Function at 0x140058ae0
Capabilities:
Access peb ldr_data
Check mutex on windows
Encode data using xor
Generate random numbers using a mersenne twister
Log keystrokes via polling
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x250
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400b8100]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor r15d, r15d
mov ebx, 4
mov rax, qword gs:[0x58]
add rbx, qword [rax]
lea r14, [0x1400bb100]
mov eax, dword [rbx]
cmp dword [0x1400bafe0], eax
jle 0x140058bb7
lea rcx, [0x1400bafe0]
call fcn.14005c96c
cmp dword [0x1400bafe0], 0xffffffff
jne 0x140058bb7
xor ecx, ecx
call fcn.14006eba0
mov rdx, rax
mov dword [0x1400bc484], 0xffffffff
mov dword [0x1400bb104], eax
mov r8d, 1
nop dword [rax]
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, r8d
mov dword [r14 + r8*4 + 4], edx
inc r8
cmp r8, 0x270
jb 0x140058b80
mov dword [0x1400bb100], 0x270
lea rcx, [0x1400bafe0]
call fcn.14005c900
mov eax, dword [rbx]
cmp dword [0x1400bc488], eax
jle 0x140058bf4
lea rcx, [0x1400bc488]
call fcn.14005c96c
cmp dword [0x1400bc488], 0xffffffff
jne 0x140058bf4
mov qword [0x1400bafd0], r15
mov qword [0x1400bafd8], 0x3d
lea rcx, [0x1400bc488]
call fcn.14005c900
mov rdi, r15
lea r13, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
lea r12, [0x1400bb0f0]
nop word [rax + rax]
mov qword [rbp + 0xa0], r14
mov rsi, qword [0x1400bafd0]
mov rdx, qword [0x1400bafd8]
sub rdx, rsi
cmp rdx, 0xffffffffffffffff
jne 0x140058c4b
mov rcx, r14
call fcn.14005adc0
mov ebx, eax
shl rbx, 0x20
mov rcx, r14
call fcn.14005adc0
mov eax, eax
or rbx, rax
jmp 0x140058c5d
inc rdx
lea rcx, [rbp + 0xa0]
call fcn.14005abd0
mov rbx, rax
lea rax, [rbx + rsi]
movzx eax, byte [rax + r13]
mov byte [rdi + r12], al
inc rdi
cmp rdi, 0xf
jb 0x140058c10
mov byte [0x1400bb0ff], r15b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
movabs rax, 0xa4e27e8935c3e654
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x140], rax
movabs rax, 0xc3102b884eafc0ac
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x148], rax
movabs rax, 0xefb57f7ae316e560
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x150], rax
movabs r12, 0x4a18a1336100eb46
mov qword [rbp + 0xa0], r12
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x158], rax
movabs r13, 0xdebe12e857ac8a13
mov qword [rbp + 0xa0], r13
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x160], rax
movabs rax, 0x9c7559e939dcb9c4
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x168], rax
movabs rax, 0xefb57f028662900d
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0xa0], r12
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x178], rax
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x140], ymm1
lea r8, [rbp + 0x140]
xor edx, edx
xor ecx, ecx
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x1400baed8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
movabs rbx, 0xfaff3ed099979cf2
movabs rdi, 0xbf758a5de8cad085
cmp eax, 0xb7
jne 0x1400591ed
movabs rax, 0xbf758a2f87b8a2c0
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 8], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x148], rax
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp], xmm0
movabs rax, 0xcc1caa389aafb8d1
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x20], rax
movabs rax, 0x839b5fb5ebfbfdd2
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x28], rax
movabs rax, 0xaa19ef5ef4cdfea7
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x30], rax
movabs rax, 0xd160017a9d02fa0d
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x38], rax
movabs rax, 0x82b6ae59b1c524fd
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x40], rax
movabs rax, 0x36a3bf491a0cc487
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x48], rax
movabs rax, 0x365e8a3a9c2179e5
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x50], rax
movabs rax, 0xedd068f7fe985aaf
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x58], rax
movabs rax, 0xaa04ffbbc8048ff9
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x60], rax
movabs rax, 0x998ea7e7a00894f2
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x68], rax
movabs rax, 0x6dce65fc4421c4ef
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x70], rax
movabs rax, 0xd4cce9965e809c6d
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x78], rax
movabs rax, 0x14c00bb084ad41a8
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x80], rax
movabs r8, 0x3cdb1d743e4ad7ae
mov qword [rbp + 0xa0], r8
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x88], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x160], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x168], rax
movabs r14, 0xde6a8137d4a39f87
mov qword [rbp + 0xa0], r14
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x170], rax
movabs rsi, 0xf1066e5af861946c
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x178], rax
movabs rcx, 0xe7decd79c2ac4c89
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x180], rax
movabs rdx, 0x5fcdd13c682cb0e6
mov qword [rbp + 0xa0], rdx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x188], rax
movabs rax, 0x4f7eec53bc0d1e8b
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x190], rax
movabs rax, 0xcda4069689b82fc0
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x198], rax
movabs rax, 0xde249bd5ad24e08d
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x1a0], rax
movabs rax, 0xb5ebc988807cf59a
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x2bee168f2153b4cf
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x1b0], rax
movabs rax, 0xa6b8c9f230e1bc54
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x1b8], rax
movabs rax, 0x14ae62d1e3cc61d1
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0xa0], r8
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x1c8], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x180]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqa xmm2, xmmword [rbp + 0x80]
vxorps xmm2, xmm2, xmmword [rbp + 0x1c0]
vmovdqa xmmword [rbp + 0x80], xmm2
xor r9d, r9d
lea rdx, [rbp + 0x20]
lea r8, [rbp]
xor ecx, ecx
vzeroupper
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.14005c8e0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movabs rax, 0xbf298a73e896d0d9
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x160], rax
movabs rax, 0xfa913ea299f29cb9
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x168], rax
movabs rax, 0xde188173d4cf9fe2
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x170], rax
movabs rax, 0xf1746e3ff8179405
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x178], rax
movabs rcx, 0xe7decd79c2ac4c89
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x180], rax
movabs rdx, 0x5fcdd13c682cb0e6
mov qword [rbp + 0xa0], rdx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x188], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x108], rax
movabs r14, 0xde6a8137d4a39f87
mov qword [rbp + 0xa0], r14
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x110], rax
movabs rsi, 0xf1066e5af861946c
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x118], rax
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0xa0], rdx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x128], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x160], ymm1
vmovdqa xmm0, xmmword [rbp + 0x180]
vxorps xmm0, xmm0, xmmword [rbp + 0x120]
vmovdqa xmmword [rbp + 0x180], xmm0
lea rcx, [rbp + 0x160]
vzeroupper
call fcn.14005a4d0
test al, al
je 0x1400591b8
movabs rax, 0xbf5b8a6fe8b9d0e6
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp], rax
movabs rax, 0xfaff3eb599ef9c97
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 8], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x148], rax
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp], xmm0
lea rcx, [rbp]
call fcn.14005a2d0
mov dword [0x1400baed0], eax
movabs rcx, 0xfed97c8123c5eb64
movabs rdx, 0xb2472a8a19aed6a2
test eax, eax
jne 0x140059687
movabs r8, 0xefb57f028c07e868
nop dword [rax + rax]
cmp byte [0x1400baeb2], r15b
jne 0x14005952e
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x160], rax
mov qword [rbp + 0xa0], rdx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x168], rax
mov qword [rbp + 0xa0], r8
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0xa0], r12
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x178], rax
mov qword [rbp + 0xa0], r13
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x100], rax
movabs rax, 0x9c7559e939dcb9c4
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x108], rax
movabs rax, 0xefb57f028662900d
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0xa0], r12
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm0, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x160], ymm0
lea rdx, [rbp + 0x160]
lea rcx, [0x1400b9570]
vzeroupper
call fcn.140050f90
mov byte [0x1400baeb2], 1
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140059d58
movabs rax, 0xde9012da57df8a70
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp], rax
movabs rax, 0x9c75598c39a4b9a1
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 8], rax
mov qword [rbp + 0xa0], r13
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x140], rax
movabs rax, 0x9c7559e939dcb9c4
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x148], rax
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp], xmm0
lea rcx, [rbp]
call fcn.14005a2d0
mov dword [0x1400baed0], eax
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x1400baed0], r15d
movabs rcx, 0xfed97c8123c5eb64
movabs rdx, 0xb2472a8a19aed6a2
movabs r8, 0xefb57f028c07e868
je 0x140059430
movabs rax, 0xcc16aa3986bfbfe3
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp], rax
movabs rax, 0xfaff34b5e1f2b2c0
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 8], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x148], rax
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp], xmm0
lea rdx, [rbp]
lea rcx, [0x1400b9570]
call fcn.140050f90
movabs rax, 0xbf108a34e8a6d0e6
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x160], rax
movabs rax, 0xfa9b3efe99e39c9c
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x168], rax
movabs rax, 0xde6a8137d4cf9feb
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x178], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x108], rax
mov qword [rbp + 0xa0], r14
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqu ymmword [rbp + 0x160], ymm1
lea rdx, [rbp + 0x160]
mov ecx, dword [0x1400baed0]
vzeroupper
call fcn.14005a3d0
mov qword [0x1400baef0], rax
test rax, rax
jne 0x140059b9e
movabs rdx, 0x83951076a607e868
movabs rcx, 0x70d4f3e5956fe948
movabs r8, 0x2f71cd5041648a29
movabs r9, 0xe20e7208344bf989
movabs r10, 0xe2041e6450658de7
nop dword [rax]
cmp byte [0x1400baeb1], r15b
jne 0x14005993e
movabs rax, 0xfed97c8123c5eb64
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x160], rax
movabs rax, 0xb2472a8a19aed6a2
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x168], rax
mov qword [rbp + 0xa0], rdx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0xa0], r8
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x178], rax
mov qword [rbp + 0xa0], r9
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x180], rax
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x188], rax
mov qword [rbp + 0xa0], r13
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x100], rax
movabs rax, 0x9c7559e939dcb9c4
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x108], rax
movabs rax, 0xefb57f028662900d
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0xa0], r12
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x118], rax
mov qword [rbp + 0xa0], r10
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x128], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x160], ymm1
vmovdqa xmm2, xmmword [rbp + 0x180]
vxorps xmm2, xmm2, xmmword [rbp + 0x120]
vmovdqa xmmword [rbp + 0x180], xmm2
lea rdx, [rbp + 0x160]
lea rcx, [0x1400b9570]
vzeroupper
call fcn.140050f90
mov byte [0x1400baeb1], 1
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140059d58
movabs rax, 0xdedb128157c08a70
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x160], rax
movabs rax, 0x9c1159c739a8b9aa
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x168], rax
movabs rax, 0xefb57f02860e9061
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0xa0], r12
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x178], rax
mov qword [rbp + 0xa0], r13
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x100], rax
movabs rax, 0x9c7559e939dcb9c4
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x108], rax
movabs rax, 0xefb57f028662900d
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0xa0], r12
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqu ymmword [rbp + 0x160], ymm1
lea rdx, [rbp + 0x160]
mov ecx, dword [0x1400baed0]
vzeroupper
call fcn.14005a3d0
mov qword [0x1400baef0], rax
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x1400baef0], r15
movabs rcx, 0x70d4f3e5956fe948
movabs rdx, 0x83951076a607e868
movabs r8, 0x2f71cd5041648a29
movabs r9, 0xe20e7208344bf989
movabs r10, 0xe2041e6450658de7
je 0x1400597c0
movabs rax, 0xd316aa3986bfbfe3
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x160], rax
movabs rax, 0x96935afeedf9f99b
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x168], rax
movabs rax, 0xde6a8137d4a39f8d
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x178], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x108], rax
mov qword [rbp + 0xa0], r14
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x160], ymm1
lea rdx, [rbp + 0x160]
lea rcx, [0x1400b9570]
vzeroupper
call fcn.140050f90
mov eax, dword [0x1400baed0]
mov qword [rbp + 0x100], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x28
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
lea r8, [rbp + 0x100]
mov edx, 0x221a58
mov rcx, qword [0x1400baee8]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140059e61
call fcn.14005ab40
movabs rax, 0xbf758a2f87b8a2e0
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 8], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x148], rax
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp], xmm0
movabs rax, 0xcb55ee3884a3b1c3
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x160], rax
movabs rax, 0x929c5fa4edf6bc9d
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x168], rax
movabs rax, 0xbd05f347f4cceba7
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x170], rax
movabs rax, 0xf1066e5af812e709
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x178], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x108], rax
mov qword [rbp + 0xa0], r14
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x160], ymm1
mov r9d, 0x40000
lea rdx, [rbp + 0x160]
jmp 0x1400591a9
movabs rax, 0xd602f97d84a6b9ee
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x160], rax
movabs rax, 0x899a4ca0b9ffff86
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x168], rax
movabs rax, 0xde6a8137dec7faf4
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x178], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x108], rax
mov qword [rbp + 0xa0], r14
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x160], ymm1
lea rdx, [rbp + 0x160]
lea rcx, [0x1400b9570]
vzeroupper
call fcn.140050f90
call fcn.14005ab40
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400591b8
mov ecx, 8
call fcn.14005cef8
lea rcx, [0x140010340]
mov qword [rax], rcx
mov qword [rbp + 0xa0], rax
lea rcx, [rbp + 0xe8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x14005a2a0]
xor edx, edx
xor ecx, ecx
call fcn.14006e8c8
mov qword [rbp + 0xe0], rax
test rax, rax
je 0x14005a205
mov qword [rbp + 0xa0], r15
mov ecx, 8
call fcn.14005cef8
lea rcx, [0x14000f970]
mov qword [rax], rcx
mov qword [rbp + 0xa0], rax
lea rcx, [rbp + 0xd8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x14005a2a0]
xor edx, edx
xor ecx, ecx
call fcn.14006e8c8
mov qword [rbp + 0xd0], rax
test rax, rax
je 0x14005a1f3
mov qword [rbp + 0xa0], r15
mov ecx, 8
call fcn.14005cef8
lea rcx, [0x14004c800]
mov qword [rax], rcx
mov qword [rbp + 0xa0], rax
lea rcx, [rbp + 0xc8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x14005a2a0]
xor edx, edx
xor ecx, ecx
call fcn.14006e8c8
mov qword [rbp + 0xc0], rax
test rax, rax
je 0x14005a262
mov qword [rbp + 0xa0], r15
mov ecx, 8
call fcn.14005cef8
lea rcx, [0x14004b220]
mov qword [rax], rcx
mov qword [rbp + 0xa0], rax
lea rcx, [rbp + 0xb8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x14005a2a0]
xor edx, edx
xor ecx, ecx
call fcn.14006e8c8
mov qword [rbp + 0xb0], rax
test rax, rax
je 0x14005a250
mov qword [rbp + 0xa0], r15
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14005a075
movabs rsi, 0xbf5b8a6fe8b9d0e6
movabs r14, 0xfaff3eb599ef9c97
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp], rax
mov qword [rbp + 0xa0], r14
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 8], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x148], rax
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp], xmm0
lea rcx, [rbp]
call fcn.14005a2d0
test eax, eax
je 0x14005a075
cmp byte [0x1400baeb4], 0
jne 0x14005a075
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140059fe1
mov byte [0x1400baeb7], 1
mov byte [0x1400baeb6], 1
mov byte [0x1400baeb5], 1
mov byte [0x1400b8d60], 0
cmp dword [rbp + 0xe8], 0
je 0x14005a245
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp + 0xe8], eax
je 0x14005a23a
movaps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rbp + 0x140], xmm0
xor edx, edx
lea rcx, [rbp + 0x140]
call fcn.14005c1bc
test eax, eax
jne 0x14005a22f
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xe0], xmm0
cmp dword [rbp + 0xd8], eax
je 0x14005a245
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp + 0xd8], eax
je 0x14005a23a
movaps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0x140], xmm0
xor edx, edx
lea rcx, [rbp + 0x140]
call fcn.14005c1bc
test eax, eax
jne 0x14005a22f
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xd0], xmm0
cmp dword [rbp + 0xc8], eax
je 0x14005a245
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp + 0xc8], eax
je 0x14005a23a
movaps xmm0, xmmword [rbp + 0xc0]
movdqa xmmword [rbp + 0x140], xmm0
xor edx, edx
lea rcx, [rbp + 0x140]
call fcn.14005c1bc
test eax, eax
jne 0x14005a22f
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xc0], xmm0
cmp dword [rbp + 0xb8], eax
je 0x14005a245
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rbp + 0xb8], eax
je 0x14005a23a
movaps xmm0, xmmword [rbp + 0xb0]
movdqa xmmword [rbp + 0x140], xmm0
xor edx, edx
lea rcx, [rbp + 0x140]
call fcn.14005c1bc
test eax, eax
jne 0x14005a22f
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xb0], xmm0
call fcn.14005ab40
nop
cmp dword [rbp + 0xb8], 0
jne 0x14005a217
cmp dword [rbp + 0xc8], 0
jne 0x14005a21d
cmp dword [rbp + 0xd8], 0
jne 0x14005a223
cmp dword [rbp + 0xe8], 0
jne 0x14005a229
xor eax, eax
jmp 0x1400591bd
mov dword [rbp + 0xd8], r15d
mov ecx, 6
call fcn.14005c078
nop
mov dword [rbp + 0xe8], r15d
mov ecx, 6
call fcn.14005c078
nop
call fcn.14006e9b4
nop
call fcn.14006e9b4
nop
call fcn.14006e9b4
nop
call fcn.14006e9b4
nop
mov ecx, 2
call fcn.14005c078
int3
mov ecx, 5
call fcn.14005c078
int3
mov ecx, 1
call fcn.14005c078
nop
mov dword [rbp + 0xb8], r15d
mov ecx, 6
call fcn.14005c078
nop
mov dword [rbp + 0xc8], r15d
mov ecx, 6
call fcn.14005c078
int3