Function at 0x14000e1d8
Capabilities:
Create thread
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x92b8
call fcn.140001685
sub rsp, rax
movaps xmmword [rsp + 0x92a0], xmm6
jp 0x14000bb6a
jnp 0x14000bb6a
call 0x1883a46b6
mov ebp, dword [rcx + 8]
mov rdi, qword [rcx]
mov rbp, qword [rcx + 8]
mov rbx, qword [rcx + 0x10]
movzx eax, byte [rcx + 0x1c]
lea r13, [rsp + 0x218]
mov qword [r13], rdi
mov qword [r13 + 8], rbp
and qword [r13 + 0x10], 0
mov qword [rsp + 0x140], r13
lea ecx, [rax - 3]
cmp ecx, 0x10
jbe 0x14000bd8c
lea ecx, [rax - 0x2f]
cmp ecx, 9
jbe 0x14000be8e
cmp eax, 0x1b
je 0x14000c63e
cmp eax, 0x21
je 0x14000c7b0
add byte [rax], al
cmp eax, 0x27
je 0x14000c68e
cmp eax, 0x43
je 0x14000c521
cmp eax, 0x49
je 0x14000c5bc
cmp eax, 0x4a
je 0x14000c53d
cmp eax, 0x4e
jne case.0x14000bd9c.7
jbe 0x14000bbf2
ja 0x14000bbf2
call 0x14175bf6a
je 0x14000bbf7
jne 0x14000bbf7
call 0x14172bf6e
jae 0x14000bbfc
jb 0x14000bbfc
call 0x14000bde8
add byte [rax], al
call 0x1417ebf86
call 0x14000bc02
add al, ch
jg 0x14000bc08
jle 0x14000bc08
call 0x1417cbf89
jge 0x14000bc0d
jl 0x14000bc0d
call 0x1417abf8c
jnp 0x14000bc12
jp 0x14000bc12
call 0x14178bf8f
jns 0x14000bc17
js 0x14000bc17
call 0x14174bf90
jne 0x14000bc1c
je 0x14000bc1c
call 0x1417ebf9f
jg 0x14000bc21
jle 0x14000bc21
call 0x14171bf95
jo 0x14000bc26
jno 0x14000bc26
call 0x164954972
cwde
add dword [rax], eax
add byte [rcx + rcx*4 + 0x2a], cl
lea rdx, [rsp + 0x198]
mov qword [rdx], r13
ja 0x14000bc36
jbe 0x14000bc36
call 0x164b54982
invalid
lea rsi, [rsp + 0x160]
mov rcx, rsi
call fcn.14000b82b
movzx esi, word [rsi + 4]
test si, si
jne 0x14000e756
jge 0x14000bc58
jl 0x14000bc58
call 0x1648547a0
invalid
mov r8d, dword [rsp + 0x160]
mov si, 0xb
cmp r8, 0x100
ja 0x14000e756
jo 0x14000bc76
jno 0x14000bc76
call 0x14fc141c7
test byte [rbx + 0x7a000000], ah
add edi, dword [rbx + 1]
test r8, r8
je 0x14000bd22
jp 0x14000bc84
jnp 0x14000bc84
call 0xc8bc49d4
add dword [rax], eax
add byte [rbp + 3], dh
lea r15, [rbx + 0x188]
jne 0x14000bc90
je 0x14000bc90
call 0x164b549dc
mov byte [rbx], cl
add byte [rax], al
lea rsi, [rsp + 0xb88]
mov rcx, rsi
mov rdx, r15
call fcn.140008d0d
movzx esi, word [rsi + 0x10]
test si, si
jne 0x14000e756
jae 0x14000bcb5
jb 0x14000bcb5
call 0x164b54805
mov byte [rbx], cl
add byte [rax], al
mov r14, qword [rsp + 0xb88]
mov rdi, qword [rsp + 0xb90]
lea rdx, [rsp + 0xf0]
mov qword [rdx], r13
jbe 0x14000bcd5
ja 0x14000bcd5
call 0x1648d4a21
add eax, dword [rax]
add byte [rbp - 0x77], cl
invalid
lea rcx, [rsp + 0x340]
mov r8, r14
mov r9, rdi
call fcn.140011e88
call 0x14000bcee
add al, ch
lea r8, [0x140002b34]
mov r9d, 9
mov rcx, r14
mov rdx, rdi
call fcn.14000b7e3
test al, 1
je 0x14000dce9
jge 0x14000bd14
jl 0x14000bd14
call 0x18cfa4664
mov edx, esi
mov rcx, r15
mov rdx, r14
mov r8, rdi
call fcn.14000999c
jo 0x14000bd27
jno 0x14000bd27
call 0x14171c09b
jo 0x14000bd2c
jno 0x14000bd2c
call 0x1417ac0ab
jnp 0x14000bd31
jp 0x14000bd31
call 0x1417cc0b2
jge 0x14000bd36
jl 0x14000bd36
call 0xc36fcd2d
mov byte [rcx], al
add byte [rax], al
movdqu xmm0, xmmword [rbx + 0x188]
lea rdx, [rsp + 0x870]
movdqa xmmword [rdx], xmm0
jle 0x14000bd4f
jg 0x14000bd4f
call 0x18e064a9f
js 0x14000bd54
lea r8, [0x1400035a4]
lea rsi, [rsp + 0x12a0]
mov r9d, 7
mov rcx, rsi
invalid
dec dword [rax - 0x73]
mov ah, 0x24
movabs al, byte [0x7b941000012]
add byte [rax - 0x77], cl
int1
call fcn.140009117
cmp word [rsi + 0x10], 0
jne 0x14000dcd0
mov rdi, qword [rsp + 0x12a8]
mov r14, qword [rsp + 0x12a0]
jmp 0x14000dcd5
xor esi, esi
lea rax, [0x14000f784]
movsxd rcx, dword [rax + rcx*4]
add rcx, rax
jmp rcx
jnp 0x14000bda3
jp 0x14000bda3
call 0x14000bf61
add al, dh
xadd dword [rbx + 0x198], edx
mov edx, 1
lock xadd dword [rbx + 0x198], edx
jns 0x14000bdb5
js 0x14000bdb5
call 0x164458501
and byte [rax + rax], al
add byte [rax], al
mov qword [rsp + 0x20], 4
lea r9, [0x1400029f8]
mov rcx, rbx
mov r8d, 0x1a
call fcn.14000fa8e
mov esi, eax
test ax, ax
jne case.0x14000bd9c.6
jp 0x14000bde3
jnp 0x14000bde3
call 0xc0b44b2f
add dword [rax], eax
add byte [rcx + 3], dh
lea rsi, [rbx + 0x180]
jno 0x14000bdef
jo 0x14000bdef
call 0x128f2473b
or ebx, esi
add al, byte [rax]
mov rcx, rsi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
xor edi, edi
jge 0x14000bdfe
jl 0x14000bdfe
call 0x1a084494a
add dword [rax], eax
add byte [rax - 0x7b], cl
sal byte [rcx + riz + 0x77], 3
mov rax, qword [rbx + 0x160]
test rax, rax
je 0x14000be2b
ja 0x14000be0f
jbe 0x14000be0f
call 0x1417fc191
jle 0x14000be14
jg 0x14000be14
call 0x14169799b
add byte [rax], al
add byte [rdi], cl
test ch, ah
cmp byte [rax], al
add byte [rbx + 0x37af848], cl
cmp dword [rbx + 0x168], 0
je 0x14000f706
mov ecx, dword [rax - 8]
jp 0x14000be29
jnp 0x14000be29
call 0x1437ed818
jmp 0x14000be44
jle 0x14000be30
jg 0x14000be30
call 0x14177c1aa
jbe 0x14000be35
ja 0x14000be35
call 0x1416979bc
add byte [rax], al
add byte [rdi], cl
test ah, al
cmp byte [rax], al
add byte [rcx], dh
leave
cmp dword [rbx + 0x168], 0
je 0x14000f706
xor ecx, ecx
jnp 0x14000be49
jp 0x14000be49
call 0x1437cb8d6
mov edx, edi
jnp 0x14000be50
jp 0x14000be50
call 0x14fd1f79c
test byte [rbp - 0x17ffffc8], ch
add dword [rax], eax
add byte [rax], al
cmp rcx, rdx
je 0x14000f706
call 0x14000be5f
add al, ch
cmp byte [rax + rdx], 0
ja 0x14000be69
jbe 0x14000be69
call 0x13f48c3e5
ret 0xdbeb
js 0x14000be70
inc rdx
jmp 0x14000be4b
mov rax, qword [rax - 0x18]
lea edi, [rdx + 1]
mov rax, qword [rax + rdx*8]
mov rcx, qword [rax]
mov rax, qword [rax + 8]
jns 0x14000be87
js 0x14000be87
call 0x1abea8f8a
invalid
call rax
jmp 0x14000bdf9
lea rax, [0x14000f7c8]
movsxd rcx, dword [rax + rcx*4]
add rcx, rax
jmp rcx
jno 0x14000bea3
jo 0x14000bea3
call 0x1417bc221
jp 0x14000bea8
jnp 0x14000bea8
call 0x164954bf4
mov byte [rbx], cl
add byte [rax], al
lea rdx, [rsp + 0xb88]
mov qword [rdx], r13
jle 0x14000beb8
jg 0x14000beb8
call 0x164b54c04
movabs al, byte [0x63e8f18948000012]
stc
invalid
lea rsi, [rsp + 0x12a0]
mov rcx, rsi
call fcn.14000b82b
movzx esi, word [rsi + 4]
test si, si
jne 0x14000bef0
call 0x14000bed7
add al, ch
mov eax, dword [rsp + 0x12a0]
imul rcx, rax, 0xf4240
jno 0x14000beeb
jo 0x14000beeb
call 0x13fd897d7
push qword [rbx + rax + 0x75]
add eax, ebp
call 0x1400096c8
je 0x14000bef5
jne 0x14000bef5
call 0x14175c26d
je 0x14000befa
jne 0x14000befa
call 0x1401d80e7
add byte [rdx + 3], dh
jb 0x14000bf04
jmp case.0x14000bd9c.6
jb 0x14000bf04
jae 0x14000bf04
call 0x17e164c50
insb byte [rdi], dx
invalid
lea rdx, [0x140002b49]
mov r8d, 0xb
jmp 0x14000dbb6
je 0x14000bf1b
jne 0x14000bf1b
call 0x164954c67
add dword [rax], eax
add byte [rcx + 0x606e901], dh
add byte [rax], al
lea rdx, [rsp + 0x140]
mov cl, 1
jmp 0x14000c530
jnp 0x14000bf2f
jp 0x14000bf2f
call 0x1417bc2ad
jp 0x14000bf34
jnp 0x14000bf34
call 0x14173c2aa
jb 0x14000bf39
jae 0x14000bf39
call 0x164bd4c89
jo 0x14000bf47
lea r15, [rsp + 0x870]
add byte [rax], al
lea rsi, [rsp + 0x12a0]
add byte [rax], al
mov rcx, r15
mov rdx, rsi
mov r8, rdi
mov r9, rbp
call fcn.1400102cd
cmp word [r15 + 8], 0
jne 0x14000db9a
jnp 0x14000bf6b
jp 0x14000bf6b
call 0x164854ab7
jo 0x14000bf79
mov rax, qword [rsp + 0x870]
add byte [rax], al
cmp rax, 0x104
ja 0x14000db9a
jl 0x14000bf84
jge 0x14000bf84
call 0xcd497f89
mov word [rax + rcx*4], fs
or eax, dword [rax]
add byte [rsi - 0x77], ah
add dword [rsi - 0x77], esp
add cl, byte [r8 - 0x77]
jno 0x14000bfa1
add eax, eax
lea rcx, [rsp + 0xb88]
mov word [rcx], ax
mov word [rcx + 2], ax
mov qword [rcx + 8], rsi
jo 0x14000bf9e
jno 0x14000bf9e
call 0x142f58d8a
add byte [0x10000bfbb], bh
call 0x14003b470
add al, byte [rax]
cmp eax, 0xc0000013
je 0x14000db8c
test eax, eax
jne 0x14000db93
js 0x14000bfbb
jns 0x14000bfbb
call 0x14175c333
je 0x14000bfc0
jne 0x14000bfc0
call 0x14175c338
je 0x14000bfc5
jne 0x14000bfc5
call 0x14019d3b2
add byte [rdx + 3], dh
jb 0x14000bfcf
jmp 0x14000d8dd
jb 0x14000bfcf
jae 0x14000bfcf
call 0x14178c34c
jns 0x14000bfd4
js 0x14000bfd4
call 0x164954d20
jo 0x14000bfe2
lea rdx, [rsp + 0x870]
add byte [rax], al
mov qword [rdx], r13
jl 0x14000bfe4
jge 0x14000bfe4
add eax, ebp
call 0x164b54d30
mov byte [rbx], cl
add byte [rax], al
lea rsi, [rsp + 0xb88]
mov rcx, rsi
call fcn.14000b82b
movzx esi, word [rsi + 4]
test si, si
jne 0x14000d747
jno 0x14000c006
jo 0x14000c006
call 0xc8257c95
or eax, dword [rax]
add byte [rax - 0x73], cl
mov bl, 0x80
add dword [rax], eax
add byte [rbp + 3], dh
mov edi, dword [rsp + 0xb88]
lea rsi, [rbx + 0x180]
jne 0x14000c019
je 0x14000c019
call 0x128f24965
fcompi st(0)
add al, byte [rax]
mov rcx, rsi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
ja 0x14000c026
jbe 0x14000c026
call 0x1a0b44b76
add dword [rax], eax
add byte [rbp + rcx*4 + 0x3d], cl
invalid
mov r14, qword [rbx + 0x160]
lea r15, [0x1400037f8]
cmp dword [rbx + 0x168], 0
je 0x14000d6e5
jb 0x14000c046
jae 0x14000c046
call 0x1b6e9b9d3
add byte [r8], al
mov ecx, edi
call 0x1400109c3
test r14, r14
je 0x14000ceb3
jp 0x14000c05b
jnp 0x14000c05b
call 0x1384f4ba0
mov ecx, dword [r14 - 8]
lea edx, [rcx - 1]
jmp 0x14000ceba
je 0x14000c06c
jne 0x14000c06c
call 0x1417dc3ec
jl 0x14000c071
jge 0x14000c071
call 0x14175c3e9
je 0x14000c076
jne 0x14000c076
call 0x14000c262
add byte [rax], al
call 0x164954dc9
add eax, dword [rax]
add byte [rcx + rcx*4 + 0x2a], cl
call 0x14000c07c
add al, ch
lea rdx, [rsp + 0x340]
mov qword [rdx], r13
jle 0x14000c08d
jg 0x14000c08d
call 0x164b54dd9
jo 0x14000c09b
lea rsi, [rsp + 0x870]
add byte [rax], al
mov rcx, rsi
call fcn.14000b82b
movzx esi, word [rsi + 4]
test si, si
jne 0x14000c0f5
invalid
jne 0x14000c0ab
je 0x14000c0ab
call 0x1b0257d3a
or byte [rax], al
add byte [rax - 0x73], cl
xchg esp, eax
and al, 0x88
or eax, dword [rax]
add byte [rcx + rcx*4 + 0x2a], cl
mov edi, dword [rsp + 0x870]
lea rdx, [rsp + 0xb88]
mov qword [rdx], r13
jp 0x14000c0c2
jnp 0x14000c0c2
call 0x164b54e0e
movabs al, byte [0x59e8f18948000012]
idiv edi
dec dword [rdi]
mov bh, 0x76
add al, 0x66
test esi, esi
lea rsi, [rsp + 0x12a0]
mov rcx, rsi
call fcn.14000b82b
movzx esi, word [rsi + 4]
test si, si
jne 0x14000c0f5
jg 0x14000c0e0
jle 0x14000c0e0
call 0xe025456e
adc al, byte [rax]
add byte [rcx + 0x108bb], cl
add byte [rax + 0x11283], cl
add byte [rcx], dh
div byte [rbx + 3]
mov al, byte [rsp + 0x12a0]
mov dword [rbx + 0x108], edi
mov byte [rbx + 0x112], al
xor esi, esi
jae 0x14000c0fa
jb 0x14000c0fa
call 0x1417bc478
jp 0x14000c0ff
jnp 0x14000c0ff
call 0x14179c47b
js 0x14000c104
jns 0x14000c104
call 0x14172c47b
jae 0x14000c109
jb 0x14000c109
call 0x1401b73f6
add byte [rcx + 3], dh
jno 0x14000c113
jmp case.0x14000bd9c.6
jno 0x14000c113
jo 0x14000c113
call 0x14177c48d
jbe 0x14000c118
ja 0x14000c118
call 0x1417fc49a
jle 0x14000c11d
jg 0x14000c11d
call 0x1417ac49c
jnp 0x14000c122
jp 0x14000c122
call 0x14171c496
jo 0x14000c127
jno 0x14000c127
call 0xc8bc4e77
add dword [rax], eax
add al, ch
add dword [rax], eax
add byte [rax], al
lea r15, [rbx + 0x188]
call 0x14000c134
add al, ch
lea rsi, [rsp + 0xb88]
mov rcx, rsi
mov rdx, r15
mov r8, rdi
mov r9, rbp
call fcn.140009117
movzx esi, word [rsi + 0x10]
test si, si
jne 0x14000e019
jle 0x14000c160
jg 0x14000c160
call 0x164b54cb0
mov byte [rbx], cl
add byte [rax], al
mov r14, qword [rsp + 0xb88]
mov rdi, qword [rsp + 0xb90]
call 0x14000c176
add al, ch
lea r9, [0x140002a00]
lea rsi, [rsp + 0x870]
mov rcx, rsi
mov rdx, r14
mov r8, rdi
call fcn.140010407
cmp word [rsi + 8], 0
je 0x14000ce09
ja 0x14000c1a4
jbe 0x14000c1a4
call 0x199164ef0
push 0xffffffffb841ffff
add al, 0
add byte [rax], al
lea rdx, [0x140002a04]
mov r8d, 4
mov rcx, rbx
call fcn.14000f956
test ax, ax
je 0x14000dcc9
mov esi, eax
jge 0x14000c1c9
jl 0x14000c1c9
call 0x1401effb6
add byte [rdi + 3], dh
ja 0x14000c1d3
jmp 0x14000e00b
ja 0x14000c1d3
jbe 0x14000c1d3
call 0x1448c0a3c
and eax, 0x30
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x58], rax
cmp rbp, 4
jae 0x14000c825
jns 0x14000c1fc
js 0x14000c1fc
call 0x14fee4748
test byte [rax + 0x16], cl
add byte [rax], al
test rbp, rbp
je 0x14000d84d
jne 0x14000c20a
je 0x14000c20a
call 0x19be9c998
adc eax, 0x37b0000
jnp 0x14000c216
mov al, byte [rdi]
jmp 0x14000d76c
jnp 0x14000c216
jp 0x14000c216
call 0x1417ac595
jnp 0x14000c21b
jp 0x14000c21b
call 0x1417ac59a
jnp 0x14000c220
jp 0x14000c220
call 0x14000c40c
add byte [rax], al
call 0x1417dc5a7
call 0x14000c226
add al, ch
jl 0x14000c22c
jge 0x14000c22c
call 0x1417ac5ab
jnp 0x14000c231
jp 0x14000c231
call 0x14170c5a6
jno 0x14000c236
jo 0x14000c236
call 0x14173c5ac
jb 0x14000c23b
jae 0x14000c23b
call 0x1417bc5b9
jp 0x14000c240
jnp 0x14000c240
call 0x14172c5b7
jae 0x14000c245
jb 0x14000c245
call 0x14174c5be
jne 0x14000c24a
je 0x14000c24a
call 0x14177c5c4
jbe 0x14000c24f
ja 0x14000c24f
call 0x1417cc5d0
jge 0x14000c254
jl 0x14000c254
call case.0x14000be9c.55
add byte [rax], al
call 0x1417fc5dd
call 0x14000c25a
add al, ch
jle 0x14000c260
jg 0x14000c260
call 0x1417cc5e1
jge 0x14000c265
jl 0x14000c265
call 0x14171c5d9
jo 0x14000c26a
jno 0x14000c26a
call 0x14177c5e4
jbe 0x14000c26f
ja 0x14000c26f
call 0x1417ac5ee
jnp 0x14000c274
jp 0x14000c274
call 0x14176c5ef
ja 0x14000c279
jbe 0x14000c279
call 0x144fe45c5
cmp rbp, 4
mov esi, 4
cmovb rsi, rbp
ja 0x14000c28b
jbe 0x14000c28b
call 0x1648d4fd7
add qword [rax], rax
add byte [rax - 0x77], cl
cli
lea rcx, [rsp + 0x148]
mov rdx, rdi
mov r8, rsi
call fcn.1400027aa
mov qword [rsp + 0x228], rsi
lea rdx, [rsp + 0x150]
mov qword [rdx], r13
jl 0x14000c2b6
jge 0x14000c2b6
call 0x164b55002
pop rax
add dword [rax], eax
add byte [rax - 0x77], cl
int1
lea rsi, [rsp + 0x158]
mov rcx, rsi
call fcn.14000b82b
movzx esi, word [rsi + 4]
test si, si
jne 0x14000ee2f
jae 0x14000c2d8
jb 0x14000c2d8
call 0x198257f67
add dword [rax], eax
add byte [rbp + rcx*4 - 0x4d], cl
mov byte [rcx], al
add byte [rax], al
mov edi, dword [rsp + 0x158]
lea r14, [rbx + 0x188]
jo 0x14000c2eb
jno 0x14000c2eb
call 0x164b55037
invalid
lea rsi, [rsp + 0x160]
mov rcx, rsi
mov rdx, r14
mov r8, rdi
call fcn.140008d0d
movzx esi, word [rsi + 0x10]
test si, si
jne 0x14000ee2f
jp 0x14000c313
jnp 0x14000c313
call 0x164bd4e63
invalid
mov r15, qword [rsp + 0x160]
mov r12, qword [rsp + 0x168]
lea rcx, [rsp + 0x1c0]
mov qword [rcx], r13
ja 0x14000c333
jbe 0x14000c333
call 0x18dfb4c83
mov eax, esp
mov rdx, r15
mov r8, r12
call fcn.14000bb04
mov si, 1
test ax, ax
jne 0x14000ee1c
jne 0x14000c350
je 0x14000c350
call 0xc0429353
cmp al, 0x3f
sub cl, byte [rcx + 0xf]
cld
dec edi
cmp byte [r15 + rdi], 0x2a
cmovne rdi, r12
jb 0x14000c360
jae 0x14000c360
call 0x14170c6d5
jno 0x14000c365
jo 0x14000c365
call 0x14179c6e1
js 0x14000c36a
jns 0x14000c36a
call 0x164b550b6
jo 0x14000c378
lea rsi, [rsp + 0x870]
add byte [rax], al
mov rcx, rsi
mov rdx, r15
mov r8, rdi
call fcn.140010cec
cmp word [rsi + 0x218], 0
je 0x14000ded4
call 0x14000c394
add al, ch
jge 0x14000c39a
jl 0x14000c39a
call 0x1402b2587
add byte [rsi + 3], dh
jbe 0x14000c3a4
jmp 0x14000ee00
jbe 0x14000c3a4
ja 0x14000c3a4
call 0x1417dc724
jl 0x14000c3a9
jge 0x14000c3a9
call 0x1417ac728
jnp 0x14000c3ae
jp 0x14000c3ae
call 0x1417dc72e
jl 0x14000c3b3
jge 0x14000c3b3
call 0x1417cc734
jge 0x14000c3b8
jl 0x14000c3b8
call 0x188fa4d04
mov edx, ebp
mov rcx, rdi
mov rdx, rbp
call fcn.140011f25
test rax, rax
je 0x14000c41f
mov r9, rdx
jp 0x14000c3d0
jnp 0x14000c3d0
call 0x14c8c0c39
and eax, 0x30
mov rcx, qword gs:[0x30]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x20]
mov rcx, qword [rcx + 0x48]
lea rdx, [rsp + 0x98]
mov qword [rdx], rcx
jo 0x14000c3f5
jno 0x14000c3f5
call 0x1440e5141
invalid
lea rcx, [0x140002b00]
mov qword [rsp + 0x20], rcx
lea rsi, [rsp + 0x198]
mov rcx, rsi
mov r8, rax
call fcn.140011d49
cmp word [rsi + 8], 0
je 0x14000c8ff
jns 0x14000c424
js 0x14000c424
call 0x14170c799
jno 0x14000c429
jo 0x14000c429
call 0x14171c79d
jo 0x14000c42e
jno 0x14000c42e
call 0x10d16517a
invalid
lea rdx, [0x140002b02]
mov r8d, 6
jmp 0x14000dbb6
jb 0x14000c445
jae 0x14000c445
call 0x1417dc7c5
jl 0x14000c44a
jge 0x14000c44a
call 0x144fe4796
cmp rbp, 4
mov esi, 4
cmovb rsi, rbp
jae 0x14000c45c
jb 0x14000c45c
call 0x1648d51a8
mov byte [rbx], cl
add byte [rax], al
lea rcx, [rsp + 0xb88]
mov rdx, rdi
mov r8, rsi
call fcn.1400027aa
mov qword [rsp + 0x228], rsi
jns 0x14000c47c
js 0x14000c47c
call 0x142ee1468
add byte [rbp - 0x447bf040], al
add eax, dword [rax]
add byte [rbx + 3], bh
call 0x14003b1d0
test eax, eax
je 0x14000c844
jnp 0x14000c48e
jp 0x14000c48e
call 0x1648d51da
mov word [rbx], cs
add byte [rax], al
lea rcx, [rsp + 0xb8c]
js 0x14000c49b
jns 0x14000c49b
call 0x14000c687
add byte [rax], al
call 0x164b551ee
movabs al, byte [0xc7480e8948000012]
or byte [rdx], r9b
add byte [rax], al
add byte [rax - 0x7d], cl
adc byte [rax], al
call 0x14000c4a1
add al, ch
lea rsi, [rsp + 0x12a0]
mov qword [rsi], rcx
mov qword [rsi + 8], 0xa
and qword [rsi + 0x10], 0
lea r8, [rsp + 0x870]
mov qword [r8], rsi
jp 0x14000c4ca
jnp 0x14000c4ca
call 0x137165216
invalid
lea rdx, [0x140002ac8]
mov ecx, eax
call 0x140011ded
jp 0x14000c4dd
jnp 0x14000c4dd
call 0x150475029
mov rax, qword [rsi + 0x10]
jbe 0x14000c4e6
ja 0x14000c4e6
call 0x1417fc868
jle 0x14000c4eb
jg 0x14000c4eb
call 0x14000c6a9
add al, dh
xadd dword [rbx + 0x198], edx
mov edx, 1
lock xadd dword [rbx + 0x198], edx
add rax, 4
jl 0x14000c501
jge 0x14000c501
call 0x164454e4d
and byte [rbp + rcx*4 - 0x74], cl
and al, 0x88
or eax, dword [rax]
add byte [rax - 0x77], cl
fld dword [rcx - 0x48]
invalid
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb88]
mov rcx, rbx
mov r8d, 0x16
call fcn.14000fa8e
jmp 0x14000c85e
jne 0x14000c526
je 0x14000c526
call 0x164955272
add dword [rax], eax
add byte [rcx], dh
leave
lea rdx, [rsp + 0x140]
xor ecx, ecx
mov r8, rbx
call fcn.140012b02
jmp 0x14000dbbe
jae 0x14000c542
jb 0x14000c542
call 0x14177c8bc
jbe 0x14000c547
ja 0x14000c547
call 0x14174c8c0
jne 0x14000c54c
je 0x14000c54c
call 0x14172c8c3
jae 0x14000c551
jb 0x14000c551
call 0x1417dc8d1
jl 0x14000c556
jge 0x14000c556
call 0x14174c8cf
jne 0x14000c55b
je 0x14000c55b
call 0x14173c8d1
jb 0x14000c560
jae 0x14000c560
call 0x14175c8d8
je 0x14000c565
jne 0x14000c565
call 0x14178c8e2
jns 0x14000c56a
js 0x14000c56a
call 0x1417ec8ed
jg 0x14000c56f
jle 0x14000c56f
call 0x1649552bb
loopne 0x14000c575
lea rdx, [rsp + 0xe0]
add byte [rax], al
mov qword [rdx], r13
jle 0x14000c57f
jg 0x14000c57f
call 0x164b552cb
movabs al, byte [0x9ce8f18948000000]
invalid
lea rsi, [rsp + 0xa0]
mov rcx, rsi
call fcn.14000b82b
movzx esi, word [rsi + 4]
test si, si
jne 0x14000cbc2
jns 0x14000c5a1
js 0x14000c5a1
call 0xe0258230
mov edi, dword [rsp + 0xa0]
cmp rdi, 0x100
jbe 0x14000ca65
xor esi, esi
jmp 0x14000cbc2
jg 0x14000c5c1
jle 0x14000c5c1
call 0x14000c7ad
add byte [rax], al
call 0x1417ec94b
call 0x14000c5c7
add al, ch
jg 0x14000c5cd
jle 0x14000c5cd
call 0x14172c944
jae 0x14000c5d2
jb 0x14000c5d2
call 0x14170c947
jno 0x14000c5d7
jo 0x14000c5d7
call 0x14170c94c
jno 0x14000c5dc
jo 0x14000c5dc
call 0x1417ec95f
jg 0x14000c5e1
jle 0x14000c5e1
call 0x14179c95d
js 0x14000c5e6
jns 0x14000c5e6
call 0x14176c961
ja 0x14000c5eb
jbe 0x14000c5eb
call 0x1417ac96a
jnp 0x14000c5f0
jp 0x14000c5f0
call 0x16495533c
xor byte [rdx], al
add byte [rax], al
lea rdx, [rsp + 0x230]
mov qword [rdx], r13
jbe 0x14000c600
ja 0x14000c600
call 0x164b5534c
mov eax, 0x48000001
mov ecx, esi
lea rsi, [rsp + 0x1b8]
mov rcx, rsi
call fcn.14000b82b
movzx esi, word [rsi + 4]
test si, si
jne 0x14000e8e9
jg 0x14000c622
jle 0x14000c622
call 0x164b5516a
mov eax, 0x49000001
cmp esi, 0x100
mov r14d, dword [rsp + 0x1b8]
cmp r14, 0x100
jbe 0x14000cbfb
xor esi, esi
jmp 0x14000e8e9
je 0x14000c643
jne 0x14000c643
call 0x14179c9bf
js 0x14000c648
jns 0x14000c648
call 0x1648d5394
movabs al, byte [0xffffc9dde8000012]
lea rcx, [rsp + 0x12a0]
call fcn.140009032
mov r8d, 1
lock xadd dword [rbx + 0x198], r8d
jg 0x14000c669
jle 0x14000c669
call 0x164554fb5
and byte [rax - 0x77], cl
fld dword [rcx + rcx*4 - 0x3e]
mov qword [rsp + 0x20], rdx
mov rcx, rbx
mov edx, r8d
mov r8d, 0x10
mov r9, rax
call fcn.14000fa8e
mov esi, eax
jno 0x14000c689
jo 0x14000c689
call 0x14015f976
add byte [rax + 3], dh
jmp case.0x14000bd9c.6
jo 0x14000c693
jno 0x14000c693
call 0x1417eca16
jg 0x14000c698
jle 0x14000c698
call 0x14000c884
add byte [rax], al
call 0x1417dca1f
call 0x14000c69e
add al, ch
jl 0x14000c6a4
jge 0x14000c6a4
call 0x14173ca1a
jb 0x14000c6a9
jae 0x14000c6a9
call 0x14170ca1e
jno 0x14000c6ae
jo 0x14000c6ae
call 0x14171ca22
jo 0x14000c6b3
jno 0x14000c6b3
call 0x164bd53ff
movabs al, byte [0x104b9000012]
lea rdi, [rsp + 0x12a0]
mov ecx, 0x104
mov rdx, rdi
call sub.KERNEL32.dll_GetCurrentDirectoryW
test eax, eax
je 0x14000c86c
jge 0x14000c6d5
jl 0x14000c6d5
call 0x1417bca53
jp 0x14000c6da
jnp 0x14000c6da
call 0xcd4986df
mov ah, 0x24
jo 0x14000c6ea
add eax, eax
lea rsi, [rsp + 0x870]
add byte [rax], al
mov qword [rsi], rdi
mov qword [rsi + 8], rax
and qword [rsi + 0x10], 0
or byte [rax - 0x7d], cl
adc byte [rax], al
xor r12d, r12d
lea rdi, [rsp + 0x340]
lea r14, [rsp + 0x240]
lea r15, [rsp + 0x658]
jno 0x14000c710
jo 0x14000c710
call 0x188fa505c
mov edx, esi
mov rcx, rdi
mov rdx, rsi
call fcn.140010a12
ja 0x14000c720
jbe 0x14000c720
call 0x1842583a4
add eax, dword [rax]
add byte [rax], al
cmp byte [rsp + 0x344], 0
je 0x14000c8ad
jae 0x14000c733
jb 0x14000c733
call 0x164857d46
add eax, dword [rax]
add cl, al
loopne 0x14000c74e
movzx eax, byte [rsp + 0x342]
shl eax, 0x10
movzx ebp, word [rsp + 0x340]
or ebp, eax
jle 0x14000c74d
jg 0x14000c74d
call 0xc9f2509d
invalid
mov rcx, r14
mov ecx, esi
mov edx, ebp
call fcn.140010b3b
js 0x14000c75c
jns 0x14000c75c
call 0x164857d6f
add al, byte [rax]
add byte [rcx + rax - 0x20], cl
movzx eax, byte [rsp + 0x242]
add rax, r12
cmp rax, 0xff
ja 0x14000c876
jo 0x14000c778
jno 0x14000c778
call 0x1640554ca
lea r8, [rsp + r12]
add r8, 0xb88
mov r9d, 0x100
sub r9, r12
js 0x14000c791
jns 0x14000c791
call 0xc9fa50e1
invalid
mov rcx, r15
mov edx, ebp
call fcn.140010ba8
js 0x14000c7a0
jns 0x14000c7a0
call 0x164857db3
pop rdx
invalid
movzx eax, byte [rsp + 0x65a]
add r12, rax
jmp 0x14000c70b
jg 0x14000c7b5
jle 0x14000c7b5
call 0x14179cb31
js 0x14000c7ba
jns 0x14000c7ba
call 0x164955506
mov byte [rbx], cl
add byte [rax], al
lea rdx, [rsp + 0xb88]
mov qword [rdx], r13
jne 0x14000c7ca
je 0x14000c7ca
call 0x164b55516
movabs al, byte [0x51e8f18948000012]
invalid
lea rsi, [rsp + 0x12a0]
mov rcx, rsi
call fcn.14000b82b
movzx esi, word [rsi + 4]
test si, si
jne 0x14000cea4
jp 0x14000c7ec
jnp 0x14000c7ec
call 0xe025547b
adc al, byte [rax]
add byte [rdi + 3], dh
mov ecx, dword [rsp + 0x12a0]
ja 0x14000c7f8
jbe 0x14000c7f8
call 0x1406669e4
add byte [rsi - 0x7b], ah
ror byte [rdi], 0x84
push 6
add byte [rax], al
call 0x140012d9e
test ax, ax
je 0x14000ce70
jae 0x14000c80b
jb 0x14000c80b
call 0x155165557
invalid
lea rdx, [0x140002b27]
mov r8d, 4
mov rcx, rbx
call fcn.14000f956
jmp 0x14000cea2
jge 0x14000c82a
jl 0x14000c82a
call 0xc3087e3d
clc
pop rsp
movzx eax, byte [rdi]
cmp eax, 0x5c
je 0x14000ca03
cmp eax, 0x2f
je 0x14000ca23
jmp 0x14000d76c
jbe 0x14000c849
ja 0x14000c849
call 0x1a9165595
invalid
lea rdx, [0x140002ab9]
mov r8d, 7
mov rcx, rbx
call fcn.14000f956
mov esi, eax
call fcn.14000c866
add al, ch
call 0x140141d54
invalid
je 0x14000c871
jne 0x14000c871
call 0x142ea135d
add byte [rax + 3], bh
call sub.KERNEL32.dll_GetLastError
js 0x14000c87b
jns 0x14000c87b
call 0x14171cbef
jo 0x14000c880
jno 0x14000c880
call 0x14178cbfd
jns 0x14000c885
js 0x14000c885
call 0x14000ca71
add byte [rax], al
call 0x14170cc01
call 0x14000c88b
add al, ch
jno 0x14000c891
jo 0x14000c891
call 0x14170cc06
jno 0x14000c896
jo 0x14000c896
call 0x1b11655e2
invalid
lea rdx, [0x140002a0e]
mov r8d, 3
mov rcx, rbx
call fcn.14000f956
jmp 0x14000c8f3
jle 0x14000c8b2
jg 0x14000c8b2
call 0x14171cc26
jo 0x14000c8b7
jno 0x14000c8b7
call 0x14173cc2d
jb 0x14000c8bc
jae 0x14000c8bc
call 0x14173cc32
jb 0x14000c8c1
jae 0x14000c8c1
call 0x14175cc39
je 0x14000c8c6
jne 0x14000c8c6
call 0x14000ca84
add al, dh
xadd dword [rbx + 0x198], edx
mov edx, 1
lock xadd dword [rbx + 0x198], edx
jo 0x14000c8d8
jno 0x14000c8d8
call 0x164655228
and byte [rbp + rcx*4 - 0x74], cl
and al, 0x88
or eax, dword [rax]
add byte [rax - 0x77], cl
fld dword [rcx - 0x48]
adc eax, dword [rax]
add byte [rax], al
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xb88]
mov rcx, rbx
mov r8d, 0x13
call fcn.14000fa8e
mov esi, eax
jns 0x14000c8fa
js 0x14000c8fa
call 0x140138ae7
add byte [rax + 3], dh
jmp case.0x14000bd9c.6
jo 0x14000c904
jno 0x14000c904
call 0x164b55450
cwde
add dword [rax], eax
add byte [rbx + 3], dh
mov rsi, qword [rsp + 0x198]
jae 0x14000c911
jb 0x14000c911
call 0x188fa525d
mov edx, ebp
mov rcx, rdi
mov rdx, rbp
call fcn.14000928d
mov rdi, rax
mov r14, rdx
jb 0x14000c927
jae 0x14000c927
call 0x1417dcca7
jl 0x14000c92c
jge 0x14000c92c
call 0x14179cca8
js 0x14000c931
jns 0x14000c931
call 0x1417dccb1
jl 0x14000c936
jge 0x14000c936
call 0x14179ccb2
js 0x14000c93b
jns 0x14000c93b
call 0x14171ccaf
jo 0x14000c940
jno 0x14000c940
call 0x14177ccba
jbe 0x14000c945
ja 0x14000c945
call 0x164955691
add byte [rax], 0
add byte [rax - 0x77], cl
xor dh, byte [rbx + rax + 0x75]
add eax, ebp
lea rdx, [rsp + 0x80]
mov qword [rdx], rsi
je 0x14000c955
jne 0x14000c955
call 0x160250e1f
add eax, 0x24bc8d4c
pop rax
add eax, 0x894c0000
stc
mov byte [rsp + 0x20], 5
lea r15, [rsp + 0x558]
mov rcx, r15
mov r8, rax
mov r9, r14
call fcn.1400127b4
movzx r13d, word [r15 + 0x10]
test r13w, r13w
je 0x14000cf1a
jl 0x14000c984
jge 0x14000c984
call 0x1417fcd06
jle 0x14000c989
jg 0x14000c989
call 0x14175cd01
je 0x14000c98e
jne 0x14000c98e
call 0x1417ccd0f
jge 0x14000c993
jl 0x14000c993
call 0x14174cd0c
jne 0x14000c998
je 0x14000c998
call 0x14179cd14
js 0x14000c99d
jns 0x14000c99d
call 0x14179cd19
js 0x14000c9a2
jns 0x14000c9a2
call 0x14173cd18
jb 0x14000c9a7
jae 0x14000c9a7
call 0x128f252f3
adc edx, ebp
add al, byte [rax]
mov rcx, rsi
call sub.ntdll.dll_NtClose
call 0x14000c9b5
add al, ch
jae 0x14000c9bb
jb 0x14000c9bb
call 0x14000cba7
add byte [rax], al
call 0x12d860f2c
call 0x14000c9c1
add al, ch
test r13w, r13w
jne 0x14000c429
jl 0x14000c9d1
jge 0x14000c9d1
call 0x14000cb8f
add al, dh
xadd dword [rbx + 0x198], edx
mov edx, 1
lock xadd dword [rbx + 0x198], edx
ja 0x14000c9e3
jbe 0x14000c9e3
call 0x16445912f
and byte [rcx], cl
add byte [rax], al
add byte [rbp + rcx*4 + 0xd], cl
invalid
mov qword [rsp + 0x20], 9
lea r9, [0x140002b09]
mov rcx, rbx
xor r8d, r8d
call fcn.14000fa8e
jmp 0x14000dbbe
jnp 0x14000ca08
jp 0x14000ca08
call 0x14350801b
movzx ecx, byte [rdi + 3]
cmp ecx, 0x5c
je 0x14000dbe3
cmp ecx, 0x2f
jne 0x14000d792
jnp 0x14000ca23
jp 0x14000ca23
call 0x1437f9358
xor ecx, ecx
jle 0x14000ca2a
jg 0x14000ca2a
call 0x14158803d
movzx edx, byte [rdi + 1]
cmp edx, 0x2f
je 0x14000ca45
cmp edx, 0x3f
je 0x14000d756
cmp edx, 0x5c
jne 0x14000d76c
jge 0x14000ca4a
jl 0x14000ca4a
call 0x14250805d
movzx ecx, byte [rdi + 2]
cmp ecx, 0x2e
je 0x14000db39
cmp ecx, 0x3f
je 0x14000db39
jmp 0x14000d76c
jae 0x14000ca6a
jb 0x14000ca6a
call 0x1649557b6
mov al, 0
add byte [rax], al
lea rdx, [rsp + 0xb0]
mov qword [rdx], r13
jo 0x14000ca7a
jno 0x14000ca7a
call 0x1648d57c6
enter 1, 0
lea rcx, [rsp + 0x1c8]
lea r8, [rsp + 0x240]
mov r9, rdi
call fcn.140011e88
lea rdx, [rsp + 0x198]
mov qword [rdx], r13
jle 0x14000caa2
jg 0x14000caa2
call 0x164b557ee
invalid
lea rsi, [rsp + 0x160]
mov rcx, rsi
call fcn.14000b82b
movzx esi, word [rsi + 4]
test si, si
jne 0x14000cbc2
jb 0x14000cac4
jae 0x14000cac4
call 0x1a0257f53
add dword [rax], eax
add byte [rax - 0x7f], cl
inc byte [rax]
add dword [rax], eax
add byte [rdi], cl
xchg ebp, ebx
cli
invalid
mov esi, dword [rsp + 0x160]
cmp rsi, 0x100
ja 0x14000c5b5
jns 0x14000cadd
js 0x14000cadd
call 0x164955829
lock add byte [rax], al
add byte [rcx + rcx*4 + 0x2a], cl
lea rdx, [rsp + 0xf0]
mov qword [rdx], r13
jle 0x14000caed
jg 0x14000caed
call 0x1648d5839
pop rax
add eax, 0x8d4c0000
test byte [rax + rbx*2], ah
invalid
lea rcx, [rsp + 0x558]
lea r8, [rsp + 0x658]
mov r9, rsi
call fcn.140011e88
jno 0x14000cb0a
jo 0x14000cb0a
call 0x14172ce81
jae 0x14000cb0f
jb 0x14000cb0f
call 0x1417cce90
jge 0x14000cb14
jl 0x14000cb14
call 0x1417cce95
jge 0x14000cb19
jl 0x14000cb19
call 0x14176ce94
ja 0x14000cb1e
jbe 0x14000cb1e
call 0x164b5586e
mov byte [rbx], cl
add byte [rax], al
lea r14, [rsp + 0xb88]
lea rdx, [rsp + 0x240]
mov rcx, r14
mov r8, rdi
call fcn.140010cec
cmp word [r14 + 0x218], 0
jne 0x14000cb92
jo 0x14000cb49
jno 0x14000cb49
call 0x1648d5895
add eax, dword [rax]
add byte [rax - 0x73], cl
xchg esp, eax
and al, 0x88
or eax, dword [rax]
add byte [rcx - 0x48], al
sbb byte [rdx], al
add byte [rax], al
lea rcx, [rsp + 0x340]
lea rdx, [rsp + 0xb88]
mov r8d, 0x218
call fcn.1400027aa
js 0x14000cb69
jns 0x14000cb69
call 0x164bd58b5
movabs al, byte [0x5824948d48000012]
invalid
lea rdi, [rsp + 0x12a0]
lea rdx, [rsp + 0x658]
mov rcx, rdi
mov r8, rsi
call fcn.140010cec
cmp word [rdi + 0x218], 0
je 0x14000e22c
jae 0x14000cb97
jb 0x14000cb97
call 0x14177cf11
jbe 0x14000cb9c
ja 0x14000cb9c
call 0x1417acf1b
jnp 0x14000cba1
jp 0x14000cba1
call 0x1417ecf24
jg 0x14000cba6
jle 0x14000cba6
call 0x14171cf1a
jo 0x14000cbab
jno 0x14000cbab
call 0x17e1658f7
pop rdi
invalid
lea rdx, [0x140002af0]
mov r8d, 2
mov rcx, rbx
call fcn.14000f956
mov esi, eax
jl 0x14000cbc7
jge 0x14000cbc7
call 0x1417ccf48
jge 0x14000cbcc
jl 0x14000cbcc
call 0x1417acf4b
jnp 0x14000cbd1
jp 0x14000cbd1
call 0x14170cf46
jno 0x14000cbd6
jo 0x14000cbd6
call 0x1417bcf54
jp 0x14000cbdb
jnp 0x14000cbdb
call 0x1417ecf5e
jg 0x14000cbe0
jle 0x14000cbe0
call 0x1417fcf62
jle 0x14000cbe5
jg 0x14000cbe5
call 0x1417acf64
jnp 0x14000cbea
jp 0x14000cbea
call 0x14179cf66
js 0x14000cbef
jns 0x14000cbef
call 0x14000cddb
add byte [rax], al
call 0x1401091e3
add byte [rbx + 3], dh
call 0x14000cbf5
add al, ch
jmp case.0x14000bd9c.6
jae 0x14000cc00
jb 0x14000cc00
call 0x16495594c
cmp byte [rdx], al
add byte [rax], al
lea rdx, [rsp + 0x238]
mov qword [rdx], r13
js 0x14000cc10
jns 0x14000cc10
call 0x1648d595c
rol byte [rax], 0
add byte [rbp + rcx*4 - 0x7c], cl
and al, 0x58
add eax, 0x894d0000
int1
lea rcx, [rsp + 0xc0]
lea r8, [rsp + 0x558]
mov r9, r14
call fcn.140011e88
lea rdx, [rsp + 0x148]
mov qword [rdx], r13
jle 0x14000cc38
jg 0x14000cc38
call 0x164b55984
push rax
add dword [rax], eax
add byte [rax - 0x77], cl
int1
lea rsi, [rsp + 0x150]
mov rcx, rsi
call fcn.14000b82b
movzx esi, word [rsi + 4]
test si, si
jne 0x14000e8e9
jle 0x14000cc5a
jg 0x14000cc5a
call 0x1902588e9
add dword [rax], eax
add byte [rax - 0x7f], cl
inc dword [rax]
add dword [rax], eax
add byte [rdi], cl
xchg ecx, ecx
stc
invalid
mov edi, dword [rsp + 0x150]
cmp rdi, 0x100
ja 0x14000c637
jno 0x14000cc73
jo 0x14000cc73
call 0x1649559bf
pop rax
add dword [rax], eax
add byte [rcx + rcx*4 + 0x2a], cl
lea rdx, [rsp + 0x158]
mov qword [rdx], r13
jnp 0x14000cc83
jp 0x14000cc83
call 0x1648d59cf
rol byte [rax], 1
add byte [rax], al
lea rcx, [rsp + 0xd0]
lea r8, [rsp + 0x240]
mov r9, rdi
call fcn.140011e88
js 0x14000cca0
jns 0x14000cca0
call 0x14178d01d
jns 0x14000cca5
js 0x14000cca5
call 0x14173d01b
jb 0x14000ccaa
jae 0x14000ccaa
call 0x1417dd02a
jl 0x14000ccaf
jge 0x14000ccaf
call 0x14176d02a
ja 0x14000ccb4
jbe 0x14000ccb4
call 0x1448c151d
and eax, 0x30
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov r15, qword [rax + 0x48]
ja 0x14000ccce
jbe 0x14000ccce
call 0x14178d04b
jns 0x14000ccd3
js 0x14000ccd3
call 0x14176d04e
ja 0x14000ccd8
jbe 0x14000ccd8
call 0x14176d053
ja 0x14000ccdd
jbe 0x14000ccdd
call 0x14000cec9
add byte [rax], al
call 0x1417ad063
call 0x14000cce3
add al, ch
jnp 0x14000cce9
jp 0x14000cce9
call 0x14000ced5
add byte [rax], al
call 0x164955a3c
cwde
add byte [rax], al
add byte [rcx + rcx*4 + 0x3a], cl
call 0x14000ccef
add al, ch
lea rdx, [rsp + 0x98]
mov qword [rdx], r15
jl 0x14000cd00
jge 0x14000cd00
call 0xd5065a4c
push 0xffffffff8948ffff
and al, 0x20
lea rax, [0x14000359c]
mov qword [rsp + 0x20], rax
lea rsi, [rsp + 0xe0]
lea r8, [rsp + 0x558]
mov rcx, rsi
mov r9, r14
call fcn.140011bb0
cmp word [rsi + 8], 0
jne 0x14000e8aa
js 0x14000cd37
jns 0x14000cd37
call 0x164b55883
loopne 0x14000cd3d
mov rsi, qword [rsp + 0xe0]
add byte [rax], al
lea rdx, [rsp + 0x1c0]
mov qword [rdx], rsi
jae 0x14000cd4f
jb 0x14000cd4f
call 0x164b55a9f
enter 1, 0
lea r14, [rsp + 0x1c8]
mov rcx, r14
call fcn.14001045c
cmp word [r14 + 0x48], 0
jne 0x14000e898
jl 0x14000cd70
jge 0x14000cd70
call 0x164ad58c0
rol byte [rcx], 1
add byte [rax], al
mov r13, qword [rsp + 0x1d0]
mov qword [rsp + 0x80], r15
jl 0x14000cd85
jge 0x14000cd85
call 0x14172d0fc
jae 0x14000cd8a
jb 0x14000cd8a
call 0x14173d100
jb 0x14000cd8f
jae 0x14000cd8f
call 0x1417dd10f
jl 0x14000cd94
jge 0x14000cd94
call 0x14177d10e
jbe 0x14000cd99
ja 0x14000cd99
call 0x1648d5ae5
add al, byte [rax]
add byte [rax - 0x77], cl
cli
lea rcx, [rsp + 0x240]
mov rdx, rdi
call fcn.140011f25
test rax, rax
je 0x14000e43a
mov r9, rdx
je 0x14000cdba
jne 0x14000cdba
call 0x164955b06
jo 0x14000cdc8
lea rdx, [rsp + 0x870]
add byte [rax], al
mov qword [rdx], r15
js 0x14000cdca
jns 0x14000cdca
add eax, ebp
call 0x1090e5b16
invalid
lea rcx, [0x14000359a]
mov qword [rsp + 0x20], rcx
lea r14, [rsp + 0x12a0]
mov rcx, r14
mov r8, rax
call fcn.140011d49
movzx eax, word [r14 + 8]
test ax, ax
je 0x14000e52f
jp 0x14000cdfc
jnp 0x14000cdfc
call 0x164855766
sub byte [rcx], al
add byte [rax], al
mov word [rsp + 0x128], ax
jmp 0x14000e57e
jns 0x14000ce0e
js 0x14000ce0e
call 0x164ad595a
jo 0x14000ce1c
mov rbp, qword [rsp + 0x870]
add byte [rax], al
lea rdx, [rsp + 0x658]
add byte [rax], al
mov qword [rdx], rbp
je 0x14000ce26
jne 0x14000ce26
call 0x164b55b72
movabs al, byte [0x26e8f18948000012]
add byte ss:[rax], al
lea rsi, [rsp + 0x12a0]
mov rcx, rsi
call fcn.14001045c
cmp word [rsi + 0x48], 0
je 0x14000dbea
jo 0x14000ce46
jno 0x14000ce46
call 0xfc165b92
pop rbx
invalid
lea rdx, [0x140002a09]
mov r8d, 4
mov rcx, rbx
call fcn.14000f956
test ax, ax
je 0x14000dcc9
mov esi, eax
jne 0x14000ce6b
je 0x14000ce6b
call 0x140126a58
add byte [rax + 3], dh
jmp 0x14000e00b
jo 0x14000ce75
jno 0x14000ce75
call 0x14000d033
add al, dh
xadd dword [rbx + 0x198], edx
mov edx, 1
lock xadd dword [rbx + 0x198], edx
jae 0x14000ce87
jb 0x14000ce87
call 0x1644595d3
and byte [rdi], al
add byte [rax], al
add byte [rbp + rcx*4 + 0xd], cl
xchg ebp, eax
pop rsp
invalid
mov qword [rsp + 0x20], 7
lea r9, [0x140002b2c]
mov rcx, rbx
xor r8d, r8d
call fcn.14000fa8e
mov esi, eax
jge 0x14000cea9
jl 0x14000cea9
call 0x14175d221
je 0x14000ceae
jne 0x14000ceae
call 0x1400ddc9b
add byte [rcx], dh
leave
jmp case.0x14000bd9c.6
xor ecx, ecx
mov edx, 0xffffffff
jle 0x14000cebf
jg 0x14000cebf
call 0x189c1580c
shr eax, 0x39
mov r8, rax
shr r8, 0x39
je 0x14000cecb
jne 0x14000cecb
call 0xca469ef0
or al, 6
and eax, edx
mov r9b, byte [r14 + rax]
sub ecx, 1
setb r10b
test r9b, r9b
je 0x14000d6e5
test r10b, r10b
jne 0x14000d6e5
jb 0x14000ceef
jae 0x14000ceef
call 0x1b9ca5338
sbb al, 0x41
and cl, 0x7f
test r9b, r9b
jns 0x14000cf10
and r9b, 0x7f
cmp r8b, r9b
jne 0x14000cf10
jp 0x14000cf02
jnp 0x14000cf02
call 0x1304f5a53
mov r9, qword [r14 - 0x10]
cmp dword [r9 + rax*4], edi
je 0x14000d6d0
jno 0x14000cf15
jo 0x14000cf15
call 0x12bc1ce61
lodsb al, byte [rsi]
inc rax
jmp 0x14000cec6
jo 0x14000cf1f
jno 0x14000cf1f
call 0x1a0258ba3
add eax, 0xf000000
test byte [rbx], al
invalid
cmp byte [rsp + 0x560], 0
je 0x14000dd30
invalid
jg 0x14000cf32
jle 0x14000cf32
call 0x164a55a82
pop rax
add eax, 0x3780000
mov r12, qword [rsp + 0x558]
js 0x14000cf3f
jns 0x14000cf3f
call 0x164bd5c8f
movabs al, byte [0x7308b841000012]
add byte [rcx + rcx*4 - 7], cl
lea r15, [rsp + 0x12a0]
mov r8d, 0x7308
mov rcx, r15
xor edx, edx
call fcn.140002794
movzx ecx, byte [r15 + 0x7300]
jns 0x14000cf64
js 0x14000cf64
call 0xc90210f5
ret 0xe280
lea eax, [rcx + 1]
mov edx, eax
and dl, 0x1f
mov byte [r15 + 0x7300], dl
imul rcx, rcx, 0x730
mov qword [rsp + rcx + 0x12a0], rdi
mov qword [rsp + rcx + 0x12a8], r14
mov qword [rsp + rcx + 0x12b0], rsi
mov qword [rsp + rcx + 0x12b8], r12
jae 0x14000cf9f
jb 0x14000cf9f
call 0x14ff726b2
adc dword [rsp + rcx + 0x12c0], esi
xorps xmm6, xmm6
movups xmmword [rsp + rcx + 0x12c0], xmm6
mov byte [rsp + rcx + 0x16d0], 0
lea rcx, [rsp + 0x658]
jge 0x14000cfbf
jl 0x14000cfbf
call 0xc40fef6b
imul ecx, dword [0x14376cfcd], 0xfee80177
enter 0xffffffffffffb60f, 0xffffffffffffffc0
test al, 0x1f
je 0x14000dd30
jbe 0x14000cfcc
ja 0x14000cfcc
call 0xf61098ce
rol byte [rbx + 0x69481fe0], 0xf8
xor byte [rdi], al
add byte [rax], al
dec al
movzx eax, al
and eax, 0x1f
imul rdi, rax, 0x730
lea rax, [rsp + rdi]
add rax, 0x12a0
mov qword [rsp + 0x60], rax
lea rbp, [rsp + rdi]
add rbp, 0x12b8
jp 0x14000cffa
jnp 0x14000cffa
call 0x128eb5946
xchg esi, eax
add byte [r8], al
mov rdx, rbp
call fcn.140011998
cmp word [rsp + 0x678], 0
jne 0x14000e3f3
jb 0x14000d016
jae 0x14000d016
call 0x1b0258c9a
invalid
cmp byte [rsp + 0x670], 0
je 0x14000d574
mov r14, qword [rsp + 0x658]
mov r15, qword [rsp + 0x660]
mov al, byte [rsp + 0x668]
jne 0x14000d040
je 0x14000d040
call 0x1982514cc
mov byte [rsp + 0x58], al
cmp al, 2
sete r12b
jae 0x14000d04f
jb 0x14000d04f
call 0x141c5c694
test r12b, 1
je 0x14000d0b7
jno 0x14000d05a
jo 0x14000d05a
call 0xe02554e8
test dword [rax], eax
add al, al
loopne 0x14000d067
mov al, byte [rsp + 0x85a0]
shl al, 3
sar al, 3
js 0x14000d11f
jge 0x14000d072
jl 0x14000d072
call 0x169065dbe
invalid
lea rax, [0x1400035a2]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x160]
mov rdx, rbp
mov r8, r14
mov r9, r15
call fcn.14001116e
movzx r13d, word [rsp + 0x168]
cmp r13, 0x1a
ja case.0x14000d0b5.1
lea rcx, [0x14000f85c]
movsxd rax, dword [rcx + r13*4]
add rax, rcx
jmp rax
jge 0x14000d0bc
jl 0x14000d0bc
call 0x18cea5a08
mov edx, esi
mov rcx, rbp
mov rdx, r14
mov r8, r15
call fcn.140012a86
mov r13d, eax
movzx eax, ax
lea ecx, [rax - 8]
cmp ecx, 0x39
ja 0x14000d105
cmp rcx, 0xf
jne 0x14000d0ec
jns 0x14000d0e3
js 0x14000d0e3
call 0x141f55128
xor r12b, 1
jmp 0x14000d04a
movabs rdx, 0x2000010001022fa
bt rdx, rcx
jb 0x14000de93
test rcx, rcx
je case.0x14000d0b5.8
test eax, eax
jne 0x14000f76a
jg 0x14000d112
jle 0x14000d112
call 0x1648d5e5e
pop rax
invalid
lea rcx, [rsp + 0x658]
jmp 0x14000cff5
jns 0x14000d124
js 0x14000d124
call 0x1417dd4a4
jl 0x14000d129
jge 0x14000d129
call 0x1417ed4ac
jg 0x14000d12e
jle 0x14000d12e
call 0x14174d4a7
jne 0x14000d133
je 0x14000d133
call 0x14000d31f
add byte [rax], al
call 0x14170d4af
call 0x14000d139
add al, ch
jno 0x14000d13f
jo 0x14000d13f
call 0x14176d4ba
ja 0x14000d144
jbe 0x14000d144
call 0x14171d4b8
jo 0x14000d149
jno 0x14000d149
call 0x1417bd4c7
jp 0x14000d14e
jnp 0x14000d14e
call 0x14175d4c6
je 0x14000d153
jne 0x14000d153
call 0x140465c9f
mov rax, qword [rbp]
mov qword [rsp + 0xe0], rax
ja 0x14000d164
jbe 0x14000d164
call 0x1982515f2
mov al, byte [rsp + 0x58]
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x240]
lea rdx, [rsp + 0xe0]
mov r8, r14
mov r9, r15
call fcn.1400127b4
movzx r13d, word [rsp + 0x250]
test r13w, r13w
jne 0x14000e4c1
jb 0x14000d19f
jae 0x14000d19f
call 0x188258e23
add al, byte [rax]
add byte [rax], al
cmp byte [rsp + 0x248], 0
je 0x14000d488
ja 0x14000d1b2
jbe 0x14000d1b2
call 0x164a55d02
add al, byte [rax]
add byte [rcx + rcx*4 - 0x5c], cl
and al, 0xd0
add byte [rax], al
add byte [rax + 0x24448901], dh
je 0x14000d215
mov r12, qword [rsp + 0x240]
mov qword [rsp + 0xd0], r12
mov al, 1
mov dword [rsp + 0x74], eax
mov qword [rsp + 0x138], r14
mov dword [rsp + 0x138], esi
mov qword [rsp + 0x130], r15
mov qword [rsp + 0x90], r12
jae 0x14000d1e5
jb 0x14000d1e5
call 0x164855f31
nop
or eax, dword [rax]
add byte [rdi], cl
adc dword [rax], esi
lea rax, [rsp + 0xb90]
movups xmmword [rax], xmm6
mov qword [rsp + 0xb88], r12
mov byte [rsp + 0xfa0], 0
jge 0x14000d205
jl 0x14000d205
call 0x1648d5f51
add eax, dword [rax]
add byte [rax - 0x73], cl
xchg esp, eax
and al, 0x88
or eax, dword [rax]
add al, ch
jle 0x14000d25f
lea rcx, [rsp + 0x340]
lea rdx, [rsp + 0xb88]
call fcn.140011998
add byte [rax], al
movzx r13d, word [rsp + 0x360]
test r13w, r13w
jne 0x14000eb54
jb 0x14000d232
jae 0x14000d232
call 0x198258eb6
add eax, dword [rax]
add byte [rax], al
cmp byte [rsp + 0x358], 0
je 0x14000d3c0
mov rax, qword [rsp + 0x340]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0x68], rax
call 0x14000d260
add al, ch
cmp byte [rsp + 0x350], 2
sete r12b
jo 0x14000d272
jno 0x14000d272
call 0x141c5c8b7
test r12b, 1
je 0x14000d2cb
js 0x14000d27d
jns 0x14000d27d
call 0x123065fc9
invalid
lea rax, [0x140003667]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x1c8]
lea rdx, [rsp + 0xd0]
mov r8, qword [rsp + 0x78]
mov r9, qword [rsp + 0x68]
call fcn.14001116e
movzx r13d, word [rsp + 0x1d0]
cmp r13, 0x1a
ja case.0x14000d2c9.1
lea rcx, [0x14000f7f0]
movsxd rax, dword [rcx + r13*4]
add rax, rcx
jmp rax
jns 0x14000d2d0
js 0x14000d2d0
call 0x1648d601c
rol byte [rax], 1
add byte [rax], al
lea rcx, [rsp + 0xd0]
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x68]
call fcn.140012a86
mov r13d, eax
movzx eax, ax
lea ecx, [rax - 8]
cmp ecx, 0x39
ja 0x14000d322
cmp rcx, 0xf
jne 0x14000d309
jo 0x14000d300
jno 0x14000d300
call 0x141f55345
xor r12b, 1
jmp 0x14000d26d
movabs rdx, 0x2000010001022fa
bt rdx, rcx
jb 0x14000e48c
test rcx, rcx
je case.0x14000d2c9.8
test eax, eax
jne 0x14000f774
js 0x14000d32f
jns 0x14000d32f
call 0x13fffa01c
invalid
jmp 0x14000d200
jle 0x14000d339
jg 0x14000d339
call 0x1b4251833
add dword [rbp + 0x17], esi
test byte [rsp + 0x74], 1
jne 0x14000d357
jo 0x14000d345
jno 0x14000d345
call 0x1648d5e91
mov byte [rax], al
add byte [rax], al
mov rcx, qword [rsp + 0x88]
call sub.ntdll.dll_NtClose
jbe 0x14000d357
ja 0x14000d357
call 0x14170d6cc
jno 0x14000d35c
jo 0x14000d35c
call 0x164a55eac
enter 1, 0
mov r12, qword [rsp + 0x1c8]
mov qword [rsp + 0xd0], r12
jnp 0x14000d371
jp 0x14000d371
call 0x1648d60bd
jo 0x14000d37f
lea rcx, [rsp + 0x870]
add byte [rax], al
mov rdx, qword [rsp + 0x78]
mov r13, qword [rsp + 0x68]
mov ebp, dword [rsp + 0x68]
mov r8, r13
call fcn.1400027aa
mov dword [rsp + 0x74], 0
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x870]
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x130], r13
jmp 0x14000d1d8
jnp 0x14000d3c5
jp 0x14000d3c5
call 0x1648d5f11
nop
add byte [rax], al
add al, ch
out dx, al
fild word [rdx]
add byte [rsi + 3], bh
mov rcx, qword [rsp + 0x90]
call sub.ntdll.dll_NtClose
jle 0x14000d3d7
jg 0x14000d3d7
call 0x14174d750
jne 0x14000d3dc
je 0x14000d3dc
call 0x1b42518d6
add dword [rsp + rbp + 0x48], esi
mov eax, dword [rbp]
test byte [rsp + 0x74], 1
je 0x14000d40f
mov rax, qword [rbp]
mov qword [rsp + 0xb0], rax
je 0x14000d3f4
jne 0x14000d3f4
call 0x1648d6140
mov al, 0
add byte [rax], al
lea rcx, [rsp + 0xb0]
mov rdx, r14
mov r8, r15
call fcn.140012a07
cmp ax, 0x6c
je 0x14000d46f
jmp 0x14000d479
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xa0], rax
je 0x14000d424
jne 0x14000d424
call 0x1648d6170
movabs al, byte [0x3824948b48000000]
add dword [rax], eax
add byte [rbx + rcx*4 - 0x7c], cl
and al, 0x30
add dword [rax], eax
add al, ch
invalid
lea rcx, [rsp + 0xa0]
mov rdx, qword [rsp + 0x138]
mov r8, qword [rsp + 0x130]
call fcn.140012a07
test ax, ax
je 0x14000d456
mov r13d, eax
movzx eax, ax
cmp eax, 8
je 0x14000d456
cmp eax, 0x6c
jne 0x14000d4ba
jns 0x14000d45b
js 0x14000d45b
call 0x1648d5fa7
mov byte [rax], al
add byte [rax], al
mov rcx, qword [rsp + 0x88]
call sub.ntdll.dll_NtClose
call 0x14000d46e
add al, ch
jne 0x14000d474
je 0x14000d474
call 0x13ffdaa61
inc dword [rcx - 0x77]
invalid
jmp 0x14000d14e
mov r13d, eax
movzx eax, ax
test eax, eax
je 0x14000d488
cmp eax, 8
jne 0x14000d4d1
jns 0x14000d48d
js 0x14000d48d
call 0x14175d805
je 0x14000d492
jne 0x14000d492
call 0x14177d80c
jbe 0x14000d497
ja 0x14000d497
call 0x1417ed81a
jg 0x14000d49c
jle 0x14000d49c
call 0x1417cd81d
jge 0x14000d4a1
jl 0x14000d4a1
call 0x1417cd822
jge 0x14000d4a6
jl 0x14000d4a6
call 0x14174d81f
jne 0x14000d4ab
je 0x14000d4ab
call 0x14172d822
jae 0x14000d4b0
jb 0x14000d4b0
call 0x1417ad82f
jnp 0x14000d4b5
jp 0x14000d4b5
call 0x13ffd28a2
invalid
jmp case.0x14000d0b5.8
jl 0x14000d4bf
jge 0x14000d4bf
call 0x1648d600b
mov byte [rax], al
add byte [rax], al
mov rcx, qword [rsp + 0x88]
call sub.ntdll.dll_NtClose
jae 0x14000d4d1
jb 0x14000d4d1
call 0x14176d84c
ja 0x14000d4d6
jbe 0x14000d4d6
call 0x14179d852
js 0x14000d4db
jns 0x14000d4db
call 0x14177d855
jbe 0x14000d4e0
ja 0x14000d4e0
call 0x1417ad85f
jnp 0x14000d4e5
jp 0x14000d4e5
call 0x14174d85e
jne 0x14000d4ea
je 0x14000d4ea
call 0x14000d6d6
add byte [rax], al
call 0x1417dd871
call 0x14000d4f0
add al, ch
jl 0x14000d4f6
jge 0x14000d4f6
call 0x14179d872
js 0x14000d4fb
jns 0x14000d4fb
call 0x1417ad87a
jnp 0x14000d500
jp 0x14000d500
call 0x12d861a6a
test r13w, r13w
je case.0x14000d0b5.8
jmp 0x14000e4f0
jno 0x14000d514
jo 0x14000d514
call 0x164856060
invalid
mov rax, qword [rsp + 0x160]
mov rdi, qword [rbp]
movzx ecx, byte [rsp + 0x85a0]
jnp 0x14000d52d
jp 0x14000d52d
call 0xc00226be
loop 0x14000d552
lea edx, [rcx + 1]
and dl, 0x1f
mov byte [rsp + 0x85a0], dl
imul rcx, rcx, 0x730
add rcx, rsp
add rcx, 0x12a0
mov qword [rcx], r14
jnp 0x14000d553
jp 0x14000d553
call 0x1487a5ea3
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rax
jno 0x14000d564
jo 0x14000d564
call 0x16071e677
movups xmmword [rcx + 0x20], xmm6
mov byte [rcx + 0x430], 0
jmp case.0x14000d643.8
jl 0x14000d579
jge 0x14000d579
call 0x128ea5ec5
invalid
mov rcx, rbp
call fcn.1400129e4
mov rdi, qword [rsp + rdi + 0x12b0]
mov qword [rsp + 0xc0], rdi
mov rax, qword [rsp + 0x60]
mov r14, qword [rax]
mov r15, qword [rax + 8]
mov al, byte [rsp + 0x85a0]
dec al
and al, 0x1f
mov byte [rsp + 0x85a0], al
ja 0x14000d5b4
jbe 0x14000d5b4
call 0x1648d6300
rol byte [rax], 0
add byte [rcx + rcx*4 - 0xe], cl
lea rcx, [rsp + 0xc0]
mov rdx, r14
mov r8, r15
call fcn.140012a07
test ax, ax
je case.0x14000d643.8
mov r13d, eax
movzx eax, ax
cmp eax, 8
je case.0x14000d643.8
cmp eax, 0x6c
jne 0x14000ed3a
mov bpl, 1
ja 0x14000d5f0
jbe 0x14000d5f0
call 0x141c6cc34
test bpl, 1
je 0x14000d645
jnp 0x14000d5fb
jp 0x14000d5fb
call 0xe0066347
pop rdi
invalid
lea rax, [0x1400035a2]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0xc0]
mov r8, r14
mov r9, r15
call fcn.14001116e
movzx r13d, word [rsp + 0xf8]
cmp r13, 0x1a
ja case.0x14000d643.1
lea rcx, [0x14000f8c8]
movsxd rax, dword [rcx + r13*4]
add rax, rcx
jmp rax
js 0x14000d64a
jns 0x14000d64a
call 0x1648d6396
rol byte [rax], 0
add byte [rcx + rcx*4 - 0xe], cl
lea rcx, [rsp + 0xc0]
mov rdx, r14
mov r8, r15
call fcn.140012a86
mov r13d, eax
movzx eax, ax
lea ecx, [rax - 8]
cmp ecx, 0x39
ja 0x14000d698
cmp rcx, 0xf
jne 0x14000d67f
je 0x14000d676
jne 0x14000d676
call 0x141f656ba
xor bpl, 1
jmp 0x14000d5eb
movabs rdx, 0x2000010001022fa
bt rdx, rcx
jb 0x14000e95f
test rcx, rcx
je case.0x14000d643.8
test eax, eax
jne 0x14000f77e
jae 0x14000d6a5
jb 0x14000d6a5
call 0xe0255b33
test dword [rax], eax
add cl, ch
add ecx, edi
invalid
mov al, byte [rsp + 0x85a0]
jmp 0x14000cfb2
jae 0x14000d6b6
jb 0x14000d6b6
call 0x164856202
lock add byte [rax], al
add byte [rdi], cl
mov dh, 0x8c
and al, 0xa0
test dword [rax], eax
add byte [rcx + 3], dh
mov rax, qword [rsp + 0xf0]
movzx ecx, byte [rsp + 0x85a0]
jno 0x14000d6cb
jo 0x14000d6cb
call 0x13fff34b8
invalid
jmp 0x14000d52d
jnp 0x14000d6d5
jp 0x14000d6d5
call 0x164bd6425
movabs al, byte [0xc641078949000012]
or byte [r9], r8b
lea r15, [rsp + 0x12a0]
mov qword [r15], rax
mov byte [r15 + 8], 1
jns 0x14000d6ea
js 0x14000d6ea
call 0x14880572f
add byte [rdx + rax*2 + 0x7c], dh
add edi, dword [rbp + 1]
cmp byte [r15 + 8], 0
je 0x14000d733
jl 0x14000d6f6
jge 0x14000d6f6
call 0x189086243
mov ecx, dword [rsi - 0x18]
mov rax, qword [r15]
mov rcx, qword [r14 - 0x18]
mov rdx, qword [rcx + rax*8]
mov byte [r14 + rax], 1
movq xmm0, qword [rbx + 0x168]
paddd xmm0, xmmword [0x14003eb30]
movq qword [rbx + 0x168], xmm0
ja 0x14000d723
jbe 0x14000d723
call 0x1880b626f
mov eax, dword [rdx + 8]
mov rcx, qword [rdx]
mov rax, qword [rdx + 8]
jnp 0x14000d72f
jp 0x14000d72f
call 0x145eca832
call rax
jmp 0x14000d738
ja 0x14000d738
jbe 0x14000d738
call 0x14174dab1
jne 0x14000d73d
je 0x14000d73d
call 0x128f26089
fild dword [r10]
add byte [rcx], dh
idiv byte [rbp + 3]
mov rcx, rsi
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
xor esi, esi
jge 0x14000d74c
jl 0x14000d74c
call 0x14171dac0
jo 0x14000d751
jno 0x14000d751
call 0x14005423e
add al, ch
add dword [rax], eax
add byte [rax], al
jmp case.0x14000bd9c.6
call 0x14000d75c
add al, ch
cmp byte [rdi + 2], 0x3f
sete dl
test cl, dl
jne 0x14000db39
jnp 0x14000d771
jp 0x14000d771
call 0x1487533b1
cmp al, 0x5c
je 0x14000d77d
movzx eax, al
cmp eax, 0x2f
jne 0x14000d7dc
jg 0x14000d782
jle 0x14000d782
call fcn.1400296c7
add byte [rax], al
mov r15d, 1
cmp rbp, 2
jb 0x14000d850
jns 0x14000d797
js 0x14000d797
call 0x141488daa
movzx eax, byte [rdi + 1]
cmp eax, 0x5c
je 0x14000d7af
mov r15d, 1
cmp eax, 0x2f
jne 0x14000d850
jnp 0x14000d7b4
jp 0x14000d7b4
call 0x143fe5b00
cmp rbp, 3
jne 0x14000db19
jg 0x14000d7c3
jle 0x14000d7c3
call 0x142488dd6
movzx eax, byte [rdi + 2]
mov r15d, 3
cmp eax, 0x2e
je 0x14000d850
cmp eax, 0x3f
je 0x14000d850
jmp 0x14000db28
jae 0x14000d7e1
jb 0x14000d7e1
call 0x142fe5b2d
cmp rbp, 2
jb 0x14000d84d
jl 0x14000d7ec
jge 0x14000d7ec
call 0x17a025770
cmp byte [rdi + 1], 0x3a
jne 0x14000d84d
jbe 0x14000d7f7
ja 0x14000d7f7
call fcn.14003973c
add byte [rax], al
mov r15d, 2
cmp rbp, 3
jb 0x14000d850
jbe 0x14000d808
ja 0x14000d808
call 0x142488e1b
movzx eax, byte [rdi + 2]
cmp eax, 0x5c
je 0x14000d816
cmp eax, 0x2f
jne 0x14000d850
jno 0x14000d81b
jo 0x14000d81b
call 0x140049760
add byte [rax], al
mov r15d, 3
jg 0x14000d826
jle 0x14000d826
call 0x14ff01173
sub dword [rdx + 0x76000007], 3
cmp r15, rbp
jae 0x14000dfd9
jbe 0x14000d834
ja 0x14000d834
call 0x144b6e77a
invalid
movzx eax, byte [rdi + r15]
cmp eax, 0x5c
je 0x14000d843
cmp eax, 0x2f
jne 0x14000d850
jo 0x14000d848
jno 0x14000d848
call 0x12bc8d795
invalid
inc r15
jmp 0x14000d821
xor r15d, r15d
call 0x14000d856
add byte [rax], al
add al, ch
lea rcx, [rdi - 1]
xor eax, eax
mov rdx, r15
jae 0x14000d865
jb 0x14000d865
call 0x1b4d611b1
jae 0x14000d853
cmp rbp, rdx
je 0x14000d8dd
call 0x14000d870
add dword [rax], eax
add byte [rax], al
add al, ch
movzx r8d, byte [rcx + rbp]
cmp r8d, 0x2f
je 0x14000d882
cmp r8d, 0x5c
jne 0x14000d892
jno 0x14000d887
jo 0x14000d887
call 0x188c1d7d3
dec ecx
inc rax
dec rcx
inc rdx
jmp 0x14000d860
mov r12, r15
neg r12
mov r14, rbp
sub r14, rax
lea rsi, [r14 + 1]
lea rcx, [r12 + rsi]
jp 0x14000d8ab
jnp 0x14000d8ab
call 0x141fa5bf7
cmp rcx, 1
je 0x14000d8ca
jg 0x14000d8b6
jle 0x14000d8b6
call 0x1774d8ec9
dec byte [rax - 1]
invalid
movzx ecx, byte [rdi + rsi - 2]
dec rsi
cmp ecx, 0x2f
je 0x14000d8cd
cmp ecx, 0x5c
jne 0x14000d8a2
jmp 0x14000d8cd
mov rsi, r15
mov rcx, rbp
sub rcx, rsi
jae 0x14000d8d8
jb 0x14000d8d8
call 0x1b5c21224
invalid
cmp rcx, rax
jne 0x14000d8e4
xor esi, esi
jmp case.0x14000bd9c.6
call 0x14000d8ea
add al, ch
js 0x14000d8f0
jns 0x14000d8f0
call 0x14179dc6c
js 0x14000d8f5
jns 0x14000d8f5
call 0x14174dc6e
jne 0x14000d8fa
je 0x14000d8fa
call 0x1648d6646
movabs al, byte [0x894dfa8948000012]
invalid
lea rcx, [rsp + 0x12a0]
mov rdx, rdi
mov r8, r14
call fcn.140010cec
movzx r13d, word [rsp + 0x14b8]
test r13w, r13w
jne 0x14000d9ea
jae 0x14000d925
jb 0x14000d925
call 0x14219916a
add byte [rax], al
mov r8d, 0x218
lea rcx, [rsp + 0xb88]
lea rdx, [rsp + 0x12a0]
call fcn.1400027aa
mov r8, qword [rsp + 0xb88]
call 0x14000d94e
add al, ch
jnp 0x14000d954
jp 0x14000d954
call fcn.1400191a0
adc byte [rax + 7], al
movabs rax, 0x780100000
mov qword [rsp + 0x880], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x870], rax
and qword [rsp + 0x878], 0
mov dword [rsp + 0x888], 2
mov word [rsp + 0x88c], 0x101
jo 0x14000d996
jno 0x14000d996
call 0x1648d66e2
add eax, dword [rax]
add byte [rax - 0x73], cl
xchg esp, eax
and al, 0x90
or eax, dword [rax]
add byte [rbp + rcx*4 - 0x74], cl
and al, 0x70
or byte [rax], al
add al, ch
mov ebp, 0x44000033
movzx ebp, word [rsp + 0x348]
lea rcx, [rsp + 0x340]
lea rdx, [rsp + 0xb90]
lea r9, [rsp + 0x870]
call fcn.140010d70
movzx r13d, word [rsp + 0x348]
test r13w, r13w
jne 0x14000d9e0
call 0x14000d9c8
add al, ch
mov rcx, qword [rsp + 0x340]
jb 0x14000d9d6
jae 0x14000d9d6
call 0x142dabfc2
add byte [rbx + 3], dh
call sub.ntdll.dll_NtClose
jae 0x14000d9e0
jb 0x14000d9e0
call 0x1417add5f
jnp 0x14000d9e5
jp 0x14000d9e5
call 0x14171dd59
jo 0x14000d9ea
jno 0x14000d9ea
call 0x14174dd63
jne 0x14000d9ef
je 0x14000d9ef
call 0x14177dd69
jbe 0x14000d9f4
ja 0x14000d9f4
call 0x12d861f5e
test r13w, r13w
je 0x14000da73
movzx eax, r13w
cmp eax, 7
je 0x14000da73
cmp eax, 8
jne 0x14000db39
lea r14, [rsi + 1]
jns 0x14000da15
js 0x14000da15
call 0x14ff81362
test byte [rbx], bl
add dword [rax], eax
add byte [rbx + 3], bh
cmp r15, rsi
je 0x14000db39
jnp 0x14000da23
jp 0x14000da23
call 0x177459036
inc dword [rbx + 0x5742ff8]
movzx eax, byte [rdi + rsi - 1]
cmp eax, 0x2f
je 0x14000da32
cmp eax, 0x5c
jne 0x14000da3f
jbe 0x14000da37
ja 0x14000da37
call 0x189cfd983
dec esi
dec rsi
dec r14
jmp 0x14000da10
lea rax, [r12 + r14]
jle 0x14000da48
jg 0x14000da48
call 0x141f95d94
cmp rax, 1
je 0x14000db0a
jp 0x14000da57
jnp 0x14000da57
call 0x184b6e99d
invalid
movzx eax, byte [rdi + r14 - 2]
dec r14
cmp eax, 0x2f
je 0x14000db0d
cmp eax, 0x5c
jne 0x14000da3f
jmp 0x14000db0d
jo 0x14000da78
jno 0x14000da78
call 0x188ef13c5
mov eax, ebp
cmp r14, rbp
mov rax, rbp
cmova rax, r14
jae 0x14000da87
jb 0x14000da87
call 0x1b3ef13d4
invalid
cmp r14, rbp
jae 0x14000daaa
jg 0x14000da91
jle 0x14000da91
call 0x14cb6e9d7
invalid
movzx ecx, byte [rdi + r14]
cmp ecx, 0x5c
je 0x14000daa0
cmp ecx, 0x2f
jne 0x14000daad
jno 0x14000daa5
jo 0x14000daa5
call 0x12bc7d9f2
fmul dword [rcx - 0x77]
invalid
inc r14
jmp 0x14000da82
mov r14, rax
jb 0x14000dab2
jae 0x14000dab2
call 0x188ef13ff
mov eax, ebp
cmp r14, rbp
mov rax, rbp
cmova rax, r14
mov rsi, r14
jbe 0x14000dac4
ja 0x14000dac4
call 0x1b3ef1410
sbb eax, 0x17f037e
cmp rsi, rbp
jae 0x14000dae6
jle 0x14000dace
jg 0x14000dace
call 0x1770d90e1
movzx ecx, byte [rdi + rsi]
cmp ecx, 0x2f
je 0x14000dae9
cmp ecx, 0x5c
je 0x14000dae9
jp 0x14000dae1
jnp 0x14000dae1
call 0x12bc7da2d
invalid
inc rsi
jmp 0x14000dabf
mov rsi, rax
jo 0x14000daee
jno 0x14000daee
call 0x14ff7143e
test dh, ah
std
invalid
cmp rsi, r14
je 0x14000d8dd
mov rax, r14
jp 0x14000daff
jnp 0x14000daff
call 0x188f7644c
mov r14, rsi
mov rsi, rax
mov esi, eax
jmp 0x14000d8eb
mov r14, r15
jns 0x14000db12
js 0x14000db12
call 0x1b5f7145f
loopne 0x14000db03
cmp r14, rsi
jne 0x14000daf7
jmp 0x14000db39
and byte [rbx + 3], bh
jnp 0x14000db1e
jp 0x14000db1e
call 0x143750894
jb 0x14000db4d
je 0x14000db25
jne 0x14000db25
call 0x1b20322b3
add esi, dword [rbx + 1]
mov al, byte [rdi + 2]
jb 0x14000db2d
jae 0x14000db2d
call 0x148750a6d
cmp al, 0x2f
je 0x14000db39
movzx eax, al
cmp eax, 0x5c
jne 0x14000db4d
jne 0x14000db3e
je 0x14000db3e
call 0x1ae16688a
invalid
lea rdx, [0x140002ab3]
mov r8d, 5
jmp 0x14000dbb6
ja 0x14000db52
jbe 0x14000db52
call 0x140039a97
add byte [rax], al
mov r15d, 2
js 0x14000db5d
jns 0x14000db5d
call 0x14ff014aa
xor dword [rbx + 2], 0
add byte [rbp + 3], bh
cmp r15, rbp
jae 0x14000ddd9
jge 0x14000db6b
jl 0x14000db6b
call 0x144b6eab1
invalid
movzx eax, byte [rdi + r15]
cmp eax, 0x2f
je 0x14000dddc
cmp eax, 0x5c
je 0x14000dddc
ja 0x14000db87
jbe 0x14000db87
call 0x12bc8dad4
int3
inc r15
jmp 0x14000db58
jge 0x14000db91
jl 0x14000db91
call 0x141e8e380
add byte [rax], al
add byte [rax], al
call 0x14176df15
jmp 0x14000db9a
call 0x14000db99
add al, ch
ja 0x14000db9f
jbe 0x14000db9f
call 0x14177df19
jbe 0x14000dba4
ja 0x14000dba4
call 0x1417adf23
jnp 0x14000dba9
jp 0x14000dba9
call 0x18d1668f5
invalid
lea rdx, [0x1400029fd]
mov r8d, 2
mov rcx, rbx
call fcn.14000f956
mov esi, eax
ja 0x14000dbc5
jbe 0x14000dbc5
call 0x16810cc52
mov ah, 0x24
movabs al, byte [0x92b8c48148000092]
add byte [rax], al
mov eax, esi
movaps xmm6, xmmword [rsp + 0x92a0]
add rsp, 0x92b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov cl, 1
jmp 0x14000ca25
jl 0x14000dbef
jge 0x14000dbef
call 0x164ad6737
test al, 0x12
add byte [rax], al
mov r13d, dword [rsp + 0x12a8]
jo 0x14000dbfc
jno 0x14000dbfc
call 0x142d6ebe8
add byte [rsi - 0x42], ah
add al, byte [rax]
call 0x14003b210
mov si, 2
test rax, rax
je 0x14000e006
mov r12, rax
mov dword [rsp + 0x58], r13d
jbe 0x14000dc1b
ja 0x14000dc1b
call 0x140519460
add byte [rax], al
mov r8d, 0x50
mov rcx, rax
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000e006
mov r13, rax
ja 0x14000dc3c
jbe 0x14000dc3c
call 0x14172dfb3
jae 0x14000dc41
jb 0x14000dc41
call 0x188c7658d
add esi, 7
mov rsi, rax
add rsi, 7
and rsi, 0xfffffffffffffff8
jns 0x14000dc51
js 0x14000dc51
call 0x1417edfd4
jg 0x14000dc56
jle 0x14000dc56
call 0x1883765a6
mov dword [rsi + 8], edi
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov eax, dword [rsp + 0x58]
mov dword [rsi + 0x10], eax
mov qword [rsi + 0x18], rbp
mov qword [rsi + 0x20], rbx
mov byte [rsi + 0x40], 0
mov qword [rsi + 0x28], r13
mov qword [rsi + 0x30], r12
jno 0x14000dc7d
jo 0x14000dc7d
call 0x164655fc9
sub byte [rax], al
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x14001055a]
mov edx, 0x1000000
xor ecx, ecx
mov r9, rsi
call sub.KERNEL32.dll_CreateThread
test rax, rax
je 0x14000dfe1
lea rdx, [rsi + 0x28]
jnp 0x14000dcb0
jp 0x14000dcb0
call 0x1784765fc
mov qword [rsi + 0x38], rax
lea rcx, [rsp + 0x340]
mov qword [rcx], rdx
jno 0x14000dcc4
jo 0x14000dcc4
call 0x1402d95b0
add byte [rcx], dh
imul cl
add rax, qword [r8]
add byte [rcx], dh
inc dword [rbp + 0x31]
idiv byte [rdx + 3]
call 0x140010981
xor esi, esi
jmp 0x14000e019
xor edi, edi
xor r14d, r14d
jp 0x14000dcda
jnp 0x14000dcda
call 0x14172e051
jae 0x14000dcdf
jb 0x14000dcdf
call 0x14175e057
je 0x14000dce4
jne 0x14000dce4
call 0x1b4f76235
jbe 0x14000dcee
test r14, r14
je 0x14000dd38
jbe 0x14000dcee
ja 0x14000dcee
call 0x164956a3a
enter 1, 0
lea rdx, [rsp + 0x1c8]
mov qword [rdx], r13
jbe 0x14000dcfe
ja 0x14000dcfe
call 0x164b56a4a
pop rax
add eax, 0x89480000
int1
lea rsi, [rsp + 0x558]
mov rcx, rsi
call fcn.14000b82b
movzx esi, word [rsi + 4]
test si, si
je 0x14000dd5d
jno 0x14000dd1c
jo 0x14000dd1c
call 0xc8c45e68
add dword [rax], eax
add byte [rdx + 3], dh
add rbx, 0x188
jb 0x14000dd28
jae 0x14000dd28
call 0x129da6674
sbb ecx, dword [rdx]
add byte [rax], al
mov rcx, rbx
jmp 0x14000e74b
xor r13d, r13d
jmp 0x14000c97f
lea rdx, [0x140002b3e]
mov r8d, 0xa
mov rcx, rbx
call fcn.14000f956
test ax, ax
mov esi, 8
cmovne esi, eax
jmp 0x14000e756
jle 0x14000dd62
jg 0x14000dd62
call 0x1648568aa
pop rax
add eax, 0x8d4c0000
mov ebx, 0x188
mov r8d, dword [rsp + 0x558]
lea r15, [rbx + 0x188]
cmp r8, 0x1001
jb 0x14000dfa5
jno 0x14000dd83
jo 0x14000dd83
call 0x18cfa66d3
mov edx, esi
mov rcx, r15
mov rdx, r14
mov r8, rdi
call fcn.14000999c
mov si, 0x5f
jmp 0x14000e756
jl 0x14000dd9f
jge 0x14000dd9f
call 0x164bd6aeb
mov eax, 0x44000012
movzx esi, byte [rdi + 0x72e8]
lea rdi, [rsp + 0x12b8]
movzx r14d, byte [rdi + 0x72e8]
jg 0x14000ddb4
jle 0x14000ddb4
call 0x141ef6101
sub r14, 1
jb 0x14000c97f
ja 0x14000ddc3
jbe 0x14000ddc3
call 0x1417be141
jp 0x14000ddc8
jnp 0x14000ddc8
call 0x128fa6714
adc al, 0x4c
add byte [rax], al
mov rcx, rdi
call fcn.1400129e4
add rdi, 0x730
jmp 0x14000ddaf
mov r15, rbp
ja 0x14000dde1
jbe 0x14000dde1
call 0x188f0172e
mov eax, ebp
cmp r15, rbp
mov rax, rbp
cmova rax, r15
jno 0x14000ddf0
jo 0x14000ddf0
call 0x1b3f0173d
invalid
cmp r15, rbp
jae 0x14000de13
jno 0x14000ddfa
jo 0x14000ddfa
call 0x14cb6ed40
invalid
movzx ecx, byte [rdi + r15]
cmp ecx, 0x5c
je 0x14000de09
cmp ecx, 0x2f
jne 0x14000de16
jno 0x14000de0e
jo 0x14000de0e
call 0x12bc8dd5b
fmul dword [rcx - 0x77]
invalid
inc r15
jmp 0x14000ddeb
mov r15, rax
jns 0x14000de1b
js 0x14000de1b
call 0x188f01768
mov eax, ebp
cmp r15, rbp
mov rax, rbp
cmova rax, r15
jg 0x14000de2a
jle 0x14000de2a
call 0x1b3f01777
invalid
cmp r15, rbp
jae 0x14000de4d
jp 0x14000de34
jnp 0x14000de34
call 0x14cb6ed7a
invalid
movzx ecx, byte [rdi + r15]
cmp ecx, 0x2f
je 0x14000de50
cmp ecx, 0x5c
je 0x14000de50
jb 0x14000de48
jae 0x14000de48
call 0x12bc8dd95
fmul dword [rcx - 0x77]
invalid
inc r15
jmp 0x14000de25
mov r15, rax
jge 0x14000de55
jl 0x14000de55
call 0x188f017a2
mov eax, ebp
cmp r15, rbp
mov rax, rbp
cmova rax, r15
jns 0x14000de64
js 0x14000de64
call 0x1b3f017b1
and dh, byte [rcx + 3]
cmp r15, rbp
jae 0x14000de8b
jno 0x14000de6e
jo 0x14000de6e
call 0x14cb6edb4
invalid
movzx ecx, byte [rdi + r15]
cmp ecx, 0x5c
je 0x14000de81
cmp ecx, 0x2f
jne 0x14000d850
js 0x14000de86
jns 0x14000de86
call 0x12bc8ddd3
invalid
inc r15
jmp 0x14000de5f
mov r15, rax
jmp 0x14000d850
jbe 0x14000de98
ja 0x14000de98
call 0x164bd6be4
mov eax, 0x44000012
movzx esi, byte [rdi + 0x72e8]
lea rdi, [rsp + 0x12b8]
movzx r14d, byte [rdi + 0x72e8]
jne 0x14000dead
je 0x14000dead
call 0x141ef61fa
sub r14, 1
jb 0x14000c97f
call 0x14000debd
add al, ch
jg 0x14000dec3
jle 0x14000dec3
call 0x128fa680f
sbb dword [rbx], ecx
add byte [rax - 0x7f], cl
invalid
mov rcx, rdi
call fcn.1400129e4
add rdi, 0x730
jmp 0x14000dea8
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r15
jnp 0x14000dee3
jp 0x14000dee3
call 0x1648d6c2f
add eax, dword [rax]
add byte [rax - 0x73], cl
xchg esp, eax
and al, 0x70
or byte [rax], al
add byte [rcx - 0x48], al
sbb byte [rdx], al
add byte [rax], al
lea rcx, [rsp + 0x340]
lea rdx, [rsp + 0x870]
mov r8d, 0x218
call fcn.1400027aa
lea rsi, [rsp + 0x348]
mov rdi, qword [rsi - 8]
ja 0x14000df0f
jbe 0x14000df0f
call 0x14173e285
jb 0x14000df14
jae 0x14000df14
call 0x1417ce295
jge 0x14000df19
jl 0x14000df19
call 0x14177e293
jbe 0x14000df1e
ja 0x14000df1e
call 0x14173e294
jb 0x14000df23
jae 0x14000df23
call 0x1448c278c
and eax, 0x30
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov r12, qword [rax + 0x48]
movabs r15, 0x180100000
lea r9, [rsp + 0x558]
mov qword [r9 + 0x10], r15
mov qword [r9], r12
and qword [r9 + 8], 0
mov dword [r9 + 0x18], 1
mov word [r9 + 0x1c], 0x100
jb 0x14000df6a
jae 0x14000df6a
call 0x164ad6cba
mov al, 0
add byte [rax], al
lea r13, [rsp + 0xb0]
mov rcx, r13
mov rdx, rsi
mov r8, rdi
call fcn.140010d70
movzx ebp, word [r13 + 8]
cmp ebp, 0x17
je 0x14000e037
test ebp, ebp
je 0x14000e098
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
jmp 0x14000edd7
jae 0x14000dfaa
jb 0x14000dfaa
call 0x14171e31e
jo 0x14000dfaf
jno 0x14000dfaf
call 0x164b56cfb
movabs al, byte [0x894cf18948000012]
cli
lea rsi, [rsp + 0x12a0]
mov rcx, rsi
mov rdx, r15
call fcn.140008d0d
movzx esi, word [rsi + 0x10]
test si, si
je 0x14000e115
jge 0x14000dfd4
jl 0x14000dfd4
call 0x140084fc1
add byte [rcx - 0x77], cl
out dx, eax
jmp 0x14000e748
mov r15, rbp
jmp 0x14000d850
jg 0x14000dfe6
jle 0x14000dfe6
call 0x142d2b5d2
add byte [rdx + 3], bh
call sub.KERNEL32.dll_GetLastError
jp 0x14000dff0
jnp 0x14000dff0
call 0x171e26940
ror byte [rbp - 0x77], cl
call 0x142d333e4
add byte [rbx + rax + 0x7d], bh
add eax, ebp
mov rcx, r12
xor edx, edx
mov r8, r13
call sub.KERNEL32.dll_HeapFree
jl 0x14000e002
jge 0x14000e002
call 0x1400f9e6c
mov si, 0xe
jg 0x14000e00b
jle 0x14000e00b
call 0x18cfa695b
mov edx, esi
mov rcx, r15
mov rdx, r14
mov r8, rdi
call fcn.14000999c
jp 0x14000e01e
jnp 0x14000e01e
call 0x1417de39e
jl 0x14000e023
jge 0x14000e023
call 0x14179e39f
js 0x14000e028
jns 0x14000e028
call 0x14176e3a3
ja 0x14000e02d
jbe 0x14000e02d
call 0x1417be3ab
jp 0x14000e032
jnp 0x14000e032
call 0x13ffc6a1f
push qword [rax + 3]
jmp case.0x14000bd9c.6
jo 0x14000e03c
jno 0x14000e03c
call 0x1648d6d8c
add al, byte [rax]
add byte [rbp - 0x77], cl
jns 0x14000e058
lea r9, [rsp + 0x240]
mov qword [r9 + 0x10], r15
mov qword [r9], r12
and qword [r9 + 8], 0
mov dword [r9 + 0x18], 1
mov word [r9 + 0x1c], 0x101
jnp 0x14000e064
jp 0x14000e064
call 0x164ad6db4
cwde
add dword [rax], eax
add byte [rcx + rcx*4 - 0x17], cl
lea r13, [rsp + 0x198]
mov rcx, r13
mov rdx, rsi
mov r8, rdi
call fcn.140010d70
movzx ebp, word [r13 + 8]
test bp, bp
je 0x14000e098
jnp 0x14000e089
jp 0x14000e089
call 0x1647d6bd9
invalid
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
jmp 0x14000edd2
jns 0x14000e09d
js 0x14000e09d
call 0x140766bea
mov rsi, qword [r13]
jg 0x14000e0a6
jle 0x14000e0a6
call 0x14170e41b
jno 0x14000e0ab
jo 0x14000e0ab
call 0x14170e420
jno 0x14000e0b0
jo 0x14000e0b0
call 0x1417be42e
jp 0x14000e0b5
jnp 0x14000e0b5
call 0x1417fe437
jle 0x14000e0ba
jg 0x14000e0ba
call 0x164956e06
invalid
lea rdx, [rsp + 0x860]
lea rax, [rsp + 0x65f]
and rax, 0xfffffffffffffff8
xor edi, edi
sub rdx, rax
cmovb rdx, rdi
jnp 0x14000e0dc
jp 0x14000e0dc
call 0x10742f028
cmovb rax, rdi
test rax, rax
mov r12, qword [rsp + 0x58]
je 0x14000e28d
jle 0x14000e0f3
jg 0x14000e0f3
call 0x13ee3643f
and rdx, 0xfffffffffffffffe
mov rcx, rdx
shr rcx, 1
test rdx, rdx
cmove rcx, rdx
mov edx, 8
cmove rax, rdx
mov rdi, rax
jmp 0x14000e28f
call 0x14000e11b
add al, ch
mov rax, qword [rsp + 0x12a0]
mov r9, qword [rsp + 0x12a8]
lea rdx, [rsp + 0x240]
mov qword [rdx], r13
mov r13, rax
jno 0x14000e13f
jo 0x14000e13f
call 0x1648d6e8b
jo 0x14000e14d
lea rcx, [rsp + 0x870]
add byte [rax], al
mov r8, rax
mov qword [rsp + 0x58], r9
and al, 0x58
call fcn.140011e88
jg 0x14000e159
jle 0x14000e159
call 0x142d19445
add byte [rsi - 0x42], ah
add al, byte [rax]
call 0x14003b210
mov si, 2
test rax, rax
je 0x14000e72e
mov rbp, rax
jge 0x14000e173
jl 0x14000e173
call 0x1405199b8
add byte [rax], al
mov r8d, 0x50
mov rcx, rax
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x14000e72e
mov r12, rax
jae 0x14000e194
jb 0x14000e194
call 0x1417ce515
jge 0x14000e199
jl 0x14000e199
call 0x188c76ae5
add esi, 7
mov rsi, rax
add rsi, 7
and rsi, 0xfffffffffffffff8
jb 0x14000e1a9
jae 0x14000e1a9
call 0x14172e520
jae 0x14000e1ae
jb 0x14000e1ae
call 0x188376afe
mov dword [rsi + 8], edi
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r13
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x20], rbx
mov byte [rsi + 0x40], 0
mov qword [rsi + 0x28], r12
mov qword [rsi + 0x30], rbp
call 0x14000e1d8
add al, ch
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x140012dd3]
mov edx, 0x1000000
xor ecx, ecx
mov r9, rsi
call sub.KERNEL32.dll_CreateThread
test rax, rax
je 0x14000e709
lea rdx, [rsi + 0x28]
jne 0x14000e20c
je 0x14000e20c
call 0x178476b58
mov qword [rsi + 0x38], rax
lea rcx, [rsp + 0x658]
mov qword [rcx], rdx
ja 0x14000e220
jbe 0x14000e220
call 0x140283f0c
add byte [rcx], dh
imul cl
sub al, byte [0x14372e22e]
call 0x140010981
xor esi, esi
jmp 0x14000e756
jb 0x14000e231
jae 0x14000e231
call 0x1648d6f7d
jo 0x14000e23f
lea rcx, [rsp + 0x870]
add byte [rax], al
lea rdx, [rsp + 0x12a0]
add byte [rax], al
mov r8d, 0x218
call fcn.1400027aa
lea rcx, [rsp + 0x348]
lea rdx, [rsp + 0x878]
ja 0x14000e261
jbe 0x14000e261
call 0x1400a9aa6
add byte [rax], al
mov r8d, 9
call sub.KERNEL32.dll_MoveFileExW
test eax, eax
je 0x14000e464
jge 0x14000e279
jl 0x14000e279
call 0x1417ee5fc
jg 0x14000e27e
jle 0x14000e27e
call 0x1417ee601
jg 0x14000e283
jle 0x14000e283
call 0x14178e600
jns 0x14000e288
js 0x14000e288
call 0x13fe40b75
push qword [rcx]
leave
jmp 0x14000c5b5
xor ecx, ecx
js 0x14000e294
jns 0x14000e294
call 0x1400c9ffe
mov bp, 0xb
test rdi, rdi
je 0x14000eda5
jae 0x14000e2a6
jb 0x14000e2a6
call 0x18809e737
cmp ecx, 0x7fffffff
lea eax, [rcx + rcx]
cmp rcx, 0x7fffffff
mov r9d, 0xffffffff
cmovbe r9d, eax
jle 0x14000e2bf
jg 0x14000e2bf
call 0x16465660b
and byte [rax], al
and qword [rsp + 0x20], 0
mov rcx, rsi
mov edx, 1
mov r8, rdi
call sub.ntdll.dll_NtQueryObject
cmp eax, 0x80000005
je 0x14000e3e5
cmp eax, 0xc0000004
je 0x14000e3e5
test dl, bh
add byte [rax], al
invalid
cmp eax, 0xc0000008
je 0x14000e6ed
cmp eax, 0xc0000022
je 0x14000e6fb
cmp eax, 0xc0000023
je 0x14000e3e5
mov bp, 0xe
test eax, eax
jne 0x14000eda5
js 0x14000e31d
jns 0x14000e31d
call 0x142806687
add byte [rdi], cl
test byte [rax + 0xa], bh
add byte [rax], al
cmp word [rdi + 2], 0
je 0x14000eda0
ja 0x14000e32d
jbe 0x14000e32d
call 0x17fb7f275
movzx r15d, word [rdi]
mov r8, qword [rdi + 8]
je 0x14000e33a
jne 0x14000e33a
call 0xcf0e7086
push rbp
invalid
lea rcx, [0x1400038d0]
mov edx, 8
mov r9d, 8
mov qword [rsp + 0x68], r8
call fcn.1400110cd
test al, 1
mov r12, qword [rsp + 0x58]
je 0x14000eda5
mov rax, r15
shr rax, 1
mov qword [rsp + 0x78], rax
jg 0x14000e373
jle 0x14000e373
call 0x13f8628dd
test r15w, r15w
je 0x14000e99e
jno 0x14000e382
jo 0x14000e382
call 0x164456ece
js 0x14000e3d0
mov rax, qword [rsp + 0x78]
lea rbp, [rax - 1]
lea ebp, [rax - 1]
mov rax, qword [rsp + 0x68]
lea rdi, [rax + 0x10]
mov r13d, 8
lea r15, [0x140003808]
ja 0x14000e3a6
jbe 0x14000e3a6
call 0x14fee1cf3
xchg edi, ebp
add eax, 0x3770000
cmp r13, rbp
ja 0x14000e99e
ja 0x14000e3b4
jbe 0x14000e3b4
call 0x1417be732
jp 0x14000e3b9
jnp 0x14000e3b9
call 0x14000e577
add byte [rcx - 0x47], al
add dword [rax], eax
add byte [rax], al
mov edx, 1
mov r9d, 1
mov rcx, rdi
mov r8, r15
call fcn.1400110cd
test al, 1
jne 0x14000e9a1
add dword [rdi], ecx
test edx, ecx
add eax, 0x3730000
jae 0x14000e3dc
jb 0x14000e3dc
call 0x188c6e329
add edi, 2
inc r13
add rdi, 2
jmp 0x14000e3a1
jp 0x14000e3ea
jnp 0x14000e3ea
call 0x1400ca154
mov bp, 0xb
jmp 0x14000eda5
jns 0x14000e3f8
js 0x14000e3f8
call 0x164bd7144
mov eax, 0x44000012
movzx esi, byte [rdi + 0x72e8]
lea rdi, [rsp + 0x12b8]
movzx r14d, byte [rdi + 0x72e8]
js 0x14000e40d
jns 0x14000e40d
call 0x141ef675a
sub r14, 1
jb 0x14000e430
call 0x14000e419
add al, ch
js 0x14000e41f
jns 0x14000e41f
call 0x128fa6d6b
mov ebp, 0x48000045
add edi, 0x730
mov rcx, rdi
call fcn.1400129e4
add rdi, 0x730
jmp 0x14000e408
mov r13w, 1
jmp 0x14000c97f
jno 0x14000e43f
jo 0x14000e43f
call 0x160252909
add byte [rax - 0x73], cl
mov word [rax + rsi*8], fs
add byte [rax], al
add byte [rax - 0x73], cl
xchg esp, eax
and al, 0x40
add al, byte [rax]
add byte [rbp + rcx*4 - 0x74], cl
and al, 0x80
add byte [rax], al
add byte [rcx - 0x77], cl
clc
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x240]
lea r9, [rsp + 0x80]
mov r8, rdi
jmp 0x14000e579
je 0x14000e469
jne 0x14000e469
call 0x142ce3755
add cl, ch
invalid
call sub.KERNEL32.dll_GetLastError
jmp 0x14000cb92
je 0x14000e478
jne 0x14000e478
call 0x1648d6fc4
nop
add byte [rax], al
add al, ch
cmp ecx, edi
add al, byte [rax]
mov rcx, qword [rsp + 0x90]
call sub.ntdll.dll_NtClose
jns 0x14000e48a
js 0x14000e48a
call 0x14372fc79
jmp 0x14000e4a3
jb 0x14000e491
jae 0x14000e491
call 0x1648d6fdd
nop
add byte [rax], al
add al, ch
and cl, bh
add al, byte [rax]
mov rcx, qword [rsp + 0x90]
call sub.ntdll.dll_NtClose
jl 0x14000e4a3
jge 0x14000e4a3
call 0x1b425299d
add dword [rbp + 0x17], esi
test byte [rsp + 0x74], 1
jne 0x14000e4c1
js 0x14000e4af
jns 0x14000e4af
call 0x1648d6ffb
mov byte [rax], al
add byte [rax], al
mov rcx, qword [rsp + 0x88]
call sub.ntdll.dll_NtClose
jno 0x14000e4c1
jo 0x14000e4c1
call 0x14174e83a
jne 0x14000e4c6
je 0x14000e4c6
call 0x14178e843
jns 0x14000e4cb
js 0x14000e4cb
call 0x1417fe84d
jle 0x14000e4d0
jg 0x14000e4d0
call 0x14178e84d
jns 0x14000e4d5
js 0x14000e4d5
call 0x1417ce856
jge 0x14000e4da
jl 0x14000e4da
call 0x1417fe85c
jle 0x14000e4df
jg 0x14000e4df
call fcn.14000e6cb
add byte [rax], al
call 0x1417be864
call 0x14000e4e5
add al, ch
jp 0x14000e4eb
jnp 0x14000e4eb
call 0x14175e863
je 0x14000e4f0
jne 0x14000e4f0
call 0x14176e86b
ja 0x14000e4f5
jbe 0x14000e4f5
call 0x164bd7241
mov eax, 0x44000012
movzx esi, byte [rdi + 0x72e8]
lea rdi, [rsp + 0x12b8]
movzx r14d, byte [rdi + 0x72e8]
jl 0x14000e50a
jge 0x14000e50a
call 0x141ef6857
sub r14, 1
jb 0x14000c97f
jae 0x14000e519
jb 0x14000e519
call 0x1417de899
jl 0x14000e51e
jge 0x14000e51e
call 0x128fa6e6a
mov esi, 0x48000044
add edi, 0x730
mov rcx, rdi
call fcn.1400129e4
add rdi, 0x730
jmp 0x14000e505
call 0x14000e535
add al, ch
mov rax, qword [rsp + 0x12a0]
lea r14, [rsp + 0xb88]
mov qword [r14], rax
jne 0x14000e54e
je 0x14000e54e
call 0x1648d729a
add al, byte [rax]
add byte [rax - 0x77], cl
cli
lea rcx, [rsp + 0x240]
mov rdx, rdi
call fcn.14000928d
mov r8, rdx
je 0x14000e566
jne 0x14000e566
call 0x160252a30
add dword [rax - 0x73], ecx
mov word [rax + rsi*8], fs
add byte [rax], al
add byte [rax - 0x77], cl
ret 0x894d
mov byte [rsp + 0x20], 1
lea rcx, [rsp + 0xf0]
mov rdx, rax
mov r9, r14
call fcn.14001215b
je 0x14000e583
jne 0x14000e583
call 0x14178e900
jns 0x14000e588
js 0x14000e588
call 0x14172e8ff
jae 0x14000e58d
jb 0x14000e58d
call 0x164bd68f7
sub byte [rcx], al
add byte [rax], al
add byte [rdi], cl
test esp, edi
add al, byte [rax]
add byte [rax + 3], bh
cmp word [rsp + 0x128], 0
jne 0x14000e898
js 0x14000e5a1
jns 0x14000e5a1
call 0xc46ff598
and al, 0xf0
add byte [rax], al
add byte [rdi], cl
adc byte [rsp + 0x100], cl
movdqu xmm0, xmmword [rsp + 0xf0]
movups xmm1, xmmword [rsp + 0x100]
movups xmm2, xmmword [rsp + 0x110]
movdqa xmmword [rsp + 0x160], xmm0
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x190], rax
movaps xmmword [rsp + 0x180], xmm2
movaps xmmword [rsp + 0x170], xmm1
xor ebp, ebp
mov rdi, qword [rsp + 0x160]
lea r14, [rsp + 0x340]
lea r15, [rsp + 0x12a0]
lea r12, [rsp + 0x870]
jo 0x14000e60a
jno 0x14000e60a
call 0x14174e983
jne 0x14000e60f
je 0x14000e60f
call 0x14173e985
jb 0x14000e614
jae 0x14000e614
call 0x1417ae993
jnp 0x14000e619
jp 0x14000e619
call 0x164ad6f65
mov byte [rbx], cl
add byte [rax], al
mov qword [rsp + 0xb88], rbp
mov byte [rsp + 0xb90], 1
js 0x14000e62e
jns 0x14000e62e
call 0x16485737a
mov byte [rbx], cl
add byte [rax], al
lea rax, [rsp + 0xb88]
mov qword [rsp + 0x20], rax
mov r9d, 0x8000
mov rcx, r14
mov rdx, rsi
mov r8, r15
call fcn.140012477
jl 0x14000e654
jge 0x14000e654
call 0x164bd69be
add rax, qword [rax]
add byte [rax], al
cmp word [rsp + 0x348], 0
jne 0x14000e6d9
jno 0x14000e664
jp 0x14000e6de
jle 0x14000e6f2
jg 0x14000e6f2
call 0x14009a45c
mov bp, 8
jmp 0x14000eda5
jae 0x14000e700
jb 0x14000e700
call 0x1400aa46a
mov bp, 9
jmp 0x14000eda5
jl 0x14000e70e
jge 0x14000e70e
call 0x142cb94fa
add byte [rax + 3], bh
call sub.KERNEL32.dll_GetLastError
js 0x14000e718
jns 0x14000e718
call 0x171ea7064
ror byte [rbp - 0x77], cl
loopne 0x14000e709
mov rcx, rbp
xor edx, edx
mov r8, r12
call sub.KERNEL32.dll_HeapFree
sub ecx, ebx
add al, byte [rax]
jnp 0x14000e72a
jp 0x14000e72a
call 0x1400fa594
mov si, 0xe
jl 0x14000e733
jge 0x14000e733
call 0x18cfa7083
mov edx, ebp
mov rcx, r15
mov rdx, r13
mov r8, qword [rsp + 0x58]
call fcn.14000999c
jno 0x14000e748
jo 0x14000e748
call 0x18cfa7098
mov edx, esi
mov rcx, r15
mov rdx, r14
mov r8, rdi
call fcn.14000999c
call 0x14000e75c
add al, ch
jle 0x14000e762
jg 0x14000e762
call 0x14176eadd
ja 0x14000e767
jbe 0x14000e767
call 0x14178eae4
jns 0x14000e76c
js 0x14000e76c
call 0x1417aeaeb
jnp 0x14000e771
jp 0x14000e771
call 0x14000e95d
add byte [rax], al
call 0x1417deaf8
call 0x14000e777
add al, ch
jl 0x14000e77d
jge 0x14000e77d
call 0x14172eaf4
jae 0x14000e782
jb 0x14000e782
call 0x1417eeb05
jg 0x14000e787
jle 0x14000e787
call 0x14179eb03
js 0x14000e78c
jns 0x14000e78c
call 0x14176eb07
ja 0x14000e791
jbe 0x14000e791
call 0x13ff5127e
push qword [rbx + 3]
jb 0x14000e79b
jmp case.0x14000bd9c.6
call 0x14176eb16
ja 0x14000e7a0
jbe 0x14000e7a0
call 0x14175eb18
je 0x14000e7a5
jne 0x14000e7a5
call 0x14174eb1e
jne 0x14000e7aa
je 0x14000e7aa
call 0x1417feb2c
jle 0x14000e7af
jg 0x14000e7af
call 0xd125a433
add dword [rax], eax
add byte [rax], al
cmp byte [rsp + 0x191], 0
je 0x14000e7d3
jnp 0x14000e7be
jp 0x14000e7be
mov rcx, rdi
call sub.ntdll.dll_NtClose
jge 0x14000e7cb
jl 0x14000e7cb
call 0xd1256c95
add dword [rax], eax
add byte [rax], al
mov byte [rsp + 0x191], 0
call 0x14000e7d9
add al, ch
lea rdx, [rsp + 0x180]
mov rbp, qword [rdx - 8]
mov rdi, qword [rdx - 0x18]
mov r14, qword [rdx - 0x10]
ja 0x14000e7f3
jbe 0x14000e7f3
call 0x1417eeb76
jg 0x14000e7f8
jle 0x14000e7f8
call 0x14174eb71
jne 0x14000e7fd
je 0x14000e7fd
call 0x14173eb73
jb 0x14000e802
jae 0x14000e802
call 0x1417aeb81
jnp 0x14000e807
jp 0x14000e807
call 0x164bd7557
jo 0x14000e815
lea r15, [rsp + 0x870]
add byte [rax], al
mov r8d, 0x10
mov rcx, r15
call fcn.140010cec
cmp word [r15 + 0x218], 0
jne 0x14000e872
ja 0x14000e82d
jbe 0x14000e82d
call 0x1648d7579
pop rax
invalid
lea rcx, [rsp + 0x658]
lea rdx, [rsp + 0x870]
mov r8d, 0x218
call fcn.1400027aa
jo 0x14000e84d
jno 0x14000e84d
call 0x164bd759d
mov byte [rbx], cl
add byte [rax], al
lea r15, [rsp + 0xb88]
mov rcx, r15
mov rdx, rdi
mov r8, r14
call fcn.140010cec
cmp word [r15 + 0x218], 0
je 0x14000eabc
jno 0x14000e877
jo 0x14000e877
call 0x14175ebef
je 0x14000e87c
jne 0x14000e87c
call 0x1417febfe
jle 0x14000e881
jg 0x14000e881
call 0x14177ebfb
jbe 0x14000e886
ja 0x14000e886
call 0x14172ebfd
jae 0x14000e88b
jb 0x14000e88b
call 0x1648d75d7
invalid
lea rcx, [rsp + 0x160]
call 0x14001272a
jns 0x14000e89d
js 0x14000e89d
call 0x128f271e9
sbb ecx, ebx
add al, byte [rax]
mov rcx, rsi
call sub.ntdll.dll_NtClose
je 0x14000e8aa
jne 0x14000e8aa
call 0x14177ec24
jbe 0x14000e8af
ja 0x14000e8af
call 0x14175ec27
je 0x14000e8b4
jne 0x14000e8b4
call 0x14178ec31
jns 0x14000e8b9
js 0x14000e8b9
call 0x1417fec3b
jle 0x14000e8be
jg 0x14000e8be
call 0x14177ec38
jbe 0x14000e8c3
ja 0x14000e8c3
call 0x14178ec40
jns 0x14000e8c8
js 0x14000e8c8
call 0x14175ec40
je 0x14000e8cd
jne 0x14000e8cd
call 0x14178ec4a
jns 0x14000e8d2
js 0x14000e8d2
call 0x15a16761e
invalid
lea rdx, [0x140002af3]
mov r8d, 4
mov rcx, rbx
call fcn.14000f956
mov esi, eax
jb 0x14000e8ee
jae 0x14000e8ee
call 0x1417dec6e
jl 0x14000e8f3
jge 0x14000e8f3
call 0x14173ec69
jb 0x14000e8f8
jae 0x14000e8f8
call 0x1417bec76
jp 0x14000e8fd
jnp 0x14000e8fd
call 0x1417dec7d
jl 0x14000e902
jge 0x14000e902
call 0x1417eec85
jg 0x14000e907
jle 0x14000e907
call 0x14179ec83
js 0x14000e90c
jns 0x14000e90c
call 0x14176ec87
ja 0x14000e911
jbe 0x14000e911
call 0x1417dec91
jl 0x14000e916
jge 0x14000e916
call 0x14178ec93
jns 0x14000e91b
js 0x14000e91b
call 0x13ff38a08
invalid
jmp case.0x14000bd9c.6
jnp 0x14000e925
jp 0x14000e925
call 0x164bd7671
mov eax, 0x44000012
movzx esi, byte [rdi + 0x72e8]
lea rdi, [rsp + 0x12b8]
movzx r14d, byte [rdi + 0x72e8]
jge 0x14000e93a
jl 0x14000e93a
call 0x141ef6c87
sub r14, 1
jb 0x14000c97f
jno 0x14000e949
jo 0x14000e949
call 0x14171ecbd
jo 0x14000e94e
jno 0x14000e94e
call 0x128fa729a
mov es, word [rax]
add byte [rax - 0x7f], cl
invalid
mov rcx, rdi
call fcn.1400129e4
add rdi, 0x730
jmp 0x14000e935
jbe 0x14000e964
ja 0x14000e964
call 0x164bd76b0
mov eax, 0x44000012
movzx esi, byte [rdi + 0x72e8]
lea rdi, [rsp + 0x12b8]
movzx r14d, byte [rdi + 0x72e8]
jge 0x14000e979
jl 0x14000e979
call 0x141ef6cc6
sub r14, 1
jb 0x14000c97f
ja 0x14000e988
jbe 0x14000e988
call 0x14174ed01
jne 0x14000e98d
je 0x14000e98d
call 0x128fa72d9
add byte [rax], al
mov rcx, rdi
call fcn.1400129e4
add rdi, 0x730
jmp 0x14000e974
xor r13d, r13d
jno 0x14000e9a6
jo 0x14000e9a6
call 0x14172ed1d
jae 0x14000e9ab
jb 0x14000e9ab
call 0x164bd76fb
mov byte [rbx], cl
add byte [rax], al
lea r15, [rsp + 0xb88]
mov r8d, 0x11c
mov rcx, r15
xor edx, edx
call fcn.140002794
jge 0x14000e9c8
jl 0x14000e9c8
call 0x153167714
invalid
lea rdx, [0x1400038e2]
lea r9, [0x140003810]
lea rdi, [rsp + 0xf0]
mov r8d, 0x15
mov rcx, rdi
call fcn.140010d70
movzx ebp, word [rdi + 8]
test bp, bp
mov r12, qword [rsp + 0x58]
jne 0x14000eda5
jnp 0x14000ea03
jp 0x14000ea03
call 0x164a57553
lock add byte [rax], al
mov r12, qword [rsp + 0xf0]
lea rcx, [rsp + 0xba0]
mov dword [rcx - 8], 0x18
add byte [rax - 0x73], cl
mov word [rax + riz*4], fs
or eax, dword [rax]
add bh, al
clc
sbb byte [rax], al
add byte [rax], al
mov r8, r13
add r8, r13
mov word [rcx - 4], r8w
jo 0x14000ea2a
jno 0x14000ea2a
call 0x164557576
push 0xffffffffff3d76e8
push qword [rax + 3]
mov rdx, qword [rsp + 0x68]
call fcn.1400027aa
jo 0x14000ea39
jno 0x14000ea39
call 0x14177edb3
jbe 0x14000ea3e
ja 0x14000ea3e
call 0x16485778a
movabs al, byte [0x4024448948000012]
lea rax, [rsp + 0x12a0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], r15
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x48], 0x470
mov dword [rsp + 0x38], 0x11c
mov dword [rsp + 0x28], 0x6d0008
mov rcx, r12
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.ntdll.dll_NtDeviceIoControlFile
cmp eax, 0xc0000010
je 0x14000ed79
cmp eax, 0xc0000022
je 0x14000ed80
test eax, eax
je 0x14000f148
mov bp, 0xe
cmp eax, 0xc0000061
jne 0x14000ed89
je 0x14000eab7
jne 0x14000eab7
call fcn.14003b4a4
add byte [rbx + 3], dh
jmp 0x14000ed85
jae 0x14000eac1
jb 0x14000eac1
call 0x164bd780d
add eax, dword [rax]
add byte [rax - 0x73], cl
xchg esp, eax
and al, 0x88
or eax, dword [rax]
add byte [rcx - 0x48], al
sbb byte [rdx], al
add byte [rax], al
lea rdi, [rsp + 0x340]
lea rdx, [rsp + 0xb88]
mov r8d, 0x218
mov rcx, rdi
call fcn.1400027aa
lea rdx, [rsp + 0x660]
mov r8, qword [rdx - 8]
mov r14, qword [rdi]
jge 0x14000eaf3
jl 0x14000eaf3
call 0x1417fee75
jle 0x14000eaf8
jg 0x14000eaf8
call 0x14175ee70
je 0x14000eafd
jne 0x14000eafd
call 0x14178ee7a
jns 0x14000eb02
js 0x14000eb02
call fcn.14001a34e
adc dword [rax + 7], eax
add byte [rax], al
add byte [rbp + rcx*4 - 0x74], cl
and al, 0x98
add dword [rax], eax
add byte [rcx - 0x77], cl
adc byte [r9 - 0x77], cl
sub dword [rcx - 0x7d], ecx
invalid
movabs rax, 0x740110000
lea r9, [rsp + 0x198]
mov qword [r9 + 0x10], rax
mov qword [r9], rbp
and qword [r9 + 8], 0
mov dword [r9 + 0x18], 1
mov word [r9 + 0x1c], 2
call 0x14000eb35
add al, ch
lea rdi, [rsp + 0xa0]
mov rcx, rdi
call fcn.140010d70
cmp word [rdi + 8], 0
je 0x14000eb70
je 0x14000eb52
jne 0x14000eb52
call 0x143742b41
jmp 0x14000eb93
jae 0x14000eb59
jb 0x14000eb59
call 0x1648d76a5
nop
add byte [rax], al
add al, ch
pop rdx
enter 2, 0x72
add esi, dword [rbx + 1]
mov rcx, qword [rsp + 0x90]
call sub.ntdll.dll_NtClose
jb 0x14000eb6b
jae 0x14000eb6b
call 0x13ffa1f58
push qword [rbx + 3]
jmp 0x14000e4a3
jae 0x14000eb75
jb 0x14000eb75
call 0x164bd76c1
movabs al, byte [0x186fe8149000000]
add byte [rax], al
mov rdi, qword [rsp + 0xa0]
cmp r14, 0x186
jbe 0x14000ebc5
jne 0x14000eb8b
je 0x14000eb8b
call 0x128fa74d7
sub eax, 0x7f0002c8
add edi, dword [rsi + 1]
mov rcx, rdi
call sub.ntdll.dll_NtClose
jg 0x14000eb98
jle 0x14000eb98
call 0x14175ef10
je 0x14000eb9d
jne 0x14000eb9d
call 0x14173ef13
jb 0x14000eba2
jae 0x14000eba2
call 0x14177ef1c
jbe 0x14000eba7
ja 0x14000eba7
call 0x14176ef22
ja 0x14000ebac
jbe 0x14000ebac
call 0x14175ef24
je 0x14000ebb1
jne 0x14000ebb1
call 0x14177ef2b
jbe 0x14000ebb6
ja 0x14000ebb6
call 0x14172ef2d
jae 0x14000ebbb
jb 0x14000ebbb
call 0x14172ef32
jae 0x14000ebc0
jb 0x14000ebc0
call 0x13ffdadad
dec dword [rbp + rcx*4 - 0x44]
and al, 0x48
add eax, dword [rax]
add byte [rdi + 3], bh
jmp 0x14000e886
lea r15, [rsp + 0x348]
jg 0x14000ebd2
jle 0x14000ebd2
call 0x176257925
lea r12, [r14 + r14]
lea r13, [rsp + 0x12b4]
mov byte [r13 - 0x14], 1
jb 0x14000ebe8
jae 0x14000ebe8
call 0x18cfa7538
mov edx, esi
mov rcx, r15
mov rdx, r14
call fcn.1400126cf
xor ecx, ecx
test al, 1
cmovne rbp, rcx
mov qword [r13 - 0xc], rbp
mov dword [r13 - 4], r12d
call 0x14000ec09
add al, ch
mov rcx, r13
mov rdx, r15
mov r8, r12
call fcn.1400027aa
lea r9d, [r12 + 0x17]
jp 0x14000ec22
jnp 0x14000ec22
call 0x1602530ed
or al, byte [rax]
add byte [rax], al
mov dword [rsp + 0x20], 0xa
lea rdx, [rsp + 0xb0]
lea r8, [rsp + 0x12a0]
mov rcx, rdi
call sub.ntdll.dll_NtSetInformationFile
cmp eax, 0xc0000022
je 0x14000f329
cmp eax, 0xc0000034
je 0x14000f335
cmp eax, 0xc0000035
je 0x14000f341
cmp eax, 0xc000003a
je 0x14000f34b
cmp eax, 0xc00000d4
je 0x14000f355
test eax, eax
jne 0x14000f35f
jp 0x14000ec86
jnp 0x14000ec86
call 0x128fa75d2
xor al, bh
add al, byte [rax]
mov rcx, rdi
call sub.ntdll.dll_NtClose
jb 0x14000ec93
jae 0x14000ec93
call 0x14172f00a
jae 0x14000ec98
jb 0x14000ec98
call 0x1417bf016
jp 0x14000ec9d
jnp 0x14000ec9d
call 0x14172f014
jae 0x14000eca2
jb 0x14000eca2
call 0x1417af021
jnp 0x14000eca7
jp 0x14000eca7
call 0x1417df027
jl 0x14000ecac
jge 0x14000ecac
call 0x14172f023
jae 0x14000ecb1
jb 0x14000ecb1
call 0x1417af030
jnp 0x14000ecb6
jp 0x14000ecb6
call 0x1417df036
jl 0x14000ecbb
jge 0x14000ecbb
call 0x1648d7a07
invalid
lea rcx, [rsp + 0x160]
mov byte [rcx + 0x32], 0
jb 0x14000eccc
jae 0x14000eccc
call 0x1403b46b8
add byte [rdx + 3], dh
call 0x14001272a
jb 0x14000ecd6
jae 0x14000ecd6
call 0x128f27622
loop 0x14000eca2
mov rcx, rsi
call sub.ntdll.dll_NtClose
add al, byte [rax]
jle 0x14000ece3
jg 0x14000ece3
call 0x14000eecf
add byte [rax], al
call 0x1417ff06c
call 0x14000ece9
add al, ch
jle 0x14000ecef
jg 0x14000ecef
call 0x1417ff071
jle 0x14000ecf4
jg 0x14000ecf4
call 0x14179f070
js 0x14000ecf9
jns 0x14000ecf9
call 0x1417af078
jnp 0x14000ecfe
jp 0x14000ecfe
call 0x1417ff080
jle 0x14000ed03
jg 0x14000ed03
call 0x14174f07c
jne 0x14000ed08
je 0x14000ed08
call 0x14000eec6
add al, dh
xadd dword [rbx + 0x198], edx
mov edx, 1
lock xadd dword [rbx + 0x198], edx
jge 0x14000ed1a
jl 0x14000ed1a
call 0x16445b466
and byte [rdi], al
add byte [rax], al
add byte [rbp + rcx*4 + 0xd], cl
invalid
mov qword [rsp + 0x20], 7
lea r9, [0x140002af8]
mov rcx, rbx
xor r8d, r8d
call fcn.14000fa8e
jmp 0x14000e8e7
jle 0x14000ed3f
jg 0x14000ed3f
call 0x164bd7a8b
mov eax, 0x44000012
movzx esi, byte [rdi + 0x72e8]
lea rdi, [rsp + 0x12b8]
movzx r14d, byte [rdi + 0x72e8]
jno 0x14000ed54
jo 0x14000ed54
call 0x141ef70a1
sub r14, 1
jb 0x14000c97f
jo 0x14000ed63
jno 0x14000ed63
call 0x14171f0d7
jo 0x14000ed68
jno 0x14000ed68
call 0x128fa76b4
je 0x14000edaa
mov rcx, rdi
call fcn.1400129e4
add byte [rax], al
add rdi, 0x730
jmp 0x14000ed4f
jno 0x14000ed7e
jo 0x14000ed7e
call 0x14370f36d
jmp 0x14000ed85
jo 0x14000ed85
jno 0x14000ed85
call 0x1400aaaef
mov bp, 9
jo 0x14000ed8e
jno 0x14000ed8e
call 0x14179f10a
js 0x14000ed93
jns 0x14000ed93
call 0x128e276e3
and eax, 0x770002c6
add esi, dword [rsi + 1]
mov rcx, r12
call sub.ntdll.dll_NtClose
ja 0x14000eda0
jbe 0x14000eda0
call 0x1646578f0
pop rax
mov r12, qword [rsp + 0x58]
jle 0x14000edaa
jg 0x14000edaa
call 0x14000ef96
add byte [rax], al
call 0x14176f12c
call 0x14000edb0
add al, ch
ja 0x14000edb6
jbe 0x14000edb6
call 0x14172f12d
jae 0x14000edbb
jb 0x14000edbb
call 0x14174f134
jne 0x14000edc0
je 0x14000edc0
call 0x14176f13b
ja 0x14000edc5
jbe 0x14000edc5
call 0x128f27711
invalid
mov rcx, rsi
call sub.ntdll.dll_NtClose
mov r15, qword [rsp + 0x60]
jae 0x14000edd7
jb 0x14000edd7
call 0x14175f14f
je 0x14000eddc
jne 0x14000eddc
call 0x14178f159
jns 0x14000ede1
js 0x14000ede1
call 0x14177f15b
jbe 0x14000ede6
ja 0x14000ede6
call 0x14177f160
jbe 0x14000edeb
ja 0x14000edeb
call 0x14000efd7
add byte [rax], al
call 0x14179f16e
call 0x14000edf1
add al, ch
js 0x14000edf7
jns 0x14000edf7
call 0x14fee7361
test byte [rbp + 0x72000000], dl
add esi, dword [rbx + 1]
test bp, bp
je 0x14000ee95
jb 0x14000ee05
jae 0x14000ee05
call 0xc4167b51
cmp al, 0xff
inc dword [rcx - 0x48]
or byte [rax], al
add byte [rax], al
lea rdx, [0x140002a90]
mov r8d, 8
mov rcx, rbx
call fcn.14000f956
mov esi, eax
jb 0x14000ee21
jae 0x14000ee21
call 0x18cf27771
mov edx, edi
mov rcx, r14
mov rdx, r15
mov r8, r12
call fcn.14000999c
jo 0x14000ee34
jno 0x14000ee34
call 0x1417cf1b5
jge 0x14000ee39
jl 0x14000ee39
call 0x14174f1b2
jne 0x14000ee3e
je 0x14000ee3e
call 0x14171f1b2
jo 0x14000ee43
jno 0x14000ee43
call 0x14179f1bf
js 0x14000ee48
jns 0x14000ee48
call 0x14172f1bf
jae 0x14000ee4d
jb 0x14000ee4d
call 0x1417ff1cf
jle 0x14000ee52
jg 0x14000ee52
call 0x14177f1cc
jbe 0x14000ee57
ja 0x14000ee57
call 0x14176f1d2
ja 0x14000ee5c
jbe 0x14000ee5c
call 0x1417ef1df
jg 0x14000ee61
jle 0x14000ee61
call 0x14172f1d8
jae 0x14000ee66
jb 0x14000ee66
call 0x14178f1e3
jns 0x14000ee6b
js 0x14000ee6b
call 0x14179f1e7
js 0x14000ee70
jns 0x14000ee70
call 0x14000f05c
add byte [rax], al
call 0x1417ff1f9
call 0x14000ee76
add al, ch
jle 0x14000ee7c
jg 0x14000ee7c
call 0x14170f1f1
jno 0x14000ee81
jo 0x14000ee81
call 0x14172f1f8
jae 0x14000ee86
jb 0x14000ee86
call 0x1417cf207
jge 0x14000ee8b
jl 0x14000ee8b
call 0x14176f206
ja 0x14000ee90
jbe 0x14000ee90
call 0x13fee1a7d
invalid
jmp case.0x14000bd9c.6
jns 0x14000ee9a
js 0x14000ee9a
call 0x14175f212
je 0x14000ee9f
jne 0x14000ee9f
call 0x1417ef222
jg 0x14000eea4
jle 0x14000eea4
call 0x1417cf225
jge 0x14000eea9
jl 0x14000eea9
call 0x1448c3712
and eax, 0x30
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x48]
lea rdx, [rsp + 0x12a0]
mov qword [rdx], rax
jns 0x14000eece
js 0x14000eece
call 0x1042e7c1a
cmp edi, edi
dec dword [rax - 0x77]
insb byte [rdi], dx
and al, 0x20
lea rbp, [0x140002a99]
mov qword [rsp + 0x20], rbp
lea rsi, [rsp + 0xa0]
lea r8, [rsp + 0xb88]
mov rcx, rsi
mov r9, r13
call fcn.14001116e
jb 0x14000eefa
jae 0x14000eefa
call 0x1487f7264
add byte [rdi + rdx + 0x7d], dh
add edi, dword [rcx + rax - 0x18]
cmp word [rsi + 8], 0
je 0x14000ef18
jge 0x14000ef06
jl 0x14000ef06
call 0xce167c52
cmp edi, edi
inc dword [rcx - 0x48]
invalid
lea rdx, [0x140002a9b]
mov r8d, 7
jmp 0x14000ee12
jl 0x14000ef1d
jge 0x14000ef1d
call 0x164bd7a69
movabs al, byte [0x9824948d48000000]
add byte [rax], al
add byte [rax - 0x77], cl
cmp dh, byte [rax + 3]
mov rdi, qword [rsp + 0xa0]
lea rdx, [rsp + 0x98]
mov qword [rdx], rdi
jo 0x14000ef35
jno 0x14000ef35
call 0x164b57c81
pop rax
invalid
lea rsi, [rsp + 0x658]
mov rcx, rsi
call fcn.140011236
cmp word [rsi + 0x48], 0
je 0x14000ef7f
jge 0x14000ef51
jl 0x14000ef51
call 0x18b167c9d
cmp edi, edi
inc dword [rcx - 0x48]
invalid
lea rdx, [0x140002aa3]
mov r8d, 7
mov rcx, rbx
call fcn.14000f956
mov esi, eax
jp 0x14000ef6d
jnp 0x14000ef6d
call 0x128fa78b9
invalid
mov rcx, rdi
call sub.ntdll.dll_NtClose
jns 0x14000ef7a
js 0x14000ef7a
call 0x13fff8d67
dec dword [rcx - 0x77]
invalid
jmp 0x14000ee1c
mov r15, rdi
jl 0x14000ef87
jge 0x14000ef87
call 0x164bd7cd3
add al, byte [rax]
add byte [rax - 0x73], cl
mov ah, 0x24
pop rax
invalid
lea rdi, [rsp + 0x240]
lea rsi, [rsp + 0x658]
mov ecx, 9
rep movsq qword [rdi], qword [rsi]
mov r8d, dword [rbx + 0x10c]
jl 0x14000efab
jge 0x14000efab
call 0x164b57cf7
pop rax
add eax, 0x89480000
int1
lea rsi, [rsp + 0x558]
mov rcx, rsi
mov rdx, r14
call fcn.140009400
movzx esi, word [rsi + 0x28]
test si, si
je 0x14000efe0
call 0x14000efcd
add al, ch
mov rcx, r15
call sub.ntdll.dll_NtClose
jnp 0x14000efdb
jp 0x14000efdb
call 0x1400807c8
add byte [rax + 3], bh
jmp 0x14000f6f7
js 0x14000efe5
jns 0x14000efe5
call 0x164857b31
js 0x14000eff0
mov rax, qword [rsp + 0x578]
add byte [rax], al
lea rcx, [rsp + 0xf0]
mov qword [rcx + 0x20], rax
movdqu xmm0, xmmword [rsp + 0x558]
and al, 0xf0
add byte [rax], al
add byte [rax - 0x77], cl
and r11b, sil
movq mm0, qword [rsp + 0x558]
movups xmm1, xmmword [rsp + 0x568]
movaps xmmword [rcx + 0x10], xmm1
movdqa xmmword [rcx], xmm0
mov qword [rsp + 0x80], rcx
jnp 0x14000f01f
jp 0x14000f01f
call 0x164957d6b
add qword [rax], rax
add byte [rcx - 0x48], al
add al, 0
add byte [rax], al
lea rdx, [rsp + 0x148]
mov r8d, 4
call fcn.140009477
test ax, ax
je 0x14000f062
mov esi, eax
jg 0x14000f03e
jle 0x14000f03e
call 0x1648d7d8a
lock add byte [rax], al
add al, ch
hlt
lea rcx, [rsp + 0xf0]
call fcn.14000993f
jnp 0x14000f050
jp 0x14000f050
call 0x128fa79a0
push 0x7c0002c3
add edi, dword [rbp + 1]
mov rcx, r15
call sub.ntdll.dll_NtClose
jl 0x14000f05d
jge 0x14000f05d
call 0x14007864a
add byte [rdx + 3], bh
jmp 0x14000f6f7
jp 0x14000f067
jnp 0x14000f067
call 0x1648d7db3
lock add byte [rax], al
add byte [rax - 0x73], cl
xchg esp, eax
and al, 0x88
or eax, dword [rax]
add byte [rbp - 0x77], cl
call 0x13fa4e966
jmp qword [rsi - 0x7b]
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0xb88]
mov r8, r13
call fcn.140009477
test ax, ax
je 0x14000f0af
mov esi, eax
jge 0x14000f08b
jl 0x14000f08b
call 0x1648d7dd7
lock add byte [rax], al
add al, ch
cmpsd dword [rsi], dword [rdi]
test al, 0xff
invalid
lea rcx, [rsp + 0xf0]
call fcn.14000993f
jp 0x14000f09d
jnp 0x14000f09d
call 0x128fa79ed
sbb eax, ebx
add al, byte [rax]
mov rcx, r15
call sub.ntdll.dll_NtClose
jo 0x14000f0aa
jno 0x14000f0aa
call 0x140073997
add al, ch
add dword [rax], eax
add byte [rax], al
jmp 0x14000f6f7
call 0x14000f0b5
add al, ch
lea rcx, [rsp + 0x80]
mov dl, 0x5c
call fcn.14000955b
test ax, ax
je 0x14000f0f5
mov esi, eax
jl 0x14000f0d1
jge 0x14000f0d1
call 0x1648d7e1d
lock add byte [rax], al
add al, ch
invalid
lea rcx, [rsp + 0xf0]
call fcn.14000993f
jne 0x14000f0e3
je 0x14000f0e3
call 0x128fa7a33
invalid
mov rcx, r15
call sub.ntdll.dll_NtClose
jo 0x14000f0f0
jno 0x14000f0f0
call 0x14006f3dd
add byte [rdi + 3], bh
jmp 0x14000f6f7
jg 0x14000f0fa
jle 0x14000f0fa
call 0xea167e46
cmp edi, edi
dec dword [rax - 0x73]
mov word [rax + rsi*8], fs
add byte [rax], al
add byte [rcx - 0x48], al
add al, byte [rax]
add byte [rax], al
lea rdx, [0x140002aab]
lea rcx, [rsp + 0xf0]
mov r8d, 2
call fcn.140009477
test ax, ax
je 0x14000f1f3
mov esi, eax
jns 0x14000f124
js 0x14000f124
call 0x1648d7e70
lock add byte [rax], al
add al, ch
invalid
lea rcx, [rsp + 0xf0]
call fcn.14000993f
jnp 0x14000f136
jp 0x14000f136
call 0x128fa7a86
invalid
mov rcx, r15
call sub.ntdll.dll_NtClose
jbe 0x14000f143
ja 0x14000f143
call 0x14006a130
add byte [rax - 0x75], cl
and al, 0x68
jmp 0x14000f6f7
mov rax, qword [rsp + 0x68]
lea rax, [rax + r13*2]
mov qword [rsp + 0x68], rax
sub qword [rsp + 0x78], r13
jne 0x14000f160
je 0x14000f160
call 0xe42575ef
adc al, byte [rax]
add byte [rbx + rbp*2 - 8], cl
sbb byte [rbp + 0x31], al
in eax, dx
mov eax, dword [rsp + 0x12a4]
imul r15, rax, 0x18
xor r13d, r13d
jne 0x14000f173
je 0x14000f173
call 0x1b4f02ac4
invalid
cmp r15, r13
je 0x14000f1d8
jl 0x14000f17d
jge 0x14000f17d
call 0xfcb800c3
sub al, 0xac
adc al, byte [rax]
add byte [rax - 0x7d], cl
call [rax]
movzx edi, word [rsp + r13 + 0x12ac]
cmp rdi, 0x18
jb 0x14000f1cd
jno 0x14000f191
jo 0x14000f191
call 0x16c857cd7
test al, 0x12
add byte [rax], al
mov eax, dword [rsp + r13 + 0x12a8]
lea rbp, [rsp + rax]
add rbp, 0x12a0
call 0x14000f1aa
add al, ch
mov edx, 0xc
mov r9d, 0xc
mov rcx, rbp
lea r8, [0x14000390e]
call fcn.1400110cd
test al, 1
jne 0x14000f24e
js 0x14000f1d2
jns 0x14000f1d2
call 0x158c6751f
add r13, 0x18
jmp 0x14000f16e
jp 0x14000f1dd
jnp 0x14000f1dd
call 0x128e27b2d
fcmovnb st(0), st(1)
add al, byte [rax]
mov rcx, r12
call sub.ntdll.dll_NtClose
ja 0x14000f1ea
jbe 0x14000f1ea
call 0x14009af54
mov bp, 8
jmp 0x14000eda0
jge 0x14000f1f8
jl 0x14000f1f8
call 0xef067f48
cmp bh, bh
dec dword [rax - 0x73]
mov word [rax + rax*4], fs
add byte [rax], al
lea r8, [0x140002aae]
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x240]
mov r9d, 1
add byte [rax], 0
add byte [rax - 0x73], cl
xchg esp, eax
and al, 0x40
add al, byte [rax]
add byte [rcx - 0x47], al
add dword [rax], eax
add byte [rax], al
call fcn.14001125c
test ax, ax
je 0x14000f369
mov esi, eax
jge 0x14000f22a
jl 0x14000f22a
call 0x1648d7f76
lock add byte [rax], al
add al, ch
or byte [rdi + 0x37dffff], ah
lea rcx, [rsp + 0xf0]
call fcn.14000993f
jge 0x14000f23c
jl 0x14000f23c
call 0x128fa7b8c
jl 0x14000f203
mov rcx, r15
call sub.ntdll.dll_NtClose
add al, byte [rax]
jl 0x14000f249
jge 0x14000f249
call 0x140059c36
add byte [rbx + rax + 0x75], dh
add eax, ebp
jmp 0x14000f6f7
je 0x14000f253
jne 0x14000f253
call 0x188f0c39f
mov eax, dword [rsp + 0x78]
shr rdi, 1
mov rax, qword [rsp + 0x78]
lea r13, [rdi + rax]
add r13, 0xfffffffffffffff4
cmp r13, 0x104
jbe 0x14000f289
call 0x14000f272
add al, ch
mov rcx, r12
call sub.ntdll.dll_NtClose
jbe 0x14000f280
ja 0x14000f280
call 0x1400cafea
mov bp, 0xb
jmp 0x14000eda0
lea r15, [rdi - 0xc]
jg 0x14000f292
jle 0x14000f292
call 0x158c675de
add rbp, 0x18
lea r8, [r15 + r15]
jb 0x14000f29f
jae 0x14000f29f
call 0x1648d7feb
pop rax
invalid
lea rcx, [rsp + 0x658]
mov rdx, rbp
call fcn.1400027aa
lea rax, [rsp + r15*2]
add rax, 0x658
xor ecx, ecx
jo 0x14000f2c0
jno 0x14000f2c0
call 0x1644d2c0c
js 0x14000f33a
cmp qword [rsp + 0x78], rcx
je 0x14000f2de
invalid
jne 0x14000f2cc
je 0x14000f2cc
call 0x164557e18
push 0x4a14b70f
mov rdx, qword [rsp + 0x68]
movzx edx, word [rdx + rcx*2]
mov word [rax + rcx*2], dx
inc rcx
jmp 0x14000f2bb
mov rax, qword [rsp + 0x78]
add rax, rdi
add rax, 0xfffffffffffffff4
xor ecx, ecx
jg 0x14000f2f1
jle 0x14000f2f1
call 0x14fc92c3d
test dl, cl
add byte [rax], al
add byte [rdi + 3], dh
cmp rax, rcx
je 0x14000f3c4
ja 0x14000f2ff
jbe 0x14000f2ff
call 0x18cbd7669
pop rax
invalid
cmp word [rsp + rcx*2 + 0x658], 0
lea rcx, [rcx + 1]
jne 0x14000f2ec
jns 0x14000f313
js 0x14000f313
call 0x128e27c63
movsd dword [rdi], dword [rsi]
rol byte [rdx], 0
mov rcx, r12
call sub.ntdll.dll_NtClose
jno 0x14000f320
jo 0x14000f320
call 0x1400eb08a
mov bp, 0xd
jmp 0x14000eda0
call 0x14000f32f
add al, ch
jmp 0x14000eb8b
call 0x14000f33b
add al, ch
jmp 0x14000eb8b
jb 0x14000f346
jae 0x14000f346
call 0x13ff93433
invalid
jmp 0x14000eb8b
jle 0x14000f350
jg 0x14000f350
call 0x13ff92a3d
invalid
jmp 0x14000eb8b
jp 0x14000f35a
jnp 0x14000f35a
call 0x13ff92047
push qword [rbx + rax + 0x75]
add eax, ebp
jmp 0x14000eb8b
je 0x14000f364
jne 0x14000f364
call 0x13ff91651
invalid
jmp 0x14000eb8b
jns 0x14000f36e
js 0x14000f36e
call 0x17b0680be
invalid
lea r8, [0x140002ab0]
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x240]
mov r9d, 2
call fcn.14001125c
test ax, ax
je 0x14000f429
mov esi, eax
jg 0x14000f3a0
jle 0x14000f3a0
call 0x1648d80ec
lock add byte [rax], al
add al, ch
xchg edx, eax
movsd dword [rdi], dword [rsi]
invalid
lea rcx, [rsp + 0xf0]
call fcn.14000993f
jbe 0x14000f3b2
ja 0x14000f3b2
call 0x128fa7d02
invalid
mov rcx, r15
call sub.ntdll.dll_NtClose
jp 0x14000f3bf
jnp 0x14000f3bf
call 0x1400427ac
add byte [rsi + 3], bh
jmp 0x14000f6f7
jle 0x14000f3c9
jg 0x14000f3c9
call 0x128e27d19
out dx, eax
mov edi, 0x3780002
mov rcx, r12
call sub.ntdll.dll_NtClose
js 0x14000f3d6
jns 0x14000f3d6
call 0x14172f74d
jae 0x14000f3db
jb 0x14000f3db
call 0x14170f750
jno 0x14000f3e0
jo 0x14000f3e0
call 0x1417bf75e
jp 0x14000f3e5
jnp 0x14000f3e5
call 0x1417cf766
jge 0x14000f3ea
jl 0x14000f3ea
call 0x1646d7d3a
and byte [rax - 0x73], cl
mov esp, 0x12a024
add byte [rax - 0x73], cl
xchg esp, eax
and al, 0x88
or eax, dword [rax]
add byte [rbp + rcx*4 - 0x74], cl
and al, 0x58
invalid
mov qword [rsp + 0x20], r13
lea rdi, [rsp + 0x12a0]
lea rdx, [rsp + 0xb88]
lea r9, [rsp + 0x658]
mov r8d, 0x30d
mov rcx, rdi
call fcn.140009197
jae 0x14000f41a
jb 0x14000f41a
call 0xcb4de14f
invalid
xor ebp, ebp
mov r13, qword [rdi]
mov r12, qword [rsp + 0x58]
jmp 0x14000edb6
je 0x14000f42e
jne 0x14000f42e
call 0x1417ef7b1
jg 0x14000f433
jle 0x14000f433
call 0x100f0039d
pxor xmm0, xmm0
lea rax, [rsp + 0x12a0]
movdqu xmmword [rax + 8], xmm0
mov qword [rax], r15
mov byte [rax + 0x418], 1
jbe 0x14000f453
ja 0x14000f453
call 0x1648d819f
enter 1, 0
lea rcx, [rsp + 0x1c8]
lea rdx, [rsp + 0x12a0]
call fcn.140011998
cmp word [rsp + 0x1e8], 0
jne 0x14000f696
jb 0x14000f47c
jae 0x14000f47c
call 0x12025b100
add dword [rax], eax
add byte [rax], al
cmp byte [rsp + 0x1e0], 0
je 0x14000f696
mov r13, qword [rsp + 0x1c8]
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x68], rax
jbe 0x14000f4a4
ja 0x14000f4a4
call 0x11825b128
add dword [rax], eax
add byte [rdx], al
cmp byte [rsp + 0x1d8], 2
jne 0x14000f540
jnp 0x14000f4b7
jp 0x14000f4b7
call 0x1646d7e03
and byte [rax - 0x73], cl
mov word [rax + rsi*4], fs
add byte [rax], al
add byte [rax - 0x73], cl
xchg esp, eax
and al, 0x98
add byte [rax], al
add byte [rbp - 0x77], cl
call 0x1644d801f
push 0x2870e8
add byte [rsi - 0x7d], ah
mov esp, 0xb824
add byte [rax], al
mov qword [rsp + 0x20], rbp
lea rcx, [rsp + 0xb0]
lea rdx, [rsp + 0x98]
mov r8, r13
mov r9, qword [rsp + 0x68]
call fcn.140011d49
cmp word [rsp + 0xb8], 0
jne 0x14000f68c
jp 0x14000f4ed
jnp 0x14000f4ed
call 0x164858039
mov al, 0
add byte [rax], al
mov rax, qword [rsp + 0xb0]
mov r12, rax
mov qword [rsp + 0xc0], rax
jbe 0x14000f505
ja 0x14000f505
call 0x1648d8251
add eax, dword [rax]
add byte [rax - 0x73], cl
xchg esp, eax
and al, 0xc0
add byte [rax], al
add al, ch
sbb al, 0x1d
add byte [rax], al
lea rcx, [rsp + 0x340]
lea rdx, [rsp + 0xc0]
call fcn.140011236
cmp word [rsp + 0x388], 0
je 0x14000f632
jae 0x14000f52e
jb 0x14000f52e
call 0x128e27e7e
mov bh, byte [rsi + 0x3760002]
mov rcx, r12
call sub.ntdll.dll_NtClose
jbe 0x14000f53b
ja 0x14000f53b
call fcn.140024228
add byte [rsi + 3], bh
jmp 0x14000f68c
jle 0x14000f545
jg 0x14000f545
call 0x14177f8bf
jbe 0x14000f54a
ja 0x14000f54a
call 0x1417ef8cd
jg 0x14000f54f
jle 0x14000f54f
call 0x1417af8ce
jnp 0x14000f554
jp 0x14000f554
call 0x164bd7ea4
loopne 0x14000f55a
mov qword [rsp + 0xe0], r15
add byte [rax], al
jo 0x14000f561
jno 0x14000f561
call 0x16e0682ad
invalid
lea rax, [0x140003596]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x198]
lea rdx, [rsp + 0xe0]
mov r8, r13
mov r9, qword [rsp + 0x68]
call fcn.140011bb0
movzx eax, word [rsp + 0x1a0]
test ax, ax
je 0x14000f5b8
jne 0x14000f59c
je 0x14000f59c
call 0x164857f06
mov eax, 0x77000008
add esi, dword [rsi + 1]
mov word [rsp + 0x8b8], ax
ja 0x14000f5a9
jbe 0x14000f5a9
call 0x14174f922
jne 0x14000f5ae
je 0x14000f5ae
call 0x14171f922
jo 0x14000f5b3
jno 0x14000f5b3
call fcn.14001caa0
add byte [rdx + 3], dh
jmp 0x14000f68c
jb 0x14000f5bd
jae 0x14000f5bd
call 0x164b58109
cwde
add dword [rax], eax
add byte [rax - 0x77], cl
mov ah, 0x24
rol byte [rax], 1
add byte [rax], al
mov rsi, qword [rsp + 0x198]
mov qword [rsp + 0xd0], rsi
ja 0x14000f5d2
jbe 0x14000f5d2
call 0x1648d831e
jo 0x14000f5e0
lea rcx, [rsp + 0x870]
add byte [rax], al
lea rdx, [rsp + 0xd0]
add byte [rax], al
call fcn.14001045c
jo 0x14000f5ec
jno 0x14000f5ec
call 0x128f27f38
int3
mov rcx, rsi
call sub.ntdll.dll_NtClose
jns 0x14000f5f9
js 0x14000f5f9
call 0x164bd7963
mov eax, 8
cmp word [rsp + 0x8b8], 0
jge 0x14000f607
jl 0x14000f607
call 0x1417cf988
jge 0x14000f60c
jl 0x14000f60c
call 0x14173f982
jb 0x14000f611
jae 0x14000f611
call 0x143756f8a
jne 0x14000f68c
je 0x14000f618
jne 0x14000f618
call fcn.14000ffd5
add byte [rax - 0x73], cl
mov esp, 0x24024
add byte [rax - 0x73], cl
mov ah, 0x24
jo 0x14000f633
mov ecx, 9
lea rdi, [rsp + 0x240]
lea rsi, [rsp + 0x870]
add byte [rax], al
rep movsq qword [rdi], qword [rsi]
jmp 0x14000f661
jb 0x14000f637
add esi, dword [rbx + 1]
jae 0x14000f637
call fcn.14000fff4
add byte [rax - 0x73], cl
mov esp, 0x24024
add byte [rax - 0x73], cl
mov ah, 0x24
add eax, dword [rax]
add bl, dh
movsq qword [rdi], qword [rsi]
mov ecx, 9
lea rdi, [rsp + 0x240]
lea rsi, [rsp + 0x340]
rep movsq qword [rdi], qword [rsi]
jl 0x14000f654
jge 0x14000f654
call 0x128e27fa4
mov ebp, 0x3720002
mov rcx, r12
call sub.ntdll.dll_NtClose
jb 0x14000f661
jae 0x14000f661
call 0x14176f9dc
ja 0x14000f666
jbe 0x14000f666
call 0x1648d83b2
add byte [rax], 0
add byte [rax - 0x73], cl
xchg esp, eax
and al, 0x40
add al, byte [rax]
add byte [rbp - 0x77], cl
call 0x1644d81c9
push 0x1bd9e8
add byte [rsi - 0x7b], ah
ror byte [rdi], 0x85
mov cl, 0
add byte [rax], al
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x240]
mov r8, r13
mov r9, qword [rsp + 0x68]
call fcn.14001125c
test ax, ax
jne 0x14000f73d
jg 0x14000f691
jle 0x14000f691
call 0x13ffeaf7e
push qword [rbx + rax + 0x75]
add eax, ebp
jmp 0x14000f44e
je 0x14000f69b
jne 0x14000f69b
call 0x14000f859
add al, dh
xadd dword [rbx + 0x198], edx
mov edx, 1
lock xadd dword [rbx + 0x198], edx
lea rdi, [rsp + 0xf0]
mov r9, qword [rdi]
mov rax, qword [rdi + 8]
jns 0x14000f6bc
js 0x14000f6bc
call 0x164458008
and byte [rax - 0x77], cl
fld dword [rcx - 0x48]
invalid
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov r8d, 0x16
call fcn.14000fa8e
mov esi, eax
call 0x14000f6d7
add al, ch
mov rcx, rdi
call fcn.14000993f
mov rcx, qword [rsp + 0x98]
jo 0x14000f6ed
jno 0x14000f6ed
call 0x142bdc5d9
add byte [rsi + 3], dh
call sub.ntdll.dll_NtClose
jbe 0x14000f6f7
ja 0x14000f6f7
call 0x1647d8247
invalid
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
jmp 0x14000ee1c
jo 0x14000f70b
jno 0x14000f70b
call 0x128f28057
fmul dword [rdx]
add byte [rax], al
mov rcx, rsi
call 0x1400101eb
lea rcx, [rbx + 0xb8]
jb 0x14000f71f
jae 0x14000f71f
call 0x1400bcb0b
add al, ch
add dword [rax], eax
add byte [rax], al
call 0x1400101f7
call 0x14000f72a
add al, ch
mov rcx, rbx
call fcn.140010280
jp 0x14000f738
jnp 0x14000f738
call 0x1400c7724
add byte [rcx + 0x710370c6], cl
add eax, ebp
call 0x1400102bc
mov esi, eax
jo 0x14000f744
jno 0x14000f744
call 0x1648d8490
lock add byte [rax], al
add al, ch
out dx, al
movabs eax, dword [0x4ce801780379ffff]
mov ecx, edi
lea rcx, [rsp + 0xf0]
call fcn.14000993f
jns 0x14000f756
js 0x14000f756
call 0x128fa80a6
invalid
mov rcx, r15
call sub.ntdll.dll_NtClose
ja 0x14000f763
jbe 0x14000f763
call 0x1437c8a52
jmp 0x14000f6f7
jnp 0x14000f76a
jp 0x14000f76a
call 0x14174fae3
jne case.0x14000d2c9.1
je case.0x14000d2c9.1
call 0x1417dfaef
jl 0x14000f774
jge 0x14000f774
call 0x14173faea
jb case.0x14000d643.1
jae case.0x14000d643.1
call 0x14170faee
jno 0x14000f77e
jo 0x14000f77e
call 0x1417dfafe
jl 0x14000f783
jge 0x14000f783
call 0x13fc71253
jmp rbx
int3