Function at 0x140001270
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate processes
Hash data using fnv
Resolve function by parsing pe exports
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x310]
sub rsp, 0x410
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0x300], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 0x4090
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.WarRock
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002900
lea rdx, [0x140002ad0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movabs rax, 0x2914ca784a02a381
mov qword [rbp - 0x20], rax
movabs rax, 0xfa40a78c0634b550
mov qword [rbp - 0x18], rax
movabs r15, 0x773a4112e63cccd
mov qword [rbp + 0x170], r15
movabs r13, 0xfa40a78c06149b7e
mov qword [rbp + 0x178], r13
movdqa xmm0, xmmword [rbp - 0x20]
xorps xmm0, xmmword [rbp + 0x170]
movdqa xmmword [rbp - 0x20], xmm0
lea rdx, [rbp - 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002900
lea rdx, [0x140002ad0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [0x1400087d0]
test rax, rax
jne 0x140001431
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x140001409
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x140001409
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x44c51394
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140001404
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x1400013d0
cmp r10d, 0xabb85ab7
je 0x140001411
test r11d, r11d
jne 0x1400013b0
mov rax, qword [rax]
jmp 0x140001380
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov eax, dword [rcx + rax*4]
add rax, rbx
mov qword [0x1400087d0], rax
mov ecx, 0x7d0
call rax
movabs rax, 0x2707cd7e4213b488
mov qword [rsp + 0x30], rax
movabs rax, 0xd427c9e56275f432
mov qword [rsp + 0x38], rax
movabs rax, 0x6f50400fb4d79879
mov qword [rsp + 0x40], rax
movabs r12, 0x4bb90f2a58d17090
mov qword [rsp + 0x48], r12
mov qword [rbp + 0x2e0], r15
mov qword [rbp + 0x2e8], r13
movabs rax, 0x6f50400fb4d7b657
mov qword [rbp + 0x2f0], rax
mov qword [rbp + 0x2f8], r12
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp + 0x2e0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rbp + 0x2f0]
movdqa xmmword [rsp + 0x40], xmm1
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002900
lea rdx, [0x140002ad0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [0x1400087f0]
test rax, rax
jne 0x1400015c1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x140001599
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x140001599
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rbx + r11*4]
mov r9d, dword [rcx + rsi]
add r9, rbx
mov r10d, 0x3fd4163f
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140001594
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140001560
cmp r10d, 0xdb156f82
je 0x1400015a1
test r11d, r11d
jne 0x140001540
mov rax, qword [rax]
jmp 0x140001510
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov eax, dword [rcx + rax*4]
add rax, rbx
mov qword [0x1400087f0], rax
mov ecx, 0x7d0
call rax
mov rax, qword [0x1400087c8]
test rax, rax
jne 0x1400016a1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x140001679
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x140001679
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x3ad1cfc9
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140001674
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140001640
cmp r10d, 0x40e6f628
je 0x140001681
test r11d, r11d
jne 0x140001620
mov rax, qword [rax]
jmp 0x1400015f0
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov eax, dword [rcx + rax*4]
add rax, rbx
mov qword [0x1400087c8], rax
movabs r15, 0x773a4112e10a0ae
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r13
movabs rdi, 0x773a4112e63cccd
mov qword [rbp + 0x2b0], rdi
mov qword [rbp + 0x2b8], r13
movdqa xmm0, xmmword [rbp - 0x40]
xorps xmm0, xmmword [rbp + 0x2b0]
movdqa xmmword [rbp - 0x40], xmm0
lea rcx, [rbp - 0x40]
call rax
lea rdx, str.Exploit_Loading...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002900
lea rdx, [0x140002ad0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [0x1400087e8]
test rax, rax
jne 0x1400017e1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x1400017b9
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x1400017b9
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x69bab5ef
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x1400017b4
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140001780
cmp r10d, 0x38a6e9d2
je 0x1400017c1
test r11d, r11d
jne 0x140001760
mov rax, qword [rax]
jmp 0x140001730
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov eax, dword [rcx + rax*4]
add rax, rbx
mov qword [0x1400087e8], rax
mov ecx, 0x7d0
call rax
mov rax, qword [0x1400087e0]
test rax, rax
jne 0x1400018c1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x140001899
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x140001899
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x5e89f89b
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140001894
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140001860
cmp r10d, 0x17011c02
je 0x1400018a1
test r11d, r11d
jne 0x140001840
mov rax, qword [rax]
jmp 0x140001810
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov eax, dword [rcx + rax*4]
add rax, rbx
mov qword [0x1400087e0], rax
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r13
mov qword [rbp + 0x2c0], rdi
mov qword [rbp + 0x2c8], r13
movdqa xmm0, xmmword [rbp - 0x30]
xorps xmm0, xmmword [rbp + 0x2c0]
movdqa xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call rax
movabs rax, 0x727a4422e3acc9e
mov qword [rsp + 0x50], rax
movabs rax, 0xfa03a7d006599b3b
mov qword [rsp + 0x58], rax
movabs rax, 0x6f22407bb4b9b638
mov qword [rsp + 0x60], rax
movabs rax, 0x4bdc0f7958bd70ff
mov qword [rsp + 0x68], rax
movabs rax, 0x1ebf32552dbf6185
mov qword [rsp + 0x70], rax
movabs rax, 0x940c9415a4b61bee
mov qword [rsp + 0x78], rax
movabs rax, 0x5030de9036a2346d
mov qword [rbp - 0x80], rax
movabs rax, 0x83e65a690f5ae357
mov qword [rbp - 0x78], rax
movabs rax, 0x6b508b36dce56c7b
mov qword [rbp - 0x70], rax
movabs rax, 0x17446808607d172d
mov qword [rbp - 0x68], rax
movabs rax, 0xfe49b3f6d4c14a9e
mov qword [rbp - 0x60], rax
movabs rax, 0xd30694b76f438f3d
mov qword [rbp - 0x58], rax
movabs rax, 0x6318de0d6fd4886a
mov qword [rbp - 0x50], rax
movabs r8, 0xd4781a58e885755a
mov qword [rbp - 0x48], r8
mov qword [rbp + 0x240], rdi
mov qword [rbp + 0x248], r13
movabs rsi, 0x6f50400fb4d7b657
mov qword [rbp + 0x250], rsi
mov qword [rbp + 0x258], r12
movabs r9, 0x1e8e32652d8f61f1
mov qword [rbp + 0x260], r9
movabs r10, 0x947e9470a4e51bb2
mov qword [rbp + 0x268], r10
movabs rcx, 0x5055def336cb341b
mov qword [rbp + 0x270], rcx
movabs rdx, 0x838f5a3e0f06e324
mov qword [rbp + 0x278], rdx
movabs rax, 0x6b338b59dcb66c15
mov qword [rbp + 0x280], rax
movabs rax, 0x17146854604f1746
mov qword [rbp + 0x288], rax
movabs rax, 0xfe24b397d4b34aff
mov qword [rbp + 0x290], rax
movabs rax, 0xd37494d26f378f58
mov qword [rbp + 0x298], rax
movabs rax, 0x6318de0d6fd48819
mov qword [rbp + 0x2a0], rax
mov qword [rbp + 0x2a8], r8
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rbp + 0x250]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x260]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [rbp - 0x80]
xorps xmm1, xmmword [rbp + 0x270]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [rbp - 0x70]
xorps xmm0, xmmword [rbp + 0x280]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [rbp - 0x60]
xorps xmm1, xmmword [rbp + 0x290]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [rbp - 0x50]
xorps xmm0, xmmword [rbp + 0x2a0]
movdqa xmmword [rbp - 0x50], xmm0
movabs rax, 0x71ca4652e16cc8c
mov qword [rsp + 0x30], rax
movabs rax, 0xfa2ca7ed067d9b1a
mov qword [rsp + 0x38], rax
movabs rax, 0x6f504043b49bb613
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r12
mov qword [rbp + 0x180], rdi
mov qword [rbp + 0x188], r13
mov qword [rbp + 0x190], rsi
mov qword [rbp + 0x198], r12
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp + 0x180]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rbp + 0x190]
movdqa xmmword [rsp + 0x40], xmm1
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
movdqa xmm1, xmmword [0x140005580]
movdqu xmmword [rbp + 0x28], xmm1
xor r15d, r15d
mov word [rbp + 0x18], r15w
movabs rax, 0x716a4652e0dcc88
mov qword [rbp + 0x180], rax
movabs rax, 0xfa28a7f806349b0c
mov qword [rbp + 0x188], rax
movabs rax, 0x6f354061b4f7b632
mov qword [rbp + 0x190], rax
movabs rax, 0x4bf50f6e58f170e7
mov qword [rbp + 0x198], rax
movabs rax, 0x1eef32152daf61bd
mov qword [rbp + 0x1a0], rax
movabs rax, 0x945e944aa48d1bc6
mov qword [rbp + 0x1a8], rax
mov qword [rbp + 0x1b0], rcx
mov qword [rbp + 0x1b8], rdx
mov qword [rbp + 0x1d0], rdi
mov qword [rbp + 0x1d8], r13
mov qword [rbp + 0x1e0], rsi
mov qword [rbp + 0x1e8], r12
mov qword [rbp + 0x1f0], r9
mov qword [rbp + 0x1f8], r10
mov qword [rbp + 0x200], rcx
mov qword [rbp + 0x208], rdx
movdqa xmm0, xmmword [rbp + 0x180]
xorps xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x180], xmm0
movdqa xmm1, xmmword [rbp + 0x190]
xorps xmm1, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x190], xmm1
movdqa xmm0, xmmword [rbp + 0x1a0]
xorps xmm0, xmmword [rbp + 0x1f0]
movdqa xmmword [rbp + 0x1a0], xmm0
movdqa xmm1, xmmword [rbp + 0x1b0]
xorps xmm1, xmmword [rbp + 0x200]
movdqa xmmword [rbp + 0x1b0], xmm1
lea rdx, [rbp + 0x180]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140002b10
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t___std::wcin]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
movzx r8d, ax
lea rdx, [rbp + 0x18]
mov rcx, rbx
call fcn.140002ee0
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 2]
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [rbp + 0x28]
lea eax, [rax*2 + 2]
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 7
cmova rcx, qword [rbp + 0x18]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
lea r9d, [r15 + 1]
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movabs rax, 0x7535c1614f00bf88
mov qword [rsp + 0x30], rax
movabs rax, 0xda36c8fe6740f611
mov qword [rsp + 0x38], rax
movabs rax, 0x41372e66c0bed700
mov qword [rsp + 0x40], rax
movabs rax, 0x4bb90f2a58d15ebe
mov qword [rsp + 0x48], rax
mov qword [rbp + 0x220], rdi
mov qword [rbp + 0x228], r13
mov qword [rbp + 0x230], rsi
mov qword [rbp + 0x238], r12
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp + 0x220]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rbp + 0x230]
movdqa xmmword [rsp + 0x40], xmm1
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002900
lea rdx, [0x140002ad0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [0x1400087f8]
test rax, rax
jne 0x140001eb1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x140001e89
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x140001e89
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0x7e95a9f1
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140001e84
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140001e50
cmp r10d, 0x63c78d14
je 0x140001e91
test r11d, r11d
jne 0x140001e30
mov rax, qword [rax]
jmp 0x140001e00
mov edx, dword [r14 + 0x1c]
add rdx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov eax, dword [rdx + rax*4]
add rax, rbx
mov qword [0x1400087f8], rax
mov ecx, 0x7d0
call rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400027ff
lea r13, str.WarRock.exe
movabs rdi, 0xfa40a7ad6275f432
movabs rsi, 0x724a44d2e59cc8e
nop dword [rax + rax]
mov dword [rbp + 0x40], 0x130
lea rdx, [rbp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400027d3
nop dword [rax]
lea rcx, [rbp + 0x6c]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140001f20
lea r14, [rbp + 0x6c]
add r14, rax
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
lea rcx, [rbp + 0x6c]
mov qword [rbp + 8], r15
mov ebx, 7
mov qword [rbp + 0x10], rbx
cmp rcx, r14
jne 0x140001f57
mov word [rbp - 8], r15w
jmp 0x140002068
lea rdi, [rbp + 0x6c]
mov rsi, r15
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x14000287e
cmp rax, rbx
jbe 0x140002010
mov rbx, rax
or rbx, 7
cmp rbx, rcx
jbe 0x140001f99
mov rbx, rcx
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x140001fc9
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140002884
add rcx, rcx
cmp rcx, 0x1000
jb 0x140001ff8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002884
mov rcx, rax
call fcn.1400035c0
mov rcx, rax
test rax, rax
je 0x14000283d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002007
test rcx, rcx
je 0x140002004
call fcn.1400035c0
jmp 0x140002007
mov rax, r15
mov qword [rbp - 8], rax
mov qword [rbp + 0x10], rbx
nop
lea rcx, [rbp - 8]
cmp rbx, 7
cmova rcx, qword [rbp - 8]
movsx eax, byte [rdi]
mov word [rcx + rsi*2], ax
mov rsi, qword [rbp + 8]
inc rsi
mov qword [rbp + 8], rsi
inc rdi
cmp rdi, r14
je 0x14000203d
mov rbx, qword [rbp + 0x10]
jmp 0x140002010
lea rax, [rbp - 8]
cmp qword [rbp + 0x10], 7
cmova rax, qword [rbp - 8]
mov word [rax + rsi*2], r15w
mov rbx, qword [rbp + 0x10]
movabs rdi, 0xfa40a7ad6275f432
movabs rsi, 0x724a44d2e59cc8e
lea rdx, [rbp - 8]
cmp rbx, 7
seta r15b
cmova rdx, qword [rbp - 8]
xor ecx, ecx
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [r13 + rcx*2]
jne 0x140002769
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r13 + rcx*2 + 2]
jne 0x140002769
add rcx, 2
cmp rcx, 0xc
jne 0x140002080
movabs rax, 0x2707cd7e4213b488
mov qword [rbp + 0x170], rax
mov qword [rbp + 0x178], rdi
movabs r14, 0x773a4112e63cccd
mov qword [rbp + 0x2d0], r14
movabs rdi, 0xfa40a78c06149b7e
mov qword [rbp + 0x2d8], rdi
movdqa xmm0, xmmword [rbp + 0x170]
xorps xmm0, xmmword [rbp + 0x2d0]
movdqa xmmword [rbp + 0x170], xmm0
lea rdx, [rbp + 0x170]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002900
lea rdx, [0x140002ad0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rax, 0x727a4422e3acc9e
mov qword [rsp + 0x50], rax
movabs rax, 0xfa03a7d006599b3b
mov qword [rsp + 0x58], rax
movabs rax, 0x6f22407bb4b9b638
mov qword [rsp + 0x60], rax
movabs rax, 0x4bdc0f7958bd70ff
mov qword [rsp + 0x68], rax
movabs rax, 0x1ebf32552dbf6185
mov qword [rsp + 0x70], rax
movabs rax, 0x940c9415a4b61bee
mov qword [rsp + 0x78], rax
movabs rax, 0x5030de9036a2346d
mov qword [rbp - 0x80], rax
movabs rax, 0x83e65a690f5ae357
mov qword [rbp - 0x78], rax
movabs rax, 0x6b508b36dce56c7b
mov qword [rbp - 0x70], rax
movabs rax, 0x17446808607d172d
mov qword [rbp - 0x68], rax
movabs rax, 0xfe49b3f6d4c14a9e
mov qword [rbp - 0x60], rax
movabs rax, 0xd30694b76f438f3d
mov qword [rbp - 0x58], rax
movabs rax, 0x6318de0d6fd4886a
mov qword [rbp - 0x50], rax
movabs rax, 0xd4781a58e885755a
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x240], r14
mov qword [rbp + 0x248], rdi
movabs rcx, 0x6f50400fb4d7b657
mov qword [rbp + 0x250], rcx
movabs r14, 0x4bb90f2a58d17090
mov qword [rbp + 0x258], r14
movabs r10, 0x1e8e32652d8f61f1
mov qword [rbp + 0x260], r10
movabs r11, 0x947e9470a4e51bb2
mov qword [rbp + 0x268], r11
movabs r8, 0x5055def336cb341b
mov qword [rbp + 0x270], r8
movabs r9, 0x838f5a3e0f06e324
mov qword [rbp + 0x278], r9
movabs rcx, 0x6b338b59dcb66c15
mov qword [rbp + 0x280], rcx
movabs rdx, 0x17146854604f1746
mov qword [rbp + 0x288], rdx
movabs rdi, 0xfe24b397d4b34aff
mov qword [rbp + 0x290], rdi
movabs rdi, 0xd37494d26f378f58
mov qword [rbp + 0x298], rdi
movabs rdi, 0x6318de0d6fd48819
mov qword [rbp + 0x2a0], rdi
mov qword [rbp + 0x2a8], rax
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm1, xmmword [rbp + 0x250]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x260]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [rbp - 0x80]
xorps xmm1, xmmword [rbp + 0x270]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [rbp - 0x70]
xorps xmm0, xmmword [rbp + 0x280]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [rbp - 0x60]
xorps xmm1, xmmword [rbp + 0x290]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [rbp - 0x50]
xorps xmm0, xmmword [rbp + 0x2a0]
movdqa xmmword [rbp - 0x50], xmm0
movabs rax, 0x71ca4652e16cc8c
mov qword [rsp + 0x30], rax
movabs rax, 0xfa2ca7ed067d9b1a
mov qword [rsp + 0x38], rax
movabs rax, 0x6f504043b49bb613
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r14
movabs rdi, 0x773a4112e63cccd
mov qword [rbp + 0x220], rdi
movabs rdi, 0xfa40a78c06149b7e
mov qword [rbp + 0x228], rdi
movabs rax, 0x6f50400fb4d7b657
mov qword [rbp + 0x230], rax
mov qword [rbp + 0x238], r14
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rbp + 0x220]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [rsp + 0x40]
xorps xmm1, xmmword [rbp + 0x230]
movdqa xmmword [rsp + 0x40], xmm1
mov qword [rbp + 0x1d0], rsi
movabs rax, 0xfa2fa7e8067a9b17
mov qword [rbp + 0x1d8], rax
movabs rax, 0x6f034053b4a4b620
mov qword [rbp + 0x1e0], rax
movabs rax, 0x4bdc0f5e58a270e9
mov qword [rbp + 0x1e8], rax
movabs rax, 0x1ed232572dbc619c
mov qword [rbp + 0x1f0], rax
movabs rax, 0x941f9403a4841bc0
mov qword [rbp + 0x1f8], rax
movabs rax, 0x5025de9f36a3347f
mov qword [rbp + 0x200], rax
movabs rax, 0x83e35a520f62e30a
mov qword [rbp + 0x208], rax
mov qword [rbp + 0x210], rcx
mov qword [rbp + 0x218], rdx
movabs rax, 0x773a4112e63cccd
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x188], rdi
movabs rax, 0x6f50400fb4d7b657
mov qword [rbp + 0x190], rax
mov qword [rbp + 0x198], r14
mov qword [rbp + 0x1a0], r10
mov qword [rbp + 0x1a8], r11
mov qword [rbp + 0x1b0], r8
mov qword [rbp + 0x1b8], r9
mov qword [rbp + 0x1c0], rcx
mov qword [rbp + 0x1c8], rdx
movdqa xmm0, xmmword [rbp + 0x1d0]
xorps xmm0, xmmword [rbp + 0x180]
movdqa xmmword [rbp + 0x1d0], xmm0
movdqa xmm1, xmmword [rbp + 0x1e0]
xorps xmm1, xmmword [rbp + 0x190]
movdqa xmmword [rbp + 0x1e0], xmm1
movdqa xmm0, xmmword [rbp + 0x1f0]
xorps xmm0, xmmword [rbp + 0x1a0]
movdqa xmmword [rbp + 0x1f0], xmm0
movdqa xmm1, xmmword [rbp + 0x200]
xorps xmm1, xmmword [rbp + 0x1b0]
movdqa xmmword [rbp + 0x200], xmm1
movdqa xmm0, xmmword [rbp + 0x210]
xorps xmm0, xmmword [rbp + 0x1c0]
movdqa xmmword [rbp + 0x210], xmm0
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rcx, [rbp + 0x1d0]
mov rax, 0xffffffffffffffff
nop
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140002560
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [0x1400087d8]
test rax, rax
jne 0x140002685
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x140002659
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x140002659
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xd1b0ff63
movzx r8d, byte [r9]
inc r9
test r8b, r8b
je 0x140002654
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r8d, byte [r9]
lea r9, [r9 + 1]
test r8b, r8b
jne 0x140002620
cmp r10d, 0x466e266
je 0x140002661
test r11d, r11d
jne 0x140002600
mov rax, qword [rax]
jmp 0x1400025d0
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov eax, dword [rcx + rax*4]
add rax, rbx
mov qword [0x1400087d8], rax
mov rbx, qword [rbp + 0x10]
mov ecx, 0x3e8
call rax
mov rax, qword [0x140008800]
test rax, rax
jne 0x140002764
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov r14d, dword [rcx + rbx + 0x88]
add r14, rbx
cmp r14, rbx
je 0x140002738
mov r11d, dword [r14 + 0x18]
test r11d, r11d
je 0x140002738
mov esi, dword [r14 + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [rsi + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
mov r10d, 0xabdf94a0
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x140002733
nop
movsx edx, cl
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx ecx, byte [r9]
lea r9, [r9 + 1]
test cl, cl
jne 0x140002700
cmp r10d, 0x3894b470
je 0x140002740
test r11d, r11d
jne 0x1400026e0
mov rax, qword [rax]
jmp 0x1400026b0
mov ecx, dword [r14 + 0x1c]
add rcx, rbx
mov eax, dword [r14 + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov eax, dword [rcx + rax*4]
add rax, rbx
mov qword [0x140008800], rax
mov rbx, qword [rbp + 0x10]
xor ecx, ecx
call rax
nop
test r15b, r15b
je 0x1400027a4
lea rdx, [rbx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000279f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000283d
call fcn.140003410
lea rdx, [rbp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
movabs rdi, 0xfa40a7ad6275f432
movabs rsi, 0x724a44d2e59cc8e
mov r15d, 0
jne 0x140001f10
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x140001ef0
mov rdx, qword [rbp + 0x30]
cmp rdx, 7
jbe 0x140002849
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002844
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002844
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140003410
mov eax, 1
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.1400031b0
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011e0
nop
call fcn.140001140
int3