Function at 0x1400249c0
Capabilities:
Check for debugger via api
Check for process debug object
Check for time delay via queryperformancecounter
Check processdebugflags
Check processdebugport
Create process on windows
Encode data using base64
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x218
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x180], xmm6
mov eax, dword [0x141dc3408]
and eax, dword [0x141dc340c]
add eax, 0xb76f7399
and eax, 0xb7d9342d
cmp eax, 0x54ca60c1
ja 0x140024af4
mov eax, dword [0x141dc3410]
xor eax, dword [0x141dc3414]
imul eax, eax, 0xc9ff7b2b
mov ecx, 0x8a7f1deb
imul rcx, rax
shr rcx, 0x3c
or ecx, 0x876ecd60
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov r11, rsp
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov rsi, rsp
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov r14, rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov r12, rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov rdx, rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov r8, rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov r10, rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov rbx, rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov rax, rsp
cmp ecx, 0x2d3dd715
jae 0x140024b95
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
jmp 0x140024a03
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0xf8], rdi
mov qword [rbp + 0x168], rsi
mov qword [rbp + 0x28], r11
mov qword [rbp + 0x60], r10
mov qword [rbp + 0x70], r9
mov qword [rbp + 0x58], r8
mov qword [rbp + 0x68], rdx
mov eax, dword [0x141dc3418]
and eax, dword [0x141dc341c]
cmp eax, 0xa3975d8
jne 0x140024d4e
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov qword [r12], 0
mov dword [r14], 0
mov dword [r15], 0
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 8
mov r8, r12
call sub.ADVAPI32.dll_OpenProcessToken
add rsp, 0x20
mov qword [rbp + 0x148], r14
mov qword [rbp + 0x150], r15
mov qword [rbp + 0x158], r12
mov r13, qword [rbp + 0x158]
nop word [rax + rax]
mov edi, dword [0x141dc3420]
or edi, dword [0x141dc3424]
add edi, 0x751dbf19
imul rax, rdi, 0x2d0c4dc9
shr rax, 0x20
sub edi, eax
shr edi, 1
add edi, eax
shr edi, 0x1f
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp - 0x40], rsp
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp - 0x38], rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp - 0x30], rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp - 0x28], rsp
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp - 0x20], rsp
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp + 0x118], rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp], rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp + 8], rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp + 0x130], rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp + 0x138], rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp + 0x140], rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp - 0x10], rsp
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp - 0x18], rsp
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp + 0x120], rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp + 0x160], rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp + 0x128], rsp
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp - 8], rsp
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp + 0x10], rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp + 0x18], rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp + 0x20], rsp
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov r12, rsp
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov rbx, rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov r15, rsp
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov r14, rsp
mov qword [r13], 0
mov rax, qword [rbp + 0x148]
mov dword [rax], 0
mov rax, qword [rbp + 0x150]
mov dword [rax], 0
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 8
mov r8, r13
call sub.ADVAPI32.dll_OpenProcessToken
add rsp, 0x20
cmp edi, 0x4ea82b39
ja 0x140024d70
mov rdi, qword [rbp + 0x128]
mov r13, qword [rbp + 0x120]
mov rcx, qword [rbp + 0x158]
mov rdx, qword [rbp + 0x150]
mov qword [rbp + 0x78], r12
mov qword [rbp + 0x170], r14
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x40], rbx
test eax, eax
mov rsi, qword [rbp + 0x148]
je 0x1400251ef
mov rcx, qword [rcx]
sub rsp, 0x30
mov qword [rsp + 0x20], rdx
mov edx, 0x14
mov r8, rsi
mov r9d, 4
call sub.ADVAPI32.dll_GetTokenInformation
add rsp, 0x30
test eax, eax
je 0x1400251ef
mov eax, dword [rsi]
mov rbx, qword [rbp + 0x170]
mov r14, qword [rbp + 0x118]
nop word [rax + rax]
mov ecx, dword [0x141dc3440]
sub ecx, dword [0x141dc3444]
and ecx, 0x800188c
xor ecx, 0x840318
cmp ecx, 0xd76b0bdc
ja 0x140025020
test eax, eax
mov rsi, rdi
mov rdi, qword [rbp + 0x160]
mov rdx, qword [rbp + 0x140]
mov rcx, qword [rbp - 0x10]
je 0x140025283
lea rax, [0x141da53be]
mov qword [rcx], rax
mov rcx, qword [rcx]
movabs rax, 0x28ee358551049bf3
mov qword [rdx], rax
mov rdx, qword [rdx]
sub rsp, 0x20
call fcn.140018ad0
add rsp, 0x20
movabs rcx, 0x6473f65616740f59
xor rcx, qword [rax]
movabs rdx, 0x5c3c7d014d9e5a4a
xor rdx, qword [rax + 8]
movabs r8, 0x4259c9f0a01aad2f
xor r8, qword [rax + 0x10]
movabs r9, 0x3bbd058d17997c23
xor r9, qword [rax + 0x18]
movabs r10, 0x3021bc15fa91e96b
xor r10, qword [rax + 0x20]
mov r11d, 0xf3c0e744
xor r11d, dword [rax + 0x28]
movzx eax, byte [rax + 0x2c]
xor al, 0xd0
mov qword [r13], rcx
mov qword [r13 + 8], rdx
mov qword [r13 + 0x10], r8
mov qword [r13 + 0x18], r9
mov qword [r13 + 0x20], r10
mov dword [r13 + 0x28], r11d
mov byte [r13 + 0x2c], al
mov qword [rdi], r13
mov qword [rdi + 8], 0x2d
mov qword [rsi], rdi
lea rax, [0x14008b440]
mov qword [rsi + 8], rax
lea rax, [0x140102eb0]
mov rdi, qword [rbp - 8]
mov qword [rdi], rax
mov qword [rdi + 8], 2
mov qword [rdi + 0x20], 0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 1
mov eax, dword [0x141dc36e8]
imul eax, dword [0x141dc36ec]
add eax, 0x22ffd4da
shr eax, 2
imul rax, rax, 0x63380ed1
shr rax, 0x3a
cmp eax, 0x86f91e3a
jbe 0x140025180
sub rsp, 0x20
mov rcx, rdi
call fcn.14009ee10
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [str.k_a_]
sub eax, dword [0x141dc36f4]
xor eax, 0x21e7d3e0
imul esi, eax, 0xd6fd80d7
xor esi, 0x8f0b9f6
sub rsp, 0x20
mov rcx, rdi
call fcn.14009ee10
add rsp, 0x20
cmp esi, 0xf40b67dd
ja 0x140025180
nop word cs:[rax + rax]
mov eax, dword [0x141dc36f8]
xor eax, dword [0x141dc36fc]
imul eax, eax, 0x78ac4e59
imul rax, rax, 0x173705b1
shr rax, 0x3c
imul eax, eax, 0xc76a2fcb
cmp eax, 0xaddce69
jae 0x1400251c0
jmp case.0x140026645.0
mov rbx, qword [rbp + 0x170]
mov r14, qword [rbp + 0x118]
nop dword [rax]
mov eax, dword [0x141dc3428]
and eax, dword [str.uOsYW_n]
or eax, 0x8a0fca97
add eax, 0xaf8a0823
and eax, 0xf132def8
cmp eax, 0x85ff4cd3
ja 0x140025200
mov ecx, 0x83de5c0b
nop word [rax + rax]
mov eax, dword [0x141dc3430]
xor edx, edx
div dword [0x141dc3434]
imul eax, eax, 0x5ff6e668
add eax, 0x56a9ccd2
shr eax, 1
imul rax, rcx
shr rax, 0x3d
cmp eax, 0x40cc09c3
je 0x140025230
nop word [rax + rax]
mov eax, dword [0x141dc3438]
add eax, dword [0x141dc343c]
imul eax, eax, 0x6798ea95
add eax, 0x9559d068
and eax, 0x7bb9a52
cmp eax, 0xcff80208
ja 0x140025260
mov eax, dword [0x141dc3448]
xor edx, edx
div dword [0x141dc344c]
nop word cs:[rax + rax]
mov eax, dword [0x141dc3450]
xor eax, dword [0x141dc3454]
or eax, 0x36feb5ef
cmp eax, 0x25e94fca
jb 0x1400252a0
mov eax, dword [0x141dc3458]
xor edx, edx
div dword [0x141dc345c]
nop word cs:[rax + rax]
mov eax, dword [0x141dc3460]
add eax, dword [0x141dc3464]
imul eax, eax, 0xa49cf52f
add eax, 0xea188616
or eax, 0x282af886
cmp eax, 0x9a59b94d
ja 0x1400252d0
movabs rax, 0x8000000000000001
dec rax
mov qword [rbp + 0x140], rax
xorps xmm6, xmm6
lea r13, [0x14008b440]
lea r12, [0x140102eb0]
jmp 0x140025337
sub rsp, 0x20
xor edx, edx
mov r8, qword [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
sub rsp, 0x20
mov rcx, r14
call fcn.140091170
add rsp, 0x20
mov rsi, qword [r14]
mov r15, qword [r14 + 8]
cmp rsi, qword [rbp + 0x140]
je 0x1400264f4
mov eax, dword [0x141dc3468]
or eax, dword [0x141dc346c]
cmp eax, 0x42e1ac14
mov rbx, qword [rbp - 0x40]
je 0x1400253b7
nop word cs:[rax + rax]
mov edi, dword [0x141dc3470]
add edi, dword [0x141dc3474]
xor edi, 0x4b010041
or edi, 0x945e799a
mov r8, qword [r14 + 0x10]
sub rsp, 0x20
mov rcx, rbx
mov rdx, r15
call fcn.140053600
add rsp, 0x20
cmp edi, 0xa26899c2
jne 0x1400253d0
mov r8, qword [r14 + 0x10]
sub rsp, 0x20
mov rcx, rbx
mov rdx, r15
call fcn.140053600
add rsp, 0x20
jmp 0x140025380
mov rax, qword [rbx]
nop word cs:[rax + rax]
mov ecx, dword [0x141dc3478]
xor ecx, dword [0x141dc347c]
xor ecx, 0xca708c33
imul rdx, rcx, 0x4cd96049
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1c
and ecx, 0xfffffffe
cmp ecx, 0x80a6312b
ja 0x1400253e0
test rax, rax
jne 0x140026aab
mov r13, qword [rbx + 8]
mov rbx, qword [rbx + 0x10]
nop word cs:[rax + rax]
mov eax, dword [0x141dc3480]
sub eax, dword [0x141dc3484]
imul eax, eax, 0xf21765f3
and eax, 0x24776940
add eax, 0xadbacd22
cmp eax, 0x596c929a
jb 0x140025430
test rbx, rbx
js 0x1400269d7
mov eax, dword [str._J_W_Z]
imul eax, dword [0x141dc349c]
and eax, 0x25836fd9
imul eax, eax, 0x970d5eb0
cmp eax, 0x41714ae6
je 0x14002545c
nop dword [rax + rax]
mov eax, dword [0x141dc34a0]
xor eax, dword [0x141dc34a4]
imul eax, eax, 0xf8bc6168
add eax, 0xa6364e50
cmp eax, 0x74b9e96
jb 0x140025480
test rbx, rbx
je 0x140025570
mov eax, dword [0x141dc34a8]
xor edx, edx
div dword [0x141dc34ac]
imul eax, eax, 0x3b514095
mov ecx, 0xa1e9a927
imul rax, rcx
shr rax, 0x3f
imul eax, eax, 0x94266e83
cmp eax, 0x5bd503ef
jne 0x1400254f0
movzx eax, byte [0x141ddb9b8]
sub rsp, 0x20
xor ecx, ecx
mov rdx, rbx
call fcn.1400bf820
add rsp, 0x20
nop
mov eax, dword [0x141dc34b0]
or eax, dword [0x141dc34b4]
imul edi, eax, 0x1e80e213
add edi, 0xad3bfc37
xor edi, 0x4ed82b90
movzx eax, byte [0x141ddb9b8]
sub rsp, 0x20
xor ecx, ecx
mov rdx, rbx
call fcn.1400bf820
add rsp, 0x20
cmp edi, 0xcbae5581
ja 0x1400254f0
mov r14, rax
nop word cs:[rax + rax]
mov eax, dword [0x141dc34b8]
sub eax, dword [0x141dc34bc]
or eax, 0x66895dad
add eax, 0xfe451686
and eax, 0xfe37c621
cmp eax, 0x714f7c06
jb 0x140025540
test r14, r14
jne 0x140025576
jmp 0x140026ab6
mov r14d, 1
sub rsp, 0x20
mov rcx, r14
mov rdx, r13
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rsp, 0x20
mov rax, qword [rbp + 0xf8]
mov qword [rax], 0
mov qword [rax + 8], 1
mov qword [rax + 0x10], 0
lea rax, [r14 + rbx]
mov rdx, qword [rbp + 0x28]
mov qword [rdx], r14
mov qword [rdx + 8], rax
mov word [rdx + 0x10], 0
mov dword [rdx + 0x18], 1
sub rsp, 0x20
mov rdi, qword [rbp + 0x168]
mov rcx, rdi
call fcn.140083030
add rsp, 0x20
mov qword [rbp - 0x78], 1
mov qword [rbp - 0x70], 1
mov word [rbp - 0x68], 0
mov dword [rbp - 0x60], 1
sub rsp, 0x20
lea rcx, [rbp - 0x58]
lea rdx, [rbp - 0x78]
call fcn.140083030
add rsp, 0x20
mov rdx, qword [rdi + 8]
mov rcx, qword [rbp - 0x50]
mov dword [rbp + 0x17c], 0
movaps xmmword [rbp + 0xe0], xmm6
movaps xmmword [rbp + 0xd0], xmm6
movaps xmmword [rbp + 0xc0], xmm6
movaps xmmword [rbp + 0xb0], xmm6
movaps xmmword [rbp + 0xa0], xmm6
movaps xmmword [rbp + 0x90], xmm6
movaps xmmword [rbp + 0x80], xmm6
mov al, 1
test al, al
je 0x140026a3c
mov qword [rbp + 0x148], rdx
mov qword [rbp + 0x128], rcx
mov qword [rbp + 0x120], r14
mov qword [rbp + 0x158], rbx
mov qword [rbp + 0x150], rsi
mov qword [rbp + 0x160], r15
movzx eax, byte [0x141ddb9b8]
sub rsp, 0x20
mov edx, 8
xor ecx, ecx
call fcn.1400bf820
add rsp, 0x20
test rax, rax
je 0x140026a96
mov rcx, rax
mov word [rax], 0x72
mov eax, 4
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], rcx
mov qword [rbp + 0x110], 1
mov eax, 1
xor r15d, r15d
lea rbx, [0x141db90f3]
nop
mov r12d, r15d
mov r13, rax
mov eax, dword [0x141dc34f0]
sub eax, dword [0x141dc34f4]
imul rax, rax, 0x47c2a7
shr rax, 0x36
or eax, 0xa3160f9e
cmp eax, 0x47e21f2a
je 0x1400256e6
test r12w, r12w
je 0x140025730
xor r15d, r15d
cmp r13, qword [rbp + 0x100]
je 0x140025949
jmp 0x1400259e8
mov eax, dword [0x141dc34f8]
or eax, dword [0x141dc34fc]
xor eax, 0xd4dfe036
imul rax, rax, 0x63de0735
shr rax, 0x37
cmp eax, 0xd0ae2f67
je 0x140025730
mov r14, qword [sym.imp.ole32.dll_CoInitializeEx]
movabs r15, 0x14000000070
mov r8d, 0xdee865c1
mov rsi, qword [rbp + 0x148]
nop word cs:[rax + rax]
mov eax, dword [0x141dc3500]
mov edx, dword [0x141dc3504]
add eax, edx
add eax, 0x1c1a76e4
imul rax, r8
shr rax, 0x3f
cmp eax, 0xf4d8873f
je 0x140025780
lea rax, [0x141db90f8]
cmp rbx, rax
je 0x140025b40
mov eax, dword [0x141dc3508]
xor edx, edx
div dword [0x141dc350c]
mov eax, dword [0x141dc3510]
imul eax, dword [0x141dc3514]
xor eax, 0x610040
or eax, 0x2b9a82b1
and eax, 0xebff9bfd
cmp eax, 0xe08d50cc
je 0x1400257c0
lea r9, [rbx + 1]
nop word [rax + rax]
mov eax, dword [0x141dc3518]
or eax, dword [0x141dc351c]
cmp eax, 0xca09379
je 0x1400257f0
movzx r8d, byte [rbx]
nop word [rax + rax]
mov eax, dword [0x141dc3520]
xor edx, edx
div dword [0x141dc3524]
imul eax, eax, 0x78f8d3b8
add eax, 0x66b37c10
and eax, 0x7979f1e8
cmp eax, 0x5cd01cbd
je 0x140025810
test r8b, r8b
js 0x140025850
mov rbx, r9
jmp 0x140025936
mov eax, dword [0x141dc3528]
add eax, dword [0x141dc352c]
and eax, 0x5e1392f6
cmp eax, 0xb5334783
je 0x140025850
mov eax, r8d
and eax, 0x1f
movzx r9d, byte [rbx + 1]
and r9d, 0x3f
cmp r8b, 0xdf
jbe 0x140025929
movzx edx, byte [rbx + 2]
shl r9d, 6
and edx, 0x3f
or edx, r9d
cmp r8b, 0xf0
jb 0x140025a1c
nop dword [rax]
mov r8d, dword [0x141dc3530]
mov r9d, dword [0x141dc3534]
add r8d, r9d
add r8d, 0x290ec61
and r8d, 0xc7a4e1e0
add r8d, 0x50807a8
cmp r8d, 0x5f35fc6b
ja 0x1400258a0
movzx r8d, byte [rbx + 3]
add rbx, 4
mov r9d, dword [0x141dc3538]
imul r9d, dword [0x141dc353c]
and r9d, 0xc2200822
imul r9d, r9d, 0x7a8b9f15
cmp r9d, 0xcc8ea5a
je 0x1400258d8
and eax, 7
shl eax, 0x12
shl edx, 6
and r8d, 0x3f
xor r9d, r9d
test r9b, r9b
jne 0x14002590b
or edx, r8d
or edx, eax
mov r8d, edx
cmp edx, 0xffff
ja 0x140025a40
jmp 0x140025936
add rbx, 2
shl eax, 6
or eax, r9d
mov r8d, eax
xor r15d, r15d
mov r12d, r8d
cmp r13, qword [rbp + 0x100]
jne 0x1400259e8
lea rax, [0x141db90f2]
sub rax, rbx
add rax, 8
movabs rcx, 0xaaaaaaaaaaaaaaab
mul rcx
mov r14, rdx
shr r14, 1
cmp r15w, 1
sbb r14, 0
add r14, 2
mov eax, dword [0x141dc3560]
sub eax, dword [0x141dc3564]
cmp eax, 0xd7ad7aa8
je 0x140025abb
lea rsi, [rbp + 0x100]
mov edi, dword [0x141dc3568]
imul edi, dword [0x141dc356c]
add edi, 0x53b060c4
xor edi, 0xfe01a27f
add edi, 0x1e949620
sub rsp, 0x30
mov qword [rsp + 0x20], 2
mov r9d, 2
mov rcx, rsi
mov rdx, r13
mov r8, r14
call fcn.1400fd630
add rsp, 0x30
cmp edi, 0x616306cb
jbe 0x140025995
mov rcx, qword [rbp + 0x108]
mov eax, dword [0x141dc3550]
xor eax, dword [0x141dc3554]
shr eax, 2
imul rax, rax, 0x2376f0ed
shr rax, 0x34
or eax, 0x20194a96
and eax, 0x20194ab6
cmp eax, 0xddb899fc
jbe 0x140025af0
jmp 0x140025b2b
add rbx, 3
shl eax, 0xc
or edx, eax
mov r8d, edx
cmp edx, 0xffff
jbe 0x140025936
nop word cs:[rax + rax]
mov eax, dword [0x141dc3540]
xor edx, edx
div dword [0x141dc3544]
xor eax, 0x91488002
and eax, 0xb34ce12b
add eax, 0x9ef217ee
cmp eax, 0xbf513729
ja 0x140025a40
lea r12d, [r8 + 0xff0000]
shr r12d, 0xa
or r12d, 0xd800
and r8d, 0x3ff
nop dword [rax]
mov eax, dword [0x141dc3548]
sub eax, dword [0x141dc354c]
xor eax, 0x6c562cd6
imul eax, eax, 0xa03d2dfd
cmp eax, 0x772c5195
ja 0x140025a80
movzx r15d, r8w
or r15d, 0xdc00
cmp r13, qword [rbp + 0x100]
je 0x140025949
jmp 0x1400259e8
sub rsp, 0x30
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rbp + 0x100]
mov rdx, r13
mov r8, r14
call fcn.1400fd630
add rsp, 0x30
jmp 0x14002598e
mov eax, dword [0x141dc3558]
add eax, dword [0x141dc355c]
or eax, 0x1bd5c4ee
imul rdx, rax, 0x3a5bcc5d
shr rdx, 0x3c
and edx, 1
lea rax, [r13 + 1]
mov word [rcx + r13*2], r12w
mov qword [rbp + 0x110], rax
cmp edx, 0xd7e3da57
jb 0x1400256e0
mov word [rcx + r13*2], r12w
lea rax, [r13 + 1]
mov qword [rbp + 0x110], rax
jmp 0x140025af0
mov eax, dword [0x141dc3570]
imul eax, dword [0x141dc3574]
or eax, 0xfa7ef8bb
add eax, 0x5f25326c
cmp eax, 0x813e6572
jbe 0x140025b90
mov rdi, qword [rbp + 0x108]
sub rsp, 0x20
xor ecx, ecx
mov edx, 6
call r14
add rsp, 0x20
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0x98], rsi
nop dword [rax]
mov edi, dword [0x141dc3578]
and edi, dword [0x141dc357c]
add edi, 0x4d1e711e
and edi, 0x3e329d70
mov rbx, qword [rbp + 0x100]
mov r13, qword [rbp + 0x108]
sub rsp, 0x20
xor ecx, ecx
mov edx, 6
call r14
add rsp, 0x20
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], rsi
cmp edi, 0xac355ddc
je 0x140025b90
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0xa0], rax
mov dword [rbp + 0xb0], 1
mov eax, dword [0x141dc3580]
imul eax, dword [0x141dc3584]
imul eax, eax, 0x4b1817c0
add eax, 0xa34397c0
and eax, 0xd908bc00
cmp eax, 0x6e1a0e31
lea r14, [rbp + 0x80]
mov r15, qword [sym.imp.shell32.dll_ShellExecuteExW]
je 0x140025e10
nop word cs:[rax + rax]
mov edi, dword [0x141dc3588]
sub edi, dword [0x141dc358c]
add edi, 0xb7c3cfe1
xor edi, 0xb510265
and edi, 0x4bdd6e67
sub rsp, 0x20
mov rcx, r14
call r15
add rsp, 0x20
test eax, eax
sete al
mov rcx, qword [rbp + 0xe8]
test rcx, rcx
sete dl
cmp edi, 0x9ad0faed
ja 0x140025e10
or al, dl
je 0x140025e30
nop word cs:[rax + rax]
mov eax, dword [0x141dc3590]
imul eax, dword [0x141dc3594]
xor eax, 0x10440100
and eax, 0x10760180
cmp eax, 0x2800826f
je 0x140025ca0
nop
mov eax, dword [0x141dc3598]
sub eax, dword [0x141dc359c]
and eax, 0xaf01a8
cmp eax, 0x8545f727
je 0x140025cc0
test rbx, rbx
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
je 0x140025de0
mov eax, dword [0x141dc35a0]
mov ecx, dword [0x141dc35a4]
add eax, ecx
add eax, 0x4f2eb412
and eax, 0xc861414
cmp eax, 0x6f1eec7
jbe 0x140025d10
mov rax, qword [0x141ddb9a0]
nop
mov eax, dword [0x141dc35a8]
xor eax, dword [0x141dc35ac]
imul eax, eax, 0x401a7a75
add eax, 0x185cc425
mov r14, qword [0x141ddb9a0]
cmp eax, 0x20234aa
jb 0x140025d10
mov eax, dword [0x141dc35b0]
sub eax, dword [0x141dc35b4]
xor eax, 0x7b5eef2e
imul rax, rax, 0x36ea2e7b
shr rax, 0x3d
or eax, 0xe26fa0b8
cmp eax, 0x291b66d
jae 0x140025d70
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, r13
call rbx
add rsp, 0x20
nop
mov eax, dword [str._v__e_b]
imul eax, dword [0x141dc35bc]
imul eax, eax, 0x3fa8b283
xor eax, 0x74c59b81
imul edi, eax, 0xcefd3e6f
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, r13
call rbx
add rsp, 0x20
cmp edi, 0xe91feb50
ja 0x140025d70
nop dword [rax + rax]
mov eax, dword [0x141dc35c0]
add eax, dword [0x141dc35c4]
or eax, 0xc14b48
add eax, 0xee6cfe94
or eax, 0xff021265
cmp eax, 0x7efaa2f3
jb 0x140025db0
nop word cs:[rax + rax]
mov eax, dword [0x141dc35c8]
mov ecx, dword [0x141dc35cc]
add eax, ecx
add eax, 0xf377ffe3
or eax, 0x34f00639
xor eax, 0x7d704abd
cmp eax, 0x2f5db390
jae 0x140025de0
mov edi, 0xffffffff
jmp 0x140025f58
sub rsp, 0x20
mov rcx, r14
call r15
add rsp, 0x20
jmp 0x140025c40
sub rsp, 0x20
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x20
mov rcx, qword [rbp + 0xe8]
sub rsp, 0x20
lea rdx, [rbp + 0x17c]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
add rsp, 0x20
mov ecx, dword [0x141dc35d0]
add ecx, dword [0x141dc35d4]
or ecx, 0x8890200
xor ecx, 0x20084b10
or ecx, 0x9772b4ef
cmp eax, 1
mov edi, 0
sbb edi, edi
cmp ecx, 0x8ef833b3
jb 0x140025e5f
or edi, dword [rbp + 0x17c]
test rbx, rbx
je 0x140025f58
mov r14, qword [0x141ddb9a0]
mov eax, dword [0x141dc35d8]
or eax, dword [0x141dc35dc]
imul eax, eax, 0x1554d4e1
add eax, 0xa6aa3c6
and eax, 0xd0bd8782
cmp eax, 0x1e254317
jae 0x140025ede
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov eax, dword [0x141dc35e0]
xor eax, dword [0x141dc35e4]
imul ebx, eax, 0x2111edbf
add ebx, 0x660414b6
or ebx, 0xf6296cc9
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, r13
call r15
add rsp, 0x20
cmp ebx, 0xd53ddcac
je 0x140025ef0
nop dword [rax]
mov eax, dword [0x141dc35e8]
imul eax, dword [0x141dc35ec]
imul rcx, rax, 0x6b6d86ff
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1c
cmp eax, 0x6918ddb4
je 0x140025f30
mov rbx, qword [rbp + 0x168]
nop
mov eax, dword [0x141dc35f0]
xor eax, dword [0x141dc35f4]
and eax, 0xbee4c33
add eax, 0x72b021f9
imul rax, rax, 0x548dd259
shr rax, 0x3a
cmp eax, 0xbce01e59
ja 0x140025f60
cmp qword [rbp - 0x58], 0
je 0x140025fcf
mov ecx, 0xb27d31bb
mov eax, dword [0x141dc35f8]
xor eax, dword [0x141dc35fc]
add eax, 0x2f142c32
imul rax, rcx
shr rax, 0x3f
cmp eax, 0x31264d33
ja 0x140025f94
mov r8, qword [rbp - 0x50]
mov rcx, qword [0x141ddb9a0]
sub rsp, 0x20
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov eax, dword [0x141dc3600]
xor edx, edx
div dword [0x141dc3604]
nop dword [rax]
mov eax, dword [0x141dc3608]
or eax, dword [0x141dc360c]
add eax, 0x10e98393
and eax, 0xade46830
cmp eax, 0xaa7eadf8
ja 0x140025fe0
mov rcx, qword [rbx]
mov eax, dword [0x141dc3610]
xor edx, edx
div dword [0x141dc3614]
xor eax, 0x6cf9cfaf
add eax, 0x8b543769
cmp eax, 0xfe755e80
ja 0x140026000
test rcx, rcx
je 0x140026110
mov rcx, qword [rbp + 0x168]
xor edx, edx
nop word cs:[rax + rax]
mov eax, dword [0x141dc3618]
add eax, dword [0x141dc361c]
or eax, 0xbe100fe9
add eax, 0xf4659cff
cmp eax, 0xb62fdeb2
ja 0x140026040
mov r13, qword [rcx + 8]
test dl, dl
jne 0x14002609a
nop word cs:[rax + rax]
mov eax, dword [0x141dc3620]
imul eax, dword [0x141dc3624]
xor eax, 0x4122
or eax, 0x4290658
and eax, 0x8d6f477a
mov r14, qword [0x141ddb9a0]
cmp eax, 0xd0b86260
jbe 0x1400260b0
mov rax, qword [0x141ddb9a0]
jmp 0x140026070
mov eax, dword [0x141dc3628]
mov ecx, dword [0x141dc362c]
add eax, ecx
add eax, 0x333e8b81
cmp eax, 0x3fc29755
jb 0x1400263b0
nop
mov eax, dword [0x141dc3630]
and eax, dword [0x141dc3634]
imul ebx, eax, 0x6ef4907e
add ebx, 0xb5be77a5
xor ebx, 0xcd12bc1c
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp ebx, 0xb304c24b
jb 0x1400263b0
mov r8, qword [rbp + 0xf8]
mov rcx, qword [r8]
mov eax, dword [0x141dc3638]
xor edx, edx
div dword [0x141dc363c]
mov eax, dword [0x141dc3640]
or eax, dword [0x141dc3644]
imul eax, eax, 0x5302acce
xor eax, 0x73d3ad8a
mov edx, 0xa9da7f6f
imul rax, rdx
shr rax, 0x3e
cmp eax, 0xc825aa2f
je 0x140026128
test rcx, rcx
mov r15, qword [rbp - 0x38]
lea r13, [0x14008b440]
je 0x140026220
mov eax, dword [0x141dc3648]
xor edx, edx
div dword [0x141dc364c]
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov eax, dword [0x141dc3650]
xor eax, dword [0x141dc3654]
imul eax, eax, 0xd5574fc0
add eax, 0x7e383ed0
cmp eax, 0xf6a4d457
ja 0x140026180
mov eax, dword [0x141dc3658]
imul eax, dword [0x141dc365c]
mov r14, qword [r8 + 8]
or eax, 0x3f7765f3
add eax, 0xd0027999
cmp eax, 0x45434add
jae 0x1400261e0
mov rcx, qword [0x141ddb9a0]
sub rsp, 0x20
xor edx, edx
mov r8, r14
call r12
add rsp, 0x20
nop word [rax + rax]
mov eax, dword [0x141dc3660]
sub eax, dword [0x141dc3664]
and eax, 0xca09e33b
imul ebx, eax, 0x85bb1b38
mov rcx, qword [0x141ddb9a0]
sub rsp, 0x20
xor edx, edx
mov r8, r14
call r12
add rsp, 0x20
cmp ebx, 0xa9df571e
ja 0x1400261e0
nop word cs:[rax + rax]
mov eax, dword [0x141dc3668]
xor edx, edx
div dword [0x141dc366c]
add eax, 0x8101db6
or eax, 0x292df8f6
cmp eax, 0x5d334671
je 0x140026220
mov rbx, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x150]
mov r8, qword [rbp + 0x120]
nop word cs:[rax + rax]
mov eax, dword [0x141dc3670]
and eax, dword [0x141dc3674]
and eax, 0x1000000
cmp eax, 0x41b39c3f
ja 0x140026260
cmp qword [rbp + 0x158], 0
mov edx, 0
lea r12, [0x140102eb0]
je 0x1400262e0
mov eax, dword [0x141dc3688]
sub eax, dword [0x141dc368c]
imul eax, eax, 0x4069d785
xor eax, 0x1a121170
add eax, 0x73c548a5
cmp eax, 0x92a6b835
jae 0x1400262c0
mov rax, qword [0x141ddb9a0]
nop dword [rax + rax]
mov rcx, qword [0x141ddb9a0]
test dl, dl
jne 0x1400262c0
sub rsp, 0x20
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
add rsp, 0x20
nop dword [rax]
test dl, dl
jne 0x1400262e0
test edi, edi
mov rax, qword [rbp + 0x38]
je 0x1400266bd
lea rcx, [0x141daf609]
mov qword [rax], rcx
mov rcx, qword [rax]
movabs rax, 0x595f673b99754862
mov qword [rbx], rax
mov rdx, qword [rbx]
sub rsp, 0x20
call fcn.140018e60
add rsp, 0x20
mov rcx, qword [rax]
movabs rdx, 0x27ba6ed99e947921
xor rcx, rdx
mov rdx, qword [rax + 8]
movabs r8, 0x347de5c2264e06c9
mov eax, 0x264e06c9
ret 0x7de5
xor al, 0x4c
xor edx, eax
mov r8, qword [rax + 0x10]
movabs r9, 0xf37d98069079d5a0
xor r8, r9
mov r9, qword [rax + 0x18]
movabs r10, 0x69a9b624fd27f38
xor r9, r10
movzx eax, byte [rax + 0x20]
xor al, 0xb9
mov qword [r15], rcx
mov qword [r15 + 8], rdx
mov qword [r15 + 0x10], r8
mov qword [r15 + 0x18], r9
mov byte [r15 + 0x20], al
mov rbx, qword [rbp - 0x30]
mov qword [rbx], r15
mov eax, dword [0x141dc3690]
or eax, dword [0x141dc3694]
add eax, 0x5295a1bc
xor eax, 0x2282a04
and eax, 0x223a6aa4
cmp eax, 0x45982ace
mov r14, qword [rbp - 0x28]
mov r15, qword [rbp - 0x20]
jbe 0x1400263d0
jmp 0x14002642e
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x1400260d0
mov edi, dword [0x141dc3698]
or edi, dword [0x141dc369c]
add edi, 0x8341c813
and edi, 0x72fb5053
mov qword [rbx + 8], 0x21
mov qword [r14], rbx
mov qword [r14 + 8], r13
mov qword [r15], r12
mov qword [r15 + 8], 2
mov qword [r15 + 0x20], 0
mov qword [r15 + 0x10], r14
mov qword [r15 + 0x18], 1
sub rsp, 0x20
mov rcx, r15
call fcn.14009ee10
add rsp, 0x20
cmp edi, 0x6ff9f073
jbe 0x140026480
mov qword [rbx + 8], 0x21
mov qword [r14], rbx
mov qword [r14 + 8], r13
mov qword [r15], r12
mov qword [r15 + 8], 2
mov qword [r15 + 0x20], 0
mov qword [r15 + 0x10], r14
mov qword [r15 + 0x18], 1
sub rsp, 0x20
mov rcx, r15
call fcn.14009ee10
add rsp, 0x20
jmp 0x1400263d0
test rsi, rsi
mov rbx, qword [rbp + 0x170]
mov r14, qword [rbp + 0x118]
je 0x140025337
mov eax, dword [0x141dc36a0]
xor eax, dword [0x141dc36a4]
imul eax, eax, 0xb6a00e42
and eax, 0x410090
cmp eax, 0xf1a8520e
ja 0x1400264eb
nop word cs:[rax + rax]
mov eax, dword [0x141dc36a8]
xor edx, edx
div dword [0x141dc36ac]
imul eax, eax, 0x8f98e1e1
or eax, 0x261d7819
mov rcx, qword [0x141ddb9a0]
cmp eax, 0x7f4eb068
jne 0x140025320
mov rax, qword [0x141ddb9a0]
jmp 0x1400264c0
mov rcx, qword [rbp + 0x138]
mov rdx, qword [rbp + 0x130]
mov r14, qword [rbp + 0x78]
nop word cs:[rax + rax]
mov eax, dword [0x141dc36e0]
imul eax, dword [0x141dc36e4]
or eax, 0x77d114e1
and eax, 0x77f116e3
cmp eax, 0xdd0cd65a
ja 0x140026510
test r15, r15
je 0x140026823
xor eax, eax
test al, al
mov r8, qword [rbp + 8]
je 0x14002654b
lea rax, [0x141db02e8]
mov qword [r8], rax
lea rax, [0x141db02e8]
xor ecx, ecx
mov rdx, qword [rbp]
mov rsi, qword [rbp + 0x10]
mov rdi, qword [rbp + 0x18]
mov rbx, qword [rbp + 0x20]
nop word cs:[rax + rax]
mov qword [r8], rax
test cl, cl
jne 0x140026570
mov rcx, qword [r8]
movabs rax, 0x63c9020a48e60ebf
mov qword [rdx], rax
mov rdx, qword [rdx]
sub rsp, 0x20
call fcn.14001a130
add rsp, 0x20
movabs rcx, 0x73d7bddf5b238f5b
xor rcx, qword [rax]
movabs rdx, 0x4361ba5209efe2c9
xor rdx, qword [rax + 8]
movabs r8, 0x80aafc04f153c8a7
xor r8, qword [rax + 0x10]
movabs r9, 0xfd95095e3a6861b1
xor r9, qword [rax + 0x18]
movzx eax, byte [rax + 0x20]
xor al, 0x21
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], r9
mov byte [rsi + 0x20], al
mov qword [rdi], rsi
mov qword [rdi + 8], 0x21
mov qword [rbx], rdi
mov qword [rbx + 8], r13
mov qword [r14], r12
mov qword [r14 + 8], 2
mov qword [r14 + 0x20], 0
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], 1
sub rsp, 0x20
mov rcx, r14
call fcn.14009ee10
add rsp, 0x20
mov eax, r15d
and eax, 3
cmp rax, 3
ja case.default.0x140026645
lea rcx, [0x141dba0ac]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
lea rsi, [r15 - 1]
mov rdi, qword [r15 - 1]
mov rbx, qword [r15 + 7]
nop word cs:[rax + rax]
mov eax, dword [0x141dc3720]
and eax, dword [0x141dc3724]
and eax, 0x2aac3606
imul eax, eax, 0x93883bcb
imul rax, rax, 0x5bbed721
shr rax, 0x3e
cmp eax, 0x49ec3cc
je 0x140026660
mov r14, qword [rbx]
test r14, r14
je 0x140026bf0
pop rbx
invalid
add byte [rax], al
mov eax, dword [str.3e4_L]
xor edx, edx
div dword [0x141dc372c]
or eax, 0x2c020
and eax, 0x264bcea0
cmp eax, 0x9f26660d
jne 0x140026b6d
jmp 0x140026ba7
mov r14, qword [rbp + 0x160]
mov rdx, qword [rbp + 0x130]
mov rbx, qword [rbp + 0x170]
nop word cs:[rax + rax]
mov eax, dword [0x141dc36b0]
mov ecx, dword [0x141dc36b4]
add eax, ecx
add eax, 0xb5dd3d9c
or eax, 0x5d0c2613
cmp eax, 0x54d2c4cf
je 0x1400266e0
test rsi, rsi
mov rcx, qword [rbp + 0x138]
je 0x140026823
mov eax, dword [0x141dc36b8]
xor edx, edx
div dword [0x141dc36bc]
imul eax, eax, 0xcf70f78
or eax, 0xacbdfdbe
cmp eax, 0x18d62419
jne 0x140026740
mov rax, qword [0x141ddb9a0]
nop word cs:[rax + rax]
mov eax, dword [0x141dc36c0]
xor eax, dword [0x141dc36c4]
add eax, 0x9762c334
or eax, 0x94502849
and eax, 0xbf7079c9
mov rsi, qword [0x141ddb9a0]
cmp eax, 0x90dbe162
je 0x140026740
mov eax, dword [0x141dc36c8]
imul eax, dword [0x141dc36cc]
imul eax, eax, 0x6950fdf8
add eax, 0x8fc95e68
xor eax, 0x3d865105
cmp eax, 0x5e074dd2
jbe 0x1400267a3
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word [rax + rax]
mov eax, dword [str.4_]
imul eax, dword [0x141dc36d4]
add eax, 0x9ccd80c
or eax, 0x3461c8b2
imul edi, eax, 0xc26b865d
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r14
call r15
add rsp, 0x20
cmp edi, 0xe56b4c87
ja 0x1400267b0
mov rdx, qword [rbp + 0x130]
mov rcx, qword [rbp + 0x138]
nop word cs:[rax + rax]
mov eax, dword [0x141dc36d8]
and eax, dword [0x141dc36dc]
and eax, 0x61cbefe0
imul eax, eax, 0x64c56613
add eax, 0x9924d5d0
cmp eax, 0xe0cafd0a
jb 0x140026800
lea rax, [0x141da608a]
mov qword [rcx], rax
mov rcx, qword [rcx]
movabs rax, 0x9d45940f69b50d5a
mov qword [rdx], rax
mov rdx, qword [rdx]
sub rsp, 0x20
call fcn.1400188f0
add rsp, 0x20
movabs r9, 0x44f21e587249d16a
xor r9, qword [rax]
movabs r10, 0x22fd9cbde01aa544
xor r10, qword [rax + 8]
movabs r11, 0x72396d0abc24f508
xor r11, qword [rax + 0x10]
movabs rcx, 0x5cc1f4aaac985a06
xor rcx, qword [rax + 0x18]
movabs rdx, 0x60f835fa28c43580
xor rdx, qword [rax + 0x20]
movzx eax, word [rax + 0x28]
mov r8d, eax
shr r8d, 8
mov rsi, qword [rbp + 0x40]
mov qword [rsi], r9
mov qword [rsi + 8], r10
mov r10, rsi
mov qword [rsi + 0x10], r11
mov r9d, dword [0x141dc3700]
or r9d, dword [0x141dc3704]
add r9d, 0x73974814
or r9d, 0x3b1f64a
imul r9d, r9d, 0x9170126d
cmp r9d, 0x10385515
jne 0x1400268e3
mov qword [r10 + 0x18], rcx
mov qword [r10 + 0x20], rdx
xor al, 0xf9
xor r8b, 0x9d
mov r11, qword [rbp + 0x48]
mov rsi, qword [rbp + 0x50]
nop word cs:[rax + rax]
mov r9d, dword [0x141dc3708]
imul r9d, dword [0x141dc370c]
imul r9d, r9d, 0x7767cfb3
xor r9d, 0x97d01000
or r9d, 0x682fc7fd
mov qword [r10 + 0x18], rcx
mov qword [r10 + 0x20], rdx
cmp r9d, 0x8f49782f
je 0x140026900
mov byte [r10 + 0x28], al
mov byte [r10 + 0x29], r8b
mov qword [r11], r10
mov qword [r11 + 8], 0x2a
mov qword [rsi], r11
mov qword [rsi + 8], r13
mov qword [rbx], r12
mov qword [rbx + 8], 2
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 1
sub rsp, 0x20
mov rcx, rbx
call fcn.14009ee10
jmp 0x140027bfe
mov eax, dword [0x141dc3710]
xor edx, edx
div dword [0x141dc3714]
add eax, 0xe2d64d83
or eax, 0x4100d9
and eax, 0xf04706d9
cmp eax, 0x9835882f
jb case.default.0x140026645
jmp 0x140026b05
mov eax, 0xf006939f
nop
mov ecx, dword [0x141dc3718]
add ecx, dword [0x141dc371c]
imul rcx, rax
shr rcx, 0x3c
or ecx, 0xedfd766a
cmp ecx, 0x9569d4fb
jbe 0x1400269b0
jmp case.0x140026645.0
mov eax, dword [0x141dc3488]
imul eax, dword [0x141dc348c]
and eax, 0x29002420
xor eax, 0x240c0410
or eax, 0xd2e3dbcd
cmp eax, 0xb768dc96
jne 0x1400269fc
ud2
mov eax, 0xd743cdc5
nop word cs:[rax + rax]
mov ecx, dword [0x141dc3490]
sub ecx, dword [0x141dc3494]
imul rcx, rax
shr rcx, 0x3c
and ecx, 0xfffffffe
add ecx, 0x4b647c67
ud2
mov eax, dword [0x141dc34d0]
imul eax, dword [0x141dc34d4]
add eax, 0xfa1422d7
or eax, 0x746af126
and eax, 0xfd7bf53e
cmp eax, 0xfd14afcf
jbe 0x140026a70
ud2
mov eax, dword [0x141dc34d8]
or eax, dword [0x141dc34dc]
invalid
retf 0x1d9
and eax, 0x256d3770
add eax, 0xf483906d
or eax, 0xd8b3f213
ud2
mov eax, dword [0x141dc34e0]
sub eax, dword [0x141dc34e4]
cmp eax, 0xdecf63e7
jne 0x140026b07
jmp 0x140026b1d
xor eax, eax
test al, al
je 0x140026b21
jmp 0x140026b47
mov eax, dword [0x141dc34c0]
sub eax, dword [0x141dc34c4]
imul eax, eax, 0x8f77ee87
and eax, 0xe15feb9a
cmp eax, 0xc3392ad9
jne 0x140026ae0
ud2
mov eax, dword [0x141dc34c8]
or eax, dword [0x141dc34cc]
or eax, 0x40580a4
and eax, 0x2ea7b0ee
imul eax, eax, 0x81b0fbbf
ud2
ud2
mov eax, dword [0x141dc34e8]
imul eax, dword [0x141dc34ec]
ud2
ud2
mov eax, dword [0x141dc3678]
xor edx, edx
div dword [0x141dc367c]
add eax, 0x3223490a
xor eax, 0x14103502
and eax, 0x34dd3d33
ud2
ud2
mov r15d, dword [0x141dc3730]
add r15d, dword [0x141dc3734]
xor r15d, 0x2534725f
add r15d, 0xdfe2530e
xor r15d, 0x25b9dd79
sub rsp, 0x20
mov rcx, rdi
call r14
add rsp, 0x20
cmp r15d, 0x1fbd9864
jae 0x140026bc0
sub rsp, 0x20
mov rcx, rdi
call r14
add rsp, 0x20
jmp 0x140026b6d
mov eax, dword [0x141dc3738]
imul eax, dword [0x141dc373c]
add eax, 0x3a98a115
or eax, 0x5cb2cb2b
add eax, 0xc113ef4f
cmp eax, 0xa92d9ce9
jb 0x140026bc0
nop word cs:[rax + rax]
mov eax, dword [0x141dc3740]
xor eax, dword [0x141dc3744]
and eax, 0x6b3a0c56
add eax, 0xf8e069e6
cmp eax, 0x55328254
ja 0x140026bf0
mov rax, qword [rbx + 8]
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x140026c20
test rax, rax
je 0x140026cc2
cmp qword [rbx + 0x10], 0x11
jb 0x140026ca8
nop word cs:[rax + rax]
mov eax, dword [0x141dc3748]
or eax, dword [0x141dc374c]
xor eax, 0x1353ebdf
imul eax, eax, 0xffde573a
and eax, 0x9b2bc4cc
cmp eax, 0xb7beecf0
ja 0x140026c40
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140026c70
mov rdi, qword [rdi - 8]
mov eax, 0xb99ac56f
nop dword [rax]
mov ecx, dword [0x141dc3750]
and ecx, dword [0x141dc3754]
imul ecx, ecx, 0xc8b77cac
or ecx, 0x820456fb
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0x258fce78
ja 0x140026c80
mov rcx, qword [0x141ddb9a0]
sub rsp, 0x20
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov eax, dword [0x141dc3758]
mov ecx, dword [0x141dc375c]
add eax, ecx
add eax, 0x6dc0b09f
and eax, 0x167fe8d6
cmp eax, 0x75d78ed0
jne 0x140026cf0
mov rax, qword [0x141ddb9a0]
nop dword [rax + rax]
mov eax, dword [0x141dc3760]
or eax, dword [0x141dc3764]
xor eax, 0xd7d05ed4
imul rax, rax, 0x21f8d477
shr rax, 0x3c
mov rdi, qword [0x141ddb9a0]
cmp eax, 0x26129c36
je 0x140026cf0
mov eax, dword [0x141dc3768]
add eax, dword [0x141dc376c]
or eax, 0xabca9471
imul eax, eax, 0x73fc613
cmp eax, 0xfeedd8bd
je 0x140026d75
mov ebx, dword [0x141dc3770]
imul ebx, dword [0x141dc3774]
xor ebx, 0xe4dc9d48
add ebx, 0x26043383
or ebx, 0x648e97b5
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp ebx, 0xe4cf1d8b
jne case.0x140026645.0
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x140026d38
mov eax, dword [0x141dc3778]
and eax, dword [0x141dc377c]
imul eax, eax, 0xfdde737a
add eax, 0x1423dea6
or eax, 0xdab289ae
cmp eax, 0xc00803fe
je case.0x140026645.0
mov eax, dword [0x141dc3780]
add eax, dword [0x141dc3784]
xor eax, 0x4dc4199b
imul rax, rax, 0x35a04811
shr rax, 0x3d
or eax, 0xb7bd3d70
cmp eax, 0xf2eba43
jae 0x140026dfb
mov qword [rbp + 0x80], 0
sub rsp, 0x20
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
add rsp, 0x20
lea rsi, [rbp + 0x80]
mov rdi, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ebx, ebx
nop dword [rax + rax]
mov qword [rbp + 0x80], 0
sub rsp, 0x20
mov rcx, rsi
call rdi
add rsp, 0x20
test bl, bl
jne 0x140026e10
test eax, eax
je 0x140026ec9
mov eax, dword [0x141dc37a0]
imul eax, dword [0x141dc37a4]
imul eax, eax, 0xc84a25d7
xor eax, 0xc0030408
and eax, 0xd5839e68
cmp eax, 0x6a463b5c
nop word cs:[rax + rax]
mov eax, dword [0x141dc37a8]
xor edx, edx
div dword [0x141dc37ac]
or eax, 0x87eec31a
imul eax, eax, 0x24616376
add eax, 0x65cce71b
cmp eax, 0xed330e08
ja 0x140026e60
mov rsi, qword [rbp + 0x80]
mov rcx, qword [0x141ddb998]
test rcx, rcx
jne 0x140026ffd
mov eax, dword [0x141dc37b0]
and eax, dword [0x141dc37b4]
imul eax, eax, 0x78c7287f
imul rax, rax, 0xb043fc5
shr rax, 0x3a
cmp eax, 0xf316c5fd
jne 0x140026f79
jmp 0x140026fbc
mov eax, dword [0x141dc3788]
xor edx, edx
div dword [0x141dc378c]
add eax, 0x356fd639
or eax, 0xa9669507
imul rax, rax, 0x667f7c3f
shr rax, 0x3e
cmp eax, 0xf4878c4a
jbe 0x140026f01
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov esi, 0x80fe777d
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ebx, dword [0x141dc3790]
add ebx, dword [0x141dc3794]
and ebx, 0xcedf207d
add ebx, 0xa0484dc
imul rbx, rsi
shr rbx, 0x37
sub rsp, 0x20
call rdi
add rsp, 0x20
cmp ebx, 0xf93d4106
ja 0x140026f10
ud2
mov eax, dword [0x141dc37b8]
mov ecx, dword [0x141dc37bc]
lea edi, [rax + rcx]
add edi, 0xd3f83c8e
or edi, 0x6c129a3d
mov qword [rbp + 0x80], 0
sub rsp, 0x20
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
cmp edi, 0x4ac6e1b0
jae 0x140026fde
mov qword [rbp + 0x80], 0
sub rsp, 0x20
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
jmp 0x140026f79
test eax, eax
je 0x140027139
mov rcx, qword [rbp + 0x80]
mov qword [0x141ddb998], rcx
test rcx, rcx
je 0x14002716a
mov rax, rsi
or rax, rcx
shr rax, 0x20
je 0x140027013
mov rax, rsi
xor edx, edx
div rcx
jmp 0x140027019
mov eax, esi
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x14002703d
xor edx, edx
div rcx
mov rsi, rax
jmp 0x140027043
xor edx, edx
div ecx
mov esi, eax
add rsi, r8
mov rax, rsi
shr rax, 9
movabs r14, 0x44b82fa09b5a53
mul r14
mov rdi, rdx
sub rsp, 0x20
mov ecx, 0x23
call fcn.14008b610
add rsp, 0x20
mov qword [rbp + 0x80], 0
sub rsp, 0x20
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
add rsp, 0x20
test eax, eax
je 0x140027110
shr rdi, 0xb
imul eax, edi, 0x3b9aca00
sub esi, eax
mov rbx, qword [rbp + 0x80]
nop word cs:[rax + rax]
mov eax, dword [0x141dc37e0]
xor eax, dword [0x141dc37e4]
add eax, 0xd7d2991
xor eax, 0xb675d138
cmp eax, 0x2d1f5be9
ja 0x1400270b0
mov rcx, qword [0x141ddb998]
test rcx, rcx
jne 0x1400272f6
mov eax, dword [0x141dc37e8]
imul eax, dword [0x141dc37ec]
imul rax, rax, 0x6499dbcb
shr rax, 0x3b
imul eax, eax, 0xb16419af
and eax, 0xa83e8d0a
cmp eax, 0xe12426f
jae 0x1400271f0
jmp 0x140027216
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
ud2
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov eax, dword [0x141dc37c0]
or eax, dword [0x141dc37c4]
and eax, 0x5c5fbcd2
imul eax, eax, 0x601bdaa5
cmp eax, 0x1d2431bf
jne 0x1400271c3
jmp 0x1400271ec
mov eax, dword [0x141dc37d0]
or eax, dword [0x141dc37d4]
imul rcx, rax, 0x59e019
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
or eax, 0x6f2a4db6
cmp eax, 0xebb73b4c
jbe 0x140027198
ud2
mov eax, dword [0x141dc37d8]
mov ecx, dword [0x141dc37dc]
add eax, ecx
add eax, 0x9095cf0f
xor eax, 0x4008908e
and eax, 0x6108d18e
ud2
mov eax, dword [0x141dc37c8]
imul eax, dword [0x141dc37cc]
or eax, 0x4004060
xor eax, 0x20820080
and eax, 0x2583c4e0
ud2
ud2
mov qword [rbp + 0x80], 0
sub rsp, 0x20
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
xor ecx, ecx
test cl, cl
je 0x140027238
mov qword [rbp + 0x80], 0
sub rsp, 0x20
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
jmp 0x1400271f0
xor ecx, ecx
nop word [rax + rax]
test cl, cl
jne 0x140027240
test eax, eax
je 0x1400273aa
mov eax, dword [0x141dc3808]
imul eax, dword [0x141dc380c]
add eax, 0xb81de7d0
and eax, 0x54417bba
xor eax, 0x88f92966
cmp eax, 0x906caefd
jbe 0x14002727d
mov rax, qword [rbp + 0x80]
mov qword [0x141ddb998], rax
xor eax, eax
nop
mov rcx, qword [rbp + 0x80]
mov qword [0x141ddb998], rcx
test al, al
jne 0x140027280
nop word cs:[rax + rax]
mov eax, dword [0x141dc3810]
xor eax, dword [0x141dc3814]
add eax, 0xa822e4a3
or eax, 0x378f7cb2
and eax, 0xffdffeb6
cmp eax, 0x6dd286fe
je 0x1400272a0
nop word cs:[rax + rax]
mov eax, dword [0x141dc3818]
or eax, dword [0x141dc381c]
add eax, 0xa261cfad
and eax, 0x97247c8f
cmp eax, 0x1b823012
jb 0x1400272d0
test rcx, rcx
je 0x140027439
mov rax, rbx
or rax, rcx
shr rax, 0x20
je 0x14002730c
mov rax, rbx
xor edx, edx
div rcx
jmp 0x140027312
mov eax, ebx
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x140027336
xor edx, edx
div rcx
mov rbx, rax
jmp 0x14002733c
xor edx, edx
div ecx
mov ebx, eax
add rbx, r8
mov rax, rbx
shr rax, 9
mul r14
mov r14, rdx
mov rcx, qword [0x141ddb998]
test rcx, rcx
jne 0x1400274ff
nop dword [rax]
mov eax, dword [0x141dc3830]
and eax, dword [0x141dc3834]
or eax, 0xa052360
and eax, 0xa856360
cmp eax, 0x36e37c7a
je 0x140027360
mov qword [rbp + 0x80], 0
mov eax, dword [0x141dc3838]
or eax, dword [0x141dc383c]
imul eax, eax, 0xb3d3e51e
cmp eax, 0xa7e58650
jne 0x14002748a
jmp 0x1400274c9
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov eax, dword [0x141dc37f0]
xor eax, dword [0x141dc37f4]
imul rax, rax, 0xc215e91
shr rax, 0x3b
imul eax, eax, 0xa9067297
imul rcx, rax, 0x3db677f7
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
cmp eax, 0xd53be3ac
jne 0x1400273f2
ud2
mov eax, 0xcca3f10f
mov ecx, dword [0x141dc37f8]
add ecx, dword [0x141dc37fc]
imul ecx, ecx, 0x887e5e8b
and ecx, 0x88e79cba
imul rcx, rax
shr rcx, 0x3d
ud2
mov eax, dword [0x141dc3820]
and eax, dword [0x141dc3824]
imul eax, eax, 0xe76ab77c
or eax, 0x40104200
and eax, 0x6216ea60
cmp eax, 0xa651df0c
ja 0x140027486
mov eax, dword [0x141dc3828]
or eax, dword [0x141dc382c]
imul eax, eax, 0x6a4d750c
xor eax, 0x534b6704
imul eax, eax, 0x27cb25c9
ud2
ud2
mov eax, dword [0x141dc3840]
and eax, dword [0x141dc3844]
mov r15d, 0xa7070365
imul r15, rax
shr r15, 0x3f
or r15d, 0xb66acf86
sub rsp, 0x20
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
cmp r15d, 0x586ecf45
jae 0x1400274e0
sub rsp, 0x20
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
jmp 0x14002748a
test eax, eax
je 0x140027cb9
mov rcx, qword [rbp + 0x80]
mov qword [0x141ddb998], rcx
test rcx, rcx
je 0x140026b05
shr r14, 0xb
imul r8d, r14d, 0x3b9aca00
cmp rcx, 0x3b9aca00
ja 0x14002751e
mov eax, 0x3b9aca00
xor edx, edx
div ecx
jmp 0x140027520
xor eax, eax
sub ebx, r8d
lea r8d, [rax - 0x3b9aca00]
xor r9d, r9d
cmp rcx, 2
setb r10b
cmovae r8d, eax
xor edx, edx
mov rcx, r14
sub rcx, rdi
setne dl
mov eax, 0xff
cmovbe eax, edx
test al, al
jne 0x1400275c3
mov eax, dword [0x141dc3868]
imul eax, dword [0x141dc386c]
imul eax, eax, 0xc09b9e0b
add eax, 0xc0bb5ddc
imul rax, rax, 0x7b83e2b
shr rax, 0x3a
cmp eax, 0x29390602
ja 0x140027550
mov eax, dword [0x141dc3870]
xor edx, edx
div dword [0x141dc3874]
nop dword [rax + rax]
cmp ebx, esi
setne al
mov edx, dword [0x141dc3878]
xor edx, dword [0x141dc387c]
or edx, 0x28b1212
add edx, 0x6d5a331f
and edx, 0x326b393
cmp edx, 0x6921e86c
ja 0x140027590
cmp ebx, esi
ja 0x1400277a7
cmp al, 1
jne 0x1400277a7
mov r9b, r10b
xor eax, eax
test al, al
jne 0x1400275d0
cmp r14, rdi
ja 0x140027c93
mov r11, rdi
sub r11, r14
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400275f0
cmp ebx, esi
jbe 0x140027660
test r11, r11
je 0x140027c93
dec r11
lea r10d, [rsi + 0x3b9aca00]
nop dword [rax + rax]
mov eax, dword [0x141dc38c8]
xor edx, edx
div dword [0x141dc38cc]
add eax, 0x4d79c03d
and eax, 0x13b980cd
add eax, 0xb058b83a
cmp eax, 0x3ace3202
jb 0x140027610
nop word cs:[rax + rax]
mov eax, dword [0x141dc38d0]
add eax, dword [0x141dc38d4]
imul eax, eax, 0xaa2acfa6
add eax, 0xe8183e16
cmp eax, 0xd5bd47a9
ja 0x140027640
jmp 0x140027663
mov r10d, esi
sub r10d, ebx
nop word cs:[rax + rax]
mov eax, dword [0x141dc38d8]
sub eax, dword [0x141dc38dc]
imul eax, eax, 0x96f543b
add eax, 0x5a173adc
cmp eax, 0x2e6c950d
jb 0x140027670
cmp r10d, 0x3b9aca00
jb 0x140027779
mov eax, r10d
shr eax, 9
imul rdx, rax, 0x44b83
shr rdx, 0x27
nop dword [rax]
mov eax, dword [0x141dc38e0]
mov r15d, dword [0x141dc38e4]
add eax, r15d
add eax, 0x9ff6e468
or eax, 0x48b092c2
and eax, 0x48fcdec3
cmp eax, 0x2501135e
jb 0x1400276b0
imul eax, edx, 0x3b9aca00
sub r10d, eax
xor r12d, r12d
nop word cs:[rax + rax]
mov rax, r11
add rax, rdx
setb r15b
test r12b, r12b
jne 0x1400276f0
nop
mov edx, dword [0x141dc38e8]
sub edx, dword [0x141dc38ec]
imul edx, edx, 0x950e2afa
add edx, 0x627fb5d3
xor edx, 0xa304a2a8
cmp edx, 0x5993151e
jb 0x140027700
test r15b, r15b
jne 0x140027c1d
xor edx, edx
nop word cs:[rax + rax]
test dl, dl
jne 0x140027740
nop word cs:[rax + rax]
mov edx, dword [0x141dc38f0]
sub edx, dword [0x141dc38f4]
and edx, 0xf963ffd6
imul edx, edx, 0x6a9a32ad
add edx, 0xce68497d
cmp edx, 0x98301305
ja 0x140027750
mov r11, rax
xor eax, eax
cmp r11, r9
setne al
mov edx, 0xff
cmovb eax, edx
xor r9d, r9d
cmp r10d, r8d
setne r9b
cmovb r9d, edx
test al, al
cmovne r9d, eax
cmp r9b, 1
jne 0x140027c66
cmp r14, rdi
jb 0x140027c66
mov eax, dword [0x141dc3880]
sub eax, dword [0x141dc3884]
imul eax, eax, 0xeab9cae5
cmp eax, 0x4422c57a
je 0x1400277b0
nop dword [rax]
mov eax, dword [0x141dc3888]
or eax, dword [0x141dc388c]
add eax, 0x8f6a0299
or eax, 0x333aebb8
xor eax, 0xc52f9bf3
cmp eax, 0x5375f4f0
jb 0x1400277d0
nop word cs:[rax + rax]
mov eax, dword [0x141dc3890]
imul eax, dword [0x141dc3894]
and eax, 0x6ebe70b2
imul rax, rax, 0xe9c7427
shr rax, 0x3a
or eax, 0xfe07cef6
cmp eax, 0x4cad3990
jb 0x140027800
cmp ebx, esi
jae 0x1400278be
test rcx, rcx
je 0x140027c66
dec rcx
nop dword [rax]
mov eax, dword [0x141dc3898]
imul eax, dword [0x141dc389c]
imul eax, eax, 0xf1bf8c7
add eax, 0xf13ab034
and eax, 0x4b08cdf7
cmp eax, 0x6b4c066b
ja 0x140027840
add ebx, 0x3b9aca00
nop word [rax + rax]
mov eax, dword [0x141dc38a0]
sub eax, dword [0x141dc38a4]
add eax, 0x735ac6b5
imul rax, rax, 0x37481d8f
shr rax, 0x3d
imul eax, eax, 0x40f36b12
cmp eax, 0x4ceef945
ja 0x140027870
nop dword [rax]
mov eax, dword [0x141dc38a8]
imul eax, dword [0x141dc38ac]
add eax, 0xbfe2f6b5
xor eax, 0x78069788
cmp eax, 0xac7b9e9c
jb 0x1400278a0
sub ebx, esi
mov eax, dword [str.n9x_o]
or eax, dword [0x141dc38b4]
imul rax, rax, 0x9ddf37b
shr rax, 0x3b
imul eax, eax, 0xe678e7f1
add eax, 0x2715a9a1
cmp eax, 0x6f3350e3
ja 0x1400278c0
cmp ebx, 0x3b9aca00
jb 0x14002798f
mov edx, ebx
shr edx, 9
imul rax, rdx, 0x44b83
shr rax, 0x27
nop word cs:[rax + rax]
mov r8d, dword [0x141dc38b8]
sub r8d, dword [0x141dc38bc]
imul r8d, r8d, 0x1f5a39ea
add r8d, 0x8bdf75d4
cmp r8d, 0xe13a758d
ja 0x140027910
imul rdx, rdx, 0x44b83
shr rdx, 0x27
imul edx, edx, 0x3b9aca00
sub ebx, edx
mov eax, eax
nop word [rax + rax]
mov edx, dword [0x141dc38c0]
or edx, dword [0x141dc38c4]
xor edx, 0xe381b39c
imul edx, edx, 0xe0bf7884
imul r8, rdx, 0x42d387a1
shr r8, 0x20
sub edx, r8d
shr edx, 1
add edx, r8d
shr edx, 0x1f
cmp edx, 0x1c1a1428
ja 0x140027950
add rcx, rax
jb 0x140026b05
cmp ebx, 0x3b9aca00
je 0x140027c66
cmp rcx, 0x19
jb 0x140027c66
mov eax, dword [0x141dc3918]
imul eax, dword [0x141dc391c]
imul eax, eax, 0x35e1c4cc
imul rax, rax, 0x4c28e3cb
shr rax, 0x3c
xor eax, 0x95fe1e36
cmp eax, 0x82782281
mov rbx, qword [rbp - 0x18]
jae 0x1400279e3
sub rsp, 0x20
mov rcx, rbx
call fcn.1400ddd50
add rsp, 0x20
mov rdi, qword [rbp + 0x58]
mov r14, qword [rbp + 0x60]
nop dword [rax + rax]
mov eax, dword [0x141dc3920]
and eax, dword [str.a_qf]
or eax, 0xff7fdcdf
imul esi, eax, 0x67ee847e
sub rsp, 0x20
mov rcx, rbx
call fcn.1400ddd50
add rsp, 0x20
cmp esi, 0x1ce9e0dd
jb 0x1400279f0
cmp byte [rbx], 0x12
jne 0x140026b05
sub rsp, 0x20
call fcn.14001da10
add rsp, 0x20
mov qword [r14], 0
mov dword [rdi], 0
mov rsi, qword [rbp + 0x68]
mov qword [rsi], 0
mov rbx, qword [rbp + 0x70]
mov dword [rbx], 0
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov rdx, rbx
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 7
mov r8, r14
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x10
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 0x1f
mov r8, rdi
mov r9d, 4
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x10
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 0x1e
mov r8, rsi
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x30
mov eax, dword [rbx]
nop word cs:[rax + rax]
mov ecx, dword [0x141dc3938]
add ecx, dword [0x141dc393c]
or ecx, 0xcec80c6d
imul ecx, ecx, 0xb9c0e432
or ecx, 0x398bc73b
cmp ecx, 0x104bead9
jb 0x140027b00
mov rdx, qword [r14]
nop dword [rax]
test eax, eax
sete cl
mov r11d, dword [0x141dc3940]
and r11d, dword [0x141dc3944]
add r11d, 0x944fcf6f
imul r8, r11, 0x4e8e0cf5
shr r8, 0x20
sub r11d, r8d
shr r11d, 1
add r11d, r8d
shr r11d, 0x1e
add r11d, 0xd6f2348d
test rdx, rdx
sete r8b
cmp dword [rdi], 0
setne r9b
cmp qword [rsi], 0
sete r10b
cmp r11d, 0xfb2bb708
ja 0x140027b30
and cl, r8b
and cl, r9b
and cl, r10b
je 0x140027c5d
nop word [rax + rax]
mov eax, dword [0x141dc3948]
add eax, dword [0x141dc394c]
cmp eax, 0x82916dc9
je 0x140027ba0
mov eax, 0x8c95def1
nop dword [rax + rax]
mov ecx, dword [0x141dc3950]
xor ecx, dword [0x141dc3954]
imul ecx, ecx, 0xd5703b
or ecx, 0x7e6e04d6
shr ecx, 1
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0x578c4543
ja 0x140027bc0
sub rsp, 0x20
mov ecx, 0x80000001
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
call fcn.140027e30
add rsp, 0x20
movaps xmm6, xmmword [rbp + 0x180]
lea rsp, [rbp + 0x198]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
ud2
sub rsp, 0x20
call fcn.1400bf5e0
mov eax, dword [0x141dc3928]
imul eax, dword [0x141dc392c]
xor eax, 0xb8be4e
imul eax, eax, 0x64526e4d
add eax, 0xc387cfec
cmp eax, 0x9fdbd398
jbe 0x140027d85
jmp 0x140027dbc
mov eax, dword [0x141dc3900]
and eax, dword [0x141dc3904]
xor eax, 0x2a0244c8
and eax, 0x2a4a4dcc
cmp eax, 0x1d6847a5
jae 0x140027dcb
jmp 0x140027df0
mov eax, dword [0x141dc3848]
or eax, dword [0x141dc384c]
or eax, 0x326cd7b9
imul eax, eax, 0xe958ad62
add eax, 0x1f76e2b4
cmp eax, 0x1b7a14b4
jb 0x140027d14
mov eax, dword [0x141dc3850]
xor edx, edx
div dword [0x141dc3854]
mov esi, eax
and esi, 0x29cd3992
add esi, 0xafa83c9b
and esi, 0xfcb14f06
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
cmp esi, 0xfdc5369d
jbe 0x140027d24
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
jmp 0x140027cdc
mov eax, dword [0x141dc3858]
or eax, dword [0x141dc385c]
or eax, 0xb3aad71a
imul rax, rax, 0x5375ab8f
shr rax, 0x3d
cmp eax, 0x4ddb0e0b
je 0x140027d4f
ud2
ud2
mov esi, dword [0x141dc3930]
sub esi, dword [0x141dc3934]
xor esi, 0x414
or esi, 0xfdf35bcb
xor esi, 0x497d07ba
sub rsp, 0x20
call fcn.1400bf5e0
add rsp, 0x20
cmp esi, 0x96156d39
jae 0x140026b05
sub rsp, 0x20
call fcn.1400bf5e0
add rsp, 0x20
jmp 0x140027d85
mov eax, dword [0x141dc3908]
imul eax, dword [0x141dc390c]
add eax, 0x8a37b85b
xor eax, 0x22a150a
and eax, 0x2be171e
ud2
ud2