx, r12
mov r14d, dword [rax + 0x50]
mov eax, r13d
mov ecx, dword [rax + rdi]
cmp dword [0x1400d2804], ecx
jle 0x14004e9e2
lea rcx, [0x1400d2804]
call fcn.1400a42f0
cmp dword [0x1400d2804], 0xffffffff
jne 0x14004e9e2
lea rcx, [0x1400b3068]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400d27c8], rax
lea rcx, [0x1400d2804]
call fcn.1400a4284
mov rcx, qword [0x1400d1cb8]
mov rdx, rbx
call fcn.140048400
mov rax, qword [0x1400d27c8]
mov rdx, r14
mov rcx, r12
call rax
mov ebx, eax
mov rcx, qword [0x1400d1cb8]
call fcn.140048600
movdqa xmm0, xmmword [0x1400bd760]
movdqu xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x1400bd6d0]
movdqu xmmword [rsp + 0x58], xmm1
mov word [rsp + 0x68], 0xa
mov edx, ebx
lea rcx, [rsp + 0x49]
call fcn.140047960
mov rax, qword [rbp + 0x68]
mov r14d, dword [rax + 0x54]
mov eax, r13d
mov ecx, dword [rax + rdi]
cmp dword [0x1400d2698], ecx
jle 0x14004ea8a
lea rcx, [0x1400d2698]
call fcn.1400a42f0
cmp dword [0x1400d2698], 0xffffffff
jne 0x14004ea8a
xor r8d, r8d
lea rdx, str.RtlZeroMemory
call fcn.140047ee0
mov qword [0x1400d2670], rax
lea rcx, [0x1400d2698]
call fcn.1400a4284
mov rbx, qword [0x1400d2670]
mov eax, r13d
mov r8d, dword [rax + rdi]
cmp dword [0x1400d27a8], r8d
jle 0x14004eae6
lea rcx, [0x1400d27a8]
call fcn.1400a42f0
cmp dword [0x1400d27a8], 0xffffffff
jne 0x14004eae6
lea rcx, [0x1400b3068]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400d2688], rax
lea rcx, [0x1400d27a8]
call fcn.1400a4284
mov rcx, qword [0x1400d1cb8]
mov rdx, rbx
call fcn.140048400
mov rdx, r14
mov rcx, r12
call qword [0x1400d2688]
mov rcx, qword [0x1400d1cb8]
call fcn.140048600
mov rcx, qword [0x1400d1cc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14004eb2b
call fcn.14004da70
test al, al
je 0x14004eb2b
mov al, 1
jmp 0x14004eb2d
xor al, al
test al, al
jne 0x14004ec43
movdqa xmm0, xmmword [0x1400bd6b0]
movdqa xmm1, xmmword [0x1400bd700]
mov dword [rsp + 0x68], 0x2e2e7265
mov word [rsp + 0x6c], 0xa2e
mov byte [rsp + 0x6e], al
movdqu xmmword [rsp + 0x48], xmm0
movdqu xmmword [rsp + 0x58], xmm1
lea rcx, [rsp + 0x49]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
nop
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14004ebb6
mov rdx, qword [rbp + 0x58]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004eba5
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f5e4
call fcn.1400a4240
xorps xmm0, xmm0
mov qword [rbp + 0x48], rsi
movdqa xmmword [rbp + 0x50], xmm0
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14004ebfc
mov rdx, qword [rbp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ebeb
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f5e4
call fcn.1400a4240
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rsi
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x14004ec3c
mov rdx, qword [rbp + 0x90]
sub rdx, rcx
cmp rdx, 0x1000
mov rax, rcx
jb 0x14004ec37
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f63f
call fcn.1400a4240
mov al, 1
jmp 0x14004ee4b
movdqa xmm0, xmmword [0x1400bd670]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0x7a696c61
mov dword [rsp + 0x5c], 0xa676e69
mov byte [rsp + 0x60], 0
lea rcx, [rsp + 0x49]
call fcn.140047960
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, str..IoControl
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400d1d80], rax
test rax, rax
je 0x14004f549
cmp rax, 0xffffffffffffffff
je 0x14004f549
movdqa xmm0, xmmword [0x1400bd6f0]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0x78652e61
mov word [rsp + 0x5c], 0x65
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0xd0], 0x130
lea rdx, [rbp + 0xd0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14004ed2e
nop dword [rax]
lea rdx, [rsp + 0x49]
lea rcx, [rbp + 0xfc]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x14004ee7b
lea rdx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14004ed00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov dword [0x1400d1d88], eax
test eax, eax
jne 0x14004ee8d
movdqa xmm0, xmmword [0x1400bd6c0]
movdqu xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x1400bd680]
movdqu xmmword [rsp + 0x58], xmm1
mov dword [rsp + 0x68], 0x64657a69
mov word [rsp + 0x6c], 0xa
lea rcx, [rsp + 0x49]
call fcn.140047960
nop
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14004edc3
mov rdx, qword [rbp + 0x58]
sub rdx, rcx
cmp rdx, 0x1000
mov rax, rcx
jb 0x14004edb2
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f5e4
call fcn.1400a4240
xorps xmm0, xmm0
mov qword [rbp + 0x48], rsi
movdqa xmmword [rbp + 0x50], xmm0
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14004ee09
mov rdx, qword [rbp + 0x40]
sub rdx, rcx
cmp rdx, 0x1000
mov rax, rcx
jb 0x14004edf8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f5e4
call fcn.1400a4240
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rsi
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x14004ee49
mov rdx, qword [rbp + 0x90]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ee44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f63f
call fcn.1400a4240
xor al, al
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.1400a4220
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0xd8]
jmp 0x14004ed39
call fcn.14004df90
lea rcx, [rax + 0x10]
call fcn.140051270
mov rdi, rax
lea rdx, [0x14004c210]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rbx, rax
call fcn.14004df90
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x140051230]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.14004df90
lea rcx, [rax + 0xd8]
call fcn.140051270
lea rcx, [rax + 0x150]
call fcn.140051270
mov rbx, rax
mov qword [rbp + 0xa0], rax
test rdi, rdi
jne 0x14004ef53
mov dword [rbp - 0x78], 0x55534127
mov word [rbp - 0x74], 0x494d
mov byte [rbp - 0x72], dil
movdqa xmm0, xmmword [0x1400bd5f0]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0x61757369
mov dword [rsp + 0x5c], 0x6e45206c
mov dword [rsp + 0x60], 0x656e6967
mov byte [rsp + 0x64], dil
lea r9d, [rdi + 0x10]
lea r8, [rbp - 0x77]
lea rdx, [rsp + 0x49]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
test rbx, rbx
jne 0x14004ef9f
mov dword [rbp - 0x68], 0x55534175
mov word [rbp - 0x64], 0x494d
mov byte [rbp - 0x62], bl
movdqa xmm0, xmmword [0x1400bd5d0]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0x6d617461
mov dword [rsp + 0x5c], 0x6c65646f
mov byte [rsp + 0x60], bl
lea r9d, [rbx + 0x10]
lea r8, [rbp - 0x67]
lea rdx, [rsp + 0x49]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov qword [0x1400d1dc0], rbx
mov dword [rbp - 0x50], 0x616c5001
mov dword [rbp - 0x4c], 0x73726579
mov byte [rbp - 0x48], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
lea rax, [rbp - 0x4f]
mov r14, 0xffffffffffffffff
mov r8, r14
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004efe0
lea rdx, [rbp - 0x4f]
lea rcx, [rsp + 0x48]
call fcn.140001a40
lea r8, [rsp + 0x48]
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0xa0]
call fcn.14004fcb0
mov rbx, qword [rbp + 0xa8]
test rbx, rbx
jne 0x14004f062
mov dword [rbp - 0x70], 0x5553410b
mov word [rbp - 0x6c], 0x494d
mov byte [rbp - 0x6a], bl
movdqa xmm0, xmmword [0x1400bd5e0]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0x6579616c
mov word [rsp + 0x5c], 0x7372
mov byte [rsp + 0x5e], bl
lea r9d, [rbx + 0x10]
lea r8, [rbp - 0x6f]
lea rdx, [rsp + 0x49]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov qword [0x1400d1db0], rbx
mov qword [0x1400d1d98], rdi
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xc8], 0xf
mov byte [rbp + 0xb0], 0
lea rcx, [rbx + 0xc8]
call fcn.140051270
lea rcx, [rax + 0x1d8]
call fcn.140051270
test rax, rax
je 0x14004f18c
lea rcx, [rax + 0x48]
call fcn.140051270
test rax, rax
je 0x14004f0d1
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14004fa70
jmp 0x14004f111
mov dword [rsp + 0x40], 0x3f3f3f24
mov byte [rsp + 0x44], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0x41]
inc r14
cmp byte [rax + r14], 0
jne 0x14004f0f5
mov r8, r14
lea rdx, [rsp + 0x41]
lea rcx, [rsp + 0x48]
call fcn.140001a40
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x14004f155
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f150
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f150
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a4240
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
lea rcx, [rsp + 0x48]
call fcn.140005060
jmp 0x14004f1fb
mov dword [rsp + 0x40], 0x6e6f6e25
mov word [rsp + 0x44], 0x65
lea rax, [rsp + 0x41]
inc r14
cmp byte [rax + r14], 0
jne 0x14004f1a0
mov rax, qword [rbp + 0xc8]
cmp r14, rax
ja 0x14004f1e7
lea rbx, [rbp + 0xb0]
cmp rax, 0xf
cmova rbx, qword [rbp + 0xb0]
mov qword [rbp + 0xc0], r14
mov r8, r14
lea rdx, [rsp + 0x41]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + r14], 0
jmp 0x14004f1fb
lea r9, [rsp + 0x41]
mov rdx, r14
lea rcx, [rbp + 0xb0]
call fcn.1400518c0
call fcn.1400556f0
test rax, rax
jne 0x14004f216
lea rcx, [rbp + 0xb0]
call fcn.140005060
jmp 0x14004ed7d
mov ecx, 8
call fcn.1400a4368
lea rcx, [0x14004b850]
mov qword [rax], rcx
mov qword [rbp + 0xa8], rax
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140052300]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x14004f53a
cmp dword [rbp - 0x38], 0
je 0x14004f52e
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14004f52e
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
lea ecx, [rax + 8]
call fcn.1400a4368
lea rcx, [0x1400a1e20]
mov qword [rax], rcx
mov qword [rbp + 0xa8], rax
lea rcx, [rbp + 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140052300]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp], rax
test rax, rax
je 0x14004f51f
cmp dword [rbp + 8], 0
je 0x14004f513
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp - 0x40], xmm0
lea rcx, [rbp - 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14004f513
movdqa xmm0, xmmword [0x1400bd4b0]
movdqu xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x1400bd4c0]
movdqu xmmword [rsp + 0x58], xmm1
movdqa xmm0, xmmword [0x1400bd600]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x78], 0x4662
mov byte [rsp + 0x7a], al
nop dword [rax]
movzx eax, byte [rsp + 0x48]
xor byte [rsp + rsi + 0x49], al
movzx eax, byte [rsp + 0x48]
xor byte [rsp + rsi + 0x4a], al
movzx eax, byte [rsp + 0x48]
xor byte [rsp + rsi + 0x4b], al
movzx eax, byte [rsp + 0x48]
xor byte [rsp + rsi + 0x4c], al
movzx eax, byte [rsp + 0x48]
xor byte [rsp + rsi + 0x4d], al
movzx eax, byte [rsp + 0x48]
xor byte [rsp + rsi + 0x4e], al
movzx eax, byte [rsp + 0x48]
xor byte [rsp + rsi + 0x4f], al
add rsi, 7
cmp rsi, 0x31
jb 0x14004f330
mov byte [rsp + 0x7a], 0
lea rcx, [rsp + 0x49]
call fcn.140047960
lea rcx, [rbp + 0x10]
call fcn.14004b9f0
movabs rcx, 0x7fffffff4d2fa1ff
mov rax, qword [rbp + 0x10]
cmp rax, rcx
je 0x14004f3b5
setl cl
test cl, cl
je 0x14004f3b5
mov ebx, 0xb2d05e00
add rbx, rax
jmp 0x14004f3b8
mov rbx, r15
mov edi, 0xff
movabs rsi, 0x4e94914effff
movabs r14, 0x431bde82d7b634db
lea rcx, [rbp + 0x18]
call fcn.14004b9f0
mov rax, qword [rbp + 0x18]
cmp rbx, rax
je 0x14004f432
mov ecx, 1
cmovl ecx, edi
test cl, cl
jle 0x14004f432
mov rcx, rbx
sub rcx, rax
cmp rcx, rsi
jg 0x14004f426
mov rax, r14
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14004f41d
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x14004f3d1
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x14004f3d1
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movabs r15, 0x7ffffffdabf41bff
movabs r12, 0x2540be400
movabs r13, 0x7fffffffffffffff
lea rcx, [rbp + 0x20]
call fcn.14004b9f0
mov rax, qword [rbp + 0x20]
cmp rax, r15
je 0x14004f47e
setl cl
test cl, cl
lea rbx, [rax + r12]
jne 0x14004f481
mov rbx, r13
lea rcx, [rbp - 0x10]
call fcn.14004b9f0
mov rax, qword [rbp - 0x10]
cmp rbx, rax
je 0x14004f4e2
mov ecx, 1
cmovl ecx, edi
test cl, cl
jle 0x14004f4e2
mov rcx, rbx
sub rcx, rax
cmp rcx, rsi
jg 0x14004f4d6
mov rax, r14
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14004f4cd
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x14004f481
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x14004f481
mov dword [rbp - 0x60], 0x626f522d
mov dword [rbp - 0x5c], 0x786f6c
lea rdx, [rbp - 0x5f]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14004f461
call fcn.14004df60
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 8], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x38], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
movdqa xmm0, xmmword [0x1400bd650]
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [str.r_Is_Not_Loaded_nL]
movdqu xmmword [rbp - 0x30], xmm1
mov byte [rbp - 0x20], 0
lea rcx, [rbp - 0x3f]
call fcn.140047960
nop
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14004f5b3
mov rdx, qword [rbp + 0x58]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f5a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f5e4
call fcn.1400a4240
mov qword [rbp + 0x48], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x50], xmm0
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14004f5fc
mov rdx, qword [rbp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f5eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f5eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a4240
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rsi
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x14004ee49
mov rdx, qword [rbp + 0x90]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ee44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004ee44
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001920
nop
call fcn.140006b40
int3
call fcn.140001920
nop
call fcn.140006b40
int3