Function at 0x140001e30
Capabilities:
Check for debugger via api
Check for process debug object
Check processdebugflags
Check processdebugport

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2d8
movdqa xmmword [rsp + 0x2c0], xmm11
movdqa xmmword [rsp + 0x2b0], xmm10
movdqa xmmword [rsp + 0x2a0], xmm9
movaps xmmword [rsp + 0x290], xmm8
movdqa xmmword [rsp + 0x280], xmm7
movdqa xmmword [rsp + 0x270], xmm6
call fcn.140093990
mov rsi, rax
mov edi, edx
mov ecx, 0x23
xor edx, edx
call fcn.140089c00
call fcn.140093990
mov qword [rsp + 0x1c8], rax
mov dword [rsp + 0x1d0], edx
mov qword [rsp + 0xa0], rsi
mov dword [rsp + 0xa8], edi
lea rcx, [rsp + 0x1c8]
lea rdx, [rsp + 0xa0]
call fcn.140093a70
cmp edx, 0x3b9aca00
je 0x1400044a5
cmp rax, 0x19
jb 0x1400044a5
lea rcx, [rsp + 0xa0]
call fcn.1400e8460
cmp byte [rsp + 0xa0], 0x12
jne 0x140003f11
lea rcx, [rsp + 0xa0]
call fcn.1400e8460
cmp byte [rsp + 0xa0], 0x12
jne 0x140003f11
lea rax, [0x1401d4449]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0x185b17d36e07a3a3
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.140095350
movabs rcx, 0x87cf73d0e44c1a53
xor rcx, qword [rax]
movabs rdx, 0x9146e7a05f1da64a
xor rdx, qword [rax + 8]
mov r8d, 0xfbeaee59
xor r8d, dword [rax + 0x10]
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rdx
mov dword [rsp + 0xb0], r8d
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0xa0]
mov r8d, 0x14
call fcn.1400e8500
movzx eax, byte [rsp + 0x38]
cmp rax, 0x12
ja case.0x140001fca.154
lea rcx, [0x1401b1060]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
cmp qword [rsp + 0x40], 0
je case.0x140001fca.160
lea rax, [rsp + 0x48]
mov r8, qword [rax]
mov rcx, qword [0x1402540f8]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov bpl, 1
lea rdx, [0x140210be0]
lea rcx, [rsp + 0xa0]
mov r8d, 0xa
call fcn.1400e8500
cmp byte [rsp + 0xa0], 0x12
jne 0x140003f11
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x238], rax
movzx eax, byte [0x140254141]
mov edx, 0xd8
xor ecx, ecx
call fcn.14008bd10
mov qword [rsp + 0x250], rax
test rax, rax
je 0x140003f11
lea rax, [0x1401d5069]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0xc4cdd2f74626acc
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.1400952c0
mov rsi, qword [rax]
mov rdi, qword [rax + 8]
mov r14, qword [rax + 0x10]
mov r15, qword [rax + 0x18]
movzx ebx, byte [rax + 0x20]
movzx eax, byte [0x140254141]
mov edx, 0x21
xor ecx, ecx
call fcn.14008bd10
test rax, rax
je 0x140003f11
mov r13, rax
mov byte [rsp + 0x37], bpl
xor bl, 0xed
movabs rax, 0x4090a09bc7fbc006
xor rsi, rax
movabs rax, 0x4b72e77cc4feb19a
xor rdi, rax
movabs rax, 0x96b62fe5e430faf2
xor r14, rax
movabs rax, 0xd14a0cb3a1e6e40
xor r15, rax
mov qword [r13], rsi
mov qword [r13 + 8], rdi
mov qword [r13 + 0x10], r14
mov qword [r13 + 0x18], r15
mov byte [r13 + 0x20], bl
lea rax, [0x1401d2e3d]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0xe88e8bea07c5f9b5
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.140095800
mov rbx, qword [rax]
mov rdi, qword [rax + 8]
mov rsi, qword [rax + 0x10]
movzx eax, byte [0x140254141]
mov edx, 0x18
xor ecx, ecx
call fcn.14008bd10
test rax, rax
je 0x140003f11
mov r14, rax
movabs rax, 0xa1845b5c4a1750da
xor rsi, rax
movabs rax, 0x204721a33c7025a1
xor rdi, rax
movabs rax, 0x29108990dcd341e7
xor rbx, rax
mov qword [r14], rbx
mov qword [r14 + 8], rdi
mov qword [r14 + 0x10], rsi
lea rax, [0x1401d2af2]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0x34130ebb97be5998
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.140094c80
mov r12, qword [rax]
mov r15, qword [rax + 8]
mov rbx, qword [rax + 0x10]
mov rsi, qword [rax + 0x18]
movzx edi, word [rax + 0x20]
movzx ebp, byte [rax + 0x22]
movzx eax, byte [0x140254141]
mov edx, 0x23
xor ecx, ecx
call fcn.14008bd10
test rax, rax
je 0x140003f11
mov qword [rsp + 0x90], r14
shl ebp, 0x10
or edi, ebp
mov r8d, edi
shr r8d, 0x10
xor r8b, 0x2d
mov ecx, edi
xor cl, 0x87
shr edi, 8
xor dil, 0xc4
movzx ecx, cl
movzx edx, dil
shl edx, 8
or edx, ecx
movabs rcx, 0xc8433fbdd07a1577
xor rsi, rcx
movabs rcx, 0x8c1e45c421cd0d75
xor rbx, rcx
movabs rcx, 0x94321c0c45ba4bef
xor r15, rcx
movabs rcx, 0x7e7705623bf63f2b
xor r12, rcx
mov qword [rax], r12
mov qword [rax + 8], r15
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov word [rax + 0x20], dx
mov qword [rsp + 0x58], rax
mov byte [rax + 0x22], r8b
lea rax, [0x1401c7bd0]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0xf0d7e7932459e575
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.140095230
mov rbx, qword [rax]
mov rdi, qword [rax + 8]
mov esi, dword [rax + 0x10]
movzx ebp, word [rax + 0x14]
movzx eax, byte [0x140254141]
mov edx, 0x16
xor ecx, ecx
call fcn.14008bd10
test rax, rax
je 0x140003f11
mov r12, rax
mov qword [rsp + 0x98], r13
mov eax, ebp
xor al, 0xc6
shr ebp, 8
xor bpl, 0x29
movzx ecx, bpl
shl ecx, 8
movzx eax, al
or eax, ecx
xor esi, 0x8ba8e2fd
movabs rcx, 0xdf233595f18f7c31
xor rdi, rcx
movabs rcx, 0xcb734f5da24310d1
xor rbx, rcx
mov qword [r12], rbx
mov qword [r12 + 8], rdi
mov dword [r12 + 0x10], esi
mov word [r12 + 0x14], ax
lea rax, [0x1401cbc34]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0x8b784038a1a9eb12
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.1400953d0
mov rbx, qword [rax]
mov r14, qword [rax + 8]
mov rsi, qword [rax + 0x10]
mov rdi, qword [rax + 0x18]
movzx eax, byte [0x140254141]
mov edx, 0x20
xor ecx, ecx
call fcn.14008bd10
test rax, rax
je 0x140003f11
movq xmm0, r14
movq xmm1, rbx
punpcklqdq xmm1, xmm0
pxor xmm1, xmmword [0x1401b1020]
movq xmm0, rdi
movq xmm2, rsi
punpcklqdq xmm2, xmm0
pxor xmm2, xmmword [0x1401b1030]
movdqu xmmword [rax + 0x10], xmm2
mov qword [rsp + 0x230], rax
movdqu xmmword [rax], xmm1
lea rax, [0x1401cd9d3]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0x667303b05389e7fe
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.140095830
mov rdi, qword [rax]
mov rbp, qword [rax + 8]
mov rbx, qword [rax + 0x10]
mov esi, dword [rax + 0x18]
movzx r15d, word [rax + 0x1c]
movzx r14d, byte [rax + 0x1e]
movzx eax, byte [0x140254141]
mov edx, 0x1f
xor ecx, ecx
call fcn.14008bd10
test rax, rax
je 0x140003f11
mov r13, rax
mov qword [rsp + 0x228], r12
shl r14d, 0x10
or r15d, r14d
mov eax, r15d
shr eax, 0x10
xor al, 8
mov ecx, r15d
xor cl, 1
shr r15d, 8
xor r15b, 0x65
movzx ecx, cl
movzx edx, r15b
shl edx, 8
or edx, ecx
xor esi, 0x17423a1
movabs rcx, 0x69a5f8dec86278a5
xor rbx, rcx
movabs rcx, 0xddd160e30d8cbd9c
xor rbp, rcx
movabs rcx, 0xe93ec6ed4d977e60
xor rdi, rcx
mov qword [r13], rdi
mov qword [r13 + 8], rbp
mov qword [r13 + 0x10], rbx
mov dword [r13 + 0x18], esi
mov word [r13 + 0x1c], dx
mov byte [r13 + 0x1e], al
lea rax, [0x1401d1533]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0xc18287ad0105d3d0
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.140094e90
mov rbx, qword [rax]
mov r14, qword [rax + 8]
mov rsi, qword [rax + 0x10]
mov rdi, qword [rax + 0x18]
movzx eax, byte [0x140254141]
mov edx, 0x20
xor ecx, ecx
call fcn.14008bd10
test rax, rax
je 0x140003f11
mov rbp, rax
movq xmm0, r14
movq xmm1, rbx
punpcklqdq xmm1, xmm0
pxor xmm1, xmmword [0x1401b1040]
movq xmm0, rdi
movq xmm2, rsi
punpcklqdq xmm2, xmm0
pxor xmm2, xmmword [0x1401b1050]
movdqu xmmword [rax + 0x10], xmm2
movdqu xmmword [rax], xmm1
lea rax, [0x1401d39ea]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0x79d8d66da3c1e841
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.140095390
mov rsi, qword [rax]
mov rdi, qword [rax + 8]
mov r12, qword [rax + 0x10]
mov r15, qword [rax + 0x18]
movzx r14d, word [rax + 0x20]
movzx eax, byte [0x140254141]
mov edx, 0x22
xor ecx, ecx
call fcn.14008bd10
test rax, rax
je 0x140003f11
mov rbx, rax
mov eax, r14d
xor al, 0x87
shr r14d, 8
xor r14b, 0xd4
movzx ecx, r14b
shl ecx, 8
movzx eax, al
or eax, ecx
movabs rcx, 0x4875200174c1a401
xor rsi, rcx
movabs rcx, 0x8aebbf4362dbb15b
xor rdi, rcx
movabs rcx, 0x66b65a815d779982
xor r12, rcx
movabs rcx, 0xc9dfc0801123a232
xor r15, rcx
mov qword [rbx], rsi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r15
mov word [rbx + 0x20], ax
lea rax, [0x1401cd972]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0xe40b928deea28cf1
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.140094f90
mov r14, qword [rax]
mov r12, qword [rax + 8]
mov r15, qword [rax + 0x10]
mov edi, dword [rax + 0x18]
movzx esi, byte [rax + 0x1c]
movzx eax, byte [0x140254141]
mov edx, 0x1d
xor ecx, ecx
call fcn.14008bd10
test rax, rax
je 0x140003f11
movabs rcx, 0x80125414041462b5
xor r15, rcx
movabs rcx, 0x816b3399f3210df6
xor r12, rcx
movabs rcx, 0x29a078604a95675f
xor r14, rcx
mov qword [rax], r14
mov qword [rax + 8], r12
mov qword [rax + 0x10], r15
xor edi, 0x98869adc
mov dword [rax + 0x18], edi
xor sil, 0x72
mov byte [rax + 0x1c], sil
mov rdi, qword [rsp + 0x250]
mov qword [rdi], 0x21
mov rcx, qword [rsp + 0x98]
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], 0x21
mov qword [rdi + 0x18], 0x18
mov rcx, qword [rsp + 0x90]
mov qword [rdi + 0x20], rcx
mov qword [rdi + 0x28], 0x18
mov qword [rdi + 0x30], 0x23
mov rcx, qword [rsp + 0x58]
mov qword [rdi + 0x38], rcx
mov qword [rdi + 0x40], 0x23
mov qword [rdi + 0x48], 0x16
mov rcx, qword [rsp + 0x228]
mov qword [rdi + 0x50], rcx
mov qword [rdi + 0x58], 0x16
mov qword [rdi + 0x60], 0x20
mov rcx, qword [rsp + 0x230]
mov qword [rdi + 0x68], rcx
mov qword [rdi + 0x70], 0x20
mov qword [rdi + 0x78], 0x1f
mov qword [rdi + 0x80], r13
mov qword [rdi + 0x88], 0x1f
mov qword [rdi + 0x90], 0x20
mov qword [rdi + 0x98], rbp
mov qword [rdi + 0xa0], 0x20
mov qword [rdi + 0xa8], 0x22
mov qword [rdi + 0xb0], rbx
mov qword [rdi + 0xb8], 0x22
mov qword [rdi + 0xc0], 0x1d
mov qword [rdi + 0xc8], rax
mov qword [rdi + 0xd0], 0x1d
mov r12, rdi
add r12, 0x20
mov esi, 0xc0
xor eax, eax
lea r14, [rsp + 0xa0]
nop word cs:[rax + rax]
lea rdx, [rax + 0x18]
mov r8, qword [rdi + rax]
movabs rcx, 0x8000000000000000
cmp r8, rcx
je 0x140002c5a
mov r15, qword [rdi + rax + 8]
mov r13, qword [rdi + rax + 0x10]
test r13, r13
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x98], r8
je 0x1400028e0
js 0x140003f11
movzx eax, byte [0x140254141]
xor ecx, ecx
mov rdx, r13
call fcn.14008bd10
mov rbx, rax
test rax, rax
jne 0x1400028e5
jmp 0x140003f11
mov ebx, 1
mov rcx, rbx
mov qword [rsp + 0x230], r15
mov rdx, r15
mov r8, r13
call sub.msvcrt.dll_memcpy
mov edx, 3
lea rcx, str.WQLIWbemClassWrapperinner
call fcn.1400e4ad0
mov rsi, rax
mov rcx, rbx
mov rdx, r13
call fcn.1400e4ad0
mov rbp, rax
mov rdx, qword [rsp + 0x238]
mov rcx, r14
mov r8, rsi
mov r9, rax
call fcn.140098620
mov r14, qword [rsp + 0xa0]
mov r15, qword [rsp + 0xa8]
test r14, r14
je 0x140002a50
test r15, r15
je 0x14000295a
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x10]
test rbp, rbp
je 0x140002967
mov rcx, rbp
call sub.oleaut32.dll_SysFreeString
xor edi, edi
mov ebp, 0
test rsi, rsi
je 0x14000297d
mov rcx, rsi
call sub.oleaut32.dll_SysFreeString
mov ebp, edi
test r13, r13
je 0x140002993
mov rcx, qword [0x1402540f8]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov edi, 1
test r14, r14
je 0x140002a80
cmp bpl, 0x12
jne 0x140003f11
test r14, r14
mov r13, qword [rsp + 0x98]
je 0x1400029d1
mov rsi, r15
mov rbx, r14
nop
mov rcx, rsi
call fcn.140095e40
add rsi, 0x30
dec rbx
jne 0x1400029c0
test rdi, rdi
je 0x1400029e7
mov rcx, qword [0x1402540f8]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
test r13, r13
mov rdi, qword [rsp + 0x250]
mov rsi, qword [rsp + 0x90]
je 0x140002a12
mov rcx, qword [0x1402540f8]
xor edx, edx
mov r8, qword [rsp + 0x230]
call sub.KERNEL32.dll_HeapFree
test r14, r14
mov rcx, qword [rsp + 0x58]
je 0x140002c8a
add rsi, 0xffffffffffffffe8
add r12, 0x18
mov rax, rcx
cmp rcx, 0xd8
lea r14, [rsp + 0xa0]
jne 0x140002870
jmp 0x140002c67
test rbp, rbp
je 0x140002a5d
mov rcx, rbp
call sub.oleaut32.dll_SysFreeString
mov dil, 0x12
mov bpl, 0x12
test rsi, rsi
jne 0x140002973
jmp 0x14000297d
mov byte [rsp + 0x60], 0x12
lea rcx, [rsp + 0x1c8]
mov rdx, r15
lea r14, [rsp + 0x60]
mov r8, r14
call fcn.14009b310
cmp qword [rsp + 0x1c8], 0
je 0x140002bc7
movzx eax, byte [0x140254141]
mov edx, 0xc0
xor ecx, ecx
call fcn.14008bd10
test rax, rax
lea rdi, [rsp + 0xa0]
je 0x140003f11
mov rbx, rax
movdqu xmm0, xmmword [rsp + 0x1c8]
movdqu xmm1, xmmword [rsp + 0x1d8]
movdqu xmm2, xmmword [rsp + 0x1e8]
movdqu xmmword [rax + 0x20], xmm2
movdqu xmmword [rax + 0x10], xmm1
movdqu xmmword [rax], xmm0
mov qword [rsp + 0x38], 4
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
mov r13d, 1
mov esi, 0x30
jmp 0x140002b58
movdqu xmm0, xmmword [rsp + 0xa0]
movdqu xmm1, xmmword [rsp + 0xb0]
movdqu xmm2, xmmword [rsp + 0xc0]
movdqu xmmword [rbx + rsi + 0x20], xmm2
movdqu xmmword [rbx + rsi + 0x10], xmm1
movdqu xmmword [rbx + rsi], xmm0
inc r13
mov qword [rsp + 0x48], r13
add rsi, 0x30
mov rcx, rdi
mov rdx, r15
mov r8, r14
call fcn.14009b310
cmp qword [rsp + 0xa0], 0
je 0x140002ba0
cmp r13, qword [rsp + 0x38]
jne 0x140002b20
mov r8d, 1
lea rcx, [rsp + 0x38]
mov rdx, r13
call fcn.1400983d0
mov rbx, qword [rsp + 0x40]
jmp 0x140002b20
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x10]
mov rdi, qword [rsp + 0x38]
movzx ebp, byte [rsp + 0x60]
cmp bpl, 0x12
jne 0x140002bee
mov bpl, 0x12
mov r15, rbx
mov r14, r13
jmp 0x1400029a1
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x10]
movzx ebp, byte [rsp + 0x60]
cmp bpl, 0x12
jne 0x140002c46
mov r15d, 8
mov bpl, 0x12
xor edi, edi
xor r14d, r14d
jmp 0x1400029a1
mov qword [rsp + 0x228], rdi
mov rdi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
test r13, r13
je 0x140002c21
mov rsi, rbx
nop dword [rax]
mov rcx, rsi
call fcn.140095e40
add rsi, 0x30
dec r13
jne 0x140002c10
cmp qword [rsp + 0x228], 0
je 0x1400029a1
mov rcx, qword [0x1402540f8]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
jmp 0x1400029a1
mov rdi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
jmp 0x1400029a1
cmp rdx, 0xd8
jne 0x14000365e
mov rcx, qword [0x1402540f8]
xor esi, esi
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [rsp + 0x238]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x140002cb9
cmp rcx, 0xd8
jne 0x1400036a9
mov rcx, qword [0x1402540f8]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [rsp + 0x238]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov sil, 1
lea rdx, [0x140210be0]
lea rcx, [rsp + 0xa0]
mov r8d, 0xa
call fcn.1400e8500
cmp byte [rsp + 0xa0], 0x12
jne 0x140003f11
mov dword [rsp + 0x90], esi
mov rsi, qword [rsp + 0xa8]
mov qword [rsp + 0x60], rsi
lea rax, [0x1401c660d]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0xcd73059b58e32273
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.140094cc0
movabs rcx, 0xaf8061b1d0cc3870
xor rcx, qword [rax]
movabs rdx, 0x8cffbe02d5741d2a
xor rdx, qword [rax + 8]
movabs r8, 0xb2cccefd1cc7b03d
xor r8, qword [rax + 0x10]
movabs r9, 0xb39cf2b5497c15f4
xor r9, qword [rax + 0x18]
movabs r10, 0x645db6749482ce50
xor r10, qword [rax + 0x20]
mov r11d, 0x80f8b89d
xor r11d, dword [rax + 0x28]
movzx eax, byte [rax + 0x2c]
xor al, 0x68
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0xb0], r8
mov qword [rsp + 0xb8], r9
mov qword [rsp + 0xc0], r10
mov dword [rsp + 0xc8], r11d
mov byte [rsp + 0xcc], al
lea rcx, [rsp + 0x1c8]
lea rdx, [rsp + 0x60]
lea r8, [rsp + 0xa0]
mov r9d, 0x2d
call fcn.14009aca0
cmp byte [rsp + 0x1c8], 0x12
jne 0x140003f11
mov r14, qword [rsp + 0x1d0]
mov rdi, qword [rsp + 0x1d8]
mov r15, qword [rsp + 0x1e0]
test r15, r15
je 0x140002ef3
lea rax, [r15 + r15*2]
shl rax, 4
add rax, rdi
mov rcx, rdi
jmp 0x140002e39
cmp rcx, rax
je 0x1400036f9
mov rdx, qword [rcx]
mov r8, qword [rcx + 0x18]
add rcx, 0x30
movdqa xmm0, xmmword [rdx]
pmovmskb r10d, xmm0
not r10d
lea r9, [rdx + 0x10]
nop word cs:[rax + rax]
test r8, r8
je 0x140002e30
test r10w, r10w
jne 0x140002e91
nop dword [rax + rax]
movdqa xmm0, xmmword [r9]
pmovmskb r10d, xmm0
add rdx, 0xfffffffffffffc80
add r9, 0x10
cmp r10d, 0xffff
je 0x140002e70
not r10d
tzcnt r11d, r10d
neg r11
imul r11, r11, 0x38
add r11, rdx
mov rbx, r11
add rbx, 0xffffffffffffffe0
je 0x140002e30
lea ebp, [r10 - 1]
and ebp, r10d
mov r10d, ebp
dec r8
cmp byte [rbx], 0xc
jne 0x140002e60
mov r11d, dword [r11 - 0x1c]
and r11d, 0xfffffffe
cmp r11d, 2
jne 0x140002e60
mov al, 1
mov dword [rsp + 0x58], eax
test r15, r15
je 0x140002efb
mov rbx, rdi
nop word [rax + rax]
mov rcx, rbx
call fcn.140095e40
add rbx, 0x30
dec r15
jne 0x140002ee0
jmp 0x140002efb
mov dword [rsp + 0x58], 0
test r14, r14
je 0x140002f16
mov rcx, qword [0x1402540f8]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rsi, qword [rsp + 0x60]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
lea rdx, [0x140210be0]
lea rcx, [rsp + 0xa0]
mov r8d, 0xa
call fcn.1400e8500
cmp byte [rsp + 0xa0], 0x12
jne 0x140003f11
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x258], rax
lea rax, [0x1401c9346]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0xb867db8c2d99b85c
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.140094f70
movabs rcx, 0xf683a6ef03b442fa
xor rcx, qword [rax]
movabs rdx, 0xdab86a93c99effc0
xor rdx, qword [rax + 8]
movabs r8, 0x814d79cf2aa64da6
xor r8, qword [rax + 0x10]
mov r9d, 0xe0e55055
xor r9d, dword [rax + 0x18]
movzx eax, word [rax + 0x1c]
mov r10d, eax
xor r10b, 0x62
shr eax, 8
xor al, 0x71
movzx r10d, r10b
movzx eax, al
shl eax, 8
or eax, r10d
mov qword [rsp + 0x1c8], rcx
mov qword [rsp + 0x1d0], rdx
mov qword [rsp + 0x1d8], r8
mov dword [rsp + 0x1e0], r9d
mov word [rsp + 0x1e4], ax
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x258]
lea r8, [rsp + 0x1c8]
mov r9d, 0x1e
call fcn.14009aca0
cmp byte [rsp + 0xa0], 0x12
jne 0x140003f11
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xb8]
lea rax, [rbp*2]
add rax, rbp
shl rax, 4
add rax, rdi
mov qword [rsp + 0x1c8], rdi
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x1d8], 0
mov qword [rsp + 0x200], 0
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x1c8]
call fcn.140097f80
movabs rax, 0x8000000000000000
cmp qword [rsp + 0x38], rax
jne 0x1400030cb
mov r14d, 8
xor r15d, r15d
xor ebx, ebx
jmp 0x140003228
mov qword [rsp + 0x98], r12
movzx eax, byte [0x140254141]
mov edx, 0x60
xor ecx, ecx
call fcn.14008bd10
test rax, rax
je 0x140003f11
mov r14, rax
mov rax, qword [rsp + 0x48]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [r14], xmm0
mov qword [rsp + 0x238], 4
mov qword [rsp + 0x240], r14
mov qword [rsp + 0x248], 1
movups xmm0, xmmword [rsp + 0x218]
movaps xmmword [rsp + 0xf0], xmm0
movups xmm0, xmmword [rsp + 0x208]
movaps xmmword [rsp + 0xe0], xmm0
movdqu xmm0, xmmword [rsp + 0x1c8]
movdqu xmm1, xmmword [rsp + 0x1d8]
movdqu xmm2, xmmword [rsp + 0x1e8]
movups xmm3, xmmword [rsp + 0x1f8]
movaps xmmword [rsp + 0xd0], xmm3
movdqa xmmword [rsp + 0xc0], xmm2
movdqa xmmword [rsp + 0xb0], xmm1
movdqa xmmword [rsp + 0xa0], xmm0
mov ebx, 1
mov esi, 0x18
lea r15, [rsp + 0x60]
lea r12, [rsp + 0xa0]
lea r13, [rsp + 0x238]
jmp 0x1400031d5
mov rax, qword [rsp + 0x70]
mov qword [r14 + rsi + 0x10], rax
movdqu xmm0, xmmword [rsp + 0x60]
movdqu xmmword [r14 + rsi], xmm0
inc rbx
mov qword [rsp + 0x248], rbx
add rsi, 0x18
mov rcx, r15
mov rdx, r12
call fcn.140097f80
movabs rax, 0x8000000000000000
cmp qword [rsp + 0x60], rax
je 0x140003210
cmp rbx, qword [rsp + 0x238]
jne 0x1400031b0
mov rcx, r13
mov rdx, rbx
call fcn.140098490
mov r14, qword [rsp + 0x240]
jmp 0x1400031b0
mov r15, qword [rsp + 0x238]
mov r14, qword [rsp + 0x240]
mov r12, qword [rsp + 0x98]
lea rax, [rbx*8]
lea rcx, [rax + rax*2]
mov rax, r14
nop word [rax + rax]
mov r13, rcx
test rcx, rcx
je 0x140003263
mov rdx, qword [rax + 0x10]
cmp rdx, 0x40
je 0x140003263
add rax, 0x18
lea rcx, [r13 - 0x18]
cmp rdx, 0x80
jne 0x140003240
test rbx, rbx
je 0x140003293
lea rsi, [r14 + 8]
jmp 0x140003279
add rsi, 0x18
dec rbx
je 0x140003293
cmp qword [rsi - 8], 0
je 0x140003270
mov r8, qword [rsi]
mov rcx, qword [0x1402540f8]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x140003270
test r15, r15
je 0x1400032a9
mov rcx, qword [0x1402540f8]
xor edx, edx
mov r8, r14
call sub.KERNEL32.dll_HeapFree
test rbp, rbp
je 0x1400032d1
mov rbx, rdi
nop word cs:[rax + rax]
mov rcx, rbx
call fcn.140095e40
add rbx, 0x30
dec rbp
jne 0x1400032c0
test r12, r12
je 0x1400032e7
mov rcx, qword [0x1402540f8]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [rsp + 0x258]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rdx, [0x140210be0]
lea rcx, [rsp + 0xa0]
mov r8d, 0xa
call fcn.1400e8500
cmp byte [rsp + 0xa0], 0x12
movzx ebp, byte [rsp + 0x37]
jne 0x140003f11
mov r14, qword [rsp + 0xa8]
mov qword [rsp + 0x60], r14
lea rax, [0x1401cd25a]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0xe7cdfd0711382acb
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.140094be0
movabs rcx, 0x192047c9710a0248
xor rcx, qword [rax]
movabs rdx, 0xcb0abea72af48b85
xor rdx, qword [rax + 8]
movabs r8, 0x428c119a071c09c8
xor r8, qword [rax + 0x10]
mov r9d, 0xd7590965
xor r9d, dword [rax + 0x18]
movzx r10d, byte [rax + 0x1e]
movzx eax, word [rax + 0x1c]
mov r11d, eax
shr r11d, 8
xor al, 0xbf
xor r11b, 0x99
movzx eax, al
movzx r11d, r11b
shl r11d, 8
or r11d, eax
xor r10b, 0xcf
mov qword [rsp + 0x1c8], rcx
mov qword [rsp + 0x1d0], rdx
mov qword [rsp + 0x1d8], r8
mov dword [rsp + 0x1e0], r9d
mov word [rsp + 0x1e4], r11w
mov byte [rsp + 0x1e6], r10b
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x60]
lea r8, [rsp + 0x1c8]
mov r9d, 0x1f
call fcn.14009aca0
cmp byte [rsp + 0xa0], 0x12
jne 0x140003f11
mov rsi, qword [rsp + 0xa8]
mov r15, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xb8]
test rbx, rbx
je 0x140003471
mov r12, r15
mov rdi, rbx
nop word cs:[rax + rax]
mov rcx, r12
call fcn.140095e40
add r12, 0x30
dec rdi
jne 0x140003460
test rsi, rsi
je 0x14000348c
mov rcx, qword [0x1402540f8]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
mov r14, qword [rsp + 0x60]
mov r12d, 0x9a7ecbe7
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
lea r14, [rsp + 0xa0]
mov rcx, r14
call fcn.1400a16c0
mov rcx, r14
call fcn.1400a1980
mov rsi, qword [rsp + 0x160]
lea rdi, [r12 + 0x45813419]
mov rcx, r14
call fcn.140095920
lea r15, [rsp + 0xa0]
mov rcx, r15
call fcn.1400a16c0
mov rcx, r15
call fcn.1400a1980
call sub.KERNEL32.dll_GetTickCount64
mov r14, rax
mov rcx, r15
call fcn.140095920
mov eax, ebp
or al, byte [rsp + 0x90]
or al, byte [rsp + 0x58]
jne 0x140003f13
test r13, r13
jne 0x140003f13
cmp rbx, 2
jb 0x140003f13
cmp rsi, rdi
jb 0x140003f13
cmp r14, r12
ja 0x140003f13
mov qword [rsp + 0x1c8], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0xa0], 0
mov dword [rsp + 0x60], 0
call sub.KERNEL32.dll_GetCurrentProcess
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x1c8]
mov rcx, rax
mov edx, 7
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x38]
mov rcx, rax
mov edx, 0x1f
mov r9d, 4
call sub.ntdll.dll_NtQueryInformationProcess
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0xa0]
mov rcx, rax
mov edx, 0x1e
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
cmp dword [rsp + 0x60], 0
jne 0x1400044a5
cmp qword [rsp + 0x1c8], 0
jne 0x1400044a5
cmp dword [rsp + 0x38], 0
je 0x1400044a5
cmp qword [rsp + 0xa0], 0
jne 0x1400044a5
call fcn.1400047f0
movaps xmm6, xmmword [rsp + 0x270]
movaps xmm7, xmmword [rsp + 0x280]
movaps xmm8, xmmword [rsp + 0x290]
movaps xmm9, xmmword [rsp + 0x2a0]
movaps xmm10, xmmword [rsp + 0x2b0]
movaps xmm11, xmmword [rsp + 0x2c0]
add rsp, 0x2d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs rcx, 0xaaaaaaaaaaaaaaab
mov rax, rsi
mul rcx
mov rsi, rdx
shr rsi, 4
jmp 0x14000368d
add r12, 0x18
dec rsi
je 0x140002c67
cmp qword [r12 - 8], 0
je 0x140003680
mov r8, qword [r12]
mov rcx, qword [0x1402540f8]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x140003680
movabs rcx, 0xaaaaaaaaaaaaaaab
mov rax, rsi
mul rcx
mov rsi, rdx
shr rsi, 4
jmp 0x1400036dd
add r12, 0x18
dec rsi
je 0x140002c97
cmp qword [r12 - 8], 0
je 0x1400036d0
mov r8, qword [r12]
mov rcx, qword [0x1402540f8]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x1400036d0
mov dword [rsp + 0x58], 0
test r15, r15
jne 0x140002ed4
jmp 0x140002efb
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x238], rax
lea rax, [0x1401c83a8]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0xd134e46efa1e6664
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.140095690
movabs rcx, 0x92aac422d552ec0b
xor rcx, qword [rax]
movabs rdx, 0x37018eb58ff2c795
xor rdx, qword [rax + 8]
movabs r8, 0x50d33da6dc32961e
xor r8, qword [rax + 0x10]
movabs r9, 0x5eb6bd53db9b24b5
xor r9, qword [rax + 0x18]
movabs r10, 0x86c58ebdaa8fa27d
xor r10, qword [rax + 0x20]
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0xb0], r8
mov qword [rsp + 0xb8], r9
mov qword [rsp + 0xc0], r10
lea rcx, [rsp + 0x1c8]
lea rdx, [rsp + 0x238]
lea r8, [rsp + 0xa0]
mov r9d, 0x28
call fcn.14009aca0
cmp byte [rsp + 0x1c8], 0x12
jne 0x140003f11
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x250], rax
mov rbx, qword [rsp + 0x1d8]
mov rsi, qword [rsp + 0x1e0]
xor ecx, ecx
call fcn.140091ae0
test rax, rax
je 0x140003f11
movups xmm0, xmmword [rax]
inc qword [rax]
movaps xmmword [rsp + 0x80], xmm0
movups xmm0, xmmword [0x1401fd130]
movaps xmmword [rsp + 0x60], xmm0
movdqu xmm0, xmmword [0x1401fd140]
movdqa xmmword [rsp + 0x70], xmm0
lea r15, [rsi + rsi*2]
shl r15, 4
add r15, rbx
mov rdi, rbx
test rsi, rsi
mov qword [rsp + 0x228], rbx
je 0x140003dcd
lea r14, [rsp + 0x1d0]
lea r12, [rsp + 0xd0]
movdqa xmm6, xmmword [str.uespemosarenegylmodnarodsetybdetn]
movdqa xmm7, xmmword [0x1401b1010]
xorps xmm8, xmm8
pcmpeqd xmm9, xmm9
movabs rax, 0x4e79616c70736964
mov rdi, rbx
mov rbx, rax
mov qword [rsp + 0x58], r15
jmp 0x140003946
cmp qword [rsp + 0x48], 0
je case.0x140001fca.160
lea rax, [rsp + 0x40]
jmp 0x140001fd9
and al, 1
movzx eax, al
sub qword [rsp + 0x70], rax
lea rax, [rcx - 0x10]
and r12, rax
mov rax, qword [rsp + 0x98]
mov byte [rsi + rcx], al
mov byte [rsi + r12 + 0x10], al
inc qword [rsp + 0x78]
neg rcx
lea rax, [rcx + rcx*2]
mov qword [rsi + rax*8 - 0x18], rbp
mov qword [rsi + rax*8 - 0x10], r13
mov qword [rsi + rax*8 - 8], rbp
mov r15, qword [rsp + 0x58]
lea r14, [rsp + 0x1d0]
lea r12, [rsp + 0xd0]
movabs rbx, 0x4e79616c70736964
nop dword [rax + rax]
lea rcx, [rsp + 0x1c8]
call fcn.140095e40
cmp rdi, r15
je 0x140003e01
mov rax, rdi
add rdi, 0x30
mov r13, qword [rax]
test r13, r13
je 0x140003dcd
mov qword [rsp + 0x1c8], r13
mov rcx, qword [rax + 0x28]
mov qword [r14 + 0x20], rcx
movdqu xmm0, xmmword [rax + 8]
movdqu xmm1, xmmword [rax + 0x18]
movdqu xmmword [r14 + 0x10], xmm1
movdqu xmmword [r14], xmm0
cmp qword [rsp + 0x1e0], 0
je 0x140003930
movdqu xmm0, xmmword [rsp + 0x1e8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmm6
movdqa xmmword [rsp + 0xa0], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmm7
movdqa xmmword [rsp + 0xb0], xmm1
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmmword [r12], xmm8
mov qword [r12 + 0x10], 0
mov r8d, 0xb
lea rsi, [rsp + 0xa0]
mov rcx, rsi
lea rdx, str.displayName_u
call fcn.14009a650
mov byte [rsp + 0x258], 0xff
mov r8d, 1
mov rcx, rsi
lea rdx, [rsp + 0x258]
call fcn.14009a650
mov rax, qword [rsp + 0xb0]
mov r9, qword [rsp + 0xd0]
shl r9, 0x38
or r9, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xa0]
add r8, rax
rol rax, 0xd
xor rcx, r9
xor rax, r8
rol r8, 0x20
mov rdx, qword [rsp + 0xa8]
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add r8, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rcx, r8
xor rax, rdx
rol rdx, 0x20
xor r8, r9
add r8, rax
rol rax, 0xd
xor rax, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add r8, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rax, rdx
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
xor rax, r8
rol r8, 0x20
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add r8, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rax, rdx
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
rol rcx, 0x15
xor rax, r8
add rdx, rax
rol rax, 0x11
mov r8, rdx
rol r8, 0x20
xor r8, rax
xor r8, rcx
xor r8, rdx
mov rax, qword [rsp + 0x1d0]
mov rcx, r8
shr rcx, 0x39
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
lea rcx, [r13 - 0x38]
xor edx, edx
and r8, rax
movdqu xmm1, xmmword [r13 + r8]
movdqa xmm2, xmm1
pcmpeqb xmm2, xmm0
pmovmskb r9d, xmm2
nop word cs:[rax + rax]
test r9w, r9w
je 0x140003ba0
tzcnt r10d, r9d
lea r11d, [r9 - 1]
and r11d, r9d
mov r9d, r11d
add r10, r8
and r10, rax
neg r10
imul r10, r10, 0x38
cmp qword [rcx + r10 + 0x10], 0xb
jne 0x140003b50
lea r11, [rcx + r10]
mov r11, qword [r11 + 8]
mov rsi, qword [r11]
xor rsi, rbx
mov r11, qword [r11 + 3]
movabs rbp, 0x656d614e79616c70
xor r11, rbp
or r11, rsi
jne 0x140003b50
jmp 0x140003bd0
pcmpeqb xmm1, xmm9
pmovmskb r9d, xmm1
test r9d, r9d
jne 0x140003930
add r8, rdx
add r8, 0x10
add rdx, 0x10
jmp 0x140003b2f
cmp byte [r13 + r10 - 0x20], 2
jne 0x140003930
add r13, r10
mov r14, qword [r13 - 0x10]
mov rbp, qword [r13 - 8]
test rbp, rbp
je 0x140003c10
js 0x140003f11
movzx eax, byte [0x140254141]
xor ecx, ecx
mov rdx, rbp
call fcn.14008bd10
mov r13, rax
test rax, rax
jne 0x140003c16
jmp 0x140003f11
mov r13d, 1
mov rcx, r13
mov rdx, r14
mov r8, rbp
call sub.msvcrt.dll_memcpy
movaps xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x260], xmm0
lea rcx, [rsp + 0x260]
mov rdx, r13
mov r8, rbp
call fcn.14009a4e0
mov r14, rax
cmp qword [rsp + 0x70], 0
je 0x140003db6
mov rsi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov rax, r14
shr rax, 0x39
mov qword [rsp + 0x98], rax
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm10, xmm0, 0
xor ecx, ecx
xor ebx, ebx
mov qword [rsp + 0x90], rcx
and r14, r12
movdqu xmm11, xmmword [rsi + r14]
movdqa xmm0, xmm11
pcmpeqb xmm0, xmm10
pmovmskb r15d, xmm0
nop word cs:[rax + rax]
test r15w, r15w
je 0x140003d00
tzcnt eax, r15d
lea ecx, [r15 - 1]
and ecx, r15d
mov r15d, ecx
add rax, r14
and rax, r12
neg rax
lea rax, [rax + rax*2]
cmp rbp, qword [rsi + rax*8 - 8]
jne 0x140003cb0
lea rax, [rsi + rax*8]
mov rdx, qword [rax - 0x10]
mov rcx, r13
mov r8, rbp
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140003cb0
jmp 0x140003d4f
cmp rbx, 1
mov ebx, 1
mov rcx, qword [rsp + 0x90]
je 0x140003d31
pmovmskb eax, xmm11
xor ebx, ebx
test eax, eax
setne bl
tzcnt eax, eax
add rax, r14
and rax, r12
mov qword [rsp + 0x230], rax
pcmpeqb xmm11, xmm9
pmovmskb eax, xmm11
test eax, eax
jne 0x140003d8d
add r14, rcx
add r14, 0x10
add rcx, 0x10
jmp 0x140003c86
test rbp, rbp
mov r15, qword [rsp + 0x58]
lea r14, [rsp + 0x1d0]
lea r12, [rsp + 0xd0]
movabs rbx, 0x4e79616c70736964
je 0x140003930
mov rcx, qword [0x1402540f8]
xor edx, edx
mov r8, r13
call sub.KERNEL32.dll_HeapFree
jmp 0x140003930
mov rcx, qword [rsp + 0x230]
movzx eax, byte [rsi + rcx]
test al, al
js 0x1400038d0
movdqa xmm0, xmmword [rsi]
pmovmskb eax, xmm0
tzcnt ecx, eax
movzx eax, byte [rsi + rcx]
jmp 0x1400038d0
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x80]
call fcn.140097180
jmp 0x140003c56
mov rax, r15
sub rax, rdi
movabs rcx, 0xaaaaaaaaaaaaaaab
mul rcx
cmp r15, rdi
je 0x140003e01
mov rbx, rdx
shr rbx, 5
nop dword [rax]
mov rcx, rdi
call fcn.140095e40
add rdi, 0x30
dec rbx
jne 0x140003df0
cmp qword [rsp + 0x250], 0
je 0x140003e22
mov rcx, qword [0x1402540f8]
xor edx, edx
mov r8, qword [rsp + 0x228]
call sub.KERNEL32.dll_HeapFree
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x78]
test rbx, rbx
sete bpl
test rdi, rdi
je 0x140003efe
mov rsi, qword [rsp + 0x60]
test rbx, rbx
je 0x140003ecd
movdqa xmm0, xmmword [rsi]
pmovmskb r15d, xmm0
not r15d
lea r14, [rsi + 0x10]
mov r12, rsi
jmp 0x140003e72
dec rbx
lea eax, [r15 - 1]
and eax, r15d
mov r15d, eax
test rbx, rbx
je 0x140003ecd
test r15w, r15w
jne 0x140003ea1
nop dword [rax + rax]
movdqa xmm0, xmmword [r14]
pmovmskb r15d, xmm0
add r12, 0xfffffffffffffe80
add r14, 0x10
cmp r15d, 0xffff
je 0x140003e80
not r15d
tzcnt eax, r15d
neg rax
lea rax, [rax + rax*2]
cmp qword [r12 + rax*8 - 0x18], 0
je 0x140003e60
lea rax, [r12 + rax*8]
mov r8, qword [rax - 0x10]
mov rcx, qword [0x1402540f8]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x140003e60
lea rax, [rdi + 1]
mov ecx, 0x18
mul rcx
add rax, 0xf
and rax, 0xfffffffffffffff0
add rdi, rax
cmp rdi, 0xffffffffffffffef
je 0x140003efe
sub rsi, rax
mov rcx, qword [0x1402540f8]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [rsp + 0x238]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x140001fed
ud2
lea rax, [0x1401cff8c]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0xeac010bb36fb94bd
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.140095460
movabs rcx, 0x2e117a115d3457d6
xor rcx, qword [rax]
mov edx, 0x2b380db8
xor edx, dword [rax + 8]
movzx eax, word [rax + 0xc]
mov r8d, eax
xor r8b, 0x1f
shr eax, 8
xor al, 7
movzx r8d, r8b
movzx eax, al
shl eax, 8
or eax, r8d
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x40], edx
mov word [rsp + 0x44], ax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x1c8], rax
mov qword [rsp + 0x1d0], 0xe
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x60], rax
lea rax, [0x14008a3a0]
mov qword [rsp + 0x68], rax
lea r15, [0x1401d6440]
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], 2
mov qword [rsp + 0xc0], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], 1
lea rcx, [rsp + 0xa0]
call fcn.140081490
test bpl, bpl
je 0x1400044aa
lea rax, [0x1401d4ef8]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0xc8fdbe6e8228bb09
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.1400953b0
movabs rcx, 0x1800204df8a976d4
xor rcx, qword [rax]
movabs rdx, 0x2f709de39d384769
xor rdx, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov r8d, eax
xor r8b, 0x25
shr eax, 8
xor al, 0x93
movzx r8d, r8b
movzx eax, al
shl eax, 8
or eax, r8d
mov qword [rsp + 0x1c8], rcx
mov qword [rsp + 0x1d0], rdx
mov word [rsp + 0x1d8], ax
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0x12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [0x14008a3a0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], 2
mov qword [rsp + 0xc0], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], 1
lea rcx, [rsp + 0xa0]
call fcn.140081490
cmp byte [rsp + 0x90], 0
jne 0x1400044b8
cmp byte [rsp + 0x58], 0
je 0x14000459f
lea rax, [0x1401cfc51]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0x6b807faef194255f
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.140094b60
movabs rcx, 0x83d5daf9d33c6ead
xor rcx, qword [rax]
movabs rdx, 0x11c91e4429d6313c
xor rdx, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov r8d, eax
xor r8b, 0xc4
shr eax, 8
xor al, 0x6f
movzx r8d, r8b
movzx eax, al
shl eax, 8
or eax, r8d
mov qword [rsp + 0x1c8], rcx
mov qword [rsp + 0x1d0], rdx
mov word [rsp + 0x1d8], ax
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0x12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [0x14008a3a0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], 2
mov qword [rsp + 0xc0], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], 1
lea rcx, [rsp + 0xa0]
call fcn.140081490
test r13, r13
jne 0x1400045a8
cmp rbx, 2
jae 0x1400046e0
lea rax, [0x1401d046d]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0x2141257512d7bd09
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.140094d70
movabs rcx, 0x3421001d75d5d052
xor rcx, qword [rax]
movabs rdx, 0xcdcdfcef9077eb8c
xor rdx, qword [rax + 8]
movzx r8d, byte [rax + 0x12]
movzx eax, word [rax + 0x10]
mov r9d, eax
shr r9d, 8
xor al, 0x27
xor r9b, 0x9d
movzx eax, al
movzx r9d, r9b
shl r9d, 8
or r9d, eax
xor r8b, 0x54
mov qword [rsp + 0x1c8], rcx
mov qword [rsp + 0x1d0], rdx
mov word [rsp + 0x1d8], r9w
mov byte [rsp + 0x1da], r8b
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0x13
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [0x14008a3a0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], 2
mov qword [rsp + 0xc0], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], 1
lea rcx, [rsp + 0xa0]
call fcn.140081490
cmp rsi, rdi
jb 0x1400046e9
cmp r14, r12
jbe 0x1400044a5
lea rax, [0x1401c7987]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0xec52a2c833a588cb
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.1400952f0
movabs rcx, 0x35c363fb21f8ccad
xor rcx, qword [rax]
movabs rdx, 0xbe6144016e39cb85
xor rdx, qword [rax + 8]
mov r8d, 0x4ac4c151
xor r8d, dword [rax + 0x10]
movzx eax, word [rax + 0x14]
mov r9d, eax
xor r9b, 0xe6
shr eax, 8
xor al, 0x8c
movzx r9d, r9b
movzx eax, al
shl eax, 8
or eax, r9d
mov qword [rsp + 0x1c8], rcx
mov qword [rsp + 0x1d0], rdx
mov dword [rsp + 0x1d8], r8d
mov word [rsp + 0x1dc], ax
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0x16
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [0x14008a3a0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], 2
mov qword [rsp + 0xc0], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], 1
lea rcx, [rsp + 0xa0]
call fcn.140081490
call fcn.140092d00
cmp byte [rsp + 0x90], 0
je 0x140004137
lea rax, [0x1401d29d2]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0xaed1b15906c0353b
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.140095620
movabs rcx, 0x45d926d49d028a72
xor rcx, qword [rax]
mov edx, 0x41715cf5
xor edx, dword [rax + 8]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x40], edx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x1c8], rax
mov qword [rsp + 0x1d0], 0xc
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x60], rax
lea rax, [0x14008a3a0]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], 2
mov qword [rsp + 0xc0], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], 1
lea rcx, [rsp + 0xa0]
call fcn.140081490
cmp byte [rsp + 0x58], 0
jne 0x140004142
test r13, r13
je 0x140004253
lea rax, [0x1401d4c38]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0x79c3a3978375a0da
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.1400955c0
movabs rcx, 0x744100e04aefe7e9
xor rcx, qword [rax]
movabs rdx, 0xe2a2a382dff8730e
xor rdx, qword [rax + 8]
mov r8d, 0x6c85a58b
xor r8d, dword [rax + 0x10]
movzx r9d, byte [rax + 0x16]
movzx eax, word [rax + 0x14]
mov r10d, eax
shr r10d, 8
xor al, 0xb1
xor r10b, 0x9b
movzx eax, al
movzx r10d, r10b
shl r10d, 8
or r10d, eax
xor r9b, 0xa1
mov qword [rsp + 0x1c8], rcx
mov qword [rsp + 0x1d0], rdx
mov dword [rsp + 0x1d8], r8d
mov word [rsp + 0x1dc], r10w
mov byte [rsp + 0x1de], r9b
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0x17
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [0x14008a3a0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], 2
mov qword [rsp + 0xc0], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], 1
lea rcx, [rsp + 0xa0]
call fcn.140081490
cmp rbx, 2
jb 0x14000425d
cmp rsi, rdi
jae 0x140004382
lea rax, [0x1401d4722]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rax, 0x3565994b4b15206b
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rdx, qword [rsp + 0xa0]
call fcn.140095660
movabs rcx, 0x5b0d2fa3f150a538
xor rcx, qword [rax]
movabs rdx, 0x53ad850321df2b3f
xor rdx, qword [rax + 8]
movabs r8, 0x2549323882bf0425
xor r8, qword [rax + 0x10]
mov qword [rsp + 0x1c8], rcx
mov qword [rsp + 0x1d0], rdx
mov qword [rsp + 0x1d8], r8
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0x18
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [0x14008a3a0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], 2
mov qword [rsp + 0xc0], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], 1
lea rcx, [rsp + 0xa0]
call fcn.140081490
cmp r14, r12
ja 0x14000438b
jmp 0x1400044a5