Function at 0x140005480
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x350
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14008f060]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
mov rdi, rcx
mov r12, rdx
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
movabs r14, 0xfb00277f9ac39a5
lea rdx, [rbp + 0x40]
mov r13, rax
movabs rbx, 0x33a127463a8fabc6
movabs rax, 0x6bf16e169bc355e2
mov qword [rbp], rax
movabs rax, 0x33a1662b55fbeaa2
mov rcx, qword [rbp]
mov qword [rbp + 0x40], rcx
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x48], rcx
mov qword [rbp], r14
mov rcx, qword [rbp]
mov qword [rbp + 0x1f0], rcx
mov rcx, r13
mov qword [rbp], rbx
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x40]
mov qword [rbp + 0x1f8], rax
pxor xmm0, xmmword [rbp + 0x1f0]
movdqa xmmword [rbp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rax
movabs r8, 0xb66386bb52945c89
movabs rax, 0x3e8277019cc54e97
mov qword [rbp], rax
movabs rax, 0x1cd552551bacdb0
mov rcx, qword [rbp]
mov qword [rbp + 0x100], rcx
mov qword [rbp], rax
movabs rax, 0xb1a6bee77c281080
mov rcx, qword [rbp]
mov qword [rbp + 0x108], rcx
mov qword [rbp], rax
movabs rax, 0xaf832bdd28281d66
mov rcx, qword [rbp]
mov qword [rbp + 0x110], rcx
movabs rcx, 0x77c5476a4d722eca
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
movabs rax, 0x87dcdd95084362e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
movabs rax, 0xc9b54fa41c4c6d10
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x100]
mov rax, qword [rbp]
movdqa xmm2, xmmword [rbp + 0x120]
vmovdqu ymm0, ymmword [rbp + 0x220]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
mov qword [rbp + 0x248], rax
vpxor xmm2, xmm2, xmmword [rbp + 0x240]
vmovdqa ymmword [rbp + 0x100], ymm1
vmovdqa xmmword [rbp + 0x120], xmm2
vzeroupper
call rdx
test ax, ax
jne 0x140005765
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movabs rax, 0xfb0020596de4be0
lea r8, [rbp + 0x10]
mov qword [rbp], rax
lea rdx, [rbp + 0x20]
mov rax, qword [rbp]
xor r9d, r9d
mov qword [rbp + 0x10], rax
xor ecx, ecx
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp], rbx
mov qword [rbp + 0x1d0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
movabs rax, 0x3f803231bfea4195
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x10], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x33a127463ab89af6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x1e8], rax
pxor xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x20], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movsxd rsi, dword [r12 + 0x3c]
lea rdx, [rbp + 0x50]
movabs rax, 0x4edc63028dde50f3
mov rcx, r13
mov qword [rbp], rax
add rsi, r12
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x33a15f0359e0c7aa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x50]
mov qword [rbp + 0x208], rax
pxor xmm0, xmmword [rbp + 0x200]
movdqa xmmword [rbp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14008fee8], rax
mov rcx, rdi
test rax, rax
jne 0x1400058bb
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movabs rax, 0xfb0020596de4be0
lea r8, [rbp + 0x20]
mov qword [rbp], rax
lea rdx, [rbp + 0x10]
mov rax, qword [rbp]
xor r9d, r9d
mov qword [rbp + 0x20], rax
xor ecx, ecx
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp], rbx
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x3f803231bfea4195
pxor xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x33a127463ab79af6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x10], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r8d, dword [rsi + 0x50]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
call rax
mov r15, rax
test rax, rax
jne 0x1400059b2
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movabs rax, 0xfb0020596de4be0
lea r8, [rbp + 0x20]
mov qword [rbp], rax
lea rdx, [rbp + 0x10]
mov rax, qword [rbp]
xor r9d, r9d
mov qword [rbp + 0x20], rax
xor ecx, ecx
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp], rbx
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x3f803231bfea4195
pxor xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x33a127463abe9bf6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x10], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movabs rdx, 0x87dcdd95084362e7
movabs rcx, 0xc9b54fa41c4c6d10
movabs rax, 0x5fdc63028dde50f3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0x4be453255ffbc4b4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x260], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x268], rax
mov qword [rbp], rdx
lea rdx, [rbp + 0x80]
mov rax, qword [rbp]
mov qword [rbp + 0x270], rax
mov qword [rbp], rcx
mov rcx, r13
mov rax, qword [rbp]
mov qword [rbp + 0x278], rax
vmovdqu ymm0, ymmword [rbp + 0x260]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x80], ymm1
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14008fef0], rax
test rax, rax
jne 0x140005b62
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movabs rax, 0xfb0020596de4be0
lea r8, [rbp + 0x20]
mov qword [rbp], rax
lea rdx, [rbp + 0x10]
mov rax, qword [rbp]
xor r9d, r9d
mov qword [rbp + 0x20], rax
xor ecx, ecx
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp], rbx
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x3f803231bfea4195
pxor xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x33a127463ab69af6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x10], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor r14d, r14d
lea rcx, [rbp + 0x1c4]
mov dword [rbp + 0x1c4], r14d
mov rdx, r15
mov r8d, dword [rsi + 0x50]
mov qword [rsp + 0x20], rcx
mov rcx, rdi
lea r9d, [r14 + 0x40]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0xa0]
mov qword [rbp + 0x140], rax
movabs rcx, 0xc9b54fa41c4c6d10
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x148], rax
mov rax, qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov qword [rbp + 0x150], rax
movabs rax, 0x60c252128dc54bf2
mov qword [rbp + 0x160], r14
mov qword [rbp + 0x168], 1
mov qword [rbp + 0x178], 1
mov qword [rbp + 0x158], r15
mov qword [rbp + 0x170], r14
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x5ccc420b49fccea5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x87dcdd9508431b95
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0xfb00277f9ac39a5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x288], rax
movabs rax, 0x87dcdd95084362e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x290], rax
mov qword [rbp], rcx
mov rcx, r13
mov rax, qword [rbp]
mov qword [rbp + 0x298], rax
vmovdqu ymm0, ymmword [rbp + 0x280]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0xa0], ymm1
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14008fef8], rax
test rax, rax
jne 0x140005dab
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movabs rcx, 0xfb00277f9ac39a5
lea r8, [rbp + 0x20]
movabs rax, 0xfb0020596de4be0
lea rdx, [rbp + 0x10]
mov qword [rbp], rax
xor r9d, r9d
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp], rbx
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x3f803231bfea4195
pxor xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x33a127463abf99f6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], rcx
xor ecx, ecx
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x10], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movabs rax, 0x49dc63028dde50f3
lea rdx, [rbp + 0x60]
mov qword [rbp], rax
mov rcx, r13
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x33a1273e7feaceb4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0xfb00277f9ac39a5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x60]
mov qword [rbp + 0x218], rax
pxor xmm0, xmmword [rbp + 0x210]
movdqa xmmword [rbp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14008fed0], rax
mov rcx, rdi
test rax, rax
jne 0x140005f0d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movabs rcx, 0xfb00277f9ac39a5
lea r8, [rbp + 0x20]
movabs rax, 0xfb0020596de4be0
lea rdx, [rbp + 0x10]
mov qword [rbp], rax
xor r9d, r9d
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp], rbx
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x3f803231bfea4195
pxor xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x33a127463abe99f6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], rcx
xor ecx, ecx
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x10], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [0x14008fef8]
mov r9d, 0x1000
mov r8, r12
mov qword [rsp + 0x20], r14
mov rdx, r15
call rax
test al, al
jne 0x140006023
movabs rcx, 0xfb00277f9ac39a5
lea r8, [rbp + 0x20]
movabs rax, 0xfb0020596de4be0
lea rdx, [rbp + 0x10]
mov qword [rbp], rax
xor r9d, r9d
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp], rbx
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x3f803231bfea4195
pxor xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x33a127463abd99f6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], rcx
xor ecx, ecx
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x10], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
call qword [0x14008fed0]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movzx ebx, word [rsi + 0x14]
add rbx, 0x2c
cmp word [rsi + 6], r14w
je 0x140006078
add rbx, rsi
mov ecx, dword [rbx - 4]
test ecx, ecx
je 0x140006068
mov r8d, dword [rbx]
mov r9d, ecx
mov edx, dword [rbx - 8]
add r8, r12
mov rax, qword [0x14008fef8]
add rdx, r15
mov rcx, rdi
mov qword [rsp + 0x20], 0
call rax
test al, al
je 0x1400061a2
movzx eax, word [rsi + 6]
inc r14d
add rbx, 0x28
cmp r14d, eax
jne 0x140006035
mov rax, qword [0x14008fee8]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
mov rcx, rdi
lea r8d, [rdx + 0x40]
call rax
mov r12, rax
test rax, rax
jne 0x1400062a0
movabs rcx, 0x33a127463a8fabc6
lea r8, [rbp + 0x20]
movabs rdx, 0xfb00277f9ac39a5
movabs rax, 0xfb0020596de4be0
mov qword [rbp], rax
xor r9d, r9d
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp], rcx
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x3f803231bfea4195
pxor xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x33a127463abb9bf6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], rdx
lea rdx, [rbp + 0x10]
mov rax, qword [rbp]
mov qword [rbp], rcx
xor ecx, ecx
mov qword [rbp + 0x1d0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x10], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
call qword [0x14008fed0]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movabs rcx, 0x33a127463a8fabc6
lea r8, [rbp + 0x20]
movabs rdx, 0xfb00277f9ac39a5
movabs rax, 0xfb0020596de4be0
mov qword [rbp], rax
xor r9d, r9d
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp], rcx
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x3f803231bfea4195
pxor xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x33a127463abc9bf6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], rdx
lea rdx, [rbp + 0x10]
mov rax, qword [rbp]
mov qword [rbp], rcx
xor ecx, ecx
mov qword [rbp + 0x1d0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x10], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
call qword [0x14008fed0]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [0x14008fef8]
lea r8, [rbp + 0x140]
xor ebx, ebx
mov rdx, r12
mov rcx, rdi
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 0x40]
call rax
test al, al
jne 0x1400063dc
movabs rcx, 0x33a127463a8fabc6
lea r8, [rbp + 0x20]
movabs rdx, 0xfb00277f9ac39a5
movabs rax, 0xfb0020596de4be0
mov qword [rbp], rax
xor r9d, r9d
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp], rcx
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x3f803231bfea4195
pxor xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x33a127463aba9bf6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], rdx
lea rdx, [rbp + 0x10]
mov rax, qword [rbp]
mov qword [rbp], rcx
xor ecx, ecx
mov qword [rbp + 0x1d0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x10], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
call qword [0x14008fed0]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [0x14008fed0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [0x14008fee8]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
mov r8d, 0x1000
mov rcx, rdi
call rax
mov qword [rbp + 0x30], rax
mov r14, rax
test rax, rax
jne 0x140006521
movabs rcx, 0x33a127463a8fabc6
lea r8, [rbp + 0x20]
movabs rdx, 0xfb00277f9ac39a5
movabs rax, 0xfb0020596de4be0
mov qword [rbp], rax
xor r9d, r9d
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp], rcx
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x3f803231bfea4195
pxor xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x33a127463ab99bf6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], rdx
lea rdx, [rbp + 0x10]
mov rax, qword [rbp]
mov qword [rbp], rcx
xor ecx, ecx
mov qword [rbp + 0x1d0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x10], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
call qword [0x14008fed0]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [0x14008fed0]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [0x14008fef8]
lea r8, [0x140007200]
mov r9d, 0x1000
mov qword [rsp + 0x20], rbx
mov rdx, r14
mov rcx, rdi
call rax
test al, al
jne 0x140006672
movabs rcx, 0x33a127463a8fabc6
lea r8, [rbp + 0x20]
movabs rdx, 0xfb00277f9ac39a5
movabs rax, 0xfb0020596de4be0
mov qword [rbp], rax
xor r9d, r9d
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp], rcx
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x3f803231bfea4195
pxor xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x33a127463ab89bf6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], rdx
lea rdx, [rbp + 0x10]
mov rax, qword [rbp]
mov qword [rbp], rcx
xor ecx, ecx
mov qword [rbp + 0x1d0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x10], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
call qword [0x14008fed0]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [0x14008fed0]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [0x14008fed0]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movabs rcx, 0xc9b54fa41c4c6d10
lea rdx, [rbp + 0xc0]
movabs rax, 0x6ae2670398c94be6
movabs rbx, 0x33a127463a8fabc6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x56d34f125ffbc4ab
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x87dcdd9508430686
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0xfb00277f9ac39a5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2a0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x2a8], rax
movabs rax, 0x87dcdd95084362e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2b0], rax
mov qword [rbp], rcx
mov rcx, r13
mov rax, qword [rbp]
mov qword [rbp + 0x2b8], rax
vmovdqu ymm0, ymmword [rbp + 0x2a0]
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0xc0], ymm1
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14008fed8], rax
test rax, rax
jne 0x140006889
movabs rcx, 0xfb00277f9ac39a5
lea r8, [rbp + 0x20]
movabs rax, 0xfb0020596de4be0
lea rdx, [rbp + 0x10]
mov qword [rbp], rax
xor r9d, r9d
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp], rbx
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x3f803231bfea4195
pxor xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x33a127463abb99f6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], rcx
xor ecx, ecx
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x10], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
call qword [0x14008fed0]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [0x14008fed0]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [0x14008fed0]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
mov r9, r14
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov dword [rsp + 0x28], ecx
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], r12
call rax
test rax, rax
jne 0x1400069cd
movabs rcx, 0xfb00277f9ac39a5
lea r8, [rbp + 0x20]
movabs rax, 0xfb0020596de4be0
lea rdx, [rbp + 0x10]
mov qword [rbp], rax
xor r9d, r9d
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp], rbx
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x3f803231bfea4195
pxor xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x33a127463ab79bf6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], rcx
xor ecx, ecx
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x10], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
call qword [0x14008fed0]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [0x14008fed0]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [0x14008fed0]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rcx, 0xc9b54fa41c4c6d10
lea rdx, [rbp + 0xe0]
movabs rax, 0x6cdf70279dcd5cf7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0x41ce4a2377fcd8a3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x87dcdd950843629e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0xfb00277f9ac39a5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2c0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x2c8], rax
movabs rax, 0x87dcdd95084362e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2d0], rax
mov qword [rbp], rcx
mov rcx, r13
mov rax, qword [rbp]
mov qword [rbp + 0x2d8], rax
vmovdqu ymm0, ymmword [rbp + 0x2c0]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0xe0], ymm1
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14008fee0], rax
test rax, rax
jne 0x140006be3
movabs rcx, 0xfb00277f9ac39a5
lea r8, [rbp + 0x20]
movabs rax, 0xfb0020596de4be0
lea rdx, [rbp + 0x10]
mov qword [rbp], rax
xor r9d, r9d
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp], rbx
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x3f803231bfea4195
pxor xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x33a127463abc99f6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], rcx
xor ecx, ecx
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x10], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
call qword [0x14008fed0]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [0x14008fed0]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [0x14008fed0]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ebx, ebx
lea rdx, [rbp + 0x1c0]
mov rcx, rdi
mov dword [rbp + 0x1c0], ebx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rbp + 0x1c0], 0x103
jne 0x140007120
xorps xmm0, xmm0
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 0x40]
mov rdx, r12
lea r8, [rbp + 0x180]
mov rcx, rdi
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
movups xmmword [rbp + 0x1a0], xmm0
movups xmmword [rbp + 0x1b0], xmm0
call qword [0x14008fee0]
mov rbx, qword [rbp + 0x1a0]
cmp rbx, 0x404040
je 0x140006ff8
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x140006be3
mov ecx, 0x1400000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r13, rax
test rax, rax
jne 0x140006d6e
movabs rcx, 0x33a127463a8fabc6
lea r8, [rbp + 0x20]
movabs rdx, 0xfb00277f9ac39a5
movabs rax, 0xfb0020596de4be0
mov qword [rbp], rax
xor r9d, r9d
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp], rcx
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x3f803231bfea4195
pxor xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x33a127463abe9af6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], rdx
lea rdx, [rbp + 0x10]
mov rax, qword [rbp]
mov qword [rbp], rcx
xor ecx, ecx
mov qword [rbp + 0x1d0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x10], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor edx, edx
mov r8d, 0x1400000
mov rcx, r13
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x1000
mov qword [rsp + 0x20], 0
mov r8, r13
mov rdx, r15
mov rcx, rdi
call qword [0x14008fef8]
movzx ecx, word [rsi + 0x14]
lea rbx, [rsi + 0x18]
movzx edx, word [rsi + 6]
add rbx, rcx
xor r14d, r14d
test dx, dx
je 0x140006e47
lea r8, str..rsrc
lea r9, str..reloc
mov edx, dword [rbx + 8]
test edx, edx
je 0x140006e30
xor ecx, ecx
nop
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140006de6
cmp rcx, 6
jne 0x140006dd0
jmp 0x140006e04
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [r9 + rcx - 1]
jne 0x140006e30
cmp rcx, 7
jne 0x140006df0
mov r9, rdx
mov qword [rsp + 0x20], 0
mov edx, dword [rbx + 0xc]
mov r8, r13
add rdx, r15
mov rcx, rdi
call qword [0x14008fef8]
lea r8, str..rsrc
lea r9, str..reloc
movzx eax, word [rsi + 6]
inc r14d
add rbx, 0x28
cmp r14d, eax
jne 0x140006dc5
movzx ecx, word [rsi + 0x14]
movzx edx, ax
movzx eax, cx
xor r14d, r14d
lea rbx, [rax + 0x3c]
test dx, dx
je 0x140006ec8
add rbx, rsi
lea edx, [r14 + 0x20]
nop dword [rax]
mov ecx, dword [rbx - 0x1c]
test ecx, ecx
je 0x140006eb4
mov eax, dword [rbx]
mov dword [rbp + 0x1c8], 0
test eax, 0x80000000
jbe 0x140006e82
mov r9d, 4
jmp 0x140006e91
test eax, 0x20000000
mov r9d, 2
cmova r9d, edx
mov edx, dword [rbx - 0x18]
lea rax, [rbp + 0x1c8]
mov r8, rcx
mov qword [rsp + 0x20], rax
add rdx, r15
mov rcx, rdi
call qword [0x14008fef0]
mov edx, reloc.WLDAP32.dll_Ordinal_32
movzx eax, word [rsi + 6]
inc r14d
add rbx, 0x28
cmp r14d, eax
jne 0x140006e60
movzx eax, word [rsi + 0x14]
movzx eax, ax
mov r9d, 2
mov dword [rbp + 0x1cc], 0
mov rdx, r15
mov rcx, rdi
mov r8d, dword [rax + rsi + 0x24]
lea rax, [rbp + 0x1cc]
mov qword [rsp + 0x20], rax
call qword [0x14008fef0]
mov rdx, qword [rbp + 0x30]
xor esi, esi
mov r9d, 0x1000
mov qword [rsp + 0x20], rsi
mov r8, r13
mov rcx, rdi
call qword [0x14008fef8]
mov rdx, qword [rbp + 0x30]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, rdi
call qword [0x14008fed0]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [0x14008fed0]
mov rax, qword [0x1400901c0]
mov rcx, qword [0x1400901c8]
cmp rax, rcx
je 0x140006f5d
mov qword [0x1400901c8], rax
mov rcx, rax
mov rdx, qword [0x1400901d0]
cmp rcx, rdx
je 0x140006fcc
cmp rax, rcx
jne 0x140006fba
test rax, rax
je 0x140006fcc
sub rdx, rax
cmp rdx, 0x1000
jb 0x140006f97
mov rcx, qword [rax - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fb3
mov rax, rcx
mov rcx, rax
call fcn.140072a54
xorps xmm0, xmm0
mov qword [0x1400901d0], rsi
movdqu xmmword [0x1400901c0], xmm0
jmp 0x140006fcc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
mov rdx, rcx
lea rcx, [0x1400901c0]
call fcn.1400045a0
mov al, 1
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.140072540
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movabs rcx, 0x33a127463a8fabc6
lea r8, [rbp + 0x20]
movabs rdx, 0xfb00277f9ac39a5
movabs rax, 0xfb0020596de4be0
mov qword [rbp + 0x30], rax
xor r9d, r9d
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], rcx
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], rdx
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp + 0x30]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x3f803231bfea4195
pxor xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x10], rax
movabs rax, 0x33a127463abf9af6
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x30], rdx
lea rdx, [rbp + 0x10]
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x30], rcx
xor ecx, ecx
mov qword [rbp + 0x1d0], rax
mov rax, qword [rbp + 0x30]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x10], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
call qword [0x14008fed0]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r12
mov rcx, rdi
call qword [0x14008fed0]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [0x14008fed0]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movabs rcx, 0x33a127463a8fabc6
lea r8, [rbp + 0x20]
movabs rdx, 0xfb00277f9ac39a5
movabs rax, 0xfb0020596de4be0
mov qword [rbp + 0x30], rax
xor r9d, r9d
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], rcx
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], rdx
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp + 0x30]
movdqa xmm0, xmmword [rbp + 0x20]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x3f803231bfea4195
pxor xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x10], rax
movabs rax, 0x33a127463ab69bf6
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x30], rdx
lea rdx, [rbp + 0x10]
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x30], rcx
xor ecx, ecx
mov qword [rbp + 0x1d0], rax
mov rax, qword [rbp + 0x30]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x1d8], rax
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x10], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]