Function at 0x140002610
Capabilities:
Create process on windows
Delete file
Execute command

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2a0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rbp + 0x180], rax
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r14
mov qword [rbp + 0xa8], 0xf
mov byte [rbp + 0x90], r14b
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x68], 0xf
mov byte [rbp + 0x50], r14b
lea rdx, str.Checking_Requirements...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005560
mov rcx, rax
lea rdx, [0x140005520]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x100], xmm1
mov ecx, 0xc0
call fcn.140006180
mov rdx, rax
mov qword [rbp + 0xf0], rax
movdqa xmm0, xmmword [0x140008e60]
movdqu xmmword [rbp + 0x100], xmm0
lea rdi, [0x140000000]
lea rax, [rdi + 0x8870]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x70]
movups xmmword [rdx + 0x70], xmm0
movups xmm1, xmmword [rax + 0x80]
movups xmmword [rdx + 0x80], xmm1
movups xmm0, xmmword [rax + 0x90]
movups xmmword [rdx + 0x90], xmm0
movups xmm1, xmmword [rax + 0xa0]
movups xmmword [rdx + 0xa0], xmm1
mov eax, dword [rax + 0xb0]
mov dword [rdx + 0xb0], eax
mov byte [rdx + 0xb4], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x140008dc0]
movdqu xmmword [rsp + 0x68], xmm1
mov eax, dword [0x140008928]
mov word [rsp + 0x58], ax
movzx eax, byte [0x14000892a]
mov byte [rsp + 0x5a], al
mov byte [rsp + 0x5b], r14b
lea r8, [rsp + 0x58]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0xf0]
call fcn.140001770
movzx ebx, al
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x1400027f6
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
movdqa xmm6, xmmword [0x140008db0]
test bl, bl
jne 0x1400028bf
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov ecx, 0x30
call fcn.140006180
mov rdx, rax
mov qword [rsp + 0x58], rax
movdqa xmm0, xmmword [0x140008e10]
movdqu xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [str.Failed_to_download_the_main_executable.]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140008940]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x140008950]
mov dword [rax + 0x20], ecx
movzx eax, word [0x140008954]
mov word [rdx + 0x24], ax
movzx eax, byte [0x140008956]
mov byte [rdx + 0x26], al
mov byte [rdx + 0x27], bl
lea rcx, [rsp + 0x58]
call fcn.140001290
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140003bb2
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b97
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, [rbp + 0x90]
call fcn.140001d70
test al, al
jne 0x140002a51
mov r13, qword [rbp + 0xa0]
movabs rdi, 0x7fffffffffffffff
mov rax, rdi
sub rax, r13
cmp rax, 0x29
jb 0x140003cf6
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rdx, qword [rbp + 0x90]
mov qword [rsp + 0x50], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
lea r12, [r13 + 0x29]
mov esi, 0xf
lea rbx, [rsp + 0x78]
cmp r12, rsi
jbe 0x1400029bb
mov rsi, r12
or rsi, 0xf
cmp rsi, rdi
jbe 0x140002976
mov rsi, rdi
movabs r14, 0x8000000000000000
add r14, 0x27
mov rcx, r14
call fcn.140006180
test rax, rax
je 0x140002a4a
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
xor r14d, r14d
jmp 0x1400029b1
mov r15d, 0x16
cmp rsi, r15
cmovb rsi, r15
lea rcx, [rsi + 1]
test rcx, rcx
jne 0x140002991
mov rbx, r14
jmp 0x1400029b6
cmp rcx, 0x1000
jb 0x1400029a9
lea r14, [rcx + 0x27]
cmp r14, rcx
jbe 0x140003cd2
jmp 0x140002954
call fcn.140006180
mov rbx, rax
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], rsi
movups xmm0, xmmword [str.Downloaded_executable_is_not_accessible:]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x140008968]
movups xmmword [rbx + 0x10], xmm1
movsd xmm0, qword [0x140008978]
movsd qword [rbx + 0x20], xmm0
movzx eax, byte [0x140008980]
mov byte [rbx + 0x28], al
lea rcx, [rbx + 0x29]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r12], 0
lea rcx, [rsp + 0x78]
call fcn.140001290
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140003bb2
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b97
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x114], xmm0
movups xmmword [rbp + 0x124], xmm0
movups xmmword [rbp + 0x134], xmm0
movups xmmword [rbp + 0x144], xmm0
movups xmmword [rbp + 0x154], xmm0
movups xmmword [rbp + 0x164], xmm0
mov dword [rbp + 0x174], eax
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x110], 0x68
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x110]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140002ba1
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov ecx, 0x40
call fcn.140006180
mov rcx, rax
mov qword [rsp + 0x58], rax
movdqa xmm0, xmmword [0x140008e50]
movdqu xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [str.Failed_to_create_process_for_the_main_executable.]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140008998]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1400089a8]
movups xmmword [rax + 0x20], xmm0
movzx eax, byte [0x1400089b8]
mov byte [rcx + 0x30], al
mov byte [rcx + 0x31], 0
lea rcx, [rsp + 0x58]
call fcn.140001290
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140003bb2
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b97
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
jmp 0x140003bb2
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14000875c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Injecting_Cheat...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005560
mov rcx, rax
lea rdx, [0x140005520]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe0], xmm1
mov ecx, 0xc0
call fcn.140006180
mov rdx, rax
mov qword [rbp + 0xd0], rax
movdqa xmm0, xmmword [0x140008e60]
movdqu xmmword [rbp + 0xe0], xmm0
lea rax, [rdi + 0x89e0]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx + 0x70], xmm1
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rdx + 0x80], xmm0
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rdx + 0x90], xmm1
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rdx + 0xa0], xmm0
mov eax, dword [rax + 0xb0]
mov dword [rdx + 0xb0], eax
mov byte [rdx + 0xb4], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x140008dc0]
movdqu xmmword [rsp + 0x68], xmm1
mov eax, dword [0x140008a98]
mov word [rsp + 0x58], ax
movzx eax, byte [0x140008a9a]
mov byte [rsp + 0x5a], al
mov byte [rsp + 0x5b], 0
lea r8, [rsp + 0x58]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0xd0]
call fcn.140001770
movzx ebx, al
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140002d38
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002d33
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
test bl, bl
jne 0x140002df2
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov ecx, 0x20
call fcn.140006180
mov rdx, rax
mov qword [rsp + 0x58], rax
movdqa xmm0, xmmword [0x140008de0]
movdqu xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [str.Failed_to_download_the_DLL.]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140008ab0]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x140008ab8]
mov word [rax + 0x18], cx
movzx eax, byte [0x140008aba]
mov byte [rdx + 0x1a], al
mov byte [rdx + 0x1b], bl
lea rcx, [rsp + 0x58]
call fcn.140001290
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140003b5f
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002f61
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, [rbp + 0x50]
call fcn.140001d70
test al, al
jne 0x140002f6b
mov r13, qword [rbp + 0x60]
movabs rdi, 0x7fffffffffffffff
mov rax, rdi
sub rax, r13
cmp rax, 0x22
jb 0x140003cfc
lea rdx, [rbp + 0x50]
cmp qword [rbp + 0x68], 0xf
cmova rdx, qword [rbp + 0x50]
mov qword [rsp + 0x50], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
lea r12, [r13 + 0x22]
mov ebx, 0xf
lea rsi, [rsp + 0x78]
cmp r12, rbx
jbe 0x140002edf
mov rbx, r12
or rbx, 0xf
cmp rbx, rdi
jbe 0x140002e9a
mov rbx, rdi
movabs r14, 0x8000000000000000
add r14, 0x27
mov rcx, r14
call fcn.140006180
test rax, rax
je 0x140002f5a
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
xor r14d, r14d
jmp 0x140002ed5
mov r15d, 0x16
cmp rbx, r15
cmovb rbx, r15
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140002eb5
mov rsi, r14
jmp 0x140002eda
cmp rcx, 0x1000
jb 0x140002ecd
lea r14, [rcx + 0x27]
cmp r14, rcx
jbe 0x140003cd8
jmp 0x140002e78
call fcn.140006180
mov rsi, rax
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], rbx
movups xmm0, xmmword [str.Downloaded_DLL_is_not_accessible:]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [0x140008ad0]
movups xmmword [rsi + 0x10], xmm1
movzx eax, word [0x140008ae0]
mov word [rsi + 0x20], ax
lea rcx, [rsi + 0x22]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r12], 0
lea rcx, [rsp + 0x78]
call fcn.140001290
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140003b5f
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002f61
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
jmp 0x140003b5f
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc0], xmm1
mov ecx, 0xc0
call fcn.140006180
mov r8, rax
mov qword [rbp + 0xb0], rax
movdqa xmm0, xmmword [0x140008e70]
movdqu xmmword [rbp + 0xc0], xmm0
lea rcx, [rdi + 0x8af0]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rdx, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rax, qword [rcx + 0x30]
mov qword [rdx + 0x30], rax
movzx eax, word [rcx + 0x38]
mov word [rdx + 0x38], ax
movzx eax, byte [rcx + 0x3a]
mov byte [rdx + 0x3a], al
mov byte [r8 + 0xbb], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x140008dc0]
movdqu xmmword [rsp + 0x68], xmm1
mov eax, dword [0x140008bac]
mov word [rsp + 0x58], ax
movzx eax, byte [0x140008bae]
mov byte [rsp + 0x5a], al
mov byte [rsp + 0x5b], 0
lea r8, [rsp + 0x58]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0xb0]
call fcn.140001770
movzx ebx, al
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x1400030c9
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400030c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400030c4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
test bl, bl
jne 0x14000318e
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov ecx, 0x30
call fcn.140006180
mov rcx, rax
mov qword [rsp + 0x58], rax
movdqa xmm0, xmmword [0x140008e40]
movdqu xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [str.Failed_to_download_the_injector_executable.]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140008bc0]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x140008bd0]
movsd qword [rax + 0x20], xmm0
movzx eax, word [0x140008bd8]
mov word [rcx + 0x28], ax
movzx eax, byte [0x140008bda]
mov byte [rcx + 0x2a], al
mov byte [rcx + 0x2b], bl
lea rcx, [rsp + 0x58]
call fcn.140001290
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140003abe
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003310
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003310
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, [rbp + 0x30]
call fcn.140001d70
mov r13, qword [rbp + 0x40]
movabs rdi, 0x7fffffffffffffff
test al, al
mov rax, rdi
jne 0x14000331a
sub rax, r13
cmp rax, 0x27
jb 0x140003d02
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0xf
cmova rdx, qword [rbp + 0x30]
mov qword [rsp + 0x50], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
lea r12, [r13 + 0x27]
mov esi, 0xf
lea rbx, [rsp + 0x78]
cmp r12, rsi
jbe 0x14000327b
mov rsi, r12
or rsi, 0xf
cmp rsi, rdi
jbe 0x140003236
mov rsi, rdi
movabs r14, 0x8000000000000000
add r14, 0x27
mov rcx, r14
call fcn.140006180
test rax, rax
je 0x140003309
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
xor r14d, r14d
jmp 0x140003271
mov r15d, 0x16
cmp rsi, r15
cmovb rsi, r15
lea rcx, [rsi + 1]
test rcx, rcx
jne 0x140003251
mov rbx, r14
jmp 0x140003276
cmp rcx, 0x1000
jb 0x140003269
lea r14, [rcx + 0x27]
cmp r14, rcx
jbe 0x140003cde
jmp 0x140003214
call fcn.140006180
mov rbx, rax
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], rsi
movups xmm0, xmmword [str.Downloaded_injector_is_not_accessible:]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x140008bf0]
movups xmmword [rbx + 0x10], xmm1
mov eax, dword [0x140008c00]
mov dword [rbx + 0x20], eax
movzx eax, word [0x140008c04]
mov word [rbx + 0x24], ax
movzx eax, byte [0x140008c06]
mov byte [rbx + 0x26], al
lea rcx, [rbx + 0x27]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r12], 0
lea rcx, [rsp + 0x78]
call fcn.140001290
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140003abe
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003310
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003310
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
jmp 0x140003abe
sub rax, r13
cmp rax, 1
jb 0x140003d08
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 0xf
cmova rax, qword [rbp + 0x30]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
lea r12, [r13 + 1]
mov ebx, 0xf
lea rsi, [rbp - 0x48]
movabs r14, 0x8000000000000000
mov r15d, 0x16
cmp r12, rbx
jbe 0x1400033dd
mov rbx, r12
or rbx, 0xf
cmp rbx, rdi
jbe 0x140003399
mov rbx, rdi
lea rax, [r14 + 0x27]
mov rcx, rax
call fcn.140006180
test rax, rax
je 0x1400033c5
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400033d4
cmp rbx, r15
cmovb rbx, r15
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1400033ad
xor esi, esi
jmp 0x1400033d9
cmp rcx, 0x1000
jb 0x1400033cc
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003ce4
jmp 0x14000337e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006180
mov rsi, rax
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], rbx
mov byte [rsi], 0x22
lea rcx, [rsi + 1]
mov r8, r13
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r12], 0
mov r8d, 3
lea rdx, [0x140008c0c]
lea rcx, [rbp - 0x48]
call fcn.140005170
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
xor r12d, r12d
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
lea r9, [rbp + 0x50]
cmp qword [rbp + 0x68], 0xf
cmova r9, qword [rbp + 0x50]
mov rsi, qword [rbp + 0x60]
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x50]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x140003497
lea rax, [rcx + rsi]
mov qword [rbp - 0x58], rax
lea rbx, [rbp - 0x68]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x68]
add rbx, rcx
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], r12b
lea rax, [rbp - 0x68]
jmp 0x1400034a8
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rbp - 0x68]
call fcn.1400059c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x140008c08]
lea rcx, [rsp + 0x58]
call fcn.140005170
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140003566
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003561
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003561
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
movdqu xmmword [rsp + 0x68], xmm6
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x1400035af
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400035aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
movdqu xmmword [rbp - 0x58], xmm6
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x1400035f6
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400035f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
movdqu xmmword [rbp - 0x38], xmm6
mov byte [rbp - 0x48], 0
mov r13, qword [rbp + 0x80]
mov rax, rdi
sub rax, r13
cmp rax, 0x13
jb 0x140003d0e
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rdx, qword [rbp + 0x70]
mov qword [rsp + 0x50], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
lea r12, [r13 + 0x13]
mov ebx, 0xf
lea rsi, [rsp + 0x78]
cmp r12, rbx
jbe 0x1400036c0
mov rbx, r12
or rbx, 0xf
cmp rbx, rdi
jbe 0x140003681
mov rbx, rdi
lea rax, [r14 + 0x27]
mov rcx, rax
call fcn.140006180
test rax, rax
je 0x140003736
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400036b6
cmp rbx, 0x16
cmovb rbx, r15
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140003696
xor esi, esi
jmp 0x1400036bb
cmp rcx, 0x1000
jb 0x1400036ae
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003cea
jmp 0x140003662
call fcn.140006180
mov rsi, rax
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], rbx
movups xmm0, xmmword [str.Executing_command:]
movups xmmword [rsi], xmm0
movzx ecx, word [0x140008c20]
mov word [rsi + 0x10], cx
movzx eax, byte [0x140008c22]
mov byte [rsi + 0x12], al
lea rcx, [rsi + 0x13]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r12], 0
lea rcx, [rsp + 0x78]
call fcn.140001290
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140003742
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000373d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000373d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rdx, qword [rbp + 0x70]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x110]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140003a20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp - 8]
call fcn.140005380
nop
mov r13, qword [rbp + 0x80]
mov rax, rdi
sub rax, r13
cmp rax, 0x42
jb 0x140003ccc
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rdx, qword [rbp + 0x70]
mov qword [rsp + 0x50], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
lea r12, [r13 + 0x42]
mov ebx, 0xf
lea rsi, [rsp + 0x78]
cmp r12, rbx
jbe 0x140003869
mov rbx, r12
or rbx, 0xf
cmp rbx, rdi
jbe 0x14000382a
mov rbx, rdi
add r14, 0x27
mov rcx, r14
call fcn.140006180
test rax, rax
je 0x1400039ca
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000385f
cmp rbx, 0x16
cmovb rbx, r15
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14000383f
xor esi, esi
jmp 0x140003864
cmp rcx, 0x1000
jb 0x140003857
lea r14, [rcx + 0x27]
cmp r14, rcx
jbe 0x140003cf0
jmp 0x14000380b
call fcn.140006180
mov rsi, rax
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], rbx
movaps xmm0, xmmword [str.Failed_to_create_process_for_the_injector_with_DLL._Command_line:]
movups xmmword [rsi], xmm0
movaps xmm1, xmmword [0x140008c50]
movups xmmword [rsi + 0x10], xmm1
movaps xmm0, xmmword [0x140008c60]
movups xmmword [rsi + 0x20], xmm0
movaps xmm1, xmmword [0x140008c70]
movups xmmword [rsi + 0x30], xmm1
movzx eax, word [0x140008c80]
mov word [rsi + 0x40], ax
lea rcx, [rsi + 0x42]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r12], 0
mov r8d, 0xf
lea rdx, str.__Error_Code:
lea rcx, [rsp + 0x78]
call fcn.140005170
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
xor r14d, r14d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
lea r9, [rbp - 8]
lea r8, [rsp + 0x58]
lea rcx, [rbp - 0x28]
call fcn.140005b70
nop
lea rcx, [rbp - 0x28]
call fcn.140001290
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x14000394d
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003948
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003948
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
movdqu xmmword [rbp - 0x18], xmm6
mov byte [rbp - 0x28], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140003997
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003991
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003991
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x1400039d6
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400039d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400039d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
movdqu xmmword [rbp - 0x78], xmm6
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xf
jbe 0x140003a67
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003a19
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
jmp 0x140003a67
lea rcx, [rbp + 0x50]
cmp qword [rbp + 0x68], 0xf
cmova rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0xf
cmova rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r9d, 0x40
lea r8, str.UnrealWindow
lea rdx, str.Loading...
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor r14d, r14d
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x140003aa8
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003aa3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003aa3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x88], 0xf
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x140003b02
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003afd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003afd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
movdqu xmmword [rbp + 0xc0], xmm6
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x140003b4f
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b4a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x140003ba3
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b9e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
movdqu xmmword [rbp + 0xe0], xmm6
mov byte [rbp + 0xd0], 0
mov rdx, qword [rbp + 0x108]
cmp rdx, 0xf
jbe 0x140003bf6
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003bf1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003bf1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
movdqu xmmword [rbp + 0x100], xmm6
mov byte [rbp + 0xf0], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x140003c43
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c3e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x68], 0xf
mov byte [rbp + 0x50], 0
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x140003c97
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c92
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400061bc
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140006160
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
nop
call fcn.140001110
nop
call fcn.140001110
int3
call fcn.140001110
nop
call fcn.140001110
nop
call fcn.140001110
nop
call fcn.1400011b0
nop
call fcn.1400011b0
nop
call fcn.1400011b0
int3
call fcn.1400011b0
nop
call fcn.1400011b0
int3