Function at 0x14000fa20
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, rcx
nop word cs:[rax + rax]
mov eax, dword [0x141dbdb88]
add eax, dword [0x141dbdb8c]
or eax, 0x565d3cdb
xor eax, 0xc537bb4e
imul eax, eax, 0x7159f79d
cmp eax, 0x6fc41815
ja 0x14000fa40
mov rcx, qword [rsi + 0x48]
test rcx, rcx
mov qword [rsp + 0x28], rsi
je 0x140010530
nop word cs:[rax + rax]
mov eax, dword [0x141dbdb90]
xor eax, dword [0x141dbdb94]
imul eax, eax, 0xa71caf2a
add eax, 0x5827a9b0
imul rdx, rax, 0x23b03fb7
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1d
cmp eax, 0x4b561d81
je 0x14000fa80
nop word cs:[rax + rax]
mov eax, dword [0x141dbdb98]
imul eax, dword [0x141dbdb9c]
imul rax, rax, 0xa227561
shr rax, 0x38
imul eax, eax, 0xf38cc37f
cmp eax, 0xbd698a21
je 0x14000fac0
nop word cs:[rax + rax]
mov eax, dword [0x141dbdba0]
xor edx, edx
div dword [0x141dbdba4]
imul eax, eax, 0x920442ad
xor eax, 0x6085806a
add eax, 0x5ae12ed6
cmp eax, 0xaf75b3fd
ja 0x14000faf0
mov r14, qword [rsi + 0x58]
test r14, r14
je 0x14001047d
nop word cs:[rax + rax]
mov eax, dword [0x141dbdba8]
sub eax, dword [0x141dbdbac]
xor eax, 0x663df777
imul rax, rax, 0x42b704f5
shr rax, 0x3e
or eax, 0xb2312b20
cmp eax, 0x35b40b5b
jb 0x14000fb30
mov rdi, qword [rsi + 0x40]
nop dword [rax]
mov eax, dword [0x141dbdbb0]
and eax, dword [0x141dbdbb4]
or eax, 0x2a9cdafc
imul rax, rax, 0x7b62aac5
shr rax, 0x3e
cmp eax, 0x6751f91a
je 0x14000fb60
movdqa xmm0, xmmword [rdi]
lea r8, [rdi + 0x10]
pmovmskb r12d, xmm0
not r12d
nop word cs:[rax + rax]
mov eax, dword [0x141dbdbb8]
and eax, dword [0x141dbdbbc]
imul eax, eax, 0x4072b123
add eax, 0xd27043c2
cmp eax, 0xd28be7c1
ja 0x14000fba0
xor esi, esi
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word [rax + rax]
mov eax, dword [0x141dbdbc0]
and eax, dword [0x141dbdbc4]
add eax, 0xd3b1ae87
and eax, 0xe4244a93
xor eax, 0x66f7c788
cmp eax, 0x6b73c2ed
jb 0x14000fbd0
test r12w, r12w
jne 0x14000fc48
nop dword [rax + rax]
movdqa xmm0, xmmword [r8]
pmovmskb eax, xmm0
add rdi, 0xffffffffffffea00
add r8, 0x10
cmp eax, 0xffff
je 0x14000fc00
mov ecx, dword [0x141dbdbc8]
and ecx, dword [0x141dbdbcc]
imul ecx, ecx, 0xa1b35095
mov edx, 0xc986f74b
imul rcx, rdx
shr rcx, 0x3e
mov r12d, eax
not r12d
cmp ecx, 0xcbe9763b
je 0x14000fc1b
mov qword [rsp + 0x30], r8
mov eax, dword [0x141dbdbd0]
xor eax, dword [0x141dbdbd4]
and eax, 0x7d8abf8b
cmp eax, 0x896c7dc1
je 0x14000fc4d
tzcnt eax, r12d
neg rax
imul rax, rax, 0x160
lea r13, [rdi + rax]
mov qword [rsp + 0x38], rdi
cmp qword [rdi + rax - 0x148], 0
je 0x14000fd1a
mov eax, dword [0x141dbdbd8]
xor edx, edx
div dword [0x141dbdbdc]
imul eax, eax, 0xf03211ba
add eax, 0x18612102
cmp eax, 0xa364c2a5
ja 0x14000fc8c
mov rdi, qword [r13 - 0x140]
mov rbx, qword [0x141dd7fe0]
mov eax, dword [0x141dbdbe0]
imul eax, dword [0x141dbdbe4]
imul eax, eax, 0x914f2d85
imul rax, rax, 0x50fb1e49
shr rax, 0x3e
or eax, 0xc1cbe0ac
cmp eax, 0xf5a05bc4
jne 0x14000fcf0
mov rcx, rbx
xor edx, edx
mov r8, rdi
call r15
nop
mov eax, dword [0x141dbdbe8]
sub eax, dword [0x141dbdbec]
and eax, 0xe041a388
imul ebp, eax, 0xc30c12c4
mov rcx, rbx
xor edx, edx
mov r8, rdi
call r15
cmp ebp, 0xc5140aea
je 0x14000fcf0
lea eax, [r12 - 1]
and eax, r12d
dec r14
mov r12d, eax
mov qword [rsp + 0x40], r14
nop dword [rax]
mov eax, dword [0x141dbdbf0]
imul eax, dword [0x141dbdbf4]
imul eax, eax, 0xdfa06c48
or eax, 0x214dcdb5
cmp eax, 0x41cc6803
ja 0x14000fd30
mov rdi, qword [r13 - 0x120]
mov rbx, qword [r13 - 0x118]
test rbx, rbx
je 0x14000fe36
xor r14d, r14d
nop dword [rax]
mov eax, dword [0x141dbdbf8]
xor edx, edx
div dword [0x141dbdbfc]
test sil, sil
jne 0x14000fd7e
mov rcx, r14
shl rcx, 5
cmp qword [rdi + rcx], 0
je 0x14000fe0a
add rcx, rdi
mov eax, dword [0x141dbdc00]
xor edx, edx
div dword [0x141dbdc04]
add eax, 0x1dcdac28
or eax, 0xfb2030a
add eax, 0xf566bf5a
cmp eax, 0x8bb1eb26
ja 0x14000fd94
mov eax, dword [0x141dbdc08]
or eax, dword [0x141dbdc0c]
mov r8, qword [rcx + 8]
add eax, 0x9d3453d
or eax, 0x1dbcfb8b
cmp eax, 0x11a8e85f
jae 0x14000fde0
mov rax, qword [0x141dd7fe0]
mov eax, dword [0x141dbdc10]
imul eax, dword [0x141dbdc14]
or eax, 0x10000
and eax, 0xb62a0
mov rcx, qword [0x141dd7fe0]
cmp eax, 0x475b0829
je 0x14000fde0
xor edx, edx
call r15
inc r14
nop dword [rax]
mov eax, dword [0x141dbdc18]
and eax, dword [0x141dbdc1c]
add eax, 0xd0a24bfd
xor eax, 0x39545fe9
cmp eax, 0xec978bde
ja 0x14000fe10
cmp r14, rbx
jne 0x14000fd70
cmp qword [r13 - 0x128], 0
je 0x14000fe4f
mov rcx, qword [0x141dd7fe0]
xor edx, edx
mov r8, rdi
call r15
mov eax, dword [0x141dbdc20]
xor edx, edx
div dword [0x141dbdc24]
nop dword [rax]
mov eax, dword [0x141dbdc28]
xor eax, dword [0x141dbdc2c]
imul eax, eax, 0x110b4eaf
xor eax, 0x40820880
or eax, 0x992d3777
cmp eax, 0x43e08a97
je 0x14000fe60
nop word cs:[rax + rax]
test sil, sil
jne 0x14000fe90
mov rax, qword [r13 - 0xf8]
nop dword [rax]
mov ecx, dword [0x141dbdc30]
or ecx, dword [0x141dbdc34]
and ecx, 0xfd2f1acc
imul ecx, ecx, 0xfe4770e3
and ecx, 0x83dd94c0
cmp ecx, 0xfb9906db
ja 0x14000fea0
shl rax, 1
test rax, rax
je 0x14000fef0
mov r8, qword [r13 - 0xf0]
mov rcx, qword [0x141dd7fe0]
xor edx, edx
call r15
nop word cs:[rax + rax]
mov eax, dword [0x141dbdc38]
or eax, dword [0x141dbdc3c]
add eax, 0x3721b431
or eax, 0x1ab91fdd
cmp eax, 0xecd10951
ja 0x14000fef0
mov rax, qword [r13 - 0xd8]
shl rax, 1
test rax, rax
je 0x14000ffb0
mov rdi, qword [r13 - 0xd0]
mov rbx, qword [0x141dd7fe0]
mov eax, dword [0x141dbdc40]
and eax, dword [0x141dbdc44]
or eax, 0x40009049
and eax, 0x4d02b0d9
xor eax, 0x25f2af93
cmp eax, 0x15db6b97
jb 0x14000ff81
mov ebp, dword [str._v__]
or ebp, dword [0x141dbdc4c]
add ebp, 0x819b13bd
or ebp, 0x21901840
and ebp, 0xa5f31963
mov rcx, rbx
xor edx, edx
mov r8, rdi
call r15
cmp ebp, 0xb39ec1b9
jbe 0x14000ff90
mov rcx, rbx
xor edx, edx
mov r8, rdi
call r15
jmp 0x14000ff50
mov eax, dword [0x141dbdc50]
and eax, dword [0x141dbdc54]
imul eax, eax, 0xb1588d6b
cmp eax, 0x6abadf58
je 0x14000ff90
nop dword [rax]
mov eax, dword [0x141dbdc58]
add eax, dword [0x141dbdc5c]
and eax, 0x1faebf36
xor eax, 0x39697a52
imul rax, rax, 0x24b11b87
shr rax, 0x3b
cmp eax, 0x26bb723f
ja 0x14000ffb0
mov rdi, qword [r13 - 0x108]
mov qword [rsp + 0x48], r13
mov rbp, qword [r13 - 0x100]
mov qword [rsp + 0x50], r12
mov r13, r15
nop word cs:[rax + rax]
mov eax, dword [0x141dbdc60]
or eax, dword [0x141dbdc64]
add eax, 0xc4f94e99
xor eax, 0xe59d6238
cmp eax, 0x4792c4e2
ja 0x140010000
test rbp, rbp
je 0x14001014e
xor r15d, r15d
nop dword [rax]
mov rax, r15
shl rax, 5
cmp qword [rdi + rax], 0
je 0x140010130
add rax, rdi
mov ecx, dword [0x141dbdc68]
xor ecx, dword [str.Ac7_a]
xor ecx, 0x4e98421
or ecx, 0xba024b52
cmp ecx, 0x9f14bc38
je 0x140010045
mov rbx, qword [rax + 8]
mov eax, dword [0x141dbdc70]
add eax, dword [str.V_t_N]
and eax, 0xadce058b
add eax, 0x9ffb6e22
or eax, 0x64533154
cmp eax, 0x5c8e7e30
jne 0x1400100a0
mov rax, qword [0x141dd7fe0]
nop word cs:[rax + rax]
mov eax, dword [0x141dbdc78]
sub eax, dword [0x141dbdc7c]
add eax, 0x239d3f69
imul rax, rax, 0x6501e107
shr rax, 0x3e
add eax, 0xff3ac3cf
mov r14, qword [0x141dd7fe0]
cmp eax, 0xc11a60c1
jb 0x1400100a0
mov eax, dword [0x141dbdc80]
or eax, dword [0x141dbdc84]
xor eax, 0xab59a983
add eax, 0xddd8e9a0
cmp eax, 0x64a9bb68
ja 0x140010117
nop dword [rax]
mov eax, dword [0x141dbdc88]
sub eax, dword [0x141dbdc8c]
imul r12d, eax, 0x4d88ba6b
mov rcx, r14
xor edx, edx
mov r8, rbx
call r13
cmp r12d, 0xce1acba3
jne 0x140010130
mov rcx, r14
xor edx, edx
mov r8, rbx
call r13
jmp 0x1400100f0
inc r15
nop word cs:[rax + rax]
test sil, sil
jne 0x140010140
cmp r15, rbp
jne 0x140010030
mov r14, qword [rsp + 0x40]
mov r15, r13
mov r12, qword [rsp + 0x50]
nop dword [rax + rax]
mov eax, dword [str.BX_t:Sw]
imul eax, dword [0x141dbdc94]
add eax, 0xffd0658d
cmp eax, 0x5ee90afe
jb 0x140010160
mov r13, qword [rsp + 0x48]
mov rax, qword [r13 - 0x110]
nop word cs:[rax + rax]
mov ecx, dword [0x141dbdc98]
xor ecx, dword [0x141dbdc9c]
add ecx, 0xb06c1e0f
xor ecx, 0xe18ea036
add ecx, 0x63708f3b
cmp ecx, 0xb94448b6
jb 0x140010190
test rax, rax
je 0x140010220
mov rbx, qword [0x141dd7fe0]
mov eax, dword [0x141dbdca0]
or eax, dword [0x141dbdca4]
add eax, 0x59ad4af2
or eax, 0x17af799d
cmp eax, 0x19dd3c72
je 0x14001020c
nop
mov ebp, dword [0x141dbdca8]
imul ebp, dword [0x141dbdcac]
add ebp, 0xc4bc5248
and ebp, 0x3cd6012
mov rcx, rbx
xor edx, edx
mov r8, rdi
call r15
cmp ebp, 0xb8403b54
jbe 0x140010220
mov rcx, rbx
xor edx, edx
mov r8, rdi
call r15
jmp 0x1400101e0
mov rax, qword [r13 - 0xc0]
nop word [rax + rax]
mov ecx, dword [str.uGmE]
sub ecx, dword [0x141dbdcb4]
and ecx, 0x592b9a5b
add ecx, 0x464132eb
and ecx, 0x43606ee6
cmp ecx, 0xcea00c06
ja 0x140010230
shl rax, 1
test rax, rax
mov rdi, qword [rsp + 0x38]
mov ebx, 0xe9aaa3eb
je 0x1400102ef
nop dword [rax]
mov eax, dword [0x141dbdcb8]
xor edx, edx
div dword [0x141dbdcbc]
and eax, 0x6f77f18c
xor eax, 0x9267ffaa
cmp eax, 0x92ab469d
ja 0x140010270
mov eax, dword [0x141dbdcc0]
or eax, dword [0x141dbdcc4]
add eax, 0x71657820
and eax, 0x2f862912
cmp eax, 0xe156344b
ja 0x1400102e1
nop dword [rax]
mov eax, dword [0x141dbdcc8]
sub eax, dword [0x141dbdccc]
or eax, 0x24ab090d
imul eax, eax, 0x84bc70af
or eax, 0xb51fba93
mov r8, qword [r13 - 0xb8]
mov rcx, qword [0x141dd7fe0]
cmp eax, 0x66690686
jae 0x1400102ea
mov rax, qword [0x141dd7fe0]
jmp 0x1400102b0
xor edx, edx
call r15
mov eax, dword [0x141dbdcd0]
xor edx, edx
div dword [0x141dbdcd4]
nop dword [rax]
mov eax, dword [0x141dbdcd8]
add eax, dword [0x141dbdcdc]
or eax, 0xf6fb51e3
add eax, 0xd3ff05ff
cmp eax, 0x28af636b
jb 0x140010300
mov rax, qword [r13 - 0xa0]
shl rax, 1
test rax, rax
je 0x140010380
test sil, sil
jne 0x140010440
nop word cs:[rax + rax]
mov eax, dword [0x141dbdce0]
sub eax, dword [0x141dbdce4]
xor eax, 0x3af41f9b
add eax, 0xb2074f3b
mov r8, qword [r13 - 0x98]
mov rcx, qword [0x141dd7fe0]
cmp eax, 0xd33b0e8b
ja 0x140010440
xor edx, edx
call r15
nop word cs:[rax + rax]
mov eax, dword [0x141dbdce8]
imul eax, dword [0x141dbdcec]
xor eax, 0xa2922413
imul eax, eax, 0x120dd1d4
add eax, 0x40ca588
cmp eax, 0x9e18932a
jb 0x140010380
test sil, sil
jne 0x1400103a4
mov rax, qword [r13 - 0x60]
test rax, rax
je 0x140010400
lock dec qword [rax]
sete al
nop dword [rax]
mov ecx, dword [0x141dbdcf0]
mov edx, dword [0x141dbdcf4]
add ecx, edx
add ecx, 0x842666fb
imul rcx, rbx
shr rcx, 0x3d
or ecx, 0x820a684
cmp ecx, 0xfd16e4cd
ja 0x1400103c0
test al, al
je 0x140010400
mov rcx, qword [r13 - 0x60]
call fcn.140017760
nop word [rax + rax]
test sil, sil
jne 0x140010400
mov r8, qword [rsp + 0x30]
nop word [rax + rax]
mov eax, dword [0x141dbdcf8]
mov ecx, dword [0x141dbdcfc]
add eax, ecx
add eax, 0x274e3f49
xor eax, 0x8b7a0775
cmp eax, 0xcdb5eea3
jb 0x140010410
test r14, r14
jne 0x14000fbd0
jmp 0x14001044c
mov rax, qword [0x141dd7fe0]
jmp 0x140010340
mov rsi, qword [rsp + 0x28]
mov rcx, qword [rsi + 0x48]
nop word cs:[rax + rax]
mov eax, dword [0x141dbdd00]
and eax, dword [0x141dbdd04]
and eax, 0x61c65ef9
add eax, 0x1158b073
cmp eax, 0x50765d95
jb 0x140010460
lea rax, [rcx + 1]
mov edx, 0x160
mul rdx
add rcx, rax
cmp rcx, 0xffffffffffffffef
je 0x140010530
neg rax
nop dword [rax]
mov ecx, dword [0x141dbdd08]
xor ecx, dword [0x141dbdd0c]
xor ecx, 0x2506101
or ecx, 0xbd8e9cce
add ecx, 0x571dcdb2
cmp ecx, 0x33858147
jb 0x1400104a0
mov r8, qword [rsi + 0x40]
mov ecx, dword [0x141dbdd10]
xor ecx, dword [0x141dbdd14]
add ecx, 0xcfd55872
imul rcx, rcx, 0x279273fd
shr rcx, 0x3d
imul ecx, ecx, 0x72b29564
cmp ecx, 0xad742425
ja 0x14001051c
mov edx, dword [0x141dbdd18]
add edx, dword [0x141dbdd1c]
xor edx, 0xbb377d06
add edx, 0x7d220135
mov rcx, qword [0x141dd7fe0]
cmp edx, 0x197059b7
jae 0x140010525
mov rcx, qword [0x141dd7fe0]
jmp 0x1400104f5
add r8, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 0x993862c3
nop word cs:[rax + rax]
mov eax, dword [0x141dbdd20]
xor edx, edx
div dword [0x141dbdd24]
add eax, 0xeefe7fb4
imul rax, rcx
shr rax, 0x3e
or eax, 0x50e1066d
cmp eax, 0x2ad9d0b1
jb 0x140010540
mov rax, qword [rsi + 0x18]
nop dword [rax + rax]
mov ecx, dword [0x141dbdd28]
imul ecx, dword [0x141dbdd2c]
add ecx, 0x5bc83cf0
xor ecx, 0x2e083870
cmp ecx, 0x4de8595d
jb 0x140010570
shl rax, 1
test rax, rax
je 0x140010630
nop dword [rax]
mov eax, dword [0x141dbdd30]
xor edx, edx
div dword [0x141dbdd34]
or eax, 0xf1dff157
add eax, 0x17d9b15d
cmp eax, 0xd727842b
ja 0x1400105a0
mov r8, qword [rsi + 0x20]
mov eax, dword [0x141dbdd38]
or eax, dword [0x141dbdd3c]
imul eax, eax, 0x8b48a640
mov ecx, 0x854bd831
imul rcx, rax
shr rcx, 0x3b
cmp ecx, 0xd387b0aa
jne 0x140010600
mov rax, qword [0x141dd7fe0]
nop word cs:[rax + rax]
mov eax, dword [0x141dbdd40]
sub eax, dword [0x141dbdd44]
mov rcx, qword [0x141dd7fe0]
cmp eax, 0xd43a0d52
je 0x140010600
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov eax, dword [0x141dbdd48]
imul eax, dword [0x141dbdd4c]
add eax, 0xb02dc9df
cmp eax, 0xaf39276b
ja 0x140010630
mov r14, qword [rsi + 8]
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1400109f5
xor r15d, r15d
mov r12d, 0x91df679b
mov r13d, 0x81137b0d
mov rbp, qword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
mov qword [rsp + 0x30], r14
nop dword [rax]
mov qword [rsp + 0x40], rsi
imul rax, rsi, 0x70
lea rdi, [r14 + rax]
cmp qword [r14 + rax], 0
je 0x14001077a
nop dword [rax + rax]
test r15b, r15b
jne 0x1400106a0
mov rbx, qword [rdi + 8]
mov eax, dword [0x141dbdd50]
sub eax, dword [0x141dbdd54]
xor eax, 0x7faaab4e
mov ecx, 0xaa4b705d
imul rax, rcx
shr rax, 0x3b
add eax, 0xd1a7aa69
cmp eax, 0xe006909b
ja 0x14001070a
nop word cs:[rax + rax]
mov eax, dword [0x141dbdd58]
add eax, dword [0x141dbdd5c]
imul eax, eax, 0x8bad47db
or eax, 0x21ac753e
and eax, 0x61ff7f7f
mov r14, qword [0x141dd7fe0]
cmp eax, 0xf4330246
jbe 0x140010720
mov rax, qword [0x141dd7fe0]
jmp 0x1400106e0
mov eax, dword [0x141dbdd60]
imul eax, dword [0x141dbdd64]
imul eax, eax, 0x5b7b7821
add eax, 0xd027f7c9
cmp eax, 0x6a492844
jbe 0x140010750
mov rcx, r14
xor edx, edx
mov r8, rbx
call rbp
nop dword [rax]
mov esi, dword [0x141dbdd68]
xor esi, dword [0x141dbdd6c]
xor esi, 0xbd2a67e0
add esi, 0x48b03c99
mov rcx, r14
xor edx, edx
mov r8, rbx
call rbp
cmp esi, 0x577b99b8
ja 0x140010750
mov rsi, qword [rsp + 0x40]
inc rsi
nop word cs:[rax + rax]
mov eax, dword [0x141dbdd70]
xor eax, dword [0x141dbdd74]
imul rax, r12
shr rax, 0x3c
cmp eax, 0x6cbc532f
je 0x140010790
cmp qword [rdi + 0x18], 0
je 0x1400107f2
mov r8, qword [rdi + 0x20]
mov rcx, qword [0x141dd7fe0]
xor edx, edx
call rbp
nop word cs:[rax + rax]
mov eax, dword [0x141dbdd78]
and eax, dword [0x141dbdd7c]
xor eax, 0xd0c01000
or eax, 0x282ba79f
xor eax, 0x2edf6fd2
cmp eax, 0xe4e67929
ja 0x1400107d0
mov r14, qword [rsp + 0x30]
nop word [rax + rax]
mov eax, dword [0x141dbdd80]
and eax, dword [0x141dbdd84]
imul eax, eax, 0x5844468d
add eax, 0xfe58b14b
cmp eax, 0x134effb9
jb 0x140010800
nop
mov eax, dword [0x141dbdd88]
or eax, dword [str.WE7_]
imul eax, eax, 0xa4d10a
add eax, 0x47b4712c
or eax, 0x257dc84
cmp eax, 0x6321a528
jb 0x140010820
mov rax, qword [rdi + 0x48]
nop word [rax + rax]
mov ecx, dword [0x141dbdd90]
sub ecx, dword [0x141dbdd94]
imul rcx, rcx, 0x2da788f
shr rcx, 0x38
cmp ecx, 0xc40eeb5a
je 0x140010850
shl rax, 1
test rax, rax
je 0x140010900
nop dword [rax + rax]
mov eax, dword [0x141dbdd98]
or eax, dword [0x141dbdd9c]
or eax, 0xb7090d95
imul eax, eax, 0x47834d0b
cmp eax, 0x275733a3
je 0x140010880
mov r8, qword [rdi + 0x50]
mov eax, dword [0x141dbdda0]
sub eax, dword [0x141dbdda4]
and eax, 0x3ebdc8d4
imul eax, eax, 0x30d2866
or eax, 0x543797a7
cmp eax, 0x81084ae4
jne 0x1400108d0
mov rax, qword [0x141dd7fe0]
nop dword [rax]
mov eax, dword [0x141dbdda8]
xor edx, edx
div dword [0x141dbddac]
add eax, 0x53b65986
and eax, 0xc3e6c0bb
add eax, 0x398f2207
mov rcx, qword [0x141dd7fe0]
cmp eax, 0x22f2d7fc
jb 0x1400108d0
xor edx, edx
call rbp
nop
mov eax, dword [0x141dbddb0]
or eax, dword [0x141dbddb4]
imul eax, eax, 0xbfd42859
add eax, 0x5dbf12e
imul rax, r13
shr rax, 0x3f
cmp eax, 0xd8a986ca
ja 0x140010900
mov rax, qword [rdi + 0x30]
nop word [rax + rax]
test r15b, r15b
jne 0x140010930
test rax, rax
je 0x1400109a2
mov eax, dword [0x141dbddb8]
imul eax, dword [0x141dbddbc]
mov ecx, 0xdb3b3db5
imul rax, rcx
shr rax, 0x3e
add eax, 0x9c2a0ef2
and eax, 0x82a08c1
cmp eax, 0xe8486814
je 0x14001093a
nop word cs:[rax + rax]
mov eax, dword [0x141dbddc0]
and eax, dword [0x141dbddc4]
imul eax, eax, 0xb73ed13e
add eax, 0xae317ce4
or eax, 0xb578d15e
cmp eax, 0xb809599e
jb 0x140010970
mov r8, qword [rdi + 0x38]
mov rcx, qword [0x141dd7fe0]
xor edx, edx
call rbp
mov eax, dword [0x141dbddc8]
sub eax, dword [0x141dbddcc]
or eax, 0xa2c9e732
imul rax, rax, 0x41af2359
shr rax, 0x3e
add eax, 0xe9ab31ad
cmp eax, 0x8ddc8743
jb 0x1400109a2
nop word [rax + rax]
mov eax, dword [0x141dbddd0]
xor edx, edx
div dword [0x141dbddd4]
add eax, 0x777f049c
cmp eax, 0xf76f051e
ja 0x1400109d0
cmp rsi, qword [rsp + 0x38]
jne 0x140010680
mov r13, qword [rsp + 0x28]
mov rax, qword [r13]
nop
mov ecx, dword [0x141dbddd8]
imul ecx, dword [0x141dbdddc]
xor ecx, 0x8fbc375
imul ecx, ecx, 0xfad4edd0
and ecx, 0xc185e290
cmp ecx, 0x89aba8c7
ja 0x140010a00
test rax, rax
je 0x140010aa0
mov rbx, qword [0x141dd7fe0]
mov eax, dword [0x141dbdde0]
xor eax, dword [0x141dbdde4]
or eax, 0x736e880
imul eax, eax, 0xe633ebf4
or eax, 0x970fd954
cmp eax, 0x834490dc
jb 0x140010a85
mov esi, dword [0x141dbdde8]
imul esi, dword [0x141dbddec]
add esi, 0xfb2583b0
and esi, 0x8857e2e1
mov rcx, rbx
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, 0xe01f9099
jbe 0x140010aa0
mov rcx, rbx
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140010a56
mov eax, dword [0x141dbddf0]
imul eax, dword [0x141dbddf4]
imul rax, rax, 0x7c2a90ad
shr rax, 0x3e
or eax, 0xed7e9886
cmp eax, 0xc31f7649
jb 0x140010aa0
nop word cs:[rax + rax]
mov eax, dword [0x141dbddf8]
imul eax, dword [0x141dbddfc]
add eax, 0x3b9d71de
xor eax, 0x10018110
or eax, 0xcf1e5ead
cmp eax, 0x6f63347a
je 0x140010ad0
mov rsi, qword [r13 + 0x90]
test rsi, rsi
je 0x140011129
mov eax, dword [0x141dbde00]
xor edx, edx
div dword [0x141dbde04]
mov eax, 0x8209e6e5
nop word cs:[rax + rax]
mov ecx, dword [0x141dbde08]
or ecx, dword [0x141dbde0c]
xor ecx, 0x2ca1143b
imul ecx, ecx, 0x14159f63
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0xd174833
je 0x140010b20
mov rbx, qword [r13 + 0xa8]
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140010b60
test rbx, rbx
je 0x140010cac
lea rdi, [rsi + 0x10]
nop word cs:[rax + rax]
mov eax, dword [0x141dbde10]
add eax, dword [0x141dbde14]
cmp eax, 0x669062ad
je 0x140010b80
mov eax, 0xaee2049b
nop dword [rax + rax]
mov ecx, dword [0x141dbde18]
imul ecx, dword [0x141dbde1c]
imul rcx, rax
shr rcx, 0x3e
add ecx, 0x3662efd9
xor ecx, 0xc7fd056e
cmp ecx, 0xe75e66e1
jb 0x140010ba0
movdqa xmm0, xmmword [rsi]
pmovmskb eax, xmm0
not eax
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x140010be0
mov r14, qword [sym.imp.pdh.dll_PdhRemoveCounter]
mov r15, rsi
mov r12, rbx
jmp 0x140010c20
tzcnt eax, eax
shl rax, 5
mov rcx, r15
sub rcx, rax
mov rcx, qword [rcx - 8]
call r14
mov eax, ebp
dec r12
je 0x140010cac
test ax, ax
je 0x140010c80
mov ecx, dword [0x141dbde20]
xor ecx, dword [0x141dbde24]
and ecx, 0x16f9f17f
add ecx, 0xaa1c542c
or ecx, 0x29235e1f
cmp ecx, 0x8778523
jb 0x140010c25
lea ebp, [rax - 1]
nop
mov ecx, dword [0x141dbde28]
mov edx, dword [0x141dbde2c]
add ecx, edx
add ecx, 0x961b11b0
or ecx, 0x24100248
and ecx, 0x345886ca
cmp ecx, 0xf21a21b2
jae 0x140010c50
and ebp, eax
jmp 0x140010c00
movdqa xmm0, xmmword [rdi]
pmovmskb eax, xmm0
add r15, 0xfffffffffffffe00
add rdi, 0x10
cmp eax, 0xffff
je 0x140010c80
mov ecx, 0xfffffffe
sub ecx, eax
not eax
mov ebp, eax
and ebp, ecx
jmp 0x140010c00
xor eax, eax
nop
test al, al
jne 0x140010cb0
mov rdi, qword [r13 + 0xc8]
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140010d00
mov eax, dword [0x141dbde40]
xor edx, edx
div dword [0x141dbde44]
imul eax, eax, 0xeae9729f
add eax, 0xd4649d82
or eax, 0x84aa8213
cmp eax, 0xd5def4f1
jbe 0x14001113a
jmp 0x140011149
mov eax, dword [0x141dbde30]
xor eax, dword [0x141dbde34]
or eax, 0x97fe7dff
cmp eax, 0x24f8a213
je 0x140010d00
mov rdi, qword [r13 + 0xc0]
mov eax, 0xb31332eb
nop word cs:[rax + rax]
mov ecx, dword [0x141dbde38]
sub ecx, dword [0x141dbde3c]
imul ecx, ecx, 0xca5191a8
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x213e46ac
ja 0x140010d30
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140010db0
mov eax, dword [0x141dbde60]
imul eax, dword [0x141dbde64]
cmp eax, 0xa03325a4
jne 0x140010d79
mov rcx, rdi
call qword [sym.imp.pdh.dll_PdhCloseQuery]
mov r14, qword [sym.imp.pdh.dll_PdhCloseQuery]
mov eax, dword [0x141dbde68]
sub eax, dword [0x141dbde6c]
or eax, 0x5544509c
imul ebp, eax, 0xe183a708
add ebp, 0x5084a410
mov rcx, rdi
call r14
cmp ebp, 0x79f7b39
jb 0x140010d80
nop dword [rax + rax]
mov eax, dword [0x141dbde70]
or eax, dword [0x141dbde74]
imul eax, eax, 0x4c792d46
add eax, 0xe7a887ce
cmp eax, 0x54f2c627
jb 0x140010db0
mov eax, 0xd6030445
nop word cs:[rax + rax]
mov ecx, dword [0x141dbde78]
xor ecx, dword [0x141dbde7c]
imul rcx, rax
shr rcx, 0x3e
add ecx, 0xdcc93a01
and ecx, 0x80092003
cmp ecx, 0xb671cd5
jb 0x140010de0
mov r14, qword [r13 + 0x98]
test r14, r14
je 0x140011129
test rbx, rbx
je 0x140010fe6
movdqa xmm0, xmmword [rsi]
pmovmskb r15d, xmm0
not r15d
lea r12, [rsi + 0x10]
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140010e40
nop word cs:[rax + rax]
mov eax, dword [0x141dbde80]
imul eax, dword [0x141dbde84]
imul eax, eax, 0x2c5fcd30
cmp eax, 0xe80b5242
ja 0x140010e50
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov eax, dword [0x141dbde88]
xor eax, dword [0x141dbde8c]
imul eax, eax, 0x3a5d6d
or eax, 0x9bbf764c
imul rcx, rax, 0xc8961b1
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
cmp eax, 0x5d8cad91
ja 0x140010e80
test r15w, r15w
jne 0x140010ee2
nop dword [rax + rax]
movdqa xmm0, xmmword [r12]
pmovmskb r15d, xmm0
add rsi, 0xfffffffffffffe00
add r12, 0x10
cmp r15d, 0xffff
je 0x140010ec0
not r15d
tzcnt ecx, r15d
shl rcx, 5
mov rax, rsi
sub rax, rcx
cmp qword [rax - 0x20], 0
je 0x140010fa0
mov ecx, dword [0x141dbde90]
or ecx, dword [0x141dbde94]
xor ecx, 0x5b870439
imul ecx, ecx, 0xc64b28bd
cmp ecx, 0x7fcb6cb5
ja 0x140010efc
mov ecx, dword [0x141dbde98]
xor ecx, dword [0x141dbde9c]
mov rdi, qword [rax - 0x18]
xor ecx, 0x82184d11
and ecx, 0x9298dd11
cmp ecx, 0xa9339330
jne 0x140010f50
mov rcx, qword [0x141dd7fe0]
xor edx, edx
mov r8, rdi
call r13
nop
mov eax, dword [0x141dbdea0]
and eax, dword [0x141dbdea4]
or eax, 0xafd78fff
imul ebp, eax, 0xc8affd37
mov rcx, qword [0x141dd7fe0]
xor edx, edx
mov r8, rdi
call r13
cmp ebp, 0x74687d62
je 0x140010f50
nop
mov eax, dword [0x141dbdea8]
xor edx, edx
div dword [0x141dbdeac]
and eax, 0x21767678
imul eax, eax, 0xa2546cbd
cmp eax, 0xc96c24cc
je 0x140010f80
lea eax, [r15 - 1]
and eax, r15d
mov r15d, eax
dec rbx
mov eax, dword [0x141dbdeb0]
xor edx, edx
div dword [0x141dbdeb4]
mov eax, dword [0x141dbdeb8]
or eax, dword [0x141dbdebc]
xor eax, 0x55c92dd9
add eax, 0x87d18010
and eax, 0x514a6891
cmp eax, 0x4844c48b
ja 0x140010fbb
test rbx, rbx
jne 0x140010e80
mov rax, r14
shl rax, 5
nop dword [rax]
mov ecx, dword [0x141dbdec0]
sub ecx, dword [0x141dbdec4]
add ecx, 0x30d9a65a
xor ecx, 0x67a6126d
cmp ecx, 0x3cfd4aa5
jb 0x140010ff0
lea rcx, [rax + 0x20]
add r14, 0x11
add rcx, r14
mov r8, qword [rsp + 0x28]
mov edx, dword [0x141dbdec8]
sub edx, dword [0x141dbdecc]
or edx, 0x105d741c
imul rdx, rdx, 0x1130886b
shr rdx, 0x3b
and edx, 1
cmp edx, 0x50d3e51f
ja 0x140011020
test rcx, rcx
je 0x140011129
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x140011060
mov rsi, qword [r8 + 0x90]
mov rdi, 0xffffffffffffffe0
sub rdi, rax
nop word cs:[rax + rax]
mov eax, dword [0x141dbded0]
imul eax, dword [0x141dbded4]
imul rax, rax, 0x1b95581
shr rax, 0x38
xor eax, 0xa8fcf455
imul eax, eax, 0xc2e2c9e2
cmp eax, 0xb328f14d
jb 0x140011080
mov eax, dword [0x141dbded8]
imul eax, dword [0x141dbdedc]
and eax, 0xa9542d20
add eax, 0x6d524f17
cmp eax, 0x480fea48
jae 0x1400110db
lea r8, [rsi + rdi]
mov rcx, qword [0x141dd7fe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, 0x914ec44b
add rsi, rdi
mov rdi, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word [rax + rax]
mov eax, dword [0x141dbdee0]
add eax, dword [0x141dbdee4]
imul r14d, eax, 0xe41f038a
xor r14d, 0xe885a333
imul r14, rbx
shr r14, 0x3f
mov rcx, qword [0x141dd7fe0]
xor edx, edx
mov r8, rsi
call rdi
cmp r14d, 0xd72b7089
ja 0x1400110f0
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
test cl, cl
je 0x140011160
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001113a
mov ecx, dword [0x141dbde48]
or ecx, dword [0x141dbde4c]
xor ecx, 0xad239a8f
imul ecx, ecx, 0xdb9d9790
cmp ecx, 0x2ebe6670
ja 0x140011160
test eax, eax
jne 0x140010d00
mov eax, dword [0x141dbde50]
and eax, dword [0x141dbde54]
xor eax, 0x63edf65e
imul rax, rax, 0x4d18f6f7
shr rax, 0x3d
imul eax, eax, 0x73656c39
cmp eax, 0xa8408d05
je 0x1400111d5
mov eax, dword [0x141dbde58]
or eax, dword [0x141dbde5c]
imul edi, eax, 0xfcfa657c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x97319dc9
jne 0x140010d00
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400111b1