Function at 0x7ff6c5d19500
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1368]
mov eax, 0x1468
call fcn.7ff6c5d5e9b0
sub rsp, rax
mov r13, rcx
mov byte [rbp + 0x13b0], 0
xor ecx, ecx
mov dword [rsp + 0x44], 1
xor eax, eax
mov dword [rsp + 0x48], ecx
xor r15b, r15b
mov dword [rsp + 0x54], ecx
mov rbx, qword [r13]
mov r14d, ecx
mov r12d, ecx
mov dword [rsp + 0x5c], ecx
mov dword [rsp + 0x58], ecx
mov edi, edx
mov qword [r13 + 0x10], rcx
mov qword [r13 + 8], rcx
mov qword [r13 + 0x18], rcx
mov byte [rbp + 0x13c8], r15b
mov r15d, ecx
mov rcx, rbx
mov word [rsp + 0x40], ax
mov byte [rsp + 0x42], al
call fcn.7ff6c5d10f80
test eax, eax
je 0x7ff6c5d1a3f7
cmp edi, 1
je 0x7ff6c5d1a395
mov rcx, rbx
call fcn.7ff6c5d13b60
mov rcx, rbx
mov esi, eax
call fcn.7ff6c5d13b60
shl esi, 0x10
mov rcx, rbx
add esi, eax
call fcn.7ff6c5d13b60
mov rcx, rbx
mov edi, eax
call fcn.7ff6c5d13b60
shl edi, 0x10
lea ecx, [rdi + rax]
cmp ecx, 0x49484452
ja 0x7ff6c5d1995f
je 0x7ff6c5d196ca
cmp ecx, 0x43674249
je 0x7ff6c5d196bd
cmp ecx, 0x49444154
je 0x7ff6c5d19622
cmp ecx, 0x49454e44
jne 0x7ff6c5d19973
cmp dword [rsp + 0x44], 0
je 0x7ff6c5d19c84
mov edx, dword [0x7ff6c5e1afd8]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, [0x7ff6c5da7f78]
jmp 0x7ff6c5d1a3ee
cmp dword [rsp + 0x44], 0
jne 0x7ff6c5d19603
movzx eax, byte [rbp + 0x13b0]
test al, al
je 0x7ff6c5d1963d
test r15d, r15d
je 0x7ff6c5d1a1ae
cmp dword [rbp + 0x13b8], 2
je 0x7ff6c5d1a20b
mov eax, dword [rsp + 0x48]
lea edi, [rsi + rax]
cmp edi, eax
jl 0x7ff6c5d1a3f7
cmp edi, r14d
jbe 0x7ff6c5d1969b
test r14d, r14d
jne 0x7ff6c5d19675
mov r14d, 0x1000
cmp esi, r14d
cmova r14d, esi
cmp edi, r14d
jbe 0x7ff6c5d1967d
add r14d, r14d
cmp edi, r14d
ja 0x7ff6c5d19675
mov rcx, qword [r13 + 8]
mov edx, r14d
call qword [sym.imp.ucrtbase.dll_realloc]
test rax, rax
je 0x7ff6c5d1a1cd
mov qword [r13 + 8], rax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov r8d, esi
add rdx, qword [r13 + 8]
mov rcx, rbx
call fcn.7ff6c5d13e10
test eax, eax
je 0x7ff6c5d1a1ec
mov dword [rsp + 0x48], edi
jmp 0x7ff6c5d19c6f
mov dword [rsp + 0x58], 1
jmp 0x7ff6c5d19988
cmp dword [rsp + 0x44], 0
je 0x7ff6c5d1a2f1
xor eax, eax
mov dword [rsp + 0x44], eax
cmp esi, 0xd
jne 0x7ff6c5d1a2d2
mov rcx, rbx
call fcn.7ff6c5d13b60
mov rcx, rbx
mov edi, eax
call fcn.7ff6c5d13b60
shl edi, 0x10
mov rcx, rbx
add eax, edi
mov dword [rbx], eax
call fcn.7ff6c5d13b60
mov rcx, rbx
mov edi, eax
call fcn.7ff6c5d13b60
shl edi, 0x10
lea ecx, [rax + rdi]
mov dword [rbx + 4], ecx
cmp ecx, 0x1000000
ja 0x7ff6c5d19940
cmp dword [rbx], 0x1000000
ja 0x7ff6c5d19940
mov rax, qword [rbx + 0xc0]
cmp rax, qword [rbx + 0xc8]
jae 0x7ff6c5d1974f
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x7ff6c5d19775
cmp dword [rbx + 0x30], 0
je 0x7ff6c5d19773
mov rcx, rbx
call fcn.7ff6c5d1e400
mov rax, qword [rbx + 0xc0]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x7ff6c5d19775
xor cl, cl
movzx eax, cl
mov dword [r13 + 0x20], eax
cmp eax, 1
je 0x7ff6c5d19798
cmp eax, 0x10
ja 0x7ff6c5d1a218
mov ecx, 0x10114
bt ecx, eax
jae 0x7ff6c5d1a218
mov rax, qword [rbx + 0xc0]
cmp rax, qword [rbx + 0xc8]
jae 0x7ff6c5d197b7
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x7ff6c5d197dd
cmp dword [rbx + 0x30], 0
je 0x7ff6c5d197db
mov rcx, rbx
call fcn.7ff6c5d1e400
mov rax, qword [rbx + 0xc0]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x7ff6c5d197dd
xor cl, cl
movzx edi, cl
mov dword [rsp + 0x5c], edi
cmp edi, 6
ja 0x7ff6c5d1a237
cmp edi, 3
jne 0x7ff6c5d1980a
cmp dword [r13 + 0x20], 0x10
je 0x7ff6c5d1a237
movzx esi, dil
mov byte [rbp + 0x13b0], dil
jmp 0x7ff6c5d1981b
test dil, 1
jne 0x7ff6c5d1a237
movzx esi, byte [rbp + 0x13b0]
cmp rax, qword [rbx + 0xc8]
jb 0x7ff6c5d19839
cmp dword [rbx + 0x30], 0
je 0x7ff6c5d1984e
mov rcx, rbx
call fcn.7ff6c5d1e400
mov rax, qword [rbx + 0xc0]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
test cl, cl
jne 0x7ff6c5d1a256
cmp rax, qword [rbx + 0xc8]
jb 0x7ff6c5d1986c
cmp dword [rbx + 0x30], 0
je 0x7ff6c5d19881
mov rcx, rbx
call fcn.7ff6c5d1e400
mov rax, qword [rbx + 0xc0]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
test cl, cl
jne 0x7ff6c5d1a275
cmp rax, qword [rbx + 0xc8]
jae 0x7ff6c5d19899
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x7ff6c5d198bf
cmp dword [rbx + 0x30], 0
je 0x7ff6c5d198bd
mov rcx, rbx
call fcn.7ff6c5d1e400
mov rax, qword [rbx + 0xc0]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x7ff6c5d198bf
xor cl, cl
movzx r12d, cl
mov dword [rsp + 0x54], r12d
cmp r12d, 1
ja 0x7ff6c5d1a2b3
mov ecx, dword [rbx]
test ecx, ecx
je 0x7ff6c5d1a294
mov r9d, dword [rbx + 4]
test r9d, r9d
je 0x7ff6c5d1a294
xor edx, edx
mov eax, 0x40000000
div ecx
test sil, sil
jne 0x7ff6c5d1992d
xor edx, edx
mov r8d, edi
shr r8d, 2
mov ecx, edi
and ecx, 2
and r8d, 1
or ecx, 1
add r8d, ecx
div r8d
mov dword [rbx + 8], r8d
cmp eax, r9d
jb 0x7ff6c5d19940
cmp dword [rbp + 0x13b8], 2
je 0x7ff6c5d1a395
jmp 0x7ff6c5d19c6f
shr eax, 2
mov dword [rbx + 8], 1
cmp eax, r9d
jae 0x7ff6c5d19c6f
mov edx, dword [0x7ff6c5e1afd8]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, [0x7ff6c5da7d58]
jmp 0x7ff6c5d1a3ee
cmp ecx, 0x504c5445
je 0x7ff6c5d19b2f
cmp ecx, 0x74524e53
je 0x7ff6c5d199e9
cmp dword [rsp + 0x44], 0
jne 0x7ff6c5d19603
bt ecx, 0x1d
jae 0x7ff6c5d1a310
test esi, esi
je 0x7ff6c5d19c6f
jns 0x7ff6c5d199a5
mov rax, qword [rbx + 0xc8]
mov qword [rbx + 0xc0], rax
jmp 0x7ff6c5d19c6f
cmp qword [rbx + 0x10], 0
je 0x7ff6c5d199da
mov ecx, dword [rbx + 0xc8]
sub ecx, dword [rbx + 0xc0]
cmp ecx, esi
jge 0x7ff6c5d199da
mov rax, qword [rbx + 0xc8]
sub esi, ecx
mov rcx, qword [rbx + 0x28]
mov edx, esi
mov qword [rbx + 0xc0], rax
call qword [rbx + 0x18]
jmp 0x7ff6c5d19c6f
movsxd rax, esi
add qword [rbx + 0xc0], rax
jmp 0x7ff6c5d19c6f
cmp dword [rsp + 0x44], 0
jne 0x7ff6c5d19603
cmp qword [r13 + 8], 0
jne 0x7ff6c5d1a3b8
cmp byte [rbp + 0x13b0], 0
je 0x7ff6c5d19a9b
cmp dword [rbp + 0x13b8], 2
je 0x7ff6c5d1a38e
test r15d, r15d
je 0x7ff6c5d1a372
cmp esi, r15d
ja 0x7ff6c5d1a356
xor eax, eax
mov byte [rbp + 0x13b0], 4
mov edi, eax
test esi, esi
je 0x7ff6c5d19c6f
nop
mov rax, qword [rbx + 0xc0]
cmp rax, qword [rbx + 0xc8]
jae 0x7ff6c5d19a5f
movzx edx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x7ff6c5d19a85
cmp dword [rbx + 0x30], 0
je 0x7ff6c5d19a83
mov rcx, rbx
call fcn.7ff6c5d1e400
mov rax, qword [rbx + 0xc0]
movzx edx, byte [rax]
inc rax
mov qword [rbx + 0xc0], rax
jmp 0x7ff6c5d19a85
xor dl, dl
lea eax, [rdi*4 + 3]
inc edi
mov byte [rsp + rax + 0x60], dl
cmp edi, esi
jb 0x7ff6c5d19a40
jmp 0x7ff6c5d19c6f
mov ecx, dword [rbx + 8]
test cl, 1
je 0x7ff6c5d1a39c
lea eax, [rcx + rcx]
cmp esi, eax
jne 0x7ff6c5d1a356
xor eax, eax
mov byte [rbp + 0x13c8], 1
cmp dword [r13 + 0x20], 0x10
mov esi, eax
jne 0x7ff6c5d19aec
test ecx, ecx
jle 0x7ff6c5d19c6f
lea rdi, [rsp + 0x4c]
mov rcx, rbx
call fcn.7ff6c5d13b60
inc esi
mov word [rdi], ax
lea rdi, [rdi + 2]
cmp esi, dword [rbx + 8]
jl 0x7ff6c5d19ad1
jmp 0x7ff6c5d19c6f
test ecx, ecx
jle 0x7ff6c5d19c6f
lea rdi, [rsp + 0x40]
lea r12, [0x7ff6c5da7b90]
mov rcx, rbx
call fcn.7ff6c5d13b60
movsxd rcx, dword [r13 + 0x20]
lea rdi, [rdi + 1]
movzx eax, al
inc esi
movzx edx, byte [rcx + r12]
imul eax, edx
mov byte [rdi - 1], al
cmp esi, dword [rbx + 8]
jl 0x7ff6c5d19b00
mov r12d, dword [rsp + 0x54]
jmp 0x7ff6c5d19c6f
cmp dword [rsp + 0x44], 0
jne 0x7ff6c5d19603
cmp esi, 0x300
ja 0x7ff6c5d1a3d4
mov eax, 0xaaaaaaab
mul esi
mov r15d, edx
shr r15d, 1
lea eax, [r15 + r15*2]
cmp eax, esi
jne 0x7ff6c5d1a3d4
xor eax, eax
mov esi, eax
test r15d, r15d
je 0x7ff6c5d19c6f
mov r8, qword [rbx + 0xc0]
mov rdx, qword [rbx + 0xc8]
cmp r8, rdx
jae 0x7ff6c5d19b88
movzx ecx, byte [r8]
inc r8
jmp 0x7ff6c5d19bab
cmp dword [rbx + 0x30], 0
je 0x7ff6c5d19bce
mov rcx, rbx
call fcn.7ff6c5d1e400
mov rax, qword [rbx + 0xc0]
mov rdx, qword [rbx + 0xc8]
movzx ecx, byte [rax]
lea r8, [rax + 1]
mov qword [rbx + 0xc0], r8
lea edi, [rsi*4]
mov byte [rsp + rdi + 0x60], cl
mov r9d, edi
cmp r8, rdx
jae 0x7ff6c5d19bdd
movzx r9d, byte [r8]
inc r8
jmp 0x7ff6c5d19c01
lea edi, [rsi*4]
mov byte [rsp + rdi + 0x60], 0
mov r9d, edi
cmp dword [rbx + 0x30], 0
je 0x7ff6c5d19c25
mov rcx, rbx
call fcn.7ff6c5d1e400
mov rax, qword [rbx + 0xc0]
mov rdx, qword [rbx + 0xc8]
movzx r9d, byte [rax]
lea r8, [rax + 1]
mov qword [rbx + 0xc0], r8
lea eax, [rdi + 1]
mov byte [rsp + rax + 0x60], r9b
cmp r8, rdx
jae 0x7ff6c5d19c2e
movzx edx, byte [r8]
inc r8
mov qword [rbx + 0xc0], r8
jmp 0x7ff6c5d19c55
lea eax, [r9 + 1]
mov byte [rsp + rax + 0x60], 0
cmp dword [rbx + 0x30], 0
je 0x7ff6c5d19c53
mov rcx, rbx
call fcn.7ff6c5d1e400
mov rax, qword [rbx + 0xc0]
movzx edx, byte [rax]
lea r8, [rax + 1]
mov qword [rbx + 0xc0], r8
jmp 0x7ff6c5d19c55
xor dl, dl
lea eax, [rdi + 2]
inc esi
mov byte [rsp + rax + 0x60], dl
lea eax, [rdi + 3]
mov byte [rsp + rax + 0x60], 0xff
cmp esi, r15d
jb 0x7ff6c5d19b73
mov rcx, rbx
call fcn.7ff6c5d13b60
mov rcx, rbx
call fcn.7ff6c5d13b60
jmp 0x7ff6c5d19597
cmp dword [rbp + 0x13b8], 0
jne 0x7ff6c5d1a395
mov rdi, qword [r13 + 8]
test rdi, rdi
jne 0x7ff6c5d19cb9
mov edx, dword [0x7ff6c5e1afd8]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, [0x7ff6c5da7ff8]
jmp 0x7ff6c5d1a3ee
mov eax, dword [rbx]
imul eax, dword [r13 + 0x20]
add eax, 7
shr eax, 3
imul eax, dword [rbx + 8]
inc eax
imul eax, dword [rbx + 4]
movsxd rsi, eax
mov rcx, rsi
call qword [sym.imp.ucrtbase.dll_malloc]
mov rcx, rax
test rax, rax
jne 0x7ff6c5d19ced
mov qword [r13 + 0x10], rax
jmp 0x7ff6c5d1a3f7
movsxd rax, dword [rsp + 0x48]
xor r14d, r14d
add rax, rdi
mov qword [rbp + 0x380], rcx
mov qword [rbp + 0x368], rax
mov edx, r14d
lea rax, [rsi + rcx]
mov qword [rbp + 0x378], rcx
mov esi, dword [rsp + 0x58]
lea rcx, [rbp + 0x360]
test esi, esi
mov qword [rbp + 0x360], rdi
mov qword [rbp + 0x388], rax
sete dl
mov dword [rbp + 0x390], 1
call fcn.7ff6c5d1a590
test eax, eax
je 0x7ff6c5d1a198
mov rax, qword [rbp + 0x380]
mov edi, dword [rbp + 0x378]
sub edi, dword [rbp + 0x380]
mov qword [r13 + 0x10], rax
test rax, rax
je 0x7ff6c5d1a3f7
mov rcx, qword [r13 + 8]
call qword [sym.imp.ucrtbase.dll_free]
mov ecx, dword [rbp + 0x13c0]
mov qword [r13 + 8], r14
mov eax, dword [rbx + 8]
movzx r14d, byte [rbp + 0x13b0]
lea r9d, [rax + 1]
cmp ecx, r9d
jne 0x7ff6c5d19d9f
cmp ecx, 3
je 0x7ff6c5d19d9f
test r14b, r14b
je 0x7ff6c5d19e41
movzx r15d, byte [rbp + 0x13c8]
test r15b, r15b
jne 0x7ff6c5d19daf
mov r9d, eax
mov eax, dword [rsp + 0x5c]
mov r8d, edi
mov dword [rbx + 0xc], r9d
mov rcx, r13
mov rdx, qword [r13 + 0x10]
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], eax
mov eax, dword [r13 + 0x20]
mov dword [rsp + 0x20], eax
call fcn.7ff6c5d11e30
test eax, eax
je 0x7ff6c5d1a3f7
test r15b, r15b
je 0x7ff6c5d19eee
mov rcx, qword [r13]
mov eax, dword [rcx + 4]
imul eax, dword [rcx]
cmp dword [r13 + 0x20], 0x10
mov rcx, qword [r13 + 0x18]
jne 0x7ff6c5d19e84
test eax, eax
je 0x7ff6c5d19eee
xor r10d, r10d
cmp dword [rbx + 0xc], 2
jne 0x7ff6c5d19e4e
movzx r8d, word [rsp + 0x4c]
mov edx, eax
nop word [rax + rax]
cmp word [rcx], r8w
lea rcx, [rcx + 4]
mov eax, 0xffff
cmove ax, r10w
mov word [rcx - 2], ax
sub rdx, 1
jne 0x7ff6c5d19e20
jmp 0x7ff6c5d19eee
movzx r15d, byte [rbp + 0x13c8]
jmp 0x7ff6c5d19daf
movzx edx, word [rsp + 0x50]
movzx r8d, word [rsp + 0x4e]
movzx r9d, word [rsp + 0x4c]
nop
cmp word [rcx], r9w
jne 0x7ff6c5d19e78
cmp word [rcx + 2], r8w
jne 0x7ff6c5d19e78
cmp word [rcx + 4], dx
jne 0x7ff6c5d19e78
mov word [rcx + 6], r10w
add rcx, 8
sub rax, 1
jne 0x7ff6c5d19e60
jmp 0x7ff6c5d19eee
test eax, eax
je 0x7ff6c5d19eee
cmp dword [rbx + 0xc], 2
jne 0x7ff6c5d19ebb
movzx r8d, byte [rsp + 0x40]
xor r10d, r10d
mov edx, eax
nop dword [rax]
cmp byte [rcx], r8b
lea rcx, [rcx + 2]
mov eax, 0xff
cmove eax, r10d
mov byte [rcx - 1], al
sub rdx, 1
jne 0x7ff6c5d19ea0
jmp 0x7ff6c5d19eee
movzx edx, byte [rsp + 0x42]
movzx r8d, byte [rsp + 0x41]
movzx r9d, byte [rsp + 0x40]
nop dword [rax]
cmp byte [rcx], r9b
jne 0x7ff6c5d19ee4
cmp byte [rcx + 1], r8b
jne 0x7ff6c5d19ee4
cmp byte [rcx + 2], dl
jne 0x7ff6c5d19ee4
mov byte [rcx + 3], 0
add rcx, 4
sub rax, 1
jne 0x7ff6c5d19ed0
mov r12d, dword [0x7ff6c5e1afd8]
test esi, esi
je 0x7ff6c5d1a03a
mov rax, qword gs:[0x58]
mov rdx, qword [rax + r12*8]
mov eax, 0x10
cmp dword [rax + rdx], 0
je 0x7ff6c5d19f1f
mov eax, 0x14
mov eax, dword [rax + rdx]
jmp 0x7ff6c5d19f25
mov eax, dword [0x7ff6c5e1ac78]
test eax, eax
je 0x7ff6c5d1a03a
cmp dword [rbx + 0xc], 2
jle 0x7ff6c5d1a03a
mov rax, qword [r13]
mov r10, qword [r13 + 0x18]
mov ecx, dword [rax + 4]
imul ecx, dword [rax]
cmp dword [rax + 0xc], 3
jne 0x7ff6c5d19f7f
test ecx, ecx
je 0x7ff6c5d1a03a
mov edx, ecx
nop word [rax + rax]
movzx ecx, byte [r10]
movzx eax, byte [r10 + 2]
mov byte [r10], al
mov byte [r10 + 2], cl
lea r10, [r10 + 3]
sub rdx, 1
jne 0x7ff6c5d19f60
jmp 0x7ff6c5d1a03a
mov eax, 0x18
cmp dword [rax + rdx], 0
je 0x7ff6c5d19f94
mov eax, 0x1c
mov eax, dword [rax + rdx]
jmp 0x7ff6c5d19f9a
mov eax, dword [0x7ff6c5e1ac74]
test ecx, ecx
je 0x7ff6c5d1a03a
test eax, eax
je 0x7ff6c5d1a01e
mov esi, ecx
nop dword [rax + rax]
movzx eax, byte [r10 + 3]
movzx ecx, byte [r10]
movzx edi, byte [r10 + 2]
test al, al
je 0x7ff6c5d1a003
mov r8d, eax
mov r9d, eax
movzx eax, byte [r10 + 1]
xor edx, edx
imul eax, eax, 0xff
shr r8d, 1
add eax, r8d
div r9d
xor edx, edx
mov byte [r10 + 1], al
imul eax, ecx, 0xff
add eax, r8d
div r9d
xor edx, edx
mov r11d, eax
imul eax, edi, 0xff
add eax, r8d
div r9d
jmp 0x7ff6c5d1a00b
movzx r11d, cl
movzx eax, dil
mov byte [r10], al
mov byte [r10 + 2], r11b
add r10, 4
sub rsi, 1
jne 0x7ff6c5d19fb0
jmp 0x7ff6c5d1a03a
mov edx, ecx
movzx ecx, byte [r10]
movzx eax, byte [r10 + 2]
mov byte [r10], al
mov byte [r10 + 2], cl
lea r10, [r10 + 4]
sub rdx, 1
jne 0x7ff6c5d1a020
test r14b, r14b
je 0x7ff6c5d1a16e
mov eax, dword [rbp + 0x13c0]
movzx esi, r14b
mov dword [rbx + 8], esi
mov dword [rbx + 0xc], esi
cmp eax, 3
jl 0x7ff6c5d1a05d
mov dword [rbx + 0xc], eax
mov esi, eax
mov rax, qword [r13]
mov rdi, qword [r13 + 0x18]
mov r14d, dword [rax + 4]
imul r14d, dword [rax]
test r14d, r14d
js 0x7ff6c5d1a155
test esi, esi
js 0x7ff6c5d1a155
je 0x7ff6c5d1a091
mov eax, 0x7fffffff
cdq
idiv esi
cmp r14d, eax
jg 0x7ff6c5d1a155
mov eax, esi
imul eax, r14d
movsxd rcx, eax
call qword [sym.imp.ucrtbase.dll_malloc]
mov r15, rax
test rax, rax
je 0x7ff6c5d1a155
test r14d, r14d
je 0x7ff6c5d1a145
mov r9d, r14d
lea r8, [rax + 2]
cmp esi, 3
jne 0x7ff6c5d1a110
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rdi]
lea r8, [r8 + 3]
lea rdi, [rdi + 1]
movzx eax, byte [rsp + rdx*4 + 0x60]
mov byte [r8 - 5], al
movzx eax, byte [rsp + rdx*4 + 0x61]
mov byte [r8 - 4], al
movzx eax, byte [rsp + rdx*4 + 0x62]
mov byte [r8 - 3], al
sub r9, 1
jne 0x7ff6c5d1a0d0
mov rcx, qword [r13 + 0x18]
call qword [sym.imp.ucrtbase.dll_free]
mov qword [r13 + 0x18], r15
jmp 0x7ff6c5d1a176
movzx edx, byte [rdi]
lea r8, [r8 + 4]
lea rdi, [rdi + 1]
movzx eax, byte [rsp + rdx*4 + 0x60]
mov byte [r8 - 6], al
movzx eax, byte [rsp + rdx*4 + 0x61]
mov byte [r8 - 5], al
movzx eax, byte [rsp + rdx*4 + 0x62]
mov byte [r8 - 4], al
movzx eax, byte [rsp + rdx*4 + 0x63]
mov byte [r8 - 3], al
sub r9, 1
jne 0x7ff6c5d1a110
mov rcx, qword [r13 + 0x18]
call qword [sym.imp.ucrtbase.dll_free]
mov qword [r13 + 0x18], r15
jmp 0x7ff6c5d1a176
mov rax, qword gs:[0x58]
lea rdx, [0x7ff6c5da7bb8]
mov rax, qword [rax + r12*8]
jmp 0x7ff6c5d1a3ee
test r15b, r15b
je 0x7ff6c5d1a176
inc dword [rbx + 8]
mov rcx, qword [r13 + 0x10]
call qword [sym.imp.ucrtbase.dll_free]
xor eax, eax
mov rcx, rbx
mov qword [r13 + 0x10], rax
call fcn.7ff6c5d13ce0
mov eax, 1
jmp 0x7ff6c5d1a3f9
mov rcx, qword [rbp + 0x380]
call qword [sym.imp.ucrtbase.dll_free]
mov qword [r13 + 0x10], r14
jmp 0x7ff6c5d1a3f7
mov edx, dword [0x7ff6c5e1afd8]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, [0x7ff6c5da7fe0]
jmp 0x7ff6c5d1a3ee
mov edx, dword [0x7ff6c5e1afd8]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, [0x7ff6c5da7bb8]
jmp 0x7ff6c5d1a3ee
mov edx, dword [0x7ff6c5e1afd8]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, [0x7ff6c5da7fe8]
jmp 0x7ff6c5d1a3ee
mov dword [rbx + 8], eax
mov eax, 1
jmp 0x7ff6c5d1a3f9
mov edx, dword [0x7ff6c5e1afd8]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, [0x7ff6c5da7f00]
jmp 0x7ff6c5d1a3ee
mov edx, dword [0x7ff6c5e1afd8]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, [0x7ff6c5da7f18]
jmp 0x7ff6c5d1a3ee
mov edx, dword [0x7ff6c5e1afd8]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, [0x7ff6c5da7f28]
jmp 0x7ff6c5d1a3ee
mov edx, dword [0x7ff6c5e1afd8]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, [0x7ff6c5da7f38]
jmp 0x7ff6c5d1a3ee
mov edx, dword [0x7ff6c5e1afd8]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, [0x7ff6c5da7f68]
jmp 0x7ff6c5d1a3ee
mov edx, dword [0x7ff6c5e1afd8]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, [0x7ff6c5da7f50]
jmp 0x7ff6c5d1a3ee
mov edx, dword [0x7ff6c5e1afd8]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, [0x7ff6c5da7ef0]
jmp 0x7ff6c5d1a3ee
mov edx, dword [0x7ff6c5e1afd8]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, [0x7ff6c5da7ee0]
jmp 0x7ff6c5d1a3ee
mov edx, dword [0x7ff6c5e1afd8]
mov eax, ecx
shr eax, 0x18
mov byte [0x7ff6c5dd7210], al
mov eax, ecx
shr eax, 0x10
mov byte [0x7ff6c5dd7211], al
mov eax, ecx
shr eax, 8
mov byte [0x7ff6c5dd7212], al
mov rax, qword gs:[0x58]
mov byte [0x7ff6c5dd7213], cl
mov rax, qword [rax + rdx*8]
lea rdx, [0x7ff6c5dd7210]
jmp 0x7ff6c5d1a3ee
mov edx, dword [0x7ff6c5e1afd8]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, [0x7ff6c5da7fc0]
jmp 0x7ff6c5d1a3ee
mov edx, dword [0x7ff6c5e1afd8]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, [0x7ff6c5da7fa8]
jmp 0x7ff6c5d1a3ee
mov dword [rbx + 8], 4
mov eax, 1
jmp 0x7ff6c5d1a3f9
mov edx, dword [0x7ff6c5e1afd8]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, [0x7ff6c5da7fd0]
jmp 0x7ff6c5d1a3ee
mov edx, dword [0x7ff6c5e1afd8]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, [0x7ff6c5da7f98]
jmp 0x7ff6c5d1a3ee
mov edx, dword [0x7ff6c5e1afd8]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rdx*8]
lea rdx, [0x7ff6c5da7f88]
mov ecx, 0x20
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x1468
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret