Function at 0x14000dbf0
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov eax, dword [0x141dc07b8]
xor edx, edx
div dword [0x141dc07bc]
nop word cs:[rax + rax]
mov eax, dword [0x141dc07c0]
or eax, dword [0x141dc07c4]
imul rax, rax, 0x537ff255
shr rax, 0x3c
or eax, 0x2869ac56
cmp eax, 0xefd6439d
je 0x14000dc20
mov rax, qword [rsi]
nop word cs:[rax + rax]
mov ecx, dword [0x141dc07c8]
imul ecx, dword [0x141dc07cc]
imul ecx, ecx, 0x206ee4a
add ecx, 0xa59db9c6
or ecx, 0x729bfbd8
cmp ecx, 0xba0ffd48
ja 0x14000dc50
test rax, rax
je 0x14000dcc0
nop dword [rax]
mov eax, dword [0x141dc07d0]
add eax, dword [0x141dc07d4]
xor eax, 0xf04e07a8
imul eax, eax, 0xe7ce7f4f
xor eax, 0x1bf98ccb
cmp eax, 0x5a08376
jb 0x14000dc80
mov r8, qword [rsi + 8]
mov rcx, qword [0x141ddb260]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov eax, dword [0x141dc07d8]
add eax, dword [0x141dc07dc]
xor eax, 0x81e1f6e2
add eax, 0x2df85954
or eax, 0x240ccba3
cmp eax, 0xd51b8510
ja 0x14000dcc0
mov rdi, qword [rsi + 0x28]
mov qword [rsp + 0x38], rsi
mov rsi, qword [rsi + 0x30]
test rsi, rsi
je 0x14000dd56
xor ebx, ebx
mov r14, qword [sym.imp.KERNEL32.dll_HeapFree]
xor r15d, r15d
jmp 0x14000dd10
inc r15
cmp r15, rsi
je 0x14000dd56
nop word [rax + rax]
mov eax, dword [0x141dc07e0]
add eax, dword [0x141dc07e4]
cmp eax, 0xd86cd3e0
je 0x14000dd10
lea rax, [r15 + r15*4]
cmp qword [rdi + rax*8 + 8], 0
je 0x14000dd02
lea rax, [rdi + rax*8]
nop word cs:[rax + rax]
test bl, bl
jne 0x14000dd40
mov r8, qword [rax + 0x10]
mov rcx, qword [0x141ddb260]
xor edx, edx
call r14
jmp 0x14000dd02
xor eax, eax
mov rsi, qword [rsp + 0x38]
nop dword [rax]
test al, al
jne 0x14000dd60
mov rax, qword [rsi + 0x20]
nop dword [rax + rax]
mov ecx, dword [0x141dc07e8]
and ecx, dword [0x141dc07ec]
and ecx, 0xa44264cd
imul ecx, ecx, 0x34c2de76
cmp ecx, 0x1f38fe0f
jb 0x14000dd70
test rax, rax
je 0x14000de1d
mov eax, dword [0x141dc07f0]
imul eax, dword [0x141dc07f4]
and eax, 0x1521e118
xor eax, 0x3faa9578
cmp eax, 0x91c05735
ja 0x14000dde1
mov eax, dword [0x141dc07f8]
xor eax, dword [0x141dc07fc]
and eax, 0xdee6edc2
imul eax, eax, 0xb573824a
and eax, 0x8f1d80f8
mov rcx, qword [0x141ddb260]
cmp eax, 0x6b986ff4
jbe 0x14000ddea
mov rax, qword [0x141ddb260]
jmp 0x14000ddb7
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov eax, dword [0x141dc0800]
and eax, dword [0x141dc0804]
add eax, 0xaefab68d
or eax, 0xd155a7
cmp eax, 0xab55ab33
je 0x14000de00
mov rdi, qword [rsi + 0x88]
mov ecx, 0x83cfd2d3
nop dword [rax]
mov eax, dword [0x141dc0808]
xor edx, edx
div dword [0x141dc080c]
imul eax, eax, 0x82f7c81c
mov rdx, rax
imul rdx, rcx
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1d
cmp eax, 0xb42e5a73
je 0x14000de30
test rdi, rdi
je 0x14000e820
xor eax, eax
nop word [rax + rax]
test al, al
jne 0x14000de70
mov r12, qword [rsi + 0x98]
nop dword [rax + rax]
mov eax, dword [0x141dc0810]
sub eax, dword [0x141dc0814]
imul eax, eax, 0xd9d6e08c
add eax, 0xb5dabe0d
cmp eax, 0xd52d8a54
jb 0x14000de80
mov rbp, qword [rsi + 0x90]
test r12, r12
je 0x14000e5f0
xor r13d, r13d
mov ecx, 0xd8bbf003
mov rsi, qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, rdi
xor edi, edi
jmp 0x14000dee8
mov ebx, 0
test r12, r12
mov ecx, 0xd8bbf003
mov rbp, qword [rsp + 0x28]
je 0x14000e740
mov eax, dword [0x141dc0838]
or eax, dword [0x141dc083c]
imul rax, rcx
shr rax, 0x3f
imul eax, eax, 0xdfa8c525
cmp eax, 0xc0dd4d57
je 0x14000dee8
test rdi, rdi
je 0x14000df23
movzx eax, word [rdi + 0x3d2]
cmp rbp, rax
jae 0x14000e210
jmp 0x14000e08d
mov r8d, 0xc39f286d
nop dword [rax]
mov eax, dword [0x141dc0840]
sub eax, dword [0x141dc0844]
and eax, 0x22931449
add eax, 0x7275ec3e
cmp eax, 0xb742de00
ja 0x14000df30
nop dword [rax]
mov eax, dword [0x141dc0848]
xor eax, dword [0x141dc084c]
xor eax, 0x840c0002
or eax, 0x1502080
and eax, 0xc57e2093
cmp eax, 0x33344f4d
jb 0x14000df50
test rbp, rbp
je 0x14000dfce
mov rax, rbp
mov rcx, rbp
and rax, 7
je 0x14000dfd6
and rcx, 0xfffffffffffffff8
nop word [rax + rax]
mov edx, dword [0x141dc0850]
xor edx, dword [0x141dc0854]
add edx, 0x521483bc
imul rdx, r8
shr rdx, 0x3f
cmp edx, 0x222ca743
ja 0x14000df90
mov rdi, rbx
nop word cs:[rax + rax]
mov rdi, qword [rdi + 0x3d8]
dec rax
jne 0x14000dfc0
jmp 0x14000dfe0
mov rdi, rbx
jmp 0x14000e079
mov rdi, rbx
nop dword [rax]
mov eax, dword [0x141dc0858]
xor edx, edx
div dword [0x141dc085c]
add eax, 0xe44fda75
xor eax, 0x91362122
cmp eax, 0x25105184
jb 0x14000dfe0
cmp rbp, 8
jb 0x14000e079
nop word cs:[rax + rax]
mov eax, dword [0x141dc0860]
or eax, dword [0x141dc0864]
and eax, 0xe8bc6a24
shr eax, 2
imul rax, rax, 0x175d72b1
shr rax, 0x37
xor eax, 0x56c9764
cmp eax, 0xaa8065f7
ja 0x14000e010
mov rax, qword [rdi + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rdi, qword [rax + 0x3d8]
add rcx, 0xfffffffffffffff8
jne 0x14000e010
xor ebp, ebp
xor ebx, ebx
movzx eax, word [rdi + 0x3d2]
cmp rbp, rax
jae 0x14000e210
mov r15, rdi
dec r12
nop word cs:[rax + rax]
mov eax, dword [0x141dc0888]
imul eax, dword [0x141dc088c]
or eax, 0xa99636
and eax, 0x32f99e3f
cmp eax, 0x81cd2183
je 0x14000e0a0
test rbx, rbx
je 0x14000e2da
nop word [rax + rax]
mov eax, dword [0x141dc0890]
xor edx, edx
div dword [0x141dc0894]
xor eax, 0xa887c17a
imul eax, eax, 0xa218a781
cmp eax, 0x2dbc447a
je 0x14000e0d0
mov rax, rbx
mov rdi, qword [r15 + rbp*8 + 0x3e0]
dec rax
je 0x14000e1ee
nop word cs:[rax + rax]
mov ecx, dword [0x141dc0898]
add ecx, dword [0x141dc089c]
or ecx, 0x9a246543
imul ecx, ecx, 0xb33db25c
cmp ecx, 0x8c36a3e3
je 0x14000e110
lea rcx, [rbx - 2]
nop word cs:[rax + rax]
test r13b, r13b
jne 0x14000e140
mov edx, eax
and edx, 7
nop word [rax + rax]
mov r8d, dword [0x141dc08a0]
add r8d, dword [0x141dc08a4]
or r8d, 0x7d8181ad
and r8d, 0x7d8ba9ad
cmp r8d, 0x2be1aa80
jb 0x14000e150
test rdx, rdx
je 0x14000e1a5
lea eax, [rbx - 1]
movzx eax, al
and eax, 7
nop word cs:[rax + rax]
mov rdi, qword [rdi + 0x3d8]
dec rax
jne 0x14000e190
not rdx
add rbx, rdx
mov rax, rbx
cmp rcx, 7
jb 0x14000e1ee
nop dword [rax + rax]
mov rcx, qword [rdi + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rdi, qword [rcx + 0x3d8]
add rax, 0xfffffffffffffff8
jne 0x14000e1b0
xor eax, eax
mov qword [rsp + 0x28], rax
jmp 0x14000e2e6
mov rdi, r15
cmp bp, word [r15 + 0x3d2]
jb 0x14000e090
nop dword [rax + rax]
mov eax, dword [0x141dc0880]
add eax, dword [0x141dc0884]
imul rax, rax, 0x6ac3291f
shr rax, 0x3e
imul eax, eax, 0xccec4785
cmp eax, 0xe9ae6552
je 0x14000e210
mov r15, qword [rdi + 0x160]
test r15, r15
je 0x14000f3a0
mov eax, dword [0x141dc08a8]
xor eax, dword [0x141dc08ac]
and eax, 0x6b112787
add eax, 0xb6cf3867
and eax, 0x5dbf2d25
cmp eax, 0xaf75ac5e
ja 0x14000e244
inc rbx
movzx ebp, word [rdi + 0x3d0]
mov eax, dword [0x141dc08b0]
and eax, dword [0x141dc08b4]
xor eax, 0xf1e56928
imul eax, eax, 0x761a2fe8
add eax, 0x19a685a6
cmp eax, 0x9f04c821
jb 0x14000e2ca
mov r14d, dword [0x141dc08b8]
sub r14d, dword [0x141dc08bc]
add r14d, 0x7443ccff
or r14d, 0xb8886cab
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rdi
call rsi
cmp r14d, 0x6ec75946
jae 0x14000e1fa
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rdi
call rsi
jmp 0x14000e293
lea rax, [rbp + 1]
mov qword [rsp + 0x28], rax
mov rdi, r15
mov qword [rsp + 0x40], r12
mov eax, dword [0x141dc08d0]
xor edx, edx
div dword [0x141dc08d4]
test r13b, r13b
jne 0x14000e2f9
imul rax, rbp, 0x38
lea rcx, [r15 + rax]
add rcx, 0x168
mov qword [rsp + 0x30], rcx
cmp qword [r15 + rax + 0x168], 0
je 0x14000e3f0
mov rax, qword [rsp + 0x30]
mov rbx, qword [rax + 8]
mov eax, dword [0x141dc08d8]
imul eax, dword [0x141dc08dc]
imul rax, rax, 0x549ae8ff
shr rax, 0x3e
imul eax, eax, 0x3881d3e5
cmp eax, 0x16aed86d
je 0x14000e374
nop
mov eax, dword [0x141dc08e0]
or eax, dword [0x141dc08e4]
or eax, 0x7c7aba84
add eax, 0x144fa036
mov r14, qword [0x141ddb260]
cmp eax, 0xdaf150c0
jbe 0x14000e380
mov rax, qword [0x141ddb260]
jmp 0x14000e350
mov eax, dword [0x141dc08e8]
add eax, dword [0x141dc08ec]
imul rax, rax, 0xc3785e5
shr rax, 0x3b
xor eax, 0x7c37c543
add eax, 0x195f69ad
cmp eax, 0x1f8aec9e
jae 0x14000e3b2
mov rcx, r14
xor edx, edx
mov r8, rbx
call rsi
mov r12d, 0xcc56a1d1
nop dword [rax + rax]
mov r13d, dword [0x141dc08f0]
or r13d, dword [0x141dc08f4]
imul r13, r12
shr r13, 0x3c
or r13d, 0x4d038430
mov rcx, r14
xor edx, edx
mov r8, rbx
call rsi
cmp r13d, 0x60f4dfd5
je 0x14000e3c0
xor r13d, r13d
test r13b, r13b
jne 0x14000e3f3
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x20], 0
je 0x14000e4f3
mov eax, dword [0x141dc08f8]
or eax, dword [0x141dc08fc]
imul eax, eax, 0xc00f2c07
mov ecx, 0xbd32bb0f
imul rax, rcx
shr rax, 0x3f
imul eax, eax, 0xcfb5cd60
cmp eax, 0x89167cce
jb 0x14000e408
mov rax, qword [rsp + 0x30]
mov rbx, qword [rax + 0x28]
mov eax, dword [0x141dc0900]
and eax, dword [0x141dc0904]
add eax, 0xec0221bc
imul rax, rax, 0x4cfbc355
shr rax, 0x3e
imul eax, eax, 0x5e639660
cmp eax, 0x27e12a11
jb 0x14000e4d0
nop word cs:[rax + rax]
mov eax, dword [0x141dc0908]
sub eax, dword [0x141dc090c]
xor eax, 0x62010029
and eax, 0xe6f9222b
add eax, 0x746173ff
mov r14, qword [0x141ddb260]
cmp eax, 0x31950dbd
ja 0x14000e4d0
mov eax, dword [0x141dc0910]
xor edx, edx
div dword [0x141dc0914]
imul eax, eax, 0xa04e44f1
or eax, 0x88827703
and eax, 0x9dca7703
cmp eax, 0x691ad01a
jae 0x14000e4e0
jmp 0x14000e5e0
mov rax, qword [0x141ddb260]
jmp 0x14000e470
mov rcx, r14
xor edx, edx
mov r8, rbx
call rsi
test r13b, r13b
jne 0x14000e5e0
shl rbp, 5
add r15, rbp
mov r12, qword [rsp + 0x40]
nop
mov eax, dword [0x141dc0918]
sub eax, dword [0x141dc091c]
imul eax, eax, 0xd80c210d
xor eax, 0x51990288
and eax, 0x53d99a8b
cmp eax, 0xe8998098
je 0x14000e500
mov rax, qword [r15]
nop word cs:[rax + rax]
mov ecx, dword [0x141dc0920]
sub ecx, dword [0x141dc0924]
add ecx, 0xb3ada06b
and ecx, 0x1df1fac2
cmp ecx, 0xd9699e4c
je 0x14000e530
shl rax, 1
test rax, rax
je 0x14000ded0
mov rbx, qword [r15 + 8]
mov r14, qword [0x141ddb260]
mov eax, dword [0x141dc0928]
and eax, dword [0x141dc092c]
xor eax, 0x10ca
or eax, 0xaaefaf35
mov ecx, 0xd1e7767d
imul rax, rcx
shr rax, 0x3e
cmp eax, 0x3906c77c
jbe 0x14000e5a0
mov rcx, r14
xor edx, edx
mov r8, rbx
call rsi
nop dword [rax + rax]
mov ebp, dword [0x141dc0930]
xor ebp, dword [0x141dc0934]
and ebp, 0x2fcea912
xor ebp, 0x967d95f4
add ebp, 0x85198515
mov rcx, r14
xor edx, edx
mov r8, rbx
call rsi
cmp ebp, 0xc189e6f7
ja 0x14000e5a0
jmp 0x14000ded0
mov rcx, r14
xor edx, edx
mov r8, rbx
call rsi
jmp 0x14000e4e0
mov eax, dword [0x141dc0818]
xor eax, dword [0x141dc081c]
or eax, 0xa847a372
imul rax, rax, 0x743b8581
shr rax, 0x3d
or eax, 0x64e798ac
cmp eax, 0xf83823cf
ja 0x14000e5f0
test rbp, rbp
je 0x14000e740
mov eax, 0x9c7b7b21
nop word cs:[rax + rax]
mov ecx, dword [0x141dc0820]
sub ecx, dword [0x141dc0824]
xor ecx, 0xff95e58e
imul rcx, rax
shr rcx, 0x3d
xor ecx, 0xc1cd093
cmp ecx, 0x616cdd2e
ja 0x14000e630
nop dword [rax + rax]
mov eax, dword [0x141dc0828]
imul eax, dword [0x141dc082c]
or eax, 0x2038557f
add eax, 0x3d3922ad
and eax, 0x26cab8a4
cmp eax, 0xb1bae56b
ja 0x14000e660
mov rax, rbp
test bpl, 7
je 0x14000e6ec
and rax, 0xfffffffffffffff8
xor ecx, ecx
nop word cs:[rax + rax]
test cl, cl
jne 0x14000e6a0
mov ecx, ebp
and ecx, 7
xor edx, edx
nop dword [rax + rax]
mov r8d, dword [0x141dc0830]
imul r8d, dword [0x141dc0834]
or r8d, 0x30241e08
and r8d, 0xb6acfe2a
add r8d, 0x16a7002f
cmp r8d, 0x609f555d
ja 0x14000e6b0
mov rdi, qword [rdi + 0x3d8]
inc rdx
dec rcx
jne 0x14000e6b0
cmp rbp, 8
jb 0x14000e740
nop word cs:[rax + rax]
mov rcx, qword [rdi + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rcx, qword [rcx + 0x3d8]
mov rdi, qword [rcx + 0x3d8]
add rax, 0xfffffffffffffff8
jne 0x14000e700
nop
mov eax, dword [0x141dc0868]
and eax, dword [0x141dc086c]
add eax, 0x85a74086
xor eax, 0x48940f2a
cmp eax, 0xcc882d44
ja 0x14000e740
mov rax, qword [rdi + 0x160]
test rax, rax
je 0x14000e7ff
mov rsi, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov rbx, rax
mov eax, dword [0x141dc0870]
xor eax, dword [0x141dc0874]
imul rax, rax, 0xeb2b801
shr rax, 0x3b
xor eax, 0x2a508b17
cmp eax, 0x7ecabd27
jbe 0x14000e7c0
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rdi
call rsi
nop word cs:[rax + rax]
mov eax, dword [0x141dc0878]
xor eax, dword [0x141dc087c]
imul ebp, eax, 0xf5a6c39f
and ebp, 0x32804
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rdi
call rsi
cmp ebp, 0xb264ee71
ja 0x14000e7c0
mov rax, qword [rbx + 0x160]
mov rdi, rbx
test rax, rax
jne 0x14000e780
jmp 0x14000e802
mov rbx, rdi
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x38]
nop dword [rax]
mov eax, dword [0x141dc0938]
xor edx, edx
div dword [0x141dc093c]
imul eax, eax, 0x93e69db9
imul rax, rax, 0x6da0d937
shr rax, 0x3e
add eax, 0xaea0739d
cmp eax, 0x700d83d9
jb 0x14000e820
mov rax, qword [rsi + 0x38]
shl rax, 1
test rax, rax
je 0x14000e8a0
nop word [rax + rax]
mov eax, dword [0x141dc0940]
xor edx, edx
div dword [0x141dc0944]
or eax, 0x841a6030
and eax, 0xa67e7c35
cmp eax, 0xda2facef
je 0x14000e860
mov r8, qword [rsi + 0x40]
mov rcx, qword [0x141ddb260]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov eax, dword [0x141dc0948]
xor edx, edx
div dword [0x141dc094c]
and eax, 0x2646902a
imul rax, rax, 0x10c44101
shr rax, 0x36
cmp eax, 0x34a73ff6
je 0x14000e8a0
mov eax, dword [rsi + 0x58]
cmp eax, 4
jb 0x14000e910
cmp eax, 6
je 0x14000e910
nop word cs:[rax + rax]
mov eax, dword [0x141dc0950]
and eax, dword [0x141dc0954]
imul eax, eax, 0xbbdf3999
xor eax, 0x3a7b600c
cmp eax, 0x4017f7d0
jb 0x14000e8e0
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov eax, dword [0x141dc0958]
xor edx, edx
div dword [0x141dc095c]
add eax, 0x122f88e0
xor eax, 0x90048500
and eax, 0x9845c555
cmp eax, 0x4115c7fa
jb 0x14000e910
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x14000e940
mov ecx, dword [rsi + 0x68]
mov r8d, 0xc1c1e2fd
nop dword [rax]
mov eax, dword [0x141dc0960]
xor edx, edx
div dword [0x141dc0964]
imul rax, r8
shr rax, 0x3d
imul eax, eax, 0x8d4d4556
imul rax, rax, 0x2a476ec3
shr rax, 0x3c
cmp eax, 0xf9c655ba
ja 0x14000e950
cmp ecx, 4
jb 0x14000e9d0
cmp ecx, 6
je 0x14000e9d0
mov rcx, qword [rsi + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word cs:[rax + rax]
mov eax, dword [0x141dc0968]
and eax, dword [0x141dc096c]
or eax, 0x3b354237
xor eax, 0xc7e79b6d
imul eax, eax, 0x13541d71
cmp eax, 0xa8568e50
je 0x14000e9a0
nop word cs:[rax + rax]
mov eax, dword [0x141dc0970]
imul eax, dword [0x141dc0974]
add eax, 0xfbe3bb06
xor eax, 0x9a033114
or eax, 0x45d48e29
cmp eax, 0xd4790c0a
je 0x14000e9d0
mov eax, dword [rsi + 0x78]
mov ecx, 0x99720327
nop dword [rax + rax]
mov edx, dword [0x141dc0978]
imul edx, dword [0x141dc097c]
imul rdx, rcx
shr rdx, 0x3d
add edx, 0xb913da39
or edx, 0x523b9dd4
cmp edx, 0x7e9e0404
jb 0x14000ea00
cmp eax, 4
jb 0x14000eac0
cmp eax, 6
je 0x14000eac0
nop dword [rax + rax]
mov eax, dword [0x141dc0980]
mov ecx, dword [0x141dc0984]
add eax, ecx
add eax, 0x975f7ba2
imul rcx, rax, 0x1c138b4b
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
or eax, 0xc41a119d
cmp eax, 0x7f549d83
je 0x14000ea40
mov eax, 0xc014eec1
nop dword [rax + rax]
mov ecx, dword [0x141dc0988]
add ecx, dword [0x141dc098c]
and ecx, 0xf6dd2429
imul rcx, rax
shr rcx, 0x3e
or ecx, 0x99b0a3bc
cmp ecx, 0x704a3135
jb 0x14000ea80
mov rcx, qword [rsi + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word cs:[rax + rax]
mov eax, dword [0x141dc0990]
imul eax, dword [0x141dc0994]
xor eax, 0x4c000415
or eax, 0xb369faa2
imul eax, eax, 0x4cd443fe
cmp eax, 0xe9fcd854
jb 0x14000eac0
mov rdi, qword [rsi + 0xa8]
mov eax, 0x85914739
mov ecx, 0xa31e8c51
nop word cs:[rax + rax]
mov edx, dword [0x141dc0998]
or edx, dword [0x141dc099c]
imul rdx, rax
shr rdx, 0x3e
add edx, 0xe9b69f21
imul rdx, rcx
shr rdx, 0x3f
cmp edx, 0xa2949261
je 0x14000eb00
nop word [rax + rax]
mov eax, dword [0x141dc09a0]
xor eax, dword [0x141dc09a4]
and eax, 0x71388ce
imul eax, eax, 0xabb3895d
cmp eax, 0x336b165d
je 0x14000eb30
test rdi, rdi
je 0x14000f380
mov eax, dword [0x141dc09a8]
xor edx, edx
div dword [0x141dc09ac]
nop word cs:[rax + rax]
mov eax, dword [0x141dc09b0]
xor edx, edx
div dword [0x141dc09b4]
and eax, 0x20889be4
imul rax, rax, 0x44ed8ba9
shr rax, 0x3b
imul eax, eax, 0xe9e4f74a
cmp eax, 0x11193a77
je 0x14000eb70
mov r15, qword [rsi + 0xb8]
mov rbp, qword [rsi + 0xb0]
mov ecx, 0xae55748b
nop
mov eax, dword [0x141dc09b8]
xor edx, edx
div dword [0x141dc09bc]
or eax, 0x74ff6af
imul rax, rcx
shr rax, 0x3e
imul eax, eax, 0x38ae38ba
cmp eax, 0xfe581490
ja 0x14000ebb0
test r15, r15
je 0x14000f1f0
nop word cs:[rax + rax]
mov eax, dword [0x141dc09c0]
xor edx, edx
div dword [0x141dc09c4]
or eax, 0x6e7af249
cmp eax, 0x71ff857d
je 0x14000ebf0
xor ebx, ebx
mov r13d, 0x9f7cf81f
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, rdi
xor edi, edi
nop
test rdi, rdi
je 0x14000ec40
movzx eax, word [rdi + 0x16a]
cmp rbp, rax
jae 0x14000eda0
mov rbx, rbp
mov r14, rdi
jmp 0x14000ee47
mov ecx, 0xedf70c95
mov edx, 0xd12fcaab
nop word [rax + rax]
mov eax, dword [0x141dc09e8]
xor eax, dword [0x141dc09ec]
xor eax, 0xad16bba
add eax, 0x370f53ae
imul rax, rcx
shr rax, 0x3e
cmp eax, 0xd9c33935
ja 0x14000ec50
nop word cs:[rax + rax]
mov eax, dword [0x141dc09f0]
xor eax, dword [0x141dc09f4]
imul rax, rdx
shr rax, 0x3f
add eax, 0x8e90e671
and eax, 0x84802262
cmp eax, 0x54ca41eb
jb 0x14000ec80
test rbp, rbp
je 0x14000ed24
mov eax, dword [0x141dc09f8]
xor edx, edx
div dword [0x141dc09fc]
nop dword [rax + rax]
test bl, bl
jne 0x14000ecc0
nop word cs:[rax + rax]
mov eax, dword [0x141dc0a00]
xor edx, edx
div dword [0x141dc0a04]
and eax, 0x10c29248
add eax, 0x9223b528
cmp eax, 0x8abe00aa
jb 0x14000ecd0
mov rax, rbp
test bpl, 7
je 0x14000ed29
and rax, 0xfffffffffffffff8
mov ecx, ebp
and ecx, 7
mov rdi, rsi
nop word cs:[rax + rax]
mov rdi, qword [rdi + 0x170]
dec rcx
jne 0x14000ed10
cmp rbp, 8
jae 0x14000ed40
jmp 0x14000ed7e
mov rdi, rsi
jmp 0x14000ed7e
mov rdi, rsi
cmp rbp, 8
jb 0x14000ed7e
nop word cs:[rax + rax]
mov rcx, qword [rdi + 0x170]
mov rcx, qword [rcx + 0x170]
mov rcx, qword [rcx + 0x170]
mov rcx, qword [rcx + 0x170]
mov rcx, qword [rcx + 0x170]
mov rcx, qword [rcx + 0x170]
mov rcx, qword [rcx + 0x170]
mov rdi, qword [rcx + 0x170]
add rax, 0xfffffffffffffff8
jne 0x14000ed40
xor ebp, ebp
xor esi, esi
movzx eax, word [rdi + 0x16a]
cmp rbp, rax
jb 0x14000ec35
nop word cs:[rax + rax]
mov r14, qword [rdi]
test r14, r14
je 0x14000f391
mov eax, dword [0x141dc0a58]
imul eax, dword [0x141dc0a5c]
or eax, 0xffbf7fee
add eax, 0xf716a223
cmp eax, 0xc6fcc51a
jae 0x14000edd1
mov rax, qword [0x141ddb260]
inc rsi
nop word cs:[rax + rax]
mov eax, dword [0x141dc0a60]
and eax, dword [0x141dc0a64]
xor eax, 0x2e9dade6
imul eax, eax, 0x8b3e9327
movzx ebx, word [rdi + 0x168]
mov rcx, qword [0x141ddb260]
cmp eax, 0xd7dca08b
je 0x14000ede0
xor edx, edx
mov r8, rdi
call r12
mov rdi, r14
cmp bx, word [r14 + 0x16a]
jae 0x14000eda0
mov eax, dword [0x141dc0a28]
and eax, dword [0x141dc0a2c]
add eax, 0xfa53f5ac
or eax, 0xe84b4643
xor eax, 0x9160f487
cmp eax, 0x8a286c93
ja 0x14000ee25
dec r15
mov eax, dword [0x141dc0a30]
sub eax, dword [0x141dc0a34]
and eax, 0x79aee320
imul eax, eax, 0x6d9e6b9c
xor eax, 0xbe2dce0a
cmp eax, 0x34361f47
jb 0x14000ee4a
test rsi, rsi
je 0x14000efc0
mov rdi, qword [r14 + rbx*8 + 0x178]
mov rcx, rsi
dec rcx
je 0x14000efae
nop word [rax + rax]
mov eax, dword [0x141dc0a38]
xor edx, edx
div dword [0x141dc0a3c]
imul eax, eax, 0xccb0bf38
shr eax, 3
imul rax, rax, 0x13521775
shr rax, 0x37
cmp eax, 0x1f141452
je 0x14000ee90
lea r8, [rsi - 2]
mov eax, ecx
and eax, 7
nop word cs:[rax + rax]
mov edx, dword [0x141dc0a40]
sub edx, dword [0x141dc0a44]
and edx, 0x3e561490
add edx, 0x6013ea39
xor edx, 0xcdc7b108
cmp edx, 0xe0976c4a
ja 0x14000eed0
test rax, rax
je 0x14000ef40
xor ecx, ecx
nop dword [rax]
mov edx, dword [0x141dc0a48]
add edx, dword [0x141dc0a4c]
imul edx, edx, 0x9e9fd908
and edx, 0x7f3d0b40
imul edx, edx, 0xf3ceb7ef
cmp edx, 0x25731d1f
je 0x14000ef00
inc rcx
mov rdi, qword [rdi + 0x170]
cmp rcx, rax
jne 0x14000ef00
not rax
add rsi, rax
mov rcx, rsi
nop
mov eax, dword [0x141dc0a50]
xor edx, edx
div dword [0x141dc0a54]
add eax, 0x2e3998df
or eax, 0x5ff39fdf
cmp eax, 0xdbed14ea
ja 0x14000ef40
cmp r8, 7
jb 0x14000efae
nop word cs:[rax + rax]
mov rax, qword [rdi + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rdi, qword [rax + 0x170]
add rcx, 0xfffffffffffffff8
jne 0x14000ef70
xor eax, eax
xor ebp, ebp
jmp 0x14000efc9
xor eax, eax
lea rbp, [rbx + 1]
mov rdi, r14
mov r12, r15
test al, al
jne 0x14000efcc
lea rax, [rbx + rbx*2]
mov rsi, qword [r14 + rax*8 + 0x60]
mov rbx, qword [r14 + rax*8 + 0x68]
mov r14, qword [rbx]
test r14, r14
je 0x14000f037
mov eax, dword [0x141dc0a68]
imul eax, dword [0x141dc0a6c]
imul eax, eax, 0xc48ef0c4
add eax, 0x920d7628
cmp eax, 0x935f826a
jbe 0x14000f010
mov rcx, rsi
call r14
nop dword [rax + rax]
mov eax, dword [0x141dc0a70]
and eax, dword [0x141dc0a74]
or eax, 0xbbda57dd
imul r15d, eax, 0x67f4c203
mov rcx, rsi
call r14
cmp r15d, 0x62e8e257
je 0x14000f010
mov rcx, qword [rbx + 8]
mov r15, r12
nop
mov eax, dword [0x141dc0a78]
and eax, dword [0x141dc0a7c]
imul eax, eax, 0x965c8873
or eax, 0xdef7ede7
cmp eax, 0x113b04f4
jb 0x14000f040
mov rax, qword [rbx + 0x10]
xor ebx, ebx
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov edx, dword [0x141dc0a80]
sub edx, dword [0x141dc0a84]
add edx, 0x9d05b36d
imul rdx, r13
shr rdx, 0x3f
imul edx, edx, 0x66d9486c
cmp edx, 0x14452732
ja 0x14000f070
test rcx, rcx
je 0x14000f114
mov ecx, dword [0x141dc0a88]
and ecx, dword [0x141dc0a8c]
xor ecx, 0x50034258
or ecx, 0xadfcbd07
add ecx, 0xe5e6345e
cmp ecx, 0x6d85e873
jb 0x14000f09d
nop word cs:[rax + rax]
mov ecx, dword [0x141dc0a90]
xor ecx, dword [0x141dc0a94]
add ecx, 0xc431e410
and ecx, 0x4400088
cmp ecx, 0xf95a47e3
ja 0x14000f0d0
cmp rax, 0x11
jae 0x14000f100
mov r8, rsi
jmp 0x14000f108
mov r8, qword [rsi - 8]
test bl, bl
jne 0x14000f100
mov rcx, qword [0x141ddb260]
xor edx, edx
call r12
mov eax, dword [0x141dc0a98]
xor eax, dword [0x141dc0a9c]
imul eax, eax, 0x6f0a3f4d
add eax, 0x36ea2ada
cmp eax, 0x7c6afe49
jb 0x14000f114
mov esi, 0
test r15, r15
jne 0x14000ec20
mov rax, qword [rdi]
test rax, rax
je 0x14000f303
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14000f16f
mov rax, qword [rsi]
mov rdi, rsi
test rax, rax
je 0x14000f306
mov rsi, rax
mov eax, dword [0x141dc0a08]
mov ecx, dword [0x141dc0a0c]
add eax, ecx
add eax, 0x8f89a6e2
and eax, 0x60ab4e68
xor eax, 0x5bd076ee
cmp eax, 0x76f53ca0
ja 0x14000f1d8
nop word cs:[rax + rax]
mov eax, dword [0x141dc0a10]
xor eax, dword [0x141dc0a14]
and eax, 0x23fe0616
add eax, 0xca586159
imul r14, rax, 0x59976c37
shr r14, 0x3d
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rdi
call rbx
cmp r14d, 0x980b53d8
jbe 0x14000f160
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rdi
call rbx
jmp 0x14000f1a0
mov eax, dword [0x141dc09c8]
or eax, dword [0x141dc09cc]
or eax, 0x13254442
and eax, 0x536565e3
add eax, 0x6f96b6ae
cmp eax, 0xb5534b80
jb 0x14000f1f0
test rbp, rbp
je 0x14000f140
mov eax, ebp
and eax, 7
mov ecx, dword [0x141dc09d0]
sub ecx, dword [0x141dc09d4]
cmp ecx, 0x74192af2
je 0x14000f220
mov rcx, rbp
test rax, rax
je 0x14000f263
and rcx, 0xfffffffffffffff8
xor edx, edx
xor r8d, r8d
nop word cs:[rax + rax]
test dl, dl
jne 0x14000f250
mov rdi, qword [rdi + 0x170]
inc r8
dec rax
jne 0x14000f250
mov eax, dword [0x141dc09d8]
xor edx, edx
div dword [0x141dc09dc]
nop word cs:[rax + rax]
mov eax, dword [0x141dc09e0]
or eax, dword [0x141dc09e4]
add eax, 0x6228fa64
imul rax, rax, 0x5b5e9155
shr rax, 0x3e
add eax, 0x45eb2585
cmp eax, 0x4d30660e
ja 0x14000f280
cmp rbp, 8
jb 0x14000f140
nop word cs:[rax + rax]
mov rax, qword [rdi + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rax, qword [rax + 0x170]
mov rdi, qword [rax + 0x170]
add rcx, 0xfffffffffffffff8
jne 0x14000f2c0
jmp 0x14000f140
mov rsi, rdi
mov eax, dword [0x141dc0a18]
xor edx, edx
div dword [0x141dc0a1c]
add eax, 0xa6a1d188
mov ecx, 0xcfa85265
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xd585ce3e
jne 0x14000f340
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, 0xe0a76ac3
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov r14d, dword [0x141dc0a20]
and r14d, dword [0x141dc0a24]
shr r14d, 1
imul r14, rdi
shr r14, 0x3c
mov rcx, qword [0x141ddb260]
xor edx, edx
mov r8, rsi
call rbx
cmp r14d, 0x641c7b0f
je 0x14000f350
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edx, 8
mov rcx, rdi
call fcn.140038140
ud2
mov eax, dword [0x141dc08c0]
imul eax, dword [0x141dc08c4]
or eax, 0xa3f14250
xor eax, 0x20a73c78
imul eax, eax, 0xc4a7e7c1
cmp eax, 0xa90c0880
jne 0x14000f3e0
mov edx, 8
mov rcx, rdi
call fcn.140038140
ud2
mov esi, dword [0x141dc08c8]
imul esi, dword [0x141dc08cc]
add esi, 0x93278846
imul rax, rsi, 0x9cf1bc9
shr rax, 0x20
sub esi, eax
shr esi, 1
add esi, eax
shr esi, 0x1f
mov edx, 8
mov rcx, rdi
call fcn.140038140
ud2