Function at 0x1400023d0
Capabilities:
Check for time delay via queryperformancecounter
Check if file exists
Encode data using base64
Encode data using xor
Encrypt data using speck
Get memory capacity
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe58
movdqa xmmword [rsp + 0xe40], xmm15
movdqa xmmword [rsp + 0xe30], xmm14
movdqa xmmword [rsp + 0xe20], xmm13
movdqa xmmword [rsp + 0xe10], xmm12
movdqa xmmword [rsp + 0xe00], xmm11
movdqa xmmword [rsp + 0xdf0], xmm10
movdqa xmmword [rsp + 0xde0], xmm9
movdqa xmmword [rsp + 0xdd0], xmm8
movdqa xmmword [rsp + 0xdc0], xmm7
movdqa xmmword [rsp + 0xdb0], xmm6
lea r13, [rsp + 0x1a0]
mov rcx, r13
call fcn.1401ba590
cmp byte [rsp + 0x1b8], 2
jne 0x1400024c8
mov rax, qword [rsp + 0x1a0]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x140002cbb
test rcx, rcx
je 0x140002cbb
lea rdi, [rax - 1]
mov rbx, qword [rax - 1]
mov rsi, qword [rax + 7]
mov rcx, rbx
call qword [rsi]
cmp qword [rsi + 8], 0
je 0x1400024b7
cmp qword [rsi + 0x10], 0x11
jb 0x1400024a6
mov rbx, qword [rbx - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rdi
jmp 0x140002cb6
mov r14, qword [rsp + 0x1a0]
mov rbp, qword [rsp + 0x1a8]
mov rdx, qword [rsp + 0x1b0]
mov rcx, r14
call fcn.1401c8710
mov r15, rax
test rax, rax
je 0x140002579
mov r8, rdx
mov rbx, r13
lea rcx, [rsp + 0x1a0]
mov rdx, r15
call fcn.1401c5b60
mov r12, qword [rsp + 0x1a0]
mov rsi, qword [rsp + 0x1a8]
test r12, r12
mov r13, r12
cmove r13, rsi
mov rdi, qword [rsp + 0x1b0]
test rdi, rdi
je 0x140002587
js case.0x14000609b.1
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140002562
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapAlloc
mov rcx, rax
test rax, rax
jne 0x14000258c
jmp case.0x14000609b.1
xor eax, eax
mov qword [rsp + 0x38], rax
test rbp, rbp
jne 0x1400025bf
jmp 0x1400025d0
mov ecx, 1
mov qword [rsp + 0x38], rcx
mov rdx, r13
mov r8, rdi
call sub.msvcrt.dll_memcpy
test r12, r12
je 0x1400025b7
test rsi, rsi
je 0x1400025b7
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, r12
call sub.kernel32.dll_HeapFree
mov r13, rbx
test rbp, rbp
je 0x1400025d0
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapFree
test r15, r15
je 0x140002cbb
lea rax, [0x1401f5e1a]
mov qword [rsp + 0x668], rax
lea rax, [rsp + 0x668]
mov rcx, qword [rsp + 0x668]
movabs rdx, 0xe7d894259bf85e1e
mov qword [rsp + 0x668], rdx
mov rdx, qword [rsp + 0x668]
call fcn.140070790
movabs rsi, 0x4246bd9a11e1975f
xor rsi, qword [rax]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x14000264f
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 8
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov qword [rax], rsi
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x1d8], 8
mov qword [rsp + 0x1e0], 8
mov byte [rsp + 0x1e8], 0
mov qword [rsp + 0x230], 8
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x200], 0
mov word [rsp + 0x208], 0
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x238], xmm0
mov byte [rsp + 0x228], 2
mov dword [rsp + 0x260], 0
mov word [rsp + 0x264], 0
mov dword [rsp + 0x1a0], 6
mov dword [rsp + 0x1b0], 6
mov dword [rsp + 0x1c0], 6
mov qword [rsp + 0x248], 0
mov qword [rsp + 0x258], 0
lea rcx, [rsp + 0xad0]
lea rdx, [rsp + 0x1a0]
call fcn.1401c0c90
mov rdx, qword [rsp + 0xad0]
test rdx, rdx
je 0x140002c35
movabs r15, 0x8080808080808080
mov rax, qword [rsp + 0xad8]
mov qword [rsp + 0xb8], rax
mov r8, qword [rsp + 0xae0]
mov rax, qword [rsp + 0xae8]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xaf0]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x668]
mov qword [rsp + 0xf8], rdx
call fcn.140036470
mov rbp, qword [rsp + 0x668]
mov rax, qword [rsp + 0x670]
test rbp, rbp
mov qword [rsp + 0xd8], rbp
mov qword [rsp + 0x68], rax
cmove rbp, rax
mov r12, qword [rsp + 0x678]
mov qword [rsp + 0x7e0], 0
mov qword [rsp + 0x7e8], r12
mov qword [rsp + 0x7f0], rbp
mov qword [rsp + 0x7f8], r12
mov qword [rsp + 0x800], 0
mov qword [rsp + 0x808], r12
mov qword [rsp + 0x810], 1
movabs rax, 0xa0000000a
mov qword [rsp + 0x818], rax
mov word [rsp + 0x820], 0
xor r13d, r13d
movdqa xmm6, xmmword [section..rdata]
movdqa xmm7, xmmword [0x1401f6010]
xor esi, esi
xor r14d, r14d
jmp 0x140002859
xor r9d, r9d
mov rdx, rdi
call fcn.1400019a0
movzx eax, al
add r14, rax
test bl, bl
je 0x140002a43
mov rax, rsi
cmp r13, r12
ja 0x1400029c3
mov rdx, r12
sub rdx, r13
mov rcx, rbp
add rcx, r13
cmp rdx, 0x10
jae 0x1400028b0
cmp r12, r13
je 0x1400029b0
xor r9d, r9d
nop word cs:[rax + rax]
cmp byte [rcx + r9], 0xa
je 0x140002983
inc r9
cmp rdx, r9
jne 0x140002890
jmp 0x1400029b0
lea r8, [rcx + 7]
and r8, 0xfffffffffffffff8
sub r8, rcx
je 0x1400028f0
cmp r8, rdx
cmovae r8, rdx
test r8, r8
je 0x1400028f0
xor r9d, r9d
nop dword [rax]
cmp byte [rcx + r9], 0xa
je 0x140002983
inc r9
cmp r8, r9
jne 0x1400028d0
lea r9, [rdx - 0x10]
jmp 0x140002900
lea r9, [rdx - 0x10]
xor r8d, r8d
jmp 0x140002905
cmp r8, r9
ja 0x140002940
movdqu xmm0, xmmword [rcx + r8]
movdqa xmm1, xmm0
pxor xmm1, xmm6
paddq xmm1, xmm7
pandn xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
movq r10, xmm1
test r10, r15
jne 0x140002940
add r8, 0x10
jmp 0x140002900
cmp r8, rdx
je 0x1400029b0
add rcx, r8
mov rdx, r12
sub rdx, r8
sub rdx, r13
xor r9d, r9d
nop word cs:[rax + rax]
cmp byte [rcx + r9], 0xa
je 0x140002980
inc r9
cmp rdx, r9
jne 0x140002960
jmp 0x1400029b0
add r9, r8
add r9, r13
mov r13, r9
inc r13
je 0x14000299c
cmp r13, r12
ja 0x14000299c
mov cl, 0xa
cmp byte [rbp + r9], cl
je 0x140002a18
cmp r13, r12
jbe 0x140002865
mov qword [rsp + 0x800], r13
jmp 0x1400029c3
mov qword [rsp + 0x800], r13
mov qword [rsp + 0x800], r12
mov r13, r12
mov byte [rsp + 0x821], 1
cmp r12, rax
mov rcx, qword [rsp + 0x38]
je 0x140002a43
xor ebx, ebx
mov rsi, rax
mov r9, r12
lea r8, [rax + rbp]
sub r9, rax
je 0x140002840
cmp byte [r8 + r9 - 1], 0xa
jne 0x140002843
mov rax, r9
dec rax
je 0x140002840
cmp byte [r8 + r9 - 2], 0xd
lea rdx, [r9 - 2]
cmove rax, rdx
mov r9, rax
jmp 0x140002843
mov qword [rsp + 0x800], r13
mov qword [rsp + 0x7e0], r13
mov bl, 1
mov rsi, r13
mov r9, r13
mov rcx, qword [rsp + 0x38]
lea r8, [rax + rbp]
sub r9, rax
jne 0x1400029ea
jmp 0x140002840
mov r8, qword [rsp + 0xd8]
test r8, r8
je 0x140002a66
cmp qword [rsp + 0x68], 0
je 0x140002a66
mov rcx, qword [0x1402d9150]
xor edx, edx
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0xb8], 0
lea r13, [rsp + 0x1a0]
je 0x140002a8f
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, qword [rsp + 0xf8]
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0x58], 0
je 0x140002aaa
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, qword [rsp + 0x70]
call sub.kernel32.dll_HeapFree
lea r12, [rsp + 0x1a0]
mov rcx, r12
call fcn.140001710
test rdi, rdi
je 0x140002ad2
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, qword [rsp + 0x38]
call sub.kernel32.dll_HeapFree
cmp r14, 1
jbe 0x140002cbb
lea rax, [0x1401fb7c6]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x520f15564a24084
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070dd0
movabs rcx, 0x8c6c8383eb3f39e2
xor rcx, qword [rax]
movabs rdx, 0x349063cf9f815c2d
xor rdx, qword [rax + 8]
movabs r8, 0x70e6abdb25da68db
xor r8, qword [rax + 0x10]
movabs r9, 0xea571839162ebbb5
xor r9, qword [rax + 0x18]
movabs r10, 0x6bd5bd12357aeb1
xor r10, qword [rax + 0x20]
mov r11d, 0x15228b72
xor r11d, dword [rax + 0x28]
movzx eax, byte [rax + 0x2c]
xor al, 0xd4
mov qword [rsp + 0x7e0], rcx
mov qword [rsp + 0x7e8], rdx
mov qword [rsp + 0x7f0], r8
mov qword [rsp + 0x7f8], r9
mov qword [rsp + 0x800], r10
mov dword [rsp + 0x808], r11d
mov byte [rsp + 0x80c], al
lea rax, [rsp + 0x7e0]
mov qword [rsp + 0xad0], rax
mov qword [rsp + 0xad8], 0x2d
lea rax, [rsp + 0xad0]
mov qword [rsp + 0x668], rax
lea rax, [0x1401c8bd0]
mov qword [rsp + 0x670], rax
lea rax, str.combase.dll
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 2
mov qword [rsp + 0x1c0], 0
lea rax, [rsp + 0x668]
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], 1
lea rcx, [rsp + 0x1a0]
call fcn.1401bff70
mov ecx, 0x64
call fcn.1401c1480
ud2
mov rax, qword [rsp + 0xad8]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x140002c96
test rcx, rcx
je 0x140002c96
lea r14, [rax - 1]
mov r15, qword [rax - 1]
mov rsi, qword [rax + 7]
mov rcx, r15
call qword [rsi]
cmp qword [rsi + 8], 0
je 0x140002c85
cmp qword [rsi + 0x10], 0x11
jb 0x140002c74
mov r15, qword [r15 - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, r15
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapFree
lea rcx, [rsp + 0x1a0]
call fcn.140001710
test rdi, rdi
je 0x140002cbb
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, qword [rsp + 0x38]
call sub.kernel32.dll_HeapFree
lea rax, [0x1401f88c7]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0xbf762448fed571c4
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140071120
movabs rcx, 0x54ff32d72498390
xor rcx, qword [rax]
mov edx, 0x9e6ff9b8
xor edx, dword [rax + 8]
movzx r8d, byte [rax + 0xe]
movzx eax, word [rax + 0xc]
mov r9d, eax
shr r9d, 8
xor al, 0x94
xor r9b, 0xeb
movzx eax, al
movzx r9d, r9b
shl r9d, 8
or r9d, eax
xor r8b, 0x41
mov qword [rsp + 0x668], rcx
mov dword [rsp + 0x670], edx
mov word [rsp + 0x674], r9w
mov byte [rsp + 0x676], r8b
lea rax, [rsp + 0x668]
mov qword [rsp + 0x7e0], rax
mov qword [rsp + 0x7e8], 0xf
lea rax, [rsp + 0x7e0]
mov qword [rsp + 0xad0], rax
lea rax, [0x1401c8bd0]
mov qword [rsp + 0xad8], rax
lea rax, str.combase.dll
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 2
mov qword [rsp + 0x1c0], 0
lea rax, [rsp + 0xad0]
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], 1
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
call fcn.1401bfe10
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140002e07
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0x378
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov r15, rax
lea rax, [0x1401f8de4]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0xa7028bb01c55ffef
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070830
mov ebx, dword [rax]
movzx esi, byte [rax + 6]
movzx ebp, word [rax + 4]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140002e8b
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 7
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov r12, rax
mov eax, ebp
shr eax, 8
xor bpl, 0xf5
xor al, 0xcc
movzx ecx, bpl
movzx eax, al
shl eax, 8
or eax, ecx
xor sil, 0xbb
movzx ecx, sil
shl rcx, 0x30
movzx eax, ax
shl rax, 0x20
or rax, rcx
mov ecx, 0xedac33b8
xor rcx, rbx
or rcx, rax
mov dword [r12], ecx
mov rax, rcx
shr rax, 0x30
mov byte [r12 + 6], al
shr rcx, 0x20
mov word [r12 + 4], cx
lea rax, [0x1401f8355]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x9da1903ad4ebc0d6
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.1400702c0
movabs rsi, 0xdfd6d821fc4b7137
xor rsi, qword [rax]
mov ebx, 0x9e8db348
xor ebx, dword [rax + 8]
movzx ebp, byte [rax + 0xc]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140002f70
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xd
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov r13, rax
xor bpl, 0x7a
mov qword [rax], rsi
mov dword [rax + 8], ebx
mov byte [rax + 0xc], bpl
lea rax, [0x1401f2188]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0xdc512a30ff1c99c5
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070a40
movabs r14, 0x89eebaf0cdfe8aa5
xor r14, qword [rax]
movzx ebx, byte [rax + 0xa]
movzx esi, word [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x14000300d
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xb
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov rbp, rax
mov eax, esi
shr eax, 8
xor sil, 0xa8
xor al, 0x20
movzx ecx, sil
movzx eax, al
shl eax, 8
or eax, ecx
movd xmm0, eax
xor bl, 0xa2
mov qword [rbp], r14
movd eax, xmm0
mov word [rbp + 8], ax
mov byte [rbp + 0xa], bl
lea rax, [0x1401f2b41]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0xc742652d87dc732c
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070bb0
mov esi, dword [rax]
movzx ebx, byte [rax + 4]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x1400030ba
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 5
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
xor bl, 0xc0
movzx ecx, bl
shl rcx, 0x20
xor rsi, 0x4008e2ea
or rsi, rcx
mov dword [rax], esi
shr rsi, 0x20
mov qword [rsp + 0x38], rax
mov byte [rax + 4], sil
lea rax, [0x1401f822f]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0xf07603ff72ba4048
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070bf0
movabs r14, 0x6cea53e873bf6125
xor r14, qword [rax]
movzx ebx, byte [rax + 0xa]
movzx esi, word [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140003169
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xb
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov edx, esi
shr edx, 8
xor sil, 0xc3
xor dl, 0x54
movzx ecx, sil
movzx edx, dl
shl edx, 8
or edx, ecx
movd xmm0, edx
xor bl, 0x7f
mov qword [rax], r14
movd ecx, xmm0
mov word [rax + 8], cx
mov qword [rsp + 0x58], rax
mov byte [rax + 0xa], bl
lea rax, [0x1401ff406]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x61da279d0fede75f
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070180
movabs rsi, 0x3559075e6dbaec8b
xor rsi, qword [rax]
movzx ebx, word [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140003223
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xa
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov ecx, ebx
xor cl, 0x67
shr ebx, 8
xor bl, 0x7d
movzx edx, cl
movzx ecx, bl
shl ecx, 8
or ecx, edx
movd xmm0, ecx
mov qword [rax], rsi
movd ecx, xmm0
mov qword [rsp + 0xb8], rax
mov word [rax + 8], cx
lea rax, [0x1401face3]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x1a66352953185301
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.14006fe50
movabs r14, 0x870edfa748807443
xor r14, qword [rax]
movzx ebx, byte [rax + 0xa]
movzx esi, word [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x1400032dc
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xb
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov edx, esi
shr edx, 8
xor sil, 0x9a
xor dl, 0x2a
movzx ecx, sil
movzx edx, dl
shl edx, 8
or edx, ecx
movd xmm0, edx
xor bl, 0xb8
mov qword [rax], r14
movd ecx, xmm0
mov word [rax + 8], cx
mov qword [rsp + 0x68], rax
mov byte [rax + 0xa], bl
lea rax, [0x1401fbd37]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x6c5fca2a1e6a0807
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070fa0
movabs rsi, 0xbbee61202841abbb
xor rsi, qword [rax]
movzx ebx, word [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140003396
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xa
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov r14, rax
mov eax, ebx
xor al, 0x65
shr ebx, 8
xor bl, 2
movzx eax, al
movzx ecx, bl
shl ecx, 8
or ecx, eax
movd xmm0, ecx
mov qword [r14], rsi
movd eax, xmm0
mov word [r14 + 8], ax
lea rax, [0x1401f6613]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x1b3bef222a0da09
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.1400707e0
movabs rsi, 0xd2695be28ed7195c
xor rsi, qword [rax]
mov ebx, 0xdbb98a68
xor ebx, dword [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x14000344a
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xc
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov qword [rsp + 0x70], rbp
mov qword [rax], rsi
mov qword [rsp + 0xf8], rax
mov dword [rax + 8], ebx
lea rax, [0x1401f5054]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x4b4614c02fc49ed3
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.1400710f0
movabs rsi, 0x24afec561f607642
xor rsi, qword [rax]
movabs rbx, 0x863b93c6fd8d5844
xor rbx, qword [rax + 8]
movzx ebp, word [rax + 0x10]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x1400034f3
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0x12
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov qword [rsp + 0x5b0], r14
mov ecx, ebp
xor cl, 7
shr ebp, 8
xor bpl, 0x15
movzx edx, cl
movzx ecx, bpl
shl ecx, 8
or ecx, edx
movd xmm0, ecx
mov qword [rax], rsi
mov qword [rax + 8], rbx
movd ecx, xmm0
mov qword [rsp + 0x5a8], rax
mov word [rax + 0x10], cx
lea rax, [0x1401f0fd3]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x282336f57793161
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.1400711d0
movabs r14, 0xf3be0c7cdf94d124
xor r14, qword [rax]
movzx ebx, byte [rax + 0xa]
movzx esi, word [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x1400035ba
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xb
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov rbp, rax
mov eax, esi
shr eax, 8
xor sil, 0xe4
xor al, 0x39
movzx ecx, sil
movzx eax, al
shl eax, 8
or eax, ecx
movd xmm0, eax
xor bl, 3
mov qword [rbp], r14
movd eax, xmm0
mov word [rbp + 8], ax
mov byte [rbp + 0xa], bl
lea rax, [0x1401f1f45]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0xdf016900378f883f
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070cb0
movq xmm6, qword [rax]
movq xmm7, qword [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x14000366a
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov r14, rax
mov qword [rsp + 0x80], rbp
punpcklqdq xmm6, xmm7
pxor xmm6, xmmword [0x1401f6020]
movdqu xmmword [rax], xmm6
lea rax, [0x1401f1d82]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0xe70cfb0458c42c2a
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.1400701a0
movabs rsi, 0xfe4a6266f7559448
xor rsi, qword [rax]
movabs rbx, 0xc40bad75f2d997c5
xor rbx, qword [rax + 8]
mov ebp, 0x850fe147
xor ebp, dword [rax + 0x10]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x14000371f
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0x14
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov qword [rsp + 0x40], r14
mov qword [rax], rsi
mov qword [rax + 8], rbx
mov qword [rsp + 0x48], rax
mov dword [rax + 0x10], ebp
lea rax, [0x1401ffa95]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x92d7800497239ea1
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070360
movabs r14, 0xe2cb9e25e07a97c4
xor r14, qword [rax]
movzx ebx, byte [rax + 0xa]
movzx esi, word [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x1400037bf
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xb
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov edx, esi
shr edx, 8
xor sil, 0xe2
xor dl, 0xa2
movzx ecx, sil
movzx edx, dl
shl edx, 8
or edx, ecx
movd xmm0, edx
xor bl, 0xe1
mov qword [rax], r14
movd ecx, xmm0
mov word [rax + 8], cx
mov qword [rsp + 0xf0], rax
mov byte [rax + 0xa], bl
lea rax, [0x1401f4666]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0xb7d3bbfcfd0e383
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070700
movabs rsi, 0x7b32c52a7462314f
xor rsi, qword [rax]
movabs rbx, 0xffd74f1f516508c1
xor rbx, qword [rax + 8]
movzx ebp, byte [rax + 0x10]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x14000388a
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0x11
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov r14, rax
xor bpl, 0xa5
mov qword [rax], rsi
mov qword [rax + 8], rbx
mov byte [rax + 0x10], bpl
lea rax, [0x1401f1c11]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0xa2d11a56a84f5c6f
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140071020
mov ebx, dword [rax]
movzx esi, byte [rax + 6]
movzx ebp, word [rax + 4]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x14000391d
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 7
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov edx, ebp
shr edx, 8
xor bpl, 0x3c
xor dl, 0x45
movzx ecx, bpl
movzx edx, dl
shl edx, 8
or edx, ecx
xor sil, 0xb7
movzx ecx, sil
shl rcx, 0x30
movzx edx, dx
shl rdx, 0x20
or rdx, rcx
xor rbx, 0x7e03d0b6
or rbx, rdx
mov dword [rax], ebx
mov rcx, rbx
shr rcx, 0x30
mov byte [rax + 6], cl
shr rbx, 0x20
mov qword [rsp + 0x5a0], rax
mov word [rax + 4], bx
lea rax, [0x1401f82f3]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x7ba9ad05cb877f33
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070230
movabs rsi, 0x7b13c1a1467746d7
xor rsi, qword [rax]
mov ebx, 0x67dbe672
xor ebx, dword [rax + 8]
movzx ebp, byte [rax + 0xc]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140003a01
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xd
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov qword [rsp + 0x598], r14
xor bpl, 0xf8
mov qword [rax], rsi
mov dword [rax + 8], ebx
mov qword [rsp + 0x590], rax
mov byte [rax + 0xc], bpl
lea rax, [0x1401f93f0]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x167de7f6d451d7f1
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.1400708b0
movabs r14, 0xedea42afafa61d48
xor r14, qword [rax]
movzx ebx, byte [rax + 0xa]
movzx esi, word [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140003aab
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xb
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov rbp, rax
mov eax, esi
shr eax, 8
xor sil, 0x70
xor al, 0xfe
movzx ecx, sil
movzx eax, al
shl eax, 8
or eax, ecx
movd xmm0, eax
xor bl, 0x41
mov qword [rbp], r14
movd eax, xmm0
mov word [rbp + 8], ax
mov byte [rbp + 0xa], bl
lea rax, [0x1401ff6ad]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x13d6e9f8fdf74222
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070950
mov esi, dword [rax]
movzx ebx, byte [rax + 4]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140003b58
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 5
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
xor bl, 0xd1
movzx ecx, bl
shl rcx, 0x20
xor rsi, 0x2162b377
or rsi, rcx
mov dword [rax], esi
shr rsi, 0x20
mov qword [rsp + 0x78], rax
mov byte [rax + 4], sil
lea rax, [0x1401f88be]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0xce0956a3f3b988b5
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.1400709b0
movabs r14, 0x42439863f3d5dc2b
xor r14, qword [rax]
movzx ebx, byte [rax + 0xa]
movzx esi, word [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140003c07
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xb
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov edx, esi
shr edx, 8
xor sil, 0x44
xor dl, 0xf8
movzx ecx, sil
movzx edx, dl
shl edx, 8
or edx, ecx
movd xmm0, edx
xor bl, 0xb3
mov qword [rax], r14
movd ecx, xmm0
mov word [rax + 8], cx
mov qword [rsp + 0x60], rax
mov byte [rax + 0xa], bl
lea rax, [0x1401f6a8e]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0xf8814d6e629fe595
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.14006fe30
movabs rsi, 0xe83dbbf98582645d
xor rsi, qword [rax]
movzx ebx, word [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140003cc1
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xa
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov ecx, ebx
xor cl, 0x58
shr ebx, 8
xor bl, 0x3f
movzx edx, cl
movzx ecx, bl
shl ecx, 8
or ecx, edx
movd xmm0, ecx
mov qword [rax], rsi
movd ecx, xmm0
mov qword [rsp + 0xe8], rax
mov word [rax + 8], cx
lea rax, [0x1401f428c]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0xc0a0472d36e50397
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070610
movabs r14, 0x957847dfe0c0dd87
xor r14, qword [rax]
movzx ebx, byte [rax + 0xa]
movzx esi, word [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140003d7a
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xb
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov edx, esi
shr edx, 8
xor sil, 0xde
xor dl, 0xca
movzx ecx, sil
movzx edx, dl
shl edx, 8
or edx, ecx
movd xmm0, edx
xor bl, 0xfe
mov qword [rax], r14
movd ecx, xmm0
mov word [rax + 8], cx
mov qword [rsp + 0x88], rax
mov byte [rax + 0xa], bl
lea rax, [0x1401f4bd5]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x794b9ebed68ba2c0
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070eb0
movabs rsi, 0xb2c005a77e1a137d
xor rsi, qword [rax]
movzx ebx, word [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140003e37
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xa
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov r14, rax
mov eax, ebx
xor al, 0x3d
shr ebx, 8
xor bl, 0x2f
movzx eax, al
movzx ecx, bl
shl ecx, 8
or ecx, eax
movd xmm0, ecx
mov qword [r14], rsi
movd eax, xmm0
mov word [r14 + 8], ax
lea rax, [0x1401ff649]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x4e9a22e49438a2a8
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070bd0
movabs rsi, 0x3b84fb1d69d43be9
xor rsi, qword [rax]
mov ebx, 0x380624ae
xor ebx, dword [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140003eeb
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xc
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov qword [rsp + 0xd0], rbp
mov qword [rax], rsi
mov qword [rsp + 0xc8], rax
mov dword [rax + 8], ebx
lea rax, [0x1401f4b5f]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x42aefadcbd47dd66
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070910
movabs rsi, 0x664144ec331d668a
xor rsi, qword [rax]
movabs rbx, 0x602a9b9e954093c2
xor rbx, qword [rax + 8]
movzx ebp, word [rax + 0x10]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140003f97
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0x12
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov qword [rsp + 0x198], r14
mov ecx, ebp
xor cl, 0x72
shr ebp, 8
xor bpl, 4
movzx edx, cl
movzx ecx, bpl
shl ecx, 8
or ecx, edx
movd xmm0, ecx
mov qword [rax], rsi
mov qword [rax + 8], rbx
movd ecx, xmm0
mov qword [rsp + 0x578], rax
mov word [rax + 0x10], cx
lea rax, [0x1401fa6f4]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x9ea6205611dab46f
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070640
movabs r14, 0x3e3e83fa1bb09064
xor r14, qword [rax]
movzx ebx, byte [rax + 0xa]
movzx esi, word [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x14000405e
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xb
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov rbp, rax
mov eax, esi
shr eax, 8
xor sil, 0x9a
xor al, 0x2f
movzx ecx, sil
movzx eax, al
shl eax, 8
or eax, ecx
movd xmm0, eax
xor bl, 0x77
mov qword [rbp], r14
movd eax, xmm0
mov word [rbp + 8], ax
mov byte [rbp + 0xa], bl
lea rax, [0x1401f2278]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x612c6db602120545
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070c70
movq xmm6, qword [rax]
movq xmm7, qword [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x14000410e
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov r14, rax
mov qword [rsp + 0x570], rbp
punpcklqdq xmm6, xmm7
pxor xmm6, xmmword [0x1401f6030]
movdqu xmmword [rax], xmm6
lea rax, [0x1401f0d83]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0xd7f31bb96b6e5204
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070da0
movabs rsi, 0xaf06daa296660d01
xor rsi, qword [rax]
movabs rbx, 0x2f437b36fe06b1eb
xor rbx, qword [rax + 8]
mov ebp, 0x4496ffa4
xor ebp, dword [rax + 0x10]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x1400041c3
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0x14
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov qword [rsp + 0x568], r14
mov qword [rax], rsi
mov qword [rax + 8], rbx
mov qword [rsp + 0xc0], rax
mov dword [rax + 0x10], ebp
lea rax, [0x1401f1090]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x8666b2284c234a2
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.1400708e0
movabs r14, 0xa2a261a7375f64a2
xor r14, qword [rax]
movzx ebx, byte [rax + 0xa]
movzx esi, word [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140004269
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xb
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov edx, esi
shr edx, 8
xor sil, 0x6c
xor dl, 0x2b
movzx ecx, sil
movzx edx, dl
shl edx, 8
or edx, ecx
movd xmm0, edx
xor bl, 0x48
mov qword [rax], r14
movd ecx, xmm0
mov word [rax + 8], cx
mov qword [rsp + 0xe0], rax
mov byte [rax + 0xa], bl
lea rax, [0x1401efead]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0xa4947b14c7687872
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.1400704f0
movabs rsi, 0x84c1cebe59e594c0
xor rsi, qword [rax]
movabs rbx, 0x34d93e521fdc5695
xor rbx, qword [rax + 8]
movzx ebp, byte [rax + 0x10]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140004334
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0x11
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov r14, rax
xor bpl, 0xbb
mov qword [rax], rsi
mov qword [rax + 8], rbx
mov byte [rax + 0x10], bpl
lea rax, [0x1401f9815]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x81002c1bfbbf65be
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.14006ff30
mov ebx, dword [rax]
movzx esi, byte [rax + 6]
movzx ebp, word [rax + 4]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x1400043c7
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 7
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov qword [rsp + 0x50], r14
mov qword [rsp + 0xd8], r15
mov edx, ebp
shr edx, 8
xor bpl, 0x25
xor dl, 0xb5
movzx ecx, bpl
movzx edx, dl
shl edx, 8
or edx, ecx
xor sil, 0x31
movzx ecx, sil
shl rcx, 0x30
movzx edx, dx
shl rdx, 0x20
or rdx, rcx
xor rbx, 0x44f08f0d
or rbx, rdx
mov dword [rax], ebx
mov rcx, rbx
shr rcx, 0x30
mov byte [rax + 6], cl
shr rbx, 0x20
mov qword [rsp + 0x588], rax
mov word [rax + 4], bx
lea rax, [0x1401fe1d7]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0xc3da080de920a83d
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070ce0
movabs r14, 0xc417a429bbf90872
xor r14, qword [rax]
movzx ebx, byte [rax + 0xa]
movzx esi, word [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x1400044b4
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xb
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov r15, rax
mov eax, esi
shr eax, 8
xor sil, 0x60
xor al, 0x10
movzx ecx, sil
movzx eax, al
shl eax, 8
or eax, ecx
movd xmm0, eax
xor bl, 0xc1
mov qword [r15], r14
movd eax, xmm0
mov word [r15 + 8], ax
mov byte [r15 + 0xa], bl
lea rax, [0x1401faf77]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0xc837f82b4ca0441
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070b20
mov ebx, dword [rax]
movzx esi, word [rax + 4]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140004562
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 6
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov r14, rax
mov eax, esi
xor al, 0x4f
shr esi, 8
xor sil, 0x41
movzx eax, al
movzx ecx, sil
shl ecx, 8
or ecx, eax
shl rcx, 0x20
xor rbx, 0x18ac3b4d
or rbx, rcx
mov dword [r14], ebx
shr rbx, 0x20
mov word [r14 + 4], bx
lea rax, [0x1401fc0fc]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x69600f9edf8fcf0b
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070880
movzx esi, byte [rax + 2]
movzx ebp, word [rax]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140004614
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 3
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov rbx, rax
mov qword [rsp + 0x580], r13
mov qword [rsp + 0x560], r12
mov eax, ebp
shr eax, 8
xor bpl, 0x34
xor al, 0x34
movzx ecx, bpl
movzx eax, al
shl eax, 8
or eax, ecx
xor sil, 0xed
movzx ecx, sil
shl ecx, 0x10
movzx eax, ax
or eax, ecx
mov word [rbx], ax
shr eax, 0x10
mov byte [rbx + 2], al
lea rax, [0x1401fafc0]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x9fda1372060db5e4
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070480
movabs rsi, 0xc8246107635e8408
xor rsi, qword [rax]
movzx ebp, byte [rax + 0xa]
movzx r13d, word [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x1400046e4
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xb
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov r12, rax
mov eax, r13d
shr eax, 8
xor r13b, 0xa5
xor al, 0xc3
movzx ecx, r13b
movzx eax, al
shl eax, 8
or eax, ecx
movd xmm0, eax
xor bpl, 0x90
mov qword [r12], rsi
movd eax, xmm0
mov word [r12 + 8], ax
mov byte [r12 + 0xa], bpl
lea rax, [0x1401f0114]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x890be2dd51b81c07
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.14006fff0
mov esi, dword [rax]
movzx r13d, word [rax + 4]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140004798
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 6
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov rbp, rax
mov eax, r13d
xor al, 0x96
shr r13d, 8
xor r13b, 0xf
movzx eax, al
movzx ecx, r13b
shl ecx, 8
or ecx, eax
shl rcx, 0x20
mov eax, 0xb7a1a4ca
xor rax, rsi
or rax, rcx
mov dword [rbp], eax
shr rax, 0x20
mov word [rbp + 4], ax
lea rax, [0x1401efee0]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x3a35efdb2bd02dd4
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070e80
movzx esi, byte [rax + 2]
movzx r13d, word [rax]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x14000484d
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 3
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov ecx, r13d
shr ecx, 8
xor r13b, 0xe7
xor cl, 0x52
movzx edx, r13b
movzx ecx, cl
shl ecx, 8
or ecx, edx
xor sil, 0x2e
movzx edx, sil
shl edx, 0x10
movzx ecx, cx
or ecx, edx
mov word [rax], cx
shr ecx, 0x10
mov byte [rax + 2], cl
mov rcx, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0x560]
mov qword [rcx], rdx
mov qword [rcx + 8], 7
mov qword [rcx + 0x10], 7
mov rdx, qword [rsp + 0x580]
mov qword [rcx + 0x18], rdx
mov qword [rcx + 0x20], 0xd
mov qword [rcx + 0x28], 0xd
mov rdx, qword [rsp + 0x70]
mov qword [rcx + 0x30], rdx
mov qword [rcx + 0x38], 0xb
mov qword [rcx + 0x40], 0xb
mov rdx, qword [rsp + 0x38]
mov qword [rcx + 0x48], rdx
mov qword [rcx + 0x50], 5
mov qword [rcx + 0x58], 5
mov rdx, qword [rsp + 0x58]
mov qword [rcx + 0x60], rdx
mov qword [rcx + 0x68], 0xb
mov qword [rcx + 0x70], 0xb
mov rdx, qword [rsp + 0xb8]
mov qword [rcx + 0x78], rdx
mov qword [rcx + 0x80], 0xa
mov qword [rcx + 0x88], 0xa
mov rdx, qword [rsp + 0x68]
mov qword [rcx + 0x90], rdx
mov qword [rcx + 0x98], 0xb
mov qword [rcx + 0xa0], 0xb
mov rdx, qword [rsp + 0x5b0]
mov qword [rcx + 0xa8], rdx
mov qword [rcx + 0xb0], 0xa
mov qword [rcx + 0xb8], 0xa
mov rdx, qword [rsp + 0xf8]
mov qword [rcx + 0xc0], rdx
mov qword [rcx + 0xc8], 0xc
mov qword [rcx + 0xd0], 0xc
mov rdx, qword [rsp + 0x5a8]
mov qword [rcx + 0xd8], rdx
mov qword [rcx + 0xe0], 0x12
mov qword [rcx + 0xe8], 0x12
mov rdx, qword [rsp + 0x80]
mov qword [rcx + 0xf0], rdx
mov qword [rcx + 0xf8], 0xb
mov qword [rcx + 0x100], 0xb
mov rdx, qword [rsp + 0x40]
mov qword [rcx + 0x108], rdx
mov qword [rcx + 0x110], 0x10
mov qword [rcx + 0x118], 0x10
mov rdx, qword [rsp + 0x48]
mov qword [rcx + 0x120], rdx
mov qword [rcx + 0x128], 0x14
mov qword [rcx + 0x130], 0x14
mov rdx, qword [rsp + 0xf0]
mov qword [rcx + 0x138], rdx
mov qword [rcx + 0x140], 0xb
mov qword [rcx + 0x148], 0xb
mov rdx, qword [rsp + 0x598]
mov qword [rcx + 0x150], rdx
mov qword [rcx + 0x158], 0x11
mov qword [rcx + 0x160], 0x11
mov rdx, qword [rsp + 0x5a0]
mov qword [rcx + 0x168], rdx
mov qword [rcx + 0x170], 7
mov qword [rcx + 0x178], 7
mov rdx, qword [rsp + 0x590]
mov qword [rcx + 0x180], rdx
mov qword [rcx + 0x188], 0xd
mov qword [rcx + 0x190], 0xd
mov rdx, qword [rsp + 0xd0]
mov qword [rcx + 0x198], rdx
mov qword [rcx + 0x1a0], 0xb
mov qword [rcx + 0x1a8], 0xb
mov rdx, qword [rsp + 0x78]
mov qword [rcx + 0x1b0], rdx
mov qword [rcx + 0x1b8], 5
mov qword [rcx + 0x1c0], 5
mov rdx, qword [rsp + 0x60]
mov qword [rcx + 0x1c8], rdx
mov qword [rcx + 0x1d0], 0xb
mov qword [rcx + 0x1d8], 0xb
mov rdx, qword [rsp + 0xe8]
mov qword [rcx + 0x1e0], rdx
mov qword [rcx + 0x1e8], 0xa
mov qword [rcx + 0x1f0], 0xa
mov rdx, qword [rsp + 0x88]
mov qword [rcx + 0x1f8], rdx
mov qword [rcx + 0x200], 0xb
mov qword [rcx + 0x208], 0xb
mov rdx, qword [rsp + 0x198]
mov qword [rcx + 0x210], rdx
mov qword [rcx + 0x218], 0xa
mov qword [rcx + 0x220], 0xa
mov rdx, qword [rsp + 0xc8]
mov qword [rcx + 0x228], rdx
mov qword [rcx + 0x230], 0xc
mov qword [rcx + 0x238], 0xc
mov rdx, qword [rsp + 0x578]
mov qword [rcx + 0x240], rdx
mov qword [rcx + 0x248], 0x12
mov qword [rcx + 0x250], 0x12
mov rdx, qword [rsp + 0x570]
mov qword [rcx + 0x258], rdx
mov qword [rcx + 0x260], 0xb
mov qword [rcx + 0x268], 0xb
mov rdx, qword [rsp + 0x568]
mov qword [rcx + 0x270], rdx
mov qword [rcx + 0x278], 0x10
mov qword [rcx + 0x280], 0x10
mov rdx, qword [rsp + 0xc0]
mov qword [rcx + 0x288], rdx
mov qword [rcx + 0x290], 0x14
mov qword [rcx + 0x298], 0x14
mov rdx, qword [rsp + 0xe0]
mov qword [rcx + 0x2a0], rdx
mov qword [rcx + 0x2a8], 0xb
mov qword [rcx + 0x2b0], 0xb
mov rdx, qword [rsp + 0x50]
mov qword [rcx + 0x2b8], rdx
mov qword [rcx + 0x2c0], 0x11
mov qword [rcx + 0x2c8], 0x11
mov rdx, qword [rsp + 0x588]
mov qword [rcx + 0x2d0], rdx
mov qword [rcx + 0x2d8], 7
mov qword [rcx + 0x2e0], 7
mov qword [rcx + 0x2e8], r15
mov qword [rcx + 0x2f0], 0xb
mov qword [rcx + 0x2f8], 0xb
mov qword [rcx + 0x300], r14
mov qword [rcx + 0x308], 6
mov qword [rcx + 0x310], 6
mov qword [rcx + 0x318], rbx
mov qword [rcx + 0x320], 3
mov qword [rcx + 0x328], 3
mov qword [rcx + 0x330], r12
mov qword [rcx + 0x338], 0xb
mov qword [rcx + 0x340], 0xb
mov qword [rcx + 0x348], rbp
mov qword [rcx + 0x350], 6
mov qword [rcx + 0x358], 6
mov qword [rcx + 0x360], rax
mov qword [rcx + 0x368], 3
mov qword [rcx + 0x370], 3
lea rax, [0x1401f2fe4]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x5fec6575907dde32
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070a00
movabs rsi, 0x863c8b0c1c7a15ef
xor rsi, qword [rax]
movzx edi, word [rax + 8]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
je 0x140004dde
lea rbx, [rsp + 0x7e0]
jmp 0x140004dfe
call sub.kernel32.dll_GetProcessHeap
test rax, rax
lea rbx, [rsp + 0x7e0]
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0xa
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov ecx, edi
xor cl, 0xe2
shr edi, 8
xor dil, 0x14
movzx ecx, cl
movzx edx, dil
shl edx, 8
or edx, ecx
movd xmm0, edx
mov qword [rax], rsi
movd ecx, xmm0
mov word [rax + 8], cx
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x1d8], 0xa
mov qword [rsp + 0x1e0], 0xa
mov byte [rsp + 0x1e8], 0
mov qword [rsp + 0x230], 8
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x200], 0
mov word [rsp + 0x208], 0
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x238], xmm0
mov byte [rsp + 0x228], 2
mov dword [rsp + 0x260], 0
mov word [rsp + 0x264], 0
mov dword [rsp + 0x1a0], 6
mov dword [rsp + 0x1b0], 6
mov dword [rsp + 0x1c0], 6
mov qword [rsp + 0x248], 0
mov qword [rsp + 0x258], 0
lea rax, [0x1401f97be]
mov qword [rsp + 0x7e0], rax
mov rcx, qword [rsp + 0x7e0]
movabs rax, 0x1e38fdcc2f9e0843
mov qword [rsp + 0x7e0], rax
mov rdx, qword [rsp + 0x7e0]
call fcn.1400706a0
movabs rdi, 0x57a219137fd17f6d
xor rdi, qword [rax]
movabs rbx, 0xb2a30607848e1933
xor rbx, qword [rax + 8]
movabs r14, 0xb6b4cc609e1269f6
xor r14, qword [rax + 0x10]
movabs r15, 0x29233f6ac823a47c
xor r15, qword [rax + 0x18]
movabs r12, 0xba2c1115970559ad
xor r12, qword [rax + 0x20]
mov ebp, 0x39db0f52
xor ebp, dword [rax + 0x28]
movzx r13d, byte [rax + 0x2c]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140004fa7
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0x2d
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov rsi, rax
lea rcx, [rsp + 0x230]
xor r13b, 0xa
mov qword [rax], rdi
mov qword [rax + 8], rbx
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r15
mov qword [rax + 0x20], r12
mov dword [rax + 0x28], ebp
mov byte [rax + 0x2c], r13b
xor edx, edx
call fcn.1401ca0a0
mov rax, qword [rsp + 0x230]
mov rcx, qword [rsp + 0x240]
lea rdx, [rcx + rcx*4]
mov qword [rax + rdx*8], 0
mov qword [rax + rdx*8 + 8], rsi
mov qword [rax + rdx*8 + 0x10], 0x2d
mov qword [rax + rdx*8 + 0x18], 0x2d
mov byte [rax + rdx*8 + 0x20], 0
inc rcx
mov qword [rsp + 0x240], rcx
lea r13, [rsp + 0x7e0]
lea rdx, [rsp + 0x1a0]
mov rcx, r13
call fcn.1401c0c90
lea rax, [0x1401f1336]
mov qword [rsp + 0xad0], rax
lea rdx, [rsp + 0xad0]
mov rcx, qword [rsp + 0xad0]
movabs rax, 0x868fa261fcdf184c
mov qword [rsp + 0xad0], rax
mov rdx, qword [rsp + 0xad0]
call fcn.140070e60
mov rcx, qword [rax]
mov rcx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
movzx eax, byte [rax + 0x18]
mov r14, qword [rsp + 0x7e0]
test r14, r14
je case.0x14000609b.1
mov rax, qword [rsp + 0x7e8]
mov qword [rsp + 0x5a8], rax
mov rsi, qword [rsp + 0x7f0]
mov rax, qword [rsp + 0x7f8]
mov qword [rsp + 0x5a0], rax
mov rax, qword [rsp + 0x800]
mov qword [rsp + 0x5b0], rax
lea rcx, [rsp + 0x1a0]
call fcn.140001710
lea rbx, [rsp + 0x1a0]
mov rcx, rbx
mov qword [rsp + 0x598], r14
mov rdx, r14
mov r8, rsi
call fcn.140036470
mov r14, qword [rsp + 0x1a0]
mov r12, qword [rsp + 0x1a8]
test r14, r14
mov r15, r14
cmove r15, r12
mov rdx, qword [rsp + 0x1b0]
lea rcx, [r15 + rdx]
mov al, 1
test rdx, rdx
je 0x140005298
xor edx, edx
mov qword [rsp + 0x68], rdx
lea r9, [0x1402a2870]
xor r8d, r8d
mov rdx, r15
jmp 0x140005169
movzx r10d, r10b
test byte [r10 + r9], 1
je 0x14000528f
nop
cmp rdx, rcx
je 0x1400053cd
mov r11, rdx
mov rdi, r8
movzx r10d, byte [rdx]
test r10b, r10b
js 0x140005190
lea rdx, [r11 + 1]
jmp 0x140005210
mov r8d, r10d
and r8d, 0x1f
movzx ebp, byte [r11 + 1]
and ebp, 0x3f
cmp r10b, 0xdf
jbe 0x1400051e4
movzx esi, byte [r11 + 2]
shl ebp, 6
and esi, 0x3f
or esi, ebp
cmp r10b, 0xf0
jb 0x1400051f4
lea rdx, [r11 + 4]
movzx r10d, byte [r11 + 3]
and r8d, 7
shl r8d, 0x12
shl esi, 6
and r10d, 0x3f
or r10d, esi
or r10d, r8d
cmp r10d, 0x110000
jne 0x140005210
jmp 0x1400089b3
lea rdx, [r11 + 2]
shl r8d, 6
or r8d, ebp
mov r10d, r8d
jmp 0x140005210
lea rdx, [r11 + 3]
shl r8d, 0xc
or esi, r8d
mov r10d, esi
nop word cs:[rax + rax]
mov r8, rdx
sub r8, r11
add r8, rdi
lea r11d, [r10 - 9]
cmp r11d, 5
jb 0x140005160
cmp r10d, 0x20
je 0x140005160
cmp r10d, 0x80
jb 0x14000528f
mov r11d, r10d
shr r11d, 8
cmp r11d, 0x1f
jg 0x140005265
test r11d, r11d
je 0x140005150
cmp r11d, 0x16
jne 0x14000528f
cmp r10d, 0x1680
je 0x140005160
jmp 0x14000528f
cmp r11d, 0x20
je 0x140005280
cmp r11d, 0x30
jne 0x14000528f
cmp r10d, 0x3000
je 0x140005160
jmp 0x14000528f
movzx r10d, r10b
test byte [r10 + r9], 2
jne 0x140005160
xor eax, eax
mov qword [rsp + 0x68], r8
jmp 0x1400052b0
xor r8d, r8d
mov rdx, r15
xor r9d, r9d
mov qword [rsp + 0x68], r9
nop word cs:[rax + rax]
cmp rdx, rcx
je 0x1400053c9
mov r10, rcx
movzx r11d, byte [rcx - 1]
test r11b, r11b
js 0x1400052d0
lea rcx, [r10 - 1]
jmp 0x140005334
movzx esi, byte [r10 - 2]
cmp sil, 0xc0
jge 0x140005305
movzx ebp, byte [r10 - 3]
cmp bpl, 0xc0
jge 0x14000530e
lea rcx, [r10 - 4]
mov r9, r13
movzx r13d, byte [r10 - 4]
and r13d, 7
shl r13d, 6
and ebp, 0x3f
or ebp, r13d
mov r13, r9
jmp 0x140005315
lea rcx, [r10 - 2]
and esi, 0x1f
jmp 0x14000531d
lea rcx, [r10 - 3]
and ebp, 0xf
shl ebp, 6
and esi, 0x3f
or esi, ebp
shl esi, 6
and r11d, 0x3f
or r11d, esi
cmp r11d, 0x110000
je 0x1400053c9
lea esi, [r11 - 9]
cmp esi, 5
jb 0x1400052b0
cmp r11d, 0x20
je 0x1400052b0
cmp r11d, 0x80
jb 0x1400053be
mov esi, r11d
shr esi, 8
cmp esi, 0x1f
jg 0x140005377
test esi, esi
je 0x140005390
cmp esi, 0x16
jne 0x1400053be
cmp r11d, 0x1680
je 0x1400052b0
jmp 0x1400053be
cmp esi, 0x20
je 0x1400053a8
cmp esi, 0x30
jne 0x1400053be
cmp r11d, 0x3000
je 0x1400052b0
jmp 0x1400053be
movzx r11d, r11b
lea r9, [0x1402a2870]
test byte [r11 + r9], 1
jne 0x1400052b0
jmp 0x1400053be
movzx r11d, r11b
lea r9, [0x1402a2870]
test byte [r11 + r9], 2
jne 0x1400052b0
sub r8, rdx
add r8, r10
mov qword [rsp + 0x68], r8
test al, al
je 0x1400053cf
xor edi, edi
mov rsi, qword [rsp + 0x68]
mov qword [rsp + 0xf8], rdi
sub rsi, rdi
mov edi, 1
je 0x14000542d
js case.0x14000609b.1
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140005417
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapAlloc
mov rdi, rax
test rax, rax
je case.0x14000609b.1
add r15, qword [rsp + 0xf8]
mov rcx, rdi
mov rdx, r15
mov r8, rsi
call sub.msvcrt.dll_memcpy
test r14, r14
je 0x14000545e
test r12, r12
je 0x14000545e
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapFree
mov r14d, 0x10
mov r15, qword [rsp + 0xd8]
jmp 0x140005474
add r14, 0x18
cmp r14, 0x388
je 0x14000adc0
cmp qword [r15 + r14], rsi
jne 0x140005470
mov rcx, qword [r15 + r14 - 0x10]
mov rdx, rdi
mov r8, rsi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140005470
lea rax, [0x1401ff395]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x32b898f5d5c9034b
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070ac0
movq xmm0, qword [rax]
movq xmm1, qword [rax + 8]
punpcklqdq xmm0, xmm1
pxor xmm0, xmmword [0x1401f6040]
movdqa xmmword [rsp + 0x7e0], xmm0
mov qword [rsp + 0xad0], r13
mov qword [rsp + 0xad8], 0x10
lea rax, [rsp + 0xad0]
mov qword [rsp + 0x668], rax
lea rax, [0x1401c8bd0]
mov qword [rsp + 0x670], rax
lea rax, str.combase.dll
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 2
mov qword [rsp + 0x1c0], 0
lea rax, [rsp + 0x668]
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], 1
lea rcx, [rsp + 0x1a0]
call fcn.1401bfe10
mov ecx, 0x1e
call fcn.1401c0480
xor ecx, ecx
call fcn.1401c8bf0
test rax, rax
je case.0x14000609b.1
movdqu xmm6, xmmword [rax]
inc qword [rax]
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x1400055be
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0x56410
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov rsi, rax
add rsi, 0x56000
mov r8d, 0x410
mov rcx, rsi
mov dl, 0xff
call sub.msvcrt.dll_memset
mov qword [rsp + 0x1e0], rsi
mov qword [rsp + 0x1e8], 0x3ff
mov qword [rsp + 0x1f0], 0x380
mov qword [rsp + 0x1f8], 0
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140005645
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 9
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
movabs rcx, 0x5043206c61746f54
mov qword [rax], rcx
mov byte [rax + 8], 0x55
mov qword [rsp + 0x230], rax
mov qword [rsp + 0x238], 9
mov qword [rsp + 0x240], 9
mov qword [rsp + 0x248], 1
pxor xmm7, xmm7
movdqu xmmword [rsp + 0x250], xmm7
mov qword [rsp + 0x260], 1
movdqu xmmword [rsp + 0x268], xmm7
mov qword [rsp + 0x278], 0
mov qword [rsp + 0x290], 0
mov dword [rsp + 0x298], 0
mov qword [rsp + 0x2a0], 8
movdqu xmmword [rsp + 0x2a8], xmm7
mov byte [rsp + 0x2b8], 0
movdqu xmmword [rsp + 0x200], xmm6
movdqu xmmword [rsp + 0x210], xmm7
movdqu xmmword [rsp + 0x220], xmm7
mov qword [rsp + 0x1a0], 0
movdqa xmmword [rsp + 0x7e0], xmm7
movdqa xmmword [rsp + 0x810], xmm7
movdqa xmmword [rsp + 0x800], xmm7
movdqa xmmword [rsp + 0x7f0], xmm7
mov dword [rsp + 0x7e0], 0x40
lea rcx, [rsp + 0x7e0]
call sub.kernel32.dll_GlobalMemoryStatusEx
test eax, eax
jne 0x140005766
call sub.kernel32.dll_GetLastError
mov qword [rsp + 0x590], rdi
movups xmm0, xmmword [rsp + 0x7e8]
movups xmmword [rsp + 0x210], xmm0
movdqa xmmword [rsp + 0x830], xmm7
movdqa xmmword [rsp + 0x820], xmm7
movdqa xmmword [rsp + 0x810], xmm7
movdqa xmmword [rsp + 0x800], xmm7
movdqa xmmword [rsp + 0x7f0], xmm7
movdqa xmmword [rsp + 0x7e0], xmm7
mov qword [rsp + 0x840], 0
lea rcx, [rsp + 0x7e0]
mov edx, 0x68
call sub.kernel32.dll_K32GetPerformanceInfo
test eax, eax
je 0x140005835
mov rdx, qword [rsp + 0x7f0]
mov r9, qword [rsp + 0x800]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rsp + 0x830]
mov rax, rcx
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rsp + 0x7e8]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rsp + 0x220], r8
mov qword [rsp + 0x228], rax
movabs rdi, 0x202020202020101
lea rsi, [rsp + 0x1a0]
mov rcx, rsi
call fcn.1401cfb00
mov byte [rsp + 0x7e0], 1
mov qword [rsp + 0x7e1], rdi
lea rdx, [rsp + 0x7e0]
mov rcx, rsi
call fcn.1401cff00
lea rcx, [rsp + 0xad0]
mov r8d, 0x120
mov rdx, rsi
call sub.msvcrt.dll_memcpy
pxor xmm6, xmm6
movdqa xmmword [rsp + 0x1a0], xmm6
movdqa xmmword [rsp + 0x1d0], xmm6
movdqa xmmword [rsp + 0x1c0], xmm6
movdqa xmmword [rsp + 0x1b0], xmm6
mov dword [rsp + 0x1a0], 0x40
lea rcx, [rsp + 0x1a0]
call sub.kernel32.dll_GlobalMemoryStatusEx
test eax, eax
jne 0x1400058ce
call sub.kernel32.dll_GetLastError
movups xmm0, xmmword [rsp + 0x1a8]
movups xmmword [rsp + 0xb40], xmm0
movdqa xmmword [rsp + 0x1f0], xmm6
movdqa xmmword [rsp + 0x1e0], xmm6
movdqa xmmword [rsp + 0x1d0], xmm6
movdqa xmmword [rsp + 0x1c0], xmm6
movdqa xmmword [rsp + 0x1b0], xmm6
movdqa xmmword [rsp + 0x1a0], xmm6
mov qword [rsp + 0x200], 0
lea rcx, [rsp + 0x1a0]
mov edx, 0x68
call sub.kernel32.dll_K32GetPerformanceInfo
test eax, eax
je 0x140005995
mov rdx, qword [rsp + 0x1b0]
mov r9, qword [rsp + 0x1c0]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rsp + 0x1f0]
mov rax, rcx
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rsp + 0x1a8]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rsp + 0xb50], r8
mov qword [rsp + 0xb58], rax
lea rsi, [rsp + 0xad0]
mov rcx, rsi
call fcn.1401cfb00
mov byte [rsp + 0x1a0], 1
mov qword [rsp + 0x1a1], rdi
lea rbx, [rsp + 0x1a0]
mov rcx, rsi
mov rdx, rbx
call fcn.1401cff00
mov rax, qword [rsp + 0xb48]
shr rax, 0x1f
je 0x14000af5f
lea rax, [0x1401f5e4d]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x531718016c98c2eb
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070540
movq xmm0, qword [rax]
movq xmm1, qword [rax + 8]
punpcklqdq xmm0, xmm1
pxor xmm0, xmmword [0x1401f6050]
movdqa xmmword [rsp + 0x7e0], xmm0
lea rax, [rsp + 0x7e0]
mov qword [rsp + 0x668], rax
mov qword [rsp + 0x670], 0x10
lea rax, [rsp + 0x668]
mov qword [rsp + 0x748], rax
lea rax, [0x1401c8bd0]
mov qword [rsp + 0x750], rax
lea rax, str.combase.dll
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 2
mov qword [rsp + 0x1c0], 0
lea rax, [rsp + 0x748]
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], 1
lea rcx, [rsp + 0x1a0]
call fcn.1401bfe10
xor esi, esi
pxor xmm6, xmm6
lea r12, [0x1401ff950]
movabs r13, 0xbbe2b78c17cb0d3a
movabs r15, 0x4ab5d0424f7b61a5
movabs rbp, 0xb411c205e700eb9c
lea rdi, [rsp + 0x100]
jmp 0x140005afb
inc esi
cmp esi, 0x14
je 0x14000932d
lea rax, [0x1401f8034]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0xdefb0f4533b0b138
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.14006fe80
movdqa xmmword [rsp + 0x210], xmm6
movdqa xmmword [rsp + 0x200], xmm6
movdqa xmmword [rsp + 0x1f0], xmm6
movdqa xmmword [rsp + 0x1e0], xmm6
movdqa xmmword [rsp + 0x1d0], xmm6
movdqa xmmword [rsp + 0x1c0], xmm6
movdqa xmmword [rsp + 0x1b0], xmm6
movdqa xmmword [rsp + 0x1a0], xmm6
mov qword [rsp + 0x220], 0
mov rcx, 0xfffffffffffffff8
nop dword [rax]
mov rdx, qword [rcx + r12 + 8]
xor rdx, qword [rax + rcx + 8]
mov qword [rsp + rcx + 0x1a8], rdx
add rcx, 8
cmp rcx, 0x80
jb 0x140005b90
movzx eax, byte [rax + 0x88]
xor al, 0xe1
mov byte [rsp + 0x228], al
mov r8d, 0x89
lea r14, [rsp + 0xc60]
mov rcx, r14
mov rdx, rbx
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x668]
mov rdx, r14
call fcn.14007a0b0
cmp dword [rsp + 0x668], 3
jne 0x140005d69
lea rax, [0x1401f0283]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0xd5592048b36eb8f6
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070120
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov r10, qword [rax + 0x20]
movzx r11d, byte [rax + 0x2a]
movzx r14d, word [rax + 0x28]
mov eax, r14d
shr eax, 8
xor r14b, 0x8d
xor al, 0xa1
movzx r14d, r14b
movzx eax, al
shl eax, 8
or eax, r14d
movabs r14, 0x6be260af780a140a
xor rcx, r14
mov qword [rsp + 0x7e0], rcx
movabs rcx, 0xa1d613abd905f9d4
xor rdx, rcx
mov qword [rsp + 0x7e8], rdx
xor r8, r13
mov qword [rsp + 0x7f0], r8
xor r9, r15
mov qword [rsp + 0x7f8], r9
xor r10, rbp
mov qword [rsp + 0x800], r10
mov word [rsp + 0x808], ax
xor r11b, 0x75
mov byte [rsp + 0x80a], r11b
lea rax, [rsp + 0x7e0]
mov qword [rsp + 0x748], rax
mov qword [rsp + 0x750], 0x2b
lea rax, [rsp + 0x748]
mov qword [rsp + 0x100], rax
lea rax, [0x1401c8bd0]
mov qword [rsp + 0x108], rax
lea rax, str.combase.dll
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 2
mov qword [rsp + 0x1c0], 0
mov qword [rsp + 0x1b0], rdi
mov qword [rsp + 0x1b8], 1
mov rcx, rbx
call fcn.1401bff70
mov ecx, 0xf
call fcn.1401c0480
cmp dword [rsp + 0x668], 3
jne 0x140005af0
lea rcx, [rsp + 0x668]
call fcn.140001450
jmp 0x140005af0
lea rcx, [rsp + 0xcf0]
lea rsi, [rsp + 0x668]
mov r8d, 0xc0
mov rdx, rsi
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x748]
mov r8d, 0x98
mov rdx, rsi
call sub.msvcrt.dll_memcpy
mov edi, dword [rsp + 0xd90]
cmp edi, 0x3b9aca00
jne 0x140005db6
mov edi, 0x3b9aca00
jmp 0x140005ecb
mov rbx, qword [rsp + 0xd88]
mov qword [rsp + 0x1a0], 0
lea rcx, [rsp + 0x1a0]
call sub.kernel32.dll_QueryPerformanceCounter
test eax, eax
je 0x14000af1d
mov rsi, qword [rsp + 0x1a0]
mov rcx, qword [0x1402d9130]
test rcx, rcx
jne 0x140005e2c
mov qword [rsp + 0x1a0], 0
lea rcx, [rsp + 0x1a0]
call sub.kernel32.dll_QueryPerformanceFrequency
test eax, eax
je 0x14000af1d
mov rcx, qword [rsp + 0x1a0]
mov qword [0x1402d9130], rcx
test rcx, rcx
je case.0x14000609b.1
mov rax, rsi
or rax, rcx
shr rax, 0x20
je 0x140005e42
mov rax, rsi
xor edx, edx
div rcx
jmp 0x140005e48
mov eax, esi
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x140005e6c
xor edx, edx
div rcx
mov rcx, rax
jmp 0x140005e72
xor edx, edx
div ecx
mov ecx, eax
add rcx, r8
mov rax, rcx
shr rax, 9
movabs rdx, 0x44b82fa09b5a53
mul rdx
shr rdx, 0xb
add rbx, rdx
jb case.0x14000609b.1
imul rax, rdx, 0x3b9aca00
sub rcx, rax
add edi, ecx
cmp edi, 0x3b9aca00
jb 0x140005ec3
inc rbx
je case.0x14000609b.1
mov qword [rsp + 0xb8], rbx
add edi, 0xc4653600
jmp 0x140005ecb
mov qword [rsp + 0xb8], rbx
call fcn.1401ca2d0
test rax, rax
je case.0x14000609b.1
mov rsi, rax
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140005f07
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je case.0x14000609b.1
mov rcx, rax
mov qword [0x1402d9150], rax
xor eax, eax
mov qword [rsp + 0x70], rax
mov r8d, 0x18
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je case.0x14000609b.1
mov qword [rax], 1
mov qword [rax + 8], 1
mov rcx, rax
add rcx, 0x10
mov qword [rax + 0x10], rsi
lea rax, fcn.1401826f0
mov qword [rsp + 0x658], rax
mov qword [rsp + 0x660], rcx
lea rax, [rsp + 0x658]
mov qword [rsp + 0x5b8], rax
lea r12, [rsp + 0x1a0]
lea rdx, [rsp + 0x748]
mov r8d, 0x98
mov rcx, r12
call sub.msvcrt.dll_memcpy
lea rax, str.utf_8
mov qword [rsp + 0x238], rax
mov qword [rsp + 0x240], 5
lea rcx, [rsp + 0x248]
lea rdx, [rsp + 0x7e0]
mov r8d, 0x2e8
call sub.msvcrt.dll_memcpy
mov byte [rsp + 0x530], 0
mov eax, dword [rsp + 0x729]
mov ecx, dword [rsp + 0x72c]
mov dword [rsp + 0x531], eax
mov dword [rsp + 0x534], ecx
lea r15, [rsp + 0x348]
pxor xmm6, xmm6
movdqa xmm7, xmmword [0x1401f60b0]
movdqa xmm8, xmmword [0x1401f60c0]
movdqa xmm9, xmmword [0x1401f60d0]
movdqa xmm10, xmmword [0x1401f6080]
movdqa xmm11, xmmword [0x1401f6090]
movdqa xmm12, xmmword [0x1401f60a0]
movdqa xmm13, xmmword [0x1401f6060]
movdqa xmm14, xmmword [0x1401f6070]
lea r13, [rsp + 0x540]
mov eax, 0
mov qword [rsp + 0xf0], rcx
mov dword [rsp + 0xe8], ecx
mov dword [rsp + 0x58], edi
test al, al
je 0x1400060d0
nop word cs:[rax + rax]
movzx eax, al
cmp eax, 3
jne case.0x14000609b.1
movzx eax, byte [rsp + 0x528]
test eax, eax
je 0x140006246
cmp eax, 3
jne case.0x14000609b.1
movzx eax, byte [rsp + 0x4e1]
lea rcx, [0x1401f60e0]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov rax, qword [rsp + 0x4e8]
mov rdx, qword [rax]
jmp 0x140006364
mov r8d, 0x98
lea rsi, [rsp + 0x248]
mov rcx, rsi
mov rdx, r12
call sub.msvcrt.dll_memcpy
mov r15, qword [rsp + 0x238]
mov r14, qword [rsp + 0x240]
movups xmm0, xmmword [0x14029fc40]
movaps xmmword [rsp + 0x110], xmm0
movdqu xmm0, xmmword [0x14029fc30]
movdqa xmmword [rsp + 0x100], xmm0
mov rcx, rsi
lea rdx, [rsp + 0x100]
call fcn.14016e6b0
mov rsi, rax
mov rax, qword [rsp + 0x100]
test rax, rax
je 0x140006154
mov rdx, qword [rsp + 0x108]
mov r8, qword [rsp + 0x110]
lea rcx, [rsp + 0x118]
call qword [rax + 0x10]
test rsi, rsi
lea r9, [0x1401f60f8]
je 0x14000618f
mov r13, qword [rsi + 8]
mov rbx, qword [rsi + 0x10]
lea r12, [rbx + r13]
xor eax, eax
nop
cmp rbx, rax
je 0x1400064b0
movzx ecx, byte [r13 + rax]
inc rax
cmp cl, 9
je 0x140006170
add cl, 0xe0
cmp cl, 0x5f
jb 0x140006170
mov qword [rsp + 0x2e0], 2
xor ecx, ecx
lea r12, [rsp + 0x1a0]
test rcx, rcx
cmovne r15, rcx
cmove rax, r14
lea rcx, [rsp + 0x118]
movdqu xmmword [rcx - 0x17], xmm6
mov word [rcx - 7], 0
test rax, rax
lea r13, [rsp + 0x540]
je 0x140006208
lea rcx, [r15 + rax]
inc r15
nop word [rax + rax]
movzx edx, byte [r15 - 1]
mov r8d, edx
add r8d, 0xfffffff7
cmp r8d, 0x56
ja case.0x1400061fd.11
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
inc r15
dec rax
jne 0x1400061e0
xor eax, eax
lea r15, [rsp + 0x348]
test rax, rax
lea rcx, [0x140202be8]
cmove rax, rcx
mov qword [rsp + 0x340], rax
mov r8d, 0x98
mov rcx, r15
lea rdx, [rsp + 0x248]
call sub.msvcrt.dll_memcpy
mov byte [rsp + 0x528], 0
mov r8d, 0x98
lea rcx, [rsp + 0x3e0]
mov rdx, r15
call sub.msvcrt.dll_memcpy
mov r8d, 0x90
lea rsi, [rsp + 0x100]
mov rcx, rsi
mov rdx, r15
call sub.msvcrt.dll_memcpy
lea rax, [rsp + 0x118]
movups xmm0, xmmword [rax + 0x58]
movups xmm1, xmmword [rax + 0x68]
movaps xmmword [rsp + 0x5c0], xmm0
movaps xmmword [rsp + 0x5d0], xmm1
mov rcx, rsi
call fcn.14014bec0
mov rax, qword [rsp + 0x620]
mov qword [r12 + 0x338], rax
movaps xmm0, xmmword [rsp + 0x610]
movups xmmword [r12 + 0x328], xmm0
movaps xmm0, xmmword [rsp + 0x600]
movups xmmword [r12 + 0x318], xmm0
movaps xmm0, xmmword [rsp + 0x5c0]
movaps xmm1, xmmword [rsp + 0x5d0]
movdqa xmm2, xmmword [rsp + 0x5e0]
movdqa xmm3, xmmword [rsp + 0x5f0]
movdqu xmmword [r12 + 0x308], xmm3
movdqu xmmword [r12 + 0x2f8], xmm2
movups xmmword [r12 + 0x2e8], xmm1
movups xmmword [r12 + 0x2d8], xmm0
mov byte [rsp + 0x4e1], 0
mov byte [rsp + 0x4e0], 0
movdqu xmm0, xmmword [r12 + 0x2d8]
movdqu xmm1, xmmword [r12 + 0x2e8]
lea rdx, [rsp + 0x498]
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx], xmm0
mov qword [rsp + 0x4d8], rdx
lea rax, [rsp + 0x4d8]
mov qword [rsp + 0x4e8], rax
lea rcx, [rsp + 0x100]
lea r8, [rsp + 0x5b8]
call fcn.1401ac0d0
mov rcx, qword [rsp + 0x100]
cmp rcx, 2
jne 0x140006390
mov al, 3
jmp 0x140006e22
mov rax, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x110]
lea rdx, [rsp + 0x118]
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0xc20], xmm0
test rcx, rcx
je 0x1400084dc
test rax, rax
je 0x140008611
mov byte [rsp + 0x4e0], 1
mov qword [rsp + 0x4b8], rax
mov qword [rsp + 0x4c0], rbx
movdqa xmm0, xmmword [rsp + 0xc20]
movdqu xmmword [r12 + 0x328], xmm0
lea rax, [rsp + 0x4d8]
mov qword [rsp + 0x4e8], rax
mov rdx, qword [rax]
lea rcx, [rsp + 0x100]
lea r8, [rsp + 0x5b8]
call fcn.1401ac0d0
mov rcx, qword [rsp + 0x100]
cmp rcx, 2
jne 0x140006430
mov al, 4
jmp 0x140006e22
mov rax, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x110]
lea rdx, [rsp + 0x118]
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0xc30], xmm0
test rcx, rcx
je 0x140008595
test rax, rax
je 0x1400085e4
mov qword [rsp + 0x4e8], rax
mov qword [rsp + 0x4f0], rbx
movaps xmm0, xmmword [rsp + 0xc30]
movups xmmword [r12 + 0x358], xmm0
mov rax, qword [rsp + 0x4d8]
cmp qword [rax], 0
je 0x140006641
cmp rbx, 3
jne 0x1400064d1
movzx eax, word [r13]
xor eax, 0x2f2a
movzx ecx, byte [r13 + 2]
xor ecx, 0x2a
or cx, ax
je 0x1400067e3
xor eax, eax
nop word cs:[rax + rax]
cmp rbx, rax
je 0x14000618f
mov rsi, rax
movzx ecx, byte [r13 + rax]
inc rax
lea rdx, [0x1402465e8]
cmp byte [rcx + rdx], 0
jne 0x1400064e0
cmp cl, 0x2f
jne 0x14000618f
test rsi, rsi
je 0x14000618f
mov qword [rsp + 0x80], r14
lea r14, [rsi + r13]
inc r14
mov rdi, rax
xor r10d, r10d
cmp r14, r12
jne 0x1400065ff
test rbx, rbx
mov rbp, qword [rsp + 0x48]
mov qword [rsp + 0x78], r10
je 0x140006fce
mov rbp, rdi
mov rcx, r14
inc r14
movzx edx, byte [rcx]
inc rdi
cmp edx, 0x2b
je 0x1400065e0
lea eax, [rdx - 0x41]
cmp al, 0x1a
jae 0x140006851
add edx, 0x20
jmp case.0x1400061fd.45
mov qword [rsp + 0x80], r14
mov eax, dword [0x1402465c4]
mov dword [rsp + 0x93], eax
mov eax, dword [0x1402465c1]
mov dword [rsp + 0x90], eax
mov esi, 1
mov ebx, 3
mov eax, 2
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x78], rax
xor r8d, r8d
xor r14d, r14d
xor r11d, r11d
xor edi, edi
lea r9, [0x1402a10f0]
xor eax, eax
mov qword [rsp + 0x48], rax
xor ebp, ebp
xor edx, edx
lea r12, [rsp + 0x1a0]
lea r13, str.utf_8
jmp 0x140007805
lea eax, [rdx - 0x61]
cmp al, 0x1a
jb case.0x1400061fd.45
lea eax, [rdx - 0x30]
cmp al, 0xa
jae 0x140006208
nop word cs:[rax + rax]
mov byte [rsp + 0x100], dl
mov eax, 1
cmp r15, rcx
je 0x140006970
nop word cs:[rax + rax]
movzx edx, byte [r15 + rax - 1]
mov r8d, edx
add r8d, 0xfffffff7
cmp r8d, 0x56
ja case.0x1400068b1.11
lea r9, [0x1401f6254]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
lea r8d, [rdx - 0x41]
cmp r8b, 0x1a
jae 0x14000690c
cmp rax, 0x13
je 0x140006208
lea r8d, [rdx - 0x61]
cmp r8b, 0x1a
jb case.0x1400068b1.45
mov edx, 0xe4
xor r8d, r8d
mov ecx, 0xe4
lea r15, [rsp + 0x348]
jmp 0x14000699e
inc rdx
mov r8, rdx
mov rdx, rcx
sub rdx, r8
jbe 0x140006a1b
shr rdx, 1
add rdx, r8
mov r9, rdx
shl r9, 4
lea r10, str.l1l2l3l4l5l6l9866mackoigbkbig5koi8sjisucs_2ms932cp866cp819x_gbkcp1250cp1251latin1gb2312cp1252latin2cp1253latin3cp1254latin4cp1255csbig5latin5utf_16cp1256ibm866latin6cp1257cp1258greek8ibm819visualkoreaneuc_jpkoi8_rkoi8_reuc_krx_sjiskoi8_utis_620ksc5601gb_2312dos_874cn_big5unicodechineselogicalcskoi8rcseuckrkoi8_rux_cp1250ksc_5601x_cp1251iso88591csgb2312x_cp1252iso88592x_cp1253iso88593ecma_114x_cp1254iso88594x_cp1255iso88595x_x_big5x_cp1256csibm866iso88596x_cp1257iso88597asmo_708ecma_118elot_928x_cp1258iso88598iso88599utf_16beutf_16leus_asciims_kanjix_euc_jpiso885910iso8859_1iso885911iso8859_2iso8859_3iso885913iso8859_4iso885914iso8859_5iso885915iso8859_6iso8859_7iso8859_8iso_ir_58iso8859_9csunicodeshift_jisshift_jisiso_ir_100iso8859_10iso_ir_110gb_2312_80iso_8859_1iso_8859_1iso_ir_101iso8859_11iso_8859_2iso_8859_2hz_gb_2312iso_8859_3iso_8859_3iso8859_13iso_8859_4iso_8859_4iso8859_14iso_ir_144iso_8859_5iso_8859_5iso8859_15iso_8859_6iso_8859_6iso_ir_126iso_8859_7iso_8859_7iso_ir_127iso_ir_157iso_8859_8iso_8859_8iso_ir_138iso_ir_148iso_8859_9iso_8859_9iso_ir_109iso_ir_149big5_hkscscsshiftjisiso_8859_10iso_8859_11csisolatin1csisolatin2iso_8859_13csisolatin3iso_8859_14csisolatin4iso_8859_15iso_8859_15csisolatin5iso_8859_16csisolatin6windows_949csisolatin9csiso88596ecsiso88598eunicodefffeunicodefeffcsmacintoshcsiso88596icsiso88598iwindows_31jx_mac_romaniso_2022_cniso_2022_jpcsiso2022jpiso_2022_krcsiso2022kriso_8859_6_eiso_8859_8_eiso_8859_6_iiso_8859_8_isun_eu_greekcsksc56011987unicode20utf8unicode11utf8ks_c_5601_1987ansi_x3.4_1968ks_c_5601_1989csiso58gb231280iso_10646_ucs_2iso_8859_1:1987iso_8859_2:1987iso_8859_6:1987iso_8859_7:1987iso_8859_3:1988iso_8859_4:1988iso_8859_5:1988iso_8859_8:1988x_unicode20utf8iso_8859_9:1989csisolatingreekx_mac_ukrainianiso_2022_cn_extcsisolatinarabiccsisolatinhebrewunicode_1_1_utf_8csisolatincyrilliccseucpkdfmtjapanese
cmp rax, qword [r9 + r10 + 8]
ja 0x140006990
jne 0x140006a10
mov byte [rsp + 0x4e1], al
mov byte [rsp + 0x528], 3
mov byte [rsp + 0x530], 3
cmp edi, 0x3b9aca00
jne 0x140006e60
call fcn.1401c0530
movzx eax, byte [rsp + 0x530]
test al, al
jne 0x140006060
mov qword [rsp + 0x100], 0
lea rcx, [rsp + 0x100]
call sub.kernel32.dll_QueryPerformanceCounter
test eax, eax
je 0x14000af1d
mov eax, dword [rsp + 0x90]
mov ecx, dword [rsp + 0x93]
mov dword [rsp + 0x543], ecx
mov dword [rsp + 0x540], eax
mov rax, rdx
shl rax, 0x10
movzx ecx, bpl
shl rcx, 8
or rcx, rax
movzx eax, byte [rsp + 0x48]
or rax, rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x2e0], rcx
mov qword [rsp + 0x2e8], rax
mov rbp, qword [rsp + 0x40]
mov qword [rsp + 0x2f0], rbp
mov qword [rsp + 0x88], r10
mov qword [rsp + 0x2f8], r10
mov qword [rsp + 0x300], r8
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x308], r14
mov qword [rsp + 0x310], r11
mov qword [rsp + 0xf0], rdi
mov byte [rsp + 0x318], dil
mov eax, dword [rsp + 0x540]
mov ecx, dword [rsp + 0x543]
mov dword [r12 + 0x17c], ecx
mov dword [r12 + 0x179], eax
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x320], r9
mov qword [rsp + 0x328], rbx
mov qword [rsp + 0x330], rbx
mov qword [rsp + 0x338], rsi
mov rdx, r11
shl rdx, 5
add rdx, r8
mov qword [rsp + 0xd0], r8
mov r10, rbp
mov r14, r11
nop word cs:[rax + rax]
test r10, r10
je 0x140007970
cmp r10, 1
jne 0x140007b56
cmp rdx, r8
je 0x140007b56
mov r9, qword [r8]
mov rax, qword [r8 + 8]
lea rcx, [rsp + 0x318]
cmp byte [rcx], 0
mov r10, rbx
cmove r10, rbx
mov r11, rax
sub r11, r9
jb case.0x14000609b.1
mov r10d, 2
mov eax, 5
lea r9, str.charset
mov rcx, r13
jmp 0x140007a2a
movzx r11d, byte [r9]
lea edi, [r11 - 0x41]
cmp dil, 0x1a
setb dil
shl dil, 5
or dil, r11b
cmp dil, 0x63
jne 0x140007900
movzx r11d, byte [r9 + 1]
lea edi, [r11 - 0x41]
cmp dil, 0x1a
setb dil
shl dil, 5
or dil, r11b
cmp dil, 0x68
jne 0x140007900
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x198], r14
mov qword [rsp + 0x578], rbx
mov qword [rsp + 0x570], rbx
mov qword [rsp + 0x568], rsi
xor ecx, ecx
mov edi, dword [rsp + 0x58]
lea r9, [0x1401f60f8]
mov r14, qword [rsp + 0x80]
jmp 0x1400061a5
xorps xmm0, xmm0
movaps xmmword [rsp + 0x640], xmm0
lea rbx, str.combase.dll
lea rax, [0x14029fc18]
mov qword [rsp + 0x70], rax
jmp 0x140008611
mov rax, qword [rsp + 0x4b8]
mov qword [rsp + 0x70], rax
mov rbx, qword [rsp + 0x4c0]
movups xmm0, xmmword [rsp + 0x4c8]
movaps xmmword [rsp + 0x640], xmm0
lea rax, [0x1402013f8]
mov qword [rsp + 0x4b8], rax
lea rax, str.combase.dll
mov qword [rsp + 0x4c0], rax
xorps xmm0, xmm0
movups xmmword [r12 + 0x328], xmm0
cmp byte [rsp + 0x4e0], 0
je 0x140008611
lea rcx, [rsp + 0x4d0]
mov rax, qword [rsp + 0x4b8]
mov rdx, qword [rsp + 0x4c0]
mov r8, qword [rsp + 0x4c8]
call qword [rax + 0x10]
mov byte [rsp + 0x4e0], 0
lea rcx, [rsp + 0x498]
call fcn.14014f700
movaps xmm0, xmmword [rsp + 0x640]
movaps xmmword [rsp + 0x730], xmm0
mov byte [rsp + 0x4e1], 1
movaps xmmword [rsp + 0xc10], xmm0
mov rsi, qword [rsp + 0x470]
cmp qword [rsi + 0x18], 0
je 0x140008667
mov r8, qword [rsi + 0x10]
mov rcx, qword [0x1402d9150]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
mov byte [rsp + 0x528], 1
movdqa xmm0, xmmword [rsp + 0xc10]
movdqa xmmword [rsp + 0x630], xmm0
mov rcx, r15
call fcn.1401828b0
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x1400086fd
movdqa xmm0, xmmword [rsp + 0x630]
movdqu xmmword [rsp + 0xc00], xmm0
mov qword [rsp + 0xbf0], rax
mov qword [rsp + 0xbf8], rbx
mov rsi, qword [rsp + 0x340]
mov r14, qword [rsp + 0xc00]
cmp r14, 3
lea rbp, [rsp + 0x7e0]
jae 0x14000876d
cmp r14, 2
je 0x140008784
cmp dword [rsp + 0x2e0], 2
lea rbp, [rsp + 0x7e0]
je 0x140008765
cmp byte [rsp + 0x318], 0
je 0x14000873a
mov r13, rbx
jmp 0x140009204
movzx eax, word [rbx]
xor eax, 0xbbef
movzx ecx, byte [rbx + 2]
xor ecx, 0xbf
or cx, ax
je 0x1400087f0
mov r8, rdi
jmp 0x1400052b0
lea rax, [0x1401f6287]
mov qword [rsp + 0x1a0], rax
lea r14, [rsp + 0x1a0]
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0xfb4d2cc4ae541653
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.140070090
movabs rcx, 0x6b1f80feb9c3e587
xor rcx, qword [rax]
movabs rdx, 0x2596a7b5fb01a2be
xor rdx, qword [rax + 8]
movabs r8, 0xfdfe35e8dd6f9fa5
xor r8, qword [rax + 0x10]
movabs r9, 0x7662176c53262169
xor r9, qword [rax + 0x18]
movabs r10, 0x6e987670a57e284b
xor r10, qword [rax + 0x20]
movabs r11, 0xdc0fa4476a9e8d3b
xor r11, qword [rax + 0x28]
movabs rsi, 0xddceaefa386d5084
xor rsi, qword [rax + 0x30]
mov edi, 0xa2cb4b2
xor edi, dword [rax + 0x38]
movzx ebx, byte [rax + 0x3e]
movzx eax, word [rax + 0x3c]
mov ebp, eax
shr ebp, 8
xor al, 0xf
xor bpl, 0xe7
movzx eax, al
movzx ebp, bpl
shl ebp, 8
or ebp, eax
mov qword [rsp + 0x1a0], rcx
mov qword [rsp + 0x1a8], rdx
mov qword [rsp + 0x1b0], r8
mov qword [rsp + 0x1b8], r9
mov qword [rsp + 0x1c0], r10
mov qword [rsp + 0x1c8], r11
mov qword [rsp + 0x1d0], rsi
mov dword [rsp + 0x1d8], edi
mov word [rsp + 0x1dc], bp
xor bl, 0xed
mov byte [rsp + 0x1de], bl
mov qword [rsp + 0x668], r14
lea rax, [rsp + 0x668]
mov qword [rsp + 0x748], rax
lea rax, [0x1401c8bd0]
mov qword [rsp + 0x750], rax
lea rax, str.combase.dll
mov qword [rsp + 0x7e0], rax
mov qword [rsp + 0x7e8], 2
mov qword [rsp + 0x800], 0
lea rax, [rsp + 0x748]
mov qword [rsp + 0x7f0], rax
mov qword [rsp + 0x670], 0x3f
mov qword [rsp + 0x7f8], 1
lea rcx, [rsp + 0x7e0]
call fcn.1401bff70
call fcn.140057d80
mov ecx, 0x190
call fcn.1401c1480
ud2
lea rax, [0x1401fab65]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x5a9dde724e2bd2f6
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.14006ff10
movabs rcx, 0xefd5cfa3dad01b1a
xor rcx, qword [rax]
movabs rdx, 0xb92e7436921112d3
xor rdx, qword [rax + 8]
movabs r8, 0x3561dd4482b973a2
xor r8, qword [rax + 0x10]
movabs r9, 0x10ecd253d7e21e20
xor r9, qword [rax + 0x18]
movabs r10, 0x4f9750ccde781700
xor r10, qword [rax + 0x20]
mov r11d, 0x145ec36b
xor r11d, dword [rax + 0x28]
mov qword [rsp + 0x7e0], rcx
mov qword [rsp + 0x7e8], rdx
mov qword [rsp + 0x7f0], r8
mov qword [rsp + 0x7f8], r9
mov qword [rsp + 0x800], r10
mov dword [rsp + 0x808], r11d
mov qword [rsp + 0xad0], r13
mov qword [rsp + 0xad8], 0x2c
lea rax, [rsp + 0xad0]
mov qword [rsp + 0x668], rax
lea rax, [0x1401c8bd0]
mov qword [rsp + 0x670], rax
lea rax, str.combase.dll
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 2
mov qword [rsp + 0x1c0], 0
lea rax, [rsp + 0x668]
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], 1
lea rcx, [rsp + 0x1a0]
call fcn.1401bff70
call fcn.140057d80
mov ecx, 0xc8
call fcn.1401c1480
ud2
call sub.kernel32.dll_GetLastError
ud2
lea rax, [0x1401f6f51]
mov qword [rsp + 0x1a0], rax
mov rcx, qword [rsp + 0x1a0]
movabs rax, 0x49d423bbf8b823b3
mov qword [rsp + 0x1a0], rax
mov rdx, qword [rsp + 0x1a0]
call fcn.1400704b0
movabs rcx, 0xb22768260e94fc6a
xor rcx, qword [rax]
movabs rdx, 0x7a46868bbb537157
xor rdx, qword [rax + 8]
movabs r8, 0xe22cc2ccf861cbc0
xor r8, qword [rax + 0x10]
movabs r9, 0xfb721a4834da8136
xor r9, qword [rax + 0x18]
mov r10d, 0xbf538cf5
xor r10d, dword [rax + 0x20]
movzx eax, byte [rax + 0x24]
xor al, 0xf3
mov qword [rsp + 0x7e0], rcx
mov qword [rsp + 0x7e8], rdx
mov qword [rsp + 0x7f0], r8
mov qword [rsp + 0x7f8], r9
mov dword [rsp + 0x800], r10d
mov byte [rsp + 0x804], al
lea rax, [rsp + 0x7e0]
mov qword [rsp + 0x668], rax
mov qword [rsp + 0x670], 0x25
lea rax, [rsp + 0x668]
mov qword [rsp + 0x748], rax
lea rax, [0x1401c8bd0]
mov qword [rsp + 0x750], rax
lea rax, str.combase.dll
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 2
mov qword [rsp + 0x1c0], 0
lea rax, [rsp + 0x748]
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], 1
lea rcx, [rsp + 0x1a0]
call fcn.1401bff70
mov ecx, 0x12c
call fcn.1401c1480
ud2
ud2
ud2