Function at 0x140001000
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1c8
mov r15, rdx
mov r12, rcx
mov rax, qword [0x14002d248]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov dword [rsp + 0x64], 0x10b
mov dword [rsp + 0x60], 0x20b
xor ecx, ecx
mov edx, 1
mov r8d, 0x774393e8
mov r9d, 0x32
call fcn.14000269b
test rax, rax
je 0x14000106b
lea rdx, [rsp + 0xb0]
mov rcx, r12
mov r8d, 0x104
call rax
mov byte [rsp + 0x88], 0x29
mov byte [rsp + 0x89], 0x77
mov byte [rsp + 0x8a], 0
xor eax, eax
add byte [rsp + rax + 0x88], 0xfc
test rax, rax
mov eax, 1
je 0x140001085
xor ecx, ecx
mov edx, 1
mov r8d, 0x8f8f114
mov r9d, 0x14
call fcn.14000269b
test rax, rax
je 0x1400012fc
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0xb0]
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call rax
test rax, rax
je 0x1400012fc
mov rdi, rax
xor esi, esi
xor ecx, ecx
mov edx, 1
mov r8d, 0xaef7cbf1
mov r9d, 0x25
call fcn.14000269b
test rax, rax
je 0x140001123
lea rdx, [rsp + 0x84]
mov rcx, rdi
call rax
mov rsi, rax
test esi, esi
je 0x1400013bd
mov dword [rsp + 0x88], 0x77
mov al, 0x52
mov byte [rsp + 0x8c], al
mov byte [rsp + 0x8d], 4
mov cl, 0x57
mov byte [rsp + 0x8e], cl
mov byte [rsp + 0x8f], 0x24
mov byte [rsp + 0x90], 0x1e
mov byte [rsp + 0x91], 0xd
mov byte [rsp + 0x92], 0x12
mov byte [rsp + 0x93], cl
mov byte [rsp + 0x94], 0x4a
mov byte [rsp + 0x95], cl
mov byte [rsp + 0x96], al
mov byte [rsp + 0x97], 2
mov byte [rsp + 0x98], 0
mov eax, 4
xor ecx, ecx
mov r8b, 0xff
mov r9b, 0xca
mov r10b, 0x35
mov dl, byte [rsp + rax + 0x88]
mov ebp, dword [rsp + 0x88]
mov ebx, edx
xor bl, r8b
and bl, r9b
and dl, r10b
or dl, bl
mov ebx, ebp
xor bl, r8b
and bl, r9b
and bpl, r10b
or bpl, bl
xor bpl, dl
mov byte [rsp + rax + 0x88], bpl
inc rcx
inc rax
cmp rax, 0x10
jne 0x1400011ad
mov byte [rsp + 0x98], 0
call fcn.140004004
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rdi
xor edx, edx
mov r8d, 2
xor r9d, r9d
call rax
test rax, rax
je 0x140001476
mov r14, rax
call fcn.140004136
mov ecx, esi
mov qword [rsp + 0x20], rcx
mov rcx, r14
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call rax
test rax, rax
je 0x1400015c5
mov rsi, rax
movsxd rax, dword [rax + 0x3c]
lea r10, [rsi + rax]
movzx eax, word [rsi + rax + 0x18]
mov ecx, dword [rsp + 0x64]
cmp ecx, eax
jne 0x140001910
mov dword [rsp + 0x88], 9
mov byte [rsp + 0x8c], 0x59
mov byte [rsp + 0x8d], 0x4c
mov byte [rsp + 0x8e], 0x3a
mov byte [rsp + 0x8f], 0x3b
mov byte [rsp + 0x90], 0
xor eax, eax
mov r8b, 0xff
mov r9b, 0xeb
mov bl, 0x14
mov dl, byte [rsp + rax + 0x8c]
mov edi, dword [rsp + 0x88]
mov ecx, edx
xor cl, r8b
and cl, r9b
and dl, bl
or dl, cl
mov ecx, edi
xor cl, r8b
and cl, r9b
and dil, bl
or dil, cl
xor dil, dl
mov byte [rsp + rax + 0x8c], dil
inc rax
cmp rax, 4
jne 0x1400012a5
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x58], r14
mov byte [rsp + 0x90], 0
add r10, 0x78
jmp 0x140001a0f
mov byte [rsp + 0x88], 0x2b
mov byte [rsp + 0x89], 0x79
mov al, 0x26
mov byte [rsp + 0x8a], al
mov byte [rsp + 0x8b], 0x49
mov cl, pe_nt_image_headers64
mov byte [rsp + 0x8c], cl
mov dl, 0x6b
mov byte [rsp + 0x8d], dl
mov byte [rsp + 0x8e], 0x67
mov byte [rsp + 0x8f], 0x7a
mov byte [rsp + 0x90], dl
mov byte [rsp + 0x91], 0x4c
mov byte [rsp + 0x92], 0x6f
mov byte [rsp + 0x93], 0x72
mov byte [rsp + 0x94], dl
mov byte [rsp + 0x95], 0x47
mov byte [rsp + 0x96], al
mov byte [rsp + 0x97], dl
mov byte [rsp + 0x98], cl
mov byte [rsp + 0x99], cl
mov byte [rsp + 0x9a], 0x75
mov byte [rsp + 0x9b], cl
mov byte [rsp + 0x9c], 0
xor eax, eax
add byte [rsp + rax + 0x88], 0xfa
inc rax
cmp rax, 0x14
jne 0x1400013a2
mov edi, 1
jmp 0x140002191
mov dword [rsp + 0x88], 0x3f
mov byte [rsp + 0x8c], 0x1a
mov byte [rsp + 0x8d], 0x4c
mov al, 0x1f
mov byte [rsp + 0x8e], al
mov byte [rsp + 0x8f], 0x6c
mov byte [rsp + 0x90], 0x56
mov byte [rsp + 0x91], 0x45
mov byte [rsp + 0x92], 0x5a
mov byte [rsp + 0x93], al
mov byte [rsp + 0x94], 2
mov byte [rsp + 0x95], al
mov byte [rsp + 0x96], 0xf
mov byte [rsp + 0x97], 0
mov eax, 4
xor ecx, ecx
mov r8b, 0xff
mov dl, byte [rsp + rax + 0x88]
mov ebp, dword [rsp + 0x88]
mov ebx, edx
xor bl, r8b
and bl, bpl
xor bpl, r8b
and bpl, dl
or bpl, bl
mov byte [rsp + rax + 0x88], bpl
inc rcx
inc rax
cmp rax, 0xf
jne 0x140001431
mov byte [rsp + 0x97], 0
mov edi, 2
jmp 0x1400015bd
mov dword [rsp + 0x88], 0x5d
mov byte [rsp + 0x8c], pe_nt_image_headers64
mov byte [rsp + 0x8d], 0x2e
mov r8b, 0x7d
mov byte [rsp + 0x8e], r8b
mov byte [rsp + 0x8f], 0x1e
mov cl, 0x2f
mov byte [rsp + 0x90], cl
mov dl, 0x38
mov byte [rsp + 0x91], dl
mov bl, 0x3c
mov byte [rsp + 0x92], bl
mov byte [rsp + 0x93], 0x29
mov byte [rsp + 0x94], dl
mov byte [rsp + 0x95], 0x1b
mov al, 0x34
mov byte [rsp + 0x96], al
mov byte [rsp + 0x97], 0x31
mov byte [rsp + 0x98], dl
mov byte [rsp + 0x99], 0x10
mov byte [rsp + 0x9a], bl
mov bl, 0x2d
mov byte [rsp + 0x9b], bl
mov byte [rsp + 0x9c], bl
mov byte [rsp + 0x9d], al
mov byte [rsp + 0x9e], 0x33
mov byte [rsp + 0x9f], 0x3a
mov byte [rsp + 0xa0], 0x1c
mov byte [rsp + 0xa1], r8b
mov byte [rsp + 0xa2], dl
mov byte [rsp + 0xa3], cl
mov byte [rsp + 0xa4], cl
mov byte [rsp + 0xa5], 0x32
mov byte [rsp + 0xa6], cl
mov byte [rsp + 0xa7], 0
mov eax, 4
xor ecx, ecx
mov r8b, 0xff
mov r9b, 0x62
mov r10b, 0x9d
mov dl, byte [rsp + rax + 0x88]
mov ebp, dword [rsp + 0x88]
mov ebx, edx
xor bl, r8b
and bl, r9b
and dl, r10b
or dl, bl
mov ebx, ebp
xor bl, r8b
and bl, r9b
and bpl, r10b
or bpl, bl
xor bpl, dl
mov byte [rsp + rax + 0x88], bpl
inc rcx
inc rax
cmp rax, 0x1f
jne 0x140001570
mov byte [rsp + 0xa7], 0
mov edi, 3
xor r14d, r14d
jmp 0x14000216a
mov dword [rsp + 0x88], 2
mov ebp, dword [rsp + 0x88]
mov al, 0xff
mov ebx, ebp
xor bl, al
mov r9b, 0xeb
and bl, r9b
mov dl, 0x14
and bpl, dl
or bpl, bl
xor bpl, 0xce
mov byte [rsp + 0x8c], bpl
mov ebp, dword [rsp + 0x88]
mov bl, 0xfe
sub bl, bpl
inc bpl
and bl, 0x73
and bpl, 0x8c
or bpl, bl
mov byte [rsp + 0x8d], bpl
mov ebp, dword [rsp + 0x88]
add bpl, 2
mov ebx, ebp
xor bl, al
and bl, 0x20
and bpl, 0xdf
or bpl, bl
mov byte [rsp + 0x8e], bpl
mov ebp, dword [rsp + 0x88]
add bpl, 3
mov ebx, ebp
xor bl, al
and bl, 0xcf
and bpl, 0x30
or bpl, bl
xor bpl, 0x82
mov byte [rsp + 0x8f], bpl
mov ebp, dword [rsp + 0x88]
add bpl, 4
mov ebx, ebp
xor bl, al
and bl, 0x61
and bpl, 0x9e
or bpl, bl
mov byte [rsp + 0x90], bpl
mov ebp, dword [rsp + 0x88]
add bpl, 5
mov ebx, ebp
xor bl, al
and bl, 0x70
and bpl, 0x8f
or bpl, bl
mov byte [rsp + 0x91], bpl
mov ebp, dword [rsp + 0x88]
add bpl, 6
mov ebx, ebp
xor bl, al
and bl, 0x56
and bpl, 0xa9
or bpl, bl
mov byte [rsp + 0x92], bpl
mov ebp, dword [rsp + 0x88]
mov bl, 0xf8
sub bl, bpl
add bpl, 7
mov r8b, 0x10
and bl, r8b
and bpl, 0xef
or bpl, bl
xor bpl, 0x79
mov byte [rsp + 0x93], bpl
mov ebp, dword [rsp + 0x88]
mov bl, 8
mov cl, 0xf7
sub cl, bpl
add bpl, bl
and cl, 0x6d
and bpl, 0x92
or bpl, cl
xor bpl, bl
mov byte [rsp + 0x94], bpl
mov ecx, dword [rsp + 0x88]
add cl, 9
mov ebx, ecx
xor bl, al
and bl, 0xa6
and cl, 0x59
or cl, bl
xor cl, 0xd1
mov byte [rsp + 0x95], cl
mov ecx, dword [rsp + 0x88]
mov bl, 0xf5
sub bl, cl
add cl, 0xa
and bl, 0x4f
and cl, 0xb0
or cl, bl
mov byte [rsp + 0x96], cl
mov ecx, dword [rsp + 0x88]
add cl, 0xb
mov ebx, ecx
xor bl, al
and bl, 0x88
and cl, 0x77
or cl, bl
xor cl, 0xee
mov byte [rsp + 0x97], cl
mov ecx, dword [rsp + 0x88]
add cl, 0xc
mov ebx, ecx
xor bl, al
and bl, 0x6a
and cl, 0x95
or cl, bl
xor cl, 0x2c
mov byte [rsp + 0x98], cl
mov ecx, dword [rsp + 0x88]
mov bl, 0xf2
sub bl, cl
add cl, 0xd
and bl, 0x69
and cl, 0x96
or cl, bl
mov byte [rsp + 0x99], cl
mov ecx, dword [rsp + 0x88]
add cl, 0xe
mov ebx, ecx
xor bl, al
and bl, 0x33
and cl, 0xcc
or cl, bl
xor cl, 0x5f
mov byte [rsp + 0x9a], cl
mov ecx, dword [rsp + 0x88]
add cl, 0xf
mov ebx, ecx
xor bl, al
mov r10b, 0x65
and bl, r10b
mov r11b, 0x9a
and cl, r11b
or cl, bl
mov byte [rsp + 0x9b], cl
mov ecx, dword [rsp + 0x88]
add cl, r8b
mov ebx, ecx
xor bl, al
and bl, 0x1d
and cl, 0xe2
or cl, bl
xor cl, 0x3d
mov byte [rsp + 0x9c], cl
mov ecx, dword [rsp + 0x88]
add cl, 0x11
mov ebx, ecx
xor bl, al
and bl, r10b
and cl, r11b
or cl, bl
mov byte [rsp + 0x9d], cl
mov ecx, dword [rsp + 0x88]
mov r11b, 0x12
add cl, r11b
mov ebx, ecx
xor bl, al
mov r8b, 0x72
and bl, r8b
mov r10b, 0x8d
and cl, r10b
or cl, bl
mov byte [rsp + 0x9e], cl
mov ecx, dword [rsp + 0x88]
mov bl, 0xec
sub bl, cl
add cl, 0x13
and bl, 0xed
and cl, r11b
or cl, bl
xor cl, 0x9f
mov byte [rsp + 0x9f], cl
mov ecx, dword [rsp + 0x88]
add dl, cl
sub r9b, cl
and r9b, 0x1b
and dl, 0xe4
or dl, r9b
xor dl, 0x74
mov byte [rsp + 0xa0], dl
mov ecx, dword [rsp + 0x88]
mov dl, 0xea
sub dl, cl
add cl, 0x15
and dl, r8b
and cl, r10b
or cl, dl
mov byte [rsp + 0xa1], cl
mov byte [rsp + 0xa2], 0
xor ecx, ecx
mov r8b, 0xd2
mov r9b, 0x2d
mov bl, byte [rsp + rcx + 0x8c]
mov ebp, dword [rsp + 0x88]
lea edi, [rcx + rbp]
mov edx, ebx
not dl
and dl, r8b
and bl, r9b
or bl, dl
mov edx, eax
sub dl, bpl
and dl, r8b
and dil, r9b
or dil, dl
xor dil, bl
mov byte [rsp + rcx + 0x8c], dil
inc rcx
dec al
cmp rcx, 0x16
jne 0x1400018bd
mov byte [rsp + 0xa2], 0
mov edi, 4
jmp 0x14000216a
movzx eax, word [r10 + 0x18]
mov ecx, dword [rsp + 0x60]
cmp ecx, eax
jne 0x1400020b4
mov dword [rsp + 0x88], 0x7c
mov eax, dword [rsp + 0x88]
mov r11b, 0xff
mov edx, eax
xor dl, r11b
and dl, 0x9b
and al, 0x64
or al, dl
xor al, 0xcb
mov byte [rsp + 0x8c], al
mov eax, dword [rsp + 0x88]
inc al
mov edx, eax
xor dl, r11b
and dl, 0xfa
and al, 5
or al, dl
xor al, 0xbf
mov byte [rsp + 0x8d], al
mov eax, dword [rsp + 0x88]
add al, 2
mov edx, eax
xor dl, r11b
and dl, 0x36
and al, 0xc9
or al, dl
mov byte [rsp + 0x8e], al
mov eax, dword [rsp + 0x88]
add al, 3
mov edx, eax
xor dl, r11b
and dl, 0x5e
and al, 0xa1
or al, dl
xor al, 0x6a
mov byte [rsp + 0x8f], al
mov byte [rsp + 0x90], 0
xor edx, edx
mov r8b, 0x1b
mov r9b, 0xe4
mov al, byte [rsp + rdx + 0x8c]
mov edi, dword [rsp + 0x88]
lea ebp, [rdx + rdi]
mov ebx, eax
not bl
and bl, r8b
and al, r9b
or al, bl
mov ecx, r11d
sub cl, dil
and cl, r8b
and bpl, r9b
or bpl, cl
xor bpl, al
mov byte [rsp + rdx + 0x8c], bpl
inc rdx
dec r11b
cmp rdx, 4
jne 0x1400019b3
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x58], r14
mov byte [rsp + 0x90], 0
add r10, 0x88
mov ecx, dword [r10]
mov rdx, rsi
call fcn.1400021b7
mov edi, eax
lea rax, [rsi + rdi]
mov qword [rsp + 0x70], rax
mov ecx, dword [rsi + rdi + 0x20]
mov rdx, rsi
call fcn.1400021b7
mov r15d, eax
add r15, rsi
mov ecx, dword [rsi + rdi + 0x24]
mov rdx, rsi
call fcn.1400021b7
mov r13d, eax
mov r14d, dword [rsi + rdi + 0x18]
mov dword [rsp + 0x88], 0x3a
mov r8b, 0x1f
mov byte [rsp + 0x8c], r8b
mov r9b, 0x49
mov byte [rsp + 0x8d], r9b
mov dl, 0x1a
mov byte [rsp + 0x8e], dl
mov bl, 0x74
mov byte [rsp + 0x8f], bl
mov r10b, 0x4f
mov byte [rsp + 0x90], r10b
mov cl, 0x57
mov byte [rsp + 0x91], cl
mov byte [rsp + 0x92], 0x58
mov al, 0x5f
mov byte [rsp + 0x93], al
mov byte [rsp + 0x94], 0x48
mov byte [rsp + 0x95], 0x75
mov byte [rsp + 0x96], 0x5c
mov byte [rsp + 0x97], bl
mov byte [rsp + 0x98], 0x5b
mov byte [rsp + 0x99], cl
mov byte [rsp + 0x9a], al
mov byte [rsp + 0x9b], r9b
mov byte [rsp + 0x9c], dl
mov byte [rsp + 0x9d], 7
mov byte [rsp + 0x9e], dl
mov byte [rsp + 0x9f], r8b
mov byte [rsp + 0xa0], r10b
mov byte [rsp + 0xa1], 0
mov eax, 4
xor ecx, ecx
mov r8b, 0xff
mov dl, byte [rsp + rax + 0x88]
mov ebp, dword [rsp + 0x88]
mov ebx, edx
xor bl, r8b
and bl, bpl
xor bpl, r8b
and bpl, dl
or bpl, bl
mov byte [rsp + rax + 0x88], bpl
inc rcx
inc rax
cmp rax, 0x19
jne 0x140001b18
mov byte [rsp + 0xa1], 0
test r14d, r14d
je 0x140002086
add r13, rsi
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x54], 0
mov qword [rsp + 0x48], r12
dec r14d
mov ecx, dword [r15]
mov rdx, rsi
call fcn.1400021b7
mov ebx, eax
mov rax, qword [rsp + 0x70]
mov ecx, dword [rax + 0x1c]
mov rdx, rsi
call fcn.1400021b7
mov eax, eax
movzx ecx, word [r13]
add rax, rsi
movabs rdx, 0x59f487f93aa524fd
add rax, rdx
lea rax, [rax + rcx*4]
sub rax, rdx
mov ecx, dword [rax]
mov rdx, rsi
call fcn.1400021b7
mov edi, eax
add rdi, rsi
mov rcx, rdi
call fcn.14000225b
test al, al
jne 0x140001dce
xor ecx, ecx
mov edx, 1
mov r8d, 0x1fc0eaee
mov r9d, 7
call fcn.14000269b
test rax, rax
je 0x140001dce
mov rbp, rax
mov edx, ebx
add rdx, rsi
mov rcx, r12
call rax
test rax, rax
je 0x140001dc9
mov r12, rax
mov al, byte [rax]
cmp al, 0xe9
je 0x140001c25
cmp al, 0xff
jne 0x140001dc9
cmp byte [r12 + 1], 0x25
jne 0x140001dc9
mov r8d, 2
mov rcx, rdi
mov rdx, r12
call fcn.14000276e
test eax, eax
je 0x140001dc9
xor eax, eax
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x7c], eax
mov dword [rsp + 0x88], 0x2a
mov ecx, dword [rsp + 0x88]
mov r8b, 0xff
mov edx, ecx
xor dl, r8b
and dl, 0x66
and cl, 0x99
or cl, dl
mov byte [rsp + 0x8c], cl
mov ecx, dword [rsp + 0x88]
mov dl, 0xfe
sub dl, cl
inc cl
and dl, 0x6e
and cl, 0x91
or cl, dl
mov byte [rsp + 0x8d], cl
mov ecx, dword [rsp + 0x88]
add cl, 2
mov edx, ecx
xor dl, r8b
and dl, 0xf3
and cl, 0xc
or cl, dl
xor cl, 0xd3
mov byte [rsp + 0x8e], cl
mov ecx, dword [rsp + 0x88]
mov dl, 0xfc
sub dl, cl
add cl, 3
and dl, 0x3d
and cl, 0xc2
or cl, dl
mov byte [rsp + 0x8f], cl
mov ecx, dword [rsp + 0x88]
add cl, 4
mov edx, ecx
xor dl, r8b
and dl, 0xbd
and cl, 0x42
or cl, dl
xor cl, 0x9d
mov byte [rsp + 0x90], cl
mov ecx, dword [rsp + 0x88]
add cl, 5
mov edx, ecx
xor dl, r8b
and dl, 0x25
and cl, 0xda
or cl, dl
mov byte [rsp + 0x91], cl
mov ecx, dword [rsp + 0x88]
add cl, 6
mov edx, ecx
xor dl, r8b
and dl, 0x73
and cl, 0x8c
or cl, dl
mov byte [rsp + 0x92], cl
mov byte [rsp + 0x93], 0
xor ecx, ecx
mov dl, byte [rsp + rcx + 0x8c]
mov ebp, dword [rsp + 0x88]
lea ebx, [rcx + rbp]
mov eax, r8d
sub al, bpl
and al, dl
not dl
and bl, dl
or al, bl
mov byte [rsp + rcx + 0x8c], al
inc rcx
dec r8b
cmp rcx, 7
jne 0x140001d35
mov byte [rsp + 0x93], 0
call fcn.140004468
mov edx, 0x40
mov rcx, r12
mov r8d, 0x40
lea r9, [rsp + 0x80]
call rax
test eax, eax
je 0x140001de4
mov rcx, r12
mov rdx, rdi
mov r8d, 0xa
call fcn.140002723
call fcn.140004468
mov r8d, dword [rsp + 0x80]
mov edx, 0x40
mov rcx, r12
lea r9, [rsp + 0x7c]
call rax
test eax, eax
je 0x140001f12
inc dword [rsp + 0x54]
mov r12, qword [rsp + 0x48]
add r15, 4
add r13, 2
test r14d, r14d
jne 0x140001b74
jmp 0x140002096
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8b, 0x26
mov byte [rsp + 0x88], r8b
mov byte [rsp + 0x89], 0x74
mov byte [rsp + 0x8a], 0x29
mov byte [rsp + 0x8b], 0x2a
mov r9b, 0x3b
mov byte [rsp + 0x8c], r9b
mov dl, 0x21
mov byte [rsp + 0x8d], dl
mov r10b, 0x66
mov byte [rsp + 0x8e], r10b
mov al, 0x73
mov byte [rsp + 0x8f], al
mov byte [rsp + 0x90], al
mov cl, 0x70
mov byte [rsp + 0x91], cl
mov byte [rsp + 0x92], al
mov byte [rsp + 0x93], dl
mov byte [rsp + 0x94], 0x57
mov byte [rsp + 0x95], 0x6a
mov byte [rsp + 0x96], al
mov bl, 0x75
mov byte [rsp + 0x97], bl
mov byte [rsp + 0x98], 0x76
mov byte [rsp + 0x99], 0x62
mov byte [rsp + 0x9a], 0x6d
mov byte [rsp + 0x9b], 0x51
mov byte [rsp + 0x9c], al
mov byte [rsp + 0x9d], cl
mov byte [rsp + 0x9e], bl
mov byte [rsp + 0x9f], r10b
mov byte [rsp + 0xa0], 0x64
mov byte [rsp + 0xa1], bl
mov byte [rsp + 0xa2], 0x32
mov byte [rsp + 0xa3], r9b
mov byte [rsp + 0xa4], dl
mov byte [rsp + 0xa5], r8b
mov byte [rsp + 0xa6], 0x65
mov byte [rsp + 0xa7], 0
xor eax, eax
mov r12, qword [rsp + 0x48]
dec byte [rsp + rax + 0x88]
inc rax
cmp rax, 0x1f
jne 0x140001ef5
mov dword [rsp + 0x44], 7
jmp 0x140001dce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x88], pe_nt_image_headers64
mov r8b, 0x5d
mov byte [rsp + 0x8c], r8b
mov byte [rsp + 0x8d], 0xb
mov byte [rsp + 0x8e], 0x50
mov byte [rsp + 0x8f], 0x51
mov r9b, 0x42
mov byte [rsp + 0x90], r9b
mov dl, 0x58
mov byte [rsp + 0x91], dl
mov r10b, 0x1d
mov byte [rsp + 0x92], r10b
mov al, 0xa
mov byte [rsp + 0x93], al
mov byte [rsp + 0x94], al
mov cl, 0x17
mov byte [rsp + 0x95], cl
mov byte [rsp + 0x96], al
mov byte [rsp + 0x97], dl
mov byte [rsp + 0x98], 0x2e
mov byte [rsp + 0x99], 0x11
mov byte [rsp + 0x9a], al
mov bl, 0xc
mov byte [rsp + 0x9b], bl
mov byte [rsp + 0x9c], 0xd
mov byte [rsp + 0x9d], 0x19
mov byte [rsp + 0x9e], 0x14
mov byte [rsp + 0x9f], 0x28
mov byte [rsp + 0xa0], al
mov byte [rsp + 0xa1], cl
mov byte [rsp + 0xa2], bl
mov byte [rsp + 0xa3], r10b
mov byte [rsp + 0xa4], 0x1b
mov byte [rsp + 0xa5], bl
mov byte [rsp + 0xa6], 0x4a
mov byte [rsp + 0xa7], r9b
mov byte [rsp + 0xa8], dl
mov byte [rsp + 0xa9], r8b
mov byte [rsp + 0xaa], 0x1c
mov byte [rsp + 0xab], 0
xor eax, eax
mov r12, qword [rsp + 0x48]
mov r8b, 0xff
mov r9b, 0x34
mov r10b, 0xcb
mov bl, byte [rsp + rax + 0x8c]
mov edx, dword [rsp + 0x88]
mov ecx, ebx
xor cl, r8b
and cl, r9b
and bl, r10b
or bl, cl
mov ecx, edx
xor cl, r8b
and cl, r9b
and dl, r10b
or dl, cl
xor dl, bl
mov byte [rsp + rax + 0x8c], dl
inc rax
cmp rax, 0x1f
jne 0x140002037
mov byte [rsp + 0xab], 0
mov dword [rsp + 0x44], 8
jmp 0x140001dce
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x44], 0
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x1400020a6
mov ecx, dword [rsp + 0x54]
mov dword [rax], ecx
mov r14, qword [rsp + 0x58]
mov edi, dword [rsp + 0x44]
jmp 0x140002160
mov dword [rsp + 0x88], 0x79
mov byte [rsp + 0x8c], 0x29
mov byte [rsp + 0x8d], 0x3c
mov al, 1
mov byte [rsp + 0x8e], al
mov byte [rsp + 0x8f], al
mov byte [rsp + 0x90], 0x59
mov byte [rsp + 0x91], 0x1c
mov al, 0xb
mov byte [rsp + 0x92], al
mov byte [rsp + 0x93], al
mov byte [rsp + 0x94], 0x16
mov byte [rsp + 0x95], al
mov byte [rsp + 0x96], 0
mov eax, 4
xor ecx, ecx
mov r8b, 0xff
mov dl, byte [rsp + rax + 0x88]
mov ebp, dword [rsp + 0x88]
mov ebx, edx
xor bl, r8b
and bl, bpl
xor bpl, r8b
and bpl, dl
or bpl, bl
mov byte [rsp + rax + 0x88], bpl
inc rcx
inc rax
cmp rax, 0xe
jne 0x140002120
mov byte [rsp + 0x96], 0
mov edi, 5
call fcn.140004246
mov rcx, rsi
call rax
test r14, r14
je 0x140002191
xor ecx, ecx
mov edx, 1
mov r8d, 0x723eb0d5
mov r9d, 0x11
call fcn.14000269b
test rax, rax
je 0x140002191
mov rcx, r14
call rax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140009dd0
mov eax, edi
add rsp, 0x1c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret