Function at 0x1a6ac
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc18
mov rax, qword [0x00017100]
xor rax, rsp
mov qword [rsp + 0xc00], rax
mov rbp, rcx
mov qword [rsp + 0x218], rcx
mov rbx, r8
lea rcx, [rsp + 0x310]
mov r14, r9
mov qword [rsp + 0x148], r9
mov qword [rsp + 0x150], rbx
mov r12, rdx
mov qword [rsp + 0x160], rdx
call fcn.00013e90
xor edx, edx
movabs rdi, 0xfffff78000000320
mov rdi, qword [rdi]
lea r8d, [rdx + 0x32]
lea rcx, [rsp + 0x1b0]
call fcn.000163a0
movzx ecx, byte [r12]
xor r10d, r10d
mov edx, 0x8b
mov byte [rsp + 0x1b0], 1
mov esi, r10d
cmp ecx, edx
mov r13b, r10b
lea r15d, [rdx + 0x74]
jg 0x1ab2c
je 0x1aad4
sub ecx, 0x1d
je 0x1aa67
sub ecx, 1
je 0x1a9b0
sub ecx, 0x62
je 0x1a945
sub ecx, 1
je 0x1a8ca
sub ecx, 1
je 0x1a85e
sub ecx, 1
je 0x1a7cf
cmp ecx, 1
jne 0x1ab6a
cmp byte [rbp + 2], r10b
je 0x1bc17
mov byte [rsp + 0x1b0], r10b
lea ecx, [r10 + 7]
lea rdx, [rsp + 0x1b2]
mov al, byte [rcx + rbp + 0x446]
dec rcx
mov byte [rdx], al
inc rdx
cmp rcx, r10
jge 0x1a7b1
mov esi, 8
jmp 0x1bc14
lea rbx, [r12 + 1]
mov r8, rbp
mov edx, 4
mov rcx, rbx
call fcn.0001a4e8
xor r10d, r10d
cmp byte [rbp + 2], r10b
je 0x1bc17
movzx r8d, word [rbx]
mov rcx, rbp
call fcn.0001a554
mov ecx, r8d
add ecx, ecx
cmp ecx, eax
jge 0x1bc17
movzx eax, word [r12 + 3]
mov rcx, rbp
mov byte [rsp + 0x1b0], r10b
mov word [rbp + r8*2 + 0x49e], ax
mov r13b, r10b
call fcn.0001a554
lea rdx, [rbp + 0x49e]
lea rcx, [0x0001f810]
mov r8d, eax
mov r9, rbp
call fcn.0001a590
xor r10d, r10d
cmp eax, r10d
jne 0x1bc17
mov byte [rsp + 0x1b0], r10b
jmp 0x1bc17
lea rbx, [r12 + 1]
mov r8, rbp
mov edx, 2
mov rcx, rbx
call fcn.0001a4e8
xor r10d, r10d
cmp byte [rbp + 2], r10b
je 0x1bc17
movzx r8d, word [rbx]
mov rcx, rbp
call fcn.0001a554
mov ecx, r8d
add ecx, ecx
cmp ecx, eax
jge 0x1bc17
mov eax, dword [rbp + r8*2 + 0x49e]
lea rdx, [rsp + 0x1b2]
mov byte [rsp + 0x1b0], r10b
mov dword [rdx], eax
movzx eax, word [rbp + r8*2 + 0x4a2]
mov word [rdx + 4], ax
mov esi, 6
jmp 0x1bc14
lea rbx, [r12 + 1]
mov r8, rbp
mov edx, 4
mov rcx, rbx
call fcn.0001a4e8
mov r11d, dword [rbp + 0x434]
cmp dword [rbx], r11d
jne 0x1bc17
cmp byte [rbp + 1], 1
jne 0x1bc17
xor eax, eax
mov rcx, rbp
mov byte [rsp + 0x1b0], al
call fcn.0001a554
mov rcx, rbp
mov byte [rsp + 0x1b2], al
call fcn.0001a554
mov r13b, 1
sar eax, 8
mov byte [rbp + 2], r13b
mov dword [0x00017268], r11d
mov byte [rsp + 0x1b3], al
mov eax, 0x10
lea esi, [rax - 0xd]
mov byte [rsp + 0x1b4], al
jmp 0x1bc17
movzx eax, word [r12 + 1]
mov edx, 0xa
mov byte [rsp + 0x1b0], r10b
mov word [rbp + 4], ax
mov eax, 0xa0cb
mov byte [rbp + 3], bpl
mov word [rbp + 6], ax
movzx eax, byte [rbp + 0x432]
mov byte [rbp + 1], 1
cmp al, 5
mov byte [rsp + 0x1b2], 2
mov byte [rsp + 0x1b4], r10b
cmova edx, eax
movzx eax, bp
mov byte [rsp + 0x1b5], bpl
shr ax, 8
mov byte [rsp + 0x1b3], dl
mov esi, 5
mov byte [rsp + 0x1b6], al
jmp 0x1bc14
cmp byte [rbp + 2], r10b
je 0x1bc17
mov eax, dword [rbx]
lea rcx, [r12 + 1]
mov r8, rbp
mov edx, 4
mov dword [rbp + 0x14ba], eax
call fcn.0001a4e8
mov edx, dword [rbp + 0x14ba]
mov rcx, r14
call fcn.0001a4e8
mov r8d, 3
cmp word [r12 + 1], r8w
lea ecx, [r8 + 4]
seta al
mov byte [rbp + 0x14be], al
cmp word [r12 + 1], cx
jae 0x1aa0b
movzx r8d, byte [r12 + 1]
jmp 0x1aa11
mov r8d, 8
mov byte [rbp + 0x14bf], r8b
mov r12d, 0x30
lea rcx, [rbp + 0x14c0]
mov r8, r12
xor edx, edx
call fcn.000163a0
movsxd r11, dword [rbp + 0x14ba]
cmp r11d, r12d
jae 0x1aa3e
mov r12, r11
lea rcx, [rbp + 0x14c0]
mov r8, r12
mov rdx, r14
call fcn.00015fc0
cmp byte [rbp + 0x438], 0x69
je 0x1bccc
call fcn.00013fb8
jmp 0x1bccc
cmp byte [rbp + 2], r10b
je 0x1bc17
lea rcx, [r12 + 1]
mov r8, rbp
mov edx, 4
call fcn.0001a4e8
movzx edi, byte [r12 + 4]
movzx r11d, word [r12 + 1]
movzx eax, r11b
mov r8, rdi
mov rdx, r14
lea rbx, [rax + rbp + 0x45e]
mov dword [0x00017264], eax
mov dword [0x00017260], edi
mov rcx, rbx
call fcn.00015fc0
mov r8, rbp
mov edx, edi
mov rcx, rbx
call fcn.0001a4e8
mov r8, qword [rsp + 0x150]
xor eax, eax
mov dword [r8], eax
jmp 0x1bccc
lea rbx, [r12 + 1]
mov r8, rbp
mov edx, 2
mov rcx, rbx
call fcn.0001a4e8
xor r10d, r10d
cmp byte [rbp + 2], r10b
je 0x1bc17
lea ecx, [r10 + 7]
cmp word [rbx], cx
ja 0x1bc17
movzx ecx, word [rbx]
lea rdx, [rsp + 0x1b2]
mov byte [rsp + 0x1b0], r10b
mov eax, dword [rbp + rcx*2 + 0x44e]
mov dword [rdx], eax
movzx eax, word [rbp + rcx*2 + 0x452]
jmp 0x1a8bc
sub ecx, 0x98
je 0x1bbcc
sub ecx, 4
je 0x1ba9c
sub ecx, 1
je 0x1b944
sub ecx, 1
je 0x1b248
sub ecx, 2
je 0x1bccc
sub ecx, 1
je 0x1af7c
cmp ecx, 1
je 0x1ab89
movzx eax, byte [rsp + 0x1b0]
cmp byte [rbp + 2], r10b
mov dword [rbx], r10d
cmovne eax, r10d
mov byte [rsp + 0x1b0], al
jmp 0x1bc17
cmp word [r12 + 1], r10w
jne 0x1bccc
mov edi, 0x7c1
cmp dword [rbx], edi
jne 0x1bccc
mov r9d, r15d
mov r8d, 8
mov byte [rsp + 0x25b], dl
mov byte [rsp + 0x24d], r8b
mov r8d, 3
mov byte [rsp + 0x231], 0xc0
lea ecx, [r8 + 4]
mov byte [rsp + 0x230], r9b
mov byte [rsp + 0x232], r10b
lea eax, [rcx - 1]
lea edx, [rcx + 3]
mov byte [rsp + 0x233], r10b
mov byte [rsp + 0x234], r10b
mov byte [rsp + 0x235], 4
mov byte [rsp + 0x236], 4
mov byte [rsp + 0x25d], al
mov byte [rsp + 0x263], dl
mov byte [rsp + 0x26b], al
mov byte [rsp + 0x277], al
mov byte [rsp + 0x237], r10b
mov byte [rsp + 0x238], r9b
mov byte [rsp + 0x239], 0xc1
mov byte [rsp + 0x23a], r10b
mov byte [rsp + 0x23b], 4
mov byte [rsp + 0x23c], r10b
mov byte [rsp + 0x23d], 1
mov byte [rsp + 0x23e], r10b
mov byte [rsp + 0x23f], 1
mov byte [rsp + 0x240], r9b
mov byte [rsp + 0x241], 0xc2
mov byte [rsp + 0x242], r10b
mov byte [rsp + 0x243], 5
mov byte [rsp + 0x244], r10b
mov byte [rsp + 0x245], 0xfd
mov byte [rsp + 0x246], r10b
mov byte [rsp + 0x247], 2
mov byte [rsp + 0x248], r9b
mov byte [rsp + 0x249], 0xc8
mov byte [rsp + 0x24a], 1
mov byte [rsp + 0x24b], 2
mov byte [rsp + 0x24c], r10b
mov byte [rsp + 0x24e], 4
mov byte [rsp + 0x24f], r8b
mov byte [rsp + 0x250], r9b
mov byte [rsp + 0x251], 0xc9
mov byte [rsp + 0x252], 2
mov byte [rsp + 0x253], 0x89
mov byte [rsp + 0x254], r10b
mov byte [rsp + 0x255], 2
mov byte [rsp + 0x256], r10b
mov byte [rsp + 0x257], cl
mov byte [rsp + 0x258], r9b
mov byte [rsp + 0x259], 0xcc
mov byte [rsp + 0x25a], 2
mov byte [rsp + 0x25c], r10b
mov byte [rsp + 0x25e], 4
mov byte [rsp + 0x25f], 0xd
mov byte [rsp + 0x260], r9b
mov byte [rsp + 0x261], 0xf4
mov byte [rsp + 0x262], 1
mov byte [rsp + 0x264], r10b
mov byte [rsp + 0x265], 0xfc
mov byte [rsp + 0x266], r10b
mov byte [rsp + 0x267], 4
mov byte [rsp + 0x268], r9b
mov byte [rsp + 0x269], 0xf5
mov byte [rsp + 0x26a], 2
mov byte [rsp + 0x26c], r10b
mov byte [rsp + 0x26d], 0x80
mov byte [rsp + 0x26e], r10b
mov byte [rsp + 0x26f], 5
mov byte [rsp + 0x270], r9b
mov byte [rsp + 0x271], 0xca
mov byte [rsp + 0x272], 2
mov byte [rsp + 0x273], 0x86
mov byte [rsp + 0x274], r10b
mov byte [rsp + 0x275], r8b
mov byte [rsp + 0x276], r10b
mov byte [rsp + 0x278], r9b
mov byte [rsp + 0x279], 0xcd
mov byte [rsp + 0x27a], 2
mov byte [rsp + 0x28d], r8b
mov byte [rsp + 0x295], r8b
mov byte [rsp + 0x29d], r8b
lea rcx, [rsp + 0x430]
mov r8, rdi
mov edx, r15d
mov byte [rsp + 0x27b], 0x91
mov byte [rsp + 0x27c], r10b
mov byte [rsp + 0x27d], 1
mov byte [rsp + 0x27e], r10b
mov byte [rsp + 0x27f], 9
mov byte [rsp + 0x280], r9b
mov byte [rsp + 0x281], 0xcb
mov byte [rsp + 0x282], 2
mov byte [rsp + 0x283], 0x92
mov byte [rsp + 0x284], r10b
mov byte [rsp + 0x285], 1
mov byte [rsp + 0x286], r10b
mov byte [rsp + 0x287], 0xb
mov byte [rsp + 0x288], r10b
mov byte [rsp + 0x289], 0xc8
mov byte [rsp + 0x28a], 2
mov byte [rsp + 0x28b], 0x93
mov byte [rsp + 0x28c], r10b
mov byte [rsp + 0x28e], r10b
mov byte [rsp + 0x28f], 0xc
mov byte [rsp + 0x290], r10b
mov byte [rsp + 0x291], 0xcc
mov byte [rsp + 0x292], 2
mov byte [rsp + 0x293], 0x96
mov byte [rsp + 0x294], r10b
mov byte [rsp + 0x296], r10b
mov byte [rsp + 0x297], 0xc
mov byte [rsp + 0x298], 1
mov byte [rsp + 0x299], 0x2b
mov byte [rsp + 0x29a], 2
mov byte [rsp + 0x29b], 0x99
mov byte [rsp + 0x29c], r10b
mov byte [rsp + 0x29e], r10b
mov byte [rsp + 0x29f], 0xc
call fcn.000163a0
lea rcx, [rsp + 0x430]
lea rdx, [rsp + 0x230]
mov r8d, 0x70
call fcn.00015fc0
xor eax, eax
lea rdx, [rsp + 0x430]
mov byte [rsp + 0xbf0], al
mov r8, rdi
jmp 0x1bcc4
movzx ecx, word [r12 + 1]
cmp ecx, r10d
je 0x1b240
sub ecx, 1
je 0x1b099
sub ecx, 1
je 0x1aff2
cmp ecx, 1
jne 0x1bccc
mov byte [rsp + 0x218], r10b
mov byte [rsp + 0x219], r10b
mov byte [rsp + 0x21a], 0xaa
mov byte [rsp + 0x21b], r10b
mov byte [rsp + 0x21c], r10b
mov byte [rsp + 0x21d], r10b
mov byte [rsp + 0x21e], r10b
mov byte [rsp + 0x21f], r10b
mov rax, qword [rsp + 0x218]
mov qword [r14], rax
jmp 0x1bccc
mov al, byte [rbp + 0x451]
lea rcx, [rsp + 0x220]
mov byte [rsp + 0x224], r10b
mov byte [rsp + 0x220], al
mov al, byte [rbp + 0x450]
mov byte [rsp + 0x225], r10b
mov byte [rsp + 0x221], al
mov al, byte [rbp + 0x44f]
mov byte [rsp + 0x226], 1
mov byte [rsp + 0x222], al
mov al, byte [rbp + 0x44e]
mov byte [rsp + 0x227], r10b
mov byte [rsp + 0x228], r10b
mov byte [rsp + 0x229], 4
mov byte [rsp + 0x22a], r10b
mov byte [rsp + 0x223], al
mov byte [rsp + 0x22b], r10b
mov byte [rsp + 0x22c], 1
mov byte [rsp + 0x22d], r10b
mov rax, qword [rcx]
mov qword [r14], rax
mov eax, dword [rcx + 8]
mov dword [r14 + 8], eax
movzx eax, word [rcx + 0xc]
mov word [r14 + 0xc], ax
jmp 0x1bccc
mov eax, 6
mov byte [rsp + 0x1ed], r10b
mov byte [rsp + 0x1ee], r10b
lea r8d, [rax - 3]
mov byte [rsp + 0x1ec], al
mov al, byte [rbp + 0x451]
mov byte [rsp + 0x1e8], al
mov al, byte [rbp + 0x450]
mov byte [rsp + 0x200], r8b
mov byte [rsp + 0x1e9], al
mov al, byte [rbp + 0x44f]
mov byte [rsp + 0x20e], r8b
mov byte [rsp + 0x1ea], al
mov al, byte [rbp + 0x44e]
mov byte [rsp + 0x1ef], r10b
mov byte [rsp + 0x1f0], r10b
mov byte [rsp + 0x1f1], 0xca
mov byte [rsp + 0x1f2], r10b
mov byte [rsp + 0x1eb], al
mov byte [rsp + 0x1f3], 0xe
mov byte [rsp + 0x1f4], r10b
mov byte [rsp + 0x1f5], r10b
mov byte [rsp + 0x1f6], 0x35
mov byte [rsp + 0x1f7], 0x88
mov byte [rsp + 0x1f8], 2
mov byte [rsp + 0x1f9], 0x24
mov byte [rsp + 0x1fa], r10b
mov byte [rsp + 0x1fb], 2
mov byte [rsp + 0x1fc], r10b
mov byte [rsp + 0x1fd], 2
mov byte [rsp + 0x1fe], r10b
mov byte [rsp + 0x1ff], r10b
mov byte [rsp + 0x201], 0x15
mov byte [rsp + 0x202], 0x22
mov byte [rsp + 0x203], 0xc3
mov byte [rsp + 0x204], 0xb
mov byte [rsp + 0x205], r10b
mov byte [rsp + 0x206], r10b
mov byte [rsp + 0x207], r10b
mov byte [rsp + 0x208], r10b
mov byte [rsp + 0x209], r10b
mov byte [rsp + 0x20a], r10b
mov byte [rsp + 0x20b], r10b
mov byte [rsp + 0x20c], pe_nt_image_headers64
mov byte [rsp + 0x20d], r10b
mov byte [rsp + 0x20f], 0x7e
mov byte [rsp + 0x210], r10b
mov byte [rsp + 0x211], 1
mov byte [rsp + 0x212], 0x32
mov byte [rsp + 0x213], 0x47
mov byte [rsp + 0x214], r10b
mov byte [rsp + 0x215], r10b
mov byte [rsp + 0x216], r10b
lea rdx, [rsp + 0x1e8]
mov r8d, 0x2f
jmp 0x1bcc4
inc byte [r14]
jmp 0x1bccc
cmp byte [rbp + 2], r10b
je 0x1bc17
cmp byte [rbp + 0x438], 0x69
je 0x1b260
call fcn.00013fb8
mov r12d, 0x30
lea rcx, [rsp + 0x2e0]
xor edx, edx
mov r8, r12
call fcn.000163a0
lea rcx, [rsp + 0x1e8]
mov r8, r12
xor edx, edx
call fcn.000163a0
movsxd rbx, dword [rbp + 0x14ba]
lea rdx, [rbp + 0x14c0]
lea rcx, [rsp + 0x1e8]
mov r8, rbx
call fcn.00015fc0
lea rdx, [rbp + 0x14c0]
lea rcx, [rsp + 0x2e0]
mov r8, rbx
call fcn.00015fc0
xor ebx, ebx
lea r9, [rbp + 0x14f0]
lea r8, str.RegistryMACHINESystemCurrentControlSetutool
lea rdx, [0x0001f870]
lea rcx, [rsp + 0x330]
lea rax, [0x0001f860]
cmp byte [rbp + 0x14be], bl
je 0x1b2f4
lea rax, [0x0001f890]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_swprintf]
lea rdx, [rsp + 0x330]
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x1a0]
lea r8, [rsp + 0x170]
lea rcx, [rsp + 0x158]
mov edx, 0x20019
mov qword [rsp + 0x180], rax
mov dword [rsp + 0x170], r12d
mov qword [rsp + 0x178], rbx
mov dword [rsp + 0x188], 0x40
mov qword [rsp + 0x190], rbx
mov qword [rsp + 0x198], rbx
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
mov esi, 0x10
mov qword [rsp + 0x120], rsi
jl 0x1b731
lea rcx, [rsp + 0x330]
xor edx, edx
mov r8d, 0x100
call fcn.000163a0
mov r11d, dword [rbp + 0x14ba]
cmp r11d, esi
je 0x1b5e7
cmp r11d, 0x20
je 0x1b59d
cmp r11d, r12d
jne 0x1b6f5
movzx r8d, byte [rsp + 0x204]
movzx eax, byte [rsp + 0x207]
movzx ecx, byte [rsp + 0x206]
movzx edx, byte [rsp + 0x205]
mov dword [rsp + 0x110], eax
mov dword [rsp + 0x108], ecx
mov dword [rsp + 0x100], edx
mov dword [rsp + 0xf8], r8d
lea r8, [0x0001fa60]
movzx eax, byte [rsp + 0x1fa]
movzx r10d, byte [rsp + 0x203]
movzx r11d, byte [rsp + 0x202]
movzx ebx, byte [rsp + 0x201]
movzx esi, byte [rsp + 0x200]
movzx ebp, byte [rsp + 0x1ff]
movzx r12d, byte [rsp + 0x1fe]
movzx r13d, byte [rsp + 0x1fd]
movzx r14d, byte [rsp + 0x1fc]
movzx r15d, byte [rsp + 0x1fb]
movzx r9d, byte [rsp + 0x1e8]
mov dword [rsp + 0xf0], r10d
mov dword [rsp + 0xe8], r11d
mov dword [rsp + 0xe0], ebx
mov dword [rsp + 0xd8], esi
mov dword [rsp + 0xd0], ebp
mov dword [rsp + 0xc8], r12d
mov dword [rsp + 0xc0], r13d
mov dword [rsp + 0xb8], r14d
mov dword [rsp + 0xb0], r15d
mov dword [rsp + 0xa8], eax
movzx eax, byte [rsp + 0x1f9]
lea rdx, [0x0001f950]
lea rcx, [rsp + 0x330]
mov dword [rsp + 0xa0], eax
movzx eax, byte [rsp + 0x1f8]
mov dword [rsp + 0x98], eax
movzx eax, byte [rsp + 0x1f7]
mov dword [rsp + 0x90], eax
movzx eax, byte [rsp + 0x1f6]
mov dword [rsp + 0x88], eax
movzx eax, byte [rsp + 0x1f5]
mov dword [rsp + 0x80], eax
movzx eax, byte [rsp + 0x1f4]
mov dword [rsp + 0x78], eax
movzx eax, byte [rsp + 0x1f3]
mov dword [rsp + 0x70], eax
movzx eax, byte [rsp + 0x1f2]
mov dword [rsp + 0x68], eax
movzx eax, byte [rsp + 0x1f1]
mov dword [rsp + 0x60], eax
movzx eax, byte [rsp + 0x1f0]
mov dword [rsp + 0x58], eax
movzx eax, byte [rsp + 0x1ef]
mov dword [rsp + 0x50], eax
movzx eax, byte [rsp + 0x1ee]
mov dword [rsp + 0x48], eax
movzx eax, byte [rsp + 0x1ed]
mov dword [rsp + 0x40], eax
movzx eax, byte [rsp + 0x1ec]
mov dword [rsp + 0x38], eax
movzx eax, byte [rsp + 0x1eb]
mov dword [rsp + 0x30], eax
movzx eax, byte [rsp + 0x1ea]
mov dword [rsp + 0x28], eax
movzx eax, byte [rsp + 0x1e9]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_swprintf]
jmp 0x1b6d7
movzx r8d, byte [rsp + 0x204]
movzx eax, byte [rsp + 0x207]
movzx ecx, byte [rsp + 0x206]
movzx edx, byte [rsp + 0x205]
mov dword [rsp + 0x110], eax
mov dword [rsp + 0x108], ecx
mov dword [rsp + 0x100], edx
mov dword [rsp + 0xf8], r8d
lea r8, [0x0001f940]
jmp 0x1b3fd
movzx eax, byte [rsp + 0x1f7]
movzx ecx, byte [rsp + 0x1f6]
movzx edx, byte [rsp + 0x1f5]
movzx r8d, byte [rsp + 0x1f4]
movzx r10d, byte [rsp + 0x1f3]
movzx r11d, byte [rsp + 0x1f2]
movzx ebx, byte [rsp + 0x1f1]
movzx esi, byte [rsp + 0x1f0]
movzx ebp, byte [rsp + 0x1ef]
movzx r12d, byte [rsp + 0x1ee]
movzx r13d, byte [rsp + 0x1ed]
movzx r14d, byte [rsp + 0x1ec]
movzx r15d, byte [rsp + 0x1eb]
movzx r9d, byte [rsp + 0x1e8]
mov dword [rsp + 0x90], eax
movzx eax, byte [rsp + 0x1ea]
mov dword [rsp + 0x88], ecx
mov dword [rsp + 0x80], edx
mov dword [rsp + 0x78], r8d
mov dword [rsp + 0x70], r10d
mov dword [rsp + 0x68], r11d
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], eax
movzx eax, byte [rsp + 0x1e9]
lea r8, [0x0001f8a0]
lea rdx, [0x0001f8b0]
lea rcx, [rsp + 0x330]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_swprintf]
mov rbp, qword [rsp + 0x218]
mov rsi, qword [rsp + 0x120]
mov r14, qword [rsp + 0x148]
mov r15d, 0xff
mov rcx, qword [rsp + 0x158]
lea r8, [rsp + 0x1e8]
lea rdx, [rsp + 0x330]
mov r9d, esi
call fcn.00013ec8
mov rcx, qword [rsp + 0x158]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
cmp ebx, eax
jge 0x1b912
xor ebx, ebx
movzx ecx, byte [rbp + 0x14bf]
cmp ecx, ebx
je 0x1b8d4
mov r12d, 1
sub ecx, r12d
je 0x1b878
sub ecx, r12d
je 0x1b7fd
sub ecx, 2
je 0x1b79b
sub ecx, r12d
je 0x1b7dc
cmp ecx, r12d
jne 0x1b914
lea rcx, [rsp + 0x2e0]
mov rdx, rsi
mov al, byte [rcx + 0x10]
xor byte [rcx], al
add rcx, r12
sub rdx, r12
jne 0x1b776
lea rcx, [rsp + 0x2e0]
mov rdx, rsi
mov al, byte [rcx + 0x20]
xor byte [rcx], al
add rcx, r12
sub rdx, r12
jne 0x1b78e
lea rdx, [rbp + 0x1518]
lea rcx, [rsp + 0x230]
mov r8d, 0x80
call fcn.00014198
lea r9, [rsp + 0x1e8]
lea r8, [rsp + 0x2e0]
lea rcx, [rsp + 0x230]
mov edx, 0xa
call fcn.00015048
jmp 0x1b914
mov rcx, rbx
mov rdx, rsi
mov al, byte [rsp + rcx + 0x2f0]
xor byte [rsp + rcx + 0x1e8], al
add rcx, r12
sub rdx, r12
jne 0x1b7e2
jmp 0x1b914
lea rdx, [rbp + 0x1518]
lea rcx, [rsp + 0x230]
mov r8d, 0x80
call fcn.00013fe0
lea r9, [rsp + 0x1e8]
lea r8, [rsp + 0x2e0]
lea rcx, [rsp + 0x230]
mov edx, 0xa
call fcn.000143b8
mov r11, rbx
mov rcx, rsi
mov al, byte [rsp + r11 + 0x2f0]
xor byte [rsp + r11 + 0x1e8], al
add r11, r12
sub rcx, r12
jne 0x1b83f
mov rcx, rbx
mov rdx, rsi
mov al, byte [rsp + rcx + 0x300]
xor byte [rsp + rcx + 0x1e8], al
add rcx, r12
sub rdx, r12
jne 0x1b85d
jmp 0x1b914
lea rdx, [rbp + 0x1518]
lea rcx, [rsp + 0x230]
mov r8d, 0x80
call fcn.00013fe0
lea r9, [rsp + 0x1e8]
lea r8, [rsp + 0x2e0]
lea rcx, [rsp + 0x230]
mov edx, 0xa
call fcn.000143b8
mov r11, rbx
mov rcx, rsi
mov al, byte [rsp + r11 + 0x2f0]
xor byte [rsp + r11 + 0x1e8], al
add r11, r12
sub rcx, r12
jne 0x1b8ba
jmp 0x1b914
lea rdx, [rbp + 0x1518]
lea rcx, [rsp + 0x230]
mov r8d, 0x80
call fcn.00013fe0
lea r9, [rsp + 0x1e8]
lea r8, [rsp + 0x2e0]
lea rcx, [rsp + 0x230]
mov edx, 0xa
call fcn.000143b8
jmp 0x1b914
xor ebx, ebx
movsxd r8, dword [rbp + 0x14ba]
lea rdx, [rsp + 0x1e8]
lea rcx, [rsp + 0x1b2]
mov byte [rsp + 0x1b0], bl
call fcn.00015fc0
mov r12, qword [rsp + 0x160]
jmp 0x1bc14
cmp byte [rbp + 2], r10b
je 0x1bc17
mov ecx, 7
cmp dword [0x00017264], ecx
jl 0x1b972
lea r8d, [rcx + 0x31]
lea rdx, [rbp + 0x45e]
lea rcx, [0x0001f820]
jmp 0x1a83d
movabs rax, 0xfffff78000000014
lea rdx, [rsp + 0x128]
mov rbx, qword [rax]
mov rax, qword [rbp + 0x496]
lea rcx, [rbx + rax]
mov qword [rsp + 0x168], rcx
lea rcx, [rsp + 0x168]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
xor eax, eax
cmp dword [0x00017264], eax
jne 0x1ba03
and byte [rbp + 0x45e], 0x7f
mov cl, byte [rbp + 0x45e]
call fcn.00013e78
mov cl, byte [rbp + 0x45f]
movzx r8d, al
mov word [rsp + 0x132], r8w
call fcn.00013e78
mov cl, byte [rbp + 0x460]
movzx r8d, al
mov word [rsp + 0x130], r8w
call fcn.00013e78
movzx r8d, al
mov word [rsp + 0x12e], r8w
jmp 0x1ba5f
mov cl, byte [rbp + 0x461]
call fcn.00013e78
mov cl, byte [rbp + 0x462]
movzx r8d, al
mov word [rsp + 0x12c], r8w
call fcn.00013e78
mov cl, byte [rbp + 0x464]
movzx r8d, al
mov word [rsp + 0x12a], r8w
call fcn.00013e78
movzx r8d, al
mov eax, 0x7d0
cmp r8d, 0x5a
jl 0x1ba52
mov eax, 0x76c
add r8w, ax
mov word [rsp + 0x128], r8w
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x128]
call qword [sym.imp.ntoskrnl.exe_RtlTimeFieldsToTime]
mov r11, qword [rsp + 0x220]
lea rdx, [rbp + 0x496]
sub r11, rbx
mov r8d, 8
lea rcx, [0x0001f840]
mov qword [rdx], r11
jmp 0x1a83d
cmp byte [rbp + 2], r10b
je 0x1bc17
lea rbx, [r12 + 1]
mov r8, rbp
mov edx, 4
mov rcx, rbx
mov byte [rsp + 0x1b0], r10b
call fcn.0001a4e8
movabs rax, 0xfffff78000000014
lea rdx, [rsp + 0x138]
mov rax, qword [rax]
lea rcx, [rsp + 0x120]
mov qword [rsp + 0x120], rax
mov rax, qword [rbp + 0x496]
add qword [rsp + 0x120], rax
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
mov si, word [rbx]
movzx eax, si
and ax, r15w
jne 0x1bb31
mov cl, byte [rsp + 0x13e]
call fcn.00013e48
mov cl, byte [rsp + 0x140]
mov byte [rsp + 0x1b4], al
call fcn.00013e48
mov cl, byte [rsp + 0x142]
jmp 0x1bb8d
mov r8d, 3
cmp ax, r8w
jne 0x1bba2
movsx ecx, word [rsp + 0x138]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub ecx, edx
call fcn.00013e48
mov cl, byte [rsp + 0x146]
mov byte [rsp + 0x1b5], al
call fcn.00013e48
mov cl, byte [rsp + 0x13a]
mov byte [rsp + 0x1b4], al
call fcn.00013e48
mov cl, byte [rsp + 0x13c]
mov byte [rsp + 0x1b3], al
call fcn.00013e48
mov byte [rsp + 0x1b2], al
jmp 0x1bbc4
movzx eax, word [rbx]
lea rcx, [rsp + 0x1b2]
mov r8, rax
movzx eax, al
lea rdx, [rax + rbp + 0x45e]
shr r8, 8
call fcn.00015fc0
movzx esi, si
shr esi, 8
jmp 0x1bc14
lea rbx, [r12 + 1]
mov r8, rbp
mov edx, 4
mov rcx, rbx
call fcn.0001a4e8
xor r10d, r10d
cmp byte [rbp + 2], r10b
je 0x1bc17
mov eax, dword [rbx]
lea rdx, [rbp + 0x149e]
lea rcx, [rsp + 0x1b2]
mov dword [rsp + 0x1b2], eax
mov byte [rsp + 0x1b0], r10b
call fcn.00015de0
mov esi, 4
mov r13b, 1
xor byte [rbp + 3], dil
cmp byte [rsp + 0x1b0], 0x1f
ja 0x1bc4e
inc byte [rbp + 3]
mov cl, byte [r12]
mov bl, byte [rbp + 3]
lea r8, [rsp + 0x1b0]
and cl, 0x7f
mov dl, 2
mov byte [rsp + 0x1b1], bl
call fcn.00013db0
test eax, eax
je 0x1bc25
jmp 0x1bc55
mov bl, byte [rsp + 0x1b1]
mov dil, byte [rsp + 0x1b0]
lea rcx, [rsp + 0x1b0]
mov r8, rbp
mov edx, 2
call fcn.0001a4e8
xor r12d, r12d
cmp r13b, r12b
je 0x1bc89
lea rcx, [rsp + 0x1b2]
mov edx, esi
call fcn.0001a4e8
cmp dil, r12b
jne 0x1bc9e
and word [rbp + 6], r15w
movzx eax, bl
shl ax, 8
or word [rbp + 6], ax
mov r8, qword [rsp + 0x150]
mov eax, esi
lea rdx, [rsp + 0x1b0]
mov ecx, dword [r8]
add rax, 2
cmp rax, rcx
cmovb rcx, rax
mov dword [r8], ecx
mov r8d, ecx
mov rcx, r14
call fcn.00015fc0
mov rcx, qword [rsp + 0xc00]
xor rcx, rsp
call fcn.00015f60
add rsp, 0xc18
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret