Function at 0x140050e40
Capabilities:
Acquire debug privileges
Check if file exists
Contain obfuscated stackstrings
Create thread
Encode data using xor
Enumerate gui resources
Enumerate processes
Get file attributes
Get process image filename
Hide thread from debugger
Set global application hook

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x500]
sub rsp, 0x600
mov rax, qword [0x140155010]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
mov rsi, rcx
xor r13d, r13d
call fcn.14000cdb0
call fcn.14000c6b0
call fcn.14000ceb0
call fcn.14000cc60
call fcn.14000c810
call fcn.14000c960
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140050ee0
lea rdx, str.NtSetInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140050ee0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r13 + 0x11]
call rbx
call fcn.14000d4f0
call fcn.14000d2a0
call fcn.14000d400
call fcn.14000d6d0
call fcn.14000d800
lea rcx, [rbp + 0x18]
call fcn.140003110
nop
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x140050f10
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rax
call fcn.140059d34
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x20], xmm0
lea r8, [rbp - 0x20]
mov edx, eax
lea rcx, [rbp + 0x78]
call fcn.140008e00
nop
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x140050f7d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140050f78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140050f78
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a898
movdqa xmm0, xmmword [0x1401486e0]
movdqu xmmword [rbp + 0x28], xmm0
mov word [rbp + 0x18], r13w
mov dword [rsp + 0x30], 0x2e734d6f
mov dword [rsp + 0x34], 0x6e6962
lea rax, [rsp + 0x31]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140050fb0
lea rdx, [rsp + 0x31]
lea rcx, [rbp + 0x78]
call fcn.140008aa0
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x58]
call fcn.140006dc0
nop
lea rcx, [rbp + 0x18]
call fcn.14000c240
nop
lea rdx, [rbp + 0x18]
cmp qword [rbp + 0x30], 0x10
cmovae rdx, qword [rbp + 0x18]
lea rcx, [rbp + 0x58]
cmp qword [rbp + 0x70], 0x10
cmovae rcx, qword [rbp + 0x58]
mov rbx, qword [rbp + 0x68]
cmp rbx, qword [rbp + 0x28]
jne 0x140051012
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140051019
mov dword [0x14016e360], r13d
test rbx, rbx
je 0x140052189
lea rdx, [rbp + 0x18]
lea rcx, [rsp + 0x38]
call fcn.140008540
mov rcx, rax
call fcn.14000b240
test al, al
jne 0x140051056
mov dword [rsp + 0x30], 0x7272451b
movdqa xmm0, xmmword [0x140148ef0]
lea r8, [rsp + 0x31]
jmp 0x14005219e
lea rbx, [0x14016d740]
cmp qword [0x14016d758], 0x10
cmovae rbx, qword [0x14016d740]
movdqa xmm0, xmmword [0x140148860]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x10], 0
lea rcx, [rbp - 0x1f]
call fcn.14000c580
mov rdx, rsi
lea rcx, [0x1401483b8]
call fcn.140050d50
lea rcx, [0x14005e720]
call fcn.14000c580
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140052108
test al, 0x10
jne 0x140052108
mov r14d, r13d
xor edx, edx
mov r15d, 2
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400520bb
mov dword [rbp + 0xa0], 0x238
lea rdx, [rbp + 0xa0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140051128
mov rdx, rsi
lea rcx, [rbp + 0xcc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140051121
lea rdx, [rbp + 0xa0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x1400510f7
mov r14d, dword [rbp + 0xa8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x1400520bb
mov edx, r14d
lea rcx, [0x140050db0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov dword [rbp + 0x10], r13d
lea rdx, [rbp + 0x10]
mov rcx, qword [0x14016e3a0]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
test eax, eax
jne 0x140051332
lea edx, [rax + 4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400524c0
mov r8, rax
movdqa xmm0, xmmword [0x1401488a0]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140148f00]
movdqu xmmword [rsp + 0x48], xmm1
movdqa xmm0, xmmword [0x140148b60]
movdqu xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x68], 0x2d252244
mov dword [rsp + 0x6c], 0x44202128
mov word [rsp + 0x70], 0x39
mov rcx, r13
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x39], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3a], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3b], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3c], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3d], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3e], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x3f], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x40], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x41], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x42], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x43], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x44], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x45], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x46], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x47], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x48], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x49], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4a], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4b], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4c], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4d], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4e], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x4f], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x50], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x51], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x52], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x53], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rcx + 0x54], al
add rcx, 0x1c
cmp rcx, 0x38
jb 0x1400511c0
mov byte [rsp + 0x71], 0
lea rdx, [rsp + 0x39]
mov rcx, r8
call fcn.1400092b0
lea rdx, [0x140009480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x7272456c
movdqa xmm0, xmmword [0x1401494b0]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x1401493e0]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0x20746567
mov dword [rsp + 0x5c], 0x646e6977
mov dword [rsp + 0x60], 0x2e776f
lea rdx, [rsp + 0x39]
jmp 0x140052168
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x140051350
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140009e00
nop
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
xorps xmm1, xmm1
test eax, eax
jne 0x1400513bf
movups xmmword [rbp + 0x38], xmm0
movdqu xmmword [rbp + 0x48], xmm1
xor r8d, r8d
lea rdx, [0x1401483b4]
lea rcx, [rbp + 0x38]
call fcn.140009ab0
jmp 0x14005141d
movups xmmword [rbp - 0x20], xmm0
movdqu xmmword [rbp - 0x10], xmm1
mov r8, rbx
lea rcx, [rbp - 0x20]
call fcn.140052bb0
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rax, qword [rbp - 0x20]
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [rbp + 0x48], xmm1
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14005145d
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051458
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051458
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a898
movdqa xmm0, xmmword [0x1401486f0]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 8
cmovae rcx, qword [rbp + 0x38]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x14005152b
lea edx, [rax + 4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400524c0
movdqa xmm0, xmmword [0x1401492e0]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140148f30]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0x454c4941
mov dword [rbp + 4], 0x5d2044
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400092b0
lea rdx, [0x140009480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x7272456f
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], sil
movdqa xmm0, xmmword [0x140149360]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x776f6420
mov dword [rbp - 0xc], 0x616f6c6e
mov word [rbp - 8], 0x2e64
mov byte [rbp - 6], sil
lea rdx, [rbp - 0x1f]
jmp 0x14005204d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140051e93
lea r8, [rbp - 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140051d1a
mov dword [rbp - 0x20], 4
lea r8, [rbp - 0x1c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [rbp - 0x14]
test eax, eax
cmovne ecx, r15d
mov dword [rbp - 0x14], ecx
lea r8, [rbp - 0x10]
lea rdx, str.SeLoadDriverPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea r8, [rbp - 4]
lea rdx, str.SeRemoteShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea r8, [rbp + 8]
lea rdx, str.SeCreateGlobalPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov r9d, 0x10
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140051b7d
mov cl, 0x40
mov word [rbp - 0x80], 0x40
movsx ebx, cl
movzx eax, bx
xor ax, 0x10
mov word [rbp - 0x7e], ax
movzx eax, bx
xor ax, 0x32
mov word [rbp - 0x7c], ax
movzx ecx, bx
xor cx, 0x29
mov word [rbp - 0x7a], cx
movzx eax, bx
xor ax, 0x36
mov word [rbp - 0x78], ax
mov word [rbp - 0x76], cx
movzx r11d, bx
xor r11w, 0x2c
mov word [rbp - 0x74], r11w
movzx r10d, bx
xor r10w, 0x25
mov word [rbp - 0x72], r10w
movzx eax, bx
xor ax, 0x27
mov word [rbp - 0x70], ax
mov word [rbp - 0x6e], r10w
movzx r9d, bx
xor r9w, 0x33
mov word [rbp - 0x6c], r9w
movzx edx, bx
xor dx, 0x60
mov word [rbp - 0x6a], dx
movzx eax, bx
xor ax, 0x21
mov word [rbp - 0x68], ax
movzx ecx, bx
xor cx, 0x24
mov word [rbp - 0x66], cx
movzx eax, bx
xor ax, 0x2a
mov word [rbp - 0x64], ax
movzx r8d, bx
xor r8w, 0x35
mov word [rbp - 0x62], r8w
mov word [rbp - 0x60], r9w
movzx eax, bx
xor ax, 0x34
mov word [rbp - 0x5e], ax
mov word [rbp - 0x5c], r10w
mov word [rbp - 0x5a], cx
mov word [rbp - 0x58], dx
mov word [rbp - 0x56], r9w
mov word [rbp - 0x54], r8w
movzx eax, bx
xor ax, 0x23
mov word [rbp - 0x52], ax
mov word [rbp - 0x50], ax
mov word [rbp - 0x4e], r10w
mov word [rbp - 0x4c], r9w
mov word [rbp - 0x4a], r9w
movzx eax, bx
xor ax, 0x26
mov word [rbp - 0x48], ax
mov word [rbp - 0x46], r8w
mov word [rbp - 0x44], r11w
mov word [rbp - 0x42], r11w
movzx eax, bx
xor ax, 0x39
mov word [rbp - 0x40], ax
xor bx, 0x6e
mov word [rbp - 0x3e], bx
mov word [rbp - 0x3c], r13w
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140052620
lea rdx, [0x1400527f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x104
lea rdx, [rbp + 0x2e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x1400518ce
mov r15, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov ebx, 4
mov rax, qword gs:[0x58]
add rbx, qword [rax]
mov eax, dword [rbx]
cmp dword [0x14016e624], eax
jle 0x1400517bc
lea rcx, [0x14016e624]
call fcn.14005ac74
cmp dword [0x14016e624], 0xffffffff
jne 0x1400517bc
xor ecx, ecx
call fcn.14000c470
mov word [0x14016e630], ax
lea rcx, [0x14016e624]
call fcn.14005ac14
mov eax, dword [rbx]
cmp dword [0x14016e634], eax
jle 0x1400517fd
lea rcx, [0x14016e634]
call fcn.14005ac74
cmp dword [0x14016e634], 0xffffffff
jne 0x1400517fd
movzx eax, word [0x14016e630]
mov edx, 0xf0
and ax, dx
mov word [0x14016e620], ax
lea rcx, [0x14016e634]
call fcn.14005ac14
mov eax, dword [rbx]
cmp dword [0x14016e62c], eax
jle 0x14005183a
lea rcx, [0x14016e62c]
call fcn.14005ac74
cmp dword [0x14016e62c], 0xffffffff
jne 0x14005183a
movzx eax, word [0x14016e630]
and ax, 0xf
mov word [0x14016e628], ax
lea rcx, [0x14016e62c]
call fcn.14005ac14
movzx edi, r13w
mov ecx, 7
call fcn.14000c470
test al, 0xf0
je 0x14005185f
mov word [0x14016e620], ax
movzx edi, ax
or di, word [0x14016e628]
jmp 0x140051874
test al, 0xf
je 0x140051874
mov word [0x14016e628], ax
movzx edi, ax
or di, word [0x14016e620]
mov rcx, r15
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
lea r12, [rbp + 0x528]
mov rbx, qword [r12]
mov qword [r12], r13
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov qword [r12], rbx
mov rcx, r15
call fcn.140052830
mov rcx, rax
lea rdx, [rbp + 0x2e0]
call fcn.140052620
lea rdx, [0x1400527f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.NextHook
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rax, rax
jne 0x140051986
lea edx, [rax + 4]
call fcn.1400524c0
movdqa xmm0, xmmword [0x140149090]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140148f40]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0x454c4941
mov dword [rbp + 4], 0x5d2044
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400092b0
lea rdx, [0x140009480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724544
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], bl
movdqa xmm0, xmmword [0x140149080]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140148f40]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0x454c4941
mov dword [rsp + 0x5c], 0x5d2044
lea rdx, [rsp + 0x39]
jmp 0x14005204d
mov edx, 7
call fcn.1400524c0
movdqa xmm0, xmmword [0x1401490a0]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140148960]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0x72656874
mov word [rbp + 4], 0x2165
mov byte [rbp + 6], 0
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400092b0
lea rdx, [0x140009480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, r14d
mov r8, rsi
mov rdx, rbx
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rax, rax
jne 0x140051a89
lea edx, [rax + 4]
call fcn.1400524c0
movdqa xmm0, xmmword [0x1401491f0]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140148f10]
movdqu xmmword [rbp - 0x10], xmm1
mov word [rbp], 0x5d20
mov byte [rbp + 2], 0
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400092b0
lea rdx, [0x140009480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724530
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x140149200]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140148f10]
movdqu xmmword [rsp + 0x48], xmm1
mov word [rsp + 0x58], 0x5d20
mov byte [rsp + 0x5a], 0
lea rdx, [rsp + 0x39]
jmp 0x14005204d
mov edx, 7
call fcn.1400524c0
movdqa xmm0, xmmword [0x140149530]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x2e70
mov byte [rbp - 0xe], 0
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400092b0
lea rdx, [0x140009480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov byte [0x140155068], 0
movdqa xmm0, xmmword [0x140149450]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x6c756673
mov dword [rbp - 0xc], 0xa21796c
mov byte [rbp - 8], 0
lea rcx, [rbp - 0x1f]
call fcn.14000c580
mov dword [rbp - 0x30], 0x63755374
mov dword [rbp - 0x2c], 0x73736563
mov byte [rbp - 0x28], 0
movdqa xmm0, xmmword [0x140149290]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x6c20796c
mov dword [rbp - 0xc], 0x6564616f
mov word [rbp - 8], 0x2164
mov byte [rbp - 6], 0
mov r9d, 0x40
lea r8, [rbp - 0x2f]
lea rdx, [rbp - 0x1f]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x140052300]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x140155068], 0
jmp 0x140052061
mov cl, 0x71
mov word [rbp - 0x80], 0x71
movsx r11d, cl
movzx eax, r11w
xor ax, 0x34
mov word [rbp - 0x7e], ax
movzx r9d, r11w
xor r9w, 3
mov word [rbp - 0x7c], r9w
mov word [rbp - 0x7a], r9w
movzx eax, r11w
xor ax, 0x1e
mov word [rbp - 0x78], ax
mov word [rbp - 0x76], r9w
movzx r10d, r11w
xor r10w, 0x51
mov word [rbp - 0x74], r10w
movzx eax, r11w
xor ax, 0x10
mov word [rbp - 0x72], ax
movzx eax, r11w
xor ax, 0x15
mov word [rbp - 0x70], ax
movzx eax, r11w
xor ax, 0x1b
mov word [rbp - 0x6e], ax
movzx eax, r11w
xor ax, 4
mov word [rbp - 0x6c], ax
movzx r8d, r11w
xor r8w, 2
mov word [rbp - 0x6a], r8w
movzx eax, r11w
xor ax, 5
mov word [rbp - 0x68], ax
movzx ecx, r11w
xor cx, 0x18
mov word [rbp - 0x66], cx
movzx eax, r11w
xor ax, 0x1f
mov word [rbp - 0x64], ax
movzx edx, r11w
xor dx, 0x16
mov word [rbp - 0x62], dx
mov word [rbp - 0x60], r10w
movzx eax, r11w
xor ax, 1
mov word [rbp - 0x5e], ax
mov word [rbp - 0x5c], r9w
mov word [rbp - 0x5a], cx
movzx eax, r11w
xor ax, 7
mov word [rbp - 0x58], ax
mov word [rbp - 0x56], cx
movzx eax, r11w
xor ax, 0x1d
mov word [rbp - 0x54], ax
movzx eax, r11w
xor ax, 0x14
mov word [rbp - 0x52], ax
mov word [rbp - 0x50], dx
mov word [rbp - 0x4e], ax
mov word [rbp - 0x4c], r8w
xor r11w, 0x4b
mov word [rbp - 0x4a], r11w
mov word [rbp - 0x48], r10w
mov word [rbp - 0x46], r13w
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140052620
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400527f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724574
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x1401491d0]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x69727020
mov dword [rsp + 0x4c], 0x656c6976
mov dword [rsp + 0x50], 0x2e736567
mov byte [rsp + 0x54], 0
lea r8, [rsp + 0x31]
lea rdx, [rsp + 0x39]
jmp 0x140052052
mov cl, 0x16
mov word [rbp - 0x80], 0x16
movsx ebx, cl
movzx eax, bx
xor ax, 0x53
mov word [rbp - 0x7e], ax
movzx r9d, bx
xor r9w, 0x64
mov word [rbp - 0x7c], r9w
mov word [rbp - 0x7a], r9w
movzx r10d, bx
xor r10w, 0x79
mov word [rbp - 0x78], r10w
mov word [rbp - 0x76], r9w
movzx r11d, bx
xor r11w, 0x36
mov word [rbp - 0x74], r11w
mov word [rbp - 0x72], r10w
movzx ecx, bx
xor cx, 0x66
mov word [rbp - 0x70], cx
movzx r8d, bx
xor r8w, 0x73
mov word [rbp - 0x6e], r8w
movzx edx, bx
xor dx, 0x78
mov word [rbp - 0x6c], dx
movzx eax, bx
xor ax, 0x7f
mov word [rbp - 0x6a], ax
mov word [rbp - 0x68], dx
movzx eax, bx
xor ax, 0x71
mov word [rbp - 0x66], ax
mov word [rbp - 0x64], r11w
mov word [rbp - 0x62], cx
mov word [rbp - 0x60], r9w
mov word [rbp - 0x5e], r10w
movzx eax, bx
xor ax, 0x75
mov word [rbp - 0x5c], ax
mov word [rbp - 0x5a], r8w
movzx eax, bx
xor ax, 0x65
mov word [rbp - 0x58], ax
mov word [rbp - 0x56], ax
mov word [rbp - 0x54], r11w
movzx eax, bx
xor ax, 0x62
mov word [rbp - 0x52], ax
mov word [rbp - 0x50], r10w
movzx eax, bx
xor ax, 0x7d
mov word [rbp - 0x4e], ax
mov word [rbp - 0x4c], r8w
mov word [rbp - 0x4a], dx
xor bx, 0x2c
mov word [rbp - 0x48], bx
mov word [rbp - 0x46], r11w
mov word [rbp - 0x44], r13w
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140052620
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400527f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x7272454c
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x1401493a0]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x65636f72
mov dword [rsp + 0x4c], 0x74207373
mov dword [rsp + 0x50], 0x6e656b6f
mov word [rsp + 0x54], 0x2e
lea rdx, [rsp + 0x39]
jmp 0x14005204d
mov cl, 0x1f
mov word [rbp - 0x80], 0x1f
movsx ebx, cl
movzx eax, bx
xor ax, 0x5a
mov word [rbp - 0x7e], ax
movzx r11d, bx
xor r11w, 0x6d
mov word [rbp - 0x7c], r11w
mov word [rbp - 0x7a], r11w
movzx r8d, bx
xor r8w, 0x70
mov word [rbp - 0x78], r8w
mov word [rbp - 0x76], r11w
movzx r10d, bx
xor r10w, 0x3f
mov word [rbp - 0x74], r10w
mov word [rbp - 0x72], r8w
movzx edx, bx
xor dx, 0x6f
mov word [rbp - 0x70], dx
movzx r9d, bx
xor r9w, 0x7a
mov word [rbp - 0x6e], r9w
movzx ecx, bx
xor cx, 0x71
mov word [rbp - 0x6c], cx
movzx eax, bx
xor ax, 0x76
mov word [rbp - 0x6a], ax
mov word [rbp - 0x68], cx
movzx eax, bx
xor ax, 0x78
mov word [rbp - 0x66], ax
mov word [rbp - 0x64], r10w
mov word [rbp - 0x62], dx
mov word [rbp - 0x60], r11w
mov word [rbp - 0x5e], r8w
movzx eax, bx
xor ax, 0x7c
mov word [rbp - 0x5c], ax
mov word [rbp - 0x5a], r9w
movzx eax, bx
xor ax, 0x6c
mov word [rbp - 0x58], ax
mov word [rbp - 0x56], ax
mov word [rbp - 0x54], r10w
movzx eax, bx
xor ax, 0x6b
mov word [rbp - 0x52], ax
movzx eax, bx
xor ax, 0x77
mov word [rbp - 0x50], ax
mov word [rbp - 0x4e], r11w
mov word [rbp - 0x4c], r9w
movzx eax, bx
xor ax, 0x7e
mov word [rbp - 0x4a], ax
movzx eax, bx
xor ax, 0x7b
mov word [rbp - 0x48], ax
xor bx, 0x25
mov word [rbp - 0x46], bx
mov word [rbp - 0x44], r10w
mov word [rbp - 0x42], r13w
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140052620
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400527f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x7272450c
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x1401493b0]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x65636f72
mov dword [rsp + 0x4c], 0x74207373
mov dword [rsp + 0x50], 0x61657268
mov word [rsp + 0x54], 0x2e64
mov byte [rsp + 0x56], 0
mov r9d, 0x10
lea r8, [rsp + 0x31]
lea rdx, [rsp + 0x39]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rsp + 0x30], 0x72724515
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r8, [rsp + 0x31]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 8
jb 0x1400520a4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005209f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005209f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a898
movdqa xmm0, xmmword [0x1401486e0]
movdqu xmmword [rbp + 0x48], xmm0
mov word [rbp + 0x38], r13w
jmp 0x1400521f2
movdqa xmm0, xmmword [0x140149550]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x2e646e
lea rdx, [rbp - 0x1f]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400092b0
lea rdx, [0x140009480]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724526
movdqa xmm0, xmmword [0x140149540]
mov dword [rbp - 0x10], 0x2e646e
jmp 0x14005215f
movdqa xmm0, xmmword [0x140149350]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x776f6420
mov dword [rbp - 0xc], 0x616f6c6e
mov dword [rbp - 8], 0xa2e64
lea rcx, [rbp - 0x1f]
call fcn.14000c580
mov rcx, rbx
call fcn.14000c580
mov dword [rsp + 0x30], 0x72724522
movdqa xmm0, xmmword [0x140149340]
mov dword [rbp - 0x10], 0x776f6420
mov dword [rbp - 0xc], 0x616f6c6e
mov word [rbp - 8], 0x64
movdqu xmmword [rbp - 0x20], xmm0
lea rdx, [rbp - 0x1f]
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
lea r8, [rsp + 0x31]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1400521f2
mov dword [rsp + 0x30], 0x72724526
movdqa xmm0, xmmword [0x140148ee0]
lea r8, [rsp + 0x31]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140148f80]
movdqa xmm0, xmmword [0x140148f20]
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqu xmmword [rsp + 0x48], xmm1
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x68], 0x2e59
mov byte [rsp + 0x6a], 0
mov r9d, 0x10
lea rdx, [rsp + 0x39]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x14016e360], r13d
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x140052231
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005222b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005222b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a898
nop
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x14005226f
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005226a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005226a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a898
mov qword [rbp + 0x68], r13
mov qword [rbp + 0x70], 0xf
mov byte [rbp + 0x58], 0
mov rdx, qword [rbp + 0x90]
cmp rdx, 0x10
jb 0x1400522c0
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400522bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400522bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005a898
xor al, al
mov rcx, qword [rbp + 0x4f0]
xor rcx, rsp
call fcn.14005a5a0
lea r11, [rsp + 0x600]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret