Function at 0x1403481e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1e8
mov qword [rsp + 0x98], r9
mov qword [rsp + 0x80], r8
mov r14, rdx
mov qword [rsp + 0x70], rcx
mov r13, qword [rsp + 0x288]
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0x90], rax
mov r15, qword [rsp + 0x270]
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x88], rax
mov edi, dword [rsp + 0x260]
mov rbp, qword [rsp + 0x258]
mov rax, qword [rsp + 0x250]
mov qword [rsp + 0x68], rax
mov eax, edi
and eax, 0x1f
cmp eax, 9
jbe 0x140348336
cmp eax, 0xf
jae 0x14034841c
cmp eax, 0xc
jae 0x14034849a
cmp eax, 0xa
jne 0x14034863a
lea rcx, [rsp + 0xac]
mov r8d, 0x110
xor edx, edx
call fcn.1405c44a0
mov dword [rsp + 0xa0], 0x11c
xor ecx, ecx
mov edx, 2
mov r8b, 3
call fcn.140326750
mov rcx, rax
mov edx, 1
mov r8b, 3
call fcn.140326750
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call fcn.140326750
mov rsi, rax
mov qword [rsp + 0xa4], 0xa
mov word [rsp + 0x1b4], 0
call fcn.140326cb0
mov rcx, qword [0x14074ad58]
mov edx, dword [0x14074ad44]
add eax, edx
add eax, 0xc9ec
cdqe
add rax, rcx
lea rcx, [rsp + 0xa0]
mov edx, 0x23
mov r8, rsi
call qword [0x140704440]
xor esi, esi
test eax, eax
setne sil
jmp 0x1403496a7
cmp eax, 4
jae 0x140348445
cmp eax, 1
jbe 0x140348545
cmp eax, 3
jne 0x1403486e9
cmp rbp, r14
je 0x140348a89
nop
mov r12d, dword [0x14074aef0]
mov rax, qword [rsp + 0x90]
lea rbx, [rax + 0x10]
mov rsi, rbp
test dil, 0x20
jne 0x140349005
mov eax, 0x6e57f4b5
mov ecx, 0x91a80b5b
mov edx, 0x6e57f4b6
mov r8d, 0x91a80b5a
xor r9d, r9d
mov r10d, 0xf0f0f0f1
lea r11, [0x1407468d0]
lea rsi, [0x1405fa000]
nop word [rax + rax]
mov ebx, r8d
imul rbx, r10
shr rbx, 0x24
lea r12d, [rdx + rbx]
shl ebx, 4
add ebx, r12d
movzx r12d, byte [r9 + r11]
xor r12b, byte [rbx + rsi]
xor r12b, 0x4c
mov byte [r9 + r11], r12b
cmp r9, 0x10
je 0x140348a22
mov ebx, ecx
imul rbx, r10
shr rbx, 0x24
lea r12d, [rax + rbx]
shl ebx, 4
add ebx, r12d
movzx r12d, byte [r9 + r11 + 1]
mov ebx, ebx
xor r12b, byte [rbx + rsi]
xor r12b, 0x4c
mov byte [r9 + r11 + 1], r12b
add r9, 2
add eax, 0xfffffffe
add ecx, 2
add edx, 0xfffffffe
add r8d, 2
jmp 0x1403483b0
jne 0x140348571
mov ecx, r13d
mov rdx, qword [rsp + 0x68]
mov r8d, ebp
mov r9, qword [rsp + 0x88]
call fcn.140326480
movzx esi, al
and esi, 1
jmp 0x1403496a7
cmp eax, 6
jbe 0x140348598
cmp eax, 7
je 0x140348792
cmp eax, 9
jne 0x14034883a
nop
cmp qword [0x140791600], 0
jne 0x1403491d6
nop
movzx eax, byte [0x140746829]
cmp al, 0x72
je 0x140348f26
mov cl, 0xd7
mov al, 0x18
lock cmpxchg byte [0x140746829], cl
je 0x140348efe
cmp al, 0x72
jne 0x140348481
jmp 0x140348f26
je 0x1403487ac
cmp eax, 0xe
jne 0x140348874
nop
mov rbx, qword [rsp + 0x68]
test rbx, rbx
jle 0x140348923
mov rbx, qword [rsp + 0x68]
jmp 0x140348502
cmp rbx, r15
cmovb r15, rbx
lea rsi, [r15 + r15]
mov rcx, r14
mov edx, 0xbaa92ae0
mov r8, rsi
call fcn.14034b8a0
mov rax, qword [rbp + 0x58]
sub dword [rax], r15d
mov rax, qword [rbp + 0x40]
add qword [rax], rsi
test dil, 0x20
je 0x140348859
sub rbx, r15
lea r14, [r14 + r15*2]
test rbx, rbx
jle 0x140348923
nop
mov rax, qword [rbp + 0x40]
mov r9, qword [rax]
test r9, r9
je 0x14034851c
nop
mov rax, qword [rbp + 0x58]
mov r15d, dword [rax]
test r15d, r15d
jg 0x1403484bf
nop
movzx edx, word [r14]
mov rax, qword [rbp]
mov rax, qword [rax + 0x18]
mov rcx, rbp
call qword [0x140704440]
cmp ax, 0xffff
je 0x140348923
add r14, 2
dec rbx
jmp 0x1403484f9
test eax, eax
je 0x140348738
nop
cmp qword [0x140791640], 0
jne 0x140348bf5
nop
movzx eax, byte [0x140746979]
cmp al, 0xb1
jne 0x140348940
jmp 0x140348a54
cmp eax, 0x11
ja 0x140348723
jne 0x140348931
mov rcx, r15
mov rdx, qword [rsp + 0x90]
call fcn.14030f8c0
mov rsi, r15
jmp 0x1403496a7
cmp eax, 4
je 0x1403487d2
cmp eax, 6
jne 0x1403488ae
nop
mov r12, qword [rsp + 0x78]
test r12, r12
mov rdi, r12
jle 0x140348787
mov rdi, r12
jmp 0x1403485f9
cmp rdi, rbx
cmovb rbx, rdi
lea rsi, [rbx + rbx]
mov edx, 0xb6103400
mov r8, rsi
mov r9, r14
call fcn.14034b8a0
lea r14, [r14 + rbx*2]
sub rdi, rbx
mov rax, qword [r15 + 0x50]
sub dword [rax], ebx
mov rax, qword [r15 + 0x38]
add qword [rax], rsi
test rdi, rdi
jle 0x140348787
nop
mov rax, qword [r15 + 0x38]
mov rcx, qword [rax]
test rcx, rcx
je 0x140348611
nop
mov rax, qword [r15 + 0x50]
mov ebx, dword [rax]
test ebx, ebx
jg 0x1403485c1
nop
mov rax, qword [r15]
mov rax, qword [rax + 0x38]
mov rcx, r15
call qword [0x140704440]
cmp ax, 0xffff
je 0x140348787
nop
mov word [r14], ax
add r14, 2
dec rdi
jmp 0x1403485f0
lea rcx, [rsp + 0xac]
mov r8d, 0x110
xor edx, edx
call fcn.1405c44a0
mov dword [rsp + 0xa0], 0x11c
xor ecx, ecx
mov edx, 2
mov r8b, 3
call fcn.140326750
mov rcx, rax
mov edx, 1
mov r8b, 3
call fcn.140326750
mov rcx, rax
mov edx, 0x20
mov r8b, 3
call fcn.140326750
mov rsi, rax
movabs rax, 0x300000006
mov qword [rsp + 0xa4], rax
mov word [rsp + 0x1b4], 0
call fcn.140326ce0
mov rcx, qword [0x14074ad08]
mov edx, dword [0x14074acf4]
add eax, edx
add eax, 0xadea
cdqe
add rax, rcx
lea rcx, [rsp + 0xa0]
mov edx, 0x23
mov r8, rsi
call qword [0x140704440]
xor esi, esi
test eax, eax
setne sil
jmp 0x1403496a7
nop
cmp qword [0x1407915c8], 0
jne 0x140348df4
nop
movzx eax, byte [0x140746729]
cmp al, 0x7e
je 0x140348cf0
mov cl, 0x5a
mov al, 0xd
lock cmpxchg byte [0x140746729], cl
je 0x140348cc8
cmp al, 0x7e
jne 0x14034870a
jmp 0x140348cf0
cmp eax, 0x12
jne 0x140348969
nop
mov esi, dword [0x14074aef0]
jmp 0x1403496a7
nop
mov rsi, qword [rsp + 0x98]
cmp rsi, qword [rsp + 0x68]
je 0x1403496a7
nop dword [rax]
nop
movzx r8d, word [rsi]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
mov rdx, qword [rsp + 0x70]
call qword [0x140704440]
test al, al
jne 0x1403496a7
add rsi, 2
cmp rsi, qword [rsp + 0x68]
jne 0x140348750
jmp 0x1403496a7
sub r12, rdi
mov rsi, r12
jmp 0x1403496a7
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0x10
mov ecx, r14d
call fcn.140095760
movzx esi, ax
jmp 0x1403496a7
nop
mov rcx, qword [rsp + 0x80]
mov rdx, rbp
add rsp, 0x1e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rsi, [rsp + 0xa0]
mov r8d, 0x10
mov rcx, qword [rsp + 0x70]
mov edx, 0xbef5aaa0
mov r9, rsi
call fcn.14034b8a0
mov qword [rsp + 0x58], rsi
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x48], 0x54e5883a
mov rsi, qword [rsp + 0x68]
mov rdx, rsi
call fcn.140336fd0
lea rax, [0x1405e8038]
mov qword [rsi], rax
jmp 0x1403496a7
nop
cmp qword [0x1407915d8], 0
jne 0x140348ef0
nop
movzx eax, byte [0x140746769]
cmp al, 0x30
je 0x140348c9d
mov cl, 0x25
mov al, 0x52
lock cmpxchg byte [0x140746769], cl
je 0x140348c75
cmp al, 0x30
jne 0x14034885b
jmp 0x140348c9d
nop
cmp qword [0x140791620], 0
jne 0x140348fde
nop
movzx eax, byte [0x1407468c9]
cmp al, 0x16
je 0x140348f71
mov cl, 0xa5
mov al, 0xa1
lock cmpxchg byte [0x1407468c9], cl
je 0x140348f51
cmp al, 0x16
jne 0x140348895
jmp 0x140348f71
nop
mov r14, qword [rsp + 0x88]
mov rbx, qword [r14]
call fcn.140326cb0
mov esi, 1
cmp qword [rbx + 0x50], 0
jne 0x1403496a7
mov ecx, eax
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xd0], xmm0
movdqa xmmword [rsp + 0xc0], xmm0
movdqa xmmword [rsp + 0xb0], xmm0
movdqa xmmword [rsp + 0xa0], xmm0
movzx eax, byte [0x1407461a6]
cmp al, 0x46
je 0x140349067
mov dl, 0xb
mov al, 0xdc
lock cmpxchg byte [0x1407461a6], dl
je 0x140349038
cmp al, 0x46
jne 0x14034890a
jmp 0x140349067
nop
mov rsi, qword [rsp + 0x68]
sub rsi, rbx
jmp 0x1403496a7
nop
cmp qword [0x140791580], 0
jne 0x1403492fa
test dil, 0x20
jne 0x140348ae7
mov cl, 0xd9
nop dword [rax]
mov al, 0x6a
lock cmpxchg byte [0x140746979], cl
je 0x140348a22
cmp al, 0xb1
jne 0x140348950
jmp 0x140348a54
cmp eax, 0x13
ja 0x140348a91
call fcn.140326cb0
mov rcx, qword [0x140748450]
mov edx, dword [0x140748444]
mov r14d, 0x79a7
sub r14d, eax
sub edx, r14d
movsxd rax, edx
add rax, rcx
mov r8, qword [rsp + 0x68]
and r8b, 1
mov rdx, qword [rsp + 0x70]
call qword [0x140704440]
mov esi, 1
test al, al
jne 0x1403496a7
nop
mov rcx, qword [0x140748460]
mov eax, dword [0x140748440]
sub eax, r14d
cdqe
add rax, rcx
mov ecx, 0x14d05cde
call qword [0x140704440]
test al, 1
jne 0x140349513
mov bl, 0x51
mov al, 0x14
lock cmpxchg byte [0x140746332], bl
je 0x140349452
nop
mov rcx, qword [0x140748458]
mov edx, dword [0x140748434]
sub edx, r14d
movsxd r8, edx
add r8, rcx
mov ecx, eax
mov edx, 0x966f9350
mov rax, r8
call qword [0x140704440]
test al, 1
je 0x1403489e2
jmp 0x140349513
test dil, 0x40
jne 0x140348ada
nop
movq xmm0, qword [0x140746970]
paddb xmm0, xmmword [0x1405f9550]
movq qword [0x140746970], xmm0
add byte [0x140746978], 0x4e
mov al, 0xb1
xchg byte [0x140746979], al
nop
movzx eax, byte [0x140746999]
cmp al, 0x55
je 0x140348ba8
mov cl, 0x39
nop word cs:[rax + rax]
mov al, 0x79
lock cmpxchg byte [0x140746999], cl
je 0x140348b12
cmp al, 0x55
jne 0x140348a70
jmp 0x140348ba8
mov rsi, rbp
jmp 0x1403496a7
cmp eax, 0x14
jne 0x140348c54
nop
cmp qword [0x1407915e8], 0
nop
mov rbx, qword [rsp + 0x78]
jne 0x140349674
nop
movzx eax, byte [0x1407467a9]
cmp al, 0x9f
je 0x140349568
mov cl, 0x70
mov al, 0x58
lock cmpxchg byte [0x1407467a9], cl
je 0x140349540
cmp al, 0x9f
jne 0x140348ac1
jmp 0x140349568
mov al, 0xff
xchg byte [0x1407468e1], al
jmp 0x140348f91
nop
movzx eax, byte [0x140746578]
cmp al, 0xd8
je 0x140349205
mov cl, 0xdd
mov al, 0x37
lock cmpxchg byte [0x140746578], cl
je 0x1403491ec
cmp al, 0xd8
jne 0x140348af9
jmp 0x140349205
mov ecx, 0xc91ad034
mov r8d, 0xc91ad032
xor r10d, r10d
movabs r11, 0x4ec4ec4ec4ec4ec5
lea rax, [0x1405fa070]
mov esi, 0xc91ad02e
add rsi, rax
lea rdi, [0x140746980]
mov rax, rcx
mul r11
mov r9, rdx
mov rax, r8
mul r11
shr rdx, 3
imul rax, rdx, 0xffffffffffffffe6
add rax, rsi
movzx edx, byte [r10 + rdi]
xor dl, byte [r10 + rax + 5]
xor dl, 0x65
mov byte [r10 + rdi], dl
cmp r10, 0x18
je 0x140348ba0
shr r9, 3
imul rax, r9, 0xffffffffffffffe6
add rax, rsi
add rax, 6
movzx edx, byte [r10 + rdi + 1]
xor dl, byte [rax + r10]
xor dl, 0x65
mov byte [r10 + rdi + 1], dl
add r10, 2
add rcx, 2
add r8, 2
jmp 0x140348b40
mov al, 0x55
xchg byte [0x140746999], al
nop
mov esi, dword [0x14074aef8]
lea rcx, [0x140746970]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x140348beb
mov ecx, 0x85da450f
xor rcx, rsi
mov qword [rsp + 0x58], rcx
lea rcx, [0x140746980]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0x9c00e0ac
mov r8, rax
call fcn.1403481e0
jmp 0x140348bed
xor eax, eax
nop
mov qword [0x140791640], rax
nop
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x80]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x78]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], r14d
mov rax, qword [rsp + 0x98]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r13d
mov rcx, qword [rsp + 0x70]
mov edx, r15d
mov r8, qword [rsp + 0x88]
mov r9, qword [rsp + 0x90]
call qword [0x140791640]
mov esi, eax
jmp 0x1403496a7
nop
mov rcx, qword [rsp + 0x78]
and cl, 1
add rsp, 0x1e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14059ca9c
nop
movq xmm0, qword [0x140746760]
paddb xmm0, xmmword [0x1405f9540]
movq qword [0x140746760], xmm0
add byte [0x140746768], 0x13
mov al, 0x30
xchg byte [0x140746769], al
nop
movzx eax, byte [0x14074677d]
cmp al, 0x13
je 0x140348ea3
mov cl, 0xba
mov al, 0xfa
lock cmpxchg byte [0x14074677d], cl
je 0x140348e02
cmp al, 0x13
jne 0x140348caf
jmp 0x140348ea3
nop
movq xmm0, qword [0x140746720]
paddb xmm0, xmmword [0x1405f9520]
movq qword [0x140746720], xmm0
add byte [0x140746728], 0x90
mov al, 0x7e
xchg byte [0x140746729], al
nop
movzx eax, byte [0x14074673d]
cmp al, 0x25
je 0x140348da7
mov cl, 0x16
mov al, 0xd
lock cmpxchg byte [0x14074673d], cl
je 0x140348d17
cmp al, 0x25
jne 0x140348d02
jmp 0x140348da7
mov eax, 1
mov ecx, 0x7c3415ca
mov edx, 0x83cbea40
mov r8d, 0x7c3415cb
mov r9d, 0x83cbea3f
mov r10d, 0xba2e8ba3
lea r11, [0x140746730]
lea rsi, [0x1405f9f20]
mov edi, r9d
imul rdi, r10
shr rdi, 0x23
lea ebx, [rdi + rdi*4]
lea edi, [rdi + rbx*2]
add edi, r8d
movzx ebx, byte [rdi + rsi]
xor bl, 0x99
add byte [rax + r11 - 1], bl
cmp rax, 0xd
je 0x140348d9f
mov edi, edx
imul rdi, r10
shr rdi, 0x23
lea ebx, [rdi + rdi*4]
lea edi, [rdi + rbx*2]
add edi, ecx
mov edi, edi
movzx ebx, byte [rdi + rsi]
xor bl, 0x99
add byte [rax + r11], bl
add rax, 2
add ecx, 0xfffffffe
add edx, 2
add r8d, 0xfffffffe
add r9d, 2
jmp 0x140348d46
mov al, 0x25
xchg byte [0x14074673d], al
nop
mov esi, dword [0x14074aef8]
lea rcx, [0x140746720]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x140348dea
mov ecx, 0x85da450f
xor rcx, rsi
mov qword [rsp + 0x58], rcx
lea rcx, [0x140746730]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0x9c00e0ac
mov r8, rax
call fcn.1403481e0
jmp 0x140348dec
xor eax, eax
nop
mov qword [0x1407915c8], rax
nop
call qword [0x1407915c8]
mov esi, eax
jmp 0x1403496a7
mov eax, 1
mov ecx, 0x35baee95
mov edx, 0xca451178
mov r8d, 0x35baee96
mov r9d, 0xca451176
mov r10d, 0x92492493
lea r11, [0x140746770]
lea rsi, [0x1405f9f40]
mov edi, r9d
shr edi, 1
imul rdi, r10
shr rdi, 0x22
lea ebx, [rdi + rdi]
shl edi, 4
sub edi, ebx
add edi, r8d
movzx ebx, byte [rax + r11 - 1]
xor bl, byte [rdi + rsi]
xor bl, 0x84
mov byte [rax + r11 - 1], bl
cmp rax, 0xd
je 0x140348e9b
mov edi, edx
shr edi, 1
imul rdi, r10
shr rdi, 0x22
lea ebx, [rdi + rdi]
shl edi, 4
sub edi, ebx
add edi, ecx
movzx ebx, byte [rax + r11]
mov edi, edi
xor bl, byte [rdi + rsi]
xor bl, 0x84
mov byte [rax + r11], bl
add rax, 2
add ecx, 0xfffffffe
add edx, 2
add r8d, 0xfffffffe
add r9d, 2
jmp 0x140348e31
mov al, 0x13
xchg byte [0x14074677d], al
nop
mov esi, dword [0x14074aef8]
lea rcx, [0x140746760]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x140348ee6
mov ecx, 0x85da450f
xor rcx, rsi
mov qword [rsp + 0x58], rcx
lea rcx, [0x140746770]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0x9c00e0ac
mov r8, rax
call fcn.1403481e0
jmp 0x140348ee8
xor eax, eax
nop
mov qword [0x1407915d8], rax
nop
call qword [0x1407915d8]
mov esi, eax
jmp 0x1403496a7
nop
movq xmm0, qword [0x140746820]
paddb xmm0, xmmword [0x1405f94f0]
movq qword [0x140746820], xmm0
add byte [0x140746828], 0xa3
mov al, 0x72
xchg byte [0x140746829], al
nop
movzx eax, byte [0x14074683c]
cmp al, 0x6d
je 0x14034913f
mov cl, 0xf8
mov al, 0x39
lock cmpxchg byte [0x14074683c], cl
je 0x140349106
cmp al, 0x6d
jne 0x140348f38
jmp 0x14034913f
movabs rax, 0x57515d7018965e57
xor qword [0x1407468c0], rax
xor byte [0x1407468c8], 0x5e
mov al, 0x16
xchg byte [0x1407468c9], al
nop
movzx eax, byte [0x1407468e1]
cmp al, 0xff
je 0x140348f91
xor esi, esi
mov cl, 0x16
mov al, 0xd2
lock cmpxchg byte [0x1407468e1], cl
je 0x140348ff6
cmp al, 0xff
jne 0x140348f81
nop
mov esi, dword [0x14074aef8]
lea rcx, [0x1407468c0]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x140348fd4
mov ecx, 0x85da450f
xor rcx, rsi
mov qword [rsp + 0x58], rcx
lea rcx, [0x1407468d0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0x9c00e0ac
mov r8, rax
call fcn.1403481e0
jmp 0x140348fd6
xor eax, eax
nop
mov qword [0x140791620], rax
mov rcx, rbp
mov edx, r15d
mov r8, qword [rsp + 0x70]
call qword [0x140791620]
mov esi, eax
jmp 0x1403496a7
xor ebx, ebx
mov r12d, ebp
test dil, 0x20
je 0x14034837b
xor r12d, 0xd73243e3
nop dword [rax]
nop
movzx edx, word [rsi]
mov dword [rsp + 0x20], 0x5fd599eb
mov r8, r12
mov r9, rbx
call fcn.14034aa50
mov word [rsi], ax
add rsi, 2
cmp rsi, r14
jne 0x140349010
jmp 0x1403496a7
nop
movdqa xmm0, xmmword [0x1407461a0]
pxor xmm0, xmmword [0x1405f94c0]
movd dword [0x1407461a0], xmm0
xor byte [0x1407461a4], 0x31
xor byte [0x1407461a5], 0x6b
mov al, 0x46
xchg byte [0x1407461a6], al
nop
mov rdx, qword [0x140748528]
mov eax, dword [0x140748508]
mov ebx, 0xffffbe63
sub ebx, ecx
sub eax, ebx
cdqe
add rax, rdx
mov ecx, 0xefb0476a
call qword [0x140704440]
mov rcx, qword [0x140748510]
mov eax, dword [0x140748500]
sub eax, ebx
cdqe
add rax, rcx
mov dword [rsp + 0x20], 0x40
lea rcx, [0x1407461b0]
lea rdx, [0x1407461a0]
lea r8, [0x1405ec9e0]
lea r9, [rsp + 0xa0]
call qword [0x140704440]
test eax, eax
je 0x140349100
nop
mov rcx, qword [r14]
add rcx, 0x38
mov rdx, qword [0x140748518]
mov eax, dword [0x140748504]
sub eax, ebx
cdqe
add rax, rdx
lea rdx, [rsp + 0xa0]
call qword [0x140704440]
jmp 0x140349182
test dil, 0x20
jne 0x140349182
nop
movq xmm0, qword [0x140746830]
paddb xmm0, xmmword [0x1405f9500]
movq qword [0x140746830], xmm0
movq xmm0, qword [0x140746838]
paddb xmm0, xmmword [0x1405f9510]
movd dword [0x140746838], xmm0
mov al, 0x6d
xchg byte [0x14074683c], al
nop
mov esi, dword [0x14074aef8]
lea rcx, [0x140746820]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x1403491cc
mov ecx, 0x85da450f
xor rcx, rsi
mov qword [rsp + 0x58], rcx
lea rcx, [0x140746830]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0x9c00e0ac
mov r8, rax
call fcn.1403481e0
jmp 0x1403491ce
nop
mov rcx, qword [0x140748528]
mov eax, dword [0x140748508]
sub eax, ebx
cdqe
add rax, rcx
mov ecx, 0xefb0476a
call qword [0x140704440]
movzx eax, byte [0x1407461c6]
cmp al, 0xf3
je 0x14034933c
mov cl, 0x23
mov al, 0xa0
lock cmpxchg byte [0x1407461c6], cl
je 0x14034930d
cmp al, 0xf3
jne 0x1403491b3
jmp 0x14034933c
xor eax, eax
nop
mov qword [0x140791600], rax
nop
mov rcx, qword [rsp + 0x80]
call qword [0x140791600]
mov esi, eax
jmp 0x1403496a7
movabs rax, 0xfc634b937e850a8d
xor qword [0x140746570], rax
mov al, 0xd8
xchg byte [0x140746578], al
nop
movzx eax, byte [0x1407465a6]
cmp al, 0xb8
je 0x1403492ad
mov cl, 0x2c
mov al, 0x93
lock cmpxchg byte [0x1407465a6], cl
je 0x14034922c
cmp al, 0xb8
jne 0x140349217
jmp 0x1403492ad
lea r8, [0x1405f9e30]
mov r9d, 0x8359e939
add r9, r8
mov r10d, 0x8359e938
xor r11d, r11d
movabs rsi, 0xd79435e50d79435f
lea rdi, [0x140746580]
mov ecx, 0x8359e938
mov rax, rcx
mul rsi
shr rdx, 5
imul rax, rdx, 0xffffffffffffffda
lea rdx, [r8 + r11]
add rdx, rax
movzx ebx, byte [r11 + rdi]
movzx ebp, byte [r11 + rdi + 1]
xor bl, byte [r10 + rdx]
xor bl, 0x77
mov byte [r11 + rdi], bl
xor bpl, byte [r9 + rax]
xor bpl, 0x77
mov byte [r11 + rdi + 1], bpl
add r11, 2
add r9, 2
add rcx, 2
cmp r11, 0x26
jne 0x14034925b
mov al, 0xb8
xchg byte [0x1407465a6], al
nop
mov esi, dword [0x14074aef8]
lea rcx, [0x140746570]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x1403492f0
mov ecx, 0x85da450f
xor rcx, rsi
mov qword [rsp + 0x58], rcx
lea rcx, [0x140746580]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0x9c00e0ac
mov r8, rax
call fcn.1403481e0
jmp 0x1403492f2
xor eax, eax
nop
mov qword [0x140791580], rax
nop
mov rcx, qword [rsp + 0x68]
call qword [0x140791580]
mov esi, eax
jmp 0x1403496a7
nop
movdqa xmm0, xmmword [0x1407461c0]
pxor xmm0, xmmword [0x1405f94d0]
movd dword [0x1407461c0], xmm0
xor byte [0x1407461c4], 7
xor byte [0x1407461c5], 0x92
mov al, 0xf3
xchg byte [0x1407461c6], al
nop
mov rcx, qword [0x140748510]
mov eax, dword [0x140748500]
sub eax, ebx
cdqe
add rax, rcx
mov dword [rsp + 0x20], 0xa
lea rcx, [0x1407461b0]
lea rdx, [0x1407461c0]
lea r8, [0x1405efeb2]
lea r9, [rsp + 0xa0]
call qword [0x140704440]
test eax, eax
je 0x1403493aa
nop
mov rcx, qword [r14]
add rcx, 0x60
mov rdx, qword [0x140748518]
mov eax, dword [0x140748504]
sub eax, ebx
cdqe
add rax, rdx
lea rdx, [rsp + 0xa0]
call qword [0x140704440]
nop
mov rcx, qword [0x140748528]
mov eax, dword [0x140748508]
sub eax, ebx
cdqe
add rax, rcx
mov ecx, 0xefb0476a
call qword [0x140704440]
movzx eax, byte [0x1407461d6]
cmp al, 0xa4
je 0x140349418
mov cl, 0x6c
mov al, 0xfb
lock cmpxchg byte [0x1407461d6], cl
je 0x1403493e9
cmp al, 0xa4
jne 0x1403493d7
jmp 0x140349418
nop
movdqa xmm0, xmmword [0x1407461d0]
pxor xmm0, xmmword [0x1405f94e0]
movd dword [0x1407461d0], xmm0
xor byte [0x1407461d4], 0xa0
xor byte [0x1407461d5], 0xa3
mov al, 0xa4
xchg byte [0x1407461d6], al
nop
mov rcx, qword [0x140748520]
mov eax, dword [0x14074850c]
sub eax, ebx
cdqe
add rax, rcx
lea rcx, [0x1407461b0]
lea rdx, [0x1407461d0]
xor r8d, r8d
call qword [0x140704440]
mov rcx, qword [r14]
mov dword [rcx + 0x88], eax
jmp 0x1403496a7
xor ebp, ebp
lea rdi, [rsp + 0x67]
lea rbx, [rsp + 0xa0]
nop
mov rcx, qword [0x140748470]
mov eax, dword [0x140748438]
sub eax, r14d
cdqe
add rax, rcx
mov ecx, ebp
mov rdx, rdi
mov r8, rbx
mov r9d, 0xfb06c601
call qword [0x140704440]
movzx edx, byte [rsp + 0x67]
mov rcx, qword [rsp + 0xa0]
mov r8, qword [0x140748478]
mov eax, dword [0x140748430]
sub eax, r14d
cdqe
add rax, r8
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0x2ec296cd
mov r8d, ebp
mov r9, rdi
call qword [0x140704440]
movzx ecx, byte [rsp + 0x67]
mov rdx, qword [rsp + 0xa0]
mov r8, qword [0x140748468]
mov eax, dword [0x140748448]
sub eax, r14d
cdqe
add rax, r8
mov dword [rsp + 0x20], 0xebb763b6
mov r8d, ebp
mov r9, rbx
call qword [0x140704440]
mov ebp, dword [rsp + 0xa0]
test al, 1
je 0x140349461
mov al, 0x2f
xchg byte [0x140746332], al
nop
mov rcx, qword [0x140748480]
mov eax, dword [0x14074843c]
sub eax, r14d
cdqe
add rax, rcx
lea rdx, [0x140746320]
mov rcx, qword [rsp + 0x70]
call qword [0x140704440]
jmp 0x1403496a7
nop
movq xmm0, qword [0x1407467a0]
paddb xmm0, xmmword [0x1405f9530]
movq qword [0x1407467a0], xmm0
add byte [0x1407467a8], 0xeb
mov al, 0x9f
xchg byte [0x1407467a9], al
nop
movzx eax, byte [0x1407467bf]
cmp al, 0xa8
je 0x140349627
mov cl, 0x69
mov al, 0xc2
lock cmpxchg byte [0x1407467bf], cl
je 0x14034958f
cmp al, 0xa8
jne 0x14034957a
jmp 0x140349627
mov ecx, 0x83bb3a0c
mov r8d, 0x83bb3a0b
xor r10d, r10d
movabs r11, 0x8888888888888889
lea rax, [0x1405f9f60]
mov esi, 0x83bb39ff
add rsi, rax
lea rdi, [0x1407467b0]
mov rax, rcx
mul r11
mov r9, rdx
mov rax, r8
mul r11
shr rdx, 3
mov rax, rdx
shl rax, 4
sub rdx, rax
add rdx, rsi
movzx eax, byte [r10 + rdx + 0xc]
xor al, 0x94
add byte [r10 + rdi], al
cmp r10, 0xe
je 0x14034961f
shr r9, 3
mov rax, r9
shl rax, 4
sub r9, rax
lea rax, [rsi + r9]
add rax, 0xd
movzx eax, byte [rax + r10]
xor al, 0x94
add byte [r10 + rdi + 1], al
add r10, 2
add rcx, 2
add r8, 2
jmp 0x1403495bd
mov al, 0xa8
xchg byte [0x1407467bf], al
nop
mov esi, dword [0x14074aef8]
lea rcx, [0x1407467a0]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x14034966a
mov ecx, 0x85da450f
xor rcx, rsi
mov qword [rsp + 0x58], rcx
lea rcx, [0x1407467b0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0x9c00e0ac
mov r8, rax
call fcn.1403481e0
jmp 0x14034966c
xor eax, eax
nop
mov qword [0x1407915e8], rax
nop
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r15
mov rcx, qword [rsp + 0x68]
mov rdx, rbx
mov r8d, ebp
mov r9, qword [rsp + 0x80]
call qword [0x1407915e8]
mov esi, eax
mov rax, rsi
add rsp, 0x1e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret