Function at 0x140012768
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov rax, qword [0x1400499b8]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov qword [rsp + 0x78], 0x62
mov rdi, 0xffffffff947a61a0
mov rax, qword [rbp + 0x4b0]
movabs rsi, 0xd8be1c7d7b23d
mov qword [rbp + 0x28], rax
movsx rax, word [0x1400495a0]
mov qword [rbp - 0x80], rax
mov eax, dword [0x1400494fc]
mov byte [rsp + 0x52], 0xaf
mov dword [rsp + 0x64], eax
mov rax, qword [0x1400495d8]
mov dword [rsp + 0x68], 0xc3
mov qword [rbp - 0x48], rax
mov eax, 0x6d88
movsx r14d, byte [0x1400494fb]
mov ebx, dword [0x1400495d0]
mov word [rsp + 0x60], ax
mov al, byte [0x140049588]
mov byte [rsp + 0x50], 0x58
mov byte [rsp + 0x5c], al
movsxd rax, dword [0x140049590]
mov qword [rbp - 0x38], rax
mov al, byte [0x1400495a8]
mov byte [rsp + 0x51], al
movzx eax, word [0x1400495f8]
mov r12, qword [0x140049600]
mov dword [rsp + 0x70], eax
mov eax, 0xb393
mov qword [rbp - 8], rcx
mov qword [rbp], rdx
mov qword [rbp - 0x68], rdi
mov edi, dword [0x1400495b0]
mov word [rsp + 0x54], ax
movzx eax, word [0x140049554]
mov byte [rsp + 0x50], 0x50
mov word [rsp + 0x54], ax
mov rax, qword [0x140049580]
mov eax, 0x2a15
mov qword [rbp + 0x48], r9
mov word [rsp + 0x54], ax
movsx rax, word [0x1400495b4]
mov qword [rbp + 0x30], rax
movsx eax, byte [0x1400494e4]
mov dword [rbp - 0x60], eax
mov eax, dword [0x1400495d8]
mov dword [rbp - 0x60], eax
movsx eax, word [0x1400495b4]
sub rbx, qword [0x1400495d8]
mov dword [rbp - 0x60], eax
mov eax, dword [0x140a0f0f0]
mov dword [0x1400495b0], eax
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
add eax, 0x3ac
mov qword [rbp + 0x50], r8
mov dword [rbp - 0x78], eax
mov rcx, qword [rbp - 0x48]
mov rax, qword [0x140049598]
not rcx
movsx ecx, cl
movsx edx, al
imul edx, ecx
movzx ecx, word [0x140049554]
not ecx
mov qword [rbp - 0x20], rsi
and ecx, 0x60
mov qword [rbp - 0x40], r14
mov dword [rbp - 0x30], 0xb6
sub dl, 0x1d
mov qword [rbp - 0x58], r12
not dl
mov qword [rbp - 0x70], rbx
mov byte [0x1400494e3], dl
mov rax, qword [rsp + 0x78]
add eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [0x140049594]
add eax, 0x75
mov dword [rbp - 0x2c], eax
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov eax, eax
lea ecx, [rdi + 0x69cade0a]
mov qword [0x140049580], rax
mov eax, dword [rsp + 0x58]
add eax, 0x1f
mov dword [rbp - 0x60], eax
mov al, byte [0x140b01f00]
mov byte [rsp + 0x50], al
mov eax, dword [0x140a0f0f0]
mov qword [rbp - 0x38], rcx
mov dword [rsp + 0x58], eax
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
xor r9d, r9d
mov word [0x140049554], ax
cmp ax, 0x4b
mov ecx, r9d
setae cl
cmp ecx, 1
jb 0x1400129a8
mov eax, dword [0x1400494fc]
movsx rsi, byte [rsp + 0x50]
add eax, eax
sub eax, ebx
mov dword [0x1400494fc], eax
movabs rax, 0xcd71e549d7bc3
add rsi, rax
mov qword [rbp - 0x20], rsi
mov eax, dword [rsp + 0x58]
add eax, 0x387
mov qword [rbp + 0x10], r9
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x58]
add eax, 0x38c
mov dword [rbp - 0x74], eax
mov eax, dword [rsp + 0x58]
add eax, 0x42
mov dword [rbp - 0x60], eax
movsxd rcx, dword [rsp + 0x68]
mov rax, qword [0x140049598]
cmp rcx, rax
mov al, byte [0x140049590]
movzx ecx, byte [str.MSUnsupportedAlgorit]
not al
sete dl
xor al, dl
mov byte [0x1400494e5], al
movzx eax, word [0x140a0f0f0]
mov word [0x1400495f8], ax
call qword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov byte [0x1400494e3], al
xor r10d, r10d
mov al, byte [0x1400494e3]
mov r8d, 2
test al, al
je 0x140012a47
movzx ecx, word [0x1400495a4]
add word [0x1400495bc], r14w
and ecx, r8d
mov al, byte [0x1400494e5]
add al, cl
mov byte [0x1400494e5], al
jmp 0x140012a6b
cmp word [0x1400495bc], r10w
je 0x140012a6b
add r14d, dword [0x140049608]
movsx rax, byte [0x1400494e4]
add qword [0x140049588], rax
mov qword [rbp - 0x40], r14
mov rax, qword [rbp - 0x38]
mov dword [rbp - 0x10], r10d
mov qword [rbp + 0x38], r10
test rax, rax
je 0x140012a80
mov al, byte [rsp + 0x5c]
mov rcx, qword [rbp - 0x48]
mov r13, r10
mov rax, qword [rsp + 0x78]
add rcx, rax
mov qword [rbp + 0x20], r10
cmp word [0x1400495bc], r10w
mov qword [rsp + 0x78], rcx
mov qword [0x1400495a8], 0x658c025b
je 0x140012ab4
mov rax, qword [rsp + 0x78]
jmp 0x140012abb
mov rax, qword [0x1400495a8]
cmp qword [0x140049608], r10
mov edx, r10d
mov r9d, dword [rsp + 0x70]
mov rbx, r10
mov word [0x1400495e0], ax
mov rax, r10
mov rcx, qword [0x140049578]
sete al
and rcx, rax
mov qword [rbp + 0x58], r10
movsx rax, word [0x1400495a0]
imul rax, rcx
mov ecx, dword [rsp + 0x68]
test rax, rax
mov qword [rbp + 0x30], r10
not ecx
mov rax, r10
sete dl
sub ecx, edi
sub ecx, r9d
cmp edx, ecx
mov ecx, r10d
sete al
cmp dword [0x14004956c], r10d
mov qword [rbp - 0x38], rax
movzx eax, r9b
cmove ecx, eax
mov al, byte [0x140049608]
xor al, byte [str.MSUnsupportedAlgorit]
sub cl, al
mov rax, qword [0x140049580]
mov byte [0x140049513], cl
test rax, rax
je 0x140012b4e
mov al, byte [0x1400494e3]
jmp 0x140012b54
mov al, byte [0x1400494fb]
movsx eax, al
mov r15b, r8b
mov word [rsp + 0x54], ax
mov rax, qword [0x1400495c0]
mov rcx, qword [0x140049578]
sub rcx, rax
mov dword [rsp + 0x74], r15d
mov qword [0x140049578], rcx
mov rax, r10
mov dword [rbp + 0x90], 0xda9594c6
mov dword [rbp + 0x94], 0x9f979b94
mov word [rbp + 0x98], 0xc4
xor byte [rbp + rax + 0x90], 0xfa
inc rax
cmp rax, 9
jb 0x140012b9c
mov rcx, qword [rsp + 0x78]
lea rax, [rbp + 0x90]
mov qword [rbp + 0x40], rax
mov rax, qword [rsp + 0x78]
sub rcx, rax
mov qword [rbp + 8], r10
mov eax, dword [0x140a0f0f0]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x78], rax
movzx eax, byte [0x140049590]
imul ecx, eax, 0x88
mov rax, qword [rbp - 0x48]
mov qword [0x140c0f760], rax
mov qword [rbp - 0x50], r10
and byte [0x1400494e7], cl
mov dword [rsp + 0x68], 4
movzx ecx, word [0x1400495f8]
mov rax, qword [rbp - 0x80]
sub rax, rcx
mov qword [rbp - 0x80], rax
mov ecx, dword [rsp + 0x68]
sub ecx, r8d
dec ecx
cmp ecx, 1
jne 0x140012c35
movzx eax, byte [rsp + 0x52]
sub rax, 0x516f
mov qword [0x140049578], rax
mov rcx, qword [0x140049600]
mov r12b, 0xbd
mov rax, qword [0x140049600]
add rcx, 0xfffffffffffffffe
sub rcx, rax
mov qword [rbp - 0x18], r12
cmp byte [0x1400494e4], r10b
mov eax, 0xf9b2bbf4
mov qword [0x140049600], rcx
mov ecx, dword [rbp - 0x74]
cmovne edi, eax
mov rax, qword [rbp + 0x28]
mov dword [rax], r10d
mov eax, dword [rsp + 0x6c]
sub ecx, eax
mov eax, dword [rbp - 0x74]
xor eax, 0x23e
cmp ecx, eax
je 0x1400136e9
mov eax, dword [0x1400495e4]
mov edx, r10d
cmp qword [0x140049610], rax
mov eax, r10d
setg dl
cmp qword [0x140049610], 0x2e
setg al
cmp edx, eax
jb 0x140012cbd
mov r12, qword [0x140049580]
sub r12b, 0x31
mov qword [rbp - 0x18], r12
jmp 0x140012cec
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x140012cec
mov cl, byte [0x1400494e5]
movzx eax, word [rsp + 0x60]
add cl, al
mov al, byte [rsp + 0x50]
xor al, cl
lea ecx, [rdi + 0x2c4dbff]
sub rsi, rcx
mov byte [0x140049513], al
mov qword [rbp - 0x20], rsi
mov eax, dword [0x140a0f0f0]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
add eax, 0x11
mov dword [rbp - 0x60], eax
mov eax, dword [rsp + 0x58]
add eax, 0x3725
mov dword [rbp - 0x74], eax
mov al, byte [0x1400494fb]
mov rcx, qword [0x140049610]
test al, al
cmovne rcx, qword [0x140049580]
mov qword [0x140049608], rcx
movzx ecx, word [0x1400495f8]
mov eax, dword [0x1400495d0]
sub ecx, eax
mov eax, dword [0x1400495d0]
add eax, ecx
mov dword [0x1400495d0], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [0x1400495a8]
add eax, 0x6018
mov dword [rsp + 0x6c], eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov al, byte [rsp + 0x52]
xor r9d, r9d
movzx eax, word [0x1400495b4]
sub ax, word [0x140cb3808]
mov word [0x1400495b4], ax
mov rax, qword [0x1400495c8]
mov ecx, dword [rsp + 0x6c]
mov qword [0x140cb3be8], rax
mov eax, dword [rbp - 0x74]
imul ecx, eax
mov eax, dword [0x140a0f0f0]
sub ecx, 0x14b308d0
mov dword [rbp + 0x18], ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
add eax, 0xd6bd
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x58]
add eax, 0x3e
mov dword [rbp - 0x60], eax
movzx eax, word [0x140049554]
add eax, 0x6797546b
mov dword [0x1400494fc], eax
mov eax, dword [rsp + 0x58]
add eax, 0xc468
mov dword [rbp - 0x60], eax
mov rax, qword [rbp - 0x80]
test rax, rax
je 0x140012e03
mov al, byte [0x1400495d4]
mov byte [rsp + 0x5c], al
movzx eax, word [0x1400495e0]
add ax, 0x63
mov word [0x1400495e0], ax
jmp 0x140012e18
movsx eax, word [0x1400495a0]
sub eax, 0xfc91
cdqe
mov qword [0x1400495e8], rax
mov eax, dword [rsp + 0x64]
mov cl, byte [str.MSUnsupportedAlgorit]
sub cl, 0x77
add al, cl
movzx ecx, word [0x140049514]
mov byte [str.MSUnsupportedAlgorit], al
mov eax, 0x5588
sub cx, ax
movzx eax, word [rsp + 0x60]
not ax
not cx
movzx edx, ax
mov rax, qword [0x1400495f0]
movzx r8d, ax
mov rax, qword [rbp - 0x48]
movzx ecx, cx
imul edx, ecx
movzx ecx, word [0x1400495a8]
imul r8d, ecx
mov ecx, r9d
add r8w, dx
mov edx, r9d
add r8w, word [0x1400495b0]
sub r8w, ax
mov eax, dword [rsp + 0x6c]
sub eax, 0xd35c
mov word [0x140049554], r8w
mov dword [rbp - 0x28], eax
movzx eax, word [0x1400495f8]
test ax, ax
mov al, byte [rsp + 0x51]
setne dl
test al, al
sete cl
cmp edx, ecx
jbe 0x140012eb8
mov qword [rbp - 0x80], 0xaeb2
jmp 0x140012f15
cmp dword [rsp + 0x70], r9d
je 0x140012ee6
mov rax, qword [0x1400495a8]
movabs rcx, 0xfff40a9c8151a6e7
movsxd rdx, dword [0x14004956c]
add rax, rcx
add rax, rdx
mov qword [0x1400495a8], rax
jmp 0x140012f15
cmp qword [0x1400495e8], r9
jne 0x140012ef3
mov eax, dword [rsp + 0x68]
movzx eax, byte [0x1400494e7]
mov ecx, r9d
cmp dword [rbp - 0x58], eax
movzx eax, word [0x140a8d768]
sete cl
mov dword [rsp + 0x70], eax
mov word [0x1400495fc], cx
mov eax, dword [0x140a0f0f0]
mov dword [rsp + 0x58], eax
movzx eax, word [rsp + 0x54]
add ax, word [0x14004956c]
mov word [rsp + 0x54], ax
mov eax, dword [rsp + 0x58]
add eax, 0xf
mov dword [rbp - 0x60], eax
movzx eax, byte [rsp + 0x52]
xor rax, 0xca
mov qword [0x140049600], rax
mov eax, dword [rsp + 0x58]
add eax, 0x18
mov dword [rbp - 0x60], eax
movzx ecx, word [rsp + 0x54]
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [rsp + 0x64], eax
xor r8d, r8d
mov eax, dword [rsp + 0x64]
test eax, eax
jne 0x140012f7b
mov rax, qword [rbp - 0x80]
imul r14d, eax, 0x6a3e5391
mov eax, dword [rsp + 0x58]
mov r11, 0xffffffff947a61a0
add eax, 0xb4
mov dword [rsp + 0x58], eax
mov rcx, qword [0x1400495c8]
mov rax, qword [0x140049580]
cmp rcx, rax
jb 0x140012ff8
mov al, byte [0x1400494e3]
mov ecx, r8d
movzx r8d, word [rsp + 0x54]
test al, al
movzx eax, word [rsp + 0x54]
sete cl
xor r9d, r9d
sub r8d, ecx
mov edx, r9d
mov ecx, dword [0x1400495b0]
or r8d, r11d
test ecx, ecx
mov ecx, r9d
cmove edx, eax
mov rax, qword [rsp + 0x78]
add rax, rdx
cmove cx, r8w
xor r8d, r8d
mov word [rsp + 0x54], cx
movsx eax, byte [rsp + 0x50]
mov r9d, eax
mov dword [rsp + 0x70], eax
jmp 0x140013041
movsx ecx, byte [rsp + 0x51]
movzx edx, word [0x1400495d4]
neg ecx
mov r9d, dword [rsp + 0x70]
sbb eax, eax
test edx, eax
je 0x140013041
mov al, byte [0x1400494e7]
add al, 0x39
mov byte [rsp + 0x52], al
movsx ecx, byte [0x1400494fb]
not ecx
movsxd rdx, ecx
movsx rcx, byte [rsp + 0x50]
mov eax, dword [rsp + 0x64]
xor rcx, rdx
sub cl, 0x66
add cl, al
not cl
mov byte [rsp + 0x5c], cl
movsx rcx, byte [rsp + 0x51]
mov rax, qword [0x140049580]
cmp rcx, rax
jae 0x140013061
mov ecx, 2
mov word [0x1400495b8], cx
jmp 0x140013074
cmp dword [0x140049594], r8d
je 0x140013074
lea eax, [rsi - 0xf04e23e]
mov dword [rsp + 0x64], eax
mov ecx, dword [rsp + 0x58]
mov eax, dword [rsp + 0x58]
xor ecx, eax
mov eax, dword [rsp + 0x58]
xor eax, ecx
xor eax, 0xd7
add eax, 0x257
mov dword [rbp - 0x60], eax
mov rax, qword [rsp + 0x78]
cmp rax, r11
ja 0x1400130b9
movsx r10d, byte [rsp + 0x50]
mov eax, 0xd2
movsx ecx, byte [rsp + 0x50]
sub cx, ax
mov qword [rbp - 0x58], r10
mov word [rsp + 0x60], cx
jmp 0x1400130bd
mov r10, qword [rbp - 0x58]
cmp word [0x1400495bc], r8w
mov eax, dword [0x140a0f0f0]
mov dword [rsp + 0x58], eax
jne 0x1400130df
mov r15b, byte [rsp + 0x52]
xor r15b, 0x2b
mov dword [rsp + 0x74], r15d
mov eax, dword [rsp + 0x58]
mov rdx, qword [rbp - 0x70]
add eax, 0x4f5
cmp qword [0x140049588], rdx
mov dword [rsp + 0x6c], eax
jg 0x140013154
mov rax, qword [rbp - 0x80]
mov rdx, rbx
mov r8, qword [rsp + 0x78]
mov r10, rbx
mov ecx, r14d
add rcx, rax
mov eax, dword [0x1400495e4]
movzx ecx, r12b
sete dl
imul r8, rax
movsxd rax, dword [0x14004956c]
sub rcx, rax
add r8, rdx
mov rax, qword [0x140049580]
sub rcx, rax
lea eax, [r9 - 0x32651eb3]
not rcx
imul rcx, r8
test rcx, rcx
sete byte [0x1400494e3]
mov dword [rsp + 0x68], eax
jmp 0x1400131d0
test rsi, rsi
je 0x140013174
movsx rcx, word [0x1400495b4]
mov rax, qword [rbp - 0x38]
add ax, cx
mov word [0x1400495b4], ax
xor r10d, r10d
jmp 0x1400131d4
mov rax, qword [0x1400495c8]
mov ecx, r8d
test rax, rax
mov rdx, r8
mov eax, dword [rsp + 0x68]
sete cl
cmp eax, ecx
mov rax, qword [rbp - 0x48]
mov rcx, r8
setl dl
test r10d, r10d
sete cl
xor rcx, rax
cmp rdx, rcx
jbe 0x1400131cd
movzx ecx, word [0x140049514]
mov r12d, 0x2690bc06
mov rax, qword [0x1400495c8]
mov rdx, qword [rbp - 0x70]
add rax, rcx
mov qword [rbp - 0x38], rax
xor r10d, r10d
mov qword [rbp - 0x58], r12
jmp 0x1400131d8
xor r10d, r10d
mov rdx, qword [rbp - 0x70]
mov r12, qword [rbp - 0x58]
mov eax, dword [rsp + 0x58]
add r14d, 0xb6
add eax, 0x32ed
mov qword [rbp - 0x40], r14
mov dword [rbp - 0x74], eax
mov eax, dword [rsp + 0x58]
add eax, 0x1553
cmp dword [0x1400495b0], r10d
mov dword [rsp + 0x58], eax
je 0x14001320d
mov eax, edi
not eax
test eax, eax
jne 0x140013269
test rdx, rdx
je 0x140013233
imul rax, qword [0x140049588], 0x55
movzx ecx, word [rsp + 0x54]
mov r12d, esi
neg r12d
add cx, ax
mov qword [rbp - 0x58], r12
mov word [rsp + 0x54], cx
jmp 0x140013269
cmp word [0x1400495a4], r10w
je 0x14001324a
mov al, byte [0x1400495e8]
add al, 0x46
mov byte [rbp - 0x18], al
jmp 0x140013269
mov rax, qword [0x140049598]
test rax, rax
jne 0x140013269
mov eax, dword [rsp + 0x68]
mov ecx, 0x521a
sub ax, cx
mov word [0x1400495a4], ax
mov ecx, dword [rbp - 0x74]
mov eax, dword [rsp + 0x6c]
or ecx, eax
mov r8d, dword [rbp - 0x74]
mov eax, dword [rsp + 0x6c]
sub r8d, eax
mov edx, dword [rbp - 0x2c]
mov eax, dword [rbp - 0x78]
add edx, eax
imul r8d, ecx
mov ecx, dword [rbp - 0x78]
mov eax, dword [rbp - 0x78]
xor ecx, eax
imul ecx, edx
xor r8d, 0x9dfbc8e
add ecx, r8d
cmp qword [rbp - 8], 0xffffffffffffffff
mov dword [rbp - 0x2c], ecx
je 0x14001368f
movsx eax, word [0x1400495b4]
cmp eax, dword [0x140049590]
jne 0x1400132d5
mov rax, qword [0x1400495c8]
test rax, rax
je 0x1400132d5
mov byte [rsp + 0x51], r10b
movsx eax, byte [rsp + 0x51]
mov byte [rsp + 0x50], al
mov eax, dword [0x140a0f0f0]
mov dword [rbp - 0x78], eax
mov ecx, dword [rbp - 0x78]
mov eax, dword [rbp + 0x18]
add ecx, eax
mov dword [rsp + 0x6c], ecx
call qword [sym.imp.USER32.dll_GetFocus]
xor r10d, r10d
test rax, rax
je 0x140013312
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMenu]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_GetSubMenu]
xor r10d, r10d
mov rax, qword [0x1400495c0]
test rax, rax
je 0x14001333a
mov rax, qword [rbp - 0x80]
movabs rcx, 0x8308c9b21d7ac
movzx eax, word [rsp + 0x54]
add rax, rcx
mov qword [rbp - 0x80], rax
jmp 0x140013385
movzx eax, word [rsp + 0x60]
test ax, ax
je 0x140013362
movsx ecx, word [0x1400495b4]
movzx eax, word [0x1400495b4]
imul ecx, r14d
sub ax, cx
mov word [0x1400495b4], ax
jmp 0x140013385
mov eax, dword [rsp + 0x64]
movabs rcx, 0x2088dd7dbe6db
imul rax, rcx
mov qword [0x140049610], rax
lea eax, [rsi + 0x53]
mov word [0x1400495d4], ax
mov ecx, dword [rbp - 0x78]
mov edx, r10d
mov eax, dword [rbp - 0x28]
add ecx, eax
mov eax, r10d
mov dword [rbp - 0x28], ecx
mov rcx, qword [0x140049610]
cmp rcx, qword [0x1400495e8]
setne dl
cmp rcx, 0x24
setne al
cmp edx, eax
jne 0x1400133de
movzx eax, word [rsp + 0x60]
not eax
movsxd rcx, eax
mov rax, rsi
not rax
cmp rax, rcx
ja 0x1400133de
mov eax, dword [rsp + 0x70]
test r12d, r12d
mov rcx, r10
sete cl
xor rcx, rax
mov qword [0x140049600], rcx
mov ecx, dword [rbp - 0x78]
mov eax, dword [rbp - 0x60]
add ecx, eax
mov dword [rsp + 0x58], ecx
mov edx, dword [rsp + 0x58]
mov eax, dword [rbp - 0x28]
mov ecx, dword [rsp + 0x58]
mov r8d, dword [rbp - 0x2c]
imul edx, eax
sub ecx, edx
mov edx, dword [rsp + 0x58]
mov eax, dword [rsp + 0x6c]
add r8d, ecx
mov ecx, dword [rsp + 0x58]
sub edx, eax
mov eax, dword [rsp + 0x6c]
imul ecx, edx
imul eax, ecx
cmp r8d, eax
je 0x140013680
movzx ecx, word [0x1400495fc]
mov edx, r10d
mov rax, qword [0x140049580]
cmp rax, rcx
mov rax, qword [0x140049580]
mov ecx, r10d
setbe dl
cmp rax, 0x46
setbe cl
cmp edx, ecx
jbe 0x140013559
movzx eax, r15b
mov edx, r10d
mov r15, qword [rbp - 0x70]
mov qword [0x1400495c0], 4
movzx r8d, word [rsp + 0x60]
mov r9b, byte [rsp + 0x51]
add r8d, eax
mov al, byte [0x1400494e4]
sub al, r15b
xor al, 0xb6
not al
test r8d, r8d
movzx ecx, al
mov eax, r10d
cmove edx, ecx
test r9b, r9b
cmove eax, ecx
sub al, dl
mov byte [str.MSUnsupportedAlgorit], al
mov rax, qword [0x1400495c0]
test rax, rax
je 0x14001354e
sub rax, 1
je 0x14001351c
sub rax, 1
je 0x14001350a
sub rax, 1
je 0x1400134e1
cmp rax, 1
jne 0x14001355d
movzx edx, word [0x1400495e0]
mov ecx, 0xaeb3
imul edx, ecx
mov word [0x1400495d4], dx
jmp 0x14001355d
mov rax, qword [0x1400495d8]
movabs rcx, 0xffffffff6da0c8f4
add rax, rcx
mov qword [rbp - 0x20], rax
mov rax, qword [0x140049578]
xor al, 0x23
add byte [0x1400494e7], al
jmp 0x14001355d
mov al, byte [rsp + 0x5c]
mov eax, 0x882aed0d
mov qword [0x140049578], rax
jmp 0x14001355d
mov eax, dword [rsp + 0x68]
movabs rcx, 0x5e0a90ebf2a4f
shl eax, 8
mov dword [rsp + 0x64], eax
mov rax, qword [0x1400495f0]
add rcx, rax
movzx eax, word [0x1400495f8]
and ax, cx
mov word [0x1400495f8], ax
jmp 0x14001355d
mov eax, dword [rsp + 0x64]
sub al, 0x29
mov byte [rbp - 0x18], al
jmp 0x14001355d
mov r15, qword [rbp - 0x70]
mov rax, qword [rbp - 0x80]
mov ecx, 0xc1
add al, 0x11
mov ebx, 0x400
mov byte [rsp + 0x5c], al
mov edx, 1
movzx eax, byte [rsp + 0x52]
add ax, cx
mov ecx, ebx
mov word [0x1400495fc], ax
call fcn.140029014
mov r8, qword [rbp]
xor r9d, r9d
mov rdx, qword [rbp - 8]
mov r13, rax
mov rcx, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r9
mov r9, r13
mov qword [rbp + 0x58], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call fcn.140012594
call qword [sym.imp.USER32.dll_AnyPopup]
mov dword [0x14004956c], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov word [0x1400495f8], ax
xor r9d, r9d
movsxd rbx, dword [r13 + 0x3c]
lea rcx, [fcn.140029014]
xor eax, eax
add rbx, r13
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov edx, dword [rbx + 0x50]
lea r8d, [rax + 1]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call fcn.140012594
mov ecx, dword [rbx + 0x50]
xor r9d, r9d
mov r8, qword [rbp]
mov r13, rax
mov rdx, qword [rbp - 8]
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], r9
mov r9, r13
mov qword [rbp + 0x20], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call fcn.140012594
movsx rax, byte [rsp + 0x50]
mov rcx, qword [0x1400495f0]
imul rcx, rax
mov qword [0x1400495f0], rcx
movsxd rbx, dword [r13 + 0x3c]
add rbx, r13
xor r10d, r10d
jmp 0x140013684
mov r15, qword [rbp - 0x70]
mov r9d, dword [rsp + 0x70]
mov qword [rbp + 0x30], r13
jmp 0x1400136f1
cmp word [0x1400495b8], r10w
mov eax, 0x61a0
mov r15, qword [rbp - 0x70]
mov edx, 0xf1e
cmovne ax, word [0x1400495e4]
mov word [rsp + 0x60], ax
movzx eax, word [rsp + 0x60]
movzx ecx, word [rsp + 0x60]
add cx, ax
mov word [rsp + 0x60], cx
mov rcx, qword [rbp]
mov rax, qword [0x140049578]
mov r13, rcx
add ax, dx
mov qword [rbp + 0x20], rcx
mov word [0x1400495b4], ax
movsxd rbx, dword [rcx + 0x3c]
add rbx, rcx
jmp 0x1400136f8
mov r15, qword [rbp - 0x70]
mov r12, qword [rbp - 0x58]
mov r11, 0xffffffff947a61a0
cmp dword [rbx + 0x88], r10d
je 0x140014141
mov rax, qword [rbp - 0x80]
mov ecx, 0xd0
xor byte [0x1400494e4], r12b
sub ax, cx
sub byte [str.MSUnsupportedAlgorit], r9b
mov rcx, qword [0x1400495d8]
mov word [0x1400495a0], ax
mov eax, 0xd229
mov word [0x1400495f8], ax
mov al, cl
mov r12d, dword [rbx + 0x88]
shl al, 3
add r12, r13
mov byte [0x1400494e4], al
mov al, byte [0x140b1aa42]
mov byte [rsp + 0x5d], al
lea eax, [rcx + 0x35]
mov edx, dword [r12 + 0x1c]
mov esi, dword [r12 + 0x20]
add rdx, r13
add rsi, r13
mov qword [rbp - 0x28], rdx
mov dword [rsp + 0x68], eax
mov qword [rbp + 0x18], rsi
cmp r9d, 0x947a61a0
je 0x14001379e
mov rax, qword [0x140049580]
sub rax, 0x22
mov qword [0x1400495d8], rax
mov al, r9b
shl al, 6
mov dword [rsp + 0x74], eax
jmp 0x1400137ac
xor r11d, edi
sub r11d, 0x6b859e60
mov qword [rbp - 0x68], r11
mov ebx, dword [r12 + 0x24]
mov rax, qword [0x140049580]
add rbx, r13
mov r13d, r10d
mov qword [rbp - 0x60], rbx
cmp dword [r12 + 0x18], r10d
jbe 0x140014141
mov al, byte [0x1400494fb]
test al, al
je 0x140013809
movzx eax, word [0x140b5bc14]
sub word [0x140049554], ax
mov rax, qword [0x140049578]
movzx ecx, byte [0x140049513]
sub rcx, rax
mov rax, qword [0x140049578]
add rax, rcx
mov qword [0x140049578], rax
jmp 0x140013828
mov rcx, qword [rbp - 0x38]
movsxd rax, dword [0x14004956c]
not rcx
cmp rax, rcx
ja 0x140013828
mov al, byte [0x140a0f0f0]
mov byte [0x1400494e3], al
movzx eax, byte [0x1400494e7]
cmp r11d, eax
jl 0x140013865
movsx ecx, byte [0x1400494e3]
movzx eax, word [rsp + 0x54]
cmp eax, ecx
jg 0x140013882
mov rcx, qword [0x140049580]
mov rax, qword [0x140049580]
sub rcx, rax
mov rax, qword [rbp - 0x48]
sub rcx, rax
mov qword [0x140049580], rcx
jmp 0x140013882
cmp word [0x1400495a0], r10w
je 0x140013882
mov ecx, 0x155
movzx eax, r11w
sub ax, cx
mov word [0x140049514], ax
mov rdi, qword [rbp + 0x20]
mov r15d, r13d
movzx eax, word [rbx + r15*2]
mov r14d, dword [rdx + rax*4]
add r14, rdi
cmp r13d, dword [r12 + 0x18]
jae 0x140013918
mov al, byte [0x1400494e3]
mov al, byte [rsp + 0x52]
mov eax, dword [0x1400495d0]
mov rax, qword [0x140049578]
mov rax, qword [0x140049598]
mov al, byte [rsp + 0x50]
test al, al
je 0x1400138cc
mov dword [0x1400495d0], 0x600eaa5b
movups xmm0, xmmword [str.MesHandleFree]
lea rcx, [rbp + 0xc0]
mov eax, dword [0x140036a60]
movsd xmm1, qword [0x140036a58]
movups xmmword [rbp + 0xc0], xmm0
mov dword [rbp + 0xd8], eax
movsd qword [rbp + 0xd0], xmm1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov qword [0x140049598], rcx
mov eax, dword [rsi + r15*4]
add rax, rdi
mov qword [rbp + 0x40], rax
lea rdx, [rbp + 8]
mov rcx, r14
call fcn.140015a54
mov esi, eax
cmp eax, 1
jbe 0x14001408d
call fcn.14001a88c
mov rdi, rax
mov qword [rbp - 0x50], rax
xor eax, eax
lea rcx, [fcn.140027c40]
mov qword [rsp + 0x40], rax
mov r9d, 0x104
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rdx, [rdi + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call fcn.140012594
mov r8, qword [rbp + 0x40]
lea rdx, [rdi + 0x18]
xor eax, eax
lea rcx, [0x140028eb0]
mov qword [rsp + 0x40], rax
mov r9d, 0x103
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call fcn.140012594
mov rax, qword [rbp]
mov rbx, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x28]
mov qword [rdi], rax
movzx eax, word [rbx + r15*2]
mov word [rdi + 8], ax
movzx eax, word [rbx + r15*2]
mov r15, qword [rbp]
mov ecx, dword [rcx + rax*4]
mov eax, 2
add rcx, r15
mov qword [rdi + 0x10], rcx
cmp esi, eax
jne 0x140013a2c
mov al, byte [0x1400494e3]
mov eax, dword [rsp + 0x64]
mov rax, qword [0x1400495f0]
movsx rcx, byte [0x1400494e3]
movabs rax, 0xb6e96ce6113e
imul rcx, rax
mov al, byte [rsp + 0x52]
add al, cl
mov rcx, qword [rbp + 8]
mov byte [rsp + 0x52], al
movsxd rax, dword [rcx + r14]
add rcx, 4
add rax, qword [rdi + 0x10]
mov rdi, qword [rbp - 0x50]
add rcx, rax
mov qword [rdi + 0x220], rcx
jmp 0x140013b2c
cmp esi, 3
jne 0x140013adf
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, dword [rsp + 0x74]
xor r14d, r14d
mov ecx, eax
cmp sil, 0xf
mov qword [0x1400495c8], rcx
mov edx, r14d
mov rax, qword [0x140049600]
seta dl
cmp rdx, rax
mov ecx, r14d
movsx eax, byte [rsp + 0x5d]
setge cl
cmp eax, ecx
jge 0x140013a81
mov eax, dword [0x1400495d0]
add ax, word [rbp - 0x70]
mov word [0x1400495b4], ax
jmp 0x140013ac7
cmp byte [rbp - 0x18], r14b
je 0x140013ac7
mov al, byte [rsp + 0x5c]
mov ecx, 1
sub cl, al
movzx esi, sil
movzx eax, cl
movzx ecx, word [0x140049514]
imul esi, eax
not ecx
movzx eax, word [0x140049554]
imul eax, ecx
mov dword [rsp + 0x74], esi
movsxd rcx, eax
mov rax, qword [0x1400495c0]
add al, 0x29
not al
add al, cl
mov byte [rsp + 0x52], al
mov rcx, qword [rdi + 0x10]
mov rax, qword [rbp + 8]
mov rdi, qword [rbp - 0x50]
mov edx, dword [rcx + rax]
mov qword [rdi + 0x220], rdx
jmp 0x140013b33
cmp esi, 4
jne 0x140013b2c
movzx eax, word [0x140049514]
movsx rdx, byte [rsp + 0x5d]
sub rdx, rax
mov rax, qword [0x1400495e8]
add dl, al
and dl, al
mov eax, dword [0x140a0f0f0]
mov dword [0x1400495e4], eax
mov rax, qword [rbp + 8]
mov byte [0x1400494fb], dl
mov rdx, qword [rdi + 0x10]
mov rdi, qword [rbp - 0x50]
mov ecx, dword [rdx + rax]
mov rax, qword [rcx + rdx + 6]
mov qword [rdi + 0x220], rax
mov esi, dword [rsp + 0x74]
xor r14d, r14d
mov rdx, qword [rdi + 0x220]
lea r8, [rbp + 0x60]
mov rcx, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov r9d, 0x30
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call fcn.140012594
test rax, rax
jne 0x140013c46
lea ecx, [rax + 1]
call qword [sym.imp.USER32.dll_BeginDeferWindowPos]
mov rcx, rax
call qword [sym.imp.USER32.dll_EndDeferWindowPos]
mov r15, qword [rbp + 0x10]
cmp r15, qword [rbp + 0x48]
jae 0x140013beb
mov rax, qword [rbp + 0x50]
movsx ecx, byte [rsp + 0x51]
mov qword [rax + r15*8], rdi
movzx eax, sil
cmp eax, ecx
jl 0x140013bcb
mov al, byte [rsp + 0x51]
movsxd rcx, dword [0x140049590]
test al, al
mov rdx, qword [rbp - 0x20]
cmovne rdx, rcx
mov dword [0x1400494fc], 0x81a24a36
mov qword [0x1400495c8], rdx
jmp 0x140013be4
movzx ecx, word [rsp + 0x54]
movzx eax, word [rsp + 0x54]
sub rcx, rax
mov rax, qword [rbp - 0x80]
sub cx, ax
mov word [rsp + 0x54], cx
inc r15
mov qword [rbp + 0x10], r15
mov rax, qword [0x140049578]
mov edx, r14d
cmp rax, qword [rbp - 0x70]
mov ecx, r14d
mov rax, qword [0x140049578]
mov rdi, qword [rbp - 0x68]
setae dl
cmp rax, 0x22
mov dword [rbp - 0x10], 4
setae cl
cmp edx, ecx
lea ebx, [rdi + 1]
lea rcx, [rbp - 0x50]
cmova ebx, edi
mov rdi, qword [rbp + 0x28]
inc dword [rdi]
call fcn.1400146b4
mov r14, qword [rbp - 0x40]
mov r11d, ebx
mov rbx, qword [rbp - 0x60]
xor r10d, r10d
mov qword [rbp - 0x68], r11
jmp 0x140014127
cmp qword [rbp + 0x68], r15
jne 0x140013cc3
movsx ecx, byte [0x1400494e5]
movzx eax, word [0x1400495bc]
cmp ecx, eax
jne 0x140013c95
mov cl, byte [rsp + 0x51]
mov edx, r14d
mov al, byte [rsp + 0x50]
cmp al, cl
mov al, byte [rsp + 0x50]
mov ecx, r14d
setl dl
cmp al, 0x39
setl cl
cmp edx, ecx
jae 0x140013cae
movzx eax, word [0x1400495d4]
imul rcx, rax, 0x704a
mov qword [0x140049588], rcx
jmp 0x140013cae
cmp qword [rbp - 0x70], r14
jne 0x140013cae
movsx eax, byte [0x1400494e3]
add eax, 0x49
cdqe
mov qword [0x140049588], rax
lea rcx, [rbp - 0x50]
call fcn.1400146b4
mov r14, qword [rbp - 0x40]
xor r10d, r10d
jmp 0x140014123
mov qword [rsp + 0x40], r14
lea rdx, [rbp + 0x220]
mov qword [rsp + 0x38], r14
lea rcx, [fcn.140027c40]
mov qword [rsp + 0x30], r14
xor r8d, r8d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov r14d, 0x104
mov r9d, r14d
call fcn.140012594
mov esi, dword [rsp + 0x70]
lea r8, [rbp + 0x220]
mov al, sil
mov r9d, r14d
mov r14, qword [rbp - 8]
mov rdx, r15
mov dword [rsp + 0x74], eax
mov rcx, r14
mov rax, qword [rbp - 0x70]
add eax, 0xef639a34
mov dword [rsp + 0x64], eax
call fcn.1400147cc
xor eax, eax
lea rdx, [rbp + 0x330]
mov qword [rsp + 0x40], rax
lea rcx, [fcn.140027c40]
mov qword [rsp + 0x38], rax
mov r9d, 0x104
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call fcn.140012594
test esi, esi
jne 0x140013d78
mov rax, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x50]
imul ecx, eax, 0xa155c187
add dword [rbp - 0x30], ecx
mov rdx, qword [rbp + 0x68]
lea r8, [rbp + 0x330]
mov r9d, 0x104
mov rcx, r14
call fcn.1400147cc
xor esi, esi
mov dword [rbp + 0xa0], 0x6c706369
mov dword [rbp + 0xa4], 0x30316a63
mov eax, esi
mov dword [rbp + 0xa8], 0x6a6a622c
mov byte [rbp + 0xac], sil
lea ecx, [rsi + 2]
add byte [rbp + rax + 0xa0], cl
inc rax
cmp rax, 0xc
jb 0x140013dbd
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x220]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x140013e5e
mov dword [rbp + 0xb0], 0x968a9d93
mov rax, rsi
mov dword [rbp + 0xb4], 0x999a949d
mov dword [rbp + 0xb8], 0x9cd69d8b
mov word [rbp + 0xbc], 0x9494
mov byte [rbp + 0xbe], sil
xor byte [rbp + rax + 0xb0], 0xf8
inc rax
cmp rax, 0xe
jb 0x140013e17
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x330]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x140013e5e
call qword [sym.imp.USER32.dll_GetFocus]
test rax, rax
je 0x140013cae
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowDC]
jmp 0x140013cae
mov qword [rsp + 0x40], rsi
lea rdx, [rbp + 0x110]
mov qword [rsp + 0x38], rsi
lea rcx, [fcn.140027c40]
mov qword [rsp + 0x30], rsi
mov r9d, 0x104
mov qword [rsp + 0x28], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call fcn.140012594
mov eax, dword [0x140036a88]
lea rcx, [rbp + 0xe0]
movups xmm0, xmmword [str.Encrypted_response]
mov dword [rbp + 0x100], eax
movups xmm1, xmmword [0x140036a78]
movzx eax, word [0x140036a8c]
movups xmmword [rbp + 0xe0], xmm0
mov word [rbp + 0x104], ax
movups xmmword [rbp + 0xf0], xmm1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rbp + 0x68]
lea r8, [rbp + 0x110]
mov r9d, 0x104
mov word [0x1400495fc], ax
mov rcx, r14
call fcn.1400147cc
mov qword [rsp + 0x40], rsi
lea r8, [rbp + 0x110]
mov qword [rsp + 0x38], rsi
lea rcx, [0x140028eb0]
mov qword [rsp + 0x30], rsi
add rdi, 0x11c
mov qword [rsp + 0x28], rsi
mov r9d, 0x103
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call fcn.140012594
mov qword [rsp + 0x40], rsi
lea rcx, [0x140029170]
mov qword [rsp + 0x38], rsi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov qword [rsp + 0x28], rsi
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call fcn.140012594
test rax, rax
je 0x140013fc9
mov qword [rsp + 0x40], rsi
lea rdx, [rbp + 0x110]
mov qword [rsp + 0x38], rsi
lea rcx, [fcn.140027c40]
mov qword [rsp + 0x30], rsi
mov r9d, 0x104
mov qword [rsp + 0x28], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call fcn.140012594
mov r9d, 0x104
lea r8, [rbp + 0x110]
mov rdx, r15
mov rcx, r14
call fcn.1400147cc
lea rdx, [rbp + 0x110]
mov rcx, rdi
call fcn.140014334
test eax, eax
jne 0x140013cae
mov r15, qword [rbp + 0x10]
cmp r15, qword [rbp + 0x48]
jae 0x140014015
movzx eax, word [rsp + 0x54]
add rax, 0x812
cmp word [0x1400495b8], si
mov qword [rbp - 0x80], rax
je 0x140013ff5
movsx rcx, word [0x1400495b4]
jmp 0x140013ffc
mov rcx, qword [0x1400495a8]
mov rax, qword [rbp - 0x50]
mov byte [0x1400494e3], cl
mov rcx, qword [rbp + 0x50]
mov qword [rcx + r15*8], rax
inc r15
mov qword [rbp + 0x10], r15
mov ecx, dword [rsp + 0x64]
mov rax, qword [0x140049598]
cmp rax, rcx
jle 0x14001405f
movsx r8, byte [rsp + 0x5d]
mov edx, esi
mov rax, qword [rbp - 0x80]
cmp r8, rax
mov eax, esi
sete dl
cmp r8b, 0x44
sete al
cmp edx, eax
jbe 0x140014082
movsx eax, byte [0x1400494e5]
sub eax, 0xd0
mov dword [rbp - 0x58], 0xbe
cdqe
mov qword [rbp - 0x20], rax
jmp 0x140014082
mov rax, qword [0x140049598]
or rax, qword [rbp - 0x20]
je 0x140014082
mov rax, qword [rsp + 0x78]
xor qword [0x1400495e8], rax
mov rax, qword [0x140049580]
mov byte [rbp - 0x18], al
mov rax, qword [rbp + 0x28]
inc dword [rax]
jmp 0x140013cb7
movsx ecx, byte [0x1400494e5]
xor r10d, r10d
cmp dword [rbp - 0x58], r10d
mov eax, r10d
mov r14, qword [rbp - 0x40]
mov edx, r10d
sete al
cmp r14d, eax
mov eax, r10d
setne dl
cmp ecx, dword [0x140049590]
setne al
or rdx, rax
mov rax, qword [0x140049600]
add rax, rdx
je 0x140014116
movzx edx, word [0x1400495f8]
movzx ecx, byte [0x140049513]
not ecx
xor edx, ecx
movsx ecx, word [0x1400495b4]
not ecx
add ecx, edx
movsxd rdx, ecx
movzx ecx, word [rsp + 0x60]
movzx eax, byte [0x1400494e7]
sub ecx, eax
sub ecx, dword [rbp - 0x70]
and ecx, edx
mov dword [rsp + 0x68], ecx
mov ecx, 0xe41
mov rax, qword [rsp + 0x78]
sub ax, cx
mov word [0x1400495e0], ax
jmp 0x140014123
mov qword [rsp + 0x78], 0x6a
mov byte [rbp - 0x18], 0xb1
mov r11, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x28]
inc r13d
mov rsi, qword [rbp + 0x18]
cmp r13d, dword [r12 + 0x18]
jb 0x1400137cd
mov r15, qword [rbp - 0x70]
cmp qword [rbp - 8], 0xffffffffffffffff
je 0x1400142ab
movzx ecx, byte [0x1400494e7]
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
movsx rcx, byte [rsp + 0x50]
xor ebx, ebx
mov word [0x140049554], ax
mov rax, qword [rsp + 0x78]
imul rax, rcx
test rax, rax
je 0x1400141bf
mov rax, qword [rbp - 0x68]
movabs rcx, 0x5bede87f50ff4
cdqe
sub rcx, rax
mov rax, qword [0x140049600]
add rcx, rax
movzx eax, word [0x140049554]
sub rax, qword [0x1400495d8]
not rcx
add rax, r15
or rax, rcx
mov eax, ebx
sete al
mov dword [0x140049594], eax
mov rax, qword [rsp + 0x78]
jmp 0x14001424b
mov al, byte [rsp + 0x51]
test al, al
je 0x1400141e5
movzx eax, word [0x1400495a4]
movabs rcx, 0xe3736296b30cd
imul rax, rcx
mov qword [0x1400495a8], rax
jmp 0x14001424b
mov al, byte [rsp + 0x50]
test al, al
je 0x1400141fc
movzx eax, word [rsp + 0x54]
add al, 0x2f
add byte [0x140049513], al
jmp 0x14001424b
mov eax, dword [rsp + 0x64]
test eax, eax
je 0x14001424b
mov al, byte [rsp + 0x50]
mov r8d, dword [rsp + 0x64]
test al, al
sete al
xor r8b, al
mov rax, qword [rbp - 0x80]
movsx ecx, byte [0x1400495e4]
movsx edx, al
movzx eax, word [0x1400495b8]
imul edx, ecx
mov ecx, 0x484b
add dl, r8b
sub dl, byte [0x1400494fc]
sub ax, cx
mov byte [0x1400494e4], dl
mov word [0x1400495d4], ax
mov rdx, qword [rbp + 0x58]
lea rcx, [fcn.140029218]
mov qword [rsp + 0x40], rbx
xor r9d, r9d
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call fcn.140012594
mov rdx, qword [rbp + 0x30]
lea rcx, [fcn.140029218]
mov qword [rsp + 0x40], rbx
xor r9d, r9d
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call fcn.140012594
jmp 0x1400142ad
xor ebx, ebx
cmp dword [0x140049594], ebx
movzx ecx, byte [0x1400495a8]
movzx eax, r14b
cmovne ecx, eax
mov qword [rbp - 0x80], 3
mov rax, qword [rbp - 0x80]
dec rax
mov byte [0x1400494e7], cl
sub rax, 1
je 0x1400142f2
cmp rax, 1
jne 0x140014304
movzx eax, byte [0x1400494e7]
add eax, 0x36
mov dword [rsp + 0x68], eax
jmp 0x140014304
mov eax, dword [0x14004956c]
mov ecx, dword [rbp - 0x30]
lea ecx, [rcx + rax*2]
mov dword [0x14004956c], ecx
mov eax, dword [rbp - 0x10]
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.1400267f0
mov rbx, qword [rsp + 0x5a8]
add rsp, 0x550
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret