Function at 0x1d340
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
sub rsp, 0xc58
mov rax, qword [0x000181d8]
mov qword [rsp + 0xc00], rax
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r14
mov rbp, rcx
mov qword [rsp + 0x140], rcx
lea rcx, [r11 - 0x948]
mov qword [r11 - 0x40], r15
mov r14, rdx
mov rsi, r9
mov qword [rsp + 0x220], r9
mov rbx, r8
mov qword [rsp + 0x158], r8
mov qword [rsp + 0x148], rdx
call fcn.00013ec0
xor eax, eax
xor r12d, r12d
movabs rdi, 0xfffff78000000320
mov rdi, qword [rdi]
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], rax
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0x1c8], rax
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x1d8], rax
mov word [rsp + 0x1e0], ax
movzx eax, byte [r14]
add eax, 0xffffffe3
xor r13b, r13b
mov byte [rsp + 0x1b0], 1
cmp eax, 0x85
lea r15d, [r12 + 2]
ja case.0x1d438.31
lea rdx, [0x00010000]
cdqe
movzx eax, byte [rdx + rax + 0xefe4]
mov ecx, dword [rdx + rax*4 + 0xefa4]
add rcx, rdx
jmp rcx
movzx eax, word [r14 + 1]
mov edx, 0xa
mov byte [rsp + 0x1b0], r12b
mov word [rbp + 4], ax
movzx eax, byte [rbp + 0x1a6]
mov byte [rsp + 0x1b4], r12b
cmp al, 5
mov word [rbp + 6], 0xa0cb
mov byte [rbp + 3], bpl
cmova edx, eax
movzx eax, bp
mov byte [rbp + 1], 1
shr ax, 8
mov byte [rsp + 0x1b2], r15b
mov byte [rsp + 0x1b5], bpl
mov byte [rsp + 0x1b3], dl
mov r12d, 5
mov r13b, 1
mov byte [rsp + 0x1b6], al
jmp 0x1ede4
lea r11, [r14 + 1]
mov r10d, 4
mov r9, r11
xor cl, cl
mov r8d, 4
nop
nop
movzx edx, word [rbp + 4]
add cl, cl
test dl, 1
je 0x1d4e2
movzx eax, word [rbp + 6]
or cl, 1
xor ax, dx
shr ax, 1
or ax, 0x8000
mov word [rbp + 4], ax
jmp 0x1d4e9
shr dx, 1
mov word [rbp + 4], dx
add cl, cl
test byte [rbp + 4], 0x80
je 0x1d4f4
or cl, 1
dec r8
jne 0x1d4c0
xor byte [r9], cl
inc r9
dec r10
jne 0x1d4b2
mov r8d, dword [rbp + 0x1a8]
cmp dword [r11], r8d
jne 0x1ede4
cmp byte [rbp + 1], 1
jne 0x1ede4
mov rcx, rbp
mov byte [rsp + 0x1b0], r12b
call fcn.0001b950
mov rcx, rbp
mov byte [rsp + 0x1b2], al
call fcn.0001b950
mov r13b, 1
sar eax, 8
mov byte [rsp + 0x1b4], 0x10
lea r12d, [r10 + 3]
mov byte [rbp + 2], r13b
mov dword [0x0001827c], r8d
mov byte [rsp + 0x1b3], al
jmp 0x1ede4
lea r11, [r14 + 1]
mov r10, r15
mov r9, r11
xor cl, cl
mov r8d, 4
nop
nop
movzx edx, word [rbp + 4]
add cl, cl
test dl, 1
je 0x1d5a2
movzx eax, word [rbp + 6]
or cl, 1
xor ax, dx
shr ax, 1
or ax, 0x8000
mov word [rbp + 4], ax
jmp 0x1d5a9
shr dx, 1
mov word [rbp + 4], dx
add cl, cl
test byte [rbp + 4], 0x80
je 0x1d5b4
or cl, 1
dec r8
jne 0x1d580
xor byte [r9], cl
inc r9
dec r10
jne 0x1d570
cmp byte [rbp + 2], r12b
je 0x1ede4
mov ax, word [r11]
cmp ax, 7
ja 0x1ede4
mov byte [rsp + 0x1b0], r12b
movzx ecx, ax
lea rdx, [rsp + 0x1b2]
mov eax, dword [rbp + rcx*2 + 0x1c2]
lea r12d, [r8 + 6]
mov r13b, 1
mov dword [rdx], eax
movzx eax, word [rbp + rcx*2 + 0x1c6]
mov word [rdx + 4], ax
jmp 0x1ede4
lea r11, [r14 + 1]
mov r10, r15
mov r9, r11
nop
nop
xor cl, cl
mov r8d, 4
nop
nop
movzx edx, word [rbp + 4]
add cl, cl
test dl, 1
je 0x1d652
movzx eax, word [rbp + 6]
or cl, 1
xor ax, dx
shr ax, 1
or ax, 0x8000
mov word [rbp + 4], ax
jmp 0x1d659
shr dx, 1
mov word [rbp + 4], dx
add cl, cl
test byte [rbp + 4], 0x80
je 0x1d664
or cl, 1
dec r8
jne 0x1d630
xor byte [r9], cl
inc r9
dec r10
jne 0x1d620
cmp byte [rbp + 2], r12b
je 0x1ede4
movzx r8d, word [r11]
mov rcx, rbp
call fcn.0001b950
mov ecx, r8d
add ecx, ecx
cmp ecx, eax
jge 0x1ede4
mov byte [rsp + 0x1b0], r12b
mov eax, dword [rbp + r8*2 + 0x212]
lea rdx, [rsp + 0x1b2]
mov dword [rdx], eax
movzx eax, word [rbp + r8*2 + 0x216]
mov rcx, r8
lea r12d, [r10 + 6]
mov r13b, 1
mov word [rdx + 4], ax
jmp 0x1ede4
lea r11, [r14 + 1]
mov r10d, 4
mov r9, r11
nop
nop
xor cl, cl
mov r8d, 4
nop
nop
movzx edx, word [rbp + 4]
add cl, cl
test dl, 1
je 0x1d712
movzx eax, word [rbp + 6]
or cl, 1
xor ax, dx
shr ax, 1
or ax, 0x8000
mov word [rbp + 4], ax
jmp 0x1d719
shr dx, 1
mov word [rbp + 4], dx
add cl, cl
test byte [rbp + 4], 0x80
je 0x1d724
or cl, 1
dec r8
jne 0x1d6f0
xor byte [r9], cl
inc r9
dec r10
jne 0x1d6e0
cmp byte [rbp + 2], r12b
je 0x1ede4
movzx r8d, word [r11]
mov rcx, rbp
call fcn.0001b950
mov ecx, r8d
add ecx, ecx
cmp ecx, eax
jge 0x1ede4
movzx eax, word [r14 + 3]
mov rcx, rbp
mov byte [rsp + 0x1b0], r12b
mov word [rbp + r8*2 + 0x212], ax
xor r13b, r13b
call fcn.0001b950
lea rdx, [rbp + 0x212]
lea rcx, [0x00021d10]
mov r9, rbp
mov r8d, eax
call fcn.0001b990
test eax, eax
jne 0x1ede4
mov byte [rsp + 0x1b0], r12b
jmp 0x1ede4
cmp byte [rbp + 2], r12b
je 0x1ede4
mov byte [rsp + 0x1b0], r12b
mov ecx, 7
lea rdx, [rsp + 0x1b2]
nop
nop
nop
movzx eax, byte [rcx + rbp + 0x1ba]
inc rdx
dec rcx
mov byte [rdx - 1], al
jns 0x1d7d0
mov r12d, 8
mov r13b, 1
jmp 0x1ede4
lea r11, [r14 + 1]
mov r10d, 4
mov r9, r11
nop
xor cl, cl
mov r8d, 4
nop
nop
movzx edx, word [rbp + 4]
add cl, cl
test dl, 1
je 0x1d832
movzx eax, word [rbp + 6]
or cl, 1
xor ax, dx
shr ax, 1
or ax, 0x8000
mov word [rbp + 4], ax
jmp 0x1d839
shr dx, 1
mov word [rbp + 4], dx
add cl, cl
test byte [rbp + 4], 0x80
je 0x1d844
or cl, 1
dec r8
jne 0x1d810
xor byte [r9], cl
inc r9
dec r10
jne 0x1d800
cmp byte [rbp + 2], r12b
je 0x1ede4
mov eax, dword [r11]
lea rdx, [rbp + 0x1212]
lea rcx, [rsp + 0x1b2]
mov dword [rsp + 0x1b2], eax
mov byte [rsp + 0x1b0], r12b
call fcn.00016bc0
mov r12d, 4
mov r13b, 1
jmp 0x1ede4
movzx ecx, word [r14 + 1]
test ecx, ecx
je 0x1db84
dec ecx
je 0x1d9ac
dec ecx
je 0x1d903
dec ecx
jne case.0x1d438.160
mov byte [rsp + 0x218], r12b
mov byte [rsp + 0x219], r12b
mov byte [rsp + 0x21a], 0xaa
mov byte [rsp + 0x21b], r12b
mov byte [rsp + 0x21c], r12b
mov byte [rsp + 0x21d], r12b
mov byte [rsp + 0x21e], r12b
mov byte [rsp + 0x21f], r12b
mov rax, qword [rsp + 0x218]
mov qword [rsi], rax
jmp case.0x1d438.160
movzx eax, byte [rbp + 0x1c5]
lea rcx, [rsp + 0x220]
mov byte [rsp + 0x224], r12b
mov byte [rsp + 0x220], al
movzx eax, byte [rbp + 0x1c4]
mov byte [rsp + 0x225], r12b
mov byte [rsp + 0x221], al
movzx eax, byte [rbp + 0x1c3]
mov byte [rsp + 0x226], 1
mov byte [rsp + 0x222], al
movzx eax, byte [rbp + 0x1c2]
mov byte [rsp + 0x227], r12b
mov byte [rsp + 0x228], r12b
mov byte [rsp + 0x229], 4
mov byte [rsp + 0x22a], r12b
mov byte [rsp + 0x223], al
mov byte [rsp + 0x22b], r12b
mov byte [rsp + 0x22c], 1
mov byte [rsp + 0x22d], r12b
mov rax, qword [rcx]
mov qword [rsi], rax
mov eax, dword [rcx + 8]
mov dword [rsi + 8], eax
movzx eax, word [rcx + 0xc]
mov word [rsi + 0xc], ax
jmp case.0x1d438.160
movzx eax, byte [rbp + 0x1c5]
lea rcx, [rsp + 0x1e8]
mov byte [rsp + 0x1ec], 6
mov byte [rsp + 0x1e8], al
movzx eax, byte [rbp + 0x1c4]
mov byte [rsp + 0x1ed], r12b
mov byte [rsp + 0x1e9], al
movzx eax, byte [rbp + 0x1c3]
mov byte [rsp + 0x1ee], r12b
mov byte [rsp + 0x1ea], al
movzx eax, byte [rbp + 0x1c2]
mov byte [rsp + 0x1ef], r12b
mov byte [rsp + 0x1f0], r12b
mov byte [rsp + 0x1f1], 0xca
mov byte [rsp + 0x1f2], r12b
mov byte [rsp + 0x1eb], al
mov byte [rsp + 0x1f3], 0xe
mov byte [rsp + 0x1f4], r12b
mov byte [rsp + 0x1f5], r12b
mov byte [rsp + 0x1f6], 0x35
mov byte [rsp + 0x1f7], 0x88
mov byte [rsp + 0x1f8], r15b
mov byte [rsp + 0x1f9], 0x24
mov byte [rsp + 0x1fa], r12b
mov byte [rsp + 0x1fb], r15b
mov byte [rsp + 0x1fc], r12b
mov byte [rsp + 0x1fd], r15b
mov byte [rsp + 0x1fe], r12b
mov byte [rsp + 0x1ff], r12b
mov byte [rsp + 0x200], 3
mov byte [rsp + 0x201], 0x15
mov byte [rsp + 0x202], 0x22
mov byte [rsp + 0x203], 0xc3
mov byte [rsp + 0x204], 0xb
mov byte [rsp + 0x205], r12b
mov byte [rsp + 0x206], r12b
mov byte [rsp + 0x207], r12b
mov byte [rsp + 0x208], r12b
mov byte [rsp + 0x209], r12b
mov byte [rsp + 0x20a], r12b
mov byte [rsp + 0x20b], r12b
mov byte [rsp + 0x20c], 0xf8
mov byte [rsp + 0x20d], r12b
mov byte [rsp + 0x20e], 3
mov byte [rsp + 0x20f], 0x7e
mov byte [rsp + 0x210], r12b
mov byte [rsp + 0x211], 1
mov byte [rsp + 0x212], 0x32
mov byte [rsp + 0x213], 0x47
mov byte [rsp + 0x214], r12b
mov byte [rsp + 0x215], r12b
mov byte [rsp + 0x216], r12b
mov rax, qword [rcx]
mov qword [rsi], rax
mov rax, qword [rcx + 8]
mov qword [rsi + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rsi + 0x10], rax
mov rax, qword [rcx + 0x18]
mov qword [rsi + 0x18], rax
mov rax, qword [rcx + 0x20]
mov qword [rsi + 0x20], rax
mov eax, dword [rcx + 0x28]
mov dword [rsi + 0x28], eax
movzx eax, word [rcx + 0x2c]
mov word [rsi + 0x2c], ax
movzx eax, byte [rcx + 0x2e]
mov byte [rsi + 0x2e], al
jmp case.0x1d438.160
inc byte [rsi]
jmp case.0x1d438.160
cmp word [r14 + 1], r12w
jne case.0x1d438.160
cmp dword [rbx], 0x7c1
jne case.0x1d438.160
mov byte [rsp + 0x230], 0xff
mov byte [rsp + 0x231], 0xc0
mov byte [rsp + 0x232], r12b
mov byte [rsp + 0x233], r12b
mov byte [rsp + 0x234], r12b
mov byte [rsp + 0x235], 4
mov byte [rsp + 0x236], 4
mov byte [rsp + 0x237], r12b
mov byte [rsp + 0x238], 0xff
mov byte [rsp + 0x239], 0xc1
mov byte [rsp + 0x23a], r12b
mov byte [rsp + 0x23b], 4
mov byte [rsp + 0x23c], r12b
mov byte [rsp + 0x23d], 1
mov byte [rsp + 0x23e], r12b
mov byte [rsp + 0x23f], 1
mov byte [rsp + 0x240], 0xff
mov byte [rsp + 0x241], 0xc2
mov byte [rsp + 0x242], r12b
mov byte [rsp + 0x243], 5
mov byte [rsp + 0x244], r12b
mov byte [rsp + 0x245], 0xfd
mov byte [rsp + 0x246], r12b
mov byte [rsp + 0x247], r15b
mov byte [rsp + 0x248], 0xff
mov byte [rsp + 0x249], 0xc8
mov byte [rsp + 0x24a], 1
mov byte [rsp + 0x24b], r15b
mov byte [rsp + 0x24c], r12b
mov byte [rsp + 0x24d], 8
mov byte [rsp + 0x24e], 4
mov byte [rsp + 0x24f], 3
mov byte [rsp + 0x250], 0xff
mov byte [rsp + 0x251], 0xc9
mov byte [rsp + 0x252], r15b
mov byte [rsp + 0x253], 0x89
mov byte [rsp + 0x254], r12b
mov byte [rsp + 0x255], r15b
mov byte [rsp + 0x256], r12b
mov byte [rsp + 0x257], 7
mov byte [rsp + 0x258], 0xff
mov byte [rsp + 0x259], 0xcc
mov byte [rsp + 0x25a], r15b
mov byte [rsp + 0x25b], 0x8b
mov byte [rsp + 0x25c], r12b
mov byte [rsp + 0x25d], 6
mov byte [rsp + 0x25e], 4
mov byte [rsp + 0x25f], 0xd
mov byte [rsp + 0x260], 0xff
mov byte [rsp + 0x261], 0xf4
mov byte [rsp + 0x262], 1
mov byte [rsp + 0x263], 0xa
mov byte [rsp + 0x264], r12b
mov byte [rsp + 0x265], 0xfc
mov byte [rsp + 0x266], r12b
mov byte [rsp + 0x267], 4
mov byte [rsp + 0x268], 0xff
mov byte [rsp + 0x269], 0xf5
mov byte [rsp + 0x26a], r15b
mov byte [rsp + 0x26b], 6
mov byte [rsp + 0x26c], r12b
mov byte [rsp + 0x26d], 0x80
mov byte [rsp + 0x26e], r12b
mov byte [rsp + 0x26f], 5
mov byte [rsp + 0x270], 0xff
mov byte [rsp + 0x271], 0xca
mov byte [rsp + 0x272], r15b
mov byte [rsp + 0x273], 0x86
mov byte [rsp + 0x274], r12b
mov byte [rsp + 0x275], 3
mov byte [rsp + 0x276], r12b
mov byte [rsp + 0x277], 6
mov byte [rsp + 0x278], 0xff
mov byte [rsp + 0x279], 0xcd
mov byte [rsp + 0x27a], r15b
mov byte [rsp + 0x27b], 0x91
mov byte [rsp + 0x27c], r12b
mov byte [rsp + 0x27d], 1
mov byte [rsp + 0x27e], r12b
mov byte [rsp + 0x27f], 9
mov byte [rsp + 0x280], 0xff
lea rcx, [rsp + 0x430]
mov edx, 0xff
mov r8d, 0x7c1
mov byte [rsp + 0x281], 0xcb
mov byte [rsp + 0x282], r15b
mov byte [rsp + 0x283], 0x92
mov byte [rsp + 0x284], r12b
mov byte [rsp + 0x285], 1
mov byte [rsp + 0x286], r12b
mov byte [rsp + 0x287], 0xb
mov byte [rsp + 0x288], r12b
mov byte [rsp + 0x289], 0xc8
mov byte [rsp + 0x28a], r15b
mov byte [rsp + 0x28b], 0x93
mov byte [rsp + 0x28c], r12b
mov byte [rsp + 0x28d], 3
mov byte [rsp + 0x28e], r12b
mov byte [rsp + 0x28f], 0xc
mov byte [rsp + 0x290], r12b
mov byte [rsp + 0x291], 0xcc
mov byte [rsp + 0x292], r15b
mov byte [rsp + 0x293], 0x96
mov byte [rsp + 0x294], r12b
mov byte [rsp + 0x295], 3
mov byte [rsp + 0x296], r12b
mov byte [rsp + 0x297], 0xc
mov byte [rsp + 0x298], 1
mov byte [rsp + 0x299], 0x2b
mov byte [rsp + 0x29a], r15b
mov byte [rsp + 0x29b], 0x99
mov byte [rsp + 0x29c], r12b
mov byte [rsp + 0x29d], 3
mov byte [rsp + 0x29e], r12b
mov byte [rsp + 0x29f], 0xc
call fcn.00016ec0
lea rcx, [rsp + 0x430]
lea rdx, [rsp + 0x230]
mov r8d, 0x70
call fcn.00016fd0
mov byte [rsp + 0xbf0], r12b
mov rcx, rsi
lea rdx, [rsp + 0x430]
mov r8d, 0x7c1
jmp 0x1ef49
cmp byte [rbp + 2], r12b
je 0x1ede4
mov byte [rsp + 0x1b0], r12b
lea r9, [r14 + 1]
mov r10d, 4
nop
xor cl, cl
mov r8d, 4
nop
nop
movzx edx, word [rbp + 4]
add cl, cl
test dl, 1
je 0x1dfc2
movzx eax, word [rbp + 6]
or cl, 1
xor ax, dx
shr ax, 1
or ax, 0x8000
mov word [rbp + 4], ax
jmp 0x1dfc9
shr dx, 1
mov word [rbp + 4], dx
add cl, cl
test byte [rbp + 4], 0x80
je 0x1dfd4
or cl, 1
dec r8
jne 0x1dfa0
xor byte [r9], cl
inc r9
dec r10
jne 0x1df90
movabs rbx, 0xfffff78000000014
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x218]
mov rax, qword [rbx]
mov qword [rsp + 0x218], rax
mov rax, qword [rbp + 0x20a]
add qword [rsp + 0x218], rax
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
movzx ebx, word [r14 + 1]
test bl, bl
movzx eax, bl
jne 0x1e076
movzx ecx, byte [rsp + 0x136]
call fcn.00013e70
movzx ecx, byte [rsp + 0x138]
mov byte [rsp + 0x1b4], al
call fcn.00013e70
movzx ecx, byte [rsp + 0x13a]
mov byte [rsp + 0x1b3], al
call fcn.00013e70
movzx r12d, bx
shr r12d, 8
mov r13b, 1
mov byte [rsp + 0x1b2], al
jmp 0x1ede4
cmp eax, 3
jne 0x1e0f1
movsx ecx, word [rsp + 0x130]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub ecx, edx
call fcn.00013e70
movzx ecx, byte [rsp + 0x13e]
mov byte [rsp + 0x1b5], al
call fcn.00013e70
movzx ecx, byte [rsp + 0x132]
mov byte [rsp + 0x1b4], al
call fcn.00013e70
movzx ecx, byte [rsp + 0x134]
mov byte [rsp + 0x1b3], al
call fcn.00013e70
movzx r12d, bx
shr r12d, 8
mov r13b, 1
mov byte [rsp + 0x1b2], al
jmp 0x1ede4
movzx eax, word [r14 + 1]
movzx ecx, al
mov r8, rax
lea rdx, [rcx + rbp + 0x1d2]
lea rcx, [rsp + 0x1b2]
shr r8, 8
call fcn.00016fd0
movzx r12d, bx
mov r13b, 1
shr r12d, 8
jmp 0x1ede4
cmp byte [rbp + 2], r12b
je 0x1ede4
mov byte [rsp + 0x1b0], r12b
lea r9, [r14 + 1]
mov r10d, 4
xor cl, cl
mov r8d, 4
nop
nop
movzx edx, word [rbp + 4]
add cl, cl
test dl, 1
je 0x1e172
movzx eax, word [rbp + 6]
or cl, 1
xor ax, dx
shr ax, 1
or ax, 0x8000
mov word [rbp + 4], ax
jmp 0x1e179
shr dx, 1
mov word [rbp + 4], dx
add cl, cl
test byte [rbp + 4], 0x80
je 0x1e184
or cl, 1
dec r8
jne 0x1e150
xor byte [r9], cl
inc r9
dec r10
jne 0x1e141
movzx eax, byte [r14 + 1]
movzx edi, byte [r14 + 4]
mov rdx, rsi
lea rbx, [rax + rbp + 0x1d2]
mov r8, rdi
mov dword [0x00018278], eax
mov rcx, rbx
mov dword [0x00018274], edi
call fcn.00016fd0
mov r8, rbp
mov edx, edi
mov rcx, rbx
call fcn.0001b8d0
mov r8, qword [rsp + 0x158]
mov dword [r8], r12d
jmp case.0x1d438.160
cmp byte [rbp + 2], r12b
je 0x1ede4
cmp dword [0x00018278], 7
jl 0x1e221
lea rdx, [rbp + 0x1d2]
lea rcx, [0x00021c40]
mov r9, rbp
mov r8d, 0x38
call fcn.0001b990
test eax, eax
jne 0x1ede4
mov byte [rsp + 0x1b0], r12b
jmp 0x1ede4
movabs rbx, 0xfffff78000000014
lea rdx, [rsp + 0x120]
mov rbx, qword [rbx]
mov rax, qword [rbp + 0x20a]
lea rcx, [rbx + rax]
mov qword [rsp + 0x160], rcx
lea rcx, [rsp + 0x160]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
cmp dword [0x00018278], r12d
jne 0x1e2b4
and byte [rbp + 0x1d2], 0x7f
movzx ecx, byte [rbp + 0x1d2]
call fcn.00013ea0
movzx ecx, byte [rbp + 0x1d3]
movzx r8d, al
mov word [rsp + 0x12a], r8w
call fcn.00013ea0
movzx ecx, byte [rbp + 0x1d4]
movzx r8d, al
mov word [rsp + 0x128], r8w
call fcn.00013ea0
movzx r8d, al
mov word [rsp + 0x126], r8w
jmp 0x1e31c
movzx ecx, byte [rbp + 0x1d5]
call fcn.00013ea0
movzx ecx, byte [rbp + 0x1d6]
movzx r8d, al
mov word [rsp + 0x124], r8w
call fcn.00013ea0
movzx ecx, byte [rbp + 0x1d8]
movzx r8d, al
mov word [rsp + 0x122], r8w
call fcn.00013ea0
movzx r8d, al
cmp r8d, 0x5a
jge 0x1e30d
add r8w, 0x7d0
mov word [rsp + 0x120], r8w
jmp 0x1e31c
add r8w, 0x76c
mov word [rsp + 0x120], r8w
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x120]
call qword [sym.imp.ntoskrnl.exe_RtlTimeFieldsToTime]
mov r11, qword [rsp + 0x168]
lea rdx, [rbp + 0x20a]
sub r11, rbx
lea rcx, [0x00021c60]
mov r9, rbp
mov r8d, 8
mov qword [rbp + 0x20a], r11
call fcn.0001b990
test eax, eax
jne 0x1ede4
mov byte [rsp + 0x1b0], r12b
jmp 0x1ede4
cmp byte [rbp + 2], r12b
je 0x1ede4
mov eax, dword [rbx]
lea r9, [r14 + 1]
mov r10d, 4
mov dword [rbp + 0x122e], eax
xor cl, cl
mov r8d, 4
nop
nop
movzx edx, word [rbp + 4]
add cl, cl
test dl, 1
je 0x1e3c2
movzx eax, word [rbp + 6]
or cl, 1
xor ax, dx
shr ax, 1
or ax, 0x8000
mov word [rbp + 4], ax
jmp 0x1e3c9
shr dx, 1
mov word [rbp + 4], dx
add cl, cl
test byte [rbp + 4], 0x80
je 0x1e3d4
or cl, 1
dec r8
jne 0x1e3a0
xor byte [r9], cl
inc r9
dec r10
jne 0x1e391
mov edx, dword [rbp + 0x122e]
mov r8, rbp
mov rcx, rsi
call fcn.0001b8d0
cmp word [r14 + 1], 3
seta al
mov byte [rbp + 0x1232], al
cmp word [r14 + 1], 7
jae 0x1e413
movzx eax, byte [r14 + 1]
jmp 0x1e418
mov eax, 8
mov byte [rbp + 0x1233], al
xor eax, eax
lea rcx, [rbp + 0x1234]
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
movsxd rax, dword [rbp + 0x122e]
cmp eax, 0x30
jb 0x1e44f
mov eax, 0x30
mov r8, rax
mov rdx, rsi
call fcn.00016fd0
cmp byte [rbp + 0x1ac], 0x69
je case.0x1d438.160
call fcn.00014020
jmp case.0x1d438.160
cmp byte [rbp + 2], r12b
je 0x1ede4
cmp byte [rbp + 0x1ac], 0x69
je 0x1e489
call fcn.00014020
movsxd rbx, dword [rbp + 0x122e]
xor eax, eax
lea rdx, [rbp + 0x1234]
lea rcx, [rsp + 0x1e8]
mov r8, rbx
mov qword [rsp + 0x2e0], rax
mov qword [rsp + 0x2e8], rax
mov qword [rsp + 0x2f0], rax
mov qword [rsp + 0x2f8], rax
mov qword [rsp + 0x300], rax
mov qword [rsp + 0x308], rax
mov qword [rsp + 0x1e8], rax
mov qword [rsp + 0x1f0], rax
mov qword [rsp + 0x1f8], rax
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x208], rax
mov qword [rsp + 0x210], rax
call fcn.00016fd0
lea rdx, [rbp + 0x1234]
lea rcx, [rsp + 0x2e0]
mov r8, rbx
call fcn.00016fd0
cmp byte [rbp + 0x1232], r12b
jne 0x1e55a
lea rax, [0x00021f70]
lea r9, [rbp + 0x1264]
lea r8, str.RegistryMACHINESystemCurrentControlSetMultiKeyDumps
lea rdx, [0x00021f50]
lea rcx, [rsp + 0x330]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_swprintf]
jmp 0x1e589
lea rax, [0x00021f40]
lea r9, [rbp + 0x1264]
lea r8, str.RegistryMACHINESystemCurrentControlSetMultiKeyDumps
lea rdx, [0x00021f50]
lea rcx, [rsp + 0x330]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_swprintf]
lea rdx, [rsp + 0x330]
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov eax, 0x30
lea r8, [rsp + 0x170]
mov dword [rsp + 0x170], eax
lea rax, [rsp + 0x1a0]
lea rcx, [rsp + 0x150]
mov edx, 0x20019
mov qword [rsp + 0x178], r12
mov dword [rsp + 0x188], 0x40
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x190], r12
mov qword [rsp + 0x198], r12
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x1eb78
lea rcx, [rsp + 0x330]
xor edx, edx
mov r8d, 0x100
call fcn.00016ec0
mov r11d, dword [rbp + 0x122e]
cmp r11d, 0x10
je 0x1ea35
cmp r11d, 0x20
je 0x1e838
cmp r11d, 0x30
jne 0x1eb3d
movzx eax, byte [rsp + 0x207]
movzx ecx, byte [rsp + 0x206]
movzx edx, byte [rsp + 0x205]
mov dword [rsp + 0x110], eax
movzx r8d, byte [rsp + 0x204]
movzx eax, byte [rsp + 0x1fa]
movzx r10d, byte [rsp + 0x203]
movzx r11d, byte [rsp + 0x202]
movzx ebx, byte [rsp + 0x201]
movzx esi, byte [rsp + 0x200]
movzx ebp, byte [rsp + 0x1ff]
movzx r12d, byte [rsp + 0x1fe]
movzx r13d, byte [rsp + 0x1fd]
movzx r14d, byte [rsp + 0x1fc]
movzx r15d, byte [rsp + 0x1fb]
mov dword [rsp + 0x108], ecx
mov dword [rsp + 0x100], edx
movzx r9d, byte [rsp + 0x1e8]
mov dword [rsp + 0xf8], r8d
mov dword [rsp + 0xf0], r10d
mov dword [rsp + 0xe8], r11d
mov dword [rsp + 0xe0], ebx
mov dword [rsp + 0xd8], esi
mov dword [rsp + 0xd0], ebp
mov dword [rsp + 0xc8], r12d
mov dword [rsp + 0xc0], r13d
mov dword [rsp + 0xb8], r14d
mov dword [rsp + 0xb0], r15d
mov dword [rsp + 0xa8], eax
movzx eax, byte [rsp + 0x1f9]
mov dword [rsp + 0xa0], eax
movzx eax, byte [rsp + 0x1f8]
lea r8, [0x00021f30]
mov dword [rsp + 0x98], eax
movzx eax, byte [rsp + 0x1f7]
lea rdx, [0x00021e20]
mov dword [rsp + 0x90], eax
movzx eax, byte [rsp + 0x1f6]
lea rcx, [rsp + 0x330]
mov dword [rsp + 0x88], eax
movzx eax, byte [rsp + 0x1f5]
mov dword [rsp + 0x80], eax
movzx eax, byte [rsp + 0x1f4]
mov dword [rsp + 0x78], eax
movzx eax, byte [rsp + 0x1f3]
mov dword [rsp + 0x70], eax
movzx eax, byte [rsp + 0x1f2]
mov dword [rsp + 0x68], eax
movzx eax, byte [rsp + 0x1f1]
mov dword [rsp + 0x60], eax
movzx eax, byte [rsp + 0x1f0]
mov dword [rsp + 0x58], eax
movzx eax, byte [rsp + 0x1ef]
mov dword [rsp + 0x50], eax
movzx eax, byte [rsp + 0x1ee]
mov dword [rsp + 0x48], eax
movzx eax, byte [rsp + 0x1ed]
mov dword [rsp + 0x40], eax
movzx eax, byte [rsp + 0x1ec]
mov dword [rsp + 0x38], eax
movzx eax, byte [rsp + 0x1eb]
mov dword [rsp + 0x30], eax
movzx eax, byte [rsp + 0x1ea]
mov dword [rsp + 0x28], eax
movzx eax, byte [rsp + 0x1e9]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_swprintf]
mov rbp, qword [rsp + 0x140]
mov r14, qword [rsp + 0x148]
xor r12d, r12d
lea r15d, [r12 + 2]
jmp 0x1eb3d
movzx eax, byte [rsp + 0x207]
movzx ecx, byte [rsp + 0x206]
movzx edx, byte [rsp + 0x205]
mov dword [rsp + 0x110], eax
movzx r8d, byte [rsp + 0x204]
movzx eax, byte [rsp + 0x1fa]
movzx r10d, byte [rsp + 0x203]
movzx r11d, byte [rsp + 0x202]
movzx ebx, byte [rsp + 0x201]
movzx esi, byte [rsp + 0x200]
movzx ebp, byte [rsp + 0x1ff]
movzx r12d, byte [rsp + 0x1fe]
movzx r13d, byte [rsp + 0x1fd]
movzx r14d, byte [rsp + 0x1fc]
movzx r15d, byte [rsp + 0x1fb]
mov dword [rsp + 0x108], ecx
mov dword [rsp + 0x100], edx
movzx r9d, byte [rsp + 0x1e8]
mov dword [rsp + 0xf8], r8d
mov dword [rsp + 0xf0], r10d
mov dword [rsp + 0xe8], r11d
mov dword [rsp + 0xe0], ebx
mov dword [rsp + 0xd8], esi
mov dword [rsp + 0xd0], ebp
mov dword [rsp + 0xc8], r12d
mov dword [rsp + 0xc0], r13d
mov dword [rsp + 0xb8], r14d
mov dword [rsp + 0xb0], r15d
mov dword [rsp + 0xa8], eax
movzx eax, byte [rsp + 0x1f9]
mov dword [rsp + 0xa0], eax
movzx eax, byte [rsp + 0x1f8]
lea r8, [0x00021e10]
mov dword [rsp + 0x98], eax
movzx eax, byte [rsp + 0x1f7]
lea rdx, [0x00021e20]
mov dword [rsp + 0x90], eax
movzx eax, byte [rsp + 0x1f6]
lea rcx, [rsp + 0x330]
mov dword [rsp + 0x88], eax
movzx eax, byte [rsp + 0x1f5]
mov dword [rsp + 0x80], eax
movzx eax, byte [rsp + 0x1f4]
mov dword [rsp + 0x78], eax
movzx eax, byte [rsp + 0x1f3]
mov dword [rsp + 0x70], eax
movzx eax, byte [rsp + 0x1f2]
mov dword [rsp + 0x68], eax
movzx eax, byte [rsp + 0x1f1]
mov dword [rsp + 0x60], eax
movzx eax, byte [rsp + 0x1f0]
mov dword [rsp + 0x58], eax
movzx eax, byte [rsp + 0x1ef]
mov dword [rsp + 0x50], eax
movzx eax, byte [rsp + 0x1ee]
mov dword [rsp + 0x48], eax
movzx eax, byte [rsp + 0x1ed]
mov dword [rsp + 0x40], eax
movzx eax, byte [rsp + 0x1ec]
mov dword [rsp + 0x38], eax
movzx eax, byte [rsp + 0x1eb]
mov dword [rsp + 0x30], eax
movzx eax, byte [rsp + 0x1ea]
mov dword [rsp + 0x28], eax
movzx eax, byte [rsp + 0x1e9]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_swprintf]
mov rbp, qword [rsp + 0x140]
mov r14, qword [rsp + 0x148]
xor r12d, r12d
lea r15d, [r12 + 2]
jmp 0x1eb3d
movzx eax, byte [rsp + 0x1f7]
movzx ecx, byte [rsp + 0x1f6]
movzx edx, byte [rsp + 0x1f5]
movzx r8d, byte [rsp + 0x1f4]
movzx r10d, byte [rsp + 0x1f3]
movzx r11d, byte [rsp + 0x1f2]
movzx ebx, byte [rsp + 0x1f1]
movzx esi, byte [rsp + 0x1f0]
movzx ebp, byte [rsp + 0x1ef]
movzx r12d, byte [rsp + 0x1ee]
movzx r13d, byte [rsp + 0x1ed]
movzx r14d, byte [rsp + 0x1ec]
movzx r15d, byte [rsp + 0x1eb]
movzx r9d, byte [rsp + 0x1e8]
mov dword [rsp + 0x90], eax
movzx eax, byte [rsp + 0x1ea]
mov dword [rsp + 0x88], ecx
mov dword [rsp + 0x80], edx
mov dword [rsp + 0x78], r8d
mov dword [rsp + 0x70], r10d
mov dword [rsp + 0x68], r11d
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], eax
movzx eax, byte [rsp + 0x1e9]
lea r8, [0x00021e00]
lea rdx, [0x00021d70]
lea rcx, [rsp + 0x330]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_swprintf]
mov rbp, qword [rsp + 0x140]
mov r14, qword [rsp + 0x148]
xor r12d, r12d
lea r15d, [r12 + 2]
mov rcx, qword [rsp + 0x150]
lea r8, [rsp + 0x1e8]
lea rdx, [rsp + 0x330]
mov r9d, 0x10
call fcn.00013f00
mov rcx, qword [rsp + 0x150]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
jns case.0x1eb99.3
movzx eax, byte [rbp + 0x1233]
cmp eax, 6
ja case.0x1eb99.3
lea rdx, [0x00010000]
mov ecx, dword [rdx + rax*4 + 0xf06c]
add rcx, rdx
jmp rcx
lea rdx, [rbp + 0x128c]
lea rcx, [rsp + 0x230]
mov r8d, 0x80
call fcn.00014050
lea r9, [rsp + 0x1e8]
lea r8, [rsp + 0x2e0]
lea rcx, [rsp + 0x230]
mov edx, 0xa
call fcn.000147d0
jmp case.0x1eb99.3
lea rdx, [rbp + 0x128c]
lea rcx, [rsp + 0x230]
mov r8d, 0x80
call fcn.00014050
lea r9, [rsp + 0x1e8]
lea r8, [rsp + 0x2e0]
lea rcx, [rsp + 0x230]
mov edx, 0xa
call fcn.000147d0
mov ecx, 0x10
nop
movzx eax, byte [rsp + r12 + 0x2f0]
inc r12
xor byte [rsp + r12 + 0x1e7], al
dec rcx
jne 0x1ec20
jmp case.0x1eb99.3
lea rdx, [rbp + 0x128c]
lea rcx, [rsp + 0x230]
mov r8d, 0x80
call fcn.00014050
lea r9, [rsp + 0x1e8]
lea r8, [rsp + 0x2e0]
lea rcx, [rsp + 0x230]
mov edx, 0xa
call fcn.000147d0
mov r11, r12
mov ecx, 0x10
movzx eax, byte [rsp + r11 + 0x2f0]
inc r11
xor byte [rsp + r11 + 0x1e7], al
dec rcx
jne 0x1ec82
mov ecx, 0x10
movzx eax, byte [rsp + r12 + 0x300]
inc r12
xor byte [rsp + r12 + 0x1e7], al
dec rcx
jne 0x1eca0
jmp case.0x1eb99.3
lea rdx, [rbp + 0x128c]
lea rcx, [rsp + 0x230]
mov r8d, 0x80
call fcn.000145a0
lea r9, [rsp + 0x1e8]
lea r8, [rsp + 0x2e0]
lea rcx, [rsp + 0x230]
mov edx, 0xa
call fcn.00015930
jmp case.0x1eb99.3
mov ecx, 0x10
movzx eax, byte [rsp + r12 + 0x2f0]
inc r12
xor byte [rsp + r12 + 0x1e7], al
dec rcx
jne 0x1ed04
jmp case.0x1eb99.3
lea rcx, [rsp + 0x2e0]
mov edx, 0x10
nop
movzx eax, byte [rcx + 0x10]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x1ed30
lea rcx, [rsp + 0x2e0]
mov edx, 0x10
nop
movzx eax, byte [rcx + 0x20]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x1ed50
lea rdx, [rbp + 0x128c]
lea rcx, [rsp + 0x230]
mov r8d, 0x80
call fcn.000145a0
lea r9, [rsp + 0x1e8]
lea r8, [rsp + 0x2e0]
lea rcx, [rsp + 0x230]
mov edx, 0xa
call fcn.00015930
movsxd r8, dword [rbp + 0x122e]
lea rdx, [rsp + 0x1e8]
lea rcx, [rsp + 0x1b2]
mov byte [rsp + 0x1b0], 0
call fcn.00016fd0
mov r12d, 0x10
mov r13b, 1
jmp 0x1ede4
movzx eax, byte [rsp + 0x1b0]
cmp byte [rbp + 2], r12b
mov dword [rbx], r12d
cmovne eax, r12d
mov byte [rsp + 0x1b0], al
xor byte [rbp + 3], dil
cmp byte [rsp + 0x1b0], 0x1f
ja 0x1ee1c
inc byte [rbp + 3]
movzx ecx, byte [r14]
movzx ebx, byte [rbp + 3]
lea r8, [rsp + 0x1b0]
and cl, 0x7f
mov dl, 2
mov byte [rsp + 0x1b1], bl
call fcn.00013db0
test eax, eax
je 0x1edf2
jmp 0x1ee23
mov bl, byte [rsp + 0x1b1]
movzx r11d, byte [rsp + 0x1b0]
lea r9, [rsp + 0x1b0]
nop
nop
nop
xor cl, cl
mov r8d, 4
nop
nop
movzx edx, word [rbp + 4]
add cl, cl
test dl, 1
je 0x1ee72
movzx eax, word [rbp + 6]
or cl, 1
xor ax, dx
shr ax, 1
or ax, 0x8000
mov word [rbp + 4], ax
jmp 0x1ee79
shr dx, 1
mov word [rbp + 4], dx
add cl, cl
test byte [rbp + 4], 0x80
je 0x1ee84
or cl, 1
dec r8
jne 0x1ee50
xor byte [r9], cl
inc r9
dec r15
jne 0x1ee40
test r13b, r13b
je 0x1ef04
test r12d, r12d
lea r9, [rsp + 0x1b2]
je 0x1ef04
test r12d, r12d
je 0x1ef04
mov r10d, r12d
nop
xor cl, cl
mov r8d, 4
nop
nop
movzx edx, word [rbp + 4]
add cl, cl
test dl, 1
je 0x1eee2
movzx eax, word [rbp + 6]
or cl, 1
xor ax, dx
shr ax, 1
or ax, 0x8000
mov word [rbp + 4], ax
jmp 0x1eee9
shr dx, 1
mov word [rbp + 4], dx
add cl, cl
test byte [rbp + 4], 0x80
je 0x1eef4
or cl, 1
dec r8
jne 0x1eec0
xor byte [r9], cl
inc r9
dec r10
jne 0x1eeb0
test r11b, r11b
jne 0x1ef1a
and word [rbp + 6], 0xff
movzx eax, bl
shl ax, 8
or word [rbp + 6], ax
mov r8, qword [rsp + 0x158]
mov eax, r12d
lea rdx, [rsp + 0x1b0]
mov ecx, dword [r8]
add rax, 2
cmp rax, rcx
cmovb rcx, rax
mov dword [r8], ecx
mov r8d, ecx
mov rcx, qword [rsp + 0x220]
call fcn.00016fd0
mov r15, qword [rsp + 0xc18]
mov r14, qword [rsp + 0xc20]
mov r13, qword [rsp + 0xc28]
mov r12, qword [rsp + 0xc30]
mov rdi, qword [rsp + 0xc38]
mov rsi, qword [rsp + 0xc40]
mov rbp, qword [rsp + 0xc48]
mov rbx, qword [rsp + 0xc50]
mov rcx, qword [rsp + 0xc00]
call fcn.00017320
add rsp, 0xc58
ret