Function at 0x1403496c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1a8
mov rsi, r9
mov r12, r8
mov r15, rdx
mov rdi, rcx
mov r14, qword [rsp + 0x220]
mov ebp, dword [rsp + 0x218]
mov rbx, qword [rsp + 0x210]
mov rax, qword [0x14077ee28]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov eax, ebp
and eax, 0x1f
cmp eax, 0xa
jae 0x140349765
cmp eax, 4
jbe 0x14034979e
cmp eax, 7
jae 0x14034981a
cmp eax, 5
jne 0x1403498e1
cmp qword [0x1407915e0], 0
jne 0x14034a72c
movzx eax, byte [0x140746789]
cmp al, 0xd6
je 0x140349d07
mov cl, 0x3a
mov al, 0xc
lock cmpxchg byte [0x140746789], cl
je 0x140349c4a
cmp al, 0xd6
jne 0x14034974c
jmp 0x140349d07
cmp eax, 0xe
jbe 0x140349804
cmp eax, 0x10
jbe 0x140349842
cmp eax, 0x13
jae 0x14034991f
cmp eax, 0x11
jne 0x140349b21
cmp r14, r12
je 0x140349c3b
add rsi, 0x10
mov r13, r14
jmp 0x14034a7dc
cmp eax, 1
jbe 0x14034986d
cmp eax, 2
je 0x140349a6d
cmp eax, 4
jne 0x140349ab1
mov rax, qword [rdi + 0x38]
mov rax, qword [rax]
test rax, rax
je 0x140349c31
mov rdx, qword [rdi + 0x18]
mov ecx, 0xffff
cmp rax, qword [rdx]
jbe 0x14034a61b
lea r13, [rdi + 0x38]
cmp r15w, 0xffff
je 0x140349e67
test bpl, 0x40
jne 0x14034a133
cmp word [rax - 2], r15w
je 0x14034a57b
jmp 0x14034a642
cmp eax, 0xa
jne 0x1403498b9
mov rcx, rdi
call fcn.14059ca5c
jmp 0x14034a734
je 0x140349a83
cmp eax, 9
jne 0x140349ae9
mov rax, qword [rdi + 8]
mov edx, dword [rbx]
mov ecx, dword [r12]
call qword [0x140704440]
movzx r13d, al
jmp 0x14034a737
cmp eax, 0xf
jne 0x14034995d
cmp qword [0x140791618], 0
jne 0x14034a7b1
movzx eax, byte [0x140746899]
cmp al, 0xa4
jne 0x14034a5a2
jmp 0x14034a5ea
test eax, eax
je 0x1403499e0
cmp qword [0x140791610], 0
jne 0x14034a553
movzx eax, byte [0x140746869]
cmp al, 0xfa
je 0x14034a2ac
mov cl, 0x78
nop word cs:[rax + rax]
mov al, 0xc9
lock cmpxchg byte [0x140746869], cl
je 0x140349c43
cmp al, 0xfa
jne 0x1403498a0
jmp 0x14034a2ac
cmp eax, 0xc
jbe 0x1403499a2
cmp eax, 0xe
jne 0x140349b43
xor dil, byte [rbx]
xor dil, 0x9f
mov byte [rsi], dil
movsxd rax, r14d
lea rcx, [0x140746320]
jmp 0x140349913
lea eax, [rsi + 0x7f5aa5dc]
mov ecx, 0xcccccccd
imul rcx, rax
shr rcx, 0x24
shl ecx, 2
lea ecx, [rcx + rcx*4]
sub eax, ecx
movsxd rcx, esi
lea rdx, [0x140746320]
movzx ecx, byte [rcx + rdx]
mov byte [rbx], cl
lea rcx, [0x1405f9c70]
add rcx, rax
mov qword [r12], rcx
jmp 0x14034a734
jne 0x140349b8a
cmp qword [0x140791598], 0
jne 0x14034a84c
movzx eax, byte [0x140746618]
cmp al, 0xbf
je 0x140349fb6
mov cl, 0x2f
mov al, 0x2a
lock cmpxchg byte [0x140746618], cl
je 0x140349f96
cmp al, 0xbf
jne 0x140349944
jmp 0x140349fb6
mov byte [rsp + 0x7f], r14b
mov qword [rsp + 0x80], 0
add rbx, 0x30
lea rcx, [rsp + 0x7c]
lea rdx, [rsp + 0x7f]
lea r8, [rsp + 0x80]
mov r9, rbx
call fcn.140326420
test eax, eax
movzx eax, word [rsp + 0x7c]
mov r13d, 0xffff
cmovns r13, rax
jmp 0x14034a737
jne 0x140349bc2
cmp qword [0x140791638], 0
jne 0x14034a102
movzx eax, byte [0x140746959]
cmp al, 0x71
je 0x14034a006
mov cl, 0x85
mov al, 0x1b
lock cmpxchg byte [0x140746959], cl
je 0x140349fca
cmp al, 0x71
jne 0x1403499c7
jmp 0x14034a006
lea rcx, [rsp + 0x84]
mov r8d, 0x118
xor edx, edx
call fcn.1405c44a0
mov dword [rsp + 0x80], 0x11c
mov byte [rsp + 0x19a], 1
xor ecx, ecx
mov edx, 0x80
mov r8b, 1
call fcn.140326750
mov rsi, rax
call fcn.140326ce0
mov rcx, qword [0x14074abf0]
mov edx, dword [0x14074abe4]
mov r14d, 0x2cc8
sub r14d, eax
sub edx, r14d
movsxd rax, edx
add rax, rcx
lea rcx, [rsp + 0x80]
mov edx, 0x80
mov r8, rsi
call qword [0x140704440]
test eax, eax
je 0x140349bec
test bpl, 0x20
jne 0x14034a72c
xor eax, eax
jmp 0x140349e86
mov rcx, r12
mov rdx, r15
mov r8d, edi
call sub.IPHLPAPI.DLL_GetIpAddrTable
mov r13d, eax
jmp 0x14034a737
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14059b6c0
mov rcx, rbx
mov rdx, r12
add rsp, 0x1a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.140295610
cmp qword [0x140791650], 0
jne 0x140349f69
movzx eax, byte [0x1407469c9]
cmp al, 0x30
je 0x140349ec9
mov cl, 0xc5
mov al, 0xc3
lock cmpxchg byte [0x1407469c9], cl
je 0x140349e8f
cmp al, 0x30
jne 0x140349ad0
jmp 0x140349ec9
cmp qword [0x140791630], 0
jne 0x14034a52b
movzx eax, byte [0x140746929]
cmp al, 0xe1
je 0x14034a3c0
mov cl, 0x12
mov al, 0xd
lock cmpxchg byte [0x140746929], cl
je 0x140349ee8
cmp al, 0xe1
jne 0x140349b08
jmp 0x14034a3c0
cmp qword [0x140791648], 0
jne 0x14034a955
movzx eax, byte [0x1407469a9]
cmp al, 3
jne 0x14034a866
jmp 0x14034a8ba
cmp qword [0x1407915d0], 0
jne 0x14034a248
test bpl, 0x20
jne 0x140349ba7
movzx eax, byte [0x140746749]
cmp al, 7
je 0x14034a133
mov cl, 0x24
mov al, 0x93
lock cmpxchg byte [0x140746749], cl
je 0x14034a113
cmp al, 7
je 0x14034a133
test bpl, bpl
js 0x140349b68
jmp 0x14034a6e1
cmp qword [0x1407915b8], 0
jne 0x140349e51
movzx eax, byte [0x1407466c9]
cmp al, 0xca
je 0x140349d42
mov cl, 0xcc
mov al, 0x9f
lock cmpxchg byte [0x1407466c9], cl
je 0x140349d1b
cmp al, 0xca
jne 0x140349ba9
jmp 0x140349d42
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14059b6c0
mov ecx, ebx
add rsp, 0x1a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14059d418
mov qword [rsp + 0x80], 0
mov rcx, qword [0x14074abf8]
mov eax, dword [0x14074abe8]
sub eax, r14d
cdqe
add rax, rcx
lea r13, [rsp + 0x80]
mov cx, 6
mov dx, 3
mov r8, r13
mov r9d, 0xe3065ad6
call qword [0x140704440]
jmp 0x140349e69
mov ecx, 0xffff
jmp 0x14034a611
mov r13, r14
jmp 0x14034a737
xor eax, eax
jmp 0x14034a256
movabs rax, 0x24dbc2b0f5acb47
xor qword [0x140746780], rax
xor byte [0x140746788], 0x6b
mov al, 0xd6
xchg byte [0x140746789], al
test ebp, 0x100
jne 0x140349d07
test bpl, 0x40
jne 0x140349d1b
mov eax, 0x8418d364
mov ecx, 0x7be72cac
mov edx, 0x8418d365
mov r8d, 0x7be72cab
xor r9d, r9d
mov r10d, 0xf0f0f0f1
lea r11, [0x1407468a0]
lea rsi, [0x1405f9fe0]
mov edi, r8d
imul rdi, r10
shr rdi, 0x24
lea ebx, [rdx + rdi]
shl edi, 4
add edi, ebx
movzx ebx, byte [rdi + rsi]
xor bl, 0x6f
add byte [r9 + r11], bl
cmp r9, 0x10
je 0x14034a75e
mov edi, ecx
imul rdi, r10
shr rdi, 0x24
lea ebx, [rax + rdi]
shl edi, 4
add edi, ebx
mov edi, edi
movzx ebx, byte [rdi + rsi]
xor bl, 0x6f
add byte [r9 + r11 + 1], bl
add r9, 2
add eax, 0xfffffffe
add ecx, 2
add edx, 0xfffffffe
add r8d, 2
jmp 0x140349cac
movzx eax, byte [0x14074679d]
cmp al, 0x16
jne 0x14034a624
jmp 0x14034a6e1
movq xmm0, qword [0x1407466c0]
paddb xmm0, xmmword [0x1405f95c0]
movq qword [0x1407466c0], xmm0
add byte [0x1407466c8], 0xe5
mov al, 0xca
xchg byte [0x1407466c9], al
movzx eax, byte [0x1407466e3]
cmp al, 0xdf
je 0x140349e06
mov cl, 0x54
mov al, 0xd5
lock cmpxchg byte [0x1407466e3], cl
je 0x140349d68
cmp al, 0xdf
jne 0x140349d53
jmp 0x140349e06
mov ecx, 0x916e4646
lea r8, [rcx + 0x8273055]
add rcx, 0x8273056
xor r10d, r10d
movabs r11, 0xd79435e50d79435f
lea rax, [0x1405f9ef0]
mov ebx, 0x9995768f
add rbx, rax
lea r14, [0x1407466d0]
mov rax, rcx
mul r11
mov r9, rdx
mov rax, r8
mul r11
shr rdx, 4
imul rax, rdx, 0xffffffffffffffed
add rax, rbx
movzx edx, byte [r10 + r14]
xor dl, byte [r10 + rax + 0xc]
xor dl, 0x5a
mov byte [r10 + r14], dl
cmp r10, 0x12
je 0x140349dfe
shr r9, 4
imul rax, r9, 0xffffffffffffffed
add rax, rbx
add rax, 0xd
movzx edx, byte [r10 + r14 + 1]
xor dl, byte [rax + r10]
xor dl, 0x5a
mov byte [r10 + r14 + 1], dl
add r10, 2
add rcx, 2
add r8, 2
jmp 0x140349d9e
mov al, 0xdf
xchg byte [0x1407466e3], al
mov ebx, dword [0x14074aef8]
lea rcx, [0x1407466c0]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x140349e48
mov ecx, 0x85da450f
xor rcx, rbx
mov qword [rsp + 0x58], rcx
lea rcx, [0x1407466d0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0x9c00e0ac
mov r8, rax
call fcn.1403481e0
jmp 0x140349e4a
xor eax, eax
mov qword [0x1407915b8], rax
mov ecx, edi
mov rdx, r12
mov r8, rsi
call qword [0x1407915b8]
mov r13d, eax
jmp 0x14034a737
xor eax, eax
test ebp, 0x100
jne 0x140349e86
mov rax, qword [rdi + 0x50]
inc dword [rax]
mov rax, qword [r13]
add qword [rax], 0xfffffffffffffffe
xor ecx, ecx
jmp 0x14034a61b
movzx r13d, al
jmp 0x14034a737
movaps xmm0, xmmword [0x1407469c0]
xorps xmm0, xmmword [0x1405f95a0]
movss dword [0x1407469c0], xmm0
xor byte [0x1407469c4], 4
xor byte [0x1407469c5], 0x6c
xor byte [0x1407469c7], 0x81
xor byte [0x1407469c8], 0xe4
mov al, 0x30
xchg byte [0x1407469c9], al
movzx eax, byte [0x1407469d8]
cmp al, 0x99
je 0x140349f1e
mov cl, 1
mov al, 0x90
lock cmpxchg byte [0x1407469d8], cl
je 0x140349f05
cmp al, 0x99
jne 0x140349ed6
jmp 0x140349f1e
movabs rax, 0x4847bd5462bf37b4
xor qword [0x140746920], rax
xor byte [0x140746928], 0x3c
jmp 0x14034a3b8
movabs rax, 0xcbbec5ebd0815590
xor qword [0x1407469d0], rax
mov al, 0x99
xchg byte [0x1407469d8], al
mov esi, dword [0x14074aef8]
lea rcx, [0x1407469c0]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x140349f60
mov ecx, 0x85da450f
xor rcx, rsi
mov qword [rsp + 0x58], rcx
lea rcx, [0x1407469d0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0x9c00e0ac
mov r8, rax
call fcn.1403481e0
jmp 0x140349f62
xor eax, eax
mov qword [0x140791650], rax
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14059b6c0
mov rcx, r14
add rsp, 0x1a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [0x140791650]
movq xmm0, qword [0x140746610]
paddb xmm0, xmmword [0x1405f9570]
movq qword [0x140746610], xmm0
mov al, 0xbf
xchg byte [0x140746618], al
movzx eax, byte [0x140746636]
cmp al, 0xfb
je 0x14034a801
jmp 0x14034a973
movdqa xmm0, xmmword [0x140746950]
pxor xmm0, xmmword [0x1405f9560]
movd dword [0x140746950], xmm0
xor byte [0x140746954], 0xa7
xor byte [0x140746955], 0x9f
xor byte [0x140746957], 0x81
xor byte [0x140746958], 0x7c
mov al, 0x71
xchg byte [0x140746959], al
movzx eax, byte [0x14074696c]
cmp al, 0xf3
je 0x14034a0b7
mov cl, 0x91
mov al, 0xb3
lock cmpxchg byte [0x14074696c], cl
je 0x14034a02c
cmp al, 0xf3
jne 0x14034a017
jmp 0x14034a0b7
mov eax, 0x7b62ae9f
mov ecx, 0x849d516c
mov edx, 1
mov r8d, 0x7b62aea0
mov r9d, 0x849d516a
mov r10d, 0xaaaaaaab
lea r11, [0x140746960]
lea rdi, [0x1405fa060]
mov ebx, ecx
imul rbx, r10
shr rbx, 0x23
lea ebx, [rbx + rbx*2]
lea ebx, [rax + rbx*4]
mov r14d, r9d
imul r14, r10
shr r14, 0x23
lea r14d, [r14 + r14*2]
lea r14d, [r8 + r14*4]
movzx ebp, byte [r14 + rdi]
xor bpl, 0x91
add byte [rdx + r11 - 1], bpl
movzx ebx, byte [rbx + rdi]
xor bl, 0x91
add byte [rdx + r11], bl
add eax, 0xfffffffe
add ecx, 2
add rdx, 2
add r8d, 0xfffffffe
add r9d, 2
cmp rdx, 0xd
jne 0x14034a05b
mov al, 0xf3
xchg byte [0x14074696c], al
mov edi, dword [0x14074aef8]
lea rcx, [0x140746950]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x14034a0f9
mov ecx, 0x85da450f
xor rcx, rdi
mov qword [rsp + 0x58], rcx
lea rcx, [0x140746960]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0x9c00e0ac
mov r8, rax
call fcn.1403481e0
jmp 0x14034a0fb
xor eax, eax
mov qword [0x140791638], rax
mov rcx, rsi
call qword [0x140791638]
mov r13d, eax
jmp 0x14034a737
movabs rax, 0x1fcc8cada4a31940
xor qword [0x140746740], rax
xor byte [0x140746748], 0xb4
mov al, 7
xchg byte [0x140746749], al
movzx eax, byte [0x14074675f]
cmp al, 0x35
je 0x14034a1fd
mov cl, 0x38
mov al, 0x88
lock cmpxchg byte [0x14074675f], cl
je 0x14034a159
cmp al, 0x35
jne 0x14034a144
jmp 0x14034a1fd
mov ecx, 0x2b8bfe0b
mov r8d, 0x2b8bfe0a
xor r10d, r10d
movabs r11, 0x8888888888888889
lea rsi, [0x1405f9f30]
lea rdi, [0x140746750]
mov rax, rcx
mul r11
mov r9, rdx
mov rax, r8
mul r11
shr rdx, 3
mov rax, rdx
shl rax, 4
sub rdx, rax
lea rax, [rsi + rdx]
add rax, 0x2b8bfdff
movzx edx, byte [r10 + rdi]
xor dl, byte [r10 + rax + 0xb]
xor dl, 0x23
mov byte [r10 + rdi], dl
cmp r10, 0xe
je 0x14034a1f5
shr r9, 3
mov rax, r9
shl rax, 4
sub r9, rax
lea rax, [rsi + r9]
add rax, 0x2b8bfe0b
movzx edx, byte [r10 + rdi + 1]
xor dl, byte [rax + r10]
xor dl, 0x23
mov byte [r10 + rdi + 1], dl
add r10, 2
add rcx, 2
add r8, 2
jmp 0x14034a17f
mov al, 0x35
xchg byte [0x14074675f], al
mov esi, dword [0x14074aef8]
lea rcx, [0x140746740]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x14034a23f
mov ecx, 0x85da450f
xor rcx, rsi
mov qword [rsp + 0x58], rcx
lea rcx, [0x140746750]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0x9c00e0ac
mov r8, rax
call fcn.1403481e0
jmp 0x14034a241
xor eax, eax
mov qword [0x1407915d0], rax
call qword [0x1407915d0]
mov r13, rax
jmp 0x14034a737
lea ecx, [rax - 0x744fd30e]
mov edx, 0xaaaaaaab
imul rdx, rcx
shr rdx, 0x22
add edx, edx
lea ecx, [rdx + rdx*2]
neg ecx
add ecx, eax
add ecx, 0x8bb02cf2
cdqe
lea rdx, [0x140746860]
movzx r8d, byte [rax + rdx]
lea r9, [0x1405f9fc0]
xor r8b, byte [rcx + r9]
xor r8b, 0xcf
mov byte [rax + rdx], r8b
inc eax
cmp eax, 9
jl 0x14034a513
mov al, 0xfa
xchg byte [0x140746869], al
movzx eax, byte [0x140746880]
cmp al, 0xf7
je 0x14034a2d0
mov cl, 0x22
nop dword [rax]
mov al, 0x9f
lock cmpxchg byte [0x140746880], cl
je 0x14034a31a
cmp al, 0xf7
jne 0x14034a2c0
mov r15d, dword [0x14074aef8]
lea rcx, [0x140746860]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x14034a54a
mov ecx, 0x85da450f
xor rcx, r15
mov qword [rsp + 0x58], rcx
lea rcx, [0x140746870]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0x9c00e0ac
mov r8, rax
call fcn.1403481e0
jmp 0x14034a54c
lea r10, [0x1405f9fd0]
lea r11, [r10 + 0x117f955c]
add r10, 0x117f955b
mov ecx, 0x117f955c
mov r8d, 0x117f955b
movabs r12, 0x4ec4ec4ec4ec4ec5
lea r13, [0x140746870]
nop dword [rax + rax]
mov rax, rcx
mul r12
mov r9, rdx
mov rax, r8
mul r12
shr rdx, 2
imul rax, rdx, 0xfffffffffffffff3
movzx eax, byte [r10 + rax]
xor al, 0xc6
add byte [rcx + r13 - 0x117f955c], al
shr r9, 2
imul rax, r9, 0xfffffffffffffff3
movzx eax, byte [r11 + rax]
xor al, 0xc6
add byte [rcx + r13 - 0x117f955b], al
add r11, 2
add rcx, 2
add r10, 2
add r8, 2
cmp rcx, 0x117f956c
jne 0x14034a350
mov al, 0xf7
xchg byte [0x140746880], al
test bpl, 0x20
je 0x14034a2d0
mov al, 0xe1
xchg byte [0x140746929], al
movzx eax, byte [0x140746944]
cmp al, 0xff
je 0x14034a3e0
mov cl, 0x53
nop dword [rax]
mov al, 6
lock cmpxchg byte [0x140746944], cl
je 0x14034a42a
cmp al, 0xff
jne 0x14034a3d0
mov r12d, dword [0x14074aef8]
lea rcx, [0x140746920]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x14034a522
mov ecx, 0x85da450f
xor rcx, r12
mov qword [rsp + 0x58], rcx
lea rcx, [0x140746930]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0x9c00e0ac
mov r8, rax
call fcn.1403481e0
jmp 0x14034a524
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rdi
mov eax, 0x59c0af4f
mov ecx, 0xa63f50c5
mov edx, 1
mov r8d, 0x59c0af50
mov r9d, 0xa63f50c4
mov r10d, 0x86186187
lea r11, [0x140746930]
lea r12, [0x1405fa040]
nop dword [rax + rax]
mov r13d, ecx
imul r13, r10
shr r13, 0x20
mov r15d, ecx
sub r15d, r13d
shr r15d, 1
add r15d, r13d
shr r15d, 4
lea r13d, [r15 + r15*4]
lea r13d, [r15 + r13*4]
add r13d, eax
mov r15d, r9d
imul r15, r10
shr r15, 0x20
mov edi, r9d
sub edi, r15d
shr edi, 1
add edi, r15d
shr edi, 4
lea r15d, [rdi + rdi*4]
lea edi, [rdi + r15*4]
add edi, r8d
movzx r15d, byte [rdx + r11 - 1]
movzx ebx, byte [rdx + r11]
add r15b, byte [rdi + r12]
add r15b, 0x80
mov byte [rdx + r11 - 1], r15b
add bl, byte [r13 + r12]
add bl, 0x80
mov byte [rdx + r11], bl
add eax, 0xfffffffe
add ecx, 2
add rdx, 2
add r8d, 0xfffffffe
add r9d, 2
cmp rdx, 0x15
jne 0x14034a470
mov al, 0xff
xchg byte [0x140746944], al
xor eax, eax
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov r15, qword [rsp + 0x60]
test bpl, 0x40
je 0x14034a256
jmp 0x14034a3e0
xor eax, eax
mov qword [0x140791630], rax
mov qword [rsp + 0x20], rsi
mov rcx, rbx
mov edx, r15d
mov r8, rdi
mov r9d, r14d
call qword [0x140791630]
mov r13d, eax
jmp 0x14034a737
xor eax, eax
mov qword [0x140791610], rax
mov rcx, rbx
mov edx, esi
mov r8d, edi
mov r9, r14
call qword [0x140791610]
mov r13d, eax
jmp 0x14034a737
mov ecx, 0xffff
test byte [rdi + 0x70], 2
jne 0x14034a61b
mov rax, qword [rdi + 0x50]
inc dword [rax]
mov rax, qword [r13]
add qword [rax], 0xfffffffffffffffe
mov rax, qword [r13]
mov rax, qword [rax]
mov word [rax], r15w
mov rcx, r15
test bpl, bpl
jns 0x14034a61b
cmp r14b, 0xa4
je 0x14034a5de
xor ecx, ecx
mov dl, 0xc3
mov al, 2
lock cmpxchg byte [0x140746899], dl
mov r14d, eax
jne 0x14034a597
movq xmm0, qword [0x140746890]
paddb xmm0, xmmword [0x1405f95b0]
movq qword [0x140746890], xmm0
add byte [0x140746898], 0x28
mov al, 0xa4
xchg byte [0x140746899], al
jmp 0x14034a5ea
test ebp, 0x400
je 0x14034a6e1
movzx eax, byte [0x1407468b1]
cmp al, 0x6c
je 0x14034a766
mov dl, 0x62
xor ecx, ecx
mov al, 0x3d
lock cmpxchg byte [0x1407468b1], dl
je 0x140349c76
cmp al, 0x6c
jne 0x14034a5fd
test bpl, 0x20
je 0x14034a766
movzx r13d, cx
jmp 0x14034a737
mov cl, 0x79
mov al, 0xdb
lock cmpxchg byte [0x14074679d], cl
je 0x14034a64f
lea r13, [rsp + 0x80]
cmp al, 0x16
je 0x14034a6e1
test ebp, 0x200
je 0x14034a624
jmp 0x14034a56c
mov ecx, 0x916e4646
lea r8, [rcx + 2]
xor r10d, r10d
movabs r11, 0xcccccccccccccccd
lea rsi, [0x1405f9f50]
add rsi, rcx
lea rdi, [0x140746790]
mov rax, r8
mul r11
mov r9, rdx
mov rax, rcx
mul r11
shr rdx, 2
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*4]
mov rdx, rsi
sub rdx, rax
movzx eax, byte [rdx + r10 + 1]
xor al, 0xc1
add byte [r10 + rdi], al
cmp r10, 0xc
je 0x14034a6d9
shr r9, 2
and r9, 0xfffffffffffffffe
lea rax, [r9 + r9*4]
mov rdx, rsi
sub rdx, rax
add rdx, 2
movzx eax, byte [rdx + r10]
xor al, 0xc1
add byte [r10 + rdi + 1], al
add r10, 2
add r8, 2
add rcx, 2
jmp 0x14034a676
mov al, 0x16
xchg byte [0x14074679d], al
mov esi, dword [0x14074aef8]
lea rcx, [0x140746780]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x14034a723
mov ecx, 0x85da450f
xor rcx, rsi
mov qword [rsp + 0x58], rcx
lea rcx, [0x140746790]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0x9c00e0ac
mov r8, rax
mov eax, eax
call fcn.1403481e0
jmp 0x14034a725
xor eax, eax
mov qword [0x1407915e0], rax
mov ecx, ebx
call qword [0x1407915e0]
xor r13d, r13d
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14059b6c0
mov rax, r13
add rsp, 0x1a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov al, 0x6c
xchg byte [0x1407468b1], al
mov esi, dword [0x14074aef8]
lea rcx, [0x140746890]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x14034a7a8
mov ecx, 0x85da450f
xor rcx, rsi
mov qword [rsp + 0x58], rcx
lea rcx, [0x1407468a0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0x9c00e0ac
mov r8, rax
call fcn.1403481e0
jmp 0x14034a7aa
xor eax, eax
mov qword [0x140791618], rax
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14059b6c0
nop
add rsp, 0x1a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [0x140791618]
movzx ecx, word [r13]
mov rdx, rsi
call fcn.140095760
mov word [r13], ax
add r13, 2
cmp r13, r12
je 0x14034a737
test bpl, 0x20
je 0x14034a7dc
mov esi, dword [0x14074aef8]
lea rcx, [0x140746610]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x14034a843
mov ecx, 0x85da450f
xor rcx, rsi
mov qword [rsp + 0x58], rcx
lea rcx, [0x140746620]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0x9c00e0ac
mov r8, rax
call fcn.1403481e0
jmp 0x14034a845
xor eax, eax
mov qword [0x140791598], rax
mov rcx, r14
mov rdx, rdi
mov r8, rbx
mov r9, r15
call qword [0x140791598]
mov r13d, eax
jmp 0x14034a737
mov cl, 0xde
mov al, 0x4c
lock cmpxchg byte [0x1407469a9], cl
je 0x14034a87e
cmp al, 3
jne 0x14034a969
jmp 0x14034a8ba
movdqa xmm0, xmmword [0x1407469a0]
paddb xmm0, xmmword [0x1405f9580]
movd dword [0x1407469a0], xmm0
add byte [0x1407469a4], 0xb2
add byte [0x1407469a6], 0xa3
add byte [0x1407469a7], 0x8c
add byte [0x1407469a8], 0x94
mov al, 3
xchg byte [0x1407469a9], al
movzx eax, byte [0x1407469b9]
cmp al, 0xb2
je 0x14034a90a
mov cl, 0x9e
mov al, 0x27
lock cmpxchg byte [0x1407469b9], cl
je 0x14034a8d9
cmp al, 0xb2
jne 0x14034a8c7
jmp 0x14034a90a
test bpl, 0x20
jne 0x14034a102
movq xmm0, qword [0x1407469b0]
paddb xmm0, xmmword [0x1405f9590]
movq qword [0x1407469b0], xmm0
add byte [0x1407469b8], 0x4f
mov al, 0xb2
xchg byte [0x1407469b9], al
mov esi, dword [0x14074aef8]
lea rcx, [0x1407469a0]
call sub.KERNEL32.dll_LoadLibraryA
mov ah, 0xb2
invalid
dec dword [rax - 0x7b]
invalid
je 0x14034a94c
mov ecx, 0x85da450f
xor rcx, rsi
mov qword [rsp + 0x58], rcx
lea rcx, [0x1407469b0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0x9c00e0ac
mov r8, rax
call fcn.1403481e0
jmp 0x14034a94e
xor eax, eax
mov qword [0x140791648], rax
mov rcx, r14
mov rdx, r15
call qword [0x140791648]
mov r13d, eax
jmp 0x14034a737
test bpl, 0x40
je 0x14034a866
mov cl, 0x7a
mov al, 0x4d
lock cmpxchg byte [0x140746636], cl
je 0x14034a995
cmp al, 0xfb
jne 0x14034a969
lea rsi, [rsp + 0x80]
xor r13d, r13d
jmp 0x14034a7fb
test ebp, 0x200
jne 0x14034a75e
mov rbp, r15
mov r13, rbx
mov r15, rdi
mov eax, 0xa1c7a3eb
mov ecx, 0x5e385c2a
mov edx, 1
mov r8d, 0xa1c7a3ec
mov r9d, 0x5e385c28
mov r10d, 0xba2e8ba3
lea r11, [0x140746620]
lea rsi, [0x1405f9e90]
mov r12d, ecx
imul r12, r10
shr r12, 0x24
lea edi, [r12 + r12*4]
lea edi, [r12 + rdi*4]
lea edi, [rsp + rdi*4]
add r12d, eax
add r12d, edi
mov edi, r9d
imul rdi, r10
shr rdi, 0x24
lea ebx, [rdi + rdi*4]
lea ebx, [rdi + rbx*4]
add edi, r8d
add edi, ebx
movzx ebx, byte [rdi + rsi]
xor bl, 0x8a
add byte [rdx + r11 - 1], bl
movzx ebx, byte [r12 + rsi]
xor bl, 0x8a
add byte [rdx + r11], bl
add eax, 0xfffffffe
add ecx, 2
add rdx, 2
add r8d, 0xfffffffe
add r9d, 2
cmp rdx, 0x17
jne 0x14034a9d9
mov al, 0xfb
xchg byte [0x140746636], al
mov rdi, r15
mov rbx, r13
mov r15, rbp
jmp 0x14034a801