Function at 0x140025780
Capabilities:
Check for debugger via api
Check for process debug object
Check for time delay via queryperformancecounter
Check processdebugflags
Check processdebugport
Create process on windows
Encode data using base64
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1f8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x160], xmm6
mov eax, dword [0x141dc2450]
sub eax, dword [0x141dc2454]
xor eax, 0x28830840
or eax, 0xd634408c
cmp eax, 0xae53780c
je 0x140025932
mov eax, dword [0x141dc2458]
add eax, dword [0x141dc245c]
imul eax, eax, 0xb5f145fa
add eax, 0xee91b6ea
mov ecx, 0xa06ae131
imul rcx, rax
shr rcx, 0x3f
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov qword [rbp + 0x108], rsp
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov qword [rbp + 0x110], rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov qword [rbp - 0x50], rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov qword [rbp - 0x48], rsp
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov qword [rbp - 0x40], rsp
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov qword [rbp + 0x100], rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov r13, rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov rdx, rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov r8, rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov r14, rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov r12, rsp
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov rsi, rsp
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov r10, rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov r11, rsp
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov rbx, rsp
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov rax, rsp
cmp ecx, 0x3870fa0e
jbe 0x140025a2e
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
jmp 0x1400257c3
mov qword [rbp - 0x18], rsi
mov qword [rbp + 0x128], r12
mov qword [rbp + 0x148], r14
mov qword [rbp + 0x120], rbx
mov qword [rbp + 0x118], r11
mov qword [rbp + 0x68], r10
mov qword [rbp + 0x150], rdi
mov qword [rbp - 0x10], r15
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x10], rax
mov qword [rbp + 8], r9
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x28], rdx
xor eax, eax
test al, al
jne 0x140025b45
mov r13d, dword [0x141dc2460]
or r13d, dword [0x141dc2464]
or r13d, 0x2010b1cc
and r13d, 0x64d0b1ce
add r13d, 0xcf1a7ab7
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov rsi, rsp
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov r15, rsp
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov r12, rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov rbx, rsp
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov r14, rsp
mov qword [rbp + 0x90], 0
mov dword [rbp + 0x70], 0
mov dword [rbp + 0x48], 0
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
lea r8, [rbp + 0x90]
mov rcx, rax
mov edx, 8
call sub.ADVAPI32.dll_OpenProcessToken
add rsp, 0x20
cmp r13d, 0x74c98836
jbe 0x140025bd2
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov qword [rbp + 0x90], 0
mov dword [rbp + 0x70], 0
mov dword [rbp + 0x48], 0
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
lea r8, [rbp + 0x90]
mov rcx, rax
mov edx, 8
call sub.ADVAPI32.dll_OpenProcessToken
add rsp, 0x20
jmp 0x140025a7b
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x20], r15
test eax, eax
mov r12, rsi
mov r15, qword [rbp + 0x148]
je 0x140025cb0
nop dword [rax]
mov eax, dword [0x141dc2478]
or eax, dword [0x141dc247c]
xor eax, 0x74e38a6b
add eax, 0x1b590115
imul rax, rax, 0x7faaeec5
shr rax, 0x3e
cmp eax, 0xfd649ed6
je 0x140025bf0
mov rcx, qword [rbp + 0x90]
sub rsp, 0x30
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x70]
mov edx, 0x14
mov r9d, 4
call sub.ADVAPI32.dll_GetTokenInformation
add rsp, 0x30
test eax, eax
je 0x140025cb0
mov eax, dword [rbp + 0x70]
nop dword [rax + rax]
mov ecx, dword [0x141dc2480]
xor ecx, dword [0x141dc2484]
add ecx, 0x4d1522d9
xor ecx, 0xc0028051
and ecx, 0xc19281d7
cmp ecx, 0x31e06729
jb 0x140025c50
test eax, eax
je 0x140025cef
mov eax, dword [0x141dc2730]
mov ecx, dword [0x141dc2734]
add eax, ecx
add eax, 0x1aa6a17f
and eax, 0xf3456906
add eax, 0xdb6d3128
cmp eax, 0xb47db639
mov rbx, qword [rbp + 0x128]
jae 0x140027b78
jmp 0x140027b9b
mov eax, dword [0x141dc2468]
sub eax, dword [0x141dc246c]
imul eax, eax, 0x34e31801
add eax, 0x796568ba
cmp eax, 0x1412f55c
jb 0x140025cb0
nop
mov eax, dword [0x141dc2470]
xor edx, edx
div dword [0x141dc2474]
and eax, 0xc6301f5f
xor eax, 0x7496716
cmp eax, 0xde5a5531
ja 0x140025cd0
mov qword [rbp - 8], r14
nop word cs:[rax + rax]
mov eax, dword [0x141dc2488]
add eax, dword [0x141dc248c]
cmp eax, 0xc6ca29a3
je 0x140025d00
mov edx, 4
nop dword [rax + rax]
mov eax, dword [0x141dc2490]
xor eax, dword [0x141dc2494]
cmp eax, 0x91248dc4
je 0x140025d20
mov qword [rbp], rdi
mov qword [rbp + 0x128], rbx
lea rax, [rdx + rdx]
mov qword [rbp - 0x38], rax
nop word cs:[rax + rax]
mov eax, dword [0x141dc2498]
or eax, dword [0x141dc249c]
imul eax, eax, 0x395a8000
cmp eax, 0xfc56b873
je 0x140025d50
lea r13, [rbp - 0x80]
xorps xmm6, xmm6
mov qword [rbp - 0x30], r12
nop word cs:[rax + rax]
mov eax, dword [0x141dc24a0]
and eax, dword [0x141dc24a4]
imul eax, eax, 0xc0b89866
or eax, 0xfef9dbbd
cmp eax, 0x71afb7d8
mov rdi, qword [rbp + 0x100]
jb 0x140025dc6
nop word cs:[rax + rax]
sub rsp, 0x20
mov rcx, rdi
call fcn.140091550
add rsp, 0x20
xor eax, eax
test al, al
je 0x140025de0
sub rsp, 0x20
mov rcx, rdi
call fcn.140091550
add rsp, 0x20
jmp 0x140025db0
mov rax, qword [rdi]
mov qword [rbp + 0x148], rax
mov rbx, qword [rbp + 0x128]
lea rsi, [rbp + 0x48]
nop word cs:[rax + rax]
mov eax, dword [0x141dc24a8]
and eax, dword [0x141dc24ac]
and eax, 0x1625dab
add eax, 0xc558b427
and eax, 0x70080c1
cmp eax, 0xe1043b78
ja 0x140025e00
mov r15, qword [rdi + 8]
movabs rax, 0x8000000000000000
cmp qword [rbp + 0x148], rax
mov qword [rbp + 0x150], r15
mov ecx, 0
je 0x140027210
mov eax, dword [0x141dc24b0]
xor edx, edx
div dword [0x141dc24b4]
mov r14, qword [rbp + 0x108]
nop
mov eax, dword [0x141dc24b8]
or eax, dword [0x141dc24bc]
xor eax, 0x45006208
and eax, 0x6d597fe8
imul eax, eax, 0x344187b8
cmp eax, 0x23552bed
je 0x140025e60
mov rbx, qword [rdi + 0x10]
test cl, cl
je 0x140025eb0
sub rsp, 0x20
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.140054a50
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dc24c0]
add eax, dword [0x141dc24c4]
imul eax, eax, 0xfc34ff2b
imul rdi, rax, 0x653eaba7
shr rdi, 0x3e
or edi, 0x6a836868
sub rsp, 0x20
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.140054a50
add rsp, 0x20
cmp edi, 0x769fa23d
ja 0x140025eb0
mov eax, dword [0x141dc24c8]
xor edx, edx
div dword [0x141dc24cc]
add eax, 0x658ecf6d
or eax, 0xe527da4
add eax, 0x5b54a098
cmp eax, 0x6f66022f
jb 0x140025ef1
cmp qword [r14], 0
lea rdi, [rbp - 0x68]
lea r15, [rbp + 0x70]
jne 0x1400273cd
mov eax, dword [0x141dc24d0]
xor edx, edx
div dword [0x141dc24d4]
nop word cs:[rax + rax]
mov eax, dword [0x141dc24d8]
or eax, dword [0x141dc24dc]
add eax, 0xad10b571
xor eax, 0x54a1352f
imul rax, rax, 0x6b94eaf3
shr rax, 0x3d
cmp eax, 0x10bb7266
je 0x140025f40
mov rbx, qword [r14 + 8]
mov r14, qword [r14 + 0x10]
mov eax, dword [0x141dc24e0]
xor edx, edx
div dword [0x141dc24e4]
nop
mov eax, dword [0x141dc24e8]
add eax, dword [0x141dc24ec]
cmp eax, 0x55ef0775
je 0x140025f80
test r14, r14
js 0x140027397
mov eax, dword [0x141dc24f8]
add eax, dword [0x141dc24fc]
xor eax, 0x2ee52855
add eax, 0x9c562545
xor eax, 0x6bca4033
cmp eax, 0xab1bc8f2
ja 0x140025f9c
test r14, r14
je 0x140026000
mov rsi, rdi
movzx eax, byte [0x141dda6b8]
mov eax, dword [0x141dc2500]
xor edx, edx
div dword [0x141dc2504]
and eax, 0x4f189b55
xor eax, 0x21b0113e
imul rax, rax, 0x3e52e17f
shr rax, 0x3c
cmp eax, 0x56fef5b7
jbe 0x1400262e0
jmp 0x140026312
mov r12d, 1
mov eax, dword [str.n8A_t9]
or eax, dword [0x141dc252c]
xor eax, 0xd49f30df
imul rax, rax, 0x4feb00b
shr rax, 0x3a
imul eax, eax, 0x9bb51b14
cmp eax, 0x63f1f8c8
jbe 0x1400260fe
sub rsp, 0x20
mov rcx, r12
mov rdx, rbx
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
add rsp, 0x20
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 1
mov qword [rbp + 0x38], 0
lea rax, [r12 + r14]
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], rax
mov word [rbp + 0x80], 0
mov dword [rbp + 0x88], 1
sub rsp, 0x20
mov rcx, rdi
mov rdx, r15
call fcn.140083450
add rsp, 0x20
mov qword [rbp + 0x48], 1
mov qword [rbp + 0x50], 1
mov word [rbp + 0x58], 0
mov dword [rbp + 0x60], 1
sub rsp, 0x20
mov rcx, r13
mov rdx, rsi
call fcn.140083450
add rsp, 0x20
mov dword [rbp + 0x15c], 0
movaps xmmword [rbp + 0xf0], xmm6
movaps xmmword [rbp + 0xe0], xmm6
movaps xmmword [rbp + 0xd0], xmm6
movaps xmmword [rbp + 0xc0], xmm6
movaps xmmword [rbp + 0xb0], xmm6
movaps xmmword [rbp + 0xa0], xmm6
movaps xmmword [rbp + 0x90], xmm6
mov r15, r14
nop word cs:[rax + rax]
mov eax, dword [0x141dc2530]
imul eax, dword [0x141dc2534]
add eax, 0x11e3fc77
imul rax, rax, 0x248e0a0d
shr rax, 0x3d
imul r14d, eax, 0xa902ead2
sub rsp, 0x20
mov rcx, r12
mov rdx, rbx
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rsp, 0x20
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 1
mov qword [rbp + 0x38], 0
lea rax, [r12 + r15]
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], rax
mov word [rbp + 0x80], 0
mov dword [rbp + 0x88], 1
sub rsp, 0x20
lea rcx, [rbp - 0x68]
lea rdx, [rbp + 0x70]
call fcn.140083450
add rsp, 0x20
mov qword [rbp + 0x48], 1
mov qword [rbp + 0x50], 1
mov word [rbp + 0x58], 0
mov dword [rbp + 0x60], 1
sub rsp, 0x20
mov rcx, r13
mov rdx, rsi
call fcn.140083450
add rsp, 0x20
mov rax, qword [rbp - 0x60]
mov rdi, qword [rbp - 0x78]
mov dword [rbp + 0x15c], 0
movaps xmmword [rbp + 0xf0], xmm6
movaps xmmword [rbp + 0xe0], xmm6
movaps xmmword [rbp + 0xd0], xmm6
movaps xmmword [rbp + 0xc0], xmm6
movaps xmmword [rbp + 0xb0], xmm6
movaps xmmword [rbp + 0xa0], xmm6
movaps xmmword [rbp + 0x90], xmm6
cmp r14d, 0xc5c2686e
je 0x140026110
mov rbx, rax
mov qword [rbp + 0x118], r12
mov qword [rbp + 0x68], r15
movabs rax, 0x3fffffffffffffff
mov r14d, 4
cmp r14, rax
ja 0x1400273ea
movzx eax, byte [0x141dda6b8]
sub rsp, 0x20
xor ecx, ecx
mov rdx, qword [rbp - 0x38]
call fcn.1400bf230
add rsp, 0x20
mov rcx, rax
lea rsi, [0x141db82d8]
nop word cs:[rax + rax]
mov eax, dword [0x141dc2550]
xor edx, edx
div dword [0x141dc2554]
or eax, 0xc9b97ffe
xor eax, 0x323f3686
add eax, 0x95f5cd74
cmp eax, 0x71ac183b
jb 0x140026270
test rcx, rcx
mov r11d, 0
mov r9d, 0xfe5663b1
je 0x140027462
mov eax, dword [0x141dc2570]
and eax, dword [0x141dc2574]
add eax, 0x707a3cdb
xor eax, 0x211709d8
cmp eax, 0xf0b0a33d
mov edx, 0xaa28c13b
jbe 0x140026370
jmp 0x14002639b
mov eax, dword [0x141dc2508]
xor eax, dword [0x141dc250c]
imul edi, eax, 0xe6b1b993
add edi, 0xbf361697
sub rsp, 0x20
xor ecx, ecx
mov rdx, r14
call fcn.1400bf230
add rsp, 0x20
cmp edi, 0x1f8d23e4
jae 0x140026330
sub rsp, 0x20
xor ecx, ecx
mov rdx, r14
call fcn.1400bf230
add rsp, 0x20
jmp 0x1400262e0
mov r12, rax
mov eax, dword [0x141dc2510]
or eax, dword [0x141dc2514]
imul eax, eax, 0x5702e3e
add eax, 0x5eb1f51d
cmp eax, 0x4d430a23
jb 0x140026333
test r12, r12
mov rdi, rsi
lea rsi, [rbp + 0x48]
jne 0x140026006
jmp 0x140027482
mov eax, dword [0x141dc2578]
add eax, dword [0x141dc257c]
imul rax, rdx
shr rax, 0x3f
or eax, 0xc88e4afa
imul eax, eax, 0xe845d6cf
mov word [rcx], 0x72
cmp eax, 0x23f97ce9
jne 0x1400263b0
mov word [rcx], 0x72
jmp 0x140026370
mov eax, dword [0x141dc2580]
and eax, dword [0x141dc2584]
or eax, 0x68157837
imul eax, eax, 0xfd20b858
or eax, 0xbbab884a
cmp eax, 0xfdadcabf
ja 0x140026440
nop word cs:[rax + rax]
mov eax, dword [0x141dc2588]
xor edx, edx
div dword [0x141dc258c]
or eax, 0x1080000
xor eax, 0x10000800
and eax, 0x11088a11
mov qword [rbp + 0x130], r14
mov qword [rbp + 0x138], rcx
cmp eax, 0xea1c4678
ja 0x140026440
mov eax, dword [0x141dc2590]
imul eax, dword [0x141dc2594]
add eax, 0xcb11dc8
or eax, 0x739a1f18
xor eax, 0x33aed8c8
cmp eax, 0x625006f
jae 0x140026450
jmp 0x140026474
mov qword [rbp + 0x130], r14
mov qword [rbp + 0x138], rcx
jmp 0x1400263e0
mov eax, dword [0x141dc2598]
add eax, dword [0x141dc259c]
imul eax, eax, 0xbbdee98
mov qword [rbp + 0x140], 1
cmp eax, 0xe09955e2
jne 0x140026490
mov qword [rbp + 0x140], 1
jmp 0x140026450
mov r12d, 1
xor r14d, r14d
lea r13, [0x141db82d3]
test r14w, r14w
je 0x1400264c0
nop word cs:[rax + rax]
xor r15d, r15d
jmp 0x14002666b
movabs r14, 0x14000000070
nop word [rax + rax]
mov eax, dword [0x141dc25a0]
add eax, dword [0x141dc25a4]
and eax, 0x550c0411
or eax, 0xaae2936c
imul eax, eax, 0x35611575
cmp eax, 0xf7556af3
ja 0x1400264d0
nop word cs:[rax + rax]
mov eax, dword [0x141dc25a8]
sub eax, dword [0x141dc25ac]
imul eax, eax, 0x7e2ac4ea
add eax, 0x62f737cd
cmp eax, 0xcc0add0
jb 0x140026500
cmp r13, rsi
je 0x1400267f0
movzx r14d, byte [r13]
test r14b, r14b
js 0x140026570
inc r13
nop word cs:[rax + rax]
mov eax, dword [0x141dc25c0]
or eax, dword [0x141dc25c4]
or eax, 0x33bef623
add eax, 0x2e50244c
cmp eax, 0x325efd1a
jae 0x140026540
jmp 0x140026650
mov eax, dword [0x141dc25b0]
xor edx, edx
div dword [0x141dc25b4]
nop
test r11b, r11b
jne 0x140026580
mov eax, r14d
and eax, 0x1f
nop dword [rax + rax]
mov edx, dword [0x141dc25b8]
sub edx, dword [0x141dc25bc]
xor edx, 0xf33825d1
add edx, 0x3f63f6c7
imul rdx, rdx, 0x7a11b411
shr rdx, 0x3e
cmp edx, 0x1ce19cab
je 0x140026590
movzx r8d, byte [r13 + 1]
and r8d, 0x3f
cmp r14b, 0xdf
jbe 0x140026636
movzx edx, byte [r13 + 2]
shl r8d, 6
and edx, 0x3f
or edx, r8d
cmp r14b, 0xf0
jb 0x140026766
movzx r8d, byte [r13 + 3]
add r13, 4
and eax, 7
shl eax, 0x12
shl edx, 6
mov r9d, dword [0x141dc25c8]
mov r10d, dword [0x141dc25cc]
add r9d, r10d
add r9d, 0x78417e17
cmp r9d, 0xf5c4840
jb 0x1400265f5
and r8d, 0x3f
or edx, r8d
or edx, eax
mov r14d, edx
mov r9d, 0xfe5663b1
cmp r14d, 0xffff
jbe 0x140026650
jmp 0x14002677f
add r13, 2
shl eax, 6
or eax, r8d
mov r14d, eax
nop word cs:[rax + rax]
mov eax, dword [0x141dc25d0]
and eax, dword [0x141dc25d4]
or eax, 0xf1546098
xor r15d, r15d
cmp eax, 0x473599df
je 0x140026650
cmp r12, qword [rbp + 0x130]
je 0x140026700
mov eax, dword [0x141dc25e8]
add eax, dword [0x141dc25ec]
imul eax, eax, 0x1ef0fc9c
imul rax, r9
shr rax, 0x3d
cmp eax, 0x9ec17290
jne 0x1400266b0
mov word [rcx + r12*2], r14w
lea rax, [r12 + 1]
mov qword [rbp + 0x140], rax
nop word [rax + rax]
mov eax, dword [0x141dc25f0]
and eax, dword [0x141dc25f4]
shr eax, 1
imul rdx, rax, 0x41b40a01
shr rdx, 0x3a
and edx, 1
or edx, 0xc779d8c0
lea rax, [r12 + 1]
mov word [rcx + r12*2], r14w
mov qword [rbp + 0x140], rax
cmp edx, 0x4ac1c86f
jb 0x1400266b0
mov r12, rax
mov r14d, r15d
test r14w, r14w
jne 0x1400264b0
jmp 0x1400264c0
lea rax, [0x141db82d2]
sub rax, r13
add rax, 8
movabs rcx, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
cmp r15w, 1
sbb rdx, 0
lea r8, [rdx + 2]
sub rsp, 0x30
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rbp + 0x130]
mov rdx, r12
call fcn.1400fce40
mov r9d, 0xfe5663b1
xor r11d, r11d
add rsp, 0x30
mov rcx, qword [rbp + 0x138]
jmp 0x140026678
add r13, 3
shl eax, 0xc
or edx, eax
mov r14d, edx
cmp r14d, 0xffff
jbe 0x140026650
lea eax, [r14 + 0xff0000]
shr eax, 0xa
mov edx, dword [0x141dc25d8]
and edx, dword [0x141dc25dc]
or edx, 0xfdfffffb
cmp edx, 0x6a8d2c87
jb 0x140026789
or eax, 0xd800
and r14d, 0x3ff
mov r15d, r14d
or r15d, 0xdc00
mov r14d, eax
nop dword [rax]
mov eax, dword [0x141dc25e0]
and eax, dword [0x141dc25e4]
imul eax, eax, 0xb10ecdcc
add eax, 0x1b34760c
cmp eax, 0x35752738
jb 0x1400267c0
jmp 0x14002666b
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x120], rax
mov eax, dword [0x141dc25f8]
add eax, dword [str.Ru]
imul eax, eax, 0x487314d1
xor eax, 0xa61e8ccd
add eax, 0xd21a4c67
cmp eax, 0xc5735aaa
mov r8, qword [sym.imp.ole32.dll_CoInitializeEx]
jbe 0x140026882
mov r15, qword [rbp + 0x138]
sub rsp, 0x20
xor ecx, ecx
mov edx, 6
mov rsi, r8
call r8
add rsp, 0x20
mov qword [rbp + 0x90], r14
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], rbx
mov qword [rbp + 0xb0], rdi
mov dword [rbp + 0xc0], 1
sub rsp, 0x20
lea rcx, [rbp + 0x90]
call qword [sym.imp.shell32.dll_ShellExecuteExW]
mov r8, rsi
add rsp, 0x20
mov rsi, r14
mov r13, qword [sym.imp.shell32.dll_ShellExecuteExW]
mov r14, rdi
nop
mov eax, dword [0x141dc2600]
sub eax, dword [0x141dc2604]
xor eax, 0x5c1b9c38
imul r15d, eax, 0xd6bed707
add r15d, 0xa516fdec
mov r12, qword [rbp + 0x138]
sub rsp, 0x20
xor ecx, ecx
mov edx, 6
mov rdi, r8
call r8
add rsp, 0x20
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], rbx
mov qword [rbp + 0xb0], r14
mov dword [rbp + 0xc0], 1
sub rsp, 0x20
lea rcx, [rbp + 0x90]
call r13
mov r8, rdi
add rsp, 0x20
cmp r15d, 0x497f34c1
ja 0x140026890
mov rbx, qword [rbp + 0xf8]
test eax, eax
sete cl
mov edx, dword [0x141dc2608]
and edx, dword [0x141dc260c]
imul r8d, edx, 0xb8dd17d6
add r8d, 0x963854b5
xor r8d, 0x65351b50
test rbx, rbx
sete dl
cmp r8d, 0x68d9fc21
jb 0x140026916
or cl, dl
mov r14, qword [sym.imp.KERNEL32.dll_HeapFree]
movabs r15, 0x595f673b99754862
je 0x140026a50
nop word cs:[rax + rax]
mov eax, dword [0x141dc2610]
imul eax, dword [0x141dc2614]
add eax, 0xc709d669
imul rax, rax, 0x46368f8d
shr rax, 0x3e
or eax, 0xaf2972e8
cmp eax, 0x77388602
je 0x140026970
cmp qword [rbp + 0x120], 0
je 0x140026a23
mov rbx, qword [0x141dda6a0]
mov eax, dword [0x141dc2618]
xor edx, edx
div dword [0x141dc261c]
xor eax, 0xcb446136
add eax, 0x466a0384
xor eax, 0xca9a4ae0
cmp eax, 0x54177a43
jae 0x1400269f0
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, r12
call r14
add rsp, 0x20
nop word cs:[rax + rax]
mov edi, dword [0x141dc2620]
or edi, dword [0x141dc2624]
add edi, 0x7ae3c9ec
or edi, 0x5765896a
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, r12
call r14
add rsp, 0x20
cmp edi, 0xd0b99db9
je 0x1400269f0
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140026a30
mov edi, 0xffffffff
mov esi, 0x80ecc589
mov r12, qword [rbp + 0x118]
jmp 0x140026c4d
mov eax, dword [0x141dc2628]
add eax, dword [0x141dc262c]
or eax, 0x5201c5d4
cmp eax, 0xa0bfb0e3
mov rsi, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
je 0x140026aa6
nop
mov eax, dword [0x141dc2630]
xor edx, edx
div dword [0x141dc2634]
mov edi, eax
add edi, 0x8191bd96
and edi, 0x3a48ea61
sub rsp, 0x20
mov rcx, rbx
mov edx, 0xffffffff
call rsi
add rsp, 0x20
cmp edi, 0x71319ede
jbe 0x140026ac0
sub rsp, 0x20
mov rcx, rbx
mov edx, 0xffffffff
call rsi
add rsp, 0x20
jmp 0x140026a70
mov rbx, qword [rbp + 0xf8]
mov eax, dword [0x141dc2638]
xor edx, edx
div dword [0x141dc263c]
and eax, 0x79fae0a
xor eax, 0x6c5c8fb7
imul eax, eax, 0x11b6ba28
cmp eax, 0xf6596a82
lea rsi, [rbp + 0x15c]
mov rdi, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
ja 0x140026c90
nop
sub rsp, 0x20
mov rcx, rbx
mov rdx, rsi
call rdi
add rsp, 0x20
mov ecx, eax
xor eax, eax
test al, al
jne 0x140026c90
mov r15d, dword [rbp + 0x15c]
mov eax, dword [0x141dc2640]
xor edx, edx
div dword [0x141dc2644]
nop word cs:[rax + rax]
mov eax, dword [0x141dc2648]
sub eax, dword [0x141dc264c]
and eax, 0x15434dbc
add eax, 0xf3eb1215
cmp ecx, 1
mov edi, 0
sbb edi, edi
cmp eax, 0x584f2ad0
jb 0x140026b40
cmp qword [rbp + 0x120], 0
je 0x140026bdf
mov rbx, qword [0x141dda6a0]
xor eax, eax
test al, al
je 0x140026b94
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov eax, dword [0x141dc2650]
xor eax, dword [0x141dc2654]
imul rax, rax, 0x69f6b257
shr rax, 0x3d
or eax, 0x5601ef64
imul r14d, eax, 0xbbfe8738
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, r12
call r13
add rsp, 0x20
cmp r14d, 0xfe1ea35
je 0x140026ba0
or edi, r15d
nop word cs:[rax + rax]
mov eax, dword [0x141dc2658]
xor edx, edx
div dword [0x141dc265c]
or eax, 0xc2723752
imul eax, eax, 0x3c738f08
cmp eax, 0x3a2c3d3d
jb 0x140026bf0
movabs r15, 0x595f673b99754862
mov esi, 0x80ecc589
mov r12, qword [rbp + 0x118]
nop word cs:[rax + rax]
mov eax, dword [0x141dc2660]
and eax, dword [0x141dc2664]
add eax, 0x7acb67ec
or eax, 0x712ebe00
cmp eax, 0x7c0c88ff
jb 0x140026c30
cmp qword [rbp - 0x80], 0
je 0x140026d14
mov eax, dword [0x141dc2668]
xor edx, edx
div dword [0x141dc266c]
and eax, 0x500a08a8
mov ecx, 0x807d9d9f
imul rax, rcx
shr rax, 0x3c
cmp eax, 0x5ba122bb
jne 0x140026cb0
jmp 0x140026cd8
sub rsp, 0x20
mov rcx, rbx
mov rdx, rsi
call rdi
add rsp, 0x20
jmp 0x140026b00
mov eax, dword [0x141dc2670]
sub eax, dword [0x141dc2674]
xor eax, 0x9000005
and eax, 0x69308245
mov r8, qword [rbp - 0x78]
mov rcx, qword [0x141dda6a0]
cmp eax, 0x5ad55b1b
jne 0x140026cf0
mov rax, qword [0x141dda6a0]
jmp 0x140026cb0
sub rsp, 0x20
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140026d10
mov eax, dword [0x141dc2678]
or eax, dword [0x141dc267c]
add eax, 0xe6b849cb
or eax, 0x64032f62
add eax, 0x9a6a1269
cmp eax, 0x29033245
jb 0x140026d14
mov rax, qword [rbp - 0x68]
nop word [rax + rax]
mov ecx, dword [0x141dc2680]
or ecx, dword [0x141dc2684]
add ecx, 0x99323b92
xor ecx, 0xf22283c0
imul rcx, rcx, 0x2acf57d5
shr rcx, 0x3c
cmp ecx, 0xb2a8fe91
ja 0x140026d40
test rax, rax
je 0x140026e0f
nop word cs:[rax + rax]
mov eax, dword [0x141dc2688]
sub eax, dword [0x141dc268c]
imul eax, eax, 0x30f82e6c
cmp eax, 0x472f36cc
je 0x140026d80
mov rbx, qword [rbp - 0x60]
mov eax, dword [0x141dc2690]
sub eax, dword [0x141dc2694]
xor eax, 0x4b3d41a4
imul eax, eax, 0xd20ef5dc
add eax, 0xafc652cf
cmp eax, 0x2aeff174
jb 0x140027190
nop word cs:[rax + rax]
mov eax, dword [0x141dc2698]
sub eax, dword [0x141dc269c]
and eax, 0x6a9c3b90
imul r14d, eax, 0x568ba956
mov rcx, qword [0x141dda6a0]
sub rsp, 0x20
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp r14d, 0x90126995
je 0x140027190
lea rbx, [0x141dae7e9]
mov r14, qword [rbp + 0x68]
nop word [rax + rax]
mov eax, dword [0x141dc26a0]
or eax, dword [0x141dc26a4]
imul eax, eax, 0x29037238
add eax, 0xba1779f0
cmp eax, 0x67e215b7
ja 0x140026e20
cmp qword [rbp + 0x28], 0
je 0x140026e80
mov r8, qword [rbp + 0x30]
mov rcx, qword [0x141dda6a0]
sub rsp, 0x20
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov eax, dword [0x141dc26a8]
xor edx, edx
div dword [0x141dc26ac]
shr eax, 1
imul rax, rsi
shr rax, 0x3e
cmp eax, 0x8b2f7cef
je 0x140026e60
nop
mov eax, dword [0x141dc26b0]
add eax, dword [0x141dc26b4]
imul eax, eax, 0x51b41a8e
cmp eax, 0x82ba20dd
je 0x140026e80
nop dword [rax]
mov eax, dword [0x141dc26b8]
xor edx, edx
div dword [0x141dc26bc]
add eax, 0xfcf152bf
xor eax, 0xd2a0b6e3
add eax, 0x6f84a83
cmp eax, 0x5e934c64
ja 0x140026ea0
test r14, r14
je 0x140026f0f
mov rcx, qword [0x141dda6a0]
sub rsp, 0x20
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dc26d0]
xor edx, edx
div dword [0x141dc26d4]
or eax, 0x7edefbfd
and eax, 0x7efeffff
cmp eax, 0xca2eec0d
ja 0x140026ef0
mov r14, qword [rbp + 0x150]
mov eax, dword [0x141dc26d8]
and eax, dword [0x141dc26dc]
imul eax, eax, 0x5d6d12fe
and eax, 0xf9b85dd4
add eax, 0x66c136ad
cmp eax, 0xec02d312
ja 0x140026f16
nop dword [rax]
mov eax, dword [0x141dc26e0]
imul eax, dword [0x141dc26e4]
imul eax, eax, 0x504c2390
cmp eax, 0x9c5455fd
je 0x140026f40
test edi, edi
je 0x1400272ca
mov eax, dword [0x141dc26e8]
xor eax, dword [0x141dc26ec]
add eax, 0x335a1f37
shr eax, 1
mov ecx, 0x80509ddb
imul rax, rcx
shr rax, 0x3c
or eax, 0xdc114c70
cmp eax, 0xf8461a39
jbe 0x140026fd1
mov qword [rbp + 0x90], rbx
lea rax, [rbp + 0x90]
mov rcx, qword [rbp + 0x90]
mov qword [rbp + 0x90], r15
mov rdx, qword [rbp + 0x90]
sub rsp, 0x20
call fcn.14001b720
add rsp, 0x20
mov rcx, qword [rax]
mov rcx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
movzx eax, byte [rax + 0x20]
lea r13, [rbp + 0x90]
mov rsi, rbx
mov rbx, r15
movabs r15, 0xf37d98069079d5a0
movabs r14, 0x347de5c2264e06c9
movabs r12, 0x69a9b624fd27f38
nop dword [rax]
mov eax, dword [0x141dc26f0]
xor eax, dword [0x141dc26f4]
imul rdi, rax, 0x60abaf19
shr rdi, 0x3c
xor edi, 0xe27b80c5
mov qword [rbp + 0x90], rsi
mov rcx, qword [rbp + 0x90]
mov qword [rbp + 0x90], rbx
mov rdx, qword [rbp + 0x90]
sub rsp, 0x20
call fcn.14001b720
add rsp, 0x20
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
xor rcx, r14
mov r8, qword [rax + 0x10]
xor r8, r15
mov r9, qword [rax + 0x18]
xor r9, r12
movzx eax, byte [rax + 0x20]
cmp edi, 0xe8147368
ja 0x140027000
movabs r10, 0x27ba6ed99e947921
xor rdx, r10
xor al, 0xb9
mov r10, qword [rbp + 0x110]
mov qword [r10], rdx
mov qword [r10 + 8], rcx
mov qword [r10 + 0x10], r8
mov qword [r10 + 0x18], r9
mov byte [r10 + 0x20], al
mov rax, qword [rbp - 0x50]
mov qword [rax], r10
mov qword [rax + 8], 0x21
mov rdx, qword [rbp - 0x48]
mov qword [rdx], rax
lea rax, [0x14000d920]
mov qword [rdx + 8], rax
lea rax, [0x140101e90]
mov rcx, qword [rbp - 0x40]
mov qword [rcx], rax
mov qword [rcx + 8], 2
mov qword [rcx + 0x20], 0
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], 1
sub rsp, 0x20
call fcn.14009f0a0
add rsp, 0x20
cmp qword [rbp + 0x148], 0
mov r12, qword [rbp - 0x30]
mov r15, qword [rbp + 0x150]
lea r13, [rbp - 0x80]
je 0x140025d80
mov eax, dword [0x141dc26f8]
add eax, dword [0x141dc26fc]
xor eax, 0xa4da589b
add eax, 0xb67fac70
imul rax, rax, 0x57983fd5
shr rax, 0x3e
cmp eax, 0x3531d030
jbe 0x140027140
mov rax, qword [0x141dda6a0]
nop word [rax + rax]
mov eax, dword [0x141dc2700]
and eax, dword [0x141dc2704]
add eax, 0x2e82e3
imul rax, rax, 0x1a16a9bb
shr rax, 0x3c
mov rbx, qword [0x141dda6a0]
cmp eax, 0xc9e3fd26
ja 0x140027140
mov eax, dword [0x141dc2708]
add eax, dword [0x141dc270c]
imul eax, eax, 0xde0fed98
or eax, 0x7cb2647
xor eax, 0xa7480b96
cmp eax, 0x7da5a0f0
jae 0x1400271b0
jmp 0x1400271f8
mov rcx, qword [0x141dda6a0]
sub rsp, 0x20
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x140026dd0
mov eax, dword [0x141dc2710]
imul eax, dword [0x141dc2714]
imul edi, eax, 0x656944f8
mov eax, 0xca4ab8cf
imul rdi, rax
shr rdi, 0x3c
add edi, 0x8538c1df
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp edi, 0x8bd8b409
jbe 0x140025d80
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x1400271b0
mov rcx, qword [rbp - 0x10]
mov r13, qword [rbp + 0x40]
nop dword [rax + rax]
mov eax, dword [0x141dc2728]
or eax, dword [0x141dc272c]
imul eax, eax, 0x74a37e2f
or eax, 0x91ddcac
and eax, 0x699fffae
cmp eax, 0xac545351
ja 0x140027220
test r15, r15
je 0x14002735a
lea rax, [0x141daf4c8]
mov qword [rcx], rax
mov rcx, qword [rcx]
movabs rax, 0x63c9020a48e60ebf
mov rdx, qword [rbp + 0x18]
mov qword [rdx], rax
mov rdx, qword [rdx]
sub rsp, 0x20
call fcn.140018d70
add rsp, 0x20
mov rcx, qword [rax]
mov qword [rbp + 0x100], rcx
mov rcx, qword [rax + 8]
mov qword [rbp + 0x108], rcx
mov rcx, qword [rax + 0x10]
mov qword [rbp + 0x110], rcx
mov r15, qword [rax + 0x18]
movzx ebx, byte [rax + 0x20]
mov eax, dword [0x141dc2778]
xor eax, dword [0x141dc277c]
cmp eax, 0x2702727f
mov r13, qword [rbp + 8]
mov rsi, qword [rbp + 0x10]
mov r14, qword [rbp + 0x20]
jne 0x140027770
jmp 0x140027841
cmp qword [rbp + 0x148], 0
mov rbx, qword [rbp + 0x128]
mov r13, qword [rbp + 0x40]
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
je 0x14002735a
mov rdi, qword [0x141dda6a0]
mov eax, dword [0x141dc2718]
and eax, dword [0x141dc271c]
or eax, 0x9db7a199
cmp eax, 0xc9893a0
jne 0x140027320
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop dword [rax + rax]
mov eax, dword [0x141dc2720]
xor edx, edx
div dword [0x141dc2724]
and eax, 0xefe6f79
imul esi, eax, 0x64edc8f3
xor esi, 0x8237e259
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, r14
call r15
add rsp, 0x20
cmp esi, 0x3d868722
jb 0x140027320
movabs rsi, 0x9d45940f69b50d5a
mov eax, dword [str.K_6L]
xor eax, dword [0x141dc275c]
or eax, 0x9f1190ad
add eax, 0xeeb5992e
or eax, 0x6b1f8799
cmp eax, 0x5789b7e3
mov r14, qword [rbp - 0x28]
mov r15, qword [rbp - 0x20]
jae 0x140027569
jmp 0x1400275b8
ud2
mov eax, dword [0x141dc26c0]
imul eax, dword [0x141dc26c4]
cmp eax, 0xbcf1015c
jne 0x14002752d
jmp 0x140027558
mov eax, dword [0x141dc2538]
xor edx, edx
div dword [0x141dc253c]
imul eax, eax, 0xf7bad359
cmp eax, 0xc88e2c4f
jne 0x140027410
ud2
mov eax, dword [0x141dc2540]
xor eax, dword [0x141dc2544]
imul rax, rax, 0x351cc5d3
shr rax, 0x3d
xor eax, 0xcc64fa4d
imul eax, eax, 0x7f5a9029
ud2
mov eax, dword [0x141dc2558]
imul eax, dword [0x141dc255c]
add eax, 0x5ff3d5e2
and eax, 0xb92ad08b
cmp eax, 0x1b12e4a9
jne 0x1400274d8
jmp 0x1400274fe
mov eax, dword [0x141dc2518]
or eax, dword [0x141dc251c]
imul rax, rax, 0x740ccfb1
shr rax, 0x3e
cmp eax, 0xb73e4793
jne 0x1400274b0
ud2
mov eax, dword [0x141dc2520]
imul eax, dword [0x141dc2524]
imul rax, rax, 0x3a2d0cfb
shr rax, 0x3c
or eax, 0x8880444
ud2
ud2
mov eax, dword [0x141dc2560]
add eax, dword [0x141dc2564]
imul eax, eax, 0x8176624c
or eax, 0x316d6ecb
imul eax, eax, 0x8f7fea25
ud2
ud2
mov eax, dword [0x141dc26c8]
imul eax, dword [0x141dc26cc]
add eax, 0x76d1a0be
xor eax, 0xfd8bee74
imul rax, rax, 0x3d2dee8d
shr rax, 0x3d
ud2
ud2
mov edi, dword [0x141dc2760]
xor edi, dword [0x141dc2764]
add edi, 0x8d8686f0
and edi, 0xa16fdbfc
lea rax, [0x141da526a]
mov qword [r15], rax
mov rcx, qword [r15]
mov qword [r14], rsi
mov rdx, qword [r14]
sub rsp, 0x20
call fcn.14001a4a0
add rsp, 0x20
mov r9, qword [rax]
mov r8, qword [rax + 8]
mov rdx, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
cmp edi, 0xa3d627ac
jne 0x1400275e9
lea rax, [0x141da526a]
mov qword [r15], rax
mov rcx, qword [r15]
mov qword [r14], rsi
mov rdx, qword [r14]
sub rsp, 0x20
call fcn.14001a4a0
add rsp, 0x20
mov rcx, qword [rax]
mov rcx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x18]
jmp 0x140027569
movabs r10, 0x60f835fa28c43580
xor r10, qword [rax + 0x20]
movzx eax, word [rax + 0x28]
movabs r11, 0x5cc1f4aaac985a06
xor rcx, r11
movabs r11, 0x72396d0abc24f508
xor rdx, r11
movabs r11, 0x22fd9cbde01aa544
xor r8, r11
movabs r11, 0x44f21e587249d16a
xor r9, r11
mov r11d, eax
xor r11b, 0xf9
shr eax, 8
xor al, 0x9d
mov rsi, qword [rbp]
mov qword [rsi], r9
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], rdx
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x20], r10
mov byte [rsi + 0x28], r11b
mov byte [rsi + 0x29], al
mov qword [r13], rsi
mov qword [r13 + 8], 0x2a
mov qword [rbx], r13
mov eax, dword [0x141dc2768]
sub eax, dword [0x141dc276c]
add eax, 0x54d38903
or eax, 0x1140a438
and eax, 0x3162b6bd
cmp eax, 0xdf450f62
mov rdi, qword [rbp - 8]
lea r14, [0x14000d920]
lea r15, [0x140101e90]
je 0x1400276f8
mov eax, dword [0x141dc2770]
mov ecx, dword [0x141dc2774]
lea esi, [rax + rcx]
add esi, 0x2df548a4
xor esi, 0x518c20cb
add esi, 0xf25cadd0
mov qword [rbx + 8], r14
mov qword [rdi], r15
mov qword [rdi + 8], 2
mov qword [rdi + 0x20], 0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 1
sub rsp, 0x20
mov rcx, rdi
call fcn.14009f0a0
add rsp, 0x20
cmp esi, 0x158402a8
ja 0x140027730
mov qword [rbx + 8], r14
mov qword [rdi], r15
mov qword [rdi + 8], 2
mov qword [rdi + 0x20], 0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 1
sub rsp, 0x20
mov rcx, rdi
call fcn.14009f0a0
add rsp, 0x20
jmp 0x14002769c
mov eax, dword [0x141dc27f8]
xor edx, edx
div dword [0x141dc27fc]
and eax, 0xd7d8fae5
imul eax, eax, 0x4631ee62
and eax, 0xa6fe79fa
cmp eax, 0xdcaa1c1a
ja 0x140027730
movaps xmm6, xmmword [rbp + 0x160]
lea rsp, [rbp + 0x178]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [0x141dc2780]
xor edx, edx
div dword [0x141dc2784]
mov edi, eax
mov rax, qword [rbp + 0x100]
movabs rcx, 0x73d7bddf5b238f5b
xor rax, rcx
mov qword [r13], rax
mov rax, qword [rbp + 0x108]
movabs rcx, 0x4361ba5209efe2c9
xor rax, rcx
mov qword [r13 + 8], rax
mov rax, qword [rbp + 0x110]
movabs rcx, 0x80aafc04f153c8a7
xor rax, rcx
mov qword [r13 + 0x10], rax
mov rax, r15
movabs rcx, 0xfd95095e3a6861b1
xor rax, rcx
mov qword [r13 + 0x18], rax
mov eax, ebx
xor al, 0x21
mov byte [r13 + 0x20], al
mov qword [rsi], r13
mov qword [rsi + 8], 0x21
mov qword [r12], rsi
lea rax, [0x14000d920]
mov qword [r12 + 8], rax
lea rax, [0x140101e90]
mov qword [r14], rax
mov qword [r14 + 8], 2
mov qword [r14 + 0x20], 0
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], 1
sub rsp, 0x20
mov rcx, r14
call fcn.14009f0a0
add rsp, 0x20
cmp edi, 0x668a8bdd
jne 0x1400278fb
mov rax, qword [rbp + 0x100]
movabs rcx, 0x73d7bddf5b238f5b
xor rax, rcx
mov qword [r13], rax
mov rax, qword [rbp + 0x108]
movabs rcx, 0x4361ba5209efe2c9
xor rax, rcx
mov qword [r13 + 8], rax
mov rax, qword [rbp + 0x110]
movabs rcx, 0x80aafc04f153c8a7
xor rax, rcx
mov qword [r13 + 0x10], rax
mov rax, r15
movabs rcx, 0xfd95095e3a6861b1
xor rax, rcx
mov qword [r13 + 0x18], rax
mov eax, ebx
xor al, 0x21
mov byte [r13 + 0x20], al
mov qword [rsi], r13
mov qword [rsi + 8], 0x21
mov qword [r12], rsi
lea rax, [0x14000d920]
mov qword [r12 + 8], rax
lea rax, [0x140101e90]
mov qword [r14], rax
mov qword [r14 + 8], 2
mov qword [r14 + 0x20], 0
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], 1
sub rsp, 0x20
mov rcx, r14
call fcn.14009f0a0
add rsp, 0x20
jmp 0x140027770
mov rdx, qword [rbp + 0x150]
mov eax, edx
and eax, 3
cmp rax, 3
ja case.default.0x14002791f
lea rcx, [0x141db929c]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
lea rdi, [rdx - 1]
nop word cs:[rax + rax]
mov eax, dword [0x141dc27a8]
or eax, dword [0x141dc27ac]
cmp eax, 0x148d7c63
je 0x140027930
mov rbx, qword [rdx - 1]
mov rsi, qword [rdx + 7]
nop dword [rax + rax]
mov eax, dword [0x141dc27b0]
sub eax, dword [0x141dc27b4]
xor eax, 0xd693be37
add eax, 0xed104dea
or eax, 0x22e17739
cmp eax, 0x90b6554c
je 0x140027950
mov rax, qword [rsi]
xor ecx, ecx
nop word [rax + rax]
test cl, cl
jne 0x140027980
test rax, rax
je 0x1400279a0
sub rsp, 0x20
mov rcx, rbx
call rax
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dc27b8]
xor eax, dword [0x141dc27bc]
add eax, 0x6cfac946
or eax, 0x482d6436
add eax, 0x49d6a12a
cmp eax, 0xb55c94df
jb 0x1400279a0
mov rcx, qword [rsi + 8]
mov rax, qword [rsi + 0x10]
nop word [rax + rax]
mov edx, dword [0x141dc27c0]
and edx, dword [0x141dc27c4]
xor edx, 0x48003800
or edx, 0xa6eac6fd
add edx, 0x903111ca
cmp edx, 0xa6c84ccc
ja 0x1400279d0
test rcx, rcx
je 0x140027a9c
cmp rax, 0x11
jb 0x140027a82
nop dword [rax]
mov eax, dword [0x141dc27c8]
xor eax, dword [0x141dc27cc]
or eax, 0xe049ef0d
imul rax, rax, 0x3890f85d
shr rax, 0x3a
xor eax, 0x7ab099c1
cmp eax, 0x8e569700
ja 0x140027a10
nop dword [rax + rax]
mov eax, dword [0x141dc27d0]
xor edx, edx
div dword [0x141dc27d4]
or eax, 0xeba76fce
cmp eax, 0x1f4241c3
je 0x140027a40
mov rbx, qword [rbx - 8]
nop
mov eax, dword [0x141dc27d8]
or eax, dword [0x141dc27dc]
xor eax, 0xf3de8f8b
add eax, 0x7925d540
xor eax, 0x4cf62b8d
cmp eax, 0xbccc021
jb 0x140027a60
mov rcx, qword [0x141dda6a0]
sub rsp, 0x20
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov eax, dword [0x141dc27e0]
or eax, dword [0x141dc27e4]
imul eax, eax, 0x7e0f1ec1
imul rcx, rax, 0xcdc8fcb
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
imul eax, eax, 0xc0237fd
cmp eax, 0x3f469752
jbe 0x140027f5e
jmp 0x140027f7d
mov eax, dword [0x141dc2790]
and eax, dword [0x141dc2794]
or eax, 0xe38ca406
xor eax, 0xe1c19b77
cmp eax, 0x97075a70
ja case.0x14002791f.3
nop dword [rax]
mov eax, dword [0x141dc2798]
xor edx, edx
div dword [0x141dc279c]
add eax, 0x939b3128
or eax, 0xff71ddff
cmp eax, 0xc504a062
je 0x140027b00
nop
mov eax, dword [0x141dc27a0]
and eax, dword [0x141dc27a4]
xor eax, 0x42c00c01
and eax, 0xdbeb2c19
cmp eax, 0x942a01de
je 0x140027b20
jmp case.0x14002791f.0
mov eax, dword [0x141dc2788]
sub eax, dword [0x141dc278c]
add eax, 0xedbda7e7
imul rax, rax, 0x67a627ef
shr rax, 0x3d
cmp eax, 0x4e2bb80f
ja case.default.0x14002791f
jmp 0x1400274d6
mov eax, dword [0x141dc2738]
imul eax, dword [0x141dc273c]
or eax, 0xa2fbf3eb
lea rcx, [0x141da459e]
mov qword [rbx], rcx
cmp eax, 0xed8133d7
jne 0x140027ba7
lea rax, [0x141da459e]
mov qword [rbx], rax
jmp 0x140027b78
movabs r12, 0x6473f65616740f59
movabs rsi, 0x5c3c7d014d9e5a4a
movabs r13, 0x3021bc15fa91e96b
movabs rdx, 0x28ee358551049bf3
mov eax, dword [0x141dc2740]
add eax, dword [0x141dc2744]
or eax, 0xc62eefbe
imul eax, eax, 0xc3b86be6
mov ecx, 0xc4991283
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0x72310b49
mov rdi, qword [rbp + 0x68]
mov r14, qword [rbp + 0x118]
jbe 0x140027c81
mov rcx, qword [rbx]
mov qword [r15], rdx
mov rdx, qword [r15]
sub rsp, 0x20
call fcn.14001b1b0
add rsp, 0x20
mov rcx, qword [rax]
xor rcx, r12
mov rdx, qword [rax + 8]
xor rdx, rsi
mov r8, qword [rax + 0x10]
movabs r9, 0x4259c9f0a01aad2f
xor r8, r9
mov r9, qword [rax + 0x18]
movabs r10, 0x3bbd058d17997c23
xor r9, r10
mov r10, qword [rax + 0x20]
mov r11d, 0xf3c0e744
xor r11d, dword [rax + 0x28]
xor r10, r13
movzx eax, byte [rax + 0x2c]
mov qword [rdi], rcx
mov qword [rdi + 8], rdx
movabs rdx, 0x28ee358551049bf3
mov qword [rdi + 0x10], r8
mov qword [rdi + 0x18], r9
mov qword [rdi + 0x20], r10
mov dword [rdi + 0x28], r11d
mov r12, rbx
nop word cs:[rax + rax]
mov ebx, dword [0x141dc2748]
sub ebx, dword [0x141dc274c]
add ebx, 0xf5c7186f
xor ebx, 0x7e14c78d
mov rcx, qword [r12]
mov qword [r15], rdx
mov rsi, rdx
mov rdx, qword [r15]
sub rsp, 0x20
call fcn.14001b1b0
add rsp, 0x20
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov r10, qword [rax + 0x20]
mov r11d, dword [rax + 0x28]
movzx r13d, byte [rax + 0x2c]
movabs rax, 0x6473f65616740f59
xor rcx, rax
mov qword [rdi], rcx
movabs rax, 0x5c3c7d014d9e5a4a
xor rdx, rax
mov qword [rdi + 8], rdx
mov rdx, rsi
movabs rax, 0x4259c9f0a01aad2f
xor r8, rax
mov qword [rdi + 0x10], r8
movabs rax, 0x3bbd058d17997c23
xor r9, rax
mov qword [rdi + 0x18], r9
movabs rax, 0x3021bc15fa91e96b
xor r10, rax
mov qword [rdi + 0x20], r10
mov eax, 0xf3c0e744
xor r11d, eax
mov dword [rdi + 0x28], r11d
cmp ebx, 0xfbed8872
ja 0x140027c90
xor r13b, 0xd0
mov eax, dword [0x141dc2750]
imul eax, dword [0x141dc2754]
and eax, 0x1d3d9532
xor eax, 0x6b487607
mov ecx, 0xa072cded
imul rcx, rax
shr rcx, 0x3c
cmp ecx, 0x49ea6df7
mov r12, qword [rbp + 0x120]
mov rsi, qword [rbp + 0x150]
jbe 0x140027de3
mov byte [rdi + 0x2c], r13b
mov qword [rsi], rdi
mov qword [rsi + 8], 0x2d
mov qword [r14], rsi
lea rax, [0x14000d920]
mov qword [r14 + 8], rax
lea rax, [0x140101e90]
mov qword [r12], rax
mov qword [r12 + 8], 2
mov qword [r12 + 0x20], 0
mov qword [r12 + 0x10], r14
mov qword [r12 + 0x18], 1
sub rsp, 0x20
mov rcx, r12
call fcn.14009f0a0
add rsp, 0x20
lea r15, [0x140101e90]
mov bl, 1
nop dword [rax]
mov byte [rdi + 0x2c], r13b
mov qword [rsi], rdi
mov qword [rsi + 8], 0x2d
mov qword [r14], rsi
lea rax, [0x14000d920]
mov qword [r14 + 8], rax
mov qword [r12], r15
mov qword [r12 + 8], 2
mov qword [r12 + 0x20], 0
mov qword [r12 + 0x10], r14
mov qword [r12 + 0x18], 1
sub rsp, 0x20
mov rcx, r12
call fcn.14009f0a0
add rsp, 0x20
test bl, bl
je 0x140027df0
nop word cs:[rax + rax]
mov eax, dword [0x141dc2800]
mov ecx, dword [0x141dc2804]
add eax, ecx
add eax, 0xc33271db
imul rax, rax, 0xc1d22a1
shr rax, 0x36
add eax, 0x72ee2eb3
cmp eax, 0x4ad94834
jb case.0x14002791f.0
mov qword [rbp + 0x90], 0
mov eax, dword [0x141dc2808]
xor eax, dword [0x141dc280c]
and eax, 0x9d245a46
cmp eax, 0x87d7dc9f
jne 0x140027eb2
sub rsp, 0x20
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
add rsp, 0x20
lea rsi, [rbp + 0x90]
mov rdi, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [0x141dc2810]
or eax, dword [0x141dc2814]
imul ebx, eax, 0xa2f527e7
add ebx, 0x1a89ea37
sub rsp, 0x20
mov rcx, rsi
call rdi
add rsp, 0x20
cmp ebx, 0xa47ed7c7
ja 0x140027ec0
test eax, eax
je 0x140027f25
mov rsi, qword [rbp + 0x90]
mov eax, dword [0x141dc2820]
mov ecx, dword [0x141dc2824]
add eax, ecx
add eax, 0x8e48981b
xor eax, 0x8dfea165
add eax, 0x67d2c76
cmp eax, 0xdea1d33b
jbe 0x140027fca
jmp 0x140027ffa
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
ud2
mov eax, dword [0x141dc27e8]
and eax, dword [0x141dc27ec]
add eax, 0xadb74419
mov rcx, qword [0x141dda6a0]
cmp eax, 0x699088f5
jbe 0x140027f86
mov rax, qword [0x141dda6a0]
jmp 0x140027f5e
sub rsp, 0x20
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop dword [rax]
mov eax, dword [0x141dc27f0]
xor edx, edx
div dword [0x141dc27f4]
imul eax, eax, 0xb29ca0cf
add eax, 0xd9c99aec
or eax, 0x42444471
cmp eax, 0xaf482d70
je 0x140027fa0
jmp case.0x14002791f.0
mov eax, dword [0x141dc2828]
sub eax, dword [0x141dc282c]
imul eax, eax, 0x2601e4b6
or eax, 0x805d18bb
imul rax, rax, 0x5eed338b
shr rax, 0x3e
mov rcx, qword [0x141dda698]
cmp eax, 0x9207462e
jne 0x140028010
mov rax, qword [0x141dda698]
jmp 0x140027fca
mov eax, dword [0x141dc2830]
or eax, dword [0x141dc2834]
imul eax, eax, 0x78bc870f
add eax, 0xad91930f
cmp eax, 0x694960b6
jb 0x140028010
test rcx, rcx
jne 0x14002825e
mov eax, dword [0x141dc2838]
sub eax, dword [0x141dc283c]
and eax, 0xb592d58f
xor eax, 0x6c6201f0
imul eax, eax, 0x502d5116
cmp eax, 0x19688660
jb 0x140028092
mov eax, dword [0x141dc2840]
and eax, dword [0x141dc2844]
mov ecx, 0xce31cbf9
imul rcx, rax
shr rcx, 0x3f
add ecx, 0x43daf88b
and ecx, 0x408a980f
mov qword [rbp + 0x90], 0
cmp ecx, 0x42010dc1
jbe 0x14002809f
mov qword [rbp + 0x90], 0
jmp 0x14002805a
mov eax, dword [0x141dc2848]
sub eax, dword [0x141dc284c]
and eax, 0x5d320ef1
add eax, 0xfc6c4c52
or eax, 0x8472a6ee
cmp eax, 0x4b056429
jb 0x1400280f6
mov edi, dword [0x141dc2850]
and edi, dword [0x141dc2854]
or edi, 0xf5a7c234
xor edi, 0x7e036ace
sub rsp, 0x20
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
cmp edi, 0x5867c56a
jae 0x140028110
sub rsp, 0x20
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
jmp 0x1400280c1
mov ecx, dword [0x141dc2858]
add ecx, dword [0x141dc285c]
or ecx, 0x9c5fc969
imul ecx, ecx, 0xe259b767
xor ecx, 0x1379cfdc
cmp ecx, 0xd3a130fe
ja 0x140028110
test eax, eax
je 0x14002819d
mov eax, dword [0x141dc2878]
xor edx, edx
div dword [0x141dc287c]
nop dword [rax + rax]
mov eax, dword [0x141dc2880]
xor eax, dword [0x141dc2884]
add eax, 0xa2af7194
cmp eax, 0x7f4c6eb7
ja 0x140028150
mov rcx, qword [rbp + 0x90]
mov eax, dword [0x141dc2888]
xor edx, edx
div dword [0x141dc288c]
or eax, 0x7a088bfb
imul rax, rax, 0x17c908f5
shr rax, 0x3b
cmp eax, 0xfb6351db
jne 0x140028232
jmp 0x14002824c
mov eax, dword [0x141dc2860]
sub eax, dword [0x141dc2864]
or eax, 0xd251c11e
cmp eax, 0xcc9a152e
jne 0x1400281c3
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop word [rax + rax]
mov edi, dword [0x141dc2868]
or edi, dword [0x141dc286c]
xor edi, 0x49311920
and edi, 0x6d3d5922
add edi, 0xa6f5c87e
sub rsp, 0x20
call rsi
add rsp, 0x20
cmp edi, 0x29764e24
ja 0x1400281d0
ud2
mov eax, dword [0x141dc2890]
or eax, dword [0x141dc2894]
mov qword [0x141dda698], rcx
cmp eax, 0x88a30e48
jne 0x140028255
mov qword [0x141dda698], rcx
jmp 0x140028232
test rcx, rcx
je 0x14002838d
mov rax, rsi
or rax, rcx
shr rax, 0x20
je 0x140028274
mov rax, rsi
xor edx, edx
div rcx
jmp 0x14002827a
mov eax, esi
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x14002829e
xor edx, edx
div rcx
mov rsi, rax
jmp 0x1400282a4
xor edx, edx
div ecx
mov esi, eax
add rsi, r8
mov rax, rsi
shr rax, 9
movabs r15, 0x44b82fa09b5a53
mul r15
mov rdi, rdx
sub rsp, 0x20
mov ecx, 0x23
call fcn.14008b4f0
add rsp, 0x20
mov qword [rbp + 0x90], 0
sub rsp, 0x20
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
add rsp, 0x20
test eax, eax
je 0x14002834f
shr rdi, 0xb
imul eax, edi, 0x3b9aca00
sub esi, eax
mov eax, dword [0x141dc28b0]
and eax, dword [0x141dc28b4]
xor eax, 0x39ab35c8
add eax, 0xf26e786e
and eax, 0xdfb7c37c
cmp eax, 0x83da8383
je 0x140028300
mov eax, dword [0x141dc28b8]
and eax, dword [0x141dc28bc]
mov rbx, qword [rbp + 0x90]
xor eax, 0x80180423
or eax, 0x55e6db94
cmp eax, 0x8060a8a4
jne 0x1400283f8
jmp 0x140028424
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov eax, dword [0x141dc28a8]
xor edx, edx
div dword [0x141dc28ac]
imul eax, eax, 0xea6295a6
mov ecx, 0xc075f805
imul rcx, rax
shr rcx, 0x3f
imul eax, ecx, 0x28a1b3d
cmp eax, 0x76ba4200
jbe 0x1400283e8
jmp 0x1400283f4
xor eax, eax
test al, al
je 0x140028395
ud2
mov eax, dword [0x141dc2898]
xor edx, edx
div dword [0x141dc289c]
or eax, 0xc970000
and eax, 0x4d9f0080
ud2
ud2
ud2
mov eax, dword [0x141dc28c0]
xor edx, edx
div dword [0x141dc28c4]
imul eax, eax, 0x513acce6
xor eax, 0x110622
and eax, 0x80350726
mov rcx, qword [0x141dda698]
cmp eax, 0x6b563191
jne 0x14002842d
mov rax, qword [0x141dda698]
jmp 0x1400283f8
test rcx, rcx
jne 0x140028634
mov eax, dword [0x141dc28c8]
xor eax, dword [0x141dc28cc]
imul eax, eax, 0xae89c0bb
cmp eax, 0xecd692b4
jne 0x14002846f
mov qword [rbp + 0x90], 0
sub rsp, 0x20
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
lea r14, [rbp + 0x90]
mov r12, qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor r13d, r13d
mov qword [rbp + 0x90], 0
sub rsp, 0x20
mov rcx, r14
call r12
add rsp, 0x20
test r13b, r13b
jne 0x140028480
mov ecx, 0xa7a61acd
nop word cs:[rax + rax]
mov edx, dword [0x141dc28d0]
or edx, dword [0x141dc28d4]
imul rdx, rcx
shr rdx, 0x3d
add edx, 0xcfcfcd9
cmp edx, 0x886f1ab8
ja 0x1400284b0
nop word cs:[rax + rax]
mov ecx, dword [0x141dc28d8]
sub ecx, dword [0x141dc28dc]
add ecx, 0x522e745b
xor ecx, 0xbc104383
imul rcx, rcx, 0x4c142deb
shr rcx, 0x3d
cmp ecx, 0xed6ac8ae
je 0x1400284e0
test eax, eax
je 0x14002853d
mov eax, dword [0x141dc28f0]
imul eax, dword [0x141dc28f4]
and eax, 0xb0f69239
imul rax, rax, 0x5fea950d
shr rax, 0x3e
add eax, 0xca59d437
cmp eax, 0x5eeb52bc
jae 0x1400285a6
jmp 0x1400285d3
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov eax, dword [0x141dc28e0]
or eax, dword [0x141dc28e4]
imul eax, eax, 0xaab864ee
add eax, 0x60b66cc6
and eax, 0x82c54f2e
cmp eax, 0xf0f544ce
ja 0x140028576
ud2
ud2
mov eax, dword [0x141dc28f8]
mov ecx, dword [0x141dc28fc]
add eax, ecx
add eax, 0x8b049e33
and eax, 0x687a67b4
mov rcx, qword [rbp + 0x90]
mov qword [0x141dda698], rcx
cmp eax, 0xa01322
jne 0x1400285e3
mov rax, qword [rbp + 0x90]
mov qword [0x141dda698], rax
jmp 0x1400285a6
mov eax, dword [0x141dc2900]
xor edx, edx
div dword [0x141dc2904]
nop word cs:[rax + rax]
mov eax, dword [0x141dc2908]
and eax, dword [0x141dc290c]
and eax, 0x49f8c1bd
add eax, 0xbc68490f
shr eax, 2
imul rax, rax, 0x22f5d715
shr rax, 0x3a
cmp eax, 0x3c09ea91
ja 0x140028600
test rcx, rcx
je 0x1400274d6
mov rax, rbx
or rax, rcx
shr rax, 0x20
je 0x14002864a
mov rax, rbx
xor edx, edx
div rcx
jmp 0x140028650
mov eax, ebx
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x140028674
xor edx, edx
div rcx
mov rbx, rax
jmp 0x14002867a
xor edx, edx
div ecx
mov ebx, eax
add rbx, r8
mov rax, rbx
shr rax, 9
mul r15
mov r14, rdx
mov r9, qword [0x141dda698]
test r9, r9
jne 0x140028785
mov eax, dword [0x141dc2910]
or eax, dword [0x141dc2914]
xor eax, 0x10100
or eax, 0x7d34f0d9
and eax, 0x7db5ffd9
cmp eax, 0xfb893aaf
ja 0x140028704
mov eax, dword [0x141dc2918]
xor eax, dword [0x141dc291c]
xor eax, 0xcac80438
imul r15d, eax, 0xb85d0af3
or r15d, 0x18dba7a5
mov qword [rbp + 0x90], 0
sub rsp, 0x20
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
cmp r15d, 0x88f285ec
jae 0x140028726
mov qword [rbp + 0x90], 0
sub rsp, 0x20
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
jmp 0x1400286bc
test eax, eax
je 0x140028fcf
mov r9, qword [rbp + 0x90]
mov qword [0x141dda698], r9
mov eax, dword [0x141dc2940]
xor ecx, ecx
xor edx, edx
div dword [0x141dc2944]
nop dword [rax]
test cl, cl
jne 0x140028750
mov eax, 0xb31b5afb
nop dword [rax]
mov ecx, dword [0x141dc2948]
sub ecx, dword [0x141dc294c]
imul rcx, rax
shr rcx, 0x39
cmp ecx, 0x466a2bb
je 0x140028760
test r9, r9
je 0x140028ff3
shr r14, 0xb
imul eax, r14d, 0x3b9aca00
sub ebx, eax
mov r10d, 0xc4653600
mov eax, dword [0x141dc2960]
sub eax, dword [0x141dc2964]
or eax, 0x40c00084
xor eax, 0x10200100
and eax, 0x51e005cc
cmp eax, 0x353c3acf
jne 0x14002881a
cmp r9, 0x3b9aca00
ja 0x14002881a
mov eax, 0x3b9aca00
xor edx, edx
div r9d
jmp 0x14002881a
mov eax, 0x3b9aca00
xor edx, edx
div r9d
mov edx, 0xa760691b
imul rdx, rcx
shr rdx, 0x3f
or edx, 0xd5b79db8
lea ecx, [rax + r10]
xor r8d, r8d
cmp r9, 2
cmovae ecx, eax
setb r11b
xor r15d, r15d
cmp rdi, r14
setne r15b
mov eax, 0xff
cmovae eax, r15d
cmp edx, 0xf29214d
jne 0x140028833
mov ecx, dword [0x141dc2968]
xor ecx, dword [0x141dc296c]
cmp r9, 0x3b9aca00
jbe 0x1400287d0
xor eax, eax
jmp 0x1400287da
test al, al
jne 0x1400288b3
nop word [rax + rax]
mov eax, dword [0x141dc2970]
xor edx, edx
div dword [0x141dc2974]
imul eax, eax, 0x67b57655
xor eax, 0x24480285
and eax, 0x34cb26cd
cmp eax, 0x9f94e9db
ja 0x140028840
mov eax, dword [0x141dc2978]
xor edx, edx
div dword [0x141dc297c]
nop word cs:[rax + rax]
cmp ebx, esi
setne al
mov edx, dword [0x141dc2980]
or edx, dword [0x141dc2984]
imul edx, edx, 0xc7b01e08
add edx, 0xdf0e3f71
or edx, 0x2ab0c398
cmp edx, 0x534b9a36
jb 0x140028880
cmp ebx, esi
ja 0x140028995
cmp al, 1
jne 0x140028995
mov r9, rdi
sub r9, r14
jb 0x140028e6c
mov r8b, r11b
nop word [rax + rax]
mov eax, dword [0x141dc29d0]
xor edx, edx
div dword [0x141dc29d4]
add eax, 0x74a5ac91
or eax, 0xa4358d9b
add eax, 0x940d84c
cmp eax, 0x360f56eb
jb 0x1400288d0
nop word cs:[rax + rax]
mov eax, dword [0x141dc29d8]
mov edx, dword [0x141dc29dc]
add eax, edx
add eax, 0xd2f884fc
or eax, 0x55b9102
and eax, 0x177fd54a
cmp eax, 0xd4f66617
ja 0x140028900
cmp ebx, esi
jbe 0x1400289e7
nop dword [rax]
mov eax, dword [0x141dc29e0]
and eax, dword [0x141dc29e4]
add eax, 0x1b8ee3de
or eax, 0x76106728
cmp eax, 0x35b54c9b
je 0x140028930
test r9, r9
je 0x140028e6c
dec r9
lea eax, [rsi + 0x3b9aca00]
nop
mov edx, dword [0x141dc29e8]
imul edx, dword [0x141dc29ec]
or edx, 0x9f074805
and edx, 0xdf4f7a5d
xor edx, 0x48467c7d
cmp edx, 0x395d7cb6
jb 0x140028960
sub eax, ebx
cmp eax, 0x3b9aca00
jae 0x1400289f6
jmp 0x140028a86
mov eax, dword [0x141dc2988]
xor edx, edx
div dword [0x141dc298c]
nop word cs:[rax + rax]
mov eax, dword [0x141dc2990]
and eax, dword [0x141dc2994]
imul rax, rax, 0x910f957
shr rax, 0x3b
or eax, 0xbfcefc40
imul eax, eax, 0x9b65bbbd
cmp eax, 0x90424f34
je 0x1400289b0
cmp rdi, r14
jbe 0x140028ae9
jmp 0x140028f8c
mov eax, esi
sub eax, ebx
cmp eax, 0x3b9aca00
jb 0x140028a86
mov edx, eax
shr edx, 9
imul rdx, rdx, 0x44b83
shr rdx, 0x27
imul r10d, edx, 0x3b9aca00
sub eax, r10d
mov r10d, 0x8c4c88e5
mov edx, edx
nop dword [rax + rax]
mov r11d, dword [0x141dc29f0]
add r11d, dword [0x141dc29f4]
xor r11d, 0x6ee44cda
imul r11, r10
shr r11, 0x3c
add r11d, 0xff990c5a
cmp r11d, 0x2f6c5103
jb 0x140028a20
add r9, rdx
jb 0x140028ec8
nop word cs:[rax + rax]
mov edx, dword [0x141dc29f8]
xor edx, dword [0x141dc29fc]
add edx, 0x213e06c2
and edx, 0x90a5fb22
add edx, 0xb48b6259
cmp edx, 0xbe9173da
ja 0x140028a60
mov edx, 0xff
nop dword [rax + rax]
mov r10d, dword [0x141dc2a10]
imul r10d, dword [0x141dc2a14]
imul r15d, r10d, 0xd7a75863
xor r10d, r10d
cmp r9, r8
setne r10b
cmovb r10d, edx
xor r11d, r11d
cmp eax, ecx
setne r11b
cmovb r11d, edx
test r10b, r10b
cmovne r11d, r10d
cmp r11b, 1
setne r10b
cmp rdi, r14
seta r11b
cmp r15d, 0x752251c6
je 0x140028a90
or r10b, r11b
jne 0x140028f8c
sub r14, rdi
nop dword [rax]
mov eax, dword [str.MzrX]
mov ecx, dword [0x141dc299c]
add eax, ecx
add eax, 0x232f7372
or eax, 0xed86e039
add eax, 0x9c98188c
cmp eax, 0xd95b9f5c
ja 0x140028af0
nop word cs:[rax + rax]
mov eax, dword [0x141dc29a0]
sub eax, dword [0x141dc29a4]
add eax, 0x6d7e7c5e
and eax, 0x8bc79e2f
imul eax, eax, 0x7542e3a2
cmp eax, 0xa609e4c2
ja 0x140028b20
cmp ebx, esi
jae 0x140028be8
nop dword [rax + rax]
mov eax, dword [0x141dc29a8]
imul eax, dword [0x141dc29ac]
xor eax, 0x6e4d0fdf
imul eax, eax, 0x9410e57b
add eax, 0xc6f22c66
cmp eax, 0xf42803c8
ja 0x140028b50
test r14, r14
je 0x140028f8c
mov eax, 0xbb42ff57
dec r14
nop word cs:[rax + rax]
mov ecx, dword [0x141dc29b0]
or ecx, dword [0x141dc29b4]
imul ecx, ecx, 0x9d845c7c
add ecx, 0x303ad9c
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0x91c1a3b
je 0x140028b90
add ebx, 0x3b9aca00
nop
mov eax, dword [0x141dc29b8]
and eax, dword [0x141dc29bc]
xor eax, 0xaf4005ee
imul rax, rax, 0x501fc2cd
shr rax, 0x3e
or eax, 0x1fd64842
cmp eax, 0x79e275ee
ja 0x140028bc0
sub ebx, esi
cmp ebx, 0x3b9aca00
jae 0x140028bf7
mov rcx, r14
jmp 0x140028c4d
mov eax, ebx
shr eax, 9
imul rax, rax, 0x44b83
shr rax, 0x27
imul ecx, eax, 0x3b9aca00
sub ebx, ecx
nop
mov r8d, dword [0x141dc29c0]
sub r8d, dword [0x141dc29c4]
or r8d, 0x2513ca48
add r8d, 0x4cb452eb
or r8d, 0x9067adf6
mov rcx, r14
add rcx, rax
setb dl
cmp r8d, 0xa6fc5ac9
ja 0x140028c10
test dl, dl
jne 0x140028e95
mov eax, dword [0x141dc2a18]
xor edx, edx
div dword [0x141dc2a1c]
nop dword [rax + rax]
mov r8d, dword [0x141dc2a20]
and r8d, dword [0x141dc2a24]
xor r8d, 0x91000101
or r8d, 0x2034c042
and r8d, 0xf536e367
cmp ebx, 0x3b9aca00
sete al
cmp rcx, 0x19
setb dl
cmp r8d, 0x994eb8ce
ja 0x140028c60
or al, dl
jne 0x140028f8c
nop word cs:[rax + rax]
mov eax, dword [0x141dc2a28]
or eax, dword [0x141dc2a2c]
imul eax, eax, 0xb77f2994
add eax, 0xef89ed1e
and eax, 0x25b875a6
cmp eax, 0x8ec6c9d2
je 0x140028cb0
sub rsp, 0x20
mov rsi, qword [rbp - 0x18]
mov rcx, rsi
call fcn.1400ddef0
add rsp, 0x20
movzx ecx, byte [rsi]
mov eax, dword [0x141dc2a30]
xor edx, edx
div dword [0x141dc2a34]
nop dword [rax + rax]
mov eax, dword [0x141dc2a38]
add eax, dword [0x141dc2a3c]
and eax, 0x40010000
cmp eax, 0x9d6b5db7
ja 0x140028d00
cmp cl, 0x12
jne 0x1400274d6
sub rsp, 0x20
call fcn.14001dcf0
add rsp, 0x20
mov qword [rbp + 0x48], 0
mov dword [rbp + 0x130], 0
mov qword [rbp + 0x90], 0
mov dword [rbp + 0x70], 0
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
lea rdx, [rbp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x48]
mov rcx, rax
mov edx, 7
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x10
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x130]
mov rcx, rax
mov edx, 0x1f
mov r9d, 4
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x10
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x90]
mov rcx, rax
mov edx, 0x1e
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x30
cmp dword [rbp + 0x70], 0
jne 0x140028ef7
cmp qword [rbp + 0x48], 0
jne 0x140028ef7
cmp dword [rbp + 0x130], 0
je 0x140028ef7
cmp qword [rbp + 0x90], 0
jne 0x140028ef7
nop word cs:[rax + rax]
mov eax, dword [0x141dc2a60]
imul eax, dword [0x141dc2a64]
xor eax, 0x2f836138
imul eax, eax, 0x74f66880
cmp eax, 0xf6f54354
ja 0x140028e30
sub rsp, 0x20
mov ecx, 0x80000001
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
call fcn.1400290f0
add rsp, 0x20
jmp 0x140027730
ud2
ud2
ud2
mov eax, dword [0x141dc2a48]
or eax, dword [0x141dc2a4c]
imul eax, eax, 0xbd1c8320
add eax, 0x68c7dc40
xor eax, 0xaa6f0546
cmp eax, 0x719f0674
jae 0x140028f30
sub rsp, 0x20
call fcn.1400bf0a0
add rsp, 0x20
nop word [rax + rax]
mov esi, dword [0x141dc2a50]
and esi, dword [0x141dc2a54]
add esi, 0xce22a37d
sub rsp, 0x20
call fcn.1400bf0a0
add rsp, 0x20
cmp esi, 0x3b05ab71
jb 0x140028f30
mov ecx, 0x9b53280b
nop dword [rax]
mov eax, dword [0x141dc2a58]
xor edx, edx
div dword [0x141dc2a5c]
xor eax, 0x9ffe3e33
imul rax, rcx
shr rax, 0x3c
or eax, 0xd3333f16
cmp eax, 0x8e3f120a
je 0x140028f60
jmp 0x1400274d6
sub rsp, 0x20
call fcn.1400bf0a0
add rsp, 0x20
nop dword [rax]
mov eax, dword [0x141dc2a40]
xor edx, edx
div dword [0x141dc2a44]
add eax, 0x1acb2fd3
imul rax, rax, 0x67831233
shr rax, 0x3e
or eax, 0xaa06c590
cmp eax, 0x142942e3
jb 0x140028fa0
jmp 0x1400274d6
mov eax, dword [0x141dc2920]
and eax, dword [0x141dc2924]
or eax, 0x353ceb21
add eax, 0x6f90c912
and eax, 0x8545cc9a
cmp eax, 0xefbcbc5c
jbe 0x140029019
jmp 0x140029052
mov eax, dword [0x141dc2950]
and eax, dword [0x141dc2954]
or eax, 0xff68fffd
add eax, 0xf66b314f
cmp eax, 0x41c08937
jae 0x1400290b2
jmp 0x1400290e3
mov eax, dword [0x141dc2928]
or eax, dword [0x141dc292c]
imul rsi, rax, 0x37016229
shr rsi, 0x3c
add esi, 0x91f92ed3
xor esi, 0xe6add7a2
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
cmp esi, 0x986d1619
jbe 0x140029062
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
jmp 0x140029019
mov eax, dword [0x141dc2930]
add eax, dword [0x141dc2934]
imul eax, eax, 0x75c0007d
add eax, 0x29f4d65b
or eax, 0xcda4b8e6
cmp eax, 0x9e40f8cf
je 0x1400290ae
mov eax, dword [0x141dc2938]
add eax, dword [str.0U__D]
or eax, 0xb53aa3a4
xor eax, 0x395b30cd
imul eax, eax, 0xb8aba96e
ud2
ud2
mov eax, dword [0x141dc2958]
xor eax, dword [0x141dc295c]
mov ecx, 0xbc7b8987
imul rcx, rax
shr rcx, 0x3e
imul eax, ecx, 0xbfeead9f
add eax, 0x582e57fa
ud2
ud2