Function at 0x140016fb0
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r14, rcx
mov r8, qword [rcx + 0x48]
mov eax, dword [0x14020eff0]
xor edx, edx
div dword [0x14020eff4]
nop word cs:[rax + rax]
mov eax, dword [0x14020eff8]
sub eax, dword [0x14020effc]
or eax, 0xad22de08
imul rax, rax, 0x66ac18a7
shr rax, 0x3b
cmp eax, 0xaefa855d
ja 0x140016fe0
test r8, r8
mov qword [rsp + 0x30], r14
je 0x1400183a0
nop word cs:[rax + rax]
mov eax, dword [0x14020f004]
add eax, dword [0x14020f000]
imul rax, rax, 0x23942561
shr rax, 0x3d
imul eax, eax, 0xb9e3003f
and eax, 0x6c67af70
cmp eax, 0xccfcade7
ja 0x140017020
nop dword [rax]
mov eax, dword [0x14020f008]
xor edx, edx
div dword [0x14020f00c]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x62661b0d
and ecx, 0x9d99e4f2
imul ecx, edx
mov edx, eax
and edx, 0x9d99e4f2
or eax, 0x9d99e4f2
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xa5af66b2
and eax, 0x5a50994c
add eax, eax
sub eax, ecx
imul rax, rax, 0x5b4b04f3
shr rax, 0x3e
cmp eax, 0x56b72ffb
je 0x140017050
mov rax, qword [r14 + 0x58]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x140018221
nop word [rax + rax]
mov eax, dword [0x14020f010]
mov ecx, dword [0x14020f014]
mov edx, eax
and edx, ecx
xor eax, ecx
lea eax, [rax + rdx*2]
xor eax, 0x9cf7bc17
imul eax, eax, 0x39cf01e1
add eax, 0x173cd392
cmp eax, 0xf2984841
ja 0x1400170c0
mov r15, qword [r14 + 0x40]
movdqa xmm0, xmmword [r15]
mov eax, dword [0x14020f018]
xor edx, edx
div dword [0x14020f01c]
mov eax, 0x9175b513
nop dword [rax + rax]
mov ecx, dword [0x14020f020]
sub ecx, dword [0x14020f024]
mov edx, ecx
and edx, 0x15112f16
xor ecx, 0x15112f16
lea ecx, [rcx + rdx*2]
shr ecx, 1
imul rcx, rax
shr rcx, 0x3c
xor ecx, 0xbe439fde
cmp ecx, 0x8c8f5e28
je 0x140017110
lea r12, [r15 + 0x10]
pmovmskb r14d, xmm0
not r14d
nop word cs:[rax + rax]
mov eax, dword [0x14020f028]
imul eax, dword [0x14020f02c]
add eax, 0x7d4df489
not eax
and eax, 0x9083c8d
cmp eax, 0x8c65b7c8
ja 0x140017160
mov rsi, qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13d, 0xc022d4c7
nop dword [rax]
test r14w, r14w
jne 0x1400171dc
nop word cs:[rax + rax]
mov eax, dword [0x14020f030]
xor edx, edx
div dword [0x14020f034]
not eax
and eax, 0x202a4640
cmp eax, 0xb71ef8ce
je 0x1400171a0
add r15, 0xffffffffffffea00
movdqa xmm0, xmmword [r12]
add r12, 0x10
pmovmskb r14d, xmm0
cmp r14w, 0xffff
je 0x1400171a0
not r14d
tzcnt eax, r14d
neg rax
imul rax, rax, 0x160
lea rbp, [r15 + rax]
cmp qword [r15 + rax - 0x148], 0
je 0x14001730d
mov eax, dword [0x14020f038]
xor edx, edx
div dword [0x14020f03c]
add eax, 0xedb60c6c
imul rax, rax, 0x6f96fd35
shr rax, 0x3e
or eax, 0x10ac980a
cmp eax, 0x89d8c79a
ja 0x1400171fe
mov rdi, qword [rbp - 0x140]
mov eax, dword [0x14020f040]
xor eax, dword [0x14020f044]
mov ecx, eax
xor ecx, 0xc8f077bc
xor eax, 0x84c12b18
add eax, ecx
and ecx, 0xb3cea35b
sub eax, ecx
mov ecx, eax
not ecx
or ecx, 0x5434986f
add eax, ecx
inc eax
cmp eax, 0x855646ae
jbe 0x140017280
mov rcx, qword [0x14022cb48]
xor edx, edx
mov r8, rdi
call rsi
nop word cs:[rax + rax]
mov eax, dword [0x14020f048]
add eax, dword [0x14020f04c]
and eax, 0xf580799a
xor eax, 0x9080400a
imul rbx, rax, 0x14b3a711
shr rbx, 0x3a
mov rcx, qword [0x14022cb48]
xor edx, edx
mov r8, rdi
call rsi
cmp ebx, 0x6baec24f
je 0x140017280
nop word [rax + rax]
mov eax, dword [0x14020f050]
mov ecx, dword [0x14020f054]
mov edx, ecx
not edx
and edx, eax
xor ecx, eax
add ecx, eax
sub ecx, edx
mov eax, ecx
not eax
or eax, 0x722fc29d
add eax, ecx
inc eax
mov ecx, eax
and ecx, 0x44503b85
add ecx, ecx
sub eax, ecx
add eax, 0x44503b85
mov ecx, eax
and ecx, 0x5b568090
xor eax, 0xdb568090
lea eax, [rax + rcx*2]
cmp eax, 0xfcaeae6d
ja 0x1400172c0
lea eax, [r14 - 1]
and eax, r14d
mov r14d, eax
dec qword [rsp + 0x28]
mov eax, dword [0x14020f058]
mov ecx, dword [0x14020f05c]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
add eax, 0x4c5a38f5
mov ecx, eax
not ecx
or ecx, 0x1da4f7b8
or eax, 0xefdbe3c
and eax, ecx
and eax, 0x1ffdffbc
cmp eax, 0xdff470e0
ja 0x14001731c
mov rdi, qword [rbp - 0x120]
mov eax, dword [0x14020f060]
and eax, dword [0x14020f064]
mov ecx, eax
xor ecx, 0xa2a94db
or eax, 0xf5d56b24
and eax, ecx
xor eax, 0x5128e4ea
imul rax, rax, 0x773c926f
shr rax, 0x3c
cmp eax, 0xa03b7d2c
ja 0x140017371
mov qword [rsp + 0x20], rbp
mov rbx, qword [rbp - 0x118]
test rbx, rbx
je 0x1400174a3
xor ebp, ebp
nop word [rax + rax]
mov eax, dword [0x14020f068]
xor edx, edx
div dword [0x14020f06c]
mov eax, dword [0x14020f070]
mov ecx, dword [0x14020f074]
add eax, ecx
add eax, 0xf2214ab5
mov ecx, eax
not ecx
and ecx, 0xada8c5d7
mov edx, eax
and edx, 0x52573a28
imul edx, ecx
mov ecx, eax
and ecx, 0xada8c5d7
or eax, 0xada8c5d7
imul eax, ecx
add eax, edx
and eax, 0xbf4a011a
cmp eax, 0xe545533b
ja 0x1400173ce
mov rax, rbp
shl rax, 5
cmp qword [rdi + rax], 0
je 0x140017434
add rax, rdi
mov r8, qword [rax + 8]
mov rcx, qword [0x14022cb48]
xor edx, edx
call rsi
mov eax, ebp
and eax, 1
or rbp, 1
add rbp, rax
mov eax, dword [0x14020f078]
mov ecx, dword [0x14020f07c]
mov edx, eax
not edx
and edx, ecx
not ecx
and ecx, eax
sub ecx, edx
mov eax, ecx
not eax
and eax, 0xb90fb72f
mov edx, ecx
and edx, 0x46f048d0
imul edx, eax
mov eax, ecx
and eax, 0xb90fb72f
or ecx, 0xb90fb72f
imul ecx, eax
lea eax, [rcx + rdx]
add eax, 0x605cab15
mov ecx, eax
xor ecx, 0xecb57b22
or eax, 0x134a84dd
and eax, ecx
cmp eax, 0x1ff22419
ja 0x140017440
cmp rbp, rbx
jne 0x1400173c0
mov r8, qword [rsp + 0x20]
nop dword [rax + rax]
mov eax, dword [0x14020f080]
xor edx, edx
div dword [0x14020f084]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xfa542dc1
and ecx, 0x5abd23e
imul ecx, edx
mov edx, eax
and edx, 0x5abd23e
or eax, 0x5abd23e
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xbcac84cc
and ecx, eax
add ecx, 0xd6f221e6
cmp ecx, 0x3573e7aa
jb 0x1400174b0
mov rax, qword [r8 - 0x128]
nop word cs:[rax + rax]
mov ecx, dword [0x14020f088]
add ecx, dword [0x14020f08c]
and ecx, 0xaf74fae0
add ecx, 0x6802f707
not ecx
and ecx, 0x8919ba30
cmp ecx, 0x716175a8
jb 0x140017510
test rax, rax
je 0x1400175d0
mov rbx, qword [0x14022cb48]
xor eax, eax
test al, al
je 0x140017560
mov rcx, rbx
xor edx, edx
mov r8, rdi
call rsi
nop dword [rax + rax]
mov ebp, dword [0x14020f090]
and ebp, dword [0x14020f094]
mov eax, ebp
not eax
and eax, 0xee35b5da
mov ecx, ebp
and ecx, 0x11ca4a25
imul ecx, eax
mov eax, ebp
and eax, 0xee35b5da
or ebp, 0xee35b5da
imul ebp, eax
add ebp, ecx
mov eax, ebp
not eax
and eax, 0x66ba0d
mov ecx, ebp
and ecx, 0x19945f2
imul ecx, eax
mov eax, ebp
and eax, 0x66ba0c
or ebp, 0x66ba0d
imul ebp, eax
add ebp, ecx
or ebp, 0xfedec881
mov rcx, rbx
xor edx, edx
mov r8, rdi
call rsi
cmp ebp, 0x3ba3a8e4
je 0x140017560
mov rdx, qword [rsp + 0x20]
nop word cs:[rax + rax]
mov eax, dword [0x14020f098]
add eax, dword [0x14020f09c]
mov ecx, eax
and ecx, 0x346fb051
add ecx, ecx
sub eax, ecx
add eax, 0xb1eee699
cmp eax, 0xb2115244
ja 0x1400175e0
mov rax, qword [rdx - 0xf8]
shl rax, 1
test rax, rax
je 0x140017770
mov eax, dword [0x14020f0a0]
mov ecx, dword [0x14020f0a4]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
imul rax, rax, 0x7eab94cd
shr rax, 0x3d
imul eax, eax, 0x3f5fde80
cmp eax, 0xa064ecea
mov r9, qword [rsp + 0x20]
ja 0x140017af0
nop word cs:[rax + rax]
mov eax, dword [0x14020f0a8]
mov ecx, dword [0x14020f0ac]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
not eax
or eax, 0xfefef7e7
mov rdi, qword [r9 - 0xf0]
mov rbx, qword [0x14022cb48]
add eax, 0xb67c3bdb
jae 0x140017af0
mov eax, dword [0x14020f0b0]
mov ecx, dword [0x14020f0b4]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
shr eax, 2
imul rax, rax, 0x4f78ee33
shr rax, 0x3b
mov ecx, eax
not ecx
and ecx, 0x294bacf9
mov edx, eax
and edx, 0xfffffffe
imul edx, ecx
mov ecx, eax
and ecx, 1
or eax, 0x294bacf9
imul eax, ecx
add eax, edx
mov ecx, 0x8cbbac6f
imul rax, rcx
shr rax, 0x3f
cmp eax, 0x90d78165
jne 0x140017740
mov rcx, rbx
xor edx, edx
mov r8, rdi
call rsi
nop word cs:[rax + rax]
mov eax, dword [0x14020f0b8]
xor edx, edx
div dword [0x14020f0bc]
mov ebp, eax
or ebp, 0x20af8ff8
add ebp, 0x8ab66bcd
mov rcx, rbx
xor edx, edx
mov r8, rdi
call rsi
cmp ebp, 0x9d415ba7
jb 0x140017740
nop
mov eax, dword [0x14020f0c0]
xor edx, edx
div dword [0x14020f0c4]
xor eax, 0x31bee422
add eax, 0xa5c1e079
or eax, 0x17f2646f
cmp eax, 0x6487a9b4
jb 0x140017770
mov rbp, qword [rsp + 0x20]
mov rax, qword [rbp - 0xd8]
mov ecx, dword [0x14020f0c8]
or ecx, dword [0x14020f0cc]
add ecx, 0x6488e2b8
mov edx, ecx
not edx
and edx, 0x6e3a57e4
mov r8d, ecx
and r8d, 0x91c5a81b
imul r8d, edx
mov edx, ecx
and edx, 0x6e3a57e4
or ecx, 0x6e3a57e4
imul ecx, edx
add ecx, r8d
cmp ecx, 0x9c758027
je 0x1400177a0
shl rax, 1
test rax, rax
je 0x1400178b0
mov rdi, qword [rbp - 0xd0]
mov eax, dword [0x14020f0d0]
mov ecx, dword [0x14020f0d4]
mov edx, eax
xor edx, ecx
not edx
or eax, ecx
and eax, edx
add eax, 0x7d7a6115
or eax, 0x85bfd20e
cmp eax, 0xbcca5510
jne 0x140017830
mov rcx, qword [0x14022cb48]
xor edx, edx
mov r8, rdi
call rsi
nop
mov eax, dword [0x14020f0d8]
xor edx, edx
div dword [0x14020f0dc]
imul ebx, eax, 0xeafaa050
and ebx, 0x2c824900
mov rcx, qword [0x14022cb48]
xor edx, edx
mov r8, rdi
call rsi
cmp ebx, 0xd254a2fc
ja 0x140017830
mov eax, dword [0x14020f0e0]
mov ecx, dword [0x14020f0e4]
add eax, ecx
add eax, 0xa5d16146
mov ecx, eax
xor ecx, 0x424d1cdc
or eax, 0xbdb2e323
and eax, ecx
mov ecx, eax
not ecx
and ecx, 0x89153d1b
mov edx, eax
and edx, 0x76eac2e4
imul edx, ecx
mov ecx, eax
and ecx, 0x89153d1b
or eax, 0x89153d1b
imul eax, ecx
add eax, edx
cmp eax, 0x8f672244
ja 0x140017860
mov rdi, qword [rbp - 0x108]
mov eax, dword [0x14020f0e8]
mov ecx, dword [0x14020f0ec]
mov edx, eax
not edx
mov r8d, ecx
not r8d
mov r9d, edx
and r9d, 0x1fb78e18
and eax, 0xe04871e7
or eax, r9d
or edx, r8d
and r8d, 0x1fb78e18
and ecx, 0xe04871e7
or ecx, r8d
xor ecx, eax
not edx
or edx, ecx
mov eax, edx
xor eax, 0xafc3389c
add eax, edx
and edx, 0x503cc763
sub eax, edx
add eax, 0xb048edd0
and eax, 0xd6736aa1
cmp eax, 0x9f8f0533
je 0x1400178b7
mov rbx, qword [rbp - 0x100]
mov eax, dword [0x14020f0f0]
and eax, dword [0x14020f0f4]
add eax, 0x8e020678
xor eax, 0xdaee6fd4
imul rax, rax, 0x6f197041
shr rax, 0x3e
cmp eax, 0x385146db
ja 0x140017921
test rbx, rbx
je 0x140017a30
xor ebp, ebp
nop word cs:[rax + rax]
mov rax, rbp
shl rax, 5
cmp qword [rdi + rax], 0
je 0x1400179db
mov ecx, dword [str.uF_N]
add ecx, dword [0x14020f0f8]
imul rcx, r13
shr rcx, 0x3f
or ecx, 0x4104b730
cmp ecx, 0xedd1f72d
jbe 0x140017997
mov rcx, qword [0x14022cb48]
add rax, rdi
nop word [rax + rax]
mov ecx, dword [0x14020f100]
mov edx, dword [0x14020f104]
xor edx, ecx
not edx
and edx, ecx
imul edx, edx, 0x222707bc
add edx, 0xea8efc18
or edx, 0x945241b8
mov r8, qword [rax + 8]
mov rcx, qword [0x14022cb48]
cmp edx, 0x9d55b4e8
ja 0x1400179a0
xor edx, edx
call rsi
inc rbp
nop
mov eax, dword [0x14020f108]
xor edx, edx
div dword [0x14020f10c]
mov ecx, eax
not ecx
and ecx, 0xb6c4b9e3
mov edx, eax
and edx, 0x493b461c
imul edx, ecx
mov ecx, eax
and ecx, 0xb6c4b9e3
or eax, 0xb6c4b9e3
imul eax, ecx
add eax, edx
imul eax, eax, 0x582d98fc
xor eax, 0x3f2acaab
cmp eax, 0x1a8ab910
jb 0x1400179e0
cmp rbp, rbx
jne 0x140017960
mov rbx, qword [rsp + 0x20]
mov rax, qword [rbx - 0x110]
nop dword [rax]
mov ecx, dword [0x14020f110]
mov edx, dword [0x14020f114]
add ecx, edx
add ecx, 0x4f04694d
not ecx
or ecx, 0xb16b07bd
mov edx, ecx
not edx
and ecx, 0x2c7f0a04
mov r8d, edx
and r8d, 0x4280f042
imul r8d, ecx
mov ecx, edx
and ecx, 0xc140800
or edx, 0x2c7f0a04
imul edx, ecx
add edx, r8d
cmp edx, 0xda52956d
ja 0x140017a40
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x140017aa0
test rax, rax
je 0x140017c5c
mov eax, dword [0x14020f118]
mov ecx, dword [0x14020f11c]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
not eax
or eax, 0x91728041
and eax, 0xb1768169
add eax, 0x92ea3aa0
jb 0x140017b00
jmp 0x140017b31
mov rax, qword [0x14022cb48]
jmp 0x140017670
mov eax, dword [0x14020f120]
mov ecx, dword [0x14020f124]
mov edx, ecx
not edx
and edx, eax
xor ecx, eax
add ecx, eax
sub ecx, edx
imul eax, ecx, 0x13676f49
add eax, 0x291aa38e
mov rbx, qword [0x14022cb48]
cmp eax, 0xe874e7aa
jbe 0x140017b40
mov rax, qword [0x14022cb48]
jmp 0x140017b00
mov eax, dword [0x14020f128]
imul eax, dword [0x14020f12c]
add eax, 0xb6694b63
mov ecx, 0xd7a0d4cf
imul rax, rcx
shr rax, 0x3e
cmp eax, 0x3899799e
jbe 0x140017b73
mov rcx, rbx
xor edx, edx
mov r8, rdi
call fcn.14014eed0
mov r13d, 0xd6240ef5
nop dword [rax]
mov eax, dword [0x14020f130]
mov ecx, dword [0x14020f134]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
imul rax, rax, 0x3241362b
shr rax, 0x3d
mov ecx, eax
xor ecx, 0xc73fa7e7
lea ebp, [rcx + rax*2]
imul rbp, r13
shr rbp, 0x3c
mov rcx, rbx
xor edx, edx
mov r8, rdi
call rsi
cmp ebp, 0x869e737b
je 0x140017b80
mov r13d, 0xc022d4c7
mov rbx, qword [rsp + 0x20]
nop word cs:[rax + rax]
mov eax, dword [0x14020f138]
and eax, dword [0x14020f13c]
mov ecx, eax
not ecx
and ecx, 0x9c3c1c03
mov edx, eax
and edx, 0x63c3e3fc
imul edx, ecx
mov ecx, eax
and ecx, 0x9c3c1c03
or eax, 0x9c3c1c03
imul eax, ecx
add eax, edx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xf6b9439c
and ecx, 0x946bc63
imul ecx, edx
mov edx, eax
and edx, 0x946bc63
or eax, 0x946bc63
imul eax, edx
add eax, ecx
imul rax, rax, 0x3289ba37
shr rax, 0x3a
cmp eax, 0x1b3a4560
je 0x140017bf0
mov eax, dword [0x14020f140]
mov ecx, dword [0x14020f144]
mov edx, eax
not edx
and edx, ecx
not ecx
and ecx, eax
sub ecx, edx
mov eax, ecx
xor eax, 0xd0aa88b4
or ecx, 0x20101149
and ecx, eax
or ecx, 0xf456602
cmp ecx, 0x463c56d7
je 0x140017c5c
mov rax, qword [rbx - 0xc0]
shl rax, 1
test rax, rax
je 0x140017d50
mov eax, dword [0x14020f148]
or eax, dword [0x14020f14c]
mov ecx, eax
not ecx
or ecx, 0x878331e5
add eax, ecx
add eax, 0xb623a801
mov ecx, eax
xor ecx, 0x64edab34
and eax, 0x1b1254cb
add eax, eax
sub eax, ecx
cmp eax, 0x40e1a896
jae 0x140017ce0
mov rax, qword [0x14022cb48]
mov eax, dword [0x14020f150]
xor edx, edx
div dword [0x14020f154]
mov ecx, eax
not ecx
and ecx, 0x39d1a864
mov edx, eax
and edx, 0xc62e579b
imul edx, ecx
mov ecx, eax
and ecx, 0x39d1a864
or eax, 0x39d1a864
imul eax, ecx
add eax, edx
add eax, 0x848ad29c
mov ecx, eax
and ecx, 0xb12d223c
or eax, 0xb12d223f
add eax, ecx
mov r8, qword [rbx - 0xb8]
mov rcx, qword [0x14022cb48]
cmp eax, 0x6d02eee
je 0x140017ce0
xor edx, edx
call rsi
nop word cs:[rax + rax]
mov eax, dword [0x14020f158]
mov ecx, dword [0x14020f15c]
mov edx, eax
xor edx, ecx
not edx
and edx, ecx
add edx, edx
sub ecx, edx
add ecx, eax
mov eax, ecx
not eax
or eax, 0x3063a5fb
add eax, ecx
inc eax
mov ecx, eax
and ecx, 0x2e036cc6
xor eax, 0xae036cc6
lea eax, [rax + rcx*2]
imul rax, rax, 0x4e7c1d0f
shr rax, 0x3e
cmp eax, 0x68962236
je 0x140017d50
mov rax, qword [rbx - 0xa0]
shl rax, 1
test rax, rax
je 0x140017e80
mov eax, dword [0x14020f160]
and eax, dword [0x14020f164]
mov ecx, eax
and ecx, 0x67328104
add ecx, ecx
neg ecx
add eax, ecx
add eax, 0x67328104
mov ecx, eax
and ecx, 0x53ce7b84
xor eax, 0xd3ce7b84
lea eax, [rax + rcx*2]
not eax
or eax, 0x384ea907
cmp eax, 0xfb2b0de1
jae 0x140017e00
mov r8, qword [rbx - 0x98]
mov rcx, qword [0x14022cb48]
xor edx, edx
call rsi
nop dword [rax + rax]
mov eax, dword [0x14020f168]
mov edi, dword [str.aNx]
xor edi, eax
not edi
and edi, eax
or edi, 0x1ca5f53c
mov r8, qword [rbx - 0x98]
mov rcx, qword [0x14022cb48]
xor edx, edx
call rsi
cmp edi, 0x95f4d77d
je 0x140017e00
nop word cs:[rax + rax]
mov eax, dword [0x14020f170]
mov ecx, dword [0x14020f174]
mov edx, eax
xor edx, ecx
not ecx
and ecx, eax
add ecx, ecx
sub ecx, edx
xor ecx, 0x83db62
add ecx, 0xd9587562
not ecx
and ecx, 0x5134b34
cmp ecx, 0x5b72007c
ja 0x140017e40
nop word cs:[rax + rax]
mov eax, dword [0x14020f178]
xor edx, edx
div dword [0x14020f17c]
add eax, 0xd5e377a6
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x83144a51
and ecx, 0x7cebb5ae
imul ecx, edx
mov edx, eax
and edx, 0x7cebb5ae
or eax, 0x7cebb5ae
imul eax, edx
add eax, ecx
mov ecx, eax
not ecx
and ecx, 0x2ee8eb72
mov edx, eax
and edx, 0xd117148c
imul edx, ecx
mov ecx, eax
and ecx, 0x2ee8eb72
or eax, 0x2ee8eb72
imul eax, ecx
add eax, edx
cmp eax, 0xabde4736
ja 0x140017e80
mov rax, qword [rbx - 0x60]
mov ecx, dword [0x14020f180]
mov edx, dword [0x14020f184]
mov r8d, edx
and r8d, ecx
add ecx, edx
sub ecx, r8d
add ecx, 0x67597906
mov edx, ecx
not edx
and edx, 0x584084e4
mov r8d, ecx
and r8d, 0xa7bf7b1b
imul r8d, edx
mov edx, ecx
and edx, 0x584084e4
or ecx, 0x584084e4
imul ecx, edx
add ecx, r8d
mov edx, 0x836b7919
imul rcx, rdx
shr rcx, 0x3a
cmp ecx, 0x13e01259
ja 0x140017eec
test rax, rax
je 0x140018130
mov ecx, dword [0x14020f188]
or ecx, dword [0x14020f18c]
mov edx, ecx
and edx, 0x70e897eb
add edx, edx
neg edx
add ecx, edx
add ecx, 0x70e897eb
mov edx, ecx
and edx, 0x29e5f66e
add edx, edx
sub ecx, edx
add ecx, 0xa9e5f66e
xor ecx, 0x4102762d
cmp ecx, 0x6d05fcda
jb 0x1400180d0
nop word [rax + rax]
mov ecx, dword [0x14020f190]
add ecx, dword [0x14020f194]
mov edx, ecx
or edx, 0xec27d4a2
not ecx
and ecx, 0x1d82a48
mov r8d, edx
and r8d, 0xb2201117
or r8d, ecx
xor r8d, 0x248ad34
and edx, 0x4f9743dc
or edx, r8d
mov ecx, edx
and ecx, 0x3ee6317b
xor edx, 0xbee6317b
lea edx, [rdx + rcx*2]
mov rcx, 0xffffffffffffffff
lock xadd qword [rax], rcx
cmp edx, 0x4275d55c
jb 0x1400180d0
nop word cs:[rax + rax]
mov eax, dword [0x14020f198]
mov edx, dword [0x14020f19c]
mov r8d, edx
not r8d
mov r9d, eax
and r9d, r8d
or r8d, eax
not r8d
imul r8d, r9d
mov r9d, eax
and r9d, edx
or eax, edx
imul eax, r9d
add eax, r8d
not eax
and eax, 0x1d1f0b87
cmp eax, 0x8ff625ec
je 0x140018010
cmp rcx, 1
jne 0x140018130
mov eax, dword [0x14020f1a0]
sub eax, dword [0x14020f1a4]
mov ecx, eax
and ecx, 0xc1cf9f2d
and eax, 0xc14a8404
sub ecx, eax
add ecx, 0xaa095aa1
cmp ecx, 0xeefce5e5
jbe 0x140018082
xor edx, edx
nop word cs:[rax + rax]
mov eax, dword [0x14020f1ac]
mov ecx, eax
xor ecx, eax
not ecx
and ecx, dword [0x14020f1a8]
xor ecx, eax
add ecx, 0xd6e79d2f
not ecx
and ecx, 0xa6fa6cd4
cmp ecx, 0xef204138
je 0x140018090
mov rdi, qword [rbx - 0x60]
test dl, dl
je 0x1400180e0
jmp 0x14001811c
lock dec qword [rax]
jmp 0x140017fa0
mov eax, dword [0x14020f1b0]
xor edx, edx
div dword [0x14020f1b4]
imul rbx, rax, 0x30ca571d
shr rbx, 0x3c
add ebx, 0xe641709f
mov eax, 0x88e4cfd7
imul rbx, rax
shr rbx, 0x3e
mov rcx, rdi
call fcn.1400219d0
cmp ebx, 0x50889a25
jne 0x140018130
mov rcx, rdi
call fcn.1400219d0
jmp 0x1400180e0
mov eax, dword [0x14020f1b8]
xor edx, edx
div dword [0x14020f1bc]
mov r8d, 0xb7a4ad71
nop word cs:[rax + rax]
mov eax, dword [0x14020f1c0]
sub eax, dword [0x14020f1c4]
add eax, 0xd8f4d0f0
imul rax, r8
shr rax, 0x39
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xffffffd2
and ecx, 0xa0d4d9ad
imul ecx, edx
mov edx, eax
and edx, 0x2d
or eax, 0xa0d4d9ad
imul eax, edx
add eax, ecx
cmp eax, 0x316995ee
ja 0x140018150
nop word cs:[rax + rax]
mov eax, dword [0x14020f1c8]
mov ecx, dword [0x14020f1cc]
mov edx, ecx
and edx, eax
add eax, ecx
sub eax, edx
or eax, 0x831ad9b2
mov ecx, eax
xor ecx, 0xa0e8de3d
add ecx, eax
and eax, 0x5f1721c2
sub ecx, eax
add ecx, 0x8314bf1a
cmp ecx, 0x4aed18a5
jb 0x1400181a0
cmp qword [rsp + 0x28], 0
jne 0x140017190
mov r14, qword [rsp + 0x30]
mov r8, qword [r14 + 0x48]
nop dword [rax]
mov eax, dword [0x14020f1d0]
xor edx, edx
div dword [0x14020f1d4]
imul rax, rax, 0x82ae753
shr rax, 0x3b
not eax
and eax, 0x8b600819
or eax, 0x40020502
xor eax, 0x876ed6af
cmp eax, 0x52b64643
ja 0x1400181f0
lea rcx, [r8 + 1]
mov r9d, 0x160
nop dword [rax + rax]
mov eax, dword [0x14020f1d8]
or eax, dword [0x14020f1dc]
imul r10, rax, 0x762ee08f
shr r10, 0x39
add r10d, 0xd2855203
and r10d, 0x4285507f
xor r10d, 0xeb1dd807
mov rax, rcx
mul r9
cmp r10d, 0xb6a5a0c2
ja 0x140018230
mov rbx, rax
add rax, r8
add rax, 0x11
test rax, rax
je 0x1400183a0
nop
mov eax, dword [0x14020f1e0]
sub eax, dword [0x14020f1e4]
imul rax, rax, 0x509af395
shr rax, 0x3e
cmp eax, 0x54ace58e
ja 0x140018280
mov rdi, qword [r14 + 0x40]
mov eax, 0xb85a5e4f
neg rbx
nop word [rax + rax]
mov ecx, dword [0x14020f1e8]
and ecx, dword [0x14020f1ec]
mov edx, ecx
not edx
mov r8d, ecx
or r8d, 0xab9f70ef
and edx, 0x54208210
mov r9d, r8d
and r9d, 0x82cb1d49
imul r9d, edx
and r8d, 0x7d34e2b6
or ecx, 0xffbff2ff
imul ecx, r8d
add ecx, r9d
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0x6962f72b
ja 0x1400182b0
mov eax, dword [0x14020f1f0]
mov ecx, dword [0x14020f1f4]
not eax
not ecx
or ecx, eax
mov eax, ecx
not eax
and eax, 0x2110212c
xor ecx, 0x12021000
or ecx, eax
or ecx, 0xccedced3
add ecx, 0x8d3a4bbf
cmp ecx, 0xa3ae150e
jbe 0x14001834b
lea r8, [rdi + rbx]
mov rcx, qword [0x14022cb48]
xor edx, edx
call fcn.14014eed0
mov esi, 0xcab8574d
add rdi, rbx
nop word cs:[rax + rax]
mov ebx, dword [0x14020f1f8]
add ebx, dword [0x14020f1fc]
and ebx, 0xfa0397bf
add ebx, 0xfcc4a9f9
imul rbx, rsi
shr rbx, 0x3f
mov rcx, qword [0x14022cb48]
xor edx, edx
mov r8, rdi
call fcn.14014eed0
cmp ebx, 0xea95f55a
je 0x140018360
nop dword [rax]
mov eax, dword [0x14020f200]
mov ecx, dword [0x14020f204]
not eax
not ecx
and ecx, eax
mov eax, ecx
not eax
or eax, 0x1402c080
and eax, 0x7c42ccbc
and ecx, 0x81382243
or ecx, eax
mov eax, ecx
xor eax, 0xc9c793da
add eax, ecx
and ecx, 0x34386c25
sub eax, ecx
cmp eax, 0x70df70b8
jb 0x1400183a0
mov rax, qword [r14 + 0x18]
shl rax, 1
test rax, rax
je 0x140018470
mov eax, dword [0x14020f208]
xor edx, edx
div dword [0x14020f20c]
xor eax, eax
test al, al
jne 0x140018400
mov r8, qword [r14 + 0x20]
mov rcx, qword [0x14022cb48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0x9132487f
nop dword [rax]
mov ecx, dword [0x14020f210]
mov edx, dword [0x14020f214]
mov r8d, ecx
xor r8d, edx
not r8d
and r8d, edx
add r8d, r8d
sub edx, r8d
add edx, ecx
mov ecx, edx
xor ecx, 0x637ce41b
xor edx, 0x988018c4
or edx, 0x713c32b
add ecx, edx
inc ecx
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x41e07097
ja 0x140018420
nop dword [rax + rax]
mov eax, dword [0x14020f218]
sub eax, dword [0x14020f21c]
mov ecx, eax
xor ecx, 0x1a0c9688
and eax, 0x65f36977
add eax, eax
sub eax, ecx
mov ecx, eax
not ecx
and ecx, 0x6765f24f
mov edx, eax
and edx, 0x989a0db0
imul edx, ecx
mov ecx, eax
and ecx, 0x6765f24f
or eax, 0x6765f24f
imul eax, ecx
add eax, edx
or eax, 0x6384ee39
cmp eax, 0x3eba630a
jb 0x140018470
mov rdi, qword [r14 + 8]
mov rsi, qword [r14 + 0x10]
test rsi, rsi
je 0x140018824
xor r14d, r14d
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
imul rax, r14, 0x70
lea r12, [rdi + rax]
cmp qword [rdi + rax], 0
je 0x140018500
mov r8, qword [r12 + 8]
mov rcx, qword [0x14022cb48]
xor edx, edx
call r15
mov eax, r14d
and eax, 1
or r14, 1
add r14, rax
mov rax, qword [r12 + 0x18]
nop word cs:[rax + rax]
mov ecx, dword [0x14020f220]
mov edx, ecx
not edx
or edx, dword [0x14020f224]
add ecx, edx
add ecx, 0x7339b88c
mov edx, ecx
and edx, 0x9da2fd1
add edx, edx
sub ecx, edx
add ecx, 0x69da2fd1
not ecx
or ecx, 0xe358da57
cmp ecx, 0x28a913c5
jb 0x140018520
test rax, rax
je 0x140018605
mov rbx, qword [r12 + 0x20]
mov eax, dword [0x14020f228]
sub eax, dword [0x14020f22c]
or eax, 0xe7634af6
mov ecx, eax
and ecx, 0x50fad423
add ecx, ecx
sub eax, ecx
cmp eax, 0x3351e915
jne 0x1400185a0
mov rcx, qword [0x14022cb48]
xor edx, edx
mov r8, rbx
call r15
nop dword [rax + rax]
mov eax, dword [0x14020f230]
mov ecx, dword [0x14020f234]
mov ebp, eax
not ebp
mov edx, ecx
not edx
mov r8d, ebp
and r8d, 0x500840
and eax, 0x109
or eax, r8d
or ebp, edx
and edx, 0x500840
and ecx, 0x109
or ecx, edx
xor ecx, eax
not ebp
or ebp, ecx
or ebp, 0xd389b406
and ebp, 0xd3d9bd4f
add ebp, 0x2f77f8b6
mov rcx, qword [0x14022cb48]
xor edx, edx
mov r8, rbx
call r15
cmp ebp, 0x396aacb4
ja 0x1400185a0
mov eax, dword [0x14020f238]
xor eax, dword [0x14020f23c]
or eax, 0x68ffd97
add eax, 0xe382a670
or eax, 0x20e223d4
cmp eax, 0xe68d3cce
jb 0x140018605
mov eax, dword [str.sxH]
imul eax, dword [0x14020f244]
add eax, 0xd582f540
mov ecx, eax
not ecx
and ecx, 0x11305b85
mov edx, eax
and edx, 0x2ecfa47a
imul edx, ecx
mov ecx, eax
and ecx, 0x11305b85
or eax, 0x11305b85
imul eax, ecx
add eax, edx
not eax
or eax, 0xdd0fa101
cmp eax, 0x4f9da16
je 0x140018627
mov rax, qword [r12 + 0x48]
shl rax, 1
test rax, rax
je 0x140018763
mov eax, dword [0x14020f248]
xor eax, dword [0x14020f24c]
add eax, 0x591dbeec
mov ecx, eax
and ecx, 0x25809941
add ecx, ecx
sub eax, ecx
add eax, 0x153e59c1
cmp eax, 0x9190b9df
ja 0x14001867f
mov rbx, qword [r12 + 0x50]
mov eax, dword [0x14020f250]
xor edx, edx
div dword [0x14020f254]
or eax, 0x86f2f16f
imul rax, rax, 0x1c876e43
shr rax, 0x3b
or eax, 0x161b7bc5
cmp eax, 0xe4bebfa6
jbe 0x1400186f0
mov rcx, qword [0x14022cb48]
xor edx, edx
mov r8, rbx
call fcn.14014eed0
nop dword [rax + rax]
mov eax, dword [0x14020f258]
sub eax, dword [0x14020f25c]
imul ebp, eax, 0xa7aa6237
add ebp, 0xada84191
or ebp, 0x9798baf1
mov rcx, qword [0x14022cb48]
xor edx, edx
mov r8, rbx
call fcn.14014eed0
cmp ebp, 0xa1bf86f6
je 0x1400186f0
nop word [rax + rax]
mov eax, dword [0x14020f260]
xor edx, edx
div dword [0x14020f264]
imul rcx, rax, 0x5c38d4d3
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
xor eax, 0x2d3003f7
add eax, 0x20979001
cmp eax, 0xb2e84977
ja 0x140018730
cmp qword [r12 + 0x30], 0
je 0x1400187d0
mov eax, dword [0x14020f268]
xor edx, edx
div dword [0x14020f26c]
mov eax, dword [0x14020f274]
add eax, dword [0x14020f270]
imul rcx, rax, 0x3c50e61f
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
lea ecx, [rax - 0x3afdec78]
not eax
and eax, 0x22406061
imul eax, eax, 0x10158c00
imul ecx, ecx, 0xf757ffe9
add ecx, eax
cmp ecx, 0xb995810f
ja 0x140018779
mov r8, qword [r12 + 0x38]
mov rcx, qword [0x14022cb48]
xor edx, edx
call r15
nop dword [rax]
mov eax, dword [0x14020f278]
and eax, dword [0x14020f27c]
not eax
or eax, 0xf9c4e1ed
mov ecx, eax
not ecx
and eax, 0xe2c0affa
mov edx, ecx
and edx, 0x43b1000
imul edx, eax
mov eax, ecx
and eax, 0x2000e12
or ecx, 0xe2c0affa
imul ecx, eax
add ecx, edx
mov eax, ecx
not eax
or eax, 0x3c7374a5
add eax, ecx
cmp eax, 0x33002a39
je 0x1400187d0
cmp r14, rsi
jne 0x1400184e0
mov r14, qword [rsp + 0x30]
mov rax, qword [r14]
nop dword [rax]
mov ecx, dword [str.1j_x]
xor ecx, dword [0x14020f284]
mov edx, ecx
and edx, 0xe9867dfd
xor edx, 0x2df56745
and ecx, 0x400218b8
add ecx, ecx
sub ecx, edx
imul ecx, ecx, 0x1543c3a4
cmp ecx, 0x12901ff7
jb 0x140018830
mov ecx, 0xb1bf220f
nop word [rax + rax]
mov edx, dword [0x14020f288]
mov r8d, dword [0x14020f28c]
not edx
not r8d
or r8d, edx
mov edx, r8d
not edx
or r8d, 0xf85df879
or edx, 0x7a20786
and edx, r8d
add edx, 0xe7647fc5
imul rdx, rcx
shr rdx, 0x3b
cmp edx, 0x58f68e93
je 0x140018870
test rax, rax
je 0x140018992
mov rbx, qword [0x14022cb48]
mov eax, dword [0x14020f290]
mov ecx, dword [0x14020f294]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
or eax, 0x852a000
and eax, 0xac7ea140
imul rax, rax, 0x3ffbda3b
shr rax, 0x3d
cmp eax, 0x5d6accc4
ja 0x14001894b
mov eax, dword [0x14020f298]
xor edx, edx
div dword [0x14020f29c]
mov esi, 0xc006835f
imul rsi, rax
shr rsi, 0x3e
add esi, 0x692a1cbe
and esi, 0x28021cff
xor esi, 0x14904259
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, 0xe5e3b567
jne 0x140018960
mov rcx, rbx
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140018908
mov eax, dword [0x14020f2a0]
or eax, dword [0x14020f2a4]
mov ecx, eax
and ecx, 0x8e79d2af
or eax, 0x8e79d2af
add eax, ecx
add eax, 0xd31659f8
mov ecx, eax
xor ecx, 0xaf799dfd
and ecx, eax
cmp ecx, 0x39a466ea
je 0x140018960
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400189a0
mov rsi, qword [r14 + 0x90]
test rsi, rsi
je 0x140019414
mov r8, qword [r14 + 0xa8]
mov eax, dword [0x14020f2a8]
xor edx, edx
div dword [0x14020f2ac]
nop dword [rax]
mov eax, dword [0x14020f2b0]
add eax, dword [0x14020f2b4]
mov ecx, eax
xor ecx, 0xe887dc99
or eax, 0x17782366
and eax, ecx
mov ecx, eax
not ecx
and ecx, 0xe91d425f
mov edx, eax
and edx, 0x16e2bda0
imul edx, ecx
mov ecx, eax
and ecx, 0xe91d425f
or eax, 0xe91d425f
imul eax, ecx
add eax, edx
mov ecx, eax
and ecx, 0x76abd544
xor eax, 0xf6abd544
lea eax, [rax + rcx*2]
cmp eax, 0x937db8f
jb 0x1400189d0
nop dword [rax]
mov eax, dword [0x14020f2b8]
mov ecx, dword [0x14020f2bc]
add eax, ecx
add eax, 0xadab33f9
or eax, 0xf93a847a
cmp eax, 0x4b0a20c3
je 0x140018a30
mov qword [rsp + 0x28], r8
test r8, r8
je 0x140018c90
lea rdi, [rsi + 0x10]
movdqa xmm0, xmmword [rsi]
pmovmskb r15d, xmm0
nop word [rax + rax]
mov eax, dword [0x14020f2c0]
xor edx, edx
div dword [0x14020f2c4]
add eax, 0xabbfd82e
and eax, 0x85d5aba1
cmp eax, 0x8e21d5d2
je 0x140018a70
not r15d
nop word cs:[rax + rax]
mov eax, dword [0x14020f2c8]
xor eax, dword [0x14020f2cc]
imul eax, eax, 0x853b8f3b
add eax, 0xa2a792d5
imul rax, rax, 0x31a9ac8b
shr rax, 0x3c
cmp eax, 0x1dd1df1
ja 0x140018aa0
movabs r14, 0x9ad6366c08fc295b
mov r12, qword [sym.imp.pdh.dll_PdhRemoveCounter]
mov r13, rsi
mov rax, qword [rsp + 0x28]
nop word cs:[rax + rax]
test r15w, r15w
mov qword [rsp + 0x20], rax
je 0x140018bb0
nop
mov eax, dword [0x14020f2e0]
mov ecx, dword [0x14020f2e4]
mov edx, eax
not edx
and edx, ecx
not ecx
and ecx, eax
sub ecx, edx
mov eax, ecx
xor eax, 0x4014800
xor ecx, 0x8088060
or ecx, 0x34d75999
or eax, 0xb99e81fc
and eax, ecx
and eax, 0xbddfd9fd
cmp eax, 0x8e60e32f
jb 0x140018b00
lea ebp, [r15 - 1]
and ebp, r15d
nop word cs:[rax + rax]
mov eax, dword [0x14020f2e8]
sub eax, dword [0x14020f2ec]
mov ecx, eax
xor ecx, 0xca52a28b
xor eax, 0x25a55530
and eax, 0xe5f777b8
mov edx, ecx
and edx, 0x1a088847
imul edx, eax
mov eax, ecx
and eax, 0xe5f777b8
or ecx, 0xe5f777b8
imul ecx, eax
add ecx, edx
imul rax, rcx, 0x65df713b
shr rax, 0x3e
cmp eax, 0x4c64ad2
jae 0x140018b50
xor eax, eax
test al, al
je 0x140018c30
jmp 0x140018c12
mov eax, dword [0x14020f2d0]
xor edx, edx
div dword [0x14020f2d4]
mov eax, dword [0x14020f2d8]
xor edx, edx
div dword [0x14020f2dc]
imul rax, rax, 0xc7f4cbd
shr rax, 0x37
and eax, 1
cmp eax, 0x780ab8cb
je 0x140018bbe
add r13, 0xfffffffffffffe00
movdqa xmm0, xmmword [rdi]
add rdi, 0x10
pmovmskb r15d, xmm0
cmp r15w, 0xffff
je 0x140018bb0
mov eax, 0xfffffffe
sub eax, r15d
not r15d
mov ebp, r15d
and ebp, eax
xor eax, eax
test al, al
je 0x140018c30
tzcnt eax, r15d
shl rax, 5
mov rcx, r13
sub rcx, rax
mov rcx, qword [rcx - 8]
call fcn.14014f160
nop word [rax + rax]
mov eax, dword [0x14020f300]
xor edx, edx
div dword [0x14020f304]
lea ecx, [rax + 0x67d3ac1]
mov edx, ecx
and edx, 0x59e5e22c
xor ecx, 0xa61a1dd3
lea ebx, [rax + rcx]
add ebx, 0x67d3ac1
sub ebx, edx
tzcnt eax, r15d
mov rcx, r14
sub rcx, rax
sub rcx, r14
shl rcx, 5
mov rcx, qword [r13 + rcx - 8]
call r12
cmp ebx, 0x3e0e0c80
je 0x140018c30
mov r15d, ebp
mov rax, qword [rsp + 0x20]
dec rax
jne 0x140018af0
mov eax, dword [0x14020f2f0]
xor edx, edx
div dword [0x14020f2f4]
mov rdi, qword [rsp + 0x30]
nop word cs:[rax + rax]
mov eax, dword [0x14020f2f8]
and eax, dword [0x14020f2fc]
xor eax, 0xde082040
or eax, 0x20e3d5a2
add eax, 0xf8bccfe2
cmp eax, 0x9c2b87bb
jb 0x140018cb0
mov rcx, qword [rdi + 0xc8]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140018db0
nop word [rax + rax]
mov eax, dword [0x14020f310]
mov edx, eax
not edx
or edx, dword [0x14020f314]
add eax, edx
inc eax
mov edx, eax
and edx, 0x74f5f927
add edx, edx
sub eax, edx
add eax, 0x74f5f927
mov edx, eax
not edx
or edx, 0x8112102c
and edx, 0xbb13526d
and eax, 0x40c88190
sub eax, edx
cmp eax, 0x4b094aa
jb 0x140018cf0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax]
mov ecx, dword [0x14020f318]
sub ecx, dword [0x14020f31c]
mov edx, ecx
and edx, 0x7266f510
add edx, edx
neg edx
add ecx, edx
add ecx, 0xf266f510
not ecx
and ecx, 0x83d987cc
mov edx, ecx
not edx
and edx, 0x26bc288c
xor ecx, 0x5943d773
lea ecx, [rcx + rdx*2]
cmp ecx, 0x6d65550
je 0x140018d40
test eax, eax
jne 0x140018db0
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov eax, dword [0x14020f320]
xor edx, edx
div dword [0x14020f324]
or eax, 0x6eb96988
cmp eax, 0xdcc57713
je 0x140018d90
nop word [rax + rax]
mov eax, dword [0x14020f308]
mov ecx, dword [0x14020f30c]
mov edx, eax
not edx
and edx, ecx
not edx
not ecx
and ecx, eax
not ecx
and ecx, edx
not ecx
or ecx, 0x483c75bb
add ecx, 0x9c7c3f77
or ecx, 0x466427ea
cmp ecx, 0x845adbf
je 0x140018db0
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x140018df0
mov rcx, qword [rdi + 0xc0]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x140018e62
call qword [sym.imp.pdh.dll_PdhCloseQuery]
nop dword [rax + rax]
mov eax, dword [0x14020f328]
mov ecx, dword [0x14020f32c]
mov edx, eax
not edx
and edx, ecx
mov r8d, ecx
not r8d
and r8d, eax
imul r8d, edx
mov edx, eax
and edx, ecx
or eax, ecx
imul eax, edx
add eax, r8d
add eax, 0x1a85f43c
mov ecx, eax
xor ecx, 0x9399060e
and ecx, eax
mov eax, ecx
xor eax, 0x6c522b83
add eax, ecx
and ecx, 0x93add47c
sub eax, ecx
cmp eax, 0x7c60eb9f
ja 0x140018e10
mov r8, qword [rdi + 0x98]
nop dword [rax]
mov eax, dword [0x14020f330]
xor edx, edx
div dword [0x14020f334]
mov ecx, eax
and ecx, 0x25af9d02
add ecx, ecx
neg ecx
add eax, ecx
add eax, 0x3fa6840a
mov ecx, eax
and ecx, 0x1d21eb66
add ecx, ecx
sub eax, ecx
add eax, 0x9d21eb66
cmp eax, 0xa557913c
ja 0x140018e70
test r8, r8
mov r14, qword [rsp + 0x28]
je 0x140019414
mov qword [rsp + 0x20], r8
test r14, r14
je 0x140019276
nop word cs:[rax + rax]
mov eax, dword [0x14020f338]
add eax, dword [0x14020f33c]
mov ecx, eax
xor ecx, 0xdf27ba6
add ecx, eax
and eax, 0x20d8459
sub ecx, eax
or ecx, 0xf27aabdf
cmp ecx, 0xb7e996ee
jb 0x140018ed0
movdqa xmm0, xmmword [rsi]
mov eax, dword [0x14020f340]
xor edx, edx
div dword [0x14020f344]
pmovmskb r12d, xmm0
not r12d
nop word cs:[rax + rax]
mov eax, dword [0x14020f348]
xor eax, dword [0x14020f34c]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xe12374c7
and ecx, 0x1edc8b38
imul ecx, edx
mov edx, eax
and edx, 0x1edc8b38
or eax, 0x1edc8b38
imul eax, edx
add eax, ecx
imul eax, eax, 0x4a8787de
imul rax, rax, 0x1c61bb11
shr rax, 0x3c
cmp eax, 0x587bfa4c
ja 0x140018f20
mov eax, dword [0x14020f350]
xor edx, edx
div dword [0x14020f354]
lea r15, [rsi + 0x10]
nop dword [rax]
mov eax, dword [0x14020f358]
sub eax, dword [0x14020f35c]
or eax, 0xd52f40bc
imul rax, rax, 0x4ac9a837
shr rax, 0x3d
cmp eax, 0xaafb5ad4
je 0x140018f80
movabs r13, 0xfa70e04ea2eba01
mov ebp, 0x9229e517
nop word cs:[rax + rax]
mov eax, dword [0x14020f360]
xor edx, edx
div dword [0x14020f364]
mov eax, dword [0x14020f368]
mov ecx, dword [0x14020f36c]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
add eax, 0x4c08316c
or eax, 0x5e6bb9d9
cmp eax, 0x59e327cc
jb 0x140018fce
test r12w, r12w
jne 0x140019071
nop word cs:[rax + rax]
mov eax, dword [0x14020f370]
mov ecx, dword [0x14020f374]
add eax, ecx
add eax, 0x614fa5f2
xor eax, 0xaffd5a93
imul rax, rbp
shr rax, 0x3c
cmp eax, 0x53017e7e
ja 0x140019020
add rsi, 0xfffffffffffffe00
movdqa xmm0, xmmword [r15]
add r15, 0x10
pmovmskb eax, xmm0
cmp ax, 0xffff
je 0x140019020
lea r12d, [rax + rax]
not r12d
add r12d, eax
mov cl, 1
test cl, cl
je 0x140019061
mov eax, dword [0x14020f378]
xor edx, edx
div dword [0x14020f37c]
mov eax, dword [0x14020f380]
xor edx, edx
div dword [0x14020f384]
and eax, 0x9ce1a28a
mov ecx, eax
xor ecx, 0x316215c
or eax, 0x14008080
and eax, ecx
not eax
or eax, 0xe8e95602
add eax, 0x74f42a42
jae 0x14001907f
tzcnt ecx, r12d
add rcx, r13
mov rax, r13
sub rax, rcx
shl rax, 5
cmp qword [rsi + rax - 0x20], 0
je 0x1400191e9
add rax, rsi
mov ecx, dword [0x14020f388]
and ecx, dword [0x14020f38c]
imul rcx, rcx, 0x2c1fb02d
shr rcx, 0x3d
not ecx
and ecx, 0x32c0221
xor ecx, 0x1a02620
or ecx, 0x9c53d08e
cmp ecx, 0xc8aec1ea
je 0x1400190d0
mov rdi, qword [rax - 0x18]
mov eax, dword [0x14020f390]
mov ecx, dword [0x14020f394]
mov edx, eax
not edx
and edx, ecx
not ecx
and ecx, eax
sub ecx, edx
mov eax, ecx
not eax
and eax, 0x1c0db0ae
mov edx, ecx
and edx, 0x3f24f51
imul edx, eax
mov eax, ecx
and eax, 0x1c0db0ae
or ecx, 0x1c0db0ae
imul ecx, eax
lea eax, [rcx + rdx]
add eax, 0xba92d7e0
and eax, 0x17017fbc
cmp eax, 0x3741498
ja 0x140019260
nop dword [rax + rax]
mov eax, dword [0x14020f398]
mov ecx, dword [0x14020f39c]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
mov ecx, eax
not ecx
and ecx, 0xc265d10e
mov edx, eax
and edx, 0x3d9a2ef1
imul edx, ecx
mov ecx, eax
and ecx, 0xc265d10e
or eax, 0xc265d10e
imul eax, ecx
add eax, edx
mov ecx, eax
not ecx
and ecx, 0xe0ceb9bd
and eax, 0x1f314642
sub eax, ecx
imul rbx, rax, 0x6ee7de2b
shr rbx, 0x3e
mov rcx, qword [0x14022cb48]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0x2275ece0
je 0x140019260
lea eax, [r12 - 1]
and eax, r12d
dec r14
mov r12d, eax
nop word [rax + rax]
mov eax, dword [0x14020f3a0]
add eax, dword [0x14020f3a4]
mov ecx, eax
xor ecx, 0xe6851f67
add ecx, eax
and eax, 0x197ae098
sub ecx, eax
mov eax, ecx
xor eax, 0x575502f2
and eax, ecx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x1e825be3
and ecx, 0xe17da41c
imul ecx, edx
mov edx, eax
and edx, 0xe17da41c
or eax, 0xe17da41c
imul eax, edx
add eax, ecx
cmp eax, 0x4db54754
jb 0x140019200
test r14, r14
jne 0x140018fc0
jmp 0x140019276
mov rcx, qword [0x14022cb48]
xor edx, edx
mov r8, rdi
call fcn.14014eed0
jmp 0x140019160
mov rcx, qword [rsp + 0x20]
mov rax, rcx
shl rax, 5
add rcx, rax
add rcx, 0x31
xor edx, edx
nop dword [rax + rax]
test dl, dl
jne 0x140019290
test rcx, rcx
mov r9, qword [rsp + 0x30]
je 0x140019414
mov ecx, dword [0x14020f3a8]
mov edx, dword [0x14020f3ac]
mov r8d, ecx
not r8d
or ecx, edx
not edx
or edx, r8d
and edx, ecx
mov ecx, edx
xor ecx, 0x93f173b0
and edx, 0x6c0e8c4f
add edx, edx
sub edx, ecx
mov ecx, edx
and ecx, 0x9146758
xor edx, 0x9146758
lea ecx, [rdx + rcx*2]
or ecx, 0xaea4f9df
cmp ecx, 0x8c6a349a
jae 0x140019300
mov rcx, qword [0x14022cb48]
nop word cs:[rax + rax]
mov ecx, dword [0x14020f3b0]
mov edx, dword [0x14020f3b4]
mov r8d, ecx
not r8d
or ecx, edx
not edx
or edx, r8d
not edx
not ecx
or ecx, edx
not ecx
imul rcx, rcx, 0x3d84b68d
shr rcx, 0x3d
lea edx, [rcx - 0x6f24d744]
xor edx, 0x526d80f
add ecx, edx
add ecx, 0x2080c
mov rdi, qword [r9 + 0x90]
mov rbx, qword [0x14022cb48]
cmp ecx, 0xce884628
ja 0x140019300
sub rdi, rax
add rdi, 0xffffffffffffffe0
xor eax, eax
test al, al
je 0x140019370
mov rcx, rbx
xor edx, edx
mov r8, rdi
call fcn.14014eed0
mov eax, dword [0x14020f3b8]
mov ecx, dword [0x14020f3bc]
mov edx, eax
xor edx, ecx
not edx
or eax, ecx
and eax, edx
mov esi, eax
not esi
or eax, 0xf7f7efbf
or esi, 0x3d3ef5e3
and esi, eax
xor esi, 0xf53fe5eb
mov rcx, rbx
xor edx, edx
mov r8, rdi
call fcn.14014eed0
cmp esi, 0xa448ecb9
ja 0x140019370
nop word cs:[rax + rax]
mov eax, dword [0x14020f3c0]
mov ecx, dword [0x14020f3c4]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
add eax, 0x8c07f30c
mov ecx, eax
xor ecx, 0xb11780f9
and eax, 0x4ee87f06
add eax, eax
sub eax, ecx
imul rax, rax, 0x32da594b
shr rax, 0x3b
cmp eax, 0x6e10a831
ja 0x1400193c0
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret