Function at 0x1400504a0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x280
movaps xmmword [rax - 0x38], xmm6
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400b3100]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rbx, rcx
xor r14d, r14d
lea rcx, [rbp + 0x18]
call fcn.140037800
nop
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
mov rcx, qword [rbp + 0x28]
sub rax, rcx
cmp rax, 0x22
jb 0x140051a9e
lea rax, [rbp + 0x18]
cmp qword [rbp + 0x30], 7
cmova rax, qword [rbp + 0x18]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x22
lea r9, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp + 0x78]
call fcn.140049f50
nop
mov rcx, qword [rbx + 0x10]
mov rax, rdi
sub rax, rcx
cmp rax, 4
jb 0x140051aa4
cmp qword [rbx + 0x18], 7
jbe 0x14005055b
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 4
lea r9, [0x1400a2ec8]
lea rcx, [rbp + 0x38]
call fcn.140049f50
nop
lea rdx, [rbp + 0x78]
cmp qword [rbp + 0x90], 7
cmova rdx, qword [rbp + 0x78]
lea r8, [rbp + 8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
movdqa xmm6, xmmword [0x1400a3180]
test eax, eax
je 0x14005068b
movabs rax, 0x26d50ada607aff00
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0xe98d01b4ad978f15
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x2509731f24a11374
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rdi, 0x73afddd9d12ceaa6
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rsi, 0x43a769fa14149e63
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs r14, 0x9fff64c78df2fb74
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movabs r15, 0x2f70167404c4701d
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
lea rdx, [rbp + 0xc0]
jmp 0x140050823
mov eax, dword [rbp + 0x48]
add eax, eax
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 7
cmova rcx, qword [rbp + 0x38]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, str.ImagePath
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [rbp + 8]
test eax, eax
je 0x140050961
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movabs rax, 0x26d50ada607aff00
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0xfe920de0ad978f15
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0xf577e0065b4157a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x6c3bcaff14b8fd4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0x6be318f6968b2032
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs r12, 0x7f454253e39ebb48
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rsi, 0x43a769fa14149e63
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs r14, 0x9fff64c78df2fb74
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movabs r15, 0x2f70167404c4701d
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
movabs rdi, 0x73afddd9d12ceaa6
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
movabs r13, 0x6be318f6968b2a57
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa xmm0, xmmword [rbp + 0xe0]
vxorps xmm0, xmm0, xmmword [rbp + 0x180]
vmovdqa xmmword [rbp + 0xe0], xmm0
lea rdx, [rbp + 0xc0]
vmovdqa ymmword [rbp + 0xc0], ymm1
lea rcx, [0x1400b4830]
vzeroupper
call fcn.140046c30
xor r14d, r14d
xor bl, bl
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x140050887
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005087a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051aaa
call fcn.1400587f0
movdqa xmm6, xmmword [0x1400a3180]
movdqu xmmword [rbp + 0x48], xmm6
mov word [rbp + 0x38], r14w
mov rdx, qword [rbp + 0x90]
cmp rdx, 7
jbe 0x1400508dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400508cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051abc
call fcn.1400587f0
movdqa xmm6, xmmword [0x1400a3180]
movdqu xmmword [rbp + 0x88], xmm6
mov word [rbp + 0x78], r14w
mov rdx, qword [rbp + 0x30]
cmp rdx, 7
jbe 0x140050929
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140050924
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051a98
call fcn.1400587f0
movzx eax, bl
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140058530
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov dword [rsp + 0x28], 4
lea rax, [0x1400a2fb0]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, str.Type
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [rbp + 8]
test eax, eax
je 0x140050a00
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movabs rax, 0x26d50ada607aff00
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0xef8610e0ad978f15
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x5950711176e45778
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x73afddd3b45986c7
mov qword [rbp], rax
movabs rdi, 0x73afddd9d12ceaa6
jmp 0x14005060a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x1400a2668]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x14005083d
lea rdx, str.RtlAdjustPrivilege
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.NtLoadDriver
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea r9, [rbp + 0x10]
xor r8d, r8d
mov dl, 1
mov ecx, 0xa
call rbx
test eax, eax
jns 0x140050d09
movabs rax, 0x31c249967560ff05
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs rax, 0xf69e02e7b7809406
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movabs rax, 0x4e50790024a01571
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
movabs rax, 0x8fb8abb8599bc5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
movabs rax, 0xfbc7c97f9e77532
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs rax, 0xd351d2186e8d23a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0x77eca3c5fa9709b8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
movabs rax, 0x7fea1f505e0451ea
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
movabs rax, 0x8613f54d5a615639
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rax, 0xab65d31a7d6d73ee
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x76781b4f1a4809eb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
movabs rax, 0x578e43e17d887da3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
movabs rsi, 0x43a769fa14149e63
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs r14, 0x9fff64c78df2fb74
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs r15, 0x2f70167404c4701d
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rdi, 0x73afddd9d12ceaa6
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs r13, 0x6be318f6968b2a57
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs r12, 0x7f454253e39ebb48
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x4c89c4a096fe7fd1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0xa993f3535653cca
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0xe73380222341334b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0xc20bbd6f0f4d169c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0x12193b3c7b686e85
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x578e43e177e614ce
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0x160], ymm1
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0x180], ymm1
vmovdqu ymm0, ymmword [rbp + 0x1a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x1a0], ymm1
lea rdx, [rbp + 0x160]
jmp 0x14005082b
mov rcx, qword [rbp + 0x28]
sub rdi, rcx
cmp rdi, 0x34
jb 0x140051ab0
lea rax, [rbp + 0x18]
cmp qword [rbp + 0x30], 7
cmova rax, qword [rbp + 0x18]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x34
lea r9, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp + 0x58]
call fcn.140049f50
nop
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], 7
cmova rdx, qword [rbp + 0x58]
lea rcx, [rbp + 0x98]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rbp + 0x98]
call rsi
mov ebx, eax
cmp eax, 0xc0000603
jne 0x1400516d1
movabs rax, 0x2fd21fda6661f11a
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x160], rcx
movabs rax, 0xbf9a08a5ec809e1a
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x168], rcx
movabs rax, 0x4350641172ad0279
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
movabs rax, 0x168faeb0f15899cf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
movabs rax, 0xac37c93fae94b39
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs rax, 0x1d6531328bbedf26
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0x38a9a0c5fd9d10bd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
movabs rax, 0x6fef5647514559a2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
movabs rax, 0x895ae4434c2d1339
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rax, 0xaa2bc800766d3afb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x763954485b0d18e4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
movabs rax, 0x21ae268d158767a7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
movabs rax, 0x243f76c183ba82a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x5b88c7b2de22bdb5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
movabs rax, 0xcdeb5bcc91b29f9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
movabs rax, 0xbc8bd49d14675152
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
movabs rax, 0x2c7faadab5313b53
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs rax, 0x262828d737a47173
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x69c4995662c8f2c8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
movabs rax, 0x4069b58941e0ae44
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
movabs rsi, 0x43a769fa14149e63
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs r14, 0x9fff64c78df2fb74
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs r15, 0x2f70167404c4701d
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rdi, 0x73afddd9d12ceaa6
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs r13, 0x6be318f6968b2a57
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs r12, 0x7f454253e39ebb48
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x4c89c4a096fe7fd1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0xa993f3535653cca
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0xe73380222341334b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0xc20bbd6f0f4d169c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0x12193b3c7b686e85
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x578e43e177e614ce
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0x6e21961e7d55c45f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0x29edb1dbac469dd0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0x63aa95c8ba7245d9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rax, 0xd9e3a0bd71142472
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
movabs rax, 0xc0dcfaac5505673
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0x524641f75fd01804
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0xcb2f02406e89ead
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
movabs rax, 0x4069b58941e0a436
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0x160], ymm1
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0x180], ymm1
vmovdqu ymm0, ymmword [rbp + 0x1a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x1a0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x120]
vmovdqa ymmword [rbp + 0x1c0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x1e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
vmovdqa ymmword [rbp + 0x1e0], ymm1
lea rdx, [rbp + 0x160]
lea rcx, [0x1400b4830]
vzeroupper
call fcn.140046c30
movabs rax, 0x3ad51d897d73fb11
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0xf08b44aff9938b54
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x4a1c741577ad143d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x12ddb8b7bd599c86
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0x1d8a6a92b6ee4635
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0x4531313a8fbec92d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x3c59bf9d3b537f1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x42da7e786a297d89
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0xb360d9717f047d02
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0xa779cf1a4c115bd9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0x7d6b4f52142b1aeb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x39e100bd038347a2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0x3268d542113ab62b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0x29e7d6b2ca28f293
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0x4c89c4a096fe7fd1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
movabs rax, 0xa993f3535653cca
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
movabs rax, 0xe73380222341334b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rax, 0xc20bbd6f0f4d169c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x12193b3c7b686e85
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
movabs rax, 0x578e43e177e614ce
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
movabs rax, 0x6e21961e7d55c45f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x29edb1dbac469dd0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x180]
vmovdqa ymmword [rbp + 0xe0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0x100], ymm1
vmovdqa xmm0, xmmword [rbp + 0x120]
vxorps xmm0, xmm0, xmmword [rbp + 0x1c0]
vmovdqa xmmword [rbp + 0x120], xmm0
lea rdx, [rbp + 0xc0]
lea rcx, [0x1400b4830]
vzeroupper
call fcn.140046c30
movabs rax, 0x2fd23fdd3460fb10
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs rax, 0xdb9a08a5ec809e1a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movabs rax, 0x401c540661b2196f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
movabs rax, 0x1deaa9aab84081c5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
movabs rax, 0x188238d1f3e74836
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs rax, 0xb6526218ce9df68
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0x4c89c4a09cce5fbe
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
movabs rcx, 0xa993f3535653cca
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x4c89c4a096fe7fd1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0x160], ymm1
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0x180], ymm1
lea rdx, [rbp + 0x160]
lea rcx, [0x1400b4830]
vzeroupper
call fcn.140046c30
shr ebx, 0x1f
xor bl, 1
mov rdx, qword [rbp + 0x70]
cmp rdx, 7
jbe 0x1400516bf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400516ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051ab6
call fcn.1400587f0
movdqu xmmword [rbp + 0x68], xmm6
xor r14d, r14d
mov word [rbp + 0x58], r14w
jmp 0x14005083f
cmp ebx, 0xc0000022
je 0x1400516e5
cmp ebx, 0xc000009a
jne 0x140051a85
movabs rax, 0x7871a897177fd02
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0xed9044a3e89b9511
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x4616700177aa193d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x16fdfdadbf4983c5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0x51907d95e4fe4524
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0x7f454253e3e68b68
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rsi, 0x43a769fa14149e63
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs r14, 0x9fff64c78df2fb74
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movabs r15, 0x2f70167404c4701d
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
movabs rdi, 0x73afddd9d12ceaa6
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
movabs r13, 0x6be318f6968b2a57
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs r12, 0x7f454253e39ebb48
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqa xmm0, xmmword [rbp + 0xe0]
vxorps xmm0, xmm0, xmmword [rbp + 0x180]
vmovdqa xmmword [rbp + 0xe0], xmm0
lea rdx, [rbp + 0xc0]
lea rcx, [0x1400b4830]
vzeroupper
call fcn.140046c30
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov edx, ebx
mov rcx, rax
call fcn.140051e20
mov r8, rax
movabs rax, 0x27cb1c957734b24a
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xc0], rcx
movabs rax, 0xfedf0aa6ad979954
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xc8], rcx
movabs rax, 0x5b11731c67ad0473
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xd0], rcx
movabs rax, 0x1adbb3b8f15e8586
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0x7813885e3f94321
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0x1b65253d8af5d827
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x3eefe4d2f38816a3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x63e94f54584551a5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0xe7338022234b5425
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rcx, 0xc20bbd6f0f4d169c
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0x4c89c4a096fe7fd1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
movabs rax, 0xa993f3535653cca
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
movabs rax, 0xe73380222341334b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x180]
vmovdqa ymmword [rbp + 0xe0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x100]
vxorps xmm0, xmm0, xmmword [rbp + 0x1a0]
vmovdqa xmmword [rbp + 0x100], xmm0
lea rdx, [rbp + 0xc0]
mov rcx, r8
vzeroupper
call fcn.140046c30
cmp ebx, 0xc000010e
jne 0x140051679
mov bl, 1
jmp 0x14005167f
call fcn.14006a170
nop
call fcn.140036400
nop
call fcn.140036400
int3
call fcn.14006a170
nop
call fcn.140036400
int3
call fcn.14006a170
nop
call fcn.14006a170
int3