Function at 0x14004bbd0
Capabilities:
Acquire debug privileges
Check if file exists
Contain obfuscated stackstrings
Create thread
Encode data using xor
Enumerate gui resources
Enumerate processes
Get file attributes
Get process image filename
Hide thread from debugger
Set global application hook

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x4b0]
sub rsp, 0x5b0
mov rax, qword [0x14014b040]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
mov r14, rcx
xor edi, edi
call fcn.140007570
call fcn.140006e80
call fcn.140007670
call fcn.140007420
call fcn.140006fe0
call fcn.140007130
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14004bc6a
lea rdx, str.NtSetInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14004bc6a
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0x11]
call rbx
call fcn.140007d90
call fcn.140007b40
call fcn.140007ca0
call fcn.140007f70
call fcn.1400080a0
lea rbx, [0x1401637b8]
cmp qword [0x1401637d0], 0xf
cmova rbx, qword [0x1401637b8]
movdqa xmm0, xmmword [0x1401403d0]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x10], dil
lea rcx, [rbp - 0x1f]
call fcn.140006d60
mov rdx, r14
lea rcx, [0x140140024]
call fcn.14004bae0
lea rcx, [0x140056390]
call fcn.140006d60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14004cc4a
test al, 0x10
jne 0x14004cc4a
mov r15d, edi
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14004cbfd
mov dword [rbp + 0x50], 0x238
lea rdx, [rbp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004bd48
nop dword [rax]
mov rdx, r14
lea rcx, [rbp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14004bd44
lea rdx, [rbp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004bd20
jmp 0x14004bd48
mov r15d, dword [rbp + 0x58]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
je 0x14004cbfd
mov edx, r15d
lea rcx, [0x14004bb40]
call qword [sym.imp.USER32.dll_EnumWindows]
mov dword [rbp + 0x20], edi
lea rdx, [rbp + 0x20]
mov rcx, qword [0x1401642a0]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r15d, eax
test eax, eax
jne 0x14004be48
lea edx, [rax + 4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004ceb0
movdqa xmm0, xmmword [0x1401409a0]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140140470]
movdqu xmmword [rsp + 0x48], xmm1
movdqa xmm0, xmmword [0x140140720]
movdqu xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x68], 0x49414620
mov dword [rsp + 0x6c], 0x2044454c
mov word [rsp + 0x70], 0x5d
lea rdx, [rsp + 0x39]
mov rcx, rax
call fcn.1400035d0
lea rdx, [0x1400037a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x7272454d
movdqa xmm0, xmmword [0x1401409b0]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140140470]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0x67726174
mov dword [rsp + 0x5c], 0x77207465
mov dword [rsp + 0x60], 0x6f646e69
mov word [rsp + 0x64], 0x2e77
mov byte [rsp + 0x66], dil
lea rdx, [rsp + 0x39]
jmp 0x14004cc99
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], dil
jne 0x14004be60
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140003a80
nop
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
test eax, eax
jne 0x14004bec3
movups xmmword [rbp + 0x28], xmm0
movdqa xmm1, xmmword [0x1401402f0]
movdqu xmmword [rbp + 0x38], xmm1
mov word [rbp + 0x28], di
jmp 0x14004bf24
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8, rbx
lea rcx, [rbp - 0x20]
call fcn.14004d490
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova rax, qword [rbp - 0x20]
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r8, qword [rsp + 0x38]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [rbp + 0x38], xmm1
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14004bf64
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bf5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004bf5f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005277c
movdqa xmm0, xmmword [0x140140300]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
lea rcx, [rbp + 0x28]
cmp qword [rbp + 0x40], 7
cmova rcx, qword [rbp + 0x28]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r14, rax
test rax, rax
jne 0x14004c01e
lea edx, [rax + 4]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004ceb0
movdqa xmm0, xmmword [0x1401408b0]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140140600]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0x454c4941
mov dword [rbp + 4], 0x5d2044
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400035d0
lea rdx, [0x1400037a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724506
movdqa xmm0, xmmword [0x1401408c0]
mov dword [rbp - 0x10], 0x6220746f
mov dword [rbp - 0xc], 0x6f662065
mov dword [rbp - 8], 0x2e646e75
mov byte [rbp - 4], r14b
jmp 0x14004cb88
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x14004ca66
lea r8, [rbp - 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14004c8fa
mov dword [rbp - 0x20], 4
lea r8, [rbp - 0x1c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14004c07f
mov dword [rbp - 0x14], 2
lea r8, [rbp - 0x10]
lea rdx, str.SeLoadDriverPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea r8, [rbp - 4]
lea rdx, str.SeRemoteShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea r8, [rbp + 8]
lea rdx, str.SeCreateGlobalPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov r9d, 0x10
lea r8, [rbp - 0x20]
xor edx, edx
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14004c76f
mov cl, 5
mov word [rbp - 0x80], 5
movsx ebx, cl
movzx eax, bx
xor ax, 0x55
mov word [rbp - 0x7e], ax
movzx eax, bx
xor ax, 0x77
mov word [rbp - 0x7c], ax
movzx ecx, bx
xor cx, 0x6c
mov word [rbp - 0x7a], cx
movzx eax, bx
xor ax, 0x73
mov word [rbp - 0x78], ax
mov word [rbp - 0x76], cx
movzx r11d, bx
xor r11w, 0x69
mov word [rbp - 0x74], r11w
movzx r10d, bx
xor r10w, 0x60
mov word [rbp - 0x72], r10w
movzx eax, bx
xor ax, 0x62
mov word [rbp - 0x70], ax
mov word [rbp - 0x6e], r10w
movzx r9d, bx
xor r9w, 0x76
mov word [rbp - 0x6c], r9w
movzx edx, bx
xor dx, 0x25
mov word [rbp - 0x6a], dx
movzx eax, bx
xor ax, 0x64
mov word [rbp - 0x68], ax
movzx ecx, bx
xor cx, 0x61
mov word [rbp - 0x66], cx
movzx eax, bx
xor ax, 0x6f
mov word [rbp - 0x64], ax
movzx r8d, bx
xor r8w, 0x70
mov word [rbp - 0x62], r8w
mov word [rbp - 0x60], r9w
movzx eax, bx
xor ax, 0x71
mov word [rbp - 0x5e], ax
mov word [rbp - 0x5c], r10w
mov word [rbp - 0x5a], cx
mov word [rbp - 0x58], dx
mov word [rbp - 0x56], r9w
mov word [rbp - 0x54], r8w
movzx eax, bx
xor ax, 0x66
mov word [rbp - 0x52], ax
mov word [rbp - 0x50], ax
mov word [rbp - 0x4e], r10w
mov word [rbp - 0x4c], r9w
mov word [rbp - 0x4a], r9w
movzx eax, bx
xor ax, 0x63
mov word [rbp - 0x48], ax
mov word [rbp - 0x46], r8w
mov word [rbp - 0x44], r11w
mov word [rbp - 0x42], r11w
movzx eax, bx
xor ax, 0x7c
mov word [rbp - 0x40], ax
xor bx, 0x2b
mov word [rbp - 0x3e], bx
mov word [rbp - 0x3c], di
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14004d000
lea rdx, [0x14004d1e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x104
lea rdx, [rbp + 0x290]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x14004c3ab
mov rsi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov ebx, 4
mov rax, qword gs:[0x58]
add rbx, qword [rax]
mov eax, dword [rbx]
cmp dword [0x1401644e4], eax
jle 0x14004c2ad
lea rcx, [0x1401644e4]
call fcn.140052a5c
cmp dword [0x1401644e4], 0xffffffff
jne 0x14004c2ad
xor ecx, ecx
call fcn.140006c80
mov word [0x1401644f0], ax
lea rcx, [0x1401644e4]
call fcn.1400529f0
mov eax, dword [rbx]
cmp dword [0x1401644f4], eax
jle 0x14004c2ee
lea rcx, [0x1401644f4]
call fcn.140052a5c
cmp dword [0x1401644f4], 0xffffffff
jne 0x14004c2ee
movzx eax, word [0x1401644f0]
mov edx, 0xf0
and ax, dx
mov word [0x1401644e0], ax
lea rcx, [0x1401644f4]
call fcn.1400529f0
mov eax, dword [rbx]
cmp dword [0x1401644ec], eax
jle 0x14004c32b
lea rcx, [0x1401644ec]
call fcn.140052a5c
cmp dword [0x1401644ec], 0xffffffff
jne 0x14004c32b
movzx eax, word [0x1401644f0]
and ax, 0xf
mov word [0x1401644e8], ax
lea rcx, [0x1401644ec]
call fcn.1400529f0
movzx ebx, di
mov ecx, 7
call fcn.140006c80
test al, 0xf0
je 0x14004c34f
mov word [0x1401644e0], ax
movzx ebx, ax
or bx, word [0x1401644e8]
jmp 0x14004c364
test al, 0xf
je 0x14004c364
mov word [0x1401644e8], ax
movzx ebx, ax
or bx, word [0x1401644e0]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, rsi
call fcn.14004d220
mov rcx, rax
lea rdx, [rbp + 0x290]
call fcn.14004d000
lea rdx, [0x14004d1e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.NextHook
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rax, rax
jne 0x14004c458
lea edx, [rax + 4]
call fcn.14004ceb0
movdqa xmm0, xmmword [0x140140780]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140140610]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0x454c4941
mov dword [rbp + 4], 0x5d2044
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400035d0
lea rdx, [0x1400037a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x7272457e
movdqa xmm0, xmmword [0x140140760]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140140610]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0x454c4941
mov dword [rsp + 0x5c], 0x5d2044
lea rdx, [rsp + 0x39]
jmp 0x14004cb91
mov edx, 7
call fcn.14004ceb0
movdqa xmm0, xmmword [0x140140770]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1401404c0]
movdqu xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0x72656874
mov word [rbp + 4], 0x2165
mov byte [rbp + 6], 0
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400035d0
lea rdx, [0x1400037a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, r15d
mov r8, r14
mov rdx, rbx
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rax, rax
jne 0x14004c67c
lea edx, [rax + 4]
call fcn.14004ceb0
mov r8, rax
movdqa xmm0, xmmword [0x140140700]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1401407d0]
movdqu xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [str.YT_GCx___uH]
movdqu xmmword [rbp], xmm0
mov dword [rbp + 0x10], 0x7c797176
mov dword [rbp + 0x14], 0x6d107475
mov byte [rbp + 0x18], 0
mov rcx, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1f], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1e], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1d], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1c], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1b], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1a], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x19], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x18], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x17], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x16], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x15], al
add rcx, 0xb
cmp rcx, 0x37
jb 0x14004c520
mov byte [rbp + 0x18], 0
lea rdx, [rbp - 0x1f]
mov rcx, r8
call fcn.1400035d0
lea rdx, [0x1400037a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724531
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
movdqa xmm0, xmmword [0x140140420]
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140140540]
movdqu xmmword [rsp + 0x48], xmm1
movdqa xmm0, xmmword [0x1401406f0]
movdqu xmmword [rsp + 0x58], xmm0
mov dword [rsp + 0x68], 0x3431393e
mov dword [rsp + 0x6c], 0x25583c3d
mov byte [rsp + 0x70], 0
nop word [rax + rax]
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x39], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x3a], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x3b], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x3c], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x3d], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x3e], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x3f], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x40], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x41], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x42], al
movzx eax, byte [rsp + 0x38]
xor byte [rsp + rdi + 0x43], al
add rdi, 0xb
cmp rdi, 0x37
jb 0x14004c600
mov byte [rsp + 0x70], 0
lea rdx, [rsp + 0x39]
jmp 0x14004cb9d
mov edx, 7
call fcn.14004ceb0
movdqa xmm0, xmmword [0x140140a10]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x2e70
mov byte [rbp - 0xe], 0
lea rdx, [rbp - 0x1f]
mov rcx, rax
call fcn.1400035d0
lea rdx, [0x1400037a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r15d
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov byte [0x14014b0d8], 0
movdqa xmm0, xmmword [0x140140970]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x6c756673
mov dword [rbp - 0xc], 0xa21796c
mov byte [rbp - 8], 0
lea rcx, [rbp - 0x1f]
call fcn.140006d60
mov dword [rbp - 0x30], 0x6375533e
mov dword [rbp - 0x2c], 0x73736563
mov byte [rbp - 0x28], 0
movdqa xmm0, xmmword [0x140140880]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x6c20796c
mov dword [rbp - 0xc], 0x6564616f
mov word [rbp - 8], 0x2164
mov byte [rbp - 6], 0
mov r9d, 0x40
lea r8, [rbp - 0x2f]
lea rdx, [rbp - 0x1f]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x14004ccf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x14014b0d8], 0
jmp 0x14004cbb1
mov cl, 0x1c
mov word [rbp - 0x80], 0x1c
movsx r11d, cl
movzx eax, r11w
xor ax, 0x59
mov word [rbp - 0x7e], ax
movzx r9d, r11w
xor r9w, 0x6e
mov word [rbp - 0x7c], r9w
mov word [rbp - 0x7a], r9w
movzx eax, r11w
xor ax, 0x73
mov word [rbp - 0x78], ax
mov word [rbp - 0x76], r9w
movzx r10d, r11w
xor r10w, 0x3c
mov word [rbp - 0x74], r10w
movzx eax, r11w
xor ax, 0x7d
mov word [rbp - 0x72], ax
movzx eax, r11w
xor ax, 0x78
mov word [rbp - 0x70], ax
movzx eax, r11w
xor ax, 0x76
mov word [rbp - 0x6e], ax
movzx eax, r11w
xor ax, 0x69
mov word [rbp - 0x6c], ax
movzx r8d, r11w
xor r8w, 0x6f
mov word [rbp - 0x6a], r8w
movzx eax, r11w
xor ax, 0x68
mov word [rbp - 0x68], ax
movzx ecx, r11w
xor cx, 0x75
mov word [rbp - 0x66], cx
movzx eax, r11w
xor ax, 0x72
mov word [rbp - 0x64], ax
movzx edx, r11w
xor dx, 0x7b
mov word [rbp - 0x62], dx
mov word [rbp - 0x60], r10w
movzx eax, r11w
xor ax, 0x6c
mov word [rbp - 0x5e], ax
mov word [rbp - 0x5c], r9w
mov word [rbp - 0x5a], cx
movzx eax, r11w
xor ax, 0x6a
mov word [rbp - 0x58], ax
mov word [rbp - 0x56], cx
movzx eax, r11w
xor ax, 0x70
mov word [rbp - 0x54], ax
movzx eax, r11w
xor ax, 0x79
mov word [rbp - 0x52], ax
mov word [rbp - 0x50], dx
mov word [rbp - 0x4e], ax
mov word [rbp - 0x4c], r8w
xor r11w, 0x26
mov word [rbp - 0x4a], r11w
mov word [rbp - 0x48], r10w
mov word [rbp - 0x46], di
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14004d000
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14004d1e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724553
movdqa xmm0, xmmword [0x1401407e0]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x69727020
mov dword [rsp + 0x4c], 0x656c6976
mov dword [rsp + 0x50], 0x2e736567
mov byte [rsp + 0x54], 0
lea rdx, [rsp + 0x39]
jmp 0x14004cb91
mov cl, 0x29
mov word [rbp - 0x80], 0x29
movsx ebx, cl
movzx eax, bx
xor ax, 0x6c
mov word [rbp - 0x7e], ax
movzx r9d, bx
xor r9w, 0x5b
mov word [rbp - 0x7c], r9w
mov word [rbp - 0x7a], r9w
movzx r10d, bx
xor r10w, 0x46
mov word [rbp - 0x78], r10w
mov word [rbp - 0x76], r9w
movzx r11d, bx
xor r11w, 9
mov word [rbp - 0x74], r11w
mov word [rbp - 0x72], r10w
movzx ecx, bx
xor cx, 0x59
mov word [rbp - 0x70], cx
movzx r8d, bx
xor r8w, 0x4c
mov word [rbp - 0x6e], r8w
movzx edx, bx
xor dx, 0x47
mov word [rbp - 0x6c], dx
movzx eax, bx
xor ax, 0x40
mov word [rbp - 0x6a], ax
mov word [rbp - 0x68], dx
movzx eax, bx
xor ax, 0x4e
mov word [rbp - 0x66], ax
mov word [rbp - 0x64], r11w
mov word [rbp - 0x62], cx
mov word [rbp - 0x60], r9w
mov word [rbp - 0x5e], r10w
movzx eax, bx
xor ax, 0x4a
mov word [rbp - 0x5c], ax
mov word [rbp - 0x5a], r8w
movzx eax, bx
xor ax, 0x5a
mov word [rbp - 0x58], ax
mov word [rbp - 0x56], ax
mov word [rbp - 0x54], r11w
movzx eax, bx
xor ax, 0x5d
mov word [rbp - 0x52], ax
mov word [rbp - 0x50], r10w
movzx eax, bx
xor ax, 0x42
mov word [rbp - 0x4e], ax
mov word [rbp - 0x4c], r8w
mov word [rbp - 0x4a], dx
xor bx, 0x13
mov word [rbp - 0x48], bx
mov word [rbp - 0x46], r11w
mov word [rbp - 0x44], di
lea rdx, [rbp - 0x7e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14004d000
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14004d1e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x7272457b
movdqa xmm0, xmmword [0x140140930]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x65636f72
mov dword [rsp + 0x4c], 0x74207373
mov dword [rsp + 0x50], 0x6e656b6f
mov word [rsp + 0x54], 0x2e
lea rdx, [rsp + 0x39]
jmp 0x14004cb91
mov cl, 0x5f
mov word [rbp - 0x20], 0x5f
movsx ebx, cl
movzx eax, bx
xor ax, 0x1a
mov word [rbp - 0x1e], ax
movzx r10d, bx
xor r10w, 0x2d
mov word [rbp - 0x1c], r10w
mov word [rbp - 0x1a], r10w
movzx r9d, bx
xor r9w, 0x30
mov word [rbp - 0x18], r9w
mov word [rbp - 0x16], r10w
movzx r11d, bx
xor r11w, 0x7f
mov word [rbp - 0x14], r11w
mov word [rbp - 0x12], r9w
movzx edx, bx
xor dx, 0x2f
mov word [rbp - 0x10], dx
movzx r8d, bx
xor r8w, 0x3a
mov word [rbp - 0xe], r8w
movzx ecx, bx
xor cx, 0x31
mov word [rbp - 0xc], cx
movzx eax, bx
xor ax, 0x36
mov word [rbp - 0xa], ax
mov word [rbp - 8], cx
movzx eax, bx
xor ax, 0x38
mov word [rbp - 6], ax
mov word [rbp - 4], r11w
mov word [rbp - 2], dx
mov word [rbp], r10w
mov word [rbp + 2], r9w
movzx eax, bx
xor ax, 0x3c
mov word [rbp + 4], ax
mov word [rbp + 6], r8w
movzx eax, bx
xor ax, 0x2c
mov word [rbp + 8], ax
mov word [rbp + 0xa], ax
xor bx, 0x65
mov word [rbp + 0xc], bx
mov word [rbp + 0xe], r11w
mov word [rbp + 0x10], di
lea rdx, [rbp - 0x1e]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14004d000
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14004d1e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x72724564
movdqa xmm0, xmmword [0x140140940]
mov dword [rbp - 0x10], 0x65636f72
mov dword [rbp - 0xc], 0x2e7373
movdqu xmmword [rbp - 0x20], xmm0
lea rdx, [rbp - 0x1f]
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], 0
mov r9d, 0x10
lea r8, [rsp + 0x31]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 7
jbe 0x14004ccb8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cbf3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004cbf3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005277c
jmp 0x14004ccb8
movdqa xmm0, xmmword [0x140140a20]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x2e646e
lea rdx, [rbp - 0x1f]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400035d0
lea rdx, [0x1400037a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x30], 0x7272454d
movdqa xmm0, xmmword [0x140140a30]
mov dword [rbp - 0x10], 0x2e646e
jmp 0x14004cc90
movdqa xmm0, xmmword [0x140140a70]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x2e747369
mov word [rbp - 0xc], 0xa
lea rcx, [rbp - 0x1f]
call fcn.140006d60
mov rcx, rbx
call fcn.140006d60
mov dword [rsp + 0x30], 0x7272457b
movdqa xmm0, xmmword [0x140140a80]
mov dword [rbp - 0x10], 0x2e747369
mov byte [rbp - 0xc], dil
lea rdx, [rbp - 0x1f]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rsp + 0x34], 0x726f
mov byte [rsp + 0x36], dil
mov r9d, 0x10
lea r8, [rsp + 0x31]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.140052720
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret