Function at 0x16404
Capabilities:
Encode data using xor
Print debug messages

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb28
mov rax, qword [0x00013100]
xor rax, rsp
mov qword [rsp + 0xb10], rax
xor eax, eax
mov rsi, rcx
mov qword [rsp + 0x198], rcx
lea rcx, [rsp + 0x220]
mov r14, r9
mov qword [rsp + 0xc8], r9
mov r15, r8
mov qword [rsp + 0x1a0], r8
mov r12, rdx
mov qword [rsp + 0xc0], rdx
mov qword [rsp + 0x220], rax
mov qword [rsp + 0x228], rax
mov dword [rsp + 0x230], eax
call fcn.000117a4
lea rdx, [rsp + 0x220]
lea rcx, [0x00019f50]
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
movabs rdi, 0xfffff78000000320
mov rdi, qword [rdi]
lea r8d, [rdx + 0x32]
lea rcx, [rsp + 0x130]
call fcn.000120d0
movzx edx, byte [r12]
xor ebx, ebx
mov eax, 0x8b
mov byte [rsp + 0x130], 1
mov ebp, ebx
cmp edx, eax
mov r13b, bl
jg 0x168e1
je 0x1687d
mov ecx, edx
sub ecx, 0x1d
je 0x1681c
sub ecx, 1
je 0x16756
sub ecx, 0x62
je 0x166f0
sub ecx, 1
je 0x16676
sub ecx, 1
je 0x16613
sub ecx, 1
je 0x16590
cmp ecx, 1
jne 0x16921
cmp byte [rsi + 2], bl
je 0x1654d
mov byte [rsp + 0x130], bl
lea ecx, [rbx + 7]
lea rdx, [rsp + 0x132]
mov al, byte [rcx + rsi + 0x19a]
sub rcx, 1
mov byte [rdx], al
add rdx, 1
cmp rcx, rbx
jge 0x1652f
mov ebp, 8
mov r13b, 1
xor r15d, r15d
xor byte [rsi + 3], dil
cmp byte [rsp + 0x130], 0x1f
ja 0x176e1
add byte [rsi + 3], 1
mov cl, byte [r12]
mov bl, byte [rsi + 3]
lea r8, [rsp + 0x130]
and cl, 0x7f
mov dl, 2
mov byte [rsp + 0x131], bl
call fcn.000115a8
cmp eax, r15d
je 0x16562
jmp 0x176e8
lea rbx, [r12 + 1]
mov r8, rsi
mov edx, 4
mov rcx, rbx
call fcn.00016360
xor r15d, r15d
cmp byte [rsi + 2], r15b
je 0x16550
movzx r8d, word [rbx]
mov rcx, rsi
call fcn.000163c8
mov ecx, r8d
add ecx, ecx
cmp ecx, eax
jge 0x16550
movzx eax, word [r12 + 3]
xor ebx, ebx
mov rcx, rsi
mov word [rsi + r8*2 + 0x1f2], ax
mov byte [rsp + 0x130], bl
mov r13b, bl
call fcn.000163c8
lea rdx, [rsi + 0x1f2]
lea rcx, [0x00019f70]
mov r8d, eax
mov r9, rsi
call fcn.00011640
cmp eax, ebx
jne 0x16550
mov byte [rsp + 0x130], bl
jmp 0x16550
lea rbx, [r12 + 1]
mov r8, rsi
mov edx, 2
mov rcx, rbx
call fcn.00016360
xor r15d, r15d
cmp byte [rsi + 2], r15b
je 0x16550
movzx r8d, word [rbx]
mov rcx, rsi
call fcn.000163c8
mov ecx, r8d
add ecx, ecx
cmp ecx, eax
jge 0x16550
mov eax, dword [rsi + r8*2 + 0x1f2]
lea rdx, [rsp + 0x132]
mov byte [rsp + 0x130], r15b
mov dword [rdx], eax
movzx eax, word [rsi + r8*2 + 0x1f6]
jmp 0x168d0
lea rbx, [r12 + 1]
mov r8, rsi
mov edx, 4
mov rcx, rbx
call fcn.00016360
mov r8d, dword [rsi + 0x188]
xor r15d, r15d
cmp dword [rbx], r8d
jne 0x16550
cmp byte [rsi + 1], 1
jne 0x16550
mov rcx, rsi
mov byte [rsp + 0x130], r15b
call fcn.000163c8
mov rcx, rsi
mov byte [rsp + 0x132], al
call fcn.000163c8
mov r13b, 1
sar eax, 8
mov byte [rsp + 0x134], 0x10
lea ebp, [r15 + 3]
mov byte [rsi + 2], r13b
mov dword [0x00013268], r8d
mov byte [rsp + 0x133], al
jmp 0x16550
movzx eax, word [r12 + 1]
mov ecx, 0xa
mov byte [rsp + 0x130], bl
mov word [rsi + 4], ax
movzx eax, byte [rsi + 0x186]
mov word [rsi + 6], 0xa0cb
cmp al, 5
mov byte [rsi + 3], sil
mov byte [rsi + 1], 1
cmova ecx, eax
movzx eax, si
mov byte [rsp + 0x132], 2
shr ax, 8
mov byte [rsp + 0x134], bl
mov byte [rsp + 0x135], sil
mov byte [rsp + 0x133], cl
mov ebp, 5
mov byte [rsp + 0x136], al
jmp 0x1654a
cmp byte [rsi + 2], bl
je 0x1654d
mov eax, dword [r15]
lea rcx, [r12 + 1]
mov r8, rsi
mov edx, 4
mov dword [rsi + 0x120e], eax
call fcn.00016360
mov edx, dword [rsi + 0x120e]
mov rcx, r14
call fcn.00016360
movzx edx, word [r12 + 1]
lea rcx, [0x0001a030]
call sub.ntoskrnl.exe_DbgPrint
cmp word [r12 + 1], 3
lea rcx, [0x0001a040]
seta al
movzx edx, al
mov byte [rsi + 0x1212], al
call sub.ntoskrnl.exe_DbgPrint
mov ecx, 7
cmp word [r12 + 1], cx
jae 0x167ce
movzx r8d, byte [r12 + 1]
jmp 0x167d4
mov r8d, 8
mov byte [rsi + 0x1213], r8b
mov ebx, 0x30
lea rcx, [rsi + 0x1214]
mov r8, rbx
xor edx, edx
call fcn.000120d0
movsxd r11, dword [rsi + 0x120e]
cmp r11d, ebx
jae 0x16800
mov rbx, r11
lea rcx, [rsi + 0x1214]
mov r8, rbx
mov rdx, r14
call fcn.00011d80
call fcn.00011908
jmp 0x1775b
cmp byte [rsi + 2], bl
je 0x1654d
lea rcx, [r12 + 1]
mov r8, rsi
mov edx, 4
call fcn.00016360
movzx eax, byte [r12 + 1]
movzx edi, byte [r12 + 4]
lea rbx, [rax + rsi + 0x1b2]
mov r8, rdi
mov rdx, r14
mov rcx, rbx
mov dword [0x00013264], eax
mov dword [0x00013260], edi
call fcn.00011d80
mov r8, rsi
mov edx, edi
mov rcx, rbx
call fcn.00016360
xor r8d, r8d
mov dword [r15], r8d
jmp 0x1775b
lea rbx, [r12 + 1]
mov r8, rsi
mov edx, 2
mov rcx, rbx
call fcn.00016360
xor r15d, r15d
cmp byte [rsi + 2], r15b
je 0x16550
lea ecx, [r15 + 7]
cmp word [rbx], cx
ja 0x16550
movzx ecx, word [rbx]
lea rdx, [rsp + 0x132]
mov byte [rsp + 0x130], r15b
mov eax, dword [rsi + rcx*2 + 0x1a2]
mov dword [rdx], eax
movzx eax, word [rsi + rcx*2 + 0x1a6]
mov word [rdx + 4], ax
mov ebp, 6
mov r13b, 1
jmp 0x16550
mov ecx, edx
sub ecx, 0x98
je 0x17691
sub ecx, 4
je 0x17563
sub ecx, 1
je 0x173f3
sub ecx, 1
je 0x16ffe
sub ecx, 2
je 0x16fed
sub ecx, 1
je 0x16d3b
cmp ecx, 1
je 0x1694d
lea rcx, [0x0001a170]
call sub.ntoskrnl.exe_DbgPrint
movzx r11d, byte [rsp + 0x130]
cmp byte [rsi + 2], bl
cmovne r11d, ebx
mov dword [r15], ebx
mov byte [rsp + 0x130], r11b
jmp 0x1654d
lea rcx, [0x00019fc0]
call sub.ntoskrnl.exe_DbgPrint
movzx edx, word [r12 + 1]
mov r8d, dword [r15]
lea rcx, [0x00019fd0]
call sub.ntoskrnl.exe_DbgPrint
cmp word [r12 + 1], bx
jne 0x1775b
mov edi, 0x7c1
cmp dword [r15], edi
jne 0x1775b
mov r8d, 8
mov byte [rsp + 0x1b0], 0xff
mov byte [rsp + 0x1b1], 0xc0
lea ecx, [r8 - 1]
mov byte [rsp + 0x1b2], bl
mov byte [rsp + 0x1b3], bl
lea ebp, [rcx - 1]
mov byte [rsp + 0x1d7], cl
mov byte [rsp + 0x1b4], bl
lea ecx, [rbp + 4]
mov byte [rsp + 0x1b5], 4
mov byte [rsp + 0x1b6], 4
mov byte [rsp + 0x1b7], bl
mov byte [rsp + 0x1b8], 0xff
mov byte [rsp + 0x1b9], 0xc1
mov byte [rsp + 0x1e3], cl
mov byte [rsp + 0x1ba], bl
mov byte [rsp + 0x1bb], 4
mov byte [rsp + 0x1bc], bl
mov byte [rsp + 0x1bd], 1
mov byte [rsp + 0x1be], bl
mov byte [rsp + 0x1bf], 1
mov byte [rsp + 0x1c0], 0xff
mov byte [rsp + 0x1c1], 0xc2
mov byte [rsp + 0x1c2], bl
mov byte [rsp + 0x1c3], 5
mov byte [rsp + 0x1c4], bl
mov byte [rsp + 0x1c5], 0xfd
mov byte [rsp + 0x1c6], bl
mov byte [rsp + 0x1c7], 2
mov byte [rsp + 0x1c8], 0xff
mov byte [rsp + 0x1c9], 0xc8
mov byte [rsp + 0x1ca], 1
mov byte [rsp + 0x1cb], 2
mov byte [rsp + 0x1cc], bl
mov byte [rsp + 0x1cd], r8b
mov byte [rsp + 0x1ce], 4
mov byte [rsp + 0x1cf], 3
mov byte [rsp + 0x1d0], 0xff
mov byte [rsp + 0x1d1], 0xc9
mov byte [rsp + 0x1d2], 2
mov byte [rsp + 0x1d3], 0x89
mov byte [rsp + 0x1d4], bl
mov byte [rsp + 0x1d5], 2
mov byte [rsp + 0x1d6], bl
mov byte [rsp + 0x1d8], 0xff
mov byte [rsp + 0x1d9], 0xcc
mov byte [rsp + 0x1da], 2
mov byte [rsp + 0x1db], 0x8b
mov byte [rsp + 0x1dc], bl
mov byte [rsp + 0x1dd], bpl
mov byte [rsp + 0x1de], 4
mov byte [rsp + 0x1df], 0xd
mov byte [rsp + 0x1e0], 0xff
mov byte [rsp + 0x1e1], 0xf4
mov byte [rsp + 0x1e2], 1
mov byte [rsp + 0x1e4], bl
mov byte [rsp + 0x1e5], 0xfc
mov byte [rsp + 0x1e6], bl
mov byte [rsp + 0x1e7], 4
mov byte [rsp + 0x1e8], 0xff
mov byte [rsp + 0x1e9], 0xf5
mov byte [rsp + 0x1ea], 2
mov byte [rsp + 0x1eb], bpl
mov byte [rsp + 0x1ec], bl
mov byte [rsp + 0x1ed], 0x80
mov byte [rsp + 0x1ee], bl
mov byte [rsp + 0x1ef], 5
mov byte [rsp + 0x1f0], 0xff
mov byte [rsp + 0x1f1], 0xca
mov byte [rsp + 0x1f2], 2
mov byte [rsp + 0x1f3], 0x86
mov byte [rsp + 0x1f4], bl
mov byte [rsp + 0x1f5], 3
mov byte [rsp + 0x1f6], bl
mov byte [rsp + 0x1f7], bpl
mov byte [rsp + 0x1f8], 0xff
mov byte [rsp + 0x1f9], 0xcd
mov byte [rsp + 0x1fa], 2
mov byte [rsp + 0x1fb], 0x91
mov byte [rsp + 0x1fc], bl
lea rcx, [rsp + 0x340]
mov r8, rdi
mov edx, 0xff
mov byte [rsp + 0x1fd], 1
mov byte [rsp + 0x1fe], bl
mov byte [rsp + 0x1ff], 9
mov byte [rsp + 0x200], 0xff
mov byte [rsp + 0x201], 0xcb
mov byte [rsp + 0x202], 2
mov byte [rsp + 0x203], 0x92
mov byte [rsp + 0x204], bl
mov byte [rsp + 0x205], 1
mov byte [rsp + 0x206], bl
mov byte [rsp + 0x207], 0xb
mov byte [rsp + 0x208], bl
mov byte [rsp + 0x209], 0xc8
mov byte [rsp + 0x20a], 2
mov byte [rsp + 0x20b], 0x93
mov byte [rsp + 0x20c], bl
mov byte [rsp + 0x20d], 3
mov byte [rsp + 0x20e], bl
mov byte [rsp + 0x20f], 0xc
mov byte [rsp + 0x210], bl
mov byte [rsp + 0x211], 0xcc
mov byte [rsp + 0x212], 2
mov byte [rsp + 0x213], 0x96
mov byte [rsp + 0x214], bl
mov byte [rsp + 0x215], 3
mov byte [rsp + 0x216], bl
mov byte [rsp + 0x217], 0xc
mov byte [rsp + 0x218], 1
mov byte [rsp + 0x219], 0x2b
mov byte [rsp + 0x21a], 2
mov byte [rsp + 0x21b], 0x99
mov byte [rsp + 0x21c], bl
mov byte [rsp + 0x21d], 3
mov byte [rsp + 0x21e], bl
mov byte [rsp + 0x21f], 0xc
call fcn.000120d0
lea rcx, [rsp + 0x340]
lea rdx, [rsp + 0x1b0]
lea r8d, [rbp + 0x6a]
call fcn.00011d80
mov byte [rsp + 0xb00], bl
lea rdx, [rsp + 0x340]
mov r8, rdi
jmp 0x17753
lea rcx, [0x00019fa0]
call sub.ntoskrnl.exe_DbgPrint
movzx r11d, word [r12 + 1]
cmp r11d, ebx
je 0x16fe4
sub r11d, 1
je 0x16e59
sub r11d, 1
je 0x16db9
cmp r11d, 1
jne 0x1775b
mov byte [rsp + 0x198], bl
mov byte [rsp + 0x199], bl
mov byte [rsp + 0x19a], 0xaa
mov byte [rsp + 0x19b], bl
mov byte [rsp + 0x19c], bl
mov byte [rsp + 0x19d], bl
mov byte [rsp + 0x19e], bl
mov byte [rsp + 0x19f], bl
mov rax, qword [rsp + 0x198]
mov qword [r14], rax
jmp 0x1775b
mov al, byte [rsi + 0x1a5]
lea rcx, [rsp + 0x1a0]
mov byte [rsp + 0x1a4], bl
mov byte [rsp + 0x1a0], al
mov al, byte [rsi + 0x1a4]
mov byte [rsp + 0x1a5], bl
mov byte [rsp + 0x1a1], al
mov al, byte [rsi + 0x1a3]
mov byte [rsp + 0x1a6], 1
mov byte [rsp + 0x1a2], al
mov al, byte [rsi + 0x1a2]
mov byte [rsp + 0x1a7], bl
mov byte [rsp + 0x1a8], bl
mov byte [rsp + 0x1a9], 4
mov byte [rsp + 0x1aa], bl
mov byte [rsp + 0x1a3], al
mov byte [rsp + 0x1ab], bl
mov byte [rsp + 0x1ac], 1
mov byte [rsp + 0x1ad], bl
mov rax, qword [rcx]
mov qword [r14], rax
mov eax, dword [rcx + 8]
mov dword [r14 + 8], eax
movzx eax, word [rcx + 0xc]
mov word [r14 + 0xc], ax
jmp 0x1775b
mov al, byte [rsi + 0x1a5]
mov ebp, 6
mov byte [rsp + 0x16d], bl
mov byte [rsp + 0x168], al
mov al, byte [rsi + 0x1a4]
mov byte [rsp + 0x16c], bpl
mov byte [rsp + 0x169], al
mov al, byte [rsi + 0x1a3]
mov byte [rsp + 0x16e], bl
mov byte [rsp + 0x16a], al
mov al, byte [rsi + 0x1a2]
mov byte [rsp + 0x16f], bl
mov byte [rsp + 0x170], bl
mov byte [rsp + 0x171], 0xca
mov byte [rsp + 0x172], bl
mov byte [rsp + 0x16b], al
mov byte [rsp + 0x173], 0xe
mov byte [rsp + 0x174], bl
mov byte [rsp + 0x175], bl
mov byte [rsp + 0x176], 0x35
mov byte [rsp + 0x177], 0x88
mov byte [rsp + 0x178], 2
mov byte [rsp + 0x179], 0x24
mov byte [rsp + 0x17a], bl
mov byte [rsp + 0x17b], 2
mov byte [rsp + 0x17c], bl
mov byte [rsp + 0x17d], 2
mov byte [rsp + 0x17e], bl
mov byte [rsp + 0x17f], bl
mov byte [rsp + 0x180], 3
mov byte [rsp + 0x181], 0x15
mov byte [rsp + 0x182], 0x22
mov byte [rsp + 0x183], 0xc3
mov byte [rsp + 0x184], 0xb
mov byte [rsp + 0x185], bl
mov byte [rsp + 0x186], bl
mov byte [rsp + 0x187], bl
mov byte [rsp + 0x188], bl
mov byte [rsp + 0x189], bl
mov byte [rsp + 0x18a], bl
mov byte [rsp + 0x18b], bl
mov byte [rsp + 0x18c], 0xf8
mov byte [rsp + 0x18d], bl
mov byte [rsp + 0x18e], 3
mov byte [rsp + 0x18f], 0x7e
mov byte [rsp + 0x190], bl
mov byte [rsp + 0x191], 1
mov byte [rsp + 0x192], 0x32
mov byte [rsp + 0x193], 0x47
mov byte [rsp + 0x194], bl
mov byte [rsp + 0x195], bl
mov byte [rsp + 0x196], bl
lea rdx, [rsp + 0x168]
lea r8d, [rbp + 0x29]
jmp 0x17753
add byte [r14], 1
jmp 0x1775b
lea rcx, [0x00019f80]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1775b
cmp byte [rsi + 2], bl
je 0x1654d
call fcn.00011908
mov ebx, 0x30
lea rcx, [rsp + 0x168]
mov r8, rbx
xor edx, edx
call fcn.000120d0
movsxd r8, dword [rsi + 0x120e]
lea rdx, [rsi + 0x1214]
lea rcx, [rsp + 0x168]
call fcn.00011d80
xor r8d, r8d
lea r9, [rsi + 0x1244]
cmp byte [rsi + 0x1212], r8b
lea rdx, [0x0001a060]
lea rcx, [rsp + 0x240]
lea r8, str.RegistryMACHINESystemCurrentControlSetMultiKeyDumps
lea rax, [0x0001a050]
je 0x17075
lea rax, [0x0001a080]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_swprintf]
lea rdx, [rsp + 0x240]
lea rcx, [0x0001a090]
call sub.ntoskrnl.exe_DbgPrint
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x120]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor ecx, ecx
lea rax, [rsp + 0x120]
mov qword [rsp + 0xf8], rcx
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rcx
lea rcx, [rsp + 0xd8]
lea r8, [rsp + 0xf0]
mov edx, 0x20019
mov dword [rsp + 0xf0], ebx
mov dword [rsp + 0x108], 0x40
mov qword [rsp + 0x100], rax
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
xor r8d, r8d
cmp eax, r8d
jl 0x17326
lea rcx, [rsp + 0x240]
xor edx, edx
mov r8d, 0x100
call fcn.000120d0
mov r11d, dword [rsi + 0x120e]
cmp r11d, 0x10
je 0x171cd
cmp r11d, 0x20
je 0x17189
cmp r11d, ebx
jne 0x172e9
movzx r8d, byte [rsp + 0x174]
movzx eax, byte [rsp + 0x177]
movzx ecx, byte [rsp + 0x176]
movzx edx, byte [rsp + 0x175]
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x88], ecx
mov dword [rsp + 0x80], edx
mov dword [rsp + 0x78], r8d
lea r8, [0x0001a160]
jmp 0x1720f
movzx r8d, byte [rsp + 0x174]
movzx eax, byte [rsp + 0x177]
movzx ecx, byte [rsp + 0x176]
movzx edx, byte [rsp + 0x175]
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x88], ecx
mov dword [rsp + 0x80], edx
mov dword [rsp + 0x78], r8d
lea r8, [0x0001a150]
jmp 0x1720f
movzx r8d, byte [rsp + 0x174]
movzx eax, byte [rsp + 0x177]
movzx ecx, byte [rsp + 0x176]
movzx edx, byte [rsp + 0x175]
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x88], ecx
mov dword [rsp + 0x80], edx
mov dword [rsp + 0x78], r8d
lea r8, [0x0001a0a0]
movzx eax, byte [rsp + 0x16a]
movzx r10d, byte [rsp + 0x173]
movzx r11d, byte [rsp + 0x172]
movzx ebx, byte [rsp + 0x171]
movzx esi, byte [rsp + 0x170]
movzx ebp, byte [rsp + 0x16f]
movzx r12d, byte [rsp + 0x16e]
movzx r13d, byte [rsp + 0x16d]
movzx r14d, byte [rsp + 0x16c]
movzx r15d, byte [rsp + 0x16b]
movzx r9d, byte [rsp + 0x168]
mov dword [rsp + 0x70], r10d
mov dword [rsp + 0x68], r11d
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], eax
movzx eax, byte [rsp + 0x169]
lea rdx, [0x0001a0b0]
lea rcx, [rsp + 0x240]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_swprintf]
lea rdx, [rsp + 0x240]
lea rcx, [0x0001a140]
call sub.ntoskrnl.exe_DbgPrint
mov rsi, qword [rsp + 0x198]
mov r12, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xd8]
lea r8, [rsp + 0x168]
lea rdx, [rsp + 0x240]
mov r9d, 0x10
call fcn.00011818
mov rcx, qword [rsp + 0xd8]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
cmp ebx, eax
jge 0x173c6
mov al, byte [rsi + 0x1213]
cmp al, 2
jbe 0x17395
cmp al, 4
je 0x17342
mov ebp, 6
cmp al, bpl
jne 0x173c6
movsx r10d, byte [rsi + 0x188]
xor ebx, ebx
mov r11d, r10d
mov r9b, bl
movzx r8d, r9b
movzx eax, r9b
mov edx, r11d
mov cl, byte [rsp + r8 + 0x168]
sub edx, eax
sar edx, 5
mov al, cl
shl cl, 3
shr al, 5
xor dl, al
mov al, r10b
sub al, r9b
add r9b, 1
shl al, 3
xor al, cl
or dl, al
cmp r9b, 0x10
mov byte [rsp + r8 + 0x168], dl
jb 0x17352
jmp 0x173c8
xor ebx, ebx
mov r8b, bl
mov al, byte [rsi + 0x188]
movzx edx, r8b
mov cl, byte [rsp + rdx + 0x168]
sub al, r8b
add r8b, 1
ror cl, 3
xor cl, al
cmp r8b, 0x10
mov byte [rsp + rdx + 0x168], cl
jb 0x1739a
jmp 0x173c8
xor ebx, ebx
movsxd rbp, dword [rsi + 0x120e]
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x132]
mov r8, rbp
mov byte [rsp + 0x130], bl
call fcn.00011d80
jmp 0x1654a
cmp byte [rsi + 2], bl
je 0x1654d
mov ecx, 7
cmp dword [0x00013264], ecx
jl 0x1742b
lea r8d, [rcx + 0x31]
lea rdx, [rsi + 0x1b2]
lea rcx, [0x00019ff0]
mov r9, rsi
call fcn.00011640
xor r15d, r15d
jmp 0x165ff
movabs rax, 0xfffff78000000014
lea rdx, [rsp + 0xa0]
mov rbx, qword [rax]
mov rax, qword [rsi + 0x1ea]
lea rcx, [rbx + rax]
mov qword [rsp + 0xe0], rcx
lea rcx, [rsp + 0xe0]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
xor eax, eax
cmp dword [0x00013264], eax
jne 0x174bc
and byte [rsi + 0x1b2], 0x7f
mov cl, byte [rsi + 0x1b2]
call fcn.0001178c
mov cl, byte [rsi + 0x1b3]
movzx r8d, al
mov word [rsp + 0xaa], r8w
call fcn.0001178c
mov cl, byte [rsi + 0x1b4]
movzx r8d, al
mov word [rsp + 0xa8], r8w
call fcn.0001178c
movzx r8d, al
mov word [rsp + 0xa6], r8w
jmp 0x17518
mov cl, byte [rsi + 0x1b5]
call fcn.0001178c
mov cl, byte [rsi + 0x1b6]
movzx r8d, al
mov word [rsp + 0xa4], r8w
call fcn.0001178c
mov cl, byte [rsi + 0x1b8]
movzx r8d, al
mov word [rsp + 0xa2], r8w
call fcn.0001178c
movzx r8d, al
cmp r8d, 0x5a
jge 0x17509
add r8w, 0x7d0
jmp 0x1750f
add r8w, 0x76c
mov word [rsp + 0xa0], r8w
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_RtlTimeFieldsToTime]
mov r11, qword [rsp + 0xe8]
lea rdx, [rsi + 0x1ea]
sub r11, rbx
lea rcx, [0x0001a010]
mov r9, rsi
mov r8d, 8
mov qword [rsi + 0x1ea], r11
call fcn.00011640
xor ebx, ebx
jmp 0x17423
cmp byte [rsi + 2], bl
je 0x1654d
mov byte [rsp + 0x130], bl
lea rbx, [r12 + 1]
mov r8, rsi
mov rcx, rbx
mov edx, 4
call fcn.00016360
movabs rax, 0xfffff78000000014
lea rdx, [rsp + 0xb0]
mov rax, qword [rax]
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsi + 0x1ea]
add qword [rsp + 0xd0], rax
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
movzx ebp, word [rbx]
movzx eax, bpl
xor r15d, r15d
cmp ax, r15w
jne 0x175fa
mov cl, byte [rsp + 0xb6]
call fcn.0001175c
mov cl, byte [rsp + 0xb8]
mov byte [rsp + 0x134], al
call fcn.0001175c
mov cl, byte [rsp + 0xba]
jmp 0x1764f
cmp eax, 3
jne 0x17664
movsx ecx, word [rsp + 0xb0]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub ecx, edx
call fcn.0001175c
mov cl, byte [rsp + 0xbe]
mov byte [rsp + 0x135], al
call fcn.0001175c
mov cl, byte [rsp + 0xb2]
mov byte [rsp + 0x134], al
call fcn.0001175c
mov cl, byte [rsp + 0xb4]
mov byte [rsp + 0x133], al
call fcn.0001175c
mov byte [rsp + 0x132], al
jmp 0x17686
movzx eax, word [rbx]
movzx ecx, al
mov r8, rax
lea rdx, [rcx + rsi + 0x1b2]
lea rcx, [rsp + 0x132]
shr r8, 8
call fcn.00011d80
movzx ebp, bp
shr ebp, 8
jmp 0x168d9
lea rbx, [r12 + 1]
mov r8, rsi
mov edx, 4
mov rcx, rbx
call fcn.00016360
xor r15d, r15d
cmp byte [rsi + 2], r15b
je 0x16550
mov eax, dword [rbx]
lea rdx, [rsi + 0x11f2]
lea rcx, [rsp + 0x132]
mov dword [rsp + 0x132], eax
mov byte [rsp + 0x130], r15b
call fcn.00011a74
lea ebp, [r15 + 4]
jmp 0x168d9
mov bl, byte [rsp + 0x131]
mov dil, byte [rsp + 0x130]
lea rcx, [rsp + 0x130]
mov r8, rsi
mov edx, 2
call fcn.00016360
cmp r13b, r15b
je 0x17719
lea rcx, [rsp + 0x132]
mov edx, ebp
call fcn.00016360
cmp dil, r15b
jne 0x1772f
and word [rsi + 6], 0xff
movzx eax, bl
shl ax, 8
or word [rsi + 6], ax
mov rdx, qword [rsp + 0x1a0]
mov eax, ebp
mov ecx, dword [rdx]
add rax, 2
cmp rax, rcx
cmovb rcx, rax
mov dword [rdx], ecx
lea rdx, [rsp + 0x130]
mov r8d, ecx
mov rcx, r14
call fcn.00011d80
mov rcx, qword [rsp + 0xb10]
xor rcx, rsp
call fcn.00011d10
add rsp, 0xb28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret