Function at 0x140049534
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x288
movaps xmmword [rsp + 0x270], xmm15
movdqa xmmword [rsp + 0x260], xmm14
movaps xmmword [rsp + 0x250], xmm13
movaps xmmword [rsp + 0x240], xmm12
movaps xmmword [rsp + 0x230], xmm11
movaps xmmword [rsp + 0x220], xmm10
movaps xmmword [rsp + 0x210], xmm9
movaps xmmword [rsp + 0x200], xmm8
movaps xmmword [rsp + 0x1f0], xmm7
movaps xmmword [rsp + 0x1e0], xmm6
mov rbx, rdx
mov rdi, rcx
mov ecx, 0xf
call fcn.140035f93
test al, al
je 0x1400470af
mov rcx, rdi
mov rdx, rbx
movaps xmm6, xmmword [rsp + 0x1e0]
movaps xmm7, xmmword [rsp + 0x1f0]
movaps xmm8, xmmword [rsp + 0x200]
movaps xmm9, xmmword [rsp + 0x210]
movaps xmm10, xmmword [rsp + 0x220]
movaps xmm11, xmmword [rsp + 0x230]
movaps xmm12, xmmword [rsp + 0x240]
movaps xmm13, xmmword [rsp + 0x250]
movaps xmm14, xmmword [rsp + 0x260]
movaps xmm15, xmmword [rsp + 0x270]
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp 0x140047e78
call fcn.140047e6e
test al, al
je 0x14004712e
mov rcx, rdi
mov rdx, rbx
movaps xmm6, xmmword [rsp + 0x1e0]
movaps xmm7, xmmword [rsp + 0x1f0]
movaps xmm8, xmmword [rsp + 0x200]
movaps xmm9, xmmword [rsp + 0x210]
movaps xmm10, xmmword [rsp + 0x220]
movaps xmm11, xmmword [rsp + 0x230]
movaps xmm12, xmmword [rsp + 0x240]
movaps xmm13, xmmword [rsp + 0x250]
movaps xmm14, xmmword [rsp + 0x260]
movaps xmm15, xmmword [rsp + 0x270]
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp 0x14004840e
mov ecx, 0xa
call fcn.140035f93
test al, al
je 0x1400471b2
mov rcx, rdi
mov rdx, rbx
movaps xmm6, xmmword [rsp + 0x1e0]
movaps xmm7, xmmword [rsp + 0x1f0]
movaps xmm8, xmmword [rsp + 0x200]
movaps xmm9, xmmword [rsp + 0x210]
movaps xmm10, xmmword [rsp + 0x220]
movaps xmm11, xmmword [rsp + 0x230]
movaps xmm12, xmmword [rsp + 0x240]
movaps xmm13, xmmword [rsp + 0x250]
movaps xmm14, xmmword [rsp + 0x260]
movaps xmm15, xmmword [rsp + 0x270]
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp 0x140048c45
mov ecx, 9
call fcn.140035f93
test al, al
je 0x140047236
mov rcx, rdi
mov rdx, rbx
movaps xmm6, xmmword [rsp + 0x1e0]
movaps xmm7, xmmword [rsp + 0x1f0]
movaps xmm8, xmmword [rsp + 0x200]
movaps xmm9, xmmword [rsp + 0x210]
movaps xmm10, xmmword [rsp + 0x220]
movaps xmm11, xmmword [rsp + 0x230]
movaps xmm12, xmmword [rsp + 0x240]
movaps xmm13, xmmword [rsp + 0x250]
movaps xmm14, xmmword [rsp + 0x260]
movaps xmm15, xmmword [rsp + 0x270]
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp 0x140049534
mov rax, qword [rdi + 0x20]
movdqa xmm9, xmmword [rdi]
movdqa xmm13, xmmword [rdi + 0x10]
movaps xmm12, xmmword [rdi + 0x20]
lea rcx, [rax + 1]
movd xmm15, ecx
shr rcx, 0x20
movd xmm0, ecx
pslldq xmm0, 8
shufps xmm0, xmm12, 0xe8
por xmm15, xmm0
lea rcx, [rax + 2]
movd xmm6, ecx
shr rcx, 0x20
movd xmm0, ecx
pslldq xmm0, 8
shufps xmm0, xmm12, 0xe8
por xmm6, xmm0
add rax, 3
movd xmm7, eax
shr rax, 0x20
movd xmm0, eax
pslldq xmm0, 8
shufps xmm0, xmm12, 0xe8
por xmm7, xmm0
movdqa xmm3, xmmword [0x1400dc260]
mov eax, 6
movdqa xmm4, xmm9
movdqa xmm5, xmm9
movdqa xmm8, xmm9
movdqa xmmword [rsp + 0x90], xmm9
movdqa xmm2, xmm13
movdqa xmm1, xmm13
movdqa xmm10, xmm13
movdqa xmmword [rsp + 0x80], xmm13
movdqa xmm11, xmm13
movdqa xmmword [rsp + 0x60], xmm3
movdqa xmmword [rsp + 0x50], xmm3
movdqa xmmword [rsp + 0x70], xmm3
movdqa xmmword [rsp + 0x40], xmm3
sub eax, 1
jb 0x1400477aa
movdqa xmmword [rsp + 0x20], xmm1
movaps xmm0, xmm12
movdqa xmm12, xmm2
movdqa xmm2, xmmword [rsp + 0x40]
paddd xmm2, xmm4
movdqa xmm3, xmmword [rsp + 0x50]
paddd xmm3, xmm5
movdqa xmm13, xmm10
movdqa xmm10, xmmword [rsp + 0x60]
paddd xmm10, xmm8
movdqa xmm1, xmm11
movdqa xmm11, xmmword [rsp + 0x70]
paddd xmm11, xmm9
xorps xmm0, xmm2
pxor xmm15, xmm3
pxor xmm6, xmm10
pxor xmm7, xmm11
pshuflw xmm0, xmm0, 0xb1
pshufhw xmm14, xmm0, 0xb1
pshuflw xmm0, xmm15, 0xb1
pshufhw xmm15, xmm0, 0xb1
pshuflw xmm0, xmm6, 0xb1
pshufhw xmm0, xmm0, 0xb1
pshuflw xmm6, xmm7, 0xb1
pshufhw xmm7, xmm6, 0xb1
paddd xmm12, xmm14
movdqa xmm6, xmmword [rsp + 0x20]
paddd xmm6, xmm15
movdqa xmmword [rsp + 0x20], xmm6
paddd xmm13, xmm0
paddd xmm1, xmm7
pxor xmm4, xmm12
pxor xmm5, xmm6
pxor xmm8, xmm13
pxor xmm9, xmm1
movdqa xmm6, xmm4
psrld xmm6, 0x14
pslld xmm4, 0xc
por xmm4, xmm6
movdqa xmm6, xmm5
psrld xmm6, 0x14
pslld xmm5, 0xc
por xmm5, xmm6
movdqa xmm6, xmm8
psrld xmm6, 0x14
pslld xmm8, 0xc
por xmm8, xmm6
movdqa xmm6, xmm9
psrld xmm6, 0x14
pslld xmm9, 0xc
por xmm9, xmm6
paddd xmm2, xmm4
paddd xmm3, xmm5
paddd xmm10, xmm8
paddd xmm11, xmm9
pxor xmm14, xmm2
movdqa xmm6, xmm14
psrld xmm6, 0x18
pslld xmm14, 8
por xmm14, xmm6
pxor xmm15, xmm3
movdqa xmm6, xmm15
psrld xmm6, 0x18
pslld xmm15, 8
por xmm15, xmm6
pxor xmm0, xmm10
movdqa xmm6, xmm0
psrld xmm6, 0x18
pslld xmm0, 8
por xmm0, xmm6
pxor xmm7, xmm11
movdqa xmm6, xmm7
psrld xmm6, 0x18
pslld xmm7, 8
por xmm7, xmm6
paddd xmm12, xmm14
movdqa xmm6, xmmword [rsp + 0x20]
paddd xmm6, xmm15
movdqa xmmword [rsp + 0x20], xmm6
paddd xmm13, xmm0
paddd xmm1, xmm7
pxor xmm4, xmm12
pxor xmm5, xmm6
pxor xmm8, xmm13
pxor xmm9, xmm1
movdqa xmm6, xmm4
psrld xmm6, 0x19
pslld xmm4, 7
por xmm4, xmm6
movdqa xmm6, xmm5
psrld xmm6, 0x19
pslld xmm5, 7
por xmm5, xmm6
movdqa xmm6, xmm8
psrld xmm6, 0x19
pslld xmm8, 7
por xmm8, xmm6
movdqa xmm6, xmm9
psrld xmm6, 0x19
pslld xmm9, 7
por xmm9, xmm6
pshufd xmm4, xmm4, 0x39
pshufd xmm5, xmm5, 0x39
pshufd xmm6, xmm8, 0x39
pshufd xmm9, xmm9, 0x39
pshufd xmm8, xmm12, 0x4e
movdqa xmmword [rsp + 0x30], xmm8
pshufd xmm8, xmmword [rsp + 0x20], 0x4e
movdqa xmmword [rsp + 0x20], xmm8
pshufd xmm12, xmm13, 0x4e
pshufd xmm13, xmm1, 0x4e
pshufd xmm8, xmm14, 0x93
pshufd xmm14, xmm15, 0x93
pshufd xmm0, xmm0, 0x93
pshufd xmm1, xmm7, 0x93
paddd xmm2, xmm4
paddd xmm3, xmm5
paddd xmm10, xmm6
paddd xmm11, xmm9
pshuflw xmm7, xmm2, 0xb1
pshufhw xmm15, xmm7, 0xb1
pshuflw xmm7, xmm8, 0xb1
pshufhw xmm7, xmm7, 0xb1
pxor xmm7, xmm15
pshuflw xmm8, xmm3, 0xb1
pshufhw xmm8, xmm8, 0xb1
pshuflw xmm14, xmm14, 0xb1
pshufhw xmm15, xmm14, 0xb1
pxor xmm15, xmm8
pshuflw xmm8, xmm10, 0xb1
pshufhw xmm8, xmm8, 0xb1
pshuflw xmm0, xmm0, 0xb1
pshufhw xmm14, xmm0, 0xb1
pxor xmm14, xmm8
pshuflw xmm0, xmm11, 0xb1
pshufhw xmm8, xmm0, 0xb1
pshuflw xmm0, xmm1, 0xb1
pshufhw xmm0, xmm0, 0xb1
pxor xmm0, xmm8
movdqa xmm1, xmmword [rsp + 0x30]
paddd xmm1, xmm7
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm8, xmmword [rsp + 0x20]
paddd xmm8, xmm15
paddd xmm12, xmm14
paddd xmm13, xmm0
pxor xmm4, xmm1
pxor xmm5, xmm8
pxor xmm6, xmm12
pxor xmm9, xmm13
movdqa xmm1, xmm4
psrld xmm1, 0x14
pslld xmm4, 0xc
por xmm4, xmm1
movdqa xmm1, xmm5
psrld xmm1, 0x14
pslld xmm5, 0xc
por xmm5, xmm1
movdqa xmm1, xmm6
psrld xmm1, 0x14
pslld xmm6, 0xc
por xmm6, xmm1
movdqa xmm1, xmm9
psrld xmm1, 0x14
pslld xmm9, 0xc
por xmm9, xmm1
paddd xmm2, xmm4
paddd xmm3, xmm5
paddd xmm10, xmm6
paddd xmm11, xmm9
movdqa xmmword [rsp + 0x40], xmm2
pxor xmm7, xmm2
movdqa xmm1, xmm7
psrld xmm1, 0x18
pslld xmm7, 8
por xmm7, xmm1
movdqa xmmword [rsp + 0x50], xmm3
pxor xmm15, xmm3
movdqa xmm1, xmm15
psrld xmm1, 0x18
pslld xmm15, 8
por xmm15, xmm1
movdqa xmmword [rsp + 0x60], xmm10
pxor xmm14, xmm10
movdqa xmm1, xmm14
psrld xmm1, 0x18
pslld xmm14, 8
por xmm14, xmm1
movdqa xmmword [rsp + 0x70], xmm11
pxor xmm0, xmm11
movdqa xmm1, xmm0
psrld xmm1, 0x18
pslld xmm0, 8
por xmm0, xmm1
movdqa xmm2, xmmword [rsp + 0x30]
paddd xmm2, xmm7
movdqa xmm3, xmm8
paddd xmm3, xmm15
paddd xmm12, xmm14
paddd xmm13, xmm0
pxor xmm4, xmm2
pxor xmm5, xmm3
pxor xmm6, xmm12
pxor xmm9, xmm13
movdqa xmm1, xmm4
psrld xmm1, 0x19
pslld xmm4, 7
por xmm4, xmm1
movdqa xmm1, xmm5
psrld xmm1, 0x19
pslld xmm5, 7
por xmm5, xmm1
movdqa xmm1, xmm6
psrld xmm1, 0x19
pslld xmm6, 7
por xmm6, xmm1
movdqa xmm1, xmm9
psrld xmm1, 0x19
pslld xmm9, 7
por xmm9, xmm1
pshufd xmm4, xmm4, 0x93
pshufd xmm5, xmm5, 0x93
pshufd xmm8, xmm6, 0x93
pshufd xmm9, xmm9, 0x93
pshufd xmm2, xmm2, 0x4e
pshufd xmm1, xmm3, 0x4e
pshufd xmm10, xmm12, 0x4e
pshufd xmm11, xmm13, 0x4e
pshufd xmm12, xmm7, 0x39
pshufd xmm15, xmm15, 0x39
pshufd xmm6, xmm14, 0x39
pshufd xmm7, xmm0, 0x39
jmp 0x140047302
mov rax, qword [rdi + 0x20]
lea rcx, [rax + 1]
mov rdx, rcx
shr rdx, 0x20
movd xmm14, edx
pslldq xmm14, 8
movaps xmm3, xmmword [rdi + 0x20]
shufps xmm14, xmm3, 0xe8
movd xmm13, ecx
por xmm13, xmm14
lea rcx, [rax + 2]
mov rdx, rcx
shr rdx, 0x20
movd xmm14, edx
pslldq xmm14, 8
shufps xmm14, xmm3, 0xe8
movd xmm0, ecx
por xmm0, xmm14
movdqa xmmword [rsp + 0x20], xmm0
lea rcx, [rax + 3]
mov rdx, rcx
shr rdx, 0x20
movd xmm0, edx
pslldq xmm0, 8
shufps xmm0, xmm3, 0xe8
movd xmm14, ecx
por xmm14, xmm0
movdqa xmmword [rsp + 0x30], xmm14
add rax, 4
mov rcx, rax
shr rcx, 0x20
movd xmm0, ecx
pslldq xmm0, 8
shufps xmm0, xmm3, 0xe8
movd xmm14, eax
por xmm14, xmm0
movaps xmm0, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0xa0], xmm0
movaps xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0xb0], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0xc0], xmm0
movaps xmm0, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0xd0], xmm0
movdqa xmmword [rsp + 0xe0], xmm4
movdqa xmmword [rsp + 0xf0], xmm5
movdqa xmmword [rsp + 0x100], xmm8
movdqa xmmword [rsp + 0x110], xmm9
movdqa xmmword [rsp + 0x120], xmm2
movdqa xmmword [rsp + 0x130], xmm1
movdqa xmmword [rsp + 0x140], xmm10
movdqa xmmword [rsp + 0x150], xmm11
movaps xmmword [rsp + 0x160], xmm12
movdqa xmmword [rsp + 0x170], xmm15
movdqa xmmword [rsp + 0x180], xmm6
movdqa xmmword [rsp + 0x190], xmm7
movaps xmmword [rsp + 0x1a0], xmm3
movdqa xmmword [rsp + 0x1b0], xmm13
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x1c0], xmm0
movaps xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x1d0], xmm0
movdqa xmmword [rdi + 0x20], xmm14
mov edi, 0x100
xor r13d, r13d
movdqa xmm6, xmmword [0x1400dc260]
lea r15, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_rand_chacha_src_guts.rs
xor ebp, ebp
movdqa xmm11, xmmword [rsp + 0x90]
movdqa xmm12, xmmword [rsp + 0x80]
cmp rbp, 0x40
je 0x140047a6a
movdqa xmm10, xmmword [rsp + rbp + 0xa0]
paddd xmm10, xmm6
movdqa xmm7, xmmword [rsp + rbp + 0x1a0]
movdqa xmm9, xmmword [rsp + rbp + 0xe0]
paddd xmm9, xmm11
movdqa xmm8, xmmword [rsp + rbp + 0x120]
paddd xmm8, xmm12
paddd xmm7, xmmword [rsp + rbp + 0x160]
xor esi, esi
mov r14, rdi
sub r14, 0x10
mov r12, rbx
cmovb r12, r13
cmovb r14, rdi
setae sil
mov rcx, r12
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_rand_chacha_src_guts.rs
call fcn.140049e62
shl rsi, 4
add rsi, rbx
movdqu xmmword [r12], xmm10
xor ebx, ebx
mov rdi, r14
sub rdi, 0x10
mov r12, rsi
cmovb r12, r13
cmovb rdi, r14
setae bl
mov rcx, r12
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_rand_chacha_src_guts.rs
call fcn.140049e62
shl rbx, 4
add rbx, rsi
movdqu xmmword [r12], xmm9
xor r12d, r12d
mov r14, rdi
sub r14, 0x10
mov rsi, rbx
cmovb rsi, r13
cmovb r14, rdi
setae r12b
mov rcx, rsi
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_rand_chacha_src_guts.rs
call fcn.140049e62
shl r12, 4
add r12, rbx
movdqu xmmword [rsi], xmm8
xor ebx, ebx
mov rdi, r14
sub rdi, 0x10
mov rsi, r12
cmovb rsi, r13
cmovb rdi, r14
setae bl
mov rcx, rsi
mov rdx, r15
call fcn.140049e62
shl rbx, 4
add rbx, r12
movdqu xmmword [rsi], xmm7
add rbp, 0x10
jmp 0x140047950
movaps xmm6, xmmword [rsp + 0x1e0]
movaps xmm7, xmmword [rsp + 0x1f0]
movaps xmm8, xmmword [rsp + 0x200]
movaps xmm9, xmmword [rsp + 0x210]
movaps xmm10, xmmword [rsp + 0x220]
movaps xmm11, xmmword [rsp + 0x230]
movaps xmm12, xmmword [rsp + 0x240]
movaps xmm13, xmmword [rsp + 0x250]
movaps xmm14, xmmword [rsp + 0x260]
movaps xmm15, xmmword [rsp + 0x270]
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x328
vmovaps xmmword [rsp + 0x310], xmm15
vmovaps xmmword [rsp + 0x300], xmm14
vmovaps xmmword [rsp + 0x2f0], xmm13
vmovaps xmmword [rsp + 0x2e0], xmm12
vmovdqa xmmword [rsp + 0x2d0], xmm11
vmovaps xmmword [rsp + 0x2c0], xmm10
vmovaps xmmword [rsp + 0x2b0], xmm9
vmovaps xmmword [rsp + 0x2a0], xmm8
vmovaps xmmword [rsp + 0x290], xmm7
vmovaps xmmword [rsp + 0x280], xmm6
mov rax, qword [rcx + 0x20]
vmovdqa xmm0, xmmword [rcx + 0x20]
lea r8, [rax + 1]
vpinsrd xmm1, xmm0, r8d, 0
shr r8, 0x20
vpinsrd xmm1, xmm1, r8d, 1
lea r8, [rax + 2]
vpinsrd xmm2, xmm0, r8d, 0
shr r8, 0x20
vpinsrd xmm2, xmm2, r8d, 1
add rax, 3
vpinsrd xmm3, xmm0, eax, 0
shr rax, 0x20
vpinsrd xmm4, xmm3, eax, 1
vbroadcasti128 ymm10, xmmword [rcx + 0x10]
vbroadcasti128 ymm6, xmmword [rcx]
mov r15, rdx
vinserti128 ymm3, ymm0, xmm1, 1
vinserti128 ymm5, ymm2, xmm4, 1
vmovdqa ymm4, ymmword [0x1400dc280]
mov eax, 6
vmovdqa ymm1, ymmword [0x1400dc2a0]
vmovdqa ymm2, ymmword [0x1400dc2c0]
vmovdqa ymm7, ymm6
vmovdqu ymmword [rsp + 0x50], ymm6
vmovdqa ymm9, ymm10
vmovdqu ymmword [rsp + 0x70], ymm10
vmovdqa ymm8, ymm4
sub eax, 1
jb 0x140048101
vpaddd ymm4, ymm4, ymm7
vpaddd ymm8, ymm8, ymm6
vpxor ymm3, ymm3, ymm4
vpxor ymm5, ymm8, ymm5
vpshuflw ymm3, ymm3, 0xb1
vpshufhw ymm3, ymm3, 0xb1
vpshuflw ymm5, ymm5, 0xb1
vpshufhw ymm5, ymm5, 0xb1
vpaddd ymm9, ymm9, ymm3
vpaddd ymm10, ymm10, ymm5
vpxor ymm7, ymm9, ymm7
vpsrld ymm11, ymm7, 0x14
vpslld ymm7, ymm7, 0xc
vpor ymm7, ymm11, ymm7
vpxor ymm6, ymm10, ymm6
vpsrld ymm11, ymm6, 0x14
vpslld ymm6, ymm6, 0xc
vpor ymm6, ymm11, ymm6
vpaddd ymm4, ymm7, ymm4
vpaddd ymm8, ymm8, ymm6
vpshufb ymm11, ymm4, ymm1
vpshufb ymm3, ymm3, ymm1
vpxor ymm3, ymm11, ymm3
vpshufb ymm11, ymm8, ymm1
vpshufb ymm5, ymm5, ymm1
vpxor ymm5, ymm11, ymm5
vpaddd ymm9, ymm9, ymm3
vpaddd ymm10, ymm10, ymm5
vpxor ymm7, ymm9, ymm7
vpxor ymm6, ymm10, ymm6
vpsrld ymm11, ymm7, 0x19
vpslld ymm7, ymm7, 7
vpor ymm7, ymm11, ymm7
vpsrld ymm11, ymm6, 0x19
vpslld ymm6, ymm6, 7
vpor ymm6, ymm11, ymm6
vpshufd ymm7, ymm7, 0x39
vpshufd ymm6, ymm6, 0x39
vpshufd ymm9, ymm9, 0x4e
vpshufd ymm10, ymm10, 0x4e
vpaddd ymm4, ymm7, ymm4
vpaddd ymm8, ymm8, ymm6
vpshuflw ymm11, ymm4, 0xb1
vpshufhw ymm11, ymm11, 0xb1
vpshufb ymm3, ymm3, ymm2
vpxor ymm3, ymm11, ymm3
vpshuflw ymm11, ymm8, 0xb1
vpshufhw ymm11, ymm11, 0xb1
vpshufb ymm5, ymm5, ymm2
vpxor ymm5, ymm11, ymm5
vpaddd ymm9, ymm9, ymm3
vpaddd ymm10, ymm10, ymm5
vpxor ymm7, ymm9, ymm7
vpxor ymm6, ymm10, ymm6
vpsrld ymm11, ymm7, 0x14
vpslld ymm7, ymm7, 0xc
vpor ymm7, ymm11, ymm7
vpsrld ymm11, ymm6, 0x14
vpslld ymm6, ymm6, 0xc
vpor ymm6, ymm11, ymm6
vpaddd ymm4, ymm7, ymm4
vpaddd ymm8, ymm8, ymm6
vpxor ymm3, ymm3, ymm4
vpshufb ymm3, ymm3, ymm1
vpxor ymm5, ymm8, ymm5
vpshufb ymm5, ymm5, ymm1
vpaddd ymm9, ymm9, ymm3
vpaddd ymm10, ymm10, ymm5
vpxor ymm7, ymm9, ymm7
vpxor ymm6, ymm10, ymm6
vpsrld ymm11, ymm7, 0x19
vpslld ymm7, ymm7, 7
vpor ymm7, ymm11, ymm7
vpsrld ymm11, ymm6, 0x19
vpslld ymm6, ymm6, 7
vpor ymm6, ymm11, ymm6
vpshufd ymm7, ymm7, 0x93
vpshufd ymm6, ymm6, 0x93
vpshufd ymm9, ymm9, 0x4e
vpshufd ymm10, ymm10, 0x4e
vpshufd ymm3, ymm3, 0x39
vpshufd ymm5, ymm5, 0x39
jmp 0x140047f7a
vmovq r8, xmm0
lea rax, [r8 + 1]
vpinsrd xmm1, xmm0, eax, 0
shr rax, 0x20
vpinsrd xmm1, xmm1, eax, 1
lea rax, [rsp + 0x1d0]
lea rdx, [r8 + 2]
vpinsrd xmm2, xmm0, edx, 0
shr rdx, 0x20
vpinsrd xmm2, xmm2, edx, 1
vmovdqa xmmword [rax - 0x30], xmm1
lea rdx, [r8 + 3]
vpinsrd xmm1, xmm0, edx, 0
shr rdx, 0x20
vpinsrd xmm1, xmm1, edx, 1
vmovdqa xmmword [rax - 0x20], xmm2
vmovdqa xmmword [rax - 0x10], xmm1
mov edx, 4
add r8, rdx
vpinsrd xmm1, xmm0, r8d, 0
shr r8, 0x20
vpinsrd xmm1, xmm1, r8d, 1
lea r8, [rsp + 0xd0]
vmovdqu ymmword [r8 - 0x40], ymm4
vmovdqu ymmword [r8 - 0x20], ymm8
lea r9, [rsp + 0x110]
vmovdqu ymmword [r9 - 0x40], ymm7
vmovdqu ymmword [r9 - 0x20], ymm6
lea r10, [rsp + 0x150]
vmovdqu ymmword [r10 - 0x40], ymm9
vmovdqu ymmword [r10 - 0x20], ymm10
lea r11, [rsp + 0x90]
lea rdi, [rsp + 0x1d0]
mov qword [rdi], r11
lea r11, [rsp + 0x190]
vmovdqu ymmword [r11 - 0x40], ymm3
vmovdqu ymmword [r11 - 0x20], ymm5
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
mov qword [rdi + 0x18], r9
and qword [rdi + 0x20], 0
mov qword [rdi + 0x28], rdx
mov qword [rdi + 0x30], rdx
lea r8, [rsp + 0x110]
mov qword [rdi + 0x38], r8
mov qword [rdi + 0x40], r10
and qword [rdi + 0x48], 0
mov qword [rdi + 0x50], rdx
mov qword [rdi + 0x58], rdx
lea r8, [rsp + 0x150]
mov qword [rdi + 0x60], r8
mov qword [rdi + 0x68], r11
and qword [rdi + 0x70], 0
mov qword [rdi + 0x78], rdx
mov qword [rdi + 0x80], rdx
lea r8, [rsp + 0x190]
mov qword [rdi + 0x88], r8
mov qword [rdi + 0x90], rax
and qword [rdi + 0x98], 0
vmovdqa xmmword [rax - 0x40], xmm0
vmovdqa xmmword [rcx + 0x20], xmm1
mov qword [rdi + 0xa0], rdx
mov qword [rdi + 0xa8], rdx
mov r12d, 0x100
xor r14d, r14d
vmovdqa xmm6, xmmword [str.expand_32_byte_kexpand_32_byte_k]
lea rcx, [rsp + 0x28]
mov rdx, rdi
vzeroupper
call fcn.140049e89
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x14004839d
vmovdqa xmm0, xmmword [rax]
vpaddd xmm10, xmm0, xmm6
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
vmovdqa xmm0, xmmword [r8]
vmovdqu ymm1, ymmword [rsp + 0x50]
vpaddd xmm9, xmm1, xmmword [rax]
vmovdqu ymm1, ymmword [rsp + 0x70]
vpaddd xmm8, xmm1, xmmword [rcx]
vpaddd xmm7, xmm0, xmmword [rdx]
xor esi, esi
mov rbx, r12
sub rbx, 0x10
mov rbp, r15
cmovb rbp, r14
cmovb rbx, r12
setae sil
mov rcx, rbp
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_rand_chacha_src_guts.rs
vzeroupper
call fcn.140049e62
shl rsi, 4
add rsi, r15
vmovdqu xmmword [rbp], xmm10
xor r15d, r15d
mov r13, rbx
sub r13, 0x10
mov r12, rsi
cmovb r12, r14
cmovb r13, rbx
setae r15b
mov rcx, r12
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_rand_chacha_src_guts.rs
call fcn.140049e62
shl r15, 4
add r15, rsi
vmovdqu xmmword [r12], xmm9
xor ebp, ebp
mov rbx, r13
sub rbx, 0x10
mov rsi, r15
cmovb rsi, r14
cmovb rbx, r13
setae bpl
mov rcx, rsi
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_rand_chacha_src_guts.rs
call fcn.140049e62
shl rbp, 4
add rbp, r15
vmovdqu xmmword [rsi], xmm8
xor r15d, r15d
mov r12, rbx
sub r12, 0x10
mov rsi, rbp
cmovb rsi, r14
cmovb r12, rbx
setae r15b
mov rcx, rsi
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_rand_chacha_src_guts.rs
call fcn.140049e62
shl r15, 4
add r15, rbp
vmovdqu xmmword [rsi], xmm7
jmp 0x140048271
vzeroupper
vmovaps xmm6, xmmword [rsp + 0x280]
vmovaps xmm7, xmmword [rsp + 0x290]
vmovaps xmm8, xmmword [rsp + 0x2a0]
vmovaps xmm9, xmmword [rsp + 0x2b0]
vmovaps xmm10, xmmword [rsp + 0x2c0]
vmovaps xmm11, xmmword [rsp + 0x2d0]
vmovaps xmm12, xmmword [rsp + 0x2e0]
vmovaps xmm13, xmmword [rsp + 0x2f0]
vmovaps xmm14, xmmword [rsp + 0x300]
vmovaps xmm15, xmmword [rsp + 0x310]
add rsp, 0x328
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x348
vmovaps xmmword [rsp + 0x330], xmm15
vmovaps xmmword [rsp + 0x320], xmm14
vmovaps xmmword [rsp + 0x310], xmm13
vmovdqa xmmword [rsp + 0x300], xmm12
vmovaps xmmword [rsp + 0x2f0], xmm11
vmovaps xmmword [rsp + 0x2e0], xmm10
vmovaps xmmword [rsp + 0x2d0], xmm9
vmovaps xmmword [rsp + 0x2c0], xmm8
vmovdqa xmmword [rsp + 0x2b0], xmm7
vmovaps xmmword [rsp + 0x2a0], xmm6
mov r15, rdx
mov rax, qword [rcx + 0x20]
vmovdqa xmm3, xmmword [rcx]
vmovdqa xmm8, xmmword [rcx + 0x20]
lea rdx, [rax + 1]
vpinsrd xmm0, xmm8, edx, 0
shr rdx, 0x20
vpinsrd xmm4, xmm0, edx, 1
vmovdqa xmm15, xmmword [rcx + 0x10]
lea rdx, [rax + 2]
vpinsrd xmm0, xmm8, edx, 0
shr rdx, 0x20
vpinsrd xmm9, xmm0, edx, 1
add rax, 3
vpinsrd xmm0, xmm8, eax, 0
shr rax, 0x20
vpinsrd xmm2, xmm0, eax, 1
vmovdqa xmm6, xmmword [0x1400dc2f0]
mov eax, 6
vmovdqa xmm14, xmm3
vmovdqa xmm10, xmm3
vmovdqa xmmword [rsp + 0x60], xmm3
vmovdqa xmm11, xmm6
vmovdqa xmmword [rsp + 0x30], xmm6
vmovdqa xmmword [rsp + 0x40], xmm6
vmovdqa xmmword [rsp + 0x20], xmm6
vmovdqa xmm13, xmm15
vmovdqa xmm0, xmm15
vmovdqa xmmword [rsp + 0x50], xmm15
sub eax, 1
jb 0x1400488c9
vpaddd xmm1, xmm3, xmmword [rsp + 0x20]
vmovdqa xmmword [rsp + 0x20], xmm1
vmovdqa xmm5, xmm3
vpxor xmm3, xmm8, xmm1
vpshuflw xmm3, xmm3, 0xb1
vpshufhw xmm12, xmm3, 0xb1
vpaddd xmm1, xmm12, xmm15
vmovdqa xmmword [rsp + 0x70], xmm1
vmovdqa xmm3, xmm2
vpxor xmm2, xmm1, xmm5
vpsrld xmm5, xmm2, 0x14
vpslld xmm2, xmm2, 0xc
vpor xmm15, xmm2, xmm5
vpaddd xmm2, xmm14, xmmword [rsp + 0x30]
vpxor xmm5, xmm4, xmm2
vpshuflw xmm5, xmm5, 0xb1
vpshufhw xmm5, xmm5, 0xb1
vpaddd xmm1, xmm13, xmm5
vmovdqa xmmword [rsp + 0x30], xmm1
vpxor xmm7, xmm14, xmm1
vpsrld xmm14, xmm7, 0x14
vpslld xmm7, xmm7, 0xc
vpor xmm14, xmm14, xmm7
vpaddd xmm7, xmm11, xmm10
vpxor xmm11, xmm9, xmm7
vpshuflw xmm11, xmm11, 0xb1
vpshufhw xmm9, xmm11, 0xb1
vpaddd xmm8, xmm9, xmm0
vpxor xmm4, xmm8, xmm10
vpsrld xmm10, xmm4, 0x14
vpslld xmm4, xmm4, 0xc
vpor xmm6, xmm10, xmm4
vmovdqa xmm1, xmmword [rsp + 0x60]
vpaddd xmm10, xmm1, xmmword [rsp + 0x40]
vpxor xmm4, xmm10, xmm3
vpshuflw xmm4, xmm4, 0xb1
vpshufhw xmm0, xmm4, 0xb1
vpaddd xmm13, xmm0, xmmword [rsp + 0x50]
vpxor xmm4, xmm13, xmm1
vpsrld xmm11, xmm4, 0x14
vpslld xmm4, xmm4, 0xc
vpor xmm4, xmm11, xmm4
vpaddd xmm3, xmm15, xmmword [rsp + 0x20]
vmovdqa xmmword [rsp + 0x40], xmm3
vmovdqa xmm11, xmmword [0x1400dc300]
vpshufb xmm1, xmm12, xmm11
vpshufb xmm12, xmm3, xmm11
vpxor xmm3, xmm12, xmm1
vpaddd xmm2, xmm14, xmm2
vpshufb xmm5, xmm5, xmm11
vpshufb xmm12, xmm2, xmm11
vpxor xmm5, xmm12, xmm5
vpaddd xmm7, xmm6, xmm7
vpshufb xmm9, xmm9, xmm11
vpshufb xmm12, xmm7, xmm11
vpxor xmm9, xmm12, xmm9
vpaddd xmm10, xmm10, xmm4
vpshufb xmm0, xmm0, xmm11
vpshufb xmm12, xmm10, xmm11
vpxor xmm1, xmm12, xmm0
vmovdqa xmm11, xmm3
vpaddd xmm0, xmm3, xmmword [rsp + 0x70]
vmovdqa xmmword [rsp + 0x70], xmm0
vpxor xmm12, xmm15, xmm0
vpsrld xmm15, xmm12, 0x19
vpslld xmm12, xmm12, 7
vpor xmm12, xmm12, xmm15
vpaddd xmm0, xmm5, xmmword [rsp + 0x30]
vmovdqa xmmword [rsp + 0x30], xmm0
vpxor xmm14, xmm14, xmm0
vpsrld xmm15, xmm14, 0x19
vpslld xmm14, xmm14, 7
vpor xmm14, xmm14, xmm15
vpaddd xmm15, xmm8, xmm9
vpxor xmm3, xmm15, xmm6
vpsrld xmm8, xmm3, 0x19
vpslld xmm3, xmm3, 7
vpor xmm6, xmm8, xmm3
vpaddd xmm0, xmm13, xmm1
vmovdqa xmmword [rsp + 0x20], xmm0
vmovdqa xmm13, xmm1
vpxor xmm1, xmm0, xmm4
vpsrld xmm8, xmm1, 0x19
vpslld xmm1, xmm1, 7
vpor xmm8, xmm8, xmm1
vpshufd xmm3, xmm12, 0x39
vpaddd xmm12, xmm3, xmmword [rsp + 0x40]
vpshuflw xmm1, xmm12, 0xb1
vpshufhw xmm1, xmm1, 0xb1
vmovdqa xmm0, xmmword [0x1400dc310]
vpshufb xmm4, xmm11, xmm0
vpxor xmm11, xmm4, xmm1
vpshufd xmm14, xmm14, 0x39
vpaddd xmm1, xmm14, xmm2
vmovdqa xmmword [rsp + 0x40], xmm1
vpshuflw xmm2, xmm1, 0xb1
vpshufhw xmm2, xmm2, 0xb1
vpshufb xmm4, xmm5, xmm0
vpxor xmm4, xmm4, xmm2
vpshufd xmm1, xmm6, 0x39
vpaddd xmm2, xmm1, xmm7
vmovdqa xmmword [rsp + 0x60], xmm2
vpshuflw xmm5, xmm2, 0xb1
vpshufhw xmm5, xmm5, 0xb1
vpshufb xmm7, xmm9, xmm0
vpxor xmm5, xmm7, xmm5
vpshufd xmm9, xmm8, 0x39
vpaddd xmm2, xmm9, xmm10
vmovdqa xmmword [rsp + 0x50], xmm2
vpshuflw xmm7, xmm2, 0xb1
vpshufhw xmm7, xmm7, 0xb1
vpshufb xmm8, xmm13, xmm0
vpxor xmm7, xmm8, xmm7
vpshufd xmm8, xmmword [rsp + 0x70], 0x4e
vpaddd xmm2, xmm8, xmm11
vpxor xmm3, xmm2, xmm3
vpsrld xmm8, xmm3, 0x14
vpslld xmm3, xmm3, 0xc
vpor xmm3, xmm8, xmm3
vpshufd xmm8, xmmword [rsp + 0x30], 0x4e
vpaddd xmm13, xmm8, xmm4
vpxor xmm8, xmm13, xmm14
vpsrld xmm10, xmm8, 0x14
vpslld xmm8, xmm8, 0xc
vpor xmm14, xmm8, xmm10
vpshufd xmm8, xmm15, 0x4e
vpaddd xmm10, xmm8, xmm5
vpxor xmm0, xmm10, xmm1
vpsrld xmm8, xmm0, 0x14
vpslld xmm0, xmm0, 0xc
vpor xmm0, xmm8, xmm0
vpshufd xmm6, xmmword [rsp + 0x20], 0x4e
vpaddd xmm8, xmm6, xmm7
vpxor xmm6, xmm8, xmm9
vpsrld xmm9, xmm6, 0x14
vpslld xmm6, xmm6, 0xc
vpor xmm9, xmm9, xmm6
vpaddd xmm1, xmm12, xmm3
vmovdqa xmmword [rsp + 0x20], xmm1
vpxor xmm11, xmm11, xmm1
vmovdqa xmm6, xmmword [0x1400dc300]
vpshufb xmm12, xmm11, xmm6
vpaddd xmm15, xmm12, xmm2
vpxor xmm1, xmm15, xmm3
vpsrld xmm3, xmm1, 0x19
vpslld xmm1, xmm1, 7
vpor xmm3, xmm1, xmm3
vpaddd xmm1, xmm14, xmmword [rsp + 0x40]
vmovdqa xmmword [rsp + 0x30], xmm1
vpxor xmm4, xmm1, xmm4
vpshufb xmm4, xmm4, xmm6
vpaddd xmm13, xmm13, xmm4
vpxor xmm11, xmm13, xmm14
vpsrld xmm14, xmm11, 0x19
vpslld xmm11, xmm11, 7
vpor xmm14, xmm11, xmm14
vpaddd xmm11, xmm0, xmmword [rsp + 0x60]
vpxor xmm2, xmm11, xmm5
vpshufb xmm2, xmm2, xmm6
vpaddd xmm5, xmm10, xmm2
vpxor xmm0, xmm5, xmm0
vpsrld xmm10, xmm0, 0x19
vpslld xmm0, xmm0, 7
vpor xmm0, xmm10, xmm0
vpaddd xmm10, xmm9, xmmword [rsp + 0x50]
vmovdqa xmmword [rsp + 0x40], xmm10
vpxor xmm7, xmm10, xmm7
vpshufb xmm7, xmm7, xmm6
vpaddd xmm8, xmm8, xmm7
vpxor xmm9, xmm8, xmm9
vpsrld xmm10, xmm9, 0x19
vpslld xmm9, xmm9, 7
vpor xmm9, xmm9, xmm10
vpshufd xmm3, xmm3, 0x93
vpshufd xmm14, xmm14, 0x93
vpshufd xmm10, xmm0, 0x93
vpshufd xmm0, xmm9, 0x93
vmovdqa xmmword [rsp + 0x60], xmm0
vpshufd xmm15, xmm15, 0x4e
vpshufd xmm13, xmm13, 0x4e
vpshufd xmm0, xmm5, 0x4e
vpshufd xmm5, xmm8, 0x4e
vmovdqa xmmword [rsp + 0x50], xmm5
vpshufd xmm8, xmm12, 0x39
vpshufd xmm4, xmm4, 0x39
vpshufd xmm9, xmm2, 0x39
vpshufd xmm2, xmm7, 0x39
jmp 0x14004850c
mov r8, qword [rcx + 0x20]
lea rax, [r8 + 1]
mov rdx, rax
shr rdx, 0x20
vmovdqa xmm5, xmm4
vmovdqa xmm4, xmmword [rcx + 0x20]
vmovdqa xmm7, xmm3
vpinsrd xmm3, xmm4, eax, 0
vpinsrd xmm3, xmm3, edx, 1
lea rax, [rsp + 0x1f0]
vmovdqa xmmword [rax - 0x30], xmm3
lea rdx, [r8 + 2]
mov r9, rdx
vpinsrd xmm3, xmm4, edx, 0
shr r9, 0x20
vpinsrd xmm3, xmm3, r9d, 1
vmovdqa xmmword [rax - 0x20], xmm3
lea rdx, [r8 + 3]
mov r9, rdx
vpinsrd xmm3, xmm4, edx, 0
shr r9, 0x20
vpinsrd xmm3, xmm3, r9d, 1
vmovdqa xmmword [rax - 0x10], xmm3
mov edx, 4
add r8, rdx
mov r9, r8
shr r9, 0x20
vpinsrd xmm3, xmm4, r8d, 0
vpinsrd xmm3, xmm3, r9d, 1
vmovdqa xmmword [rcx + 0x20], xmm3
lea r8, [rsp + 0xf0]
vmovaps xmm1, xmmword [rsp + 0x20]
vmovaps xmmword [r8 - 0x40], xmm1
vmovaps xmm1, xmmword [rsp + 0x30]
vmovaps xmmword [r8 - 0x30], xmm1
vmovdqa xmmword [r8 - 0x20], xmm11
vmovaps xmm1, xmmword [rsp + 0x40]
vmovaps xmmword [r8 - 0x10], xmm1
lea r9, [rsp + 0x130]
vmovdqa xmmword [r9 - 0x40], xmm7
vmovdqa xmmword [r9 - 0x30], xmm14
vmovdqa xmmword [r9 - 0x20], xmm10
vmovaps xmm1, xmmword [rsp + 0x60]
vmovaps xmmword [r9 - 0x10], xmm1
lea r10, [rsp + 0x170]
vmovdqa xmmword [r10 - 0x40], xmm15
vmovdqa xmmword [r10 - 0x30], xmm13
vmovdqa xmmword [r10 - 0x20], xmm0
vmovdqa xmm0, xmmword [rsp + 0x50]
vmovdqa xmmword [r10 - 0x10], xmm0
lea r11, [rsp + 0x1b0]
vmovdqa xmmword [r11 - 0x40], xmm8
vmovdqa xmmword [r11 - 0x30], xmm5
lea rsi, [rsp + 0xb0]
lea rdi, [rsp + 0x1f0]
mov qword [rdi], rsi
vmovdqa xmmword [r11 - 0x20], xmm9
vmovdqa xmmword [r11 - 0x10], xmm2
vmovdqa xmm6, xmmword [rcx]
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
mov qword [rdi + 0x18], r9
and qword [rdi + 0x20], 0
mov qword [rdi + 0x28], rdx
mov qword [rdi + 0x30], rdx
lea r8, [rsp + 0x130]
mov qword [rdi + 0x38], r8
mov qword [rdi + 0x40], r10
and qword [rdi + 0x48], 0
mov qword [rdi + 0x50], rdx
mov qword [rdi + 0x58], rdx
lea r8, [rsp + 0x170]
mov qword [rdi + 0x60], r8
mov qword [rdi + 0x68], r11
and qword [rdi + 0x70], 0
mov qword [rdi + 0x78], rdx
mov qword [rdi + 0x80], rdx
lea r8, [rsp + 0x1b0]
mov qword [rdi + 0x88], r8
mov qword [rdi + 0x90], rax
and qword [rdi + 0x98], 0
vmovdqa xmm7, xmmword [rcx + 0x10]
vmovdqa xmmword [rax - 0x40], xmm4
mov qword [rdi + 0xa0], rdx
mov qword [rdi + 0xa8], rdx
mov r12d, 0x100
xor r14d, r14d
vmovdqa xmm8, xmmword [0x1400dc2f0]
lea rcx, [rsp + 0x88]
mov rdx, rdi
call fcn.140049e89
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x140048bd4
vmovdqa xmm0, xmmword [rax]
vpaddd xmm12, xmm8, xmm0
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xa0]
mov r8, qword [rsp + 0xa8]
vmovdqa xmm0, xmmword [r8]
vpaddd xmm11, xmm6, xmmword [rax]
vpaddd xmm10, xmm7, xmmword [rcx]
vpaddd xmm9, xmm0, xmmword [rdx]
xor esi, esi
mov rbx, r12
sub rbx, 0x10
mov rbp, r15
cmovb rbp, r14
cmovb rbx, r12
setae sil
mov rcx, rbp
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_rand_chacha_src_guts.rs
call fcn.140049e62
shl rsi, 4
add rsi, r15
vmovdqu xmmword [rbp], xmm12
xor r15d, r15d
mov r13, rbx
sub r13, 0x10
mov r12, rsi
cmovb r12, r14
cmovb r13, rbx
setae r15b
mov rcx, r12
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_rand_chacha_src_guts.rs
call fcn.140049e62
shl r15, 4
add r15, rsi
vmovdqu xmmword [r12], xmm11
xor ebp, ebp
mov rbx, r13
sub rbx, 0x10
mov rsi, r15
cmovb rsi, r14
cmovb rbx, r13
setae bpl
mov rcx, rsi
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_rand_chacha_src_guts.rs
call fcn.140049e62
shl rbp, 4
add rbp, r15
vmovdqu xmmword [rsi], xmm10
xor r15d, r15d
mov r12, rbx
sub r12, 0x10
mov rsi, rbp
cmovb rsi, r14
cmovb r12, rbx
setae r15b
mov rcx, rsi
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_rand_chacha_src_guts.rs
call fcn.140049e62
shl r15, 4
add r15, rbp
vmovdqu xmmword [rsi], xmm9
jmp 0x140048aa8
vzeroupper
vmovaps xmm6, xmmword [rsp + 0x2a0]
vmovaps xmm7, xmmword [rsp + 0x2b0]
vmovaps xmm8, xmmword [rsp + 0x2c0]
vmovaps xmm9, xmmword [rsp + 0x2d0]
vmovaps xmm10, xmmword [rsp + 0x2e0]
vmovaps xmm11, xmmword [rsp + 0x2f0]
vmovaps xmm12, xmmword [rsp + 0x300]
vmovaps xmm13, xmmword [rsp + 0x310]
vmovaps xmm14, xmmword [rsp + 0x320]
vmovaps xmm15, xmmword [rsp + 0x330]
add rsp, 0x348
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x338
movaps xmmword [rsp + 0x320], xmm15
movaps xmmword [rsp + 0x310], xmm14
movaps xmmword [rsp + 0x300], xmm13
movaps xmmword [rsp + 0x2f0], xmm12
movaps xmmword [rsp + 0x2e0], xmm11
movaps xmmword [rsp + 0x2d0], xmm10
movaps xmmword [rsp + 0x2c0], xmm9
movaps xmmword [rsp + 0x2b0], xmm8
movaps xmmword [rsp + 0x2a0], xmm7
movdqa xmmword [rsp + 0x290], xmm6
mov r15, rdx
mov rax, qword [rcx + 0x20]
movdqa xmm0, xmmword [rcx]
movdqa xmm7, xmmword [rcx + 0x10]
movdqa xmm11, xmmword [rcx + 0x20]
lea rdx, [rax + 1]
movdqa xmm13, xmm11
pinsrd xmm13, edx, 0
shr rdx, 0x20
pinsrd xmm13, edx, 1
lea rdx, [rax + 2]
movdqa xmm5, xmm11
pinsrd xmm5, edx, 0
shr rdx, 0x20
pinsrd xmm5, edx, 1
add rax, 3
movdqa xmm4, xmm11
pinsrd xmm4, eax, 0
shr rax, 0x20
pinsrd xmm4, eax, 1
movdqa xmm3, xmmword [0x1400dc320]
mov eax, 6
movdqa xmm8, xmm0
movdqa xmm9, xmm0
movdqa xmm10, xmm0
movdqa xmmword [rsp + 0x40], xmm3
movdqa xmmword [rsp + 0x60], xmm3
movdqa xmmword [rsp + 0x20], xmm3
movdqa xmmword [rsp + 0x50], xmm3
movdqa xmm12, xmm7
movdqa xmm14, xmm7
movdqa xmm15, xmm7
sub eax, 1
jb 0x1400491c0
movdqa xmm6, xmmword [rsp + 0x50]
paddd xmm6, xmm0
movdqa xmm3, xmmword [rsp + 0x60]
paddd xmm3, xmm8
movdqa xmm2, xmmword [rsp + 0x40]
paddd xmm2, xmm9
movdqa xmm1, xmmword [rsp + 0x20]
paddd xmm1, xmm10
pxor xmm11, xmm6
pxor xmm13, xmm3
pxor xmm5, xmm2
pxor xmm4, xmm1
pshuflw xmm11, xmm11, 0xb1
pshufhw xmm11, xmm11, 0xb1
pshuflw xmm13, xmm13, 0xb1
pshufhw xmm13, xmm13, 0xb1
pshuflw xmm5, xmm5, 0xb1
pshufhw xmm5, xmm5, 0xb1
pshuflw xmm4, xmm4, 0xb1
pshufhw xmm4, xmm4, 0xb1
paddd xmm7, xmm11
movdqa xmmword [rsp + 0x30], xmm7
paddd xmm12, xmm13
paddd xmm14, xmm5
movdqa xmmword [rsp + 0x20], xmm14
paddd xmm15, xmm4
pxor xmm0, xmm7
pxor xmm8, xmm12
pxor xmm9, xmm14
pxor xmm10, xmm15
movdqa xmm7, xmm0
psrld xmm7, 0x14
pslld xmm0, 0xc
por xmm0, xmm7
movdqa xmm7, xmm8
psrld xmm7, 0x14
pslld xmm8, 0xc
por xmm8, xmm7
movdqa xmm7, xmm9
psrld xmm7, 0x14
pslld xmm9, 0xc
por xmm9, xmm7
movdqa xmm7, xmm10
psrld xmm7, 0x14
pslld xmm10, 0xc
por xmm10, xmm7
paddd xmm6, xmm0
paddd xmm3, xmm8
paddd xmm2, xmm9
paddd xmm1, xmm10
movdqa xmm7, xmm6
movdqa xmm14, xmm15
movdqa xmm15, xmm12
movdqa xmm12, xmmword [0x1400dc330]
pshufb xmm7, xmm12
pshufb xmm11, xmm12
pxor xmm11, xmm7
movdqa xmm7, xmm3
pshufb xmm7, xmm12
pshufb xmm13, xmm12
pxor xmm13, xmm7
movdqa xmm7, xmm2
pshufb xmm7, xmm12
pshufb xmm5, xmm12
pxor xmm5, xmm7
movdqa xmm7, xmm1
pshufb xmm7, xmm12
pshufb xmm4, xmm12
pxor xmm4, xmm7
movdqa xmm12, xmmword [rsp + 0x30]
paddd xmm12, xmm11
movdqa xmmword [rsp + 0x30], xmm12
paddd xmm15, xmm13
movdqa xmm7, xmmword [rsp + 0x20]
paddd xmm7, xmm5
paddd xmm14, xmm4
pxor xmm0, xmm12
pxor xmm8, xmm15
pxor xmm9, xmm7
movdqa xmm12, xmm7
pxor xmm10, xmm14
movdqa xmm7, xmm0
psrld xmm7, 0x19
pslld xmm0, 7
por xmm0, xmm7
movdqa xmm7, xmm8
psrld xmm7, 0x19
pslld xmm8, 7
por xmm8, xmm7
movdqa xmm7, xmm9
psrld xmm7, 0x19
pslld xmm9, 7
por xmm9, xmm7
movdqa xmm7, xmm10
psrld xmm7, 0x19
pslld xmm10, 7
por xmm10, xmm7
pshufd xmm7, xmm0, 0x39
pshufd xmm8, xmm8, 0x39
pshufd xmm9, xmm9, 0x39
pshufd xmm10, xmm10, 0x39
pshufd xmm0, xmmword [rsp + 0x30], 0x4e
movdqa xmmword [rsp + 0x40], xmm0
pshufd xmm0, xmm15, 0x4e
movdqa xmmword [rsp + 0x20], xmm0
pshufd xmm0, xmm12, 0x4e
movdqa xmmword [rsp + 0x30], xmm0
pshufd xmm15, xmm14, 0x4e
paddd xmm6, xmm7
paddd xmm3, xmm8
paddd xmm2, xmm9
paddd xmm1, xmm10
pshuflw xmm0, xmm6, 0xb1
pshufhw xmm0, xmm0, 0xb1
movdqa xmm12, xmmword [0x1400dc340]
pshufb xmm11, xmm12
pxor xmm11, xmm0
pshuflw xmm0, xmm3, 0xb1
pshufhw xmm0, xmm0, 0xb1
pshufb xmm13, xmm12
pxor xmm13, xmm0
pshuflw xmm0, xmm2, 0xb1
pshufhw xmm0, xmm0, 0xb1
pshufb xmm5, xmm12
pxor xmm5, xmm0
pshuflw xmm0, xmm1, 0xb1
pshufhw xmm0, xmm0, 0xb1
pshufb xmm4, xmm12
pxor xmm4, xmm0
movdqa xmm12, xmmword [rsp + 0x40]
paddd xmm12, xmm11
movdqa xmm14, xmmword [rsp + 0x20]
paddd xmm14, xmm13
movdqa xmm0, xmmword [rsp + 0x30]
paddd xmm0, xmm5
movdqa xmmword [rsp + 0x30], xmm0
paddd xmm15, xmm4
pxor xmm7, xmm12
pxor xmm8, xmm14
pxor xmm9, xmm0
pxor xmm10, xmm15
movdqa xmm0, xmm7
psrld xmm0, 0x14
pslld xmm7, 0xc
por xmm7, xmm0
movdqa xmm0, xmm8
psrld xmm0, 0x14
pslld xmm8, 0xc
por xmm8, xmm0
movdqa xmm0, xmm9
psrld xmm0, 0x14
pslld xmm9, 0xc
por xmm9, xmm0
movdqa xmm0, xmm10
psrld xmm0, 0x14
pslld xmm10, 0xc
por xmm10, xmm0
paddd xmm6, xmm7
paddd xmm3, xmm8
paddd xmm2, xmm9
paddd xmm1, xmm10
movdqa xmmword [rsp + 0x50], xmm6
pxor xmm11, xmm6
movdqa xmmword [rsp + 0x60], xmm3
pxor xmm13, xmm3
movdqa xmmword [rsp + 0x40], xmm2
pxor xmm5, xmm2
movdqa xmmword [rsp + 0x20], xmm1
pxor xmm4, xmm1
movdqa xmm0, xmmword [0x1400dc330]
pshufb xmm11, xmm0
pshufb xmm13, xmm0
pshufb xmm5, xmm0
pshufb xmm4, xmm0
paddd xmm12, xmm11
paddd xmm14, xmm13
movdqa xmm0, xmmword [rsp + 0x30]
paddd xmm0, xmm5
paddd xmm15, xmm4
pxor xmm7, xmm12
pxor xmm8, xmm14
pxor xmm9, xmm0
movdqa xmm1, xmm0
pxor xmm10, xmm15
movdqa xmm0, xmm7
psrld xmm0, 0x19
pslld xmm7, 7
por xmm7, xmm0
movdqa xmm0, xmm8
psrld xmm0, 0x19
pslld xmm8, 7
por xmm8, xmm0
movdqa xmm0, xmm9
psrld xmm0, 0x19
pslld xmm9, 7
por xmm9, xmm0
movdqa xmm0, xmm10
psrld xmm0, 0x19
pslld xmm10, 7
por xmm10, xmm0
pshufd xmm0, xmm7, 0x93
pshufd xmm8, xmm8, 0x93
pshufd xmm9, xmm9, 0x93
pshufd xmm10, xmm10, 0x93
pshufd xmm7, xmm12, 0x4e
pshufd xmm12, xmm14, 0x4e
pshufd xmm14, xmm1, 0x4e
pshufd xmm15, xmm15, 0x4e
pshufd xmm11, xmm11, 0x39
pshufd xmm13, xmm13, 0x39
pshufd xmm5, xmm5, 0x39
pshufd xmm4, xmm4, 0x39
jmp 0x140048d57
mov r8, qword [rcx + 0x20]
lea rax, [r8 + 1]
movdqa xmm1, xmmword [rcx + 0x20]
movdqa xmm2, xmm1
pinsrd xmm2, eax, 0
shr rax, 0x20
pinsrd xmm2, eax, 1
lea rax, [rsp + 0x1e0]
lea rdx, [r8 + 2]
movdqa xmm3, xmm1
pinsrd xmm3, edx, 0
shr rdx, 0x20
pinsrd xmm3, edx, 1
movdqa xmmword [rax - 0x30], xmm2
movdqa xmmword [rax - 0x20], xmm3
lea rdx, [r8 + 3]
movdqa xmm2, xmm1
pinsrd xmm2, edx, 0
shr rdx, 0x20
pinsrd xmm2, edx, 1
movdqa xmmword [rax - 0x10], xmm2
mov edx, 4
add r8, rdx
movdqa xmm2, xmm1
pinsrd xmm2, r8d, 0
shr r8, 0x20
pinsrd xmm2, r8d, 1
movdqa xmmword [rax - 0x40], xmm1
movdqa xmmword [rcx + 0x20], xmm2
lea r8, [rsp + 0xe0]
movaps xmm1, xmmword [rsp + 0x50]
movaps xmmword [r8 - 0x40], xmm1
movaps xmm1, xmmword [rsp + 0x60]
movaps xmmword [r8 - 0x30], xmm1
movaps xmm1, xmmword [rsp + 0x40]
movaps xmmword [r8 - 0x20], xmm1
movaps xmm1, xmmword [rsp + 0x20]
movaps xmmword [r8 - 0x10], xmm1
lea r9, [rsp + 0x120]
movdqa xmmword [r9 - 0x40], xmm0
movdqa xmmword [r9 - 0x30], xmm8
movdqa xmmword [r9 - 0x20], xmm9
movdqa xmmword [r9 - 0x10], xmm10
lea r10, [rsp + 0x160]
movdqa xmmword [r10 - 0x40], xmm7
movdqa xmmword [r10 - 0x30], xmm12
movdqa xmmword [r10 - 0x20], xmm14
movdqa xmmword [r10 - 0x10], xmm15
lea r11, [rsp + 0x1a0]
movdqa xmmword [r11 - 0x40], xmm11
lea rsi, [rsp + 0xa0]
lea rdi, [rsp + 0x1e0]
mov qword [rdi], rsi
movdqa xmmword [r11 - 0x30], xmm13
movdqa xmmword [r11 - 0x20], xmm5
movdqa xmmword [r11 - 0x10], xmm4
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
mov qword [rdi + 0x18], r9
and qword [rdi + 0x20], 0
mov qword [rdi + 0x28], rdx
mov qword [rdi + 0x30], rdx
lea r8, [rsp + 0x120]
mov qword [rdi + 0x38], r8
mov qword [rdi + 0x40], r10
and qword [rdi + 0x48], 0
mov qword [rdi + 0x50], rdx
mov qword [rdi + 0x58], rdx
lea r8, [rsp + 0x160]
mov qword [rdi + 0x60], r8
mov qword [rdi + 0x68], r11
and qword [rdi + 0x70], 0
mov qword [rdi + 0x78], rdx
mov qword [rdi + 0x80], rdx
lea r8, [rsp + 0x1a0]
mov qword [rdi + 0x88], r8
mov qword [rdi + 0x90], rax
and qword [rdi + 0x98], 0
movdqa xmm6, xmmword [rcx]
movdqa xmm7, xmmword [rcx + 0x10]
mov qword [rdi + 0xa0], rdx
mov qword [rdi + 0xa8], rdx
mov r12d, 0x100
xor r14d, r14d
movdqa xmm8, xmmword [0x1400dc320]
lea rcx, [rsp + 0x78]
mov rdx, rdi
call fcn.140049e89
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x1400494c8
movdqa xmm12, xmmword [rax]
paddd xmm12, xmm8
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x90]
mov r8, qword [rsp + 0x98]
movdqa xmm9, xmmword [r8]
movdqa xmm11, xmmword [rax]
paddd xmm11, xmm6
movdqa xmm10, xmmword [rcx]
paddd xmm10, xmm7
paddd xmm9, xmmword [rdx]
xor esi, esi
mov rbx, r12
sub rbx, 0x10
mov rbp, r15
cmovb rbp, r14
cmovb rbx, r12
setae sil
mov rcx, rbp
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_rand_chacha_src_guts.rs
call fcn.140049e62
shl rsi, 4
add rsi, r15
movdqu xmmword [rbp], xmm12
xor r15d, r15d
mov r13, rbx
sub r13, 0x10
mov r12, rsi
cmovb r12, r14
cmovb r13, rbx
setae r15b
mov rcx, r12
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_rand_chacha_src_guts.rs
call fcn.140049e62
shl r15, 4
add r15, rsi
movdqu xmmword [r12], xmm11
xor ebp, ebp
mov rbx, r13
sub rbx, 0x10
mov rsi, r15
cmovb rsi, r14
cmovb rbx, r13
setae bpl
mov rcx, rsi
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_rand_chacha_src_guts.rs
call fcn.140049e62
shl rbp, 4
add rbp, r15
movdqu xmmword [rsi], xmm10
xor r15d, r15d
mov r12, rbx
sub r12, 0x10
mov rsi, rbp
cmovb rsi, r14
cmovb r12, rbx
setae r15b
mov rcx, rsi
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_rand_chacha_src_guts.rs
call fcn.140049e62
shl r15, 4
add r15, rbp
movdqu xmmword [rsi], xmm9
jmp 0x140049390
movaps xmm6, xmmword [rsp + 0x290]
movaps xmm7, xmmword [rsp + 0x2a0]
movaps xmm8, xmmword [rsp + 0x2b0]
movaps xmm9, xmmword [rsp + 0x2c0]
movaps xmm10, xmmword [rsp + 0x2d0]
movaps xmm11, xmmword [rsp + 0x2e0]
movaps xmm12, xmmword [rsp + 0x2f0]
movaps xmm13, xmmword [rsp + 0x300]
movaps xmm14, xmmword [rsp + 0x310]
movaps xmm15, xmmword [rsp + 0x320]
add rsp, 0x338
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
movaps xmmword [rsp + 0x250], xmm15
movaps xmmword [rsp + 0x240], xmm14
movdqa xmmword [rsp + 0x230], xmm13
movaps xmmword [rsp + 0x220], xmm12
movaps xmmword [rsp + 0x210], xmm11
movaps xmmword [rsp + 0x200], xmm10
movaps xmmword [rsp + 0x1f0], xmm9
movaps xmmword [rsp + 0x1e0], xmm8
movaps xmmword [rsp + 0x1d0], xmm7
movdqa xmmword [rsp + 0x1c0], xmm6
mov rbx, rdx
mov rax, qword [rcx + 0x20]
movdqa xmm12, xmmword [rcx]
movdqa xmm7, xmmword [rcx + 0x10]
movdqa xmm14, xmmword [rcx + 0x20]
lea rdx, [rax + 1]
movd xmm15, edx
shr rdx, 0x20
movdqa xmm0, xmm14
pslldq xmm0, 8
shufps xmm0, xmm14, 0xe8
movd xmm3, edx
por xmm3, xmm0
movdqa xmm2, xmm3
pslldq xmm2, 8
shufps xmm2, xmm3, 0xe8
por xmm15, xmm2
lea rdx, [rax + 2]
movd xmm5, edx
shr rdx, 0x20
movd xmm3, edx
por xmm3, xmm0
movdqa xmm2, xmm3
pslldq xmm2, 8
shufps xmm2, xmm3, 0xe8
por xmm5, xmm2
add rax, 3
movd xmm4, eax
shr rax, 0x20
movd xmm2, eax
por xmm2, xmm0
movdqa xmm0, xmm2
pslldq xmm0, 8
shufps xmm0, xmm2, 0xe8
por xmm4, xmm0
movdqa xmm3, xmmword [0x1400dc350]
mov eax, 6
movdqa xmm8, xmm12
movdqa xmm9, xmm12
movdqa xmm10, xmm12
movdqa xmmword [rsp + 0x20], xmm7
movdqa xmm1, xmm7
movdqa xmm11, xmm7
movdqa xmmword [rsp + 0x40], xmm3
movdqa xmmword [rsp + 0x60], xmm3
movdqa xmmword [rsp + 0x30], xmm3
movdqa xmmword [rsp + 0x50], xmm3
sub eax, 1
jb 0x140049b0b
movdqa xmm6, xmmword [rsp + 0x50]
paddd xmm6, xmm12
movdqa xmm3, xmmword [rsp + 0x60]
paddd xmm3, xmm8
movdqa xmm0, xmmword [rsp + 0x40]
paddd xmm0, xmm9
movdqa xmm13, xmmword [rsp + 0x30]
paddd xmm13, xmm10
pxor xmm14, xmm6
pxor xmm15, xmm3
pxor xmm5, xmm0
movdqa xmm2, xmm0
pxor xmm4, xmm13
pshuflw xmm14, xmm14, 0xb1
pshufhw xmm14, xmm14, 0xb1
pshuflw xmm15, xmm15, 0xb1
pshufhw xmm15, xmm15, 0xb1
pshuflw xmm5, xmm5, 0xb1
pshufhw xmm5, xmm5, 0xb1
pshuflw xmm4, xmm4, 0xb1
pshufhw xmm4, xmm4, 0xb1
paddd xmm7, xmm14
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmm0, xmmword [rsp + 0x20]
paddd xmm0, xmm15
paddd xmm1, xmm5
movdqa xmmword [rsp + 0x20], xmm1
paddd xmm11, xmm4
pxor xmm12, xmm7
pxor xmm8, xmm0
pxor xmm9, xmm1
pxor xmm10, xmm11
movdqa xmm7, xmm12
psrld xmm7, 0x14
pslld xmm12, 0xc
por xmm12, xmm7
movdqa xmm7, xmm8
psrld xmm7, 0x14
pslld xmm8, 0xc
por xmm8, xmm7
movdqa xmm7, xmm9
psrld xmm7, 0x14
pslld xmm9, 0xc
por xmm9, xmm7
movdqa xmm7, xmm10
psrld xmm7, 0x14
pslld xmm10, 0xc
por xmm10, xmm7
paddd xmm6, xmm12
paddd xmm3, xmm8
paddd xmm2, xmm9
movdqa xmmword [rsp + 0x40], xmm2
paddd xmm13, xmm10
movdqa xmm7, xmm6
movdqa xmm1, xmm11
movdqa xmm11, xmmword [0x1400dc360]
pshufb xmm7, xmm11
pshufb xmm14, xmm11
pxor xmm14, xmm7
movdqa xmm7, xmm3
pshufb xmm7, xmm11
pshufb xmm15, xmm11
pxor xmm15, xmm7
movdqa xmm7, xmm2
pshufb xmm7, xmm11
pshufb xmm5, xmm11
pxor xmm5, xmm7
movdqa xmm7, xmm13
pshufb xmm7, xmm11
pshufb xmm4, xmm11
pxor xmm4, xmm7
movdqa xmm2, xmmword [rsp + 0x30]
paddd xmm2, xmm14
paddd xmm0, xmm15
movdqa xmm7, xmmword [rsp + 0x20]
paddd xmm7, xmm5
paddd xmm1, xmm4
pxor xmm12, xmm2
pxor xmm8, xmm0
pxor xmm9, xmm7
movdqa xmm11, xmm7
pxor xmm10, xmm1
movdqa xmm7, xmm12
psrld xmm7, 0x19
pslld xmm12, 7
por xmm12, xmm7
movdqa xmm7, xmm8
psrld xmm7, 0x19
pslld xmm8, 7
por xmm8, xmm7
movdqa xmm7, xmm9
psrld xmm7, 0x19
pslld xmm9, 7
por xmm9, xmm7
movdqa xmm7, xmm10
psrld xmm7, 0x19
pslld xmm10, 7
por xmm10, xmm7
pshufd xmm7, xmm12, 0x39
pshufd xmm8, xmm8, 0x39
pshufd xmm9, xmm9, 0x39
pshufd xmm10, xmm10, 0x39
pshufd xmm12, xmm2, 0x4e
pshufd xmm0, xmm0, 0x4e
movdqa xmmword [rsp + 0x20], xmm0
pshufd xmm0, xmm11, 0x4e
movdqa xmmword [rsp + 0x30], xmm0
pshufd xmm2, xmm1, 0x4e
paddd xmm6, xmm7
paddd xmm3, xmm8
movdqa xmm0, xmmword [rsp + 0x40]
paddd xmm0, xmm9
movdqa xmmword [rsp + 0x40], xmm0
paddd xmm13, xmm10
pshuflw xmm1, xmm6, 0xb1
pshufhw xmm1, xmm1, 0xb1
movdqa xmm11, xmmword [0x1400dc370]
pshufb xmm14, xmm11
pxor xmm14, xmm1
pshuflw xmm1, xmm3, 0xb1
pshufhw xmm1, xmm1, 0xb1
pshufb xmm15, xmm11
pxor xmm15, xmm1
pshuflw xmm1, xmm0, 0xb1
pshufhw xmm1, xmm1, 0xb1
pshufb xmm5, xmm11
pxor xmm5, xmm1
pshuflw xmm1, xmm13, 0xb1
pshufhw xmm1, xmm1, 0xb1
pshufb xmm4, xmm11
pxor xmm4, xmm1
paddd xmm12, xmm14
movdqa xmm0, xmmword [rsp + 0x20]
paddd xmm0, xmm15
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [rsp + 0x30]
paddd xmm1, xmm5
paddd xmm2, xmm4
pxor xmm7, xmm12
movdqa xmm11, xmm12
pxor xmm8, xmm0
pxor xmm9, xmm1
movdqa xmm12, xmm1
pxor xmm10, xmm2
movdqa xmm1, xmm7
psrld xmm1, 0x14
pslld xmm7, 0xc
por xmm7, xmm1
movdqa xmm1, xmm8
psrld xmm1, 0x14
pslld xmm8, 0xc
por xmm8, xmm1
movdqa xmm1, xmm9
psrld xmm1, 0x14
pslld xmm9, 0xc
por xmm9, xmm1
movdqa xmm1, xmm10
psrld xmm1, 0x14
pslld xmm10, 0xc
por xmm10, xmm1
paddd xmm6, xmm7
paddd xmm3, xmm8
movdqa xmm0, xmmword [rsp + 0x40]
paddd xmm0, xmm9
paddd xmm13, xmm10
movdqa xmmword [rsp + 0x50], xmm6
pxor xmm14, xmm6
movdqa xmmword [rsp + 0x60], xmm3
pxor xmm15, xmm3
movdqa xmmword [rsp + 0x40], xmm0
pxor xmm5, xmm0
movdqa xmmword [rsp + 0x30], xmm13
pxor xmm4, xmm13
movdqa xmm0, xmmword [0x1400dc360]
pshufb xmm14, xmm0
pshufb xmm15, xmm0
pshufb xmm5, xmm0
pshufb xmm4, xmm0
paddd xmm11, xmm14
movdqa xmm0, xmmword [rsp + 0x20]
paddd xmm0, xmm15
movdqa xmm1, xmm12
paddd xmm1, xmm5
movdqa xmm3, xmm2
paddd xmm3, xmm4
pxor xmm7, xmm11
pxor xmm8, xmm0
pxor xmm9, xmm1
movdqa xmm2, xmm1
pxor xmm10, xmm3
movdqa xmm1, xmm7
psrld xmm1, 0x19
pslld xmm7, 7
por xmm7, xmm1
movdqa xmm1, xmm8
psrld xmm1, 0x19
pslld xmm8, 7
por xmm8, xmm1
movdqa xmm1, xmm9
psrld xmm1, 0x19
pslld xmm9, 7
por xmm9, xmm1
movdqa xmm1, xmm10
psrld xmm1, 0x19
pslld xmm10, 7
por xmm10, xmm1
pshufd xmm12, xmm7, 0x93
pshufd xmm8, xmm8, 0x93
pshufd xmm9, xmm9, 0x93
pshufd xmm10, xmm10, 0x93
pshufd xmm7, xmm11, 0x4e
pshufd xmm0, xmm0, 0x4e
movdqa xmmword [rsp + 0x20], xmm0
pshufd xmm1, xmm2, 0x4e
pshufd xmm11, xmm3, 0x4e
pshufd xmm14, xmm14, 0x39
pshufd xmm15, xmm15, 0x39
pshufd xmm5, xmm5, 0x39
pshufd xmm4, xmm4, 0x39
jmp 0x14004967b
mov rax, qword [rcx + 0x20]
lea rdx, [rax + 1]
mov r8, rdx
shr r8, 0x20
movdqa xmm2, xmmword [rcx + 0x20]
movdqa xmmword [rsp + 0x70], xmm2
movdqa xmm0, xmm2
pslldq xmm0, 8
shufps xmm0, xmm2, 0xe8
movd xmm2, r8d
por xmm2, xmm0
movdqa xmm6, xmm2
pslldq xmm6, 8
shufps xmm6, xmm2, 0xe8
movd xmm3, edx
por xmm3, xmm6
lea rdx, [rax + 2]
mov r8, rdx
shr r8, 0x20
movd xmm2, r8d
por xmm2, xmm0
movdqa xmm13, xmm2
pslldq xmm13, 8
shufps xmm13, xmm2, 0xe8
movd xmm6, edx
por xmm6, xmm13
lea rdx, [rax + 3]
mov r8, rdx
shr r8, 0x20
movd xmm2, r8d
por xmm2, xmm0
movdqa xmm13, xmm2
pslldq xmm13, 8
shufps xmm13, xmm2, 0xe8
movaps xmm2, xmm13
movd xmm13, edx
por xmm13, xmm2
add rax, 4
mov rdx, rax
shr rdx, 0x20
movd xmm2, edx
por xmm2, xmm0
movdqa xmm0, xmm2
pslldq xmm0, 8
shufps xmm0, xmm2, 0xe8
movaps xmm2, xmm0
movd xmm0, eax
por xmm0, xmm2
movdqa xmm2, xmm0
movaps xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x80], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0xa0], xmm0
movaps xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0xb0], xmm0
movdqa xmmword [rsp + 0xc0], xmm12
movdqa xmmword [rsp + 0xd0], xmm8
movdqa xmmword [rsp + 0xe0], xmm9
movdqa xmmword [rsp + 0xf0], xmm10
movdqa xmmword [rsp + 0x100], xmm7
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x110], xmm0
movdqa xmmword [rsp + 0x120], xmm1
movdqa xmmword [rsp + 0x130], xmm11
movaps xmmword [rsp + 0x140], xmm14
movdqa xmmword [rsp + 0x150], xmm15
movdqa xmmword [rsp + 0x160], xmm5
movdqa xmmword [rsp + 0x170], xmm4
movaps xmm0, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x180], xmm0
movdqa xmmword [rsp + 0x190], xmm3
movdqa xmmword [rsp + 0x1a0], xmm6
movdqa xmm6, xmmword [rcx]
movdqa xmmword [rsp + 0x1b0], xmm13
movdqa xmm7, xmmword [rcx + 0x10]
movdqa xmmword [rcx + 0x20], xmm2
mov edi, 0x100
xor r13d, r13d
movdqa xmm8, xmmword [0x1400dc350]
lea r15, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_rand_chacha_src_guts.rs
xor ebp, ebp
cmp rbp, 0x40
je 0x140049df6
movdqa xmm12, xmmword [rsp + rbp + 0x80]
paddd xmm12, xmm8
movdqa xmm9, xmmword [rsp + rbp + 0x180]
movdqa xmm11, xmmword [rsp + rbp + 0xc0]
paddd xmm11, xmm6
movdqa xmm10, xmmword [rsp + rbp + 0x100]
paddd xmm10, xmm7
paddd xmm9, xmmword [rsp + rbp + 0x140]
xor esi, esi
mov r14, rdi
sub r14, 0x10
mov r12, rbx
cmovb r12, r13
cmovb r14, rdi
setae sil
mov rcx, r12
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_rand_chacha_src_guts.rs
call fcn.140049e62
shl rsi, 4
add rsi, rbx
movdqu xmmword [r12], xmm12
xor ebx, ebx
mov rdi, r14
sub rdi, 0x10
mov r12, rsi
cmovb r12, r13
cmovb rdi, r14
setae bl
mov rcx, r12
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_rand_chacha_src_guts.rs
call fcn.140049e62
shl rbx, 4
add rbx, rsi
movdqu xmmword [r12], xmm11
xor r12d, r12d
mov r14, rdi
sub r14, 0x10
mov rsi, rbx
cmovb rsi, r13
cmovb r14, rdi
setae r12b
mov rcx, rsi
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_rand_chacha_src_guts.rs
call fcn.140049e62
shl r12, 4
add r12, rbx
movdqu xmmword [rsi], xmm10
xor ebx, ebx
mov rdi, r14
sub rdi, 0x10
mov rsi, r12
cmovb rsi, r13
cmovb rdi, r14
setae bl
mov rcx, rsi
mov rdx, r15
call fcn.140049e62
shl rbx, 4
add rbx, r12
movdqu xmmword [rsi], xmm9
add rbp, 0x10
jmp 0x140049cd9
movaps xmm6, xmmword [rsp + 0x1c0]
movaps xmm7, xmmword [rsp + 0x1d0]
movaps xmm8, xmmword [rsp + 0x1e0]
movaps xmm9, xmmword [rsp + 0x1f0]
movaps xmm10, xmmword [rsp + 0x200]
movaps xmm11, xmmword [rsp + 0x210]
movaps xmm12, xmmword [rsp + 0x220]
movaps xmm13, xmmword [rsp + 0x230]
movaps xmm14, xmmword [rsp + 0x240]
movaps xmm15, xmmword [rsp + 0x250]
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret