Function at 0x140002920
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2a0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x140008008]
xor rax, rsp
mov qword [rbp + 0x180], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
xor r14d, r14d
mov qword [rbp + 0x170], r14
mov r15d, 0xf
mov qword [rbp + 0x178], r15
lea ecx, [r14 + 0x30]
call fcn.1400046a0
mov rcx, rax
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x170], 0x29
mov qword [rbp + 0x178], 0x2f
movups xmm0, xmmword [str.S:DevIllsills_buildx64_Debugills.dll]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400064b8]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1400064c8]
movsd qword [rax + 0x20], xmm0
movzx eax, byte [0x1400064d0]
mov byte [rcx + 0x28], al
mov byte [rcx + 0x29], r14b
lea rcx, str.msedge.exe
call fcn.140001640
mov dword [rbp - 0x38], eax
cmp eax, 0xffffffff
jne 0x1400029f5
lea rcx, str.____an_error_occurred_when_trying_to_find_the_target_process._n
jmp 0x1400040ae
lea rax, [rbp + 0x100]
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x5c], r14d
mov qword [rbp - 0x58], 0xb
mov qword [rbp - 0x50], r15
movsd xmm0, qword [str.OpenProcess]
movsd qword [rbp - 0x68], xmm0
movzx eax, word [0x1400064a0]
mov word [rbp - 0x60], ax
movzx eax, byte [0x1400064a2]
mov byte [rbp - 0x5e], al
mov byte [rbp - 0x5d], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
movups xmmword [rbp + 0x54], xmm0
mov dword [rbp - 0x20], 0xb
movdqa xmm6, xmmword [0x140006770]
mov edx, r14d
mov rcx, r14
nop
lea rax, [rbp - 0x68]
movdqu xmm0, xmmword [rax + rcx]
xorps xmm0, xmm6
movdqu xmmword [rbp + rcx - 0x1c], xmm0
inc edx
lea rcx, [rcx + 1]
movsxd rax, edx
cmp rax, 0xb
jb 0x140002a70
mov ebx, dword [rbp - 0x20]
movsxd rdx, ebx
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
test ebx, ebx
jle 0x140002acd
mov rcx, rax
lea r8, [rbp - 0x1c]
sub r8, rax
mov edx, ebx
movdqu xmm0, xmmword [r8 + rcx]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140002ab2
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.1400042b0
mov r13, rax
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0xc
mov qword [rsp + 0x60], r15
movsd xmm0, qword [str.kernel32.dll]
movsd qword [rsp + 0x48], xmm0
mov eax, dword [0x140006400]
mov dword [rsp + 0x50], eax
mov byte [rsp + 0x54], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm0
movups xmmword [rbp + 0x94], xmm0
movups xmmword [rbp + 0xa4], xmm0
movups xmmword [rbp + 0xb4], xmm0
movups xmmword [rbp + 0xc4], xmm0
movups xmmword [rbp + 0xd4], xmm0
movups xmmword [rbp + 0xe4], xmm0
mov dword [rbp + 0x70], 0xc
mov edx, r14d
mov rcx, r14
nop dword [rax + rax]
lea rax, [rsp + 0x48]
movdqu xmm0, xmmword [rcx + rax]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rbp + rcx + 0x74], xmm1
inc edx
lea rcx, [rcx + 1]
movsxd rax, edx
cmp rax, 0xc
jb 0x140002b60
mov ebx, dword [rbp + 0x70]
movsxd rdx, ebx
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rsi, rax
test ebx, ebx
jle 0x140002bc7
mov rcx, rax
lea r8, [rbp + 0x74]
sub r8, rax
mov edx, ebx
nop word [rax + rax]
movdqu xmm0, xmmword [r8 + rcx]
xorps xmm0, xmm6
movdqu xmmword [rcx], xmm0
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140002bb0
mov rdi, qword gs:[0x60]
test rsi, rsi
jne 0x140002be0
mov r12, qword [rdi + 0x10]
mov qword [rsp + 0x68], r12
jmp 0x140002c3e
mov r12, r14
mov qword [rsp + 0x68], r14
mov rax, qword [rdi + 0x18]
add rax, 0x20
mov rbx, qword [rax]
cmp rbx, rax
je 0x140002c31
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x140002c16
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr]
mov r8, rax
mov rdx, rsi
call fcn.140001360
test eax, eax
je 0x140002c23
mov rbx, qword [rbx]
mov rax, qword [rdi + 0x18]
add rax, 0x20
jmp 0x140002bf3
mov r12, qword [rbx + 0x20]
mov qword [rsp + 0x68], r12
test r12, r12
jne 0x140002c3e
lea rcx, str.____module_base_not_found._n
call fcn.140001010
nop
movsxd rax, dword [r12 + 0x3c]
mov ecx, dword [rax + r12 + 0x88]
movabs r8, 0x7fffffffffffffff
movabs r9, 0x8000000000000000
mov r10d, 0x16
cmp dword [rax + r12 + 0x8c], 0
ja 0x140002cef
lea rcx, str.____eat__export_address_table__not_found._n
call fcn.140001010
nop
mov rdx, qword [r13 + 0x18]
cmp rdx, 0x10
jb 0x140002cb8
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x140002cb3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002f6b
mov rcx, r8
call fcn.1400046e4
mov rbx, r14
mov byte [r13], 0
mov qword [r13 + 0x18], r15
mov qword [r13 + 0x10], r14
mov r8d, dword [rbp - 0x38]
xor edx, edx
mov ecx, 0x1fffff
call rbx
mov qword [rbp - 0x38], rax
cmp rax, 0xffffffffffffffff
jne 0x140002f72
lea rcx, str.____an_error_occurred_when_trying_to_open_the_target_process._n
jmp 0x1400040ae
mov edx, dword [r12 + rcx + 0x20]
add rdx, r12
mov qword [rbp - 0x40], rdx
mov eax, dword [r12 + rcx + 0x1c]
add rax, r12
mov qword [rsp + 0x78], rax
mov eax, dword [r12 + rcx + 0x24]
add rax, r12
mov qword [rbp - 0x30], rax
mov ecx, dword [r12 + rcx + 0x18]
mov qword [rbp - 0x48], rcx
mov rax, r14
mov qword [rsp + 0x70], rax
test rcx, rcx
je 0x140002c7d
nop
mov r15, rcx
sub r15, rax
shr r15, 1
add r15, rax
mov r14d, dword [rdx + r15*4]
add r14, r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r14 + rbx], 0
jne 0x140002d52
cmp rbx, r8
ja 0x140004141
cmp rbx, 0x10
jae 0x140002da2
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 0xf
mov r8, rbx
mov rdx, r14
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x48], 0
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
jmp 0x140002e2a
mov rdi, rbx
or rdi, 0xf
cmp rdi, r8
jbe 0x140002db7
mov rdi, r8
lea rax, [r9 + 0x27]
jmp 0x140002dd9
cmp rdi, 0x16
cmovb rdi, r10
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140002df8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000413b
mov rcx, rax
call fcn.1400046a0
test rax, rax
je 0x140002efb
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140002e09
test rcx, rcx
je 0x140002e07
call fcn.1400046a0
mov rsi, rax
jmp 0x140002e09
xor esi, esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rdi
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
lea rdx, [rsp + 0x48]
cmp rdi, 0x10
setae byte [rsp + 0x40]
cmovae rdx, rsi
mov r12, qword [r13 + 0x10]
mov rcx, r13
cmp qword [r13 + 0x18], 0x10
jb 0x140002e4e
mov rcx, qword [r13]
mov r8, r12
cmp rbx, r12
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
mov r14d, eax
test eax, eax
jne 0x140002e79
cmp r12, rbx
jae 0x140002e6f
lea r14d, [rax - 1]
jmp 0x140002e79
xor r14d, r14d
cmp r12, rbx
seta r14b
cmp byte [rsp + 0x40], 0
je 0x140002ead
lea rdx, [rdi + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140002ea5
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002efb
mov rcx, rsi
call fcn.1400046e4
test r14d, r14d
je 0x140002f0e
jle 0x140002ec2
mov rax, r15
mov qword [rsp + 0x70], rax
mov rcx, qword [rbp - 0x48]
jmp 0x140002ece
mov rcx, r15
mov qword [rbp - 0x48], rcx
mov rax, qword [rsp + 0x70]
cmp rcx, rax
je 0x140002f02
mov r12, qword [rsp + 0x68]
mov rdx, qword [rbp - 0x40]
movabs r8, 0x7fffffffffffffff
movabs r9, 0x8000000000000000
mov r10d, 0x16
jmp 0x140002d30
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor r14d, r14d
lea r15d, [r14 + 0xf]
jmp 0x140002c7d
mov rax, qword [rbp - 0x30]
movzx eax, word [rax + r15*2]
mov rcx, qword [rsp + 0x78]
mov ebx, dword [rcx + rax*4]
add rbx, qword [rsp + 0x68]
mov rdx, qword [r13 + 0x18]
cmp rdx, 0x10
jb 0x140002f5b
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x140002f56
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002f6b
mov rcx, r8
call fcn.1400046e4
xor r14d, r14d
lea r15d, [r14 + 0xf]
mov byte [r13], r14b
jmp 0x140002cc0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, str.___process_opened_successfully._n
call fcn.140001010
lea rcx, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae rcx, qword [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cdqe
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x100]
mov qword [rbp - 0x70], rax
mov word [rbp - 0x5a], 0
mov qword [rbp - 0x58], 0xe
mov qword [rbp - 0x50], r15
movsd xmm0, qword [str.VirtualAllocEx]
movsd qword [rbp - 0x68], xmm0
mov eax, dword [0x140006438]
mov dword [rbp - 0x60], eax
movzx eax, word [0x14000643c]
mov word [rbp - 0x5c], ax
xorps xmm0, xmm0
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm0
movups xmmword [rbp + 0x94], xmm0
movups xmmword [rbp + 0xa4], xmm0
movups xmmword [rbp + 0xb4], xmm0
movups xmmword [rbp + 0xc4], xmm0
movups xmmword [rbp + 0xd4], xmm0
movups xmmword [rbp + 0xe4], xmm0
mov dword [rbp + 0x70], 0xe
mov edx, r14d
mov rcx, r14
movabs r8, 0x416c617574726956
lea rax, [rbp - 0x68]
cmp r15, 0x10
cmovae rax, r8
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rbp + rcx + 0x74], xmm1
inc edx
lea rcx, [rcx + 1]
movsxd rax, edx
cmp rax, 0xe
jb 0x140003030
cmp r15, 0x10
jb 0x140003099
lea rdx, [r15 + 1]
cmp rdx, 0x1000
jb 0x140003091
add rdx, 0x27
movabs rax, 0x416c61757472694e
mov r8, qword [rax]
sub rax, r8
cmp rax, 0x1f
jbe 0x140003091
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.1400046e4
mov ebx, dword [rbp + 0x70]
movsxd rdx, ebx
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
test ebx, ebx
jle 0x1400030db
mov rcx, rax
lea r8, [rbp + 0x74]
sub r8, rax
mov edx, ebx
nop word [rax + rax]
movdqu xmm0, xmmword [r8 + rcx]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1400030c0
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.1400042b0
mov r13, rax
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0xc
mov qword [rsp + 0x60], r15
movsd xmm0, qword [str.kernel32.dll]
movsd qword [rsp + 0x48], xmm0
mov eax, dword [0x140006400]
mov dword [rsp + 0x50], eax
mov byte [rsp + 0x54], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
movups xmmword [rbp + 0x54], xmm0
mov dword [rbp - 0x20], 0xc
mov edx, r14d
mov rcx, r14
movabs r8, 0x32336c656e72656b
nop
lea rax, [rsp + 0x48]
cmp r15, 0x10
cmovae rax, r8
movdqu xmm0, xmmword [rcx + rax]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rbp + rcx - 0x1c], xmm1
inc edx
lea rcx, [rcx + 1]
movsxd rax, edx
cmp rax, 0xc
jb 0x140003160
cmp r15, 0x10
jb 0x1400031ca
lea rdx, [r15 + 1]
mov rcx, r8
cmp rdx, 0x1000
jb 0x1400031c5
add rdx, 0x27
movabs rax, 0x32336c656e726563
mov rcx, qword [rax]
sub rax, rcx
cmp rax, 0x1f
jbe 0x1400031c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400046e4
mov ebx, dword [rbp - 0x20]
movsxd rdx, ebx
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rsi, rax
test ebx, ebx
jle 0x140003207
mov rcx, rax
lea r8, [rbp - 0x1c]
sub r8, rax
mov edx, ebx
nop
movdqu xmm0, xmmword [r8 + rcx]
xorps xmm0, xmm6
movdqu xmmword [rcx], xmm0
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1400031f0
mov rdi, qword gs:[0x60]
test rsi, rsi
jne 0x140003220
mov r12, qword [rdi + 0x10]
mov qword [rsp + 0x68], r12
jmp 0x14000327e
mov r12, r14
mov qword [rsp + 0x68], r14
mov rax, qword [rdi + 0x18]
add rax, 0x20
mov rbx, qword [rax]
cmp rbx, rax
je 0x140003271
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x140003256
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr]
mov r8, rax
mov rdx, rsi
call fcn.140001360
test eax, eax
je 0x140003263
mov rbx, qword [rbx]
mov rax, qword [rdi + 0x18]
add rax, 0x20
jmp 0x140003233
mov r12, qword [rbx + 0x20]
mov qword [rsp + 0x68], r12
test r12, r12
jne 0x14000327e
lea rcx, str.____module_base_not_found._n
call fcn.140001010
nop
movsxd rax, dword [r12 + 0x3c]
mov ecx, dword [rax + r12 + 0x88]
cmp dword [rax + r12 + 0x8c], 0
ja 0x140003325
lea rcx, str.____eat__export_address_table__not_found._n
call fcn.140001010
nop
mov rdx, qword [r13 + 0x18]
cmp rdx, 0x10
jb 0x1400032e2
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x1400032dd
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400035ab
mov rcx, r8
call fcn.1400046e4
mov rbx, r14
mov byte [r13], 0
mov qword [r13 + 0x18], r15
mov qword [r13 + 0x10], r14
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, qword [rbp - 0x80]
xor edx, edx
mov rcx, qword [rbp - 0x38]
call rbx
mov qword [rbp - 0x40], rax
test rax, rax
jne 0x1400035b2
lea rcx, str.____an_error_is_occured_when_trying_to_allocate_memory_in_the_target_process._n
jmp 0x1400040ae
mov edx, dword [r12 + rcx + 0x20]
add rdx, r12
mov qword [rsp + 0x78], rdx
mov eax, dword [r12 + rcx + 0x1c]
add rax, r12
mov qword [rbp - 0x40], rax
mov eax, dword [r12 + rcx + 0x24]
add rax, r12
mov qword [rbp - 0x30], rax
mov ecx, dword [r12 + rcx + 0x18]
mov qword [rsp + 0x70], rcx
mov rax, r14
mov qword [rbp - 0x48], rax
test rcx, rcx
je 0x1400032a7
nop dword [rax]
nop dword [rax + rax]
mov r15, rcx
sub r15, rax
shr r15, 1
add r15, rax
mov r14d, dword [rdx + r15*4]
add r14, r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r14 + rbx], 0
jne 0x140003392
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x14000414d
cmp rbx, 0x10
jae 0x1400033ed
mov qword [rsp + 0x58], rbx
mov eax, 0xf
mov qword [rsp + 0x60], rax
mov r8, rbx
mov rdx, r14
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x48], 0
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
jmp 0x140003484
mov rdi, rbx
or rdi, 0xf
cmp rdi, rax
jbe 0x14000340c
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140003433
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140003452
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004147
mov rcx, rax
call fcn.1400046a0
test rax, rax
je 0x14000353c
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140003463
test rcx, rcx
je 0x140003461
call fcn.1400046a0
mov rsi, rax
jmp 0x140003463
xor esi, esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rdi
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
lea rdx, [rsp + 0x48]
cmp rdi, 0x10
setae byte [rsp + 0x40]
cmovae rdx, rsi
mov r12, qword [r13 + 0x10]
mov rcx, r13
cmp qword [r13 + 0x18], 0x10
jb 0x1400034a8
mov rcx, qword [r13]
mov r8, r12
cmp rbx, r12
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
mov r14d, eax
test eax, eax
jne 0x1400034d3
cmp r12, rbx
jae 0x1400034c9
lea r14d, [rax - 1]
jmp 0x1400034d3
xor r14d, r14d
cmp r12, rbx
seta r14b
cmp byte [rsp + 0x40], 0
je 0x140003507
lea rdx, [rdi + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400034ff
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000353c
mov rcx, rsi
call fcn.1400046e4
test r14d, r14d
je 0x14000354f
jle 0x14000351c
mov rax, r15
mov qword [rbp - 0x48], rax
mov rcx, qword [rsp + 0x70]
jmp 0x140003528
mov rcx, r15
mov qword [rsp + 0x70], rcx
mov rax, qword [rbp - 0x48]
cmp rcx, rax
je 0x140003543
mov r12, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x78]
jmp 0x140003370
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor r14d, r14d
lea r15d, [r14 + 0xf]
jmp 0x1400032a7
mov rax, qword [rbp - 0x30]
movzx eax, word [rax + r15*2]
mov rcx, qword [rbp - 0x40]
mov ebx, dword [rcx + rax*4]
add rbx, qword [rsp + 0x68]
mov rdx, qword [r13 + 0x18]
cmp rdx, 0x10
jb 0x14000359b
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x140003596
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400035ab
mov rcx, r8
call fcn.1400046e4
xor r14d, r14d
lea r15d, [r14 + 0xf]
mov byte [r13], r14b
jmp 0x1400032ea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov edx, eax
lea rcx, str.___memory_allocated_at_0x_X._n
call fcn.140001010
lea rcx, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae rcx, qword [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cdqe
mov qword [rbp - 0x78], rax
lea rax, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae rax, qword [rbp + 0x160]
mov qword [rbp - 0x70], rax
lea rax, [rbp + 0x100]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x50], r14
mov ebx, 0x20
mov ecx, ebx
call fcn.1400046a0
mov r8, rax
mov edx, 0x1f
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], 0x12
mov qword [rsp + 0x60], rdx
movups xmm0, xmmword [str.WriteProcessMemory]
movups xmmword [rax], xmm0
movzx eax, word [0x140006450]
mov word [r8 + 0x10], ax
mov byte [r8 + 0x12], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm0
movups xmmword [rbp + 0x94], xmm0
movups xmmword [rbp + 0xa4], xmm0
movups xmmword [rbp + 0xb4], xmm0
movups xmmword [rbp + 0xc4], xmm0
movups xmmword [rbp + 0xd4], xmm0
movups xmmword [rbp + 0xe4], xmm0
mov dword [rbp + 0x70], 0x12
mov r9d, r14d
mov rcx, r14
nop word [rax + rax]
movdqu xmm0, xmmword [r8 + rcx]
xorps xmm0, xmm6
movdqu xmmword [rbp + rcx + 0x74], xmm0
inc r9d
lea rcx, [rcx + 1]
cmp r9d, 0x12
jb 0x1400036a0
mov rdx, rbx
mov rcx, r8
call fcn.1400046e4
mov ebx, dword [rbp + 0x70]
movsxd rdx, ebx
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
test ebx, ebx
jle 0x14000370b
mov rcx, rax
lea r8, [rbp + 0x74]
sub r8, rax
mov edx, ebx
nop dword [rax + rax]
movdqu xmm0, xmmword [r8 + rcx]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1400036f0
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.1400042b0
mov r13, rax
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], 0xc
mov qword [rbp - 0x50], r15
movsd xmm0, qword [str.kernel32.dll]
movsd qword [rbp - 0x68], xmm0
mov eax, dword [0x140006400]
mov dword [rbp - 0x60], eax
mov byte [rbp - 0x5c], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
movups xmmword [rbp + 0x54], xmm0
mov dword [rbp - 0x20], 0xc
mov edx, r14d
mov rcx, r14
movabs r8, 0x32336c656e72656b
nop dword [rax + rax]
lea rax, [rbp - 0x68]
cmp r15, 0x10
cmovae rax, r8
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rbp + rcx - 0x1c], xmm1
inc edx
lea rcx, [rcx + 1]
movsxd rax, edx
cmp rax, 0xc
jb 0x140003790
cmp r15, 0x10
jb 0x1400037fc
lea rdx, [r15 + 1]
cmp rdx, 0x1000
jb 0x1400037f1
add rdx, 0x27
movabs rcx, 0x32336c656e726563
mov rax, qword [rcx]
sub rcx, rax
cmp rcx, 0x1f
jbe 0x1400037f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, r8
mov rcx, rax
call fcn.1400046e4
mov ebx, dword [rbp - 0x20]
movsxd rdx, ebx
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rsi, rax
test ebx, ebx
jle 0x14000383b
mov rcx, rax
lea r8, [rbp - 0x1c]
sub r8, rax
mov edx, ebx
movdqu xmm0, xmmword [r8 + rcx]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140003820
mov rdi, qword gs:[0x60]
test rsi, rsi
jne 0x140003854
mov r12, qword [rdi + 0x10]
mov qword [rsp + 0x68], r12
jmp 0x1400038b2
mov r12, r14
mov qword [rsp + 0x68], r14
mov rax, qword [rdi + 0x18]
add rax, 0x20
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400038a5
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x14000388a
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr]
mov r8, rax
mov rdx, rsi
call fcn.140001360
test eax, eax
je 0x140003897
mov rbx, qword [rbx]
mov rax, qword [rdi + 0x18]
add rax, 0x20
jmp 0x140003867
mov r12, qword [rbx + 0x20]
mov qword [rsp + 0x68], r12
test r12, r12
jne 0x1400038b2
lea rcx, str.____module_base_not_found._n
call fcn.140001010
nop
movsxd rax, dword [r12 + 0x3c]
mov ecx, dword [rax + r12 + 0x88]
cmp dword [rax + r12 + 0x8c], 0
ja 0x140003951
lea rcx, str.____eat__export_address_table__not_found._n
call fcn.140001010
nop
mov rdx, qword [r13 + 0x18]
cmp rdx, 0x10
jb 0x140003916
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x140003911
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003bcb
mov rcx, r8
call fcn.1400046e4
mov rbx, r14
mov byte [r13], 0
mov qword [r13 + 0x18], r15
mov qword [r13 + 0x10], r14
mov qword [rsp + 0x20], r14
mov r9, qword [rbp - 0x78]
mov r8, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
call rbx
test eax, eax
jne 0x140003bd2
lea rcx, str.____an_error_is_occured_when_trying_to_write_the_DLL_path_in_the_target_process._n
jmp 0x1400040ae
mov edx, dword [rcx + r12 + 0x20]
add rdx, r12
mov qword [rbp - 0x80], rdx
mov eax, dword [rcx + r12 + 0x1c]
add rax, r12
mov qword [rbp - 0x30], rax
mov eax, dword [rcx + r12 + 0x24]
add rax, r12
mov qword [rsp + 0x78], rax
mov ecx, dword [rcx + r12 + 0x18]
mov qword [rsp + 0x70], rcx
mov rax, r14
mov qword [rbp - 0x48], rax
test rcx, rcx
je 0x1400038db
mov r15, rcx
sub r15, rax
shr r15, 1
add r15, rax
mov r14d, dword [rdx + r15*4]
add r14, r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r14 + rbx], 0
jne 0x1400039b2
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140004159
cmp rbx, 0x10
jae 0x140003a0d
mov qword [rsp + 0x58], rbx
mov eax, 0xf
mov qword [rsp + 0x60], rax
mov r8, rbx
mov rdx, r14
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x48], 0
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
jmp 0x140003aa4
mov rdi, rbx
or rdi, 0xf
cmp rdi, rax
jbe 0x140003a2c
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140003a53
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140003a72
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004153
mov rcx, rax
call fcn.1400046a0
test rax, rax
je 0x140003b5b
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140003a83
test rcx, rcx
je 0x140003a81
call fcn.1400046a0
mov rsi, rax
jmp 0x140003a83
xor esi, esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rdi
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
lea rdx, [rsp + 0x48]
cmp rdi, 0x10
setae byte [rsp + 0x40]
cmovae rdx, rsi
mov r12, qword [r13 + 0x10]
mov rcx, r13
cmp qword [r13 + 0x18], 0x10
jb 0x140003ac8
mov rcx, qword [r13]
mov r8, r12
cmp rbx, r12
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
mov r14d, eax
test eax, eax
jne 0x140003af3
cmp r12, rbx
jae 0x140003ae9
lea r14d, [rax - 1]
jmp 0x140003af3
xor r14d, r14d
cmp r12, rbx
seta r14b
cmp byte [rsp + 0x40], 0
je 0x140003b27
lea rdx, [rdi + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140003b1f
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b5b
mov rcx, rsi
call fcn.1400046e4
test r14d, r14d
je 0x140003b6e
jle 0x140003b3c
mov rax, r15
mov qword [rbp - 0x48], rax
mov rcx, qword [rsp + 0x70]
jmp 0x140003b48
mov rcx, r15
mov qword [rsp + 0x70], rcx
mov rax, qword [rbp - 0x48]
cmp rcx, rax
je 0x140003b62
mov r12, qword [rsp + 0x68]
mov rdx, qword [rbp - 0x80]
jmp 0x140003990
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor r14d, r14d
lea r15d, [r14 + 0xf]
jmp 0x1400038db
mov rax, qword [rsp + 0x78]
movzx eax, word [rax + r15*2]
mov rcx, qword [rbp - 0x30]
mov ebx, dword [rcx + rax*4]
add rbx, qword [rsp + 0x68]
mov rdx, qword [r13 + 0x18]
cmp rdx, 0x10
jb 0x140003bbb
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x140003bb6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003bcb
mov rcx, r8
call fcn.1400046e4
xor r14d, r14d
lea r15d, [r14 + 0xf]
mov byte [r13], r14b
jmp 0x14000391e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, str.___dll_path_writen_successfully._n
call fcn.140001010
mov rdi, qword gs:[0x60]
mov rsi, r14
mov qword [rsp + 0x70], r14
mov rax, qword [rdi + 0x18]
add rax, 0x20
mov rbx, qword [rax]
cmp rbx, rax
je 0x140003c3c
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x140003c21
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr]
mov r8, rax
lea rdx, str.kernel32.dll
call fcn.140001360
test eax, eax
je 0x140003c2e
mov rbx, qword [rbx]
mov rax, qword [rdi + 0x18]
add rax, 0x20
jmp 0x140003bfa
mov rsi, qword [rbx + 0x20]
mov qword [rsp + 0x70], rsi
test rsi, rsi
jne 0x140003c48
lea rcx, str.____module_base_not_found._n
call fcn.140001010
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400040b3
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 0xc
mov qword [rsp + 0x60], r15
movsd xmm0, qword [str.LoadLibraryA]
movsd qword [rsp + 0x48], xmm0
mov eax, dword [0x140006428]
mov dword [rsp + 0x50], eax
mov byte [rsp + 0x54], 0
lea rax, [rsp + 0x48]
mov qword [rbp - 0x28], rax
movsxd rax, dword [rsi + 0x3c]
mov edx, dword [rax + rsi + 0x88]
cmp dword [rax + rsi + 0x8c], 0
ja 0x140003cfe
lea rcx, str.____eat__export_address_table__not_found._n
call fcn.140001010
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140003cf4
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003cef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003cef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400046e4
mov byte [rsp + 0x48], 0
jmp 0x1400040a7
mov eax, dword [rdx + rsi + 0x20]
add rax, rsi
mov qword [rbp - 0x70], rax
mov ecx, dword [rdx + rsi + 0x1c]
add rcx, rsi
mov qword [rbp - 0x80], rcx
mov ecx, dword [rdx + rsi + 0x24]
add rcx, rsi
mov qword [rbp - 0x78], rcx
mov r13d, dword [rdx + rsi + 0x18]
mov r12, r14
test r13, r13
je 0x14000409d
mov r14, r13
sub r14, r12
shr r14, 1
add r14, r12
mov r15d, dword [rax + r14*4]
add r15, rsi
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r15 + rbx], 0
jne 0x140003d51
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140004135
cmp rbx, 0x10
jae 0x140003d9a
mov qword [rbp - 0x58], rbx
mov eax, 0xf
mov qword [rbp - 0x50], rax
mov r8, rbx
mov rdx, r15
lea rcx, [rbp - 0x68]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x68], 0
jmp 0x140003e2f
mov rdi, rbx
or rdi, 0xf
cmp rdi, rax
jbe 0x140003db9
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140003de0
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140003dfb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000415f
mov rcx, rax
call fcn.1400046a0
test rax, rax
je 0x140003e68
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140003e0c
test rcx, rcx
je 0x140003e0a
call fcn.1400046a0
mov rsi, rax
jmp 0x140003e0c
xor esi, esi
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], rdi
mov r8, rbx
mov rdx, r15
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
mov rsi, qword [rsp + 0x70]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x48]
call fcn.1400041e0
mov ebx, eax
lea rcx, [rbp - 0x68]
call fcn.140004250
test ebx, ebx
je 0x140003e6f
jle 0x140003e53
mov r12, r14
jmp 0x140003e56
mov r13, r14
cmp r13, r12
je 0x14000409d
mov rax, qword [rbp - 0x70]
jmp 0x140003d30
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rbp - 0x78]
movzx eax, word [rax + r14*2]
mov rcx, qword [rbp - 0x80]
mov r12d, dword [rcx + rax*4]
lea rcx, [rsp + 0x48]
call fcn.140004250
add r12, rsi
je 0x1400040a7
mov edx, r12d
lea rcx, str.___loadlibrary_address_at_0x_X._n
call fcn.140001010
lea rax, [rbp - 0x68]
mov qword [rbp - 0x28], rax
lea rdx, str.CreateRemoteThread
lea rcx, [rbp + 0x100]
call fcn.1400042b0
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140001230
mov rcx, rax
call fcn.140001310
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.1400042b0
mov r13, rax
mov qword [rsp + 0x78], rax
lea rdx, str.kernel32.dll
lea rcx, [rbp + 0x120]
call fcn.1400042b0
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140001230
mov rcx, rax
call fcn.140001310
mov rsi, rax
mov rdi, qword gs:[0x60]
xor r15d, r15d
test rax, rax
jne 0x140003f26
mov r14, qword [rdi + 0x10]
jmp 0x140003f7a
mov r14, r15
mov rax, qword [rdi + 0x18]
add rax, 0x20
mov rbx, qword [rax]
cmp rbx, rax
je 0x140003f6d
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x140003f57
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr]
mov r8, rax
mov rdx, rsi
call fcn.140001360
test eax, eax
je 0x140003f64
mov rbx, qword [rbx]
mov rax, qword [rdi + 0x18]
add rax, 0x20
jmp 0x140003f34
mov r14, qword [rbx + 0x20]
test r14, r14
jne 0x140003f7a
lea rcx, str.____module_base_not_found._n
call fcn.140001010
nop
movsxd rax, dword [r14 + 0x3c]
mov edx, dword [rax + r14 + 0x88]
cmp dword [rax + r14 + 0x8c], 0
ja 0x140003fe0
lea rcx, str.____eat__export_address_table__not_found._n
call fcn.140001010
nop
mov rcx, r13
call fcn.140004250
mov rbx, r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov rax, qword [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9, r12
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x38]
call rbx
cmp rax, 0xffffffffffffffff
jne 0x14000408f
lea rcx, str.____an_error_is_occured_when_trying_to_create_the_thread_in_the_target_process._n
jmp 0x1400040ae
mov ecx, dword [rdx + r14 + 0x20]
add rcx, r14
mov qword [rbp - 0x70], rcx
mov eax, dword [rdx + r14 + 0x1c]
add rax, r14
mov qword [rbp - 0x80], rax
mov eax, dword [rdx + r14 + 0x24]
add rax, r14
mov qword [rbp - 0x78], rax
mov ebx, dword [rdx + r14 + 0x18]
mov rdi, r15
test rbx, rbx
je 0x140003f9e
mov rsi, rbx
sub rsi, rdi
shr rsi, 1
add rsi, rdi
mov edx, dword [rcx + rsi*4]
add rdx, r14
lea rcx, [rbp + 0x140]
call fcn.1400042b0
mov rdx, rax
mov rcx, r13
call fcn.1400041e0
mov r15d, eax
lea rcx, [rbp + 0x140]
call fcn.140004250
test r15d, r15d
je 0x14000406d
mov rax, rsi
cmovle rax, rdi
mov rdi, rax
cmovle rbx, rsi
cmp rbx, rax
mov rcx, qword [rbp - 0x70]
jne 0x140004011
xor r15d, r15d
jmp 0x140003f9e
mov rax, qword [rbp - 0x78]
movzx eax, word [rax + rsi*2]
mov rcx, qword [rbp - 0x80]
mov ebx, dword [rcx + rax*4]
add rbx, r14
mov rcx, r13
call fcn.140004250
xor r15d, r15d
jmp 0x140003fa9
lea rcx, str.___injected._n
call fcn.140001010
jmp 0x1400040b9
lea rcx, [rsp + 0x48]
call fcn.140004250
lea rcx, str.____an_error_is_occured_when_trying_to_get__loadlibrarya__address._n
call fcn.140001010
mov r15d, 0xffffffff
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x1400040fd
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400040f8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400046e4
mov eax, r15d
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140004680
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001210
nop
call fcn.140001170
int3
call fcn.140001210
nop
call fcn.140001170
int3
call fcn.140001210
nop
call fcn.140001170
int3
call fcn.140001210
nop
call fcn.140001170
int3