Function at 0x140001a40
Capabilities:
Delete file
Execute command
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x150], rax
xor ebx, ebx
mov dword [rbp + 0xa0], ebx
mov dword [rbp + 0xa0], ebx
mov qword [rbp - 0x80], rbx
mov dword [rbp + 0xa4], ebx
mov word [rbp + 0xa8], 0x500
lea rax, [rbp - 0x80]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp + 0xa4]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140001af6
lea r8, [rbp + 0xa0]
mov rdx, qword [rbp - 0x80]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rbp + 0xa0], 1
jne 0x14000259c
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x120], xmm1
mov r8d, 0xb
lea rdx, str.config.json
lea rcx, [rbp + 0x110]
call fcn.140003a30
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rbx
mov qword [rbp + 0xc8], rbx
mov r8d, 0x2f
lea rdx, str.C:Users_aaaAppDataLocalTemp_temp_script.bat
lea rcx, [rbp + 0xb0]
call fcn.140003a30
nop
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x130]
call fcn.140001350
nop
mov r14, qword [rbp + 0x140]
test r14, r14
jne 0x140001c3b
lea rdx, str.ERROR_READ
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003700
mov rcx, rax
lea rdx, [0x1400038e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x140001bee
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001be8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400024a7
call fcn.1400042ac
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x140001c2f
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400024ef
call fcn.1400042ac
mov qword [rbp + 0xc0], rbx
jmp 0x14000209a
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0x1d
jb 0x1400025a2
lea r13, [rbp + 0x130]
mov rsi, qword [rbp + 0x130]
mov r15, qword [rbp + 0x148]
cmp r15, 0xf
cmova r13, rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea r12, [r14 + 0x1d]
mov ebx, 0xf
lea rdi, [rsp + 0x60]
movabs rax, 0x8000000000000000
mov edx, 0x16
cmp r12, rbx
jbe 0x140001d13
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001cd3
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.140004270
test rax, rax
je 0x140001cff
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001d0e
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140001ce7
xor edi, edi
jmp 0x140001d0e
cmp rcx, 0x1000
jb 0x140001d06
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002590
jmp 0x140001cb8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004270
mov rdi, rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], rbx
movups xmm0, xmmword [str._echo_off_ncolor_2_nset__email]
movups xmmword [rdi], xmm0
movsd xmm0, qword [0x140006e48]
movsd qword [rdi + 0x10], xmm0
mov eax, dword [0x140006e50]
mov dword [rdi + 0x18], eax
movzx eax, byte [0x140006e54]
mov byte [rdi + 0x1c], al
lea rcx, [rdi + 0x1d]
mov r8, r14
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r12], 0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 0x7f2
jb 0x140001db4
lea rax, [rcx + 0x7f2]
mov qword [rsp + 0x70], rax
lea rbx, [rsp + 0x60]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x60]
add rbx, rcx
mov r8d, 0x7f2
lea rdx, str.__n_nif___email___you_example.com____n____cls_n____color_4_n____echo_error__pls_enter_email__n____start_notepad_config.json_n____pause_n____exit__n__necho_MAKE_BY_S_necho_JOIN_HERE_https:__discord.gg_V7nRsGSSK4_n_necho_Choose_an_option:_necho_0__Exit_necho_1__Start_nset__p_choiceEnter_your_choice:__n_nif___choice___0____n____exit__b_n__nif___choice___1____n____set__dataLegacyGeneric:targetMicrosoftAccount:user_email___n____set__liveLegacyGeneric:targetWindowsLive:_token_:name_email__serviceuriscopeservice::user.auth.xboxlive.com::mbi_ssl__n_n____rem_microsoft_login_data_n____for__f__tokens1__delims:____A_in__cmdkey__list__findstr__r__LegacyGeneric:targetMicrosoftAccount:___do___n________if_not____B____data_____n____________cmdkey__delete:__B_n____________echo_removed___B_n__________n______n_n____rem_windows_live_n____for__f__tokens1__delims:____A_in__cmdkey__list__findstr__r__LegacyGeneric:targetWindowsLive:___do___n________if_not____B____live_____n____________cmdkey__delete:__B_n____________echo_removed___B_n__________n______n_n____rem_xbl_n____for__f__tokens1__delims:____A_in__cmdkey__list__findstr__LegacyGeneric:targetXblGrts___do___n________cmdkey__delete:__B_n________echo_removed___B_n______n_n____rem_delete_registry_keys_related_to_email_n____for__f__tokens____A_in__reg_query__HKCUSoftwareMicrosoftIdentityCRLUserExtendedProperties___do___n________set__key__A__n________cls__n________echo___A__findstr__i___email____nul_n________if_errorlevel_1___n____________reg_delete___A__f_n____________echo_Removed_registry_key:___A_n__________else___n____________echo_Skipped_registry_key:___A__matches_email__n__________n______n_n____for__f__tokens____A_in__reg_query__HKEY_USERS___s__f_CredManLog__do___n________echo___A__findstr__i___email____nul_n________if_errorlevel_1___n____________reg_delete____A___f_n____________echo_Removed_registry_key:___A_n__________else___n____________echo_Skipped_registry_key:___A__matches_email__n__________n______n_n____cls_n____echo_Completed_n____echo_Recommend_restart_n____pause_n__nexit__b_n
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x7f2], 0
lea rax, [rsp + 0x60]
jmp 0x140001dd3
mov qword [rsp + 0x20], 0x7f2
lea r9, str.__n_nif___email___you_example.com____n____cls_n____color_4_n____echo_error__pls_enter_email__n____start_notepad_config.json_n____pause_n____exit__n__necho_MAKE_BY_S_necho_JOIN_HERE_https:__discord.gg_V7nRsGSSK4_n_necho_Choose_an_option:_necho_0__Exit_necho_1__Start_nset__p_choiceEnter_your_choice:__n_nif___choice___0____n____exit__b_n__nif___choice___1____n____set__dataLegacyGeneric:targetMicrosoftAccount:user_email___n____set__liveLegacyGeneric:targetWindowsLive:_token_:name_email__serviceuriscopeservice::user.auth.xboxlive.com::mbi_ssl__n_n____rem_microsoft_login_data_n____for__f__tokens1__delims:____A_in__cmdkey__list__findstr__r__LegacyGeneric:targetMicrosoftAccount:___do___n________if_not____B____data_____n____________cmdkey__delete:__B_n____________echo_removed___B_n__________n______n_n____rem_windows_live_n____for__f__tokens1__delims:____A_in__cmdkey__list__findstr__r__LegacyGeneric:targetWindowsLive:___do___n________if_not____B____live_____n____________cmdkey__delete:__B_n____________echo_removed___B_n__________n______n_n____rem_xbl_n____for__f__tokens1__delims:____A_in__cmdkey__list__findstr__LegacyGeneric:targetXblGrts___do___n________cmdkey__delete:__B_n________echo_removed___B_n______n_n____rem_delete_registry_keys_related_to_email_n____for__f__tokens____A_in__reg_query__HKCUSoftwareMicrosoftIdentityCRLUserExtendedProperties___do___n________set__key__A__n________cls__n________echo___A__findstr__i___email____nul_n________if_errorlevel_1___n____________reg_delete___A__f_n____________echo_Removed_registry_key:___A_n__________else___n____________echo_Skipped_registry_key:___A__matches_email__n__________n______n_n____for__f__tokens____A_in__reg_query__HKEY_USERS___s__f_CredManLog__do___n________echo___A__findstr__i___email____nul_n________if_errorlevel_1___n____________reg_delete____A___f_n____________echo_Removed_registry_key:___A_n__________else___n____________echo_Skipped_registry_key:___A__matches_email__n__________n______n_n____cls_n____echo_Completed_n____echo_Recommend_restart_n____pause_n__nexit__b_n
mov edx, 0x7f2
lea rcx, [rsp + 0x60]
call fcn.140003ca0
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xor edi, edi
mov qword [rbp + 0xe0], rdi
mov qword [rbp + 0xe8], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe0], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], dil
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140001e51
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e4c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042ac
movdqa xmm0, xmmword [0x140006f70]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memset
lea rbx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rbx, qword [rbp + 0xb0]
lea rax, [0x140006f48]
mov qword [rbp - 0x70], rax
lea rcx, [rbp + 0x38]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rbp + 0xa0], 7
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea r14, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x70], r14
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x74], edx
lea rcx, [rbp - 0x68]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp - 0x68], rax
mov byte [rbp + 0x14], 0
mov byte [rbp + 9], 0
lea rcx, [rbp - 0x68]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x18], rdi
mov rax, qword [0x14000a9f8]
mov qword [rbp + 0xc], rax
mov qword [rbp], rdi
mov r8d, 2
mov rdx, rbx
lea rcx, [rbp - 0x68]
call fcn.1400035a0
test rax, rax
jne 0x140001f56
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x70]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx - 0x70], r14
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x74], edx
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x70]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
je 0x1400020f7
lea rdx, str.Failed_to_create_batch_file
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003700
mov rcx, rax
lea rdx, [0x1400038e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp - 0x70]
call fcn.140001290
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x140002001
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ffc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002457
call fcn.1400042ac
mov qword [rbp + 0xe0], rdi
mov qword [rbp + 0xe8], 0xf
mov byte [rbp + 0xd0], 0
cmp r15, 0xf
jbe 0x140002052
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140002049
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400024a7
mov rcx, rsi
call fcn.1400042ac
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x140002093
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000208e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400024ef
call fcn.1400042ac
mov qword [rbp + 0xc0], rdi
mov byte [rbp + 0xb0], 0
mov qword [rbp + 0xc8], 0xf
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x1400020ed
inc rdx
mov rcx, qword [rbp + 0x110]
cmp rdx, 0x1000
mov rax, rcx
jb 0x1400020e8
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000254c
call fcn.1400042ac
mov eax, 1
jmp 0x14000255a
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0xf
cmova rdx, qword [rbp + 0xd0]
mov r8, qword [rbp + 0xe0]
lea rcx, [rbp - 0x70]
call fcn.140003ff0
lea rcx, [rbp - 0x68]
call fcn.1400034b0
test rax, rax
jne 0x140002149
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x70]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov r13, qword [rbp + 0xc0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 8
jb 0x14000258a
lea r12, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova r12, qword [rbp + 0xb0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea r14, [r13 + 8]
mov ebx, 0xf
lea rdi, [rsp + 0x60]
cmp r14, rbx
jbe 0x140002223
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400021dd
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140004270
test rax, rax
je 0x14000220f
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000221e
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1400021f7
xor edi, edi
jmp 0x14000221e
cmp rcx, 0x1000
jb 0x140002216
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002596
jmp 0x1400021c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004270
mov rdi, rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rbx
movabs rax, 0x2220632f20646d63
mov qword [rdi], rax
lea rcx, [rdi + 8]
mov r8, r13
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140002289
lea rax, [rcx + 1]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x60]
mov word [rax + rcx], 0x22
lea rax, [rsp + 0x60]
jmp 0x1400022a8
mov qword [rsp + 0x20], 1
lea r9, [0x1400065b0]
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.140003ca0
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x100], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x100], xmm1
xor edi, edi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], dil
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140002323
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000231e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000231e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042ac
movdqa xmm0, xmmword [0x140006f70]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
lea rcx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 0xf
cmova rcx, qword [rbp + 0xf0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ebx, eax
lea rcx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rcx, qword [rbp + 0xb0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test ebx, ebx
jne 0x14000238b
lea rdx, str.Success
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003700
jmp 0x1400023a9
lea rdx, str.Error
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003700
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
lea rdx, [0x1400038e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x108]
cmp rdx, 0xf
jbe 0x1400023fe
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400023f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400023f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042ac
movdqa xmm0, xmmword [0x140006f70]
movdqu xmmword [rbp + 0x100], xmm0
mov byte [rbp + 0xf0], 0
lea rcx, [rbp - 0x70]
call fcn.140001290
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x140002463
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000245e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000245e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042ac
mov qword [rbp + 0xe0], rdi
mov qword [rbp + 0xe8], 0xf
mov byte [rbp + 0xd0], 0
cmp r15, 0xf
jbe 0x1400024b7
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400024ae
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400024ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400042ac
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x1400024fb
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400024f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400024f6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042ac
mov qword [rbp + 0xc0], rdi
mov qword [rbp + 0xc8], 0xf
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x140002558
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002553
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002553
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042ac
xor eax, eax
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140004250
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
nop
call fcn.140001110
nop
call fcn.140001970
nop
call fcn.1400011b0
int3