Function at 0x140050e50
Capabilities:
Acquire debug privileges
Check if file exists
Contain obfuscated stackstrings
Create thread
Encode data using xor
Enumerate gui resources
Enumerate processes
Get file attributes
Get process image filename
Hide thread from debugger
Set global application hook

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x500]
sub rsp, 0x600
mov rax, qword [0x140155010]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
mov rsi, rcx
xor r13d, r13d
call fcn.14000cdc0
call fcn.14000c6c0
call fcn.14000cec0
call fcn.14000cc70
call fcn.14000c820
call fcn.14000c970
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140050ef0
lea rdx, str.NtSetInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140050ef0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r13 + 0x11]
call rbx
call fcn.14000d500
call fcn.14000d2b0
call fcn.14000d410
call fcn.14000d6e0
call fcn.14000d810
lea rcx, [rbp + 0x18]
call fcn.140003110
nop
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x140050f20
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rax
call fcn.140059dd4
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x20], xmm0
lea r8, [rbp - 0x20]
mov edx, eax
lea rcx, [rbp + 0x78]
call fcn.140008e10
nop
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x140050f8d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140050f88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140050f88
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a938
movdqa xmm0, xmmword [0x1401486e0]
movdqu xmmword [rbp + 0x28], xmm0
mov word [rbp + 0x18], r13w
mov dword [rsp + 0x30], 0x2e734d6f
mov dword [rsp + 0x34], 0x6e6962
lea rax, [rsp + 0x31]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140050fc0
lea rdx, [rsp + 0x31]
lea rcx, [rbp + 0x78]
call fcn.140008ab0
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x58]
call fcn.140006dd0
nop
lea rcx, [rbp + 0x18]
call fcn.14000c250
nop
lea rdx, [rbp + 0x18]
cmp qword [rbp + 0x30], 0x10
cmovae rdx, qword [rbp + 0x18]
lea rcx, [rbp + 0x58]
cmp qword [rbp + 0x70], 0x10
cmovae rcx, qword [rbp + 0x58]
mov rbx, qword [rbp + 0x68]
cmp rbx, qword [rbp + 0x28]
jne 0x140051022
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140051029
mov dword [0x14016e360], r13d
test rbx, rbx
je 0x140052199
lea rdx, [rbp + 0x18]
lea rcx, [rsp + 0x38]
call fcn.140008550
mov rcx, rax
call fcn.14000b230
test al, al
jne 0x140051066
mov dword [rsp + 0x30], 0x7272451b
movdqa xmm0, xmmword [0x140148f30]
lea r8, [rsp + 0x31]
jmp 0x1400521ae
lea rbx, [0x14016d740]
cmp qword [0x14016d758], 0x10
cmovae rbx, qword [0x14016d740]
movdqa xmm0, xmmword [0x140148830]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x10], 0
lea rcx, [rbp - 0x1f]
call fcn.14000c590
mov rdx, rsi
lea rcx, [0x1401483b8]
call fcn.140050d60
lea rcx, [0x14005e720]
call fcn.14000c590
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140052118
test al, 0x10
jne 0x140052118
mov r14d, r13d
xor edx, edx
mov r15d, 2
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400520cb
mov dword [rbp + 0xa0], 0x238
lea rdx, [rbp + 0xa0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140051138
mov rdx, rsi
lea rcx, [rbp + 0xcc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140051131
lea rdx, [rbp + 0xa0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x140051107
mov r14d, dword [rbp + 0xa8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x1400520cb
mov edx, r14d
lea rcx, [0x140050dc0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov dword [rbp + 0x10], r13d
lea rdx, [rbp + 0x10]
mov rcx, qword [0x14016e3a0]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
test eax, eax
jne 0x140051342
lea edx, [rax + 4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400524d0
mov r8, rax
movdqa xmm0, xmmword [0x140148860]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140148f40]
movdqu xmmword [rsp + 0x48], xmm1
movdqa xmm0, xmmword [0x140148b70]
movdqu xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x68], 0x2d252244
mov dword [rsp + 0x6c], 0x44202128
mov word [rsp + 0x70], 0x39
mov rcx, r13
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x39], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3a], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3b], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3c], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3d], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3e], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3f], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x40], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x41], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x42], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x43], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x44], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x45], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x46], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x47], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x48], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x49], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4a], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4b], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4c], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4d], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4e], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4f], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x50], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x51], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x52], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x53], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x54], al
add rcx, 0x1c
cmp rcx, 0x38
jb 0x1400511d0
mov byte [rsp + 0x71], 0
lea rdx, [rsp + 0x39]
mov rcx, r8
call fcn.1400092c0
lea rdx, [0x140009490]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x7272456c
movdqa xmm0, xmmword [0x140149490]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x1401493e0]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0x20746567
mov dword [rsp + 0x5c], 0x646e6977
mov dword [rsp + 0x60], 0x2e776f
lea rdx, [rsp + 0x39]
jmp 0x140052178
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x140051360
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140009e10
nop
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
xorps xmm1, xmm1
test eax, eax
jne 0x1400513cf
movups xmmword [rbp + 0x38], xmm0
movdqu xmmword [rbp + 0x48], xmm1
xor r8d, r8d
lea rdx, [0x1401483b4]
lea rcx, [rbp + 0x38]
call fcn.140009ac0
jmp 0x14005142d
movups xmmword [rbp - 0x20], xmm0
movdqu xmmword [rbp - 0x10], xmm1
mov r8, rbx
lea rcx, [rbp - 0x20]
call fcn.140052bc0
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rax, qword [rbp - 0x20]
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [rbp + 0x48], xmm1
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14005146d
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051468
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051468
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a938
movdqa xmm0, xmmword [0x1401486f0]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 8
cmovae rcx, qword [rbp + 0x38]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x14005153b
lea edx, [rax + 4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400524d0
movdqa xmm0, xmmword [0x140149270]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140148f80]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0x454c4941
mov dword [rbp + 4], 0x5d2044
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400092c0
lea rdx, [0x140009490]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x7272456f
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], sil
movdqa xmm0, xmmword [0x140149330]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x776f6420
mov dword [rbp - 0xc], 0x616f6c6e
mov word [rbp - 8], 0x2e64
mov byte [rbp - 6], sil
lea rdx, [rbp - 0x1f]
jmp 0x14005205d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140051ea3
lea r8, [rbp - 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140051d2a
mov dword [rbp - 0x20], 4
lea r8, [rbp - 0x1c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [rbp - 0x14]
test eax, eax
cmovne ecx, r15d
mov dword [rbp - 0x14], ecx
lea r8, [rbp - 0x10]
lea rdx, str.SeLoadDriverPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea r8, [rbp - 4]
lea rdx, str.SeRemoteShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea r8, [rbp + 8]
lea rdx, str.SeCreateGlobalPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov r9d, 0x10
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140051b8d
mov cl, 0x40
mov word [rbp - 0x80], 0x40
movsx ebx, cl
movzx eax, bx
xor ax, 0x10
mov word [rbp - 0x7e], ax
movzx eax, bx
xor ax, 0x32
mov word [rbp - 0x7c], ax
movzx ecx, bx
xor cx, 0x29
mov word [rbp - 0x7a], cx
movzx eax, bx
xor ax, 0x36
mov word [rbp - 0x78], ax
mov word [rbp - 0x76], cx
movzx r11d, bx
xor r11w, 0x2c
mov word [rbp - 0x74], r11w
movzx r10d, bx
xor r10w, 0x25
mov word [rbp - 0x72], r10w
movzx eax, bx
xor ax, 0x27
mov word [rbp - 0x70], ax
mov word [rbp - 0x6e], r10w
movzx r9d, bx
xor r9w, 0x33
mov word [rbp - 0x6c], r9w
movzx edx, bx
xor dx, 0x60
mov word [rbp - 0x6a], dx
movzx eax, bx
xor ax, 0x21
mov word [rbp - 0x68], ax
movzx ecx, bx
xor cx, 0x24
mov word [rbp - 0x66], cx
movzx eax, bx
xor ax, 0x2a
mov word [rbp - 0x64], ax
movzx r8d, bx
xor r8w, 0x35
mov word [rbp - 0x62], r8w
mov word [rbp - 0x60], r9w
movzx eax, bx
xor ax, 0x34
mov word [rbp - 0x5e], ax
mov word [rbp - 0x5c], r10w
mov word [rbp - 0x5a], cx
mov word [rbp - 0x58], dx
mov word [rbp - 0x56], r9w
mov word [rbp - 0x54], r8w
movzx eax, bx
xor ax, 0x23
mov word [rbp - 0x52], ax
mov word [rbp - 0x50], ax
mov word [rbp - 0x4e], r10w
mov word [rbp - 0x4c], r9w
mov word [rbp - 0x4a], r9w
movzx eax, bx
xor ax, 0x26
mov word [rbp - 0x48], ax
mov word [rbp - 0x46], r8w
mov word [rbp - 0x44], r11w
mov word [rbp - 0x42], r11w
movzx eax, bx
xor ax, 0x39
mov word [rbp - 0x40], ax
xor bx, 0x6e
mov word [rbp - 0x3e], bx
mov word [rbp - 0x3c], r13w
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140052630
lea rdx, [0x140052800]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x104
lea rdx, [rbp + 0x2e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x1400518de
mov r15, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov ebx, 4
mov rax, qword gs:[0x58]
add rbx, qword [rax]
mov eax, dword [rbx]
cmp dword [0x14016e624], eax
jle 0x1400517cc
lea rcx, [0x14016e624]
call fcn.14005ad14
cmp dword [0x14016e624], 0xffffffff
jne 0x1400517cc
xor ecx, ecx
call fcn.14000c480
mov word [0x14016e630], ax
lea rcx, [0x14016e624]
call fcn.14005acb4
mov eax, dword [rbx]
cmp dword [0x14016e634], eax
jle 0x14005180d
lea rcx, [0x14016e634]
call fcn.14005ad14
cmp dword [0x14016e634], 0xffffffff
jne 0x14005180d
movzx eax, word [0x14016e630]
mov edx, 0xf0
and ax, dx
mov word [0x14016e620], ax
lea rcx, [0x14016e634]
call fcn.14005acb4
mov eax, dword [rbx]
cmp dword [0x14016e62c], eax
jle 0x14005184a
lea rcx, [0x14016e62c]
call fcn.14005ad14
cmp dword [0x14016e62c], 0xffffffff
jne 0x14005184a
movzx eax, word [0x14016e630]
and ax, 0xf
mov word [0x14016e628], ax
lea rcx, [0x14016e62c]
call fcn.14005acb4
movzx edi, r13w
mov ecx, 7
call fcn.14000c480
test al, 0xf0
je 0x14005186f
mov word [0x14016e620], ax
movzx edi, ax
or di, word [0x14016e628]
jmp 0x140051884
test al, 0xf
je 0x140051884
mov word [0x14016e628], ax
movzx edi, ax
or di, word [0x14016e620]
mov rcx, r15
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
lea r12, [rbp + 0x528]
mov rbx, qword [r12]
mov qword [r12], r13
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov qword [r12], rbx
mov rcx, r15
call fcn.140052840
mov rcx, rax
lea rdx, [rbp + 0x2e0]
call fcn.140052630
lea rdx, [0x140052800]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.NextHook
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rax, rax
jne 0x140051996
lea edx, [rax + 4]
call fcn.1400524d0
movdqa xmm0, xmmword [0x140149040]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140148f90]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0x454c4941
mov dword [rbp + 4], 0x5d2044
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400092c0
lea rdx, [0x140009490]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724544
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], bl
movdqa xmm0, xmmword [0x140149030]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140148f90]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0x454c4941
mov dword [rsp + 0x5c], 0x5d2044
lea rdx, [rsp + 0x39]
jmp 0x14005205d
mov edx, 7
call fcn.1400524d0
movdqa xmm0, xmmword [0x140149050]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140148950]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0x72656874
mov word [rbp + 4], 0x2165
mov byte [rbp + 6], 0
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400092c0
lea rdx, [0x140009490]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, r14d
mov r8, rsi
mov rdx, rbx
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rax, rax
jne 0x140051a99
lea edx, [rax + 4]
call fcn.1400524d0
movdqa xmm0, xmmword [0x140149150]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140148f50]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp], 0x5d20
mov byte [rbp + 2], 0
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400092c0
lea rdx, [0x140009490]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724530
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x140149160]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140148f50]
movdqu xmmword [rsp + 0x48], xmm1
mov word [rsp + 0x58], 0x5d20
mov byte [rsp + 0x5a], 0
lea rdx, [rsp + 0x39]
jmp 0x14005205d
mov edx, 7
call fcn.1400524d0
movdqa xmm0, xmmword [0x140149500]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x2e70
mov byte [rbp - 0xe], 0
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400092c0
lea rdx, [0x140009490]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov byte [0x140155068], 0
movdqa xmm0, xmmword [0x140149430]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x6c756673
mov dword [rbp - 0xc], 0xa21796c
mov byte [rbp - 8], 0
lea rcx, [rbp - 0x1f]
call fcn.14000c590
mov dword [rbp - 0x30], 0x63755374
mov dword [rbp - 0x2c], 0x73736563
mov byte [rbp - 0x28], 0
movdqa xmm0, xmmword [0x140149220]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x6c20796c
mov dword [rbp - 0xc], 0x6564616f
mov word [rbp - 8], 0x2164
mov byte [rbp - 6], 0
mov r9d, 0x40
lea r8, [rbp - 0x2f]
lea rdx, [rbp - 0x1f]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x140052310]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x140155068], 0
jmp 0x140052071
mov cl, 0x71
mov word [rbp - 0x80], 0x71
movsx r11d, cl
movzx eax, r11w
xor ax, 0x34
mov word [rbp - 0x7e], ax
movzx r9d, r11w
xor r9w, 3
mov word [rbp - 0x7c], r9w
mov word [rbp - 0x7a], r9w
movzx eax, r11w
xor ax, 0x1e
mov word [rbp - 0x78], ax
mov word [rbp - 0x76], r9w
movzx r10d, r11w
xor r10w, 0x51
mov word [rbp - 0x74], r10w
movzx eax, r11w
xor ax, 0x10
mov word [rbp - 0x72], ax
movzx eax, r11w
xor ax, 0x15
mov word [rbp - 0x70], ax
movzx eax, r11w
xor ax, 0x1b
mov word [rbp - 0x6e], ax
movzx eax, r11w
xor ax, 4
mov word [rbp - 0x6c], ax
movzx r8d, r11w
xor r8w, 2
mov word [rbp - 0x6a], r8w
movzx eax, r11w
xor ax, 5
mov word [rbp - 0x68], ax
movzx ecx, r11w
xor cx, 0x18
mov word [rbp - 0x66], cx
movzx eax, r11w
xor ax, 0x1f
mov word [rbp - 0x64], ax
movzx edx, r11w
xor dx, 0x16
mov word [rbp - 0x62], dx
mov word [rbp - 0x60], r10w
movzx eax, r11w
xor ax, 1
mov word [rbp - 0x5e], ax
mov word [rbp - 0x5c], r9w
mov word [rbp - 0x5a], cx
movzx eax, r11w
xor ax, 7
mov word [rbp - 0x58], ax
mov word [rbp - 0x56], cx
movzx eax, r11w
xor ax, 0x1d
mov word [rbp - 0x54], ax
movzx eax, r11w
xor ax, 0x14
mov word [rbp - 0x52], ax
mov word [rbp - 0x50], dx
mov word [rbp - 0x4e], ax
mov word [rbp - 0x4c], r8w
xor r11w, 0x4b
mov word [rbp - 0x4a], r11w
mov word [rbp - 0x48], r10w
mov word [rbp - 0x46], r13w
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140052630
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140052800]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724574
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x140149130]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x69727020
mov dword [rsp + 0x4c], 0x656c6976
mov dword [rsp + 0x50], 0x2e736567
mov byte [rsp + 0x54], 0
lea r8, [rsp + 0x31]
lea rdx, [rsp + 0x39]
jmp 0x140052062
mov cl, 0x16
mov word [rbp - 0x80], 0x16
movsx ebx, cl
movzx eax, bx
xor ax, 0x53
mov word [rbp - 0x7e], ax
movzx r9d, bx
xor r9w, 0x64
mov word [rbp - 0x7c], r9w
mov word [rbp - 0x7a], r9w
movzx r10d, bx
xor r10w, 0x79
mov word [rbp - 0x78], r10w
mov word [rbp - 0x76], r9w
movzx r11d, bx
xor r11w, 0x36
mov word [rbp - 0x74], r11w
mov word [rbp - 0x72], r10w
movzx ecx, bx
xor cx, 0x66
mov word [rbp - 0x70], cx
movzx r8d, bx
xor r8w, 0x73
mov word [rbp - 0x6e], r8w
movzx edx, bx
xor dx, 0x78
mov word [rbp - 0x6c], dx
movzx eax, bx
xor ax, 0x7f
mov word [rbp - 0x6a], ax
mov word [rbp - 0x68], dx
movzx eax, bx
xor ax, 0x71
mov word [rbp - 0x66], ax
mov word [rbp - 0x64], r11w
mov word [rbp - 0x62], cx
mov word [rbp - 0x60], r9w
mov word [rbp - 0x5e], r10w
movzx eax, bx
xor ax, 0x75
mov word [rbp - 0x5c], ax
mov word [rbp - 0x5a], r8w
movzx eax, bx
xor ax, 0x65
mov word [rbp - 0x58], ax
mov word [rbp - 0x56], ax
mov word [rbp - 0x54], r11w
movzx eax, bx
xor ax, 0x62
mov word [rbp - 0x52], ax
mov word [rbp - 0x50], r10w
movzx eax, bx
xor ax, 0x7d
mov word [rbp - 0x4e], ax
mov word [rbp - 0x4c], r8w
mov word [rbp - 0x4a], dx
xor bx, 0x2c
mov word [rbp - 0x48], bx
mov word [rbp - 0x46], r11w
mov word [rbp - 0x44], r13w
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140052630
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140052800]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x7272454c
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x140149370]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x65636f72
mov dword [rsp + 0x4c], 0x74207373
mov dword [rsp + 0x50], 0x6e656b6f
mov word [rsp + 0x54], 0x2e
lea rdx, [rsp + 0x39]
jmp 0x14005205d
mov cl, 0x1f
mov word [rbp - 0x80], 0x1f
movsx ebx, cl
movzx eax, bx
xor ax, 0x5a
mov word [rbp - 0x7e], ax
movzx r11d, bx
xor r11w, 0x6d
mov word [rbp - 0x7c], r11w
mov word [rbp - 0x7a], r11w
movzx r8d, bx
xor r8w, 0x70
mov word [rbp - 0x78], r8w
mov word [rbp - 0x76], r11w
movzx r10d, bx
xor r10w, 0x3f
mov word [rbp - 0x74], r10w
mov word [rbp - 0x72], r8w
movzx edx, bx
xor dx, 0x6f
mov word [rbp - 0x70], dx
movzx r9d, bx
xor r9w, 0x7a
mov word [rbp - 0x6e], r9w
movzx ecx, bx
xor cx, 0x71
mov word [rbp - 0x6c], cx
movzx eax, bx
xor ax, 0x76
mov word [rbp - 0x6a], ax
mov word [rbp - 0x68], cx
movzx eax, bx
xor ax, 0x78
mov word [rbp - 0x66], ax
mov word [rbp - 0x64], r10w
mov word [rbp - 0x62], dx
mov word [rbp - 0x60], r11w
mov word [rbp - 0x5e], r8w
movzx eax, bx
xor ax, 0x7c
mov word [rbp - 0x5c], ax
mov word [rbp - 0x5a], r9w
movzx eax, bx
xor ax, 0x6c
mov word [rbp - 0x58], ax
mov word [rbp - 0x56], ax
mov word [rbp - 0x54], r10w
movzx eax, bx
xor ax, 0x6b
mov word [rbp - 0x52], ax
movzx eax, bx
xor ax, 0x77
mov word [rbp - 0x50], ax
mov word [rbp - 0x4e], r11w
mov word [rbp - 0x4c], r9w
movzx eax, bx
xor ax, 0x7e
mov word [rbp - 0x4a], ax
movzx eax, bx
xor ax, 0x7b
mov word [rbp - 0x48], ax
xor bx, 0x25
mov word [rbp - 0x46], bx
mov word [rbp - 0x44], r10w
mov word [rbp - 0x42], r13w
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140052630
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140052800]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x7272450c
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x140149380]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x65636f72
mov dword [rsp + 0x4c], 0x74207373
mov dword [rsp + 0x50], 0x61657268
mov word [rsp + 0x54], 0x2e64
mov byte [rsp + 0x56], 0
mov r9d, 0x10
lea r8, [rsp + 0x31]
lea rdx, [rsp + 0x39]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rsp + 0x30], 0x72724515
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r8, [rsp + 0x31]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 8
jb 0x1400520b4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400520af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400520af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a938
movdqa xmm0, xmmword [0x1401486e0]
movdqu xmmword [rbp + 0x48], xmm0
mov word [rbp + 0x38], r13w
jmp 0x140052202
movdqa xmm0, xmmword [0x140149520]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x2e646e
lea rdx, [rbp - 0x1f]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400092c0
lea rdx, [0x140009490]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724526
movdqa xmm0, xmmword [0x140149510]
mov dword [rbp - 0x10], 0x2e646e
jmp 0x14005216f
movdqa xmm0, xmmword [0x140149320]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x776f6420
mov dword [rbp - 0xc], 0x616f6c6e
mov dword [rbp - 8], 0xa2e64
lea rcx, [rbp - 0x1f]
call fcn.14000c590
mov rcx, rbx
call fcn.14000c590
mov dword [rsp + 0x30], 0x72724522
movdqa xmm0, xmmword [0x140149310]
mov dword [rbp - 0x10], 0x776f6420
mov dword [rbp - 0xc], 0x616f6c6e
mov word [rbp - 8], 0x64
movdqu xmmword [rbp - 0x20], xmm0
lea rdx, [rbp - 0x1f]
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
lea r8, [rsp + 0x31]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140052202
mov dword [rsp + 0x30], 0x72724526
movdqa xmm0, xmmword [0x140148f20]
lea r8, [rsp + 0x31]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140148fb0]
movdqa xmm0, xmmword [0x140148f60]
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqu xmmword [rsp + 0x48], xmm1
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x68], 0x2e59
mov byte [rsp + 0x6a], 0
mov r9d, 0x10
lea rdx, [rsp + 0x39]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x14016e360], r13d
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x140052241
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005223b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005223b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a938
nop
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x14005227f
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005227a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005227a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a938
mov qword [rbp + 0x68], r13
mov qword [rbp + 0x70], 0xf
mov byte [rbp + 0x58], 0
mov rdx, qword [rbp + 0x90]
cmp rdx, 0x10
jb 0x1400522d0
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400522cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400522cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a938
xor al, al
mov rcx, qword [rbp + 0x4f0]
xor rcx, rsp
call fcn.14005a640
lea r11, [rsp + 0x600]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret