Function at 0x1400b6c90
Capabilities:
Create pipe
Encode data using base64
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x30], xmm6
mov r8d, edx
xor eax, eax
test al, al
jne 0x1400b6d08
mov edx, dword [0x141dd45a8]
add edx, dword [0x141dd45ac]
xor edx, 0x40905
and edx, 0x83244b3d
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov rbx, rsp
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov rax, rsp
cmp edx, 0xa8031611
jbe 0x1400b6d31
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
jmp 0x1400b6cb8
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x10], rcx
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x48], rax
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp - 0x78], rsp
mov eax, 0x10
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp - 0x30], rsp
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp - 0x70], rsp
mov eax, 0x30
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp - 0x68], rsp
mov eax, 0x20
call fcn.1400ef3b0
sub rsp, rax
mov qword [rbp - 0x28], rsp
movzx eax, r8b
mov ecx, 0x40080002
sub ecx, eax
nop word cs:[rax + rax]
mov eax, dword [0x141dd45b0]
xor edx, edx
div dword [0x141dd45b4]
add eax, 0xc8d2d6b7
and eax, 0x9af9c78f
xor eax, 0xe99bb0dd
cmp eax, 0x9bb87bbc
ja 0x1400b6dc0
mov dword [rbp + 0xc], ecx
mov byte [rbp + 0x2f], r8b
xor r13d, r13d
mov dword [rbp + 0x1c], 8
mov r12d, 0x890616ef
xorps xmm6, xmm6
mov dil, 1
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x58], rbx
nop dword [rax + rax]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add rsp, 0x20
mov rcx, qword [rbp - 0x30]
mov dword [rcx], eax
jmp 0x1400b6e3a
mov rax, qword [rbx]
mov qword [0x141ddb988], rax
mov rax, qword [0x141ddb988]
test rax, rax
jne 0x1400b6ee0
mov eax, dword [0x141dd45b8]
and eax, dword [0x141dd45bc]
imul eax, eax, 0xd60e0624
imul rax, r12
shr rax, 0x3f
cmp eax, 0xc91a3e83
mov r14, qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
je 0x1400b6ebe
nop word cs:[rax + rax]
mov eax, dword [0x141dd45c0]
xor edx, edx
div dword [0x141dd45c4]
mov esi, eax
xor esi, 0x2f088450
and esi, 0x6f0ce4d7
movups xmmword [rbx], xmm6
sub rsp, 0x20
mov edx, 0x10
mov rcx, rbx
call r14
add rsp, 0x20
cmp esi, 0xc11f9b3
jne 0x1400b6e30
movups xmmword [rbx], xmm6
sub rsp, 0x20
mov edx, 0x10
mov rcx, rbx
call r14
add rsp, 0x20
jmp 0x1400b6e80
mov rax, qword [rbp - 0x18]
lea esi, [rax + 1]
mov eax, dword [0x141dd45c8]
imul eax, dword [0x141dd45cc]
imul eax, eax, 0xe7bcab3a
and eax, 0x91398a70
xor eax, 0x9c689a1
cmp eax, 0x5f12b059
jb 0x1400b6f3e
nop dword [rax + rax]
mov ecx, dword [0x141dd45d0]
sub ecx, dword [0x141dd45d4]
and ecx, 0x6a8c0010
add ecx, 0x1d4a9623
mov eax, 1
lock xadd qword [0x141ddb988], rax
cmp ecx, 0xa0885b47
jbe 0x1400b6f50
lock inc qword [0x141ddb988]
jmp 0x1400b6f10
mov rcx, qword [rbp - 0x78]
mov qword [rcx], rax
mov rax, qword [rbp - 0x30]
mov r8, qword [rbp - 0x70]
mov qword [r8], rax
lea rax, [0x140054fb0]
mov qword [r8 + 8], rax
mov qword [r8 + 0x10], rcx
lea rax, [0x140053250]
mov qword [r8 + 0x18], rax
mov rdx, qword [rbp - 0x68]
lea rax, [0x141db94b8]
mov qword [rdx], rax
mov qword [rdx + 8], 2
mov qword [rdx + 0x20], 0
mov qword [rdx + 0x10], r8
mov qword [rdx + 0x18], 2
sub rsp, 0x20
mov rcx, qword [rbp - 0x28]
call fcn.140037760
add rsp, 0x20
cmp qword [rbp + 0x10], 0
sete al
or dil, al
test dil, 1
jne 0x1400b7020
mov eax, dword [0x141dd4700]
and eax, dword [0x141dd4704]
and eax, 0x16d3a53c
add eax, 0xbfb43a96
imul rcx, rax, 0x31b39699
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1d
cmp eax, 0x4c2cc250
ja 0x1400b6fc8
mov rcx, qword [0x141ddb9a0]
sub rsp, 0x20
xor edx, edx
mov r8, qword [rbp]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop word cs:[rax + rax]
mov eax, dword [0x141dd45d8]
add eax, dword [0x141dd45dc]
imul eax, eax, 0x6516fba
and eax, 0xe7a84f5e
imul eax, eax, 0x78854bcf
cmp eax, 0x67be4704
jb 0x1400b7020
mov rax, qword [rbp - 0x28]
mov r11, qword [rax]
mov r8, qword [rax + 8]
mov rdi, qword [rax + 0x10]
nop word cs:[rax + rax]
mov eax, dword [0x141dd45e0]
sub eax, dword [0x141dd45e4]
and eax, 0xc80d4a23
xor eax, 0x7b57d823
add eax, 0x805e1a0e
cmp eax, 0x8c4d7774
ja 0x1400b7060
lea rax, [r8 + rdi]
mov qword [rbp + 0x20], rax
test rdi, rdi
mov qword [rbp], r8
mov qword [rbp + 0x10], r11
mov dword [rbp - 4], esi
mov qword [rbp - 0x60], rdi
je 0x1400b71d0
mov eax, dword [0x141dd45e8]
and eax, dword [0x141dd45ec]
xor eax, 0xd66fb526
imul eax, eax, 0x504147d3
cmp eax, 0xfc31665f
je 0x1400b70a2
movzx ebx, byte [r8]
test bl, bl
js 0x1400b7100
lea r14, [r8 + 1]
nop dword [rax]
mov eax, dword [0x141dd4600]
add eax, dword [0x141dd4604]
imul eax, eax, 0x71813d05
add eax, 0xe951bdb6
cmp eax, 0x6cd16bcc
jbe 0x1400b70d0
mov r8, 0xffffffffffffffff
jmp 0x1400b7200
mov eax, dword [0x141dd45f0]
sub eax, dword [0x141dd45f4]
and eax, 0x60900800
cmp eax, 0x7581f4b2
je 0x1400b7100
mov eax, ebx
and eax, 0x1f
mov ecx, dword [0x141dd45f8]
add ecx, dword [0x141dd45fc]
imul ecx, ecx, 0x33988dda
cmp ecx, 0xb79e27b4
je 0x1400b711d
movzx edx, byte [r8 + 1]
and edx, 0x3f
cmp bl, 0xdf
jbe 0x1400b71ea
movzx ecx, byte [r8 + 2]
shl edx, 6
and ecx, 0x3f
or ecx, edx
cmp bl, 0xf0
jb 0x1400b72aa
nop
test r13b, r13b
jne 0x1400b7160
lea r14, [r8 + 4]
movzx edx, byte [r8 + 3]
shl eax, 0x12
mov r8d, dword [0x141dd4608]
imul r8d, dword [0x141dd460c]
or r8d, 0x4e301762
and r8d, 0x7eb997e3
imul r8d, r8d, 0xb41164a4
mov r9d, eax
and r9d, 0x1c0000
mov r10d, ecx
shl r10d, 6
mov ebx, edx
and ebx, 0x3f
or ebx, r10d
or ebx, r9d
cmp r8d, 0x7808c8df
jb 0x1400b7171
cmp ebx, 0xffff
mov r8, 0xffffffffffffffff
ja 0x1400b72d0
jmp 0x1400b7200
mov esi, 4
mov r8d, 8
xor r12d, r12d
xor r14d, r14d
xor ebx, ebx
xor eax, eax
jmp 0x1400b727e
lea r14, [r8 + 2]
shl eax, 6
or eax, edx
mov ebx, eax
mov r8, 0xffffffffffffffff
nop dword [rax]
mov al, 1
test al, al
je 0x1400b7200
mov ecx, 1
xor r12d, r12d
mov r9d, 4
mov r10, qword [rbp + 0x20]
nop dword [rax + rax]
mov eax, dword [0x141dd4618]
xor edx, edx
div dword [0x141dd461c]
or eax, 0x2041080
and eax, 0x2261085
mov rdx, r10
sub rdx, r14
add rdx, 3
cmovb rdx, r8
shr rdx, 2
lea rsi, [rdx + rcx]
inc rsi
add rdx, rcx
cmp rdx, 3
cmovb rsi, r9
cmp eax, 0xe8d284c9
ja 0x1400b7220
movabs rax, 0x3fffffffffffffff
cmp rsi, rax
ja 0x1400b7e42
lea r8, [rsi + rsi]
mov ax, 1
mov qword [rbp - 0x20], rax
mov eax, dword [0x141dd4638]
xor edx, edx
div dword [0x141dd463c]
xor eax, 0x88200000
and eax, 0xc8e40080
cmp eax, 0x3179023f
mov qword [rbp - 0x38], r8
jae 0x1400b7320
jmp 0x1400b7368
lea r14, [r8 + 3]
shl eax, 0xc
or ecx, eax
mov ebx, ecx
cmp ebx, 0xffff
mov r8, 0xffffffffffffffff
jbe 0x1400b7200
nop dword [rax + rax]
mov eax, dword [0x141dd4610]
sub eax, dword [0x141dd4614]
add eax, 0x782c9cd0
cmp eax, 0x6b9b057d
ja 0x1400b72d0
lea eax, [rbx + 0xff0000]
shr eax, 0xa
movzx eax, ax
or eax, 0xd800
and ebx, 0x3ff
or ebx, 0xdc00
mov ecx, 2
mov r12d, ebx
mov ebx, eax
jmp 0x1400b720e
mov eax, dword [0x141dd4640]
imul eax, dword [0x141dd4644]
imul rax, rax, 0x50721a5d
shr rax, 0x3e
xor eax, 0x2caa5019
imul edi, eax, 0xc421f472
movzx eax, byte [0x141ddb9b8]
sub rsp, 0x20
xor ecx, ecx
mov rdx, r8
call fcn.1400bf820
mov r8, qword [rbp - 0x38]
add rsp, 0x20
cmp edi, 0x81beeb49
jne 0x1400b7390
movzx eax, byte [0x141ddb9b8]
sub rsp, 0x20
xor ecx, ecx
mov rdx, r8
call fcn.1400bf820
mov r8, qword [rbp - 0x38]
add rsp, 0x20
jmp 0x1400b7320
mov rcx, rax
test rax, rax
je 0x1400b7e1c
mov eax, dword [0x141dd4658]
xor edx, edx
div dword [0x141dd465c]
xor eax, 0x90120891
and eax, 0xb8331995
imul eax, eax, 0xab96bc83
cmp eax, 0x38b065b5
mov edi, 0xe2e55f0d
jne 0x1400b73d8
mov word [rcx], bx
mov qword [r15], rsi
mov qword [r15 + 8], rcx
mov qword [r15 + 0x10], 1
mov r11, qword [rbp + 0x20]
mov rdx, qword [rbp - 0x20]
mov eax, dword [0x141dd4660]
and eax, dword [0x141dd4664]
imul rax, rax, 0x681508af
shr rax, 0x3d
or eax, 0x54758180
imul eax, eax, 0xa9ba4462
mov word [rcx], bx
mov qword [r15], rsi
mov qword [r15 + 8], rcx
mov qword [r15 + 0x10], 1
cmp eax, 0xb9c3e81f
je 0x1400b73e0
mov eax, dword [0x141dd4668]
imul eax, dword [0x141dd466c]
imul eax, eax, 0xbbb77d6a
add eax, 0x1744871b
cmp eax, 0x7be1628d
ja 0x1400b741b
nop word [rax + rax]
mov eax, dword [0x141dd4670]
xor eax, dword [0x141dd4674]
and eax, 0x20002000
cmp eax, 0x1c9463b7
jb 0x1400b7440
mov ebx, 1
jmp 0x1400b747c
xor eax, eax
mov esi, r12d
cmp rbx, qword [r15]
je 0x1400b77dc
mov r12d, eax
mov word [rcx + rbx*2], si
inc rbx
mov qword [r15 + 0x10], rbx
test r14, r14
je 0x1400b7510
nop word cs:[rax + rax]
test r13b, r13b
jne 0x1400b7490
test r12w, r12w
jne 0x1400b7460
nop dword [rax + rax]
test r13b, r13b
jne 0x1400b74a0
cmp r14, r11
je 0x1400b7510
nop word [rax + rax]
mov eax, dword [0x141dd4678]
add eax, dword [0x141dd467c]
imul eax, eax, 0xcc3ee8dc
cmp eax, 0x359ce017
je 0x1400b74b0
lea r8, [r14 + 1]
movzx r10d, byte [r14]
nop word cs:[rax + rax]
mov eax, dword [0x141dd4680]
or eax, dword [0x141dd4684]
and eax, 0x7ce244d0
imul eax, eax, 0x5ed2b698
cmp eax, 0x39cdf23a
je 0x1400b74e0
test r10b, r10b
js 0x1400b75aa
mov esi, r10d
jmp 0x1400b784c
mov r9, qword [r15]
nop word cs:[rax + rax]
mov eax, dword [0x141dd46d8]
xor eax, dword [0x141dd46dc]
add eax, 0x31f0bd62
and eax, 0xb7d0bed5
add eax, 0xcf661d7
cmp eax, 0xa971e21d
ja 0x1400b7520
cmp dx, 1
mov rsi, qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
jne 0x1400b7860
mov eax, dword [0x141dd46e0]
xor edx, edx
div dword [0x141dd46e4]
nop word cs:[rax + rax]
mov eax, dword [0x141dd46e8]
imul eax, dword [0x141dd46ec]
add eax, 0xeffcf7ba
cmp eax, 0x4a93befc
jb 0x1400b7570
xor esi, esi
mov r14d, 0
mov edx, 0
mov r8d, 0
cmp rbx, r9
jne 0x1400b7471
jmp 0x1400b7806
mov r9d, r10d
and r9d, 0x1f
mov r12, rdx
nop word cs:[rax + rax]
mov eax, dword [0x141dd4688]
add eax, dword [0x141dd468c]
or eax, 0x80e98c0
imul eax, eax, 0xf76ad9eb
cmp eax, 0xdf10165c
je 0x1400b75c0
lea r8, [r14 + 2]
movzx eax, byte [r14 + 1]
mov esi, r9d
shl esi, 6
and eax, 0x3f
mov edx, dword [0x141dd4690]
and edx, dword [0x141dd4694]
mov r11d, 0xc09d552b
imul rdx, r11
shr rdx, 0x3f
or edx, 0x73d79db8
mov r11d, 0x8842ce11
imul rdx, r11
shr rdx, 0x38
cmp edx, 0x9caa1b56
ja 0x1400b75f0
cmp r10b, 0xdf
jbe 0x1400b7843
mov edx, dword [0x141dd4698]
imul edx, dword [0x141dd469c]
or edx, 0x5ffc276a
and edx, 0x5ffc777a
cmp edx, 0x2728bbcd
jb 0x1400b7630
lea r8, [r14 + 3]
movzx r11d, byte [r14 + 2]
shl eax, 6
and r11d, 0x3f
or r11d, eax
mov esi, r9d
shl esi, 0xc
or esi, r11d
nop dword [rax]
mov eax, dword [0x141dd46a0]
xor edx, edx
div dword [0x141dd46a4]
imul eax, eax, 0x1cc813d0
imul rax, rdi
shr rax, 0x3e
and eax, 0xfffffffe
cmp eax, 0x878ef365
ja 0x1400b7670
cmp r10b, 0xf0
jb 0x1400b76f4
movzx eax, byte [r14 + 3]
add r14, 4
and r9d, 7
shl r9d, 0x12
shl r11d, 6
and eax, 0x3f
mov r8d, 0xbcedc4cd
nop word [rax + rax]
mov edx, dword [0x141dd46a8]
xor edx, dword [0x141dd46ac]
imul edx, edx, 0x2309a71f
add edx, 0x5dac4225
imul rdx, r8
shr rdx, 0x3d
cmp edx, 0x1805a3aa
ja 0x1400b76c0
or r11d, eax
or r11d, r9d
mov r8, r14
mov esi, r11d
mov eax, dword [0x141dd46b0]
xor edx, edx
div dword [0x141dd46b4]
mov eax, dword [0x141dd46b8]
xor edx, edx
div dword [0x141dd46bc]
add eax, 0xc4aa91ee
imul rax, rax, 0x4431e191
shr rax, 0x3d
cmp eax, 0xe577fb70
je 0x1400b7702
cmp esi, 0xffff
mov r11, qword [rbp + 0x20]
jbe 0x1400b7849
nop word [rax + rax]
mov eax, dword [0x141dd46c0]
sub eax, dword [0x141dd46c4]
cmp eax, 0xe64b064a
je 0x1400b7740
lea eax, [rsi + 0xff0000]
shr eax, 0xa
mov edx, dword [0x141dd46c8]
and edx, dword [0x141dd46cc]
add edx, 0xbf65785c
imul rdx, rdx, 0x6e779c1b
shr rdx, 0x3b
cmp edx, 0xe476ac1d
ja 0x1400b775c
mov r9d, esi
movzx eax, ax
or eax, 0xd800
and r9d, 0x3ff
mov esi, eax
nop word cs:[rax + rax]
mov eax, dword [0x141dd46d0]
xor edx, edx
div dword [0x141dd46d4]
imul edx, eax, 0x23624d92
or edx, 0x81800be
and edx, 0x7c58c1be
movzx eax, r9w
or eax, 0xdc00
cmp edx, 0x96c346e0
je 0x1400b77a0
mov r14, r8
mov rdx, r12
jmp 0x1400b7465
mov r8, r11
sub r8, r14
add r8, 3
mov rcx, 0xffffffffffffffff
cmovb r8, rcx
shr r8, 2
movzx ecx, dx
cmp ax, 1
sbb r8, 0xffffffffffffffff
add r8, rcx
mov r12d, eax
inc r8
sub rsp, 0x30
mov qword [rsp + 0x20], 2
mov r9d, 2
mov rcx, r15
mov rdi, rdx
mov rdx, rbx
call fcn.1400fd630
mov rdx, rdi
mov edi, 0xe2e55f0d
mov r11, qword [rbp + 0x20]
add rsp, 0x30
mov rcx, qword [r15 + 8]
jmp 0x1400b7471
or esi, eax
mov r11, qword [rbp + 0x20]
mov rdx, r12
xor eax, eax
mov r14, r8
jmp 0x1400b7465
mov qword [rbp + 0x20], r9
mov eax, dword [0x141dd46f0]
imul eax, dword [0x141dd46f4]
imul eax, eax, 0xdf3e4083
or eax, 0x26ecdf25
and eax, 0x7ffdffbd
cmp eax, 0x32a3373b
jne 0x1400b78c4
mov rcx, qword [r15 + 8]
sub rsp, 0x40
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
mov edx, dword [rbp + 0xc]
mov r8d, dword [rbp + 0x1c]
mov r9d, 1
call rsi
add rsp, 0x40
mov r12d, dword [rbp + 0xc]
mov rbx, rsi
mov edi, dword [rbp + 0x1c]
nop
mov eax, dword [0x141dd46f8]
sub eax, dword [0x141dd46fc]
or eax, 0x7ad5cd49
imul r14, rax, 0x32fdfe31
shr r14, 0x3d
mov rsi, qword [r15 + 8]
sub rsp, 0x40
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
mov rcx, rsi
mov edx, r12d
mov r8d, edi
mov r9d, 1
call rbx
add rsp, 0x40
cmp r14d, 0x42ca497b
je 0x1400b78d0
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x1400b7b16
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
mov ecx, eax
mov r9d, dword [rbp - 4]
cmp r9d, 0xa
mov r12d, 0x890616ef
jge 0x1400b7abc
mov eax, dword [0x141dd4790]
sub eax, dword [0x141dd4794]
add eax, 0xf1f88e21
cmp eax, 0x20bd51e9
jb 0x1400b7964
mov r8d, dword [rbp + 0x1c]
mov eax, dword [0x141dd4798]
xor eax, dword [0x141dd479c]
imul rdx, rax, 0x328da271
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
or eax, 0x598e0118
cmp eax, 0x3b35941f
jb 0x1400b7980
cmp ecx, 5
jne 0x1400b79c0
mov eax, r9d
mov qword [rbp - 0x18], rax
jmp 0x1400b79ff
test r8d, r8d
setne al
cmp ecx, 0x57
sete r8b
and r8b, al
mov eax, dword [0x141dd47d0]
xor edx, edx
div dword [0x141dd47d4]
xor eax, 0x7f99c2da
add eax, 0xa7271759
cmp eax, 0xd35e1bcd
ja 0x1400b79d0
mov dword [rbp + 0x1c], 0
test r8b, r8b
je 0x1400b7abc
cmp qword [rbp + 0x20], 0
mov rbx, qword [rbp - 0x58]
je 0x1400b7a88
mov eax, dword [0x141dd47b8]
add eax, dword [0x141dd47bc]
imul rcx, rax, 0x23e9ad53
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1f
add eax, 0xc16f744f
imul rax, rax, 0x5c89908f
shr rax, 0x3e
cmp eax, 0xa62d988b
jbe 0x1400b7a50
mov rax, qword [0x141ddb9a0]
nop dword [rax]
mov eax, dword [0x141dd47c0]
and eax, dword [0x141dd47c4]
imul eax, eax, 0xe76c2bd8
add eax, 0xbc9fe144
mov rcx, qword [0x141ddb9a0]
cmp eax, 0xa5ffa7af
ja 0x1400b7a50
sub rsp, 0x20
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov ecx, 0x89e65a05
nop dword [rax]
mov eax, dword [0x141dd47c8]
xor eax, dword [0x141dd47cc]
xor eax, 0x74fe8118
imul rax, rcx
shr rax, 0x3e
or eax, 0x39b65e0c
cmp eax, 0x73a86979
je 0x1400b7a90
xor edi, edi
jmp 0x1400b6e10
shl rcx, 0x20
or rcx, 2
mov rax, qword [rbp - 0x10]
mov qword [rax + 8], rcx
mov qword [rax], 1
mov r15, 0xffffffffffffffff
cmp qword [rbp + 0x20], 0
je 0x1400b7d1f
mov r13, qword [rbp]
mov r14, qword [0x141ddb9a0]
mov eax, dword [0x141dd47a0]
and eax, dword [0x141dd47a4]
and eax, 0xbab171d0
add eax, 0xcf990792
cmp eax, 0xea2e54ff
jbe 0x1400b8084
jmp 0x1400b80c0
mov r13, qword [rbp]
nop word [rax + rax]
mov eax, dword [0x141dd4708]
and eax, dword [0x141dd470c]
or eax, 0xa60bf85e
cmp eax, 0x975728a7
je 0x1400b7b20
cmp qword [rbp + 0x20], 0
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
je 0x1400b7c10
mov r15, r13
mov rdi, qword [0x141ddb9a0]
mov eax, dword [0x141dd4710]
sub eax, dword [0x141dd4714]
imul rax, rax, 0x40bb40db
shr rax, 0x3e
imul eax, eax, 0x9fece61
imul rax, rax, 0xca79c19
shr rax, 0x36
cmp eax, 0xf93c2b1a
jne 0x1400b7ba0
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop dword [rax]
mov eax, dword [0x141dd4718]
add eax, dword [0x141dd471c]
imul r14d, eax, 0xc09a3c09
add r14d, 0xe9b8f81b
or r14d, 0x81c4c9ae
sub rsp, 0x20
mov rcx, rdi
xor edx, edx
mov r8, rsi
call r12
add rsp, 0x20
cmp r14d, 0x9d3ea3e9
je 0x1400b7ba0
mov r13, r15
mov eax, dword [0x141dd4720]
or eax, dword [0x141dd4724]
xor eax, 0x64302144
and eax, 0x747ca374
imul eax, eax, 0x150b99b0
cmp eax, 0x7e285c2e
jb 0x1400b7be0
nop word cs:[rax + rax]
mov eax, dword [0x141dd4728]
or eax, dword [0x141dd472c]
or eax, 0xb5b3ac84
add eax, 0x1969c04c
cmp eax, 0xfd3a6eea
ja 0x1400b7c10
mov eax, dword [0x141dd4730]
xor edx, edx
div dword [0x141dd4734]
and eax, 0xc92a916c
add eax, 0x577a8cea
or eax, 0x76525fcb
cmp eax, 0xa64bcc95
mov rsi, qword [rbp - 0x10]
movzx ecx, byte [rbp + 0x2f]
mov r8, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x60]
jne 0x1400b7c70
mov qword [r8 + 0x10], 0
mov dword [r8], 0
mov r9, qword [rbp - 0x40]
add r9, 0x1c
nop dword [rax + rax]
mov eax, dword [0x141dd4738]
xor eax, dword [0x141dd473c]
add eax, 0x81205fbc
imul rax, rax, 0x23729ad7
shr rax, 0x38
mov qword [r8 + 0x10], 0
mov dword [r8], 0
cmp eax, 0xd8fa369f
ja 0x1400b7c80
mov word [r9 + 8], 0
mov qword [r9], 0
mov byte [r8 + 0x21], cl
xor cl, 1
mov byte [r8 + 0x20], cl
mov dword [r8 + 0x18], 0
mov rax, qword [rbp - 0x50]
mov dword [rax], 0x18
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
mov qword [r8 + 8], rax
sub rsp, 0x20
mov rcx, r13
call fcn.140092220
add rsp, 0x20
test rax, rax
je 0x1400b7d36
mov qword [rsi + 8], rdx
mov qword [rsi], 1
mov r8, rbx
mov r15, rbx
mov rcx, qword [rbp + 0x10]
jmp 0x1400b7f20
mov rcx, qword [rbp + 0x10]
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13, qword [rbp]
mov r8, rbx
jmp 0x1400b7f20
mov eax, dword [0x141dd4740]
or eax, dword [0x141dd4744]
imul eax, eax, 0x9e46f7b3
or eax, 0x2d206b63
imul rax, rax, 0x5fe030ed
shr rax, 0x3e
cmp eax, 0x859f73d8
jbe 0x1400b7d6e
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rdx
mov qword [rsi], 0
mov eax, 0x8f77a40d
nop word cs:[rax + rax]
mov ecx, dword [0x141dd4748]
and ecx, dword [0x141dd474c]
imul rcx, rax
shr rcx, 0x3a
imul ecx, ecx, 0x3bce0387
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rdx
mov qword [rsi], 0
cmp ecx, 0xad097c1b
je 0x1400b7d80
cmp qword [rbp + 0x10], 0
je 0x1400b7ef1
mov rsi, qword [0x141ddb9a0]
mov eax, dword [0x141dd4750]
and eax, dword [0x141dd4754]
and eax, 0x61d9fc09
add eax, 0x851565ec
cmp eax, 0x5ae66707
jae 0x1400b7df6
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
mov bl, 1
nop dword [rax + rax]
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r13
call r12
add rsp, 0x20
test bl, bl
je 0x1400b7e00
jmp 0x1400b7ef1
mov eax, dword [str.o0_]
or eax, dword [0x141dd464c]
or eax, 0xfa282dfb
and eax, 0xfa29affb
cmp eax, 0x192e7c9a
jae 0x1400b7ec7
jmp 0x1400b7eeb
mov eax, dword [0x141dd4620]
and eax, dword [0x141dd4624]
imul rax, rax, 0x71a69f07
shr rax, 0x3e
cmp eax, 0x48787d5f
jne 0x1400b7e70
ud2
mov eax, dword [0x141dd4628]
imul eax, dword [0x141dd462c]
xor eax, 0x24d4448
add eax, 0x1e6c8360
and eax, 0xef8b0d4
ud2
mov eax, dword [0x141dd4650]
and eax, dword [0x141dd4654]
add eax, 0xd007ce6c
and eax, 0x6c28458b
add eax, 0xd4977ac5
ud2
ud2
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400b7f00
movaps xmm6, xmmword [rbp + 0x30]
lea rsp, [rbp + 0x48]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [0x141dd4758]
or eax, dword [0x141dd475c]
and eax, 0x8088000
add eax, 0x80cbe1d1
cmp eax, 0x6ba20105
jb 0x1400b7f20
test rcx, rcx
je 0x1400b8028
mov eax, dword [0x141dd4760]
xor eax, dword [0x141dd4764]
add eax, 0x96eca860
imul rax, rax, 0x7cdbb187
shr rax, 0x3c
cmp eax, 0x63b1d60
jne 0x1400b7f70
mov rax, qword [0x141ddb9a0]
mov eax, dword [0x141dd4768]
or eax, dword [0x141dd476c]
or eax, 0x6fe4561c
imul eax, eax, 0xdeab889a
mov rsi, qword [0x141ddb9a0]
cmp eax, 0x91fa197b
je 0x1400b7f70
mov eax, dword [0x141dd4770]
sub eax, dword [0x141dd4774]
or eax, 0xefebe543
and eax, 0xefefeff3
cmp eax, 0x8c5f513d
jne 0x1400b7fd0
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
nop dword [rax + rax]
mov edi, dword [0x141dd4778]
xor edi, dword [0x141dd477c]
xor edi, 0x52928d6f
add edi, 0x6f0af2ad
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8, r13
call r12
add rsp, 0x20
cmp edi, 0x3c6feed8
jb 0x1400b7fd0
mov r8, rbx
nop word cs:[rax + rax]
mov eax, dword [0x141dd4780]
or eax, dword [0x141dd4784]
or eax, 0x8bb1e875
cmp eax, 0xa074f288
je 0x1400b8010
mov eax, 0xa0fe21cf
nop dword [rax]
mov ecx, dword [0x141dd4788]
add ecx, dword [0x141dd478c]
xor ecx, 0x796fc2eb
mov rdx, rcx
imul rdx, rax
shr rdx, 0x20
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1e
xor ecx, 0x4a2e0481
cmp ecx, 0x86e05dda
ja 0x1400b8030
cmp r8, 0xffffffffffffffff
je 0x1400b7ef1
sub rsp, 0x20
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
jmp 0x1400b7ef1
mov eax, dword [0x141dd47a8]
add eax, dword [0x141dd47ac]
imul edi, eax, 0x3ce994f2
add edi, 0x63181412
and edi, 0x80348168
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
cmp edi, 0x52b22930
jbe 0x1400b80d8
sub rsp, 0x20
mov rcx, r14
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x20
jmp 0x1400b8084
mov rcx, qword [rbp + 0x10]
mov r8, rbx
nop
mov eax, dword [0x141dd47b0]
add eax, dword [0x141dd47b4]
or eax, 0xedab7dbd
imul eax, eax, 0x716ea6cf
cmp eax, 0x2323f1be
je 0x1400b80e0
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400b7f20