Function at 0x140004b10
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x618
call fcn.1400e90b0
test al, al
jne 0x140005ba3
lea rsi, [rsp + 0x5f8]
mov rcx, rsi
call fcn.1400f8f90
mov rcx, rsi
call fcn.1400c5ef0
mov rsi, rax
mov rdi, rdx
lea rax, [0x140149f46]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x158]
mov rcx, qword [rsp + 0x158]
movabs rax, 0xcbbe830710fdf018
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x158]
mov rdx, qword [rsp + 0x158]
call fcn.140004520
movabs rcx, 0x590ae043ab5e54c0
xor rcx, qword [rax]
movzx edx, byte [rax + 0xa]
movzx eax, word [rax + 8]
mov r8d, eax
shr r8d, 8
xor al, 0x82
xor r8b, 0xda
movzx eax, al
movzx r8d, r8b
shl r8d, 8
or r8d, eax
xor dl, 0x52
mov qword [rsp + 0x158], rcx
mov word [rsp + 0x160], r8w
mov byte [rsp + 0x162], dl
mov qword [rsp + 0x20], 0xb
lea rcx, [rsp + 0x118]
lea r9, [rsp + 0x158]
mov rdx, rsi
mov r8, rdi
call fcn.1400ffd20
mov rdi, qword [rsp + 0x120]
mov rsi, qword [rsp + 0x128]
test rsi, rsi
je 0x140004c47
js 0x140005d4b
movzx eax, byte [0x140214be1]
mov edx, 1
mov rcx, rsi
call fcn.14000f6f0
mov rbx, rax
test rax, rax
jne 0x140004c4c
mov ecx, 1
mov rdx, rsi
call fcn.14014ad70
mov ebx, 1
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140145bd0
mov qword [rsp + 0x3a8], rsi
mov qword [rsp + 0x3b0], rbx
mov qword [rsp + 0x3b8], rsi
movzx eax, byte [rsp + 0x130]
mov byte [rsp + 0x3c0], al
mov dword [rsp + 0x158], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x160], xmm0
mov dword [rsp + 0x170], 7
mov qword [rsp + 0x174], 0
mov word [rsp + 0x17c], 0
mov byte [rsp + 0x179], 1
mov byte [rsp + 0x17c], 1
mov byte [rsp + 0x17b], 1
lea rcx, [rsp + 0x3a8]
call fcn.1400c5ef0
mov r8, rdx
lea rcx, [rsp + 0x158]
mov rdx, rax
call fcn.1400f9f40
mov rdi, rax
mov rsi, rdx
mov rdx, qword [rsp + 0x3a8]
test rdx, rdx
je 0x140004d16
mov rcx, qword [rsp + 0x3b0]
mov r8d, 1
call fcn.14000f700
test rdi, rdi
jne 0x140005c48
mov qword [rsp + 0xb8], rsi
lea rax, [0x14014d3cc]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x158]
mov rcx, qword [rsp + 0x158]
movabs rax, 0x807cbf8aba57529a
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x158]
mov rdx, qword [rsp + 0x158]
call fcn.1400047d0
mov rsi, rax
lea rcx, [rsp + 0x158]
mov r8d, 0x248
xor edx, edx
call fcn.140146270
mov rax, 0xfffffffffffffff8
lea rcx, [0x14014d658]
nop word cs:[rax + rax]
mov rdx, qword [rax + rcx + 8]
xor rdx, qword [rsi + rax + 8]
mov qword [rsp + rax + 0x160], rdx
add rax, 8
cmp rax, 0x240
jb 0x140004da0
movzx eax, byte [rsi + 0x24a]
movzx ecx, word [rsi + 0x248]
mov edx, ecx
shr edx, 8
xor cl, 0x27
xor dl, 0xd2
movzx ecx, cl
movzx edx, dl
shl edx, 8
or edx, ecx
mov word [rsp + 0x3a0], dx
xor al, 0xe7
mov byte [rsp + 0x3a2], al
lea rcx, [rsp + 0x3a8]
lea rdx, [rsp + 0x158]
mov r8d, 0x24b
call fcn.140145bd0
movzx eax, byte [0x140214be1]
mov ecx, 0x24b
mov edx, 1
call fcn.14000f6f0
test rax, rax
je 0x140005c59
mov rbp, rax
mov r13, rax
lea rsi, [rsp + 0x3a8]
mov r8d, 0x24b
mov rcx, rbp
mov rdx, rsi
call fcn.140145bd0
lea rax, [0x14014d42b]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x158]
mov rcx, qword [rsp + 0x158]
movabs rax, 0xf07a26ec6a594c7a
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x158]
mov rdx, qword [rsp + 0x158]
call fcn.140003e90
movzx eax, word [rax]
mov ecx, eax
xor cl, 0x95
shr eax, 8
xor al, 0xf6
movzx ecx, cl
movzx eax, al
shl eax, 8
or eax, ecx
mov word [rsp + 0x3e], ax
lea rcx, [rsp + 0x158]
call fcn.1400f92b0
movabs rax, 0x8000000000000000
cmp qword [rsp + 0x158], rax
je 0x140005c68
movups xmm0, xmmword [rsp + 0x158]
movups xmm1, xmmword [rsp + 0x168]
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call fcn.1400c5ef0
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], rdx
mov qword [rsp + 0x3a8], 0
mov qword [rsp + 0x3b0], 1
mov qword [rsp + 0x3b8], 0
mov qword [rsp + 0x188], 0x20
mov byte [rsp + 0x190], 3
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x168], 0
mov qword [rsp + 0x178], rsi
lea r14, [0x14014d3e0]
mov qword [rsp + 0x180], r14
lea rcx, [rsp + 0x148]
lea rdx, [rsp + 0x158]
call fcn.1400ffe90
test al, al
jne 0x140005c1c
mov rsi, qword [rsp + 0x3a8]
mov rdi, qword [rsp + 0x3b0]
mov r8, qword [rsp + 0x3b8]
lea rbx, [rsp + 0x158]
mov rcx, rbx
mov rdx, rdi
call fcn.1401268b0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 1
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x3d8], 0x20
mov byte [rsp + 0x3e0], 3
mov qword [rsp + 0x3a8], 0
mov qword [rsp + 0x3b8], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x3c8], rax
mov qword [rsp + 0x3d0], r14
lea rdx, [rsp + 0x3a8]
mov rcx, rbx
call fcn.140129e00
test al, al
jne 0x140005c1c
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0xc0], xmm0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x138], rax
lea rax, [0x140004af0]
mov qword [rsp + 0x140], rax
lea rax, [0x14014d8a8]
mov qword [rsp + 0x3a8], rax
mov qword [rsp + 0x3b0], 1
mov qword [rsp + 0x3c8], 0
lea rax, [rsp + 0x138]
mov qword [rsp + 0x3b8], rax
mov qword [rsp + 0x3c0], 1
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x3a8]
call fcn.140117840
mov rdx, qword [rsp + 0xc0]
test rdx, rdx
je 0x1400050dc
mov rcx, qword [rsp + 0xc8]
mov r8d, 1
call fcn.14000f700
test rsi, rsi
je 0x1400050f2
mov r8d, 1
mov rcx, rdi
mov rdx, rsi
call fcn.14000f700
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x14000510c
mov rcx, qword [rsp + 0x78]
mov r8d, 1
call fcn.14000f700
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x70], xmm0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x70]
call fcn.1401187f0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x3a8], 0
mov qword [rsp + 0x3b0], 1
mov qword [rsp + 0x3b8], 0
mov qword [rsp + 0x20], 2
lea rcx, [rsp + 0x158]
lea r9, [rsp + 0x3e]
mov r8d, 0x24b
mov rdx, r13
call fcn.140125d00
mov r12, qword [rsp + 0x160]
mov r11, qword [rsp + 0x170]
mov r10, qword [rsp + 0x1a0]
mov r14, qword [rsp + 0x1a8]
cmp qword [rsp + 0x158], 0
mov qword [rsp + 0x60], r10
mov qword [rsp + 0x108], r13
mov qword [rsp + 0xa0], rbp
je 0x1400055a9
mov rsi, qword [rsp + 0x180]
mov rdi, qword [rsp + 0x1b8]
lea rbx, [rdi - 1]
lea rax, [rbx + rsi]
cmp rax, r14
jae 0x1400055b2
mov rcx, qword [rsp + 0x178]
mov qword [rsp + 0xa8], rcx
mov r13, qword [rsp + 0x190]
mov rbp, qword [rsp + 0x1b0]
mov rcx, rdi
sub rcx, r11
mov qword [rsp + 0xe0], rcx
lea rcx, [r12 - 1]
mov qword [rsp + 0x98], rcx
cmp rcx, rdi
setb byte [rsp + 0x2f]
mov rcx, r12
neg rcx
mov qword [rsp + 0x100], rcx
lea rcx, [r10 + r12]
mov qword [rsp + 0xd8], rcx
lea rcx, [r12 + rbp]
mov qword [rsp + 0x110], rcx
lea rcx, [rbp + r12 - 1]
mov qword [rsp + 0xe8], rcx
mov ecx, 1
mov qword [rsp + 0x30], rcx
xor r15d, r15d
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf8], r11
cmp r13, 0xffffffffffffffff
jne 0x1400052c3
mov r13, qword [rsp + 0xd8]
jmp 0x1400053a6
add rsi, rdi
xor r13d, r13d
lea rax, [rsi + rbx]
cmp rax, r14
jae 0x1400055c6
movzx eax, byte [r10 + rax]
mov rcx, qword [rsp + 0xa8]
bt rcx, rax
jae 0x1400052b0
cmp r12, r13
mov rax, r13
cmova rax, r12
lea rcx, [r10 + rsi]
mov rdx, rax
nop word [rax + rax]
cmp rdx, rdi
jae 0x140005330
lea r8, [rsi + rdx]
cmp r8, r14
jae 0x140005c00
lea r8, [rdx + 1]
movzx r9d, byte [rbp + rdx]
cmp r9b, byte [rcx + rdx]
mov rdx, r8
je 0x1400052f0
add rsi, qword [rsp + 0x100]
add rsi, r8
jmp 0x1400052b3
mov rax, r12
nop word cs:[rax + rax]
cmp r13, rax
jae 0x140005460
dec rax
cmp rax, rdi
jae 0x140005597
lea rcx, [rax + rsi]
cmp rcx, r14
jae 0x140005bee
movzx edx, byte [rbp + rax]
cmp dl, byte [r10 + rcx]
je 0x140005340
add rsi, r11
mov r13, qword [rsp + 0xe0]
lea rax, [rsi + rbx]
cmp rax, r14
jb 0x1400052c3
jmp 0x1400055c6
add rsi, rdi
mov rdx, rsi
lea rax, [rdx + rbx]
mov rsi, rdx
cmp rax, r14
jae 0x1400055c6
movzx eax, byte [r10 + rax]
mov rcx, qword [rsp + 0xa8]
bt rcx, rax
jae 0x140005390
xor eax, eax
mov rcx, rsi
nop
lea rdx, [r12 + rax]
cmp rdx, rdi
jae 0x140005400
lea rdx, [r12 + rcx]
cmp rdx, r14
jae 0x140005bfd
mov rdx, qword [rsp + 0x110]
movzx r8d, byte [rdx + rax]
lea rdx, [rcx + 1]
inc rax
cmp r8b, byte [r13 + rcx]
mov rcx, rdx
je 0x1400053c0
jmp 0x140005396
test byte [rsp + 0x2f], 1
je 0x14000557f
mov rax, qword [rsp + 0x98]
lea rcx, [rax + rsi]
mov rax, qword [rsp + 0xe8]
mov rdx, r12
nop word cs:[rax + rax]
sub rdx, 1
jb 0x140005470
cmp rcx, r14
jae 0x140005bee
movzx r8d, byte [rax]
dec rax
lea r9, [rcx - 1]
cmp r8b, byte [r10 + rcx]
mov rcx, r9
je 0x140005430
add rsi, r11
jmp 0x140005393
xor r13d, r13d
jmp 0x140005477
mov r13, 0xffffffffffffffff
mov rbx, rsi
mov rdx, qword [rsp + 0x40]
sub rbx, rdx
mov rax, qword [rsp + 0x3a8]
sub rax, r15
cmp rax, rbx
jb 0x14000552d
add rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x30]
add rcx, r15
mov r8, rbx
call fcn.140145bd0
add r15, rbx
mov qword [rsp + 0x3b8], r15
mov rax, qword [rsp + 0x3a8]
sub rax, r15
mov rbx, qword [rsp + 0xb0]
cmp rax, rbx
jb 0x14000555f
add rsi, rdi
mov rax, qword [rsp + 0x3b0]
mov qword [rsp + 0x30], rax
lea rcx, [rax + r15]
mov rdx, qword [rsp + 0x68]
mov r8, rbx
call fcn.140145bd0
add r15, rbx
mov qword [rsp + 0x3b8], r15
mov rbx, qword [rsp + 0xf0]
lea rax, [rsi + rbx]
mov qword [rsp + 0x40], rsi
cmp rax, r14
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0xf8]
jb 0x140005290
jmp 0x140005801
lea rcx, [rsp + 0x3a8]
mov rdx, r15
mov r8, rbx
call fcn.140147610
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x3b0]
mov qword [rsp + 0x30], rax
mov r15, qword [rsp + 0x3b8]
jmp 0x140005496
lea rcx, [rsp + 0x3a8]
mov rdx, r15
mov r8, rbx
call fcn.140147610
mov r15, qword [rsp + 0x3b8]
jmp 0x1400054d5
mov r13, 0xffffffffffffffff
test r12, r12
je 0x140005477
mov rax, qword [rsp + 0x98]
lea r8, [0x14014d500]
mov rcx, rax
mov rdx, rdi
call fcn.14014b020
test r11d, 0xff0000
je 0x1400055d0
mov eax, 1
mov qword [rsp + 0x30], rax
xor r15d, r15d
xor esi, esi
jmp 0x140005801
mov rsi, qword [rsp + 0x40]
jmp 0x140005801
mov ebx, 1
xor r15d, r15d
xor esi, esi
jmp 0x14000560f
mov rbx, qword [rsp + 0x3b0]
lea rcx, [rbx + r15]
mov rdx, qword [rsp + 0x68]
mov r8, rsi
call fcn.140145bd0
add r15, rsi
mov qword [rsp + 0x3b8], r15
mov rsi, r12
mov r10, qword [rsp + 0x60]
mov r11, rdi
test r12, r12
je 0x140005636
cmp r12, r14
jae 0x140005630
cmp byte [r10 + r12], 0xc0
jge 0x140005636
jmp 0x140005d2c
jne 0x140005d2c
cmp r12, r14
jne 0x140005650
test r11b, r11b
je 0x1400057fc
mov rdx, rbx
xor r11b, 1
mov r12, r14
jmp 0x140005678
movzx edx, byte [r10 + r12]
movzx ecx, dl
test cl, cl
js 0x1400056f0
mov eax, ecx
test r11b, r11b
je 0x14000574d
mov rcx, r12
mov rdx, rbx
xor r11b, 1
mov r12, rcx
mov rdi, r11
mov rbx, r12
sub rbx, rsi
mov rax, qword [rsp + 0x3a8]
sub rax, r15
cmp rax, rbx
jb 0x140005794
add rsi, rbp
mov rcx, rdx
add rcx, r15
mov rdx, rsi
mov r8, rbx
call fcn.140145bd0
add r15, rbx
mov qword [rsp + 0x3b8], r15
mov rax, qword [rsp + 0x3a8]
sub rax, r15
mov rsi, qword [rsp + 0xb0]
cmp rax, rsi
jae 0x1400055e0
lea rcx, [rsp + 0x3a8]
mov rdx, r15
mov r8, rsi
call fcn.140147610
mov r15, qword [rsp + 0x3b8]
jmp 0x1400055e0
mov eax, ecx
and eax, 0x1f
movzx r8d, byte [r10 + r12 + 1]
and r8d, 0x3f
cmp cl, 0xe0
jb 0x14000573e
movzx ecx, byte [r10 + r12 + 2]
shl r8d, 6
and ecx, 0x3f
or ecx, r8d
cmp dl, 0xf0
jb 0x1400057e9
movzx edx, byte [r10 + r12 + 3]
and eax, 7
shl eax, 0x12
shl ecx, 6
and edx, 0x3f
or edx, ecx
or eax, edx
test r11b, r11b
jne 0x14000566b
jmp 0x14000574d
shl eax, 6
or eax, r8d
test r11b, r11b
jne 0x14000566b
cmp eax, 0x110000
je 0x1400057fc
mov ecx, 1
cmp eax, 0x80
jb 0x14000577e
mov ecx, 2
cmp eax, 0x800
jb 0x14000577e
cmp eax, 0x10000
mov ecx, 4
sbb rcx, 0
add rcx, r12
je 0x1400057c2
cmp rcx, r14
jae 0x1400057bc
cmp byte [r10 + rcx], 0xc0
jge 0x1400057c2
jmp 0x140005d29
lea rcx, [rsp + 0x3a8]
mov rdx, r15
mov r8, rbx
call fcn.140147610
mov rdx, qword [rsp + 0x3b0]
mov r15, qword [rsp + 0x3b8]
jmp 0x140005695
jne 0x140005d29
cmp rcx, r14
jne 0x1400057d2
mov rdx, rbx
xor r11d, r11d
jmp 0x14000564b
movzx eax, byte [r10 + rcx]
mov r11b, 1
test al, al
jns 0x14000566e
cmp al, 0xe0
jmp 0x14000566e
shl eax, 0xc
or eax, ecx
test r11b, r11b
jne 0x14000566b
jmp 0x14000574d
mov qword [rsp + 0x30], rbx
mov rdx, qword [rsp + 0xa0]
add rdx, rsi
mov edi, 0x24b
sub rdi, rsi
mov rsi, qword [rsp + 0x3a8]
mov rax, rsi
sub rax, r15
cmp rax, rdi
jb 0x140005bb8
mov rbx, qword [rsp + 0x30]
lea rcx, [rbx + r15]
mov r8, rdi
call fcn.140145bd0
add r15, rdi
lea rcx, [rsp + 0xb8]
mov rdx, rbx
mov r8, r15
call fcn.14000bb00
test rax, rax
jne 0x140005ca4
test rsi, rsi
je 0x140005871
mov r8d, 1
mov rcx, rbx
mov rdx, rsi
call fcn.14000f700
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14000588b
mov r8d, 1
mov rcx, qword [rsp + 0x68]
call fcn.14000f700
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x1400058a5
mov rcx, qword [rsp + 0x78]
mov r8d, 1
call fcn.14000f700
lea rax, [0x140147f17]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x158]
mov rcx, qword [rsp + 0x158]
movabs rax, 0xcefe255b6b0e30f2
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x158]
mov rdx, qword [rsp + 0x158]
call fcn.1400043d0
movabs rcx, 0x2a1eadc47c6b6dab
xor rcx, qword [rax]
movzx eax, byte [rax + 8]
xor al, 0xf7
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x78], al
lea rcx, [rsp + 0x158]
lea rdx, [rsp + 0x70]
mov r8d, 9
call fcn.140106ed0
lea rcx, [rsp + 0x118]
call fcn.1400c5ef0
mov r8, rdx
lea rcx, [rsp + 0x3a8]
mov rdx, rax
call fcn.1400f9d40
cmp qword [rsp + 0x3a8], 0
jne 0x140005cd8
mov rsi, qword [rsp + 0x3b0]
mov rdi, qword [rsp + 0x3b8]
lea rdx, [0x14014d8e8]
lea rbx, [rsp + 0x158]
mov r8d, 3
mov rcx, rbx
call fcn.140106fd0
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.140106fd0
lea rcx, [rsp + 0x3a8]
mov rdx, rbx
call fcn.1400ffeb0
mov r13, qword [rsp + 0x3a8]
cmp r13, 2
je 0x140005ce4
mov rbx, qword [rsp + 0x3b0]
mov r12, qword [rsp + 0x3b8]
mov rdi, qword [rsp + 0x3c0]
mov r15, qword [rsp + 0x3c8]
mov rsi, qword [rsp + 0x3d0]
mov rcx, qword [rsp + 0x3d8]
mov r14, qword [rsp + 0x3e0]
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbp
mov rcx, r14
call rbp
test r13, r13
je 0x1400059ff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12, r12
mov r14, qword [rsp + 0x108]
je 0x140005a15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
je 0x140005a23
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x158]
call fcn.1400010c0
lea rax, [0x140145efb]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x158]
mov rcx, qword [rsp + 0x158]
movabs rax, 0xf374b97f0ac7351a
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x158]
mov rdx, qword [rsp + 0x158]
call fcn.140004360
mov rdi, qword [rax]
movzx eax, byte [0x140214be1]
mov ecx, 8
mov edx, 1
call fcn.14000f6f0
test rax, rax
je 0x140005d1a
mov rsi, rax
movabs rax, 0xb35e7f0f77463ae2
xor rdi, rax
mov qword [rsi], rdi
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140005ae8
mov rdi, qword [sym.imp.USER32.dll_FindWindowA]
nop word cs:[rax + rax]
xor ecx, ecx
mov edx, 0x5f5e100
call fcn.1400f8010
xor ecx, ecx
mov rdx, rsi
call rdi
test rax, rax
je 0x140005ad0
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.USER32.dll_FindWindowA]
mov rdi, rax
mov rbx, qword [sym.imp.USER32.dll_PostMessageA]
mov r8d, 0xd
mov rcx, rax
mov edx, 0x100
xor r9d, r9d
call rbx
xor ecx, ecx
mov edx, 0x2faf080
call fcn.1400f8010
mov r8d, 0xd
mov rcx, rdi
mov edx, 0x101
xor r9d, r9d
call rbx
mov edx, 8
mov r8d, 1
mov rcx, rsi
call fcn.14000f700
mov edx, 0x24b
mov r8d, 1
mov rcx, r14
call fcn.14000f700
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x118]
test rdx, rdx
je 0x140005b83
mov rcx, qword [rsp + 0x120]
mov r8d, 1
call fcn.14000f700
mov rdx, qword [rsp + 0x5f8]
test rdx, rdx
je 0x140005ba3
mov rcx, qword [rsp + 0x600]
mov r8d, 1
call fcn.14000f700
nop
add rsp, 0x618
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x3a8]
mov rsi, rdx
mov rdx, r15
mov r8, rdi
call fcn.140147610
mov rdx, rsi
mov r15, qword [rsp + 0x3b8]
mov rsi, qword [rsp + 0x3a8]
mov rbx, qword [rsp + 0x3b0]
jmp 0x140005830
lea r8, [0x14014d518]
mov rdx, r14
call fcn.14014b020
mov rax, r12
add rsi, rax
cmp r14, rsi
cmova rsi, r14
lea r8, [0x14014d530]
mov rcx, rsi
mov rdx, r14
call fcn.14014b020
lea rax, [0x14014d498]
mov qword [rsp + 0x20], rax
lea rcx, [0x14014d410]
lea r9, [0x14014d548]
lea r8, [rsp + 0xc0]
mov edx, 0x37
call fcn.14014b330
mov qword [rsp + 0x158], rsi
lea rax, str.src_antivirus.rs0
jmp 0x140005cb3
mov ecx, 1
mov edx, 0x24b
call fcn.14014ad70
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x3a8], rax
lea rax, str.src_antivirus.rs0
mov qword [rsp + 0x20], rax
lea rcx, [0x14014d568]
lea r9, [0x14014d598]
lea r8, [rsp + 0x3a8]
mov edx, 0x2b
call fcn.14014b330
mov qword [rsp + 0x158], rax
lea rax, str.src_antivirus.rs0
mov qword [rsp + 0x20], rax
lea rcx, [0x14014d568]
lea r9, [0x14014d598]
lea r8, [rsp + 0x158]
mov edx, 0x2b
call fcn.14014b330
lea rcx, str.src_antivirus.rs0
call fcn.14014ae70
mov rax, qword [rsp + 0x3b0]
mov qword [rsp + 0x48], rax
lea rax, str.src_antivirus.rs0
mov qword [rsp + 0x20], rax
lea rcx, [0x14014d568]
lea r9, [0x14014d598]
lea r8, [rsp + 0x48]
mov edx, 0x2b
call fcn.14014b330
mov ecx, 1
mov edx, 8
call fcn.14014ad70
mov r12, rcx
lea rax, [0x14014d618]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x60]
mov rdx, r14
mov r8, r12
mov r9, r14
call fcn.14014b500
call fcn.140117470
int3