Function at 0x14000cb70
Capabilities:
Authenticate hmac
Create process on windows
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x108]
sub rsp, 0x1d0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
mov rax, qword [0x140052040]
xor rax, rsp
mov qword [rbp + 0x88], rax
mov rdi, rcx
mov qword [rbp - 8], rcx
mov dword [rbp + 0x10], 0
movsd xmm0, qword [rcx + 8]
movsd qword [rbp + 0x50], xmm0
mov rsi, qword [0x1400b2bb0]
add rsi, 0x1ed0
xorps xmm0, xmm0
cvtss2sd xmm0, xmm1
mulsd xmm0, qword [0x140047f38]
cvtpd2ps xmm0, xmm0
movss xmm1, dword [0x1400b2d6c]
addss xmm1, xmm0
movss dword [0x1400b2d6c], xmm1
xorps xmm9, xmm9
movss xmm6, dword [0x140047f6c]
comiss xmm1, xmm6
jbe 0x14000cc1b
mov dword [0x1400b2d6c], 0
lea rcx, [rbp + 0x78]
call fcn.1400029a0
xor ebx, ebx
movss xmm7, dword [0x140047f04]
nop
movd xmm0, ebx
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm7
subss xmm0, dword [0x1400b2d6c]
comiss xmm9, xmm0
jbe 0x14000cc4d
addss xmm0, xmm6
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 8]
movaps xmm2, xmm6
movaps xmm1, xmm6
call fcn.140018c50
movss dword [rsp + 0x20], xmm6
movss xmm3, dword [rbp + 0x10]
movss xmm2, dword [rbp]
movss xmm1, dword [rbp + 8]
lea rcx, [rbp + 0x40]
call fcn.140002a00
movups xmm0, xmmword [rbp + 0x40]
movups xmmword [rbp + 0x78], xmm0
inc ebx
cmp ebx, 0xa
jl 0x14000cc30
movaps xmm0, xmmword [0x140048250]
movups xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0x40]
call fcn.140018ba0
mov qword [rbp + 0x10], 0
movss xmm0, dword [0x140047f7c]
movss dword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0xf
movss dword [rsp + 0x20], xmm9
mov r9d, eax
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x10]
mov rcx, rsi
call fcn.140033e30
mov qword [rbp + 0x58], rsi
mov edx, 0x48
lea rcx, [0x1400b2c58]
call fcn.140013160
mov rcx, rax
call fcn.140022b50
mov dword [rsp + 0x20], 0xff
mov edx, 0xff
mov r9d, edx
mov r8d, edx
lea rcx, [rbp + 0x18]
call fcn.1400029b0
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x40], xmm0
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
movss xmm0, dword [rbp + 0x50]
movss dword [rsp + 0x20], xmm0
movss xmm8, dword [0x140047fbc]
movaps xmm3, xmm8
lea r8, str.diablo
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x58]
call fcn.14000e640
call fcn.140022bf0
mov edx, 0x20
lea rcx, [0x1400b2c68]
call fcn.140013220
mov rcx, rax
call fcn.140022b50
mov dword [rsp + 0x20], 0xff
mov edx, 0xa8
mov r9d, edx
mov r8d, edx
lea rcx, [rbp + 0x18]
call fcn.1400029b0
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x40], xmm0
movss xmm3, dword [rbp + 0x64]
addss xmm3, xmm8
subss xmm3, dword [0x140047fa4]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
movss xmm0, dword [rbp + 0x50]
movss dword [rsp + 0x20], xmm0
lea r8, str.play_different
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x58]
call fcn.14000e640
call fcn.140022bf0
mov edx, 0x18
lea rcx, [0x1400b2c68]
call fcn.140013220
mov rcx, rax
call fcn.140022b50
mov dword [rsp + 0x20], 0xff
mov edx, 0xff
mov r9d, edx
mov r8d, edx
lea rcx, [rbp + 0x18]
call fcn.1400029b0
movups xmm6, xmmword [rax]
lea rcx, [rdi + 0x10]
call fcn.140001b70
movdqa xmmword [rbp + 0x40], xmm6
movss xmm3, dword [rbp + 0x64]
addss xmm3, xmm8
addss xmm3, dword [rbp + 0x6c]
addss xmm3, dword [0x140047fa4]
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x28], rcx
movss xmm0, dword [rbp + 0x50]
movss dword [rsp + 0x20], xmm0
mov r8, rax
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x58]
call fcn.14000e640
call fcn.140022bf0
movss xmm0, dword [rbp + 0x64]
addss xmm0, xmm8
addss xmm0, dword [rbp + 0x6c]
addss xmm0, dword [rbp + 0x74]
addss xmm0, xmm8
call fcn.1400233f0
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x18]
call fcn.140001e60
nop
mov r8d, 7
lea rdx, str.nullify
lea rcx, [rbp + 0x18]
call fcn.140001e80
nop
mov dword [rbp + 0x10], 1
call qword [0x1400b2b48]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140001a10
lea rdx, [rbp + 0x18]
mov rcx, rax
call fcn.140015360
lea rcx, [rsp + 0x50]
call fcn.1400019a0
nop
lea rcx, [rbp + 0x18]
call fcn.1400019a0
cmp qword [0x1400b2b78], 0
jne 0x14000cef6
mov rcx, qword [0x1400b2af0]
call fcn.14000c790
movss xmm0, dword [0x140047fc0]
call fcn.1400233a0
xor sil, sil
mov dword [rbp - 0x24], esi
xor r14b, r14b
mov dword [rbp - 0x20], r14d
xor r15b, r15b
mov dword [rbp + 8], r15d
xor r12b, r12b
mov dword [rbp], r12d
xor r13b, r13b
mov dword [rbp - 0x58], r13d
xor bl, bl
mov dword [rbp - 0x54], ebx
mov byte [rbp - 0x50], bl
mov byte [rbp - 0x28], bl
mov byte [rbp + 0x10], bl
mov rcx, qword [rdi + 0x30]
mov qword [rbp - 0x60], rcx
mov rax, qword [rdi + 0x38]
mov qword [rbp - 0x18], rax
cmp rcx, rax
je 0x14000d2b7
movzx ebx, byte [rsp + 0x40]
movzx edi, byte [rsp + 0x40]
movzx esi, byte [rsp + 0x40]
movzx r14d, byte [rsp + 0x40]
movzx r15d, byte [rsp + 0x40]
movzx r12d, byte [rsp + 0x40]
movzx r13d, byte [rsp + 0x40]
mov rdx, rcx
lea rcx, [rbp + 0x18]
call fcn.140001a50
nop
movzx edx, bl
lea rcx, [rbp - 0x48]
call fcn.140001e60
nop
mov r8d, 0xb
lea rdx, str.diablo_rust
lea rcx, [rbp - 0x48]
call fcn.140001e80
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.140015360
mov byte [rsp + 0x40], al
lea rcx, [rbp - 0x48]
call fcn.1400019a0
mov eax, dword [rbp - 0x24]
movzx eax, al
cmp byte [rsp + 0x40], 0
mov ecx, 1
cmovne eax, ecx
mov dword [rbp - 0x24], eax
movzx edx, sil
lea rcx, [rbp - 0x48]
call fcn.140001e60
nop
mov r8d, 0x13
lea rdx, str.diablo_rust_private
lea rcx, [rbp - 0x48]
call fcn.140001e80
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.140015360
mov byte [rsp + 0x40], al
lea rcx, [rbp - 0x48]
call fcn.1400019a0
mov eax, dword [rbp - 0x20]
movzx eax, al
cmp byte [rsp + 0x40], 0
mov ecx, 1
cmovne eax, ecx
mov dword [rbp - 0x20], eax
movzx edx, r12b
lea rcx, [rbp - 0x48]
call fcn.140001e60
nop
mov r8d, 0xb
lea rdx, str.diablo_apex
lea rcx, [rbp - 0x48]
call fcn.140001e80
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.140015360
mov byte [rsp + 0x40], al
lea rcx, [rbp - 0x48]
call fcn.1400019a0
mov eax, dword [rbp + 8]
movzx eax, al
cmp byte [rsp + 0x40], 0
mov ecx, 1
cmovne eax, ecx
mov dword [rbp + 8], eax
movzx edx, dil
lea rcx, [rbp - 0x48]
call fcn.140001e60
nop
mov r8d, 0x10
lea rdx, str.diablo_rust_test
lea rcx, [rbp - 0x48]
call fcn.140001e80
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.140015360
mov byte [rsp + 0x40], al
lea rcx, [rbp - 0x48]
call fcn.1400019a0
mov eax, dword [rbp]
movzx eax, al
cmp byte [rsp + 0x40], 0
mov ecx, 1
cmovne eax, ecx
mov dword [rbp], eax
movzx edx, r14b
lea rcx, [rbp - 0x48]
call fcn.140001e60
nop
mov r8d, 0x10
lea rdx, str.diablo_apex_test
lea rcx, [rbp - 0x48]
call fcn.140001e80
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.140015360
mov byte [rsp + 0x40], al
lea rcx, [rbp - 0x48]
call fcn.1400019a0
mov eax, dword [rbp - 0x58]
movzx eax, al
cmp byte [rsp + 0x40], 0
mov ecx, 1
cmovne eax, ecx
mov dword [rbp - 0x58], eax
movzx edx, r15b
lea rcx, [rbp - 0x48]
call fcn.140001e60
nop
mov r8d, 0x10
lea rdx, str.diablo_csgo_test
lea rcx, [rbp - 0x48]
call fcn.140001e80
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.140015360
mov byte [rsp + 0x40], al
lea rcx, [rbp - 0x48]
call fcn.1400019a0
mov eax, dword [rbp - 0x54]
movzx eax, al
cmp byte [rsp + 0x40], 0
mov ecx, 1
cmovne eax, ecx
mov dword [rbp - 0x54], eax
movzx edx, r13b
lea rcx, [rbp - 0x48]
call fcn.140001e60
nop
mov r8d, 0xb
lea rdx, str.diablo_csgo
lea rcx, [rbp - 0x48]
call fcn.140001e80
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.140015360
mov byte [rsp + 0x40], al
lea rcx, [rbp - 0x48]
call fcn.1400019a0
mov eax, dword [rbp - 0x50]
movzx eax, al
cmp byte [rsp + 0x40], 0
mov ecx, 1
cmovne eax, ecx
mov dword [rbp - 0x50], eax
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x48]
call fcn.140001e60
nop
mov r8d, 0xa
lea rdx, str.diablo_r6s
lea rcx, [rbp - 0x48]
call fcn.140001e80
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.140015360
mov byte [rsp + 0x40], al
lea rcx, [rbp - 0x48]
call fcn.1400019a0
mov eax, dword [rbp - 0x28]
movzx eax, al
cmp byte [rsp + 0x40], 0
mov ecx, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x48]
call fcn.140001e60
nop
mov r8d, 0xd
lea rdx, str.diablo_finals
lea rcx, [rbp - 0x48]
call fcn.140001e80
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.140015360
mov byte [rsp + 0x40], al
lea rcx, [rbp - 0x48]
call fcn.1400019a0
mov eax, dword [rbp + 0x10]
movzx eax, al
cmp byte [rsp + 0x40], 0
mov ecx, 1
cmovne eax, ecx
mov dword [rbp + 0x10], eax
lea rcx, [rbp + 0x18]
call fcn.1400019a0
mov rcx, qword [rbp - 0x60]
add rcx, 0x20
mov qword [rbp - 0x60], rcx
cmp rcx, qword [rbp - 0x18]
jne 0x14000cf73
mov rdi, qword [rbp - 8]
mov esi, dword [rbp - 0x24]
mov r14d, dword [rbp - 0x20]
mov r15d, dword [rbp + 8]
mov r12d, dword [rbp]
mov r13d, dword [rbp - 0x58]
mov ebx, dword [rbp - 0x54]
lea rcx, [rbp + 0x40]
call fcn.1400232e0
cmp byte [rdi + 0x4c], 0
jne 0x14000d2d8
test r12b, r12b
jne 0x14000d2d8
test r13b, r13b
jne 0x14000d2d8
test bl, bl
je 0x14000d3b4
mov edx, 0x10
lea rcx, [0x1400b2c58]
call fcn.140013160
mov rcx, rax
call fcn.140022b50
mov dword [rbp - 0x60], 0x41200000
mov dword [rbp - 0x5c], 0x41200000
lea rcx, [rbp - 0x60]
call fcn.140023320
lea rdx, [0x1400b2d21]
lea rcx, str.Test_Build_
call fcn.14003c780
call fcn.140022bf0
test bl, bl
je 0x14000d3b4
mov dword [rbp - 0x60], 0x41200000
mov dword [rbp - 0x5c], 0x420c0000
lea rcx, [rbp - 0x60]
call fcn.140023320
mov dword [rbp - 0x60], 0x42c80000
mov dword [rbp - 0x5c], 0x41a00000
xor r8d, r8d
lea rdx, [rbp - 0x60]
lea rcx, str.Test_Module
call fcn.14003b550
test al, al
je 0x14000d3b4
mov ecx, 0xb8
call fcn.14003e440
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movzx edx, r13b
movzx ecx, r12b
add edx, ecx
movzx ecx, r15b
add edx, ecx
movzx ecx, r14b
add edx, ecx
movzx eax, sil
add edx, eax
mov r8, rdi
mov rcx, rbx
call fcn.14000bf00
nop
mov qword [0x1400b2b00], rax
lea rcx, [rbp + 0x40]
call fcn.140023320
movaps xmm0, xmmword [0x140048250]
movups xmmword [rbp - 0x18], xmm0
lea rdx, [rbp - 0x18]
mov ecx, 0x15
call fcn.140018ee0
movaps xmm0, xmmword [0x1400482a0]
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x18], xmm1
mov dword [rbp - 0x60], 0x3f800000
mov dword [rbp - 0x5c], 0x3f800000
mov qword [rbp], 0
mov dword [rbp + 8], 0x43160000
mov dword [rbp + 0xc], 0x43480000
lea rax, [rbp - 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
lea r9, [rbp - 0x60]
lea r8, [rbp]
lea rdx, [rbp + 8]
mov rcx, qword [0x1400b2b78]
call fcn.14003c670
test al, al
je 0x14000d737
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140001e60
nop
mov r8d, 0xc
lea rdx, str.mpnotify.exe
lea rcx, [rsp + 0x50]
call fcn.140001e80
nop
lea rcx, [rsp + 0x50]
call fcn.14000c620
nop
lea rcx, [rsp + 0x50]
call fcn.1400019a0
mov ecx, 0x28
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm1, xmmword [0x140048340]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140048320]
movdqu xmmword [rsp + 0x60], xmm2
mov dl, 0x7e
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
xor dl, cl
mov byte [rsp + 0x70], dl
mov byte [rsp + 0x71], 0
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x51]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
test r12b, r12b
je 0x14000d5cb
cmp byte [0x1400b2d21], 0
je 0x14000d5cb
mov ecx, 0xb8
call fcn.14003e440
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movzx edx, r15b
movzx ecx, r14b
add edx, ecx
movzx ecx, sil
add edx, ecx
mov r8, rdi
mov rcx, rbx
call fcn.14000bf00
nop
mov qword [0x1400b2b00], rax
jmp 0x14000d737
test r14b, r14b
je 0x14000d60d
mov ecx, 0xb8
call fcn.14003e440
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movzx edx, sil
mov r8, rdi
mov rcx, rbx
call fcn.14000bf00
nop
mov qword [0x1400b2b00], rax
jmp 0x14000d737
test sil, sil
je 0x14000d64d
mov ecx, 0xb8
call fcn.14003e440
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.14000bf00
nop
mov qword [0x1400b2b00], rax
jmp 0x14000d737
movdqa xmm0, xmmword [0x1400482c0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140048110]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400480d0]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140048140]
movdqa xmmword [rbp - 0x80], xmm1
mov word [rbp - 0x70], 0x401b
xor eax, eax
mov byte [rbp - 0x6e], al
xor ecx, ecx
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x51], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x52], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x53], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x54], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x55], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x56], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x57], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x58], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x59], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5a], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5b], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5c], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5d], al
add rcx, 0xd
cmp rcx, 0x41
jb 0x14000d691
mov byte [rbp - 0x6e], 0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x51]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movss xmm6, dword [0x140048018]
movaps xmm1, xmm6
movaps xmm0, xmm9
call fcn.140023230
movaps xmm0, xmmword [0x1400482a0]
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x48], xmm1
mov dword [rbp - 0x60], 0x3f800000
mov dword [rbp - 0x5c], 0x3f800000
mov qword [rbp], 0
mov dword [rbp + 8], 0x43160000
mov dword [rbp + 0xc], 0x43480000
lea rax, [rbp + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
lea r9, [rbp - 0x60]
lea r8, [rbp]
lea rdx, [rbp + 8]
mov rcx, qword [0x1400b2ae0]
call fcn.14003c670
test al, al
je 0x14000dac6
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140001e60
nop
mov r8d, 0xc
lea rdx, str.mpnotify.exe
lea rcx, [rsp + 0x50]
call fcn.140001e80
nop
lea rcx, [rsp + 0x50]
call fcn.14000c620
nop
lea rcx, [rsp + 0x50]
call fcn.1400019a0
mov ecx, 0x28
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm1, xmmword [0x1400482f0]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x1400482d0]
movdqu xmmword [rsp + 0x60], xmm2
mov dl, 0x5c
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
xor dl, cl
mov byte [rsp + 0x70], dl
mov byte [rsp + 0x71], 0
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x51]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
test r13b, r13b
je 0x14000d946
cmp byte [0x1400b2d21], 0
je 0x14000d946
mov ecx, 0xb8
call fcn.14003e440
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movzx edx, r12b
movzx ecx, r15b
add edx, ecx
movzx ecx, r14b
add edx, ecx
movzx ecx, sil
add edx, ecx
mov r8, rdi
mov rcx, rbx
call fcn.14000bf00
nop
mov qword [0x1400b2b00], rax
jmp 0x14000dac6
test r15b, r15b
je 0x14000d9d3
movzx r13d, r14b
movzx eax, sil
add r13d, eax
mov ecx, 0xb8
cmp byte [rdi + 0x4c], 0
je 0x14000d99c
call fcn.14003e440
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r8, rdi
mov edx, r13d
mov rcx, rbx
call fcn.14000bf00
nop
mov qword [0x1400b2b00], rax
jmp 0x14000dac6
call fcn.14003e440
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r8, rdi
mov edx, r13d
mov rcx, rbx
call fcn.14000bf00
nop
mov qword [0x1400b2b00], rax
jmp 0x14000dac6
movdqa xmm0, xmmword [0x140048300]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140048130]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400480c0]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140048100]
movdqa xmmword [rbp - 0x80], xmm1
mov word [rbp - 0x70], 0x4e15
xor eax, eax
mov byte [rbp - 0x6e], al
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x51], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x52], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x53], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x54], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x55], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x56], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x57], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x58], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x59], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5a], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5b], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5c], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5d], al
add rcx, 0xd
cmp rcx, 0x41
jb 0x14000da20
mov byte [rbp - 0x6e], 0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x51]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movaps xmm1, xmm6
movaps xmm0, xmm9
call fcn.140023230
movaps xmm0, xmmword [0x1400482a0]
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x48], xmm1
mov dword [rbp - 0x60], 0x3f800000
mov dword [rbp - 0x5c], 0x3f800000
mov qword [rbp], 0
mov dword [rbp + 8], 0x43160000
mov dword [rbp + 0xc], 0x43480000
lea rax, [rbp + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
lea r9, [rbp - 0x60]
lea r8, [rbp]
lea rdx, [rbp + 8]
mov rcx, qword [0x1400b2b10]
call fcn.14003c670
test al, al
je 0x14000ddc7
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140001e60
nop
mov r8d, 0xc
lea rdx, str.mpnotify.exe
lea rcx, [rsp + 0x50]
call fcn.140001e80
nop
lea rcx, [rsp + 0x50]
call fcn.14000c620
nop
lea rcx, [rsp + 0x50]
call fcn.1400019a0
mov ecx, 0x28
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm1, xmmword [0x1400481b0]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140048180]
movdqu xmmword [rsp + 0x60], xmm2
mov dl, 0x3b
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
xor dl, cl
mov byte [rsp + 0x70], dl
mov byte [rsp + 0x71], 0
mov dword [rsp + 0x28], 0xa
xor ebx, ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x51]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp byte [rbp - 0x50], bl
je 0x14000dcd9
mov ecx, 0xb8
call fcn.14003e440
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movzx edx, byte [rbp - 0x54]
mov r13d, dword [rbp - 0x58]
movzx ecx, r13b
add edx, ecx
movzx ecx, r12b
add edx, ecx
movzx ecx, r15b
add edx, ecx
movzx eax, r14b
add edx, eax
movzx eax, sil
add edx, eax
mov r8, rdi
mov rcx, rbx
call fcn.14000bf00
nop
mov byte [rax + 0x81], 1
mov qword [0x1400b2b00], rax
jmp 0x14000ddcb
movdqa xmm0, xmmword [0x140048350]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400481c0]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400481e0]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140048170]
movdqa xmmword [rbp - 0x80], xmm1
mov word [rbp - 0x70], 0x7a21
xor eax, eax
mov byte [rbp - 0x6e], al
mov rcx, rbx
nop
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x51], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x52], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x53], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x54], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x55], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x56], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x57], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x58], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x59], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5a], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5b], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5c], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5d], al
add rcx, 0xd
cmp rcx, 0x41
jb 0x14000dd20
mov byte [rbp - 0x6e], bl
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x51]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov r13d, dword [rbp - 0x58]
jmp 0x14000ddcd
mov r13d, dword [rbp - 0x58]
xor ebx, ebx
movaps xmm1, xmm6
movaps xmm0, xmm9
call fcn.140023230
movaps xmm0, xmmword [0x1400482a0]
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x48], xmm1
mov dword [rbp - 0x60], 0x3f800000
mov dword [rbp - 0x5c], 0x3f800000
mov qword [rbp], 0
mov dword [rbp + 8], 0x43160000
mov dword [rbp + 0xc], 0x43480000
lea rax, [rbp + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
lea r9, [rbp - 0x60]
lea r8, [rbp]
lea rdx, [rbp + 8]
mov rcx, qword [0x1400b2b80]
call fcn.14003c670
test al, al
je 0x14000e203
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140001e60
nop
mov r8d, 0xb
lea rdx, str.Notepad.exe
lea rcx, [rsp + 0x50]
call fcn.140001e80
nop
lea rcx, [rsp + 0x50]
call fcn.14000c620
nop
lea rcx, [rsp + 0x50]
call fcn.1400019a0
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140001e60
nop
mov r8d, 0xb
lea rdx, str.notepad.exe
lea rcx, [rsp + 0x50]
call fcn.140001e80
nop
lea rcx, [rsp + 0x50]
call fcn.14000c620
nop
lea rcx, [rsp + 0x50]
call fcn.1400019a0
mov ecx, 0x28
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm1, xmmword [0x1400481d0]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [str.__wv]
movdqu xmmword [rsp + 0x60], xmm2
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
mov byte [rsp + 0x70], 0
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x51]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
lea rcx, str.Notepad
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14000dfe0
mov edi, 1
nop dword [rax]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, str.Notepad
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14000dfc0
mov rdi, qword [rbp - 8]
cmp byte [rbp - 0x28], 0
je 0x14000e04e
mov ecx, 0xb8
call fcn.14003e440
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movzx edx, byte [rbp - 0x50]
movzx ecx, byte [rbp - 0x54]
add edx, ecx
movzx ecx, r13b
add edx, ecx
movzx ecx, r12b
add edx, ecx
movzx eax, r15b
add edx, eax
movzx eax, r14b
add edx, eax
movzx eax, sil
add edx, eax
mov r8, rdi
mov rcx, rbx
call fcn.14000bf00
nop
mov byte [rax + 0x80], 1
mov qword [0x1400b2b00], rax
jmp 0x14000e203
movdqa xmm0, xmmword [0x140048310]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400480e0]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x140048120]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1400480f0]
movdqa xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x70], 0x7031a01
mov word [rbp - 0x6c], 0x5c
mov rcx, rbx
nop word [rax + rax]
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x51], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x52], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x53], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x54], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x55], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x56], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x57], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x58], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x59], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5a], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5b], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5c], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5d], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5e], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x5f], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x60], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x61], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x62], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x63], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x64], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x65], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x66], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x67], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x68], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x69], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x6a], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x6b], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x6c], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x6d], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x6e], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x6f], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x70], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x71], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x72], al
add rcx, 0x22
cmp rcx, 0x44
jb 0x14000e0a0
mov byte [rbp - 0x6b], 0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x51]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movaps xmm1, xmm6
movaps xmm0, xmm9
call fcn.140023230
movaps xmm0, xmmword [0x1400482a0]
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x48], xmm1
mov dword [rbp - 8], 0x3f800000
mov dword [rbp - 4], 0x3f800000
mov qword [rbp - 0x60], 0
mov dword [rbp], 0x43160000
mov dword [rbp + 4], 0x43480000
lea rax, [rbp + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
lea r9, [rbp - 8]
lea r8, [rbp - 0x60]
lea rdx, [rbp]
mov rcx, qword [0x1400b2a90]
call fcn.14003c670
test al, al
je 0x14000e5f3
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140001e60
nop
mov r8d, 0xc
lea rdx, str.mpnotify.exe
lea rcx, [rsp + 0x50]
call fcn.140001e80
nop
lea rcx, [rsp + 0x50]
call fcn.14000c620
nop
lea rcx, [rsp + 0x50]
call fcn.1400019a0
mov ecx, 0x28
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm1, xmmword [0x1400482e0]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x1400482b0]
movdqu xmmword [rsp + 0x60], xmm2
mov r8b, 0x5d
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor byte [rsp + 0x58], cl
xor byte [rsp + 0x59], cl
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor byte [rsp + 0x68], cl
xor byte [rsp + 0x69], cl
xor byte [rsp + 0x6a], cl
xor byte [rsp + 0x6b], cl
xor byte [rsp + 0x6c], cl
xor byte [rsp + 0x6d], cl
xor byte [rsp + 0x6e], cl
xor byte [rsp + 0x6f], cl
xor r8b, cl
mov byte [rsp + 0x70], r8b
mov byte [rsp + 0x71], 0
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x51]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rbp + 0x10], 0
je 0x14000e42f
mov ecx, 0xb8
call fcn.14003e440
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movzx edx, byte [rbp - 0x28]
movzx ecx, byte [rbp - 0x50]
add edx, ecx
movzx ecx, byte [rbp - 0x54]
add edx, ecx
movzx ecx, r13b
add edx, ecx
movzx eax, r12b
add edx, eax
movzx eax, r15b
add edx, eax
movzx eax, r14b
add edx, eax
movzx eax, sil
add edx, eax
mov r8, rdi
mov rcx, rbx
call fcn.14000bf00
nop
mov byte [rax + 0x82], 1
mov qword [0x1400b2b00], rax
jmp 0x14000e5f3
movdqa xmm1, xmmword [0x140048330]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm2, xmmword [0x140048210]
movdqa xmmword [rsp + 0x60], xmm2
movdqa xmm3, xmmword [0x140048160]
movdqa xmmword [rsp + 0x70], xmm3
movdqa xmm4, xmmword [0x140048190]
movdqa xmmword [rbp - 0x80], xmm4
mov cl, 0x35
mov r8b, 0x6b
movzx r9d, cl
mov r10b, 0x25
mov r11b, 0x34
mov bl, 0x2f
mov dil, 0x36
mov sil, 0x32
mov r14b, 0x69
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd edx, xmm1
xor al, dl
mov byte [rsp + 0x51], al
xor byte [rsp + 0x52], dl
xor byte [rsp + 0x53], dl
xor byte [rsp + 0x54], dl
xor byte [rsp + 0x55], dl
xor byte [rsp + 0x56], dl
xor byte [rsp + 0x57], dl
xor byte [rsp + 0x58], dl
xor byte [rsp + 0x59], dl
xor byte [rsp + 0x5a], dl
xor byte [rsp + 0x5b], dl
xor byte [rsp + 0x5c], dl
xor byte [rsp + 0x5d], dl
xor byte [rsp + 0x5e], dl
xor byte [rsp + 0x5f], dl
movd eax, xmm2
xor al, dl
mov byte [rsp + 0x60], al
xor byte [rsp + 0x61], dl
xor byte [rsp + 0x62], dl
xor byte [rsp + 0x63], dl
xor byte [rsp + 0x64], dl
xor byte [rsp + 0x65], dl
xor byte [rsp + 0x66], dl
xor byte [rsp + 0x67], dl
xor byte [rsp + 0x68], dl
xor byte [rsp + 0x69], dl
xor byte [rsp + 0x6a], dl
xor byte [rsp + 0x6b], dl
xor byte [rsp + 0x6c], dl
xor byte [rsp + 0x6d], dl
xor byte [rsp + 0x6e], dl
xor byte [rsp + 0x6f], dl
movd eax, xmm3
xor al, dl
mov byte [rsp + 0x70], al
xor byte [rsp + 0x71], dl
xor byte [rsp + 0x72], dl
xor byte [rsp + 0x73], dl
xor byte [rsp + 0x74], dl
xor byte [rsp + 0x75], dl
xor byte [rsp + 0x76], dl
xor byte [rsp + 0x77], dl
xor byte [rsp + 0x78], dl
xor byte [rsp + 0x79], dl
xor byte [rsp + 0x7a], dl
xor byte [rsp + 0x7b], dl
xor byte [rsp + 0x7c], dl
xor byte [rsp + 0x7d], dl
xor byte [rsp + 0x7e], dl
xor byte [rsp + 0x7f], dl
movd eax, xmm4
xor al, dl
mov byte [rbp - 0x80], al
xor byte [rbp - 0x7f], dl
xor byte [rbp - 0x7e], dl
xor byte [rbp - 0x7d], dl
xor byte [rbp - 0x7c], dl
xor byte [rbp - 0x7b], dl
xor byte [rbp - 0x7a], dl
xor byte [rbp - 0x79], dl
xor byte [rbp - 0x78], dl
xor byte [rbp - 0x77], dl
xor byte [rbp - 0x76], dl
xor byte [rbp - 0x75], dl
xor byte [rbp - 0x74], dl
xor byte [rbp - 0x73], dl
xor byte [rbp - 0x72], dl
xor byte [rbp - 0x71], dl
xor cl, dl
mov byte [rbp - 0x70], cl
xor r8b, dl
mov byte [rbp - 0x6f], r8b
xor r9b, dl
mov byte [rbp - 0x6e], r9b
xor r10b, dl
mov byte [rbp - 0x6d], r10b
xor r11b, dl
mov byte [rbp - 0x6c], r11b
xor bl, dl
mov byte [rbp - 0x6b], bl
xor dil, dl
mov byte [rbp - 0x6a], dil
xor sil, dl
mov byte [rbp - 0x69], sil
xor r14b, dl
mov byte [rbp - 0x68], r14b
mov byte [rbp - 0x67], 0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x51]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 1
call fcn.140018f40
mov rcx, qword [rbp + 0x88]
xor rcx, rsp
call fcn.14003e420
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret