Function at 0x6b3d40
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
xor eax, eax
cmp eax, dword [esp + 0x1c]
je CryptGetProvParam
call 0x6b3d55
pop eax
lea ebp, [0xab2150]
test dword [ebp], 0x1000000
je 0x6b3d73
test dword [ebp + 4], 0x200
je 0x6b3d73
jmp CryptHashData
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
sub esp, 0x84
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], edx
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], edx
mov eax, dword [edi]
mov ebx, dword [edi + 4]
mov ecx, dword [edi + 8]
mov edx, dword [edi + 0xc]
sub eax, 1
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
jmp 0x6b3df5
mov dword [esp + 0x9c], ebx
mov dword [esp + 0x98], eax
mov dword [esp + 0xa0], ecx
mov eax, 0x61707865
mov dword [esp + 4], 0x3320646e
mov dword [esp + 8], 0x79622d32
mov dword [esp + 0xc], 0x6b206574
mov ebx, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
mov ecx, dword [esp + 0x68]
mov esi, dword [esp + 0x6c]
mov edx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], edi
mov ebx, dword [esp + 0x5c]
mov edi, dword [esp + 0x7c]
mov edx, dword [esp + 0x70]
mov ebp, dword [esp + 0x50]
mov ecx, dword [esp + 0x60]
mov esi, dword [esp + 0x64]
add edx, 1
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x70], edx
mov ebx, 0xa
jmp 0x6b3e70
add eax, ebp
mov dword [esp + 0x80], ebx
mov ebx, ebp
xor edx, eax
rol edx, 0x10
add ecx, edx
xor ebx, ecx
mov edi, dword [esp + 0x34]
rol ebx, 0xc
mov ebp, dword [esp + 0x14]
add eax, ebx
xor edx, eax
mov dword [esp], eax
rol edx, 8
mov eax, dword [esp + 4]
add ecx, edx
mov dword [esp + 0x30], edx
xor ebx, ecx
add eax, ebp
rol ebx, 7
xor edi, eax
mov dword [esp + 0x20], ecx
rol edi, 0x10
mov dword [esp + 0x10], ebx
add esi, edi
mov ecx, dword [esp + 0x28]
xor ebp, esi
mov edx, dword [esp + 0x38]
rol ebp, 0xc
mov ebx, dword [esp + 0x18]
add eax, ebp
xor edi, eax
mov dword [esp + 4], eax
rol edi, 8
mov eax, dword [esp + 8]
add esi, edi
mov dword [esp + 0x34], edi
xor ebp, esi
add eax, ebx
rol ebp, 7
xor edx, eax
mov dword [esp + 0x24], esi
rol edx, 0x10
mov dword [esp + 0x14], ebp
add ecx, edx
mov esi, dword [esp + 0x2c]
xor ebx, ecx
mov edi, dword [esp + 0x3c]
rol ebx, 0xc
mov ebp, dword [esp + 0x1c]
add eax, ebx
xor edx, eax
mov dword [esp + 8], eax
rol edx, 8
mov eax, dword [esp + 0xc]
add ecx, edx
mov dword [esp + 0x38], edx
xor ebx, ecx
add eax, ebp
rol ebx, 7
xor edi, eax
rol edi, 0x10
mov dword [esp + 0x18], ebx
add esi, edi
xor ebp, esi
rol ebp, 0xc
mov ebx, dword [esp + 0x14]
add eax, ebp
xor edi, eax
mov dword [esp + 0xc], eax
rol edi, 8
mov eax, dword [esp]
add esi, edi
mov edx, edi
xor ebp, esi
add eax, ebx
rol ebp, 7
xor edx, eax
rol edx, 0x10
mov dword [esp + 0x1c], ebp
add ecx, edx
xor ebx, ecx
mov edi, dword [esp + 0x30]
rol ebx, 0xc
mov ebp, dword [esp + 0x18]
add eax, ebx
xor edx, eax
mov dword [esp], eax
rol edx, 8
mov eax, dword [esp + 4]
add ecx, edx
mov dword [esp + 0x3c], edx
xor ebx, ecx
add eax, ebp
rol ebx, 7
xor edi, eax
mov dword [esp + 0x28], ecx
rol edi, 0x10
mov dword [esp + 0x14], ebx
add esi, edi
mov ecx, dword [esp + 0x20]
xor ebp, esi
mov edx, dword [esp + 0x34]
rol ebp, 0xc
mov ebx, dword [esp + 0x1c]
add eax, ebp
xor edi, eax
mov dword [esp + 4], eax
rol edi, 8
mov eax, dword [esp + 8]
add esi, edi
mov dword [esp + 0x30], edi
xor ebp, esi
add eax, ebx
rol ebp, 7
xor edx, eax
mov dword [esp + 0x2c], esi
rol edx, 0x10
mov dword [esp + 0x18], ebp
add ecx, edx
mov esi, dword [esp + 0x24]
xor ebx, ecx
mov edi, dword [esp + 0x38]
rol ebx, 0xc
mov ebp, dword [esp + 0x10]
add eax, ebx
xor edx, eax
mov dword [esp + 8], eax
rol edx, 8
mov eax, dword [esp + 0xc]
add ecx, edx
mov dword [esp + 0x34], edx
xor ebx, ecx
add eax, ebp
rol ebx, 7
xor edi, eax
rol edi, 0x10
mov dword [esp + 0x1c], ebx
add esi, edi
xor ebp, esi
mov edx, dword [esp + 0x30]
rol ebp, 0xc
mov ebx, dword [esp + 0x80]
add eax, ebp
xor edi, eax
mov dword [esp + 0xc], eax
rol edi, 8
mov eax, dword [esp]
add esi, edi
mov dword [esp + 0x38], edi
xor ebp, esi
rol ebp, 7
dec ebx
jne 0x6b3e70
mov ebx, dword [esp + 0xa0]
add eax, 0x61707865
add ebp, dword [esp + 0x50]
add ecx, dword [esp + 0x60]
add esi, dword [esp + 0x64]
cmp ebx, 0x40
jb 0x6b4141
mov ebx, dword [esp + 0x9c]
add edx, dword [esp + 0x70]
add edi, dword [esp + 0x78]
xor eax, dword [ebx]
xor ebp, dword [ebx + 0x10]
mov dword [esp], eax
mov eax, dword [esp + 0x98]
xor ecx, dword [ebx + 0x20]
xor esi, dword [ebx + 0x24]
xor edx, dword [ebx + 0x30]
xor edi, dword [ebx + 0x38]
mov dword [eax + 0x10], ebp
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], esi
mov dword [eax + 0x30], edx
mov dword [eax + 0x38], edi
mov ebp, dword [esp + 4]
mov ecx, dword [esp + 8]
mov esi, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
add ebp, 0x3320646e
add ecx, 0x79622d32
add esi, 0x6b206574
add edx, dword [esp + 0x54]
add edi, dword [esp + 0x58]
xor ebp, dword [ebx + 4]
xor ecx, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
xor edx, dword [ebx + 0x14]
xor edi, dword [ebx + 0x18]
mov dword [eax + 4], ebp
mov dword [eax + 8], ecx
mov dword [eax + 0xc], esi
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], edi
mov ebp, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
mov edi, dword [esp + 0x3c]
add ebp, dword [esp + 0x5c]
add ecx, dword [esp + 0x68]
add esi, dword [esp + 0x6c]
add edx, dword [esp + 0x74]
add edi, dword [esp + 0x7c]
xor ebp, dword [ebx + 0x1c]
xor ecx, dword [ebx + 0x28]
xor esi, dword [ebx + 0x2c]
xor edx, dword [ebx + 0x34]
xor edi, dword [ebx + 0x3c]
lea ebx, [ebx + 0x40]
mov dword [eax + 0x1c], ebp
mov ebp, dword [esp]
mov dword [eax + 0x28], ecx
mov ecx, dword [esp + 0xa0]
mov dword [eax + 0x2c], esi
mov dword [eax + 0x34], edx
mov dword [eax + 0x3c], edi
mov dword [eax], ebp
lea eax, [eax + 0x40]
sub ecx, 0x40
jne RegEnumKeyExA
jmp CreateThread
add edx, dword [esp + 0x70]
add edi, dword [esp + 0x78]
mov dword [esp], eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], esi
mov dword [esp + 0x30], edx
mov dword [esp + 0x38], edi
mov ebp, dword [esp + 4]
mov ecx, dword [esp + 8]
mov esi, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
add ebp, 0x3320646e
add ecx, 0x79622d32
add esi, 0x6b206574
add edx, dword [esp + 0x54]
add edi, dword [esp + 0x58]
mov dword [esp + 4], ebp
mov dword [esp + 8], ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edi
mov ebp, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
mov edi, dword [esp + 0x3c]
add ebp, dword [esp + 0x5c]
add ecx, dword [esp + 0x68]
add esi, dword [esp + 0x6c]
add edx, dword [esp + 0x74]
add edi, dword [esp + 0x7c]
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x9c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x98]
mov dword [esp + 0x2c], esi
xor esi, esi
mov dword [esp + 0x34], edx
mov dword [esp + 0x3c], edi
xor eax, eax
xor edx, edx
mov al, byte [esi + ebp]
mov dl, byte [esp + esi]
lea esi, [esi + 1]
xor al, dl
mov byte [ecx + esi - 1], al
dec ebx
jne 0x6b41f2
add esp, 0x84
pop edi
pop esi
pop ebx
pop ebp
ret
test dword [ebp + 4], 0x800
jne 0x6b4504
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov ebp, esp
sub esp, 0x20c
and esp, 0xffffffc0
mov dword [esp + 0x200], ebp
lea eax, [eax + 0x6eb]
movdqu xmm3, xmmword [ebx]
movdqa xmm0, xmmword [eax + 0x20]
movdqu xmm1, xmmword [edx]
movdqu xmm2, xmmword [edx + 0x10]
movdqa xmm6, xmmword [eax]
movdqa xmm7, xmmword [eax + 0x10]
mov dword [esp + 0x30], ebp
movdqa xmmword [esp], xmm0
movdqa xmmword [esp + 0x10], xmm1
movdqa xmmword [esp + 0x20], xmm2
movdqa xmmword [esp + 0x30], xmm3
mov edx, 0xa
jmp GetFileType
movdqa xmm3, xmmword [eax + 0x50]
movdqa xmm0, xmmword [esp]
movdqa xmm1, xmmword [esp + 0x10]
movdqa xmm2, xmmword [esp + 0x20]
paddd xmm3, xmmword [esp + 0x30]
mov edx, 0xa
movdqa xmmword [esp + 0x30], xmm3
jmp 0x6b42c0
paddd xmm0, xmm1
pxor xmm3, xmm0
pshufb xmm3, xmm6
paddd xmm2, xmm3
pxor xmm1, xmm2
movdqa xmm4, xmm1
psrld xmm1, 0x14
pslld xmm4, 0xc
por xmm1, xmm4
paddd xmm0, xmm1
pxor xmm3, xmm0
pshufb xmm3, xmm7
paddd xmm2, xmm3
pxor xmm1, xmm2
movdqa xmm4, xmm1
psrld xmm1, 0x19
pslld xmm4, 7
por xmm1, xmm4
pshufd xmm2, xmm2, 0x4e
pshufd xmm1, xmm1, 0x39
pshufd xmm3, xmm3, 0x93
nop
paddd xmm0, xmm1
pxor xmm3, xmm0
pshufb xmm3, xmm6
paddd xmm2, xmm3
pxor xmm1, xmm2
movdqa xmm4, xmm1
psrld xmm1, 0x14
pslld xmm4, 0xc
por xmm1, xmm4
paddd xmm0, xmm1
pxor xmm3, xmm0
pshufb xmm3, xmm7
paddd xmm2, xmm3
pxor xmm1, xmm2
movdqa xmm4, xmm1
psrld xmm1, 0x19
pslld xmm4, 7
por xmm1, xmm4
pshufd xmm2, xmm2, 0x4e
pshufd xmm1, xmm1, 0x93
pshufd xmm3, xmm3, 0x39
dec edx
jne 0x6b42c0
paddd xmm0, xmmword [esp]
paddd xmm1, xmmword [esp + 0x10]
paddd xmm2, xmmword [esp + 0x20]
paddd xmm3, xmmword [esp + 0x30]
cmp ecx, 0x40
jb 0x6b43e5
movdqu xmm4, xmmword [esi]
movdqu xmm5, xmmword [esi + 0x10]
pxor xmm0, xmm4
movdqu xmm4, xmmword [esi + 0x20]
pxor xmm1, xmm5
movdqu xmm5, xmmword [esi + 0x30]
pxor xmm2, xmm4
pxor xmm3, xmm5
lea esi, [esi + 0x40]
movdqu xmmword [edi], xmm0
movdqu xmmword [edi + 0x10], xmm1
movdqu xmmword [edi + 0x20], xmm2
movdqu xmmword [edi + 0x30], xmm3
lea edi, [edi + 0x40]
sub ecx, 0x40
jne 0x6b4290
jmp 0x6b4414
movdqa xmmword [esp], xmm0
movdqa xmmword [esp + 0x10], xmm1
movdqa xmmword [esp + 0x20], xmm2
movdqa xmmword [esp + 0x30], xmm3
xor eax, eax
xor edx, edx
xor ebp, ebp
mov al, byte [esp + ebp]
mov dl, byte [esi + ebp]
lea ebp, [ebp + 1]
xor al, dl
mov byte [edi + ebp - 1], al
dec ecx
jne GetVersion
mov esp, dword [esp + 0x200]
pop edi
pop esi
pop ebx
pop ebp
ret
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
vzeroupper
mov ebp, esp
sub esp, 0x20c
and esp, 0xffffffc0
mov dword [esp + 0x200], ebp
lea eax, [eax + 0x6eb]
vmovdqu xmm3, xmmword [ebx]
cmp ecx, 0x100
jb QueryPerformanceCounter
mov dword [esp + 0x204], edx
mov dword [esp + 0x208], ebx
sub ecx, 0x100
lea ebp, [esp + 0x180]
vmovdqu xmm7, xmmword [edx]
vpshufd xmm0, xmm3, 0
vpshufd xmm1, xmm3, 0x55
vpshufd xmm2, xmm3, 0xaa
vpshufd xmm3, xmm3, 0xff
vpaddd xmm0, xmm0, xmmword [eax + 0x30]
vpshufd xmm4, xmm7, 0
vpshufd xmm5, xmm7, 0x55
vpsubd xmm0, xmm0, xmmword [eax + 0x40]
vpshufd xmm6, xmm7, 0xaa
vpshufd xmm7, xmm7, 0xff
vmovdqa xmmword [ebp + 0x40], xmm0
vmovdqa xmmword [ebp + 0x50], xmm1
vmovdqa xmmword [ebp + 0x60], xmm2
vmovdqa xmmword [ebp + 0x70], xmm3
vmovdqu xmm3, xmmword [edx + 0x10]
vmovdqa xmmword [ebp - 0x40], xmm4
vmovdqa xmmword [ebp - 0x30], xmm5
vmovdqa xmmword [ebp - 0x20], xmm6
vmovdqa xmmword [ebp - 0x10], xmm7
vmovdqa xmm7, xmmword [eax + 0x20]
lea ebx, [esp + 0x80]
vpshufd xmm0, xmm3, 0
vpshufd xmm1, xmm3, 0x55
vpshufd xmm2, xmm3, 0xaa
vpshufd xmm3, xmm3, 0xff
vpshufd xmm4, xmm7, 0
vpshufd xmm5, xmm7, 0x55
vpshufd xmm6, xmm7, 0xaa
vpshufd xmm7, xmm7, 0xff
vmovdqa xmmword [ebp], xmm0
vmovdqa xmmword [ebp + 0x10], xmm1
vmovdqa xmmword [ebp + 0x20], xmm2
vmovdqa xmmword [ebp + 0x30], xmm3
vmovdqa xmmword [ebp - 0x80], xmm4
vmovdqa xmmword [ebp - 0x70], xmm5
vmovdqa xmmword [ebp - 0x60], xmm6
vmovdqa xmmword [ebp - 0x50], xmm7
lea esi, [esi + 0x80]
lea edi, [edi + 0x80]
jmp SetLastError
vmovdqa xmm1, xmmword [ebp - 0x70]
vmovdqa xmm2, xmmword [ebp - 0x60]
vmovdqa xmm3, xmmword [ebp - 0x50]
vmovdqa xmm5, xmmword [ebp - 0x30]
vmovdqa xmm6, xmmword [ebp - 0x20]
vmovdqa xmm7, xmmword [ebp - 0x10]
vmovdqa xmmword [ebx - 0x70], xmm1
vmovdqa xmmword [ebx - 0x60], xmm2
vmovdqa xmmword [ebx - 0x50], xmm3
vmovdqa xmmword [ebx - 0x30], xmm5
vmovdqa xmmword [ebx - 0x20], xmm6
vmovdqa xmmword [ebx - 0x10], xmm7
vmovdqa xmm2, xmmword [ebp + 0x20]
vmovdqa xmm3, xmmword [ebp + 0x30]
vmovdqa xmm4, xmmword [ebp + 0x40]
vmovdqa xmm5, xmmword [ebp + 0x50]
vmovdqa xmm6, xmmword [ebp + 0x60]
vmovdqa xmm7, xmmword [ebp + 0x70]
vpaddd xmm4, xmm4, xmmword [eax + 0x40]
vmovdqa xmmword [ebx + 0x20], xmm2
vmovdqa xmmword [ebx + 0x30], xmm3
vmovdqa xmmword [ebx + 0x40], xmm4
vmovdqa xmmword [ebx + 0x50], xmm5
vmovdqa xmmword [ebx + 0x60], xmm6
vmovdqa xmmword [ebx + 0x70], xmm7
vmovdqa xmmword [ebp + 0x40], xmm4
vmovdqa xmm0, xmmword [ebp - 0x80]
vmovdqa xmm6, xmm4
vmovdqa xmm3, xmmword [ebp - 0x40]
vmovdqa xmm4, xmmword [ebp]
vmovdqa xmm5, xmmword [ebp + 0x10]
mov edx, 0xa
nop
vpaddd xmm0, xmm0, xmm3
vpxor xmm6, xmm6, xmm0
vprotd xmm6, xmm6, 0x10
vpaddd xmm4, xmm4, xmm6
vpxor xmm2, xmm3, xmm4
vmovdqa xmm1, xmmword [ebx - 0x70]
vprotd xmm2, xmm2, 0xc
vmovdqa xmm3, xmmword [ebx - 0x30]
vpaddd xmm0, xmm0, xmm2
vmovdqa xmm7, xmmword [ebx + 0x50]
vpxor xmm6, xmm6, xmm0
vpaddd xmm1, xmm1, xmm3
vprotd xmm6, xmm6, 8
vmovdqa xmmword [ebx - 0x80], xmm0
vpaddd xmm4, xmm4, xmm6
vmovdqa xmmword [ebx + 0x40], xmm6
vpxor xmm2, xmm2, xmm4
vpxor xmm7, xmm7, xmm1
vprotd xmm2, xmm2, 7
vmovdqa xmmword [ebx], xmm4
vprotd xmm7, xmm7, 0x10
vmovdqa xmmword [ebx - 0x40], xmm2
vpaddd xmm5, xmm5, xmm7
vmovdqa xmm4, xmmword [ebx + 0x20]
vpxor xmm3, xmm3, xmm5
vmovdqa xmm0, xmmword [ebx - 0x60]
vprotd xmm3, xmm3, 0xc
vmovdqa xmm2, xmmword [ebx - 0x20]
vpaddd xmm1, xmm1, xmm3
vmovdqa xmm6, xmmword [ebx + 0x60]
vpxor xmm7, xmm7, xmm1
vpaddd xmm0, xmm0, xmm2
vprotd xmm7, xmm7, 8
vmovdqa xmmword [ebx - 0x70], xmm1
vpaddd xmm5, xmm5, xmm7
vmovdqa xmmword [ebx + 0x50], xmm7
vpxor xmm3, xmm3, xmm5
vpxor xmm6, xmm6, xmm0
vprotd xmm3, xmm3, 7
vmovdqa xmmword [ebx + 0x10], xmm5
vprotd xmm6, xmm6, 0x10
vmovdqa xmmword [ebx - 0x30], xmm3
vpaddd xmm4, xmm4, xmm6
vmovdqa xmm5, xmmword [ebx + 0x30]
vpxor xmm2, xmm2, xmm4
vmovdqa xmm1, xmmword [ebx - 0x50]
vprotd xmm2, xmm2, 0xc
vmovdqa xmm3, xmmword [ebx - 0x10]
vpaddd xmm0, xmm0, xmm2
vmovdqa xmm7, xmmword [ebx + 0x70]
vpxor xmm6, xmm6, xmm0
vpaddd xmm1, xmm1, xmm3
vprotd xmm6, xmm6, 8
vmovdqa xmmword [ebx - 0x60], xmm0
vpaddd xmm4, xmm4, xmm6
vmovdqa xmmword [ebx + 0x60], xmm6
vpxor xmm2, xmm2, xmm4
vpxor xmm7, xmm7, xmm1
vprotd xmm2, xmm2, 7
vprotd xmm7, xmm7, 0x10
vmovdqa xmmword [ebx - 0x20], xmm2
vpaddd xmm5, xmm5, xmm7
vpxor xmm3, xmm3, xmm5
vmovdqa xmm0, xmmword [ebx - 0x80]
vprotd xmm3, xmm3, 0xc
vmovdqa xmm2, xmmword [ebx - 0x30]
vpaddd xmm1, xmm1, xmm3
vpxor xmm7, xmm7, xmm1
vpaddd xmm0, xmm0, xmm2
vprotd xmm7, xmm7, 8
vmovdqa xmmword [ebx - 0x50], xmm1
vpaddd xmm5, xmm5, xmm7
vpxor xmm3, xmm3, xmm5
vpxor xmm6, xmm7, xmm0
vprotd xmm3, xmm3, 7
vprotd xmm6, xmm6, 0x10
vmovdqa xmmword [ebx - 0x10], xmm3
vpaddd xmm4, xmm4, xmm6
vpxor xmm2, xmm2, xmm4
vmovdqa xmm1, xmmword [ebx - 0x70]
vprotd xmm2, xmm2, 0xc
vmovdqa xmm3, xmmword [ebx - 0x20]
vpaddd xmm0, xmm0, xmm2
vmovdqa xmm7, xmmword [ebx + 0x40]
vpxor xmm6, xmm6, xmm0
vpaddd xmm1, xmm1, xmm3
vprotd xmm6, xmm6, 8
vmovdqa xmmword [ebx - 0x80], xmm0
vpaddd xmm4, xmm4, xmm6
vmovdqa xmmword [ebx + 0x70], xmm6
vpxor xmm2, xmm2, xmm4
vpxor xmm7, xmm7, xmm1
vprotd xmm2, xmm2, 7
vmovdqa xmmword [ebx + 0x20], xmm4
vprotd xmm7, xmm7, 0x10
vmovdqa xmmword [ebx - 0x30], xmm2
vpaddd xmm5, xmm5, xmm7
vmovdqa xmm4, xmmword [ebx]
vpxor xmm3, xmm3, xmm5
vmovdqa xmm0, xmmword [ebx - 0x60]
vprotd xmm3, xmm3, 0xc
vmovdqa xmm2, xmmword [ebx - 0x10]
vpaddd xmm1, xmm1, xmm3
vmovdqa xmm6, xmmword [ebx + 0x50]
vpxor xmm7, xmm7, xmm1
vpaddd xmm0, xmm0, xmm2
vprotd xmm7, xmm7, 8
vmovdqa xmmword [ebx - 0x70], xmm1
vpaddd xmm5, xmm5, xmm7
vmovdqa xmmword [ebx + 0x40], xmm7
vpxor xmm3, xmm3, xmm5
vpxor xmm6, xmm6, xmm0
vprotd xmm3, xmm3, 7
vmovdqa xmmword [ebx + 0x30], xmm5
vprotd xmm6, xmm6, 0x10
vmovdqa xmmword [ebx - 0x20], xmm3
vpaddd xmm4, xmm4, xmm6
vmovdqa xmm5, xmmword [ebx + 0x10]
vpxor xmm2, xmm2, xmm4
vmovdqa xmm1, xmmword [ebx - 0x50]
vprotd xmm2, xmm2, 0xc
vmovdqa xmm3, xmmword [ebx - 0x40]
vpaddd xmm0, xmm0, xmm2
vmovdqa xmm7, xmmword [ebx + 0x60]
vpxor xmm6, xmm6, xmm0
vpaddd xmm1, xmm1, xmm3
vprotd xmm6, xmm6, 8
vmovdqa xmmword [ebx - 0x60], xmm0
vpaddd xmm4, xmm4, xmm6
vmovdqa xmmword [ebx + 0x50], xmm6
vpxor xmm2, xmm2, xmm4
vpxor xmm7, xmm7, xmm1
vprotd xmm2, xmm2, 7
vprotd xmm7, xmm7, 0x10
vmovdqa xmmword [ebx - 0x10], xmm2
vpaddd xmm5, xmm5, xmm7
vpxor xmm3, xmm3, xmm5
vmovdqa xmm0, xmmword [ebx - 0x80]
vprotd xmm3, xmm3, 0xc
vpaddd xmm1, xmm1, xmm3
vmovdqa xmm6, xmmword [ebx + 0x40]
vpxor xmm7, xmm7, xmm1
vprotd xmm7, xmm7, 8
vmovdqa xmmword [ebx - 0x50], xmm1
vpaddd xmm5, xmm5, xmm7
vmovdqa xmmword [ebx + 0x60], xmm7
vpxor xmm3, xmm3, xmm5
vprotd xmm3, xmm3, 7
dec edx
jne reloc.KERNEL32.dll_VerSetConditionMask
vmovdqa xmmword [ebx - 0x40], xmm3
vmovdqa xmmword [ebx], xmm4
vmovdqa xmmword [ebx + 0x10], xmm5
vmovdqa xmmword [ebx + 0x40], xmm6
vmovdqa xmmword [ebx + 0x60], xmm7
vmovdqa xmm1, xmmword [ebx - 0x70]
vmovdqa xmm2, xmmword [ebx - 0x60]
vmovdqa xmm3, xmmword [ebx - 0x50]
vpaddd xmm0, xmm0, xmmword [ebp - 0x80]
vpaddd xmm1, xmm1, xmmword [ebp - 0x70]
vpaddd xmm2, xmm2, xmmword [ebp - 0x60]
vpaddd xmm3, xmm3, xmmword [ebp - 0x50]
vpunpckldq xmm6, xmm0, xmm1
vpunpckldq xmm7, xmm2, xmm3
vpunpckhdq xmm0, xmm0, xmm1
vpunpckhdq xmm2, xmm2, xmm3
vpunpcklqdq xmm1, xmm6, xmm7
vpunpckhqdq xmm6, xmm6, xmm7
vpunpcklqdq xmm7, xmm0, xmm2
vpunpckhqdq xmm3, xmm0, xmm2
vpxor xmm4, xmm1, xmmword [esi - 0x80]
vpxor xmm5, xmm6, xmmword [esi - 0x40]
vpxor xmm6, xmm7, xmmword [esi]
vpxor xmm7, xmm3, xmmword [esi + 0x40]
lea esi, [esi + 0x10]
vmovdqa xmm0, xmmword [ebx - 0x40]
vmovdqa xmm1, xmmword [ebx - 0x30]
vmovdqa xmm2, xmmword [ebx - 0x20]
vmovdqa xmm3, xmmword [ebx - 0x10]
vmovdqu xmmword [edi - 0x80], xmm4
vmovdqu xmmword [edi - 0x40], xmm5
vmovdqu xmmword [edi], xmm6
vmovdqu xmmword [edi + 0x40], xmm7
lea edi, [edi + 0x10]
vpaddd xmm0, xmm0, xmmword [ebp - 0x40]
vpaddd xmm1, xmm1, xmmword [ebp - 0x30]
vpaddd xmm2, xmm2, xmmword [ebp - 0x20]
vpaddd xmm3, xmm3, xmmword [ebp - 0x10]
vpunpckldq xmm6, xmm0, xmm1
vpunpckldq xmm7, xmm2, xmm3
vpunpckhdq xmm0, xmm0, xmm1
vpunpckhdq xmm2, xmm2, xmm3
vpunpcklqdq xmm1, xmm6, xmm7
vpunpckhqdq xmm6, xmm6, xmm7
vpunpcklqdq xmm7, xmm0, xmm2
vpunpckhqdq xmm3, xmm0, xmm2
vpxor xmm4, xmm1, xmmword [esi - 0x80]
vpxor xmm5, xmm6, xmmword [esi - 0x40]
vpxor xmm6, xmm7, xmmword [esi]
vpxor xmm7, xmm3, xmmword [esi + 0x40]
lea esi, [esi + 0x10]
vmovdqa xmm0, xmmword [ebx]
vmovdqa xmm1, xmmword [ebx + 0x10]
vmovdqa xmm2, xmmword [ebx + 0x20]
vmovdqa xmm3, xmmword [ebx + 0x30]
vmovdqu xmmword [edi - 0x80], xmm4
vmovdqu xmmword [edi - 0x40], xmm5
vmovdqu xmmword [edi], xmm6
vmovdqu xmmword [edi + 0x40], xmm7
lea edi, [edi + 0x10]
vpaddd xmm0, xmm0, xmmword [ebp]
vpaddd xmm1, xmm1, xmmword [ebp + 0x10]
vpaddd xmm2, xmm2, xmmword [ebp + 0x20]
vpaddd xmm3, xmm3, xmmword [ebp + 0x30]
vpunpckldq xmm6, xmm0, xmm1
vpunpckldq xmm7, xmm2, xmm3
vpunpckhdq xmm0, xmm0, xmm1
vpunpckhdq xmm2, xmm2, xmm3
vpunpcklqdq xmm1, xmm6, xmm7
vpunpckhqdq xmm6, xmm6, xmm7
vpunpcklqdq xmm7, xmm0, xmm2
vpunpckhqdq xmm3, xmm0, xmm2
vpxor xmm4, xmm1, xmmword [esi - 0x80]
vpxor xmm5, xmm6, xmmword [esi - 0x40]
vpxor xmm6, xmm7, xmmword [esi]
vpxor xmm7, xmm3, xmmword [esi + 0x40]
lea esi, [esi + 0x10]
vmovdqa xmm0, xmmword [ebx + 0x40]
vmovdqa xmm1, xmmword [ebx + 0x50]
vmovdqa xmm2, xmmword [ebx + 0x60]
vmovdqa xmm3, xmmword [ebx + 0x70]
vmovdqu xmmword [edi - 0x80], xmm4
vmovdqu xmmword [edi - 0x40], xmm5
vmovdqu xmmword [edi], xmm6
vmovdqu xmmword [edi + 0x40], xmm7
lea edi, [edi + 0x10]
vpaddd xmm0, xmm0, xmmword [ebp + 0x40]
vpaddd xmm1, xmm1, xmmword [ebp + 0x50]
vpaddd xmm2, xmm2, xmmword [ebp + 0x60]
vpaddd xmm3, xmm3, xmmword [ebp + 0x70]
vpunpckldq xmm6, xmm0, xmm1
vpunpckldq xmm7, xmm2, xmm3
vpunpckhdq xmm0, xmm0, xmm1
vpunpckhdq xmm2, xmm2, xmm3
vpunpcklqdq xmm1, xmm6, xmm7
vpunpckhqdq xmm6, xmm6, xmm7
vpunpcklqdq xmm7, xmm0, xmm2
vpunpckhqdq xmm3, xmm0, xmm2
vpxor xmm4, xmm1, xmmword [esi - 0x80]
vpxor xmm5, xmm6, xmmword [esi - 0x40]
vpxor xmm6, xmm7, xmmword [esi]
vpxor xmm7, xmm3, xmmword [esi + 0x40]
lea esi, [esi + 0xd0]
vmovdqu xmmword [edi - 0x80], xmm4
vmovdqu xmmword [edi - 0x40], xmm5
vmovdqu xmmword [edi], xmm6
vmovdqu xmmword [edi + 0x40], xmm7
lea edi, [edi + 0xd0]
sub ecx, 0x100
jae 0x6b4640
add ecx, 0x100
je strpbrk
mov ebx, dword [esp + 0x208]
lea esi, [esi - 0x80]
mov edx, dword [esp + 0x204]
lea edi, [edi - 0x80]
vmovd xmm2, dword [ebp + 0x40]
vmovdqu xmm3, xmmword [ebx]
vpaddd xmm2, xmm2, xmmword [eax + 0x60]
vpand xmm3, xmm3, xmmword [eax + 0x70]
vpor xmm3, xmm3, xmm2
vmovdqa xmm0, xmmword [eax + 0x20]
vmovdqu xmm1, xmmword [edx]
vmovdqu xmm2, xmmword [edx + 0x10]
vmovdqa xmm6, xmmword [eax]
vmovdqa xmm7, xmmword [eax + 0x10]
mov dword [esp + 0x30], ebp
vmovdqa xmmword [esp], xmm0
vmovdqa xmmword [esp + 0x10], xmm1
vmovdqa xmmword [esp + 0x20], xmm2
vmovdqa xmmword [esp + 0x30], xmm3
mov edx, 0xa
jmp 0x6b4c40
vmovdqa xmm3, xmmword [eax + 0x50]
vmovdqa xmm0, xmmword [esp]
vmovdqa xmm1, xmmword [esp + 0x10]
vmovdqa xmm2, xmmword [esp + 0x20]
vpaddd xmm3, xmm3, xmmword [esp + 0x30]
mov edx, 0xa
vmovdqa xmmword [esp + 0x30], xmm3
jmp 0x6b4c40
vpaddd xmm0, xmm0, xmm1
vpxor xmm3, xmm3, xmm0
vprotd xmm3, xmm3, 0x10
vpaddd xmm2, xmm2, xmm3
vpxor xmm1, xmm1, xmm2
vprotd xmm1, xmm1, 0xc
vpaddd xmm0, xmm0, xmm1
vpxor xmm3, xmm3, xmm0
vprotd xmm3, xmm3, 8
vpaddd xmm2, xmm2, xmm3
vpxor xmm1, xmm1, xmm2
vprotd xmm1, xmm1, 7
vpshufd xmm2, xmm2, 0x4e
vpshufd xmm1, xmm1, 0x39
vpshufd xmm3, xmm3, 0x93
vpaddd xmm0, xmm0, xmm1
vpxor xmm3, xmm3, xmm0
vprotd xmm3, xmm3, 0x10
vpaddd xmm2, xmm2, xmm3
vpxor xmm1, xmm1, xmm2
vprotd xmm1, xmm1, 0xc
vpaddd xmm0, xmm0, xmm1
vpxor xmm3, xmm3, xmm0
vprotd xmm3, xmm3, 8
vpaddd xmm2, xmm2, xmm3
vpxor xmm1, xmm1, xmm2
vprotd xmm1, xmm1, 7
vpshufd xmm2, xmm2, 0x4e
vpshufd xmm1, xmm1, 0x93
vpshufd xmm3, xmm3, 0x39
dec edx
jne 0x6b4c40
vpaddd xmm0, xmm0, xmmword [esp]
vpaddd xmm1, xmm1, xmmword [esp + 0x10]
vpaddd xmm2, xmm2, xmmword [esp + 0x20]
vpaddd xmm3, xmm3, xmmword [esp + 0x30]
cmp ecx, 0x40
jb 0x6b4d28
vpxor xmm0, xmm0, xmmword [esi]
vpxor xmm1, xmm1, xmmword [esi + 0x10]
vpxor xmm2, xmm2, xmmword [esi + 0x20]
vpxor xmm3, xmm3, xmmword [esi + 0x30]
lea esi, [esi + 0x40]
vmovdqu xmmword [edi], xmm0
vmovdqu xmmword [edi + 0x10], xmm1
vmovdqu xmmword [edi + 0x20], xmm2
vmovdqu xmmword [edi + 0x30], xmm3
lea edi, [edi + 0x40]
sub ecx, 0x40
jne _lseeki64
jmp strcspn
vmovdqa xmmword [esp], xmm0
vmovdqa xmmword [esp + 0x10], xmm1
vmovdqa xmmword [esp + 0x20], xmm2
vmovdqa xmmword [esp + 0x30], xmm3
xor eax, eax
xor edx, edx
xor ebp, ebp
mov al, byte [esp + ebp]
mov dl, byte [esi + ebp]
lea ebp, [ebp + 1]
xor al, dl
mov byte [edi + ebp - 1], al
dec ecx
jne 0x6b4d45
vzeroupper
mov esp, dword [esp + 0x200]
pop edi
pop esi
pop ebx
pop ebp
ret