Function at 0x1400a8640
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Encode data using base64
Encode data using xor
Encrypt data using speck
Get common file path
Parse credit card information
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x608
movdqa xmmword [rsp + 0x5f0], xmm6
mov qword [rsp + 0x98], rcx
movzx eax, byte [rdx + 0xa0]
test al, al
sete cl
mov qword [rsp + 0x140], rdx
mov rsi, qword [rdx + 0x98]
test rsi, rsi
sete dl
and dl, cl
mov byte [rsp + 0x8e], dl
mov qword [rsp + 0x90], r8
je 0x1400a86b0
mov r13, r8
xor r12d, r12d
jmp 0x1400aa150
mov ecx, dword [0x141f3f6d8]
sub ecx, dword [0x141f3f6dc]
or ecx, 0x5b523399
imul ecx, ecx, 0x3ccb9c68
add ecx, 0xffc8cc87
mov qword [rsp + 0x1c8], 0
cmp ecx, 0x2f233a1
jb 0x1400a86b0
mov qword [rsp + 0x1d8], 0
test al, al
je 0x1400a870f
mov rax, qword [rsp + 0x140]
mov rcx, qword [rax + 0x88]
test rcx, rcx
jne 0x1400a8bf1
jmp 0x1400a9cb0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
nop word cs:[rax + rax]
mov ecx, dword [0x141f3f6e0]
imul ecx, dword [0x141f3f6e4]
xor ecx, 0xa158
and ecx, 0x458ba95d
imul ecx, ecx, 0x496d8b
cmp ecx, 0x89545703
je 0x1400a8720
test rax, rax
je 0x1400ac0d7
mov qword [rsp + 0x58], rsi
nop word cs:[rax + rax]
mov ecx, dword [0x141f3f6e8]
sub ecx, dword [0x141f3f6ec]
add ecx, 0xc235ec42
and ecx, 0xc83e800e
cmp ecx, 0x1e6eb783
jb 0x1400a8760
mov qword [rsp + 0x80], rax
cmp word [rax], 0
je 0x1400a8bc6
lea r14, [rsp + 0x210]
nop word [rax + rax]
mov eax, dword [0x141f3f6f0]
xor edx, edx
div dword [0x141f3f6f4]
imul eax, eax, 0x7d71dbac
add eax, 0xf5df288e
cmp eax, 0xf81aedd2
ja 0x1400a87a0
mov rbx, qword [rsp + 0x80]
nop dword [rax + rax]
mov eax, dword [0x141f3f6f8]
imul eax, dword [0x141f3f6fc]
imul eax, eax, 0xcf221446
add eax, 0x439bac70
and eax, 0x2cec8274
cmp eax, 0x18a766e8
ja 0x1400a87d0
lea r12, [rsp + 0xa0]
jmp 0x1400a885f
mov qword [rsp + 0x1f0], rsi
mov qword [rsp + 0x1f8], rdi
movdqu xmmword [rsp + 0x200], xmm6
mov rcx, r12
lea rdx, [rsp + 0x1c8]
lea r8, [rsp + 0x1f0]
lea r9, [rsp + 0x160]
call fcn.1400b3910
mov rax, qword [rsp + 0xa0]
shl rax, 1
test rax, rax
jne 0x1400a8b44
nop dword [rax]
cmp word [r13], 0
mov rbx, r13
je 0x1400a8bc6
xor eax, eax
nop word cs:[rax + rax]
mov rbp, rax
nop word cs:[rax + rax]
mov eax, dword [0x141f3f700]
sub eax, dword [0x141f3f704]
add eax, 0xc8dc2c33
or eax, 0xb670a899
and eax, 0xbef3ec9b
cmp eax, 0xba84104c
jb 0x1400a8880
lea rax, [rbp + 1]
cmp word [rbx + rbp*2], 0
jne 0x1400a8870
lea r13, [rbx + rax*2]
cmp rbp, 1
je 0x1400a8850
test rbp, rbp
je 0x1400ac15b
lea rcx, [rbx + rbp*2]
lea r8, [rbx + 2]
xor edi, edi
nop word [rax + rax]
cmp word [r8], 0x3d
je 0x1400a8940
add r8, 2
inc rdi
nop
mov eax, dword [0x141f3f708]
xor edx, edx
div dword [0x141f3f70c]
imul eax, eax, 0xd033769d
add eax, 0xa4350138
xor eax, 0x6939f6fe
cmp eax, 0x74a847d4
jb 0x1400a88e0
nop word cs:[rax + rax]
mov eax, dword [0x141f3f710]
xor eax, dword [0x141f3f714]
and eax, 0xc118703c
imul eax, eax, 0xc77417e8
add eax, 0x9425989d
cmp eax, 0x1c1a5d54
jb 0x1400a8910
cmp r8, rcx
jne 0x1400a88d0
jmp 0x1400a8850
mov eax, dword [0x141f3f728]
imul eax, dword [0x141f3f72c]
mov ecx, 0x8f02fe7f
imul rax, rcx
shr rax, 0x3f
add eax, 0x73c69981
cmp eax, 0x44f57600
cmp rdi, rbp
jae 0x1400a8ba0
nop dword [rax]
mov eax, dword [0x141f3f730]
add eax, dword [0x141f3f734]
imul eax, eax, 0x97f0607f
imul rax, rax, 0x13d83451
shr rax, 0x3c
imul eax, eax, 0xf8d99851
cmp eax, 0x63fdecbd
ja 0x1400a8970
lea rsi, [rdi + 1]
nop
mov r15d, dword [0x141f3f738]
and r15d, dword [0x141f3f73c]
add r15d, 0x2b00d1b8
and r15d, 0xf5bc89a6
add r15d, 0xe73d954a
mov rcx, r12
mov rdx, rbx
mov r8, rsi
call fcn.1400918d0
cmp r15d, 0x611e13e8
ja 0x1400a89a0
add rdi, 2
sub rbp, rdi
jb case.default.0x1400ab46c
nop word [rax + rax]
mov eax, dword [0x141f3f748]
xor edx, edx
div dword [0x141f3f74c]
add eax, 0xe77b8cca
xor eax, 0x5e71facb
cmp eax, 0x2baef549
jb 0x1400a89f0
lea rdx, [rbx + rdi*2]
mov rcx, r14
mov r8, rbp
call fcn.1400918d0
movups xmm0, xmmword [rsp + 0xa0]
movups xmm1, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x200], xmm1
movaps xmmword [rsp + 0x1f0], xmm0
mov rsi, qword [rsp + 0x1f0]
mov rdi, qword [rsp + 0x1f8]
movdqa xmm6, xmmword [rsp + 0x200]
movups xmm0, xmmword [r14]
movups xmm1, xmmword [r14 + 0x10]
movaps xmmword [rsp + 0x160], xmm0
movaps xmmword [rsp + 0x170], xmm1
movabs rax, 0x8000000000000000
cmp rsi, rax
je 0x1400a8bc6
mov eax, dword [0x141f3f750]
and eax, dword [0x141f3f754]
imul eax, eax, 0x9140a8db
and eax, 0x78a14010
cmp eax, 0x484ccb12
mov eax, dword [0x141f3f758]
sub eax, dword [0x141f3f75c]
and eax, 0xf894ddbe
cmp eax, 0x7a8ac21c
je 0x1400a8a9f
movq rax, xmm6
add rax, rdi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], rax
mov word [rsp + 0xb0], 0
lea rcx, [rsp + 0x210]
mov rdx, r12
call fcn.1400b3150
mov eax, dword [0x141f3f760]
xor eax, dword [0x141f3f764]
imul eax, eax, 0x6f664e89
cmp eax, 0x5918e344
jne 0x1400a8800
mov qword [rsp + 0x1f0], rsi
mov qword [rsp + 0x1f8], rdi
movdqu xmmword [rsp + 0x200], xmm6
mov rcx, r12
lea rdx, [rsp + 0x1c8]
lea r8, [rsp + 0x1f0]
lea r9, [rsp + 0x160]
call fcn.1400b3910
jmp 0x1400a8800
mov rsi, qword [rsp + 0xa8]
mov rdi, qword [0x141f49060]
mov eax, dword [0x141f3f768]
sub eax, dword [0x141f3f76c]
and eax, 0x67c70a1d
xor eax, 0x2676dcf6
add eax, 0x795c22f4
cmp eax, 0x48253f4c
jae 0x1400a8b83
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400a8850
mov eax, dword [0x141f3f740]
imul eax, dword [0x141f3f744]
imul eax, eax, 0x551dc58c
add eax, 0xd5a3e810
ud2
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rsi, qword [rsp + 0x58]
mov rax, qword [rsp + 0x140]
mov rcx, qword [rax + 0x88]
test rcx, rcx
je 0x1400a9cb0
test rsi, rsi
je 0x1400a9cb0
mov rax, qword [rsp + 0x140]
mov r9, qword [rax + 0x90]
nop dword [rax]
mov eax, dword [0x141f3f770]
or eax, dword [0x141f3f774]
xor eax, 0xb05befcc
add eax, 0x4ed39b19
cmp eax, 0xa42e403b
ja 0x1400a8c10
xor r15d, r15d
xor r13d, r13d
jmp 0x1400a8c6c
mov rax, qword [rsp + 0x160]
shl rax, 1
test rax, rax
jne 0x1400a8d60
mov ecx, 0
mov rsi, qword [rsp + 0x58]
dec rsi
mov r9, qword [rsp + 0x60]
je 0x1400a9cb0
test r13, r13
je 0x1400a8c90
movzx eax, word [r13 + 0x3d2]
cmp r9, rax
jb 0x1400a8e10
jmp 0x1400a8e20
mov eax, dword [0x141f3f778]
and eax, dword [0x141f3f77c]
xor eax, 0x201ba2be
add eax, 0xd9cf6be2
cmp eax, 0x64fa9e95
jb 0x1400a8c90
test r9, r9
mov r8d, 0xd6b5e837
je 0x1400a8da3
nop dword [rax]
mov eax, dword [0x141f3f780]
imul eax, dword [0x141f3f784]
add eax, 0xa09b5a59
shr eax, 2
imul rax, rax, 0x20c45a47
shr rax, 0x3b
add eax, 0xaa975e95
cmp eax, 0xc02d1e57
ja 0x1400a8cc0
mov eax, r9d
and eax, 7
nop word cs:[rax + rax]
mov edx, dword [0x141f3f788]
imul edx, dword [0x141f3f78c]
imul rdx, r8
shr rdx, 0x3e
imul edx, edx, 0x91fc3f4a
add edx, 0x3b3215d4
cmp edx, 0x5f089365
jb 0x1400a8d00
test rax, rax
je 0x1400a8da8
mov r13, rcx
xor ecx, ecx
nop word cs:[rax + rax]
mov r13, qword [r13 + 0x3d8]
inc rcx
cmp rax, rcx
jne 0x1400a8d40
mov rax, r9
sub rax, rcx
cmp r9, 8
jae 0x1400a8dc0
jmp 0x1400a8dfe
mov r8, qword [rsp + 0x168]
mov rcx, qword [0x141f49060]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop word [rax + rax]
mov eax, dword [0x141f3f808]
or eax, dword [0x141f3f80c]
xor eax, 0xab91c485
imul eax, eax, 0x6e2f709c
cmp eax, 0x516f1b24
je 0x1400a8d80
jmp 0x1400a8c54
mov r13, rcx
jmp 0x1400a8dfe
mov rax, r9
mov r13, rcx
cmp r9, 8
jb 0x1400a8dfe
nop word cs:[rax + rax]
mov rcx, qword [r13 + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov r13, qword [rcx + 0x3d8]
add rax, 0xfffffffffffffff8
jne 0x1400a8dc0
xor r9d, r9d
xor ecx, ecx
movzx eax, word [r13 + 0x3d2]
cmp r9, rax
jae 0x1400a8e20
mov r8, r9
mov r14, r13
jmp 0x1400a8e4d
test r15b, r15b
jne 0x1400a8e20
mov r14, qword [r13 + 0x160]
test r14, r14
je 0x1400a9c60
movzx r8d, word [r13 + 0x3d0]
inc rcx
mov r13, r14
cmp r8w, word [r14 + 0x3d2]
jae 0x1400a8e20
test rcx, rcx
mov qword [rsp + 0x58], rsi
je 0x1400a8f60
mov r13, qword [r14 + r8*8 + 0x3e0]
mov r9, rcx
dec r9
je 0x1400a8f4e
nop
mov eax, dword [0x141f3f798]
and eax, dword [0x141f3f79c]
add eax, 0xde46286a
cmp eax, 0x21ec02db
jb 0x1400a8e70
lea r10, [rcx - 2]
nop dword [rax]
mov eax, dword [0x141f3f7a0]
xor eax, dword [0x141f3f7a4]
or eax, 0x41200200
and eax, 0x61b2e79c
add eax, 0xe7a5b27a
cmp eax, 0x6cc8989
jb 0x1400a8e90
nop word cs:[rax + rax]
mov eax, dword [0x141f3f7a8]
xor edx, edx
div dword [0x141f3f7ac]
or eax, 0xbc5b1fb9
add eax, 0x10d3464c
cmp eax, 0x323f384
jb 0x1400a8ec0
test r9b, 7
je 0x1400a8f02
dec cl
movzx eax, cl
and eax, 7
xor ecx, ecx
nop
mov r13, qword [r13 + 0x3d8]
inc rcx
cmp rax, rcx
jne 0x1400a8ef0
sub r9, rcx
cmp r10, 7
jb 0x1400a8f4e
nop dword [rax + rax]
mov rax, qword [r13 + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov r13, qword [rax + 0x3d8]
add r9, 0xfffffffffffffff8
jne 0x1400a8f10
xor ebp, ebp
jmp 0x1400a8f67
lea rbp, [r8 + 1]
mov r13, r14
imul rax, r8, 0x38
lea rdi, [r14 + rax]
add rdi, 0x168
shl r8, 5
movabs rax, 0x8000000000000000
cmp qword [r14 + r8], rax
mov qword [rsp + 0x60], rbp
jne 0x1400a91b0
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x158], rax
test rax, rax
je 0x1400a8c54
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x80], rax
mov rsi, qword [rdi + 0x30]
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x70], rax
nop dword [rax]
mov eax, dword [0x141f3f810]
sub eax, dword [0x141f3f814]
imul eax, eax, 0x5ea6d688
add eax, 0xa715d7b2
cmp eax, 0x2b0b4887
jb 0x1400a8fd0
mov rax, qword [rsp + 0x70]
lea ecx, [rax + 7]
mov dword [rsp + 0x1b8], ecx
xor ecx, ecx
mov qword [rsp + 0x150], rcx
mov r9, rax
mov rcx, qword [rsp + 0x158]
mov qword [rsp + 0x78], r9
nop word [rax + rax]
mov eax, dword [str._rjgRx]
sub eax, dword [0x141f3f81c]
imul eax, eax, 0x4d8c7565
add eax, 0xf3c58e23
cmp eax, 0x93888279
ja 0x1400a9020
lea rbp, [rcx + 0x168]
movzx eax, word [rcx + 0x3d2]
mov qword [rsp + 0x68], rax
imul rax, rax, 0x38
mov qword [rsp + 0x198], rcx
lea r14, [rcx + rax]
add r14, 0x168
xor edi, edi
jmp 0x1400a90a0
lea r12, [rbp + 0x38]
lea rdi, [rbx + 1]
mov r8, qword [rbp + 0x28]
mov r9d, dword [rbp + 0x30]
mov dword [rsp + 0x20], 1
mov rcx, qword [rsp + 0x80]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
mov rbp, r12
cmp eax, 3
jne 0x1400a90f0
cmp rbp, r14
je 0x1400a9110
mov rbx, rdi
mov eax, dword [0x141f3f820]
and eax, dword [0x141f3f824]
mov ecx, 0xa5b3a107
imul rax, rcx
shr rax, 0x3e
or eax, 0xffffb716
cmp eax, 0x2c02b7b4
jae 0x1400a9070
mov r8, qword [rbp + 0x28]
mov r9d, dword [rbp + 0x30]
mov dword [rsp + 0x20], 1
mov rcx, qword [rsp + 0x80]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
jmp 0x1400a9070
cmp eax, 1
mov r9, qword [rsp + 0x78]
jne 0x1400a9240
mov rcx, qword [rsp + 0x198]
test r9, r9
jne 0x1400a9130
jmp 0x1400a8c54
mov r9, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x198]
mov rbx, qword [rsp + 0x68]
test r9, r9
je 0x1400a8c54
nop dword [rax + rax]
mov eax, dword [0x141f3f830]
xor edx, edx
div dword [0x141f3f834]
add eax, 0xc0aa55ae
xor eax, 0x775fe17c
cmp eax, 0xfc3371f7
ja 0x1400a9130
nop
mov eax, dword [0x141f3f838]
xor eax, dword [0x141f3f83c]
imul rax, rax, 0x50ce7bc1
shr rax, 0x3d
imul eax, eax, 0xa2114377
xor eax, 0xbb5fe517
cmp eax, 0x1dc9ee0a
jb 0x1400a9150
dec r9
inc qword [rsp + 0x150]
mov rcx, qword [rcx + rbx*8 + 0x3d8]
mov eax, dword [rsp + 0x1b8]
add al, 7
mov dword [rsp + 0x1b8], eax
jmp 0x1400a9012
add r14, r8
nop word cs:[rax + rax]
mov eax, dword [0x141f3f7b0]
add eax, dword [0x141f3f7b4]
imul eax, eax, 0x7dcd0124
add eax, 0x34b58bb4
cmp eax, 0xdb4f903e
jb 0x1400a91c0
mov rsi, qword [rdi + 0x10]
test rsi, rsi
js case.default.0x1400ab46c
mov r12, qword [rdi + 8]
je 0x1400a9529
movzx eax, byte [0x141f49078]
xor ecx, ecx
mov rdx, rsi
call fcn.1400c6170
mov rbx, rax
nop dword [rax]
mov eax, dword [0x141f3f7b8]
sub eax, dword [0x141f3f7bc]
or eax, 0x1cd014ea
xor eax, 0x9175af94
add eax, 0xbe102190
cmp eax, 0x88f88ed8
ja 0x1400a9210
test rbx, rbx
jne 0x1400a952e
jmp 0x1400ac103
cmp eax, 2
mov rdx, qword [rsp + 0x198]
jne 0x1400a9c80
mov byte [rsp + 0x8f], 0
test r9, r9
lea rcx, [rsp + 0x1f0]
lea r8, [rsp + 0xa0]
je 0x1400a9498
nop word cs:[rax + rax]
mov eax, dword [0x141f3f850]
sub eax, dword [0x141f3f854]
and eax, 0x5c6cad
imul eax, eax, 0x72011760
xor eax, 0xcf15185e
cmp eax, 0x6374f9ca
ja 0x1400a9280
mov r8, r9
mov r10, qword [rdx + rbx*8 + 0x3d8]
dec r8
je 0x1400a93bf
test r8b, 7
je 0x1400a92f6
movzx eax, byte [rsp + 0x1b8]
and eax, 7
neg rax
mov edx, 1
movzx r8d, word [r10 + 0x3d2]
mov r10, qword [r10 + r8*8 + 0x3d8]
lea r8, [rax + rdx]
inc r8
inc rdx
cmp r8, 1
jne 0x1400a92d0
sub r9, rdx
mov r8, r9
mov r9, qword [rsp + 0x70]
sub r9, qword [rsp + 0x150]
add r9, 0xfffffffffffffffe
nop word [rax + rax]
mov eax, dword [0x141f3f858]
xor edx, edx
div dword [0x141f3f85c]
or eax, 0xbed41d99
xor eax, 0xd7a083ed
add eax, 0x49b4f466
cmp eax, 0x1bcdc8e8
jb 0x1400a9310
cmp r9, 7
jb 0x1400a93bf
nop
movzx eax, word [r10 + 0x3d2]
mov rax, qword [r10 + rax*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov rax, qword [rax + rdx*8 + 0x3d8]
movzx edx, word [rax + 0x3d2]
mov r10, qword [rax + rdx*8 + 0x3d8]
add r8, 0xfffffffffffffff8
jne 0x1400a9340
movzx eax, word [r10 + 0x3d2]
dec rax
mov qword [rsp + 0x1a0], r10
mov qword [rsp + 0x1a8], 0
mov qword [rsp + 0x1b0], rax
lea rdx, [rsp + 0x1a0]
lea r8, [rsp + 0x8f]
call fcn.1400b6ec0
mov rax, qword [rsp + 0x220]
mov qword [rsp + 0x190], rax
movups xmm0, xmmword [rsp + 0x1f0]
movups xmm1, xmmword [rsp + 0x200]
movups xmm2, xmmword [rsp + 0x210]
movaps xmmword [rsp + 0x180], xmm2
movaps xmmword [rsp + 0x170], xmm1
movaps xmmword [rsp + 0x160], xmm0
lea rax, [rsp + 0x228]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x120], xmm0
movaps xmmword [rsp + 0x130], xmm1
mov rdx, qword [rsp + 0x248]
mov rax, qword [rsp + 0x258]
movzx ecx, word [rdx + 0x3d2]
cmp rax, rcx
jae 0x1400a976b
mov rcx, rdx
jmp 0x1400a97cc
mov qword [rsp + 0xa0], rdx
mov eax, dword [0x141f3f840]
imul eax, dword [0x141f3f844]
imul eax, eax, 0xeed64347
add eax, 0xfed41893
and eax, 0xbf2457c0
mov qword [rsp + 0xa0], rdx
cmp eax, 0x36e92160
jb 0x1400a9490
jmp 0x1400a94dc
mov qword [rsp + 0xa8], 0
mov eax, dword [0x141f3f848]
xor edx, edx
div dword [0x141f3f84c]
add eax, 0xa8c32632
or eax, 0x1a6045b0
add eax, 0xff3353e
mov qword [rsp + 0xa8], 0
cmp eax, 0xf313d19b
ja 0x1400a94d0
mov qword [rsp + 0xb0], rbx
mov rdx, r8
lea r8, [rsp + 0x8f]
call fcn.1400b6ec0
jmp 0x1400a9a33
mov ebx, 1
mov eax, dword [0x141f3f7c0]
sub eax, dword [0x141f3f7c4]
add eax, 0x67d4b3b1
or eax, 0xaeb118a8
imul eax, eax, 0xdf4cb8b2
cmp eax, 0xfc627a9b
jbe 0x1400a955f
mov rcx, rbx
mov rdx, r12
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x80], rbx
mov rcx, rbx
mov rdx, r12
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rbx, qword [rdi + 0x30]
test rbx, rbx
js case.default.0x1400ab46c
lea r12, [rbx + rbx]
movabs rax, 0x8000000000000000
add rax, 0xfffffffffffffffe
cmp r12, rax
ja case.default.0x1400ab46c
movzx eax, byte [rdi + 0x18]
mov byte [rsp + 0x78], al
mov rdx, qword [rdi + 0x28]
test r12, r12
je 0x1400a9611
mov qword [rsp + 0x198], rdx
movzx eax, byte [0x141f49078]
xor ecx, ecx
mov rdx, r12
call fcn.1400c6170
mov rbp, rax
nop word [rax + rax]
mov eax, dword [0x141f3f7c8]
or eax, dword [0x141f3f7cc]
shr eax, 3
imul rax, rax, 0x14b49ad
bt rax, 0x32
mov eax, 0
adc eax, 0x89f9d46d
cmp eax, 0xd6b1f823
ja 0x1400a95d0
mov rdi, rbx
test rbp, rbp
mov rdx, qword [rsp + 0x198]
jne 0x1400a9618
jmp 0x1400ac0e0
mov ebp, 2
xor edi, edi
mov rcx, rbp
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x1f0], rsi
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x1f8], rax
mov qword [rsp + 0x200], rsi
movzx eax, byte [rsp + 0x78]
mov byte [rsp + 0x208], al
mov qword [rsp + 0x210], rdi
mov qword [rsp + 0x218], rbp
mov qword [rsp + 0x220], rbx
mov rsi, qword [r14 + 0x10]
test rsi, rsi
js 0x1400ac107
mov rdx, qword [r14 + 8]
lea rdi, [rsp + 0x1f0]
mov eax, dword [0x141f3f7e8]
sub eax, dword [0x141f3f7ec]
add eax, 0x369cd440
imul rcx, rax, 0x17ca0ab
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
xor eax, 0xd83c6d6e
cmp eax, 0x6975ff17
jb 0x1400a9680
test rsi, rsi
mov qword [rsp + 0x80], rdx
je 0x1400a9727
mov eax, dword [0x141f3f7f0]
xor eax, dword [0x141f3f7f4]
or eax, 0x38a4c0be
imul eax, eax, 0x38a13bbf
add eax, 0xfa1bf805
cmp eax, 0x963206e1
jbe 0x1400a96e8
movzx eax, byte [0x141f49078]
mov rbx, rdi
nop dword [rax + rax]
mov eax, dword [0x141f3f7f8]
imul eax, dword [0x141f3f7fc]
and eax, 0xa691774f
movzx ecx, byte [0x141f49078]
cmp eax, 0xea2c83f0
je 0x1400a96f0
xor ecx, ecx
mov rdx, rsi
call fcn.1400c6170
mov r12, rax
test rax, rax
jne 0x1400a9730
jmp 0x1400ac103
mov rbx, rdi
mov r12d, 1
mov eax, dword [0x141f3f800]
or eax, dword [0x141f3f804]
or eax, 0xfb4d5c0
xor eax, 0xd39f2bf6
add eax, 0xb5e3a929
cmp eax, 0x13410aad
mov rdi, qword [rsp + 0x80]
lea rbp, [rsp + 0xa0]
jb 0x1400a9c06
jmp 0x1400a9bb0
mov r8, qword [rsp + 0x250]
nop word cs:[rax + rax]
mov eax, dword [0x141f3f860]
or eax, dword [0x141f3f864]
imul eax, eax, 0x9418c4ae
add eax, 0x37e7d1cb
or eax, 0x2859ee38
cmp eax, 0xe5b2c8b1
ja 0x1400a9780
mov rcx, qword [rdx + 0x160]
test rcx, rcx
je 0x1400a97c7
inc r8
movzx eax, word [rdx + 0x3d0]
mov rdx, rcx
cmp ax, word [rcx + 0x3d2]
jae 0x1400a9780
jmp 0x1400a97cc
mov rax, r8
xor ecx, ecx
mov edx, dword [0x141f3f868]
mov r8d, dword [0x141f3f86c]
add edx, r8d
add edx, 0x318dc3e2
or edx, 0x2470e869
add edx, 0x8c84acb3
cmp edx, 0xa393ee16
jae 0x1400a991a
imul rdx, rax, 0x38
mov r8, rax
shl r8, 5
mov r9, qword [rcx + rdx + 0x198]
mov qword [rsp + 0xd0], r9
movups xmm0, xmmword [rcx + rdx + 0x168]
movups xmm1, xmmword [rcx + rdx + 0x178]
movups xmm2, xmmword [rcx + rdx + 0x188]
movaps xmmword [rsp + 0xc0], xmm2
movaps xmmword [rsp + 0xb0], xmm1
movaps xmmword [rsp + 0xa0], xmm0
mov r9, qword [rsp + 0x190]
mov qword [rcx + rdx + 0x198], r9
movaps xmm0, xmmword [rsp + 0x160]
movaps xmm1, xmmword [rsp + 0x170]
movaps xmm2, xmmword [rsp + 0x180]
movups xmmword [rcx + rdx + 0x188], xmm2
movups xmmword [rcx + rdx + 0x178], xmm1
movups xmmword [rcx + rdx + 0x168], xmm0
movups xmm0, xmmword [rcx + r8]
movups xmm1, xmmword [rcx + r8 + 0x10]
lea rdx, [rsp + 0xd8]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
movaps xmm0, xmmword [rsp + 0x120]
movaps xmm1, xmmword [rsp + 0x130]
movups xmmword [rcx + r8 + 0x10], xmm1
movups xmmword [rcx + r8], xmm0
movaps xmm0, xmmword [rsp + 0xa0]
movaps xmm1, xmmword [rsp + 0xb0]
movaps xmm2, xmmword [rsp + 0xc0]
movaps xmm3, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x1f0], xmm0
movaps xmmword [rsp + 0x200], xmm1
movaps xmmword [rsp + 0x210], xmm2
movaps xmmword [rsp + 0x220], xmm3
movaps xmm0, xmmword [rsp + 0xe0]
movaps xmmword [rsp + 0x230], xmm0
mov rdx, qword [rsp + 0xf0]
mov qword [rsp + 0x240], rdx
imul rdx, rax, 0x38
shl rax, 5
mov r8, qword [rcx + rdx + 0x198]
mov qword [rsp + 0xd0], r8
movups xmm0, xmmword [rcx + rdx + 0x168]
movups xmm1, xmmword [rcx + rdx + 0x178]
movups xmm2, xmmword [rcx + rdx + 0x188]
movaps xmmword [rsp + 0xc0], xmm2
movaps xmmword [rsp + 0xb0], xmm1
movaps xmmword [rsp + 0xa0], xmm0
mov r8, qword [rsp + 0x190]
mov qword [rcx + rdx + 0x198], r8
movaps xmm0, xmmword [rsp + 0x160]
movaps xmm1, xmmword [rsp + 0x170]
movaps xmm2, xmmword [rsp + 0x180]
movups xmmword [rcx + rdx + 0x188], xmm2
movups xmmword [rcx + rdx + 0x178], xmm1
movups xmmword [rcx + rdx + 0x168], xmm0
movups xmm0, xmmword [rcx + rax]
movups xmm1, xmmword [rcx + rax + 0x10]
lea rdx, [rsp + 0xd8]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
movaps xmm0, xmmword [rsp + 0x120]
movaps xmm1, xmmword [rsp + 0x130]
movups xmmword [rcx + rax + 0x10], xmm1
movups xmmword [rcx + rax], xmm0
movaps xmm0, xmmword [rsp + 0xa0]
movaps xmm1, xmmword [rsp + 0xb0]
movaps xmm2, xmmword [rsp + 0xc0]
movaps xmm3, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x1f0], xmm0
movaps xmmword [rsp + 0x200], xmm1
movaps xmmword [rsp + 0x210], xmm2
movaps xmmword [rsp + 0x220], xmm3
movaps xmm0, xmmword [rsp + 0xe0]
movaps xmmword [rsp + 0x230], xmm0
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x240], rax
mov rbp, qword [rsp + 0x1f0]
mov rdi, qword [rsp + 0x1f8]
mov r14, qword [rsp + 0x210]
mov r12, qword [rsp + 0x218]
dec qword [rsp + 0x1d8]
mov rbx, qword [rsp + 0x228]
mov rsi, qword [rsp + 0x230]
cmp byte [rsp + 0x8f], 0
mov rcx, qword [rsp + 0x70]
je 0x1400a9abf
test rcx, rcx
je 0x1400ac186
mov r8, qword [rsp + 0x158]
mov rax, qword [r8 + 0x3d8]
mov qword [rsp + 0x1c8], rax
dec rcx
mov qword [rsp + 0x1d0], rcx
mov qword [rax + 0x160], 0
mov rcx, qword [0x141f49060]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
movabs rax, 0x8000000000000000
cmp rbp, rax
je 0x1400a8c54
test rbp, rbp
je 0x1400a9af0
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov eax, dword [0x141f3f880]
imul eax, dword [0x141f3f884]
xor eax, 0x2fd51f1f
imul eax, eax, 0x1da5341a
cmp eax, 0xab33e38
je 0x1400a9af0
test r14, r14
je 0x1400a9b40
mov rdi, qword [0x141f49060]
test r15b, r15b
je 0x1400a9b2e
mov rcx, rdi
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rdi
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov eax, dword [0x141f3f888]
or eax, dword [0x141f3f88c]
imul eax, eax, 0xe87b9ccc
add eax, 0xff449284
and eax, 0xb448b298
cmp eax, 0x762255ef
jb 0x1400a9b40
shl rbx, 1
test rbx, rbx
je 0x1400a8c54
nop
mov eax, dword [0x141f3f890]
sub eax, dword [0x141f3f894]
add eax, 0xbcb76699
or eax, 0xee2f75fb
cmp eax, 0xd0137a50
jb 0x1400a9b70
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400a8c54
mov rcx, r12
mov rdx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [r14 + 0x18]
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb0], rsi
mov byte [rsp + 0xb8], al
lea rcx, [rsp + 0x160]
lea rdx, [rsp + 0x1c8]
mov r8, rbx
mov r9, rbp
call fcn.1400b3910
test r15b, r15b
je 0x1400a8c40
mov rcx, r12
mov rdx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [r14 + 0x18]
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb0], rsi
mov byte [rsp + 0xb8], al
lea rcx, [rsp + 0x160]
lea rdx, [rsp + 0x1c8]
mov r8, rbx
mov r9, rbp
call fcn.1400b3910
jmp 0x1400a9bb0
mov eax, dword [0x141f3f790]
xor eax, dword [0x141f3f794]
ud2
mov eax, dword [0x141f3f828]
xor edx, edx
div dword [0x141f3f82c]
imul rax, rax, 0x81ab04d
shr rax, 0x3b
imul esi, eax, 0x55cf77c2
call fcn.140097370
cmp esi, 0xd7e712a0
ja 0x1400a9c80
mov eax, dword [0x141f3f898]
imul eax, dword [0x141f3f89c]
or eax, 0xfeffffef
cmp eax, 0xd723d54a
jb 0x1400a9cb0
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x198], rax
nop dword [rax]
mov eax, dword [0x141f3f8a0]
xor edx, edx
div dword [0x141f3f8a4]
imul rax, rax, 0x2bea0b31
shr rax, 0x3d
imul eax, eax, 0x6ea7ee7
add eax, 0xe92ad15e
cmp eax, 0xe9c5209d
ja 0x1400a9ce0
mov eax, dword [0x141f3f8a8]
or eax, dword [0x141f3f8ac]
mov rcx, qword [rsp + 0x1d0]
mov qword [rsp + 0x1b8], rcx
imul eax, eax, 0x21d63722
add eax, 0x66a3dab7
cmp eax, 0xeb6fd9a0
jbe 0x1400a9d4c
movzx eax, byte [0x141f49078]
mov edx, 4
xor ecx, ecx
call fcn.1400c6170
mov r13, qword [rsp + 0x90]
nop word cs:[rax + rax]
mov eax, dword [0x141f3f8b0]
imul eax, dword [0x141f3f8b4]
and eax, 0x84b777b3
imul rsi, rax, 0x6fca3b19
shr rsi, 0x3d
add esi, 0x87f834af
mov r15, qword [rsp + 0x1d8]
movzx eax, byte [0x141f49078]
mov edx, 4
xor ecx, ecx
call fcn.1400c6170
cmp esi, 0x3d5bb960
jb 0x1400a9d60
mov rbx, rax
test rax, rax
je 0x1400aa042
mov eax, dword [0x141f3f8c0]
xor eax, dword [0x141f3f8c4]
and eax, 0x85b1c814
or eax, 0x5a4e37c3
xor eax, 0x48b8b13a
cmp eax, 0x320d4f4c
jae 0x1400a9dda
mov dword [rbx], 0x48544150
mov rax, rbx
add rax, 4
nop word cs:[rax + rax]
mov ecx, dword [0x141f3f8c8]
add ecx, dword [0x141f3f8cc]
shr ecx, 2
imul rcx, rcx, 0x2de9baab
shr rcx, 0x39
xor ecx, 0xc82b57f1
imul ecx, ecx, 0xc082ebd3
mov dword [rbx], 0x48544150
cmp ecx, 0x3aae00a4
jb 0x1400a9df0
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rax
mov word [rsp + 0xb0], 0
lea rdi, [rsp + 0x210]
lea rdx, [rsp + 0xa0]
mov rcx, rdi
call fcn.1400b3150
nop word cs:[rax + rax]
mov eax, dword [0x141f3f8d0]
sub eax, dword [0x141f3f8d4]
add eax, 0x1eb072f9
xor eax, 0x21c8ce40
and eax, 0xa9fbcfc2
cmp eax, 0x26b5c9ff
jb 0x1400a9e60
mov r14, qword [rsp + 0x218]
mov rcx, qword [rsp + 0x198]
test rcx, rcx
je 0x1400aa0ac
nop dword [rax + rax]
mov eax, dword [0x141f3f8d8]
imul eax, dword [0x141f3f8dc]
or eax, 0x54adcf80
imul eax, eax, 0x3a434c69
cmp eax, 0x3699fad9
je 0x1400a9ea0
nop
mov eax, dword [0x141f3f8e0]
xor eax, dword [str.V::g]
imul eax, eax, 0x785dfa68
or eax, 0x6549bcbf
cmp eax, 0xeb6bc328
ja 0x1400a9ec0
mov qword [rsp + 0x80], r15
mov rsi, qword [rsp + 0x220]
mov r12, qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x60], rax
mov rdx, rcx
lea rcx, [rdx + 0x168]
movzx eax, word [rdx + 0x3d2]
mov qword [rsp + 0x78], rax
imul rax, rax, 0x38
mov qword [rsp + 0x58], rdx
lea rbp, [rdx + rax]
add rbp, 0x168
xor r13d, r13d
nop
cmp rcx, rbp
je 0x1400a9fa0
mov r15, r13
lea rdi, [rcx + 0x38]
inc r13
mov r8, qword [rcx + 0x28]
mov r9, qword [rcx + 0x30]
nop word [rax + rax]
mov eax, dword [0x141f3f8e8]
or eax, dword [0x141f3f8ec]
add eax, 0x392120a4
and eax, 0x5e25060c
cmp eax, 0xbf297419
ja 0x1400a9f50
mov dword [rsp + 0x20], 1
mov rcx, r14
mov edx, esi
call r12
mov rcx, rdi
cmp eax, 3
je 0x1400a9f30
cmp eax, 1
jne 0x1400aa071
mov r8, r15
mov r13, qword [rsp + 0x90]
jmp 0x1400a9fad
mov r13, qword [rsp + 0x90]
mov r8, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
mov r15, qword [rsp + 0x80]
je 0x1400aaabf
nop word cs:[rax + rax]
mov eax, dword [0x141f3f8f0]
and eax, dword [0x141f3f8f4]
or eax, 0x341d0ae6
imul eax, eax, 0x107e822c
cmp eax, 0xaf18f5e7
ja 0x1400a9fd0
mov rdx, qword [rsp + 0x58]
nop word cs:[rax + rax]
mov eax, dword [0x141f3f8f8]
and eax, dword [0x141f3f8fc]
add eax, 0xa5bd9967
xor eax, 0xe8493bf0
add eax, 0xe00437f0
cmp eax, 0xcf8ed74d
ja 0x1400aa000
dec rcx
mov qword [rsp + 0x60], rcx
mov rdx, qword [rdx + r8*8 + 0x3d8]
jmp 0x1400a9f05
mov eax, dword [0x141f3f8b8]
xor eax, dword [0x141f3f8bc]
xor eax, 0xadf39e25
imul rax, rax, 0x21eaa3d7
shr rax, 0x3d
xor eax, 0xc5732f47
ud2
cmp eax, 2
mov r13, qword [rsp + 0x90]
jne 0x1400ac0d7
shl r15, 5
mov rax, qword [rsp + 0x58]
mov rsi, qword [rax + r15 + 8]
mov rax, qword [rax + r15 + 0x10]
mov qword [rsp + 0x60], rax
mov r15, qword [rsp + 0x80]
lea rdi, [rsp + 0x210]
jmp 0x1400aa0ae
xor esi, esi
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rdi], 0
je 0x1400aa120
mov eax, dword [0x141f3f900]
sub eax, dword [0x141f3f904]
add eax, 0xe342b10
cmp eax, 0x6ab09b85
jae 0x1400aa0f0
mov rax, qword [0x141f49060]
nop word cs:[rax + rax]
mov eax, dword [0x141f3f908]
and eax, dword [0x141f3f90c]
xor eax, 0xc1824633
add eax, 0xd37fc97e
mov rcx, qword [0x141f49060]
cmp eax, 0xab0c7fcd
ja 0x1400aa0f0
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov eax, dword [0x141f3f910]
add eax, dword [0x141f3f914]
xor eax, 0x383133d7
imul eax, eax, 0x841f5ec3
add eax, 0xd0a66c49
cmp eax, 0xc7a902b0
ja 0x1400aa120
mov r12, rsi
nop word cs:[rax + rax]
mov eax, dword [0x141f3f918]
imul eax, dword [0x141f3f91c]
imul eax, eax, 0x4c8bcec5
add eax, 0xec924008
cmp eax, 0xc4e37447
ja 0x1400aa150
mov rax, qword [rsp + 0x140]
mov rbp, qword [rax + 0x10]
lea r14, [0x141f259f8]
test rbp, rbp
je 0x1400aba84
mov rcx, qword [rax + 8]
nop
mov eax, dword [str.K6_F_]
sub eax, dword [0x141f3f924]
imul eax, eax, 0xf5d56e24
cmp eax, 0x161cce01
jb 0x1400aa190
cmp rbp, 4
mov rax, rcx
mov qword [rsp + 0x58], rcx
jae 0x1400aa1c0
lea rdi, [0x1400b7d00]
jmp 0x1400aa1e8
mov eax, dword [rcx]
bswap eax
xor ecx, ecx
cmp eax, 0x5c5c3f5c
setb cl
cmp eax, 0x5c5c3f5d
adc ecx, 0xffffffff
lea rax, [0x1400b7ce0]
lea rdi, [0x1400b7d00]
cmove rdi, rax
mov eax, dword [0x141f3f928]
and eax, dword [0x141f3f92c]
add eax, 0xea9aa52a
imul rax, rax, 0x1bd07ff3
shr rax, 0x38
add eax, 0x8e87f205
cmp eax, 0xb4d6c5e1
jbe 0x1400aa21c
mov rax, qword [rsp + 0x58]
movzx ecx, byte [rbp + rax - 1]
call rdi
mov rax, qword [rsp + 0x58]
movzx esi, byte [rbp + rax - 1]
mov ecx, esi
call rdi
test al, al
jne 0x1400aba84
nop word cs:[rax + rax]
mov eax, dword [0x141f3f930]
and eax, dword [0x141f3f934]
and eax, 0x728d7941
add eax, 0xd1038b9b
cmp eax, 0x3b981f28
ja 0x1400aa240
movabs rbx, 0x8000000000000000
cmp rbp, 3
mov qword [rsp + 0x80], r15
mov rdi, qword [rsp + 0x58]
jbe 0x1400aa328
nop
mov eax, dword [0x141f3f9a0]
and eax, dword [0x141f3f9a4]
add eax, 0x888fd3fa
or eax, 0xb16ee0c9
imul eax, eax, 0xa669e4a6
cmp eax, 0xc58cd2c3
ja 0x1400aa280
movzx eax, byte [rbp + rdi - 4]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x2e
jne 0x1400aa35b
nop
mov eax, dword [0x141f3f9a8]
sub eax, dword [0x141f3f9ac]
imul eax, eax, 0x391e14ed
add eax, 0xb28aaeb4
or eax, 0x4c49ab97
cmp eax, 0xc838ebf4
jb 0x1400aa2c0
movzx eax, byte [rdi + rbp - 3]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x65
jne 0x1400aa35b
movzx eax, byte [rdi + rbp - 2]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x78
jne 0x1400aa35b
lea eax, [rsi - 0x41]
cmp al, 0x1a
setb al
shl al, 5
or al, sil
cmp al, 0x65
sete al
jmp 0x1400aa35d
lea rax, [rdi + rbp]
mov rcx, rdi
mov rsi, qword [rsp + 0x60]
nop word cs:[rax + rax]
cmp rcx, rax
je 0x1400aa6bb
movzx edx, byte [rcx]
cmp edx, 0x2f
je 0x1400aa3ca
inc rcx
cmp edx, 0x5c
jne 0x1400aa340
jmp 0x1400aa3ca
xor eax, eax
xor ecx, ecx
mov rsi, qword [rsp + 0x60]
nop word cs:[rax + rax]
mov edx, dword [0x141f3f9b0]
or edx, dword [0x141f3f9b4]
xor edx, 0x652340cf
add edx, 0x92785cf8
cmp edx, 0xb0238830
ja 0x1400aa370
cmp rbp, rcx
je 0x1400aa6bb
movzx edx, byte [rdi + rcx]
cmp edx, 0x5c
je 0x1400aa3aa
inc rcx
cmp edx, 0x2f
jne 0x1400aa370
test al, al
je 0x1400aa3ca
mov eax, dword [0x141f3f9b8]
add eax, dword [0x141f3f9bc]
cmp eax, 0x7b100b7c
je 0x1400ac1df
jmp 0x1400ac1ac
test rbp, rbp
js 0x1400aab18
movzx eax, byte [0x141f49078]
mov eax, dword [0x141f3f970]
xor eax, dword [0x141f3f974]
and eax, 0x53de3485
imul eax, eax, 0xd086c38d
cmp eax, 0x542359f3
jne 0x1400aa410
xor ecx, ecx
mov rdx, rbp
call fcn.1400c6170
nop word cs:[rax + rax]
mov eax, dword [0x141f3f978]
xor eax, dword [0x141f3f97c]
and eax, 0x4870011
imul edi, eax, 0xa6b12ad7
xor edi, 0x1ef82e3a
xor ecx, ecx
mov rdx, rbp
call fcn.1400c6170
cmp edi, 0xa129cf4b
ja 0x1400aa410
mov rsi, rax
nop word cs:[rax + rax]
mov eax, dword [0x141f3f980]
imul eax, dword [0x141f3f984]
and eax, 0xac413280
add eax, 0x4f0926fd
cmp eax, 0x159c0bff
jb 0x1400aa450
test rsi, rsi
mov rdi, qword [rsp + 0x58]
je 0x1400aa66c
mov eax, dword [0x141f3f998]
xor edx, edx
div dword [0x141f3f99c]
or eax, 0x214c4ff8
shr eax, 3
imul rax, rax, 0x21376abb
shr rax, 0x38
add eax, 0xfbe504a2
cmp eax, 0x1440d6b1
jae 0x1400aa4c7
mov rcx, rsi
mov rdx, rdi
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x1f0], rbp
mov qword [rsp + 0x1f8], rsi
mov rcx, rsi
mov rdx, rdi
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x1f0], rbp
mov qword [rsp + 0x1f8], rsi
mov qword [rsp + 0x200], rbp
mov qword [rsp + 0x208], 0
lea rdx, [0x141f25a10]
lea rcx, [rsp + 0x1f0]
mov r8d, 4
call fcn.140098380
mov rsi, qword [rsp + 0x1f0]
mov rbx, qword [rsp + 0x1f8]
mov r14, qword [rsp + 0x200]
lea rcx, [rsp + 0x160]
mov rdx, rbx
mov r8, r14
call fcn.1400b7d10
movabs rax, 0x8000000000000000
cmp qword [rsp + 0x160], rax
jne 0x1400aa898
mov eax, dword [0x141f3f9f8]
add eax, dword [0x141f3f9fc]
imul eax, eax, 0xa36cbf25
and eax, 0xea96c450
xor eax, 0xcdf0c740
cmp eax, 0xf2111547
jbe 0x1400aa584
mov rcx, rbx
mov rdx, r14
call fcn.1400a7a60
mov rcx, rbx
mov rdx, r14
call fcn.1400a7a60
nop
mov ecx, dword [0x141f3fa00]
xor ecx, dword [0x141f3fa04]
add ecx, 0x8c877793
and ecx, 0x927f7f38
imul ecx, ecx, 0x85c04c5
cmp ecx, 0xdf76731c
ja 0x1400aa590
nop word cs:[rax + rax]
mov ecx, dword [0x141f3fa08]
add ecx, dword [0x141f3fa0c]
xor ecx, 0x22c08969
and ecx, 0xf2f48979
xor ecx, 0x5b6aed07
cmp ecx, 0x66a6db0
jb 0x1400aa5c0
test rax, rax
je 0x1400ab961
nop
mov ecx, dword [0x141f3fa10]
or ecx, dword [str.7ofO]
imul rcx, rcx, 0x17dbff63
shr rcx, 0x39
add ecx, 0x1c413cb7
and ecx, 0xc010493
cmp ecx, 0x627cc3b3
ja 0x1400aa5f0
nop dword [rax + rax]
mov ecx, dword [0x141f3fa18]
and ecx, dword [0x141f3fa1c]
add ecx, 0x7c0bdd25
or ecx, 0xddc415e7
imul ecx, ecx, 0x68013deb
cmp ecx, 0xe0f1da5
jb 0x1400aa620
cmp rdx, 2
jne 0x1400aa987
movzx ecx, word [rax]
cmp ecx, 0x2e2e
jne 0x1400aa987
mov ecx, 2
xor r8d, r8d
jmp 0x1400ab800
mov eax, dword [0x141f3f988]
imul eax, dword [0x141f3f98c]
imul eax, eax, 0x8101de22
and eax, 0x7b6d9bbe
add eax, 0x50551301
ud2
lea rcx, [rdi + rbp]
xor r10d, r10d
lea r14, [0x141f259c0]
mov r8, rdi
nop dword [rax]
mov eax, dword [0x141f3f938]
sub eax, dword [0x141f3f93c]
xor eax, 0xda0f4395
imul eax, eax, 0x65110932
add eax, 0x23377d02
cmp eax, 0xf83a4139
ja 0x1400aa6d0
mov r9w, 1
test r10w, r10w
je 0x1400aa706
xor r10d, r10d
jmp 0x1400aa810
cmp r8, rcx
je 0x1400aaa5f
movzx eax, byte [r8]
test al, al
js 0x1400aa748
inc r8
nop word [rax + rax]
mov edx, dword [0x141f3f940]
and edx, dword [0x141f3f944]
or edx, 0x55eb3072
imul edx, edx, 0x7794c3ae
cmp edx, 0x2f9b1032
je 0x1400aa720
mov r11, r8
jmp 0x1400aa7f0
mov edx, eax
and edx, 0x1f
lea r11, [r8 + 2]
movzx esi, byte [r8 + 1]
and esi, 0x3f
cmp al, 0xdf
jbe 0x1400aa7e2
movzx r10d, byte [r11]
shl esi, 6
and r10d, 0x3f
or r10d, esi
cmp al, 0xf0
jb 0x1400aa844
movzx eax, byte [r8 + 3]
add r8, 4
mov rsi, qword [rsp + 0x60]
nop word cs:[rax + rax]
mov r11d, dword [0x141f3f948]
and r11d, dword [0x141f3f94c]
imul r11d, r11d, 0x3d888f73
imul r11, r11, 0x5387016b
shr r11, 0x3e
xor r11d, 0x5a370afb
cmp r11d, 0x6a0557bc
ja 0x1400aa790
and edx, 7
shl edx, 0x12
shl r10d, 6
and eax, 0x3f
or eax, r10d
or eax, edx
cmp eax, 0xffff
jbe 0x1400aa740
jmp 0x1400aa861
shl edx, 6
or edx, esi
mov eax, edx
mov rsi, qword [rsp + 0x60]
nop
mov edx, dword [0x141f3f950]
imul edx, dword [0x141f3f954]
cmp edx, 0x4ffd1aca
je 0x1400aa7f0
xor r10d, r10d
mov r8, r11
mov r9d, eax
nop
mov eax, dword [0x141f3f960]
xor edx, edx
div dword [0x141f3f964]
or eax, 0x3050a640
and eax, 0x3e52aec0
imul eax, eax, 0xe43ec49
cmp eax, 0xf007d3f0
ja 0x1400aa810
test r9w, r9w
jne 0x1400aa6d0
jmp 0x1400aba84
add r8, 3
shl edx, 0xc
or r10d, edx
mov eax, r10d
mov rsi, qword [rsp + 0x60]
cmp eax, 0xffff
jbe 0x1400aa740
and eax, 0x3ff
or eax, 0xdc00
mov r10d, eax
nop
mov eax, dword [0x141f3f958]
xor eax, dword [0x141f3f95c]
imul eax, eax, 0xee39c6a3
add eax, 0xfa2a7675
or eax, 0x70c43bbf
cmp eax, 0xa4305a00
jb 0x1400aa870
jmp 0x1400aa810
mov eax, dword [0x141f3f9d8]
and eax, dword [0x141f3f9dc]
add eax, 0x7dc126bc
xor eax, 0x5ec36ad4
cmp eax, 0xe9de3a85
jbe 0x1400aa8d5
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x1b0], rax
movups xmm0, xmmword [rsp + 0x160]
movaps xmmword [rsp + 0x1a0], xmm0
mov ecx, 0xefd546c3
nop word [rax + rax]
mov eax, dword [0x141f3f9e0]
xor edx, edx
div dword [0x141f3f9e4]
imul rax, rcx
shr rax, 0x3c
imul eax, eax, 0x973ef1c
movups xmm0, xmmword [rsp + 0x160]
movaps xmmword [rsp + 0x1a0], xmm0
mov rdx, qword [rsp + 0x170]
mov qword [rsp + 0x1b0], rdx
cmp eax, 0xc222a917
ja 0x1400aa8e0
nop word cs:[rax + rax]
mov eax, dword [0x141f3f9e8]
add eax, dword [0x141f3f9ec]
imul eax, eax, 0x85a403ac
add eax, 0x4fbc06ad
cmp eax, 0x9022480b
ja 0x1400aa930
mov eax, 0x954e9d35
nop word cs:[rax + rax]
mov ecx, dword [0x141f3f9f0]
or ecx, dword [0x141f3f9f4]
imul rcx, rax
shr rcx, 0x3e
imul ecx, ecx, 0xea565c3c
cmp ecx, 0x22b1fa75
jb 0x1400aa960
jmp 0x1400aba4a
lea r8, [rax + rdx]
mov rcx, rdx
nop
mov r9, rcx
nop word cs:[rax + rax]
mov ecx, dword [0x141f3fa20]
xor ecx, dword [0x141f3fa24]
imul ecx, ecx, 0x3712c1b0
add ecx, 0x3c5bed40
and ecx, 0x63a8ee60
cmp ecx, 0x51f50a6c
ja 0x1400aa9a0
cmp r8, rax
je 0x1400aaac6
dec r8
nop word cs:[rax + rax]
mov ecx, dword [0x141f3fa28]
and ecx, dword [0x141f3fa2c]
imul ecx, ecx, 0xc9992499
imul rcx, rcx, 0x4444aa93
stosb byte [rdi], al
shr rcx, 0x3e
cmp ecx, 0x88388fb
ja 0x1400aa9e0
lea rcx, [r9 - 1]
movzx r10d, byte [r8]
nop dword [rax]
mov r11d, dword [0x141f3fa30]
mov edi, dword [0x141f3fa34]
add r11d, edi
add r11d, 0x96cb1363
or r11d, 0x3754d125
xor r11d, 0xd86f1214
cmp r11d, 0xe4069923
ja 0x1400aaa10
cmp r10b, 0x2e
jne 0x1400aa990
test rcx, rcx
je 0x1400ab7fa
sub rdx, r9
mov r8, rax
add r8, r9
jmp 0x1400ab800
cmp rbp, 0xf
ja 0x1400aaad3
xor eax, eax
mov qword [rsp + 0x150], rax
xor ecx, ecx
mov r11, r12
nop word cs:[rax + rax]
cmp byte [rdi + rcx], 0x2e
je 0x1400aab58
inc rcx
nop dword [rax]
mov eax, dword [0x141f3fa80]
xor edx, edx
div dword [0x141f3fa84]
and eax, 0x7835dd52
imul eax, eax, 0xe95eb9bc
add eax, 0xc8812b00
cmp eax, 0xf4ed4caf
ja 0x1400aaa90
cmp rcx, rbp
jne 0x1400aaa80
jmp 0x1400aab65
xor esi, esi
jmp 0x1400aa0a2
mov r8, rax
mov rcx, rdx
xor eax, eax
jmp 0x1400ab800
mov cl, 0x2e
mov rdx, rdi
mov r8, rbp
call fcn.14005b940
mov qword [rsp + 0x150], rax
nop dword [rax + rax]
mov eax, dword [0x141f3fa78]
xor eax, dword [0x141f3fa7c]
and eax, 0x1d590510
imul eax, eax, 0x1f3ee163
add eax, 0xc04344fd
cmp eax, 0x17ec9836
jbe 0x1400aaaf0
mov r11, r12
jmp 0x1400aab65
ud2
mov eax, 1
mov qword [rsp + 0x150], rax
mov eax, 0x935f52b5
nop word [rax + rax]
mov ecx, dword [0x141f3fa88]
or ecx, dword [0x141f3fa8c]
imul rcx, rax
shr rcx, 0x3d
imul ecx, ecx, 0xa2efea4d
cmp ecx, 0xb57491a0
je 0x1400aab70
test r11, r11
je 0x1400ab3c0
add rsi, r11
nop
mov eax, dword [0x141f3fa90]
sub eax, dword [0x141f3fa94]
or eax, 0xffed5e5c
add eax, 0x408bb877
cmp eax, 0x60f2d7db
ja 0x1400aaba0
mov byte [rsp + 0x78], 1
xor r15d, r15d
mov qword [rsp + 0x60], rsi
jmp 0x1400aabdc
xor r8d, r8d
mov rcx, rdx
test rax, rax
cmovne r8, rax
test r8, r8
je 0x1400ab961
mov r9d, 0x849b1d35
nop word cs:[rax + rax]
mov r11d, dword [0x141f3fa38]
add r11d, dword [0x141f3fa3c]
and r11d, 0xa571c50e
shr r11d, 1
imul r11, r9
shr r11, 0x3d
xor r11d, 0x189d251
test rax, rax
mov r10, rcx
cmove r10, rdx
cmp r11d, 0x96f3c12d
ja 0x1400ab820
add r8, r10
mov rcx, r8
sub rcx, rbx
nop word cs:[rax + rax]
mov eax, dword [0x141f3fa40]
xor edx, edx
div dword [0x141f3fa44]
add eax, 0x52413b5c
or eax, 0xbe5d2d4a
xor eax, 0x8791d60e
cmp eax, 0x84e0e303
loopne 0x1400ab816
ja 0x1400ab870
cmp r8, rbx
je 0x1400ab940
cmp r14, rcx
jbe 0x1400ab910
nop word cs:[rax + rax]
mov eax, dword [0x141f3fa50]
xor eax, dword [0x141f3fa54]
or eax, 0x961ab8af
xor eax, 0x68ea17f2
cmp eax, 0xaac1a1d8
jb 0x1400ab8b0
movzx eax, byte [rbx + rcx]
nop word cs:[rax + rax]
mov edx, dword [0x141f3fa58]
or edx, dword [0x141f3fa5c]
add edx, 0x258bd6fc
xor edx, 0x60707fb8
imul edx, edx, 0xb26e8345
cmp edx, 0xee0df3f7
jb 0x1400ab8e0
cmp al, 0xbf
jg 0x1400ab933
jmp case.default.0x1400ab46c
mov eax, dword [0x141f3fa60]
xor edx, edx
div dword [0x141f3fa64]
add eax, 0x2204ef80
cmp eax, 0xfdf3974e
ja 0x1400ab910
cmp r14, rcx
jne case.default.0x1400ab46c
cmp r14, rcx
jb 0x1400ab961
nop dword [rax + rax]
mov eax, dword [0x141f3fa48]
and eax, dword [0x141f3fa4c]
or eax, 0x4ee17b4e
imul eax, eax, 0xc17df632
cmp eax, 0x31185c2a
je 0x1400ab940
mov r14, rcx
mov eax, dword [0x141f3fa68]
xor edx, edx
div dword [0x141f3fa6c]
or eax, 0x45908184
and eax, 0x45faf1d4
imul eax, eax, 0x4249e5be
cmp eax, 0x7e669c51
jae 0x1400ab999
lea rcx, [rsp + 0xa0]
mov rdx, rbx
mov r8, r14
call fcn.1400965b0
lea rcx, [rsp + 0xa0]
mov rdx, rbx
mov r8, r14
call fcn.1400965b0
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0xa8]
movabs rdx, 0x8000000000000000
cmp rcx, rdx
jne 0x1400aba0c
nop dword [rax + rax]
mov ecx, dword [0x141f3fa70]
or ecx, dword [0x141f3fa74]
and ecx, 0x4b1a48f3
imul ecx, ecx, 0x370959fc
cmp ecx, 0x949cdbb0
je 0x1400ab9d0
mov qword [rsp + 0x1a8], rax
movabs rax, 0x8000000000000000
mov qword [rsp + 0x1a0], rax
test byte [rax + riz*4], ah
add dword [rax], eax
add bl, ch
invalid
xor r8d, r8d
nop
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x1f0], rcx
test r8b, r8b
jne 0x1400aba10
mov qword [rsp + 0x1f8], rax
mov qword [rsp + 0x200], rdx
lea rcx, [rsp + 0x1a0]
lea rdx, [rsp + 0x1f0]
call fcn.1400b8380
test rsi, rsi
je 0x1400aba61
mov rcx, qword [0x141f49060]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
movabs rbx, 0x8000000000000000
call fcn.140097370
ud2
mov eax, dword [0x141f3f7d0]
xor edx, edx
div dword [0x141f3f7d4]
and eax, 0xb6003309
add eax, 0x9b3022f6
cmp eax, 0xc7caf298
jbe case.default.0x1400ab46c
mov eax, dword [0x141f3f7d8]
xor edx, edx
div dword [0x141f3f7dc]
and eax, 0x5620233e
imul eax, eax, 0x11935069
mov eax, dword [0x141f3f718]
and eax, dword [0x141f3f71c]
and eax, 0x8497638f
xor eax, 0x25969ffe
add eax, 0x7440d2e5
cmp eax, 0x7189469c
jb 0x1400ac954
jmp 0x1400ac92c
mov eax, dword [0x141f3f870]
xor eax, dword [0x141f3f874]
or eax, 0xefe777ff
add eax, 0x6384ae34
cmp eax, 0xe96199e4
ja 0x1400ac98b
jmp 0x1400ac958
mov esi, dword [0x141f3f9c0]
and esi, dword [0x141f3f9c4]
add esi, 0x48546b0d
and esi, 0xdd26167a
lea rcx, [rsp + 0xa0]
mov rdx, rdi
mov r8, rbp
call fcn.1400965b0
cmp esi, 0x28087f03
jae 0x1400ac1f4
lea rcx, [rsp + 0xa0]
mov rdx, rdi
mov r8, rbp
call fcn.1400965b0
jmp 0x1400ac1ac
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0xa8]
cmp rcx, rbx
jne 0x1400ac269
mov ecx, dword [0x141f3f9c8]
xor ecx, dword [0x141f3f9cc]
and ecx, 0x9fe86852
add ecx, 0x85aba801
xor ecx, 0x7962343c
cmp ecx, 0xf3dffa5c
jbe 0x1400ac23f
mov qword [rsp + 0x1a8], rax
mov qword [rsp + 0x1a0], rbx
mov qword [rsp + 0x1a8], rax
mov qword [rsp + 0x1a0], rbx
nop
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x1f0], rcx
mov qword [rsp + 0x1f8], rax
mov qword [rsp + 0x200], rdx
lea rcx, [rsp + 0x1a0]
and al, 0xa0
add dword [rax], eax
add byte [rax - 0x73], cl
xchg esp, eax
and al, 0xf0
add dword [rax], eax
add al, ch
loop 0x1400ac25c
add byte [rax], al
mov eax, dword [0x141f3f720]
add eax, dword [0x141f3f724]
xor eax, 0x740866a9
add eax, 0xb21b4f52
or eax, 0x6dd1d7b9
ud2
ud2
mov eax, dword [0x141f3f878]
add eax, dword [0x141f3f87c]
mov ecx, 0xd9c871b3
imul rcx, rax
shr rcx, 0x3d
or ecx, 0x4ef40eb4
add ecx, 0xa296cb0b
ud2
ud2