Function at 0x1400b39a0
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x808
movaps xmmword [rsp + 0x7f0], xmm9
movaps xmmword [rsp + 0x7e0], xmm8
movaps xmmword [rsp + 0x7d0], xmm7
movaps xmmword [rsp + 0x7c0], xmm6
mov rdi, r8
mov rsi, rdx
mov qword [rsp + 0x88], rcx
movabs rbx, 0x8000000000000000
lea rcx, [rsp + 0x710]
call fcn.14009ef10
lea rdx, [rdi + 0x58]
mov r8, qword [rdi + 8]
mov r9, qword [rdi + 0x10]
mov r10, qword [rsi + 0x28]
mov rax, qword [rdi + 0x40]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xa8], rdi
movups xmm0, xmmword [rdi + 0x30]
movaps xmmword [rsp + 0xb0], xmm0
mov rax, qword [rsi + 0x30]
mov rcx, qword [rax]
mov eax, dword [rax + 8]
movups xmm0, xmmword [rsp + 0x710]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x40], rcx
movups xmmword [rsp + 0x30], xmm0
lea r14, [rsp + 0xb0]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0xa0], r10
mov qword [rsp + 0x20], r10
lea rcx, [rsp + 0x288]
mov qword [rsp + 0x338], rdx
call fcn.14008ea20
movups xmm0, xmmword [rsp + 0x710]
movups xmm1, xmmword [rsp + 0x720]
movaps xmmword [rsp + 0x590], xmm1
movaps xmmword [rsp + 0x580], xmm0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 8
mov qword [rsp + 0x80], 0
lea rbp, [rbx + 1]
lea rbx, [rsp + 0x600]
lea r15, str.cookieTransfer_EncodingchunkedContent_LengthauthorizationAuthorizationBasic
movabs rsi, 0x8080808080808080
lea r12, [0x1401d2089]
mov qword [rsp + 0x340], rbp
jmp 0x1400b3afd
lea rcx, [rsp + 0x470]
call fcn.140090070
mov rcx, r14
lea rdx, [rsp + 0x288]
mov r8b, 1
lea r9, [rsp + 0x580]
call fcn.14008f570
mov rdi, qword [rsp + 0xb0]
mov r8d, 0x108
mov rcx, rbx
lea rdx, [rsp + 0xb8]
call sub.msvcrt.dll_memcpy
cmp rdi, rbp
jne 0x1400b4a1a
mov r8d, 0x108
lea rcx, [rsp + 0x470]
mov rdx, rbx
call sub.msvcrt.dll_memcpy
movzx ebx, word [rsp + 0x570]
lea eax, [rbx - 0x12c]
cmp ax, 0x63
jae 0x1400b4870
mov rax, qword [rsp + 0x320]
mov ecx, dword [rax + 0xc8]
test rcx, rcx
je 0x1400b4870
mov rdi, qword [rsp + 0x80]
lea r13, [rdi + 1]
cmp r13, rcx
jae 0x1400b4a53
mov rcx, qword [rsp + 0x4e8]
mov rdx, qword [rsp + 0x4f0]
mov r9d, 8
lea r8, [0x1401d1dd9]
call fcn.1400b2640
test rax, rax
je 0x1400b4870
mov r9, rdx
mov qword [rsp + 0x450], rax
mov qword [rsp + 0x458], rdx
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xc0], 0
lea rcx, [rsp + 0x2a0]
mov qword [rsp + 0xd0], rcx
lea rcx, [rsp + 0x5a0]
mov rdx, r14
mov r8, rax
call fcn.1400b5670
movabs rax, 0x8000000000000000
cmp qword [rsp + 0x5a0], rax
je 0x1400b4b11
mov rax, qword [rsp + 0x5f0]
mov qword [rsp + 0x430], rax
movups xmm0, xmmword [rsp + 0x5e0]
movaps xmmword [rsp + 0x420], xmm0
movups xmm1, xmmword [rsp + 0x5a0]
movups xmm2, xmmword [rsp + 0x5b0]
movups xmm3, xmmword [rsp + 0x5c0]
movups xmm4, xmmword [rsp + 0x5d0]
movaps xmmword [rsp + 0x230], xmm1
movaps xmmword [rsp + 0x240], xmm2
movaps xmmword [rsp + 0x250], xmm3
movaps xmmword [rsp + 0x260], xmm4
movaps xmmword [rsp + 0x270], xmm0
mov qword [rsp + 0x280], rax
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0x3a0], rax
movaps xmm0, xmmword [rsp + 0x270]
movaps xmmword [rsp + 0x390], xmm0
movaps xmm0, xmmword [rsp + 0x230]
movaps xmm1, xmmword [rsp + 0x240]
movaps xmm2, xmmword [rsp + 0x250]
movaps xmm3, xmmword [rsp + 0x260]
movaps xmmword [rsp + 0x380], xmm3
movaps xmmword [rsp + 0x370], xmm2
movaps xmmword [rsp + 0x360], xmm1
movaps xmmword [rsp + 0x350], xmm0
lea eax, [rbx - 0x12d]
cmp eax, 3
jae 0x1400b3e30
mov rbx, qword [rsp + 0x290]
mov rax, qword [rsp + 0x298]
cmp rax, 4
je 0x1400b3e94
cmp rax, 3
lea rbp, [0x1401d1d8c]
jne 0x1400b3d4e
mov rdx, rax
movzx eax, word [rbx]
xor eax, 0x4547
movzx ecx, byte [rbx + 2]
xor ecx, 0x54
or cx, ax
mov rax, rdx
je 0x1400b3ea7
movzx eax, byte [0x140228121]
mov rax, qword [0x140228110]
test rax, rax
jne 0x1400b3d76
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400b50ef
mov qword [0x140228110], rax
mov r8d, 3
mov rcx, rax
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400b50ef
mov rbx, rax
mov byte [rax + 2], 0x54
mov word [rax], 0x4547
mov al, 1
mov dword [rsp + 0x6c], eax
mov eax, 3
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x348], rbx
mov rax, qword [rsp + 0x320]
cmp byte [rax + 0xce], 0
je 0x1400b414a
cmp byte [rsp + 0x390], 0
mov rcx, qword [rsp + 0x358]
mov rax, qword [rsp + 0x360]
je 0x1400b3e7b
mov edx, dword [rsp + 0x384]
mov ebx, dword [rsp + 0x388]
cmp edx, ebx
ja 0x1400b50ef
test rdx, rdx
je 0x1400b3f2b
cmp rax, rdx
jbe 0x1400b3f25
cmp byte [rcx + rdx], 0xc0
jge 0x1400b3f2b
jmp 0x1400b50ef
cmp ebx, 0x133
je 0x1400b3ee6
cmp ebx, 0x134
jne case.0x1400b3f17.6
mov rax, qword [rsp + 0x298]
mov qword [rsp + 0x58], rax
add rax, 0xfffffffffffffffd
cmp rax, 4
ja case.0x1400b3f17.6
mov rbx, qword [rsp + 0x290]
lea rcx, [0x140190cc0]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
xor r9d, r9d
mov r8d, dword [rsp + 0x37c]
test r8, r8
jne 0x1400b3f5a
jmp 0x1400b3fa0
cmp dword [rbx], 0x44414548
lea rbp, [0x1401d1d8c]
jne 0x1400b3d4e
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x288]
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x6c], 0
mov qword [rsp + 0x348], rbx
mov rax, qword [rsp + 0x320]
cmp byte [rax + 0xce], 0
jne 0x1400b3dd0
jmp 0x1400b414a
mov rax, qword [rsp + 0x298]
mov qword [rsp + 0x58], rax
add rax, 0xfffffffffffffffd
cmp rax, 4
ja case.0x1400b3f17.6
mov rbx, qword [rsp + 0x290]
lea rcx, [0x140190cd4]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
lea rcx, str.GETDecoderErrorStatus
jmp 0x1400b40f9
jne 0x1400b50ef
test rbx, rbx
je 0x1400b3f46
cmp rax, rbx
jbe 0x1400b3f40
cmp byte [rcx + rbx], 0xbf
jg 0x1400b3f46
jmp 0x1400b50ef
jne 0x1400b50ef
lea r9, [rcx + rdx]
sub rbx, rdx
mov r8d, dword [rsp + 0x37c]
test r8, r8
je 0x1400b3fa0
cmp rax, r8
jbe 0x1400b3f6b
cmp byte [rcx + r8], 0xbf
jg 0x1400b3f71
jmp 0x1400b50ef
jne 0x1400b50ef
cmp r8d, 5
jne 0x1400b3fa0
lea rdx, [0x1401e6f8c]
mov r14, r9
call sub.msvcrt.dll_memcmp
mov r9, r14
test eax, eax
sete r10b
jmp 0x1400b3fa3
xor r10d, r10d
cmp byte [rsp + 0x2e0], 0
mov rcx, qword [rsp + 0x2a8]
mov rax, qword [rsp + 0x2b0]
mov qword [rsp + 0x90], r13
je 0x1400b3ff2
mov edx, dword [rsp + 0x2d4]
mov r12d, dword [rsp + 0x2d8]
cmp edx, r12d
ja 0x1400b50ef
test rdx, rdx
je 0x1400b400a
cmp rax, rdx
jbe 0x1400b4004
cmp byte [rcx + rdx], 0xc0
jge 0x1400b400a
jmp 0x1400b50ef
xor r13d, r13d
mov r8d, dword [rsp + 0x2cc]
test r8, r8
jne 0x1400b403a
jmp 0x1400b4080
jne 0x1400b50ef
test r12, r12
je 0x1400b4026
cmp rax, r12
jbe 0x1400b4020
cmp byte [rcx + r12], 0xbf
jg 0x1400b4026
jmp 0x1400b50ef
jne 0x1400b50ef
lea r13, [rcx + rdx]
sub r12, rdx
mov r8d, dword [rsp + 0x2cc]
test r8, r8
je 0x1400b4080
cmp rax, r8
jbe 0x1400b404b
cmp byte [rcx + r8], 0xbf
jg 0x1400b4051
jmp 0x1400b50ef
jne 0x1400b50ef
cmp r8d, 5
jne 0x1400b4080
lea rdx, [0x1401e6f8c]
mov qword [rsp + 0x60], r9
mov r14d, r10d
call sub.msvcrt.dll_memcmp
mov r10d, r14d
mov r9, qword [rsp + 0x60]
test eax, eax
sete r14b
jmp 0x1400b4083
xor r14d, r14d
mov rax, r9
or rax, r13
sete al
test r9, r9
je 0x1400b40b8
test r13, r13
je 0x1400b40b8
cmp rbx, r12
jne 0x1400b40b6
mov rcx, r9
mov rdx, r13
mov r8, rbx
mov ebx, r10d
call sub.msvcrt.dll_memcmp
mov r10d, ebx
test eax, eax
sete al
jmp 0x1400b40b8
xor eax, eax
xor r14b, 1
or r14b, r10b
and r14b, al
mov dword [rsp + 0x60], r14d
lea r14, [rsp + 0xb0]
lea r12, [0x1401d2089]
mov r13, qword [rsp + 0x90]
jmp 0x1400b4152
lea rcx, [0x1401d1dc6]
jmp 0x1400b40f9
lea rcx, [0x1401d1dd4]
jmp 0x1400b40f9
lea rcx, [0x1401d1dca]
mov rdx, rbx
mov r8, qword [rsp + 0x58]
call sub.msvcrt.dll_memcmp
test eax, eax
jne case.0x1400b3f17.6
mov rax, qword [rsp + 0x288]
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x6c], 0
lea rbp, [0x1401d1d8c]
mov qword [rsp + 0x348], rbx
mov rax, qword [rsp + 0x320]
cmp byte [rax + 0xce], 0
jne 0x1400b3dd0
mov dword [rsp + 0x60], 0
lea rcx, [rsp + 0x2a0]
mov rax, qword [rcx + 0x50]
mov qword [rsp + 0x100], rax
movups xmm0, xmmword [rcx + 0x40]
movaps xmmword [rsp + 0xf0], xmm0
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmm2, xmmword [rcx + 0x20]
movups xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0xe0], xmm3
movaps xmmword [rsp + 0xd0], xmm2
movaps xmmword [rsp + 0xc0], xmm1
movaps xmmword [rsp + 0xb0], xmm0
cmp rdi, qword [rsp + 0x70]
jne 0x1400b41c1
lea rcx, [rsp + 0x70]
mov rdx, rdi
call fcn.1400936c0
mov rdi, qword [rsp + 0x80]
lea r13, [rdi + 1]
mov rax, qword [rsp + 0x78]
imul rcx, rdi, 0x58
mov rdx, qword [rsp + 0x100]
mov qword [rax + rcx + 0x50], rdx
movaps xmm0, xmmword [rsp + 0xf0]
movups xmmword [rax + rcx + 0x40], xmm0
movaps xmm0, xmmword [rsp + 0xb0]
movaps xmm1, xmmword [rsp + 0xc0]
movaps xmm2, xmmword [rsp + 0xd0]
movaps xmm3, xmmword [rsp + 0xe0]
movups xmmword [rax + rcx + 0x30], xmm3
movups xmmword [rax + rcx + 0x20], xmm2
movups xmmword [rax + rcx + 0x10], xmm1
movups xmmword [rax + rcx], xmm0
mov qword [rsp + 0x80], r13
movabs rax, 0x8000000000000000
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x580]
mov rdx, r14
call fcn.14009ef10
mov rax, qword [rsp + 0x2f8]
mov qword [rsp + 0x90], rax
mov r14, qword [rsp + 0x300]
mov r13, qword [rsp + 0x308]
test r13, r13
je 0x1400b4300
mov rdi, r14
xor ebx, ebx
nop
mov r8d, 0xe
mov rcx, rdi
mov rdx, r12
call fcn.1400b2550
test al, al
jne 0x1400b42d0
mov r8d, 6
mov rcx, rdi
mov rdx, r15
call fcn.1400b2550
test al, al
jne 0x1400b42d0
mov r8d, 0xd
mov rcx, rdi
mov rdx, rbp
call fcn.1400b2550
xor al, 1
or al, byte [rsp + 0x60]
je 0x1400b42d0
inc rbx
add rdi, 0x20
cmp r13, rbx
jne 0x1400b4270
xor r12d, r12d
jmp 0x1400b471d
inc rbx
mov r12d, 1
cmp qword [rdi], 0
je 0x1400b432f
mov r8, qword [rdi + 8]
mov rcx, qword [0x140228110]
xor edx, edx
call sub.kernel32.dll_HeapFree
cmp rbx, r13
jne 0x1400b4338
jmp 0x1400b471d
xor ebx, ebx
xor r12d, r12d
cmp rbx, r13
jne 0x1400b4338
jmp 0x1400b471d
mov rax, rbx
sub rax, r12
shl rax, 5
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [r14 + rax + 0x10], xmm1
movups xmmword [r14 + rax], xmm0
inc rbx
cmp rbx, r13
je 0x1400b471d
mov rdi, rbx
shl rdi, 5
mov rcx, qword [r14 + rdi + 0x18]
cmp rcx, qword [r14 + rdi + 0x10]
ja 0x1400b50ef
add rdi, r14
mov rax, rcx
sub rax, 0xf
mov edx, 0
cmovae rdx, rax
test rcx, rcx
je 0x1400b46c0
mov rax, qword [rdi + 8]
lea r8, [rax + 7]
and r8, 0xfffffffffffffff8
sub r8, rax
xor r9d, r9d
jmp 0x1400b438c
inc r9
cmp r9, rcx
jae 0x1400b4550
movzx r10d, byte [rax + r9]
test r10b, r10b
js 0x1400b43f0
mov r10d, r8d
sub r10d, r9d
test r10b, 7
jne 0x1400b4380
jmp 0x1400b43b4
add r9, 0x10
cmp r9, rdx
jae 0x1400b43c7
mov r10, qword [rax + r9 + 8]
or r10, qword [rax + r9]
test r10, rsi
je 0x1400b43b0
cmp r9, rcx
jae 0x1400b4383
nop dword [rax]
cmp byte [rax + r9], 0
js 0x1400b4383
inc r9
cmp rcx, r9
jne 0x1400b43d0
jmp 0x1400b4550
lea r11, [0x1401ae6d8]
movzx r11d, byte [r10 + r11]
cmp r11d, 4
je 0x1400b441a
cmp r11d, 3
je 0x1400b4449
cmp r11d, 2
jne 0x1400b50ef
inc r9
jmp 0x1400b452f
lea r11, [r9 + 1]
cmp r11, rcx
jae 0x1400b50ef
movzx r11d, byte [rax + r11]
cmp r10, 0xf0
je 0x1400b447c
cmp r10d, 0xf4
jne 0x1400b448b
cmp r11b, 0x8f
jle 0x1400b44a3
jmp 0x1400b50ef
lea r11, [r9 + 1]
cmp r11, rcx
jae 0x1400b50ef
movzx r11d, byte [rax + r11]
cmp r10, 0xe0
je 0x1400b44d8
cmp r10d, 0xed
jne 0x1400b44e7
cmp r11b, 0x9f
jle 0x1400b452b
jmp 0x1400b50ef
add r11b, 0x70
cmp r11b, 0x30
jb 0x1400b44a3
jmp 0x1400b50ef
add r10b, 0xf
cmp r10b, 2
ja 0x1400b50ef
cmp r11b, 0xc0
jge 0x1400b50ef
lea r10, [r9 + 2]
cmp r10, rcx
jae 0x1400b50ef
cmp byte [rax + r10], 0xbf
jg 0x1400b50ef
add r9, 3
cmp r9, rcx
jae 0x1400b50ef
cmp byte [rax + r9], 0xc0
jl 0x1400b4380
jmp 0x1400b50ef
and r11b, 0xe0
cmp r11b, 0xa0
je 0x1400b452b
jmp 0x1400b50ef
mov rbp, r15
lea r15d, [r10 + 0x1f]
cmp r15b, 0xc
jae 0x1400b4509
cmp r11b, 0xc0
mov r15, rbp
lea rbp, [0x1401d1d8c]
jl 0x1400b452b
jmp 0x1400b50ef
and r10b, 0xfe
cmp r10b, 0xee
mov r15, rbp
lea rbp, [0x1401d1d8c]
jne 0x1400b50ef
cmp r11b, 0xc0
jge 0x1400b50ef
add r9, 2
cmp r9, rcx
jae 0x1400b50ef
cmp byte [rax + r9], 0xbf
jle 0x1400b4380
jmp 0x1400b50ef
cmp rcx, 0xe
jne 0x1400b46c0
movzx ecx, byte [rax]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x63
jne 0x1400b46c0
movzx ecx, byte [rax + 1]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x6f
jne 0x1400b46c0
movzx ecx, byte [rax + 2]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x6e
jne 0x1400b46c0
movzx ecx, byte [rax + 3]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x74
jne 0x1400b46c0
movzx ecx, byte [rax + 4]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x65
jne 0x1400b46c0
movzx ecx, byte [rax + 5]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x6e
jne 0x1400b46c0
movzx ecx, byte [rax + 6]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x74
jne 0x1400b46c0
movzx ecx, byte [rax + 7]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x2d
jne 0x1400b46c0
movzx ecx, byte [rax + 8]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x6c
jne 0x1400b46c0
movzx ecx, byte [rax + 9]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x65
jne 0x1400b46c0
movzx ecx, byte [rax + 0xa]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x6e
jne 0x1400b46c0
movzx ecx, byte [rax + 0xb]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x67
jne 0x1400b46c0
movzx ecx, byte [rax + 0xc]
lea edx, [rcx - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, cl
cmp dl, 0x74
jne 0x1400b46c0
movzx eax, byte [rax + 0xd]
lea ecx, [rax - 0x41]
cmp cl, 0x1a
setb cl
shl cl, 5
or cl, al
cmp cl, 0x68
je 0x1400b46f2
nop dword [rax + rax]
mov r8d, 6
mov rcx, rdi
mov rdx, r15
call fcn.1400b2550
test al, al
jne 0x1400b46f2
mov r8d, 0xd
mov rcx, rdi
mov rdx, rbp
call fcn.1400b2550
xor al, 1
or al, byte [rsp + 0x60]
jne 0x1400b4310
inc r12
cmp qword [rdi], 0
je 0x1400b432c
mov r8, qword [rdi + 8]
mov rcx, qword [0x140228110]
xor edx, edx
call sub.kernel32.dll_HeapFree
inc rbx
cmp rbx, r13
jne 0x1400b4338
sub r13, r12
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x600], rax
mov qword [rsp + 0x608], r14
mov qword [rsp + 0x610], r13
mov rax, qword [rsp + 0x310]
mov ecx, dword [rsp + 0x318]
movaps xmm0, xmmword [rsp + 0x580]
mov dword [rsp + 0x48], ecx
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
lea rbx, [rsp + 0x600]
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x350]
mov qword [rsp + 0x20], rax
lea r14, [rsp + 0xb0]
mov rcx, r14
lea rdx, [rsp + 0x320]
mov rdi, qword [rsp + 0x348]
mov r8, rdi
mov r9, qword [rsp + 0x58]
call fcn.14008ea20
mov rax, qword [rsp + 0x320]
lock dec qword [rax]
jne 0x1400b47c2
lea rcx, [rsp + 0x320]
call fcn.1400a8160
mov rax, qword [rsp + 0x328]
lock dec qword [rax]
mov rbp, qword [rsp + 0x340]
lea r12, [0x1401d2089]
jne 0x1400b47ec
lea rcx, [rsp + 0x328]
call fcn.1400a7d50
cmp byte [rsp + 0x6c], 0
je 0x1400b4814
cmp qword [rsp + 0x288], 0
je 0x1400b4814
mov r8, qword [rsp + 0x290]
mov rcx, qword [0x140228110]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov r8d, 0xb0
lea rcx, [rsp + 0x288]
mov rdx, r14
call sub.msvcrt.dll_memcpy
cmp qword [rsp + 0x98], 0
je 0x1400b4846
mov rcx, qword [0x140228110]
xor edx, edx
mov r8, rdi
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0x350], 0
je 0x1400b3af0
mov r8, qword [rsp + 0x358]
mov rcx, qword [0x140228110]
xor edx, edx
call sub.kernel32.dll_HeapFree
jmp 0x1400b3af0
lea rcx, [rsp + 0x730]
lea rdx, [rsp + 0x470]
mov r8d, 0x88
call sub.msvcrt.dll_memcpy
mov rdi, qword [rsp + 0x4f8]
mov rsi, qword [rsp + 0x500]
mov rbx, qword [rsp + 0x508]
movups xmm0, xmmword [rsp + 0x510]
movaps xmmword [rsp + 0x1c0], xmm0
movups xmm0, xmmword [rsp + 0x520]
movaps xmmword [rsp + 0x1d0], xmm0
movups xmm0, xmmword [rsp + 0x530]
movaps xmmword [rsp + 0x1e0], xmm0
movups xmm0, xmmword [rsp + 0x540]
movaps xmmword [rsp + 0x1f0], xmm0
movups xmm0, xmmword [rsp + 0x550]
movaps xmmword [rsp + 0x200], xmm0
movups xmm0, xmmword [rsp + 0x560]
movaps xmmword [rsp + 0x210], xmm0
mov rax, qword [rsp + 0x570]
mov qword [rsp + 0x220], rax
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
test rbx, rbx
je 0x1400b4954
lea r13, [rsi + 8]
jmp 0x1400b4939
add r13, 0x58
dec rbx
je 0x1400b4954
cmp qword [r13 - 8], 0
je 0x1400b4930
mov r8, qword [r13]
mov rcx, qword [0x140228110]
xor edx, edx
call sub.kernel32.dll_HeapFree
jmp 0x1400b4930
test rdi, rdi
je 0x1400b496a
mov rcx, qword [0x140228110]
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapFree
lea rcx, [rsp + 0xb8]
lea rdx, [rsp + 0x730]
mov r8d, 0x88
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x140], r14
mov qword [rsp + 0x148], r15
mov qword [rsp + 0x150], r12
movaps xmm0, xmmword [rsp + 0x1c0]
movaps xmm1, xmmword [rsp + 0x1d0]
movaps xmm2, xmmword [rsp + 0x1e0]
movaps xmm3, xmmword [rsp + 0x1f0]
movups xmmword [rsp + 0x158], xmm0
movups xmmword [rsp + 0x168], xmm1
movups xmmword [rsp + 0x178], xmm2
movups xmmword [rsp + 0x188], xmm3
movaps xmm0, xmmword [rsp + 0x200]
movups xmmword [rsp + 0x198], xmm0
movaps xmm0, xmmword [rsp + 0x210]
movups xmmword [rsp + 0x1a8], xmm0
mov rax, qword [rsp + 0x220]
mov qword [rsp + 0x1b8], rax
mov qword [rsp + 0xb0], rbp
jmp 0x1400b4e2e
lea rcx, [rsp + 0xb8]
lea rdx, [rsp + 0x600]
mov r8d, 0x108
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0xb0], rdi
mov rdi, qword [rsp + 0x80]
test rdi, rdi
jne 0x1400b4ddf
jmp 0x1400b4e13
add rax, 0xc8
mov qword [rsp + 0x3e0], rax
lea rax, [0x140017700]
mov qword [rsp + 0x3e8], rax
lea rax, [0x1401d1e00]
mov qword [rsp + 0x600], rax
mov qword [rsp + 0x608], 2
mov qword [rsp + 0x620], 0
lea rax, [rsp + 0x3e0]
mov qword [rsp + 0x610], rax
mov qword [rsp + 0x618], 1
lea rcx, [rsp + 0xb8]
lea rdx, [rsp + 0x600]
call fcn.1400048a0
movabs rax, 0x8000000000000000
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x128], 0
mov byte [rsp + 0x138], 5
lea rcx, [rsp + 0x470]
call fcn.140090070
test rdi, rdi
jne 0x1400b4ddf
jmp 0x1400b4e13
movzx ebx, byte [rsp + 0x5a8]
lea rax, [rsp + 0x450]
mov qword [rsp + 0x460], rax
lea rax, [0x140085130]
mov qword [rsp + 0x468], rax
lea rax, str.Bad_redirection:
mov qword [rsp + 0x3b0], rax
mov qword [rsp + 0x3b8], 1
mov qword [rsp + 0x3d0], 0
lea rax, [rsp + 0x460]
mov qword [rsp + 0x3c0], rax
mov qword [rsp + 0x3c8], 1
lea rdx, [rsp + 0x3b0]
lea rcx, [rsp + 0xb8]
call fcn.1400048a0
movabs rax, 0x8000000000000000
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x128], 0
mov byte [rsp + 0x138], 0
mov qword [rsp + 0xb0], rax
mov rsi, qword [rsp + 0x138]
movzx eax, byte [0x140228121]
mov rcx, qword [0x140228110]
test rcx, rcx
jne 0x1400b4bf1
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400b50ef
mov rcx, rax
mov qword [0x140228110], rax
mov r8d, 1
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400b50ef
mov byte [rax], bl
lea rcx, [rsp + 0xb8]
movups xmm0, xmmword [rcx + 0x60]
movaps xmmword [rsp + 0x440], xmm0
movups xmm0, xmmword [rcx + 0x50]
movaps xmmword [rsp + 0x430], xmm0
movups xmm0, xmmword [rcx + 0x40]
movaps xmmword [rsp + 0x420], xmm0
movups xmm1, xmmword [rcx]
movups xmm2, xmmword [rcx + 0x10]
movups xmm3, xmmword [rcx + 0x20]
movups xmm4, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x410], xmm4
movaps xmmword [rsp + 0x400], xmm3
movaps xmmword [rsp + 0x3f0], xmm2
movaps xmmword [rsp + 0x3e0], xmm1
movaps xmmword [rsp + 0x230], xmm1
movaps xmmword [rsp + 0x240], xmm2
movaps xmmword [rsp + 0x250], xmm3
movaps xmmword [rsp + 0x260], xmm4
movaps xmmword [rsp + 0x270], xmm0
mov rcx, qword [rsp + 0x430]
mov qword [rsp + 0x280], rcx
movups xmm0, xmmword [rsp + 0x438]
movups xmmword [rsp + 0x110], xmm0
mov rcx, qword [rsp + 0x448]
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rax
lea rax, [0x1401e5300]
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], rsi
movups xmm0, xmmword [rsp + 0x670]
movups xmmword [rsp + 0x1b0], xmm0
movups xmm0, xmmword [rsp + 0x660]
movups xmmword [rsp + 0x1a0], xmm0
movups xmm0, xmmword [rsp + 0x650]
movups xmmword [rsp + 0x190], xmm0
movups xmm0, xmmword [rsp + 0x640]
movups xmmword [rsp + 0x180], xmm0
movups xmm0, xmmword [rsp + 0x600]
movups xmm1, xmmword [rsp + 0x610]
movups xmm2, xmmword [rsp + 0x620]
movups xmm3, xmmword [rsp + 0x630]
movups xmmword [rsp + 0x170], xmm3
movups xmmword [rsp + 0x160], xmm2
movups xmmword [rsp + 0x150], xmm1
movups xmmword [rsp + 0x140], xmm0
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0x108], rax
movaps xmm0, xmmword [rsp + 0x270]
movups xmmword [rsp + 0xf8], xmm0
movaps xmm0, xmmword [rsp + 0x230]
movaps xmm1, xmmword [rsp + 0x240]
movaps xmm2, xmmword [rsp + 0x250]
movaps xmm3, xmmword [rsp + 0x260]
movups xmmword [rsp + 0xe8], xmm3
movups xmmword [rsp + 0xd8], xmm2
movups xmmword [rsp + 0xc8], xmm1
movups xmmword [rsp + 0xb8], xmm0
movabs rax, 0x8000000000000000
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x470]
call fcn.140090070
test rdi, rdi
je 0x1400b4e13
mov rsi, qword [rsp + 0x78]
add rsi, 8
jmp 0x1400b4df9
add rsi, 0x58
dec rdi
je 0x1400b4e13
cmp qword [rsi - 8], 0
je 0x1400b4df0
mov r8, qword [rsi]
mov rcx, qword [0x140228110]
xor edx, edx
call sub.kernel32.dll_HeapFree
jmp 0x1400b4df0
cmp qword [rsp + 0x70], 0
je 0x1400b4e2e
mov r8, qword [rsp + 0x78]
mov rcx, qword [0x140228110]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rax, qword [rsp + 0x320]
lock dec qword [rax]
jne 0x1400b4ee3
lea rcx, [rsp + 0x320]
call fcn.1400a8160
mov rax, qword [rsp + 0x328]
lock dec qword [rax]
je 0x1400b4ef5
cmp qword [rsp + 0x288], 0
je 0x1400b4e80
mov r8, qword [rsp + 0x290]
mov rcx, qword [0x140228110]
xor edx, edx
call sub.kernel32.dll_HeapFree
cmp qword [rsp + 0x2a0], 0
je 0x1400b4ea1
mov r8, qword [rsp + 0x2a8]
mov rcx, qword [0x140228110]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov rsi, qword [rsp + 0x308]
test rsi, rsi
je 0x1400b4f16
mov rdi, qword [rsp + 0x300]
add rdi, 8
jmp 0x1400b4ec9
add rdi, 0x20
dec rsi
je 0x1400b4f16
cmp qword [rdi - 8], 0
je 0x1400b4ec0
mov r8, qword [rdi]
mov rcx, qword [0x140228110]
xor edx, edx
call sub.kernel32.dll_HeapFree
jmp 0x1400b4ec0
mov rax, qword [rsp + 0x328]
lock dec qword [rax]
jne 0x1400b4e5f
lea rcx, [rsp + 0x328]
call fcn.1400a7d50
cmp qword [rsp + 0x288], 0
jne 0x1400b4e6a
jmp 0x1400b4e80
cmp qword [rsp + 0x2f8], 0
je 0x1400b4f37
mov r8, qword [rsp + 0x300]
mov rcx, qword [0x140228110]
xor edx, edx
call sub.kernel32.dll_HeapFree
mov r12, qword [rsp + 0xb0]
cmp r12, rbp
jne 0x1400b4f6b
lea rdx, [rsp + 0xb8]
mov rsi, qword [rsp + 0x88]
lea rcx, [rsi + 8]
mov r8d, 0x108
call sub.msvcrt.dll_memcpy
mov qword [rsi], rbp
jmp 0x1400b5379
movups xmm0, xmmword [rsp + 0xb8]
movaps xmmword [rsp + 0x3e0], xmm0
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x3f0], rax
mov r15, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xd8]
mov r13, qword [rsp + 0xe0]
movups xmm6, xmmword [rsp + 0xe8]
movsd xmm7, qword [rsp + 0xf8]
movups xmm8, xmmword [rsp + 0xfc]
mov ebp, dword [rsp + 0x10c]
movups xmm0, xmmword [rsp + 0x110]
movaps xmmword [rsp + 0x230], xmm0
movzx eax, byte [rsp + 0x120]
mov byte [rsp + 0x240], al
mov eax, dword [rsp + 0x121]
mov ecx, dword [rsp + 0x124]
mov dword [rsp + 0x3b3], ecx
mov dword [rsp + 0x3b0], eax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x1d0], rax
movups xmm0, xmmword [rsp + 0x128]
movaps xmmword [rsp + 0x1c0], xmm0
movups xmm0, xmmword [rsp + 0x1b0]
movaps xmmword [rsp + 0x670], xmm0
movups xmm0, xmmword [rsp + 0x1a0]
movaps xmmword [rsp + 0x660], xmm0
movups xmm0, xmmword [rsp + 0x190]
movaps xmmword [rsp + 0x650], xmm0
movups xmm0, xmmword [rsp + 0x180]
movaps xmmword [rsp + 0x640], xmm0
movups xmm0, xmmword [rsp + 0x140]
movups xmm1, xmmword [rsp + 0x150]
movups xmm2, xmmword [rsp + 0x160]
movups xmm3, xmmword [rsp + 0x170]
movaps xmmword [rsp + 0x630], xmm3
movaps xmmword [rsp + 0x620], xmm2
movaps xmmword [rsp + 0x610], xmm1
movaps xmmword [rsp + 0x600], xmm0
mov rax, qword [rsp + 0xa0]
mov r14, qword [rax + 8]
mov rsi, qword [rax + 0x10]
test rsi, rsi
je 0x1400b50f1
js 0x1400b50ef
movzx eax, byte [0x140228121]
mov rcx, qword [0x140228110]
test rcx, rcx
jne 0x1400b50dd
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400b50ef
mov rcx, rax
mov qword [0x140228110], rax
xor edx, edx
mov r8, rsi
call sub.kernel32.dll_HeapAlloc
mov rbx, rax
test rax, rax
jne 0x1400b50f6
ud2
mov ebx, 1
mov rcx, rbx
mov rdx, r14
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0xa0]
movups xmm9, xmmword [rcx + 0x2c]
movups xmm0, xmmword [rcx + 0x40]
movzx eax, byte [rcx + 0x50]
mov byte [rsp + 0x5b0], al
movaps xmmword [rsp + 0x5a0], xmm0
movabs rax, 0x8000000000000000
cmp r12, rax
jne 0x1400b5265
mov r8, rdi
movzx r10d, word [rcx + 0x28]
movzx r12d, word [rcx + 0x2a]
mov r9d, dword [rcx + 0x3c]
mov r13d, dword [rcx + 0x18]
mov edi, dword [rcx + 0x1c]
mov ebp, dword [rcx + 0x20]
mov r14d, dword [rcx + 0x24]
movaps xmm0, xmmword [rsp + 0x3e0]
movaps xmmword [rsp + 0x470], xmm0
mov rax, qword [rsp + 0x3f0]
mov qword [rsp + 0x480], rax
movaps xmm0, xmmword [rsp + 0x1c0]
movaps xmmword [rsp + 0x730], xmm0
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x740], rax
shl r15, 1
test r15, r15
je 0x1400b51c0
mov rcx, qword [0x140228110]
xor edx, edx
mov dword [rsp + 0x60], r9d
mov r15d, r10d
call sub.kernel32.dll_HeapFree
mov r10d, r15d
mov r9d, dword [rsp + 0x60]
mov rax, qword [rsp + 0x480]
mov rdx, qword [rsp + 0x88]
mov qword [rdx + 0x18], rax
movaps xmm0, xmmword [rsp + 0x470]
movups xmmword [rdx + 8], xmm0
mov qword [rdx + 0x20], rsi
mov qword [rdx + 0x28], rbx
mov qword [rdx + 0x30], rsi
mov dword [rdx + 0x38], r13d
mov dword [rdx + 0x3c], edi
mov dword [rdx + 0x40], ebp
mov dword [rdx + 0x44], r14d
mov word [rdx + 0x48], r10w
mov word [rdx + 0x4a], r12w
movups xmmword [rdx + 0x4c], xmm9
mov dword [rdx + 0x5c], r9d
movzx eax, byte [rsp + 0x5b0]
mov byte [rdx + 0x70], al
movaps xmm0, xmmword [rsp + 0x5a0]
movups xmmword [rdx + 0x60], xmm0
mov eax, dword [rsp + 0x350]
mov ecx, dword [rsp + 0x353]
mov dword [rdx + 0x74], ecx
mov dword [rdx + 0x71], eax
movaps xmm0, xmmword [rsp + 0x730]
movups xmmword [rdx + 0x78], xmm0
mov rax, qword [rsp + 0x740]
mov qword [rdx + 0x88], rax
movabs rax, 0x8000000000000000
mov qword [rdx], rax
jmp 0x1400b5379
mov rdx, qword [rsp + 0x88]
mov qword [rdx], r12
movaps xmm0, xmmword [rsp + 0x3e0]
movups xmmword [rdx + 8], xmm0
mov rax, qword [rsp + 0x3f0]
mov qword [rdx + 0x18], rax
mov qword [rdx + 0x20], r15
mov qword [rdx + 0x28], rdi
mov qword [rdx + 0x30], r13
movups xmmword [rdx + 0x38], xmm6
movss dword [rdx + 0x48], xmm7
movups xmmword [rdx + 0x4c], xmm8
mov dword [rdx + 0x5c], ebp
movzx eax, byte [rsp + 0x240]
mov byte [rdx + 0x70], al
movaps xmm0, xmmword [rsp + 0x230]
movups xmmword [rdx + 0x60], xmm0
mov eax, dword [rsp + 0x3b0]
mov ecx, dword [rsp + 0x3b3]
mov dword [rdx + 0x74], ecx
mov dword [rdx + 0x71], eax
mov rax, qword [rsp + 0x1d0]
mov qword [rdx + 0x88], rax
movaps xmm0, xmmword [rsp + 0x1c0]
movups xmmword [rdx + 0x78], xmm0
movaps xmm0, xmmword [rsp + 0x600]
movaps xmm1, xmmword [rsp + 0x610]
movaps xmm2, xmmword [rsp + 0x620]
movaps xmm3, xmmword [rsp + 0x630]
movups xmmword [rdx + 0x90], xmm0
movups xmmword [rdx + 0xa0], xmm1
movups xmmword [rdx + 0xb0], xmm2
movups xmmword [rdx + 0xc0], xmm3
movaps xmm0, xmmword [rsp + 0x640]
movups xmmword [rdx + 0xd0], xmm0
movaps xmm0, xmmword [rsp + 0x650]
movups xmmword [rdx + 0xe0], xmm0
movaps xmm0, xmmword [rsp + 0x660]
movups xmmword [rdx + 0xf0], xmm0
movaps xmm0, xmmword [rsp + 0x670]
movups xmmword [rdx + 0x100], xmm0
test rsi, rsi
je 0x1400b5379
mov rcx, qword [0x140228110]
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapFree
mov rsi, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x338]
mov rax, qword [rcx]
lock dec qword [rax]
jne 0x1400b5408
call fcn.1400a8160
mov rax, qword [rsi + 0x60]
lock dec qword [rax]
je 0x1400b5412
cmp qword [rsi], 0
je 0x1400b53b9
mov r8, qword [rsi + 8]
mov rcx, qword [0x140228110]
xor edx, edx
call sub.kernel32.dll_HeapFree
cmp qword [rsi + 0x18], 0
je 0x1400b53d2
mov r8, qword [rsi + 0x20]
mov rcx, qword [0x140228110]
xor edx, edx
call sub.kernel32.dll_HeapFree
movaps xmm6, xmmword [rsp + 0x7c0]
movaps xmm7, xmmword [rsp + 0x7d0]
movaps xmm8, xmmword [rsp + 0x7e0]
movaps xmm9, xmmword [rsp + 0x7f0]
add rsp, 0x808
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x60]
lock dec qword [rax]
jne 0x1400b53a1
lea rcx, [rsi + 0x60]
call fcn.1400a7d50
cmp qword [rsi], 0
jne 0x1400b53a7
jmp 0x1400b53b9
lea rcx, [rsp + 0x730]
lea rdx, [rsp + 0x470]
mov r8d, 0x88
call sub.msvcrt.dll_memcpy
mov rdi, qword [rsp + 0x4f8]
mov rsi, qword [rsp + 0x500]
mov rbx, qword [rsp + 0x508]
movups xmm0, xmmword [rsp + 0x510]
movaps xmmword [rsp + 0x1c0], xmm0
movups xmm0, xmmword [rsp + 0x520]
movaps xmmword [rsp + 0x1d0], xmm0
movups xmm0, xmmword [rsp + 0x530]
movaps xmmword [rsp + 0x1e0], xmm0
movups xmm0, xmmword [rsp + 0x540]
movaps xmmword [rsp + 0x1f0], xmm0
movups xmm0, xmmword [rsp + 0x550]
movaps xmmword [rsp + 0x200], xmm0
movups xmm0, xmmword [rsp + 0x560]
movaps xmmword [rsp + 0x210], xmm0
mov rax, qword [rsp + 0x570]
mov qword [rsp + 0x220], rax
cmp qword [rsp + 0x350], 0
je 0x1400b4913
mov r8, qword [rsp + 0x358]
mov rcx, qword [0x140228110]
xor edx, edx
call sub.kernel32.dll_HeapFree
jmp 0x1400b4913