Function at 0x140001080
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x580
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov eax, 0x5a4d
mov rsi, rdx
mov rdi, rcx
movabs r12, 0x29ecdd7a14f89486
cmp word [rdx], ax
je 0x140001140
movabs rax, 0x2f293f17c79970ac
lea rcx, [rbp + 0x80]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0x29ecdd707194fde0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0xf4d567ba6ef1ee5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r12
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x80]
mov qword [rbp + 0x28], rax
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x80], xmm0
call fcn.140001020
jmp 0x140002dfb
movsxd r13, dword [rdx + 0x3c]
mov eax, 0x8664
add r13, rsi
cmp word [r13 + 4], ax
je 0x140001222
movabs rax, 0x2f293f17c79970ac
lea rcx, [rbp + 0x20]
mov qword [rbp], rax
movabs rsi, 0xa0becd1838181488
mov rax, qword [rbp]
movabs r15, 0x10750e59499e4397
mov qword [rbp + 0x20], rax
movabs rax, 0x449eb21c6099f8f6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x10750e59499e439d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xf4d567ba6ef1ee5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.140001020
jmp 0x140002dfb
movabs rax, 0x526395bc38377a3
lea rcx, [rbp + 0x140]
mov qword [rbp], rax
movabs r14, 0xf4d567ba6ef1ee5
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
mov qword [rbp], r12
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x140]
mov qword [rbp + 0x248], rax
xorps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp + 0x140], xmm0
call fcn.140001020
mov r8d, dword [r13 + 0x50]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x60], rax
mov rbx, rax
test rax, rax
jne 0x140001451
movabs rax, 0x7f6d221ec19d7fb1
movabs rcx, 0xc895cc048e9e1cfc
mov qword [rbp], rax
movabs r15, 0x10750e59499e4397
mov rax, qword [rbp]
movabs rsi, 0xa0becd1838181488
mov qword [rbp + 0x20], rax
movabs r13, 0x6e71c667fd8a9939
movabs rax, 0x44ccae09719bfbf4
movabs rbx, 0x90f16df640aba68a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x7c142e203bf12ef2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xced1a46c597b7be4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x4e15a30b94ebff19
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xb5895dd669d3c3a2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x3c742ed54c7e1b73
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x3c742ed54c7e112b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x20]
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqu ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x20], ymm1
mov qword [rbp + 0xb8], rax
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call fcn.140001020
jmp 0x140002dfb
xor r15d, r15d
lea rax, [rbp + 0xd0]
mov dword [rbp + 0xd0], r15d
mov rdx, rbx
mov r8d, dword [r13 + 0x50]
mov rcx, rdi
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r9d, 0x1000
mov qword [rbp + 0x260], rax
mov r8, rsi
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rbx
mov qword [rbp + 0x268], rax
mov rcx, rdi
mov rax, qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov qword [rbp + 0x270], rax
mov qword [rbp + 0x280], r15
mov qword [rbp + 0x288], 1
mov qword [rbp + 0x298], 1
mov qword [rbp + 0x278], rbx
mov qword [rbp + 0x290], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400015d2
movabs rax, 0x7d3a760f81817fa6
lea rcx, [rbp + 0x20]
mov qword [rbp], rax
movabs r15, 0x10750e59499e4397
mov rax, qword [rbp]
movabs rsi, 0xa0becd1838181488
mov qword [rbp + 0x20], rax
movabs rax, 0x4c80b41c349de0ef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x30076b3d28fb2bb7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xa0becd12603d6cb8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.140001020
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x140002dfb
movzx eax, word [r13 + 0x14]
mov esi, r15d
add rax, 0x2c
cmp word [r13 + 6], r15w
je 0x14000163a
mov r15, qword [rbp + 0x60]
lea rbx, [rax + r13]
nop dword [rax]
mov eax, dword [rbx - 4]
test eax, eax
je 0x140001625
mov r8d, dword [rbx]
mov r9d, eax
mov edx, dword [rbx - 8]
mov rcx, rdi
add r8, qword [rsp + 0x5b8]
add rdx, r15
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000180b
movzx eax, word [r13 + 6]
inc esi
add rbx, 0x28
cmp esi, eax
jne 0x1400015f0
mov rbx, r15
xor r15d, r15d
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov rcx, rdi
lea r8d, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x68], rax
mov rsi, rax
test rax, rax
jne 0x1400018ec
movabs rax, 0x7f6d221ec19d7fb1
movabs rcx, 0xc895cc048e9e1cfc
mov qword [rbp], rax
movabs r15, 0x10750e59499e4397
mov rax, qword [rbp]
movabs rsi, 0xa0becd1838181488
mov qword [rbp + 0x20], rax
movabs r13, 0x6e71c667fd8a9939
movabs rax, 0x44ccae09719bfbf4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x7155693720ee33f6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xcfd7b9795b7778e4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xa14aa0e9cecb957
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xe8c14ddf38ce8eaa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x3c742ed54c74490e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x90f16df640aba68a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x3c742ed54c7e112b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x20]
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqu ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x20], ymm1
mov qword [rbp + 0xb8], rax
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call fcn.140001020
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x140002dfb
movabs rax, 0x6e20760f81817fa6
lea rcx, [rbp + 0x20]
mov qword [rbp], rax
movabs r15, 0x10750e59499e4397
mov rax, qword [rbp]
movabs rsi, 0xa0becd1838181488
mov qword [rbp + 0x20], rax
movabs rax, 0x4685a919718bb4f6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x6850766969a430f9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xa0becd1838181482
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.140001020
mov rdx, qword [rbp + 0x60]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x140002dfb
mov r9d, 0x40
mov qword [rsp + 0x20], r15
lea r8, [rbp + 0x260]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140001951
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cant_write_mapping_0x_X_n
call fcn.140001020
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x140002dfb
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0xc8], rax
test rax, rax
jne 0x140001aef
movabs rax, 0x7c6d2f09c9827ba8
lea rcx, [rbp + 0x80]
mov qword [rbp], rax
movabs r15, 0x10750e59499e4397
mov rax, qword [rbp]
movabs rsi, 0xa0becd1838181488
mov qword [rbp + 0x80], rax
movabs r13, 0x6e71c667fd8a9939
movabs rax, 0x4c88b2197894f1ee
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x64146d3625f222b7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0xccd7ac7e18767be1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0x4e58be02d5aafd5c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x90f16dfc188edeba
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x90f16df640aba68a
mov qword [rbp], rax
mov rax, qword [rbp]
movdqa xmm2, xmmword [rbp + 0xa0]
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
mov qword [rbp + 0x48], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x80], ymm1
vmovdqa xmmword [rbp + 0xa0], xmm2
vzeroupper
call fcn.140001020
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rbp + 0x68]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x140002dfb
mov r9d, 0x1000
mov qword [rsp + 0x20], r15
lea r8, [0x140002e20]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movabs r15, 0x10750e59499e4397
movabs rsi, 0xa0becd1838181488
test eax, eax
jne 0x140001c24
movabs rax, 0x7d3a760f81817fa6
lea rcx, [rbp + 0x20]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x4589b509349de0ef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x68452e3c2df120fb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xa0becd1838124cad
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.140001020
mov rdx, rbx
xor r8d, r8d
mov r9d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rbp + 0x68]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rbp + 0xc8]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x140002dfb
movabs rax, 0x4b6d321ed69f7fa8
lea rcx, [rbp + 0x180]
mov qword [rbp], rax
mov rdx, rbx
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs rax, 0x59c9fd0e75d8d8ca
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0x10750e59499e439d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x3e0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x3e8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x3f0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x3f8], rax
vmovdqu ymm0, ymmword [rbp + 0x3e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x180]
vmovdqa ymmword [rbp + 0x180], ymm1
vzeroupper
call fcn.140001020
mov rdx, qword [rbp + 0x68]
lea rcx, [rbp + 0x1a0]
movabs rax, 0x2f2a3812d69f7fa8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rax, 0x998bc5a7b9efaef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x10750e59499433b2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x400], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x408], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x410], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x418], rax
vmovdqu ymm0, ymmword [rbp + 0x400]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0x1a0], ymm1
vzeroupper
call fcn.140001020
movabs rax, 0x602e7617ca8a76b6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0x59c9fd0e75d8f1e2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x10750e59499e439d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
lea rcx, [rbp + 0xe0]
mov rdx, qword [rbp + 0xc8]
mov qword [rbp + 0xf8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x420], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x428], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x430], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x438], rax
vmovdqu ymm0, ymmword [rbp + 0x420]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0xe0], ymm1
vzeroupper
call fcn.140001020
movabs rax, 0x6321375bc79b7fa1
lea rcx, [rbp + 0x150]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
movabs rax, 0x29e6b91f6099f7e9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x250], rax
mov qword [rbp], r12
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x150]
mov qword [rbp + 0x258], rax
xorps xmm0, xmmword [rbp + 0x250]
movdqa xmmword [rbp + 0x150], xmm0
call fcn.140001020
mov r9, qword [rbp + 0xc8]
xor eax, eax
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], eax
xor edx, edx
mov rax, qword [rbp + 0x68]
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x140001fd3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
movabs rax, 0x6c6d321ac39d76b1
mov qword [rbp], rax
movabs rax, 0x982b2136099f1f4
mov rcx, qword [rbp]
mov qword [rbp + 0xe0], rcx
mov qword [rbp], rax
movabs rax, 0x20556a3c25f722f1
mov rcx, qword [rbp]
mov qword [rbp + 0xe8], rcx
mov qword [rbp], rax
movabs rax, 0xa0becd18324031f0
mov rcx, qword [rbp]
mov qword [rbp + 0xf0], rcx
lea rcx, [rbp + 0xe0]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0xe0], ymm1
vzeroupper
call fcn.140001020
jmp 0x140001bdb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0xc8]
lea rcx, [rbp + 0x2a0]
movabs rax, 0x6c6d321ac39d76b1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2a0], rax
movabs rax, 0x48ccb91f6099f1f4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2a8], rax
movabs rax, 0x675522296cbe79e3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2b0], rax
movabs rax, 0xc69eaa76516c7de9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2b8], rax
movabs rax, 0x1c04b2028faaeb56
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2c0], rax
movabs rax, 0x90f16dfc6e8588e4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2c8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x320], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x328], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x330], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
movabs rax, 0x6e71c667fd8a9939
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x340], rax
movabs rax, 0x90f16df640aba68a
mov qword [rbp], rax
mov rax, qword [rbp]
movdqa xmm2, xmmword [rbp + 0x2c0]
vmovdqu ymm0, ymmword [rbp + 0x320]
vpxor ymm1, ymm0, ymmword [rbp + 0x2a0]
mov qword [rbp + 0x348], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x340]
vmovdqa ymmword [rbp + 0x2a0], ymm1
vmovdqa xmmword [rbp + 0x2c0], xmm2
vzeroupper
call fcn.140001020
nop word [rax + rax]
xor ebx, ebx
lea rdx, [rbp + 0xc0]
mov rcx, rdi
mov dword [rbp + 0xc0], ebx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rbp + 0xc0], 0x103
jne 0x140002d43
mov rdx, qword [rbp + 0x68]
lea r9d, [rbx + 0x40]
xorps xmm0, xmm0
mov qword [rsp + 0x20], rbx
lea r8, [rbp + 0x4e0]
mov rcx, rdi
movups xmmword [rbp + 0x4e0], xmm0
movups xmmword [rbp + 0x4f0], xmm0
movups xmmword [rbp + 0x500], xmm0
movups xmmword [rbp + 0x510], xmm0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x500]
cmp rbx, 0x404040
je 0x140002c92
cmp rbx, 0x505050
jne 0x1400021bd
lea rcx, str.WARNING:_Exception_support_failed__n
call fcn.140001020
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x140002130
mov ecx, 0x1400000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp], rax
mov rbx, rax
test rax, rax
jne 0x1400022a3
movabs rax, 0x7b6d3317c48e70b0
lea rcx, [rbp + 0x20]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x488fb2167899b4e9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x621a633c24be26e3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xa0becd1838181ef1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.140001020
jmp 0x140002dfb
xor edx, edx
mov r8d, 0x1400000
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rbp + 0x60]
mov r9d, 0x1000
mov r8, rbx
mov qword [rsp + 0x20], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400023a1
movabs rax, 0x2e0a1832e8bd5fb2
lea rcx, [rbp + 0x1c0]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x998fa1475bbb4bc
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1c8], rax
movabs rax, 0x553d2e2b28fb2ff4
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1d0], rax
movabs rax, 0xa0becd126a5d50c9
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
mov qword [rbp + 0x10], r14
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x440], rax
mov qword [rbp + 0x10], r12
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x448], rax
mov qword [rbp + 0x10], r15
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x10], rsi
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x458], rax
vmovdqu ymm0, ymmword [rbp + 0x440]
vpxor ymm1, ymm0, ymmword [rbp + 0x1c0]
vmovdqa ymmword [rbp + 0x1c0], ymm1
vzeroupper
call fcn.140001020
movzx ebx, word [r13 + 0x14]
xor edx, edx
movzx ecx, word [r13 + 6]
add rbx, 0x18
add rbx, r13
mov dword [rbp + 0x10], edx
test cx, cx
je 0x14000260e
lea r8, str..rsrc
movabs r10, 0x663e251ec5806cb5
lea r9, str..reloc
movabs r11, 0x4c9efd0931d8f3e8
cmp dword [rbx + 8], 0
je 0x1400025f5
xor ecx, ecx
nop
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140002406
cmp rcx, 6
jne 0x1400023f0
jmp 0x140002428
xor eax, eax
nop dword [rax + rax]
movzx ecx, byte [rbx + rax]
inc rax
cmp cl, byte [r9 + rax - 1]
jne 0x1400025f5
cmp rax, 7
jne 0x140002410
mov qword [rbp + 8], r10
lea rcx, [rbp + 0x1e0]
mov rax, qword [rbp + 8]
mov rdx, rbx
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 8], r11
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x1075043528e82cfa
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1f8], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x460], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x468], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x470], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x478], rax
vmovdqu ymm0, ymmword [rbp + 0x460]
vpxor ymm1, ymm0, ymmword [rbp + 0x1e0]
vmovdqa ymmword [rbp + 0x1e0], ymm1
vzeroupper
call fcn.140001020
mov edx, dword [rbx + 0xc]
mov rcx, rdi
add rdx, qword [rbp + 0x60]
mov r9d, dword [rbx + 8]
mov r8, qword [rbp]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400025d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, rbx
movabs rax, 0x632e760f81817fa6
mov qword [rbp + 8], rax
movabs rax, 0x5d8fb809348af5e3
mov rcx, qword [rbp + 8]
mov qword [rbp + 0x200], rcx
mov qword [rbp + 8], rax
movabs rax, 0x304f7d7c69f02cfe
mov rcx, qword [rbp + 8]
mov qword [rbp + 0x208], rcx
mov qword [rbp + 8], rax
movabs rax, 0xa0becd12403d6cb8
mov rcx, qword [rbp + 8]
mov qword [rbp + 0x210], rcx
lea rcx, [rbp + 0x200]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x218], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x480], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x488], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x490], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x498], rax
vmovdqu ymm0, ymmword [rbp + 0x480]
vpxor ymm1, ymm0, ymmword [rbp + 0x200]
vmovdqa ymmword [rbp + 0x200], ymm1
vzeroupper
call fcn.140001020
mov edx, dword [rbp + 0x10]
lea r9, str..reloc
movabs r11, 0x4c9efd0931d8f3e8
lea r8, str..rsrc
movabs r10, 0x663e251ec5806cb5
movzx eax, word [r13 + 6]
inc edx
add rbx, 0x28
mov dword [rbp + 0x10], edx
cmp edx, eax
jne 0x1400023e2
movzx ecx, ax
movzx ebx, word [r13 + 0x14]
add rbx, 0x18
mov dword [rbp + 0x10], 0
add rbx, r13
test cx, cx
je 0x1400028c2
mov r14d, dword [rbp + 0x10]
mov edx, 0x20
mov ecx, dword [rbx + 8]
test ecx, ecx
je 0x14000289f
mov eax, dword [rbx + 0x24]
mov dword [rbp + 0xd4], 0
test eax, 0x80000000
jbe 0x14000265a
mov r14d, 4
jmp 0x140002669
test eax, 0x20000000
mov r14d, 2
cmova r14d, edx
mov edx, dword [rbx + 0xc]
lea rax, [rbp + 0xd4]
add rdx, qword [rbp + 0x60]
mov r8, rcx
mov r9d, r14d
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x140002757
movabs rax, 0x2f233912d28c7b96
lea rcx, [rbp + 0x220]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x220], rax
movabs rax, 0x48cca91f67d8e7a3
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x228], rax
movabs rax, 0x1075040125bb63e4
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x230], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x238], rax
movabs rax, 0xf4d567ba6ef1ee5
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4a0], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4a8], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4b0], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4b8], rax
vmovdqu ymm0, ymmword [rbp + 0x4a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x220]
vmovdqa ymmword [rbp + 0x220], ymm1
jmp 0x140002888
movabs rcx, 0x6e71c667fd8a9939
movabs rax, 0x6a3e7641eaa65fa3
mov qword [rbp + 8], rax
movabs rdx, 0x90f16df640aba68a
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2e0], rax
movabs rax, 0x5ac9fd147b91e0e5
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2e8], rax
movabs rax, 0x64107d793df12db7
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2f0], rax
movabs rax, 0xaae6a13d186b75a8
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2f8], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x300], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x308], rax
movabs rax, 0xf4d567ba6ef1ee5
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x360], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x368], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x370], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x378], rax
mov qword [rbp + 8], rcx
lea rcx, [rbp + 0x2e0]
mov rax, qword [rbp + 8]
mov qword [rbp + 0x380], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 8]
movdqa xmm2, xmmword [rbp + 0x300]
vmovdqu ymm0, ymmword [rbp + 0x360]
vpxor ymm1, ymm0, ymmword [rbp + 0x2e0]
mov qword [rbp + 0x388], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x380]
vmovdqa ymmword [rbp + 0x2e0], ymm1
vmovdqa xmmword [rbp + 0x300], xmm2
mov rdx, rbx
mov r8d, r14d
vzeroupper
call fcn.140001020
mov r14d, dword [rbp + 0x10]
mov edx, 0x20
movzx eax, word [r13 + 6]
inc r14d
add rbx, 0x28
mov dword [rbp + 0x10], r14d
cmp r14d, eax
jne 0x140002633
movabs r14, 0xf4d567ba6ef1ee5
movzx eax, word [r13 + 0x14]
mov r9d, 2
mov rdx, qword [rbp + 0x60]
mov rcx, rdi
mov dword [rbp + 0xd8], 0
mov r8d, dword [rax + r13 + 0x24]
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rbx, qword [rbp + 0xc8]
mov r9d, 0x1000
mov r8, qword [rbp]
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movabs r13, 0x350a1832e8bd5fb2
test eax, eax
jne 0x1400029ea
mov qword [rbp + 8], r13
lea rcx, [rbp + 0x160]
mov rax, qword [rbp + 8]
mov qword [rbp + 0x160], rax
movabs rax, 0x4acca95d7a99d7a6
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x168], rax
movabs rax, 0x751d7d793bff26fb
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x170], rax
movabs rax, 0xa0b4a87c577b78e4
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x178], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4c0], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4c8], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4d0], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4d8], rax
vmovdqu ymm0, ymmword [rbp + 0x4c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x160], ymm1
vzeroupper
call fcn.140001020
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
movabs rcx, 0x5bcca95d7a99f7a6
test eax, eax
jne 0x140002b42
mov qword [rbp + 8], r13
movabs rbx, 0x90f16df640aba68a
mov rax, qword [rbp + 8]
movabs r13, 0x6e71c667fd8a9939
mov qword [rbp + 0x100], rax
mov qword [rbp + 8], rcx
lea rcx, [rbp + 0x100]
mov rax, qword [rbp + 8]
mov qword [rbp + 0x108], rax
movabs rax, 0x63556b2a28fb2ff2
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x110], rax
movabs rax, 0xc4d1ae38547471e0
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x118], rax
movabs rax, 0x1703a90a98e7b95c
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x120], rax
movabs rax, 0x90f16df640aba680
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x128], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x3a0], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x3a8], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x3b0], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x3b8], rax
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x3c0], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
movdqa xmm2, xmmword [rbp + 0x120]
vmovdqu ymm0, ymmword [rbp + 0x3a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
mov qword [rbp + 0x3c8], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x3c0]
vmovdqa ymmword [rbp + 0x100], ymm1
vmovdqa xmmword [rbp + 0x120], xmm2
vzeroupper
call fcn.140001020
jmp 0x140002b56
movabs rbx, 0x90f16df640aba68a
movabs r13, 0x6e71c667fd8a9939
mov rdx, qword [rbp + 0x68]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
jne 0x140002c8b
movabs rax, 0x350a1832e8bd5fb2
lea rcx, [rbp + 0x100]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x100], rax
movabs rax, 0x5bcca95d7a99f7a6
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x108], rax
movabs rax, 0x7d556b2a28fb2ff2
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x110], rax
movabs rax, 0xc49eaa76516864e9
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x118], rax
movabs rax, 0x11ca30addebed58
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x120], rax
movabs rax, 0x90f16df640a1dff8
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x128], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x20], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x30], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x38], rax
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x40], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
movdqa xmm2, xmmword [rbp + 0x120]
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
mov qword [rbp + 0x48], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x100], ymm1
vmovdqa xmmword [rbp + 0x120], xmm2
vzeroupper
call fcn.140001020
mov al, 1
jmp 0x140002dfd
movabs rax, 0x6e20761cc8806cb2
lea rcx, [rbp + 0x20]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x20], rax
movabs rax, 0x5d9cfd1d7a91e4f6
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
movabs rax, 0x10750e59499e49e5
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x30], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x38], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x80], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x88], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x90], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.140001020
mov rdx, qword [rbp + 0x60]
jmp 0x140001bde
movabs rax, 0x2f3e251ec5806cb5
lea rcx, [rbp + 0x20]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x20], rax
movabs rax, 0x588b8126799e6e5
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
movabs rax, 0x7f162e2d20e626b7
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x30], rax
movabs rax, 0xa0b4a93d182271ec
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x38], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x80], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x88], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x90], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov edx, dword [rbp + 0xc0]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.140001020
xor al, al
lea r11, [rsp + 0x580]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret