Function at 0x140043260
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Get disk size

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x968]
sub rsp, 0xa30
mov qword [rbp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
movaps xmmword [rax - 0x48], xmm6
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp + 0x910], rax
mov qword [rbp - 0x10], r8
mov rdi, rdx
mov qword [rbp - 0x18], rdx
mov r13, rcx
xor sil, sil
xor r14d, r14d
mov r12d, r14d
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], r14
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov eax, dword [0x1401c4d60]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 0x80000007
jge 0x1400432f5
dec ecx
or ecx, 0xfffffff8
inc ecx
cmp ecx, 1
jne 0x140043320
mov ecx, 4
call fcn.1400cea88
mov rdi, rax
call fcn.1400cebc4
mov dword [rdi], eax
mov dword [0x1401c4d60], eax
mov rcx, rdi
call fcn.1400ce2b0
mov rdi, qword [rbp - 0x18]
call fcn.140042350
test al, al
jne 0x1400433d4
mov r8d, r14d
mov edx, dword [0x1401c4d60]
nop word [rax + rax]
mov ecx, r8d
and ecx, 1
dec ecx
not ecx
and ecx, edx
mov eax, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, edx
sar ecx, 1
xor eax, ecx
add edx, eax
inc r8d
cmp r8d, 0x100
jl 0x140043340
mov dword [0x1401c4d60], edx
cmp byte [r13 + 0x18], 0
je 0x140044450
mov rax, qword [rdi]
cmp dword [rax - 0x10], 0
je 0x140044450
call fcn.140042260
test al, al
jne 0x140043469
lea rsi, [rbp + 0x50]
nop dword [rax]
xor r10d, r10d
nop word [rax + rax]
lea edi, [r10 + 1]
lea ecx, [r14 + 1]
mov r8d, dword [0x1401c4d60]
mov eax, r8d
cdq
idiv ecx
mov r9d, edx
mov ecx, r8d
sub ecx, r14d
imul r9d, ecx
mov eax, r8d
cdq
idiv edi
add r9d, eax
sub r9d, r10d
mov dword [rsi], r9d
mov edx, r9d
lea rcx, [0x14014d9a0]
call fcn.1400cf1dc
mov r10d, edi
add rsi, 4
cmp edi, 0x18
jl 0x140043410
inc r14d
cmp r14d, 2
jl 0x140043400
mov rdi, qword [rbp - 0x18]
mov rdi, qword [rdi]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
mov esi, 1
cmp dword [rdi - 8], 0
jl 0x14004349d
cmp rax, qword [rdi - 0x18]
jne 0x14004349d
lea r14, [rdi - 0x18]
lock inc dword [rdi - 8]
mov r12, qword [rbp - 0x80]
mov rbx, qword [rsp + 0x30]
jmp 0x1400434d4
mov rax, qword [rax]
mov r8d, esi
mov edx, dword [rdi - 0x10]
call qword [rax]
mov r14, rax
test rax, rax
jne 0x1400434b6
call fcn.140002490
int3
mov eax, dword [rdi - 0x10]
mov dword [r14 + 8], eax
mov eax, dword [rdi - 0x10]
inc eax
movsxd rdx, eax
mov r8, rdi
lea rcx, [r14 + 0x18]
mov r9, rdx
call fcn.1400cebf0
lea rdi, [r14 + 0x18]
mov qword [rsp + 0x40], rdi
movsxd r14, dword [rdi - 0x10]
cmp dword [rdi - 8], 1
jle 0x1400434f9
mov edx, dword [rdi - 0x10]
lea rcx, [rsp + 0x40]
call fcn.14001af50
mov rdi, qword [rsp + 0x40]
mov rcx, r14
test r14b, 3
jne 0x140044169
mov rax, rcx
shr rax, 2
lea r14, [rax + rax*2]
mov qword [rbp - 0x20], r14
cmp byte [rcx + rdi - 1], 0x3d
jne 0x140043523
dec r14
mov qword [rbp - 0x20], r14
cmp byte [rcx + rdi - 2], 0x3d
jne 0x140043531
dec r14
mov qword [rbp - 0x20], r14
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov r8d, dword [0x1401c4d60]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
mov eax, ecx
sub eax, edx
cmp eax, 6
jne 0x14004360d
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xb
jne 0x1400435b5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0xcccccccd
mul ecx
shr edx, 6
lea eax, [rdx + rdx*4]
shl eax, 4
sub ecx, eax
lea r8d, [rcx + 1]
mov dword [0x1401c4d60], r8d
movsd xmm3, qword [0x1401542b8]
xorps xmm2, xmm2
movd xmm4, r8d
cvtdq2pd xmm4, xmm4
movsd xmm5, qword [0x1401542e0]
movsd xmm6, qword [0x1401542b0]
nop dword [rax]
addsd xmm2, xmm3
movaps xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x1400435f9
subsd xmm2, xmm3
divsd xmm3, xmm5
movaps xmm1, xmm2
mulsd xmm1, xmm2
movaps xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmm6
ja 0x1400435e0
mov rdx, r14
lea rcx, [rsp + 0x58]
call fcn.14002a560
mov eax, dword [rdi - 0x10]
mov dword [rsp + 0x3c], eax
cmp dword [rdi - 8], 1
jle 0x14004363c
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.14001af50
mov rdi, qword [rsp + 0x40]
mov eax, dword [rsp + 0x3c]
test rdi, rdi
je 0x140043eb8
movsxd rdx, eax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9, r14
mov r14, qword [rsp + 0x58]
mov r8, r14
mov rcx, rdi
call fcn.140020090
test al, al
je 0x140043eb8
xor al, al
mov dword [rsp + 0x4c], eax
xor edx, edx
mov dword [rsp + 0x3c], edx
mov ecx, dword [r13 + 0x30]
mov dword [rbp - 0x28], ecx
mov eax, dword [rsp + 0x60]
sub eax, r14d
mov dword [rbp - 8], eax
mov esi, edx
mov dword [rsp + 0x54], edx
neg ecx
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x50], eax
nop dword [rax]
mov qword [rbp - 0x68], rdx
mov qword [rbp - 0x60], rdx
mov qword [rbp - 0x58], rdx
movsxd rdx, dword [r13 + 0x30]
lea rcx, [rbp - 0x68]
call fcn.14002a560
movsxd rdx, esi
mov ecx, dword [r13 + 0x30]
mov rax, qword [rsp + 0x60]
sub rax, r14
sub rax, rdx
mov esi, dword [rsp + 0x50]
cmp rax, rcx
cmova esi, ecx
movsxd r8, esi
add rdx, r14
mov r14, qword [rbp - 0x68]
mov rcx, r14
call fcn.1400ce300
mov edx, dword [rsp + 0x54]
lea eax, [rdx + rsi]
mov ecx, dword [rsp + 0x4c]
movzx ecx, cl
cmp eax, dword [rbp - 8]
mov esi, 1
cmovge ecx, esi
mov dword [rsp + 0x4c], ecx
mov ecx, dword [rsp + 0x3c]
inc ecx
mov dword [rsp + 0x3c], ecx
add edx, dword [rbp - 0x28]
mov dword [rsp + 0x54], edx
mov eax, dword [rsp + 0x38]
add dword [rsp + 0x50], eax
mov eax, dword [rbp - 0x78]
sub eax, r12d
mov dword [rsp + 0x48], eax
mov eax, dword [r13 + 0x30]
sub eax, 0xb
imul eax, ecx
movsxd rdx, eax
lea rcx, [rbp - 0x80]
call fcn.14002a560
movsxd r8, dword [rsp + 0x48]
mov r12, qword [rbp - 0x80]
mov dword [rsp + 0x20], esi
mov r9, qword [r13 + 0x28]
mov rdx, r14
mov ecx, dword [r13 + 0x30]
add r8, r12
cmp byte [r13 + 0x34], 0
je 0x140043771
call fcn.14006f660
mov esi, eax
cmp eax, 0xffffffff
je 0x14004381c
jmp 0x1400437c3
call fcn.14006f690
mov esi, eax
cmp eax, 0xffffffff
je 0x140043c4c
mov eax, dword [0x1401c4d60]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0xa
jne 0x1400437c3
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov eax, dword [r13 + 0x30]
sub eax, 0xb
cmp esi, eax
jge 0x1400437e4
mov eax, dword [rsp + 0x48]
add eax, esi
movsxd rdx, eax
lea rcx, [rbp - 0x80]
call fcn.14002a560
mov r12, qword [rbp - 0x80]
test r14, r14
je 0x140043800
mov rcx, r14
call fcn.1400ce2b0
xor r14d, r14d
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r14
mov eax, dword [rsp + 0x4c]
test al, al
jne 0x140043a26
mov r14, qword [rsp + 0x58]
mov esi, dword [rsp + 0x54]
xor edx, edx
jmp 0x1400436a0
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x38], rax
lea rdx, str.RSA_private_decrypt_
test rdx, 0xffffffffffff0000
jne 0x140043865
movzx edi, dx
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x140043875
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.1400025a0
jmp 0x140043875
mov r8d, 0x14
lea rcx, [rbp - 0x38]
call fcn.1400022b0
nop
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 8], rax
lea r8, [rbp - 0x38]
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x28]
call fcn.1400207c0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400438f3
cmp dword [rbx + 0x10], 0
jl 0x1400438e4
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400438e4
call fcn.140002400
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x1400438d9
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x30], rax
jmp 0x1400438f3
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.1400022b0
nop
mov rdx, qword [rbp + 0x28]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004390c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 8]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140043925
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004393d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r14d, r14d
mov word [rbp + 0x110], r14w
xor edx, edx
mov r8d, 0x3fe
lea rcx, [rbp + 0x112]
call fcn.1400d3710
call fcn.140070d20
mov ecx, eax
lea rdx, [rbp + 0x110]
call fcn.140070cb0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x14004398b
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14004399f
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x20]
mov rcx, rax
mov eax, r14d
test rcx, rcx
setne al
test eax, eax
jne 0x1400439b7
mov ecx, 0x80004005
call fcn.140001920
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x40], rbx
lea rcx, [rbp + 0x110]
lea rax, [rbp + 0x110]
test rax, 0xffffffffffff0000
jne 0x1400439fb
movzx edi, cx
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x140043a0f
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400025a0
jmp 0x140043a0b
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x40]
call fcn.140003350
mov rbx, qword [rbp - 0x40]
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140010150
nop
jmp 0x140043e55
mov ebx, dword [rbp - 0x78]
sub ebx, r12d
mov ecx, dword [0x1401c4d60]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x30c30c31
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 5
jne 0x140043a6b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401c4d60], eax
lea eax, [rbx + 2]
movsxd rdx, eax
lea rcx, [rbp - 0x80]
call fcn.14002a560
movsxd rax, ebx
mov rsi, qword [rbp - 0x80]
mov byte [rax + rsi], 0
mov r8d, dword [0x1401c4d60]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 3
jne 0x140043b32
test r8d, r8d
je 0x140043b32
nop dword [rax + rax]
mov eax, r8d
and eax, 0x80000001
jge 0x140043ad1
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x140043ae8
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov dword [0x1401c4d60], eax
jmp 0x140043af7
lea r8d, [r8*2 + 1]
mov dword [0x1401c4d60], r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov ecx, r8d
sub ecx, eax
je 0x140043b1b
sub ecx, 2
je 0x140043b1f
dec ecx
je 0x140043b22
jmp 0x140043b2d
add r8d, 2
inc r8d
add r8d, 2
mov dword [0x1401c4d60], r8d
test r8d, r8d
jne 0x140043ac0
lea eax, [rbx + 1]
movsxd rcx, eax
mov byte [rcx + rsi], 0
cmp qword [rbp - 0x78], rsi
je 0x140043b93
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x30], rax
mov rdx, rsi
lea rcx, [rbp - 0x30]
call fcn.140003350
nop
lea rdx, [rbp - 0x30]
mov rcx, qword [rbp - 0x10]
call fcn.140002220
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140043b8e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rbp - 0x10]
mov rcx, rdx
call fcn.140027080
mov edx, dword [0x1401c4d60]
lea r8d, [rdx + 2]
lea ecx, [rdx + 1]
imul r8d, ecx
imul r8d, edx
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 0xe
jne 0x140043bfe
mov eax, 0xc8
mov r8d, 0xde
nop dword [rax]
test r8d, r8d
je 0x140043bf5
mov ecx, r8d
cdq
idiv r8d
mov r8d, edx
mov eax, ecx
test ecx, ecx
jne 0x140043be0
add eax, r8d
mov dword [0x1401c4d60], eax
mov sil, 1
call fcn.1400423f0
test al, al
jne 0x140043c10
dec dword [0x1401c5cb0]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140043c2e
call fcn.1400ce2b0
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
lea rdx, [rdi - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140043c42
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
jmp 0x140044450
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x48], rax
lea rdx, str.RSA_public_decrypt_
test rdx, 0xffffffffffff0000
jne 0x140043c95
movzx edi, dx
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x140043ca5
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.1400025a0
jmp 0x140043ca5
mov r8d, 0x13
lea rcx, [rbp - 0x48]
call fcn.1400022b0
nop
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x10], rax
lea r8, [rbp - 0x48]
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x38]
call fcn.1400207c0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140043d24
cmp dword [rbx + 0x10], 0
jl 0x140043d15
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140043d15
call fcn.140002400
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x140043d0a
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x30], rax
jmp 0x140043d24
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.1400022b0
nop
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140043d3d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x10]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140043d56
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140043d6e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r14d, r14d
mov word [rbp + 0x510], r14w
xor edx, edx
mov r8d, 0x3fe
lea rcx, [rbp + 0x512]
call fcn.1400d3710
call fcn.140070d20
mov ecx, eax
lea rdx, [rbp + 0x510]
call fcn.140070cb0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x140043dbc
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rdx, rax
test rax, rax
jne 0x140043dd0
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x20]
mov rdx, rax
mov ecx, r14d
test rdx, rdx
setne cl
test ecx, ecx
jne 0x140043de8
mov ecx, 0x80004005
call fcn.140001920
int3
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x50], rbx
lea rcx, [rbp + 0x510]
lea rax, [rbp + 0x510]
test rax, 0xffffffffffff0000
jne 0x140043e2f
movzx edi, cx
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x140043e43
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.1400025a0
jmp 0x140043e3f
lea rdx, [rbp + 0x510]
lea rcx, [rbp - 0x50]
call fcn.140003350
mov rbx, qword [rbp - 0x50]
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140010150
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140043e6a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140043e84
call fcn.1400ce2b0
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x68], r14
mov rdx, qword [rbp - 0x18]
mov rdx, qword [rdx]
mov rcx, qword [rbp - 0x10]
call fcn.140003350
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140043eb3
call fcn.1400ce2b0
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
jmp 0x140044415
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x70], rdi
lea r13, str.base64_Decode
test r13, 0xffffffffffff0000
jne 0x140043f08
movzx edi, r13w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x140043f77
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400025a0
jmp 0x140043f77
mov r12d, dword [rdi - 0x10]
mov r14, r13
sub r14, rdi
sar r14, 1
mov ecx, esi
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 0xd
or eax, ecx
jge 0x140043f38
mov edx, 0xd
lea rcx, [rsp + 0x70]
call fcn.1400023a0
mov rdi, qword [rsp + 0x70]
movsxd rdx, dword [rdi - 0xc]
mov r9d, 0x1a
mov rcx, rdi
add rdx, rdx
cmp r14, r12
ja 0x140043f58
lea r8, [rdi + r14*2]
call fcn.1400ceaf4
jmp 0x140043f60
mov r8, r13
call fcn.1400cebf0
cmp dword [rdi - 0xc], 0xd
jl 0x14004415e
mov dword [rdi - 0x10], 0xd
xor eax, eax
mov word [rdi + 0x1a], ax
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp], rax
lea r8, [rsp + 0x70]
lea rdx, [rbp]
lea rcx, [rbp + 0x20]
call fcn.1400207c0
nop
mov r13, qword [rax]
lea rcx, [r13 - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x1400440ec
cmp dword [rdi + 0x10], 0
jl 0x140043fea
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140043fea
call fcn.140002400
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140043fe1
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
jmp 0x1400440e7
movsxd r14, dword [r13 - 0x10]
test r14d, r14d
jne 0x14004404c
mov rsi, qword [rdi]
cmp dword [rdi + 8], r14d
je 0x1400440ec
cmp dword [rdi + 0x10], r14d
jge 0x140044027
cmp dword [rbx - 0xc], r14d
jge 0x140044017
mov ecx, 0x80070057
call fcn.140001920
int3
xor r14d, r14d
mov dword [rbx - 0x10], r14d
mov word [rbx], r14w
jmp 0x1400440ef
lock add dword [rdi + 0x10], 0xffffffff
jg 0x14004403a
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
jmp 0x1400440e7
test r13, r13
jne 0x14004405c
mov ecx, 0x80070057
call fcn.140001920
int3
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x38], eax
mov r12, r13
sub r12, rbx
sar r12, 1
test r14d, r14d
jns 0x14004407c
mov ecx, 0x80070057
call fcn.140001920
int3
sub esi, dword [rdi + 0x10]
mov eax, dword [rdi + 0xc]
sub eax, r14d
or eax, esi
jge 0x14004409b
mov edx, r14d
lea rcx, [rsp + 0x30]
call fcn.1400023a0
mov rbx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
lea rdi, [r14 + r14]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
mov r9, rdi
add rdx, rdx
cmp r12, rax
ja 0x1400440c0
lea r8, [rbx + r12*2]
call fcn.1400ceaf4
jmp 0x1400440c8
mov r8, r13
call fcn.1400cebf0
cmp r14d, dword [rbx - 0xc]
jg 0x1400440dc
mov dword [rbx - 0x10], r14d
xor r14d, r14d
mov word [rdi + rbx], r14w
jmp 0x1400440ef
mov ecx, 0x80070057
call fcn.140001920
int3
mov qword [rsp + 0x30], rax
xor r14d, r14d
mov rdx, qword [rbp + 0x20]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140044108
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140044121
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14004413b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140044159
call fcn.1400ce2b0
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
jmp 0x140044415
mov ecx, 0x80070057
call fcn.140001920
nop
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x78], rdi
lea r13, [0x140151c20]
test r13, 0xffffffffffff0000
jne 0x1400441b9
movzx edi, r13w
mov ecx, edi
call fcn.1400019e0
test rax, rax
je 0x140044228
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400025a0
jmp 0x140044228
mov r12d, dword [rdi - 0x10]
mov r14, r13
sub r14, rdi
sar r14, 1
mov ecx, esi
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 0xe
or eax, ecx
jge 0x1400441e9
mov edx, 0xe
lea rcx, [rsp + 0x78]
call fcn.1400023a0
mov rdi, qword [rsp + 0x78]
movsxd rdx, dword [rdi - 0xc]
mov r9d, 0x1c
mov rcx, rdi
add rdx, rdx
cmp r14, r12
ja 0x140044209
lea r8, [rdi + r14*2]
call fcn.1400ceaf4
jmp 0x140044211
mov r8, r13
call fcn.1400cebf0
cmp dword [rdi - 0xc], 0xe
jl 0x140044445
mov dword [rdi - 0x10], 0xe
xor eax, eax
mov word [rdi + 0x1c], ax
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x18], rax
lea r8, [rsp + 0x78]
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x40]
call fcn.1400207c0
nop
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.140020700
nop
mov r13, qword [rax]
lea rcx, [r13 - 0x18]
lea rdi, [rbx - 0x18]
cmp rcx, rdi
je 0x1400443ad
cmp dword [rdi + 0x10], 0
jl 0x1400442ab
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400442ab
call fcn.140002400
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x1400442a2
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
jmp 0x1400443a8
movsxd r14, dword [r13 - 0x10]
test r14d, r14d
jne 0x14004430d
mov rsi, qword [rdi]
cmp dword [rdi + 8], r14d
je 0x1400443ad
cmp dword [rdi + 0x10], r14d
jge 0x1400442e8
cmp dword [rbx - 0xc], r14d
jge 0x1400442d8
mov ecx, 0x80070057
call fcn.140001920
int3
xor r14d, r14d
mov dword [rbx - 0x10], r14d
mov word [rbx], r14w
jmp 0x1400443b0
lock add dword [rdi + 0x10], 0xffffffff
jg 0x1400442fb
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
jmp 0x1400443a8
test r13, r13
jne 0x14004431d
mov ecx, 0x80070057
call fcn.140001920
int3
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x38], eax
mov r12, r13
sub r12, rbx
sar r12, 1
test r14d, r14d
jns 0x14004433d
mov ecx, 0x80070057
call fcn.140001920
int3
sub esi, dword [rdi + 0x10]
mov eax, dword [rdi + 0xc]
sub eax, r14d
or eax, esi
jge 0x14004435c
mov edx, r14d
lea rcx, [rsp + 0x30]
call fcn.1400023a0
mov rbx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
lea rdi, [r14 + r14]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
mov r9, rdi
add rdx, rdx
cmp r12, rax
ja 0x140044381
lea r8, [rbx + r12*2]
call fcn.1400ceaf4
jmp 0x140044389
mov r8, r13
call fcn.1400cebf0
cmp r14d, dword [rbx - 0xc]
jg 0x14004439d
mov dword [rbx - 0x10], r14d
xor r14d, r14d
mov word [rdi + rbx], r14w
jmp 0x1400443b0
mov ecx, 0x80070057
call fcn.140001920
int3
mov qword [rsp + 0x30], rax
xor r14d, r14d
mov rdx, qword [rbp + 0x30]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400443c9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400443e2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x18]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400443fb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140044415
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140044438
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x30]
xor sil, sil
jmp 0x140044450
mov rbx, qword [rsp + 0x30]
xor sil, sil
xor r14d, r14d
jmp 0x140044450
mov ecx, 0x80070057
call fcn.140001920
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140044465
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14004447f
call fcn.1400ce2b0
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], r14
movzx eax, sil
mov rcx, qword [rbp + 0x910]
xor rcx, rsp
call fcn.1400ce2d0
mov rbx, qword [rsp + 0xa88]
movaps xmm6, xmmword [rsp + 0xa20]
add rsp, 0xa30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret