Function at 0x14000fc60
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Execute command
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x14001b020]
xor rax, rsp
mov qword [rbp + 0x198], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
xor r13d, r13d
mov qword [rbp + 0x68], r13
mov qword [rbp + 0x70], 0xf
mov byte [rbp + 0x58], r13b
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x50], 0xf
mov byte [rbp + 0x38], r13b
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x30], 0xf
mov byte [rbp + 0x18], r13b
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], r13
mov qword [rbp + 0x10], 0xf
mov byte [rbp - 8], r13b
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], r13b
movups xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0x108], r13
mov qword [rbp + 0x110], 0xf
mov byte [rbp + 0xf8], r13b
movups xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe8], r13
mov qword [rbp + 0xf0], 0xf
mov byte [rbp + 0xd8], r13b
movups xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xd0], 0xf
mov byte [rbp + 0xb8], r13b
movups xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xb0], 0xf
mov byte [rbp + 0x98], r13b
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x90], 0xf
mov byte [rbp + 0x78], r13b
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x128], r13
mov qword [rbp + 0x130], 0xf
mov byte [rbp + 0x118], r13b
movups xmmword [rbp + 0x138], xmm0
mov qword [rbp + 0x148], r13
mov qword [rbp + 0x150], 0xf
mov byte [rbp + 0x138], r13b
movups xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], r13
mov qword [rbp + 0x170], 0xf
mov byte [rbp + 0x158], r13b
movups xmmword [rbp + 0x178], xmm0
mov qword [rbp + 0x188], r13
mov qword [rbp + 0x190], 0xf
mov byte [rbp + 0x178], r13b
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 8]
lea r8, [rbp + 0x18]
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x58]
call fcn.140012900
lea rdx, [rbp + 0xf8]
lea rcx, [rsp + 0x30]
call fcn.140014040
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000fe88
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fe83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ffc3
call fcn.140016c5c
lea rdx, [rbp + 0xd8]
lea rcx, [rsp + 0x30]
call fcn.140014470
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000fed6
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fed1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ffc3
call fcn.140016c5c
lea rdx, [rbp + 0x98]
lea rcx, [rsp + 0x30]
call fcn.1400148a0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000ff24
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ff1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ffc3
call fcn.140016c5c
lea rdx, [rbp + 0xb8]
lea rcx, [rsp + 0x30]
call fcn.140014cd0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000ff6e
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ff69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ffc3
call fcn.140016c5c
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x118]
call fcn.1400150a0
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x30]
call fcn.1400154a0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000ffcf
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ffca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ffca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016c5c
mov cl, 0xd
mov byte [rsp + 0x70], cl
mov dword [rbp - 0x60], 0x7f7e747e
mov dword [rbp - 0x5c], 0x79687e68
mov dword [rbp - 0x58], 0x77747523
xor eax, eax
mov byte [rbp - 0x54], al
movsx ebx, cl
mov ecx, ebx
call fcn.14000e900
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x140010017
mov edx, 0x84
xor ecx, ecx
lea r9d, [rdx - 0x80]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp ebx, 0xffffffb7
jg 0x140010033
mov edx, 0x9d
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
imul r11d, ebx, 0x5bd1e995
mov r8d, r13d
lea r9, [rsp + 0x74]
mov r12d, 8
mov r10d, r12d
nop dword [rax + rax]
mov eax, r11d
shr eax, 0x18
xor eax, r11d
imul ecx, eax, 0x5bd1e995
xor ecx, r8d
imul edx, ecx, 0x286a90b9
xor edx, 0xaa2a7357
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9], eax
add r8d, 0x5bd1e995
lea r9, [r9 + 4]
sub r10, 1
jne 0x140010050
mov ebx, 0xc
mov r9d, ebx
lea r8, [rsp + 0x74]
lea rdx, [rbp - 0x60]
call fcn.140016870
mov qword [rbp - 0x68], rax
movsx edi, byte [rsp + 0x70]
mov ecx, edi
call fcn.14000e900
add edi, eax
cmp edi, 0xfffffff0
jg 0x1400100d8
lea edx, [rbx + 0x78]
xor ecx, ecx
lea r9d, [rbx - 8]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp edi, 0xffffffb7
jg 0x1400100f4
mov edx, 0x9d
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
imul r11d, edi, 0x5bd1e995
mov r8d, r13d
lea r9, [rsp + 0x74]
mov r10, r12
nop word [rax + rax]
mov eax, r11d
shr eax, 0x18
xor eax, r11d
imul ecx, eax, 0x5bd1e995
xor ecx, r8d
imul edx, ecx, 0x286a90b9
xor edx, 0xaa2a7357
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9], eax
add r8d, 0x5bd1e995
lea r9, [r9 + 4]
sub r10, 1
jne 0x140010110
mov r9d, dword [0x14001b6e4]
lea r8, [rsp + 0x74]
mov rdx, qword [rbp - 0x68]
call fcn.1400169d0
mov rdx, rax
test rax, rax
jne 0x140010178
mov rdx, r13
jmp 0x14001018f
movzx ecx, byte [rsp + 0x70]
nop dword [rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rbx, 1
jne 0x140010180
mov byte [rdx + 0xc], bl
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov r14, 0xffffffffffffffff
mov r8, r14
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400101b0
lea rcx, [rsp + 0x30]
call fcn.1400161f0
xor r8d, r8d
lea edx, [r8 + 0xf]
lea rcx, [rsp + 0x30]
call fcn.14000fb60
mov cl, 0x7a
mov byte [rsp + 0x70], cl
movdqa xmm0, xmmword [0x140018600]
movdqu xmmword [rbp - 0x60], xmm0
xor eax, eax
mov byte [rbp - 0x50], al
movsx ebx, cl
mov ecx, ebx
call fcn.14000e900
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x140010215
mov edx, 0x84
xor ecx, ecx
lea r9d, [rdx - 0x80]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp ebx, 0xffffffb7
jg 0x140010231
mov edx, 0x9d
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
imul r11d, ebx, 0x5bd1e995
mov r8d, r13d
lea r9, [rsp + 0x74]
mov r10, r12
nop dword [rax]
nop word [rax + rax]
mov eax, r11d
shr eax, 0x18
xor eax, r11d
imul eax, eax, 0x5bd1e995
mov ecx, r8d
xor ecx, eax
imul edx, ecx, 0x286a90b9
xor edx, 0xaa2a7357
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9], eax
add r8d, 0x5bd1e995
lea r9, [r9 + 4]
sub r10, 1
jne 0x140010250
lea r9d, [r10 + 0x10]
lea r8, [rsp + 0x74]
lea rdx, [rbp - 0x60]
call fcn.140016870
mov qword [rbp - 0x68], rax
movsx ebx, byte [rsp + 0x70]
mov ecx, ebx
call fcn.14000e900
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x1400102d8
mov edx, 0x84
xor ecx, ecx
lea r9d, [rdx - 0x80]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp ebx, 0xffffffb7
jg 0x1400102f4
mov edx, 0x9d
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
imul r11d, ebx, 0x5bd1e995
mov r8d, r13d
lea r9, [rsp + 0x74]
mov r10, r12
nop word [rax + rax]
mov eax, r11d
shr eax, 0x18
xor eax, r11d
imul eax, eax, 0x5bd1e995
mov ecx, r8d
xor ecx, eax
imul edx, ecx, 0x286a90b9
xor edx, 0xaa2a7357
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9], eax
add r8d, 0x5bd1e995
lea r9, [r9 + 4]
sub r10, 1
jne 0x140010310
mov r9d, dword [0x14001b6e4]
lea r8, [rsp + 0x74]
mov rdx, qword [rbp - 0x68]
call fcn.1400169d0
mov rdx, rax
test rax, rax
jne 0x14001037a
mov rdx, r13
jmp 0x14001039f
movsx eax, byte [rsp + 0x70]
movd xmm1, eax
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
movdqu xmm0, xmmword [rdx]
xorps xmm1, xmm0
movdqu xmmword [rdx], xmm1
mov byte [rdx + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov r8, r14
inc r8
cmp byte [rdx + r8], 0
jne 0x1400103b4
lea rcx, [rsp + 0x30]
call fcn.1400161f0
xor r8d, r8d
lea edx, [r8 + 7]
lea rcx, [rsp + 0x30]
call fcn.14000fb60
lea rdx, [0x140015fe0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140015fe0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x58]
cmp qword [rbp + 0x70], 0x10
cmovae rcx, qword [rbp + 0x58]
movabs r15, 0x7fffffffffffffff
mov qword [rbp - 0x30], r15
mov r8, qword [rbp + 0x68]
test r8, r8
jne 0x14001043a
lea rdx, [0x140018428]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14001056c
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov r8d, 0xe
lea rdx, str.Diskdrive_0:
lea rcx, [rsp + 0x30]
call fcn.1400161f0
mov r8b, 1
mov edx, 7
lea rcx, [rsp + 0x30]
call fcn.14000fb60
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
lea rsi, [rbp + 0x58]
cmp qword [rbp + 0x70], 0x10
cmovae rsi, qword [rbp + 0x58]
mov rdi, qword [rbp + 0x68]
cmp rdi, r15
ja 0x1400128a4
mov qword [rsp + 0x48], 0xf
cmp rdi, 0x10
jae 0x1400104c3
mov qword [rsp + 0x40], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x30], xmm0
jmp 0x14001055b
mov rbx, rdi
or rbx, 0xf
cmp rbx, r15
jbe 0x1400104fe
mov rbx, r15
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140016c20
mov rcx, rax
test rax, rax
je 0x140010527
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001053d
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14001052e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140012850
jmp 0x1400104e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14001053a
call fcn.140016c20
jmp 0x14001053d
mov rax, r13
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor r8d, r8d
lea edx, [r8 + 0xf]
lea rcx, [rsp + 0x30]
call fcn.14000fb60
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rcx, qword [rbp + 0x38]
mov r8, qword [rbp + 0x48]
test r8, r8
jne 0x140010597
lea rdx, [0x140018428]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400106c9
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov r8d, 0xe
lea rdx, str.Diskdrive_1:
lea rcx, [rsp + 0x30]
call fcn.1400161f0
mov r8b, 1
mov edx, 7
lea rcx, [rsp + 0x30]
call fcn.14000fb60
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
lea rsi, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rsi, qword [rbp + 0x38]
mov rdi, qword [rbp + 0x48]
cmp rdi, r15
ja 0x1400128aa
mov qword [rsp + 0x48], 0xf
cmp rdi, 0x10
jae 0x140010620
mov qword [rsp + 0x40], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x30], xmm0
jmp 0x1400106b8
mov rbx, rdi
or rbx, 0xf
cmp rbx, r15
jbe 0x14001065b
mov rbx, r15
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140016c20
mov rcx, rax
test rax, rax
je 0x140010684
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001069a
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14001068b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140012856
jmp 0x14001063d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140010697
call fcn.140016c20
jmp 0x14001069a
mov rax, r13
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor r8d, r8d
lea edx, [r8 + 0xf]
lea rcx, [rsp + 0x30]
call fcn.14000fb60
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 0x10
cmovae rcx, qword [rbp + 0x18]
mov r8, qword [rbp + 0x28]
test r8, r8
jne 0x1400106f4
lea rdx, [0x140018428]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140010826
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov r8d, 0xd
lea rdx, str.Diskdrive_2:
lea rcx, [rsp + 0x30]
call fcn.1400161f0
mov r8b, 1
mov edx, 7
lea rcx, [rsp + 0x30]
call fcn.14000fb60
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
lea rsi, [rbp + 0x18]
cmp qword [rbp + 0x30], 0x10
cmovae rsi, qword [rbp + 0x18]
mov rdi, qword [rbp + 0x28]
cmp rdi, r15
ja 0x1400128b0
mov qword [rsp + 0x48], 0xf
cmp rdi, 0x10
jae 0x14001077d
mov qword [rsp + 0x40], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x30], xmm0
jmp 0x140010815
mov rbx, rdi
or rbx, 0xf
cmp rbx, r15
jbe 0x1400107b8
mov rbx, r15
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140016c20
mov rcx, rax
test rax, rax
je 0x1400107e1
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400107f7
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400107e8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001285c
jmp 0x14001079a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400107f4
call fcn.140016c20
jmp 0x1400107f7
mov rax, r13
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor r8d, r8d
lea edx, [r8 + 0xf]
lea rcx, [rsp + 0x30]
call fcn.14000fb60
lea rcx, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae rcx, qword [rbp - 8]
mov r8, qword [rbp + 8]
test r8, r8
jne 0x140010851
lea rdx, [0x140018428]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140010983
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov r8d, 0xd
lea rdx, str.Diskdrive_3:
lea rcx, [rsp + 0x30]
call fcn.1400161f0
mov r8b, 1
mov edx, 7
lea rcx, [rsp + 0x30]
call fcn.14000fb60
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
lea rsi, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae rsi, qword [rbp - 8]
mov rdi, qword [rbp + 8]
cmp rdi, r15
ja 0x1400128b6
mov qword [rsp + 0x48], 0xf
cmp rdi, 0x10
jae 0x1400108da
mov qword [rsp + 0x40], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x30], xmm0
jmp 0x140010972
mov rbx, rdi
or rbx, 0xf
cmp rbx, r15
jbe 0x140010915
mov rbx, r15
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140016c20
mov rcx, rax
test rax, rax
je 0x14001093e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140010954
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140010945
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140012862
jmp 0x1400108f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140010951
call fcn.140016c20
jmp 0x140010954
mov rax, r13
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor r8d, r8d
lea edx, [r8 + 0xf]
lea rcx, [rsp + 0x30]
call fcn.14000fb60
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rcx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
test r8, r8
jne 0x1400109ae
lea rdx, [0x140018428]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140010ae0
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov r8d, 0xd
lea rdx, str.Diskdrive_4:
lea rcx, [rsp + 0x30]
call fcn.1400161f0
mov r8b, 1
mov edx, 7
lea rcx, [rsp + 0x30]
call fcn.14000fb60
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
lea rsi, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rsi, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x18]
cmp rdi, r15
ja 0x1400128bc
mov qword [rsp + 0x48], 0xf
cmp rdi, 0x10
jae 0x140010a37
mov qword [rsp + 0x40], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x30], xmm0
jmp 0x140010acf
mov rbx, rdi
or rbx, 0xf
cmp rbx, r15
jbe 0x140010a72
mov rbx, r15
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140016c20
mov rcx, rax
test rax, rax
je 0x140010a9b
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140010ab1
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140010aa2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140012868
jmp 0x140010a54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140010aae
call fcn.140016c20
jmp 0x140010ab1
mov rax, r13
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor r8d, r8d
lea edx, [r8 + 0xf]
lea rcx, [rsp + 0x30]
call fcn.14000fb60
mov cl, 0xc
mov byte [rsp + 0x70], cl
mov dword [rbp - 0x60], 0x44584341
mov dword [rbp - 0x5c], 0x434e5e49
mov dword [rbp - 0x58], 0x36485e4d
mov word [rbp - 0x54], 0x2c2c
xor eax, eax
mov byte [rbp - 0x52], al
movsx ebx, cl
mov ecx, ebx
call fcn.14000e900
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x140010b2e
mov edx, 0x84
xor ecx, ecx
lea r9d, [rdx - 0x80]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp ebx, 0xffffffb7
jg 0x140010b4a
mov edx, 0x9d
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
imul r11d, ebx, 0x5bd1e995
mov r8d, r13d
lea r9, [rsp + 0x74]
mov r10, r12
nop dword [rax]
mov eax, r11d
shr eax, 0x18
xor eax, r11d
imul ecx, eax, 0x5bd1e995
xor ecx, r8d
imul edx, ecx, 0x286a90b9
xor edx, 0xaa2a7357
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9], eax
add r8d, 0x5bd1e995
lea r9, [r9 + 4]
sub r10, 1
jne 0x140010b60
lea r9d, [r10 + 0xe]
lea r8, [rsp + 0x74]
lea rdx, [rbp - 0x60]
call fcn.140016870
mov qword [rbp - 0x68], rax
movsx ebx, byte [rsp + 0x70]
mov ecx, ebx
call fcn.14000e900
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x140010be6
mov edx, 0x84
xor ecx, ecx
lea r9d, [rdx - 0x80]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp ebx, 0xffffffb7
jg 0x140010c02
mov edx, 0x9d
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
imul r11d, ebx, 0x5bd1e995
mov r8d, r13d
lea r9, [rsp + 0x74]
mov r10, r12
nop dword [rax]
nop dword [rax + rax]
mov eax, r11d
shr eax, 0x18
xor eax, r11d
imul ecx, eax, 0x5bd1e995
xor ecx, r8d
imul edx, ecx, 0x286a90b9
xor edx, 0xaa2a7357
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9], eax
add r8d, 0x5bd1e995
lea r9, [r9 + 4]
sub r10, 1
jne 0x140010c20
mov r9d, dword [0x14001b6e4]
lea r8, [rsp + 0x74]
mov rdx, qword [rbp - 0x68]
call fcn.1400169d0
mov rdx, rax
test rax, rax
jne 0x140010c88
mov rdx, r13
jmp 0x140010ca3
mov ecx, 0xe
movzx r8d, byte [rsp + 0x70]
xor byte [rax], r8b
lea rax, [rax + 1]
sub rcx, 1
jne 0x140010c93
mov byte [rdx + 0xe], cl
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov r8, r14
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140010cc0
lea rcx, [rsp + 0x30]
call fcn.1400161f0
mov r8b, 1
mov edx, 7
lea rcx, [rsp + 0x30]
call fcn.14000fb60
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
lea rsi, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 0x10
cmovae rsi, qword [rbp + 0xd8]
mov rdi, qword [rbp + 0xe8]
cmp rdi, r15
ja 0x1400128c2
mov qword [rsp + 0x48], 0xf
cmp rdi, 0x10
jae 0x140010d40
mov qword [rsp + 0x40], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x30], xmm0
jmp 0x140010dd8
mov rbx, rdi
or rbx, 0xf
cmp rbx, r15
jbe 0x140010d7b
mov rbx, r15
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140016c20
mov rcx, rax
test rax, rax
je 0x140010da4
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140010dba
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140010dab
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001286e
jmp 0x140010d5d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140010db7
call fcn.140016c20
jmp 0x140010dba
mov rax, r13
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor r8d, r8d
lea edx, [r8 + 0xf]
lea rcx, [rsp + 0x30]
call fcn.14000fb60
mov cl, 0x15
mov byte [rsp + 0x70], cl
mov dword [rbp - 0x60], 0x5c575846
mov dword [rbp - 0x5c], 0x4035465a
mov dword [rbp - 0x58], 0x2f515c40
mov word [rbp - 0x54], 0x3535
xor eax, eax
mov byte [rbp - 0x52], al
movsx ebx, cl
mov ecx, ebx
call fcn.14000e900
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x140010e37
mov edx, 0x84
xor ecx, ecx
lea r9d, [rdx - 0x80]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp ebx, 0xffffffb7
jg 0x140010e53
mov edx, 0x9d
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
imul r11d, ebx, 0x5bd1e995
mov r8d, r13d
lea r9, [rsp + 0x74]
mov r10, r12
nop word [rax + rax]
mov eax, r11d
shr eax, 0x18
xor eax, r11d
imul eax, eax, 0x5bd1e995
mov ecx, r8d
xor ecx, eax
imul edx, ecx, 0x286a90b9
xor edx, 0xaa2a7357
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9], eax
add r8d, 0x5bd1e995
lea r9, [r9 + 4]
sub r10, 1
jne 0x140010e70
lea r9d, [r10 + 0xe]
lea r8, [rsp + 0x74]
lea rdx, [rbp - 0x60]
call fcn.140016870
mov qword [rbp - 0x68], rax
movsx ebx, byte [rsp + 0x70]
mov ecx, ebx
call fcn.14000e900
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x140010ef8
mov edx, 0x84
xor ecx, ecx
lea r9d, [rdx - 0x80]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp ebx, 0xffffffb7
jg 0x140010f14
mov edx, 0x9d
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
imul r11d, ebx, 0x5bd1e995
mov r8d, r13d
lea r9, [rsp + 0x74]
mov r10, r12
nop word [rax + rax]
mov eax, r11d
shr eax, 0x18
xor eax, r11d
imul eax, eax, 0x5bd1e995
mov ecx, r8d
xor ecx, eax
imul edx, ecx, 0x286a90b9
xor edx, 0xaa2a7357
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9], eax
add r8d, 0x5bd1e995
lea r9, [r9 + 4]
sub r10, 1
jne 0x140010f30
mov r9d, dword [0x14001b6e4]
lea r8, [rsp + 0x74]
mov rdx, qword [rbp - 0x68]
call fcn.1400169d0
mov rdx, rax
test rax, rax
jne 0x140010f9a
mov rdx, r13
jmp 0x140010fc0
mov ecx, 0xe
movzx r8d, byte [rsp + 0x70]
nop word [rax + rax]
xor byte [rax], r8b
lea rax, [rax + 1]
sub rcx, 1
jne 0x140010fb0
mov byte [rdx + 0xe], cl
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov r8, r14
inc r8
cmp byte [rdx + r8], 0
jne 0x140010fd5
lea rcx, [rsp + 0x30]
call fcn.1400161f0
mov r8b, 1
mov edx, 7
lea rcx, [rsp + 0x30]
call fcn.14000fb60
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
lea rsi, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 0x10
cmovae rsi, qword [rbp + 0xb8]
mov rdi, qword [rbp + 0xc8]
cmp rdi, r15
ja 0x1400128c8
mov qword [rsp + 0x48], 0xf
cmp rdi, 0x10
jae 0x140011055
mov qword [rsp + 0x40], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x30], xmm0
jmp 0x1400110ed
mov rbx, rdi
or rbx, 0xf
cmp rbx, r15
jbe 0x140011090
mov rbx, r15
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140016c20
mov rcx, rax
test rax, rax
je 0x1400110b9
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400110cf
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400110c0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140012874
jmp 0x140011072
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400110cc
call fcn.140016c20
jmp 0x1400110cf
mov rax, r13
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor r8d, r8d
lea edx, [r8 + 0xf]
lea rcx, [rsp + 0x30]
call fcn.14000fb60
mov cl, 0x33
mov byte [rsp + 0x70], cl
mov dword [rbp - 0x60], 0x607c7a71
mov dword [rbp - 0x5c], 0x13131309
mov dword [rbp - 0x58], 0x13131313
mov word [rbp - 0x54], 0x1313
xor eax, eax
mov byte [rbp - 0x52], al
movsx ebx, cl
mov ecx, ebx
call fcn.14000e900
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x14001114c
mov edx, 0x84
xor ecx, ecx
lea r9d, [rdx - 0x80]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp ebx, 0xffffffb7
jg 0x140011168
mov edx, 0x9d
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
imul r11d, ebx, 0x5bd1e995
mov r8d, r13d
lea r9, [rsp + 0x74]
mov r10, r12
nop word [rax + rax]
mov eax, r11d
shr eax, 0x18
xor eax, r11d
imul eax, eax, 0x5bd1e995
mov ecx, r8d
xor ecx, eax
imul edx, ecx, 0x286a90b9
xor edx, 0xaa2a7357
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9], eax
add r8d, 0x5bd1e995
lea r9, [r9 + 4]
sub r10, 1
jne 0x140011180
lea r9d, [r10 + 0xe]
lea r8, [rsp + 0x74]
lea rdx, [rbp - 0x60]
call fcn.140016870
mov qword [rbp - 0x68], rax
movsx ebx, byte [rsp + 0x70]
mov ecx, ebx
call fcn.14000e900
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x140011208
mov edx, 0x84
xor ecx, ecx
lea r9d, [rdx - 0x80]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp ebx, 0xffffffb7
jg 0x140011224
mov edx, 0x9d
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
imul r11d, ebx, 0x5bd1e995
mov r8d, r13d
lea r9, [rsp + 0x74]
mov r10, r12
nop word [rax + rax]
mov eax, r11d
shr eax, 0x18
xor eax, r11d
imul eax, eax, 0x5bd1e995
mov ecx, r8d
xor ecx, eax
imul edx, ecx, 0x286a90b9
xor edx, 0xaa2a7357
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9], eax
add r8d, 0x5bd1e995
lea r9, [r9 + 4]
sub r10, 1
jne 0x140011240
mov r9d, dword [0x14001b6e4]
lea r8, [rsp + 0x74]
mov rdx, qword [rbp - 0x68]
call fcn.1400169d0
mov rdx, rax
test rax, rax
jne 0x1400112aa
mov rdx, r13
jmp 0x1400112d0
mov ecx, 0xe
movzx r8d, byte [rsp + 0x70]
nop word [rax + rax]
xor byte [rax], r8b
lea rax, [rax + 1]
sub rcx, 1
jne 0x1400112c0
mov byte [rdx + 0xe], cl
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov r8, r14
inc r8
cmp byte [rdx + r8], 0
jne 0x1400112e5
lea rcx, [rsp + 0x30]
call fcn.1400161f0
mov r8b, 1
mov edx, 7
lea rcx, [rsp + 0x30]
call fcn.14000fb60
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
lea rsi, [rbp + 0x98]
cmp qword [rbp + 0xb0], 0x10
cmovae rsi, qword [rbp + 0x98]
mov rdi, qword [rbp + 0xa8]
cmp rdi, r15
ja 0x1400128ce
mov qword [rsp + 0x48], 0xf
cmp rdi, 0x10
jae 0x140011365
mov qword [rsp + 0x40], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x30], xmm0
jmp 0x1400113fd
mov rbx, rdi
or rbx, 0xf
cmp rbx, r15
jbe 0x1400113a0
mov rbx, r15
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140016c20
mov rcx, rax
test rax, rax
je 0x1400113c9
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400113df
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400113d0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001287a
jmp 0x140011382
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400113dc
call fcn.140016c20
jmp 0x1400113df
mov rax, r13
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor r8d, r8d
lea edx, [r8 + 0xf]
lea rcx, [rsp + 0x30]
call fcn.14000fb60
mov cl, 0x46
mov byte [rsp + 0x70], cl
mov dword [rbp - 0x60], 0x7c131605
mov dword [rbp - 0x5c], 0x66666666
mov dword [rbp - 0x58], 0x66666666
mov word [rbp - 0x54], 0x6666
xor eax, eax
mov byte [rbp - 0x52], al
movsx ebx, cl
mov ecx, ebx
call fcn.14000e900
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x14001145c
mov edx, 0x84
xor ecx, ecx
lea r9d, [rdx - 0x80]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp ebx, 0xffffffb7
jg 0x140011478
mov edx, 0x9d
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
imul r11d, ebx, 0x5bd1e995
mov r8d, r13d
lea r9, [rsp + 0x74]
mov r10, r12
nop word [rax + rax]
mov eax, r11d
shr eax, 0x18
xor eax, r11d
imul eax, eax, 0x5bd1e995
mov ecx, r8d
xor ecx, eax
imul edx, ecx, 0x286a90b9
xor edx, 0xaa2a7357
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9], eax
add r8d, 0x5bd1e995
lea r9, [r9 + 4]
sub r10, 1
jne 0x140011490
lea r9d, [r10 + 0xe]
lea r8, [rsp + 0x74]
lea rdx, [rbp - 0x60]
call fcn.140016870
mov qword [rbp - 0x68], rax
movsx ebx, byte [rsp + 0x70]
mov ecx, ebx
call fcn.14000e900
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x140011518
mov edx, 0x84
xor ecx, ecx
lea r9d, [rdx - 0x80]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp ebx, 0xffffffb7
jg 0x140011534
mov edx, 0x9d
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
imul r11d, ebx, 0x5bd1e995
mov r8d, r13d
lea r9, [rsp + 0x74]
mov r10, r12
nop word [rax + rax]
mov eax, r11d
shr eax, 0x18
xor eax, r11d
imul ecx, eax, 0x5bd1e995
xor ecx, r8d
imul edx, ecx, 0x286a90b9
xor edx, 0xaa2a7357
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9], eax
add r8d, 0x5bd1e995
lea r9, [r9 + 4]
sub r10, 1
jne 0x140011550
mov r9d, dword [0x14001b6e4]
lea r8, [rsp + 0x74]
mov rdx, qword [rbp - 0x68]
call fcn.1400169d0
mov rdx, rax
test rax, rax
jne 0x1400115b8
mov rdx, r13
jmp 0x1400115d3
mov ecx, 0xe
movzx r8d, byte [rsp + 0x70]
xor byte [rax], r8b
lea rax, [rax + 1]
sub rcx, 1
jne 0x1400115c3
mov byte [rdx + 0xe], cl
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov r8, r14
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400115f0
lea rcx, [rsp + 0x30]
call fcn.1400161f0
mov r8b, 1
mov edx, 7
lea rcx, [rsp + 0x30]
call fcn.14000fb60
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
lea rsi, [rbp + 0xf8]
cmp qword [rbp + 0x110], 0x10
cmovae rsi, qword [rbp + 0xf8]
mov rdi, qword [rbp + 0x108]
cmp rdi, r15
ja 0x1400128d4
mov qword [rsp + 0x48], 0xf
cmp rdi, 0x10
jae 0x140011670
mov qword [rsp + 0x40], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x30], xmm0
jmp 0x140011708
mov rbx, rdi
or rbx, 0xf
cmp rbx, r15
jbe 0x1400116ab
mov rbx, r15
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140016c20
mov rcx, rax
test rax, rax
je 0x1400116d4
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400116ea
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400116db
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140012880
jmp 0x14001168d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400116e7
call fcn.140016c20
jmp 0x1400116ea
mov rax, r13
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor r8d, r8d
lea edx, [r8 + 0xf]
lea rcx, [rsp + 0x30]
call fcn.14000fb60
mov cl, 0x44
mov byte [rsp + 0x70], cl
mov dword [rbp - 0x60], 0x7e111403
mov dword [rbp - 0x5c], 0x64646464
mov dword [rbp - 0x58], 0x64646464
mov word [rbp - 0x54], 0x6464
xor eax, eax
mov byte [rbp - 0x52], al
movsx ebx, cl
mov ecx, ebx
call fcn.14000e900
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x140011767
mov edx, 0x84
xor ecx, ecx
lea r9d, [rdx - 0x80]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp ebx, 0xffffffb7
jg 0x140011783
mov edx, 0x9d
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
imul r11d, ebx, 0x5bd1e995
mov r8d, r13d
lea r9, [rsp + 0x74]
mov r10, r12
nop word [rax + rax]
mov eax, r11d
shr eax, 0x18
xor eax, r11d
imul ecx, eax, 0x5bd1e995
xor ecx, r8d
imul edx, ecx, 0x286a90b9
xor edx, 0xaa2a7357
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9], eax
add r8d, 0x5bd1e995
lea r9, [r9 + 4]
sub r10, 1
jne 0x1400117a0
lea r9d, [r10 + 0xe]
lea r8, [rsp + 0x74]
lea rdx, [rbp - 0x60]
call fcn.140016870
mov qword [rbp - 0x68], rax
movsx ebx, byte [rsp + 0x70]
mov ecx, ebx
call fcn.14000e900
add ebx, eax
cmp ebx, 0xfffffff0
jg 0x140011826
mov edx, 0x84
xor ecx, ecx
lea r9d, [rdx - 0x80]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp ebx, 0xffffffb7
jg 0x140011842
mov edx, 0x9d
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
imul r11d, ebx, 0x5bd1e995
mov r8d, r13d
lea r9, [rsp + 0x74]
mov r10, r12
nop dword [rax]
nop dword [rax + rax]
mov eax, r11d
shr eax, 0x18
xor eax, r11d
imul eax, eax, 0x5bd1e995
mov ecx, r8d
xor ecx, eax
imul edx, ecx, 0x286a90b9
xor edx, 0xaa2a7357
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov dword [r9], eax
add r8d, 0x5bd1e995
lea r9, [r9 + 4]
sub r10, 1
jne 0x140011860
mov r9d, dword [0x14001b6e4]
lea r8, [rsp + 0x74]
mov rdx, qword [rbp - 0x68]
call fcn.1400169d0
mov rdx, rax
test rax, rax
jne 0x1400118ca
mov rdx, r13
jmp 0x1400118f0
mov ecx, 0xe
movzx r8d, byte [rsp + 0x70]
nop word [rax + rax]
xor byte [rax], r8b
lea rax, [rax + 1]
sub rcx, 1
jne 0x1400118e0
mov byte [rdx + 0xe], cl
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
inc r14
cmp byte [rdx + r14], 0
jne 0x140011902
mov r8, r14
lea rcx, [rsp + 0x30]
call fcn.1400161f0
mov r8b, 1
mov edx, 7
lea rcx, [rsp + 0x30]
call fcn.14000fb60
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
lea rsi, [rbp + 0x78]
cmp qword [rbp + 0x90], 0x10
cmovae rsi, qword [rbp + 0x78]
mov rdi, qword [rbp + 0x88]
cmp rdi, r15
ja 0x1400128da
mov qword [rsp + 0x48], 0xf
cmp rdi, 0x10
jae 0x14001197f
mov qword [rsp + 0x40], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x30], xmm0
jmp 0x140011a17
mov rbx, rdi
or rbx, 0xf
cmp rbx, r15
jbe 0x1400119ba
mov rbx, r15
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140016c20
mov rcx, rax
test rax, rax
je 0x1400119e3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400119f9
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400119ea
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140012886
jmp 0x14001199c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400119f6
call fcn.140016c20
jmp 0x1400119f9
mov rax, r13
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor r8d, r8d
lea edx, [r8 + 0xf]
lea rcx, [rsp + 0x30]
call fcn.14000fb60
lea rcx, [rbp + 0x118]
mov rbx, qword [rbp + 0x118]
mov r14, qword [rbp + 0x130]
cmp r14, 0x10
cmovae rcx, rbx
mov rdi, qword [rbp + 0x128]
test rdi, rdi
jne 0x140011a68
mov r8, rdi
lea rdx, [0x140018428]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140011b97
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov r8d, 0xe
lea rdx, str.MAC_0:
lea rcx, [rsp + 0x30]
call fcn.1400161f0
mov r8b, 1
mov edx, 7
lea rcx, [rsp + 0x30]
call fcn.14000fb60
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
lea rsi, [rbp + 0x118]
cmp r14, 0x10
cmovae rsi, rbx
cmp rdi, r15
ja 0x1400128e0
mov qword [rsp + 0x48], 0xf
cmp rdi, 0x10
jae 0x140011aee
mov qword [rsp + 0x40], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x30], xmm0
jmp 0x140011b86
mov rbx, rdi
or rbx, 0xf
cmp rbx, r15
jbe 0x140011b29
mov rbx, r15
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140016c20
mov rcx, rax
test rax, rax
je 0x140011b52
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140011b68
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140011b59
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001288c
jmp 0x140011b0b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140011b65
call fcn.140016c20
jmp 0x140011b68
mov rax, r13
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor r8d, r8d
lea edx, [r8 + 0xf]
lea rcx, [rsp + 0x30]
call fcn.14000fb60
lea rcx, [rbp + 0x138]
mov r12, qword [rbp + 0x138]
mov rbx, qword [rbp + 0x150]
cmp rbx, 0x10
cmovae rcx, r12
mov rdi, qword [rbp + 0x148]
test rdi, rdi
jne 0x140011bd7
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.1400011a0
int3
call fcn.1400011a0
int3
call fcn.1400011a0
int3
call fcn.1400011a0
int3
call fcn.1400011a0
int3
call fcn.1400011a0
int3
call fcn.1400011a0
int3
call fcn.1400011a0
int3
call fcn.1400011a0
int3
call fcn.1400011a0
int3
call fcn.1400011a0
int3