Function at 0x14000fe90
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r14, rcx
nop word cs:[rax + rax]
mov eax, dword [0x141dbfc70]
and eax, dword [0x141dbfc74]
add eax, 0x4aaf7f51
or eax, 0x648f2b6e
cmp eax, 0x547341dd
je 0x14000feb0
nop dword [rax]
mov eax, dword [0x141dbfc78]
add eax, dword [0x141dbfc7c]
and eax, 0x52287430
add eax, 0x3f7607f1
cmp eax, 0x64a72db4
jb 0x14000fed0
mov rcx, qword [r14 + 0x48]
test rcx, rcx
mov qword [rsp + 0x38], r14
je 0x1400107ae
nop
mov eax, dword [0x141dbfc80]
add eax, dword [0x141dbfc84]
imul eax, eax, 0x498543dc
add eax, 0xd0c5495c
xor eax, 0x4a8ad233
cmp eax, 0xae0a1373
ja 0x14000ff00
mov rdi, qword [r14 + 0x58]
test rdi, rdi
je 0x14001070d
mov r15, qword [r14 + 0x40]
movdqa xmm0, xmmword [r15]
pmovmskb ebx, xmm0
not ebx
lea r12, [r15 + 0x10]
xor r13d, r13d
mov rsi, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
test bx, bx
jne 0x14000ff86
nop word cs:[rax + rax]
movdqa xmm0, xmmword [r12]
pmovmskb eax, xmm0
add r15, 0xffffffffffffea00
add r12, 0x10
cmp eax, 0xffff
je 0x14000ff60
mov ebx, eax
not ebx
mov cl, 1
test cl, cl
je 0x14000ff7c
tzcnt eax, ebx
neg rax
imul rax, rax, 0x160
lea r14, [r15 + rax]
cmp qword [r15 + rax - 0x148], 0
je 0x14001001c
mov eax, dword [0x141dbfc88]
xor edx, edx
div dword [0x141dbfc8c]
nop word cs:[rax + rax]
mov eax, dword [0x141dbfc90]
imul eax, dword [0x141dbfc94]
shr eax, 3
imul rax, rax, 0x2044d407
shr rax, 0x37
imul eax, eax, 0xc2ce0468
cmp eax, 0xcb0ca5c6
ja 0x14000ffc0
mov eax, dword [0x141dbfc98]
and eax, dword [0x141dbfc9c]
and eax, 0xe1529d2
add eax, 0xd653f12e
or eax, 0xc7a630c9
cmp eax, 0xa1fe91f4
je 0x14000ffe8
mov r8, qword [r14 - 0x140]
mov rcx, qword [0x141dda6a0]
xor edx, edx
call rsi
lea eax, [rbx - 1]
and eax, ebx
mov ecx, eax
dec rdi
mov eax, dword [0x141dbfca0]
xor edx, edx
div dword [0x141dbfca4]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x30], rdi
nop
mov eax, dword [0x141dbfca8]
sub eax, dword [0x141dbfcac]
and eax, 0xb728e3be
xor eax, 0xd65ea348
add eax, 0xd4ddac2d
cmp eax, 0x59ccf690
jb 0x140010040
mov rdi, qword [r14 - 0x120]
mov qword [rsp + 0x28], r14
mov rbx, qword [r14 - 0x118]
test rbx, rbx
je 0x140010160
lea rbp, [rdi + 8]
xor r14d, r14d
jmp 0x1400100a0
add rbp, 0x20
inc r14
dec rbx
je 0x140010160
mov eax, dword [0x141dbfcb0]
sub eax, dword [str.V_g]
add eax, 0x52d715f8
xor eax, 0x5d90ac44
cmp eax, 0x30cbc5d3
jb 0x1400100a0
cmp qword [rbp - 8], 0
je 0x140010090
mov eax, dword [0x141dbfcb8]
or eax, dword [0x141dbfcbc]
xor eax, 0x83028132
and eax, 0x83aaf9b3
imul rcx, rax, 0x755ce77
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
cmp eax, 0xaf2d0f9f
ja 0x140010150
nop word cs:[rax + rax]
mov r8, qword [rbp]
mov rcx, qword [0x141dda6a0]
test r13b, r13b
jne 0x140010150
xor edx, edx
call rsi
nop word cs:[rax + rax]
mov eax, dword [0x141dbfcc0]
and eax, dword [0x141dbfcc4]
or eax, 0x86006403
imul rax, rax, 0x77bbb281
shr rax, 0x3e
or eax, 0xac2a986
cmp eax, 0xa3ffffb5
ja 0x140010120
jmp 0x140010090
mov rax, qword [0x141dda6a0]
jmp 0x140010100
mov eax, dword [0x141dbfcc8]
and eax, dword [0x141dbfccc]
imul eax, eax, 0xf2c8f88a
add eax, 0x55804a5a
and eax, 0x62a69e70
cmp eax, 0x8bb019a9
ja 0x140010160
mov rbx, qword [rsp + 0x28]
mov rax, qword [rbx - 0x128]
mov ebp, 0xe6cca7e7
nop word cs:[rax + rax]
test r13b, r13b
jne 0x1400101a0
nop word cs:[rax + rax]
mov ecx, dword [0x141dbfcd0]
add ecx, dword [0x141dbfcd4]
xor ecx, 0x9de7ef0
imul ecx, ecx, 0x88d56ca9
and ecx, 0x2d2c3082
cmp ecx, 0xae4cebcc
ja 0x1400101b0
test rax, rax
je 0x14001028d
mov rbx, qword [0x141dda6a0]
mov eax, dword [0x141dbfcd8]
xor edx, edx
div dword [0x141dbfcdc]
add eax, 0x2c0f00f2
and eax, 0xf9339f15
imul eax, eax, 0xbc28ae56
cmp eax, 0x3b586e47
jne 0x140010220
mov rcx, rbx
xor edx, edx
mov r8, rdi
call rsi
nop word cs:[rax + rax]
mov r14d, dword [0x141dbfce0]
add r14d, dword [0x141dbfce4]
imul r14, rbp
shr r14, 0x3e
xor r14d, 0x927f8eb1
add r14d, 0x1ee19e06
mov rcx, rbx
xor edx, edx
mov r8, rdi
call rsi
cmp r14d, 0xb99e8260
ja 0x140010220
mov rbx, qword [rsp + 0x28]
nop dword [rax]
mov eax, dword [0x141dbfce8]
imul eax, dword [0x141dbfcec]
or eax, 0xf57fbebd
imul rcx, rax, 0x34551471
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
cmp eax, 0x678afd1f
ja 0x140010260
mov rax, qword [rbx - 0xf8]
mov edx, 0x934fb30d
nop dword [rax]
mov ecx, dword [0x141dbfcf0]
xor ecx, dword [0x141dbfcf4]
imul ecx, ecx, 0xd01cdb0
shr ecx, 1
imul rcx, rdx
shr rcx, 0x3e
cmp ecx, 0x9b7ac4e4
je 0x1400102a0
shl rax, 1
test rax, rax
je 0x140010310
nop dword [rax]
mov eax, dword [0x141dbfcf8]
mov ecx, dword [0x141dbfcfc]
add eax, ecx
add eax, 0x756201de
or eax, 0xefffbf75
cmp eax, 0xc09ff95
jb 0x1400102d0
mov r8, qword [rbx - 0xf0]
mov rcx, qword [0x141dda6a0]
xor edx, edx
call rsi
nop word cs:[rax + rax]
mov eax, dword [0x141dbfd00]
mov ecx, dword [0x141dbfd04]
add eax, ecx
add eax, 0xc6e9ca2b
or eax, 0xec4f40d
cmp eax, 0xb003d6d4
je 0x140010310
nop
mov eax, dword [0x141dbfd08]
sub eax, dword [0x141dbfd0c]
add eax, 0xe0c5f0dc
xor eax, 0xd6d78372
imul rax, rax, 0x33064c51
shr rax, 0x3c
cmp eax, 0x33faf79
ja 0x140010330
mov rax, qword [rbx - 0xd8]
shl rax, 1
test rax, rax
je 0x1400103a0
nop word [rax + rax]
test r13b, r13b
jne 0x140010370
nop word cs:[rax + rax]
test r13b, r13b
jne 0x140010380
mov r8, qword [rbx - 0xd0]
mov rcx, qword [0x141dda6a0]
xor edx, edx
call rsi
nop word [rax + rax]
mov eax, dword [0x141dbfd10]
or eax, dword [0x141dbfd14]
or eax, 0xdffbfe7b
cmp eax, 0xf52ee1ef
je 0x1400103a0
mov rdi, qword [rbx - 0x108]
mov rbx, qword [rbx - 0x100]
test rbx, rbx
je 0x140010460
mov r14, rdi
xor ebp, ebp
jmp 0x1400103ec
add r14, 0x20
inc rbp
dec rbx
je 0x140010460
mov eax, dword [0x141dbfd18]
xor eax, dword [0x141dbfd1c]
cmp eax, 0x285cec66
je 0x1400103ec
cmp qword [r14], 0
je 0x1400103e0
mov eax, dword [str._t_DH]
xor edx, edx
div dword [0x141dbfd24]
and eax, 0x917f8865
imul eax, eax, 0x93f77d65
cmp eax, 0x5d7e2392
je 0x140010405
mov r8, qword [r14 + 8]
mov rcx, qword [0x141dda6a0]
xor edx, edx
call rsi
nop word cs:[rax + rax]
mov eax, dword [0x141dbfd28]
xor eax, dword [0x141dbfd2c]
add eax, 0x5e1444
and eax, 0x2f0b68cd
cmp eax, 0xf88057f0
je 0x140010440
jmp 0x1400103e0
mov r14, qword [rsp + 0x28]
mov rcx, qword [r14 - 0x110]
mov r8d, 0xcd5558e3
mov eax, dword [0x141dbfd30]
xor edx, edx
div dword [0x141dbfd34]
imul rax, r8
shr rax, 0x3e
and eax, 1
xor eax, 0x84e42ee5
cmp eax, 0x474a07c
jb 0x140010472
test rcx, rcx
mov r8d, 0xcf848e0f
je 0x1400104fb
mov eax, dword [0x141dbfd38]
and eax, dword [0x141dbfd3c]
or eax, 0x5fc4bbf
imul eax, eax, 0xe5b86bd0
or eax, 0xf883c890
cmp eax, 0x5d7d1447
jne 0x1400104d0
mov rax, qword [0x141dda6a0]
nop dword [rax]
mov eax, dword [0x141dbfd40]
xor edx, edx
div dword [0x141dbfd44]
imul rax, r8
shr rax, 0x3f
mov rcx, qword [0x141dda6a0]
cmp eax, 0x5191f3bb
je 0x1400104d0
xor edx, edx
mov r8, rdi
call rsi
mov rax, qword [r14 - 0xc0]
nop word cs:[rax + rax]
mov ecx, dword [0x141dbfd48]
and ecx, dword [0x141dbfd4c]
imul rcx, rcx, 0x37aefbb3
shr rcx, 0x3d
xor ecx, 0x3104101
or ecx, 0x7ca5aeea
cmp ecx, 0xa830bfaa
je 0x140010510
shl rax, 1
test rax, rax
je 0x1400105b2
mov eax, dword [0x141dbfd50]
sub eax, dword [0x141dbfd54]
mov rdi, qword [r14 - 0xb8]
imul rax, rax, 0x27e4d8d
shr rax, 0x38
cmp eax, 0x47dc3f98
jne 0x140010580
mov rcx, qword [0x141dda6a0]
xor edx, edx
mov r8, rdi
call rsi
nop word cs:[rax + rax]
mov eax, dword [0x141dbfd58]
add eax, dword [0x141dbfd5c]
xor eax, 0x3b152002
and eax, 0x7b5f601f
imul ebx, eax, 0x862518c2
mov rcx, qword [0x141dda6a0]
xor edx, edx
mov r8, rdi
call rsi
cmp ebx, 0x66d7c4bf
ja 0x140010580
mov rax, qword [r14 - 0xa0]
nop dword [rax]
mov ecx, dword [0x141dbfd60]
imul ecx, dword [0x141dbfd64]
and ecx, 0x434fa3d3
add ecx, 0x791f3ce1
or ecx, 0xbe07235f
cmp ecx, 0x5386ce3f
jb 0x1400105c0
shl rax, 1
test rax, rax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
je 0x140010648
nop dword [rax]
mov eax, dword [0x141dbfd68]
xor edx, edx
div dword [0x141dbfd6c]
or eax, 0xe75f5dff
cmp eax, 0x48bf621e
jb 0x140010600
mov r8, qword [r14 - 0x98]
mov rcx, qword [0x141dda6a0]
xor edx, edx
call rsi
nop dword [rax]
mov eax, dword [0x141dbfd70]
sub eax, dword [0x141dbfd74]
and eax, 0x43410a00
cmp eax, 0xc2c08dd4
je 0x140010630
mov rcx, qword [r14 - 0x60]
test rcx, rcx
je 0x140010671
mov rax, 0xffffffffffffffff
lock xadd qword [rcx], rax
test r13b, r13b
jne 0x14001065d
cmp rax, 1
jne 0x140010671
mov rcx, qword [r14 - 0x60]
call fcn.1400174b0
mov eax, dword [0x141dbfd78]
xor edx, edx
div dword [0x141dbfd7c]
nop
mov eax, dword [0x141dbfd80]
imul eax, dword [0x141dbfd84]
imul eax, eax, 0x24f33247
xor eax, 0x33bb48d1
imul rax, rax, 0x35aeb859
shr rax, 0x3d
cmp eax, 0xe93d0722
ja 0x140010680
nop word [rax + rax]
mov eax, dword [0x141dbfd88]
and eax, dword [0x141dbfd8c]
imul eax, eax, 0xa5ee8e10
imul rax, rax, 0x58e021d5
shr rax, 0x3e
add eax, 0x39907851
cmp eax, 0xf7d75a33
ja 0x1400106b0
test rdi, rdi
jne 0x14000ff50
mov r14, qword [rsp + 0x38]
nop word [rax + rax]
mov eax, dword [0x141dbfd90]
or eax, dword [0x141dbfd94]
imul eax, eax, 0x9a976360
cmp eax, 0x2c4789f9
je 0x1400106f0
mov rcx, qword [r14 + 0x48]
lea rax, [rcx + 1]
mov edx, 0x160
mul rdx
add rcx, rax
cmp rcx, 0xffffffffffffffef
je 0x1400107ae
mov rdi, qword [r14 + 0x40]
sub rdi, rax
xor eax, eax
test al, al
je 0x140010745
mov rcx, qword [0x141dda6a0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov eax, dword [0x141dbfd98]
xor edx, edx
div dword [0x141dbfd9c]
xor eax, 0x41622a2a
and eax, 0x437e3eae
imul ebx, eax, 0xd643167e
mov rcx, qword [0x141dda6a0]
xor edx, edx
mov r8, rdi
call rsi
cmp ebx, 0x52c1289a
jb 0x140010750
nop word cs:[rax + rax]
mov eax, dword [0x141dbfda0]
sub eax, dword [0x141dbfda4]
or eax, 0xe3efe6ef
imul eax, eax, 0xa896b4bf
cmp eax, 0x23418f0a
jb 0x140010790
mov eax, dword [0x141dbfda8]
xor edx, edx
div dword [0x141dbfdac]
nop dword [rax]
mov eax, dword [0x141dbfdb0]
xor edx, edx
div dword [0x141dbfdb4]
xor eax, 0x82851b3c
imul eax, eax, 0xc064c0d1
cmp eax, 0x1408d64e
je 0x1400107c0
mov rax, qword [r14 + 0x18]
shl rax, 1
test rax, rax
je 0x14001088a
mov eax, dword [0x141dbfdb8]
sub eax, dword [0x141dbfdbc]
xor eax, 0x305fcb33
add eax, 0x5f8575ad
and eax, 0x3b686561
cmp eax, 0x8c0be971
je 0x1400107f0
mov eax, dword [0x141dbfdc0]
or eax, dword [0x141dbfdc4]
or eax, 0x64ea486
imul eax, eax, 0x8bd3daea
and eax, 0x437cab8
cmp eax, 0x7ced6391
ja 0x14001084f
mov r8, qword [r14 + 0x20]
mov rcx, qword [0x141dda6a0]
xor esi, esi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test sil, sil
je 0x140010870
mov r8, qword [r14 + 0x20]
mov rcx, qword [0x141dda6a0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140010835
mov eax, dword [0x141dbfdc8]
xor edx, edx
div dword [0x141dbfdcc]
or eax, 0xee454bf2
cmp eax, 0x48dc328d
je 0x140010870
xor eax, eax
nop dword [rax]
test al, al
jne 0x140010890
mov rax, qword [r14 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax]
mov eax, dword [0x141dbfdd0]
and eax, dword [0x141dbfdd4]
or eax, 0x20010042
and eax, 0x60010072
cmp eax, 0x7ecf087b
je 0x1400108a0
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0x30], rax
mov eax, 0xf6241435
nop dword [rax + rax]
mov ecx, dword [0x141dbfdd8]
sub ecx, dword [0x141dbfddc]
imul ecx, ecx, 0x73b6de58
or ecx, 0x365d5129
imul rcx, rax
shr rcx, 0x3a
cmp ecx, 0xf821c215
ja 0x1400108d0
cmp qword [rsp + 0x30], 0
mov r14, qword [rsp + 0x28]
je 0x140010cb4
xor r15d, r15d
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13d, 0xa2f8f539
xor ebp, ebp
nop dword [rax + rax]
imul rax, rbp, 0x70
lea rsi, [r14 + rax]
cmp qword [r14 + rax], 0
je 0x1400109cd
mov eax, dword [0x141dbfde0]
imul eax, dword [0x141dbfde4]
add eax, 0x63cc3d2c
shr eax, 1
mov ecx, 0x87eab4a9
imul rax, rcx
shr rax, 0x3c
or eax, 0xff7a9fbb
cmp eax, 0x9475070b
je 0x140010933
mov rbx, qword [rsi + 8]
mov eax, dword [0x141dbfde8]
add eax, dword [0x141dbfdec]
mov ecx, 0xcc54a245
imul rax, rcx
shr rax, 0x3d
and eax, 0xfffffffd
cmp eax, 0xc076eb94
jne 0x1400109a0
mov rcx, qword [0x141dda6a0]
xor edx, edx
mov r8, rbx
call r12
nop word cs:[rax + rax]
mov r14d, dword [0x141dbfdf0]
or r14d, dword [0x141dbfdf4]
or r14d, 0xf7ecfcea
mov rcx, qword [0x141dda6a0]
xor edx, edx
mov r8, rbx
call r12
cmp r14d, 0x778aeac1
je 0x1400109a0
inc rbp
mov eax, dword [0x141dbfdf8]
xor edx, edx
div dword [0x141dbfdfc]
xor eax, 0x48280758
and eax, 0x49b9a7fc
xor eax, 0x21973051
cmp eax, 0xb6f001f4
ja 0x1400109d0
mov rax, qword [rsi + 0x18]
nop dword [rax + rax]
test r15b, r15b
jne 0x140010a00
test rax, rax
je 0x140010aa7
mov rbx, qword [rsi + 0x20]
mov r14, qword [0x141dda6a0]
mov eax, dword [0x141dbfe00]
or eax, dword [0x141dbfe04]
cmp eax, 0x93a7c17a
jne 0x140010a40
mov rcx, r14
xor edx, edx
mov r8, rbx
call r12
nop word [rax + rax]
mov edi, dword [0x141dbfe08]
sub edi, dword [0x141dbfe0c]
add edi, 0x4672e4f8
xor edi, 0x6418cc28
or edi, 0x8be723d6
mov rcx, r14
xor edx, edx
mov r8, rbx
call r12
cmp edi, 0xe1427ebf
ja 0x140010a40
nop word cs:[rax + rax]
mov eax, dword [0x141dbfe10]
or eax, dword [0x141dbfe14]
imul eax, eax, 0xd8d835b6
imul rax, r13
shr rax, 0x3f
imul eax, eax, 0xf9510592
cmp eax, 0x4c3898da
je 0x140010a80
mov eax, dword [0x141dbfe18]
xor edx, edx
div dword [0x141dbfe1c]
nop word cs:[rax + rax]
mov eax, dword [0x141dbfe20]
imul eax, dword [0x141dbfe24]
imul rax, rax, 0xa60873d
shr rax, 0x3a
or eax, 0x9f8e888c
cmp eax, 0x7700387c
jb 0x140010ac0
mov eax, dword [0x141dbfe28]
xor eax, dword [str._ae:D]
add eax, 0xe40d5179
xor eax, 0x40412010
and eax, 0x48d36a10
cmp eax, 0x64e2619c
ja 0x140010ae4
mov rax, qword [rsi + 0x48]
shl rax, 1
test rax, rax
je 0x140010b8b
mov rbx, qword [rsi + 0x50]
mov r14, qword [0x141dda6a0]
mov eax, dword [0x141dbfe30]
imul eax, dword [0x141dbfe34]
or eax, 0x46c1b67a
xor eax, 0x50262b47
imul rcx, rax, 0x7180a21f
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
cmp eax, 0x21c47ef8
jbe 0x140010b60
mov rcx, r14
xor edx, edx
mov r8, rbx
call r12
nop word [rax + rax]
mov edi, dword [0x141dbfe38]
add edi, dword [0x141dbfe3c]
or edi, 0x382cefe7
and edi, 0x3e2fefe7
mov rcx, r14
xor edx, edx
mov r8, rbx
call r12
cmp edi, 0x472a670
jb 0x140010b60
mov rax, qword [rsi + 0x30]
nop
mov ecx, dword [0x141dbfe40]
and ecx, dword [0x141dbfe44]
imul ecx, ecx, 0x2b9c9a68
cmp ecx, 0x9668aeee
je 0x140010b90
test rax, rax
mov r14, qword [rsp + 0x28]
je 0x140010c58
nop dword [rax + rax]
mov eax, dword [0x141dbfe48]
and eax, dword [0x141dbfe4c]
and eax, 0xeb9f7d2
imul eax, eax, 0x9128db9c
imul rax, rax, 0x163e07f3
shr rax, 0x38
cmp eax, 0xf783fe94
ja 0x140010bc0
mov rbx, qword [rsi + 0x38]
mov eax, dword [0x141dbfe50]
add eax, dword [0x141dbfe54]
and eax, 0x4e602410
cmp eax, 0x2e9ebe48
je 0x140010ca0
nop dword [rax]
mov esi, dword [0x141dbfe58]
and esi, dword [0x141dbfe5c]
add esi, 0x192cea45
or esi, 0xa93829a3
mov rcx, qword [0x141dda6a0]
xor edx, edx
mov r8, rbx
call r12
cmp esi, 0x2c49ea1d
je 0x140010ca0
nop
mov eax, dword [0x141dbfe60]
and eax, dword [0x141dbfe64]
or eax, 0xbfb77ffd
cmp eax, 0xfffcf919
je 0x140010c40
mov eax, dword [0x141dbfe68]
xor edx, edx
div dword [0x141dbfe6c]
mov eax, dword [0x141dbfe70]
sub eax, dword [0x141dbfe74]
add eax, 0x35129314
xor eax, 0xb380104
and eax, 0xff8c905
cmp eax, 0xff2568e1
je 0x140010c66
cmp rbp, qword [rsp + 0x30]
jne 0x140010920
jmp 0x140010cb4
mov rcx, qword [0x141dda6a0]
xor edx, edx
mov r8, rbx
call r12
jmp 0x140010c10
mov eax, dword [0x141dbfe78]
xor edx, edx
div dword [0x141dbfe7c]
mov rdi, qword [rsp + 0x38]
nop word [rax + rax]
mov eax, dword [0x141dbfe80]
imul eax, dword [0x141dbfe84]
xor eax, 0x28d744e
add eax, 0x50fc8978
or eax, 0x875dab3c
cmp eax, 0xa90f4246
jb 0x140010cd0
cmp qword [rdi], 0
je 0x140010dd0
mov eax, dword [0x141dbfe88]
imul eax, dword [0x141dbfe8c]
imul eax, eax, 0x9f5d43b0
or eax, 0x39a6668d
imul eax, eax, 0x8f957080
cmp eax, 0x6cd899f8
jne 0x140010d30
mov rax, qword [0x141dda6a0]
nop dword [rax]
mov eax, dword [0x141dbfe90]
imul eax, dword [0x141dbfe94]
imul rcx, rax, 0x22fbdc4d
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
add eax, 0xc101b0c1
xor eax, 0xcf861f70
mov rbx, qword [0x141dda6a0]
cmp eax, 0xe9fc9114
ja 0x140010d30
mov eax, dword [0x141dbfe98]
or eax, dword [0x141dbfe9c]
add eax, 0x12e5b23f
xor eax, 0xfa53a99b
cmp eax, 0x704288f1
ja 0x140010db8
mov eax, dword [0x141dbfea0]
xor edx, edx
div dword [0x141dbfea4]
mov ebp, eax
add ebp, 0x2645a89d
or ebp, 0xd7f1bff4
mov rcx, rbx
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebp, 0xbfaeb4d7
jae 0x140010dd0
mov rcx, rbx
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140010d86
mov eax, dword [0x141dbfea8]
xor edx, edx
div dword [0x141dbfeac]
add eax, 0x279be16e
and eax, 0x29144844
cmp eax, 0x6bce7096
ja 0x140010dd0
mov rsi, qword [rdi + 0x90]
nop word cs:[rax + rax]
mov eax, dword [0x141dbfeb0]
sub eax, dword [0x141dbfeb4]
add eax, 0x88871b81
xor eax, 0x207ee716
imul rax, rax, 0x30ef5195
shr rax, 0x3d
cmp eax, 0xaac99edd
ja 0x140010e00
test rsi, rsi
je 0x14001148b
mov rcx, qword [rdi + 0xa8]
nop dword [rax + rax]
mov eax, dword [0x141dbfeb8]
add eax, dword [0x141dbfebc]
imul eax, eax, 0x402cbf3c
add eax, 0xd3f1f554
cmp eax, 0x5dec6b9e
jb 0x140010e40
mov qword [rsp + 0x28], rcx
test rcx, rcx
je 0x140010ff0
lea rdi, [rsi + 0x10]
movdqa xmm0, xmmword [rsi]
pmovmskb r13d, xmm0
not r13d
mov rbx, qword [sym.imp.pdh.dll_PdhRemoveCounter]
mov r15, rsi
mov r12, qword [rsp + 0x28]
nop dword [rax + rax]
mov eax, dword [0x141dbfec0]
add eax, dword [0x141dbfec4]
or eax, 0x2342057
add eax, 0x88266918
cmp eax, 0x81b639cf
ja 0x140010e90
test r13w, r13w
je 0x140010f20
nop word cs:[rax + rax]
mov eax, dword [0x141dbfed0]
and eax, dword [0x141dbfed4]
xor eax, 0x18000002
and eax, 0x18000282
cmp eax, 0x7396978
ja 0x140010ec0
lea ebp, [r13 - 1]
and ebp, r13d
nop word cs:[rax + rax]
mov eax, dword [0x141dbfed8]
imul eax, dword [0x141dbfedc]
add eax, 0x4719bca1
shr eax, 1
imul rax, rax, 0x4fb11571
shr rax, 0x3d
or eax, 0x4ec13e20
cmp eax, 0x13c4b1bb
je 0x140010ef0
jmp 0x140010f64
movdqa xmm0, xmmword [rdi]
pmovmskb eax, xmm0
add r15, 0xfffffffffffffe00
add rdi, 0x10
cmp eax, 0xffff
je 0x140010f20
mov ecx, dword [str.CQ__t9]
and ecx, dword [0x141dbfecc]
add ecx, 0x129d6bca
mov ebp, 0xfffffffe
sub ebp, eax
mov r13d, eax
not r13d
and ebp, r13d
cmp ecx, 0x41c8fd57
jae 0x140010f3a
mov eax, dword [0x141dbfee8]
xor eax, dword [0x141dbfeec]
and eax, 0x497c0fac
imul eax, eax, 0xf065c360
cmp eax, 0x1f394d50
jae 0x140010fa0
tzcnt eax, r13d
shl rax, 5
mov rcx, r15
sub rcx, rax
mov rcx, qword [rcx - 8]
call rbx
nop word [rax + rax]
mov r14d, dword [0x141dbfef0]
sub r14d, dword [0x141dbfef4]
or r14d, 0x2d0f7e38
add r14d, 0x2d26b960
tzcnt eax, r13d
shl rax, 5
mov rcx, r15
sub rcx, rax
mov rcx, qword [rcx - 8]
call rbx
cmp r14d, 0xb56192
jb 0x140010fa0
mov r13d, ebp
dec r12
jne 0x140010e90
nop word cs:[rax + rax]
mov eax, dword [0x141dbfee0]
xor edx, edx
div dword [0x141dbfee4]
or eax, 0x580f48a3
add eax, 0x7efdf0c
imul rcx, rax, 0xba256c7
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
cmp eax, 0xa843819f
je 0x140010ff0
mov r14, qword [rsp + 0x38]
mov rdi, qword [r14 + 0xc8]
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400110da
mov eax, dword [0x141dbff00]
xor edx, edx
div dword [0x141dbff04]
add eax, 0x83a891fd
xor eax, 0x2cb2b7eb
add eax, 0x96351478
cmp eax, 0x11fe089e
jae 0x14001106a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word cs:[rax + rax]
mov eax, dword [0x141dbff08]
xor edx, edx
div dword [str.d_MkD]
mov ebx, eax
and ebx, 0x10300a30
add ebx, 0xfb8ffcac
mov rcx, rdi
call r15
cmp ebx, 0x6bf7480e
jb 0x140011080
test eax, eax
jne 0x1400110da
mov eax, dword [0x141dbff10]
and eax, dword [0x141dbff14]
and eax, 0x1375abc3
imul eax, eax, 0x94852f80
add eax, 0x366ce2c9
cmp eax, 0x95e4f7c3
jbe 0x1400114ca
jmp 0x1400114da
mov rbx, qword [rsp + 0x28]
nop
mov eax, dword [0x141dbfef8]
imul eax, dword [0x141dbfefc]
imul eax, eax, 0xb9e4234a
add eax, 0xf9869c7f
or eax, 0x4b53310a
cmp eax, 0x9238ba80
je 0x1400110e0
mov rcx, qword [r14 + 0xc0]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140011120
call qword [sym.imp.pdh.dll_PdhCloseQuery]
nop dword [rax + rax]
mov eax, dword [0x141dbff18]
mov ecx, dword [0x141dbff1c]
add eax, ecx
add eax, 0x4dfa690a
or eax, 0x2a18004a
and eax, 0xaedfd45a
cmp eax, 0xe4da84e5
je 0x140011120
mov rax, qword [r14 + 0x98]
test rax, rax
je 0x14001148b
mov qword [rsp + 0x30], rax
mov ecx, 0xbc9fc649
nop
mov eax, dword [0x141dbff20]
xor edx, edx
div dword [0x141dbff24]
xor eax, 0x7be5a7ca
imul rax, rcx
shr rax, 0x3f
or eax, 0x74286e7e
cmp eax, 0x9934fb59
je 0x140011160
test rbx, rbx
je 0x140011347
mov eax, dword [0x141dbff28]
sub eax, dword [0x141dbff2c]
add eax, 0xb4bfc041
and eax, 0x8b62130a
cmp eax, 0xc4fe100
je 0x140011190
movdqa xmm0, xmmword [rsi]
pmovmskb ebp, xmm0
not ebp
xor eax, eax
nop dword [rax]
test al, al
jne 0x1400111c0
lea r15, [rsi + 0x10]
mov r12d, 0xab6a35e7
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov eax, dword [0x141dbff30]
xor eax, dword [0x141dbff34]
and eax, 0xa983ca0
cmp eax, 0xa6337a6e
je 0x1400111e0
test bp, bp
jne 0x14001123f
nop dword [rax]
mov eax, dword [0x141dbff38]
imul eax, dword [0x141dbff3c]
add eax, 0xcbd479d7
xor eax, 0xa29018
and eax, 0x51f6b31c
cmp eax, 0xe9032a83
ja 0x140011200
add rsi, 0xfffffffffffffe00
movdqa xmm0, xmmword [r15]
add r15, 0x10
pmovmskb ebp, xmm0
cmp bp, 0xffff
je 0x140011200
not ebp
tzcnt eax, ebp
shl rax, 5
mov rcx, rsi
sub rcx, rax
cmp qword [rcx - 0x20], 0
je 0x1400112f4
mov eax, dword [0x141dbff40]
xor edx, edx
div dword [0x141dbff44]
mov eax, dword [0x141dbff48]
imul eax, dword [0x141dbff4c]
and eax, 0x308cc01
imul eax, eax, 0x4b55b527
cmp eax, 0xff04c6a7
ja 0x140011266
mov rdi, qword [rcx - 0x18]
mov eax, dword [0x141dbff50]
xor eax, dword [0x141dbff54]
or eax, 0x1cefedef
imul rax, rax, 0x30adb3d5
shr rax, 0x3b
and eax, 1
cmp eax, 0xc73662f6
ja 0x1400112e3
mov r14d, dword [0x141dbff58]
sub r14d, dword [0x141dbff5c]
xor r14d, 0x1ffc6c86
add r14d, 0xc46df2c3
mov rcx, qword [0x141dda6a0]
xor edx, edx
mov r8, rdi
call r13
cmp r14d, 0x963a3ab7
jbe 0x1400112f4
mov rcx, qword [0x141dda6a0]
xor edx, edx
mov r8, rdi
call r13
jmp 0x1400112af
lea eax, [rbp - 1]
and eax, ebp
dec rbx
mov ebp, eax
nop
mov eax, dword [0x141dbff60]
xor eax, dword [0x141dbff64]
xor eax, 0x29481156
imul rax, r12
shr rax, 0x3f
cmp eax, 0xd9c98474
ja 0x140011300
mov eax, dword [0x141dbff68]
xor eax, dword [0x141dbff6c]
and eax, 0xf8914309
imul eax, eax, 0xd4144ad1
cmp eax, 0x191cebea
je 0x140011320
test rbx, rbx
jne 0x1400111e0
mov r10, qword [rsp + 0x30]
mov rax, r10
shl rax, 5
lea rcx, [rax + 0x20]
add r10, 0x11
mov r9, qword [rsp + 0x38]
mov edx, dword [0x141dbff70]
xor edx, dword [0x141dbff74]
xor edx, 0x61b920
or edx, 0x839e44c8
imul rdx, rdx, 0x700b7fad
shr rdx, 0x3b
cmp edx, 0xcc6bdc77
ja 0x140011360
nop dword [rax + rax]
mov edx, dword [0x141dbff78]
mov r8d, dword [0x141dbff7c]
add edx, r8d
add edx, 0x16402e24
or edx, 0xf55fffef
cmp edx, 0xff3201ef
jb 0x140011390
add rcx, r10
je 0x14001148b
mov rsi, qword [r9 + 0x90]
mov rcx, 0xffffffffffffffe0
sub rcx, rax
mov eax, dword [0x141dbff80]
imul eax, dword [0x141dbff84]
add eax, 0x962cfe2b
and eax, 0x5952e8da
imul eax, eax, 0x9c3273cf
cmp eax, 0x4574a04b
jae 0x1400113f9
mov rax, qword [0x141dda6a0]
add rsi, rcx
nop dword [rax]
mov eax, dword [0x141dbff88]
xor edx, edx
div dword [0x141dbff8c]
and eax, 0xa46b69af
xor eax, 0xa6ce54db
mov rdi, qword [0x141dda6a0]
cmp eax, 0xfc9cec1e
ja 0x140011400
mov eax, dword [0x141dbff90]
sub eax, dword [0x141dbff94]
imul eax, eax, 0x8de1df88
or eax, 0xb1600564
and eax, 0xf9641f6c
cmp eax, 0x8a41ba23
jne 0x140011457
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov eax, dword [0x141dbff98]
imul eax, dword [0x141dbff9c]
imul ebp, eax, 0x213fcc6e
add ebp, 0xa6384fea
mov rcx, rdi
xor edx, edx
mov r8, rsi
call rbx
cmp ebp, 0xda7b6fca
ja 0x140011460
mov eax, 0xb7729c97
mov ecx, dword [0x141dbffa0]
imul ecx, dword [0x141dbffa4]
add ecx, 0xd74caf75
xor ecx, 0xf264e034
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0x3e6ef204
ja 0x140011490
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov al, 1
test al, al
jne 0x1400110da
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400114ca