Function at 0x140028e20
Capabilities:
Encode data using xor
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x440]
sub rsp, 0x540
mov rax, qword [0x140158418]
xor rax, rsp
mov qword [rbp + 0x430], rax
xor r13d, r13d
movdqa xmm0, xmmword [0x14012e660]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x6f24797d
mov word [rsp + 0x44], 0x6f72
xor eax, eax
mov byte [rsp + 0x46], al
mov ecx, r13d
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x31], al
inc rcx
cmp rcx, 0x15
jb 0x140028e90
mov byte [rsp + 0x46], r13b
lea rcx, [rsp + 0x31]
call fcn.14000f910
mov dword [0x140158d6c], eax
test eax, eax
je 0x14002a9ab
mov edx, eax
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov dword [rbp - 0x80], 0x238
cmp rax, 0xffffffffffffffff
je 0x140028f1c
lea rdx, [rbp - 0x80]
mov rcx, rax
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x140028f13
nop dword [rax + rax]
lea rdx, [rsp + 0x31]
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
test eax, eax
je 0x140028f13
lea rdx, [rbp - 0x80]
mov rcx, rbx
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x140028ef0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x1c0]
lea rax, [rbp - 0x80]
mov edx, 4
nop dword [rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x140028f30
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov r8d, dword [0x140158d6c]
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
mov qword [0x140158dc0], rax
xorps xmm0, xmm0
mov ebx, dword [rbp - 0x60]
movdqu xmmword [rbp + 0x418], xmm0
mov r14, r13
mov qword [rbp + 0x428], r13
mov rdi, r13
mov rsi, r13
test rbx, rbx
je 0x14002904a
cmp rbx, 0x1000
jb 0x140029011
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14002a9e1
call fcn.1400e9738
test rax, rax
je 0x14002a999
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14002901c
mov rcx, rbx
call fcn.1400e9738
mov rsi, rax
mov r15, rsi
mov qword [rbp + 0x418], rsi
lea r14, [rsi + rbx]
mov rdi, r14
mov qword [rbp + 0x428], r14
mov r8, rbx
xor edx, edx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x420], r14
jmp 0x140029051
mov r15, qword [rbp + 0x418]
mov qword [rsp + 0x20], r13
mov r9, rbx
mov r8, r15
mov rdx, qword [rbp - 0x68]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
nop
mov rax, qword [rbp + 0x1d8]
mov qword [0x140158e90], rax
lea rax, [rsp + 0x60]
mov qword [rbp + 0x400], rax
lea rdx, [0x140159168]
lea rcx, [rsp + 0x60]
call fcn.14000d750
mov r12, rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
sub rdi, rsi
movabs rbx, 0x7fffffffffffffff
je 0x14002912e
cmp rdi, rbx
ja 0x14002a9e7
cmp rdi, 0x1000
jb 0x1400290f6
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x14002a9ed
call fcn.1400e9738
mov rcx, rax
test rax, rax
je 0x1400290ef
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400290fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400e9738
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea rbx, [rax + rdi]
mov qword [rsp + 0x40], rbx
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
movabs rbx, 0x7fffffffffffffff
mov rdx, r12
lea rcx, [rsp + 0x30]
call fcn.14000f9d0
mov qword [0x140158de0], rax
lea rax, [rsp + 0x60]
mov qword [rbp + 0x400], rax
lea rdx, [0x140158fe8]
lea rcx, [rsp + 0x60]
call fcn.14000d750
mov r12, rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
test rdi, rdi
je 0x1400291e4
cmp rdi, rbx
ja 0x14002a9f3
cmp rdi, 0x1000
jb 0x1400291b6
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x14002a9f9
call fcn.1400e9738
mov rcx, rax
test rax, rax
je 0x1400291af
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400291be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400e9738
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea rbx, [rdi + rax]
mov qword [rsp + 0x40], rbx
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
mov rdx, r12
lea rcx, [rsp + 0x30]
call fcn.14000f9d0
mov qword [0x140158e00], rax
lea rax, [rsp + 0x60]
mov qword [rbp + 0x400], rax
lea rdx, [0x1401590e0]
lea rcx, [rsp + 0x60]
call fcn.14000d750
mov r12, rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
test rdi, rdi
je 0x1400292a4
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x14002a9ff
cmp rdi, 0x1000
jb 0x140029276
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x14002aa05
call fcn.1400e9738
mov rcx, rax
test rax, rax
je 0x14002926f
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14002927e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400e9738
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea rbx, [rdi + rax]
mov qword [rsp + 0x40], rbx
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
mov rdx, r12
lea rcx, [rsp + 0x30]
call fcn.14000f9d0
mov qword [0x140158e28], rax
lea rax, [rsp + 0x60]
mov qword [rbp + 0x400], rax
lea rdx, [0x140158fa0]
lea rcx, [rsp + 0x60]
call fcn.14000d750
mov r12, rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
test rdi, rdi
je 0x140029364
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x14002aa0b
cmp rdi, 0x1000
jb 0x140029336
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x14002aa11
call fcn.1400e9738
mov rcx, rax
test rax, rax
je 0x14002932f
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14002933e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400e9738
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea rbx, [rax + rdi]
mov qword [rsp + 0x40], rbx
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
mov rdx, r12
lea rcx, [rsp + 0x30]
call fcn.14000f9d0
mov qword [0x140158e48], rax
lea rax, [rsp + 0x60]
mov qword [rbp + 0x400], rax
lea rdx, [0x1401590f8]
lea rcx, [rsp + 0x60]
call fcn.14000d750
mov r12, rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
test rdi, rdi
je 0x140029424
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x14002aa17
cmp rdi, 0x1000
jb 0x1400293f6
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x14002a9db
call fcn.1400e9738
mov rcx, rax
test rax, rax
je 0x1400293ef
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400293fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400e9738
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea rbx, [rax + rdi]
mov qword [rsp + 0x40], rbx
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x38], rbx
mov rdx, r12
lea rcx, [rsp + 0x30]
call fcn.14000f9d0
mov qword [0x140158e68], rax
mov r12, 0xfffffffffffffffb
mov rcx, qword [0x140158de0]
test rcx, rcx
je 0x140029a9e
movss xmm0, dword [0x14015803c]
movss dword [rbp + 0x400], xmm0
mov eax, dword [0x140158dc8]
test eax, eax
jne 0x1400297f6
mov rax, qword [0x140159020]
cmp qword [0x140159018], rax
jne 0x140029a9e
mov rdx, qword [0x140159078]
mov eax, dword [rbp + 0x400]
movzx ecx, al
mov dword [rdx + 0x14], ecx
mov rdx, qword [0x140159078]
mov ecx, eax
shr ecx, 8
movzx ecx, cl
mov dword [rdx + 0x18], ecx
mov rdx, qword [0x140159078]
mov ecx, eax
shr ecx, 0x10
movzx ecx, cl
mov dword [rdx + 0x1c], ecx
mov rcx, qword [0x140159078]
shr eax, 0x18
mov dword [rcx + 0x20], eax
lea rdx, [0x1401590a8]
lea rcx, [rsp + 0x60]
call fcn.14000d750
mov r8, qword [0x140158de0]
add r8, qword [0x140158e90]
mov r9, rax
mov rdx, qword [0x140158dc0]
lea rcx, [rsp + 0x30]
call fcn.14000f6e0
mov rdx, rax
lea rcx, [0x1401590a8]
call fcn.14000ea10
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140029552
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002954d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002954d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e9774
lea rcx, [rbp - 0x80]
lea rax, [rbp + 0x1c0]
mov edx, 4
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x140029562
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov qword [rsp + 0x20], 1
lea r9d, [rdx + 4]
mov r8, qword [0x140158de0]
lea rdx, [rbp - 0x80]
mov rcx, qword [0x140158dc0]
call fcn.14000f810
mov rbx, rax
lea rdx, [0x140159078]
lea rcx, [rsp + 0x60]
call fcn.14000d750
mov r8, rax
mov word [rbp + 0x408], bx
mov rdx, r13
mov r9, qword [rax]
mov rax, qword [rax + 8]
sub rax, r9
sar rax, 2
movzx ecx, bx
test rax, rax
je 0x140029648
nop dword [rax]
cmp dword [r9 + rdx*4], 0xfffffffe
je 0x140029641
inc rdx
cmp rdx, rax
jb 0x140029630
jmp 0x140029648
movzx eax, cl
mov dword [r9 + rdx*4], eax
mov rdx, r13
mov r9, qword [r8]
mov rax, qword [r8 + 8]
sub rax, r9
sar rax, 2
test rax, rax
je 0x140029678
nop
cmp dword [r9 + rdx*4], 0xfffffffe
je 0x140029671
inc rdx
cmp rdx, rax
jb 0x140029660
jmp 0x140029678
movzx eax, cl
mov dword [r9 + rdx*4], eax
mov rdx, r13
mov r9, qword [r8]
mov rax, qword [r8 + 8]
sub rax, r9
sar rax, 2
test rax, rax
je 0x1400296a8
nop
cmp dword [r9 + rdx*4], 0xfffffffe
je 0x1400296a1
inc rdx
cmp rdx, rax
jb 0x140029690
jmp 0x1400296a8
movzx eax, cl
mov dword [r9 + rdx*4], eax
mov rdx, qword [r8 + 0x10]
mov qword [r8 + 0x10], r13
mov rcx, qword [r8 + 8]
mov qword [r8 + 8], r13
mov rax, qword [r8]
mov qword [r8], r13
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x30]
lea rcx, [0x140159078]
call fcn.14000ea10
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140029729
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029724
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140029724
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e9774
lea rax, [rsp + 0x60]
mov qword [rbp + 0x400], rax
lea rdx, [0x1401590a8]
lea rcx, [rsp + 0x60]
call fcn.14000d750
mov rbx, rax
lea rdx, [0x140159078]
lea rcx, [rsp + 0x48]
call fcn.14000d750
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000fcc0
mov rdx, rax
lea rcx, [0x140159078]
call fcn.14000ea10
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400297c5
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400297c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400297c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e9774
cmp byte [0x140158d4e], 0
jne 0x140029a9e
lea rdx, [0x140159078]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov rdx, qword [0x140158e90]
add rdx, qword [0x140158de0]
jmp 0x140029a8f
cmp eax, 1
jne 0x140029a9e
mov rax, qword [0x140159020]
cmp qword [0x140159018], rax
je 0x140029a9e
mov rsi, qword [0x140158e90]
add rsi, rcx
lea rdx, [0x140159078]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov rdx, rax
mov rcx, rsi
call fcn.14001e330
mov rdi, rax
lea rcx, [rbp - 0x80]
lea rax, [rbp + 0x1c0]
mov edx, 4
nop dword [rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x140029850
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov r9, qword [0x140159020]
sub r9, qword [0x140159018]
sar r9, 2
mov dword [rsp + 0x28], 4
mov eax, dword [0x140158dc8]
mov dword [rsp + 0x20], eax
mov r8, qword [0x140158de0]
lea rdx, [rbp - 0x80]
mov rcx, qword [0x140158dc0]
call fcn.140011c30
mov r13, rax
lea rdx, [0x140159018]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov rdx, rax
mov rcx, r13
call fcn.140013710
mov rcx, rsi
sub rcx, r13
mov rbx, r12
sub rbx, rcx
sub rax, rdi
mov rdi, r12
sub rdi, rax
lea rax, [r13 + 0x1000]
mov qword [0x140158df8], rax
mov qword [0x140158de8], rsi
mov qword [0x140158df0], r13
lea rdx, [0x1401590a8]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, qword [0x140158de0]
add r8, qword [0x140158e90]
mov r9, rax
mov rdx, qword [0x140158dc0]
lea rcx, [rsp + 0x60]
call fcn.14000f6e0
mov rdx, rax
lea rcx, [0x1401590a8]
call fcn.14000ea10
lea rcx, [rsp + 0x60]
call fcn.14000e700
lea rdx, [0x140159078]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14000fe00
mov rdx, rax
lea rcx, [0x140159078]
call fcn.14000ea10
lea rcx, [rsp + 0x60]
call fcn.14000e700
lea rdx, [0x140159018]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.14000fe00
mov rdx, rax
lea rcx, [0x140159018]
call fcn.14000ea10
lea rcx, [rsp + 0x60]
call fcn.14000e700
mov dword [rbp + 0x408], 0x40400000
cmp byte [0x140158d4e], 0
jne 0x140029a2e
movss xmm0, dword [0x14015803c]
movss dword [rbp + 0x408], xmm0
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x408]
mov rdx, qword [0x140158df8]
mov rcx, qword [0x140158dc0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [0x140159018]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
mov rdx, r13
mov rcx, qword [0x140158dc0]
call fcn.140036570
lea rdx, [0x140159078]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov rdx, rsi
mov r8, rax
mov rcx, qword [0x140158dc0]
call fcn.140036570
mov rcx, qword [0x140158e28]
test rcx, rcx
je 0x140029d5b
cmp dword [0x140158dd0], 1
jne 0x140029d5b
mov rax, qword [0x140159038]
cmp qword [0x140159030], rax
je 0x140029d5b
mov rsi, qword [0x140158e90]
add rsi, rcx
lea rdx, [0x140159128]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov rdx, rax
mov rcx, rsi
call fcn.14001e330
mov rdi, rax
lea rcx, [rbp - 0x80]
lea rax, [rbp + 0x1c0]
mov edx, 4
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x140029b10
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov r9, qword [0x140159038]
sub r9, qword [0x140159030]
sar r9, 2
mov dword [rsp + 0x28], 4
mov eax, dword [0x140158dd0]
mov dword [rsp + 0x20], eax
mov r8, qword [0x140158e28]
lea rdx, [rbp - 0x80]
mov rcx, qword [0x140158dc0]
call fcn.140011c30
mov r13, rax
lea rdx, [0x140159030]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov rdx, rax
mov rcx, r13
call fcn.140013710
mov rcx, rsi
sub rcx, r13
mov rbx, r12
sub rbx, rcx
sub rax, rdi
mov rdi, r12
sub rdi, rax
lea rax, [r13 + 0x1000]
mov qword [0x140158e40], rax
mov qword [0x140158e30], rsi
mov qword [0x140158e38], r13
lea rdx, [0x1401590c8]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r9, rax
mov r8, rsi
mov rdx, qword [0x140158dc0]
lea rcx, [rsp + 0x60]
call fcn.14000f6e0
mov rdx, rax
lea rcx, [0x1401590c8]
call fcn.14000ea10
lea rcx, [rsp + 0x60]
call fcn.14000e700
lea rdx, [0x140159128]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14000fe00
mov rdx, rax
lea rcx, [0x140159128]
call fcn.14000ea10
lea rcx, [rsp + 0x60]
call fcn.14000e700
lea rdx, [0x140159030]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.14000fe00
mov rdx, rax
lea rcx, [0x140159030]
call fcn.14000ea10
lea rcx, [rsp + 0x60]
call fcn.14000e700
mov dword [0x140158d48], 0x41a00000
cmp byte [0x140158d53], 0
jne 0x140029ceb
movss xmm0, dword [0x14015806c]
mulss xmm0, dword [0x14012dba4]
movss dword [0x140158d48], xmm0
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [0x140158d48]
mov rdx, qword [0x140158e40]
mov rcx, qword [0x140158dc0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [0x140159030]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
mov rdx, r13
mov rcx, qword [0x140158dc0]
call fcn.140036570
lea rdx, [0x140159128]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
mov rdx, rsi
mov rcx, qword [0x140158dc0]
call fcn.140036570
mov rcx, qword [0x140158e48]
test rcx, rcx
je 0x14002a005
cmp dword [0x140158dd4], 1
jne 0x14002a005
mov rax, qword [0x1401591c8]
cmp qword [0x1401591c0], rax
je 0x14002a005
mov r13, qword [0x140158e90]
add r13, rcx
lea rdx, [0x140159060]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov rdx, rax
mov rcx, r13
call fcn.14001e330
mov rdi, rax
lea rcx, [rbp - 0x80]
lea rax, [rbp + 0x1c0]
mov edx, 4
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x140029dd0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov r9, qword [0x1401591c8]
sub r9, qword [0x1401591c0]
sar r9, 2
mov dword [rsp + 0x28], 4
mov eax, dword [0x140158dd4]
mov dword [rsp + 0x20], eax
mov r8, qword [0x140158e48]
lea rdx, [rbp - 0x80]
mov rcx, qword [0x140158dc0]
call fcn.140011c30
mov rsi, rax
lea rdx, [0x1401591c0]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov rdx, rax
mov rcx, rsi
call fcn.140013710
mov rcx, r13
sub rcx, rsi
mov rbx, r12
sub rbx, rcx
sub rax, rdi
mov rdi, r12
sub rdi, rax
lea rax, [rsi + 0x1000]
mov qword [0x140158e60], rax
mov qword [0x140158e50], r13
mov qword [0x140158e58], rsi
lea rdx, [0x140158fd0]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, qword [0x140158e90]
add r8, qword [0x140158e48]
mov r9, rax
mov rdx, qword [0x140158dc0]
lea rcx, [rsp + 0x60]
call fcn.14000f6e0
mov rdx, rax
lea rcx, [0x140158fd0]
call fcn.14000ea10
lea rcx, [rsp + 0x60]
call fcn.14000e700
lea rdx, [0x140159060]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14000fe00
mov rdx, rax
lea rcx, [0x140159060]
call fcn.14000ea10
lea rcx, [rsp + 0x60]
call fcn.14000e700
lea rdx, [0x1401591c0]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.14000fe00
mov rdx, rax
lea rcx, [0x1401591c0]
call fcn.14000ea10
lea rcx, [rsp + 0x60]
call fcn.14000e700
mov dword [rbp + 0x400], 1
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x400]
mov rdx, qword [0x140158e60]
mov rcx, qword [0x140158dc0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [0x1401591c0]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
mov rdx, rsi
mov rcx, qword [0x140158dc0]
call fcn.140036570
lea rdx, [0x140159060]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
mov rdx, r13
mov rcx, qword [0x140158dc0]
call fcn.140036570
mov rcx, qword [0x140158e68]
test rcx, rcx
je 0x14002a307
cmp dword [0x140158dd8], 2
jne 0x14002a307
mov rax, qword [0x140158fc0]
cmp qword [0x140158fb8], rax
je 0x14002a307
mov rsi, qword [0x140158e90]
add rsi, rcx
lea rdx, [0x140159000]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov rdx, rax
mov rcx, rsi
call fcn.14001e330
mov rdi, rax
lea rcx, [rbp - 0x80]
lea rax, [rbp + 0x1c0]
mov edx, 4
nop
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x14002a070
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov r9, qword [0x140158fc0]
sub r9, qword [0x140158fb8]
sar r9, 2
mov dword [rsp + 0x28], 4
mov eax, dword [0x140158dd8]
mov dword [rsp + 0x20], eax
mov r8, qword [0x140158e68]
lea rdx, [rbp - 0x80]
mov rcx, qword [0x140158dc0]
call fcn.140011c30
mov r13, rax
lea rdx, [0x140158fb8]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov rdx, rax
mov rcx, r13
call fcn.140013710
mov rcx, rsi
sub rcx, r13
mov rbx, r12
sub rbx, rcx
sub rax, rdi
mov rdi, r12
sub rdi, rax
lea rax, [r13 + 0x1000]
mov qword [0x140158e80], rax
add rax, 4
mov qword [0x140158e88], rax
mov qword [0x140158e70], rsi
mov qword [0x140158e78], r13
lea rdx, [0x140159048]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, qword [0x140158e90]
add r8, qword [0x140158e68]
mov r9, rax
mov rdx, qword [0x140158dc0]
lea rcx, [rsp + 0x60]
call fcn.14000f6e0
mov rdx, rax
lea rcx, [0x140159048]
call fcn.14000ea10
lea rcx, [rsp + 0x60]
call fcn.14000e700
lea rdx, [0x140159000]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14000fe00
mov rdx, rax
lea rcx, [0x140159000]
call fcn.14000ea10
lea rcx, [rsp + 0x60]
call fcn.14000e700
lea rdx, [0x140158fb8]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14000fe00
mov rdx, rax
lea rcx, [0x140158fb8]
call fcn.14000ea10
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14002a277
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a272
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a272
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e9774
xor ebx, ebx
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 4]
lea r8, [0x14015807c]
mov rdx, qword [0x140158e80]
mov rcx, qword [0x140158dc0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 4]
lea r8, [0x140158100]
mov rdx, qword [0x140158e88]
mov rcx, qword [0x140158dc0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [0x140158fb8]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
mov rdx, r13
mov rcx, qword [0x140158dc0]
call fcn.140036570
lea rdx, [0x140159000]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
mov rdx, rsi
mov rcx, qword [0x140158dc0]
call fcn.140036570
mov rax, qword [0x140158e00]
test rax, rax
je 0x14002a970
lea rcx, [rax + 2]
mov qword [0x140158e00], rcx
cmp dword [0x140158dcc], 2
jne 0x14002a970
mov rax, qword [0x1401591a0]
cmp qword [0x140159198], rax
je 0x14002a970
mov rdi, qword [0x140158e90]
add rdi, rcx
lea rdx, [0x140159150]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov rdx, rax
mov rcx, rdi
call fcn.14001e330
mov r13, rax
lea rcx, [rbp - 0x80]
lea rax, [rbp + 0x1c0]
mov edx, 4
nop dword [rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x14002a380
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov r9, qword [0x1401591a0]
sub r9, qword [0x140159198]
sar r9, 2
mov dword [rsp + 0x28], 4
mov eax, dword [0x140158dcc]
mov dword [rsp + 0x20], eax
mov r8, qword [0x140158e00]
lea rdx, [rbp - 0x80]
mov rcx, qword [0x140158dc0]
call fcn.140011c30
mov rsi, rax
lea rdx, [0x140159198]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov rdx, rax
mov rcx, rsi
call fcn.140013710
mov rcx, rdi
sub rcx, rsi
mov rbx, r12
sub rbx, rcx
sub rax, r13
sub r12, rax
lea rax, [rsi + 0x1000]
mov qword [0x140158e18], rax
add rax, 4
mov qword [0x140158e20], rax
mov qword [0x140158e08], rdi
mov qword [0x140158e10], rsi
lea rdx, [0x140159180]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r9, rax
mov r8, rdi
mov rdx, qword [0x140158dc0]
lea rcx, [rsp + 0x60]
call fcn.14000f6e0
mov rdx, rax
lea rcx, [0x140159180]
call fcn.14000ea10
lea rcx, [rsp + 0x60]
call fcn.14000e700
lea rdx, [0x140159150]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14000fe00
mov rdx, rax
lea rcx, [0x140159150]
call fcn.14000ea10
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14002a53f
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a53a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a53a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e9774
lea rdx, [0x140159198]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
mov rdx, r12
lea rcx, [rsp + 0x30]
call fcn.14000fe00
mov rdx, rax
lea rcx, [0x140159198]
call fcn.14000ea10
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14002a5ba
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a5b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a5b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e9774
lea rcx, [rbp - 0x80]
lea rax, [rbp + 0x1c0]
mov edx, 4
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x14002a5d0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rcx + 0x30], rax
mov qword [rsp + 0x20], 1
lea r9d, [rdx + 5]
mov r8, qword [0x140158e00]
lea rdx, [rbp - 0x80]
mov rcx, qword [0x140158dc0]
call fcn.14000f810
mov rbx, rax
lea rdx, [0x140159198]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
mov word [rbp + 0x408], bx
xor r12d, r12d
mov ecx, r12d
mov r9, qword [rax]
mov rdx, qword [rax + 8]
sub rdx, r9
sar rdx, 2
test rdx, rdx
je 0x14002a6bc
nop dword [rax + rax]
cmp dword [r9 + rcx*4], 0xfffffffe
je 0x14002a6b1
inc rcx
cmp rcx, rdx
jb 0x14002a6a0
jmp 0x14002a6bc
movzx eax, byte [rbp + 0x408]
mov dword [r9 + rcx*4], eax
mov rdx, qword [r8 + 0x10]
mov qword [r8 + 0x10], r12
mov rcx, qword [r8 + 8]
mov qword [r8 + 8], r12
mov rax, qword [r8]
mov qword [r8], r12
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x30]
lea rcx, [0x140159198]
call fcn.14000ea10
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14002a73d
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a738
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a738
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e9774
lea rdx, [0x140159198]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
lea rcx, [rbx + 4]
mov word [rbp + 0x408], cx
mov rcx, r12
mov r9, qword [rax]
mov rdx, qword [rax + 8]
sub rdx, r9
sar rdx, 2
test rdx, rdx
je 0x14002a78e
cmp dword [r9 + rcx*4], 0xfffffffe
je 0x14002a783
inc rcx
cmp rcx, rdx
jb 0x14002a772
jmp 0x14002a78e
movzx eax, byte [rbp + 0x408]
mov dword [r9 + rcx*4], eax
mov rdx, qword [r8 + 0x10]
mov qword [r8 + 0x10], r12
mov rcx, qword [r8 + 8]
mov qword [r8 + 8], r12
mov rax, qword [r8]
mov qword [r8], r12
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x30]
lea rcx, [0x140159198]
call fcn.14000ea10
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14002a80f
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a80a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a80a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e9774
lea rdx, [0x140159198]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
lea rcx, [rbx + 8]
mov word [rbp + 0x408], cx
mov rcx, r12
mov r9, qword [rax]
mov rdx, qword [rax + 8]
sub rdx, r9
sar rdx, 2
test rdx, rdx
je 0x14002a860
cmp dword [r9 + rcx*4], 0xfffffffe
je 0x14002a855
inc rcx
cmp rcx, rdx
jb 0x14002a844
jmp 0x14002a860
movzx eax, byte [rbp + 0x408]
mov dword [r9 + rcx*4], eax
mov rdx, qword [r8 + 0x10]
mov qword [r8 + 0x10], r12
mov rcx, qword [r8 + 8]
mov qword [r8 + 8], r12
mov rax, qword [r8]
mov qword [r8], r12
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x30]
lea rcx, [0x140159198]
call fcn.14000ea10
lea rcx, [rsp + 0x30]
call fcn.14000e700
mov dword [rbp + 0x410], 0x3f800000
mov dword [rbp + 0x400], 0x3f800000
cmp byte [0x140158d50], r12b
jne 0x14002a8dd
movss xmm0, dword [0x14015804c]
movss dword [rbp + 0x410], xmm0
movss xmm1, dword [0x14015805c]
movss dword [rbp + 0x400], xmm1
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x410]
mov rdx, qword [0x140158e18]
mov rcx, qword [0x140158dc0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rbp + 0x400]
mov rdx, qword [0x140158e20]
mov rcx, qword [0x140158dc0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [0x140159198]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
mov rdx, rsi
mov rcx, qword [0x140158dc0]
call fcn.140036570
lea rdx, [0x140159150]
lea rcx, [rsp + 0x48]
call fcn.14000d750
mov r8, rax
mov rdx, rdi
mov rcx, qword [0x140158dc0]
call fcn.140036570
nop
test r15, r15
je 0x14002a9ab
sub r14, r15
mov rax, r15
cmp r14, 0x1000
jb 0x14002a9a0
add r14, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002a9a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r14
mov rcx, r15
call fcn.1400e9774
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.1400ea080
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140011860
nop
call fcn.140011860
nop
call fcn.140011b80
int3
call fcn.140011860
nop
call fcn.140011b80
int3
call fcn.140011860
nop
call fcn.140011b80
int3
call fcn.140011860
nop
call fcn.140011b80
int3
call fcn.140011860
nop
call fcn.140011b80
int3