Function at 0x1400b6180
Capabilities:
Create pipe
Encode data using base64
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x20], xmm6
mov r8d, edx
mov qword [rbp - 0x18], rcx
xor eax, eax
test al, al
jne 0x1400b61e9
mov eax, dword [0x141dd3188]
xor edx, edx
div dword [0x141dd318c]
imul rcx, rax, 0xf181601
shr rcx, 0x3b
add ecx, 0xdeb9fa2d
and ecx, 0xc801b222
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov r14, rsp
cmp ecx, 0xc878f962
jbe 0x1400b61f8
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
jmp 0x1400b61ac
xor r12d, r12d
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov qword [rbp - 0x40], rsp
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov qword [rbp - 0x38], rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.1400eeec0
sub rsp, rax
mov qword [rbp - 0x78], rsp
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov qword [rbp - 0x70], rsp
mov eax, 0x30
call fcn.1400eeec0
sub rsp, rax
mov qword [rbp - 0x68], rsp
mov eax, 0x20
call fcn.1400eeec0
sub rsp, rax
mov qword [rbp - 0x60], rsp
mov byte [rbp + 0x1f], r8b
movzx eax, r8b
mov ecx, 0x40080002
sub ecx, eax
mov dword [rbp - 0x24], ecx
mov dword [rbp + 0x18], 8
xorps xmm6, xmm6
mov dil, 1
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x58], r15
jmp 0x1400b62b5
sub rsp, 0x20
xor edi, edi
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add rsp, 0x20
mov r13, qword [rbp - 0x78]
mov dword [r13], eax
mov rax, qword [0x141dda688]
test rax, rax
mov rbx, qword [rbp + 8]
mov rsi, qword [rbp + 0x10]
jne 0x1400b6333
nop
mov eax, dword [0x141dd3190]
sub eax, dword [0x141dd3194]
imul eax, eax, 0x559e8ebc
add eax, 0xeaabdd07
or eax, 0x33a94598
cmp eax, 0xc288fed8
je 0x1400b62e0
movups xmmword [r14], xmm6
sub rsp, 0x20
mov edx, 0x10
mov rcx, r14
call qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
add rsp, 0x20
mov rax, qword [r14]
mov qword [0x141dda688], rax
mov rax, qword [0x141dda688]
test rax, rax
je 0x1400b62e0
mov rax, qword [rbp - 0x30]
inc eax
mov dword [rbp - 0x28], eax
mov eax, 1
lock xadd qword [0x141dda688], rax
mov qword [r15], rax
mov eax, dword [0x141dd3198]
sub eax, dword [0x141dd319c]
imul rax, rax, 0x24af5a8b
shr rax, 0x37
and eax, 0xffffffe9
cmp eax, 0xa327fcd0
mov rcx, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x68]
mov r8d, 0xdb5ddca5
lea r9, [0x1400562a0]
lea r10, [0x140054720]
lea r11, [0x141db8698]
je 0x1400b63e5
nop word cs:[rax + rax]
mov eax, dword [0x141dd31a0]
imul eax, dword [0x141dd31a4]
imul rax, r8
shr rax, 0x3d
and eax, 0xfffffffd
mov qword [rcx], r13
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], r10
mov qword [rdx], r11
mov qword [rdx + 8], 2
mov qword [rdx + 0x20], 0
mov qword [rdx + 0x10], rcx
cmp eax, 0x1ed1df76
jne 0x1400b6410
mov qword [rcx], r13
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], r10
mov qword [rdx], r11
mov qword [rdx + 8], 2
mov qword [rdx + 0x20], 0
mov qword [rdx + 0x10], rcx
jmp 0x1400b63a0
mov qword [rdx + 0x18], 2
sub rsp, 0x20
mov r14, qword [rbp - 0x60]
mov rcx, r14
call fcn.140038da0
add rsp, 0x20
test rsi, rsi
sete al
or dil, al
test dil, 1
mov rdi, qword [sym.imp.KERNEL32.dll_HeapFree]
mov r15d, 0x986fd7af
jne 0x1400b64ac
test r12b, r12b
je 0x1400b6470
mov rcx, qword [0x141dda6a0]
sub rsp, 0x20
xor edx, edx
mov r8, rbx
call rdi
add rsp, 0x20
nop word cs:[rax + rax]
mov esi, dword [0x141dd32b0]
xor esi, dword [0x141dd32b4]
and esi, 0xe627adc7
add esi, 0xbb3029eb
xor esi, 0x2bb0b9cc
mov rcx, qword [0x141dda6a0]
sub rsp, 0x20
xor edx, edx
mov r8, rbx
call rdi
add rsp, 0x20
cmp esi, 0x7c31c8b6
jbe 0x1400b6470
mov eax, dword [0x141dd31a8]
imul eax, dword [0x141dd31ac]
and eax, 0x80cc104a
or eax, 0x6c312f15
imul eax, eax, 0x6f2718e7
cmp eax, 0x92ac7ba8
ja 0x1400b64ac
mov r10, qword [r14]
mov r9, qword [r14 + 8]
mov r11, qword [r14 + 0x10]
lea rax, [r9 + r11]
mov qword [rbp - 0x20], rax
xor ebx, ebx
nop word cs:[rax + rax]
mov eax, dword [0x141dd31b0]
and eax, dword [0x141dd31b4]
imul rcx, rax, 0x2521ca6d
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
or eax, 0x4b1f3930
cmp eax, 0x580bffd5
ja 0x1400b64f0
test r11, r11
mov qword [rbp + 8], r9
mov qword [rbp + 0x10], r10
mov qword [rbp - 0x50], r11
je 0x1400b66c0
mov eax, dword [0x141dd31b8]
xor eax, dword [0x141dd31bc]
and eax, 0x3848d552
add eax, 0xd52a56ef
or eax, 0xc84dcaf
cmp eax, 0xc1313c14
je 0x1400b6531
lea rdi, [r9 + 1]
mov eax, dword [0x141dd31c0]
xor edx, edx
div dword [0x141dd31c4]
mov eax, dword [0x141dd31c8]
imul eax, dword [0x141dd31cc]
xor eax, 0x22538858
add eax, 0x9878fc69
cmp eax, 0x1bf73afe
jb 0x1400b6565
movzx r14d, byte [r9]
test r14b, r14b
js 0x1400b65d0
nop dword [rax]
test bl, bl
jne 0x1400b6590
nop word cs:[rax + rax]
mov eax, dword [0x141dd31e8]
xor eax, dword [0x141dd31ec]
imul eax, eax, 0x738d1910
add eax, 0x30e6ba9b
and eax, 0x9af4ad53
cmp eax, 0xe55af91f
jae 0x1400b65a0
jmp 0x1400b67a0
mov eax, dword [0x141dd31d0]
xor eax, dword [0x141dd31d4]
or eax, 0xda9ebd29
and eax, 0xda9ebd2d
cmp eax, 0x8c6aadc7
jb 0x1400b65d0
mov ecx, r14d
and ecx, 0x1f
lea rdi, [r9 + 2]
movzx r8d, byte [r9 + 1]
nop dword [rax]
mov eax, dword [0x141dd31d8]
xor edx, edx
div dword [0x141dd31dc]
and eax, 0xdf5a4311
cmp eax, 0x142fa179
je 0x1400b6600
mov eax, ecx
shl eax, 6
and r8d, 0x3f
nop word cs:[rax + rax]
mov edx, dword [0x141dd31e0]
xor edx, dword [0x141dd31e4]
xor edx, 0xc044a282
or edx, 0x3f321d08
cmp edx, 0xf8e26043
je 0x1400b6630
cmp r14b, 0xdf
jbe 0x1400b66da
movzx eax, byte [r9 + 2]
shl r8d, 6
and eax, 0x3f
or eax, r8d
cmp r14b, 0xf0
jb 0x1400b66e5
nop
mov edx, dword [0x141dd31f0]
imul edx, dword [0x141dd31f4]
xor edx, 0xc368d368
imul rdx, rdx, 0x517353bf
shr rdx, 0x3e
add edx, 0x8b2a0023
cmp edx, 0xf0885bc7
ja 0x1400b6670
lea rdi, [r9 + 4]
movzx r14d, byte [r9 + 3]
and ecx, 7
shl ecx, 0x12
shl eax, 6
and r14d, 0x3f
or r14d, eax
or r14d, ecx
jmp 0x1400b66f1
mov esi, 4
mov edx, 8
xor r13d, r13d
xor r12d, r12d
xor r14d, r14d
xor edi, edi
jmp 0x1400b683b
or eax, r8d
mov r14d, eax
jmp 0x1400b67a0
lea rdi, [r9 + 3]
shl ecx, 0xc
or eax, ecx
mov r14d, eax
mov eax, dword [0x141dd31f8]
or eax, dword [0x141dd31fc]
xor eax, 0x3db69113
imul eax, eax, 0xf1e2fe9f
mov ecx, 0xa064883d
imul rax, rcx
shr rax, 0x3f
cmp eax, 0x713fd536
je 0x1400b66f1
cmp r14d, 0xffff
jbe 0x1400b67a0
mov eax, dword [0x141dd3208]
xor eax, dword [0x141dd320c]
imul eax, eax, 0x3da08ce6
or eax, 0x88114850
and eax, 0x9f114876
cmp eax, 0xeb6da615
ja 0x1400b6725
lea eax, [r14 + 0xff0000]
shr eax, 0xa
nop word cs:[rax + rax]
mov ecx, dword [0x141dd3210]
imul ecx, dword [0x141dd3214]
imul ecx, ecx, 0xd20fa75
cmp ecx, 0x4d4f911c
je 0x1400b6760
movzx ecx, ax
or ecx, 0xd800
and r14d, 0x3ff
or r14d, 0xdc00
mov eax, 2
mov r13d, r14d
mov r14d, ecx
jmp 0x1400b67cb
mov eax, dword [0x141dd3200]
imul eax, dword [0x141dd3204]
add eax, 0x9d7e72d3
or eax, 0x20000320
and eax, 0xe186f374
cmp eax, 0x5ab8c692
je 0x1400b67a0
xor r13d, r13d
mov eax, 1
mov r9d, 4
mov ecx, dword [0x141dd3218]
or ecx, dword [0x141dd321c]
add ecx, 0x69bb3fc6
or ecx, 0x3646c403
mov rdx, qword [rbp - 0x20]
sub rdx, rdi
add rdx, 3
mov r8, 0xffffffffffffffff
cmovb rdx, r8
shr rdx, 2
lea rsi, [rdx + rax]
inc rsi
add rdx, rax
cmp rdx, 3
cmovb rsi, r9
cmp ecx, 0x56823393
je 0x1400b67d1
movabs rax, 0x3fffffffffffffff
cmp rsi, rax
ja 0x1400b7084
mov r12, rdi
lea rdx, [rsi + rsi]
mov di, 1
movzx eax, byte [0x141dda6b8]
sub rsp, 0x20
xor ecx, ecx
call fcn.1400bf230
add rsp, 0x20
test rax, rax
je 0x1400b7079
mov rcx, rax
mov word [rax], r14w
mov qword [rbp - 0x10], rsi
mov eax, dword [0x141dd3220]
xor edx, edx
div dword [0x141dd3224]
xor eax, 0x2436c65d
imul eax, eax, 0xac0bd7d9
add eax, 0x1653b627
cmp eax, 0xb173e914
jae 0x1400b6896
mov qword [rbp - 8], rcx
mov qword [rbp], 1
mov r10, rdi
nop dword [rax]
mov eax, dword [0x141dd3228]
sub eax, dword [0x141dd322c]
or eax, 0xfbd4c78b
xor eax, 0xc34fa612
mov qword [rbp - 8], rcx
mov qword [rbp], 1
cmp eax, 0x57fb0656
ja 0x1400b68a0
mov rdi, r12
nop dword [rax]
mov eax, dword [0x141dd3230]
imul eax, dword [0x141dd3234]
add eax, 0xcfdd3854
xor eax, 0x8104b71f
add eax, 0x4108fff8
cmp eax, 0xb22a9e9d
ja 0x1400b68d0
mov r14d, 1
test rdi, rdi
je 0x1400b69d0
nop word cs:[rax + rax]
test r13w, r13w
je 0x1400b6930
xor eax, eax
mov r12d, r13d
cmp r14, qword [rbp - 0x10]
je 0x1400b6b94
jmp 0x1400b6d40
mov eax, dword [0x141dd3238]
xor eax, dword [0x141dd323c]
add eax, 0x81065ae1
xor eax, 0x230c4283
or eax, 0x5c31ad2c
cmp eax, 0x5c233af3
je 0x1400b6930
cmp rdi, qword [rbp - 0x20]
je 0x1400b69d0
nop dword [rax + rax]
mov eax, dword [0x141dd3240]
xor edx, edx
div dword [0x141dd3244]
imul rax, r15
shr rax, 0x3e
xor eax, 0xd54190f3
add eax, 0xd451a8bb
cmp eax, 0x2479797d
jb 0x1400b6960
movzx eax, byte [rdi]
test al, al
js 0x1400b6a63
inc rdi
nop word cs:[rax + rax]
mov edx, dword [0x141dd3250]
sub edx, dword [0x141dd3254]
add edx, 0x7dd8bc75
cmp edx, 0x14866b53
jbe 0x1400b69a0
mov rdx, rdi
mov r8d, eax
jmp 0x1400b6b82
xor r12d, r12d
mov eax, dword [0x141dd3280]
and eax, dword [0x141dd3284]
imul rax, rax, 0x6ecd856d
shr rax, 0x3d
or eax, 0x1d062804
and eax, 0x1d062805
cmp eax, 0xb6bf1bd6
ja 0x1400b69d3
mov rbx, qword [rbp - 0x10]
cmp r10w, 1
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x1400b6dc0
nop word cs:[rax + rax]
mov eax, dword [0x141dd3288]
xor eax, dword [0x141dd328c]
add eax, 0x5a9f7d5
or eax, 0xee990c25
cmp eax, 0x9e2655fa
je 0x1400b6a20
xor r12d, r12d
mov edi, 0
mov r10d, 0
mov esi, 0
cmp r14, rbx
mov ebx, 0
je 0x1400b6bf5
jmp 0x1400b6d43
mov r9d, eax
and r9d, 0x1f
lea rdx, [rdi + 2]
movzx r11d, byte [rdi + 1]
mov r8d, r9d
shl r8d, 6
and r11d, 0x3f
or r8d, r11d
mov r13, r10
nop word cs:[rax + rax]
mov r10d, dword [0x141dd3248]
mov esi, dword [0x141dd324c]
add r10d, esi
add r10d, 0x7765447f
xor r10d, 0x4f102d5c
imul r10, r10, 0x2c8a147d
shr r10, 0x3a
cmp r10d, 0x6762c119
ja 0x1400b6a90
cmp al, 0xdf
jbe 0x1400b6b7f
mov r8d, dword [0x141dd3258]
imul r8d, dword [0x141dd325c]
or r8d, 0xb4022730
and r8d, 0xbc2b27ba
xor r8d, 0x967fd897
cmp r8d, 0xfb0eea3e
ja 0x1400b6aca
lea r10, [rdi + 3]
movzx r8d, byte [rdx]
shl r11d, 6
and r8d, 0x3f
or r8d, r11d
mov edx, r9d
shl edx, 0xc
test bl, bl
jne 0x1400b6b10
cmp al, 0xf0
jb 0x1400b6c99
mov eax, dword [0x141dd3260]
xor edx, edx
div dword [0x141dd3264]
mov eax, dword [0x141dd3268]
add eax, dword [0x141dd326c]
or eax, 0x8e594a73
imul eax, eax, 0x7307d1ed
cmp eax, 0xf5520e94
je 0x1400b6b2a
add rdi, 4
movzx eax, byte [r10]
and r9d, 7
shl r9d, 0x12
shl r8d, 6
and eax, 0x3f
or eax, r8d
test bl, bl
jne 0x1400b6b62
or eax, r9d
mov r10, rdi
mov r8d, eax
cmp r8d, 0xffff
ja 0x1400b6ca9
mov rdx, r10
mov r10, r13
xor eax, eax
mov rdi, rdx
mov r12d, r8d
cmp r14, qword [rbp - 0x10]
jne 0x1400b6d40
mov rcx, qword [rbp - 0x20]
sub rcx, rdi
add rcx, 3
mov rdx, 0xffffffffffffffff
cmovb rcx, rdx
nop word [rax + rax]
mov edx, dword [0x141dd3290]
and edx, dword [0x141dd3294]
xor edx, 0x3a390081
and edx, 0x3abb18b5
imul r9d, edx, 0xeea8927f
xor edx, edx
test ax, ax
setne r8b
cmp r9d, 0x858c7742
jb 0x1400b6bb0
shr rcx, 2
mov dl, r8b
add rdx, rcx
movzx esi, r10w
add rsi, rdx
mov r13d, eax
mov qword [rbp - 0x80], r13
mov r13, rdi
mov rdi, r10
mov eax, dword [0x141dd32a8]
xor eax, dword [0x141dd32ac]
add eax, 0x8c7a2a1e
shr eax, 2
imul rax, rax, 0x885a347
shr rax, 0x34
cmp eax, 0x99a35022
je 0x1400b6c70
mov bl, 1
lea r15, [rbp - 0x10]
lea r8, [rsi + 1]
sub rsp, 0x30
mov qword [rsp + 0x20], 2
mov r9d, 2
mov rcx, r15
mov rdx, r14
call fcn.1400fce40
add rsp, 0x30
test bl, bl
je 0x1400b6c2b
mov rcx, qword [rbp - 8]
mov r15d, 0x986fd7af
xor ebx, ebx
mov r10, rdi
mov rdi, r13
mov r13, qword [rbp - 0x80]
jmp 0x1400b6d43
lea r8, [rsi + 1]
sub rsp, 0x30
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rbp - 0x10]
mov rdx, r14
call fcn.1400fce40
add rsp, 0x30
jmp 0x1400b6c25
or r8d, edx
cmp r8d, 0xffff
jbe 0x1400b6b7c
mov r9d, 0x9c34bc1b
nop
mov eax, dword [0x141dd3270]
imul eax, dword [0x141dd3274]
and eax, 0xc30d396a
imul rax, rax, 0x5b034327
shr rax, 0x3e
cmp eax, 0x73d15853
je 0x1400b6cb0
lea r12d, [r8 + 0xff0000]
shr r12d, 0xa
or r12d, 0xd800
nop word cs:[rax + rax]
mov eax, dword [0x141dd3278]
xor edx, edx
div dword [0x141dd327c]
imul rax, r9
shr rax, 0x3f
imul edx, eax, 0x875a7ed0
mov eax, r8d
and eax, 0x3ff
or eax, 0xdc00
cmp edx, 0x70e67d15
je 0x1400b6cf0
mov rdi, r10
mov r10, r13
cmp r14, qword [rbp - 0x10]
je 0x1400b6b94
nop word cs:[rax + rax]
mov r13d, eax
mov eax, dword [0x141dd3298]
add eax, dword [0x141dd329c]
xor eax, 0x6dd10386
imul rax, rax, 0x2ad4f83b
shr rax, 0x3d
cmp eax, 0x7470d50f
jbe 0x1400b6d80
mov word [rcx + r14*2], r12w
lea rax, [r14 + 1]
mov qword [rbp], rax
nop word cs:[rax + rax]
mov eax, dword [0x141dd32a0]
xor eax, dword [0x141dd32a4]
imul edx, eax, 0xa4a0cd10
and edx, 0x47e2b1a0
lea rax, [r14 + 1]
mov word [rcx + r14*2], r12w
mov qword [rbp], rax
cmp edx, 0x59073fd8
ja 0x1400b6d80
mov r14, rax
test rdi, rdi
jne 0x1400b6910
jmp 0x1400b69d0
mov r13, qword [rbp - 8]
sub rsp, 0x40
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
mov rcx, r13
mov edx, dword [rbp - 0x24]
mov r8d, dword [rbp + 0x18]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
add rsp, 0x40
mov r14, rax
cmp rax, 0xffffffffffffffff
mov r15, qword [rbp - 0x58]
jne 0x1400b6ff0
mov eax, dword [0x141dd32e8]
sub eax, dword [0x141dd32ec]
or eax, 0x50072440
and eax, 0xd2a7256b
xor eax, 0x3714e9db
cmp eax, 0x1e5ef972
jae 0x1400b6e40
sub rsp, 0x20
call rdi
add rsp, 0x20
mov eax, dword [0x141dd32f0]
imul eax, dword [0x141dd32f4]
or eax, 0x1f82255d
imul esi, eax, 0xa0ab208b
and esi, 0x65d51469
sub rsp, 0x20
call rdi
add rsp, 0x20
cmp esi, 0x2a84e777
jb 0x1400b6e40
mov edx, 0x9bce76e1
mov ecx, dword [0x141dd32f8]
sub ecx, dword [0x141dd32fc]
imul rcx, rdx
shr rcx, 0x3b
add ecx, 0x42f79aae
or ecx, 0xbf44d9f
cmp ecx, 0x626c0c38
ja 0x1400b6e75
mov edx, dword [rbp - 0x28]
cmp edx, 0xa
mov r8, qword [rbp - 0x18]
jge 0x1400b706a
nop dword [rax]
mov ecx, dword [0x141dd3378]
and ecx, dword [0x141dd337c]
imul ecx, ecx, 0xe93c268b
xor ecx, 0x2edcb491
cmp ecx, 0xe715efab
ja 0x1400b6eb0
mov ecx, dword [0x141dd3380]
imul ecx, dword [str._He_]
and ecx, 0xa134577
add ecx, 0x2defacb3
and ecx, 0x2b152696
cmp ecx, 0xf40a708f
ja 0x1400b6ed0
cmp eax, 5
jne 0x1400b6f10
mov eax, edx
mov qword [rbp - 0x30], rax
jmp 0x1400b6f70
mov r9d, 0x8d7a6e4f
nop word cs:[rax + rax]
mov ecx, dword [0x141dd33c8]
add ecx, dword [0x141dd33cc]
imul rcx, r9
shr rcx, 0x3c
imul ecx, ecx, 0xb07e45cc
imul rdx, rcx, 0x2892bbcb
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1f
cmp ecx, 0xc56f00d7
je 0x1400b6f20
cmp dword [rbp + 0x18], 0
je 0x1400b706a
mov dword [rbp + 0x18], 0
cmp eax, 0x57
jne 0x1400b706a
xor edi, edi
test rbx, rbx
mov r14, qword [rbp - 0x48]
je 0x1400b62b5
mov eax, dword [0x141dd33b8]
or eax, dword [0x141dd33bc]
xor eax, 0x8c13653d
add eax, 0x51c46e14
and eax, 0xf48c09f9
cmp eax, 0x95d4055b
ja 0x1400b6fdf
nop word cs:[rax + rax]
mov eax, dword [0x141dd33c0]
xor eax, dword [0x141dd33c4]
imul eax, eax, 0x8657d0ac
or eax, 0xd228ba6
imul eax, eax, 0xe9bb38ce
mov rcx, qword [0x141dda6a0]
cmp eax, 0x9332a1ca
jne 0x1400b62a0
mov rax, qword [0x141dda6a0]
jmp 0x1400b6fb0
mov eax, dword [0x141dd32b8]
add eax, dword [str.8USc_]
xor eax, 0x1ddb6bde
add eax, 0xbd07d4ae
cmp eax, 0x15497656
jb 0x1400b6ff0
test rbx, rbx
je 0x1400b70da
mov eax, dword [0x141dd32c0]
xor eax, dword [0x141dd32c4]
or eax, 0x20c00005
and eax, 0x60e04005
cmp eax, 0x255f55df
jbe 0x1400b703a
mov rax, qword [0x141dda6a0]
xor eax, eax
nop dword [rax]
mov rbx, qword [0x141dda6a0]
test al, al
jne 0x1400b7040
mov eax, dword [0x141dd32c8]
and eax, dword [0x141dd32cc]
add eax, 0x5d54959f
and eax, 0x87897da0
cmp eax, 0x2b68add5
jae 0x1400b7086
jmp 0x1400b70c2
xor ecx, ecx
test cl, cl
je 0x1400b74ce
jmp 0x1400b7504
ud2
ud2
mov esi, dword [0x141dd32d0]
and esi, dword [0x141dd32d4]
xor esi, 0x6081ab90
or esi, 0x147e106d
xor esi, 0x723067f1
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp esi, 0xc0552eab
jbe 0x1400b70da
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x1400b7086
mov eax, dword [0x141dd32d8]
xor eax, dword [0x141dd32dc]
or eax, 0xfefffdde
xor eax, 0xea3f097f
cmp eax, 0x47ccc597
mov r8, qword [rbp - 0x38]
ja 0x1400b7127
mov eax, dword [0x141dd32e0]
or eax, dword [0x141dd32e4]
add eax, 0xf0292367
or eax, 0x9b3c7ce5
mov qword [r8 + 0x10], 0
mov dword [r8], 0
cmp eax, 0x4a1bf905
jne 0x1400b7138
mov qword [r8 + 0x10], 0
mov dword [r8], 0
jmp 0x1400b70fb
mov rax, r8
add rax, 0x1c
mov word [rax + 8], 0
mov qword [rax], 0
movzx eax, byte [rbp + 0x1f]
mov byte [r8 + 0x21], al
xor al, 1
mov byte [r8 + 0x20], al
mov dword [r8 + 0x18], 0
mov rax, qword [rbp - 0x40]
mov dword [rax], 0x18
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
mov qword [r8 + 8], rax
sub rsp, 0x20
mov rdi, qword [rbp + 8]
mov rcx, rdi
mov rdx, qword [rbp - 0x50]
call fcn.1400927d0
add rsp, 0x20
mov rcx, rdx
test rax, rax
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
mov r9, qword [rbp + 0x10]
je 0x1400b725b
mov r8, qword [rbp - 0x18]
nop word cs:[rax + rax]
mov eax, dword [0x141dd3330]
and eax, dword [0x141dd3334]
and eax, 0xed51f127
imul eax, eax, 0xe830022e
cmp eax, 0xbfa22f93
je 0x1400b71c0
mov eax, dword [0x141dd3338]
or eax, dword [0x141dd333c]
add eax, 0x661b8222
cmp eax, 0x39402e64
jae 0x1400b7200
mov qword [r8 + 8], rcx
nop word [rax + rax]
mov eax, dword [0x141dd3340]
mov edx, dword [0x141dd3344]
add eax, edx
add eax, 0x58a3f2e1
and eax, 0x53bc98f1
mov qword [r8 + 8], rcx
cmp eax, 0x605222c3
je 0x1400b7200
mov eax, dword [0x141dd3348]
and eax, dword [0x141dd334c]
xor eax, 0xbcf3e1c4
imul rcx, rax, 0x391343ed
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1c
and eax, 6
cmp eax, 0x37a82aa3
jne 0x1400b73b9
jmp 0x1400b73d3
mov eax, dword [0x141dd3300]
or eax, dword [0x141dd3304]
and eax, 0x9d539c6d
xor eax, 0xcaa76f2a
add eax, 0x27839441
cmp eax, 0x7c69d75e
mov r8, qword [rbp - 0x18]
jbe 0x1400b7290
mov qword [r8 + 8], r14
nop word cs:[rax + rax]
mov eax, dword [0x141dd3308]
and eax, dword [0x141dd330c]
imul eax, eax, 0xeb341b25
mov qword [r8 + 8], r14
cmp eax, 0xf8689bd7
je 0x1400b7290
mov eax, dword [0x141dd3310]
xor edx, edx
div dword [0x141dd3314]
mov edx, 0x9817e7cf
imul rdx, rax
shr rdx, 0x3e
imul eax, edx, 0x4d40892f
xor eax, 0x9757e2f3
cmp eax, 0x3c25ee9f
jae 0x1400b72f0
mov qword [r8 + 0x10], rcx
mov qword [r8], 0
nop word cs:[rax + rax]
mov eax, dword [0x141dd3318]
and eax, dword [0x141dd331c]
add eax, 0xdbe29b2b
mov qword [r8 + 0x10], rcx
mov qword [r8], 0
cmp eax, 0x38815de3
jb 0x1400b72f0
test r9, r9
je 0x1400b738f
mov eax, dword [0x141dd3320]
xor edx, edx
div dword [0x141dd3324]
or eax, 0xf1f78f76
mov ecx, 0xd17567bb
imul rcx, rax
shr rcx, 0x3f
or ecx, 0x2d2c0210
cmp ecx, 0xd30d5a48
ja 0x1400b7353
mov rcx, qword [0x141dda6a0]
xor eax, eax
test al, al
je 0x1400b735c
mov rax, qword [0x141dda6a0]
jmp 0x1400b7346
sub rsp, 0x20
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop
mov eax, dword [0x141dd3328]
mov ecx, dword [0x141dd332c]
add eax, ecx
add eax, 0x4a7ce9bc
and eax, 0xcca75275
cmp eax, 0x8e0b2e07
ja 0x1400b7370
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400b73a0
movaps xmm6, xmmword [rbp + 0x20]
lea rsp, [rbp + 0x38]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [0x141dd3350]
add eax, dword [0x141dd3354]
mov qword [r8], 1
cmp eax, 0xcae05c6b
jne 0x1400b73dc
mov qword [r8], 1
jmp 0x1400b73b9
mov r15, r14
nop
mov eax, dword [0x141dd3358]
xor eax, dword [0x141dd335c]
and eax, 0xa2323fd5
imul eax, eax, 0x3bc4d68a
add eax, 0x458a5f7c
cmp eax, 0xaa1b06d1
ja 0x1400b73e0
test r9, r9
je 0x1400b7490
mov rbx, qword [0x141dda6a0]
mov eax, dword [0x141dd3360]
sub eax, dword [0x141dd3364]
add eax, 0x85cf2a3b
or eax, 0x455ebd8
cmp eax, 0x2c248bd8
jae 0x1400b7450
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dd3368]
add eax, dword [0x141dd336c]
xor eax, 0x556f88f2
imul esi, eax, 0x8d6a1c22
add esi, 0x28f5c304
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, rdi
call r12
add rsp, 0x20
cmp esi, 0x4f976dc
jb 0x1400b7450
nop dword [rax + rax]
mov eax, dword [0x141dd3370]
xor eax, dword [0x141dd3374]
imul eax, eax, 0x191bfe10
add eax, 0x826956cc
cmp eax, 0x1a01b498
ja 0x1400b7490
cmp r14, 0xffffffffffffffff
je 0x1400b738f
sub rsp, 0x20
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
jmp 0x1400b738f
mov ecx, dword [0x141dd3388]
xor ecx, dword [0x141dd338c]
xor ecx, 0xb248104
or ecx, 0x70db6efa
mov rdx, rax
shl rdx, 0x20
or rdx, 2
mov qword [r8 + 8], rdx
mov qword [r8], 1
cmp ecx, 0x35c17896
jne 0x1400b751c
mov rcx, rax
shl rcx, 0x20
or rcx, 2
mov qword [r8 + 8], rcx
mov qword [r8], 1
jmp 0x1400b74ce
mov r15, 0xffffffffffffffff
test rbx, rbx
je 0x1400b761a
mov eax, dword [0x141dd3390]
add eax, dword [0x141dd3394]
or eax, 0x3b075440
add eax, 0x760e352e
xor eax, 0xae1cf87
cmp eax, 0xb70cc5bc
jbe 0x1400b7560
mov rax, qword [0x141dda6a0]
nop word cs:[rax + rax]
mov eax, dword [0x141dd3398]
or eax, dword [0x141dd339c]
or eax, 0x9009b6f5
add eax, 0x3ddfc910
imul rax, rax, 0x301e46b3
shr rax, 0x3d
mov rbx, qword [0x141dda6a0]
cmp eax, 0x4d0fee4d
je 0x1400b7560
mov eax, dword [0x141dd33a0]
and eax, dword [0x141dd33a4]
xor eax, 0xd7fd6546
imul eax, eax, 0x5f1d7f50
add eax, 0x48f98160
cmp eax, 0xdcf76086
jbe 0x1400b75c8
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov rdi, qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov esi, dword [0x141dd33a8]
or esi, dword [0x141dd33ac]
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, r13
call rdi
add rsp, 0x20
cmp esi, 0xb204a058
je 0x1400b75d0
nop word cs:[rax + rax]
mov eax, dword [0x141dd33b0]
imul eax, dword [0x141dd33b4]
imul eax, eax, 0x2d8a5018
cmp eax, 0x79ebd7aa
je 0x1400b7600
mov rdi, qword [rbp + 8]
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
mov r9, qword [rbp + 0x10]
jmp 0x1400b73e0