Function at 0x1400ed090
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x490]
sub rsp, 0x590
mov rax, qword [0x14041d0c0]
xor rax, rsp
mov qword [rbp + 0x480], rax
xor r12d, r12d
lea rcx, [0x1404b98c7]
call fcn.1402b13b0
call qword [sym.imp.KERNEL32.DLL_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
movdqa xmm0, xmmword [0x1403e9040]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x1403e8f50]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [0x1403e9e50]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1403e9e70]
movdqa xmmword [rbp - 0x70], xmm1
mov word [rbp - 0x60], Ordinal_45
mov eax, r12d
nop dword [rax + rax]
movzx ecx, byte [rsp + 0x60]
xor byte [rsp + rax + 0x61], cl
movzx ecx, byte [rsp + 0x60]
xor byte [rsp + rax + 0x62], cl
movzx ecx, byte [rsp + 0x60]
xor byte [rsp + rax + 0x63], cl
movzx ecx, byte [rsp + 0x60]
xor byte [rsp + rax + 0x64], cl
movzx ecx, byte [rsp + 0x60]
xor byte [rsp + rax + 0x65], cl
movzx ecx, byte [rsp + 0x60]
xor byte [rsp + rax + 0x66], cl
movzx ecx, byte [rsp + 0x60]
xor byte [rsp + rax + 0x67], cl
movzx ecx, byte [rsp + 0x60]
xor byte [rsp + rax + 0x68], cl
movzx ecx, byte [rsp + 0x60]
xor byte [rsp + rax + 0x69], cl
movzx ecx, byte [rsp + 0x60]
xor byte [rsp + rax + 0x6a], cl
movzx ecx, byte [rsp + 0x60]
xor byte [rsp + rax + 0x6b], cl
movzx ecx, byte [rsp + 0x60]
xor byte [rsp + rax + 0x6c], cl
movzx ecx, byte [rsp + 0x60]
xor byte [rsp + rax + 0x6d], cl
movzx ecx, byte [rsp + 0x60]
xor byte [rsp + rax + 0x6e], cl
movzx ecx, byte [rsp + 0x60]
xor byte [rsp + rax + 0x6f], cl
movzx ecx, byte [rsp + 0x60]
xor byte [rsp + rax + 0x70], cl
add rax, 0x10
cmp rax, 0x40
jb 0x1400ed130
mov byte [rbp - 0x5f], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x128], r12
mov qword [rbp + 0x130], r12
lea rax, [rsp + 0x61]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x1400ed200
lea rdx, [rsp + 0x61]
lea rcx, [rbp + 0x118]
call fcn.140046fc0
lea rax, [rbp + 0x118]
mov qword [rbp + 0xf0], rax
mov r8, qword [rbp + 0x128]
cmp r8, 0x40
jne 0x1400ed29c
lea rbx, [0x140494980]
mov rdx, rbx
mov rsi, qword [0x140494980]
mov r14, qword [0x140494998]
cmp r14, 0xf
cmova rdx, rsi
lea rcx, [rbp + 0x118]
cmp qword [rbp + 0x130], 0xf
cmova rcx, qword [rbp + 0x118]
cmp r8, qword [0x140494990]
jne 0x1400ed29c
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400ed29c
mov qword [0x140494990], r12
cmp r14, 0xf
cmova rbx, rsi
mov byte [rbx], al
lea rcx, [0x140491db0]
call fcn.14025a620
nop
lea rcx, [rbp + 0x118]
call fcn.14005f3e0
call fcn.1400d9f70
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.DLL_Sleep]
call fcn.1400d81b0
call fcn.1400d7e00
call fcn.1400d9dc0
mov ecx, 8
call fcn.1402b0048
lea rcx, [0x1400ec930]
mov qword [rax], rcx
mov qword [rbp + 0xf0], rax
lea rcx, [rbp + 0xd8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x1400eedf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0xd0], rax
test rax, rax
je 0x1400ee548
cmp dword [rbp + 0xd8], 0
je 0x1400ee53c
movaps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400ee53c
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xd0], xmm0
call fcn.1400da040
call fcn.1400ebb80
call fcn.1400ec0e0
call fcn.1400e44c0
call fcn.1400eb940
call fcn.140100350
call fcn.1400da4a0
call fcn.1400ec690
call fcn.1400e24d0
call fcn.1400e19c0
call fcn.1400e2730
call fcn.1400eafa0
call fcn.1400e2cb0
call fcn.1400e3290
call fcn.1400e01e0
call fcn.1400e04c0
call fcn.1400e1f30
call fcn.1400e15b0
call fcn.140100a50
call fcn.140100da0
call fcn.140101300
call fcn.140101a20
call fcn.140101ea0
call fcn.140103be0
call fcn.140102140
call fcn.140103f00
call fcn.140102270
call fcn.140104030
call fcn.1401036f0
call fcn.140102780
call fcn.140102ca0
call fcn.140104720
call fcn.1401050b0
call fcn.140104c90
call fcn.140104db0
call fcn.140105660
call fcn.1401059f0
call fcn.140105b30
call fcn.140105c70
call fcn.140105c40
call fcn.140105d90
call fcn.1401e8780
lea rax, [rbp + 0x270]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WLDAP32.dll_Ordinal_26
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400ed4b3
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
mov r9d, edi
lea r8, [rbp + 0x270]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
test eax, eax
jle 0x1400ed4b3
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x128], r12
mov qword [rbp + 0x130], r12
lea rax, [rbp + 0x160]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400ed4a0
lea rdx, [rbp + 0x160]
jmp 0x1400ed4d5
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x128], r12
mov qword [rbp + 0x130], r12
xor r8d, r8d
lea rdx, [0x1403d9989]
lea rcx, [rbp + 0x118]
call fcn.140046fc0
nop
mov dword [rsp + 0x48], 0x68705c01
mov dword [rsp + 0x4c], 0x6e6f746f
mov byte [rsp + 0x50], 0
lea rax, [rsp + 0x49]
mov rcx, rdi
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400ed500
movabs rsi, 0x7fffffffffffffff
mov rax, rsi
mov rdx, qword [rbp + 0x128]
sub rax, rdx
cmp rax, rcx
jb 0x1400ee561
lea r9, [rbp + 0x118]
cmp qword [rbp + 0x130], 0xf
cmova r9, qword [rbp + 0x118]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x49]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, [rbp + 0x118]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0xf8]
call fcn.140068d30
nop
lea rax, [rbp + 0xf8]
cmp qword [rbp + 0x110], 0xf
cmova rax, qword [rbp + 0xf8]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0xd8], rax
call fcn.1402af300
movaps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
lea r8, [rbp + 0xd0]
mov edx, eax
lea rcx, [rbp + 0x138]
call fcn.1400d0560
nop
mov qword [rbp + 0xd0], r12
lea r14, [0x14048e308]
mov qword [rbp + 0xd8], r14
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x138]
call fcn.1400d1f20
movzx ebx, al
cmp dword [rbp + 0xd0], 0
jne 0x1400ee567
lea rcx, [rbp + 0x138]
call fcn.1400d4840
nop
lea rcx, [rbp + 0xf8]
call fcn.14005f3e0
test bl, bl
jne 0x1400ed73a
mov dword [rsp + 0x48], 0x68705c60
mov dword [rsp + 0x4c], 0x6e6f746f
mov byte [rsp + 0x50], bl
lea rax, [rsp + 0x49]
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400ed640
mov rax, rsi
mov rdx, qword [rbp + 0x128]
sub rax, rdx
cmp rax, rcx
jb 0x1400ee582
lea r9, [rbp + 0x118]
cmp qword [rbp + 0x130], 0xf
cmova r9, qword [rbp + 0x118]
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x49]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, [rbp + 0x118]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x138]
call fcn.140068d30
nop
lea rax, [rbp + 0x138]
cmp qword [rbp + 0x150], 0xf
cmova rax, qword [rbp + 0x138]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0x148]
mov qword [rbp + 0xd8], rax
call fcn.1402af300
movaps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
lea r8, [rbp + 0xd0]
mov edx, eax
lea rcx, [rbp + 0xf8]
call fcn.1400d0560
nop
lea rcx, [rbp + 0xf8]
cmp qword [rbp + 0x110], 7
cmova rcx, qword [rbp + 0xf8]
call fcn.1402af560
shr rax, 0x20
test eax, eax
jne 0x1400ee588
lea rcx, [rbp + 0xf8]
call fcn.1400d4840
nop
lea rcx, [rbp + 0x138]
call fcn.14005f3e0
movdqa xmm0, xmmword [0x1403e9cd0]
movdqu xmmword [rbp + 0xd0], xmm0
mov byte [rbp + 0xe0], 0
lea rax, [rbp + 0xd1]
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400ed760
mov rax, rsi
mov rdx, qword [rbp + 0x128]
sub rax, rdx
cmp rax, rcx
jb 0x1400ee59e
lea r9, [rbp + 0x118]
cmp qword [rbp + 0x130], 0xf
cmova r9, qword [rbp + 0x118]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0xd1]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, [rbp + 0x118]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0xf8]
call fcn.140068d30
nop
lea rax, [rbp + 0xf8]
cmp qword [rbp + 0x110], 0xf
cmova rax, qword [rbp + 0xf8]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0xd8], rax
call fcn.1402af300
movaps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
lea r8, [rbp + 0xd0]
mov edx, eax
lea rcx, [rbp + 0x138]
call fcn.1400d0560
nop
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x138]
call fcn.1400d1f20
movzx ebx, al
cmp dword [rbp + 0xd0], 0
jne 0x1400ee5a4
lea rcx, [rbp + 0x138]
call fcn.1400d4840
nop
lea rcx, [rbp + 0xf8]
call fcn.14005f3e0
test bl, bl
jne 0x1400ed98c
movdqa xmm0, xmmword [0x1403e9c90]
movdqu xmmword [rbp + 0xd0], xmm0
mov byte [rbp + 0xe0], bl
lea rax, [rbp + 0xd1]
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400ed890
mov rax, rsi
mov rdx, qword [rbp + 0x128]
sub rax, rdx
cmp rax, rcx
jb 0x1400ee5bf
lea r9, [rbp + 0x118]
cmp qword [rbp + 0x130], 0xf
cmova r9, qword [rbp + 0x118]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0xd1]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, [rbp + 0x118]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x138]
call fcn.140068d30
nop
lea rax, [rbp + 0x138]
cmp qword [rbp + 0x150], 0xf
cmova rax, qword [rbp + 0x138]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0x148]
mov qword [rbp + 0xd8], rax
call fcn.1402af300
movaps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
lea r8, [rbp + 0xd0]
mov edx, eax
lea rcx, [rbp + 0xf8]
call fcn.1400d0560
nop
lea rcx, [rbp + 0xf8]
cmp qword [rbp + 0x110], 7
cmova rcx, qword [rbp + 0xf8]
call fcn.1402af560
shr rax, 0x20
test eax, eax
jne 0x1400ee5c5
lea rcx, [rbp + 0xf8]
call fcn.1400d4840
nop
lea rcx, [rbp + 0x138]
call fcn.14005f3e0
mov dword [rbp + 0xd0], 0x68705c0e
mov dword [rbp + 0xd4], 0x6e6f746f
mov dword [rbp + 0xd8], 0x61754c5c
mov byte [rbp + 0xdc], 0
lea rax, [rbp + 0xd1]
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400ed9c0
mov rax, rsi
mov rdx, qword [rbp + 0x128]
sub rax, rdx
cmp rax, rcx
jb 0x1400ee5db
lea r9, [rbp + 0x118]
cmp qword [rbp + 0x130], 0xf
cmova r9, qword [rbp + 0x118]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0xd1]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, [rbp + 0x118]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0xf8]
call fcn.140068d30
nop
lea rax, [rbp + 0xf8]
cmp qword [rbp + 0x110], 0xf
cmova rax, qword [rbp + 0xf8]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0xd8], rax
call fcn.1402af300
movaps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
lea r8, [rbp + 0xd0]
mov edx, eax
lea rcx, [rbp + 0x138]
call fcn.1400d0560
nop
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x138]
call fcn.1400d1f20
movzx ebx, al
cmp dword [rbp + 0xd0], 0
jne 0x1400ee5e1
lea rcx, [rbp + 0x138]
call fcn.1400d4840
nop
lea rcx, [rbp + 0xf8]
call fcn.14005f3e0
test bl, bl
jne 0x1400edbfc
mov dword [rbp + 0xd0], 0x68705c78
mov dword [rbp + 0xd4], 0x6e6f746f
mov dword [rbp + 0xd8], 0x61754c5c
mov byte [rbp + 0xdc], bl
lea rax, [rbp + 0xd1]
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400edb00
mov rax, rsi
mov rdx, qword [rbp + 0x128]
sub rax, rdx
cmp rax, rcx
jb 0x1400ee5fc
lea r9, [rbp + 0x118]
cmp qword [rbp + 0x130], 0xf
cmova r9, qword [rbp + 0x118]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0xd1]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, [rbp + 0x118]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x138]
call fcn.140068d30
nop
lea rax, [rbp + 0x138]
cmp qword [rbp + 0x150], 0xf
cmova rax, qword [rbp + 0x138]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0x148]
mov qword [rbp + 0xd8], rax
call fcn.1402af300
movaps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
lea r8, [rbp + 0xd0]
mov edx, eax
lea rcx, [rbp + 0xf8]
call fcn.1400d0560
nop
lea rcx, [rbp + 0xf8]
cmp qword [rbp + 0x110], 7
cmova rcx, qword [rbp + 0xf8]
call fcn.1402af560
shr rax, 0x20
test eax, eax
jne 0x1400ee602
lea rcx, [rbp + 0xf8]
call fcn.1400d4840
nop
lea rcx, [rbp + 0x138]
call fcn.14005f3e0
movdqa xmm0, xmmword [0x1403e9e00]
movdqu xmmword [rbp + 0x138], xmm0
mov dword [rbp + 0x148], 0x616f4c6f
mov word [rbp + 0x14c], 0x64
lea rax, [rbp + 0x139]
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400edc30
mov rax, rsi
mov rdx, qword [rbp + 0x128]
sub rax, rdx
cmp rax, rcx
jb 0x1400ee618
lea r9, [rbp + 0x118]
cmp qword [rbp + 0x130], 0xf
cmova r9, qword [rbp + 0x118]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x139]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, [rbp + 0x118]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0xf8]
call fcn.140068d30
nop
lea rax, [rbp + 0xf8]
cmp qword [rbp + 0x110], 0xf
cmova rax, qword [rbp + 0xf8]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0xd8], rax
call fcn.1402af300
movaps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
lea r8, [rbp + 0xd0]
mov edx, eax
lea rcx, [rbp - 0x50]
call fcn.1400d0560
nop
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
lea rdx, [rbp + 0xd0]
lea rcx, [rbp - 0x50]
call fcn.1400d1f20
movzx ebx, al
cmp dword [rbp + 0xd0], 0
jne 0x1400ee61e
lea rcx, [rbp - 0x50]
call fcn.1400d4840
nop
lea rcx, [rbp + 0xf8]
call fcn.14005f3e0
test bl, bl
jne 0x1400ede4b
movdqa xmm0, xmmword [0x1403e9e00]
movdqu xmmword [rbp + 0x138], xmm0
mov dword [rbp + 0x148], 0x616f4c6f
mov word [rbp + 0x14c], 0x64
lea rax, [rbp + 0x139]
mov rcx, rdi
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400edd61
mov rax, rsi
mov rdx, qword [rbp + 0x128]
sub rax, rdx
cmp rax, rcx
jb 0x1400ee636
lea r9, [rbp + 0x118]
cmp qword [rbp + 0x130], 0xf
cmova r9, qword [rbp + 0x118]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x139]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, [rbp + 0x118]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x50]
call fcn.140068d30
nop
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rax, qword [rbp - 0x50]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp - 0x40]
mov qword [rbp + 0xd8], rax
call fcn.1402af300
movaps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
lea r8, [rbp + 0xd0]
mov edx, eax
lea rcx, [rbp + 0xf8]
call fcn.1400d0560
nop
lea rcx, [rbp + 0xf8]
cmp qword [rbp + 0x110], 7
cmova rcx, qword [rbp + 0xf8]
call fcn.1402af560
shr rax, 0x20
test eax, eax
jne 0x1400ee63c
lea rcx, [rbp + 0xf8]
call fcn.1400d4840
nop
lea rcx, [rbp - 0x50]
call fcn.14005f3e0
mov dword [rbp + 0xd0], 0x68705c09
mov dword [rbp + 0xd4], 0x6e6f746f
mov dword [rbp + 0xd8], 0x7461445c
mov word [rbp + 0xdc], 0x61
lea rax, [rbp + 0xd1]
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400ede80
mov rax, rsi
mov rdx, qword [rbp + 0x128]
sub rax, rdx
cmp rax, rcx
jb 0x1400ee652
lea r9, [rbp + 0x118]
cmp qword [rbp + 0x130], 0xf
cmova r9, qword [rbp + 0x118]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0xd1]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, [rbp + 0x118]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0xf8]
call fcn.140068d30
nop
lea rax, [rbp + 0xf8]
cmp qword [rbp + 0x110], 0xf
cmova rax, qword [rbp + 0xf8]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0xd8], rax
call fcn.1402af300
movaps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
lea r8, [rbp + 0xd0]
mov edx, eax
lea rcx, [rbp + 0x138]
call fcn.1400d0560
nop
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x138]
call fcn.1400d1f20
movzx ebx, al
cmp dword [rbp + 0xd0], 0
jne 0x1400ee658
lea rcx, [rbp + 0x138]
call fcn.1400d4840
nop
lea rcx, [rbp + 0xf8]
call fcn.14005f3e0
test bl, bl
jne 0x1400ee0bc
mov dword [rbp + 0xd0], 0x68705c2d
mov dword [rbp + 0xd4], 0x6e6f746f
mov dword [rbp + 0xd8], 0x7461445c
mov word [rbp + 0xdc], 0x61
lea rax, [rbp + 0xd1]
mov rcx, rdi
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400edfc0
mov rax, rsi
mov rdx, qword [rbp + 0x128]
sub rax, rdx
cmp rax, rcx
jb 0x1400ee673
lea r9, [rbp + 0x118]
cmp qword [rbp + 0x130], 0xf
cmova r9, qword [rbp + 0x118]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0xd1]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r8, [rbp + 0x118]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x138]
call fcn.140068d30
nop
lea rax, [rbp + 0x138]
cmp qword [rbp + 0x150], 0xf
cmova rax, qword [rbp + 0x138]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0x148]
mov qword [rbp + 0xd8], rax
call fcn.1402af300
movaps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
lea r8, [rbp + 0xd0]
mov edx, eax
lea rcx, [rbp + 0xf8]
call fcn.1400d0560
nop
lea rcx, [rbp + 0xf8]
cmp qword [rbp + 0x110], 7
cmova rcx, qword [rbp + 0xf8]
call fcn.1402af560
shr rax, 0x20
test eax, eax
jne 0x1400ee679
lea rcx, [rbp + 0xf8]
call fcn.1400d4840
nop
lea rcx, [rbp + 0x138]
call fcn.14005f3e0
cmp byte [0x1404919a1], 0
jne 0x1400ee359
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0x108], r12
mov qword [rbp + 0x110], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xf8], 0
lea rax, [rbp + 0x138]
mov qword [rbp + 0xf0], rax
movdqa xmm0, xmmword [0x1403e9ee0]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x1403e8f80]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [0x1403e9010]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1403e8fe0]
movdqa xmmword [rbp - 0x70], xmm1
mov word [rbp - 0x60], Ordinal_45
mov rcx, r12
nop dword [rax]
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x61], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x62], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x63], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x64], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x65], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x66], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x67], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x68], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x69], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x6a], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x6b], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x6c], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x6d], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x6e], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x6f], al
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x70], al
add rcx, 0x10
cmp rcx, 0x40
jb 0x1400ee140
mov byte [rbp - 0x5f], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
mov qword [rbp + 0x148], r12
mov qword [rbp + 0x150], r12
lea rax, [rsp + 0x61]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x1400ee202
lea rdx, [rsp + 0x61]
lea rcx, [rbp + 0x138]
call fcn.140046fc0
nop
lea rax, [rbp]
mov qword [rbp - 0x30], rax
lea r15, [0x140456050]
mov rdx, r15
lea rcx, [rbp]
call fcn.14005ce30
mov rbx, rax
lea rdx, [0x140456010]
lea rcx, [rbp - 0x20]
call fcn.14005ce30
nop
lea r9, [rbp + 0xf8]
lea r8, [rbp + 0x138]
mov rdx, rbx
mov rcx, rax
call fcn.1400eccb0
test al, al
jne 0x1400ee397
mov qword [0x140456060], r12
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova r15, qword [0x140456050]
mov byte [r15], al
mov dword [rsp + 0x48], 0x72724562
mov dword [rsp + 0x4c], 0x203a726f
mov byte [rsp + 0x50], al
lea rax, [rsp + 0x49]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400ee2a1
mov rcx, qword [rbp + 0x108]
sub rsi, rcx
cmp rsi, rdi
jb 0x1400ee55b
lea rax, [rbp + 0xf8]
cmp qword [rbp + 0x110], 0xf
cmova rax, qword [rbp + 0xf8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x49]
lea r8, [rbp + 0xf8]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x138]
call fcn.140068d30
nop
mov dword [rbp + 0xf0], 0x6f68704a
mov dword [rbp + 0xf4], 0x6e6f74
lea rdx, [rbp + 0x138]
cmp qword [rbp + 0x150], 0xf
cmova rdx, qword [rbp + 0x138]
xor r9d, r9d
lea r8, [rbp + 0xf1]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
lea rcx, [rbp + 0x138]
call fcn.14005f3e0
nop
lea rcx, [rbp + 0xf8]
call fcn.14005f3e0
nop
lea rcx, [rbp + 0x118]
call fcn.14005f3e0
xor eax, eax
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.1402aff00
lea r11, [rsp + 0x590]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea rax, [rbp + 0x28]
mov qword [rbp - 0x28], rax
mov rdx, r15
lea rcx, [rbp + 0x28]
call fcn.1400ecb10
mov r14, rax
lea rax, [rbp + 0x48]
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x50]
call fcn.1400ee710
lea rdx, [rax + 1]
movzx r8d, byte [rax]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rdx + 7], r8b
mov byte [rdx + 8], 0
lea rcx, [rbp]
call fcn.140046ed0
nop
lea rdx, [rbp]
lea rcx, [rbp + 0x48]
call fcn.1400ecb10
mov rsi, rax
lea rax, [rbp + 0x68]
mov qword [rbp + 0xf0], rax
lea rdx, [0x140456010]
lea rcx, [rbp + 0x68]
call fcn.1400ecb10
mov rdi, rax
lea rax, [rbp + 0x88]
mov qword [rbp + 0x20], rax
lea rdx, [rbp + 0xd0]
call fcn.1400ee6d0
lea rdx, [rax + 1]
movzx r8d, byte [rax]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rdx + 7], r8b
mov byte [rdx + 8], 0
lea rcx, [rbp - 0x20]
call fcn.140046ed0
nop
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x88]
call fcn.1400ecb10
mov rbx, rax
lea rdx, [rbp + 0x138]
call fcn.1400ee690
lea r8, [rax + 1]
movzx edx, byte [rax]
xor byte [r8], dl
xor byte [rax + 2], dl
xor byte [rax + 3], dl
xor byte [rax + 4], dl
xor byte [rax + 5], dl
xor byte [rax + 6], dl
xor byte [rax + 7], dl
xor byte [rax + 8], dl
xor byte [rax + 9], dl
xor byte [rax + 0xa], dl
xor byte [rax + 0xb], dl
xor byte [rax + 0xc], dl
xor byte [rax + 0xd], dl
xor byte [rax + 0xe], dl
xor byte [rax + 0xf], dl
xor byte [rax + 0x10], dl
xor byte [rax + 0x11], dl
xor byte [r8 + 0x11], dl
mov byte [r8 + 0x12], 0
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0xa8]
call fcn.1400eea50
nop
mov qword [rsp + 0x20], r14
mov r9, rsi
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.1400d7240
nop
lea rcx, [rbp - 0x20]
call fcn.14005cc00
nop
lea rcx, [rbp]
call fcn.14005cc00
mov rcx, r15
call fcn.14006b720
lea rcx, [0x140456010]
call fcn.14006b720
lea rcx, [0x140492228]
call fcn.14006b720
call fcn.1401118c0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0xd8], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call fcn.140044e70
nop
call fcn.140044e70
nop
lea r8, [rbp + 0x138]
lea rdx, [rbp + 0xd0]
lea rcx, str.exists
call fcn.1400d16f0
nop
call fcn.140044e70
nop
lea r8, [rbp + 0xf8]
mov edx, eax
lea rcx, str.create_directory
call fcn.1400d1670
nop
call fcn.140044e70
nop
lea r8, [rbp + 0x138]
lea rdx, [rbp + 0xd0]
lea rcx, str.exists
call fcn.1400d16f0
nop
call fcn.140044e70
nop
lea r8, [rbp + 0xf8]
mov edx, eax
lea rcx, str.create_directory
call fcn.1400d1670
nop
call fcn.140044e70
nop
lea r8, [rbp + 0x138]
lea rdx, [rbp + 0xd0]
lea rcx, str.exists
call fcn.1400d16f0
nop
call fcn.140044e70
nop
lea r8, [rbp + 0xf8]
mov edx, eax
lea rcx, str.create_directory
call fcn.1400d1670
nop
call fcn.140044e70
nop
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0xd0]
lea rcx, str.exists
call fcn.1400d16f0
nop
call fcn.140044e70
nop
lea r8, [rbp + 0xf8]
mov edx, eax
lea rcx, str.create_directory
call fcn.1400d1670
nop
call fcn.140044e70
nop
lea r8, [rbp + 0x138]
lea rdx, [rbp + 0xd0]
lea rcx, str.exists
call fcn.1400d16f0
nop
call fcn.140044e70
nop
lea r8, [rbp + 0xf8]
mov edx, eax
lea rcx, str.create_directory
call fcn.1400d1670
int3