Function at 0x140004bc7
Capabilities:
Check for software breakpoints
Connect to wmi namespace via wbemlocator

Disassembly:
push rbp
push rdi
push rsi
push rbx
mov eax, 0xb548
call fcn.1400ad0a0
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb4f0], rcx
mov qword [rbp + 0xb4f8], rdx
mov dword [rbp + 0xb4bc], 0x735f
mov dword [rbp + 0xb4b8], 0
jmp 0x140004ccd
mov ecx, 0xf854
call fcn.14015cc00
mov qword [rbp + 0x9d50], rax
mov dword [rbp + 0xb4b4], 0
jmp 0x140004ca0
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0xb4b4]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x9d50]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0xc825eb3
shr rdx, 0x20
sar edx, 8
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x1477
sub eax, ecx
mov edx, eax
mov dword [r8], edx
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0xffffffff9a110061
shr rdx, 0x20
add edx, eax
sar edx, 0xd
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x352c
sub eax, ecx
mov edx, eax
add dword [rbp + 0xb4bc], edx
add dword [rbp + 0xb4b4], 1
cmp dword [rbp + 0xb4b4], 0x6f
jle 0x140004c24
mov rax, qword [rbp + 0x9d50]
test rax, rax
je 0x140004cc6
mov edx, 4
mov rcx, rax
call fcn.14015cbf0
add dword [rbp + 0xb4b8], 1
cmp dword [rbp + 0xb4b8], 0x56a
jle 0x140004c07
lea rax, [rbp + 0x3100]
mov rcx, rax
call fcn.140142400
mov dword [rbp + 0x3128], 0
mov dword [rbp + 0x312c], 0
lea rdx, [rbp + 0x3128]
lea rax, [rbp + 0x312c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3120], rax
lea rdx, [rbp + 0x3120]
lea rax, [rbp + 0x3100]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3138], 0xfffffffc
mov dword [rbp + 0x313c], 1
lea rdx, [rbp + 0x3138]
lea rax, [rbp + 0x313c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3130], rax
lea rdx, [rbp + 0x3130]
lea rax, [rbp + 0x3100]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3148], 0xfffffffb
mov dword [rbp + 0x314c], 0xffffffff
lea rdx, [rbp + 0x3148]
lea rax, [rbp + 0x314c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3140], rax
lea rdx, [rbp + 0x3140]
lea rax, [rbp + 0x3100]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3158], 0xfffffffd
mov dword [rbp + 0x315c], 0xfffffffb
lea rdx, [rbp + 0x3158]
lea rax, [rbp + 0x315c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3150], rax
lea rdx, [rbp + 0x3150]
lea rax, [rbp + 0x3100]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3168], 0xffffffff
mov dword [rbp + 0x316c], 0xfffffffd
lea rdx, [rbp + 0x3168]
lea rax, [rbp + 0x316c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3160], rax
lea rdx, [rbp + 0x3160]
lea rax, [rbp + 0x3100]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3178], 0xfffffffd
mov dword [rbp + 0x317c], 0xffffffff
lea rdx, [rbp + 0x3178]
lea rax, [rbp + 0x317c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3170], rax
lea rdx, [rbp + 0x3170]
lea rax, [rbp + 0x3100]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3188], 0xfffffffe
mov dword [rbp + 0x318c], 0xfffffffe
lea rdx, [rbp + 0x3188]
lea rax, [rbp + 0x318c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3180], rax
lea rdx, [rbp + 0x3180]
lea rax, [rbp + 0x3100]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3198], 0xffffffff
mov dword [rbp + 0x319c], 0xffffffff
lea rdx, [rbp + 0x3198]
lea rax, [rbp + 0x319c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3190], rax
lea rdx, [rbp + 0x3190]
lea rax, [rbp + 0x3100]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x31a8], 0xffffffff
mov dword [rbp + 0x31ac], 0xfffffffe
lea rdx, [rbp + 0x31a8]
lea rax, [rbp + 0x31ac]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x31a0], rax
lea rdx, [rbp + 0x31a0]
lea rax, [rbp + 0x3100]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x31b8], 1
mov dword [rbp + 0x31bc], 0xffffffff
lea rdx, [rbp + 0x31b8]
lea rax, [rbp + 0x31bc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x31b0], rax
lea rdx, [rbp + 0x31b0]
lea rax, [rbp + 0x3100]
mov rcx, rax
call fcn.1401421e0
lea rax, [rbp + 0x3100]
mov rcx, rax
call fcn.1400cbf50
mov dword [rbp + 0xac38], eax
lea rax, [rbp + 0x3100]
mov rcx, rax
call fcn.140142130
mov rbx, rax
lea rax, [rbp + 0x3100]
mov rcx, rax
call fcn.1401421b0
mov rdx, rbx
mov rcx, rax
call fcn.140158ca0
lea rdx, [rbp + 0x3100]
lea rax, [rbp + 0x31c0]
mov rcx, rax
call fcn.1401422f0
lea rax, [rbp + 0x30e0]
lea rdx, [rbp + 0x31c0]
mov rcx, rax
call fcn.14000467d
lea rax, [rbp + 0x31c0]
mov rcx, rax
call fcn.140142420
lea rax, [0x1401d1b88]
mov rdx, rax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.14015a590
lea rax, [rbp + 0x30e0]
mov qword [rbp + 0xac30], rax
mov rax, qword [rbp + 0xac30]
mov rcx, rax
call fcn.1401421b0
mov qword [rbp + 0x12c0], rax
mov rax, qword [rbp + 0xac30]
mov rcx, rax
call fcn.140142130
mov qword [rbp + 0x12b8], rax
jmp 0x1400050f6
lea rax, [rbp + 0x12c0]
mov rcx, rax
call fcn.1400c1900
mov rax, qword [rax]
mov qword [rbp + 0x12c8], rax
mov eax, dword [rbp + 0x12c8]
mov edx, eax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.140118c40
mov rcx, rax
lea rax, [0x1401d1b96]
mov rdx, rax
call fcn.14015a590
mov rcx, rax
mov eax, dword [rbp + 0x12cc]
mov edx, eax
call fcn.140118c40
mov rcx, rax
mov rax, qword [0x1401d8680]
mov rdx, rax
call fcn.140118a30
lea rax, [rbp + 0x12c0]
mov rcx, rax
call fcn.1400beba0
lea rdx, [rbp + 0x12b8]
lea rax, [rbp + 0x12c0]
mov rcx, rax
call fcn.1400bff30
test al, al
jne 0x140005083
mov dword [rbp + 0xb4b0], 0x3c8d
mov dword [rbp + 0xb4ac], 0
jmp 0x1400051f6
mov ecx, 0x1f0bc
call fcn.14015cc00
mov qword [rbp + 0x9d58], rax
mov dword [rbp + 0xb4a8], 0
jmp 0x1400051c6
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0xb4a8]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x9d58]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x101316ab
shr rdx, 0x20
sar edx, 9
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x1fda
sub eax, ecx
mov edx, eax
mov dword [r8], edx
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0xffffffff90486c5b
shr rdx, 0x20
add edx, eax
sar edx, 0xd
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x38c7
sub eax, ecx
mov edx, eax
add dword [rbp + 0xb4b0], edx
add dword [rbp + 0xb4a8], 1
cmp dword [rbp + 0xb4a8], 0x1a4
jle 0x14000514a
mov rax, qword [rbp + 0x9d58]
test rax, rax
je 0x1400051ef
mov edx, 4
mov rcx, rax
call fcn.14015cbf0
add dword [rbp + 0xb4ac], 1
cmp dword [rbp + 0xb4ac], 0x606
jle 0x14000512d
lea rax, [rbp + 0x30c0]
mov rcx, rax
call fcn.140142400
mov dword [rbp + 0x31e8], 0
mov dword [rbp + 0x31ec], 0
lea rdx, [rbp + 0x31e8]
lea rax, [rbp + 0x31ec]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x31e0], rax
lea rdx, [rbp + 0x31e0]
lea rax, [rbp + 0x30c0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x31f8], 0xfffffffc
mov dword [rbp + 0x31fc], 1
lea rdx, [rbp + 0x31f8]
lea rax, [rbp + 0x31fc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x31f0], rax
lea rdx, [rbp + 0x31f0]
lea rax, [rbp + 0x30c0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3208], 0xfffffffb
mov dword [rbp + 0x320c], 0xffffffff
lea rdx, [rbp + 0x3208]
lea rax, [rbp + 0x320c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3200], rax
lea rdx, [rbp + 0x3200]
lea rax, [rbp + 0x30c0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3218], 0xfffffffd
mov dword [rbp + 0x321c], 0xfffffffb
lea rdx, [rbp + 0x3218]
lea rax, [rbp + 0x321c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3210], rax
lea rdx, [rbp + 0x3210]
lea rax, [rbp + 0x30c0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3228], 0xffffffff
mov dword [rbp + 0x322c], 0xfffffffd
lea rdx, [rbp + 0x3228]
lea rax, [rbp + 0x322c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3220], rax
lea rdx, [rbp + 0x3220]
lea rax, [rbp + 0x30c0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3238], 0xfffffffd
mov dword [rbp + 0x323c], 0xffffffff
lea rdx, [rbp + 0x3238]
lea rax, [rbp + 0x323c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3230], rax
lea rdx, [rbp + 0x3230]
lea rax, [rbp + 0x30c0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3248], 0xfffffffe
mov dword [rbp + 0x324c], 0xfffffffe
lea rdx, [rbp + 0x3248]
lea rax, [rbp + 0x324c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3240], rax
lea rdx, [rbp + 0x3240]
lea rax, [rbp + 0x30c0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3258], 0xffffffff
mov dword [rbp + 0x325c], 0xffffffff
lea rdx, [rbp + 0x3258]
lea rax, [rbp + 0x325c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3250], rax
lea rdx, [rbp + 0x3250]
lea rax, [rbp + 0x30c0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3268], 0xffffffff
mov dword [rbp + 0x326c], 0xfffffffe
lea rdx, [rbp + 0x3268]
lea rax, [rbp + 0x326c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3260], rax
lea rdx, [rbp + 0x3260]
lea rax, [rbp + 0x30c0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3278], 1
mov dword [rbp + 0x327c], 0xffffffff
lea rdx, [rbp + 0x3278]
lea rax, [rbp + 0x327c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3270], rax
lea rdx, [rbp + 0x3270]
lea rax, [rbp + 0x30c0]
mov rcx, rax
call fcn.1401421e0
lea rax, [rbp + 0x30c0]
mov rcx, rax
call fcn.1400cbf50
mov dword [rbp + 0xac2c], eax
lea rax, [rbp + 0x30c0]
mov rcx, rax
call fcn.140142130
mov rbx, rax
lea rax, [rbp + 0x30c0]
mov rcx, rax
call fcn.1401421b0
mov rdx, rbx
mov rcx, rax
call fcn.140158ca0
lea rdx, [rbp + 0x30c0]
lea rax, [rbp + 0x3280]
mov rcx, rax
call fcn.1401422f0
lea rax, [rbp + 0x30a0]
lea rdx, [rbp + 0x3280]
mov rcx, rax
call fcn.14000467d
lea rax, [rbp + 0x3280]
mov rcx, rax
call fcn.140142420
lea rax, [0x1401d1b88]
mov rdx, rax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.14015a590
lea rax, [rbp + 0x30a0]
mov qword [rbp + 0xac20], rax
mov rax, qword [rbp + 0xac20]
mov rcx, rax
call fcn.1401421b0
mov qword [rbp + 0x12a8], rax
mov rax, qword [rbp + 0xac20]
mov rcx, rax
call fcn.140142130
mov qword [rbp + 0x12a0], rax
jmp 0x14000561f
lea rax, [rbp + 0x12a8]
mov rcx, rax
call fcn.1400c1900
mov rax, qword [rax]
mov qword [rbp + 0x12b0], rax
mov eax, dword [rbp + 0x12b0]
mov edx, eax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.140118c40
mov rcx, rax
lea rax, [0x1401d1b96]
mov rdx, rax
call fcn.14015a590
mov rcx, rax
mov eax, dword [rbp + 0x12b4]
mov edx, eax
call fcn.140118c40
mov rcx, rax
mov rax, qword [0x1401d8680]
mov rdx, rax
call fcn.140118a30
lea rax, [rbp + 0x12a8]
mov rcx, rax
call fcn.1400beba0
lea rdx, [rbp + 0x12a0]
lea rax, [rbp + 0x12a8]
mov rcx, rax
call fcn.1400bff30
test al, al
jne 0x1400055ac
mov dword [rbp + 0xb4a4], 0x131d
mov dword [rbp + 0xb4a0], 0
jmp 0x14000571d
mov ecx, 0x22920
call fcn.14015cc00
mov qword [rbp + 0x9d60], rax
mov dword [rbp + 0xb49c], 0
jmp 0x1400056ed
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0xb49c]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x9d60]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x5dfbd2f
shr rdx, 0x20
sar edx, 8
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x2b95
sub eax, ecx
mov edx, eax
mov dword [r8], edx
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0x4a8eb527
shr rdx, 0x20
sar edx, 0xb
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x1b78
sub eax, ecx
mov edx, eax
add dword [rbp + 0xb4a4], edx
add dword [rbp + 0xb49c], 1
cmp dword [rbp + 0xb49c], 0x1ca
jle 0x140005673
mov rax, qword [rbp + 0x9d60]
test rax, rax
je 0x140005716
mov edx, 4
mov rcx, rax
call fcn.14015cbf0
add dword [rbp + 0xb4a0], 1
cmp dword [rbp + 0xb4a0], 0x53f
jle 0x140005656
lea rax, [rbp + 0x3080]
mov rcx, rax
call fcn.140142400
mov dword [rbp + 0x32a8], 0
mov dword [rbp + 0x32ac], 0
lea rdx, [rbp + 0x32a8]
lea rax, [rbp + 0x32ac]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x32a0], rax
lea rdx, [rbp + 0x32a0]
lea rax, [rbp + 0x3080]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x32b8], 0xfffffffc
mov dword [rbp + 0x32bc], 1
lea rdx, [rbp + 0x32b8]
lea rax, [rbp + 0x32bc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x32b0], rax
lea rdx, [rbp + 0x32b0]
lea rax, [rbp + 0x3080]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x32c8], 0xfffffffb
mov dword [rbp + 0x32cc], 0xffffffff
lea rdx, [rbp + 0x32c8]
lea rax, [rbp + 0x32cc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x32c0], rax
lea rdx, [rbp + 0x32c0]
lea rax, [rbp + 0x3080]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x32d8], 0xfffffffd
mov dword [rbp + 0x32dc], 0xfffffffb
lea rdx, [rbp + 0x32d8]
lea rax, [rbp + 0x32dc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x32d0], rax
lea rdx, [rbp + 0x32d0]
lea rax, [rbp + 0x3080]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x32e8], 0xffffffff
mov dword [rbp + 0x32ec], 0xfffffffd
lea rdx, [rbp + 0x32e8]
lea rax, [rbp + 0x32ec]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x32e0], rax
lea rdx, [rbp + 0x32e0]
lea rax, [rbp + 0x3080]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x32f8], 0xfffffffd
mov dword [rbp + 0x32fc], 0xffffffff
lea rdx, [rbp + 0x32f8]
lea rax, [rbp + 0x32fc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x32f0], rax
lea rdx, [rbp + 0x32f0]
lea rax, [rbp + 0x3080]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3308], 0xfffffffe
mov dword [rbp + 0x330c], 0xfffffffe
lea rdx, [rbp + 0x3308]
lea rax, [rbp + 0x330c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3300], rax
lea rdx, [rbp + 0x3300]
lea rax, [rbp + 0x3080]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3318], 0xffffffff
mov dword [rbp + 0x331c], 0xffffffff
lea rdx, [rbp + 0x3318]
lea rax, [rbp + 0x331c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3310], rax
lea rdx, [rbp + 0x3310]
lea rax, [rbp + 0x3080]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3328], 0xffffffff
mov dword [rbp + 0x332c], 0xfffffffe
lea rdx, [rbp + 0x3328]
lea rax, [rbp + 0x332c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3320], rax
lea rdx, [rbp + 0x3320]
lea rax, [rbp + 0x3080]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3338], 1
mov dword [rbp + 0x333c], 0xffffffff
lea rdx, [rbp + 0x3338]
lea rax, [rbp + 0x333c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3330], rax
lea rdx, [rbp + 0x3330]
lea rax, [rbp + 0x3080]
mov rcx, rax
call fcn.1401421e0
lea rax, [rbp + 0x3080]
mov rcx, rax
call fcn.1400cbf50
mov dword [rbp + 0xac1c], eax
lea rax, [rbp + 0x3080]
mov rcx, rax
call fcn.140142130
mov rbx, rax
lea rax, [rbp + 0x3080]
mov rcx, rax
call fcn.1401421b0
mov rdx, rbx
mov rcx, rax
call fcn.140158ca0
lea rdx, [rbp + 0x3080]
lea rax, [rbp + 0x3340]
mov rcx, rax
call fcn.1401422f0
lea rax, [rbp + 0x3060]
lea rdx, [rbp + 0x3340]
mov rcx, rax
call fcn.14000467d
lea rax, [rbp + 0x3340]
mov rcx, rax
call fcn.140142420
lea rax, [0x1401d1b88]
mov rdx, rax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.14015a590
lea rax, [rbp + 0x3060]
mov qword [rbp + 0xac10], rax
mov rax, qword [rbp + 0xac10]
mov rcx, rax
call fcn.1401421b0
mov qword [rbp + 0x1290], rax
mov rax, qword [rbp + 0xac10]
mov rcx, rax
call fcn.140142130
mov qword [rbp + 0x1288], rax
jmp 0x140005b46
lea rax, [rbp + 0x1290]
mov rcx, rax
call fcn.1400c1900
mov rax, qword [rax]
mov qword [rbp + 0x1298], rax
mov eax, dword [rbp + 0x1298]
mov edx, eax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.140118c40
mov rcx, rax
lea rax, [0x1401d1b96]
mov rdx, rax
call fcn.14015a590
mov rcx, rax
mov eax, dword [rbp + 0x129c]
mov edx, eax
call fcn.140118c40
mov rcx, rax
mov rax, qword [0x1401d8680]
mov rdx, rax
call fcn.140118a30
lea rax, [rbp + 0x1290]
mov rcx, rax
call fcn.1400beba0
lea rdx, [rbp + 0x1288]
lea rax, [rbp + 0x1290]
mov rcx, rax
call fcn.1400bff30
test al, al
jne 0x140005ad3
mov dword [rbp + 0xb498], 0x7245
mov dword [rbp + 0xb494], 0
jmp 0x140005c44
mov ecx, 0x12c98
call fcn.14015cc00
mov qword [rbp + 0x9d68], rax
mov dword [rbp + 0xb490], 0
jmp 0x140005c14
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0xb490]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x9d68]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x36e7af25
shr rdx, 0x20
sar edx, 0xb
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x254d
sub eax, ecx
mov edx, eax
mov dword [r8], edx
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0x55c980df
shr rdx, 0x20
sar edx, 0xc
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x2fbf
sub eax, ecx
mov edx, eax
add dword [rbp + 0xb498], edx
add dword [rbp + 0xb490], 1
cmp dword [rbp + 0xb490], 0x1b7
jle 0x140005b9a
mov rax, qword [rbp + 0x9d68]
test rax, rax
je 0x140005c3d
mov edx, 4
mov rcx, rax
call fcn.14015cbf0
add dword [rbp + 0xb494], 1
cmp dword [rbp + 0xb494], 0x5da
jle 0x140005b7d
lea rax, [rbp + 0x3040]
mov rcx, rax
call fcn.140142400
mov dword [rbp + 0x3368], 0
mov dword [rbp + 0x336c], 0
lea rdx, [rbp + 0x3368]
lea rax, [rbp + 0x336c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3360], rax
lea rdx, [rbp + 0x3360]
lea rax, [rbp + 0x3040]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3378], 0xfffffffc
mov dword [rbp + 0x337c], 1
lea rdx, [rbp + 0x3378]
lea rax, [rbp + 0x337c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3370], rax
lea rdx, [rbp + 0x3370]
lea rax, [rbp + 0x3040]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3388], 0xfffffffb
mov dword [rbp + 0x338c], 0xffffffff
lea rdx, [rbp + 0x3388]
lea rax, [rbp + 0x338c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3380], rax
lea rdx, [rbp + 0x3380]
lea rax, [rbp + 0x3040]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3398], 0xfffffffd
mov dword [rbp + 0x339c], 0xfffffffb
lea rdx, [rbp + 0x3398]
lea rax, [rbp + 0x339c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3390], rax
lea rdx, [rbp + 0x3390]
lea rax, [rbp + 0x3040]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x33a8], 0xffffffff
mov dword [rbp + 0x33ac], 0xfffffffd
lea rdx, [rbp + 0x33a8]
lea rax, [rbp + 0x33ac]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x33a0], rax
lea rdx, [rbp + 0x33a0]
lea rax, [rbp + 0x3040]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x33b8], 0xfffffffd
mov dword [rbp + 0x33bc], 0xffffffff
lea rdx, [rbp + 0x33b8]
lea rax, [rbp + 0x33bc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x33b0], rax
lea rdx, [rbp + 0x33b0]
lea rax, [rbp + 0x3040]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x33c8], 0xfffffffe
mov dword [rbp + 0x33cc], 0xfffffffe
lea rdx, [rbp + 0x33c8]
lea rax, [rbp + 0x33cc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x33c0], rax
lea rdx, [rbp + 0x33c0]
lea rax, [rbp + 0x3040]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x33d8], 0xffffffff
mov dword [rbp + 0x33dc], 0xffffffff
lea rdx, [rbp + 0x33d8]
lea rax, [rbp + 0x33dc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x33d0], rax
lea rdx, [rbp + 0x33d0]
lea rax, [rbp + 0x3040]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x33e8], 0xffffffff
mov dword [rbp + 0x33ec], 0xfffffffe
lea rdx, [rbp + 0x33e8]
lea rax, [rbp + 0x33ec]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x33e0], rax
lea rdx, [rbp + 0x33e0]
lea rax, [rbp + 0x3040]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x33f8], 1
mov dword [rbp + 0x33fc], 0xffffffff
lea rdx, [rbp + 0x33f8]
lea rax, [rbp + 0x33fc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x33f0], rax
lea rdx, [rbp + 0x33f0]
lea rax, [rbp + 0x3040]
mov rcx, rax
call fcn.1401421e0
lea rax, [rbp + 0x3040]
mov rcx, rax
call fcn.1400cbf50
mov dword [rbp + 0xac0c], eax
lea rax, [rbp + 0x3040]
mov rcx, rax
call fcn.140142130
mov rbx, rax
lea rax, [rbp + 0x3040]
mov rcx, rax
call fcn.1401421b0
mov rdx, rbx
mov rcx, rax
call fcn.140158ca0
lea rdx, [rbp + 0x3040]
lea rax, [rbp + 0x3400]
mov rcx, rax
call fcn.1401422f0
lea rax, [rbp + 0x3020]
lea rdx, [rbp + 0x3400]
mov rcx, rax
call fcn.14000467d
lea rax, [rbp + 0x3400]
mov rcx, rax
call fcn.140142420
lea rax, [0x1401d1b88]
mov rdx, rax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.14015a590
lea rax, [rbp + 0x3020]
mov qword [rbp + 0xac00], rax
mov rax, qword [rbp + 0xac00]
mov rcx, rax
call fcn.1401421b0
mov qword [rbp + 0x1278], rax
mov rax, qword [rbp + 0xac00]
mov rcx, rax
call fcn.140142130
mov qword [rbp + 0x1270], rax
jmp 0x14000606d
lea rax, [rbp + 0x1278]
mov rcx, rax
call fcn.1400c1900
mov rax, qword [rax]
mov qword [rbp + 0x1280], rax
mov eax, dword [rbp + 0x1280]
mov edx, eax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.140118c40
mov rcx, rax
lea rax, [0x1401d1b96]
mov rdx, rax
call fcn.14015a590
mov rcx, rax
mov eax, dword [rbp + 0x1284]
mov edx, eax
call fcn.140118c40
mov rcx, rax
mov rax, qword [0x1401d8680]
mov rdx, rax
call fcn.140118a30
lea rax, [rbp + 0x1278]
mov rcx, rax
call fcn.1400beba0
lea rdx, [rbp + 0x1270]
lea rax, [rbp + 0x1278]
mov rcx, rax
call fcn.1400bff30
test al, al
jne 0x140005ffa
mov dword [rbp + 0xb48c], 0x4a6f
mov dword [rbp + 0xb488], 0
jmp 0x14000616d
mov ecx, 0x18c30
call fcn.14015cc00
mov qword [rbp + 0x9d70], rax
mov dword [rbp + 0xb484], 0
jmp 0x14000613d
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0xb484]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x9d70]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x17dd22ef
shr rdx, 0x20
sar edx, 0xa
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x2ae9
sub eax, ecx
mov edx, eax
mov dword [r8], edx
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0xffffffff859c5061
shr rdx, 0x20
add edx, eax
sar edx, 0xc
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x1ea8
sub eax, ecx
mov edx, eax
add dword [rbp + 0xb48c], edx
add dword [rbp + 0xb484], 1
cmp dword [rbp + 0xb484], 0x172
jle 0x1400060c1
mov rax, qword [rbp + 0x9d70]
test rax, rax
je 0x140006166
mov edx, 4
mov rcx, rax
call fcn.14015cbf0
add dword [rbp + 0xb488], 1
cmp dword [rbp + 0xb488], 0x726
jle 0x1400060a4
lea rax, [rbp + 0x3000]
mov rcx, rax
call fcn.140142400
mov dword [rbp + 0x3428], 0
mov dword [rbp + 0x342c], 0
lea rdx, [rbp + 0x3428]
lea rax, [rbp + 0x342c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3420], rax
lea rdx, [rbp + 0x3420]
lea rax, [rbp + 0x3000]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3438], 0xfffffffc
mov dword [rbp + 0x343c], 1
lea rdx, [rbp + 0x3438]
lea rax, [rbp + 0x343c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3430], rax
lea rdx, [rbp + 0x3430]
lea rax, [rbp + 0x3000]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3448], 0xfffffffb
mov dword [rbp + 0x344c], 0xffffffff
lea rdx, [rbp + 0x3448]
lea rax, [rbp + 0x344c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3440], rax
lea rdx, [rbp + 0x3440]
lea rax, [rbp + 0x3000]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3458], 0xfffffffd
mov dword [rbp + 0x345c], 0xfffffffb
lea rdx, [rbp + 0x3458]
lea rax, [rbp + 0x345c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3450], rax
lea rdx, [rbp + 0x3450]
lea rax, [rbp + 0x3000]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3468], 0xffffffff
mov dword [rbp + 0x346c], 0xfffffffd
lea rdx, [rbp + 0x3468]
lea rax, [rbp + 0x346c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3460], rax
lea rdx, [rbp + 0x3460]
lea rax, [rbp + 0x3000]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3478], 0xfffffffd
mov dword [rbp + 0x347c], 0xffffffff
lea rdx, [rbp + 0x3478]
lea rax, [rbp + 0x347c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3470], rax
lea rdx, [rbp + 0x3470]
lea rax, [rbp + 0x3000]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3488], 0xfffffffe
mov dword [rbp + 0x348c], 0xfffffffe
lea rdx, [rbp + 0x3488]
lea rax, [rbp + 0x348c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3480], rax
lea rdx, [rbp + 0x3480]
lea rax, [rbp + 0x3000]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3498], 0xffffffff
mov dword [rbp + 0x349c], 0xffffffff
lea rdx, [rbp + 0x3498]
lea rax, [rbp + 0x349c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3490], rax
lea rdx, [rbp + 0x3490]
lea rax, [rbp + 0x3000]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x34a8], 0xffffffff
mov dword [rbp + 0x34ac], 0xfffffffe
lea rdx, [rbp + 0x34a8]
lea rax, [rbp + 0x34ac]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x34a0], rax
lea rdx, [rbp + 0x34a0]
lea rax, [rbp + 0x3000]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x34b8], 1
mov dword [rbp + 0x34bc], 0xffffffff
lea rdx, [rbp + 0x34b8]
lea rax, [rbp + 0x34bc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x34b0], rax
lea rdx, [rbp + 0x34b0]
lea rax, [rbp + 0x3000]
mov rcx, rax
call fcn.1401421e0
lea rax, [rbp + 0x3000]
mov rcx, rax
call fcn.1400cbf50
mov dword [rbp + 0xabfc], eax
lea rax, [rbp + 0x3000]
mov rcx, rax
call fcn.140142130
mov rbx, rax
lea rax, [rbp + 0x3000]
mov rcx, rax
call fcn.1401421b0
mov rdx, rbx
mov rcx, rax
call fcn.140158ca0
lea rdx, [rbp + 0x3000]
lea rax, [rbp + 0x34c0]
mov rcx, rax
call fcn.1401422f0
lea rax, [rbp + 0x2fe0]
lea rdx, [rbp + 0x34c0]
mov rcx, rax
call fcn.14000467d
lea rax, [rbp + 0x34c0]
mov rcx, rax
call fcn.140142420
lea rax, [0x1401d1b88]
mov rdx, rax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.14015a590
lea rax, [rbp + 0x2fe0]
mov qword [rbp + 0xabf0], rax
mov rax, qword [rbp + 0xabf0]
mov rcx, rax
call fcn.1401421b0
mov qword [rbp + 0x1260], rax
mov rax, qword [rbp + 0xabf0]
mov rcx, rax
call fcn.140142130
mov qword [rbp + 0x1258], rax
jmp 0x140006596
lea rax, [rbp + 0x1260]
mov rcx, rax
call fcn.1400c1900
mov rax, qword [rax]
mov qword [rbp + 0x1268], rax
mov eax, dword [rbp + 0x1268]
mov edx, eax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.140118c40
mov rcx, rax
lea rax, [0x1401d1b96]
mov rdx, rax
call fcn.14015a590
mov rcx, rax
mov eax, dword [rbp + 0x126c]
mov edx, eax
call fcn.140118c40
mov rcx, rax
mov rax, qword [0x1401d8680]
mov rdx, rax
call fcn.140118a30
lea rax, [rbp + 0x1260]
mov rcx, rax
call fcn.1400beba0
lea rdx, [rbp + 0x1258]
lea rax, [rbp + 0x1260]
mov rcx, rax
call fcn.1400bff30
test al, al
jne 0x140006523
mov dword [rbp + 0xb480], 0x45e1
mov dword [rbp + 0xb47c], 0
jmp 0x140006694
mov ecx, 0x19cbc
call fcn.14015cc00
mov qword [rbp + 0x9d78], rax
mov dword [rbp + 0xb478], 0
jmp 0x140006664
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0xb478]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x9d78]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x58ae97bb
shr rdx, 0x20
sar edx, 0xc
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x2e30
sub eax, ecx
mov edx, eax
mov dword [r8], edx
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0x4da3463f
shr rdx, 0x20
sar edx, 0xc
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x34c2
sub eax, ecx
mov edx, eax
add dword [rbp + 0xb480], edx
add dword [rbp + 0xb478], 1
cmp dword [rbp + 0xb478], 0x111
jle 0x1400065ea
mov rax, qword [rbp + 0x9d78]
test rax, rax
je 0x14000668d
mov edx, 4
mov rcx, rax
call fcn.14015cbf0
add dword [rbp + 0xb47c], 1
cmp dword [rbp + 0xb47c], 0x67e
jle 0x1400065cd
lea rax, [rbp + 0x2fc0]
mov rcx, rax
call fcn.140142400
mov dword [rbp + 0x34e8], 0
mov dword [rbp + 0x34ec], 0
lea rdx, [rbp + 0x34e8]
lea rax, [rbp + 0x34ec]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x34e0], rax
lea rdx, [rbp + 0x34e0]
lea rax, [rbp + 0x2fc0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x34f8], 0xfffffffc
mov dword [rbp + 0x34fc], 1
lea rdx, [rbp + 0x34f8]
lea rax, [rbp + 0x34fc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x34f0], rax
lea rdx, [rbp + 0x34f0]
lea rax, [rbp + 0x2fc0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3508], 0xfffffffb
mov dword [rbp + 0x350c], 0xffffffff
lea rdx, [rbp + 0x3508]
lea rax, [rbp + 0x350c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3500], rax
lea rdx, [rbp + 0x3500]
lea rax, [rbp + 0x2fc0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3518], 0xfffffffd
mov dword [rbp + 0x351c], 0xfffffffb
lea rdx, [rbp + 0x3518]
lea rax, [rbp + 0x351c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3510], rax
lea rdx, [rbp + 0x3510]
lea rax, [rbp + 0x2fc0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3528], 0xffffffff
mov dword [rbp + 0x352c], 0xfffffffd
lea rdx, [rbp + 0x3528]
lea rax, [rbp + 0x352c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3520], rax
lea rdx, [rbp + 0x3520]
lea rax, [rbp + 0x2fc0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3538], 0xfffffffd
mov dword [rbp + 0x353c], 0xffffffff
lea rdx, [rbp + 0x3538]
lea rax, [rbp + 0x353c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3530], rax
lea rdx, [rbp + 0x3530]
lea rax, [rbp + 0x2fc0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3548], 0xfffffffe
mov dword [rbp + 0x354c], 0xfffffffe
lea rdx, [rbp + 0x3548]
lea rax, [rbp + 0x354c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3540], rax
lea rdx, [rbp + 0x3540]
lea rax, [rbp + 0x2fc0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3558], 0xffffffff
mov dword [rbp + 0x355c], 0xffffffff
lea rdx, [rbp + 0x3558]
lea rax, [rbp + 0x355c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3550], rax
lea rdx, [rbp + 0x3550]
lea rax, [rbp + 0x2fc0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3568], 0xffffffff
mov dword [rbp + 0x356c], 0xfffffffe
lea rdx, [rbp + 0x3568]
lea rax, [rbp + 0x356c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3560], rax
lea rdx, [rbp + 0x3560]
lea rax, [rbp + 0x2fc0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3578], 1
mov dword [rbp + 0x357c], 0xffffffff
lea rdx, [rbp + 0x3578]
lea rax, [rbp + 0x357c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3570], rax
lea rdx, [rbp + 0x3570]
lea rax, [rbp + 0x2fc0]
mov rcx, rax
call fcn.1401421e0
lea rax, [rbp + 0x2fc0]
mov rcx, rax
call fcn.1400cbf50
mov dword [rbp + 0xabec], eax
lea rax, [rbp + 0x2fc0]
mov rcx, rax
call fcn.140142130
mov rbx, rax
lea rax, [rbp + 0x2fc0]
mov rcx, rax
call fcn.1401421b0
mov rdx, rbx
mov rcx, rax
call fcn.140158ca0
lea rdx, [rbp + 0x2fc0]
lea rax, [rbp + 0x3580]
mov rcx, rax
call fcn.1401422f0
lea rax, [rbp + 0x2fa0]
lea rdx, [rbp + 0x3580]
mov rcx, rax
call fcn.14000467d
lea rax, [rbp + 0x3580]
mov rcx, rax
call fcn.140142420
lea rax, [0x1401d1b88]
mov rdx, rax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.14015a590
lea rax, [rbp + 0x2fa0]
mov qword [rbp + 0xabe0], rax
mov rax, qword [rbp + 0xabe0]
mov rcx, rax
call fcn.1401421b0
mov qword [rbp + 0x1248], rax
mov rax, qword [rbp + 0xabe0]
mov rcx, rax
call fcn.140142130
mov qword [rbp + 0x1240], rax
jmp 0x140006abd
lea rax, [rbp + 0x1248]
mov rcx, rax
call fcn.1400c1900
mov rax, qword [rax]
mov qword [rbp + 0x1250], rax
mov eax, dword [rbp + 0x1250]
mov edx, eax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.140118c40
mov rcx, rax
lea rax, [0x1401d1b96]
mov rdx, rax
call fcn.14015a590
mov rcx, rax
mov eax, dword [rbp + 0x1254]
mov edx, eax
call fcn.140118c40
mov rcx, rax
mov rax, qword [0x1401d8680]
mov rdx, rax
call fcn.140118a30
lea rax, [rbp + 0x1248]
mov rcx, rax
call fcn.1400beba0
lea rdx, [rbp + 0x1240]
lea rax, [rbp + 0x1248]
mov rcx, rax
call fcn.1400bff30
test al, al
jne 0x140006a4a
mov dword [rbp + 0xb474], 0x641e
mov dword [rbp + 0xb470], 0
jmp 0x140006bbd
mov ecx, 0x1a074
call fcn.14015cc00
mov qword [rbp + 0x9d80], rax
mov dword [rbp + 0xb46c], 0
jmp 0x140006b8d
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0xb46c]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x9d80]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x5d83aa11
shr rdx, 0x20
sar edx, 0xc
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x2bcd
sub eax, ecx
mov edx, eax
mov dword [r8], edx
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8e44401f
shr rdx, 0x20
add edx, eax
sar edx, 0xd
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x3995
sub eax, ecx
mov edx, eax
add dword [rbp + 0xb474], edx
add dword [rbp + 0xb46c], 1
cmp dword [rbp + 0xb46c], 0x15c
jle 0x140006b11
mov rax, qword [rbp + 0x9d80]
test rax, rax
je 0x140006bb6
mov edx, 4
mov rcx, rax
call fcn.14015cbf0
add dword [rbp + 0xb470], 1
cmp dword [rbp + 0xb470], 0x53b
jle 0x140006af4
lea rax, [rbp + 0x2f80]
mov rcx, rax
call fcn.140142400
mov dword [rbp + 0x35a8], 0
mov dword [rbp + 0x35ac], 0
lea rdx, [rbp + 0x35a8]
lea rax, [rbp + 0x35ac]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x35a0], rax
lea rdx, [rbp + 0x35a0]
lea rax, [rbp + 0x2f80]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x35b8], 0xfffffffc
mov dword [rbp + 0x35bc], 1
lea rdx, [rbp + 0x35b8]
lea rax, [rbp + 0x35bc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x35b0], rax
lea rdx, [rbp + 0x35b0]
lea rax, [rbp + 0x2f80]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x35c8], 0xfffffffb
mov dword [rbp + 0x35cc], 0xffffffff
lea rdx, [rbp + 0x35c8]
lea rax, [rbp + 0x35cc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x35c0], rax
lea rdx, [rbp + 0x35c0]
lea rax, [rbp + 0x2f80]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x35d8], 0xfffffffd
mov dword [rbp + 0x35dc], 0xfffffffb
lea rdx, [rbp + 0x35d8]
lea rax, [rbp + 0x35dc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x35d0], rax
lea rdx, [rbp + 0x35d0]
lea rax, [rbp + 0x2f80]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x35e8], 0xffffffff
mov dword [rbp + 0x35ec], 0xfffffffd
lea rdx, [rbp + 0x35e8]
lea rax, [rbp + 0x35ec]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x35e0], rax
lea rdx, [rbp + 0x35e0]
lea rax, [rbp + 0x2f80]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x35f8], 0xfffffffd
mov dword [rbp + 0x35fc], 0xffffffff
lea rdx, [rbp + 0x35f8]
lea rax, [rbp + 0x35fc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x35f0], rax
lea rdx, [rbp + 0x35f0]
lea rax, [rbp + 0x2f80]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3608], 0xfffffffe
mov dword [rbp + 0x360c], 0xfffffffe
lea rdx, [rbp + 0x3608]
lea rax, [rbp + 0x360c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3600], rax
lea rdx, [rbp + 0x3600]
lea rax, [rbp + 0x2f80]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3618], 0xffffffff
mov dword [rbp + 0x361c], 0xffffffff
lea rdx, [rbp + 0x3618]
lea rax, [rbp + 0x361c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3610], rax
lea rdx, [rbp + 0x3610]
lea rax, [rbp + 0x2f80]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3628], 0xffffffff
mov dword [rbp + 0x362c], 0xfffffffe
lea rdx, [rbp + 0x3628]
lea rax, [rbp + 0x362c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3620], rax
lea rdx, [rbp + 0x3620]
lea rax, [rbp + 0x2f80]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3638], 1
mov dword [rbp + 0x363c], 0xffffffff
lea rdx, [rbp + 0x3638]
lea rax, [rbp + 0x363c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3630], rax
lea rdx, [rbp + 0x3630]
lea rax, [rbp + 0x2f80]
mov rcx, rax
call fcn.1401421e0
lea rax, [rbp + 0x2f80]
mov rcx, rax
call fcn.1400cbf50
mov dword [rbp + 0xabdc], eax
lea rax, [rbp + 0x2f80]
mov rcx, rax
call fcn.140142130
mov rbx, rax
lea rax, [rbp + 0x2f80]
mov rcx, rax
call fcn.1401421b0
mov rdx, rbx
mov rcx, rax
call fcn.140158ca0
lea rdx, [rbp + 0x2f80]
lea rax, [rbp + 0x3640]
mov rcx, rax
call fcn.1401422f0
lea rax, [rbp + 0x2f60]
lea rdx, [rbp + 0x3640]
mov rcx, rax
call fcn.14000467d
lea rax, [rbp + 0x3640]
mov rcx, rax
call fcn.140142420
lea rax, [0x1401d1b88]
mov rdx, rax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.14015a590
lea rax, [rbp + 0x2f60]
mov qword [rbp + 0xabd0], rax
mov rax, qword [rbp + 0xabd0]
mov rcx, rax
call fcn.1401421b0
mov qword [rbp + 0x1230], rax
mov rax, qword [rbp + 0xabd0]
mov rcx, rax
call fcn.140142130
mov qword [rbp + 0x1228], rax
jmp 0x140006fe6
lea rax, [rbp + 0x1230]
mov rcx, rax
call fcn.1400c1900
mov rax, qword [rax]
mov qword [rbp + 0x1238], rax
mov eax, dword [rbp + 0x1238]
mov edx, eax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.140118c40
mov rcx, rax
lea rax, [0x1401d1b96]
mov rdx, rax
call fcn.14015a590
mov rcx, rax
mov eax, dword [rbp + 0x123c]
mov edx, eax
call fcn.140118c40
mov rcx, rax
mov rax, qword [0x1401d8680]
mov rdx, rax
call fcn.140118a30
lea rax, [rbp + 0x1230]
mov rcx, rax
call fcn.1400beba0
lea rdx, [rbp + 0x1228]
lea rax, [rbp + 0x1230]
mov rcx, rax
call fcn.1400bff30
test al, al
jne 0x140006f73
mov dword [rbp + 0xb468], 0xf52
mov dword [rbp + 0xb464], 0
jmp 0x1400070e6
mov ecx, 0x18218
call fcn.14015cc00
mov qword [rbp + 0x9d88], rax
mov dword [rbp + 0xb460], 0
jmp 0x1400070b6
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0xb460]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x9d88]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x2eb50931
shr rdx, 0x20
sar edx, 0xb
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x2bd9
sub eax, ecx
mov edx, eax
mov dword [r8], edx
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0xffffffff80100201
shr rdx, 0x20
add edx, eax
sar edx, 0xc
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x1ffc
sub eax, ecx
mov edx, eax
add dword [rbp + 0xb468], edx
add dword [rbp + 0xb460], 1
cmp dword [rbp + 0xb460], 0x163
jle 0x14000703a
mov rax, qword [rbp + 0x9d88]
test rax, rax
je 0x1400070df
mov edx, 4
mov rcx, rax
call fcn.14015cbf0
add dword [rbp + 0xb464], 1
cmp dword [rbp + 0xb464], 0x5aa
jle 0x14000701d
lea rax, [rbp + 0x2f40]
mov rcx, rax
call fcn.140142400
mov dword [rbp + 0x3668], 0
mov dword [rbp + 0x366c], 0
lea rdx, [rbp + 0x3668]
lea rax, [rbp + 0x366c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3660], rax
lea rdx, [rbp + 0x3660]
lea rax, [rbp + 0x2f40]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3678], 0xfffffffc
mov dword [rbp + 0x367c], 1
lea rdx, [rbp + 0x3678]
lea rax, [rbp + 0x367c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3670], rax
lea rdx, [rbp + 0x3670]
lea rax, [rbp + 0x2f40]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3688], 0xfffffffb
mov dword [rbp + 0x368c], 0xffffffff
lea rdx, [rbp + 0x3688]
lea rax, [rbp + 0x368c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3680], rax
lea rdx, [rbp + 0x3680]
lea rax, [rbp + 0x2f40]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3698], 0xfffffffd
mov dword [rbp + 0x369c], 0xfffffffb
lea rdx, [rbp + 0x3698]
lea rax, [rbp + 0x369c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3690], rax
lea rdx, [rbp + 0x3690]
lea rax, [rbp + 0x2f40]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x36a8], 0xffffffff
mov dword [rbp + 0x36ac], 0xfffffffd
lea rdx, [rbp + 0x36a8]
lea rax, [rbp + 0x36ac]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x36a0], rax
lea rdx, [rbp + 0x36a0]
lea rax, [rbp + 0x2f40]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x36b8], 0xfffffffd
mov dword [rbp + 0x36bc], 0xffffffff
lea rdx, [rbp + 0x36b8]
lea rax, [rbp + 0x36bc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x36b0], rax
lea rdx, [rbp + 0x36b0]
lea rax, [rbp + 0x2f40]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x36c8], 0xfffffffe
mov dword [rbp + 0x36cc], 0xfffffffe
lea rdx, [rbp + 0x36c8]
lea rax, [rbp + 0x36cc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x36c0], rax
lea rdx, [rbp + 0x36c0]
lea rax, [rbp + 0x2f40]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x36d8], 0xffffffff
mov dword [rbp + 0x36dc], 0xffffffff
lea rdx, [rbp + 0x36d8]
lea rax, [rbp + 0x36dc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x36d0], rax
lea rdx, [rbp + 0x36d0]
lea rax, [rbp + 0x2f40]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x36e8], 0xffffffff
mov dword [rbp + 0x36ec], 0xfffffffe
lea rdx, [rbp + 0x36e8]
lea rax, [rbp + 0x36ec]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x36e0], rax
lea rdx, [rbp + 0x36e0]
lea rax, [rbp + 0x2f40]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x36f8], 1
mov dword [rbp + 0x36fc], 0xffffffff
lea rdx, [rbp + 0x36f8]
lea rax, [rbp + 0x36fc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x36f0], rax
lea rdx, [rbp + 0x36f0]
lea rax, [rbp + 0x2f40]
mov rcx, rax
call fcn.1401421e0
lea rax, [rbp + 0x2f40]
mov rcx, rax
call fcn.1400cbf50
mov dword [rbp + 0xabcc], eax
lea rax, [rbp + 0x2f40]
mov rcx, rax
call fcn.140142130
mov rbx, rax
lea rax, [rbp + 0x2f40]
mov rcx, rax
call fcn.1401421b0
mov rdx, rbx
mov rcx, rax
call fcn.140158ca0
lea rdx, [rbp + 0x2f40]
lea rax, [rbp + 0x3700]
mov rcx, rax
call fcn.1401422f0
lea rax, [rbp + 0x2f20]
lea rdx, [rbp + 0x3700]
mov rcx, rax
call fcn.14000467d
lea rax, [rbp + 0x3700]
mov rcx, rax
call fcn.140142420
lea rax, [0x1401d1b88]
mov rdx, rax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.14015a590
lea rax, [rbp + 0x2f20]
mov qword [rbp + 0xabc0], rax
mov rax, qword [rbp + 0xabc0]
mov rcx, rax
call fcn.1401421b0
mov qword [rbp + 0x1218], rax
mov rax, qword [rbp + 0xabc0]
mov rcx, rax
call fcn.140142130
mov qword [rbp + 0x1210], rax
jmp 0x14000750f
lea rax, [rbp + 0x1218]
mov rcx, rax
call fcn.1400c1900
mov rax, qword [rax]
mov qword [rbp + 0x1220], rax
mov eax, dword [rbp + 0x1220]
mov edx, eax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.140118c40
mov rcx, rax
lea rax, [0x1401d1b96]
mov rdx, rax
call fcn.14015a590
mov rcx, rax
mov eax, dword [rbp + 0x1224]
mov edx, eax
call fcn.140118c40
mov rcx, rax
mov rax, qword [0x1401d8680]
mov rdx, rax
call fcn.140118a30
lea rax, [rbp + 0x1218]
mov rcx, rax
call fcn.1400beba0
lea rdx, [rbp + 0x1210]
lea rax, [rbp + 0x1218]
mov rcx, rax
call fcn.1400bff30
test al, al
jne 0x14000749c
mov dword [rbp + 0xb45c], 0x6286
mov dword [rbp + 0xb458], 0
jmp 0x14000760f
mov ecx, 0x1bc94
call fcn.14015cc00
mov qword [rbp + 0x9d90], rax
mov dword [rbp + 0xb454], 0
jmp 0x1400075df
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0xb454]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x9d90]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x59e60383
shr rdx, 0x20
sar edx, 0xc
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x2d90
sub eax, ecx
mov edx, eax
mov dword [r8], edx
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0xffffffffbb94a76f
shr rdx, 0x20
add edx, eax
sar edx, 0xd
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x2bac
sub eax, ecx
mov edx, eax
add dword [rbp + 0xb45c], edx
add dword [rbp + 0xb454], 1
cmp dword [rbp + 0xb454], 0xc4
jle 0x140007563
mov rax, qword [rbp + 0x9d90]
test rax, rax
je 0x140007608
mov edx, 4
mov rcx, rax
call fcn.14015cbf0
add dword [rbp + 0xb458], 1
cmp dword [rbp + 0xb458], 0x4f1
jle 0x140007546
lea rax, [rbp + 0x2f00]
mov rcx, rax
call fcn.140142400
mov dword [rbp + 0x3728], 0
mov dword [rbp + 0x372c], 0
lea rdx, [rbp + 0x3728]
lea rax, [rbp + 0x372c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3720], rax
lea rdx, [rbp + 0x3720]
lea rax, [rbp + 0x2f00]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3738], 0xfffffffc
mov dword [rbp + 0x373c], 1
lea rdx, [rbp + 0x3738]
lea rax, [rbp + 0x373c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3730], rax
lea rdx, [rbp + 0x3730]
lea rax, [rbp + 0x2f00]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3748], 0xfffffffb
mov dword [rbp + 0x374c], 0xffffffff
lea rdx, [rbp + 0x3748]
lea rax, [rbp + 0x374c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3740], rax
lea rdx, [rbp + 0x3740]
lea rax, [rbp + 0x2f00]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3758], 0xfffffffd
mov dword [rbp + 0x375c], 0xfffffffb
lea rdx, [rbp + 0x3758]
lea rax, [rbp + 0x375c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3750], rax
lea rdx, [rbp + 0x3750]
lea rax, [rbp + 0x2f00]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3768], 0xffffffff
mov dword [rbp + 0x376c], 0xfffffffd
lea rdx, [rbp + 0x3768]
lea rax, [rbp + 0x376c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3760], rax
lea rdx, [rbp + 0x3760]
lea rax, [rbp + 0x2f00]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3778], 0xfffffffd
mov dword [rbp + 0x377c], 0xffffffff
lea rdx, [rbp + 0x3778]
lea rax, [rbp + 0x377c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3770], rax
lea rdx, [rbp + 0x3770]
lea rax, [rbp + 0x2f00]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3788], 0xfffffffe
mov dword [rbp + 0x378c], 0xfffffffe
lea rdx, [rbp + 0x3788]
lea rax, [rbp + 0x378c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3780], rax
lea rdx, [rbp + 0x3780]
lea rax, [rbp + 0x2f00]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3798], 0xffffffff
mov dword [rbp + 0x379c], 0xffffffff
lea rdx, [rbp + 0x3798]
lea rax, [rbp + 0x379c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3790], rax
lea rdx, [rbp + 0x3790]
lea rax, [rbp + 0x2f00]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x37a8], 0xffffffff
mov dword [rbp + 0x37ac], 0xfffffffe
lea rdx, [rbp + 0x37a8]
lea rax, [rbp + 0x37ac]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x37a0], rax
lea rdx, [rbp + 0x37a0]
lea rax, [rbp + 0x2f00]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x37b8], 1
mov dword [rbp + 0x37bc], 0xffffffff
lea rdx, [rbp + 0x37b8]
lea rax, [rbp + 0x37bc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x37b0], rax
lea rdx, [rbp + 0x37b0]
lea rax, [rbp + 0x2f00]
mov rcx, rax
call fcn.1401421e0
lea rax, [rbp + 0x2f00]
mov rcx, rax
call fcn.1400cbf50
mov dword [rbp + 0xabbc], eax
lea rax, [rbp + 0x2f00]
mov rcx, rax
call fcn.140142130
mov rbx, rax
lea rax, [rbp + 0x2f00]
mov rcx, rax
call fcn.1401421b0
mov rdx, rbx
mov rcx, rax
call fcn.140158ca0
lea rdx, [rbp + 0x2f00]
lea rax, [rbp + 0x37c0]
mov rcx, rax
call fcn.1401422f0
lea rax, [rbp + 0x2ee0]
lea rdx, [rbp + 0x37c0]
mov rcx, rax
call fcn.14000467d
lea rax, [rbp + 0x37c0]
mov rcx, rax
call fcn.140142420
lea rax, [0x1401d1b88]
mov rdx, rax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.14015a590
lea rax, [rbp + 0x2ee0]
mov qword [rbp + 0xabb0], rax
mov rax, qword [rbp + 0xabb0]
mov rcx, rax
call fcn.1401421b0
mov qword [rbp + 0x1200], rax
mov rax, qword [rbp + 0xabb0]
mov rcx, rax
call fcn.140142130
mov qword [rbp + 0x11f8], rax
jmp 0x140007a38
lea rax, [rbp + 0x1200]
mov rcx, rax
call fcn.1400c1900
mov rax, qword [rax]
mov qword [rbp + 0x1208], rax
mov eax, dword [rbp + 0x1208]
mov edx, eax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.140118c40
mov rcx, rax
lea rax, [0x1401d1b96]
mov rdx, rax
call fcn.14015a590
mov rcx, rax
mov eax, dword [rbp + 0x120c]
mov edx, eax
call fcn.140118c40
mov rcx, rax
mov rax, qword [0x1401d8680]
mov rdx, rax
call fcn.140118a30
lea rax, [rbp + 0x1200]
mov rcx, rax
call fcn.1400beba0
lea rdx, [rbp + 0x11f8]
lea rax, [rbp + 0x1200]
mov rcx, rax
call fcn.1400bff30
test al, al
jne 0x1400079c5
movss xmm0, dword [0x1401d1c68]
movss dword [rbp + 0xb450], xmm0
movss xmm0, dword [0x1401d1c6c]
movss dword [rbp + 0xb450], xmm0
pxor xmm0, xmm0
cvtss2sd xmm0, dword [rbp + 0xb450]
ucomisd xmm0, qword [0x1401d1c70]
jp 0x140007bb3
ucomisd xmm0, qword [0x1401d1c70]
jne 0x140007bb3
mov dword [rbp + 0xb44c], 0
jmp 0x140007b83
mov ecx, 0x23460
call fcn.14015cc00
mov qword [rbp + 0xaba8], rax
mov dword [rbp + 0xb448], 0
jmp 0x140007b53
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0xb448]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0xaba8]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x758a49a3
shr rdx, 0x20
sar edx, 0xc
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x22d9
sub eax, ecx
mov edx, eax
mov dword [r8], edx
call sub.msvcrt.dll_rand
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
movsd xmm2, qword [0x1401d1c78]
movapd xmm1, xmm0
subsd xmm1, xmm2
pxor xmm0, xmm0
cvtss2sd xmm0, dword [rbp + 0xb450]
addsd xmm0, xmm1
cvtsd2ss xmm0, xmm0
movss dword [rbp + 0xb450], xmm0
add dword [rbp + 0xb448], 1
cmp dword [rbp + 0xb448], 0x236
jle 0x140007acd
mov rax, qword [rbp + 0xaba8]
test rax, rax
je 0x140007b7c
mov edx, 4
mov rcx, rax
call fcn.14015cbf0
add dword [rbp + 0xb44c], 1
cmp dword [rbp + 0xb44c], 0x1180
jle 0x140007aad
movss xmm0, dword [0x1401d1c80]
movss dword [rbp + 0xb450], xmm0
movss xmm0, dword [0x1401d1c84]
movss dword [rbp + 0xb450], xmm0
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.ole32.dll_CoInitializeEx]
call rax
mov dword [rbp + 0xaba4], eax
cmp dword [rbp + 0xaba4], 0
jns 0x140007bdf
mov ebx, 0
jmp 0x1400382a5
mov dword [rbp + 0xb444], 0x16ae
mov dword [rbp + 0xb440], 0
jmp 0x140007cbf
mov ecx, 0xe10c
call fcn.14015cc00
mov qword [rbp + 0x9d98], rax
mov dword [rbp + 0xb43c], 0
jmp 0x140007c8f
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0xb43c]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x9d98]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x61738879
shr rdx, 0x20
sar edx, 0xb
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x1504
sub eax, ecx
mov edx, eax
mov dword [r8], edx
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0x7232f73f
shr rdx, 0x20
sar edx, 0xc
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x23de
sub eax, ecx
mov edx, eax
add dword [rbp + 0xb444], edx
add dword [rbp + 0xb43c], 1
cmp dword [rbp + 0xb43c], 0x132
jle 0x140007c15
mov rax, qword [rbp + 0x9d98]
test rax, rax
je 0x140007cb8
mov edx, 4
mov rcx, rax
call fcn.14015cbf0
add dword [rbp + 0xb440], 1
cmp dword [rbp + 0xb440], 0x6b3
jle 0x140007bf8
lea rax, [rbp + 0x2ec0]
mov rcx, rax
call fcn.140142400
mov dword [rbp + 0x37e8], 0
mov dword [rbp + 0x37ec], 0
lea rdx, [rbp + 0x37e8]
lea rax, [rbp + 0x37ec]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x37e0], rax
lea rdx, [rbp + 0x37e0]
lea rax, [rbp + 0x2ec0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x37f8], 0xfffffffc
mov dword [rbp + 0x37fc], 1
lea rdx, [rbp + 0x37f8]
lea rax, [rbp + 0x37fc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x37f0], rax
lea rdx, [rbp + 0x37f0]
lea rax, [rbp + 0x2ec0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3808], 0xfffffffb
mov dword [rbp + 0x380c], 0xffffffff
lea rdx, [rbp + 0x3808]
lea rax, [rbp + 0x380c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3800], rax
lea rdx, [rbp + 0x3800]
lea rax, [rbp + 0x2ec0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3818], 0xfffffffd
mov dword [rbp + 0x381c], 0xfffffffb
lea rdx, [rbp + 0x3818]
lea rax, [rbp + 0x381c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3810], rax
lea rdx, [rbp + 0x3810]
lea rax, [rbp + 0x2ec0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3828], 0xffffffff
mov dword [rbp + 0x382c], 0xfffffffd
lea rdx, [rbp + 0x3828]
lea rax, [rbp + 0x382c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3820], rax
lea rdx, [rbp + 0x3820]
lea rax, [rbp + 0x2ec0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3838], 0xfffffffd
mov dword [rbp + 0x383c], 0xffffffff
lea rdx, [rbp + 0x3838]
lea rax, [rbp + 0x383c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3830], rax
lea rdx, [rbp + 0x3830]
lea rax, [rbp + 0x2ec0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3848], 0xfffffffe
mov dword [rbp + 0x384c], 0xfffffffe
lea rdx, [rbp + 0x3848]
lea rax, [rbp + 0x384c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3840], rax
lea rdx, [rbp + 0x3840]
lea rax, [rbp + 0x2ec0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3858], 0xffffffff
mov dword [rbp + 0x385c], 0xffffffff
lea rdx, [rbp + 0x3858]
lea rax, [rbp + 0x385c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3850], rax
lea rdx, [rbp + 0x3850]
lea rax, [rbp + 0x2ec0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3868], 0xffffffff
mov dword [rbp + 0x386c], 0xfffffffe
lea rdx, [rbp + 0x3868]
lea rax, [rbp + 0x386c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3860], rax
lea rdx, [rbp + 0x3860]
lea rax, [rbp + 0x2ec0]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3878], 1
mov dword [rbp + 0x387c], 0xffffffff
lea rdx, [rbp + 0x3878]
lea rax, [rbp + 0x387c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3870], rax
lea rdx, [rbp + 0x3870]
lea rax, [rbp + 0x2ec0]
mov rcx, rax
call fcn.1401421e0
lea rax, [rbp + 0x2ec0]
mov rcx, rax
call fcn.1400cbf50
mov dword [rbp + 0xaba0], eax
lea rax, [rbp + 0x2ec0]
mov rcx, rax
call fcn.140142130
mov rbx, rax
lea rax, [rbp + 0x2ec0]
mov rcx, rax
call fcn.1401421b0
mov rdx, rbx
mov rcx, rax
call fcn.140158ca0
lea rdx, [rbp + 0x2ec0]
lea rax, [rbp + 0x3880]
mov rcx, rax
call fcn.1401422f0
lea rax, [rbp + 0x2ea0]
lea rdx, [rbp + 0x3880]
mov rcx, rax
call fcn.14000467d
lea rax, [rbp + 0x3880]
mov rcx, rax
call fcn.140142420
lea rax, [0x1401d1b88]
mov rdx, rax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.14015a590
lea rax, [rbp + 0x2ea0]
mov qword [rbp + 0xab98], rax
mov rax, qword [rbp + 0xab98]
mov rcx, rax
call fcn.1401421b0
mov qword [rbp + 0x11e8], rax
mov rax, qword [rbp + 0xab98]
mov rcx, rax
call fcn.140142130
mov qword [rbp + 0x11e0], rax
jmp 0x1400080e8
lea rax, [rbp + 0x11e8]
mov rcx, rax
call fcn.1400c1900
mov rax, qword [rax]
mov qword [rbp + 0x11f0], rax
mov eax, dword [rbp + 0x11f0]
mov edx, eax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.140118c40
mov rcx, rax
lea rax, [0x1401d1b96]
mov rdx, rax
call fcn.14015a590
mov rcx, rax
mov eax, dword [rbp + 0x11f4]
mov edx, eax
call fcn.140118c40
mov rcx, rax
mov rax, qword [0x1401d8680]
mov rdx, rax
call fcn.140118a30
lea rax, [rbp + 0x11e8]
mov rcx, rax
call fcn.1400beba0
lea rdx, [rbp + 0x11e0]
lea rax, [rbp + 0x11e8]
mov rcx, rax
call fcn.1400bff30
test al, al
jne 0x140008075
mov dword [rbp + 0xb438], 0x6485
mov dword [rbp + 0xb434], 0
jmp 0x1400081e6
mov ecx, 0xdc64
call fcn.14015cc00
mov qword [rbp + 0x9da0], rax
mov dword [rbp + 0xb430], 0
jmp 0x1400081b6
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0xb430]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x9da0]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x2739ba35
shr rdx, 0x20
sar edx, 0xa
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x1a1b
sub eax, ecx
mov edx, eax
mov dword [r8], edx
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0x5fc4e47b
shr rdx, 0x20
sar edx, 0xc
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x2ac5
sub eax, ecx
mov edx, eax
add dword [rbp + 0xb438], edx
add dword [rbp + 0xb430], 1
cmp dword [rbp + 0xb430], 0x12c
jle 0x14000813c
mov rax, qword [rbp + 0x9da0]
test rax, rax
je 0x1400081df
mov edx, 4
mov rcx, rax
call fcn.14015cbf0
add dword [rbp + 0xb434], 1
cmp dword [rbp + 0xb434], 0x6eb
jle 0x14000811f
lea rax, [rbp + 0x2e80]
mov rcx, rax
call fcn.140142400
mov dword [rbp + 0x38a8], 0
mov dword [rbp + 0x38ac], 0
lea rdx, [rbp + 0x38a8]
lea rax, [rbp + 0x38ac]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x38a0], rax
lea rdx, [rbp + 0x38a0]
lea rax, [rbp + 0x2e80]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x38b8], 0xfffffffc
mov dword [rbp + 0x38bc], 1
lea rdx, [rbp + 0x38b8]
lea rax, [rbp + 0x38bc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x38b0], rax
lea rdx, [rbp + 0x38b0]
lea rax, [rbp + 0x2e80]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x38c8], 0xfffffffb
mov dword [rbp + 0x38cc], 0xffffffff
lea rdx, [rbp + 0x38c8]
lea rax, [rbp + 0x38cc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x38c0], rax
lea rdx, [rbp + 0x38c0]
lea rax, [rbp + 0x2e80]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x38d8], 0xfffffffd
mov dword [rbp + 0x38dc], 0xfffffffb
lea rdx, [rbp + 0x38d8]
lea rax, [rbp + 0x38dc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x38d0], rax
lea rdx, [rbp + 0x38d0]
lea rax, [rbp + 0x2e80]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x38e8], 0xffffffff
mov dword [rbp + 0x38ec], 0xfffffffd
lea rdx, [rbp + 0x38e8]
lea rax, [rbp + 0x38ec]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x38e0], rax
lea rdx, [rbp + 0x38e0]
lea rax, [rbp + 0x2e80]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x38f8], 0xfffffffd
mov dword [rbp + 0x38fc], 0xffffffff
lea rdx, [rbp + 0x38f8]
lea rax, [rbp + 0x38fc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x38f0], rax
lea rdx, [rbp + 0x38f0]
lea rax, [rbp + 0x2e80]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3908], 0xfffffffe
mov dword [rbp + 0x390c], 0xfffffffe
lea rdx, [rbp + 0x3908]
lea rax, [rbp + 0x390c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3900], rax
lea rdx, [rbp + 0x3900]
lea rax, [rbp + 0x2e80]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3918], 0xffffffff
mov dword [rbp + 0x391c], 0xffffffff
lea rdx, [rbp + 0x3918]
lea rax, [rbp + 0x391c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3910], rax
lea rdx, [rbp + 0x3910]
lea rax, [rbp + 0x2e80]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3928], 0xffffffff
mov dword [rbp + 0x392c], 0xfffffffe
lea rdx, [rbp + 0x3928]
lea rax, [rbp + 0x392c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3920], rax
lea rdx, [rbp + 0x3920]
lea rax, [rbp + 0x2e80]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3938], 1
mov dword [rbp + 0x393c], 0xffffffff
lea rdx, [rbp + 0x3938]
lea rax, [rbp + 0x393c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3930], rax
lea rdx, [rbp + 0x3930]
lea rax, [rbp + 0x2e80]
mov rcx, rax
call fcn.1401421e0
lea rax, [rbp + 0x2e80]
mov rcx, rax
call fcn.1400cbf50
mov dword [rbp + 0xab94], eax
lea rax, [rbp + 0x2e80]
mov rcx, rax
call fcn.140142130
mov rbx, rax
lea rax, [rbp + 0x2e80]
mov rcx, rax
call fcn.1401421b0
mov rdx, rbx
mov rcx, rax
call fcn.140158ca0
lea rdx, [rbp + 0x2e80]
lea rax, [rbp + 0x3940]
mov rcx, rax
call fcn.1401422f0
lea rax, [rbp + 0x2e60]
lea rdx, [rbp + 0x3940]
mov rcx, rax
call fcn.14000467d
lea rax, [rbp + 0x3940]
mov rcx, rax
call fcn.140142420
lea rax, [0x1401d1b88]
mov rdx, rax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.14015a590
lea rax, [rbp + 0x2e60]
mov qword [rbp + 0xab88], rax
mov rax, qword [rbp + 0xab88]
mov rcx, rax
call fcn.1401421b0
mov qword [rbp + 0x11d0], rax
mov rax, qword [rbp + 0xab88]
mov rcx, rax
call fcn.140142130
mov qword [rbp + 0x11c8], rax
jmp 0x14000860f
lea rax, [rbp + 0x11d0]
mov rcx, rax
call fcn.1400c1900
mov rax, qword [rax]
mov qword [rbp + 0x11d8], rax
mov eax, dword [rbp + 0x11d8]
mov edx, eax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.140118c40
mov rcx, rax
lea rax, [0x1401d1b96]
mov rdx, rax
call fcn.14015a590
mov rcx, rax
mov eax, dword [rbp + 0x11dc]
mov edx, eax
call fcn.140118c40
mov rcx, rax
mov rax, qword [0x1401d8680]
mov rdx, rax
call fcn.140118a30
lea rax, [rbp + 0x11d0]
mov rcx, rax
call fcn.1400beba0
lea rdx, [rbp + 0x11c8]
lea rax, [rbp + 0x11d0]
mov rcx, rax
call fcn.1400bff30
test al, al
jne 0x14000859c
mov dword [rbp + 0xb42c], 0x457d
mov dword [rbp + 0xb428], 0
jmp 0x14000870d
mov ecx, 0x120e0
call fcn.14015cc00
mov qword [rbp + 0x9da8], rax
mov dword [rbp + 0xb424], 0
jmp 0x1400086dd
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0xb424]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x9da8]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x49110005
shr rdx, 0x20
sar edx, 0xc
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x380f
sub eax, ecx
mov edx, eax
mov dword [r8], edx
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0x53e48dfb
shr rdx, 0x20
sar edx, 0xc
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x30d3
sub eax, ecx
mov edx, eax
add dword [rbp + 0xb42c], edx
add dword [rbp + 0xb424], 1
cmp dword [rbp + 0xb424], 0x1b8
jle 0x140008663
mov rax, qword [rbp + 0x9da8]
test rax, rax
je 0x140008706
mov edx, 4
mov rcx, rax
call fcn.14015cbf0
add dword [rbp + 0xb428], 1
cmp dword [rbp + 0xb428], 0x67f
jle 0x140008646
lea rax, [rbp + 0x2e40]
mov rcx, rax
call fcn.140142400
mov dword [rbp + 0x3968], 0
mov dword [rbp + 0x396c], 0
lea rdx, [rbp + 0x3968]
lea rax, [rbp + 0x396c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3960], rax
lea rdx, [rbp + 0x3960]
lea rax, [rbp + 0x2e40]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3978], 0xfffffffc
mov dword [rbp + 0x397c], 1
lea rdx, [rbp + 0x3978]
lea rax, [rbp + 0x397c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3970], rax
lea rdx, [rbp + 0x3970]
lea rax, [rbp + 0x2e40]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3988], 0xfffffffb
mov dword [rbp + 0x398c], 0xffffffff
lea rdx, [rbp + 0x3988]
lea rax, [rbp + 0x398c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3980], rax
lea rdx, [rbp + 0x3980]
lea rax, [rbp + 0x2e40]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3998], 0xfffffffd
mov dword [rbp + 0x399c], 0xfffffffb
lea rdx, [rbp + 0x3998]
lea rax, [rbp + 0x399c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3990], rax
lea rdx, [rbp + 0x3990]
lea rax, [rbp + 0x2e40]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x39a8], 0xffffffff
mov dword [rbp + 0x39ac], 0xfffffffd
lea rdx, [rbp + 0x39a8]
lea rax, [rbp + 0x39ac]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x39a0], rax
lea rdx, [rbp + 0x39a0]
lea rax, [rbp + 0x2e40]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x39b8], 0xfffffffd
mov dword [rbp + 0x39bc], 0xffffffff
lea rdx, [rbp + 0x39b8]
lea rax, [rbp + 0x39bc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x39b0], rax
lea rdx, [rbp + 0x39b0]
lea rax, [rbp + 0x2e40]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x39c8], 0xfffffffe
mov dword [rbp + 0x39cc], 0xfffffffe
lea rdx, [rbp + 0x39c8]
lea rax, [rbp + 0x39cc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x39c0], rax
lea rdx, [rbp + 0x39c0]
lea rax, [rbp + 0x2e40]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x39d8], 0xffffffff
mov dword [rbp + 0x39dc], 0xffffffff
lea rdx, [rbp + 0x39d8]
lea rax, [rbp + 0x39dc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x39d0], rax
lea rdx, [rbp + 0x39d0]
lea rax, [rbp + 0x2e40]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x39e8], 0xffffffff
mov dword [rbp + 0x39ec], 0xfffffffe
lea rdx, [rbp + 0x39e8]
lea rax, [rbp + 0x39ec]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x39e0], rax
lea rdx, [rbp + 0x39e0]
lea rax, [rbp + 0x2e40]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x39f8], 1
mov dword [rbp + 0x39fc], 0xffffffff
lea rdx, [rbp + 0x39f8]
lea rax, [rbp + 0x39fc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x39f0], rax
lea rdx, [rbp + 0x39f0]
lea rax, [rbp + 0x2e40]
mov rcx, rax
call fcn.1401421e0
lea rax, [rbp + 0x2e40]
mov rcx, rax
call fcn.1400cbf50
mov dword [rbp + 0xab84], eax
lea rax, [rbp + 0x2e40]
mov rcx, rax
call fcn.140142130
mov rbx, rax
lea rax, [rbp + 0x2e40]
mov rcx, rax
call fcn.1401421b0
mov rdx, rbx
mov rcx, rax
call fcn.140158ca0
lea rdx, [rbp + 0x2e40]
lea rax, [rbp + 0x3a00]
mov rcx, rax
call fcn.1401422f0
lea rax, [rbp + 0x2e20]
lea rdx, [rbp + 0x3a00]
mov rcx, rax
call fcn.14000467d
lea rax, [rbp + 0x3a00]
mov rcx, rax
call fcn.140142420
lea rax, [0x1401d1b88]
mov rdx, rax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.14015a590
lea rax, [rbp + 0x2e20]
mov qword [rbp + 0xab78], rax
mov rax, qword [rbp + 0xab78]
mov rcx, rax
call fcn.1401421b0
mov qword [rbp + 0x11b8], rax
mov rax, qword [rbp + 0xab78]
mov rcx, rax
call fcn.140142130
mov qword [rbp + 0x11b0], rax
jmp 0x140008b36
lea rax, [rbp + 0x11b8]
mov rcx, rax
call fcn.1400c1900
mov rax, qword [rax]
mov qword [rbp + 0x11c0], rax
mov eax, dword [rbp + 0x11c0]
mov edx, eax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.140118c40
mov rcx, rax
lea rax, [0x1401d1b96]
mov rdx, rax
call fcn.14015a590
mov rcx, rax
mov eax, dword [rbp + 0x11c4]
mov edx, eax
call fcn.140118c40
mov rcx, rax
mov rax, qword [0x1401d8680]
mov rdx, rax
call fcn.140118a30
lea rax, [rbp + 0x11b8]
mov rcx, rax
call fcn.1400beba0
lea rdx, [rbp + 0x11b0]
lea rax, [rbp + 0x11b8]
mov rcx, rax
call fcn.1400bff30
test al, al
jne 0x140008ac3
mov dword [rbp + 0xb420], 0x741d
mov dword [rbp + 0xb41c], 0
jmp 0x140008c34
mov ecx, 0x123b4
call fcn.14015cc00
mov qword [rbp + 0x9db0], rax
mov dword [rbp + 0xb418], 0
jmp 0x140008c04
call sub.msvcrt.dll_rand
mov edx, dword [rbp + 0xb418]
movsxd rdx, edx
lea rcx, [rdx*4]
mov rdx, qword [rbp + 0x9db0]
lea r8, [rcx + rdx]
movsxd rdx, eax
imul rdx, rdx, 0x6ac4cd83
shr rdx, 0x20
sar edx, 0xc
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x265d
sub eax, ecx
mov edx, eax
mov dword [r8], edx
call sub.msvcrt.dll_rand
movsxd rdx, eax
imul rdx, rdx, 0x52f857d5
shr rdx, 0x20
sar edx, 0xb
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x18af
sub eax, ecx
mov edx, eax
add dword [rbp + 0xb420], edx
add dword [rbp + 0xb418], 1
cmp dword [rbp + 0xb418], 0x158
jle 0x140008b8a
mov rax, qword [rbp + 0x9db0]
test rax, rax
je 0x140008c2d
mov edx, 4
mov rcx, rax
call fcn.14015cbf0
add dword [rbp + 0xb41c], 1
cmp dword [rbp + 0xb41c], 0x70a
jle 0x140008b6d
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.140142400
mov dword [rbp + 0x3a28], 0
mov dword [rbp + 0x3a2c], 0
lea rdx, [rbp + 0x3a28]
lea rax, [rbp + 0x3a2c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3a20], rax
lea rdx, [rbp + 0x3a20]
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3a38], 0xfffffffc
mov dword [rbp + 0x3a3c], 1
lea rdx, [rbp + 0x3a38]
lea rax, [rbp + 0x3a3c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3a30], rax
lea rdx, [rbp + 0x3a30]
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3a48], 0xfffffffb
mov dword [rbp + 0x3a4c], 0xffffffff
lea rdx, [rbp + 0x3a48]
lea rax, [rbp + 0x3a4c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3a40], rax
lea rdx, [rbp + 0x3a40]
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3a58], 0xfffffffd
mov dword [rbp + 0x3a5c], 0xfffffffb
lea rdx, [rbp + 0x3a58]
lea rax, [rbp + 0x3a5c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3a50], rax
lea rdx, [rbp + 0x3a50]
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3a68], 0xffffffff
mov dword [rbp + 0x3a6c], 0xfffffffd
lea rdx, [rbp + 0x3a68]
lea rax, [rbp + 0x3a6c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3a60], rax
lea rdx, [rbp + 0x3a60]
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3a78], 0xfffffffd
mov dword [rbp + 0x3a7c], 0xffffffff
lea rdx, [rbp + 0x3a78]
lea rax, [rbp + 0x3a7c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3a70], rax
lea rdx, [rbp + 0x3a70]
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3a88], 0xfffffffe
mov dword [rbp + 0x3a8c], 0xfffffffe
lea rdx, [rbp + 0x3a88]
lea rax, [rbp + 0x3a8c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3a80], rax
lea rdx, [rbp + 0x3a80]
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3a98], 0xffffffff
mov dword [rbp + 0x3a9c], 0xffffffff
lea rdx, [rbp + 0x3a98]
lea rax, [rbp + 0x3a9c]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3a90], rax
lea rdx, [rbp + 0x3a90]
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3aa8], 0xffffffff
mov dword [rbp + 0x3aac], 0xfffffffe
lea rdx, [rbp + 0x3aa8]
lea rax, [rbp + 0x3aac]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3aa0], rax
lea rdx, [rbp + 0x3aa0]
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.1401421e0
mov dword [rbp + 0x3ab8], 1
mov dword [rbp + 0x3abc], 0xffffffff
lea rdx, [rbp + 0x3ab8]
lea rax, [rbp + 0x3abc]
mov rcx, rax
call fcn.1401598d0
mov qword [rbp + 0x3ab0], rax
lea rdx, [rbp + 0x3ab0]
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.1401421e0
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.1400cbf50
mov dword [rbp + 0xab74], eax
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.140142130
mov rbx, rax
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.1401421b0
mov rdx, rbx
mov rcx, rax
call fcn.140158ca0
lea rdx, [rbp + 0x2e00]
lea rax, [rbp + 0x3ac0]
mov rcx, rax
call fcn.1401422f0
lea rax, [rbp + 0x2de0]
lea rdx, [rbp + 0x3ac0]
mov rcx, rax
call fcn.14000467d
lea rax, [rbp + 0x3ac0]
mov rcx, rax
call fcn.140142420
lea rax, [0x1401d1b88]
mov rdx, rax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.14015a590
lea rax, [rbp + 0x2de0]
mov qword [rbp + 0xab68], rax
mov rax, qword [rbp + 0xab68]
mov rcx, rax
call fcn.1401421b0
mov qword [rbp + 0x11a0], rax
mov rax, qword [rbp + 0xab68]
mov rcx, rax
call fcn.140142130
mov qword [rbp + 0x1198], rax
jmp 0x14000905d
lea rax, [rbp + 0x11a0]
mov rcx, rax
call fcn.1400c1900
mov rax, qword [rax]
mov qword [rbp + 0x11a8], rax
mov eax, dword [rbp + 0x11a8]
mov edx, eax
mov rax, qword [0x1401d8670]
mov rcx, rax
call fcn.140118c40
mov rcx, rax
lea rax, [0x1401d1b96]
mov rdx, rax
call fcn.14015a590
mov rcx, rax
mov eax, dword [rbp + 0x11ac]
mov edx, eax
call fcn.140118c40
mov rcx, rax
mov rax, qword [0x1401d8680]
mov rdx, rax
call fcn.140118a30
lea rax, [rbp + 0x11a0]
mov rcx, rax
call fcn.1400beba0
lea rdx, [rbp + 0x1198]
lea rax, [rbp + 0x11a0]
mov rcx, rax
call fcn.1400bff30
test al, al
jne 0x140008fea
mov dword [rbp + 0xb414], 0x426a
lea rax, [rbp + 0x2ee0]
mov rcx, rax
call fcn.140142420
lea rax, [rbp + 0x2f00]
mov rcx, rax
call fcn.140142420
lea rax, [rbp + 0x2f20]
mov rcx, rax
call fcn.140142420
lea rax, [rbp + 0x2f40]
mov rcx, rax
call fcn.140142420
lea rax, [rbp + 0x2f60]
mov rcx, rax
call fcn.140142420
lea rax, [rbp + 0x2f80]
mov rcx, rax
call fcn.140142420
lea rax, [rbp + 0x2fa0]
mov rcx, rax
call fcn.140142420
lea rax, [rbp + 0x2fc0]
mov rcx, rax
call fcn.140142420
lea rax, [rbp + 0x2fe0]
mov rcx, rax
call fcn.140142420
lea rax, [rbp + 0x3000]
mov rcx, rax
call fcn.140142420
lea rax, [rbp + 0x3020]
mov rcx, rax
call fcn.140142420
lea rax, [rbp + 0x3040]
mov rcx, rax
call fcn.140142420
lea rax, [rbp + 0x3060]
mov rcx, rax
call fcn.140142420
lea rax, [rbp + 0x3080]
mov rcx, rax
call fcn.140142420
lea rax, [rbp + 0x30a0]
mov rcx, rax
call fcn.140142420
lea rax, [rbp + 0x30c0]
mov rcx, rax
call fcn.140142420
lea rax, [rbp + 0x30e0]
mov rcx, rax
call fcn.140142420
lea rax, [rbp + 0x3100]
mov rcx, rax
call fcn.140142420
mov eax, ebx
jmp 0x14003a72d
add rsp, 0xb548
pop rbx
pop rsi
pop rdi
pop rbp
ret