Function at 0x140001d40
Capabilities:
Allocate thread local storage
Check for debugger via api
Check for process debug object
Check processdebugflags
Check processdebugport
Encode data using base64
Encode data using xor
Generate random numbers via winapi
Get thread local storage value
Open clipboard
Read clipboard data
Set thread local storage value
Write clipboard data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x398
movdqa xmmword [rsp + 0x380], xmm14
movdqa xmmword [rsp + 0x370], xmm13
movdqa xmmword [rsp + 0x360], xmm12
movdqa xmmword [rsp + 0x350], xmm11
movdqa xmmword [rsp + 0x340], xmm10
movdqa xmmword [rsp + 0x330], xmm9
movdqa xmmword [rsp + 0x320], xmm8
movdqa xmmword [rsp + 0x310], xmm7
movdqa xmmword [rsp + 0x300], xmm6
lea rcx, [rsp + 0x130]
call fcn.14010c940
cmp byte [rsp + 0x130], 0x12
jne 0x140002767
lea rsi, [rsp + 0x130]
mov rcx, rsi
call fcn.14010c940
cmp byte [rsp + 0x130], 0x12
jne 0x140002767
lea rax, [0x14017b90a]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0xfcc1e873e0de7a0d
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f6030
movabs rcx, 0x2f113bdba3ebe379
xor rcx, qword [rax]
movabs rdx, 0x1deb291c0521a22e
xor rdx, qword [rax + 8]
mov r8d, 0x61da3a78
xor r8d, dword [rax + 0x10]
mov qword [rsp + 0x130], rcx
mov qword [rsp + 0x138], rdx
mov dword [rsp + 0x140], r8d
lea rcx, [rsp + 0x70]
lea rsi, [rsp + 0x130]
mov r8d, 0x14
mov rdx, rsi
call fcn.14010ca10
movzx eax, byte [rsp + 0x70]
cmp rax, 0x12
jne 0x14000209d
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x250], rax
lea rax, [0x140173fa0]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0xa4b41c0f53f0de00
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f5a20
movabs rcx, 0xfee3f2c04eedb6db
xor rcx, qword [rax]
movabs rdx, 0x56a0cdc897cde13d
xor rdx, qword [rax + 8]
movabs r8, 0x37fbe1baac24a2c4
xor r8, qword [rax + 0x10]
movabs r9, 0xc75d17ef325c0fdc
xor r9, qword [rax + 0x18]
movabs r10, 0x619e69eed1b862df
xor r10, qword [rax + 0x20]
mov qword [rsp + 0x130], rcx
mov qword [rsp + 0x138], rdx
mov qword [rsp + 0x140], r8
mov qword [rsp + 0x148], r9
mov qword [rsp + 0x150], r10
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x250]
lea r8, [rsp + 0x130]
mov r9d, 0x28
call fcn.1400fd1e0
cmp byte [rsp + 0xa0], 0x12
jne 0x140002767
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x50], rax
mov rbx, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xb8]
xor ecx, ecx
call fcn.1400f3180
test rax, rax
je 0x140002767
movups xmm0, xmmword [rax]
inc qword [rax]
movaps xmmword [rsp + 0x120], xmm0
movups xmm0, xmmword [0x14017d7a0]
movaps xmmword [rsp + 0x100], xmm0
movdqu xmm0, xmmword [0x14017d7b0]
movdqa xmmword [rsp + 0x110], xmm0
lea r14, [rsi + rsi*2]
shl r14, 4
add r14, rbx
mov qword [rsp + 0x98], rbx
test rsi, rsi
jne 0x140002769
mov rax, r14
sub rax, rbx
movabs rcx, 0xaaaaaaaaaaaaaaab
mul rcx
cmp r14, rbx
je 0x140002011
mov rsi, rdx
shr rsi, 5
nop dword [rax + rax]
mov rcx, rbx
call fcn.1400f7890
add rbx, 0x30
dec rsi
jne 0x140002000
cmp qword [rsp + 0x50], 0
je 0x14000202f
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, qword [rsp + 0x98]
call sub.KERNEL32.dll_HeapFree
mov rdi, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x118]
test rbx, rbx
sete bpl
test rdi, rdi
je 0x14000208d
mov rsi, qword [rsp + 0x100]
test rbx, rbx
jne 0x140002cd8
lea rax, [rdi + 1]
mov ecx, 0x18
mul rcx
add rax, 0xf
and rax, 0xfffffffffffffff0
add rdi, rax
cmp rdi, 0xffffffffffffffef
je 0x14000208d
sub rsi, rax
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [rsp + 0x250]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1400020d7
cmp rax, 0x10
ja case.0x1400020b1.6
lea rcx, [0x1401180a0]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
cmp qword [rsp + 0x78], 0
je case.0x1400020b1.0
lea rax, [rsp + 0x80]
mov r8, qword [rax]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov bpl, 1
lea rdx, [0x14017da30]
lea rbx, [rsp + 0x130]
mov r8d, 0xa
mov rcx, rbx
call fcn.14010ca10
cmp byte [rsp + 0x130], 0x12
jne 0x140002767
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x70], rax
movzx eax, byte [0x140188180]
mov edx, 0xd8
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x140002767
mov qword [rsp + 0x50], rax
lea rax, [0x14017b4e3]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x57d3c83a50758f83
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f5730
mov rdi, qword [rax]
mov r15, qword [rax + 8]
mov r12, qword [rax + 0x10]
mov r13, qword [rax + 0x18]
movzx esi, byte [rax + 0x20]
movzx eax, byte [0x140188180]
mov edx, 0x21
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x140002767
mov r14, rax
xor sil, 0x85
movabs rax, 0x1c2087b0bceff0cb
xor rdi, rax
movabs rax, 0x6b6eb8739606babb
xor r15, rax
movabs rax, 0xf326dd930704e23
xor r12, rax
movabs rax, 0x4203a9c13a4ff3d
xor r13, rax
mov qword [r14], rdi
mov qword [r14 + 8], r15
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], r13
mov byte [r14 + 0x20], sil
lea rax, [0x140178fd7]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x28a8ffbce5f6ec08
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f5920
mov r15, qword [rax]
mov r12, qword [rax + 8]
mov rdi, qword [rax + 0x10]
movzx eax, byte [0x140188180]
mov edx, 0x18
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x140002767
mov byte [rsp + 0x98], bpl
movabs rcx, 0x8da8fe922f2c3040
xor rdi, rcx
movabs rcx, 0xbc3fd966cce1f49f
xor r15, rcx
movabs rcx, 0x1b27eb65a574670f
xor r12, rcx
mov qword [rax], r15
mov qword [rax + 8], r12
mov qword [rsp + 0x68], rax
mov qword [rax + 0x10], rdi
lea rax, [0x140172b71]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x868feab9bfac17d1
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f5f20
mov rbp, qword [rax]
mov r13, qword [rax + 8]
mov r12, qword [rax + 0x10]
mov rdi, qword [rax + 0x18]
movzx r15d, word [rax + 0x20]
movzx esi, byte [rax + 0x22]
movzx eax, byte [0x140188180]
mov edx, 0x23
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x140002767
shl esi, 0x10
or r15d, esi
mov r8d, r15d
shr r8d, 0x10
xor r8b, 0xe0
mov ecx, r15d
xor cl, 0xf0
shr r15d, 8
xor r15b, 0x38
movzx ecx, cl
movzx edx, r15b
shl edx, 8
or edx, ecx
movabs rcx, 0xc08517ce1349e1b1
xor rdi, rcx
movabs rcx, 0xdf0a598ceb92859c
xor r12, rcx
movabs rcx, 0x73141e7111f0d1b2
xor r13, rcx
movabs rcx, 0xb91e12584ef18644
xor rbp, rcx
mov qword [rax], rbp
mov qword [rax + 8], r13
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], rdi
mov word [rax + 0x20], dx
mov qword [rsp + 0x48], rax
mov byte [rax + 0x22], r8b
lea rax, [0x14017ab31]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x8f6a5a15e90951f6
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f5890
mov rbp, qword [rax]
mov r13, qword [rax + 8]
mov edi, dword [rax + 0x10]
movzx r15d, word [rax + 0x14]
movzx eax, byte [0x140188180]
mov edx, 0x16
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x140002767
mov r12, rax
mov eax, r15d
xor al, 0x2c
shr r15d, 8
xor r15b, 0x4c
movzx ecx, r15b
shl ecx, 8
movzx eax, al
or eax, ecx
xor edi, 0xd9e90508
movabs rcx, 0x2a7545642ed51f79
xor r13, rcx
movabs rcx, 0xb60ee14aef969e23
xor rbp, rcx
mov qword [r12], rbp
mov qword [r12 + 8], r13
mov dword [r12 + 0x10], edi
mov word [r12 + 0x14], ax
lea rax, [0x140177e98]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0xc20586a8f62da60f
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f5de0
mov rdi, qword [rax]
mov r15, qword [rax + 8]
mov r13, qword [rax + 0x10]
mov rsi, qword [rax + 0x18]
movzx eax, byte [0x140188180]
mov edx, 0x20
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x140002767
movq xmm0, rsi
movq xmm1, r13
punpcklqdq xmm1, xmm0
movq xmm0, r15
movq xmm2, rdi
punpcklqdq xmm2, xmm0
pxor xmm2, xmmword [0x140118020]
pxor xmm1, xmmword [0x140118030]
movdqu xmmword [rax + 0x10], xmm1
mov qword [rsp + 0x58], rax
movdqu xmmword [rax], xmm2
lea rax, [0x1401787d3]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0xcb7b0d7ae427f497
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f5bd0
mov rcx, qword [rax]
mov qword [rsp + 0x60], rcx
mov r13, qword [rax + 8]
mov rbp, qword [rax + 0x10]
mov edi, dword [rax + 0x18]
movzx r15d, word [rax + 0x1c]
movzx esi, byte [rax + 0x1e]
movzx eax, byte [0x140188180]
mov edx, 0x1f
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x140002767
shl esi, 0x10
or r15d, esi
mov r8d, r15d
shr r8d, 0x10
xor r8b, 0x96
mov ecx, r15d
xor cl, 0xc7
shr r15d, 8
xor r15b, 0x95
movzx ecx, cl
movzx edx, r15b
shl edx, 8
or edx, ecx
xor edi, 0x181c1ce7
movabs rcx, 0x9c31cef018016a55
xor rbp, rcx
movabs rcx, 0x3f1ec70a1739be35
xor r13, rcx
movabs rcx, 0xa9254ccb1119ab9e
mov r9, qword [rsp + 0x60]
xor r9, rcx
mov qword [rax], r9
mov qword [rax + 8], r13
mov qword [rax + 0x10], rbp
mov dword [rax + 0x18], edi
mov word [rax + 0x1c], dx
mov qword [rsp + 0x60], rax
mov byte [rax + 0x1e], r8b
lea rax, [0x1401755fe]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x5cc1f808f69c35cd
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f5b60
mov rdi, qword [rax]
mov r15, qword [rax + 8]
mov r13, qword [rax + 0x10]
mov rsi, qword [rax + 0x18]
movzx eax, byte [0x140188180]
mov edx, 0x20
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x140002767
movq xmm0, rsi
movq xmm1, r13
punpcklqdq xmm1, xmm0
movq xmm0, r15
movq xmm2, rdi
punpcklqdq xmm2, xmm0
pxor xmm2, xmmword [0x140118040]
pxor xmm1, xmmword [0x140118050]
movdqu xmmword [rax + 0x10], xmm1
mov qword [rsp + 0x270], rax
movdqu xmmword [rax], xmm2
lea rax, [0x140170beb]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x6497df9d93ac1c64
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f6350
mov rdi, qword [rax]
mov r13, qword [rax + 8]
mov rbp, qword [rax + 0x10]
mov rsi, qword [rax + 0x18]
movzx r15d, word [rax + 0x20]
movzx eax, byte [0x140188180]
mov edx, 0x22
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x140002767
mov edx, r15d
xor dl, 0xa5
shr r15d, 8
xor r15b, 0xc3
movzx ecx, r15b
shl ecx, 8
movzx edx, dl
or edx, ecx
movabs rcx, 0xcfac4a63bbadad05
xor rdi, rcx
movabs rcx, 0x4e6d82349ae12b73
xor r13, rcx
movabs rcx, 0xacf18f533b44d901
xor rbp, rcx
movabs rcx, 0x68abad883e6f9a1e
xor rsi, rcx
mov qword [rax], rdi
mov qword [rax + 8], r13
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rsp + 0x2a8], rax
mov word [rax + 0x20], dx
lea rax, [0x140171235]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0xb666add89f4a2024
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f62c0
mov rbp, qword [rax]
mov r13, qword [rax + 8]
mov r15, qword [rax + 0x10]
mov edi, dword [rax + 0x18]
movzx ebx, byte [rax + 0x1c]
movzx eax, byte [0x140188180]
mov edx, 0x1d
xor ecx, ecx
call fcn.1400f2120
test rax, rax
jne 0x140002d76
ud2
lea r15, [rsp + 0xa8]
lea r12, [rsp + 0x160]
lea r13, [rsp + 0xa0]
movdqa xmm6, xmmword [section..rdata]
movdqa xmm7, xmmword [0x140118010]
pxor xmm8, xmm8
pcmpeqd xmm9, xmm9
mov rbx, qword [rsp + 0x98]
mov qword [rsp + 0x58], r14
jmp 0x140002821
and al, 1
movzx eax, al
sub qword [rsp + 0x110], rax
lea rax, [rcx - 0x10]
and r13, rax
mov rax, qword [rsp + 0x48]
mov byte [r15 + rcx], al
mov byte [r13 + r15 + 0x10], al
inc qword [rsp + 0x118]
neg rcx
lea rax, [rcx + rcx*2]
mov qword [r15 + rax*8 - 0x18], rsi
mov qword [r15 + rax*8 - 0x10], rdi
mov qword [r15 + rax*8 - 8], rsi
mov r14, qword [rsp + 0x58]
lea r15, [rsp + 0xa8]
lea r12, [rsp + 0x160]
lea r13, [rsp + 0xa0]
nop word [rax + rax]
mov rcx, r13
call fcn.1400f7890
cmp rbx, r14
je 0x140002011
mov rax, rbx
add rbx, 0x30
mov rsi, qword [rax]
test rsi, rsi
je 0x140001fd9
mov qword [rsp + 0xa0], rsi
mov rcx, qword [rax + 0x28]
mov qword [r15 + 0x20], rcx
movdqu xmm0, xmmword [rax + 8]
movdqu xmm1, xmmword [rax + 0x18]
movdqu xmmword [r15 + 0x10], xmm1
movdqu xmmword [r15], xmm0
cmp qword [rsp + 0xb8], 0
je 0x140002810
movdqu xmm0, xmmword [rsp + 0xc0]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmm6
movdqa xmmword [rsp + 0x130], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmm7
movdqa xmmword [rsp + 0x140], xmm1
movdqa xmmword [rsp + 0x150], xmm0
movdqa xmmword [r12], xmm8
mov qword [r12 + 0x10], 0
mov r8d, 0xb
lea rdi, [rsp + 0x130]
mov rcx, rdi
lea rdx, str.displayName
call fcn.140079f30
mov byte [rsp + 0x288], 0xff
mov r8d, 1
mov rcx, rdi
lea rdx, [rsp + 0x288]
call fcn.140079f30
mov rax, qword [rsp + 0x140]
mov r9, qword [rsp + 0x160]
shl r9, 0x38
or r9, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x148]
mov r8, qword [rsp + 0x130]
add r8, rax
rol rax, 0xd
xor rcx, r9
xor rax, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x138]
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add r8, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rcx, r8
xor rax, rdx
rol rdx, 0x20
xor r8, r9
add r8, rax
rol rax, 0xd
xor rax, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add r8, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rax, rdx
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
xor rax, r8
rol r8, 0x20
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add r8, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rax, rdx
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
rol rcx, 0x15
xor rax, r8
add rdx, rax
rol rax, 0x11
mov r8, rdx
rol r8, 0x20
xor r8, rax
xor r8, rcx
xor r8, rdx
mov rax, qword [rsp + 0xa8]
mov rcx, r8
shr rcx, 0x39
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
lea rcx, [rsi - 0x38]
xor edx, edx
and r8, rax
movdqu xmm1, xmmword [rsi + r8]
movdqa xmm2, xmm1
pcmpeqb xmm2, xmm0
pmovmskb r9d, xmm2
nop word cs:[rax + rax]
test r9w, r9w
je 0x140002a90
tzcnt r10d, r9d
lea r11d, [r9 - 1]
and r11d, r9d
mov r9d, r11d
add r10, r8
and r10, rax
neg r10
imul r10, r10, 0x38
cmp qword [rcx + r10 + 0x10], 0xb
jne 0x140002a30
lea r11, [rcx + r10]
mov r11, qword [r11 + 8]
mov rdi, qword [r11]
movabs rbp, 0x4e79616c70736964
xor rdi, rbp
mov r11, qword [r11 + 3]
movabs rbp, 0x656d614e79616c70
xor r11, rbp
or r11, rdi
jne 0x140002a30
jmp 0x140002ac0
pcmpeqb xmm1, xmm9
pmovmskb r9d, xmm1
test r9d, r9d
jne 0x140002810
add r8, rdx
add r8, 0x10
add rdx, 0x10
jmp 0x140002a0b
cmp byte [rsi + r10 - 0x20], 2
jne 0x140002810
add rsi, r10
mov rbp, qword [rsi - 0x10]
mov rsi, qword [rsi - 8]
test rsi, rsi
je 0x140002b00
js 0x140002767
movzx eax, byte [0x140188180]
xor ecx, ecx
mov rdx, rsi
call fcn.1400f2120
mov rdi, rax
test rax, rax
jne 0x140002b05
jmp 0x140002767
mov edi, 1
mov rcx, rdi
mov rdx, rbp
mov r8, rsi
call sub.msvcrt.dll_memcpy
movaps xmm10, xmmword [rsp + 0x120]
movaps xmmword [rsp + 0x2f0], xmm10
lea rcx, [rsp + 0x2f0]
mov rdx, rdi
mov r8, rsi
call fcn.1400fd440
mov rbp, rax
cmp qword [rsp + 0x110], 0
je 0x140002cb5
mov r15, qword [rsp + 0x100]
mov r13, qword [rsp + 0x108]
mov rax, rbp
shr rax, 0x39
mov qword [rsp + 0x48], rax
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm10, xmm0, 0
xor eax, eax
mov qword [rsp + 0x68], rax
xor r14d, r14d
and rbp, r13
movdqu xmm11, xmmword [r15 + rbp]
movdqa xmm0, xmm11
pcmpeqb xmm0, xmm10
pmovmskb r12d, xmm0
nop dword [rax + rax]
test r12w, r12w
je 0x140002bf0
tzcnt eax, r12d
lea ecx, [r12 - 1]
and ecx, r12d
mov r12d, ecx
add rax, rbp
and rax, r13
neg rax
lea rax, [rax + rax*2]
cmp rsi, qword [r15 + rax*8 - 8]
jne 0x140002ba0
lea rax, [r15 + rax*8]
mov rdx, qword [rax - 0x10]
mov rcx, rdi
mov r8, rsi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140002ba0
jmp 0x140002c50
cmp r14, 1
mov r14d, 1
je 0x140002c19
pmovmskb eax, xmm11
xor r14d, r14d
test eax, eax
setne r14b
tzcnt eax, eax
add rax, rbp
and rax, r13
mov qword [rsp + 0x60], rax
pcmpeqb xmm11, xmm9
pmovmskb eax, xmm11
test eax, eax
jne 0x140002c8c
mov rax, qword [rsp + 0x68]
add rbp, rax
add rbp, 0x10
add rax, 0x10
mov qword [rsp + 0x68], rax
jmp 0x140002b83
test rsi, rsi
mov r14, qword [rsp + 0x58]
lea r15, [rsp + 0xa8]
lea r12, [rsp + 0x160]
lea r13, [rsp + 0xa0]
je 0x140002810
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
jmp 0x140002810
mov rcx, qword [rsp + 0x60]
movzx eax, byte [r15 + rcx]
test al, al
js 0x1400027aa
movdqa xmm0, xmmword [r15]
pmovmskb eax, xmm0
tzcnt ecx, eax
movzx eax, byte [r15 + rcx]
jmp 0x1400027aa
movaps xmmword [rsp + 0x2e0], xmm10
lea rcx, [rsp + 0x100]
lea rdx, [rsp + 0x2e0]
call fcn.1400f79f0
jmp 0x140002b4a
movdqa xmm0, xmmword [rsi]
pmovmskb r12d, xmm0
not r12d
lea r14, [rsi + 0x10]
mov r15, rsi
jmp 0x140002d07
dec rbx
lea eax, [r12 - 1]
and eax, r12d
mov r12d, eax
test rbx, rbx
je 0x14000205c
test r12w, r12w
jne 0x140002d31
nop dword [rax]
movdqa xmm0, xmmword [r14]
pmovmskb r12d, xmm0
add r15, 0xfffffffffffffe80
add r14, 0x10
cmp r12d, 0xffff
je 0x140002d10
not r12d
tzcnt eax, r12d
neg rax
lea rax, [rax + rax*2]
cmp qword [r15 + rax*8 - 0x18], 0
je 0x140002cf0
lea rax, [r15 + rax*8]
mov r8, qword [rax - 0x10]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x140002cf0
cmp qword [rsp + 0x80], 0
je case.0x1400020b1.0
lea rax, [rsp + 0x78]
jmp 0x1400020c3
movabs rcx, 0xe124b25c73970016
xor r15, rcx
movabs rcx, 0x9c4762d854ab8b3e
xor r13, rcx
movabs rcx, 0x214e263aeacaf32d
xor rbp, rcx
mov qword [rax], rbp
mov qword [rax + 8], r13
mov qword [rax + 0x10], r15
xor edi, 0x9a8e348b
mov dword [rax + 0x18], edi
xor bl, 4
mov byte [rax + 0x1c], bl
mov r13, qword [rsp + 0x50]
mov qword [r13], 0x21
mov qword [r13 + 8], r14
mov qword [r13 + 0x10], 0x21
mov qword [r13 + 0x18], 0x18
mov rcx, qword [rsp + 0x68]
mov qword [r13 + 0x20], rcx
mov qword [r13 + 0x28], 0x18
mov qword [r13 + 0x30], 0x23
mov rcx, qword [rsp + 0x48]
mov qword [r13 + 0x38], rcx
mov qword [r13 + 0x40], 0x23
mov qword [r13 + 0x48], 0x16
mov qword [r13 + 0x50], r12
mov qword [r13 + 0x58], 0x16
mov qword [r13 + 0x60], 0x20
mov rcx, qword [rsp + 0x58]
mov qword [r13 + 0x68], rcx
mov qword [r13 + 0x70], 0x20
mov qword [r13 + 0x78], 0x1f
mov rcx, qword [rsp + 0x60]
mov qword [r13 + 0x80], rcx
mov qword [r13 + 0x88], 0x1f
mov qword [r13 + 0x90], 0x20
mov rcx, qword [rsp + 0x270]
mov qword [r13 + 0x98], rcx
mov qword [r13 + 0xa0], 0x20
mov qword [r13 + 0xa8], 0x22
mov rcx, qword [rsp + 0x2a8]
mov qword [r13 + 0xb0], rcx
mov qword [r13 + 0xb8], 0x22
mov qword [r13 + 0xc0], 0x1d
mov qword [r13 + 0xc8], rax
mov qword [r13 + 0xd0], 0x1d
lea rax, [rsp + 0x70]
movq xmm7, rax
lea r15, [r13 + 0x20]
mov eax, 0xc0
xor r8d, r8d
lea r14, [rsp + 0x130]
movdqa xmm6, xmmword [0x140118060]
nop dword [rax + rax]
lea rdx, [r8 + r8*2]
inc r8
mov r9, qword [r13 + rdx*8]
movabs rcx, 0x8000000000000000
cmp r9, rcx
je 0x14000324d
lea rcx, [rdx*8]
add rcx, r13
mov rsi, qword [rcx + 8]
mov rbp, qword [rcx + 0x10]
test rbp, rbp
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x48], r9
je 0x140002f50
js 0x140002767
movzx eax, byte [0x140188180]
xor ecx, ecx
mov rdx, rbp
call fcn.1400f2120
mov rbx, rax
test rax, rax
jne 0x140002f55
jmp 0x140002767
mov ebx, 1
mov rcx, rbx
mov qword [rsp + 0x58], rsi
mov rdx, rsi
mov r8, rbp
call sub.msvcrt.dll_memcpy
mov edx, 3
lea rcx, str.WQLEmptyNullString
call fcn.140109760
mov r12, rax
mov rcx, rbx
mov rdx, rbp
call fcn.140109760
mov rdi, rax
mov rdx, qword [rsp + 0x70]
mov rcx, r14
mov r8, r12
mov r9, rax
call fcn.1400fe3d0
mov rsi, qword [rsp + 0x130]
mov r13, qword [rsp + 0x138]
test rsi, rsi
je 0x1400031f0
test r13, r13
je 0x140002fc5
mov rax, qword [r13]
mov rcx, r13
call qword [rax + 0x10]
test rdi, rdi
je 0x140002fd2
mov rcx, rdi
call sub.oleaut32.dll_SysFreeString
test r12, r12
mov r13, qword [rsp + 0x50]
je 0x140002fe4
mov rcx, r12
call sub.oleaut32.dll_SysFreeString
test rbp, rbp
lea rdi, [rsp + 0xa0]
je 0x140003002
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
test rsi, rsi
jne 0x140002767
pshufd xmm0, xmm8, 0xee
movq rbx, xmm0
mov byte [rsp + 0xa0], 0x12
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.1400fe450
cmp qword [rsp + 0x130], 0
je 0x140003220
movzx eax, byte [0x140188180]
mov edx, 0xc0
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x140002767
mov r12, rax
movups xmm0, xmmword [rsp + 0x130]
movdqu xmm1, xmmword [rsp + 0x140]
movdqu xmm2, xmmword [rsp + 0x150]
movdqu xmmword [rax + 0x20], xmm2
movdqu xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov qword [rsp + 0x100], 4
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], 1
mov ebp, 1
mov esi, 0x30
jmp 0x1400030ee
movdqu xmm0, xmmword [rsp + 0x130]
movdqu xmm1, xmmword [rsp + 0x140]
movdqu xmm2, xmmword [rsp + 0x150]
movdqu xmmword [r12 + rsi + 0x20], xmm2
movdqu xmmword [r12 + rsi + 0x10], xmm1
movdqu xmmword [r12 + rsi], xmm0
inc rbp
mov qword [rsp + 0x110], rbp
add rsi, 0x30
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.1400fe450
cmp qword [rsp + 0x130], 0
je 0x140003140
cmp rbp, qword [rsp + 0x100]
jne 0x1400030b0
mov r8d, 1
lea rcx, [rsp + 0x100]
mov rdx, rbp
call fcn.1400d4ea0
mov r12, qword [rsp + 0x108]
jmp 0x1400030b0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
movdqa xmm9, xmmword [rsp + 0x100]
cmp byte [rsp + 0xa0], 0x12
jne 0x14000340d
pshufd xmm0, xmm9, 0xee
movq rdi, xmm0
mov rbx, rdi
test rbp, rbp
sete sil
je 0x140003191
nop dword [rax + rax]
mov rcx, rbx
call fcn.1400f7890
add rbx, 0x30
dec rbp
jne 0x140003180
movq rax, xmm9
test rax, rax
je 0x1400031ac
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x1400031c9
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, qword [rsp + 0x58]
call sub.KERNEL32.dll_HeapFree
test sil, sil
jne 0x14000327d
mov rax, qword [rsp + 0x60]
add rax, 0xffffffffffffffe8
add r15, 0x18
mov r8, qword [rsp + 0x68]
cmp r8, 9
jne 0x140002ee0
jmp 0x140003257
test rdi, rdi
je 0x1400031fd
mov rcx, rdi
call sub.oleaut32.dll_SysFreeString
movq xmm0, r13
movdqa xmm8, xmm7
punpcklqdq xmm8, xmm0
test r12, r12
mov r13, qword [rsp + 0x50]
jne 0x140002fdc
jmp 0x140002fe4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
cmp byte [rsp + 0xa0], 0x12
jne 0x1400034d7
mov sil, 1
mov rax, qword [rsp + 0x48]
test rax, rax
jne 0x1400031b6
jmp 0x1400031c9
cmp r8, 9
jne 0x14000343b
mov rcx, qword [0x140188170]
mov dword [rsp + 0x60], 0
xor edx, edx
mov r8, r13
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1400032ad
cmp qword [rsp + 0x68], 9
jne 0x140003487
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, qword [rsp + 0x50]
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov al, 1
mov dword [rsp + 0x60], eax
lea rdx, [0x14017da30]
lea rsi, [rsp + 0x130]
mov r8d, 0xa
mov rcx, rsi
call fcn.14010ca10
cmp byte [rsp + 0x130], 0x12
jne 0x140002767
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x100], rax
lea rax, [0x140177f2e]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x410b0b75e88491c6
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f5aa0
movabs rcx, 0x8d8a5d9ff30f7c3b
xor rcx, qword [rax]
movabs rdx, 0x5b179f0c01020ee3
xor rdx, qword [rax + 8]
movabs r8, 0x33076f1b63f2597
xor r8, qword [rax + 0x10]
movabs r9, 0x7dad36d8b02450c6
xor r9, qword [rax + 0x18]
movabs r10, 0x78f68b0db5bd3703
xor r10, qword [rax + 0x20]
mov r11d, 0x9b788706
xor r11d, dword [rax + 0x28]
movzx eax, byte [rax + 0x2c]
xor al, 0x8a
mov qword [rsp + 0x130], rcx
mov qword [rsp + 0x138], rdx
mov qword [rsp + 0x140], r8
mov qword [rsp + 0x148], r9
mov qword [rsp + 0x150], r10
mov dword [rsp + 0x158], r11d
mov byte [rsp + 0x15c], al
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x100]
lea r8, [rsp + 0x130]
mov r9d, 0x2d
call fcn.1400fd1e0
cmp byte [rsp + 0xa0], 0x12
jne 0x140002767
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x58], rax
mov r12, qword [rsp + 0xb8]
test r12, r12
jne 0x1400034fd
xor ebp, ebp
jmp 0x1400035e1
pshufd xmm0, xmm9, 0xee
movq rsi, xmm0
test rbp, rbp
je 0x140003431
mov rdi, rsi
mov rcx, rdi
call fcn.1400f7890
add rdi, 0x30
dec rbp
jne 0x140003420
movdqa xmm6, xmm9
jmp 0x1400034dc
movabs rcx, 0xaaaaaaaaaaaaaaab
mul rcx
mov rsi, rdx
shr rsi, 4
jmp 0x14000346d
add r15, 0x18
dec rsi
je 0x140003257
cmp qword [r15 - 8], 0
je 0x140003460
mov r8, qword [r15]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x140003460
movabs rcx, 0xaaaaaaaaaaaaaaab
mov rax, qword [rsp + 0x60]
mul rcx
mov rsi, rdx
shr rsi, 4
jmp 0x1400034bd
add r15, 0x18
dec rsi
je 0x140003289
cmp qword [r15 - 8], 0
je 0x1400034b0
mov r8, qword [r15]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x1400034b0
mov esi, 8
movq rax, xmm6
test rax, rax
je 0x140002767
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
ud2
lea rcx, [r12 + r12*2]
shl rcx, 4
mov rax, qword [rsp + 0x58]
add rcx, rax
mov qword [rsp + 0x48], rcx
jmp 0x140003524
mov rax, qword [rsp + 0x68]
cmp rax, qword [rsp + 0x48]
je 0x140004629
mov r15, qword [rax]
mov r13, qword [rax + 0x18]
add rax, 0x30
mov qword [rsp + 0x68], rax
movdqa xmm0, xmmword [r15]
pmovmskb edi, xmm0
not edi
lea rsi, [r15 + 0x10]
nop word cs:[rax + rax]
sub r13, 1
jb 0x140003514
test di, di
jne 0x14000357d
nop dword [rax + rax]
movdqa xmm0, xmmword [rsi]
pmovmskb edi, xmm0
add r15, 0xfffffffffffffc80
add rsi, 0x10
cmp edi, 0xffff
je 0x140003560
not edi
tzcnt eax, edi
neg rax
imul r14, rax, 0x38
add r14, r15
add r14, 0xffffffffffffffe0
je 0x140003514
mov rcx, r14
lea rdx, [0x14017cd18]
call fcn.1400f6410
mov bpl, 1
test al, al
jne 0x1400035c1
lea ebx, [rdi - 1]
and ebx, edi
mov rcx, r14
lea rdx, [0x14017cd38]
call fcn.1400f6410
mov edi, ebx
test al, al
je 0x140003550
test r12, r12
je 0x1400035e1
mov rdi, qword [rsp + 0x58]
nop dword [rax + rax]
mov rcx, rdi
call fcn.1400f7890
add rdi, 0x30
dec r12
jne 0x1400035d0
cmp qword [rsp + 0x50], 0
je 0x1400035fc
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, qword [rsp + 0x58]
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [rsp + 0x100]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rdx, [0x14017da30]
lea rsi, [rsp + 0x130]
mov r8d, 0xa
mov rcx, rsi
call fcn.14010ca10
cmp byte [rsp + 0x130], 0x12
jne 0x140002767
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x250], rax
lea rax, [0x14017b83f]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x1c6933000f9aa9ec
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f5ef0
movabs rcx, 0x7fba55ac972ef4f4
xor rcx, qword [rax]
movabs rdx, 0x6653301494f62a4b
xor rdx, qword [rax + 8]
movabs r8, 0x6e9977740a67b7bc
xor r8, qword [rax + 0x10]
mov r9d, 0x4e8d3eaf
xor r9d, dword [rax + 0x18]
movzx eax, word [rax + 0x1c]
mov r10d, eax
xor r10b, 0x63
shr eax, 8
xor al, 0xea
movzx r10d, r10b
movzx eax, al
shl eax, 8
or eax, r10d
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0xb0], r8
mov dword [rsp + 0xb8], r9d
mov word [rsp + 0xbc], ax
lea rcx, [rsp + 0x130]
lea rdx, [rsp + 0x250]
lea r8, [rsp + 0xa0]
mov r9d, 0x1e
call fcn.1400fd1e0
cmp byte [rsp + 0x130], 0x12
jne 0x140002767
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x148]
lea rax, [rdi + rdi*2]
shl rax, 4
add rax, rcx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xd8], 0
lea rcx, [rsp + 0x130]
lea rdx, [rsp + 0xa0]
call fcn.1400fba20
movabs rax, 0x8000000000000000
cmp qword [rsp + 0x130], rax
jne 0x1400037b2
mov r14d, 8
xor r15d, r15d
xor ebx, ebx
jmp 0x1400038fd
movzx eax, byte [0x140188180]
mov edx, 0x60
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x140002767
mov r14, rax
mov rax, qword [rsp + 0x140]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rsp + 0x130]
movups xmmword [r14], xmm0
mov qword [rsp + 0x70], 4
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], 1
movups xmm0, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x180], xmm0
movups xmm0, xmmword [rsp + 0xe0]
movaps xmmword [rsp + 0x170], xmm0
movdqu xmm0, xmmword [rsp + 0xa0]
movdqu xmm1, xmmword [rsp + 0xb0]
movdqu xmm2, xmmword [rsp + 0xc0]
movupd xmm3, xmmword [rsp + 0xd0]
movapd xmmword [rsp + 0x160], xmm3
movdqa xmmword [rsp + 0x150], xmm2
movdqa xmmword [rsp + 0x140], xmm1
movdqa xmmword [rsp + 0x130], xmm0
mov ebx, 1
mov esi, 0x18
lea r15, [rsp + 0x100]
lea r12, [rsp + 0x130]
lea r13, [rsp + 0x70]
jmp 0x1400038bb
mov rax, qword [rsp + 0x110]
mov qword [r14 + rsi + 0x10], rax
movdqu xmm0, xmmword [rsp + 0x100]
movdqu xmmword [r14 + rsi], xmm0
inc rbx
mov qword [rsp + 0x80], rbx
add rsi, 0x18
mov rcx, r15
mov rdx, r12
call fcn.1400fba20
movabs rax, 0x8000000000000000
cmp qword [rsp + 0x100], rax
je 0x1400038f3
cmp rbx, qword [rsp + 0x70]
jne 0x140003890
mov rcx, r13
mov rdx, rbx
call fcn.1400fa840
mov r14, qword [rsp + 0x78]
jmp 0x140003890
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
lea rax, [rbx*8]
lea rcx, [rax + rax*2]
mov rax, r14
nop dword [rax]
mov r12, rcx
test rcx, rcx
je 0x140003934
mov rdx, qword [rax + 0x10]
cmp rdx, 0x40
je 0x140003934
add rax, 0x18
lea rcx, [r12 - 0x18]
cmp rdx, 0x80
jne 0x140003910
test rbx, rbx
jne 0x140003d43
test r15, r15
je 0x140003953
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, r14
call sub.KERNEL32.dll_HeapFree
test rdi, rdi
je 0x140003971
mov rbx, qword [rsp + 0x68]
nop dword [rax]
mov rcx, rbx
call fcn.1400f7890
add rbx, 0x30
dec rdi
jne 0x140003960
cmp qword [rsp + 0x48], 0
je 0x14000398c
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, qword [rsp + 0x68]
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [rsp + 0x250]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rdx, [0x14017da30]
lea rsi, [rsp + 0x130]
mov r8d, 0xa
mov rcx, rsi
call fcn.14010ca10
cmp byte [rsp + 0x130], 0x12
jne 0x140002767
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x100], rax
lea rax, [0x140179d54]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x265154c01a70a718
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f5d30
movabs rcx, 0x8fbf27517157894e
xor rcx, qword [rax]
movabs rdx, 0xe4474cdb01f36d9b
xor rdx, qword [rax + 8]
movabs r8, 0xe2bbaf70b6596c95
xor r8, qword [rax + 0x10]
mov r9d, 0x7de97f9a
xor r9d, dword [rax + 0x18]
movzx r10d, byte [rax + 0x1e]
movzx eax, word [rax + 0x1c]
mov r11d, eax
shr r11d, 8
xor al, 0x77
xor r11b, 0xc4
movzx eax, al
movzx r11d, r11b
shl r11d, 8
or r11d, eax
xor r10b, 0x58
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0xb0], r8
mov dword [rsp + 0xb8], r9d
mov word [rsp + 0xbc], r11w
mov byte [rsp + 0xbe], r10b
lea rcx, [rsp + 0x130]
lea rdx, [rsp + 0x100]
lea r8, [rsp + 0xa0]
mov r9d, 0x1f
call fcn.1400fd1e0
cmp byte [rsp + 0x130], 0x12
jne 0x140002767
mov rdi, qword [rsp + 0x138]
mov rsi, qword [rsp + 0x140]
mov r14, qword [rsp + 0x148]
test r14, r14
je 0x140003b01
mov r15, rsi
mov rbx, r14
nop dword [rax + rax]
mov rcx, r15
call fcn.1400f7890
add r15, 0x30
dec rbx
jne 0x140003af0
test rdi, rdi
je 0x140003b17
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov edi, 0x9a7ecbe7
mov rcx, qword [rsp + 0x100]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rsi, [rsp + 0x130]
mov rcx, rsi
call fcn.140108490
mov rcx, rsi
call fcn.140108750
mov r13, qword [rsp + 0x1f0]
lea rbx, [rdi + 0x45813419]
mov rcx, rsi
call fcn.1400f65b0
lea r15, [rsp + 0x130]
mov rcx, r15
call fcn.140108490
mov rcx, r15
call fcn.140108750
call sub.KERNEL32.dll_GetTickCount64
mov rsi, rax
mov rcx, r15
call fcn.1400f65b0
movzx eax, byte [rsp + 0x98]
or al, byte [rsp + 0x60]
or al, bpl
jne 0x140003d77
test r12, r12
jne 0x140003d77
cmp r14, 2
jb 0x140003d77
cmp r13, rbx
jb 0x140003d77
mov eax, 0x9a7ecbe7
cmp rsi, rax
ja 0x140003d77
mov qword [rsp + 0xa0], 0
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x130], 0
mov dword [rsp + 0x100], 0
call sub.KERNEL32.dll_GetCurrentProcess
lea rdx, [rsp + 0x100]
mov rcx, rax
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea rsi, [rsp + 0xa0]
mov rcx, rax
mov edx, 7
mov r8, rsi
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x70]
mov rcx, rax
mov edx, 0x1f
mov r9d, 4
call sub.ntdll.dll_NtQueryInformationProcess
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x130]
mov rcx, rax
mov edx, 0x1e
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
cmp dword [rsp + 0x100], 0
jne 0x14000461f
cmp qword [rsp + 0xa0], 0
jne 0x14000461f
cmp dword [rsp + 0x70], 0
je 0x14000461f
cmp qword [rsp + 0x130], 0
jne 0x14000461f
lea rcx, [rsp + 0x130]
call fcn.1400f1000
mov rdi, qword [rsp + 0x130]
movabs rax, 0x8000000000000000
cmp rdi, rax
jne 0x140004639
mov rax, qword [rsp + 0x138]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x140004a34
test rcx, rcx
je 0x140004a34
lea rbx, [rax - 1]
mov r15, qword [rax - 1]
mov rdi, qword [rax + 7]
mov rcx, r15
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x140003d32
cmp qword [rdi + 0x10], 0x11
jb 0x140003d21
mov r15, qword [r15 - 8]
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rbx
jmp 0x14000466b
lea rsi, [r14 + 8]
jmp 0x140003d5d
add rsi, 0x18
dec rbx
je 0x14000393d
cmp qword [rsi - 8], 0
je 0x140003d50
mov r8, qword [rsi]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x140003d50
lea rax, [0x140172205]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x19545ba874134d44
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f5790
movabs rcx, 0x177edbaecabe1210
xor rcx, qword [rax]
mov edx, 0x4d64c8cb
xor edx, dword [rax + 8]
movzx eax, word [rax + 0xc]
mov r8d, eax
xor r8b, 0x55
shr eax, 8
xor al, 0x9c
movzx r8d, r8b
movzx eax, al
shl eax, 8
or eax, r8d
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x78], edx
mov word [rsp + 0x7c], ax
lea rax, [rsp + 0x70]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 0xe
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x100], rax
lea rax, [0x1400fd070]
mov qword [rsp + 0x108], rax
lea r15, [0x14017cce8]
mov qword [rsp + 0x130], r15
mov qword [rsp + 0x138], 2
mov qword [rsp + 0x150], 0
lea rax, [rsp + 0x100]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 1
lea rdi, [rsp + 0x130]
mov rcx, rdi
call fcn.1400ee730
cmp byte [rsp + 0x98], 0
je 0x1400042ee
lea rax, [0x140170d1c]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x7266fbabdae8102e
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f57f0
movabs rcx, 0x631cf2ec5cdd0113
xor rcx, qword [rax]
movabs rdx, 0xfefdc320556085cc
xor rdx, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov r8d, eax
xor r8b, 0xec
shr eax, 8
xor al, 0xed
movzx r8d, r8b
movzx eax, al
shl eax, 8
or eax, r8d
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rdx
mov word [rsp + 0xb0], ax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 0x12
lea rax, [rsp + 0x100]
mov qword [rsp + 0x70], rax
lea rax, [0x1400fd070]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x130], r15
mov qword [rsp + 0x138], 2
mov qword [rsp + 0x150], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 1
lea rcx, [rsp + 0x130]
call fcn.1400ee730
cmp byte [rsp + 0x60], 0
jne 0x1400042f9
test bpl, bpl
je 0x1400043d7
lea rax, [0x140177f09]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0xdb8890ba34b38e3c
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f58c0
movabs rcx, 0xce1571673a161d59
xor rcx, qword [rax]
movabs rdx, 0xf1e2afc670d8e1b
xor rdx, qword [rax + 8]
movzx eax, word [rax + 0x10]
mov r8d, eax
xor r8b, 0x5c
shr eax, 8
xor al, 0x34
movzx r8d, r8b
movzx eax, al
shl eax, 8
or eax, r8d
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rdx
mov word [rsp + 0xb0], ax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 0x12
lea rax, [rsp + 0x100]
mov qword [rsp + 0x70], rax
lea rax, [0x1400fd070]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x130], r15
mov qword [rsp + 0x138], 2
mov qword [rsp + 0x150], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 1
lea rcx, [rsp + 0x130]
call fcn.1400ee730
test r12, r12
jne 0x1400043e0
cmp r14, 2
jae 0x140004511
lea rax, [0x14016d8cf]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0xa4d3b9916ceb73d6
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f5a60
movabs rcx, 0xbced0d85c8d249d1
xor rcx, qword [rax]
movabs rdx, 0x4a3cca3bb6e9c64b
xor rdx, qword [rax + 8]
movzx r8d, byte [rax + 0x12]
movzx eax, word [rax + 0x10]
mov r9d, eax
shr r9d, 8
xor al, 0x46
xor r9b, 0xb3
movzx eax, al
movzx r9d, r9b
shl r9d, 8
or r9d, eax
xor r8b, 3
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rdx
mov word [rsp + 0xb0], r9w
mov byte [rsp + 0xb2], r8b
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 0x13
lea rax, [rsp + 0x100]
mov qword [rsp + 0x70], rax
lea rax, [0x1400fd070]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x130], r15
mov qword [rsp + 0x138], 2
mov qword [rsp + 0x150], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 1
lea rcx, [rsp + 0x130]
call fcn.1400ee730
cmp r13, rbx
jb 0x14000451a
mov eax, 0x9a7ecbe7
cmp rsi, rax
jbe 0x14000461a
lea rax, [0x140172056]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x2f60da37f12d2a16
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f61f0
movabs rcx, 0xa99b7aeb2486b2e6
xor rcx, qword [rax]
movabs rdx, 0xd41233841e094888
xor rdx, qword [rax + 8]
mov r8d, 0xde3dac15
xor r8d, dword [rax + 0x10]
movzx eax, word [rax + 0x14]
mov r9d, eax
xor r9b, 0x8a
and eax, 0xff00
movzx r9d, r9b
or r9d, eax
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rdx
mov dword [rsp + 0xb0], r8d
mov word [rsp + 0xb4], r9w
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 0x16
lea rax, [rsp + 0x100]
mov qword [rsp + 0x70], rax
lea rax, [0x1400fd070]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x130], r15
mov qword [rsp + 0x138], 2
mov qword [rsp + 0x150], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 1
lea rcx, [rsp + 0x130]
call fcn.1400ee730
call fcn.1400edd50
cmp byte [rsp + 0x60], 0
je 0x140003f92
lea rax, [0x14017460d]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0xa15731d27c5c1315
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f6370
movabs rcx, 0xadddfc9d15a9cd3a
xor rcx, qword [rax]
mov edx, 0x5b84e2fa
xor edx, dword [rax + 8]
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x78], edx
lea rax, [rsp + 0x70]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 0xc
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x100], rax
lea rax, [0x1400fd070]
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x130], r15
mov qword [rsp + 0x138], 2
mov qword [rsp + 0x150], 0
lea rax, [rsp + 0x100]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 1
lea rcx, [rsp + 0x130]
call fcn.1400ee730
test bpl, bpl
jne 0x140003f9b
test r12, r12
je 0x1400040a5
lea rax, [0x14017c8ac]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x4518ec5dcf602f98
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f61a0
movabs rcx, 0xf4b0fe283d6a8d49
xor rcx, qword [rax]
movabs rdx, 0x4528210d85c4f9d2
xor rdx, qword [rax + 8]
mov r8d, 0x603d90a9
xor r8d, dword [rax + 0x10]
movzx r9d, byte [rax + 0x16]
movzx eax, word [rax + 0x14]
mov r10d, eax
shr r10d, 8
xor al, 0x1d
xor r10b, 0xee
movzx eax, al
movzx r10d, r10b
shl r10d, 8
or r10d, eax
xor r9b, 0x33
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rdx
mov dword [rsp + 0xb0], r8d
mov word [rsp + 0xb4], r10w
mov byte [rsp + 0xb6], r9b
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 0x17
lea rax, [rsp + 0x100]
mov qword [rsp + 0x70], rax
lea rax, [0x1400fd070]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x130], r15
mov qword [rsp + 0x138], 2
mov qword [rsp + 0x150], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 1
lea rcx, [rsp + 0x130]
call fcn.1400ee730
cmp r14, 2
jb 0x1400040af
cmp r13, rbx
jae 0x1400041cd
lea rax, [0x140174c25]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x14ee0fde57a0a558
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f5c70
movabs rcx, 0x7438c44b1e8bf179
xor rcx, qword [rax]
movabs rdx, 0x9133f695fa83d073
xor rdx, qword [rax + 8]
movabs r8, 0xfdc36b9b13c50dc5
xor r8, qword [rax + 0x10]
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0xb0], r8
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 0x18
lea rax, [rsp + 0x100]
mov qword [rsp + 0x70], rax
lea rax, [0x1400fd070]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x130], r15
mov qword [rsp + 0x138], 2
mov qword [rsp + 0x150], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], 1
lea rcx, [rsp + 0x130]
call fcn.1400ee730
mov eax, 0x9a7ecbe7
cmp rsi, rax
ja 0x1400041db
call fcn.1400edd50
call fcn.14003ff90
call fcn.1400edd50
xor ebp, ebp
test r12, r12
jne 0x1400035c6
jmp 0x1400035e1
mov r13, qword [rsp + 0x138]
mov rdx, qword [rsp + 0x140]
mov rcx, r13
call fcn.1400e8bc0
test rax, rax
jne 0x140004675
test rdi, rdi
je 0x140004a34
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, r13
call sub.KERNEL32.dll_HeapFree
jmp 0x140004a34
mov r8, rdx
lea rcx, [rsp + 0x130]
mov rdx, rax
call fcn.1400ef070
mov rbp, qword [rsp + 0x138]
mov r15, qword [rsp + 0x140]
mov r12d, 1
test r15, r15
je 0x1400046c6
js 0x140002767
movzx eax, byte [0x140188180]
xor ecx, ecx
mov rdx, r15
call fcn.1400f2120
mov r12, rax
test rax, rax
je 0x140002767
mov rcx, r12
mov rdx, rbp
mov r8, r15
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x130]
shl rax, 1
test rax, rax
je 0x1400046f5
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rbp
call sub.KERNEL32.dll_HeapFree
test rdi, rdi
je 0x14000470b
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, r13
call sub.KERNEL32.dll_HeapFree
lea rdi, [rsp + 0x130]
mov rcx, rdi
call fcn.140108490
mov rcx, rdi
call fcn.140108750
mov rdi, qword [rsp + 0x1c0]
mov rbp, qword [rsp + 0x1d8]
movdqa xmm0, xmmword [rdi]
pmovmskb ebx, xmm0
not ebx
lea r14, [rdi + 0x10]
xor r13d, r13d
jmp 0x140004770
add rax, rdi
mov rcx, qword [rax - 0x138]
mov rdx, r12
mov r8, r15
call sub.msvcrt.dll_memcmp
test eax, eax
sete al
lea ecx, [rbx - 1]
and ecx, ebx
movzx eax, al
add r13, rax
dec rbp
mov ebx, ecx
test bx, bx
jne 0x14000479e
test rbp, rbp
je 0x1400047ba
nop word [rax + rax]
movdqa xmm0, xmmword [r14]
pmovmskb ebx, xmm0
add rdi, 0xffffffffffffea80
add r14, 0x10
cmp ebx, 0xffff
je 0x140004780
not ebx
tzcnt eax, ebx
neg rax
imul rax, rax, 0x158
cmp qword [rdi + rax - 0x130], r15
je 0x140004746
xor eax, eax
jmp 0x140004760
lea rcx, [rsp + 0x1c0]
call fcn.1400f74e0
cmp qword [rsp + 0x130], 0
je 0x1400047e8
mov r8, qword [rsp + 0x138]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x178]
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x14000481a
test rax, rax
je 0x14000481a
mov r8, qword [rsp + 0x180]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x148], 0
je 0x14000483b
mov r8, qword [rsp + 0x150]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x160], 0
je 0x14000485c
mov r8, qword [rsp + 0x168]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [rsp + 0x1a8]
mov rdx, qword [rsp + 0x1b0]
call fcn.1400fafb0
cmp qword [rsp + 0x1a0], 0
je 0x140004892
mov r8, qword [rsp + 0x1a8]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x210], 0
je 0x140004909
lea rcx, [rsp + 0x210]
call fcn.140104670
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140004909
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0x228]
test r14, r14
jne 0x140004cf0
mov rcx, qword [rsp + 0x68]
mov rax, rcx
shl rax, 5
add rcx, rax
cmp rcx, 0xffffffffffffffcf
je 0x140004909
mov r8, qword [rsp + 0x48]
sub r8, rax
add r8, 0xffffffffffffffe0
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
test r15, r15
je 0x14000491f
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, r12
call sub.KERNEL32.dll_HeapFree
cmp r13, 1
jbe 0x140004a34
lea rax, [0x14011bdbc]
mov qword [rsp + 0x130], rax
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x130]
movabs rax, 0xa02786f44e68f442
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f5ca0
movabs rcx, 0xfe27532b47476f19
xor rcx, qword [rax]
movabs rdx, 0xde84be4c9c05184a
xor rdx, qword [rax + 8]
movabs r8, 0xab71274760ee47aa
xor r8, qword [rax + 0x10]
movabs r9, 0x9c0e02817ca991eb
xor r9, qword [rax + 0x18]
movabs r10, 0xb2fb2dd7d79f996e
xor r10, qword [rax + 0x20]
mov r11d, 0x3f756897
xor r11d, dword [rax + 0x28]
movzx eax, byte [rax + 0x2c]
xor al, 0x24
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0xb0], r8
mov qword [rsp + 0xb8], r9
mov qword [rsp + 0xc0], r10
mov dword [rsp + 0xc8], r11d
mov byte [rsp + 0xcc], al
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0x108], 0x2d
lea rax, [rsp + 0x100]
mov qword [rsp + 0x70], rax
lea rax, [0x1400fd070]
mov qword [rsp + 0x78], rax
lea rax, [0x14017cce8]
mov qword [rsp + 0x130], rax
jmp 0x1400042ab
lea rax, [0x14010edf8]
mov qword [rsp + 0x130], rax
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x130]
movabs rax, 0x25d66fbb7857bf0a
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f57d0
mov ecx, dword [rax]
movzx edx, byte [rax + 6]
movzx eax, word [rax + 4]
mov r8d, eax
shr r8d, 8
xor al, 0xa2
xor r8b, 0xaa
movzx eax, al
movzx r8d, r8b
shl r8d, 8
or r8d, eax
xor dl, 0x41
movzx eax, dl
mov byte [rsp + 0x26e], al
shl rax, 0x30
movzx edx, r8w
shl rdx, 0x20
or rdx, rax
xor ecx, 0xd9a9a035
mov dword [rsp + 0x268], ecx
shr rdx, 0x20
mov word [rsp + 0x26c], dx
lea rax, [rsp + 0x268]
mov qword [rsp + 0x2b0], rax
mov qword [rsp + 0x2b8], 7
lea rbx, [rsp + 0x130]
mov rcx, rbx
call fcn.1400f1000
lea rax, [0x140117049]
mov qword [rsp + 0xa0], rax
mov rcx, qword [rsp + 0xa0]
movabs rax, 0xf84d670183f2e7f4
mov qword [rsp + 0xa0], rax
mov rdx, qword [rsp + 0xa0]
call fcn.1400f5d60
mov rcx, qword [rax]
mov rcx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov ecx, dword [rax + 0x20]
movzx eax, byte [rax + 0x24]
mov rdi, qword [rsp + 0x130]
movabs rax, 0x8000000000000000
cmp rdi, rax
je 0x140002767
mov r14, qword [rsp + 0x138]
mov r15, qword [rsp + 0x140]
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 1
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0x160], 0x20
mov byte [rsp + 0x168], 3
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x150], rsi
lea rax, method._p4.virtual_0
mov qword [rsp + 0x158], rax
lea r13, [r14 + r15]
xor eax, eax
lea r12, [0x14017ccb0]
cmp rax, r15
je 0x140004d64
lea rdx, [r14 + rax]
mov rbp, rax
mov r8, rdx
jmp 0x140004c18
add r8, 2
cmp rcx, r13
cmovne rcx, r8
mov r10d, 2
add rbp, r10
mov r8, rcx
cmp rcx, r13
je 0x140004d67
lea rcx, [r8 + 1]
movzx r9d, byte [r8]
mov r10d, 1
test r9b, r9b
jns 0x140004c09
cmp r9b, 0xe0
jb 0x140004bf8
cmp r9b, 0xed
jne 0x140004c63
cmp rcx, r13
je 0x140004d67
lea rcx, [r8 + 2]
cmp rcx, r13
je 0x140004d67
cmp byte [r8 + 1], 0x9f
ja 0x140004c9d
add r8, 3
mov r10d, 3
mov rcx, r8
jmp 0x140004c09
add r8, 2
cmp rcx, r13
cmove r8, rcx
xor ecx, ecx
cmp r8, r13
setne cl
add rcx, r8
mov r10d, 3
cmp r9b, 0xf0
jb 0x140004c09
xor r8d, r8d
cmp rcx, r13
setne r8b
add rcx, r8
mov r10d, 4
jmp 0x140004c09
mov r8, rbp
sub r8, rax
jb 0x140002767
cmp rbp, r15
ja 0x140002767
mov rcx, rsi
call fcn.1400018d0
test al, al
jne 0x140002767
mov r8d, 3
mov rcx, rsi
mov rdx, r12
call fcn.1400018d0
test al, al
jne 0x140002767
add rbp, 3
mov rax, rbp
cmp rbp, r15
jbe 0x140004be3
jmp 0x140002767
mov rbp, qword [rsp + 0x48]
movdqa xmm0, xmmword [rbp]
pmovmskb edi, xmm0
not edi
lea rbx, [rbp + 0x10]
jmp 0x140004d19
dec r14
lea eax, [rdi - 1]
and eax, edi
mov edi, eax
test r14, r14
je 0x1400048da
test di, di
jne 0x140004d3b
movdqa xmm0, xmmword [rbx]
pmovmskb edi, xmm0
add rbp, 0xfffffffffffffe00
add rbx, 0x10
cmp edi, 0xffff
je 0x140004d1e
not edi
tzcnt ecx, edi
shl rcx, 5
mov rax, rbp
sub rax, rcx
cmp qword [rax - 0x20], 0
je 0x140004d06
mov r8, qword [rax - 0x18]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x140004d06
mov rax, r15
sub r15, rax
lea rdx, [r14 + rax]
test rax, rax
jne 0x140004d85
lea rcx, [rsp + 0x130]
mov r8, r15
call fcn.1400357a0
jmp 0x140004d95
lea rcx, [rsp + 0xa0]
mov r8, r15
call fcn.1400018d0
test al, al
jne 0x140002767
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x80], rax
movdqu xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x70], xmm0
test rdi, rdi
je 0x140004dd2
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, r14
call sub.KERNEL32.dll_HeapFree
lea rax, [0x140118e4a]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x2d2488a03dc41fe3
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f62f0
movabs rcx, 0xc1f444bc2868bcc4
xor rcx, qword [rax]
movabs rdx, 0xbc6baa38651fe1ad
xor rdx, qword [rax + 8]
mov r8d, 0xecb51b6e
xor r8d, dword [rax + 0x10]
mov qword [rsp + 0x250], rcx
mov qword [rsp + 0x258], rdx
mov dword [rsp + 0x260], r8d
lea rax, [rsp + 0x250]
mov qword [rsp + 0x2c0], rax
mov qword [rsp + 0x2c8], 0x14
lea rax, [0x140119639]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x29d7f9c5105c8773
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f5b30
movabs rcx, 0xd7a75aa99733721
xor rcx, qword [rax]
mov edx, 0x3a2d9ded
xor edx, dword [rax + 8]
movzx r8d, byte [rax + 0xe]
movzx eax, word [rax + 0xc]
mov r9d, eax
shr r9d, 8
xor al, 0x85
xor r9b, 0x5d
movzx eax, al
movzx r9d, r9b
shl r9d, 8
or r9d, eax
xor r8b, 0x9f
mov qword [rsp + 0x278], rcx
mov dword [rsp + 0x280], edx
mov word [rsp + 0x284], r9w
mov byte [rsp + 0x286], r8b
lea rax, [rsp + 0x278]
mov qword [rsp + 0x2d0], rax
mov qword [rsp + 0x2d8], 0xf
lea rax, [0x14011af38]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x7d1af87aa73c547d
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f59f0
movabs rcx, 0x821fe17e89bd6422
xor rcx, qword [rax]
mov edx, 0xb833d2a6
xor edx, dword [rax + 8]
movzx eax, word [rax + 0xc]
mov r8d, eax
xor r8b, 0x35
shr eax, 8
xor al, 1
movzx r8d, r8b
movzx eax, al
shl eax, 8
or eax, r8d
mov qword [rsp + 0x298], rcx
mov dword [rsp + 0x2a0], edx
mov word [rsp + 0x2a4], ax
lea rax, [rsp + 0x298]
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x290], 0xe
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x130], rax
lea rcx, [0x1400fd070]
mov qword [rsp + 0x138], rcx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x140], rax
lea rax, [0x140001d20]
mov qword [rsp + 0x148], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], rcx
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], rcx
lea rax, [rsp + 0x288]
mov qword [rsp + 0x170], rax
mov qword [rsp + 0x178], rcx
lea rax, [0x14011d8b8]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 5
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], 5
lea rcx, [rsp + 0x100]
lea rsi, [rsp + 0xa0]
mov rdx, rsi
call fcn.140034610
lea rax, [0x1401159c6]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
movabs rax, 0x5a2528e3d8560114
mov qword [rsp + 0x130], rax
mov rdx, qword [rsp + 0x130]
call fcn.1400f5e70
mov edi, dword [rax]
movzx ebx, word [rax + 4]
movzx ebp, byte [rax + 6]
movzx eax, byte [0x140188180]
mov edx, 7
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x140002767
shl ebp, 0x10
or ebx, ebp
mov ecx, ebx
xor cl, 0x46
mov edx, ebx
shr edx, 8
xor dl, 0x52
movzx ecx, cl
movzx edx, dl
shl edx, 8
or edx, ecx
movzx ecx, dx
shl rcx, 0x20
shr ebx, 0x10
xor bl, 0x13
movzx edx, bl
mov byte [rax + 6], dl
shl rdx, 0x30
or rdx, rcx
xor edi, 0x3bf4b43f
mov dword [rax], edi
shr rdx, 0x20
mov word [rax + 4], dx
mov qword [rsp + 0x130], 7
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], 7
mov byte [rsp + 0x148], 0
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x158], 8
mov qword [rsp + 0x160], 0
mov qword [rsp + 0x1b8], 0
mov qword [rsp + 0x1c8], 0
mov word [rsp + 0x1d0], 0
movabs rax, 0x8000000000000000
mov qword [rsp + 0x168], rax
mov word [rsp + 0x1f4], 0
mov dword [rsp + 0x188], 6
mov dword [rsp + 0x198], 6
mov dword [rsp + 0x1a8], 6
mov qword [rsp + 0x1d8], 0
mov qword [rsp + 0x1e8], 0
mov dword [rsp + 0x1f0], 0x8000000
lea rax, [0x14010feab]
mov qword [rsp + 0xa0], rax
mov rcx, qword [rsp + 0xa0]
movabs rax, 0x485515fff733d357
mov qword [rsp + 0xa0], rax
mov rdx, qword [rsp + 0xa0]
call fcn.1400f5990
movzx edi, word [rax]
movzx eax, byte [0x140188180]
mov edx, 2
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x140002767
mov r14, rax
lea rsi, [rsp + 0x150]
mov eax, edi
xor al, 0x1d
shr edi, 8
xor dil, 0xe6
movzx ecx, dil
shl ecx, 8
movzx eax, al
or eax, ecx
mov word [r14], ax
mov rbx, qword [rsp + 0x160]
mov edi, 8
cmp rbx, qword [rsp + 0x150]
jne 0x14000529f
mov rcx, rsi
mov rdx, rbx
call fcn.1400e5fc0
mov rdi, qword [rsp + 0x158]
mov rbx, qword [rsp + 0x160]
lea rax, [rbx + rbx*4]
mov qword [rdi + rax*8], 0
mov qword [rdi + rax*8 + 8], 2
mov qword [rdi + rax*8 + 0x10], r14
mov qword [rdi + rax*8 + 0x18], 2
mov byte [rdi + rax*8 + 0x20], 0
inc rbx
mov qword [rsp + 0x160], rbx
mov r14, qword [rsp + 0x108]
mov r15, qword [rsp + 0x110]
mov r12d, 1
test r15, r15
je 0x140005310
js 0x140002767
movzx eax, byte [0x140188180]
xor ecx, ecx
mov rdx, r15
call fcn.1400f2120
mov r12, rax
test rax, rax
je 0x140002767
mov rcx, r12
mov rdx, r14
mov r8, r15
call sub.msvcrt.dll_memcpy
cmp rbx, qword [rsp + 0x150]
jne 0x140005343
mov rcx, rsi
mov rdx, rbx
call fcn.1400e5fc0
mov rdi, qword [rsp + 0x158]
mov rbx, qword [rsp + 0x160]
lea rax, [rbx + rbx*4]
mov qword [rdi + rax*8], 0
mov qword [rdi + rax*8 + 8], r15
mov qword [rdi + rax*8 + 0x10], r12
mov qword [rdi + rax*8 + 0x18], r15
mov byte [rdi + rax*8 + 0x20], 0
inc rbx
mov qword [rsp + 0x160], rbx
cmp qword [rsp + 0x100], 0
je 0x14000538a
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, r14
call sub.KERNEL32.dll_HeapFree
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x130]
call fcn.1400e9d90
lea rax, [0x14010dae3]
mov qword [rsp + 0x250], rax
lea rdx, [rsp + 0x250]
mov rcx, qword [rsp + 0x250]
movabs rax, 0x5a5e2562fd5f73c
mov qword [rsp + 0x250], rax
mov rdx, qword [rsp + 0x250]
call fcn.1400f5e90
mov rcx, qword [rax]
mov rcx, qword [rax + 8]
mov ecx, dword [rax + 0x10]
movzx ecx, byte [rax + 0x16]
movzx eax, word [rax + 0x14]
mov r13, qword [rsp + 0xa0]
cmp r13, 2
je 0x140002767
mov rbx, qword [rsp + 0xa8]
mov r12, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xb8]
mov r15, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xd0]
mov r14, qword [rsp + 0xd8]
call sub.KERNEL32.dll_CloseHandle
mov rcx, r14
call sub.KERNEL32.dll_CloseHandle
test r13, r13
jne 0x140005472
test r12, r12
jne 0x14000547f
test r15, r15
jne 0x14000548c
cmp qword [rsp + 0x130], 0
jne 0x14000549f
mov rsi, qword [rsp + 0x160]
test rsi, rsi
je 0x1400054c2
jmp 0x14000551a
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
test r12, r12
je 0x140005450
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
test r15, r15
je 0x140005455
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
cmp qword [rsp + 0x130], 0
je 0x140005460
mov r8, qword [rsp + 0x138]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rsi, qword [rsp + 0x160]
test rsi, rsi
jne 0x14000551a
cmp qword [rsp + 0x150], 0
je 0x1400054e3
mov r8, qword [rsp + 0x158]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rdi, qword [rsp + 0x1b8]
test rdi, rdi
je 0x140005811
mov rbx, qword [rsp + 0x1c8]
mov r14, qword [rsp + 0x1c0]
test rbx, rbx
jne 0x14000554b
test r14, r14
jne 0x140005757
mov rsi, rdi
jmp 0x1400057cc
mov rdi, qword [rsp + 0x158]
add rdi, 0x10
jmp 0x140005531
add rdi, 0x28
dec rsi
je 0x1400054c2
cmp qword [rdi - 8], 0
je 0x140005528
mov r8, qword [rdi]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x140005528
xor esi, esi
mov r13, rdi
jmp 0x140005561
mov r13d, 0
dec rbx
je 0x14000573a
test rsi, rsi
jne 0x1400055e1
test r14, r14
je 0x14000558c
mov rcx, r14
and rcx, 7
je 0x140005591
mov rax, r14
and rax, 0xfffffffffffffff8
mov rsi, r13
mov rsi, qword [rsi + 0x3d8]
dec rcx
jne 0x14000557e
jmp 0x140005597
mov rsi, r13
jmp 0x1400055db
mov rsi, r13
mov rax, r14
cmp r14, 8
jb 0x1400055db
mov rcx, qword [rsi + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rsi, qword [rcx + 0x3d8]
add rax, 0xfffffffffffffff8
jne 0x14000559d
xor r14d, r14d
xor r13d, r13d
movzx eax, word [rsi + 0x3d2]
mov r12, r14
mov r15, rsi
cmp r14, rax
jb 0x14000562c
mov r15, qword [rsi + 0x160]
test r15, r15
je 0x140005a88
inc r13
movzx r12d, word [rsi + 0x3d0]
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rsi, r15
cmp r12w, word [r15 + 0x3d2]
jae 0x1400055f3
test r13, r13
je 0x1400056af
mov rsi, qword [r15 + r12*8 + 0x3e0]
mov rax, r13
dec rax
je 0x1400056aa
mov rcx, rax
and rcx, 7
je 0x140005662
mov rax, rcx
mov rsi, qword [rsi + 0x3d8]
dec rax
jne 0x14000564d
not rcx
add rcx, r13
mov rax, rcx
add r13, 0xfffffffffffffffe
cmp r13, 7
jb 0x1400056aa
mov rcx, qword [rsi + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rsi, qword [rcx + 0x3d8]
add rax, 0xfffffffffffffff8
jne 0x14000566c
xor r14d, r14d
jmp 0x1400056b7
lea r14, [r12 + 1]
mov rsi, r15
imul rax, r12, 0x38
lea r13, [r15 + rax]
add r13, 0x168
cmp qword [r15 + rax + 0x168], 0
je 0x1400056e3
mov r8, qword [r13 + 8]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [r13 + 0x20], 0
je 0x1400056fc
mov r8, qword [r13 + 0x28]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
shl r12, 5
mov rax, qword [r15 + r12]
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x140005552
test rax, rax
je 0x140005552
add r15, r12
mov r8, qword [r15 + 8]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x140005552
test rdi, rdi
je 0x140005811
test rsi, rsi
jne 0x1400057cc
xor edi, edi
test r14, r14
je 0x140005512
mov rcx, r14
and rcx, 7
jne 0x140005768
mov rsi, rdi
mov rax, r14
jmp 0x14000577e
mov rax, r14
and rax, 0xfffffffffffffff8
mov rdi, qword [rdi + 0x3d8]
dec rcx
jne 0x14000576f
mov rsi, rdi
cmp r14, 8
jae 0x14000578e
test rsi, rsi
jne 0x1400057cc
jmp 0x140005811
mov rcx, qword [rsi + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rsi, qword [rcx + 0x3d8]
add rax, 0xfffffffffffffff8
jne 0x14000578e
mov rax, qword [rsi + 0x160]
test rax, rax
jne 0x1400057dd
mov rdi, rsi
jmp 0x140005800
mov rdi, rax
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rdi + 0x160]
mov rsi, rdi
test rax, rax
jne 0x1400057dd
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x168]
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x140005843
test rax, rax
je 0x140005843
mov r8, qword [rsp + 0x170]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov eax, dword [rsp + 0x188]
cmp eax, 4
jb 0x140005861
cmp eax, 6
je 0x140005861
mov rcx, qword [rsp + 0x190]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [rsp + 0x198]
cmp eax, 4
jb 0x14000587f
cmp eax, 6
je 0x14000587f
mov rcx, qword [rsp + 0x1a0]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [rsp + 0x1a8]
cmp eax, 4
jb 0x14000589d
cmp eax, 6
je 0x14000589d
mov rcx, qword [rsp + 0x1b0]
call sub.KERNEL32.dll_CloseHandle
mov rbx, qword [rsp + 0x1d8]
test rbx, rbx
je 0x140005b5f
mov r14, qword [rsp + 0x1e8]
mov r15, qword [rsp + 0x1e0]
test r14, r14
jne 0x1400058d4
test r15, r15
jne 0x140005ab0
mov rsi, rbx
jmp 0x140005b22
xor esi, esi
mov rdi, rbx
jmp 0x1400058fa
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov edi, 0
dec r14
je 0x140005a97
test rsi, rsi
jne 0x140005979
test r15, r15
je 0x140005925
mov rcx, r15
and rcx, 7
je 0x14000592a
mov rax, r15
and rax, 0xfffffffffffffff8
mov rsi, rdi
mov rsi, qword [rsi + 0x170]
dec rcx
jne 0x140005917
jmp 0x140005930
mov rsi, rdi
jmp 0x140005974
mov rsi, rdi
mov rax, r15
cmp r15, 8
jb 0x140005974
mov rcx, qword [rsi + 0x170]
mov rcx, qword [rcx + 0x170]
mov rcx, qword [rcx + 0x170]
mov rcx, qword [rcx + 0x170]
mov rcx, qword [rcx + 0x170]
mov rcx, qword [rcx + 0x170]
mov rcx, qword [rcx + 0x170]
mov rsi, qword [rcx + 0x170]
add rax, 0xfffffffffffffff8
jne 0x140005936
xor r15d, r15d
xor edi, edi
movzx eax, word [rsi + 0x16a]
mov r13, r15
mov r12, rsi
cmp r15, rax
jb 0x1400059c1
mov r12, qword [rsi]
test r12, r12
je 0x140005a88
inc rdi
movzx r13d, word [rsi + 0x168]
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rsi, r12
cmp r13w, word [r12 + 0x16a]
jae 0x14000598b
test rdi, rdi
je 0x140005a44
mov rsi, qword [r12 + r13*8 + 0x178]
mov rax, rdi
dec rax
je 0x140005a3f
mov rcx, rax
and rcx, 7
je 0x1400059f7
mov rax, rcx
mov rsi, qword [rsi + 0x170]
dec rax
jne 0x1400059e2
not rcx
add rcx, rdi
mov rax, rcx
add rdi, 0xfffffffffffffffe
cmp rdi, 7
jb 0x140005a3f
mov rcx, qword [rsi + 0x170]
mov rcx, qword [rcx + 0x170]
mov rcx, qword [rcx + 0x170]
mov rcx, qword [rcx + 0x170]
mov rcx, qword [rcx + 0x170]
mov rcx, qword [rcx + 0x170]
mov rcx, qword [rcx + 0x170]
mov rsi, qword [rcx + 0x170]
add rax, 0xfffffffffffffff8
jne 0x140005a01
xor r15d, r15d
jmp 0x140005a4b
lea r15, [r13 + 1]
mov rsi, r12
lea rax, [r13*2]
add rax, r13
mov rdi, qword [r12 + rax*8 + 0x60]
mov r12, qword [r12 + rax*8 + 0x68]
mov rcx, rdi
call qword [r12]
cmp qword [r12 + 8], 0
je 0x1400058ec
cmp qword [r12 + 0x10], 0x11
jb 0x1400058db
mov rdi, qword [rdi - 8]
jmp 0x1400058db
mov edx, 8
mov rcx, rsi
call fcn.140009360
ud2
test rbx, rbx
je 0x140005b5f
test rsi, rsi
jne 0x140005b22
xor ebx, ebx
test r15, r15
je 0x1400058cc
mov rcx, r15
and rcx, 7
jne 0x140005ac1
mov rsi, rbx
mov rax, r15
jmp 0x140005ad7
mov rax, r15
and rax, 0xfffffffffffffff8
mov rbx, qword [rbx + 0x170]
dec rcx
jne 0x140005ac8
mov rsi, rbx
cmp r15, 8
jae 0x140005ae4
test rsi, rsi
jne 0x140005b22
jmp 0x140005b5f
mov rcx, qword [rsi + 0x170]
mov rcx, qword [rcx + 0x170]
mov rcx, qword [rcx + 0x170]
mov rcx, qword [rcx + 0x170]
mov rcx, qword [rcx + 0x170]
mov rcx, qword [rcx + 0x170]
mov rcx, qword [rcx + 0x170]
mov rsi, qword [rcx + 0x170]
add rax, 0xfffffffffffffff8
jne 0x140005ae4
mov rax, qword [rsi]
test rax, rax
jne 0x140005b2f
mov rdi, rsi
jmp 0x140005b4e
mov rdi, rax
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rdi]
mov rsi, rdi
test rax, rax
jne 0x140005b2f
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x70], 0
je 0x140005b7a
mov r8, qword [rsp + 0x78]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov r12d, 1
lea rdi, [0x140123be0]
pxor xmm6, xmm6
movdqa xmm7, xmmword [section..rdata]
movdqa xmm8, xmmword [0x140118010]
pcmpeqd xmm9, xmm9
movdqa xmm10, xmmword [str.________________]
movdqa xmm11, xmmword [0x140118080]
movdqa xmm12, xmmword [str.________________4]
xor esi, esi
xor eax, eax
mov qword [rsp + 0x48], rax
mov eax, 1
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x98], rax
lea r13, [rsp + 0x130]
jmp 0x140005c06
mov r12, qword [rsp + 0x60]
mov r14, qword [rsp + 0x48]
mov r15, qword [rsp + 0x58]
mov ecx, 0xfa
call sub.KERNEL32.dll_Sleep
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r12
mov rbx, 0xfffffffffffffff6
xor ecx, ecx
call sub.USER32.dll_OpenClipboard
mov ecx, 0
test eax, eax
jne 0x140005c2a
call sub.KERNEL32.dll_GetLastError
mov rcx, rdi
test rcx, rcx
je 0x140005c40
test rbx, rbx
je 0x140005c40
xor ecx, ecx
call sub.KERNEL32.dll_Sleep
inc rbx
jmp 0x140005c12
test rcx, rcx
je 0x140005cc1
xor ecx, ecx
xor edx, edx
mov r8d, 2
mov r9d, 0x1f0003
call sub.KERNEL32.dll_CreateWaitableTimerExW
test rax, rax
je 0x140005ef2
mov rbx, rax
mov qword [rsp + 0x130], 0xffffffffff676980
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r13
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_SetWaitableTimer
test eax, eax
je 0x140005eea
mov rcx, rbx
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov ebp, eax
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
cmp ebp, 0xffffffff
jne 0x140005efc
jmp 0x140005ef2
mov ecx, 0xd
call sub.USER32.dll_GetClipboardData
test rax, rax
je 0x140005f74
mov rbx, rax
mov rcx, rax
call sub.KERNEL32.dll_GlobalLock
test rax, rax
je 0x140005f74
mov rbp, rax
mov rcx, rbx
call sub.KERNEL32.dll_GlobalSize
mov r14, rax
shr r14, 1
movdqu xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rbp
mov r9d, r14d
call sub.KERNEL32.dll_WideCharToMultiByte
test eax, eax
je 0x140005f90
mov r15d, eax
mov r9, r13
movsxd r13, eax
cmp r13, 9
mov r8d, 8
cmovae r8, r13
mov rdx, r8
not rdx
shr rdx, 0x3f
mov qword [rsp + 0x138], 0
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x68], r8
call fcn.1400348c0
cmp qword [rsp + 0xa0], 0
mov r12, qword [rsp + 0xa8]
je 0x140005d9c
movabs rax, 0x8000000000000001
cmp r12, rax
jne 0x1400091ea
mov r12d, 1
xor eax, eax
mov qword [rsp + 0x68], rax
movdqu xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r12
mov ecx, 0xfde9
xor edx, edx
mov r8, rbp
mov r9d, r14d
call sub.KERNEL32.dll_WideCharToMultiByte
xor r14d, r14d
mov r15, r12
mov r12, qword [rsp + 0x68]
cmp byte [r15 + r14], 0
je 0x140005ddb
inc r14
cmp r13, r14
jne 0x140005dc9
mov r14, r13
mov rcx, rbx
call fcn.140034950
call sub.USER32.dll_CloseClipboard
test eax, eax
lea r13, [rsp + 0x130]
jne 0x140005df9
call sub.KERNEL32.dll_GetLastError
movabs rax, 0x8000000000000000
cmp r12, rax
je 0x140005c45
mov qword [rsp + 0x50], r15
test rsi, rsi
je 0x140005e29
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, qword [rsp + 0x60]
call sub.KERNEL32.dll_HeapFree
cmp r14, qword [rsp + 0x48]
jne 0x140005fc8
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x48]
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140005fc8
xor ecx, ecx
xor edx, edx
mov r8d, 2
mov r9d, 0x1f0003
call sub.KERNEL32.dll_CreateWaitableTimerExW
test rax, rax
je 0x140005ff3
mov rbx, rax
mov qword [rsp + 0x130], 0xffffffffffd9da60
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [rsp + 0x130]
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_SetWaitableTimer
test eax, eax
je 0x140006007
mov rcx, rbx
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov r14d, eax
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov rsi, qword [rsp + 0x68]
cmp r14d, 0xffffffff
lea r13, [rsp + 0x130]
jne 0x140005c0b
jmp 0x140006025
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
mov ecx, 0x3e8
call sub.KERNEL32.dll_Sleep
xor ecx, ecx
xor edx, edx
mov r8d, 2
mov r9d, 0x1f0003
call sub.KERNEL32.dll_CreateWaitableTimerExW
test rax, rax
je 0x140005be3
mov rbx, rax
mov qword [rsp + 0x130], 0xffffffffffd9da60
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r13
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_SetWaitableTimer
test eax, eax
je 0x140005fac
mov rcx, rbx
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov ebp, eax
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
cmp ebp, 0xffffffff
jne 0x140005c0b
jmp 0x140005be3
call sub.KERNEL32.dll_GetLastError
call sub.USER32.dll_CloseClipboard
test eax, eax
jne 0x140005c45
call sub.KERNEL32.dll_GetLastError
jmp 0x140005c45
call sub.KERNEL32.dll_GetLastError
mov rcx, rbx
call fcn.140034950
call sub.USER32.dll_CloseClipboard
test eax, eax
jne 0x140005c45
jmp 0x140005f86
mov r12, qword [rsp + 0x60]
mov r14, qword [rsp + 0x48]
mov r15, qword [rsp + 0x58]
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
jmp 0x140005bf2
test r14, r14
je 0x14000603e
js 0x140002767
movzx eax, byte [0x140188180]
xor ecx, ecx
mov rdx, r14
call fcn.1400f2120
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x140006048
jmp 0x140002767
mov r14, qword [rsp + 0x48]
mov r15, qword [rsp + 0x58]
lea r13, [rsp + 0x130]
jmp 0x14000602f
mov r14, qword [rsp + 0x48]
mov r15, qword [rsp + 0x58]
lea r13, [rsp + 0x130]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
jmp 0x140005fbb
mov r14, qword [rsp + 0x48]
mov r15, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
jmp 0x140005bf2
mov eax, 1
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov r8, r14
call sub.msvcrt.dll_memcpy
cmp qword [rsp + 0x98], 0
je 0x140006078
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, qword [rsp + 0x58]
call sub.KERNEL32.dll_HeapFree
cmp r14, 3
jb 0x140008fd9
lea rax, [r14 - 0x22]
cmp rax, 0x3d
ja case.0x14000609e.36
lea rcx, [0x1401180e4]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
or eax, 2
cmp eax, 0x33
jne case.0x14000609e.36
lea rax, [0x1401125a9]
mov qword [rsp + 0x130], rax
lea rax, [rsp + 0x130]
mov rcx, qword [rsp + 0x130]
movabs rdx, 0x9e6292261e5ecd32
mov qword [rsp + 0x130], rdx
mov rdx, qword [rsp + 0x130]
call fcn.1400f57b0
movzx esi, word [rax]
movzx ebx, byte [rax + 2]
movzx eax, byte [0x140188180]
mov edx, 3
xor ecx, ecx
call fcn.1400f2120
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140002767
shl ebx, 0x10
or esi, ebx
mov eax, esi
shr eax, 0x10
xor al, 0xcc
mov ecx, esi
xor cl, 0xb0
shr esi, 8
xor sil, 0xfb
jmp 0x140008104
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
cmp eax, 0x3174
jne case.0x14000609e.36
lea rax, [0x140112557]
mov qword [rsp + 0x130], rax
lea rax, [rsp + 0x130]
mov rcx, qword [rsp + 0x130]
movabs rdx, 0x3e473bddb4adf890
mov qword [rsp + 0x130], rdx
mov rdx, qword [rsp + 0x130]
call fcn.1400f58f0
movzx esi, word [rax]
movzx ebx, byte [rax + 2]
movzx eax, byte [0x140188180]
mov edx, 3
xor ecx, ecx
call fcn.1400f2120
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140002767
shl ebx, 0x10
or esi, ebx
mov eax, esi
shr eax, 0x10
xor al, 0x54
mov ecx, esi
xor cl, 0x35
shr esi, 8
xor sil, 0xb6
jmp 0x140008104
mov rax, qword [rsp + 0x50]
cmp dword [rax], 0x31626e62
je 0x140006721
mov rax, qword [rsp + 0x50]
cmp dword [rax], 0x66337830
je 0x1400068cb
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
cmp eax, 0x7830
je 0x14000694e
mov rcx, qword [rsp + 0x50]
movzx eax, word [rcx]
xor eax, 0x6362
movzx ecx, byte [rcx + 2]
xor ecx, 0x31
or cx, ax
jne case.0x14000609e.36
jmp 0x1400060b4
mov rdx, qword [rsp + 0x50]
lea rcx, [rdx + 7]
and rcx, 0xfffffffffffffff8
mov rax, rcx
sub rax, rdx
je 0x1400067a4
mov edx, 0
je 0x1400067a6
xor edx, edx
mov r8, qword [rsp + 0x50]
cmp byte [r8 + rdx], 0x2d
je 0x140008086
inc rdx
cmp rax, rdx
jne 0x14000624a
mov rdx, rax
jmp 0x1400067a6
mov rax, qword [rsp + 0x50]
cmp byte [rax], 0x47
jne case.0x14000609e.36
mov r8d, 0x14
lea rcx, [rsp + 0x130]
lea rdx, [0x14011d94d]
call fcn.140049060
cmp qword [rsp + 0x130], 0
je 0x140002767
movups xmm0, xmmword [rsp + 0x130]
movups xmm1, xmmword [rsp + 0x140]
movaps xmmword [rsp + 0xb0], xmm1
movaps xmmword [rsp + 0xa0], xmm0
movzx eax, byte [0x140188180]
mov edx, 0x38
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x140002767
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdx + 0x30]
mov qword [rax + 0x30], rcx
movdqu xmm0, xmmword [rdx]
movdqu xmm1, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmmword [rax + 0x20], xmm2
movdqu xmmword [rax + 0x10], xmm1
movdqu xmmword [rax], xmm0
mov qword [rsp + 0x130], 0x38
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], 0x38
mov edx, 0x38
mov r8d, 2
lea rcx, [rsp + 0x130]
call fcn.14004b950
mov rsi, qword [rsp + 0x138]
mov r9, qword [rsp + 0x140]
mov r12, qword [rsp + 0x130]
mov word [rsi + r9], 0x4141
add r9, 2
mov r15, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xa8]
mov rcx, r15
mov r8, rsi
call fcn.140001930
mov ebx, eax
test r12, r12
je 0x14000639c
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov r15, qword [rsp + 0xa0]
lock dec qword [r15]
jne 0x1400063af
lea rcx, [rsp + 0xa0]
call fcn.1400fbf20
mov rsi, qword [rsp + 0xa8]
mov r15, qword [rsi + 0x18]
mov r12, qword [rsi + 0x20]
mov rcx, r15
call qword [r12]
cmp qword [r12 + 8], 0
je 0x1400063eb
cmp qword [r12 + 0x10], 0x11
jb 0x1400063da
mov r15, qword [r15 - 8]
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
call fcn.1400fb060
cmp qword [rsi], 0
je 0x140006414
mov rax, qword [rsi + 8]
mov r8, qword [rax - 8]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp dword [rsi + 0x30], 3
je 0x140006423
mov r8d, 0x14
lea rcx, [rsp + 0x130]
lea rdx, [0x14011d94d]
call fcn.140049060
cmp qword [rsp + 0x130], 0
je 0x140002767
movdqu xmm0, xmmword [rsp + 0x130]
movdqu xmm1, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0xb0], xmm1
movdqa xmmword [rsp + 0xa0], xmm0
mov rsi, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xa8]
mov r9d, 0x3a
mov rcx, rsi
mov r8, qword [rsp + 0x50]
call fcn.140001930
mov ebx, eax
lock dec qword [rsi]
jne 0x140006567
lea rcx, [rsp + 0xa0]
call fcn.1400fbf20
mov rsi, qword [rsp + 0xa8]
mov r15, qword [rsi + 0x18]
mov r12, qword [rsi + 0x20]
mov rcx, r15
call qword [r12]
cmp qword [r12 + 8], 0
je 0x1400065a3
cmp qword [r12 + 0x10], 0x11
jb 0x140006592
mov r15, qword [r15 - 8]
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
call fcn.1400fb060
cmp qword [rsi], 0
je 0x1400065cc
mov rax, qword [rsi + 8]
mov r8, qword [rax - 8]
mov rcx, qword [0x140188170]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp dword [rsi + 0x30], 3
je 0x1400065db
lea rcx, [rsi + 0x30]
call fcn.1400015d0
mov rcx, qword [0x140188170]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0xb0]
lock dec qword [rax]
jne 0x14000660f
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xb8]
call fcn.14007a1d0
test bl, bl
je case.0x14000609e.36
lea rax, [0x14011111a]
mov qword [rsp + 0x130], rax
lea rax, [rsp + 0x130]
mov rcx, qword [rsp + 0x130]
movabs rdx, 0x1d9593a63eada559
mov qword [rsp + 0x130], rdx
mov rdx, qword [rsp + 0x130]
call fcn.1400f6130
mov esi, dword [rax]
movzx eax, byte [0x140188180]
mov edx, 4
xor ecx, ecx
call fcn.1400f2120
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140002767
mov rax, qword [rsp + 0x50]
cmp byte [rax], 0x34
jne case.0x14000609e.36
lea rax, [0x1401135dd]
mov qword [rsp + 0x130], rax
lea rax, [rsp + 0x130]
mov rcx, qword [rsp + 0x130]
movabs rdx, 0x15ee8c39bea37375
mov qword [rsp + 0x130], rdx
mov rdx, qword [rsp + 0x130]
call fcn.1400f5f40
movzx esi, word [rax]
movzx ebx, byte [rax + 2]
movzx eax, byte [0x140188180]
mov edx, 3
xor ecx, ecx
call fcn.1400f2120
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140002767
shl ebx, 0x10
or esi, ebx
mov eax, esi
shr eax, 0x10
xor al, 0xdf
mov ecx, esi
xor cl, 0x49
shr esi, 8
xor sil, 0xad
jmp 0x140008104
lea rax, [0x14011a5e6]
mov qword [rsp + 0x130], rax
lea rax, [rsp + 0x130]
mov rcx, qword [rsp + 0x130]
movabs rdx, 0x913e4908838b857d
mov qword [rsp + 0x130], rdx
mov rdx, qword [rsp + 0x130]
call fcn.1400f6000
movzx esi, word [rax]
movzx ebx, byte [rax + 2]
movzx eax, byte [0x140188180]
mov edx, 3
xor ecx, ecx
call fcn.1400f2120
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140002767
shl ebx, 0x10
or esi, ebx
mov eax, esi
shr eax, 0x10
xor al, 0x71
mov ecx, esi
xor cl, 0x17
shr esi, 8
xor sil, 0x10
jmp 0x140008104
xor edx, edx
mov r8, qword [rsp + 0x50]
movdqu xmm0, xmmword [r8 + rdx]
movdqa xmm1, xmm0
pxor xmm1, xmm10
paddq xmm1, xmm11
pandn xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
movq r8, xmm1
movabs r9, 0x8080808080808080
test r8, r9
je 0x1400067e8
mov r8, rdx
jmp 0x14000686a
mov r8, rdx
or r8, 0x10
mov r9, qword [rsp + 0x50]
movdqu xmm0, xmmword [r9 + r8]
movdqa xmm1, xmm0
pxor xmm1, xmm10
paddq xmm1, xmm11
pandn xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
movq r9, xmm1
movabs r10, 0x8080808080808080
test r9, r10
jne 0x14000686a
mov r8, rdx
or r8, 0x20
cmp r8, 0x20
jne 0x14000686a
mov r9, qword [rsp + 0x50]
movdqu xmm0, xmmword [r9 + r8]
movdqa xmm1, xmm0
pxor xmm1, xmm10
paddq xmm1, xmm11
pandn xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
movq r9, xmm1
test r9, r10
je 0x1400091ae
mov rdx, qword [rsp + 0x50]
add rdx, r8
mov r9d, 0x30
sub r9, r8
xor r8d, r8d
cmp byte [rdx + r8], 0x2d
je 0x140008086
inc r8
cmp r9, r8
jne 0x14000687e
cmp rcx, qword [rsp + 0x50]
je 0x1400069d1
mov ecx, 0
test rax, rax
je 0x1400069d3
xor ecx, ecx
mov rdx, qword [rsp + 0x50]
cmp byte [rdx + rcx], 0x5f
je 0x140008086
lea rax, [0x14011198b]
mov qword [rsp + 0x130], rax
lea rax, [rsp + 0x130]
mov rcx, qword [rsp + 0x130]
movabs rdx, 0x9059712b5bf99c13
mov qword [rsp + 0x130], rdx
mov rdx, qword [rsp + 0x130]
call fcn.1400f5e10
movzx esi, word [rax]
movzx ebx, byte [rax + 2]
movzx eax, byte [0x140188180]
mov edx, 3
xor ecx, ecx
call fcn.1400f2120
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140002767
shl ebx, 0x10
or esi, ebx
mov eax, esi
shr eax, 0x10
xor al, 0xb5
mov ecx, esi
xor cl, 0x82
shr esi, 8
xor sil, 3
jmp 0x140008104
lea rax, [0x14011999c]
mov qword [rsp + 0x130], rax
lea rax, [rsp + 0x130]
mov rcx, qword [rsp + 0x130]
movabs rdx, 0xc70c03a5c1d12b35
mov qword [rsp + 0x130], rdx
mov rdx, qword [rsp + 0x130]
call fcn.1400f5ec0
movzx esi, word [rax]
movzx ebx, byte [rax + 2]
movzx eax, byte [0x140188180]
mov edx, 3
xor ecx, ecx
call fcn.1400f2120
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140002767
shl ebx, 0x10
or esi, ebx
mov eax, esi
shr eax, 0x10
xor al, 0x82
mov ecx, esi
xor cl, 0xe9
shr esi, 8
xor sil, 0x4f
jmp 0x140008104
xor ecx, ecx
mov rax, qword [rsp + 0x50]
movdqu xmm0, xmmword [rax + rcx]
movdqa xmm1, xmm0
pxor xmm1, xmm12
paddq xmm1, xmm11
pandn xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
movq rax, xmm1
movabs rdx, 0x8080808080808080
test rax, rdx
je 0x140006a14
mov rax, rcx
jmp 0x140006a94
mov rax, rcx
or rax, 0x10
mov rdx, qword [rsp + 0x50]
movdqu xmm0, xmmword [rdx + rax]
movdqa xmm1, xmm0
pxor xmm1, xmm12
paddq xmm1, xmm11
pandn xmm0, xmm1
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
movq rdx, xmm1
movabs r8, 0x8080808080808080
test rdx, r8
jne 0x140006a94
mov esi, dword [0x140117110]
test esi, esi
je 0x140006b1a
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x140006ae8
cmp qword [rax + 8], 0
je 0x140006ae8
mov rcx, rax
add rcx, 0x10
mov rax, qword [rax + 0x10]
jmp 0x140006cf9
mov esi, dword [0x140117110]
test esi, esi
je 0x140006c42
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140006bb8
mov rsi, rax
cmp rax, 1
jne 0x140006c01
cmp qword [0x1401170f8], 0
je 0x1400090c7
mov dword [rsp + 0xa0], 0
lea rcx, [0x140117108]
xor edx, edx
lea r8, [rsp + 0xa0]
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
cmp eax, 1
jne 0x140002767
cmp dword [rsp + 0xa0], 0
je 0x140009133
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x1400091ef
mov esi, eax
inc eax
mov dword [0x140117110], eax
mov rax, qword [0x140188158]
mov qword [0x140117100], rax
lea rcx, [0x1401170f8]
lock cmpxchg qword [0x140188158], rcx
jne 0x140006b82
mov byte [0x140188150], 1
lea rcx, [0x140117108]
xor edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x140006ac4
movzx eax, byte [0x140188180]
mov edx, 0x20
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x140002767
cmp qword [0x1401170f8], 0
je 0x1400090fd
mov dword [rsp + 0xa0], 0
lea rcx, [0x140117108]
xor edx, edx
lea r8, [rsp + 0xa0]
xor r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
cmp eax, 1
jne 0x140002767
cmp dword [rsp + 0xa0], 0
je 0x14000913e
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x1400091ef
mov esi, eax
inc eax
mov dword [0x140117110], eax
mov rax, qword [0x140188158]
mov qword [0x140117100], rax
lea rcx, [0x1401170f8]
lock cmpxchg qword [0x140188158], rcx
jne 0x140006caa
mov rdx, qword [rcx + 8]
lea r8, [rax + 1]
mov qword [rcx], r8
movups xmm0, xmmword [0x14017d7b0]
movaps xmmword [rsp + 0x140], xmm0
movups xmm0, xmmword [0x14017d7a0]
movaps xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], rdx
lea rax, [0x1401145fb]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rdx, 0xc543aad90e13def2
mov qword [rsp + 0xa0], rdx
mov rdx, qword [rsp + 0xa0]
call fcn.1400f6170
mov esi, dword [rax]
movzx eax, byte [0x140188180]
mov edx, 4
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x140002767
xor esi, 0x79dea417
mov dword [rax], esi
mov qword [rsp + 0x100], 4
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], 4
lea rax, [0x140113a2d]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rdx, 0xd899667a69188e1c
mov qword [rsp + 0xa0], rdx
mov rdx, qword [rsp + 0xa0]
call fcn.1400f5c20
mov rcx, qword [rax]
mov qword [rsp + 0x98], rcx
mov rbp, qword [rax + 8]
mov r13, qword [rax + 0x10]
mov r12, qword [rax + 0x18]
mov r15, qword [rax + 0x20]
mov rcx, qword [rax + 0x28]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x48], rcx
movzx esi, word [rax + 0x38]
movzx ebx, byte [rax + 0x3a]
movzx eax, byte [0x140188180]
mov edx, 0x3b
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x140002767
shl ebx, 0x10
or esi, ebx
mov ecx, esi
mov edx, esi
xor dl, 0x54
shr esi, 8
xor sil, 0xdf
movzx edx, dl
movzx r8d, sil
shl r8d, 8
or r8d, edx
movabs rdx, 0xd27d0c4ad13f72be
mov r9, qword [rsp + 0x98]
xor r9, rdx
mov qword [rax], r9
movabs rdx, 0xf491cff60d7ac3b0
xor rbp, rdx
mov qword [rax + 8], rbp
movabs rdx, 0x3d60d3f660824161
xor r13, rdx
mov qword [rax + 0x10], r13
movabs rdx, 0xa39095a3c4de0f59
xor r12, rdx
mov qword [rax + 0x18], r12
movabs rdx, 0x2ebd5e7895b10b11
xor r15, rdx
mov qword [rax + 0x20], r15
movabs rdx, 0x6e188fd72b3184e1
mov r9, qword [rsp + 0x58]
xor r9, rdx
mov qword [rax + 0x28], r9
movabs rdx, 0xafaedffc83a854e6
mov r9, qword [rsp + 0x48]
xor r9, rdx
mov qword [rax + 0x30], r9
mov word [rax + 0x38], r8w
shr ecx, 0x10
xor cl, 0x7d
mov byte [rax + 0x3a], cl
mov qword [rsp + 0xa0], 0x3b
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], 0x3b
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x130]
lea r8, [rsp + 0x100]
lea r9, [rsp + 0xa0]
call fcn.1400fa900
mov rax, qword [rsp + 0x70]
movabs rcx, 0x8000000000000000
cmp rax, rcx
je 0x140006f6a
test rax, rax
je 0x140006f6a
lea rax, [0x14011b220]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa0]
movabs rdx, 0x363083ee9b3db7f4
mov qword [rsp + 0xa0], rdx
mov rdx, qword [rsp + 0xa0]
call fcn.1400f6050
movzx esi, word [rax]
movzx ebx, byte [rax + 2]
movzx eax, byte [0x140188180]
mov edx, 3
xor ecx, ecx
call fcn.1400f2120
test rax, rax
je 0x140002767
lea rax, [0x14010f221]
mov qword [rsp + 0x130], rax
lea rax, [rsp + 0x130]
mov rcx, qword [rsp + 0x130]
movabs rdx, 0xf5fb0e7fb66fda59
mov qword [rsp + 0x130], rdx
mov rdx, qword [rsp + 0x130]
call fcn.1400f5810
movzx esi, word [rax]
movzx ebx, byte [rax + 2]
movzx eax, byte [0x140188180]
mov edx, 3
xor ecx, ecx
call fcn.1400f2120
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140002767
shl ebx, 0x10
or esi, ebx
mov eax, esi
shr eax, 0x10
xor al, 0xd9
mov ecx, esi
xor cl, 0xb0
shr esi, 8
xor sil, 0xa2
movzx ecx, cl
movzx edx, sil
shl edx, 8
or edx, ecx
mov rcx, qword [rsp + 0x48]
mov byte [rcx + 2], al
mov word [rcx], dx
mov r13d, 3
jmp 0x140008246
mov rax, qword [0x140188030]
cmp rax, 2
je 0x1400082af
mov byte [rsp + 0x70], 1
lea rax, [0x140188038]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x130], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x138], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x140], rax
lea rcx, [0x140188030]
lea rdx, [rsp + 0x130]
lea r8, method..virtual_0
call fcn.1400439b0
lea rcx, [0x140188040]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
movzx eax, byte [0x140188048]
test al, al
jne 0x140002767
cmp qword [0x140188068], 0
je 0x140002767
movdqu xmm0, xmmword [0x140188070]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmm7
pshufd xmm0, xmm0, 0xee
pxor xmm0, xmm8
mov rcx, r13
and rcx, 0xfffffffffffffff8
je 0x140008386
xor ecx, ecx
xor edx, edx
mov r8d, 2
mov r9d, 0x1f0003
call sub.KERNEL32.dll_CreateWaitableTimerExW
test rax, rax
je 0x14000907f
mov rbx, rax
mov qword [rsp + 0x130], 0xffffffffffd9da60
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [rsp + 0x130]
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_SetWaitableTimer
test eax, eax
je 0x1400090a3
mov rcx, rbx
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov esi, eax
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
mov qword [rsp + 0x48], r14
mov r15, qword [rsp + 0x60]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x98], r14
cmp esi, 0xffffffff
lea r13, [rsp + 0x130]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
jne 0x140005c06
jmp 0x140005bf2
mov qword [rsp + 0x98], r14
lea r13, [rsp + 0x130]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x60]
jmp 0x140005bf2
mov qword [rsp + 0x98], r14
lea r13, [rsp + 0x130]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x60]
jmp 0x140005fbb
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140002767
mov esi, eax
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [0x140117110], ecx
je 0x140006ac4
mov ebx, eax
mov ecx, esi
call sub.KERNEL32.dll_TlsFree
dec ebx
mov esi, ebx
jmp 0x140006ac4
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x140002767
mov esi, eax
mov ecx, eax
inc ecx
xor eax, eax
lock cmpxchg dword [0x140117110], ecx
je 0x140006af8
mov ebx, eax
mov ecx, esi
call sub.KERNEL32.dll_TlsFree
dec ebx
mov esi, ebx
jmp 0x140006af8
mov esi, dword [0x140117110]
jmp 0x140006ac2
mov esi, dword [0x140117110]
jmp 0x140006af6
or rdx, 0x30
mov r9, rdx
sub r9, 0x30
je 0x140006891
add rdx, qword [rsp + 0x50]
neg r9
jmp 0x14000687b
test r12, r12
ud2
lea rcx, [0x140117108]
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
ud2