Function at 0x14004d160
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
xor ebx, ebx
movdqa xmm0, xmmword [0x1400fa630]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x1005f41
mov ecx, ebx
nop dword [rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x12
jb 0x14004d190
mov byte [rbp - 0x3d], bl
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x3e]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004d203
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d1fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d1fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
je 0x14004d21d
call fcn.1400491c0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14004e092
movdqa xmm0, xmmword [0x1400fa650]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x1005f41
mov rcx, rbx
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x12
jb 0x14004d240
mov byte [rbp - 0x3d], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x3e]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004d2b4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d2af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d2af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004d208
movdqa xmm0, xmmword [0x1400fa380]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x5e425c
mov byte [rbp - 0x3c], 1
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x13
jb 0x14004d2e0
mov byte [rbp - 0x3c], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x3d]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004d354
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d34f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d34f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004d208
movdqa xmm0, xmmword [0x1400fa690]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x445e144e
mov word [rbp - 0x3c], 0x58
mov byte [rbp - 0x3a], 1
mov rcx, rbx
nop
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x15
jb 0x14004d380
mov byte [rbp - 0x3a], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x3b]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004d3f4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d3ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d3ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004e092
movdqa xmm0, xmmword [0x1400fa5a0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x40], 0x5c
mov byte [rbp - 0x3e], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x11
jb 0x14004d420
mov byte [rbp - 0x3e], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x3f]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004d494
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d48f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d48f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004e092
mov dword [rbp - 0x50], 0x4f445859
mov dword [rbp - 0x4c], 0x1e414140
mov dword [rbp - 0x48], 0x564a54
mov byte [rbp - 0x44], 1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xb
jb 0x14004d4c0
mov byte [rbp - 0x44], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x45]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004d534
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d52f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d52f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004e08d
movdqa xmm0, xmmword [0x1400fa600]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x40], Ordinal_79
mov byte [rbp - 0x3e], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x11
jb 0x14004d560
mov byte [rbp - 0x3e], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x3f]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004d5d4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d5cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d5cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004d208
mov dword [rbp - 0x50], 0x5d4a4e40
mov dword [rbp - 0x4c], 0x55574b03
mov word [rbp - 0x48], 0x100
mov rcx, rbx
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 8
jb 0x14004d600
mov byte [rbp - 0x47], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004d674
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d66f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d66f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004d208
mov dword [rbp - 0x50], 0x5d4a4e40
mov dword [rbp - 0x4c], 0x55011a1b
mov dword [rbp - 0x48], 0x1005749
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xa
jb 0x14004d6a0
mov byte [rbp - 0x45], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x46]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004d714
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d70f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d70f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004d208
mov dword [rbp - 0x50], 0xc6a6e60
mov dword [rbp - 0x4c], 0x301165b
mov dword [rbp - 0x48], 0x514b571f
mov word [rbp - 0x44], 0x100
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xc
jb 0x14004d740
mov byte [rbp - 0x43], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x44]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004d7b4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d7af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d7af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004d208
mov dword [rbp - 0x50], 0x4959437e
mov dword [rbp - 0x4c], 0x424e465e
mov dword [rbp - 0x48], 0x4c561c5a
mov word [rbp - 0x44], 0x50
mov byte [rbp - 0x42], 1
mov rcx, rbx
nop
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xd
jb 0x14004d7e0
mov byte [rbp - 0x42], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x43]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004d854
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d84f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d84f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004e08d
mov dword [rbp - 0x50], 0x484f436f
mov dword [rbp - 0x4c], 0x1e5d4b41
mov dword [rbp - 0x48], 0x564a54
mov byte [rbp - 0x44], 1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xb
jb 0x14004d880
mov byte [rbp - 0x44], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x45]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004d8f4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d8ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d8ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004e08d
mov dword [rbp - 0x50], 0x43454f71
mov dword [rbp - 0x4c], 0x1e1b185e
mov dword [rbp - 0x48], 0x564a54
mov byte [rbp - 0x44], 1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xb
jb 0x14004d920
mov byte [rbp - 0x44], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x45]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004d994
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d98f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d98f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004e08d
movdqa xmm0, xmmword [0x1400fa670]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x40], 0x100
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x10
jb 0x14004d9c0
mov byte [rbp - 0x3f], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004da34
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004da2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004da2f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004e08d
movdqa xmm0, xmmword [0x1400fa610]
movdqu xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x1400fa7f0]
movdqu xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x30], 0x25296a7b
mov dword [rbp - 0x2c], 0x35616739
mov dword [rbp - 0x28], 0x1003729
mov rcx, rbx
nop
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x2a
jb 0x14004da70
mov byte [rbp - 0x25], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x26]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004dae4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004dadf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004dadf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004e08d
mov dword [rbp - 0x50], 0x596f5962
mov dword [rbp - 0x4c], 0x424a5e40
mov dword [rbp - 0x48], 0x514b571f
mov word [rbp - 0x44], 0x100
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xc
jb 0x14004db10
mov byte [rbp - 0x43], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x44]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004db84
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004db7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004db7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004e08d
mov dword [rbp - 0x50], 0x481f1c51
mov dword [rbp - 0x4c], 0x5501494f
mov dword [rbp - 0x48], 0x1005749
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xa
jb 0x14004dbb0
mov byte [rbp - 0x45], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x46]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004dc24
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004dc1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004dc1f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004e08d
mov dword [rbp - 0x50], 0x491f1c51
mov dword [rbp - 0x4c], 0x1e4e5d5e
mov dword [rbp - 0x48], 0x564a54
mov byte [rbp - 0x44], 1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xb
jb 0x14004dc50
mov byte [rbp - 0x44], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x45]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004dcc4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004dcbf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004dcbf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004e08d
mov dword [rbp - 0x50], 0x494f456a
mov dword [rbp - 0x4c], 0x47405c6f
mov dword [rbp - 0x48], 0x1a415742
mov dword [rbp - 0x44], 0x1004e50
mov rcx, rbx
nop dword [rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xe
jb 0x14004dcf0
mov byte [rbp - 0x41], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x42]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004dd64
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004dd5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004dd5f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004e08d
movdqa xmm0, xmmword [0x1400fa2f0]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x40], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xf
jb 0x14004dd90
mov byte [rbp - 0x40], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x41]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004de04
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ddff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004ddff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004e08d
mov dword [rbp - 0x50], 0x4d5d4b43
mov dword [rbp - 0x4c], 0x484a005a
mov word [rbp - 0x48], 0x54
mov byte [rbp - 0x46], 1
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 9
jb 0x14004de30
mov byte [rbp - 0x46], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x47]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004dea4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004de9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004de9f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004e08d
mov dword [rbp - 0x50], 0x59494f6d
mov dword [rbp - 0x4c], 0x424a494a
mov dword [rbp - 0x48], 0x514b571f
mov word [rbp - 0x44], 0x100
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xc
jb 0x14004ded0
mov byte [rbp - 0x43], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x44]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004df44
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004df3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004df3f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004e08d
mov dword [rbp - 0x50], 0x59494f4d
mov dword [rbp - 0x4c], 0x424a494a
mov dword [rbp - 0x48], 0x514b571f
mov word [rbp - 0x44], 0x100
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx + 0x29]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xc
jb 0x14004df70
mov byte [rbp - 0x43], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x44]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004dfe4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004dfdf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004dfdf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rdi, rdi
jne 0x14004e08d
mov dword [rbp - 0x50], 0x5f4a4e40
mov dword [rbp - 0x4c], 0x484a0040
mov word [rbp - 0x48], 0x54
mov byte [rbp - 0x46], 1
nop word [rax + rax]
lea eax, [rbx + 0x29]
xor byte [rbp + rbx - 0x50], al
inc rbx
cmp rbx, 9
jb 0x14004e010
mov byte [rbp - 0x46], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x47]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14005a3a0
nop
lea rcx, [rbp - 0x20]
call fcn.1400497c0
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14004e084
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e07f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004e07f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d317c
test rbx, rbx
je 0x14004e170
call fcn.1400491c0
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.RtlAdjustPrivilege
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtRaiseHardError
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x10]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea rcx, [0x1400f7080]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.RtlAdjustPrivilege
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtRaiseHardError
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x10]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call rbx
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002b4
call rdi
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret