Function at 0x140074fe0
Capabilities:
Accept command line arguments
Access peb ldr_data
Check http status code
Check os version
Encode data using base64
Encode data using xor
Encrypt data using dpapi
Encrypt data using rc4 ksa
Generate random numbers using the delphi lcg
Get hostname
Get session user name
Hash data with crc32
Inspect section memory permissions
Load assembly via iassembly
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x21b8
call fcn.14026d4d0
sub rsp, rax
movdqa xmmword [rsp + 0x21a0], xmm15
movdqa xmmword [rsp + 0x2190], xmm14
movdqa xmmword [rsp + 0x2180], xmm13
movdqa xmmword [rsp + 0x2170], xmm12
movdqa xmmword [rsp + 0x2160], xmm11
movdqa xmmword [rsp + 0x2150], xmm10
movdqa xmmword [rsp + 0x2140], xmm9
movdqa xmmword [rsp + 0x2130], xmm8
movdqa xmmword [rsp + 0x2120], xmm7
movdqa xmmword [rsp + 0x2110], xmm6
call qword [sym.imp.kernel32.dll_GetCommandLineW]
mov qword [rsp + 0x12a0], 0
mov qword [rsp + 0x12a8], 8
mov qword [rsp + 0x12b0], 0
test rax, rax
je 0x140075604
movzx ebx, word [rax]
test bx, bx
je 0x140075604
mov qword [rsp + 0xe70], 0
mov qword [rsp + 0xe78], 2
mov qword [rsp + 0xe80], 0
add rax, 2
mov ecx, 2
xor r8d, r8d
lea rsi, [rsp + 0xe70]
xor edi, edi
jmp 0x140075107
mov word [rcx + r8*2], bx
mov r8, qword [rsp + 0xe80]
inc r8
mov qword [rsp + 0xe80], r8
movzx ebx, word [r12]
lea rax, [r12 + 2]
test bx, bx
je 0x140075174
mov r12, rax
cmp bx, 9
je 0x140075140
movzx eax, bx
cmp eax, 0x20
je 0x140075140
cmp eax, 0x22
jne 0x140075146
not dil
and dil, 1
movzx ebx, word [r12]
lea rax, [r12 + 2]
test bx, bx
jne 0x140075107
jmp 0x140075174
test dil, 1
je 0x140075174
cmp r8, qword [rsp + 0xe70]
jne 0x1400750e0
mov rcx, rsi
mov rdx, r8
call fcn.1401f3760
mov rcx, qword [rsp + 0xe78]
mov r8, qword [rsp + 0xe80]
jmp 0x1400750e0
add r12, 2
movzx eax, word [r12]
cmp eax, 0x20
je 0x140075170
cmp eax, 9
je 0x140075170
mov rdx, qword [rsp + 0xe78]
lea rcx, [rsp + 0x270]
call fcn.1401ef1a0
mov rdx, qword [rsp + 0x12b0]
cmp rdx, qword [rsp + 0x12a0]
jne 0x1400751bf
lea rcx, [rsp + 0x12a0]
call fcn.1400c5ba0
mov rdx, qword [rsp + 0x12b0]
mov rax, qword [rsp + 0x12a8]
mov rcx, rdx
shl rcx, 5
movdqu xmm0, xmmword [rsp + 0x270]
movdqu xmm1, xmmword [rsp + 0x280]
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmmword [rax + rcx], xmm0
inc rdx
mov qword [rsp + 0x12b0], rdx
mov qword [rsp + 0x910], 0
mov qword [rsp + 0x918], 2
mov qword [rsp + 0x920], 0
movzx r15d, word [r12]
test r15w, r15w
je 0x140075772
mov r14d, 2
xor r8d, r8d
lea rsi, [rsp + 0x270]
lea rdi, [rsp + 0x12a0]
lea rbx, [rsp + 0x910]
movdqa xmm6, xmmword [0x14027ce40]
xor ebp, ebp
jmp 0x14007528a
mov r14, qword [rsp + 0x918]
mov word [r14 + r8*2], r15w
inc r8
mov qword [rsp + 0x920], r8
movzx r15d, word [r13]
mov r12, r13
test r15w, r15w
je 0x140075777
lea r13, [r12 + 2]
movzx eax, r15w
cmp eax, 0x21
jg 0x140075350
cmp eax, 9
je 0x1400752aa
cmp eax, 0x20
jne 0x1400753d0
test bpl, 1
jne 0x1400753d0
mov r14, qword [rsp + 0x918]
mov rcx, rsi
mov rdx, r14
call fcn.1401ef1a0
mov rdx, qword [rsp + 0x12b0]
cmp rdx, qword [rsp + 0x12a0]
jne 0x1400752e9
mov rcx, rdi
call fcn.1400c5ba0
mov rdx, qword [rsp + 0x12b0]
mov rax, qword [rsp + 0x12a8]
mov rcx, rdx
shl rcx, 5
movdqu xmm0, xmmword [rsp + 0x270]
movdqu xmm1, xmmword [rsp + 0x280]
movdqu xmmword [rax + rcx + 0x10], xmm1
movdqu xmmword [rax + rcx], xmm0
inc rdx
mov qword [rsp + 0x12b0], rdx
mov qword [rsp + 0x920], 0
jmp 0x140075334
add r13, 2
movzx r15d, word [r13]
cmp r15d, 0x20
je 0x140075330
cmp r15d, 9
je 0x140075330
xor r8d, r8d
jmp 0x14007527d
cmp eax, 0x22
je 0x1400753f6
cmp eax, 0x5c
jne 0x1400753d0
movzx eax, word [r13]
xor r15d, r15d
cmp ax, 0x5c
jne 0x140075383
nop dword [rax]
add r13, 2
movzx eax, word [r12 + r15*2 + 4]
inc r15
cmp ax, 0x5c
je 0x140075370
inc r15
cmp ax, 0x22
jne 0x140075408
mov r12, r15
shr r12, 1
mov rax, qword [rsp + 0x910]
sub rax, r8
cmp rax, r12
jb 0x1400754fb
cmp r15, 2
jb 0x14007557f
mov r14, qword [rsp + 0x918]
cmp r15, 0x20
jae 0x140075523
mov rax, r12
jmp 0x140075570
cmp r8, qword [rsp + 0x910]
jne 0x140075260
mov rcx, rbx
mov rdx, r8
call fcn.1401f3760
mov r8, qword [rsp + 0x920]
jmp 0x140075260
test bpl, 1
jne 0x140075494
mov bpl, 1
jmp 0x140075278
mov rax, qword [rsp + 0x910]
sub rax, r8
cmp rax, r15
jb 0x1400755d7
test r15, r15
je 0x140075270
cmp r15, 0x10
jb 0x140075480
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov eax, r15d
and eax, 0xf
lea rdx, [r14 + r8*2]
add rdx, 0x10
add r8, rcx
xor r9d, r9d
nop word cs:[rax + rax]
movdqu xmmword [rdx + r9*2 - 0x10], xmm6
movdqu xmmword [rdx + r9*2], xmm6
add r9, 0x10
cmp rcx, r9
jne 0x140075450
cmp r15, rcx
je 0x140075270
mov r15, rax
nop word cs:[rax + rax]
mov word [r14 + r8*2], 0x5c
inc r8
dec r15
jne 0x140075480
jmp 0x140075270
movzx r15d, word [r13]
cmp r15d, 0x22
je 0x1400754af
test r15d, r15d
je 0x140075777
xor ebp, ebp
jmp 0x14007527d
cmp r8, qword [rsp + 0x910]
jne 0x1400754cc
mov rcx, rbx
mov rdx, r8
call fcn.1401f3760
mov r8, qword [rsp + 0x920]
mov r14, qword [rsp + 0x918]
mov word [r14 + r8*2], 0x22
inc r8
mov qword [rsp + 0x920], r8
lea rax, [r12 + 4]
cmp word [r12 + 2], 0
cmovne r13, rax
jmp 0x140075278
mov rcx, rbx
mov rdx, r8
mov r8, r12
call fcn.14027b150
mov r8, qword [rsp + 0x920]
mov r14, qword [rsp + 0x918]
cmp r15, 0x20
jb 0x1400753c2
movabs rax, 0x8000000000000000
lea rcx, [rax - 0x10]
and rcx, r12
mov eax, r12d
and eax, 0xf
lea rdx, [r14 + r8*2]
add rdx, 0x10
add r8, rcx
xor r9d, r9d
nop dword [rax + rax]
movdqu xmmword [rdx + r9*2 - 0x10], xmm6
movdqu xmmword [rdx + r9*2], xmm6
add r9, 0x10
cmp rcx, r9
jne 0x140075550
cmp r12, rcx
je 0x14007557f
nop dword [rax + rax]
mov word [r14 + r8*2], 0x5c
inc r8
dec rax
jne 0x140075570
mov qword [rsp + 0x920], r8
test r15b, 1
je 0x140075278
xor r14d, r14d
cmp word [r13], 0
setne r15b
cmp r8, qword [rsp + 0x910]
jne 0x1400755bb
mov rcx, rbx
mov rdx, r8
call fcn.1401f3760
mov r8, qword [rsp + 0x920]
mov r14b, r15b
lea r13, [r13 + r14*2]
mov r14, qword [rsp + 0x918]
mov word [r14 + r8*2], 0x22
jmp 0x14007526d
mov rcx, rbx
mov rdx, r8
mov r8, r15
call fcn.14027b150
mov r14, qword [rsp + 0x918]
mov r8, qword [rsp + 0x920]
cmp r15, 0x10
jb 0x140075480
jmp 0x14007542b
lea rcx, [rsp + 0x270]
call fcn.1401f2610
mov rdi, qword [rsp + 0x270]
movabs rax, 0x8000000000000000
cmp rdi, rax
jne 0x140075653
mov rax, qword [rsp + 0x278]
mov ecx, eax
and ecx, 3
mov sil, 1
mov r14d, 1
xor edi, edi
lea rdx, [rcx - 2]
cmp rdx, 2
jae 0x1400756ec
xor r15d, r15d
jmp 0x140075687
mov r14, qword [rsp + 0x278]
mov r15, qword [rsp + 0x280]
movzx esi, byte [rsp + 0x288]
mov eax, dword [rsp + 0x289]
mov dword [rsp + 0x910], eax
mov eax, dword [rsp + 0x28c]
mov dword [rsp + 0x913], eax
xor ebp, ebp
lea rcx, [rsp + 0x12a0]
mov rdx, rbp
call fcn.1400c5ba0
mov rbp, qword [rsp + 0x12a0]
mov rbx, qword [rsp + 0x12b0]
mov rcx, qword [rsp + 0x12a8]
mov rax, rbx
shl rax, 5
mov qword [rcx + rax], rdi
mov qword [rcx + rax + 8], r14
mov qword [rcx + rax + 0x10], r15
mov byte [rcx + rax + 0x18], sil
mov rsi, rcx
mov ecx, dword [rsp + 0x910]
mov edx, dword [rsp + 0x913]
mov dword [rsi + rax + 0x19], ecx
mov dword [rsi + rax + 0x1c], edx
inc rbx
jmp 0x140075870
mov r15d, 0
mov ebp, 0
test rcx, rcx
je 0x140075689
lea rsi, [rax - 1]
mov rdi, qword [rax - 1]
mov rbx, qword [rax + 7]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x140075731
cmp qword [rbx + 0x10], 0x11
jb 0x14007571f
mov rdi, qword [rdi - 8]
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x14034bdf0]
xor edi, edi
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rbp, qword [rsp + 0x12a0]
mov rbx, qword [rsp + 0x12b0]
mov sil, 1
mov r14d, 1
mov r15d, 0
cmp rbx, rbp
je 0x140075689
jmp 0x1400756a9
xor r8d, r8d
xor ebp, ebp
test r8, r8
jne 0x1400757ae
and bpl, 1
jne 0x1400757ae
mov rsi, qword [rsp + 0x12a8]
mov rbx, qword [rsp + 0x12b0]
mov rbp, qword [rsp + 0x12a0]
cmp qword [rsp + 0x910], 0
jne 0x140075837
jmp 0x14007584e
mov rdx, qword [rsp + 0x918]
lea rcx, [rsp + 0x270]
call fcn.1401ef1a0
mov rbx, qword [rsp + 0x12b0]
cmp rbx, qword [rsp + 0x12a0]
jne 0x1400757ed
lea rcx, [rsp + 0x12a0]
mov rdx, rbx
call fcn.1400c5ba0
mov rbx, qword [rsp + 0x12b0]
mov rsi, qword [rsp + 0x12a8]
mov rax, rbx
shl rax, 5
movdqu xmm0, xmmword [rsp + 0x270]
movdqu xmm1, xmmword [rsp + 0x280]
movdqu xmmword [rsi + rax + 0x10], xmm1
movdqu xmmword [rsi + rax], xmm0
inc rbx
mov qword [rsp + 0x12b0], rbx
mov rbp, qword [rsp + 0x12a0]
cmp qword [rsp + 0x910], 0
je 0x14007584e
mov r8, qword [rsp + 0x918]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0xe70], 0
je 0x140075870
mov r8, qword [rsp + 0xe78]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov r12, rbx
shl r12, 5
lea r15, [rsi + r12]
mov r13, rsi
test rbx, rbx
je 0x140075899
lea r13, [rsi + 0x20]
mov r14, qword [rsi]
movabs rax, 0x8000000000000000
cmp r14, rax
jne 0x14007590c
mov rdi, rsi
sub r15, r13
je 0x1400758e1
shr r15, 5
add r13, 8
mov rsi, qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1400758c9
add r13, 0x20
dec r15
je 0x1400758e1
cmp qword [r13 - 8], 0
je 0x1400758c0
mov r8, qword [r13]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call rsi
jmp 0x1400758c0
mov r12d, 8
test rbp, rbp
je 0x140075b1d
mov rcx, qword [0x14034bdf0]
xor ebx, ebx
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
xor r15d, r15d
jmp 0x140075b95
mov qword [rsp + 0x60], rbp
mov rdi, qword [rsi + 8]
mov rbp, qword [rsi + 0x10]
cmp byte [rsi + 0x18], 0
je 0x140077de4
mov qword [rsp + 0x58], rsi
dec rbx
movabs rax, 0x7ffffffffffffff
and rax, rbx
cmp rax, 4
mov esi, 3
cmovae rsi, rax
movabs rax, 0x555555555555554
cmp rsi, rax
ja case.0x14008bad5.1
movzx eax, byte [0x14034be90]
mov rcx, qword [0x14034bdf0]
test rcx, rcx
jne 0x140075984
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je case.0x14008bad5.1
mov rcx, rax
mov qword [0x14034bdf0], rax
lea rax, [rsi*8 + 8]
lea r8, [rax + rax*2]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je case.0x14008bad5.1
inc rsi
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rbp
mov qword [rsp + 0x270], rsi
mov qword [rsp + 0x278], rax
add r12, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x58]
lea rbp, [rcx + 0x48]
mov ebx, 1
lea r10, [rsp + 0x270]
jmp 0x140075a0e
cmp rbx, qword [rsp + 0x270]
je 0x140075aea
lea rcx, [rbx + rbx*2]
mov qword [rax + rcx*8], rsi
mov qword [rax + rcx*8 + 8], r11
mov qword [rax + rcx*8 + 0x10], rdi
inc rbx
add r12, 0xffffffffffffffe0
add rbp, 0x20
mov r13, r14
mov qword [rsp + 0x280], rbx
cmp r13, r15
je 0x140075b61
lea r14, [r13 + 0x20]
mov rsi, qword [r13]
movabs rcx, 0x8000000000000000
cmp rsi, rcx
je 0x140075b24
mov r11, qword [r13 + 8]
mov rdi, qword [r13 + 0x10]
cmp byte [r13 + 0x18], 0
jne 0x1400759e0
test rdi, rdi
je 0x1400759e0
lea rcx, [r11 + rdi]
mov r8, r11
jmp 0x140075a7c
add r8, 2
cmp rdx, rcx
cmovne rdx, r8
nop word cs:[rax + rax]
mov r8, rdx
cmp rdx, rcx
je 0x1400759e0
lea rdx, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
jns 0x140075a70
cmp r9b, 0xe0
jb 0x140075a57
cmp r9b, 0xed
jne 0x140075abf
cmp rdx, rcx
je 0x1400759e0
lea rdx, [r8 + 2]
cmp rdx, rcx
je 0x1400759e0
cmp byte [r8 + 1], 0x9f
ja case.0x14008bad5.1
add r8, 3
mov rdx, r8
jmp 0x140075a70
add r8, 2
cmp rdx, rcx
cmove r8, rdx
xor edx, edx
cmp r8, rcx
setne dl
add rdx, r8
cmp r9b, 0xf0
jb 0x140075a70
xor r8d, r8d
cmp rdx, rcx
setne r8b
add rdx, r8
jmp 0x140075a70
mov r8, r15
sub r8, r14
shr r8, 5
inc r8
mov rcx, r10
mov rdx, rbx
mov r13, r11
call case.0x1400bfed7.526
mov r11, r13
lea r10, [rsp + 0x270]
mov rax, qword [rsp + 0x278]
jmp 0x1400759ee
xor ebx, ebx
xor r15d, r15d
jmp 0x140075b95
cmp r15, r14
je 0x140075b61
shr r12, 5
mov rsi, qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140075b49
add rbp, 0x20
dec r12
je 0x140075b61
cmp qword [rbp - 8], 0
je 0x140075b40
mov r8, qword [rbp]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call rsi
jmp 0x140075b40
cmp qword [rsp + 0x60], 0
je 0x140075b7d
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, qword [rsp + 0x58]
call qword [sym.imp.kernel32.dll_HeapFree]
mov r15, qword [rsp + 0x270]
mov r12, qword [rsp + 0x278]
mov rbx, qword [rsp + 0x280]
lea rdx, [0x1402ad8cb]
lea rcx, [rsp + 0x270]
mov r8d, 0xc
call fcn.1400af140
mov rsi, qword [rsp + 0x278]
mov r8, qword [rsp + 0x280]
lea rcx, [rsp + 0x1d68]
mov qword [rsp + 0x1290], rcx
mov rdx, rsi
call case.0x140074154.4724
cmp qword [rsp + 0x270], 0
je 0x140075bf4
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
lea rdx, [0x1402ad8d7]
lea rcx, [rsp + 0x270]
mov r8d, 4
call fcn.1400af140
mov rsi, qword [rsp + 0x278]
mov r8, qword [rsp + 0x280]
lea rcx, [rsp + 0x1948]
mov qword [rsp + 0x1278], rcx
mov rdx, rsi
call case.0x140074154.4724
cmp qword [rsp + 0x270], 0
je 0x140075c53
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
movabs rax, 0x3ff3333333333333
mov qword [rsp + 0xe30], rax
mov qword [rsp + 0x1860], 0
mov qword [rsp + 0x1868], 1
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x1870], xmm0
mov qword [rsp + 0x1880], 1
mov byte [rsp + 0x18c0], 0
movdqu xmmword [rsp + 0x1888], xmm0
mov qword [rsp + 0x1898], 8
movdqu xmmword [rsp + 0x18a0], xmm0
mov qword [rsp + 0x18b0], 1
mov qword [rsp + 0x18b8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 1
mov qword [rsp + 0xe0], 0
mov dword [rsp + 0x1e4], 0
mov dword [rsp + 0xe70], 0
lea r8, [rsp + 0xe70]
mov ecx, 3
xor edx, edx
call qword [sym.imp.secur32.dll_GetUserNameExW]
test al, al
jne case.0x14008bad5.1
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xea
jne 0x140075d89
mov edi, dword [rsp + 0xe70]
test rdi, rdi
je 0x140075d98
movzx eax, byte [0x14034be90]
mov rcx, qword [0x14034bdf0]
test rcx, rcx
jne 0x140075d70
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je case.0x14008bad5.1
mov rcx, rax
mov qword [0x14034bdf0], rax
lea r8, [rdi + rdi]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x140075d9d
jmp case.0x14008bad5.1
lea rcx, [rsp + 0x270]
call fcn.1402122f0
jmp 0x140075df0
mov esi, 2
mov dword [rsp + 0x910], edi
lea r8, [rsp + 0x910]
mov ecx, 3
mov rdx, rsi
call qword [sym.imp.secur32.dll_GetUserNameExW]
test al, al
je 0x1400771a1
mov r8d, dword [rsp + 0x910]
lea rcx, [rsp + 0x270]
mov rdx, rsi
call fcn.1401ef1a0
test edi, edi
je 0x140075df0
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
mov qword [rsp + 0xe28], rbx
lea rdi, [rsp + 0x1968]
lea rdx, [rsp + 0x270]
mov rcx, rdi
call fcn.140212120
lea rsi, [rsp + 0x270]
mov rcx, rsi
call fcn.1402122f0
lea r13, [rsp + 0x1918]
mov rcx, r13
mov rdx, rsi
call fcn.140212120
mov dword [rsp + 0x910], 0
lea r8, [rsp + 0x910]
mov ecx, 1
xor edx, edx
call qword [sym.imp.kernel32.dll_GetComputerNameExW]
test eax, eax
jne case.0x14008bad5.1
mov ebx, dword [rsp + 0x910]
test rbx, rbx
je 0x140075eac
movzx eax, byte [0x14034be90]
mov rcx, qword [0x14034bdf0]
test rcx, rcx
jne 0x140075e93
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je case.0x14008bad5.1
mov rcx, rax
mov qword [0x14034bdf0], rax
lea r8, [rbx + rbx]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x140075eb1
jmp case.0x14008bad5.1
mov esi, 2
mov dword [rsp + 0x910], ebx
lea r8, [rsp + 0x910]
mov ecx, 1
mov rdx, rsi
call qword [sym.imp.kernel32.dll_GetComputerNameExW]
test eax, eax
je 0x140076565
mov r8d, dword [rsp + 0x910]
lea rcx, [rsp + 0x270]
mov rdx, rsi
call fcn.1401ef1a0
test ebx, ebx
je 0x140075f04
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
lea rcx, [rsp + 0x1930]
lea rdx, [rsp + 0x270]
call fcn.140212120
mov qword [rsp + 0x270], 0
mov rax, qword [0x14034b068]
lea rcx, [rsp + 0x270]
call rax
mov r9, qword [rsp + 0x270]
movabs r10, 0x19db1ded53e8000
mov rax, r9
sub rax, r10
neg rax
movabs rcx, 0xfe624e212ac18000
lea r8, [r9 + rcx]
cmp r9, r10
cmovl r8, rax
movabs rcx, 0xd6bf94d5e57a42bd
mov rax, r8
mul rcx
cmp r9, r10
jl case.0x14008bad5.1
mov rcx, rdx
shr rcx, 0x17
movabs rdx, 0xc22e4506728a
mov rax, rcx
mul rdx
mov r9, rdx
movabs rdx, 0xa2e3ff1de20581e3
mov rax, r8
mul rdx
shr rdx, 0x27
add edx, 0xafaa8
imul rax, rdx, 0xe5ac1b
shr rax, 0x29
imul r10d, eax, 0x23ab1
sub edx, r10d
imul r10, rdx, 0xb38cfa
shr r10, 0x20
imul r11d, r10d, 0x16d
sub edx, r11d
lea rsi, [0x14027f5b0]
movzx ebx, byte [r10 + rsi]
mov r11d, edx
sub r11d, ebx
jae 0x140076017
dec r10d
cmp r10d, 0x190
ja case.0x14008bad5.1
mov r11d, r10d
movzx r11d, byte [r11 + rsi]
sub edx, r11d
add edx, 0x16d
mov r11d, edx
jmp 0x140076024
cmp r10d, 0x190
jae case.0x14008bad5.1
mov edx, r10d
lea rsi, [0x14027f0e0]
movzx edx, byte [rdx + rsi]
shl r11d, 4
add r11d, 0x10
or r11d, edx
lea edx, [r11 - 0x16e8]
cmp edx, 0xffffe928
jb case.0x14008bad5.1
imul edx, ecx, 0x989680
sub r8d, edx
imul edx, r8d, 0x64
imul r8, r9, 0x15180
sub rcx, r8
imul eax, eax, 0x190
add r10d, eax
shl r10d, 0xd
or r11d, r10d
mov dword [rsp + 0xe64], ecx
mov dword [rsp + 0xe68], edx
mov dword [rsp + 0xe6c], r11d
lea rcx, [rsp + 0x270]
lea rsi, [rsp + 0xe64]
mov rdx, rsi
call fcn.140039ab0
mov ebp, dword [rsp + 0x278]
lea rcx, [rsp + 0x270]
mov rdx, rsi
call fcn.140039ab0
mov eax, dword [rsp + 0x278]
and eax, 0x1fff
xor ebx, ebx
lea r14, [0x1402acca8]
mov ecx, 0
cmp eax, 0x16e7
ja 0x1400760ed
mov ecx, eax
shr ecx, 3
movzx ecx, byte [rcx + r14]
lea ecx, [rax + rcx*8]
shr ecx, 9
mov dword [rsp + 0xe40], ecx
lea rsi, [rsp + 0x270]
lea rdx, [rsp + 0xe64]
mov rcx, rsi
call fcn.140039ab0
mov eax, dword [rsp + 0x278]
mov ecx, eax
and ecx, 0x1fff
cmp ecx, 0x16e7
ja 0x140076134
shr ecx, 3
movzx ecx, byte [rcx + r14]
lea ebx, [rax + rcx*8]
shr ebx, 4
and ebx, 0x1f
mov dword [rsp + 0xe44], ebx
lea rdx, [0x1402ad920]
lea r14, [rsp + 0x12a0]
mov r8d, 0xd
mov rcx, r14
call fcn.1400af140
lea rdx, str._rtx43cpb__bfn5mo_b__fnp._H5am
mov r8d, 0xa
lea rbx, [rsp + 0xe70]
mov rcx, rbx
call fcn.1400af140
mov qword [rsp + 0x270], r14
lea rax, [0x140035b70]
mov qword [rsp + 0x278], rax
mov qword [rsp + 0x280], rbx
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x290], r13
mov qword [rsp + 0x298], rax
lea rax, str.combase.dll
mov qword [rsp + 0x910], rax
mov qword [rsp + 0x918], 4
mov qword [rsp + 0x930], 0
mov qword [rsp + 0x920], rsi
mov qword [rsp + 0x928], 3
lea rcx, [rsp + 0x15d0]
lea rdx, [rsp + 0x910]
call fcn.140035a20
cmp qword [rsp + 0xe70], 0
je 0x14007621e
mov r8, qword [rsp + 0xe78]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov qword [rsp + 0x1910], r15
cmp qword [rsp + 0x12a0], 0
je 0x140076248
mov r8, qword [rsp + 0x12a8]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov r15, qword [rsp + 0x15d0]
mov rsi, qword [rsp + 0x15d8]
mov rbx, qword [rsp + 0x15e0]
mov rax, qword [rsp + 0xd0]
mov r14, qword [rsp + 0xe0]
sub rax, r14
cmp rax, rbx
jb 0x140078117
mov rcx, qword [rsp + 0xd8]
add rcx, r14
mov rdx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add r14, rbx
mov qword [rsp + 0xe0], r14
test r15, r15
je 0x1400762b4
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rdx, qword [rsp + 0x1970]
mov r8, qword [rsp + 0x1978]
lea rbx, [rsp + 0x910]
mov rcx, rbx
call fcn.1400346a0
mov rdx, qword [rsp + 0x1920]
mov r8, qword [rsp + 0x1928]
lea rcx, [rsp + 0x270]
call fcn.1400346a0
mov r8, qword [rsp + 0x920]
cmp r8, qword [rsp + 0x280]
jne 0x14007632b
mov rdx, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x918]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
sete sil
cmp qword [rsp + 0x270], 0
jne 0x140076338
jmp 0x14007634f
xor esi, esi
cmp qword [rsp + 0x270], 0
je 0x14007634f
mov r8, qword [rsp + 0x278]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x910], 0
je 0x140076371
mov r8, qword [rsp + 0x918]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
test sil, sil
jne 0x14007649c
lea rdx, str._nbL_
mov r8d, 0xb
lea rsi, [rsp + 0xe70]
mov rcx, rsi
call fcn.1400af140
mov qword [rsp + 0x910], rsi
lea rax, [0x140035b70]
mov qword [rsp + 0x918], rax
mov qword [rsp + 0x920], rdi
mov qword [rsp + 0x928], rax
lea rax, str.combase.dll
mov qword [rsp + 0x270], rax
mov qword [rsp + 0x278], 3
mov qword [rsp + 0x290], 0
mov qword [rsp + 0x280], rbx
mov qword [rsp + 0x288], 2
lea rcx, [rsp + 0x12a0]
lea rdx, [rsp + 0x270]
call fcn.140035a20
cmp qword [rsp + 0xe70], 0
je 0x140076430
mov r8, qword [rsp + 0xe78]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov r14, qword [rsp + 0x12a0]
mov rsi, qword [rsp + 0x12a8]
mov rdi, qword [rsp + 0x12b0]
mov rax, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xe0]
sub rax, rbx
cmp rax, rdi
jb 0x140078182
mov rcx, qword [rsp + 0xd8]
add rcx, rbx
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rbx, rdi
mov qword [rsp + 0xe0], rbx
test r14, r14
je 0x14007649c
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
lea rdx, [0x1402ad9e0]
lea rcx, [rsp + 0x120]
mov r8d, 0xa
call fcn.1400af140
lea rdx, [0x1402ad9ea]
lea rcx, [rsp + 0x1510]
mov r8d, 0xb
call fcn.1400af140
mov dword [rsp + 0x1af0], 0
mov dword [rsp + 0x15d0], 0
lea rdx, [rsp + 0x1af0]
lea r9, [rsp + 0x15d0]
mov ecx, 8
xor r8d, r8d
call qword [sym.imp.kernel32.dll_GetUserPreferredUILanguages]
test eax, eax
je case.0x14008bad5.1
mov edi, dword [rsp + 0x15d0]
test rdi, rdi
je 0x1400765ea
movzx eax, byte [0x14034be90]
mov rcx, qword [0x14034bdf0]
test rcx, rcx
jne 0x140076548
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je case.0x14008bad5.1
mov rcx, rax
mov qword [0x14034bdf0], rax
lea r8, [rdi + rdi]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r13, rax
test rax, rax
jne 0x1400765f0
jmp case.0x14008bad5.1
movzx eax, byte [0x14034be90]
mov rcx, qword [0x14034bdf0]
test rcx, rcx
jne 0x140076591
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je case.0x14008bad5.1
mov rcx, rax
mov qword [0x14034bdf0], rax
mov r8d, 7
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je case.0x14008bad5.1
mov dword [rax + 3], 0x6e776f6e
mov dword [rax], 0x6e6b6e55
mov qword [rsp + 0x270], 7
mov qword [rsp + 0x278], rax
mov qword [rsp + 0x280], 7
mov byte [rsp + 0x288], 1
test ebx, ebx
jne 0x140075ef2
jmp 0x140075f04
mov r13d, 2
lea rdx, [rsp + 0x1af0]
lea r9, [rsp + 0x15d0]
mov ecx, 8
mov r8, r13
call qword [sym.imp.kernel32.dll_GetUserPreferredUILanguages]
test eax, eax
je case.0x14008bad5.1
mov eax, dword [rsp + 0x15d0]
test rax, rax
je 0x140076632
lea rcx, [rax - 2]
xor esi, esi
cmp rax, 1
cmovne rsi, rcx
jmp 0x140076634
xor esi, esi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x1298], r12
mov qword [rsp + 0x270], 0
mov qword [rsp + 0x278], 1
mov qword [rsp + 0x280], 0
mov rax, rsi
shr rax, 1
mov r8d, esi
and r8d, 1
add r8, rax
jne 0x140078137
sar ebp, 0xd
mov dword [rsp + 0xe3c], ebp
lea r12, [rsi*2]
add r12, r13
xor r14d, r14d
lea rbx, [rsp + 0x270]
lea r15, [rsp + 0x910]
mov qword [rsp + 0x98], r13
test r14w, r14w
je 0x1400766d0
nop word cs:[rax + rax]
mov ecx, ebp
jmp 0x1400766e2
cmp r13, r12
je 0x14007691f
movzx ecx, word [r13]
add r13, 2
mov edx, ecx
and edx, 0xf800
movzx eax, cx
cmp edx, 0xd800
jne 0x1400767b0
cmp eax, 0xdbff
ja 0x14007680e
cmp r13, r12
je 0x140076813
movzx eax, word [r13]
add r13, 2
mov edx, eax
add edx, 0x2000
movzx edx, dx
cmp edx, 0xfc00
jb 0x140076828
movzx eax, ax
and ecx, 0x3ff
and eax, 0x3ff
shl rcx, 0x1a
shl rax, 0x10
movabs rdx, 0x100000000
add rcx, rdx
or rcx, rax
mov rax, rcx
mov rsi, rax
shr rsi, 0x10
cmp esi, 0x80
jb 0x1400767c3
mov dword [rsp + 0x910], 0
cmp esi, 0x800
jae 0x14007681b
shr eax, 0x16
or al, 0xc0
mov byte [rsp + 0x910], al
and sil, 0x3f
or sil, 0x80
mov byte [rsp + 0x911], sil
mov esi, 2
jmp 0x1400768bc
shl rax, 0x10
mov rsi, rax
shr rsi, 0x10
cmp esi, 0x80
jae 0x140076765
mov rdx, qword [rsp + 0x280]
cmp rdx, qword [rsp + 0x270]
jne 0x1400767e5
mov rcx, rbx
call fcn.1402106e0
mov rdx, qword [rsp + 0x280]
mov rax, qword [rsp + 0x278]
mov byte [rax + rdx], sil
inc rdx
mov qword [rsp + 0x280], rdx
xor r14d, r14d
test r14w, r14w
jne 0x1400766c0
jmp 0x1400766d0
xor r14d, r14d
jmp 0x14007682f
xor r14d, r14d
mov r13, r12
jmp 0x14007682f
cmp esi, 0x10000
jae 0x140076874
xor r14d, r14d
jmp 0x14007683f
mov r14w, 1
mov ebp, eax
mov dword [rsp + 0x910], 0
mov esi, 0xfffd
mov eax, esi
shr eax, 0xc
or al, 0xe0
mov byte [rsp + 0x910], al
mov eax, esi
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x911], al
and sil, 0x3f
or sil, 0x80
mov byte [rsp + 0x912], sil
mov esi, 3
jmp 0x1400768bf
mov rcx, rax
shr rcx, 0x22
or cl, 0xf0
mov byte [rsp + 0x910], cl
mov rcx, rax
shr rcx, 0x1c
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0x911], cl
shr eax, 0x16
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x912], al
and sil, 0x3f
or sil, 0x80
mov byte [rsp + 0x913], sil
mov esi, 4
xor r14d, r14d
mov rax, qword [rsp + 0x270]
mov rdi, qword [rsp + 0x280]
sub rax, rdi
cmp rax, rsi
jb 0x140076907
mov rcx, qword [rsp + 0x278]
add rcx, rdi
mov rdx, r15
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rsi
mov qword [rsp + 0x280], rdi
test r14w, r14w
jne 0x1400766c0
jmp 0x1400766d0
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.140270860
mov rdi, qword [rsp + 0x280]
jmp 0x1400768d7
mov rbx, qword [rsp + 0x270]
mov r13, qword [rsp + 0x278]
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0x910], 0
mov qword [rsp + 0x918], rax
mov qword [rsp + 0x920], r13
mov qword [rsp + 0x928], rax
mov qword [rsp + 0x930], 0
mov qword [rsp + 0x938], rax
mov qword [rsp + 0x940], 1
mov qword [rsp + 0x948], 0
mov word [rsp + 0x950], 1
lea rcx, [rsp + 0x270]
lea rdx, [rsp + 0x910]
call fcn.14009d230
movabs rax, 0x8000000000000000
cmp qword [rsp + 0x270], rax
jne 0x140076a70
mov eax, 8
mov qword [rsp + 0x58], rax
xor r15d, r15d
xor edi, edi
test rbx, rbx
je 0x1400769e4
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, r13
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x60], 0
je 0x140076a03
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, qword [rsp + 0x98]
call qword [sym.imp.kernel32.dll_HeapFree]
test r15, r15
je 0x140076c02
mov rax, qword [rsp + 0x58]
mov r14, qword [rax + 8]
mov r13, qword [rax + 0x10]
test r13, r13
je 0x140076c48
js case.0x14008bad5.1
movzx eax, byte [0x14034be90]
mov rcx, qword [0x14034bdf0]
test rcx, rcx
jne 0x140076a54
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je case.0x14008bad5.1
mov rcx, rax
mov qword [0x14034bdf0], rax
xor edx, edx
mov r8, r13
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
jne 0x140076c4d
jmp case.0x14008bad5.1
movzx eax, byte [0x14034be90]
mov rcx, qword [0x14034bdf0]
test rcx, rcx
jne 0x140076a9c
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je case.0x14008bad5.1
mov rcx, rax
mov qword [0x14034bdf0], rax
mov r8d, 0x60
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je case.0x14008bad5.1
mov rsi, rax
mov rax, qword [rsp + 0x280]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x270]
movups xmmword [rsi], xmm0
mov qword [rsp + 0x12a0], 4
mov qword [rsp + 0x12a8], rsi
mov qword [rsp + 0x12b0], 1
mov rax, qword [rsp + 0x950]
mov qword [rsp + 0x2b0], rax
movdqu xmm0, xmmword [rsp + 0x910]
movdqu xmm1, xmmword [rsp + 0x920]
movdqu xmm2, xmmword [rsp + 0x930]
movdqu xmm3, xmmword [rsp + 0x940]
movdqa xmmword [rsp + 0x2a0], xmm3
movdqa xmmword [rsp + 0x290], xmm2
movdqa xmmword [rsp + 0x280], xmm1
movdqa xmmword [rsp + 0x270], xmm0
mov r15d, 1
mov r14d, 0x18
lea rdi, [rsp + 0xe70]
lea r12, [rsp + 0x270]
lea rbp, [rsp + 0x12a0]
jmp 0x140076b9b
mov rax, qword [rsp + 0xe80]
mov qword [rsi + r14 + 0x10], rax
movdqu xmm0, xmmword [rsp + 0xe70]
movdqu xmmword [rsi + r14], xmm0
inc r15
mov qword [rsp + 0x12b0], r15
add r14, 0x18
mov rcx, rdi
mov rdx, r12
call fcn.14009d230
movabs rax, 0x8000000000000000
cmp qword [rsp + 0xe70], rax
je 0x140076bdf
cmp r15, qword [rsp + 0x12a0]
jne 0x140076b70
mov r8d, 1
mov rcx, rbp
mov rdx, r15
call case.0x1400bfed7.526
mov rsi, qword [rsp + 0x12a8]
jmp 0x140076b70
mov rdi, qword [rsp + 0x12a0]
mov rax, qword [rsp + 0x12a8]
mov qword [rsp + 0x58], rax
test rbx, rbx
jne 0x1400769d2
jmp 0x1400769e4
mov qword [rsp + 0x1980], 0
mov qword [rsp + 0x1988], 8
mov qword [rsp + 0x1990], 0
test rdi, rdi
je 0x140076e3b
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, qword [rsp + 0x58]
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140076e3b
mov esi, 1
mov rcx, rsi
mov rdx, r14
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [0x14034be90]
mov rcx, qword [0x14034bdf0]
test rcx, rcx
jne 0x140076c87
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je case.0x14008bad5.1
mov rcx, rax
mov qword [0x14034bdf0], rax
mov r8d, 0x60
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je case.0x14008bad5.1
mov r14, rax
mov qword [rsp + 0x60], rdi
mov qword [rax], r13
mov qword [rax + 8], rsi
mov qword [rax + 0x10], r13
mov qword [rsp + 0x270], 4
mov qword [rsp + 0x278], rax
mov qword [rsp + 0x280], 1
cmp r15, 1
mov rbp, r15
adc rbp, 0
mov r13d, 1
mov r12d, 0x28
jmp 0x140076d46
mov qword [0x14034bdf0], rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je case.0x14008bad5.1
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
cmp r13, qword [rsp + 0x270]
je 0x140076d9a
inc r13
mov qword [r14 + r12 - 0x10], rsi
mov qword [r14 + r12 - 8], rbx
mov qword [r14 + r12], rsi
mov qword [rsp + 0x280], r13
add r12, 0x18
cmp rbp, r13
je 0x140076dbd
mov rax, qword [rsp + 0x58]
mov rdi, qword [rax + r12 - 8]
mov rsi, qword [rax + r12]
test rsi, rsi
je 0x140076d90
js case.0x14008bad5.1
movzx eax, byte [0x14034be90]
mov rax, qword [0x14034bdf0]
test rax, rax
jne 0x140076cf7
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
jne 0x140076cf0
jmp case.0x14008bad5.1
mov ebx, 1
jmp 0x140076d11
mov r8d, 1
lea rcx, [rsp + 0x270]
mov rdx, r13
call case.0x1400bfed7.526
mov r14, qword [rsp + 0x278]
jmp 0x140076d29
mov rax, qword [rsp + 0x58]
lea rsi, [rax + 8]
mov rdi, qword [sym.imp.kernel32.dll_HeapFree]
mov rbx, qword [rsp + 0x60]
jmp 0x140076de9
add rsi, 0x18
dec r15
je 0x140076e00
cmp qword [rsi - 8], 0
je 0x140076de0
mov r8, qword [rsi]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call rdi
jmp 0x140076de0
test rbx, rbx
je 0x140076e19
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, qword [rsp + 0x58]
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0x1990], rax
movdqu xmm0, xmmword [rsp + 0x270]
movdqa xmmword [rsp + 0x1980], xmm0
lea rdx, [0x1402ad9f5]
lea rcx, [rsp + 0x1af0]
mov r8d, 4
call fcn.1400af140
movzx eax, byte [0x14034be90]
mov rcx, qword [0x14034bdf0]
test rcx, rcx
jne 0x140076e81
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je case.0x14008bad5.1
mov rcx, rax
mov qword [0x14034bdf0], rax
mov r8d, 8
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je case.0x14008bad5.1
mov word [rax], 0x6e
mov qword [rsp + 0x270], 4
mov qword [rsp + 0x278], rax
lea rsi, [0x1403337b2]
mov r15d, 1
xor r12d, r12d
lea rdi, str.Windows__Unknown_WorkstationDomain_ControllerServerUnknownWindows_.
lea rbx, [0x1403337b1]
lea r14, [rsp + 0x270]
jmp 0x140076eeb
mov word [rax + r15*2], r12w
inc r15
mov r12d, ebp
mov qword [rsp + 0x280], r15
test r12w, r12w
jne 0x140076fa0
cmp rsi, rdi
je 0x14007703b
movzx r12d, byte [rsi]
test r12b, r12b
js 0x140076f23
inc rsi
xor ebp, ebp
cmp r15, qword [rsp + 0x270]
jne 0x140076ee0
jmp 0x140076fb0
mov ecx, r12d
and ecx, 0x1f
movzx r8d, byte [rsi + 1]
and r8d, 0x3f
cmp r12b, 0xdf
jbe 0x140076f84
movzx edx, byte [rsi + 2]
shl r8d, 6
and edx, 0x3f
or edx, r8d
cmp r12b, 0xf0
jb 0x140076fee
movzx r12d, byte [rsi + 3]
and ecx, 7
shl ecx, 0x12
shl edx, 6
and r12d, 0x3f
or r12d, edx
or r12d, ecx
cmp r12d, 0x110000
je 0x14007703b
add rsi, 4
cmp r12d, 0xffff
jbe 0x140076fa0
jmp 0x140077003
add rsi, 2
shl ecx, 6
or ecx, r8d
mov r12d, ecx
nop word cs:[rax + rax]
xor ebp, ebp
cmp r15, qword [rsp + 0x270]
jne 0x140076ee0
mov rax, rbx
sub rax, rsi
add rax, 0xc
movabs rcx, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
cmp bp, 1
sbb rdx, 0
lea r8, [rdx + 2]
mov rcx, r14
mov rdx, r15
call fcn.14027b150
mov rax, qword [rsp + 0x278]
jmp 0x140076ee0
add rsi, 3
shl ecx, 0xc
or edx, ecx
mov r12d, edx
cmp r12d, 0xffff
jbe 0x140076fa0
lea ecx, [r12 + 0xff0000]
shr ecx, 0xa
or ecx, 0xd800
and r12d, 0x3ff
or r12d, 0xdc00
mov ebp, r12d
mov r12d, ecx
cmp r15, qword [rsp + 0x270]
jne 0x140076ee0
jmp 0x140076fb0
mov r13, qword [rsp + 0x270]
mov r15, qword [rsp + 0x278]
mov rcx, r15
xor edx, edx
mov r8d, 0x800
call sub.kernel32.dll_LoadLibraryExW
mov rsi, rax
movzx eax, byte [0x14034be90]
mov rcx, qword [0x14034bdf0]
test rcx, rcx
jne 0x14007708a
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je case.0x14008bad5.1
mov rcx, rax
mov qword [0x14034bdf0], rax
mov r8d, 0xe
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je case.0x14008bad5.1
mov r12, rax
movabs rax, 0x65567465476c7452
mov qword [r12], rax
mov dword [r12 + 8], 0x6f697372
mov word [r12 + 0xc], 0x6e
mov rcx, rsi
mov rdx, r12
call sub.kernel32.dll_GetProcAddress
test rax, rax
je 0x140077173
mov rdi, rax
lea rcx, [rsp + 0x914]
mov r8d, 0x118
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x910], 0x11c
lea rbx, [rsp + 0x910]
mov rcx, rbx
call rdi
mov rcx, rsi
call sub.kernel32.dll_FreeLibrary
lea rcx, [rsp + 0x270]
mov r8d, 0x11c
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [rsp + 0x38a]
cmp eax, 1
je 0x14007723c
cmp eax, 2
movabs rsi, 0x8000000000000000
lea rdi, [rsp + 0x120]
je 0x140077226
cmp eax, 3
jne 0x140077264
lea rax, [0x1403337e8]
mov qword [rsp + 0x770], rax
mov eax, 6
jmp 0x140077278
movzx eax, byte [0x14034be90]
mov rcx, qword [0x14034bdf0]
test rcx, rcx
je 0x140077348
movabs rsi, 0x8000000000000000
lea rdi, [rsp + 0x120]
jmp 0x140077373
movzx eax, byte [0x14034be90]
mov rcx, qword [0x14034bdf0]
test rcx, rcx
jne 0x1400771cd
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je case.0x14008bad5.1
mov rcx, rax
mov qword [0x14034bdf0], rax
mov r8d, 7
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je case.0x14008bad5.1
mov dword [rax + 3], 0x6e776f6e
mov dword [rax], 0x6e6b6e55
mov qword [rsp + 0x270], 7
mov qword [rsp + 0x278], rax
mov qword [rsp + 0x280], 7
mov byte [rsp + 0x288], 1
test edi, edi
jne 0x140075dde
jmp 0x140075df0
lea rax, [0x1403337d7]
mov qword [rsp + 0x770], rax
mov eax, 0x11
jmp 0x140077278
lea rax, [0x1403337cc]
mov qword [rsp + 0x770], rax
mov eax, 0xb
movabs rsi, 0x8000000000000000
lea rdi, [rsp + 0x120]
jmp 0x140077278
lea rax, case.0x1400b6f9b.1
mov qword [rsp + 0x770], rax
mov eax, 7
mov qword [rsp + 0x778], rax
lea rax, [rsp + 0x274]
lea rcx, [rsp + 0x278]
lea rdx, [rsp + 0x27c]
mov qword [rsp + 0xe70], rax
lea rax, [0x140043da0]
mov qword [rsp + 0xe78], rax
mov qword [rsp + 0xe80], rcx
mov qword [rsp + 0xe88], rax
mov qword [rsp + 0xe90], rdx
mov qword [rsp + 0xe98], rax
lea rax, [rsp + 0x770]
mov qword [rsp + 0xea0], rax
lea rax, [0x140044cb0]
mov qword [rsp + 0xea8], rax
lea rax, [0x140333800]
mov qword [rsp + 0x12a0], rax
mov qword [rsp + 0x12a8], 5
mov qword [rsp + 0x12c0], 0
lea rax, [rsp + 0xe70]
mov qword [rsp + 0x12b0], rax
mov qword [rsp + 0x12b8], 4
lea rcx, [rsp + 0x15d0]
lea rdx, [rsp + 0x12a0]
call fcn.140035a20
jmp 0x1400773ba
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
movabs rsi, 0x8000000000000000
lea rdi, [rsp + 0x120]
je case.0x14008bad5.1
mov rcx, rax
mov qword [0x14034bdf0], rax
mov r8d, 0x11
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je case.0x14008bad5.1
movdqu xmm0, xmmword [str.Windows__Unknown_WorkstationDomain_ControllerServerUnknownWindows_.]
movdqu xmmword [rax], xmm0
mov byte [rax + 0x10], 0x29
mov qword [rsp + 0x15d0], 0x11
mov qword [rsp + 0x15d8], rax
mov qword [rsp + 0x15e0], 0x11
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, r12
call qword [sym.imp.kernel32.dll_HeapFree]
test r13, r13
je 0x1400773e3
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x15d0], rsi
mov r12, qword [rsp + 0x1298]
jne 0x1400774ab
lea rax, [rsi + 2]
mov qword [rsp + 0x910], rax
lea rax, [rsp + 0x910]
mov qword [rsp + 0x12a0], rax
lea rax, [0x140211fe0]
mov qword [rsp + 0x12a8], rax
lea rax, [0x1402acf90]
mov qword [rsp + 0x270], rax
mov qword [rsp + 0x278], 1
mov qword [rsp + 0x290], 0
lea rax, [rsp + 0x12a0]
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x288], 1
lea rcx, [rsp + 0xe70]
lea rdx, [rsp + 0x270]
call fcn.140035a20
mov rax, qword [rsp + 0x910]
lea rcx, [rsi + 0xc]
cmp rax, rcx
jl 0x1400774cd
test rax, rax
je 0x1400774cd
mov r8, qword [rsp + 0x918]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1400774cd
mov rax, qword [rsp + 0x15e0]
mov qword [rsp + 0xe80], rax
movdqu xmm0, xmmword [rsp + 0x15d0]
movdqa xmmword [rsp + 0xe70], xmm0
lea rdx, [rsp + 0x1510]
mov qword [rsp + 0x270], rdi
lea rcx, [0x140035b70]
mov qword [rsp + 0x278], rcx
lea rax, [rsp + 0x1930]
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x288], rcx
mov qword [rsp + 0x290], rdx
mov qword [rsp + 0x298], rcx
lea rax, [rsp + 0x1980]
mov qword [rsp + 0x2a0], rax
lea rax, [0x14009cff0]
mov qword [rsp + 0x2a8], rax
lea rax, [rsp + 0x1af0]
mov qword [rsp + 0x2b0], rax
mov qword [rsp + 0x2b8], rcx
lea rax, [rsp + 0xe70]
mov qword [rsp + 0x2c0], rax
mov qword [rsp + 0x2c8], rcx
lea rax, str.combase.dll
mov qword [rsp + 0x910], rax
mov qword [rsp + 0x918], 7
mov qword [rsp + 0x930], 0
mov qword [rsp + 0x920], r14
mov qword [rsp + 0x928], 6
lea rcx, [rsp + 0x12a0]
lea r13, [rsp + 0x910]
mov rdx, r13
call fcn.140035a20
cmp qword [rsp + 0xe70], 0
je 0x1400775d8
mov r8, qword [rsp + 0xe78]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x1af0], 0
je 0x1400775fa
mov r8, qword [rsp + 0x1af8]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rsi, qword [rsp + 0x1990]
test rsi, rsi
je 0x140077640
mov rdi, qword [rsp + 0x1988]
add rdi, 8
mov rbx, qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140077629
add rdi, 0x18
dec rsi
je 0x140077640
cmp qword [rdi - 8], 0
je 0x140077620
mov r8, qword [rdi]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call rbx
jmp 0x140077620
cmp qword [rsp + 0x1980], 0
je 0x140077662
mov r8, qword [rsp + 0x1988]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x1510], 0
je 0x140077684
mov r8, qword [rsp + 0x1518]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x120], 0
je 0x1400776a6
mov r8, qword [rsp + 0x128]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rsi, qword [rsp + 0x12a0]
mov rdi, qword [rsp + 0x12a8]
mov rbx, qword [rsp + 0x12b0]
mov rax, qword [rsp + 0xd0]
mov r14, qword [rsp + 0xe0]
sub rax, r14
cmp rax, rbx
jb 0x14007814b
mov rcx, qword [rsp + 0xd8]
add rcx, r14
mov rdx, rdi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add r14, rbx
mov qword [rsp + 0xe0], r14
test rsi, rsi
je 0x140077712
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
lea rdx, [0x1402ad9f9]
lea rcx, [rsp + 0x1980]
mov r8d, 0x2c
call fcn.1400af140
lea rcx, [rsp + 0x1998]
lea rdx, [0x1402ada25]
mov r8d, 0x2f
call fcn.1400af140
lea rcx, [rsp + 0x19b0]
lea rdx, [0x1402ada54]
mov r8d, 0xe
call fcn.1400af140
lea rcx, [rsp + 0x19c8]
lea rdx, [0x1402ada62]
mov r8d, 0xf
call fcn.1400af140
lea rcx, [rsp + 0x19e0]
lea rdx, [0x1402ada71]
mov r8d, 0x1c
call fcn.1400af140
lea rcx, [rsp + 0x19f8]
lea rdx, [0x1402ada8d]
mov r8d, 7
call fcn.1400af140
lea rcx, [rsp + 0x1a10]
lea rdx, [0x1402ada94]
mov r8d, 6
call fcn.1400af140
lea rcx, [rsp + 0x1a28]
lea rdx, [0x1402ada9a]
mov r8d, 8
call fcn.1400af140
lea rcx, [rsp + 0x1a40]
lea rdx, [0x1402adaa2]
mov r8d, 0x11
call fcn.1400af140
lea rcx, [rsp + 0x1a58]
lea rdx, [0x1402adab3]
mov r8d, 0x11
call fcn.1400af140
lea rcx, [rsp + 0x1a70]
lea rdx, [0x1402adac4]
mov r8d, 7
call fcn.1400af140
lea rcx, [rsp + 0x1a88]
lea rdx, [0x1402adacb]
mov r8d, 9
call fcn.1400af140
mov rbx, qword [rsp + 0x1a00]
mov rdi, qword [rsp + 0x1a08]
test rdi, rdi
je 0x1400778a9
js case.0x14008bad5.1
movzx eax, byte [0x14034be90]
mov rcx, qword [0x14034bdf0]
test rcx, rcx
jne 0x140077891
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je case.0x14008bad5.1
mov rcx, rax
mov qword [0x14034bdf0], rax
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r14, rax
test rax, rax
jne 0x1400778af
jmp case.0x14008bad5.1
mov r14d, 1
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x720]
mov qword [rsp + 0x1288], rcx
mov rdx, r14
mov r8, rdi
call case.0x140074154.4724
test rdi, rdi
je 0x1400778ef
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
lea rdx, [0x1402adad4]
lea rcx, [rsp + 0x270]
mov r8d, 0xb
call fcn.1400af140
mov rdi, qword [rsp + 0x278]
mov r8, qword [rsp + 0x280]
lea rcx, [rsp + 0x1d88]
mov rdx, rdi
call case.0x140074154.4724
cmp qword [rsp + 0x270], 0
movabs rbx, 0x8000000000000000
je 0x140077950
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
lea rcx, [rsp + 0xda0]
lea rdx, [rsp + 0x1980]
call fcn.14008c120
mov rsi, qword [rsp + 0xda0]
cmp rsi, rbx
jne 0x14007860d
cmp word [rsp + 0xda8], 4
jne 0x14007860d
xor esi, esi
lea rdi, [rsp + 0x270]
lea rbx, [rsp + 0x1980]
nop word [rax + rax]
mov rcx, rdi
mov rdx, rbx
call fcn.14008c120
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0xdb0], rax
movdqu xmm0, xmmword [rsp + 0x270]
movdqa xmmword [rsp + 0xda0], xmm0
movabs rax, 0x8000000000000000
cmp qword [rsp + 0xda0], rax
jne 0x1400779f8
cmp esi, 0x4e1e
ja 0x1400779f8
cmp word [rsp + 0xda8], 4
jne 0x1400779f8
inc esi
jmp 0x1400779a0
cmp esi, 0x4e1f
jb 0x1400785fb
lea rdx, [0x1402adadf]
lea rcx, [rsp + 0x270]
mov r8d, 3
call fcn.1400af140
mov rdi, qword [rsp + 0x278]
mov rbx, qword [rsp + 0x280]
mov rax, qword [rsp + 0xe28]
lea rax, [rax*8]
lea rsi, [rax + rax*2]
xor r14d, r14d
mov r15, r12
jmp 0x140077a58
add r15, 0x18
add r14, 0x18
cmp rsi, r14
je 0x140077a77
cmp qword [r15 + 0x10], rbx
jne 0x140077a50
mov rcx, qword [r12 + r14 + 8]
mov rdx, rdi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140077a50
cmp qword [rsp + 0x270], 0
je 0x140077a94
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
cmp rsi, r14
jne 0x1400785fb
cmp qword [rsp + 0xe28], 0
je case.0x14008bad5.1
mov r14, qword [r12 + 8]
mov rbx, qword [r12 + 0x10]
mov edi, 1
mov r15d, 1
test rbx, rbx
je 0x140077b0f
js case.0x14008bad5.1
movzx eax, byte [0x14034be90]
mov rcx, qword [0x14034bdf0]
test rcx, rcx
jne 0x140077af8
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je case.0x14008bad5.1
mov rcx, rax
mov qword [0x14034bdf0], rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r15, rax
test rax, rax
je case.0x14008bad5.1
mov rcx, r15
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x270], rbx
mov qword [rsp + 0x278], r15
mov qword [rsp + 0x280], rbx
mov byte [rsp + 0x288], 0
mov qword [rsp + 0x290], 0
mov qword [rsp + 0x298], 8
mov qword [rsp + 0x2a0], 0
mov qword [rsp + 0x2f8], 0
mov qword [rsp + 0x308], 0
mov word [rsp + 0x310], 0
movabs rax, 0x8000000000000000
mov qword [rsp + 0x2a8], rax
mov dword [rsp + 0x330], 0
mov word [rsp + 0x334], 0
mov dword [rsp + 0x2c8], 6
mov dword [rsp + 0x2d8], 6
mov dword [rsp + 0x2e8], 6
mov qword [rsp + 0x318], 0
mov qword [rsp + 0x328], 0
lea rdx, [0x1402adadf]
lea rcx, [rsp + 0x910]
mov r8d, 3
call fcn.1400af140
mov rbx, qword [rsp + 0x918]
mov r14, qword [rsp + 0x920]
test r14, r14
je 0x140077c5b
js case.0x14008bad5.1
movzx eax, byte [0x14034be90]
mov rcx, qword [0x14034bdf0]
test rcx, rcx
jne 0x140077c44
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je case.0x14008bad5.1
mov rcx, rax
mov qword [0x14034bdf0], rax
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je case.0x14008bad5.1
lea r15, [rsp + 0x290]
mov rcx, rdi
mov rdx, rbx
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r15
xor edx, edx
call fcn.140148060
mov rax, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x2a0]
lea rdx, [rcx + rcx*4]
mov qword [rax + rdx*8], 0
mov qword [rax + rdx*8 + 8], r14
mov qword [rax + rdx*8 + 0x10], rdi
mov qword [rax + rdx*8 + 0x18], r14
mov byte [rax + rdx*8 + 0x20], 0
mov r8d, dword [rsp + 0xe70]
mov r9d, dword [rsp + 0xe73]
mov dword [rax + rdx*8 + 0x21], r8d
mov dword [rax + rdx*8 + 0x24], r9d
inc rcx
mov qword [rsp + 0x2a0], rcx
cmp qword [rsp + 0x910], 0
je 0x140077ced
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
lea rcx, [rsp + 0x910]
lea rdx, [rsp + 0x270]
call fcn.1401ea8a0
cmp dword [rsp + 0x910], 2
jne 0x14008aa6c
mov rax, qword [rsp + 0x918]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x140077d73
test rcx, rcx
je 0x140077d73
lea rdi, [rax - 1]
mov rbx, qword [rax - 1]
mov rsi, qword [rax + 7]
mov rcx, rbx
call qword [rsi]
cmp qword [rsi + 8], 0
je 0x140077d61
cmp qword [rsi + 0x10], 0x11
jb 0x140077d4f
mov rbx, qword [rbx - 8]
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x270], 0
je 0x140077d95
mov r8, qword [rsp + 0x278]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rsi, qword [rsp + 0x2a0]
test rsi, rsi
je 0x140077e87
mov rdi, qword [rsp + 0x298]
add rdi, 0x10
mov rbx, qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140077dcd
add rdi, 0x28
dec rsi
je 0x140077e87
cmp qword [rdi - 8], 0
je 0x140077dc0
mov r8, qword [rdi]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call rbx
jmp 0x140077dc0
test rbp, rbp
je 0x140075923
lea rax, [rdi + rbp]
mov rdx, rdi
jmp 0x140077e1c
add rdx, 2
cmp rcx, rax
cmovne rcx, rdx
nop word cs:[rax + rax]
mov rdx, rcx
cmp rcx, rax
je 0x140075923
lea rcx, [rdx + 1]
movzx r8d, byte [rdx]
test r8b, r8b
jns 0x140077e10
cmp r8b, 0xe0
jb 0x140077df6
cmp r8b, 0xed
jne 0x140077e5e
cmp rcx, rax
je 0x140075923
lea rcx, [rdx + 2]
cmp rcx, rax
je 0x140075923
cmp byte [rdx + 1], 0x9f
ja case.0x14008bad5.1
add rdx, 3
mov rcx, rdx
jmp 0x140077e10
add rdx, 2
cmp rcx, rax
cmove rdx, rcx
xor ecx, ecx
cmp rdx, rax
setne cl
add rcx, rdx
cmp r8b, 0xf0
jb 0x140077e10
xor edx, edx
cmp rcx, rax
setne dl
add rcx, rdx
jmp 0x140077e10
cmp qword [rsp + 0x290], 0
je 0x140077ea9
mov r8, qword [rsp + 0x298]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rbx, qword [rsp + 0x2f8]
test rbx, rbx
je 0x140078277
mov r14, qword [rsp + 0x308]
mov r12, qword [rsp + 0x300]
test r14, r14
je 0x1400781a2
xor r13d, r13d
mov r15, qword [sym.imp.kernel32.dll_HeapFree]
mov rdi, rbx
jmp 0x140077efe
mov edi, 0
dec r14
je 0x14007816b
test r13, r13
jne 0x140077f93
test r12, r12
je 0x140077f34
mov rcx, r12
and rcx, 7
je 0x140077f39
mov rax, r12
and rax, 0xfffffffffffffff8
mov r13, rdi
nop
mov r13, qword [r13 + 0x3d8]
dec rcx
jne 0x140077f20
cmp r12, 8
jae 0x140077f50
jmp 0x140077f8e
mov r13, rdi
jmp 0x140077f8e
mov r13, rdi
mov rax, r12
cmp r12, 8
jb 0x140077f8e
nop word cs:[rax + rax]
mov rcx, qword [r13 + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov r13, qword [rcx + 0x3d8]
add rax, 0xfffffffffffffff8
jne 0x140077f50
xor r12d, r12d
xor edi, edi
movzx eax, word [r13 + 0x3d2]
mov rbp, r12
mov rsi, r13
cmp r12, rax
jb 0x140077fe6
nop word cs:[rax + rax]
mov rsi, qword [r13 + 0x160]
test rsi, rsi
je 0x14008a7d5
inc rdi
movzx ebp, word [r13 + 0x3d0]
mov rcx, qword [0x14034bdf0]
xor edx, edx
mov r8, r13
call r15
mov r13, rsi
cmp bp, word [rsi + 0x3d2]
jae 0x140077fb0
test rdi, rdi
je 0x1400780f0
mov r13, qword [rsi + rbp*8 + 0x3e0]
mov rax, rdi
dec rax
je 0x14007806e
mov rcx, rax
and rcx, 7
je 0x140078025
mov rax, rcx
nop dword [rax + rax]
mov r13, qword [r13 + 0x3d8]
dec rax
jne 0x140078010
not rcx
add rcx, rdi
mov rax, rcx
add rdi, 0xfffffffffffffffe
cmp rdi, 7
jb 0x14007806e
nop
mov rcx, qword [r13 + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov r13, qword [rcx + 0x3d8]
add rax, 0xfffffffffffffff8
jne 0x140078030
xor r12d, r12d
imul rax, rbp, 0x38
lea rdi, [rsi + rax]
add rdi, 0x168
cmp qword [rsi + rax + 0x168], 0
je 0x14007809b
mov r8, qword [rdi + 8]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call r15
cmp qword [rdi + 0x20], 0
je 0x1400780b2
mov r8, qword [rdi + 0x28]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call r15
shl rbp, 5
mov rax, qword [rsi + rbp]
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x140077ef0
test rax, rax
je 0x140077ef0
add rsi, rbp
mov r8, qword [rsi + 8]
mov rcx, qword [0x14034bdf0]
xor edx, edx
call r15
jmp 0x140077ef0
lea r12, [rbp + 1]
mov r13, rsi
imul rax, rbp, 0x38
lea rdi, [rsi + rax]
add rdi, 0x168
cmp qword [rsi + rax + 0x168], 0
jne 0x14007808b
jmp 0x14007809b
lea rcx, [rsp + 0xd0]
mov rdx, r14
mov r8, rbx
call fcn.140270860
mov r14, qword [rsp + 0xe0]
jmp 0x14007627c
lea rcx, [rsp + 0x270]
xor edx, edx
call fcn.140270860
jmp 0x14007667b
lea rcx, [rsp + 0xd0]
mov rdx, r14
mov r8, rbx
call fcn.140270860
mov r14, qword [rsp + 0xe0]
jmp 0x1400776da
test rbx, rbx
je 0x140078277
test r13, r13
jne 0x14007821e
xor r13d, r13d
jmp 0x1400781a5
lea rcx, [rsp + 0xd0]
mov rdx, rbx
mov r8, rdi
call fcn.140270860
mov rbx, qword [rsp + 0xe0]
jmp 0x140076464
mov r13, rbx
test r12, r12
je 0x14007821e
mov rcx, r12
mov rax, r12
and rcx, 7
je 0x1400781cc
and rax, 0xfffffffffffffff8
nop word [rax + rax]
mov r13, qword [r13 + 0x3d8]
dec rcx
jne 0x1400781c0
cmp r12, 8
jae 0x1400781e0
test r13, r13
jne 0x14007821e
jmp 0x140078277
mov rcx, qword [r13 + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov r13, qword [rcx + 0x3d8]
add rax, 0xfffffffffffffff8
jne 0x1400781e0
mov rax, qword [r13 + 0x160]
test rax, rax
je 0x140078262
mov rsi, qword [sym.imp.kernel32.dll_HeapFree]
nop word cs:[rax + rax]
mov rbx, r13
mov edx, 8
mov rcx, r13
call fcn.140007660
ud2
call fcn.1401eeb00
add rcx, 0x10
xor edx, edx
call case.0x14019ea7a.1075
ud2