Function at 0x1402decc0
Capabilities:
Encode data using xor
Encrypt data using speck

Disassembly:
mov rcx, qword [rcx + 8]
cmp byte [0x1407904a0], 0
jne 0x1402cf4b0
test byte [0x14079020a], 1
jne 0x1402cf4b0
mov rax, qword [rcx + 8]
test rax, rax
je 0x1402cf4b0
ret
mov rax, qword [rcx]
ret
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x288
mov qword [rsp + 0x40], r9
mov r15, r8
mov rbx, rdx
mov qword [rsp + 0x50], rcx
mov r13, qword [rsp + 0x308]
mov rdi, qword [rsp + 0x300]
mov ebp, dword [rsp + 0x2f8]
mov rax, qword [rsp + 0x2f0]
mov qword [rsp + 0x48], rax
mov eax, ebp
and eax, 0x3f
cmp eax, 0x14
jbe 0x1402ded4c
mov r12d, r13d
cmp eax, 0x1e
jbe 0x1402ded93
cmp eax, 0x23
jae 0x1402dee0f
cmp eax, 0x20
jbe 0x1402deec8
cmp eax, 0x22
jne 0x1402df063
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1402956d0
cmp eax, 0xa
setb sil
jae 0x1402dedc3
cmp eax, 5
jae 0x1402dee39
test eax, eax
je 0x1402df02a
cmp eax, 2
jbe 0x1402df046
cmp eax, 4
jne 0x1402df528
mov rcx, rbx
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1402cf480
cmp eax, 0x1a
jae 0x1402dee63
cmp eax, 0x17
jae 0x1402deef2
cmp eax, 0x15
jne 0x1402df06f
nop
mov rcx, qword [rsp + 0x40]
mov rdx, r15
call fcn.14059db48
mov edi, eax
jmp 0x1402e0521
cmp eax, 0xe
jbe 0x1402dee95
cmp eax, 0x12
jae 0x1402def1f
cmp eax, 0xf
je 0x1402df22a
cmp eax, 0x10
jne 0x1402e02e2
nop
cmp qword [0x1407911d8], 0
je 0x1402df679
nop
mov rcx, qword [rsp + 0x50]
mov rdx, r15
mov r8d, edi
call qword [0x1407911d8]
mov edi, eax
jmp 0x1402e0521
cmp eax, 0x25
jbe 0x1402def51
cmp eax, 0x27
ja 0x1402df087
cmp eax, 0x26
jne 0x1402df564
mov rcx, rbx
call fcn.14059cc7c
xor edi, edi
jmp 0x1402e0521
cmp eax, 7
jb 0x1402def83
je 0x1402df292
cmp eax, 9
jne 0x1402df419
nop
mov rcx, qword [rsp + 0x48]
call fcn.1402ee2e0
xor edi, edi
jmp 0x1402e0521
cmp eax, 0x1b
jbe 0x1402defc6
cmp eax, 0x1c
je 0x1402df2af
cmp eax, 0x1e
jne 0x1402df42d
nop
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
call fcn.14059cc10
xor edi, edi
jmp 0x1402e0521
cmp eax, 0xc
jae 0x1402df009
cmp eax, 0xa
jne 0x1402df0ab
nop
mov rcx, qword [rsp + 0x40]
mov rdx, r13
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14028cdc0
cmp eax, 0x1f
jne 0x1402df0c4
nop
mov rcx, qword [rsp + 0x40]
and cl, 1
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14059ca9c
je 0x1402df2d2
cmp eax, 0x19
jne 0x1402df440
mov rcx, r15
mov rdx, rdi
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1402944a0
cmp eax, 0x14
je 0x1402df34e
cmp eax, 0x12
jne 0x1402df489
mov rcx, r15
mov rdx, r13
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, 0x23
je 0x1402df39c
cmp eax, 0x24
jne 0x1402df4a7
mov rcx, rdi
mov rdx, qword [rsp + 0x48]
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.140295610
cmp eax, 5
jne 0x1402df141
nop
cmp qword [0x1407911f0], 0
jne 0x1402dfa18
nop
movzx eax, byte [0x14073ed69]
cmp al, 0x51
je 0x1402df9d3
mov cl, 0xef
mov al, 0x16
lock cmpxchg byte [0x14073ed69], cl
je 0x1402df9b3
cmp al, 0x51
jne 0x1402defad
jmp 0x1402df9d3
cmp eax, 0x1a
jne 0x1402df215
nop
cmp qword [0x1407911f8], 0
jne 0x1402dfbf1
nop
movzx eax, byte [0x14073ed97]
cmp al, 0x91
je 0x1402df122
mov cl, 0x65
mov al, 0xc8
lock cmpxchg byte [0x14073ed97], cl
je 0x1402df0e3
cmp al, 0x91
jne 0x1402deff0
jmp 0x1402df122
je 0x1402df3c6
cmp eax, 0xd
jne 0x1402df4c3
mov rcx, rdi
mov rdx, qword [rsp + 0x48]
call fcn.140295800
jmp 0x1402e0521
nop
mov r12, qword [rsp + 0x48]
test r12, r12
jle 0x1402e0419
lea r13, [rdi + 0x40]
lea r14, [rdi + 0x58]
jmp 0x1402e0394
cmp eax, 1
jne 0x1402df546
nop
cmp qword [0x140791200], 0
jne 0x1402e0171
jmp 0x1402df620
nop
mov edi, dword [0x14073fee8]
jmp 0x1402e0521
nop
mov rax, qword [rdi + 0x10]
mov rcx, rax
sub rcx, r13
jae 0x1402df57f
xor edi, edi
jmp 0x1402df921
cmp eax, 0x28
jne 0x1402df5c5
mov rcx, rdi
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1402cf4d0
nop
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14057b26c
nop
cmp qword [0x1407911e8], 0
jne 0x1402dff0e
nop
movzx eax, byte [0x14073ed39]
cmp al, 0x38
jne 0x1402df8c3
test bpl, bpl
js 0x1402dfa46
nop
movdqa xmm0, xmmword [0x14073ed90]
pxor xmm0, xmmword [0x1405f7340]
movd dword [0x14073ed90], xmm0
xor byte [0x14073ed94], 0xdb
xor byte [0x14073ed95], 0xe6
xor byte [0x14073ed96], 0x1f
mov al, 0x91
xchg byte [0x14073ed97], al
nop
movzx eax, byte [0x14073edaf]
cmp al, 0x75
jne 0x1402dfb21
test bpl, 0x40
je 0x1402e014b
jmp 0x1402dfbce
call fcn.1402d73e0
mov esi, eax
mov rax, qword [0x140791208]
mov r12, rax
shr r12, 0x20
or r12d, eax
mov rcx, qword [0x14073ffa8]
mov eax, dword [0x14073ff88]
add eax, esi
sub eax, r12d
add eax, 0xffff3d82
cdqe
add rax, rcx
mov ecx, 0xf2bc9256
call qword [0x140704440]
test al, al
je 0x1402df614
mov r13d, 0xc27e
sub r13d, esi
mov qword [rsp + 0x58], rsi
mov r14d, esi
add r14d, r12d
mov rcx, qword [0x14073ffd8]
mov eax, dword [0x14073ff80]
xor eax, r12d
sub eax, r13d
cdqe
add rax, rcx
call qword [0x140704440]
mov rsi, rax
mov rcx, qword [0x14073ffb8]
mov eax, dword [0x14073ff84]
or eax, r12d
sub eax, r13d
cdqe
add rax, rcx
mov rcx, rsi
mov edx, 0x33bc7d7d
call qword [0x140704440]
mov qword [rsp + 0x68], rax
mov rcx, qword [0x14073ffd0]
mov eax, dword [0x14073ff8c]
add eax, r14d
add eax, 0xffff3d82
cdqe
add rax, rcx
mov rcx, rsi
call qword [0x140704440]
mov qword [rsp + 0x60], rax
jmp 0x1402df746
nop
mov rcx, qword [rsp + 0x48]
mov rdx, r13
call fcn.1402f9690
xor edi, edi
jmp 0x1402e0521
nop
mov rax, qword [rbx]
mov dword [0x14073ff34], 0x2c43a39c
mov rax, qword [rax + 0x30]
mov rcx, rbx
mov rsi, rax
call qword [0x140704440]
cmp eax, 0xffffffff
je 0x1402df65f
test bpl, 0x40
je 0x1402e0419
nop
mov rax, qword [rbx + 0x50]
dec dword [rax]
lea rcx, [rbx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
lea r8, [rdx + 1]
mov qword [rax], r8
movzx eax, byte [rdx]
lea r14, [rsp + 0x70]
lea r13, [rsp + 0x80]
mov rbx, rcx
mov r12, r15
mov r8, rsi
jmp 0x1402e03a3
nop
cmp qword [0x1407911e0], 0
je 0x1402df690
nop
call qword [0x1407911e0]
xor edi, edi
jmp 0x1402e0521
nop
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14028d130
nop
mov rax, qword [rdi + 0x38]
mov rcx, qword [rax]
mov eax, 0xffffffff
test rcx, rcx
je 0x1402e0420
nop
mov rdx, qword [rdi + 0x18]
cmp rcx, qword [rdx]
jbe 0x1402e0420
cmp r12d, 0xffffffff
je 0x1402dfcc0
nop
cmp byte [rcx - 1], r13b
je 0x1402df312
nop
test byte [rdi + 0x70], 2
jne 0x1402e0420
nop
mov rax, qword [rdi + 0x50]
inc dword [rax]
mov rax, qword [rdi + 0x38]
dec qword [rax]
mov rax, qword [rdi + 0x38]
mov rax, qword [rax]
mov byte [rax], r13b
mov esi, r13d
lea r14, [rsp + 0x80]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x50], rax
xor r12d, r12d
jmp 0x1402e04c0
cmp r13, rbx
je 0x1402df6bb
nop
mov edi, dword [0x14073ff34]
mov r14, qword [rsp + 0x50]
add r14, 0x10
xor rdi, 0x5df8bc77
nop
nop
movzx r9d, byte [rbx]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 0x59f1e755
mov r8, r14
call fcn.1402decc0
mov byte [rbx], al
inc rbx
cmp rbx, r13
jne 0x1402df370
mov rdi, rbx
jmp 0x1402e0410
nop
mov qword [rsp + 0x28], r15
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x48]
mov rdx, rdi
mov r8, r13
mov r9, rbx
call fcn.14057fd94
mov edi, eax
jmp 0x1402e0521
nop
mov rdi, qword [0x1407911c8]
test rdi, rdi
jne 0x1402e0521
nop
mov dword [rsp + 0x28], 0xaeca82c3
call fcn.1402decc0
mov ecx, eax
and ecx, 0x3ff
cmp ecx, 4
jne 0x1402df912
shr eax, 0xa
and eax, 0x3f
lea ecx, [rax - 3]
cmp ecx, 2
ja 0x1402df8e5
mov eax, ecx
lea rcx, [0x1405f7000]
mov eax, dword [rcx + rax*4]
jmp 0x1402df8e5
add r13, 0x68
mov rcx, r13
mov rdx, rdi
call fcn.14028cdc0
jmp 0x1402e0419
nop
mov rcx, qword [rsp + 0x50]
call fcn.1402cfde0
movzx edi, al
jmp 0x1402e0521
nop
mov esi, dword [0x14073ff34]
mov rcx, qword [rsp + 0x40]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x1402df82e
mov ecx, 0x9a997f44
xor rcx, rsi
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x28], 0xdf8a3e52
mov r8, rax
call fcn.1402decc0
mov qword [rsp + 0x80], rax
jmp 0x1402df847
test r15, r15
jle 0x1402e0419
lea r14, [r13 + 0x38]
lea rax, [r13 + 0x50]
mov qword [rsp + 0x40], rax
mov r12, r15
jmp 0x1402e0436
cmp r15, rdi
je 0x1402df855
test ebp, 0x800
jne 0x1402df880
xor esi, esi
jmp 0x1402e0289
nop
mov r12d, dword [0x14073fee8]
mov rcx, qword [0x1407911c8]
test rcx, rcx
jne 0x1402e04f9
nop
mov dword [rsp + 0x28], 0xaeca82c3
call fcn.1402decc0
mov rsi, rax
and eax, 0x3ff
cmp eax, 4
jne 0x1402df969
shr esi, 0xa
and esi, 0x3f
lea eax, [rsi - 3]
cmp eax, 2
ja 0x1402dff1c
mov eax, eax
lea rcx, [0x1405f7000]
mov esi, dword [rcx + rax*4]
mov rax, r12
xor r12d, r12d
mov qword [rsp + 0x48], rax
jmp 0x1402e04ce
nop
cmp qword [0x1407911d0], 0
je 0x1402df85d
nop
call qword [0x1407911d0]
movzx edi, ax
jmp 0x1402e0521
nop
mov rcx, qword [rsp + 0x40]
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp 0x1402cf490
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0x10
movzx ecx, r15b
call fcn.140095800
movzx edi, al
jmp 0x1402e0521
nop
mov r9, qword [rsp + 0x48]
cmp rcx, r9
cmovb r9, rcx
mov rdx, qword [rsp + 0x40]
cmp rdx, r9
jne 0x1402df6c3
nop
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x1402df5a8
mov rdx, qword [rdi]
add rdx, r13
mov rcx, rbx
mov r8, qword [rsp + 0x40]
mov r9d, 0xf593919c
call fcn.1402e0540
xor eax, eax
jmp 0x1402df666
nop
mov edi, dword [r13 + 0x10]
or edi, dword [rsp + 0x48]
xor eax, eax
cmp qword [r13 + 0x48], 0
mov esi, dword [0x14073fee8]
sete al
shl eax, 2
and edi, 0x17
or edi, eax
mov dword [r13 + 0x10], edi
and edi, dword [r13 + 0x14]
je 0x1402df8f0
test r15b, 1
je 0x1402e02ef
test ebp, 0x100
jne 0x1402e0382
xor r12d, r12d
xor ecx, ecx
jmp 0x1402e04f9
test ebp, 0x200
jne 0x1402df733
mov r12d, r13d
nop
movzx eax, byte [0x14073edb7]
cmp al, 0x66
je 0x1402e0076
test ebp, 0x100
jne 0x1402df998
xor eax, eax
mov qword [rsp + 0x68], rax
mov r12, qword [rsp + 0x48]
mov eax, r15d
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
jmp 0x1402df746
mov eax, 0xffffffff
xor edi, edi
test ebp, 0x100
jne 0x1402e0420
xor esi, esi
jmp 0x1402e0410
nop
movzx eax, byte [0x14073ecd9]
cmp al, 0x43
jne 0x1402df8f7
xor esi, esi
jmp 0x1402dfc95
nop
movzx eax, byte [0x14073ed09]
cmp al, 0x8f
je 0x1402dff30
mov cl, 0x3b
mov al, pe_nt_image_headers64
lock cmpxchg byte [0x14073ed09], cl
je 0x1402dfe73
cmp al, 0x8f
jne 0x1402df6a2
jmp 0x1402dff30
mov rdi, rbx
jmp 0x1402e0521
mov r8, rax
sub r8, r9
sub r8, r13
inc r8
mov r10, rdx
sub r10, r9
jae 0x1402df932
mov r15, r8
add rax, rdx
mov r14, r9
sub rax, r9
mov qword [rdi + 0x10], rax
cmp qword [rdi + 0x18], 0x10
mov rsi, rdi
jb 0x1402df6f8
mov rsi, qword [rdi]
add rsi, r13
mov rcx, rbx
mov rdx, rsi
mov rbx, qword [rsp + 0x40]
mov r8, rbx
mov r9d, 0xf593919c
call fcn.1402e0540
mov rcx, r14
add rcx, rsi
add rsi, rbx
mov rdx, rsi
mov r8, r15
mov r9d, 0xf593919c
call fcn.1402e0540
jmp 0x1402e0521
xor eax, eax
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rsi
xor esi, esi
lea r13, [rsp + 0x80]
mov r8d, 0x200
mov rcx, r13
xor edx, edx
call fcn.1405c44a0
mov rcx, qword [0x14073ffc0]
mov eax, dword [0x14073ff9c]
or eax, r12d
mov r14d, 0xc27e
sub r14d, dword [rsp + 0x58]
sub eax, r14d
cdqe
add rax, rcx
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x40]
mov r8, r13
mov r9d, 0x200
call qword [0x140704440]
test eax, eax
je 0x1402df7d3
nop
mov rcx, qword [0x14073ffa0]
or r12d, dword [0x14073ff94]
sub r12d, r14d
movsxd rax, r12d
add rax, rcx
lea rdx, [rsp + 0x80]
mov rcx, r15
call qword [0x140704440]
mov edi, 1
jmp 0x1402e0521
mov rax, qword [rsp + 0x58]
test ebp, 0x400
je 0x1402dff24
mov rbx, rax
add eax, 0xffff3d82
mov rcx, qword [0x14073ffc0]
add eax, r12d
add eax, dword [0x14073ff9c]
cdqe
add rax, rcx
lea r8, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x40]
mov r9d, 0x200
call qword [0x140704440]
test eax, eax
jne 0x1402df7a0
xor esi, esi
jmp 0x1402dfc24
nop
mov qword [rsp + 0x80], 0
test ebp, 0x400
jne 0x1402e014b
nop
mov rdi, qword [rsp + 0x80]
jmp 0x1402e0521
mov rdi, r15
jmp 0x1402e0521
nop
movzx eax, byte [0x14073eca9]
cmp al, 0xae
jne 0x1402dfd2f
xor esi, esi
test ebp, 0x200
je 0x1402e0419
jmp 0x1402dfd6f
mov rax, qword [rsp + 0x48]
lea rsi, [rax + 0x10]
lea r14, [rsp + 0x80]
xor ebx, ebx
nop word cs:[rax + rax]
nop
movzx ecx, byte [r15]
mov rdx, rsi
call fcn.140095800
mov byte [r15], al
inc r15
cmp r15, rdi
jne 0x1402df8a0
xor r12d, r12d
mov r13, r14
jmp 0x1402e0405
mov cl, 0xb2
mov al, 0xa3
lock cmpxchg byte [0x14073ed39], cl
je 0x1402dfa26
cmp al, 0x38
jne 0x1402df8c5
xor eax, eax
test bpl, 0x40
je 0x1402dfa46
movzx ecx, ax
shl ecx, 0xa
or ecx, 4
jmp 0x1402df918
xor edi, edi
jmp 0x1402e0521
mov cl, 0x26
mov al, 0xbf
lock cmpxchg byte [0x14073ecd9], cl
je 0x1402dfc04
cmp al, 0x43
jne 0x1402df8f9
jmp 0x1402dfc95
or ecx, 0x800
mov edi, ecx
mov qword [0x1407911c8], rdi
test ebp, 0x200
jne 0x1402e0521
call fcn.1400c3f00
nop
mov rdx, qword [rdi + 0x18]
mov rcx, rdx
sub rcx, rax
cmp r10, rcx
jbe 0x1402dfe98
nop
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov rcx, rdi
mov rdx, r10
mov r8, r13
call fcn.1402d6ab0
jmp 0x1402e0521
lea r13, [rsp + 0x70]
lea r9, [rsp + 0x80]
xor r8d, r8d
mov r10, qword [rsp + 0x40]
test bpl, bpl
js 0x1402dfd96
mov rsi, r9
sub rsi, rbx
jbe 0x1402e01a0
jmp 0x1402e01a2
mov cl, 0x4a
mov al, 0xcd
lock cmpxchg byte [0x14073edb7], cl
je 0x1402e0040
cmp al, 0x66
jne 0x1402df99a
jmp 0x1402e0076
movabs rax, 0x82fc87c7499801f4
xor qword [0x14073ed60], rax
xor byte [0x14073ed68], 0x9f
mov al, 0x51
xchg byte [0x14073ed69], al
nop
movzx eax, byte [0x14073ed80]
cmp al, 0xfb
je 0x1402df9f5
mov cl, 0xf6
mov al, 0x42
lock cmpxchg byte [0x14073ed80], cl
je 0x1402dfa71
cmp al, 0xfb
jne 0x1402df9e1
nop
mov dword [rsp + 0x28], 0x27a7b3d8
lea r8, [0x14073ed70]
lea r9, [0x14073ed60]
call fcn.1402decc0
mov qword [0x1407911f0], rax
nop
call qword [0x1407911f0]
mov edi, eax
jmp 0x1402e0521
movabs rax, 0x3911fc3bbb640e94
xor qword [0x14073ed30], rax
xor byte [0x14073ed38], 0x5d
mov al, 0x38
xchg byte [0x14073ed39], al
nop
movzx eax, byte [0x14073ed52]
cmp al, 0x2e
je 0x1402dfeeb
mov cl, 0xe5
mov al, 0x64
lock cmpxchg byte [0x14073ed52], cl
je 0x1402dfcd5
cmp al, 0x2e
jne 0x1402dfa58
jmp 0x1402dfeeb
lea r10, [0x1405f72c0]
mov ecx, 0xda8444aa
lea r11, [r10 + rcx]
mov r8d, 0xda8444a8
xor esi, esi
movabs rdi, 0xcccccccccccccccd
lea r14, [0x14073ed70]
mov r15d, 0xda8444a9
mov rax, rcx
mul rdi
mov r9, rdx
mov rax, r8
mul rdi
shr rdx, 2
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*4]
mov rdx, r10
sub rdx, rax
add rdx, rsi
movzx eax, byte [rsi + r14]
xor al, byte [r15 + rdx]
xor al, 0xe5
test ebp, 0x100
mov byte [rsi + r14], al
je 0x1402dfb1e
shr r9, 2
and r9, 0xfffffffffffffffc
lea rax, [r9 + r9*4]
neg rax
movzx edx, byte [rsi + r14 + 1]
xor dl, byte [r11 + rax]
xor dl, 0xe5
mov byte [rsi + r14 + 1], dl
cmp rsi, 0xe
je 0x1402e02c9
add rsi, 2
add r11, 2
add rcx, 2
add r8, 2
test ebp, 0x100
jne 0x1402dfaa0
mov r12d, r13d
mov cl, 0xe
mov al, 0xcf
lock cmpxchg byte [0x14073edaf], cl
je 0x1402dfb38
cmp al, 0x75
jne 0x1402dfb23
jmp 0x1402dfbce
mov r8d, 0xac9e3334
mov r9d, 0xac9e3332
xor r10d, r10d
movabs r11, 0x4924924924924925
lea rsi, [0x1405f72e0]
add rsi, r9
lea rdi, [0x14073eda0]
mov rax, r8
shr rax, 1
mul r11
mov rcx, rdx
mov rax, r9
shr rax, 1
mul r11
shr rdx, 1
imul rax, rdx, 0xfffffffffffffff2
add rax, rsi
movzx edx, byte [r10 + rdi]
xor dl, byte [r10 + rax + 1]
xor dl, 0xe6
mov byte [r10 + rdi], dl
cmp r10, 0xe
je 0x1402dfbc6
shr rcx, 1
imul rax, rcx, 0xfffffffffffffff2
add rax, rsi
add rax, 2
movzx ecx, byte [r10 + rdi + 1]
xor cl, byte [rax + r10]
xor cl, 0xe6
mov byte [r10 + rdi + 1], cl
add r10, 2
add r8, 2
add r9, 2
jmp 0x1402dfb62
mov al, 0x75
xchg byte [0x14073edaf], al
nop
mov dword [rsp + 0x28], 0x27a7b3d8
lea r8, [0x14073eda0]
lea r9, [0x14073ed90]
call fcn.1402decc0
mov qword [0x1407911f8], rax
mov rcx, rbx
mov edx, r12d
call qword [0x1407911f8]
mov edi, eax
jmp 0x1402e0521
movabs rax, 0x88e012f61ad39370
xor qword [0x14073ecd0], rax
xor byte [0x14073ecd8], 0xe9
mov ebx, 9
mov r12d, r13d
test bpl, bpl
js 0x1402dfc8d
nop
mov rcx, qword [0x14073ffc8]
mov eax, dword [0x14073ff90]
mov edx, ebx
sub edx, r12d
add eax, edx
add eax, 0xffff3d82
cdqe
add rax, rcx
call qword [0x140704440]
mov rcx, qword [0x14073ffb0]
xor r12d, dword [0x14073ff98]
lea edx, [rbx + r12]
add edx, 0xffff3d82
movsxd r8, edx
add r8, rcx
mov rcx, r15
mov rdx, rax
mov rax, r8
call qword [0x140704440]
test bpl, 0x40
jne 0x1402dfd47
test sil, sil
jmp 0x1402e0419
mov al, 0x43
xchg byte [0x14073ecd9], al
nop
movzx eax, byte [0x14073ecf3]
cmp al, 0xa5
je 0x1402e0289
mov cl, 0xa4
mov al, 0xb6
lock cmpxchg byte [0x14073ecf3], cl
je 0x1402e01fd
cmp al, 0xa5
jne 0x1402dfca7
jmp 0x1402e0289
nop
mov rax, qword [rdi + 0x50]
inc dword [rax]
mov rax, qword [rdi + 0x38]
dec qword [rax]
xor eax, eax
jmp 0x1402e0420
mov eax, 0x7606524e
mov ecx, 0x89f9adc3
xor edx, edx
lea r8, [0x14073ed40]
lea r9, [0x1405f72a0]
mov r10d, ecx
imul r10, r10, 0x38e38e39
shr r10, 0x22
lea r10d, [r10 + r10*8]
lea r10d, [rax + r10*2]
movzx r11d, byte [rdx + r8]
xor r11b, byte [r10 + r9]
xor r11b, 0xdc
mov byte [rdx + r8], r11b
cmp rdx, 0x11
je 0x1402dfee3
inc rdx
dec eax
inc ecx
test ebp, 0x100
jne 0x1402dfcef
mov cl, 2
mov al, 0x8f
lock cmpxchg byte [0x14073eca9], cl
je 0x1402dfd45
cmp al, 0xae
jne 0x1402dfd31
xor esi, esi
jmp 0x1402dfd6f
xor esi, esi
nop
movq xmm0, qword [0x14073eca0]
paddb xmm0, xmmword [0x1405f7330]
movq qword [0x14073eca0], xmm0
add byte [0x14073eca8], 0xac
mov al, 0xae
xchg byte [0x14073eca9], al
nop
movzx eax, byte [0x14073ecc9]
cmp al, 0x97
je 0x1402dfe3d
mov cl, 0xff
mov al, 0x3a
lock cmpxchg byte [0x14073ecc9], cl
je 0x1402dfda0
cmp al, 0x97
jne 0x1402dfd81
jmp 0x1402dfe3d
or eax, 0x800
jmp 0x1402e04f0
mov r8d, 0x15f0d0e
mov r9d, 0x15f0d0c
xor r10d, r10d
movabs r11, 0x4924924924924925
lea rdi, [0x1405f7250]
lea rbx, [0x14073ecb0]
mov rax, r8
shr rax, 2
mul r11
mov rcx, rdx
mov rax, r9
shr rax, 2
mul r11
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
add rax, rdi
add rax, 0x15f0cf4
movzx edx, byte [r10 + rbx]
xor dl, byte [r10 + rax + 0x19]
xor dl, 0x35
mov byte [r10 + rbx], dl
cmp r10, 0x18
je 0x1402dfe35
shr rcx, 1
imul rax, rcx, 0xffffffffffffffe4
add rax, rdi
add rax, 0x15f0d0e
movzx ecx, byte [r10 + rbx + 1]
xor cl, byte [rax + r10]
xor cl, 0x35
mov byte [r10 + rbx + 1], cl
add r10, 2
add r8, 2
add r9, 2
jmp 0x1402dfdc7
mov al, 0x97
xchg byte [0x14073ecc9], al
nop
mov dword [rsp + 0x28], 0x27a7b3d8
lea r8, [0x14073ecb0]
lea r9, [0x14073eca0]
call fcn.1402decc0
mov qword [0x1407911d0], rax
call rax
test sil, sil
jne 0x1402e0419
movzx edi, ax
jmp 0x1402e0521
movabs rax, 0x9b41d33f9da982fa
xor qword [0x14073ed00], rax
xor byte [0x14073ed08], 5
mov al, 0x8f
xchg byte [0x14073ed09], al
jmp 0x1402dff30
test ebp, 0x400
jne 0x1402dfee3
lea rcx, [r10 + rax]
mov qword [rdi + 0x10], rcx
mov rcx, rdi
cmp rdx, 0x10
jb 0x1402dfeb4
mov rcx, qword [rdi]
add r13, rcx
add r9, r13
mov rsi, qword [rsp + 0x40]
lea rdx, [rbx + rsi]
cmp rdx, r13
jbe 0x1402e01a2
add rcx, rax
cmp rcx, rbx
nop
mov rax, qword [rsp + 0x50]
jae 0x1402df97e
jmp 0x1402e01a2
mov al, 0x2e
xchg byte [0x14073ed52], al
nop
mov dword [rsp + 0x28], 0x27a7b3d8
lea r8, [0x14073ed40]
lea r9, [0x14073ed30]
call fcn.1402decc0
mov qword [0x1407911e8], rax
nop
call qword [0x1407911e8]
xor edi, edi
jmp 0x1402e0521
mov eax, r12d
mov qword [rsp + 0x40], rax
test ebp, 0x200
je 0x1402e04de
nop
movzx eax, byte [0x14073ed21]
cmp al, 0x51
je 0x1402e0014
mov cl, 0xd7
mov al, 0xf5
lock cmpxchg byte [0x14073ed21], cl
je 0x1402dff59
cmp al, 0x51
jne 0x1402dff42
xor esi, esi
jmp 0x1402e01fd
mov eax, 0x6ffcaced
mov ecx, 0x90035325
mov edx, 0x6ffcacee
mov r8d, 0x90035324
xor r9d, r9d
mov r10d, 0xaf286bcb
lea r11, [0x14073ed10]
lea rsi, [0x1405f7280]
mov ebx, r8d
imul rbx, r10
shr rbx, 0x20
mov r14d, r8d
sub r14d, ebx
shr r14d, 1
add r14d, ebx
shr r14d, 4
lea ebx, [r14 + r14*8]
lea ebx, [r14 + rbx*2]
add ebx, edx
movzx ebx, byte [rbx + rsi]
xor bl, 0xf2
add byte [r9 + r11], bl
cmp r9, 0x10
je 0x1402e0000
mov ebx, ecx
imul rbx, r10
shr rbx, 0x20
mov r14d, ecx
sub r14d, ebx
shr r14d, 1
add r14d, ebx
shr r14d, 4
lea ebx, [r14 + r14*8]
lea ebx, [r14 + rbx*2]
add ebx, eax
mov ebx, ebx
movzx ebx, byte [rbx + rsi]
xor bl, 0xf2
add byte [r9 + r11 + 1], bl
add r9, 2
add eax, 0xfffffffe
add ecx, 2
add edx, 0xfffffffe
add r8d, 2
jmp 0x1402dff85
test ebp, 0x100
jne 0x1402e0191
mov al, 0x51
xchg byte [0x14073ed21], al
nop
mov dword [rsp + 0x28], 0x27a7b3d8
lea r8, [0x14073ed10]
lea r9, [0x14073ed00]
call fcn.1402decc0
mov qword [0x1407911e0], rax
call rax
xor edi, edi
jmp 0x1402e0521
nop
movdqa xmm0, xmmword [0x14073edb0]
pxor xmm0, xmmword [0x1405f7320]
movd dword [0x14073edb0], xmm0
xor byte [0x14073edb4], 0x2e
xor byte [0x14073edb5], 0xaa
xor byte [0x14073edb6], 0xaf
mov al, 0x66
xchg byte [0x14073edb7], al
nop
movzx eax, byte [0x14073edcc]
cmp al, 0xe0
je 0x1402e014b
mov cl, 0xaa
mov al, 0xa
lock cmpxchg byte [0x14073edcc], cl
je 0x1402e009d
cmp al, 0xe0
jne 0x1402e0088
jmp 0x1402e014b
mov eax, 0xe1efeb0b
mov ecx, 0x1e101503
mov edx, 1
mov r8d, 0xe1efeb0c
mov r9d, 0x1e101502
mov r10d, 0x88888889
lea r11, [0x14073edc0]
lea rsi, [0x1405f72f0]
mov edi, ecx
imul rdi, r10
shr rdi, 0x23
lea edi, [rdi + rdi*4]
lea edi, [rdi + rdi*2]
add edi, eax
mov ebx, r9d
imul rbx, r10
shr rbx, 0x23
lea ebx, [rbx + rbx*4]
lea ebx, [rbx + rbx*2]
add ebx, r8d
movzx r14d, byte [rdx + r11 - 1]
movzx r15d, byte [rdx + r11]
xor r14b, byte [rbx + rsi]
xor r14b, 0x5e
mov byte [rdx + r11 - 1], r14b
xor r15b, byte [rdi + rsi]
xor r15b, 0x5e
mov byte [rdx + r11], r15b
add eax, 0xfffffffe
add ecx, 2
add rdx, 2
add r8d, 0xfffffffe
add r9d, 2
cmp rdx, 0xd
jne 0x1402e00cc
test bpl, bpl
jns 0x1402df2a1
mov al, pe_nt_image_headers64
xchg byte [0x14073edcc], al
test ebp, 0x400
je 0x1402df847
nop
mov dword [rsp + 0x28], 0x27a7b3d8
lea r8, [0x14073edc0]
lea r9, [0x14073edb0]
call fcn.1402decc0
mov qword [0x140791200], rax
mov r13d, r12d
nop
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov r9d, r13d
call qword [0x140791200]
mov edi, eax
jmp 0x1402e0521
lea rsi, [0x14073ed20]
xor r15d, r15d
jmp 0x1402df889
xor esi, esi
nop
mov r14, qword [rsp + 0x40]
lea rdx, [r14 + r13]
mov rcx, r9
mov r9d, 0xf593919c
mov r12, r10
call fcn.1402e0540
mov rcx, rbx
mov rdx, r13
mov r8, rsi
mov r9d, 0xf593919c
call fcn.1402e0540
sub r14, rsi
add r12, rbx
add r12, rsi
add r13, rsi
mov rcx, r12
mov rdx, r14
mov r8, r13
mov r9d, 0x88982c99
call fcn.1402e0540
xor esi, esi
test bpl, 0x40
je 0x1402e0410
test ebp, 0x400
jne 0x1402e0254
xor eax, eax
lea rcx, [0x14073ece0]
lea rdx, [0x1405f7270]
lea r8d, [rax - 1]
and r8d, 0xf
movzx r9d, byte [rax + rcx]
xor r9b, byte [r8 + rdx]
xor r9b, 0x6c
mov byte [rax + rcx], r9b
cmp rax, 0x12
je 0x1402e0281
mov r8d, eax
and r8d, 0xe
movzx r9d, byte [rax + rcx + 1]
xor r9b, byte [r8 + rdx]
xor r9b, 0x6c
mov byte [rax + rcx + 1], r9b
add rax, 2
jmp 0x1402e0215
nop
mov dword [rsp + 0x28], 0x27a7b3d8
lea r8, [0x14073ed10]
lea r9, [0x14073ed00]
call fcn.1402decc0
mov qword [0x1407911e0], rax
call rax
test sil, sil
jmp 0x1402e0419
mov al, 0xa5
xchg byte [0x14073ecf3], al
nop
mov dword [rsp + 0x28], 0x27a7b3d8
lea r8, [0x14073ece0]
lea r9, [0x14073ecd0]
call fcn.1402decc0
mov qword [0x1407911d8], rax
mov rcx, qword [rsp + 0x50]
mov rdx, r15
mov r8d, edi
call rax
test sil, sil
jne 0x1402e0419
mov edi, eax
jmp 0x1402e0521
test bpl, bpl
js 0x1402e02db
mov al, 0xfb
xchg byte [0x14073ed80], al
jmp 0x1402df9f5
xor esi, esi
jmp 0x1402dfd67
mov rcx, rbx
mov rdx, qword [rsp + 0x50]
call fcn.1405c502c
mov ecx, esi
xor ecx, 0xecd1a519
call fcn.1402d73a0
mov ecx, esi
xor ecx, 0x5a1fd900
call fcn.1402d73b0
test dil, 2
lea rax, [0x14073ebb0]
lea rbx, [0x14073eb90]
cmove rbx, rax
xor rsi, 0x4f244a4e
mov r8, rsi
mov r9d, 0xe1b5258e
call fcn.1402e0540
test dil, 4
lea rsi, [0x14073eb70]
cmove rsi, rbx
lea rdi, [rsp + 0x70]
mov rcx, rdi
mov edx, 1
call fcn.14008c180
lea rbx, [rsp + 0x80]
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.140096540
mov dword [rsp + 0x28], 0x912c0811
lea rcx, [0x140647838]
mov rdx, rbx
call fcn.1402decc0
nop
mov dword [rsp + 0x28], 0x17af111
xor ecx, ecx
xor edx, edx
call fcn.1402decc0
nop
mov rax, qword [r13]
mov r8, qword [rax]
xor eax, eax
test r8, r8
je 0x1402e03de
test bpl, bpl
js 0x1402e0420
nop
mov rax, qword [r14]
mov esi, dword [rax]
test esi, esi
jle 0x1402e03de
cmp r12, rsi
cmovb rsi, r12
mov rcx, rbx
mov rdx, rsi
mov r9d, 0x88982c99
call fcn.1402e0540
add rbx, rsi
sub r12, rsi
mov rax, qword [r14]
sub dword [rax], esi
mov rax, qword [r13]
add qword [rax], rsi
jmp 0x1402e03fd
nop
movzx edx, byte [rbx]
mov rax, qword [rdi]
mov rax, qword [rax + 0x18]
mov rcx, rdi
call qword [0x140704440]
cmp eax, 0xffffffff
je 0x1402e0428
inc rbx
dec r12
xor r15d, r15d
test r12, r12
jle 0x1402e0428
test bpl, 0x40
jne 0x1402e0394
xor esi, esi
mov rdi, r15
test sil, sil
je 0x1402e0521
xor edi, edi
jmp 0x1402e0521
mov rdi, rax
jmp 0x1402e0521
nop
mov rdi, qword [rsp + 0x48]
sub rdi, r12
jmp 0x1402e0521
nop
mov rax, qword [r14]
mov rcx, qword [rax]
test rcx, rcx
je 0x1402e048b
nop
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov esi, dword [rax]
test esi, esi
jle 0x1402e048b
cmp r12, rsi
cmovb rsi, r12
mov rdx, rsi
mov rdi, qword [rsp + 0x50]
mov r8, rdi
mov r9d, 0x88982c99
call fcn.1402e0540
add rdi, rsi
mov qword [rsp + 0x50], rdi
sub r12, rsi
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
sub dword [rax], esi
mov rax, qword [r14]
add qword [rax], rsi
jmp 0x1402e04b9
nop
mov rax, qword [r13]
mov rax, qword [rax + 0x38]
mov rcx, r13
call qword [0x140704440]
cmp eax, 0xffffffff
je 0x1402e0538
nop
mov rcx, qword [rsp + 0x50]
mov byte [rcx], al
inc rcx
mov qword [rsp + 0x50], rcx
dec r12
xor esi, esi
test r12, r12
jle 0x1402e04ce
mov rdi, rsi
test bpl, bpl
js 0x1402e0436
jmp 0x1402e0521
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
test bpl, 0x40
jne 0x1402e0538
movzx eax, si
shl eax, 0xa
or eax, 4
nop
mov rcx, qword [rsp + 0x40]
mov r12d, ecx
mov ecx, eax
mov qword [0x1407911c8], rcx
xor r12d, 0x2eb762c9
mov edx, r12d
call fcn.1402d48f0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xf784f524
call fcn.1402decc0
xor edi, edi
mov rax, rdi
add rsp, 0x288
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
sub r15, r12
mov rdi, r15
jmp 0x1402e0521