Function at 0x1400029b0
Capabilities:
Check for time delay via queryperformancecounter
Check if file exists
Encode data using base64
Encode data using xor
Encrypt data using speck
Get memory capacity
Get system information on windows
Parse credit card information
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe88
movdqa xmmword [rsp + 0xe70], xmm15
movdqa xmmword [rsp + 0xe60], xmm14
movdqa xmmword [rsp + 0xe50], xmm13
movdqa xmmword [rsp + 0xe40], xmm12
movdqa xmmword [rsp + 0xe30], xmm11
movdqa xmmword [rsp + 0xe20], xmm10
movdqa xmmword [rsp + 0xe10], xmm9
movdqa xmmword [rsp + 0xe00], xmm8
movdqa xmmword [rsp + 0xdf0], xmm7
movdqa xmmword [rsp + 0xde0], xmm6
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140002a50
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x378
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov r14, rax
lea rax, [0x14011c4eb]
mov qword [rsp + 0x130], rax
lea rsi, [rsp + 0x130]
mov rcx, qword [rsp + 0x130]
movabs rax, 0xb6cb62cb644fe798
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400475f0
mov edi, dword [rax]
movzx ebx, byte [rax + 6]
movzx ebp, word [rax + 4]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140002adc
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 7
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov r12, rax
mov eax, ebp
shr eax, 8
xor bpl, 0x4c
xor al, 0x2b
movzx ecx, bpl
movzx eax, al
shl eax, 8
or eax, ecx
xor bl, 0x6a
movzx ecx, bl
shl rcx, 0x30
movzx eax, ax
shl rax, 0x20
or rax, rcx
xor rdi, 0x5f388be
or rdi, rax
mov dword [r12], edi
mov rax, rdi
shr rax, 0x30
mov byte [r12 + 6], al
shr rdi, 0x20
mov word [r12 + 4], di
lea rax, [0x140121be9]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x25c5d34ddd26c211
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047aa0
movabs rdi, 0x4d4b061490cc95a8
xor rdi, qword [rax]
mov ebx, 0x9cbb8ad0
xor ebx, dword [rax + 8]
movzx ebp, byte [rax + 0xc]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140002bbe
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xd
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov r13, rax
xor bpl, 0x20
mov qword [rax], rdi
mov dword [rax + 8], ebx
mov byte [rax + 0xc], bpl
lea rax, [0x140122119]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x727e60200e15e1d5
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400471b0
movabs rbx, 0xe01455e3cda86507
xor rbx, qword [rax]
movzx edi, byte [rax + 0xa]
movzx ebp, word [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140002c5b
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xb
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov r15, rax
mov eax, ebp
shr eax, 8
xor bpl, 0x57
xor al, 0x16
movzx ecx, bpl
movzx eax, al
shl eax, 8
or eax, ecx
movd xmm0, eax
xor dil, 0xa8
mov qword [r15], rbx
movd eax, xmm0
mov word [r15 + 8], ax
mov byte [r15 + 0xa], dil
lea rax, [0x14012245f]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0xbcf13a1546fc8c46
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047c20
mov edi, dword [rax]
movzx ebx, byte [rax + 4]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140002d0a
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 5
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
xor bl, 0x25
movzx ecx, bl
shl rcx, 0x20
xor rdi, 0x53235dc8
or rdi, rcx
mov dword [rax], edi
shr rdi, 0x20
mov qword [rsp + 0x40], rax
mov byte [rax + 4], dil
lea rax, [0x140125d36]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x720ae0f3fdd9aa08
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047bb0
movabs rbx, 0xc54cc29ce18676b4
xor rbx, qword [rax]
movzx edi, byte [rax + 0xa]
movzx ebp, word [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140002db9
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xb
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov edx, ebp
shr edx, 8
xor bpl, 0x73
xor dl, 0xee
movzx ecx, bpl
movzx edx, dl
shl edx, 8
or edx, ecx
movd xmm0, edx
xor dil, 0xf2
mov qword [rax], rbx
movd ecx, xmm0
mov word [rax + 8], cx
mov qword [rsp + 0x128], rax
mov byte [rax + 0xa], dil
lea rax, [0x14011fca3]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x303852330a609b59
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047800
movabs rdi, 0xc398c0ede47e1adf
xor rdi, qword [rax]
movzx ebx, word [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140002e78
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xa
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov ecx, ebx
xor cl, 0xcf
shr ebx, 8
xor bl, 0xa8
movzx edx, cl
movzx ecx, bl
shl ecx, 8
or ecx, edx
movd xmm0, ecx
mov qword [rax], rdi
movd ecx, xmm0
mov qword [rsp + 0x98], rax
mov word [rax + 8], cx
lea rax, [0x14011c16a]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x519a17f2c8a79cdf
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047be0
movabs rbx, 0xa468601e0a20795b
xor rbx, qword [rax]
movzx edi, byte [rax + 0xa]
movzx ebp, word [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140002f31
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xb
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov edx, ebp
shr edx, 8
xor bpl, 0x4b
xor dl, 0x71
movzx ecx, bpl
movzx edx, dl
shl edx, 8
or edx, ecx
movd xmm0, edx
xor dil, 0x15
mov qword [rax], rbx
movd ecx, xmm0
mov word [rax + 8], cx
mov qword [rsp + 0x38], rax
mov byte [rax + 0xa], dil
lea rax, [0x140129b9e]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x5de36d2f7006ecb9
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047c80
movabs rdi, 0x787869c0783250
xor rdi, qword [rax]
movzx ebx, word [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140002fed
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xa
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov rbp, rax
mov eax, ebx
xor al, 0xb3
shr ebx, 8
xor bl, 0xa5
movzx eax, al
movzx ecx, bl
shl ecx, 8
or ecx, eax
movd xmm0, ecx
mov qword [rbp], rdi
movd eax, xmm0
mov word [rbp + 8], ax
lea rax, [0x14011f384]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0xa897e9e295abb57f
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047b90
movabs rdi, 0x46bfea187fe3ac2b
xor rdi, qword [rax]
mov ebx, 0xc46a4b26
xor ebx, dword [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400030a1
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xc
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov qword [rsp + 0xa0], rbp
mov qword [rax], rdi
mov qword [rsp + 0x4e8], rax
mov dword [rax + 8], ebx
lea rax, [0x14012151b]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x4a4d4471280e2c12
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047920
movabs rdi, 0x87c3729971070de4
xor rdi, qword [rax]
movabs rbx, 0x854700fcdb94ec71
xor rbx, qword [rax + 8]
movzx ebp, word [rax + 0x10]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x14000314d
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x12
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov ecx, ebp
xor cl, 0x50
shr ebp, 8
xor bpl, 0xf8
movzx edx, cl
movzx ecx, bpl
shl ecx, 8
or ecx, edx
movd xmm0, ecx
mov qword [rax], rdi
mov qword [rax + 8], rbx
movd ecx, xmm0
mov qword [rsp + 0x30], rax
mov word [rax + 0x10], cx
lea rax, [0x14012728d]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x6391eb1c98d4ba3e
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400474a0
movabs rbx, 0xd1a836b1bfcd4f8f
xor rbx, qword [rax]
movzx edi, byte [rax + 0xa]
movzx ebp, word [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140003209
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xb
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov edx, ebp
shr edx, 8
xor bpl, 0xce
xor dl, 0xdc
movzx ecx, bpl
movzx edx, dl
shl edx, 8
or edx, ecx
movd xmm0, edx
xor dil, 0xb1
mov qword [rax], rbx
movd ecx, xmm0
mov word [rax + 8], cx
mov qword [rsp + 0x90], rax
mov byte [rax + 0xa], dil
lea rax, [0x1401254a5]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0xa3d60b1cda277fcc
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400476a0
movq xmm6, qword [rax]
movq xmm7, qword [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400032c0
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x10
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
punpcklqdq xmm6, xmm7
pxor xmm6, xmmword [section..rdata]
mov qword [rsp + 0x5a8], rax
movdqu xmmword [rax], xmm6
lea rax, [0x14011fa05]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0xe4bbe7b9a086f508
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047760
movabs rdi, 0xe4cb37e0beb651a1
xor rdi, qword [rax]
movabs rbx, 0xccbc9caec4d9a99b
xor rbx, qword [rax + 8]
mov ebp, 0xba07147a
xor ebp, dword [rax + 0x10]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140003372
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x14
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov qword [rax], rdi
mov qword [rax + 8], rbx
mov qword [rsp + 0x5a0], rax
mov dword [rax + 0x10], ebp
lea rax, [0x140126a89]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x938bca438e347fd
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047150
movabs rbx, 0xa0d59b2f51e2e479
xor rbx, qword [rax]
movzx edi, byte [rax + 0xa]
movzx ebp, word [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140003410
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xb
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov edx, ebp
shr edx, 8
xor bpl, 0x17
xor dl, 0x2c
movzx ecx, bpl
movzx edx, dl
shl edx, 8
or edx, ecx
movd xmm0, edx
xor dil, 0xbe
mov qword [rax], rbx
movd ecx, xmm0
mov word [rax + 8], cx
mov qword [rsp + 0x48], rax
mov byte [rax + 0xa], dil
lea rax, [0x1401272b6]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x8abf12813c9c9596
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400474f0
movabs rdi, 0x3d198f2d01f6b524
xor rdi, qword [rax]
movabs rbx, 0xd0f86d3c93790333
xor rbx, qword [rax + 8]
movzx ebp, byte [rax + 0x10]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400034da
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x11
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
xor bpl, 0xf3
mov qword [rax], rdi
mov qword [rax + 8], rbx
mov qword [rsp + 0x598], rax
mov byte [rax + 0x10], bpl
lea rax, [0x14011e037]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x4d50136ae280dae0
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047970
mov edi, dword [rax]
movzx ebx, byte [rax + 6]
movzx ebp, word [rax + 4]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140003572
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 7
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov edx, ebp
shr edx, 8
xor bpl, 0xd3
xor dl, 4
movzx ecx, bpl
movzx edx, dl
shl edx, 8
or edx, ecx
xor bl, 0x34
movzx ecx, bl
shl rcx, 0x30
movzx edx, dx
shl rdx, 0x20
or rdx, rcx
mov ecx, 0x8527eecc
xor rcx, rdi
or rcx, rdx
mov dword [rax], ecx
mov rdx, rcx
shr rdx, 0x30
mov byte [rax + 6], dl
shr rcx, 0x20
mov qword [rsp + 0x590], rax
mov word [rax + 4], cx
lea rax, [0x140127495]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x3411bb635ffa2e31
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400474c0
movabs rdi, 0xf0806bd5770fa4b9
xor rdi, qword [rax]
mov ebx, 0x42ac1028
xor ebx, dword [rax + 8]
movzx ebp, byte [rax + 0xc]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140003655
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xd
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
xor bpl, 0xfc
mov qword [rax], rdi
mov dword [rax + 8], ebx
mov qword [rsp + 0x88], rax
mov byte [rax + 0xc], bpl
lea rax, [0x14011b0f9]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x674b42dcd1566fc9
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047580
movabs rbx, 0x1835de3544d55b4b
xor rbx, qword [rax]
movzx edi, byte [rax + 0xa]
movzx ebp, word [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400036f7
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xb
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov edx, ebp
shr edx, 8
xor bpl, 0x4c
xor dl, 0xd6
movzx ecx, bpl
movzx edx, dl
shl edx, 8
or edx, ecx
movd xmm0, edx
xor dil, 0x96
mov qword [rax], rbx
movd ecx, xmm0
mov word [rax + 8], cx
mov qword [rsp + 0x120], rax
mov byte [rax + 0xa], dil
lea rax, [0x1401231c9]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x8b268ef8b65a90b1
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400471e0
mov edi, dword [rax]
movzx ebx, byte [rax + 4]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400037ab
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 5
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
xor bl, 0x29
movzx ecx, bl
shl rcx, 0x20
xor rdi, 0x1e988627
or rdi, rcx
mov dword [rax], edi
shr rdi, 0x20
mov qword [rsp + 0x4e0], rax
mov byte [rax + 4], dil
lea rax, [0x1401236d9]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x78dd2703896f1cb0
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400478a0
movabs rbx, 0xaaf792a40b8c568a
xor rbx, qword [rax]
movzx edi, byte [rax + 0xa]
movzx ebp, word [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x14000385d
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xb
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov edx, ebp
shr edx, 8
xor bpl, 0x55
xor dl, 0xe0
movzx ecx, bpl
movzx edx, dl
shl edx, 8
or edx, ecx
movd xmm0, edx
xor dil, 0xc4
mov qword [rax], rbx
movd ecx, xmm0
mov word [rax + 8], cx
mov qword [rsp + 0xa8], rax
mov byte [rax + 0xa], dil
lea rax, [0x14011fe20]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0xb60530abedd557bb
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047180
movabs rdi, 0x55f2a57bcfdeef04
xor rdi, qword [rax]
movzx ebx, word [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x14000391c
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xa
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov ecx, ebx
xor cl, 0x75
shr ebx, 8
xor bl, 0x7f
movzx edx, cl
movzx ecx, bl
shl ecx, 8
or ecx, edx
movd xmm0, ecx
mov qword [rax], rdi
movd ecx, xmm0
mov qword [rsp + 0x4c8], rax
mov word [rax + 8], cx
lea rax, [0x14011a5e1]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x39e6363bea169a0d
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047820
movabs rbx, 0xac8ac77dacb0a08d
xor rbx, qword [rax]
movzx edi, byte [rax + 0xa]
movzx ebp, word [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400039d5
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xb
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov edx, ebp
shr edx, 8
xor bpl, 0xaf
xor dl, 0xb4
movzx ecx, bpl
movzx edx, dl
shl edx, 8
or edx, ecx
movd xmm0, edx
xor dil, 0xc6
mov qword [rax], rbx
movd ecx, xmm0
mov word [rax + 8], cx
mov qword [rsp + 0x100], rax
mov byte [rax + 0xa], dil
lea rax, [0x14011aee0]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x78b061765e61655b
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047a10
movabs rdi, 0x5f7a334f05c9737c
xor rdi, qword [rax]
movzx ebx, word [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140003a94
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xa
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov rbp, rax
mov eax, ebx
xor al, 6
shr ebx, 8
xor bl, 0x27
movzx eax, al
movzx ecx, bl
shl ecx, 8
or ecx, eax
movd xmm0, ecx
mov qword [rbp], rdi
movd eax, xmm0
mov word [rbp + 8], ax
lea rax, [0x14011ac6a]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0xa3e18e0dc13da0ef
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047310
movabs rdi, 0xc7885b7996354fb8
xor rdi, qword [rax]
mov ebx, 0x5004bc4a
xor ebx, dword [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140003b48
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xc
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov qword [rsp + 0x110], rbp
mov qword [rax], rdi
mov qword [rsp + 0x588], rax
mov dword [rax + 8], ebx
lea rax, [0x14011ba94]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0xff86f81c00515f1d
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400472d0
movabs rdi, 0xaf1a7f5e974a256d
xor rdi, qword [rax]
movabs rbx, 0x8d2651bcfec82be6
xor rbx, qword [rax + 8]
movzx ebp, word [rax + 0x10]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140003bf4
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x12
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov ecx, ebp
xor cl, 0xb4
shr ebp, 8
xor bpl, 0xb4
movzx edx, cl
movzx ecx, bpl
shl ecx, 8
or ecx, edx
movd xmm0, ecx
mov qword [rax], rdi
mov qword [rax + 8], rbx
movd ecx, xmm0
mov qword [rsp + 0x4d8], rax
mov word [rax + 0x10], cx
lea rax, [0x140124f19]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x3c8ffc6c01ae62d3
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047790
movabs rbx, 0x43374e467f0e4554
xor rbx, qword [rax]
movzx edi, byte [rax + 0xa]
movzx ebp, word [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140003cb3
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xb
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov edx, ebp
shr edx, 8
xor bpl, 0x19
xor dl, 0xbc
movzx ecx, bpl
movzx edx, dl
shl edx, 8
or edx, ecx
movd xmm0, edx
xor dil, 4
mov qword [rax], rbx
movd ecx, xmm0
mov word [rax + 8], cx
mov qword [rsp + 0x118], rax
mov byte [rax + 0xa], dil
lea rax, [0x14011f49b]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x8b6c690ffdf09ed4
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400470f0
movq xmm6, qword [rax]
movq xmm7, qword [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140003d6a
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x10
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
punpcklqdq xmm6, xmm7
pxor xmm6, xmmword [0x140124010]
mov qword [rsp + 0x108], rax
movdqu xmmword [rax], xmm6
lea rax, [0x14011defe]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0xede2a950db7f521d
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047230
movabs rdi, 0x4b2e3acea35cc6cc
xor rdi, qword [rax]
movabs rbx, 0xdf9aa73002802255
xor rbx, qword [rax + 8]
mov ebp, 0xe4e0b34e
xor ebp, dword [rax + 0x10]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140003e1c
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x14
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov qword [rax], rdi
mov qword [rax + 8], rbx
mov qword [rsp + 0xa58], rax
mov dword [rax + 0x10], ebp
lea rax, [0x14011ba57]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x88184b7b5999d6a0
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047440
movabs rbx, 0xb40f66c8c81c7c06
xor rbx, qword [rax]
movzx edi, byte [rax + 0xa]
movzx ebp, word [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140003eba
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xb
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov edx, ebp
shr edx, 8
xor bpl, 0xc3
xor dl, 0x1e
movzx ecx, bpl
movzx edx, dl
shl edx, 8
or edx, ecx
movd xmm0, edx
xor dil, 0x1f
mov qword [rax], rbx
movd ecx, xmm0
mov word [rax + 8], cx
mov qword [rsp + 0xa50], rax
mov byte [rax + 0xa], dil
lea rax, [0x14012322a]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x979e0af7490e725
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047470
movabs rdi, 0x768eb85fe036d28c
xor rdi, qword [rax]
movabs rbx, 0x5a35f19c91241b3d
xor rbx, qword [rax + 8]
movzx ebp, byte [rax + 0x10]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140003f87
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x11
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
xor bpl, 0x7f
mov qword [rax], rdi
mov qword [rax + 8], rbx
mov qword [rsp + 0xa48], rax
mov byte [rax + 0x10], bpl
lea rax, [0x14011b117]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x1b3b31eba97ab1cf
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400475b0
mov ebx, dword [rax]
movzx edi, byte [rax + 6]
movzx ebp, word [rax + 4]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x14000401f
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 7
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov qword [rsp + 0xa40], r15
mov qword [rsp + 0x4d0], r14
mov edx, ebp
shr edx, 8
xor bpl, 0x99
xor dl, 0xd6
movzx ecx, bpl
movzx edx, dl
shl edx, 8
or edx, ecx
xor dil, 0xda
movzx ecx, dil
shl rcx, 0x30
movzx edx, dx
shl rdx, 0x20
or rdx, rcx
mov ecx, 0xc081dc3a
xor rcx, rbx
or rcx, rdx
mov dword [rax], ecx
mov rdx, rcx
shr rdx, 0x30
mov byte [rax + 6], dl
shr rcx, 0x20
mov qword [rsp + 0xa38], rax
mov word [rax + 4], cx
lea rax, [0x140123323]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x992d13e37f800486
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400473e0
movabs r14, 0xdaaa521bae3bb171
xor r14, qword [rax]
movzx ebx, byte [rax + 0xa]
movzx edi, word [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140004110
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xb
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov r15, rax
mov eax, edi
shr eax, 8
xor dil, 0x8f
xor al, 0x37
movzx ecx, dil
movzx eax, al
shl eax, 8
or eax, ecx
movd xmm0, eax
xor bl, 0xc6
mov qword [r15], r14
movd eax, xmm0
mov word [r15 + 8], ax
mov byte [r15 + 0xa], bl
lea rax, [0x140121b6c]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x772265806b5a4c18
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400476c0
mov edi, dword [rax]
movzx ebx, word [rax + 4]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400041be
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 6
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov rbp, rax
mov eax, ebx
xor al, 0x63
shr ebx, 8
xor bl, 0x42
movzx eax, al
movzx ecx, bl
shl ecx, 8
or ecx, eax
shl rcx, 0x20
mov eax, 0xbba12d03
xor rax, rdi
or rax, rcx
mov dword [rbp], eax
shr rax, 0x20
mov word [rbp + 4], ax
lea rax, [0x140120bef]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x471c03ae3d96648a
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047c50
movzx edi, byte [rax + 2]
movzx ebx, word [rax]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x14000426e
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 3
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov r14, rax
mov qword [rsp + 0xa28], r13
mov qword [rsp + 0xa30], r12
shl edi, 0x10
mov eax, ebx
shr eax, 8
xor bl, 0x9f
xor al, 0x36
movzx ecx, bl
movzx eax, al
shl eax, 8
or eax, ecx
movzx eax, ax
or eax, edi
mov word [r14], ax
shr eax, 0x10
mov byte [r14 + 2], al
lea rax, [0x1401217bd]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x6677da33a79bdb39
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047940
movabs rdi, 0xb7461a5c6249aa5d
xor rdi, qword [rax]
movzx ebx, byte [rax + 0xa]
movzx r12d, word [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140004336
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xb
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov r13, rax
mov eax, r12d
shr eax, 8
xor r12b, 0x1a
xor al, 0xab
movzx ecx, r12b
movzx eax, al
shl eax, 8
or eax, ecx
movd xmm0, eax
xor bl, 0xb9
mov qword [r13], rdi
movd eax, xmm0
mov word [r13 + 8], ax
mov byte [r13 + 0xa], bl
lea rax, [0x140120532]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x654c0bc5c0a43e18
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047360
mov edi, dword [rax]
movzx r12d, word [rax + 4]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400043e7
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 6
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov rbx, rax
mov eax, r12d
xor al, 0x9c
shr r12d, 8
xor r12b, 0x38
movzx eax, al
movzx ecx, r12b
shl ecx, 8
or ecx, eax
shl rcx, 0x20
mov eax, 0x8d69a7d5
xor rax, rdi
or rax, rcx
mov dword [rbx], eax
shr rax, 0x20
mov word [rbx + 4], ax
lea rax, [0x140122a26]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0xcc6c3ce97e695986
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047270
movzx edi, byte [rax + 2]
movzx r12d, word [rax]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x14000449b
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 3
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov ecx, r12d
shr ecx, 8
xor r12b, 0xe8
xor cl, 0x50
movzx edx, r12b
movzx ecx, cl
shl ecx, 8
or ecx, edx
xor dil, 0x26
movzx edx, dil
shl edx, 0x10
movzx ecx, cx
or ecx, edx
mov word [rax], cx
shr ecx, 0x10
mov byte [rax + 2], cl
mov rcx, qword [rsp + 0x4d0]
mov rdx, qword [rsp + 0xa30]
mov qword [rcx], rdx
mov qword [rcx + 8], 7
mov qword [rcx + 0x10], 7
mov rdx, qword [rsp + 0xa28]
mov qword [rcx + 0x18], rdx
mov qword [rcx + 0x20], 0xd
mov qword [rcx + 0x28], 0xd
mov rdx, qword [rsp + 0xa40]
mov qword [rcx + 0x30], rdx
mov qword [rcx + 0x38], 0xb
mov qword [rcx + 0x40], 0xb
mov rdx, qword [rsp + 0x40]
mov qword [rcx + 0x48], rdx
mov qword [rcx + 0x50], 5
mov qword [rcx + 0x58], 5
mov rdx, qword [rsp + 0x128]
mov qword [rcx + 0x60], rdx
mov qword [rcx + 0x68], 0xb
mov qword [rcx + 0x70], 0xb
mov rdx, qword [rsp + 0x98]
mov qword [rcx + 0x78], rdx
mov qword [rcx + 0x80], 0xa
mov qword [rcx + 0x88], 0xa
mov rdx, qword [rsp + 0x38]
mov qword [rcx + 0x90], rdx
mov qword [rcx + 0x98], 0xb
mov qword [rcx + 0xa0], 0xb
mov rdx, qword [rsp + 0xa0]
mov qword [rcx + 0xa8], rdx
mov qword [rcx + 0xb0], 0xa
mov qword [rcx + 0xb8], 0xa
mov rdx, qword [rsp + 0x4e8]
mov qword [rcx + 0xc0], rdx
mov qword [rcx + 0xc8], 0xc
mov qword [rcx + 0xd0], 0xc
mov rdx, qword [rsp + 0x30]
mov qword [rcx + 0xd8], rdx
mov qword [rcx + 0xe0], 0x12
mov qword [rcx + 0xe8], 0x12
mov rdx, qword [rsp + 0x90]
mov qword [rcx + 0xf0], rdx
mov qword [rcx + 0xf8], 0xb
mov qword [rcx + 0x100], 0xb
mov rdx, qword [rsp + 0x5a8]
mov qword [rcx + 0x108], rdx
mov qword [rcx + 0x110], 0x10
mov qword [rcx + 0x118], 0x10
mov rdx, qword [rsp + 0x5a0]
mov qword [rcx + 0x120], rdx
mov qword [rcx + 0x128], 0x14
mov qword [rcx + 0x130], 0x14
mov rdx, qword [rsp + 0x48]
mov qword [rcx + 0x138], rdx
mov qword [rcx + 0x140], 0xb
mov qword [rcx + 0x148], 0xb
mov rdx, qword [rsp + 0x598]
mov qword [rcx + 0x150], rdx
mov qword [rcx + 0x158], 0x11
mov qword [rcx + 0x160], 0x11
mov rdx, qword [rsp + 0x590]
mov qword [rcx + 0x168], rdx
mov qword [rcx + 0x170], 7
mov qword [rcx + 0x178], 7
mov rdx, qword [rsp + 0x88]
mov qword [rcx + 0x180], rdx
mov qword [rcx + 0x188], 0xd
mov qword [rcx + 0x190], 0xd
mov rdx, qword [rsp + 0x120]
mov qword [rcx + 0x198], rdx
mov qword [rcx + 0x1a0], 0xb
mov qword [rcx + 0x1a8], 0xb
mov rdx, qword [rsp + 0x4e0]
mov qword [rcx + 0x1b0], rdx
mov qword [rcx + 0x1b8], 5
mov qword [rcx + 0x1c0], 5
mov rdx, qword [rsp + 0xa8]
mov qword [rcx + 0x1c8], rdx
mov qword [rcx + 0x1d0], 0xb
mov qword [rcx + 0x1d8], 0xb
mov rdx, qword [rsp + 0x4c8]
mov qword [rcx + 0x1e0], rdx
mov qword [rcx + 0x1e8], 0xa
mov qword [rcx + 0x1f0], 0xa
mov rdx, qword [rsp + 0x100]
mov qword [rcx + 0x1f8], rdx
mov qword [rcx + 0x200], 0xb
mov qword [rcx + 0x208], 0xb
mov rdx, qword [rsp + 0x110]
mov qword [rcx + 0x210], rdx
mov qword [rcx + 0x218], 0xa
mov qword [rcx + 0x220], 0xa
mov rdx, qword [rsp + 0x588]
mov qword [rcx + 0x228], rdx
mov qword [rcx + 0x230], 0xc
mov qword [rcx + 0x238], 0xc
mov rdx, qword [rsp + 0x4d8]
mov qword [rcx + 0x240], rdx
mov qword [rcx + 0x248], 0x12
mov qword [rcx + 0x250], 0x12
mov rdx, qword [rsp + 0x118]
mov qword [rcx + 0x258], rdx
mov qword [rcx + 0x260], 0xb
mov qword [rcx + 0x268], 0xb
mov rdx, qword [rsp + 0x108]
mov qword [rcx + 0x270], rdx
mov qword [rcx + 0x278], 0x10
mov qword [rcx + 0x280], 0x10
mov rdx, qword [rsp + 0xa58]
mov qword [rcx + 0x288], rdx
mov qword [rcx + 0x290], 0x14
mov qword [rcx + 0x298], 0x14
mov rdx, qword [rsp + 0xa50]
mov qword [rcx + 0x2a0], rdx
mov qword [rcx + 0x2a8], 0xb
mov qword [rcx + 0x2b0], 0xb
mov rdx, qword [rsp + 0xa48]
mov qword [rcx + 0x2b8], rdx
mov qword [rcx + 0x2c0], 0x11
mov qword [rcx + 0x2c8], 0x11
mov rdx, qword [rsp + 0xa38]
mov qword [rcx + 0x2d0], rdx
mov qword [rcx + 0x2d8], 7
mov qword [rcx + 0x2e0], 7
mov qword [rcx + 0x2e8], r15
mov qword [rcx + 0x2f0], 0xb
mov qword [rcx + 0x2f8], 0xb
mov qword [rcx + 0x300], rbp
mov qword [rcx + 0x308], 6
mov qword [rcx + 0x310], 6
mov qword [rcx + 0x318], r14
mov qword [rcx + 0x320], 3
mov qword [rcx + 0x328], 3
mov qword [rcx + 0x330], r13
mov qword [rcx + 0x338], 0xb
mov qword [rcx + 0x340], 0xb
mov qword [rcx + 0x348], rbx
mov qword [rcx + 0x350], 6
mov qword [rcx + 0x358], 6
mov qword [rcx + 0x360], rax
mov qword [rcx + 0x368], 3
mov qword [rcx + 0x370], 3
lea rax, [0x140122157]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x15c52f75f10ce752
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047a40
movabs rsi, 0x5a0e34ca23721565
xor rsi, qword [rax]
movzx edi, word [rax + 8]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140004a49
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0xa
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov ecx, edi
xor cl, 0xa1
shr edi, 8
xor dil, 0x6a
movzx ecx, cl
movzx edx, dil
shl edx, 8
or edx, ecx
movd xmm0, edx
mov qword [rax], rsi
movd ecx, xmm0
mov word [rax + 8], cx
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 0xa
mov qword [rsp + 0x170], 0xa
mov byte [rsp + 0x178], 0
mov qword [rsp + 0x1c0], 8
mov qword [rsp + 0x180], 0
mov qword [rsp + 0x190], 0
mov word [rsp + 0x198], 0
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x1c8], xmm0
mov byte [rsp + 0x1b8], 2
mov dword [rsp + 0x1f0], 0
mov word [rsp + 0x1f4], 0
mov dword [rsp + 0x130], 6
mov dword [rsp + 0x140], 6
mov dword [rsp + 0x150], 6
mov qword [rsp + 0x1d8], 0
mov qword [rsp + 0x1e8], 0
lea rax, [0x140126ba8]
mov qword [rsp + 0x6a0], rax
lea rax, [rsp + 0x6a0]
mov rcx, qword [rsp + 0x6a0]
movabs rdx, 0xb22c8538750f0e6c
mov qword [rsp + 0x6a0], rdx
mov rdx, qword [rsp + 0x6a0]
call fcn.140047ad0
movabs rdi, 0xba92bd7f79fb6420
xor rdi, qword [rax]
movabs rbx, 0x4c6aa9d14a9857c1
xor rbx, qword [rax + 8]
movabs r14, 0xf7693adc33402a59
xor r14, qword [rax + 0x10]
movabs r15, 0x23ad7717d6688a65
xor r15, qword [rax + 0x18]
movabs r12, 0x9036d9b124b5e7b0
xor r12, qword [rax + 0x20]
mov ebp, 0x2b1b5a11
xor ebp, dword [rax + 0x28]
movzx r13d, byte [rax + 0x2c]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140004bfa
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x2d
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov rsi, rax
lea rcx, [rsp + 0x1c0]
xor r13b, 0x9d
mov qword [rax], rdi
mov qword [rax + 8], rbx
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r15
mov qword [rax + 0x20], r12
mov dword [rax + 0x28], ebp
mov byte [rax + 0x2c], r13b
xor edx, edx
call fcn.1400f0c10
mov rax, qword [rsp + 0x1c0]
mov rcx, qword [rsp + 0x1d0]
lea rdx, [rcx + rcx*4]
mov qword [rax + rdx*8], 0
mov qword [rax + rdx*8 + 8], rsi
mov qword [rax + rdx*8 + 0x10], 0x2d
mov qword [rax + rdx*8 + 0x18], 0x2d
mov byte [rax + rdx*8 + 0x20], 0
inc rcx
mov qword [rsp + 0x1d0], rcx
lea rbp, [rsp + 0x6a0]
lea rdx, [rsp + 0x130]
mov rcx, rbp
call fcn.1400e3cd0
lea rax, [0x14011a723]
mov qword [rsp + 0xa60], rax
lea rdx, [rsp + 0xa60]
mov rcx, qword [rsp + 0xa60]
movabs rax, 0xc524d19bb8bb34b5
mov qword [rsp + 0xa60], rax
mov rdx, qword [rsp + 0xa60]
call fcn.140047410
mov rcx, qword [rax]
mov rcx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
movzx eax, byte [rax + 0x18]
mov rdi, qword [rsp + 0x6a0]
test rdi, rdi
je 0x14000c1e6
mov rax, qword [rsp + 0x6a8]
mov qword [rsp + 0x5a0], rax
mov rsi, qword [rsp + 0x6b0]
mov rax, qword [rsp + 0x6b8]
mov qword [rsp + 0x598], rax
mov rax, qword [rsp + 0x6c0]
mov qword [rsp + 0x5a8], rax
lea rcx, [rsp + 0x130]
call fcn.140001710
lea rbx, [rsp + 0x130]
mov rcx, rbx
mov qword [rsp + 0x590], rdi
mov rdx, rdi
mov r8, rsi
call fcn.14000dc10
mov r14, qword [rsp + 0x130]
mov r12, qword [rsp + 0x138]
test r14, r14
mov r15, r14
cmove r15, r12
mov rdx, qword [rsp + 0x140]
lea rcx, [r15 + rdx]
mov al, 1
test rdx, rdx
je 0x140004efe
xor edx, edx
mov qword [rsp + 0xa0], rdx
lea r9, [0x140173660]
xor r8d, r8d
mov rdx, r15
jmp 0x140004dc9
movzx r10d, r10b
test byte [r10 + r9], 1
je 0x140004eef
nop word cs:[rax + rax]
cmp rdx, rcx
je 0x14000502d
mov r11, rdx
mov rsi, r8
movzx r10d, byte [rdx]
test r10b, r10b
js 0x140004df0
lea rdx, [r11 + 1]
jmp 0x140004e70
mov r8d, r10d
and r8d, 0x1f
movzx edi, byte [r11 + 1]
and edi, 0x3f
cmp r10b, 0xdf
jbe 0x140004e47
mov r13, rsi
movzx esi, byte [r11 + 2]
shl edi, 6
and esi, 0x3f
or esi, edi
cmp r10b, 0xf0
jb 0x140004e57
lea rdx, [r11 + 4]
movzx r10d, byte [r11 + 3]
and r8d, 7
shl r8d, 0x12
shl esi, 6
and r10d, 0x3f
or r10d, esi
or r10d, r8d
cmp r10d, 0x110000
jne 0x140004e65
jmp 0x140008469
lea rdx, [r11 + 2]
shl r8d, 6
or r8d, edi
mov r10d, r8d
jmp 0x140004e70
lea rdx, [r11 + 3]
shl r8d, 0xc
or esi, r8d
mov r10d, esi
mov rsi, r13
nop dword [rax + rax]
mov r8, rdx
sub r8, r11
add r8, rsi
lea r11d, [r10 - 9]
cmp r11d, 5
jb 0x140004dc0
cmp r10d, 0x20
je 0x140004dc0
cmp r10d, 0x80
jb 0x140004eef
mov r11d, r10d
shr r11d, 8
cmp r11d, 0x1f
jg 0x140004ec5
test r11d, r11d
je 0x140004da6
cmp r11d, 0x16
jne 0x140004eef
cmp r10d, 0x1680
je 0x140004dc0
jmp 0x140004eef
cmp r11d, 0x20
je 0x140004ee0
cmp r11d, 0x30
jne 0x140004eef
cmp r10d, 0x3000
je 0x140004dc0
jmp 0x140004eef
movzx r10d, r10b
test byte [r10 + r9], 2
jne 0x140004dc0
mov r13, rsi
xor eax, eax
mov qword [rsp + 0xa0], r8
jmp 0x140004f10
xor r8d, r8d
mov rdx, r15
xor r9d, r9d
mov qword [rsp + 0xa0], r9
nop
cmp rdx, rcx
je 0x140005029
mov r10, rcx
movzx r11d, byte [rcx - 1]
test r11b, r11b
js 0x140004f30
lea rcx, [r10 - 1]
jmp 0x140004f91
movzx esi, byte [r10 - 2]
cmp sil, 0xc0
jge 0x140004f62
movzx edi, byte [r10 - 3]
cmp dil, 0xc0
jge 0x140004f6b
lea rcx, [r10 - 4]
mov r9, rbp
movzx ebp, byte [r10 - 4]
and ebp, 7
shl ebp, 6
and edi, 0x3f
or edi, ebp
mov rbp, r9
jmp 0x140004f72
lea rcx, [r10 - 2]
and esi, 0x1f
jmp 0x140004f7a
lea rcx, [r10 - 3]
and edi, 0xf
shl edi, 6
and esi, 0x3f
or esi, edi
shl esi, 6
and r11d, 0x3f
or r11d, esi
cmp r11d, 0x110000
je 0x140005029
lea esi, [r11 - 9]
cmp esi, 5
jb 0x140004f10
cmp r11d, 0x20
je 0x140004f10
cmp r11d, 0x80
jb 0x14000501b
mov esi, r11d
shr esi, 8
cmp esi, 0x1f
jg 0x140004fd4
test esi, esi
je 0x140004fed
cmp esi, 0x16
jne 0x14000501b
cmp r11d, 0x1680
je 0x140004f10
jmp 0x14000501b
cmp esi, 0x20
je 0x140005005
cmp esi, 0x30
jne 0x14000501b
cmp r11d, 0x3000
je 0x140004f10
jmp 0x14000501b
movzx r11d, r11b
lea r9, [0x140173660]
test byte [r11 + r9], 1
jne 0x140004f10
jmp 0x14000501b
movzx r11d, r11b
lea r9, [0x140173660]
test byte [r11 + r9], 2
jne 0x140004f10
sub r8, rdx
add r8, r10
mov qword [rsp + 0xa0], r8
test al, al
je 0x140005030
xor r13d, r13d
mov rsi, qword [rsp + 0xa0]
mov qword [rsp + 0x4e8], r13
sub rsi, r13
mov r13d, 1
je 0x140005092
js 0x14000c1e6
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x14000507c
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapAlloc
mov r13, rax
test rax, rax
je 0x14000c1e6
add r15, qword [rsp + 0x4e8]
mov rcx, r13
mov rdx, r15
mov r8, rsi
call sub.msvcrt.dll_memcpy
test r14, r14
je 0x1400050c3
test r12, r12
je 0x1400050c3
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, r14
call sub.KERNEL32.dll_HeapFree
mov edi, 0x10
mov r14, qword [rsp + 0x4d0]
jmp 0x1400050e4
add rdi, 0x18
cmp rdi, 0x388
je 0x14000c22d
cmp qword [r14 + rdi], rsi
jne 0x1400050e0
mov rcx, qword [r14 + rdi - 0x10]
mov rdx, r13
mov r8, rsi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x1400050e0
lea rax, [0x140122d38]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0xa52e69d20d42efc8
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047070
movq xmm0, qword [rax]
movq xmm1, qword [rax + 8]
punpcklqdq xmm0, xmm1
pxor xmm0, xmmword [0x140124020]
movdqa xmmword [rsp + 0x6a0], xmm0
mov qword [rsp + 0xa60], rbp
mov qword [rsp + 0xa68], 0x10
lea rax, [rsp + 0xa60]
mov qword [rsp + 0x5b0], rax
lea rax, [0x1400ef720]
mov qword [rsp + 0x5b8], rax
lea rax, str.combase.dll
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], 2
mov qword [rsp + 0x150], 0
lea rax, [rsp + 0x5b0]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 1
lea rcx, [rsp + 0x130]
call fcn.1400e2d60
lea rbx, [rsp + 0x130]
mov rcx, rbx
call fcn.1400e07b0
cmp byte [rsp + 0x148], 2
mov qword [rsp + 0x128], r13
jne 0x14000526d
mov rax, qword [rsp + 0x130]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x140005a6e
test rcx, rcx
je 0x140005a6e
lea rsi, [rax - 1]
mov r14, qword [rax - 1]
mov rdi, qword [rax + 7]
mov rcx, r14
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x14000525c
cmp qword [rdi + 0x10], 0x11
jb 0x14000524b
mov r14, qword [r14 - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, r14
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rsi
jmp 0x140005a69
mov r12, qword [rsp + 0x130]
mov rdi, qword [rsp + 0x138]
mov rdx, qword [rsp + 0x140]
mov rcx, r12
call fcn.1400ef260
mov r13, rax
test rax, rax
je 0x14000531e
mov r8, rdx
mov r15, rbp
lea rcx, [rsp + 0x130]
mov rdx, r13
call fcn.1400ec990
mov rsi, qword [rsp + 0x130]
mov rbx, qword [rsp + 0x138]
test rsi, rsi
mov rbp, rsi
cmove rbp, rbx
mov r14, qword [rsp + 0x140]
test r14, r14
je 0x14000532c
js 0x14000c1e6
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140005307
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
xor edx, edx
mov r8, r14
call sub.KERNEL32.dll_HeapAlloc
mov rcx, rax
test rax, rax
jne 0x140005331
jmp 0x14000c1e6
xor eax, eax
mov qword [rsp + 0x40], rax
test rdi, rdi
jne 0x14000536c
jmp 0x14000537d
mov ecx, 1
mov qword [rsp + 0x40], rcx
mov rdx, rbp
mov r8, r14
call sub.msvcrt.dll_memcpy
test rsi, rsi
je 0x14000535c
test rbx, rbx
je 0x14000535c
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rbp, r15
lea rbx, [rsp + 0x130]
test rdi, rdi
je 0x14000537d
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, r12
call sub.KERNEL32.dll_HeapFree
test r13, r13
je 0x140005a6e
lea rax, [0x1401291b2]
mov qword [rsp + 0x5b0], rax
lea rdx, [rsp + 0x5b0]
mov rcx, qword [rsp + 0x5b0]
movabs rax, 0x220469b007a5cd30
mov qword [rsp + 0x5b0], rax
mov rdx, qword [rsp + 0x5b0]
call fcn.140047b00
movabs rsi, 0x3a849db9470cc10f
xor rsi, qword [rax]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400053fc
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 8
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov qword [rax], rsi
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], 8
mov qword [rsp + 0x170], 8
mov byte [rsp + 0x178], 0
mov qword [rsp + 0x1c0], 8
mov qword [rsp + 0x180], 0
mov qword [rsp + 0x190], 0
mov word [rsp + 0x198], 0
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x1c8], xmm0
mov byte [rsp + 0x1b8], 2
mov dword [rsp + 0x1f0], 0
mov word [rsp + 0x1f4], 0
mov dword [rsp + 0x130], 6
mov dword [rsp + 0x140], 6
mov dword [rsp + 0x150], 6
mov qword [rsp + 0x1d8], 0
mov qword [rsp + 0x1e8], 0
lea rcx, [rsp + 0xa60]
lea rdx, [rsp + 0x130]
call fcn.1400e3cd0
mov rdx, qword [rsp + 0xa60]
test rdx, rdx
je 0x1400059e7
movabs rsi, 0x8080808080808080
mov rax, qword [rsp + 0xa68]
mov qword [rsp + 0x38], rax
mov r8, qword [rsp + 0xa70]
mov rax, qword [rsp + 0xa78]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xa80]
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0x5b0]
mov qword [rsp + 0x88], rdx
call fcn.14000dc10
mov r12, qword [rsp + 0x5b0]
mov rax, qword [rsp + 0x5b8]
test r12, r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x90], rax
cmove r12, rax
mov rdi, qword [rsp + 0x5c0]
mov qword [rsp + 0x6a0], 0
mov qword [rsp + 0x6a8], rdi
mov qword [rsp + 0x6b0], r12
mov qword [rsp + 0x6b8], rdi
mov qword [rsp + 0x6c0], 0
mov qword [rsp + 0x6c8], rdi
mov qword [rsp + 0x6d0], 1
movabs rax, 0xa0000000a
mov qword [rsp + 0x6d8], rax
mov word [rsp + 0x6e0], 0
xor r13d, r13d
movdqa xmm6, xmmword [0x140124030]
movdqa xmm7, xmmword [0x140124040]
xor ebx, ebx
xor ebp, ebp
jmp 0x14000560a
xor r9d, r9d
mov rdx, r14
call fcn.140001fa0
movzx eax, al
add rbp, rax
test r15b, r15b
je 0x1400057f5
mov rax, rbx
cmp r13, rdi
ja 0x140005773
mov rdx, rdi
sub rdx, r13
lea rcx, [r12 + r13]
cmp rdx, 0x10
jae 0x140005660
cmp rdi, r13
je 0x140005760
xor r9d, r9d
nop word cs:[rax + rax]
cmp byte [rcx + r9], 0xa
je 0x140005733
inc r9
cmp rdx, r9
jne 0x140005640
jmp 0x140005760
lea r8, [rcx + 7]
and r8, 0xfffffffffffffff8
sub r8, rcx
je 0x1400056a0
cmp r8, rdx
cmovae r8, rdx
test r8, r8
je 0x1400056a0
xor r9d, r9d
nop dword [rax]
cmp byte [rcx + r9], 0xa
je 0x140005733
inc r9
cmp r8, r9
jne 0x140005680
lea r9, [rdx - 0x10]
jmp 0x1400056b0
lea r9, [rdx - 0x10]
xor r8d, r8d
jmp 0x1400056b5
cmp r8, r9
ja 0x1400056f0
movdqu xmm0, xmmword [rcx + r8]
movdqa xmm1, xmm0
pxor xmm1, xmm6
paddq xmm1, xmm7
pandn xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
movq r10, xmm1
test r10, rsi
jne 0x1400056f0
add r8, 0x10
jmp 0x1400056b0
cmp r8, rdx
je 0x140005760
add rcx, r8
mov rdx, rdi
sub rdx, r8
sub rdx, r13
xor r9d, r9d
nop word cs:[rax + rax]
cmp byte [rcx + r9], 0xa
je 0x140005730
inc r9
cmp rdx, r9
jne 0x140005710
jmp 0x140005760
add r9, r8
add r9, r13
mov r13, r9
inc r13
je 0x14000574b
cmp r13, rdi
ja 0x14000574b
mov cl, 0xa
cmp byte [r12 + r9], cl
je 0x1400057c9
cmp r13, rdi
jbe 0x140005616
mov qword [rsp + 0x6c0], r13
jmp 0x140005773
mov qword [rsp + 0x6c0], r13
mov qword [rsp + 0x6c0], rdi
mov r13, rdi
mov byte [rsp + 0x6e1], 1
cmp rdi, rax
mov rcx, qword [rsp + 0x40]
je 0x1400057f5
xor r15d, r15d
mov rbx, rax
mov r9, rdi
lea r8, [r12 + rax]
sub r9, rax
je 0x1400055f0
cmp byte [r8 + r9 - 1], 0xa
jne 0x1400055f3
mov rax, r9
dec rax
je 0x1400055f0
cmp byte [r8 + r9 - 2], 0xd
lea rdx, [r9 - 2]
cmove rax, rdx
mov r9, rax
jmp 0x1400055f3
mov qword [rsp + 0x6c0], r13
mov qword [rsp + 0x6a0], r13
mov r15b, 1
mov rbx, r13
mov r9, r13
mov rcx, qword [rsp + 0x40]
lea r8, [r12 + rax]
sub r9, rax
jne 0x14000579b
jmp 0x1400055f0
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x140005818
cmp qword [rsp + 0x90], 0
je 0x140005818
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x38], 0
lea rbx, [rsp + 0x130]
je 0x14000583e
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, qword [rsp + 0x88]
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x98], 0
je 0x14000585c
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, qword [rsp + 0x48]
call sub.KERNEL32.dll_HeapFree
lea rsi, [rsp + 0x130]
mov rcx, rsi
call fcn.140001710
test r14, r14
je 0x140005884
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, qword [rsp + 0x40]
call sub.KERNEL32.dll_HeapFree
cmp rbp, 1
lea rbp, [rsp + 0x6a0]
jbe 0x140005a6e
lea rax, [0x140124118]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0xbaad59eb274a1021
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047b70
movabs rcx, 0xa8e21e6675476663
xor rcx, qword [rax]
movabs rdx, 0x7c7071d18efbd5d1
xor rdx, qword [rax + 8]
movabs r8, 0x6cfa0e903b077674
xor r8, qword [rax + 0x10]
movabs r9, 0x8c464e39882b1884
xor r9, qword [rax + 0x18]
movabs r10, 0x15a30230f5a8d3d9
xor r10, qword [rax + 0x20]
mov r11d, 0xc9422082
xor r11d, dword [rax + 0x28]
movzx eax, byte [rax + 0x2c]
xor al, 0x4b
mov qword [rsp + 0x6a0], rcx
mov qword [rsp + 0x6a8], rdx
mov qword [rsp + 0x6b0], r8
mov qword [rsp + 0x6b8], r9
mov qword [rsp + 0x6c0], r10
mov dword [rsp + 0x6c8], r11d
mov byte [rsp + 0x6cc], al
mov qword [rsp + 0xa60], rbp
mov qword [rsp + 0xa68], 0x2d
lea rax, [rsp + 0xa60]
mov qword [rsp + 0x5b0], rax
lea rax, [0x1400ef720]
mov qword [rsp + 0x5b8], rax
lea rax, str.combase.dll
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], 2
mov qword [rsp + 0x150], 0
lea rax, [rsp + 0x5b0]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 1
lea rcx, [rsp + 0x130]
call fcn.1400e2ec0
mov ecx, 0xc8
call fcn.1400e8820
ud2
mov rax, qword [rsp + 0xa68]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x140005a49
test rcx, rcx
je 0x140005a49
lea rsi, [rax - 1]
mov r12, qword [rax - 1]
mov rdi, qword [rax + 7]
mov rcx, r12
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x140005a38
cmp qword [rdi + 0x10], 0x11
jb 0x140005a27
mov r12, qword [r12 - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, r12
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
lea rcx, [rsp + 0x130]
call fcn.140001710
test r14, r14
je 0x140005a6e
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, qword [rsp + 0x40]
call sub.KERNEL32.dll_HeapFree
lea rax, [0x140127eea]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x2679d2e6bd4fa3d4
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047040
movabs rcx, 0xbf286411fc40b767
xor rcx, qword [rax]
movzx eax, byte [rax + 8]
xor al, 0x44
mov qword [rsp + 0x5b0], rcx
mov byte [rsp + 0x5b8], al
lea rax, [rsp + 0x5b0]
mov qword [rsp + 0x6a0], rax
mov qword [rsp + 0x6a8], 9
mov qword [rsp + 0xa60], rbp
lea rax, [0x1400ef720]
mov qword [rsp + 0xa68], rax
lea rax, str.combase.dll
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], 2
mov qword [rsp + 0x150], 0
lea rax, [rsp + 0xa60]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 1
lea rcx, [rsp + 0x130]
call fcn.1400e2d60
mov ecx, 0x1e
call fcn.1400e33d0
xor ecx, ecx
call fcn.1400ef760
test rax, rax
je 0x14000c1e6
movdqu xmm6, xmmword [rax]
inc qword [rax]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140005b95
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x56410
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov rsi, rax
add rsi, 0x56000
mov r8d, 0x410
mov rcx, rsi
mov dl, 0xff
call sub.msvcrt.dll_memset
mov qword [rsp + 0x170], rsi
mov qword [rsp + 0x178], 0x3ff
mov qword [rsp + 0x180], 0x380
mov qword [rsp + 0x188], 0
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x140005c1c
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 9
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
movabs rcx, 0x5043206c61746f54
mov qword [rax], rcx
mov byte [rax + 8], 0x55
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0x1c8], 9
mov qword [rsp + 0x1d0], 9
mov qword [rsp + 0x1d8], 1
pxor xmm7, xmm7
movdqu xmmword [rsp + 0x1e0], xmm7
mov qword [rsp + 0x1f0], 1
movdqu xmmword [rsp + 0x1f8], xmm7
mov qword [rsp + 0x208], 0
mov qword [rsp + 0x220], 0
mov dword [rsp + 0x228], 0
mov qword [rsp + 0x230], 8
movdqu xmmword [rsp + 0x238], xmm7
mov byte [rsp + 0x248], 0
movdqu xmmword [rsp + 0x190], xmm6
movdqu xmmword [rsp + 0x1a0], xmm7
movdqu xmmword [rsp + 0x1b0], xmm7
mov qword [rsp + 0x130], 0
movdqa xmmword [rsp + 0x6a0], xmm7
movdqa xmmword [rsp + 0x6d0], xmm7
movdqa xmmword [rsp + 0x6c0], xmm7
movdqa xmmword [rsp + 0x6b0], xmm7
mov dword [rsp + 0x6a0], 0x40
lea rcx, [rsp + 0x6a0]
call sub.KERNEL32.dll_GlobalMemoryStatusEx
test eax, eax
jne 0x140005d3d
call sub.KERNEL32.dll_GetLastError
movups xmm0, xmmword [rsp + 0x6a8]
movups xmmword [rsp + 0x1a0], xmm0
movdqa xmmword [rsp + 0x6f0], xmm7
movdqa xmmword [rsp + 0x6e0], xmm7
movdqa xmmword [rsp + 0x6d0], xmm7
movdqa xmmword [rsp + 0x6c0], xmm7
movdqa xmmword [rsp + 0x6b0], xmm7
movdqa xmmword [rsp + 0x6a0], xmm7
mov qword [rsp + 0x700], 0
lea rcx, [rsp + 0x6a0]
mov edx, 0x68
call sub.KERNEL32.dll_K32GetPerformanceInfo
test eax, eax
je 0x140005e04
mov rdx, qword [rsp + 0x6b0]
mov r9, qword [rsp + 0x6c0]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rsp + 0x6f0]
mov rax, rcx
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rsp + 0x6a8]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rsp + 0x1b0], r8
mov qword [rsp + 0x1b8], rax
movabs rdi, 0x202020202020101
lea rsi, [rsp + 0x130]
mov rcx, rsi
call fcn.1400f6670
mov byte [rsp + 0x6a0], 1
mov qword [rsp + 0x6a1], rdi
lea rbx, [rsp + 0x6a0]
mov rcx, rsi
mov rdx, rbx
call fcn.1400f6a70
lea rcx, [rsp + 0xa60]
mov r8d, 0x120
mov rdx, rsi
call sub.msvcrt.dll_memcpy
pxor xmm6, xmm6
movdqa xmmword [rsp + 0x130], xmm6
movdqa xmmword [rsp + 0x160], xmm6
movdqa xmmword [rsp + 0x150], xmm6
movdqa xmmword [rsp + 0x140], xmm6
mov dword [rsp + 0x130], 0x40
lea rcx, [rsp + 0x130]
call sub.KERNEL32.dll_GlobalMemoryStatusEx
test eax, eax
jne 0x140005ea0
call sub.KERNEL32.dll_GetLastError
movups xmm0, xmmword [rsp + 0x138]
movups xmmword [rsp + 0xad0], xmm0
movdqa xmmword [rsp + 0x180], xmm6
movdqa xmmword [rsp + 0x170], xmm6
movdqa xmmword [rsp + 0x160], xmm6
movdqa xmmword [rsp + 0x150], xmm6
movdqa xmmword [rsp + 0x140], xmm6
movdqa xmmword [rsp + 0x130], xmm6
mov qword [rsp + 0x190], 0
lea rcx, [rsp + 0x130]
mov edx, 0x68
call sub.KERNEL32.dll_K32GetPerformanceInfo
test eax, eax
je 0x140005f67
mov rdx, qword [rsp + 0x140]
mov r9, qword [rsp + 0x150]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rsp + 0x180]
mov rax, rcx
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rsp + 0x138]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rsp + 0xae0], r8
mov qword [rsp + 0xae8], rax
lea rsi, [rsp + 0xa60]
mov rcx, rsi
call fcn.1400f6670
mov byte [rsp + 0x130], 1
mov qword [rsp + 0x131], rdi
lea r14, [rsp + 0x130]
mov rcx, rsi
mov rdx, r14
call fcn.1400f6a70
mov rax, qword [rsp + 0xad8]
shr rax, 0x1f
je 0x14000c393
movabs rax, 0x8000000000000001
mov qword [rsp + 0x4e0], rax
lea rax, [0x140129656]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x94665eda0f4b7c77
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400478f0
movq xmm0, qword [rax]
movq xmm1, qword [rax + 8]
punpcklqdq xmm0, xmm1
pxor xmm0, xmmword [0x140124050]
movdqa xmmword [rsp + 0x6a0], xmm0
mov qword [rsp + 0x5b0], rbx
mov qword [rsp + 0x5b8], 0x10
lea rax, [rsp + 0x5b0]
mov qword [rsp + 0x4f0], rax
lea rax, [0x1400ef720]
mov qword [rsp + 0x4f8], rax
lea rax, str.combase.dll
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], 2
mov qword [rsp + 0x150], 0
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 1
lea rcx, [rsp + 0x130]
call fcn.1400e2d60
xor esi, esi
pxor xmm6, xmm6
lea rbp, [0x14012a230]
movabs r13, 0x30c313eda61d7ea9
lea r15, [rsp + 0x50]
jmp 0x1400060cb
inc esi
cmp esi, 0x14
je 0x140008ca4
lea rax, [0x1401201f6]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x31a6192b5b593922
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047880
movdqa xmmword [rsp + 0x1a0], xmm6
movdqa xmmword [rsp + 0x190], xmm6
movdqa xmmword [rsp + 0x180], xmm6
movdqa xmmword [rsp + 0x170], xmm6
movdqa xmmword [rsp + 0x160], xmm6
movdqa xmmword [rsp + 0x150], xmm6
movdqa xmmword [rsp + 0x140], xmm6
movdqa xmmword [rsp + 0x130], xmm6
mov qword [rsp + 0x1b0], 0
mov rcx, 0xfffffffffffffff8
nop dword [rax]
mov rdx, qword [rcx + rbp + 8]
xor rdx, qword [rax + rcx + 8]
mov qword [rsp + rcx + 0x138], rdx
add rcx, 8
cmp rcx, 0x80
jb 0x140006160
movzx eax, byte [rax + 0x88]
xor al, 0x94
mov byte [rsp + 0x1b8], al
mov r8d, 0x89
lea r12, [rsp + 0x990]
mov rcx, r12
mov rdx, r14
call sub.msvcrt.dll_memcpy
mov rcx, r14
call fcn.140071cb0
lea rcx, [rsp + 0x4f0]
mov rdx, r14
call fcn.140071160
mov rdi, qword [rsp + 0x4f0]
mov rax, qword [rsp + 0x500]
cmp eax, 0x3b9aca01
jne 0x1400061f0
mov qword [rsp + 0x5b8], rdi
mov qword [rsp + 0x5b0], 3
jmp 0x140006258
mov rcx, qword [rsp + 0x4f8]
movq xmm0, rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rcx
movq qword [rsp + 0x60], xmm0
mov qword [rsp + 0x20], 0x89
mov rcx, rbx
mov rdx, r15
lea r8, [0x14016f1c8]
mov r9, r12
call fcn.140049a30
lea rcx, [rsp + 0x5b0]
mov rdx, rbx
call fcn.1400c5350
lock dec qword [rdi]
jne 0x140006249
mov rcx, r15
call fcn.140047ec0
cmp qword [rsp + 0x5b0], 3
jne 0x1400063ce
lea rax, [0x14011f229]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x1546ad607682843f
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047720
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov r10, qword [rax + 0x20]
movzx r11d, byte [rax + 0x2a]
movzx eax, word [rax + 0x28]
mov edi, eax
shr edi, 8
xor al, 0xf2
xor dil, 0xcc
movzx eax, al
movzx edi, dil
shl edi, 8
or edi, eax
movabs rax, 0x88bd7369e7cc81b4
xor rcx, rax
mov qword [rsp + 0x6a0], rcx
movabs rax, 0x6f5f53affcd84021
xor rdx, rax
mov qword [rsp + 0x6a8], rdx
movabs rax, 0xedc2afc72074d67a
xor r8, rax
mov qword [rsp + 0x6b0], r8
movabs rax, 0xff05444fbf78689a
xor r9, rax
mov qword [rsp + 0x6b8], r9
xor r10, r13
mov qword [rsp + 0x6c0], r10
mov word [rsp + 0x6c8], di
xor r11b, 0x6d
mov byte [rsp + 0x6ca], r11b
mov qword [rsp + 0x4f0], rbx
mov qword [rsp + 0x4f8], 0x2b
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x50], rax
lea rax, [0x1400ef720]
mov qword [rsp + 0x58], rax
lea rax, str.combase.dll
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], 2
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x140], r15
mov qword [rsp + 0x148], 1
mov rcx, r14
call fcn.1400e2ec0
mov ecx, 0xf
call fcn.1400e33d0
cmp dword [rsp + 0x5b0], 3
jne 0x1400060c0
lea rcx, [rsp + 0x5b0]
call fcn.140001450
jmp 0x1400060c0
lea rcx, [rsp + 0xba0]
lea rsi, [rsp + 0x5b0]
mov r8d, 0xc0
mov rdx, rsi
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x4f0]
mov r8d, 0x98
mov rdx, rsi
call sub.msvcrt.dll_memcpy
mov ebp, dword [rsp + 0xc40]
cmp ebp, 0x3b9aca00
jne 0x14000641b
mov ebp, 0x3b9aca00
jmp 0x14000651e
mov r14, qword [rsp + 0xc38]
mov qword [rsp + 0x130], 0
lea rcx, [rsp + 0x130]
call sub.KERNEL32.dll_QueryPerformanceCounter
test eax, eax
je 0x14000c380
mov rsi, qword [rsp + 0x130]
mov rcx, qword [0x1401a4140]
test rcx, rcx
jne 0x140006491
mov qword [rsp + 0x130], 0
lea rcx, [rsp + 0x130]
call sub.KERNEL32.dll_QueryPerformanceFrequency
test eax, eax
je 0x14000c380
mov rcx, qword [rsp + 0x130]
mov qword [0x1401a4140], rcx
test rcx, rcx
je 0x14000c1e6
mov rax, rsi
or rax, rcx
shr rax, 0x20
je 0x1400064a7
mov rax, rsi
xor edx, edx
div rcx
jmp 0x1400064ad
mov eax, esi
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x1400064d1
xor edx, edx
div rcx
mov rcx, rax
jmp 0x1400064d7
xor edx, edx
div ecx
mov ecx, eax
add rcx, r8
mov rax, rcx
shr rax, 9
movabs rdx, 0x44b82fa09b5a53
mul rdx
shr rdx, 0xb
add r14, rdx
jb 0x14000c1e6
imul rax, rdx, 0x3b9aca00
sub rcx, rax
add ebp, ecx
cmp ebp, 0x3b9aca00
jb 0x14000651e
inc r14
je 0x14000c1e6
add ebp, 0xc4653600
call fcn.1400f0e40
test rax, rax
je 0x14000c1e6
mov rsi, rax
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x14000655a
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x14000c1e6
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x18
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000c1e6
mov qword [rax], 1
mov qword [rax + 8], 1
mov rcx, rax
add rcx, 0x10
mov qword [rax + 0x10], rsi
lea rax, fcn.1400a5a00
mov qword [rsp + 0x680], rax
mov qword [rsp + 0x688], rcx
lea rax, [rsp + 0x680]
mov qword [rsp + 0x670], rax
lea rcx, [rsp + 0x130]
lea rdx, [rsp + 0x4f0]
mov r8d, 0x98
call sub.msvcrt.dll_memcpy
lea rax, str.utf_8
mov qword [rsp + 0x1c8], rax
mov qword [rsp + 0x1d0], 5
lea r13, [rsp + 0x1d8]
lea rdx, [rsp + 0x6a0]
mov r8d, 0x2e8
mov rcx, r13
call sub.msvcrt.dll_memcpy
mov byte [rsp + 0x4c0], 0
mov eax, dword [rsp + 0x989]
mov ecx, dword [rsp + 0x98c]
mov dword [rsp + 0x4c1], eax
mov dword [rsp + 0x4c4], ecx
lea r12, [rsp + 0x2d8]
lea rdi, [rsp + 0x50]
pxor xmm6, xmm6
movdqa xmm7, xmmword [0x1401240b0]
movdqa xmm8, xmmword [0x1401240c0]
movdqa xmm9, xmmword [0x1401240d0]
movdqa xmm10, xmmword [0x140124080]
movdqa xmm11, xmmword [0x140124090]
movdqa xmm12, xmmword [0x1401240a0]
movdqa xmm13, xmmword [0x140124060]
movdqa xmm14, xmmword [0x140124070]
xor eax, eax
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x40], r14
test al, al
je 0x1400066b0
movzx eax, al
cmp eax, 3
je 0x140007477
jmp 0x14000c1e6
mov r8d, 0x98
mov rcx, r13
lea rdx, [rsp + 0x130]
call sub.msvcrt.dll_memcpy
mov r12, qword [rsp + 0x1c8]
mov rbx, qword [rsp + 0x1d0]
movups xmm0, xmmword [0x140170c00]
movaps xmmword [rsp + 0x60], xmm0
movdqu xmm0, xmmword [0x140170bf0]
movdqa xmmword [rsp + 0x50], xmm0
mov rcx, r13
mov rdx, rdi
call fcn.140091910
mov rsi, rax
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x14000671a
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
lea rcx, [rsp + 0x68]
call qword [rax + 0x10]
test rsi, rsi
je 0x14000674a
mov r14, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
lea r9, [r14 + r13]
xor eax, eax
nop dword [rax]
cmp r13, rax
je 0x140006770
movzx ecx, byte [r14 + rax]
inc rax
cmp cl, 9
je 0x140006730
add cl, 0xe0
cmp cl, 0x5f
jb 0x140006730
mov qword [rsp + 0x270], 2
xor r8d, r8d
lea r14, [0x1401240e0]
jmp 0x1400073e0
mov qword [rsp + 0x98], rbx
cmp r13, 3
jne 0x140006798
movzx eax, word [r14]
xor eax, 0x2f2a
movzx ecx, byte [r14 + 2]
xor ecx, 0x2a
or cx, ax
je 0x140006904
xor eax, eax
nop word [rax + rax]
cmp r13, rax
je 0x140007030
mov rsi, rax
movzx ecx, byte [r14 + rax]
inc rax
lea rdx, [0x14016f340]
cmp byte [rcx + rdx], 0
jne 0x1400067a0
cmp cl, 0x2f
jne 0x140007030
test rsi, rsi
je 0x140007030
lea rbp, [r14 + rsi]
inc rbp
mov rbx, rax
xor r10d, r10d
cmp rbp, r9
jne 0x1400068bf
mov eax, dword [0x14016f31c]
mov dword [rsp + 0xb3], eax
mov eax, dword [0x14016f319]
mov dword [rsp + 0xb0], eax
mov esi, 1
mov r13d, 3
mov edi, 2
xor r11d, r11d
xor r15d, r15d
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov qword [rsp + 0x30], rcx
lea rbp, [0x140171f90]
xor r9d, r9d
xor ecx, ecx
xor edx, edx
lea r14, [0x1401240e0]
jmp 0x1400070e3
mov qword [rsp + 0x270], 2
xor r8d, r8d
lea rdi, [rsp + 0x50]
mov ebp, dword [rsp + 0x38]
lea r14, [0x1401240e0]
mov rbx, qword [rsp + 0x98]
jmp 0x1400073e0
mov r8d, dword [rsp + 0xb3]
mov dword [rsp + 0xeb], r8d
mov r8d, dword [rsp + 0xb0]
mov dword [rsp + 0xe8], r8d
shl rdx, 0x10
movzx ecx, cl
shl rcx, 8
or rcx, rdx
movzx edx, r9b
or rdx, rcx
mov qword [rsp + 0x270], r11
mov qword [rsp + 0x278], rdx
mov qword [rsp + 0x280], rdi
mov qword [rsp + 0x88], r10
mov qword [rsp + 0x288], r10
mov qword [rsp + 0x290], r15
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x298], rax
mov qword [rsp + 0x2a0], rbx
mov rax, qword [rsp + 0x30]
mov byte [rsp + 0x2a8], al
mov eax, dword [rsp + 0xeb]
lea rcx, [rsp + 0x130]
mov dword [rcx + 0x17c], eax
mov eax, dword [rsp + 0xe8]
mov dword [rcx + 0x179], eax
mov qword [rsp + 0x2b0], rbp
mov qword [rsp + 0x2b8], r13
mov qword [rsp + 0x2c0], r13
mov qword [rsp + 0x2c8], rsi
mov qword [rsp + 0x120], rbx
mov rax, rbx
shl rax, 5
add rax, r15
mov qword [rsp + 0x48], r15
mov rbx, qword [rsp + 0x98]
nop dword [rax]
test rdi, rdi
je 0x140007230
cmp rdi, 1
jne 0x1400073c5
cmp rax, r15
je 0x1400073c5
mov edi, 2
mov edx, 5
lea r9, str.charset
lea r8, str.utf_8
jmp 0x1400072d6
movzx r10d, byte [r9]
lea r11d, [r10 - 0x41]
cmp r11b, 0x1a
setb r11b
shl r11b, 5
or r11b, r10b
cmp r11b, 0x63
jne 0x1400071d0
xor r8d, r8d
lea rdi, [rsp + 0x50]
mov ebp, dword [rsp + 0x38]
nop word cs:[rax + rax]
test r8, r8
cmovne r12, r8
cmove rdx, rbx
lea rax, [rsp + 0x68]
movdqu xmmword [rax - 0x17], xmm6
mov word [rax - 7], 0
test rdx, rdx
lea r13, [rsp + 0x1d8]
je 0x140007439
lea rcx, [r12 + rdx]
inc r12
nop
movzx eax, byte [r12 - 1]
mov r8d, eax
add r8d, 0xfffffff7
cmp r8d, 0x56
ja case.0x14000742e.11
movsxd r8, dword [r14 + r8*4]
add r8, r14
jmp r8
inc r12
dec rdx
jne 0x140007410
xor eax, eax
mov r14, qword [rsp + 0x40]
lea r12, [rsp + 0x2d8]
test rax, rax
lea rcx, [0x14012b9f8]
cmove rax, rcx
mov qword [rsp + 0x2d0], rax
mov r8d, 0x98
mov rcx, r12
mov rdx, r13
call sub.msvcrt.dll_memcpy
mov byte [rsp + 0x4b8], 0
mov rcx, rdi
mov rdx, r12
lea r8, [rsp + 0x670]
call fcn.1400a5bc0
cmp qword [rsp + 0x50], 0
je 0x14000807e
mov byte [rsp + 0x4c0], 3
cmp ebp, 0x3b9aca00
jne 0x1400074c0
call fcn.1400e3480
movzx eax, byte [rsp + 0x4c0]
test al, al
jne 0x140006690
jmp 0x1400066b0
mov qword [rsp + 0x50], 0
mov rcx, rdi
call sub.KERNEL32.dll_QueryPerformanceCounter
test eax, eax
je 0x14000c380
mov rsi, qword [rsp + 0x50]
mov r8, qword [0x1401a4140]
test r8, r8
jne 0x140007518
mov qword [rsp + 0x50], 0
mov rcx, rdi
call sub.KERNEL32.dll_QueryPerformanceFrequency
test eax, eax
je 0x14000c380
mov rax, rsi
or rax, r8
shr rax, 0x20
je 0x140007540
lea edx, [rax - 0x41]
cmp dl, 0x1a
jae 0x140007618
add eax, 0x20
jmp case.0x14000742e.45
lea edx, [rax - 0x61]
cmp dl, 0x1a
jb case.0x14000742e.45
lea edx, [rax - 0x30]
cmp dl, 0xa
jae 0x140007439
nop dword [rax]
mov byte [rsp + 0x50], al
mov eax, 1
cmp r12, rcx
je 0x140007730
nop word cs:[rax + rax]
movzx edx, byte [r12 + rax - 1]
mov r8d, edx
add r8d, 0xfffffff7
cmp r8d, 0x56
ja 0x1400076a3
mov edx, 0xe4
xor r8d, r8d
mov ecx, 0xe4
mov r14, qword [rsp + 0x40]
lea r12, [rsp + 0x2d8]
jmp 0x14000775e
mov rbx, qword [rsp + 0x58]
mov r14, qword [rsp + 0x60]
movdqu xmm0, xmmword [rsp + 0x68]
movdqa xmmword [rsp + 0x690], xmm0
mov rcx, r12
call fcn.1400a63d0
test rbx, rbx
je 0x1400080f3
movdqa xmm0, xmmword [rsp + 0x690]
movdqu xmmword [rsp + 0xb90], xmm0
mov qword [rsp + 0xb80], rbx
mov qword [rsp + 0xb88], r14
mov rsi, qword [rsp + 0x2d0]
mov r13, qword [rsp + 0xb90]
cmp r13, 3
jae 0x14000815b
cmp r13, 2
je 0x140008178
mov qword [rsp + 0x38], r14
mov r12, r13
jmp 0x140008269
cmp dword [rsp + 0x270], 2
je 0x140008153
cmp byte [rsp + 0x2a8], 0
je 0x140008128
cmp qword [rsp + 0x2b8], 0
je 0x140008128
cmp dword [rsp + 0x280], 1
jne 0x140008153
mov r15, r14
jmp 0x140008b7f
movzx eax, word [r14]
xor eax, 0xbbef
movzx ecx, byte [r14 + 2]
xor ecx, 0xbf
or cx, ax
je 0x140008246
movzx ecx, word [r14]
mov eax, 2
cmp ecx, 0xfeff
je 0x14000823d
lea rcx, [0x140170bb0]
mov eax, 3
mov r12, r13
sub r12, rax
jb 0x14000c1e6
mov r8, r13
jmp 0x140004f10
xor ebp, ebp
mov rax, qword [rsp + 0x680]
mov rcx, qword [rsp + 0x688]
call qword [rax + 0x18]
test rbp, rbp
jne 0x140008c04
lea rax, [0x14012201f]
mov qword [rsp + 0x130], rax
lea r14, [rsp + 0x130]
mov rcx, qword [rsp + 0x130]
movabs rax, 0x7c18cb79c391832b
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400479a0
movabs rcx, 0xaae7984d2196d8ac
xor rcx, qword [rax]
movabs rdx, 0x7e2483b3642c83fa
xor rdx, qword [rax + 8]
movabs r8, 0xbb91e147240007da
xor r8, qword [rax + 0x10]
movabs r9, 0x7654d2c709111fb
xor r9, qword [rax + 0x18]
movabs r10, 0x99e0e6b976d3d3cc
xor r10, qword [rax + 0x20]
movabs r11, 0xbaaf116723c70062
xor r11, qword [rax + 0x28]
movabs rsi, 0xbf57da8448f879e6
xor rsi, qword [rax + 0x30]
mov edi, 0xc4e86867
xor edi, dword [rax + 0x38]
movzx ebx, byte [rax + 0x3e]
movzx eax, word [rax + 0x3c]
mov ebp, eax
shr ebp, 8
xor al, 0x35
xor bpl, 0x7e
movzx eax, al
movzx ebp, bpl
shl ebp, 8
or ebp, eax
mov qword [rsp + 0x130], rcx
mov qword [rsp + 0x138], rdx
mov qword [rsp + 0x140], r8
mov qword [rsp + 0x148], r9
mov qword [rsp + 0x150], r10
mov qword [rsp + 0x158], r11
mov qword [rsp + 0x160], rsi
mov dword [rsp + 0x168], edi
mov word [rsp + 0x16c], bp
xor bl, 0x79
mov byte [rsp + 0x16e], bl
mov qword [rsp + 0x5b0], r14
lea rax, [rsp + 0x5b0]
mov qword [rsp + 0x4f0], rax
lea rax, [0x1400ef720]
mov qword [rsp + 0x4f8], rax
lea rax, str.combase.dll
mov qword [rsp + 0x6a0], rax
mov qword [rsp + 0x6a8], 2
mov qword [rsp + 0x6c0], 0
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x6b0], rax
mov qword [rsp + 0x5b8], 0x3f
mov qword [rsp + 0x6b8], 1
lea rcx, [rsp + 0x6a0]
call fcn.1400e2ec0
call fcn.14002e920
mov ecx, 0x190
call fcn.1400e8820
ud2
ud2
lea rax, [0x14011fec8]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0xf7981373456d0298
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.140047a80
movabs rcx, 0x5ad67e1639a89113
xor rcx, qword [rax]
movabs rdx, 0x16528fa8378a671c
xor rdx, qword [rax + 8]
movabs r8, 0x111628e3b352231b
xor r8, qword [rax + 0x10]
movabs r9, 0xcbd49f03554e7e26
xor r9, qword [rax + 0x18]
movabs r10, 0x9d9359cd5eaeb039
xor r10, qword [rax + 0x20]
mov r11d, 0x23fad198
xor r11d, dword [rax + 0x28]
mov qword [rsp + 0x6a0], rcx
mov qword [rsp + 0x6a8], rdx
mov qword [rsp + 0x6b0], r8
mov qword [rsp + 0x6b8], r9
mov qword [rsp + 0x6c0], r10
mov dword [rsp + 0x6c8], r11d
mov qword [rsp + 0xa60], rbp
mov qword [rsp + 0xa68], 0x2c
lea rax, [rsp + 0xa60]
mov qword [rsp + 0x5b0], rax
lea rax, [0x1400ef720]
mov qword [rsp + 0x5b8], rax
lea rax, str.combase.dll
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], 2
mov qword [rsp + 0x150], 0
lea rax, [rsp + 0x5b0]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 1
lea rcx, [rsp + 0x130]
call fcn.1400e2ec0
call fcn.14002e920
mov ecx, 0x64
call fcn.1400e8820
ud2
call sub.KERNEL32.dll_GetLastError
ud2
lea rax, [0x140123a6e]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x2ed87efc4af01350
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400470a0
movabs rcx, 0x71342c483157a79a
xor rcx, qword [rax]
movabs rdx, 0xa02e9e10631794d6
xor rdx, qword [rax + 8]
movabs r8, 0xa68faca80e785b26
xor r8, qword [rax + 0x10]
movabs r9, 0xfb2dccb8304a2185
xor r9, qword [rax + 0x18]
mov r10d, 0x15e75145
xor r10d, dword [rax + 0x20]
movzx eax, byte [rax + 0x24]
xor al, 0xe2
mov qword [rsp + 0x6a0], rcx
mov qword [rsp + 0x6a8], rdx
mov qword [rsp + 0x6b0], r8
mov qword [rsp + 0x6b8], r9
mov dword [rsp + 0x6c0], r10d
mov byte [rsp + 0x6c4], al
mov qword [rsp + 0x5b0], rbx
mov qword [rsp + 0x5b8], 0x25
lea rax, [rsp + 0x5b0]
mov qword [rsp + 0x4f0], rax
lea rax, [0x1400ef720]
mov qword [rsp + 0x4f8], rax
lea rax, str.combase.dll
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], 2
mov qword [rsp + 0x150], 0
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 1
lea rcx, [rsp + 0x130]
call fcn.1400e2ec0
mov ecx, 0x12c
call fcn.1400e8820
ud2