Function at 0x1a3ac
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4e8
mov rax, qword [0x00016500]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
mov rsi, rcx
mov qword [rsp + 0x160], rcx
mov r13, r8
mov qword [rsp + 0x188], r8
mov r14, rdx
mov qword [rsp + 0x1e8], rdx
lea rcx, [rsp + 0x2f2]
xor ebp, ebp
xor edx, edx
mov r8d, 0xbe
mov r15, r9
mov qword [rsp + 0x150], r9
mov word [rsp + 0x2f0], bp
call fcn.00015420
lea ebx, [rbp + 1]
mov edi, 0x1002
mov ecx, ebx
mov r8d, 0x4d525356
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r12, rax
mov qword [rsp + 0x158], rax
cmp rax, rbp
je 0x1cb23
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.00015420
mov byte [r12], bl
mov ebx, dword [r13]
movabs rdi, 0xfffff78000000320
mov dword [rsp + 0x144], ebp
mov byte [rsp + 0x140], bpl
mov rdi, qword [rdi]
mov cl, byte [rsi + 0x7b27]
mov dword [rsp + 0x14c], ebx
call fcn.00014e28
lea r8d, [rbp + 1]
mov byte [rsi + 0x7b11], al
cmp eax, ebp
jbe 0x1a4a2
mov byte [rsi + 0x7b11], r8b
mov edx, 0x1000
cmp byte [rsi + 0x7b11], r8b
je 0x1a501
mov r8, rdx
lea rcx, [rsi + 0x74]
xor edx, edx
call fcn.00015420
xor eax, eax
mov edx, 0x1000
mov qword [rsi + 0x7a64], rax
mov qword [rsi + 0x7a6c], rax
mov qword [rsi + 0x7a74], rax
mov qword [rsi + 0x7a7c], rax
mov qword [rsi + 0x7a84], rax
mov qword [rsi + 0x7a8c], rax
mov qword [rsi + 0x7a94], rax
lea r8d, [rax + 1]
mov qword [rsi + 0x7a9c], rax
movzx ecx, byte [r14]
mov eax, 0x9c
cmp ecx, eax
jg 0x1caae
je 0x1c994
cmp ecx, 0x29
jg 0x1c54e
je 0x1ad30
sub ecx, 0x1d
je 0x1acd2
sub ecx, r8d
je 0x1ac30
sub ecx, 5
je 0x1ac0d
sub ecx, r8d
je 0x1abbc
sub ecx, r8d
je 0x1aa63
sub ecx, r8d
je 0x1a810
sub ecx, r8d
je 0x1a5c5
cmp ecx, r8d
jne 0x1d97f
movzx eax, word [r14 + 1]
mov word [rsi + 0x10da], ax
movzx eax, byte [r14 + 4]
mov word [rsi + 0x10dc], ax
cmp byte [r14 + 3], 0x80
mov eax, ebp
sete al
mov word [rsi + 0x10e0], ax
cmp ebx, 4
jne 0x1a5b8
mov eax, dword [r15]
mov ecx, eax
shr eax, 0x10
shr ecx, 8
movzx edx, cl
movzx ecx, al
shl edx, 8
or edx, ecx
shl edx, 4
mov dword [rsi + 0x10e6], edx
mov byte [r12], bpl
mov dword [r13], ebp
jmp 0x1cb15
movzx ecx, word [r14 + 1]
mov word [rsi + 0x10da], cx
movzx eax, byte [r14 + 4]
mov word [rsi + 0x10dc], ax
cmp byte [r14 + 3], 0x80
mov eax, ebp
sete al
mov word [rsi + 0x10e0], ax
mov eax, ExAllocatePoolWithTag
cmp cx, ax
jne 0x1cb15
mov r8, rdx
lea rcx, [rsi + 0x83fd]
xor edx, edx
call fcn.00015420
lea rcx, [rsi + 0x83fd]
mov r8, rbx
mov rdx, r15
call fcn.00015520
movzx ecx, byte [rsi + 0x83fe]
movzx eax, byte [rsi + 0x83ff]
shl ecx, 8
or ecx, eax
shl ecx, 4
mov dword [rsi + 0x7ac4], ecx
test bl, 0xf
jne 0x1a744
movzx eax, word [rsi + 0x8409]
mov r13d, 0x10
lea r8, [rsi + 0x7ab4]
mov word [rsi + 0x10ee], ax
mov al, byte [rsi + 0x840b]
lea rdx, [rsp + 0x230]
mov byte [rsi + 0x10f0], al
movzx eax, byte [rsi + 0x10ee]
movzx ecx, byte [rsi + 0x10ef]
shl eax, 8
mov r9d, r13d
or ecx, eax
movzx eax, byte [rsi + 0x10f0]
shl ecx, 8
or ecx, eax
xor eax, eax
mov qword [rsp + 0x230], rax
mov qword [rsp + 0x238], rax
mov eax, dword [rsi + 0x8405]
mov dword [rsi + 0x10f1], ecx
lea rcx, [rsi + 0x7a94]
mov dword [rsp + 0x230], eax
call fcn.00011d40
mov al, byte [rsi + 0x1138]
mov r11b, byte [rsi + 0x1137]
mov byte [rsp + 0x235], al
mov al, byte [rsi + 0x1139]
lea r8, [rsi + 0x7aa4]
lea rdx, [rsp + 0x230]
lea rcx, [rsi + 0x7a94]
mov r9d, r13d
mov byte [rsp + 0x236], al
mov byte [rsp + 0x234], r11b
call fcn.00011d40
mov r9d, dword [rsp + 0x14c]
lea rdx, [rsi + 0x840d]
lea r8, [rsi + 0x83fd]
add r9d, 0xfffffff0
lea rcx, [rsi + 0x7aa4]
mov dword [rsi + 0x7ac8], r9d
call fcn.00011c14
mov r13, qword [rsp + 0x188]
jmp 0x1a769
lea r9d, [rbx - 8]
lea rdx, [rsi + 0x8405]
lea rcx, [rsi + 0x7aa4]
lea r8, [rsi + 0x83fd]
mov dword [rsi + 0x7ac8], r9d
call fcn.00011c14
mov ebx, 3
lea rcx, [rsi + 0x83fd]
lea r12d, [rbx - 2]
mov al, byte [rcx - 0x730f]
xor byte [rcx], al
add rcx, r12
sub rbx, r12
jne 0x1a779
add dword [rsi + 0x10f1], r12d
mov ecx, dword [rsi + 0x10f1]
mov r8d, dword [rsi + 0x7ac8]
mov eax, ecx
shr ecx, 8
lea rdx, [rsi + 0x83fd]
shr eax, 0x10
mov byte [rsi + 0x10ef], cl
mov byte [rsi + 0x10ee], al
mov al, byte [rsi + 0x10f1]
mov byte [rsi + 0x10f0], al
mov eax, dword [rsi + 0x7ac4]
lea rcx, [rax + rsi + 0x62a4]
call fcn.00015520
lea r9, [rsi + 0x62a4]
lea r8, [0x0001eef0]
mov rdx, rsi
mov ecx, 0x1001
mov dword [rsp + 0x20], 0xfc0
call fcn.000110dc
mov r12, qword [rsp + 0x158]
cmp eax, ebp
setne al
mov byte [r12], al
jmp 0x1a5bc
movzx eax, word [r14 + 1]
lea rcx, [rsp + 0x220]
mov r13d, 0x10
mov word [rsi + 0x10da], ax
movzx eax, byte [r14 + 4]
mov word [rsi + 0x10dc], ax
cmp byte [r14 + 3], 0x80
mov eax, ebp
sete al
mov word [rsi + 0x10e0], ax
movzx eax, word [r15]
mov word [rcx], ax
mov al, byte [r15 + 2]
mov byte [rcx + 2], al
movzx ecx, byte [rsp + 0x221]
movzx eax, byte [rsp + 0x222]
shl ecx, 8
or ecx, eax
shl ecx, 4
mov dword [rsi + 0x10e6], ecx
cmp ebx, r13d
jne 0x1aa52
movdqu xmm0, xmmword [r15]
lea rcx, [rsp + 0x22c]
mov byte [rsp + 0x1f0], 0x12
mov byte [rsp + 0x1f1], 0x34
mov byte [rsp + 0x1f2], 0x56
mov byte [rsp + 0x1f3], 0x78
movdqu xmmword [rsp + 0x220], xmm0
movzx eax, word [rcx]
mov byte [rsp + 0x1f4], r8b
mov byte [rsp + 0x1f5], 0x23
mov word [rsi + 0x10ee], ax
mov al, byte [rcx + 2]
lea rcx, [rsp + 0x1f0]
mov byte [rsi + 0x10f0], al
lea rax, [rsp + 0x228]
mov byte [rsp + 0x1f6], 0x45
mov edx, dword [rax]
mov byte [rsp + 0x1f7], bpl
mov dword [rsi + 0x83f9], ebp
cmp edx, dword [rcx]
jne 0x1a917
mov dx, word [rax + 4]
cmp dx, word [rcx + 4]
jne 0x1a917
mov dl, byte [rax + 6]
cmp dl, byte [rcx + 6]
jne 0x1a917
mov eax, ebp
jmp 0x1a91c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
jne 0x1a927
mov dword [rsi + 0x83f9], r8d
movzx eax, byte [rsi + 0x10ee]
movzx ecx, byte [rsi + 0x10ef]
mov dx, word [rsi + 0x10da]
shl eax, 8
or ecx, eax
movzx eax, byte [rsi + 0x10f0]
shl ecx, 8
or ecx, eax
xor eax, eax
mov qword [rsp + 0x210], rax
mov dword [rsi + 0x10f1], ecx
mov rcx, qword [rsp + 0x228]
mov qword [rsp + 0x218], rax
mov eax, ExAllocatePoolWithTag
mov dword [rsp + 0x210], ecx
cmp dx, ax
je 0x1a9ed
mov eax, 0xf5ff
cmp dx, ax
je 0x1a9ed
shr rcx, 0x38
cmp cl, 2
jne 0x1a9ab
mov dword [rsi + 0x10e2], r8d
lea rcx, [rsi + 0x7a84]
lea r8, [rsi + 0x7ab4]
jmp 0x1aa42
mov r9d, r13d
lea rdx, [rsp + 0x210]
cmp byte [rsp + 0x22f], r8b
jne 0x1a9d7
mov dword [rsi + 0x10e2], r8d
lea rcx, [rsi + 0x7a74]
lea r8, [rsi + 0x7ab4]
jmp 0x1aa4d
mov dword [rsi + 0x10e2], ebp
lea r8, [rsi + 0x7ab4]
lea rcx, [rsi + 0x7a64]
jmp 0x1aa4d
lea r8, [rsi + 0x7ab4]
lea rdx, [rsp + 0x210]
lea rcx, [rsi + 0x7a94]
mov r9d, r13d
call fcn.00011d40
mov al, byte [rsi + 0x1138]
mov r11b, byte [rsi + 0x1137]
mov byte [rsp + 0x215], al
mov al, byte [rsi + 0x1139]
mov byte [rsp + 0x214], r11b
lea r8, [rsi + 0x7aa4]
lea rcx, [rsi + 0x7a94]
mov byte [rsp + 0x216], al
mov r9d, r13d
lea rdx, [rsp + 0x210]
call fcn.00011d40
movzx eax, word [r14 + 1]
mov word [rsi + 0x10da], ax
jmp 0x1cb15
movzx eax, word [rsi + 0x1138]
ror ax, 8
add ax, r8w
ror ax, 8
mov word [rsi + 0x1138], ax
movzx eax, word [rsi + 0x1131]
ror ax, 8
add ax, r8w
ror ax, 8
mov word [rsi + 0x1131], ax
movzx r13d, word [r14 + 1]
mov word [rsi + 0x10da], r13w
movzx eax, byte [r14 + 4]
mov word [rsi + 0x10dc], ax
cmp ebx, 0x18
jbe 0x1cb15
mov edi, 0xa4
lea rcx, [rsp + 0x3f0]
xor edx, edx
mov r8, rdi
call fcn.00015420
mov r8, rbx
cmp ebx, edi
lea rcx, [rsp + 0x3f0]
mov rdx, r15
cmova r8, rdi
call fcn.00015520
movzx eax, byte [rsp + 0x3f2]
movzx edi, byte [rsp + 0x3f1]
movzx ebp, byte [rsp + 0x3f4]
shl di, 8
or di, ax
mov eax, 0xf5ff
shl di, 4
cmp r13w, ax
jne 0x1ab5c
lea eax, [rbp + 0x18]
cmp eax, ebx
jne 0x1ab5c
movzx eax, di
lea rdx, [rsp + 0x408]
mov r8, rbp
lea rcx, [rax + rsi + 0x7264]
call fcn.00015520
lea r9, [rsi + 0x7264]
lea r8, [0x0001eee0]
mov rdx, rsi
mov ecx, 0x1001
mov dword [rsp + 0x20], 0x800
call fcn.000110dc
mov eax, ExAllocatePoolWithTag
cmp word [rsi + 0x10da], ax
jne 0x1cb15
lea eax, [rbp + 0x18]
cmp eax, ebx
jne 0x1cb15
movzx eax, di
lea rdx, [rsp + 0x408]
mov r8, rbp
lea rcx, [rax + rsi + 0x62a4]
call fcn.00015520
lea r9, [rsi + 0x62a4]
lea r8, [0x0001eef0]
mov rdx, rsi
mov ecx, 0x1001
mov dword [rsp + 0x20], 0xfc0
call fcn.000110dc
jmp 0x1cb15
movzx eax, word [r14 + 1]
mov word [rsi + 0x10da], ax
movzx eax, byte [r14 + 4]
mov word [rsi + 0x10dc], ax
movzx eax, word [rsi + 0x1138]
ror ax, 8
add ax, r8w
ror ax, 8
mov word [rsi + 0x1138], ax
movzx eax, word [rsi + 0x1131]
ror ax, 8
add ax, r8w
ror ax, 8
mov word [rsi + 0x1131], ax
jmp 0x1cb15
movzx eax, word [r14 + 1]
mov word [rsi + 0x10da], ax
movzx eax, byte [r14 + 4]
mov word [rsi + 0x10dc], ax
cmp ebx, 0x18
jne 0x1cb15
jmp 0x1abd4
cmp byte [rsi + 2], bpl
je 0x1d98d
mov eax, dword [r13]
lea rcx, [r14 + 1]
mov r8, rsi
mov edx, 4
mov dword [rsi + 0x108c], eax
call fcn.0001a304
mov edx, dword [rsi + 0x108c]
mov rcx, r15
call fcn.0001a304
mov ebx, 3
cmp word [r14 + 1], bx
seta al
mov byte [rsi + 0x1090], al
lea eax, [rbx + 4]
cmp word [r14 + 1], ax
jae 0x1ac87
movzx eax, byte [r14 + 1]
jmp 0x1ac8c
mov eax, 8
mov ebx, 0x30
lea rcx, [rsi + 0x1092]
xor edx, edx
mov r8, rbx
mov byte [rsi + 0x1091], al
call fcn.00015420
movsxd r11, dword [rsi + 0x108c]
cmp r11d, ebx
jae 0x1acb7
mov rbx, r11
lea rcx, [rsi + 0x1092]
mov r8, rbx
mov rdx, r15
call fcn.00015520
mov byte [r12], bpl
jmp 0x1cb15
cmp byte [rsi + 2], bpl
je 0x1d98d
lea rcx, [r14 + 1]
mov r8, rsi
mov edx, 4
mov byte [r12], bpl
call fcn.0001a304
movzx r8d, word [r14 + 1]
movzx edi, byte [r14 + 4]
movzx eax, r8b
mov rdx, r15
lea rbx, [rax + rsi + 0x34]
mov r8, rdi
mov dword [0x00016714], eax
mov rcx, rbx
mov dword [0x00016710], edi
call fcn.00015520
mov r8, rsi
mov edx, edi
mov rcx, rbx
call fcn.0001a304
jmp 0x1a5bc
movzx eax, word [r14 + 1]
movsxd rbx, dword [r13]
mov edi, 0x40
mov word [rsi + 0x10da], ax
movzx eax, byte [r14 + 4]
lea rcx, [rsp + 0x2b0]
mov word [rsi + 0x10dc], ax
cmp byte [r14 + 3], 0x80
mov eax, ebp
sete al
mov r8, rdi
xor edx, edx
mov word [rsi + 0x10e0], ax
mov dword [rsp + 0x148], ebp
call fcn.00015420
mov r8, rdi
cmp ebx, edi
lea rcx, [rsp + 0x2b0]
cmovb r8, rbx
mov rdx, r15
call fcn.00015520
mov al, byte [rsp + 0x2b0]
lea r14d, [rdi - 0x10]
mov byte [rsi + 0x10f5], al
mov al, byte [rsp + 0x2b1]
lea r13, [0x00018958]
mov r8, r14
xor edx, edx
mov rcx, r13
mov byte [rsi + 0x10f6], al
call fcn.00015420
lea rcx, [0x00018988]
mov r8, r14
xor edx, edx
call fcn.00015420
lea r15d, [rdi - 0x38]
lea edi, [r14 - 0x20]
mov dword [rsp + 0x14c], r15d
cmp ebx, 0x20
je 0x1adfa
cmp ebx, r14d
je 0x1adfa
cmp ebx, 0x40
jne 0x1aec9
lea rcx, [rsp + 0x2bc]
lea r8, [rsi + 0x7ab4]
lea rdx, [rsp + 0x240]
movzx eax, word [rcx]
mov r9d, edi
mov r15d, edi
mov word [rsi + 0x10ee], ax
mov al, byte [rcx + 2]
mov dword [rsp + 0x14c], edi
mov byte [rsi + 0x10f0], al
movzx eax, byte [rsi + 0x10ee]
movzx ecx, byte [rsi + 0x10ef]
shl eax, 8
or ecx, eax
movzx eax, byte [rsi + 0x10f0]
shl ecx, 8
or ecx, eax
xor eax, eax
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x248], rax
mov eax, dword [rsp + 0x2b8]
mov dword [rsi + 0x10f1], ecx
lea rcx, [rsi + 0x7a94]
mov dword [rsp + 0x240], eax
call fcn.00011d40
mov al, byte [rsi + 0x1138]
mov r11b, byte [rsi + 0x1137]
mov byte [rsp + 0x245], al
mov al, byte [rsi + 0x1139]
lea r8, [rsi + 0x7aa4]
lea rdx, [rsp + 0x240]
lea rcx, [rsi + 0x7a94]
mov r9d, edi
mov byte [rsp + 0x246], al
mov byte [rsp + 0x244], r11b
call fcn.00011d40
sub ebx, r15d
movsxd rax, r15d
lea rcx, [rsi + 0x7ab4]
cmp ebx, r14d
lea rdx, [rsp + rax + 0x2b0]
mov r8, r13
cmova ebx, r14d
mov qword [rsp + 0x150], rcx
mov r9d, ebx
call fcn.00011c14
mov ebx, 3
mov r11, rbp
lea r14d, [rbx - 2]
mov al, byte [r11 + rsi + 0x10ee]
xor byte [r11 + r13], al
add r11, r14
cmp r11, rbx
jl 0x1af04
add dword [rsi + 0x10f1], r14d
mov ecx, dword [rsi + 0x10f1]
mov r15d, 0xc0
mov eax, ecx
shr ecx, 8
mov r8, r15
shr eax, 0x10
mov byte [rsi + 0x10ef], cl
lea rcx, [rsp + 0x2f0]
mov byte [rsi + 0x10ee], al
mov al, byte [rsi + 0x10f1]
xor edx, edx
mov byte [rsi + 0x10f0], al
call fcn.00015420
movzx r11d, word [rsi + 0x10da]
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r11d
lea rax, [0x0001ef00]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x2f0]
mov r14d, 0x800
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov dword [rsp + 0x20], r14d
call fcn.00010590
mov edx, dword [rsi + 0xa]
lea rax, [rsp + 0x148]
mov r13d, 0x2001
lea r9, [0x00016590]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x2f0]
mov ecx, r13d
mov dword [rsp + 0x20], edi
call fcn.000109ac
mov edx, dword [rsi + 0xa]
lea r11, [rsp + 0x148]
lea r9, [0x000165f0]
lea r8, [rsp + 0x2f0]
mov qword [rsp + 0x28], r11
mov ecx, r13d
mov dword [rsp + 0x20], edi
call fcn.000109ac
movzx r11d, word [rsi + 0x10da]
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], r11d
lea rax, [0x0001ef00]
lea rcx, [rsp + 0x2f0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov dword [rsp + 0x20], r14d
call fcn.00010590
mov edx, dword [rsi + 0xa]
lea r11, [rsp + 0x148]
mov qword [rsp + 0x28], r11
lea r9, [0x000165a0]
lea r8, [rsp + 0x2f0]
mov ecx, r13d
mov dword [rsp + 0x20], edi
call fcn.000109ac
movzx r11d, word [rsi + 0x10da]
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], r11d
lea rax, [0x0001ef00]
lea rcx, [rsp + 0x2f0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov dword [rsp + 0x20], r14d
call fcn.00010590
mov edx, dword [rsi + 0xa]
lea r11, [rsp + 0x148]
mov qword [rsp + 0x28], r11
lea r9, [0x000165b0]
lea r8, [rsp + 0x2f0]
mov ecx, r13d
mov dword [rsp + 0x20], edi
call fcn.000109ac
movzx r11d, word [rsi + 0x10da]
mov dword [rsp + 0x38], 4
lea rax, [0x0001ef00]
mov dword [rsp + 0x30], r11d
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x2f0]
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov dword [rsp + 0x20], r14d
call fcn.00010590
mov edx, dword [rsi + 0xa]
lea r11, [rsp + 0x148]
lea r9, [0x000165c0]
lea r8, [rsp + 0x2f0]
mov qword [rsp + 0x28], r11
mov ecx, r13d
mov dword [rsp + 0x20], edi
call fcn.000109ac
movzx r11d, word [rsi + 0x10da]
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], r11d
lea rax, [0x0001ef00]
lea rcx, [rsp + 0x2f0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov dword [rsp + 0x20], r14d
call fcn.00010590
mov edx, dword [rsi + 0xa]
lea r11, [rsp + 0x148]
mov qword [rsp + 0x28], r11
lea r9, [0x000165d0]
lea r8, [rsp + 0x2f0]
mov ecx, r13d
mov dword [rsp + 0x20], edi
call fcn.000109ac
movzx r11d, word [rsi + 0x10da]
mov r13d, 6
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r11d
lea rax, [0x0001ef00]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x2f0]
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x144], r13d
call fcn.00010590
mov edx, dword [rsi + 0xa]
lea r11, [rsp + 0x148]
mov r14d, 0x2001
lea r9, [0x000165e0]
mov qword [rsp + 0x28], r11
lea r8, [rsp + 0x2f0]
mov ecx, r14d
mov dword [rsp + 0x20], edi
call fcn.000109ac
mov edx, dword [rsi + 0xa]
lea r11, [rsp + 0x148]
lea r9, [0x00016600]
lea r8, [rsp + 0x2f0]
mov qword [rsp + 0x28], r11
mov ecx, r14d
mov dword [rsp + 0x20], edi
call fcn.000109ac
lea rcx, [rsp + 0x2f0]
mov r8, r15
xor edx, edx
call fcn.00015420
cmp byte [rsi + 0x7b12], 0x11
mov eax, 0x8001
cmove r14d, eax
movzx eax, byte [rsi + 0x10f5]
cmp eax, 5
mov dword [rsp + 0x1f0], r14d
jg 0x1bea6
cmp eax, 4
jge 0x1ba84
cmp eax, ebp
jl 0x1cb15
lea r10d, [r13 - 5]
cmp eax, r10d
jle 0x1b89b
cmp eax, 2
je 0x1b5b0
cmp eax, ebx
jne 0x1cb15
movzx eax, byte [0x00018977]
movzx ecx, byte [0x00018976]
movzx edx, byte [0x00018975]
mov dword [rsp + 0x138], eax
mov dword [rsp + 0x130], ecx
movzx eax, byte [0x00018968]
movzx r8d, byte [0x00018974]
movzx r9d, byte [0x00018973]
movzx ebx, byte [0x00018970]
mov dword [rsp + 0x128], edx
movzx r10d, byte [0x00018972]
movzx r11d, byte [0x00018971]
movzx edi, byte [0x0001896f]
mov dword [rsp + 0x120], r8d
movzx esi, byte [0x0001896e]
movzx ebp, byte [0x0001896d]
movzx r12d, byte [0x0001896c]
movzx r13d, byte [0x0001896b]
movzx r14d, byte [0x0001896a]
movzx r15d, byte [0x00018969]
mov dword [rsp + 0x118], r9d
mov dword [rsp + 0x110], r10d
mov dword [rsp + 0x108], r11d
mov dword [rsp + 0x100], ebx
mov rbx, qword [rsp + 0x160]
mov dword [rsp + 0xf8], edi
mov dword [rsp + 0xf0], esi
mov dword [rsp + 0xe8], ebp
mov dword [rsp + 0xe0], r12d
mov dword [rsp + 0xd8], r13d
mov dword [rsp + 0xd0], r14d
mov dword [rsp + 0xc8], r15d
mov dword [rsp + 0xc0], eax
movzx eax, byte [0x00018967]
lea rcx, [rsp + 0x2f0]
xor r9d, r9d
mov dword [rsp + 0xb8], eax
movzx eax, byte [0x00018966]
xor r8d, r8d
mov dword [rsp + 0xb0], eax
movzx eax, byte [0x00018965]
mov edx, 0xc0
mov dword [rsp + 0xa8], eax
movzx eax, byte [0x00018964]
mov dword [rsp + 0xa0], eax
movzx eax, byte [0x00018963]
mov dword [rsp + 0x98], eax
movzx eax, byte [0x00018962]
mov dword [rsp + 0x90], eax
movzx eax, byte [0x00018961]
mov dword [rsp + 0x88], eax
movzx eax, byte [0x00018960]
mov dword [rsp + 0x80], eax
movzx eax, byte [0x0001895f]
mov dword [rsp + 0x78], eax
movzx eax, byte [0x0001895e]
mov dword [rsp + 0x70], eax
movzx eax, byte [0x0001895d]
mov dword [rsp + 0x68], eax
movzx eax, byte [0x0001895c]
mov dword [rsp + 0x60], eax
movzx eax, byte [0x0001895b]
mov dword [rsp + 0x58], eax
movzx eax, byte [0x0001895a]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x00018959]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x00018958]
mov dword [rsp + 0x40], eax
movzx eax, word [rbx + 0x10da]
mov dword [rsp + 0x38], eax
movzx eax, byte [rbx + 0x10f5]
mov dword [rsp + 0x30], eax
lea rax, [0x0001efc0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
call fcn.00010590
lea r11, [rsp + 0x148]
mov ebp, 0x20
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], ebp
mov edx, dword [rbx + 0xa]
mov ecx, dword [rsp + 0x1f0]
lea rsi, [0x00018988]
lea r8, [rsp + 0x2f0]
mov r9, rsi
call fcn.000109ac
xor edi, edi
lea r13d, [rbp - 0x10]
cmp eax, edi
jge 0x1b53f
lea rdx, [0x00018958]
lea rcx, [0x000165d0]
mov r9d, r13d
mov r8, rsi
call fcn.00011c14
lea r14, [0x00018998]
lea rdx, [0x00018968]
lea rcx, [0x000165c0]
mov r8, r14
mov r9d, r13d
call fcn.00011d40
mov r11, rsi
mov rcx, r13
lea ebx, [rbp - 0x1f]
mov al, byte [r11 + 0x10]
xor byte [r11], al
add r11, rbx
sub rcx, rbx
jne 0x1b521
mov r8, rbp
xor edx, edx
mov rcx, r14
call fcn.00015420
jmp 0x1b562
cmp byte [rbx + 0x7b12], dil
je 0x1b55d
lea rcx, [0x00018948]
mov r9d, r13d
mov r8, rsi
mov rdx, rsi
call fcn.00011c14
mov ebx, 1
movsxd rcx, dword [rsp + 0x14c]
lea rdx, [rsp + rcx + 0x2c0]
mov al, byte [rdx + rdi]
xor byte [rdi + rsi], al
add rdi, rbx
cmp rdi, r13
jl 0x1b572
mov rcx, qword [rsp + 0x150]
mov r9d, r13d
mov r8, rsi
mov rdx, rsi
call fcn.00011d40
mov r11, qword [0x00018990]
mov qword [0x00018998], r11
mov qword [0x000189a0], r11
jmp 0x1c541
movzx eax, byte [0x00018977]
movzx ecx, byte [0x00018976]
movzx edx, byte [0x00018975]
mov dword [rsp + 0x138], eax
mov dword [rsp + 0x130], ecx
movzx eax, byte [0x00018968]
movzx r8d, byte [0x00018974]
movzx r9d, byte [0x00018973]
movzx ebx, byte [0x00018970]
mov dword [rsp + 0x128], edx
movzx r10d, byte [0x00018972]
movzx r11d, byte [0x00018971]
movzx edi, byte [0x0001896f]
mov dword [rsp + 0x120], r8d
movzx esi, byte [0x0001896e]
movzx ebp, byte [0x0001896d]
movzx r12d, byte [0x0001896c]
movzx r13d, byte [0x0001896b]
movzx r14d, byte [0x0001896a]
movzx r15d, byte [0x00018969]
mov dword [rsp + 0x118], r9d
mov dword [rsp + 0x110], r10d
mov dword [rsp + 0x108], r11d
mov dword [rsp + 0x100], ebx
mov rbx, qword [rsp + 0x160]
mov dword [rsp + 0xf8], edi
mov dword [rsp + 0xf0], esi
mov dword [rsp + 0xe8], ebp
mov dword [rsp + 0xe0], r12d
mov dword [rsp + 0xd8], r13d
mov dword [rsp + 0xd0], r14d
mov dword [rsp + 0xc8], r15d
mov dword [rsp + 0xc0], eax
movzx eax, byte [0x00018967]
lea rcx, [rsp + 0x2f0]
xor r9d, r9d
mov dword [rsp + 0xb8], eax
movzx eax, byte [0x00018966]
xor r8d, r8d
mov dword [rsp + 0xb0], eax
movzx eax, byte [0x00018965]
mov edx, 0xc0
mov dword [rsp + 0xa8], eax
movzx eax, byte [0x00018964]
mov dword [rsp + 0xa0], eax
movzx eax, byte [0x00018963]
mov dword [rsp + 0x98], eax
movzx eax, byte [0x00018962]
mov dword [rsp + 0x90], eax
movzx eax, byte [0x00018961]
mov dword [rsp + 0x88], eax
movzx eax, byte [0x00018960]
mov dword [rsp + 0x80], eax
movzx eax, byte [0x0001895f]
mov dword [rsp + 0x78], eax
movzx eax, byte [0x0001895e]
mov dword [rsp + 0x70], eax
movzx eax, byte [0x0001895d]
mov dword [rsp + 0x68], eax
movzx eax, byte [0x0001895c]
mov dword [rsp + 0x60], eax
movzx eax, byte [0x0001895b]
mov dword [rsp + 0x58], eax
movzx eax, byte [0x0001895a]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x00018959]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x00018958]
mov dword [rsp + 0x40], eax
movzx eax, word [rbx + 0x10da]
mov dword [rsp + 0x38], eax
movzx eax, byte [rbx + 0x10f5]
mov dword [rsp + 0x30], eax
lea rax, [0x0001efc0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
call fcn.00010590
lea r11, [rsp + 0x148]
mov r13d, 0x10
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], r13d
mov edx, dword [rbx + 0xa]
mov ecx, dword [rsp + 0x1f0]
lea rsi, [0x00018988]
lea r8, [rsp + 0x2f0]
mov r9, rsi
call fcn.000109ac
xor edi, edi
cmp eax, edi
jge 0x1b852
lea rdx, [0x00018958]
lea rcx, [0x000165a0]
mov r9d, r13d
mov r8, rsi
call fcn.00011d40
lea r14, [0x00018998]
lea rdx, [0x00018968]
lea rcx, [0x000165b0]
mov r8, r14
mov r9d, r13d
call fcn.00011d40
mov r11, rsi
mov rcx, r13
lea ebx, [rdi + 1]
mov al, byte [r11 + 0x10]
xor byte [r11], al
add r11, rbx
sub rcx, rbx
jne 0x1b833
lea r8d, [rcx + 0x20]
xor edx, edx
mov rcx, r14
call fcn.00015420
jmp 0x1b875
cmp byte [rbx + 0x7b12], dil
je 0x1b870
lea rcx, [0x00018948]
mov r9d, r13d
mov r8, rsi
mov rdx, rsi
call fcn.00011c14
mov ebx, 1
movsxd rcx, dword [rsp + 0x14c]
lea rdx, [rsp + rcx + 0x2c0]
mov al, byte [rdx + rdi]
xor byte [rdi + rsi], al
add rdi, rbx
cmp rdi, r13
jl 0x1b885
mov r9d, r13d
jmp 0x1c52e
movzx eax, byte [0x00018967]
movzx ecx, byte [0x00018966]
movzx edx, byte [0x00018965]
movzx r8d, byte [0x00018964]
movzx r9d, byte [0x00018963]
movzx ebx, byte [0x00018960]
movzx r10d, byte [0x00018962]
movzx r11d, byte [0x00018961]
movzx edi, byte [0x0001895f]
movzx esi, byte [0x0001895e]
movzx ebp, byte [0x0001895d]
movzx r12d, byte [0x0001895c]
movzx r13d, byte [0x0001895b]
movzx r14d, byte [0x0001895a]
movzx r15d, byte [0x00018959]
mov dword [rsp + 0xb8], eax
movzx eax, byte [0x00018958]
mov dword [rsp + 0xb0], ecx
mov dword [rsp + 0xa8], edx
mov dword [rsp + 0xa0], r8d
mov dword [rsp + 0x98], r9d
mov dword [rsp + 0x90], r10d
mov dword [rsp + 0x88], r11d
mov dword [rsp + 0x80], ebx
mov rbx, qword [rsp + 0x160]
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], ebp
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], eax
movzx eax, word [rbx + 0x10da]
lea rcx, [rsp + 0x2f0]
xor r9d, r9d
mov dword [rsp + 0x38], eax
movzx eax, byte [rbx + 0x10f5]
xor r8d, r8d
mov dword [rsp + 0x30], eax
lea rax, [0x0001ef20]
mov edx, 0xc0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
call fcn.00010590
mov edx, dword [rbx + 0xa]
mov ecx, dword [rsp + 0x1f0]
lea r11, [rsp + 0x148]
mov qword [rsp + 0x28], r11
lea rsi, [0x00018988]
lea r8, [rsp + 0x2f0]
mov r13d, 0x10
mov r9, rsi
mov dword [rsp + 0x20], r13d
call fcn.000109ac
xor edi, edi
cmp eax, edi
jge 0x1ba3d
cmp byte [rbx + 0x10f5], dil
jne 0x1ba1e
lea rdx, [0x00018958]
lea rcx, [0x00016590]
mov r9d, r13d
mov r8, rsi
call fcn.00011d40
mov r8d, 1
cmp byte [rbx + 0x10f5], r8b
jne 0x1ba61
lea rdx, [0x00018958]
lea rcx, [0x00016590]
jmp 0x1ba50
cmp byte [rbx + 0x7b12], dil
je 0x1ba5b
mov rdx, rsi
lea rcx, [0x00018948]
mov r9d, r13d
mov r8, rsi
call fcn.00011c14
mov r8d, 1
movsxd rcx, dword [rsp + 0x14c]
lea rdx, [rsp + rcx + 0x2b0]
mov al, byte [rdx + rdi]
xor byte [rdi + rsi], al
add rdi, r8
cmp rdi, r13
jl 0x1ba71
jmp 0x1b893
movzx eax, byte [0x00018977]
movzx ecx, byte [0x00018976]
movzx edx, byte [0x00018975]
mov dword [rsp + 0x138], eax
mov dword [rsp + 0x130], ecx
movzx eax, byte [0x00018968]
movzx r8d, byte [0x00018974]
movzx r9d, byte [0x00018973]
movzx ebx, byte [0x00018970]
mov dword [rsp + 0x128], edx
movzx r10d, byte [0x00018972]
movzx r11d, byte [0x00018971]
movzx edi, byte [0x0001896f]
mov dword [rsp + 0x120], r8d
movzx esi, byte [0x0001896e]
movzx ebp, byte [0x0001896d]
movzx r12d, byte [0x0001896c]
movzx r13d, byte [0x0001896b]
movzx r14d, byte [0x0001896a]
movzx r15d, byte [0x00018969]
mov dword [rsp + 0x118], r9d
mov dword [rsp + 0x110], r10d
mov dword [rsp + 0x108], r11d
mov dword [rsp + 0x100], ebx
mov rbx, qword [rsp + 0x160]
mov dword [rsp + 0xf8], edi
mov dword [rsp + 0xf0], esi
mov dword [rsp + 0xe8], ebp
mov dword [rsp + 0xe0], r12d
mov dword [rsp + 0xd8], r13d
mov dword [rsp + 0xd0], r14d
mov dword [rsp + 0xc8], r15d
mov dword [rsp + 0xc0], eax
movzx eax, byte [0x00018967]
lea rcx, [rsp + 0x2f0]
xor r9d, r9d
mov dword [rsp + 0xb8], eax
movzx eax, byte [0x00018966]
xor r8d, r8d
mov dword [rsp + 0xb0], eax
movzx eax, byte [0x00018965]
mov edx, 0xc0
mov dword [rsp + 0xa8], eax
movzx eax, byte [0x00018964]
mov dword [rsp + 0xa0], eax
movzx eax, byte [0x00018963]
mov dword [rsp + 0x98], eax
movzx eax, byte [0x00018962]
mov dword [rsp + 0x90], eax
movzx eax, byte [0x00018961]
mov dword [rsp + 0x88], eax
movzx eax, byte [0x00018960]
mov dword [rsp + 0x80], eax
movzx eax, byte [0x0001895f]
mov dword [rsp + 0x78], eax
movzx eax, byte [0x0001895e]
mov dword [rsp + 0x70], eax
movzx eax, byte [0x0001895d]
mov dword [rsp + 0x68], eax
movzx eax, byte [0x0001895c]
mov dword [rsp + 0x60], eax
movzx eax, byte [0x0001895b]
mov dword [rsp + 0x58], eax
movzx eax, byte [0x0001895a]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x00018959]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x00018958]
mov dword [rsp + 0x40], eax
movzx eax, word [rbx + 0x10da]
mov dword [rsp + 0x38], eax
movzx eax, byte [rbx + 0x10f5]
mov dword [rsp + 0x30], eax
lea rax, [0x0001efc0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
call fcn.00010590
lea r11, [rsp + 0x148]
mov ebp, 0x30
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], ebp
mov edx, dword [rbx + 0xa]
mov ecx, dword [rsp + 0x1f0]
lea rsi, [0x00018988]
lea r8, [rsp + 0x2f0]
mov r9, rsi
call fcn.000109ac
xor edi, edi
cmp eax, edi
jge 0x1be20
lea rdx, [0x00018958]
mov rcx, rsi
mov r8, rbp
call fcn.00015520
cmp byte [rbx + 0x10f5], 4
lea r14, [0x00018998]
lea r13d, [rbp - 0x20]
jne 0x1bd81
lea rdx, [0x00018958]
lea rcx, [0x000165a0]
mov r9d, r13d
mov r8, rsi
call fcn.00011d40
lea rdx, [0x00018968]
lea rcx, [0x000165b0]
mov r9d, r13d
mov r8, r14
call fcn.00011d40
lea r8, [0x000189a8]
lea rdx, [0x00018978]
lea rcx, [0x000165c0]
mov r9d, r13d
call fcn.00011d40
mov r11, rsi
mov rcx, r13
lea ebp, [rdi + 1]
mov al, byte [r11 + 0x10]
xor al, byte [r11 + 0x20]
xor byte [r11], al
add r11, rbp
sub rcx, rbp
jne 0x1bd49
lea rcx, [0x000165d0]
mov r9d, r13d
mov r8, rsi
mov rdx, rsi
call fcn.00011d40
xor edx, edx
mov rcx, r14
lea r8d, [rdx + 0x20]
call fcn.00015420
jmp 0x1bd86
mov ebp, 1
cmp byte [rbx + 0x10f5], 5
jne 0x1be44
lea rdx, [0x00018958]
lea rcx, [0x000165d0]
mov r9d, r13d
mov r8, rsi
call fcn.00011c14
lea rdx, [0x00018968]
lea rcx, [0x000165c0]
mov r9d, r13d
mov r8, r14
call fcn.00011d40
lea r8, [0x000189a8]
lea rdx, [0x00018978]
lea rcx, [0x000165b0]
mov r9d, r13d
call fcn.00011d40
mov r11, rsi
mov rcx, r13
mov al, byte [r11 + 0x10]
xor al, byte [r11 + 0x20]
xor byte [r11], al
add r11, rbp
sub rcx, rbp
jne 0x1bde8
lea rcx, [0x000165a0]
mov r9d, r13d
mov r8, rsi
mov rdx, rsi
call fcn.00011c14
xor edx, edx
mov rcx, r14
lea r8d, [rdx + 0x20]
call fcn.00015420
jmp 0x1be44
mov r13d, 0x10
cmp byte [rbx + 0x7b12], dil
je 0x1be44
lea rcx, [0x00018948]
mov r9d, r13d
mov r8, rsi
mov rdx, rsi
call fcn.00011c14
movsxd rcx, dword [rsp + 0x14c]
mov r10d, 1
lea rdx, [rsp + rcx + 0x2d0]
mov al, byte [rdx + rdi]
xor byte [rdi + rsi], al
add rdi, r10
cmp rdi, r13
jl 0x1be5a
mov rcx, qword [rsp + 0x150]
mov r9d, r13d
mov r8, rsi
mov rdx, rsi
call fcn.00011d40
mov r11, qword [0x00018990]
mov qword [0x00018998], r11
mov qword [0x000189a0], r11
mov qword [0x000189a8], r11
mov qword [0x000189b0], r11
jmp 0x1c541
cmp eax, r13d
jl 0x1cb15
cmp eax, 9
jle 0x1c0fa
cmp eax, 0xb
jg 0x1cb15
movzx eax, byte [0x00018967]
movzx ecx, byte [0x00018966]
movzx edx, byte [0x00018965]
movzx r8d, byte [0x00018964]
movzx r9d, byte [0x00018963]
movzx ebx, byte [0x00018960]
movzx r10d, byte [0x00018962]
movzx r11d, byte [0x00018961]
movzx edi, byte [0x0001895f]
movzx esi, byte [0x0001895e]
movzx ebp, byte [0x0001895d]
movzx r12d, byte [0x0001895c]
movzx r13d, byte [0x0001895b]
movzx r14d, byte [0x0001895a]
movzx r15d, byte [0x00018959]
mov dword [rsp + 0xb8], eax
movzx eax, byte [0x00018958]
mov dword [rsp + 0xb0], ecx
mov dword [rsp + 0xa8], edx
mov dword [rsp + 0xa0], r8d
mov dword [rsp + 0x98], r9d
mov dword [rsp + 0x90], r10d
mov dword [rsp + 0x88], r11d
mov dword [rsp + 0x80], ebx
mov rbx, qword [rsp + 0x160]
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], ebp
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], eax
movzx eax, word [rbx + 0x10da]
lea rcx, [rsp + 0x2f0]
xor r9d, r9d
mov dword [rsp + 0x38], eax
movzx eax, byte [rbx + 0x10f5]
xor r8d, r8d
mov dword [rsp + 0x30], eax
lea rax, [0x0001ef20]
mov edx, 0xc0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
call fcn.00010590
mov edx, dword [rbx + 0xa]
mov ecx, dword [rsp + 0x1f0]
lea r11, [rsp + 0x148]
mov qword [rsp + 0x28], r11
lea rsi, [0x00018988]
lea r8, [rsp + 0x2f0]
mov r9, rsi
mov dword [rsp + 0x20], 0x20
call fcn.000109ac
xor edi, edi
cmp eax, edi
lea r13d, [rdi + 0x10]
jge 0x1c091
lea ecx, [rdi + 0xa]
lea r14, [0x00018998]
cmp byte [rbx + 0x10f5], cl
jne 0x1c063
lea rdx, [0x00018958]
lea rcx, [0x00016600]
mov r9d, r13d
mov r8, rsi
call fcn.00011d40
lea rcx, [0x00016600]
mov r9d, r13d
mov r8, r14
mov rdx, rsi
call fcn.00011d40
cmp byte [rbx + 0x10f5], 0xb
jne 0x1c0cb
lea rdx, [0x00018958]
lea rcx, [0x00016600]
mov r9d, r13d
mov r8, rsi
call fcn.00011c14
mov rdx, rsi
lea rcx, [0x00016600]
jmp 0x1c0c0
cmp byte [rbx + 0x7b12], dil
je 0x1c0cb
lea rcx, [0x00018948]
mov r9d, r13d
mov r8, rsi
mov rdx, rsi
call fcn.00011c14
lea r14, [0x00018998]
lea rcx, [0x00018948]
mov rdx, r14
mov r9d, r13d
mov r8, r14
call fcn.00011c14
movsxd rcx, dword [rsp + 0x14c]
mov r10d, 1
lea rdx, [rsp + rcx + 0x2b0]
mov al, byte [rdx + rdi]
xor byte [rdi + rsi], al
add rdi, r10
cmp rdi, r13
jl 0x1c0e1
mov r9d, 0x20
jmp 0x1c52e
movzx eax, byte [0x00018977]
movzx ecx, byte [0x00018976]
movzx edx, byte [0x00018975]
mov dword [rsp + 0x138], eax
mov dword [rsp + 0x130], ecx
movzx eax, byte [0x00018968]
movzx r8d, byte [0x00018974]
movzx r9d, byte [0x00018973]
movzx ebx, byte [0x00018970]
mov dword [rsp + 0x128], edx
movzx r10d, byte [0x00018972]
movzx r11d, byte [0x00018971]
movzx edi, byte [0x0001896f]
mov dword [rsp + 0x120], r8d
movzx esi, byte [0x0001896e]
movzx ebp, byte [0x0001896d]
movzx r12d, byte [0x0001896c]
movzx r13d, byte [0x0001896b]
movzx r14d, byte [0x0001896a]
movzx r15d, byte [0x00018969]
mov dword [rsp + 0x118], r9d
mov dword [rsp + 0x110], r10d
mov dword [rsp + 0x108], r11d
mov dword [rsp + 0x100], ebx
mov rbx, qword [rsp + 0x160]
mov dword [rsp + 0xf8], edi
mov dword [rsp + 0xf0], esi
mov dword [rsp + 0xe8], ebp
mov dword [rsp + 0xe0], r12d
mov dword [rsp + 0xd8], r13d
mov dword [rsp + 0xd0], r14d
mov dword [rsp + 0xc8], r15d
mov dword [rsp + 0xc0], eax
movzx eax, byte [0x00018967]
lea rcx, [rsp + 0x2f0]
xor r9d, r9d
mov dword [rsp + 0xb8], eax
movzx eax, byte [0x00018966]
xor r8d, r8d
mov dword [rsp + 0xb0], eax
movzx eax, byte [0x00018965]
mov edx, 0xc0
mov dword [rsp + 0xa8], eax
movzx eax, byte [0x00018964]
mov dword [rsp + 0xa0], eax
movzx eax, byte [0x00018963]
mov dword [rsp + 0x98], eax
movzx eax, byte [0x00018962]
mov dword [rsp + 0x90], eax
movzx eax, byte [0x00018961]
mov dword [rsp + 0x88], eax
movzx eax, byte [0x00018960]
mov dword [rsp + 0x80], eax
movzx eax, byte [0x0001895f]
mov dword [rsp + 0x78], eax
movzx eax, byte [0x0001895e]
mov dword [rsp + 0x70], eax
movzx eax, byte [0x0001895d]
mov dword [rsp + 0x68], eax
movzx eax, byte [0x0001895c]
mov dword [rsp + 0x60], eax
movzx eax, byte [0x0001895b]
mov dword [rsp + 0x58], eax
movzx eax, byte [0x0001895a]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x00018959]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x00018958]
mov dword [rsp + 0x40], eax
movzx eax, word [rbx + 0x10da]
mov dword [rsp + 0x38], eax
movzx eax, byte [rbx + 0x10f5]
mov dword [rsp + 0x30], eax
lea rax, [0x0001efc0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
call fcn.00010590
lea r11, [rsp + 0x148]
mov ebp, 0x20
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], ebp
mov edx, dword [rbx + 0xa]
mov ecx, dword [rsp + 0x1f0]
lea rsi, [0x00018988]
lea r8, [rsp + 0x2f0]
mov r9, rsi
call fcn.000109ac
xor edi, edi
cmp eax, edi
jge 0x1c4c7
lea rdx, [0x00018958]
mov rcx, rsi
mov r8, rbp
call fcn.00015520
lea rcx, [rsp + 0x278]
lea rdx, [0x00018958]
lea r8d, [rbp + 0x10]
call fcn.00015520
mov r11b, byte [rbx + 0x10f5]
mov eax, dword [rsp + 0x144]
lea r14, [0x00018998]
cmp r11b, al
je 0x1c38d
lea eax, [rbp - 0x18]
cmp r11b, al
jne 0x1c412
lea r12, [0x00016590]
mov r13d, 0x10
lea rdx, [rsp + 0x278]
mov rcx, r12
mov r9d, r13d
cmp byte [rbx + 0x10f6], dil
jne 0x1c3d1
mov r8, rsi
call fcn.00011d40
lea rdx, [rsp + 0x288]
mov r9d, r13d
mov r8, r14
mov rcx, r12
call fcn.00011d40
jmp 0x1c41f
mov r8, r14
call fcn.00011d40
mov r11, rdi
mov rcx, r13
mov r15d, 1
mov al, byte [r11 + rsi + 0x10]
xor byte [rsp + r11 + 0x288], al
add r11, r15
sub rcx, r15
jne 0x1c3e5
lea rdx, [rsp + 0x288]
mov r9d, r13d
mov r8, rsi
mov rcx, r12
call fcn.00011d40
jmp 0x1c425
mov r13d, 0x10
lea r12, [0x00016590]
mov r15d, 1
mov cl, byte [rbx + 0x10f5]
mov eax, 7
cmp cl, al
je 0x1c43d
cmp cl, 9
jne 0x1c507
mov r9d, r13d
mov r8, rsi
lea rdx, [rsp + 0x278]
mov rcx, r12
cmp byte [rbx + 0x10f6], dil
jne 0x1c461
call fcn.00011c14
mov r8, r14
jmp 0x1c4ba
call fcn.00011c14
mov rcx, r13
mov al, byte [r14 - 0x10]
xor byte [r14], al
add r14, r15
sub rcx, r15
jne 0x1c469
movzx ecx, byte [rbx + 0x10f6]
mov eax, r13d
mov dl, dil
sub eax, ecx
cmp eax, edi
jle 0x1c4b7
movzx eax, byte [rbx + 0x10f6]
mov r8d, r13d
mov r9, rcx
sub r8d, eax
movzx ecx, dl
add dl, r15b
add rcx, r9
mov al, byte [rcx + rsi + 0x10]
mov byte [rsp + rcx + 0x288], al
movzx eax, dl
cmp eax, r8d
jl 0x1c49b
mov r8, rsi
lea rdx, [rsp + 0x288]
mov rcx, r12
jmp 0x1c4ff
mov r13d, 0x10
cmp byte [rbx + 0x7b12], dil
je 0x1c507
lea rcx, [0x00018948]
mov r9d, r13d
mov r8, rsi
mov rdx, rsi
call fcn.00011c14
lea r14, [0x00018998]
lea rcx, [0x00018948]
mov r8, r14
mov rdx, r14
mov r9d, r13d
call fcn.00011c14
movsxd rcx, dword [rsp + 0x14c]
mov r10d, 1
lea rdx, [rsp + rcx + 0x2c0]
mov al, byte [rdx + rdi]
xor byte [rdi + rsi], al
add rdi, r10
cmp rdi, r13
jl 0x1c51d
mov r9d, ebp
mov rcx, qword [rsp + 0x150]
mov r8, rsi
mov rdx, rsi
call fcn.00011d40
mov r12, qword [rsp + 0x158]
jmp 0x1cb15
sub ecx, 0x2f
je 0x1c819
sub ecx, 0x51
je 0x1c7a1
sub ecx, r8d
je 0x1c72b
sub ecx, r8d
je 0x1c6dd
sub ecx, r8d
je 0x1c659
sub ecx, r8d
je 0x1c626
mov ebx, 7
sub ecx, ebx
je 0x1c5d1
cmp ecx, 0xd
jne 0x1d97f
lea edx, [rbx - 3]
lea rcx, [r14 + 1]
mov r8, rsi
call fcn.0001a304
cmp byte [rsi + 2], bpl
je 0x1d98d
mov byte [r12], bpl
mov eax, dword [r14 + 1]
lea rcx, [r12 + 2]
lea rdx, [rsi + 0x1074]
mov dword [rcx], eax
call fcn.0001eb44
mov ebx, 4
jmp 0x1c619
lea rcx, [r14 + 1]
mov r8, rsi
mov edx, 2
call fcn.0001a304
cmp byte [rsi + 2], bpl
je 0x1d98d
cmp word [r14 + 1], bx
ja 0x1d98d
mov byte [r12], bpl
movzx ecx, word [r14 + 1]
mov eax, dword [rsi + rcx*2 + 0x24]
mov dword [r12 + 2], eax
movzx eax, word [rsi + rcx*2 + 0x28]
mov word [r12 + 6], ax
mov ebx, 6
mov byte [rsp + 0x140], 1
jmp 0x1d994
cmp byte [rsi + 2], bpl
je 0x1d98d
mov byte [r12], bpl
mov ecx, 7
lea rdx, [r12 + 2]
mov al, byte [rsi + rcx + 0x1c]
sub rcx, r8
mov byte [rdx], al
add rdx, r8
cmp rcx, rbp
jge 0x1c63e
mov ebx, 8
jmp 0x1c80c
lea rcx, [r14 + 1]
mov r8, rsi
mov edx, 4
call fcn.0001a304
cmp byte [rsi + 2], bpl
je 0x1d98d
mov rcx, rsi
call fcn.0001a370
movzx ecx, word [r14 + 1]
add ecx, ecx
cmp ecx, eax
jge 0x1d98d
mov byte [r12], bpl
movzx edx, word [r14 + 1]
movzx eax, word [r14 + 3]
mov rcx, rsi
mov ebx, ebp
mov byte [rsp + 0x140], bpl
mov word [rsi + rdx*2 + 0x74], ax
call fcn.0001a370
lea r9, [rsi + 0x74]
lea r8, [0x0001ec90]
mov rdx, rsi
mov ecx, 0x1002
mov dword [rsp + 0x20], eax
call fcn.000110dc
cmp eax, ebp
jne 0x1d994
mov byte [r12], bpl
jmp 0x1d994
lea rcx, [r14 + 1]
mov r8, rsi
mov edx, 2
call fcn.0001a304
cmp byte [rsi + 2], bpl
je 0x1d98d
mov rcx, rsi
call fcn.0001a370
movzx ecx, word [r14 + 1]
add ecx, ecx
cmp ecx, eax
jge 0x1d98d
mov byte [r12], bpl
movzx ecx, word [r14 + 1]
mov eax, dword [rsi + rcx*2 + 0x74]
mov dword [r12 + 2], eax
movzx eax, word [rsi + rcx*2 + 0x78]
jmp 0x1c60e
lea rcx, [r14 + 1]
mov r8, rsi
mov edx, 4
call fcn.0001a304
mov r8d, dword [rsi + 0xa]
cmp dword [r14 + 1], r8d
jne 0x1d98d
mov r8d, 1
cmp byte [rsi + 1], r8b
jne 0x1d98d
mov rcx, rsi
mov byte [r12], bpl
call fcn.0001a370
mov rcx, rsi
mov byte [r12 + 2], al
call fcn.0001a370
lea r13d, [r8 + 0xf]
sar eax, 8
mov byte [r12 + 4], r13b
lea ebx, [r8 + 2]
mov byte [r12 + 3], al
mov byte [rsi + 2], r8b
mov byte [rsp + 0x140], r8b
mov r13, qword [rsp + 0x188]
jmp 0x1d994
movzx eax, word [r14 + 1]
mov byte [rsi + 3], sil
mov byte [rsi + 1], r8b
mov word [rsi + 4], ax
mov ecx, 0xa
mov eax, 0xa0cb
mov word [rsi + 6], ax
lea ebx, [rcx - 7]
mov byte [r12], bpl
mov byte [r12 + 2], 2
mov byte [r12 + 3], cl
cmp byte [rsi + 0x28], bl
je 0x1c7df
cmp byte [rsi + 0x28], 5
mov eax, ecx
jne 0x1c7e4
mov eax, 0x1a
mov byte [r12 + 3], al
movzx eax, byte [rsi + 8]
mov byte [r12 + 6], bl
cmp al, 5
mov byte [r12 + 4], bpl
mov byte [r12 + 5], 0x19
cmova ecx, eax
mov ebx, 5
mov byte [r12 + 3], cl
mov byte [rsp + 0x140], r8b
jmp 0x1d994
mov byte [rsp + 0x1f8], 0x79
mov byte [rsp + 0x1f9], 0x4c
mov byte [rsp + 0x1fa], 0xe1
mov byte [rsp + 0x1fb], 0x88
mov byte [rsp + 0x1fc], 0xcb
mov byte [rsp + 0x1fd], 0xc1
mov byte [rsp + 0x1fe], 0x78
mov byte [rsp + 0x1ff], 0x53
mov byte [rsp + 0x200], 0x11
mov byte [rsp + 0x201], 0x69
mov byte [rsp + 0x202], 0xe0
mov byte [rsp + 0x203], 0xb2
mov byte [rsp + 0x204], 0xca
mov byte [rsp + 0x205], 0x97
mov byte [rsp + 0x206], 0xc9
mov byte [rsp + 0x207], 0x76
cmp ebx, 8
jne 0x1cb15
xor eax, eax
lea r13d, [rbx + 8]
lea r8, [rsp + 0x268]
mov qword [rsi + 0x93fd], rax
mov qword [rsi + 0x9405], rax
mov qword [rsi + 0x940d], rax
mov qword [rsp + 0x268], rax
mov dword [rsi + 0x9415], eax
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x258], rax
mov dword [rsp + 0x260], eax
mov qword [rsp + 0x270], rax
mov eax, dword [r14 + 1]
lea rdx, [rsp + 0x268]
lea rcx, [rsp + 0x1f8]
mov r9d, r13d
mov dword [rsp + 0x268], eax
call fcn.00011d40
mov r11, qword [r15]
mov qword [rsi + 0x93fd], r11
mov eax, dword [0x00016640]
mov qword [rsp + 0x258], r11
mov dword [rsp + 0x250], eax
mov dword [rsp + 0x260], eax
call fcn.0001210c
lea r8, [rsp + 0x250]
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x268]
mov r9d, r13d
call fcn.00011d40
lea rcx, [rsp + 0x250]
mov rax, qword [rcx]
mov qword [rsi + 0x9405], rax
mov rax, qword [rcx + 8]
mov qword [rsi + 0x940d], rax
mov eax, dword [rcx + 0x10]
mov dword [rsi + 0x9415], eax
mov byte [r12], bpl
mov byte [r12 + 4], bpl
jmp 0x1cb15
cmp byte [rsi + 2], bpl
je 0x1d98d
lea rcx, [r14 + 1]
mov r8, rsi
mov edx, 4
mov byte [r12], bpl
call fcn.0001a304
movabs rax, 0xfffff78000000014
mov rax, qword [rax]
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x190]
mov qword [rsp + 0x190], rax
mov rax, qword [rsi + 0x6c]
add qword [rsp + 0x190], rax
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
movzx eax, word [r14 + 1]
mov ecx, 0xff
and ax, cx
jne 0x1ca1f
mov cl, byte [rsp + 0x1a6]
call fcn.00012048
mov cl, byte [rsp + 0x1a8]
mov byte [r12 + 4], al
call fcn.00012048
mov cl, byte [rsp + 0x1aa]
jmp 0x1ca75
mov ebx, 3
cmp ax, bx
jne 0x1ca86
movsx ecx, word [rsp + 0x1a0]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub ecx, edx
call fcn.00012048
mov cl, byte [rsp + 0x1ae]
mov byte [r12 + 5], al
call fcn.00012048
mov cl, byte [rsp + 0x1a2]
mov byte [r12 + 4], al
call fcn.00012048
mov cl, byte [rsp + 0x1a4]
mov byte [r12 + 3], al
call fcn.00012048
mov byte [r12 + 2], al
jmp 0x1caa4
movzx eax, word [r14 + 1]
lea rcx, [r12 + 2]
mov r8, rax
movzx eax, al
lea rdx, [rax + rsi + 0x34]
shr r8, 8
call fcn.00015520
movzx ebx, byte [r14 + 2]
jmp 0x1c619
mov eax, 0xa6
cmp ecx, eax
jg 0x1d939
je 0x1d705
sub ecx, 0x9d
je 0x1d5b3
sub ecx, r8d
je 0x1cc90
sub ecx, 2
je 0x1cc7a
sub ecx, r8d
je 0x1cbcf
sub ecx, r8d
je 0x1cb47
sub ecx, r8d
je 0x1cb00
sub ecx, r8d
je 0x1cb00
cmp ecx, r8d
jne 0x1d97f
mov byte [r12], bpl
mov byte [r12 + 2], bpl
mov dword [r13], r8d
mov al, byte [r12 + 2]
mov byte [r15], al
mov edx, 0x4d525356
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.00015300
add rsp, 0x4e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp word [r14 + 1], bp
jne 0x1cb15
mov edi, 0x7c1
cmp ebx, edi
jne 0x1cb8a
lea rcx, [r12 + 2]
lea rdx, [rsi + 0x113f]
mov r8, rdi
mov byte [r12], bpl
call fcn.00015520
lea rdx, [r12 + 2]
mov r8, rdi
mov rcx, r15
mov dword [r13], edi
call fcn.00015520
mov ebx, dword [rsp + 0x14c]
cmp word [r14 + 1], bp
jne 0x1cb15
mov edi, 0x1a1
cmp ebx, edi
jne 0x1cb15
mov byte [r12], bpl
lea rdx, [rsi + 0x113f]
lea rcx, [r12 + 2]
mov r8, rdi
call fcn.00015520
mov dword [r13], edi
mov r8, rdi
lea rdx, [r12 + 2]
mov rcx, r15
call fcn.00015520
jmp 0x1cb15
movzx ecx, word [r14 + 1]
cmp ecx, ebp
je 0x1cc50
sub ecx, r8d
je 0x1cc2f
sub ecx, r8d
je 0x1cc01
cmp ecx, r8d
jne 0x1cc71
mov rax, qword [rsi + 0x1137]
mov qword [r12 + 2], rax
mov dword [r13], 8
jmp 0x1cc71
mov rax, qword [rsi + 0x1129]
mov qword [r12 + 2], rax
mov eax, dword [rsi + 0x1131]
mov dword [r12 + 0xa], eax
movzx eax, word [rsi + 0x1135]
mov word [r12 + 0xe], ax
mov dword [r13], 0xe
jmp 0x1cc71
lea rcx, [r12 + 2]
lea rdx, [rsi + 0x10fa]
mov r8d, 0x2f
call fcn.00015520
mov dword [r13], 0x2f
jmp 0x1cc71
movzx eax, word [rsi + 0x10f7]
mov ebx, 3
mov word [r12 + 2], ax
mov al, byte [rsi + 0x10f9]
mov byte [r12 + 4], al
mov dword [r13], ebx
mov r8d, dword [r13]
jmp 0x1cbbd
mov byte [r12], bpl
mov byte [r12 + 4], bpl
mov dword [r13], r8d
mov al, byte [r12]
jmp 0x1cb12
cmp byte [rsi + 2], bpl
je 0x1d98d
lea r14, [0x00018958]
mov r13d, 0x30
xor edx, edx
mov rcx, r14
mov r8, r13
mov dword [rsp + 0x168], ebp
call fcn.00015420
lea rbx, [0x00018988]
mov r8, r13
mov rcx, rbx
xor edx, edx
call fcn.00015420
movsxd rax, dword [rsi + 0x108c]
cmp eax, r13d
jae 0x1ccde
mov r13, rax
lea rdx, [rsi + 0x1092]
mov r8, r13
mov rcx, r14
call fcn.00015520
lea rcx, [rsp + 0x2f0]
xor edx, edx
mov r8d, 0xc0
call fcn.00015420
cmp byte [rsi + 0x7b12], 0x11
jne 0x1cd26
mov dword [rsp + 0x14c], 0x8002
mov dword [rsp + 0x1f0], 0x8003
jmp 0x1cd3c
mov dword [rsp + 0x14c], 0x3001
mov dword [rsp + 0x1f0], 0x4001
mov ecx, dword [rsi + 0x108c]
mov r13d, 0x10
cmp ecx, r13d
je 0x1d157
cmp ecx, 0x20
je 0x1cf96
lea eax, [r13 + 0x20]
cmp ecx, eax
je 0x1cda4
mov qword [rsp + 0x38], rbp
lea rax, [0x0001eeb0]
lea rcx, [rsp + 0x2f0]
mov qword [rsp + 0x30], rax
lea rax, [0x0001eed0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0xc0
mov dword [rsp + 0x20], 0x800
call fcn.00010590
jmp 0x1d290
movzx eax, byte [0x00018977]
movzx ecx, byte [0x00018976]
movzx edx, byte [0x00018975]
mov dword [rsp + 0x130], eax
movzx eax, byte [0x00018969]
movzx r8d, byte [0x00018974]
movzx r9d, byte [0x00018973]
movzx r10d, byte [0x00018972]
movzx r11d, byte [0x00018971]
movzx ebx, byte [0x00018970]
movzx esi, byte [0x0001896f]
movzx ebp, byte [0x0001896e]
movzx r12d, byte [0x0001896d]
movzx r13d, byte [0x0001896c]
movzx r14d, byte [0x0001896b]
movzx r15d, byte [0x0001896a]
mov dword [rsp + 0x128], ecx
mov dword [rsp + 0x120], edx
mov dword [rsp + 0x118], r8d
mov dword [rsp + 0x110], r9d
mov dword [rsp + 0x108], r10d
mov dword [rsp + 0x100], r11d
mov dword [rsp + 0xf8], ebx
mov dword [rsp + 0xf0], esi
mov dword [rsp + 0xe8], ebp
mov dword [rsp + 0xe0], r12d
mov dword [rsp + 0xd8], r13d
mov dword [rsp + 0xd0], r14d
mov dword [rsp + 0xc8], r15d
mov dword [rsp + 0xc0], eax
movzx eax, byte [0x00018968]
mov dword [rsp + 0xb8], eax
movzx eax, byte [0x00018967]
mov dword [rsp + 0xb0], eax
movzx eax, byte [0x00018966]
mov dword [rsp + 0xa8], eax
movzx eax, byte [0x00018965]
mov dword [rsp + 0xa0], eax
movzx eax, byte [0x00018964]
mov dword [rsp + 0x98], eax
movzx eax, byte [0x00018963]
mov dword [rsp + 0x90], eax
movzx eax, byte [0x00018962]
mov dword [rsp + 0x88], eax
movzx eax, byte [0x00018961]
mov dword [rsp + 0x80], eax
movzx eax, byte [0x00018960]
mov dword [rsp + 0x78], eax
movzx eax, byte [0x0001895f]
mov dword [rsp + 0x70], eax
movzx eax, byte [0x0001895e]
mov dword [rsp + 0x68], eax
movzx eax, byte [0x0001895d]
mov dword [rsp + 0x60], eax
movzx eax, byte [0x0001895c]
mov dword [rsp + 0x58], eax
movzx eax, byte [0x0001895b]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x0001895a]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x00018959]
mov dword [rsp + 0x40], eax
movzx eax, byte [0x00018958]
mov dword [rsp + 0x38], eax
lea rax, [0x0001eea0]
mov qword [rsp + 0x30], rax
lea rax, [0x0001ed90]
lea rcx, [rsp + 0x2f0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0
mov dword [rsp + 0x20], 0x800
call fcn.00010590
jmp 0x1d264
movzx eax, byte [0x00018977]
movzx ecx, byte [0x00018976]
movzx edx, byte [0x00018975]
mov dword [rsp + 0x130], eax
movzx eax, byte [0x00018969]
movzx r8d, byte [0x00018974]
movzx r9d, byte [0x00018973]
movzx r10d, byte [0x00018972]
movzx r11d, byte [0x00018971]
movzx ebx, byte [0x00018970]
movzx esi, byte [0x0001896f]
movzx ebp, byte [0x0001896e]
movzx r12d, byte [0x0001896d]
movzx r13d, byte [0x0001896c]
movzx r14d, byte [0x0001896b]
movzx r15d, byte [0x0001896a]
mov dword [rsp + 0x128], ecx
mov dword [rsp + 0x120], edx
mov dword [rsp + 0x118], r8d
mov dword [rsp + 0x110], r9d
mov dword [rsp + 0x108], r10d
mov dword [rsp + 0x100], r11d
mov dword [rsp + 0xf8], ebx
mov dword [rsp + 0xf0], esi
mov dword [rsp + 0xe8], ebp
mov dword [rsp + 0xe0], r12d
mov dword [rsp + 0xd8], r13d
mov dword [rsp + 0xd0], r14d
mov dword [rsp + 0xc8], r15d
mov dword [rsp + 0xc0], eax
movzx eax, byte [0x00018968]
mov dword [rsp + 0xb8], eax
movzx eax, byte [0x00018967]
mov dword [rsp + 0xb0], eax
movzx eax, byte [0x00018966]
mov dword [rsp + 0xa8], eax
movzx eax, byte [0x00018965]
mov dword [rsp + 0xa0], eax
movzx eax, byte [0x00018964]
mov dword [rsp + 0x98], eax
movzx eax, byte [0x00018963]
mov dword [rsp + 0x90], eax
movzx eax, byte [0x00018962]
mov dword [rsp + 0x88], eax
movzx eax, byte [0x00018961]
mov dword [rsp + 0x80], eax
movzx eax, byte [0x00018960]
mov dword [rsp + 0x78], eax
movzx eax, byte [0x0001895f]
mov dword [rsp + 0x70], eax
movzx eax, byte [0x0001895e]
mov dword [rsp + 0x68], eax
movzx eax, byte [0x0001895d]
mov dword [rsp + 0x60], eax
movzx eax, byte [0x0001895c]
mov dword [rsp + 0x58], eax
movzx eax, byte [0x0001895b]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x0001895a]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x00018959]
mov dword [rsp + 0x40], eax
movzx eax, byte [0x00018958]
mov dword [rsp + 0x38], eax
lea rax, [0x0001ed80]
jmp 0x1cf60
movzx eax, byte [0x00018967]
movzx ecx, byte [0x00018966]
movzx edx, byte [0x00018965]
movzx r8d, byte [0x00018964]
movzx r9d, byte [0x00018963]
movzx r10d, byte [0x00018962]
movzx r11d, byte [0x00018961]
movzx ebx, byte [0x00018960]
movzx esi, byte [0x0001895f]
movzx ebp, byte [0x0001895e]
movzx r12d, byte [0x0001895d]
movzx r13d, byte [0x0001895c]
movzx r14d, byte [0x0001895b]
movzx r15d, byte [0x0001895a]
mov dword [rsp + 0xb0], eax
movzx eax, byte [0x00018959]
mov dword [rsp + 0xa8], ecx
mov dword [rsp + 0xa0], edx
mov dword [rsp + 0x98], r8d
mov dword [rsp + 0x90], r9d
mov dword [rsp + 0x88], r10d
mov dword [rsp + 0x80], r11d
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], ebp
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], eax
movzx eax, byte [0x00018958]
lea rcx, [rsp + 0x2f0]
xor r9d, r9d
mov dword [rsp + 0x38], eax
lea rax, [0x0001ece0]
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rax, [0x0001ecf0]
mov edx, 0xc0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
call fcn.00010590
mov rsi, qword [rsp + 0x160]
mov r12, qword [rsp + 0x158]
mov r15, qword [rsp + 0x150]
xor ebp, ebp
lea rbx, [0x00018988]
lea r14, [0x00018958]
lea r13d, [rbp + 0x10]
mov edx, dword [rsi + 0xa]
mov ecx, dword [rsp + 0x1f0]
lea rax, [rsp + 0x168]
mov qword [rsp + 0x28], rax
mov r9, rbx
lea r8, [rsp + 0x2f0]
mov dword [rsp + 0x20], r13d
cmp byte [rsi + 0x1090], bpl
je 0x1d2c7
mov ecx, dword [rsp + 0x14c]
call fcn.000109ac
cmp eax, ebp
jge 0x1d535
movzx ecx, byte [rsi + 0x1091]
cmp ecx, ebp
je 0x1d51e
mov eax, 1
sub ecx, eax
je 0x1d4b6
sub ecx, eax
je 0x1d415
sub ecx, 2
je 0x1d406
sub ecx, eax
je 0x1d39c
cmp ecx, eax
jne 0x1d553
lea rcx, [0x000165d0]
mov r9d, r13d
mov r8, rbx
mov rdx, r14
call fcn.00011c14
lea r14, [0x00018998]
lea rdx, [0x00018968]
lea rcx, [0x000165c0]
mov r8, r14
mov r9d, r13d
call fcn.00011d40
lea r8, [0x000189a8]
lea rdx, [0x00018978]
lea rcx, [0x000165b0]
mov r9d, r13d
call fcn.00011d40
mov r11, rbx
mov rcx, r13
mov r15d, 1
mov al, byte [r11 + 0x10]
xor al, byte [r11 + 0x20]
xor byte [r11], al
add r11, r15
sub rcx, r15
jne 0x1d36f
lea rcx, [0x000165a0]
mov r9d, r13d
mov r8, rbx
mov rdx, rbx
call fcn.00011c14
jmp 0x1d506
lea rcx, [0x000165d0]
mov r9d, r13d
mov r8, rbx
mov rdx, r14
call fcn.00011c14
lea r14, [0x00018998]
lea rdx, [0x00018968]
lea rcx, [0x000165c0]
mov r8, r14
mov r9d, r13d
call fcn.00011d40
mov r11, rbx
mov rcx, r13
mov esi, 1
mov al, byte [r11 + 0x10]
xor byte [r11], al
add r11, rsi
sub rcx, rsi
jne 0x1d3dc
lea r8d, [rcx + 0x20]
xor edx, edx
mov rcx, r14
call fcn.00015420
mov rsi, qword [rsp + 0x160]
jmp 0x1d553
mov rdx, r14
lea rcx, [0x00016590]
jmp 0x1d548
lea rcx, [0x000165a0]
mov r9d, r13d
mov r8, rbx
mov rdx, r14
call fcn.00011d40
lea r14, [0x00018998]
lea rdx, [0x00018968]
lea rcx, [0x000165b0]
mov r8, r14
mov r9d, r13d
call fcn.00011d40
lea r8, [0x000189a8]
lea rdx, [0x00018978]
lea rcx, [0x000165c0]
mov r9d, r13d
call fcn.00011d40
mov r11, rbx
mov rcx, r13
mov r12d, 1
mov al, byte [r11 + 0x10]
xor al, byte [r11 + 0x20]
xor byte [r11], al
add r11, r12
sub rcx, r12
jne 0x1d473
lea rcx, [0x000165d0]
mov r9d, r13d
mov r8, rbx
mov rdx, rbx
call fcn.00011d40
xor edx, edx
mov rcx, r14
lea r8d, [rdx + 0x20]
call fcn.00015420
mov r12, qword [rsp + 0x158]
jmp 0x1d553
lea rcx, [0x000165a0]
mov r9d, r13d
mov r8, rbx
mov rdx, r14
call fcn.00011d40
lea r14, [0x00018998]
lea rdx, [0x00018968]
lea rcx, [0x000165b0]
mov r8, r14
mov r9d, r13d
call fcn.00011d40
mov r11, rbx
mov rcx, r13
mov r15d, 1
mov al, byte [r11 + 0x10]
xor byte [r11], al
add r11, r15
sub rcx, r15
jne 0x1d4f7
xor edx, edx
mov rcx, r14
lea r8d, [rdx + 0x20]
call fcn.00015420
mov r15, qword [rsp + 0x150]
jmp 0x1d553
lea rcx, [0x00016590]
mov r9d, r13d
mov r8, rbx
mov rdx, r14
call fcn.00011d40
jmp 0x1d553
cmp byte [rsi + 0x7b12], bpl
je 0x1d553
mov rdx, rbx
lea rcx, [0x00018948]
mov r9d, r13d
mov r8, rbx
call fcn.00011c14
lea rcx, [rsp + 0x4a0]
mov rdx, rbx
mov r8d, 0x30
call fcn.00015520
lea rcx, [rsi + 0x7ab4]
mov r9d, r13d
mov r8, rbx
mov rdx, rbx
call fcn.00011d40
mov byte [r12], bpl
movsxd r8, dword [rsi + 0x108c]
lea rcx, [r12 + 2]
lea rdx, [rsp + 0x4a0]
call fcn.00015520
mov r14, qword [rsp + 0x1e8]
mov ebx, r13d
mov byte [rsp + 0x140], 1
jmp 0x1c794
cmp byte [rsi + 2], bpl
je 0x1d98d
mov eax, 7
cmp dword [0x00016714], eax
jl 0x1d5f6
lea r9, [rsi + 0x34]
mov dword [rsp + 0x20], 0x38
lea r8, [0x0001eca0]
mov rdx, rsi
mov ecx, 0x1002
call fcn.000110dc
mov ebx, dword [rsp + 0x144]
jmp 0x1c6cc
movabs rax, 0xfffff78000000014
lea rdx, [rsp + 0x178]
mov rbx, qword [rax]
mov rax, qword [rsi + 0x6c]
lea rcx, [rbx + rax]
mov qword [rsp + 0x1e0], rcx
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
cmp dword [0x00016714], ebp
jne 0x1d676
and byte [rsi + 0x34], 0x7f
mov cl, byte [rsi + 0x34]
call fcn.00012078
mov cl, byte [rsi + 0x35]
movzx r8d, al
mov word [rsp + 0x182], r8w
call fcn.00012078
mov cl, byte [rsi + 0x36]
movzx r8d, al
mov word [rsp + 0x180], r8w
call fcn.00012078
movzx r8d, al
mov word [rsp + 0x17e], r8w
jmp 0x1d6c9
mov cl, byte [rsi + 0x37]
call fcn.00012078
mov cl, byte [rsi + 0x38]
movzx r8d, al
mov word [rsp + 0x17c], r8w
call fcn.00012078
mov cl, byte [rsi + 0x3a]
movzx r8d, al
mov word [rsp + 0x17a], r8w
call fcn.00012078
movzx r8d, al
mov eax, 0x7d0
cmp r8d, 0x5a
jl 0x1d6bc
mov eax, 0x76c
add r8w, ax
mov word [rsp + 0x178], r8w
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0x178]
call qword [sym.imp.ntoskrnl.exe_RtlTimeFieldsToTime]
mov r11, qword [rsp + 0x1d8]
lea r9, [rsi + 0x6c]
sub r11, rbx
mov dword [rsp + 0x20], 8
lea r8, [0x0001ecc0]
mov qword [r9], r11
jmp 0x1d5dd
mov r8, rdx
lea rcx, [rsi + 0x83fd]
dec ebx
xor edx, edx
mov dword [rsp + 0x1f0], ebx
call fcn.00015420
mov r10d, 1
cmp dword [rsi + 0x83f9], r10d
jne 0x1d767
lea rcx, [rsi + 0x83fd]
xor edx, edx
mov r8d, 0x1000
call fcn.00015420
lea rcx, [rsi + 0x7ab4]
lea r8, [rsi + 0x83fd]
lea rdx, [rsi + 0x83fd]
mov r9d, ebx
call fcn.00011d40
mov r14d, ebx
jmp 0x1d900
movzx edx, word [rsi + 0x10da]
mov r14d, ExAllocatePoolWithTag
cmp edx, r14d
je 0x1d817
cmp edx, 0xf5ff
je 0x1d7e7
movzx r9d, bp
movzx ecx, bp
mov r8d, 0xf8
mov r15, r10
movzx eax, cx
imul rax, rax, 0x4c
cmp dx, word [rax + rsi + 0x1904]
je 0x1d7b2
add cx, r15w
cmp cx, r8w
jb 0x1d795
jmp 0x1d7b6
mov r9w, cx
movzx ecx, r9w
imul rcx, rcx, 0x4c
movzx eax, word [rcx + rsi + 0x1908]
lea rdx, [rcx + rsi + 0x1910]
lea rcx, [rsi + 0x83fd]
cmp ebx, eax
cmovb eax, ebx
mov r8d, eax
call fcn.00015520
lea eax, [rbx + 1]
jmp 0x1d83f
mov eax, dword [rsi + 0x10e6]
lea rcx, [rsi + 0x83fd]
mov r8d, ebx
lea rdx, [rax + rsi + 0x7264]
call fcn.00015520
mov dword [rsp + 0x144], 0x801
mov r15d, 1
jmp 0x1d846
mov eax, dword [rsi + 0x10e6]
lea rcx, [rsi + 0x83fd]
mov r8d, ebx
lea rdx, [rax + rsi + 0x62a4]
call fcn.00015520
mov eax, 0xfc1
mov r15d, 1
mov dword [rsp + 0x144], eax
lea rcx, [rsi + 0x83fd]
mov ebx, 3
mov al, byte [rcx - 0x730f]
xor byte [rcx], al
add rcx, r15
sub rbx, r15
jne 0x1d852
add dword [rsi + 0x10f1], r15d
mov ecx, dword [rsi + 0x10f1]
mov r15, qword [rsp + 0x150]
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rsi + 0x10ef], cl
movzx ecx, word [rsi + 0x10da]
mov byte [rsi + 0x10ee], al
mov al, byte [rsi + 0x10f1]
mov byte [rsi + 0x10f0], al
cmp ecx, r14d
je 0x1d8db
mov eax, 0xf5ff
cmp ecx, eax
je 0x1d8db
mov r14d, dword [rsp + 0x1f0]
lea rcx, [rsi + 0x7ab4]
lea r8, [rsi + 0x83fd]
lea rdx, [rsi + 0x83fd]
mov r9d, r14d
cmp dword [rsi + 0x10e2], ebp
je 0x1d8fb
call int.00011e70
jmp 0x1d900
mov r14d, dword [rsp + 0x1f0]
lea rcx, [rsi + 0x7ab4]
lea r8, [rsi + 0x83fd]
mov r9d, r14d
lea rdx, [rsi + 0x83fd]
call fcn.00011d40
lea rdx, [rsi + 0x83fd]
lea rcx, [r12 + 2]
mov r8d, r14d
call fcn.00015520
mov r11d, dword [rsp + 0x14c]
mov eax, dword [rsp + 0x144]
cmp eax, r11d
cmovb r11d, eax
mov dword [r13], r11d
mov dword [rsi + 0x10e6], ebp
jmp 0x1cc71
sub ecx, 0xa7
je 0x1cb00
sub ecx, r8d
je 0x1dca3
sub ecx, r8d
je 0x1dbb2
sub ecx, r8d
je 0x1cc7a
sub ecx, r8d
je 0x1cc7a
sub ecx, r8d
je 0x1da80
mov ebx, 3
cmp ecx, ebx
je 0x1da36
cmp byte [rsi + 2], bpl
je 0x1d989
mov byte [r12], bpl
mov dword [r13], ebp
mov ebx, dword [rsp + 0x144]
xor byte [rsi + 3], dil
cmp byte [r12], 0x1f
ja 0x1d9cd
mov r15d, 1
add byte [rsi + 3], r15b
mov al, byte [rsi + 3]
mov r8, r12
mov byte [r12 + 1], al
mov cl, byte [r14]
mov dl, 2
and cl, 0x7f
call fcn.00011fb0
cmp eax, ebp
je 0x1d9a5
mov r15, qword [rsp + 0x150]
mov dil, byte [r12]
mov r14b, byte [r12 + 1]
mov r8, rsi
mov edx, 2
mov rcx, r12
call fcn.0001a304
cmp byte [rsp + 0x140], bpl
je 0x1d9fc
lea rcx, [r12 + 2]
mov edx, ebx
call fcn.0001a304
cmp dil, bpl
jne 0x1da16
mov eax, 0xff
and word [rsi + 6], ax
movzx eax, r14b
shl ax, 8
or word [rsi + 6], ax
mov ecx, dword [r13]
mov eax, ebx
mov rdx, r12
add rax, 2
cmp rax, rcx
cmovb rcx, rax
mov dword [r13], ecx
mov r8d, ecx
jmp 0x1cbc2
mov rax, qword [rsi + 0x9405]
mov qword [r12 + 2], rax
mov rax, qword [rsi + 0x940d]
mov qword [r12 + 0xa], rax
mov eax, dword [rsi + 0x9415]
mov dword [r12 + 0x12], eax
mov dword [r13], 0x14
mov rax, qword [r12 + 2]
mov qword [r15], rax
mov rax, qword [r12 + 0xa]
mov qword [r15 + 8], rax
mov eax, dword [r12 + 0x12]
mov dword [r15 + 0x10], eax
jmp 0x1cb15
xor edx, edx
lea rcx, [rsp + 0x1c4]
lea r8d, [rdx + 0x14]
call fcn.00015420
xor eax, eax
mov dword [rsp + 0x198], ebp
mov dword [rsp + 0x19c], eax
mov dword [rsp + 0x174], eax
mov dword [rsp + 0x170], ebp
movabs rax, 0xfffff78000000014
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x198]
mov rax, qword [rax]
mov qword [rsp + 0x198], rax
call qword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
mov r11, qword [rsi + 0x6c]
add qword [rsp + 0x170], r11
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x170]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
movsx r11d, word [rsp + 0x1b0]
mov eax, 0x76c
sub r11d, eax
movsx eax, word [rsp + 0x1b2]
lea rcx, [rsp + 0x1c0]
dec eax
mov dword [rsp + 0x1c8], r11d
mov dword [rsp + 0x1c4], eax
movsx eax, word [rsp + 0x1b4]
mov dword [rsp + 0x1c0], eax
movsx eax, word [rsp + 0x1b6]
mov dword [rsp + 0x1cc], eax
movsx eax, word [rsp + 0x1b8]
mov dword [rsp + 0x1d0], eax
movsx eax, word [rsp + 0x1ba]
mov dword [rsp + 0x1d4], eax
call fcn.00012090
mov byte [r12 + 5], al
mov ecx, eax
sar ecx, 0x18
mov byte [r12 + 2], cl
mov ecx, eax
sar ecx, 0x10
mov byte [r12 + 3], cl
mov ecx, eax
sar ecx, 8
mov byte [r12 + 4], cl
mov dword [r13], 5
mov eax, dword [r12 + 2]
mov dword [r15], eax
mov al, byte [r12 + 6]
mov byte [r15 + 4], al
jmp 0x1cb15
xor edx, edx
lea rcx, [rsp + 0x3b0]
lea r8d, [rdx + 0x40]
call fcn.00015420
mov r11b, byte [rsi + 0x10f5]
cmp r11b, 2
jbe 0x1dc4a
mov ebx, 3
cmp r11b, bl
je 0x1dbf2
jbe 0x1cb15
cmp r11b, 5
jbe 0x1dc1e
cmp r11b, 0xb
ja 0x1cb15
lea rcx, [rsp + 0x3b0]
lea rdx, [0x00018988]
mov r8d, 0x20
call fcn.00015520
lea rdx, [rsp + 0x3b0]
mov edi, 0x21
jmp 0x1cba9
lea rcx, [rsp + 0x3b0]
lea rdx, [0x00018988]
mov r8d, 0x30
call fcn.00015520
lea rdx, [rsp + 0x3b0]
mov edi, 0x31
jmp 0x1cba9
movdqu xmm0, xmmword [0x00018988]
lea rcx, [rsp + 0x3b0]
movdqu xmmword [rsp + 0x3b0], xmm0
mov rax, qword [rcx]
mov qword [r12 + 2], rax
mov rax, qword [rcx + 8]
mov qword [r12 + 0xa], rax
mov al, byte [rcx + 0x10]
mov byte [r12 + 0x12], al
mov dword [r13], 0x11
mov rax, qword [r12 + 2]
mov qword [r15], rax
mov rax, qword [r12 + 0xa]
mov qword [r15 + 8], rax
mov al, byte [r12 + 0x12]
mov byte [r15 + 0x10], al
jmp 0x1cb15
mov r8, rdx
lea rcx, [rsi + 0x83fd]
xor edx, edx
lea r14d, [rbx - 0x19]
call fcn.00015420
mov r10d, 1
cmp dword [rsi + 0x83f9], r10d
jne 0x1dce0
lea rcx, [rsi + 0x83fd]
xor edx, edx
mov r8d, 0x1000
call fcn.00015420
jmp 0x1ddb3
movzx eax, word [rsi + 0x10dc]
movzx edx, word [rsi + 0x10da]
mov rcx, qword [rsi + rax*8 + 0x113f]
mov eax, ExAllocatePoolWithTag
mov qword [rsp + 0x208], rcx
cmp edx, eax
je 0x1dd7d
cmp edx, 0xf5ff
je 0x1dd6d
movzx r9d, bp
movzx ecx, bp
mov r8d, 0xf8
movzx eax, cx
imul rax, rax, 0x4c
cmp dx, word [rax + rsi + 0x1904]
je 0x1dd39
add cx, r10w
cmp cx, r8w
jb 0x1dd1c
jmp 0x1dd3d
mov r9w, cx
movzx ecx, r9w
imul rcx, rcx, 0x4c
movzx eax, word [rcx + rsi + 0x1908]
lea rdx, [rcx + rsi + 0x1910]
lea rcx, [rsi + 0x83fd]
cmp r14d, eax
cmovb eax, r14d
mov r8d, eax
call fcn.00015520
jmp 0x1dda6
mov eax, dword [rsi + 0x10e6]
lea rdx, [rax + rsi + 0x7264]
jmp 0x1dd8b
mov eax, dword [rsi + 0x10e6]
lea rdx, [rax + rsi + 0x62a4]
lea rcx, [rsi + 0x83fd]
mov r8d, r14d
call fcn.00015520
mov al, byte [rsp + 0x20c]
mov byte [r12 + 3], al
mov r11b, byte [rsp + 0x20d]
mov byte [r12 + 4], r11b
lea rcx, [r12 + 0xa]
lea rdx, [rsi + 0x83fd]
mov r8d, r14d
call fcn.00015520
mov byte [rbx + r12 + 2], 0xff
lea rdx, [r12 + 2]
mov r8, rbx
mov rcx, r15
mov dword [r13], ebx
call fcn.00015520
mov edx, 0x4d525356
mov rcx, r12
mov byte [r12], bpl
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [rsi + 0x10e6], ebp
jmp 0x1cb23