Function at 0x140006540
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push rbp
push rbx
push r15
lea rbp, [rsp - 0x490]
sub rsp, 0x590
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x460], rax
cmp dword [rcx + 0x24], 0
mov r15, r8
mov dword [rsp + 0x48], r9d
mov rbx, rcx
je 0x140006580
mov eax, 0x40000
jmp 0x14000776e
cmp byte [rcx + 0x40], 0
je 0x140006590
mov eax, 0x50000
jmp 0x14000776e
mov qword [rsp + 0x5b8], rsi
xor esi, esi
mov eax, esi
mov qword [rsp + 0x580], r12
mov r12d, dword [rbp + 0x4d0]
mov dword [rsp + 0x54], eax
lea ecx, [rsi + 0xc]
cmp qword [rbx], rax
je 0x1400065c2
cmp r12d, 4
cmovne eax, ecx
mov dword [rsp + 0x54], eax
lea rcx, [rbp + 0x350]
sub rcx, rdx
nop dword [rax]
movzx eax, byte [rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400065d0
movzx ecx, byte [rbp + 0x350]
mov qword [rsp + 0x588], rdi
mov qword [rsp + 0x578], r13
mov qword [rsp + 0x570], r14
test cl, cl
je 0x140007741
lea rax, [rbp + 0x350]
nop dword [rax]
cmp cl, 0x5c
jne 0x140006618
mov byte [rax], 0x2f
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
jne 0x140006610
mov r13d, 8
mov r14, 0xffffffffffffffff
cmp r12d, 4
jne 0x14000665f
lea rcx, [rbp + 0x350]
mov rax, r14
cmp byte [rcx + rax + 1], sil
lea rax, [rax + 1]
jne 0x140006640
cmp byte [rbp + rax + 0x34f], 0x2f
je 0x14000665f
mov byte [rsp + 0x40], 1
jmp 0x140006765
mov byte [rsp + 0x40], sil
mov dword [rsp + 0x50], r13d
cmp r12d, 4
je 0x140006765
lea rcx, [rbp + 0x350]
mov rax, r14
nop dword [rax]
inc rax
cmp byte [rcx + rax], sil
jne 0x140006680
lea rdi, [rbp + 0x350]
add rdi, rax
lea rax, [rbp + 0x350]
cmp rdi, rax
jbe 0x1400066b4
nop
cmp byte [rdi], 0x2e
je 0x1400066c9
dec rdi
lea rax, [rbp + 0x350]
cmp rdi, rax
ja 0x1400066a0
lea rax, [rbp + 0x350]
cmp rdi, rax
jne 0x1400066c9
cmp byte [rdi], 0x2e
jne 0x140006769
lea rdx, [0x14002782c]
mov rcx, rdi
call fcn.1400137a8
test eax, eax
je 0x140006765
lea rdx, str..zip
mov rcx, rdi
call fcn.1400137a8
test eax, eax
je 0x140006765
lea rdx, str..zoo
mov rcx, rdi
call fcn.1400137a8
test eax, eax
je 0x140006765
lea rdx, str..arc
mov rcx, rdi
call fcn.1400137a8
test eax, eax
je 0x140006765
lea rdx, str..lzh
mov rcx, rdi
call fcn.1400137a8
test eax, eax
je 0x140006765
lea rdx, str..arj
mov rcx, rdi
call fcn.1400137a8
test eax, eax
je 0x140006765
lea rdx, [0x140027858]
mov rcx, rdi
call fcn.1400137a8
test eax, eax
je 0x140006765
lea rdx, str..tgz
mov rcx, rdi
call fcn.1400137a8
test eax, eax
jne 0x140006769
mov dword [rsp + 0x50], esi
cmp r12d, 2
jne 0x14000680f
mov qword [rbx + 0xa8], rsi
mov qword [rbx + 0xb8], rsi
mov byte [rbx + 0xb0], sil
mov qword [rbx + 0x9c], rsi
mov dword [rbx + 0x98], esi
mov dword [rbx + 0xc8], esi
test r15, r15
je 0x140006886
mov qword [rsp + 0x30], rsi
lea r8d, [r12 - 1]
mov dword [rsp + 0x28], esi
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
cmp rax, r14
jne 0x1400067df
mov edi, 0x200
mov eax, edi
jmp 0x140007746
xor r8d, r8d
mov rdx, r15
mov rcx, rbx
call fcn.14000aa90
mov edi, eax
test eax, eax
je 0x140006803
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x140007746
mov byte [rbx + 0xb0], 1
jmp 0x1400069b6
cmp r12d, 1
jne 0x140006834
mov r8d, dword [rsp + 0x48]
mov rdx, r15
mov rcx, rbx
call fcn.14000aa90
mov edi, eax
test eax, eax
je 0x1400069b6
jmp 0x140007746
cmp r12d, 3
jne 0x140006892
mov eax, dword [rsp + 0x48]
mov dword [rbx + 0xc0], eax
mov qword [rbx + 0xa8], rsi
mov qword [rbx + 0xb8], r15
mov byte [rbx + 0xb0], sil
mov qword [rbx + 0x9c], rsi
mov qword [rbx + 0xc4], rsi
test r15, r15
je 0x140006886
test eax, eax
je 0x140006886
mov dword [rbx + 0x70], 0x80000000
mov dword [rbx + 0x98], eax
mov byte [rbx + 0x94], 1
jmp 0x1400068d2
mov edi, 0x10000
mov eax, edi
jmp 0x140007746
cmp r12d, 4
jne 0x140007741
mov qword [rbx + 0xa8], rsi
mov qword [rbx + 0xb8], rsi
mov byte [rbx + 0xb0], sil
mov qword [rbx + 0x9c], rsi
mov dword [rbx + 0xc8], esi
mov dword [rbx + 0x70], 0x41c00010
mov dword [rbx + 0x98], esi
mov byte [rbx + 0x94], sil
lea rcx, [rbp + 0x300]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x300]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov rax, qword [rsp + 0x48]
lea rdx, [rbp + 0x2f0]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movabs rcx, 0xfe624e212ac18000
movabs rax, 0xd6bf94d5e57a42bd
add rcx, qword [rsp + 0x48]
imul rcx
add rdx, rcx
movzx ecx, word [rbp + 0x2f0]
sub cx, 0x3c
sar rdx, 0x17
mov rax, rdx
shl cx, 4
shr rax, 0x3f
add rdx, rax
movzx eax, word [rbp + 0x2f2]
and ax, 0xf
mov qword [rbx + 0x78], rdx
or cx, ax
mov qword [rbx + 0x80], rdx
movzx eax, word [rbp + 0x2f6]
and eax, 0x1f
shl cx, 5
mov qword [rbx + 0x88], rdx
movzx edx, cx
movzx ecx, word [rbp + 0x2fa]
or edx, eax
movzx eax, word [rbp + 0x2f8]
and cx, 0x3f
shl ax, 6
or cx, ax
shl edx, 0x10
shl cx, 5
movzx eax, cx
or edx, eax
movzx eax, word [rbp + 0x2fc]
add ax, ax
and eax, 0x1f
or edx, eax
mov dword [rbx + 0x90], edx
mov qword [rbp + 0x2e0], rsi
mov rcx, rsi
mov byte [rbp - 0x58], sil
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbp + rcx + 0x350]
mov byte [rbp + rcx + 0xc8], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400069d0
lea rax, [rbp + 0xc8]
nop
inc r14
cmp byte [rax + r14], sil
jne 0x1400069f0
mov qword [rsp + 0x78], r14
cmp byte [rsp + 0x40], sil
je 0x140006a29
lea rcx, [rbp + 0xc8]
dec rcx
nop
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x140006a10
movzx eax, word [0x140027864]
mov word [rcx], ax
inc qword [rsp + 0x78]
mov edx, 9
mov eax, dword [rbx + 0x90]
mov dword [rsp + 0x68], eax
mov byte [rbp + 0x1cc], sil
mov qword [rbp + 0xc0], rsi
mov qword [rbp - 0x70], rsi
mov dword [rbp + 0x2d0], 1
mov dword [rbp + 0x2d8], esi
mov word [rbp - 0x66], si
mov dword [rsp + 0x60], 0x140b17
mov dword [rsp + 0x6c], esi
mov word [rsp + 0x64], r13w
cmp qword [rbx], rsi
je 0x140006a84
cmp r12d, 4
je 0x140006a84
movzx r13d, dx
mov word [rsp + 0x64], dx
mov r15d, dword [rsp + 0x50]
mov ecx, dword [rbx + 0x98]
mov word [rbp - 0x64], r13w
mov word [rsp + 0x66], r15w
test r15d, r15d
jne 0x140006aaf
test ecx, ecx
js 0x140006aaf
mov eax, dword [rsp + 0x54]
add eax, ecx
mov dword [rsp + 0x70], eax
jmp 0x140006ab3
mov dword [rsp + 0x70], esi
mov eax, dword [rbx + 0x70]
mov r8, rbx
mov dword [rbp - 0x60], eax
mov eax, dword [rbx + 0x20]
add eax, dword [rbx + 0x28]
mov dword [rbp - 0x5c], eax
lea rax, [rbp + 0x320]
mov qword [rbp + 0xb0], rax
lea rax, [rbp + 0x338]
mov qword [rbp + 0xb8], rax
movzx eax, byte [rbx + 0x80]
mov byte [rbp + 0x325], al
mov dword [rsp + 0x74], ecx
mov rcx, qword [rbx + 0x78]
mov qword [rbp - 0x78], rdx
mov rdx, qword [rbx + 0x80]
mov rax, rdx
mov dword [rbp + 0x320], 0xd5455
sar rax, 8
mov byte [rbp + 0x326], al
mov rax, rdx
sar rax, 0x10
mov byte [rbp + 0x327], al
movzx eax, byte [rbx + 0x78]
mov byte [rbp + 0x329], al
mov rax, rcx
sar rax, 8
mov byte [rbp + 0x32a], al
mov rax, rcx
sar rax, 0x10
mov byte [rbp + 0x32b], al
movzx eax, byte [rbx + 0x88]
sar rcx, 0x18
mov byte [rbp + 0x32d], al
mov byte [rbp + 0x32c], cl
mov rcx, qword [rbx + 0x88]
mov rax, rcx
sar rdx, 0x18
sar rax, 8
mov byte [rbp + 0x32e], al
mov rax, rcx
sar rcx, 0x18
mov byte [rbp + 0x324], 7
movsd xmm0, qword [rbp + 0x320]
mov byte [rbp + 0x330], cl
lea rcx, [rsp + 0x60]
mov byte [rbp + 0x328], dl
sar rax, 0x10
mov byte [rbp + 0x340], dl
lea rdx, [0x14000c1a0]
movsd qword [rbp + 0x338], xmm0
mov word [rbp - 0x68], si
mov qword [rbp - 0x80], 0x11
mov byte [rbp + 0x32f], al
mov byte [rbp + 0x33a], 5
call fcn.14000b670
test eax, eax
je 0x140006c12
cmp byte [rbx + 0xb0], sil
je 0x140006bf5
mov rcx, qword [rbx + 0xa8]
test rcx, rcx
je 0x140006bf5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbx + 0x9c]
mov dword [rbx + 0x98], eax
mov qword [rbx + 0xa8], rsi
mov eax, 0x400
jmp 0x140007746
mov ecx, dword [rsp + 0x78]
add ecx, 0x1e
add ecx, dword [rbp - 0x80]
add dword [rbx + 0x28], ecx
cmp dword [rbx + 0x24], esi
je 0x140006c5a
cmp byte [rbx + 0xb0], sil
je 0x140006c3f
mov rcx, qword [rbx + 0xa8]
test rcx, rcx
je 0x140006c3f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbx + 0x9c]
mov dword [rbx + 0x98], eax
mov eax, dword [rbx + 0x24]
mov qword [rbx + 0xa8], rsi
jmp 0x140007746
mov dword [rbx + 0x44], 0x12345678
lea r13, [0x140027130]
mov dword [rbx + 0x48], 0x23456789
mov dword [rbx + 0x4c], 0x34567890
mov r8, qword [rbx]
test r8, r8
je 0x140006ccd
nop
movzx eax, byte [r8]
test al, al
je 0x140006ccd
mov edx, dword [rbx + 0x44]
mov ecx, edx
xor rcx, rax
shr edx, 8
movzx eax, cl
mov ecx, dword [rbx + 0x4c]
xor edx, dword [r13 + rax*4]
movzx eax, dl
add eax, dword [rbx + 0x48]
mov dword [rbx + 0x44], edx
imul edx, eax, 0x8088405
movzx eax, cl
shr ecx, 8
inc edx
mov dword [rbx + 0x48], edx
shr rdx, 0x18
xor rdx, rax
xor ecx, dword [r13 + rdx*4]
mov dword [rbx + 0x4c], ecx
add r8, 1
jne 0x140006c80
cmp byte [0x140034b44], sil
jne 0x140006cee
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, eax
mov ecx, edi
call fcn.140013790
mov rdi, rsi
call fcn.140013764
sar eax, 7
mov byte [rbp + rdi + 0x310], al
inc rdi
cmp rdi, 0xc
jl 0x140006cf1
mov eax, dword [rsp + 0x68]
mov r14, rsi
shr eax, 8
mov byte [rbp + 0x31b], al
nop dword [rax]
movsx r10, byte [rbp + r14 + 0x310]
mov r11d, dword [rbx + 0x4c]
mov edx, dword [rbx + 0x44]
mov r8d, r11d
mov ecx, edx
and r8d, 0xfffd
xor rcx, r10
shr edx, 8
movzx eax, cl
or r8d, 2
movzx ecx, r11b
shr r11d, 8
xor edx, dword [r13 + rax*4]
movzx eax, dl
mov edi, edx
add eax, dword [rbx + 0x48]
imul r9d, eax, 0x8088405
inc r9d
mov eax, r9d
shr rax, 0x18
xor rcx, rax
mov eax, r8d
xor eax, 1
imul eax, r8d
movsx r8, byte [rbp + r14 + 0x311]
xor r11d, dword [r13 + rcx*4]
mov ecx, edi
xor rcx, r8
shr edi, 8
mov edx, r11d
shr eax, 8
and edx, 0xfffd
xor al, r10b
or edx, 2
mov byte [rbp + r14 + 0x310], al
movzx eax, cl
mov r10d, r11d
shr r10d, 8
xor edi, dword [r13 + rax*4]
movzx eax, dil
add eax, r9d
imul r9d, eax, 0x8088405
movzx eax, r11b
mov r11d, edi
inc r9d
mov ecx, r9d
shr rcx, 0x18
xor rcx, rax
mov eax, edx
xor eax, 1
imul eax, edx
xor r10d, dword [r13 + rcx*4]
mov ecx, r11d
mov edx, r10d
shr r11d, 8
and edx, 0xfffd
shr eax, 8
or edx, 2
xor al, r8b
movsx r8, byte [rbp + r14 + 0x312]
mov byte [rbp + r14 + 0x311], al
xor rcx, r8
movzx eax, cl
xor r11d, dword [r13 + rax*4]
movzx eax, r11b
add eax, r9d
imul r9d, eax, 0x8088405
movzx eax, r10b
shr r10d, 8
inc r9d
mov ecx, r9d
shr rcx, 0x18
xor rcx, rax
mov eax, edx
xor eax, 1
imul eax, edx
xor r10d, dword [r13 + rcx*4]
shr eax, 8
xor al, r8b
movsx r8, byte [rbp + r14 + 0x313]
mov byte [rbp + r14 + 0x312], al
mov edx, r10d
mov ecx, r11d
xor rcx, r8
shr r11d, 8
movzx eax, cl
and edx, 0xfffd
or edx, 2
xor r11d, dword [r13 + rax*4]
movzx eax, r11b
add eax, r9d
imul r9d, eax, 0x8088405
movzx eax, r10b
shr r10d, 8
inc r9d
mov ecx, r9d
shr rcx, 0x18
xor rcx, rax
mov eax, edx
xor eax, 1
imul eax, edx
xor r10d, dword [r13 + rcx*4]
mov ecx, r11d
mov edx, r10d
shr r11d, 8
and edx, 0xfffd
mov edi, r10d
shr eax, 8
or edx, 2
xor al, r8b
shr edi, 8
movsx r8, byte [rbp + r14 + 0x314]
mov byte [rbp + r14 + 0x313], al
xor rcx, r8
movzx eax, cl
xor r11d, dword [r13 + rax*4]
movzx eax, r11b
add eax, r9d
imul r9d, eax, 0x8088405
movzx eax, r10b
movsx r10, byte [rbp + r14 + 0x315]
inc r9d
mov ecx, r9d
shr rcx, 0x18
xor rcx, rax
mov eax, edx
xor eax, 1
imul eax, edx
mov edx, r11d
xor edi, dword [r13 + rcx*4]
mov ecx, edx
xor rcx, r10
shr edx, 8
shr eax, 8
xor al, r8b
mov r8d, edi
mov byte [rbp + r14 + 0x314], al
and r8d, 0xfffd
movzx eax, cl
or r8d, 2
xor edx, dword [r13 + rax*4]
movzx eax, dl
add eax, r9d
mov dword [rbx + 0x44], edx
imul eax, eax, 0x8088405
mov edx, edi
shr edx, 8
inc eax
mov ecx, eax
mov dword [rbx + 0x48], eax
shr rcx, 0x18
movzx eax, dil
xor rcx, rax
mov eax, r8d
xor eax, 1
imul eax, r8d
xor edx, dword [r13 + rcx*4]
mov dword [rbx + 0x4c], edx
shr eax, 8
xor al, r10b
mov byte [rbp + r14 + 0x315], al
add r14, 6
cmp r14, 0xc
jl 0x140006d20
cmp qword [rbx], rsi
je 0x140007358
cmp r12d, 4
je 0x140007347
lea rdx, [rbp + 0x310]
cmp byte [rbx + 0x41], sil
je 0x1400072e4
mov rcx, qword [rbx + 0x50]
mov rax, rcx
test rcx, rcx
je 0x140006fe8
cmp dword [rbx + 0x58], 0xc
jae 0x140006fe8
call fcn.14000cb30
mov qword [rbx + 0x50], rsi
jmp 0x140006fed
test rax, rax
jne 0x140007002
mov ecx, 0x18
call fcn.14000cb38
mov qword [rbx + 0x50], rax
mov dword [rbx + 0x58], 0xc
movsd xmm0, qword [rbp + 0x310]
mov r11d, 2
movsd qword [rax], xmm0
mov edi, r11d
mov ecx, dword [rbp + 0x318]
mov dword [rax + 8], ecx
mov rax, qword [rbx + 0x50]
mov edx, dword [rbx + 0x44]
mov r8d, dword [rbx + 0x4c]
mov r9d, r8d
movsx r10, byte [r11 + rax - 2]
and r9d, 0xfffd
or r9d, 2
mov rax, r10
xor rax, rdx
shr edx, 8
movzx ecx, al
xor edx, dword [r13 + rcx*4]
mov dword [rbx + 0x44], edx
movzx eax, dl
add eax, dword [rbx + 0x48]
imul eax, eax, 0x8088405
movzx ecx, r8b
shr r8d, 8
inc eax
mov dword [rbx + 0x48], eax
shr rax, 0x18
xor rcx, rax
xor r8d, dword [r13 + rcx*4]
mov ecx, r9d
mov dword [rbx + 0x4c], r8d
xor ecx, 1
mov rax, qword [rbx + 0x50]
imul ecx, r9d
shr ecx, 8
xor cl, r10b
mov byte [r11 + rax - 2], cl
mov edx, dword [rbx + 0x44]
mov rax, qword [rbx + 0x50]
mov r8d, dword [rbx + 0x4c]
and r8d, 0xfffd
or r8d, 2
movsx r9, byte [r11 + rax - 1]
mov rax, r9
xor rax, rdx
shr edx, 8
movzx ecx, al
xor edx, dword [r13 + rcx*4]
mov dword [rbx + 0x44], edx
movzx eax, dl
add eax, dword [rbx + 0x48]
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x48], eax
mov edx, dword [rbx + 0x4c]
mov ecx, eax
movzx eax, dl
shr rcx, 0x18
xor rcx, rax
shr edx, 8
xor edx, dword [r13 + rcx*4]
mov ecx, r8d
mov dword [rbx + 0x4c], edx
xor ecx, 1
mov rax, qword [rbx + 0x50]
imul ecx, r8d
shr ecx, 8
xor cl, r9b
mov byte [r11 + rax - 1], cl
mov edx, dword [rbx + 0x44]
mov rax, qword [rbx + 0x50]
mov r8d, dword [rbx + 0x4c]
and r8d, 0xfffd
or r8d, 2
movsx r9, byte [r11 + rax]
mov rax, r9
xor rax, rdx
shr edx, 8
movzx ecx, al
xor edx, dword [r13 + rcx*4]
mov dword [rbx + 0x44], edx
movzx eax, dl
add eax, dword [rbx + 0x48]
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x48], eax
mov edx, dword [rbx + 0x4c]
mov ecx, eax
shr rcx, 0x18
movzx eax, dl
xor rcx, rax
shr edx, 8
xor edx, dword [r13 + rcx*4]
mov ecx, r8d
mov dword [rbx + 0x4c], edx
xor ecx, 1
mov rax, qword [rbx + 0x50]
imul ecx, r8d
shr ecx, 8
xor cl, r9b
mov byte [r11 + rax], cl
mov edx, dword [rbx + 0x44]
mov rax, qword [rbx + 0x50]
mov r8d, dword [rbx + 0x4c]
and r8d, 0xfffd
or r8d, 2
movsx r9, byte [r11 + rax + 1]
mov rax, r9
xor rax, rdx
shr edx, 8
movzx ecx, al
xor edx, dword [r13 + rcx*4]
mov dword [rbx + 0x44], edx
movzx eax, dl
add eax, dword [rbx + 0x48]
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x48], eax
mov edx, dword [rbx + 0x4c]
mov ecx, eax
shr rcx, 0x18
movzx eax, dl
xor rcx, rax
shr edx, 8
xor edx, dword [r13 + rcx*4]
mov ecx, r8d
mov dword [rbx + 0x4c], edx
xor ecx, 1
mov rax, qword [rbx + 0x50]
imul ecx, r8d
shr ecx, 8
xor cl, r9b
mov byte [r11 + rax + 1], cl
mov edx, dword [rbx + 0x44]
mov ecx, edx
mov rax, qword [rbx + 0x50]
mov r8d, dword [rbx + 0x4c]
shr edx, 8
and r8d, 0xfffd
or r8d, 2
movsx r9, byte [r11 + rax + 2]
xor rcx, r9
movzx eax, cl
xor edx, dword [r13 + rax*4]
mov dword [rbx + 0x44], edx
movzx eax, dl
add eax, dword [rbx + 0x48]
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x48], eax
mov edx, dword [rbx + 0x4c]
shr rax, 0x18
movzx ecx, dl
xor rcx, rax
shr edx, 8
xor edx, dword [r13 + rcx*4]
mov ecx, r8d
mov dword [rbx + 0x4c], edx
xor ecx, 1
mov rax, qword [rbx + 0x50]
imul ecx, r8d
shr ecx, 8
xor cl, r9b
mov byte [r11 + rax + 2], cl
mov rax, qword [rbx + 0x50]
mov r8d, dword [rbx + 0x4c]
and r8d, 0xfffd
movsx r9, byte [r11 + rax + 3]
mov edx, dword [rbx + 0x44]
lea r11, [r11 + 6]
or r8d, 2
mov rax, r9
xor rax, rdx
shr edx, 8
movzx ecx, al
xor edx, dword [r13 + rcx*4]
mov dword [rbx + 0x44], edx
movzx eax, dl
add eax, dword [rbx + 0x48]
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x48], eax
mov edx, dword [rbx + 0x4c]
movzx ecx, dl
shr rax, 0x18
xor rcx, rax
shr edx, 8
xor edx, dword [r13 + rcx*4]
mov ecx, r8d
xor ecx, 1
mov dword [rbx + 0x4c], edx
mov rax, qword [rbx + 0x50]
imul ecx, r8d
shr ecx, 8
xor cl, r9b
mov byte [r11 + rax - 3], cl
sub rdi, 1
jne 0x140007020
mov rdx, qword [rbx + 0x50]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14000731b
mov r8d, dword [rbx + 0x38]
lea eax, [r8 + 0xc]
cmp eax, dword [rbx + 0x3c]
jb 0x140007303
mov dword [rbx + 0x24], 0x30000
jmp 0x140007343
movsd xmm0, qword [rdx]
movsd qword [rcx + r8], xmm0
mov eax, dword [rdx + 8]
mov dword [rcx + r8 + 8], eax
add dword [rbx + 0x38], 0xc
jmp 0x140007343
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000733c
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rsi
mov r8d, 0xc
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140007343
mov dword [rbx + 0x24], 0x1000000
add dword [rbx + 0x28], 0xc
cmp qword [rbx], rsi
je 0x140007358
cmp r12d, 4
je 0x140007358
mov byte [rbx + 0x41], 1
jmp 0x140007366
mov byte [rbx + 0x41], sil
cmp r12d, 4
je 0x140007541
cmp r15d, 8
jne 0x140007380
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140009e40
mov esi, eax
jmp 0x140007547
test r15d, r15d
jne 0x140007547
mov r8d, 0x4000
lea rdx, [rbx + 0xcc]
mov rcx, rbx
mov r13d, esi
call fcn.14000b990
mov edi, eax
test eax, eax
je 0x140007527
nop dword [rax + rax]
cmp edi, 0xffffffff
je 0x140007527
lea rdx, [rbx + 0xcc]
cmp byte [rbx + 0x41], sil
je 0x1400074a9
mov rcx, qword [rbx + 0x50]
mov rax, rcx
test rcx, rcx
je 0x1400073e6
cmp dword [rbx + 0x58], edi
jae 0x1400073e6
call fcn.14000cb30
mov qword [rbx + 0x50], rsi
jmp 0x1400073eb
test rax, rax
jne 0x1400073fa
lea ecx, [rdi + rdi]
call fcn.14000cb38
mov qword [rbx + 0x50], rax
mov dword [rbx + 0x58], edi
mov r8d, edi
lea rdx, [rbx + 0xcc]
mov rcx, rax
mov r14d, edi
call fcn.140023e00
test edi, edi
je 0x1400074a5
mov r11, rsi
lea r12, [0x140027130]
mov rax, qword [rbx + 0x50]
lea r11, [r11 + 1]
mov edx, dword [rbx + 0x44]
mov r8d, dword [rbx + 0x4c]
mov r9d, r8d
movsx r10, byte [r11 + rax - 1]
and r9d, 0xfffd
or r9d, 2
mov rax, r10
xor rax, rdx
shr edx, 8
movzx ecx, al
xor edx, dword [r12 + rcx*4]
mov ecx, r9d
movzx eax, dl
xor ecx, 1
add eax, dword [rbx + 0x48]
mov dword [rbx + 0x44], edx
imul edx, eax, 0x8088405
movzx eax, r8b
imul ecx, r9d
shr r8d, 8
inc edx
mov dword [rbx + 0x48], edx
shr rdx, 0x18
xor rdx, rax
shr ecx, 8
xor cl, r10b
xor r8d, dword [r12 + rdx*4]
mov dword [rbx + 0x4c], r8d
mov rax, qword [rbx + 0x50]
mov byte [r11 + rax - 1], cl
sub r14, 1
jne 0x140007421
mov r12d, dword [rbp + 0x4d0]
mov rdx, qword [rbx + 0x50]
mov r9, qword [rbx + 0x30]
test r9, r9
je 0x1400074d6
mov ecx, dword [rbx + 0x38]
lea eax, [rcx + rdi]
cmp eax, dword [rbx + 0x3c]
jb 0x1400074c6
mov dword [rbx + 0x24], 0x30000
jmp 0x1400074ff
mov r8d, edi
add rcx, r9
call fcn.140023e00
add dword [rbx + 0x38], edi
jmp 0x140007505
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400074f8
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rsi
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x48]
jmp 0x140007501
mov dword [rbx + 0x24], 0x1000000
mov eax, esi
cmp eax, edi
jne 0x140007535
mov r8d, 0x4000
lea rdx, [rbx + 0xcc]
mov rcx, rbx
add r13d, edi
call fcn.14000b990
mov edi, eax
test eax, eax
jne 0x1400073b0
mov r15d, dword [rsp + 0x50]
mov dword [rbx + 0xc8], r13d
jmp 0x140007547
mov r15d, dword [rsp + 0x50]
mov esi, 0x60000
jmp 0x140007547
mov dword [rbx + 0xc8], esi
mov rcx, rbx
mov byte [rbx + 0x41], 0
call fcn.140009dd0
mov edx, dword [rbx + 0xc8]
add dword [rbx + 0x28], edx
mov eax, dword [rbx + 0x24]
test eax, eax
jne 0x140007746
test esi, esi
jne 0x140006c08
mov eax, dword [rbx + 0xa0]
mov ecx, dword [rsp + 0x54]
add ecx, edx
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x70], ecx
mov eax, dword [rbx + 0x98]
sete dl
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x74], eax
cmp byte [rbx + 0x2c], sil
je 0x14000760d
cmp qword [rbx], 0
je 0x1400075a6
cmp r12d, 4
jne 0x14000760d
movzx eax, word [rsp + 0x64]
mov word [rsp + 0x66], r15w
test al, 1
jne 0x1400075c2
mov ecx, 0xfff7
and ax, cx
mov word [rsp + 0x64], ax
mov edx, dword [rbp - 0x5c]
mov rcx, rbx
sub edx, dword [rbx + 0x20]
mov word [rbp - 0x64], ax
call fcn.14000ac80
test al, al
je 0x140007603
mov r8, rbx
lea rdx, [0x14000c1a0]
lea rcx, [rsp + 0x60]
call fcn.14000b670
test eax, eax
jne 0x140006c08
mov edx, dword [rbx + 0x28]
mov rcx, rbx
call fcn.14000ac80
test al, al
jne 0x14000764f
mov eax, 0x2000000
jmp 0x140007746
cmp word [rsp + 0x66], r15w
jne 0x14000773a
test r15d, r15d
jne 0x140007626
test dl, dl
je 0x14000773a
mov r8, rbx
lea rdx, [0x14000c1a0]
lea rcx, [rsp + 0x60]
call fcn.14000b4d0
test eax, eax
jne 0x140006c08
movzx eax, word [rbp - 0x64]
add dword [rbx + 0x28], 0x10
mov word [rsp + 0x64], ax
mov eax, dword [rbx + 0x24]
test eax, eax
jne 0x140007746
mov rcx, qword [rbp - 0x78]
call fcn.14000cb38
mov r8, qword [rbp - 0x78]
mov rcx, rax
mov rdx, qword [rbp + 0xb8]
mov rdi, rax
call fcn.140023e00
mov ecx, 0x388
mov qword [rbp + 0xb8], rdi
call fcn.14000caf4
mov r8, rax
mov rcx, rax
lea rax, [rsp + 0x60]
mov edx, 7
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x1400076a0
mov rax, qword [rax]
mov qword [rcx], rax
mov rcx, qword [rbx + 0x60]
test rcx, rcx
jne 0x14000770a
mov qword [rbx + 0x60], r8
xor eax, eax
jmp 0x140007746
mov rax, qword [rcx + 0x380]
test rax, rax
je 0x14000772f
nop word [rax + rax]
mov rcx, rax
mov rax, qword [rax + 0x380]
test rax, rax
jne 0x140007720
mov qword [rcx + 0x380], r8
xor eax, eax
jmp 0x140007746
mov eax, 0x4000000
jmp 0x140007746
mov eax, 0x10000
mov r13, qword [rsp + 0x578]
mov rdi, qword [rsp + 0x588]
mov r14, qword [rsp + 0x570]
mov rsi, qword [rsp + 0x5b8]
mov r12, qword [rsp + 0x580]
mov rcx, qword [rbp + 0x460]
xor rcx, rsp
call fcn.14000ce70
add rsp, 0x590
pop r15
pop rbx
pop rbp
ret