Function at 0x1400515c0
Capabilities:
Acquire debug privileges
Check if file exists
Contain obfuscated stackstrings
Create thread
Encode data using xor
Enumerate gui resources
Enumerate processes
Execute command
Get file attributes
Get process image filename
Set global application hook

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x140156010]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov rsi, rcx
xor r15d, r15d
call fcn.14000d450
call fcn.14000cd50
call fcn.14000d550
call fcn.14000d300
call fcn.14000ceb0
call fcn.14000d000
call fcn.14000d7b0
call fcn.14000dc70
call fcn.14000da20
call fcn.14000db80
call fcn.14000de50
call fcn.14000df80
lea rcx, [rbp + 8]
call fcn.140003150
nop
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x14005164b
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rax
call fcn.14005a7d4
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x20], xmm0
lea r8, [rbp - 0x20]
mov edx, eax
lea rcx, [rbp + 0x68]
call fcn.140008ae0
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 8
jb 0x1400516b8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400516b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400516b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b338
movdqa xmm0, xmmword [0x1401496b0]
movdqu xmmword [rbp + 0x18], xmm0
mov word [rbp + 8], r15w
mov dword [rsp + 0x30], 0x2e734d3c
mov dword [rsp + 0x34], 0x6e6962
lea rax, [rsp + 0x31]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400516e6
lea rdx, [rsp + 0x31]
lea rcx, [rbp + 0x68]
call fcn.140008780
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x48]
call fcn.1400066b0
nop
lea rdx, [0x14016f430]
lea rcx, [rsp + 0x40]
call fcn.140007ea0
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.14000c800
nop
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae rdx, qword [rbp + 8]
lea rcx, [rbp + 0x48]
cmp qword [rbp + 0x60], 0x10
cmovae rcx, qword [rbp + 0x48]
mov rbx, qword [rbp + 0x58]
cmp rbx, qword [rbp + 0x18]
jne 0x14005175c
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140051763
mov dword [0x14016f364], r15d
test rbx, rbx
je 0x14005280f
lea rdx, [rbp + 8]
lea rcx, [rbp - 0x70]
call fcn.140008220
mov rcx, rax
call fcn.14000b040
test al, al
jne 0x14005179f
mov dword [rsp + 0x30], 0x72724534
movdqa xmm0, xmmword [0x140149d90]
lea r8, [rsp + 0x31]
jmp 0x140052824
lea rbx, [0x14016e740]
cmp qword [0x14016e758], 0x10
cmovae rbx, qword [0x14016e740]
movdqa xmm0, xmmword [0x1401497d0]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x10], 0
lea rcx, [rbp - 0x1f]
call fcn.14000cc20
mov rdx, rsi
lea rcx, [0x140149398]
call fcn.1400514d0
lea rcx, [0x14005f700]
call fcn.14000cc20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14005278e
test al, 0x10
jne 0x14005278e
mov r14d, r15d
xor edx, edx
mov r12d, 2
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140052741
mov dword [rbp + 0x90], 0x238
lea rdx, [rbp + 0x90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140051871
mov rdx, rsi
lea rcx, [rbp + 0xbc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14005186a
lea rdx, [rbp + 0x90]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x140051840
mov r14d, dword [rbp + 0x98]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x140052741
mov edx, r14d
lea rcx, [0x140051530]
call qword [sym.imp.USER32.dll_EnumWindows]
mov dword [rbp], r15d
lea rdx, [rbp]
mov rcx, qword [0x14016f3a0]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
test eax, eax
jne 0x140051a64
lea edx, [rax + 4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140052b40
mov r8, rax
movdqa xmm0, xmmword [0x140149920]
movdqu xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x14014a0b0]
movdqu xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [str._.__o8__8ao]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x60e096f
mov dword [rbp - 0x3c], 0x6f0b0a03
mov word [rbp - 0x38], 0x12
mov rcx, r15
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x6f], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x6e], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x6d], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x6c], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x6b], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x6a], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x69], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x68], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x67], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x66], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x65], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x64], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x63], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x62], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x61], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x60], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x5f], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x5e], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x5d], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x5c], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x5b], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x5a], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x59], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x58], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x57], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x56], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x55], al
movzx eax, byte [rbp - 0x70]
xor byte [rbp + rcx - 0x54], al
add rcx, 0x1c
cmp rcx, 0x38
jb 0x140051910
mov byte [rbp - 0x37], 0
lea rdx, [rbp - 0x6f]
mov rcx, r8
call fcn.140008f90
lea rdx, [0x140009160]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724556
movdqa xmm0, xmmword [0x14014a220]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14014a160]
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x20746567
mov dword [rsp + 0x64], 0x646e6977
mov dword [rsp + 0x68], 0x2e776f
lea rdx, [rsp + 0x41]
jmp 0x1400527ee
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x140051a80
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140009a20
nop
lea r8, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae r8, qword [rbp - 0x70]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
xorps xmm1, xmm1
test eax, eax
jne 0x140051aeb
movups xmmword [rbp + 0x28], xmm0
movdqu xmmword [rbp + 0x38], xmm1
xor r8d, r8d
lea rdx, [0x140149394]
lea rcx, [rbp + 0x28]
call fcn.140009790
jmp 0x140051b46
movups xmmword [rbp - 0x20], xmm0
movdqu xmmword [rbp - 0x10], xmm1
mov r8, rbx
lea rcx, [rbp - 0x20]
call fcn.140053390
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rax, qword [rbp - 0x20]
lea r8, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae r8, qword [rbp - 0x70]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [rbp + 0x38], xmm1
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140051b84
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051b7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051b7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b338
movdqa xmm0, xmmword [0x1401496c0]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
lea rcx, [rbp + 0x28]
cmp qword [rbp + 0x40], 8
cmovae rcx, qword [rbp + 0x28]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
jne 0x140051c55
lea edx, [rax + 4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140052b40
movdqa xmm0, xmmword [0x14014a070]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x140149de0]
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x454c4941
mov dword [rsp + 0x64], 0x5d2044
lea rdx, [rsp + 0x41]
mov rcx, rax
call fcn.140008f90
lea rdx, [0x140009160]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724546
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], dil
movdqa xmm0, xmmword [0x14014a0f0]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x776f6420
mov dword [rbp - 0xc], 0x616f6c6e
mov word [rbp - 8], 0x2e64
mov byte [rbp - 6], dil
lea rdx, [rbp - 0x1f]
jmp 0x1400526d3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x1400524ff
lea r8, [rbp - 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14005236c
mov dword [rbp - 0x20], 4
lea r8, [rbp - 0x1c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [rbp - 0x14]
test eax, eax
cmovne ecx, r12d
mov dword [rbp - 0x14], ecx
lea r8, [rbp - 0x10]
lea rdx, str.SeLoadDriverPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea r8, [rbp - 4]
lea rdx, str.SeRemoteShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea r8, [rbp + 8]
lea rdx, str.SeCreateGlobalPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov r9d, 0x10
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400521b6
mov cl, 0x47
mov word [rsp + 0x40], 0x47
movsx ebx, cl
movzx eax, bx
xor ax, 0x17
mov word [rsp + 0x42], ax
movzx eax, bx
xor ax, 0x35
mov word [rsp + 0x44], ax
movzx ecx, bx
xor cx, 0x2e
mov word [rsp + 0x46], cx
movzx eax, bx
xor ax, 0x31
mov word [rsp + 0x48], ax
mov word [rsp + 0x4a], cx
movzx r11d, bx
xor r11w, 0x2b
mov word [rsp + 0x4c], r11w
movzx r10d, bx
xor r10w, 0x22
mov word [rsp + 0x4e], r10w
movzx eax, bx
xor ax, 0x20
mov word [rsp + 0x50], ax
mov word [rsp + 0x52], r10w
movzx r9d, bx
xor r9w, 0x34
mov word [rsp + 0x54], r9w
movzx edx, bx
xor dx, 0x67
mov word [rsp + 0x56], dx
movzx eax, bx
xor ax, 0x26
mov word [rsp + 0x58], ax
movzx ecx, bx
xor cx, 0x23
mov word [rsp + 0x5a], cx
movzx eax, bx
xor ax, 0x2d
mov word [rsp + 0x5c], ax
movzx r8d, bx
xor r8w, 0x32
mov word [rsp + 0x5e], r8w
mov word [rsp + 0x60], r9w
movzx eax, bx
xor ax, 0x33
mov word [rsp + 0x62], ax
mov word [rsp + 0x64], r10w
mov word [rsp + 0x66], cx
mov word [rsp + 0x68], dx
mov word [rsp + 0x6a], r9w
mov word [rsp + 0x6c], r8w
movzx eax, bx
xor ax, 0x24
mov word [rsp + 0x6e], ax
mov word [rsp + 0x70], ax
mov word [rsp + 0x72], r10w
mov word [rsp + 0x74], r9w
mov word [rsp + 0x76], r9w
movzx eax, bx
xor ax, 0x21
mov word [rsp + 0x78], ax
mov word [rsp + 0x7a], r8w
mov word [rsp + 0x7c], r11w
mov word [rsp + 0x7e], r11w
movzx eax, bx
xor ax, 0x3e
mov word [rbp - 0x80], ax
xor bx, 0x69
mov word [rbp - 0x7e], bx
mov word [rbp - 0x7c], r15w
lea rdx, [rsp + 0x42]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140052ca0
lea rdx, [0x140052e70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x104
lea rdx, [rbp + 0x2d0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x140051eea
mov edx, 7
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140052eb0
mov rcx, rax
call fcn.140053010
mov rcx, rax
lea rdx, [rbp + 0x2d0]
call fcn.140052ca0
lea rdx, [0x140052e70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.NextHook
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rax, rax
jne 0x140051fa7
lea edx, [rax + 4]
call fcn.140052b40
movdqa xmm0, xmmword [0x140149e80]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x140149df0]
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x454c4941
mov dword [rsp + 0x64], 0x5d2044
lea rdx, [rsp + 0x41]
mov rcx, rax
call fcn.140008f90
lea rdx, [0x140009160]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x7272451e
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], bl
movdqa xmm0, xmmword [0x140149e70]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x140149df0]
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x454c4941
mov dword [rsp + 0x64], 0x5d2044
lea rdx, [rsp + 0x41]
jmp 0x1400526d3
mov edx, 7
call fcn.140052b40
movdqa xmm0, xmmword [0x140149e90]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x1401498c0]
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x60], 0x72656874
mov word [rsp + 0x64], 0x2165
mov byte [rsp + 0x66], 0
lea rdx, [rsp + 0x41]
mov rcx, rax
call fcn.140008f90
lea rdx, [0x140009160]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, r14d
mov r8, rdi
mov rdx, rbx
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rax, rax
jne 0x1400520b5
lea edx, [rax + 4]
call fcn.140052b40
movdqa xmm0, xmmword [0x140149f60]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x140149db0]
movdqu xmmword [rsp + 0x50], xmm1
mov word [rsp + 0x60], 0x5d20
mov byte [rsp + 0x62], 0
lea rdx, [rsp + 0x41]
mov rcx, rax
call fcn.140008f90
lea rdx, [0x140009160]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724531
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x140149f50]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x140149db0]
movdqu xmmword [rsp + 0x50], xmm1
mov word [rsp + 0x60], 0x5d20
mov byte [rsp + 0x62], 0
lea rdx, [rsp + 0x41]
jmp 0x1400526d3
mov edx, 7
call fcn.140052b40
movdqa xmm0, xmmword [0x14014a280]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x2e70
mov byte [rbp - 0xe], 0
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.140008f90
lea rdx, [0x140009160]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov byte [0x140156068], 0
movdqa xmm0, xmmword [0x14014a1e0]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x6c756673
mov dword [rbp - 0xc], 0xa21796c
mov byte [rbp - 8], 0
lea rcx, [rbp - 0x1f]
call fcn.14000cc20
mov dword [rbp - 0x30], 0x6375536e
mov dword [rbp - 0x2c], 0x73736563
mov byte [rbp - 0x28], 0
movdqa xmm0, xmmword [0x14014a030]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x6c20796c
mov dword [rbp - 0xc], 0x6564616f
mov word [rbp - 8], 0x2164
mov byte [rbp - 6], 0
mov r9d, 0x40
lea r8, [rbp - 0x2f]
lea rdx, [rbp - 0x1f]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x140052980]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x140156068], 0
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x1400526e7
mov cl, 0x2f
mov word [rsp + 0x40], 0x2f
movsx r11d, cl
movzx eax, r11w
xor ax, 0x6a
mov word [rsp + 0x42], ax
movzx r9d, r11w
xor r9w, 0x5d
mov word [rsp + 0x44], r9w
mov word [rsp + 0x46], r9w
movzx eax, r11w
xor ax, 0x40
mov word [rsp + 0x48], ax
mov word [rsp + 0x4a], r9w
movzx r10d, r11w
xor r10w, 0xf
mov word [rsp + 0x4c], r10w
movzx eax, r11w
xor ax, 0x4e
mov word [rsp + 0x4e], ax
movzx eax, r11w
xor ax, 0x4b
mov word [rsp + 0x50], ax
movzx eax, r11w
xor ax, 0x45
mov word [rsp + 0x52], ax
movzx eax, r11w
xor ax, 0x5a
mov word [rsp + 0x54], ax
movzx r8d, r11w
xor r8w, 0x5c
mov word [rsp + 0x56], r8w
movzx eax, r11w
xor ax, 0x5b
mov word [rsp + 0x58], ax
movzx ecx, r11w
xor cx, 0x46
mov word [rsp + 0x5a], cx
movzx eax, r11w
xor ax, 0x41
mov word [rsp + 0x5c], ax
movzx edx, r11w
xor dx, 0x48
mov word [rsp + 0x5e], dx
mov word [rsp + 0x60], r10w
movzx eax, r11w
xor ax, 0x5f
mov word [rsp + 0x62], ax
mov word [rsp + 0x64], r9w
mov word [rsp + 0x66], cx
movzx eax, r11w
xor ax, 0x59
mov word [rsp + 0x68], ax
mov word [rsp + 0x6a], cx
movzx eax, r11w
xor ax, 0x43
mov word [rsp + 0x6c], ax
movzx eax, r11w
xor ax, 0x4a
mov word [rsp + 0x6e], ax
mov word [rsp + 0x70], dx
mov word [rsp + 0x72], ax
mov word [rsp + 0x74], r8w
xor r11w, 0x15
mov word [rsp + 0x76], r11w
mov word [rsp + 0x78], r10w
mov word [rsp + 0x7a], r15w
lea rdx, [rsp + 0x42]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140052ca0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140052e70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x7272453b
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x140149f30]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0x69727020
mov dword [rbp - 0x5c], 0x656c6976
mov dword [rbp - 0x58], 0x2e736567
mov byte [rbp - 0x54], 0
lea r8, [rsp + 0x31]
lea rdx, [rbp - 0x6f]
jmp 0x1400526d8
mov cl, 0x3d
mov word [rsp + 0x40], 0x3d
movsx ebx, cl
movzx eax, bx
xor ax, 0x78
mov word [rsp + 0x42], ax
movzx r9d, bx
xor r9w, 0x4f
mov word [rsp + 0x44], r9w
mov word [rsp + 0x46], r9w
movzx r10d, bx
xor r10w, 0x52
mov word [rsp + 0x48], r10w
mov word [rsp + 0x4a], r9w
movzx r11d, bx
xor r11w, 0x1d
mov word [rsp + 0x4c], r11w
mov word [rsp + 0x4e], r10w
movzx ecx, bx
xor cx, 0x4d
mov word [rsp + 0x50], cx
movzx r8d, bx
xor r8w, 0x58
mov word [rsp + 0x52], r8w
movzx edx, bx
xor dx, 0x53
mov word [rsp + 0x54], dx
movzx eax, bx
xor ax, 0x54
mov word [rsp + 0x56], ax
mov word [rsp + 0x58], dx
movzx eax, bx
xor ax, 0x5a
mov word [rsp + 0x5a], ax
mov word [rsp + 0x5c], r11w
mov word [rsp + 0x5e], cx
mov word [rsp + 0x60], r9w
mov word [rsp + 0x62], r10w
movzx eax, bx
xor ax, 0x5e
mov word [rsp + 0x64], ax
mov word [rsp + 0x66], r8w
movzx eax, bx
xor ax, 0x4e
mov word [rsp + 0x68], ax
mov word [rsp + 0x6a], ax
mov word [rsp + 0x6c], r11w
movzx eax, bx
xor ax, 0x49
mov word [rsp + 0x6e], ax
mov word [rsp + 0x70], r10w
movzx eax, bx
xor ax, 0x56
mov word [rsp + 0x72], ax
mov word [rsp + 0x74], r8w
mov word [rsp + 0x76], dx
xor bx, 7
mov word [rsp + 0x78], bx
mov word [rsp + 0x7a], r11w
mov word [rsp + 0x7c], r15w
lea rdx, [rsp + 0x42]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140052ca0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140052e70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724556
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x14014a140]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0x65636f72
mov dword [rbp - 0x5c], 0x74207373
mov dword [rbp - 0x58], 0x6e656b6f
mov word [rbp - 0x54], 0x2e
lea rdx, [rbp - 0x6f]
jmp 0x1400526d3
mov cl, 0x60
mov word [rsp + 0x40], 0x60
movsx ebx, cl
movzx eax, bx
xor ax, 0x25
mov word [rsp + 0x42], ax
movzx r11d, bx
xor r11w, 0x12
mov word [rsp + 0x44], r11w
mov word [rsp + 0x46], r11w
movzx r8d, bx
xor r8w, 0xf
mov word [rsp + 0x48], r8w
mov word [rsp + 0x4a], r11w
movzx r10d, bx
xor r10w, 0x40
mov word [rsp + 0x4c], r10w
mov word [rsp + 0x4e], r8w
movzx edx, bx
xor dx, 0x10
mov word [rsp + 0x50], dx
movzx r9d, bx
xor r9w, 5
mov word [rsp + 0x52], r9w
movzx ecx, bx
xor cx, 0xe
mov word [rsp + 0x54], cx
movzx eax, bx
xor ax, 9
mov word [rsp + 0x56], ax
mov word [rsp + 0x58], cx
movzx eax, bx
xor ax, 7
mov word [rsp + 0x5a], ax
mov word [rsp + 0x5c], r10w
mov word [rsp + 0x5e], dx
mov word [rsp + 0x60], r11w
mov word [rsp + 0x62], r8w
movzx eax, bx
xor ax, 3
mov word [rsp + 0x64], ax
mov word [rsp + 0x66], r9w
movzx eax, bx
xor ax, 0x13
mov word [rsp + 0x68], ax
mov word [rsp + 0x6a], ax
mov word [rsp + 0x6c], r10w
movzx eax, bx
xor ax, 0x14
mov word [rsp + 0x6e], ax
movzx eax, bx
xor ax, 8
mov word [rsp + 0x70], ax
mov word [rsp + 0x72], r11w
mov word [rsp + 0x74], r9w
movzx eax, bx
xor ax, 1
mov word [rsp + 0x76], ax
movzx eax, bx
xor ax, 4
mov word [rsp + 0x78], ax
xor bx, 0x5a
mov word [rsp + 0x7a], bx
mov word [rsp + 0x7c], r10w
mov word [rsp + 0x7e], r15w
lea rdx, [rsp + 0x42]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140052ca0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140052e70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724568
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x14014a130]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0x65636f72
mov dword [rbp - 0x5c], 0x74207373
mov dword [rbp - 0x58], 0x61657268
mov word [rbp - 0x54], 0x2e64
mov byte [rbp - 0x52], 0
mov r9d, 0x10
lea r8, [rsp + 0x31]
lea rdx, [rbp - 0x6f]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rsp + 0x30], 0x72724558
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea r8, [rsp + 0x31]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x14005272a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052725
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140052725
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b338
movdqa xmm0, xmmword [0x1401496b0]
movdqu xmmword [rbp + 0x38], xmm0
mov word [rbp + 0x28], r15w
jmp 0x140052878
movdqa xmm0, xmmword [0x14014a290]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x2e646e
lea rdx, [rbp - 0x1f]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140008f90
lea rdx, [0x140009160]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724550
movdqa xmm0, xmmword [0x14014a2a0]
mov dword [rbp - 0x10], 0x2e646e
jmp 0x1400527e5
movdqa xmm0, xmmword [0x14014a0e0]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x776f6420
mov dword [rbp - 0xc], 0x616f6c6e
mov dword [rbp - 8], 0xa2e64
lea rcx, [rbp - 0x1f]
call fcn.14000cc20
mov rcx, rbx
call fcn.14000cc20
mov dword [rsp + 0x30], 0x7272453d
movdqa xmm0, xmmword [0x14014a0d0]
mov dword [rbp - 0x10], 0x776f6420
mov dword [rbp - 0xc], 0x616f6c6e
mov word [rbp - 8], 0x64
movdqu xmmword [rbp - 0x20], xmm0
lea rdx, [rbp - 0x1f]
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
lea r8, [rsp + 0x31]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140052878
mov dword [rsp + 0x30], 0x7272455c
movdqa xmm0, xmmword [0x140149da0]
lea r8, [rsp + 0x31]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x140149e00]
movdqa xmm0, xmmword [0x140149dd0]
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqu xmmword [rsp + 0x50], xmm1
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x70], 0x2e59
mov byte [rsp + 0x72], 0
mov r9d, 0x10
lea rdx, [rsp + 0x41]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x14016f364], r15d
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x1400528b7
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400528b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400528b1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b338
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0x10
jb 0x1400528f5
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400528f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400528f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b338
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x60], 0xf
mov byte [rbp + 0x48], 0
mov rdx, qword [rbp + 0x80]
cmp rdx, 0x10
jb 0x140052946
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052941
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140052941
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b338
xor al, al
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.14005b040
lea r11, [rsp + 0x5f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret