Function at 0x140024480
Capabilities:
Check for debugger via api
Check for process debug object
Check for time delay via queryperformancecounter
Check processdebugflags
Check processdebugport
Create process on windows
Encode data using base64
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x188
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xf0], xmm6
mov eax, dword [0x141dc3118]
or eax, dword [0x141dc311c]
xor eax, 0x200134
and eax, 0xf9ac8b34
imul rax, rax, 0x658ad595
shr rax, 0x3e
cmp eax, 0x4389b9e6
jne 0x1400245f0
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov eax, 0x70
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
nop dword [rax]
mov ecx, dword [0x141dc3120]
or ecx, dword [0x141dc3124]
and ecx, 0xb3811292
or ecx, 0x445a6d49
xor ecx, 0xb4942e22
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov qword [rbp + 0x80], rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov qword [rbp + 0x38], rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov qword [rbp - 0x50], rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov qword [rbp + 0x40], rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov qword [rbp + 0x30], rsp
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov rdi, rsp
mov eax, 0x70
call fcn.1400ef330
sub rsp, rax
mov qword [rbp + 0x70], rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov qword [rbp + 0xb8], rsp
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov qword [rbp - 0x78], rsp
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov qword [rbp + 0x78], rsp
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov rbx, rsp
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov r14, rsp
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r11, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r13, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov rdx, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r8, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r10, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r12, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov rax, rsp
cmp ecx, 0x20447052
jb 0x1400245f0
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0xc8], r11
mov qword [rbp + 0xe8], r13
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x30], r12
mov qword [rbp + 0x48], r15
mov qword [rbp + 0x88], r14
mov qword [rbp - 0x38], rbx
mov qword [rbp + 0x60], r10
mov qword [rbp], r9
mov qword [rbp - 8], r8
mov qword [rbp - 0x10], rdx
mov eax, dword [0x141dc3128]
add eax, dword [0x141dc312c]
imul eax, eax, 0xd926f4a2
add eax, 0x9013e042
mov ecx, 0x976be3e9
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xfd4fb58e
jbe 0x1400248e0
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
nop
mov eax, dword [str.Q_vZF]
xor eax, dword [0x141dc3134]
and eax, 0x58b57001
imul ecx, eax, 0xb29d32bf
add ecx, 0xdc5e4e4e
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov qword [rbp + 0x68], rsp
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
mov qword [rbp - 0x70], rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov qword [rbp - 0x68], rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov qword [rbp - 0x60], rsp
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
mov qword [rbp - 0x58], rsp
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r10, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r11, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r8, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r12, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r13, rsp
mov eax, 0x20
call fcn.1400ef330
sub rsp, rax
mov rdx, rsp
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov qword [rbp + 0xd8], rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov rbx, rsp
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
mov r14, rsp
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
mov rax, rsp
cmp ecx, 0xa8ab4765
jb 0x1400248e0
mov qword [rbp + 0x10], r14
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0x98], r13
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0x18], rax
mov qword [rbp - 0x40], r11
mov qword [rbp - 0x48], r10
mov qword [rbp + 0xa8], r9
mov qword [rbp + 0xa0], r8
mov qword [rbp + 8], rdx
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov r14, rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov qword [rbp + 0x20], rsp
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
mov qword [rbp + 0x28], rsp
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
mov qword [rbp - 0x20], rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov qword [rbp - 0x18], rsp
mov eax, 0x10
call fcn.1400ef330
sub rsp, rax
mov qword [rbp + 0x50], rsp
mov eax, 0x30
call fcn.1400ef330
sub rsp, rax
mov qword [rbp + 0x58], rsp
mov r13, qword [rbp + 0x90]
mov qword [r13], 0
mov rax, qword [rbp + 0xe8]
mov dword [rax], 0
mov rsi, qword [rbp + 0xc8]
mov dword [rsi], 0
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 8
mov r8, r13
call sub.ADVAPI32.dll_OpenProcessToken
add rsp, 0x20
test eax, eax
je 0x140024e20
mov rcx, qword [r13]
sub rsp, 0x30
mov qword [rsp + 0x20], rsi
mov edx, 0x14
mov r8, qword [rbp + 0xe8]
mov r9d, 4
call sub.ADVAPI32.dll_GetTokenInformation
add rsp, 0x30
mov ecx, eax
nop word cs:[rax + rax]
mov eax, dword [0x141dc3148]
xor edx, edx
div dword [0x141dc314c]
imul eax, eax, 0x5050b3d5
xor eax, 0x40b26c48
and eax, 0xd8bf7d79
cmp eax, 0x3754701c
jb 0x140024b70
test ecx, ecx
je 0x140024e20
nop dword [rax]
mov eax, dword [0x141dc3150]
xor eax, dword [0x141dc3154]
imul eax, eax, 0xb5f14571
add eax, 0x97ffa4ce
cmp eax, 0x7ec4f606
ja 0x140024ba0
mov rax, qword [rbp + 0xe8]
mov eax, dword [rax]
mov rcx, qword [rbp + 0xc0]
nop
mov edx, dword [0x141dc3158]
sub edx, dword [0x141dc315c]
imul rdx, rdx, 0x7789d113
shr rdx, 0x3d
xor edx, 0xeb83547d
cmp edx, 0xc1289017
jb 0x140024bd0
nop word cs:[rax + rax]
mov edx, dword [0x141dc3160]
sub edx, dword [0x141dc3164]
add edx, 0x5d3357a6
or edx, 0x8c8dde0b
add edx, 0x83fdb82c
cmp edx, 0x8a533977
ja 0x140024c00
test eax, eax
je 0x140024e63
movabs r13, 0x6473f65616740f59
movabs rdi, 0x5c3c7d014d9e5a4a
movabs r12, 0x4259c9f0a01aad2f
movabs r9, 0x28ee358551049bf3
mov eax, dword [0x141dc33b0]
and eax, dword [0x141dc33b4]
add eax, 0x6924ca9a
imul rax, rax, 0x6b38f723
shr rax, 0x3d
imul eax, eax, 0xccee1888
lea r11, [0x141da539e]
cmp eax, 0x109233c
mov rsi, qword [rbp + 0xe0]
mov rbx, qword [rbp + 0x98]
mov r15, qword [rbp + 0xd0]
jae 0x140024d00
mov qword [rbx], r11
mov rcx, qword [rbx]
mov qword [rsi], r9
mov rdx, qword [rsi]
sub rsp, 0x20
mov r14, r11
call fcn.140018590
mov r11, r14
add rsp, 0x20
mov rcx, qword [rax]
xor rcx, r13
mov rdx, qword [rax + 8]
xor rdx, rdi
mov r8, qword [rax + 0x10]
xor r8, r12
mov r9, qword [rax + 0x18]
mov r9, qword [rax + 0x20]
mov r9d, dword [rax + 0x28]
movabs r9, 0x28ee358551049bf3
movzx eax, byte [rax + 0x2c]
mov qword [r15], rcx
mov qword [r15 + 8], rdx
mov qword [r15 + 0x10], r8
nop word cs:[rax + rax]
mov qword [rbx], r11
mov rcx, qword [rbx]
mov qword [rsi], r9
mov rdx, qword [rsi]
sub rsp, 0x20
mov r13, r9
mov r14, r11
call fcn.140018590
add rsp, 0x20
mov r9, qword [rax]
mov r10, qword [rax + 8]
mov r11, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rax + 0x20]
mov r8d, dword [rax + 0x28]
movzx eax, byte [rax + 0x2c]
movabs rdi, 0x6473f65616740f59
xor r9, rdi
mov qword [r15], r9
mov r9, r13
movabs rdi, 0x5c3c7d014d9e5a4a
xor r10, rdi
mov qword [r15 + 8], r10
xor r11, r12
mov qword [r15 + 0x10], r11
mov r11, r14
movabs r14, 0x3bbd058d17997c23
xor rcx, r14
movabs r14, 0x3021bc15fa91e96b
xor rdx, r14
mov r14d, 0xf3c0e744
xor r8d, r14d
xor edi, edi
test dil, dil
jne 0x140024d00
xor al, 0xd0
mov qword [r15 + 0x18], rcx
mov qword [r15 + 0x20], rdx
mov dword [r15 + 0x28], r8d
mov byte [r15 + 0x2c], al
mov rax, qword [rbp + 0xd8]
mov qword [rax], r15
mov qword [rax + 8], 0x2d
mov rdx, qword [rbp + 0xb0]
mov qword [rdx], rax
lea rax, [0x14008b790]
mov qword [rdx + 8], rax
lea rax, [0x140102e90]
mov rcx, qword [rbp + 0x10]
mov qword [rcx], rax
mov qword [rcx + 8], 2
mov qword [rcx + 0x20], 0
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], 1
sub rsp, 0x20
call fcn.14009f0e0
add rsp, 0x20
mov r12, qword [rbp + 0x60]
mov r14, qword [rbp + 0x30]
jmp case.0x1400266c2.0
mov eax, dword [0x141dc3138]
imul eax, dword [0x141dc313c]
add eax, 0x9282bb53
xor eax, 0x5a7377cf
add eax, 0x9ef6376f
cmp eax, 0x4d539579
ja 0x140024e20
mov rcx, qword [rbp + 0xc0]
nop word [rax + rax]
mov eax, dword [0x141dc3140]
or eax, dword [0x141dc3144]
cmp eax, 0xf4047e93
je 0x140024e50
mov r13, qword [rbp + 0x88]
nop word [rax + rax]
mov eax, dword [0x141dc3168]
and eax, dword [0x141dc316c]
imul eax, eax, 0xc59efe37
cmp eax, 0x6bd6a90b
je 0x140024e70
mov qword [rbp + 0xb0], r14
mov eax, dword [0x141dc3170]
xor eax, dword [0x141dc3174]
xor eax, 0x3a8076ac
imul rax, rax, 0x47028991
shr rax, 0x3e
or eax, 0xfc873bf0
cmp eax, 0xdd6fb17f
je 0x140024e90
xorps xmm6, xmm6
xor esi, esi
nop dword [rax]
sub rsp, 0x20
call fcn.1400910d0
mov rdx, qword [rbp + 0xc0]
add rsp, 0x20
mov rcx, qword [rdx]
mov rax, qword [rdx + 8]
mov qword [rbp + 0xe8], rax
nop word cs:[rax + rax]
mov eax, dword [0x141dc3178]
or eax, dword [0x141dc317c]
or eax, 0x9f8144e2
imul eax, eax, 0x2b157229
or eax, 0x1910dfb6
cmp eax, 0x50b824c2
jb 0x140024ef0
movabs rax, 0x8000000000000000
cmp rcx, rax
mov r12, qword [rbp + 0xa0]
mov r9, qword [rbp + 0xa8]
mov r10, qword [rbp - 0x48]
mov r11, qword [rbp - 0x40]
je 0x1400261c8
mov qword [rbp + 0xc8], rcx
mov r15, qword [rbp + 0x70]
mov rcx, qword [rbp + 0x68]
nop dword [rax + rax]
mov eax, dword [0x141dc3180]
or eax, dword [0x141dc3184]
and eax, 0xff8fca43
add eax, 0x76e08ad7
and eax, 0x8f4390c8
cmp eax, 0xe1fba2e3
ja 0x140024f50
mov eax, dword [0x141dc3188]
or eax, dword [0x141dc318c]
mov rbx, qword [rdx + 0x10]
imul eax, eax, 0xde364714
add eax, 0xf5aaf119
cmp eax, 0x63bc4479
mov r12, qword [rbp + 0xe8]
jb 0x140024fdd
nop dword [rax + rax]
mov r14d, dword [0x141dc3190]
imul r14d, dword [0x141dc3194]
add r14d, 0xc0bca953
or r14d, 0x6b724e46
sub rsp, 0x20
mov rdx, r12
mov r8, rbx
call fcn.140053dc0
mov rcx, qword [rbp + 0x68]
add rsp, 0x20
cmp r14d, 0x494d5b19
jne 0x140025000
sub rsp, 0x20
mov rdx, r12
mov r8, rbx
call fcn.140053dc0
mov rcx, qword [rbp + 0x68]
add rsp, 0x20
jmp 0x140024fa0
mov eax, dword [0x141dc3198]
or eax, dword [0x141dc319c]
or eax, 0x8040c01
and eax, 0x18048c01
cmp eax, 0x1923b552
ja 0x140025000
cmp qword [rcx], 0
jne 0x1400262e9
mov rbx, qword [rcx + 8]
mov r14, r13
nop
mov eax, dword [0x141dc31a0]
and eax, dword [0x141dc31a4]
cmp eax, 0xb714043b
je 0x140025030
mov r13, qword [rcx + 0x10]
nop word [rax + rax]
mov eax, dword [str.JL]
and eax, dword [0x141dc31ac]
imul eax, eax, 0xbd579158
add eax, 0x6fcae114
cmp eax, 0x7d57c290
ja 0x140025050
test r13, r13
js 0x1400262e9
nop word [rax + rax]
mov eax, dword [0x141dc31b0]
xor eax, dword [0x141dc31b4]
xor eax, 0x21945107
imul eax, eax, 0x3d7fad75
and eax, 0x9db760cd
cmp eax, 0x3ab77528
jb 0x140025080
test r13, r13
je 0x1400250d0
movzx eax, byte [0x141ddb278]
sub rsp, 0x20
xor ecx, ecx
mov rdx, r13
call fcn.1400c0180
add rsp, 0x20
mov r12, rax
test rax, rax
jne 0x1400250d6
jmp 0x1400262d4
mov r12d, 1
sub rsp, 0x20
mov rcx, r12
mov rdx, rbx
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
add rsp, 0x20
mov rax, qword [rbp + 0x48]
mov qword [rax], 0
mov qword [rax + 8], 1
mov qword [rax + 0x10], 0
lea rax, [r12 + r13]
mov rdx, qword [rbp - 0x38]
mov qword [rdx], r12
mov qword [rdx + 8], rax
mov word [rdx + 0x10], 0
mov dword [rdx + 0x18], 1
sub rsp, 0x20
mov rcx, r14
call fcn.140083250
add rsp, 0x20
mov rdx, qword [rbp - 0x78]
mov qword [rdx], 1
mov qword [rdx + 8], 1
mov word [rdx + 0x10], 0
mov dword [rdx + 0x18], 1
sub rsp, 0x20
mov rbx, qword [rbp + 0x78]
mov rcx, rbx
call fcn.140083250
add rsp, 0x20
mov rcx, qword [r14 + 8]
mov rdx, qword [rbx + 8]
mov rax, qword [rbp + 0xb8]
mov dword [rax], 0
movups xmmword [r15 + 0x60], xmm6
movups xmmword [r15 + 0x50], xmm6
movups xmmword [r15 + 0x40], xmm6
movups xmmword [r15 + 0x30], xmm6
movups xmmword [r15 + 0x20], xmm6
movups xmmword [r15 + 0x10], xmm6
movups xmmword [r15], xmm6
mov al, 1
test al, al
je 0x140026288
mov qword [rbp + 0x98], rdx
mov qword [rbp + 0xe0], rcx
mov eax, dword [0x141dc31d0]
or eax, dword [0x141dc31d4]
imul eax, eax, 0xd3b3aaa3
and eax, 0xc8c71efb
cmp eax, 0xb9f01a03
jne 0x1400251db
movzx eax, byte [0x141ddb278]
mov r8d, 0xfb3740a5
mov r14d, 0xee59b4db
nop word [rax + rax]
mov eax, dword [0x141dc31d8]
xor edx, edx
div dword [0x141dc31dc]
xor eax, 0xd56913dd
imul rax, r8
shr rax, 0x3e
imul eax, eax, 0x87e7a20
movzx ecx, byte [0x141ddb278]
cmp eax, 0x52e93c33
je 0x1400251f0
test sil, sil
je 0x140025240
sub rsp, 0x20
mov edx, 8
xor ecx, ecx
call fcn.1400c0180
add rsp, 0x20
nop dword [rax + rax]
mov ebx, dword [0x141dc31e0]
and ebx, dword [0x141dc31e4]
add ebx, 0xc63345a2
or ebx, 0x9292640c
imul rbx, r14
shr rbx, 0x3b
sub rsp, 0x20
mov edx, 8
xor ecx, ecx
call fcn.1400c0180
add rsp, 0x20
cmp ebx, 0x4bfdaa64
ja 0x140025240
mov rcx, rax
mov edx, 4
lea r14, [0x141db90d8]
nop dword [rax + rax]
mov eax, dword [0x141dc31e8]
imul eax, dword [0x141dc31ec]
and eax, 0xa419837a
add eax, 0xf967a1d2
cmp eax, 0x5cb3e12e
jb 0x140025290
test rcx, rcx
je 0x1400262b5
mov qword [rbp + 0x90], r13
mov qword [rbp + 0xd0], r12
mov eax, dword [0x141dc3200]
add eax, dword [0x141dc3204]
xor eax, 0x3105b183
imul eax, eax, 0x48d4b26a
mov r8d, 0xb53d2bc7
imul rax, r8
shr rax, 0x3e
cmp eax, 0x4f6959fa
je 0x14002530d
nop word cs:[rax + rax]
mov word [rcx], 0x72
mov qword [rdi], rdx
test sil, sil
je 0x140025320
mov word [rcx], 0x72
mov qword [rdi], rdx
jmp 0x140025300
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], 1
mov ebx, 1
xor r13d, r13d
lea r12, [0x141db90d3]
nop dword [rax + rax]
test sil, sil
jne 0x140025340
test r13w, r13w
je 0x140025360
xor r15d, r15d
jmp 0x1400255e3
mov eax, dword [0x141dc3208]
xor eax, dword [0x141dc320c]
imul rax, rax, 0x6ab2f219
shr rax, 0x3c
xor eax, 0xab0d9214
add eax, 0x42f8d3e6
cmp eax, 0x197a03ca
jb 0x140025360
nop dword [rax + rax]
mov eax, dword [0x141dc3210]
imul eax, dword [0x141dc3214]
or eax, 0x8000
xor eax, 0x4280002
and eax, 0x1c28c002
cmp eax, 0x11e5adbf
jb 0x140025390
cmp r12, r14
je 0x140025770
lea r8, [r12 + 1]
test sil, sil
jne 0x1400253c1
movzx r11d, byte [r12]
test r11b, r11b
js 0x140025410
mov eax, dword [str.M_bR4]
xor eax, dword [0x141dc3234]
imul eax, eax, 0x42d45ed9
add eax, 0x67cd14eb
shr eax, 3
imul rax, rax, 0x12ad6e27
shr rax, 0x37
cmp eax, 0x226708c1
jae 0x1400253d0
mov r13d, r11d
jmp 0x1400255dd
mov eax, dword [0x141dc3218]
imul eax, dword [0x141dc321c]
and eax, 0x35fb0640
xor eax, 0xee437012
imul eax, eax, 0x5bde4e80
cmp eax, 0x3dfb7283
jb 0x140025410
mov r9d, r11d
and r9d, 0x1f
lea r8, [r12 + 2]
movzx r10d, byte [r12 + 1]
mov r13d, r9d
shl r13d, 6
and r10d, 0x3f
or r13d, r10d
mov eax, dword [0x141dc3220]
xor edx, edx
div dword [0x141dc3224]
nop word cs:[rax + rax]
mov eax, dword [0x141dc3228]
or eax, dword [0x141dc322c]
and eax, 0x51787ac5
imul eax, eax, 0xd111531b
or eax, 0x8928279a
cmp eax, 0x3fc4742f
je 0x140025470
cmp r11b, 0xdf
jbe 0x1400255dd
nop dword [rax]
mov eax, dword [0x141dc3238]
sub eax, dword [0x141dc323c]
and eax, 0x12f248f9
cmp eax, 0x7692136b
je 0x1400254a0
lea r8, [r12 + 3]
movzx r14d, byte [r12 + 2]
shl r10d, 6
and r14d, 0x3f
nop dword [rax + rax]
mov eax, dword [0x141dc3240]
xor edx, edx
div dword [0x141dc3244]
imul eax, eax, 0xdead46f3
cmp eax, 0x1fb065e
je 0x1400254d0
or r10d, r14d
cmp r11b, 0xf0
jb 0x140025568
lea r14, [0x141db90d8]
nop dword [rax + rax]
mov eax, dword [0x141dc3248]
sub eax, dword [0x141dc324c]
and eax, 0xddece43
cmp eax, 0x2720f93a
je 0x140025500
movzx r8d, byte [r12 + 3]
add r12, 4
and r9d, 7
shl r9d, 0x12
shl r10d, 6
and r8d, 0x3f
mov eax, dword [0x141dc3250]
xor edx, edx
div dword [0x141dc3254]
add eax, 0x2fed1737
or eax, 0x951bac25
mov r13d, r10d
or r13d, r8d
or r13d, r9d
cmp eax, 0x372cea8a
je 0x140025532
mov r8, r12
cmp r13d, 0xffff
ja 0x140025590
jmp 0x1400255dd
shl r9d, 0xc
or r10d, r9d
mov r13d, r10d
lea r14, [0x141db90d8]
cmp r13d, 0xffff
jbe 0x1400255dd
nop word cs:[rax + rax]
mov eax, dword [0x141dc3258]
xor edx, edx
div dword [0x141dc325c]
and eax, 0xbd001041
or eax, 0x42f66532
imul eax, eax, 0x67fa113
cmp eax, 0xb229cf5
jb 0x140025590
lea eax, [r13 + 0xff0000]
shr eax, 0xa
or eax, 0xd800
and r13d, 0x3ff
or r13d, 0xdc00
mov r12, r8
mov r15d, r13d
mov r13d, eax
jmp 0x1400255e3
xor r15d, r15d
mov r12, r8
cmp rbx, qword [rdi]
je 0x14002565e
mov eax, dword [0x141dc3260]
xor edx, edx
div dword [0x141dc3264]
xor eax, 0x424ea0e9
imul rax, rax, 0x574f40b3
shr rax, 0x3c
add eax, 0x115792e7
cmp eax, 0xaa400345
jbe 0x140025620
mov word [rcx + rbx*2], r13w
lea rax, [rbx + 1]
mov qword [rdi + 0x10], rax
nop
mov edx, dword [0x141dc3268]
or edx, dword [0x141dc326c]
or edx, 0xcb0b2bd
add edx, 0x188737f2
and edx, 0x9f94332
lea rax, [rbx + 1]
mov word [rcx + rbx*2], r13w
mov qword [rdi + 0x10], rax
cmp edx, 0x826495bf
jae 0x140025620
mov rbx, rax
mov r13d, r15d
jmp 0x140025340
lea rax, [0x141db90d2]
mov qword [rbp + 0xd8], r12
sub rax, r12
add rax, 8
movabs rcx, 0xaaaaaaaaaaaaaaab
mul rcx
mov rcx, rdx
shr rcx, 1
cmp r15w, 1
mov r12d, 2
sbb r12, 0
mov eax, dword [0x141dc3270]
xor edx, edx
div dword [0x141dc3274]
mov eax, dword [0x141dc3278]
xor eax, dword [0x141dc327c]
add eax, 0xc4763699
and eax, 0xe51240
cmp eax, 0x4cec42ca
ja 0x1400256a3
add r12, rcx
mov eax, dword [0x141dc3280]
mov ecx, dword [0x141dc3284]
add eax, ecx
add eax, 0xa43ce4d
or eax, 0x9afc27b6
cmp eax, 0xc91fd33f
jne 0x140025707
sub rsp, 0x30
mov qword [rsp + 0x20], 2
mov r9d, 2
mov rcx, rdi
mov rdx, rbx
mov r8, r12
call fcn.1400fe010
add rsp, 0x30
mov r14d, dword [0x141dc3288]
sub r14d, dword [0x141dc328c]
mov eax, 0xbec548cf
imul r14, rax
shr r14, 0x3f
or r14d, 0x22a020b2
sub rsp, 0x30
mov qword [rsp + 0x20], 2
mov r9d, 2
mov rcx, rdi
mov rdx, rbx
mov r8, r12
call fcn.1400fe010
add rsp, 0x30
cmp r14d, 0xfbe8fc79
ja 0x1400256e2
mov rcx, qword [rdi + 8]
lea r14, [0x141db90d8]
mov r12, qword [rbp + 0xd8]
jmp 0x1400255e8
mov r15, qword [rdi]
mov rbx, qword [rdi + 8]
sub rsp, 0x20
xor ecx, ecx
mov edx, 6
call qword [sym.imp.ole32.dll_CoInitializeEx]
add rsp, 0x20
mov r14, qword [rbp + 0x70]
movabs rax, 0x14000000070
mov qword [r14], rax
mov qword [r14 + 0x10], rbx
mov rax, qword [rbp + 0xe0]
mov qword [r14 + 0x18], rax
mov rax, qword [rbp + 0x98]
mov qword [r14 + 0x20], rax
mov dword [r14 + 0x30], 1
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.shell32.dll_ShellExecuteExW]
add rsp, 0x20
test eax, eax
je 0x1400259b0
mov r14, qword [r14 + 0x68]
test r14, r14
je 0x1400259b0
test sil, sil
je 0x140025800
sub rsp, 0x20
mov rcx, r14
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x20
mov r13, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop word [rax + rax]
mov eax, dword [0x141dc32b8]
xor eax, dword [0x141dc32bc]
xor eax, 0xd3156644
shr eax, 2
imul rax, rax, 0x4175b429
shr rax, 0x39
imul r12d, eax, 0x344d81b3
sub rsp, 0x20
mov rcx, r14
mov edx, 0xffffffff
call r13
add rsp, 0x20
cmp r12d, 0x361718a9
je 0x140025810
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xd8], rbx
mov rax, qword [rbp + 0x70]
mov r14, qword [rax + 0x68]
mov eax, dword [0x141dc32c0]
sub eax, dword [0x141dc32c4]
or eax, 0xf6f9babb
imul rcx, rax, 0x6dff91
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
cmp eax, 0xf129f34f
jne 0x1400258ac
sub rsp, 0x20
mov rcx, r14
mov rdx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
add rsp, 0x20
mov r15, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ebx, 0x9ddacd73
nop dword [rax + rax]
mov r13d, dword [0x141dc32c8]
sub r13d, dword [0x141dc32cc]
or r13d, 0xd3c51617
imul r13, rbx
shr r13, 0x3d
add r13d, 0xdcb5ff82
sub rsp, 0x20
mov rcx, r14
mov rdx, qword [rbp + 0xb8]
call r15
mov rcx, qword [rbp + 0xb8]
add rsp, 0x20
cmp eax, 1
mov r12d, 0
sbb r12d, r12d
cmp r13d, 0xc5c28f50
jb 0x1400258c0
or r12d, dword [rcx]
cmp qword [rbp + 0xe0], 0
mov rbx, qword [rbp + 0xd8]
je 0x140025b90
mov eax, dword [0x141dc32d0]
and eax, dword [str.1_n_f]
mov ecx, 0xaeb5c1f9
imul rax, rcx
shr rax, 0x3e
imul eax, eax, 0xdc1ba552
add eax, 0x2020c1b9
cmp eax, 0x36365c9e
jbe 0x140025960
mov rax, qword [0x141ddb260]
nop
mov eax, dword [0x141dc32d8]
and eax, dword [0x141dc32dc]
imul eax, eax, 0x9a934102
mov r14, qword [0x141ddb260]
cmp eax, 0x3e23697f
jb 0x140025960
mov eax, dword [0x141dc32e0]
or eax, dword [0x141dc32e4]
imul eax, eax, 0x13268f45
or eax, 0xe2dd4931
add eax, 0xc1e27540
cmp eax, 0xfe68a7bd
jbe 0x140025b30
jmp 0x140025b70
mov eax, dword [0x141dc3290]
xor edx, edx
div dword [0x141dc3294]
imul eax, eax, 0xb1e9eb71
add eax, 0xcc299e8d
cmp eax, 0x97b14822
jb 0x1400259b0
test r15, r15
je 0x140025aac
mov eax, dword [0x141dc3298]
add eax, dword [0x141dc329c]
imul eax, eax, 0xaa1d8ec0
and eax, 0xe9442d40
cmp eax, 0x448ae48c
je 0x140025a20
nop word [rax + rax]
mov r14, qword [0x141ddb260]
test sil, sil
jne 0x140025a20
test sil, sil
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
je 0x140025a40
jmp 0x140025b10
mov rax, qword [0x141ddb260]
mov r14, qword [0x141ddb260]
test sil, sil
jne 0x140025a20
jmp 0x140025a0c
mov r15d, dword [0x141dc32a0]
and r15d, dword [0x141dc32a4]
add r15d, 0x9b5e9285
or r15d, 0x2f2652a9
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, rbx
call r12
add rsp, 0x20
cmp r15d, 0xd8e2abf8
je 0x140025b10
nop dword [rax]
mov eax, dword [0x141dc32a8]
xor eax, dword [0x141dc32ac]
add eax, 0x52449d15
shr eax, 2
imul rax, rax, 0x211bbd8b
shr rax, 0x3a
imul eax, eax, 0x747695d9
cmp eax, 0x54417efd
je 0x140025a80
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
test sil, sil
jne 0x140025ac0
mov rcx, qword [rbp + 0x78]
nop dword [rax]
mov eax, dword [0x141dc32b0]
add eax, dword [0x141dc32b4]
xor eax, 0xb98378c3
add eax, 0x7091ea23
cmp eax, 0x5d2d131b
jbe 0x140025ad0
mov r12d, 0xffffffff
cmp qword [rcx], 0
jne 0x140025bd0
jmp 0x140025c56
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, rbx
call r12
add rsp, 0x20
jmp 0x140025a40
mov eax, dword [0x141dc32e8]
and eax, dword [0x141dc32ec]
imul r15d, eax, 0x3f191bfc
xor r15d, 0x860820c0
and r15d, 0x9e0929c8
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp r15d, 0xf23b407a
jbe 0x140025b90
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x140025b30
mov eax, dword [0x141dc32f0]
sub eax, dword [0x141dc32f4]
imul rax, rax, 0xc44bcb7
shr rax, 0x3a
add eax, 0xe55336ad
and eax, 0x20122622
cmp eax, 0xca3426fe
ja 0x140025b90
mov rcx, qword [rbp + 0x78]
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rcx], 0
je 0x140025c56
nop dword [rax]
test sil, sil
jne 0x140025bd0
mov rbx, qword [rcx + 8]
mov r14, qword [0x141ddb260]
mov eax, dword [0x141dc32f8]
or eax, dword [0x141dc32fc]
and eax, 0x40d06036
or eax, 0xbb268ac1
xor eax, 0xa673384b
cmp eax, 0xbc965896
ja 0x140025e30
nop word cs:[rax + rax]
mov eax, dword [0x141dc3300]
xor edx, edx
div dword [0x141dc3304]
mov r13d, eax
and r13d, 0x8984100c
xor r13d, 0xf2c0295
or r13d, 0x5053c962
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, rbx
call r15
add rsp, 0x20
cmp r13d, 0x16862843
jb 0x140025e30
mov r15, qword [rbp + 0x88]
mov rax, qword [r15]
mov ecx, dword [0x141dc3308]
and ecx, dword [0x141dc330c]
xor ecx, 0x3eb45360
add ecx, 0x5a3d6daa
and ecx, 0x2e56aabb
cmp ecx, 0x9a700970
ja 0x140025c60
test rax, rax
mov rbx, qword [rbp + 0x48]
mov r14, qword [rbp + 0x90]
je 0x140025ce8
test sil, sil
je 0x140025cb0
mov rax, qword [0x141ddb260]
nop word cs:[rax + rax]
mov eax, dword [0x141dc3310]
and eax, dword [0x141dc3314]
add eax, 0x95fd058a
or eax, 0x9b06556a
mov r8, qword [r15 + 8]
mov rcx, qword [0x141ddb260]
cmp eax, 0xc9783b76
je 0x140025cb0
sub rsp, 0x20
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov ecx, 0x9024530d
mov eax, dword [0x141dc3318]
and eax, dword [0x141dc331c]
imul rax, rcx
shr rax, 0x3f
or eax, 0x5f4c90
cmp eax, 0x9e2a9cb8
je 0x140025ced
mov rax, qword [rbx]
mov ecx, dword [0x141dc3320]
imul ecx, dword [0x141dc3324]
or ecx, 0xfa321378
and ecx, 0xfa7a13f8
cmp ecx, 0xf9831926
jb 0x140025d10
test rax, rax
je 0x140025dd0
nop word [rax + rax]
mov eax, dword [0x141dc3328]
sub eax, dword [0x141dc332c]
xor eax, 0x14a4e3cd
add eax, 0x77332f6d
and eax, 0x338c59bf
cmp eax, 0xf4237a98
ja 0x140025d40
mov r8, qword [rbx + 8]
mov eax, dword [0x141dc3330]
or eax, dword [0x141dc3334]
imul eax, eax, 0xfd115dfe
cmp eax, 0x5cdb7d4b
jne 0x140025d90
mov rax, qword [0x141ddb260]
nop word cs:[rax + rax]
mov eax, dword [0x141dc3338]
and eax, dword [0x141dc333c]
xor eax, 0xa79f3508
imul eax, eax, 0xd4db0bd7
mov rcx, qword [0x141ddb260]
cmp eax, 0xae5763b5
je 0x140025d90
sub rsp, 0x20
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop word cs:[rax + rax]
test sil, sil
jne 0x140025dd0
nop word cs:[rax + rax]
mov eax, dword [0x141dc3340]
and eax, dword [0x141dc3344]
or eax, 0x48600220
and eax, 0xc862a220
cmp eax, 0x726a5064
ja 0x140025de0
test r14, r14
je 0x140025ef0
mov eax, dword [0x141dc3348]
sub eax, dword [0x141dc334c]
imul eax, eax, 0x22b1544e
add eax, 0x5036565b
cmp eax, 0x93d1662d
jbe 0x140025e50
jmp 0x140025e70
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, rbx
call r15
add rsp, 0x20
jmp 0x140025c10
mov eax, dword [0x141dc3350]
xor eax, dword [0x141dc3354]
imul eax, eax, 0x33d494d6
mov rbx, qword [0x141ddb260]
cmp eax, 0x8f971650
jne 0x140025e80
mov rax, qword [0x141ddb260]
jmp 0x140025e50
test sil, sil
je 0x140025e9f
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, qword [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13, qword [rbp + 0xd0]
nop dword [rax]
mov eax, dword [0x141dc3358]
add eax, dword [0x141dc335c]
xor eax, 0x55a12e79
imul r14, rax, 0x208a47c9
shr r14, 0x3d
xor r14d, 0xe5cb691b
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, r13
call r15
add rsp, 0x20
cmp r14d, 0x736b4402
jb 0x140025eb0
nop
mov eax, dword [0x141dc3360]
xor eax, dword [0x141dc3364]
imul rcx, rax, 0x2143bc05
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1a
xor eax, 0x55ffbecc
add eax, 0x37525694
cmp eax, 0xe7e73970
ja 0x140025ef0
test r12d, r12d
mov rax, qword [rbp - 0x30]
mov r13, qword [rbp + 0x88]
je 0x140026238
mov rcx, qword [rbp - 0x28]
lea rdx, [0x141daf5e9]
mov qword [rcx], rdx
mov rbx, qword [rcx]
movabs rcx, 0x595f673b99754862
mov qword [rax], rcx
mov r14, qword [rax]
mov eax, dword [0x141dc3368]
sub eax, dword [0x141dc336c]
imul eax, eax, 0x2fd539e5
xor eax, 0xa762505e
add eax, 0xd0114d63
cmp eax, 0xba8384b
lea r12, [0x14008b790]
jb 0x140026090
nop word cs:[rax + rax]
sub rsp, 0x20
mov rcx, rbx
mov rdx, r14
call fcn.140018810
add rsp, 0x20
mov r8, qword [rax]
mov rdx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
test sil, sil
jne 0x140026090
mov r9, qword [rax + 0x18]
movzx eax, byte [rax + 0x20]
movabs r10, 0x27ba6ed99e947921
xor r8, r10
mov r10, qword [rbp - 0x70]
mov qword [r10], r8
movabs r8, 0x347de5c2264e06c9
xor rdx, r8
mov qword [r10 + 8], rdx
movabs rdx, 0xf37d98069079d5a0
xor rcx, rdx
mov qword [r10 + 0x10], rcx
movabs rcx, 0x69a9b624fd27f38
xor r9, rcx
mov qword [r10 + 0x18], r9
xor al, 0xb9
mov byte [r10 + 0x20], al
mov rax, qword [rbp - 0x68]
mov qword [rax], r10
mov qword [rax + 8], 0x21
mov rbx, qword [rbp - 0x60]
mov qword [rbx], rax
mov qword [rbx + 8], r12
mov r15, qword [rbp - 0x58]
lea rax, [0x140102e90]
mov qword [r15], rax
mov qword [r15 + 8], 2
mov qword [r15 + 0x20], 0
mov qword [r15 + 0x10], rbx
mov qword [r15 + 0x18], 1
sub rsp, 0x20
mov rcx, r15
call fcn.14009f0e0
add rsp, 0x20
cmp qword [rbp + 0xc8], 0
je 0x140026189
mov eax, dword [0x141dc3370]
or eax, dword [0x141dc3374]
xor eax, 0x80344658
or eax, 0x5d489883
cmp eax, 0x109b0b70
jne 0x1400260c0
jmp 0x140026110
sub rsp, 0x20
mov rcx, rbx
mov rdx, r14
call fcn.140018810
add rsp, 0x20
mov rcx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, qword [rax + 0x10]
jmp 0x140025f90
mov rbx, qword [0x141ddb260]
test sil, sil
jne 0x140026110
mov eax, dword [0x141dc3378]
and eax, dword [0x141dc337c]
add eax, 0x39580409
or eax, 0x5fc6f410
xor eax, 0xf12de088
cmp eax, 0x6aea2bac
mov r12, qword [rbp + 0xe8]
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
jae 0x140026120
jmp 0x1400261b0
mov rax, qword [0x141ddb260]
jmp 0x1400260c0
mov eax, dword [0x141dc3380]
mov ecx, dword [0x141dc3384]
lea r14d, [rax + rcx]
add r14d, 0x6d2d7248
xor r14d, 0x3b3eaf4e
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, r12
call r15
add rsp, 0x20
cmp r14d, 0xb0038ea9
jb 0x1400261b0
nop word [rax + rax]
mov eax, dword [0x141dc3388]
and eax, dword [0x141dc338c]
imul rax, rax, 0x1ce0f8ed
shr rax, 0x3c
imul eax, eax, 0xc083f15a
and eax, 0x50aab936
cmp eax, 0xe9a500b9
ja 0x140026160
mov rcx, qword [rbp + 0xc0]
mov eax, dword [0x141dc3390]
sub eax, dword [0x141dc3394]
cmp eax, 0x6ba413d1
je 0x140026190
jmp 0x140024ec0
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, r12
call r15
add rsp, 0x20
jmp 0x140026120
mov ecx, 0x99c2ffb3
mov r13, qword [rbp + 0x50]
mov rdi, qword [rbp + 0x58]
mov rsi, qword [rbp + 0xb0]
lea r14, [0x140102e90]
mov rbx, qword [rbp + 0xe8]
nop word [rax + rax]
mov eax, dword [0x141dc33a8]
xor edx, edx
div dword [0x141dc33ac]
imul rax, rcx
shr rax, 0x3d
cmp eax, 0xe74ca563
je 0x1400261f0
test rbx, rbx
je 0x14002638e
mov eax, dword [0x141dc33d0]
or eax, dword [0x141dc33d4]
imul eax, eax, 0x18577350
cmp eax, 0xb60a955e
jne 0x1400265b3
jmp 0x1400265d0
cmp qword [rbp + 0xc8], 0
mov r12, qword [rbp + 0xa0]
mov r13, qword [rbp + 0x50]
mov rdi, qword [rbp + 0x58]
mov r9, qword [rbp + 0xa8]
lea r14, [0x140102e90]
mov r8, qword [rbp + 0xe8]
je 0x14002638e
mov eax, dword [0x141dc3398]
xor edx, edx
div dword [0x141dc339c]
cmp eax, 0x70cedddc
jne 0x14002633d
jmp 0x140026367
ud2
mov eax, dword [0x141dc31f0]
sub eax, dword [0x141dc31f4]
or eax, 0xf32fefdf
and eax, 0xf7bfffdf
cmp eax, 0xebbf051e
jae 0x140026314
jmp 0x140026339
mov eax, dword [0x141dc31b8]
and eax, dword [0x141dc31bc]
cmp eax, 0x9a25affb
jne 0x1400262eb
jmp 0x140026310
ud2
mov eax, dword [0x141dc31c0]
sub eax, dword [0x141dc31c4]
imul eax, eax, 0x2a7f38e5
add eax, 0xce3de50f
and eax, 0xf662c812
ud2
ud2
mov eax, dword [0x141dc31f8]
sub eax, dword [0x141dc31fc]
and eax, 0x5c2aca1b
imul eax, eax, 0x2b6bfbd3
add eax, 0xf3a8425c
ud2
ud2
mov eax, dword [0x141dc33a0]
add eax, dword [0x141dc33a4]
imul eax, eax, 0x8a27b84c
xor eax, 0xaa90d73d
add eax, 0x970e19ff
mov rcx, qword [0x141ddb260]
cmp eax, 0xb82fcddf
jbe 0x140026370
mov rax, qword [0x141ddb260]
jmp 0x14002633d
sub rsp, 0x20
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov r12, qword [rbp + 0xa0]
mov r9, qword [rbp + 0xa8]
mov eax, dword [0x141dc33b8]
xor eax, dword [0x141dc33bc]
add eax, 0xd268eb85
or eax, 0xf9dd97fd
cmp eax, 0x5cb4bb4c
jb 0x1400263bb
lea rax, [0x141da606a]
mov qword [r9], rax
xor eax, eax
test al, al
je 0x1400263c7
lea rax, [0x141da606a]
mov qword [r9], rax
jmp 0x1400263ab
mov rcx, qword [r9]
movabs rax, 0x9d45940f69b50d5a
mov qword [r12], rax
mov rdx, qword [r12]
sub rsp, 0x20
call fcn.1400183e0
add rsp, 0x20
movabs rcx, 0x44f21e587249d16a
xor rcx, qword [rax]
movabs rdx, 0x22fd9cbde01aa544
xor rdx, qword [rax + 8]
movabs r8, 0x72396d0abc24f508
xor r8, qword [rax + 0x10]
movabs r9, 0x5cc1f4aaac985a06
xor r9, qword [rax + 0x18]
movabs r10, 0x60f835fa28c43580
xor r10, qword [rax + 0x20]
movzx esi, word [rax + 0x28]
mov r11d, esi
xor r11b, 0xf9
shr esi, 8
xor sil, 0x9d
mov r15, qword [rbp - 0x20]
mov qword [r15], rcx
mov qword [r15 + 8], rdx
mov qword [r15 + 0x10], r8
mov qword [r15 + 0x18], r9
mov qword [r15 + 0x20], r10
mov eax, dword [0x141dc33c0]
add eax, dword [0x141dc33c4]
cmp eax, 0xae94a815
mov r12, qword [rbp - 0x18]
jne 0x1400264d0
mov byte [r15 + 0x28], r11b
mov byte [r15 + 0x29], sil
mov qword [r12], r15
mov qword [r12 + 8], 0x2a
mov qword [r13], r12
lea rax, [0x14008b790]
mov qword [r13 + 8], rax
mov qword [rdi], r14
mov qword [rdi + 8], 2
mov qword [rdi + 0x20], 0
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 1
sub rsp, 0x20
mov rcx, rdi
mov ebx, r11d
call fcn.14009f0e0
mov r11d, ebx
add rsp, 0x20
nop word [rax + rax]
mov eax, dword [0x141dc33c8]
or eax, dword [0x141dc33cc]
imul r14d, eax, 0x35a6fce9
or r14d, 0xd357c046
mov eax, 0xd523e949
imul r14, rax
shr r14, 0x3f
mov byte [r15 + 0x28], r11b
mov byte [r15 + 0x29], sil
mov qword [r12], r15
mov qword [r12 + 8], 0x2a
mov qword [r13], r12
lea rax, [0x14008b790]
mov qword [r13 + 8], rax
lea rax, [0x140102e90]
mov qword [rdi], rax
mov qword [rdi + 8], 2
mov qword [rdi + 0x20], 0
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 1
sub rsp, 0x20
mov rcx, rdi
mov rbx, r13
mov r13d, esi
mov esi, r11d
call fcn.14009f0e0
mov r11d, esi
mov esi, r13d
mov r13, rbx
add rsp, 0x20
cmp r14d, 0x656e246d
jae 0x1400264d0
mov eax, dword [0x141dc3450]
xor eax, dword [0x141dc3454]
add eax, 0xb380634e
imul rax, rax, 0x2e170bbd
shr rax, 0x3d
add eax, 0x24f4304d
cmp eax, 0xe0430862
ja 0x140026570
movaps xmm6, xmmword [rbp + 0xf0]
lea rsp, [rbp + 0x108]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [0x141dc33d8]
or eax, dword [0x141dc33dc]
lea rcx, [0x141db02c8]
mov qword [r11], rcx
cmp eax, 0x2fc3543
jne 0x1400265dc
lea rax, [0x141db02c8]
mov qword [r11], rax
jmp 0x1400265b3
mov rcx, qword [r11]
movabs rax, 0x63c9020a48e60ebf
mov qword [r10], rax
mov rdx, qword [r10]
sub rsp, 0x20
call fcn.140019970
add rsp, 0x20
movabs rcx, 0x73d7bddf5b238f5b
xor rcx, qword [rax]
movabs rdx, 0x4361ba5209efe2c9
xor rdx, qword [rax + 8]
movabs r8, 0x80aafc04f153c8a7
xor r8, qword [rax + 0x10]
movabs r9, 0xfd95095e3a6861b1
xor r9, qword [rax + 0x18]
movzx eax, byte [rax + 0x20]
xor al, 0x21
mov r10, qword [rbp + 0x18]
mov qword [r10], rcx
mov qword [r10 + 8], rdx
mov qword [r10 + 0x10], r8
mov qword [r10 + 0x18], r9
mov byte [r10 + 0x20], al
mov qword [rsi], r10
mov qword [rsi + 8], 0x21
mov rax, qword [rbp + 0x20]
mov qword [rax], rsi
lea rcx, [0x14008b790]
mov qword [rax + 8], rcx
mov rcx, qword [rbp + 0x28]
mov qword [rcx], r14
mov qword [rcx + 8], 2
mov qword [rcx + 0x20], 0
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
sub rsp, 0x20
call fcn.14009f0e0
add rsp, 0x20
mov eax, ebx
and eax, 3
cmp rax, 3
mov r12, qword [rbp + 0x60]
ja case.default.0x1400266c2
lea rcx, [0x141dba09c]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
mov r14, qword [rbp + 0x30]
jmp rax
lea rsi, [rbx - 1]
mov rdi, qword [rbx - 1]
nop dword [rax]
mov eax, dword [0x141dc33f8]
xor eax, dword [0x141dc33fc]
or eax, 0x3d826056
imul eax, eax, 0x3f97ba33
imul rax, rax, 0x62997d35
shr rax, 0x3e
cmp eax, 0xba8dc15d
je 0x1400266d0
mov rbx, qword [rbx + 7]
mov rax, qword [rbx]
mov ecx, dword [0x141dc3400]
sub ecx, dword [0x141dc3404]
add ecx, 0xb852b68d
or ecx, 0x40801818
and ecx, 0x6bd65b78
cmp ecx, 0xe9a47380
je 0x140026700
test rax, rax
je 0x140026759
sub rsp, 0x20
mov rcx, rdi
call rax
add rsp, 0x20
nop dword [rax + rax]
mov eax, dword [0x141dc3408]
sub eax, dword [0x141dc340c]
imul eax, eax, 0x462f1587
cmp eax, 0x19af5146
je 0x140026740
mov rcx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
nop word cs:[rax + rax]
mov edx, dword [str._lf]
xor edx, dword [0x141dc3414]
imul rdx, rdx, 0x21973065
shr rdx, 0x3c
imul edx, edx, 0xc2e47812
xor edx, 0xad5d0534
cmp edx, 0x223abb19
jb 0x140026770
test rcx, rcx
je 0x140026914
mov ecx, 0xce287d5b
nop dword [rax]
mov edx, dword [0x141dc3418]
and edx, dword [0x141dc341c]
xor edx, 0xf1d66cb1
imul edx, edx, 0x4256b68b
imul rdx, rcx
shr rdx, 0x3e
cmp edx, 0x5fa5d600
ja 0x1400267b0
cmp rax, 0x11
jb 0x140026815
nop
mov eax, dword [0x141dc3420]
and eax, dword [0x141dc3424]
add eax, 0x3c2c800c
or eax, 0x596ed1cd
imul rcx, rax, 0x240e2499
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
cmp eax, 0xeeb0a897
ja 0x1400267e0
mov rdi, qword [rdi - 8]
mov eax, dword [0x141dc3428]
xor edx, edx
div dword [0x141dc342c]
imul eax, eax, 0x3e7c7296
cmp eax, 0xd8be3a04
jne 0x1400268b8
jmp 0x1400268f8
mov eax, dword [0x141dc33e8]
xor edx, edx
div dword [0x141dc33ec]
or eax, 0x7b019016
add eax, 0x36c8fb8e
xor eax, 0xd9ae0a22
cmp eax, 0x174e9dc0
jb case.0x1400266c2.3
nop word cs:[rax + rax]
mov eax, dword [0x141dc33f0]
add eax, dword [0x141dc33f4]
or eax, 0xfdffe6fd
xor eax, 0x542b6a7d
cmp eax, 0xfa5b187a
jae 0x140026870
jmp case.0x1400266c2.0
mov eax, dword [0x141dc33e0]
sub eax, dword [0x141dc33e4]
cmp eax, 0x119c48d
je case.default.0x1400266c2
jmp 0x1400262e9
mov ebx, dword [0x141dc3430]
sub ebx, dword [0x141dc3434]
add ebx, 0x80000000
or ebx, 0x5f58b30b
and ebx, 0xdf5cb3eb
mov rcx, qword [0x141ddb260]
sub rsp, 0x20
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp ebx, 0x28bf9405
jne 0x140026914
mov rcx, qword [0x141ddb260]
sub rsp, 0x20
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x1400268b8
mov eax, dword [0x141dc3438]
xor edx, edx
div dword [0x141dc343c]
imul eax, eax, 0x64af7fcc
cmp eax, 0xffcc82c
jne 0x140026940
mov rax, qword [0x141ddb260]
nop word cs:[rax + rax]
mov eax, dword [0x141dc3440]
xor edx, edx
div dword [0x141dc3444]
or eax, 0x47a2017c
xor eax, 0x8a82bac6
imul rax, rax, 0x76045c77
shr rax, 0x3e
mov rcx, qword [0x141ddb260]
cmp eax, 0xd5a33698
ja 0x140026940
sub rsp, 0x20
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dc3448]
and eax, dword [0x141dc344c]
add eax, 0xf7a62aca
imul rax, rax, 0x3e6f0625
shr rax, 0x3d
cmp eax, 0x7cabec2b
jae 0x140026990
nop word cs:[rax + rax]
mov eax, dword [0x141dc3458]
sub eax, dword [0x141dc345c]
and eax, 0x3c596492
add eax, 0x6724b436
and eax, 0x4c4f2022
cmp eax, 0x12b8de3b
ja case.0x1400266c2.0
xor eax, eax
test al, al
jne 0x140026a1b
mov eax, dword [0x141dc3460]
imul eax, dword [0x141dc3464]
xor eax, 0x40b69200
or eax, 0x8f40604f
mov ecx, 0x87cd954f
imul rcx, rax
shr rcx, 0x3c
mov qword [r14], 0
cmp ecx, 0xa0f9a6c6
jbe 0x140026a24
mov qword [r14], 0
jmp 0x1400269e8
mov eax, dword [0x141dc3468]
sub eax, dword [0x141dc346c]
imul eax, eax, 0x15ddb244
cmp eax, 0xe0d0622b
je 0x140026a78
mov eax, dword [0x141dc3470]
xor edx, edx
div dword [str.A3__]
mov esi, eax
xor esi, 0xd4900080
or esi, 0x2b6fdf3d
add esi, 0x11da43ca
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
add rsp, 0x20
cmp esi, 0xb2ad9346
jbe 0x140026a8b
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
add rsp, 0x20
jmp 0x140026a3d
test eax, eax
je 0x140026c09
mov eax, 0xda31775b
nop dword [rax + rax]
mov ecx, dword [0x141dc3490]
sub ecx, dword [0x141dc3494]
xor ecx, 0x20937117
add ecx, 0x749a0c20
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0x626c0eb1
ja 0x140026aa0
mov rsi, qword [r14]
mov rcx, qword [0x141ddb258]
nop word cs:[rax + rax]
mov eax, dword [0x141dc3498]
xor edx, edx
div dword [0x141dc349c]
or eax, 0x32937bb0
imul rax, rax, 0x1651a33b
shr rax, 0x3c
add eax, 0x4c44bd8b
cmp eax, 0x73491bf3
ja 0x140026ae0
test rcx, rcx
jne 0x140026cfd
nop word cs:[rax + rax]
mov eax, dword [0x141dc34a0]
and eax, dword [0x141dc34a4]
add eax, 0x259310ca
imul rax, rax, 0x145aec59
shr rax, 0x3b
imul eax, eax, 0xdb028a4e
cmp eax, 0xe4496009
ja 0x140026b20
mov rcx, qword [rbp + 0x40]
mov qword [rcx], 0
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
nop word cs:[rax + rax]
mov ecx, dword [0x141dc34a8]
or ecx, dword [0x141dc34ac]
add ecx, 0x900d80bc
xor ecx, 0x8d82ac75
add ecx, 0x74fabf1a
cmp ecx, 0x1536ed76
jb 0x140026b70
test eax, eax
je 0x140026bc2
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax]
mov eax, dword [0x141dc34b8]
and eax, dword [0x141dc34bc]
or eax, 0xdfff7f7e
cmp eax, 0xe10614d3
jae 0x140026cac
jmp 0x140026cb9
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
ud2
xor eax, eax
test al, al
jne 0x140026c4a
mov eax, dword [0x141dc3478]
or eax, dword [0x141dc347c]
mov ecx, 0xa4130483
imul rcx, rax
shr rcx, 0x3e
imul esi, ecx, 0x37ad51c1
add esi, 0x3aba5736
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
cmp esi, 0x9cbd346a
jbe 0x140026c5a
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
jmp 0x140026c0f
mov eax, dword [0x141dc3480]
sub eax, dword [0x141dc3484]
imul eax, eax, 0xb5b24adb
add eax, 0xe30098fd
and eax, 0x59c42da9
cmp eax, 0xf00e7be2
jbe 0x140026c80
ud2
mov eax, dword [0x141dc3488]
xor edx, edx
div dword [0x141dc348c]
add eax, 0xd8906319
or eax, 0xb4fb2946
imul eax, eax, 0x15a56bbf
ud2
mov qword [0x141ddb258], rcx
xor eax, eax
test al, al
je 0x140026cd0
mov qword [0x141ddb258], rcx
jmp 0x140026cac
mov eax, dword [0x141dc34c0]
imul eax, dword [0x141dc34c4]
add eax, 0xbdff700f
xor eax, 0x94cdf230
imul eax, eax, 0x485b2c08
cmp eax, 0xbe0486cd
ja 0x140026cd0
test rcx, rcx
je 0x1400270d7
mov rax, rsi
or rax, rcx
shr rax, 0x20
je 0x140026d13
mov rax, rsi
xor edx, edx
div rcx
jmp 0x140026d19
mov eax, esi
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x140026d3d
xor edx, edx
div rcx
mov rsi, rax
jmp 0x140026d43
xor edx, edx
div ecx
mov esi, eax
add rsi, r8
mov rax, rsi
shr rax, 9
movabs r14, 0x44b82fa09b5a53
mul r14
mov rbx, rdx
sub rsp, 0x20
mov ecx, 0x23
call fcn.14008b8d0
add rsp, 0x20
mov rdi, qword [rbp - 0x50]
mov qword [rdi], 0
sub rsp, 0x20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
add rsp, 0x20
test eax, eax
je 0x140027007
mov rdi, qword [rdi]
mov r9, qword [0x141ddb258]
test r9, r9
mov rcx, qword [rbp + 0x80]
jne 0x140026e6e
mov rcx, qword [rbp + 0x38]
mov qword [rcx], 0
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
test eax, eax
je 0x1400270ff
nop
mov eax, dword [0x141dc3518]
or eax, dword [0x141dc351c]
add eax, 0xac2d662
or eax, 0x825b8824
and eax, 0xc65bae64
cmp eax, 0xc057b799
je 0x140026dd0
mov rax, qword [rbp + 0x38]
mov r9, qword [rax]
mov eax, dword [str._5GM_7]
xor edx, edx
div dword [0x141dc3524]
imul eax, eax, 0x47c154d8
add eax, 0x7cd85370
mov edx, 0x8557c1f1
imul rdx, rax
shr rdx, 0x3f
cmp edx, 0xf7e062a0
mov rcx, qword [rbp + 0x80]
jbe 0x140026e40
mov qword [0x141ddb258], r9
nop word cs:[rax + rax]
mov eax, dword [0x141dc3528]
imul eax, dword [0x141dc352c]
add eax, 0x3d4611e3
or eax, 0xa9da77fd
mov qword [0x141ddb258], r9
cmp eax, 0x5b4c2f7f
je 0x140026e40
test r9, r9
je 0x140027188
mov rax, rdi
or rax, r9
shr rax, 0x20
je 0x140026e84
mov rax, rdi
xor edx, edx
div r9
jmp 0x140026e8b
mov eax, edi
xor edx, edx
div r9d
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, r9
shr rdx, 0x20
je 0x140026eaf
xor edx, edx
div r9
mov rdi, rax
jmp 0x140026eb6
xor edx, edx
div r9d
mov edi, eax
add rdi, r8
mov rax, rdi
shr rax, 9
mul r14
mov r14, rdx
mov r8, qword [0x141ddb258]
test r8, r8
jne 0x140026f96
mov qword [rcx], 0
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
nop dword [rax + rax]
mov ecx, dword [0x141dc3548]
or ecx, dword [0x141dc354c]
imul ecx, ecx, 0xbec05797
add ecx, 0x25522f23
cmp ecx, 0xd4e0cba1
ja 0x140026ef0
test eax, eax
je 0x140026fdc
mov eax, dword [0x141dc3560]
xor edx, edx
div dword [0x141dc3564]
and eax, 0x9deb8909
mov ecx, 0xd07dd87b
imul rcx, rax
shr rcx, 0x39
or ecx, 0xc193014f
cmp ecx, 0x24c9424
mov rcx, qword [rbp + 0x80]
jae 0x140026f60
mov rax, qword [rcx]
mov qword [0x141ddb258], rax
nop word [rax + rax]
mov eax, dword [0x141dc3568]
and eax, dword [0x141dc356c]
imul eax, eax, 0x4edb3815
and eax, 0x3aa6ab36
xor eax, 0x766915dd
mov r8, qword [rcx]
mov qword [0x141ddb258], r8
cmp eax, 0x90ee477d
ja 0x140026f60
test r8, r8
je 0x1400271ae
shr rbx, 0xb
imul eax, ebx, 0x3b9aca00
sub esi, eax
shr r14, 0xb
imul eax, r14d, 0x3b9aca00
sub edi, eax
mov eax, dword [0x141dc3588]
sub eax, dword [0x141dc358c]
mov r9d, 0xc4653600
and eax, 0x99ed05f9
imul eax, eax, 0xf6635c7e
cmp eax, 0xa2b40105
jne 0x14002731b
jmp 0x140027382
mov eax, dword [0x141dc3550]
add eax, dword [0x141dc3554]
xor eax, 0x1304a208
and eax, 0x1f64e21f
xor eax, 0x882e8d6a
cmp eax, 0xf163cccf
jbe 0x14002728e
jmp 0x1400272c0
mov eax, dword [0x141dc34d8]
imul eax, dword [0x141dc34dc]
add eax, 0x3fa76346
and eax, 0xdf5fe0da
cmp eax, 0xaeedd979
jbe 0x140027033
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop word [rax + rax]
mov eax, dword [0x141dc34e0]
add eax, dword [0x141dc34e4]
xor eax, 0xd0a00461
or eax, 0xf0f7b8e
imul edi, eax, 0xf96aeef4
sub rsp, 0x20
call rsi
add rsp, 0x20
cmp edi, 0x63d20fe
je 0x140027040
mov eax, dword [0x141dc34e8]
xor edx, edx
div dword [0x141dc34ec]
imul eax, eax, 0xaa12b888
xor eax, 0x80000841
or eax, 0x793877a2
cmp eax, 0xe3dcd1f5
jne 0x140027095
ud2
xor eax, eax
nop word [rax + rax]
ud2
mov eax, dword [0x141dc34c8]
xor edx, edx
div dword [0x141dc34cc]
xor eax, 0xe0d399c6
add eax, 0x89e64f29
cmp eax, 0xa2c58828
jbe 0x1400271dd
jmp 0x140027206
mov eax, dword [0x141dc34f8]
add eax, dword [0x141dc34fc]
imul eax, eax, 0x3061ca63
or eax, 0x958b57fc
cmp eax, 0x5dc713ef
jne 0x14002712b
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x141dc3500]
or eax, dword [0x141dc3504]
imul edi, eax, 0x68bc32f
add edi, 0xb665fb31
sub rsp, 0x20
call rsi
add rsp, 0x20
cmp edi, 0x7918c308
jb 0x140027132
mov eax, dword [0x141dc3508]
add eax, dword [0x141dc350c]
imul eax, eax, 0xd314ce04
xor eax, 0x12690a10
and eax, 0xd6695f54
cmp eax, 0x32abf4df
jbe 0x14002720a
jmp 0x140027238
mov eax, dword [0x141dc3530]
and eax, dword [0x141dc3534]
add eax, 0x996a8958
and eax, 0xd450414
cmp eax, 0x7068945c
jbe 0x14002723c
jmp 0x140027262
mov eax, dword [0x141dc3570]
or eax, dword [0x141dc3574]
mov ecx, 0xad279f67
imul rcx, rax
shr rcx, 0x3f
imul eax, ecx, 0x4edbb7df
cmp eax, 0x29899f0f
jne 0x1400272d0
jmp 0x1400272f4
mov eax, dword [0x141dc34d0]
imul eax, dword [0x141dc34d4]
add eax, 0x1a1f6689
xor eax, 0xab935761
add eax, 0x8c8ab419
ud2
ud2
mov eax, dword [0x141dc3510]
add eax, dword [0x141dc3514]
or eax, 0x62a7f7c5
add eax, 0x579831a1
imul rax, rax, 0xe3adf99
shr rax, 0x3b
ud2
ud2
mov eax, dword [0x141dc3538]
and eax, dword [0x141dc353c]
imul eax, eax, 0x75fb8364
xor eax, 0xcdfefa28
imul eax, eax, 0x619f5b82
ud2
ud2
mov eax, dword [0x141dc3558]
add eax, dword [0x141dc355c]
imul esi, eax, 0x834cb9f4
add esi, 0x78f3771f
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
cmp esi, 0x71ca7e39
jbe 0x1400262e9
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
jmp 0x14002728e
mov eax, dword [0x141dc3578]
xor eax, dword [0x141dc357c]
or eax, 0x572d4fce
xor eax, 0x417571a4
add eax, 0x77b02f5a
ud2
ud2
mov eax, dword [0x141dc3590]
xor ecx, ecx
xor edx, edx
div dword [0x141dc3594]
imul r10d, eax, 0xd725a95c
add r10d, 0xf9a55bd0
and r10d, 0xd5a2524c
cmp r8, 0x3b9aca00
ja 0x140027355
mov eax, 0x3b9aca00
xor edx, edx
div r8d
mov ecx, eax
lea eax, [rcx + r9]
xor edx, edx
cmp r8, 2
cmovae eax, ecx
setb cl
xor r15d, r15d
cmp rbx, r14
setne r15b
mov r11d, 0xff
cmovae r11d, r15d
cmp r10d, 0x2289cbae
jne 0x140027397
cmp r8, 0x3b9aca00
ja 0x14002731b
mov eax, 0x3b9aca00
xor edx, edx
div r8d
jmp 0x14002731b
test r11b, r11b
jne 0x1400273e9
mov r8d, 0xd85d60d9
nop word cs:[rax + rax]
mov r9d, dword [0x141dc3598]
and r9d, dword [0x141dc359c]
or r9d, 0xb9479cd3
imul r9d, r9d, 0x1d136f3c
imul r9, r8
shr r9, 0x3c
cmp r9d, 0x61766a44
je 0x1400273b0
cmp edi, esi
setne r11b
ja 0x1400275f1
mov dl, cl
nop dword [rax + rax]
mov ecx, dword [0x141dc35a0]
sub ecx, dword [0x141dc35a4]
xor ecx, 0x48210139
and ecx, 0x48b7a339
imul ecx, ecx, 0xeda1678
cmp ecx, 0x5df51824
ja 0x1400273f0
cmp r11b, 1
jne 0x1400275f1
mov ecx, dword [0x141dc35e8]
imul ecx, dword [0x141dc35ec]
add ecx, 0xf8b8857f
imul r8, rcx, 0x2e28f6bf
shr r8, 0x20
sub ecx, r8d
shr ecx, 1
add ecx, r8d
shr ecx, 0x1f
cmp ecx, 0x7ab1b2e6
ja 0x140027420
mov rcx, rbx
sub rcx, r14
jb 0x1400262e9
nop dword [rax]
mov r8d, dword [0x141dc35f0]
or r8d, dword [0x141dc35f4]
xor r8d, 0xac9e000f
or r8d, 0x120bbf0
cmp r8d, 0xa6f9ed0a
je 0x140027460
cmp edi, esi
jbe 0x1400274f7
nop dword [rax]
mov r8d, dword [0x141dc35f8]
xor r8d, dword [0x141dc35fc]
or r8d, 0x41010000
xor r8d, 0x400038
and r8d, 0x414310b8
cmp r8d, 0xa38d6da8
ja 0x140027490
test rcx, rcx
je 0x1400262e9
dec rcx
lea r8d, [rsi + 0x3b9aca00]
nop
mov r9d, dword [0x141dc3600]
or r9d, dword [0x141dc3604]
add r9d, 0xbef57050
and r9d, 0x5ed08897
cmp r9d, 0xea0ac5e8
je 0x1400274d0
jmp 0x1400274fa
mov r8d, esi
sub r8d, edi
nop dword [rax]
mov r9d, dword [str.d6:S]
add r9d, dword [0x141dc360c]
imul r9d, r9d, 0x15109252
add r9d, 0xcafda0a4
cmp r9d, 0xe4430dd9
jb 0x140027500
cmp r8d, 0x3b9aca00
jb 0x1400275c3
mov r9d, r8d
shr r9d, 9
imul r9, r9, 0x44b83
shr r9, 0x27
imul r10d, r9d, 0x3b9aca00
sub r8d, r10d
mov r10d, r9d
nop word cs:[rax + rax]
mov r15d, dword [0x141dc3610]
and r15d, dword [0x141dc3614]
and r15d, 0x6d7d85b3
add r15d, 0xf5337eb0
xor r15d, 0xbc21fa8c
mov r9, rcx
add r9, r10
setb r11b
cmp r15d, 0x32727a0c
jb 0x140027560
test r11b, r11b
jne 0x1400277d1
nop
mov ecx, dword [0x141dc3618]
and ecx, dword [0x141dc361c]
xor ecx, 0x1827ecf0
add ecx, 0x5cdf472d
cmp ecx, 0x8ad57f33
jae 0x1400275a0
mov rcx, r9
xor r9d, r9d
cmp rcx, rdx
setne r9b
mov ecx, 0xff
cmovb r9d, ecx
xor edx, edx
cmp r8d, eax
setne dl
cmovb edx, ecx
test r9b, r9b
cmovne edx, r9d
cmp dl, 1
jne 0x1400277c8
cmp rbx, r14
ja 0x1400277c8
sub r14, rbx
nop dword [rax]
mov eax, dword [0x141dc35a8]
or eax, dword [0x141dc35ac]
xor eax, 0xe06020a1
or eax, 0x1e951d58
cmp eax, 0x7e66a078
je 0x140027600
mov eax, 0xcd298697
nop word cs:[rax + rax]
mov ecx, dword [0x141dc35b0]
mov edx, dword [0x141dc35b4]
add ecx, edx
add ecx, 0x2c9af4fc
xor ecx, 0x3beabb
imul rcx, rax
shr rcx, 0x3c
cmp ecx, 0x3e33b69e
je 0x140027630
cmp edi, esi
jae 0x1400276d8
test r14, r14
je 0x1400277c8
mov eax, dword [0x141dc35b8]
xor edx, edx
div dword [0x141dc35bc]
dec r14
nop dword [rax + rax]
mov eax, dword [0x141dc35c0]
xor eax, dword [0x141dc35c4]
imul eax, eax, 0xe3ad3d8a
cmp eax, 0x65be10f4
je 0x140027680
mov eax, 0xb5832f47
add edi, 0x3b9aca00
nop word cs:[rax + rax]
mov ecx, dword [0x141dc35c8]
xor ecx, dword [0x141dc35cc]
add ecx, 0xac887f2f
and ecx, 0x9c225419
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0x766faefe
ja 0x1400276b0
sub edi, esi
cmp edi, 0x3b9aca00
jb 0x140027768
mov eax, edi
shr eax, 9
imul rax, rax, 0x44b83
shr rax, 0x27
add r14, rax
jb 0x14002779d
imul eax, eax, 0x3b9aca00
sub edi, eax
nop word [rax + rax]
mov eax, dword [0x141dc35d0]
imul eax, dword [0x141dc35d4]
add eax, 0x85cde5fd
and eax, 0x63506249
imul rax, rax, 0x2c8f904d
shr rax, 0x3b
cmp eax, 0x66f77adc
ja 0x140027710
mov eax, 0x8e7db86b
nop
mov ecx, dword [0x141dc35d8]
add ecx, dword [0x141dc35dc]
or ecx, 0xe4a83173
imul rcx, rax
shr rcx, 0x3c
imul ecx, ecx, 0x5addf072
cmp ecx, 0x5b5dd8bd
jb 0x140027740
cmp edi, 0x3b9aca00
je 0x1400277c8
cmp r14, 0x19
jb 0x1400277c8
mov eax, dword [0x141dc3630]
imul eax, dword [0x141dc3634]
imul eax, eax, 0xc40b9fb3
cmp eax, 0xe7dc089b
mov rdi, qword [rbp + 8]
jne 0x140027816
jmp 0x14002784f
ud2
sub rsp, 0x20
call fcn.1400bff60
mov eax, dword [0x141dc3620]
xor edx, edx
div dword [0x141dc3624]
or eax, 0xa7f64f7e
add eax, 0x29573a4e
cmp eax, 0x7620f8f0
jae 0x1400277f2
ud2
mov eax, dword [0x141dc3628]
and eax, dword [0x141dc362c]
and eax, 0x949a22c1
xor eax, 0xb980241
ud2
mov eax, dword [0x141dc3638]
sub eax, dword [0x141dc363c]
xor eax, 0x20000a64
or eax, 0x1fbef48b
imul rsi, rax, 0x7450e21f
shr rsi, 0x3e
sub rsp, 0x20
mov rcx, rdi
call fcn.1400de730
add rsp, 0x20
cmp esi, 0x362651c1
jbe 0x140027861
sub rsp, 0x20
mov rcx, rdi
call fcn.1400de730
add rsp, 0x20
jmp 0x140027816
movzx eax, byte [rdi]
mov rdi, qword [rbp - 0x10]
mov rbx, qword [rbp - 8]
mov r14, qword [rbp]
mov ecx, dword [str.:_nH]
add ecx, dword [0x141dc3644]
xor ecx, 0x1cc8c5e8
imul ecx, ecx, 0x48db1e58
cmp ecx, 0xc0da0237
je 0x140027870
mov ecx, dword [0x141dc3648]
add ecx, dword [0x141dc364c]
imul ecx, ecx, 0x51739ea6
shr ecx, 3
imul rcx, rcx, 0x107265cd
shr rcx, 0x39
add ecx, 0x6551463d
cmp ecx, 0x312474bf
jb 0x140027890
cmp al, 0x12
jne 0x140027b14
sub rsp, 0x20
call fcn.14001cdd0
add rsp, 0x20
mov eax, dword [0x141dc3650]
imul eax, dword [0x141dc3654]
imul eax, eax, 0x149a77b1
shr eax, 1
imul rax, rax, 0x440b14dd
shr rax, 0x3d
cmp eax, 0x80302976
jne 0x1400279c0
mov qword [r12], 0
mov dword [r14], 0
mov qword [rbx], 0
mov dword [rdi], 0
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov rdx, rdi
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 7
mov r8, r12
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x10
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 0x1f
mov r8, r14
mov r9d, 4
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x10
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 0x1e
mov r8, rbx
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x30
nop word cs:[rax + rax]
mov eax, dword [0x141dc3658]
or eax, dword [0x141dc365c]
and eax, 0xe818403d
imul esi, eax, 0x55a20f94
mov qword [r12], 0
mov dword [r14], 0
mov qword [rbx], 0
mov dword [rdi], 0
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov rdx, rdi
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 7
mov r8, r12
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x10
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 0x1f
mov r8, r14
mov r9d, 4
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x10
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 0x1e
mov r8, rbx
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x30
cmp dword [rdi], 0
sete al
cmp qword [r12], 0
sete cl
cmp dword [r14], 0
setne dl
cmp esi, 0x540d32a8
jb 0x1400279c0
and al, cl
and al, dl
mov rcx, qword [rbx]
nop word cs:[rax + rax]
test rcx, rcx
sete dl
mov r8d, dword [0x141dc3660]
and r8d, dword [0x141dc3664]
add r8d, 0x214b4b97
imul r8, r8, 0x5ede7a61
shr r8, 0x3c
and r8d, 0xfffffffd
cmp r8d, 0xec100ac4
ja 0x140027ac0
sub rsp, 0x20
and al, dl
je 0x140027b6a
mov ecx, 0x80000001
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
call fcn.140027bb0
add rsp, 0x20
jmp 0x140026570
mov eax, dword [0x141dc3670]
or eax, dword [0x141dc3674]
imul eax, eax, 0x5d49fb58
and eax, 0x5898df8
imul eax, eax, 0x300b209b
cmp eax, 0x52b2ec4d
jbe 0x140027b40
ud2
mov eax, dword [0x141dc3678]
or eax, dword [0x141dc367c]
imul eax, eax, 0x1e880824
add eax, 0xdcb017ec
and eax, 0x9d88d65c
ud2
call fcn.1400bff60
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dc3668]
imul eax, dword [0x141dc366c]
or eax, 0xa4594de3
imul rax, rax, 0x1366c9a3
shr rax, 0x3b
imul eax, eax, 0x642ce5c4
cmp eax, 0xc1f0f94c
ja 0x140027b80
jmp 0x1400262e9