Function at 0x14000ce3c
Capabilities:
Access peb ldr_data
Check for debugger via api
Delete file
Encode data using xor
Execute command
Hash data using fnv
Resolve function by parsing pe exports
Set console window title
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x388]
sub rsp, 0x460
mov rax, qword [0x1401a80c0]
xor rax, rsp
mov qword [rbp + 0x350], rax
xor esi, esi
lea r14, [0x14027f5e0]
mov rcx, r14
call fcn.140087e50
lea edi, [rsi + 1]
lea r8d, [rsi + 8]
mov rdx, qword [0x14027f380]
test rdx, rdx
jne 0x14000cffc
mov ebx, esi
mov edi, 0x9bc5a608
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r15, qword [rax]
mov r10, r15
movups xmm0, xmmword [r10 + 0x58]
movd eax, xmm0
sub ax, r8w
test ebx, ebx
je 0x14000cf01
psrldq xmm0, 8
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
mov edx, 0x811c9dc5
jmp 0x14000cef4
movsx eax, byte [rcx]
xor eax, edx
imul edx, eax, 0x1000193
add rcx, 2
cmp rcx, r8
jne 0x14000cee5
cmp edx, ebx
jne 0x14000cfca
mov r8, qword [r10 + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov rax, qword [rax + r8 + 0x88]
mov r9d, eax
add r9, r8
shr rax, 0x20
cmp r9, r8
je 0x14000cfca
mov r11d, dword [r9 + 0x18]
test r11d, r11d
je 0x14000cfca
mov r13d, dword [r9 + 0x20]
dec r11d
lea rcx, [r8 + r11*4]
mov edx, dword [rcx + r13]
add rdx, r8
mov r14d, 0x811c9dc5
jmp 0x14000cf58
movsx ecx, cl
xor ecx, r14d
imul r14d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14000cf4b
cmp r14d, edi
je 0x14000cf6d
test r11d, r11d
jne 0x14000cf35
jmp 0x14000cfca
mov edx, dword [r9 + 0x1c]
add rdx, r8
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx ecx, word [rcx + r11*2]
mov edx, dword [rdx + rcx*4]
add rdx, r8
cmp rdx, r9
jbe 0x14000cfe9
lea rcx, [rax + r9]
cmp rdx, rcx
jae 0x14000cfe9
mov ebx, 0x811c9dc5
mov edi, ebx
jmp 0x14000cfab
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
inc rdx
mov al, byte [rdx]
cmp al, 0x2e
jne 0x14000cf9d
jmp 0x14000cfbe
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
inc rdx
mov al, byte [rdx]
test al, al
jne 0x14000cfb3
mov r10, qword [r15]
mov rax, qword [r10]
mov r10, rax
cmp rax, r15
je 0x14000cfe6
cmp qword [rax + 0x30], rsi
je 0x14000cfe6
mov r8d, 8
jmp 0x14000ceb9
mov rdx, rsi
mov qword [0x14027f380], rdx
mov edi, 1
lea r14, [0x14027f5e0]
call rdx
mov rcx, rax
call fcn.1400086fc
call fcn.14000b434
call fcn.140008c10
call fcn.140008504
call fcn.1400060fc
call fcn.140005a50
call fcn.14000aad0
call fcn.1400094a4
call fcn.14000bd5c
call fcn.14000b938
call fcn.140008360
call fcn.140006e40
call fcn.140006c14
call fcn.140009df0
test al, al
je 0x14000d050
call fcn.14000609c
call fcn.14000a600
test al, al
je 0x14000d05e
call fcn.14000609c
call fcn.1400097a4
test eax, eax
je 0x14000d06c
call fcn.14000609c
call fcn.14000b1f4
test al, al
je 0x14000d07a
call fcn.14000609c
call fcn.140009110
test eax, eax
je 0x14000d088
call fcn.14000609c
call fcn.14000bcf0
test al, al
je 0x14000d096
call fcn.14000609c
call fcn.140009abc
test eax, eax
je 0x14000d0a4
call fcn.14000609c
movups xmm0, xmmword [0x14017cf48]
movups xmmword [rbp + 0x38], xmm0
mov al, byte [0x14017cf58]
mov byte [rbp + 0x48], al
mov r8d, esi
lea r9, [rbp + 0x38]
mov r12d, 0xa0a0a0a1
mov r15b, Ordinal_50
mov eax, r12d
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x33
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x11
jl 0x14000d0c8
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov r13d, 3
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, r13d
mov edx, 0xc0000000
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x14000f298
movups xmm0, xmmword [0x14017cf60]
movups xmmword [rbp + 0xf8], xmm0
movups xmm1, xmmword [0x14017cf70]
movups xmmword [rbp + 0x108], xmm1
movsd xmm0, qword [0x14017cf80]
movsd qword [rbp + 0x118], xmm0
mov eax, dword [0x14017cf88]
mov dword [rbp + 0x120], eax
mov al, byte [0x14017cf8c]
mov byte [rbp + 0x124], al
mov r8d, esi
lea r9, [rbp + 0xf8]
mov eax, r12d
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x33
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x2d
jl 0x14000d16f
lea rax, [rbp + 0xf8]
mov qword [rbp + 0x70], rax
lea rcx, [rbp + 0xf8]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], sil
jne 0x14000d1ab
mov qword [rbp + 0x78], rax
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x158]
call fcn.14001c5b8
nop
lea rcx, [rbp + 0x158]
call fcn.14000396c
mov bl, al
lea rcx, [rbp + 0x158]
call fcn.140011e3c
test bl, bl
je 0x14000d20e
lea rdx, str.Hyper_hide_binary_check_failed
lea rcx, [rbp + 0x1c0]
call fcn.14000595c
mov rdx, rax
mov rcx, r14
call fcn.140086880
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movups xmm0, xmmword [str.r_bocXSWNIgoDMK__qq]
movups xmmword [rbp + 0xd0], xmm0
movups xmm1, xmmword [0x14017d160]
movups xmmword [rbp + 0xe0], xmm1
mov eax, dword [0x14017d170]
mov dword [rbp + 0xf0], eax
movzx eax, word [0x14017d174]
mov word [rbp + 0xf4], ax
mov r8d, esi
lea r9, [rbp + 0xd0]
mov eax, r12d
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x33
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x26
jl 0x14000d24e
lea rax, [rbp + 0xd0]
mov qword [rbp + 0x80], rax
lea rcx, [rbp + 0xd0]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], sil
jne 0x14000d28d
mov qword [rbp + 0x88], rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x178]
call fcn.14001c5b8
nop
lea rcx, [rbp + 0x178]
call fcn.14000396c
mov bl, al
lea rcx, [rbp + 0x178]
call fcn.140011e3c
test bl, bl
je 0x14000d2f6
lea rdx, str.Air_HVHbinary_check_failed
lea rcx, [rbp + 0x1c0]
call fcn.14000595c
mov rdx, rax
mov rcx, r14
call fcn.140086880
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movsd xmm0, qword [0x14017cd90]
movsd qword [rbp + 0x10], xmm0
mov eax, dword [0x14017cd98]
mov dword [rbp + 0x18], eax
movzx eax, word [0x14017cd9c]
mov word [rbp + 0x1c], ax
cmp byte [0x14017cd9d], sil
je 0x14000d34d
mov r8d, esi
lea r9, [rbp + 0x10]
mov eax, r12d
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x33
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0xe
jl 0x14000d327
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, r13d
mov edx, 0xc0000000
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x14000f274
movups xmm0, xmmword [0x14017d108]
movups xmmword [rbp + 0x128], xmm0
movups xmm1, xmmword [0x14017d118]
movups xmmword [rbp + 0x138], xmm1
movsd xmm0, qword [0x14017d128]
movsd qword [rbp + 0x148], xmm0
movzx eax, word [0x14017d130]
mov word [rbp + 0x150], ax
mov r8d, esi
lea r9, [rbp + 0x128]
mov eax, r12d
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x33
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x2a
jl 0x14000d3be
lea rax, [rbp + 0x128]
mov qword [rbp + 0x90], rax
lea rcx, [rbp + 0x128]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], sil
jne 0x14000d3fd
mov qword [rbp + 0x98], rax
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 0x40]
call fcn.14001c5b8
nop
lea rcx, [rbp - 0x40]
call fcn.14000396c
mov bl, al
lea rcx, [rbp - 0x40]
call fcn.140011e3c
test bl, bl
je 0x14000d45d
lea rdx, str.TitanHideBinaryCheckfailed
lea rcx, [rbp + 0x1c0]
call fcn.14000595c
mov rdx, rax
mov rcx, r14
call fcn.140086880
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movups xmm0, xmmword [0x14017c688]
movups xmmword [rbp + 0x50], xmm0
mov eax, dword [0x14017c698]
mov dword [rbp + 0x60], eax
cmp byte [0x14017c69b], sil
je 0x14000d4a7
mov r8d, esi
lea r9, [rbp + 0x50]
mov eax, r12d
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x33
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x14
jl 0x14000d481
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, r13d
mov ebx, 0xc0000000
mov edx, ebx
lea rcx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x14000f250
movsd xmm0, qword [0x14017d238]
movsd qword [rbp], xmm0
mov eax, dword [0x14017d240]
mov dword [rbp + 8], eax
mov al, byte [0x14017d244]
mov byte [rbp + 0xc], al
mov r8d, esi
lea r9, [rbp]
mov eax, r12d
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x33
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0xd
jl 0x14000d4fc
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, r13d
mov edx, ebx
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x14000f22c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x260]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rbp + 0x260], esi
je 0x14000d58e
lea rdx, str.CheckRemoteDebuggerPresentAPI
lea rcx, [rbp - 0x40]
call fcn.14000595c
mov rdx, rax
mov rcx, r14
call fcn.140086880
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140003a24
test eax, eax
je 0x14000d5bb
lea rdx, str.NtQueryInformationProcess_ProcessDbgPort
lea rcx, [rbp - 0x40]
call fcn.14000595c
mov rdx, rax
mov rcx, r14
call fcn.140086880
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14000d5e9
lea rdx, str.IsDebuggerPresentAPI
lea rcx, [rbp - 0x40]
call fcn.14000595c
mov rdx, rax
mov rcx, r14
call fcn.140086880
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rbp + 0x198], rsi
lea rcx, [0x14017af00]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r9d, 4
lea r8, [rbp + 0x198]
lea edx, [r9 + 0x1a]
call rbx
test eax, eax
mov eax, esi
jne 0x14000d641
cmp qword [rbp + 0x198], rsi
setne al
test eax, eax
je 0x14000d669
lea rdx, str.NtQueryInformationProcess_ProcessDebugObject
lea rcx, [rbp - 0x40]
call fcn.14000595c
mov rdx, rax
mov rcx, r14
call fcn.140086880
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140003b0c
test eax, eax
je 0x14000d696
lea rdx, str.NtQueryInformationProcess_SystemKernelDebuggerInformation
lea rcx, [rbp - 0x40]
call fcn.14000595c
mov rdx, rax
mov rcx, r14
call fcn.140086880
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [0x14017af00]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r10, rax
movups xmm0, xmmword [0x14017d138]
movups xmmword [rbp + 0x20], xmm0
mov ecx, dword [0x14017d148]
mov dword [rbp + 0x30], ecx
movzx ecx, word [0x14017d14c]
mov word [rbp + 0x34], cx
mov cl, byte [0x14017d14e]
mov byte [rbp + 0x36], cl
mov r8d, esi
lea r9, [rbp + 0x20]
mov eax, r12d
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x33
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x17
jl 0x14000d6d5
lea rdx, [rbp + 0x20]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
call rbx
test eax, eax
je 0x14000d748
lea rdx, str.NtSetInformationThread_ThreadHideFromDebugger
lea rcx, [rbp - 0x40]
call fcn.14000595c
mov rdx, rax
mov rcx, r14
call fcn.140086880
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140003bd4
test eax, eax
je 0x14000d775
lea rdx, str.CloseHandleAPI
lea rcx, [rbp - 0x40]
call fcn.14000595c
mov rdx, rax
mov rcx, r14
call fcn.140086880
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rsp + 0x40]
call fcn.1400023b8
mov dword [rbp - 0x48], esi
mov edx, esi
mov ecx, edx
imul ecx, edx
mov eax, dword [rbp - 0x48]
add ecx, eax
mov dword [rbp - 0x48], ecx
add edx, edi
cmp edx, 0x3e8
jl 0x14000d784
lea rcx, [rsp + 0x50]
call fcn.1400023b8
mov rax, qword [rsp + 0x50]
sub rax, qword [rsp + 0x40]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm0, qword [0x14018c940]
comisd xmm0, xmmword [0x14018c8a8]
jbe 0x14000d7ee
mov r9d, Ordinal_50
lea r8, str.ERROR
lea rdx, str.Heisenberg_commands_your_efforts_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.status:ok
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012e58
lea rdx, [0x140012fc8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f0], xmm0
lea rcx, [rbp + 0x388]
movabs rax, 0xff00ff00ff00ff00
mov qword [rbp + 0x2f8], rax
mov qword [rbp + 0x300], rcx
mov r15, qword [rcx]
xor r15, rax
mov qword [rsp + 0x40], r15
mov qword [rbp + 0x2f0], r15
mov qword [rcx], rsi
lea rcx, [rbp + 0x2d0]
call fcn.14000c114
nop
lea rcx, [rbp + 0x330]
call fcn.14000c114
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1b0], xmm1
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.Application_started
lea rcx, [rbp + 0x1a0]
call fcn.140005990
nop
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x2d0]
call fcn.14000c4dc
nop
mov ebx, 0x1000
mov rdx, qword [rbp + 0x1b8]
mov r13d, reloc.WS2_32.dll_ntohs
cmp rdx, r13
jbe 0x14000d8f6
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, rbx
jb 0x14000d8f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d8f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f04
mov qword [0x14027f858], rsi
mov word [0x14027f860], si
mov qword [0x14027f5b0], rsi
mov word [0x14027f5b8], si
mov byte [0x14027f5ba], sil
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x14027f870], xmm0
movups xmmword [0x14027f880], xmm0
movups xmmword [0x14027f890], xmm0
movups xmmword [0x14027f8a0], xmm0
mov byte [0x14027f8b0], al
mov dword [0x14027f5a8], esi
movups xmmword [0x14027f5c0], xmm0
mov qword [0x14027f5d0], rax
mov dword [0x14027f5d8], eax
mov byte [0x14027f5dc], al
lea rcx, [rbp + 0x1c0]
call fcn.14000cb8c
cmp qword [rax + 0x18], r13
jbe 0x14000d975
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rdx, qword [rbp + 0x1d8]
cmp rdx, r13
jbe 0x14000d9bd
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, rbx
jb 0x14000d9b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d9b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f04
lea rcx, str.Color_C0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], rsi
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.Loader_openned
lea rcx, [rbp + 0x1a0]
call fcn.140005990
lea rdx, [rbp + 0x1a0]
mov rcx, r14
call fcn.140086880
cmp byte [0x14027f7f0], sil
jne 0x14000db5e
lea rcx, [rbp + 0x2b0]
call fcn.14000cc64
lea rdx, [rbp + 0x388]
lea rcx, [rbp + 0x2b0]
call fcn.14000c914
nop
mov rcx, r14
call fcn.14008fca0
lea rdx, str.Failed
lea rcx, [rbp + 0x1c0]
call fcn.14000595c
mov rdx, rax
mov rcx, r14
call fcn.140086880
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x58]
call fcn.14000f300
mov r10, rax
cmp byte [rax + 0xa], sil
je 0x14000daa3
mov r8d, esi
mov r9, rax
mov eax, r12d
mul r8d
shr edx, 5
movsx edx, dl
imul eax, edx, 0x33
mov dl, r8b
sub dl, al
add dl, 0x31
xor byte [r9], dl
add r8d, edi
add r9, rdi
cmp r8d, 0xb
jl 0x14000da7d
mov rdx, r10
call fcn.140012e58
mov rcx, rax
lea rdx, [0x14027f7f8]
call fcn.140013060
lea rdx, str._n_Status:
lea rcx, [rbp + 0x1c0]
call fcn.14000595c
nop
lea r8, [0x14027f7f8]
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x2d0]
call fcn.14000c570
nop
lea rcx, [rbp + 0x1c0]
call fcn.14000f360
lea rdx, [rsp + 0x68]
call fcn.14000f324
mov r8, rax
cmp byte [rax + 6], sil
je 0x14000db2d
mov rcx, rax
mov eax, r12d
mul esi
shr edx, 5
movsx edx, dl
imul eax, edx, 0x33
mov dl, sil
sub dl, al
add dl, 0x31
xor byte [rcx], dl
add esi, edi
add rcx, rdi
cmp esi, 7
jl 0x14000db0b
lea rcx, [0x14027f7f8]
call fcn.1400106f0
mov r9d, reloc.WS2_32.dll_recv
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rax, str.santo.json
mov qword [rbp + 0x200], rax
mov qword [rbp + 0x208], 0xa
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x1c0]
call fcn.14001c5b8
nop
lea rcx, [rbp + 0x1c0]
call fcn.14000396c
mov bl, al
lea rcx, [rbp + 0x1c0]
call fcn.140011e3c
xorps xmm0, xmm0
lea r12, [rbp + 0x388]
mov r14, qword [r12]
mov qword [r12], rsi
test bl, bl
je 0x14000e2a3
movups xmmword [rbp + 0x200], xmm0
movabs rbx, 0xff00ff00ff00ff00
mov qword [rbp + 0x208], rbx
mov qword [rbp + 0x210], r12
xor r14, rbx
mov qword [rbp + 0x200], r14
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x40], rax
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], rsi
mov r8d, 8
lea rdx, str.username
lea rcx, [rbp + 0x1a0]
call fcn.140005990
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x1f0], rsi
mov qword [rbp + 0x1f8], rsi
mov r8d, 0xa
lea rdx, str.santo.json
lea rcx, [rbp + 0x1e0]
call fcn.140005990
nop
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x1e0]
call fcn.140004924
xorps xmm0, xmm0
test al, al
jne 0x14000df64
movups xmmword [rbp + 0x2b0], xmm0
lea rcx, [rbp + 0x388]
mov qword [rbp + 0x2b8], rbx
mov qword [rbp + 0x2c0], rcx
mov rbx, qword [rcx]
movabs rax, 0xff00ff00ff00ff00
xor rbx, rax
mov qword [rbp + 0x2b0], rbx
mov qword [rcx], rsi
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x40], rax
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], rsi
mov r8d, 7
lea rdx, str.license
lea rcx, [rbp + 0x1a0]
call fcn.140005990
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x1f0], rsi
mov qword [rbp + 0x1f8], rsi
mov r8d, 0xa
lea rdx, str.santo.json
lea rcx, [rbp + 0x1e0]
call fcn.140005990
nop
lea r8, [rbp + 0x1a0]
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x1c0]
call fcn.140004560
nop
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x270]
call fcn.14000cc74
mov rdx, rax
lea rcx, [0x14027f5e0]
call fcn.14008d600
cmp byte [0x14027f7f0], sil
jne 0x14000de37
lea rdx, str.Failed
lea rcx, [rbp + 0x270]
call fcn.14000595c
mov rdx, rax
lea rcx, [0x14027f5e0]
call fcn.140086880
lea rcx, str.santo.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x58]
call fcn.14000f300
mov r9, rax
cmp byte [rax + 0xa], sil
je 0x14000ddd1
mov r8, rax
mov eax, 0xa0a0a0a1
mul esi
shr edx, 5
movsx edx, dl
imul eax, edx, 0x33
mov dl, sil
sub dl, al
add dl, 0x31
xor byte [r8], dl
add esi, edi
add r8, rdi
cmp esi, 0xb
jl 0x14000ddac
mov rdx, r9
call fcn.140012e58
mov rcx, rax
lea rdx, [0x14027f7f8]
call fcn.140013060
lea rdx, str._n_Status:
lea rcx, [rbp + 0x270]
call fcn.14000595c
nop
lea r8, [0x14027f7f8]
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x2d0]
call fcn.14000c570
nop
lea rcx, [rbp + 0x270]
call fcn.14000f360
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movsd xmm0, qword [str.pGG_]
movsd qword [rsp + 0x68], xmm0
mov al, byte [reloc.WS2_32.dll_gethostname]
mov byte [rsp + 0x70], al
mov r8d, esi
lea r9, [rsp + 0x68]
mov eax, 0xa0a0a0a1
mul r8d
shr edx, 5
movsx eax, dl
imul edx, eax, 0x33
mov al, r8b
sub al, dl
add al, 0x31
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 9
jl 0x14000de57
lea rdx, [rsp + 0x68]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012e58
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
mov r8d, 9
lea rdx, str.Auth_Done
lea rcx, [rbp - 0x68]
call fcn.140005990
nop
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x2d0]
call fcn.14000c4dc
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, r13
jbe 0x14000df04
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000defe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000defe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f04
nop
mov rdx, qword [rbp + 0x1d8]
cmp rdx, r13
jbe 0x14000df48
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000df42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000df42
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f04
nop
movabs rax, 0xff00ff00ff00ff00
xor rbx, rax
lea rcx, [rbp + 0x388]
mov qword [rcx], rbx
jmp 0x14000e29b
lea rax, [rbp - 0x68]
mov qword [rsp + 0x40], rax
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
mov r8d, 8
lea rdx, str.username
lea rcx, [rbp - 0x68]
call fcn.140005990
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], rsi
mov ebx, 0xa
mov r8d, ebx
lea rdx, str.santo.json
lea rcx, [rbp + 0x1a0]
call fcn.140005990
nop
lea r8, [rbp - 0x68]
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x1c0]
call fcn.140004560
nop
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x1f0], rsi
mov qword [rbp + 0x1f8], rsi
lea r8d, [rbx - 2]
lea rdx, str.password
lea rcx, [rbp + 0x1e0]
call fcn.140005990
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2b0], xmm0
mov qword [rbp + 0x2c0], rsi
mov qword [rbp + 0x2c8], rsi
mov r8d, ebx
lea rdx, str.santo.json
lea rcx, [rbp + 0x2b0]
call fcn.140005990
nop
lea r8, [rbp + 0x1e0]
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x240]
call fcn.140004560
nop
lea rax, [rbp + 0x270]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x270]
call fcn.14000cc74
mov rbx, rax
lea rdx, [rbp + 0x1c0]
lea rcx, [rsp + 0x78]
call fcn.14000cc74
nop
mov r8, rbx
mov rdx, rax
lea rcx, [0x14027f5e0]
call fcn.14008bf90
cmp byte [0x14027f7f0], sil
jne 0x14000e190
lea rcx, str.santo.json
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rdx, [rsp + 0x68]
call fcn.14000f324
mov r10, rax
cmp byte [rax + 6], sil
je 0x14000e103
mov r8d, esi
mov r9, rax
mov eax, 0xa0a0a0a1
mul r8d
shr edx, 5
movsx ecx, dl
imul eax, ecx, 0x33
mov cl, r8b
sub cl, al
add cl, 0x31
xor byte [r9], cl
add r8d, edi
add r9, rdi
cmp r8d, 7
jl 0x14000e0db
lea rcx, [0x14027f7f8]
call fcn.1400106f0
mov r9d, reloc.WS2_32.dll_recv
mov r8, r10
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x58]
call fcn.14000f344
mov r9, rax
cmp byte [rax + 8], sil
je 0x14000e165
mov r8, rax
mov eax, 0xa0a0a0a1
mul esi
shr edx, 5
movsx edx, dl
imul eax, edx, 0x33
mov dl, sil
sub dl, al
add dl, 0x31
xor byte [r8], dl
add esi, edi
add r8, rdi
cmp esi, 9
jl 0x14000e140
mov rdx, r9
call fcn.140012e58
mov rcx, rax
lea rdx, [0x14027f7f8]
call fcn.140013060
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movsd xmm0, qword [0x14017cf00]
movsd qword [rsp + 0x58], xmm0
movzx eax, word [0x14017cf08]
mov word [rsp + 0x60], ax
cmp byte [0x14017cf09], sil
je 0x14000e1e2
mov r8d, esi
lea r9, [rsp + 0x58]
mov eax, 0xa0a0a0a1
mul r8d
shr edx, 5
movsx eax, dl
imul edx, eax, 0x33
mov al, r8b
sub al, dl
add al, 0x31
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0xa
jl 0x14000e1bb
lea rdx, [rsp + 0x58]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012e58
nop
mov rdx, qword [rbp + 0x258]
cmp rdx, r13
jbe 0x14000e237
inc rdx
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e232
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e232
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f04
movdqa xmm0, xmmword [0x14018cb90]
movdqu xmmword [rbp + 0x250], xmm0
mov byte [rbp + 0x240], sil
mov rdx, qword [rbp + 0x1d8]
cmp rdx, r13
jbe 0x14000e291
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e28c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e28c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f04
movabs rax, 0xff00ff00ff00ff00
xor r14, rax
jmp 0x14000eb47
movups xmmword [rbp + 0x2b0], xmm0
movabs r15, 0xff00ff00ff00ff00
mov qword [rbp + 0x2b8], r15
mov qword [rbp + 0x2c0], r12
xor r14, r15
mov qword [rbp + 0x2b0], r14
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], r13
mov byte [rbp + 0x1a0], sil
movups xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x1f0], rsi
mov qword [rbp + 0x1f8], r13
mov byte [rbp + 0x1e0], sil
movups xmmword [rbp + 0x1c0], xmm0
movdqa xmm1, xmmword [0x14018cb90]
movdqu xmmword [rbp + 0x1d0], xmm1
mov byte [rbp + 0x1c0], sil
movups xmm0, xmmword [str.tGQG]
movups xmmword [rbp + 0x200], xmm0
mov eax, dword [0x14017cdb0]
mov dword [rbp + 0x210], eax
movzx eax, word [0x14017cdb4]
mov word [rbp + 0x214], ax
cmp byte [0x14017cdb5], sil
je 0x14000e384
mov r8d, esi
lea r9, [rbp + 0x200]
mov eax, 0xa0a0a0a1
mul r8d
shr edx, 5
movsx eax, dl
imul edx, eax, 0x33
mov al, r8b
sub al, dl
add al, 0x31
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x16
jl 0x14000e35d
lea rdx, [rbp + 0x200]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012e58
lea rdx, [rbp + 0x1a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140013074
movups xmm0, xmmword [0x14017d0e8]
movups xmmword [rbp + 0x200], xmm0
mov al, byte [0x14017d0f8]
mov byte [rbp + 0x210], al
mov r8d, esi
lea r9, [rbp + 0x200]
mov eax, 0xa0a0a0a1
mul r8d
shr edx, 5
movsx eax, dl
imul edx, eax, 0x33
mov al, r8b
sub al, dl
add al, 0x31
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x11
jl 0x14000e3ce
lea rdx, [rbp + 0x200]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012e58
lea rdx, [rbp + 0x1e0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140013074
lea rax, [rbp + 0x270]
mov qword [rsp + 0x50], rax
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x270]
call fcn.14000cc74
mov rbx, rax
lea rdx, [rbp + 0x1a0]
lea rcx, [rsp + 0x78]
call fcn.14000cc74
nop
mov r8, rbx
mov rdx, rax
lea rbx, [0x14027f5e0]
mov rcx, rbx
call fcn.14008bf90
cmp byte [0x14027f7f0], sil
jne 0x14000e561
lea rcx, [rbp + 0x310]
call fcn.14000cc64
lea rdx, [rbp + 0x388]
lea rcx, [rbp + 0x310]
call fcn.14000c914
nop
mov rcx, rbx
call fcn.14008fca0
lea rdx, str.Failed
lea rcx, [rbp + 0x270]
call fcn.14000595c
mov rdx, rax
mov rcx, rbx
call fcn.140086880
lea rdx, [rsp + 0x68]
call fcn.14000f324
mov r10, rax
cmp byte [rax + 6], sil
je 0x14000e4f2
mov r8, rax
mov eax, 0xa0a0a0a1
mul esi
shr edx, 5
movsx ecx, dl
imul eax, ecx, 0x33
mov cl, sil
sub cl, al
add cl, 0x31
xor byte [r8], cl
add esi, edi
add r8, rdi
cmp esi, 7
jl 0x14000e4cd
lea rcx, [0x14027f7f8]
call fcn.1400106f0
mov r9d, reloc.WS2_32.dll_recv
mov r8, r10
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rdx, str.Status:
lea rcx, [rbp + 0x270]
call fcn.14000595c
nop
lea r8, [0x14027f7f8]
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x2d0]
call fcn.14000c570
nop
lea rcx, [rbp + 0x270]
call fcn.14000f360
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
cmp qword [rbp + 0x1b0], rsi
je 0x14000e7e2
cmp qword [rbp + 0x1f0], rsi
je 0x14000e7e2
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
lea r13, [rbp + 0x388]
mov qword [rbp + 0x208], r15
mov qword [rbp + 0x210], r13
mov r15, qword [r13]
movabs rax, 0xff00ff00ff00ff00
xor r15, rax
mov qword [rbp + 0x200], r15
mov qword [r13], rsi
mov rcx, rbx
call fcn.14008fca0
xorps xmm0, xmm0
movups xmmword [rbp + 0x240], xmm0
mov qword [rbp + 0x250], rsi
mov qword [rbp + 0x258], rsi
mov r8d, 7
lea rdx, str.Success
lea rcx, [rbp + 0x240]
call fcn.140005990
lea rdx, [rbp + 0x240]
mov rcx, rbx
call fcn.140086880
lea rax, [rbp + 0x270]
mov qword [rsp + 0x50], rax
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x270]
call fcn.14000cc74
mov rdi, rax
lea rax, [rbp + 0x240]
mov qword [rbp + 0x198], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x240], xmm0
mov qword [rbp + 0x250], rsi
mov qword [rbp + 0x258], rsi
mov r8d, 8
lea rdx, str.password
lea rcx, [rbp + 0x240]
call fcn.140005990
nop
lea rax, [rbp - 0x20]
mov qword [rsp + 0x68], rax
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp - 0x20]
call fcn.14000cc74
mov rbx, rax
lea rax, [rbp - 0x68]
mov qword [rbp + 0x260], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
mov r8d, 8
lea rdx, str.username
lea rcx, [rbp - 0x68]
call fcn.140005990
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
mov r8d, 0xa
lea rdx, str.santo.json
lea rcx, [rsp + 0x78]
call fcn.140005990
nop
mov qword [rsp + 0x28], rdi
lea rax, [rbp + 0x240]
mov qword [rsp + 0x20], rax
mov edi, 1
mov r9b, dil
mov r8, rbx
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x78]
call fcn.140004c10
movsd xmm0, qword [0x14017c630]
movsd qword [rsp + 0x58], xmm0
movzx eax, word [0x14017c638]
mov word [rsp + 0x60], ax
mov al, byte [0x14017c63a]
mov byte [rsp + 0x62], al
mov r8d, esi
lea r9, [rsp + 0x58]
mov eax, 0xa0a0a0a1
mul r8d
shr edx, 5
movsx eax, dl
imul edx, eax, 0x33
mov al, r8b
sub al, dl
add al, 0x31
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0xb
jl 0x14000e72b
lea rdx, [rsp + 0x58]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012e58
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov r8d, 9
lea rdx, str.Auth_Done
lea rcx, [rsp + 0x78]
call fcn.140005990
nop
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x2d0]
call fcn.14000c4dc
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x14000e7dd
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e7d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e7d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f04
nop
jmp 0x14000ea5c
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
lea r13, [rbp + 0x388]
mov qword [rbp + 0x208], r15
mov qword [rbp + 0x210], r13
mov r15, qword [r13]
movabs rax, 0xff00ff00ff00ff00
xor r15, rax
mov qword [rbp + 0x200], r15
mov qword [r13], rsi
mov rcx, rbx
call fcn.14008fca0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
mov r8d, 7
lea rdx, str.Success
lea rcx, [rsp + 0x78]
call fcn.140005990
lea rdx, [rsp + 0x78]
mov rcx, rbx
call fcn.140086880
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
xor r8d, r8d
lea rdx, [0x14017ae48]
lea rcx, [rsp + 0x78]
call fcn.140005990
nop
lea rax, [rbp + 0x240]
mov qword [rbp + 0x198], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x240], xmm0
mov qword [rbp + 0x250], rsi
mov qword [rbp + 0x258], rsi
xor r8d, r8d
lea rdx, [0x14017ae48]
lea rcx, [rbp + 0x240]
call fcn.140005990
nop
lea rax, [rbp - 0x20]
mov qword [rsp + 0x68], rax
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp - 0x20]
call fcn.14000cc74
mov rbx, rax
lea rax, [rbp - 0x68]
mov qword [rbp + 0x260], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
mov r8d, 7
lea rdx, str.license
lea rcx, [rbp - 0x68]
call fcn.140005990
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x270], xmm0
mov qword [rbp + 0x280], rsi
mov qword [rbp + 0x288], rsi
mov r8d, 0xa
lea rdx, str.santo.json
lea rcx, [rbp + 0x270]
call fcn.140005990
nop
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x240]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rbx
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x270]
call fcn.140004c10
movsd xmm0, qword [0x14017c630]
movsd qword [rsp + 0x58], xmm0
movzx eax, word [0x14017c638]
mov word [rsp + 0x60], ax
mov al, byte [0x14017c63a]
mov byte [rsp + 0x62], al
mov r8d, esi
lea r9, [rsp + 0x58]
mov eax, 0xa0a0a0a1
mul r8d
shr edx, 5
movsx eax, dl
imul edx, eax, 0x33
mov al, r8b
sub al, dl
add al, 0x31
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0xb
jl 0x14000e99c
lea rdx, [rsp + 0x58]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140012e58
xorps xmm0, xmm0
movups xmmword [rbp + 0x270], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x280], xmm1
mov r8d, 9
lea rdx, str.Auth_Done
lea rcx, [rbp + 0x270]
call fcn.140005990
nop
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x2d0]
call fcn.14000c4dc
nop
mov rdx, qword [rbp + 0x288]
cmp rdx, 0xf
jbe 0x14000ea5c
inc rdx
mov rcx, qword [rbp + 0x270]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ea56
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ea56
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f04
nop
movabs rbx, 0xff00ff00ff00ff00
xor r15, rbx
mov qword [r13], r15
mov rdx, qword [rbp + 0x1d8]
mov r13d, reloc.WS2_32.dll_ntohs
cmp rdx, r13
jbe 0x14000eab7
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eab1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000eab1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f04
nop
mov rdx, qword [rbp + 0x1f8]
cmp rdx, r13
jbe 0x14000eafb
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eaf5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000eaf5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f04
nop
mov rdx, qword [rbp + 0x1b8]
cmp rdx, r13
jbe 0x14000eb3f
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eb39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000eb39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f04
nop
xor r14, rbx
mov r15, qword [rsp + 0x40]
mov qword [r12], r14
lea rcx, [rbp + 0x220]
call fcn.1400022b0
nop
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rcx, qword [rbp + 0x230]
sub rax, rcx
mov r14d, 6
cmp rax, r14
jb 0x14000f2d2
lea r9, [rbp + 0x220]
cmp qword [rbp + 0x238], r13
cmova r9, qword [rbp + 0x220]
mov qword [rsp + 0x30], r14
lea rax, str._santo
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x220]
mov dl, byte [rsp + 0x48]
lea rcx, [rbp + 0x1a0]
call fcn.140015510
nop
lea rax, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], r13
cmova rax, qword [rbp + 0x1a0]
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0x1b0]
mov qword [rbp + 0xa8], rax
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x1c0]
call fcn.14001c5b8
nop
lea rcx, [rbp + 0x1c0]
call fcn.14000396c
mov dil, al
lea rcx, [rbp + 0x1c0]
call fcn.140011e3c
nop
mov rdx, qword [rbp + 0x1b8]
mov r12d, 0x1000
cmp rdx, r13
jbe 0x14000ec62
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, r12
jb 0x14000ec5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ec5d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f04
test dil, dil
jne 0x14000ed78
mov rax, rbx
mov rcx, qword [rbp + 0x230]
sub rax, rcx
cmp rax, r14
jb 0x14000f2d8
lea r9, [rbp + 0x220]
cmp qword [rbp + 0x238], r13
cmova r9, qword [rbp + 0x220]
mov qword [rsp + 0x30], r14
lea rax, str._santo
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x220]
mov dl, byte [rsp + 0x48]
lea rcx, [rbp + 0x1e0]
call fcn.140015510
nop
lea rax, [rbp + 0x1e0]
cmp qword [rbp + 0x1f8], r13
cmova rax, qword [rbp + 0x1e0]
mov qword [rbp + 0xb0], rax
mov rax, qword [rbp + 0x1f0]
mov qword [rbp + 0xb8], rax
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x1a0]
call fcn.14001c5b8
nop
lea rcx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rcx, qword [rbp + 0x1a0]
call fcn.140149ff8
shr rax, 0x20
test eax, eax
jne 0x14000f2de
lea rcx, [rbp + 0x1a0]
call fcn.140011e3c
nop
mov rdx, qword [rbp + 0x1f8]
cmp rdx, r13
jbe 0x14000ed78
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, r12
jb 0x14000ed73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ed73
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f04
mov rax, rbx
mov rcx, qword [rbp + 0x230]
sub rax, rcx
cmp rax, 0xe
jb 0x14000f2f4
lea r9, [rbp + 0x220]
cmp qword [rbp + 0x238], r13
cmova r9, qword [rbp + 0x220]
mov qword [rsp + 0x30], reloc.WS2_32.dll_ntohl
lea r14, str._santoconfigs
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x220]
mov dl, byte [rsp + 0x48]
lea rcx, [rbp + 0x1a0]
call fcn.140015510
nop
lea rax, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], r13
cmova rax, qword [rbp + 0x1a0]
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0x1b0]
mov qword [rbp + 0xc8], rax
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x1c0]
call fcn.14001c5b8
nop
lea rcx, [rbp + 0x1c0]
call fcn.14000396c
mov dil, al
lea rcx, [rbp + 0x1c0]
call fcn.140011e3c
nop
mov rdx, qword [rbp + 0x1b8]
cmp rdx, r13
jbe 0x14000ee71
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, r12
jb 0x14000ee6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ee6c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f04
test dil, dil
jne 0x14000ef82
mov rax, qword [rbp + 0x230]
sub rbx, rax
cmp rbx, 0xe
jb 0x14000f2fa
lea r9, [rbp + 0x220]
cmp qword [rbp + 0x238], r13
cmova r9, qword [rbp + 0x220]
mov qword [rsp + 0x30], reloc.WS2_32.dll_ntohl
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x220]
mov dl, byte [rsp + 0x48]
lea rcx, [rbp + 0x1e0]
call fcn.140015510
nop
lea rax, [rbp + 0x1e0]
cmp qword [rbp + 0x1f8], r13
cmova rax, qword [rbp + 0x1e0]
mov qword [rbp + 0x310], rax
mov rax, qword [rbp + 0x1f0]
mov qword [rbp + 0x318], rax
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0x1a0]
call fcn.14001c5b8
nop
lea rcx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rcx, qword [rbp + 0x1a0]
call fcn.140149ff8
shr rax, 0x20
test eax, eax
jne 0x14000f2bc
lea rcx, [rbp + 0x1a0]
call fcn.140011e3c
nop
mov rdx, qword [rbp + 0x1f8]
cmp rdx, r13
jbe 0x14000ef82
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, r12
jb 0x14000ef7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ef7d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f04
mov r14b, sil
mov rbx, qword [0x14027f7c0]
mov rdi, qword [0x14027f7c8]
jmp 0x14000f051
mov rdx, rbx
lea rcx, [rbp + 0x270]
call fcn.14000cc74
nop
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x290]
call fcn.14000cc74
nop
lea rcx, [rbp + 0x270]
cmp qword [rbp + 0x288], r13
cmova rcx, qword [rbp + 0x270]
cmp qword [rbp + 0x280], 7
jne 0x14000f0bb
mov r8d, 7
lea rdx, str.default
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000f0bb
test r14b, r14b
jne 0x14000f041
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
mov qword [rbp + 0x1d0], rsi
mov qword [rbp + 0x1d8], rsi
lea r8d, [rax + 0x15]
lea rdx, str.Success_AUTH_CHECK_OP
lea rcx, [rbp + 0x1c0]
call fcn.140005990
lea rdx, [rbp + 0x1c0]
lea rcx, [0x14027f5e0]
call fcn.140086880
mov r14b, 1
lea rcx, [rbp + 0x270]
call fcn.14000f3bc
add rbx, 0x40
cmp rbx, rdi
jne 0x14000ef98
call fcn.1400269a4
lea rcx, str.something_went_wrong_
call fcn.140002078
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
nop
mov rdx, qword [rbp + 0x238]
cmp rdx, r13
jbe 0x14000f138
inc rdx
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, r12
jb 0x14000f133
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f133
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r9d, Ordinal_50
lea r8, str.ERROR
lea rdx, str.Heisenberg_commands_your_efforts_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, str.Failed_to_pass_auth_check
lea rcx, [rbp + 0x1c0]
call fcn.14000595c
nop
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x2d0]
call fcn.14000c4dc
nop
lea rcx, [rbp + 0x1c0]
call fcn.14000f360
lea rdx, str.Failed_to_pass_auth_check
lea rcx, [rbp - 0x20]
call fcn.14000595c
mov rdx, rax
lea rcx, [0x14027f5e0]
call fcn.140086880
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.140148f04
mov qword [rbp + 0x230], rsi
mov qword [rbp + 0x238], r13
mov byte [rbp + 0x220], sil
mov rdx, qword [rbp + 0x348]
cmp rdx, r13
jbe 0x14000f18c
inc rdx
mov rcx, qword [rbp + 0x330]
mov rax, rcx
cmp rdx, r12
jb 0x14000f187
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f187
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f04
movdqa xmm0, xmmword [0x14018cb90]
movdqu xmmword [rbp + 0x340], xmm0
mov byte [rbp + 0x330], sil
mov rdx, qword [rbp + 0x2e8]
cmp rdx, r13
jbe 0x14000f1e3
inc rdx
mov rcx, qword [rbp + 0x2d0]
mov rax, rcx
cmp rdx, r12
jb 0x14000f1dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f1dd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140148f04
nop
movabs rax, 0xff00ff00ff00ff00
xor r15, rax
lea rax, [rbp + 0x388]
mov qword [rax], r15
xor eax, eax
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.140148a70
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, str.KsDumperCheck
lea rcx, [rbp - 0x20]
call fcn.14000595c
mov rdx, rax
mov rcx, r14
call fcn.140086880
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.ProcessHackerCheck
lea rcx, [rbp - 0x20]
call fcn.14000595c
mov rdx, rax
mov rcx, r14
call fcn.140086880
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.Titen_Hide_check_failed
lea rcx, [rbp - 0x20]
call fcn.14000595c
mov rdx, rax
mov rcx, r14
call fcn.140086880
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.Hyper_hide_check_failed
lea rcx, [rbp - 0x20]
call fcn.14000595c
mov rdx, rax
mov rcx, r14
call fcn.140086880
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea r8, [rbp + 0x1a0]
mov edx, eax
lea rcx, str.create_directory
call fcn.140003548
nop
call fcn.140002284
int3
call fcn.140002284
nop
lea r8, [rbp + 0x1a0]
mov edx, eax
lea rcx, str.create_directory
call fcn.140003548
nop
call fcn.140002284
int3
call fcn.140002284
int3