Function at 0x1400531f0
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate process modules
Generate random numbers using a mersenne twister
Log keystrokes via polling
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x590
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400b3100]
xor rax, rsp
mov qword [rbp + 0x520], rax
xor r15d, r15d
mov ebx, 4
mov rax, qword gs:[0x58]
add rbx, qword [rax]
lea r14, [0x1400b6430]
mov eax, dword [rbx]
cmp dword [0x1400b63e4], eax
jle 0x1400532c7
lea rcx, [0x1400b63e4]
call fcn.1400588a0
cmp dword [0x1400b63e4], 0xffffffff
jne 0x1400532c7
xor ecx, ecx
call fcn.1400698dc
mov rdx, rax
mov dword [0x1400b77b4], 0xffffffff
mov dword [0x1400b6434], eax
mov r8d, 1
nop dword [rax]
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, r8d
mov dword [r14 + r8*4 + 4], edx
inc r8
cmp r8, 0x270
jb 0x140053290
mov dword [0x1400b6430], 0x270
lea rcx, [0x1400b63e4]
call fcn.140058834
mov eax, dword [rbx]
cmp dword [0x1400b641c], eax
jle 0x140053304
lea rcx, [0x1400b641c]
call fcn.1400588a0
cmp dword [0x1400b641c], 0xffffffff
jne 0x140053304
mov qword [0x1400b6420], r15
mov qword [0x1400b6428], 0x3d
lea rcx, [0x1400b641c]
call fcn.140058834
mov rdi, r15
lea r13, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
lea r12, [0x1400b63e8]
nop word [rax + rax]
mov qword [rbp + 0x440], r14
mov rsi, qword [0x1400b6420]
mov rdx, qword [0x1400b6428]
sub rdx, rsi
cmp rdx, 0xffffffffffffffff
jne 0x14005335b
mov rcx, r14
call fcn.140054d50
mov ebx, eax
shl rbx, 0x20
mov rcx, r14
call fcn.140054d50
mov eax, eax
or rbx, rax
jmp 0x14005336d
inc rdx
lea rcx, [rbp + 0x440]
call fcn.140054b60
mov rbx, rax
lea rax, [rbx + rsi]
movzx eax, byte [rax + r13]
mov byte [rdi + r12], al
inc rdi
cmp rdi, 0x32
jb 0x140053320
mov byte [0x1400b641a], r15b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
movabs rbx, 0x98396d515d9dcb21
mov qword [rbp + 0x440], rbx
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a0], rax
movabs r13, 0x8a9c1450fb187f45
mov qword [rbp + 0x440], r13
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a8], rax
movabs rax, 0xd96c13816a246f1a
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4b0], rax
movabs rax, 0x8a232dcd607055a1
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4b8], rax
movabs rcx, 0x50dc96530eb5fac1
mov qword [rbp + 0x440], rcx
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4c0], rax
movabs rdx, 0x9a4bc4f66fd91db2
mov qword [rbp + 0x440], rdx
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4c8], rax
movabs r14, 0x98656d7f5dc1cb7d
mov qword [rbp + 0x440], r14
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x460], rax
movabs rsi, 0x8af21422fb7d7f0e
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x468], rax
movabs rdi, 0xd91e13c56a486f7f
mov qword [rbp + 0x440], rdi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x470], rax
movabs r12, 0x8a512da8600655c8
mov qword [rbp + 0x440], r12
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x478], rax
mov qword [rbp + 0x440], rcx
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x480], rax
mov qword [rbp + 0x440], rdx
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x488], rax
vmovdqu ymm0, ymmword [rbp + 0x4a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x460]
vmovdqa ymmword [rbp + 0x4a0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x4c0]
vxorps xmm0, xmm0, xmmword [rbp + 0x480]
vmovdqa xmmword [rbp + 0x4c0], xmm0
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
lea rcx, [rbp + 0x4a0]
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400b6298], rax
cmp rax, 0xffffffffffffffff
jne 0x140053c0e
movabs rax, 0xb80a195f39a4ae13
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x460], rax
movabs rax, 0xfc9b6646db0d1e63
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x468], rax
movabs rax, 0xd91e13c56a421d1a
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x470], rax
mov qword [rbp + 0x440], r12
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x478], rax
mov qword [rbp + 0x440], r14
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a0], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a8], rax
mov qword [rbp + 0x440], rdi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4b0], rax
mov qword [rbp + 0x440], r12
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4b8], rax
vmovdqu ymm0, ymmword [rbp + 0x460]
vpxor ymm1, ymm0, ymmword [rbp + 0x4a0]
vmovdqa ymmword [rbp + 0x460], ymm1
lea rdx, [rbp + 0x460]
lea rcx, [0x1400b49d0]
vzeroupper
call fcn.14004ca30
xorps xmm0, xmm0
movups xmmword [rbp + 0x460], xmm0
mov qword [rbp + 0x470], r15
mov qword [rbp + 0x478], r15
mov r8d, 7
lea rdx, str.drv.sys
lea rcx, [rbp + 0x460]
call fcn.1400484c0
lea rcx, [rbp + 0x460]
call fcn.14004df70
test al, al
je 0x140053abf
movabs rax, 0xf5451f1a2ba8b919
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4e0], rax
movabs rax, 0x8af21e469e0d0f6f
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4e8], rax
mov qword [rbp + 0x440], r14
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a0], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a8], rax
movdqa xmm0, xmmword [rbp + 0x4e0]
xorps xmm0, xmmword [rbp + 0x4a0]
movdqa xmmword [rbp + 0x4e0], xmm0
lea rdx, [rbp + 0x4e0]
lea rcx, [0x1400b49d0]
call fcn.14004ca30
mov ecx, 0x2ee
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp + 0x440], rbx
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a0], rax
mov qword [rbp + 0x440], r13
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a8], rax
movabs rax, 0xd96c13816a246f1a
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4b0], rax
movabs rax, 0x8a232dcd607055a1
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4b8], rax
movabs rbx, 0x50dc96530eb5fac1
mov qword [rbp + 0x440], rbx
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4c0], rax
movabs r13, 0x9a4bc4f66fd91db2
mov qword [rbp + 0x440], r13
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4c8], rax
mov qword [rbp + 0x440], r14
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x460], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x468], rax
mov qword [rbp + 0x440], rdi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x470], rax
mov qword [rbp + 0x440], r12
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x478], rax
mov qword [rbp + 0x440], rbx
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x480], rax
mov qword [rbp + 0x440], r13
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x488], rax
vmovdqu ymm0, ymmword [rbp + 0x460]
vpxor ymm0, ymm0, ymmword [rbp + 0x4a0]
vmovdqa ymmword [rbp + 0x4a0], ymm0
vmovdqa xmm1, xmmword [rbp + 0x4c0]
vxorps xmm1, xmm1, xmmword [rbp + 0x480]
vmovdqa xmmword [rbp + 0x4c0], xmm1
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
lea rcx, [rbp + 0x4a0]
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400b6298], rax
cmp rax, 0xffffffffffffffff
jne 0x140053d02
movabs rax, 0x98656d0d32b3b918
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4e0], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4e8], rax
mov qword [rbp + 0x440], r14
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a0], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a8], rax
movdqa xmm0, xmmword [rbp + 0x4e0]
xorps xmm0, xmmword [rbp + 0x4a0]
movdqa xmmword [rbp + 0x4e0], xmm0
movabs rax, 0xf9034d1331a8bf0e
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a0], rax
movabs rax, 0xaa9d60029f181367
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a8], rax
movabs rax, 0xf96a70a00426001c
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4b0], rax
movabs rax, 0xef2744da04263abc
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4b8], rax
movabs rax, 0x39a8ff2b6b95d6b3
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4c0], rax
movabs rax, 0x9a4bc4f66fd97adc
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4c8], rax
mov qword [rbp + 0x440], r14
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x460], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x468], rax
mov qword [rbp + 0x440], rdi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x470], rax
mov qword [rbp + 0x440], r12
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x478], rax
mov qword [rbp + 0x440], rbx
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x480], rax
mov qword [rbp + 0x440], r13
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x488], rax
vmovdqu ymm0, ymmword [rbp + 0x460]
vpxor ymm1, ymm0, ymmword [rbp + 0x4a0]
vmovdqa ymmword [rbp + 0x4a0], ymm1
vmovdqa xmm2, xmmword [rbp + 0x4c0]
vxorps xmm2, xmm2, xmmword [rbp + 0x480]
vmovdqa xmmword [rbp + 0x4c0], xmm2
lea r8, [rbp + 0x4e0]
lea rdx, [rbp + 0x4a0]
jmp 0x140054958
movabs rax, 0x98656d0d32b3b918
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4e0], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4e8], rax
mov qword [rbp + 0x440], r14
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a0], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a8], rax
movdqa xmm0, xmmword [rbp + 0x4e0]
xorps xmm0, xmmword [rbp + 0x4a0]
movdqa xmmword [rbp + 0x4e0], xmm0
movabs rax, 0xec45091a31a8aa1b
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x460], rax
movabs rax, 0xf89634529a105f61
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x468], rax
movabs rax, 0xd91e13c5182d1916
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x470], rax
mov qword [rbp + 0x440], r12
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x478], rax
mov qword [rbp + 0x440], r14
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a0], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a8], rax
mov qword [rbp + 0x440], rdi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4b0], rax
mov qword [rbp + 0x440], r12
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4b8], rax
vmovdqu ymm0, ymmword [rbp + 0x4a0]
lea r8, [rbp + 0x4e0]
jmp 0x140054941
movabs rax, 0xb801081a33e1a413
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x460], rax
movabs rax, 0xeed26443965d107a
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x468], rax
movabs rax, 0xd91e19b70f3e060d
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x470], rax
mov qword [rbp + 0x440], r12
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x478], rax
mov qword [rbp + 0x440], r14
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a0], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a8], rax
mov qword [rbp + 0x440], rdi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4b0], rax
mov qword [rbp + 0x440], r12
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4b8], rax
vmovdqu ymm0, ymmword [rbp + 0x4a0]
vpxor ymm0, ymm0, ymmword [rbp + 0x460]
vmovdqa ymmword [rbp + 0x460], ymm0
lea rdx, [rbp + 0x460]
lea rcx, [0x1400b49d0]
vzeroupper
call fcn.14004ca30
movabs r13, 0x984b6d4d5db2cb1e
mov qword [rbp + 0x440], r13
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4e0], rax
movabs rbx, 0x8af21447fb057f6b
mov qword [rbp + 0x440], rbx
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4e8], rax
mov qword [rbp + 0x440], r14
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a0], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a8], rax
movdqa xmm0, xmmword [rbp + 0x4e0]
xorps xmm0, xmmword [rbp + 0x4a0]
movdqa xmmword [rbp + 0x4e0], xmm0
lea rcx, [rbp + 0x4e0]
call fcn.140054a60
mov dword [0x1400b6218], eax
movabs r8, 0xb802031629a8aa0a
test eax, eax
jne 0x140053f79
movabs rcx, 0xa4c06741db0f1068
movabs rdx, 0xd91e13c5602d171a
nop dword [rax]
mov byte [0x1400b61ea], 1
cmp byte [0x1400b61e9], r15b
jne 0x140053eb1
mov qword [rbp + 0x440], r8
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x460], rax
mov qword [rbp + 0x440], rcx
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x468], rax
mov qword [rbp + 0x440], rdx
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x470], rax
mov qword [rbp + 0x440], r12
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x478], rax
mov qword [rbp + 0x440], r14
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x500], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x508], rax
mov qword [rbp + 0x440], rdi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x510], rax
mov qword [rbp + 0x440], r12
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x518], rax
vmovdqu ymm0, ymmword [rbp + 0x460]
vpxor ymm1, ymm0, ymmword [rbp + 0x500]
vmovdqa ymmword [rbp + 0x460], ymm1
lea rdx, [rbp + 0x460]
lea rcx, [0x1400b49d0]
vzeroupper
call fcn.14004ca30
mov byte [0x1400b61e9], 1
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14005442a
mov qword [rbp + 0x440], r13
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x440], rbx
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x458], rax
mov qword [rbp + 0x440], r14
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a0], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a8], rax
movdqa xmm0, xmmword [rbp + 0x450]
xorps xmm0, xmmword [rbp + 0x4a0]
movdqa xmmword [rbp + 0x450], xmm0
lea rcx, [rbp + 0x450]
call fcn.140054a60
mov dword [0x1400b6218], eax
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1400b6218]
test eax, eax
movabs rcx, 0xa4c06741db0f1068
movabs rdx, 0xd91e13c5602d171a
movabs r8, 0xb802031629a8aa0a
je 0x140053dc0
mov eax, eax
mov qword [rbp + 0x460], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x28
lea rax, [rbp + 0x460]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
lea r8, [rbp + 0x460]
mov edx, 0x221a58
mov rcx, qword [0x1400b6298]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1400547e0
cmp byte [0x1400b61ea], r15b
je 0x1400541e3
movabs rax, 0xb802031629a8aa0a
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x460], rax
movabs rax, 0xe49d7747885d4f3f
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x468], rax
movabs rax, 0xba3e61aa0c681c1b
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x470], rax
movabs rax, 0xfe7148d0052867bb
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x478], rax
movabs rax, 0x33fcf23261d9daae
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x480], rax
movabs rax, 0xf62fea8201bc74de
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x488], rax
movabs rax, 0x65fc48192522042f
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x490], rax
movabs rcx, 0xf126bbbce026e48c
mov qword [rbp + 0x440], rcx
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x498], rax
mov qword [rbp + 0x440], r14
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a0], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a8], rax
mov qword [rbp + 0x440], rdi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4b0], rax
mov qword [rbp + 0x440], r12
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4b8], rax
movabs rax, 0x50dc96530eb5fac1
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4c0], rax
movabs rax, 0x9a4bc4f66fd91db2
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4c8], rax
movabs rax, 0x65fc481925220e43
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4d0], rax
mov qword [rbp + 0x440], rcx
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4d8], rax
vmovdqu ymm0, ymmword [rbp + 0x460]
vpxor ymm1, ymm0, ymmword [rbp + 0x4a0]
vmovdqa ymmword [rbp + 0x460], ymm1
vmovdqu ymm0, ymmword [rbp + 0x480]
vpxor ymm1, ymm0, ymmword [rbp + 0x4c0]
vmovdqa ymmword [rbp + 0x480], ymm1
lea rdx, [rbp + 0x460]
lea rcx, [0x1400b49d0]
vzeroupper
call fcn.14004ca30
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rax, 0x98006d165dadcb1e
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x460], rax
movabs rax, 0x8a96140cfb097f60
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x468], rax
movabs rax, 0xd91e13c56a246f13
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x470], rax
mov qword [rbp + 0x440], r12
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x478], rax
mov qword [rbp + 0x440], r14
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a0], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a8], rax
mov qword [rbp + 0x440], rdi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4b0], rax
mov qword [rbp + 0x440], r12
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4b8], rax
vmovdqu ymm0, ymmword [rbp + 0x4a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x460]
vmovdqu ymmword [rbp + 0x460], ymm1
mov rdi, r15
mov edx, dword [0x1400b6218]
mov ecx, 0x18
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14005443e
mov qword [0x1400b62a0], r15
mov rcx, qword [0x1400b6298]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0x98656d0d32b3b918
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a0], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a8], rax
mov qword [rbp + 0x440], r14
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x460], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x468], rax
movdqa xmm0, xmmword [rbp + 0x460]
xorps xmm0, xmmword [rbp + 0x4a0]
movdqa xmmword [rbp + 0x4a0], xmm0
movabs rax, 0xec45091a31a8aa1b
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x460], rax
movabs rax, 0xe9d2704c921b5f61
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x468], rax
movabs rax, 0xb57a3db1042d0613
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x470], rax
movabs rax, 0x8a512da8600655a4
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x478], rax
mov qword [rbp + 0x440], r14
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4e0], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4e8], rax
movabs rax, 0xd91e13c56a486f7f
mov qword [rbp + 0x440], rax
jmp 0x14005490f
mov rcx, qword [0x1400b6298]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14005496e
xor edx, edx
mov r8d, 0x434
lea rcx, [rbp + 4]
call fcn.140085510
mov dword [rbp], 0x438
lea rdx, [rbp]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
cmp eax, 1
jne 0x1400544bd
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x460]
call fcn.14005a774
test rax, rax
jne 0x1400544b9
lea rdx, [rbp]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
cmp eax, 1
jne 0x1400544bd
nop
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x460]
call fcn.14005a774
test rax, rax
jne 0x1400544b9
lea rdx, [rbp]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
cmp eax, 1
je 0x140054490
jmp 0x1400544bd
mov rdi, qword [rbp + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1400b62a0], rdi
test rdi, rdi
je 0x1400542ec
mov ecx, 8
call fcn.140058b58
lea rcx, [0x140001ba0]
mov qword [rax], rcx
mov qword [rbp + 0x440], rax
lea rcx, [rbp + 0x4e8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x140054a30]
xor edx, edx
xor ecx, ecx
call fcn.14006a318
mov qword [rbp + 0x4e0], rax
test rax, rax
je 0x14005499e
mov qword [rbp + 0x440], r15
mov ecx, 8
call fcn.140058b58
lea rcx, [0x140001270]
mov qword [rax], rcx
mov qword [rbp + 0x440], rax
lea rcx, [rbp + 0x458]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x140054a30]
xor edx, edx
xor ecx, ecx
call fcn.14006a318
mov qword [rbp + 0x450], rax
test rax, rax
je 0x1400549f5
mov qword [rbp + 0x440], r15
mov ecx, 8
call fcn.140058b58
lea rcx, [0x140035a60]
mov qword [rax], rcx
mov qword [rbp + 0x440], rax
lea rcx, [rbp + 0x508]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x140054a30]
xor edx, edx
xor ecx, ecx
call fcn.14006a318
mov qword [rbp + 0x500], rax
test rax, rax
je 0x1400549e3
mov qword [rbp + 0x440], r15
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
je 0x1400545ee
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x1400546aa
movabs rbx, 0x8af21447fb057f6b
nop dword [rax]
mov qword [rbp + 0x440], r13
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a0], rax
mov qword [rbp + 0x440], rbx
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a8], rax
mov qword [rbp + 0x440], r14
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x460], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x468], rax
movdqa xmm0, xmmword [rbp + 0x4a0]
xorps xmm0, xmmword [rbp + 0x460]
movdqa xmmword [rbp + 0x4a0], xmm0
lea rcx, [rbp + 0x4a0]
call fcn.140054a60
test eax, eax
je 0x1400546aa
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140054610
mov byte [0x1400b61ec], 1
cmp dword [rbp + 0x4e8], 0
je 0x1400549d8
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp + 0x4e8], eax
je 0x1400549cd
movaps xmm0, xmmword [rbp + 0x4e0]
movdqa xmmword [rbp + 0x460], xmm0
xor edx, edx
lea rcx, [rbp + 0x460]
call fcn.140057e5c
test eax, eax
jne 0x1400549c2
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x4e0], xmm0
mov byte [0x1400b61eb], 1
cmp dword [rbp + 0x458], eax
je 0x1400549d8
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp + 0x458], eax
je 0x1400549cd
movaps xmm0, xmmword [rbp + 0x450]
movdqa xmmword [rbp + 0x460], xmm0
xor edx, edx
lea rcx, [rbp + 0x460]
call fcn.140057e5c
test eax, eax
jne 0x1400549c2
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x450], xmm0
mov byte [0x1400b3d60], al
cmp dword [rbp + 0x508], eax
je 0x1400549d8
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp + 0x508], eax
je 0x1400549cd
movaps xmm0, xmmword [rbp + 0x500]
movdqa xmmword [rbp + 0x460], xmm0
xor edx, edx
lea rcx, [rbp + 0x460]
call fcn.140057e5c
test eax, eax
jne 0x1400549c2
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x500], xmm0
mov rcx, qword [0x1400b6298]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp dword [rbp + 0x508], 0
jne 0x1400549b6
cmp dword [rbp + 0x458], 0
jne 0x1400549bc
cmp dword [rbp + 0x4e8], 0
jne 0x1400549b0
jmp 0x140054437
mov rcx, qword [0x1400b6298]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0x98656d0d32b3b918
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a0], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4a8], rax
mov qword [rbp + 0x440], r14
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x460], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x468], rax
movdqa xmm0, xmmword [rbp + 0x460]
xorps xmm0, xmmword [rbp + 0x4a0]
movdqa xmmword [rbp + 0x4a0], xmm0
movabs rax, 0xec45091a31a8aa1b
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x460], rax
movabs rax, 0xe29175568f1c5f61
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x468], rax
movabs rax, 0xba7161b54a271b5f
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x470], rax
movabs rax, 0x8a512da8607526ad
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x478], rax
mov qword [rbp + 0x440], r14
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4e0], rax
mov qword [rbp + 0x440], rsi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4e8], rax
mov qword [rbp + 0x440], rdi
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4f0], rax
mov qword [rbp + 0x440], r12
mov rax, qword [rbp + 0x440]
mov qword [rbp + 0x4f8], rax
lea r8, [rbp + 0x4a0]
vmovdqu ymm0, ymmword [rbp + 0x4e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x460]
vmovdqa ymmword [rbp + 0x460], ymm1
lea rdx, [rbp + 0x460]
xor ecx, ecx
mov r9d, 0x40000
vzeroupper
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
mov rcx, qword [rbp + 0x520]
xor rcx, rsp
call fcn.140058530
lea r11, [rsp + 0x590]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov dword [rbp + 0x4e8], r15d
mov ecx, 6
call fcn.140057d18
nop
call fcn.14006a404
nop
call fcn.14006a404
nop
call fcn.14006a404
nop
mov ecx, 2
call fcn.140057d18
int3
mov ecx, 5
call fcn.140057d18
int3
mov ecx, 1
call fcn.140057d18
nop
mov dword [rbp + 0x508], r15d
mov ecx, 6
call fcn.140057d18
nop
mov dword [rbp + 0x458], r15d
mov ecx, 6
call fcn.140057d18
int3