Function at 0x1400b8050
Capabilities:
Create pipe
Encode data using base64
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x128
movaps xmmword [rsp + 0x110], xmm6
mov qword [rsp + 0x98], rcx
mov byte [rsp + 0x43], dl
movzx eax, dl
mov edx, 0x40080002
sub edx, eax
nop word cs:[rax + rax]
mov eax, dword [0x141dd5060]
or eax, dword [0x141dd5064]
imul eax, eax, 0x6275ccc5
imul rcx, rax, 0x44e447ed
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1c
xor eax, 0xf4b7b097
cmp eax, 0x2c82974f
jb 0x1400b8090
xor edi, edi
mov dword [rsp + 0x44], 8
mov sil, 1
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xorps xmm6, xmm6
lea r12, [rsp + 0xb0]
mov r13, qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
lea rbp, [rsp + 0x58]
xor eax, eax
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0xa0], edx
nop
mov eax, dword [0x141dd5068]
imul eax, dword [0x141dd506c]
add eax, 0x9b8b625c
mov rcx, rax
mov edx, 0xafea8815
imul rcx, rdx
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1c
imul eax, eax, 0xc03c4a99
cmp eax, 0x235fc9a7
jb 0x1400b8175
nop dword [rax + rax]
mov eax, dword [0x141dd5070]
xor edx, edx
div dword [0x141dd5074]
and eax, 0xd024a3f9
imul ebx, eax, 0xd6b0a1e
xor ebx, 0x20ed59b9
call r15
mov dword [rsp + 0x54], eax
mov rax, qword [0x141ddc4c8]
cmp ebx, 0x8134c24d
jbe 0x1400b81a6
call r15
mov dword [rsp + 0x54], eax
mov rax, qword [0x141ddc4c8]
jmp 0x1400b8140
mov rax, qword [rsp + 0xb0]
mov qword [0x141ddc4c8], rax
mov rax, qword [0x141ddc4c8]
test rax, rax
jne 0x1400b8240
mov eax, dword [0x141dd5078]
add eax, dword [0x141dd507c]
xor eax, 0x41c1
or eax, 0xed5f0c02
xor eax, 0x5102bc54
cmp eax, 0x4b39c54f
jb 0x1400b8223
nop word cs:[rax + rax]
mov eax, dword [0x141dd5080]
imul eax, dword [0x141dd5084]
imul eax, eax, 0x6b11f38c
imul rax, rax, 0x5f85649f
shr rax, 0x3d
imul ebx, eax, 0x1e4631f0
movaps xmmword [rsp + 0xb0], xmm6
mov edx, 0x10
mov rcx, r12
call r13
cmp ebx, 0xf54a7dfc
jne 0x1400b8190
movaps xmmword [rsp + 0xb0], xmm6
mov edx, 0x10
mov rcx, r12
call r13
jmp 0x1400b81e0
mov eax, 1
lock xadd qword [0x141ddc4c8], rax
mov qword [rsp + 0xf0], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0xc8], rax
lea rax, [0x1400573f0]
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0xd8], rax
lea rax, [0x140055820]
mov qword [rsp + 0xe0], rax
lea rax, [0x141dba8b8]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 2
mov qword [rsp + 0x78], 0
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 2
lea rcx, [rsp + 0xf8]
mov rdx, rbp
call fcn.14003a080
test r14, r14
sete al
or sil, al
test sil, 1
jne 0x1400b82fb
mov rcx, qword [0x141ddc4e0]
xor edx, edx
mov r8, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0xa8]
lea ebp, [rax + 1]
mov r11, qword [rsp + 0xf8]
mov r10, qword [rsp + 0x100]
mov rbx, qword [rsp + 0x108]
nop
mov eax, dword [0x141dd5088]
sub eax, dword [0x141dd508c]
add eax, 0xd52538b7
cmp eax, 0x70758b72
ja 0x1400b8320
lea rax, [r10 + rbx]
mov qword [rsp + 0x48], rax
nop word cs:[rax + rax]
mov eax, dword [0x141dd5090]
mov ecx, dword [0x141dd5094]
add eax, ecx
add eax, 0xaba28e43
and eax, 0x67953bb1
imul eax, eax, 0x32164574
cmp eax, 0x9aa57350
ja 0x1400b8350
test rbx, rbx
mov qword [rsp + 0x88], r10
mov qword [rsp + 0x90], r11
mov qword [rsp + 0xe8], rbx
mov dword [rsp + 0xa4], ebp
je 0x1400b8400
lea r13, [r10 + 1]
mov ecx, 0xee152511
mov eax, dword [0x141dd5098]
add eax, dword [0x141dd509c]
imul rax, rcx
shr rax, 0x3d
add eax, 0x95b38769
and eax, 0x9083803b
cmp eax, 0x7a3b6639
jb 0x1400b83a2
movzx esi, byte [r10]
test sil, sil
js 0x1400b8420
mov eax, dword [0x141dd50a8]
imul eax, dword [0x141dd50ac]
imul eax, eax, 0x1b06e516
and eax, 0x8b52a218
imul eax, eax, 0x8f51f08a
cmp eax, 0xe273de53
ja 0x1400b83d0
jmp 0x1400b84f4
mov r12d, 4
mov ebx, 8
xor r14d, r14d
xor r13d, r13d
xor esi, esi
xor ebp, ebp
jmp 0x1400b8544
mov ecx, esi
and ecx, 0x1f
mov eax, dword [0x141dd50a0]
xor edx, edx
div dword [0x141dd50a4]
or eax, 0xa7dff71b
cmp eax, 0x532d17a8
je 0x1400b8425
movzx r8d, byte [r10 + 1]
and r8d, 0x3f
cmp sil, 0xdf
jbe 0x1400b84e8
lea r13, [r10 + 3]
movzx r9d, byte [r10 + 2]
shl r8d, 6
mov eax, dword [0x141dd50b0]
xor edx, edx
div dword [0x141dd50b4]
mov eax, dword [0x141dd50b8]
and eax, dword [0x141dd50bc]
mov edx, 0xbf89decb
imul rax, rdx
shr rax, 0x39
cmp eax, 0x117e2f8a
je 0x1400b846d
and r9d, 0x3f
or r8d, r9d
cmp sil, 0xf0
jb 0x1400b8570
mov eax, dword [0x141dd50c0]
imul eax, dword [0x141dd50c4]
add eax, 0x67c800e8
and eax, 0x49402452
cmp eax, 0xf8496ca1
je 0x1400b849e
lea r13, [r10 + 4]
shl ecx, 0x12
movzx esi, byte [r10 + 3]
and ecx, 0x1c0000
shl r8d, 6
and esi, 0x3f
or esi, r8d
or esi, ecx
cmp esi, 0xffff
ja 0x1400b8590
jmp 0x1400b84f4
lea r13, [r10 + 2]
shl ecx, 6
or ecx, r8d
mov esi, ecx
mov eax, 1
xor r14d, r14d
mov rcx, qword [rsp + 0x48]
sub rcx, r13
add rcx, 3
mov rdx, 0xffffffffffffffff
cmovb rcx, rdx
shr rcx, 2
lea rdx, [rcx + rax]
lea r12, [rcx + rax]
inc r12
cmp rdx, 3
mov eax, 4
cmovb r12, rax
mov rax, r12
shr rax, 0x3e
jne 0x1400b906a
lea rbx, [r12 + r12]
mov bp, 1
mov eax, dword [0x141dd50f0]
xor eax, dword [0x141dd50f4]
xor eax, 0xb4de8bf4
imul eax, eax, 0xfb111d7f
add eax, 0x4587d5f8
cmp eax, 0xf64fa3ce
jb 0x1400b8639
jmp 0x1400b8600
shl ecx, 0xc
or r8d, ecx
mov esi, r8d
cmp esi, 0xffff
jbe 0x1400b84f4
nop word cs:[rax + rax]
mov eax, dword [0x141dd50c8]
or eax, dword [0x141dd50cc]
and eax, 0x81650c02
imul eax, eax, 0x549b8a9b
cmp eax, 0xa72de1e5
ja 0x1400b8590
lea ecx, [rsi + 0xff0000]
mov eax, dword [0x141dd50d0]
xor edx, edx
div dword [0x141dd50d4]
imul eax, eax, 0x75b9cf38
cmp eax, 0xf715e3d8
ja 0x1400b85b4
shr ecx, 0xa
or ecx, 0xd800
and esi, 0x3ff
or esi, 0xdc00
mov eax, 2
mov r14d, esi
mov esi, ecx
jmp 0x1400b84fc
mov eax, dword [0x141dd50f8]
and eax, dword [0x141dd50fc]
or eax, 0xa2348f1c
imul r15d, eax, 0x6f8fc90f
xor r15d, 0xad436bb6
movzx eax, byte [0x141ddc4f8]
xor ecx, ecx
mov rdx, rbx
call fcn.1400c0a10
cmp r15d, 0xfd795daf
jbe 0x1400b8650
movzx eax, byte [0x141ddc4f8]
xor ecx, ecx
mov rdx, rbx
call fcn.1400c0a10
jmp 0x1400b8600
mov rcx, rax
test rax, rax
je 0x1400b9034
mov eax, dword [0x141dd5108]
or eax, dword [0x141dd510c]
mov edx, 0xc403eed1
imul rax, rdx
shr rax, 0x3c
add eax, 0x3ea0d137
cmp eax, 0x462a002c
ja 0x1400b86b2
nop word cs:[rax + rax]
mov eax, dword [0x141dd5110]
mov edx, dword [0x141dd5114]
add eax, edx
add eax, 0xef8fa76d
or eax, 0x56e2015d
mov word [rcx], si
cmp eax, 0x7e220c42
jbe 0x1400b86c0
mov word [rcx], si
jmp 0x1400b8690
mov eax, dword [0x141dd5118]
and eax, dword [0x141dd511c]
imul eax, eax, 0xbfc0cf6d
add eax, 0x713c02e1
or eax, 0x6c29cec1
cmp eax, 0x3c0031ea
mov r10d, 0xa286dee9
mov r11, qword [rsp + 0x48]
jb 0x1400b8720
nop
mov eax, dword [0x141dd5120]
xor eax, dword [0x141dd5124]
add eax, 0xb6da4cf1
xor eax, 0x83777bc9
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], 1
cmp eax, 0x25f0b795
jae 0x1400b8740
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], 1
jmp 0x1400b86f0
mov eax, 1
nop word cs:[rax + rax]
mov rbx, rax
mov eax, dword [0x141dd5128]
mov edx, dword [0x141dd512c]
add eax, edx
add eax, 0x652cc66e
or eax, 0x7e7bfabb
cmp eax, 0x48a06610
jb 0x1400b8753
test r13, r13
je 0x1400b89a0
nop dword [rax + rax]
mov eax, dword [0x141dd5130]
and eax, dword [0x141dd5134]
cmp eax, 0xe136fd5
je 0x1400b8780
nop word cs:[rax + rax]
mov eax, dword [0x141dd5138]
imul eax, dword [0x141dd513c]
imul eax, eax, 0x947d790e
add eax, 0x28a73a63
cmp eax, 0xf79daa7c
ja 0x1400b87a0
test r14w, r14w
je 0x1400b87e0
xor r9d, r9d
mov esi, r14d
cmp rbx, qword [rsp + 0x58]
jne 0x1400b8a5a
jmp 0x1400b8b00
mov eax, dword [0x141dd5140]
add eax, dword [0x141dd5144]
imul eax, eax, 0x6e6ff881
xor eax, 0x729dcd74
add eax, 0xe111cf08
cmp eax, 0x4f1d365f
ja 0x1400b87e0
nop word cs:[rax + rax]
test dil, dil
jne 0x1400b8810
cmp r13, r11
je 0x1400b89a0
mov eax, dword [0x141dd5148]
and eax, dword [0x141dd514c]
or eax, 0x12265ff7
imul rdx, rax, 0x5949f15
shr rdx, 0x20
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1f
or eax, 0x85f52b18
cmp eax, 0xb0553e03
ja 0x1400b881e
lea rax, [r13 + 1]
nop word cs:[rax + rax]
mov edx, dword [0x141dd5150]
add edx, dword [0x141dd5154]
imul rdx, rdx, 0x75dbae4d
shr rdx, 0x3d
or edx, 0xb9745ece
imul edx, edx, 0x13b65bc6
cmp edx, 0xe9c43df
je 0x1400b8860
movzx r8d, byte [r13]
test r8b, r8b
jns 0x1400b8a46
mov edx, r8d
and edx, 0x1f
movzx r9d, byte [r13 + 1]
and r9d, 0x3f
cmp r8b, 0xdf
jbe 0x1400b8a36
nop word cs:[rax + rax]
mov eax, dword [0x141dd5158]
imul eax, dword [0x141dd515c]
add eax, 0xee0c34be
shr eax, 1
imul rax, r10
shr rax, 0x3b
cmp eax, 0x238eea0b
je 0x1400b88c0
lea rax, [r13 + 3]
movzx r10d, byte [r13 + 2]
mov r11d, dword [0x141dd5160]
xor r11d, dword [0x141dd5164]
or r11d, 0xc100ab89
mov esi, 0xc4569aab
imul r11, rsi
shr r11, 0x3d
and r11d, 2
cmp r11d, 0x612bd708
je 0x1400b88ec
shl r9d, 6
and r10d, 0x3f
or r10d, r9d
cmp r8b, 0xf0
jb 0x1400b8a83
movzx r8d, byte [r13 + 3]
add r13, 4
and edx, 7
shl edx, 0x12
shl r10d, 6
and r8d, 0x3f
or r8d, r10d
or r8d, edx
mov r11, qword [rsp + 0x48]
nop word cs:[rax + rax]
mov eax, dword [0x141dd5168]
xor edx, edx
div dword [0x141dd516c]
xor eax, 0x1a002044
and eax, 0x5b02a645
add eax, 0xb24585e7
cmp eax, 0x7ec4cfab
jb 0x1400b8960
mov rax, r13
cmp r8d, 0xffff
ja 0x1400b8a9e
mov r10d, 0xa286dee9
jmp 0x1400b8a46
mov eax, dword [0x141dd5178]
xor edx, edx
div dword [0x141dd517c]
add eax, 0xafada99c
and eax, 0xaa6b3ac4
cmp eax, 0x544bbf6f
jb 0x1400b89a0
mov r12, qword [rsp + 0x58]
nop word cs:[rax + rax]
mov eax, dword [0x141dd5180]
imul eax, dword [0x141dd5184]
imul eax, eax, 0x9ea961e3
add eax, 0x5ee739c6
and eax, 0x18cf9dff
cmp eax, 0x7429c8ab
je 0x1400b89d0
cmp bp, 1
jne 0x1400b8cc0
nop
mov eax, dword [0x141dd5188]
xor eax, dword [0x141dd518c]
imul eax, eax, 0x9a0e6295
cmp eax, 0xc422fe30
ja 0x1400b8a00
xor esi, esi
mov r13d, 0
mov ebp, 0
mov r15d, 0
cmp rbx, r12
jne 0x1400b8a5d
jmp 0x1400b8baf
add r13, 2
shl edx, 6
or edx, r9d
mov rax, r13
mov r8d, edx
xor r9d, r9d
mov r13, rax
mov esi, r8d
cmp rbx, qword [rsp + 0x58]
je 0x1400b8b00
mov r14d, r9d
mov eax, dword [0x141dd51b0]
sub eax, dword [str.j_oEV]
add eax, 0x851edf45
and eax, 0x6d7d9d08
cmp eax, 0x5f7f2210
ja 0x1400b8cab
jmp 0x1400b8c70
shl edx, 0xc
or r10d, edx
mov r8d, r10d
mov r11, qword [rsp + 0x48]
cmp r8d, 0xffff
jbe 0x1400b8994
lea esi, [r8 + 0xff0000]
shr esi, 0xa
or esi, 0xd800
and r8d, 0x3ff
mov r10d, 0xa286dee9
mov edx, dword [0x141dd5170]
imul edx, dword [0x141dd5174]
imul edx, edx, 0x42133d2b
add edx, 0x8a12bdd4
xor edx, 0xb2445e9f
movzx r9d, r8w
or r9d, 0xdc00
cmp edx, 0xfca59c8
jb 0x1400b8abb
mov r13, rax
cmp rbx, qword [rsp + 0x58]
jne 0x1400b8a5a
nop dword [rax + rax]
mov eax, dword [0x141dd5190]
sub eax, dword [0x141dd5194]
add eax, 0x15a92b4
or eax, 0xf37c5dae
cmp eax, 0x46d6592c
jb 0x1400b8b00
mov eax, dword [0x141dd5198]
xor edx, edx
div dword [0x141dd519c]
mov ecx, dword [0x141dd51a0]
or ecx, dword [0x141dd51a4]
and ecx, 0x336070ef
add ecx, 0xcbe377ac
xor ecx, 0x69cb3242
mov rax, r11
sub rax, r13
add rax, 3
mov rdx, 0xffffffffffffffff
cmovb rax, rdx
cmp ecx, 0xc72c54c8
ja 0x1400b8b2b
nop word cs:[rax + rax]
mov ecx, dword [0x141dd51a8]
or ecx, dword [0x141dd51ac]
and ecx, 0xa00000a0
or ecx, 0x4f5f791d
imul ecx, ecx, 0xe9eeb3a1
mov r15, rax
shr r15, 2
cmp r9w, 1
sbb r15, 0xffffffffffffffff
cmp ecx, 0x6caad29b
jbe 0x1400b8b70
movzx eax, bp
add r15, rax
mov r14d, r9d
mov eax, dword [0x141dd51c0]
and eax, dword [0x141dd51c4]
and eax, 0x33c41e4f
imul eax, eax, 0xda35aeff
xor eax, 0x83405930
cmp eax, 0x5022042f
jb 0x1400b8c40
mov eax, dword [0x141dd51c8]
add eax, dword [0x141dd51cc]
xor eax, 0xb3811bd7
imul r12d, eax, 0xa0180858
imul rax, r12, 0x2c0da545
shr rax, 0x20
sub r12d, eax
shr r12d, 1
add r12d, eax
shr r12d, 0x1f
lea r8, [r15 + 1]
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rsp + 0x58]
mov rdx, rbx
call fcn.1400fe550
cmp r12d, 0x606eec7
ja 0x1400b8c40
mov rcx, qword [rsp + 0x60]
mov r10d, 0xa286dee9
mov r11, qword [rsp + 0x48]
jmp 0x1400b8a5d
lea r8, [r15 + 1]
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rsp + 0x58]
mov rdx, rbx
call fcn.1400fe550
jmp 0x1400b8bd2
mov eax, dword [0x141dd51b8]
add eax, dword [0x141dd51bc]
imul eax, eax, 0x7a732867
and eax, 0xf45dff81
imul rdx, rax, 0x18149f67
shr rdx, 0x3c
lea rax, [rbx + 1]
mov word [rcx + rbx*2], si
mov qword [rsp + 0x68], rax
cmp edx, 0x604727c3
jne 0x1400b8750
mov word [rcx + rbx*2], si
lea rax, [rbx + 1]
mov qword [rsp + 0x68], rax
jmp 0x1400b8c70
mov eax, dword [0x141dd51d0]
imul eax, dword [0x141dd51d4]
imul eax, eax, 0x97d95a19
cmp eax, 0x4e5b372a
mov ebp, dword [rsp + 0xa0]
mov r14, qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov r13d, dword [rsp + 0x44]
je 0x1400b8f30
nop word cs:[rax + rax]
mov esi, dword [0x141dd51d8]
or esi, dword [0x141dd51dc]
or esi, 0x3bec9ab9
mov r15, qword [rsp + 0x60]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
mov rcx, r15
mov edx, ebp
mov r8d, r13d
mov r9d, 1
call r14
cmp esi, 0xac765e9e
je 0x1400b8f30
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400b8f70
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13, qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
lea rbp, [rsp + 0x58]
mov r8d, dword [rsp + 0x44]
mov r9d, dword [rsp + 0xa4]
nop word cs:[rax + rax]
mov ecx, dword [0x141dd5208]
and ecx, dword [0x141dd520c]
add ecx, 0xd6d1d919
imul rcx, rcx, 0x149d4b17
shr rcx, 0x3c
xor ecx, 0x464283e7
cmp ecx, 0x5a01ca53
ja 0x1400b8d90
nop dword [rax + rax]
mov ecx, dword [0x141dd5210]
imul ecx, dword [0x141dd5214]
imul ecx, ecx, 0x2019c1d4
cmp ecx, 0x132e4ea2
je 0x1400b8dc0
cmp r9d, 0xa
jge 0x1400b8fe0
mov ecx, dword [0x141dd5248]
and ecx, dword [0x141dd524c]
mov edx, 0x87b21009
imul rcx, rdx
shr rcx, 0x3d
and ecx, 3
cmp ecx, 0xdbf593a7
ja 0x1400b8de5
nop dword [rax]
mov ecx, dword [0x141dd5250]
add ecx, dword [0x141dd5254]
xor ecx, 0x9005014
or ecx, 0xe0d5ad6a
add ecx, 0x35328750
cmp ecx, 0xe9c5f6f4
ja 0x1400b8e10
cmp eax, 5
jne 0x1400b8e50
mov eax, r9d
mov qword [rsp + 0xa8], rax
jmp 0x1400b8ec3
mov ecx, dword [0x141dd5270]
xor ecx, dword [0x141dd5274]
add ecx, 0x8916cb69
imul rcx, rcx, 0x6cb486a7
shr rcx, 0x3e
or ecx, 0x8aff190c
cmp ecx, 0xbe2c6859
ja 0x1400b8e50
cmp eax, 0x57
sete dl
test r8d, r8d
setne cl
and cl, dl
mov r8d, 0xfacabb07
nop
mov edx, dword [0x141dd5278]
or edx, dword [0x141dd527c]
xor edx, 0xcd3f5ba0
imul rdx, r8
shr rdx, 0x3e
add edx, 0xdaab60fb
cmp edx, 0xd1930039
jb 0x1400b8e90
xor r8d, r8d
test cl, cl
je 0x1400b8fe0
mov dword [rsp + 0x44], r8d
test r12, r12
je 0x1400b8edf
mov rcx, qword [0x141ddc4e0]
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r12, [rsp + 0xb0]
nop word [rax + rax]
mov eax, dword [0x141dd5268]
xor esi, esi
xor edx, edx
div dword [0x141dd526c]
or eax, 0xba2b69c4
imul eax, eax, 0xb19251cc
cmp eax, 0xec5cb4ea
je 0x1400b8ef0
mov r14, qword [rsp + 0x90]
mov r15, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x1400b8100
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
mov edx, ebp
mov r8d, r13d
mov r9d, 1
call r14
jmp 0x1400b8d00
mov eax, dword [0x141dd51e0]
sub eax, dword [0x141dd51e4]
imul eax, eax, 0x6f1ce5bb
add eax, 0x354276df
or eax, 0x29de44b4
cmp eax, 0x34dea5a0
je 0x1400b8f70
test r12, r12
je 0x1400b9102
mov r14, qword [0x141ddc4e0]
mov eax, dword [0x141dd51e8]
mov ecx, dword [str.2_P]
add eax, ecx
add eax, 0xfc98718a
imul rcx, rax, 0x18e4129b
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1c
imul eax, eax, 0x3dc25123
cmp eax, 0xe92b03e2
ja 0x1400b90c3
jmp 0x1400b9090
shl rax, 0x20
or rax, 2
mov rcx, qword [rsp + 0x98]
mov qword [rcx + 8], rax
mov qword [rcx], 1
mov rdi, 0xffffffffffffffff
test r12, r12
je 0x1400b92d6
mov r14, qword [0x141ddc4e0]
mov eax, dword [0x141dd5258]
or eax, dword [0x141dd525c]
imul eax, eax, 0x4d0b059d
cmp eax, 0xdf8054d0
je 0x1400b92c6
jmp 0x1400b9298
ud2
mov eax, dword [0x141dd50d8]
xor eax, dword [0x141dd50dc]
xor eax, 0x80110000
or eax, 0x7deeff7f
cmp eax, 0xc404a975
je 0x1400b93d9
jmp 0x1400b93af
mov eax, dword [0x141dd51f0]
imul eax, dword [str.w0s_]
add eax, 0xbb4c8ab2
xor eax, 0x6a94732a
imul esi, eax, 0x90cef132
mov rcx, r14
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, 0x5bb17b6b
jae 0x1400b90e0
mov rcx, r14
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400b9090
mov eax, dword [0x141dd51f8]
and eax, dword [0x141dd51fc]
add eax, 0x4bc5ecfc
and eax, 0x59025e2
add eax, 0xe089feb2
cmp eax, 0xe9ae7b2b
ja 0x1400b90e0
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x74], 0
mov word [rsp + 0x7c], 0
movzx eax, byte [rsp + 0x43]
mov byte [rsp + 0x79], al
xor al, 1
mov byte [rsp + 0x78], al
mov dword [rsp + 0x70], 0
mov dword [rsp + 0xc8], 0x18
mov qword [rsp + 0xd0], 0
mov dword [rsp + 0xd8], 1
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x58]
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0xe8]
call fcn.140093790
nop word cs:[rax + rax]
mov ecx, dword [0x141dd5200]
mov r8d, dword [0x141dd5204]
add ecx, r8d
add ecx, 0x39ebc119
or ecx, 0x5f1a6463
cmp ecx, 0xab83c6d3
je 0x1400b9190
test rax, rax
mov rcx, qword [rsp + 0x90]
je 0x1400b91e5
mov rax, qword [rsp + 0x98]
mov qword [rax + 8], rdx
mov qword [rax], 1
mov rdi, rbx
test rcx, rcx
jne 0x1400b92e3
jmp 0x1400b9320
mov rax, qword [rsp + 0x98]
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
mov qword [rax], 0
nop dword [rax]
mov eax, dword [0x141dd5218]
xor edx, edx
div dword [0x141dd521c]
not eax
or eax, 0xffdffefd
cmp eax, 0xe8a20fb6
jb 0x1400b9200
test rcx, rcx
mov r8, qword [rsp + 0x88]
je 0x1400b9370
mov eax, dword [0x141dd5220]
add eax, dword [0x141dd5224]
or eax, 0xaf7959f7
mov ecx, 0x8f53e0af
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0x6d2841f9
jbe 0x1400b9260
mov rax, qword [0x141ddc4e0]
nop word [rax + rax]
mov eax, dword [0x141dd5228]
xor edx, edx
div dword [0x141dd522c]
and eax, 0x2563d314
xor eax, 0xe2c5625c
add eax, 0xafd7bda0
mov rcx, qword [0x141ddc4e0]
cmp eax, 0xcab601eb
ja 0x1400b9260
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400b9370
mov esi, dword [0x141dd5260]
sub esi, dword [0x141dd5264]
add esi, 0xafb57654
or esi, 0xa4db9761
mov rcx, r14
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, 0x460c7b00
jne 0x1400b92d6
mov rcx, r14
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400b9298
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x1400b9320
xor eax, eax
test al, al
je 0x1400b92f0
mov rax, qword [0x141ddc4e0]
mov eax, dword [0x141dd5238]
xor eax, dword [0x141dd523c]
or eax, 0xffef5edf
mov rcx, qword [0x141ddc4e0]
cmp eax, 0xc8231aa2
jb 0x1400b92f0
xor edx, edx
mov r8, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov eax, dword [0x141dd5240]
xor eax, dword [0x141dd5244]
or eax, 0x26a18001
and eax, 0xa6a1c001
cmp eax, 0x204ba6c
jb 0x1400b9320
cmp rbx, 0xffffffffffffffff
je 0x1400b9370
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax]
mov eax, dword [0x141dd5280]
sub eax, dword [0x141dd5284]
or eax, 0xedb47c7e
and eax, 0xfff5fcff
cmp eax, 0x1c5e014a
je 0x1400b9350
nop dword [rax]
mov eax, dword [0x141dd5230]
xor eax, dword [0x141dd5234]
and eax, 0x67440bbe
imul eax, eax, 0x5f71f446
add eax, 0xf663f6f4
cmp eax, 0xd8efa57d
ja 0x1400b9370
movaps xmm6, xmmword [rsp + 0x110]
add rsp, 0x128
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x141dd50e0]
or eax, dword [0x141dd50e4]
or eax, 0x268c2320
add eax, 0x5139b70f
imul rax, rax, 0x5fee2dff
shr rax, 0x3b
ud2
ud2