Function at 0x1400b74a0
Capabilities:
Create pipe
Encode data using base64
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
movaps xmmword [rsp + 0x120], xmm6
nop dword [rax + rax]
mov eax, dword [0x141dd3f20]
mov r8d, dword [0x141dd3f24]
add eax, r8d
add eax, 0xce090daa
cmp eax, 0xd4ae3d04
ja 0x1400b74c0
mov qword [rsp + 0xa8], rcx
mov byte [rsp + 0x4f], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rsp + 0xa0], ecx
nop dword [rax]
mov eax, dword [0x141dd3f28]
xor eax, dword [0x141dd3f2c]
and eax, 0xff3df79b
add eax, 0x11c1f49a
xor eax, 0x6c1508a4
cmp eax, 0x9a884ff1
jb 0x1400b7500
xor r13d, r13d
mov dword [rsp + 0x58], 8
mov cl, 1
xorps xmm6, xmm6
lea rsi, [rsp + 0xc8]
mov rbp, qword [sym.imp.KERNEL32.dll_HeapFree]
mov r15d, 0xde24f39d
xor eax, eax
mov qword [rsp + 0xb0], rax
nop word cs:[rax + rax]
mov dword [rsp + 0x50], ecx
mov eax, dword [0x141dd3f30]
xor eax, dword [0x141dd3f34]
add eax, 0x778e02fe
or eax, 0x42b26c82
and eax, 0x42f37ea3
cmp eax, 0x39a42d94
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jb 0x1400b7690
nop word cs:[rax + rax]
mov eax, dword [0x141dd3f38]
xor edx, edx
div dword [0x141dd3f3c]
mov ebx, eax
add ebx, 0x3b8ebbd7
mov eax, 0xd450ce57
imul rbx, rax
shr rbx, 0x3e
xor ebx, 0x4c5108fa
call rdi
mov dword [rsp + 0x5c], eax
mov rax, qword [0x141ddb248]
cmp ebx, 0x8e531efb
ja 0x1400b7690
test rax, rax
mov rdi, qword [rsp + 0x60]
lea rbx, [rsp + 0xf0]
jne 0x1400b7655
nop word cs:[rax + rax]
movaps xmmword [rsp + 0xf0], xmm6
mov edx, 0x10
mov rcx, rbx
call qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
mov rax, qword [rsp + 0xf0]
mov qword [0x141ddb248], rax
mov rax, qword [0x141ddb248]
nop dword [rax]
mov ecx, dword [0x141dd3f40]
sub ecx, dword [0x141dd3f44]
xor ecx, 0x1dc27cd6
add ecx, 0xe23e5fd3
cmp ecx, 0x3c5a3a3
jb 0x1400b7630
test rax, rax
je 0x1400b7600
mov eax, dword [0x141dd3f48]
and eax, dword [0x141dd3f4c]
mov rcx, qword [rsp + 0xb0]
inc ecx
mov dword [rsp + 0xa4], ecx
or eax, 0x62a4b1fa
add eax, 0x2128c106
cmp eax, 0x70d9938
jae 0x1400b76b0
jmp 0x1400b7780
call rdi
mov dword [rsp + 0x5c], eax
mov rax, qword [0x141ddb248]
jmp 0x1400b75a0
mov eax, dword [0x141dd3f50]
or eax, dword [0x141dd3f54]
and eax, 0xe4fc82b4
mov ecx, 1
lock xadd qword [0x141ddb248], rcx
imul eax, eax, 0x7b1ed007
xor eax, 0x8ebdb43d
mov qword [rsp + 0xc0], rcx
cmp eax, 0x5e1594fb
jb 0x1400b7780
lea rax, [rsp + 0x5c]
mov qword [rsp + 0xc8], rax
lea rax, [0x1400554b0]
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0xd8], rax
lea rax, [0x140053a40]
mov qword [rsp + 0xe0], rax
lea rax, [0x141db9498]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
mov eax, dword [0x141dd3f58]
or eax, dword [0x141dd3f5c]
mov qword [rsp + 0x88], 0
add eax, 0x71874e90
or eax, 0x66616bb9
cmp eax, 0xe6382bcd
lea r14, [rsp + 0x108]
lea r12, [rsp + 0x68]
jbe 0x1400b77a0
jmp 0x1400b7930
mov eax, 1
lock xadd qword [0x141ddb248], rax
mov qword [rsp + 0xc0], rax
jmp 0x1400b76b0
mov eax, dword [0x141dd3f60]
xor edx, edx
div dword [0x141dd3f64]
mov ebx, eax
add ebx, 0x84e8f984
or ebx, 0xffa678fe
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], 2
mov rcx, r14
mov rdx, r12
call fcn.1400384d0
cmp qword [rsp + 0x98], 0
sete al
cmp ebx, 0xed3b4f8b
jb 0x1400b7930
mov ecx, dword [rsp + 0x50]
or cl, al
test cl, 1
jne 0x1400b787e
mov eax, dword [0x141dd4040]
xor edx, edx
div dword [0x141dd4044]
nop dword [rax]
test r13b, r13b
jne 0x1400b7810
mov eax, dword [0x141dd4048]
mov ecx, dword [0x141dd404c]
add eax, ecx
add eax, 0x6038d3a7
mov ecx, 0xb62e3bdd
imul rax, rcx
shr rax, 0x3e
cmp eax, 0xf92d71ea
jbe 0x1400b7850
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rdi
call rbp
nop word [rax + rax]
mov esi, dword [0x141dd4050]
xor esi, dword [0x141dd4054]
or esi, 0x81802284
and esi, 0xf18a2ed4
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rdi
call rbp
cmp esi, 0x899a26b2
je 0x1400b7850
mov ecx, 0xc5de74f7
mov eax, dword [0x141dd3f68]
imul eax, dword [0x141dd3f6c]
and eax, 0xf1a3f252
shr eax, 1
imul rax, rcx
shr rax, 0x3c
cmp eax, 0x6cab44b3
je 0x1400b7883
mov r11, qword [rsp + 0x108]
mov r10, qword [rsp + 0x110]
mov r14, qword [rsp + 0x118]
lea rax, [r10 + r14]
mov qword [rsp + 0x50], rax
test r14, r14
mov qword [rsp + 0x60], r10
mov qword [rsp + 0x98], r11
mov qword [rsp + 0xe8], r14
je 0x1400b7960
lea rsi, [r10 + 1]
nop word cs:[rax + rax]
test r13b, r13b
jne 0x1400b78f0
movzx r9d, byte [r10]
nop dword [rax]
mov eax, dword [0x141dd3f70]
or eax, dword [0x141dd3f74]
imul eax, eax, 0x788848c0
or eax, 0xa3f3f1ff
cmp eax, 0xc24c4ba
je 0x1400b7900
test r9b, r9b
js 0x1400b7990
mov r12d, r9d
jmp 0x1400b7b15
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], 2
mov rcx, r14
mov rdx, r12
call fcn.1400384d0
jmp 0x1400b77a0
mov edi, 4
mov r12d, 8
xor ebx, ebx
xor esi, esi
xor eax, eax
mov qword [rsp + 0xb8], rax
xor r14d, r14d
jmp 0x1400b7b6d
mov ecx, r9d
and ecx, 0x1f
mov eax, dword [0x141dd3f78]
and eax, dword [0x141dd3f7c]
add eax, 0x16751017
imul rax, rax, 0x16808fe7
shr rax, 0x3a
cmp eax, 0x2ab2a26d
ja 0x1400b7996
movzx eax, byte [r10 + 1]
and eax, 0x3f
cmp r9b, 0xdf
jbe 0x1400b7b09
lea rsi, [r10 + 3]
movzx r8d, byte [r10 + 2]
shl eax, 6
and r8d, 0x3f
or r8d, eax
mov r12d, ecx
shl r12d, 0xc
or r12d, r8d
nop dword [rax + rax]
mov eax, dword [0x141dd3f80]
xor edx, edx
div dword [0x141dd3f84]
or eax, 0x4ca164ee
imul rax, rax, 0x32bcf2e1
shr rax, 0x3a
add eax, 0xa5d211ea
cmp eax, 0x389dc7f9
jb 0x1400b79f0
cmp r9b, 0xf0
jb 0x1400b7a8b
mov eax, dword [str.n_1_]
and eax, dword [0x141dd3f8c]
xor eax, 0x336f2ae6
imul rdx, rax, 0xd92ec77
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1d
cmp eax, 0x1654fe16
je 0x1400b7a20
lea rsi, [r10 + 4]
movzx r12d, byte [r10 + 3]
mov eax, dword [0x141dd3f90]
or eax, dword [0x141dd3f94]
or eax, 0x3111
xor eax, 0x80100800
and eax, 0xc0303d15
cmp eax, 0xc7499bb2
je 0x1400b7a55
and ecx, 7
shl ecx, 0x12
shl r8d, 6
and r12d, 0x3f
or r12d, r8d
or r12d, ecx
cmp r12d, 0xffff
jbe 0x1400b7b15
lea ecx, [r12 + 0xff0000]
mov eax, dword [0x141dd3f98]
imul eax, dword [0x141dd3f9c]
xor eax, 0x515ba53a
imul eax, eax, 0x4c55d536
add eax, 0x1753072f
cmp eax, 0x16899eb1
jb 0x1400b7aa0
shr ecx, 0xa
nop word [rax + rax]
mov eax, dword [0x141dd3fa0]
xor edx, edx
div dword [0x141dd3fa4]
cmp eax, 0x843b5ae9
je 0x1400b7ad0
movzx ecx, cx
or ecx, 0xd800
and r12d, 0x3ff
or r12d, 0xdc00
mov eax, 2
mov ebx, r12d
mov r12d, ecx
jmp 0x1400b7b1c
lea rsi, [r10 + 2]
shl ecx, 6
or ecx, eax
mov r12d, ecx
mov eax, 1
xor ebx, ebx
mov rcx, qword [rsp + 0x50]
sub rcx, rsi
add rcx, 3
mov rdx, 0xffffffffffffffff
cmovb rcx, rdx
shr rcx, 2
lea rdx, [rcx + rax]
lea rdi, [rcx + rax]
inc rdi
cmp rdx, 3
mov eax, 4
cmovb rdi, rax
mov rax, rdi
shr rax, 0x3e
jne 0x1400b8626
mov qword [rsp + 0xb8], r12
lea r12, [rdi + rdi]
mov r14w, 1
mov eax, dword [0x141dd3fb8]
and eax, dword [0x141dd3fbc]
or eax, 0x404000e0
xor eax, 0x13806208
and eax, 0x53c46bea
cmp eax, 0xb0297908
ja 0x1400b8080
nop word cs:[rax + rax]
mov ebp, dword [0x141dd3fc0]
and ebp, dword [0x141dd3fc4]
xor ebp, 0x5b150068
and ebp, 0x7b9500f8
movzx eax, byte [0x141ddb278]
xor ecx, ecx
mov rdx, r12
call fcn.1400c0180
cmp ebp, 0xe5b0a843
je 0x1400b8080
mov rcx, rax
test rax, rax
je 0x1400b8679
mov rax, qword [rsp + 0xb8]
mov word [rcx], ax
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], 1
mov r10, qword [rsp + 0x50]
nop word cs:[rax + rax]
test r13b, r13b
jne 0x1400b7c10
mov ebp, 1
test rsi, rsi
je 0x1400b7d40
nop word cs:[rax + rax]
mov eax, dword [0x141dd3fc8]
xor edx, edx
div dword [0x141dd3fcc]
or eax, 0x124200
and eax, 0x1134300
cmp eax, 0x83f85be2
je 0x1400b7c30
test bx, bx
je 0x1400b7c70
xor eax, eax
mov edi, ebx
cmp rbp, qword [rsp + 0x68]
jne 0x1400b7f46
jmp 0x1400b801d
mov eax, dword [0x141dd3fd0]
xor eax, dword [0x141dd3fd4]
and eax, 0x3baac556
xor eax, 0x53e64dde
cmp eax, 0xa669a9ac
ja 0x1400b7c70
cmp rsi, r10
je 0x1400b7d40
mov edi, 0x95946f6b
nop dword [rax + rax]
mov eax, dword [str.f9o]
add eax, dword [0x141dd3fdc]
or eax, 0xa41e3b63
imul eax, eax, 0xdc6535a4
add eax, 0xb3d1547c
cmp eax, 0xec549e48
jb 0x1400b7ca0
lea rax, [rsi + 1]
nop word [rax + rax]
mov edx, dword [0x141dd3fe0]
sub edx, dword [0x141dd3fe4]
imul rdx, r15
shr rdx, 0x3e
imul edx, edx, 0xb1da40e3
or edx, 0x112ecb30
cmp edx, 0x5f44f726
jb 0x1400b7cd0
movzx r9d, byte [rsi]
nop dword [rax]
mov edx, dword [str.hIjesL]
imul edx, dword [0x141dd3fec]
imul edx, edx, 0x2ada41ab
add edx, 0xbe89ff8e
xor edx, 0xf5a3415
cmp edx, 0x9c8bc082
ja 0x1400b7d00
test r9b, r9b
js 0x1400b7dd0
mov rsi, rax
mov edx, r9d
jmp 0x1400b7f10
test r13b, r13b
jne 0x1400b7d40
mov r12, qword [rsp + 0x68]
nop word [rax + rax]
mov eax, dword [0x141dd4020]
imul eax, dword [0x141dd4024]
and eax, 0x7240ca09
cmp eax, 0x98cfe8a8
je 0x1400b7d50
cmp r14w, 1
jne 0x1400b80a0
nop word cs:[rax + rax]
mov eax, dword [0x141dd4028]
add eax, dword [0x141dd402c]
or eax, 0x6457d195
imul eax, eax, 0xa878b791
or eax, 0x96b7cd4f
cmp eax, 0x1b0c4078
jb 0x1400b7d80
xor edi, edi
mov esi, 0
mov r14d, 0
mov r8d, 0
cmp rbp, r12
jne 0x1400b7f48
jmp 0x1400b8047
mov eax, dword [0x141dd3ff0]
xor eax, dword [0x141dd3ff4]
and eax, 0xbcc4d69c
add eax, 0xa2f87d78
xor eax, 0xd606c27b
cmp eax, 0xf6ad6e8
jb 0x1400b7dd0
mov eax, r9d
and eax, 0x1f
movzx edx, byte [rsi + 1]
and edx, 0x3f
cmp r9b, 0xdf
jbe 0x1400b7ef6
lea r10, [rsi + 3]
movzx r8d, byte [rsi + 2]
shl edx, 6
and r8d, 0x3f
or r8d, edx
mov edx, eax
shl edx, 0xc
or edx, r8d
nop word cs:[rax + rax]
mov r11d, dword [0x141dd3ff8]
imul r11d, dword [0x141dd3ffc]
and r11d, 0x3a5f83ad
add r11d, 0x90fb6c95
imul r11, rdi
shr r11, 0x3d
cmp r11d, 0xce76fc41
ja 0x1400b7e30
cmp r9b, 0xf0
jb 0x1400b7fc3
add rsi, 4
nop dword [rax]
mov edx, dword [0x141dd4000]
imul edx, dword [0x141dd4004]
and edx, 0xa19f3ef5
imul edx, edx, 0x13aee07f
imul rdx, rdx, 0x201c7cdf
shr rdx, 0x3b
cmp edx, 0x4f612dc0
ja 0x1400b7e70
movzx edx, byte [r10]
and eax, 7
shl eax, 0x12
shl r8d, 6
and edx, 0x3f
mov r9d, dword [0x141dd4008]
imul r9d, dword [0x141dd400c]
add r9d, 0x4c6ffd63
imul r9, r9, 0x6cb49811
shr r9, 0x3d
and r9d, 0xfffffffe
cmp r9d, 0x56521387
ja 0x1400b7ead
or r8d, edx
or r8d, eax
mov edx, r8d
mov r10, qword [rsp + 0x50]
cmp edx, 0xffff
jbe 0x1400b7f10
jmp 0x1400b7fd7
add rsi, 2
shl eax, 6
or eax, edx
mov edx, eax
nop word cs:[rax + rax]
mov eax, dword [0x141dd4010]
or eax, dword [0x141dd4014]
imul rax, rax, 0x56ec6fb
shr rax, 0x3a
imul r8d, eax, 0x37dd0aa6
xor eax, eax
cmp r8d, 0x8cc904d9
ja 0x1400b7f10
mov edi, edx
cmp rbp, qword [rsp + 0x68]
je 0x1400b801d
mov ebx, eax
mov eax, dword [0x141dd4030]
xor edx, edx
div dword [0x141dd4034]
or eax, 0x511a9d89
imul eax, eax, 0x3655ec47
add eax, 0x1351e7b
cmp eax, 0x4b9a91d5
jbe 0x1400b7f80
mov word [rcx + rbp*2], di
lea rax, [rbp + 1]
mov qword [rsp + 0x78], rax
nop word [rax + rax]
mov eax, dword [0x141dd4038]
or eax, dword [0x141dd403c]
imul eax, eax, 0xf259f686
or eax, 0x129fcc5a
imul edx, eax, 0x20136cfe
lea rax, [rbp + 1]
mov word [rcx + rbp*2], di
mov qword [rsp + 0x78], rax
cmp edx, 0x9d503467
je 0x1400b7f80
mov rbp, rax
test rsi, rsi
jne 0x1400b7c30
jmp 0x1400b7d40
mov rsi, r10
mov r10, qword [rsp + 0x50]
cmp edx, 0xffff
jbe 0x1400b7f10
lea edi, [rdx + 0xff0000]
shr edi, 0xa
or edi, 0xd800
mov eax, dword [0x141dd4018]
or eax, dword [0x141dd401c]
or eax, 0x4dfea836
imul eax, eax, 0x38f3e70e
cmp eax, 0x5731cb41
je 0x1400b7fe6
and edx, 0x3ff
movzx eax, dx
or eax, 0xdc00
cmp rbp, qword [rsp + 0x68]
jne 0x1400b7f46
mov r8, r10
sub r8, rsi
add r8, 3
mov rcx, 0xffffffffffffffff
cmovb r8, rcx
shr r8, 2
movzx ecx, r14w
cmp ax, 1
sbb r8, 0xffffffffffffffff
add r8, rcx
mov ebx, eax
inc r8
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rsp + 0x68]
mov rdx, rbp
call fcn.1400fe010
mov r10, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
jmp 0x1400b7f48
movzx eax, byte [0x141ddb278]
xor ecx, ecx
mov rdx, r12
call fcn.1400c0180
jmp 0x1400b7ba0
mov rdi, qword [rsp + 0x70]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
mov rcx, rdi
mov edx, dword [rsp + 0xa0]
mov ebx, dword [rsp + 0x58]
mov r8d, ebx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
mov r14, qword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x1400b833b
mov eax, dword [0x141dd4080]
add eax, dword [0x141dd4084]
imul eax, eax, 0x32985e32
cmp eax, 0xdb921f54
je 0x1400b81a0
nop word cs:[rax + rax]
mov esi, dword [0x141dd4088]
xor esi, dword [0x141dd408c]
add esi, 0x3784d33b
or esi, 0x694229d0
add esi, 0x7aa2e06e
call r14
cmp esi, 0x703b54ca
jb 0x1400b81a0
test r13b, r13b
jne 0x1400b8149
mov edx, dword [rsp + 0xa4]
cmp edx, 0xa
jge 0x1400b82c0
nop
mov ecx, dword [0x141dd40c8]
sub ecx, dword [0x141dd40cc]
imul ecx, ecx, 0x383b0da5
and ecx, 0xfbc97a4d
cmp ecx, 0x6d96b6e7
je 0x1400b8160
cmp eax, 5
jne 0x1400b81b0
mov eax, edx
mov qword [rsp + 0xb0], rax
jmp 0x1400b821b
call r14
jmp 0x1400b8120
mov ecx, dword [0x141dd40f0]
add ecx, dword [str._]
or ecx, 0x179b5b52
imul ecx, ecx, 0x8333bbc2
and ecx, 0x14c8ad62
cmp ecx, 0x47adff25
ja 0x1400b81b0
nop word cs:[rax + rax]
cmp eax, 0x57
sete cl
test ebx, ebx
setne dl
mov r8d, dword [0x141dd40f8]
imul r8d, dword [0x141dd40fc]
add r8d, 0x331d7d9
and r8d, 0x6c7b92c4
cmp r8d, 0x8d5fb71e
je 0x1400b81e0
xor ebx, ebx
and dl, cl
je 0x1400b82c0
mov dword [rsp + 0x58], ebx
xor ecx, ecx
test r12, r12
lea rsi, [rsp + 0xc8]
mov rbp, qword [sym.imp.KERNEL32.dll_HeapFree]
je 0x1400b7560
mov rbx, qword [0x141ddb260]
mov eax, dword [0x141dd40e0]
xor edx, edx
div dword [0x141dd40e4]
imul rax, rax, 0x5f44444f
shr rax, 0x3d
add eax, 0x736a7b8e
or eax, 0x9859f395
cmp eax, 0xba3c3bb7
je 0x1400b827f
nop word [rax + rax]
mov rcx, rbx
xor edx, edx
mov r8, rdi
call rbp
test r13b, r13b
je 0x1400b8290
mov rcx, rbx
xor edx, edx
mov r8, rdi
call rbp
jmp 0x1400b8270
mov eax, dword [0x141dd40e8]
or eax, dword [0x141dd40ec]
xor eax, 0xd2162865
imul eax, eax, 0x3844fae
imul rax, rax, 0x3d4763bb
shr rax, 0x36
cmp eax, 0xb4ec71a0
ja 0x1400b8290
xor ecx, ecx
jmp 0x1400b7560
xor ecx, ecx
test cl, cl
mov rdx, qword [rsp + 0xa8]
je 0x1400b82e4
mov rcx, rax
shl rcx, 0x20
or rcx, 2
mov qword [rdx + 8], rcx
mov qword [rdx], 1
shl rax, 0x20
or rax, 2
xor ecx, ecx
nop
mov qword [rdx + 8], rax
mov qword [rdx], 1
test cl, cl
jne 0x1400b82f0
mov rsi, 0xffffffffffffffff
test r12, r12
je 0x1400b8561
mov eax, dword [0x141dd40d0]
or eax, dword [0x141dd40d4]
imul eax, eax, 0x1f253c57
or eax, 0x9de826a1
add eax, 0x4ec20cd
cmp eax, 0x3fbb15bb
jae 0x1400b8759
jmp 0x1400b8783
xor eax, eax
mov rbx, qword [rsp + 0xa8]
nop word cs:[rax + rax]
test al, al
jne 0x1400b8350
test r12, r12
je 0x1400b8455
mov eax, dword [0x141dd4058]
add eax, dword [0x141dd405c]
imul eax, eax, 0xc55a1e21
or eax, 0x1208200c
and eax, 0x972be1be
cmp eax, 0x68435f19
jne 0x1400b8390
mov rax, qword [0x141ddb260]
nop word [rax + rax]
mov eax, dword [0x141dd4060]
imul eax, dword [0x141dd4064]
add eax, 0xb2614f5d
or eax, 0x759b5641
mov r14, qword [0x141ddb260]
cmp eax, 0x50b1aeff
jb 0x1400b8390
mov eax, dword [str.RY_r]
add eax, dword [0x141dd406c]
and eax, 0x91a1018d
add eax, 0x2d0e0175
and eax, 0xa02f002c
cmp eax, 0xb3322afa
jbe 0x1400b83e5
mov rcx, r14
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov esi, dword [0x141dd4070]
and esi, dword [0x141dd4074]
or esi, 0x8240
and esi, 0x141c8e4c
add esi, 0x99f2641b
mov rcx, r14
xor edx, edx
mov r8, rdi
call r15
cmp esi, 0xc1f99d64
ja 0x1400b83f0
nop word cs:[rax + rax]
mov eax, dword [0x141dd4078]
xor edx, edx
div dword [0x141dd407c]
or eax, 0x302eaa6f
imul eax, eax, 0xed51e5b8
or eax, 0x33789069
cmp eax, 0x360db5e9
je 0x1400b8430
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x68], 0
mov qword [rsp + 0x84], 0
mov word [rsp + 0x8c], 0
movzx eax, byte [rsp + 0x4f]
mov byte [rsp + 0x89], al
xor al, 1
mov byte [rsp + 0x88], al
mov dword [rsp + 0x80], 0
mov dword [rsp + 0xc8], 0x18
mov qword [rsp + 0xd0], 0
mov dword [rsp + 0xd8], 1
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
mov rdx, qword [rsp + 0xe8]
call fcn.140092180
test rax, rax
je 0x1400b856b
mov eax, dword [0x141dd40a8]
xor eax, dword [0x141dd40ac]
and eax, 0x24adf2cd
add eax, 0x41cfd55
cmp eax, 0xf9ac4cad
jbe 0x1400b8516
mov qword [rbx + 8], rdx
mov qword [rbx], 1
xor eax, eax
nop dword [rax + rax]
mov qword [rbx + 8], rdx
mov qword [rbx], 1
test al, al
jne 0x1400b8520
nop
mov eax, dword [0x141dd40b0]
sub eax, dword [0x141dd40b4]
imul eax, eax, 0xe99bff7
add eax, 0x1d2f350b
imul rax, rax, 0x5db52365
shr rax, 0x3e
cmp eax, 0x2c6344e2
jae 0x1400b8530
mov rsi, rbp
jmp 0x1400b8697
mov rdi, qword [rsp + 0x60]
jmp 0x1400b8697
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rdx
mov qword [rbx], 0
nop word [rax + rax]
mov eax, dword [0x141dd4090]
or eax, dword [0x141dd4094]
add eax, 0xd434a367
imul rax, rax, 0x2db27db9
shr rax, 0x3d
cmp eax, 0xa7ed27d5
ja 0x1400b8580
cmp qword [rsp + 0x98], 0
je 0x1400b867b
mov eax, dword [0x141dd4098]
or eax, dword [0x141dd409c]
or eax, 0x9020410
and eax, 0x4b52843c
imul rax, rax, 0x1c10a6b5
shr rax, 0x39
cmp eax, 0xe0547722
jbe 0x1400b85f0
mov rax, qword [0x141ddb260]
nop word cs:[rax + rax]
mov eax, dword [0x141dd40a0]
sub eax, dword [0x141dd40a4]
and eax, 0x1ed6005f
add eax, 0x6e9e8772
and eax, 0xed468244
mov rcx, qword [0x141ddb260]
cmp eax, 0x77e3bfa5
je 0x1400b85f0
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400b867b
mov eax, dword [0x141dd3fa8]
or eax, dword [0x141dd3fac]
imul eax, eax, 0x31732809
add eax, 0x63f3badc
or eax, 0x59c7a5c3
cmp eax, 0x951d0f8b
jne 0x1400b864b
ud2
xor eax, eax
nop dword [rax]
ud2
ud2
movaps xmm6, xmmword [rsp + 0x120]
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp qword [rsp + 0x98], 0
je 0x1400b86f0
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov eax, dword [0x141dd40b8]
add eax, dword [0x141dd40bc]
or eax, 0x5e080010
and eax, 0xff3d4071
imul eax, eax, 0x7cdf9ff4
cmp eax, 0xed6b147a
je 0x1400b86c0
nop word cs:[rax + rax]
mov eax, dword [0x141dd40c0]
or eax, dword [0x141dd40c4]
add eax, 0xc0beca91
or eax, 0xee3d474d
imul eax, eax, 0xc6183ee7
cmp eax, 0x41d7ca87
je 0x1400b86f0
cmp rbp, 0xffffffffffffffff
je 0x1400b867b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word cs:[rax + rax]
mov eax, dword [0x141dd4100]
and eax, dword [0x141dd4104]
imul rax, rax, 0x1381f247
shr rax, 0x3b
imul eax, eax, 0x4a4561ca
cmp eax, 0x7a7fa946
je 0x1400b8730
jmp 0x1400b867b
mov eax, dword [0x141dd40d8]
or eax, dword [0x141dd40dc]
imul eax, eax, 0xbe29a22f
or eax, 0x1000f024
and eax, 0xd825f4a6
mov rcx, qword [0x141ddb260]
cmp eax, 0xb1ac1742
jae 0x1400b878c
mov rax, qword [0x141ddb260]
jmp 0x1400b8759
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rsp + 0x60]
jmp 0x1400b8697