Function at 0x140028730
Capabilities:
Encode data using base64
Encode data using xor
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x528
lea rbp, [rsp + 0x80]
mov eax, dword [0x141f30930]
and eax, dword [0x141f30934]
and eax, 0x85c96261
imul rax, rax, 0x3e80bb27
shr rax, 0x3b
cmp eax, 0x7e6648a0
je 0x140028a4e
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0xd8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0xe0], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0xe8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0xf8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x100], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x1f0], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x1f8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x108], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x110], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x120], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x128], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x130], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x200], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0xa8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0xb0], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0xb8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0xc0], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0xc8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0xd0], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x270], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x20], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x170], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x178], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x180], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x188], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x18], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r11, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rdi, rsp
mov eax, 0x70
call fcn.1400f4d10
sub rsp, rax
mov rbx, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r14, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r12, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r13, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rcx, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rdx, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r8, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r10, rsp
xor eax, eax
test al, al
je 0x140028c4e
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x70
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
jmp 0x140028772
mov qword [rbp + 0x198], r11
mov qword [rbp + 0x1a0], r10
mov qword [rbp + 0x220], r9
mov qword [rbp + 0x218], r8
mov qword [rbp + 0x230], rdx
mov qword [rbp + 0x228], rcx
mov qword [rbp + 0x1c8], r13
mov qword [rbp + 0x1c0], r12
mov qword [rbp + 0x1b8], r15
mov qword [rbp + 0x1b0], r14
mov qword [rbp + 0x1a8], rbx
mov qword [rbp + 0x1d0], rdi
mov qword [rbp + 0x240], rsi
mov eax, dword [0x141f30938]
or eax, dword [0x141f3093c]
or eax, 0x187f933b
mov ecx, 0xab9d0251
imul rcx, rax
shr rcx, 0x3f
add ecx, 0xc12cb5b
cmp ecx, 0x6f1ce83
jb 0x140029445
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x90], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x98], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0xa0], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x50], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x58], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x60], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x68], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x70], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x78], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x80], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x88], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x48], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x10], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x10], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x18], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x20], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x28], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x30], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x38], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x40], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x58], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x50], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x48], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x40], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x38], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x30], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x28], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x260], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x68], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x60], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x268], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x80], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x78], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x70], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x2c0], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x2c8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x2d0], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x2d8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x2e0], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x258], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x3d8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x290], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x2b0], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x2b8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x350], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x2f8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x300], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x308], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x310], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x318], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x320], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x328], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x368], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x298], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x2a0], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x2a8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x3b0], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x250], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x4a0], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x3a8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r14, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0xf0], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x140], rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x148], rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x210], rsp
mov eax, 0x60
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x118], rsp
mov eax, 0xd0
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x338], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x288], rsp
mov eax, 0xd0
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x248], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x138], rsp
mov eax, 0xd0
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x3e0], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x3f0], rsp
mov eax, 0x70
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x1d8], rsp
mov eax, 0xd0
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x1e0], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x1e8], rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x360], rsp
mov eax, 0xd0
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x348], rsp
mov eax, 0xd0
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x3a0], rsp
mov eax, 0xd0
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x3e8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x190], rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x428], rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x208], rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x160], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x168], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x150], rsp
mov eax, 0x30
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x158], rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x498], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x3f8], rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x340], rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x280], rsp
sub rsp, 0x20
mov ecx, 5
call fcn.140091490
add rsp, 0x20
lea rax, [0x141f15db7]
mov qword [r15], rax
mov rcx, qword [r15]
movabs rax, 0x44f6c3cb1fd41a51
mov qword [r14], rax
mov rdx, qword [r14]
sub rsp, 0x20
call fcn.140017af0
add rsp, 0x20
mov r14, qword [rax]
mov r15, qword [rax + 8]
mov rdi, qword [rax + 0x10]
mov r12d, dword [rax + 0x18]
movzx r13d, byte [rax + 0x1c]
movzx eax, byte [0x141f49078]
sub rsp, 0x20
xor esi, esi
mov edx, 0x1d
xor ecx, ecx
call fcn.1400c6170
add rsp, 0x20
test sil, sil
je 0x14002997f
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x60
call fcn.1400f4d10
sub rsp, rax
mov eax, 0xd0
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0xd0
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0xd0
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x70
call fcn.1400f4d10
sub rsp, rax
mov eax, 0xd0
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov eax, 0xd0
call fcn.1400f4d10
sub rsp, rax
mov eax, 0xd0
call fcn.1400f4d10
sub rsp, rax
mov eax, 0xd0
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x30
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
sub rsp, 0x20
mov ecx, 5
call fcn.140091490
add rsp, 0x20
lea rax, [0x141f15db7]
mov qword [rdi], rax
mov rcx, qword [rdi]
movabs rax, 0x44f6c3cb1fd41a51
mov qword [rsi], rax
mov rdx, qword [rsi]
sub rsp, 0x20
call fcn.140017af0
add rsp, 0x20
mov rcx, qword [rax]
mov rcx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov ecx, dword [rax + 0x18]
movzx eax, byte [rax + 0x1c]
movzx eax, byte [0x141f49078]
sub rsp, 0x20
mov edx, 0x1d
xor ecx, ecx
call fcn.1400c6170
add rsp, 0x20
jmp 0x140028cd9
mov rbx, rax
test rax, rax
je 0x14002bd4a
mov r11d, r12d
mov r10, rdi
movabs rdx, 0xcc88a9782c0b007a
movabs rcx, 0x8d3ffe41ae851465
movabs r12, 0x834d7acfca72d760
mov r8d, dword [0x141f30940]
imul r8d, dword [0x141f30944]
xor r8d, 0xb25ea18
imul r8d, r8d, 0x574f3ddf
or r8d, 0xeb45d475
cmp r8d, 0x9b6102ba
mov rsi, r14
mov rdi, r15
mov r14, r10
mov r15d, r11d
jae 0x140029a13
mov r8d, r15d
xor r8d, 0xed5f70cb
mov r9, r14
xor r9, rdx
mov r10, rdi
xor r10, rcx
mov r11, rsi
xor r11, r12
mov qword [rbx], r11
mov qword [rbx + 8], r10
mov qword [rbx + 0x10], r9
mov dword [rbx + 0x18], r8d
xor r13b, 0x68
xor r15d, 0xed5f70cb
xor r14, rdx
xor rdi, rcx
xor rsi, r12
nop word [rax + rax]
mov eax, dword [0x141f30948]
xor edx, edx
div dword [0x141f3094c]
xor eax, 0x40002042
and eax, 0x618833e6
xor eax, 0xfd763242
mov qword [rbx], rsi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], r14
mov dword [rbx + 0x18], r15d
cmp eax, 0x5dcb1c0f
jb 0x140029a30
mov byte [rbx + 0x1c], r13b
sub rsp, 0x20
lea r12, [rbp + 0x430]
mov r8d, 0x1d
mov rcx, r12
mov rdx, rbx
call fcn.1400a3b10
add rsp, 0x20
mov eax, dword [0x141f30950]
xor edx, edx
div dword [0x141f30954]
or eax, 0xd6926a74
imul eax, eax, 0x66522b00
and eax, 0xd6ade400
cmp eax, 0x785062f0
nop word [rax + rax]
xor eax, eax
test al, al
jne 0x140029ab0
mov rax, qword [rbp + 0x430]
cmp eax, 2
jne 0x14002a1e0
mov rax, qword [rbp + 0x438]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
mov qword [rbp + 0x238], rbx
jb 0x140029d99
test rcx, rcx
je 0x140029d99
lea r13, [rax - 1]
nop word cs:[rax + rax]
mov ecx, dword [0x141f30968]
imul ecx, dword [0x141f3096c]
add ecx, 0x69a39250
and ecx, 0xc8974296
add ecx, 0xdd016386
cmp ecx, 0x5f657d2b
ja 0x140029b00
nop word [rax + rax]
mov ecx, dword [0x141f30970]
or ecx, dword [str.P_fxl]
and ecx, 0xb9e306d
imul ecx, ecx, 0x57b7445b
add ecx, 0x4865bcfa
cmp ecx, 0x6db46825
jb 0x140029b30
mov r15, qword [rax - 1]
mov rsi, qword [rax + 7]
nop
mov eax, dword [0x141f30978]
sub eax, dword [0x141f3097c]
or eax, 0x3d6c5d8c
imul eax, eax, 0x84716385
imul rax, rax, 0xb544461
shr rax, 0x3b
cmp eax, 0xc659eb0d
je 0x140029b60
mov rdi, qword [rsi]
test rdi, rdi
je 0x140029c1f
mov eax, dword [0x141f30980]
xor eax, dword [0x141f30984]
xor eax, 0x2d293256
imul rax, rax, 0x4acd2633
shr rax, 0x3e
or eax, 0x5cba1b98
cmp eax, 0xcad83dc6
jbe 0x140029bd0
sub rsp, 0x20
mov rcx, r15
call rdi
add rsp, 0x20
nop word [rax + rax]
mov eax, dword [0x141f30988]
or eax, dword [0x141f3098c]
imul ebx, eax, 0xb79dd07c
add ebx, 0x4a526d93
sub rsp, 0x20
mov rcx, r15
call rdi
add rsp, 0x20
cmp ebx, 0x92b160e4
jb 0x140029bd0
nop dword [rax]
mov eax, dword [0x141f30990]
imul eax, dword [0x141f30994]
imul eax, eax, 0x9dfb0995
add eax, 0x4c60439d
cmp eax, 0xd4d2a0fc
ja 0x140029c00
mov eax, dword [0x141f30998]
xor edx, edx
div dword [0x141f3099c]
xor eax, eax
nop
test al, al
jne 0x140029c30
mov eax, 0xce80c821
nop dword [rax]
mov ecx, dword [0x141f309a0]
xor ecx, dword [0x141f309a4]
imul ecx, ecx, 0x75849877
add ecx, 0x79659ad
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x1d39280c
ja 0x140029c40
cmp qword [rsi + 8], 0
je 0x140029cff
mov rax, qword [rsi + 0x10]
nop word [rax + rax]
mov ecx, dword [0x141f309a8]
sub ecx, dword [0x141f309ac]
or ecx, 0xd904d535
imul rdx, rcx, 0x5c776747
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1b
xor ecx, 0x1bae3c72
cmp ecx, 0xa7966a10
ja 0x140029c80
cmp rax, 0x11
jb 0x140029ce5
mov r15, qword [r15 - 8]
nop
mov eax, dword [0x141f309b0]
xor edx, edx
div dword [0x141f309b4]
add eax, 0x77134770
or eax, 0x38ab3adc
imul eax, eax, 0xc2f84769
cmp eax, 0x90b45294
ja 0x140029cc0
mov rcx, qword [0x141f49060]
sub rsp, 0x20
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov eax, dword [0x141f309b8]
imul eax, dword [0x141f309bc]
imul eax, eax, 0x32815c72
add eax, 0x65f30486
mov ecx, 0x82740b11
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xc4047bd1
jbe 0x140029d40
mov rax, qword [0x141f49060]
nop word cs:[rax + rax]
mov eax, dword [0x141f309c0]
and eax, dword [0x141f309c4]
and eax, 0xb125e72e
xor eax, 0xd2158853
add eax, 0x22fd7ef2
mov rcx, qword [0x141f49060]
cmp eax, 0x5aa29098
jb 0x140029d40
sub rsp, 0x20
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop dword [rax]
mov eax, dword [0x141f309c8]
and eax, dword [0x141f309cc]
imul eax, eax, 0x794181f4
cmp eax, 0xff3eab24
je 0x140029d80
lea rax, [0x141f17a80]
mov qword [rbp + 0x430], rax
mov rcx, qword [rbp + 0x430]
movabs rax, 0x7d92d8286e2e030c
mov qword [rbp + 0x430], rax
mov rdx, qword [rbp + 0x430]
sub rsp, 0x20
call fcn.14001aed0
add rsp, 0x20
movabs rcx, 0x233e4dc515ee965
xor rcx, qword [rax]
movabs rdx, 0x10bbf3d1aba32a88
xor rdx, qword [rax + 8]
movzx eax, byte [rax + 0x10]
xor al, 0x91
mov qword [rbp + 0x388], rcx
mov qword [rbp + 0x390], rdx
mov byte [rbp + 0x398], al
lea rax, [rbp + 0x399]
lea rcx, [rbp + 0x388]
mov qword [rbp + 0x430], rcx
mov qword [rbp + 0x438], rax
mov eax, dword [0x141f309d0]
xor edx, edx
div dword [0x141f309d4]
xor eax, 0x91730e91
imul rax, rax, 0x276f477b
shr rax, 0x3d
imul eax, eax, 0xeb9062e8
cmp eax, 0x3aa92305
jne 0x140029e92
mov word [rbp + 0x440], 0
mov dword [rbp + 0x448], 1
sub rsp, 0x20
lea rcx, [rbp + 0x400]
lea rdx, [rbp + 0x430]
call fcn.140088da0
add rsp, 0x20
mov qword [rbp + 0x430], 0
mov dword [rbp + 0x370], 0
lea rdi, [rbp + 0x400]
lea r13, [rbp + 0x430]
mov esi, dword [0x141f309d8]
sub esi, dword [0x141f309dc]
xor esi, 0x578ecd24
add esi, 0x755223c0
or esi, 0x68ee98e4
mov word [rbp + 0x440], 0
mov dword [rbp + 0x448], 1
sub rsp, 0x20
mov rcx, rdi
mov rdx, r13
call fcn.140088da0
add rsp, 0x20
mov qword [rbp + 0x430], 0
mov dword [rbp + 0x370], 0
cmp esi, 0x368d9cea
je 0x140029ea0
mov eax, dword [0x141f309e0]
xor edx, edx
div dword [0x141f309e4]
imul eax, eax, 0x9c53c7d9
imul rcx, rax, 0x12d40e2b
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
add eax, 0xb0cf03f9
lea rbx, [rbp + 0x370]
cmp eax, 0x51e480f9
jae 0x140029f90
mov rdx, qword [rbp + 0x408]
sub rsp, 0x50
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
add rsp, 0x50
nop word cs:[rax + rax]
mov eax, dword [0x141f309e8]
sub eax, dword [0x141f309ec]
imul esi, eax, 0x7fcd2cd5
add esi, 0x16a710f3
xor esi, 0x645b3def
mov r15, qword [rbp + 0x408]
sub rsp, 0x50
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
mov rdx, r15
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
add rsp, 0x50
cmp esi, 0xbf0db3d0
ja 0x140029f90
mov r14d, eax
test eax, eax
je 0x14002a020
mov r12, r14
shl r12, 0x20
or r12, 2
jmp 0x14002a07b
mov eax, dword [0x141f309f0]
xor edx, edx
div dword [0x141f309f4]
imul eax, eax, 0x7a062850
or eax, 0x74694e71
add eax, 0x4807152d
cmp eax, 0xeb9200bc
ja 0x14002a020
nop word cs:[rax + rax]
mov eax, dword [0x141f309f8]
xor edx, edx
div dword [0x141f309fc]
add eax, 0x60b3eaba
and eax, 0x33ed03eb
add eax, 0x87fa70f
cmp eax, 0x80978f65
jae 0x14002a050
mov r12, qword [rbp + 0x430]
xor eax, eax
test al, al
nop
mov eax, dword [0x141f30a00]
xor edx, edx
div dword [0x141f30a04]
and eax, 0x550c0480
cmp eax, 0x6214707f
je 0x14002a080
cmp qword [rbp + 0x400], 0
je 0x14002a0c0
mov rcx, qword [0x141f49060]
sub rsp, 0x20
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop
mov eax, dword [0x141f30a08]
xor eax, dword [0x141f30a0c]
and eax, 0x95529ff6
add eax, 0xfa4e34da
xor eax, 0xe105cdcc
cmp eax, 0x3bf0e44b
jb 0x14002a0c0
nop word cs:[rax + rax]
mov eax, dword [0x141f30a10]
imul eax, dword [0x141f30a14]
and eax, 0xa9bbe8ed
imul eax, eax, 0xe001ad11
cmp eax, 0x277c9a0a
je 0x14002a0f0
test r14d, r14d
je 0x14002a1db
lea rax, [0x141f12e22]
mov qword [rbp + 0x430], rax
mov rcx, qword [rbp + 0x430]
movabs rax, 0xe0c788b119bc1cd3
mov qword [rbp + 0x430], rax
mov rdx, qword [rbp + 0x430]
sub rsp, 0x20
call fcn.140017d40
add rsp, 0x20
movabs rcx, 0xb0eb7465d4cd17de
xor rcx, qword [rax]
movabs rdx, 0x1ce0ad271290d196
xor rdx, qword [rax + 8]
movzx eax, byte [rax + 0x10]
xor al, 0x25
mov qword [rbp + 0x370], rcx
mov qword [rbp + 0x378], rdx
mov byte [rbp + 0x380], al
lea rax, [rbp + 0x381]
mov qword [rbp + 0x430], rbx
mov qword [rbp + 0x438], rax
mov word [rbp + 0x440], 0
mov word [rbp + 0x448], 1
mov eax, dword [0x141f30a18]
imul eax, dword [0x141f30a1c]
imul eax, eax, 0x29c32048
add eax, 0xf2906e58
and eax, 0x954befa8
cmp eax, 0x1fa12f7e
jne 0x14002a389
jmp 0x14002a42a
mov r14, r12
jmp 0x14002a237
mov eax, dword [0x141f30958]
imul eax, dword [str.Js]
or eax, 0x115526
and eax, 0x1835d56e
add eax, 0x267a1ec4
cmp eax, 0xe6ec501c
ja 0x14002a228
mov esi, dword [0x141f30960]
xor esi, dword [0x141f30964]
sub rsp, 0x20
call fcn.1400c5f80
add rsp, 0x20
cmp esi, 0xd05a7d76
jne 0x14002bd4a
sub rsp, 0x20
call fcn.1400c5f80
add rsp, 0x20
jmp 0x14002a203
lea rax, [0x141f16296]
mov qword [rbp + 0x430], rax
mov rcx, qword [rbp + 0x430]
movabs rax, 0xed5572516afc2e29
mov qword [rbp + 0x430], rax
mov rdx, qword [rbp + 0x430]
sub rsp, 0x20
call fcn.14001a090
add rsp, 0x20
mov ecx, dword [rax]
movzx eax, byte [rax + 4]
xor al, 0xaa
mov edx, 0xd8847c6e
xor rdx, rcx
mov byte [rbp + 0x374], al
mov dword [rbp + 0x370], edx
lea rax, [rbp + 0x375]
mov qword [rbp + 0x430], rbx
mov qword [rbp + 0x438], rax
mov word [rbp + 0x440], 0
mov dword [rbp + 0x448], 1
sub rsp, 0x20
lea rcx, [rbp + 0x400]
lea rdx, [rbp + 0x430]
call fcn.140088da0
add rsp, 0x20
mov dword [rbp + 0x3c0], 0x800
mov dword [rbp + 0x388], 0
movzx eax, byte [0x141f49078]
sub rsp, 0x20
mov edx, 0x800
xor ecx, ecx
call fcn.1400c6170
add rsp, 0x20
test rax, rax
je 0x14002a33d
mov r13, rax
mov qword [rbp + 0x430], 0x800
mov eax, dword [0x141f30a48]
and eax, dword [0x141f30a4c]
xor eax, 0x573c312a
add eax, 0xfaf28776
or eax, 0x136599b
cmp eax, 0x6ad7d1fe
jae 0x14002a637
jmp 0x14002a66b
mov eax, dword [0x141f30a38]
xor edx, edx
div dword [0x141f30a3c]
add eax, 0xd0383ab7
xor eax, 0x1af40610
cmp eax, 0x9b9b16f8
jb 0x14002a385
mov eax, dword [0x141f30a40]
xor eax, dword [0x141f30a44]
xor eax, 0x10534450
or eax, 0xe9241b87
imul eax, eax, 0xddc01405
ud2
ud2
mov eax, dword [0x141f30a20]
xor edx, edx
div dword [0x141f30a24]
mov r15d, eax
and r15d, 0xd0936f01
xor r15d, 0x9a80da36
mov eax, 0x82d62b47
imul rax, r15
shr rax, 0x20
sub r15d, eax
shr r15d, 1
add r15d, eax
shr r15d, 0x1e
mov word [rbp + 0x44a], 0
sub rsp, 0x20
lea rcx, [rbp + 0x400]
lea rdi, [rbp + 0x430]
mov rdx, rdi
call fcn.140088da0
add rsp, 0x20
mov qword [rbp + 0x430], 0
mov r14, qword [rbp + 0x408]
sub rsp, 0x30
mov qword [rsp + 0x20], rdi
mov rcx, 0xffffffff80000002
mov rdx, r14
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add rsp, 0x30
cmp r15d, 0x7cf53f35
jbe 0x14002a48b
mov word [rbp + 0x44a], 0
sub rsp, 0x20
lea rcx, [rbp + 0x400]
lea rdi, [rbp + 0x430]
mov rdx, rdi
call fcn.140088da0
add rsp, 0x20
mov qword [rbp + 0x430], 0
mov rdx, qword [rbp + 0x408]
sub rsp, 0x30
mov qword [rsp + 0x20], rdi
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add rsp, 0x30
jmp 0x14002a389
mov edi, eax
mov rsi, qword [rbp + 0x430]
cmp qword [rbp + 0x400], 0
je 0x14002a510
mov eax, dword [0x141f30a28]
add eax, dword [str.D_f4ar]
or eax, 0x1a3ec72a
xor eax, 0xbad9608a
add eax, 0xbf43a3f3
cmp eax, 0xb355462e
jbe 0x14002a4c7
mov rax, qword [0x141f49060]
xor eax, eax
nop dword [rax]
mov rcx, qword [0x141f49060]
test al, al
jne 0x14002a4d0
sub rsp, 0x20
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop
mov eax, dword [0x141f30a30]
xor edx, edx
div dword [0x141f30a34]
imul eax, eax, 0x625fbf31
add eax, 0xbdcdbc49
cmp eax, 0xb5d5969b
ja 0x14002a4f0
test edi, edi
jne 0x14002bd4a
mov r14, rsi
nop dword [rax + rax]
mov eax, dword [0x141f30af8]
imul eax, dword [0x141f30afc]
imul eax, eax, 0x6f208e5
add eax, 0xa98de847
xor eax, 0xaca5d3a3
cmp eax, 0xc7fc48be
jb 0x14002a520
mov eax, r12d
and eax, 3
lea rcx, [0x141f2659c]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov eax, dword [0x141f30a50]
xor eax, dword [0x141f30a54]
add eax, 0xa26afe9d
xor eax, 0xf088890
or eax, 0x50b3174f
mov qword [rbp + 0x438], r13
mov qword [rbp + 0x440], 0
cmp eax, 0x2cecb6f9
jae 0x14002a67f
mov qword [rbp + 0x438], r13
mov qword [rbp + 0x440], 0
jmp 0x14002a637
mov r12, qword [rbp + 0x408]
nop word cs:[rax + rax]
mov eax, dword [0x141f30a58]
imul eax, dword [str.qA6]
xor eax, 0x7fc3723a
add eax, 0xf7065de7
cmp eax, 0xec6e0094
ja 0x14002a690
mov edi, 0x800
xor r15d, r15d
lea r9, [rbp + 0x388]
mov rsi, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, 0x96ed6d65
mov qword [rbp + 0x3b8], r14
mov qword [rbp + 0x330], rdi
sub rdi, r15
nop word [rax + rax]
sub rsp, 0x30
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov rcx, r14
mov rdx, r12
xor r8d, r8d
call rsi
add rsp, 0x30
cmp eax, 0xea
jne 0x14002a793
mov eax, dword [0x141f30a70]
imul eax, dword [0x141f30a74]
shr eax, 1
imul rax, rbx
shr rax, 0x3e
or eax, 0x68bd8436
cmp eax, 0xcde55b7b
ja 0x14002a70f
mov r8d, dword [rbp + 0x3c0]
cmp rdi, r8
mov r14, qword [rbp + 0x3b8]
lea r9, [rbp + 0x388]
jae 0x14002a6e0
sub rsp, 0x30
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rbp + 0x430]
mov rdx, r15
call fcn.1401035b0
lea r9, [rbp + 0x388]
add rsp, 0x30
mov rdi, qword [rbp + 0x430]
mov r13, qword [rbp + 0x438]
mov r15, qword [rbp + 0x440]
jmp 0x14002a6d0
mov r14d, eax
test eax, eax
jne 0x14002a7ce
mov esi, dword [rbp + 0x3c0]
mov qword [rbp + 0x440], rsi
mov r15d, dword [rbp + 0x388]
cmp r15d, 0xb
movabs rdi, 0x8000000000000000
jbe 0x14002a8f9
movabs r14, 0xde00000002
jmp 0x14002a810
mov eax, dword [0x141f30a60]
xor edx, edx
div dword [0x141f30a64]
shl r14, 0x20
or r14, 2
movabs rdi, 0x8000000000000000
nop
mov eax, dword [0x141f30a68]
xor edx, edx
div dword [0x141f30a6c]
imul eax, eax, 0x7db3f65a
or eax, 0xfef52f23
cmp eax, 0xc2ab4b7
jb 0x14002a7f0
mov rcx, qword [rbp + 0x330]
nop word [rax + rax]
mov eax, dword [0x141f30a80]
or eax, dword [0x141f30a84]
imul eax, eax, 0xdda9bb34
add eax, 0xde860a8
xor eax, 0x15ccf451
cmp eax, 0x6df0f365
ja 0x14002a820
test rcx, rcx
je 0x14002a8e4
mov rdi, qword [0x141f49060]
mov eax, dword [0x141f30a88]
and eax, dword [0x141f30a8c]
imul eax, eax, 0xb585b3f
or eax, 0xfdcfffed
cmp eax, 0x499c111a
jne 0x14002a887
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_HeapFree]
xor r15d, r15d
nop word cs:[rax + rax]
mov eax, dword [0x141f30a90]
imul eax, dword [0x141f30a94]
imul eax, eax, 0x7ce0008b
and eax, 0xae11ed47
imul ebx, eax, 0xf6a04edf
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, r13
call rsi
add rsp, 0x20
cmp ebx, 0x98fbc627
jae 0x14002a8a0
movabs rdi, 0x8000000000000000
jmp 0x14002a8e7
xor r15d, r15d
mov rcx, rdi
mov r13, r14
cmp qword [rbp + 0x400], 0
jne 0x14002a90a
jmp 0x14002a960
mov rcx, qword [rbp + 0x330]
cmp qword [rbp + 0x400], 0
je 0x14002a960
xor eax, eax
test al, al
je 0x14002a917
mov rax, qword [0x141f49060]
mov rbx, rcx
nop word [rax + rax]
mov eax, dword [0x141f30a78]
or eax, dword [0x141f30a7c]
xor eax, 0xa89f9c04
imul eax, eax, 0x8bc2736c
mov rcx, qword [0x141f49060]
cmp eax, 0x8af8a12f
ja 0x14002a920
sub rsp, 0x20
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov rcx, rbx
nop dword [rax + rax]
mov eax, dword [0x141f30a98]
and eax, dword [0x141f30a9c]
imul eax, eax, 0xe9d31be
xor eax, 0xcfab46cf
imul eax, eax, 0x7bf1a246
cmp eax, 0x487f805f
jb 0x14002a960
nop word cs:[rax + rax]
mov eax, dword [0x141f30aa0]
imul eax, dword [0x141f30aa4]
imul rax, rax, 0x2cc30207
shr rax, 0x3d
imul eax, eax, 0x3af8d501
add eax, 0x5c8ca879
cmp eax, 0x8e0dfede
ja 0x14002a990
xor eax, eax
nop dword [rax]
test al, al
jne 0x14002a9c0
cmp rcx, rdi
jne 0x14002aa30
nop dword [rax]
mov eax, dword [0x141f30ae8]
or eax, dword [0x141f30aec]
imul eax, eax, 0x852284e
add eax, 0x55100bd8
imul rax, rax, 0x41e80351
shr rax, 0x3e
cmp eax, 0xc98d2149
ja 0x14002a9d0
mov eax, 0x8ca7dfcf
nop
mov ecx, dword [0x141f30af0]
and ecx, dword [0x141f30af4]
add ecx, 0x7f86c75b
imul rcx, rax
shr rcx, 0x3e
imul ecx, ecx, 0x7fbc5a58
cmp ecx, 0x917c870b
ja 0x14002aa00
mov rsi, r13
jmp 0x14002abe0
mov eax, dword [0x141f30aa8]
or eax, dword [0x141f30aac]
and eax, 0x54a884
cmp eax, 0xd4da14d5
je 0x14002aa30
cmp r15b, 5
je 0x14002aa80
movzx eax, r15b
cmp eax, 4
jne 0x14002ab38
nop dword [rax + rax]
mov eax, dword [0x141f30ab0]
add eax, dword [0x141f30ab4]
or eax, 0xdefff7ff
cmp eax, 0x2a90b280
jb 0x14002aa60
jmp 0x14002aa93
mov eax, dword [0x141f30ab8]
and eax, dword [0x141f30abc]
cmp eax, 0x18e7faa3
je 0x14002aa80
cmp rsi, 4
jne 0x14002ab1e
nop dword [rax]
mov eax, dword [0x141f30ac0]
add eax, dword [0x141f30ac4]
and eax, 0x846b45b6
imul eax, eax, 0x83081a1c
cmp eax, 0x8c3ef9b5
ja 0x14002aaa0
nop
mov eax, dword [0x141f30ac8]
imul eax, dword [0x141f30acc]
imul eax, eax, 0xdcefb20c
xor eax, 0x515d6f68
shr eax, 2
imul rax, rax, 0x41b36b7f
shr rax, 0x3c
cmp eax, 0xa059b896
ja 0x14002aac0
nop dword [rax]
mov eax, dword [0x141f30ad0]
and eax, dword [0x141f30ad4]
imul eax, eax, 0x89ad43e2
xor eax, 0xf5bc1812
cmp eax, 0xa23432f6
ja 0x14002aaf0
mov bl, 1
shl rcx, 1
test rcx, rcx
je 0x14002abd8
jmp 0x14002ab50
xor ebx, ebx
movabs rsi, 0xd00000002
shl rcx, 1
test rcx, rcx
je 0x14002abd8
jmp 0x14002ab50
movabs rsi, 0xde00000002
xor ebx, ebx
shl rcx, 1
test rcx, rcx
je 0x14002abd8
mov eax, dword [0x141f30ad8]
xor eax, dword [0x141f30adc]
imul eax, eax, 0xe8f1ecad
mov ecx, 0xbd0c18a9
imul rcx, rax
shr rcx, 0x3f
imul eax, ecx, 0x20f79fd8
cmp eax, 0x22beaf6f
je 0x14002abbc
mov edi, dword [0x141f30ae0]
or edi, dword [0x141f30ae4]
add edi, 0x366055
and edi, 0xfbe04823
add edi, 0x778fdfb1
mov rcx, qword [0x141f49060]
sub rsp, 0x20
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp edi, 0xe0366b70
jbe 0x14002abd8
mov rcx, qword [0x141f49060]
sub rsp, 0x20
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x14002ab7c
test bl, bl
jne 0x14002acb9
mov eax, esi
and eax, 3
lea rcx, [0x141f265ac]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
lea r13, [rbp + 0x3c0]
jmp rax
lea rax, [0x141f1bc50]
mov qword [rbp + 0x3c0], rax
lea rdx, [rbp + 0x3c0]
mov rcx, qword [rbp + 0x3c0]
movabs rax, 0x26235929db028556
mov qword [rbp + 0x3c0], rax
mov rdx, qword [rbp + 0x3c0]
sub rsp, 0x20
call fcn.1400193d0
add rsp, 0x20
mov rsi, rax
nop dword [rax]
mov eax, dword [0x141f30b60]
imul eax, dword [0x141f30b64]
cmp eax, 0xf8030362
je 0x14002ad00
movabs r12, 0xb968ed20c740a088
movabs r14, 0xa2dc36333d5b5786
movabs rdi, 0x887e05dc14c4621f
mov eax, dword [0x141f30b68]
add eax, dword [0x141f30b6c]
or eax, 0x2ce8089
and eax, 0x92ce98cd
add eax, 0xd8a484d7
cmp eax, 0x8be15b6f
lea r13, [rbp + 0x370]
lea rbx, [rbp + 0x388]
ja 0x14002ae93
mov eax, dword [0x141f30b70]
sub eax, dword [0x141f30b74]
mov rcx, qword [rsi]
xor rcx, rdi
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
mov r9, qword [rsi + 0x18]
mov r10d, 0xa752c3fe
xor r10d, dword [rsi + 0x20]
movzx r11d, word [rsi + 0x24]
mov qword [rbp + 0x400], rcx
movabs rcx, 0x357283015071967e
xor rdx, rcx
mov qword [rbp + 0x408], rdx
xor r8, r12
mov qword [rbp + 0x410], r8
xor r9, r14
mov qword [rbp + 0x418], r9
mov dword [rbp + 0x420], r10d
mov ecx, r11d
xor cl, 0x68
mov byte [rbp + 0x424], cl
shr r11d, 8
xor r11b, 0xf1
mov byte [rbp + 0x425], r11b
mov qword [rbp + 0x388], r13
lea rcx, [0x14000d730]
mov qword [rbp + 0x390], rcx
lea rcx, [0x140108eb0]
mov qword [rbp + 0x430], rcx
mov r15, r14
mov r14, r12
imul r12, rax, 0x44984523
shr r12, 0x3e
add r12d, 0x226fea85
and r12d, 0x2043c286
lea rax, [rbp + 0x400]
mov qword [rbp + 0x370], rax
mov qword [rbp + 0x378], 0x26
mov qword [rbp + 0x438], 2
mov qword [rbp + 0x450], 0
mov qword [rbp + 0x440], rbx
mov qword [rbp + 0x448], 1
sub rsp, 0x20
lea rcx, [rbp + 0x430]
call fcn.1400a6160
call fcn.1400c5f80
add rsp, 0x20
cmp r12d, 0x318e96d9
mov r12, r14
mov r14, r15
jbe 0x14002bd4a
mov rax, qword [rsi]
xor rax, rdi
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov r8, qword [rsi + 0x18]
mov r9d, 0xa752c3fe
xor r9d, dword [rsi + 0x20]
movzx r10d, word [rsi + 0x24]
mov qword [rbp + 0x400], rax
movabs rax, 0x357283015071967e
xor rcx, rax
mov qword [rbp + 0x408], rcx
xor rdx, r12
mov qword [rbp + 0x410], rdx
xor r8, r14
mov qword [rbp + 0x418], r8
mov dword [rbp + 0x420], r9d
mov eax, r10d
xor al, 0x68
mov byte [rbp + 0x424], al
shr r10d, 8
xor r10b, 0xf1
mov byte [rbp + 0x425], r10b
mov qword [rbp + 0x388], r13
lea rax, [0x14000d730]
mov qword [rbp + 0x390], rax
lea rax, [0x140108eb0]
mov qword [rbp + 0x430], rax
lea rax, [rbp + 0x400]
mov qword [rbp + 0x370], rax
mov qword [rbp + 0x378], 0x26
mov qword [rbp + 0x438], 2
mov qword [rbp + 0x450], 0
mov qword [rbp + 0x440], rbx
mov qword [rbp + 0x448], 1
sub rsp, 0x20
lea rcx, [rbp + 0x430]
call fcn.1400a6160
call fcn.1400c5f80
add rsp, 0x20
jmp 0x14002ad66
ud2