Function at 0x1400052d0
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1188
call fcn.1400508c0
sub rsp, rax
mov ebp, r9d
mov r12, r8
mov r15, rdx
mov qword [rsp + 0x68], rcx
lea rax, [0x142f4426d]
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rcx, qword [rsp + 0x180]
movabs rax, 0xbc165e500e2f0204
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rdx, qword [rsp + 0x180]
call fcn.140036bb0
mov esi, dword [rax]
movzx edi, word [rax + 4]
movzx ebx, byte [rax + 6]
movzx eax, byte [0x142f53108]
mov edx, 7
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140006892
mov r13, rax
shl ebx, 0x10
or edi, ebx
mov eax, edi
shr eax, 0x10
xor al, 0x91
movzx eax, al
mov byte [r13 + 6], al
shl rax, 0x30
mov ecx, edi
shr ecx, 8
xor cl, 0x3e
movzx ecx, cl
shl rcx, 0x28
or rcx, rax
xor dil, 0x67
movzx eax, dil
shl rax, 0x20
or rax, rcx
xor esi, 0xeedcf681
mov dword [r13], esi
shr rax, 0x20
mov word [r13 + 4], ax
lea rax, [0x142f40064]
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rcx, qword [rsp + 0x180]
movabs rax, 0xe43b57907b2acd2e
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rdx, qword [rsp + 0x180]
call fcn.1400360f0
mov rsi, qword [rax]
movzx eax, byte [0x142f53108]
mov edx, 8
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140006892
mov r14, rax
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x30], r15
movabs rax, 0x5379674c351d9d9b
xor rsi, rax
mov qword [r14], rsi
lea rax, [0x142f456c0]
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rcx, qword [rsp + 0x180]
movabs rax, 0xe05a4f30ff879259
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rdx, qword [rsp + 0x180]
call fcn.140036a40
mov rsi, qword [rax]
movzx eax, byte [0x142f53108]
mov edx, 8
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140006892
mov r15, rax
movabs rax, 0xb99a857858f2e889
xor rsi, rax
mov qword [r15], rsi
lea rax, [0x142f41ff0]
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rcx, qword [rsp + 0x180]
movabs rax, 0xafffddccda9fdcaa
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rdx, qword [rsp + 0x180]
call fcn.140035e90
mov esi, dword [rax]
movzx edi, word [rax + 4]
movzx ebx, byte [rax + 6]
movzx eax, byte [0x142f53108]
mov edx, 7
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140006892
mov r13, rax
mov qword [rsp + 0x20], r12
mov byte [rsp + 0x28], bpl
shl ebx, 0x10
or edi, ebx
mov eax, edi
shr eax, 0x10
xor al, 0xa7
movzx eax, al
mov byte [r13 + 6], al
shl rax, 0x30
mov ecx, edi
shr ecx, 8
xor cl, 0x74
movzx ecx, cl
shl rcx, 0x28
or rcx, rax
xor dil, 0xd5
movzx eax, dil
shl rax, 0x20
or rax, rcx
xor esi, 0x1144df25
mov dword [r13], esi
shr rax, 0x20
mov word [r13 + 4], ax
lea rax, [0x142f3fb3b]
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rcx, qword [rsp + 0x180]
movabs rax, 0x315877d5fd2829d6
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rdx, qword [rsp + 0x180]
call fcn.140036680
mov esi, dword [rax]
movzx ebx, byte [rax + 4]
movzx eax, byte [0x142f53108]
mov edx, 5
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140006892
mov rbp, rax
xor bl, 0x39
xor esi, 0xb0a75628
mov byte [rax + 4], bl
mov dword [rax], esi
lea rax, [0x142f484c6]
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rcx, qword [rsp + 0x180]
movabs rax, 0x42052d41c6d202de
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rdx, qword [rsp + 0x180]
call fcn.140036a10
mov esi, dword [rax]
movzx eax, byte [0x142f53108]
mov edx, 4
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140006892
mov r12, rax
xor esi, 0xeced7aa0
mov dword [rax], esi
lea rax, [0x142f451a7]
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rcx, qword [rsp + 0x180]
movabs rax, 0x930223cf646141c4
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rdx, qword [rsp + 0x180]
call fcn.140035e50
mov esi, dword [rax]
movzx edi, word [rax + 4]
movzx ebx, byte [rax + 6]
movzx eax, byte [0x142f53108]
mov edx, 7
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140006892
mov rdx, rax
shl ebx, 0x10
or edi, ebx
mov eax, edi
shr eax, 0x10
xor al, 0xf2
movzx eax, al
mov byte [rdx + 6], al
shl rax, 0x30
mov ecx, edi
shr ecx, 8
xor cl, 0x58
movzx ecx, cl
shl rcx, 0x28
or rcx, rax
xor dil, 0x51
movzx eax, dil
shl rax, 0x20
or rax, rcx
xor esi, 0x2070ac81
mov dword [rdx], esi
shr rax, 0x20
mov qword [rsp + 0x70], rdx
mov word [rdx + 4], ax
lea rax, [0x142f43342]
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rcx, qword [rsp + 0x180]
movabs rax, 0x66d1a33ac320659e
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rdx, qword [rsp + 0x180]
call fcn.140036650
mov rsi, qword [rax]
movzx ebx, byte [rax + 8]
movzx eax, byte [0x142f53108]
mov edx, 9
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140006892
xor bl, 0x4f
movabs rcx, 0x1b34a472578c4d26
xor rsi, rcx
mov qword [rax], rsi
mov qword [rsp + 0x60], rax
mov byte [rax + 8], bl
lea rax, [0x142f43a42]
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rcx, qword [rsp + 0x180]
movabs rax, 0xcf5bebcabe45433b
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rdx, qword [rsp + 0x180]
call fcn.140036040
mov esi, dword [rax]
movzx edi, word [rax + 4]
movzx ebx, byte [rax + 6]
movzx eax, byte [0x142f53108]
mov edx, 7
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140006892
mov rdx, rax
shl ebx, 0x10
or edi, ebx
mov eax, edi
shr eax, 0x10
xor al, 0x66
movzx eax, al
mov byte [rdx + 6], al
shl rax, 0x30
mov ecx, edi
shr ecx, 8
xor cl, 0x35
movzx ecx, cl
shl rcx, 0x28
or rcx, rax
xor dil, 0x73
movzx eax, dil
shl rax, 0x20
or rax, rcx
xor esi, 0xacb1326d
mov dword [rdx], esi
shr rax, 0x20
mov qword [rsp + 0x58], rdx
mov word [rdx + 4], ax
lea rax, [0x142f3ed15]
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rcx, qword [rsp + 0x180]
movabs rax, 0xbb2e386589dc5cff
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rdx, qword [rsp + 0x180]
call fcn.140035fa0
mov rsi, qword [rax]
movzx ebx, byte [rax + 8]
movzx eax, byte [0x142f53108]
mov edx, 9
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140006892
mov rdi, rax
xor bl, 0x33
movabs rax, 0x10465166849fbc2b
xor rsi, rax
mov qword [rdi], rsi
mov byte [rdi + 8], bl
lea rax, [0x142f3adf2]
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rcx, qword [rsp + 0x180]
movabs rax, 0x151073579532631b
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rdx, qword [rsp + 0x180]
call fcn.140036ae0
mov esi, dword [rax]
movzx ebx, byte [rax + 4]
movzx eax, byte [0x142f53108]
mov edx, 5
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140006892
mov qword [rsp + 0x50], rdi
xor bl, 0xb5
xor esi, 0x59dcba5e
mov byte [rax + 4], bl
mov qword [rsp + 0x48], rax
mov dword [rax], esi
lea rax, [0x142f3ff28]
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rcx, qword [rsp + 0x180]
movabs rax, 0x89e33f529a6558b6
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rdx, qword [rsp + 0x180]
call fcn.140036480
mov rsi, qword [rax]
movzx eax, byte [0x142f53108]
mov edx, 8
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140006892
mov rbx, rax
mov qword [rsp + 0x40], r12
movabs rax, 0xd6d4b13f300cdf2b
xor rsi, rax
mov qword [rbx], rsi
lea rax, [0x142f44303]
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rcx, qword [rsp + 0x180]
movabs rax, 0x687df196b30d7b71
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rdx, qword [rsp + 0x180]
call fcn.140036350
mov esi, dword [rax]
movzx edi, word [rax + 4]
movzx eax, byte [0x142f53108]
mov edx, 6
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140006892
mov ecx, edi
shr ecx, 8
xor cl, 0xa2
movzx edx, cl
shl rdx, 0x28
xor dil, 0x54
movzx ecx, dil
shl rcx, 0x20
or rcx, rdx
xor esi, 0xb2df9838
mov dword [rax], esi
shr rcx, 0x20
mov word [rax + 4], cx
movzx ecx, byte [0x142f53108]
mov edx, 0xd0
xor ecx, ecx
mov rsi, rax
call fcn.140025a60
test rax, rax
je 0x140006892
mov r12, rax
mov rax, qword [rsp + 0x78]
mov qword [r12], rax
mov qword [r12 + 8], 7
mov qword [r12 + 0x10], r14
mov qword [r12 + 0x18], 8
mov qword [r12 + 0x20], r15
mov qword [r12 + 0x28], 8
mov qword [r12 + 0x30], r13
mov qword [r12 + 0x38], 7
mov qword [r12 + 0x40], rbp
mov qword [r12 + 0x48], 5
mov rax, qword [rsp + 0x40]
mov qword [r12 + 0x50], rax
mov qword [r12 + 0x58], 4
mov rax, qword [rsp + 0x70]
mov qword [r12 + 0x60], rax
mov qword [r12 + 0x68], 7
mov rax, qword [rsp + 0x60]
mov qword [r12 + 0x70], rax
mov qword [r12 + 0x78], 9
mov rax, qword [rsp + 0x58]
mov qword [r12 + 0x80], rax
mov qword [r12 + 0x88], 7
mov rax, qword [rsp + 0x50]
mov qword [r12 + 0x90], rax
mov qword [r12 + 0x98], 9
mov rax, qword [rsp + 0x48]
mov qword [r12 + 0xa0], rax
mov qword [r12 + 0xa8], 5
mov qword [r12 + 0xb0], rbx
mov qword [r12 + 0xb8], 8
mov qword [rsp + 0x118], rsi
mov qword [r12 + 0xc0], rsi
mov qword [r12 + 0xc8], 6
mov ecx, dword [0x140057040]
test ecx, ecx
je 0x140005c6f
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
cmp rax, 1
ja 0x140005e7d
je 0x140006892
xorps xmm0, xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
lea rdx, [rsp + 0xc0]
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x140005c07
mov esi, eax
lea rcx, [rsp + 0xc0]
mov edx, 0x20
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140005c07
and esi, 0x7fffffff
jne 0x14000687a
movaps xmm0, xmmword [rsp + 0xc0]
movaps xmm1, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x90], xmm1
movaps xmmword [rsp + 0x80], xmm0
mov rax, qword [0x142f53100]
test rax, rax
je 0x140005c94
lea rsi, [rsp + 0x190]
test eax, 0x4000
jne 0x140005ca8
movaps xmm0, xmmword [rsp + 0x80]
movaps xmm1, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x190], xmm0
movaps xmmword [rsp + 0x1a0], xmm1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1b0], xmm0
jmp 0x140005cbf
lea rcx, [0x140057028]
call fcn.140027e30
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
cmp rax, 1
jbe 0x140005ba8
jmp 0x140005e7d
call fcn.1400357f0
lea rsi, [rsp + 0x190]
test eax, 0x4000
je 0x140005c42
lea r8, [0x142f4d520]
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.14001e7e0
movaps xmm0, xmmword [rsi]
movaps xmm1, xmmword [rsi + 0x10]
movaps xmm2, xmmword [rsi + 0x20]
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x90], xmm1
movaps xmmword [rsp + 0xa0], xmm2
movups xmmword [rsp + 0x188], xmm0
movups xmmword [rsp + 0x198], xmm1
movups xmmword [rsp + 0x1a8], xmm2
movzx eax, byte [0x142f53108]
mov edx, 0x170
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140006892
mov rsi, rax
mov qword [rax], 1
mov qword [rax + 8], 1
xorps xmm0, xmm0
movaps xmmword [rax + 0x10], xmm0
movaps xmmword [rax + 0x20], xmm0
movaps xmmword [rax + 0x30], xmm0
movaps xmmword [rax + 0x40], xmm0
movaps xmmword [rax + 0x50], xmm0
movaps xmmword [rax + 0x60], xmm0
movaps xmmword [rax + 0x70], xmm0
movaps xmmword [rax + 0x80], xmm0
movaps xmmword [rax + 0x90], xmm0
movaps xmmword [rax + 0xa0], xmm0
movaps xmmword [rax + 0xb0], xmm0
movaps xmmword [rax + 0xc0], xmm0
movaps xmmword [rax + 0xd0], xmm0
movaps xmmword [rax + 0xe0], xmm0
movaps xmmword [rax + 0xf0], xmm0
movaps xmmword [rax + 0x100], xmm0
mov qword [rax + 0x110], 0x40
movups xmm0, xmmword [rsp + 0x180]
movups xmm1, xmmword [rsp + 0x190]
movups xmm2, xmmword [rsp + 0x1a0]
movups xmmword [rax + 0x118], xmm0
movups xmmword [rax + 0x128], xmm1
movups xmmword [rax + 0x138], xmm2
mov rax, qword [rsp + 0x1b0]
mov qword [rsi + 0x148], rax
mov qword [rsi + 0x150], 0x10000
mov qword [rsi + 0x158], 0x10000
mov qword [rsi + 0x160], 0
movzx eax, byte [0x142f53108]
mov edx, 0x10
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140006892
mov rdi, rax
mov qword [rax], rsi
lea rax, [0x140057028]
mov qword [rdi + 8], rax
mov ecx, dword [0x140057040]
test ecx, ecx
je 0x1400067e2
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rsi, rax
mov ecx, dword [0x140057040]
test ecx, ecx
je 0x1400067f5
dec ecx
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
test rsi, rsi
je 0x140005e7d
mov r8, qword [rsi]
dec qword [r8]
jne 0x140005e6c
dec qword [r8 + 8]
jne 0x140005e6c
mov rcx, qword [0x142f53058]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov qword [rsp + 0x110], rbx
mov rbx, qword [rdi]
inc qword [rbx]
je 0x140006892
mov rax, qword [rbx + 0x110]
cmp rax, 0x40
jb 0x140005eda
lea rdx, [rbx + 0x10]
lea rcx, [rbx + 0x120]
mov rax, qword [rbx + 0x158]
test rax, rax
jle 0x140005ed3
cmp qword [rbx + 0x160], 0
js 0x140005ed3
add rax, 0xffffffffffffff00
mov qword [rbx + 0x158], rax
call fcn.14001c540
jmp 0x140005ed8
call fcn.14003d100
xor eax, eax
mov qword [rsp + 0x108], r14
lea rcx, [rax + 1]
cmp dword [rbx + rax*4 + 0x10], 0
mov qword [rbx + 0x110], rcx
mov qword [rsp + 0x100], r13
mov qword [rsp + 0xf8], rbp
js 0x140005f9c
lea rax, [0x142f3c586]
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rcx, qword [rsp + 0x180]
movabs rax, 0x1c79b98027d0fc62
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rdx, qword [rsp + 0x180]
call fcn.1400365c0
mov r14, qword [rax]
mov rsi, qword [rax + 8]
movzx eax, byte [0x142f53108]
mov edi, 0x10
mov edx, 0x10
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140006892
movabs rcx, 0xb6a4a13fba5dbc32
xor rsi, rcx
movabs rcx, 0x8b8fad639fcaec24
xor r14, rcx
mov qword [rax], r14
mov qword [rax + 8], rsi
jmp 0x14000605a
mov r13, r15
lea rax, [0x142f3aa6b]
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rcx, qword [rsp + 0x180]
movabs rax, 0x36811ad0d7f787b0
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rdx, qword [rsp + 0x180]
call fcn.140035f00
mov r14, qword [rax]
mov ebp, dword [rax + 8]
movzx esi, word [rax + 0xc]
movzx r15d, byte [rax + 0xe]
movzx eax, byte [0x142f53108]
mov edi, 0xf
mov edx, 0xf
xor ecx, ecx
call fcn.140025a60
test rax, rax
je 0x140006892
shl r15d, 0x10
or esi, r15d
mov r8d, esi
shr r8d, 0x10
xor r8b, 0x5b
mov ecx, esi
shr ecx, 8
xor cl, 0xa6
xor sil, 0xfa
xor ebp, 0x2d08430e
movabs rdx, 0xad346afb4a81e2f4
xor r14, rdx
mov qword [rax], r14
mov dword [rax + 8], ebp
mov byte [rax + 0xc], sil
mov byte [rax + 0xd], cl
mov byte [rax + 0xe], r8b
mov r15, r13
mov r14, rax
lea rsi, [rsp + 0x168]
mov r9d, 0xd
mov rcx, rsi
mov rdx, rbx
mov r8, r12
call fcn.140004f20
lea rcx, [rsp + 0x150]
mov r9d, 0xd
mov rdx, rbx
mov r8, r12
call fcn.140004f20
lea rcx, [rsp + 0x120]
mov rdx, r14
mov r8, rdi
mov r9, rsi
call fcn.14003cc00
mov byte [rsp + 0x180], 1
mov rsi, qword [rsp + 0x128]
mov rdi, qword [rsp + 0x130]
lea rcx, [rsp + 0x180]
mov rdx, rsi
mov r8, rdi
call fcn.1400280e0
test rax, rax
jne 0x140006892
lea rcx, [rsp + 0xc0]
lea r9, [rsp + 0x150]
mov rdx, rsi
mov r8, rdi
call fcn.14003cc00
mov byte [rsp + 0x180], 1
mov rdi, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xd0]
lea rcx, [rsp + 0x180]
mov rdx, rdi
mov r8, rsi
call fcn.1400280e0
test rax, rax
jne 0x140006892
mov qword [rsp + 0xe8], r14
test rsi, rsi
mov qword [rsp + 0xf0], r15
je 0x140006168
js 0x140006892
movzx eax, byte [0x142f53108]
xor ecx, ecx
mov rdx, rsi
call fcn.140025a60
test rax, rax
je 0x140006892
mov r14, rax
mov r15, rsi
jmp 0x140006171
mov r14d, 1
xor r15d, r15d
mov rcx, r14
mov rdx, rdi
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x180], r15
mov qword [rsp + 0x188], r14
mov qword [rsp + 0x190], rsi
mov byte [rsp + 0x198], 0
lea rcx, [rsp + 0x180]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x20]
call fcn.140033180
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x30], rax
mov r14, qword [rsp + 0x188]
mov rbp, qword [rsp + 0x190]
mov dword [rsp + 0x180], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x188], xmm0
mov dword [rsp + 0x198], 7
mov qword [rsp + 0x19c], 0
mov word [rsp + 0x1a4], 0
mov byte [rsp + 0x1a1], 1
mov byte [rsp + 0x1a4], 1
mov byte [rsp + 0x1a3], 1
lea r8, [rsp + 0x180]
mov rcx, r14
mov rdx, rbp
call fcn.14002bcc0
test rax, rax
jne 0x140006892
mov r13, rdx
movabs r15, 0x8000000000000000
mov qword [rsp + 0x38], rdx
mov rax, qword [rsp + 0x68]
cmp qword [rax], r15
je 0x140006819
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
lea rcx, [rsp + 0x38]
call fcn.14003d250
test rax, rax
jne 0x140006892
cmp byte [rsp + 0x28], 0
mov qword [rsp + 0x20], r14
je 0x14000635b
lea rcx, [rsp + 0x180]
mov rdx, r13
call fcn.14002bf40
cmp dword [rsp + 0x180], 2
je 0x140006892
mov rdi, qword [rsp + 0x1b8]
mov r13, qword [rsp + 0x38]
cmp rdi, 0x2bbfffff
ja 0x14000635b
mov qword [rsp + 0x180], 0
lea r8, [rsp + 0x180]
mov rcx, r13
xor edx, edx
mov r9d, 2
call sub.KERNEL32.dll_SetFilePointerEx
test eax, eax
je 0x140006873
lea rsi, [rsp + 0x180]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov r15d, 0x2bc00000
sub r15, rdi
lea r14, [rsp + 0x38]
nop word cs:[rax + rax]
cmp r15, 0x1000
mov edi, 0x1000
cmovb rdi, r15
mov rcx, r14
mov rdx, rsi
mov r8, rdi
call fcn.14003d250
test rax, rax
jne 0x140006892
sub r15, rdi
jne 0x140006320
mov r14, qword [rsp + 0x20]
movabs r15, 0x8000000000000000
mov rcx, r13
call sub.KERNEL32.dll_CloseHandle
test rbp, rbp
je 0x1400063bb
js 0x140006892
movzx eax, byte [0x142f53108]
xor ecx, ecx
mov rdx, rbp
call fcn.140025a60
test rax, rax
je 0x140006892
mov r13, rax
mov rcx, rax
mov rdx, r14
mov r8, rbp
call sub.msvcrt.dll_memcpy
movzx eax, byte [0x142f53108]
xor ecx, ecx
mov rdx, rbp
call fcn.140025a60
test rax, rax
je 0x140006892
mov rsi, rax
mov rdi, rbp
jmp 0x1400063d8
mov r13d, 1
mov ecx, 1
mov rdx, r14
mov r8, rbp
call sub.msvcrt.dll_memcpy
xor edi, edi
mov esi, 1
mov rcx, rsi
mov rdx, r13
mov r8, rbp
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x188], rsi
mov qword [rsp + 0x190], rbp
mov byte [rsp + 0x198], 0
mov qword [rsp + 0x1a0], 0
mov qword [rsp + 0x1a8], 8
mov qword [rsp + 0x1b0], 0
mov qword [rsp + 0x208], 0
mov qword [rsp + 0x218], 0
mov word [rsp + 0x220], 0
mov qword [rsp + 0x1b8], r15
mov dword [rsp + 0x240], 0
mov word [rsp + 0x244], 0
mov dword [rsp + 0x1d8], 6
mov dword [rsp + 0x1e8], 6
mov dword [rsp + 0x1f8], 6
mov qword [rsp + 0x228], 0
mov qword [rsp + 0x238], 0
test rbp, rbp
je 0x1400064b8
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, r13
call sub.KERNEL32.dll_HeapFree
mov dword [rsp + 0x240], 0x8000000
mov dword [rsp + 0x140], 0
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x180]
lea r8, [rsp + 0x140]
call fcn.14002d980
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x90]
cmp rbp, 2
jne 0x140006506
mov r14, rsi
jmp 0x14000654d
mov r13, qword [rsp + 0x88]
mov r14, qword [rsp + 0x98]
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0xa0], 0
sete r15b
cmp qword [rsp + 0xb0], 0
sete dil
lea rax, [0x142f409d6]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x80]
movabs rax, 0xb681732d18fd6a06
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x80]
mov rdx, qword [rsp + 0x80]
call fcn.140036320
mov rcx, qword [rax]
mov rcx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
movzx eax, word [rax + 0x18]
cmp ebp, 2
je 0x140006892
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
mov rcx, r13
call sub.KERNEL32.dll_CloseHandle
test rbp, rbp
je 0x1400065c8
mov rcx, r14
call sub.KERNEL32.dll_CloseHandle
test r15b, 1
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0xf0]
mov r15, qword [rsp + 0x100]
mov r13, qword [rsp + 0xf8]
jne 0x1400065f8
mov rcx, qword [rsp + 0xe0]
call sub.KERNEL32.dll_CloseHandle
test dil, 1
mov rdi, qword [rsp + 0x108]
jne 0x140006610
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_CloseHandle
lea rcx, [rsp + 0x180]
call fcn.140001450
mov rax, qword [rsp + 0x68]
cmp qword [rax], 0
je 0x14000663a
mov r8, qword [rax + 8]
mov rcx, qword [0x142f53058]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x30], 0
je 0x140006655
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, qword [rsp + 0x20]
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0xc0], 0
je 0x140006676
mov r8, qword [rsp + 0xc8]
mov rcx, qword [0x142f53058]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x120], 0
je 0x140006697
mov r8, qword [rsp + 0x128]
mov rcx, qword [0x142f53058]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, qword [rsp + 0xe8]
call sub.KERNEL32.dll_HeapFree
dec qword [rbx]
jne 0x1400066c9
dec qword [rbx + 8]
jne 0x1400066c9
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, r12
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, r14
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, r13
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, qword [rsp + 0x40]
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, qword [rsp + 0x70]
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, qword [rsp + 0x60]
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, qword [rsp + 0x58]
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, qword [rsp + 0x50]
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, qword [rsp + 0x48]
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, qword [rsp + 0x110]
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142f53058]
xor edx, edx
mov r8, qword [rsp + 0x118]
call sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x1188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140057028]
call fcn.140027e30
mov ecx, eax
jmp 0x140005e2b
lea rcx, [0x140057028]
call fcn.140027e30
mov ecx, eax
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
test rsi, rsi
jne 0x140005e50
jmp 0x140005e7d
lea rax, [0x142f4246d]
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rcx, qword [rsp + 0x180]
movabs rax, 0x5e82a50c27c431eb
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x180]
mov rdx, qword [rsp + 0x180]
call fcn.140036960
mov rcx, qword [rax]
mov rcx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov ecx, dword [rax + 0x18]
movzx eax, word [rax + 0x1c]
ud2
call sub.KERNEL32.dll_GetLastError
ud2
movzx eax, byte [0x142f53108]
mov edx, 4
xor ecx, ecx
call fcn.140025a60
test rax, rax
jne 0x140006894
ud2
mov dword [rax], esi
ud2