Function at 0x140001474
Capabilities:
Accept command line arguments
Extract resource via kernel32 functions
Parse pe header

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x198
lea rbp, [rsp + 0x80]
movabs r15, 0x8000000000000000
call fcn.140005640
lea rbx, [rbp + 0xc0]
push 8
pop r13
mov rcx, rbx
mov rdx, r13
call fcn.1400028dc
lea rsi, str..redata_n
lea r8, [0x140007097]
mov rcx, rbx
mov rdx, rsi
call fcn.140002607
xor eax, eax
cmp rax, 7
je 0x1400014e0
cmp byte [rax + rsi], 0
je 0x14000153c
inc rax
jmp 0x1400014cf
movups xmm0, xmmword [rbp + 0xc0]
movaps xmmword [rbp + 0xf0], xmm0
mov rsi, qword [rbp + 0xd0]
mov qword [rbp + 0x100], rsi
mov rdi, qword [rbp + 0xf0]
cmp rdi, rsi
jne 0x1400015a4
lea rax, [r15 - 2]
cmp rsi, rax
ja 0x140001dce
lea rdi, [rsi + 1]
test rsi, rsi
je 0x14000155c
mov rax, qword [rbp + 0xf8]
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x90], rsi
push 1
pop rax
jmp 0x14000155e
cmp qword [rbp + 0xc0], r15
jne 0x140001dce
mov r14, qword [rbp + 0xc8]
mov rsi, qword [rbp + 0xd0]
jmp 0x1400015fd
xor eax, eax
lea r9, [rbp + 0x80]
mov qword [r9 + 8], rax
lea r14, [rbp + 0x20]
push 1
pop rdx
mov rcx, r14
mov r8, rdi
call fcn.14000276f
mov rax, qword [r14 + 8]
test byte [r14], 1
je 0x140001596
lea rcx, [r15 + 1]
mov rdi, rsi
cmp rax, rcx
je 0x1400015a4
jmp 0x140001dce
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0xf0], rdi
cmp rsi, rdi
jne 0x1400015bb
lea rdi, [rbp + 0xf0]
mov rcx, rdi
call fcn.1400027f4
mov rdi, qword [rdi]
mov r14, qword [rbp + 0xf8]
mov byte [r14 + rsi], 0
inc rsi
cmp rdi, rsi
jbe 0x1400015fd
test rsi, rsi
je 0x1400015ec
mov rcx, r14
mov rdx, rsi
call fcn.1400025e0
mov r14, rax
test rax, rax
jne 0x1400015fd
jmp 0x140001dce
push 1
pop rdi
mov rcx, r14
mov rdx, rdi
call fcn.1400025b0
mov r14, rdi
push 0xa
pop r8
xor ecx, ecx
mov rdx, r14
call sub.kernel32.dll_FindResourceA
mov r15, rax
xor ecx, ecx
mov rdx, rax
call sub.kernel32.dll_LoadResource
mov rcx, rax
call sub.kernel32.dll_LockResource
mov rdi, rax
xor ecx, ecx
mov rdx, r15
call sub.kernel32.dll_SizeofResource
mov r15d, eax
mov byte [r14], 0
test rsi, rsi
je 0x140001644
push 1
pop rdx
mov rcx, r14
call fcn.1400025b0
mov eax, r15d
lea rcx, [rbp - 0x58]
mov qword [rcx], rdi
mov qword [rcx + 8], rax
lea rax, [rbp + 0xf0]
mov qword [rax], rcx
lea rcx, [0x140001432]
mov qword [rax + 8], rcx
lea rcx, [0x140007098]
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], 2
and qword [rbp + 0xa0], 0
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], 1
mov eax, dword [0x14000a158]
cmp eax, 3
je 0x14000176e
mov eax, dword [0x14000a158]
cmp eax, 3
je 0x14000176e
mov rdi, r13
lea rax, [0x14000a120]
mov qword [rbp + 0x20], rax
lea rax, [rbp + 0x68]
mov qword [rbp + 0x28], rax
push 2
pop rsi
lea r14, [0x14000a158]
lea r15, [rbp + 0xc0]
push 4
pop r12
push 0xffffffffffffffff
pop r13
mov eax, dword [0x14000a158]
mov edx, eax
and edx, 3
mov ecx, eax
and ecx, 4
cmp edx, 2
jae 0x14000170b
or ecx, 2
lock cmpxchg dword [0x14000a158], ecx
jne 0x1400016ed
jmp 0x140001749
jne 0x14000176b
test ecx, ecx
jne 0x140001724
mov ecx, eax
or ecx, 4
mov eax, esi
lock cmpxchg dword [0x14000a158], ecx
jne 0x1400016ed
jmp 0x140001726
mov ecx, eax
mov dword [rbp + 0xc0], ecx
mov rcx, r14
mov rdx, r15
mov r8, r12
mov r9d, r13d
call sub.api_ms_win_core_synch_l1_2_0.dll_WaitOnAddress
cmp eax, 1
je 0x1400016e7
call sub.kernel32.dll_GetLastError
jmp 0x1400016e7
lea rcx, [rbp + 0x20]
call fcn.140004002
push 3
pop rax
xchg dword [0x14000a158], eax
test al, 4
je 0x14000176b
lea rcx, [0x14000a158]
call sub.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressAll
mov r13, rdi
mov eax, dword [0x14000a078]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov r12, qword [rax + 8]
test r12, r12
jne 0x1400017c7
mov rax, qword [0x14000a160]
cmp rax, 0xffffffffffffffff
je 0x140001dce
lea r12, [rax + 1]
lock cmpxchg qword [0x14000a160], r12
jne 0x140001794
mov eax, dword [0x14000a078]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov qword [rax + 8], r12
mov rax, qword [0x14000a120]
cmp rax, r12
jne 0x1400017f0
mov eax, dword [0x14000a128]
cmp eax, 0xffffffff
movabs r15, 0x8000000000000000
je 0x140001dce
inc eax
jmp 0x140001816
mov cl, 1
xor eax, eax
lock cmpxchg byte [0x14000a12c], cl
jne 0x140001b2e
mov qword [0x14000a120], r12
push 1
pop rax
movabs r15, 0x8000000000000000
mov dword [0x14000a128], eax
lea rax, [0x14000a120]
mov qword [rbp + 0xc0], rax
lea rsi, [rbp + 0x20]
mov qword [rsi], rbx
and qword [rsi + 8], 0
lea rdx, [0x1400071c0]
lea r8, [rbp + 0x80]
mov rcx, rsi
call fcn.140002919
mov ebx, eax
mov rcx, qword [rsi + 8]
test al, al
je 0x140001860
test rcx, rcx
jne 0x140001865
jmp 0x140001dce
call fcn.140003036
mov rcx, qword [rbp + 0xc0]
dec dword [rcx + 8]
jne 0x14000188a
mov qword [rcx], 0
xor eax, eax
xchg byte [rcx + 0xc], al
cmp al, 2
jne 0x14000188a
add rcx, 0xc
call sub.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle
test bl, bl
jne 0x140001dce
xor ecx, ecx
call fcn.140003036
call sub.kernel32.dll_GetCommandLineW
and qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 8
and qword [rbp + 0x78], 0
test rax, rax
je 0x14000191b
mov rbx, rax
movzx edx, word [rax]
test dx, dx
je 0x14000191b
lea rsi, [rbp + 0xc0]
and qword [rsi], 0
mov qword [rsi + 8], 2
and qword [rsi + 0x10], 0
add rbx, 2
xor edi, edi
test dx, dx
je 0x14000198c
cmp dx, 9
je 0x140001900
movzx eax, dx
cmp eax, 0x20
je 0x140001900
cmp eax, 0x22
jne 0x14000190a
xor dil, 1
jmp 0x140001912
test dil, 1
je 0x140001996
mov rcx, rsi
call fcn.140003dab
movzx edx, word [rbx]
add rbx, 2
jmp 0x1400018de
lea rsi, [rbp + 0x80]
mov rcx, rsi
call fcn.140003df5
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
cmp rax, r15
jne 0x140001951
and qword [rbp + 0x100], 0
mov byte [rbp + 0x108], 1
call fcn.140002e08
push 1
pop rcx
xor eax, eax
jmp 0x140001962
lea rdx, [rbp + 0x100]
movups xmm0, xmmword [rbp + 0x90]
movups xmmword [rdx], xmm0
lea rdx, [rbp + 0xf0]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rsi, [rbp + 0x68]
mov rcx, rsi
call fcn.140003f24
mov rdi, qword [rsi]
mov r14, qword [rsi + 8]
mov rbx, qword [rsi + 0x10]
jmp 0x140001c07
add rbx, 0xfffffffffffffffe
jmp 0x140001996
add rbx, 2
movzx eax, word [rbx]
cmp eax, 0x20
je 0x140001992
cmp eax, 9
je 0x140001992
mov rdx, qword [rbp + 0xc8]
mov r8, qword [rbp + 0xd0]
lea r14, [rbp + 0x80]
mov rcx, r14
call fcn.140003b5f
lea r15, [rbp + 0x68]
mov rcx, r15
mov rdx, r14
call fcn.140003f24
lea r12, [rbp + 0xf0]
and qword [r12], 0
mov qword [r12 + 8], 2
and qword [r12 + 0x10], 0
xor eax, eax
mov edi, eax
movzx edx, word [rbx]
test edx, edx
je 0x140001af9
mov rsi, rbx
add rbx, 2
cmp edx, 9
je 0x140001a2b
cmp edx, 0x20
je 0x140001a2b
cmp edx, 0x22
je 0x140001a79
cmp edx, 0x5c
jne 0x140001a31
xor esi, esi
movzx eax, word [rbx]
lea rdx, [rsi + 1]
cmp eax, 0x5c
jne 0x140001a99
add rbx, 2
mov rsi, rdx
jmp 0x140001a16
test dil, 1
je 0x140001a3d
mov rcx, r12
call fcn.140003dab
mov eax, edi
jmp 0x1400019ec
mov rdx, qword [rbp + 0xf8]
mov r8, qword [rbp + 0x100]
mov rcx, r14
call fcn.140003b5f
mov rcx, r15
mov rdx, r14
call fcn.140003f24
and qword [rbp + 0x100], 0
movzx eax, word [rbx]
cmp eax, 0x20
je 0x140001a73
cmp eax, 9
jne 0x140001a39
add rbx, 2
jmp 0x140001a66
mov al, 1
test dil, 1
je 0x1400019ec
movzx ecx, word [rbx]
cmp ecx, 0x22
je 0x140001adb
xor eax, eax
test ecx, ecx
jne 0x1400019ec
jmp 0x140001af9
cmp eax, 0x22
jne 0x140001ace
shr rdx, 1
mov rcx, r12
call fcn.140003cd0
mov eax, edi
test sil, 1
jne 0x1400019ec
xor eax, eax
cmp word [rbx], 0
setne al
lea rbx, [rbx + rax*2]
mov rcx, r12
mov dx, 0x22
jmp 0x140001a34
mov rcx, r12
call fcn.140003cd0
jmp 0x140001a39
mov rcx, r12
mov dx, 0x22
call fcn.140003dab
cmp word [rsi + 2], 0
lea rax, [rsi + 4]
cmovne rbx, rax
jmp 0x140001a39
mov r8, qword [rbp + 0x100]
test r8, r8
je 0x140001ba0
mov rsi, qword [rbp + 0xf8]
lea rcx, [rbp + 0x80]
mov rdx, rsi
call fcn.140003b5f
movabs r15, 0x8000000000000000
jmp 0x140001bc9
lea rcx, [0x14000a12c]
call fcn.140003ddf
test al, al
jne 0x140001b50
mov cl, 1
xor eax, eax
lock cmpxchg byte [0x14000a12c], cl
je 0x140001802
lea rsi, [0x14000a12c]
lea rdi, [rbp + 0x20]
push 1
pop r14
push 0xffffffffffffffff
pop r15
cmp al, 2
je 0x140001b77
mov al, 2
xchg byte [0x14000a12c], al
test al, al
je 0x140001802
mov byte [rbp + 0x20], 2
mov rcx, rsi
mov rdx, rdi
mov r8, r14
mov r9d, r15d
call sub.api_ms_win_core_synch_l1_2_0.dll_WaitOnAddress
cmp eax, 1
je 0x140001b96
call sub.kernel32.dll_GetLastError
mov rcx, rsi
call fcn.140003ddf
jmp 0x140001b63
mov rsi, qword [rbp + 0xf8]
test dil, 1
movabs r15, 0x8000000000000000
je 0x140001bd9
lea rcx, [rbp + 0x80]
mov rdx, rsi
xor r8d, r8d
call fcn.140003b5f
lea rcx, [rbp + 0x68]
lea rdx, [rbp + 0x80]
call fcn.140003f24
mov rdi, qword [rbp + 0x68]
mov r14, qword [rbp + 0x70]
mov rbx, qword [rbp + 0x78]
mov rcx, qword [rbp + 0xf0]
mov rdx, rsi
call fcn.140002e79
mov rcx, qword [rbp + 0xc0]
mov rdx, qword [rbp + 0xc8]
call fcn.140002e79
shl rbx, 5
add rbx, r14
lea rdx, [rbp + 0x20]
mov qword [rdx], r14
mov qword [rdx + 8], r14
mov qword [rdx + 0x10], rdi
mov qword [rdx + 0x18], rbx
mov qword [rdx + 0x20], 1
lea rsi, [rbp + 0xc0]
mov rcx, rsi
call fcn.140001384
cmp qword [rsi], r15
jne 0x140001c5c
lea rcx, [rbp + 0x20]
call fcn.140003d57
push 1
pop rax
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x18], 0
xor ebx, ebx
jmp 0x140001e74
push 1
pop rbx
push 4
pop rsi
lea r14, [rbp + 0x80]
lea rdi, [rbp + 0x20]
mov rcx, r14
mov rdx, rdi
call fcn.14000140b
mov rcx, qword [r14]
inc rcx
push 0xffffffffffffffff
pop rax
cmove rcx, rax
cmp rcx, 5
cmovb rcx, rsi
push 8
pop r15
push 0x18
pop rsi
mov rdx, r15
mov r8, rsi
call fcn.140001442
mov r13, rdx
mov rcx, qword [rbp + 0xd0]
movups xmm0, xmmword [rbp + 0xc0]
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], rcx
lea r12, [rbp + 0x68]
mov qword [r12], rax
mov qword [r12 + 8], rdx
mov qword [r12 + 0x10], 1
mov rax, qword [rdi + 0x20]
mov qword [r14 + 0x20], rax
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movaps xmmword [r14 + 0x10], xmm1
movaps xmmword [r14], xmm0
lea rdi, [rbp - 0x48]
mov rcx, rdi
mov rdx, r14
call fcn.140001384
movabs rax, 0x8000000000000000
cmp qword [rbp - 0x48], rax
je 0x140001d67
cmp rbx, qword [rbp + 0x68]
je 0x140001d2a
movups xmm0, xmmword [rbp - 0x48]
mov rax, qword [rbp - 0x38]
mov qword [r13 + rsi + 0x10], rax
movups xmmword [r13 + rsi], xmm0
inc rbx
mov qword [rbp + 0x78], rbx
add rsi, 0x18
jmp 0x140001ce9
lea rcx, [rbp + 0xf0]
mov rdx, r14
call fcn.14000140b
mov r8, qword [rbp + 0xf0]
inc r8
push 0xffffffffffffffff
pop rax
cmove r8, rax
mov qword [rsp + 0x20], 0x18
mov rcx, r12
mov rdx, rbx
mov r9, r15
call fcn.140002671
mov r13, qword [rbp + 0x70]
jmp 0x140001d0a
mov rdx, qword [rbp - 0x40]
movabs r15, 0x8000000000000000
mov rcx, r15
call fcn.140001435
lea rcx, [rbp + 0x80]
call fcn.140003d57
mov r8, qword [rbp + 0x68]
mov r13, qword [rbp + 0x70]
test rbx, rbx
mov qword [rbp + 0x18], r8
je 0x140001e6b
imul rax, rbx, 0x18
lea rdi, [rsi - 0x18]
add rax, 0xffffffffffffffe8
push 0x18
pop rcx
xor edx, edx
div rcx
mov r14, rax
mov rax, r13
test rsi, rsi
je 0x140001dd0
lea rcx, [rax + 0x18]
add rsi, 0xffffffffffffffe8
add r14, qword [rax + 0x10]
mov rax, rcx
jae 0x140001db8
ud2
push 1
pop rdx
mov rcx, r14
mov r8, rdx
call fcn.140001442
lea rsi, [rbp + 0x80]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
and qword [rsi + 0x10], 0
mov rdx, qword [r13 + 8]
mov r8, qword [r13 + 0x10]
add r8, rdx
mov rcx, rsi
call fcn.140002607
mov rcx, qword [rsi + 8]
mov rax, qword [rsi + 0x10]
mov qword [rbp + 0x60], rcx
add rcx, rax
mov rsi, r14
sub rsi, rax
lea r15, [r13 + 0x28]
test rdi, rdi
je 0x140001e55
test rsi, rsi
je 0x140001dce
mov rdx, qword [r15 - 8]
mov r8, qword [r15]
dec rsi
mov byte [rcx], 0x20
sub rsi, r8
jb 0x140001dce
lea r12, [rcx + r8]
inc r12
inc rcx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add r15, 0x18
add rdi, 0xffffffffffffffe8
mov rcx, r12
jmp 0x140001e1d
sub r14, rsi
mov r12, qword [rbp + 0x80]
movabs r15, 0x8000000000000000
jmp 0x140001e7a
xor ebx, ebx
push 1
pop rax
mov qword [rbp + 0x60], rax
xor r14d, r14d
xor r12d, r12d
mov qword [rbp - 0x30], r13
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x58], rax
lea rsi, [rbp + 0x80]
mov rcx, rsi
call fcn.140003df5
mov rax, qword [rsi]
mov qword [rbp + 0xd8], rax
cmp rax, r15
je 0x140001dce
lea rdi, [rbp + 0x80]
mov rsi, qword [rdi + 8]
mov r13, qword [rdi + 0x10]
mov rcx, rdi
mov rdx, rsi
mov r8, r13
xor r9d, r9d
call fcn.140002e8a
test byte [rdi], 1
mov qword [rbp - 0x28], r12
je 0x140001f88
mov r15, qword [rbp + 0x88]
lea rcx, [rbp + 0x20]
mov rdx, r13
call fcn.140003ca0
cmp r15, r13
ja 0x140001dce
lea r8, [rsi + r15]
lea rdi, [rbp + 0x20]
mov rcx, rdi
mov rdx, rsi
call fcn.140002607
lea rdx, [0x140007298]
lea r8, [0x14000729b]
mov rcx, rdi
call fcn.140002607
mov r12, r15
add r12, 3
lea rcx, [rbp + 0x80]
mov rdx, rsi
mov r8, r13
mov r9, r12
call fcn.140002e8a
test byte [rbp + 0x80], 1
je 0x140001f94
mov r15, qword [rbp + 0x88]
cmp r15, r12
jb 0x140001dce
cmp r15, r13
ja 0x140001dce
add r12, rsi
lea r8, [rsi + r15]
mov rcx, rdi
mov rdx, r12
call fcn.140002607
mov rcx, rdi
lea rdx, [0x140007298]
lea r8, [0x14000729b]
jmp 0x140001f20
mov qword [rbp + 0xe8], r15
mov r15, rsi
jmp 0x140001fc7
cmp r12, r13
ja 0x140001dce
add r12, rsi
add r13, rsi
lea rdi, [rbp + 0x20]
mov rcx, rdi
mov rdx, r12
mov r8, r13
call fcn.140002607
mov rax, qword [rdi]
mov qword [rbp + 0xe8], rax
mov r15, qword [rdi + 8]
mov r13, qword [rdi + 0x10]
lea rdi, [rbp + 0x80]
mov rcx, rdi
mov rdx, r13
call fcn.1400028dc
mov rcx, qword [rdi + 8]
mov rdx, r15
mov r8, r13
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
lea r12, [rbp + 0x20]
mov qword [r12 + 0x10], r13
movups xmm0, xmmword [rdi]
movaps xmmword [r12], xmm0
lea rdx, [0x1400070b8]
lea r8, [0x1400070b9]
mov rcx, r12
call fcn.140002607
mov rax, qword [r12 + 0x10]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [r12]
movaps xmmword [rdi], xmm0
mov rdx, qword [rbp + 0x60]
add r14, rdx
mov rcx, rdi
mov r8, r14
call fcn.140002607
mov rax, qword [rdi]
mov qword [rbp - 0x20], rax
mov rax, qword [rdi + 8]
mov qword [rbp + 0x10], rax
mov rax, qword [rdi + 0x10]
mov qword [rbp - 0x18], rax
mov rcx, qword [rbp + 0xe8]
movabs rax, 0x8000000000000000
cmp rcx, rax
je 0x140002067
mov rdx, r15
call fcn.14000282b
mov rcx, qword [rbp + 0xd8]
mov rdx, rsi
call fcn.14000282b
mov r14, qword [rbp + 0xe0]
cmp word [r14], 0x5a4d
mov r15, qword [rbp + 0x58]
jne case.0x140002276.4
movsxd rcx, dword [r14 + 0x3c]
cmp dword [rcx + r14], 0x4550
jne case.0x140002276.4
mov rsi, rcx
add rsi, r14
lea rdi, [rsi + 0x108]
mov edx, dword [rsi + 0x50]
mov eax, dword [rsi + 0x90]
mov qword [rbp + 0xd8], rax
mov r12d, dword [rsi + 0x94]
mov eax, dword [rsi + 0xb0]
mov qword [rbp - 0x10], rax
mov eax, dword [rsi + 0xd0]
mov qword [rbp + 8], rax
mov eax, dword [rsi + 0xd4]
mov dword [rbp + 0x54], eax
mov eax, dword [rsi + 0xa0]
mov qword [rbp], rax
mov eax, dword [rsi + 0xa4]
mov dword [rbp + 0xbc], eax
push 4
pop r9
xor ecx, ecx
mov r8d, 0x3000
call sub.kernel32.dll_VirtualAlloc
mov r13, rax
mov qword [rbp + 0xe8], rsi
movzx esi, word [rsi + 6]
mov qword [rbp - 8], rdi
sub si, 1
jb 0x140002147
mov r8d, dword [rdi + 0x10]
mov edx, dword [rdi + 0x14]
lea rax, [r8 + rdx]
cmp rax, r15
ja case.0x140002276.4
mov ecx, dword [rdi + 0xc]
add rdx, r14
add rcx, r13
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add rdi, 0x28
jmp 0x140002119
xor r8d, r8d
push 0x14
pop rcx
mov eax, r12d
xor edx, edx
div ecx
mov rdi, qword [rbp + 0xd8]
add rdi, r13
lea r14, [r13 + 2]
mov qword [rbp + 0xd8], rdi
mov qword [rbp + 0x58], rax
cmp r8, rax
je 0x14000221a
imul rdx, r8, 0x14
mov esi, dword [rdi + rdx]
mov r15d, dword [rdi + rdx + 0x10]
mov ecx, r15d
or ecx, esi
je 0x14000221a
mov qword [rbp + 0xe0], r8
add rdx, rdi
mov ecx, dword [rdx + 0xc]
add rcx, r13
call sub.kernel32.dll_LoadLibraryA
mov r12, rax
test rax, rax
jne 0x1400021ba
call fcn.1400044f9
test eax, eax
jne 0x140002354
xor r12d, r12d
inc qword [rbp + 0xe0]
mov rcx, r12
xor edx, edx
call fcn.140002ce6
mov rdi, r13
mov rdx, qword [rdi + rsi]
test rdx, rdx
je 0x1400021de
jns 0x1400021e5
movzx edx, dx
jmp 0x1400021e8
cmp qword [rdi + r15], 0
je 0x140002203
add rdx, r14
mov rcx, r12
call sub.kernel32.dll_GetProcAddress
test rax, rax
je case.0x140002276.4
mov qword [rdi + r15], rax
add rdi, 8
jmp 0x1400021ce
mov rdi, qword [rbp + 0xd8]
mov r8, qword [rbp + 0xe0]
mov rax, qword [rbp + 0x58]
jmp 0x14000216d
mov rax, r13
mov rcx, qword [rbp + 0xe8]
sub rax, qword [rcx + 0x30]
mov rsi, qword [rbp - 0x10]
add rsi, r13
mov ecx, eax
shr ecx, 0x10
lea rdx, [0x1400073ec]
cmp dword [rsi], 0
je 0x1400022a0
lea r8, [rsi + 8]
mov r9d, dword [rsi + 4]
add r9, rsi
cmp r8, r9
jae 0x14000229b
movzx r10d, word [r8]
mov r11d, r10d
shr r11d, 0xc
cmp r11d, 0xa
ja case.0x140002276.4
and r10d, 0xfff
add r10d, dword [rsi]
movsxd r11, dword [rdx + r11*4]
add r11, rdx
jmp r11
add word [r13 + r10], cx
jmp case.0x140002276.0
add dword [r13 + r10], eax
jmp case.0x140002276.0
add word [r13 + r10], ax
jmp case.0x140002276.0
add qword [r13 + r10], rax
add r8, 2
jmp 0x14000224b
mov rsi, r8
jmp 0x14000223b
mov rax, qword [rbp + 0xe8]
movzx r14d, word [rax + 6]
xor r12d, r12d
lea rsi, [rbp + 0x80]
mov rax, qword [rbp - 8]
cmp r12w, r14w
jae 0x140002362
mov edx, dword [rax + 0x10]
test rdx, rdx
je 0x1400022d4
mov ecx, dword [rax + 0xc]
test rcx, rcx
jne 0x1400022d9
inc r12d
jmp 0x1400022ba
mov rdi, rax
mov eax, dword [rax + 0x24]
xor r8d, r8d
test eax, eax
js 0x1400022fd
cmp eax, 0x40000000
setae r8b
lea r9d, [r8 + r8]
shl r8d, 4
add r8d, 0x10
jmp 0x140002315
bt eax, 0x1e
setae r8b
lea r9d, [r8*4 + 4]
shl r8d, 6
add r8d, 0x40
bt eax, 0x1d
cmovae r8d, r9d
and dword [rbp + 0x80], 0
add rcx, r13
mov r9, rsi
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x14000233c
call fcn.1400044f9
test eax, eax
jne 0x140002354
inc r12d
xor ecx, ecx
xor edx, edx
call fcn.140002ce6
mov rax, rdi
add rax, 0x28
jmp 0x1400022ba
xor ecx, ecx
mov edx, eax
call fcn.140002ce6
jmp case.0x140002276.4
cmp dword [rbp + 0xbc], 0
je 0x140002393
mov rcx, qword [rbp]
add rcx, r13
push 0xc
pop r8
mov eax, dword [rbp + 0xbc]
xor edx, edx
div r8d
mov edx, eax
mov r8, r13
call sub.kernel32.dll_RtlAddFunctionTable
test al, al
je case.0x140002276.4
cmp dword [rbp + 0x54], 0
je 0x1400023bd
mov rax, qword [rbp + 8]
mov rdi, qword [r13 + rax + 0x18]
push 1
pop rsi
mov rax, qword [rdi]
test rax, rax
je 0x1400023bd
mov rcx, r13
mov edx, esi
xor r8d, r8d
call rax
add rdi, 8
jmp 0x1400023a5
push 0x30
pop rax
mov rax, qword gs:[eax]
mov rax, qword [rax + 0x60]
mov r14, qword [rax + 0x20]
mov rcx, qword [r14 + 0x78]
movzx r8d, word [r14 + 0x70]
add r8d, r8d
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 0x18]
add rdx, rax
lea rcx, [rbp + 0xf0]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
and word [rcx + 0x10], 0
call fcn.140002d32
test ax, ax
je 0x140002502
mov r12d, edx
mov qword [rbp + 0xe0], r14
mov rax, qword [rbp + 0xf8]
sub rax, qword [rbp + 0xf0]
movzx ecx, word [rbp + 0x100]
add rax, 2
push 3
pop r8
xor edx, edx
div r8
cmp cx, 1
sbb rax, 0xffffffffffffffff
cmp rax, 4
cmovb rax, r8
lea rcx, [rax + 1]
push 2
pop rdx
mov r8, rdx
call fcn.140001442
mov rsi, rdx
mov word [rdx], r12w
lea rcx, [rbp + 0x20]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
mov r14, rcx
mov qword [rcx + 0x10], 1
mov rax, qword [rbp + 0x100]
lea rcx, [rbp + 0x80]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rbp + 0xf0]
mov r15, rcx
movaps xmmword [rcx], xmm0
push 1
pop rdi
mov rcx, r15
call fcn.140002d32
cmp ax, 1
jne 0x1400024f5
mov r12d, edx
cmp rdi, qword [rbp + 0x20]
jne 0x1400024e7
mov rax, qword [rbp + 0x88]
sub rax, qword [rbp + 0x80]
movzx ecx, word [rbp + 0x90]
add rax, 2
xor edx, edx
push 3
pop r8
div r8
cmp cx, 1
sbb rax, 0xffffffffffffffff
lea rdx, [rax + 1]
mov rcx, r14
call fcn.140002cfc
mov rsi, qword [rbp + 0x28]
mov word [rsi + rdi*2], r12w
inc rdi
mov qword [rbp + 0x30], rdi
jmp 0x140002496
mov r12, qword [rbp + 0x20]
mov r14, qword [rbp + 0xe0]
jmp 0x14000250a
push 2
pop rsi
xor r12d, r12d
xor edi, edi
mov rcx, qword [r14 + 0x78]
lea r8, [rdi + rdi]
mov rdx, rsi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add edi, edi
mov word [r14 + 0x70], di
mov word [r14 + 0x72], di
mov rax, qword [rbp + 0xe8]
mov eax, dword [rax + 0x28]
add r13, rax
call r13
mov rcx, r12
mov rdx, rsi
call fcn.140002e79
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp + 0x10]
call fcn.14000282b
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rbp + 0x60]
call fcn.14000282b
mov rdi, qword [rbp - 0x30]
lea rsi, [rdi + 8]
sub rbx, 1
jb 0x14000257b
mov rcx, qword [rsi - 8]
mov rdx, qword [rsi]
call fcn.14000282b
add rsi, 0x18
jmp 0x140002563
push 8
pop r8
push 0x18
pop r9
mov rcx, qword [rbp + 0x18]
mov rdx, rdi
call fcn.14000283c
nop
add rsp, 0x198
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret