Function at 0x1400062b0
Capabilities:
Access peb ldr_data
Create process on windows
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports
Terminate process

Disassembly:
push rbx
push rdi
sub rsp, 0x428
mov rax, qword [0x140010040]
xor rax, rsp
mov qword [rsp + 0x400], rax
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x68
xor eax, eax
mov edx, 0x298
mov dword [rsp + 0xd4], eax
xor edi, edi
mov qword [rsp + 0x60], rax
mov rbx, rcx
mov rax, qword gs:[0x58]
mov ecx, 0x90
movups xmmword [rsp + 0x74], xmm0
mov dword [rsp + 0x68], edi
mov r8, qword [rax]
movups xmmword [rsp + 0x84], xmm0
movups xmmword [rsp + 0x94], xmm0
mov eax, dword [rcx + r8]
movups xmmword [rsp + 0xa4], xmm0
movups xmmword [rsp + 0xb4], xmm0
movups xmmword [rsp + 0xc4], xmm0
movups xmmword [rsp + 0x50], xmm0
test al, 1
jne 0x1400063ba
or eax, 1
mov qword [r8 + rdx], rdi
mov dword [rcx + r8], eax
mov rcx, qword [0x14000c690]
mov rax, qword [0x14000c688]
mov word [r8 + rdx + 8], di
mov byte [r8 + rdx + 0xa], dil
shr rax, 0x20
mov word [r8 + rdx + 0xc], ax
movzx eax, word [0x14000c68e]
mov word [r8 + rdx + 0xe], ax
mov rax, rcx
mov word [r8 + rdx + 0x10], 0xf5
shr rax, 0x10
mov word [r8 + rdx + 0x12], ax
movzx eax, word [0x14000c696]
shr rcx, 0x20
mov word [r8 + rdx + 0x14], cx
mov word [r8 + rdx + 0x16], ax
movzx eax, word [0x14000c69a]
mov word [r8 + rdx + 0x18], 0xe2
mov word [r8 + rdx + 0x1a], ax
add r8, rdx
mov qword [rsp + 0x450], rsi
cmp byte [r8 + 0xa], dil
jne 0x14000661d
mov edx, edi
mov esi, 0x82
mov r10d, 0x80
mov r11d, 0x81
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x140006410
movsxd rax, edx
inc cx
xor word [r8 + rax*2 + 0xc], cx
inc dword [r8]
jmp 0x1400063f0
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x14000642a
movsxd rax, edx
add cx, 2
xor word [r8 + rax*2 + 0xc], cx
inc dword [r8]
jmp 0x1400063f0
cmp r9d, ecx
je 0x140006463
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x140006449
movsxd rax, edx
add cx, 3
xor word [r8 + rax*2 + 0xc], cx
inc dword [r8]
jmp 0x1400063f0
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x140006471
movsxd rax, edx
add cx, 4
xor word [r8 + rax*2 + 0xc], cx
inc dword [r8]
jmp 0x1400063f0
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x7f]
xor word [rcx + 0xc], ax
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x140006491
inc cx
movsxd rax, edx
xor word [r8 + rax*2 + 0xe], cx
inc dword [r8]
jmp 0x140006471
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x1400064ab
add cx, 2
movsxd rax, edx
xor word [r8 + rax*2 + 0xe], cx
inc dword [r8]
jmp 0x140006471
cmp r9d, ecx
je 0x1400064e4
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x1400064ca
add cx, 3
movsxd rax, edx
xor word [r8 + rax*2 + 0xe], cx
inc dword [r8]
jmp 0x140006471
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x140006500
add cx, 4
movsxd rax, edx
xor word [r8 + rax*2 + 0xe], cx
inc dword [r8]
jmp 0x140006471
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [r10 + rdx]
xor word [rcx + 0xe], ax
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x140006520
inc cx
movsxd rax, edx
xor word [r8 + rax*2 + 0x10], cx
inc dword [r8]
jmp 0x140006500
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x14000653a
add cx, 2
movsxd rax, edx
xor word [r8 + rax*2 + 0x10], cx
inc dword [r8]
jmp 0x140006500
cmp r9d, ecx
je 0x140006573
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x140006559
add cx, 3
movsxd rax, edx
xor word [r8 + rax*2 + 0x10], cx
inc dword [r8]
jmp 0x140006500
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x140006590
add cx, 4
movsxd rax, edx
xor word [r8 + rax*2 + 0x10], cx
inc dword [r8]
jmp 0x140006500
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [r11 + rdx]
xor word [rcx + 0x10], ax
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x1400065b0
inc cx
movsxd rax, edx
xor word [r8 + rax*2 + 0x12], cx
inc dword [r8]
jmp 0x140006590
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x1400065ca
add cx, 2
movsxd rax, edx
xor word [r8 + rax*2 + 0x12], cx
inc dword [r8]
jmp 0x140006590
cmp r9d, ecx
je 0x140006603
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x1400065e9
add cx, 3
movsxd rax, edx
xor word [r8 + rax*2 + 0x12], cx
inc dword [r8]
jmp 0x140006590
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x140006611
add cx, 4
movsxd rax, edx
xor word [r8 + rax*2 + 0x12], cx
inc dword [r8]
jmp 0x140006590
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rsi + rdx]
xor word [rcx + 0x12], ax
add edx, 4
cmp edx, 8
jb 0x1400063f0
mov byte [r8 + 0xa], 1
xor edx, edx
add r8, 0xc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14000665f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_DebugActiveProcess]
test eax, eax
jne 0x1400070d1
mov ecx, 0x22b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x140010958]
mov qword [rsp + 0x448], rbp
mov qword [rsp + 0x420], r12
mov qword [rsp + 0x418], r14
mov qword [rsp + 0x410], r15
test rcx, rcx
jne 0x14000681c
mov rax, qword gs:[0x60]
mov r11d, edi
mov r10d, 0x6e0fa189
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r15, qword [rax]
mov rsi, r15
nop
movups xmm0, xmmword [rsi + 0x58]
movd eax, xmm0
sub ax, 8
test r11d, r11d
je 0x1400066fd
psrldq xmm0, 8
mov edx, 0x6e379ff2
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x1400066f4
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x1400066e0
cmp edx, r11d
jne 0x1400067fd
mov r9, qword [rsi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov rbp, rcx
mov ebx, ecx
shr rbp, 0x20
add rbx, r9
cmp rbx, r9
je 0x1400067fd
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400067fd
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
lea rcx, [r14 + r8*4]
mov edx, dword [rcx + r9]
mov ecx, 0x6e379ff2
add rdx, r9
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140006777
nop dword [rax]
movsx eax, al
lea rdx, [rdx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x140006760
cmp ecx, r10d
je 0x140006783
test r8d, r8d
jne 0x140006740
jmp 0x1400067fd
mov eax, dword [rbx + 0x24]
mov ecx, dword [rbx + 0x1c]
add rax, r9
add rcx, r9
movzx edx, word [rax + r8*2]
mov ecx, dword [rcx + rdx*4]
add rcx, r9
cmp rcx, rbx
jbe 0x140006815
lea rax, [rbx + rbp]
cmp rcx, rax
jae 0x140006815
movzx eax, byte [rcx]
mov r11d, 0x6e379ff2
mov r10d, r11d
cmp al, 0x2e
je 0x1400067d7
nop dword [rax + rax]
movsx eax, al
inc rcx
xor eax, r11d
imul r11d, eax, 0x1000193
movzx eax, byte [rcx]
cmp al, 0x2e
jne 0x1400067c0
movzx eax, byte [rcx + 1]
inc rcx
test al, al
je 0x1400067fa
movsx eax, al
lea rcx, [rcx + 1]
xor eax, r10d
imul r10d, eax, 0x1000193
movzx eax, byte [rcx]
test al, al
jne 0x1400067e2
mov rsi, qword [r15]
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r15
je 0x140006812
cmp qword [rax + 0x30], rdi
jne 0x1400066b0
mov rcx, rdi
mov qword [0x140010958], rcx
call rcx
mov r8d, 0x104
lea rdx, [rsp + 0x1f0]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r9, [rsp + 0x1f0]
mov dword [rsp + 0x20], ebx
lea r8, str._ws__d
mov edx, 0x109
lea rcx, [rsp + 0xe0]
call fcn.140001080
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0xe0]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov r8, qword [0x140010988]
test r8, r8
jne 0x140006a40
mov rax, qword gs:[0x60]
mov r11d, edi
mov r10d, 0x867f0c90
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop word [rax + rax]
movups xmm0, xmmword [rsi + 0x58]
movd eax, xmm0
sub ax, 8
test r11d, r11d
je 0x14000691d
psrldq xmm0, 8
mov edx, 0x8f860281
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140006914
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140006900
cmp edx, r11d
jne 0x140006a21
mov r9, qword [rsi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r15, rcx
mov ebx, ecx
shr r15, 0x20
add rbx, r9
cmp rbx, r9
je 0x140006a21
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140006a21
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
lea rcx, [r14 + r8*4]
mov edx, dword [rcx + r9]
mov ecx, 0x8f860281
add rdx, r9
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140006997
nop dword [rax]
movsx eax, al
lea rdx, [rdx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x140006980
cmp ecx, r10d
je 0x1400069a3
test r8d, r8d
jne 0x140006960
jmp 0x140006a21
mov eax, dword [rbx + 0x24]
mov ecx, dword [rbx + 0x1c]
add rax, r9
add rcx, r9
movzx edx, word [rax + r8*2]
mov r8d, dword [rcx + rdx*4]
add r8, r9
cmp r8, rbx
jbe 0x140006a39
lea rax, [r15 + rbx]
cmp r8, rax
jae 0x140006a39
movzx eax, byte [r8]
mov r11d, 0x8f860281
mov r10d, r11d
cmp al, 0x2e
je 0x1400069f8
nop word [rax + rax]
movsx eax, al
inc r8
xor eax, r11d
imul r11d, eax, 0x1000193
movzx eax, byte [r8]
cmp al, 0x2e
jne 0x1400069e0
movzx eax, byte [r8 + 1]
inc r8
test al, al
je 0x140006a1d
movsx eax, al
lea r8, [r8 + 1]
xor eax, r10d
imul r10d, eax, 0x1000193
movzx eax, byte [r8]
test al, al
jne 0x140006a04
mov rsi, qword [rbp]
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x140006a36
cmp qword [rax + 0x30], rdi
jne 0x1400068d0
mov r8, rdi
mov qword [0x140010988], r8
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call r8
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x68], 0x22b
mov r12d, edi
mov rdx, qword [0x140010980]
mov eax, 1
cmove r12d, eax
test rdx, rdx
jne 0x140006c0c
mov rax, qword gs:[0x60]
mov r11d, edi
mov r10d, 0x95d77c64
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r15, qword [rax]
mov rsi, r15
movups xmm0, xmmword [rsi + 0x58]
movd eax, xmm0
sub ax, 8
test r11d, r11d
je 0x140006aed
psrldq xmm0, 8
mov edx, 0x93b191ae
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140006ae4
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140006ad0
cmp edx, r11d
jne 0x140006bed
mov r9, qword [rsi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r14, rcx
mov ebx, ecx
shr r14, 0x20
add rbx, r9
cmp rbx, r9
je 0x140006bed
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140006bed
mov ebp, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + rbp]
mov ecx, 0x93b191ae
add rdx, r9
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140006b67
nop dword [rax]
movsx eax, al
lea rdx, [rdx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x140006b50
cmp ecx, r10d
je 0x140006b73
test r8d, r8d
jne 0x140006b30
jmp 0x140006bed
mov eax, dword [rbx + 0x24]
mov ecx, dword [rbx + 0x1c]
add rax, r9
add rcx, r9
movzx edx, word [rax + r8*2]
mov edx, dword [rcx + rdx*4]
add rdx, r9
cmp rdx, rbx
jbe 0x140006c05
lea rax, [rbx + r14]
cmp rdx, rax
jae 0x140006c05
movzx eax, byte [rdx]
mov r11d, 0x93b191ae
mov r10d, r11d
cmp al, 0x2e
je 0x140006bc7
nop dword [rax + rax]
movsx eax, al
inc rdx
xor eax, r11d
imul r11d, eax, 0x1000193
movzx eax, byte [rdx]
cmp al, 0x2e
jne 0x140006bb0
movzx eax, byte [rdx + 1]
inc rdx
test al, al
je 0x140006bea
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r10d
imul r10d, eax, 0x1000193
movzx eax, byte [rdx]
test al, al
jne 0x140006bd2
mov rsi, qword [r15]
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r15
je 0x140006c02
cmp qword [rax + 0x30], rdi
jne 0x140006aa1
mov rdx, rdi
mov qword [0x140010980], rdx
mov rcx, qword [rsp + 0x50]
call rdx
mov rdx, qword [0x140010998]
test rdx, rdx
jne 0x140006dbc
mov rax, qword gs:[0x60]
mov r11d, edi
mov r10d, 0xcb4f964
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r15, qword [rax]
mov rsi, r15
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rsi + 0x58]
movd eax, xmm0
sub ax, 8
test r11d, r11d
je 0x140006c9d
psrldq xmm0, 8
mov edx, 0x3e4708ae
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140006c94
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140006c80
cmp edx, r11d
jne 0x140006d9d
mov r9, qword [rsi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r14, rcx
mov ebx, ecx
shr r14, 0x20
add rbx, r9
cmp rbx, r9
je 0x140006d9d
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140006d9d
mov ebp, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + rbp]
mov ecx, 0x3e4708ae
add rdx, r9
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140006d17
nop dword [rax]
movsx eax, al
lea rdx, [rdx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x140006d00
cmp ecx, r10d
je 0x140006d23
test r8d, r8d
jne 0x140006ce0
jmp 0x140006d9d
mov eax, dword [rbx + 0x24]
mov ecx, dword [rbx + 0x1c]
add rax, r9
add rcx, r9
movzx edx, word [rax + r8*2]
mov edx, dword [rcx + rdx*4]
add rdx, r9
cmp rdx, rbx
jbe 0x140006db5
lea rax, [rbx + r14]
cmp rdx, rax
jae 0x140006db5
movzx eax, byte [rdx]
mov r11d, 0x3e4708ae
mov r10d, r11d
cmp al, 0x2e
je 0x140006d77
nop dword [rax + rax]
movsx eax, al
inc rdx
xor eax, r11d
imul r11d, eax, 0x1000193
movzx eax, byte [rdx]
cmp al, 0x2e
jne 0x140006d60
movzx eax, byte [rdx + 1]
inc rdx
test al, al
je 0x140006d9a
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r10d
imul r10d, eax, 0x1000193
movzx eax, byte [rdx]
test al, al
jne 0x140006d82
mov rsi, qword [r15]
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r15
je 0x140006db2
cmp qword [rax + 0x30], rdi
jne 0x140006c50
mov rdx, rdi
mov qword [0x140010998], rdx
mov rcx, qword [rsp + 0x58]
call rdx
mov r15, qword [rsp + 0x410]
test r12d, r12d
mov r12, qword [rsp + 0x420]
mov r14, qword [rsp + 0x418]
mov rbp, qword [rsp + 0x448]
je 0x1400070d1
call fcn.140007100
mov rdx, rax
cmp byte [rax + 9], dil
jne 0x1400070b8
nop
mov r8d, dword [rdx + 4]
mov r9d, dword [rdx]
lea ecx, [r8 + 1]
cmp r9d, ecx
jne 0x140006e1f
movsxd rax, edi
inc r8b
xor byte [rax + rdx + 0xa], r8b
inc dword [rdx]
jmp 0x140006e00
lea eax, [r8 + 2]
cmp r9d, eax
jne 0x140006e38
movsxd rax, edi
add r8b, 2
xor byte [rax + rdx + 0xa], r8b
inc dword [rdx]
jmp 0x140006e00
cmp r9d, r8d
je 0x140006e6f
lea eax, [r8 + 4]
cmp r9d, eax
jne 0x140006e56
movsxd rax, edi
add r8b, 3
xor byte [rax + rdx + 0xa], r8b
inc dword [rdx]
jmp 0x140006e00
lea eax, [r8 + 5]
cmp r9d, eax
jne 0x140006e80
movsxd rax, edi
add r8b, 4
xor byte [rax + rdx + 0xa], r8b
inc dword [rdx]
jmp 0x140006e00
movsxd rcx, edi
lea eax, [rdi - 0x7f]
xor byte [rcx + rdx + 0xa], al
nop dword [rax]
mov ecx, dword [rdx + 4]
mov r8d, dword [rdx]
lea eax, [rcx + 1]
cmp r8d, eax
jne 0x140006e9b
inc cl
movsxd rax, edi
xor byte [rax + rdx + 0xb], cl
inc dword [rdx]
jmp 0x140006e80
lea eax, [rcx + 2]
cmp r8d, eax
jne 0x140006eb1
add cl, 2
movsxd rax, edi
xor byte [rax + rdx + 0xb], cl
inc dword [rdx]
jmp 0x140006e80
cmp r8d, ecx
je 0x140006ee2
lea eax, [rcx + 4]
cmp r8d, eax
jne 0x140006ecc
add cl, 3
movsxd rax, edi
xor byte [rax + rdx + 0xb], cl
inc dword [rdx]
jmp 0x140006e80
lea eax, [rcx + 5]
cmp r8d, eax
jne 0x140006ef0
add cl, 4
movsxd rax, edi
xor byte [rax + rdx + 0xb], cl
inc dword [rdx]
jmp 0x140006e80
movsxd rcx, edi
lea eax, [rdi - 0x7e]
xor byte [rcx + rdx + 0xb], al
nop dword [rax]
mov ecx, dword [rdx + 4]
mov r8d, dword [rdx]
lea eax, [rcx + 1]
cmp r8d, eax
jne 0x140006f0b
inc cl
movsxd rax, edi
xor byte [rax + rdx + 0xc], cl
inc dword [rdx]
jmp 0x140006ef0
lea eax, [rcx + 2]
cmp r8d, eax
jne 0x140006f21
add cl, 2
movsxd rax, edi
xor byte [rax + rdx + 0xc], cl
inc dword [rdx]
jmp 0x140006ef0
cmp r8d, ecx
je 0x140006f52
lea eax, [rcx + 4]
cmp r8d, eax
jne 0x140006f3c
add cl, 3
movsxd rax, edi
xor byte [rax + rdx + 0xc], cl
inc dword [rdx]
jmp 0x140006ef0
lea eax, [rcx + 5]
cmp r8d, eax
jne 0x140006f60
add cl, 4
movsxd rax, edi
xor byte [rax + rdx + 0xc], cl
inc dword [rdx]
jmp 0x140006ef0
movsxd rcx, edi
lea eax, [rdi - 0x7d]
xor byte [rcx + rdx + 0xc], al
nop dword [rax]
mov ecx, dword [rdx + 4]
mov r8d, dword [rdx]
lea eax, [rcx + 1]
cmp r8d, eax
jne 0x140006f7b
inc cl
movsxd rax, edi
xor byte [rax + rdx + 0xd], cl
inc dword [rdx]
jmp 0x140006f60
lea eax, [rcx + 2]
cmp r8d, eax
jne 0x140006f91
add cl, 2
movsxd rax, edi
xor byte [rax + rdx + 0xd], cl
inc dword [rdx]
jmp 0x140006f60
cmp r8d, ecx
je 0x140006fc2
lea eax, [rcx + 4]
cmp r8d, eax
jne 0x140006fac
add cl, 3
movsxd rax, edi
xor byte [rax + rdx + 0xd], cl
inc dword [rdx]
jmp 0x140006f60
lea eax, [rcx + 5]
cmp r8d, eax
jne 0x140006fd0
add cl, 4
movsxd rax, edi
xor byte [rax + rdx + 0xd], cl
inc dword [rdx]
jmp 0x140006f60
movsxd rcx, edi
lea eax, [rdi - 0x7c]
xor byte [rcx + rdx + 0xd], al
nop dword [rax]
mov ecx, dword [rdx + 4]
mov r8d, dword [rdx]
lea eax, [rcx + 1]
cmp r8d, eax
jne 0x140006feb
inc cl
movsxd rax, edi
xor byte [rax + rdx + 0xe], cl
inc dword [rdx]
jmp 0x140006fd0
lea eax, [rcx + 2]
cmp r8d, eax
jne 0x140007001
add cl, 2
movsxd rax, edi
xor byte [rax + rdx + 0xe], cl
inc dword [rdx]
jmp 0x140006fd0
cmp r8d, ecx
je 0x140007032
lea eax, [rcx + 4]
cmp r8d, eax
jne 0x14000701c
add cl, 3
movsxd rax, edi
xor byte [rax + rdx + 0xe], cl
inc dword [rdx]
jmp 0x140006fd0
lea eax, [rcx + 5]
cmp r8d, eax
jne 0x140007040
add cl, 4
movsxd rax, edi
xor byte [rax + rdx + 0xe], cl
inc dword [rdx]
jmp 0x140006fd0
movsxd rcx, edi
lea eax, [rdi - 0x7b]
xor byte [rcx + rdx + 0xe], al
nop dword [rax]
mov ecx, dword [rdx + 4]
mov r8d, dword [rdx]
lea eax, [rcx + 1]
cmp r8d, eax
jne 0x14000705b
inc cl
movsxd rax, edi
xor byte [rax + rdx + 0xf], cl
inc dword [rdx]
jmp 0x140007040
lea eax, [rcx + 2]
cmp r8d, eax
jne 0x140007071
add cl, 2
movsxd rax, edi
xor byte [rax + rdx + 0xf], cl
inc dword [rdx]
jmp 0x140007040
cmp r8d, ecx
je 0x1400070a2
lea eax, [rcx + 4]
cmp r8d, eax
jne 0x14000708c
add cl, 3
movsxd rax, edi
xor byte [rax + rdx + 0xf], cl
inc dword [rdx]
jmp 0x140007040
lea eax, [rcx + 5]
cmp r8d, eax
jne 0x1400070ac
add cl, 4
movsxd rax, edi
xor byte [rax + rdx + 0xf], cl
inc dword [rdx]
jmp 0x140007040
movsxd rcx, edi
lea eax, [rdi - 0x7a]
xor byte [rcx + rdx + 0xf], al
add edi, 6
cmp edi, 0x1e
jb 0x140006e00
mov byte [rdx + 9], 1
add rdx, 0xa
call fcn.1400012a0
mov ecx, 0x1008
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rsi, qword [rsp + 0x450]
mov rcx, qword [rsp + 0x400]
xor rcx, rsp
call fcn.14000a9e0
add rsp, 0x428
pop rdi
pop rbx
ret