Function at 0x1400019f0
Capabilities:
Create process on windows
Create process suspended
Execute command
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, str.kerber.exe
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ebx, 9
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._________________________________________________________________________________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400034f0
mov rcx, rax
lea rdx, str.________________::____________________________________________::_________________n
call fcn.1400034f0
mov rcx, rax
lea rdx, str._______________:5:::____________________________________:::5:________________n
call fcn.1400034f0
mov rcx, rax
lea rdx, str._____________.B_BGP_.7:________________________________:7._PGB_B.______________n
call fcn.1400034f0
mov rcx, rax
lea rdx, str.____________.5_B_:B_B57:_____:____________:_____:75B_B:__5______________n
call fcn.1400034f0
mov rcx, rax
lea rdx, str.__________5___BGPB______G_.:7Y__________57:._G______GPGB___5___________n
call fcn.1400034f0
mov rcx, rax
lea rdx, str.________.P__B__B5___BGB____B.7__.__.___.____BGB___5B__B__P._________n
call fcn.1400034f0
mov rcx, rax
lea rdx, str.________75___5_____GGB__5.:GBBG:_5__BGG_____5___57_________n
call fcn.1400034f0
mov rcx, rax
lea rdx, str._______7_____________BY_JB________BJ_YB_____________7________n
call fcn.1400034f0
mov rcx, rax
lea rdx, str.____:7B_____BGBB_________GB____________________GG_________BBGB_____B7:_____n
call fcn.1400034f0
mov rcx, rax
lea rdx, str.___75___P_:__G________YB_5G________G5_BY________G__:_P___57____n
call fcn.1400034f0
mov rcx, rax
lea rdx, str.____:G_J:_7:7__P___JJG__7__BB__7__GJJ___P_77:7_:J_G:_____n
call fcn.1400034f0
mov rcx, rax
lea rdx, str.______._JP_BB_Y.JBPY7.:B__GBBBBG__B:.7YPBJ.Y_BB_PJ_._______n
call fcn.1400034f0
mov ebx, 0xe
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.___________PGGY__________J7___BB___7J__________YGGP___________n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400034f0
mov rcx, rax
lea rdx, str.___________________:5______P_G____G7..7G____G_P______5:____________________n
call fcn.1400034f0
mov rcx, rax
lea rdx, str._________________5_______P_YGPB_Y7G77P7Y_BPPY_P_______5__________________n
call fcn.1400034f0
mov rcx, rax
lea rdx, str._________________5_________J_YP7___JJJJ___7PY_J__________5__________________n
call fcn.1400034f0
mov rcx, rax
lea rdx, str._________________.P_________5_BBPJPPJPBB_5_________P.__________________n
call fcn.1400034f0
mov rcx, rax
lea rdx, str.____________________P______B_.J_BGBBGB__._B______P_____________________n
call fcn.1400034f0
mov rcx, rax
lea rdx, str._____________________:_J5PB____P._5BB5_.P____BP5J_.______________________n
call fcn.1400034f0
mov rcx, rax
lea rdx, str.___________________________Y_____BJ::::JB_____Y____________________________n
call fcn.1400034f0
mov rcx, rax
lea rdx, str.____________________________G______GPYYPG______G_____________________________n
call fcn.1400034f0
mov rcx, rax
lea rdx, str._______________________________P______________5_______________________________n
call fcn.1400034f0
mov rcx, rax
lea rdx, str.________________________________._YB______BY_._________________________________n
call fcn.1400034f0
mov rcx, rax
lea rdx, str.____________________________________:7__7:_____________________________________n
call fcn.1400034f0
mov rcx, rax
lea rdx, str._________________________________________________________________________________n
call fcn.1400034f0
mov rcx, rax
lea rdx, [0x1400036c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x140007190]
movdqu xmmword [rbp - 0x60], xmm1
mov byte [rbp - 0x70], 0
movups xmmword [rbp - 0x10], xmm0
movdqu xmmword [rbp], xmm1
mov byte [rbp - 0x10], 0
movups xmmword [rbp - 0x30], xmm0
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0x30], 0
movups xmmword [rsp + 0x70], xmm0
movdqu xmmword [rbp - 0x80], xmm1
mov byte [rsp + 0x70], 0
mov ebx, 0xf
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____Want:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400034f0
mov ecx, 0xfffffff5
lea r13d, [rbx - 5]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r13w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Encrypt_C_or_E
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400034f0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._or
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400034f0
lea ebx, [r13 - 6]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Decrypt_D
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400034f0
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
mov edi, eax
lea ecx, [rax - 0x43]
test cl, 0xdd
je 0x1400022c9
lea ecx, [rax - 0x44]
test cl, 0xdf
je 0x140001f65
lea rcx, [0x140007024]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea ebx, [r13 + 2]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Choice__
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400034f0
mov rcx, rax
movzx edx, dil
call fcn.140003320
mov rcx, rax
lea rdx, str.___is_Incorrect..._____Next_time_choose:_C_or_E_for_Encryption_or_D_for_Decryption_
call fcn.1400034f0
mov rcx, rax
lea rdx, [0x1400036c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
lea r12d, [r13 - 2]
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r12w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r8d, 0x104
lea rdx, [rbp + 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
movups xmmword [rbp + 0x54], xmm0
movups xmmword [rbp + 0x64], xmm0
mov dword [rbp + 0x74], eax
mov dword [rbp + 0x10], 0x68
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140001f3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, [0x1400070a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400034f0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400036c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140001eb5
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001eb0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001eb0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000431c
movdqa xmm0, xmmword [0x140007190]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140001f05
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f00
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000431c
mov eax, 1
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140004080
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000263c
lea rcx, str.kerber.exe_d___start
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfffffff5
mov r12d, 8
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r12w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__Enter_text_to_DECRYPT__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400034f0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r13w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._n____
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400034f0
lea ebx, [r12 - 1]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp - 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140003700
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r12w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x50]
call fcn.1400018d0
nop
lea rcx, [rbp - 0x50]
call fcn.140002fb0
mov r14, rax
lea rbx, [0x140000000]
sub r14d, 1
js 0x140002100
movsxd r15, r14d
mov rdx, r15
lea rcx, [rbp - 0x50]
call fcn.140002fc0
movsx edi, byte [rax]
lea eax, [rdi - 0x20]
cmp eax, 0x5e
ja case.0x14000206b.49
cdqe
movzx eax, byte [rbx + rax + 0x269c]
mov ecx, dword [rbx + rax*4 + 0x2654]
add rcx, rbx
jmp rcx
mov al, 0x5e
jmp 0x1400020e7
mov al, 0x20
jmp 0x1400020e7
mov al, 0x25
jmp 0x1400020e7
mov al, 0x2e
jmp 0x1400020e7
mov al, 0x2a
jmp 0x1400020e7
mov al, 0x2c
jmp 0x1400020e7
mov al, 0x7e
jmp 0x1400020e7
mov al, 0x3d
jmp 0x1400020e7
mov al, 0x60
jmp 0x1400020e7
mov al, 0x2b
jmp 0x1400020e7
mov al, 0x2f
jmp 0x1400020e7
mov al, 0x2d
jmp 0x1400020e7
mov al, 0x23
jmp 0x1400020e7
mov al, 0x3a
jmp 0x1400020e7
mov al, 0x26
jmp 0x1400020e7
mov al, 0x3b
jmp 0x1400020e7
mov eax, 0x69
sub al, dil
jmp 0x1400020e7
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_islower]
test eax, eax
je 0x1400020cd
mov eax, 0xffffffdb
sub al, dil
jmp 0x1400020e7
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isupper]
test eax, eax
je 0x1400020e3
mov eax, 0xffffff9b
sub al, dil
jmp 0x1400020e7
movzx eax, dil
movzx edx, al
lea rcx, [rbp - 0x30]
call fcn.140002fe0
dec r15
sub r14d, 1
jns 0x140002040
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.140001510
nop
lea rcx, [rsp + 0x50]
call fcn.140002fb0
mov r14, rax
sub r14d, 1
js 0x1400021f2
movsxd r15, r14d
nop dword [rax]
mov rdx, r15
lea rcx, [rsp + 0x50]
call fcn.140002fc0
movsx edi, byte [rax]
lea eax, [rdi - 0x20]
cmp eax, 0x5e
ja case.0x14000215c.49
cdqe
movzx eax, byte [rbx + rax + 0x2744]
mov ecx, dword [rbx + rax*4 + 0x26fc]
add rcx, rbx
jmp rcx
mov al, 0x5e
jmp 0x1400021d8
mov al, 0x20
jmp 0x1400021d8
mov al, 0x25
jmp 0x1400021d8
mov al, 0x2e
jmp 0x1400021d8
mov al, 0x2a
jmp 0x1400021d8
mov al, 0x2c
jmp 0x1400021d8
mov al, 0x7e
jmp 0x1400021d8
mov al, 0x3d
jmp 0x1400021d8
mov al, 0x60
jmp 0x1400021d8
mov al, 0x2b
jmp 0x1400021d8
mov al, 0x2f
jmp 0x1400021d8
mov al, 0x2d
jmp 0x1400021d8
mov al, 0x23
jmp 0x1400021d8
mov al, 0x3a
jmp 0x1400021d8
mov al, 0x26
jmp 0x1400021d8
mov al, 0x3b
jmp 0x1400021d8
mov eax, 0x69
sub al, dil
jmp 0x1400021d8
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_islower]
test eax, eax
je 0x1400021be
mov eax, 0xffffffdb
sub al, dil
jmp 0x1400021d8
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isupper]
test eax, eax
je 0x1400021d4
mov eax, 0xffffff9b
sub al, dil
jmp 0x1400021d8
movzx eax, dil
movzx edx, al
lea rcx, [rsp + 0x70]
call fcn.140002fe0
dec r15
sub r14d, 1
jns 0x140002130
lea rcx, str.kerber.exe_d___done
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ebx, 0xc
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400034f0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea edx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003740
mov rcx, rax
lea rdx, [0x1400036c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea edx, [rbx + 3]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._n__Done._Text_Decrypted.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400034f0
mov rcx, rax
lea rdx, [0x1400036c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r12w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
lea rcx, [rsp + 0x50]
call fcn.140003030
nop
jmp 0x140002633
lea rcx, str.kerber.exe_e___start
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfffffff5
mov r12d, 8
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r12w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.__Enter_text_to_ENCRYPT__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400034f0
lea ebx, [r12 + 4]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._n____
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400034f0
lea ebx, [r12 - 1]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rbp - 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140003700
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r12w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp - 0x70]
call fcn.140002fb0
mov r14, rax
lea rbx, [0x140000000]
sub r14d, 1
js 0x140002460
movsxd r15, r14d
nop word [rax + rax]
mov rdx, r15
lea rcx, [rbp - 0x70]
call fcn.140002fc0
movsx edi, byte [rax]
lea eax, [rdi - 0x20]
cmp eax, 0x5e
ja case.0x1400023cb.49
cdqe
movzx eax, byte [rbx + rax + 0x27ec]
mov ecx, dword [rbx + rax*4 + 0x27a4]
add rcx, rbx
jmp rcx
mov al, 0x5e
jmp 0x140002447
mov al, 0x20
jmp 0x140002447
mov al, 0x25
jmp 0x140002447
mov al, 0x2e
jmp 0x140002447
mov al, 0x2a
jmp 0x140002447
mov al, 0x2c
jmp 0x140002447
mov al, 0x7e
jmp 0x140002447
mov al, 0x3d
jmp 0x140002447
mov al, 0x60
jmp 0x140002447
mov al, 0x2b
jmp 0x140002447
mov al, 0x2f
jmp 0x140002447
mov al, 0x2d
jmp 0x140002447
mov al, 0x23
jmp 0x140002447
mov al, 0x3a
jmp 0x140002447
mov al, 0x26
jmp 0x140002447
mov al, 0x3b
jmp 0x140002447
mov eax, 0x69
sub al, dil
jmp 0x140002447
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_islower]
test eax, eax
je 0x14000242d
mov eax, 0xffffffdb
sub al, dil
jmp 0x140002447
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isupper]
test eax, eax
je 0x140002443
mov eax, 0xffffff9b
sub al, dil
jmp 0x140002447
movzx eax, dil
movzx edx, al
lea rcx, [rbp - 0x30]
call fcn.140002fe0
dec r15
sub r14d, 1
jns 0x1400023a0
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.140001220
nop
lea rcx, [rbp - 0x50]
call fcn.140002fb0
mov r14, rax
sub r14d, 1
js 0x140002551
movsxd r15, r14d
nop word [rax + rax]
mov rdx, r15
lea rcx, [rbp - 0x50]
call fcn.140002fc0
movsx edi, byte [rax]
lea eax, [rdi - 0x20]
cmp eax, 0x5e
ja case.0x1400024bb.49
cdqe
movzx eax, byte [rbx + rax + 0x2894]
mov ecx, dword [rbx + rax*4 + 0x284c]
add rcx, rbx
jmp rcx
mov al, 0x5e
jmp 0x140002537
mov al, 0x20
jmp 0x140002537
mov al, 0x25
jmp 0x140002537
mov al, 0x2e
jmp 0x140002537
mov al, 0x2a
jmp 0x140002537
mov al, 0x2c
jmp 0x140002537
mov al, 0x7e
jmp 0x140002537
mov al, 0x3d
jmp 0x140002537
mov al, 0x60
jmp 0x140002537
mov al, 0x2b
jmp 0x140002537
mov al, 0x2f
jmp 0x140002537
mov al, 0x2d
jmp 0x140002537
mov al, 0x23
jmp 0x140002537
mov al, 0x3a
jmp 0x140002537
mov al, 0x26
jmp 0x140002537
mov al, 0x3b
jmp 0x140002537
mov eax, 0x69
sub al, dil
jmp 0x140002537
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_islower]
test eax, eax
je 0x14000251d
mov eax, 0xffffffdb
sub al, dil
jmp 0x140002537
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isupper]
test eax, eax
je 0x140002533
mov eax, 0xffffff9b
sub al, dil
jmp 0x140002537
movzx eax, dil
movzx edx, al
lea rcx, [rsp + 0x70]
call fcn.140002fe0
dec r15
sub r14d, 1
jns 0x140002490
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.1400016f0
nop
lea rcx, str.kerber.exe_e___done
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r13w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.____
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400034f0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xe
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [rsp + 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003740
mov rcx, rax
lea rdx, [0x1400036c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._n__Done._Text_Encrypted.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400034f0
mov rcx, rax
lea rdx, [0x1400036c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, r12w
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
lea rcx, [rsp + 0x50]
call fcn.140003030
nop
lea rcx, [rbp - 0x50]
call fcn.140003030
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3