Function at 0x14001c868
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x298]
sub rsp, 0x370
mov rax, qword [0x140104080]
xor rax, rsp
mov qword [rbp + 0x260], rax
xor r15d, r15d
mov r14d, 0x1000
lea r12d, [r15 + 1]
lea r13d, [r15 + 0xf]
or rdi, 0xffffffffffffffff
cmp byte [0x1401b47e8], r15b
jne 0x14001cd79
lea r8, [0x1400ebbe2]
lea rdx, [0x1400e7e10]
lea rcx, [rbp + 0x1e0]
call fcn.14001f5e0
nop
mov rcx, qword [rbp + 0x1e0]
cmp qword [rbp + 0x1e8], rcx
jne 0x14001c91c
test rcx, rcx
je 0x14001c98b
mov rdx, qword [rbp + 0x1f0]
sub rdx, rcx
mov rax, rcx
cmp rdx, r14
jb 0x14001c986
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jmp 0x14001c980
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x200]
call fcn.140015fac
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140016670
nop
call fcn.14001bc84
test al, al
jne 0x14001c993
lea rcx, [rbp - 0x80]
call fcn.14001d8c4
nop
mov rcx, qword [rbp + 0x1e0]
test rcx, rcx
je 0x14001c98b
mov rdx, qword [rbp + 0x1f0]
sub rdx, rcx
mov r8, rcx
cmp rdx, r14
jb 0x14001c986
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x14001cd6d
call fcn.1400cb7a4
mov al, r12b
jmp 0x14001d891
lea rcx, [rsp + 0x40]
call fcn.1400173c8
lea rcx, [rbp + 0xc0]
call fcn.14001eff8
nop
lea rdx, str.NtShutdownSystem
lea rcx, [rbp + 0xc0]
call fcn.1400093e8
mov rbx, rax
mov rdx, qword [0x1401b2fd0]
lea rcx, [rbp + 0x200]
call fcn.140008ea0
nop
lea rdx, [rbp + 0x200]
cmp qword [rbp + 0x218], r13
cmova rdx, qword [rbp + 0x200]
mov r8, qword [rbp + 0x210]
mov rcx, rbx
call fcn.14000deb8
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, r13
jbe 0x14001ca39
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, r14
jb 0x14001ca34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ca34
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cb7a4
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0xc8]
call fcn.14001f1fc
nop
lea rdx, [rbp + 0x200]
call fcn.14001c19c
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, r13
jbe 0x14001ca99
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, r14
jb 0x14001ca94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ca94
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cb7a4
lea rcx, [rbp - 0x30]
call fcn.14001eff8
nop
lea rdx, str.NtShutdownSystem
lea rcx, [rbp - 0x30]
call fcn.1400093e8
mov rbx, rax
movzx edx, word [0x1401b2fe4]
lea rcx, [rbp + 0x200]
call fcn.140008e38
nop
lea rdx, [rbp + 0x200]
cmp qword [rbp + 0x218], r13
cmova rdx, qword [rbp + 0x200]
mov r8, qword [rbp + 0x210]
mov rcx, rbx
call fcn.14000deb8
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, r13
jbe 0x14001cb2f
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, r14
jb 0x14001cb2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001cb2a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cb7a4
lea rdx, [rbp + 0x200]
lea rcx, [rbp - 0x28]
call fcn.14001f1fc
nop
lea rdx, [rbp + 0x200]
call fcn.14001c19c
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, r13
jbe 0x14001cb8c
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, r14
jb 0x14001cb87
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001cb87
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cb7a4
lea rax, vtable.std::_Func_impl_no_alloc_class__bool___cdecl_Aradus::roblox::init_void_::_8::_lambda_1___unsigned_long_long_unsigned___int64___char_const____ptr64__char_const____ptr64_.0
mov qword [rbp + 0x200], rax
lea rax, [rbp + 0x200]
mov qword [rbp + 0x238], rax
lea rdx, [rbp + 0x200]
lea rcx, [rbp - 0x80]
call fcn.140016958
lea rcx, [rbp - 0x80]
call fcn.140016734
mov rbx, qword [rbp - 0x48]
mov edx, dword [rbx + 0x50]
call fcn.1400179d0
mov rsi, rax
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140016834
mov r9d, dword [rbx + 0x50]
mov r8, qword [rbp - 0x68]
mov rdx, rsi
call fcn.140017ad8
mov r14d, dword [rbx + 0x28]
add r14, rsi
mov ebx, dword [rbx + 0x50]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax]
mov ecx, dword [rcx + rax]
cmp dword [0x1401b4978], ecx
jle 0x14001cc56
lea rcx, [0x1401b4978]
call fcn.1400cb880
cmp dword [0x1401b4978], edi
jne 0x14001cc56
lea rcx, [0x1400e2780]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401b4970], rax
lea rcx, [0x1401b4978]
call fcn.1400cb814
mov rcx, qword [0x1401b2fd0]
mov rdx, r14
call fcn.140017168
mov rdx, rbx
mov rcx, rsi
call qword [0x1401b4970]
mov rcx, qword [0x1401b2fd0]
call fcn.140017348
mov rax, qword [rbp - 0x48]
mov r8d, dword [rax + 0x54]
mov rdx, rsi
call fcn.140017b64
mov byte [0x1401b47e8], r12b
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea rbx, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx - 0x30], rbx
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx - 0x34], edx
lea rcx, [rbp - 0x28]
call fcn.14001ef2c
lea rcx, [rbp - 0x20]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x58]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0xc0], rbx
mov rax, qword [rbp + 0xc0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rbp + rcx + 0xbc], edx
lea rcx, [rbp + 0xc8]
call fcn.14001ef2c
lea rcx, [rbp + 0xd0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x148]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
call fcn.14001d8c4
nop
mov rcx, qword [rbp + 0x1e0]
mov r14d, 0x1000
test rcx, rcx
je 0x14001cd79
mov rdx, qword [rbp + 0x1f0]
sub rdx, rcx
mov rax, rcx
cmp rdx, r14
jb 0x14001cd74
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001cd74
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cb7a4
movdqa xmm0, xmmword [0x1400f2410]
movdqu xmmword [rbp + 0x200], xmm0
mov dword [rbp + 0x210], 0x7871767b
mov dword [rbp + 0x214], 0x7a777c3f
mov dword [rbp + 0x218], 0x156b7e
mov rcx, r15
mov al, byte [rbp + 0x200]
xor byte [rbp + rcx + 0x201], al
add rcx, r12
cmp rcx, 0x1a
jb 0x14001cdaa
mov byte [rbp + 0x21b], r15b
lea rcx, [rbp + 0x201]
call fcn.140001bac
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov r8d, 3
mov dword [rsp + 0x20], r8d
xor r9d, r9d
mov edx, 0xc0000000
lea rcx, str..IoControl
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1401b3008], rax
test rax, rax
je 0x14001d7fd
cmp rax, rdi
je 0x14001d7fd
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
mov qword [rbp + 0x210], r15
mov qword [rbp + 0x218], r15
mov r8d, Ordinal_60
lea rdx, str.Driver_mapping_and_verification_completed_successfully.
lea rcx, [rbp + 0x200]
call fcn.140009fc0
nop
lea rdx, [rbp + 0x200]
call fcn.14001c19c
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, r13
jbe 0x14001ce94
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, r14
jb 0x14001ce8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ce8f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cb7a4
movdqa xmm0, xmmword [0x1400f2400]
movdqu xmmword [rbp + 0x1c0], xmm0
mov dword [rbp + 0x1d0], 0x7b662d62
mov word [rbp + 0x1d4], 0x66
mov rcx, r15
mov al, byte [rbp + 0x1c0]
xor byte [rbp + rcx + 0x1c1], al
add rcx, r12
cmp rcx, 0x14
jb 0x14001ceba
mov byte [rbp + 0x1d5], r15b
lea rcx, [rbp + 0x1c1]
call fcn.14001ad94
mov dword [0x1401b3000], eax
test eax, eax
jne 0x14001cf4b
movdqa xmm0, xmmword [0x1400f23d0]
movdqu xmmword [rbp + 0x200], xmm0
mov dword [rbp + 0x210], 0x6e73216f
mov dword [rbp + 0x214], 0x796e6d63
mov word [rbp + 0x218], select
mov rcx, r15
mov al, byte [rbp + 0x200]
xor byte [rbp + rcx + 0x201], al
add rcx, r12
cmp rcx, 0x18
jb 0x14001cf1d
mov byte [rbp + 0x219], r15b
lea rcx, [rbp + 0x201]
call fcn.140001bac
jmp 0x14001d88f
mov cl, 0x34
mov dword [rbp + 0x1b0], 0x565b6634
mov dword [rbp + 0x1b4], 0x4c5b58
mov rax, r15
mov esi, 6
xor byte [rbp + rax + 0x1b1], cl
add rax, r12
cmp rax, rsi
jae 0x14001cf80
mov cl, byte [rbp + 0x1b0]
jmp 0x14001cf69
mov byte [rbp + 0x1b7], r15b
lea rdx, [rbp + 0x1b1]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1401b30b0], rax
call fcn.14001c490
lea rcx, [rax + 0x10]
call fcn.14001f824
mov rbx, rax
call fcn.14001c490
lea rcx, [rax + 0x118]
call fcn.14001f824
lea rcx, [rax + 0x198]
call fcn.14001f824
mov qword [rbp + 0x1b0], rax
mov qword [0x1401b3070], rax
mov cl, 7
mov dword [rbp + 0x1c0], 0x666b5707
mov dword [rbp + 0x1c4], 0x7475627e
mov byte [rbp + 0x1c8], r15b
mov rax, r15
xor byte [rbp + rax + 0x1c1], cl
add rax, r12
cmp rax, 7
jae 0x14001d011
mov cl, byte [rbp + 0x1c0]
jmp 0x14001cff9
mov byte [rbp + 0x1c8], r15b
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
mov qword [rbp + 0x210], r15
mov qword [rbp + 0x218], r15
lea rax, [rbp + 0x1c1]
mov r8, rdi
inc r8
cmp byte [rax + r8], r15b
jne 0x14001d03a
lea rdx, [rbp + 0x1c1]
lea rcx, [rbp + 0x200]
call fcn.140009fc0
lea r8, [rbp + 0x200]
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x1b0]
call fcn.14001e420
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
mov qword [rbp + 0x210], 9
mov qword [rbp + 0x218], r13
movsd xmm0, qword [str.Workspace]
movsd qword [rbp + 0x200], xmm0
mov al, byte [0x1400e7d20]
mov byte [rbp + 0x208], al
mov byte [rbp + 0x209], r15b
lea r8, [rbp + 0x200]
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x1b0]
call fcn.14001e420
mov rax, qword [rbp + 0x1c0]
mov qword [0x1401b30b8], rax
mov rax, qword [rbp + 0x1e0]
mov qword [0x1401b3080], rax
mov qword [0x1401b3088], rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0x240], xmm0
mov qword [rbp + 0x250], r15
mov qword [rbp + 0x258], r13
mov byte [rbp + 0x240], r15b
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x1e0]
call fcn.14001e5c0
lea rdx, [rbp + 0x1b0]
mov rcx, rax
call fcn.14001e9bc
cmp qword [rbp + 0x1b0], r15
je 0x14001d20e
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x1b0]
call fcn.14001e29c
mov rbx, rax
lea rax, [rbp + 0x240]
cmp rax, rbx
je 0x14001d1c9
mov rdx, qword [rbp + 0x258]
cmp rdx, r13
jbe 0x14001d194
inc rdx
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, r14
jb 0x14001d18f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d200
call fcn.1400cb7a4
mov qword [rbp + 0x250], r15
mov qword [rbp + 0x258], r13
mov byte [rbp + 0x240], r15b
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x240], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x250], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r13
mov byte [rbx], r15b
mov rdx, qword [rbp + 0x218]
cmp rdx, r13
jbe 0x14001d26b
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, r14
jb 0x14001d207
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d207
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cb7a4
jmp 0x14001d26b
mov cl, reloc.WLDAP32.dll_Ordinal_22
mov dword [rbp + 0x1b0], 0x78797816
mov word [rbp + 0x1b4], reloc.WS2_32.dll_WSAStartup
mov rax, r15
xor byte [rbp + rax + 0x1b1], cl
add rax, r12
cmp rax, 4
jae 0x14001d23e
mov cl, byte [rbp + 0x1b0]
jmp 0x14001d226
mov byte [rbp + 0x1b5], r15b
lea rax, [rbp + 0x1b1]
inc rdi
cmp byte [rax + rdi], r15b
jne 0x14001d24c
mov r8, rdi
lea rdx, [rbp + 0x1b1]
lea rcx, [rbp + 0x240]
call fcn.140016174
call fcn.14002f34c
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x1e0]
call fcn.14001e5c0
mov rcx, qword [rax]
mov qword [0x1401b3098], rcx
mov ebx, 8
mov ecx, ebx
call fcn.1400cb520
lea rcx, [fcn.140019d98]
mov qword [rax], rcx
mov qword [rbp + 0x1c0], rax
lea rcx, [rbp + 0x1e8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea rdi, [0x140018d70]
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x1e0], rax
test rax, rax
je 0x14001d7ed
cmp dword [rbp + 0x1e8], r15d
je 0x14001d7e3
movaps xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x1c0], xmm0
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001d7e3
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1c0], xmm0
movdqa xmmword [rbp + 0x1e0], xmm0
mov ecx, ebx
call fcn.1400cb520
lea rcx, [0x140019b7c]
mov qword [rax], rcx
mov qword [rbp + 0x1c0], rax
lea rcx, [rbp + 0x1e8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x1e0], rax
test rax, rax
je 0x14001d7d3
cmp dword [rbp + 0x1e8], r15d
je 0x14001d7c9
movaps xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x1c0], xmm0
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001d7c9
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1c0], xmm0
movdqa xmmword [rbp + 0x1e0], xmm0
mov eax, r12d
xchg byte [0x1401b30c5], al
mov ecx, ebx
call fcn.1400cb520
lea rcx, [0x1400233ec]
mov qword [rax], rcx
mov qword [rbp + 0x1c0], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14001d7bb
mov qword [rsp + 0x70], rax
cmp dword [rsp + 0x58], r15d
je 0x14001d7b1
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp + 0x1c0], xmm0
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001d7b1
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm0
lea ecx, [rbx + 0x10]
call fcn.1400cb520
lea rcx, [rsp + 0x70]
mov qword [rax], rcx
lea rcx, [rsp + 0x50]
mov qword [rax + 8], rcx
lea rcx, [0x140023a78]
mov qword [rax + 0x10], rcx
mov qword [rbp + 0x1c0], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x1400201e8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14001d7a3
cmp dword [rsp + 0x68], r15d
je 0x14001d799
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp + 0x1c0], xmm0
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001d799
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov ecx, ebx
call fcn.1400cb520
lea rcx, [0x140019860]
mov qword [rax], rcx
mov qword [rbp + 0x1c0], rax
lea rcx, [rbp + 0x1e8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x1e0], rax
test rax, rax
je 0x14001d789
cmp dword [rbp + 0x1e8], r15d
je 0x14001d77f
movaps xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x1c0], xmm0
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001d77f
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1e0], xmm0
mov ecx, ebx
call fcn.1400cb520
lea rcx, [0x140023328]
mov qword [rax], rcx
mov qword [rbp + 0x1c0], rax
lea rcx, [rbp + 0x1e8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x1e0], rax
test rax, rax
je 0x14001d76f
cmp dword [rbp + 0x1e8], r15d
je 0x14001d765
movaps xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x1c0], xmm0
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001d765
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1e0], xmm0
mov ecx, ebx
call fcn.1400cb520
lea rcx, [0x140070bbc]
mov qword [rax], rcx
mov qword [rbp + 0x1c0], rax
lea rcx, [rbp + 0x1e8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x140018d70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x1e0], rax
test rax, rax
je 0x14001d755
cmp dword [rbp + 0x1e8], r15d
je 0x14001d74b
movaps xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x1c0], xmm0
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14001d74b
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
mov qword [rbp + 0x210], r15
mov qword [rbp + 0x218], r15
lea r8d, [rbx + 0x14]
lea rdx, str.init_completed_successfully.
lea rcx, [rbp + 0x200]
call fcn.140009fc0
nop
lea rdx, [rbp + 0x200]
call fcn.14001c19c
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, r13
jbe 0x14001d6d0
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, r14
jb 0x14001d6cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001d6cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cb7a4
mov qword [rbp + 0x1c0], r12
lea rcx, [rbp + 0x1c0]
call fcn.140018c50
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x1401b30b0]
sete byte [0x1401b306b]
mov cl, 0x66
mov dword [rbp + 0x1b0], 0x4093466
mov dword [rbp + 0x1b4], 0x1e090a
mov rax, r15
xor byte [rbp + rax + 0x1b1], cl
add rax, r12
cmp rax, rsi
jae 0x14001d727
mov cl, byte [rbp + 0x1b0]
jmp 0x14001d710
mov byte [rbp + 0x1b7], r15b
lea rdx, [rbp + 0x1b1]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001d6d7
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov ecx, r12d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x1e8], r15d
mov ecx, esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, r12d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x1e8], r15d
mov ecx, esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, r12d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x1e8], r15d
mov ecx, esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, r12d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x68], r15d
mov ecx, esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, r12d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x58], r15d
mov ecx, esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, r12d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x1e8], r15d
mov ecx, esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, r12d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x1e8], r15d
mov ecx, esi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
movdqa xmm0, xmmword [0x1400f23b0]
movdqu xmmword [rbp + 0x1e0], xmm0
mov word [rbp + 0x1f0], 0x4a4c
mov byte [rbp + 0x1f2], r15b
mov rcx, r15
mov al, byte [rbp + 0x1e0]
xor byte [rbp + rcx + 0x1e1], al
add rcx, r12
cmp rcx, 0x11
jb 0x14001d820
mov byte [rbp + 0x1f2], r15b
movdqa xmm0, xmmword [0x1400f23e0]
movdqu xmmword [rbp + 0x1c0], xmm0
mov byte [rbp + 0x1d0], r15b
mov rcx, r15
mov al, byte [rbp + 0x1c0]
xor byte [rbp + rcx + 0x1c1], al
add rcx, r12
cmp rcx, r13
jb 0x14001d857
mov byte [rbp + 0x1d0], r15b
mov r9d, Ordinal_50
lea r8, [rbp + 0x1e1]
lea rdx, [rbp + 0x1c1]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.1400cb500
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret