Function at 0x1d340
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
sub rsp, 0xbd8
mov rax, qword [0x000181d8]
mov qword [rsp + 0xb80], rax
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r14
mov rbp, rcx
mov qword [rsp + 0xc0], rcx
lea rcx, [r11 - 0x948]
mov qword [r11 - 0x40], r15
mov r14, rdx
mov rsi, r9
mov qword [rsp + 0x1a0], r9
mov rbx, r8
mov qword [rsp + 0xd8], r8
mov qword [rsp + 0xc8], rdx
call fcn.00013ec0
xor eax, eax
xor r12d, r12d
movabs rdi, 0xfffff78000000320
mov rdi, qword [rdi]
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], rax
mov word [rsp + 0x160], ax
movzx eax, byte [r14]
add eax, 0xffffffe3
xor r13b, r13b
mov byte [rsp + 0x130], 1
cmp eax, 0x85
lea r15d, [r12 + 2]
ja case.0x1d438.31
lea rdx, [0x00010000]
cdqe
movzx eax, byte [rdx + rax + 0xedf4]
mov ecx, dword [rdx + rax*4 + 0xedb4]
add rcx, rdx
jmp rcx
movzx eax, word [r14 + 1]
mov edx, 0xa
mov byte [rsp + 0x130], r12b
mov word [rbp + 4], ax
movzx eax, byte [rbp + 0x1a6]
mov byte [rsp + 0x134], r12b
cmp al, 5
mov word [rbp + 6], 0xa0cb
mov byte [rbp + 3], bpl
cmova edx, eax
movzx eax, bp
mov byte [rbp + 1], 1
shr ax, 8
mov byte [rsp + 0x132], r15b
mov byte [rsp + 0x135], bpl
mov byte [rsp + 0x133], dl
mov r12d, 5
mov r13b, 1
mov byte [rsp + 0x136], al
jmp 0x1ebf4
lea r11, [r14 + 1]
mov r10d, 4
mov r9, r11
xor cl, cl
mov r8d, 4
nop
nop
movzx edx, word [rbp + 4]
add cl, cl
test dl, 1
je 0x1d4e2
movzx eax, word [rbp + 6]
or cl, 1
xor ax, dx
shr ax, 1
or ax, 0x8000
mov word [rbp + 4], ax
jmp 0x1d4e9
shr dx, 1
mov word [rbp + 4], dx
add cl, cl
test byte [rbp + 4], 0x80
je 0x1d4f4
or cl, 1
dec r8
jne 0x1d4c0
xor byte [r9], cl
inc r9
dec r10
jne 0x1d4b2
mov r8d, dword [rbp + 0x1a8]
cmp dword [r11], r8d
jne 0x1ebf4
cmp byte [rbp + 1], 1
jne 0x1ebf4
mov rcx, rbp
mov byte [rsp + 0x130], r12b
call fcn.0001b950
mov rcx, rbp
mov byte [rsp + 0x132], al
call fcn.0001b950
mov r13b, 1
sar eax, 8
mov byte [rsp + 0x134], 0x10
lea r12d, [r10 + 3]
mov byte [rbp + 2], r13b
mov dword [0x0001827c], r8d
mov byte [rsp + 0x133], al
jmp 0x1ebf4
lea r11, [r14 + 1]
mov r10, r15
mov r9, r11
xor cl, cl
mov r8d, 4
nop
nop
movzx edx, word [rbp + 4]
add cl, cl
test dl, 1
je 0x1d5a2
movzx eax, word [rbp + 6]
or cl, 1
xor ax, dx
shr ax, 1
or ax, 0x8000
mov word [rbp + 4], ax
jmp 0x1d5a9
shr dx, 1
mov word [rbp + 4], dx
add cl, cl
test byte [rbp + 4], 0x80
je 0x1d5b4
or cl, 1
dec r8
jne 0x1d580
xor byte [r9], cl
inc r9
dec r10
jne 0x1d570
cmp byte [rbp + 2], r12b
je 0x1ebf4
mov ax, word [r11]
cmp ax, 7
ja 0x1ebf4
mov byte [rsp + 0x130], r12b
movzx ecx, ax
lea rdx, [rsp + 0x132]
mov eax, dword [rbp + rcx*2 + 0x1c2]
lea r12d, [r8 + 6]
mov r13b, 1
mov dword [rdx], eax
movzx eax, word [rbp + rcx*2 + 0x1c6]
mov word [rdx + 4], ax
jmp 0x1ebf4
lea r11, [r14 + 1]
mov r10, r15
mov r9, r11
nop
nop
xor cl, cl
mov r8d, 4
nop
nop
movzx edx, word [rbp + 4]
add cl, cl
test dl, 1
je 0x1d652
movzx eax, word [rbp + 6]
or cl, 1
xor ax, dx
shr ax, 1
or ax, 0x8000
mov word [rbp + 4], ax
jmp 0x1d659
shr dx, 1
mov word [rbp + 4], dx
add cl, cl
test byte [rbp + 4], 0x80
je 0x1d664
or cl, 1
dec r8
jne 0x1d630
xor byte [r9], cl
inc r9
dec r10
jne 0x1d620
cmp byte [rbp + 2], r12b
je 0x1ebf4
movzx r8d, word [r11]
mov rcx, rbp
call fcn.0001b950
mov ecx, r8d
add ecx, ecx
cmp ecx, eax
jge 0x1ebf4
mov byte [rsp + 0x130], r12b
mov eax, dword [rbp + r8*2 + 0x212]
lea rdx, [rsp + 0x132]
mov dword [rdx], eax
movzx eax, word [rbp + r8*2 + 0x216]
mov rcx, r8
lea r12d, [r10 + 6]
mov r13b, 1
mov word [rdx + 4], ax
jmp 0x1ebf4
lea r11, [r14 + 1]
mov r10d, 4
mov r9, r11
nop
nop
xor cl, cl
mov r8d, 4
nop
nop
movzx edx, word [rbp + 4]
add cl, cl
test dl, 1
je 0x1d712
movzx eax, word [rbp + 6]
or cl, 1
xor ax, dx
shr ax, 1
or ax, 0x8000
mov word [rbp + 4], ax
jmp 0x1d719
shr dx, 1
mov word [rbp + 4], dx
add cl, cl
test byte [rbp + 4], 0x80
je 0x1d724
or cl, 1
dec r8
jne 0x1d6f0
xor byte [r9], cl
inc r9
dec r10
jne 0x1d6e0
cmp byte [rbp + 2], r12b
je 0x1ebf4
movzx r8d, word [r11]
mov rcx, rbp
call fcn.0001b950
mov ecx, r8d
add ecx, ecx
cmp ecx, eax
jge 0x1ebf4
movzx eax, word [r14 + 3]
mov rcx, rbp
mov byte [rsp + 0x130], r12b
mov word [rbp + r8*2 + 0x212], ax
xor r13b, r13b
call fcn.0001b950
lea rdx, [rbp + 0x212]
lea rcx, [0x00021b20]
mov r9, rbp
mov r8d, eax
call fcn.0001b990
test eax, eax
jne 0x1ebf4
mov byte [rsp + 0x130], r12b
jmp 0x1ebf4
cmp byte [rbp + 2], r12b
je 0x1ebf4
mov byte [rsp + 0x130], r12b
mov ecx, 7
lea rdx, [rsp + 0x132]
nop
nop
nop
movzx eax, byte [rcx + rbp + 0x1ba]
inc rdx
dec rcx
mov byte [rdx - 1], al
jns 0x1d7d0
mov r12d, 8
mov r13b, 1
jmp 0x1ebf4
lea r11, [r14 + 1]
mov r10d, 4
mov r9, r11
nop
xor cl, cl
mov r8d, 4
nop
nop
movzx edx, word [rbp + 4]
add cl, cl
test dl, 1
je 0x1d832
movzx eax, word [rbp + 6]
or cl, 1
xor ax, dx
shr ax, 1
or ax, 0x8000
mov word [rbp + 4], ax
jmp 0x1d839
shr dx, 1
mov word [rbp + 4], dx
add cl, cl
test byte [rbp + 4], 0x80
je 0x1d844
or cl, 1
dec r8
jne 0x1d810
xor byte [r9], cl
inc r9
dec r10
jne 0x1d800
cmp byte [rbp + 2], r12b
je 0x1ebf4
mov eax, dword [r11]
lea rdx, [rbp + 0x1212]
lea rcx, [rsp + 0x132]
mov dword [rsp + 0x132], eax
mov byte [rsp + 0x130], r12b
call fcn.00016bc0
mov r12d, 4
mov r13b, 1
jmp 0x1ebf4
movzx ecx, word [r14 + 1]
test ecx, ecx
je 0x1db84
dec ecx
je 0x1d9ac
dec ecx
je 0x1d903
dec ecx
jne case.0x1d438.160
mov byte [rsp + 0x198], r12b
mov byte [rsp + 0x199], r12b
mov byte [rsp + 0x19a], 0xaa
mov byte [rsp + 0x19b], r12b
mov byte [rsp + 0x19c], r12b
mov byte [rsp + 0x19d], r12b
mov byte [rsp + 0x19e], r12b
mov byte [rsp + 0x19f], r12b
mov rax, qword [rsp + 0x198]
mov qword [rsi], rax
jmp case.0x1d438.160
movzx eax, byte [rbp + 0x1c5]
lea rcx, [rsp + 0x1a0]
mov byte [rsp + 0x1a4], r12b
mov byte [rsp + 0x1a0], al
movzx eax, byte [rbp + 0x1c4]
mov byte [rsp + 0x1a5], r12b
mov byte [rsp + 0x1a1], al
movzx eax, byte [rbp + 0x1c3]
mov byte [rsp + 0x1a6], 1
mov byte [rsp + 0x1a2], al
movzx eax, byte [rbp + 0x1c2]
mov byte [rsp + 0x1a7], r12b
mov byte [rsp + 0x1a8], r12b
mov byte [rsp + 0x1a9], 4
mov byte [rsp + 0x1aa], r12b
mov byte [rsp + 0x1a3], al
mov byte [rsp + 0x1ab], r12b
mov byte [rsp + 0x1ac], 1
mov byte [rsp + 0x1ad], r12b
mov rax, qword [rcx]
mov qword [rsi], rax
mov eax, dword [rcx + 8]
mov dword [rsi + 8], eax
movzx eax, word [rcx + 0xc]
mov word [rsi + 0xc], ax
jmp case.0x1d438.160
movzx eax, byte [rbp + 0x1c5]
lea rcx, [rsp + 0x168]
mov byte [rsp + 0x16c], 6
mov byte [rsp + 0x168], al
movzx eax, byte [rbp + 0x1c4]
mov byte [rsp + 0x16d], r12b
mov byte [rsp + 0x169], al
movzx eax, byte [rbp + 0x1c3]
mov byte [rsp + 0x16e], r12b
mov byte [rsp + 0x16a], al
movzx eax, byte [rbp + 0x1c2]
mov byte [rsp + 0x16f], r12b
mov byte [rsp + 0x170], r12b
mov byte [rsp + 0x171], 0xca
mov byte [rsp + 0x172], r12b
mov byte [rsp + 0x16b], al
mov byte [rsp + 0x173], 0xe
mov byte [rsp + 0x174], r12b
mov byte [rsp + 0x175], r12b
mov byte [rsp + 0x176], 0x35
mov byte [rsp + 0x177], 0x88
mov byte [rsp + 0x178], r15b
mov byte [rsp + 0x179], 0x24
mov byte [rsp + 0x17a], r12b
mov byte [rsp + 0x17b], r15b
mov byte [rsp + 0x17c], r12b
mov byte [rsp + 0x17d], r15b
mov byte [rsp + 0x17e], r12b
mov byte [rsp + 0x17f], r12b
mov byte [rsp + 0x180], 3
mov byte [rsp + 0x181], 0x15
mov byte [rsp + 0x182], 0x22
mov byte [rsp + 0x183], 0xc3
mov byte [rsp + 0x184], 0xb
mov byte [rsp + 0x185], r12b
mov byte [rsp + 0x186], r12b
mov byte [rsp + 0x187], r12b
mov byte [rsp + 0x188], r12b
mov byte [rsp + 0x189], r12b
mov byte [rsp + 0x18a], r12b
mov byte [rsp + 0x18b], r12b
mov byte [rsp + 0x18c], 0xf8
mov byte [rsp + 0x18d], r12b
mov byte [rsp + 0x18e], 3
mov byte [rsp + 0x18f], 0x7e
mov byte [rsp + 0x190], r12b
mov byte [rsp + 0x191], 1
mov byte [rsp + 0x192], 0x32
mov byte [rsp + 0x193], 0x47
mov byte [rsp + 0x194], r12b
mov byte [rsp + 0x195], r12b
mov byte [rsp + 0x196], r12b
mov rax, qword [rcx]
mov qword [rsi], rax
mov rax, qword [rcx + 8]
mov qword [rsi + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rsi + 0x10], rax
mov rax, qword [rcx + 0x18]
mov qword [rsi + 0x18], rax
mov rax, qword [rcx + 0x20]
mov qword [rsi + 0x20], rax
mov eax, dword [rcx + 0x28]
mov dword [rsi + 0x28], eax
movzx eax, word [rcx + 0x2c]
mov word [rsi + 0x2c], ax
movzx eax, byte [rcx + 0x2e]
mov byte [rsi + 0x2e], al
jmp case.0x1d438.160
inc byte [rsi]
jmp case.0x1d438.160
cmp word [r14 + 1], r12w
jne case.0x1d438.160
cmp dword [rbx], 0x7c1
jne case.0x1d438.160
mov byte [rsp + 0x1b0], 0xff
mov byte [rsp + 0x1b1], 0xc0
mov byte [rsp + 0x1b2], r12b
mov byte [rsp + 0x1b3], r12b
mov byte [rsp + 0x1b4], r12b
mov byte [rsp + 0x1b5], 4
mov byte [rsp + 0x1b6], 4
mov byte [rsp + 0x1b7], r12b
mov byte [rsp + 0x1b8], 0xff
mov byte [rsp + 0x1b9], 0xc1
mov byte [rsp + 0x1ba], r12b
mov byte [rsp + 0x1bb], 4
mov byte [rsp + 0x1bc], r12b
mov byte [rsp + 0x1bd], 1
mov byte [rsp + 0x1be], r12b
mov byte [rsp + 0x1bf], 1
mov byte [rsp + 0x1c0], 0xff
mov byte [rsp + 0x1c1], 0xc2
mov byte [rsp + 0x1c2], r12b
mov byte [rsp + 0x1c3], 5
mov byte [rsp + 0x1c4], r12b
mov byte [rsp + 0x1c5], 0xfd
mov byte [rsp + 0x1c6], r12b
mov byte [rsp + 0x1c7], r15b
mov byte [rsp + 0x1c8], 0xff
mov byte [rsp + 0x1c9], 0xc8
mov byte [rsp + 0x1ca], 1
mov byte [rsp + 0x1cb], r15b
mov byte [rsp + 0x1cc], r12b
mov byte [rsp + 0x1cd], 8
mov byte [rsp + 0x1ce], 4
mov byte [rsp + 0x1cf], 3
mov byte [rsp + 0x1d0], 0xff
mov byte [rsp + 0x1d1], 0xc9
mov byte [rsp + 0x1d2], r15b
mov byte [rsp + 0x1d3], 0x89
mov byte [rsp + 0x1d4], r12b
mov byte [rsp + 0x1d5], r15b
mov byte [rsp + 0x1d6], r12b
mov byte [rsp + 0x1d7], 7
mov byte [rsp + 0x1d8], 0xff
mov byte [rsp + 0x1d9], 0xcc
mov byte [rsp + 0x1da], r15b
mov byte [rsp + 0x1db], 0x8b
mov byte [rsp + 0x1dc], r12b
mov byte [rsp + 0x1dd], 6
mov byte [rsp + 0x1de], 4
mov byte [rsp + 0x1df], 0xd
mov byte [rsp + 0x1e0], 0xff
mov byte [rsp + 0x1e1], 0xf4
mov byte [rsp + 0x1e2], 1
mov byte [rsp + 0x1e3], 0xa
mov byte [rsp + 0x1e4], r12b
mov byte [rsp + 0x1e5], 0xfc
mov byte [rsp + 0x1e6], r12b
mov byte [rsp + 0x1e7], 4
mov byte [rsp + 0x1e8], 0xff
mov byte [rsp + 0x1e9], 0xf5
mov byte [rsp + 0x1ea], r15b
mov byte [rsp + 0x1eb], 6
mov byte [rsp + 0x1ec], r12b
mov byte [rsp + 0x1ed], 0x80
mov byte [rsp + 0x1ee], r12b
mov byte [rsp + 0x1ef], 5
mov byte [rsp + 0x1f0], 0xff
mov byte [rsp + 0x1f1], 0xca
mov byte [rsp + 0x1f2], r15b
mov byte [rsp + 0x1f3], 0x86
mov byte [rsp + 0x1f4], r12b
mov byte [rsp + 0x1f5], 3
mov byte [rsp + 0x1f6], r12b
mov byte [rsp + 0x1f7], 6
mov byte [rsp + 0x1f8], 0xff
mov byte [rsp + 0x1f9], 0xcd
mov byte [rsp + 0x1fa], r15b
mov byte [rsp + 0x1fb], 0x91
mov byte [rsp + 0x1fc], r12b
mov byte [rsp + 0x1fd], 1
mov byte [rsp + 0x1fe], r12b
mov byte [rsp + 0x1ff], 9
mov byte [rsp + 0x200], 0xff
lea rcx, [rsp + 0x3b0]
mov edx, 0xff
mov r8d, 0x7c1
mov byte [rsp + 0x201], 0xcb
mov byte [rsp + 0x202], r15b
mov byte [rsp + 0x203], 0x92
mov byte [rsp + 0x204], r12b
mov byte [rsp + 0x205], 1
mov byte [rsp + 0x206], r12b
mov byte [rsp + 0x207], 0xb
mov byte [rsp + 0x208], r12b
mov byte [rsp + 0x209], 0xc8
mov byte [rsp + 0x20a], r15b
mov byte [rsp + 0x20b], 0x93
mov byte [rsp + 0x20c], r12b
mov byte [rsp + 0x20d], 3
mov byte [rsp + 0x20e], r12b
mov byte [rsp + 0x20f], 0xc
mov byte [rsp + 0x210], r12b
mov byte [rsp + 0x211], 0xcc
mov byte [rsp + 0x212], r15b
mov byte [rsp + 0x213], 0x96
mov byte [rsp + 0x214], r12b
mov byte [rsp + 0x215], 3
mov byte [rsp + 0x216], r12b
mov byte [rsp + 0x217], 0xc
mov byte [rsp + 0x218], 1
mov byte [rsp + 0x219], 0x2b
mov byte [rsp + 0x21a], r15b
mov byte [rsp + 0x21b], 0x99
mov byte [rsp + 0x21c], r12b
mov byte [rsp + 0x21d], 3
mov byte [rsp + 0x21e], r12b
mov byte [rsp + 0x21f], 0xc
call fcn.00016ec0
lea rcx, [rsp + 0x3b0]
lea rdx, [rsp + 0x1b0]
mov r8d, 0x70
call fcn.00016fd0
mov byte [rsp + 0xb70], r12b
mov rcx, rsi
lea rdx, [rsp + 0x3b0]
mov r8d, 0x7c1
jmp 0x1ed59
cmp byte [rbp + 2], r12b
je 0x1ebf4
mov byte [rsp + 0x130], r12b
lea r9, [r14 + 1]
mov r10d, 4
nop
xor cl, cl
mov r8d, 4
nop
nop
movzx edx, word [rbp + 4]
add cl, cl
test dl, 1
je 0x1dfc2
movzx eax, word [rbp + 6]
or cl, 1
xor ax, dx
shr ax, 1
or ax, 0x8000
mov word [rbp + 4], ax
jmp 0x1dfc9
shr dx, 1
mov word [rbp + 4], dx
add cl, cl
test byte [rbp + 4], 0x80
je 0x1dfd4
or cl, 1
dec r8
jne 0x1dfa0
xor byte [r9], cl
inc r9
dec r10
jne 0x1df90
movabs rbx, 0xfffff78000000014
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x198]
mov rax, qword [rbx]
mov qword [rsp + 0x198], rax
mov rax, qword [rbp + 0x20a]
add qword [rsp + 0x198], rax
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
movzx ebx, word [r14 + 1]
test bl, bl
movzx eax, bl
jne 0x1e076
movzx ecx, byte [rsp + 0xb6]
call fcn.00013e70
movzx ecx, byte [rsp + 0xb8]
mov byte [rsp + 0x134], al
call fcn.00013e70
movzx ecx, byte [rsp + 0xba]
mov byte [rsp + 0x133], al
call fcn.00013e70
movzx r12d, bx
shr r12d, 8
mov r13b, 1
mov byte [rsp + 0x132], al
jmp 0x1ebf4
cmp eax, 3
jne 0x1e0f1
movsx ecx, word [rsp + 0xb0]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub ecx, edx
call fcn.00013e70
movzx ecx, byte [rsp + 0xbe]
mov byte [rsp + 0x135], al
call fcn.00013e70
movzx ecx, byte [rsp + 0xb2]
mov byte [rsp + 0x134], al
call fcn.00013e70
movzx ecx, byte [rsp + 0xb4]
mov byte [rsp + 0x133], al
call fcn.00013e70
movzx r12d, bx
shr r12d, 8
mov r13b, 1
mov byte [rsp + 0x132], al
jmp 0x1ebf4
movzx eax, word [r14 + 1]
movzx ecx, al
mov r8, rax
lea rdx, [rcx + rbp + 0x1d2]
lea rcx, [rsp + 0x132]
shr r8, 8
call fcn.00016fd0
movzx r12d, bx
mov r13b, 1
shr r12d, 8
jmp 0x1ebf4
cmp byte [rbp + 2], r12b
je 0x1ebf4
mov byte [rsp + 0x130], r12b
lea r9, [r14 + 1]
mov r10d, 4
xor cl, cl
mov r8d, 4
nop
nop
movzx edx, word [rbp + 4]
add cl, cl
test dl, 1
je 0x1e172
movzx eax, word [rbp + 6]
or cl, 1
xor ax, dx
shr ax, 1
or ax, 0x8000
mov word [rbp + 4], ax
jmp 0x1e179
shr dx, 1
mov word [rbp + 4], dx
add cl, cl
test byte [rbp + 4], 0x80
je 0x1e184
or cl, 1
dec r8
jne 0x1e150
xor byte [r9], cl
inc r9
dec r10
jne 0x1e141
movzx eax, byte [r14 + 1]
movzx edi, byte [r14 + 4]
mov rdx, rsi
lea rbx, [rax + rbp + 0x1d2]
mov r8, rdi
mov dword [0x00018278], eax
mov rcx, rbx
mov dword [0x00018274], edi
call fcn.00016fd0
mov r8, rbp
mov edx, edi
mov rcx, rbx
call fcn.0001b8d0
mov r8, qword [rsp + 0xd8]
mov dword [r8], r12d
jmp case.0x1d438.160
cmp byte [rbp + 2], r12b
je 0x1ebf4
cmp dword [0x00018278], 7
jl 0x1e221
lea rdx, [rbp + 0x1d2]
lea rcx, [0x00021a50]
mov r9, rbp
mov r8d, 0x38
call fcn.0001b990
test eax, eax
jne 0x1ebf4
mov byte [rsp + 0x130], r12b
jmp 0x1ebf4
movabs rbx, 0xfffff78000000014
lea rdx, [rsp + 0xa0]
mov rbx, qword [rbx]
mov rax, qword [rbp + 0x20a]
lea rcx, [rbx + rax]
mov qword [rsp + 0xe0], rcx
lea rcx, [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
cmp dword [0x00018278], r12d
jne 0x1e2b4
and byte [rbp + 0x1d2], 0x7f
movzx ecx, byte [rbp + 0x1d2]
call fcn.00013ea0
movzx ecx, byte [rbp + 0x1d3]
movzx r8d, al
mov word [rsp + 0xaa], r8w
call fcn.00013ea0
movzx ecx, byte [rbp + 0x1d4]
movzx r8d, al
mov word [rsp + 0xa8], r8w
call fcn.00013ea0
movzx r8d, al
mov word [rsp + 0xa6], r8w
jmp 0x1e31c
movzx ecx, byte [rbp + 0x1d5]
call fcn.00013ea0
movzx ecx, byte [rbp + 0x1d6]
movzx r8d, al
mov word [rsp + 0xa4], r8w
call fcn.00013ea0
movzx ecx, byte [rbp + 0x1d8]
movzx r8d, al
mov word [rsp + 0xa2], r8w
call fcn.00013ea0
movzx r8d, al
cmp r8d, 0x5a
jge 0x1e30d
add r8w, 0x7d0
mov word [rsp + 0xa0], r8w
jmp 0x1e31c
add r8w, 0x76c
mov word [rsp + 0xa0], r8w
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_RtlTimeFieldsToTime]
mov r11, qword [rsp + 0xe8]
lea rdx, [rbp + 0x20a]
sub r11, rbx
lea rcx, [0x00021a70]
mov r9, rbp
mov r8d, 8
mov qword [rbp + 0x20a], r11
call fcn.0001b990
test eax, eax
jne 0x1ebf4
mov byte [rsp + 0x130], r12b
jmp 0x1ebf4
cmp byte [rbp + 2], r12b
je 0x1ebf4
mov eax, dword [rbx]
lea r9, [r14 + 1]
mov r10d, 4
mov dword [rbp + 0x122e], eax
xor cl, cl
mov r8d, 4
nop
nop
movzx edx, word [rbp + 4]
add cl, cl
test dl, 1
je 0x1e3c2
movzx eax, word [rbp + 6]
or cl, 1
xor ax, dx
shr ax, 1
or ax, 0x8000
mov word [rbp + 4], ax
jmp 0x1e3c9
shr dx, 1
mov word [rbp + 4], dx
add cl, cl
test byte [rbp + 4], 0x80
je 0x1e3d4
or cl, 1
dec r8
jne 0x1e3a0
xor byte [r9], cl
inc r9
dec r10
jne 0x1e391
mov edx, dword [rbp + 0x122e]
mov r8, rbp
mov rcx, rsi
call fcn.0001b8d0
cmp word [r14 + 1], 3
seta al
mov byte [rbp + 0x1232], al
cmp word [r14 + 1], 7
jae 0x1e413
movzx eax, byte [r14 + 1]
jmp 0x1e418
mov eax, 8
mov byte [rbp + 0x1233], al
xor eax, eax
lea rcx, [rbp + 0x1234]
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
movsxd rax, dword [rbp + 0x122e]
cmp eax, 0x30
jb 0x1e44f
mov eax, 0x30
mov r8, rax
mov rdx, rsi
call fcn.00016fd0
call fcn.00014020
jmp case.0x1d438.160
cmp byte [rbp + 2], r12b
je 0x1ebf4
call fcn.00014020
movsxd rbx, dword [rbp + 0x122e]
xor r11d, r11d
xor eax, eax
lea rdx, [rbp + 0x1234]
lea rcx, [rsp + 0x168]
mov r8, rbx
mov qword [rsp + 0x260], r11
mov qword [rsp + 0x268], r11
mov qword [rsp + 0x270], r11
mov qword [rsp + 0x278], r11
mov qword [rsp + 0x280], r11
mov qword [rsp + 0x288], r11
mov qword [rsp + 0x168], rax
mov qword [rsp + 0x170], rax
mov qword [rsp + 0x178], rax
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x188], rax
mov qword [rsp + 0x190], rax
call fcn.00016fd0
lea rdx, [rbp + 0x1234]
lea rcx, [rsp + 0x260]
mov r8, rbx
call fcn.00016fd0
cmp byte [rbp + 0x1232], r12b
jne 0x1e547
lea rax, [0x00021c70]
lea r9, [rbp + 0x1264]
lea r8, str.RegistryMACHINESystemCurrentControlSetMultiKeyDumps
lea rdx, [0x00021c50]
lea rcx, [rsp + 0x2b0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_swprintf]
jmp 0x1e576
lea rax, [0x00021c40]
lea r9, [rbp + 0x1264]
lea r8, str.RegistryMACHINESystemCurrentControlSetMultiKeyDumps
lea rdx, [0x00021c50]
lea rcx, [rsp + 0x2b0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_swprintf]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x120]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov eax, 0x30
lea r8, [rsp + 0xf0]
mov dword [rsp + 0xf0], eax
lea rax, [rsp + 0x120]
lea rcx, [rsp + 0xd0]
mov edx, 0x20019
mov qword [rsp + 0xf8], r12
mov dword [rsp + 0x108], 0x40
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x110], r12
mov qword [rsp + 0x118], r12
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x1e985
lea rcx, [rsp + 0x2b0]
xor edx, edx
mov r8d, 0x100
call fcn.00016ec0
mov r11d, dword [rbp + 0x122e]
cmp r11d, 0x10
je 0x1e842
cmp r11d, 0x20
je 0x1e735
cmp r11d, 0x30
jne 0x1e94a
movzx eax, byte [rsp + 0x177]
movzx ecx, byte [rsp + 0x176]
movzx edx, byte [rsp + 0x175]
movzx r8d, byte [rsp + 0x174]
movzx r10d, byte [rsp + 0x173]
movzx r11d, byte [rsp + 0x172]
movzx ebx, byte [rsp + 0x171]
movzx esi, byte [rsp + 0x170]
movzx ebp, byte [rsp + 0x16f]
movzx r12d, byte [rsp + 0x16e]
movzx r13d, byte [rsp + 0x16d]
movzx r14d, byte [rsp + 0x16c]
movzx r15d, byte [rsp + 0x16b]
movzx r9d, byte [rsp + 0x168]
mov dword [rsp + 0x90], eax
movzx eax, byte [rsp + 0x16a]
mov dword [rsp + 0x88], ecx
mov dword [rsp + 0x80], edx
mov dword [rsp + 0x78], r8d
mov dword [rsp + 0x70], r10d
mov dword [rsp + 0x68], r11d
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], eax
movzx eax, byte [rsp + 0x169]
lea r8, [0x00021c30]
lea rdx, [0x00021ba0]
lea rcx, [rsp + 0x2b0]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_swprintf]
mov rbp, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
xor r12d, r12d
lea r15d, [r12 + 2]
jmp 0x1e94a
movzx eax, byte [rsp + 0x177]
movzx ecx, byte [rsp + 0x176]
movzx edx, byte [rsp + 0x175]
movzx r8d, byte [rsp + 0x174]
movzx r10d, byte [rsp + 0x173]
movzx r11d, byte [rsp + 0x172]
movzx ebx, byte [rsp + 0x171]
movzx esi, byte [rsp + 0x170]
movzx ebp, byte [rsp + 0x16f]
movzx r12d, byte [rsp + 0x16e]
movzx r13d, byte [rsp + 0x16d]
movzx r14d, byte [rsp + 0x16c]
movzx r15d, byte [rsp + 0x16b]
movzx r9d, byte [rsp + 0x168]
mov dword [rsp + 0x90], eax
movzx eax, byte [rsp + 0x16a]
mov dword [rsp + 0x88], ecx
mov dword [rsp + 0x80], edx
mov dword [rsp + 0x78], r8d
mov dword [rsp + 0x70], r10d
mov dword [rsp + 0x68], r11d
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], eax
movzx eax, byte [rsp + 0x169]
lea r8, [0x00021b90]
lea rdx, [0x00021ba0]
lea rcx, [rsp + 0x2b0]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_swprintf]
mov rbp, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
xor r12d, r12d
lea r15d, [r12 + 2]
jmp 0x1e94a
movzx eax, byte [rsp + 0x177]
movzx ecx, byte [rsp + 0x176]
movzx edx, byte [rsp + 0x175]
movzx r8d, byte [rsp + 0x174]
movzx r10d, byte [rsp + 0x173]
movzx r11d, byte [rsp + 0x172]
movzx ebx, byte [rsp + 0x171]
movzx esi, byte [rsp + 0x170]
movzx ebp, byte [rsp + 0x16f]
movzx r12d, byte [rsp + 0x16e]
movzx r13d, byte [rsp + 0x16d]
movzx r14d, byte [rsp + 0x16c]
movzx r15d, byte [rsp + 0x16b]
movzx r9d, byte [rsp + 0x168]
mov dword [rsp + 0x90], eax
movzx eax, byte [rsp + 0x16a]
mov dword [rsp + 0x88], ecx
mov dword [rsp + 0x80], edx
mov dword [rsp + 0x78], r8d
mov dword [rsp + 0x70], r10d
mov dword [rsp + 0x68], r11d
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], eax
movzx eax, byte [rsp + 0x169]
lea r8, [0x00021b80]
lea rdx, [0x00021ba0]
lea rcx, [rsp + 0x2b0]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_swprintf]
mov rbp, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
xor r12d, r12d
lea r15d, [r12 + 2]
mov rcx, qword [rsp + 0xd0]
lea r8, [rsp + 0x168]
lea rdx, [rsp + 0x2b0]
mov r9d, 0x10
call fcn.00013f00
mov rcx, qword [rsp + 0xd0]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
jns case.0x1e9a6.3
movzx eax, byte [rbp + 0x1233]
cmp eax, 6
ja case.0x1e9a6.3
lea rdx, [0x00010000]
mov ecx, dword [rdx + rax*4 + 0xee7c]
add rcx, rdx
jmp rcx
lea rdx, [rbp + 0x128c]
lea rcx, [rsp + 0x1b0]
mov r8d, 0x80
call fcn.00014050
lea r9, [rsp + 0x168]
lea r8, [rsp + 0x260]
lea rcx, [rsp + 0x1b0]
mov edx, 0xa
call fcn.000147d0
jmp case.0x1e9a6.3
lea rdx, [rbp + 0x128c]
lea rcx, [rsp + 0x1b0]
mov r8d, 0x80
call fcn.00014050
lea r9, [rsp + 0x168]
lea r8, [rsp + 0x260]
lea rcx, [rsp + 0x1b0]
mov edx, 0xa
call fcn.000147d0
mov ecx, 0x10
nop
nop
movzx eax, byte [rsp + r12 + 0x270]
inc r12
xor byte [rsp + r12 + 0x167], al
dec rcx
jne 0x1ea30
jmp case.0x1e9a6.3
lea rdx, [rbp + 0x128c]
lea rcx, [rsp + 0x1b0]
mov r8d, 0x80
call fcn.00014050
lea r9, [rsp + 0x168]
lea r8, [rsp + 0x260]
lea rcx, [rsp + 0x1b0]
mov edx, 0xa
call fcn.000147d0
mov r11, r12
mov ecx, 0x10
movzx eax, byte [rsp + r11 + 0x270]
inc r11
xor byte [rsp + r11 + 0x167], al
dec rcx
jne 0x1ea92
mov ecx, 0x10
movzx eax, byte [rsp + r12 + 0x280]
inc r12
xor byte [rsp + r12 + 0x167], al
dec rcx
jne 0x1eab0
jmp case.0x1e9a6.3
lea rdx, [rbp + 0x128c]
lea rcx, [rsp + 0x1b0]
mov r8d, 0x80
call fcn.000145a0
lea r9, [rsp + 0x168]
lea r8, [rsp + 0x260]
lea rcx, [rsp + 0x1b0]
mov edx, 0xa
call fcn.00015930
jmp case.0x1e9a6.3
mov ecx, 0x10
movzx eax, byte [rsp + r12 + 0x270]
inc r12
xor byte [rsp + r12 + 0x167], al
dec rcx
jne 0x1eb14
jmp case.0x1e9a6.3
lea rcx, [rsp + 0x260]
mov edx, 0x10
nop
movzx eax, byte [rcx + 0x10]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x1eb40
lea rcx, [rsp + 0x260]
mov edx, 0x10
nop
movzx eax, byte [rcx + 0x20]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x1eb60
lea rdx, [rbp + 0x128c]
lea rcx, [rsp + 0x1b0]
mov r8d, 0x80
call fcn.000145a0
lea r9, [rsp + 0x168]
lea r8, [rsp + 0x260]
lea rcx, [rsp + 0x1b0]
mov edx, 0xa
call fcn.00015930
movsxd r8, dword [rbp + 0x122e]
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x132]
mov byte [rsp + 0x130], 0
call fcn.00016fd0
mov r12d, 0x10
mov r13b, 1
jmp 0x1ebf4
movzx eax, byte [rsp + 0x130]
cmp byte [rbp + 2], r12b
mov dword [rbx], r12d
cmovne eax, r12d
mov byte [rsp + 0x130], al
xor byte [rbp + 3], dil
cmp byte [rsp + 0x130], 0x1f
ja 0x1ec2c
inc byte [rbp + 3]
movzx ecx, byte [r14]
movzx ebx, byte [rbp + 3]
lea r8, [rsp + 0x130]
and cl, 0x7f
mov dl, 2
mov byte [rsp + 0x131], bl
call fcn.00013db0
test eax, eax
je 0x1ec02
jmp 0x1ec33
mov bl, byte [rsp + 0x131]
movzx r11d, byte [rsp + 0x130]
lea r9, [rsp + 0x130]
nop
nop
nop
xor cl, cl
mov r8d, 4
nop
nop
movzx edx, word [rbp + 4]
add cl, cl
test dl, 1
je 0x1ec82
movzx eax, word [rbp + 6]
or cl, 1
xor ax, dx
shr ax, 1
or ax, 0x8000
mov word [rbp + 4], ax
jmp 0x1ec89
shr dx, 1
mov word [rbp + 4], dx
add cl, cl
test byte [rbp + 4], 0x80
je 0x1ec94
or cl, 1
dec r8
jne 0x1ec60
xor byte [r9], cl
inc r9
dec r15
jne 0x1ec50
test r13b, r13b
je 0x1ed14
test r12d, r12d
lea r9, [rsp + 0x132]
je 0x1ed14
test r12d, r12d
je 0x1ed14
mov r10d, r12d
nop
xor cl, cl
mov r8d, 4
nop
nop
movzx edx, word [rbp + 4]
add cl, cl
test dl, 1
je 0x1ecf2
movzx eax, word [rbp + 6]
or cl, 1
xor ax, dx
shr ax, 1
or ax, 0x8000
mov word [rbp + 4], ax
jmp 0x1ecf9
shr dx, 1
mov word [rbp + 4], dx
add cl, cl
test byte [rbp + 4], 0x80
je 0x1ed04
or cl, 1
dec r8
jne 0x1ecd0
xor byte [r9], cl
inc r9
dec r10
jne 0x1ecc0
test r11b, r11b
jne 0x1ed2a
and word [rbp + 6], 0xff
movzx eax, bl
shl ax, 8
or word [rbp + 6], ax
mov r8, qword [rsp + 0xd8]
mov eax, r12d
lea rdx, [rsp + 0x130]
mov ecx, dword [r8]
add rax, 2
cmp rax, rcx
cmovb rcx, rax
mov dword [r8], ecx
mov r8d, ecx
mov rcx, qword [rsp + 0x1a0]
call fcn.00016fd0
mov r15, qword [rsp + 0xb98]
mov r14, qword [rsp + 0xba0]
mov r13, qword [rsp + 0xba8]
mov r12, qword [rsp + 0xbb0]
mov rdi, qword [rsp + 0xbb8]
mov rsi, qword [rsp + 0xbc0]
mov rbp, qword [rsp + 0xbc8]
mov rbx, qword [rsp + 0xbd0]
mov rcx, qword [rsp + 0xb80]
call fcn.00017320
add rsp, 0xbd8
ret