Function at 0x1401a3050
Capabilities:
Create pipe
Encode data using base64
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x20], xmm6
mov r9d, dword [0x1415c93a0]
sub r9d, dword [0x1415c93a4]
mov eax, r9d
and eax, 0x21ea206d
mov r10d, eax
not r10d
mov r8d, r9d
and r8d, 0x4a0029
and r10d, 0x79a1ed56
imul r10d, r8d
and r9d, 0x21a02044
or eax, 0x79a1ed56
imul eax, r9d
add eax, r10d
mov r8d, eax
not r8d
and r8d, 0x6b535930
mov r9d, eax
and r9d, 0x94aca6ce
imul r9d, r8d
mov r8d, eax
and r8d, 0x6b535930
or eax, 0x6b535930
imul eax, r8d
add eax, r9d
cmp eax, 0xbe77e52c
jae 0x1401a3160
mov eax, 0x20
call fcn.14021cf50
sub rsp, rax
mov eax, 0x10
call fcn.14021cf50
sub rsp, rax
mov eax, 0x20
call fcn.14021cf50
sub rsp, rax
mov eax, 0x30
call fcn.14021cf50
sub rsp, rax
mov eax, 0x10
call fcn.14021cf50
sub rsp, rax
mov eax, 0x10
call fcn.14021cf50
sub rsp, rax
mov eax, 0x20
call fcn.14021cf50
sub rsp, rax
mov eax, 0x30
call fcn.14021cf50
sub rsp, rax
mov eax, 0x20
call fcn.14021cf50
sub rsp, rax
mov qword [rbp - 0x38], rcx
nop word cs:[rax + rax]
mov ecx, dword [0x1415c93a8]
imul ecx, dword [0x1415c93ac]
mov eax, ecx
not eax
or eax, 0x5f030
and eax, 0x2445f939
and ecx, 0xd3b206c0
or ecx, eax
xor ecx, 0x8d911989
mov eax, 0x20
call fcn.14021cf50
sub rsp, rax
mov r10, rsp
mov eax, 0x10
call fcn.14021cf50
sub rsp, rax
mov r12, rsp
mov eax, 0x20
call fcn.14021cf50
sub rsp, rax
mov r8, rsp
mov eax, 0x30
call fcn.14021cf50
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.14021cf50
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.14021cf50
sub rsp, rax
mov r11, rsp
mov eax, 0x20
call fcn.14021cf50
sub rsp, rax
mov rsi, rsp
mov eax, 0x30
call fcn.14021cf50
sub rsp, rax
mov rdi, rsp
mov eax, 0x20
call fcn.14021cf50
sub rsp, rax
mov rax, rsp
cmp ecx, 0x13914acf
jb 0x1401a3170
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x20], r11
mov qword [rbp], r10
mov qword [rbp - 0x70], r8
mov byte [rbp + 0x1f], dl
movzx eax, dl
mov ecx, 0x40080002
sub ecx, eax
mov dword [rbp - 0x2c], ecx
mov dword [rbp + 0xc], 8
mov al, 1
mov dword [rbp + 0x10], eax
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, 0xbb6ef293
xorps xmm6, xmm6
mov r13, qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x68], r9
mov qword [rbp - 0x58], r15
nop dword [rax]
mov eax, dword [0x1415c93b0]
xor edx, edx
div dword [0x1415c93b4]
xor eax, 0x67957952
imul rax, rax, 0x78cdfadd
shr rax, 0x3e
cmp eax, 0xa7e5c4ae
mov r15, qword [rbp - 0x20]
je 0x1401a36b0
nop dword [rax]
mov esi, dword [str.x_lN]
or esi, dword [0x1415c93bc]
xor esi, 0x66c042b1
sub rsp, 0x20
call rdi
add rsp, 0x20
mov dword [r15], eax
mov rax, qword [0x1415d3920]
cmp esi, 0x7ace3605
ja 0x1401a36b0
test rax, rax
mov edi, 0x82e908fb
lea r14, [0x1400c8d10]
jne 0x1401a3406
nop word [rax + rax]
mov eax, dword [0x1415c93c4]
mov ecx, eax
xor ecx, ecx
not ecx
and ecx, dword [0x1415c93c0]
xor ecx, eax
imul rcx, rbx
shr rcx, 0x3f
imul eax, ecx, 0x4f1c16e7
cmp eax, 0x2800e4da
jne 0x1401a3360
movups xmmword [r12], xmm6
sub rsp, 0x20
mov edx, 0x10
mov rcx, r12
call r13
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x1415c93c8]
add eax, dword [0x1415c93cc]
and eax, 0x30db33eb
lea ecx, [rax + 0x11b38c2f]
mov edx, ecx
and edx, 0x3114a388
xor ecx, 0xc2eb5c77
lea esi, [rax + rcx]
add esi, 0x11b38c2f
sub esi, edx
movups xmmword [r12], xmm6
sub rsp, 0x20
mov edx, 0x10
mov rcx, r12
call r13
add rsp, 0x20
cmp esi, 0x37871a08
je 0x1401a3360
mov rax, qword [r12]
mov qword [0x1415d3920], rax
mov rcx, qword [0x1415d3920]
nop word cs:[rax + rax]
mov eax, dword [0x1415c93d0]
xor edx, edx
div dword [0x1415c93d4]
or eax, 0xb92b7c80
mov edx, eax
xor edx, 0x8924d0bd
and edx, eax
imul rdx, rdi
shr rdx, 0x3d
cmp edx, 0x8f9c9ef1
je 0x1401a33d0
test rcx, rcx
je 0x1401a3310
mov eax, dword [0x1415c93d8]
imul eax, dword [0x1415c93dc]
imul eax, eax, 0x26a6d369
lea ecx, [rax - 0x1f86b094]
mov edx, ecx
and edx, 0x1b4acac4
xor ecx, 0xe4b5353b
add eax, ecx
add eax, 0xe0794f6c
sub eax, edx
cmp eax, 0x979b5aa4
jne 0x1401a34ab
mov eax, 1
lock xadd qword [0x1415d3920], rax
mov rdx, qword [rbp - 0x58]
mov qword [rdx], rax
mov rax, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x50]
mov qword [rcx], rax
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], rdx
lea rax, [0x1400bea50]
mov qword [rcx + 0x18], rax
mov rdx, qword [rbp - 0x48]
lea rax, [0x14159ecb0]
mov qword [rdx], rax
mov qword [rdx + 8], 2
mov qword [rdx + 0x20], 0
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], 2
sub rsp, 0x20
mov rcx, qword [rbp - 0x18]
call fcn.14008e840
add rsp, 0x20
mov rax, qword [rbp - 0x40]
inc eax
mov dword [rbp - 0x30], eax
mov r15, qword [rbp - 0x20]
mov rdi, qword [rbp - 0x50]
mov r13, qword [rbp - 0x48]
mov rbx, qword [rbp - 0x18]
mov r14, qword [rbp - 0x58]
nop dword [rax + rax]
mov eax, dword [0x1415c93e4]
not eax
add eax, dword [0x1415c93e0]
imul esi, eax, 0x1bd26d58
mov eax, 1
lock xadd qword [0x1415d3920], rax
add esi, 0xe56445a
or esi, 0x74ee05ab
mov qword [r14], rax
mov qword [rdi], r15
lea rax, [0x1400c8d10]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], r14
lea rax, [0x1400bea50]
mov qword [rdi + 0x18], rax
lea rax, [0x14159ecb0]
mov qword [r13], rax
mov qword [r13 + 8], 2
mov qword [r13 + 0x20], 0
mov qword [r13 + 0x10], rdi
mov qword [r13 + 0x18], 2
sub rsp, 0x20
mov rcx, rbx
mov rdx, r13
call fcn.14008e840
add rsp, 0x20
cmp esi, 0xaf25c3c8
jb 0x1401a34d0
cmp qword [rbp - 8], 0
sete al
mov ecx, dword [rbp + 0x10]
or cl, al
test cl, 1
mov r14d, 0x81515797
mov r15, qword [rbp - 0x10]
jne 0x1401a36d0
mov eax, dword [0x1415c9550]
xor edx, edx
div dword [0x1415c9554]
mov eax, dword [str._mZNUy]
add eax, dword [0x1415c955c]
imul rax, rax, 0x5dbb2971
shr rax, 0x3d
cmp eax, 0xbe42cbb0
je 0x1401a3592
mov eax, dword [0x1415c9560]
or eax, dword [0x1415c9564]
mov ecx, eax
xor ecx, 0x2c901010
xor eax, 0x516fe58f
mov edx, eax
and edx, 0x824deaea
and ecx, 0x7db21515
imul ecx, edx
mov edx, eax
and edx, 0x7db21515
or eax, 0x7db21515
imul eax, edx
add eax, ecx
cmp eax, 0xcda3d2d0
jae 0x1401a3600
mov rax, qword [0x1415d3918]
nop word [rax + rax]
mov eax, dword [0x1415c9568]
xor eax, dword [0x1415c956c]
mov ecx, eax
xor ecx, 0x200410c0
xor eax, 0x98500000
and eax, 0xd8f28703
and ecx, 0x270d78fc
sub ecx, eax
mov eax, ecx
not eax
or ecx, 0x8d5a3c99
or eax, 0x72a5c366
and eax, ecx
mov rsi, qword [0x1415d3918]
cmp eax, 0x8ab3e2bd
je 0x1401a3600
mov ecx, dword [0x1415c9570]
mov eax, dword [0x1415c9574]
mov edx, eax
not edx
and edx, ecx
xor eax, ecx
add eax, ecx
sub eax, edx
add eax, 0x969ed972
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x2f0deea9
and ecx, 0xd0f21156
imul ecx, edx
mov edx, eax
and edx, 0xd0f21156
or eax, 0xd0f21156
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0x2720b893
or eax, 0xd8df476c
and eax, ecx
cmp eax, 0xcefd68fd
jbe 0x1401a4730
jmp 0x1401a4790
sub rsp, 0x20
call rdi
add rsp, 0x20
mov dword [r15], eax
mov rax, qword [0x1415d3920]
jmp 0x1401a32c0
mov eax, dword [0x1415c93e8]
add eax, dword [0x1415c93ec]
mov ecx, eax
not ecx
or ecx, 0x2aa88
and ecx, 0xc2aba98
mov edx, eax
and edx, 0x52954125
or edx, ecx
xor edx, 0x498cda1e
and eax, 0x44a44004
or eax, edx
mov ecx, eax
not ecx
and ecx, 0x2494c704
mov edx, eax
and edx, 0x5b2b1033
imul edx, ecx
mov ecx, eax
and ecx, 0x4946184
or eax, 0x2494e784
imul eax, ecx
add eax, edx
cmp eax, 0x626e872e
jb 0x1401a36d0
mov rax, qword [rbp - 0x18]
mov r11, qword [rax]
mov r10, qword [rax + 8]
mov rax, qword [rax + 0x10]
lea rcx, [r10 + rax]
mov qword [rbp - 0x28], rcx
test rax, rax
mov qword [rbp - 0x10], r10
mov qword [rbp - 8], r11
mov qword [rbp - 0x78], rax
je 0x1401a37e0
mov eax, dword [0x1415c93f0]
add eax, dword [0x1415c93f4]
imul eax, eax, 0x892678e4
cmp eax, 0x29a83f0f
je 0x1401a375d
lea r15, [r10 + 1]
movzx edi, byte [r10]
mov eax, dword [0x1415c93f8]
sub eax, dword [0x1415c93fc]
mov ecx, eax
and ecx, 0x1f6d6a59
add ecx, ecx
neg ecx
add eax, ecx
add eax, 0x1f6d6a59
or eax, 0x95edcdef
cmp eax, 0x4b1c495d
jb 0x1401a377e
test dil, dil
js 0x1401a3800
nop
mov eax, dword [0x1415c9410]
sub eax, dword [0x1415c9414]
imul eax, eax, 0x94111ecf
imul rax, rax, 0x10114ba7
shr rax, 0x3c
xor eax, 0x6874b32b
neg eax
cmp eax, 0x6153bc63
jbe 0x1401a37b0
jmp 0x1401a3a20
mov r15d, 4
mov esi, 8
xor eax, eax
mov qword [rbp - 0x60], rax
xor r13d, r13d
xor edi, edi
xor eax, eax
jmp 0x1401a3a76
mov eax, edi
and eax, 0x1f
lea r15, [r10 + 2]
movzx ecx, byte [r10 + 1]
mov edx, dword [0x1415c9400]
sub edx, dword [0x1415c9404]
mov r8d, edx
and r8d, 0x7218236a
add r8d, r8d
neg r8d
add edx, r8d
add edx, 0x9be12023
imul rdx, rdx, 0x2c5e0419
shr rdx, 0x3d
cmp edx, 0xd6357834
ja 0x1401a380e
mov edx, eax
shl edx, 6
nop dword [rax + rax]
mov r8d, dword [0x1415c9408]
imul r8d, dword [0x1415c940c]
and r8d, 0xb64f4881
xor r8d, 0x45471181
cmp r8d, 0xa564bc24
ja 0x1401a3850
and ecx, 0x3f
cmp dil, 0xdf
jbe 0x1401a39d5
nop word cs:[rax + rax]
mov edx, dword [0x1415c9418]
mov r8d, dword [0x1415c941c]
mov r9d, r8d
not r9d
and r9d, edx
xor r8d, edx
add r8d, edx
sub r8d, r9d
add r8d, 0x91844a81
and r8d, 0xd3690695
xor r8d, 0x12480280
cmp r8d, 0x15df9bda
ja 0x1401a3890
lea r15, [r10 + 3]
movzx edx, byte [r10 + 2]
shl ecx, 6
mov r8d, edx
xor r8b, 0xc0
and r8b, dl
movzx edx, r8b
or edx, ecx
mov ecx, eax
shl ecx, 0xc
nop
mov r8d, dword [0x1415c9420]
or r8d, dword [0x1415c9424]
imul r8, r8, 0x1c7c4f0b
mov r9, r8
shr r9, 0x3b
not r9d
and r9d, 0x9d99f3ea
bt r8, 0x3b
mov r8d, 0
adc r8d, 0x4237f78d
sub r8d, r9d
cmp r8d, 0xa5957687
ja 0x1401a38f0
cmp dil, 0xf0
jb 0x1401a39e9
lea r15, [r10 + 4]
movzx ecx, byte [r10 + 3]
and eax, 7
shl eax, 0x12
shl edx, 6
and ecx, 0x3f
mov esi, 0x9b537dbd
nop dword [rax + rax]
mov r8d, dword [0x1415c9428]
mov r9d, r8d
not r9d
or r9d, dword [str.jHe]
add r8d, r9d
inc r8d
and r8d, 0xbf95e600
imul r8d, r8d, 0xbbfbec17
imul r8, rsi
shr r8, 0x3f
cmp r8d, 0xc6c3d54b
ja 0x1401a3960
or edx, ecx
mov edi, edx
not edi
mov ecx, eax
not ecx
mov r8d, edi
and r8d, 0xbb8b9bbb
and edx, 0x6444
or edx, r8d
or edi, ecx
and ecx, 0xbb8b9bbb
and eax, 0x146444
or eax, ecx
xor eax, edx
not edi
or edi, eax
cmp edi, 0xffff
ja 0x1401a39f5
jmp 0x1401a3a20
mov eax, edx
not eax
or edx, ecx
not ecx
and ecx, eax
not edx
or edx, ecx
not edx
mov edi, edx
jmp 0x1401a3a20
or edx, ecx
mov edi, edx
cmp edi, 0xffff
jbe 0x1401a3a20
lea ecx, [rdi + 0xff0000]
shr ecx, 0xa
or ecx, 0xd800
and edi, 0x3ff
or edi, 0xdc00
mov eax, 2
mov r8d, edi
mov edi, ecx
jmp 0x1401a3a28
mov eax, 1
xor r8d, r8d
mov rcx, qword [rbp - 0x28]
mov r13, r15
sub rcx, r15
add rcx, 3
mov rdx, 0xffffffffffffffff
cmovb rcx, rdx
shr rcx, 2
lea rdx, [rax + rcx]
lea r15, [rax + rcx]
inc r15
cmp rdx, 3
mov eax, 4
cmovb r15, rax
mov rax, r15
shr rax, 0x3e
jne 0x1401a48fd
mov qword [rbp - 0x60], r8
lea rsi, [r15 + r15]
mov ax, 1
mov qword [rbp + 0x10], rax
mov eax, dword [0x1415c9448]
or eax, dword [0x1415c944c]
and eax, 0xd1141899
imul rcx, rax, 0x204ae645
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
xor eax, 0x233fd129
cmp eax, 0xba1a43c3
jbe 0x1401a3ac4
movzx eax, byte [0x1415d3950]
sub rsp, 0x20
xor ecx, ecx
mov rdx, rsi
call fcn.1401b5e70
add rsp, 0x20
xor ebx, ebx
nop word cs:[rax + rax]
movzx eax, byte [0x1415d3950]
sub rsp, 0x20
xor ecx, ecx
mov rdx, rsi
call fcn.1401b5e70
add rsp, 0x20
test bl, bl
jne 0x1401a3ad0
mov rcx, rax
test rax, rax
je 0x1401a48ac
mov word [rcx], di
mov edx, dword [0x1415c9460]
mov eax, dword [0x1415c9464]
xor eax, edx
not eax
and eax, edx
mov edx, eax
not edx
and edx, 0xde81a12b
mov r8d, eax
and r8d, 0x217e5ed4
imul r8d, edx
mov edx, eax
and edx, 0xde81a12b
or eax, 0xde81a12b
imul eax, edx
add eax, r8d
mov edx, eax
or edx, 0x68024660
not eax
and eax, 0x81440000
and edx, 0x6a8b5e60
or edx, eax
cmp edx, 0x8e2ca094
mov rsi, qword [rbp]
mov r10d, 0xc6d59219
mov r11d, 0x8c4301d9
je 0x1401a4340
nop dword [rax]
mov eax, dword [0x1415c9468]
add eax, dword [str.bbzs]
and eax, 0x7fffffff
xor eax, 0x7562b51b
add eax, 0x72a62f8f
and eax, 0x5306d5f2
mov qword [rsi], r15
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], 1
cmp eax, 0xfce4ba8f
ja 0x1401a4340
mov rbx, qword [rbp - 0x60]
nop
mov eax, dword [0x1415c9470]
sub eax, dword [0x1415c9474]
and eax, 0xa47cbad2
imul rax, rax, 0x61e013b7
shr rax, 0x3c
and eax, 0xfffffffe
cmp eax, 0x3b74f594
ja 0x1401a3bb0
mov edi, 1
mov r15, r13
jmp 0x1401a3bee
mov ebx, eax
mov word [rcx + rdi*2], r13w
inc rdi
mov qword [rsi + 0x10], rdi
test r15, r15
je 0x1401a3e10
nop word [rax + rax]
mov eax, dword [0x1415c9478]
xor eax, dword [0x1415c947c]
mov edx, eax
not edx
and edx, 0x400ca0b
and eax, 0xfbff35f4
sub eax, edx
xor eax, 0xd1736d55
add eax, 0xca7022d8
cmp eax, 0x88065a88
jb 0x1401a3c00
nop
mov eax, dword [0x1415c9480]
mov edx, dword [0x1415c9484]
mov r8d, eax
and r8d, edx
xor eax, edx
lea eax, [rax + r8*2]
mov edx, eax
xor edx, 0x3b6e07b9
add edx, eax
and eax, 0xc491f846
sub edx, eax
mov eax, edx
and eax, 0x338b511f
add eax, eax
neg eax
add eax, edx
add eax, 0x338b511f
imul rax, r14
shr rax, 0x3f
cmp eax, 0xae83e11d
je 0x1401a3c30
test bx, bx
je 0x1401a3c90
xor eax, eax
mov r13d, ebx
jmp 0x1401a41b0
mov eax, dword [0x1415c9488]
add eax, dword [0x1415c948c]
or eax, 0xdaf4f633
imul eax, eax, 0xc06312
add eax, 0x55876ee8
cmp eax, 0xb651b536
jb 0x1401a3c90
nop word cs:[rax + rax]
mov eax, dword [0x1415c9490]
imul eax, dword [0x1415c9494]
or eax, 0x92a0aeb9
imul rax, r11
shr rax, 0x3b
or eax, 0x69ba1109
cmp eax, 0x503e6de0
je 0x1401a3cc0
cmp r15, qword [rbp - 0x28]
je 0x1401a3e10
mov edx, dword [str.9P_nJ]
mov eax, edx
xor eax, edx
not eax
and eax, dword [0x1415c9498]
xor eax, edx
mov edx, eax
not edx
mov r8d, eax
and r8d, 0xc70b0cca
and edx, 0x38f4f335
imul edx, r8d
mov r8d, eax
and r8d, 0x38f4f335
or eax, 0x38f4f335
imul eax, r8d
add eax, edx
mov edx, eax
xor edx, 0x7d27363c
xor eax, 0x45cfbc28
add eax, edx
and edx, 0xc71775eb
sub eax, edx
cmp eax, 0xa7aa2
jb 0x1401a3cf0
lea r9, [r15 + 1]
nop word cs:[rax + rax]
mov edx, dword [0x1415c94a0]
mov eax, dword [0x1415c94a4]
mov r8d, edx
xor r8d, eax
not r8d
and r8d, eax
add r8d, r8d
sub eax, r8d
add eax, edx
mov edx, eax
xor edx, 0x41b0199f
or eax, 0xbe4fe660
and eax, edx
mov edx, eax
and edx, 0x1c1da4c6
xor edx, 0x18050486
and eax, 0x18050486
or eax, edx
or eax, 0xe3e25b39
cmp eax, 0xf62da1f6
jb 0x1401a3d60
movzx r8d, byte [r15]
test r8b, r8b
js 0x1401a3edb
mov eax, dword [0x1415c94a8]
add eax, dword [0x1415c94ac]
imul eax, eax, 0xd072e9a4
add eax, 0xac583d83
and eax, 0x3aedef2b
cmp eax, 0x3babc82
je 0x1401a3dbd
mov eax, dword [0x1415c94b0]
sub eax, dword [0x1415c94b4]
add eax, 0x389092bd
or eax, 0x8767f31c
cmp eax, 0xf6844afc
je 0x1401a3de0
jmp 0x1401a41a7
mov eax, dword [0x1415c9510]
or eax, dword [0x1415c9514]
imul eax, eax, 0x2baccc40
xor eax, 0x9c6c7d7c
add eax, 0xf59fa606
jae 0x1401a3e10
mov rsi, qword [rsi]
nop word cs:[rax + rax]
mov eax, dword [0x1415c9518]
mov edx, eax
not edx
or edx, dword [0x1415c951c]
add eax, edx
add eax, 0x1695f0cc
mov edx, eax
and edx, 0x69cfd0e6
add edx, edx
sub eax, edx
add eax, 0xe9cfd0e6
xor eax, 0x46da5015
cmp eax, 0x508a6802
jb 0x1401a3e40
cmp word [rbp + 0x10], 1
jne 0x1401a4360
nop
mov eax, dword [0x1415c9528]
sub eax, dword [0x1415c952c]
imul rax, r10
shr rax, 0x3f
or eax, 0x9de3e70a
mov edx, eax
xor edx, 0xfb379d88
and eax, 0x4c06203
add eax, eax
sub eax, edx
cmp eax, 0x24206756
jb 0x1401a3e80
xor r13d, r13d
mov r15d, 0
mov eax, 0
mov qword [rbp + 0x10], rax
mov r8d, 0
cmp rdi, rsi
mov rsi, qword [rbp]
jne 0x1401a3be2
jmp 0x1401a430d
mov r10d, r8d
and r10d, 0x1f
movzx r11d, byte [r15 + 1]
and r11d, 0x3f
cmp r8b, 0xdf
jbe 0x1401a404f
mov eax, dword [0x1415c94b8]
xor edx, edx
div dword [0x1415c94bc]
nop word cs:[rax + rax]
mov eax, dword [0x1415c94c0]
or eax, dword [0x1415c94c4]
imul rax, rax, 0xfe2dc79
shr rax, 0x39
cmp eax, 0xed05c46a
je 0x1401a3f10
nop
mov eax, dword [0x1415c94cc]
not eax
add eax, dword [0x1415c94c8]
imul eax, eax, 0x99043a94
add eax, 0x9da98060
cmp eax, 0xf53803e
jb 0x1401a3f30
lea r9, [r15 + 3]
movzx eax, byte [r15 + 2]
shl r11d, 6
mov esi, eax
xor sil, 0xc0
and sil, al
mov eax, dword [0x1415c94d0]
xor edx, edx
div dword [0x1415c94d4]
mov eax, dword [0x1415c94d8]
sub eax, dword [0x1415c94dc]
mov edx, eax
xor edx, 0xf4284d3e
and eax, 0xbd7b2c1
add eax, eax
sub eax, edx
mov edx, eax
not edx
or edx, 0x292100
and edx, 0x886d6714
and eax, 0x141098c8
sub eax, edx
cmp eax, 0x19d235d8
jb 0x1401a3f74
movzx eax, sil
or r11d, eax
cmp r8b, 0xf0
jb 0x1401a4071
movzx r8d, byte [r15 + 3]
add r15, 4
and r10d, 7
shl r10d, 0x12
shl r11d, 6
and r8d, 0x3f
lea eax, [r11 + r8]
not r11d
not r8d
and r8d, r11d
not r8d
and r8d, eax
or r8d, r10d
mov rsi, qword [rbp]
nop word cs:[rax + rax]
mov eax, dword [0x1415c94e0]
xor edx, edx
div dword [0x1415c94e4]
xor eax, 0xb4a672bf
add eax, 0xe2add5c
mov edx, eax
not edx
and edx, 0x2cefe354
mov r9d, eax
and r9d, 0xd3101cab
imul r9d, edx
mov edx, eax
and edx, 0x2cefe354
or eax, 0x2cefe354
imul eax, edx
add eax, r9d
cmp eax, 0x5f295ab6
jb 0x1401a4000
mov r9, r15
jmp 0x1401a407f
add r15, 2
shl r10d, 6
or r10d, r11d
mov r9, r15
mov r8d, r10d
mov r10d, 0xc6d59219
mov r11d, 0x8c4301d9
jmp 0x1401a41a7
shl r10d, 0xc
or r11d, r10d
mov r8d, r11d
mov rsi, qword [rbp]
mov r11d, 0x8c4301d9
mov eax, dword [0x1415c94e8]
or eax, dword [0x1415c94ec]
mov edx, eax
and edx, 0x37b64c2e
add edx, edx
neg edx
add eax, edx
add eax, 0x37b64c2e
mov edx, eax
xor edx, 0x5a526ef7
xor eax, 0x212c1100
and eax, 0x617c37f6
mov r10d, edx
and r10d, 0x9e83c809
imul r10d, eax
mov eax, edx
and eax, 0x617c37f6
or edx, 0x617c37f6
imul edx, eax
add edx, r10d
cmp edx, 0x2ec7e9bc
jb 0x1401a4085
cmp r8d, 0xffff
jbe 0x1401a41a1
mov eax, dword [0x1415c94f0]
xor edx, edx
div dword [0x1415c94f4]
nop word [rax + rax]
mov eax, dword [0x1415c94f8]
sub eax, dword [0x1415c94fc]
add eax, 0x97c94e04
and eax, 0x7749f322
add eax, 0x358cc387
cmp eax, 0x3a92128b
jb 0x1401a4100
lea r10d, [r8 + 0xff0000]
mov eax, dword [0x1415c9500]
xor edx, edx
div dword [0x1415c9504]
xor eax, eax
nop dword [rax]
test al, al
jne 0x1401a4140
shr r10d, 0xa
mov edx, dword [0x1415c9508]
imul edx, dword [0x1415c950c]
mov eax, edx
xor eax, 0x104002
or edx, 0x1010000
and edx, eax
or edx, 0xaa62201
and edx, 0xbb76203
mov r13d, r10d
or r13d, 0xd800
mov eax, r8d
not eax
or eax, 0x3ff
add eax, r8d
inc eax
or eax, 0xdc00
cmp edx, 0x61fe8504
ja 0x1401a4148
mov r15, r9
mov r10d, 0xc6d59219
jmp 0x1401a41b0
mov r10d, 0xc6d59219
xor eax, eax
mov r15, r9
mov r13d, r8d
nop
mov edx, dword [0x1415c9520]
mov r8d, dword [0x1415c9524]
mov r9d, edx
and r9d, r8d
add r9d, r9d
add edx, r8d
sub edx, r9d
mov r8d, edx
not r8d
mov r9d, edx
and r9d, 0x45ad1644
and r8d, 0xba52e9bb
imul r8d, r9d
mov r9d, edx
and r9d, 0xba52e9bb
or edx, 0xba52e9bb
imul edx, r9d
add edx, r8d
mov r8d, edx
xor r8d, 0x6da9ecfe
and edx, 0x12561301
add edx, edx
sub edx, r8d
mov r8d, edx
and r8d, 0x7bf3d94d
add r8d, r8d
neg r8d
add edx, r8d
add edx, 0xfbf3d94d
cmp edx, 0x9257ee25
jb 0x1401a41b0
cmp rdi, qword [rsi]
jne 0x1401a3be0
mov r8, qword [rbp - 0x28]
sub r8, r15
add r8, 3
mov rcx, 0xffffffffffffffff
cmovb r8, rcx
shr r8, 2
xor ecx, ecx
test ax, ax
setne cl
mov edx, dword [0x1415c9530]
mov r9d, dword [0x1415c9534]
mov r10d, edx
not r10d
and r10d, r9d
mov r11d, r9d
not r11d
and r11d, edx
imul r11d, r10d
mov r10d, edx
and r10d, r9d
or edx, r9d
imul edx, r10d
add edx, r11d
add edx, 0x8b1c4393
or edx, 0x827f461
cmp edx, 0xdd3f3640
ja 0x1401a4263
add r8, rcx
movzx ecx, word [rbp + 0x10]
nop word cs:[rax + rax]
mov edx, dword [0x1415c9538]
mov r9d, dword [0x1415c953c]
mov r10d, edx
not r10d
and r10d, r9d
not r9d
and r9d, edx
sub r9d, r10d
mov edx, r9d
and edx, 0x74a52f4b
or r9d, 0x74a52f4b
add r9d, edx
and r9d, 0x9ae69e46
imul edx, r9d, 0x4741622d
cmp edx, 0xab2ae342
jae 0x1401a42c0
add r8, rcx
mov ebx, eax
inc r8
sub rsp, 0x20
mov rcx, rsi
mov rdx, rdi
call fcn.1402569f0
mov r11d, 0x8c4301d9
mov r10d, 0xc6d59219
add rsp, 0x20
mov rcx, qword [rsi + 8]
jmp 0x1401a3be2
mov qword [rsi], r15
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], 1
jmp 0x1401a3b70
mov eax, dword [0x1415c9540]
and eax, dword [0x1415c9544]
imul rax, rax, 0x4b0141ef
shr rax, 0x3e
imul eax, eax, 0x7e548dc7
mov ecx, eax
xor ecx, 0xf04e1f49
or eax, 0xfb1e0b6
and eax, ecx
cmp eax, 0xfee5f6ad
mov rdi, qword [rbp]
mov ebx, dword [rbp + 0xc]
mov r15d, dword [rbp - 0x2c]
je 0x1401a46e0
nop word cs:[rax + rax]
mov eax, dword [0x1415c9548]
sub eax, dword [0x1415c954c]
imul r13d, eax, 0xc7c2ae24
mov eax, r13d
not eax
and eax, 0x19a4fc75
mov ecx, r13d
and ecx, 0x65b0388
imul ecx, eax
mov eax, r13d
and eax, 0x19a4fc74
or r13d, 0x19a4fc75
imul r13d, eax
add r13d, ecx
not r13d
or r13d, 0xec4fc1fe
mov r14, qword [rdi + 8]
sub rsp, 0x40
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
mov rcx, r14
mov edx, r15d
mov r8d, ebx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
add rsp, 0x40
cmp r13d, 0x24b2fadb
jb 0x1401a46e0
cmp rax, 0xffffffffffffffff
mov qword [rbp + 0x10], rax
jne 0x1401a47db
sub rsp, 0x20
call sub.KERNEL32.dll_GetLastError
add rsp, 0x20
nop word cs:[rax + rax]
mov ecx, dword [0x1415c95c8]
xor ecx, dword [0x1415c95cc]
mov edx, ecx
not edx
mov r8d, ecx
and r8d, 0xb44ef589
and edx, 0x4bb10a76
imul edx, r8d
mov r8d, ecx
and r8d, 0x4bb10a76
or ecx, 0x4bb10a76
imul ecx, r8d
add ecx, edx
mov edx, ecx
not edx
and edx, 0x31e3c350
and ecx, 0xce1c3cae
sub ecx, edx
imul ecx, ecx, 0x454d65a
cmp ecx, 0x55fcb05c
ja 0x1401a4470
mov ecx, dword [rbp - 0x30]
cmp ecx, 0xa
mov r13, qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
mov r10d, dword [rbp + 0xc]
jge 0x1401a47a7
cmp eax, 5
jne 0x1401a4500
mov eax, ecx
mov qword [rbp - 0x40], rax
jmp 0x1401a45e0
mov ecx, dword [0x1415c9658]
sub ecx, dword [0x1415c965c]
mov edx, ecx
or edx, 0xf1902744
mov r8d, ecx
not r8d
and r8d, 0xe0f1813
mov r9d, edx
and r9d, 0xe060e7e8
imul r9d, r8d
and edx, 0x1f9f1817
or ecx, 0xff9f3f57
imul ecx, edx
add ecx, r9d
imul rcx, rcx, 0x6584e4db
shr rcx, 0x3e
cmp ecx, 0x83246caf
ja 0x1401a4500
test r10d, r10d
setne cl
cmp eax, 0x57
sete dl
xor r8d, r8d
test r8b, r8b
jne 0x1401a4554
and cl, dl
nop word [rax + rax]
mov r8d, dword [0x1415c9660]
mov edx, dword [0x1415c9664]
mov r9d, r8d
not r9d
and r9d, edx
not edx
and edx, r8d
sub edx, r9d
mov r8d, edx
or r8d, 0xec194cbb
mov r9d, edx
not r9d
and r9d, 0x12c22200
mov r10d, r8d
and r10d, 0x253dd9ed
imul r10d, r9d
and r8d, 0xdac22612
or edx, 0xfedb6ebb
imul edx, r8d
add edx, r10d
or edx, 0x34e484a1
cmp edx, 0x622b7766
jb 0x1401a4570
xor r10d, r10d
test cl, cl
je 0x1401a47a7
mov eax, dword [0x1415c9640]
xor eax, dword [0x1415c9644]
add eax, 0x88f241f5
mov ecx, eax
not ecx
or ecx, 0xc4255086
and ecx, 0xec2775b7
and eax, 0x11080a08
or eax, ecx
cmp eax, 0xd18ed2db
ja 0x1401a45e0
mov dword [rbp + 0xc], r10d
mov dword [rbp + 0x10], 0
test rsi, rsi
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, 0xbb6ef293
je 0x1401a3290
mov eax, dword [0x1415c9648]
sub eax, dword [0x1415c964c]
imul eax, eax, 0x7bed9c0
add eax, 0xb40748e3
imul rax, rax, 0x7e7f072f
shr rax, 0x3d
cmp eax, 0x86cc7df9
jbe 0x1401a4660
mov rax, qword [0x1415d3918]
nop
mov eax, dword [0x1415c9650]
mov ecx, dword [0x1415c9654]
mov edx, ecx
not edx
mov r8d, eax
and r8d, edx
or edx, eax
not edx
imul edx, r8d
mov r8d, eax
and r8d, ecx
or eax, ecx
imul eax, r8d
add eax, edx
mov edx, eax
xor edx, 0x9508d304
xor eax, 0x68862808
and eax, 0x6aa72829
and edx, 0x9558d7d6
or edx, eax
mov rcx, qword [0x1415d3918]
cmp edx, 0x3f92de6a
je 0x1401a4660
sub rsp, 0x20
mov dword [rbp + 0x10], 0
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x1401a3290
mov rcx, qword [rdi + 8]
sub rsp, 0x40
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
mov edx, r15d
mov r8d, ebx
mov r9d, 1
call fcn.14021c310
add rsp, 0x40
jmp 0x1401a43b0
mov edi, dword [0x1415c9578]
imul edi, dword [0x1415c957c]
add edi, 0xb225e8c9
mov eax, edi
or eax, 0xbf8d9aa1
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xc1b641b7
and ecx, 0x3e49be48
imul ecx, edx
and eax, 0x3e49be48
or edi, 0xbfcdbee9
imul edi, eax
add edi, ecx
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r15
call fcn.140219910
add rsp, 0x20
cmp edi, 0xc09429e8
jne 0x1401a36d0
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r15
call fcn.140219910
add rsp, 0x20
jmp 0x1401a4730
mov ecx, dword [0x1415c9630]
imul ecx, dword [0x1415c9634]
add ecx, 0xc9866f00
or ecx, 0xe3675a69
xor ecx, 0x7a736de8
cmp ecx, 0x6a2c282e
mov rdx, qword [rbp - 0x38]
jae 0x1401a50ff
jmp 0x1401a511b
mov r15, r14
mov r12, qword [rbp - 0x68]
nop word cs:[rax + rax]
mov eax, dword [0x1415c9580]
mov ecx, dword [0x1415c9584]
add eax, ecx
add eax, 0x951c94d2
xor eax, 0xe9ff8942
mov ecx, eax
and ecx, 0xc3a6d023
or eax, 0xc3a6d023
add eax, ecx
cmp eax, 0x3bae98d8
jb 0x1401a47f0
test rsi, rsi
mov r14, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x78]
je 0x1401a4a82
mov rbx, qword [0x1415d3918]
mov ecx, dword [0x1415c9588]
mov eax, dword [0x1415c958c]
mov edx, ecx
xor edx, eax
not edx
and edx, eax
add edx, edx
sub eax, edx
add eax, ecx
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x1247722e
and ecx, 0xedb88dd1
imul ecx, edx
mov edx, eax
and edx, 0xedb88dd1
or eax, 0xedb88dd1
imul eax, edx
add eax, ecx
mov ecx, eax
not ecx
or eax, 0xbf82b4c1
or ecx, 0x407d4b3e
and ecx, eax
not ecx
mov eax, ecx
and eax, 0x3aef078
add eax, eax
neg eax
add eax, ecx
add eax, 0x3aef078
cmp eax, 0xbcb4eaf3
jae 0x1401a49d0
jmp 0x1401a4a1e
mov eax, dword [0x1415c9450]
imul eax, dword [0x1415c9454]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0x8227688b
and ecx, 0x7dd89774
imul ecx, edx
mov edx, eax
and edx, 0x7dd89774
or eax, 0x7dd89774
imul eax, edx
add eax, ecx
imul eax, eax, 0xc99d9cc1
mov ecx, 0xb26a8b69
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x8c7183af
jbe 0x1401a493a
jmp 0x1401a4942
mov eax, dword [0x1415c9430]
mov ecx, dword [0x1415c9434]
mov edx, eax
and edx, ecx
add edx, edx
add eax, ecx
sub eax, edx
and eax, 0x573bea1d
xor eax, 0xeaeeb7fb
imul rcx, rax, 0x2d775e6d
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
cmp eax, 0x807f1492
jne 0x1401a4976
jmp 0x1401a499c
ud2
ud2
mov eax, dword [0x1415c9438]
mov ecx, dword [str._d9]
add eax, ecx
add eax, 0x36030223
xor eax, 0x5eb94fc3
add eax, 0x50aff0f6
ud2
ud2
mov eax, dword [0x1415c9590]
mov ecx, dword [0x1415c9594]
mov edx, eax
xor edx, ecx
not edx
or eax, ecx
and eax, edx
xor eax, 0xf6b8adb3
imul rax, rax, 0x10069fd3
shr rax, 0x3b
mov ecx, eax
xor ecx, 0xc65c23e7
lea esi, [rcx + rax*2]
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, r15
call fcn.140219910
add rsp, 0x20
cmp esi, 0x80364876
jae 0x1401a4a40
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
mov r8, r15
call fcn.140219910
add rsp, 0x20
jmp 0x1401a49d0
mov eax, dword [0x1415c9598]
mov ecx, dword [0x1415c959c]
not eax
not ecx
and ecx, eax
mov eax, ecx
not eax
and eax, 0x37316dea
xor ecx, 0xc8ce9215
lea eax, [rcx + rax*2]
mov ecx, eax
not ecx
or ecx, 0x212d0a
and ecx, 0xc1b13d5b
and eax, 0x280c82a4
or eax, ecx
cmp eax, 0xdb6b3ba9
ja 0x1401a4a40
mov eax, dword [0x1415c95a0]
add eax, dword [0x1415c95a4]
mov ecx, eax
not ecx
mov edx, eax
and edx, 0xa4d03719
and ecx, 0x5b2fc8e6
imul ecx, edx
mov edx, eax
and edx, 0x5b2fc8e6
or eax, 0x5b2fc8e6
imul eax, edx
add eax, ecx
mov ecx, 0x8a1c1bb7
imul rcx, rax
shr rcx, 0x3f
not ecx
and ecx, 0x701e9c05
xor ecx, 0xb3cdf1c5
cmp ecx, 0xe1dad117
movzx r10d, byte [rbp + 0x1f]
jbe 0x1401a4b26
mov qword [r12 + 0x10], 0
mov dword [r12], 0
mov qword [r12 + 0x1c], 0
mov word [r12 + 0x24], 0
mov byte [r12 + 0x21], r10b
mov eax, r10d
xor al, 1
mov byte [r12 + 0x20], al
mov dword [r12 + 0x18], 0
mov dword [r14], 0x18
mov qword [r14 + 8], 0
mov eax, r10d
xor al, 1
mov r15, qword [rbp - 0x10]
mov rbx, qword [rbp - 0x38]
nop word cs:[rax + rax]
mov ecx, dword [0x1415c95a8]
mov edx, dword [0x1415c95ac]
mov r8d, edx
not r8d
mov r9d, ecx
and r9d, r8d
or r8d, ecx
not r8d
imul r8d, r9d
mov r9d, ecx
and r9d, edx
or ecx, edx
imul ecx, r9d
add ecx, r8d
imul ecx, ecx, 0xcb4271f7
mov edx, ecx
xor edx, 0x763fe024
and edx, ecx
add edx, 0x21cbce36
mov qword [r12 + 0x10], 0
mov dword [r12], 0
mov qword [r12 + 0x1c], 0
mov word [r12 + 0x24], 0
mov byte [r12 + 0x21], r10b
mov byte [r12 + 0x20], al
mov dword [r12 + 0x18], 0
mov dword [r14], 0x18
mov qword [r14 + 8], 0
cmp edx, 0x422a89df
ja 0x1401a4b40
mov eax, dword [0x1415c95b0]
imul eax, dword [0x1415c95b4]
add eax, 0x866253b0
mov ecx, 0xc10f2d05
imul rcx, rax
shr rcx, 0x3d
cmp ecx, 0x6a14563
ja 0x1401a4c54
mov eax, dword [0x1415c95b8]
xor edx, edx
div dword [0x1415c95bc]
mov esi, eax
add esi, 0xc01d866e
mov eax, esi
and eax, 0xc39ff4ca
or esi, 0xc39ff4ca
add esi, eax
and esi, 0x9dafff53
mov dword [r14 + 0x10], 1
mov qword [r12 + 8], r14
sub rsp, 0x20
mov rcx, r15
mov rdx, rdi
mov r8, r12
call fcn.14021be50
add rsp, 0x20
cmp esi, 0x2d2bdab
jae 0x1401a4c79
mov dword [r14 + 0x10], 1
mov qword [r12 + 8], r14
sub rsp, 0x20
mov rcx, r15
mov rdx, rdi
mov r8, r12
call fcn.140157d40
add rsp, 0x20
jmp 0x1401a4bfe
mov rsi, qword [rbp - 8]
mov r9, qword [rbp + 0x10]
nop word cs:[rax + rax]
mov ecx, dword [0x1415c95c0]
imul ecx, dword [0x1415c95c4]
mov r8d, ecx
and r8d, 0xd9a54a64
or ecx, 0xd9a54a64
add ecx, r8d
imul ecx, ecx, 0xa620d93
cmp ecx, 0x3ceb587f
je 0x1401a4c90
test rax, rax
je 0x1401a4d48
nop word [rax + rax]
mov eax, dword [0x1415c95f8]
sub eax, dword [0x1415c95fc]
mov ecx, eax
and ecx, 0x48aeecf0
add ecx, ecx
neg ecx
add eax, ecx
add eax, 0x48aeecf0
xor eax, 0xedb3c8a2
imul eax, eax, 0xe7d2c413
cmp eax, 0xf2072c53
ja 0x1401a4cd0
mov qword [rbx + 8], rdx
mov qword [rbx], 1
nop dword [rax]
mov eax, dword [0x1415c9600]
mov ecx, dword [0x1415c9604]
mov edx, eax
and edx, ecx
or eax, ecx
not edx
and edx, eax
add edx, 0x4762669e
and edx, 0x5b443b9c
add edx, 0x675d8664
cmp edx, 0xdc2ab670
ja 0x1401a4d10
mov rbx, r9
jmp 0x1401a4f10
mov eax, dword [0x1415c95d0]
imul eax, dword [0x1415c95d4]
mov ecx, eax
xor ecx, 0x73070e2e
and ecx, eax
xor ecx, 0xc98425f2
imul rax, rcx, 0x3d675a75
shr rax, 0x20
sub ecx, eax
shr ecx, 1
add ecx, eax
shr ecx, 0x1f
cmp ecx, 0x695a57af
ja 0x1401a4dc9
mov eax, dword [0x1415c95d8]
or eax, dword [str.tkp]
mov ecx, 0xcb8879b1
imul rcx, rax
shr rcx, 0x3f
not ecx
and ecx, 0xa7d7713
xor ecx, 0xa9ddb6bd
imul rax, rcx, 0x7f813837
shr rax, 0x3e
mov qword [rbx + 8], r9
mov qword [rbx + 0x10], rdx
mov qword [rbx], 0
cmp eax, 0x2ed7249f
jne 0x1401a4de0
mov qword [rbx + 8], r9
mov qword [rbx + 0x10], rdx
mov qword [rbx], 0
jmp 0x1401a4d81
mov eax, dword [0x1415c95e0]
mov ecx, eax
not ecx
or ecx, dword [0x1415c95e4]
add ecx, eax
imul eax, ecx, 0xaee5afd3
add eax, 0xaee5afd3
mov ecx, eax
xor ecx, 0xc277b3eb
xor eax, 0x3d084810
or eax, 0xc2c03407
add eax, ecx
cmp eax, 0x118b0f79
je 0x1401a4de0
test rsi, rsi
je 0x1401a4eef
mov rsi, qword [0x1415d3918]
xor eax, eax
test al, al
jne 0x1401a4ea7
mov eax, dword [0x1415c95e8]
mov ecx, dword [0x1415c95ec]
mov edi, eax
not edi
mov edx, ecx
not edx
mov r8d, edi
and r8d, 0x310a7092
and eax, 0xc8800621
or eax, r8d
or edi, edx
and edx, 0x310a7092
and ecx, 0xc8800621
or ecx, edx
xor ecx, eax
not edi
or edi, ecx
or edi, 0x675894c
mov eax, edi
not eax
and eax, 0x53e0ca0d
and edi, 0x2c1f35f2
sub edi, eax
not edi
and edi, 0x4ed0f3aa
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp edi, 0x1a4c6dd5
jbe 0x1401a4ed0
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x1401a4e2e
mov eax, dword [0x1415c95f0]
xor edx, edx
div dword [0x1415c95f4]
or eax, 0x25c29a89
and eax, 0xa5d29a89
cmp eax, 0x91a2ddbb
ja 0x1401a4ed0
movaps xmm6, xmmword [rbp + 0x20]
lea rsp, [rbp + 0x38]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [0x1415c9608]
xor edx, edx
div dword [0x1415c960c]
shr eax, 5
imul rax, rax, 0x42fec7f
shr rax, 0x33
not eax
and eax, 0xc4a12241
cmp eax, 0x6c2b835c
jb 0x1401a4f10
test rsi, rsi
je 0x1401a5060
mov rsi, qword [0x1415d3918]
mov eax, dword [0x1415c9610]
mov ecx, dword [0x1415c9614]
not eax
not ecx
or ecx, eax
not ecx
and ecx, 0x70beb94d
imul eax, ecx, 0x64f75115
add eax, 0x53fd3a32
cmp eax, 0xc4d150d6
ja 0x1401a4fea
mov r14d, dword [0x1415c9618]
imul r14d, dword [0x1415c961c]
add r14d, 0x981c131a
mov eax, r14d
and eax, 0x318a38eb
or r14d, 0x318a38eb
add r14d, eax
mov eax, r14d
not eax
mov ecx, r14d
and ecx, 0xe3f2502
and eax, 0xf1c0dafd
imul eax, ecx
mov ecx, r14d
and ecx, 0xf1c0dafd
or r14d, 0xf1c0dafd
imul r14d, ecx
add r14d, eax
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp r14d, 0x8fee9a20
jbe 0x1401a5005
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x1401a4f76
mov r9, qword [rbp + 0x10]
nop dword [rax]
mov eax, dword [0x1415c9620]
mov ecx, dword [0x1415c9624]
not eax
not ecx
and ecx, eax
xor ecx, 0x7d2608a
mov eax, ecx
and eax, 0x67d264ca
mov edx, eax
not edx
and edx, 0x3e7aee9a
mov r8d, ecx
and r8d, 0x41800040
imul r8d, edx
and ecx, 0x2652648a
or eax, 0x3e7aee9a
imul eax, ecx
add eax, r8d
cmp eax, 0x71002085
jb 0x1401a5010
nop
mov eax, dword [0x1415c9628]
mov ecx, dword [0x1415c962c]
mov edx, eax
not edx
or edx, ecx
not ecx
or ecx, eax
not ecx
not edx
or edx, ecx
add edx, 0x11f45e13
mov eax, edx
not eax
or eax, 0x28888250
and eax, 0xec8ac370
and edx, 0x11142487
or edx, eax
cmp edx, 0x48c30ef5
ja 0x1401a5060
cmp r9, 0xffffffffffffffff
je 0x1401a4eef
sub rsp, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
nop dword [rax + rax]
mov eax, dword [0x1415c9668]
xor edx, edx
div dword [0x1415c966c]
mov ecx, eax
not ecx
or ecx, 0xba815ad2
add eax, ecx
add eax, 0xe2ac6f5f
imul rcx, rax, 0x4e1e91f7
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1e
cmp eax, 0x102acf04
jae 0x1401a50c0
jmp 0x1401a4eef
mov rcx, rax
shl rcx, 0x20
or rcx, 2
mov qword [rdx + 8], rcx
mov qword [rdx], 1
xor ecx, ecx
test cl, cl
je 0x1401a5133
mov rcx, rax
shl rcx, 0x20
or rcx, 2
mov qword [rdx + 8], rcx
mov qword [rdx], 1
jmp 0x1401a50ff
mov rbx, 0xffffffffffffffff
test rsi, rsi
mov r9, qword [rbp + 0x10]
je 0x1401a5179
mov eax, dword [0x1415c9638]
xor edx, edx
div dword [0x1415c963c]
mov ecx, eax
not ecx
and ecx, 0xb49613b2
and eax, 0x4b69ec4d
sub eax, ecx
add eax, 0xdb4f17cb
or eax, 0x21424c5
cmp eax, 0x2584b4b7
mov rsi, qword [rbp - 8]
jae 0x1401a5186
jmp 0x1401a5193
mov r15, qword [rbp - 0x10]
mov rsi, qword [rbp - 8]
jmp 0x1401a4f10
mov rcx, qword [0x1415d3918]
xor eax, eax
test al, al
je 0x1401a519c
mov rax, qword [0x1415d3918]
jmp 0x1401a5186
sub rsp, 0x20
xor edx, edx
mov r8, r14
call fcn.140219910
add rsp, 0x20
mov r15, qword [rbp - 0x10]
mov r9, qword [rbp + 0x10]
jmp 0x1401a4f10