Function at 0x14001b910
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Create thread
Delete file
Encode data using xor
Get token membership
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x140044040]
xor rax, rsp
mov qword [rbp + 0x30], rax
xor r15d, r15d
mov word [rbp - 0x6c], 0x500
lea rax, [rbp - 0x80]
mov dword [rbp - 0x78], r15d
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x70]
mov dword [rsp + 0x48], r15d
mov ebx, r15d
mov dword [rsp + 0x40], r15d
mov r9d, 0x220
mov dword [rsp + 0x38], r15d
mov r8d, 0x20
mov dword [rsp + 0x30], r15d
mov dl, 2
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov qword [rbp - 0x80], r15
mov dword [rbp - 0x70], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14001b9a0
mov rdx, qword [rbp - 0x80]
lea r8, [rbp - 0x78]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x14001b9a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14001b9bb
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov qword [rbp - 0x80], r15
test ebx, ebx
jne 0x14001cf33
mov qword [rsp + 0x1f8], rdi
cmp dword [rbp - 0x78], r15d
jne 0x14001badb
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x14001ba67
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14001ba67
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0xefad81f4
lea rdx, [r10 + r9*4]
mov ecx, dword [rdx + rbx]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14001ba62
nop dword [rax]
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14001ba40
cmp r8d, 0xbee9a68f
je 0x14001ba6c
test r9d, r9d
jne 0x14001ba20
mov rax, qword [rax]
jmp 0x14001b9f0
mov ecx, dword [r11 + 0x24]
mov edx, dword [r11 + 0x1c]
add rcx, r10
movdqa xmm0, xmmword [0x14003e490]
add rdx, r10
movzx ecx, word [rcx + r9*2]
mov ebx, dword [rdx + rcx*4]
lea rcx, [rsp + 0x60]
movdqu xmmword [rbp - 0x20], xmm0
add rbx, r10
mov word [rbp - 0xf], 0x52
movdqa xmm0, xmmword [0x14003e4a0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rbp - 0x10], 0x45
mov byte [rbp - 0xd], r15b
mov dword [rsp + 0x70], 0x5b475343
mov dword [rsp + 0x74], 0x1001847
call fcn.14001b150
xor r9d, r9d
lea r8, [rbp - 0x20]
mov rdx, rax
xor ecx, ecx
call rbx
call fcn.14000cbf0
call fcn.14001d680
call fcn.140001560
movups xmm0, xmmword [0x1400440c0]
lea rbx, [0x140046100]
mov edi, 0x4eb0
movups xmm1, xmmword [0x1400440d0]
lea r8, [0x1402bc430]
movups xmmword [0x1402bc430], xmm0
movups xmm0, xmmword [0x1400440e0]
movups xmmword [0x1402bc440], xmm1
movups xmm1, xmmword [0x1400440f0]
movups xmmword [0x1402bc450], xmm0
movups xmm0, xmmword [0x140044100]
movups xmmword [0x1402bc460], xmm1
movups xmm1, xmmword [0x140044110]
movups xmmword [0x1402bc470], xmm0
movups xmm0, xmmword [0x140044120]
movups xmmword [0x1402bc480], xmm1
movups xmm1, xmmword [0x140044130]
movups xmmword [0x1402bc490], xmm0
movups xmmword [0x1402bc4a0], xmm1
nop dword [rax + rax]
mov rcx, rbx
sub r8, rbx
mov edx, 0x80
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14001bb80
mov rcx, rbx
call fcn.140001db0
mov r8, rbx
sub rbx, 0xffffffffffffff80
sub rdi, 1
jne 0x14001bb70
movups xmm0, xmmword [r8]
mov ecx, 8
movups xmmword [0x1402bc430], xmm0
movups xmm1, xmmword [r8 + 0x10]
movups xmmword [0x1402bc440], xmm1
movups xmm0, xmmword [r8 + 0x20]
movups xmmword [0x1402bc450], xmm0
movups xmm1, xmmword [r8 + 0x30]
movups xmmword [0x1402bc460], xmm1
movups xmm0, xmmword [r8 + 0x40]
movups xmmword [0x1402bc470], xmm0
movups xmm1, xmmword [r8 + 0x50]
movups xmmword [0x1402bc480], xmm1
movups xmm0, xmmword [r8 + 0x60]
movups xmmword [0x1402bc490], xmm0
movups xmm1, xmmword [r8 + 0x70]
movups xmmword [0x1402bc4a0], xmm1
call fcn.140021a68
lea rcx, [0x14001b860]
mov r9, rax
lea r8, [0x14001ea30]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14001cf23
cmp dword [rbp - 0x48], r15d
je 0x14001cf17
movaps xmm0, xmmword [rbp - 0x50]
lea rcx, [rbp - 0x20]
movdqa xmmword [rbp - 0x20], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001cf17
xorps xmm0, xmm0
mov ecx, 8
movaps xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x50], xmm0
call fcn.140021a68
lea rcx, [0x14001a320]
mov r9, rax
lea r8, [0x14001ea30]
xor edx, edx
mov qword [rax], rcx
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x60], rax
test rax, rax
je 0x14001cf07
cmp dword [rbp - 0x58], r15d
je 0x14001cf17
movaps xmm0, xmmword [rbp - 0x60]
lea rcx, [rbp - 0x20]
movdqa xmmword [rbp - 0x20], xmm0
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001cf17
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x60], xmm0
call fcn.14000d530
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x14001bd85
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14001bd85
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0x522dec33
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14001bd80
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x14001bd60
cmp edx, 0xadadc98b
je 0x14001bd8a
test r9d, r9d
jne 0x14001bd40
mov rax, qword [rax]
jmp 0x14001bd10
mov eax, dword [r11 + 0x24]
lea r8, [0x14001a3a0]
mov ecx, dword [r11 + 0x1c]
add rax, r10
add rcx, r10
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
movzx edx, word [rax + r9*2]
xor r9d, r9d
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
xor ecx, ecx
call rax
call fcn.140017900
test eax, eax
jne 0x14001cef4
call fcn.140016ac0
test eax, eax
jne 0x14001cef4
call fcn.140016440
test eax, eax
jne 0x14001cef4
cmp dword [0x1402bc4b0], 1
movaps xmmword [rsp + 0x1b0], xmm6
movaps xmmword [rsp + 0x1a0], xmm7
movaps xmmword [rsp + 0x190], xmm8
movaps xmmword [rsp + 0x180], xmm9
jle 0x14001be1c
mov rax, qword [0x1402bc338]
mov rdx, qword [rax + 8]
jmp 0x14001be23
lea rdx, [0x14003d9de]
xorps xmm0, xmm0
mov qword [rbp - 0x30], r15
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x28], r15
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], r15b
jne 0x14001be40
lea rcx, [rbp - 0x40]
call fcn.140008b70
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x14001bee5
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14001bee5
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + rbx]
mov edx, 0x23af5290
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14001bee0
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x14001bec0
cmp edx, 0x6389163e
je 0x14001beea
test r9d, r9d
jne 0x14001bea0
mov rax, qword [rax]
jmp 0x14001be70
mov ecx, dword [r11 + 0x24]
movdqa xmm6, xmmword [0x14003e410]
add rcx, r10
movdqa xmm7, xmmword [0x14003e420]
movdqa xmm8, xmmword [0x14003e520]
movdqa xmm9, xmmword [0x14003e4f0]
movzx r8d, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov qword [rsp + 0x1f0], rsi
mov qword [rsp + 0x200], r12
mov qword [rsp + 0x1c8], r13
mov qword [rsp + 0x1c0], r14
mov ebx, dword [rcx + r8*4]
lea rcx, [rbp - 0x20]
add rbx, r10
movdqu xmmword [rbp - 0x20], xmm6
movdqu xmmword [rbp - 0x10], xmm7
movdqu xmmword [rbp], xmm8
movdqu xmmword [rbp + 0x10], xmm9
mov word [rbp + 0x20], pe_nt_image_headers64
call fcn.14000be20
lea r8, [rbp - 0x20]
xor edx, edx
mov ecx, 0x1f0001
call rbx
test rax, rax
jne 0x14001ce10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x14001c015
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14001c015
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0x1cc775f4
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14001c010
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x14001bff0
cmp edx, 0x82328e6
je 0x14001c01a
test r9d, r9d
jne 0x14001bfd0
mov rax, qword [rax]
jmp 0x14001bfa0
mov eax, dword [r11 + 0x24]
mov ecx, dword [r11 + 0x1c]
add rax, r10
add rcx, r10
movzx edx, word [rax + r9*2]
mov ebx, dword [rcx + rdx*4]
lea rcx, [rbp - 0x20]
add rbx, r10
movdqu xmmword [rbp - 0x20], xmm6
movdqu xmmword [rbp - 0x10], xmm7
movdqu xmmword [rbp], xmm8
movdqu xmmword [rbp + 0x10], xmm9
mov word [rbp + 0x20], pe_nt_image_headers64
call fcn.14000be20
lea r8, [rbp - 0x20]
xor edx, edx
xor ecx, ecx
call rbx
mov rax, qword [0x1402bc6f0]
test rax, rax
jne 0x14001c12b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x14001c105
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14001c105
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0xaa61ac70
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14001c100
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x14001c0e0
cmp edx, 0xeb3fc063
je 0x14001c10a
test r9d, r9d
jne 0x14001c0c0
mov rax, qword [rax]
jmp 0x14001c090
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx r8d, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + r8*4]
add rax, r10
mov qword [0x1402bc6f0], rax
mov ecx, 0x5dc
call rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.14001cf50
movabs rax, 0x59cc99ea04c6f5f1
movabs rcx, 0xfa5c5fd3af750d43
mov qword [rbp - 0x80], rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x80], rcx
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x68], rax
movabs rax, 0x59cc99ea04b59992
mov qword [rbp - 0x80], rax
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x80], rcx
mov rax, qword [rbp - 0x80]
movdqa xmm0, xmmword [rsp + 0x60]
mov qword [rbp - 0x18], rax
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rsp + 0x60], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x14001c235
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14001c235
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0xbfe0bc8
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14001c230
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x14001c210
cmp edx, 0x33f330c9
je 0x14001c23a
test r9d, r9d
jne 0x14001c1f0
mov rax, qword [rax]
jmp 0x14001c1c0
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx r8d, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + r8*4]
lea rcx, [rsp + 0x60]
add rax, r10
call rax
xorps xmm0, xmm0
mov qword [rbp - 0x10], r15
mov r8d, 0x21e
mov qword [rbp - 8], r15
lea rdx, str.______n________________________________.________________________________________________________n_______________________________________________________________________________________n______________________________________________________________________________n____________________________________________________________________________n________________________________________________________________________________n________________________________________________________________________________n_____n_n
lea rcx, [rbp - 0x20]
movups xmmword [rbp - 0x20], xmm0
call fcn.140008b70
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movdqa xmm0, xmmword [0x14003e3f0]
mov esi, r15d
mov r15, qword [rbp - 0x10]
mov r14, rax
movdqa xmm1, xmmword [0x14003e400]
mov r12, qword [rbp - 0x20]
mov r13, qword [rbp - 8]
movdqu xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm1
test r15, r15
je 0x14001c35c
xor ebx, ebx
cmp r13, 0xf
jbe 0x14001c30e
mov rdi, r12
nop dword [rax]
movzx edx, word [rsp + rbx*4 + 0x60]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movzx edx, byte [rdi]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001e400
mov rax, rbx
lea rcx, [rbx + 1]
xor ebx, ebx
lea rdi, [rdi + 1]
inc esi
cmp rax, 7
movsxd rax, esi
cmovne rbx, rcx
cmp rax, r15
jb 0x14001c2d0
jmp 0x14001c35c
xor edi, edi
lea rsi, [rbp - 0x20]
nop dword [rax]
nop dword [rax + rax]
movzx edx, word [rsp + rbx*4 + 0x60]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movzx edx, byte [rsi]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001e400
mov rax, rbx
lea rcx, [rbx + 1]
xor ebx, ebx
lea rsi, [rsi + 1]
inc edi
cmp rax, 7
movsxd rax, edi
cmovne rbx, rcx
cmp rax, r15
jb 0x14001c320
mov edx, 9
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
cmp r13, 0xf
jbe 0x14001c3a2
lea rdx, [r13 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x14001c39a
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ce45
mov rcx, r12
call fcn.140021940
xor r15d, r15d
mov qword [rbp - 8], 0xf
mov qword [rbp - 0x10], r15
mov byte [rbp - 0x20], r15b
call fcn.14001af40
call fcn.14001b2a0
lea rcx, [0x14003db60]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
cmp qword [rbp - 0x30], r15
jne 0x14001c43d
movdqa xmm0, xmmword [0x14003e530]
lea rcx, [rbp - 0x20]
movdqa xmm1, xmmword [0x14003e580]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp], 0x203a65
movdqu xmmword [rbp - 0x10], xmm1
mov byte [rbp + 4], r15b
call fcn.14000c970
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [0x14001e5d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___class_std::basic_istream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_istream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
mov dl, 0xa
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
lea rdx, [rbp - 0x40]
mov rcx, rbx
movzx r8d, al
call fcn.14001e890
cmp qword [rbp - 0x28], 0xf
lea rdx, [rbp - 0x40]
movdqa xmm0, xmmword [0x14003e470]
lea rcx, [rbp - 0x20]
cmova rdx, qword [rbp - 0x40]
mov word [rbp - 0xd], 0xa
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x7325
mov byte [rbp - 0xe], 0x27
mov byte [rbp - 0xb], r15b
call fcn.14000c970
lea rcx, [rbp - 0x40]
call fcn.14001dba0
mov edi, eax
test eax, eax
jne 0x14001c5c7
movdqa xmm0, xmmword [0x14003e590]
lea rcx, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0xf], 0xa
mov byte [rbp - 0x10], 0x64
mov byte [rbp - 0xd], r15b
call fcn.14000c970
movabs rax, 0x59cc998f77c0f8e2
movabs rcx, 0xfa5c5fd3af750d43
mov qword [rbp - 0x80], rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x80], rcx
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x68], rax
movabs rax, 0x59cc99ea04b59992
mov qword [rbp - 0x80], rax
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x80], rcx
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x18], rax
movdqa xmm0, xmmword [rbp - 0x20]
xorps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x14001c595
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14001c595
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + rbx]
mov edx, 0x1dcdd879
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14001c590
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x14001c570
cmp edx, 0x168a5e18
je 0x14001c59a
test r9d, r9d
jne 0x14001c550
mov rax, qword [rax]
jmp 0x14001c520
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx r8d, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + r8*4]
lea rcx, [rsp + 0x60]
add rax, r10
call rax
mov rbx, 0xffffffffffffffff
jmp 0x14001ce13
movdqa xmm0, xmmword [str.Process_pid:__d_nInvalid_Process___7e]
lea rcx, [rbp - 0x20]
mov edx, edi
mov word [rbp - 0x10], r15w
movdqu xmmword [rbp - 0x20], xmm0
call fcn.14000c970
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x14001c675
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14001c675
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0x2308305d
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14001c670
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x14001c650
cmp edx, 0x38f6dd8e
je 0x14001c67a
test r9d, r9d
jne 0x14001c630
mov rax, qword [rax]
jmp 0x14001c600
mov eax, dword [r11 + 0x24]
mov r8d, edi
mov ecx, dword [r11 + 0x1c]
add rax, r10
add rcx, r10
movzx edx, word [rax + r9*2]
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
mov ecx, 0x1fffff
call rax
mov qword [rbp - 0x80], rax
mov rdi, rax
test rax, rax
jne 0x14001c804
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm0, xmmword [0x14003e510]
lea rcx, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov ebx, eax
mov dword [rbp - 0x10], 0x14095654
mov dword [rbp - 0xc], 0x60124e05
mov word [rbp - 8], 0x33
mov byte [rbp - 6], 1
call fcn.14000bda0
mov rcx, rax
mov edx, ebx
call fcn.14000c970
movabs rax, 0x59cc998f77c0f8e2
movabs rcx, 0xfa5c5fd3af750d43
mov qword [rbp - 0x80], rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x80], rcx
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x68], rax
movabs rax, 0x59cc99ea04b59992
mov qword [rbp - 0x80], rax
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x80], rcx
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x18], rax
movdqa xmm0, xmmword [rbp - 0x20]
xorps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x14001c7d5
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14001c7d5
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0xdebca226
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14001c7d0
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x14001c7b0
cmp edx, 0x17f16a27
je 0x14001c7da
test r9d, r9d
jne 0x14001c790
mov rax, qword [rax]
jmp 0x14001c760
mov eax, dword [r11 + 0x24]
mov ecx, dword [r11 + 0x1c]
add rax, r10
add rcx, r10
movzx edx, word [rax + r9*2]
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x60]
add rax, r10
call rax
mov ebx, 0xfffffffe
jmp 0x14001ce13
lea rdx, [rbp - 0x74]
mov dword [rbp - 0x74], r15d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x14001c868
call qword [sym.imp.KERNEL32.dll_GetLastError]
movdqa xmm0, xmmword [0x14003e4d0]
lea rcx, [rbp - 0x20]
movdqa xmm1, xmmword [0x14003e460]
mov ebx, eax
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp + 0x10], 0x5b
movdqa xmm0, xmmword [0x14003e5c0]
movdqu xmmword [rbp], xmm0
mov byte [rbp + 0x12], 1
movdqu xmmword [rbp - 0x10], xmm1
call fcn.14001de80
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.14000c970
jmp 0x14001c88b
mov dword [rbp - 0x78], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [rbp - 0x78]
cmp dword [rbp - 0x74], eax
je 0x14001ca95
movdqa xmm0, xmmword [0x14003e440]
lea rcx, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 3], 0xa
mov dword [rbp - 0x10], 0x68637241
mov dword [rbp - 0xc], 0x63657469
mov dword [rbp - 8], 0x65727574
mov byte [rbp - 4], 0x2e
mov byte [rbp - 1], r15b
call fcn.14000c970
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x14001c955
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14001c955
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + rbx]
mov edx, 0xfafe0f4d
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14001c950
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x14001c930
cmp edx, 0x47247a0d
je 0x14001c95a
test r9d, r9d
jne 0x14001c910
mov rax, qword [rax]
jmp 0x14001c8e0
mov eax, dword [r11 + 0x24]
mov ecx, dword [r11 + 0x1c]
add rax, r10
add rcx, r10
movzx edx, word [rax + r9*2]
mov eax, dword [rcx + rdx*4]
mov rcx, rdi
add rax, r10
call rax
movabs rax, 0x59cc998f77c0f8e2
movabs rcx, 0xfa5c5fd3af750d43
mov qword [rbp - 0x80], rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x80], rcx
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x68], rax
movabs rax, 0x59cc99ea04b59992
mov qword [rbp - 0x80], rax
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x80], rcx
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x18], rax
movdqa xmm0, xmmword [rbp - 0x20]
xorps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x14001ca65
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14001ca65
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + rbx]
mov edx, 0xbcd4c34f
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14001ca60
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x14001ca40
cmp edx, 0x1c647bae
je 0x14001ca6a
test r9d, r9d
jne 0x14001ca20
mov rax, qword [rax]
jmp 0x14001c9f0
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx r8d, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + r8*4]
lea rcx, [rsp + 0x60]
add rax, r10
call rax
mov ebx, 0xfffffffd
jmp 0x14001ce13
movaps xmmword [rsp + 0x170], xmm10
movaps xmmword [rsp + 0x160], xmm11
movaps xmmword [rsp + 0x150], xmm12
movaps xmmword [rsp + 0x140], xmm13
call fcn.140001560
movups xmm0, xmmword [0x1400440c0]
lea r14, [0x140046100]
mov edi, 0x4eb0
movups xmm1, xmmword [0x1400440d0]
lea rsi, [0x1402bc430]
mov rbx, r14
movups xmmword [0x1402bc430], xmm0
sub rsi, r14
movups xmm0, xmmword [0x1400440e0]
movups xmmword [0x1402bc440], xmm1
movups xmm1, xmmword [0x1400440f0]
movups xmmword [0x1402bc450], xmm0
movups xmm0, xmmword [0x140044100]
movups xmmword [0x1402bc460], xmm1
movups xmm1, xmmword [0x140044110]
movups xmmword [0x1402bc470], xmm0
movups xmm0, xmmword [0x140044120]
movups xmmword [0x1402bc480], xmm1
movups xmm1, xmmword [0x140044130]
movups xmmword [0x1402bc490], xmm0
movups xmmword [0x1402bc4a0], xmm1
nop word [rax + rax]
movups xmm6, xmmword [rbx]
mov rcx, rbx
movups xmm7, xmmword [rbx + 0x10]
movups xmm8, xmmword [rbx + 0x20]
movups xmm9, xmmword [rbx + 0x30]
movups xmm10, xmmword [rbx + 0x40]
movups xmm11, xmmword [rbx + 0x50]
movups xmm12, xmmword [rbx + 0x60]
movups xmm13, xmmword [rbx + 0x70]
call fcn.140002020
mov ecx, 0x80
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx + rsi]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x14001cb90
add rsi, 0xffffffffffffff80
movups xmmword [0x1402bc430], xmm6
movups xmmword [0x1402bc440], xmm7
movups xmmword [0x1402bc450], xmm8
movups xmmword [0x1402bc460], xmm9
movups xmmword [0x1402bc470], xmm10
movups xmmword [0x1402bc480], xmm11
movups xmmword [0x1402bc490], xmm12
movups xmmword [0x1402bc4a0], xmm13
sub rdi, 1
jne 0x14001cb50
movaps xmm13, xmmword [rsp + 0x140]
lea rcx, [rsp + 0x60]
movaps xmm12, xmmword [rsp + 0x150]
movaps xmm11, xmmword [rsp + 0x160]
movaps xmm10, xmmword [rsp + 0x170]
mov word [rsp + 0x6d], 0xa
mov dword [rsp + 0x60], 0x72636544
mov dword [rsp + 0x64], 0x69747079
mov dword [rsp + 0x68], 0x2e2e676e
mov byte [rsp + 0x6c], 0x2e
mov byte [rsp + 0x6f], r15b
call fcn.14000c970
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x68], 0xa2e2e
mov dword [rsp + 0x60], 0x7070614d
mov dword [rsp + 0x64], 0x2e676e69
mov byte [rsp + 0x6c], r15b
call fcn.14000c970
mov rcx, qword [rbp - 0x80]
mov rdx, r14
call fcn.1400244f0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x20
call fcn.140021940
mov ecx, 0x20
call fcn.140021940
mov rax, qword [0x1402bc730]
test rax, rax
jne 0x14001cd5b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x14001cd35
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x14001cd35
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [r10 + r9*4]
mov r8d, dword [rdx + rbx]
mov edx, 0xc5e8b8d6
add r8, r10
movzx ecx, byte [r8]
inc r8
test cl, cl
je 0x14001cd30
nop
movsx ecx, cl
lea r8, [r8 + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [r8 - 1]
test cl, cl
jne 0x14001cd10
cmp edx, 0x7e1fdd39
je 0x14001cd3a
test r9d, r9d
jne 0x14001ccf0
mov rax, qword [rax]
jmp 0x14001ccc0
mov edx, dword [r11 + 0x24]
add rdx, r10
movzx r9d, word [rdx + r9*2]
mov edx, dword [r11 + 0x1c]
add rdx, r10
mov eax, dword [rdx + r9*4]
add rax, r10
mov qword [0x1402bc730], rax
mov ecx, 0x7d0
call rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rdi, r11
nop dword [rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r10d, dword [rax + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14001cdf4
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x14001cdf4
mov ebx, dword [r10 + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + rbx]
mov ecx, 0xb385f81d
add rdx, r9
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14001cdef
nop dword [rax]
movsx eax, al
lea rdx, [rdx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x14001cdd0
cmp ecx, 0xe3c3853d
je 0x14001ce4c
test r8d, r8d
jne 0x14001cdb0
mov r11, qword [r11]
cmp r11, rdi
je 0x14001ce06
cmp qword [r11 + 0x30], r15
jne 0x14001cd80
mov rax, r15
mov ecx, 0xffffffff
call rax
mov ebx, r15d
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x14001ce6d
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ce68
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ce68
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx r8d, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + r8*4]
add rax, r9
jmp 0x14001ce09
call fcn.140021940
cmp dword [rbp - 0x58], 0
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
jne 0x14001ceed
cmp dword [rbp - 0x48], 0
jne 0x14001ceed
mov r12, qword [rsp + 0x200]
mov eax, ebx
mov r13, qword [rsp + 0x1c8]
mov r14, qword [rsp + 0x1c0]
mov rsi, qword [rsp + 0x1f0]
movaps xmm6, xmmword [rsp + 0x1b0]
movaps xmm7, xmmword [rsp + 0x1a0]
movaps xmm8, xmmword [rsp + 0x190]
movaps xmm9, xmmword [rsp + 0x180]
mov rdi, qword [rsp + 0x1f8]
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140021920
add rsp, 0x1d0
pop r15
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
cmp dword [rbp - 0x58], r15d
jne 0x14001cf00
cmp dword [rbp - 0x48], r15d
je 0x14001cecd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov ecx, 6
mov dword [rbp - 0x58], r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 6
mov dword [rbp - 0x48], r15d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
lea rdx, [0x140041720]
mov dword [rbp - 0x74], ebx
lea rcx, [rbp - 0x74]
call sub.VCRUNTIME140.dll__CxxThrowException
int3