Function at 0x140005230
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi
Get thread local storage value
Set thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1198
call fcn.1400507d0
sub rsp, rax
mov r13, r8
mov rbp, rdx
mov qword [rsp + 0x68], rcx
lea rax, [0x1427f380d]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rcx, qword [rsp + 0x190]
movabs rax, 0xbc165e500e2f0204
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rdx, qword [rsp + 0x190]
call fcn.140036ac0
mov esi, dword [rax]
movzx edi, word [rax + 4]
movzx ebx, byte [rax + 6]
movzx eax, byte [0x142802108]
mov edx, 7
xor ecx, ecx
call fcn.1400259b0
test rax, rax
je 0x1400067e9
mov r12, rax
shl ebx, 0x10
or edi, ebx
mov eax, edi
shr eax, 0x10
xor al, 0x91
movzx eax, al
mov byte [r12 + 6], al
shl rax, 0x30
mov ecx, edi
shr ecx, 8
xor cl, 0x3e
movzx ecx, cl
shl rcx, 0x28
or rcx, rax
xor dil, 0x67
movzx eax, dil
shl rax, 0x20
or rax, rcx
xor esi, 0xeedcf681
mov dword [r12], esi
shr rax, 0x20
mov word [r12 + 4], ax
lea rax, [0x1427ef604]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rcx, qword [rsp + 0x190]
movabs rax, 0xe43b57907b2acd2e
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rdx, qword [rsp + 0x190]
call fcn.140036000
mov rsi, qword [rax]
movzx eax, byte [0x142802108]
mov edx, 8
xor ecx, ecx
call fcn.1400259b0
test rax, rax
je 0x1400067e9
mov r14, rax
movabs rax, 0x5379674c351d9d9b
xor rsi, rax
mov qword [r14], rsi
lea rax, [0x1427f4c60]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rcx, qword [rsp + 0x190]
movabs rax, 0xe05a4f30ff879259
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rdx, qword [rsp + 0x190]
call fcn.140036950
mov rsi, qword [rax]
movzx eax, byte [0x142802108]
mov edx, 8
xor ecx, ecx
call fcn.1400259b0
test rax, rax
je 0x1400067e9
mov r15, rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], r13
movabs rax, 0xb99a857858f2e889
xor rsi, rax
mov qword [r15], rsi
lea rax, [0x1427f1590]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rcx, qword [rsp + 0x190]
movabs rax, 0xafffddccda9fdcaa
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rdx, qword [rsp + 0x190]
call fcn.140035de0
mov esi, dword [rax]
movzx edi, word [rax + 4]
movzx ebx, byte [rax + 6]
movzx eax, byte [0x142802108]
mov edx, 7
xor ecx, ecx
call fcn.1400259b0
test rax, rax
je 0x1400067e9
mov r13, rax
mov qword [rsp + 0x78], r12
shl ebx, 0x10
or edi, ebx
mov eax, edi
shr eax, 0x10
xor al, 0xa7
movzx eax, al
mov byte [r13 + 6], al
shl rax, 0x30
mov ecx, edi
shr ecx, 8
xor cl, 0x74
movzx ecx, cl
shl rcx, 0x28
or rcx, rax
xor dil, 0xd5
movzx eax, dil
shl rax, 0x20
or rax, rcx
xor esi, 0x1144df25
mov dword [r13], esi
shr rax, 0x20
mov word [r13 + 4], ax
lea rax, [0x1427ef0db]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rcx, qword [rsp + 0x190]
movabs rax, 0x315877d5fd2829d6
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rdx, qword [rsp + 0x190]
call fcn.140036590
mov esi, dword [rax]
movzx ebx, byte [rax + 4]
movzx eax, byte [0x142802108]
mov edx, 5
xor ecx, ecx
call fcn.1400259b0
test rax, rax
je 0x1400067e9
mov rbp, rax
xor bl, 0x39
xor esi, 0xb0a75628
mov byte [rax + 4], bl
mov dword [rax], esi
lea rax, [0x1427f7a66]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rcx, qword [rsp + 0x190]
movabs rax, 0x42052d41c6d202de
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rdx, qword [rsp + 0x190]
call fcn.140036920
mov esi, dword [rax]
movzx eax, byte [0x142802108]
mov edx, 4
xor ecx, ecx
call fcn.1400259b0
test rax, rax
je 0x1400067e9
mov r12, rax
xor esi, 0xeced7aa0
mov dword [rax], esi
lea rax, [0x1427f4747]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rcx, qword [rsp + 0x190]
movabs rax, 0x930223cf646141c4
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rdx, qword [rsp + 0x190]
call fcn.140035da0
mov esi, dword [rax]
movzx edi, word [rax + 4]
movzx ebx, byte [rax + 6]
movzx eax, byte [0x142802108]
mov edx, 7
xor ecx, ecx
call fcn.1400259b0
test rax, rax
je 0x1400067e9
mov rdx, rax
shl ebx, 0x10
or edi, ebx
mov eax, edi
shr eax, 0x10
xor al, 0xf2
movzx eax, al
mov byte [rdx + 6], al
shl rax, 0x30
mov ecx, edi
shr ecx, 8
xor cl, 0x58
movzx ecx, cl
shl rcx, 0x28
or rcx, rax
xor dil, 0x51
movzx eax, dil
shl rax, 0x20
or rax, rcx
xor esi, 0x2070ac81
mov dword [rdx], esi
shr rax, 0x20
mov qword [rsp + 0x70], rdx
mov word [rdx + 4], ax
lea rax, [0x1427f28e2]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rcx, qword [rsp + 0x190]
movabs rax, 0x66d1a33ac320659e
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rdx, qword [rsp + 0x190]
call fcn.140036560
mov rsi, qword [rax]
movzx ebx, byte [rax + 8]
movzx eax, byte [0x142802108]
mov edx, 9
xor ecx, ecx
call fcn.1400259b0
test rax, rax
je 0x1400067e9
xor bl, 0x4f
movabs rcx, 0x1b34a472578c4d26
xor rsi, rcx
mov qword [rax], rsi
mov qword [rsp + 0x60], rax
mov byte [rax + 8], bl
lea rax, [0x1427f2fe2]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rcx, qword [rsp + 0x190]
movabs rax, 0xcf5bebcabe45433b
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rdx, qword [rsp + 0x190]
call fcn.140035f90
mov esi, dword [rax]
movzx edi, word [rax + 4]
movzx ebx, byte [rax + 6]
movzx eax, byte [0x142802108]
mov edx, 7
xor ecx, ecx
call fcn.1400259b0
test rax, rax
je 0x1400067e9
mov rdx, rax
shl ebx, 0x10
or edi, ebx
mov eax, edi
shr eax, 0x10
xor al, 0x66
movzx eax, al
mov byte [rdx + 6], al
shl rax, 0x30
mov ecx, edi
shr ecx, 8
xor cl, 0x35
movzx ecx, cl
shl rcx, 0x28
or rcx, rax
xor dil, 0x73
movzx eax, dil
shl rax, 0x20
or rax, rcx
xor esi, 0xacb1326d
mov dword [rdx], esi
shr rax, 0x20
mov qword [rsp + 0x58], rdx
mov word [rdx + 4], ax
lea rax, [0x1427ee2b5]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rcx, qword [rsp + 0x190]
movabs rax, 0xbb2e386589dc5cff
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rdx, qword [rsp + 0x190]
call fcn.140035ef0
mov rsi, qword [rax]
movzx ebx, byte [rax + 8]
movzx eax, byte [0x142802108]
mov edx, 9
xor ecx, ecx
call fcn.1400259b0
test rax, rax
je 0x1400067e9
mov rdi, rax
xor bl, 0x33
movabs rax, 0x10465166849fbc2b
xor rsi, rax
mov qword [rdi], rsi
mov byte [rdi + 8], bl
lea rax, [0x1427ea392]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rcx, qword [rsp + 0x190]
movabs rax, 0x151073579532631b
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rdx, qword [rsp + 0x190]
call fcn.1400369f0
mov esi, dword [rax]
movzx ebx, byte [rax + 4]
movzx eax, byte [0x142802108]
mov edx, 5
xor ecx, ecx
call fcn.1400259b0
test rax, rax
je 0x1400067e9
mov qword [rsp + 0x50], rdi
xor bl, 0xb5
xor esi, 0x59dcba5e
mov byte [rax + 4], bl
mov qword [rsp + 0x48], rax
mov dword [rax], esi
lea rax, [0x1427ef4c8]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rcx, qword [rsp + 0x190]
movabs rax, 0x89e33f529a6558b6
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rdx, qword [rsp + 0x190]
call fcn.140036390
mov rsi, qword [rax]
movzx eax, byte [0x142802108]
mov edx, 8
xor ecx, ecx
call fcn.1400259b0
test rax, rax
je 0x1400067e9
mov rbx, rax
mov qword [rsp + 0x40], r12
movabs rax, 0xd6d4b13f300cdf2b
xor rsi, rax
mov qword [rbx], rsi
lea rax, [0x1427f38a3]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rcx, qword [rsp + 0x190]
movabs rax, 0x687df196b30d7b71
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rdx, qword [rsp + 0x190]
call fcn.140036260
mov esi, dword [rax]
movzx edi, word [rax + 4]
movzx eax, byte [0x142802108]
mov edx, 6
xor ecx, ecx
call fcn.1400259b0
test rax, rax
je 0x1400067e9
mov ecx, edi
shr ecx, 8
xor cl, 0xa2
movzx edx, cl
shl rdx, 0x28
xor dil, 0x54
movzx ecx, dil
shl rcx, 0x20
or rcx, rdx
xor esi, 0xb2df9838
mov dword [rax], esi
shr rcx, 0x20
mov word [rax + 4], cx
movzx ecx, byte [0x142802108]
mov edx, 0xd0
xor ecx, ecx
mov rsi, rax
call fcn.1400259b0
test rax, rax
je 0x1400067e9
mov r12, rax
mov rax, qword [rsp + 0x78]
mov qword [r12], rax
mov qword [r12 + 8], 7
mov qword [r12 + 0x10], r14
mov qword [r12 + 0x18], 8
mov qword [r12 + 0x20], r15
mov qword [r12 + 0x28], 8
mov qword [r12 + 0x30], r13
mov qword [r12 + 0x38], 7
mov qword [r12 + 0x40], rbp
mov qword [r12 + 0x48], 5
mov rax, qword [rsp + 0x40]
mov qword [r12 + 0x50], rax
mov qword [r12 + 0x58], 4
mov rax, qword [rsp + 0x70]
mov qword [r12 + 0x60], rax
mov qword [r12 + 0x68], 7
mov rax, qword [rsp + 0x60]
mov qword [r12 + 0x70], rax
mov qword [r12 + 0x78], 9
mov rax, qword [rsp + 0x58]
mov qword [r12 + 0x80], rax
mov qword [r12 + 0x88], 7
mov rax, qword [rsp + 0x50]
mov qword [r12 + 0x90], rax
mov qword [r12 + 0x98], 9
mov rax, qword [rsp + 0x48]
mov qword [r12 + 0xa0], rax
mov qword [r12 + 0xa8], 5
mov qword [r12 + 0xb0], rbx
mov qword [r12 + 0xb8], 8
mov qword [rsp + 0x128], rsi
mov qword [r12 + 0xc0], rsi
mov qword [r12 + 0xc8], 6
mov ecx, dword [0x140057040]
test ecx, ecx
je 0x140005bc9
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
cmp rax, 1
ja 0x140005dd7
je 0x1400067e9
xorps xmm0, xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
lea rdx, [rsp + 0xc0]
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x140005b61
mov esi, eax
lea rcx, [rsp + 0xc0]
mov edx, 0x20
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140005b61
and esi, 0x7fffffff
jne 0x1400067d1
movaps xmm0, xmmword [rsp + 0xc0]
movaps xmm1, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x90], xmm1
movaps xmmword [rsp + 0x80], xmm0
mov rax, qword [0x142802100]
test rax, rax
je 0x140005bee
lea rsi, [rsp + 0x1a0]
test eax, 0x4000
jne 0x140005c02
movaps xmm0, xmmword [rsp + 0x80]
movaps xmm1, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x1a0], xmm0
movaps xmmword [rsp + 0x1b0], xmm1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1c0], xmm0
jmp 0x140005c19
lea rcx, [0x140057028]
call fcn.140027d80
mov ecx, eax
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
cmp rax, 1
jbe 0x140005b02
jmp 0x140005dd7
call fcn.140035740
lea rsi, [rsp + 0x1a0]
test eax, 0x4000
je 0x140005b9c
lea r8, [0x1427fcab0]
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.14001e730
movaps xmm0, xmmword [rsi]
movaps xmm1, xmmword [rsi + 0x10]
movaps xmm2, xmmword [rsi + 0x20]
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x90], xmm1
movaps xmmword [rsp + 0xa0], xmm2
movups xmmword [rsp + 0x198], xmm0
movups xmmword [rsp + 0x1a8], xmm1
movups xmmword [rsp + 0x1b8], xmm2
movzx eax, byte [0x142802108]
mov edx, 0x170
xor ecx, ecx
call fcn.1400259b0
test rax, rax
je 0x1400067e9
mov rsi, rax
mov qword [rax], 1
mov qword [rax + 8], 1
xorps xmm0, xmm0
movaps xmmword [rax + 0x10], xmm0
movaps xmmword [rax + 0x20], xmm0
movaps xmmword [rax + 0x30], xmm0
movaps xmmword [rax + 0x40], xmm0
movaps xmmword [rax + 0x50], xmm0
movaps xmmword [rax + 0x60], xmm0
movaps xmmword [rax + 0x70], xmm0
movaps xmmword [rax + 0x80], xmm0
movaps xmmword [rax + 0x90], xmm0
movaps xmmword [rax + 0xa0], xmm0
movaps xmmword [rax + 0xb0], xmm0
movaps xmmword [rax + 0xc0], xmm0
movaps xmmword [rax + 0xd0], xmm0
movaps xmmword [rax + 0xe0], xmm0
movaps xmmword [rax + 0xf0], xmm0
movaps xmmword [rax + 0x100], xmm0
mov qword [rax + 0x110], 0x40
movups xmm0, xmmword [rsp + 0x190]
movups xmm1, xmmword [rsp + 0x1a0]
movups xmm2, xmmword [rsp + 0x1b0]
movups xmmword [rax + 0x118], xmm0
movups xmmword [rax + 0x128], xmm1
movups xmmword [rax + 0x138], xmm2
mov rax, qword [rsp + 0x1c0]
mov qword [rsi + 0x148], rax
mov qword [rsi + 0x150], 0x10000
mov qword [rsi + 0x158], 0x10000
mov qword [rsi + 0x160], 0
movzx eax, byte [0x142802108]
mov edx, 0x10
xor ecx, ecx
call fcn.1400259b0
test rax, rax
je 0x1400067e9
mov rdi, rax
mov qword [rax], rsi
lea rax, [0x140057028]
mov qword [rdi + 8], rax
mov ecx, dword [0x140057040]
test ecx, ecx
je 0x140006739
dec ecx
call sub.KERNEL32.dll_TlsGetValue
mov rsi, rax
mov ecx, dword [0x140057040]
test ecx, ecx
je 0x14000674c
dec ecx
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
test rsi, rsi
je 0x140005dd7
mov r8, qword [rsi]
dec qword [r8]
jne 0x140005dc6
dec qword [r8 + 8]
jne 0x140005dc6
mov rcx, qword [0x142802058]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142802058]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov qword [rsp + 0x120], rbx
mov rbx, qword [rdi]
inc qword [rbx]
je 0x1400067e9
mov rax, qword [rbx + 0x110]
cmp rax, 0x40
jb 0x140005e34
lea rdx, [rbx + 0x10]
lea rcx, [rbx + 0x120]
mov rax, qword [rbx + 0x158]
test rax, rax
jle 0x140005e2d
cmp qword [rbx + 0x160], 0
js 0x140005e2d
add rax, 0xffffffffffffff00
mov qword [rbx + 0x158], rax
call fcn.14001c490
jmp 0x140005e32
call fcn.14003d010
xor eax, eax
mov qword [rsp + 0x118], r14
lea rcx, [rax + 1]
cmp dword [rbx + rax*4 + 0x10], 0
mov qword [rbx + 0x110], rcx
mov qword [rsp + 0x110], r13
mov qword [rsp + 0x108], rbp
js 0x140005ef6
lea rax, [0x1427ebb26]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rcx, qword [rsp + 0x190]
movabs rax, 0x1c79b98027d0fc62
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rdx, qword [rsp + 0x190]
call fcn.1400364d0
mov r14, qword [rax]
mov rsi, qword [rax + 8]
movzx eax, byte [0x142802108]
mov edi, 0x10
mov edx, 0x10
xor ecx, ecx
call fcn.1400259b0
test rax, rax
je 0x1400067e9
movabs rcx, 0xb6a4a13fba5dbc32
xor rsi, rcx
movabs rcx, 0x8b8fad639fcaec24
xor r14, rcx
mov qword [rax], r14
mov qword [rax + 8], rsi
jmp 0x140005fb4
mov r13, r15
lea rax, [0x1427ea00b]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rcx, qword [rsp + 0x190]
movabs rax, 0x36811ad0d7f787b0
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rdx, qword [rsp + 0x190]
call fcn.140035e50
mov r14, qword [rax]
mov ebp, dword [rax + 8]
movzx esi, word [rax + 0xc]
movzx r15d, byte [rax + 0xe]
movzx eax, byte [0x142802108]
mov edi, 0xf
mov edx, 0xf
xor ecx, ecx
call fcn.1400259b0
test rax, rax
je 0x1400067e9
shl r15d, 0x10
or esi, r15d
mov r8d, esi
shr r8d, 0x10
xor r8b, 0x5b
mov ecx, esi
shr ecx, 8
xor cl, 0xa6
xor sil, 0xfa
xor ebp, 0x2d08430e
movabs rdx, 0xad346afb4a81e2f4
xor r14, rdx
mov qword [rax], r14
mov dword [rax + 8], ebp
mov byte [rax + 0xc], sil
mov byte [rax + 0xd], cl
mov byte [rax + 0xe], r8b
mov r15, r13
mov r14, rax
lea rsi, [rsp + 0x178]
mov r9d, 0xd
mov rcx, rsi
mov rdx, rbx
mov r8, r12
call fcn.140004e80
lea rcx, [rsp + 0x160]
mov r9d, 0xd
mov rdx, rbx
mov r8, r12
call fcn.140004e80
lea rcx, [rsp + 0x130]
mov rdx, r14
mov r8, rdi
mov r9, rsi
call fcn.14003cb10
mov byte [rsp + 0x190], 1
mov rsi, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x140]
lea rcx, [rsp + 0x190]
mov rdx, rsi
mov r8, rdi
call fcn.140028030
test rax, rax
jne 0x1400067e9
lea rcx, [rsp + 0xc0]
lea r9, [rsp + 0x160]
mov rdx, rsi
mov r8, rdi
call fcn.14003cb10
mov byte [rsp + 0x190], 1
mov rdi, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xd0]
lea rcx, [rsp + 0x190]
mov rdx, rdi
mov r8, rsi
call fcn.140028030
test rax, rax
jne 0x1400067e9
mov qword [rsp + 0xf8], r14
test rsi, rsi
mov qword [rsp + 0x100], r15
je 0x1400060c2
js 0x1400067e9
movzx eax, byte [0x142802108]
xor ecx, ecx
mov rdx, rsi
call fcn.1400259b0
test rax, rax
je 0x1400067e9
mov r14, rax
mov r15, rsi
jmp 0x1400060cb
mov r14d, 1
xor r15d, r15d
mov rcx, r14
mov rdx, rdi
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x190], r15
mov qword [rsp + 0x198], r14
mov qword [rsp + 0x1a0], rsi
mov byte [rsp + 0x1a8], 0
lea rcx, [rsp + 0x190]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x28]
call fcn.1400330d0
mov rdi, qword [rsp + 0x190]
mov r14, qword [rsp + 0x198]
mov rbp, qword [rsp + 0x1a0]
mov dword [rsp + 0x190], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x198], xmm0
mov dword [rsp + 0x1a8], 7
mov qword [rsp + 0x1ac], 0
mov word [rsp + 0x1b4], 0
mov byte [rsp + 0x1b1], 1
mov byte [rsp + 0x1b4], 1
mov byte [rsp + 0x1b3], 1
lea r8, [rsp + 0x190]
mov rcx, r14
mov rdx, rbp
call fcn.14002bc10
test rax, rax
jne 0x1400067e9
mov rsi, rdx
movabs r15, 0x8000000000000000
mov qword [rsp + 0x38], rdx
mov rax, qword [rsp + 0x68]
cmp qword [rax], r15
je 0x140006770
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
lea rcx, [rsp + 0x38]
call fcn.14003d160
test rax, rax
jne 0x1400067e9
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x190]
mov rdx, rsi
call fcn.14002be90
cmp dword [rsp + 0x190], 2
je 0x1400067e9
mov rdi, qword [rsp + 0x1c8]
mov r13, qword [rsp + 0x38]
cmp rdi, 0x2bbfffff
mov qword [rsp + 0x28], r14
ja 0x1400062ab
mov qword [rsp + 0x190], 0
lea r8, [rsp + 0x190]
mov rcx, r13
xor edx, edx
mov r9d, 2
call sub.KERNEL32.dll_SetFilePointerEx
test eax, eax
je 0x1400067ca
lea rsi, [rsp + 0x190]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov r15d, 0x2bc00000
sub r15, rdi
lea r14, [rsp + 0x38]
nop word cs:[rax + rax]
cmp r15, 0x1000
mov edi, 0x1000
cmovb rdi, r15
mov rcx, r14
mov rdx, rsi
mov r8, rdi
call fcn.14003d160
test rax, rax
jne 0x1400067e9
sub r15, rdi
jne 0x140006270
mov r14, qword [rsp + 0x28]
movabs r15, 0x8000000000000000
mov rcx, r13
call sub.KERNEL32.dll_CloseHandle
test rbp, rbp
je 0x14000630b
js 0x1400067e9
movzx eax, byte [0x142802108]
xor ecx, ecx
mov rdx, rbp
call fcn.1400259b0
test rax, rax
je 0x1400067e9
mov r13, rax
mov rcx, rax
mov rdx, r14
mov r8, rbp
call sub.msvcrt.dll_memcpy
movzx eax, byte [0x142802108]
xor ecx, ecx
mov rdx, rbp
call fcn.1400259b0
test rax, rax
je 0x1400067e9
mov rsi, rax
mov rdi, rbp
jmp 0x140006328
mov r13d, 1
mov ecx, 1
mov rdx, r14
mov r8, rbp
call sub.msvcrt.dll_memcpy
xor edi, edi
mov esi, 1
mov rcx, rsi
mov rdx, r13
mov r8, rbp
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x190], rdi
mov qword [rsp + 0x198], rsi
mov qword [rsp + 0x1a0], rbp
mov byte [rsp + 0x1a8], 0
mov qword [rsp + 0x1b0], 0
mov qword [rsp + 0x1b8], 8
mov qword [rsp + 0x1c0], 0
mov qword [rsp + 0x218], 0
mov qword [rsp + 0x228], 0
mov word [rsp + 0x230], 0
mov qword [rsp + 0x1c8], r15
mov dword [rsp + 0x250], 0
mov word [rsp + 0x254], 0
mov dword [rsp + 0x1e8], 6
mov dword [rsp + 0x1f8], 6
mov dword [rsp + 0x208], 6
mov qword [rsp + 0x238], 0
mov qword [rsp + 0x248], 0
test rbp, rbp
je 0x140006408
mov rcx, qword [0x142802058]
xor edx, edx
mov r8, r13
call sub.KERNEL32.dll_HeapFree
mov dword [rsp + 0x250], 0x8000000
mov dword [rsp + 0x150], 0
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x190]
lea r8, [rsp + 0x150]
call fcn.14002d8d0
mov rsi, qword [rsp + 0x80]
mov r13, qword [rsp + 0x90]
cmp r13, 2
jne 0x140006456
mov r14, rsi
jmp 0x1400064a0
mov rbp, qword [rsp + 0x88]
mov r14, qword [rsp + 0x98]
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0xf0], rax
cmp qword [rsp + 0xa0], 0
sete r15b
cmp qword [rsp + 0xb0], 0
sete dil
lea rax, [0x1427eff76]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x80]
movabs rax, 0xb681732d18fd6a06
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x80]
mov rdx, qword [rsp + 0x80]
call fcn.140036230
mov rcx, qword [rax]
mov rcx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
movzx eax, word [rax + 0x18]
cmp r13d, 2
je 0x1400067e9
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
mov rcx, rbp
call sub.KERNEL32.dll_CloseHandle
test r13, r13
je 0x14000651c
mov rcx, r14
call sub.KERNEL32.dll_CloseHandle
test r15b, 1
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x100]
mov r15, qword [rsp + 0x110]
mov r13, qword [rsp + 0x108]
jne 0x14000654c
mov rcx, qword [rsp + 0xe8]
call sub.KERNEL32.dll_CloseHandle
test dil, 1
mov rdi, qword [rsp + 0x118]
jne 0x140006567
mov rcx, qword [rsp + 0xf0]
call sub.KERNEL32.dll_CloseHandle
lea rcx, [rsp + 0x190]
call fcn.140001450
mov rax, qword [rsp + 0x68]
cmp qword [rax], 0
je 0x140006591
mov r8, qword [rax + 8]
mov rcx, qword [0x142802058]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x30], 0
je 0x1400065ac
mov rcx, qword [0x142802058]
xor edx, edx
mov r8, qword [rsp + 0x28]
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0xc0], 0
je 0x1400065cd
mov r8, qword [rsp + 0xc8]
mov rcx, qword [0x142802058]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x130], 0
je 0x1400065ee
mov r8, qword [rsp + 0x138]
mov rcx, qword [0x142802058]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142802058]
xor edx, edx
mov r8, qword [rsp + 0xf8]
call sub.KERNEL32.dll_HeapFree
dec qword [rbx]
jne 0x140006620
dec qword [rbx + 8]
jne 0x140006620
mov rcx, qword [0x142802058]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142802058]
xor edx, edx
mov r8, r12
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142802058]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142802058]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142802058]
xor edx, edx
mov r8, r14
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142802058]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142802058]
xor edx, edx
mov r8, r13
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142802058]
xor edx, edx
mov r8, qword [rsp + 0x40]
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142802058]
xor edx, edx
mov r8, qword [rsp + 0x70]
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142802058]
xor edx, edx
mov r8, qword [rsp + 0x60]
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142802058]
xor edx, edx
mov r8, qword [rsp + 0x58]
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142802058]
xor edx, edx
mov r8, qword [rsp + 0x50]
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142802058]
xor edx, edx
mov r8, qword [rsp + 0x48]
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142802058]
xor edx, edx
mov r8, qword [rsp + 0x120]
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x142802058]
xor edx, edx
mov r8, qword [rsp + 0x128]
call sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x1198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140057028]
call fcn.140027d80
mov ecx, eax
jmp 0x140005d85
lea rcx, [0x140057028]
call fcn.140027d80
mov ecx, eax
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
test rsi, rsi
jne 0x140005daa
jmp 0x140005dd7
lea rax, [0x1427f1a0d]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rcx, qword [rsp + 0x190]
movabs rax, 0x5e82a50c27c431eb
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x190]
mov rdx, qword [rsp + 0x190]
call fcn.140036870
mov rcx, qword [rax]
mov rcx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov ecx, dword [rax + 0x18]
movzx eax, word [rax + 0x1c]
ud2
call sub.KERNEL32.dll_GetLastError
ud2
movzx eax, byte [0x142802108]
mov edx, 4
xor ecx, ecx
call fcn.1400259b0
test rax, rax
jne 0x1400067eb
ud2
mov dword [rax], esi
ud2