Function at 0x1400293e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Execute command
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x310]
sub rsp, 0x410
mov rax, qword [0x14012c040]
xor rax, rsp
mov qword [rbp + 0x300], rax
mov dword [rsp + 0x40], 0x724f5c70
mov dword [rsp + 0x44], 0x746962
mov rdx, qword [0x14012c388]
lea rax, [rsp + 0x41]
mov rbx, 0xffffffffffffffff
mov rcx, rbx
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x140029440
movabs r14, 0x7fffffffffffffff
mov rax, r14
sub rax, rdx
cmp rax, rcx
jb 0x14002a732
lea r15, [0x14012c378]
mov r9, r15
cmp qword [0x14012c390], 0xf
cmova r9, qword [0x14012c378]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x41]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x60]
call fcn.140024940
nop
lea rcx, [rsp + 0x60]
call fcn.140029220
movzx edi, al
lea rcx, [rsp + 0x60]
call fcn.140004140
nop dword [rax]
test dil, dil
jne 0x1400295d2
mov dword [rsp + 0x40], 0x724f5c25
mov dword [rsp + 0x44], 0x746962
mov rdx, qword [0x14012c388]
lea rax, [rsp + 0x41]
mov rcx, rbx
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400294f0
mov rax, r14
sub rax, rdx
cmp rax, rcx
jb 0x14002a738
mov r9, r15
cmp qword [0x14012c390], 0xf
cmova r9, qword [0x14012c378]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x41]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x1c8]
call fcn.140024940
nop
mov rsi, qword [rbp + 0x1d8]
lea rdi, [rbp + 0x1c8]
cmp qword [rbp + 0x1e0], 0xf
cmova rdi, qword [rbp + 0x1c8]
call fcn.140088260
mov qword ds:[rsp + 0x40], rdi
mov qword [rsp + 0x48], rsi
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rbp + 0x160]
call fcn.140005780
nop
lea rcx, [rbp + 0x160]
cmp qword [rbp + 0x178], 7
cmova rcx, qword [rbp + 0x160]
call fcn.1400884c0
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x14002a73e
lea rcx, ds:[rbp + 0x160]
call fcn.1400040c0
nop
lea rcx, [rbp + 0x1c8]
call fcn.140004140
movdqa xmm0, xmmword [0x140115e90]
movdqu xmmword [rbp + 0x140], xmm0
mov dword [rbp + 0x150], 0x65706c65
mov dword [rbp + 0x154], 0x78742e72
mov word [rbp + 0x158], 0x74
mov rdx, qword [0x14012c388]
lea rax, [rbp + 0x141]
mov rcx, rbx
inc rcx
cmp byte [rax + rcx], 0
jne 0x140029610
mov rax, r14
sub rax, rdx
cmp rax, rcx
jb 0x14002a756
mov r9, r15
cmp qword [0x14012c390], 0xf
cmova r9, qword [0x14012c378]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x141]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x160]
call fcn.140024940
mov rdx, qword [0x14012c3c8]
cmp rdx, 0xf
jbe 0x14002969f
mov rcx, qword [0x14012c3b0]
inc rdx
cmp rdx, 0x1000
jb 0x14002969a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029967
mov rcx, r8
call fcn.14008927c
movups xmm0, xmmword [rbp + 0x160]
movups xmmword [0x14012c3b0], xmm0
movups xmm1, xmmword [rbp + 0x170]
movups xmmword [0x14012c3c0], xmm1
movdqa xmm0, xmmword [0x140115c00]
movdqu xmmword [rbp + 0x170], xmm0
mov byte [rbp + 0x160], 0
lea rcx, [rbp + 0x160]
call fcn.140004140
movdqa xmm0, xmmword [0x140115f50]
movdqu xmmword [rbp + 0x140], xmm0
mov dword [rbp + 0x150], 0x6f697372
mov dword [rbp + 0x154], 0x78742e6e
mov word [rbp + 0x158], 0x74
mov rdx, qword [0x14012c388]
lea rax, [rbp + 0x141]
mov rcx, rbx
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140029720
mov rax, r14
sub rax, rdx
cmp rax, rcx
jb 0x14002a75c
mov r9, r15
cmp qword [0x14012c390], 0xf
cmova r9, qword [0x14012c378]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x141]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x160]
call fcn.140024940
nop
mov rsi, qword [rbp + 0x170]
lea rdi, [rbp + 0x160]
cmp qword [rbp + 0x178], 0xf
cmova rdi, qword [rbp + 0x160]
call fcn.140088260
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rsi
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.140005780
nop
lea rcx, [rsp + 0x60]
call fcn.1400071a0
movzx edi, al
lea rcx, [rsp + 0x60]
call fcn.1400040c0
nop
lea rcx, [rbp + 0x160]
call fcn.140004140
lea rsi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
nop dword [rax]
test dil, dil
jne 0x1400299f8
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x1f0]
call sub.VCRUNTIME140.dll_memset
movdqa xmm0, xmmword [0x140115f60]
movdqu xmmword [rbp + 0x140], xmm0
mov dword [rbp + 0x150], 0x6f697372
mov dword [rbp + 0x154], 0x78742e6e
mov word [rbp + 0x158], 0x74
mov rdx, qword [0x14012c388]
lea rax, [rbp + 0x141]
mov rcx, rbx
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140029840
mov rax, r14
sub rax, rdx
cmp rax, rcx
jb 0x14002a766
mov r9, r15
cmp qword [0x14012c390], 0xf
cmova r9, qword [0x14012c378]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x141]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x160]
call fcn.140024940
nop
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 0xf
cmova rdx, qword [rbp + 0x160]
lea rcx, [rbp + 0x1f0]
call fcn.1400203e0
mov rax, qword [rbp + 0x1f0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x1f0], rsi
mov rax, qword [rbp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x1ec], edx
lea rcx, [rbp + 0x160]
call fcn.140004140
cmp qword [rbp + 0x278], 0
jne 0x14002996e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, ds:[rbp - 0x80]
call fcn.14002a780
lea rdx, [rax + 1]
mov r9, rdx
mov r10d, 0xad
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rax]
xor byte [r9], r8b
lea r9, [r9 + 1]
sub r10, 1
jne 0x140029920
mov byte [rax + 0xae], r10b
call fcn.1400045e0
lea rdx, [0x1400047c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [rbp + 0x1f8]
call fcn.1400218c0
test rax, rax
jne 0x1400299a7
mov rax, qword ds:[rbp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x1f0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x1f0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x1f0], rsi
mov rax, qword [rbp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x1ec], edx
lea rcx, [rbp + 0x1f8]
call fcn.1400202c0
lea rcx, [rbp + 0x200]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x298]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x30]
call sub.VCRUNTIME140.dll_memset
movdqa xmm0, xmmword [0x140115f40]
movdqu xmmword [rbp + 0x140], xmm0
mov dword [rbp + 0x150], 0x6f697372
mov dword [rbp + 0x154], 0x78742e6e
mov word [rbp + 0x158], 0x74
mov rdx, qword [0x14012c388]
lea rax, [rbp + 0x141]
mov rcx, rbx
inc rcx
cmp byte [rax + rcx], 0
jne 0x140029a47
mov rax, r14
sub rax, rdx
cmp rax, rcx
jb 0x14002a76c
mov r9, r15
cmp qword [0x14012c390], 0xf
cmova r9, qword [0x14012c378]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x141]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x60]
call fcn.140024940
nop
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x30]
call fcn.14001f000
nop
lea rcx, [rsp + 0x60]
call fcn.140004140
mov rax, qword ds:[rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x30]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
je 0x140029b9d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, ds:[rbp + 0x160]
call fcn.14002a8f0
lea rdx, [rax + 1]
movzx r8d, byte [rax]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
xor byte [rax + 0x1c], r8b
xor byte [rax + 0x1d], r8b
xor byte [rax + 0x1e], r8b
xor byte [rax + 0x1f], r8b
mov byte [rax + 0x20], 0
call fcn.1400045e0
lea rdx, [0x1400047c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
xor edi, edi
mov qword [rbp + 0x170], rdi
mov qword [rbp + 0x178], 0xf
mov byte [rbp + 0x160], dil
movups xmmword [rbp + 0x1a8], xmm0
mov qword [rbp + 0x1b8], rdi
mov qword [rbp + 0x1c0], rdi
xor r8d, r8d
lea rdx, [0x14010df56]
lea rcx, [rbp + 0x1a8]
call fcn.140007b40
nop
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x30]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x30]
call fcn.140024ae0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x140029cf0
nop dword [rax]
nop word [rax + rax]
lea r9, [rbp + 0x160]
cmp qword [rbp + 0x178], 0xf
cmova r9, qword [rbp + 0x160]
mov rsi, qword [rbp + 0x170]
mov rax, qword [rbp + 0x1c0]
cmp rsi, rax
ja 0x140029c98
lea rdi, [rbp + 0x1a8]
cmp rax, 0xf
cmova rdi, qword [rbp + 0x1a8]
mov qword [rbp + 0x1b8], rsi
mov r8, rsi
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rdi], 0
jmp 0x140029ca7
mov rdx, rsi
lea rcx, [rbp + 0x1a8]
call fcn.140024060
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x30]
add rcx, rax
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x30]
call fcn.140024ae0
mov rcx, qword ds:[rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
jne 0x140029c40
xor edi, edi
lea rcx, [rbp + 0x40]
call fcn.1400218c0
test rax, rax
jne 0x140029d1a
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x30]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0x188], xmm0
mov qword [rbp + 0x198], rdi
mov qword [rbp + 0x1a0], rdi
xor r8d, r8d
lea rdx, [0x14010df56]
lea rcx, [rbp + 0x188]
call fcn.140007b40
nop
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x140], xmm1
mov qword [rbp + 0x150], rdi
lea rcx, [rbp + 0x1a8]
mov r12, qword [rbp + 0x1a8]
mov r13, qword [rbp + 0x1c0]
cmp r13, 0xf
cmova rcx, r12
mov rsi, qword [rbp + 0x1b8]
test rsi, rsi
jne 0x14002a574
mov r8, rsi
lea rdx, [0x14010df56]
call sub.VCRUNTIME140.dll_memcmp
nop dword [rax + rax]
test eax, eax
jne 0x14002a574
mov eax, dword [0x14012e498]
cmp eax, 0x4a65
jne 0x140029e31
movdqa xmm0, xmmword [str.nWin10_22H2.sys]
movdqu xmmword [rsp + 0x40], xmm0
lea rax, [rsp + 0x41]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140029dd0
mov rax, qword [rbp + 0x1a0]
cmp rbx, rax
ja 0x140029e18
lea rdi, [rbp + 0x188]
cmp rax, 0xf
cmova rdi, qword [rbp + 0x188]
mov qword [rbp + 0x198], rbx
mov r8, rbx
lea rdx, [rsp + 0x41]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
jmp 0x14002a688
lea r9, [rsp + 0x41]
mov rdx, rbx
lea rcx, [rbp + 0x188]
call fcn.140024060
jmp 0x14002a688
cmp eax, 0x585d
jne 0x140029eb1
movdqa xmm0, xmmword [str.KWin11_22H2.sys]
movdqu xmmword [rsp + 0x40], xmm0
lea rax, [rsp + 0x41]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140029e50
mov rax, qword [rbp + 0x1a0]
cmp rbx, rax
ja 0x140029e98
lea rdi, [rbp + 0x188]
cmp rax, 0xf
cmova rdi, qword [rbp + 0x188]
mov qword [rbp + 0x198], rbx
mov r8, rbx
lea rdx, [rsp + 0x41]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
jmp 0x14002a688
lea r9, [rsp + 0x41]
mov rdx, rbx
lea rcx, [rbp + 0x188]
call fcn.140024060
jmp 0x14002a688
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x1f0]
call sub.VCRUNTIME140.dll_memset
movdqa xmm0, xmmword [0x140115f30]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x6f697372
mov dword [rsp + 0x54], 0x78742e6e
mov word [rsp + 0x58], 0x74
mov rcx, qword [0x14012c388]
lea rdx, [rsp + 0x41]
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x140029f00
sub r14, rcx
cmp r14, rax
jb 0x14002a72c
cmp qword [0x14012c390], 0xf
cmova r15, qword [0x14012c378]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x41]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r9, r15
lea rcx, [rsp + 0x60]
call fcn.140024940
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rdx, qword [rsp + 0x60]
lea rcx, [rbp + 0x1f0]
call fcn.1400203e0
mov rax, qword ds:[rbp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea r15, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x1f0], r15
mov rax, qword [rbp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x1ec], edx
lea rcx, [rsp + 0x60]
call fcn.140004140
cmp qword [rbp + 0x278], 0
jne 0x14002a140
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, ds:[rbp - 0x80]
call fcn.14002a930
lea rdx, [rax + 1]
movzx r8d, byte [rax]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
xor byte [rax + 0x1c], r8b
xor byte [rax + 0x1d], r8b
xor byte [rax + 0x1e], r8b
xor byte [rax + 0x1f], r8b
xor byte [rax + 0x20], r8b
xor byte [rax + 0x21], r8b
xor byte [rax + 0x22], r8b
xor byte [rax + 0x23], r8b
xor byte [rax + 0x24], r8b
xor byte [rax + 0x25], r8b
xor byte [rax + 0x26], r8b
xor byte [rax + 0x27], r8b
xor byte [rax + 0x28], r8b
xor byte [rax + 0x29], r8b
xor byte [rax + 0x2a], r8b
xor byte [rax + 0x2b], r8b
xor byte [rax + 0x2c], r8b
xor byte [rax + 0x2d], r8b
xor byte [rax + 0x2e], r8b
xor byte [rax + 0x2f], r8b
xor byte [rax + 0x30], r8b
xor byte [rax + 0x31], r8b
xor byte [rax + 0x32], r8b
xor byte [rax + 0x33], r8b
xor byte [rax + 0x34], r8b
xor byte [rax + 0x35], r8b
xor byte [rax + 0x36], r8b
xor byte [rax + 0x37], r8b
xor byte [rax + 0x38], r8b
xor byte [rax + 0x39], r8b
xor byte [rax + 0x3a], r8b
xor byte [rax + 0x3b], r8b
xor byte [rax + 0x3c], r8b
xor byte [rax + 0x3d], r8b
xor byte [rax + 0x3e], r8b
xor byte [rax + 0x3f], r8b
xor byte [rax + 0x40], r8b
xor byte [rax + 0x41], r8b
xor byte [rax + 0x42], r8b
xor byte [rax + 0x43], r8b
xor byte [rax + 0x44], r8b
xor byte [rax + 0x45], r8b
xor byte [rax + 0x46], r8b
xor byte [rax + 0x47], r8b
xor byte [rax + 0x48], r8b
xor byte [rax + 0x49], r8b
xor byte [rax + 0x4a], r8b
xor byte [rax + 0x4b], r8b
xor byte [rax + 0x4c], r8b
xor byte [rax + 0x4d], r8b
xor byte [rax + 0x4e], r8b
xor byte [rax + 0x4f], r8b
xor byte [rax + 0x50], r8b
xor byte [rax + 0x51], r8b
mov byte [rax + 0x52], 0
call fcn.1400045e0
lea rdx, [0x1400047c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movdqa xmm0, xmmword [0x140115f80]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x140115d80]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x140116020]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x140116000]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x140115ff0]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x140115f10]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [str.unqbuqbutnhi__r_r]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140115dc0]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x140115eb0]
movdqa xmmword [rbp], xmm0
mov dword [rbp + 0x10], 0x73727769
mov word [rbp + 0x14], 0x273d
mov byte [rbp + 0x16], 0
mov r8, rdi
nop dword [rax]
movzx eax, byte ds:[rbp - 0x80]
xor byte [rbp + r8 - 0x7f], al
inc r8
cmp r8, 0x95
jb 0x14002a1d0
mov byte [rbp + 0x16], 0
lea rdx, [rbp - 0x7f]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400045e0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c8], xmm0
mov qword [rbp + 0x1d8], rdi
mov qword [rbp + 0x1e0], rdi
xor r8d, r8d
lea rdx, [0x14010df56]
lea rcx, [rbp + 0x1c8]
call fcn.140007b40
nop
lea rdx, [rbp + 0x1c8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14002e5c0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov word [rsp + 0x40], 0x3056
mov byte [rsp + 0x42], 0
lea rcx, [rsp + 0x41]
mov rax, rbx
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x14002a260
lea rcx, [rbp + 0x1c8]
mov rsi, qword [rbp + 0x1c8]
mov r14, qword [rbp + 0x1e0]
cmp r14, 0xf
cmova rcx, rsi
mov rdi, qword [rbp + 0x1d8]
cmp rdi, rax
jne 0x14002a34b
mov r8, rdi
lea rdx, [rsp + 0x41]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14002a34b
mov dword [0x14012e498], 0x4a65
movdqa xmm0, xmmword [str.MWin10_22H2.sys]
movdqu xmmword [rsp + 0x40], xmm0
lea rax, [rsp + 0x41]
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14002a2d0
mov rax, qword [rbp + 0x1a0]
cmp rbx, rax
ja 0x14002a325
lea rdi, [rbp + 0x188]
cmp rax, 0xf
cmova rdi, qword [rbp + 0x188]
mov qword [rbp + 0x198], rbx
mov r8, rbx
lea rdx, [rsp + 0x41]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
movdqa xmm0, xmmword [str.Win10_22H2.sys]
lea rdx, [rsp + 0x41]
jmp 0x14002a421
lea r9, [rsp + 0x41]
mov rdx, rbx
lea rcx, [rbp + 0x188]
call fcn.140024060
movdqa xmm0, xmmword [str.Win10_22H2.sys]
lea rdx, [rsp + 0x41]
jmp 0x14002a421
mov word [rsp + 0x40], 0x3117
mov byte [rsp + 0x42], 0
lea rcx, [rsp + 0x41]
mov rax, rbx
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x14002a360
lea rcx, ds:[rbp + 0x1c8]
cmp r14, 0xf
cmova rcx, rsi
cmp rdi, rax
jne 0x14002a4f8
mov r8, rdi
lea rdx, [rsp + 0x41]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14002a4f8
movdqa xmm0, xmmword [0x140115ce0]
movdqu xmmword [rsp + 0x40], xmm0
lea rax, [rsp + 0x41]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14002a3b1
mov rax, qword [rbp + 0x1a0]
cmp rbx, rax
ja 0x14002a3f6
lea rdi, [rbp + 0x188]
cmp rax, 0xf
cmova rdi, qword [rbp + 0x188]
mov qword [rbp + 0x198], rbx
mov r8, rbx
lea rdx, [rsp + 0x41]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
jmp 0x14002a40a
lea r9, [rsp + 0x41]
mov rdx, rbx
lea rcx, [rbp + 0x188]
call fcn.140024060
mov dword [0x14012e498], 0x585d
movdqa xmm0, xmmword [str.FWin11_22H2.sys]
lea rdx, [rsp + 0x41]
movdqu xmmword [rsp + 0x40], xmm0
lea rcx, [rbp + 0x1f0]
call fcn.1400045e0
lea rdx, [0x1400047c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x1f8]
call fcn.1400218c0
test rax, rax
jne 0x14002a479
mov rax, qword [rbp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x1f0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov dword [rsp + 0x40], 0x736c6338
mov byte [rsp + 0x44], 0
lea rcx, [rsp + 0x41]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rcx, [rbp + 0x1c8]
call fcn.140004140
nop
mov rax, qword [rbp + 0x1f0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x1f0], r15
mov rax, qword [rbp + 0x1f0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x1ec], edx
lea rcx, [rbp + 0x1f8]
call fcn.1400202c0
lea rcx, ds:[rbp + 0x200]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x298]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x14002a688
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x40]
call fcn.14002a9d0
lea rdx, [rax + 1]
movzx r8d, byte [rax]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
mov byte [rax + 0xe], 0
call fcn.1400045e0
lea rdx, [0x1400047c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea r9, [rbp + 0x1a8]
cmp r13, 0xf
cmova r9, r12
mov rax, qword [rbp + 0x1a0]
cmp rsi, rax
ja 0x14002a5bd
lea rdi, [rbp + 0x188]
cmp rax, 0xf
cmova rdi, qword [rbp + 0x188]
mov qword [rbp + 0x198], rsi
mov r8, rsi
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rdi], 0
jmp 0x14002a5e1
mov rdx, rsi
lea rcx, [rbp + 0x188]
call fcn.140024060
mov r13, qword [rbp + 0x1c0]
mov rsi, qword [rbp + 0x1b8]
mov r12, qword [rbp + 0x1a8]
movdqa xmm0, xmmword [0x140115cf0]
movdqu xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x41]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x14002a5f7
lea rcx, [rbp + 0x1a8]
cmp r13, 0xf
cmova rcx, r12
cmp rsi, rax
jne 0x14002a635
mov r8, rsi
lea rdx, [rsp + 0x41]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14002a635
mov dword [0x14012e498], 0x585d
jmp 0x14002a688
movdqa xmm0, xmmword [str.VWin10_22H2.sys]
movdqu xmmword [rsp + 0x40], xmm0
lea rax, [rsp + 0x41]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14002a650
lea rcx, [rbp + 0x1a8]
cmp r13, 0xf
cmova rcx, r12
cmp rsi, rbx
jne 0x14002a688
mov r8, rsi
lea rdx, [rsp + 0x41]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14002a688
mov dword [0x14012e498], 0x4a65
lea rcx, [rbp + 0x188]
call fcn.140004140
nop
lea rcx, [rbp + 0x1a8]
call fcn.140004140
nop
lea rcx, [rbp + 0x160]
call fcn.140004140
nop
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x30], rax
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x2c], edx
lea rcx, [rbp + 0x40]
call fcn.1400202c0
lea rcx, [rbp + 0x48]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.140088df0
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140004c40
nop
call fcn.140004c40
int3
call fcn.140004c40
nop
shr rdx, 0x20
lea r8, [rbp + 0x160]
lea rcx, str.create_directory
call fcn.140006700
nop
call fcn.140004c40
int3
nop dword [rax]
call fcn.140004c40
int3
call fcn.140004c40
int3
call fcn.140004c40
int3