Function at 0x1400047c0
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x350
mov rax, qword [0x14002e180]
xor rax, rsp
mov qword [rsp + 0x340], rax
xor esi, esi
xorps xmm0, xmm0
movups xmmword [r11 - 0x68], xmm0
movups xmmword [r11 - 0x58], xmm0
lea ecx, [rsi + 0x10]
call fcn.14000e940
mov r13, rax
mov qword [rsp + 0x318], rax
mov qword [rsp + 0x310], 0x10
test rax, rax
je 0x14000482f
movups xmm0, xmmword [str.a__8__rDIy_0Uq]
movups xmmword [rax], xmm0
mov qword [rsp + 0x308], 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x2e0], xmm0
movups xmmword [rsp + 0x2f0], xmm0
mov ecx, 0x10
call fcn.14000e940
mov r12, rax
mov qword [rsp + 0x2f8], rax
mov qword [rsp + 0x2f0], 0x10
test rax, rax
je 0x14000487e
movups xmm0, xmmword [str._g_QE_YOnpg3B]
movups xmmword [rax], xmm0
mov qword [rsp + 0x2e8], 0xffffffffffffffff
mov qword [rsp + 0x320], rsi
mov qword [rsp + 0x330], rsi
mov qword [rsp + 0x338], 0xf
mov byte [rsp + 0x320], 0
mov qword [rsp + 0x108], rsi
mov qword [rsp + 0x118], rsi
mov qword [rsp + 0x120], 0xf
mov ecx, 0x6d0
call fcn.14001e3f0
mov rdi, rax
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x118], 0x6c0
mov qword [rsp + 0x120], 0x6cf
mov rcx, rax
lea rdx, str.csMdjuI8WrR_7amlLj6DcD4McVtUtiIILq6AKAI638EskktdLHB6lkvytK7Jj5jOQ6eKU0NM974wRc4EIhWQlyf6fGldIpoEbauYhhFbbNcuter1_mm1fXLK1LMbZbDEbWcfD77sKr49IN1Qbqz06UKUkfC1eeyuOGDW9Okcwh93WozQYwv6Pwpt3OHr_n2qB43kRKkKbV8l_3YKiUednbl_UhkZ1vZZ_xSQVbXXPFWvcbQ7ID9ZxqJDKHDb3l5vkT5LpC4yFS__I0EobuEaBOTn6EXijoNFy5dBZ7hpA9YPlgkaZA1NucaGbZLYLRbgUayEiCKbInmlTR7QU5necbs0AGRv5maWt973BxWvTcN65GP7XPx0T106nPvmiI0zYHFyBpcyoWiJv_1HZELNHFLlFD4v5VzxSrXdCWYUH8bt8V0d9cP3LT3FtopcekSz2RITVqZVFHv3nYOCbsUX7bbJx3o5q_8n987D3cUnYtCJ7RcG7GFiVHIbmXZe0ZjQ_LdGPvJAg96QsyBEFLmpF6SPUO_DaN04bWQFZeOb5hIGz7ovHNrgPM5MsNAaMGr9yWL6E0dbZIxsW5JoLQwLzB7iicvp5pLA6uGhKU8w9UCpdz7gM7rvEXv9lLQUq9tbNZnA_0P67UvNJ7k6jbDnl7dAN2gD0ZadUqbh7zF7nJ3FqBFh3Gbl2xTL7DkRgpVXWmPgFKJPANw88CCGEQoeRiERHa9Lv8rMiLnaPiZRtVWJK3sn9OEUdiTWlBXMjAbhDqrLRoBHQIwoFfLhBkPOsKPgwaQmzkfN7zrVzZBjwwULuWeHIuMbEA9tiprT02k7kWCgxPtrEkrtZf7igqIwXxBszALvXQkTVnRnWEb3wrK5ezDOr9MbpiuN7WEDsX1QrdHfkPcZCANuw0lU6XYUMknreRGogaacayePCL0zQOp70n_yKbgM362ceUYFOp2ONhhJ4JqVNSuq09XQOnfF2cbbv_KeGdUiPJD2FdbKOJbBSPSmr2fnWmg9oYBugGUb0jaa1Q7vvesg3xMl2JKb4tNJn2zlFZ46YG1mxt0PbJ1GPkbT2_AdgI0WSWIGVh4qOjc0uG9Lz5Dz_TQBmXJDvTjfAWAvTyoTuuUMpulbtDvApUWAkxBG_wdS2T7eDtiyku6FZKt3rsFguEkgH7TbAwDx7Jaqe_GqXmha3zprfdPxzGwcIFuReRNZAv8ZLcqJQeFUwLq95aedOQJgCCzMP_djKMgnzOc5JCtatal3KIWvZ9dzL2J6NzU3YkO3w6f5JPVNda5I__RfRx1slhjy7QfSDJzUoWbhoBSxMdHtI5Lx8cExCkm3ZD0cYnxXXQgmdPjOtG7uxYJ82fpjSmEv6wuPbJ1bgFoxRYeraU2Otg8x3zNO13Oalwe0rQ2FalUqfJYdpYrLMlSSPn53xztbhBMe7KCSI_BTsFlK3bX7etaFnAePM0BeszXyIew5cgtaMXmEZMIvaWpvutEVSvE0S3yWDZD6TVejCodCupZPfbiv9vdhlCJYxHRHwRBWLCUkS_AhYslQpoP9HwuvtO4wRV8FVjydLX8r_YTZayIIOTi5B9UxUHwcP4SwbwEsbm4I_GOufMIy3pdFxXkbdyFl_WyjZ_fmoVhPxLRox6l_DMIawCDy5OANFbpb5XrYaIz2dc6HtcYfdHeShSEcItupQfWIKHQLzSE_ChG_R6ZBEORB
mov r8d, 0x6c0
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + 0x6c0], 0
mov qword [rsp + 0x128], rsi
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x140], 0xf
mov byte [rsp + 0x128], 0
mov ecx, 0x68
call fcn.14001e3f0
mov rbx, rax
mov qword [rsp + 0x100], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
mov qword [rbx + 0x60], rax
lea ecx, [rax + 0x20]
call fcn.14001e3f0
mov rdi, rax
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
xor edx, edx
mov rcx, rax
call fcn.140008b80
lea rax, vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.0
mov qword [rdi], rax
lea rax, vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.1.0
mov qword [rdi + 8], rax
lea rax, [rsp + 0x128]
mov qword [rdi + 0x18], rax
call fcn.1400191a0
mov rdx, rax
mov r9, rdi
mov r8d, 6
mov rcx, rbx
call fcn.140003b70
lea rax, vtable.CryptoPP::Base64Decoder.1.0
mov qword [rbx], rax
lea rax, vtable.CryptoPP::Base64Decoder.0
mov qword [rbx + 8], rax
mov r9, rbx
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0x270]
call fcn.140003930
lea r14, vtable.CryptoPP::SourceTemplate_class_CryptoPP::StringStore_.0
mov qword [rsp + 0x270], r14
lea r15, vtable.CryptoPP::SourceTemplate_class_CryptoPP::StringStore_.1.0
mov qword [rsp + 0x278], r15
mov rcx, qword [rsp + 0x288]
test rcx, rcx
je 0x140004a2c
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xf8], 0xf
mov byte [rsp + 0xe0], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x270], xmm0
movups xmmword [rsp + 0x280], xmm0
movups xmmword [rsp + 0x290], xmm0
movups xmmword [rsp + 0x2a0], xmm0
movups xmmword [rsp + 0x2b0], xmm0
movups xmmword [rsp + 0x2c0], xmm0
mov dl, 1
lea rcx, [rsp + 0x278]
call fcn.140008b80
movabs rax, 0x3fffffffffffffff
mov qword [rsp + 0x298], rax
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x2a8], rsi
mov qword [rsp + 0x2b8], 0xffffffffffffffff
mov qword [rsp + 0x2c0], rsi
mov qword [rsp + 0x2c8], rsi
lea rax, vtable.CryptoPP::BlockCipherFinal_1__class_CryptoPP::Rijndael::Dec_.1.0
mov qword [rsp + 0x270], rax
lea rax, vtable.CryptoPP::BlockCipherFinal_1__class_CryptoPP::Rijndael::Dec_.0
mov qword [rsp + 0x278], rax
mov r9, qword [section..data]
mov r8d, 0x10
mov rdx, r13
lea rcx, [rsp + 0x270]
call fcn.14000a0e0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1f0], xmm0
movups xmmword [rsp + 0x200], xmm0
movups xmmword [rsp + 0x210], xmm0
movups xmmword [rsp + 0x220], xmm0
movups xmmword [rsp + 0x230], xmm0
movups xmmword [rsp + 0x240], xmm0
movups xmmword [rsp + 0x250], xmm0
mov qword [rsp + 0x260], rax
mov dl, 1
lea rcx, [rsp + 0x1f8]
call fcn.140008b80
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x210], 0xffffffffffffffff
mov qword [rsp + 0x218], rsi
mov qword [rsp + 0x220], rsi
mov qword [rsp + 0x230], 0xffffffffffffffff
mov qword [rsp + 0x238], rsi
mov qword [rsp + 0x240], rsi
mov qword [rsp + 0x250], 0xffffffffffffffff
mov qword [rsp + 0x258], rsi
mov qword [rsp + 0x260], rsi
lea rax, vtable.CryptoPP::CipherModeFinalTemplate_ExternalCipher_class_CryptoPP::CBC_Decryption_.0
mov qword [rsp + 0x1f0], rax
lea rax, vtable.CryptoPP::CipherModeFinalTemplate_ExternalCipher_class_CryptoPP::CBC_Decryption_.1.0
mov qword [rsp + 0x1f8], rax
mov rdx, r12
lea rcx, [rsp + 0x1f0]
call fcn.14000a3b0
lea rax, [rsp + 0x270]
mov qword [rsp + 0x200], rax
lea rcx, [rsp + 0x1f0]
mov rax, qword [rsp + 0x1f0]
call qword [rax + 0x80]
mov rax, qword [rsp + 0x1f0]
xor edx, edx
lea rcx, [rsp + 0x1f0]
call qword [rax + 0x78]
lea rcx, [rsp + 0x1f0]
mov rax, qword [rsp + 0x1f0]
call qword [rax + 0x38]
cmp eax, 4
jge 0x140004c5a
mov rax, qword [rsp + 0x1f0]
mov r8d, 0xffffffff
mov rdx, r12
lea rcx, [rsp + 0x1f0]
call qword [rax + 0x58]
nop
mov ecx, 0xe0
call fcn.14001e3f0
mov rbx, rax
mov qword [rsp + 0x100], rax
xor edx, edx
mov r8d, 0xe0
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x20
call fcn.14001e3f0
mov rdi, rax
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
xor edx, edx
mov rcx, rax
call fcn.140008b80
lea rax, vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.0
mov qword [rdi], rax
lea rax, vtable.CryptoPP::StringSinkTemplate_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___.1.0
mov qword [rdi + 8], rax
lea rax, [rsp + 0xe0]
mov qword [rdi + 0x18], rax
mov r9d, 5
mov r8, rdi
lea rdx, [rsp + 0x1f8]
mov rcx, rbx
call fcn.14000ae70
nop
mov r9, rax
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x70]
call fcn.140003930
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r15
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140004d17
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
mov rcx, qword [rsp + 0x258]
cmp qword [rsp + 0x250], rcx
cmovb rcx, qword [rsp + 0x250]
mov rdx, qword [rsp + 0x260]
test rdx, rdx
je 0x140004d4d
mov rdi, rdx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rdx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
mov rcx, qword [rsp + 0x238]
cmp qword [rsp + 0x230], rcx
cmovb rcx, qword [rsp + 0x230]
mov rdx, qword [rsp + 0x240]
test rdx, rdx
je 0x140004d83
mov rdi, rdx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rdx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
mov rcx, qword [rsp + 0x218]
cmp qword [rsp + 0x210], rcx
cmovb rcx, qword [rsp + 0x210]
mov rdx, qword [rsp + 0x220]
test rdx, rdx
je 0x140004db9
mov rdi, rdx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rdx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
mov rcx, qword [rsp + 0x2c0]
cmp qword [rsp + 0x2b8], rcx
cmovb rcx, qword [rsp + 0x2b8]
mov rdx, qword [rsp + 0x2c8]
test rdx, rdx
je 0x140004def
mov rdi, rdx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rdx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
mov rcx, qword [rsp + 0x2a0]
cmp qword [rsp + 0x298], rcx
cmovb rcx, qword [rsp + 0x298]
mov rdx, qword [rsp + 0x2a8]
test rdx, rdx
je 0x140004e25
mov rdi, rdx
xor eax, eax
rep stosd dword [rdi], eax
mov rcx, rdx
call fcn.14000e930
nop
mov qword [rsp + 0x1c0], rsi
mov qword [rsp + 0x1d0], rsi
mov qword [rsp + 0x1d8], rsi
mov rbx, qword [rsp + 0xf0]
lea r14, [rsp + 0xe0]
cmp qword [rsp + 0xf8], 0x10
cmovae r14, qword [rsp + 0xe0]
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x140005c13
mov qword [rsp + 0x1d8], 0xf
cmp rbx, 0x10
jae 0x140004e9d
mov qword [rsp + 0x1d0], rbx
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x1c0], xmm0
jmp 0x140004f4b
mov rax, rbx
or rax, 0xf
mov qword [rsp + 0x100], rax
cmp rax, rdi
jbe 0x140004ee1
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14001e3f0
mov rcx, rax
test rax, rax
je 0x140005927
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140004f23
mov ecx, 0x16
mov qword [rsp + 0x100], rcx
mov rdi, rax
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140004f14
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005c19
jmp 0x140004ebf
test rcx, rcx
je 0x140004f20
call fcn.14001e3f0
jmp 0x140004f23
mov rax, rsi
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0x1d0], rbx
mov qword [rsp + 0x1d8], rdi
lea r8, [rbx + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
lea r9, [0x14002590c]
lea r8, str.5Zh4iAdRE_
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x1a0]
call fcn.140004600
nop
lea r9, [0x14002591c]
lea r8, str.e7Vs9ks
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x180]
call fcn.140004600
nop
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x48]
call fcn.1400017e0
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x148]
call fcn.140001a20
nop
lea r14, [rsp + 0x148]
cmp qword [rsp + 0x160], 0x10
cmovae r14, qword [rsp + 0x148]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x168], xmm1
mov rbx, rsi
mov qword [rsp + 0x178], rbx
mov r15d, esi
mov rdi, qword [rsp + 0x170]
cmp qword [rsp + 0x158], r15
jbe 0x140005056
nop
movzx eax, byte [r14]
xor al, 8
mov byte [rsp + 0x30], al
cmp rdi, rbx
je 0x14000501e
mov byte [rdi], al
inc rdi
mov qword [rsp + 0x170], rdi
jmp 0x140005043
lea r8, [rsp + 0x30]
mov rdx, rdi
lea rcx, [rsp + 0x168]
call fcn.140007ec0
mov rbx, qword [rsp + 0x178]
mov rdi, qword [rsp + 0x170]
inc r15d
inc r14
movsxd rax, r15d
cmp rax, qword [rsp + 0x158]
jb 0x140005000
mov dword [0x1400311d8], 1
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], 0x10
lea rax, [0x140031208]
mov qword [rsp + 0x58], rax
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [0x140031200], rax
lea r9, [rsp + 0x48]
mov rdx, rax
mov cl, 1
call fcn.140004280
test al, al
jne 0x140005397
mov rcx, qword [rsp + 0x168]
test rcx, rcx
je 0x1400050e2
sub rbx, rcx
mov rax, rcx
cmp rbx, 0x1000
jb 0x1400050d9
add rbx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400057b4
mov rdx, rbx
call fcn.14001e42c
nop
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x140005125
inc rdx
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005120
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005801
call fcn.14001e42c
mov qword [rsp + 0x158], rsi
mov qword [rsp + 0x160], 0xf
mov byte [rsp + 0x148], 0
mov rdx, qword [rsp + 0x198]
cmp rdx, 0x10
jb 0x140005184
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000517f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005863
call fcn.14001e42c
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x198], 0xf
mov byte [rsp + 0x180], 0
mov rdx, qword [rsp + 0x1b8]
cmp rdx, 0x10
jb 0x1400051e3
inc rdx
mov rcx, qword [rsp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400051de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400058c5
call fcn.14001e42c
mov qword [rsp + 0x1b0], rsi
mov qword [rsp + 0x1b8], 0xf
mov byte [rsp + 0x1a0], 0
mov rdx, qword [rsp + 0x1d8]
cmp rdx, 0x10
jb 0x140005243
inc rdx
mov rcx, qword [rsp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000523d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005927
call fcn.14001e42c
nop
mov rdx, qword [rsp + 0xf8]
cmp rdx, 0x10
jb 0x140005286
inc rdx
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005281
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005aaa
call fcn.14001e42c
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xf8], 0xf
mov byte [rsp + 0xe0], 0
mov rdx, qword [rsp + 0x140]
cmp rdx, 0x10
jb 0x1400052e5
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400052e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005b0e
call fcn.14001e42c
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x140], 0xf
mov byte [rsp + 0x128], 0
mov rdx, qword [rsp + 0x120]
cmp rdx, 0x10
jb 0x140005344
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000533f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005b70
call fcn.14001e42c
mov qword [rsp + 0x118], rsi
mov qword [rsp + 0x120], 0xf
mov byte [rsp + 0x108], 0
test r12, r12
je 0x14000537a
mov rdi, r12
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, r12
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
test r13, r13
je 0x140005bdc
mov rdi, r13
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, r13
jmp 0x140005bd6
mov eax, dword [0x1400311d8]
test eax, eax
jne 0x1400053a3
jmp 0x1400053a1
cmp eax, 2
jne 0x1400053b8
lea rdx, [0x1400045a0]
lea ecx, [rax - 1]
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov r15, rsi
mov rax, rdi
mov r14, qword [rsp + 0x168]
sub rax, r14
mov qword [rsp + 0x38], rax
inc rax
mov qword [rsp + 0x100], rax
mov r9d, 4
mov r8d, 0x1000
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000577c
mov r8, qword [rsp + 0x38]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x1e0]
mov r8d, 0x20
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000577c
cmp r14, rdi
cmovne rdi, r14
mov qword [rsp + 0x170], rdi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x40]
lea r8, [0x1400045f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r15, rax
test rax, rax
je 0x14000577c
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r14, r14
je 0x1400054c3
sub rbx, r14
mov rax, r14
cmp rbx, 0x1000
jb 0x1400054b7
add rbx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400057b4
mov rdx, rbx
mov rcx, r14
call fcn.14001e42c
nop
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x140005506
inc rdx
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005501
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005801
call fcn.14001e42c
mov qword [rsp + 0x158], rsi
mov qword [rsp + 0x160], 0xf
mov byte [rsp + 0x148], 0
mov rdx, qword [rsp + 0x198]
cmp rdx, 0x10
jb 0x140005565
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005560
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005863
call fcn.14001e42c
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x198], 0xf
mov byte [rsp + 0x180], 0
mov rdx, qword [rsp + 0x1b8]
cmp rdx, 0x10
jb 0x1400055c4
inc rdx
mov rcx, qword [rsp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400055bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400058c5
call fcn.14001e42c
mov qword [rsp + 0x1b0], rsi
mov qword [rsp + 0x1b8], 0xf
mov byte [rsp + 0x1a0], 0
mov rdx, qword [rsp + 0x1d8]
cmp rdx, 0x10
jb 0x140005624
inc rdx
mov rcx, qword [rsp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000561e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005927
call fcn.14001e42c
nop
mov rdx, qword [rsp + 0xf8]
cmp rdx, 0x10
jb 0x140005667
inc rdx
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005662
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005aaa
call fcn.14001e42c
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xf8], 0xf
mov byte [rsp + 0xe0], 0
mov rdx, qword [rsp + 0x140]
cmp rdx, 0x10
jb 0x1400056c6
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400056c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005b0e
call fcn.14001e42c
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x140], 0xf
mov byte [rsp + 0x128], 0
mov rdx, qword [rsp + 0x120]
cmp rdx, 0x10
jb 0x140005725
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005720
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005b70
call fcn.14001e42c
mov qword [rsp + 0x118], rsi
mov qword [rsp + 0x120], 0xf
mov byte [rsp + 0x108], 0
test r12, r12
je 0x14000575b
mov rdi, r12
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, r12
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
test r13, r13
je 0x140005775
mov rdi, r13
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, r13
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
xor eax, eax
jmp 0x140005be1
test r15, r15
je 0x14000578b
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r14, r14
je 0x1400057c7
sub rbx, r14
mov rax, r14
cmp rbx, 0x1000
jb 0x1400057bb
add rbx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400057bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rbx
mov rcx, r14
call fcn.14001e42c
nop
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x14000580d
inc rdx
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005808
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005808
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e42c
mov qword [rsp + 0x158], rsi
mov qword [rsp + 0x160], 0xf
mov byte [rsp + 0x148], 0
mov rdx, qword [rsp + 0x198]
cmp rdx, 0x10
jb 0x14000586f
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000586a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000586a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e42c
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x198], 0xf
mov byte [rsp + 0x180], 0
mov rdx, qword [rsp + 0x1b8]
cmp rdx, 0x10
jb 0x1400058d1
inc rdx
mov rcx, qword [rsp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400058cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400058cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e42c
mov qword [rsp + 0x1b0], rsi
mov qword [rsp + 0x1b8], 0xf
mov byte [rsp + 0x1a0], 0
mov rdx, qword [rsp + 0x1d8]
cmp rdx, 0x10
jb 0x140005934
inc rdx
mov rcx, qword [rsp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000592e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000592e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e42c
nop
mov rdx, qword [rsp + 0xf8]
cmp rdx, 0x10
jb 0x140005977
inc rdx
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005972
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005aaa
call fcn.14001e42c
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xf8], 0xf
mov byte [rsp + 0xe0], 0
mov rdx, qword [rsp + 0x140]
cmp rdx, 0x10
jb 0x1400059d6
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005b0e
call fcn.14001e42c
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x140], 0xf
mov byte [rsp + 0x128], 0
mov rdx, qword [rsp + 0x120]
cmp rdx, 0x10
jb 0x140005a35
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005b70
call fcn.14001e42c
mov qword [rsp + 0x118], rsi
mov qword [rsp + 0x120], 0xf
mov byte [rsp + 0x108], 0
test r12, r12
je 0x140005a6b
mov rdi, r12
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, r12
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
jmp 0x14000537a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
mov eax, 1
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.14001e3d0
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.1400014b0
nop
call fcn.140001410
int3