Function at 0x140004da0
Capabilities:
Access pe header
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov rax, qword [0x140048020]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rdi, rdx
mov r12, rcx
xor edx, edx
mov cl, 0x4b
call fcn.1400021a0
mov edx, 1
mov byte [rbp - 0x59], al
mov cl, 0x65
call fcn.1400021a0
mov edx, 2
mov byte [rbp - 0x58], al
mov cl, 0x6d
call fcn.1400021a0
mov edx, 3
mov byte [rbp - 0x57], al
mov cl, 0x6f
call fcn.1400021a0
mov edx, 4
mov byte [rbp - 0x79], al
mov cl, 0x77
mov byte [rbp - 0x56], al
call fcn.1400021a0
mov edx, 5
mov byte [rbp - 0x55], al
mov cl, 0x61
call fcn.1400021a0
mov edx, 6
mov byte [rbp - 0x73], al
mov cl, 0x72
mov byte [rbp - 0x54], al
call fcn.1400021a0
mov edx, 7
mov byte [rbp - 0x53], al
mov cl, 0x65
call fcn.1400021a0
mov edx, 8
mov byte [rbp - 0x77], al
mov cl, 0x20
mov byte [rbp - 0x52], al
call fcn.1400021a0
mov edx, 9
mov byte [rbp - 0x51], al
mov cl, 0x69
call fcn.1400021a0
mov edx, 0xa
mov byte [rbp - 0x50], al
mov cl, 0x6e
call fcn.1400021a0
mov edx, 0xb
mov byte [rbp - 0x4f], al
mov cl, 0x6a
call fcn.1400021a0
mov edx, 0xc
mov byte [rbp - 0x4e], al
mov cl, 0x65
call fcn.1400021a0
mov edx, 0xd
mov byte [rbp - 0x76], al
mov cl, 0x63
mov byte [rbp - 0x4d], al
call fcn.1400021a0
mov edx, 0xe
mov byte [rbp - 0x4c], al
mov cl, 0x74
call fcn.1400021a0
mov edx, 0xf
mov byte [rbp - 0x4b], al
mov cl, 0x6f
call fcn.1400021a0
mov edx, 0x10
mov byte [rbp - 0x4a], al
mov cl, 0x72
call fcn.1400021a0
mov edx, 0x11
mov byte [rbp - 0x49], al
mov cl, 0xa
call fcn.1400021a0
mov byte [rbp - 0x48], al
xor eax, eax
mov byte [rbp - 0x47], al
xor ebx, ebx
mov edx, ebx
movsxd rax, edx
lea rcx, [rbp - 0x59]
add rcx, rax
lea eax, [rdx + 0x13]
inc edx
xor byte [rcx], al
cmp edx, 0x12
jb 0x140004ef0
lea rcx, [rbp - 0x59]
mov byte [rbp - 0x47], bl
call fcn.140001360
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140004f4d
mov r15, rbx
mov qword [rbp - 0x61], rbx
jmp 0x140004fbc
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
mov edx, eax
mov r8d, 0x3000
mov edi, eax
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov rdx, rax
mov qword [rbp - 0x61], rax
mov r8d, edi
mov rcx, rsi
mov r15, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140004f99
cmp dword [r15], 0x905a4d
je 0x140004faa
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15, r15
jne 0x1400050c2
xor edx, edx
mov cl, 0x64
call fcn.1400021a0
mov edx, 1
mov byte [rbp - 0x59], al
mov cl, 0x6c
call fcn.1400021a0
mov edx, 2
mov byte [rbp - 0x58], al
call fcn.1400021a0
mov edx, 3
mov byte [rbp - 0x57], al
mov cl, 0x20
call fcn.1400021a0
mov edx, 4
mov byte [rbp - 0x56], al
mov cl, 0x6e
call fcn.1400021a0
mov edx, 5
mov byte [rbp - 0x55], al
mov cl, 0x6f
call fcn.1400021a0
mov edx, 6
mov byte [rbp - 0x54], al
mov cl, 0x74
call fcn.1400021a0
mov edx, 7
mov byte [rbp - 0x53], al
mov cl, 0x20
call fcn.1400021a0
mov edx, 8
mov byte [rbp - 0x52], al
mov cl, 0x66
call fcn.1400021a0
mov edx, 9
mov byte [rbp - 0x51], al
mov cl, 0x6f
call fcn.1400021a0
mov edx, 0xa
mov byte [rbp - 0x50], al
mov cl, 0x75
call fcn.1400021a0
mov edx, 0xb
mov byte [rbp - 0x4f], al
mov cl, 0x6e
call fcn.1400021a0
mov edx, 0xc
mov byte [rbp - 0x4e], al
mov cl, 0x64
call fcn.1400021a0
mov edx, 0xd
mov byte [rbp - 0x4d], al
mov cl, 0x20
call fcn.1400021a0
mov edx, 0xe
mov byte [rbp - 0x4c], al
mov cl, 0xa
call fcn.1400021a0
mov byte [rbp - 0x4b], al
mov edx, ebx
xor eax, eax
mov byte [rbp - 0x4a], al
nop
movsxd rax, edx
lea rcx, [rbp - 0x59]
add rcx, rax
lea eax, [rdx + 0x13]
inc edx
xor byte [rcx], al
cmp edx, 0xf
jb 0x1400050a0
lea rcx, [rbp - 0x59]
mov byte [rbp - 0x4a], bl
call fcn.140001360
mov rcx, r15
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r14, rax
test rax, rax
jne 0x140005362
xor edx, edx
mov cl, 0x70
call fcn.1400021a0
lea edx, [r14 + 1]
mov byte [rbp - 0x19], al
mov cl, 0x75
call fcn.1400021a0
lea edx, [r14 + 2]
mov byte [rbp - 0x18], al
mov cl, 0x74
call fcn.1400021a0
lea edx, [r14 + 3]
mov byte [rbp - 0x17], al
mov cl, 0x20
call fcn.1400021a0
lea edx, [r14 + 4]
mov byte [rbp - 0x16], al
mov cl, 0x74
call fcn.1400021a0
lea edx, [r14 + 5]
mov byte [rbp - 0x15], al
mov cl, 0x68
call fcn.1400021a0
lea edx, [r14 + 6]
mov byte [rbp - 0x14], al
mov cl, 0x65
call fcn.1400021a0
lea edx, [r14 + 7]
mov byte [rbp - 0x13], al
mov cl, 0x20
call fcn.1400021a0
lea edx, [r14 + 8]
mov byte [rbp - 0x12], al
mov cl, 0x64
call fcn.1400021a0
lea edx, [r14 + 9]
mov byte [rbp - 0x11], al
mov cl, 0x6c
call fcn.1400021a0
lea edx, [r14 + 0xa]
mov byte [rbp - 0x10], al
call fcn.1400021a0
lea edx, [r14 + 0xb]
mov byte [rbp - 0xf], al
mov cl, 0x20
call fcn.1400021a0
lea edx, [r14 + 0xc]
mov byte [rbp - 0xe], al
mov cl, 0x69
call fcn.1400021a0
lea edx, [r14 + 0xd]
mov byte [rbp - 0xd], al
mov cl, 0x6e
call fcn.1400021a0
lea edx, [r14 + 0xe]
mov byte [rbp - 0xc], al
mov cl, 0x20
call fcn.1400021a0
lea edx, [r14 + 0xf]
mov byte [rbp - 0xb], al
mov cl, 0x73
call fcn.1400021a0
lea edx, [r14 + 0x10]
mov byte [rbp - 0xa], al
mov cl, 0x61
call fcn.1400021a0
lea edx, [r14 + 0x11]
mov byte [rbp - 9], al
mov cl, 0x6d
call fcn.1400021a0
lea edx, [r14 + 0x12]
mov byte [rbp - 8], al
mov cl, 0x65
call fcn.1400021a0
lea edx, [r14 + 0x13]
mov byte [rbp - 7], al
mov cl, 0x20
call fcn.1400021a0
mov byte [rbp - 6], al
lea edx, [r14 + 0x14]
mov cl, 0x66
call fcn.1400021a0
lea edx, [r14 + 0x15]
mov byte [rbp - 5], al
mov cl, 0x6f
call fcn.1400021a0
lea edx, [r14 + 0x16]
mov byte [rbp - 4], al
mov cl, 0x6c
call fcn.1400021a0
lea edx, [r14 + 0x17]
mov byte [rbp - 3], al
mov cl, 0x64
call fcn.1400021a0
lea edx, [r14 + 0x18]
mov byte [rbp - 2], al
mov cl, 0x65
call fcn.1400021a0
lea edx, [r14 + 0x19]
mov byte [rbp - 1], al
mov cl, 0x72
call fcn.1400021a0
lea edx, [r14 + 0x1a]
mov byte [rbp], al
mov cl, 0x20
call fcn.1400021a0
lea edx, [r14 + 0x1b]
mov byte [rbp + 1], al
mov cl, 0x61
call fcn.1400021a0
lea edx, [r14 + 0x1c]
mov byte [rbp + 2], al
mov cl, 0x73
call fcn.1400021a0
lea edx, [r14 + 0x1d]
mov byte [rbp + 3], al
mov cl, 0x20
call fcn.1400021a0
lea edx, [r14 + 0x1e]
mov byte [rbp + 4], al
mov cl, 0x74
call fcn.1400021a0
lea edx, [r14 + 0x1f]
mov byte [rbp + 5], al
mov cl, 0x68
call fcn.1400021a0
lea edx, [r14 + 0x20]
mov byte [rbp + 6], al
mov cl, 0x65
call fcn.1400021a0
lea edx, [r14 + 0x21]
mov byte [rbp + 7], al
mov cl, 0x20
call fcn.1400021a0
lea edx, [r14 + 0x22]
mov byte [rbp + 8], al
mov cl, 0x69
call fcn.1400021a0
lea edx, [r14 + 0x23]
mov byte [rbp + 9], al
mov cl, 0x6e
call fcn.1400021a0
lea edx, [r14 + 0x24]
mov byte [rbp + 0xa], al
mov cl, 0x6a
call fcn.1400021a0
lea edx, [r14 + 0x25]
mov byte [rbp + 0xb], al
mov cl, 0x65
call fcn.1400021a0
lea edx, [r14 + 0x26]
mov byte [rbp + 0xc], al
mov cl, 0x63
call fcn.1400021a0
lea edx, [r14 + 0x27]
mov byte [rbp + 0xd], al
mov cl, 0x74
call fcn.1400021a0
lea edx, [r14 + 0x28]
mov byte [rbp + 0xe], al
mov cl, 0x6f
call fcn.1400021a0
lea edx, [r14 + 0x29]
mov byte [rbp + 0xf], al
mov cl, 0x72
call fcn.1400021a0
lea edx, [r14 + 0x2a]
mov byte [rbp + 0x10], al
mov cl, 0xa
call fcn.1400021a0
mov byte [rbp + 0x11], al
mov edx, ebx
xor eax, eax
mov byte [rbp + 0x12], al
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x19]
add rcx, rax
lea eax, [rdx + 0x13]
inc edx
xor byte [rcx], al
cmp edx, 0x2b
jb 0x140005340
lea rcx, [rbp - 0x19]
mov byte [rbp + 0x12], bl
call fcn.140001360
mov dword [rbp - 0x39], ebx
xor edx, edx
mov rcx, r12
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
lea rdx, [rbp - 0x39]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, 0x14
mov dword [rbp - 0x65], eax
mov esi, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [rbp - 0x39]
test edi, edi
je 0x140005365
xor edx, edx
mov cl, 0x70
call fcn.1400021a0
mov edx, 1
mov byte [rbp - 0x59], al
mov cl, 0x72
call fcn.1400021a0
mov edx, 2
mov byte [rbp - 0x58], al
mov cl, 0x6f
call fcn.1400021a0
mov edx, 3
mov byte [rbp - 0x57], al
mov cl, 0x63
call fcn.1400021a0
mov edx, 4
mov byte [rbp - 0x56], al
mov cl, 0x65
call fcn.1400021a0
mov edx, 5
mov byte [rbp - 0x78], al
mov cl, 0x73
mov byte [rbp - 0x55], al
call fcn.1400021a0
mov edx, 6
mov byte [rbp - 0x54], al
call fcn.1400021a0
mov edx, 7
mov byte [rbp - 0x68], al
mov cl, 0x20
mov byte [rbp - 0x53], al
call fcn.1400021a0
mov edx, 8
mov byte [rbp - 0x67], al
mov cl, 0x3d
mov byte [rbp - 0x52], al
call fcn.1400021a0
mov edx, 9
mov byte [rbp - 0x51], al
movzx r12d, al
call fcn.1400021a0
mov edx, 0xa
mov byte [rbp - 0x50], al
mov cl, 0x20
call fcn.1400021a0
mov edx, 0xb
mov byte [rbp - 0x74], al
mov cl, 0x30
mov byte [rbp - 0x4f], al
call fcn.1400021a0
mov edx, 0xc
mov byte [rbp - 0x4e], al
mov cl, 0x78
call fcn.1400021a0
mov byte [rbp - 0x4d], al
mov edx, ebx
xor eax, eax
mov byte [rbp - 0x4c], al
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x59]
add rcx, rax
lea eax, [rdx + 0x13]
inc edx
xor byte [rcx], al
cmp edx, 0xd
jb 0x140005470
lea rdx, [rbp - 0x59]
mov byte [rbp - 0x4c], bl
call fcn.140009670
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov edx, edi
mov rcx, rax
call fcn.140006d80
mov rcx, rax
call fcn.140009950
xor edx, edx
mov cl, 0x74
call fcn.1400021a0
mov edx, 1
mov byte [rbp - 0x59], al
mov cl, 0x68
call fcn.1400021a0
mov edx, 2
mov byte [rbp - 0x58], al
mov cl, 0x72
movzx r13d, al
call fcn.1400021a0
mov edx, 3
mov byte [rbp - 0x57], al
mov cl, 0x65
call fcn.1400021a0
mov edx, 4
mov byte [rbp - 0x56], al
mov cl, 0x61
call fcn.1400021a0
mov edx, 5
mov byte [rbp - 0x55], al
mov cl, 0x64
call fcn.1400021a0
mov edx, 6
mov byte [rbp - 0x75], al
mov cl, 0x20
mov byte [rbp - 0x54], al
call fcn.1400021a0
mov edx, 7
mov byte [rbp - 0x53], al
mov cl, 0x3d
call fcn.1400021a0
mov edx, 9
mov byte [rbp - 0x52], al
mov cl, 0x20
mov byte [rbp - 0x51], r12b
call fcn.1400021a0
mov edx, 0xa
mov byte [rbp - 0x50], al
mov cl, 0x30
call fcn.1400021a0
mov edx, 0xb
mov byte [rbp - 0x4f], al
mov cl, 0x78
call fcn.1400021a0
mov byte [rbp - 0x4e], al
mov edx, ebx
xor eax, eax
mov byte [rbp - 0x4d], al
movsxd rax, edx
lea rcx, [rbp - 0x59]
add rcx, rax
lea eax, [rdx + 0x13]
inc edx
xor byte [rcx], al
cmp edx, 0xc
jb 0x140005571
lea rdx, [rbp - 0x59]
mov byte [rbp - 0x4d], bl
call fcn.140009670
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov edx, esi
mov rcx, rax
call fcn.140006d80
mov rcx, rax
call fcn.140009950
test esi, esi
je 0x140005f9e
mov rax, qword gs:[0x58]
mov r13d, 4
add r13, qword [rax]
mov eax, dword [0x14008e0d8]
cmp eax, dword [r13]
jle 0x14000562a
lea rcx, [0x14008e0d8]
call fcn.14000d868
mov eax, dword [0x14008e0d8]
cmp eax, 0xffffffff
jne 0x14000562a
lea rcx, [0x140033730]
mov dword [0x14008e0e0], ebx
mov qword [0x14008e0e8], 0xffffffffffffffff
call fcn.14000dbb0
lea rcx, [0x14008e0d8]
call fcn.14000d808
mov eax, dword [0x14008e0d8]
mov dword [0x14008e0e0], edi
cmp eax, dword [r13]
jle 0x140005674
lea rcx, [0x14008e0d8]
call fcn.14000d868
cmp dword [0x14008e0d8], 0xffffffff
jne 0x140005674
lea rcx, [0x140033730]
mov dword [0x14008e0e0], ebx
mov qword [0x14008e0e8], 0xffffffffffffffff
call fcn.14000dbb0
lea rcx, [0x14008e0d8]
call fcn.14000d808
mov eax, dword [0x14008e0e0]
mov r12, rbx
mov rcx, qword [0x14008e0e8]
mov dword [rbp - 0x19], eax
lea rax, [rbp - 0x59]
mov qword [rbp - 0x11], rax
mov eax, dword [r14 + 0x50]
mov qword [rbp - 9], rax
mov qword [rbp - 0x59], rbx
mov dword [rbp - 0x15], ebx
mov qword [rbp - 1], 0x40
cmp rcx, 0xffffffffffffffff
je 0x1400056d8
mov qword [rsp + 0x38], rbx
lea r8, [rbp - 0x19]
mov qword [rsp + 0x30], rbx
mov r9d, 0x20
mov dword [rsp + 0x28], ebx
mov edx, 0x3009d220
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov r12, qword [rbp - 0x59]
xor edx, edx
mov cl, 0x61
call fcn.1400021a0
mov edx, 1
mov byte [rbp - 0x39], al
mov cl, 0x6c
call fcn.1400021a0
mov edx, 2
mov byte [rbp - 0x69], al
mov byte [rbp - 0x38], al
call fcn.1400021a0
mov byte [rbp - 0x74], al
mov edx, 4
mov byte [rbp - 0x37], al
mov cl, 0x63
movzx eax, byte [rbp - 0x79]
mov byte [rbp - 0x36], al
call fcn.1400021a0
mov byte [rbp - 0x35], al
mov edx, 6
movzx eax, byte [rbp - 0x73]
mov cl, 0x74
mov byte [rbp - 0x34], al
call fcn.1400021a0
mov byte [rbp - 0x79], al
mov edx, 8
mov byte [rbp - 0x33], al
mov cl, 0x64
movzx eax, byte [rbp - 0x77]
mov byte [rbp - 0x32], al
call fcn.1400021a0
mov edx, 9
mov byte [rbp - 0x31], al
mov cl, 0x62
call fcn.1400021a0
mov edx, 0xa
mov byte [rbp - 0x30], al
mov cl, 0x61
call fcn.1400021a0
mov edx, 0xb
mov byte [rbp - 0x2f], al
mov cl, 0x73
call fcn.1400021a0
mov byte [rbp - 0x2e], al
mov edx, 0xd
movzx eax, byte [rbp - 0x76]
mov cl, 0x20
mov byte [rbp - 0x2d], al
call fcn.1400021a0
mov edx, 0xe
mov byte [rbp - 0x2c], al
mov cl, 0x3d
call fcn.1400021a0
mov edx, 0xf
mov byte [rbp - 0x2b], al
call fcn.1400021a0
mov edx, 0x10
mov byte [rbp - 0x2a], al
mov cl, 0x20
call fcn.1400021a0
mov edx, 0x11
mov byte [rbp - 0x29], al
mov cl, 0x30
call fcn.1400021a0
mov edx, 0x12
mov byte [rbp - 0x28], al
mov cl, 0x78
call fcn.1400021a0
mov byte [rbp - 0x27], al
mov edx, ebx
xor eax, eax
mov byte [rbp - 0x26], al
nop
movsxd rax, edx
lea rcx, [rbp - 0x39]
add rcx, rax
lea eax, [rdx + 0x13]
inc edx
xor byte [rcx], al
cmp edx, 0x13
jb 0x1400057e0
lea rdx, [rbp - 0x39]
mov byte [rbp - 0x26], bl
call fcn.140009670
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov rdx, r12
mov rcx, rax
call fcn.140006b70
mov rcx, rax
call fcn.140009950
mov r8, r14
mov rdx, r15
mov rcx, r12
call fcn.1400049c0
test eax, eax
jne 0x140005952
mov eax, dword [r13]
cmp dword [0x14008e0d8], eax
jle 0x14000588e
lea rcx, [0x14008e0d8]
call fcn.14000d868
cmp dword [0x14008e0d8], 0xffffffff
jne 0x14000588e
lea rcx, [0x140033730]
mov dword [0x14008e0e0], ebx
mov qword [0x14008e0e8], 0xffffffffffffffff
call fcn.14000dbb0
lea rcx, [0x14008e0d8]
call fcn.14000d808
mov rcx, qword [0x14008e0e8]
mov eax, dword [0x14008e0e0]
mov dword [rbp - 0x35], ebx
mov dword [rbp - 0x39], eax
mov qword [rbp - 0x31], r12
cmp rcx, 0xffffffffffffffff
je 0x1400058d3
mov qword [rsp + 0x38], rbx
lea r8, [rbp - 0x39]
mov qword [rsp + 0x30], rbx
mov r9d, 0x10
mov dword [rsp + 0x28], ebx
mov edx, 0x3009d4e0
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor edx, edx
mov cl, 0x66
call fcn.1400021a0
mov edx, 1
mov byte [rbp - 0x39], al
mov cl, 0x61
call fcn.1400021a0
mov edx, 2
mov byte [rbp - 0x38], al
mov cl, 0x69
call fcn.1400021a0
mov edx, 3
mov byte [rbp - 0x37], al
mov cl, 0x6c
call fcn.1400021a0
mov edx, 4
mov byte [rbp - 0x36], al
mov cl, 0xa
call fcn.1400021a0
mov byte [rbp - 0x35], al
mov edx, ebx
xor eax, eax
mov byte [rbp - 0x34], al
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x39]
add rcx, rax
lea eax, [rdx + 0x13]
inc edx
xor byte [rcx], al
cmp edx, 5
jb 0x140005930
lea rcx, [rbp - 0x39]
mov byte [rbp - 0x34], bl
call fcn.140001360
mov r8, r14
mov rdx, r15
mov ecx, esi
call fcn.140004b50
test eax, eax
jne 0x140005a87
mov eax, dword [r13]
cmp dword [0x14008e0d8], eax
jle 0x1400059b1
lea rcx, [0x14008e0d8]
call fcn.14000d868
cmp dword [0x14008e0d8], 0xffffffff
jne 0x1400059b1
lea rcx, [0x140033730]
mov dword [0x14008e0e0], ebx
mov qword [0x14008e0e8], 0xffffffffffffffff
call fcn.14000dbb0
lea rcx, [0x14008e0d8]
call fcn.14000d808
mov rcx, qword [0x14008e0e8]
mov eax, dword [0x14008e0e0]
mov dword [rbp - 0x35], ebx
mov dword [rbp - 0x39], eax
mov qword [rbp - 0x31], r12
cmp rcx, 0xffffffffffffffff
je 0x1400059f6
mov qword [rsp + 0x38], rbx
lea r8, [rbp - 0x39]
mov qword [rsp + 0x30], rbx
mov r9d, 0x10
mov dword [rsp + 0x28], ebx
mov edx, 0x3009d4e0
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor edx, edx
mov cl, 0x66
call fcn.1400021a0
mov edx, 1
mov byte [rbp - 0x39], al
mov cl, 0x61
call fcn.1400021a0
mov edx, 2
mov byte [rbp - 0x38], al
mov cl, 0x69
call fcn.1400021a0
mov edx, 3
mov byte [rbp - 0x37], al
mov cl, 0x6c
call fcn.1400021a0
movzx edi, byte [rbp - 0x78]
mov edx, 6
mov byte [rbp - 0x36], al
mov cl, 0xa
movzx eax, byte [rbp - 0x75]
mov byte [rbp - 0x34], al
mov byte [rbp - 0x35], dil
call fcn.1400021a0
mov byte [rbp - 0x33], al
mov r8d, ebx
xor eax, eax
mov byte [rbp - 0x32], al
nop word [rax + rax]
movsxd rax, r8d
lea rcx, [rbp - 0x39]
add rcx, rax
lea eax, [r8 + 0x13]
inc r8d
xor byte [rcx], al
cmp r8d, 7
jb 0x140005a60
lea rcx, [rbp - 0x39]
mov byte [rbp - 0x32], bl
call fcn.140001360
jmp 0x140005a8b
movzx edi, byte [rbp - 0x78]
xor edx, edx
mov cl, 0x63
call fcn.1400021a0
mov edx, 1
mov byte [rbp - 0x75], al
mov cl, 0x6f
mov byte [rbp - 0x39], al
call fcn.1400021a0
mov edx, 2
mov byte [rbp - 0x76], al
mov cl, 0x6e
mov byte [rbp - 0x38], al
call fcn.1400021a0
mov edx, 3
mov byte [rbp - 0x77], al
mov byte [rbp - 0x37], al
call fcn.1400021a0
mov edx, 5
mov byte [rbp - 0x72], al
mov cl, 0x63
mov byte [rbp - 0x36], al
mov byte [rbp - 0x35], dil
call fcn.1400021a0
mov byte [rbp - 0x71], al
mov edx, 7
mov byte [rbp - 0x34], al
mov cl, 0x69
movzx eax, byte [rbp - 0x79]
mov byte [rbp - 0x33], al
call fcn.1400021a0
mov edx, 8
mov byte [rbp - 0x70], al
mov cl, 0x6e
mov byte [rbp - 0x32], al
call fcn.1400021a0
mov edx, 9
mov byte [rbp - 0x6f], al
mov cl, 0x67
mov byte [rbp - 0x31], al
call fcn.1400021a0
mov edx, 0xa
mov byte [rbp - 0x6e], al
mov cl, 0x2e
mov byte [rbp - 0x30], al
call fcn.1400021a0
mov edx, 0xb
mov byte [rbp - 0x6d], al
mov byte [rbp - 0x2f], al
call fcn.1400021a0
mov edx, 0xc
mov byte [rbp - 0x6c], al
mov byte [rbp - 0x2e], al
call fcn.1400021a0
mov edx, 0xd
mov byte [rbp - 0x6b], al
mov cl, 0xa
mov byte [rbp - 0x2d], al
call fcn.1400021a0
mov byte [rbp - 0x6a], al
mov r8d, ebx
mov byte [rbp - 0x2c], al
xor eax, eax
mov byte [rbp - 0x2b], al
nop dword [rax]
movsxd rcx, r8d
lea rdx, [rbp - 0x39]
add rdx, rcx
lea ecx, [r8 + 0x13]
inc r8d
xor byte [rdx], cl
cmp r8d, 0xe
jb 0x140005b70
lea rcx, [rbp - 0x39]
mov byte [rbp - 0x2b], al
call fcn.140001360
movzx edi, word [r14 + 0x14]
movzx esi, bx
add rdi, 0x2c
cmp bx, word [r14 + 6]
jae 0x140005c6f
add rdi, r14
nop
mov eax, dword [r13]
cmp dword [0x14008e0d8], eax
jle 0x140005bfa
lea rcx, [0x14008e0d8]
call fcn.14000d868
cmp dword [0x14008e0d8], 0xffffffff
jne 0x140005bfa
lea rcx, [0x140033730]
mov dword [0x14008e0e0], ebx
mov qword [0x14008e0e8], 0xffffffffffffffff
call fcn.14000dbb0
lea rcx, [0x14008e0d8]
call fcn.14000d808
mov eax, dword [0x14008e0e0]
mov rcx, qword [0x14008e0e8]
mov dword [rbp - 0x21], eax
mov eax, dword [rdi - 8]
add rax, r12
mov word [rbp - 0x1c], bx
mov qword [rbp - 0x31], rax
mov eax, dword [rdi]
add rax, r15
mov byte [rbp - 0x1a], bl
mov qword [rbp - 0x39], rax
mov eax, dword [rdi - 4]
mov qword [rbp - 0x29], rax
mov byte [rbp - 0x1d], 1
cmp rcx, 0xffffffffffffffff
je 0x140005c5d
mov qword [rsp + 0x38], rbx
lea r8, [rbp - 0x39]
mov qword [rsp + 0x30], rbx
mov r9d, 0x20
mov dword [rsp + 0x28], ebx
mov edx, 0x3009ce20
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
inc si
add rdi, 0x28
cmp si, word [r14 + 6]
jb 0x140005bb0
movzx eax, byte [rbp - 0x75]
mov edx, ebx
mov byte [rbp - 0x39], al
movzx eax, byte [rbp - 0x76]
mov byte [rbp - 0x38], al
movzx eax, byte [rbp - 0x77]
mov byte [rbp - 0x37], al
movzx eax, byte [rbp - 0x72]
mov byte [rbp - 0x36], al
movzx eax, byte [rbp - 0x78]
mov byte [rbp - 0x35], al
movzx eax, byte [rbp - 0x71]
mov byte [rbp - 0x34], al
movzx eax, byte [rbp - 0x79]
mov byte [rbp - 0x33], al
movzx eax, byte [rbp - 0x70]
mov byte [rbp - 0x32], al
movzx eax, byte [rbp - 0x6f]
mov byte [rbp - 0x31], al
movzx eax, byte [rbp - 0x6e]
mov byte [rbp - 0x30], al
movzx eax, byte [rbp - 0x6d]
mov byte [rbp - 0x2f], al
movzx eax, byte [rbp - 0x6c]
mov byte [rbp - 0x2e], al
movzx eax, byte [rbp - 0x6b]
mov byte [rbp - 0x2d], al
movzx eax, byte [rbp - 0x6a]
mov byte [rbp - 0x2c], al
xor eax, eax
mov byte [rbp - 0x2b], al
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x39]
add rcx, rax
lea eax, [rdx + 0x13]
inc edx
xor byte [rcx], al
cmp edx, 0xe
jb 0x140005ce0
lea rcx, [rbp - 0x39]
mov byte [rbp - 0x2b], bl
call fcn.140001360
mov ecx, dword [rbp - 0x65]
mov r8, r14
mov rdx, r12
call fcn.140004430
xor edx, edx
mov cl, 0x64
call fcn.1400021a0
mov byte [rbp - 0x59], al
mov edx, 3
movzx eax, byte [rbp - 0x69]
mov cl, 0x20
mov byte [rbp - 0x58], al
movzx eax, byte [rbp - 0x74]
mov byte [rbp - 0x57], al
call fcn.1400021a0
mov edx, 4
mov byte [rbp - 0x56], al
mov cl, 0x68
call fcn.1400021a0
mov byte [rbp - 0x55], al
mov edx, 8
movzx eax, byte [rbp - 0x73]
mov cl, 0x62
mov byte [rbp - 0x54], al
movzx eax, byte [rbp - 0x68]
mov byte [rbp - 0x53], al
movzx eax, byte [rbp - 0x67]
mov byte [rbp - 0x52], al
call fcn.1400021a0
mov edx, 9
mov byte [rbp - 0x51], al
mov cl, 0x65
call fcn.1400021a0
mov edx, 0xa
mov byte [rbp - 0x50], al
call fcn.1400021a0
mov edx, 0xb
mov byte [rbp - 0x4f], al
mov cl, 0x6e
call fcn.1400021a0
mov edx, 0xc
mov byte [rbp - 0x4e], al
mov cl, 0x20
call fcn.1400021a0
mov edx, 0xd
mov byte [rbp - 0x4d], al
mov cl, 0x69
call fcn.1400021a0
mov edx, 0xe
mov byte [rbp - 0x4c], al
mov cl, 0x6e
call fcn.1400021a0
mov edx, 0xf
mov byte [rbp - 0x4b], al
mov cl, 0x6a
call fcn.1400021a0
mov edx, 0x10
mov byte [rbp - 0x4a], al
mov cl, 0x65
call fcn.1400021a0
mov edx, 0x11
mov byte [rbp - 0x49], al
mov cl, 0x63
call fcn.1400021a0
mov edx, 0x12
mov byte [rbp - 0x48], al
mov cl, 0x74
call fcn.1400021a0
mov edx, 0x13
mov byte [rbp - 0x47], al
mov cl, 0x65
call fcn.1400021a0
mov edx, 0x14
mov byte [rbp - 0x46], al
mov cl, 0x64
call fcn.1400021a0
mov byte [rbp - 0x45], al
mov edx, 0x15
mov cl, 0xa
call fcn.1400021a0
mov byte [rbp - 0x44], al
mov edx, ebx
xor eax, eax
mov byte [rbp - 0x43], al
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x59]
add rcx, rax
lea eax, [rdx + 0x13]
inc edx
xor byte [rcx], al
cmp edx, 0x16
jb 0x140005e40
lea rcx, [rbp - 0x59]
mov byte [rbp - 0x43], bl
call fcn.140001360
movzx edi, word [r14 + 0x14]
movzx esi, bx
add rdi, 0x28
cmp bx, word [r14 + 6]
jae 0x140005f7c
add rdi, r14
nop dword [rax]
mov eax, dword [rdi]
test eax, eax
je 0x140005f66
test dword [rdi + 0x14], 0x2000000
je 0x140005f66
xor ecx, ecx
mov edx, eax
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [r13]
mov r15, rax
cmp dword [0x14008e0d8], ecx
jle 0x140005ef8
lea rcx, [0x14008e0d8]
call fcn.14000d868
cmp dword [0x14008e0d8], 0xffffffff
jne 0x140005ef8
lea rcx, [0x140033730]
mov dword [0x14008e0e0], ebx
mov qword [0x14008e0e8], 0xffffffffffffffff
call fcn.14000dbb0
lea rcx, [0x14008e0d8]
call fcn.14000d808
mov eax, dword [0x14008e0e0]
mov rcx, qword [0x14008e0e8]
mov dword [rbp - 0x41], eax
mov eax, dword [rdi - 4]
add rax, r12
mov word [rbp - 0x3c], bx
mov qword [rbp - 0x51], rax
mov eax, dword [rdi]
mov qword [rbp - 0x49], rax
mov byte [rbp - 0x3a], bl
mov qword [rbp - 0x59], r15
mov byte [rbp - 0x3d], 1
cmp rcx, 0xffffffffffffffff
je 0x140005f55
mov qword [rsp + 0x38], rbx
lea r8, [rbp - 0x59]
mov qword [rsp + 0x30], rbx
mov r9d, 0x20
mov dword [rsp + 0x28], ebx
mov edx, 0x3009ce20
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
inc si
add rdi, 0x28
cmp si, word [r14 + 6]
jb 0x140005e80
mov r15, qword [rbp - 0x61]
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [0x14008ca40]
call fcn.140009950
jmp 0x140006113
xor edx, edx
mov cl, 0x75
call fcn.1400021a0
mov edx, 2
mov byte [rbp - 0x59], al
mov cl, 0x20
mov byte [rbp - 0x58], r13b
call fcn.1400021a0
mov edx, 3
mov byte [rbp - 0x57], al
mov cl, 0x73
call fcn.1400021a0
mov edx, 4
mov byte [rbp - 0x56], al
mov cl, 0x6f
call fcn.1400021a0
mov edx, 5
mov byte [rbp - 0x55], al
mov cl, 0x6d
call fcn.1400021a0
mov edx, 6
mov byte [rbp - 0x54], al
mov cl, 0x65
call fcn.1400021a0
mov edx, 7
mov byte [rbp - 0x53], al
mov cl, 0x6f
call fcn.1400021a0
mov edx, 8
mov byte [rbp - 0x52], al
mov cl, 0x6e
call fcn.1400021a0
mov edx, 9
mov byte [rbp - 0x51], al
mov cl, 0x65
call fcn.1400021a0
mov byte [rbp - 0x50], al
mov edx, 0xb
movzx eax, byte [rbp - 0x74]
mov cl, 0x69
mov byte [rbp - 0x4f], al
call fcn.1400021a0
mov edx, 0xc
mov byte [rbp - 0x4e], al
mov cl, 0x73
call fcn.1400021a0
mov edx, 0xd
mov byte [rbp - 0x4d], al
mov cl, 0x20
call fcn.1400021a0
mov edx, 0xe
mov byte [rbp - 0x4c], al
mov cl, 0x64
call fcn.1400021a0
mov edx, 0xf
mov byte [rbp - 0x4b], al
mov cl, 0x75
call fcn.1400021a0
mov edx, 0x10
mov byte [rbp - 0x4a], al
mov cl, 0x6d
call fcn.1400021a0
mov edx, 0x11
mov byte [rbp - 0x49], al
mov cl, 0x62
call fcn.1400021a0
mov edx, 0x12
mov byte [rbp - 0x48], al
mov cl, 0x3f
call fcn.1400021a0
mov edx, 0x13
mov byte [rbp - 0x47], al
mov cl, 0x20
call fcn.1400021a0
mov edx, 0x14
mov byte [rbp - 0x46], al
mov cl, 0x3a
call fcn.1400021a0
mov byte [rbp - 0x45], al
mov edx, 0x15
mov cl, 0x28
call fcn.1400021a0
mov edx, 0x16
mov byte [rbp - 0x44], al
mov cl, 0xa
call fcn.1400021a0
mov byte [rbp - 0x43], al
xor eax, eax
mov byte [rbp - 0x42], al
nop word [rax + rax]
movsxd rax, ebx
lea rcx, [rbp - 0x59]
add rcx, rax
lea eax, [rbx + 0x13]
inc ebx
xor byte [rcx], al
cmp ebx, 0x17
jb 0x1400060f0
lea rcx, [rbp - 0x59]
mov byte [rbp - 0x42], 0
call fcn.140001360
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14000d6f0
mov rbx, qword [rsp + 0x130]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret