Function at 0x140025060
Capabilities:
Check for debugger via api
Check for process debug object
Check for time delay via queryperformancecounter
Check processdebugflags
Check processdebugport
Create process on windows
Encode data using base64
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x188
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xf0], xmm6
mov eax, dword [0x141dc0440]
xor edx, edx
div dword [0x141dc0444]
cmp eax, 0x7990f511
jne 0x140025130
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov eax, 0x70
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
nop word [rax + rax]
mov ecx, dword [0x141dc0448]
and ecx, dword [0x141dc044c]
add ecx, 0x9343cb0b
or ecx, 0xd0ed440a
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov rdx, rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov r8, rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov r10, rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov r11, rsp
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov rsi, rsp
mov eax, 0x70
call fcn.1400ed360
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov rbx, rsp
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov r14, rsp
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov r15, rsp
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov rax, rsp
cmp ecx, 0x41d07b83
jb 0x140025130
mov qword [rbp + 0x68], rax
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x78], rbx
mov qword [rbp + 0x88], rdi
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xb8], r11
mov qword [rbp + 0x90], r10
mov qword [rbp + 0x28], r9
mov qword [rbp + 0x70], r8
mov qword [rbp + 0x30], rdx
xor eax, eax
test al, al
jne 0x140025521
mov ebx, dword [str.GD_C_]
xor ebx, dword [0x141dc0454]
or ebx, 0x7dccc215
xor ebx, 0xa2621cde
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov qword [rbp + 0x98], rsp
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov qword [rbp + 0xc8], rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov rdx, rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov rcx, rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov r12, rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov qword [rbp + 0x50], rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov qword [rbp - 0x40], rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov qword [rbp - 0x38], rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov qword [rbp - 0x30], rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov qword [rbp - 0x70], rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov qword [rbp - 0x68], rsp
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov qword [rbp - 0x78], rsp
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov qword [rbp - 0x60], rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov qword [rbp - 0x58], rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov qword [rbp - 0x50], rsp
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov qword [rbp - 0x48], rsp
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov qword [rbp + 0x80], rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov qword [rbp - 0x20], rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov qword [rbp - 0x18], rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov qword [rbp + 0x48], rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov qword [rbp + 0x38], rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov qword [rbp - 0x28], rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov qword [rbp + 0xd8], rsp
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov qword [rbp + 0x58], rsp
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov qword [rbp + 0xe0], rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov qword [rbp + 0xb0], rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov qword [rbp + 0xa8], rsp
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov qword [rbp + 0xd0], rsp
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov qword [rbp - 0x10], rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov qword [rbp - 8], rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov qword [rbp], rsp
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov qword [rbp + 8], rsp
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov qword [rbp + 0x40], rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov rsi, rsp
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov r13, rsp
mov qword [r12], 0
mov qword [rbp + 0xe8], rcx
mov dword [rcx], 0
mov r15, rdx
mov dword [rdx], 0
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 8
mov r14, r12
mov r8, r12
call sub.ADVAPI32.dll_OpenProcessToken
add rsp, 0x20
cmp ebx, 0xdaebccb9
jbe 0x140025733
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov rcx, rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov rdx, rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x20
call fcn.1400ed360
sub rsp, rax
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x10
call fcn.1400ed360
sub rsp, rax
mov eax, 0x30
call fcn.1400ed360
sub rsp, rax
mov qword [rdi], 0
mov dword [rdx], 0
mov dword [rcx], 0
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 8
mov r8, rdi
call sub.ADVAPI32.dll_OpenProcessToken
add rsp, 0x20
jmp 0x140025249
mov rdx, r14
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x10], r13
test eax, eax
mov r14, qword [rbp + 0xc8]
mov rsi, qword [rbp + 0xe8]
mov r12, qword [rbp + 0xd0]
mov r13, qword [rbp + 0xd8]
je 0x140025975
mov eax, dword [0x141dc0458]
or eax, dword [0x141dc045c]
or eax, 0xb0530671
add eax, 0x43d84430
cmp eax, 0x2244b0bc
mov rdi, r15
mov r15, rdx
jae 0x1400257b0
mov rcx, qword [r15]
sub rsp, 0x30
mov qword [rsp + 0x20], rdi
mov edx, 0x14
mov r8, rsi
mov r9d, 4
call sub.ADVAPI32.dll_GetTokenInformation
add rsp, 0x30
nop dword [rax]
mov ebx, dword [0x141dc0460]
xor ebx, dword [0x141dc0464]
and ebx, 0x29f11441
add ebx, 0x79ee172a
and ebx, 0x51bb1563
mov rcx, qword [r15]
sub rsp, 0x30
mov qword [rsp + 0x20], rdi
mov edx, 0x14
mov r8, rsi
mov r9d, 4
call sub.ADVAPI32.dll_GetTokenInformation
add rsp, 0x30
cmp ebx, 0x8c48e6b2
ja 0x1400257b0
test eax, eax
je 0x140025975
mov eax, dword [0x141dc0468]
xor edx, edx
div dword [0x141dc046c]
mov rbx, qword [rbp + 0x80]
mov rdi, qword [rbp + 0xa8]
mov r15, qword [rbp + 0xb0]
mov r11, qword [rbp - 0x28]
nop dword [rax + rax]
mov eax, dword [0x141dc0470]
sub eax, dword [0x141dc0474]
add eax, 0xb71cd5de
or eax, 0xfcfede1b
cmp eax, 0xc435073a
jb 0x140025830
mov ecx, dword [rsi]
nop
mov eax, dword [0x141dc0478]
xor edx, edx
div dword [0x141dc047c]
imul eax, eax, 0xd2768302
cmp eax, 0x5d604c2b
je 0x140025850
test ecx, ecx
mov rsi, qword [rbp + 0xe0]
je 0x140025990
lea rax, [0x141da25be]
mov qword [r13], rax
mov rcx, qword [r13]
movabs rax, 0x28ee358551049bf3
mov qword [r11], rax
mov rdx, qword [r11]
sub rsp, 0x20
call fcn.14001b7a0
add rsp, 0x20
movabs rcx, 0x6473f65616740f59
xor rcx, qword [rax]
movabs rdx, 0x5c3c7d014d9e5a4a
xor rdx, qword [rax + 8]
movabs r8, 0x4259c9f0a01aad2f
xor r8, qword [rax + 0x10]
movabs r9, 0x3bbd058d17997c23
xor r9, qword [rax + 0x18]
movabs r10, 0x3021bc15fa91e96b
xor r10, qword [rax + 0x20]
mov r11d, 0xf3c0e744
xor r11d, dword [rax + 0x28]
movzx eax, byte [rax + 0x2c]
xor al, 0xd0
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], r9
mov qword [rsi + 0x20], r10
mov dword [rsi + 0x28], r11d
mov byte [rsi + 0x2c], al
mov qword [r15], rsi
mov qword [r15 + 8], 0x2d
mov qword [rdi], r15
lea rax, [0x14000d490]
mov qword [rdi + 8], rax
lea rax, [0x1400ffeb0]
mov qword [r12], rax
mov qword [r12 + 8], 2
mov qword [r12 + 0x20], 0
mov qword [r12 + 0x10], rdi
mov qword [r12 + 0x18], 1
sub rsp, 0x20
mov rcx, r12
call fcn.14009e1e0
add rsp, 0x20
mov rcx, qword [rbp + 0xb8]
jmp case.0x140026ce3.0
xor eax, eax
mov rbx, qword [rbp + 0x80]
nop
test al, al
jne 0x140025980
nop word cs:[rax + rax]
mov eax, dword [0x141dc0480]
and eax, dword [0x141dc0484]
add eax, 0xa5c85f1c
cmp eax, 0x94b593c1
jb 0x140025990
nop dword [rax + rax]
mov eax, dword [0x141dc0488]
sub eax, dword [0x141dc048c]
xor eax, 0x30060719
and eax, 0x36467799
add eax, 0x37ac6780
cmp eax, 0x52308514
ja 0x1400259b0
xor esi, esi
xorps xmm6, xmm6
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov eax, dword [0x141dc0490]
add eax, dword [0x141dc0494]
and eax, 0x4626b3a6
add eax, 0xed43f9fb
xor eax, 0x7ba5338d
cmp eax, 0x215e4443
jb 0x1400259e0
mov eax, dword [0x141dc0498]
and eax, dword [0x141dc049c]
xor eax, 0x7527a5a6
add eax, 0xdb1190d9
or eax, 0x18ef63fb
cmp eax, 0xdc3781db
ja 0x140025a49
mov edi, dword [0x141dc04a0]
imul edi, dword [0x141dc04a4]
sub rsp, 0x20
mov rcx, rbx
call fcn.1400902b0
add rsp, 0x20
cmp edi, 0xdd149fa1
jne 0x140025a5b
sub rsp, 0x20
mov rcx, rbx
call fcn.1400902b0
add rsp, 0x20
jmp 0x140025a24
mov r13, qword [rbx]
mov rdi, qword [rbp - 0x78]
nop word cs:[rax + rax]
test sil, sil
jne 0x140025a70
mov r15, qword [rbx + 8]
movabs rax, 0x8000000000000000
cmp r13, rax
je 0x140026b28
mov eax, dword [0x141dc04a8]
mov ecx, dword [0x141dc04ac]
add eax, ecx
add eax, 0xe9fcb29d
or eax, 0xba73cbd5
cmp eax, 0x28b83091
jae 0x140025ad0
mov r8, qword [rbx + 0x10]
sub rsp, 0x20
mov rcx, rdi
mov rdx, r15
call fcn.140053980
add rsp, 0x20
nop word cs:[rax + rax]
mov r8, qword [rbx + 0x10]
sub rsp, 0x20
mov rcx, rdi
mov rdx, r15
call fcn.140053980
add rsp, 0x20
test sil, sil
jne 0x140025ad0
cmp qword [rdi], 0
jne 0x14002723f
mov r12, qword [rdi + 8]
mov rbx, qword [rdi + 0x10]
nop
test sil, sil
jne 0x140025b00
nop word cs:[rax + rax]
mov eax, dword [0x141dc04b0]
xor eax, dword [0x141dc04b4]
imul eax, eax, 0x52949b66
or eax, 0xa1c037d2
and eax, 0xb3e877d2
cmp eax, 0x9489914b
jb 0x140025b10
test rbx, rbx
js 0x1400272b7
mov eax, dword [0x141dc04d0]
xor eax, dword [0x141dc04d4]
or eax, 0x16cb79af
add eax, 0x29520c68
xor eax, 0x538d0e13
cmp eax, 0x57ae5f7
jb 0x140025b3c
nop
mov eax, dword [str.W0_nW]
imul eax, dword [0x141dc04dc]
imul eax, eax, 0x8f35b10e
cmp eax, 0x9bee8b3c
je 0x140025b60
test rbx, rbx
je 0x140025bb4
movzx eax, byte [0x141dd7ff8]
sub rsp, 0x20
xor ecx, ecx
mov rdx, rbx
call fcn.1400beea0
add rsp, 0x20
mov qword [rbp + 0xe0], rax
nop
test sil, sil
jne 0x140025ba0
cmp qword [rbp + 0xe0], 0
jne 0x140025bc0
jmp 0x14002721c
mov eax, 1
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xb0], r15
mov eax, dword [0x141dc04e8]
and eax, dword [0x141dc04ec]
or eax, 0x18014080
xor eax, 0x8214825
or eax, 0xa2ceb552
cmp eax, 0x3c5256ba
jae 0x140025cb8
sub rsp, 0x20
mov rdi, qword [rbp + 0xe0]
mov rcx, rdi
mov rdx, r12
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rsp, 0x20
mov qword [r14], 0
mov qword [r14 + 8], 1
mov qword [r14 + 0x10], 0
lea rax, [rdi + rbx]
mov rdx, qword [rbp + 0x68]
mov qword [rdx], rdi
mov qword [rdx + 8], rax
mov word [rdx + 0x10], 0
mov dword [rdx + 0x18], 1
sub rsp, 0x20
mov rcx, qword [rbp + 0x98]
call fcn.140082020
add rsp, 0x20
mov rdx, qword [rbp + 0x60]
mov qword [rdx], 1
mov qword [rdx + 8], 1
mov word [rdx + 0x10], 0
mov dword [rdx + 0x18], 1
sub rsp, 0x20
mov rcx, qword [rbp + 0xa0]
call fcn.140082020
add rsp, 0x20
mov rax, qword [rbp + 0x78]
mov dword [rax], 0
mov rax, qword [rbp + 0x88]
movups xmmword [rax + 0x60], xmm6
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax + 0x10], xmm6
movups xmmword [rax], xmm6
mov r15, qword [rbp + 0x68]
mov r14, qword [rbp + 0xe0]
mov qword [rbp + 0xd8], rbx
mov rdi, qword [rbp + 0x88]
mov qword [rbp + 0xd0], r12
mov r12, qword [rbp + 0x60]
nop dword [rax]
mov eax, dword [0x141dc04f0]
mov ecx, dword [0x141dc04f4]
add eax, ecx
add eax, 0x22e113ff
imul rax, rax, 0x37423183
shr rax, 0x3d
imul eax, eax, 0x3d9cbf6f
mov dword [rbp + 0xe8], eax
sub rsp, 0x20
mov rcx, r14
mov rdx, qword [rbp + 0xd0]
mov rbx, qword [rbp + 0xd8]
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rsp, 0x20
mov rax, qword [rbp + 0xc8]
mov qword [rax], 0
mov qword [rax + 8], 1
mov qword [rax + 0x10], 0
lea rax, [r14 + rbx]
mov qword [r15], r14
mov qword [r15 + 8], rax
mov word [r15 + 0x10], 0
mov dword [r15 + 0x18], 1
sub rsp, 0x20
mov r13, qword [rbp + 0x98]
mov rcx, r13
mov rdx, r15
call fcn.140082020
add rsp, 0x20
mov qword [r12], 1
mov qword [r12 + 8], 1
mov word [r12 + 0x10], 0
mov dword [r12 + 0x18], 1
sub rsp, 0x20
mov rbx, qword [rbp + 0xa0]
mov rcx, rbx
mov rdx, r12
call fcn.140082020
add rsp, 0x20
mov rax, qword [r13 + 8]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbp + 0x78]
mov dword [rdx], 0
movups xmmword [rdi + 0x60], xmm6
movups xmmword [rdi + 0x50], xmm6
movups xmmword [rdi + 0x40], xmm6
movups xmmword [rdi + 0x30], xmm6
movups xmmword [rdi + 0x20], xmm6
movups xmmword [rdi + 0x10], xmm6
movups xmmword [rdi], xmm6
cmp dword [rbp + 0xe8], 0xed113c08
ja 0x140025ce0
mov qword [rbp + 0xd0], rcx
mov qword [rbp + 0xe8], rax
movabs rax, 0x3fffffffffffffff
mov edi, 4
cmp rdi, rax
ja 0x140027327
movzx eax, byte [0x141dd7ff8]
sub rsp, 0x20
mov edx, 8
xor ecx, ecx
call fcn.1400beea0
add rsp, 0x20
test rax, rax
mov edx, 0x92d618d3
mov r13, qword [sym.imp.shell32.dll_ShellExecuteExW]
je 0x140027379
mov r12, rax
test sil, sil
mov rcx, qword [rbp + 0xc0]
jne 0x1400262db
mov eax, dword [0x141dc0518]
add eax, dword [0x141dc051c]
imul rax, rdx
shr rax, 0x3e
or eax, 0xba9cb7c1
xor eax, 0x15231b89
mov word [r12], 0x72
mov qword [rcx], rdi
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], 1
cmp eax, 0xa8d4ddb8
jb 0x1400262db
mov edi, 1
xor ebx, ebx
lea r14, [0x141db62f3]
jmp 0x140025ec0
mov word [r12 + rdi*2], bx
inc rdi
mov qword [rcx + 0x10], rdi
mov ebx, r15d
nop dword [rax]
test sil, sil
jne 0x140025ec0
test bx, bx
je 0x140025ee0
xor r15d, r15d
jmp 0x1400261c0
mov eax, dword [0x141dc0520]
and eax, dword [0x141dc0524]
add eax, 0xa74a2f56
or eax, 0x6b7f0e95
cmp eax, 0x5e94022f
jb 0x140025ee0
lea rax, [0x141db62f8]
cmp r14, rax
je 0x1400262f6
nop dword [rax]
test sil, sil
jne 0x140025f10
lea r8, [r14 + 1]
movzx r9d, byte [r14]
mov eax, dword [0x141dc0528]
xor edx, edx
div dword [0x141dc052c]
nop dword [rax + rax]
mov eax, dword [0x141dc0530]
add eax, dword [0x141dc0534]
imul rax, rax, 0x15c8d397
shr rax, 0x3c
cmp eax, 0xec8dd73
je 0x140025f30
nop
mov eax, dword [0x141dc0538]
sub eax, dword [0x141dc053c]
cmp eax, 0xa1a727b1
je 0x140025f50
test r9b, r9b
js 0x140025f9a
nop dword [rax + rax]
mov eax, dword [0x141dc0548]
or eax, dword [0x141dc054c]
xor eax, 0x20908008
or eax, 0x844e0910
and eax, 0xa6de8918
cmp eax, 0x975a145b
je 0x140025f70
mov eax, r9d
jmp 0x140026181
mov r10d, r9d
and r10d, 0x1f
lea r8, [r14 + 2]
movzx r11d, byte [r14 + 1]
mov eax, r10d
shl eax, 6
and r11d, 0x3f
or eax, r11d
nop word [rax + rax]
mov edx, dword [0x141dc0540]
add edx, dword [0x141dc0544]
or edx, 0x7ad1263c
add edx, 0xe92f0519
cmp edx, 0x5c0b15f2
jb 0x140025fc0
cmp r9b, 0xdf
jbe 0x140026181
nop word [rax + rax]
mov eax, dword [str.hP__a]
or eax, dword [0x141dc0554]
or eax, 0xf30af2e1
xor eax, 0x337c693d
imul eax, eax, 0xa7f11bfe
cmp eax, 0x439880a1
jb 0x140025ff0
lea r8, [r14 + 3]
movzx eax, byte [r14 + 2]
shl r11d, 6
and eax, 0x3f
nop word cs:[rax + rax]
mov edx, dword [str.xK04]
sub edx, dword [0x141dc055c]
add edx, 0xb5459779
and edx, 0x5b9b2db6
imul rdx, rdx, 0x642d65ab
shr rdx, 0x3d
cmp edx, 0x6fc90775
ja 0x140026030
or r11d, eax
cmp r9b, 0xf0
jb 0x1400260c2
mov eax, dword [0x141dc0560]
xor edx, edx
div dword [0x141dc0564]
nop word cs:[rax + rax]
mov eax, dword [0x141dc0568]
xor edx, edx
div dword [0x141dc056c]
cmp eax, 0xc503fb10
je 0x140026080
movzx eax, byte [r14 + 3]
add r14, 4
and r10d, 7
shl r10d, 0x12
shl r11d, 6
and eax, 0x3f
or eax, r11d
or eax, r10d
mov r8, r14
cmp eax, 0xffff
ja 0x1400260d7
jmp 0x140026181
shl r10d, 0xc
or r11d, r10d
mov eax, r11d
cmp eax, 0xffff
jbe 0x140026181
mov edx, dword [str._fU_tn37T_x]
sub edx, dword [0x141dc057c]
add edx, 0x79b48f62
shr edx, 1
mov ecx, 0xceae4615
imul rdx, rcx
shr rdx, 0x3d
cmp edx, 0x70ba4937
ja 0x1400260d7
lea edx, [rax + 0xff0000]
shr edx, 0xa
mov rcx, qword [rbp + 0xc0]
mov r9d, dword [0x141dc0580]
add r9d, dword [0x141dc0584]
imul r9d, r9d, 0x8c2cb647
add r9d, 0x386bcae0
and r9d, 0xbd69bc1a
cmp r9d, 0x7d6d1f86
ja 0x140026110
mov r9d, dword [0x141dc0588]
imul r9d, dword [0x141dc058c]
or r9d, 0x5de43d7e
imul r9d, r9d, 0xd1b9d44c
movzx ebx, dx
or ebx, 0xd800
mov r15d, eax
and r15d, 0x3ff
or r15d, 0xdc00
cmp r9d, 0xa4317e50
je 0x14002613c
mov r14, r8
jmp 0x1400261c0
mov rcx, qword [rbp + 0xc0]
nop dword [rax + rax]
mov edx, dword [0x141dc0570]
and edx, dword [0x141dc0574]
xor edx, 0x8bd858a2
add edx, 0xb5fffee2
cmp edx, 0xed2b7e20
jae 0x140026190
xor r15d, r15d
mov r14, r8
mov ebx, eax
nop dword [rax + rax]
mov eax, dword [0x141dc0590]
imul eax, dword [0x141dc0594]
add eax, 0x75852def
xor eax, 0x66e43c55
imul eax, eax, 0xa9e324fa
cmp eax, 0xde127925
ja 0x1400261c0
cmp rdi, qword [rcx]
jne 0x140025eae
lea r9, [0x141db62f2]
movabs r10, 0xaaaaaaaaaaaaaaab
mov r8d, dword [0x141dc0598]
and r8d, dword [0x141dc059c]
add r8d, 0xaf470ae0
or r8d, 0xe7f7dfbd
mov rax, r9
sub rax, r14
add rax, 8
mul r10
mov r13, rdx
shr r13, 1
cmp r15w, 1
sbb r13, 0
cmp r8d, 0x164fc9ca
jb 0x1400261fe
add r13, 2
test sil, sil
jne 0x1400262ad
mov r12d, dword [0x141dc05a0]
xor r12d, dword [str.4Z]
add r12d, 0xb7a74fd0
or r12d, 0xc86d7bb3
xor r12d, 0xcf04303d
sub rsp, 0x30
mov qword [rsp + 0x20], 2
mov r9d, 2
mov rdx, rdi
mov r8, r13
call fcn.1400faca0
mov rcx, qword [rbp + 0xc0]
add rsp, 0x30
cmp r12d, 0xf9b399e8
jae 0x140026248
mov r12, qword [rcx + 8]
mov r13, qword [sym.imp.shell32.dll_ShellExecuteExW]
jmp 0x140025eae
sub rsp, 0x30
mov qword [rsp + 0x20], 2
mov r9d, 2
mov rdx, rdi
mov r8, r13
call fcn.1400faca0
mov rcx, qword [rbp + 0xc0]
add rsp, 0x30
jmp 0x140026248
mov word [r12], 0x72
mov qword [rcx], rdi
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], 1
jmp 0x140025e5f
mov r14, qword [rcx]
mov rdi, qword [rcx + 8]
sub rsp, 0x20
xor ecx, ecx
mov edx, 6
call qword [sym.imp.ole32.dll_CoInitializeEx]
add rsp, 0x20
mov rbx, qword [rbp + 0x88]
movabs rax, 0x14000000070
mov qword [rbx], rax
mov qword [rbx + 0x10], rdi
mov rax, qword [rbp + 0xe8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbp + 0xd0]
mov qword [rbx + 0x20], rax
mov eax, dword [0x141dc05a8]
add eax, dword [0x141dc05ac]
or eax, 0x8589b8ff
imul eax, eax, 0xafce3b7d
add eax, 0xd41b70a0
cmp eax, 0x74ed7539
jae 0x140026378
mov dword [rbx + 0x30], 1
sub rsp, 0x20
mov rcx, rbx
call r13
add rsp, 0x20
mov r15, qword [rbp + 0x78]
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov dword [rbx + 0x30], 1
sub rsp, 0x20
mov rcx, rbx
call r13
add rsp, 0x20
test eax, eax
sete al
mov rcx, qword [rbx + 0x68]
test rcx, rcx
sete dl
test sil, sil
jne 0x140026390
or al, dl
je 0x14002646c
mov rbx, qword [rbp + 0xc8]
mov r15, qword [rbp + 0xa0]
nop
mov eax, dword [0x141dc05b0]
xor eax, dword [0x141dc05b4]
or eax, 0x538056
and eax, 0x578076
cmp eax, 0x515c1ee2
ja 0x1400263d0
test r14, r14
je 0x140026409
mov rcx, qword [0x141dd7fe0]
sub rsp, 0x20
xor edx, edx
mov r8, rdi
call r12
add rsp, 0x20
mov r14, rbx
nop dword [rax]
mov eax, dword [0x141dc05b8]
add eax, dword [0x141dc05bc]
imul eax, eax, 0xce386ff0
imul rax, rax, 0x631236d1
shr rax, 0x3e
cmp eax, 0x8132ca39
ja 0x140026410
mov edi, 0x9447a6f3
nop dword [rax]
mov eax, dword [0x141dc05c0]
xor eax, dword [0x141dc05c4]
and eax, 0x20240202
cmp eax, 0x293ec30f
ja 0x140026440
mov ebx, 0xffffffff
cmp qword [r15], 0
jne 0x1400265b3
jmp 0x1400265d0
sub rsp, 0x20
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x20
mov eax, dword [0x141dc05c8]
or eax, dword [0x141dc05cc]
mov r13, qword [rbx + 0x68]
add eax, 0x9f0eff9b
and eax, 0xc2518a4a
cmp eax, 0xe2d1287d
mov rbx, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
je 0x1400264bc
sub rsp, 0x20
mov rcx, r13
mov rdx, r15
call rbx
add rsp, 0x20
test sil, sil
je 0x1400264ce
sub rsp, 0x20
mov rcx, r13
mov rdx, r15
call rbx
add rsp, 0x20
jmp 0x1400264a7
mov ecx, eax
mov r9, qword [rbp + 0xc8]
mov r8d, 0xbe9d794b
nop dword [rax]
mov eax, dword [0x141dc05d0]
xor edx, edx
div dword [0x141dc05d4]
or eax, 0xfb80f88e
imul eax, eax, 0x9693d6a6
imul rax, r8
shr rax, 0x3e
cmp ecx, 1
mov ebx, 0
sbb ebx, ebx
cmp eax, 0x9227ec7
ja 0x1400264e0
or ebx, dword [r15]
test r14, r14
mov r15, qword [rbp + 0xa0]
mov r14, r9
je 0x140026590
mov eax, dword [0x141dc05d8]
imul eax, dword [0x141dc05dc]
xor eax, 0x94271101
and eax, 0xf4377111
cmp eax, 0x13268ec4
je 0x140026575
mov eax, dword [0x141dc05e0]
and eax, dword [0x141dc05e4]
imul rcx, rax, 0x2a13b67f
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
or eax, 0x291fdc54
mov rcx, qword [0x141dd7fe0]
cmp eax, 0xe6022a66
jne 0x14002657e
mov rax, qword [0x141dd7fe0]
jmp 0x140026542
sub rsp, 0x20
xor edx, edx
mov r8, rdi
call r12
add rsp, 0x20
nop
mov eax, dword [0x141dc05e8]
and eax, dword [0x141dc05ec]
add eax, 0x9e82a237
cmp eax, 0x12e9ecd0
jb 0x140026590
mov edi, 0x9447a6f3
cmp qword [r15], 0
je 0x1400265d0
mov r8, qword [r15 + 8]
mov rcx, qword [0x141dd7fe0]
sub rsp, 0x20
xor edx, edx
call r12
add rsp, 0x20
nop dword [rax + rax]
mov eax, dword [0x141dc05f0]
sub eax, dword [0x141dc05f4]
imul eax, eax, 0x1c6e43a8
or eax, 0xbf6b9197
cmp eax, 0x86f6bf19
je 0x1400265d0
mov r15, qword [rbp + 0xe0]
nop word cs:[rax + rax]
mov eax, dword [0x141dc05f8]
imul eax, dword [0x141dc05fc]
imul eax, eax, 0x9ff245d6
imul rax, rax, 0x408ffce5
shr rax, 0x3e
cmp eax, 0xebe10d0b
je 0x140026600
mov rax, qword [rbp + 0x98]
mov rcx, qword [rax]
nop
mov eax, dword [0x141dc0600]
xor edx, edx
div dword [0x141dc0604]
imul eax, eax, 0xa1ed3528
add eax, 0x1f2911d8
cmp eax, 0x3d462c77
ja 0x140026630
test rcx, rcx
je 0x1400266a3
nop word cs:[rax + rax]
mov eax, dword [0x141dc0608]
xor edx, edx
div dword [str.g_t]
and eax, 0x4b777c3d
add eax, 0x59475df3
or eax, 0x63e02eff
cmp eax, 0xc25830ba
ja 0x140026660
mov rax, qword [rbp + 0x98]
mov r8, qword [rax + 8]
mov rcx, qword [0x141dd7fe0]
sub rsp, 0x20
xor edx, edx
call r12
add rsp, 0x20
mov rax, qword [r14]
nop word cs:[rax + rax]
mov ecx, dword [0x141dc0610]
and ecx, dword [0x141dc0614]
imul rcx, rdi
shr rcx, 0x3d
and ecx, 3
cmp ecx, 0x82e1004f
je 0x1400266b0
test rax, rax
je 0x140026770
mov eax, dword [0x141dc0618]
imul eax, dword [0x141dc061c]
and eax, 0x13601b40
imul eax, eax, 0x4348d9d
and eax, 0x756a77c0
cmp eax, 0x755e9802
ja 0x14002672a
mov eax, dword [0x141dc0620]
add eax, dword [0x141dc0624]
xor eax, 0x12800a12
and eax, 0x9681aef3
imul eax, eax, 0x1901b3cf
mov r8, qword [r14 + 8]
mov rcx, qword [0x141dd7fe0]
cmp eax, 0xb99d762f
jae 0x140026733
mov rax, qword [0x141dd7fe0]
jmp 0x1400266fc
sub rsp, 0x20
xor edx, edx
call r12
add rsp, 0x20
mov eax, dword [0x141dc0628]
or eax, dword [0x141dc062c]
xor eax, 0x72000022
or eax, 0x1cc314
and eax, 0xf21ecb36
cmp eax, 0x762d66b8
jb 0x140026740
nop word cs:[rax + rax]
mov eax, dword [0x141dc0630]
or eax, dword [0x141dc0634]
add eax, 0xca6b6379
and eax, 0x2ff94021
cmp eax, 0x4b23b170
ja 0x140026770
cmp qword [rbp + 0xd8], 0
je 0x140026869
mov eax, dword [0x141dc0648]
and eax, dword [0x141dc064c]
add eax, 0xea2d80e5
xor eax, 0x49f54eae
cmp eax, 0x12650c64
jb 0x1400267d2
mov eax, dword [0x141dc0650]
sub eax, dword [0x141dc0654]
mov rdi, qword [0x141dd7fe0]
cmp eax, 0xcb32486b
jne 0x1400267db
mov rax, qword [0x141dd7fe0]
jmp 0x1400267b8
mov eax, dword [str.j4WM]
sub eax, dword [0x141dc065c]
or eax, 0x7847fb65
imul eax, eax, 0xbd42475e
add eax, 0x4121f188
cmp eax, 0x4c6c0aaa
jbe 0x140026820
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, r15
call r12
add rsp, 0x20
nop word cs:[rax + rax]
mov r14d, dword [0x141dc0660]
or r14d, dword [0x141dc0664]
imul rax, r14, 0xd21dd4f
shr rax, 0x20
sub r14d, eax
shr r14d, 1
add r14d, eax
shr r14d, 0x1c
xor r14d, 0x89366092
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, r15
call r12
add rsp, 0x20
cmp r14d, 0xe52b8d55
ja 0x140026820
mov eax, dword [0x141dc0668]
or eax, dword [0x141dc066c]
xor eax, 0x30121a10
and eax, 0xf6933a94
cmp eax, 0xb7ce6ed9
je 0x140026869
mov rdi, qword [rbp + 0x38]
mov r14, qword [rbp + 0x40]
mov rcx, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x68]
nop word cs:[rax + rax]
mov eax, dword [0x141dc0670]
sub eax, dword [0x141dc0674]
imul rax, rax, 0x30a8574f
shr rax, 0x3d
imul eax, eax, 0x803feab4
add eax, 0xe7da3b05
cmp eax, 0xcfaca759
jb 0x1400268a0
test ebx, ebx
je 0x140027039
lea rax, [0x141dac809]
mov qword [rdx], rax
mov rax, qword [rdx]
mov qword [rbp + 0xe8], rax
movabs rax, 0x595f673b99754862
mov qword [rcx], rax
mov rax, qword [rcx]
mov qword [rbp + 0xd8], rax
mov eax, dword [0x141dc0678]
imul eax, dword [0x141dc067c]
and eax, 0x980664ad
imul eax, eax, 0x2002a747
and eax, 0x85a8ab4c
cmp eax, 0x93621da6
mov r14, qword [rbp - 0x60]
mov r15, qword [rbp - 0x58]
mov r13, qword [rbp - 0x50]
mov rdi, qword [rbp - 0x48]
movabs r12, 0x69a9b624fd27f38
ja 0x140026a66
mov ebx, dword [0x141dc0680]
sub ebx, dword [0x141dc0684]
imul rax, rbx, 0x6ac73461
shr rax, 0x20
sub ebx, eax
shr ebx, 1
add ebx, eax
shr ebx, 0x1d
sub rsp, 0x20
mov rcx, qword [rbp + 0xe8]
mov rdx, qword [rbp + 0xd8]
call fcn.14001bd40
add rsp, 0x20
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
movzx eax, byte [rax + 0x20]
movabs r10, 0x27ba6ed99e947921
xor rcx, r10
mov qword [r14], rcx
movabs rcx, 0x347de5c2264e06c9
xor rdx, rcx
mov qword [r14 + 8], rdx
movabs rcx, 0xf37d98069079d5a0
xor r8, rcx
mov qword [r14 + 0x10], r8
xor r9, r12
mov qword [r14 + 0x18], r9
xor al, 0xb9
mov byte [r14 + 0x20], al
mov qword [r15], r14
mov qword [r15 + 8], 0x21
mov qword [r13], r15
lea rax, [0x14000d490]
mov qword [r13 + 8], rax
lea rax, [0x1400ffeb0]
mov qword [rdi], rax
mov qword [rdi + 8], 2
mov qword [rdi + 0x20], 0
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 1
sub rsp, 0x20
mov rcx, rdi
call fcn.14009e1e0
add rsp, 0x20
cmp ebx, 0x12718580
je 0x140026a66
cmp qword [rbp + 0xa8], 0
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rbp + 0x80]
mov r14, qword [rbp + 0xc8]
je 0x1400259e0
mov rcx, qword [0x141dd7fe0]
sub rsp, 0x20
xor edx, edx
mov r8, qword [rbp + 0xb0]
call r12
add rsp, 0x20
jmp 0x1400259e0
sub rsp, 0x20
mov rcx, qword [rbp + 0xe8]
mov rdx, qword [rbp + 0xd8]
call fcn.14001bd40
add rsp, 0x20
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
movzx eax, byte [rax + 0x20]
movabs r10, 0x27ba6ed99e947921
xor rcx, r10
mov qword [r14], rcx
movabs rcx, 0x347de5c2264e06c9
xor rdx, rcx
mov qword [r14 + 8], rdx
movabs rcx, 0xf37d98069079d5a0
xor r8, rcx
mov qword [r14 + 0x10], r8
xor r9, r12
mov qword [r14 + 0x18], r9
xor al, 0xb9
mov byte [r14 + 0x20], al
mov qword [r15], r14
mov qword [r15 + 8], 0x21
mov qword [r13], r15
lea rax, [0x14000d490]
mov qword [r13 + 8], rax
lea rax, [0x1400ffeb0]
mov qword [rdi], rax
mov qword [rdi + 8], 2
mov qword [rdi + 0x20], 0
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 1
sub rsp, 0x20
mov rcx, rdi
call fcn.14009e1e0
add rsp, 0x20
jmp 0x14002693e
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x38]
mov r14, qword [rbp + 0x40]
nop word cs:[rax + rax]
mov eax, dword [0x141dc0698]
and eax, dword [0x141dc069c]
or eax, 0x6450441a
imul eax, eax, 0xbdb3b68b
and eax, 0x519e9c57
cmp eax, 0xa43ed227
ja 0x140026b40
test r15, r15
je 0x1400270a4
xor eax, eax
nop
test al, al
jne 0x140026b70
movabs rax, 0x63c9020a48e60ebf
mov ecx, dword [0x141dc06d0]
or ecx, dword [0x141dc06d4]
add ecx, 0xd750a6c4
imul rcx, rcx, 0x4ff34313
shr rcx, 0x3d
or ecx, 0x55e7be5c
cmp ecx, 0x4af69117
mov r10, qword [rbp - 0x20]
mov r11, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x10]
mov rdi, qword [rbp - 8]
mov rbx, qword [rbp]
mov r14, qword [rbp + 8]
jae 0x140026bce
lea rcx, [0x141dad4e8]
mov qword [r11], rcx
mov qword [r10], rax
mov edx, 0x90073a31
lea r8, [0x141dad4e8]
nop word [rax + rax]
mov r9d, dword [0x141dc06d8]
imul r9d, dword [0x141dc06dc]
add r9d, 0x77a00efc
imul r9, rdx
shr r9, 0x3e
mov qword [r11], r8
mov rcx, qword [r11]
mov qword [r10], rax
cmp r9d, 0x5d09a8ef
ja 0x140026be0
mov rdx, qword [r10]
sub rsp, 0x20
call fcn.140019230
add rsp, 0x20
movabs rcx, 0x73d7bddf5b238f5b
xor rcx, qword [rax]
movabs rdx, 0x4361ba5209efe2c9
xor rdx, qword [rax + 8]
movabs r8, 0x80aafc04f153c8a7
xor r8, qword [rax + 0x10]
movabs r9, 0xfd95095e3a6861b1
xor r9, qword [rax + 0x18]
movzx eax, byte [rax + 0x20]
xor al, 0x21
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], r9
mov byte [rsi + 0x20], al
mov qword [rdi], rsi
mov qword [rdi + 8], 0x21
mov qword [rbx], rdi
lea rax, [0x14000d490]
mov qword [rbx + 8], rax
lea rax, [0x1400ffeb0]
mov qword [r14], rax
mov qword [r14 + 8], 2
mov qword [r14 + 0x20], 0
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], 1
sub rsp, 0x20
mov rcx, r14
call fcn.14009e1e0
add rsp, 0x20
mov eax, r15d
and eax, 3
cmp rax, 3
ja case.default.0x140026ce3
lea rcx, [0x141db72bc]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
mov rcx, qword [rbp + 0xb8]
jmp rax
lea rsi, [r15 - 1]
mov rdi, qword [r15 - 1]
mov rbx, qword [r15 + 7]
mov r14, qword [rbx]
nop word cs:[rax + rax]
mov eax, dword [0x141dc06f8]
sub eax, dword [0x141dc06fc]
add eax, 0x310b785e
xor eax, 0x737029a2
cmp eax, 0xd1e8e3e
jb 0x140026d00
xor eax, eax
nop
test al, al
jne 0x140026d20
test r14, r14
je 0x140026da2
mov eax, dword [0x141dc0700]
imul eax, dword [0x141dc0704]
add eax, 0xf46b3f69
mov ecx, 0x917b7885
imul rcx, rax
shr rcx, 0x3f
add ecx, 0x47b2e1f3
cmp ecx, 0x5a27ef60
jbe 0x140026d70
sub rsp, 0x20
mov rcx, rdi
call r14
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dc0708]
imul eax, dword [0x141dc070c]
imul r15d, eax, 0x78ec95d6
add r15d, 0xd107bf74
sub rsp, 0x20
mov rcx, rdi
call r14
add rsp, 0x20
cmp r15d, 0x36dcc3ca
jb 0x140026d70
mov rcx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
nop word [rax + rax]
mov edx, dword [0x141dc0710]
add edx, dword [0x141dc0714]
imul r8, rdx, 0x348dda93
shr r8, 0x20
sub edx, r8d
shr edx, 1
add edx, r8d
shr edx, 0x1f
cmp edx, 0x5b15159c
je 0x140026db0
nop word [rax + rax]
mov edx, dword [0x141dc0718]
and edx, dword [0x141dc071c]
add edx, 0xa3b099a8
xor edx, 0xa8404260
or edx, 0x419f859b
cmp edx, 0x1ee1be34
jb 0x140026de0
test rcx, rcx
je 0x140026e9d
nop
mov ecx, dword [0x141dc0720]
or ecx, dword [0x141dc0724]
add ecx, 0x6656aa9b
and ecx, 0x62c273b5
cmp ecx, 0xc809e10a
ja 0x140026e10
mov ecx, dword [0x141dc0728]
and ecx, dword [0x141dc072c]
or ecx, 0x755215c4
imul ecx, ecx, 0x32f7b6b8
add ecx, 0xe7957c90
cmp ecx, 0x957e8b27
jb 0x140026e30
cmp rax, 0x11
jb 0x140026e83
mov rdi, qword [rdi - 8]
mov eax, dword [0x141dc0730]
xor eax, dword [0x141dc0734]
or eax, 0xa622f237
imul eax, eax, 0x851d597
xor eax, 0xdeb8cd39
cmp eax, 0xb880d229
jb 0x140026e60
mov rcx, qword [0x141dd7fe0]
sub rsp, 0x20
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov rdi, qword [0x141dd7fe0]
mov eax, dword [0x141dc0738]
sub eax, dword [0x141dc073c]
or eax, 0x7fbbfffb
imul eax, eax, 0xc528d13f
cmp eax, 0x5718e3f4
jae 0x140026ed8
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov ebx, 0xd030f34d
nop dword [rax]
mov r14d, dword [0x141dc0740]
or r14d, dword [0x141dc0744]
imul r14, rbx
shr r14, 0x3d
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, rsi
call r12
add rsp, 0x20
cmp r14d, 0x3b49ed5e
je 0x140026ee0
mov rcx, qword [rbp + 0xb8]
nop dword [rax]
mov eax, dword [0x141dc0748]
or eax, dword [0x141dc074c]
and eax, 0x1762c85b
cmp eax, 0x255b9320
je 0x140026f20
jmp case.0x140026ce3.0
mov eax, dword [0x141dc06e8]
xor edx, edx
div dword [0x141dc06ec]
and eax, 0xb0d17e77
add eax, 0xd80513a
xor eax, 0xbb34f285
cmp eax, 0xe2f6d071
ja case.0x140026ce3.3
nop word cs:[rax + rax]
mov eax, dword [0x141dc06f0]
mov edx, dword [0x141dc06f4]
add eax, edx
add eax, 0x498110fa
and eax, 0x45f561d0
cmp eax, 0x62f23883
je 0x140026f70
mov qword [rcx], 0
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
add rsp, 0x20
mov ecx, eax
nop word cs:[rax + rax]
mov eax, dword [0x141dc0758]
xor edx, edx
div dword [0x141dc075c]
and eax, 0xc068ba64
xor eax, 0xf170732e
imul eax, eax, 0x7bd3b845
cmp eax, 0x87ed80fa
jb 0x140026fb0
test ecx, ecx
mov rcx, qword [rbp + 0x90]
je 0x1400273c9
mov r8, qword [rbp + 0xb8]
nop dword [rax + rax]
mov eax, dword [0x141dc0770]
xor edx, edx
div dword [0x141dc0774]
xor eax, 0x20000028
or eax, 0xdb7bff87
cmp eax, 0xce0fd74c
jb 0x140026ff0
mov eax, dword [0x141dc0778]
or eax, dword [0x141dc077c]
mov rsi, qword [r8]
or eax, 0xf01faed7
imul eax, eax, 0xe0ee13ae
cmp eax, 0xc131ca1c
jbe 0x1400275e1
jmp 0x140027613
mov r8, qword [rbp + 0xb0]
mov eax, dword [0x141dc0688]
imul eax, dword [0x141dc068c]
cmp eax, 0xee07269e
je 0x140027040
cmp qword [rbp + 0xa8], 0
mov rsi, qword [rbp + 0x48]
je 0x1400270a4
mov rcx, qword [0x141dd7fe0]
sub rsp, 0x20
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop dword [rax]
mov eax, dword [0x141dc0690]
imul eax, dword [0x141dc0694]
add eax, 0xe566974a
imul rax, rax, 0x5b296b3d
shr rax, 0x3e
cmp eax, 0x6315e13
jae 0x140027080
movabs r15, 0x9d45940f69b50d5a
movabs r11, 0x44f21e587249d16a
mov eax, dword [0x141dc06a0]
mov ecx, dword [0x141dc06a4]
add eax, ecx
add eax, 0xe7cd280
and eax, 0x79fbcff4
imul eax, eax, 0x6dd93bb3
lea r12, [0x141da328a]
cmp eax, 0xe5b7b71c
jbe 0x140027126
mov qword [rdi], r12
mov rcx, qword [rdi]
mov qword [rsi], r15
mov rdx, qword [rsi]
sub rsp, 0x20
mov rbx, r15
mov r15, r11
call fcn.14001a8c0
mov r11, r15
mov r15, rbx
add rsp, 0x20
mov rcx, qword [rax]
xor rcx, r11
mov rdx, qword [rax + 8]
mov rdx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rdx, qword [rax + 0x20]
movzx eax, word [rax + 0x28]
mov qword [r14], rcx
mov rbx, rdi
mov rdi, rsi
nop dword [rax]
mov eax, dword [0x141dc06a8]
sub eax, dword [0x141dc06ac]
or eax, 0x3edf7616
imul esi, eax, 0xd729347a
and esi, 0x20341410
mov qword [rbx], r12
mov rcx, qword [rbx]
mov qword [rdi], r15
mov rdx, qword [rdi]
sub rsp, 0x20
mov r13, r12
mov r12, r11
call fcn.14001a8c0
mov r11, r12
mov r12, r13
add rsp, 0x20
mov r10, qword [rax]
xor r10, r11
mov rcx, qword [rax + 8]
movabs rdx, 0x22fd9cbde01aa544
xor rcx, rdx
mov rdx, qword [rax + 0x10]
movabs r8, 0x72396d0abc24f508
xor rdx, r8
mov r8, qword [rax + 0x18]
movabs r9, 0x5cc1f4aaac985a06
xor r8, r9
mov r9, qword [rax + 0x20]
movabs r13, 0x60f835fa28c43580
xor r9, r13
movzx eax, word [rax + 0x28]
mov qword [r14], r10
cmp esi, 0x8cea6ff9
je 0x140027130
mov r10d, eax
xor r10b, 0xf9
shr eax, 8
xor al, 0x9d
mov r11d, dword [0x141dc06b0]
xor r11d, dword [0x141dc06b4]
imul r11d, r11d, 0x5f470833
cmp r11d, 0x5d127813
mov rdi, qword [rbp + 0x10]
mov rbx, qword [rbp + 0x18]
mov r15, qword [rbp + 0x20]
lea r12, [0x14000d490]
lea rsi, [0x1400ffeb0]
jne 0x14002743a
jmp 0x1400274bf
ud2
xor eax, eax
test al, al
je 0x140027247
ud2
mov eax, 0xb1a3b1c5
nop dword [rax]
mov ecx, dword [0x141dc0638]
xor ecx, dword [0x141dc063c]
imul rcx, rax
shr rcx, 0x3d
add ecx, 0x68eb78d2
imul rcx, rcx, 0x47e419a9
shr rcx, 0x3c
ud2
mov eax, dword [0x141dc04b8]
or eax, dword [0x141dc04bc]
xor eax, 0xc47cf0e9
add eax, 0x9f9427bb
and eax, 0xd51f20fe
cmp eax, 0x1b34bb4d
jbe 0x1400272e0
ud2
mov eax, dword [0x141dc04c0]
xor eax, dword [0x141dc04c4]
and eax, 0x7037c57d
ud2
mov eax, dword [0x141dc04f8]
xor edx, edx
div dword [0x141dc04fc]
add eax, 0x8cd62352
cmp eax, 0xca4335b9
jbe 0x140027350
ud2
mov eax, dword [0x141dc0500]
and eax, dword [0x141dc0504]
xor eax, 0xfc714571
add eax, 0x8f0bc5af
and eax, 0x85ea3d9e
ud2
mov eax, dword [0x141dc0508]
or eax, dword [0x141dc050c]
add eax, 0x7437dead
imul rax, rax, 0x2058f9e9
shr rax, 0x3c
cmp eax, 0x6cad437e
jbe 0x1400273a0
ud2
mov eax, dword [0x141dc0510]
xor edx, edx
div dword [0x141dc0514]
and eax, 0x3cd50c11
imul eax, eax, 0xdc29ca5
xor eax, 0xf5442d81
ud2
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov eax, dword [0x141dc0760]
sub eax, dword [0x141dc0764]
add eax, 0x115cdba
xor eax, 0xac05ab1b
cmp eax, 0xbce28111
jbe 0x1400275bf
jmp 0x1400275dd
mov eax, 0x84066945
nop word cs:[rax + rax]
mov ecx, dword [0x141dc06e0]
xor ecx, dword [0x141dc06e4]
imul rcx, rax
shr rcx, 0x3f
add ecx, 0x4b01bd03
and ecx, 0xa003d07
cmp ecx, 0x91aa491d
ja 0x140027410
ud2
mov r11d, dword [0x141dc06b8]
and r11d, dword [0x141dc06bc]
xor r11d, 0x55c02306
imul r11d, r11d, 0x1ed9c102
imul rsi, r11, 0x6fbdde25
shr rsi, 0x20
sub r11d, esi
shr r11d, 1
add r11d, esi
lea rsi, [0x1400ffeb0]
shr r11d, 0x1b
mov qword [r14 + 8], rcx
mov qword [r14 + 0x10], rdx
mov qword [r14 + 0x18], r8
mov qword [r14 + 0x20], r9
mov byte [r14 + 0x28], r10b
mov byte [r14 + 0x29], al
mov qword [rbx], r14
mov qword [rbx + 8], 0x2a
mov qword [r15], rbx
mov qword [r15 + 8], r12
mov qword [rdi], rsi
mov qword [rdi + 8], 2
mov qword [rdi + 0x20], 0
mov qword [rdi + 0x10], r15
cmp r11d, 0x9fa691e8
jbe 0x140027505
mov qword [r14 + 8], rcx
mov qword [r14 + 0x10], rdx
mov qword [r14 + 0x18], r8
mov qword [r14 + 0x20], r9
mov byte [r14 + 0x28], r10b
mov byte [r14 + 0x29], al
mov qword [rbx], r14
mov qword [rbx + 8], 0x2a
mov qword [r15], rbx
mov qword [r15 + 8], r12
mov qword [rdi], rsi
mov qword [rdi + 8], 2
mov qword [rdi + 0x20], 0
mov qword [rdi + 0x10], r15
jmp 0x14002743a
mov eax, dword [0x141dc06c0]
add eax, dword [0x141dc06c4]
or eax, 0xe4129a99
imul eax, eax, 0x591a050d
imul rax, rax, 0x215facdf
shr rax, 0x3d
cmp eax, 0x153106e5
jne 0x140027550
mov qword [rdi + 0x18], 1
sub rsp, 0x20
mov rcx, rdi
call fcn.14009e1e0
add rsp, 0x20
nop word cs:[rax + rax]
mov esi, dword [0x141dc06c8]
sub esi, dword [0x141dc06cc]
mov qword [rdi + 0x18], 1
sub rsp, 0x20
mov rcx, rdi
call fcn.14009e1e0
add rsp, 0x20
cmp esi, 0x907cf8a
je 0x140027550
nop dword [rax]
mov eax, dword [0x141dc0750]
xor edx, edx
div dword [0x141dc0754]
xor eax, 0x1feea257
add eax, 0xa906a70c
or eax, 0x8689f60a
cmp eax, 0x3c00c0d0
je 0x140027580
movaps xmm6, xmmword [rbp + 0xf0]
lea rsp, [rbp + 0x108]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [0x141dc0768]
add eax, dword [0x141dc076c]
and eax, 0x26292c10
ud2
ud2
mov eax, dword [0x141dc0780]
and eax, dword [0x141dc0784]
imul eax, eax, 0xa1b97d5d
shr eax, 1
imul rax, rax, 0x4290458f
shr rax, 0x3d
or eax, 0x84b3d0ae
mov r9, qword [0x141dd7fd8]
cmp eax, 0x7dc0e8ed
jae 0x14002761c
mov rax, qword [0x141dd7fd8]
jmp 0x1400275e1
test r9, r9
jne 0x1400277dd
mov eax, dword [0x141dc0788]
sub eax, dword [0x141dc078c]
add eax, 0xf19ceed8
cmp eax, 0xa7c72983
jbe 0x140027644
mov qword [rcx], 0
xor eax, eax
nop word cs:[rax + rax]
mov qword [rcx], 0
test al, al
jne 0x140027650
mov eax, dword [0x141dc0790]
sub eax, dword [0x141dc0794]
imul eax, eax, 0xad46b442
add eax, 0x39117694
cmp eax, 0xaf8480b7
jae 0x14002768e
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rcx, qword [rbp + 0x90]
add rsp, 0x20
mov rdi, qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
nop word cs:[rax + rax]
mov eax, dword [0x141dc0798]
and eax, dword [0x141dc079c]
xor eax, 0x433b1fd7
imul rbx, rax, 0x627a5ad5
shr rbx, 0x3e
sub rsp, 0x20
call rdi
mov rcx, qword [rbp + 0x90]
add rsp, 0x20
cmp ebx, 0xa050e15
je 0x1400276a0
test eax, eax
je 0x1400276fb
mov eax, dword [0x141dc07b0]
xor eax, dword [0x141dc07b4]
add eax, 0x3af01955
and eax, 0x445e5ea3
cmp eax, 0x4462355c
jbe 0x14002776c
jmp 0x14002778e
mov eax, dword [0x141dc07a0]
sub eax, dword [0x141dc07a4]
xor eax, 0x676a5e5f
imul eax, eax, 0x96bca116
and eax, 0x8d892e4e
cmp eax, 0x1447752d
jne 0x14002772c
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x141dc07a8]
sub eax, dword [0x141dc07ac]
or eax, 0x53a5578c
imul eax, eax, 0x8a4e4522
imul rdi, rax, 0x61bca891
shr rdi, 0x3e
sub rsp, 0x20
call rsi
add rsp, 0x20
cmp edi, 0xfdf7a116
je 0x140027733
jmp 0x140027438
mov eax, dword [0x141dc07b8]
add eax, dword [0x141dc07bc]
or eax, 0xbffff5fd
mov r9, qword [rcx]
mov qword [0x141dd7fd8], r9
cmp eax, 0x3d20ffc
jne 0x1400277a0
mov rax, qword [rcx]
mov qword [0x141dd7fd8], rax
jmp 0x14002776c
mov eax, dword [0x141dc07c0]
xor eax, dword [0x141dc07c4]
add eax, 0x988a18db
or eax, 0x16ecf223
and eax, 0xb7fdfa6b
cmp eax, 0xf0bb5a30
ja 0x1400277a0
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400277d0
test r9, r9
je 0x1400279c8
mov rax, rsi
or rax, r9
shr rax, 0x20
je 0x1400277f3
mov rax, rsi
xor edx, edx
div r9
jmp 0x1400277fa
mov eax, esi
xor edx, edx
div r9d
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, r9
shr rdx, 0x20
je 0x14002781e
xor edx, edx
div r9
mov rsi, rax
jmp 0x140027825
xor edx, edx
div r9d
mov esi, eax
add rsi, r8
mov rax, rsi
shr rax, 9
movabs r12, 0x44b82fa09b5a53
mul r12
mov rdi, rdx
sub rsp, 0x20
mov ecx, 0x23
call fcn.14008a260
add rsp, 0x20
mov rbx, qword [rbp + 0x28]
mov qword [rbx], 0
sub rsp, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
add rsp, 0x20
test eax, eax
je 0x1400279a5
shr rdi, 0xb
imul eax, edi, 0x3b9aca00
mov r14, qword [rbx]
mov ecx, dword [0x141dc07e8]
imul ecx, dword [0x141dc07ec]
add ecx, 0xb7418968
cmp ecx, 0xc89ffc49
jae 0x1400278a4
mov rcx, qword [0x141dd7fd8]
sub esi, eax
mov ecx, 0x9265be99
nop dword [rax + rax]
mov eax, dword [0x141dc07f0]
xor edx, edx
div dword [0x141dc07f4]
add eax, 0x9283fa1
imul rax, rcx
shr rax, 0x3f
mov r8, qword [0x141dd7fd8]
cmp eax, 0x70b1b02b
ja 0x1400278b0
test r8, r8
jne 0x140027b6d
mov eax, dword [0x141dc07f8]
imul eax, dword [0x141dc07fc]
add eax, 0xa830cddb
and eax, 0xda472126
add eax, 0x6523d738
cmp eax, 0x623aac68
mov rcx, qword [rbp + 0x70]
jae 0x140027910
mov qword [rcx], 0
mov eax, dword [0x141dc0800]
sub eax, dword [0x141dc0804]
xor eax, 0xb21c9b94
add eax, 0x32393be7
mov qword [rcx], 0
cmp eax, 0x1a74308d
jb 0x140027910
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
mov ecx, eax
nop word cs:[rax + rax]
mov eax, dword [0x141dc0808]
xor edx, edx
div dword [0x141dc080c]
imul eax, eax, 0xeddd5fc
and eax, 0xf29ae888
cmp eax, 0x6ed3371
je 0x140027950
test ecx, ecx
je 0x140027a14
mov eax, dword [0x141dc0830]
and eax, dword [0x141dc0834]
mov rcx, qword [rbp + 0x70]
mov r8, qword [rcx]
xor eax, 0x91af5bd6
add eax, 0xc76925c6
cmp eax, 0x6b6340b5
jae 0x140027b01
jmp 0x140027b1b
mov eax, dword [0x141dc07d8]
imul eax, dword [0x141dc07dc]
or eax, 0x33f6f445
and eax, 0x33fef655
cmp eax, 0xa711f4a8
jbe 0x140027a34
jmp 0x140027a60
xor eax, eax
test al, al
je 0x1400279d0
ud2
mov eax, dword [0x141dc07c8]
xor edx, edx
div dword [0x141dc07cc]
imul eax, eax, 0xf9169e35
add eax, 0xd69ead75
ud2
mov eax, dword [0x141dc0810]
and eax, dword [0x141dc0814]
imul eax, eax, 0xb28b3c80
and eax, 0xdf09a980
cmp eax, 0x86cd26e4
jne 0x140027a70
jmp 0x140027aa7
mov esi, dword [0x141dc07e0]
or esi, dword [0x141dc07e4]
add esi, 0xaf447eb4
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
cmp esi, 0x3991d7cf
jae 0x140027438
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
jmp 0x140027a34
mov eax, dword [0x141dc0818]
add eax, dword [0x141dc081c]
xor eax, 0x1ebe00ff
mov esi, 0x9247ad09
imul rsi, rax
shr rsi, 0x3c
and esi, 0xfffffffe
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
cmp esi, 0x2620735e
jbe 0x140027ab7
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
jmp 0x140027a70
mov eax, dword [0x141dc0820]
add eax, dword [0x141dc0824]
imul eax, eax, 0xb63cfd1a
add eax, 0xeaf23300
cmp eax, 0x8db92a90
jae 0x140027ad7
ud2
mov eax, dword [0x141dc0828]
xor eax, dword [0x141dc082c]
imul eax, eax, 0xc956acc3
and eax, 0xbccfa395
add eax, 0xe8972ab9
ud2
mov eax, dword [0x141dc0838]
or eax, dword [0x141dc083c]
mov qword [0x141dd7fd8], r8
cmp eax, 0x6a728731
jne 0x140027b24
mov qword [0x141dd7fd8], r8
jmp 0x140027b01
mov eax, dword [0x141dc0840]
xor edx, edx
div dword [0x141dc0844]
nop word cs:[rax + rax]
mov eax, dword [0x141dc0848]
imul eax, dword [0x141dc084c]
imul eax, eax, 0x5301dd5
and eax, 0xf5f38dff
add eax, 0x9a9be712
cmp eax, 0x42d8f548
jb 0x140027b40
test r8, r8
je 0x140028363
mov eax, dword [0x141dc0858]
and eax, dword [0x141dc085c]
or eax, 0x93706db0
imul rax, rax, 0x52aee3cf
shr rax, 0x3e
or eax, 0xf76347c
cmp eax, 0xfe89d4c7
jbe 0x140027c32
mov rax, r14
or rax, r8
shr rax, 0x20
je 0x140027baf
mov rax, r14
xor edx, edx
div r8
jmp 0x140027bb7
mov eax, r14d
xor edx, edx
div r8d
imul rax, rdx, 0x3b9aca00
mov rcx, rax
or rcx, r8
shr rcx, 0x20
je 0x140027bd8
xor edx, edx
div r8
mov rax, qword [0x141dd7fd8]
jmp 0x140027c32
xor edx, edx
div r8d
mov rax, qword [0x141dd7fd8]
jmp 0x140027c32
xor edx, edx
div r8
imul r10, r9, 0x116663c1
shr r10, 0x3a
add r10d, 0xa4e569cd
imul r15, rcx, 0x3b9aca00
add r15, rax
mov rax, r15
shr rax, 9
mul r12
and r10d, 0xa4a1280d
mov r9, qword [0x141dd7fd8]
cmp r10d, 0x93062809
jae 0x140027c8b
mov r9d, dword [0x141dc0860]
imul r9d, dword [0x141dc0864]
mov rax, r14
or rax, r8
shr rax, 0x20
je 0x140027c60
mov rax, r14
xor edx, edx
div r8
mov rcx, rax
jmp 0x140027c6a
mov eax, r14d
xor edx, edx
div r8d
mov ecx, eax
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, r8
shr rdx, 0x20
jne 0x140027bf0
xor edx, edx
div r8d
jmp 0x140027bf5
mov rbx, rdx
test r9, r9
mov r12, qword [rbp + 0x50]
jne 0x140027d5b
mov eax, dword [0x141dc0868]
and eax, dword [0x141dc086c]
or eax, 0x68384df3
add eax, 0x7e94e354
cmp eax, 0xf9a53ecd
mov r14, qword [rbp + 0x30]
jbe 0x140027cc3
mov qword [r14], 0
xor eax, eax
nop word cs:[rax + rax]
mov qword [r14], 0
test al, al
jne 0x140027cd0
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
add rsp, 0x20
test eax, eax
je 0x140028448
mov r9, qword [r14]
mov qword [0x141dd7fd8], r9
nop
mov eax, dword [0x141dc0880]
add eax, dword [0x141dc0884]
imul eax, eax, 0x625962a1
add eax, 0x13b7a8b7
and eax, 0xb97c2625
cmp eax, 0x8317e0a
jb 0x140027d00
mov eax, 0xa01cb787
nop dword [rax + rax]
mov ecx, dword [0x141dc0888]
sub ecx, dword [0x141dc088c]
imul ecx, ecx, 0xc11b870d
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x73152d92
je 0x140027d30
test r9, r9
je 0x140027438
shr rbx, 0xb
imul eax, ebx, 0x3b9aca00
sub r15d, eax
mov r10d, 0xc4653600
mov eax, dword [0x141dc0890]
add eax, dword [0x141dc0894]
xor eax, 0x40925f1a
cmp eax, 0xa239eee1
jae 0x140027ded
cmp r9, 0x3b9aca00
ja 0x140027ded
mov eax, 0x3b9aca00
xor edx, edx
div r9d
jmp 0x140027ded
mov eax, 0x3b9aca00
xor edx, edx
div r9d
imul ecx, ecx, 0x6c9c7c9e
shr ecx, 1
mov r11d, 0x8058fdcb
imul r11, rcx
shr r11, 0x3d
lea ecx, [rax + r10]
xor r8d, r8d
cmp r9, 2
cmovae ecx, eax
setb al
xor r14d, r14d
cmp rdi, rbx
setne r14b
mov edx, 0xff
cmovae edx, r14d
cmp r11d, 0xc84d728e
jne 0x140027e06
mov ecx, dword [0x141dc0898]
add ecx, dword [0x141dc089c]
cmp r9, 0x3b9aca00
jbe 0x140027da0
xor eax, eax
jmp 0x140027daa
test dl, dl
jne 0x140027e75
nop word [rax + rax]
mov edx, dword [0x141dc08a0]
add edx, dword [0x141dc08a4]
or edx, 0xc045246
and edx, 0x8dc55f46
cmp edx, 0xf76dbf16
je 0x140027e10
cmp r15d, esi
setne dl
nop word cs:[rax + rax]
mov r9d, dword [0x141dc08a8]
add r9d, dword [0x141dc08ac]
and r9d, 0x29579244
imul r9d, r9d, 0x6769397a
add r9d, 0x7a0dde96
cmp r9d, 0x63bd505b
jb 0x140027e40
cmp r15d, esi
ja 0x140027fac
cmp dl, 1
jne 0x140027fac
mov r9, rdi
sub r9, rbx
jb 0x140027438
mov r8b, al
mov eax, dword [0x141dc0900]
xor edx, edx
div dword [0x141dc0904]
nop dword [rax + rax]
mov eax, dword [0x141dc0908]
add eax, dword [0x141dc090c]
imul eax, eax, 0xd4cd3e24
add eax, 0x59b55998
cmp eax, 0x61cfaf69
jb 0x140027ea0
mov eax, 0xf517ebd1
nop word cs:[rax + rax]
mov edx, dword [0x141dc0910]
and edx, dword [0x141dc0914]
xor edx, 0x662e826c
imul rdx, rax
shr rdx, 0x3f
or edx, 0x4e19036
cmp edx, 0xe2b73d18
ja 0x140027ed0
mov r10d, 0x9dfcea87
nop
mov eax, dword [0x141dc0918]
xor edx, edx
div dword [0x141dc091c]
imul rax, r10
shr rax, 0x3f
not eax
and eax, 0x2ea41
cmp eax, 0x2272940c
ja 0x140027f00
cmp r15d, esi
jbe 0x140028001
nop dword [rax]
mov eax, dword [0x141dc0920]
add eax, dword [0x141dc0924]
or eax, 0x68871a02
imul eax, eax, 0x10bd3808
add eax, 0xcbe35c98
cmp eax, 0x75f5b06e
ja 0x140027f30
test r9, r9
je 0x140027438
dec r9
nop
mov eax, dword [0x141dc0928]
sub eax, dword [0x141dc092c]
xor eax, 0x100822
or eax, 0xffeb93dc
cmp eax, 0xdde247df
jb 0x140027f60
lea r10d, [rsi + 0x3b9aca00]
nop word cs:[rax + rax]
mov eax, dword [0x141dc0930]
imul eax, dword [0x141dc0934]
imul eax, eax, 0xed40f01
cmp eax, 0x3bbd79cb
je 0x140027f90
jmp 0x140028004
mov rcx, qword [rbp + 0x58]
mov eax, dword [0x141dc08b0]
and eax, dword [0x141dc08b4]
imul eax, eax, 0x2f951c07
cmp eax, 0xd0a32676
je 0x140027fb0
nop dword [rax]
mov eax, dword [0x141dc08b8]
imul eax, dword [0x141dc08bc]
xor eax, 0x8064020
and eax, 0x4d47d5f1
add eax, 0x436e2b73
cmp eax, 0x55a310b6
ja 0x140027fd0
cmp rdi, rbx
jbe 0x140028100
jmp 0x140028393
mov r10d, esi
sub r10d, r15d
nop word [rax + rax]
mov eax, dword [0x141dc0938]
xor edx, edx
div dword [0x141dc093c]
and eax, 0x7a40002a
add eax, 0x883f39b5
cmp eax, 0x1a5307c0
jb 0x140028010
cmp r10d, 0x3b9aca00
jb 0x140028083
mov eax, r10d
shr eax, 9
imul rax, rax, 0x44b83
shr rax, 0x27
add r9, rax
jb 0x140028484
imul eax, eax, 0x3b9aca00
sub r10d, eax
nop dword [rax + rax]
mov eax, dword [0x141dc0940]
xor eax, dword [0x141dc0944]
xor eax, 0xb14dcb1b
imul eax, eax, 0x1e6ecee8
add eax, 0xd66daf88
cmp eax, 0x26ba6292
jae 0x140028060
mov eax, 0xf96be3f7
mov edx, 0xff
nop dword [rax]
mov r11d, dword [0x141dc0958]
xor r11d, dword [0x141dc095c]
or r11d, 0xd002462b
imul r11, rax
shr r11, 0x3c
or r11d, 0x346c8f60
xor r14d, r14d
cmp r9, r8
setne r14b
cmovb r14d, edx
xor r12d, r12d
cmp r10d, ecx
setne r12b
cmovb r12d, edx
test r14b, r14b
cmovne r12d, r14d
cmp r12b, 1
setne r14b
cmp rdi, rbx
seta r12b
cmp r11d, 0x6a6d9399
ja 0x140028090
or r14b, r12b
mov r12, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x58]
jne 0x140028393
sub rbx, rdi
nop word cs:[rax + rax]
mov eax, dword [0x141dc08c0]
or eax, dword [0x141dc08c4]
add eax, 0x8379c954
shr eax, 1
imul rax, rax, 0x238d1227
shr rax, 0x3c
add eax, 0x61193c73
cmp eax, 0x6862c0af
ja 0x140028110
cmp r15d, esi
jae 0x1400281f8
mov eax, 0x8b1bd059
nop dword [rax + rax]
mov edx, dword [0x141dc08c8]
add edx, dword [0x141dc08cc]
imul edx, edx, 0xf2c5a86b
imul rdx, rax
shr rdx, 0x3b
cmp edx, 0x83ca8575
je 0x140028150
nop word cs:[rax + rax]
mov eax, dword [0x141dc08d0]
xor edx, edx
div dword [0x141dc08d4]
xor eax, 0x5d99c5c4
add eax, 0xbf707c31
cmp eax, 0x8f9aebcd
ja 0x140028180
test rbx, rbx
je 0x140028393
dec rbx
nop dword [rax + rax]
mov eax, dword [0x141dc08d8]
or eax, dword [0x141dc08dc]
or eax, 0xd6aef926
imul eax, eax, 0xb8036b8c
cmp eax, 0x97cde70b
je 0x1400281b0
add r15d, 0x3b9aca00
nop word cs:[rax + rax]
mov eax, dword [0x141dc08e0]
and eax, dword [0x141dc08e4]
or eax, 0xf4ffdbee
cmp eax, 0xb56392dc
je 0x1400281e0
sub r15d, esi
cmp r15d, 0x3b9aca00
jb 0x140028280
mov eax, r15d
shr eax, 9
imul rax, rax, 0x44b83
shr rax, 0x27
imul edx, eax, 0x3b9aca00
sub r15d, edx
nop
mov edx, dword [0x141dc08e8]
add edx, dword [0x141dc08ec]
imul edx, edx, 0xa7e63a85
and edx, 0x642640a8
cmp edx, 0xa97388fa
ja 0x140028220
mov eax, eax
add rbx, rax
jb 0x140028337
mov eax, 0xf83d1773
mov edx, dword [0x141dc08f0]
add edx, dword [0x141dc08f4]
imul edx, edx, 0x4c8d68ee
add edx, 0x654df368
imul rdx, rax
shr rdx, 0x3f
cmp edx, 0x4ea59b6
je 0x140028250
nop dword [rax + rax]
mov edx, dword [0x141dc0960]
or edx, dword [0x141dc0964]
or edx, 0xcb7fd5fe
cmp r15d, 0x3b9aca00
sete al
cmp rbx, 0x19
setb r8b
cmp edx, 0x107cd5dd
je 0x140028280
or al, r8b
jne 0x140028393
sub rsp, 0x20
mov rsi, rcx
call fcn.1400dcd30
add rsp, 0x20
cmp byte [rsi], 0x12
jne 0x1400282f5
mov eax, dword [str._Vl]
xor eax, dword [0x141dc0984]
xor eax, 0x403aa833
imul eax, eax, 0x2ee5c6d8
cmp eax, 0x5ed8bd6
mov rbx, qword [rbp - 0x30]
jae 0x1400284da
jmp 0x14002850e
ud2
ud2
ud2
mov eax, dword [0x141dc0968]
sub eax, dword [0x141dc096c]
add eax, 0x42589512
xor eax, 0x8fdc0341
mov ecx, 0xc0f9b8c3
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x1cc5e005
jne 0x1400283d0
sub rsp, 0x20
call fcn.1400becc0
add rsp, 0x20
nop dword [rax + rax]
mov esi, dword [0x141dc0970]
xor esi, dword [0x141dc0974]
or esi, 0xb7626bb8
add esi, 0x32c114f8
imul rax, rsi, 0x1b8500b9
shr rax, 0x20
sub esi, eax
shr esi, 1
add esi, eax
shr esi, 0x1f
sub rsp, 0x20
call fcn.1400becc0
add rsp, 0x20
cmp esi, 0x284df675
je 0x1400283d0
mov eax, 0xa80ddce3
nop word cs:[rax + rax]
mov ecx, dword [0x141dc0978]
imul ecx, dword [0x141dc097c]
add ecx, 0x9a51f18b
imul rcx, rax
shr rcx, 0x3e
cmp ecx, 0x4487be24
ja 0x140028420
jmp 0x140027438
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov eax, dword [0x141dc0870]
or eax, dword [0x141dc0874]
xor eax, 0x3a461e8b
mov ecx, 0x84009491
imul rcx, rax
shr rcx, 0x3c
or ecx, 0x4733bb7a
cmp ecx, 0xd49e0385
jne 0x1400284b1
jmp 0x1400284d6
mov eax, dword [0x141dc0948]
xor edx, edx
div dword [0x141dc094c]
add eax, 0xddf7c825
xor eax, 0x42012000
or eax, 0x9dfadbfa
cmp eax, 0x743d9a23
jne 0x14002864a
jmp 0x14002866f
mov eax, dword [0x141dc0878]
xor edx, edx
div dword [0x141dc087c]
add eax, 0x39e2ee43
xor eax, 0x2ef9dbe7
ud2
ud2
mov esi, dword [0x141dc0988]
sub esi, dword [0x141dc098c]
xor esi, 0x40002
and esi, 0x40072
sub rsp, 0x20
call fcn.14001e590
add rsp, 0x20
mov qword [rbx], 0
cmp esi, 0x540933ce
jne 0x140028524
sub rsp, 0x20
call fcn.14001e590
add rsp, 0x20
mov qword [rbx], 0
jmp 0x1400284da
mov rdi, qword [rbp - 0x38]
mov dword [rdi], 0
mov rsi, qword [rbp - 0x40]
mov qword [rsi], 0
mov dword [r12], 0
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov rdx, r12
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 7
mov r8, rbx
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x10
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 0x1f
mov r8, rdi
mov r9d, 4
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x10
call sub.KERNEL32.dll_GetCurrentProcess
sub rsp, 0x10
mov qword [rsp + 0x20], 0
mov rcx, rax
mov edx, 0x1e
mov r8, rsi
mov r9d, 8
call sub.ntdll.dll_NtQueryInformationProcess
add rsp, 0x30
cmp dword [r12], 0
jne 0x140028641
cmp qword [rbx], 0
jne 0x140028641
cmp dword [rdi], 0
je 0x140028641
cmp qword [rsi], 0
jne 0x140028641
nop word cs:[rax + rax]
mov eax, dword [0x141dc0990]
imul eax, dword [0x141dc0994]
add eax, 0x31bf721c
imul rax, rax, 0x37162d3
shr rax, 0x39
cmp eax, 0x55aaa404
je 0x140028600
sub rsp, 0x20
mov ecx, 0x80000001
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
call fcn.140028680
add rsp, 0x20
jmp 0x140027580
sub rsp, 0x20
call fcn.1400becc0
mov eax, dword [0x141dc0950]
xor edx, edx
div dword [0x141dc0954]
xor eax, 0xd73a163e
add eax, 0x965299bf
ud2
ud2