Function at 0x1400587e0
Capabilities:
Check for time delay via gettickcount
Check os version
Encode data using xor
Enumerate processes
Get process image filename

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x898]
sub rsp, 0x970
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401bee90]
xor rax, rsp
mov qword [rbp + 0x860], rax
mov r12, rcx
mov qword [rsp + 0x60], rcx
xor r14d, r14d
mov word [rbp + 0x650], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x652]
call fcn.1400d1cf0
mov qword [r12 + 0x1d8], r14
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x50], r14d
or r15, 0xffffffffffffffff
mov r13d, 0x63
lea ebx, [r13 + 2]
lea edi, [rbx - 0x64]
mov r8d, dword [0x1401c6d80]
nop word [rax + rax]
cmp byte [r12 + 0x121], 0
je 0x1400588b3
mov ebx, dword [r12 + 0x1e8]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, ebx
jb 0x1400588a7
test ebx, ebx
jne 0x140059874
mov r8d, dword [0x1401c6d80]
mov ebx, 0x65
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
cmp ecx, 2
jne 0x140058901
mov eax, 0xbb
mov r8d, 0x45
test r8d, r8d
je 0x1400588f8
mov ecx, r8d
cdq
idiv r8d
mov r8d, edx
mov eax, ecx
test ecx, ecx
jne 0x1400588e3
add eax, r8d
mov dword [0x1401c6d80], eax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140059c1c
mov ecx, dword [0x1401c6d80]
mov r8d, ecx
imul r8d, ecx
imul r8d, ecx
mov eax, 0x38e38e39
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r8d, eax
cmp r8d, 5
jne 0x140058950
dec dword [0x1401c7c88]
xor edx, edx
mov r8d, 0x238
lea rcx, [rbp + 0x50]
call fcn.1400d1cf0
mov dword [rbp + 0x50], 0x238
mov dword [rsp + 0x28], r14d
lea rdx, [rbp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140059b58
mov word [rbp + 0x630], r13w
mov dword [rbp + 0x634], 0x6f0072
mov eax, 0x6d
mov word [rbp + 0x638], ax
mov eax, 0x2e
mov word [rbp + 0x63c], ax
mov word [rbp + 0x644], r14w
mov qword [rbp + 0x2a0], r14
mov qword [rbp + 0x2a8], r14
mov qword [rbp + 0x2a8], 7
mov qword [rbp + 0x2a0], r14
mov word [rbp + 0x290], r14w
cmp word [rbp + 0x7c], 0
jne 0x1400589e8
mov r8, r14
jmp 0x1400589fb
lea rax, [rbp + 0x7c]
mov r8, r15
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1400589f0
lea rdx, [rbp + 0x7c]
lea rcx, [rbp + 0x290]
call fcn.14005d4d0
nop
mov dword [rbp + 0x640], 0x650078
mov word [rbp + 0x63e], bx
mov word [rbp + 0x63a], bx
mov eax, 0x68
mov word [rbp + 0x632], ax
lea rax, [rbp + 0x630]
mov rdx, r15
nop word [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140058a40
lea rax, [rbp + 0x290]
cmp qword [rbp + 0x2a8], 8
cmovae rax, qword [rbp + 0x290]
mov r9, rdx
mov r10, qword [rbp + 0x2a0]
cmp r10, rdx
cmovb r9, r10
test r9, r9
je 0x140058aa4
lea r8, [rbp + 0x630]
nop
movzx ecx, word [r8]
cmp word [rax], cx
jne 0x140058a98
add rax, 2
add r8, 2
dec r9
jne 0x140058a80
jmp 0x140058aa4
mov r9d, edi
cmp word [rax], cx
cmovb r9d, r15d
jmp 0x140058aa7
mov r9d, r14d
movsxd rax, r9d
test r9d, r9d
jne 0x140058aba
cmp r10, rdx
jb 0x140058abe
mov eax, r14d
setne al
test eax, eax
je 0x140058b08
cmp qword [rbp + 0x2a8], 8
jb 0x140058ad4
mov rcx, qword [rbp + 0x290]
call fcn.1400cc890
mov qword [rbp + 0x2a8], 7
mov qword [rbp + 0x2a0], r14
mov word [rbp + 0x290], r14w
lea rdx, [rbp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140058d9e
jmp 0x140058982
cmp dword [r12 + 0x2d8], 1
jne 0x140058b1f
mov dword [r12 + 0x2d8], 2
mov r13d, dword [rbp + 0x70]
mov dword [rsp + 0x28], r13d
mov r8d, r13d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r12 + 0x1d8], rax
test rax, rax
je 0x140058d11
test r13d, r13d
je 0x140058d11
mov r8d, 0x104
lea rdx, [rbp + 0x650]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x1400598f3
cmp word [rbp + 0x650], 0
jne 0x140058b7f
mov r8, r14
jmp 0x140058b9b
lea rax, [rbp + 0x650]
mov r8, r15
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140058b90
lea rdx, [rbp + 0x650]
lea rcx, [rbp + 0x290]
call fcn.14005d4d0
mov r8, qword [rbp + 0x2a0]
add r8, 0xfffffffffffffff6
mov r9, r15
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0x290]
call fcn.14005cf70
mov rcx, rax
lea rax, [rbp + 0x630]
mov rdx, r15
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140058be0
mov r10, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x140058bf8
mov rcx, qword [rcx]
mov r9, rdx
cmp r10, rdx
cmovb r9, r10
test r9, r9
je 0x140058c34
lea r8, [rbp + 0x630]
nop
movzx eax, word [r8]
cmp word [rcx], ax
jne 0x140058c28
add rcx, 2
add r8, 2
dec r9
jne 0x140058c10
jmp 0x140058c34
mov r9d, edi
cmp word [rcx], ax
cmovb r9d, r15d
jmp 0x140058c37
mov r9d, r14d
movsxd rax, r9d
test r9d, r9d
jne 0x140058c52
cmp r10, rdx
jae 0x140058c49
mov eax, r15d
jmp 0x140058c52
mov eax, r14d
cmp r10, rdx
setne al
test eax, eax
setne bl
cmp qword [rbp + 0x328], 8
jb 0x140058c6d
mov rcx, qword [rbp + 0x310]
call fcn.1400cc890
mov qword [rbp + 0x328], 7
mov qword [rbp + 0x320], r14
mov word [rbp + 0x310], r14w
test bl, bl
je 0x140058cf9
mov rcx, qword [r12 + 0x1d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140051600
test al, al
jne 0x140058cb3
mov eax, dword [0x1401c6d80]
test eax, eax
cmove eax, edi
mov dword [0x1401c6d80], eax
mov ebx, dword [rbp + 0x58]
mov dword [rsp + 0x28], ebx
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r12 + 0x1d8], rax
test rax, rax
je 0x1400598b7
mov r8d, 0x104
lea rdx, [rbp + 0x650]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x14005987b
cmp qword [rbp + 0x2a8], 8
jb 0x140058d7a
mov rcx, qword [rbp + 0x290]
call fcn.1400cc890
jmp 0x140058d7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ebx, dword [rbp + 0x58]
mov dword [rsp + 0x28], ebx
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r12 + 0x1d8], rax
test rax, rax
je 0x14005996b
mov r8d, 0x104
lea rdx, [rbp + 0x650]
mov rcx, rax
call qword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x14005992f
cmp qword [rbp + 0x2a8], 8
jb 0x140058d75
mov rcx, qword [rbp + 0x290]
call fcn.1400cc890
mov edi, 1
mov r13d, 0x63
lea ebx, [r13 + 2]
mov word [rbp + 0x290], r14w
mov qword [rbp + 0x2a0], r14
mov qword [rbp + 0x2a8], 7
mov rax, qword [r12 + 0x1d8]
inc rax
test rax, 0xfffffffffffffffe
jne 0x140058dbf
mov ecx, dword [r12 + 0x1e4]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [0x1401c6d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 1
jne 0x140058e14
mov edx, edi
mov eax, edi
mov ecx, 0x39
nop dword [rax + rax]
lea r8d, [rax + rdx]
lea edx, [rax]
mov eax, r8d
dec ecx
jns 0x140058e00
mov dword [0x1401c6d80], r8d
mov rax, qword [r12 + 0x1d8]
dec rax
cmp rax, 0xfffffffffffffffd
mov esi, dword [rsp + 0x38]
ja 0x140058880
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r13d, r14d
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
setb al
test al, al
jne 0x140058f8c
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x140058ea7
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1400024e0
mov rbx, qword [rsp + 0x30]
cmp dword [rbx - 0xc], 0x104
jl 0x1400599e2
mov dword [rbx - 0x10], 0x104
mov word [rbx + 0x208], r14w
mov r9d, 0x104
mov r8, rbx
xor edx, edx
mov rcx, qword [r12 + 0x1d8]
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbx - 0x18]
call fcn.140002540
add rax, 0x18
mov qword [rbp - 0x70], rax
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x48]
call fcn.14004e200
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140058f61
cmp dword [rdi + 0x10], 0
jl 0x140058f52
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140058f52
call fcn.140002540
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140058f47
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x20], rax
jmp 0x140058f61
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.1400023f0
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140058f79
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
mov rbx, qword [rsp + 0x20]
jmp 0x140059187
lea rax, [rbp - 0x38]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x650]
lea rcx, [rbp - 0x38]
call fcn.140002240
nop
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.14004e200
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140059007
cmp dword [rdi + 0x10], 0
jl 0x140058ff8
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140058ff8
call fcn.140002540
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140058fed
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x20], rax
jmp 0x140059007
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.1400023f0
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005901f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
call fcn.140052800
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x140059b4d
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
sub rdx, rbx
nop dword [rax]
movzx eax, word [rcx]
cmp ax, word [rcx + rdx]
jne 0x140059067
add rcx, 2
test ax, ax
jne 0x140059050
mov eax, r14d
jmp 0x14005906c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140059187
mov rdi, qword [rsp + 0x30]
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x1400590a1
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.1400024e0
mov rdi, qword [rsp + 0x30]
cmp dword [rdi - 0xc], 0x104
jl 0x1400599ed
mov dword [rdi - 0x10], 0x104
mov word [rdi + 0x208], r14w
mov r9d, 0x104
mov r8, rdi
xor edx, edx
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsi + 0x1d8]
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x48], rax
lea rcx, [rdi - 0x18]
call fcn.140002540
add rax, 0x18
mov qword [rbp - 0x68], rax
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x58]
call fcn.14004e200
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14005915f
cmp dword [rbx + 0x10], 0
jl 0x140059150
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140059150
call fcn.140002540
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x140059145
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x20], rax
jmp 0x14005915f
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.1400023f0
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140059177
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
mov rbx, qword [rsp + 0x20]
jmp 0x14005918c
mov rsi, qword [rsp + 0x60]
cmp dword [rbx - 0x10], 0
je 0x1400591d5
call fcn.140052800
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x1400599f8
mov rcx, rbx
sub rdx, rbx
movzx eax, word [rcx]
cmp ax, word [rcx + rdx]
jne 0x1400591c8
add rcx, 2
test ax, ax
jne 0x1400591b1
mov eax, r14d
jmp 0x1400591cd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140059a03
mov r8d, r14d
cmp r12d, 0x714
jne 0x140059269
lea rcx, [rbp - 0x50]
call fcn.14004e930
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140059243
cmp dword [rbx + 0x10], 0
jl 0x140059234
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140059234
call fcn.140002540
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x140059229
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x20], rax
jmp 0x140059243
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.1400023f0
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14005925b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rbx, qword [rsp + 0x20]
cmp dword [rbx - 0x10], 0
je 0x1400592b4
call fcn.140052800
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x140059b06
mov rcx, rbx
sub rdx, rbx
nop
movzx eax, word [rcx]
cmp ax, word [rcx + rdx]
jne 0x1400592a7
add rcx, 2
test ax, ax
jne 0x140059290
mov eax, r14d
jmp 0x1400592ac
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140059a03
mov qword [rsi + 0x1d8], r14
mov edx, r8d
lea rcx, [rbp + 0x3b0]
call fcn.140051490
mov rsi, rax
mov edx, r12d
lea rcx, [rbp + 0x370]
call fcn.140051490
mov rdi, rax
mov edx, r13d
lea rcx, [rbp + 0x330]
call fcn.140051490
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x2d0]
call fcn.140051490
nop
lea r8, [0x14014ea84]
mov rdx, rax
lea rcx, [rbp + 0x2f0]
call fcn.140033c80
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x3d0]
call fcn.14005db70
nop
lea r8, [0x14014e87c]
mov rdx, rax
lea rcx, [rbp + 0x350]
call fcn.140033c80
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x390]
call fcn.14005db70
nop
lea r8, [0x14014e854]
mov rdx, rax
lea rcx, [rbp + 0x3f0]
call fcn.140033c80
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.14005db70
nop
cmp qword [rbp + 0x408], 0x10
jb 0x14005939a
mov rcx, qword [rbp + 0x3f0]
call fcn.1400cc890
mov qword [rbp + 0x408], 0xf
mov qword [rbp + 0x400], r14
mov byte [rbp + 0x3f0], 0
cmp qword [rbp + 0x3a8], 0x10
jb 0x1400593c9
mov rcx, qword [rbp + 0x390]
call fcn.1400cc890
mov qword [rbp + 0x3a8], 0xf
mov qword [rbp + 0x3a0], r14
mov byte [rbp + 0x390], 0
cmp qword [rbp + 0x368], 0x10
jb 0x1400593f8
mov rcx, qword [rbp + 0x350]
call fcn.1400cc890
mov qword [rbp + 0x368], 0xf
mov qword [rbp + 0x360], r14
mov byte [rbp + 0x350], 0
cmp qword [rbp + 0x3e8], 0x10
jb 0x140059427
mov rcx, qword [rbp + 0x3d0]
call fcn.1400cc890
mov qword [rbp + 0x3e8], 0xf
mov qword [rbp + 0x3e0], r14
mov byte [rbp + 0x3d0], 0
cmp qword [rbp + 0x308], 0x10
jb 0x140059456
mov rcx, qword [rbp + 0x2f0]
call fcn.1400cc890
mov qword [rbp + 0x308], 0xf
mov qword [rbp + 0x300], r14
mov byte [rbp + 0x2f0], 0
cmp qword [rbp + 0x2e8], 0x10
jb 0x140059485
mov rcx, qword [rbp + 0x2d0]
call fcn.1400cc890
mov qword [rbp + 0x2e8], 0xf
mov qword [rbp + 0x2e0], r14
mov byte [rbp + 0x2d0], 0
cmp qword [rbp + 0x348], 0x10
jb 0x1400594b4
mov rcx, qword [rbp + 0x330]
call fcn.1400cc890
mov qword [rbp + 0x348], 0xf
mov qword [rbp + 0x340], r14
mov byte [rbp + 0x330], 0
cmp qword [rbp + 0x388], 0x10
jb 0x1400594e3
mov rcx, qword [rbp + 0x370]
call fcn.1400cc890
mov qword [rbp + 0x388], 0xf
mov qword [rbp + 0x380], r14
mov byte [rbp + 0x370], 0
cmp qword [rbp + 0x3c8], 0x10
jb 0x140059512
mov rcx, qword [rbp + 0x3b0]
call fcn.1400cc890
mov qword [rbp + 0x3c8], 0xf
mov qword [rbp + 0x3c0], r14
mov byte [rbp + 0x3b0], 0
mov r8d, dword [0x1401c6d80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 0xb
jne 0x140059581
mov ecx, r14d
lea rdx, [rbp + 0x600]
mov eax, dword [rdx]
imul eax, eax, 0xfb
add r8d, eax
inc ecx
lea rdx, [rdx + 4]
movsxd rax, ecx
cmp rax, 0x30
jb 0x140059560
mov dword [0x1401c6d80], r8d
mov esi, dword [rsp + 0x50]
mov eax, esi
inc esi
mov dword [rsp + 0x50], esi
cmp eax, 5
jge 0x140059b11
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0x10
jne 0x14005965c
mov edx, r14d
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, r8d
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r8d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r8d
sar ecx, 1
xor eax, ecx
add r8d, eax
inc edx
cmp edx, 0x100
jl 0x1400595c2
mov dword [0x1401c6d80], r8d
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
cmp ecx, 2
jne 0x14005968e
lea rcx, [rbp + 0x550]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
lea rbx, [rbp + 0x2b0]
cmp qword [rbp + 0x2c8], 0x10
cmovae rbx, qword [rbp + 0x2b0]
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
test rbx, rbx
je 0x1400596ee
test rbx, 0xffffffffffff0000
jne 0x1400596ee
movzx ebx, bx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x1400596fc
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400026e0
jmp 0x1400596fc
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140003550
nop
call fcn.140054cf0
mov rbx, rax
lea rcx, [0x1401be9a8]
mov rdx, qword [0x1401be9a8]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
test rbx, rbx
je 0x14005975c
test rbx, 0xffffffffffff0000
jne 0x14005974d
movzx ebx, bx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x140059770
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400026e0
jmp 0x140059770
mov rax, r15
inc rax
cmp word [rbx + rax*2], 0
jne 0x140059750
jmp 0x14005975f
mov eax, r14d
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.1400023f0
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x60]
call fcn.14000f540
nop
mov r12, qword [rsp + 0x60]
lea rcx, [r12 + 0x1c0]
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
call fcn.140010000
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400597b7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400597d1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400597ea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [r12 + 0x1e4]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp qword [rbp + 0x2c8], 0x10
jb 0x140059816
mov rcx, qword [rbp + 0x2b0]
call fcn.1400cc890
mov qword [rbp + 0x2c8], 0xf
mov qword [rbp + 0x2c0], r14
mov byte [rbp + 0x2b0], 0
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140059849
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jle 0x140059862
mov esi, dword [rsp + 0x38]
jmp 0x140058863
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov esi, dword [rsp + 0x38]
jmp 0x140058863
mov eax, edi
jmp 0x140059cf0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x530]
call fcn.140051490
mov r10, rax
call fcn.140054bd0
mov rdx, rax
mov r8, r10
lea rcx, [rbp + 0x38]
call fcn.140055b20
lea rdx, [0x140189250]
lea rcx, [rbp + 0x38]
call fcn.1400d4788
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x450]
call fcn.140051490
mov rbx, rax
call fcn.1400557e0
mov rdx, rax
mov r8, rbx
lea rcx, [rbp]
call fcn.140055b20
lea rdx, [0x140189250]
lea rcx, [rbp]
call fcn.1400d4788
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x410]
call fcn.140051490
mov rbx, rax
call fcn.1400555a0
mov rdx, rax
mov r8, rbx
lea rcx, [rbp + 0x28]
call fcn.140055b20
lea rdx, [0x140189250]
lea rcx, [rbp + 0x28]
call fcn.1400d4788
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x490]
call fcn.140051490
mov rbx, rax
call fcn.1400538f0
mov rdx, rax
mov r8, rbx
lea rcx, [rbp + 0x18]
call fcn.140055b20
lea rdx, [0x140189250]
lea rcx, [rbp + 0x18]
call fcn.1400d4788
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x4f0]
call fcn.140051490
mov rbx, rax
mov edx, edi
lea rcx, [rbp + 0x4d0]
call fcn.140051490
nop
lea r8, [0x14014ea9c]
mov rdx, rax
lea rcx, [rbp + 0x510]
call fcn.140033c80
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x430]
call fcn.14005db70
mov rbx, rax
call fcn.1400545f0
mov rdx, rax
mov r8, rbx
lea rcx, [rbp - 0x20]
call fcn.140055b20
lea rdx, [0x140189250]
lea rcx, [rbp - 0x20]
call fcn.1400d4788
nop
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80004005
call fcn.140001920
int3
mov rcx, r14
lea rdx, str.0.0.0.0
nop dword [rax]
movzx eax, word [rbx + rcx*2]
inc rcx
cmp ax, word [rdx + rcx*2 - 2]
jne 0x140059a29
cmp rcx, 8
jne 0x140059a10
mov eax, r14d
jmp 0x140059a2e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140059ab6
mov qword [rsi + 0x1d8], r14
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.14001b1b0
nop
mov dl, 0x5c
lea rcx, [rsp + 0x40]
call fcn.14005ce40
mov dl, 0x20
lea rcx, [rsp + 0x40]
call fcn.14005ce40
mov dl, 0x2f
lea rcx, [rsp + 0x40]
call fcn.14005ce40
mov rax, qword [rsp + 0x40]
mov ecx, 1
sub ecx, dword [rax - 8]
or ecx, dword [rax - 0xc]
jge 0x140059a8f
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.14001beb0
call fcn.140054a90
mov rdx, rax
mov r8, qword [rsp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.140055a60
lea rdx, [0x140189250]
lea rcx, [rbp - 0x10]
call fcn.1400d4788
nop
lea rcx, [rsi + 0x190]
lea rdx, [rsp + 0x20]
call fcn.140002360
mov eax, dword [rsp + 0x28]
mov dword [rsi + 0x1d0], eax
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140059ae6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140059aff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140059cf0
mov ecx, 0x80004005
call fcn.140001920
nop
lea r9, [rbp + 0x2b0]
cmp qword [rbp + 0x2c8], 0x10
cmovae r9, qword [rbp + 0x2b0]
call fcn.140054550
mov rdx, rax
mov r8, r9
lea rcx, [rbp - 0x30]
call fcn.140055a60
lea rdx, [0x140189250]
lea rcx, [rbp - 0x30]
call fcn.1400d4788
nop
mov ecx, 0x80004005
call fcn.140001920
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x470]
call fcn.140051490
mov rdi, rax
call fcn.140054310
mov rbx, rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rcx, [0x1401be9a8]
mov rdx, qword [0x1401be9a8]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rax
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x78], rax
test rbx, rbx
je 0x140059bce
inc r15
cmp word [rbx + r15*2], 0
jne 0x140059bc0
mov r14d, r15d
mov r8d, r14d
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.1400023f0
cmp qword [rdi + 0x18], 0x10
jb 0x140059be7
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.140003550
lea r8, [0x140153434]
lea rdx, [0x140153430]
lea rcx, [rbp - 0x80]
call fcn.14000f0e0
nop
lea rdx, [0x140189250]
lea rcx, [rbp - 0x80]
call fcn.1400d4788
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x4b0]
call fcn.140051490
mov rdi, rax
call fcn.1400547c0
mov rbx, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [0x1401be9a8]
mov rdx, qword [0x1401be9a8]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rcx, [0x1401be9a8]
mov rax, qword [0x1401be9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
test rbx, rbx
je 0x140059c9e
nop dword [rax + rax]
inc r15
cmp word [rbx + r15*2], 0
jne 0x140059c90
mov r14d, r15d
mov r8d, r14d
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1400023f0
cmp qword [rdi + 0x18], 0x10
jb 0x140059cb8
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rsp + 0x78]
call fcn.140003550
lea r8, [0x140153434]
lea rdx, [0x140153430]
lea rcx, [rsp + 0x70]
call fcn.14000f0e0
nop
lea rdx, [0x140189250]
lea rcx, [rsp + 0x70]
call fcn.1400d4788
nop
mov rcx, qword [rbp + 0x860]
xor rcx, rsp
call fcn.1400cc8b0
lea r11, [rsp + 0x970]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret