Function at 0x1400a6171
Capabilities:
Delete file
Parse pe header

Disassembly:
push rax
pushf
mov eax, 0x5b8090ed
pushf
not eax
add eax, 0x971574e9
xor eax, 0xdc4a5e48
rol eax, 0xc4
popf
pushf
not eax
add eax, 0xf75d6b48
xor eax, 0x90c39b13
rol eax, 0x27
popf
pushf
not eax
add eax, 0xe6d6d192
xor eax, 0xb1d12d40
rol eax, 0x92
popf
pushf
not eax
add eax, 0x8d1d5f71
xor eax, 0xe7a66f6f
rol eax, 0x53
popf
cmp eax, 0x29
jne 0x1400a61d4
popf
pop rax
jmp 0x1400a7b6e
cmp eax, 0
jne 0x1400a61e3
popf
pop rax
jmp 0x1400a6459
cmp eax, 3
jne 0x1400a61f2
popf
pop rax
jmp 0x1400a66c1
cmp eax, 1
jne 0x1400a6201
popf
pop rax
jmp 0x1400a656d
cmp eax, 0xd
jne 0x1400a6210
popf
pop rax
jmp 0x1400a6ceb
cmp eax, 0x1a
jne 0x1400a621f
popf
pop rax
jmp 0x1400a741a
cmp eax, 0xe
jne 0x1400a622e
popf
pop rax
jmp 0x1400a6d4d
cmp eax, 0xb
jne 0x1400a623d
popf
pop rax
jmp 0x1400a6b24
cmp eax, 0x19
jne 0x1400a624c
popf
pop rax
jmp 0x1400a73bb
cmp eax, 8
jne 0x1400a625b
popf
pop rax
jmp 0x1400a6988
cmp eax, 0x2a
jne 0x1400a626a
popf
pop rax
jmp 0x1400a7be0
cmp eax, 0x17
jne 0x1400a6279
popf
pop rax
jmp 0x1400a721e
cmp eax, 0x1c
jne 0x1400a6288
popf
pop rax
jmp 0x1400a7563
cmp eax, 0x12
jne 0x1400a6297
popf
pop rax
jmp 0x1400a6f00
cmp eax, 0x18
jne 0x1400a62a6
popf
pop rax
jmp 0x1400a727c
cmp eax, 0x2b
jne 0x1400a62b5
popf
pop rax
jmp 0x1400a7c2c
cmp eax, 0x1b
jne 0x1400a62c4
popf
pop rax
jmp 0x1400a749d
cmp eax, 0x21
jne 0x1400a62d3
popf
pop rax
jmp 0x1400a7811
cmp eax, 0x23
jne 0x1400a62e2
popf
pop rax
jmp 0x1400a78ed
cmp eax, 0x25
jne 0x1400a62f1
popf
pop rax
jmp 0x1400a79b7
cmp eax, 0xf
jne 0x1400a6300
popf
pop rax
jmp 0x1400a6d9a
cmp eax, 0x13
jne 0x1400a630f
popf
pop rax
jmp 0x1400a6f62
cmp eax, 0x15
jne 0x1400a631e
popf
pop rax
jmp 0x1400a711c
cmp eax, 0x24
jne 0x1400a632d
popf
pop rax
jmp 0x1400a7925
cmp eax, 0x1e
jne 0x1400a633c
popf
pop rax
jmp 0x1400a7678
cmp eax, 0xc
jne 0x1400a634b
popf
pop rax
jmp 0x1400a6c5a
cmp eax, 0x26
jne 0x1400a635a
popf
pop rax
jmp 0x1400a7a31
cmp eax, 0x27
jne 0x1400a6369
popf
pop rax
jmp 0x1400a7ac0
cmp eax, 0x1f
jne 0x1400a6378
popf
pop rax
jmp 0x1400a76c3
cmp eax, 0x10
jne 0x1400a6387
popf
pop rax
jmp 0x1400a6dfb
cmp eax, 6
jne 0x1400a6396
popf
pop rax
jmp 0x1400a685e
cmp eax, 9
jne 0x1400a63a5
popf
pop rax
jmp 0x1400a6a34
cmp eax, 4
jne 0x1400a63b4
popf
pop rax
jmp 0x1400a6740
cmp eax, 0x16
jne 0x1400a63c3
popf
pop rax
jmp 0x1400a71be
cmp eax, 0x28
jne 0x1400a63d2
popf
pop rax
jmp 0x1400a7b20
cmp eax, 0xa
jne 0x1400a63e1
popf
pop rax
jmp 0x1400a6acd
cmp eax, 0x22
jne 0x1400a63f0
popf
pop rax
jmp 0x1400a78a0
cmp eax, 0x14
jne 0x1400a63ff
popf
pop rax
jmp 0x1400a7051
cmp eax, 7
jne 0x1400a640e
popf
pop rax
jmp 0x1400a68e0
cmp eax, 5
jne 0x1400a641d
popf
pop rax
jmp 0x1400a67c6
cmp eax, 2
jne 0x1400a642c
popf
pop rax
jmp 0x1400a6603
cmp eax, 0x20
jne 0x1400a643b
popf
pop rax
jmp 0x1400a7746
cmp eax, 0x1d
jne 0x1400a644a
popf
pop rax
jmp 0x1400a762b
cmp eax, 0x11
jne 0x1400a6459
popf
pop rax
jmp 0x1400a6ec7
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x140085080]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov r13, rdx
mov r12, rcx
xor r14d, r14d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [0x1b09b79d0]
pushf
sub rcx, 0x70930628
popf
jmp 0x1400a64bf
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
lea rdx, [rbp - 0x40]
mov ecx, 0xb2fa75e8
pushf
not ecx
add ecx, 0xab29d758
xor ecx, 0xd4951fb9
rol ecx, 0xe3
popf
pushf
not ecx
add ecx, 0xe5a68f1f
xor ecx, 0xef83e75d
rol ecx, 0xe4
popf
pushf
not ecx
add ecx, 0xce54e350
xor ecx, 0xc938e046
rol ecx, 0x56
popf
jmp 0x1400a650e
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rbp - 0x68]
call fcn.1400feeff
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
lea rax, [rbp - 0x40]
mov rbx, 0xffffffffffffffff
push rax
pushf
mov eax, 0xaa816193
pushf
not eax
add eax, 0xa7a7fe20
xor eax, 0xc097d34a
rol eax, 0x6c
popf
pushf
not eax
add eax, 0xd19702ce
xor eax, 0xbc9a9efa
rol eax, 0xfd
popf
jmp 0x1400a61c5
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400a65bd
push rax
pushf
mov eax, 0xa361b105
pushf
not eax
add eax, 0xb37e1720
xor eax, 0xb32e00fd
rol eax, 0xc3
popf
pushf
not eax
add eax, 0x90e1d1a5
xor eax, 0xb45b13da
rol eax, 0x1d
popf
pushf
not eax
add eax, 0xa16b2fda
xor eax, 0xeb087ea2
rol eax, 0xc8
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0xe166cd8e
pushf
not eax
add eax, 0xb1c821dc
xor eax, 0xd0c8f7b8
rol eax, 0xcf
popf
pushf
not eax
add eax, 0xd5e53ebf
xor eax, 0x9f62985c
rol eax, 0x7a
popf
pushf
not eax
add eax, 0xa9b6fdc1
xor eax, 0xcf445d28
rol eax, 0x51
popf
jmp 0x1400a61c5
movabs rsi, 0x5fffff9ffc04ec39
pushf
not rsi
add rsi, 0x5b640168
xor rsi, 0x438c0a3c
rol rsi, 0xc3
popf
pushf
not rsi
add rsi, 0x7193f886
xor rsi, 0x7505000f
rol rsi, 0x57
popf
cmp rbx, rsi
ja 0x1400a667b
push rax
pushf
mov eax, 0x792cae92
pushf
not eax
add eax, 0xee1bea28
xor eax, 0xace26de6
rol eax, 0xe3
popf
pushf
not eax
add eax, 0x850a3aeb
xor eax, 0xc49f872c
rol eax, 0x3b
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0x2791dd72
pushf
not eax
add eax, 0xc41de85b
xor eax, 0x9a7a6b6a
rol eax, 0x5d
popf
pushf
not eax
add eax, 0xcd16b28e
xor eax, 0xa87a1a38
rol eax, 0xb1
popf
pushf
not eax
add eax, 0x81e786d9
xor eax, 0x891d3f6d
rol eax, 0xdd
popf
jmp 0x1400a61c5
cmp rbx, 7
ja 0x1400a670d
push rax
pushf
mov eax, 0x3d41d780
pushf
not eax
add eax, 0xac2fba88
xor eax, 0xae7f8e33
rol eax, 0x8b
popf
pushf
not eax
add eax, 0xe34fa190
xor eax, 0xbb42f909
rol eax, 0x79
popf
pushf
not eax
add eax, 0xa86926a3
xor eax, 0xa27fda9d
rol eax, 0x39
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0x3c043068
pushf
not eax
add eax, 0xd8b732a2
xor eax, 0xc2576d69
rol eax, 0xea
popf
pushf
not eax
add eax, 0x85b3bce2
xor eax, 0xf3f679e6
rol eax, 0xf9
popf
jmp 0x1400a61c5
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], 7
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x38]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x38], r14w
jmp 0x1400a6e21
mov rax, rbx
or rax, 7
cmp rax, rsi
jbe 0x1400a6805
push rax
pushf
mov eax, 0xd960dd37
pushf
not eax
add eax, 0x97ff35c0
xor eax, 0xaeeb3d81
rol eax, 5
popf
pushf
not eax
add eax, 0xa7974058
xor eax, 0x98ea9f55
rol eax, 0x9c
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0xcaf50baf
pushf
not eax
add eax, 0xbd80a0b5
xor eax, 0xce27eaa1
rol eax, 0xaf
popf
pushf
not eax
add eax, 0xc0d8764c
xor eax, 0x9e9326d3
rol eax, 0x1e
popf
pushf
not eax
add eax, 0xafbc322f
xor eax, 0x984439f8
rol eax, 0x84
popf
pushf
not eax
add eax, 0xe03ce6fe
xor eax, 0xe70e27e2
rol eax, 0xba
popf
jmp 0x1400a61c5
movabs rax, 0x80b000001ff54b81
pushf
not rax
add rax, 0x6aafab36
xor rax, 0x4abef56d
rol rax, 0x8d
popf
pushf
not rax
add rax, 0x42a457aa
xor rax, 0x72b6d840
rol rax, 0xe2
popf
lea rcx, [rax + rax]
push rax
pushf
mov eax, 0x5507d4d9
pushf
not eax
add eax, 0xb6ba86fe
xor eax, 0xf3b221f2
rol eax, 0x60
popf
pushf
not eax
add eax, 0xbec6b429
xor eax, 0xd785b9cd
rol eax, 2
popf
pushf
not eax
add eax, 0xcb1801cc
xor eax, 0xde09954c
rol eax, 0xd7
popf
jmp 0x1400a61c5
cmp rcx, 0x1000
jb 0x1400a6942
push rax
pushf
mov eax, 0x81752d4a
pushf
not eax
add eax, 0xaf0fe400
xor eax, 0x97302be3
rol eax, 0x38
popf
pushf
not eax
add eax, 0x9a398cc0
xor eax, 0xd7cd1742
rol eax, 0x19
popf
pushf
not eax
add eax, 0xed6ba676
xor eax, 0xbad98e79
rol eax, 0xef
popf
pushf
not eax
add eax, 0xcfa01c43
xor eax, 0xf726d2f5
rol eax, 0x7a
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0x712fe57b
pushf
not eax
add eax, 0x85dcd10c
xor eax, 0xa2e01620
rol eax, 0xcc
popf
pushf
not eax
add eax, 0xd61d7332
xor eax, 0x908b92af
rol eax, 0x94
popf
pushf
not eax
add eax, 0xfe1a2627
xor eax, 0xa7f08587
rol eax, 0x16
popf
jmp 0x1400a61c5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400a69ee
push rax
pushf
mov eax, 0x55766690
pushf
not eax
add eax, 0xd0c1018f
xor eax, 0xaa7257bf
rol eax, 0x67
popf
pushf
not eax
add eax, 0xdee3df84
xor eax, 0xd3e62c77
rol eax, 0xaa
popf
pushf
not eax
add eax, 0xe8b8ef75
xor eax, 0x93b11dc2
rol eax, 0xfc
popf
pushf
not eax
add eax, 0x8ae46cec
xor eax, 0xbbe22add
rol eax, 0x11
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0x1e1ed265
pushf
not eax
add eax, 0xf21d1915
xor eax, 0xb875e12b
rol eax, 0x28
popf
pushf
not eax
add eax, 0xefda5150
xor eax, 0xc8fef187
rol eax, 0x32
popf
pushf
not eax
add eax, 0xdaddc536
xor eax, 0xce4f1205
rol eax, 0x28
popf
jmp 0x1400a61c5
mov rcx, rax
call fcn.140096a2f
test rax, rax
je 0x1400a6a9a
push rax
pushf
mov eax, 0xce0ed360
pushf
not eax
add eax, 0x9edb1a4b
xor eax, 0xa1ebaf93
rol eax, 0x88
popf
pushf
not eax
add eax, 0x8c1f09cf
xor eax, 0xcf0c0865
rol eax, 0x47
popf
pushf
not eax
add eax, 0xb5fd2e2c
xor eax, 0xbfc24dac
rol eax, 0x48
popf
pushf
not eax
add eax, 0x961dde70
xor eax, 0xa2c1c3c9
rol eax, 0xb4
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0x5e1e183f
pushf
not eax
add eax, 0xa58139f5
xor eax, 0xc6e2f92a
rol eax, 0x6b
popf
pushf
not eax
add eax, 0xd97ec252
xor eax, 0xcac9c645
rol eax, 0x2d
popf
jmp 0x1400a61c5
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400a6dfb
mov rsi, rax
mov ecx, 0xa14da653
pushf
not ecx
add ecx, 0xaf808642
xor ecx, 0xefbd3730
rol ecx, 0xd4
popf
pushf
not ecx
add ecx, 0xf8043c1b
xor ecx, 0x84744418
rol ecx, 0x69
popf
pushf
not ecx
add ecx, 0xc3f5a61e
xor ecx, 0xfda79c41
rol ecx, 0x8a
popf
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
movabs rax, 0xf90124b54e1558b
pushf
not rax
add rax, 0x744d03b0
xor rax, 0x4fd3c7e7
rol rax, 0x5a
popf
pushf
not rax
add rax, 0x4a16b828
xor rax, 0x7a50f871
rol rax, 0xe2
popf
pushf
not rax
add rax, 0x49b04f2e
xor rax, 0x61442a37
rol rax, 0xcb
popf
cmp rcx, rax
ja 0x1400a6c27
push rax
pushf
mov eax, 0x3954f80c
pushf
not eax
add eax, 0x84b27bef
xor eax, 0xec1151d3
rol eax, 0xd
popf
pushf
not eax
add eax, 0xd2f4060c
xor eax, 0x8b4e178d
rol eax, 0x93
popf
pushf
not eax
add eax, 0xe7da546f
xor eax, 0xccc9b808
rol eax, 0x9b
popf
pushf
not eax
add eax, 0x815567e1
xor eax, 0xa560bf76
rol eax, 0x67
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0xd1bd178b
pushf
not eax
add eax, 0xc982d9e8
xor eax, 0xaeb04c9b
rol eax, 0x12
popf
pushf
not eax
add eax, 0x9f2f12a9
xor eax, 0xe411acc7
rol eax, 0xa1
popf
jmp 0x1400a61c5
add rcx, rcx
jne 0x1400a6c92
push rax
pushf
mov eax, 0x4f552467
pushf
not eax
add eax, 0xba806834
xor eax, 0x85c8e5a5
rol eax, 0xd9
popf
pushf
not eax
add eax, 0xb0d4249b
xor eax, 0x9cf65d4d
rol eax, 0x22
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0xe8528002
pushf
not eax
add eax, 0xa4155141
xor eax, 0x8b6f3dae
rol eax, 0x34
popf
pushf
not eax
add eax, 0xfee0ecbb
xor eax, 0xd1240a07
rol eax, 0x79
popf
pushf
not eax
add eax, 0x88b8f5d8
xor eax, 0xc99226d5
rol eax, 0xc1
popf
pushf
not eax
add eax, 0xd294e9ba
xor eax, 0x839aa00f
rol eax, 0x26
popf
jmp 0x1400a61c5
mov rdi, r14
jmp 0x1400a6dfb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140096a2f
mov rdi, rax
push rax
pushf
mov eax, 0x8ecadb0
pushf
not eax
add eax, 0xfb89c7e2
xor eax, 0xaf1d6227
rol eax, 0xdf
popf
pushf
not eax
add eax, 0x88baf020
xor eax, 0xb08e137d
rol eax, 0x86
popf
pushf
not eax
add eax, 0x90cf0144
xor eax, 0xf38d21f9
rol eax, 0xbd
popf
pushf
not eax
add eax, 0xeb934e0b
xor eax, 0xd3864d24
rol eax, 0xf1
popf
jmp 0x1400a61c5
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x40]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r14w
lea r9, [rbp - 0x68]
mov rdi, qword [rbp - 0x68]
mov r14, qword [rbp - 0x50]
cmp r14, 7
cmova r9, rdi
mov r15, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
sub rax, r15
mov rsi, qword [rbp - 0x58]
cmp rsi, rax
ja 0x1400a6e81
push rax
pushf
mov eax, 0x351ffe13
pushf
not eax
add eax, 0x837a5e4a
xor eax, 0x978c11a2
rol eax, 7
popf
pushf
not eax
add eax, 0xb504825b
xor eax, 0xc9c997ee
rol eax, 0x33
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0x416b6097
pushf
not eax
add eax, 0xd1b4d55d
xor eax, 0x847cc1cc
rol eax, 0x25
popf
pushf
not eax
add eax, 0x874c2ae5
xor eax, 0xa19770fe
rol eax, 0x2b
popf
pushf
not eax
add eax, 0xd0a6bc06
xor eax, 0xf0dcd6fd
rol eax, 0xc6
popf
jmp 0x1400a61c5
lea rax, [r15 + rsi]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x38]
cmp rcx, 7
cmova rbx, qword [rsp + 0x38]
lea rcx, [rbx + r15*2]
lea r8, [rsi + rsi]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + r15]
xor esi, esi
mov word [rbx + rax*2], si
lea rax, [rsp + 0x38]
jmp 0x1400a6f62
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.1400b3aad
mov r14, qword [rbp - 0x50]
mov rdi, qword [rbp - 0x68]
xor esi, esi
push rax
pushf
mov eax, 0x8553d4ab
pushf
not eax
add eax, 0xfef03aa6
xor eax, 0x9876983d
rol eax, 0xb4
popf
pushf
not eax
add eax, 0xe8e58b88
xor eax, 0xbdbcc9af
rol eax, 0xe5
popf
pushf
not eax
add eax, 0xd094da97
xor eax, 0x95202b86
rol eax, 0x1f
popf
jmp 0x1400a61c5
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x1400a6ff8
push rax
pushf
mov eax, 0xcff73f99
pushf
not eax
add eax, 0xcd2756b1
xor eax, 0xc23a7d48
rol eax, 0xc0
popf
pushf
not eax
add eax, 0xa01425aa
xor eax, 0xb4f81473
rol eax, 0xa3
popf
pushf
not eax
add eax, 0xfe4ea954
xor eax, 0xe48c155d
rol eax, 0x7e
popf
pushf
not eax
add eax, 0xef9b0031
xor eax, 0xc507b3fa
rol eax, 0xdb
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0x42d15712
pushf
not eax
add eax, 0x90dd910b
xor eax, 0xd6ba6513
rol eax, 0xc4
popf
pushf
not eax
add eax, 0x98896e99
xor eax, 0xf31ee149
rol eax, 0x45
popf
pushf
not eax
add eax, 0x81ac1750
xor eax, 0xdf788836
rol eax, 0x77
popf
pushf
not eax
add eax, 0xea111ffb
xor eax, 0xc6ddbd94
rol eax, 0xb6
popf
jmp 0x1400a61c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a70c3
push rax
pushf
mov eax, 0xc90639
pushf
not eax
add eax, 0xdc694955
xor eax, 0xb5af5eda
rol eax, 0xc0
popf
pushf
not eax
add eax, 0xd087c31c
xor eax, 0xb545ba5b
rol eax, 0x5a
popf
pushf
not eax
add eax, 0xcb8a92e0
xor eax, 0xf0ff8d61
rol eax, 0x39
popf
pushf
not eax
add eax, 0xeecb2609
xor eax, 0xea61abe2
rol eax, 0x57
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0x666d8bff
pushf
not eax
add eax, 0xa4ba263e
xor eax, 0x9f9dc679
rol eax, 0xfa
popf
pushf
not eax
add eax, 0x9c24c40d
xor eax, 0xdbf37cd3
rol eax, 0x5b
popf
pushf
not eax
add eax, 0xcb193c75
xor eax, 0x8ee233c1
rol eax, 0x6c
popf
pushf
not eax
add eax, 0x8815ce70
xor eax, 0xe81b9dbd
rol eax, 0xa3
popf
jmp 0x1400a61c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a718a
push rax
pushf
mov eax, 0xad501845
pushf
not eax
add eax, 0xfc1d6c2f
xor eax, 0x88e566b4
rol eax, 0x83
popf
pushf
not eax
add eax, 0xc6889793
xor eax, 0x98e4a9df
rol eax, 0xa0
popf
pushf
not eax
add eax, 0xbec73a40
xor eax, 0xf9e46a35
rol eax, 0x86
popf
pushf
not eax
add eax, 0xf98019b1
xor eax, 0xc9585dee
rol eax, 0xdd
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0x60aa2108
pushf
not eax
add eax, 0x90466aa8
xor eax, 0xab744f8a
rol eax, 0xca
popf
pushf
not eax
add eax, 0x86123c64
xor eax, 0xe5f9e67e
rol eax, 0xbf
popf
jmp 0x1400a61c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bfce0
push rax
pushf
mov eax, 0xd1cbd36d
pushf
not eax
add eax, 0xedb90c1e
xor eax, 0xb5df1fc1
rol eax, 0x13
popf
pushf
not eax
add eax, 0x9a127fc7
xor eax, 0xcd617e02
rol eax, 0xd6
popf
pushf
not eax
add eax, 0xd6327106
xor eax, 0xcfaeaf80
rol eax, 0x60
popf
pushf
not eax
add eax, 0xa73e9a79
xor eax, 0x9f5b420f
rol eax, 0xd4
popf
jmp 0x1400a61c5
movdqa xmm0, xmmword [0x140079960]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], si
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov r8d, 0xfcc2ca49
pushf
not r8d
add r8d, 0xcb6c7713
xor r8d, 0x98b327bd
rol r8d, 0xec
popf
pushf
not r8d
add r8d, 0x84e4c743
xor r8d, 0x84da3839
rol r8d, 0x3e
popf
pushf
not r8d
add r8d, 0xd3e4d127
xor r8d, 0xbda6de30
rol r8d, 0xb9
popf
lea rdx, [0x1a8b937a1]
pushf
sub rdx, 0x68b1b4a1
popf
lea rcx, [rsp + 0x78]
call fcn.1400cd7ec
nop
lea rcx, [rsp + 0x58]
call fcn.1400c1e59
mov r9, r13
mov r8, r12
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.1400ecf58
mov rcx, qword [0x1400873a8]
jmp 0x1400a7334
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
cmp qword [rsp + 0x68], 0
je 0x1400a7375
push rax
pushf
mov eax, 0x561b2529
pushf
not eax
add eax, 0xb171e562
xor eax, 0xe5203520
rol eax, 7
popf
pushf
not eax
add eax, 0xe9d62cf9
xor eax, 0xad7ba099
rol eax, 0x4b
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0xbe6bf807
pushf
not eax
add eax, 0xb838b468
xor eax, 0xfdb76582
rol eax, 0x16
popf
pushf
not eax
add eax, 0xa4dd74f6
xor eax, 0x89a34a31
rol eax, 0x63
popf
pushf
not eax
add eax, 0xc7982e93
xor eax, 0x8d9f301d
rol eax, 0xa8
popf
jmp 0x1400a61c5
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova rcx, qword [rsp + 0x58]
jmp 0x1400a73cd
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
push rax
pushf
mov eax, 0x98680410
pushf
not eax
add eax, 0xb430af68
xor eax, 0xc084dea0
rol eax, 0xd6
popf
pushf
not eax
add eax, 0x80a7f505
xor eax, 0xb8b8aa74
rol eax, 0x7f
popf
pushf
not eax
add eax, 0xa303093e
xor eax, 0xc5fe5974
rol eax, 0xf8
popf
jmp 0x1400a61c5
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x1400a7457
push rax
pushf
mov eax, 0xf63f66d0
pushf
not eax
add eax, 0x8a67f760
xor eax, 0xa927db70
rol eax, 0x90
popf
pushf
not eax
add eax, 0x9b7206ea
xor eax, 0xff72c9db
rol eax, 0xe4
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0x7aed8db8
pushf
not eax
add eax, 0xc800dda2
xor eax, 0xba278329
rol eax, 0xfd
popf
pushf
not eax
add eax, 0xf533c1eb
xor eax, 0xaca0a98b
rol eax, 0x50
popf
pushf
not eax
add eax, 0xc5c1bf6c
xor eax, 0xb3e8447f
rol eax, 0xa4
popf
jmp 0x1400a61c5
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a750a
push rax
pushf
mov eax, 0x6e6f4aa4
pushf
not eax
add eax, 0xa2f09d5b
xor eax, 0xb1563cc3
rol eax, 0xd4
popf
pushf
not eax
add eax, 0xe21aa8fb
xor eax, 0xb438a2a9
rol eax, 0x34
popf
pushf
not eax
add eax, 0xdae7f917
xor eax, 0xd84490ce
rol eax, 0xed
popf
pushf
not eax
add eax, 0x8c0d0582
xor eax, 0x9b583377
rol eax, 0x2b
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0x78d0212e
pushf
not eax
add eax, 0xc1e652af
xor eax, 0xfc31dce9
rol eax, 0xdc
popf
pushf
not eax
add eax, 0xb3769ed4
xor eax, 0xfe0a5ee7
rol eax, 0x9e
popf
pushf
not eax
add eax, 0x9e514c14
xor eax, 0xf1f6edc5
rol eax, 0x9b
popf
pushf
not eax
add eax, 0xc91a36ff
xor eax, 0x887f9c4e
rol eax, 0xd1
popf
jmp 0x1400a61c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a75d1
push rax
pushf
mov eax, 0x4892dea
pushf
not eax
add eax, 0xbc3a33e6
xor eax, 0xce8da034
rol eax, 0x9c
popf
pushf
not eax
add eax, 0x93990714
xor eax, 0xf5446d75
rol eax, 0x8d
popf
pushf
not eax
add eax, 0xe6a43d0d
xor eax, 0xd1feef79
rol eax, 4
popf
pushf
not eax
add eax, 0x93d2023b
xor eax, 0xba69f864
rol eax, 0xad
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0x2ac4be0
pushf
not eax
add eax, 0xa0dd0cbe
xor eax, 0xb1d95f37
rol eax, 0x61
popf
pushf
not eax
add eax, 0xa6c8cbdd
xor eax, 0xacb4dc0f
rol eax, 0x67
popf
pushf
not eax
add eax, 0xbfeb8d59
xor eax, 0xa909a010
rol eax, 0xaa
popf
pushf
not eax
add eax, 0xf291c590
xor eax, 0xca2bf8b6
rol eax, 0x2b
popf
jmp 0x1400a61c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bfce0
push rax
pushf
mov eax, 0x2a27de19
pushf
not eax
add eax, 0xe88c7d9f
xor eax, 0xb5fc510d
rol eax, 0xdc
popf
pushf
not eax
add eax, 0xb068b483
xor eax, 0xeab74d5c
rol eax, 0xc9
popf
pushf
not eax
add eax, 0xc051f624
xor eax, 0x8f7c6861
rol eax, 0xfd
popf
jmp 0x1400a61c5
movdqa xmm0, xmmword [0x140079970]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x1400a7713
push rax
pushf
mov eax, 0x1c0ee107
pushf
not eax
add eax, 0x8e90c018
xor eax, 0xbe898231
rol eax, 0xbe
popf
pushf
not eax
add eax, 0xf87c7f40
xor eax, 0x85fa67f7
rol eax, 0xee
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0x3bda2199
pushf
not eax
add eax, 0xe19fc6f0
xor eax, 0xf4997a3f
rol eax, 0xa
popf
pushf
not eax
add eax, 0xf11b2cdb
xor eax, 0xfd9d8791
rol eax, 0x43
popf
jmp 0x1400a61c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a77b8
push rax
pushf
mov eax, 0xf7246c05
pushf
not eax
add eax, 0xdc38b5ff
xor eax, 0x9005cdc5
rol eax, 0x79
popf
pushf
not eax
add eax, 0xb1ab0ec5
xor eax, 0x83d3f975
rol eax, 0x21
popf
pushf
not eax
add eax, 0xd4983cc2
xor eax, 0x8a0a8594
rol eax, 0x20
popf
pushf
not eax
add eax, 0xbfd790f9
xor eax, 0xcb5efe3a
rol eax, 0xc3
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0x5dd68cfe
pushf
not eax
add eax, 0xdfabf943
xor eax, 0x995aa9b9
rol eax, 0x36
popf
pushf
not eax
add eax, 0xd97ff461
xor eax, 0xb20f3f6f
rol eax, 0x58
popf
pushf
not eax
add eax, 0xadbbee57
xor eax, 0xd03fbaf6
rol eax, 0x48
popf
pushf
not eax
add eax, 0xadf73ec8
xor eax, 0xc1e9a92b
rol eax, 0x1b
popf
jmp 0x1400a61c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a7859
push rax
pushf
mov eax, 0xfd4876fc
pushf
not eax
add eax, 0xba3bbfd4
xor eax, 0xaa33784d
rol eax, 0x95
popf
pushf
not eax
add eax, 0xa5a03d2e
xor eax, 0x925d6505
rol eax, 0x60
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0x7e75ecc6
pushf
not eax
add eax, 0xd84272f5
xor eax, 0x878a841f
rol eax, 0xc4
popf
pushf
not eax
add eax, 0xb39eff28
xor eax, 0xcefdefd3
rol eax, 0xb0
popf
pushf
not eax
add eax, 0xe658f2ca
xor eax, 0xb239f106
rol eax, 0x8f
popf
jmp 0x1400a61c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bfce0
push rax
pushf
mov eax, 0xae4dad46
pushf
not eax
add eax, 0x8bdfdba1
xor eax, 0xe457a28f
rol eax, 0x65
popf
pushf
not eax
add eax, 0xdae4d36a
xor eax, 0xa2333a82
rol eax, 0x9c
popf
jmp 0x1400a61c5
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], si
cmp r14, 7
jbe 0x1400a7971
push rax
pushf
mov eax, 0x82a221ef
pushf
not eax
add eax, 0x9ebd54a6
xor eax, 0x860800a1
rol eax, 0xb3
popf
pushf
not eax
add eax, 0xba1c9ef7
xor eax, 0xa95fce4f
rol eax, 0x81
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0xf20f22ed
pushf
not eax
add eax, 0xce8a61a5
xor eax, 0x827e9d17
rol eax, 0x40
popf
pushf
not eax
add eax, 0xf8967297
xor eax, 0xf12c7d5e
rol eax, 0x46
popf
pushf
not eax
add eax, 0xac408f9c
xor eax, 0xbd13f781
rol eax, 0x57
popf
jmp 0x1400a61c5
lea rdx, [r14*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400a79fe
push rax
pushf
mov eax, 0xdcce5f0f
pushf
not eax
add eax, 0x881f68ab
xor eax, 0xae312f88
rol eax, 0x2b
popf
pushf
not eax
add eax, 0x8644e82f
xor eax, 0x85144303
rol eax, 0x79
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0x4fb93771
pushf
not eax
add eax, 0xb3bee69a
xor eax, 0xce170ded
rol eax, 0x69
popf
pushf
not eax
add eax, 0xba7cf51a
xor eax, 0x953739c5
rol eax, 0x97
popf
jmp 0x1400a61c5
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a7a79
push rax
pushf
mov eax, 0x8ff6130a
pushf
not eax
add eax, 0x85d2a93d
xor eax, 0xf001cd61
rol eax, 0xe7
popf
pushf
not eax
add eax, 0xa4465273
xor eax, 0xb598aa80
rol eax, 0x1c
popf
jmp 0x1400a61c5
push rax
pushf
mov eax, 0x683a7b2d
pushf
not eax
add eax, 0xe395a69b
xor eax, 0xda97542d
rol eax, 0x4d
popf
pushf
not eax
add eax, 0x8dadfa4a
xor eax, 0x98d6c6c3
rol eax, 0xd8
popf
pushf
not eax
add eax, 0xa279bcdf
xor eax, 0xcf14acbe
rol eax, 0xbb
popf
jmp 0x1400a61c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400bfce0
push rax
pushf
mov eax, 0xc164ecfe
pushf
not eax
add eax, 0x915342e8
xor eax, 0xa20f0b1c
rol eax, 0x4b
popf
pushf
not eax
add eax, 0xeb4bf9f6
xor eax, 0xdad6a8ab
rol eax, 0xcb
popf
pushf
not eax
add eax, 0x9e015d2f
xor eax, 0x86cd635a
rol eax, 0xf4
popf
jmp 0x1400a61c5
xor eax, eax
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1400dadee
mov rbx, qword [rsp + 0x330]
add rsp, 0x2e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400db508
nop
push rax
pushf
mov eax, 0xa3d3b4d0
pushf
not eax
add eax, 0xf80d907a
xor eax, 0xb478bf16
rol eax, 0xb3
popf
pushf
not eax
add eax, 0xca4de80e
xor eax, 0xf718d443
rol eax, 0xb5
popf
pushf
not eax
add eax, 0x8470e685
xor eax, 0xfc467bb4
rol eax, 2
popf
jmp 0x1400a61c5
call fcn.14009c780
int3