Function at 0x1400490bc
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Enumerate processes
Get process image filename

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x8e8]
sub rsp, 0x9c0
mov qword [rbp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rbp + 0x8b0], rax
mov r13, rcx
mov ebx, dword [0x1401aad80]
mov r8d, ebx
imul r8d, ebx
mov eax, 0x30c30c31
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
or rsi, 0xffffffffffffffff
lea eax, [rsi + 0x12]
cmp r8d, eax
jne 0x14004916e
mov eax, 0x51eb851f
imul ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub ebx, edx
add ebx, 0x141
movsxd rcx, ebx
lea eax, [rsi + 5]
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400bcf98
mov rcx, rax
call fcn.1400be048
mov ebx, dword [0x1401aad80]
xor r14d, r14d
mov word [rbp + 0x6a0], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x6a2]
call fcn.1400c2d60
mov qword [r13 + 0x1d8], r14
imul ebx, ebx
mov eax, 0x66666667
imul ebx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ebx, eax
lea r12d, [r14 + 0xf]
cmp ebx, r12d
jne 0x1400491c4
call fcn.1400be2e0
mov dword [0x1401aad80], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x58], r14d
mov r15d, 1
mov r8d, dword [0x1401aad80]
mov ebx, 2
cmp byte [r13 + 0x121], r14b
je 0x140049217
mov ebx, dword [r13 + 0x1e8]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, ebx
jb 0x14004920b
test ebx, ebx
jne 0x14004a16a
mov r8d, dword [0x1401aad80]
mov ebx, 2
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 0xd
jne 0x140049278
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x141
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400bcf98
mov rcx, rax
call fcn.1400be048
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
or rdi, 0xffffffffffffffff
cmp rax, rdi
je 0x14004a6cd
mov ebx, dword [0x1401aad80]
lea ecx, [rbx + 1]
imul ecx, ebx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
lea eax, [rdi + 8]
cmp ecx, eax
jne 0x1400492fc
mov eax, 0x51eb851f
imul ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub ebx, edx
add ebx, 0x141
movsxd rcx, ebx
lea eax, [rdi + 5]
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.1400bcf98
mov rcx, rax
call fcn.1400be048
mov ebx, dword [0x1401aad80]
xor edx, edx
mov r8d, 0x238
lea rcx, [rbp + 0x60]
call fcn.1400c2d60
lea ecx, [rbx + 2]
lea eax, [rbx + 1]
imul ecx, eax
imul ecx, ebx
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
cmp ecx, 4
jne 0x140049340
lea rcx, [rbp + 0x560]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov dword [rbp + 0x60], 0x238
mov dword [rsp + 0x30], r14d
lea rdx, [rbp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004a563
mov ebx, 7
mov eax, 0x63
mov word [rbp + 0x610], ax
mov dword [rbp + 0x614], 0x6f0072
mov eax, 0x6d
mov word [rbp + 0x618], ax
mov eax, 0x2e
mov word [rbp + 0x61c], ax
mov word [rbp + 0x624], r14w
mov qword [rbp + 0x2b0], r14
mov qword [rbp + 0x2b8], r14
mov qword [rbp + 0x2b8], rbx
mov qword [rbp + 0x2b0], r14
mov word [rbp + 0x2a0], r14w
cmp word [rbp + 0x8c], r14w
jne 0x1400493cf
mov r8, r14
jmp 0x1400493e3
lea rax, [rbp + 0x8c]
mov r8, rdi
inc r8
cmp word [rax + r8*2], r14w
jne 0x1400493d9
lea rdx, [rbp + 0x8c]
lea rcx, [rbp + 0x2a0]
call fcn.14004e0f4
nop
mov eax, 0x65
mov dword [rbp + 0x620], 0x650078
mov word [rbp + 0x61e], ax
mov word [rbp + 0x61a], ax
mov eax, 0x68
mov word [rbp + 0x612], ax
lea rax, [rbp + 0x610]
mov r8, rdi
inc r8
cmp word [rax + r8*2], r14w
jne 0x14004942a
lea rcx, [rbp + 0x2a0]
mov r9d, 8
cmp qword [rbp + 0x2b8], r9
cmovae rcx, qword [rbp + 0x2a0]
mov rdx, r8
mov r10, qword [rbp + 0x2b0]
cmp r10, r8
cmovb rdx, r10
test rdx, rdx
je 0x14004949e
lea r9, [rbp + 0x610]
movzx eax, word [r9]
cmp word [rcx], ax
jne 0x140049488
mov eax, 2
add rcx, rax
add r9, rax
sub rdx, r15
jne 0x14004946d
jmp 0x140049498
sbb eax, eax
and eax, 0xfffffffe
add eax, r15d
mov r9d, 8
jmp 0x1400494a1
mov r9d, 8
mov eax, r14d
movsxd rcx, eax
mov eax, r14d
cmp r10, r8
setne al
cmp r10, r8
cmovb eax, edi
test rcx, rcx
cmovne eax, ecx
test eax, eax
je 0x140049502
cmp qword [rbp + 0x2b8], r9
jb 0x1400494d2
mov rcx, qword [rbp + 0x2a0]
call fcn.1400bd904
mov qword [rbp + 0x2b8], rbx
mov qword [rbp + 0x2b0], r14
mov word [rbp + 0x2a0], r14w
lea rdx, [rbp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1400498fe
jmp 0x140049366
cmp dword [r13 + 0x2d8], r15d
jne 0x140049516
mov dword [r13 + 0x2d8], 2
mov r9d, dword [rbp + 0x80]
mov r12d, r9d
mov dword [rsp + 0x30], r9d
mov ecx, dword [0x1401aad80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x38e38e39
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 0xb
jne 0x1400495a6
lea ecx, [r8 + 0x1d]
call fcn.1400bcf98
mov rdi, rax
mov rbx, r14
mov r12d, 0xa
call fcn.1400be2e0
add eax, dword [0x1401aad80]
mov dword [rdi + rbx*4], eax
add rbx, r15
cmp rbx, r12
jl 0x14004956f
mov r12d, dword [rsp + 0x30]
mov ecx, dword [rdi + 0x24]
mov dword [0x1401aad80], ecx
mov rcx, rdi
call fcn.1400be048
mov r9d, dword [rbp + 0x80]
or rdi, 0xffffffffffffffff
mov r8d, r9d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r13 + 0x1d8], rax
test rax, rax
je 0x1400497e1
test r12d, r12d
je 0x1400497e1
mov r8d, 0x104
lea rdx, [rbp + 0x6a0]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x14004a1ea
cmp word [rbp + 0x6a0], r14w
jne 0x1400495fc
mov r8, r14
jmp 0x140049610
lea rax, [rbp + 0x6a0]
mov r8, rdi
inc r8
cmp word [rax + r8*2], r14w
jne 0x140049606
lea rdx, [rbp + 0x6a0]
lea rcx, [rbp + 0x2a0]
call fcn.14004e0f4
mov r8, qword [rbp + 0x2b0]
add r8, 0xfffffffffffffff6
mov r9, rdi
lea rdx, [rbp + 0x320]
lea rcx, [rbp + 0x2a0]
call fcn.14004dae4
mov rcx, rax
lea rax, [rbp + 0x610]
mov r8, rdi
inc r8
cmp word [rax + r8*2], r14w
jne 0x140049651
mov r10, qword [rcx + 0x10]
mov r11d, 8
cmp qword [rcx + 0x18], r11
jb 0x14004966e
mov rcx, qword [rcx]
mov rdx, r8
cmp r10, r8
cmovb rdx, r10
test rdx, rdx
je 0x1400496a9
lea r9, [rbp + 0x610]
movzx eax, word [r9]
cmp word [rcx], ax
jne 0x14004969f
mov eax, 2
add rcx, rax
add r9, rax
sub rdx, r15
jne 0x140049684
jmp 0x1400496a9
sbb eax, eax
and eax, 0xfffffffe
add eax, r15d
jmp 0x1400496ac
mov eax, r14d
movsxd rcx, eax
mov eax, r14d
cmp r10, r8
setne al
cmp r10, r8
cmovb eax, edi
test rcx, rcx
cmovne eax, ecx
test eax, eax
setne bl
cmp qword [rbp + 0x338], r11
jb 0x1400496de
mov rcx, qword [rbp + 0x320]
call fcn.1400bd904
mov edi, 7
mov qword [rbp + 0x338], rdi
mov qword [rbp + 0x330], r14
mov word [rbp + 0x320], r14w
test bl, bl
je 0x1400497a6
mov rcx, qword [r13 + 0x1d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12d, dword [rbp + 0x68]
mov dword [rsp + 0x30], r12d
mov r8d, r12d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r10, rax
mov qword [r13 + 0x1d8], rax
mov r9d, dword [0x1401aad80]
mov r8d, r9d
imul r8d, r9d
mov eax, 0x2aaaaaab
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
lea eax, [rdi + 0xd]
cmp r8d, eax
jne 0x14004977f
mov ecx, r15d
cmp r9d, r15d
jle 0x140049779
mov eax, r9d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r9d
jl 0x14004976a
mov dword [0x1401aad80], ecx
test r10, r10
je 0x14004a1ae
mov r8d, 0x104
lea rdx, [rbp + 0x6a0]
mov rcx, r10
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x14004a172
mov ebx, 8
cmp qword [rbp + 0x2b8], rbx
jb 0x1400497c0
mov rcx, qword [rbp + 0x2a0]
call fcn.1400bd904
mov qword [rbp + 0x2b8], rdi
mov qword [rbp + 0x2b0], r14
mov word [rbp + 0x2a0], r14w
mov r12d, 0xf
jmp 0x140049903
mov eax, dword [0x1401aad80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
and ecx, 0x80000007
jge 0x140049800
sub ecx, r15d
or ecx, 0xfffffff8
add ecx, r15d
mov r12d, 6
cmp ecx, r12d
jne 0x140049821
lea edx, [r12 + 0x6c]
lea r8d, [r12 + 0x6d]
lea rcx, str._d__d_n
call fcn.1400be234
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ebx, dword [rbp + 0x68]
mov dword [rsp + 0x30], ebx
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r13 + 0x1d8], rax
mov edx, dword [0x1401aad80]
lea r8d, [rdx + 2]
lea ecx, [rdx + 1]
imul r8d, ecx
imul r8d, edx
mov eax, 0x38e38e39
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 0xb
jne 0x140049896
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rcx, qword [r13 + 0x1d8]
test rcx, rcx
je 0x14004a3c8
mov edi, 0x104
mov r8d, edi
lea rdx, [rbp + 0x6a0]
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x14004a38c
mov ebx, 8
cmp qword [rbp + 0x2b8], rbx
jb 0x1400498dd
mov rcx, qword [rbp + 0x2a0]
call fcn.1400bd904
mov eax, 7
mov qword [rbp + 0x2b8], rax
mov qword [rbp + 0x2b0], r14
mov word [rbp + 0x2a0], r14w
lea r12d, [rax + 8]
jmp 0x140049908
mov ebx, 8
mov edi, 0x104
mov rax, qword [r13 + 0x1d8]
add rax, r15
test rax, 0xfffffffffffffffe
jne 0x140049927
mov ecx, dword [r13 + 0x1e4]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [0x1401aad80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, ebx
jne 0x1400499a5
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mov eax, 4
mul rcx
mov rsi, 0xffffffffffffffff
cmovo rax, rsi
mov rcx, rax
call fcn.1400bcf98
mov rcx, rax
call fcn.1400be048
mov r8d, dword [0x1401aad80]
jmp 0x1400499a9
or rsi, 0xffffffffffffffff
mov rax, qword [r13 + 0x1d8]
sub rax, r15
cmp rax, 0xfffffffffffffffd
ja 0x14004a115
lea rcx, [0x1401a29a8]
mov rax, qword [0x1401a29a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
mov r12d, r14d
lea rcx, [0x1401a29a8]
mov rax, qword [0x1401a29a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.14003ade4
test al, al
jne 0x140049a97
mov ecx, r15d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140049a29
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140002210
mov rbx, qword [rsp + 0x38]
cmp dword [rbx - 0xc], edi
jl 0x14004a226
mov dword [rbx - 0x10], edi
mov word [rbx + 0x208], r14w
mov r9d, edi
mov r8, rbx
xor edx, edx
mov rcx, qword [r13 + 0x1d8]
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x50]
call fcn.140002d5c
nop
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.14003f7c4
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002038
nop
mov rdx, qword [rbp - 0x80]
jmp 0x140049bf5
lea rax, [rbp - 0x40]
mov qword [rsp + 0x68], rax
lea rdx, [rbp + 0x6a0]
lea rcx, [rbp - 0x40]
call fcn.140001f6c
nop
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.14003f7c4
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002038
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140049aea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [0x1401aad80]
imul eax, eax
and eax, 0x8000000f
jge 0x140049b03
sub eax, r15d
or eax, 0xfffffff0
add eax, r15d
cmp eax, 0xf
jne 0x140049b14
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401aad80], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.140043bb8
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x14004a381
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
sub rax, rbx
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x140049b54
add rcx, 2
test dx, dx
jne 0x140049b3d
mov eax, r14d
jmp 0x140049b59
sbb eax, eax
or eax, r15d
test eax, eax
jne 0x140049c1c
mov r8, qword [rsp + 0x38]
mov ecx, r15d
sub ecx, dword [r8 - 8]
mov eax, dword [r8 - 0xc]
mov ebx, 0x104
sub eax, ebx
or eax, ecx
jge 0x140049b8d
mov edx, ebx
lea rcx, [rsp + 0x38]
call fcn.140002210
mov r8, qword [rsp + 0x38]
cmp dword [r8 - 0xc], ebx
jl 0x14004a231
mov dword [r8 - 0x10], ebx
mov word [r8 + 0x208], r14w
mov r9d, ebx
xor edx, edx
mov rcx, qword [r13 + 0x1d8]
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x68]
call fcn.140002d5c
nop
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.14003f7c4
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002038
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140049c0f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x40]
mov edi, eax
cmp dword [rbx - 0x10], r14d
je 0x140049c62
call fcn.140043bb8
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x14004a23c
mov rcx, rbx
sub rax, rbx
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x140049c55
add rcx, 2
test dx, dx
jne 0x140049c3e
mov eax, r14d
jmp 0x140049c5a
sbb eax, eax
or eax, r15d
test eax, eax
jne 0x14004a247
mov r10d, r14d
cmp edi, 0x714
jne 0x140049cb1
lea rcx, [rbp - 0x78]
call fcn.140040084
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002038
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140049ca3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r10d, eax
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 0x10], r14d
je 0x140049cf7
call fcn.140043bb8
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x14004a33b
mov rcx, rbx
sub rax, rbx
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x140049cea
add rcx, 2
test dx, dx
jne 0x140049cd3
mov eax, r14d
jmp 0x140049cef
sbb eax, eax
or eax, r15d
test eax, eax
jne 0x14004a247
mov qword [r13 + 0x1d8], r14
mov edx, r10d
lea rcx, [rbp + 0x400]
call fcn.1400420ac
mov rsi, rax
mov edx, edi
lea rcx, [rbp + 0x3c0]
call fcn.1400420ac
mov rdi, rax
mov edx, r12d
lea rcx, [rbp + 0x380]
call fcn.1400420ac
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x340]
call fcn.1400420ac
nop
lea r12, str.___:
mov r8, r12
mov rdx, rax
lea rcx, [rbp + 0x2e0]
call fcn.14002adf4
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x300]
call fcn.14004e5fc
nop
mov r8, r12
mov rdx, rax
lea rcx, [rbp + 0x3e0]
call fcn.14002adf4
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x360]
call fcn.14004e5fc
nop
mov r8, r12
mov rdx, rax
lea rcx, [rbp + 0x3a0]
call fcn.14002adf4
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x2c0]
call fcn.14004e5fc
nop
mov edi, 0x10
cmp qword [rbp + 0x3b8], rdi
jb 0x140049ddb
mov rcx, qword [rbp + 0x3a0]
call fcn.1400bd904
mov r12d, 0xf
mov qword [rbp + 0x3b8], r12
mov qword [rbp + 0x3b0], r14
mov byte [rbp + 0x3a0], r14b
cmp qword [rbp + 0x378], rdi
jb 0x140049e0b
mov rcx, qword [rbp + 0x360]
call fcn.1400bd904
mov qword [rbp + 0x378], r12
mov qword [rbp + 0x370], r14
mov byte [rbp + 0x360], r14b
cmp qword [rbp + 0x3f8], rdi
jb 0x140049e35
mov rcx, qword [rbp + 0x3e0]
call fcn.1400bd904
mov qword [rbp + 0x3f8], r12
mov qword [rbp + 0x3f0], r14
mov byte [rbp + 0x3e0], r14b
cmp qword [rbp + 0x318], rdi
jb 0x140049e5f
mov rcx, qword [rbp + 0x300]
call fcn.1400bd904
mov qword [rbp + 0x318], r12
mov qword [rbp + 0x310], r14
mov byte [rbp + 0x300], r14b
cmp qword [rbp + 0x2f8], rdi
jb 0x140049e89
mov rcx, qword [rbp + 0x2e0]
call fcn.1400bd904
mov qword [rbp + 0x2f8], r12
mov qword [rbp + 0x2f0], r14
mov byte [rbp + 0x2e0], r14b
cmp qword [rbp + 0x358], rdi
jb 0x140049eb3
mov rcx, qword [rbp + 0x340]
call fcn.1400bd904
mov qword [rbp + 0x358], r12
mov qword [rbp + 0x350], r14
mov byte [rbp + 0x340], r14b
cmp qword [rbp + 0x398], rdi
jb 0x140049edd
mov rcx, qword [rbp + 0x380]
call fcn.1400bd904
mov qword [rbp + 0x398], r12
mov qword [rbp + 0x390], r14
mov byte [rbp + 0x380], r14b
cmp qword [rbp + 0x3d8], rdi
jb 0x140049f07
mov rcx, qword [rbp + 0x3c0]
call fcn.1400bd904
mov qword [rbp + 0x3d8], r12
mov qword [rbp + 0x3d0], r14
mov byte [rbp + 0x3c0], r14b
cmp qword [rbp + 0x418], rdi
jb 0x140049f31
mov rcx, qword [rbp + 0x400]
call fcn.1400bd904
mov qword [rbp + 0x418], r12
mov qword [rbp + 0x410], r14
mov byte [rbp + 0x400], r14b
mov ebx, dword [rsp + 0x58]
mov eax, ebx
add ebx, r15d
mov dword [rsp + 0x58], ebx
cmp eax, 5
jge 0x14004a346
mov ecx, dword [0x1401aad80]
imul ecx, ecx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
mov eax, 0x14
or rsi, 0xffffffffffffffff
cmp ecx, eax
jne 0x140049fd8
mov rax, qword [str.oWzgrk8VQxFW]
mov qword [rsp + 0x70], rax
mov eax, dword [0x14013ddf8]
mov dword [rsp + 0x78], eax
mov al, byte [0x14013ddfc]
mov byte [rsp + 0x7c], al
lea rax, [rsp + 0x70]
mov rcx, rsi
inc rcx
cmp byte [rax + rcx], r14b
jne 0x140049fb3
mov eax, 4
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400bcf98
mov rcx, rax
call fcn.1400be048
lea rdx, [rbp + 0x2c0]
cmp qword [rbp + 0x2d8], rdi
cmovae rdx, qword [rbp + 0x2c0]
lea rcx, [rsp + 0x60]
call fcn.140002df8
nop
call fcn.140045d70
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.140001f6c
nop
lea r8, [rsp + 0x60]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.14000de60
nop
lea rcx, [r13 + 0x1c0]
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
call fcn.14000e884
nop
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004a050
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004a06f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004a08e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [r13 + 0x1e4]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp qword [rbp + 0x2d8], rdi
jb 0x14004a0b8
mov rcx, qword [rbp + 0x2c0]
call fcn.1400bd904
mov qword [rbp + 0x2d8], r12
mov qword [rbp + 0x2d0], r14
mov byte [rbp + 0x2c0], r14b
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004a0ed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004a10c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rsp + 0x48]
jmp 0x1400491db
mov ecx, r8d
imul ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, r12d
mov edi, dword [rsp + 0x48]
mov ebx, 2
jne 0x1400491e7
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
test rax, rax
jne 0x14004a10c
lea eax, [rbx + 5]
mov r8d, eax
mov dword [0x1401aad80], eax
jmp 0x1400491e7
mov eax, r15d
jmp 0x14004a709
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x480]
call fcn.1400420ac
mov rbx, rax
call fcn.140045bc4
mov rdx, rax
mov r8, rbx
lea rcx, [rbp + 0x40]
call fcn.1400469cc
lea rdx, [0x14016d588]
lea rcx, [rbp + 0x40]
call fcn.1400c57f8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x420]
call fcn.1400420ac
mov rbx, rax
call fcn.140046828
mov rdx, rax
mov r8, rbx
lea rcx, [rbp - 8]
call fcn.1400469cc
lea rdx, [0x14016d588]
lea rcx, [rbp - 8]
call fcn.1400c57f8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x500]
call fcn.1400420ac
mov rbx, rax
call fcn.140046664
mov rdx, rax
mov r8, rbx
lea rcx, [rbp + 0x50]
call fcn.1400469cc
lea rdx, [0x14016d588]
lea rcx, [rbp + 0x50]
call fcn.1400c57f8
nop
mov ecx, 0x80070057
call fcn.140001874
int3
mov ecx, 0x80070057
call fcn.140001874
int3
mov ecx, 0x80004005
call fcn.140001874
int3
lea rdx, str.0.0.0.0
mov rcx, rbx
call fcn.1400d1908
test eax, eax
jne 0x14004a2de
mov qword [r13 + 0x1d8], r14
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.140018bd8
nop
mov dl, 0x5c
lea rcx, [rsp + 0x50]
call fcn.14004d914
mov dl, 0x20
lea rcx, [rsp + 0x50]
call fcn.14004d914
mov dl, 0x2f
lea rcx, [rsp + 0x50]
call fcn.14004d914
mov r10, qword [rsp + 0x50]
sub r15d, dword [r10 - 8]
or r15d, dword [r10 - 0xc]
jge 0x14004a2b9
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140019894
mov r10, qword [rsp + 0x50]
call fcn.140045ad4
mov rdx, rax
mov r8, r10
lea rcx, [rbp + 0x18]
call fcn.140046914
lea rdx, [0x14016d588]
lea rcx, [rbp + 0x18]
call fcn.1400c57f8
nop
lea rcx, [r13 + 0x190]
lea rdx, [rsp + 0x40]
call fcn.140002038
mov eax, dword [rsp + 0x30]
mov dword [r13 + 0x1d0], eax
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004a315
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14004a334
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14004a709
mov ecx, 0x80004005
call fcn.140001874
nop
lea r10, [rbp + 0x2c0]
cmp qword [rbp + 0x2d8], rdi
cmovae r10, qword [rbp + 0x2c0]
call fcn.14004573c
mov rdx, rax
mov r8, r10
lea rcx, [rbp + 0x30]
call fcn.140046914
lea rdx, [0x14016d588]
lea rcx, [rbp + 0x30]
call fcn.1400c57f8
nop
mov ecx, 0x80004005
call fcn.140001874
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x4a0]
call fcn.1400420ac
mov r9, rax
call fcn.140044c68
mov rdx, rax
mov r8, r9
lea rcx, [rbp - 0x28]
call fcn.1400469cc
lea rdx, [0x14016d588]
lea rcx, [rbp - 0x28]
call fcn.1400c57f8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x4c0]
call fcn.1400420ac
mov rbx, rax
mov edx, edi
lea rcx, [rbp + 0x520]
call fcn.1400420ac
nop
lea r8, [0x14013aa10]
mov rdx, rax
lea rcx, [rbp + 0x440]
call fcn.14002adf4
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x460]
call fcn.14004e5fc
mov rbx, rax
mov r9d, dword [0x1401aad80]
mov r8d, r9d
imul r8d, r9d
imul r8d, r9d
mov eax, 0x2aaaaaab
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 0x12
jne 0x14004a46d
mov ecx, r15d
cmp r9d, r15d
jle 0x14004a464
mov eax, r9d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r9d
jl 0x14004a455
mov r9d, ecx
mov dword [0x1401aad80], ecx
lea rdi, [0x1401a6578]
cmp byte [0x1401acf19], r14b
jne 0x14004a543
lea ecx, [r9 + 2]
lea eax, [r9 + 1]
imul ecx, eax
imul ecx, r9d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
mov esi, 0x11
cmp ecx, esi
jne 0x14004a4c9
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov dword [rbp + 0x628], 0x4002e
mov dword [rbp + 0x62c], 0xd000c
mov dword [rbp + 0x630], 0x10036
mov dword [rbp + 0x634], 0x20004
mov dword [rbp + 0x638], 0x110004
mov dword [rbp + 0x63c], 0x4b001a
mov dword [rbp + 0x640], 0x6000b
mov dword [rbp + 0x644], 0x13
lea rcx, [0x1401a5da0]
movzx eax, byte [r14 + rcx]
xor ax, word [rbp + r14*2 + 0x628]
mov word [rdi + r14*2], ax
add r14, r15
cmp r14, 0xf
jl 0x14004a520
mov byte [0x1401acf19], r15b
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x18]
call fcn.1400469cc
lea rdx, [0x14016d588]
lea rcx, [rbp - 0x18]
call fcn.1400c57f8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x540]
call fcn.1400420ac
mov rbx, rax
mov edx, dword [0x1401aad80]
lea r8d, [rdx + 2]
lea ecx, [rdx + 1]
imul r8d, ecx
imul r8d, edx
mov eax, 0x66666667
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
cmp r8d, r15d
jne 0x14004a5c5
mov edi, 4
mov r8d, edi
lea edx, [rdi - 1]
lea rcx, str._d__d_n
call fcn.1400be234
lea r10, [0x1401a64d0]
cmp byte [0x1401acf23], r14b
jne 0x14004a6ad
mov dword [rbp + 0x650], 0x60004
mov dword [rbp + 0x654], 0xc001b
mov dword [rbp + 0x658], 0x530014
mov dword [rbp + 0x65c], 0x4000c
mov dword [rbp + 0x660], 0x160015
mov dword [rbp + 0x664], 0x50000
mov dword [rbp + 0x668], 0x53000f
mov dword [rbp + 0x66c], 0x40007
mov dword [rbp + 0x670], 0x60010
mov dword [rbp + 0x674], 0x520005
mov dword [rbp + 0x678], 0x11
mov dword [rbp + 0x67c], 0x4000a
mov dword [rbp + 0x680], 0x1e0008
mov dword [rbp + 0x684], 0x500006
mov dword [rbp + 0x688], 0x1e000c
mov dword [rbp + 0x68c], 0x1b0015
mov dword [rbp + 0x690], 0x5b
lea rcx, [0x1401a5da0]
movzx eax, byte [r14 + rcx]
xor ax, word [rbp + r14*2 + 0x650]
mov word [r10 + r14*2], ax
add r14, r15
cmp r14, 0x21
jl 0x14004a68a
mov byte [0x1401acf23], r15b
mov r8, rbx
mov rdx, r10
lea rcx, [rbp + 8]
call fcn.1400469cc
lea rdx, [0x14016d588]
lea rcx, [rbp + 8]
call fcn.1400c57f8
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x4e0]
call fcn.1400420ac
mov rbx, rax
call fcn.140045854
mov rdx, rax
mov r8, rbx
lea rcx, [rbp - 0x38]
call fcn.1400469cc
lea rdx, [0x14016d588]
lea rcx, [rbp - 0x38]
call fcn.1400c57f8
nop
mov rcx, qword [rbp + 0x8b0]
xor rcx, rsp
call fcn.1400bd920
lea r11, [rsp + 0x9c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret