Function at 0x140001e48
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x158]
sub rsp, 0x230
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rbp + 0x120], rax
xor r14d, r14d
mov dword [rsp + 0x20], 0x7a627570
mov dword [rsp + 0x24], 0x6825383a
mov ecx, r14d
mov dword [rsp + 0x28], 0x1006261
lea r15d, [r14 + 1]
lea eax, [rcx + 5]
xor byte [rsp + rcx + 0x20], al
add rcx, r15
cmp rcx, 0xa
jb 0x140001ea1
mov byte [rsp + 0x2b], r14b
or r12d, 0xffffffff
mov rax, qword gs:[0x60]
mov esi, 0x53b2070f
mov r13d, 0x811c9dc5
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140001f35
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140001f35
mov edi, dword [r10 + 0x20]
add r9d, r12d
mov r11d, r13d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x140001f30
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x140001f15
cmp r11d, esi
je 0x140001f3a
test r9d, r9d
jne 0x140001efb
mov rax, qword [rax]
jmp 0x140001ed6
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x20]
add rax, r8
call rax
mov rcx, r14
mov dword [rsp + 0x40], 0x6675636e
mov dword [rsp + 0x44], 0x3e38666c
mov dword [rsp + 0x48], 0x7c636a23
mov word [rsp + 0x4c], pe_nt_image_headers64
lea eax, [rcx + 5]
xor byte [rsp + rcx + 0x40], al
add rcx, r15
cmp rcx, 0xc
jb 0x140001f7c
mov byte [rsp + 0x4d], r14b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140002001
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140002001
mov edi, dword [r10 + 0x20]
add r9d, r12d
mov r11d, r13d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x140001ffc
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x140001fe1
cmp r11d, esi
je 0x140002006
test r9d, r9d
jne 0x140001fc7
mov rax, qword [rax]
jmp 0x140001fa2
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x40]
add rax, r8
call rax
mov rcx, r14
mov dword [rsp + 0x30], 0x3b696f72
mov dword [rsp + 0x34], 0x68257f3b
mov dword [rsp + 0x38], 0x1006261
lea eax, [rcx + 5]
xor byte [rsp + rcx + 0x30], al
add rcx, r15
cmp rcx, 0xa
jb 0x140002041
mov byte [rsp + 0x3b], r14b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1400020c6
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x1400020c6
mov edi, dword [r10 + 0x20]
add r9d, r12d
mov r11d, r13d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x1400020c1
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x1400020a6
cmp r11d, esi
je 0x1400020cb
test r9d, r9d
jne 0x14000208c
mov rax, qword [rax]
jmp 0x140002067
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x30]
add rax, r8
call rax
mov rcx, r14
mov dword [rsp + 0x50], 0x14b0143
mov word [rsp + 0x54], r14w
mov esi, 0x105
mov byte [rsp + 0x56], r15b
lea eax, [rsi + rcx]
xor word [rsp + rcx*2 + 0x50], ax
add rcx, r15
cmp rcx, 2
jb 0x140002106
mov byte [rsp + 0x56], r14b
mov r13d, 0xe05299f3
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140002195
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140002195
mov edi, dword [r10 + 0x20]
add r9d, r12d
mov r11d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x140002190
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x140002175
cmp r11d, r13d
je 0x14000219a
test r9d, r9d
jne 0x140002158
mov rax, qword [rax]
jmp 0x140002133
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r8
lea rcx, [rsp + 0x50]
call rax
mov qword [0x140007720], rax
test rax, rax
jne 0x140002df3
mov dword [rbp - 0x50], 0x16f0152
mov rcx, r14
mov dword [rbp - 0x4c], 0x15a0169
mov dword [rbp - 0x48], 0x1780168
mov dword [rbp - 0x44], 0x165015c
mov dword [rbp - 0x40], 0x16a0163
mov dword [rbp - 0x3c], 0x1670160
mov word [rbp - 0x38], r14w
mov byte [rbp - 0x36], r15b
lea eax, [rsi + rcx]
xor word [rbp + rcx*2 - 0x50], ax
add rcx, r15
cmp rcx, 0xc
jb 0x140002202
mov byte [rbp - 0x36], r14b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14000228a
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x14000228a
mov edi, dword [r10 + 0x20]
dec r9d
mov r11d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x140002285
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x14000226a
cmp r11d, r13d
je 0x14000228f
test r9d, r9d
jne 0x14000224d
mov rax, qword [rax]
jmp 0x140002228
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r8
lea rcx, [rbp - 0x50]
call rax
mov qword [0x140007720], rax
test rax, rax
jne 0x140002def
mov dword [rsp + 0x58], 0x1720156
mov rcx, r14
mov dword [rsp + 0x5c], 0x1690162
mov dword [rsp + 0x60], 0x164
mov byte [rsp + 0x64], r15b
lea eax, [rsi + rcx]
xor word [rsp + rcx*2 + 0x58], ax
add rcx, r15
cmp rcx, 5
jb 0x1400022e0
mov byte [rsp + 0x64], r14b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14000236d
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x14000236d
mov edi, dword [r10 + 0x20]
or r12d, 0xffffffff
add r9d, r12d
mov r11d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x140002368
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x14000234d
cmp r11d, r13d
je 0x140002372
test r9d, r9d
jne 0x140002330
mov rax, qword [rax]
jmp 0x140002307
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x58]
add rax, r8
xor ecx, ecx
call rax
mov qword [0x140007720], rax
test rax, rax
jne 0x140002df3
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14000241e
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x14000241e
mov edi, dword [r10 + 0x20]
mov r13d, 0x811c9dc5
add r9d, r12d
mov r11d, r13d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x140002419
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x1400023fa
cmp r11d, 0xcded1a85
je 0x140002423
test r9d, r9d
jne 0x1400023e0
mov rax, qword [rax]
jmp 0x1400023b5
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r8
call rax
movdqa xmm0, xmmword [0x1400053d0]
mov rcx, r14
movdqa xmm1, xmmword [0x140005400]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm0, xmmword [0x140005430]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x60], 0x7e717073
mov dword [rbp - 0x5c], 0x7a7d7c7f
mov dword [rbp - 0x58], 0x679787b
mov dword [rbp - 0x54], 0x1000407
lea eax, [rcx + 5]
xor byte [rsp + rcx + 0x70], al
add rcx, r15
cmp rcx, 0x3e
jb 0x140002487
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14000250b
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x14000250b
mov edi, dword [r10 + 0x20]
add r9d, r12d
mov r11d, r13d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x140002506
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x1400024e7
cmp r11d, 0xa19b8cd6
je 0x140002510
test r9d, r9d
jne 0x1400024cd
mov rax, qword [rax]
jmp 0x1400024a8
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov rcx, qword gs:[0x60]
mov esi, eax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov r10d, dword [rdx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x1400025a0
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x1400025a0
mov edi, dword [r10 + 0x20]
add r8d, r12d
mov r11d, r13d
lea rax, [r9 + r8*4]
mov edx, dword [rax + rdi]
add rdx, r9
mov al, byte [rdx]
add rdx, r15
test al, al
je 0x14000259b
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rdx]
add rdx, r15
test al, al
jne 0x14000257c
cmp r11d, 0xc1d5565c
je 0x1400025a5
test r8d, r8d
jne 0x140002563
mov rcx, qword [rcx]
jmp 0x14000253e
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
xor r8d, r8d
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r9
mov ecx, esi
xor r9d, r9d
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14000263d
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x14000263d
mov edi, dword [r10 + 0x20]
add r9d, r12d
mov r11d, r13d
lea rcx, [r8 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r8
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x140002638
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x140002619
cmp r11d, 0xa19b8cd6
je 0x140002642
test r9d, r9d
jne 0x140002600
mov rax, qword [rax]
jmp 0x1400025db
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov esi, eax
mov eax, 0x80010003
imul esi
add edx, esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7fff
sub esi, eax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x1400026ed
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x1400026ed
mov edi, dword [r10 + 0x20]
add r8d, r12d
mov r11d, r13d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + rdi]
add rdx, r9
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x1400026e8
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x1400026c9
cmp r11d, 0xe80fd3a
je 0x1400026f2
test r8d, r8d
jne 0x1400026b0
mov rax, qword [rax]
jmp 0x14000268b
mov edx, dword [r10 + 0x24]
mov ecx, esi
add rdx, r9
movzx r8d, word [rdx + r8*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov eax, dword [rdx + r8*4]
add rax, r9
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140002783
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140002783
mov edi, dword [r10 + 0x20]
add r9d, r12d
mov r11d, r13d
lea rcx, [r8 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r8
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x14000277e
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x14000275f
cmp r11d, 0xb8246c
je 0x140002788
test r9d, r9d
jne 0x140002746
mov rax, qword [rax]
jmp 0x140002721
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rcx, [0x1400030ec]
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14000281d
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x14000281d
mov edi, dword [r10 + 0x20]
add r9d, r12d
mov r11d, r13d
lea rcx, [r8 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r8
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x140002818
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x1400027f9
cmp r11d, 0x345116d3
je 0x140002822
test r9d, r9d
jne 0x1400027e0
mov rax, qword [rax]
jmp 0x1400027bb
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rcx, [0x1400030ec]
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1400028b7
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x1400028b7
mov edi, dword [r9 + 0x20]
add r10d, r12d
mov r11d, r13d
lea rcx, [r8 + r10*4]
mov edx, dword [rcx + rdi]
add rdx, r8
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x1400028b2
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x140002893
cmp r11d, 0xa52bcaf9
je 0x1400028bc
test r10d, r10d
jne 0x14000287a
mov rax, qword [rax]
jmp 0x140002855
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
movdqa xmm0, xmmword [0x1400053d0]
mov rcx, r14
movdqa xmm1, xmmword [0x140005400]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm0, xmmword [0x140005430]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x60], 0x7e717073
mov dword [rbp - 0x5c], 0x7a7d7c7f
mov dword [rbp - 0x58], 0x679787b
mov dword [rbp - 0x54], 0x1000407
lea eax, [rcx + 5]
xor byte [rsp + rcx + 0x70], al
add rcx, r15
cmp rcx, 0x3e
jb 0x14000291e
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1400029a2
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x1400029a2
mov edi, dword [r10 + 0x20]
add r9d, r12d
mov r11d, r13d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x14000299d
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x14000297e
cmp r11d, 0xa19b8cd6
je 0x1400029a7
test r9d, r9d
jne 0x140002964
mov rax, qword [rax]
jmp 0x14000293f
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov rcx, qword gs:[0x60]
mov esi, eax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r9, qword [rcx + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov r10d, dword [rdx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x140002a37
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x140002a37
mov edi, dword [r10 + 0x20]
add r8d, r12d
mov r11d, r13d
lea rax, [r9 + r8*4]
mov edx, dword [rax + rdi]
add rdx, r9
mov al, byte [rdx]
add rdx, r15
test al, al
je 0x140002a32
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rdx]
add rdx, r15
test al, al
jne 0x140002a13
cmp r11d, 0xc1d5565c
je 0x140002a3c
test r8d, r8d
jne 0x1400029fa
mov rcx, qword [rcx]
jmp 0x1400029d5
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
xor r8d, r8d
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r9
mov ecx, esi
xor r9d, r9d
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140002ad4
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140002ad4
mov edi, dword [r10 + 0x20]
add r9d, r12d
mov r11d, r13d
lea rcx, [r8 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r8
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x140002acf
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x140002ab0
cmp r11d, 0xa19b8cd6
je 0x140002ad9
test r9d, r9d
jne 0x140002a97
mov rax, qword [rax]
jmp 0x140002a72
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov esi, eax
mov eax, 0x80010003
imul esi
add edx, esi
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7fff
sub esi, eax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x140002b84
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x140002b84
mov edi, dword [r10 + 0x20]
add r8d, r12d
mov r11d, r13d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + rdi]
add rdx, r9
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x140002b7f
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x140002b60
cmp r11d, 0xe80fd3a
je 0x140002b89
test r8d, r8d
jne 0x140002b47
mov rax, qword [rax]
jmp 0x140002b22
mov edx, dword [r10 + 0x24]
mov ecx, esi
add rdx, r9
movzx r8d, word [rdx + r8*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov eax, dword [rdx + r8*4]
add rax, r9
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140002c1a
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140002c1a
mov edi, dword [r10 + 0x20]
add r9d, r12d
mov r11d, r13d
lea rcx, [r8 + r9*4]
mov edx, dword [rcx + rdi]
add rdx, r8
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x140002c15
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x140002bf6
cmp r11d, 0xcded1a85
je 0x140002c1f
test r9d, r9d
jne 0x140002bdd
mov rax, qword [rax]
jmp 0x140002bb8
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140002cb0
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140002cb0
mov edi, dword [r10 + 0x20]
add r9d, r12d
mov r11d, r13d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x140002cab
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x140002c8c
cmp r11d, 0xb8246c
je 0x140002cb5
test r9d, r9d
jne 0x140002c72
mov rax, qword [rax]
jmp 0x140002c4d
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rcx, [0x1400030ec]
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140002d4b
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140002d4b
mov edi, dword [r10 + 0x20]
add r9d, r12d
mov r11d, r13d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x140002d46
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x140002d27
cmp r11d, 0x345116d3
je 0x140002d50
test r9d, r9d
jne 0x140002d0d
mov rax, qword [rax]
jmp 0x140002ce8
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rcx, [0x1400030ec]
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140002dea
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x140002dea
mov edi, dword [r9 + 0x20]
add r10d, r12d
mov r11d, r13d
lea rcx, [rdi + r10*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x140002de5
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x140002dc2
cmp r11d, 0xa52bcaf9
je 0x1400028bc
test r10d, r10d
jne 0x140002da8
mov rax, qword [rax]
jmp 0x140002d83
or r12d, 0xffffffff
mov rax, qword [0x140007710]
test rax, rax
jne 0x140002e9e
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140002e79
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x140002e79
mov edi, dword [r9 + 0x20]
add r10d, r12d
mov r11d, 0x811c9dc5
lea rcx, [r8 + r10*4]
mov edx, dword [rcx + rdi]
add rdx, r8
mov cl, byte [rdx]
add rdx, r15
test cl, cl
je 0x140002e74
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
add rdx, r15
test cl, cl
jne 0x140002e55
cmp r11d, 0x2fa62ca8
je 0x140002e7e
test r10d, r10d
jne 0x140002e39
mov rax, qword [rax]
jmp 0x140002e14
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov qword [0x140007710], rax
mov ecx, 0x1f4
call rax
movdqa xmm0, xmmword [0x1400053f0]
mov rcx, r14
movdqa xmm1, xmmword [0x1400053e0]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm0, xmmword [0x140005390]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmm1, xmmword [0x140005440]
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmm0, xmmword [0x140005380]
movdqa xmmword [rbp], xmm1
movdqa xmm1, xmmword [0x140005360]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmm0, xmmword [0x140005370]
movdqa xmmword [rbp + 0x20], xmm1
movdqa xmm1, xmmword [0x1400054b0]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm0, xmmword [0x1400054c0]
movdqa xmmword [rbp + 0x40], xmm1
movdqa xmm1, xmmword [0x140005450]
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmm0, xmmword [0x1400054a0]
movdqa xmmword [rbp + 0x60], xmm1
movdqa xmm1, xmmword [0x140005480]
movdqa xmmword [rbp + 0x70], xmm0
movdqa xmm0, xmmword [0x140005490]
movdqa xmmword [rbp + 0x80], xmm1
movdqa xmm1, xmmword [0x140005470]
movdqa xmmword [rbp + 0x90], xmm0
movdqa xmm0, xmmword [0x140005460]
movdqa xmmword [rbp + 0xa0], xmm1
movdqa xmm1, xmmword [0x140005420]
movdqa xmmword [rbp + 0xb0], xmm0
movdqa xmmword [rbp + 0xc0], xmm1
mov dword [rbp + 0xd0], 0x78466f4c
mov word [rbp + 0xd4], pe_nt_image_headers64
lea eax, [rcx + 5]
xor byte [rbp + rcx - 0x30], al
add rcx, r15
cmp rcx, 0x104
jb 0x140002f9a
mov byte [rbp + 0xd5], r14b
lea rax, [rbp - 0x30]
mov qword [rbp + 0x100], r14
or rbx, 0xffffffffffffffff
mov qword [rbp + 0x110], r14
mov qword [rbp + 0x118], 0xf
inc rbx
cmp byte [rax + rbx], r14b
jne 0x140002fd5
lea rcx, [rbp + 0x100]
cmp rbx, 0xf
ja 0x140003008
mov r8, rbx
mov qword [rbp + 0x110], rbx
lea rdx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0x100], r14b
jmp 0x140003014
lea r9, [rbp - 0x30]
mov rdx, rbx
call fcn.14000336c
lea rdx, [rbp + 0x100]
lea rcx, [rsp + 0x70]
call fcn.140001248
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.1400014a0
mov rdx, qword [rbp + 0xf8]
mov ebx, 0x1000
cmp rdx, 0x10
jb 0x140003079
mov rcx, qword [rbp + 0xe0]
inc rdx
mov rax, rcx
cmp rdx, rbx
jb 0x140003074
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003074
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400039f8
mov rdx, qword [rbp + 0x118]
cmp rdx, 0x10
jb 0x1400030b9
mov rcx, qword [rbp + 0x100]
inc rdx
mov rax, rcx
cmp rdx, rbx
jb 0x1400030b4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400030b4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400039f8
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.1400034b0
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret