Function at 0x14006b2d0
Capabilities:
Encode data using xor
Enumerate threads
Resume thread
Suspend thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5d8]
sub rsp, 0x6b0
mov rax, qword [0x14069f448]
xor rax, rsp
mov qword [rbp + 0x5a0], rax
mov rsi, rdx
mov qword [rbp - 0x38], rdx
mov edi, ecx
mov dword [rsp + 0x50], ecx
xor r15d, r15d
xor edx, edx
lea ecx, [rdx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov qword [rbp - 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x14006c3c0
mov dword [rbp - 0x10], 0x1c
lea rdx, [rbp - 0x10]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x14006c3b7
lea r14d, [r15 + 0xf]
movabs r12, 0xfae9e8d7c6b5a493
movabs r13, 0xaebdccdb0a192837
cmp dword [rbp - 4], edi
jne 0x14006c3a3
mov r8d, dword [rbp - 8]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp - 0x70], rax
mov dword [rbp + 0x40], 0x100001
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov r8, qword [rbp + 0x108]
mov rdx, rsi
lea rcx, [rbp + 0x580]
call fcn.1400612c8
mov qword [rbp - 0x48], rax
lea rax, [rbp + 0x500]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x500], xmm0
mov qword [rbp + 0x510], r15
mov qword [rbp + 0x518], r14
mov byte [rbp + 0x500], r15b
xor eax, eax
mov qword [rbp + 0x520], rax
lea rbx, [0x14006b26c]
lea esi, [rax + 1]
cmp byte [0x1406a3910], r15b
jne 0x14006b406
mov qword [0x1406a3908], rbx
mov byte [0x1406a3910], sil
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], r14
mov byte [rbp - 0x68], r15b
lea rax, [rbp - 0x68]
mov qword [rsp + 0x58], rax
cmp byte [0x1406a2d01], r15b
jne 0x14006b480
movabs rdx, 0xfeeddccbbaa99887
lea rcx, [0x1406a3110]
lea r12, [0x1406a3908]
movabs r8, 0xababdbf33353735b
mov r13d, 0xffffffff
mov rax, rdx
xor rax, r8
mov qword [rcx], rax
sub rdx, r13
add rcx, 8
cmp rcx, r12
jl 0x14006b450
movabs r12, 0xfae9e8d7c6b5a493
movabs r13, 0xaebdccdb0a192837
mov byte [0x1406a2d01], sil
mov qword [rsp + 0x30], r12
mov r11, r13
mov qword [rsp + 0x40], r15
mov eax, r15d
mov cl, r15b
xor cl, 0xae
add eax, esi
cmp eax, 8
jb 0x14006b493
mov byte [rsp + 0x40], cl
mov r10b, r15b
mov r9d, r15d
mov r8, r15
xor r11, r13
mov qword [rsp + 0x38], r11
mov al, byte [rsp + r8 + 0x38]
xor byte [rsp + r8 + 0x30], al
lea eax, [r9*8]
mov edx, 8
test eax, eax
cmovg edx, eax
mov ecx, 0x40
sub ecx, edx
mov rax, r15
xor r10b, sil
cmovne rax, qword [rsp + 0x40]
shl rax, cl
xor rax, qword [rsp + 0x30]
mov qword [rsp + 0x30], rax
add r9d, esi
add r8, rsi
cmp r9d, 8
jb 0x14006b4aa
and rax, r12
xor rax, 0xffffffffffff52ad
mov qword [rbp + 0x520], rax
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x500]
call fcn.14000a2a0
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x14006b556
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006b551
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006c3f0
call fcn.140213ea4
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], r14
mov byte [rbp - 0x68], r15b
cmp byte [0x1406a3911], r15b
jne 0x14006b579
mov qword [0x1406a3908], rbx
mov byte [0x1406a3911], sil
xorps xmm0, xmm0
movups xmmword [rbp + 0x548], xmm0
mov qword [rbp + 0x558], 8
mov qword [rbp + 0x560], r14
movabs rax, 0x6576697365686461
mov qword [rbp + 0x548], rax
mov byte [rbp + 0x550], r15b
movups xmmword [rbp + 0x4e0], xmm0
mov qword [rbp + 0x4f0], r15
mov qword [rbp + 0x4f8], r15
mov r8d, 8
lea rdx, [rbp + 0x548]
lea rcx, [rbp + 0x4e0]
call fcn.140004c7c
mov r15, qword [rbp + 0x4f0]
mov qword [rsp + 0x38], r15
lea r14, [rbp + 0x4e0]
mov r12, qword [rbp + 0x4e0]
mov r13, qword [rbp + 0x4f8]
cmp r13, 0x10
cmovae r14, r12
cmp byte [0x1406a2b50], 0
jne 0x14006b902
xor edi, edi
lea r12, [0x140000000]
movabs r15, 0x101010101010101
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
cmp rbx, 0x989680
jne 0x14006b640
imul rbx, rax, 0x64
jmp 0x14006b65c
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rbx, [rax + rcx]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rcx, eax
mov rax, rbx
cqo
idiv rcx
mov rax, rdx
cqo
and edx, 0xf
add rax, rdx
and eax, 0xf
sub rax, rdx
add rax, rsi
xor rax, 0x10
shl rax, 0xa
or rax, r15
mov qword [rdi + r12 + 0x6a2b60], rax
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
cmp rbx, 0x989680
jne 0x14006b6b0
imul rbx, rax, 0x64
jmp 0x14006b6cc
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rbx, [rax + rcx]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rcx, eax
mov rax, rbx
cqo
idiv rcx
mov rax, rdx
cqo
and edx, 0x1f
add rax, rdx
and eax, 0x1f
sub rax, rdx
add rax, rsi
xor rax, 0x20
shl rax, 0xb
or rax, r15
mov qword [rdi + r12 + 0x6a2be0], rax
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
cmp rbx, 0x989680
jne 0x14006b720
imul rbx, rax, 0x64
jmp 0x14006b73c
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rbx, [rax + rcx]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rcx, eax
mov rax, rbx
cqo
idiv rcx
mov rax, rdx
cqo
and edx, 0x3f
add rax, rdx
and eax, 0x3f
sub rax, rdx
add rax, rsi
xor rax, 0x40
shl rax, 0xc
or rax, r15
mov qword [rdi + r12 + 0x6a2c60], rax
add rdi, 8
cmp rdi, 0x80
jl 0x14006b624
mov r15, qword [rsp + 0x38]
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
cmp rbx, 0x989680
jne 0x14006b7a6
imul rbx, rax, 0x64
jmp 0x14006b7c2
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rbx, [rax + rcx]
xor edi, edi
lea rsi, [0x1406a2ce0]
lea r13d, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14006b7e5
sub eax, r13d
or eax, 0xfffffff0
add eax, r13d
add al, r13b
movsx rcx, al
mov rax, rbx
cqo
idiv rcx
mov byte [rsi], dl
add edi, r13d
add rsi, r13
cmp edi, 4
jb 0x14006b7cf
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
cmp rbx, 0x989680
jne 0x14006b81d
imul rsi, rax, 0x64
jmp 0x14006b838
cqo
idiv rbx
imul rsi, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rsi, rax
xor ebx, ebx
lea rdi, [0x1406a2ce8]
mov r12, r13
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14006b85a
sub eax, r12d
or eax, 0xfffffff0
add eax, r12d
add al, r12b
movsx rcx, al
mov rax, rsi
cqo
idiv rcx
mov byte [rdi], dl
add ebx, r12d
add rdi, r12
cmp ebx, 8
jb 0x14006b844
mov r12, qword [rbp + 0x4e0]
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
cmp rbx, 0x989680
jne 0x14006b899
imul rsi, rax, 0x64
jmp 0x14006b8b4
cqo
idiv rbx
imul rsi, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rsi, rax
xor ebx, ebx
lea rdi, [0x1406a2cf0]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14006b8d3
sub eax, r13d
or eax, 0xfffffff0
add eax, r13d
add al, r13b
movsx rcx, al
mov rax, rsi
cqo
idiv rcx
mov byte [rdi], dl
add ebx, r13d
add rdi, r13
cmp ebx, 0xc
jb 0x14006b8bd
mov r13, qword [rbp + 0x4f8]
mov esi, 1
mov byte [0x1406a2b50], sil
test r15, r15
je 0x14006b9f4
xor ebx, ebx
test r15, r15
je 0x14006b9f4
lea rdi, [0x140000000]
xor r11d, r11d
mov dl, byte [r14]
lea r10, [0x1406a2ce0]
xor r8d, r8d
xor r9d, r9d
movzx eax, byte [r10]
lea rcx, [r9 + rax*8]
xor dl, byte [rcx + rdi + 0x6a2b60]
mov byte [r14], dl
add r8d, esi
add r9, rsi
cmp r8d, 8
jb 0x14006b930
add r11d, esi
add r10, rsi
cmp r11d, 4
jb 0x14006b92a
xor r11d, r11d
lea r10, [0x1406a2ce8]
xor r8d, r8d
xor r9d, r9d
movzx eax, byte [r10]
lea rcx, [r9 + rax*8]
xor dl, byte [rcx + rdi + 0x6a2be0]
mov byte [r14], dl
add r8d, esi
add r9, rsi
cmp r8d, 8
jb 0x14006b96a
add r11d, esi
add r10, rsi
cmp r11d, 8
jb 0x14006b964
xor r8d, r8d
lea r11, [0x1406a2cf0]
xor r9d, r9d
xor r10d, r10d
movzx eax, byte [r11]
lea rcx, [r10 + rax*8]
xor dl, byte [rcx + rdi + 0x6a2b60]
mov byte [r14], dl
add r9d, esi
add r10, rsi
cmp r9d, 8
jb 0x14006b9a4
add r8d, esi
add r11, rsi
cmp r8d, 0xc
jb 0x14006b99e
add ebx, esi
add r14, rsi
movsxd rax, ebx
cmp rax, r15
jb 0x14006b91d
mov r13, qword [rbp + 0x4f8]
mov r15, qword [rbp + 0x4f0]
mov r12, qword [rbp + 0x4e0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
and qword [rsp + 0x70], 0
and qword [rsp + 0x78], 0
lea rdx, [rbp + 0x4e0]
cmp r13, 0x10
cmovae rdx, r12
mov r8, r15
lea rcx, [rsp + 0x60]
call fcn.140004c7c
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rdx
lea rbx, [0x1406a3110]
cmp byte [0x1406a2d01], 0
jne 0x14006ba98
movabs r8, 0xfeeddccbbaa99887
mov rcx, rbx
lea rdx, [0x1406a3908]
movabs r9, 0xababdbf33353735b
mov rax, r8
xor rax, r9
mov qword [rcx], rax
mov eax, 0xffffffff
sub r8, rax
add rcx, 8
cmp rcx, rdx
jl 0x14006ba72
mov rdx, qword [rsp + 0x38]
mov byte [0x1406a2d01], sil
movabs r9, 0xfae9e8d7c6b5a493
mov qword [rsp + 0x30], r9
xor r11d, r11d
mov r8, qword [rsp + 0x70]
test r8, r8
je 0x14006baf1
mov r10, rdx
xor r9d, r9d
mov cl, byte [r10]
lea rax, [rsp + 0x30]
xor byte [rax], cl
add r9d, esi
add rax, rsi
cmp r9d, 8
jb 0x14006bac2
not cl
movzx eax, cl
mov r9, qword [rsp + 0x30]
xor r9, qword [rbx + rax*8]
mov qword [rsp + 0x30], r9
add r11d, esi
add r10, rsi
movsxd rax, r11d
cmp rax, r8
jb 0x14006bab7
movabs r13, 0xaebdccdb0a192837
mov rdi, r13
movzx r14d, byte [rdx]
cmp r8, rsi
jbe 0x14006bb0e
mov bl, byte [rdx + r8 - 1]
jmp 0x14006bb10
mov bl, 0xae
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], r8
xor eax, eax
mov cl, r8b
mov dl, r8b
xor cl, r14b
xor dl, bl
add eax, esi
cmp eax, 8
jb 0x14006bb22
mov byte [rsp + 0x40], cl
mov byte [rsp + 0x38], dl
xor sil, sil
xor r10d, r10d
lea r15, [r8*8]
xor r11d, r11d
lea r12d, [r10 + 1]
mov eax, r10d
test r10d, r10d
cmove eax, r12d
shl eax, 3
movsxd rcx, eax
xor edx, edx
mov rax, r15
div rcx
mov rcx, rdx
mov rax, r8
shl rax, cl
xor rdi, rax
xor rdi, r13
mov qword [rsp + 0x48], rdi
mov al, byte [rsp + r11 + 0x48]
xor byte [rsp + r11 + 0x30], al
lea eax, [r10*8]
mov edx, 8
test eax, eax
cmovg edx, eax
mov ecx, 0x40
sub ecx, edx
mov rdx, qword [rsp + 0x40]
xor sil, r12b
cmovne rdx, qword [rsp + 0x38]
shl rdx, cl
xor rdx, qword [rsp + 0x30]
mov qword [rsp + 0x30], rdx
add r10d, r12d
add r11, r12
cmp r10d, 8
jb 0x14006bb4b
movzx eax, bl
imul rcx, rax, 0xff
not rcx
mov rax, r14
shl rax, 7
sub rcx, rax
and rdx, r9
xor rcx, rdx
mov qword [rbp + 0x520], rcx
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x500]
call fcn.14000a2a0
nop
mov rdx, qword [rsp + 0x78]
mov ebx, 0x1000
cmp rdx, 0x10
jb 0x14006bc35
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, rbx
jb 0x14006bc30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006c3f7
call fcn.140213ea4
xor r15d, r15d
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], recv
mov byte [rsp + 0x60], r15b
mov rdx, qword [rbp + 0x4f8]
cmp rdx, 0x10
jb 0x14006bc89
inc rdx
mov rcx, qword [rbp + 0x4e0]
mov rax, rcx
cmp rdx, rbx
jb 0x14006bc83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006c3fe
call fcn.140213ea4
nop
mov rdx, qword [rbp + 0x560]
cmp rdx, 0x10
jb 0x14006bcc7
inc rdx
mov rcx, qword [rbp + 0x548]
mov rax, rcx
cmp rdx, rbx
jb 0x14006bcc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006c405
call fcn.140213ea4
nop
lea rdx, [rbp + 0x500]
cmp qword [rbp + 0x518], 0x10
cmovae rdx, qword [rbp + 0x500]
lea rbx, [0x1406a3110]
cmp byte [0x1406a2d01], r15b
jne 0x14006bd35
movabs r8, 0xfeeddccbbaa99887
mov rcx, rbx
lea r13, [0x1406a3908]
movabs r9, 0xababdbf33353735b
mov r12d, 0xffffffff
mov rax, r8
xor rax, r9
mov qword [rcx], rax
sub r8, r12
add rcx, 8
cmp rcx, r13
jl 0x14006bd12
mov esi, 1
mov byte [0x1406a2d01], sil
jmp 0x14006bd3a
mov esi, 1
movabs rax, 0xfae9e8d7c6b5a493
mov qword [rsp + 0x30], rax
mov r11d, r15d
mov r9, rax
mov r8, qword [rbp + 0x510]
test r8, r8
je 0x14006bd98
mov r10, rdx
mov r9d, r15d
mov cl, byte [r10]
lea rax, [rsp + 0x30]
xor byte [rax], cl
add r9d, esi
add rax, rsi
cmp r9d, 8
jb 0x14006bd69
not cl
movzx eax, cl
mov r9, qword [rsp + 0x30]
xor r9, qword [rbx + rax*8]
mov qword [rsp + 0x30], r9
add r11d, esi
add r10, rsi
movsxd rax, r11d
cmp rax, r8
jb 0x14006bd5e
movabs rdi, 0xaebdccdb0a192837
movzx r14d, byte [rdx]
cmp r8, rsi
jbe 0x14006bdb2
mov bl, byte [rdx + r8 - 1]
jmp 0x14006bdb4
mov bl, 0xae
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r8
mov eax, r15d
mov cl, r8b
mov dl, r8b
xor cl, r14b
xor dl, bl
add eax, esi
cmp eax, 8
jb 0x14006bdc7
mov byte [rsp + 0x38], cl
mov byte [rsp + 0x40], dl
mov sil, r15b
mov r10d, r15d
lea r15, [r8*8]
xor r11d, r11d
lea r13d, [r11 + 1]
mov r12, rdi
mov eax, r10d
test r10d, r10d
cmove eax, r13d
shl eax, 3
movsxd rcx, eax
xor edx, edx
mov rax, r15
div rcx
mov rcx, rdx
mov rax, r8
shl rax, cl
xor rdi, rax
xor rdi, r12
mov qword [rsp + 0x48], rdi
mov al, byte [rsp + r11 + 0x48]
xor byte [rsp + r11 + 0x30], al
lea eax, [r10*8]
mov edx, 8
test eax, eax
cmovg edx, eax
mov ecx, 0x40
sub ecx, edx
mov rdx, qword [rsp + 0x38]
xor sil, r13b
cmovne rdx, qword [rsp + 0x40]
shl rdx, cl
xor rdx, qword [rsp + 0x30]
mov qword [rsp + 0x30], rdx
add r10d, r13d
add r11, r13
cmp r10d, 8
jb 0x14006bdf3
mov r12, qword [rbp + 0x500]
mov r13, qword [rbp + 0x518]
movzx eax, bl
imul rbx, rax, 0xff
not rbx
mov rax, r14
shl rax, 7
sub rbx, rax
and r9, rdx
xor rbx, r9
mov rsi, qword [rbp + 0x520]
cmp rbx, rsi
je 0x14006beeb
mov rdi, qword [0x1406a3908]
mov edx, 3
lea rcx, [rbp + 0x548]
call fcn.14002d52c
mov qword [rbp + 0x570], rsi
mov qword [rbp + 0x578], rbx
lea rdx, [rbp + 0x500]
lea rcx, [rbp + 0x548]
call rdi
mov r13, qword [rbp + 0x518]
mov r8, qword [rbp + 0x510]
mov r12, qword [rbp + 0x500]
xorps xmm0, xmm0
movups xmmword [rbp + 0x4e0], xmm0
xor r15d, r15d
mov qword [rbp + 0x4f0], r15
mov qword [rbp + 0x4f8], r15
lea rdx, [rbp + 0x500]
cmp r13, 0x10
cmovae rdx, r12
lea rcx, [rbp + 0x4e0]
call fcn.140004c7c
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x528], xmm0
mov qword [rbp + 0x538], r15
mov qword [rbp + 0x540], r15
lea rdx, [rbp + 0x4e0]
cmp qword [rbp + 0x4f8], 0x10
cmovae rdx, qword [rbp + 0x4e0]
mov r8, qword [rbp + 0x4f0]
lea rcx, [rbp + 0x528]
call fcn.140004c7c
mov r12, qword [rbp + 0x538]
mov qword [rsp + 0x38], r12
lea rsi, [rbp + 0x528]
mov rdi, qword [rbp + 0x528]
mov r13, qword [rbp + 0x540]
cmp r13, 0x10
cmovae rsi, rdi
mov qword [rsp + 0x48], rsi
cmp byte [0x1406a2b50], r15b
jne 0x14006c19d
mov r14d, r15d
lea r12, [0x140000000]
movabs rsi, 0x101010101010101
lea rcx, [rbp - 0x80]
call fcn.140063754
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rcx, eax
mov rax, qword [rbp - 0x80]
cqo
idiv rcx
mov rax, rdx
cqo
and edx, 0xf
add rax, rdx
and eax, 0xf
sub rax, rdx
inc rax
xor rax, 0x10
shl rax, 0xa
or rax, rsi
mov qword [r14 + r12 + 0x6a2b60], rax
lea rcx, [rbp - 0x30]
call fcn.140063754
mov rbx, qword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rcx, eax
mov rax, rbx
cqo
idiv rcx
mov rax, rdx
cqo
and edx, 0x1f
add rax, rdx
and eax, 0x1f
sub rax, rdx
inc rax
xor rax, 0x20
shl rax, 0xb
or rax, rsi
mov qword [r14 + r12 + 0x6a2be0], rax
lea rcx, [rbp - 0x28]
call fcn.140063754
mov rbx, qword [rax]
mov qword [rbp - 0x80], rbx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rcx, eax
mov rax, rbx
cqo
idiv rcx
mov rax, rdx
cqo
and edx, 0x3f
add rax, rdx
and eax, 0x3f
sub rax, rdx
inc rax
xor rax, 0x40
shl rax, 0xc
or rax, rsi
mov qword [r14 + r12 + 0x6a2c60], rax
add r14, 8
cmp r14, 0x80
jl 0x14006bfb3
mov rsi, qword [rsp + 0x48]
lea rcx, [rbp - 0x78]
call fcn.140063754
mov ebx, r15d
lea r14, [0x1406a2ce0]
mov r13d, 1
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14006c0c6
sub eax, r13d
or eax, 0xfffffff0
add eax, r13d
add al, r13b
movsx rcx, al
mov rax, qword [rbp - 0x78]
cqo
idiv rcx
mov byte [r14], dl
add ebx, r13d
add r14, r13
cmp ebx, 4
jb 0x14006c0b0
lea rcx, [rbp - 0x20]
call fcn.140063754
mov rbx, qword [rax]
mov r14d, r15d
lea r15, [0x1406a2ce8]
mov r12, r13
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14006c113
sub eax, r12d
or eax, 0xfffffff0
add eax, r12d
add al, r12b
movsx rcx, al
mov rax, rbx
cqo
idiv rcx
mov byte [r15], dl
add r14d, r12d
add r15, r12
cmp r14d, 8
jb 0x14006c0fd
mov r12, qword [rsp + 0x38]
lea rcx, [rbp - 0x18]
call fcn.140063754
mov rbx, qword [rax]
mov qword [rbp - 0x78], rbx
xor r14d, r14d
lea r15, [0x1406a2cf0]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000000f
jge 0x14006c166
sub eax, r13d
or eax, 0xfffffff0
add eax, r13d
add al, r13b
movsx rcx, al
mov rax, rbx
cqo
idiv rcx
mov byte [r15], dl
add r14d, r13d
add r15, r13
cmp r14d, 0xc
jb 0x14006c150
mov r13, qword [rbp + 0x540]
mov r14d, 1
mov byte [0x1406a2b50], r14b
xor r15d, r15d
jmp 0x14006c1a3
mov r14d, 1
test r12, r12
je 0x14006c28a
mov ebx, r15d
lea rdi, [0x140000000]
mov r11d, r15d
mov dl, byte [rsi]
lea r10, [0x1406a2ce0]
mov r8d, r15d
mov r9, r15
movzx eax, byte [r10]
lea rcx, [r9 + rax*8]
xor dl, byte [rcx + rdi + 0x6a2b60]
mov byte [rsi], dl
add r8d, r14d
add r9, r14
cmp r8d, 8
jb 0x14006c1c8
add r11d, r14d
add r10, r14
cmp r11d, 4
jb 0x14006c1c2
mov r11d, r15d
lea r10, [0x1406a2ce8]
mov r8d, r15d
mov r9, r15
movzx eax, byte [r10]
lea rcx, [r9 + rax*8]
xor dl, byte [rcx + rdi + 0x6a2be0]
mov byte [rsi], dl
add r8d, r14d
add r9, r14
cmp r8d, 8
jb 0x14006c201
add r11d, r14d
add r10, r14
cmp r11d, 8
jb 0x14006c1fb
mov r8d, r15d
lea r11, [0x1406a2cf0]
mov r9d, r15d
mov r10, r15
movzx eax, byte [r11]
lea rcx, [r10 + rax*8]
xor dl, byte [rcx + rdi + 0x6a2b60]
mov byte [rsi], dl
add r9d, r14d
add r10, r14
cmp r9d, 8
jb 0x14006c23a
add r8d, r14d
add r11, r14
cmp r8d, 0xc
jb 0x14006c234
add ebx, r14d
add rsi, r14
movsxd rax, ebx
cmp rax, r12
jb 0x14006c1b6
mov r13, qword [rbp + 0x540]
mov r12, qword [rbp + 0x538]
mov rdi, qword [rbp + 0x528]
mov rdx, qword [rbp + 0x4f8]
cmp rdx, 0x10
jb 0x14006c2cb
inc rdx
mov rcx, qword [rbp + 0x4e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006c2c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006c40c
call fcn.140213ea4
lea r9, [rbp + 0x528]
cmp r13, 0x10
setae bl
cmovae r9, rdi
mov rax, qword [rbp - 0x48]
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x14006c2ef
mov rax, qword [rax]
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov rcx, rax
call fcn.140018ac4
mov rsi, rax
test bl, bl
je 0x14006c338
lea rdx, [r13 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14006c32f
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006c413
mov rcx, rdi
call fcn.140213ea4
nop
lea rcx, [rbp + 0x500]
call fcn.14002f208
nop
lea rcx, [rbp + 0x580]
call fcn.1400099b4
mov rbx, qword [rbp - 0x70]
cmp rsi, 0xffffffffffffffff
je 0x14006c374
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov qword [rbp + 0x108], r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbp - 0x40]
mov edi, dword [rsp + 0x50]
mov rsi, qword [rbp - 0x38]
mov r14d, recv
movabs r12, 0xfae9e8d7c6b5a493
movabs r13, 0xaebdccdb0a192837
lea rdx, [rbp - 0x10]
mov rcx, rbx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x14006b365
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x5a0]
xor rcx, rsp
call fcn.1402145d0
lea r11, [rsp + 0x6b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3