Function at 0x140024cf0
Capabilities:
Check for debugger via api
Check for process debug object
Check for time delay via queryperformancecounter
Check processdebugflags
Check processdebugport
Create process on windows
Encode data using base64
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x188
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xf0], xmm6
mov eax, dword [0x141f30348]
sub eax, dword [0x141f3034c]
xor eax, 0xee8bac30
add eax, 0xebbda104
cmp eax, 0x2464f46a
jbe 0x140024dc0
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x70
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
nop word cs:[rax + rax]
mov eax, dword [0x141f30350]
xor edx, edx
div dword [0x141f30354]
or eax, 0x5d7906d0
xor eax, 0x583eb7f
imul ecx, eax, 0xcd647260
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rdx, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r8, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r10, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r11, rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov r14, rsp
mov eax, 0x70
call fcn.1400f4d10
sub rsp, rax
mov rsi, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rdi, rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov rbx, rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov rax, rsp
cmp ecx, 0xe3bae629
ja 0x140024dc0
mov qword [rbp + 0xa0], r14
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0x70], rbx
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0x78], r11
mov qword [rbp + 0x58], r8
mov qword [rbp + 0x98], rdx
mov eax, dword [0x141f30358]
xor eax, dword [0x141f3035c]
add eax, 0xc30b33c0
xor eax, 0x1be44bf6
imul eax, eax, 0xf4c88a08
cmp eax, 0x26158712
jne 0x140024f9c
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x30
call fcn.1400f4d10
sub rsp, rax
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0xd0], rdi
mov qword [rbp + 8], r10
mov qword [rbp], r9
nop dword [rax + rax]
mov eax, dword [0x141f30360]
sub eax, dword [0x141f30364]
imul ecx, eax, 0x8a228fbb
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov r11, rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov rdi, rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov rbx, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0xc8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0xb0], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r8, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rdx, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r10, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r13, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r14, rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov rsi, rsp
mov eax, 0x30
call fcn.1400f4d10
sub rsp, rax
mov r12, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rax, rsp
cmp ecx, 0xbc28d98f
je 0x140024fb0
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r13
mov qword [rbp + 0x88], rbx
mov qword [rbp + 0xa8], rdi
mov qword [rbp - 0x70], r11
mov qword [rbp + 0x20], r10
mov qword [rbp + 0x80], r9
mov qword [rbp + 0x18], r8
mov qword [rbp + 0x10], rdx
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x40], rsp
mov eax, 0x30
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x38], rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x80], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x48], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x50], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x30], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x20], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov r12, rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x90], rsp
mov eax, 0x20
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x28], rsp
mov eax, 0x30
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0xd8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0xe8], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov rdi, rsp
mov eax, 0x30
call fcn.1400f4d10
sub rsp, rax
mov rbx, rsp
mov eax, 0x30
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0xc0], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x30], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x38], rsp
mov eax, 0x30
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp + 0x40], rsp
mov eax, 0x30
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x18], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x10], rsp
mov eax, 0x10
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 8], rsp
mov eax, 0x30
call fcn.1400f4d10
sub rsp, rax
mov qword [rbp - 0x28], rsp
mov qword [r15], 0
mov r13, qword [rbp + 0xb0]
mov dword [r13], 0
mov rax, qword [rbp + 0xc8]
mov dword [rax], 0
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 8
mov r14, r15
mov r8, r15
call sub.ADVAPI32.dll_OpenProcessToken
add rsp, 0x20
test eax, eax
mov qword [rbp - 0x68], rsi
je 0x140025340
mov r15, qword [rbp + 0xc8]
nop dword [rax]
mov eax, dword [0x141f30378]
xor edx, edx
div dword [0x141f3037c]
xor eax, 0x87232709
imul rcx, rax, 0x2058f965
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
xor eax, 0x3fb6f7d9
cmp eax, 0xfb78ab38
ja 0x1400252d0
mov r14, qword [r14]
mov eax, dword [0x141f30380]
imul eax, dword [0x141f30384]
imul eax, eax, 0xc7e15dd9
imul rax, rax, 0x4d70ea6d
shr rax, 0x3e
add eax, 0x9b5393a7
cmp eax, 0x8cd6ec9
jae 0x140026928
jmp 0x140026951
mov eax, dword [0x141f30368]
xor eax, dword [0x141f3036c]
add eax, 0xb4f9e165
or eax, 0xacf47139
and eax, 0xbcfcf3b9
cmp eax, 0x6a56452
jb 0x140025340
nop word cs:[rax + rax]
mov eax, dword [0x141f30370]
xor edx, edx
div dword [0x141f30374]
or eax, 0xf93f97ff
add eax, 0x60c47011
cmp eax, 0x11008c2d
jbe 0x140025370
nop
mov eax, dword [0x141f30398]
xor edx, edx
div dword [0x141f3039c]
or eax, 0x200b3900
and eax, 0xab1bbb05
cmp eax, 0xd94ffd50
je 0x140025390
mov r13, qword [rbp + 0xc0]
nop word cs:[rax + rax]
mov eax, dword [0x141f303a0]
add eax, dword [0x141f303a4]
and eax, 0x50002490
add eax, 0x12b3d3f1
cmp eax, 0x6943e7f0
ja 0x1400253c0
movabs rax, 0x8000000000000001
dec rax
mov qword [rbp - 0x78], rax
xorps xmm6, xmm6
nop word cs:[rax + rax]
sub rsp, 0x20
mov rsi, qword [rbp - 0x80]
mov rcx, rsi
call fcn.140097c40
add rsp, 0x20
mov ecx, 0x9c784e79
mov eax, dword [str.b_ve7_e]
xor edx, edx
div dword [0x141f303ac]
imul eax, eax, 0x3a21b6b8
xor eax, 0x488753c3
imul rax, rcx
shr rax, 0x3e
cmp eax, 0xa9bd1807
ja 0x140025419
mov r15, qword [rsi]
mov rax, qword [rsi + 8]
cmp r15, qword [rbp - 0x78]
mov rbx, qword [rbp + 0x88]
mov qword [rbp + 0xe8], rax
je 0x1400266fc
xor eax, eax
mov r12, qword [rbp - 0x70]
mov r13, qword [rbp - 0x68]
nop word [rax + rax]
test al, al
jne 0x140025470
mov eax, dword [0x141f303b0]
sub eax, dword [0x141f303b4]
mov rsi, qword [rsi + 0x10]
xor eax, 0xf6e99c58
add eax, 0xd6c79afe
cmp eax, 0xab0dacbb
mov r14, qword [rbp + 0xe8]
ja 0x1400254db
nop dword [rax]
mov eax, dword [0x141f303b8]
and eax, dword [0x141f303bc]
xor eax, 0x42b029c0
imul edi, eax, 0x6d9e11a5
or edi, 0x9c9a4f9c
sub rsp, 0x20
mov rcx, r13
mov rdx, r14
mov r8, rsi
call fcn.140057380
add rsp, 0x20
cmp edi, 0xeba99407
jae 0x140025500
sub rsp, 0x20
mov rcx, r13
mov rdx, r14
mov r8, rsi
call fcn.140057380
add rsp, 0x20
jmp 0x1400254a0
mov rax, qword [r13]
nop word cs:[rax + rax]
mov ecx, dword [0x141f303c0]
add ecx, dword [0x141f303c4]
imul rdx, rcx, 0x3740daf
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1e
add ecx, 0x1a783e93
cmp ecx, 0x5e312f38
ja 0x140025510
test rax, rax
mov rsi, qword [rbp + 0xa8]
jne 0x140026874
mov rdi, qword [r13 + 0x10]
test rdi, rdi
js 0x1400267e5
mov r14, r12
mov r13, qword [r13 + 8]
je 0x140025620
mov eax, dword [0x141f303d0]
xor eax, dword [0x141f303d4]
imul eax, eax, 0xf64e6acc
add eax, 0x93aec4d8
or eax, 0x77721d3e
cmp eax, 0x6ee6eeb1
jae 0x1400255a0
movzx eax, byte [0x141f49078]
nop word cs:[rax + rax]
mov eax, dword [0x141f303d8]
or eax, dword [0x141f303dc]
xor eax, 0x2d8820fe
imul rax, rax, 0x413c5029
shr rax, 0x3e
or eax, 0x5bec4f8
movzx ecx, byte [0x141f49078]
cmp eax, 0xa297a80f
je 0x1400255a0
sub rsp, 0x20
xor ecx, ecx
mov rdx, rdi
call fcn.1400c6170
add rsp, 0x20
mov r12, rax
nop word cs:[rax + rax]
mov eax, dword [0x141f303e0]
xor edx, edx
div dword [0x141f303e4]
add eax, 0xd91a6b48
and eax, 0x8b54758b
cmp eax, 0x490e5a85
je 0x1400255f0
test r12, r12
jne 0x140025626
jmp 0x140026817
mov r12d, 1
mov qword [rbp + 0x60], r15
mov eax, dword [0x141f303f0]
add eax, dword [0x141f303f4]
imul eax, eax, 0x87b24915
cmp eax, 0x5a3c009a
jne 0x140025704
sub rsp, 0x20
mov rcx, r12
mov rdx, r13
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rsp, 0x20
mov qword [rbx], 0
mov qword [rbx + 8], 1
mov qword [rbx + 0x10], 0
lea rax, [r12 + rdi]
mov qword [r14], r12
mov qword [r14 + 8], rax
mov word [r14 + 0x10], 0
mov dword [r14 + 0x18], 1
sub rsp, 0x20
mov rcx, rsi
mov rdx, r14
call fcn.140088da0
add rsp, 0x20
mov rdx, qword [rbp + 0x70]
mov qword [rdx], 1
mov qword [rdx + 8], 1
mov word [rdx + 0x10], 0
mov dword [rdx + 0x18], 1
sub rsp, 0x20
mov rcx, qword [rbp + 0xb8]
call fcn.140088da0
add rsp, 0x20
mov rax, qword [rbp + 0xd0]
mov dword [rax], 0
mov rax, qword [rbp + 0xe0]
movups xmmword [rax + 0x60], xmm6
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax + 0x10], xmm6
movups xmmword [rax], xmm6
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xd8], r13
mov qword [rbp + 0xc8], rdi
mov rdi, qword [rbp + 0x70]
mov r15, r14
mov r14, qword [rbp + 0xe0]
nop word [rax + rax]
mov eax, dword [0x141f303f8]
imul eax, dword [0x141f303fc]
add eax, 0xbfa03385
imul rsi, rax, 0x7e1dcd61
shr rsi, 0x3e
sub rsp, 0x20
mov r12, qword [rbp + 0xb0]
mov rcx, r12
mov rdx, qword [rbp + 0xd8]
mov r13, qword [rbp + 0xc8]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
add rsp, 0x20
mov qword [rbx], 0
mov qword [rbx + 8], 1
mov qword [rbx + 0x10], 0
lea rax, [r12 + r13]
mov qword [r15], r12
mov qword [r15 + 8], rax
mov word [r15 + 0x10], 0
mov dword [r15 + 0x18], 1
sub rsp, 0x20
mov r13, qword [rbp + 0xa8]
mov rcx, r13
mov rdx, r15
call fcn.140088da0
add rsp, 0x20
mov qword [rdi], 1
mov qword [rdi + 8], 1
mov word [rdi + 0x10], 0
mov dword [rdi + 0x18], 1
sub rsp, 0x20
mov r12, qword [rbp + 0xb8]
mov rcx, r12
mov rdx, rdi
call fcn.140088da0
add rsp, 0x20
mov rax, qword [r13 + 8]
mov rcx, qword [r12 + 8]
mov rdx, qword [rbp + 0xd0]
mov dword [rdx], 0
movups xmmword [r14 + 0x60], xmm6
movups xmmword [r14 + 0x50], xmm6
movups xmmword [r14 + 0x40], xmm6
movups xmmword [r14 + 0x30], xmm6
movups xmmword [r14 + 0x20], xmm6
movups xmmword [r14 + 0x10], xmm6
movups xmmword [r14], xmm6
cmp esi, 0x560d623
je 0x140025730
mov qword [rbp + 0x90], rcx
mov qword [rbp + 0xd8], rax
movabs rax, 0x3fffffffffffffff
mov esi, 4
cmp rsi, rax
ja 0x140026848
mov eax, dword [0x141f30410]
and eax, dword [0x141f30414]
or eax, 0xbc1ef3ff
xor eax, 0x845d51cd
cmp eax, 0x1ac5c141
mov edi, 0
movabs r15, 0xaaaaaaaaaaaaaaab
jae 0x1400258b0
movzx eax, byte [0x141f49078]
sub rsp, 0x20
mov edx, 8
xor ecx, ecx
call fcn.1400c6170
add rsp, 0x20
nop word [rax + rax]
movzx eax, byte [0x141f49078]
sub rsp, 0x20
mov edx, 8
xor ecx, ecx
call fcn.1400c6170
add rsp, 0x20
test dil, dil
jne 0x1400258b0
mov rbx, rax
nop word cs:[rax + rax]
mov eax, dword [0x141f30418]
or eax, dword [0x141f3041c]
imul eax, eax, 0x911ddf0c
add eax, 0x23047a28
imul rax, rax, 0x531e2e41
shr rax, 0x3e
cmp eax, 0x37d3a7fb
je 0x1400258e0
test rbx, rbx
mov rcx, qword [rbp + 0xa0]
je 0x140026b5b
test dil, dil
jne 0x14002594b
nop
mov eax, dword [0x141f30420]
add eax, dword [0x141f30424]
imul eax, eax, 0xeea98c03
or eax, 0x2028000
and eax, 0x53528e30
mov word [rbx], 0x72
mov qword [rcx], rsi
cmp eax, 0xf55216e8
jne 0x140025960
mov word [rbx], 0x72
mov qword [rcx], rsi
jmp 0x140025920
mov eax, dword [0x141f30428]
sub eax, dword [0x141f3042c]
imul eax, eax, 0x5e76b9a6
shr eax, 2
imul rax, rax, 0x23453ac3
shr rax, 0x38
and eax, 0xfffffffe
cmp eax, 0x39d25baf
jbe 0x140025990
mov qword [rcx + 8], rbx
nop
mov eax, dword [0x141f30430]
xor edx, edx
div dword [0x141f30434]
add eax, 0x5f1bc477
imul rax, rax, 0x6fbb90b7
shr rax, 0x3e
imul eax, eax, 0x994fe3d3
mov qword [rcx + 8], rbx
cmp eax, 0x99c6a29c
ja 0x140025990
mov qword [rcx + 0x10], 1
mov r14d, 1
xor r13d, r13d
lea r12, [0x141f255bb]
jmp 0x1400259ef
mov word [rbx + r14*2], r13w
inc r14
mov qword [rcx + 0x10], r14
mov r13d, edi
test r13w, r13w
je 0x140025a00
xor edi, edi
jmp 0x140025cb0
mov r13, qword [sym.imp.shell32.dll_ShellExecuteExW]
nop word [rax + rax]
mov eax, dword [0x141f30438]
or eax, dword [0x141f3043c]
add eax, 0x83f3d86b
or eax, 0x150c127
cmp eax, 0x9d3040a1
je 0x140025a10
nop dword [rax]
mov eax, dword [0x141f30440]
or eax, dword [0x141f30444]
xor eax, 0x8086008
or eax, 0xf7d79ff7
cmp eax, 0x84611ab6
je 0x140025a30
lea rax, [0x141f255c0]
cmp r12, rax
je 0x140025db0
lea r8, [r12 + 1]
mov eax, dword [0x141f30448]
add eax, dword [0x141f3044c]
imul rax, rax, 0x38974e2b
shr rax, 0x3d
add eax, 0x9659fc61
cmp eax, 0xf85a78b
jb 0x140025a62
movzx r9d, byte [r12]
test r9b, r9b
js 0x140025ab5
nop
mov eax, dword [str.PFXW]
or eax, dword [0x141f3045c]
add eax, 0x87c4cefd
xor eax, 0x37ea60f1
cmp eax, 0x9753ecc
jb 0x140025a90
mov r13d, r9d
jmp 0x140025ca1
mov edx, 0xbb105d51
mov eax, dword [0x141f30450]
add eax, dword [0x141f30454]
imul rax, rdx
shr rax, 0x3d
cmp eax, 0xa570efc1
je 0x140025aba
mov r10d, r9d
and r10d, 0x1f
movzx esi, byte [r12 + 1]
and esi, 0x3f
cmp r9b, 0xdf
jbe 0x140025c90
mov eax, dword [0x141f30460]
imul eax, dword [0x141f30464]
add eax, 0x272eacef
or eax, 0xf14c102b
imul rdx, rax, 0x3a9b5fcb
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1d
cmp eax, 0x66f3c729
ja 0x140025aef
lea r8, [r12 + 3]
movzx r11d, byte [r12 + 2]
mov eax, dword [0x141f30468]
xor edx, edx
div dword [0x141f3046c]
nop word [rax + rax]
mov eax, dword [0x141f30470]
and eax, dword [0x141f30474]
xor eax, 0x9d1e96f7
imul eax, eax, 0x58ec54e
add eax, 0x606cb2b8
cmp eax, 0xc12d6a0b
ja 0x140025b40
shl esi, 6
and r11d, 0x3f
or r11d, esi
mov r13d, r10d
shl r13d, 0xc
or r13d, r11d
mov eax, dword [0x141f30478]
xor edx, edx
div dword [0x141f3047c]
nop word cs:[rax + rax]
mov eax, dword [0x141f30480]
and eax, dword [0x141f30484]
imul eax, eax, 0x5e61c227
imul rax, rax, 0x434f656d
shr rax, 0x3c
cmp eax, 0x343d328b
je 0x140025b90
cmp r9b, 0xf0
jb 0x140025bfc
nop word [rax + rax]
mov eax, dword [0x141f30488]
sub eax, dword [0x141f3048c]
imul eax, eax, 0xd969f4cc
cmp eax, 0x28d356ef
je 0x140025bc0
and r10d, 7
shl r10d, 0x12
shl r11d, 6
or r11d, r10d
movzx r13d, byte [r12 + 3]
add r12, 4
and r13d, 0x3f
or r13d, r11d
mov r8, r12
mov rcx, qword [rbp + 0xa0]
nop word cs:[rax + rax]
mov eax, dword [0x141f30490]
add eax, dword [0x141f30494]
or eax, 0x99074be9
imul rax, rax, 0x612fec6d
shr rax, 0x3e
or eax, 0x1d572d1e
cmp eax, 0xabee7ba8
je 0x140025c10
cmp r13d, 0xffff
jbe 0x140025ca1
lea r9d, [r13 + 0xff0000]
shr r9d, 0xa
mov eax, dword [0x141f30498]
xor edx, edx
div dword [0x141f3049c]
mov edx, 0xcde21089
imul rax, rdx
shr rax, 0x3d
cmp eax, 0xbbeaebbc
je 0x140025c4c
movzx eax, r9w
or eax, 0xd800
and r13d, 0x3ff
or r13d, 0xdc00
mov r12, r8
mov edi, r13d
mov r13d, eax
jmp 0x140025cb0
add r12, 2
shl r10d, 6
or r10d, esi
mov r8, r12
mov r13d, r10d
xor edi, edi
mov r12, r8
nop word cs:[rax + rax]
mov eax, dword [0x141f304a0]
xor edx, edx
div dword [0x141f304a4]
imul eax, eax, 0x7174c074
add eax, 0xb785d53
cmp eax, 0x5a79a0bd
ja 0x140025cb0
cmp r14, qword [rcx]
jne 0x1400259e0
lea rsi, [0x141f255ba]
sub rsi, r12
mov eax, dword [0x141f304a8]
and eax, dword [0x141f304ac]
add rsi, 8
or eax, 0x541fb09
and eax, 0x8551ff8d
cmp eax, 0xbc381563
je 0x140025d6c
mov eax, dword [0x141f304b0]
sub eax, dword [0x141f304b4]
xor eax, 0xc667de93
imul rbx, rax, 0x151e9493
shr rbx, 0x38
mov rax, rsi
mul r15
shr rdx, 1
cmp di, 1
sbb rdx, 0
lea r8, [rdx + 2]
sub rsp, 0x30
mov qword [rsp + 0x20], 2
mov r9d, 2
mov rdx, r14
call fcn.1401035b0
mov rcx, qword [rbp + 0xa0]
add rsp, 0x30
cmp ebx, 0xd0cfb8d
ja 0x140025d04
mov rbx, qword [rcx + 8]
jmp 0x1400259e0
mov rax, rsi
mul r15
shr rdx, 1
cmp di, 1
sbb rdx, 0
lea r8, [rdx + 2]
sub rsp, 0x30
mov qword [rsp + 0x20], 2
mov r9d, 2
mov rdx, r14
call fcn.1401035b0
mov rcx, qword [rbp + 0xa0]
add rsp, 0x30
jmp 0x140025d04
mov rax, qword [rcx]
mov qword [rbp + 0x68], rax
mov r14, qword [rcx + 8]
sub rsp, 0x20
xor ecx, ecx
mov edx, 6
call qword [sym.imp.ole32.dll_CoInitializeEx]
add rsp, 0x20
mov rbx, qword [rbp + 0xe0]
movabs rax, 0x14000000070
mov qword [rbx], rax
mov qword [rbx + 0x10], r14
mov eax, dword [0x141f304b8]
xor edx, edx
div dword [0x141f304bc]
or eax, 0x8000008
xor eax, 0x22880000
and eax, 0xaae800c8
cmp eax, 0x1498fb76
mov r15, qword [rbp + 0xd8]
mov r12, qword [rbp + 0x90]
je 0x140025e71
nop word [rax + rax]
mov eax, dword [0x141f304c0]
imul eax, dword [0x141f304c4]
or eax, 0xc0d1c149
xor eax, 0x90a76348
imul edi, eax, 0xae44390c
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], r12
mov dword [rbx + 0x30], 1
sub rsp, 0x20
mov rcx, rbx
call r13
add rsp, 0x20
test eax, eax
sete al
mov rsi, qword [rbx + 0x68]
test rsi, rsi
sete cl
cmp edi, 0xa1fb7c94
jbe 0x140025e90
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], r12
mov dword [rbx + 0x30], 1
sub rsp, 0x20
mov rcx, rbx
call r13
add rsp, 0x20
jmp 0x140025e20
or al, cl
je 0x140025fc0
mov r13d, 0x902c2443
nop
mov eax, dword [0x141f304c8]
and eax, dword [0x141f304cc]
and eax, 0xb040140
xor eax, 0x62068120
cmp eax, 0xf7db34e6
ja 0x140025ea0
cmp qword [rbp + 0x68], 0
je 0x140025f70
mov rsi, qword [0x141f49060]
mov eax, dword [0x141f304d0]
sub eax, dword [0x141f304d4]
imul eax, eax, 0x199c4c6
add eax, 0xeca1d8
imul rax, rax, 0x11bd6037
shr rax, 0x38
cmp eax, 0x31b35a4e
jne 0x140025f0e
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov edi, dword [0x141f304d8]
and edi, dword [0x141f304dc]
xor edi, 0x5a0afd29
add edi, 0xc4e94ba2
mov rax, rdi
imul rax, r13
shr rax, 0x20
sub edi, eax
shr edi, 1
add edi, eax
shr edi, 0x1e
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r14
call rbx
add rsp, 0x20
cmp edi, 0x49a568e3
ja 0x140025f20
nop word cs:[rax + rax]
mov eax, dword [0x141f304e0]
xor edx, edx
div dword [0x141f304e4]
or eax, 0xa80000a6
and eax, 0xa89000a7
cmp eax, 0x7b10216d
je 0x140025f70
mov edi, 0xffffffff
mov rcx, qword [rbp + 0xb8]
mov r14, qword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, 0x9034ad73
mov r13d, 0x93c55957
jmp 0x1400261d0
mov eax, dword [0x141f304e8]
add eax, dword [0x141f304ec]
or eax, 0x588272bc
imul rcx, rax, 0x257c60d
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
add eax, 0xa702b20d
cmp eax, 0x6db4edfa
mov rbx, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jb 0x140026038
nop dword [rax + rax]
mov eax, dword [str.F_bbdN_fwA]
add eax, dword [0x141f304f4]
imul edi, eax, 0xbc0d5c87
or edi, 0x4531c189
add edi, 0x7bc6951d
sub rsp, 0x20
mov rcx, rsi
mov edx, 0xffffffff
call rbx
add rsp, 0x20
cmp edi, 0xd40088b8
jbe 0x140026050
sub rsp, 0x20
mov rcx, rsi
mov edx, 0xffffffff
call rbx
add rsp, 0x20
jmp 0x140026000
mov eax, dword [0x141f304f8]
and eax, dword [0x141f304fc]
add eax, 0x7a4dcaa0
and eax, 0x204c726b
xor eax, 0x2dbf5509
cmp eax, 0xe1e7cb6a
mov r13d, 0x93c55957
mov rbx, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jbe 0x14002609b
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax + 0x68]
sub rsp, 0x20
mov rdx, qword [rbp + 0xd0]
call rbx
add rsp, 0x20
mov rdi, qword [rbp + 0xe0]
mov r15, qword [rbp + 0xd0]
nop dword [rax]
mov esi, dword [0x141f30500]
or esi, dword [0x141f30504]
or esi, 0xe6e7f3f6
and esi, 0xe7e7f3f7
mov rcx, qword [rdi + 0x68]
sub rsp, 0x20
mov rdx, r15
call rbx
add rsp, 0x20
cmp esi, 0xd711a6c9
jb 0x1400260b0
mov ecx, eax
mov eax, dword [0x141f30508]
xor edx, edx
div dword [0x141f3050c]
mov esi, 0x9034ad73
nop word cs:[rax + rax]
mov eax, dword [0x141f30510]
xor eax, dword [0x141f30514]
imul rax, rax, 0xe9ced99
shr rax, 0x3a
or eax, 0x57fede24
cmp ecx, 1
mov edi, 0
sbb edi, edi
cmp eax, 0xe1bcde37
ja 0x140026100
mov rax, qword [rbp + 0xd0]
or edi, dword [rax]
cmp qword [rbp + 0x68], 0
je 0x140026160
mov rcx, qword [0x141f49060]
sub rsp, 0x20
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop word [rax + rax]
mov eax, dword [0x141f30518]
or eax, dword [0x141f3051c]
add eax, 0x284b25a2
and eax, 0x9aeccfad
xor eax, 0x834d0195
cmp eax, 0xb978576d
ja 0x140026160
mov rcx, qword [rbp + 0xb8]
mov r14, qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x141f30520]
xor eax, dword [0x141f30524]
add eax, 0x7e6c5347
xor eax, 0x4be5fca9
cmp eax, 0xc7fe2553
ja 0x140026190
nop dword [rax]
mov eax, dword [0x141f30528]
add eax, dword [0x141f3052c]
imul eax, eax, 0x2b02ec98
add eax, 0xa704b5b3
cmp eax, 0x7df0e6ca
ja 0x1400261b0
nop
mov eax, dword [0x141f30530]
or eax, dword [0x141f30534]
xor eax, 0xc5082592
or eax, 0x2a75982d
imul rax, rsi
shr rax, 0x3e
cmp eax, 0xa0f1d1d1
je 0x1400261d0
cmp qword [rcx], 0
je 0x140026267
mov rsi, qword [rcx + 8]
mov eax, dword [0x141f30538]
sub eax, dword [0x141f3053c]
and eax, 0x82100103
cmp eax, 0xed185cc4
jbe 0x140026230
mov rcx, qword [0x141f49060]
sub rsp, 0x20
xor edx, edx
mov r8, rsi
call r14
add rsp, 0x20
nop
mov ebx, dword [0x141f30540]
xor ebx, dword [0x141f30544]
add ebx, 0x87178c7f
and ebx, 0x3eb4f7b9
mov rcx, qword [0x141f49060]
sub rsp, 0x20
xor edx, edx
mov r8, rsi
call r14
add rsp, 0x20
cmp ebx, 0x4cc6915
jb 0x140026230
mov rax, qword [rbp + 0xa8]
mov rax, qword [rax]
nop word cs:[rax + rax]
mov ecx, dword [0x141f30548]
xor ecx, dword [0x141f3054c]
imul rcx, r13
shr rcx, 0x3f
or ecx, 0x525a7020
cmp ecx, 0x959e170d
ja 0x140026280
test rax, rax
je 0x140026340
mov rax, qword [rbp + 0xa8]
mov rsi, qword [rax + 8]
mov r14, qword [0x141f49060]
mov eax, dword [0x141f30550]
xor eax, dword [0x141f30554]
imul eax, eax, 0xdc4df2ac
cmp eax, 0xa8ca4ec4
je 0x14002631b
nop word cs:[rax + rax]
mov eax, dword [0x141f30558]
and eax, dword [0x141f3055c]
imul rbx, rax, 0x3afb3c5b
shr rbx, 0x3d
or ebx, 0x4b80e908
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp ebx, 0xdb88e308
jbe 0x140026340
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x1400262e0
mov eax, dword [0x141f30560]
and eax, dword [0x141f30564]
or eax, 0xdea452db
imul eax, eax, 0xb97fdfb
add eax, 0x291b1254
cmp eax, 0x1818744a
jb 0x140026340
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
mov ecx, dword [0x141f30568]
xor ecx, dword [0x141f3056c]
add ecx, 0xfba452e7
xor ecx, 0x95fcc1c2
add ecx, 0x4cb7eb00
cmp ecx, 0x50f69f0d
ja 0x14002636d
test rax, rax
je 0x1400264aa
mov rcx, qword [rbp + 0x88]
nop word cs:[rax + rax]
mov eax, dword [0x141f30570]
sub eax, dword [0x141f30574]
and eax, 0x4412408d
add eax, 0x12f0f06a
cmp eax, 0x820fe068
ja 0x1400263b0
mov r14, qword [rcx + 8]
mov eax, dword [0x141f30578]
or eax, dword [0x141f3057c]
imul rax, rax, 0x680dba7d
shr rax, 0x3e
or eax, 0x8921fdae
imul eax, eax, 0xef968057
cmp eax, 0x4966893d
jae 0x140026410
mov rax, qword [0x141f49060]
nop word cs:[rax + rax]
mov eax, dword [0x141f30580]
imul eax, dword [0x141f30584]
imul eax, eax, 0x7d5adf98
mov rsi, qword [0x141f49060]
cmp eax, 0x9fa4bdb4
je 0x140026410
mov eax, dword [0x141f30588]
or eax, dword [0x141f3058c]
or eax, 0xc36e3118
add eax, 0x6c465c7
cmp eax, 0x920f5aef
jbe 0x140026464
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ebx, dword [0x141f30590]
imul ebx, dword [0x141f30594]
add ebx, 0x97055b29
xor ebx, 0x44008502
and ebx, 0xdf0185c3
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r14
call r13
add rsp, 0x20
cmp ebx, 0x23b783da
jb 0x140026470
xor eax, eax
nop dword [rax]
test al, al
jne 0x1400264b0
cmp qword [rbp + 0xc8], 0
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13, qword [rbp + 0xc0]
mov rsi, qword [rbp - 0x60]
je 0x140026515
mov rcx, qword [0x141f49060]
sub rsp, 0x20
xor edx, edx
mov r8, qword [rbp + 0xb0]
call rbx
add rsp, 0x20
nop word [rax + rax]
mov eax, dword [0x141f305b8]
xor edx, edx
div dword [0x141f305bc]
xor eax, 0x1ae8ac3b
imul eax, eax, 0xdfd0654a
and eax, 0x17f18fec
cmp eax, 0x24ecd5e3
ja 0x1400264f0
test edi, edi
je 0x140026796
xor edi, edi
lea rax, [0x141f1ba61]
mov qword [rsi], rax
mov rcx, qword [rsi]
mov rax, qword [rbp - 0x58]
movabs rdx, 0x595f673b99754862
mov qword [rax], rdx
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.14001ad20
add rsp, 0x20
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
movzx eax, byte [rax + 0x20]
movabs r10, 0x27ba6ed99e947921
xor rcx, r10
mov r10, qword [rbp - 0x50]
mov qword [r10], rcx
movabs rcx, 0x347de5c2264e06c9
xor rdx, rcx
mov qword [r10 + 8], rdx
movabs rcx, 0xf37d98069079d5a0
xor r8, rcx
mov qword [r10 + 0x10], r8
movabs rcx, 0x69a9b624fd27f38
xor r9, rcx
mov qword [r10 + 0x18], r9
xor al, 0xb9
mov byte [r10 + 0x20], al
mov rax, qword [rbp - 0x48]
mov qword [rax], r10
mov qword [rax + 8], 0x21
mov rdx, qword [rbp - 0x40]
mov qword [rdx], rax
lea rax, [0x14000d730]
mov qword [rdx + 8], rax
lea rax, [0x140108eb0]
mov rcx, qword [rbp - 0x38]
mov qword [rcx], rax
mov qword [rcx + 8], 2
mov qword [rcx + 0x20], 0
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], 1
sub rsp, 0x20
call fcn.1400a6160
add rsp, 0x20
cmp qword [rbp + 0x60], 0
je 0x140025400
mov eax, dword [0x141f305c0]
imul eax, dword [0x141f305c4]
shr eax, 1
mov ecx, 0x90d962f1
imul rax, rcx
shr rax, 0x3c
imul eax, eax, 0x7958c825
add eax, 0x5af7b075
cmp eax, 0xb1added1
ja 0x1400266f0
nop word cs:[rax + rax]
mov eax, dword [0x141f305c8]
xor edx, edx
div dword [0x141f305cc]
imul rcx, rax, 0x260fb4f
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
add eax, 0x68de425e
mov rsi, qword [0x141f49060]
cmp eax, 0x13c6656
jb 0x1400266f0
test dil, dil
je 0x1400266a0
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, qword [rbp + 0xe8]
call rbx
add rsp, 0x20
mov r14, qword [rbp + 0xe8]
nop word [rax + rax]
mov edi, dword [0x141f305d0]
or edi, dword [0x141f305d4]
add edi, 0x30b61974
or edi, 0x85835308
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r14
call rbx
add rsp, 0x20
cmp edi, 0x9206ce6e
je 0x1400266b0
jmp 0x140025400
mov rax, qword [0x141f49060]
jmp 0x140026650
test rax, rax
je 0x140026bcd
mov eax, dword [0x141f30630]
sub eax, dword [0x141f30634]
and eax, 0x802c004
add eax, 0x5338cbb4
cmp eax, 0x64aa53a8
mov rdx, qword [rbp + 0x50]
jbe 0x140026730
lea rax, [0x141f1c740]
mov qword [rdx], rax
lea rax, [0x141f1c740]
mov r12, qword [rbp + 0x48]
nop dword [rax + rax]
mov ecx, dword [0x141f30638]
xor ecx, dword [0x141f3063c]
imul rcx, rcx, 0x5c397bc1
shr rcx, 0x3e
mov qword [rdx], rax
cmp ecx, 0x43c1ddc
ja 0x140026740
mov rdi, qword [rdx]
mov eax, dword [0x141f30640]
add eax, dword [0x141f30644]
movabs r14, 0x63c9020a48e60ebf
imul eax, eax, 0x377e21c3
and eax, 0x7f4d0a5a
cmp eax, 0xaa88e8fc
jne 0x140026f0e
jmp 0x140026f55
mov r8, qword [rbp + 0xe8]
nop dword [rax]
mov eax, dword [0x141f305d8]
xor edx, edx
div dword [0x141f305dc]
or eax, 0x765e3235
imul eax, eax, 0x166e6817
imul rax, rax, 0x748944b7
shr rax, 0x3d
cmp eax, 0x90a8f8e2
ja 0x1400267a0
cmp qword [rbp + 0x60], 0
je 0x140026bcd
xor eax, eax
test al, al
je 0x140026b8b
jmp 0x140026bb4
ud2
ud2
mov eax, dword [0x141f30400]
imul eax, dword [0x141f30404]
and eax, 0x6814c3d8
add eax, 0x5d2671b3
and eax, 0x553d3250
cmp eax, 0x823907c7
jbe 0x140026b5d
jmp 0x140026b87
mov eax, 0xd4be0cd5
nop dword [rax]
mov ecx, dword [0x141f30598]
add ecx, dword [0x141f3059c]
or ecx, 0x74444b3a
add ecx, 0xdaca1c08
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0xdbc88c7b
je 0x140026880
mov eax, dword [0x141f305a0]
xor eax, dword [0x141f305a4]
add eax, 0xd6ea7822
and eax, 0xbe4bdf3
imul eax, eax, 0x5b9c861c
cmp eax, 0x2fcf8e8f
jae 0x1400268d0
ud2
mov eax, dword [0x141f305a8]
add eax, dword [0x141f305ac]
or eax, 0x6523be9
add eax, 0x1f6d6093
and eax, 0xd95f4ce
ud2
sub rsp, 0x30
mov qword [rsp + 0x20], r15
mov rcx, r14
mov edx, 0x14
mov r8, r13
mov r9d, 4
call sub.ADVAPI32.dll_GetTokenInformation
add rsp, 0x30
xor ecx, ecx
test cl, cl
je 0x140026980
sub rsp, 0x30
mov qword [rsp + 0x20], r15
mov rcx, r14
mov edx, 0x14
mov r8, r13
mov r9d, 4
call sub.ADVAPI32.dll_GetTokenInformation
add rsp, 0x30
jmp 0x140026928
mov ecx, dword [0x141f30388]
or ecx, dword [0x141f3038c]
xor ecx, 0xfc753fa3
imul ecx, ecx, 0x29dd7ef
add ecx, 0xcff9dfe
cmp ecx, 0xd0c2c0eb
jb 0x140026980
test eax, eax
je 0x140025340
mov rcx, r13
mov r13, qword [rbp + 0x78]
nop word cs:[rax + rax]
mov eax, dword [0x141f30390]
and eax, dword [0x141f30394]
xor eax, 0xa80ede4c
imul eax, eax, 0xc2bd56f4
cmp eax, 0x2b42e61f
je 0x1400269c0
cmp dword [rcx], 0
je 0x140025390
lea rax, [0x141f11816]
mov rcx, qword [rbp + 0x90]
mov qword [rcx], rax
mov rcx, qword [rcx]
movabs rax, 0x28ee358551049bf3
mov qword [r12], rax
mov rdx, qword [r12]
sub rsp, 0x20
call fcn.14001a6b0
add rsp, 0x20
movabs rcx, 0x6473f65616740f59
xor rcx, qword [rax]
movabs rdx, 0x5c3c7d014d9e5a4a
xor rdx, qword [rax + 8]
movabs r8, 0x4259c9f0a01aad2f
xor r8, qword [rax + 0x10]
movabs r9, 0x3bbd058d17997c23
xor r9, qword [rax + 0x18]
movabs r10, 0x3021bc15fa91e96b
xor r10, qword [rax + 0x20]
mov r11d, 0xf3c0e744
xor r11d, dword [rax + 0x28]
movzx eax, byte [rax + 0x2c]
xor al, 0xd0
mov rsi, qword [rbp + 0xd8]
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], r9
mov qword [rsi + 0x20], r10
mov ecx, dword [0x141f305e8]
sub ecx, dword [0x141f305ec]
mov dword [rsi + 0x28], r11d
imul ecx, ecx, 0xfdc5c4f0
and ecx, 0x42b49b00
cmp ecx, 0x46d3bb35
mov r9, qword [rbp + 0xe8]
jbe 0x140026ada
mov byte [rsi + 0x2c], al
mov qword [r9], rsi
mov qword [r9 + 8], 0x2d
mov qword [rdi], r9
lea rcx, [0x14000d730]
mov qword [rdi + 8], rcx
lea rcx, [0x140108eb0]
mov qword [rbx], rcx
lea rcx, [0x14000d730]
lea rdx, [0x140108eb0]
mov r15, qword [rbp + 0x80]
nop
mov r8d, dword [0x141f305f0]
and r8d, dword [str.W0L:]
add r8d, 0x112dfa77
xor r8d, 0x90843
and r8d, 0x8ecd1ecb
mov byte [rsi + 0x2c], al
mov qword [r9], rsi
mov qword [r9 + 8], 0x2d
mov qword [rdi], r9
mov qword [rdi + 8], rcx
mov qword [rbx], rdx
cmp r8d, 0xa8d58366
ja 0x140026af0
mov eax, dword [0x141f305f8]
sub eax, dword [0x141f305fc]
and eax, 0x4c2c3304
imul eax, eax, 0xdeb4cbca
cmp eax, 0x47a675a
jae 0x140026c23
jmp 0x140026c81
ud2
mov eax, dword [str.rWry]
xor eax, dword [0x141f3040c]
xor eax, 0x41d440b2
imul rax, rax, 0x697fb9b
shr rax, 0x3a
or eax, 0xeb1b9a18
ud2
ud2
mov eax, dword [0x141f305e0]
or eax, dword [0x141f305e4]
add eax, 0x1884f5c0
or eax, 0xb6ad040e
add eax, 0x3d23fcb2
mov rcx, qword [0x141f49060]
cmp eax, 0xb6a2941f
jbe 0x140026bbd
mov rax, qword [0x141f49060]
jmp 0x140026b8b
sub rsp, 0x20
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
movabs rsi, 0x9d45940f69b50d5a
movabs r15, 0x44f21e587249d16a
movabs r12, 0x22fd9cbde01aa544
mov eax, dword [str..._aV]
xor eax, dword [0x141f3060c]
imul rax, rax, 0x2e654b79
shr rax, 0x3d
or eax, 0x2f65faa
cmp eax, 0xee49e972
mov rdi, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
jne 0x140026cb2
jmp 0x140026d46
mov eax, dword [0x141f30600]
mov ecx, dword [0x141f30604]
add eax, ecx
add eax, 0xd749df16
mov esi, 0x8588ada1
imul rsi, rax
shr rsi, 0x3b
add esi, 0x743ba031
mov qword [rbx + 8], 2
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 1
sub rsp, 0x20
mov rcx, rbx
call fcn.1400a6160
add rsp, 0x20
cmp esi, 0xe76f44a6
jb 0x140027478
mov qword [rbx + 8], 2
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 1
sub rsp, 0x20
mov rcx, rbx
call fcn.1400a6160
add rsp, 0x20
jmp 0x140026c23
mov eax, dword [0x141f30610]
add eax, dword [0x141f30614]
or eax, 0xbef4fbbf
imul r13, rax, 0x11eaa76f
shr r13, 0x39
xor r13d, 0x4d2e6d3f
lea rax, [0x141f124e2]
mov qword [rbx], rax
mov rcx, qword [rbx]
mov qword [rdi], rsi
mov rdx, qword [rdi]
sub rsp, 0x20
call fcn.140019d10
add rsp, 0x20
mov rdx, qword [rax]
xor rdx, r15
mov rcx, qword [rax + 8]
xor rcx, r12
mov r8, qword [rax + 0x10]
movabs r9, 0x72396d0abc24f508
xor r8, r9
mov r9, qword [rax + 0x18]
movabs r10, 0x5cc1f4aaac985a06
xor r9, r10
mov r10, qword [rax + 0x20]
movabs r11, 0x60f835fa28c43580
xor r10, r11
movzx r11d, word [rax + 0x28]
mov qword [r14], rdx
cmp r13d, 0xea85a1a6
jbe 0x140026d88
lea rax, [0x141f124e2]
mov qword [rbx], rax
mov rcx, qword [rbx]
mov qword [rdi], rsi
mov rdx, qword [rdi]
sub rsp, 0x20
call fcn.140019d10
add rsp, 0x20
mov rcx, qword [rax]
xor rcx, r15
mov rdx, qword [rax + 8]
mov rdx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rdx, qword [rax + 0x20]
movzx eax, word [rax + 0x28]
mov qword [r14], rcx
jmp 0x140026cb2
mov ebx, r11d
xor bl, 0xf9
shr r11d, 8
xor r11b, 0x9d
mov eax, dword [0x141f30618]
xor edx, edx
div dword [0x141f3061c]
cmp eax, 0x547298d1
mov rdi, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x10]
mov rsi, qword [rbp - 8]
lea r15, [0x14000d730]
lea r12, [0x140108eb0]
jne 0x140026e10
mov qword [r14 + 8], rcx
mov qword [r14 + 0x10], r8
mov qword [r14 + 0x18], r9
mov qword [r14 + 0x20], r10
mov byte [r14 + 0x28], bl
mov byte [r14 + 0x29], r11b
mov qword [rdx], r14
mov qword [rdx + 8], 0x2a
mov qword [rsi], rdx
mov qword [rsi + 8], r15
mov qword [rdi], r12
mov qword [rdi + 8], 2
mov qword [rdi + 0x20], 0
mov qword [rdi + 0x10], rsi
nop word cs:[rax + rax]
mov eax, dword [0x141f30620]
xor eax, dword [0x141f30624]
imul rax, rax, 0x685e7ea1
shr rax, 0x3c
and eax, 2
mov qword [r14 + 8], rcx
mov qword [r14 + 0x10], r8
mov qword [r14 + 0x18], r9
mov qword [r14 + 0x20], r10
mov byte [r14 + 0x28], bl
mov byte [r14 + 0x29], r11b
mov qword [rdx], r14
mov qword [rdx + 8], 0x2a
mov qword [rsi], rdx
mov qword [rsi + 8], r15
mov qword [rdi], r12
mov qword [rdi + 8], 2
mov qword [rdi + 0x20], 0
mov qword [rdi + 0x10], rsi
cmp eax, 0x49e1ef49
ja 0x140026e10
xor eax, eax
test al, al
je 0x140026e90
mov qword [rdi + 0x18], 1
sub rsp, 0x20
mov rcx, rdi
call fcn.1400a6160
add rsp, 0x20
mov eax, dword [0x141f30628]
imul eax, dword [0x141f3062c]
xor eax, 0x942028a0
or eax, 0x85fd107
imul esi, eax, 0xf1dfaa7
mov qword [rdi + 0x18], 1
sub rsp, 0x20
mov rcx, rdi
call fcn.1400a6160
add rsp, 0x20
cmp esi, 0x55bb5437
ja 0x140026e90
nop dword [rax]
mov eax, dword [0x141f306e0]
add eax, dword [0x141f306e4]
imul eax, eax, 0x869e684d
and eax, 0x3953af4b
add eax, 0x98b1938c
cmp eax, 0xb834c407
jb 0x140026ed0
movaps xmm6, xmmword [rbp + 0xf0]
lea rsp, [rbp + 0x108]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [0x141f30648]
xor edx, edx
div dword [0x141f3064c]
mov r15d, 0xb4833e47
imul r15, rax
shr r15, 0x3f
or r15d, 0x1cfa5c76
mov qword [r12], r14
mov rdx, qword [r12]
sub rsp, 0x20
mov rcx, rdi
call fcn.140018270
add rsp, 0x20
mov rbx, qword [rax]
cmp r15d, 0xb09ce427
jbe 0x140026f72
mov qword [r12], r14
mov rdx, qword [r12]
sub rsp, 0x20
mov rcx, rdi
call fcn.140018270
add rsp, 0x20
mov rax, qword [rax]
jmp 0x140026f0e
mov rsi, rax
mov eax, dword [0x141f30650]
add eax, dword [0x141f30654]
imul eax, eax, 0x2c8e7f0d
add eax, 0x21c17f0f
mov ecx, 0x80910297
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0x31fc6909
mov rdi, qword [rbp + 0x30]
mov r14, qword [rbp + 0x38]
mov r15, qword [rbp + 0x40]
lea r12, [0x140108eb0]
ja 0x140027097
mov eax, dword [0x141f30658]
xor eax, dword [0x141f3065c]
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov r8, qword [rsi + 0x18]
movzx r9d, byte [rsi + 0x20]
mov r10, rbx
movabs r11, 0x73d7bddf5b238f5b
xor r10, r11
mov qword [r13], r10
movabs r10, 0x4361ba5209efe2c9
xor rcx, r10
mov qword [r13 + 8], rcx
movabs rcx, 0x80aafc04f153c8a7
xor rdx, rcx
mov qword [r13 + 0x10], rdx
movabs rcx, 0xfd95095e3a6861b1
xor r8, rcx
mov qword [r13 + 0x18], r8
xor r9b, 0x21
mov byte [r13 + 0x20], r9b
or eax, 0x3ffabff7
imul r13, rax, 0x2729f4af
shr r13, 0x3d
mov rax, qword [rbp + 0xc0]
mov qword [rdi], rax
mov qword [rdi + 8], 0x21
mov qword [r14], rdi
lea rax, [0x14000d730]
mov qword [r14 + 8], rax
mov qword [r15], r12
mov qword [r15 + 8], 2
mov qword [r15 + 0x20], 0
mov qword [r15 + 0x10], r14
mov qword [r15 + 0x18], 1
sub rsp, 0x20
mov rcx, r15
call fcn.1400a6160
add rsp, 0x20
cmp r13d, 0x6a580572
mov r13, qword [rbp + 0xc0]
jne 0x140027144
mov rax, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
movzx r8d, byte [rsi + 0x20]
mov r9, rbx
movabs r10, 0x73d7bddf5b238f5b
xor r9, r10
mov qword [r13], r9
movabs r9, 0x4361ba5209efe2c9
xor rax, r9
mov qword [r13 + 8], rax
movabs rax, 0x80aafc04f153c8a7
xor rcx, rax
mov qword [r13 + 0x10], rcx
movabs rax, 0xfd95095e3a6861b1
xor rdx, rax
mov qword [r13 + 0x18], rdx
xor r8b, 0x21
mov byte [r13 + 0x20], r8b
mov qword [rdi], r13
mov qword [rdi + 8], 0x21
mov qword [r14], rdi
lea rax, [0x14000d730]
mov qword [r14 + 8], rax
mov qword [r15], r12
mov qword [r15 + 8], 2
mov qword [r15 + 0x20], 0
mov qword [r15 + 0x10], r14
mov qword [r15 + 0x18], 1
sub rsp, 0x20
mov rcx, r15
call fcn.1400a6160
add rsp, 0x20
jmp 0x140026fb8
mov r8, qword [rbp + 0xe8]
mov eax, r8d
and eax, 3
lea rcx, [0x141f2658c]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
mov r15, qword [rbp + 0x80]
mov r13, qword [rbp + 0x78]
jmp rax
mov eax, dword [0x141f306e8]
xor edx, edx
div dword [0x141f306ec]
or eax, 0xebc0fdf4
and eax, 0xebc4fdf4
cmp eax, 0xea32437b
jae 0x1400274b0
mov qword [r13], 0
sub rsp, 0x20
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
add rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rbx, qword [rbp]
nop dword [rax + rax]
mov edi, dword [0x141f306f0]
and edi, dword [0x141f306f4]
or edi, 0x81965980
and edi, 0xedd77fbc
mov qword [r13], 0
sub rsp, 0x20
mov rcx, r13
call rsi
add rsp, 0x20
cmp edi, 0x1257551
je 0x1400274c0
xor ecx, ecx
mov rdi, qword [rbp + 8]
nop dword [rax + rax]
test cl, cl
jne 0x140027500
test eax, eax
je 0x140027658
nop dword [rax]
mov eax, dword [0x141f30700]
imul eax, dword [0x141f30704]
add eax, 0x434dc44c
and eax, 0xf49ce7c0
cmp eax, 0xf5ea7a03
je 0x140027510
mov rsi, qword [r13]
mov eax, dword [0x141f30708]
imul eax, dword [0x141f3070c]
and eax, 0x42228121
or eax, 0x2c5d6ec4
imul eax, eax, 0x5fa2794f
cmp eax, 0xf0083d82
jbe 0x140027560
mov rax, qword [0x141f49058]
nop dword [rax]
mov eax, dword [0x141f30710]
xor eax, dword [0x141f30714]
or eax, 0x4108d60e
imul eax, eax, 0x4fcd5283
mov rcx, qword [0x141f49058]
cmp eax, 0xcfb5540a
je 0x140027560
test rcx, rcx
jne 0x14002779f
mov eax, dword [0x141f30718]
sub eax, dword [0x141f3071c]
mov ecx, 0x97df4f45
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x30228e73
jne 0x1400275c0
mov qword [rdi], 0
nop word cs:[rax + rax]
mov eax, dword [0x141f30720]
and eax, dword [0x141f30724]
or eax, 0xdbf0ffbf
and eax, 0xfbfdffff
mov qword [rdi], 0
cmp eax, 0xe080c915
ja 0x1400275c0
sub rsp, 0x20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
test eax, eax
je 0x140027698
nop dword [rax]
mov eax, dword [0x141f30740]
imul eax, dword [0x141f30744]
imul rcx, rax, 0x14c002a9
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
or eax, 0x22186834
and eax, 0x22186836
cmp eax, 0xc87d244a
ja 0x140027600
mov rcx, qword [rdi]
mov eax, dword [0x141f30748]
xor edx, edx
div dword [0x141f3074c]
or eax, 0x1451989b
cmp eax, 0x934aca14
jne 0x140027737
jmp 0x140027767
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
ud2
mov eax, dword [0x141f30728]
xor edx, edx
div dword [0x141f3072c]
and eax, 0xd823a606
imul rax, rax, 0x1b09edc1
shr rax, 0x3b
imul eax, eax, 0xaadfb06a
cmp eax, 0x56d7f479
je 0x1400276f5
mov eax, dword [0x141f30730]
sub eax, dword [0x141f30734]
and eax, 0xc01124
or eax, 0xef016c9a
imul esi, eax, 0x4da54a7f
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
cmp esi, 0x27dd30ad
jae 0x140027705
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
jmp 0x1400276c3
ud2
mov eax, dword [0x141f30750]
or eax, dword [0x141f30754]
and eax, 0xc0815f92
mov edx, 0xb8b62c35
imul rdx, rax
shr rdx, 0x3e
and edx, 1
mov qword [0x141f49058], rcx
cmp edx, 0xe5864657
jbe 0x140027770
mov qword [0x141f49058], rcx
jmp 0x140027737
mov eax, dword [0x141f30758]
or eax, dword [0x141f3075c]
add eax, 0x8e7daf78
imul rax, rax, 0x46e0227b
shr rax, 0x38
and eax, 0xfffffff7
cmp eax, 0x70832390
ja 0x140027770
test rcx, rcx
je 0x140027be8
mov rax, rsi
or rax, rcx
shr rax, 0x20
je 0x1400277b5
mov rax, rsi
xor edx, edx
div rcx
jmp 0x1400277bb
mov eax, esi
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x1400277df
xor edx, edx
div rcx
mov rsi, rax
jmp 0x1400277e5
xor edx, edx
div ecx
mov esi, eax
add rsi, r8
mov rax, rsi
shr rax, 9
movabs r12, 0x44b82fa09b5a53
mul r12
mov rdi, rdx
sub rsp, 0x20
mov ecx, 0x23
call fcn.140091490
add rsp, 0x20
mov qword [rbx], 0
sub rsp, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
add rsp, 0x20
test eax, eax
je 0x140027b48
shr rdi, 0xb
imul eax, edi, 0x3b9aca00
sub esi, eax
mov r14, qword [rbx]
mov r8, qword [0x141f49058]
mov eax, 0xa4246261
nop dword [rax]
mov ecx, dword [str.czcG]
xor ecx, dword [0x141f30784]
add ecx, 0x299d686
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0xe9aa89c8
ja 0x140027850
test r8, r8
jne 0x1400278dc
mov rbx, qword [rbp + 0x58]
mov qword [rbx], 0
sub rsp, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
test eax, eax
je 0x140027c10
mov r8, qword [rbx]
mov qword [0x141f49058], r8
nop word cs:[rax + rax]
mov eax, dword [0x141f307a0]
or eax, dword [0x141f307a4]
add eax, 0x7ea6a387
and eax, 0xb6baa261
imul eax, eax, 0x76e335a8
cmp eax, 0x19f311d5
jb 0x1400278b0
test r8, r8
je 0x140027c7b
mov r13, r15
mov eax, dword [0x141f307b8]
sub eax, dword [0x141f307bc]
imul rax, rax, 0x7030c17
shr rax, 0x39
or eax, 0x46d7b32e
cmp eax, 0xecbf321d
jne 0x1400279a3
mov rax, r14
or rax, r8
shr rax, 0x20
je 0x14002791c
mov rax, r14
xor edx, edx
div r8
jmp 0x140027924
mov eax, r14d
xor edx, edx
div r8d
imul rax, rdx, 0x3b9aca00
mov rcx, rax
or rcx, r8
shr rcx, 0x20
je 0x140027945
xor edx, edx
div r8
mov rax, qword [0x141f49058]
jmp 0x1400279a3
xor edx, edx
div r8d
mov rax, qword [0x141f49058]
jmp 0x1400279a3
xor edx, edx
div r8
or r9d, 0xcce5badc
mov r10d, 0xa046e761
imul r10, r9
shr r10, 0x3f
imul r15, rcx, 0x3b9aca00
add r15, rax
mov rax, r15
shr rax, 9
mul r12
imul eax, r10d, 0x34dd55db
mov r11, qword [0x141f49058]
cmp eax, 0x56b0f97f
jbe 0x1400279fb
mov r9d, dword [0x141f307c0]
mov rax, r14
or rax, r8
and r9d, dword [0x141f307c4]
shr rax, 0x20
je 0x1400279d0
mov rax, r14
xor edx, edx
div r8
mov rcx, rax
jmp 0x1400279da
mov eax, r14d
xor edx, edx
div r8d
mov ecx, eax
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, r8
shr rdx, 0x20
jne 0x140027960
xor edx, edx
div r8d
jmp 0x140027965
mov rbx, rdx
test r11, r11
jne 0x140027d3b
mov eax, dword [0x141f307c8]
xor edx, edx
div dword [0x141f307cc]
add eax, 0x75357943
xor eax, 0x5a2aa509
imul eax, eax, 0xc85a376f
cmp eax, 0xfbc33b29
mov rcx, qword [rbp + 0x98]
jbe 0x140027a3a
mov qword [rcx], 0
xor eax, eax
nop dword [rax]
mov qword [rcx], 0
test al, al
jne 0x140027a40
mov eax, dword [0x141f307d0]
imul eax, dword [0x141f307d4]
or eax, 0xcd3fb9f5
add eax, 0x88e90a15
cmp eax, 0x898914d0
jbe 0x140027a7e
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rcx, qword [rbp + 0x98]
add rsp, 0x20
mov r14, qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
nop word cs:[rax + rax]
mov r12d, dword [0x141f307d8]
imul r12d, dword [0x141f307dc]
and r12d, 0x219f96f1
add r12d, 0xd9b33752
or r12d, 0x25fe0971
sub rsp, 0x20
call r14
mov rcx, qword [rbp + 0x98]
add rsp, 0x20
cmp r12d, 0x71823b7
je 0x140027a90
nop
mov edx, dword [0x141f307e0]
and edx, dword [0x141f307e4]
imul rdx, rdx, 0x4d0c4f69
shr rdx, 0x3e
add edx, 0xdcb83c7f
cmp edx, 0xe93f267a
ja 0x140027ad0
test eax, eax
je 0x140027bd8
nop dword [rax]
mov eax, dword [0x141f307e8]
xor edx, edx
div dword [0x141f307ec]
add eax, 0x644c4d60
and eax, 0x68619e87
cmp eax, 0xe035265b
je 0x140027b00
mov eax, dword [0x141f307f0]
add eax, dword [0x141f307f4]
mov r11, qword [rcx]
xor eax, 0x900481
or eax, 0xfb67f81e
cmp eax, 0x7a25f618
jne 0x140027d0b
jmp 0x140027d2d
mov eax, dword [0x141f30768]
and eax, dword [0x141f3076c]
add eax, 0xbc2cd50
or eax, 0x21841bb
and eax, 0xbe39edfb
cmp eax, 0xee0ffab9
jbe 0x140027b78
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov eax, dword [0x141f30770]
imul eax, dword [0x141f30774]
imul edi, eax, 0x9b38f656
xor edi, 0x1a281b77
add edi, 0x424f9aeb
sub rsp, 0x20
call rsi
add rsp, 0x20
cmp edi, 0xfb5f9680
ja 0x140027b80
ud2
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
ud2
mov eax, dword [0x141f30760]
xor edx, edx
div dword [0x141f30764]
xor eax, 0x120611
or eax, 0x7ba9c8a4
cmp eax, 0x9ad4131d
jne 0x140027ccf
jmp 0x140027cdb
xor eax, eax
test al, al
je 0x140027c24
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x141f30788]
add eax, dword [0x141f3078c]
and eax, 0xc300260a
or eax, 0x14fa4850
imul edi, eax, 0x205e2729
sub rsp, 0x20
call rsi
add rsp, 0x20
cmp edi, 0xd978b5
je 0x140027c2b
mov eax, dword [0x141f30790]
and eax, dword [0x141f30794]
or eax, 0x1802
and eax, 0x58a2
cmp eax, 0x378b4575
jbe 0x140027cdf
jmp 0x140027d07
mov eax, dword [0x141f307a8]
imul eax, dword [0x141f307ac]
or eax, 0xb12479d2
add eax, 0xbea83ee4
imul rcx, rax, 0x29eea8d5
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1c
cmp eax, 0x98dc9781
jbe 0x140027caf
ud2
mov eax, dword [0x141f307b0]
sub eax, dword [0x141f307b4]
imul eax, eax, 0x983e2c41
ud2
ud2
ud2
mov eax, dword [0x141f30798]
add eax, dword [0x141f3079c]
xor eax, 0x85902400
or eax, 0x6a261ab6
add eax, 0x8735bd87
ud2
ud2
mov eax, dword [0x141f307f8]
xor edx, edx
div dword [0x141f307fc]
imul eax, eax, 0xa3176108
mov qword [0x141f49058], r11
cmp eax, 0x31af4e56
jne 0x140027d36
mov qword [0x141f49058], r11
jmp 0x140027d0b
test r11, r11
je 0x140027d71
shr rbx, 0xb
imul eax, ebx, 0x3b9aca00
sub r15d, eax
mov eax, dword [0x141f30808]
imul eax, dword [0x141f3080c]
mov r14d, 0xc4653600
xor eax, 0x2048200
and eax, 0x7604b2e4
cmp eax, 0x9b6bf07
jne 0x140027da5
jmp 0x140027e0a
ud2
mov eax, dword [0x141f30810]
xor r8d, r8d
xor edx, edx
div dword [0x141f30814]
mov ecx, eax
add ecx, 0xce965ad1
xor ecx, 0x1d722d18
cmp r11, 0x3b9aca00
ja 0x140027dda
mov eax, 0x3b9aca00
xor edx, edx
div r11d
mov r8d, eax
lea r9d, [r8 + r14]
xor r10d, r10d
cmp r11, 2
setb al
cmovae r9d, r8d
xor r12d, r12d
mov r8, rbx
sub r8, rdi
setne r12b
mov edx, 0xff
cmovbe edx, r12d
cmp ecx, 0x890be4b3
jae 0x140027e1f
cmp r11, 0x3b9aca00
ja 0x140027da5
mov eax, 0x3b9aca00
xor edx, edx
div r11d
jmp 0x140027da5
test dl, dl
jne 0x140027e5c
nop word cs:[rax + rax]
mov ecx, dword [0x141f30818]
add ecx, dword [0x141f3081c]
imul ecx, ecx, 0xd200a1fc
add ecx, 0xc0279e68
cmp ecx, 0x10cdae90
ja 0x140027e30
cmp r15d, esi
setne dl
ja 0x140027f15
cmp dl, 1
jne 0x140027f15
cmp rbx, rdi
ja 0x140026b5b
mov r10b, al
mov rcx, rdi
sub rcx, rbx
nop word [rax + rax]
mov eax, dword [0x141f30868]
mov edx, dword [0x141f3086c]
add eax, edx
add eax, 0xe74488f3
xor eax, 0x5a8cc320
or eax, 0x81622c9c
cmp eax, 0x43b413d4
jb 0x140027e80
cmp r15d, esi
jbe 0x140027f4d
nop dword [rax]
mov eax, dword [0x141f30870]
or eax, dword [0x141f30874]
and eax, 0x8e7fa341
imul eax, eax, 0x7db972ae
add eax, 0xb47579f0
cmp eax, 0x3ef3a08d
jb 0x140027eb0
test rcx, rcx
je 0x140026b5b
dec rcx
lea r11d, [rsi + 0x3b9aca00]
nop word cs:[rax + rax]
mov eax, dword [0x141f30878]
sub eax, dword [0x141f3087c]
xor eax, 0x38ce8ef6
imul eax, eax, 0x4045db10
or eax, 0xc0d78a4b
cmp eax, 0x1a75be7c
jb 0x140027ef0
jmp 0x140027f50
mov eax, 0xbd6c7631
nop word [rax + rax]
mov ecx, dword [0x141f30820]
or ecx, dword [0x141f30824]
add ecx, 0x4817f62f
or ecx, 0xbf122ef0
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x60baaae6
je 0x140027f20
jmp 0x14002803c
mov r11d, esi
sub r11d, r15d
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x140027f60
cmp r11d, 0x3b9aca00
jae 0x140027f75
mov rax, rcx
jmp 0x140028013
mov eax, r11d
shr eax, 9
imul r14, rax, 0x44b83
shr r14, 0x27
imul eax, r14d, 0x3b9aca00
sub r11d, eax
mov eax, dword [0x141f30880]
xor eax, dword [0x141f30884]
add eax, 0xcfe89234
cmp eax, 0x8b3cfd25
ja 0x140027f90
mov eax, dword [0x141f30888]
xor edx, edx
div dword [0x141f3088c]
mov edx, r14d
nop dword [rax]
mov eax, dword [0x141f30890]
imul eax, dword [0x141f30894]
imul r12d, eax, 0xb97f0d99
or r12d, 0x68666123
mov rax, rcx
add rax, rdx
setb r14b
cmp r12d, 0xb5e6bc06
jb 0x140027fc0
nop
mov ecx, dword [0x141f30898]
or ecx, dword [0x141f3089c]
or ecx, 0x773ddff9
cmp ecx, 0x673efd7
je 0x140027ff0
test r14b, r14b
jne 0x1400282f2
xor ecx, ecx
cmp rax, r10
setne cl
mov eax, 0xff
cmovb ecx, eax
xor edx, edx
cmp r11d, r9d
setne dl
cmovb edx, eax
test cl, cl
cmovne edx, ecx
cmp dl, 1
jne 0x14002826a
cmp rbx, rdi
jb 0x14002826a
nop word cs:[rax + rax]
mov eax, dword [0x141f30828]
add eax, dword [0x141f3082c]
imul eax, eax, 0xd005145f
cmp eax, 0x736df3f1
je 0x140028050
mov eax, dword [0x141f30830]
xor edx, edx
div dword [0x141f30834]
nop word [rax + rax]
mov eax, dword [0x141f30838]
imul eax, dword [0x141f3083c]
and eax, 0x44c46afd
imul eax, eax, 0xb45e3853
and eax, 0x5c6648b0
cmp eax, 0x6dac96bc
ja 0x140028080
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400280b0
cmp r15d, esi
jae 0x140028103
test r8, r8
je 0x14002826a
dec r8
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x1400280d0
add r15d, 0x3b9aca00
nop dword [rax + rax]
mov eax, dword [0x141f30840]
sub eax, dword [0x141f30844]
or eax, 0x402e2001
and eax, 0xe96f3181
imul eax, eax, 0x3e833c26
cmp eax, 0x78afff40
je 0x1400280e0
sub r15d, esi
nop word cs:[rax + rax]
mov eax, dword [0x141f30848]
add eax, dword [0x141f3084c]
imul eax, eax, 0x6ccb0488
or eax, 0x32b29d5b
cmp eax, 0x5612b0d9
ja 0x140028110
cmp r15d, 0x3b9aca00
jb 0x1400281fb
mov eax, 0xa5f255cd
mov ecx, r15d
shr ecx, 9
imul rcx, rcx, 0x44b83
shr rcx, 0x27
imul edx, ecx, 0x3b9aca00
sub r15d, edx
nop word [rax + rax]
mov edx, dword [0x141f30850]
or edx, dword [0x141f30854]
add edx, 0xc692498b
imul rdx, rax
shr rdx, 0x3f
cmp edx, 0xcbcb477a
ja 0x140028160
mov ecx, ecx
nop word cs:[rax + rax]
mov r9d, dword [0x141f30858]
add r9d, dword [0x141f3085c]
xor r9d, 0xf02e8341
or r9d, 0x691482c
add r9d, 0x35df136a
mov rax, r8
add rax, rcx
setb dl
cmp r9d, 0x4668964a
jb 0x140028190
test dl, dl
jne 0x140026b5b
nop dword [rax]
mov ecx, dword [0x141f30860]
mov edx, dword [0x141f30864]
add ecx, edx
add ecx, 0x7270546d
or ecx, 0xad9a02ee
and ecx, 0xffffe7ef
cmp ecx, 0xd5577670
jb 0x1400281d0
mov r8, rax
cmp r15d, 0x3b9aca00
je 0x14002826a
cmp r8, 0x19
jb 0x14002826a
mov eax, 0xe64cc501
nop
mov ecx, dword [0x141f308b8]
sub ecx, dword [0x141f308bc]
add ecx, 0x336aa5d
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xd87786a9
je 0x140028210
mov eax, dword [0x141f308c0]
xor edx, edx
div dword [0x141f308c4]
add eax, 0x69a71b7a
or eax, 0xfd3263ad
cmp eax, 0x51bf8d68
mov rdi, qword [rbp + 0x10]
mov rbx, qword [rbp + 0x18]
mov r14, qword [rbp + 0x20]
mov r15, qword [rbp + 0x28]
jae 0x14002831a
jmp 0x140028350
mov eax, dword [0x141f308d0]
sub eax, dword [0x141f308d4]
add eax, 0x4e21b933
cmp eax, 0xbf07edd9
jbe 0x140028290
sub rsp, 0x20
call fcn.1400c5f80
add rsp, 0x20
nop
mov esi, dword [0x141f308d8]
add esi, dword [0x141f308dc]
and esi, 0x614001d2
add esi, 0x28c077f3
xor esi, 0xbe058be8
sub rsp, 0x20
call fcn.1400c5f80
add rsp, 0x20
cmp esi, 0x78ddf946
jb 0x140028290
nop word cs:[rax + rax]
mov eax, dword [0x141f308e0]
and eax, dword [0x141f308e4]
or eax, 0xef7ffffe
add eax, 0xb950cee
cmp eax, 0x2c8dbf80
ja 0x1400282d0
jmp 0x140026b5b
mov eax, dword [0x141f308a0]
xor edx, edx
div dword [0x141f308a4]
xor eax, 0x4110a7d4
and eax, 0x4b30a7f4
cmp eax, 0x4e9e3043
jne 0x1400286cc
jmp 0x1400286f1
mov esi, dword [0x141f308c8]
sub esi, dword [0x141f308cc]
add esi, 0x24c5bc27
or esi, 0x208f0811
and esi, 0x34df8811
sub rsp, 0x20
mov rcx, r15
call fcn.1400e3e60
add rsp, 0x20
cmp esi, 0x79b95cf7
jbe 0x140028362
sub rsp, 0x20
mov rcx, r15
call fcn.1400e3e60
add rsp, 0x20
jmp 0x14002831a
cmp byte [r15], 0x12
jne 0x140026b5b
mov r15, r13
nop
mov eax, dword [0x141f308e8]
or eax, dword [0x141f308ec]
imul eax, eax, 0x8924aee4
cmp eax, 0xb77fa518
je 0x140028370
mov eax, dword [0x141f308f0]
add eax, dword [0x141f308f4]
imul eax, eax, 0xc2f2178f
add eax, 0x92076b1d
and eax, 0x3ee97446
cmp eax, 0xcb5a974d
je 0x14002849b
mov eax, dword [0x141f308f8]
or eax, dword [0x141f308fc]
mov esi, 0xbcd65ac9
imul rsi, rax
shr rsi, 0x3f
or esi, 0x42a1daa8
sub rsp, 0x20
call fcn.14001d730
add rsp, 0x20
mov qword [r14], 0
mov dword [r15], 0
mov qword [rdi], 0
mov dword [rbx], 0
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov rdx, rbx
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 7
mov r8, r14
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x10
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 0x1f
mov r8, r15
mov r9d, 4
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x10
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 0x1e
mov r8, rdi
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x30
cmp esi, 0x560c81e7
jbe 0x140028560
sub rsp, 0x20
call fcn.14001d730
add rsp, 0x20
mov qword [r14], 0
mov dword [r15], 0
mov qword [rdi], 0
mov dword [rbx], 0
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov rdx, rbx
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 7
mov r8, r14
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x10
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 0x1f
mov r8, r15
mov r9d, 4
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x10
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 0x1e
mov r8, rdi
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x30
jmp 0x1400283b0
cmp dword [rbx], 0
jne 0x140028663
cmp qword [r14], 0
jne 0x140028663
cmp dword [r15], 0
je 0x140028663
cmp qword [rdi], 0
jne 0x140028663
mov eax, dword [0x141f30910]
sub eax, dword [0x141f30914]
xor eax, 0x148579b6
add eax, 0x6258084d
or eax, 0x48de580c
cmp eax, 0x7308143d
jae 0x1400285bc
sub rsp, 0x20
mov ecx, 0x80000001
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
add rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
nop word cs:[rax + rax]
mov eax, dword [0x141f30918]
imul eax, dword [0x141f3091c]
add eax, 0xdecc701e
xor eax, 0xbf7443ec
imul rdi, rax, 0x2ae51295
shr rdi, 0x3a
sub rsp, 0x20
mov ecx, 0x80000001
call rsi
add rsp, 0x20
cmp edi, 0x733be35
je 0x1400285d0
mov eax, dword [0x141f30920]
add eax, dword [0x141f30924]
and eax, 0x2083f7d3
cmp eax, 0x5ca50a02
jne 0x140028630
sub rsp, 0x20
call fcn.140028730
add rsp, 0x20
nop
mov esi, dword [0x141f30928]
imul esi, dword [0x141f3092c]
or esi, 0x3eecf4ca
add esi, 0x4d5c43e0
sub rsp, 0x20
call fcn.140028730
add rsp, 0x20
cmp esi, 0x861a3171
ja 0x140028630
jmp 0x140026ed0
mov eax, dword [0x141f30900]
imul eax, dword [0x141f30904]
add eax, 0x28bf79b5
or eax, 0x37cba2c2
cmp eax, 0xe3140fc8
je 0x1400286bd
mov eax, dword [0x141f30908]
imul eax, dword [0x141f3090c]
add eax, 0xd84b9628
imul rax, rax, 0xc76fda5
shr rax, 0x3b
imul esi, eax, 0xfe97045d
sub rsp, 0x20
call fcn.1400c5f80
add rsp, 0x20
cmp esi, 0xcdd6cb95
jne 0x140026b5b
sub rsp, 0x20
call fcn.1400c5f80
add rsp, 0x20
jmp 0x140028681
mov eax, dword [0x141f308a8]
imul eax, dword [0x141f308ac]
add eax, 0xa6b39173
xor eax, 0xa1b43c4
or eax, 0xd5608031
ud2
ud2