Function at 0x1d6ac
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4a8
mov rax, qword [0x00018100]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rsi, rcx
mov qword [rsp + 0x160], rcx
mov r12, r8
mov qword [rsp + 0x188], r8
mov r13, rdx
mov qword [rsp + 0x1d8], rdx
lea rcx, [rsp + 0x2e2]
xor ebx, ebx
xor edx, edx
mov r8d, 0xbe
mov r14, r9
mov qword [rsp + 0x168], r9
mov word [rsp + 0x2e0], bx
call fcn.00015ec0
lea edi, [rbx + 1]
mov r15d, 0x1002
mov ecx, edi
mov r8d, 0x4d525356
mov rdx, r15
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbp, rax
mov qword [rsp + 0x158], rax
cmp rax, rbx
je 0x1fdb3
mov r8, r15
xor edx, edx
mov rcx, rax
call fcn.00015ec0
mov byte [rbp], dil
mov r15d, dword [r12]
movabs rdi, 0xfffff78000000320
mov dword [rsp + 0x144], ebx
mov byte [rsp + 0x140], bl
mov rdi, qword [rdi]
mov cl, byte [rsi + 0x7ae7]
call fcn.00015900
xor r8d, r8d
lea r9d, [rbx + 1]
mov byte [rsi + 0x7ad1], al
cmp eax, r8d
jbe 0x1d79f
mov byte [rsi + 0x7ad1], r9b
cmp byte [rsi + 0x7ad1], r9b
je 0x1d7e2
xor eax, eax
mov qword [rsi + 0x7a64], rax
mov qword [rsi + 0x7a6c], rax
mov qword [rsi + 0x7a74], rax
mov qword [rsi + 0x7a7c], rax
mov qword [rsi + 0x7a84], rax
mov qword [rsi + 0x7a8c], rax
mov qword [rsi + 0x7a94], rax
mov qword [rsi + 0x7a9c], rax
movzx ecx, byte [r13]
mov ebx, 0xff
lea eax, [rbx - 0x63]
cmp ecx, eax
jg 0x1fd41
je 0x1fc36
cmp ecx, 0x29
jg 0x1f7f5
je 0x1dfa3
sub ecx, 0x1d
je 0x1df3f
sub ecx, r9d
je 0x1de99
sub ecx, 5
je 0x1de75
sub ecx, r9d
je 0x1de24
sub ecx, r9d
je 0x1dcc7
sub ecx, r9d
je 0x1daf7
sub ecx, r9d
je 0x1d8ac
cmp ecx, r9d
jne 0x20b06
movzx eax, word [r13 + 1]
mov word [rsi + 0x10da], ax
movzx eax, byte [r13 + 4]
mov word [rsi + 0x10dc], ax
cmp byte [r13 + 3], 0x80
mov eax, r8d
sete al
mov word [rsi + 0x10e0], ax
cmp r15d, 4
jne 0x1d89f
mov eax, dword [r14]
mov ecx, eax
shr eax, 0x10
shr ecx, 8
movzx edx, cl
movzx ecx, al
shl edx, 8
or edx, ecx
shl edx, 4
mov dword [rsi + 0x10e6], edx
mov byte [rbp], r8b
mov dword [r12], r8d
jmp 0x1fda5
movzx ecx, word [r13 + 1]
mov word [rsi + 0x10da], cx
movzx eax, byte [r13 + 4]
mov word [rsi + 0x10dc], ax
cmp byte [r13 + 3], 0x80
mov eax, r8d
sete al
mov word [rsi + 0x10e0], ax
mov eax, 0xf4ff
cmp cx, ax
jne 0x1fda5
lea rcx, [rsi + 0x83b1]
xor edx, edx
mov r8d, 0x1000
call fcn.00015ec0
lea rcx, [rsi + 0x83b1]
mov r8, r15
mov rdx, r14
call fcn.00015fc0
movzx ecx, byte [rsi + 0x83b2]
movzx eax, byte [rsi + 0x83b3]
shl ecx, 8
or ecx, eax
shl ecx, 4
mov dword [rsi + 0x7ac4], ecx
test r15b, 0xf
jne 0x1da28
movzx eax, word [rsi + 0x83bd]
mov r12d, 0x10
lea r8, [rsi + 0x7ab4]
mov word [rsi + 0x10ee], ax
mov al, byte [rsi + 0x83bf]
lea rdx, [rsp + 0x220]
mov byte [rsi + 0x10f0], al
movzx eax, byte [rsi + 0x10ee]
movzx ecx, byte [rsi + 0x10ef]
shl eax, 8
mov r9d, r12d
or ecx, eax
movzx eax, byte [rsi + 0x10f0]
shl ecx, 8
or ecx, eax
xor eax, eax
mov qword [rsp + 0x220], rax
mov qword [rsp + 0x228], rax
mov eax, dword [rsi + 0x83b9]
mov dword [rsi + 0x10f1], ecx
lea rcx, [rsi + 0x7a94]
mov dword [rsp + 0x220], eax
call fcn.00012818
mov al, byte [rsi + 0x1138]
mov r11b, byte [rsi + 0x1137]
mov byte [rsp + 0x225], al
mov al, byte [rsi + 0x1139]
lea r8, [rsi + 0x7aa4]
lea rdx, [rsp + 0x220]
lea rcx, [rsi + 0x7a94]
mov r9d, r12d
mov byte [rsp + 0x226], al
mov byte [rsp + 0x224], r11b
call fcn.00012818
lea r9d, [r15 - 0x10]
lea rdx, [rsi + 0x83c1]
lea r8, [rsi + 0x83b1]
lea rcx, [rsi + 0x7aa4]
mov dword [rsi + 0x7ac8], r9d
call fcn.000126ec
mov r12, qword [rsp + 0x188]
jmp 0x1da4d
lea r9d, [r15 - 8]
lea rdx, [rsi + 0x83b9]
lea rcx, [rsi + 0x7aa4]
lea r8, [rsi + 0x83b1]
mov dword [rsi + 0x7ac8], r9d
call fcn.000126ec
mov ebx, 3
lea rcx, [rsi + 0x83b1]
lea ebp, [rbx - 2]
mov al, byte [rcx - 0x72c3]
xor byte [rcx], al
add rcx, rbp
sub rbx, rbp
jne 0x1da5c
add dword [rsi + 0x10f1], ebp
mov ecx, dword [rsi + 0x10f1]
mov r8d, dword [rsi + 0x7ac8]
mov eax, ecx
shr ecx, 8
lea rdx, [rsi + 0x83b1]
shr eax, 0x10
mov byte [rsi + 0x10ef], cl
mov byte [rsi + 0x10ee], al
mov al, byte [rsi + 0x10f1]
mov byte [rsi + 0x10f0], al
mov eax, dword [rsi + 0x7ac4]
lea rcx, [rax + rsi + 0x62a4]
call fcn.00015fc0
lea r9, [rsi + 0x62a4]
lea r8, [0x000220b0]
mov rdx, rsi
mov ecx, 0x1001
mov dword [rsp + 0x20], 0xfc0
call fcn.00011bb4
mov rbp, qword [rsp + 0x158]
xor ecx, ecx
cmp eax, ecx
setne al
mov byte [rbp], al
mov dword [r12], ecx
jmp 0x1fda5
movzx edx, word [r13 + 1]
lea rcx, [rsp + 0x248]
mov r12d, 0x10
mov word [rsi + 0x10da], dx
movzx eax, byte [r13 + 4]
mov word [rsi + 0x10dc], ax
cmp byte [r13 + 3], 0x80
mov eax, r8d
sete al
mov word [rsi + 0x10e0], ax
movzx eax, word [r14]
mov word [rcx], ax
mov al, byte [r14 + 2]
mov byte [rcx + 2], al
movzx ecx, byte [rsp + 0x249]
movzx eax, byte [rsp + 0x24a]
shl ecx, 8
or ecx, eax
shl ecx, 4
mov dword [rsi + 0x10e6], ecx
cmp r15d, r12d
jne 0x1dcb2
movdqu xmm0, xmmword [r14]
lea rcx, [rsp + 0x254]
movdqu xmmword [rsp + 0x248], xmm0
movzx eax, word [rcx]
mov word [rsi + 0x10ee], ax
mov al, byte [rcx + 2]
mov byte [rsi + 0x10f0], al
movzx eax, byte [rsi + 0x10ee]
movzx ecx, byte [rsi + 0x10ef]
shl eax, 8
or ecx, eax
movzx eax, byte [rsi + 0x10f0]
shl ecx, 8
or ecx, eax
xor eax, eax
mov qword [rsp + 0x200], rax
mov dword [rsi + 0x10f1], ecx
mov rcx, qword [rsp + 0x250]
mov qword [rsp + 0x208], rax
mov eax, 0xf4ff
mov dword [rsp + 0x200], ecx
cmp dx, ax
je 0x1dc4a
mov eax, 0xf5ff
cmp dx, ax
je 0x1dc4a
shr rcx, 0x38
cmp cl, 2
jne 0x1dc0a
mov dword [rsi + 0x10e2], r9d
lea r8, [rsi + 0x7ab4]
lea rcx, [rsi + 0x7a84]
jmp 0x1dc9f
lea rdx, [rsp + 0x200]
cmp byte [rsp + 0x257], r9b
jne 0x1dc33
mov dword [rsi + 0x10e2], r9d
lea r8, [rsi + 0x7ab4]
lea rcx, [rsi + 0x7a74]
jmp 0x1dca7
mov dword [rsi + 0x10e2], r8d
lea rcx, [rsi + 0x7a64]
lea r8, [rsi + 0x7ab4]
jmp 0x1dca7
lea r8, [rsi + 0x7ab4]
lea rdx, [rsp + 0x200]
lea rcx, [rsi + 0x7a94]
mov r9d, r12d
call fcn.00012818
mov al, byte [rsi + 0x1138]
mov r11b, byte [rsi + 0x1137]
mov byte [rsp + 0x205], al
mov al, byte [rsi + 0x1139]
mov byte [rsp + 0x204], r11b
lea r8, [rsi + 0x7aa4]
lea rcx, [rsi + 0x7a94]
mov byte [rsp + 0x206], al
lea rdx, [rsp + 0x200]
mov r9d, r12d
call fcn.00012818
xor r8d, r8d
movzx eax, word [r13 + 1]
mov word [rsi + 0x10da], ax
mov byte [rbp], r8b
jmp 0x1fda5
movzx eax, word [rsi + 0x1138]
ror ax, 8
add ax, r9w
ror ax, 8
mov word [rsi + 0x1138], ax
movzx eax, word [rsi + 0x1131]
ror ax, 8
add ax, r9w
ror ax, 8
mov word [rsi + 0x1131], ax
movzx r12d, word [r13 + 1]
mov word [rsi + 0x10da], r12w
movzx eax, byte [r13 + 4]
mov word [rsi + 0x10dc], ax
cmp r15d, 0x18
jbe 0x1fda5
mov ebx, 0xa4
lea rcx, [rsp + 0x3e0]
xor edx, edx
mov r8, rbx
call fcn.00015ec0
mov r8, r15
cmp r15d, ebx
lea rcx, [rsp + 0x3e0]
mov rdx, r14
cmova r8, rbx
call fcn.00015fc0
movzx eax, byte [rsp + 0x3e2]
movzx ebx, byte [rsp + 0x3e1]
movzx edi, byte [rsp + 0x3e4]
shl bx, 8
or bx, ax
mov eax, 0xf5ff
shl bx, 4
cmp r12w, ax
jne 0x1ddc3
lea eax, [rdi + 0x18]
cmp eax, r15d
jne 0x1ddc3
movzx eax, bx
lea rdx, [rsp + 0x3f8]
mov r8, rdi
lea rcx, [rax + rsi + 0x7264]
call fcn.00015fc0
lea r9, [rsi + 0x7264]
lea r8, [0x000220a0]
mov rdx, rsi
mov ecx, 0x1001
mov dword [rsp + 0x20], 0x800
call fcn.00011bb4
mov eax, 0xf4ff
cmp word [rsi + 0x10da], ax
jne 0x1fda5
lea eax, [rdi + 0x18]
cmp eax, r15d
jne 0x1fda5
movzx eax, bx
lea rdx, [rsp + 0x3f8]
mov r8, rdi
lea rcx, [rax + rsi + 0x62a4]
call fcn.00015fc0
lea r9, [rsi + 0x62a4]
lea r8, [0x000220b0]
mov rdx, rsi
mov ecx, 0x1001
mov dword [rsp + 0x20], 0xfc0
call fcn.00011bb4
jmp 0x1fda5
movzx eax, word [r13 + 1]
mov word [rsi + 0x10da], ax
movzx eax, byte [r13 + 4]
mov word [rsi + 0x10dc], ax
movzx eax, word [rsi + 0x1138]
ror ax, 8
add ax, r9w
ror ax, 8
mov word [rsi + 0x1138], ax
movzx eax, word [rsi + 0x1131]
ror ax, 8
add ax, r9w
ror ax, 8
mov word [rsi + 0x1131], ax
jmp 0x1fda5
movzx eax, word [r13 + 1]
mov word [rsi + 0x10da], ax
movzx eax, byte [r13 + 4]
mov word [rsi + 0x10dc], ax
cmp r15d, 0x18
jne 0x1fda5
jmp 0x1de3c
cmp byte [rsi + 2], r8b
je 0x20b14
mov eax, dword [r12]
lea rcx, [r13 + 1]
mov r8, rsi
mov edx, 4
mov dword [rsi + 0x108c], eax
call fcn.0001d604
mov edx, dword [rsi + 0x108c]
mov rcx, r14
call fcn.0001d604
mov ebx, 3
cmp word [r13 + 1], bx
lea r15d, [rbx + 4]
seta al
mov byte [rsi + 0x1090], al
cmp word [r13 + 1], r15w
jae 0x1def1
movzx eax, byte [r13 + 1]
jmp 0x1def6
mov eax, 8
mov r15d, 0x30
lea rcx, [rsi + 0x1092]
xor edx, edx
mov r8, r15
mov byte [rsi + 0x1091], al
call fcn.00015ec0
movsxd r11, dword [rsi + 0x108c]
cmp r11d, r15d
jae 0x1df22
mov r15, r11
lea rcx, [rsi + 0x1092]
mov r8, r15
mov rdx, r14
call fcn.00015fc0
xor edi, edi
mov byte [rbp], dil
jmp 0x1fda5
cmp byte [rsi + 2], r8b
je 0x20b14
mov byte [rbp], r8b
lea rcx, [r13 + 1]
mov edx, 4
mov r8, rsi
call fcn.0001d604
movzx r8d, word [r13 + 1]
movzx edi, byte [r13 + 4]
movzx eax, r8b
mov rdx, r14
mov r8, rdi
lea rbx, [rax + rsi + 0x34]
mov dword [0x00018304], eax
mov dword [0x00018300], edi
mov rcx, rbx
call fcn.00015fc0
mov r8, rsi
mov edx, edi
mov rcx, rbx
call fcn.0001d604
xor edi, edi
mov dword [r12], edi
jmp 0x1fda5
movzx eax, word [r13 + 1]
movsxd r15, dword [r12]
mov dword [rsp + 0x148], r8d
mov word [rsi + 0x10da], ax
movzx eax, byte [r13 + 4]
mov ebx, 0x40
mov word [rsi + 0x10dc], ax
cmp byte [r13 + 3], 0x80
mov eax, r8d
sete al
lea rcx, [rsp + 0x2a0]
mov r8, rbx
xor edx, edx
mov word [rsi + 0x10e0], ax
call fcn.00015ec0
mov r8, rbx
cmp r15d, ebx
lea rcx, [rsp + 0x2a0]
mov rdx, r14
cmovb r8, r15
call fcn.00015fc0
mov al, byte [rsp + 0x2a0]
lea r13d, [rbx - 0x10]
mov byte [rsi + 0x10f5], al
mov al, byte [rsp + 0x2a1]
lea r12, [0x0001a548]
mov r8, r13
xor edx, edx
mov rcx, r12
mov byte [rsi + 0x10f6], al
call fcn.00015ec0
lea rcx, [0x0001a578]
mov r8, r13
xor edx, edx
call fcn.00015ec0
lea r14d, [rbx - 0x38]
lea edi, [rbx - 0x30]
mov dword [rsp + 0x1e8], r14d
cmp r15d, 0x20
je 0x1e070
cmp r15d, r13d
je 0x1e070
cmp r15d, ebx
jne 0x1e13f
lea rcx, [rsp + 0x2ac]
lea r8, [rsi + 0x7ab4]
lea rdx, [rsp + 0x210]
movzx eax, word [rcx]
mov r9d, edi
mov r14d, edi
mov word [rsi + 0x10ee], ax
mov al, byte [rcx + 2]
mov dword [rsp + 0x1e8], edi
mov byte [rsi + 0x10f0], al
movzx eax, byte [rsi + 0x10ee]
movzx ecx, byte [rsi + 0x10ef]
shl eax, 8
or ecx, eax
movzx eax, byte [rsi + 0x10f0]
shl ecx, 8
or ecx, eax
xor eax, eax
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x218], rax
mov eax, dword [rsp + 0x2a8]
mov dword [rsi + 0x10f1], ecx
lea rcx, [rsi + 0x7a94]
mov dword [rsp + 0x210], eax
call fcn.00012818
mov al, byte [rsi + 0x1138]
mov r11b, byte [rsi + 0x1137]
mov byte [rsp + 0x215], al
mov al, byte [rsi + 0x1139]
lea r8, [rsi + 0x7aa4]
lea rdx, [rsp + 0x210]
lea rcx, [rsi + 0x7a94]
mov r9d, edi
mov byte [rsp + 0x216], al
mov byte [rsp + 0x214], r11b
call fcn.00012818
sub r15d, r14d
movsxd rax, r14d
lea rcx, [rsi + 0x7ab4]
cmp r15d, r13d
lea rdx, [rsp + rax + 0x2a0]
mov r8, r12
cmova r15d, r13d
mov qword [rsp + 0x150], rcx
mov r9d, r15d
call fcn.000126ec
xor eax, eax
lea ebx, [rax + 3]
lea r13d, [rax + 1]
mov r11, rax
mov al, byte [r11 + rsi + 0x10ee]
xor byte [r11 + r12], al
add r11, r13
cmp r11, rbx
jl 0x1e17a
add dword [rsi + 0x10f1], r13d
mov ecx, dword [rsi + 0x10f1]
mov r14d, 0xc0
mov eax, ecx
shr ecx, 8
mov r8, r14
shr eax, 0x10
mov byte [rsi + 0x10ef], cl
lea rcx, [rsp + 0x2e0]
mov byte [rsi + 0x10ee], al
mov al, byte [rsi + 0x10f1]
xor edx, edx
mov byte [rsi + 0x10f0], al
call fcn.00015ec0
movzx r11d, word [rsi + 0x10da]
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r11d
lea r12, [0x000220c0]
lea rcx, [rsp + 0x2e0]
mov r13d, 0x800
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r13d
call fcn.00011210
mov edx, dword [rsi + 0xa]
lea rax, [rsp + 0x148]
mov r15d, 0x2001
lea r9, [0x00018188]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x2e0]
mov ecx, r15d
mov dword [rsp + 0x20], edi
call fcn.0001162c
mov edx, dword [rsi + 0xa]
lea r11, [rsp + 0x148]
lea r9, [0x000181e8]
lea r8, [rsp + 0x2e0]
mov qword [rsp + 0x28], r11
mov ecx, r15d
mov dword [rsp + 0x20], edi
call fcn.0001162c
movzx r11d, word [rsi + 0x10da]
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], r11d
lea rcx, [rsp + 0x2e0]
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r13d
call fcn.00011210
mov edx, dword [rsi + 0xa]
lea r11, [rsp + 0x148]
lea r9, [0x00018198]
lea r8, [rsp + 0x2e0]
mov qword [rsp + 0x28], r11
mov ecx, r15d
mov dword [rsp + 0x20], edi
call fcn.0001162c
movzx r11d, word [rsi + 0x10da]
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], r11d
lea rcx, [rsp + 0x2e0]
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r13d
call fcn.00011210
mov edx, dword [rsi + 0xa]
lea r11, [rsp + 0x148]
lea r9, [0x000181a8]
lea r8, [rsp + 0x2e0]
mov qword [rsp + 0x28], r11
mov ecx, r15d
mov dword [rsp + 0x20], edi
call fcn.0001162c
movzx r11d, word [rsi + 0x10da]
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x30], r11d
lea rcx, [rsp + 0x2e0]
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r13d
call fcn.00011210
mov edx, dword [rsi + 0xa]
lea r11, [rsp + 0x148]
lea r9, [0x000181b8]
lea r8, [rsp + 0x2e0]
mov qword [rsp + 0x28], r11
mov ecx, r15d
mov dword [rsp + 0x20], edi
call fcn.0001162c
movzx r11d, word [rsi + 0x10da]
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], r11d
lea rcx, [rsp + 0x2e0]
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r13d
call fcn.00011210
mov edx, dword [rsi + 0xa]
lea r11, [rsp + 0x148]
lea r9, [0x000181c8]
lea r8, [rsp + 0x2e0]
mov qword [rsp + 0x28], r11
mov ecx, r15d
mov dword [rsp + 0x20], edi
call fcn.0001162c
movzx r11d, word [rsi + 0x10da]
mov r12d, 6
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r11d
lea rax, [0x000220c0]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x2e0]
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x144], r12d
call fcn.00011210
mov edx, dword [rsi + 0xa]
lea r11, [rsp + 0x148]
lea r9, [0x000181d8]
lea r8, [rsp + 0x2e0]
mov qword [rsp + 0x28], r11
mov ecx, r15d
mov dword [rsp + 0x20], edi
call fcn.0001162c
mov edx, dword [rsi + 0xa]
lea r11, [rsp + 0x148]
mov qword [rsp + 0x28], r11
lea r9, [0x000181f8]
lea r8, [rsp + 0x2e0]
mov ecx, r15d
mov dword [rsp + 0x20], edi
call fcn.0001162c
lea rcx, [rsp + 0x2e0]
mov r8, r14
xor edx, edx
call fcn.00015ec0
cmp byte [rsi + 0x7ad2], 0x11
mov eax, 0x8001
cmove r15d, eax
movzx eax, byte [rsi + 0x10f5]
cmp eax, 5
mov dword [rsp + 0x14c], r15d
jg 0x1f134
cmp eax, 4
jge 0x1ed0a
xor r14d, r14d
cmp eax, r14d
jl 0x1f7e8
lea r10d, [r12 - 5]
cmp eax, r10d
jle 0x1eafe
cmp eax, 2
je 0x1e80f
cmp eax, ebx
jne 0x1f7e8
movzx eax, byte [0x0001a567]
movzx ecx, byte [0x0001a566]
movzx edx, byte [0x0001a565]
mov dword [rsp + 0x138], eax
mov dword [rsp + 0x130], ecx
movzx eax, byte [0x0001a558]
movzx r8d, byte [0x0001a564]
movzx r9d, byte [0x0001a563]
movzx ebx, byte [0x0001a560]
mov dword [rsp + 0x128], edx
movzx r10d, byte [0x0001a562]
movzx r11d, byte [0x0001a561]
movzx edi, byte [0x0001a55f]
mov dword [rsp + 0x120], r8d
movzx esi, byte [0x0001a55e]
movzx ebp, byte [0x0001a55d]
movzx r12d, byte [0x0001a55c]
movzx r13d, byte [0x0001a55b]
movzx r14d, byte [0x0001a55a]
movzx r15d, byte [0x0001a559]
mov dword [rsp + 0x118], r9d
mov dword [rsp + 0x110], r10d
mov dword [rsp + 0x108], r11d
mov dword [rsp + 0x100], ebx
mov rbx, qword [rsp + 0x160]
mov dword [rsp + 0xf8], edi
mov dword [rsp + 0xf0], esi
mov dword [rsp + 0xe8], ebp
mov dword [rsp + 0xe0], r12d
mov dword [rsp + 0xd8], r13d
mov dword [rsp + 0xd0], r14d
mov dword [rsp + 0xc8], r15d
mov dword [rsp + 0xc0], eax
movzx eax, byte [0x0001a557]
lea rcx, [rsp + 0x2e0]
xor r9d, r9d
mov dword [rsp + 0xb8], eax
movzx eax, byte [0x0001a556]
xor r8d, r8d
mov dword [rsp + 0xb0], eax
movzx eax, byte [0x0001a555]
mov edx, 0xc0
mov dword [rsp + 0xa8], eax
movzx eax, byte [0x0001a554]
mov dword [rsp + 0xa0], eax
movzx eax, byte [0x0001a553]
mov dword [rsp + 0x98], eax
movzx eax, byte [0x0001a552]
mov dword [rsp + 0x90], eax
movzx eax, byte [0x0001a551]
mov dword [rsp + 0x88], eax
movzx eax, byte [0x0001a550]
mov dword [rsp + 0x80], eax
movzx eax, byte [0x0001a54f]
mov dword [rsp + 0x78], eax
movzx eax, byte [0x0001a54e]
mov dword [rsp + 0x70], eax
movzx eax, byte [0x0001a54d]
mov dword [rsp + 0x68], eax
movzx eax, byte [0x0001a54c]
mov dword [rsp + 0x60], eax
movzx eax, byte [0x0001a54b]
mov dword [rsp + 0x58], eax
movzx eax, byte [0x0001a54a]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x0001a549]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x0001a548]
mov dword [rsp + 0x40], eax
movzx eax, word [rbx + 0x10da]
mov dword [rsp + 0x38], eax
movzx eax, byte [rbx + 0x10f5]
mov dword [rsp + 0x30], eax
lea rax, [0x00022180]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
call fcn.00011210
lea r11, [rsp + 0x148]
lea rdi, [0x0001a578]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0x20
mov edx, dword [rbx + 0xa]
mov ecx, dword [rsp + 0x14c]
lea r8, [rsp + 0x2e0]
mov r9, rdi
call fcn.0001162c
xor r14d, r14d
cmp eax, r14d
lea r12d, [r14 + 0x10]
jge 0x1e79b
lea rdx, [0x0001a548]
lea rcx, [0x000181c8]
mov r9d, r12d
mov r8, rdi
call fcn.000126ec
lea r13, [0x0001a588]
lea rdx, [0x0001a558]
lea rcx, [0x000181b8]
mov r8, r13
mov r9d, r12d
call fcn.00012818
mov r11, rdi
mov rcx, r12
lea ebx, [r14 + 1]
mov al, byte [r11 + 0x10]
xor byte [r11], al
add r11, rbx
sub rcx, rbx
jne 0x1e77c
lea r8d, [rcx + 0x20]
xor edx, edx
mov rcx, r13
call fcn.00015ec0
jmp 0x1e7be
cmp byte [rbx + 0x7ad2], r14b
je 0x1e7b9
lea rcx, [0x0001a538]
mov r9d, r12d
mov r8, rdi
mov rdx, rdi
call fcn.000126ec
mov ebx, 1
movsxd r8, dword [rsp + 0x1e8]
mov rdx, r14
lea rcx, [rsp + r8 + 0x2b0]
mov al, byte [rcx + rdx]
xor byte [rdx + rdi], al
add rdx, rbx
cmp rdx, r12
jl 0x1e7d1
mov rcx, qword [rsp + 0x150]
mov r9d, r12d
mov r8, rdi
mov rdx, rdi
call fcn.00012818
mov r11, qword [0x0001a580]
mov qword [0x0001a588], r11
mov qword [0x0001a590], r11
jmp 0x1ecfd
movzx eax, byte [0x0001a567]
movzx ecx, byte [0x0001a566]
movzx edx, byte [0x0001a565]
mov dword [rsp + 0x138], eax
mov dword [rsp + 0x130], ecx
movzx eax, byte [0x0001a558]
movzx r8d, byte [0x0001a564]
movzx r9d, byte [0x0001a563]
movzx ebx, byte [0x0001a560]
mov dword [rsp + 0x128], edx
movzx r10d, byte [0x0001a562]
movzx r11d, byte [0x0001a561]
movzx edi, byte [0x0001a55f]
mov dword [rsp + 0x120], r8d
movzx esi, byte [0x0001a55e]
movzx ebp, byte [0x0001a55d]
movzx r12d, byte [0x0001a55c]
movzx r13d, byte [0x0001a55b]
movzx r14d, byte [0x0001a55a]
movzx r15d, byte [0x0001a559]
mov dword [rsp + 0x118], r9d
mov dword [rsp + 0x110], r10d
mov dword [rsp + 0x108], r11d
mov dword [rsp + 0x100], ebx
mov rbx, qword [rsp + 0x160]
mov dword [rsp + 0xf8], edi
mov dword [rsp + 0xf0], esi
mov dword [rsp + 0xe8], ebp
mov dword [rsp + 0xe0], r12d
mov dword [rsp + 0xd8], r13d
mov dword [rsp + 0xd0], r14d
mov dword [rsp + 0xc8], r15d
mov dword [rsp + 0xc0], eax
movzx eax, byte [0x0001a557]
lea rcx, [rsp + 0x2e0]
xor r9d, r9d
mov dword [rsp + 0xb8], eax
movzx eax, byte [0x0001a556]
xor r8d, r8d
mov dword [rsp + 0xb0], eax
movzx eax, byte [0x0001a555]
mov edx, 0xc0
mov dword [rsp + 0xa8], eax
movzx eax, byte [0x0001a554]
mov dword [rsp + 0xa0], eax
movzx eax, byte [0x0001a553]
mov dword [rsp + 0x98], eax
movzx eax, byte [0x0001a552]
mov dword [rsp + 0x90], eax
movzx eax, byte [0x0001a551]
mov dword [rsp + 0x88], eax
movzx eax, byte [0x0001a550]
mov dword [rsp + 0x80], eax
movzx eax, byte [0x0001a54f]
mov dword [rsp + 0x78], eax
movzx eax, byte [0x0001a54e]
mov dword [rsp + 0x70], eax
movzx eax, byte [0x0001a54d]
mov dword [rsp + 0x68], eax
movzx eax, byte [0x0001a54c]
mov dword [rsp + 0x60], eax
movzx eax, byte [0x0001a54b]
mov dword [rsp + 0x58], eax
movzx eax, byte [0x0001a54a]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x0001a549]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x0001a548]
mov dword [rsp + 0x40], eax
movzx eax, word [rbx + 0x10da]
mov dword [rsp + 0x38], eax
movzx eax, byte [rbx + 0x10f5]
mov dword [rsp + 0x30], eax
lea rax, [0x00022180]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
call fcn.00011210
lea r11, [rsp + 0x148]
mov r12d, 0x10
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], r12d
mov edx, dword [rbx + 0xa]
mov ecx, dword [rsp + 0x14c]
lea rdi, [0x0001a578]
lea r8, [rsp + 0x2e0]
mov r9, rdi
call fcn.0001162c
xor r14d, r14d
cmp eax, r14d
jge 0x1eab5
lea rdx, [0x0001a548]
lea rcx, [0x00018198]
mov r9d, r12d
mov r8, rdi
call fcn.00012818
lea r13, [0x0001a588]
lea rdx, [0x0001a558]
lea rcx, [0x000181a8]
mov r8, r13
mov r9d, r12d
call fcn.00012818
mov r11, rdi
mov rcx, r12
lea ebx, [r12 - 0xf]
mov al, byte [r11 + 0x10]
xor byte [r11], al
add r11, rbx
sub rcx, rbx
jne 0x1ea96
lea r8d, [rcx + 0x20]
xor edx, edx
mov rcx, r13
call fcn.00015ec0
jmp 0x1ead8
cmp byte [rbx + 0x7ad2], r14b
je 0x1ead3
lea rcx, [0x0001a538]
mov r9d, r12d
mov r8, rdi
mov rdx, rdi
call fcn.000126ec
mov ebx, 1
movsxd r8, dword [rsp + 0x1e8]
mov rcx, r14
lea rdx, [rsp + r8 + 0x2b0]
mov al, byte [rdx + rcx]
xor byte [rcx + rdi], al
add rcx, rbx
cmp rcx, r12
jl 0x1eaeb
jmp 0x1ece7
movzx eax, byte [0x0001a557]
movzx ecx, byte [0x0001a556]
movzx edx, byte [0x0001a555]
movzx r8d, byte [0x0001a554]
movzx r9d, byte [0x0001a553]
movzx ebx, byte [0x0001a550]
movzx r10d, byte [0x0001a552]
movzx r11d, byte [0x0001a551]
movzx edi, byte [0x0001a54f]
movzx esi, byte [0x0001a54e]
movzx ebp, byte [0x0001a54d]
movzx r12d, byte [0x0001a54c]
movzx r13d, byte [0x0001a54b]
movzx r14d, byte [0x0001a54a]
movzx r15d, byte [0x0001a549]
mov dword [rsp + 0xb8], eax
movzx eax, byte [0x0001a548]
mov dword [rsp + 0xb0], ecx
mov dword [rsp + 0xa8], edx
mov dword [rsp + 0xa0], r8d
mov dword [rsp + 0x98], r9d
mov dword [rsp + 0x90], r10d
mov dword [rsp + 0x88], r11d
mov dword [rsp + 0x80], ebx
mov rbx, qword [rsp + 0x160]
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], ebp
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], eax
movzx eax, word [rbx + 0x10da]
lea rcx, [rsp + 0x2e0]
xor r9d, r9d
mov dword [rsp + 0x38], eax
movzx eax, byte [rbx + 0x10f5]
xor r8d, r8d
mov dword [rsp + 0x30], eax
lea rax, [0x000220e0]
mov edx, 0xc0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
call fcn.00011210
mov edx, dword [rbx + 0xa]
mov ecx, dword [rsp + 0x14c]
lea r11, [rsp + 0x148]
mov qword [rsp + 0x28], r11
lea rdi, [0x0001a578]
lea r8, [rsp + 0x2e0]
mov r12d, 0x10
mov r9, rdi
mov dword [rsp + 0x20], r12d
call fcn.0001162c
xor r14d, r14d
cmp eax, r14d
jge 0x1eca2
cmp byte [rbx + 0x10f5], r14b
jne 0x1ec83
lea rdx, [0x0001a548]
lea rcx, [0x00018188]
mov r9d, r12d
mov r8, rdi
call fcn.00012818
mov r9d, 1
cmp byte [rbx + 0x10f5], r9b
jne 0x1ecc6
lea rdx, [0x0001a548]
lea rcx, [0x00018188]
jmp 0x1ecb5
cmp byte [rbx + 0x7ad2], r14b
je 0x1ecc0
mov rdx, rdi
lea rcx, [0x0001a538]
mov r9d, r12d
mov r8, rdi
call fcn.000126ec
mov r9d, 1
movsxd r8, dword [rsp + 0x1e8]
mov rcx, r14
lea rdx, [rsp + r8 + 0x2a0]
mov al, byte [rdx + rcx]
xor byte [rcx + rdi], al
add rcx, r9
cmp rcx, r12
jl 0x1ecd9
mov r9d, r12d
mov rcx, qword [rsp + 0x150]
mov r8, rdi
mov rdx, rdi
call fcn.00012818
mov rbp, qword [rsp + 0x158]
jmp 0x1f7e8
movzx eax, byte [0x0001a567]
movzx ecx, byte [0x0001a566]
movzx edx, byte [0x0001a565]
mov dword [rsp + 0x138], eax
mov dword [rsp + 0x130], ecx
movzx eax, byte [0x0001a558]
movzx r8d, byte [0x0001a564]
movzx r9d, byte [0x0001a563]
movzx ebx, byte [0x0001a560]
mov dword [rsp + 0x128], edx
movzx r10d, byte [0x0001a562]
movzx r11d, byte [0x0001a561]
movzx edi, byte [0x0001a55f]
mov dword [rsp + 0x120], r8d
movzx esi, byte [0x0001a55e]
movzx ebp, byte [0x0001a55d]
movzx r12d, byte [0x0001a55c]
movzx r13d, byte [0x0001a55b]
movzx r14d, byte [0x0001a55a]
movzx r15d, byte [0x0001a559]
mov dword [rsp + 0x118], r9d
mov dword [rsp + 0x110], r10d
mov dword [rsp + 0x108], r11d
mov dword [rsp + 0x100], ebx
mov rbx, qword [rsp + 0x160]
mov dword [rsp + 0xf8], edi
mov dword [rsp + 0xf0], esi
mov dword [rsp + 0xe8], ebp
mov dword [rsp + 0xe0], r12d
mov dword [rsp + 0xd8], r13d
mov dword [rsp + 0xd0], r14d
mov dword [rsp + 0xc8], r15d
mov dword [rsp + 0xc0], eax
movzx eax, byte [0x0001a557]
lea rcx, [rsp + 0x2e0]
xor r9d, r9d
mov dword [rsp + 0xb8], eax
movzx eax, byte [0x0001a556]
xor r8d, r8d
mov dword [rsp + 0xb0], eax
movzx eax, byte [0x0001a555]
mov edx, 0xc0
mov dword [rsp + 0xa8], eax
movzx eax, byte [0x0001a554]
mov dword [rsp + 0xa0], eax
movzx eax, byte [0x0001a553]
mov dword [rsp + 0x98], eax
movzx eax, byte [0x0001a552]
mov dword [rsp + 0x90], eax
movzx eax, byte [0x0001a551]
mov dword [rsp + 0x88], eax
movzx eax, byte [0x0001a550]
mov dword [rsp + 0x80], eax
movzx eax, byte [0x0001a54f]
mov dword [rsp + 0x78], eax
movzx eax, byte [0x0001a54e]
mov dword [rsp + 0x70], eax
movzx eax, byte [0x0001a54d]
mov dword [rsp + 0x68], eax
movzx eax, byte [0x0001a54c]
mov dword [rsp + 0x60], eax
movzx eax, byte [0x0001a54b]
mov dword [rsp + 0x58], eax
movzx eax, byte [0x0001a54a]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x0001a549]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x0001a548]
mov dword [rsp + 0x40], eax
movzx eax, word [rbx + 0x10da]
mov dword [rsp + 0x38], eax
movzx eax, byte [rbx + 0x10f5]
mov dword [rsp + 0x30], eax
lea rax, [0x00022180]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
call fcn.00011210
lea r11, [rsp + 0x148]
mov r15d, 0x30
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], r15d
mov edx, dword [rbx + 0xa]
mov ecx, dword [rsp + 0x14c]
lea rdi, [0x0001a578]
lea r8, [rsp + 0x2e0]
mov r9, rdi
call fcn.0001162c
xor r14d, r14d
cmp eax, r14d
jge 0x1f0ab
lea rdx, [0x0001a548]
mov rcx, rdi
mov r8, r15
call fcn.00015fc0
cmp byte [rbx + 0x10f5], 4
lea r13, [0x0001a588]
lea r12d, [r15 - 0x20]
jne 0x1f00c
lea rdx, [0x0001a548]
lea rcx, [0x00018198]
mov r9d, r12d
mov r8, rdi
call fcn.00012818
lea rdx, [0x0001a558]
lea rcx, [0x000181a8]
mov r9d, r12d
mov r8, r13
call fcn.00012818
lea r8, [0x0001a598]
lea rdx, [0x0001a568]
lea rcx, [0x000181b8]
mov r9d, r12d
call fcn.00012818
mov r11, rdi
mov rcx, r12
lea esi, [r15 - 0x2f]
mov al, byte [r11 + 0x10]
xor al, byte [r11 + 0x20]
xor byte [r11], al
add r11, rsi
sub rcx, rsi
jne 0x1efd4
lea rcx, [0x000181c8]
mov r9d, r12d
mov r8, rdi
mov rdx, rdi
call fcn.00012818
xor edx, edx
mov rcx, r13
lea r8d, [rdx + 0x20]
call fcn.00015ec0
jmp 0x1f011
mov esi, 1
cmp byte [rbx + 0x10f5], 5
jne 0x1f0cf
lea rdx, [0x0001a548]
lea rcx, [0x000181c8]
mov r9d, r12d
mov r8, rdi
call fcn.000126ec
lea rdx, [0x0001a558]
lea rcx, [0x000181b8]
mov r9d, r12d
mov r8, r13
call fcn.00012818
lea r8, [0x0001a598]
lea rdx, [0x0001a568]
lea rcx, [0x000181a8]
mov r9d, r12d
call fcn.00012818
mov r11, rdi
mov rcx, r12
mov al, byte [r11 + 0x10]
xor al, byte [r11 + 0x20]
xor byte [r11], al
add r11, rsi
sub rcx, rsi
jne 0x1f073
lea rcx, [0x00018198]
mov r9d, r12d
mov r8, rdi
mov rdx, rdi
call fcn.000126ec
xor edx, edx
mov rcx, r13
lea r8d, [rdx + 0x20]
call fcn.00015ec0
jmp 0x1f0cf
mov r12d, 0x10
cmp byte [rbx + 0x7ad2], r14b
je 0x1f0cf
lea rcx, [0x0001a538]
mov r9d, r12d
mov r8, rdi
mov rdx, rdi
call fcn.000126ec
movsxd r8, dword [rsp + 0x1e8]
mov rcx, r14
mov r10d, 1
lea rdx, [rsp + r8 + 0x2c0]
mov al, byte [rdx + rcx]
xor byte [rcx + rdi], al
add rcx, r10
cmp rcx, r12
jl 0x1f0e8
mov rcx, qword [rsp + 0x150]
mov r9d, r12d
mov r8, rdi
mov rdx, rdi
call fcn.00012818
mov r11, qword [0x0001a580]
mov qword [0x0001a588], r11
mov qword [0x0001a590], r11
mov qword [0x0001a598], r11
mov qword [0x0001a5a0], r11
jmp 0x1ecfd
cmp eax, r12d
jl 0x1f7e5
cmp eax, 9
jle 0x1f38e
cmp eax, 0xb
jg 0x1f7e5
movzx eax, byte [0x0001a557]
movzx ecx, byte [0x0001a556]
movzx edx, byte [0x0001a555]
movzx r8d, byte [0x0001a554]
movzx r9d, byte [0x0001a553]
movzx ebx, byte [0x0001a550]
movzx r10d, byte [0x0001a552]
movzx r11d, byte [0x0001a551]
movzx edi, byte [0x0001a54f]
movzx esi, byte [0x0001a54e]
movzx ebp, byte [0x0001a54d]
movzx r12d, byte [0x0001a54c]
movzx r13d, byte [0x0001a54b]
movzx r14d, byte [0x0001a54a]
movzx r15d, byte [0x0001a549]
mov dword [rsp + 0xb8], eax
movzx eax, byte [0x0001a548]
mov dword [rsp + 0xb0], ecx
mov dword [rsp + 0xa8], edx
mov dword [rsp + 0xa0], r8d
mov dword [rsp + 0x98], r9d
mov dword [rsp + 0x90], r10d
mov dword [rsp + 0x88], r11d
mov dword [rsp + 0x80], ebx
mov rbx, qword [rsp + 0x160]
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], ebp
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], eax
movzx eax, word [rbx + 0x10da]
lea rcx, [rsp + 0x2e0]
xor r9d, r9d
mov dword [rsp + 0x38], eax
movzx eax, byte [rbx + 0x10f5]
xor r8d, r8d
mov dword [rsp + 0x30], eax
lea rax, [0x000220e0]
mov edx, 0xc0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
call fcn.00011210
mov edx, dword [rbx + 0xa]
mov ecx, dword [rsp + 0x14c]
lea r11, [rsp + 0x148]
mov qword [rsp + 0x28], r11
lea rdi, [0x0001a578]
lea r8, [rsp + 0x2e0]
mov r9, rdi
mov dword [rsp + 0x20], 0x20
call fcn.0001162c
xor r14d, r14d
cmp eax, r14d
lea r12d, [r14 + 0x10]
jge 0x1f322
lea ecx, [r14 + 0xa]
lea r13, [0x0001a588]
cmp byte [rbx + 0x10f5], cl
jne 0x1f2f4
lea rdx, [0x0001a548]
lea rcx, [0x000181f8]
mov r9d, r12d
mov r8, rdi
call fcn.00012818
lea rcx, [0x000181f8]
mov r9d, r12d
mov r8, r13
mov rdx, rdi
call fcn.00012818
cmp byte [rbx + 0x10f5], 0xb
jne 0x1f35c
lea rdx, [0x0001a548]
lea rcx, [0x000181f8]
mov r9d, r12d
mov r8, rdi
call fcn.000126ec
mov rdx, rdi
lea rcx, [0x000181f8]
jmp 0x1f351
cmp byte [rbx + 0x7ad2], r14b
je 0x1f35c
lea rcx, [0x0001a538]
mov r9d, r12d
mov r8, rdi
mov rdx, rdi
call fcn.000126ec
lea r13, [0x0001a588]
lea rcx, [0x0001a538]
mov rdx, r13
mov r9d, r12d
mov r8, r13
call fcn.000126ec
movsxd r8, dword [rsp + 0x1e8]
mov rcx, r14
mov r10d, 1
lea rdx, [rsp + r8 + 0x2a0]
mov al, byte [rdx + rcx]
xor byte [rcx + rdi], al
add rcx, r10
cmp rcx, r12
jl 0x1f375
mov r9d, 0x20
jmp 0x1ecea
movzx eax, byte [0x0001a567]
movzx ecx, byte [0x0001a566]
movzx edx, byte [0x0001a565]
mov dword [rsp + 0x138], eax
mov dword [rsp + 0x130], ecx
movzx eax, byte [0x0001a558]
movzx r8d, byte [0x0001a564]
movzx r9d, byte [0x0001a563]
movzx ebx, byte [0x0001a560]
mov dword [rsp + 0x128], edx
movzx r10d, byte [0x0001a562]
movzx r11d, byte [0x0001a561]
movzx edi, byte [0x0001a55f]
mov dword [rsp + 0x120], r8d
movzx esi, byte [0x0001a55e]
movzx ebp, byte [0x0001a55d]
movzx r12d, byte [0x0001a55c]
movzx r13d, byte [0x0001a55b]
movzx r14d, byte [0x0001a55a]
movzx r15d, byte [0x0001a559]
mov dword [rsp + 0x118], r9d
mov dword [rsp + 0x110], r10d
mov dword [rsp + 0x108], r11d
mov dword [rsp + 0x100], ebx
mov rbx, qword [rsp + 0x160]
mov dword [rsp + 0xf8], edi
mov dword [rsp + 0xf0], esi
mov dword [rsp + 0xe8], ebp
mov dword [rsp + 0xe0], r12d
mov dword [rsp + 0xd8], r13d
mov dword [rsp + 0xd0], r14d
mov dword [rsp + 0xc8], r15d
mov dword [rsp + 0xc0], eax
movzx eax, byte [0x0001a557]
lea rcx, [rsp + 0x2e0]
xor r9d, r9d
mov dword [rsp + 0xb8], eax
movzx eax, byte [0x0001a556]
xor r8d, r8d
mov dword [rsp + 0xb0], eax
movzx eax, byte [0x0001a555]
mov edx, 0xc0
mov dword [rsp + 0xa8], eax
movzx eax, byte [0x0001a554]
mov dword [rsp + 0xa0], eax
movzx eax, byte [0x0001a553]
mov dword [rsp + 0x98], eax
movzx eax, byte [0x0001a552]
mov dword [rsp + 0x90], eax
movzx eax, byte [0x0001a551]
mov dword [rsp + 0x88], eax
movzx eax, byte [0x0001a550]
mov dword [rsp + 0x80], eax
movzx eax, byte [0x0001a54f]
mov dword [rsp + 0x78], eax
movzx eax, byte [0x0001a54e]
mov dword [rsp + 0x70], eax
movzx eax, byte [0x0001a54d]
mov dword [rsp + 0x68], eax
movzx eax, byte [0x0001a54c]
mov dword [rsp + 0x60], eax
movzx eax, byte [0x0001a54b]
mov dword [rsp + 0x58], eax
movzx eax, byte [0x0001a54a]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x0001a549]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x0001a548]
mov dword [rsp + 0x40], eax
movzx eax, word [rbx + 0x10da]
mov dword [rsp + 0x38], eax
movzx eax, byte [rbx + 0x10f5]
mov dword [rsp + 0x30], eax
lea rax, [0x00022180]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
call fcn.00011210
lea r11, [rsp + 0x148]
mov esi, 0x20
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], esi
mov edx, dword [rbx + 0xa]
mov ecx, dword [rsp + 0x14c]
lea rdi, [0x0001a578]
lea r8, [rsp + 0x2e0]
mov r9, rdi
call fcn.0001162c
xor r14d, r14d
cmp eax, r14d
jge 0x1f776
lea rdx, [0x0001a548]
mov rcx, rdi
mov r8, rsi
call fcn.00015fc0
lea rcx, [rsp + 0x268]
lea rdx, [0x0001a548]
lea r8d, [rsi + 0x10]
call fcn.00015fc0
mov r11b, byte [rbx + 0x10f5]
mov eax, dword [rsp + 0x144]
lea r13, [0x0001a588]
cmp r11b, al
je 0x1f623
lea eax, [rsi - 0x18]
cmp r11b, al
jne 0x1f6ab
lea rbp, [0x00018188]
mov r12d, 0x10
lea rdx, [rsp + 0x268]
mov rcx, rbp
mov r9d, r12d
cmp byte [rbx + 0x10f6], r14b
jne 0x1f667
mov r8, rdi
call fcn.00012818
lea rdx, [rsp + 0x278]
mov r9d, r12d
mov r8, r13
mov rcx, rbp
call fcn.00012818
jmp 0x1f6b8
mov r8, r13
call fcn.00012818
mov r11, r14
mov r14d, 1
mov rcx, r12
mov al, byte [r11 + rdi + 0x10]
xor byte [rsp + r11 + 0x278], al
add r11, r14
sub rcx, r14
jne 0x1f67b
lea rdx, [rsp + 0x278]
mov r9d, r12d
mov r8, rdi
mov rcx, rbp
call fcn.00012818
xor r14d, r14d
jmp 0x1f6b8
mov r12d, 0x10
lea rbp, [0x00018188]
mov al, byte [rbx + 0x10f5]
mov r15d, 7
cmp al, r15b
je 0x1f6d1
cmp al, 9
jne 0x1f7b6
mov r9d, r12d
mov r8, rdi
lea rdx, [rsp + 0x268]
mov rcx, rbp
cmp byte [rbx + 0x10f6], r14b
jne 0x1f700
call fcn.000126ec
lea rdx, [rsp + 0x278]
mov rcx, rbp
jmp 0x1f7ab
call fcn.000126ec
mov rcx, r12
mov r15d, 1
mov al, byte [r13 - 0x10]
xor byte [r13], al
add r13, r15
sub rcx, r15
jne 0x1f70e
movzx ecx, byte [rbx + 0x10f6]
mov eax, r12d
mov dl, r14b
sub eax, ecx
cmp eax, r14d
jle 0x1f75e
movzx eax, byte [rbx + 0x10f6]
mov r8d, r12d
mov r9, rcx
sub r8d, eax
movzx ecx, dl
add dl, r15b
add rcx, r9
mov al, byte [rcx + rdi + 0x10]
mov byte [rsp + rcx + 0x278], al
movzx eax, dl
cmp eax, r8d
jl 0x1f742
lea rdx, [rsp + 0x278]
mov r9d, r12d
mov r8, rdi
mov rcx, rbp
call fcn.000126ec
jmp 0x1f7bc
mov r12d, 0x10
cmp byte [rbx + 0x7ad2], r14b
je 0x1f7b6
lea rcx, [0x0001a538]
mov r9d, r12d
mov r8, rdi
mov rdx, rdi
call fcn.000126ec
lea r13, [0x0001a588]
lea rcx, [0x0001a538]
mov rdx, r13
mov r9d, r12d
mov r8, r13
call fcn.000126ec
mov r15d, 1
movsxd r8, dword [rsp + 0x1e8]
mov rcx, r14
lea rdx, [rsp + r8 + 0x2b0]
mov al, byte [rdx + rcx]
xor byte [rcx + rdi], al
add rcx, r15
cmp rcx, r12
jl 0x1f7cf
mov r9d, esi
jmp 0x1ecea
xor r14d, r14d
mov byte [rbp], r14b
mov byte [rbp + 4], r14b
jmp 0x1fda5
sub ecx, 0x2f
je 0x1fabb
sub ecx, 0x51
je 0x1fa55
sub ecx, r9d
je 0x1f9e8
sub ecx, r9d
je 0x1f995
sub ecx, r9d
je 0x1f908
sub ecx, r9d
je 0x1f8d4
mov r15d, 7
sub ecx, r15d
je 0x1f884
cmp ecx, 0xd
jne 0x20b06
lea edx, [rcx - 9]
lea rcx, [r13 + 1]
mov r8, rsi
call fcn.0001d604
xor r8d, r8d
cmp byte [rsi + 2], r8b
je 0x20bc2
mov byte [rbp], r8b
mov eax, dword [r13 + 1]
lea rcx, [rbp + 2]
lea rdx, [rsi + 0x1074]
mov dword [rcx], eax
call fcn.00021cfc
lea ebx, [r15 - 3]
mov r9d, 1
jmp 0x1fab3
lea rcx, [r13 + 1]
mov r8, rsi
mov edx, 2
call fcn.0001d604
xor r8d, r8d
cmp byte [rsi + 2], r8b
je 0x20bc2
lea r9d, [r8 + 1]
cmp word [r13 + 1], r15w
ja 0x20b14
mov byte [rbp], r8b
movzx ecx, word [r13 + 1]
mov eax, dword [rsi + rcx*2 + 0x24]
mov dword [rbp + 2], eax
movzx eax, word [rsi + rcx*2 + 0x28]
mov word [rbp + 6], ax
mov ebx, 6
jmp 0x1fab3
cmp byte [rsi + 2], r8b
je 0x20b14
mov byte [rbp], r8b
mov r15d, 7
lea rcx, [rbp + 2]
mov al, byte [rsi + r15 + 0x1c]
sub r15, r9
mov byte [rcx], al
add rcx, r9
cmp r15, r8
jge 0x1f8ec
mov ebx, 8
jmp 0x1fab3
lea rcx, [r13 + 1]
mov r8, rsi
mov edx, 4
call fcn.0001d604
xor r8d, r8d
cmp byte [rsi + 2], r8b
je 0x20bc2
mov rcx, rsi
call fcn.0001d670
movzx ecx, word [r13 + 1]
mov r15b, r8b
add ecx, ecx
cmp ecx, eax
jge 0x20bc5
mov byte [rbp], r8b
movzx edx, word [r13 + 1]
movzx eax, word [r13 + 3]
mov rcx, rsi
mov ebx, r8d
mov word [rsi + rdx*2 + 0x74], ax
call fcn.0001d670
lea r9, [rsi + 0x74]
lea r8, [0x00021e50]
mov rdx, rsi
mov ecx, 0x1002
mov dword [rsp + 0x20], eax
call fcn.00011bb4
xor r8d, r8d
mov r9d, 1
cmp eax, r8d
jne 0x20b1e
mov byte [rbp], r8b
jmp 0x20b1e
lea rcx, [r13 + 1]
mov r8, rsi
mov edx, 2
call fcn.0001d604
xor r8d, r8d
cmp byte [rsi + 2], r8b
je 0x20bc2
mov rcx, rsi
call fcn.0001d670
movzx ecx, word [r13 + 1]
lea r9d, [r8 + 1]
add ecx, ecx
cmp ecx, eax
jge 0x20b14
mov byte [rbp], r8b
movzx ecx, word [r13 + 1]
mov eax, dword [rsi + rcx*2 + 0x74]
mov dword [rbp + 2], eax
movzx eax, word [rsi + rcx*2 + 0x78]
jmp 0x1f8c6
lea rcx, [r13 + 1]
mov r8, rsi
mov edx, 4
call fcn.0001d604
mov r8d, dword [rsi + 0xa]
mov r9d, 1
cmp dword [r13 + 1], r8d
jne 0x20bb5
cmp byte [rsi + 1], r9b
jne 0x20bb5
xor eax, eax
mov rcx, rsi
mov byte [rbp], al
call fcn.0001d670
mov rcx, rsi
mov byte [rbp + 2], al
call fcn.0001d670
lea r12d, [r9 + 0xf]
sar eax, 8
mov byte [rbp + 4], r12b
lea ebx, [r9 + 2]
mov byte [rbp + 3], al
mov byte [rsi + 2], r9b
mov r12, qword [rsp + 0x188]
mov r15b, r9b
jmp 0x20b1e
movzx eax, word [r13 + 1]
mov byte [rsi + 3], sil
mov byte [rsi + 1], r9b
mov word [rsi + 4], ax
mov ecx, 0xa
mov eax, 0xa0cb
mov word [rsi + 6], ax
lea ebx, [rcx - 7]
mov byte [rbp], r8b
mov byte [rbp + 2], 2
mov byte [rbp + 3], cl
cmp byte [rsi + 0x28], bl
je 0x1fa8f
cmp byte [rsi + 0x28], 5
mov eax, ecx
jne 0x1fa94
mov eax, 0x1a
mov byte [rbp + 3], al
movzx eax, byte [rsi + 8]
mov byte [rbp + 6], bl
cmp al, 5
mov byte [rbp + 4], r8b
mov byte [rbp + 5], 0x19
cmova ecx, eax
mov ebx, 5
mov byte [rbp + 3], cl
mov r15b, r9b
jmp 0x20b1e
mov byte [rsp + 0x1f0], 0x79
mov byte [rsp + 0x1f1], 0x4c
mov byte [rsp + 0x1f2], 0xe1
mov byte [rsp + 0x1f3], 0x88
mov byte [rsp + 0x1f4], 0xcb
mov byte [rsp + 0x1f5], 0xc1
mov byte [rsp + 0x1f6], 0x78
mov byte [rsp + 0x1f7], 0x53
mov byte [rsp + 0x1f8], 0x11
mov byte [rsp + 0x1f9], 0x69
mov byte [rsp + 0x1fa], 0xe0
mov byte [rsp + 0x1fb], 0xb2
mov byte [rsp + 0x1fc], 0xca
mov byte [rsp + 0x1fd], 0x97
mov byte [rsp + 0x1fe], 0xc9
mov byte [rsp + 0x1ff], 0x76
cmp r15d, 8
jne 0x1fda5
xor eax, eax
lea r12d, [r15 + 8]
lea r8, [rsp + 0x258]
mov qword [rsi + 0x93b1], rax
mov qword [rsi + 0x93b9], rax
mov qword [rsi + 0x93c1], rax
mov qword [rsp + 0x258], rax
mov dword [rsi + 0x93c9], eax
mov qword [rsp + 0x230], rax
mov qword [rsp + 0x238], rax
mov dword [rsp + 0x240], eax
mov qword [rsp + 0x260], rax
mov eax, dword [r13 + 1]
lea rdx, [rsp + 0x258]
lea rcx, [rsp + 0x1f0]
mov r9d, r12d
mov dword [rsp + 0x258], eax
call fcn.00012818
mov r11, qword [r14]
mov qword [rsi + 0x93b1], r11
mov eax, dword [0x00018238]
mov qword [rsp + 0x238], r11
mov dword [rsp + 0x230], eax
mov dword [rsp + 0x240], eax
call fcn.00012be4
lea r8, [rsp + 0x230]
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x258]
mov r9d, r12d
call fcn.00012818
lea rcx, [rsp + 0x230]
mov rax, qword [rcx]
mov qword [rsi + 0x93b9], rax
mov rax, qword [rcx + 8]
mov qword [rsi + 0x93c1], rax
mov eax, dword [rcx + 0x10]
mov dword [rsi + 0x93c9], eax
xor eax, eax
mov byte [rbp], al
mov byte [rbp + 4], al
jmp 0x1fda5
cmp byte [rsi + 2], r8b
je 0x20b14
mov byte [rbp], r8b
lea r15, [r13 + 1]
mov edx, 4
mov rcx, r15
mov r8, rsi
call fcn.0001d604
movabs rax, 0xfffff78000000014
lea rdx, [rsp + 0x190]
mov rax, qword [rax]
lea rcx, [rsp + 0x180]
mov qword [rsp + 0x180], rax
mov rax, qword [rsi + 0x6c]
add qword [rsp + 0x180], rax
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
movzx eax, word [r15]
and ax, bx
jne 0x1fcbc
mov cl, byte [rsp + 0x196]
call fcn.00012b20
mov cl, byte [rsp + 0x198]
mov byte [rbp + 4], al
call fcn.00012b20
mov cl, byte [rsp + 0x19a]
jmp 0x1fd0e
mov ebx, 3
cmp ax, bx
jne 0x1fd1b
movsx ecx, word [rsp + 0x190]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub ecx, edx
call fcn.00012b20
mov cl, byte [rsp + 0x19e]
mov byte [rbp + 5], al
call fcn.00012b20
mov cl, byte [rsp + 0x192]
mov byte [rbp + 4], al
call fcn.00012b20
mov cl, byte [rsp + 0x194]
mov byte [rbp + 3], al
call fcn.00012b20
mov byte [rbp + 2], al
jmp 0x1fd37
movzx eax, word [r15]
lea rcx, [rbp + 2]
mov r8, rax
movzx eax, al
lea rdx, [rax + rsi + 0x34]
shr r8, 8
call fcn.00015fc0
movzx ebx, byte [r15 + 1]
jmp 0x1f879
mov eax, 0xa6
cmp ecx, eax
jg 0x20ac0
je 0x208dd
sub ecx, 0x9d
je 0x2077f
sub ecx, r9d
je 0x1ff0a
sub ecx, 2
je 0x1fef6
sub ecx, r9d
je 0x1fe59
sub ecx, r9d
je 0x1fdd7
sub ecx, r9d
je 0x1fd93
sub ecx, r9d
je 0x1fd93
cmp ecx, r9d
jne 0x20b06
mov byte [rbp], r8b
mov byte [rbp + 2], r8b
mov dword [r12], r9d
mov al, byte [rbp + 2]
mov byte [r14], al
mov edx, 0x4d525356
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.00016310
add rsp, 0x4a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp word [r13 + 1], r8w
jne 0x1fda5
mov edi, 0x7c1
cmp r15d, edi
jne 0x1fe15
mov byte [rbp], r8b
lea rcx, [rbp + 2]
lea rdx, [rsi + 0x113f]
mov r8, rdi
call fcn.00015fc0
lea rdx, [rbp + 2]
mov r8, rdi
mov rcx, r14
mov dword [r12], edi
call fcn.00015fc0
xor r8d, r8d
cmp word [r13 + 1], r8w
jne 0x1fda5
mov edi, 0x1a1
cmp r15d, edi
jne 0x1fda5
mov byte [rbp], r8b
lea rcx, [rbp + 2]
lea rdx, [rsi + 0x113f]
mov r8, rdi
call fcn.00015fc0
mov dword [r12], edi
mov r8, rdi
lea rdx, [rbp + 2]
mov rcx, r14
call fcn.00015fc0
jmp 0x1fda5
movzx ecx, word [r13 + 1]
cmp ecx, r8d
je 0x1fed0
sub ecx, r9d
je 0x1feb0
sub ecx, r9d
je 0x1fe87
cmp ecx, r9d
jne 0x1feed
mov rax, qword [rsi + 0x1137]
mov qword [rbp + 2], rax
mov dword [r12], 8
jmp 0x1feed
mov rax, qword [rsi + 0x1129]
mov qword [rbp + 2], rax
mov eax, dword [rsi + 0x1131]
mov dword [rbp + 0xa], eax
movzx eax, word [rsi + 0x1135]
mov word [rbp + 0xe], ax
mov dword [r12], 0xe
jmp 0x1feed
lea rcx, [rbp + 2]
lea rdx, [rsi + 0x10fa]
mov r8d, 0x2f
call fcn.00015fc0
mov dword [r12], 0x2f
jmp 0x1feed
movzx eax, word [rsi + 0x10f7]
mov ebx, 3
mov word [rbp + 2], ax
mov al, byte [rsi + 0x10f9]
mov byte [rbp + 4], al
mov dword [r12], ebx
mov r8d, dword [r12]
jmp 0x1fe48
mov byte [rbp + 4], r8b
mov byte [rbp], r8b
mov dword [r12], r9d
mov al, byte [rbp]
jmp 0x1fda2
cmp byte [rsi + 2], r8b
je 0x20b14
mov dword [rsp + 0x14c], r8d
lea r13, [0x0001a548]
mov r15d, 0x30
mov rcx, r13
mov r8, r15
xor edx, edx
call fcn.00015ec0
lea rbx, [0x0001a578]
mov r8, r15
mov rcx, rbx
xor edx, edx
call fcn.00015ec0
movsxd rax, dword [rsi + 0x108c]
mov r8, rax
cmp eax, r15d
jb 0x1ff5c
mov r8, r15
lea rdx, [rsi + 0x1092]
mov rcx, r13
call fcn.00015fc0
lea rcx, [rsp + 0x2e0]
xor edx, edx
mov r8d, 0xc0
call fcn.00015ec0
mov r11d, dword [rsi + 0x108c]
mov r12d, 0x10
cmp r11d, r12d
je 0x2039d
cmp r11d, 0x20
je 0x201dc
cmp r11d, r15d
je 0x1ffea
lea rax, [0x00022070]
xor r15d, r15d
lea rcx, [rsp + 0x2e0]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rax
lea rax, [0x00022090]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0
mov dword [rsp + 0x20], 0x800
call fcn.00011210
jmp 0x204d9
movzx eax, byte [0x0001a567]
movzx ecx, byte [0x0001a566]
movzx edx, byte [0x0001a565]
mov dword [rsp + 0x130], eax
movzx eax, byte [0x0001a559]
movzx r8d, byte [0x0001a564]
movzx r9d, byte [0x0001a563]
movzx r10d, byte [0x0001a562]
movzx r11d, byte [0x0001a561]
movzx ebx, byte [0x0001a560]
movzx esi, byte [0x0001a55f]
movzx ebp, byte [0x0001a55e]
movzx r12d, byte [0x0001a55d]
movzx r13d, byte [0x0001a55c]
movzx r14d, byte [0x0001a55b]
movzx r15d, byte [0x0001a55a]
mov dword [rsp + 0x128], ecx
mov dword [rsp + 0x120], edx
mov dword [rsp + 0x118], r8d
mov dword [rsp + 0x110], r9d
mov dword [rsp + 0x108], r10d
mov dword [rsp + 0x100], r11d
mov dword [rsp + 0xf8], ebx
mov dword [rsp + 0xf0], esi
mov dword [rsp + 0xe8], ebp
mov dword [rsp + 0xe0], r12d
mov dword [rsp + 0xd8], r13d
mov dword [rsp + 0xd0], r14d
mov dword [rsp + 0xc8], r15d
mov dword [rsp + 0xc0], eax
movzx eax, byte [0x0001a558]
mov dword [rsp + 0xb8], eax
movzx eax, byte [0x0001a557]
mov dword [rsp + 0xb0], eax
movzx eax, byte [0x0001a556]
mov dword [rsp + 0xa8], eax
movzx eax, byte [0x0001a555]
mov dword [rsp + 0xa0], eax
movzx eax, byte [0x0001a554]
mov dword [rsp + 0x98], eax
movzx eax, byte [0x0001a553]
mov dword [rsp + 0x90], eax
movzx eax, byte [0x0001a552]
mov dword [rsp + 0x88], eax
movzx eax, byte [0x0001a551]
mov dword [rsp + 0x80], eax
movzx eax, byte [0x0001a550]
mov dword [rsp + 0x78], eax
movzx eax, byte [0x0001a54f]
mov dword [rsp + 0x70], eax
movzx eax, byte [0x0001a54e]
mov dword [rsp + 0x68], eax
movzx eax, byte [0x0001a54d]
mov dword [rsp + 0x60], eax
movzx eax, byte [0x0001a54c]
mov dword [rsp + 0x58], eax
movzx eax, byte [0x0001a54b]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x0001a54a]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x0001a549]
mov dword [rsp + 0x40], eax
movzx eax, byte [0x0001a548]
mov dword [rsp + 0x38], eax
lea rax, [0x00022060]
mov qword [rsp + 0x30], rax
lea rax, [0x00021f50]
lea rcx, [rsp + 0x2e0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0
mov dword [rsp + 0x20], 0x800
call fcn.00011210
jmp 0x204aa
movzx eax, byte [0x0001a567]
movzx ecx, byte [0x0001a566]
movzx edx, byte [0x0001a565]
mov dword [rsp + 0x130], eax
movzx eax, byte [0x0001a559]
movzx r8d, byte [0x0001a564]
movzx r9d, byte [0x0001a563]
movzx r10d, byte [0x0001a562]
movzx r11d, byte [0x0001a561]
movzx ebx, byte [0x0001a560]
movzx esi, byte [0x0001a55f]
movzx ebp, byte [0x0001a55e]
movzx r12d, byte [0x0001a55d]
movzx r13d, byte [0x0001a55c]
movzx r14d, byte [0x0001a55b]
movzx r15d, byte [0x0001a55a]
mov dword [rsp + 0x128], ecx
mov dword [rsp + 0x120], edx
mov dword [rsp + 0x118], r8d
mov dword [rsp + 0x110], r9d
mov dword [rsp + 0x108], r10d
mov dword [rsp + 0x100], r11d
mov dword [rsp + 0xf8], ebx
mov dword [rsp + 0xf0], esi
mov dword [rsp + 0xe8], ebp
mov dword [rsp + 0xe0], r12d
mov dword [rsp + 0xd8], r13d
mov dword [rsp + 0xd0], r14d
mov dword [rsp + 0xc8], r15d
mov dword [rsp + 0xc0], eax
movzx eax, byte [0x0001a558]
mov dword [rsp + 0xb8], eax
movzx eax, byte [0x0001a557]
mov dword [rsp + 0xb0], eax
movzx eax, byte [0x0001a556]
mov dword [rsp + 0xa8], eax
movzx eax, byte [0x0001a555]
mov dword [rsp + 0xa0], eax
movzx eax, byte [0x0001a554]
mov dword [rsp + 0x98], eax
movzx eax, byte [0x0001a553]
mov dword [rsp + 0x90], eax
movzx eax, byte [0x0001a552]
mov dword [rsp + 0x88], eax
movzx eax, byte [0x0001a551]
mov dword [rsp + 0x80], eax
movzx eax, byte [0x0001a550]
mov dword [rsp + 0x78], eax
movzx eax, byte [0x0001a54f]
mov dword [rsp + 0x70], eax
movzx eax, byte [0x0001a54e]
mov dword [rsp + 0x68], eax
movzx eax, byte [0x0001a54d]
mov dword [rsp + 0x60], eax
movzx eax, byte [0x0001a54c]
mov dword [rsp + 0x58], eax
movzx eax, byte [0x0001a54b]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x0001a54a]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x0001a549]
mov dword [rsp + 0x40], eax
movzx eax, byte [0x0001a548]
mov dword [rsp + 0x38], eax
lea rax, [0x00021f40]
jmp 0x201a6
movzx eax, byte [0x0001a557]
movzx ecx, byte [0x0001a556]
movzx edx, byte [0x0001a555]
movzx r8d, byte [0x0001a554]
movzx r9d, byte [0x0001a553]
movzx r10d, byte [0x0001a552]
movzx r11d, byte [0x0001a551]
movzx ebx, byte [0x0001a550]
movzx esi, byte [0x0001a54f]
movzx ebp, byte [0x0001a54e]
movzx r12d, byte [0x0001a54d]
movzx r13d, byte [0x0001a54c]
movzx r14d, byte [0x0001a54b]
movzx r15d, byte [0x0001a54a]
mov dword [rsp + 0xb0], eax
movzx eax, byte [0x0001a549]
mov dword [rsp + 0xa8], ecx
mov dword [rsp + 0xa0], edx
mov dword [rsp + 0x98], r8d
mov dword [rsp + 0x90], r9d
mov dword [rsp + 0x88], r10d
mov dword [rsp + 0x80], r11d
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], ebp
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], eax
movzx eax, byte [0x0001a548]
lea rcx, [rsp + 0x2e0]
xor r9d, r9d
mov dword [rsp + 0x38], eax
lea rax, [0x00021ea0]
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rax, [0x00021eb0]
mov edx, 0xc0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
call fcn.00011210
mov rsi, qword [rsp + 0x160]
mov rbp, qword [rsp + 0x158]
mov r14, qword [rsp + 0x168]
lea rbx, [0x0001a578]
mov r12d, 0x10
lea r13, [0x0001a548]
xor r15d, r15d
mov edx, dword [rsi + 0xa]
lea rax, [rsp + 0x14c]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x2e0]
mov ecx, 0x4001
mov dword [rsp + 0x20], r12d
cmp byte [rsi + 0x1090], r15b
je 0x2050c
mov ecx, 0x3001
call fcn.0001162c
cmp eax, r15d
jge 0x20752
movzx ecx, byte [rsi + 0x1091]
cmp ecx, r15d
je 0x2073d
mov eax, 1
sub ecx, eax
je 0x206da
sub ecx, eax
je 0x20652
sub ecx, 2
je 0x20638
sub ecx, eax
je 0x205e3
cmp ecx, eax
jne 0x20752
lea rcx, [0x000181c8]
mov r9d, r12d
mov r8, rbx
mov rdx, r13
call fcn.000126ec
lea r13, [0x0001a588]
lea rdx, [0x0001a558]
lea rcx, [0x000181b8]
mov r8, r13
mov r9d, r12d
call fcn.00012818
lea r8, [0x0001a598]
lea rdx, [0x0001a568]
lea rcx, [0x000181a8]
mov r9d, r12d
call fcn.00012818
mov r11, rbx
mov rcx, r12
mov r15d, 1
mov al, byte [r11 + 0x10]
xor al, byte [r11 + 0x20]
xor byte [r11], al
add r11, r15
sub rcx, r15
jne 0x205b6
lea rcx, [0x00018198]
mov r9d, r12d
mov r8, rbx
mov rdx, rbx
call fcn.000126ec
jmp 0x2072a
lea rcx, [0x000181c8]
mov r9d, r12d
mov r8, rbx
mov rdx, r13
call fcn.000126ec
lea r13, [0x0001a588]
lea rdx, [0x0001a558]
lea rcx, [0x000181b8]
mov r8, r13
mov r9d, r12d
call fcn.00012818
mov r11, rbx
mov rcx, r12
mov r15d, 1
mov al, byte [r11 + 0x10]
xor byte [r11], al
add r11, r15
sub rcx, r15
jne 0x20624
jmp 0x2072a
lea rcx, [0x00018188]
mov r9d, r12d
mov r8, rbx
mov rdx, r13
call fcn.000126ec
jmp 0x20752
lea rcx, [0x00018198]
mov r9d, r12d
mov r8, rbx
mov rdx, r13
call fcn.00012818
lea r13, [0x0001a588]
lea rdx, [0x0001a558]
lea rcx, [0x000181a8]
mov r8, r13
mov r9d, r12d
call fcn.00012818
lea r8, [0x0001a598]
lea rdx, [0x0001a568]
lea rcx, [0x000181b8]
mov r9d, r12d
call fcn.00012818
mov r11, rbx
mov rcx, r12
mov r15d, 1
mov al, byte [r11 + 0x10]
xor al, byte [r11 + 0x20]
xor byte [r11], al
add r11, r15
sub rcx, r15
jne 0x206b0
lea rcx, [0x000181c8]
mov r9d, r12d
mov r8, rbx
mov rdx, rbx
call fcn.00012818
jmp 0x2072a
lea rcx, [0x00018198]
mov r9d, r12d
mov r8, rbx
mov rdx, r13
call fcn.00012818
lea r13, [0x0001a588]
lea rdx, [0x0001a558]
lea rcx, [0x000181a8]
mov r8, r13
mov r9d, r12d
call fcn.00012818
mov r11, rbx
mov rcx, r12
mov r15d, 1
mov al, byte [r11 + 0x10]
xor byte [r11], al
add r11, r15
sub rcx, r15
jne 0x2071b
xor edx, edx
mov rcx, r13
lea r8d, [rdx + 0x20]
call fcn.00015ec0
xor r15d, r15d
jmp 0x20752
lea rcx, [0x00018188]
mov r9d, r12d
mov r8, rbx
mov rdx, r13
call fcn.00012818
mov byte [rbp], r15b
movsxd r8, dword [rsi + 0x108c]
lea rcx, [rbp + 2]
mov rdx, rbx
call fcn.00015fc0
mov r13, qword [rsp + 0x1d8]
mov ebx, r12d
mov r9d, 1
jmp 0x1fa45
cmp byte [rsi + 2], r8b
je 0x20b14
mov r15d, 7
cmp dword [0x00018304], r15d
jl 0x207ca
lea r9, [rsi + 0x34]
mov dword [rsp + 0x20], 0x38
lea r8, [0x00021e60]
mov rdx, rsi
mov ecx, 0x1002
call fcn.00011bb4
mov ebx, dword [rsp + 0x144]
xor r8d, r8d
mov r15b, r8b
jmp 0x1f97d
movabs rax, 0xfffff78000000014
lea r15, [rsi + 0x6c]
lea rdx, [rsp + 0x170]
mov rbx, qword [rax]
mov rax, qword [r15]
lea rcx, [rbx + rax]
mov qword [rsp + 0x1e0], rcx
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
xor eax, eax
cmp dword [0x00018304], eax
jne 0x2084f
and byte [rsi + 0x34], 0x7f
mov cl, byte [rsi + 0x34]
call fcn.00012b50
mov cl, byte [rsi + 0x35]
movzx r8d, al
mov word [rsp + 0x17a], r8w
call fcn.00012b50
mov cl, byte [rsi + 0x36]
movzx r8d, al
mov word [rsp + 0x178], r8w
call fcn.00012b50
movzx r8d, al
mov word [rsp + 0x176], r8w
jmp 0x208a2
mov cl, byte [rsi + 0x37]
call fcn.00012b50
mov cl, byte [rsi + 0x38]
movzx r8d, al
mov word [rsp + 0x174], r8w
call fcn.00012b50
mov cl, byte [rsi + 0x3a]
movzx r8d, al
mov word [rsp + 0x172], r8w
call fcn.00012b50
movzx r8d, al
mov eax, 0x7d0
cmp r8d, 0x5a
jl 0x20895
mov eax, 0x76c
add r8w, ax
mov word [rsp + 0x170], r8w
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x170]
call qword [sym.imp.ntoskrnl.exe_RtlTimeFieldsToTime]
mov r11, qword [rsp + 0x1d0]
mov dword [rsp + 0x20], 8
sub r11, rbx
mov r9, r15
lea r8, [0x00021e80]
mov qword [r15], r11
jmp 0x207ab
lea rcx, [rsi + 0x83b1]
xor edx, edx
mov r8d, 0x1000
lea ebx, [r15 - 1]
call fcn.00015ec0
movzx edx, word [rsi + 0x10da]
mov r13d, 0xf4ff
cmp edx, r13d
je 0x209a9
cmp edx, 0xf5ff
je 0x2097f
xor eax, eax
mov r8d, 0xf8
lea r14d, [rax + 1]
movzx r9d, ax
movzx ecx, ax
movzx eax, cx
imul rax, rax, 0x4c
cmp dx, word [rax + rsi + 0x1904]
je 0x20943
add cx, r14w
cmp cx, r8w
jb 0x20926
jmp 0x20947
mov r9w, cx
movzx ecx, r9w
imul rcx, rcx, 0x4c
movzx eax, word [rcx + rsi + 0x1908]
lea rdx, [rcx + rsi + 0x1910]
lea rcx, [rsi + 0x83b1]
cmp ebx, eax
cmovb eax, ebx
mov r8d, eax
call fcn.00015fc0
lea eax, [rbx + 1]
mov dword [rsp + 0x14c], eax
jmp 0x209d7
mov eax, dword [rsi + 0x10e6]
lea rcx, [rsi + 0x83b1]
mov r8d, ebx
lea rdx, [rax + rsi + 0x7264]
call fcn.00015fc0
mov dword [rsp + 0x14c], 0x801
jmp 0x209d1
mov eax, dword [rsi + 0x10e6]
lea rcx, [rsi + 0x83b1]
mov r8d, ebx
lea rdx, [rax + rsi + 0x62a4]
call fcn.00015fc0
mov dword [rsp + 0x14c], 0xfc1
mov r14d, 1
lea rcx, [rsi + 0x83b1]
mov ebx, 3
mov al, byte [rcx - 0x72c3]
xor byte [rcx], al
add rcx, r14
sub rbx, r14
jne 0x209e3
add dword [rsi + 0x10f1], r14d
mov ecx, dword [rsi + 0x10f1]
mov r14, qword [rsp + 0x168]
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rsi + 0x10ef], cl
movzx ecx, word [rsi + 0x10da]
mov byte [rsi + 0x10ee], al
mov al, byte [rsi + 0x10f1]
mov byte [rsi + 0x10f0], al
cmp ecx, r13d
je 0x20a6a
mov eax, 0xf5ff
cmp ecx, eax
je 0x20a6a
lea r13d, [r15 - 1]
xor eax, eax
lea rcx, [rsi + 0x7ab4]
lea r8, [rsi + 0x83b1]
lea rdx, [rsi + 0x83b1]
mov r9d, r13d
cmp dword [rsi + 0x10e2], eax
je 0x20a86
call fcn.00012948
jmp 0x20a8b
lea r13d, [r15 - 1]
lea rcx, [rsi + 0x7ab4]
lea r8, [rsi + 0x83b1]
mov r9d, r13d
lea rdx, [rsi + 0x83b1]
call fcn.00012818
lea rdx, [rsi + 0x83b1]
lea rcx, [rbp + 2]
mov r8d, r13d
call fcn.00015fc0
mov eax, dword [rsp + 0x14c]
cmp eax, r15d
cmovb r15d, eax
xor eax, eax
mov dword [r12], r15d
mov dword [rsi + 0x10e6], eax
mov byte [rbp], al
jmp 0x1feed
sub ecx, 0xa7
je 0x1fd93
sub ecx, r9d
je 0x20e4c
sub ecx, r9d
je 0x20d43
sub ecx, r9d
je 0x20d3a
sub ecx, r9d
je 0x1fef6
sub ecx, r9d
je 0x20c12
mov ebx, 3
cmp ecx, ebx
je 0x20bd0
cmp byte [rsi + 2], r8b
je 0x20b10
mov byte [rbp], r8b
mov dword [r12], r8d
mov r15b, r8b
mov ebx, dword [rsp + 0x144]
xor byte [rsi + 3], dil
cmp byte [rbp], 0x1f
ja 0x20b4f
xor edi, edi
add byte [rsi + 3], r9b
mov al, byte [rsi + 3]
mov r8, rbp
mov byte [rbp + 1], al
mov cl, byte [r13]
mov dl, 2
and cl, 0x7f
call fcn.00012a88
mov r9d, 1
cmp eax, edi
je 0x20b2a
mov dil, byte [rbp]
mov r13b, byte [rbp + 1]
mov r8, rsi
mov edx, 2
mov rcx, rbp
call fcn.0001d604
xor eax, eax
cmp r15b, al
je 0x20b7b
lea rcx, [rbp + 2]
mov edx, ebx
call fcn.0001d604
xor eax, eax
cmp dil, al
jne 0x20b95
mov eax, 0xff
and word [rsi + 6], ax
movzx eax, r13b
shl ax, 8
or word [rsi + 6], ax
mov ecx, dword [r12]
mov eax, ebx
mov rdx, rbp
add rax, 2
cmp rax, rcx
cmovb rcx, rax
mov dword [r12], ecx
mov r8d, ecx
jmp 0x1fe4c
mov r15b, byte [rsp + 0x140]
jmp 0x20b17
mov r15b, r8b
mov r9d, 1
jmp 0x20b17
mov rax, qword [rsi + 0x93b9]
mov qword [rbp + 2], rax
mov rax, qword [rsi + 0x93c1]
mov qword [rbp + 0xa], rax
mov eax, dword [rsi + 0x93c9]
mov dword [rbp + 0x12], eax
mov dword [r12], 0x14
mov rax, qword [rbp + 2]
mov qword [r14], rax
mov rax, qword [rbp + 0xa]
mov qword [r14 + 8], rax
mov eax, dword [rbp + 0x12]
mov dword [r14 + 0x10], eax
jmp 0x1fda5
xor edx, edx
lea rcx, [rsp + 0x1bc]
lea r8d, [rdx + 0x14]
call fcn.00015ec0
xor eax, eax
xor ecx, ecx
mov dword [rsp + 0x1a4], eax
mov dword [rsp + 0x1a0], ecx
mov dword [rsp + 0x154], eax
mov dword [rsp + 0x150], ecx
movabs rax, 0xfffff78000000014
lea rdx, [rsp + 0x150]
mov rax, qword [rax]
lea rcx, [rsp + 0x1a0]
mov qword [rsp + 0x1a0], rax
call qword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
mov r11, qword [rsi + 0x6c]
add qword [rsp + 0x150], r11
lea rdx, [rsp + 0x1a8]
lea rcx, [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
movsx r11d, word [rsp + 0x1a8]
mov eax, 0x76c
sub r11d, eax
movsx eax, word [rsp + 0x1aa]
lea rcx, [rsp + 0x1b8]
dec eax
mov dword [rsp + 0x1c0], r11d
mov dword [rsp + 0x1bc], eax
movsx eax, word [rsp + 0x1ac]
mov dword [rsp + 0x1b8], eax
movsx eax, word [rsp + 0x1ae]
mov dword [rsp + 0x1c4], eax
movsx eax, word [rsp + 0x1b0]
mov dword [rsp + 0x1c8], eax
movsx eax, word [rsp + 0x1b2]
mov dword [rsp + 0x1cc], eax
call fcn.00012b68
mov byte [rbp + 5], al
mov ecx, eax
sar ecx, 0x18
mov byte [rbp + 2], cl
mov ecx, eax
sar ecx, 0x10
mov byte [rbp + 3], cl
mov ecx, eax
sar ecx, 8
mov byte [rbp + 4], cl
mov dword [r12], 5
mov eax, dword [rbp + 2]
mov dword [r14], eax
mov al, byte [rbp + 6]
mov byte [r14 + 4], al
jmp 0x1fda5
mov byte [rbp + 2], r8b
jmp 0x1fefa
xor edx, edx
lea rcx, [rsp + 0x3a0]
lea r8d, [rdx + 0x40]
call fcn.00015ec0
mov r11b, byte [rsi + 0x10f5]
cmp r11b, 2
jbe 0x20dfb
mov ebx, 3
cmp r11b, bl
je 0x20d87
jbe 0x1fc29
cmp r11b, 5
jbe 0x20dd2
cmp r11b, 0xb
ja 0x1fc29
lea rcx, [rsp + 0x3a0]
lea rdx, [0x0001a578]
mov r8d, 0x20
call fcn.00015fc0
lea rdx, [rsp + 0x3a0]
mov edi, 0x21
lea rcx, [rbp + 2]
mov r8, rdi
call fcn.00015fc0
lea rdx, [rbp + 2]
mov r8, rdi
mov rcx, r14
mov dword [r12], edi
call fcn.00015fc0
jmp 0x1fc29
lea rcx, [rsp + 0x3a0]
lea rdx, [0x0001a578]
mov r8d, 0x30
call fcn.00015fc0
lea rdx, [rsp + 0x3a0]
mov edi, 0x31
jmp 0x20dae
movdqu xmm0, xmmword [0x0001a578]
lea rcx, [rsp + 0x3a0]
movdqu xmmword [rsp + 0x3a0], xmm0
mov rax, qword [rcx]
mov qword [rbp + 2], rax
mov rax, qword [rcx + 8]
mov qword [rbp + 0xa], rax
mov al, byte [rcx + 0x10]
mov byte [rbp + 0x12], al
mov dword [r12], 0x11
mov rax, qword [rbp + 2]
mov qword [r14], rax
mov rax, qword [rbp + 0xa]
mov qword [r14 + 8], rax
mov al, byte [rbp + 0x12]
mov byte [r14 + 0x10], al
jmp 0x1fc29
lea rcx, [rsi + 0x83b1]
xor edx, edx
mov r8d, 0x1000
lea edi, [r15 - 0x19]
call fcn.00015ec0
movzx r11d, word [rsi + 0x10dc]
mov rax, qword [rsi + r11*8 + 0x113f]
movzx edx, word [rsi + 0x10da]
mov qword [rsp + 0x1e8], rax
mov eax, 0xf4ff
cmp edx, eax
je 0x20f06
cmp edx, 0xf5ff
je 0x20ef6
xor eax, eax
mov r8d, 0xf8
lea r10d, [rax + 1]
movzx r9d, ax
movzx ecx, ax
movzx eax, cx
imul rax, rax, 0x4c
cmp dx, word [rax + rsi + 0x1904]
je 0x20ec4
add cx, r10w
cmp cx, r8w
jb 0x20ea7
jmp 0x20ec8
mov r9w, cx
movzx ecx, r9w
imul rcx, rcx, 0x4c
movzx eax, word [rcx + rsi + 0x1908]
lea rdx, [rcx + rsi + 0x1910]
lea rcx, [rsi + 0x83b1]
cmp edi, eax
cmovb eax, edi
mov r8d, eax
call fcn.00015fc0
jmp 0x20f2d
mov eax, dword [rsi + 0x10e6]
lea rdx, [rax + rsi + 0x7264]
jmp 0x20f14
mov eax, dword [rsi + 0x10e6]
lea rdx, [rax + rsi + 0x62a4]
lea rcx, [rsi + 0x83b1]
mov r8d, edi
call fcn.00015fc0
mov al, byte [rsp + 0x1ec]
mov byte [rbp + 3], al
mov r11b, byte [rsp + 0x1ed]
lea rcx, [rbp + 0xa]
lea rdx, [rsi + 0x83b1]
mov r8d, edi
mov byte [rbp + 4], r11b
call fcn.00015fc0
mov byte [r15 + rbp + 2], bl
lea rdx, [rbp + 2]
mov r8, r15
mov rcx, r14
mov dword [r12], r15d
call fcn.00015fc0
xor ebx, ebx
mov edx, 0x4d525356
mov rcx, rbp
mov byte [rbp], bl
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [rsi + 0x10e6], ebx
jmp 0x1fdb3