Function at 0x140199d90
Capabilities:
Create pipe
Encode data using base64
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x30], xmm6
mov r10d, edx
xor eax, eax
test al, al
jne 0x140199e58
mov eax, dword [0x1415a2ad0]
xor eax, dword [0x1415a2ad4]
mov r8d, eax
not r8d
mov r9d, eax
and r9d, 0x774dd086
and r8d, 0x88b22f79
imul r8d, r9d
mov r9d, eax
and r9d, 0x88b22f79
or eax, 0x88b22f79
imul eax, r9d
add eax, r8d
mov r8d, eax
not r8d
and r8d, 0xe3e13cb3
mov r9d, eax
and r9d, 0x1c1ec34c
imul r9d, r8d
mov r8d, eax
and r8d, 0xe3e13cb3
or eax, 0xe3e13cb3
imul eax, r8d
add eax, r9d
mov r8d, eax
not r8d
or eax, 0xafb24178
or r8d, 0x504dbe87
and r8d, eax
mov eax, 0x20
call fcn.14020e090
sub rsp, rax
mov rax, rsp
cmp r8d, 0xb688c889
jbe 0x140199e6a
mov eax, 0x20
call fcn.14020e090
sub rsp, rax
jmp 0x140199dbc
mov qword [rbp], rax
mov eax, dword [0x1415a2ad8]
mov r8d, dword [0x1415a2adc]
mov r9d, r8d
and r9d, eax
add eax, r8d
sub eax, r9d
mov r8d, eax
and r8d, 0x235abb63
add r8d, r8d
neg r8d
add eax, r8d
add eax, 0x235abb63
imul rax, rax, 0x54bd59c9
shr rax, 0x3e
cmp eax, 0x61419214
jne 0x140199f19
mov eax, 0x10
call fcn.14020e090
sub rsp, rax
mov eax, 0x20
call fcn.14020e090
sub rsp, rax
mov eax, 0x30
call fcn.14020e090
sub rsp, rax
mov eax, 0x10
call fcn.14020e090
sub rsp, rax
mov eax, 0x10
call fcn.14020e090
sub rsp, rax
mov eax, 0x20
call fcn.14020e090
sub rsp, rax
mov eax, 0x30
call fcn.14020e090
sub rsp, rax
mov eax, 0x20
call fcn.14020e090
sub rsp, rax
mov byte [rbp + 0x2f], r10b
mov qword [rbp - 0x10], rcx
nop word cs:[rax + rax]
mov ecx, dword [0x1415a2ae0]
xor ecx, dword [0x1415a2ae4]
mov eax, ecx
not eax
mov r8d, ecx
and r8d, 0x995244bc
and eax, 0x66adbb43
imul eax, r8d
mov r8d, ecx
and r8d, 0x66adbb43
or ecx, 0x66adbb43
imul ecx, r8d
add ecx, eax
mov eax, 0x10
call fcn.14020e090
sub rsp, rax
mov r10, rsp
mov eax, 0x20
call fcn.14020e090
sub rsp, rax
mov r8, rsp
mov eax, 0x30
call fcn.14020e090
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.14020e090
sub rsp, rax
mov r11, rsp
mov eax, 0x10
call fcn.14020e090
sub rsp, rax
mov rsi, rsp
mov eax, 0x20
call fcn.14020e090
sub rsp, rax
mov rdi, rsp
mov eax, 0x30
call fcn.14020e090
sub rsp, rax
mov rbx, rsp
mov eax, 0x20
call fcn.14020e090
sub rsp, rax
mov rax, rsp
cmp ecx, 0x4069f300
je 0x140199f30
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x78], r11
mov qword [rbp - 0x18], r10
mov qword [rbp - 0x28], r8
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x50], r9
mov byte [rbp + 0x2e], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rbp - 0x20], ecx
mov dword [rbp + 0x14], 8
xorps xmm6, xmm6
mov r12, qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
mov r14d, 0xb5d83b07
mov r13, 0xffffffffffffffff
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
mov sil, 1
xor eax, eax
mov qword [rbp - 0x30], rax
nop word [rax + rax]
sub rsp, 0x20
call fcn.14020d460
add rsp, 0x20
mov rcx, qword [rbp - 0x48]
mov dword [rcx], eax
mov rax, qword [0x1415acba0]
test rax, rax
mov rcx, qword [rbp - 0x18]
je 0x14019a1b0
mov eax, 1
lock xadd qword [0x1415acba0], rax
mov rcx, qword [rbp - 0x78]
mov qword [rcx], rax
mov rax, qword [rbp - 0x48]
mov r8, qword [rbp - 0x70]
mov qword [r8], rax
lea rax, [0x1400bc420]
mov qword [r8 + 8], rax
mov qword [r8 + 0x10], rcx
lea rax, [0x1400b29c0]
mov qword [r8 + 0x18], rax
mov rdx, qword [rbp - 0x68]
lea rax, [0x141578b18]
mov qword [rdx], rax
mov qword [rdx + 8], 2
mov qword [rdx + 0x20], 0
mov qword [rdx + 0x10], r8
mov qword [rdx + 0x18], 2
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
call fcn.140082280
add rsp, 0x20
test rbx, rbx
sete al
or sil, al
test sil, 1
mov ebx, 4
mov r12, qword [rbp + 0x18]
jne 0x14019a310
nop dword [rax + rax]
mov eax, dword [0x1415a2c78]
or eax, dword [0x1415a2c7c]
mov ecx, eax
not ecx
and ecx, 0x58ad0a53
mov edx, eax
and edx, 0xa752f5ac
imul edx, ecx
mov ecx, eax
and ecx, 0x58ad0a53
or eax, 0x58ad0a53
imul eax, ecx
add eax, edx
xor eax, 0x8f148cb7
add eax, 0xd03ea1cb
cmp eax, 0x68051d18
jb 0x14019a120
mov rsi, qword [0x1415acb98]
mov eax, dword [0x1415a2c80]
or eax, dword [0x1415a2c84]
imul eax, eax, 0xbdde4e52
add eax, 0x194aec42
xor eax, 0xa6f13b59
cmp eax, 0x6ef3e6dd
jbe 0x14019b480
jmp 0x14019b4c8
mov rax, qword [0x1415acba0]
test rax, rax
jne 0x14019a087
mov eax, dword [0x1415a2ae8]
xor eax, dword [0x1415a2aec]
add eax, 0xcea77f23
mov edx, eax
not edx
or eax, 0x79daeca8
or edx, 0x86251357
and edx, eax
cmp edx, 0x6093f94c
je 0x14019a280
nop
mov r8d, dword [0x1415a2af0]
mov eax, dword [0x1415a2af4]
mov edx, eax
not edx
and edx, r8d
xor eax, r8d
add eax, r8d
sub eax, edx
add eax, 0xa9a790f
mov r8d, eax
not r8d
mov edx, eax
and edx, 0x5530c434
and r8d, 0xaacf3bcb
imul r8d, edx
mov edx, eax
and edx, 0xaacf3bcb
or eax, 0xaacf3bcb
imul eax, edx
lea edi, [rax + r8]
add edi, 0x75e9e5e8
movups xmmword [rcx], xmm6
sub rsp, 0x20
mov edx, 0x10
call r12
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
cmp edi, 0x217eb28
jb 0x14019a280
mov eax, dword [0x1415a2af8]
sub eax, dword [0x1415a2afc]
and eax, 0x119cbe14
add eax, 0xeb858391
or eax, 0xe0149858
cmp eax, 0xebff8957
jae 0x14019a2a0
jmp 0x14019a2ff
movups xmmword [rcx], xmm6
sub rsp, 0x20
mov edx, 0x10
call r12
mov rcx, qword [rbp - 0x18]
add rsp, 0x20
jmp 0x14019a1e0
mov eax, dword [0x1415a2b00]
mov r8d, dword [0x1415a2b04]
not eax
not r8d
or r8d, eax
mov eax, r8d
not eax
mov edx, eax
and edx, 0xf0d4dc10
and r8d, 0xf2b23ef
imul r8d, edx
mov edx, eax
and edx, 0xf2b23ef
or eax, 0xf2b23ef
imul eax, edx
add eax, r8d
or eax, 0x55000050
and eax, 0xdf650050
mov rdx, qword [rcx]
mov qword [0x1415acba0], rdx
cmp eax, 0x2e1c97c5
jne 0x14019a1a0
mov rax, qword [rcx]
mov qword [0x1415acba0], rax
jmp 0x14019a2a0
mov rax, qword [rbp - 0x30]
lea r9d, [rax + 1]
mov r8, qword [rbp - 0x40]
mov r11, qword [r8]
nop
mov eax, dword [0x1415a2b08]
sub eax, dword [0x1415a2b0c]
mov ecx, eax
xor ecx, 0x3a3982b3
and eax, 0x45c67d4c
add eax, eax
sub eax, ecx
mov ecx, eax
xor ecx, 0xd042010
xor eax, 0xa2fbcfe2
mov edx, eax
and edx, 0xd2b09dad
and ecx, 0x2d4f6252
imul ecx, edx
mov edx, eax
and edx, 0x2d4f6252
or eax, 0x2d4f6252
imul eax, edx
add eax, ecx
cmp eax, 0xd8645ce9
ja 0x14019a320
mov rax, qword [r8 + 8]
mov rsi, qword [r8 + 0x10]
mov qword [rbp + 0x18], rax
lea r15, [rax + rsi]
test rsi, rsi
mov qword [rbp - 0x60], rsi
mov dword [rbp - 0x1c], r9d
je 0x14019a460
nop word cs:[rax + rax]
mov eax, dword [0x1415a2b10]
sub eax, dword [0x1415a2b14]
xor eax, 0xf1365b3d
imul eax, eax, 0x55d47ff2
mov ecx, eax
xor ecx, 0xbf32a4dd
or eax, 0x40cd5b22
and eax, ecx
cmp eax, 0x7c63715a
ja 0x14019a3a0
mov rdx, qword [rbp + 0x18]
lea rax, [rdx + 1]
movzx r12d, byte [rdx]
test r12b, r12b
js 0x14019a480
nop word cs:[rax + rax]
mov ecx, dword [0x1415a2b20]
or ecx, dword [0x1415a2b24]
mov edx, ecx
xor edx, 0x1cf8768
and ecx, 0x1e307897
add ecx, ecx
sub ecx, edx
mov edx, ecx
not edx
mov r8d, ecx
or r8d, 0xe9d51eaf
mov r9d, r8d
and r9d, 0xe6c25459
and edx, 0x1028a100
imul edx, r9d
and r8d, 0x193daba6
or ecx, 0xf9fdbfaf
imul ecx, r8d
add ecx, edx
cmp ecx, 0x17e36e22
jb 0x14019a3f0
mov rdi, rax
jmp 0x14019a730
mov r12d, 4
mov esi, 8
xor eax, eax
mov qword [rbp + 0x20], rax
xor edi, edi
xor eax, eax
mov qword [rbp - 0x38], rax
xor eax, eax
jmp 0x14019a7da
mov ecx, r12d
and ecx, 0x1f
lea rdi, [rdx + 2]
mov edx, dword [0x1415a2b18]
mov r8d, dword [0x1415a2b1c]
mov r9d, edx
xor r9d, r8d
not r9d
or edx, r8d
and edx, r9d
add edx, 0xcc333a97
shr edx, 1
mov r8d, 0x9d446a97
imul rdx, r8
shr rdx, 0x3e
cmp edx, 0xd8a50d49
je 0x14019a48a
movzx r8d, byte [rax]
and r8d, 0x3f
cmp r12b, 0xdf
jbe 0x14019a650
mov eax, dword [0x1415a2b28]
xor edx, edx
div dword [0x1415a2b2c]
nop word cs:[rax + rax]
mov eax, dword [0x1415a2b30]
mov edx, dword [0x1415a2b34]
mov r9d, eax
not r9d
and r9d, edx
mov r10d, edx
not r10d
and r10d, eax
imul r10d, r9d
mov r9d, eax
and r9d, edx
or eax, edx
imul eax, r9d
add eax, r10d
mov edx, eax
and edx, 0x14a18cd9
add edx, edx
sub eax, edx
add eax, 0x94a18cd9
not eax
and eax, 0x3ae42ca5
cmp eax, 0xef1518c7
je 0x14019a4f0
mov rdx, qword [rbp + 0x18]
movzx eax, byte [rdx + 2]
shl r8d, 6
and eax, 0x3f
or eax, r8d
cmp r12b, 0xf0
jb 0x14019a666
nop dword [rax]
mov edx, dword [0x1415a2b38]
mov r8d, dword [0x1415a2b3c]
mov r9d, edx
not r9d
and r9d, r8d
mov r10d, r8d
not r10d
and r10d, edx
imul r10d, r9d
mov r9d, edx
and r9d, r8d
or edx, r8d
imul edx, r9d
add edx, r10d
mov r8d, edx
not r8d
and r8d, 0x2c360a0b
mov r9d, edx
and r9d, 0xd3c9f5f4
imul r9d, r8d
mov r8d, edx
and r8d, 0x2c360a0b
or edx, 0x2c360a0b
imul edx, r8d
add edx, r9d
mov r8d, edx
and r8d, 0x2bcc0c3a
xor edx, 0xabcc0c3a
lea edx, [rdx + r8*2]
imul edx, edx, 0x1abc064
cmp edx, 0xae88879d
je 0x14019a560
mov rdx, qword [rbp + 0x18]
lea rdi, [rdx + 4]
movzx r12d, byte [rdx + 3]
mov r9d, 0x98b68a25
nop
mov edx, dword [0x1415a2b40]
mov r8d, dword [0x1415a2b44]
not edx
not r8d
or r8d, edx
not r8d
imul r8, r9
shr r8, 0x3f
imul edx, r8d, 0x86c94018
cmp edx, 0x19c912bb
ja 0x14019a600
and ecx, 7
shl ecx, 0x12
shl eax, 6
and r12d, 0x3f
or r12d, eax
or r12d, ecx
cmp r12d, 0xffff
ja 0x14019a67f
jmp 0x14019a730
shl ecx, 6
not ecx
not r8d
and r8d, ecx
not r8d
mov r12d, r8d
jmp 0x14019a730
lea rdi, [rdx + 3]
shl ecx, 0xc
or ecx, eax
mov r12d, ecx
cmp r12d, 0xffff
jbe 0x14019a730
lea eax, [r12 + 0xff0000]
mov ecx, dword [0x1415a2b48]
and ecx, dword [0x1415a2b4c]
and ecx, 0xc645c94e
add ecx, 0x478ca234
mov edx, ecx
and edx, 0x6076b1c
add edx, edx
sub ecx, edx
add ecx, 0xa6077b1d
cmp ecx, 0x6329463a
ja 0x14019a687
shr eax, 0xa
or eax, 0xd800
mov ecx, r12d
and ecx, 0x3ff
mov r12d, eax
mov edx, dword [0x1415a2b50]
and edx, dword [0x1415a2b54]
mov eax, edx
not eax
mov r8d, edx
and r8d, 0xfc1dd73d
and eax, 0x3e228c2
imul eax, r8d
mov r8d, edx
and r8d, 0x3e228c2
or edx, 0x3e228c2
imul edx, r8d
add edx, eax
or edx, 0x718dfa74
movzx r8d, cx
or r8d, 0xdc00
mov eax, 2
cmp edx, 0xf6acf662
je 0x14019a6cd
jmp 0x14019a738
mov eax, 1
xor r8d, r8d
mov qword [rbp - 0x38], r12
mov qword [rbp + 0x20], r8
mov ecx, dword [0x1415a2b58]
mov edx, dword [0x1415a2b5c]
mov r8d, edx
and r8d, ecx
add ecx, edx
sub ecx, r8d
mov edx, ecx
not edx
mov r8d, ecx
or r8d, 0xac11643c
mov r9d, r8d
and r9d, 0x2ca82118
and edx, 0x53469ac3
imul edx, r9d
and r8d, 0xd357dee7
or ecx, 0xff57feff
imul ecx, r8d
mov r8, r15
sub r8, rdi
add r8, 3
cmovb r8, r13
add ecx, edx
add ecx, 0xbde0933
shr r8, 2
lea rdx, [rax + r8]
lea r12, [rax + r8]
inc r12
cmp rdx, 3
cmovb r12, rbx
cmp ecx, 0xf08da362
ja 0x14019a740
movabs rax, 0x3fffffffffffffff
cmp r12, rax
ja 0x14019b71b
lea rsi, [r12 + r12]
mov ax, 1
mov qword [rbp + 8], rax
mov qword [rbp - 8], r11
mov eax, dword [0x1415a2b78]
or eax, dword [0x1415a2b7c]
mov ecx, eax
or ecx, 0x8210a00
not eax
or eax, 0x370e4510
and eax, ecx
not eax
and eax, 0x3f2f4f10
add eax, 0x8d49c968
cmp eax, 0x363333ba
jae 0x14019a830
movzx eax, byte [0x1415acbd0]
sub rsp, 0x20
xor ecx, ecx
mov rdx, rsi
call fcn.1401ac910
add rsp, 0x20
nop dword [rax + rax]
mov eax, dword [0x1415a2b80]
mov ebx, dword [0x1415a2b84]
not eax
not ebx
or ebx, eax
not ebx
or ebx, 0x950aaecc
add ebx, 0x9fb997fa
mov eax, ebx
xor eax, 0xcdf95ca5
and ebx, 0x3204835a
add ebx, ebx
sub ebx, eax
movzx eax, byte [0x1415acbd0]
sub rsp, 0x20
xor ecx, ecx
mov rdx, rsi
call fcn.14020ae90
add rsp, 0x20
cmp ebx, 0xc798fc6c
ja 0x14019a830
mov r10, rax
test rax, rax
je 0x14019b675
mov rax, qword [rbp - 0x38]
mov word [r10], ax
mov eax, dword [0x1415a2ba0]
and eax, dword [0x1415a2ba4]
mov edx, eax
not edx
and edx, 0x98ba9d72
mov r8d, eax
and r8d, 0x6745628d
imul r8d, edx
mov edx, eax
and edx, 0x98ba9d72
or eax, 0x98ba9d72
imul eax, edx
add eax, r8d
or eax, 0x3962631e
cmp eax, 0x312b4b39
mov rcx, qword [rbp]
mov r11d, 0xc7392dfd
jne 0x14019a8f2
mov qword [rcx], r12
mov qword [rcx + 8], r10
mov qword [rcx + 0x10], 1
mov r9, qword [rbp + 0x20]
nop word cs:[rax + rax]
mov eax, dword [0x1415a2ba8]
sub eax, dword [0x1415a2bac]
not eax
or eax, 0x8102888
and eax, 0x68f36c8c
mov edx, eax
not edx
and edx, 0x630c8516
xor eax, 0x9cf37ae9
lea eax, [rax + rdx*2]
mov qword [rcx], r12
mov qword [rcx + 8], r10
mov qword [rcx + 0x10], 1
cmp eax, 0xc73b162d
ja 0x14019a900
mov eax, 1
nop word cs:[rax + rax]
mov rsi, rax
nop word cs:[rax + rax]
mov eax, dword [0x1415a2bb0]
and eax, dword [0x1415a2bb4]
mov edx, eax
and edx, 0x2f998a35
or eax, 0x2f998a35
add eax, edx
mov edx, eax
not edx
mov r8d, eax
and r8d, 0xa5c4386c
and edx, 0x5a3bc793
imul edx, r8d
mov r8d, eax
and r8d, 0x5a3bc793
or eax, 0x5a3bc793
imul eax, r8d
add eax, edx
imul rax, rax, 0x4c91934b
shr rax, 0x3e
cmp eax, 0x26744b1
ja 0x14019a960
test rdi, rdi
je 0x14019ae70
mov rbx, r9
mov eax, dword [0x1415a2bb8]
and eax, dword [str.:_nD]
mov edx, eax
xor edx, 0x5d26ec6a
or eax, 0xa2d91395
and eax, edx
add eax, 0xee7a8960
cmp eax, 0x788927df
jb 0x14019a9c6
nop dword [rax]
mov eax, dword [0x1415a2bc0]
mov edx, dword [0x1415a2bc4]
mov r8d, edx
not r8d
mov r9d, eax
and r9d, r8d
or r8d, eax
not r8d
imul r8d, r9d
mov r9d, eax
and r9d, edx
or eax, edx
imul eax, r9d
add eax, r8d
imul rax, r14
shr rax, 0x3f
mov edx, eax
xor edx, 0xb3d9cc65
lea eax, [rdx + rax*2]
cmp eax, 0xa674769c
je 0x14019a9f0
mov r9, rbx
test r9w, r9w
je 0x14019aa60
xor eax, eax
mov r12d, r9d
cmp rsi, qword [rcx]
jne 0x14019af66
jmp 0x14019afc0
cmp rdi, r15
je 0x14019ae70
lea r8, [rdi + 1]
movzx r9d, byte [rdi]
mov eax, dword [0x1415a2bc8]
imul eax, dword [0x1415a2bcc]
mov edx, eax
xor edx, 0x585765a4
add edx, eax
and eax, 0xa7a89a5b
sub edx, eax
add edx, 0x2da9ae7c
mov eax, 0xfbadc8e3
imul rdx, rax
shr rdx, 0x3e
cmp edx, 0x530ecc47
ja 0x14019aa71
nop word [rax + rax]
mov eax, dword [0x1415a2bd0]
xor eax, dword [0x1415a2bd4]
and eax, 0x3fffffff
xor eax, 0x37278b6e
add eax, 0xad6dda6a
or eax, 0xd9e65e51
cmp eax, 0xeecccbec
jb 0x14019aab0
test r9b, r9b
js 0x14019ab20
mov eax, dword [str.qsW_d]
xor edx, edx
div dword [0x1415a2bf4]
mov eax, dword [0x1415a2bf8]
xor edx, edx
div dword [0x1415a2bfc]
imul eax, eax, 0x2935eb90
add eax, 0x653079f0
cmp eax, 0x4a82e013
jbe 0x14019aaea
mov r12d, r9d
jmp 0x14019af5c
mov eax, dword [0x1415a2bd8]
xor edx, edx
div dword [0x1415a2bdc]
add eax, 0xc9d34473
imul rax, rax, 0x1fee3c29
shr rax, 0x3c
or eax, 0x3eb92f64
cmp eax, 0x239903f2
jb 0x14019ab20
mov eax, r9d
xor al, 0xe0
mov edx, r9d
or dl, 0x1f
and dl, al
lea r8, [rdi + 2]
movzx ebx, dl
movzx eax, byte [rdi + 1]
nop word cs:[rax + rax]
mov edx, dword [0x1415a2be0]
imul edx, dword [0x1415a2be4]
or edx, 0x8316695d
imul edx, edx, 0xa9c9c569
not edx
or edx, 0x78cea26a
cmp edx, 0x314d52e1
je 0x14019ab70
mov r12d, ebx
shl r12d, 6
and eax, 0x3f
or r12d, eax
mov edx, dword [0x1415a2be8]
or edx, dword [0x1415a2bec]
mov r11d, edx
xor r11d, 0xe6421090
xor edx, 0x10bce54e
or r11d, 0x90d0e67
and r11d, edx
xor r11d, 0x38c6f43f
cmp r11d, 0x79b4e083
ja 0x14019aba6
cmp r9b, 0xdf
mov r11d, 0xc7392dfd
jbe 0x14019af5c
nop dword [rax]
mov edx, dword [0x1415a2c00]
imul edx, dword [0x1415a2c04]
mov r8d, edx
not r8d
or r8d, 0xf8ce149e
or edx, 0x731eb61
and edx, r8d
add edx, 0x1d735208
mov r8d, edx
and r8d, 0x622e5120
add r8d, r8d
sub edx, r8d
cmp edx, 0x92e8d4f
je 0x14019abf0
lea r8, [rdi + 3]
movzx ecx, byte [rdi + 2]
shl eax, 6
and ecx, 0x3f
or ecx, eax
mov dword [rbp + 0x20], ebx
mov eax, ebx
shl eax, 0xc
mov r12d, ecx
not r12d
mov edx, eax
not edx
mov ebx, r12d
and ebx, 0x5b933e4e
mov r11d, ecx
and r11d, 0x1b1
or r11d, ebx
or r12d, edx
and edx, 0x5b933e4e
and eax, 0xcc1b1
or eax, edx
xor eax, r11d
not r12d
or r12d, eax
nop word cs:[rax + rax]
mov eax, dword [0x1415a2c08]
mov edx, dword [0x1415a2c0c]
xor edx, eax
not edx
and edx, eax
shr edx, 1
imul rax, rdx, 0x221c9d6b
shr rax, 0x39
add eax, 0xf99bc67f
or eax, 0xd089846d
cmp eax, 0x86ab3bd1
jb 0x14019ac90
cmp r9b, 0xf0
mov r11d, 0xc7392dfd
mov ebx, dword [rbp + 0x20]
jb 0x14019ad97
movzx r8d, byte [rdi + 3]
add rdi, 4
and ebx, 7
shl ebx, 0x12
nop word cs:[rax + rax]
mov eax, dword [0x1415a2c10]
xor edx, edx
div dword [0x1415a2c14]
add eax, 0x43d85c88
or eax, 0x518bbb4c
imul rax, rax, 0x5989f959
shr rax, 0x3a
cmp eax, 0xea111a55
ja 0x14019acf0
shl ecx, 6
and r8d, 0x3f
nop word cs:[rax + rax]
mov eax, dword [0x1415a2c18]
and eax, dword [0x1415a2c1c]
not eax
or eax, 0xc6a8522a
mov edx, eax
not edx
and eax, 0x5f3ba05e
mov r9d, edx
and r9d, 0x20440d81
or r9d, eax
xor r9d, 0x2546718
and edx, 0x19478544
or edx, r9d
xor edx, 0xe78e4f5a
cmp edx, 0xd4b56b8d
ja 0x14019ad30
mov r12d, ecx
xor r12d, r8d
not r8d
and r8d, ecx
add r12d, ecx
sub r12d, r8d
mov eax, ebx
and eax, r12d
add r12d, ebx
sub r12d, eax
mov r8, rdi
cmp r12d, 0xffff
jbe 0x14019af58
mov rcx, qword [rbp]
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x14019adb0
lea eax, [r12 + 0xff0000]
shr eax, 0xa
nop
mov edx, dword [0x1415a2c20]
sub edx, dword [0x1415a2c24]
xor edx, 0xccca05cb
add edx, 0xacee0f20
cmp edx, 0x1982203f
jb 0x14019adc0
or eax, 0xd800
mov edx, r12d
and edx, 0x3ff
mov r12d, eax
nop word cs:[rax + rax]
mov eax, dword [0x1415a2c28]
sub eax, dword [0x1415a2c2c]
mov r9d, eax
not r9d
or eax, 0x80801105
and r9d, 0x2d000602
and eax, 0xc0f831b5
or eax, r9d
mov r9d, eax
xor r9d, 0x2b614c50
and r9d, 0x2be16d54
xor eax, 0x949aa1ac
lea r9d, [rax + r9*2]
movzx eax, dx
or eax, 0xdc00
cmp r9d, 0x73554665
jb 0x14019ae00
mov rdi, r8
cmp rsi, qword [rcx]
jne 0x14019af66
jmp 0x14019afc0
mov r12d, dword [rbp - 0x20]
nop word cs:[rax + rax]
mov eax, dword [0x1415a2c30]
sub eax, dword [str.ZG_XT_]
mov edx, 0xe925342
sub edx, eax
add eax, 0xf16dacbd
mov r8d, eax
and r8d, 0xf1c3ba35
and edx, 0xe3c45ca
imul edx, r8d
mov r8d, eax
and r8d, 0xe3c45ca
or eax, 0xe3c45ca
imul eax, r8d
add eax, edx
mov edx, eax
and edx, 0x3e64e956
xor eax, 0xbe64e957
lea eax, [rax + rdx*2]
cmp eax, 0xcf782185
je 0x14019ae80
mov r8, qword [rcx]
nop dword [rax + rax]
mov eax, dword [0x1415a2c38]
imul eax, dword [0x1415a2c3c]
add eax, 0xf2d82b5b
imul rax, rax, 0x33a5e857
shr rax, 0x3c
or eax, 0x3c9c2458
cmp eax, 0xe61f3c0a
ja 0x14019aee0
cmp word [rbp + 8], 1
jne 0x14019b160
mov eax, dword [0x1415a2c40]
mov edx, dword [0x1415a2c44]
add eax, edx
add eax, 0x57f815db
and eax, 0xd6fdde2c
xor eax, 0x2509a671
cmp eax, 0x442fae7f
jb 0x14019af14
xor r12d, r12d
mov edi, 0
mov eax, 0
mov qword [rbp + 8], rax
mov ebx, 0
cmp rsi, r8
jne 0x14019af69
jmp 0x14019b05b
mov rcx, qword [rbp]
xor eax, eax
mov rdi, r8
cmp rsi, qword [rcx]
je 0x14019afc0
mov r9d, eax
mov edx, dword [0x1415a2c50]
mov eax, dword [0x1415a2c54]
mov r8d, edx
not r8d
or edx, eax
not eax
and eax, r8d
not eax
and eax, edx
mov edx, eax
not edx
and edx, 0xd355cecf
and eax, 0x2caa3130
sub eax, edx
imul rax, r11
shr rax, 0x3b
add eax, 0xa3359a4e
cmp eax, 0x975b9811
jae 0x14019b0f0
jmp 0x14019b148
mov edx, dword [0x1415a2c48]
mov r9d, dword [0x1415a2c4c]
xor r9d, edx
not r9d
and r9d, edx
mov edx, r9d
not edx
and edx, 0xb8b7e1c8
and r9d, 0x47481e37
sub r9d, edx
mov edx, r9d
not edx
mov r8d, r9d
and r8d, 0x8466c23d
and edx, 0x7b993dc2
imul edx, r8d
mov r8d, r9d
and r8d, 0x7b993dc2
or r9d, 0x7b993dc2
imul r9d, r8d
add r9d, edx
mov edx, r9d
and edx, 0x4ab5f480
add edx, edx
sub r9d, edx
mov rbx, r15
sub rbx, rdi
add rbx, 3
cmovb rbx, r13
cmp r9d, 0x6a19587a
je 0x14019afc0
shr rbx, 2
movzx edx, word [rbp + 8]
cmp ax, 1
sbb rbx, 0xffffffffffffffff
add rbx, rdx
mov r9d, eax
mov qword [rbp + 0x20], r9
mov eax, dword [0x1415a2c60]
mov r8d, dword [0x1415a2c64]
mov edx, eax
and edx, r8d
or eax, r8d
add eax, edx
xor eax, 0x47d153c5
mov edx, eax
and edx, 0x4d8d44fb
add edx, edx
neg edx
add eax, edx
add eax, 0x4d8d44fb
imul rax, rax, 0x1ed9b17d
shr rax, 0x3c
cmp eax, 0xb368c27f
jne 0x14019b0b8
lea r8, [rbx + 1]
sub rsp, 0x20
mov rdx, rsi
call fcn.1402474d0
mov rcx, qword [rbp]
add rsp, 0x20
lea r8, [rbx + 1]
sub rsp, 0x20
mov rdx, rsi
call fcn.1402474d0
mov rcx, qword [rbp]
add rsp, 0x20
xor eax, eax
test al, al
jne 0x14019b0a0
mov r10, qword [rcx + 8]
mov r11d, 0xc7392dfd
mov r9, qword [rbp + 0x20]
jmp 0x14019af69
mov edx, dword [0x1415a2c58]
xor edx, dword [0x1415a2c5c]
add edx, 0xdc0272d7
mov eax, edx
not eax
mov r8d, edx
and r8d, 0xbc9f2eda
and eax, 0x4360d125
imul eax, r8d
mov r8d, edx
and r8d, 0x4360d125
or edx, 0x4360d125
imul edx, r8d
add edx, eax
lea rax, [rsi + 1]
mov word [r10 + rsi*2], r12w
mov qword [rcx + 0x10], rax
cmp edx, 0x3c20d0ed
jne 0x14019a950
mov word [r10 + rsi*2], r12w
lea rax, [rsi + 1]
mov qword [rcx + 0x10], rax
jmp 0x14019b0f0
mov qword [rbp + 8], r8
mov eax, dword [0x1415a2c68]
xor edx, edx
div dword [0x1415a2c6c]
or eax, 0xf67ac149
imul rax, rax, 0x6a38428d
shr rax, 0x3e
or eax, 0xae58ad86
cmp eax, 0x1944f324
jae 0x14019b1d2
mov rcx, qword [rcx + 8]
sub rsp, 0x40
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
mov edx, r12d
mov r8d, dword [rbp + 0x14]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rcx, qword [rbp]
add rsp, 0x40
mov r15d, dword [rbp + 0x14]
mov rsi, qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
nop dword [rax]
mov eax, dword [0x1415a2c70]
and eax, dword [0x1415a2c74]
imul rax, rax, 0x61eb74bf
shr rax, 0x3d
or eax, 0xb8fc64f1
mov edi, eax
xor edi, 0xcc92f39d
add edi, eax
and eax, 0x306c0462
sub edi, eax
mov rbx, qword [rcx + 8]
sub rsp, 0x40
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
mov rcx, rbx
mov edx, r12d
mov r8d, r15d
mov r9d, 1
call rsi
mov rcx, qword [rbp]
add rsp, 0x40
cmp edi, 0x19e44210
je 0x14019b1e0
mov r8, rax
cmp rax, 0xffffffffffffffff
mov qword [rbp + 0x20], rax
jne 0x14019b5fb
sub rsp, 0x20
call sub.KERNEL32.dll_GetLastError
add rsp, 0x20
mov ecx, eax
mov eax, dword [0x1415a2ce0]
add eax, dword [0x1415a2ce4]
mov edx, eax
xor edx, 0x40001608
and edx, eax
and edx, 0x40805eb8
cmp edx, 0x7f243fd6
ja 0x14019b277
mov r12, qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
mov r8d, dword [rbp + 0x14]
mov r9d, dword [rbp - 0x1c]
nop word [rax + rax]
mov eax, dword [0x1415a2ce8]
xor eax, dword [str.Hi]
imul rdx, rax, 0x24ad9aff
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
cmp eax, 0xd33ac421
je 0x14019b2b0
cmp r9d, 0xa
jge 0x14019b5ca
mov eax, dword [0x1415a2d58]
xor edx, edx
div dword [0x1415a2d5c]
mov eax, dword [0x1415a2d60]
xor edx, edx
div dword [0x1415a2d64]
mov edx, eax
not edx
or edx, 0xfe06a4a0
or eax, 0xa41d317f
and eax, edx
and eax, 0xfe1fb5ff
xor eax, 0x530f529b
cmp eax, 0xb66a4170
jb 0x14019b2ef
cmp ecx, 5
jne 0x14019b330
mov eax, r9d
mov qword [rbp - 0x30], rax
jmp 0x14019b390
mov eax, dword [0x1415a2db0]
or eax, dword [0x1415a2db4]
and eax, 0x60317218
xor eax, 0x423ac208
or eax, 0x9d4404e5
cmp eax, 0x91127cd6
jb 0x14019b330
mov eax, dword [0x1415a2db8]
mov edx, dword [0x1415a2dbc]
add eax, edx
add eax, 0x600a8564
xor eax, 0x476a1b2f
cmp eax, 0xc1c7ca76
je 0x14019b352
test r8d, r8d
je 0x14019b5ca
cmp ecx, 0x57
jne 0x14019b5ca
xor r8d, r8d
mov al, 1
test al, al
je 0x14019b5ca
cmp qword [rbp + 8], 0
je 0x14019b560
mov r15d, r8d
mov eax, dword [0x1415a2d80]
xor eax, dword [0x1415a2d84]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x902c1c45
and ecx, 0x6fd3e3ba
imul ecx, edx
mov edx, eax
and edx, 0x6fd3e3ba
or eax, 0x6fd3e3ba
imul eax, edx
add eax, ecx
mov ecx, eax
and ecx, 0xc203e4e
mov edx, ecx
not edx
mov r8d, eax
and r8d, 0x4203640
and edx, 0xba8d082e
imul edx, r8d
and eax, 0x800080e
or ecx, 0xba8d082e
imul ecx, eax
add ecx, edx
cmp ecx, 0x3e79ee48
jae 0x14019b410
mov rax, qword [0x1415acb98]
mov eax, dword [0x1415a2d88]
or eax, dword [0x1415a2d8c]
add eax, 0x7366a452
and eax, 0x42e0deb4
mov rsi, qword [0x1415acb98]
cmp eax, 0x27f07ac5
je 0x14019b410
mov eax, dword [0x1415a2d94]
mov ecx, eax
xor ecx, eax
not ecx
and ecx, dword [0x1415a2d90]
xor ecx, eax
add ecx, 0xc6fca382
mov eax, ecx
not eax
and eax, 0x60873720
and ecx, 0x9f78c8df
sub ecx, eax
xor ecx, 0xadd8c388
cmp ecx, 0xfbb5b709
jbe 0x14019b4e0
jmp 0x14019b5b0
mov eax, dword [0x1415a2c88]
add eax, dword [0x1415a2c8c]
mov edi, eax
and edi, 0xa8fdb003
and eax, 0x85c8003
add eax, eax
sub edi, eax
add edi, 0x9c5cc49f
xor edi, 0x6dbfc468
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r12
call r15
add rsp, 0x20
cmp edi, 0x26d6e7db
jae 0x14019a310
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r12
call r15
add rsp, 0x20
jmp 0x14019b480
mov eax, dword [0x1415a2d98]
mov ecx, dword [0x1415a2d9c]
mov edx, eax
xor edx, ecx
not ecx
and ecx, eax
add ecx, ecx
sub ecx, edx
imul edi, ecx, 0x3ef23368
or edi, 0xb75e4f36
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, rbx
call fcn.14020ae70
add rsp, 0x20
cmp edi, 0xff16c4f1
je 0x14019b5b0
mov r8d, r15d
nop dword [rax + rax]
mov eax, dword [0x1415a2da0]
imul eax, dword [0x1415a2da4]
xor eax, 0xd567b007
imul eax, eax, 0xe6e6cfc2
imul rax, rax, 0x5b1a74f9
shr rax, 0x3c
cmp eax, 0x3f356480
ja 0x14019b530
nop word [rax + rax]
mov eax, dword [0x1415a2da8]
xor esi, esi
xor edx, edx
div dword [0x1415a2dac]
mov ecx, eax
xor ecx, 0x2140
and eax, 0x8043214d
xor eax, 0xd5e28eb4
or ecx, 0xd5e18ebd
and ecx, eax
cmp ecx, 0xa75780f2
jbe 0x14019b560
mov dword [rbp + 0x14], r8d
mov rbx, qword [rbp - 8]
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14019a060
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, rbx
call fcn.14020ae70
add rsp, 0x20
jmp 0x14019b4e0
mov eax, dword [0x1415a2d68]
xor edx, edx
div dword [0x1415a2d6c]
add eax, 0xd9bc4f8
and eax, 0x2b3f8019
xor eax, 0x20238018
cmp eax, 0xacb39991
mov r9, qword [rbp - 0x10]
jne 0x14019bf98
jmp 0x14019bffb
movzx r13d, byte [rbp + 0x2e]
movzx esi, byte [rbp + 0x2f]
mov r14, qword [rbp - 0x28]
mov r15, qword [rbp - 0x60]
nop dword [rax]
mov eax, dword [0x1415a2c90]
mov ecx, dword [0x1415a2c94]
mov edx, eax
not edx
or eax, ecx
not ecx
and ecx, edx
not eax
or eax, ecx
not eax
add eax, 0x54fdd1df
and eax, 0x423c30a7
cmp eax, 0x62852308
je 0x14019b610
cmp qword [rbp + 8], 0
je 0x14019b900
mov eax, dword [0x1415a2c98]
imul eax, dword [0x1415a2c9c]
add eax, 0x2d485104
and eax, 0x1a870fda
imul eax, eax, 0xadf31e96
cmp eax, 0xbda9c3ad
jne 0x14019b7b9
jmp 0x14019b828
mov eax, dword [0x1415a2b88]
or eax, dword [0x1415a2b8c]
xor eax, 0xbceb97e9
mov ecx, 0x966b8bf9
imul rcx, rax
shr rcx, 0x3d
and ecx, 0xfffffffe
cmp ecx, 0x333540a0
jbe 0x14019b6a0
ud2
mov eax, dword [0x1415a2b90]
add eax, dword [0x1415a2b94]
imul rax, rax, 0x5df02bc5
shr rax, 0x3e
imul eax, eax, 0xbce14590
ud2
mov eax, dword [0x1415a2b60]
or eax, dword [0x1415a2b64]
mov ecx, eax
not ecx
and ecx, 0xe954fa9a
mov edx, eax
and edx, 0x16ab0565
imul edx, ecx
mov ecx, eax
and ecx, 0xe954fa9a
or eax, 0xe954fa9a
imul eax, ecx
add eax, edx
xor eax, 0x420da8c5
or eax, 0x2c70573a
cmp eax, 0xd5d8d500
ja 0x14019b780
mov eax, dword [0x1415a2b68]
xor edx, edx
div dword [0x1415a2b6c]
add eax, 0xc9234e50
and eax, 0xed1c747f
ud2
ud2
mov eax, dword [0x1415a2ca0]
xor edx, edx
div dword [0x1415a2ca4]
mov ecx, eax
not ecx
and ecx, 0x274a8628
mov edx, eax
and edx, 0xd8b579d7
imul edx, ecx
mov ecx, eax
and ecx, 0x274a8628
or eax, 0x274a8628
imul eax, ecx
add eax, edx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x1d035b70
and ecx, 0xe2fca48b
imul ecx, edx
mov edx, eax
and edx, 0xe2fca488
or eax, 0xe2fca48b
imul eax, edx
add eax, ecx
add eax, 0x9ff6e23b
mov rdi, qword [0x1415acb98]
cmp eax, 0x242b3bf1
jbe 0x14019b831
mov rax, qword [0x1415acb98]
jmp 0x14019b7b9
mov eax, dword [0x1415a2ca8]
xor edx, edx
div dword [0x1415a2cac]
add eax, 0xf511ff43
mov ecx, 0xc528381f
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x756b8dd5
jbe 0x14019b870
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop
mov eax, dword [0x1415a2cb0]
xor edx, edx
div dword [0x1415a2cb4]
not eax
mov r14d, eax
and r14d, 0xd080182
or eax, 0x2d14420
or r14d, 0x2d14420
and r14d, eax
mov eax, r14d
not eax
xor r14d, 0xe50ea346
and r14d, eax
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, rbx
call fcn.14020ae70
add rsp, 0x20
cmp r14d, 0xf0016d90
ja 0x14019b870
mov r14, qword [rbp - 0x28]
nop word [rax + rax]
mov eax, dword [0x1415a2cb8]
xor edx, edx
div dword [0x1415a2cbc]
or eax, 0x31ad5c59
mov ecx, eax
xor ecx, 0xd7edc3dd
and eax, 0x28123c22
add eax, eax
sub eax, ecx
add eax, 0x88c9ea37
cmp eax, 0xc5cea96d
jb 0x14019b8d0
mov eax, dword [0x1415a2cc0]
and eax, dword [0x1415a2cc4]
xor eax, 0xb33a2bab
imul rax, rax, 0x575a1841
shr rax, 0x3e
or eax, 0x21cdb5b4
cmp eax, 0xc4411575
mov rbx, qword [rbp - 0x50]
jne 0x14019b93a
mov qword [rbx + 0x10], 0
mov dword [rbx], 0
mov rdi, qword [rbp - 0x58]
add rdi, 0x1c
nop word cs:[rax + rax]
mov eax, dword [0x1415a2cc8]
and eax, dword [0x1415a2ccc]
mov ecx, eax
xor ecx, 0x8a43001
xor eax, 0x4020080
and eax, 0x24534984
and ecx, 0xdbacb67b
or ecx, eax
mov eax, ecx
not eax
or eax, 0xaf32f593
add eax, ecx
inc eax
mov qword [rbx + 0x10], 0
mov dword [rbx], 0
cmp eax, 0x6b1fbc40
ja 0x14019b950
mov eax, dword [0x1415a2cd0]
mov ecx, dword [0x1415a2cd4]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
mov ecx, eax
xor ecx, 0x36015e11
and eax, 0x49fea1ee
add eax, eax
sub eax, ecx
add eax, 0x7968298e
mov ecx, eax
and ecx, 0xbc82eb9
add ecx, ecx
sub eax, ecx
add eax, 0x8bc82eb9
cmp eax, 0xaa218876
jae 0x14019ba43
mov word [rdi + 8], 0
mov qword [rdi], 0
mov byte [rbx + 0x21], sil
mov eax, r13d
xor al, 1
mov byte [rbx + 0x20], al
mov dword [rbx + 0x18], 0
mov dword [r14], 0x18
mov qword [r14 + 8], 0
mov dword [r14 + 0x10], 1
mov qword [rbx + 8], r14
sub rsp, 0x20
mov rcx, qword [rbp + 0x18]
mov rdx, r15
mov r8, rbx
call fcn.140150230
add rsp, 0x20
xor r13b, 1
mov esi, r13d
mov r13, rdi
mov r12, qword [rbp + 0x18]
nop word cs:[rax + rax]
mov eax, dword [0x1415a2cd8]
mov ecx, dword [0x1415a2cdc]
not eax
not ecx
and ecx, eax
not ecx
or ecx, 0xfd460261
imul edi, ecx, 0xb74516c9
mov word [r13 + 8], 0
mov qword [r13], 0
movzx eax, byte [rbp + 0x2f]
mov byte [rbx + 0x21], al
mov byte [rbx + 0x20], sil
mov dword [rbx + 0x18], 0
mov dword [r14], 0x18
mov qword [r14 + 8], 0
mov dword [r14 + 0x10], 1
mov qword [rbx + 8], r14
sub rsp, 0x20
mov rcx, r12
mov rdx, r15
mov r8, rbx
call fcn.14020d300
add rsp, 0x20
cmp edi, 0xe175461b
je 0x14019ba60
mov rcx, rdx
test rax, rax
je 0x14019bb29
mov eax, dword [0x1415a2d18]
mov edx, dword [0x1415a2d1c]
not eax
not edx
and edx, eax
not edx
mov eax, edx
or eax, 0x5238c288
xor eax, 0x4230444d
or edx, 0x11098290
and edx, eax
or edx, 0xacc63922
cmp edx, 0x3100e339
mov r8, qword [rbp - 8]
mov r9, qword [rbp - 0x10]
jae 0x14019bd26
jmp 0x14019bd4f
mov eax, dword [0x1415a2cf0]
or eax, dword [0x1415a2cf4]
mov edx, eax
not edx
and edx, 0xfff16d4a
mov r8d, eax
and r8d, 0xe92b5
imul r8d, edx
mov edx, eax
and edx, 0xfff16d4a
or eax, 0xfff16d4a
imul eax, edx
add eax, r8d
add eax, 0x17a86959
and eax, 0xfffffffe
xor eax, 0xd48c6495
cmp eax, 0x163b243a
mov rdx, qword [rbp - 8]
mov r8, qword [rbp + 0x20]
mov r9, qword [rbp - 0x10]
jb 0x14019bb95
mov qword [r9 + 8], r8
mov qword [r9 + 0x10], rcx
mov qword [r9], 0
xor eax, eax
test al, al
je 0x14019bba6
mov qword [r9 + 8], r8
mov qword [r9 + 0x10], rcx
mov qword [r9], 0
jmp 0x14019bb80
test rdx, rdx
je 0x14019bd11
mov eax, dword [0x1415a2cf8]
xor edx, edx
div dword [0x1415a2cfc]
mov ecx, 0x9f2a0119
imul rcx, rax
shr rcx, 0x3f
or ecx, 0x33473704
mov eax, ecx
and eax, 0x23061005
xor ecx, 0x27a610f5
lea eax, [rcx + rax*2]
cmp eax, 0xfd93cc41
jne 0x14019bbee
mov rax, qword [0x1415acb98]
xor eax, eax
mov rbx, qword [rbp + 0x18]
nop word cs:[rax + rax]
mov rsi, qword [0x1415acb98]
test al, al
jne 0x14019bc00
mov eax, dword [0x1415a2d00]
or eax, dword [0x1415a2d04]
or eax, 0x5cefb6ec
shr eax, 2
imul rax, rax, 0x4335134b
shr rax, 0x3a
cmp eax, 0x6166a902
je 0x14019bc89
mov eax, dword [0x1415a2d08]
mov ecx, dword [0x1415a2d0c]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
add eax, 0xdf02a2d5
and eax, 0x55e9f62c
imul edi, eax, 0xbc8bc033
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, rbx
call fcn.14020ae70
add rsp, 0x20
cmp edi, 0xee90529b
jbe 0x14019bca1
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x14019bc31
mov eax, 0x8b0af891
nop word cs:[rax + rax]
mov ecx, dword [0x1415a2d10]
mov edx, dword [0x1415a2d14]
mov r8d, ecx
xor r8d, edx
not edx
and edx, ecx
add edx, edx
sub edx, r8d
mov ecx, edx
xor ecx, 0x450786bb
xor edx, 0x18a86844
and edx, 0x5daf6e7e
mov r8d, ecx
and r8d, 0xa2509181
imul r8d, edx
mov edx, ecx
and edx, 0x5daf6e7e
or ecx, 0x5daf6e7e
imul ecx, edx
add ecx, r8d
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xfa623623
ja 0x14019bcb0
movaps xmm6, xmmword [rbp + 0x30]
lea rsp, [rbp + 0x48]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [0x1415a2d20]
xor edx, edx
div dword [0x1415a2d24]
imul eax, eax, 0x4651640f
add eax, 0xea6ed6cc
or eax, 0x2c5b6d0c
mov qword [r9 + 8], rcx
cmp eax, 0x6bb8c966
jae 0x14019bd55
mov qword [r9 + 8], rcx
jmp 0x14019bd26
mov eax, dword [0x1415a2d28]
add eax, dword [0x1415a2d2c]
imul rax, rax, 0x45b48db7
shr rax, 0x3e
not eax
and eax, 0xe0084b01
or eax, 0xe06b092
cmp eax, 0x2b8e0469
je 0x14019bdcb
mov eax, dword [0x1415a2d30]
mov ecx, dword [0x1415a2d34]
mov edx, eax
not edx
or eax, ecx
not ecx
or ecx, edx
not ecx
not eax
or eax, ecx
not eax
mov ecx, eax
and ecx, 0x96607ce9
and eax, 0x10006001
mov edx, ecx
xor edx, 0xe76e9dec
add edx, ecx
sub edx, eax
add edx, 0x65352227
mov qword [r9], 1
cmp edx, 0x407358f4
jae 0x14019bdd4
mov qword [r9], 1
jmp 0x14019bd7f
mov rdi, qword [rbp + 0x20]
mov rsi, qword [rbp + 0x18]
nop dword [rax]
mov eax, dword [0x1415a2d38]
and eax, dword [0x1415a2d3c]
mov ecx, eax
xor ecx, 0xdce5cf95
and eax, 0x231a306a
add eax, eax
sub eax, ecx
or eax, 0x40202b1e
and eax, 0xdcf1ef5f
cmp eax, 0x94771e9f
ja 0x14019bde0
test r8, r8
je 0x14019bee1
mov rbx, qword [0x1415acb98]
mov eax, dword [0x1415a2d40]
mov ecx, dword [0x1415a2d44]
add eax, ecx
add eax, 0x5417c90b
or eax, 0x70211419
mov ecx, eax
and ecx, 0x39046885
add ecx, ecx
neg ecx
add eax, ecx
add eax, 0xb9046885
cmp eax, 0x23f2b13f
jb 0x14019be95
mov eax, dword [0x1415a2d48]
xor eax, dword [0x1415a2d4c]
xor eax, 0x89e57fc0
mov r14d, 0xa8776bbd
imul r14, rax
shr r14, 0x3d
add r14d, 0xf4f4e37f
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp r14d, 0x97154313
jae 0x14019beb0
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x14019be50
mov eax, dword [0x1415a2d50]
xor edx, edx
div dword [0x1415a2d54]
mov ecx, eax
and ecx, 0x762e9671
and eax, 0x22241630
sub ecx, eax
add ecx, 0xaaa53e3a
xor ecx, 0x48d5e85
cmp ecx, 0xe2b3fd71
ja 0x14019beb0
cmp qword [rbp + 0x20], 0xffffffffffffffff
je 0x14019bd11
mov eax, dword [0x1415a2dc0]
xor edx, edx
div dword [0x1415a2dc4]
add eax, 0xe68c3bfd
mov ecx, eax
not ecx
and ecx, 0xe2223cde
and eax, 0x1dddc321
sub eax, ecx
cmp eax, 0xdfc5bd6e
jbe 0x14019bf28
sub rsp, 0x20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [0x1415a2dc8]
add eax, dword [0x1415a2dcc]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x3a679e89
and ecx, 0xc5986176
imul ecx, edx
mov edx, eax
and edx, 0xc5986176
or eax, 0xc5986176
imul eax, edx
lea ebx, [rax + rcx]
add ebx, 0x4b1612a9
imul rax, rbx, 0x2e8d7569
shr rax, 0x20
sub ebx, eax
shr ebx, 1
add ebx, eax
shr ebx, 0x1e
sub rsp, 0x20
mov rcx, rdi
call rsi
add rsp, 0x20
cmp ebx, 0x4e930792
je 0x14019bf30
jmp 0x14019bd11
mov eax, dword [0x1415a2d70]
sub eax, dword [0x1415a2d74]
imul eax, eax, 0xa3d93810
mov edx, eax
xor edx, 0x722d8f3a
xor eax, 0x888060c0
and eax, 0xc88063c0
mov r8d, edx
and r8d, 0x377f9c38
imul r8d, eax
mov eax, edx
and eax, 0xc88063c2
or edx, 0xc88063c2
imul edx, eax
add edx, r8d
mov rax, rcx
shl rax, 0x20
or rax, 2
mov qword [r9 + 8], rax
mov qword [r9], 1
cmp edx, 0x2f19e1e3
jae 0x14019c013
mov rax, rcx
shl rax, 0x20
or rax, 2
mov qword [r9 + 8], rax
mov qword [r9], 1
jmp 0x14019bf98
mov rdi, 0xffffffffffffffff
cmp qword [rbp + 8], 0
mov rsi, qword [rbp + 0x18]
je 0x14019c0a6
mov rcx, qword [0x1415acb98]
sub rsp, 0x20
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov eax, 0xb727f6cf
nop dword [rax + rax]
mov ecx, dword [0x1415a2d78]
mov edx, dword [0x1415a2d7c]
mov r8d, ecx
not r8d
and r8d, edx
mov r9d, edx
not r9d
and r9d, ecx
imul r9d, r8d
mov r8d, ecx
and r8d, edx
or ecx, edx
imul ecx, r8d
add ecx, r9d
xor ecx, 0x2172ecf6
imul rcx, rax
shr rcx, 0x3e
or ecx, 0x8d063bc4
cmp ecx, 0x199735ea
jb 0x14019c050
mov r8, qword [rbp - 8]
jmp 0x14019bde0
mov r8, qword [rbp - 8]
jmp 0x14019bde0