Function at 0x140056ea0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x1400e1700]
xor rax, rsp
mov qword [rbp + 0xf0], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xor r13d, r13d
mov qword [rbp], r13
mov qword [rbp + 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x10], r13b
movdqa xmm1, xmmword [0x1400d0cb0]
movdqu xmmword [rbp - 0x38], xmm1
mov dl, 0x30
mov r8b, reloc.WS2_32.dll_socket
mov r9b, 6
mov r10b, 2
mov r11b, recv
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x37], al
xor byte [rbp - 0x36], cl
xor byte [rbp - 0x35], cl
xor byte [rbp - 0x34], cl
xor byte [rbp - 0x33], cl
xor byte [rbp - 0x32], cl
xor byte [rbp - 0x31], cl
xor byte [rbp - 0x30], cl
xor byte [rbp - 0x2f], cl
xor byte [rbp - 0x2e], cl
xor byte [rbp - 0x2d], cl
xor byte [rbp - 0x2c], cl
xor byte [rbp - 0x2b], cl
xor byte [rbp - 0x2a], cl
xor byte [rbp - 0x29], cl
xor dl, cl
mov byte [rbp - 0x28], dl
xor r8b, cl
mov byte [rbp - 0x27], r8b
xor r9b, cl
mov byte [rbp - 0x26], r9b
xor r10b, cl
mov byte [rbp - 0x25], r10b
xor r11b, cl
mov byte [rbp - 0x24], r11b
mov byte [rbp - 0x23], r13b
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp - 0x37]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, r13d
cmp eax, 2
je 0x140056fa2
test eax, eax
sete bl
movdqa xmm1, xmmword [0x1400d10b0]
movdqu xmmword [rsp + 0x58], xmm1
movdqa xmm2, xmmword [0x1400d0820]
movdqu xmmword [rsp + 0x68], xmm2
mov r8b, 3
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rsp + 0x59], al
xor byte [rsp + 0x5a], dl
xor byte [rsp + 0x5b], dl
xor byte [rsp + 0x5c], dl
xor byte [rsp + 0x5d], dl
xor byte [rsp + 0x5e], dl
xor byte [rsp + 0x5f], dl
xor byte [rsp + 0x60], dl
xor byte [rsp + 0x61], dl
xor byte [rsp + 0x62], dl
xor byte [rsp + 0x63], dl
xor byte [rsp + 0x64], dl
xor byte [rsp + 0x65], dl
xor byte [rsp + 0x66], dl
xor byte [rsp + 0x67], dl
movd eax, xmm2
xor al, dl
mov byte [rsp + 0x68], al
xor byte [rsp + 0x69], dl
xor byte [rsp + 0x6a], dl
xor byte [rsp + 0x6b], dl
xor byte [rsp + 0x6c], dl
xor byte [rsp + 0x6d], dl
xor byte [rsp + 0x6e], dl
xor byte [rsp + 0x6f], dl
xor byte [rsp + 0x70], dl
xor byte [rsp + 0x71], dl
xor byte [rsp + 0x72], dl
xor byte [rsp + 0x73], dl
xor byte [rsp + 0x74], dl
xor byte [rsp + 0x75], dl
xor byte [rsp + 0x76], dl
xor byte [rsp + 0x77], dl
xor r8b, dl
mov byte [rsp + 0x78], r8b
mov byte [rsp + 0x79], 0
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0x59]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, eax
cmp eax, 2
mov eax, r13d
je 0x140057096
test ecx, ecx
sete al
test ebx, ebx
je 0x140057270
movdqa xmm1, xmmword [0x1400d1260]
movdqu xmmword [rbp - 0x38], xmm1
mov dl, 0x7f
mov r8b, 0x58
mov r9b, 0x49
mov r10b, Ordinal_79
mov r11b, 0x41
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x37], al
xor byte [rbp - 0x36], cl
xor byte [rbp - 0x35], cl
xor byte [rbp - 0x34], cl
xor byte [rbp - 0x33], cl
xor byte [rbp - 0x32], cl
xor byte [rbp - 0x31], cl
xor byte [rbp - 0x30], cl
xor byte [rbp - 0x2f], cl
xor byte [rbp - 0x2e], cl
xor byte [rbp - 0x2d], cl
xor byte [rbp - 0x2c], cl
xor byte [rbp - 0x2b], cl
xor byte [rbp - 0x2a], cl
xor byte [rbp - 0x29], cl
xor dl, cl
mov byte [rbp - 0x28], dl
xor r8b, cl
mov byte [rbp - 0x27], r8b
xor r9b, cl
mov byte [rbp - 0x26], r9b
xor r10b, cl
mov byte [rbp - 0x25], r10b
xor r11b, cl
mov byte [rbp - 0x24], r11b
mov byte [rbp - 0x23], 0
lea r8, [rbp - 0x37]
call fcn.14005ac90
mov r12, rax
mov byte [rbp - 0x80], 0x5f
mov cl, reloc.WLDAP32.dll_Ordinal_22
mov dl, Ordinal_50
mov r8b, Ordinal_45
mov r9b, Ordinal_45
mov r10b, 0x3e
mov r11b, 0x33
movzx ebx, r11b
mov dil, reloc.WS2_32.dll_ntohs
movzx esi, r10b
movzx r14d, r9b
mov r15b, gethostname
xor eax, eax
xor cl, 0x5f
mov byte [rbp - 0x7f], cl
xor dl, 0x5f
mov byte [rbp - 0x7e], dl
xor r8b, 0x5f
mov byte [rbp - 0x7d], r8b
xor r9b, 0x5f
mov byte [rbp - 0x7c], r9b
xor r10b, 0x5f
mov byte [rbp - 0x7b], r10b
xor r11b, 0x5f
mov byte [rbp - 0x7a], r11b
xor bl, 0x5f
mov byte [rbp - 0x79], bl
xor dil, 0x5f
mov byte [rbp - 0x78], dil
xor sil, 0x5f
mov byte [rbp - 0x77], sil
xor r14b, 0x5f
mov byte [rbp - 0x76], r14b
xor r15b, 0x5f
mov byte [rbp - 0x75], r15b
mov byte [rbp - 0x74], al
lea r9, [rbp - 0x7f]
mov r8, r12
lea rdx, [rsp + 0x58]
call fcn.14005af50
mov rbx, rax
lea rax, [rbp - 0x10]
cmp rax, rbx
je 0x140057229
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x1400571fb
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400571f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057269
call fcn.1400b8b1c
mov qword [rbp], r13
mov qword [rbp + 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x10], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14005745e
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057459
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140057459
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test eax, eax
je 0x140057a5e
movdqa xmm1, xmmword [0x1400d12c0]
movdqu xmmword [rbp - 0x38], xmm1
movdqa xmm2, xmmword [0x1400d09c0]
movdqu xmmword [rbp - 0x28], xmm2
mov dl, reloc.WLDAP32.dll_Ordinal_45
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x37], al
xor byte [rbp - 0x36], cl
xor byte [rbp - 0x35], cl
xor byte [rbp - 0x34], cl
xor byte [rbp - 0x33], cl
xor byte [rbp - 0x32], cl
xor byte [rbp - 0x31], cl
xor byte [rbp - 0x30], cl
xor byte [rbp - 0x2f], cl
xor byte [rbp - 0x2e], cl
xor byte [rbp - 0x2d], cl
xor byte [rbp - 0x2c], cl
xor byte [rbp - 0x2b], cl
xor byte [rbp - 0x2a], cl
xor byte [rbp - 0x29], cl
movd eax, xmm2
xor al, cl
mov byte [rbp - 0x28], al
xor byte [rbp - 0x27], cl
xor byte [rbp - 0x26], cl
xor byte [rbp - 0x25], cl
xor byte [rbp - 0x24], cl
xor byte [rbp - 0x23], cl
xor byte [rbp - 0x22], cl
xor byte [rbp - 0x21], cl
xor byte [rbp - 0x20], cl
xor byte [rbp - 0x1f], cl
xor byte [rbp - 0x1e], cl
xor byte [rbp - 0x1d], cl
xor byte [rbp - 0x1c], cl
xor byte [rbp - 0x1b], cl
xor byte [rbp - 0x1a], cl
xor byte [rbp - 0x19], cl
xor dl, cl
mov byte [rbp - 0x18], dl
mov byte [rbp - 0x17], 0
lea r8, [rbp - 0x37]
call fcn.14005ac90
mov r12, rax
mov byte [rbp - 0x80], Ordinal_41
mov cl, reloc.WS2_32.dll_WSAGetLastError
mov dl, 0x48
mov r8b, 0x55
mov r9b, 0x52
mov r10b, 0x47
mov r11b, 0x4a
movzx ebx, r11b
mov dil, 0x76
movzx esi, r10b
movzx r14d, r9b
mov r15b, Ordinal_79
xor eax, eax
xor cl, 0x26
mov byte [rbp - 0x7f], cl
xor dl, 0x26
mov byte [rbp - 0x7e], dl
xor r8b, 0x26
mov byte [rbp - 0x7d], r8b
xor r9b, 0x26
mov byte [rbp - 0x7c], r9b
xor r10b, 0x26
mov byte [rbp - 0x7b], r10b
xor r11b, 0x26
mov byte [rbp - 0x7a], r11b
xor bl, 0x26
mov byte [rbp - 0x79], bl
xor dil, 0x26
mov byte [rbp - 0x78], dil
xor sil, 0x26
mov byte [rbp - 0x77], sil
xor r14b, 0x26
mov byte [rbp - 0x76], r14b
xor r15b, 0x26
mov byte [rbp - 0x75], r15b
mov byte [rbp - 0x74], al
lea r9, [rbp - 0x7f]
mov r8, r12
lea rdx, [rsp + 0x58]
call fcn.14005af50
mov rbx, rax
lea rax, [rbp - 0x10]
cmp rax, rbx
je 0x14005741e
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x1400573f0
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400573eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057452
call fcn.1400b8b1c
mov qword [rbp], r13
mov qword [rbp + 8], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x10], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14005745e
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057459
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140057459
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b8b1c
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0x10], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
mov dword [rbp + 0x80], WSASetLastError
xorps xmm1, xmm1
movups xmmword [rbp + 0x88], xmm1
movups xmmword [rbp + 0x98], xmm1
movups xmmword [rbp + 0xa8], xmm1
movups xmmword [rbp + 0xb8], xmm1
movups xmmword [rbp + 0xc8], xmm1
movups xmmword [rbp + 0xd8], xmm1
mov r8d, 0xa
lea rdx, str._steam.exe
lea rcx, [rbp - 0x10]
call fcn.140006b50
mov rcx, qword [0x1401d51c8]
call fcn.14005c320
mov rdi, qword [0x1401d5178]
add rdi, 0x298
mov byte [rsp + 0x50], 0xa
mov al, 0x3d
xor ecx, ecx
xor al, 0xa
mov byte [rsp + 0x51], al
mov byte [rsp + 0x52], cl
lea rcx, [rsp + 0x51]
mov rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x140057512
mov r14, qword [rdi + 0x10]
mov rcx, rdi
mov rsi, qword [rdi + 0x18]
cmp rsi, 0x10
jb 0x14005752f
mov rcx, qword [rdi]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x51]
mov rdx, r14
call fcn.140006f60
cmp rax, rbx
jne 0x140057804
mov byte [rsp + 0x50], reloc.WS2_32.dll_send
mov al, 0x2b
xor ecx, ecx
xor al, 0x13
mov byte [rsp + 0x51], al
mov byte [rsp + 0x52], cl
lea rax, [rsp + 0x51]
inc rbx
cmp byte [rax + rbx], cl
jne 0x140057562
cmp rsi, 0x10
jb 0x140057573
mov rdi, qword [rdi]
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x51]
mov rdx, r14
mov rcx, rdi
call fcn.140006f60
cmp rax, 0xffffffffffffffff
jne 0x140057804
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
mov rdi, qword [rbp]
lea rsi, [rbp - 0x10]
mov r14, qword [rbp - 0x10]
mov r15, qword [rbp + 8]
cmp r15, 0x10
cmovae rsi, r14
movabs rbx, 0x7fffffffffffffff
cmp rdi, rbx
ja 0x140057a64
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp rdi, 0x10
jae 0x1400575f3
mov qword [rbp - 0x28], rdi
lea r8d, [rax + 0x11]
mov rdx, rsi
lea rcx, [rbp - 0x38]
call fcn.1400b9b2c
jmp 0x14005768c
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x14005762f
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400b8890
mov rcx, rax
test rax, rax
je 0x1400577f3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140057669
mov rbx, rax
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005765a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140057a58
jmp 0x14005760d
test rcx, rcx
je 0x140057666
call fcn.1400b8890
jmp 0x140057669
mov rax, r13
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov r15, qword [rbp + 8]
mov r14, qword [rbp - 0x10]
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x10]
cmp r15, 0x10
cmovae rcx, r14
lea rax, [rbp - 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400579f1
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x80], 0x3e8
lea rcx, [rbp - 0x80]
call fcn.140006c70
movdqa xmm1, xmmword [str._afwwkfrido047]
movdqu xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x7f], al
xor byte [rbp - 0x7e], cl
xor byte [rbp - 0x7d], cl
xor byte [rbp - 0x7c], cl
xor byte [rbp - 0x7b], cl
xor byte [rbp - 0x7a], cl
xor byte [rbp - 0x79], cl
xor byte [rbp - 0x78], cl
xor byte [rbp - 0x77], cl
xor byte [rbp - 0x76], cl
xor byte [rbp - 0x75], cl
xor byte [rbp - 0x74], cl
xor byte [rbp - 0x73], cl
xor byte [rbp - 0x72], cl
mov byte [rbp - 0x71], 0
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rcx, qword [rbp - 0x10]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x7f]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140057a6a
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140057983
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400577fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400577fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b8b1c
jmp 0x140057983
movdqa xmm1, xmmword [0x1400d09d0]
movdqu xmmword [rbp - 0x38], xmm1
mov cl, reloc.WLDAP32.dll_Ordinal_46
mov dl, reloc.WLDAP32.dll_Ordinal_35
mov r8b, 0x68
mov r9b, reloc.WS2_32.dll_WSASetLastError
mov r10b, reloc.WS2_32.dll_WSACleanup
mov bl, 0x77
mov dil, 0x67
mov sil, 0x6a
mov r14b, 0x34
movzx r15d, cl
mov r12b, Ordinal_45
mov r13b, Ordinal_35
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r11d, xmm1
xor al, r11b
mov byte [rbp - 0x37], al
xor byte [rbp - 0x36], r11b
xor byte [rbp - 0x35], r11b
xor byte [rbp - 0x34], r11b
xor byte [rbp - 0x33], r11b
xor byte [rbp - 0x32], r11b
xor byte [rbp - 0x31], r11b
xor byte [rbp - 0x30], r11b
xor byte [rbp - 0x2f], r11b
xor byte [rbp - 0x2e], r11b
xor byte [rbp - 0x2d], r11b
xor byte [rbp - 0x2c], r11b
xor byte [rbp - 0x2b], r11b
xor byte [rbp - 0x2a], r11b
xor byte [rbp - 0x29], r11b
xor cl, r11b
mov byte [rbp - 0x28], cl
xor dl, r11b
mov byte [rbp - 0x27], dl
xor r8b, r11b
mov byte [rbp - 0x26], r8b
xor r9b, r11b
mov byte [rbp - 0x25], r9b
xor r10b, r11b
mov byte [rbp - 0x24], r10b
xor bl, r11b
mov byte [rbp - 0x23], bl
xor dil, r11b
mov byte [rbp - 0x22], dil
xor sil, r11b
mov byte [rbp - 0x21], sil
xor r14b, r11b
mov byte [rbp - 0x20], r14b
xor r15b, r11b
mov byte [rbp - 0x1f], r15b
xor r12b, r11b
mov byte [rbp - 0x1e], r12b
xor r13b, r11b
mov byte [rbp - 0x1d], r13b
mov al, reloc.WLDAP32.dll_Ordinal_41
xor al, r11b
mov byte [rbp - 0x1c], al
mov al, 0x33
xor al, r11b
mov byte [rbp - 0x1b], al
mov byte [rbp - 0x1a], 0
lea rdx, [rbp - 0x37]
call fcn.14005cb10
mov byte [rbp - 0x80], 0x51
mov al, Ordinal_35
mov cl, 0x25
mov dl, 0x34
mov r8b, Ordinal_50
mov r9b, reloc.WLDAP32.dll_Ordinal_60
mov r10b, 0x7f
movzx r11d, dl
mov bl, reloc.WLDAP32.dll_Ordinal_41
movzx edi, dl
xor esi, esi
xor al, 0x51
mov byte [rbp - 0x7f], al
xor cl, 0x51
mov byte [rbp - 0x7e], cl
xor dl, 0x51
mov byte [rbp - 0x7d], dl
xor r8b, 0x51
mov byte [rbp - 0x7c], r8b
xor r9b, 0x51
mov byte [rbp - 0x7b], r9b
xor r10b, 0x51
mov byte [rbp - 0x7a], r10b
xor r11b, 0x51
mov byte [rbp - 0x79], r11b
xor bl, 0x51
mov byte [rbp - 0x78], bl
xor dil, 0x51
mov byte [rbp - 0x77], dil
mov byte [rbp - 0x76], sil
lea rdx, [rbp - 0x7f]
call fcn.14005cd40
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
lea edx, [rsi + 1]
mov rcx, rax
call fcn.1400560e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x1400579c1
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400579bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400579bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b8b1c
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.1400b8870
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movdqa xmm1, xmmword [0x1400d1300]
movdqu xmmword [rbp - 0x80], xmm1
mov dl, 0x7d
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x7f], al
xor byte [rbp - 0x7e], cl
xor byte [rbp - 0x7d], cl
xor byte [rbp - 0x7c], cl
xor byte [rbp - 0x7b], cl
xor byte [rbp - 0x7a], cl
xor byte [rbp - 0x79], cl
xor byte [rbp - 0x78], cl
xor byte [rbp - 0x77], cl
xor byte [rbp - 0x76], cl
xor byte [rbp - 0x75], cl
xor byte [rbp - 0x74], cl
xor byte [rbp - 0x73], cl
xor byte [rbp - 0x72], cl
xor byte [rbp - 0x71], cl
xor dl, cl
mov byte [rbp - 0x70], dl
mov byte [rbp - 0x6f], 0
lea rdx, [rbp - 0x7f]
call fcn.14005c900
call fcn.14005cf40
nop
call fcn.140001350
int3
call fcn.14005cf40
int3
call fcn.1400013f0
nop
movdqa xmm1, xmmword [0x1400d0fe0]
movdqu xmmword [rbp - 0x80], xmm1
mov dl, 0x4b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rbp - 0x7f], al
xor byte [rbp - 0x7e], cl
xor byte [rbp - 0x7d], cl
xor byte [rbp - 0x7c], cl
xor byte [rbp - 0x7b], cl
xor byte [rbp - 0x7a], cl
xor byte [rbp - 0x79], cl
xor byte [rbp - 0x78], cl
xor byte [rbp - 0x77], cl
xor byte [rbp - 0x76], cl
xor byte [rbp - 0x75], cl
xor byte [rbp - 0x74], cl
xor byte [rbp - 0x73], cl
xor byte [rbp - 0x72], cl
xor byte [rbp - 0x71], cl
xor dl, cl
mov byte [rbp - 0x70], dl
mov byte [rbp - 0x6f], 0
lea rdx, [rbp - 0x7f]
call fcn.14005c900
call fcn.14005cf40
int3