Function at 0x140003430
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x1b0
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov dword [rcx + 0x88], eax
mov qword [rcx + 0x90], rax
mov word [rcx + 0x98], 1
mov byte [rbp + 0x80], al
lea r9, [rbp + 0x80]
xor r8d, r8d
mov dl, 1
mov ecx, 0x16
call sub.ntdll.dll_RtlAdjustPrivilege
test eax, eax
js 0x140004a54
mov byte [rsi + 0x99], 1
movabs rax, 0x2adaf1b0052ccf6e
mov qword [rbp], rax
movabs rax, 0x9bd22f210b5ffa69
mov qword [rbp + 8], rax
movabs r15, 0x4f9788c06a6fa223
mov qword [rbp + 0x20], r15
movabs r14, 0x9bd22f21722d9504
mov qword [rbp + 0x28], r14
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
lea rax, [rbp]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003510
lea rdx, [rbp]
lea rcx, [rbp + 0xa0]
call fcn.140001310
nop
movabs rdi, 0x23f9faab1900d64d
mov qword [rbp], rdi
movabs r12, 0x9bd22f211755f02a
mov qword [rbp + 8], r12
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r14
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
lea rax, [rbp]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140003573
lea rdx, [rbp]
lea rcx, [rbp + 0x40]
call fcn.140001310
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x40]
call fcn.140004df0
mov qword [rsi + 8], rax
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x1400035de
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400035d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009efc
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x14000361f
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000361a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400042a3
call fcn.140009efc
movabs rax, 0x1cf8c1b00b22cf6e
mov qword [rbp], rax
movabs rax, 0x9bd22f21174ef474
mov qword [rbp + 8], rax
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r14
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
lea rax, [rbp]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003670
lea rdx, [rbp]
lea rcx, [rbp + 0xa0]
call fcn.140001310
nop
mov qword [rbp], rdi
mov qword [rbp + 8], r12
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r14
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
lea rax, [rbp]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400036c0
lea rdx, [rbp]
lea rcx, [rbp + 0x40]
call fcn.140001310
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x40]
call fcn.140004df0
mov qword [rsi + 0x10], rax
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14000372b
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003725
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003725
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009efc
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x14000376c
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003767
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400042a3
call fcn.140009efc
movabs rax, 0x6e7e9ad043acf6e
mov qword [rbp], rax
movabs rax, 0x9bd24a42135dc66b
mov qword [rbp + 8], rax
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r14
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
lea rax, [rbp]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400037c0
lea rdx, [rbp]
lea rcx, [rbp + 0xa0]
call fcn.140001310
nop
mov qword [rbp], rdi
mov qword [rbp + 8], r12
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r14
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
lea rax, [rbp]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140003810
lea rdx, [rbp]
lea rcx, [rbp + 0x40]
call fcn.140001310
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x40]
call fcn.140004df0
mov qword [rsi + 0x18], rax
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14000387b
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003875
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003875
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009efc
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x1400038bc
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400038b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400042a3
call fcn.140009efc
movabs rax, 0x36ffd8b40f28cf6e
mov qword [rbp + 0x40], rax
movabs rax, 0xf6b7624d134efc77
mov qword [rbp + 0x48], rax
movabs rax, 0x8df32df3e7d5cfaa
mov qword [rbp + 0x50], rax
movabs rax, 0x8a5f910b0091399d
mov qword [rbp + 0x58], rax
mov qword [rbp], r15
mov qword [rbp + 8], r14
movabs rax, 0xe8944392b5acbdc5
mov qword [rbp + 0x10], rax
movabs r13, 0x8a5f910b009139ee
mov qword [rbp + 0x18], r13
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp]
vmovdqa ymmword [rbp + 0x40], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0xa0], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0xb0], xmm1
lea rax, [rbp + 0x40]
mov r8, rbx
vzeroupper
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003950
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xa0]
call fcn.140001310
nop
mov qword [rbp], rdi
mov qword [rbp + 8], r12
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r14
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
lea rax, [rbp]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400039a0
lea rdx, [rbp]
lea rcx, [rbp + 0x40]
call fcn.140001310
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x40]
call fcn.140004df0
mov qword [rsi + 0x38], rax
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140003a0b
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003a05
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009efc
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x140003a4c
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400042a3
call fcn.140009efc
movabs rax, 0x2efefca90426d173
mov qword [rbp + 0x40], rax
movabs rax, 0xcbbf4a550154c668
mov qword [rbp + 0x48], rax
movabs rax, 0xe89430e1d0cfd2b7
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], r13
mov qword [rbp], r15
mov qword [rbp + 8], r14
movabs rcx, 0xe8944392b5acbdc5
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], r13
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp]
vmovdqa ymmword [rbp + 0x40], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0xa0], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0xb0], xmm1
lea rax, [rbp + 0x40]
mov r8, rbx
vzeroupper
inc r8
cmp byte [rax + r8], 0
jne 0x140003ac5
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xa0]
call fcn.140001310
nop
mov qword [rbp], rdi
mov qword [rbp + 8], r12
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r14
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
lea rax, [rbp]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140003b14
lea rdx, [rbp]
lea rcx, [rbp + 0x40]
call fcn.140001310
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x40]
call fcn.140004df0
mov qword [rsi + 0x20], rax
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140003b7f
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b79
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009efc
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x140003bc0
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003bbb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400042a3
call fcn.140009efc
movabs rdi, 0x3de2cbb40f28d173
mov qword [rbp + 0x40], rdi
movabs r12, 0xf8bd5d710643f076
mov qword [rbp + 0x48], r12
movabs rax, 0xe89443f6fcdfcea0
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], r13
mov qword [rbp], r15
mov qword [rbp + 8], r14
movabs rax, 0xe8944392b5acbdc5
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r13
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp]
vmovdqa ymmword [rbp + 0x40], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0xa0], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0xb0], xmm1
lea rax, [rbp + 0x40]
mov r8, rbx
vzeroupper
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003c40
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xa0]
call fcn.140001310
nop
movabs rax, 0x23f9faab1900d64d
mov qword [rbp], rax
movabs rax, 0x9bd22f211755f02a
mov qword [rbp + 8], rax
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r14
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
lea rax, [rbp]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140003ca3
lea rdx, [rbp]
lea rcx, [rbp + 0x40]
call fcn.140001310
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x40]
call fcn.140004df0
mov qword [rsi + 0x28], rax
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140003d0e
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003d08
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009efc
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x140003d4f
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400042a3
call fcn.140009efc
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], r12
movabs rax, 0xe8944392b5dfcea0
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], r13
mov qword [rbp], r15
mov qword [rbp + 8], r14
movabs rax, 0xe8944392b5acbdc5
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r13
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp]
vmovdqa ymmword [rbp + 0x40], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0xa0], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0xb0], xmm1
lea rax, [rbp + 0x40]
mov r8, rbx
vzeroupper
inc r8
cmp byte [rax + r8], 0
jne 0x140003db4
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xa0]
call fcn.140001310
nop
movabs rdi, 0x23f9faab1900d64d
mov qword [rbp], rdi
movabs r12, 0x9bd22f211755f02a
mov qword [rbp + 8], r12
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r14
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
lea rax, [rbp]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003e20
lea rdx, [rbp]
lea rcx, [rbp + 0x40]
call fcn.140001310
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x40]
call fcn.140004df0
mov qword [rsi + 0x30], rax
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140003e8b
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e85
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009efc
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x140003ecc
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ec7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400042a3
call fcn.140009efc
movabs rax, 0x4f97f1b00902c74e
mov qword [rbp], rax
mov qword [rbp + 8], r14
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r14
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
lea rax, [rbp]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140003f10
lea rdx, [rbp]
lea rcx, [rbp + 0xa0]
call fcn.140001310
nop
mov qword [rbp], rdi
mov qword [rbp + 8], r12
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r14
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
lea rax, [rbp]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140003f60
lea rdx, [rbp]
lea rcx, [rbp + 0x40]
call fcn.140001310
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x40]
call fcn.140004df0
mov qword [rsi + 0x40], rax
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140003fcb
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003fc5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003fc5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009efc
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x14000400c
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004007
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400042a3
call fcn.140009efc
movabs rax, 0x2ef4e7ac062eda66
mov qword [rbp], rax
movabs rax, 0x9bd2434e1d7df070
mov qword [rbp + 8], rax
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r14
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
lea rax, [rbp]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140004060
lea rdx, [rbp]
lea rcx, [rbp + 0xa0]
call fcn.140001310
nop
mov qword [rbp], rdi
mov qword [rbp + 8], r12
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r14
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
lea rax, [rbp]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400040b0
lea rdx, [rbp]
lea rcx, [rbp + 0x40]
call fcn.140001310
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x40]
call fcn.140004df0
mov qword [rsi + 0x48], rax
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14000411b
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004115
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004115
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009efc
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x14000415c
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004157
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400042a3
call fcn.140009efc
movabs rax, 0x20c7eda51829da66
mov qword [rbp], rax
movabs rax, 0x9bd22f21722df96b
mov qword [rbp + 8], rax
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r14
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xb0], xmm1
lea rax, [rbp]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400041b0
lea rdx, [rbp]
lea rcx, [rbp + 0xa0]
call fcn.140001310
nop
mov qword [rbp], rdi
mov qword [rbp + 8], r12
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r14
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
lea rax, [rbp]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140004200
lea rdx, [rbp]
lea rcx, [rbp + 0x40]
call fcn.140001310
nop
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x40]
call fcn.140004df0
mov qword [rsi + 0x50], rax
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14000426b
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004265
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004265
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009efc
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x1400042af
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400042aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400042aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009efc
mov qword [rbp], rdi
mov qword [rbp + 8], r12
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r14
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
lea rax, [rbp]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400042e3
lea rdx, [rbp]
lea rcx, [rbp + 0x40]
call fcn.140001310
nop
lea rcx, [rbp + 0x40]
call fcn.140004c10
mov qword [rsi + 0x90], rax
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140004349
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004344
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004344
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140009efc
cmp byte [rsi + 0x98], 0
je 0x140004365
mov rdx, qword [rsi + 0x90]
lea rcx, str.ntos:__llx_n
call fcn.140003100
lea rdx, [rbp + 0xe0]
mov rcx, qword [0x1400114c8]
call fcn.1400074d0
nop
cmp byte [rsi + 0x98], 0
je 0x1400043a5
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova rdx, qword [rbp + 0xe0]
lea rcx, str.pdb_path:__s_n
call fcn.140003100
movabs rax, 0x4f9788c02f21ed6d
mov qword [rbp], rax
mov qword [rbp + 8], r14
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r14
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp], xmm0
lea rax, [rbp]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400043d1
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova rcx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
cmp r8, rbx
jne 0x14000440e
lea rdx, [rbp]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004a01
mov rbx, qword [0x1400114c8]
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x40]
call fcn.140003290
lea r8, [rbp]
mov rdx, rax
mov rcx, rbx
call fcn.140009340
test al, al
je 0x140004a01
mov rdi, qword [0x1400114c8]
lea rax, [rbp + 0x140]
mov qword [rbp + 0xa0], rax
movabs rax, 0x4ffe88b46a0ca262
mov qword [rbp + 0x40], rax
movabs rax, 0x9ba02f7172489572
mov qword [rbp + 0x48], rax
movabs rax, 0xe8e743f7b5cfbdaa
mov qword [rbp + 0x50], rax
movabs rax, 0x8a31916200dd399d
mov qword [rbp + 0x58], rax
movabs rax, 0x305c4ac5b224ecc
mov qword [rbp + 0x60], rax
movabs rax, 0x767c909d12c61b98
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x100], r15
mov qword [rbp + 0x108], r14
movabs rcx, 0xe8944392b5acbdc5
mov qword [rbp + 0x110], rcx
mov qword [rbp + 0x118], r13
movabs rcx, 0x305c4ac5b514ea7
mov qword [rbp + 0x120], rcx
mov qword [rbp + 0x128], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqa xmm0, xmmword [rbp + 0x60]
vxorps xmm0, xmm0, xmmword [rbp + 0x120]
vmovdqa xmmword [rbp + 0x60], xmm0
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x140]
vzeroupper
call fcn.1400033f0
mov rbx, rax
movabs r12, 0x1cd2cb8f383fe77c
mov qword [rbp + 0x20], r12
movabs r13, 0x9bd22f21722d9557
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], r14
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x20], xmm0
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x100]
call fcn.1400033b0
nop
mov r9, rbx
mov r8, rax
lea rdx, [rbp]
mov rcx, rdi
call fcn.1400090a0
mov qword [rsi + 0x58], rax
cmp byte [rsi + 0x98], 0
je 0x14000458e
mov rdx, rax
lea rcx, str.process_active_process_links_offset:__llx_n
call fcn.140003100
mov rdi, qword [0x1400114c8]
lea rax, [rbp + 0x100]
mov qword [rbp + 0x20], rax
movabs rax, 0x4fe688a96a01a276
mov qword [rbp + 0x40], rax
movabs rax, 0x9ba02f7172489571
mov qword [rbp + 0x48], rax
movabs rax, 0xe8e743f7b5cfbdaa
mov qword [rbp + 0x50], rax
movabs rax, 0x8a5f916f00d8399d
mov qword [rbp + 0x58], rax
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], r14
movabs rax, 0xe8944392b5acbdc5
mov qword [rbp + 0xb0], rax
movabs rax, 0x8a5f910b009139ee
mov qword [rbp + 0xb8], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqu ymmword [rbp + 0x40], ymm1
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x100]
vzeroupper
call fcn.1400033f0
mov rbx, rax
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], r14
movdqa xmm0, xmmword [rbp + 0xa0]
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0xa0], xmm0
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x140]
call fcn.1400033b0
nop
mov r9, rbx
mov r8, rax
lea rdx, [rbp]
mov rcx, rdi
call fcn.1400090a0
mov qword [rsi + 0x60], rax
cmp byte [rsi + 0x98], 0
je 0x14000469c
mov rdx, rax
lea rcx, str.process_unique_id_offset:__llx_n
call fcn.140003100
mov rdi, qword [0x1400114c8]
lea rax, [rbp + 0x100]
mov qword [rbp + 0x20], rax
movabs rax, 0x4fe388a36a0aa270
mov qword [rbp + 0xa0], rax
movabs rax, 0x9b902f4f7242956d
mov qword [rbp + 0xa8], rax
movabs rax, 0xe8d543f7b5dfbda4
mov qword [rbp + 0xb0], rax
movabs rax, 0x8a3a917900f5398a
mov qword [rbp + 0xb8], rax
movabs rax, 0x305c4ac5b224ed4
mov qword [rbp + 0xc0], rax
movabs rax, 0x767c909d12c61b98
mov qword [rbp + 0xc8], rax
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], r14
movabs rcx, 0xe8944392b5acbdc5
mov qword [rbp + 0x50], rcx
movabs rcx, 0x8a5f910b009139ee
mov qword [rbp + 0x58], rcx
movabs rcx, 0x305c4ac5b514ea7
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0xa0], ymm1
vmovdqa xmm0, xmmword [rbp + 0xc0]
vxorps xmm0, xmm0, xmmword [rbp + 0x60]
vmovdqa xmmword [rbp + 0xc0], xmm0
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x100]
vzeroupper
call fcn.1400033f0
mov rbx, rax
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], r14
movdqa xmm0, xmmword [rbp + 0xa0]
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0xa0], xmm0
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x140]
call fcn.1400033b0
nop
mov r9, rbx
mov r8, rax
lea rdx, [rbp]
mov rcx, rdi
call fcn.1400090a0
mov qword [rsi + 0x68], rax
cmp byte [rsi + 0x98], 0
je 0x1400047f9
mov rdx, rax
lea rcx, str.process_section_base_address_offset:__llx_n
call fcn.140003100
mov rbx, qword [0x1400114c8]
movabs rax, 0x2ef4e7ac062ecf6e
mov qword [rbp + 0x40], rax
movabs rax, 0xfea24a451c64f070
mov qword [rbp + 0x48], rax
movabs rax, 0x8ff513e6dbc9d9ab
mov qword [rbp + 0x50], rax
movabs rax, 0x8a5f910b00914a8b
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r14
movabs r12, 0xe8944392b5acbdc5
mov qword [rbp + 0x30], r12
movabs rdi, 0x8a5f910b009139ee
mov qword [rbp + 0x38], rdi
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x40], ymm1
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x100]
vzeroupper
call fcn.1400033b0
mov r8, rax
lea rdx, [rbp]
mov rcx, rbx
call fcn.140009000
mov qword [rsi + 0x70], rax
cmp byte [rsi + 0x98], 0
je 0x1400048a9
mov rdx, rax
lea rcx, str.mm_allocate_independent_pages_offset:__llx_n
call fcn.140003100
mov rbx, qword [0x1400114c8]
movabs rax, 0x21deeda51829cf6e
mov qword [rbp + 0x40], rax
movabs rax, 0xf5b74b4f175df060
mov qword [rbp + 0x48], rax
movabs rax, 0xe89430f7d2cdedb1
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdi
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], rdi
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x40], ymm1
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x100]
vzeroupper
call fcn.1400033b0
mov r8, rax
lea rdx, [rbp]
mov rcx, rbx
call fcn.140009000
mov qword [rsi + 0x78], rax
cmp byte [rsi + 0x98], 0
je 0x14000493b
mov rdx, rax
lea rcx, str.mm_free_independent_pages_offset:__llx_n
call fcn.140003100
mov rbx, qword [0x1400114c8]
movabs rax, 0x28f6d8b40f3ccf6e
mov qword [rbp + 0x40], rax
movabs rax, 0xefb14a551d5fc561
mov qword [rbp + 0x48], rax
movabs rax, 0xe8944392b5c2d2ac
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdi
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], rdi
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x40], ymm1
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x100]
vzeroupper
call fcn.1400033b0
mov r8, rax
lea rdx, [rbp]
mov rcx, rbx
call fcn.140009000
mov qword [rsi + 0x80], rax
cmp byte [rsi + 0x98], 0
je 0x1400049d0
mov rdx, rax
lea rcx, str.mm_set_page_protection_offset:__llx_n
call fcn.140003100
lea rdx, [rbp]
mov rcx, qword [0x1400114c8]
call fcn.1400098b0
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, 1
jmp 0x140004a03
xor al, al
mov byte [rsi + 0x99], al
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsi + 0x30]
call fcn.140004fe0
cmp qword [0x1400114c0], 0
jne 0x140004a34
mov byte [rsi + 0x99], 0
mov r8, qword [rbp + 0xf8]
cmp r8, 0xf
jbe 0x140004a54
mov rdx, qword [rbp + 0xe0]
lea rcx, [rbp + 0xe0]
call fcn.140004a90
mov rax, rsi
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret