Function at 0x140003e00
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate process modules
Enumerate processes
Hash data using fnv
Move file
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x760
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rbp + 0x700], rax
mov r15, rdx
xor r12d, r12d
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, [rbp + 0x140]
call fcn.140003d30
mov rsi, rax
cmp qword [rax + 0x18], 0x10
jb 0x140003e69
mov rsi, qword [rax]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140003ef6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140003ef6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x3663ab38
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140003ef1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140003ed0
cmp r8d, 0x2be9b084
je 0x140003efb
test r9d, r9d
jne 0x140003eb0
mov rax, qword [rax]
jmp 0x140003e80
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
mov rcx, rsi
call rdx
nop
mov rdx, qword [rbp + 0x158]
cmp rdx, 0x10
jb 0x140003f5c
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f57
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005ac0
movdqa xmm0, xmmword [0x140007730]
movdqu xmmword [rbp + 0x150], xmm0
mov byte [rbp + 0x140], 0
movabs rax, 0x70775a29f596fd13
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs r13, 0xca1092302b431da2
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x70775a2990ee983d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x640], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x648], rax
movdqa xmm0, xmmword [rbp + 0x30]
pxor xmm0, xmmword [rbp + 0x640]
movdqa xmmword [rbp + 0x30], xmm0
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x3c0]
call fcn.140004c70
nop
lea rcx, [rbp + 0x160]
call fcn.140003d30
mov rbx, rax
lea r9, [rbp + 0x3c0]
cmp qword [rbp + 0x3d8], 0x10
cmovae r9, qword [rbp + 0x3c0]
mov r14, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r14
mov rdi, qword [rbp + 0x3d0]
cmp rdi, rax
ja 0x140004057
lea rax, [r14 + rdi]
mov qword [rbx + 0x10], rax
mov rsi, rbx
cmp rcx, 0x10
jb 0x14000403e
mov rsi, qword [rbx]
lea rcx, [rsi + r14]
mov r8, rdi
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + r14]
mov byte [rax + rdi], 0
jmp 0x14000406a
mov qword [rsp + 0x20], rdi
mov rdx, rdi
mov rcx, rbx
call fcn.140005640
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rdx, qword [rbp + 0x10]
mov rcx, qword [r15]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x1400040ec
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400040e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005ac0
movdqa xmm0, xmmword [0x140007730]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x140004141
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000413c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000413c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005ac0
movdqa xmm0, xmmword [0x140007730]
movdqu xmmword [rbp + 0x170], xmm0
mov byte [rbp + 0x160], 0
movabs rsi, 0x7012224cbedceb5e
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs r14, 0x70775a2990ee983d
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x650], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x658], rax
movdqa xmm0, xmmword [rbp + 0x40]
pxor xmm0, xmmword [rbp + 0x650]
movdqa xmmword [rbp + 0x40], xmm0
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x70]
call fcn.140004c70
mov edi, r12d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000424e
mov dword [rbp + 0x3e0], 0x130
lea rdx, [rbp + 0x3e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000424e
cmp dword [rbp + 0x3e8], r12d
jne 0x140004210
lea rdx, [rbp + 0x3e0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
nop
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rdx, qword [rbp + 0x70]
lea rcx, [rbp + 0x40c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140004248
lea rdx, [rbp + 0x3e0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14000424e
jmp 0x140004210
mov edi, dword [rbp + 0x3e8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x140004298
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004293
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004293
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005ac0
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], 0xf
mov byte [rbp + 0x70], 0
mov ecx, edi
call section..text
mov qword [0x14000a728], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x660], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x668], rax
movdqa xmm0, xmmword [rbp + 0x50]
pxor xmm0, xmmword [rbp + 0x660]
movdqa xmmword [rbp + 0x50], xmm0
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x90]
call fcn.140004c70
movabs rax, 0x14592e47f587f45e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0xca1092302b4371ce
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x670], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x678], rax
movdqa xmm0, xmmword [rbp + 0x60]
pxor xmm0, xmmword [rbp + 0x670]
movdqa xmmword [rbp + 0x60], xmm0
mov edi, r12d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140004404
mov dword [rbp + 0x510], 0x130
lea rdx, [rbp + 0x510]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140004404
cmp dword [rbp + 0x518], r12d
jne 0x1400043c0
lea rdx, [rbp + 0x510]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
nop
lea rdx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae rdx, qword [rbp + 0x90]
lea rcx, [rbp + 0x53c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400043fe
lea rdx, [rbp + 0x510]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140004404
jmp 0x1400043c0
mov edi, dword [rbp + 0x518]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, edi
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000449e
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x184]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x180], 0x238
lea rdx, [rbp + 0x180]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x140004495
lea rax, [rbp + 0x1b0]
lea r8, [rbp + 0x60]
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140004476
inc rax
test ecx, ecx
jne 0x140004463
test edx, edx
je 0x14000448c
lea rdx, [rbp + 0x180]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32Next]
jmp 0x140004451
mov rax, qword [rbp + 0x198]
jmp 0x1400044aa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, r12
mov qword [0x14000a720], rax
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0x10
jb 0x1400044f5
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400044f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400044f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005ac0
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], 0xf
mov byte [rbp + 0x90], 0
movabs rsi, 0x16d3430ba285446f
movabs rdi, 0xc8969c8aa57c6bc4
cmp qword [0x14000a728], 0
je 0x140004613
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x1604294cf38ded6e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0xa079fa10522f71d7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x77bb636fc7ee270e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0xc896bcb0c0100faa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x6c0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x6c8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x6d0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x6d8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x6c0]
vmovdqa ymmword [rbp + 0xc0], ymm1
lea rdx, [rbp + 0xc0]
vzeroupper
call fcn.1400052c0
mov rdx, qword [0x14000a728]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
jmp 0x1400046d7
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
movabs rax, 0x4573e4cfc87f97b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0xa173f35a422b3dcd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x16b62f6fcce42c4f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x6e0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x6e8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x6f0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x6f8], rax
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x6e0]
vmovdqa ymmword [rbp + 0xe0], ymm1
lea rdx, [rbp + 0xe0]
vzeroupper
call fcn.1400052c0
lea rdx, [0x140005490]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x14000a718]
je 0x140004797
movabs r14, 0x7fffffffc46535ff
movabs r15, 0x7fffffffffffffff
nop
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14000472e
imul rax, rax, 0x64
jmp 0x140004749
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r14
jge 0x14000475a
add rax, 0x3b9aca00
mov qword [rbp + 8], rax
jmp 0x14000475e
mov qword [rbp + 8], r15
lea rcx, [rbp + 8]
call fcn.1400057d0
call fcn.1400036a0
mov edx, 1
mov rcx, qword [0x14000a718]
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x14000a718]
jne 0x140004710
movabs r14, 0x70775a2990ee983d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x916365bf598f766
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0xa364f35559003dff
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0x79b72d62d5a52301
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0xa9faeeefd3134bb3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0x53ae3d9df74629a8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rdx, 0xe79f9b84bab76716
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x680], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x688], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x690], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x698], rax
movabs rax, 0x53ae3d9dd96807d1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6a0], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x6a8], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x680]
vmovdqa ymmword [rbp + 0x100], ymm1
vmovdqa xmm0, xmmword [rbp + 0x120]
vpxor xmm0, xmm0, xmmword [rbp + 0x6a0]
vmovdqa xmmword [rbp + 0x120], xmm0
lea rdx, [rbp + 0x100]
vzeroupper
call fcn.1400052c0
lea rdx, [0x140005490]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [0x14000a6f8]
test rax, rax
jne 0x1400049a9
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140004986
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140004986
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xa9bab237
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140004981
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140004960
cmp r8d, 0x6e13b6ef
je 0x14000498b
test r9d, r9d
jne 0x140004940
mov rax, qword [rax]
jmp 0x140004910
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov eax, dword [rcx + rax*4]
add rax, r10
mov qword [0x14000a6f8], rax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x140001f00]
xor edx, edx
xor ecx, ecx
call rax
test rax, rax
je 0x140004b90
mov rax, qword [0x14000a6e0]
test rax, rax
jne 0x140004a89
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140004a66
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140004a66
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x939e2af
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140004a61
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140004a40
cmp r8d, 0x9bcf2d17
je 0x140004a6b
test r9d, r9d
jne 0x140004a20
mov rax, qword [rax]
jmp 0x1400049f0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov eax, dword [rcx + rax*4]
add rax, r10
mov qword [0x14000a6e0], rax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x140001620]
xor edx, edx
xor ecx, ecx
call rax
test rax, rax
je 0x140004b90
mov rax, qword [0x14000a6e8]
test rax, rax
jne 0x140004b69
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140004b46
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140004b46
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x9843be28
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140004b41
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140004b20
cmp r8d, 0x41cdb774
je 0x140004b4b
test r9d, r9d
jne 0x140004b00
mov rax, qword [rax]
jmp 0x140004ad0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov eax, dword [rcx + rax*4]
add rax, r10
mov qword [0x14000a6e8], rax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [0x1400038c0]
xor edx, edx
xor ecx, ecx
call rax
test rax, rax
je 0x140004b90
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
jmp 0x140004b96
mov r12d, 1
mov rdx, qword [rbp + 0x3d8]
cmp rdx, 0x10
jb 0x140004bda
inc rdx
mov rcx, qword [rbp + 0x3c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004bd5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004bd5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005ac0
mov eax, r12d
mov rcx, qword [rbp + 0x700]
xor rcx, rsp
call fcn.140005aa0
lea r11, [rsp + 0x760]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret