Function at 0x140002760
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x358
mov ecx, 5
call fcn.140033590
lea rax, [0x141d25e03]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x44f6c3cb1fd41a51
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034aa0
mov r15, qword [rax]
mov r14, qword [rax + 8]
mov rdi, qword [rax + 0x10]
mov esi, dword [rax + 0x18]
movzx ebx, byte [rax + 0x1c]
movzx eax, byte [0x141d43a20]
mov edx, 0x1d
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
xor esi, 0xed5f70cb
mov edx, esi
shr edx, 8
movabs rcx, 0xcc88a9782c0b007a
xor rdi, rcx
movabs rcx, 0x8d3ffe41ae851465
xor r14, rcx
movabs rcx, 0x834d7acfca72d760
xor r15, rcx
xor bl, 0x68
mov qword [rax], r15
mov qword [rax + 8], r14
mov qword [rax + 0x10], rdi
mov byte [rax + 0x18], sil
shr esi, 0x18
mov byte [rax + 0x1b], sil
mov word [rax + 0x19], dx
mov byte [rax + 0x1c], bl
lea rcx, [rsp + 0x48]
mov r8d, 0x1d
mov qword [rsp + 0x320], rax
mov rdx, rax
call fcn.140033b10
cmp dword [rsp + 0x48], 2
jne 0x140005dec
mov rsi, qword [rsp + 0x50]
mov eax, esi
and eax, 3
cmp eax, 1
jne 0x1400028b4
mov rdi, qword [rsi - 1]
mov rbx, qword [rsi + 7]
mov rax, qword [rbx]
test rax, rax
je 0x14000287b
mov rcx, rdi
call rax
dec rsi
cmp qword [rbx + 8], 0
je 0x1400028a2
cmp qword [rbx + 0x10], 0x11
jb 0x140002890
mov rdi, qword [rdi - 8]
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [0x141d27acc]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x7d92d8286e2e030c
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034340
movabs rcx, 0x233e4dc515ee965
xor rcx, qword [rax]
movabs rdx, 0x10bbf3d1aba32a88
xor rdx, qword [rax + 8]
movzx eax, byte [rax + 0x10]
xor al, 0x91
mov qword [rsp + 0x190], rcx
mov qword [rsp + 0x198], rdx
mov byte [rsp + 0x1a0], al
lea rax, [rsp + 0x1a1]
lea rcx, [rsp + 0x190]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov word [rsp + 0x58], 0
mov dword [rsp + 0x60], 1
lea rcx, [rsp + 0x120]
lea rsi, [rsp + 0x48]
mov rdx, rsi
call fcn.14003b780
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x1b0], 0
mov rdi, qword [rsp + 0x128]
lea r15, [rsp + 0x1b0]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
je 0x140002ade
mov rsi, rbx
shl rsi, 0x20
or rsi, 2
cmp qword [rsp + 0x120], 0
je 0x1400029ed
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
je 0x140002af7
lea rax, [0x141d22e6e]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0xe0c788b119bc1cd3
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034e70
movabs rcx, 0xb0eb7465d4cd17de
xor rcx, qword [rax]
movabs rdx, 0x1ce0ad271290d196
xor rdx, qword [rax + 8]
movzx eax, byte [rax + 0x10]
xor al, 0x25
mov qword [rsp + 0x1b0], rcx
mov qword [rsp + 0x1b8], rdx
mov byte [rsp + 0x1c0], al
lea rax, [rsp + 0x1c1]
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], rax
mov word [rsp + 0x58], 0
mov dword [rsp + 0x60], 1
lea rcx, [rsp + 0x120]
lea rbx, [rsp + 0x48]
mov rdx, rbx
call fcn.14003b780
mov qword [rsp + 0x48], 0
mov rdi, qword [rsp + 0x128]
mov qword [rsp + 0x20], rbx
mov rcx, 0xffffffff80000002
mov rdx, rdi
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x140002b07
mov r14, qword [rsp + 0x48]
cmp qword [rsp + 0x120], 0
jne 0x140002b1d
jmp 0x140002b2f
mov rsi, qword [rsp + 0x48]
cmp qword [rsp + 0x120], 0
jne 0x1400029db
jmp 0x1400029ed
mov qword [rsp + 0x218], rsi
mov r14, rsi
jmp 0x140002b9f
mov r14, rbx
shl r14, 0x20
or r14, 2
cmp qword [rsp + 0x120], 0
je 0x140002b2f
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jne 0x140005dea
mov qword [rsp + 0x218], r14
mov eax, esi
and eax, 3
cmp eax, 1
jne 0x140002b9f
mov rdi, qword [rsi - 1]
mov rbx, qword [rsi + 7]
mov rax, qword [rbx]
test rax, rax
je 0x140002b5e
mov rcx, rdi
call rax
dec rsi
cmp qword [rbx + 8], 0
je 0x140002b85
cmp qword [rbx + 0x10], 0x11
jb 0x140002b73
mov rdi, qword [rdi - 8]
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r14, qword [rsp + 0x218]
lea rax, [0x141d262e2]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0xed5572516afc2e29
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140035060
mov ecx, 0xd8847c6e
xor ecx, dword [rax]
movzx eax, byte [rax + 4]
xor al, 0xaa
mov dword [rsp + 0x1b0], ecx
mov byte [rsp + 0x1b4], al
lea rax, [rsp + 0x1b5]
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], rax
mov word [rsp + 0x58], 0
mov dword [rsp + 0x60], 1
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0x48]
call fcn.14003b780
mov dword [rsp + 0x1a8], 0x800
mov dword [rsp + 0x190], 0
movzx eax, byte [0x141d43a20]
mov edx, 0x800
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov r12, rax
mov qword [rsp + 0x48], 0x800
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
mov r15, qword [rsp + 0x128]
lea rdi, [rsp + 0x190]
mov rsi, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r13, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
sub r13, rbp
nop word cs:[rax + rax]
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov rcx, r14
mov rdx, r15
xor r8d, r8d
mov r9, rdi
call rsi
cmp eax, 0xea
jne 0x140002cf7
mov r8d, dword [rsp + 0x1a8]
cmp r13, r8
jae 0x140002ca0
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rsp + 0x48]
mov rdx, rbp
call fcn.140059920
mov r12, qword [rsp + 0x50]
jmp 0x140002c84
mov ebx, eax
test eax, eax
jne 0x140002d74
movabs rbx, 0xde00000002
mov esi, dword [rsp + 0x1a8]
mov qword [rsp + 0x58], rsi
mov r12d, dword [rsp + 0x190]
cmp r12d, 0xb
ja 0x140002d7c
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
cmp qword [rsp + 0x120], 0
je 0x140002d4d
mov r8, qword [rsp + 0x128]
mov rcx, qword [0x141d439e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
movabs rax, 0x8000000000000000
cmp r15, rax
jne 0x140002dcc
mov rbx, r14
lea r15, [rsp + 0x1b0]
lea r12, [rsp + 0x120]
jmp 0x140002e1d
shl rbx, 0x20
or rbx, 2
lea r15, [rsp + 0x1b0]
cmp qword [rsp + 0x48], 0
lea r12, [rsp + 0x120]
je 0x140002da8
mov r8, qword [rsp + 0x50]
mov rcx, qword [0x141d439e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0x120], 0
je 0x140002e1d
mov r8, qword [rsp + 0x128]
mov rcx, qword [0x141d439e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140002e1d
mov bpl, 1
cmp r12b, 5
je 0x140002de2
movzx eax, r12b
cmp eax, 4
jne 0x140005dd4
cmp esi, 4
lea r12, [rsp + 0x120]
jne 0x140005dbc
xor ebp, ebp
test r15, r15
je 0x140002e0c
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
test bpl, bpl
lea r15, [rsp + 0x1b0]
je 0x140005df1
mov eax, ebx
and eax, 3
cmp eax, 1
jne 0x140002e75
mov r14, qword [rbx - 1]
mov rsi, qword [rbx + 7]
mov rax, qword [rsi]
test rax, rax
je 0x140002e3c
mov rcx, r14
call rax
dec rbx
cmp qword [rsi + 8], 0
je 0x140002e63
cmp qword [rsi + 0x10], 0x11
jb 0x140002e51
mov r14, qword [r14 - 8]
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [0x141d2f7c4]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x33536d3b785d71a5
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034c70
movabs rcx, 0x99a9ae2a5545f6a2
xor rcx, qword [rax]
movabs rdx, 0x878a0bd821fbbb9c
xor rdx, qword [rax + 8]
movabs r8, 0x7e4ed78418dc7ca0
xor r8, qword [rax + 0x10]
movabs r9, 0x719c310f337ebebb
xor r9, qword [rax + 0x18]
movzx eax, byte [rax + 0x20]
xor al, 0xf1
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov byte [rsp + 0x140], al
mov qword [rsp + 0x1b0], r12
mov qword [rsp + 0x1b8], 0x21
mov qword [rsp + 0x190], r15
lea rax, [0x14003d2b0]
mov qword [rsp + 0x198], rax
lea rax, [0x141d35dd0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 2
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 1
lea rcx, [rsp + 0x48]
call fcn.14002b9a0
lea rax, [0x141d28e18]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x4386d87d7524156
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034790
mov ecx, 0x3201cb7e
xor ecx, dword [rax]
movzx eax, byte [rax + 4]
xor al, 0xe9
mov dword [rsp + 0x48], ecx
mov byte [rsp + 0x4c], al
lea r9, [0x141d30e28]
lea rcx, [rsp + 0x218]
lea rdx, [rsp + 0x48]
mov r8d, 5
call fcn.14003b270
test rax, rax
jne 0x140005dea
movabs rax, 0xffffffff7fffffff
mov rcx, qword [rsp + 0x218]
cmp rcx, rax
ja 0x140002ffc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [0x141d2b275]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0xff17700a5c08bf96
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034970
mov rdi, qword [rax]
movzx esi, word [rax + 8]
movzx eax, byte [0x141d43a20]
mov edx, 0xa
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov ecx, esi
shr ecx, 8
xor cl, 0xd1
xor sil, 0xae
movabs rdx, 0x4b470958430eed0f
xor rdi, rdx
mov qword [rax], rdi
mov byte [rax + 8], sil
mov byte [rax + 9], cl
mov qword [rsp + 0x48], 0xa
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xa
mov byte [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 8
mov qword [rsp + 0x78], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xe0], 0
mov word [rsp + 0xe8], 0
movabs rax, 0x8000000000000000
mov qword [rsp + 0x80], rax
mov word [rsp + 0x108], 0
mov word [rsp + 0x110], 0
mov dword [rsp + 0xa0], 6
mov dword [rsp + 0xb0], 6
mov dword [rsp + 0xc0], 6
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0x100], 0
mov dword [rsp + 0x10c], 0x8000000
lea rax, [0x141d248be]
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov rcx, qword [rsp + 0x120]
movabs rax, 0x32a5dd3953367bb
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov rdx, qword [rsp + 0x120]
call fcn.140034540
mov r15, qword [rax]
mov r14, qword [rax + 8]
mov rbx, qword [rax + 0x10]
mov edi, dword [rax + 0x18]
movzx eax, byte [0x141d43a20]
mov edx, 0x1c
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov rsi, rax
lea rcx, [rsp + 0x68]
xor edi, 0xa5607154
movabs rax, 0xfcef8d746ac2609c
xor rbx, rax
movabs rax, 0xd49be5d726180c1
xor r14, rax
movabs rax, 0x3edc47f0e1064da9
xor r15, rax
mov qword [rsi], r15
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rbx
mov dword [rsi + 0x18], edi
call fcn.140033000
mov rax, qword [rsp + 0x70]
mov qword [rax], 0
mov qword [rax + 8], 0x1c
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0x1c
mov byte [rax + 0x20], 0
mov qword [rsp + 0x78], 1
lea rcx, [rsp + 0x48]
call section..text
mov ecx, 5
call fcn.140033590
lea rax, [0x141d2731f]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x432ed4ae69bb95d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034730
mov rdi, qword [rax]
movzx esi, word [rax + 8]
movzx eax, byte [0x141d43a20]
mov edx, 0xa
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov ecx, esi
shr ecx, 8
xor cl, 7
xor sil, 0xbf
movabs rdx, 0xa7d096da49322330
xor rdi, rdx
mov qword [rax], rdi
mov byte [rax + 8], sil
mov byte [rax + 9], cl
mov qword [rsp + 0x48], 0xa
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xa
mov byte [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 8
mov qword [rsp + 0x78], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xe0], 0
mov word [rsp + 0xe8], 0
movabs rax, 0x8000000000000000
mov qword [rsp + 0x80], rax
mov word [rsp + 0x108], 0
mov word [rsp + 0x110], 0
mov dword [rsp + 0xa0], 6
mov dword [rsp + 0xb0], 6
mov dword [rsp + 0xc0], 6
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0x100], 0
mov dword [rsp + 0x10c], 0x8000000
lea rax, [0x141d24891]
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov rcx, qword [rsp + 0x120]
movabs rax, 0xb7f59a802cf5a181
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov rdx, qword [rsp + 0x120]
call fcn.1400348e0
mov r15, qword [rax]
mov r14, qword [rax + 8]
mov edi, dword [rax + 0x10]
movzx ebx, byte [rax + 0x14]
movzx eax, byte [0x141d43a20]
mov edx, 0x15
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov rsi, rax
lea rcx, [rsp + 0x68]
xor bl, 0xcb
xor edi, 0xb38a760e
mov eax, edi
shr eax, 8
movabs rdx, 0x93cdf9b319c02ded
xor r14, rdx
movabs rdx, 0x7ce87de7e7da4a4e
xor r15, rdx
mov qword [rsi], r15
mov qword [rsi + 8], r14
mov byte [rsi + 0x10], dil
shr edi, 0x18
mov byte [rsi + 0x13], dil
mov word [rsi + 0x11], ax
mov byte [rsi + 0x14], bl
call fcn.140033000
mov rax, qword [rsp + 0x70]
mov qword [rax], 0
mov qword [rax + 8], 0x15
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0x15
mov byte [rax + 0x20], 0
mov qword [rsp + 0x78], 1
lea rcx, [rsp + 0x48]
call section..text
mov ecx, 5
call fcn.140033590
lea rax, [0x141d21621]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x740c95bfe7808b90
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.1400349f0
mov rdi, qword [rax]
movzx esi, word [rax + 8]
movzx ebx, byte [rax + 0xa]
movzx eax, byte [0x141d43a20]
mov edx, 0xb
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov r15, rax
shl ebx, 0x10
or esi, ebx
mov eax, esi
shr eax, 0x10
xor al, 0xe2
mov ecx, esi
shr ecx, 8
xor cl, 0xde
xor sil, 0x3c
movabs rdx, 0x123999337001d630
xor rdi, rdx
mov qword [r15], rdi
mov byte [r15 + 8], sil
mov byte [r15 + 9], cl
mov byte [r15 + 0xa], al
lea rax, [0x141d29574]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x535c504f0d5aa733
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034850
mov rdi, qword [rax]
mov esi, dword [rax + 8]
movzx ebx, byte [rax + 0xc]
movzx eax, byte [0x141d43a20]
mov edx, 0xd
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov r12, rax
xor esi, 0x54264034
movabs rax, 0x284957ee0bbc34bb
xor rdi, rax
xor bl, 0xa4
mov qword [r12], rdi
mov dword [r12 + 8], esi
mov byte [r12 + 0xc], bl
lea rax, [0x141d237de]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0xaf8038318eeb0826
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034d90
mov rdi, qword [rax]
mov esi, dword [rax + 8]
movzx eax, byte [0x141d43a20]
mov edx, 0xc
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov r13, rax
xor esi, 0x46110602
movabs rax, 0xacb05dc67ebbdfa1
xor rdi, rax
mov qword [r13], rdi
mov dword [r13 + 8], esi
lea rax, [0x141d2da0c]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0xa1ac13ee7097c8ba
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140033ef0
mov rdi, qword [rax]
mov esi, dword [rax + 8]
movzx ebx, byte [rax + 0xc]
movzx eax, byte [0x141d43a20]
mov edx, 0xd
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
xor esi, 0x9a02a198
movabs rcx, 0x65566656341ec2b2
xor rdi, rcx
add bl, 0x80
mov qword [rax], rdi
mov dword [rax + 8], esi
mov qword [rsp + 0x2d8], rax
mov byte [rax + 0xc], bl
lea rax, [0x141d2efb5]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0xb0e1d4a2dd0fc9f8
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034bb0
mov rdi, qword [rax]
movzx esi, word [rax + 8]
movzx eax, byte [0x141d43a20]
mov edx, 0xa
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov edx, esi
shr edx, 8
xor dl, 0xf5
xor sil, 0x5e
movabs rcx, 0x98c8af757dccf09
xor rdi, rcx
mov qword [rax], rdi
mov byte [rax + 8], sil
mov qword [rsp + 0x2d0], rax
mov byte [rax + 9], dl
lea rax, [0x141d2a365]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0xc12d15b1a8be4869
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034cd0
mov rdi, qword [rax]
movzx esi, word [rax + 8]
movzx eax, byte [0x141d43a20]
mov edx, 0xa
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov edx, esi
shr edx, 8
xor dl, 0xdc
xor sil, 0xc2
movabs rcx, 0x7ffe12581dbfcb34
xor rdi, rcx
mov qword [rax], rdi
mov byte [rax + 8], sil
mov qword [rsp + 0x2c8], rax
mov byte [rax + 9], dl
lea rax, [0x141d21a14]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x5cf9132a7136bc29
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034010
mov rdi, qword [rax]
mov esi, dword [rax + 8]
movzx ebx, byte [rax + 0xc]
movzx eax, byte [0x141d43a20]
mov edx, 0xd
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
xor esi, 0x4590830f
movabs rcx, 0x38891392cda6a554
xor rdi, rcx
xor bl, 0x17
mov qword [rax], rdi
mov dword [rax + 8], esi
mov qword [rsp + 0x2c0], rax
mov byte [rax + 0xc], bl
lea rax, [0x141d30a94]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0xd57cf0511c4c9555
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034f20
mov rdi, qword [rax]
mov esi, dword [rax + 8]
movzx ebx, byte [rax + 0xc]
movzx eax, byte [0x141d43a20]
mov edx, 0xd
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
xor esi, 0x371acb6a
movabs rcx, 0x639f2172821c4ad
xor rdi, rcx
xor bl, 0x71
mov qword [rax], rdi
mov dword [rax + 8], esi
mov qword [rsp + 0x2b8], rax
mov byte [rax + 0xc], bl
lea rax, [0x141d24aa1]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x36c703bcdde0ead
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.1400344d0
mov rbx, qword [rax]
mov edi, dword [rax + 8]
movzx esi, word [rax + 0xc]
movzx ebp, byte [rax + 0xe]
movzx eax, byte [0x141d43a20]
mov edx, 0xf
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
shl ebp, 0x10
or esi, ebp
mov r8d, esi
shr r8d, 0x10
xor r8b, 0x35
mov ecx, esi
shr ecx, 8
xor cl, 0x42
not sil
xor edi, 0x476b1393
movabs rdx, 0x300b05ac90b86e99
xor rbx, rdx
mov qword [rax], rbx
mov dword [rax + 8], edi
mov byte [rax + 0xc], sil
mov byte [rax + 0xd], cl
mov qword [rsp + 0x2b0], rax
mov byte [rax + 0xe], r8b
lea rax, [0x141d2df02]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x44963384db3a9c67
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.1400348b0
mov r14, qword [rax]
mov rbx, qword [rax + 8]
mov rdi, qword [rax + 0x10]
mov esi, dword [rax + 0x18]
movzx eax, byte [0x141d43a20]
mov edx, 0x1c
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
xor esi, 0x21c1972f
movabs rcx, 0x9e9d32ab90ac65c1
xor rdi, rcx
movabs rcx, 0x72ff55c2501b94c3
xor rbx, rcx
movabs rcx, 0xdaa93e162216d858
xor r14, rcx
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rsp + 0x2a8], rax
mov dword [rax + 0x18], esi
lea rax, [0x141d2f42a]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x2235047b7475dcd
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034ca0
mov rbx, qword [rax]
mov rdi, qword [rax + 8]
mov rsi, qword [rax + 0x10]
movzx ebp, byte [rax + 0x18]
movzx eax, byte [0x141d43a20]
mov edx, 0x19
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov r14, rax
movabs rax, 0xb07cce13b224f601
xor rsi, rax
movabs rax, 0x9f1ac184274a464
xor rdi, rax
movabs rax, 0xe13f19e5aa104049
xor rbx, rax
xor bpl, 0x4c
mov qword [r14], rbx
mov qword [r14 + 8], rdi
mov qword [r14 + 0x10], rsi
mov byte [r14 + 0x18], bpl
lea rax, [0x141d2cfc9]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x1eacaacc7e474bf2
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034b40
mov rdi, qword [rax]
movzx esi, word [rax + 8]
movzx eax, byte [0x141d43a20]
mov edx, 0xa
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov rbx, rax
mov eax, esi
shr eax, 8
xor al, 0x3e
xor sil, 0xa8
movabs rcx, 0xbc7472b9dbf0c067
xor rdi, rcx
mov qword [rbx], rdi
mov byte [rbx + 8], sil
mov byte [rbx + 9], al
lea rax, [0x141d24390]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x1b347d79cb670557
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034ad0
mov rdi, qword [rax]
mov esi, dword [rax + 8]
movzx eax, byte [0x141d43a20]
mov edx, 0xc
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov qword [rsp + 0x2a0], rbx
xor esi, 0x61116202
movabs rcx, 0xb7e523883ab2e1cd
xor rdi, rcx
mov qword [rax], rdi
mov qword [rsp + 0x298], rax
mov dword [rax + 8], esi
lea rax, [0x141d28fc8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0xf295d6760bfad70a
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034f70
mov rsi, qword [rax]
movzx eax, byte [0x141d43a20]
mov edx, 8
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
movabs rcx, 0x22932320fef108d5
xor rsi, rcx
mov qword [rsp + 0x290], rax
mov qword [rax], rsi
lea rax, [0x141d2fda0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0xf6787da385f35a23
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140033f70
mov rsi, qword [rax]
movzx ebx, byte [rax + 8]
movzx eax, byte [0x141d43a20]
mov edx, 9
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
xor bl, 6
movabs rcx, 0x9a3b31c74a1d88a3
xor rsi, rcx
mov qword [rax], rsi
mov qword [rsp + 0x288], rax
mov byte [rax + 8], bl
lea rax, [0x141d273b1]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0xa04a212370e673e0
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034050
mov rsi, qword [rax]
movzx ebx, byte [rax + 8]
movzx eax, byte [0x141d43a20]
mov edx, 9
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
xor bl, 0xf4
movabs rcx, 0xda2fc24787e16361
xor rsi, rcx
mov qword [rax], rsi
mov qword [rsp + 0x280], rax
mov byte [rax + 8], bl
lea rax, [0x141d240a1]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x80476478ee0865b5
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140035340
mov rdi, qword [rax]
mov esi, dword [rax + 8]
movzx eax, byte [0x141d43a20]
mov edx, 0xc
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
xor esi, 0x2ca00864
movabs rcx, 0x53410d9d76ab6719
xor rdi, rcx
mov qword [rax], rdi
mov qword [rsp + 0x278], rax
mov dword [rax + 8], esi
lea rax, [0x141d2575f]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0xe55da395b214e2a9
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.1400340e0
mov rbx, qword [rax]
mov edi, dword [rax + 8]
movzx esi, word [rax + 0xc]
movzx ebp, byte [rax + 0xe]
movzx eax, byte [0x141d43a20]
mov edx, 0xf
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
shl ebp, 0x10
or esi, ebp
mov r8d, esi
shr r8d, 0x10
xor r8b, 0x77
mov ecx, esi
shr ecx, 8
xor cl, 0x61
xor sil, 0xe7
xor edi, 0x4f4606c8
movabs rdx, 0xab875ff4d76d4e20
xor rbx, rdx
mov qword [rax], rbx
mov dword [rax + 8], edi
mov byte [rax + 0xc], sil
mov byte [rax + 0xd], cl
mov qword [rsp + 0x270], rax
mov byte [rax + 0xe], r8b
lea rax, [0x141d23f65]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x9573ed1fc04b58cf
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140033ec0
mov rdi, qword [rax]
mov esi, dword [rax + 8]
movzx eax, byte [0x141d43a20]
mov edx, 0xc
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov rbp, rax
xor esi, 0xb30df44
movabs rax, 0x4a97b91e6cced92b
xor rdi, rax
mov qword [rbp], rdi
mov dword [rbp + 8], esi
lea rax, [0x141d29ac7]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x6b87b053c38ea112
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.1400351a0
mov rdi, qword [rax]
movzx esi, word [rax + 8]
movzx ebx, byte [rax + 0xa]
movzx eax, byte [0x141d43a20]
mov edx, 0xb
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
shl ebx, 0x10
or esi, ebx
mov r8d, esi
shr r8d, 0x10
xor r8b, 0x2c
mov ecx, esi
shr ecx, 8
xor cl, 0x73
xor sil, 0xa
movabs rdx, 0x356b0ef5a590ced
xor rdi, rdx
mov qword [rax], rdi
mov byte [rax + 8], sil
mov byte [rax + 9], cl
mov qword [rsp + 0x268], rax
mov byte [rax + 0xa], r8b
lea rax, [0x141d2b481]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x80da10ff2fb4762d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034a50
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
movzx ebx, byte [rax + 0x10]
movzx eax, byte [0x141d43a20]
mov edx, 0x11
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
movabs rcx, 0xae7853fff0b2c406
xor rsi, rcx
movabs rcx, 0x88385d0ab2adb67b
xor rdi, rcx
xor bl, 0x7c
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x260], rax
mov byte [rax + 0x10], bl
lea rax, [0x141d2cc93]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0xa3023d26bad2c8d8
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.1400352c0
mov rdi, qword [rax]
mov esi, dword [rax + 8]
movzx ebx, byte [rax + 0xc]
movzx eax, byte [0x141d43a20]
mov edx, 0xd
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
xor esi, 0x2ec95806
movabs rcx, 0x85d7b9b64c343248
xor rdi, rcx
xor bl, 0xa2
mov qword [rax], rdi
mov dword [rax + 8], esi
mov qword [rsp + 0x258], rax
mov byte [rax + 0xc], bl
lea rax, [0x141d30dfa]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x1c7094fd98233669
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034610
mov rdi, qword [rax]
movzx esi, word [rax + 8]
movzx ebx, byte [rax + 0xa]
movzx eax, byte [0x141d43a20]
mov edx, 0xb
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
shl ebx, 0x10
or esi, ebx
mov r8d, esi
shr r8d, 0x10
xor r8b, 0xba
mov ecx, esi
shr ecx, 8
xor cl, 0xc6
xor sil, 0x70
movabs rdx, 0x5f81da1195209f54
xor rdi, rdx
mov qword [rax], rdi
mov byte [rax + 8], sil
mov byte [rax + 9], cl
mov qword [rsp + 0x250], rax
mov byte [rax + 0xa], r8b
lea rax, [0x141d2279e]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x5b594c6a430d7bb7
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034700
mov rdi, qword [rax]
mov esi, dword [rax + 8]
movzx ebx, byte [rax + 0xc]
movzx eax, byte [0x141d43a20]
mov edx, 0xd
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
xor esi, 0x6f064b5
movabs rcx, 0x46006327b1bddef6
xor rdi, rcx
xor bl, 0x46
mov qword [rax], rdi
mov dword [rax + 8], esi
mov qword [rsp + 0x248], rax
mov byte [rax + 0xc], bl
lea rax, [0x141d26184]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0xecf93d694de39d6c
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.1400345e0
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
movzx ebx, word [rax + 0x10]
movzx eax, byte [0x141d43a20]
mov edx, 0x12
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
movabs rcx, 0x9cc05e51b55cc6b4
xor rsi, rcx
movabs rcx, 0xcd1e06d645008e71
xor rdi, rcx
mov ecx, ebx
shr ecx, 8
xor cl, 0x8f
xor bl, 0x54
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov byte [rax + 0x10], bl
mov qword [rsp + 0x240], rax
mov byte [rax + 0x11], cl
lea rax, [0x141d2f6ad]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0xfc5e652fef5b972
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034d30
mov esi, dword [rax]
movzx edi, word [rax + 4]
movzx ebx, byte [rax + 6]
movzx eax, byte [0x141d43a20]
mov edx, 7
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov r8, rax
shl ebx, 0x10
or edi, ebx
mov eax, edi
shr eax, 0x10
xor al, 0x7b
movzx eax, al
mov byte [r8 + 6], al
shl rax, 0x30
mov ecx, edi
shr ecx, 8
xor cl, 0x2c
movzx ecx, cl
shl rcx, 0x28
or rcx, rax
xor dil, 0x79
movzx eax, dil
shl rax, 0x20
or rax, rcx
xor esi, 0x2fa8dd58
mov dword [r8], esi
shr rax, 0x20
mov word [r8 + 4], ax
movzx eax, byte [0x141d43a20]
mov edx, 0x1a0
xor ecx, ecx
mov rsi, r8
call fcn.14002f460
test rax, rax
je 0x140005dea
mov rcx, rax
mov qword [rsp + 0x310], r15
mov qword [rax], r15
mov qword [rax + 8], 0xb
mov qword [rsp + 0x308], r12
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xd
mov qword [rsp + 0x300], r13
mov qword [rax + 0x20], r13
mov qword [rax + 0x28], 0xc
mov rax, qword [rsp + 0x2d8]
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], 0xd
mov rax, qword [rsp + 0x2d0]
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], 0xa
mov rax, qword [rsp + 0x2c8]
mov qword [rcx + 0x50], rax
mov qword [rcx + 0x58], 0xa
mov rax, qword [rsp + 0x2c0]
mov qword [rcx + 0x60], rax
mov qword [rcx + 0x68], 0xd
mov rax, qword [rsp + 0x2b8]
mov qword [rcx + 0x70], rax
mov qword [rcx + 0x78], 0xd
mov rax, qword [rsp + 0x2b0]
mov qword [rcx + 0x80], rax
mov qword [rcx + 0x88], 0xf
mov rax, qword [rsp + 0x2a8]
mov qword [rcx + 0x90], rax
mov qword [rcx + 0x98], 0x1c
mov qword [rsp + 0x2f0], r14
mov qword [rcx + 0xa0], r14
mov qword [rcx + 0xa8], 0x19
mov rax, qword [rsp + 0x2a0]
mov qword [rcx + 0xb0], rax
mov qword [rcx + 0xb8], 0xa
mov rax, qword [rsp + 0x298]
mov qword [rcx + 0xc0], rax
mov qword [rcx + 0xc8], 0xc
mov rax, qword [rsp + 0x290]
mov qword [rcx + 0xd0], rax
mov qword [rcx + 0xd8], 8
mov rax, qword [rsp + 0x288]
mov qword [rcx + 0xe0], rax
mov qword [rcx + 0xe8], 9
mov rax, qword [rsp + 0x280]
mov qword [rcx + 0xf0], rax
mov qword [rcx + 0xf8], 9
mov rax, qword [rsp + 0x278]
mov qword [rcx + 0x100], rax
mov qword [rcx + 0x108], 0xc
mov rax, qword [rsp + 0x270]
mov qword [rcx + 0x110], rax
mov qword [rcx + 0x118], 0xf
mov qword [rsp + 0x2f8], rbp
mov qword [rcx + 0x120], rbp
mov qword [rcx + 0x128], 0xc
mov rax, qword [rsp + 0x268]
mov qword [rcx + 0x130], rax
mov qword [rcx + 0x138], 0xb
mov rax, qword [rsp + 0x260]
mov qword [rcx + 0x140], rax
mov qword [rcx + 0x148], 0x11
mov rax, qword [rsp + 0x258]
mov qword [rcx + 0x150], rax
mov qword [rcx + 0x158], 0xd
mov rax, qword [rsp + 0x250]
mov qword [rcx + 0x160], rax
mov qword [rcx + 0x168], 0xb
mov rax, qword [rsp + 0x248]
mov qword [rcx + 0x170], rax
mov qword [rcx + 0x178], 0xd
mov rax, qword [rsp + 0x240]
mov qword [rcx + 0x180], rax
mov qword [rcx + 0x188], 0x12
mov qword [rsp + 0x2e8], rsi
mov qword [rcx + 0x190], rsi
mov qword [rsp + 0x2e0], rcx
mov qword [rcx + 0x198], 7
lea rax, [0x141d23169]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0xf8d6834860899f92
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034230
movabs rcx, 0xc447eced7e1c7d9a
xor rcx, qword [rax]
movabs rdx, 0x1a9add4802905000
xor rdx, qword [rax + 8]
movabs r8, 0x19f01528674c47f1
xor r8, qword [rax + 0x10]
movzx eax, byte [rax + 0x18]
xor al, 0xc2
mov qword [rsp + 0x1b0], rcx
mov qword [rsp + 0x1b8], rdx
mov qword [rsp + 0x1c0], r8
mov byte [rsp + 0x1c8], al
mov dword [rsp + 0x238], 0x41888887
lea rax, [0x141d2d891]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x28b88b74830e5616
mov qword [rsp + 0x48], rax
lea r15, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140035020
mov rcx, qword [rax]
mov qword [rsp + 0x318], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x230], rcx
mov rdi, qword [rax + 0x10]
mov rbp, qword [rax + 0x18]
mov r13, qword [rax + 0x20]
mov r12, qword [rax + 0x28]
mov r14, qword [rax + 0x30]
mov rbx, qword [rax + 0x38]
mov rsi, qword [rax + 0x40]
movzx eax, byte [rax + 0x48]
mov byte [rsp + 0x11f], al
movzx eax, byte [0x141d43a20]
mov edx, 0x49
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
movabs rcx, 0x3eeff2f240fd73f3
xor rsi, rcx
movabs rcx, 0x46c264b907eed9f1
xor rbx, rcx
movabs rcx, 0x75cb2b8c2917e08f
xor r14, rcx
movabs rcx, 0xbc5e7400a984ee20
xor r12, rcx
movabs rcx, 0x8f0e85f88171c622
xor r13, rcx
movabs rcx, 0x76fadcd2d4108c5f
xor rbp, rcx
movabs rcx, 0x38068f48751ba6af
xor rdi, rcx
movabs rcx, 0x474ec0e6e07abfe5
mov rdx, qword [rsp + 0x230]
xor rdx, rcx
movabs rcx, 0xd27fe07d1269ec2b
mov r8, qword [rsp + 0x318]
xor r8, rcx
movzx ecx, byte [rsp + 0x11f]
xor cl, 0xea
mov qword [rax], r8
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], r13
mov qword [rax + 0x28], r12
mov qword [rax + 0x30], r14
mov qword [rax + 0x38], rbx
mov qword [rax + 0x40], rsi
mov byte [rax + 0x48], cl
mov qword [rsp + 0x218], 0x49
mov qword [rsp + 0x220], rax
mov qword [rsp + 0x228], 0x49
xor esi, esi
movabs rdi, 0xffffffff7fffffff
jmp 0x1400046f1
add rsi, 0x10
cmp rsi, 0x1a0
je 0x140004976
mov rax, qword [rsp + 0x2e0]
add rax, rsi
mov qword [rsp + 0x1a8], rax
lea rax, [rsp + 0x218]
mov qword [rsp + 0x120], rax
lea rax, [0x1400019b0]
mov qword [rsp + 0x128], rax
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x130], rax
lea rax, [0x14003d290]
mov qword [rsp + 0x138], rax
lea rax, [0x141d30e30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 2
mov qword [rsp + 0x68], 0
lea rbx, [rsp + 0x120]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 2
lea rcx, [rsp + 0x190]
mov rdx, r15
call fcn.1400079e0
mov rbp, qword [rsp + 0x190]
mov r14, qword [rsp + 0x198]
mov rax, qword [rsp + 0x1a0]
add rax, r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], rax
mov word [rsp + 0x58], 0
mov dword [rsp + 0x60], 1
mov rcx, rbx
mov rdx, r15
call fcn.14003b780
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x23c], 0
mov rbx, qword [rsp + 0x128]
lea rax, [rsp + 0x23c]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov r12d, eax
test eax, eax
je 0x1400048b0
mov r13, r12
shl r13, 0x20
or r13, 2
cmp qword [rsp + 0x120], 0
je 0x140004855
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r12d, r12d
jne 0x1400048c6
mov qword [rsp + 0x48], r13
mov r8d, 0x19
mov rcx, r15
lea rdx, [rsp + 0x1b0]
lea r9, [rsp + 0x238]
call fcn.14003b270
test rax, rax
jne 0x1400048ea
cmp r13, rdi
ja 0x140004890
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbp, rbp
je 0x1400046e0
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400046e0
mov r13, qword [rsp + 0x48]
cmp qword [rsp + 0x120], 0
jne 0x140004843
jmp 0x140004855
movzx eax, byte [0x141d43a20]
mov edx, 8
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov rsi, rax
mov qword [rax], r13
jmp 0x140004927
mov rdi, rax
movzx eax, byte [0x141d43a20]
mov edx, 8
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov rsi, rax
mov qword [rax], rdi
movabs rax, 0xffffffff7fffffff
cmp r13, rax
ja 0x140004927
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbp, rbp
je 0x14000493e
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0x218], 0
je 0x140004960
mov r8, qword [rsp + 0x220]
mov rcx, qword [0x141d439e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call fcn.14003bdd0
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, rsi
jmp 0x140004992
cmp qword [rsp + 0x218], 0
je 0x140004998
mov r8, qword [rsp + 0x220]
mov rcx, qword [0x141d439e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 3
call fcn.140033590
lea rax, [0x141d29d64]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x29da22b4d8bcdc2b
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034d70
mov rbx, qword [rax]
mov edi, dword [rax + 8]
movzx esi, word [rax + 0xc]
movzx eax, byte [0x141d43a20]
mov edx, 0xe
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov ecx, esi
shr ecx, 8
xor cl, 0x6d
xor sil, 0x21
xor edi, 0xf38efb71
movabs rdx, 0x2a2fd9db2b47e54c
xor rbx, rdx
mov qword [rax], rbx
mov dword [rax + 8], edi
mov byte [rax + 0xc], sil
mov byte [rax + 0xd], cl
mov qword [rsp + 0x48], 0xe
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0xe
mov byte [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 8
mov qword [rsp + 0x78], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xe0], 0
mov word [rsp + 0xe8], 0
movabs rax, 0x8000000000000000
mov qword [rsp + 0x80], rax
mov word [rsp + 0x108], 0
mov word [rsp + 0x110], 0
mov dword [rsp + 0xa0], 6
mov dword [rsp + 0xb0], 6
mov dword [rsp + 0xc0], 6
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0x100], 0
mov dword [rsp + 0x10c], 0x8000000
lea rax, [0x141d30ee7]
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov rcx, qword [rsp + 0x120]
movabs rax, 0x30eb33f0f8b7ced5
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov rdx, qword [rsp + 0x120]
call fcn.140035210
mov rdi, qword [rax]
movzx eax, byte [0x141d43a20]
mov edx, 8
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov rbx, rax
lea rsi, [rsp + 0x68]
movabs rax, 0xd9c1fd0e1db24ef8
xor rdi, rax
mov qword [rbx], rdi
mov rcx, rsi
call fcn.140033000
mov r14, qword [rsp + 0x70]
mov qword [r14], 0
mov qword [r14 + 8], 8
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], 8
mov byte [r14 + 0x20], 0
mov qword [rsp + 0x78], 1
lea rax, [0x141d2e796]
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov rcx, qword [rsp + 0x120]
movabs rax, 0x87ba72b29a503a66
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov rdx, qword [rsp + 0x120]
call fcn.140035040
xorps xmm0, xmm0
movaps xmmword [rsp + 0x170], xmm0
movaps xmmword [rsp + 0x160], xmm0
movaps xmmword [rsp + 0x150], xmm0
movaps xmmword [rsp + 0x140], xmm0
movaps xmmword [rsp + 0x130], xmm0
movaps xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x180], 0
mov rcx, 0xfffffffffffffff8
lea rdx, [0x14005c6ac]
nop word cs:[rax + rax]
mov r8, qword [rcx + rdx + 8]
xor r8, qword [rax + rcx + 8]
mov qword [rsp + rcx + 0x128], r8
add rcx, 8
cmp rcx, 0x60
jb 0x140004c40
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x210], rax
movaps xmm0, xmmword [rsp + 0x170]
movaps xmmword [rsp + 0x200], xmm0
movaps xmm0, xmmword [rsp + 0x160]
movaps xmmword [rsp + 0x1f0], xmm0
movaps xmm0, xmmword [rsp + 0x120]
movaps xmm1, xmmword [rsp + 0x130]
movaps xmm2, xmmword [rsp + 0x140]
movaps xmm3, xmmword [rsp + 0x150]
movaps xmmword [rsp + 0x1e0], xmm3
movaps xmmword [rsp + 0x1d0], xmm2
movaps xmmword [rsp + 0x1c0], xmm1
movaps xmmword [rsp + 0x1b0], xmm0
movzx eax, byte [0x141d43a20]
mov edx, 0x68
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov rbx, rax
mov rax, qword [rsp + 0x210]
mov qword [rbx + 0x60], rax
movaps xmm0, xmmword [rsp + 0x200]
movups xmmword [rbx + 0x50], xmm0
movaps xmm0, xmmword [rsp + 0x1f0]
movups xmmword [rbx + 0x40], xmm0
movaps xmm0, xmmword [rsp + 0x1b0]
movaps xmm1, xmmword [rsp + 0x1c0]
movaps xmm2, xmmword [rsp + 0x1d0]
movaps xmm3, xmmword [rsp + 0x1e0]
movups xmmword [rbx + 0x30], xmm3
movups xmmword [rbx + 0x20], xmm2
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx], xmm0
cmp qword [rsp + 0x68], 1
jne 0x140004d53
mov rcx, rsi
call fcn.140033000
mov r14, qword [rsp + 0x70]
mov qword [r14 + 0x28], 0
mov qword [r14 + 0x30], 0x68
mov qword [r14 + 0x38], rbx
mov qword [r14 + 0x40], 0x68
mov byte [r14 + 0x48], 0
mov qword [rsp + 0x78], 2
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0x48]
call fcn.140030340
lea rax, [0x141d2d5bf]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rcx, qword [rsp + 0x190]
movabs rax, 0x413da60540754cda
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rdx, qword [rsp + 0x190]
call fcn.140034120
mov rcx, qword [rax]
mov rcx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
movzx eax, word [rax + 0x20]
test byte [rsp + 0x120], 1
jne 0x140005dea
lea rcx, [rsp + 0x48]
call section..text
lea rax, [0x141d31042]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x4953dd6d43019651
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034910
mov esi, dword [rax]
movzx ebx, word [rax + 4]
movzx edi, byte [rax + 6]
movzx eax, byte [0x141d43a20]
mov edx, 7
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
shl edi, 0x10
or ebx, edi
mov ecx, ebx
shr ecx, 0x10
xor cl, 0x7f
movzx ecx, cl
mov byte [rax + 6], cl
shl rcx, 0x30
mov edx, ebx
shr edx, 8
xor dl, 0xef
movzx edx, dl
shl rdx, 0x28
or rdx, rcx
xor bl, 0xbc
movzx ecx, bl
shl rcx, 0x20
or rcx, rdx
xor esi, 0x28f72ead
mov dword [rax], esi
shr rcx, 0x20
mov word [rax + 4], cx
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 7
mov byte [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 8
mov qword [rsp + 0x78], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xe0], 0
mov word [rsp + 0xe8], 0
movabs rax, 0x8000000000000000
mov qword [rsp + 0x80], rax
mov word [rsp + 0x108], 0
mov word [rsp + 0x110], 0
mov dword [rsp + 0xa0], 6
mov dword [rsp + 0xb0], 6
mov dword [rsp + 0xc0], 6
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0x100], 0
mov dword [rsp + 0x10c], 0x8000000
lea rax, [0x141d29321]
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov rcx, qword [rsp + 0x120]
movabs rax, 0x9941b81bf0183b2d
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov rdx, qword [rsp + 0x120]
call fcn.140034b80
movzx esi, word [rax]
movzx eax, byte [0x141d43a20]
mov edx, 2
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov rbx, rax
lea rcx, [rsp + 0x68]
xor esi, 0x33e4
mov word [rax], si
call fcn.140033000
mov r14, qword [rsp + 0x70]
mov qword [r14], 0
mov qword [r14 + 8], 2
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], 2
mov byte [r14 + 0x20], 0
mov qword [rsp + 0x78], 1
lea rax, [0x141d24ba7]
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov rcx, qword [rsp + 0x120]
movabs rax, 0x19fc9423878f79ca
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov rdx, qword [rsp + 0x120]
call fcn.1400341c0
mov rsi, qword [rax]
mov rbp, qword [rax + 8]
mov r13, qword [rax + 0x10]
mov r12, qword [rax + 0x18]
mov r15, qword [rax + 0x20]
mov edi, dword [rax + 0x28]
movzx eax, byte [0x141d43a20]
mov edx, 0x2c
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov rbx, rax
xor edi, 0x439fe49
movabs rax, 0xe5f245cc2e4ad609
xor r15, rax
movabs rax, 0x16e419c7437e3f6e
xor r12, rax
movabs rax, 0x9657ba27c841db52
xor r13, rax
movabs rax, 0x1b0504ddb6c76679
xor rbp, rax
movabs rax, 0x95e407d649ed10ee
xor rsi, rax
mov qword [rbx], rsi
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r12
mov qword [rbx + 0x20], r15
mov dword [rbx + 0x28], edi
cmp qword [rsp + 0x68], 1
jne 0x1400050fb
lea rcx, [rsp + 0x68]
call fcn.140033000
mov r14, qword [rsp + 0x70]
mov qword [r14 + 0x28], 0
mov qword [r14 + 0x30], 0x2c
mov qword [r14 + 0x38], rbx
mov qword [r14 + 0x40], 0x2c
mov byte [r14 + 0x48], 0
mov qword [rsp + 0x78], 2
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0x48]
call fcn.140030340
lea rax, [0x141d24e2e]
mov qword [rsp + 0x1b0], rax
lea rax, [rsp + 0x1b0]
mov rcx, qword [rsp + 0x1b0]
movabs rax, 0xb7adf53db4968b92
mov qword [rsp + 0x1b0], rax
lea rax, [rsp + 0x1b0]
mov rdx, qword [rsp + 0x1b0]
call fcn.140035180
mov rcx, qword [rax]
mov rcx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rcx, qword [rax + 0x20]
mov rcx, qword [rax + 0x28]
movzx eax, byte [rax + 0x30]
test byte [rsp + 0x120], 1
jne 0x140005dea
lea rcx, [rsp + 0x48]
call section..text
lea rax, [0x141d24039]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0xcff47f38334fb465
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034400
mov esi, dword [rax]
movzx ebx, word [rax + 4]
movzx edi, byte [rax + 6]
movzx eax, byte [0x141d43a20]
mov edx, 7
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
shl edi, 0x10
or ebx, edi
mov ecx, ebx
shr ecx, 0x10
xor cl, 0xd3
movzx ecx, cl
mov byte [rax + 6], cl
shl rcx, 0x30
mov edx, ebx
shr edx, 8
xor dl, 0xbe
movzx edx, dl
shl rdx, 0x28
or rdx, rcx
xor bl, 0xc0
movzx ecx, bl
shl rcx, 0x20
or rcx, rdx
xor esi, 0x48b4ec5f
mov dword [rax], esi
shr rcx, 0x20
mov word [rax + 4], cx
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 7
mov byte [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 8
mov qword [rsp + 0x78], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xe0], 0
mov word [rsp + 0xe8], 0
movabs rax, 0x8000000000000000
mov qword [rsp + 0x80], rax
mov word [rsp + 0x108], 0
mov word [rsp + 0x110], 0
mov dword [rsp + 0xa0], 6
mov dword [rsp + 0xb0], 6
mov dword [rsp + 0xc0], 6
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0x100], 0
mov dword [rsp + 0x10c], 0x8000000
lea rax, [0x141d2e499]
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov rcx, qword [rsp + 0x120]
movabs rax, 0x54f05b42c4e97a54
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov rdx, qword [rsp + 0x120]
call fcn.140034e10
movzx esi, word [rax]
movzx eax, byte [0x141d43a20]
mov edx, 2
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov rbx, rax
lea rcx, [rsp + 0x68]
xor esi, 0x60d9
mov word [rax], si
call fcn.140033000
mov r14, qword [rsp + 0x70]
mov qword [r14], 0
mov qword [r14 + 8], 2
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], 2
mov byte [r14 + 0x20], 0
mov qword [rsp + 0x78], 1
lea rax, [0x141d3029f]
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov rcx, qword [rsp + 0x120]
movabs rax, 0x21cf1d8543e69925
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov rdx, qword [rsp + 0x120]
call fcn.1400350e0
mov rcx, qword [rax]
mov qword [rsp + 0x230], rcx
mov r13, qword [rax + 8]
mov r12, qword [rax + 0x10]
mov r15, qword [rax + 0x18]
mov ebp, dword [rax + 0x20]
movzx edi, word [rax + 0x24]
movzx esi, byte [rax + 0x26]
movzx eax, byte [0x141d43a20]
mov edx, 0x27
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov rbx, rax
shl esi, 0x10
or edi, esi
mov eax, edi
shr eax, 0x10
xor al, 0x7b
mov ecx, edi
shr ecx, 8
xor cl, 0xfe
xor dil, 0x7a
xor ebp, 0xde71e88a
movabs rdx, 0x7ac22e4fc8e2785b
xor r15, rdx
movabs rdx, 0xe41bb653feb178e5
xor r12, rdx
movabs rdx, 0x16021aea82955b55
xor r13, rdx
movabs rdx, 0xc86dfe217c388894
mov r8, qword [rsp + 0x230]
xor r8, rdx
mov qword [rbx], r8
mov qword [rbx + 8], r13
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r15
mov dword [rbx + 0x20], ebp
mov byte [rbx + 0x24], dil
mov byte [rbx + 0x25], cl
mov byte [rbx + 0x26], al
cmp qword [rsp + 0x68], 1
jne 0x1400054d0
lea rcx, [rsp + 0x68]
call fcn.140033000
mov r14, qword [rsp + 0x70]
mov qword [r14 + 0x28], 0
mov qword [r14 + 0x30], 0x27
mov qword [r14 + 0x38], rbx
mov qword [r14 + 0x40], 0x27
mov byte [r14 + 0x48], 0
mov qword [rsp + 0x78], 2
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0x48]
call fcn.140030340
lea rax, [0x141d26740]
mov qword [rsp + 0x1b0], rax
lea rax, [rsp + 0x1b0]
mov rcx, qword [rsp + 0x1b0]
movabs rax, 0x119f583298cf42e2
mov qword [rsp + 0x1b0], rax
lea rax, [rsp + 0x1b0]
mov rdx, qword [rsp + 0x1b0]
call fcn.1400350b0
mov rcx, qword [rax]
mov rcx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov eax, dword [rax + 0x18]
test byte [rsp + 0x120], 1
mov r15, qword [rsp + 0x310]
mov r12, qword [rsp + 0x308]
mov r13, qword [rsp + 0x300]
mov rbp, qword [rsp + 0x2f8]
jne 0x140005dea
lea rcx, [rsp + 0x48]
call section..text
lea rax, [0x141d27e1f]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x651c6b6eebbd2d0e
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140035160
mov esi, dword [rax]
movzx ebx, word [rax + 4]
movzx edi, byte [rax + 6]
movzx eax, byte [0x141d43a20]
mov edx, 7
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
shl edi, 0x10
or ebx, edi
mov ecx, ebx
shr ecx, 0x10
xor cl, 0x33
movzx ecx, cl
mov byte [rax + 6], cl
shl rcx, 0x30
mov edx, ebx
shr edx, 8
xor dl, 0xc5
movzx edx, dl
shl rdx, 0x28
or rdx, rcx
xor bl, 0xda
movzx ecx, bl
shl rcx, 0x20
or rcx, rdx
xor esi, 0xbc733b12
mov dword [rax], esi
shr rcx, 0x20
mov word [rax + 4], cx
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 7
mov byte [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 8
mov qword [rsp + 0x78], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xe0], 0
mov word [rsp + 0xe8], 0
movabs rax, 0x8000000000000000
mov qword [rsp + 0x80], rax
mov word [rsp + 0x108], 0
mov word [rsp + 0x110], 0
mov dword [rsp + 0xa0], 6
mov dword [rsp + 0xb0], 6
mov dword [rsp + 0xc0], 6
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0x100], 0
mov dword [rsp + 0x10c], 0x8000000
lea rax, [0x141d29dfc]
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov rcx, qword [rsp + 0x120]
movabs rax, 0xe58cee059ff7da69
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov rdx, qword [rsp + 0x120]
call fcn.140034670
movzx edi, word [rax]
movzx eax, byte [0x141d43a20]
mov edx, 2
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov rbx, rax
lea rsi, [rsp + 0x68]
xor edi, 0x7034
mov word [rax], di
mov rcx, rsi
call fcn.140033000
mov r14, qword [rsp + 0x70]
mov qword [r14], 0
mov qword [r14 + 8], 2
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], 2
mov byte [r14 + 0x20], 0
mov qword [rsp + 0x78], 1
lea rax, [0x141d246bf]
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov rcx, qword [rsp + 0x120]
movabs rax, 0x7730aaed86b40fed
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x120]
mov rdx, qword [rsp + 0x120]
call fcn.1400346d0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x160], xmm0
movaps xmmword [rsp + 0x150], xmm0
movaps xmmword [rsp + 0x140], xmm0
movaps xmmword [rsp + 0x130], xmm0
movaps xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x170], 0
mov rcx, 0xfffffffffffffff8
lea rdx, [0x14005c714]
nop word cs:[rax + rax]
mov r8, qword [rcx + rdx + 8]
xor r8, qword [rax + rcx + 8]
mov qword [rsp + rcx + 0x128], r8
add rcx, 8
cmp rcx, 0x50
jb 0x140005840
movzx eax, byte [rax + 0x58]
xor al, 0x97
mov byte [rsp + 0x178], al
movaps xmm0, xmmword [rsp + 0x120]
movaps xmm1, xmmword [rsp + 0x130]
movaps xmm2, xmmword [rsp + 0x140]
movaps xmm3, xmmword [rsp + 0x150]
movaps xmmword [rsp + 0x1b0], xmm0
movaps xmmword [rsp + 0x1c0], xmm1
movaps xmmword [rsp + 0x1d0], xmm2
movaps xmmword [rsp + 0x1e0], xmm3
movaps xmm0, xmmword [rsp + 0x160]
movaps xmmword [rsp + 0x1f0], xmm0
mov rax, qword [rsp + 0x169]
mov qword [rsp + 0x1f9], rax
mov eax, dword [rsp + 0x171]
mov dword [rsp + 0x201], eax
movzx eax, word [rsp + 0x175]
mov word [rsp + 0x205], ax
movzx eax, byte [rsp + 0x177]
mov byte [rsp + 0x207], al
movzx eax, byte [rsp + 0x178]
mov byte [rsp + 0x208], al
movzx eax, byte [0x141d43a20]
mov edx, 0x59
xor ecx, ecx
call fcn.14002f460
test rax, rax
je 0x140005dea
mov rbx, rax
movups xmm0, xmmword [rsp + 0x1f9]
movups xmmword [rax + 0x49], xmm0
movaps xmm0, xmmword [rsp + 0x1f0]
movups xmmword [rax + 0x40], xmm0
movaps xmm0, xmmword [rsp + 0x1b0]
movaps xmm1, xmmword [rsp + 0x1c0]
movaps xmm2, xmmword [rsp + 0x1d0]
movaps xmm3, xmmword [rsp + 0x1e0]
movups xmmword [rax + 0x30], xmm3
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
cmp qword [rsp + 0x68], 1
jne 0x140005980
mov rcx, rsi
call fcn.140033000
mov r14, qword [rsp + 0x70]
mov qword [r14 + 0x28], 0
mov qword [r14 + 0x30], 0x59
mov qword [r14 + 0x38], rbx
mov qword [r14 + 0x40], 0x59
mov byte [r14 + 0x48], 0
mov qword [rsp + 0x78], 2
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0x48]
call fcn.140030340
lea rax, [0x141d2d708]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rcx, qword [rsp + 0x190]
movabs rax, 0xb53b98227f404d8e
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rdx, qword [rsp + 0x190]
call fcn.140034ff0
mov rcx, qword [rax]
mov rcx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov ecx, dword [rax + 0x20]
movzx ecx, byte [rax + 0x26]
movzx eax, word [rax + 0x24]
test byte [rsp + 0x120], 1
jne 0x140005dea
lea rcx, [rsp + 0x48]
call section..text
mov ecx, 2
call fcn.140033590
lea rax, [0x141bbcda9]
mov qword [rsp + 0x28], rax
lea rax, [0x141bbcd9d]
mov qword [rsp + 0x20], rax
lea rdx, [0x14005c76d]
lea r9, [0x141bbcd7d]
lea rbx, [rsp + 0x328]
mov r8d, 0x1b60610
mov rcx, rbx
call fcn.140017940
lea rax, [0x141d30e05]
mov qword [rsp + 0x28], rax
lea rax, [0x141d30df9]
mov qword [rsp + 0x20], rax
lea rdx, [0x141bbcdc9]
lea r9, [0x141d30dd9]
lea rsi, [rsp + 0x340]
mov r8d, 0x174010
mov rcx, rsi
call fcn.140017940
lea rax, [0x141d2b8b5]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0xc200df8019a44b36
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.1400343d0
movabs rcx, 0xafd6af569ad0dd2c
xor rcx, qword [rax]
movabs rdx, 0x2533e0c73db61b48
xor rdx, qword [rax + 8]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdx
lea rdx, [rsp + 0x48]
mov r8d, 0x10
mov rcx, rbx
call fcn.1400063c0
lea rax, [0x141d245e8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x2a58b20db44e575b
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.1400347b0
movabs rcx, 0xd4ec747cb3e6755a
xor rcx, qword [rax]
mov edx, 0x1618f0ed
xor edx, dword [rax + 8]
movzx eax, word [rax + 0xc]
mov r8d, eax
xor r8b, 0xf
shr eax, 8
xor al, 0xc9
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], edx
mov byte [rsp + 0x54], r8b
mov byte [rsp + 0x55], al
lea rdx, [rsp + 0x48]
mov r8d, 0xe
mov rcx, rsi
call fcn.1400063c0
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x2e0]
mov rsi, qword [sym.imp.KERNEL32.dll_HeapFree]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, r15
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, r12
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, r13
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x2d8]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x2d0]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x2c8]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x2c0]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x2b8]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x2b0]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x2a8]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x2f0]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x2a0]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x298]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x290]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x288]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x280]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x278]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x270]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, rbp
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x268]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x260]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x258]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x250]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x248]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x240]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x2e8]
call rsi
mov rcx, qword [0x141d439e8]
xor edx, edx
mov r8, qword [rsp + 0x320]
call rsi
nop
add rsp, 0x358
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs rbx, 0xd00000002
test r15, r15
jne 0x140002dfa
jmp 0x140002e0c
lea r12, [rsp + 0x120]
test r15, r15
jne 0x140002dfa
jmp 0x140002e0c
ud2
call fcn.140030440
lea rax, [0x141d2bc9c]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movabs rax, 0x26235929db028556
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov rdx, qword [rsp + 0x48]
call fcn.140034430
movabs rcx, 0x887e05dc14c4621f
xor rcx, qword [rax]
movabs rdx, 0x357283015071967e
xor rdx, qword [rax + 8]
movabs r8, 0xb968ed20c740a088
xor r8, qword [rax + 0x10]
movabs r9, 0xa2dc36333d5b5786
xor r9, qword [rax + 0x18]
mov r10d, 0xa752c3fe
xor r10d, dword [rax + 0x20]
movzx eax, word [rax + 0x24]
mov r11d, eax
xor r11b, 0x68
shr eax, 8
xor al, 0xf1
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov dword [rsp + 0x140], r10d
mov byte [rsp + 0x144], r11b
mov byte [rsp + 0x145], al
mov qword [rsp + 0x1b0], r12
mov qword [rsp + 0x1b8], 0x26
mov qword [rsp + 0x190], r15
lea rax, [0x14003d2b0]
mov qword [rsp + 0x198], rax
lea rax, [0x141d35dd0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 2
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 1
lea rcx, [rsp + 0x48]
call fcn.14002b9a0
call fcn.140030440
int3