Function at 0x140018530
Capabilities:
Encode data using xor
Execute command
Get hostname
Get session user name
Query service status
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x430]
sub rsp, 0x530
mov rax, qword [0x1400a5080]
xor rax, rsp
mov qword [rbp + 0x420], rax
xor ebx, ebx
lea rcx, str.Mainx
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
lea rcx, [rbp + 0xc8]
call fcn.1400162e0
nop
lea rcx, [rbp + 0xe8]
call fcn.140012d40
nop
lea rcx, [rbp + 0x108]
call fcn.1400146a0
nop
lea rcx, [rbp + 0x128]
call fcn.140013500
nop
lea rcx, [rbp + 0x148]
call fcn.140013be0
nop
lea rcx, [rbp + 0x168]
call fcn.140014140
nop
lea rcx, [rbp + 0x188]
call fcn.140014db0
nop
mov dword [rbp + 0x20], reloc.WS2_32.dll_recv
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x1a8]
lea ecx, [rbx + 5]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x140018694
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp - 0x38]
call fcn.140019d70
nop
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rdx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x28]
lea r8, [rdx + rax*2]
lea rdx, [rbp - 0x38]
cmova rdx, qword [rbp - 0x38]
lea rcx, [rbp + 0x28]
call fcn.14001bf60
movups xmm0, xmmword [rbp + 0x28]
movups xmmword [rbp + 0x48], xmm0
movups xmm1, xmmword [rbp + 0x38]
movups xmmword [rbp + 0x58], xmm1
mov rdx, qword [rbp - 0x20]
cmp rdx, 7
jbe 0x140018681
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001867c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001867c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077d60
movdqa xmm0, xmmword [0x140097d10]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x38], bx
jmp 0x1400186ba
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x58], xmm1
mov r8d, 9
lea rdx, str.NOT_FOUND
lea rcx, [rbp + 0x48]
call fcn.140010400
nop
mov dword [rbp + 0x18], 0x101
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x210]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140018779
lea rdx, [rbp + 0x210]
lea rcx, [rbp - 8]
call fcn.140019d70
nop
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 7
cmova rdx, qword [rbp - 8]
mov rax, qword [rbp + 8]
lea r8, [rdx + rax*2]
lea rdx, [rbp - 8]
cmova rdx, qword [rbp - 8]
lea rcx, [rbp + 0x28]
call fcn.14001bf60
movups xmm0, xmmword [rbp + 0x28]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [rbp + 0x38]
movups xmmword [rbp + 0x78], xmm1
mov rdx, qword [rbp + 0x10]
cmp rdx, 7
jbe 0x140018766
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018761
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140018761
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140077d60
movdqa xmm0, xmmword [0x140097d10]
movdqu xmmword [rbp + 8], xmm0
mov word [rbp - 8], bx
jmp 0x14001879f
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x78], xmm1
mov r8d, 4
lea rdx, [0x140096d88]
lea rcx, [rbp + 0x68]
call fcn.140010400
nop
lea rcx, [rbp + 0x28]
call fcn.1400124f0
nop
lea rcx, [rbp + 0x88]
call fcn.140012770
nop
lea r14, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 0xf
cmova r14, qword [rbp + 0xc8]
mov rbx, qword [0x1403679a8]
mov qword [rbp + 0x18], rbx
mov rsi, 0xffffffffffffffff
mov r15, qword [0x1403679b0]
cmp rbx, r15
je 0x14001882f
mov rdi, rsi
nop
inc rdi
cmp byte [r14 + rdi], 0
jne 0x1400187f0
nop word [rax + rax]
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140018811
mov rcx, qword [rbx]
cmp r8, rdi
jne 0x140018822
mov rdx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001882b
add rbx, 0x20
cmp rbx, r15
jne 0x140018800
mov qword [rbp + 0x18], rbx
lea rdi, [rbp + 0xe8]
cmp qword [rbp + 0x100], 0xf
cmova rdi, qword [rbp + 0xe8]
mov rbx, qword [0x1403679f0]
mov qword [rbp + 0x20], rbx
mov r14, qword [0x1403679f8]
cmp rbx, r14
je 0x14001889b
nop dword [rax]
mov rax, rsi
inc rax
cmp byte [rdi + rax], 0
jne 0x140018863
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14001887d
mov rcx, qword [rbx]
cmp r8, rax
jne 0x14001888e
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140018897
add rbx, 0x20
cmp rbx, r14
jne 0x140018860
mov qword [rbp + 0x20], rbx
lea r14, [rbp + 0x108]
cmp qword [rbp + 0x120], 0xf
cmova r14, qword [rbp + 0x108]
mov rbx, qword [0x140367990]
mov qword [rsp + 0x58], rbx
mov r15, qword [0x140367998]
mov rdi, rsi
cmp rbx, r15
je 0x140018910
nop dword [rax]
inc rsi
cmp byte [r14 + rsi], 0
jne 0x1400188d0
nop word [rax + rax]
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400188f1
mov rcx, qword [rbx]
cmp r8, rsi
jne 0x140018902
mov rdx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001890b
add rbx, 0x20
cmp rbx, r15
jne 0x1400188e0
mov qword [rsp + 0x58], rbx
lea r14, [rbp + 0x128]
cmp qword [rbp + 0x140], 0xf
cmova r14, qword [rbp + 0x128]
mov rbx, qword [0x140367a38]
mov qword [rbp - 8], rbx
mov r15, qword [0x140367a40]
cmp rbx, r15
je 0x14001897f
mov rsi, rdi
inc rsi
cmp byte [r14 + rsi], 0
jne 0x140018941
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140018961
mov rcx, qword [rbx]
cmp r8, rsi
jne 0x140018972
mov rdx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001897b
add rbx, 0x20
cmp rbx, r15
jne 0x140018950
mov qword [rbp - 8], rbx
lea rsi, [rbp + 0x148]
cmp qword [rbp + 0x160], 0xf
cmova rsi, qword [rbp + 0x148]
mov r14, qword [0x140367a70]
mov r13, qword [0x140367a68]
cmp r13, r14
je 0x1400189ec
mov rbx, rdi
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x1400189b0
nop dword [rax]
mov r8, qword [r13 + 0x10]
mov rcx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x1400189d2
mov rcx, qword [r13]
cmp r8, rbx
jne 0x1400189e3
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400189ec
add r13, 0x20
cmp r13, r14
jne 0x1400189c0
lea rsi, [rbp + 0x168]
cmp qword [rbp + 0x180], 0xf
cmova rsi, qword [rbp + 0x168]
mov r14, qword [0x140367af0]
mov r12, qword [0x140367ae8]
cmp r12, r14
je 0x140018a5e
mov rbx, rdi
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x140018a20
nop dword [rax]
mov r8, qword [r12 + 0x10]
mov rcx, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x140018a44
mov rcx, qword [r12]
cmp r8, rbx
jne 0x140018a55
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140018a5e
add r12, 0x20
cmp r12, r14
jne 0x140018a30
lea rsi, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0xf
cmova rsi, qword [rbp + 0x188]
mov r14, qword [0x140367a10]
mov r15, qword [0x140367a08]
cmp r15, r14
je 0x140018acb
mov rbx, rdi
nop dword [rax + rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x140018a90
nop dword [rax]
mov r8, qword [r15 + 0x10]
mov rcx, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x140018ab1
mov rcx, qword [r15]
cmp r8, rbx
jne 0x140018ac2
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140018acb
add r15, 0x20
cmp r15, r14
jne 0x140018aa0
lea rsi, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova rsi, qword [rbp + 0x48]
mov rax, qword [0x140367ab8]
mov r14, qword [0x140367ab0]
cmp r14, rax
je 0x140018b32
mov rbx, rdi
nop
inc rbx
cmp byte [rsi + rbx], 0
jne 0x140018af0
nop dword [rax]
mov r8, qword [r14 + 0x10]
mov rcx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x140018b11
mov rcx, qword [r14]
cmp r8, rbx
jne 0x140018b29
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140018b32
mov rax, qword [0x140367ab8]
add r14, 0x20
cmp r14, rax
jne 0x140018b00
lea rax, [rbp + 0x68]
cmp qword [rbp + 0x80], 0xf
cmova rax, qword [rbp + 0x68]
mov qword [rbp - 0x38], rax
mov rsi, qword [0x140367a98]
cmp rsi, qword [0x140367aa0]
je 0x140018ba3
mov rbx, rdi
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140018b60
nop dword [rax]
mov r8, qword [rsi + 0x10]
mov rcx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x140018b81
mov rcx, qword [rsi]
cmp r8, rbx
jne 0x140018b96
mov rdx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140018ba3
mov rax, qword [rbp - 0x38]
add rsi, 0x20
cmp rsi, qword [0x140367aa0]
jne 0x140018b70
lea rax, [rbp + 0x28]
cmp qword [rbp + 0x40], 0xf
cmova rax, qword [rbp + 0x28]
mov qword [rbp - 0x38], rax
mov rbx, qword [0x140367a20]
cmp rbx, qword [0x140367a28]
je 0x140018c03
inc rdi
cmp byte [rax + rdi], 0
jne 0x140018bc5
nop
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140018be1
mov rcx, qword [rbx]
cmp r8, rdi
jne 0x140018bf6
mov rdx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140018c03
mov rax, qword [rbp - 0x38]
add rbx, 0x20
cmp rbx, qword [0x140367a28]
jne 0x140018bd0
mov rax, qword [0x140367ad0]
mov rdi, qword [0x140367ac8]
cmp rdi, rax
je 0x140018c6a
nop word [rax + rax]
lea rdx, [rbp + 0x88]
cmp qword [rbp + 0xa0], 0xf
cmova rdx, qword [rbp + 0x88]
mov r8, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140018c48
mov rcx, qword [rdi]
cmp r8, qword [rbp + 0x98]
jne 0x140018c61
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
mov rax, qword [0x140367ad0]
je 0x140018c6a
add rdi, 0x20
cmp rdi, rax
jne 0x140018c20
mov rcx, qword [0x1403679b0]
cmp qword [rbp + 0x18], rcx
jne 0x140018d4d
mov rcx, qword [0x1403679f8]
cmp qword [rbp + 0x20], rcx
jne 0x140018d4d
mov rcx, qword [0x140367998]
cmp qword [rsp + 0x58], rcx
jne 0x140018d4d
mov rcx, qword [0x140367a40]
cmp qword [rbp - 8], rcx
jne 0x140018d4d
cmp r13, qword [0x140367a70]
jne 0x140018d4d
cmp r12, qword [0x140367af0]
jne 0x140018d4d
cmp r15, qword [0x140367a10]
jne 0x140018d4d
cmp r14, qword [0x140367ab8]
jne 0x140018d4d
cmp rsi, qword [0x140367aa0]
jne 0x140018d4d
cmp rbx, qword [0x140367a28]
jne 0x140018d4d
cmp rdi, rax
jne 0x140018d4d
movdqa xmm0, xmmword [0x140097d30]
movdqu xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x140097d40]
movdqu xmmword [rbp - 0x50], xmm1
mov dword [rbp - 0x40], 0x1e00
mov dword [rbp - 0x3c], 0x10e0
xor r12d, r12d
mov edi, r12d
lea rsi, [rbp - 0x5c]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, eax
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp ebx, dword [rbp + rdi*8 - 0x60]
jne 0x140018d44
cmp eax, dword [rsi + rdi*8]
je 0x140018d59
inc rdi
cmp rdi, 4
jl 0x140018d24
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140018d8e
mov dword [rbp + 0x210], 0x11c
lea rcx, [rbp + 0x210]
call rax
cmp dword [rbp + 0x214], 6
jne 0x140018db0
mov eax, dword [rbp + 0x218]
dec eax
cmp eax, 2
ja 0x140018db0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movdqa xmm0, xmmword [0x140097e30]
movdqu xmmword [rbp - 8], xmm0
mov word [rbp + 8], 0xf9
mov byte [rbp + 0xa], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x74]
xor byte [rbp + rcx - 8], al
inc rcx
cmp rcx, 0x11
jb 0x140018dd0
mov byte [rbp + 0xa], r12b
lea r8, [rbp + 9]
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x1a8]
call fcn.14001c530
nop
mov dword [rbp - 0x38], 0xe2fdf4df
mov dword [rbp - 0x34], 0xa7a4ffff
mov dword [rbp - 0x30], 0xf2eef0ba
mov word [rbp - 0x2c], 0x100
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx - 0x74]
xor byte [rbp + rcx - 0x38], al
inc rcx
cmp rcx, 0xc
jb 0x140018e20
mov byte [rbp - 0x2b], 0
lea r8, [rbp - 0x2c]
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x1c8]
call fcn.14001c530
nop
lea rcx, [rbp + 0x1a8]
call fcn.140011f80
test al, al
jne 0x140019276
lea rcx, [rbp + 0x1c8]
call fcn.140011f80
test al, al
jne 0x140019276
mov rbx, qword [0x1403679d8]
mov r14, qword [0x1403679e0]
cmp rbx, r14
je 0x140018f20
nop dword [rax + rax]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x140018f13
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140018eb3
mov rdx, qword [rbx]
mov r8d, 4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x140018ed5
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140018f13
lea rdx, [rbp - 8]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rcx, rsi
test eax, eax
jne 0x140018efa
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140018f13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [rbp - 4], 4
je 0x140019276
add rbx, 0x20
cmp rbx, r14
jne 0x140018e90
lea rcx, [rbp + 0xa8]
call fcn.140015a70
nop
mov rdi, qword [0x140367a88]
mov rbx, qword [0x140367a80]
cmp rbx, rdi
je 0x140018fa8
mov r14, qword [rbp + 0xc0]
mov rsi, qword [rbp + 0xb8]
mov r15, qword [rbp + 0xa8]
nop word [rax + rax]
lea rdx, [rbp + 0xa8]
cmp r14, 0xf
cmova rdx, r15
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140018f80
mov rcx, qword [rbx]
cmp r8, rsi
jne 0x140018f8e
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140018f97
add rbx, 0x20
cmp rbx, rdi
jne 0x140018f60
cmp rbx, rdi
je 0x140018fa8
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbp - 8]
call fcn.140010930
nop
mov rdx, rax
lea rcx, [rbp - 0x38]
call qword [sym.imp.MSVCP140.dll_public:_static_class_std::locale___cdecl_std::locale::global_class_std::locale_const____ptr64_]
lea rcx, [rbp - 0x38]
call fcn.140010ac0
nop
lea rcx, [rbp - 8]
call fcn.140010ac0
mov rdx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rax, qword [rdx]
movsxd rbx, dword [rax + 4]
add rbx, rdx
lea rcx, [rbp - 8]
call fcn.140010910
nop
mov r8, rax
lea rdx, [rbp - 0x38]
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::locale___cdecl_std::basic_ios_char__struct_std::char_traits_char__::imbue_class_std::locale_const____ptr64____ptr64]
lea rcx, [rbp - 0x38]
call fcn.140010ac0
nop
lea rcx, [rbp - 8]
call fcn.140010ac0
call fcn.140015c00
lea rcx, [rbp - 8]
call fcn.140019290
movdqa xmm0, xmmword [0x140097f10]
movdqu xmmword [rbp - 0x38], xmm0
mov dword [rbp - 0x28], 0xfaedc8bc
mov dword [rbp - 0x24], 0x10080d2
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x38]
call fcn.1400193c0
mov ebx, dword [rbp + 8]
mov edx, ebx
mov rcx, rax
call fcn.140015c30
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x140097ef0]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x140097dd0]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x140097df0]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0xdad0d8cc
mov dword [rsp + 0x54], 0x100efa4
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140019370
mov edx, dword [rbp - 4]
mov rcx, rax
call fcn.140015c30
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140097290]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140015c00
movdqa xmm0, xmmword [0x140097ea0]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x140097d90]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x140097d50]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x50], 1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140019320
mov edx, ebx
mov rcx, rax
call fcn.140015c30
call fcn.140016190
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400163d0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], 0x1ff41fdf
mov dword [rsp + 0x24], 0x1ffb1ffd
mov dword [rsp + 0x28], 0x1ffc1ff5
mov dword [rsp + 0x2c], 0x1ff61fda
mov dword [rsp + 0x30], 0x1ff91ff5
mov dword [rsp + 0x34], 0x1fff1fe2
mov dword [rsp + 0x38], 0x1ff11fdb
mov dword [rsp + 0x3c], 0x1ff81fff
mov dword [rsp + 0x40], 0x1fb31ff7
mov dword [rsp + 0x44], 0x1fe71ffb
mov dword [rsp + 0x48], 0x1fc5
mov byte [rsp + 0x4c], 1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140019570
mov rdx, rax
lea rcx, [rbp + 0x1e8]
call fcn.140015d70
nop
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp - 0x80]
call fcn.140019ec0
mov rcx, rax
call fcn.1400160c0
call fcn.140017390
movdqa xmm0, xmmword [0x140097db0]
movdqu xmmword [rbp - 0x38], xmm0
mov dword [rbp - 0x28], 0xfbfff2f0
mov dword [rbp - 0x24], 0x83c5c5
mov byte [rbp - 0x20], 1
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x38]
call fcn.1400195c0
mov edx, dword [rbp + 4]
mov rcx, rax
call fcn.140015c30
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x140097e60]
movdqu xmmword [rbp - 0x38], xmm0
movdqa xmm1, xmmword [0x140097e10]
movdqu xmmword [rbp - 0x28], xmm1
mov dword [rbp - 0x18], 0xfafeea8c
mov dword [rbp - 0x14], 0xdac0d590
mov dword [rbp - 0x10], 0x96c4d0c2
mov word [rbp - 0xc], 0x100
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x38]
call fcn.1400192d0
mov edx, ebx
mov rcx, rax
call fcn.140015c30
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3