Function at 0x1400d7b40
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x7a8
movdqa xmmword [rsp + 0x790], xmm12
movdqa xmmword [rsp + 0x780], xmm11
movdqa xmmword [rsp + 0x770], xmm10
movdqa xmmword [rsp + 0x760], xmm9
movaps xmmword [rsp + 0x750], xmm8
movaps xmmword [rsp + 0x740], xmm7
movdqa xmmword [rsp + 0x730], xmm6
mov r15, r8
mov r12, rdx
mov qword [rsp + 0x178], rcx
mov rsi, qword [rdx + 0x130]
test rsi, rsi
je 0x1400d7c3f
mov r14, qword [r15]
xor ecx, ecx
call fcn.140102310
test rax, rax
je 0x1400d7bdf
movzx edi, byte [rax + 0x4c]
movzx ebx, byte [rax + 0x4d]
test dil, dil
je 0x1400d7bff
test bl, bl
jne 0x1400d7bff
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
call qword [rax + 0x10]
jmp 0x1400d7c3f
mov rcx, rsi
mov rdx, r15
call fcn.1401026a0
test al, al
je 0x1400daf45
movzx eax, al
cmp eax, 4
je 0x1400d7c3f
jmp case.default.0x1400d8429
xor ecx, ecx
mov edx, ebx
sub dl, 1
movzx edx, dl
cmovb edx, ecx
test dil, dil
movzx ecx, bl
cmovne ecx, edx
mov byte [rax + 0x4d], cl
mov rcx, rsi
mov rdx, r15
call fcn.1401026a0
test dil, dil
je 0x1400d7bea
cmp al, 4
jne 0x1400d7bea
xor ecx, ecx
call fcn.140102310
test rax, rax
je 0x1400d7c3f
mov byte [rax + 0x4c], 1
mov byte [rax + 0x4d], bl
lea rax, [r12 + 0x20]
mov qword [rsp + 0x308], rax
lea rax, [r12 + 0x88]
mov qword [rsp + 0x548], rax
lea rax, [r12 + 0xe0]
mov qword [rsp + 0x198], rax
lea rax, [r12 + 0xe3]
mov qword [rsp + 0x530], rax
lea r14, [rsp + 0x7a]
lea rax, [r12 + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [0x140171d90]
lea rcx, str.combase.dll
xorps xmm7, xmm7
movaps xmm8, xmmword [0x140128090]
movq xmm0, rcx
movq xmm9, rax
punpcklqdq xmm9, xmm0
movdqa xmm10, xmmword [str.uespemosarenegylmodnarodsetybdet_]
movdqa xmm11, xmmword [0x1401280c0]
lea rax, [0x140172158]
movq xmm0, rax
movdqa xmm6, xmmword [0x1401280a0]
punpcklqdq xmm6, xmm0
lea rax, [r12 + 0xc8]
mov qword [rsp + 0x190], rax
lea rax, [r12 + 0xf8]
mov qword [rsp + 0x5a8], rax
lea rax, [r12 + 0x58]
mov qword [rsp + 0x5c0], rax
lea rax, [r12 + 0x70]
mov qword [rsp + 0x5b8], rax
lea r13, [rsp + 0x5f0]
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x540], r15
mov rdx, qword [r12 + 0x118]
mov rax, qword [r12 + 0x120]
mov rcx, r13
mov r8, r15
call qword [rax + 0x18]
mov rax, qword [rsp + 0x5f0]
cmp rax, 3
je 0x1400d7f20
cmp eax, 4
lea r15, [rsp + 0x430]
je 0x1400db160
mov r8d, 0xa0
lea rcx, [rsp + 0x690]
mov rdx, r13
call sub.msvcrt.dll_memcpy
movzx eax, word [rsp + 0x6f8]
lea ecx, [rax - 0x12d]
cmp ecx, 3
jae 0x1400d7fda
cmp qword [r12], 0
je 0x1400d7dc0
mov rax, qword [r12 + 8]
test rax, rax
je 0x1400d7dc0
mov rdx, qword [r12 + 0x10]
mov r8, qword [r12 + 0x18]
mov rcx, qword [rsp + 0x308]
call qword [rax + 0x10]
mov qword [r12], 0
mov rcx, rbp
mov rdx, qword [rsp + 0x30]
lea r8, [0x140172078]
call fcn.140091e60
cmp byte [rsp + 0x90], 2
je 0x1400d7e03
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0x88]
call qword [rax + 0x10]
mov rcx, rbp
mov rdx, qword [rsp + 0x30]
lea r8, [0x140172098]
call fcn.140091e60
cmp byte [rsp + 0x90], 2
je 0x1400d7e3e
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0x88]
call qword [rax + 0x10]
mov rcx, rbp
mov rdx, qword [rsp + 0x30]
lea r8, [0x1401720b8]
call fcn.140091e60
cmp byte [rsp + 0x90], 2
je 0x1400d7e79
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0x88]
call qword [rax + 0x10]
mov rcx, rbp
mov rdx, qword [rsp + 0x30]
lea r8, [0x1401720d8]
call fcn.140091e60
cmp byte [rsp + 0x90], 2
je 0x1400d7eb4
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0x88]
call qword [rax + 0x10]
mov rax, qword [rsp + 0x198]
movzx eax, byte [rax]
mov ecx, eax
or ecx, 4
cmp ecx, 5
je 0x1400d8000
cmp al, 0xa
jb 0x1400d7ef2
cmp qword [r12 + 0xf0], 0
je 0x1400d7ef2
mov r8, qword [r12 + 0xe8]
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x198]
movabs rcx, 0x101010101010101
mov qword [rax + 0x10], rcx
movups xmmword [rax], xmm8
jmp 0x1400d8000
mov rdi, qword [rsp + 0x5f8]
mov qword [rsp + 0x510], rdi
mov rsi, qword [rdi]
test rsi, rsi
lea r15, [rsp + 0x430]
je 0x1400db1d6
mov rax, qword [rdi + 8]
mov rcx, rsi
call qword [rax + 0x38]
movabs rcx, 0xc153b745c2b4da85
xor rdx, rcx
movabs rcx, 0x949ccad0664456ed
xor rax, rcx
or rax, rdx
jne 0x1400db1d6
cmp byte [rsi], 1
jne 0x1400db1d6
cmp byte [rsi + 1], 2
jne 0x1400db1d6
cmp dword [rsi + 4], 0
jne 0x1400db1d6
cmp qword [r12], 0
je 0x1400d8327
mov rax, qword [r12 + 8]
test rax, rax
je 0x1400db1d6
mov r8, qword [r12 + 0x10]
mov r9, qword [r12 + 0x18]
lea rcx, [rsp + 0x370]
mov rdx, qword [rsp + 0x308]
call qword [rax]
mov rax, qword [r12 + 0x128]
cmp rax, 1
jbe 0x1400d8362
jmp 0x1400db1c9
add eax, 0xfffffecd
cmp eax, 2
jae 0x1400db411
cmp qword [r12], 0
je 0x1400d8000
cmp qword [r12 + 8], 0
je 0x1400db411
nop dword [rax + rax]
movups xmm0, xmmword [0x140172108]
movaps xmmword [rsp + 0x80], xmm0
movdqu xmm0, xmmword [0x1401720f8]
movdqa xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x690]
mov rdx, rbp
call fcn.140091910
mov rsi, rax
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x1400d8052
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0x88]
call qword [rax + 0x10]
test rsi, rsi
je 0x1400db411
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
mov rcx, r15
call fcn.140013510
cmp qword [rsp + 0x430], 0
jne 0x1400db411
mov r8, qword [rsp + 0x438]
mov r9, qword [rsp + 0x440]
mov qword [rsp + 0x430], 0
mov qword [rsp + 0x440], 0
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x450], rax
mov rcx, rbp
mov rdx, r15
call fcn.14010cba0
mov edi, dword [rsp + 0x70]
cmp edi, 2
je 0x1400db411
mov rax, qword [r14 - 6]
mov qword [rsp + 0x310], rax
mov eax, dword [r14 + 2]
mov dword [rsp + 0x318], eax
mov rbx, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov rsi, rbp
mov rbp, qword [rsp + 0x90]
lea rax, [rsp + 0x98]
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0x10]
movups xmm2, xmmword [rax + 0x20]
movdqa xmmword [rsp + 0x5f0], xmm0
movdqa xmmword [rsp + 0x600], xmm1
movaps xmmword [rsp + 0x610], xmm2
lea r15, [rsp + 0x3d0]
mov rcx, r15
mov rdx, rbx
mov r8, rbp
call fcn.14000f0c0
mov rcx, rsi
mov rdx, r15
call fcn.14002ff50
cmp byte [rsp + 0x70], 3
je 0x1400db07b
movups xmm0, xmmword [rsp + 0x70]
movdqu xmm1, xmmword [rsp + 0x80]
movups xmm2, xmmword [rsp + 0x90]
movups xmm3, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x430], xmm0
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x480], rax
movdqu xmm0, xmmword [rsp + 0xb0]
movdqa xmmword [rsp + 0x470], xmm0
movaps xmmword [rsp + 0x460], xmm3
movaps xmmword [rsp + 0x450], xmm2
movdqa xmmword [rsp + 0x440], xmm1
movzx eax, byte [rsp + 0x430]
cmp al, 3
je 0x1400db07b
cmp al, 2
jb 0x1400d81f7
mov rsi, qword [rsp + 0x438]
lea rcx, [rsi + 0x18]
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
call qword [rax + 0x10]
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x440]
mov rdx, qword [rsp + 0x448]
mov r8, qword [rsp + 0x450]
lea rcx, [rsp + 0x458]
call qword [rax + 0x10]
mov rax, qword [rsp + 0x460]
mov rdx, qword [rsp + 0x468]
mov r8, qword [rsp + 0x470]
lea rcx, [rsp + 0x478]
call qword [rax + 0x10]
mov eax, dword [rsp + 0x318]
mov dword [rsp + 0x378], eax
mov rcx, qword [rsp + 0x310]
mov qword [rsp + 0x370], rcx
movaps xmm0, xmmword [rsp + 0x5f0]
movdqa xmm1, xmmword [rsp + 0x600]
movaps xmm2, xmmword [rsp + 0x610]
movaps xmmword [rsp + 0x220], xmm2
movdqa xmmword [rsp + 0x210], xmm1
movaps xmmword [rsp + 0x200], xmm0
lea rdx, [rsp + 0x294]
mov dword [rdx + 8], eax
mov qword [rdx], rcx
movaps xmm0, xmmword [rsp + 0x220]
movups xmmword [rdx + 0x44], xmm0
movaps xmm0, xmmword [rsp + 0x210]
movups xmmword [rdx + 0x34], xmm0
movdqa xmm0, xmmword [rsp + 0x200]
movdqu xmmword [rdx + 0x24], xmm0
mov dword [rsp + 0x290], edi
mov qword [rsp + 0x2a0], rbx
mov qword [rsp + 0x2a8], r14
mov qword [rsp + 0x2b0], rbp
mov rax, qword [r12 + 0x110]
cmp byte [rax + 0x1b8], 0
je 0x1400d87e0
mov r8d, dword [rsp + 0x2bc]
test r8, r8
lea rdi, [rsp + 0x430]
je 0x1400d8455
cmp rbp, r8
jbe 0x1400d8432
cmp byte [rbx + r8], 0xbf
jg 0x1400d8438
jmp case.default.0x1400d8429
lea rax, [0x140171d90]
mov qword [rsp + 0x370], rax
lea rax, str.combase.dll
mov qword [rsp + 0x378], rax
lea rax, [rsp + 0x380]
movups xmmword [rax], xmm7
mov rax, qword [r12 + 0x128]
cmp rax, 1
ja 0x1400db1c9
inc rax
mov qword [r12 + 0x128], rax
mov rdx, qword [r12 + 0x98]
mov r8, qword [r12 + 0xa8]
mov rcx, r15
call fcn.14000f0c0
mov rcx, rbp
mov rdx, r15
call fcn.14002ff50
cmp byte [rsp + 0x70], 3
je case.default.0x1400d8429
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x360], rax
movups xmm0, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x350], xmm0
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movups xmm2, xmmword [rsp + 0x90]
movups xmm3, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x340], xmm3
movaps xmmword [rsp + 0x330], xmm2
movaps xmmword [rsp + 0x320], xmm1
movaps xmmword [rsp + 0x310], xmm0
movaps xmmword [rsp + 0x290], xmm7
movaps xmmword [rsp + 0x180], xmm7
movaps xmmword [rsp + 0x590], xmm7
mov rax, qword [rsp + 0x198]
movzx eax, byte [rax]
lea rcx, [0x1401280d0]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
xor ecx, ecx
jmp 0x1400d8d50
jne case.default.0x1400d8429
cmp r8d, 4
jne 0x1400d8455
mov rcx, rbx
lea rdx, str.httphttpswswssftpfile__file:__
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x1400d9531
mov ebx, dword [r12 + 0xb4]
mov rsi, qword [r12 + 0x98]
mov rbp, qword [r12 + 0xa8]
test rbp, rbp
je 0x1400d84ba
js case.default.0x1400d8429
movzx eax, byte [0x1401a4170]
mov rax, qword [0x1401a4160]
test rax, rax
jne 0x1400d84a0
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je case.default.0x1400d8429
mov qword [0x1401a4160], rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call sub.KERNEL32.dll_HeapAlloc
mov r14, rax
test rax, rax
jne 0x1400d84c0
jmp case.default.0x1400d8429
mov r14d, 1
mov rcx, r14
mov rdx, rsi
mov r8, rbp
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x90], rbp
mov rax, qword [rsp + 0x190]
movups xmm0, xmmword [rax]
lea rcx, [rsp + 0xb0]
movups xmmword [rcx], xmm0
movzx eax, byte [rax + 0x10]
mov byte [rcx + 0x10], al
mov eax, dword [r12 + 0xb0]
movdqu xmm0, xmmword [r12 + 0x88]
mov dword [rsp + 0x9c], ebx
mov dword [rsp + 0x98], eax
movdqu xmm1, xmmword [r12 + 0xb8]
movdqu xmmword [rsp + 0xa0], xmm1
movdqu xmmword [rsp + 0x70], xmm0
lea rsi, [rsp + 0x70]
mov rcx, rsi
lea rdx, str.combase.dll
call fcn.14010e3a0
mov rcx, rsi
call fcn.14010e200
cmp dword [rsp + 0x78], 0
mov rax, qword [rsp + 0x90]
je 0x1400d8571
mov r8d, dword [rsp + 0x7c]
cmp rax, r8
jae 0x1400d8576
mov r8, rax
jmp 0x1400d859b
test r8, r8
je 0x1400d8593
cmp rax, r8
jbe 0x1400d8593
mov rax, qword [rsp + 0x80]
cmp byte [rax + r8], 0xbf
jle case.default.0x1400d8429
mov qword [rsp + 0x90], r8
mov dword [rsp + 0x78], 0
mov eax, dword [rsp + 0x9c]
mov rbx, qword [rsp + 0x80]
mov rcx, r8
inc eax
je 0x1400d85d2
mov rcx, r8
sub rcx, rax
jbe 0x1400d85cc
cmp byte [rbx + rax], 0xbf
jg 0x1400d85d2
jmp case.default.0x1400d8429
jne case.default.0x1400d8429
test rcx, rcx
je 0x1400d85e7
cmp byte [rbx + rax], 0x2f
sete al
test al, al
je 0x1400d85f1
jmp 0x1400d86c0
xor eax, eax
test al, al
jne 0x1400d86c0
cmp dword [rsp + 0x70], 0
jne 0x1400d86c0
mov rcx, r8
test r8, r8
je 0x1400d86a5
lea rcx, [rbx + r8]
xor eax, eax
nop
movzx edx, byte [rcx - 1]
test dl, dl
js 0x1400d8620
dec rcx
jmp 0x1400d867f
movzx r9d, byte [rcx - 2]
cmp r9b, 0xc0
jge 0x1400d8650
movzx r10d, byte [rcx - 3]
cmp r10b, 0xc0
jge 0x1400d865a
movzx r11d, byte [rcx - 4]
add rcx, 0xfffffffffffffffc
and r11d, 7
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
jmp 0x1400d8662
add rcx, 0xfffffffffffffffe
and r9d, 0x1f
jmp 0x1400d866d
add rcx, 0xfffffffffffffffd
and r10d, 0xf
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
shl r9d, 6
and edx, 0x3f
or edx, r9d
cmp edx, 0x110000
je 0x1400d868c
cmp edx, 0x20
jne 0x1400d868c
inc rax
cmp rbx, rcx
jne 0x1400d8610
mov rcx, r8
sub rcx, rax
jb 0x1400d86c0
je 0x1400d86a5
cmp r8, rcx
jbe 0x1400d86a5
cmp byte [rbx + rcx], 0xbf
jle case.default.0x1400d8429
cmp r8, rcx
jb 0x1400d86c0
mov qword [rsp + 0x90], rcx
mov r8, rcx
nop word cs:[rax + rax]
xor eax, eax
nop word cs:[rax + rax]
cmp r8, rax
je 0x1400d870d
movzx r9d, byte [rbx + rax]
cmp r9b, 0x20
setae cl
cmp r9b, 0x7f
setne dl
inc rax
cmp r9b, 9
je 0x1400d86d0
and cl, dl
jne 0x1400d86d0
mov byte [rsp + 0x610], 2
mov sil, 2
cmp qword [rsp + 0x88], 0
jne 0x1400d875f
jmp 0x1400d8770
mov rcx, rdi
mov rdx, rbx
call fcn.14000f0c0
mov byte [rsp + 0x450], 0
movdqu xmm0, xmmword [rsp + 0x430]
movdqu xmm1, xmmword [rsp + 0x440]
movdqa xmmword [rsp + 0x5f0], xmm0
movdqa xmmword [rsp + 0x600], xmm1
mov rsi, qword [rsp + 0x450]
mov qword [rsp + 0x610], rsi
cmp qword [rsp + 0x88], 0
je 0x1400d8770
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
cmp sil, 2
je 0x1400d87e0
movups xmm0, xmmword [0x140172128]
movaps xmmword [rsp + 0x440], xmm0
movdqu xmm0, xmmword [0x140172118]
movdqa xmmword [rsp + 0x430], xmm0
lea rcx, [rsp + 0x70]
mov rdx, qword [rsp + 0x30]
mov r8, rdi
mov r9, r13
call fcn.1400c3a40
cmp byte [rsp + 0x90], 2
je 0x1400d87e0
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0x88]
call qword [rax + 0x10]
nop word cs:[rax + rax]
mov rbx, qword [r12 + 0x98]
mov rsi, qword [r12 + 0xa8]
test rsi, rsi
je 0x1400d883d
js case.default.0x1400d8429
movzx eax, byte [0x1401a4170]
mov rax, qword [0x1401a4160]
test rax, rax
jne 0x1400d8823
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je case.default.0x1400d8429
mov qword [0x1401a4160], rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapAlloc
mov rbp, rax
test rax, rax
jne 0x1400d8842
jmp case.default.0x1400d8429
mov ebp, 1
mov rcx, rbp
mov rdx, rbx
mov r8, rsi
call sub.msvcrt.dll_memcpy
movdqu xmm12, xmmword [r12 + 0xb4]
mov rcx, qword [rsp + 0x190]
movzx eax, byte [rcx + 0x10]
mov byte [rsp + 0x5e0], al
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x5d0], xmm0
movzx r14d, word [r12 + 0xb0]
movzx r10d, word [r12 + 0xb2]
mov r8d, dword [r12 + 0xc4]
mov r15d, dword [r12 + 0x88]
mov ebx, dword [r12 + 0x8c]
mov r13d, dword [r12 + 0x90]
mov edi, dword [r12 + 0x94]
mov rdx, qword [r12 + 0x108]
cmp rdx, qword [r12 + 0x100]
jne 0x1400d88ef
mov rcx, qword [rsp + 0x5a8]
mov dword [rsp + 0x58], r8d
mov word [rsp + 0x48], r10w
call fcn.140099210
movzx r10d, word [rsp + 0x48]
mov r8d, dword [rsp + 0x58]
mov rdx, qword [r12 + 0x108]
mov rax, qword [r12 + 0xf8]
imul rcx, rdx, 0x58
mov dword [rax + rcx], r15d
mov dword [rax + rcx + 4], ebx
mov dword [rax + rcx + 8], r13d
mov dword [rax + rcx + 0xc], edi
mov qword [rax + rcx + 0x10], rbp
mov qword [rax + rcx + 0x18], rsi
mov qword [rax + rcx + 0x20], rsi
mov word [rax + rcx + 0x28], r14w
mov word [rax + rcx + 0x2a], r10w
movdqu xmmword [rax + rcx + 0x2c], xmm12
mov dword [rax + rcx + 0x3c], r8d
movdqa xmm0, xmmword [rsp + 0x5d0]
movdqu xmmword [rax + rcx + 0x40], xmm0
movzx edx, byte [rsp + 0x5e0]
mov byte [rax + rcx + 0x50], dl
mov rdx, qword [r12 + 0xf8]
mov rax, qword [r12 + 0x108]
inc rax
mov qword [r12 + 0x108], rax
mov rcx, qword [r12 + 0x110]
mov r8, qword [rcx + 0x188]
test r8, r8
je 0x1400d89a0
cmp r8d, 1
jne 0x1400db3f0
cmp qword [rcx + 0x190], rax
ja 0x1400d89fb
jmp 0x1400db6b4
movzx r8d, word [rsp + 0x6f8]
lea r9, [rsp + 0x290]
mov qword [rsp + 0x70], r9
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x80], rax
mov word [rsp + 0x88], r8w
mov rdx, qword [rcx + 0x190]
mov rax, qword [rcx + 0x198]
lea rcx, [rsp + 0x430]
lea r8, [rsp + 0x70]
call qword [rax + 0x28]
mov rax, qword [rsp + 0x430]
test rax, rax
jne 0x1400db3e6
mov esi, dword [rsp + 0x2bc]
test rsi, rsi
je 0x1400db00d
mov rbp, qword [rsp + 0x2a0]
mov rbx, qword [rsp + 0x2b0]
cmp rbx, rsi
jbe 0x1400d8a2c
cmp byte [rbp + rsi], 0xbf
jg 0x1400d8a32
jmp case.default.0x1400d8429
jne case.default.0x1400d8429
cmp esi, 4
jne 0x1400d8a4d
mov rcx, rbp
lea rdx, str.httphttpswswssftpfile__file:__
mov r8, rsi
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x1400d8a87
cmp rbx, rsi
jbe 0x1400d8a5e
cmp byte [rbp + rsi], 0xbf
jg 0x1400d8a64
jmp case.default.0x1400d8429
jne case.default.0x1400d8429
cmp esi, 5
jne 0x1400db00d
mov rcx, rbp
lea rdx, [0x140196b08]
mov r8, rsi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x1400db00d
mov rax, qword [r12 + 0x110]
cmp byte [rax + 0x1ba], 0
je 0x1400d8ad2
cmp rbx, rsi
jbe 0x1400d8aa9
cmp byte [rbp + rsi], 0xbf
jg 0x1400d8aaf
jmp case.default.0x1400d8429
jne case.default.0x1400d8429
cmp esi, 5
jne 0x1400db174
mov rcx, rbp
lea rdx, [0x140196b08]
mov r8, rsi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x1400db174
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0xc0], rax
movups xmm0, xmmword [rsp + 0x2d0]
movaps xmmword [rsp + 0xb0], xmm0
movups xmm0, xmmword [rsp + 0x290]
movups xmm1, xmmword [rsp + 0x2a0]
movups xmm2, xmmword [rsp + 0x2b0]
movups xmm3, xmmword [rsp + 0x2c0]
movaps xmmword [rsp + 0xa0], xmm3
movaps xmmword [rsp + 0x90], xmm2
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
cmp qword [r12 + 0xa0], 0
lea rbp, [rsp + 0x70]
je 0x1400d8b55
mov r8, qword [r12 + 0x98]
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x548]
mov qword [rcx + 0x50], rax
movaps xmm0, xmmword [rsp + 0xb0]
movups xmmword [rcx + 0x40], xmm0
movaps xmm0, xmmword [rsp + 0x70]
movaps xmm1, xmmword [rsp + 0x80]
movaps xmm2, xmmword [rsp + 0x90]
movaps xmm3, xmmword [rsp + 0xa0]
movups xmmword [rcx + 0x30], xmm3
movups xmmword [rcx + 0x20], xmm2
movups xmmword [rcx + 0x10], xmm1
movups xmmword [rcx], xmm0
mov rax, qword [rsp + 0x30]
movups xmm0, xmmword [rax + 0x50]
movaps xmmword [rsp + 0x250], xmm0
movups xmm0, xmmword [rax + 0x40]
movaps xmmword [rsp + 0x240], xmm0
movups xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 0x10]
movups xmm2, xmmword [rax + 0x20]
movups xmm3, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x230], xmm3
movaps xmmword [rsp + 0x220], xmm2
movdqa xmmword [rsp + 0x210], xmm1
movaps xmmword [rsp + 0x200], xmm0
mov qword [r12 + 0x28], 0
mov qword [r12 + 0x40], 2
mov qword [r12 + 0x48], 0
mov qword [r12 + 0x50], 8
mov rax, qword [rsp + 0x5c0]
movups xmmword [rax], xmm7
mov qword [r12 + 0x68], 8
mov rax, qword [rsp + 0x5b8]
movups xmmword [rax], xmm7
mov word [rax + 0x10], 0
mov rax, qword [r12 + 0x108]
sub rax, 1
jb 0x1400d9e6d
mov r14, qword [r12 + 0xf8]
mov rcx, qword [rsp + 0x190]
cmp byte [rcx], 0
je 0x1400d8ca9
mov edx, dword [r12 + 0xbc]
mov r8d, dword [r12 + 0xc0]
cmp edx, r8d
ja case.default.0x1400d8429
mov rcx, qword [r12 + 0x98]
mov r9, qword [r12 + 0xa8]
test rdx, rdx
je 0x1400d944c
cmp r9, rdx
jbe 0x1400d9446
cmp byte [rcx + rdx], 0xc0
jge 0x1400d944c
jmp case.default.0x1400d8429
xor ecx, ecx
imul r15, rax, 0x58
cmp byte [r14 + r15 + 0x40], 0
jne 0x1400d947e
xor edx, edx
test rcx, rcx
jne 0x1400d94e1
test rdx, rdx
jne 0x1400d9638
jmp 0x1400d9500
mov cl, 1
jmp 0x1400d8d50
mov cl, 2
jmp 0x1400d8d50
mov cl, 3
jmp 0x1400d8d50
movzx r10d, byte [rsp + 0x74]
mov byte [rsp + 0x64], r10b
mov r10d, dword [rsp + 0x70]
mov dword [rsp + 0x60], r10d
mov r10, qword [rsp + 0x570]
mov r11, qword [rsp + 0x576]
mov qword [rsp + 0x2f0], r10
mov qword [rsp + 0x2f6], r11
movaps xmm0, xmmword [rsp + 0x290]
movaps xmmword [rsp + 0x430], xmm0
movaps xmm0, xmmword [rsp + 0x180]
movaps xmmword [rsp + 0x200], xmm0
mov r10d, dword [rsp + 0x1f8]
mov dword [rsp + 0x1d8], r10d
movzx r10d, word [rsp + 0x1fc]
mov word [rsp + 0x1dc], r10w
mov r10, qword [rsp + 0x580]
mov r11, qword [rsp + 0x587]
mov qword [rsp + 0x527], r11
mov qword [rsp + 0x520], r10
movaps xmm0, xmmword [rsp + 0x590]
movaps xmmword [rsp + 0x3d0], xmm0
movzx r10d, word [rsp + 0x1a4]
mov word [rsp + 0x174], r10w
mov r10d, dword [rsp + 0x1a0]
mov dword [rsp + 0x170], r10d
movzx r10d, byte [rsp + 0x64]
mov byte [rsp + 0x6c], r10b
mov r10d, dword [rsp + 0x60]
mov dword [rsp + 0x68], r10d
mov r10d, dword [rsp + 0x562]
mov r11d, dword [rsp + 0x565]
mov dword [rsp + 0x1eb], r11d
mov dword [rsp + 0x1e8], r10d
mov r10, qword [rsp + 0x2f0]
mov r11, qword [rsp + 0x2f6]
mov qword [r14 + 6], r11
mov qword [r14], r10
mov qword [rsp + 0x88], 2
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 8
movaps xmm0, xmmword [rsp + 0x430]
movups xmmword [r14 + 0x26], xmm0
mov qword [rsp + 0xb0], 8
movaps xmm0, xmmword [rsp + 0x200]
movups xmmword [r14 + 0x3e], xmm0
mov word [rsp + 0xc8], 0
movzx r10d, word [rsp + 0x1dc]
mov word [r14 + 0x54], r10w
mov r10d, dword [rsp + 0x1d8]
mov dword [r14 + 0x50], r10d
mov byte [rsp + 0xd0], 0
mov r10, qword [rsp + 0x520]
mov r11, qword [rsp + 0x527]
mov qword [r14 + 0x5e], r11
mov qword [r14 + 0x57], r10
lea r11, [0x14015f2f0]
mov qword [rsp + 0xe0], r11
lea r10, str.combase.dll
mov qword [rsp + 0xe8], r10
movaps xmm0, xmmword [rsp + 0x3d0]
movups xmmword [r14 + 0x76], xmm0
mov qword [rsp + 0x100], r11
lea r10, [0x1401709b6]
mov qword [rsp + 0x108], r10
mov qword [rsp + 0x110], 1
mov qword [rsp + 0x118], 0
mov word [rsp + 0x120], 0xffff
movzx r10d, word [rsp + 0x174]
mov word [r14 + 0xac], r10w
mov r10d, dword [rsp + 0x170]
mov dword [r14 + 0xa8], r10d
movzx r10d, byte [rsp + 0x6c]
mov byte [r14 + 0xb5], r10b
mov r10d, dword [rsp + 0x68]
mov dword [r14 + 0xb1], r10d
mov qword [rsp + 0x140], 0
mov byte [rsp + 0x148], 2
mov r10d, dword [rsp + 0x1e8]
mov r11d, dword [rsp + 0x1eb]
mov dword [r14 + 0xd2], r11d
mov dword [r14 + 0xcf], r10d
mov r10, qword [rsp + 0x360]
mov qword [rsp + 0x420], r10
movaps xmm0, xmmword [rsp + 0x350]
movaps xmmword [rsp + 0x410], xmm0
movaps xmm0, xmmword [rsp + 0x310]
movaps xmm1, xmmword [rsp + 0x320]
movaps xmm2, xmmword [rsp + 0x330]
movaps xmm3, xmmword [rsp + 0x340]
movaps xmmword [rsp + 0x400], xmm3
movaps xmmword [rsp + 0x3f0], xmm2
movaps xmmword [rsp + 0x3e0], xmm1
movaps xmmword [rsp + 0x3d0], xmm0
mov qword [rsp + 0x70], 0
mov byte [rsp + 0x128], cl
mov byte [rsp + 0x129], r8b
mov byte [rsp + 0x12a], r9b
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], rdx
mov rcx, r15
mov rdx, rbp
lea r8, [rsp + 0x3d0]
call fcn.1400d7930
mov rdi, r14
mov r14, qword [rsp + 0x430]
mov rax, qword [rsp + 0x448]
mov qword [rsp + 0x1c0], rax
lea rcx, [rsp + 0x43a]
mov rax, qword [rcx]
mov rcx, qword [rcx + 6]
mov qword [rsp + 0x290], rax
mov qword [rsp + 0x296], rcx
mov rbx, qword [rsp + 0x450]
mov rax, qword [rsp + 0x458]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x460]
mov qword [rsp + 0x40], rax
mov r13, qword [rsp + 0x468]
mov rsi, qword [rsp + 0x470]
mov rax, qword [rsp + 0x478]
mov qword [rsp + 0x58], rax
mov r12, qword [rsp + 0x480]
mov r8d, 0x88
lea r15, [rsp + 0x200]
mov rcx, r15
lea rdx, [rsp + 0x488]
call sub.msvcrt.dll_memcpy
movups xmm0, xmmword [rsp + 0x370]
movups xmm1, xmmword [rsp + 0x380]
movaps xmmword [rsp + 0x3e0], xmm1
movaps xmmword [rsp + 0x3d0], xmm0
cmp r14, 3
je 0x1400dbb60
mov rax, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x296]
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x186], rcx
mov r8d, 0x88
mov rcx, rbp
mov rdx, r15
call sub.msvcrt.dll_memcpy
movups xmm0, xmmword [rsp + 0x370]
movdqu xmm1, xmmword [rsp + 0x380]
movups xmmword [rdi + 0x7e], xmm0
movdqu xmmword [rdi + 0x8e], xmm1
mov r8d, 0xa8
lea rcx, [rsp + 0x430]
mov rdx, rbp
call sub.msvcrt.dll_memcpy
mov rbp, qword [rsp + 0x50]
movzx edi, word [rbp + 0x80]
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
call fcn.1400c52b0
mov r14, rax
mov r15, rdx
mov rdx, qword [rbp + 0x50]
mov r8, qword [rbp + 0x60]
lea rcx, [rsp + 0x98]
call fcn.14008c5a0
mov rdx, qword [rbp + 0x68]
mov r8, qword [rbp + 0x78]
lea rcx, [rsp + 0xb0]
call fcn.14008c800
movdqu xmm0, xmmword [rbp + 0x28]
mov rax, qword [rbp + 0x38]
mov word [rsp + 0xc8], di
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r15
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rax
test rbx, rbx
je 0x1400d9225
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, qword [rsp + 0x1c0]
call sub.KERNEL32.dll_HeapFree
test r13, r13
lea r14, [rsp + 0x7a]
lea rdi, [rsp + 0x70]
mov rbx, rsi
mov r15, qword [rsp + 0x48]
je 0x1400d9290
lea rsi, [r15 + 0x30]
jmp 0x1400d926b
mov rax, qword [rsi - 0x18]
mov rdx, qword [rsi - 0x10]
mov r8, qword [rsi - 8]
mov rcx, rsi
call qword [rax + 0x10]
add rsi, 0x68
dec r13
je 0x1400d9290
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1400d9250
lea rcx, [rsi + 0x28]
mov rdx, qword [rsi + 0x18]
mov r8, qword [rsi + 0x20]
call qword [rax + 0x10]
jmp 0x1400d9250
cmp qword [rsp + 0x40], 0
je 0x1400d92a9
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
test r12, r12
mov r15, qword [rsp + 0x540]
lea r13, [rsp + 0x5f0]
je 0x1400d92eb
lea rsi, [rbx + 0x38]
nop word cs:[rax + rax]
mov rax, qword [rsi - 0x18]
mov rdx, qword [rsi - 0x10]
mov r8, qword [rsi - 8]
mov rcx, rsi
call qword [rax + 0x10]
add rsi, 0x48
dec r12
jne 0x1400d92d0
cmp qword [rsp + 0x58], 0
je 0x1400d9304
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x70]
movzx ecx, word [rsp + 0x78]
mov rdx, qword [r14]
mov r8, qword [r14 + 6]
mov qword [rsp + 0x180], rdx
mov qword [rsp + 0x186], r8
movdqu xmm0, xmmword [rsp + 0x88]
mov rdx, qword [rsp + 0x98]
mov r8, qword [rsp + 0xb0]
mov r9, qword [rsp + 0xc8]
mov qword [rsp + 0x430], r9
movdqu xmm1, xmmword [rsp + 0xa0]
movups xmm2, xmmword [rsp + 0xb8]
mov r12, qword [rsp + 0x50]
mov rsi, qword [r12 + 0x110]
add rsi, 0x10
mov qword [rsp + 0x70], rax
mov word [rsp + 0x78], cx
mov rax, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x186]
mov qword [r14 + 6], rcx
mov qword [r14], rax
movdqu xmmword [rsp + 0x88], xmm0
mov qword [rsp + 0x98], rdx
movdqu xmmword [rsp + 0xa0], xmm1
mov qword [rsp + 0xb0], r8
movups xmmword [rsp + 0xb8], xmm2
mov r8d, 0xa8
lea rcx, [rsp + 0xc8]
lea rdx, [rsp + 0x430]
call sub.msvcrt.dll_memcpy
mov rcx, rsi
mov rdx, rdi
call fcn.1400ae360
mov rsi, rax
mov rbx, rdx
mov rbp, qword [r12 + 0x118]
mov rdi, qword [r12 + 0x120]
mov rcx, rbp
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x1400d941f
cmp qword [rdi + 0x10], 0x11
jb 0x1400d940e
mov rbp, qword [rbp - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rbp
call sub.KERNEL32.dll_HeapFree
mov qword [r12 + 0x118], rsi
mov qword [r12 + 0x120], rbx
lea rcx, [rsp + 0x510]
call fcn.140040d90
lea rbp, [rsp + 0x70]
jmp 0x1400d7d31
jne case.default.0x1400d8429
test r8, r8
je 0x1400d9468
cmp r9, r8
jbe 0x1400d9462
cmp byte [rcx + r8], 0xbf
jg 0x1400d9468
jmp case.default.0x1400d8429
jne case.default.0x1400d8429
add rcx, rdx
sub r8, rdx
imul r15, rax, 0x58
cmp byte [r14 + r15 + 0x40], 0
je 0x1400d8cbb
mov r9d, dword [r14 + r15 + 0x34]
mov eax, dword [r14 + r15 + 0x38]
cmp r9d, eax
ja case.default.0x1400d8429
mov rdx, qword [r14 + r15 + 0x10]
mov r10, qword [r14 + r15 + 0x20]
test r9, r9
je 0x1400d94b7
cmp r10, r9
jbe 0x1400d94b1
cmp byte [rdx + r9], 0xc0
jge 0x1400d94b7
jmp case.default.0x1400d8429
jne case.default.0x1400d8429
test rax, rax
je 0x1400d94d2
cmp r10, rax
jbe 0x1400d94cc
cmp byte [rdx + rax], 0xbf
jg 0x1400d94d2
jmp case.default.0x1400d8429
jne case.default.0x1400d8429
add rdx, r9
sub rax, r9
test rcx, rcx
je 0x1400d8cc6
test rdx, rdx
je 0x1400d9638
cmp r8, rax
jne 0x1400d9638
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x1400d9638
cmp word [r12 + 0xb0], 0
je 0x1400d955e
movzx esi, word [r12 + 0xb2]
mov bx, 1
cmp word [r14 + r15 + 0x28], 0
je 0x1400d95eb
movzx edx, word [r14 + r15 + 0x2a]
jmp 0x1400d961e
mov ebx, dword [r12 + 0xb4]
mov rsi, qword [r12 + 0x98]
mov rbp, qword [r12 + 0xa8]
test rbx, rbx
je 0x1400d9588
cmp rbp, rbx
jbe 0x1400d958f
cmp byte [rsi + rbx], 0xbf
jg 0x1400d9595
jmp case.default.0x1400d8429
mov edx, dword [r12 + 0xb4]
mov rcx, qword [r12 + 0x98]
test rdx, rdx
je 0x1400d95c8
cmp qword [r12 + 0xa8], rdx
jbe 0x1400d95c2
cmp byte [rcx + rdx], 0xbf
jg 0x1400d95c8
jmp case.default.0x1400d8429
xor ebx, ebx
jmp 0x1400d846d
jne case.default.0x1400d8429
cmp ebx, 5
jne 0x1400d846d
mov rcx, rsi
lea rdx, [0x140196b08]
mov r8, rbx
call sub.msvcrt.dll_memcmp
mov ebx, 5
test eax, eax
jne 0x1400d846d
jmp 0x1400d87e0
jne case.default.0x1400d8429
call fcn.14010e820
mov ebx, eax
mov esi, edx
cmp word [r14 + r15 + 0x28], 0
je 0x1400d95eb
test bx, bx
je 0x1400d9638
movzx edx, word [r14 + r15 + 0x2a]
mov bx, 1
jmp 0x1400d961e
mov edx, dword [r14 + r15 + 0x2c]
mov rcx, qword [r14 + r15 + 0x10]
test rdx, rdx
je 0x1400d9612
cmp qword [r14 + r15 + 0x20], rdx
jbe 0x1400d960c
cmp byte [rcx + rdx], 0xbf
jg 0x1400d9612
jmp case.default.0x1400d8429
jne case.default.0x1400d8429
call fcn.14010e820
test bx, bx
je 0x1400d962f
mov ebx, eax
cmp bx, 1
jne 0x1400d9638
cmp si, dx
je 0x1400d9e6d
jmp 0x1400d9638
test ax, ax
je 0x1400d9e6d
movups xmm0, xmmword [0x1401721c0]
movaps xmmword [rsp + 0x440], xmm0
movups xmm0, xmmword [0x1401721b0]
movaps xmmword [rsp + 0x430], xmm0
mov rcx, rbp
lea rdi, [rsp + 0x200]
mov rdx, rdi
lea rsi, [rsp + 0x430]
mov r8, rsi
call fcn.140091c30
cmp byte [rsp + 0x90], 2
je 0x1400d969b
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0x88]
call qword [rax + 0x10]
movups xmm0, xmmword [0x1401721e0]
movaps xmmword [rsp + 0x440], xmm0
movdqu xmm0, xmmword [0x1401721d0]
movdqa xmmword [rsp + 0x430], xmm0
mov rcx, rbp
mov rdx, rdi
mov r8, rsi
call fcn.140091c30
cmp byte [rsp + 0x90], 2
je 0x1400d96f0
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0x88]
call qword [rax + 0x10]
lea rax, [0x1401718d8]
mov qword [rsp + 0x20], rax
mov r8d, 7
mov rcx, rbp
lea rdx, str.cookie2
mov r9, rsi
call fcn.140030c60
movzx r15d, byte [rsp + 0x80]
cmp r15d, 3
jne 0x1400d9730
lea rsi, [rsp + 0x430]
jmp 0x1400d9dc7
mov r9, qword [rsp + 0x238]
test r9, r9
lea r11, [0x1401718d8]
je 0x1400d9db2
mov r13, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
cmp dword [rsp + 0x200], 2
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x58], r13
jne 0x1400d9808
movdqu xmm0, xmmword [rsp + 0x208]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmm10
movdqa xmmword [rsp + 0x70], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmm11
movdqa xmmword [rsp + 0x80], xmm1
movdqa xmmword [rsp + 0x90], xmm0
lea rax, [rsp + 0x7a]
movaps xmmword [rax + 0x26], xmm7
mov qword [rax + 0x36], 0
xor eax, eax
cmp r15d, 2
setne al
mov qword [rsp + 0x3d0], rax
mov r8d, 8
lea rdi, [rsp + 0x70]
mov rcx, rdi
lea rbx, [rsp + 0x3d0]
mov rdx, rbx
call fcn.1400908d0
cmp r15d, 2
jne 0x1400d986e
movzx eax, r13b
mov qword [rsp + 0x3d0], rax
mov r8d, 8
mov rcx, rdi
mov rdx, rbx
jmp 0x1400d9880
xor ecx, ecx
cmp r15d, 2
setne cl
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs rbp, 0x1efac7090aef4a21
imul rcx, rbp
cmp r15d, 2
jne 0x1400d9a4d
movzx eax, r13b
xor ecx, eax
imul ebp, ecx
and ebp, 0x7fff
movzx esi, word [rsp + 0x258]
mov eax, ebp
and eax, esi
mov rbx, qword [rsp + 0x218]
mov r14, qword [rsp + 0x220]
mov r10, qword [rsp + 0x228]
jmp 0x1400d99cb
test r15d, r15d
je 0x1400d9a9a
mov rcx, rdi
mov rdx, r13
mov r8, rbp
call fcn.1400908d0
lea r14, [0x1401718d8]
mov rax, qword [rsp + 0x80]
mov r9, qword [rsp + 0xa0]
shl r9, 0x38
or r9, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x88]
mov r8, qword [rsp + 0x70]
add r8, rax
rol rax, 0xd
xor rcx, r9
xor rax, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x78]
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add r8, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rcx, r8
xor rax, rdx
rol rdx, 0x20
xor r8, r9
add r8, rax
rol rax, 0xd
xor rax, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add r8, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rax, rdx
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
xor rax, r8
rol r8, 0x20
add rdx, rcx
rol rcx, 0x10
xor rcx, rdx
add r8, rcx
rol rcx, 0x15
add rdx, rax
rol rax, 0x11
xor rax, rdx
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
xor rax, r8
add rdx, rcx
shl rcx, 0x10
xor rcx, rdx
shr rcx, 0x2b
add rdx, rax
shr rax, 0x2f
xor rax, rcx
mov rbp, rdx
shr rbp, 0x20
xor rbp, rdx
xor rbp, rax
mov r11, r14
mov r9, qword [rsp + 0x48]
and ebp, 0x7fff
movzx esi, word [rsp + 0x258]
mov eax, ebp
and eax, esi
mov rbx, qword [rsp + 0x218]
mov r14, qword [rsp + 0x220]
mov r10, qword [rsp + 0x228]
test r15d, r15d
je 0x1400d9ca4
cmp r15d, 2
jne 0x1400d9b42
xor ecx, ecx
jmp 0x1400d99e0
inc rcx
inc r15
mov rax, r15
nop dword [rax + rax]
mov r15, rax
mov eax, 0
cmp r15, r14
jae 0x1400d99e0
movzx r13d, word [rbx + r15*4]
cmp r13, 0xffff
je 0x1400d9db2
movzx eax, word [rbx + r15*4 + 2]
mov edx, esi
and edx, eax
mov r8d, r15d
sub r8d, edx
mov edx, esi
and edx, r8d
cmp rcx, rdx
ja 0x1400d9db2
cmp ax, bp
jne 0x1400d99cf
cmp r9, r13
jbe case.default.0x1400d8429
imul rax, r13, 0x68
cmp qword [r10 + rax + 0x40], 0
jne 0x1400d99cf
add rax, r10
add rax, 0x40
mov rdx, qword [rsp + 0x58]
cmp byte [rax + 8], dl
jne 0x1400d99cf
jmp 0x1400dabeb
mov r8, qword [rsp + 0x40]
lea rax, [r8 + r13]
test r15d, r15d
movabs r10, 0x100000001b3
je 0x1400d9ae0
test r8, r8
je 0x1400d9b16
and r8, 7
je 0x1400d9bf4
mov rdx, r13
nop dword [rax + rax]
movzx ebp, byte [rdx]
inc rdx
xor rbp, rcx
imul rbp, r10
mov rcx, rbp
dec r8
jne 0x1400d9a80
jmp 0x1400d9bfa
test rbp, rbp
lea r14, [0x1401718d8]
je 0x1400d988c
xor esi, esi
nop dword [rax]
movzx eax, byte [r13 + rsi]
movzx eax, byte [rax + r14]
mov byte [rsp + 0x3d0], al
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.1400908d0
inc rsi
cmp rbp, rsi
jne 0x1400d9ab0
jmp 0x1400d988c
test r8, r8
je 0x1400d9c78
mov rdx, r13
and r8, 3
je 0x1400daee2
movzx r9d, byte [rdx]
movzx ebp, byte [r9 + r11]
xor rbp, rcx
imul rbp, r10
inc rdx
mov rcx, rbp
dec r8
jne 0x1400d9af6
jmp 0x1400daee5
and ecx, 0x7fff
movzx esi, word [rsp + 0x258]
mov eax, ecx
and eax, esi
mov rbx, qword [rsp + 0x218]
mov r14, qword [rsp + 0x220]
mov r10, qword [rsp + 0x228]
mov ebp, ecx
xor edi, edi
mov qword [rsp + 0x1c0], r10
jmp 0x1400d9b60
inc rdi
inc r15
mov rax, r15
nop word [rax + rax]
mov r15, rax
mov eax, 0
cmp r15, r14
jae 0x1400d9b60
movzx r13d, word [rbx + r15*4]
cmp r13, 0xffff
je 0x1400d9db2
movzx eax, word [rbx + r15*4 + 2]
mov ecx, esi
and ecx, eax
mov edx, r15d
sub edx, ecx
mov ecx, esi
and ecx, edx
cmp rdi, rcx
ja 0x1400d9db2
cmp ax, bp
jne 0x1400d9b4e
cmp r9, r13
jbe case.default.0x1400d8429
imul rax, r13, 0x68
cmp qword [r10 + rax + 0x40], 0
je 0x1400d9b4e
add rax, r10
add rax, 0x40
mov rcx, qword [rsp + 0x40]
cmp qword [rax + 0x10], rcx
jne 0x1400d9b4e
mov rcx, qword [rax + 8]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x40]
call sub.msvcrt.dll_memcmp
mov r10, qword [rsp + 0x1c0]
mov r9, qword [rsp + 0x48]
test eax, eax
jne 0x1400d9b4e
jmp 0x1400dabeb
mov rbp, rcx
mov rdx, r13
cmp qword [rsp + 0x40], 8
jb 0x1400d998e
nop word cs:[rax + rax]
movzx ecx, byte [rdx]
xor rcx, rbp
imul rcx, r10
movzx r8d, byte [rdx + 1]
xor r8, rcx
imul r8, r10
movzx ecx, byte [rdx + 2]
xor rcx, r8
imul rcx, r10
movzx r8d, byte [rdx + 3]
xor r8, rcx
imul r8, r10
movzx ecx, byte [rdx + 4]
xor rcx, r8
imul rcx, r10
movzx r8d, byte [rdx + 5]
xor r8, rcx
imul r8, r10
movzx ecx, byte [rdx + 6]
xor rcx, r8
imul rcx, r10
movzx ebp, byte [rdx + 7]
add rdx, 8
xor rbp, rcx
imul rbp, r10
cmp rdx, rax
jne 0x1400d9c10
jmp 0x1400d998e
and ecx, 0x7fff
movzx esi, word [rsp + 0x258]
mov eax, ecx
and eax, esi
mov rbx, qword [rsp + 0x218]
mov r14, qword [rsp + 0x220]
mov r10, qword [rsp + 0x228]
mov ebp, ecx
mov rcx, qword [rsp + 0x40]
dec rcx
xor edx, edx
mov r15, rax
jmp 0x1400d9cc6
inc rdx
inc r15
mov rax, r15
nop dword [rax]
mov r15, rax
mov eax, 0
cmp r15, r14
jae 0x1400d9cd0
movzx r13d, word [rbx + r15*4]
cmp r13, 0xffff
je 0x1400d9db2
movzx eax, word [rbx + r15*4 + 2]
mov r8d, esi
and r8d, eax
mov r9d, r15d
sub r9d, r8d
mov r8d, esi
and r8d, r9d
mov r9, qword [rsp + 0x48]
cmp rdx, r8
ja 0x1400d9db2
cmp ax, bp
jne 0x1400d9cc0
cmp r9, r13
jbe case.default.0x1400d8429
imul rax, r13, 0x68
cmp qword [r10 + rax + 0x40], 0
je 0x1400d9cc0
add rax, r10
add rax, 0x40
mov r8, qword [rsp + 0x40]
cmp qword [rax + 0x10], r8
jne 0x1400d9cc0
cmp qword [rsp + 0x40], 0
je 0x1400dabeb
mov rax, qword [rax + 8]
mov r8, qword [rsp + 0x58]
movzx r8d, byte [r8]
movzx r8d, byte [r8 + r11]
cmp r8b, byte [rax]
jne 0x1400d9cc0
xor r8d, r8d
nop
cmp rcx, r8
je 0x1400dabe6
mov r9, qword [rsp + 0x58]
movzx r9d, byte [r9 + r8 + 1]
mov rdi, r10
movzx r10d, byte [r9 + r11]
lea r9, [r8 + 1]
cmp r10b, byte [rax + r8 + 1]
mov r10, rdi
mov r8, r9
je 0x1400d9d70
cmp r9, qword [rsp + 0x40]
mov r9, qword [rsp + 0x48]
jb 0x1400d9cc0
jmp 0x1400dabeb
lea rsi, [rsp + 0x430]
lea rbp, [rsp + 0x70]
lea rdi, [rsp + 0x200]
movups xmm0, xmmword [0x140172068]
movaps xmmword [rsp + 0x440], xmm0
movups xmm0, xmmword [0x140172058]
movaps xmmword [rsp + 0x430], xmm0
mov rcx, rbp
mov rdx, rdi
mov r8, rsi
call fcn.140091c30
cmp byte [rsp + 0x90], 2
je 0x1400d9e1a
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0x88]
call qword [rax + 0x10]
movups xmm0, xmmword [0x140172208]
movaps xmmword [rsp + 0x440], xmm0
movups xmm0, xmmword [0x1401721f8]
movaps xmmword [rsp + 0x430], xmm0
mov rcx, rbp
mov rdx, rdi
mov r8, rsi
call fcn.140091c30
cmp byte [rsp + 0x90], 2
je 0x1400d9e6d
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0x88]
call qword [rax + 0x10]
mov rdx, qword [r12 + 0x98]
mov r8, qword [r12 + 0xa8]
lea r15, [rsp + 0x430]
mov rcx, r15
call fcn.14000f0c0
mov rcx, rbp
mov rdx, r15
call fcn.14002ff50
cmp byte [rsp + 0x70], 3
je case.default.0x1400d8429
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x3c0], rax
movups xmm0, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x3b0], xmm0
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movups xmm2, xmmword [rsp + 0x90]
movups xmm3, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x3a0], xmm3
movaps xmmword [rsp + 0x390], xmm2
movaps xmmword [rsp + 0x380], xmm1
movaps xmmword [rsp + 0x370], xmm0
cmp qword [r12], 0
lea r14, [rsp + 0x7a]
je 0x1400d9f50
mov rax, qword [r12 + 8]
test rax, rax
je 0x1400d9f50
mov r8, qword [r12 + 0x10]
mov r9, qword [r12 + 0x18]
mov rcx, rbp
mov rdx, qword [rsp + 0x308]
call qword [rax]
movdqa xmm12, xmmword [rsp + 0x70]
mov r13, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
jmp 0x1400d9f5a
xor r13d, r13d
xor esi, esi
movdqa xmm12, xmm9
movaps xmmword [rsp + 0x3d0], xmm7
movaps xmmword [rsp + 0x310], xmm7
movaps xmmword [rsp + 0x180], xmm7
mov rax, qword [rsp + 0x198]
movzx eax, byte [rax]
lea rcx, [0x1401280fc]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
xor ebx, ebx
jmp 0x1400da060
movzx eax, byte [rsp + 0x74]
mov byte [rsp + 0x1b4], al
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x1b0], eax
mov rax, qword [rsp + 0x562]
mov rcx, qword [rsp + 0x568]
mov qword [rsp + 0x1e8], rax
mov qword [rsp + 0x1ee], rcx
movaps xmm0, xmmword [rsp + 0x3d0]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [rsp + 0x310]
movaps xmmword [rsp + 0x430], xmm0
mov eax, dword [rsp + 0x55c]
mov dword [rsp + 0x68], eax
movzx eax, word [rsp + 0x560]
mov word [rsp + 0x6c], ax
mov rax, qword [rsp + 0x570]
mov rcx, qword [rsp + 0x577]
mov qword [rsp + 0x2f7], rcx
mov qword [rsp + 0x2f0], rax
movaps xmm0, xmmword [rsp + 0x180]
movaps xmmword [rsp + 0x5f0], xmm0
movzx eax, word [rsp + 0x55a]
mov word [rsp + 0x64], ax
mov eax, dword [rsp + 0x556]
mov dword [rsp + 0x60], eax
movzx eax, byte [rsp + 0x1b4]
mov byte [rsp + 0x1bc], al
mov eax, dword [rsp + 0x1b0]
mov dword [rsp + 0x1b8], eax
mov eax, dword [rsp + 0x1f8]
mov ecx, dword [rsp + 0x1fb]
mov dword [rsp + 0x173], ecx
mov dword [rsp + 0x170], eax
mov rax, qword [rsp + 0x1e8]
mov rcx, qword [rsp + 0x1ee]
mov qword [rsp + 0x1de], rcx
mov qword [rsp + 0x1d8], rax
movaps xmm0, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x590], xmm0
movaps xmm0, xmmword [rsp + 0x430]
movaps xmmword [rsp + 0x520], xmm0
movzx eax, word [rsp + 0x6c]
mov word [rsp + 0x1d4], ax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x1d0], eax
mov rax, qword [rsp + 0x2f0]
mov rcx, qword [rsp + 0x2f7]
mov qword [rsp + 0x517], rcx
mov qword [rsp + 0x510], rax
movaps xmm0, xmmword [rsp + 0x5f0]
movaps xmmword [rsp + 0x580], xmm0
movzx eax, word [rsp + 0x64]
mov word [rsp + 0x1cc], ax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x1c8], eax
movzx eax, byte [rsp + 0x1bc]
mov byte [rsp + 0x1ac], al
mov eax, dword [rsp + 0x1b8]
mov dword [rsp + 0x1a8], eax
mov eax, dword [rsp + 0x170]
mov ecx, dword [rsp + 0x173]
mov dword [rsp + 0x1a3], ecx
mov dword [rsp + 0x1a0], eax
movzx eax, byte [rsp + 0x370]
test rax, rax
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x48], rsi
je 0x1400da24c
cmp eax, 1
jne 0x1400da250
mov dil, 1
movzx ebp, byte [rsp + 0x371]
jmp 0x1400da2c7
xor edi, edi
jmp 0x1400da2c7
mov rdi, qword [rsp + 0x378]
movzx eax, byte [0x1401a4170]
mov rax, qword [0x1401a4160]
test rax, rax
jne 0x1400da280
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je case.default.0x1400d8429
mov qword [0x1401a4160], rax
mov r8d, 0x20
mov rcx, rax
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je case.default.0x1400d8429
mov rsi, rax
lea rdx, [rdi + 0x18]
mov rax, qword [rdi]
mov r8, qword [rdi + 8]
mov r9, qword [rdi + 0x10]
mov rcx, rbp
call qword [rax]
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov dil, 2
mov rax, qword [rsp + 0x380]
mov r8, qword [rsp + 0x388]
mov r9, qword [rsp + 0x390]
lea rcx, [rsp + 0x320]
lea rdx, [rsp + 0x398]
call qword [rax]
mov rax, qword [rsp + 0x3a0]
mov r8, qword [rsp + 0x3a8]
mov r9, qword [rsp + 0x3b0]
lea rcx, [rsp + 0x340]
lea rdx, [rsp + 0x3b8]
call qword [rax]
movzx eax, word [rsp + 0x3c0]
mov byte [rsp + 0x310], dil
mov byte [rsp + 0x311], bpl
mov qword [rsp + 0x318], rsi
mov word [rsp + 0x360], ax
mov rax, qword [rsp + 0x360]
mov qword [rsp + 0x420], rax
movups xmm0, xmmword [rsp + 0x320]
movups xmm1, xmmword [rsp + 0x330]
movups xmm2, xmmword [rsp + 0x340]
movups xmm3, xmmword [rsp + 0x350]
movaps xmmword [rsp + 0x410], xmm3
movaps xmmword [rsp + 0x400], xmm2
movaps xmmword [rsp + 0x3f0], xmm1
movaps xmmword [rsp + 0x3e0], xmm0
movzx eax, byte [rsp + 0x310]
mov byte [rsp + 0x3d0], al
movzx eax, byte [rsp + 0x311]
mov byte [rsp + 0x3d1], al
mov eax, dword [rsp + 0x312]
mov dword [rsp + 0x3d2], eax
movzx eax, word [rsp + 0x316]
mov word [rsp + 0x3d6], ax
mov rax, qword [rsp + 0x318]
mov qword [rsp + 0x3d8], rax
mov qword [rsp + 0x70], 0
mov rax, qword [rsp + 0x1d8]
mov rcx, qword [rsp + 0x1de]
mov qword [r14 + 6], rcx
mov qword [r14], rax
mov qword [rsp + 0x88], 2
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 8
movaps xmm0, xmmword [rsp + 0x590]
movups xmmword [r14 + 0x26], xmm0
mov qword [rsp + 0xb0], 8
movaps xmm0, xmmword [rsp + 0x520]
movups xmmword [r14 + 0x3e], xmm0
mov word [rsp + 0xc8], 0
movzx eax, word [rsp + 0x1d4]
mov word [r14 + 0x54], ax
mov eax, dword [rsp + 0x1d0]
mov dword [r14 + 0x50], eax
mov byte [rsp + 0xd0], 0
mov rax, qword [rsp + 0x510]
mov rcx, qword [rsp + 0x517]
mov qword [r14 + 0x5e], rcx
mov qword [r14 + 0x57], rax
lea rcx, [0x14015f2f0]
mov qword [rsp + 0xe0], rcx
lea rax, str.combase.dll
mov qword [rsp + 0xe8], rax
movaps xmm0, xmmword [rsp + 0x580]
movups xmmword [r14 + 0x76], xmm0
mov qword [rsp + 0x100], rcx
lea rax, [0x1401709b6]
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], 1
mov qword [rsp + 0x118], 0
mov word [rsp + 0x120], 0xffff
movzx eax, word [rsp + 0x1cc]
mov word [r14 + 0xac], ax
mov eax, dword [rsp + 0x1c8]
mov dword [r14 + 0xa8], eax
mov byte [rsp + 0x128], bl
movzx eax, byte [rsp + 0x3f]
mov byte [rsp + 0x129], al
movzx eax, byte [rsp + 0x3e]
mov byte [rsp + 0x12a], al
movzx eax, byte [rsp + 0x1ac]
mov byte [r14 + 0xb5], al
mov eax, dword [rsp + 0x1a8]
mov dword [r14 + 0xb1], eax
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], 0
mov byte [rsp + 0x148], 2
mov eax, dword [rsp + 0x1a0]
mov ecx, dword [rsp + 0x1a3]
mov dword [r14 + 0xd2], ecx
mov dword [r14 + 0xcf], eax
mov rcx, r15
lea rdx, [rsp + 0x70]
lea r8, [rsp + 0x3d0]
call fcn.1400d7930
mov rdi, r14
mov r14, qword [rsp + 0x430]
mov rax, qword [rsp + 0x448]
mov qword [rsp + 0x5b0], rax
lea rcx, [rsp + 0x43a]
mov rax, qword [rcx]
mov rcx, qword [rcx + 6]
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x186], rcx
mov rbx, qword [rsp + 0x450]
mov rax, qword [rsp + 0x458]
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x460]
mov qword [rsp + 0x5c8], rax
mov r13, qword [rsp + 0x468]
mov rsi, qword [rsp + 0x470]
mov rax, qword [rsp + 0x478]
mov qword [rsp + 0x40], rax
mov r12, qword [rsp + 0x480]
mov r8d, 0x88
mov rbp, r15
lea r15, [rsp + 0x5f0]
mov rcx, r15
lea rdx, [rsp + 0x488]
call sub.msvcrt.dll_memcpy
movdqa xmmword [rsp + 0x3d0], xmm12
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x3e0], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x3e8], rax
cmp r14, 3
je 0x1400dbb60
mov rax, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x186]
mov qword [rsp + 0x310], rax
mov qword [rsp + 0x316], rcx
mov r8d, 0x88
lea r14, [rsp + 0x70]
mov rcx, r14
mov rdx, r15
call sub.msvcrt.dll_memcpy
movaps xmm0, xmmword [rsp + 0x3d0]
movdqa xmm1, xmmword [rsp + 0x3e0]
movups xmmword [rdi + 0x7e], xmm0
movdqu xmmword [rdi + 0x8e], xmm1
mov r8d, 0xa8
mov rcx, rbp
mov rdx, r14
mov rbp, r14
call sub.msvcrt.dll_memcpy
movzx edi, word [rsp + 0x258]
mov rcx, qword [rsp + 0x218]
mov rdx, qword [rsp + 0x220]
call fcn.1400c52b0
mov r14, rax
mov r15, rdx
mov rdx, qword [rsp + 0x228]
mov r8, qword [rsp + 0x238]
lea rcx, [rsp + 0x98]
call fcn.14008c5a0
mov rdx, qword [rsp + 0x240]
mov r8, qword [rsp + 0x250]
lea rcx, [rsp + 0xb0]
call fcn.14008c800
movdqa xmm0, xmmword [rsp + 0x200]
mov rax, qword [rsp + 0x210]
mov word [rsp + 0xc8], di
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r15
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rax
test rbx, rbx
mov rdi, rbp
je 0x1400da79d
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, qword [rsp + 0x5b0]
call sub.KERNEL32.dll_HeapFree
test r13, r13
lea r14, [rsp + 0x7a]
mov rbx, rsi
mov r15, qword [rsp + 0x1c0]
je 0x1400da800
lea rsi, [r15 + 0x30]
jmp 0x1400da7db
mov rax, qword [rsi - 0x18]
mov rdx, qword [rsi - 0x10]
mov r8, qword [rsi - 8]
mov rcx, rsi
call qword [rax + 0x10]
add rsi, 0x68
dec r13
je 0x1400da800
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1400da7c0
lea rcx, [rsi + 0x28]
mov rdx, qword [rsi + 0x18]
mov r8, qword [rsi + 0x20]
call qword [rax + 0x10]
jmp 0x1400da7c0
cmp qword [rsp + 0x5c8], 0
je 0x1400da81c
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
test r12, r12
mov r15, qword [rsp + 0x540]
lea r13, [rsp + 0x5f0]
je 0x1400da85b
lea rsi, [rbx + 0x38]
nop word cs:[rax + rax]
mov rax, qword [rsi - 0x18]
mov rdx, qword [rsi - 0x10]
mov r8, qword [rsi - 8]
mov rcx, rsi
call qword [rax + 0x10]
add rsi, 0x48
dec r12
jne 0x1400da840
cmp qword [rsp + 0x40], 0
je 0x1400da874
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [rsp + 0x70]
movzx edx, word [rsp + 0x78]
mov rax, qword [r14]
mov r8, qword [r14 + 6]
mov qword [rsp + 0x310], rax
mov qword [rsp + 0x316], r8
movdqu xmm0, xmmword [rsp + 0x88]
mov r8, qword [rsp + 0x98]
mov rax, qword [rsp + 0xb0]
mov r9, qword [rsp + 0xc8]
mov qword [rsp + 0x430], r9
movups xmm2, xmmword [rsp + 0xa0]
movdqu xmm1, xmmword [rsp + 0xb8]
movaps xmm3, xmmword [rsp + 0x200]
mov r12, qword [rsp + 0x50]
movups xmm4, xmmword [r12 + 0x28]
movups xmmword [r12 + 0x28], xmm3
movaps xmmword [rsp + 0x200], xmm4
movaps xmm3, xmmword [rsp + 0x210]
movups xmm4, xmmword [r12 + 0x38]
movups xmmword [r12 + 0x38], xmm3
movaps xmmword [rsp + 0x210], xmm4
movaps xmm3, xmmword [rsp + 0x220]
movups xmm4, xmmword [r12 + 0x48]
movups xmmword [r12 + 0x48], xmm3
movaps xmmword [rsp + 0x220], xmm4
movaps xmm3, xmmword [rsp + 0x230]
movups xmm4, xmmword [r12 + 0x58]
movups xmmword [r12 + 0x58], xmm3
movaps xmmword [rsp + 0x230], xmm4
movaps xmm3, xmmword [rsp + 0x240]
movups xmm4, xmmword [r12 + 0x68]
movups xmmword [r12 + 0x68], xmm3
movaps xmmword [rsp + 0x240], xmm4
movaps xmm3, xmmword [rsp + 0x250]
movups xmm4, xmmword [r12 + 0x78]
movups xmmword [r12 + 0x78], xmm3
movaps xmmword [rsp + 0x250], xmm4
mov rsi, qword [r12 + 0x110]
add rsi, 0x10
mov qword [rsp + 0x70], rcx
mov word [rsp + 0x78], dx
mov rcx, qword [rsp + 0x310]
mov rdx, qword [rsp + 0x316]
mov qword [r14 + 6], rdx
mov qword [r14], rcx
movdqu xmmword [rsp + 0x88], xmm0
mov qword [rsp + 0x98], r8
movups xmmword [rsp + 0xa0], xmm2
mov qword [rsp + 0xb0], rax
movdqu xmmword [rsp + 0xb8], xmm1
mov r8d, 0xa8
lea rcx, [rsp + 0xc8]
lea rdx, [rsp + 0x430]
call sub.msvcrt.dll_memcpy
mov rcx, rsi
mov rdx, rdi
call fcn.1400ae360
mov rsi, rax
mov rbx, rdx
mov rbp, qword [r12 + 0x118]
mov rdi, qword [r12 + 0x120]
mov rcx, rbp
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x1400daa37
cmp qword [rdi + 0x10], 0x11
jb 0x1400daa26
mov rbp, qword [rbp - 8]
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rbp
call sub.KERNEL32.dll_HeapFree
mov qword [r12 + 0x118], rsi
mov qword [r12 + 0x120], rbx
cmp byte [rsp + 0x370], 2
jb 0x1400daa7c
mov rsi, qword [rsp + 0x378]
lea rcx, [rsi + 0x18]
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
call qword [rax + 0x10]
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x380]
mov rdx, qword [rsp + 0x388]
mov r8, qword [rsp + 0x390]
lea rcx, [rsp + 0x398]
call qword [rax + 0x10]
mov rax, qword [rsp + 0x3a0]
mov rdx, qword [rsp + 0x3a8]
mov r8, qword [rsp + 0x3b0]
lea rcx, [rsp + 0x3b8]
call qword [rax + 0x10]
cmp qword [rsp + 0x220], 0
lea rbp, [rsp + 0x70]
je 0x1400daae8
mov r8, qword [rsp + 0x218]
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rsi, qword [rsp + 0x228]
mov rdi, qword [rsp + 0x238]
test rdi, rdi
je 0x1400dab50
lea rbx, [rsi + 0x30]
jmp 0x1400dab2b
mov rax, qword [rbx - 0x18]
mov rdx, qword [rbx - 0x10]
mov r8, qword [rbx - 8]
mov rcx, rbx
call qword [rax + 0x10]
add rbx, 0x68
dec rdi
je 0x1400dab50
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400dab10
lea rcx, [rbx + 0x28]
mov rdx, qword [rbx + 0x18]
mov r8, qword [rbx + 0x20]
call qword [rax + 0x10]
jmp 0x1400dab10
cmp qword [rsp + 0x230], 0
je 0x1400dab6c
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rsi, qword [rsp + 0x240]
mov rdi, qword [rsp + 0x250]
test rdi, rdi
je 0x1400dabab
lea rbx, [rsi + 0x38]
nop word cs:[rax + rax]
mov rax, qword [rbx - 0x18]
mov rdx, qword [rbx - 0x10]
mov r8, qword [rbx - 8]
mov rcx, rbx
call qword [rax + 0x10]
add rbx, 0x48
dec rdi
jne 0x1400dab90
cmp qword [rsp + 0x248], 0
je 0x1400dabc7
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
lea rcx, [rsp + 0x690]
call fcn.14006e270
lea rcx, [rsp + 0x700]
call fcn.1400d2940
jmp 0x1400d7d31
mov r9, qword [rsp + 0x48]
cmp r13, r9
lea rbp, [rsp + 0x70]
jae case.default.0x1400d8429
imul rsi, r13, 0x68
cmp qword [r10 + rsi], 0
je 0x1400dac20
add r10, rsi
mov rdx, qword [r10 + 8]
lea rcx, [rsp + 0x200]
call fcn.140038b00
mov r14, qword [rsp + 0x220]
cmp r14, r15
jbe case.default.0x1400d8429
mov rax, qword [rsp + 0x218]
mov dword [rax + r15*4], 0xffff
mov rcx, qword [rsp + 0x238]
cmp rcx, r13
jbe case.default.0x1400d8429
mov r8, qword [rsp + 0x228]
lea rdx, [r8 + rsi]
movups xmm0, xmmword [r8 + rsi]
movups xmm1, xmmword [r8 + rsi + 0x10]
movups xmm2, xmmword [r8 + rsi + 0x20]
movups xmm3, xmmword [r8 + rsi + 0x30]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x90], xmm2
movaps xmmword [rsp + 0xa0], xmm3
movups xmm0, xmmword [r8 + rsi + 0x40]
movaps xmmword [rsp + 0xb0], xmm0
movups xmm0, xmmword [r8 + rsi + 0x50]
movaps xmmword [rsp + 0xc0], xmm0
mov r9, qword [r8 + rsi + 0x60]
mov qword [rsp + 0xd0], r9
dec rcx
imul r9, rcx, 0x68
mov r10, qword [r8 + r9 + 0x60]
movdqu xmm0, xmmword [r8 + r9 + 0x50]
movdqu xmm1, xmmword [r8 + r9 + 0x40]
movups xmm2, xmmword [r8 + r9]
movups xmm3, xmmword [r8 + r9 + 0x10]
movups xmm4, xmmword [r8 + r9 + 0x20]
movups xmm5, xmmword [r8 + r9 + 0x30]
movups xmmword [r8 + rsi], xmm2
movups xmmword [r8 + rsi + 0x10], xmm3
movups xmmword [r8 + rsi + 0x20], xmm4
movups xmmword [r8 + rsi + 0x30], xmm5
movdqu xmmword [r8 + rsi + 0x40], xmm1
movdqu xmmword [r8 + rsi + 0x50], xmm0
mov qword [r8 + rsi + 0x60], r10
mov qword [rsp + 0x238], rcx
cmp rcx, r13
mov r9d, 0
cmovbe rdx, r9
jbe 0x1400dadd3
movzx r8d, word [r8 + rsi + 0x60]
movzx r9d, word [rsp + 0x258]
and r9w, r8w
movzx r11d, r9w
jmp 0x1400dad50
inc r10
mov r11, r10
nop dword [rax + rax]
mov r10, r11
mov r11d, 0
cmp r10, r14
jae 0x1400dad50
movzx r11d, word [rax + r10*4]
cmp r11, 0xffff
cmovne r9, r11
je 0x1400dad42
cmp r9, rcx
jb 0x1400dad42
mov word [rax + r10*4], r13w
mov word [rax + r10*4 + 2], r8w
cmp qword [rdx], 0
je 0x1400dadd3
mov r10, qword [rdx + 8]
mov r8, qword [rsp + 0x250]
cmp r10, r8
jae case.default.0x1400d8429
mov r9, qword [rdx + 0x10]
mov rdx, qword [rsp + 0x240]
lea r10, [r10 + r10*8]
mov qword [rdx + r10*8], 0
mov qword [rdx + r10*8 + 8], r13
cmp r9, r8
jae case.default.0x1400d8429
lea r8, [r9 + r9*8]
mov qword [rdx + r8*8 + 0x10], 0
mov qword [rdx + r8*8 + 0x18], r13
test rcx, rcx
je 0x1400dae45
lea r8, [r15 + 1]
movzx ecx, word [rsp + 0x258]
nop word cs:[rax + rax]
mov rdx, r8
mov r8d, 0
cmp rdx, r14
jae 0x1400dadf0
movzx r8d, word [rax + rdx*4]
cmp r8w, 0xffff
je 0x1400dae45
movzx r9d, word [rax + rdx*4 + 2]
mov r10d, ecx
and r10d, r9d
mov r11d, edx
sub r11d, r10d
test r11d, ecx
je 0x1400dae45
cmp r15, r14
jae case.default.0x1400d8429
mov word [rax + r15*4], r8w
mov word [rax + r15*4 + 2], r9w
mov dword [rax + rdx*4], 0xffff
lea r8, [rdx + 1]
mov r15, rdx
jmp 0x1400dadf0
lea rcx, [rsp + 0x88]
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x610], rax
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqa xmmword [rsp + 0x600], xmm1
movdqa xmmword [rsp + 0x5f0], xmm0
mov rax, qword [rsp + 0xb0]
test rax, rax
je 0x1400dae9c
mov rdx, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xc0]
lea rcx, [rsp + 0xc8]
call qword [rax + 0x10]
cmp byte [rsp + 0x610], 2
lea rsi, [rsp + 0x430]
lea rdi, [rsp + 0x200]
je 0x1400d9dc7
mov rax, qword [rsp + 0x5f0]
mov rdx, qword [rsp + 0x5f8]
mov r8, qword [rsp + 0x600]
lea rcx, [rsp + 0x608]
call qword [rax + 0x10]
jmp 0x1400d9dc7
mov rbp, rcx
cmp qword [rsp + 0x40], 4
mov r9, qword [rsp + 0x48]
jb 0x1400d998e
movzx ecx, byte [rdx]
movzx ecx, byte [rcx + r11]
xor rcx, rbp
imul rcx, r10
movzx r8d, byte [rdx + 1]
movzx r8d, byte [r8 + r11]
xor r8, rcx
imul r8, r10
movzx ecx, byte [rdx + 2]
movzx ecx, byte [rcx + r11]
xor rcx, r8
imul rcx, r10
movzx r8d, byte [rdx + 3]
movzx ebp, byte [r8 + r11]
xor rbp, rcx
imul rbp, r10
add rdx, 4
cmp rdx, rax
jne 0x1400daef6
jmp 0x1400d998e
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400daf70
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je case.default.0x1400d8429
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x70
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je case.default.0x1400d8429
mov rbx, rax
mov dword [rax], 2
mov qword [rax + 0x58], 1
lea rax, [0x140171438]
mov qword [rbx + 0x60], rax
mov word [rbx + 0x68], 1
mov r15, qword [r12 + 0x98]
mov rsi, qword [r12 + 0xa8]
test rsi, rsi
je 0x1400db095
js case.default.0x1400d8429
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400daff2
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je case.default.0x1400d8429
mov rcx, rax
mov qword [0x1401a4160], rax
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapAlloc
mov r14, rax
test rax, rax
jne 0x1400db09b
jmp case.default.0x1400d8429
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0xc0], rax
movups xmm0, xmmword [rsp + 0x2d0]
movaps xmmword [rsp + 0xb0], xmm0
movups xmm0, xmmword [rsp + 0x290]
movdqu xmm1, xmmword [rsp + 0x2a0]
movups xmm2, xmmword [rsp + 0x2b0]
movups xmm3, xmmword [rsp + 0x2c0]
movaps xmmword [rsp + 0xa0], xmm3
movaps xmmword [rsp + 0x90], xmm2
movdqa xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x70]
call fcn.1400c9910
jmp 0x1400db98a
test r14, r14
je 0x1400db411
mov rcx, qword [0x1401a4160]
xor edx, edx
mov r8, rbx
jmp 0x1400db40c
mov r14d, 1
mov rcx, r14
mov rdx, r15
mov r8, rsi
call sub.msvcrt.dll_memcpy
movdqu xmm6, xmmword [r12 + 0xb4]
movups xmm0, xmmword [r12 + 0xc8]
movzx eax, byte [r12 + 0xd8]
mov byte [rsp + 0x80], al
movaps xmmword [rsp + 0x70], xmm0
movzx edx, word [r12 + 0xb0]
movzx r15d, word [r12 + 0xb2]
mov ecx, dword [r12 + 0xc4]
mov rax, r12
mov r12d, dword [r12 + 0x88]
mov r13d, dword [rax + 0x8c]
mov edi, dword [rax + 0x90]
mov ebp, dword [rax + 0x94]
cmp dword [rbx], 2
je 0x1400db139
cmp qword [rbx + 0x18], 0
je 0x1400db139
mov r8, qword [rbx + 0x10]
mov dword [rsp + 0x30], ecx
mov rcx, qword [0x1401a4160]
mov word [rsp + 0x50], dx
xor edx, edx
call sub.KERNEL32.dll_HeapFree
movzx edx, word [rsp + 0x50]
mov ecx, dword [rsp + 0x30]
mov dword [rbx], r12d
mov dword [rbx + 4], r13d
mov dword [rbx + 8], edi
mov dword [rbx + 0xc], ebp
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x20], rsi
mov word [rbx + 0x28], dx
mov word [rbx + 0x2a], r15w
jmp 0x1400db39c
mov rax, qword [rsp + 0x178]
mov qword [rax], 4
jmp 0x1400db9b7
test rbx, rbx
je 0x1400db719
js case.default.0x1400d8429
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400db1ae
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je case.default.0x1400d8429
mov rcx, rax
mov qword [0x1401a4160], rax
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapAlloc
mov rdi, rax
test rax, rax
jne 0x1400db71e
jmp case.default.0x1400d8429
lea rcx, [rsp + 0x370]
call fcn.14006ff50
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400db201
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je case.default.0x1400d8429
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 8
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je case.default.0x1400d8429
mov rsi, rax
mov qword [rax], rdi
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400db248
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je case.default.0x1400d8429
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x70
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je case.default.0x1400d8429
mov rbx, rax
mov dword [rax], 2
mov qword [rax + 0x58], rsi
lea rax, fcn.1400c1060
mov qword [rbx + 0x60], rax
mov word [rbx + 0x68], 1
mov r14, qword [r12 + 0x98]
mov rsi, qword [r12 + 0xa8]
test rsi, rsi
je 0x1400db2d9
js case.default.0x1400d8429
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400db2c2
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je case.default.0x1400d8429
mov rcx, rax
mov qword [0x1401a4160], rax
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapAlloc
mov r15, rax
test rax, rax
jne 0x1400db2df
jmp case.default.0x1400d8429
mov r15d, 1
mov rcx, r15
mov rdx, r14
mov r8, rsi
call sub.msvcrt.dll_memcpy
movdqu xmm6, xmmword [r12 + 0xb4]
mov rcx, qword [rsp + 0x190]
movzx eax, byte [rcx + 0x10]
mov byte [rsp + 0x80], al
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x70], xmm0
movzx edx, word [r12 + 0xb0]
movzx r14d, word [r12 + 0xb2]
mov ecx, dword [r12 + 0xc4]
mov rax, r12
mov r12d, dword [r12 + 0x88]
mov r13d, dword [rax + 0x8c]
mov edi, dword [rax + 0x90]
mov ebp, dword [rax + 0x94]
cmp dword [rbx], 2
je 0x1400db37a
cmp qword [rbx + 0x18], 0
je 0x1400db37a
mov r8, qword [rbx + 0x10]
mov dword [rsp + 0x30], ecx
mov rcx, qword [0x1401a4160]
mov word [rsp + 0x50], dx
xor edx, edx
call sub.KERNEL32.dll_HeapFree
movzx edx, word [rsp + 0x50]
mov ecx, dword [rsp + 0x30]
mov dword [rbx], r12d
mov dword [rbx + 4], r13d
mov dword [rbx + 8], edi
mov dword [rbx + 0xc], ebp
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x20], rsi
mov word [rbx + 0x28], dx
mov word [rbx + 0x2a], r14w
movdqu xmmword [rbx + 0x2c], xmm6
mov dword [rbx + 0x3c], ecx
movdqa xmm0, xmmword [rsp + 0x70]
movdqu xmmword [rbx + 0x40], xmm0
movzx eax, byte [rsp + 0x80]
mov byte [rbx + 0x50], al
mov eax, dword [rsp + 0x430]
mov ecx, dword [rsp + 0x433]
mov dword [rbx + 0x51], eax
mov dword [rbx + 0x54], ecx
mov rax, qword [rsp + 0x178]
mov qword [rax], 3
mov qword [rax + 8], rbx
jmp 0x1400db9b7
cmp rax, 1
jne 0x1400db6ab
cmp qword [rsp + 0x2a8], 0
je 0x1400db411
mov r8, qword [rsp + 0x2a0]
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x690]
mov r8d, 0xa0
call sub.msvcrt.dll_memcpy
mov rsi, qword [r12 + 0x98]
mov rbx, qword [r12 + 0xa8]
test rbx, rbx
je 0x1400db486
js case.default.0x1400d8429
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400db46f
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je case.default.0x1400d8429
mov rcx, rax
mov qword [0x1401a4160], rax
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapAlloc
mov r14, rax
test rax, rax
jne 0x1400db48c
jmp case.default.0x1400d8429
mov r14d, 1
mov rcx, r14
mov rdx, rsi
mov r8, rbx
call sub.msvcrt.dll_memcpy
movups xmm6, xmmword [r12 + 0xb4]
mov rax, qword [rsp + 0x190]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x430], xmm0
movzx eax, byte [rax + 0x10]
mov byte [rsp + 0x440], al
movzx eax, word [r12 + 0xb0]
mov word [rsp + 0x198], ax
mov rax, r12
movzx r12d, word [r12 + 0xb2]
mov ecx, dword [rax + 0xc4]
mov dword [rsp + 0x50], ecx
mov r13d, dword [rax + 0x88]
mov edi, dword [rax + 0x8c]
mov ebp, dword [rax + 0x90]
mov r15d, dword [rax + 0x94]
mov rcx, qword [rax + 0x130]
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x130], 0
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400db544
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je case.default.0x1400d8429
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x30
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je case.default.0x1400d8429
mov rsi, rax
movups xmm0, xmmword [rsp + 0xe0]
movups xmm1, xmmword [rsp + 0xf0]
movups xmm2, xmmword [rsp + 0x100]
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400db5ab
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je case.default.0x1400d8429
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x58
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je case.default.0x1400d8429
mov dword [rax], r13d
mov dword [rax + 4], edi
mov dword [rax + 8], ebp
mov dword [rax + 0xc], r15d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbx
movzx ecx, word [rsp + 0x198]
mov word [rax + 0x28], cx
mov word [rax + 0x2a], r12w
movups xmmword [rax + 0x2c], xmm6
mov ecx, dword [rsp + 0x50]
mov dword [rax + 0x3c], ecx
movzx ecx, byte [rsp + 0x440]
mov byte [rax + 0x50], cl
movaps xmm0, xmmword [rsp + 0x430]
movups xmmword [rax + 0x40], xmm0
mov ecx, dword [rsp + 0x5f0]
mov edx, dword [rsp + 0x5f3]
mov dword [rax + 0x54], edx
mov dword [rax + 0x51], ecx
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movups xmm2, xmmword [rsp + 0x90]
movups xmm3, xmmword [rsp + 0xa0]
mov rdx, qword [rsp + 0x178]
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm2
movups xmmword [rdx + 0x30], xmm3
movups xmm0, xmmword [rsp + 0xb0]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rsp + 0xd0]
movups xmmword [rdx + 0x60], xmm0
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rdx + 0x50], xmm0
mov qword [rdx + 0x70], 0
mov qword [rdx + 0x78], rsi
lea rcx, [0x140171f58]
mov qword [rdx + 0x80], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rdx + 0x88], rcx
mov qword [rdx + 0x90], rax
jmp 0x1400db9b7
movdqu xmm6, xmmword [rsp + 0x438]
mov r14, qword [r12 + 0x98]
mov rbx, qword [r12 + 0xa8]
test rbx, rbx
je 0x1400dba08
js case.default.0x1400d8429
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400db6fe
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je case.default.0x1400d8429
mov rcx, rax
mov qword [0x1401a4160], rax
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapAlloc
mov rsi, rax
test rax, rax
jne 0x1400dba0d
jmp case.default.0x1400d8429
mov edi, 1
mov rcx, rdi
mov rdx, rbp
mov r8, rbx
call sub.msvcrt.dll_memcpy
movdqu xmm6, xmmword [rsp + 0x2bc]
movups xmm0, xmmword [rsp + 0x2d0]
movaps xmmword [rsp + 0x70], xmm0
movzx eax, byte [rsp + 0x2e0]
mov byte [rsp + 0x80], al
movzx eax, word [rsp + 0x2b8]
mov word [rsp + 0x50], ax
movzx r15d, word [rsp + 0x2ba]
mov eax, dword [rsp + 0x2cc]
mov dword [rsp + 0x30], eax
mov r12d, dword [rsp + 0x290]
mov r13d, dword [rsp + 0x294]
mov ebp, dword [rsp + 0x298]
mov r14d, dword [rsp + 0x29c]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400db7bc
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je case.default.0x1400d8429
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x70
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je case.default.0x1400d8429
mov rsi, rax
mov qword [rax + 0x58], 1
lea rax, [0x140171528]
mov qword [rsi + 0x60], rax
mov word [rsi + 0x68], 0
mov dword [rsi], r12d
mov dword [rsi + 4], r13d
mov dword [rsi + 8], ebp
mov dword [rsi + 0xc], r14d
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], rbx
mov qword [rsi + 0x20], rbx
movzx eax, word [rsp + 0x50]
mov word [rsi + 0x28], ax
mov word [rsi + 0x2a], r15w
movdqu xmmword [rsi + 0x2c], xmm6
mov eax, dword [rsp + 0x30]
mov dword [rsi + 0x3c], eax
movzx eax, byte [rsp + 0x80]
mov byte [rsi + 0x50], al
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rsi + 0x40], xmm0
mov eax, dword [rsp + 0x430]
mov ecx, dword [rsp + 0x433]
mov dword [rsi + 0x54], ecx
mov dword [rsi + 0x51], eax
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0xc0], rax
movups xmm0, xmmword [rsp + 0x2d0]
movaps xmmword [rsp + 0xb0], xmm0
movups xmm0, xmmword [rsp + 0x290]
movups xmm1, xmmword [rsp + 0x2a0]
movups xmm2, xmmword [rsp + 0x2b0]
movups xmm3, xmmword [rsp + 0x2c0]
movaps xmmword [rsp + 0xa0], xmm3
movaps xmmword [rsp + 0x90], xmm2
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x70], xmm0
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400db8d2
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je case.default.0x1400d8429
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 8
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je case.default.0x1400d8429
mov rdi, rax
mov qword [rax], rsi
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400db919
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je case.default.0x1400d8429
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x70
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je case.default.0x1400d8429
mov qword [rax + 0x58], rdi
lea rcx, [0x140171000]
mov qword [rax + 0x60], rcx
mov word [rax + 0x68], 2
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmm1, xmmword [rsp + 0x80]
movaps xmm2, xmmword [rsp + 0x90]
movaps xmm3, xmmword [rsp + 0xa0]
movups xmmword [rax], xmm0
movdqu xmmword [rax + 0x10], xmm1
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x30], xmm3
movaps xmm0, xmmword [rsp + 0xb0]
movups xmmword [rax + 0x40], xmm0
mov rcx, qword [rsp + 0xc0]
mov qword [rax + 0x50], rcx
mov rcx, qword [rsp + 0x178]
mov qword [rcx], 3
mov qword [rcx + 8], rax
lea rcx, [rsp + 0x690]
call fcn.14006e270
lea rcx, [rsp + 0x700]
call fcn.1400d2940
movaps xmm6, xmmword [rsp + 0x730]
movaps xmm7, xmmword [rsp + 0x740]
movaps xmm8, xmmword [rsp + 0x750]
movaps xmm9, xmmword [rsp + 0x760]
movaps xmm10, xmmword [rsp + 0x770]
movaps xmm11, xmmword [rsp + 0x780]
movaps xmm12, xmmword [rsp + 0x790]
add rsp, 0x7a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov esi, 1
mov rcx, rsi
mov rdx, r14
mov r8, rbx
call sub.msvcrt.dll_memcpy
movups xmm7, xmmword [r12 + 0xb4]
mov rax, qword [rsp + 0x190]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x70], xmm0
movzx eax, byte [rax + 0x10]
mov byte [rsp + 0x80], al
movzx ebp, word [r12 + 0xb0]
movzx r14d, word [r12 + 0xb2]
mov eax, dword [r12 + 0xc4]
mov dword [rsp + 0x30], eax
mov r15d, dword [r12 + 0x88]
mov rax, r12
mov r12d, dword [r12 + 0x8c]
mov r13d, dword [rax + 0x90]
mov edi, dword [rax + 0x94]
movzx eax, byte [0x1401a4170]
mov rcx, qword [0x1401a4160]
test rcx, rcx
jne 0x1400dbaa8
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je case.default.0x1400d8429
mov rcx, rax
mov qword [0x1401a4160], rax
mov r8d, 0x70
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je case.default.0x1400d8429
movdqu xmmword [rax + 0x58], xmm6
mov word [rax + 0x68], 2
mov dword [rax], r15d
mov dword [rax + 4], r12d
mov dword [rax + 8], r13d
mov dword [rax + 0xc], edi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbx
mov word [rax + 0x28], bp
mov word [rax + 0x2a], r14w
movups xmmword [rax + 0x2c], xmm7
mov ecx, dword [rsp + 0x30]
mov dword [rax + 0x3c], ecx
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rax + 0x40], xmm0
movzx ecx, byte [rsp + 0x80]
mov byte [rax + 0x50], cl
mov ecx, dword [rsp + 0x430]
mov edx, dword [rsp + 0x433]
mov dword [rax + 0x51], ecx
mov dword [rax + 0x54], edx
mov rcx, qword [rsp + 0x178]
mov qword [rcx], 3
mov qword [rcx + 8], rax
cmp qword [rsp + 0x2a8], 0
je 0x1400db99d
mov r8, qword [rsp + 0x2a0]
mov rcx, qword [0x1401a4160]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x1400db99d
ud2
lea rcx, [rsp + 0x3d0]
call fcn.14006ff50
ud2