Function at 0x140002f00
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Resolve function by parsing pe exports
Spawn thread to rwx shellcode

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x8a8
mov rax, qword [0x140010008]
xor rax, rsp
mov qword [rsp + 0x890], rax
mov dword [rsp + 0x350], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x8c8]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14000309a
lea rax, [rsp + 0x7d0]
mov qword [rsp + 0x360], rax
lea rax, [rsp + 0xd2]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x3b8]
lea rcx, str.__BTZ_
mov rdi, rax
mov rsi, rcx
mov ecx, 0x15
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0x14
movsx eax, byte [rsp + rax + 0x3b8]
test eax, eax
je 0x140002fdf
mov dword [rsp + 0x140], 1
jmp 0x140002fea
mov dword [rsp + 0x140], 0
movzx eax, byte [rsp + 0x140]
test eax, eax
je 0x140003064
mov dword [rsp + 0xa0], 0
jmp 0x140003013
mov eax, dword [rsp + 0xa0]
inc eax
mov dword [rsp + 0xa0], eax
cmp dword [rsp + 0xa0], 0x15
jge 0x140003064
movsxd rax, dword [rsp + 0xa0]
movsx eax, byte [rsp + rax + 0x3b8]
mov dword [rsp + 0x1e8], eax
mov eax, dword [rsp + 0xa0]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1e8]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0xa0]
mov byte [rsp + rcx + 0x3b8], al
jmp 0x140003003
lea rax, [rsp + 0x3b8]
mov rdx, rax
mov rcx, qword [rsp + 0x360]
call fcn.140001270
mov qword [rsp + 0x368], rax
xor edx, edx
mov rcx, qword [rsp + 0x368]
call fcn.140002bb0
xor eax, eax
jmp 0x140005011
mov rax, qword [rsp + 0x8c8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x8c8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
add rax, 0x18
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0xa8]
add rax, 4
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x1f0]
mov eax, dword [rax + 0x38]
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x140003229
lea rax, [rsp + 0x5f0]
mov qword [rsp + 0x208], rax
lea rax, [rsp + 0xc0]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x400]
lea rcx, [0x14000c848]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x17
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0x16
movsx eax, byte [rsp + rax + 0x400]
test eax, eax
je 0x140003183
mov dword [rsp + 0x144], 1
jmp 0x14000318e
mov dword [rsp + 0x144], 0
movzx eax, byte [rsp + 0x144]
test eax, eax
je 0x1400031f3
mov dword [rsp + 0x54], 0
jmp 0x1400031ae
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0x17
jge 0x1400031f3
movsxd rax, dword [rsp + 0x54]
movsx eax, byte [rsp + rax + 0x400]
mov dword [rsp + 0x1d8], eax
mov eax, dword [rsp + 0x54]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1d8]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x54]
mov byte [rsp + rcx + 0x400], al
jmp 0x1400031a4
lea rax, [rsp + 0x400]
mov rdx, rax
mov rcx, qword [rsp + 0x208]
call fcn.140001270
mov qword [rsp + 0x210], rax
mov dl, 1
mov rcx, qword [rsp + 0x210]
call fcn.140002bb0
xor eax, eax
jmp 0x140005011
mov dword [rsp + 0x888], 0
mov rax, qword [rsp + 0x1f0]
mov eax, dword [rax + 0x38]
lea rcx, [rsp + 0x888]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
mov r8d, eax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rsp + 0x800]
mov rdi, rax
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x800], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x808], rax
mov rax, qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov qword [rsp + 0x810], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x818], rax
mov eax, dword [rsp + 0x8f8]
mov dword [rsp + 0x828], eax
mov rax, qword [rsp + 0x900]
mov qword [rsp + 0x830], rax
mov eax, dword [rsp + 0x8f0]
mov dword [rsp + 0x838], eax
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, qword [rsp + 0x8c8]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140003438
lea rax, [rsp + 0x5d0]
mov qword [rsp + 0x218], rax
lea rax, [rsp + 0xc1]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x370]
lea rcx, [0x14000c808]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x14
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0x13
movsx eax, byte [rsp + rax + 0x370]
test eax, eax
je 0x140003376
mov dword [rsp + 0x148], 1
jmp 0x140003381
mov dword [rsp + 0x148], 0
movzx eax, byte [rsp + 0x148]
test eax, eax
je 0x1400033e6
mov dword [rsp + 0x58], 0
jmp 0x1400033a1
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0x14
jge 0x1400033e6
movsxd rax, dword [rsp + 0x58]
movsx eax, byte [rsp + rax + 0x370]
mov dword [rsp + 0x1ec], eax
mov eax, dword [rsp + 0x58]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1ec]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x58]
mov byte [rsp + rcx + 0x370], al
jmp 0x140003397
lea rax, [rsp + 0x370]
mov rdx, rax
mov rcx, qword [rsp + 0x218]
call fcn.140001270
mov qword [rsp + 0x220], rax
mov dl, 1
mov rcx, qword [rsp + 0x220]
call fcn.140002bb0
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x140005011
mov rax, qword [rsp + 0xa8]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0xa8]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0xe4], 0
jmp 0x140003481
mov eax, dword [rsp + 0xe4]
inc eax
mov dword [rsp + 0xe4], eax
mov rax, qword [rsp + 0x40]
add rax, 0x28
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x158]
movzx eax, word [rax + 2]
cmp dword [rsp + 0xe4], eax
jae 0x140003628
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x10], 0
je 0x140003623
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x10]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 0x14]
mov rdx, qword [rsp + 0x8c8]
add rdx, rcx
mov rcx, rdx
mov rdx, qword [rsp + 0x40]
mov edx, dword [rdx + 0xc]
mov rdi, qword [rsp + 0x48]
add rdi, rdx
mov rdx, rdi
mov qword [rsp + 0x20], 0
mov r9d, eax
mov r8, rcx
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140003623
lea rax, [rsp + 0x5b0]
mov qword [rsp + 0x228], rax
lea rax, [rsp + 0xc2]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x388]
lea rcx, [0x14000c930]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x14
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0x13
movsx eax, byte [rsp + rax + 0x388]
test eax, eax
je 0x140003561
mov dword [rsp + 0xe8], 1
jmp 0x14000356c
mov dword [rsp + 0xe8], 0
movzx eax, byte [rsp + 0xe8]
test eax, eax
je 0x1400035d1
mov dword [rsp + 0x50], 0
jmp 0x14000358c
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0x14
jge 0x1400035d1
movsxd rax, dword [rsp + 0x50]
movsx eax, byte [rsp + rax + 0x388]
mov dword [rsp + 0x1a0], eax
mov eax, dword [rsp + 0x50]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1a0]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x50]
mov byte [rsp + rcx + 0x388], al
jmp 0x140003582
lea rax, [rsp + 0x388]
mov rdx, rax
mov rcx, qword [rsp + 0x228]
call fcn.140001270
mov qword [rsp + 0x230], rax
mov dl, 1
mov rcx, qword [rsp + 0x230]
call fcn.140002bb0
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x140005011
jmp 0x140003463
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x40
xor edx, edx
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0xb0], rax
cmp qword [rsp + 0xb0], 0
jne 0x14000379c
lea rax, [rsp + 0x610]
mov qword [rsp + 0x238], rax
lea rax, [rsp + 0xc3]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x4a8]
lea rcx, [0x14000c980]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1d
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0x1c
movsx eax, byte [rsp + rax + 0x4a8]
test eax, eax
je 0x1400036c5
mov dword [rsp + 0xec], 1
jmp 0x1400036d0
mov dword [rsp + 0xec], 0
movzx eax, byte [rsp + 0xec]
test eax, eax
je 0x14000374a
mov dword [rsp + 0x9c], 0
jmp 0x1400036f9
mov eax, dword [rsp + 0x9c]
inc eax
mov dword [rsp + 0x9c], eax
cmp dword [rsp + 0x9c], 0x1d
jge 0x14000374a
movsxd rax, dword [rsp + 0x9c]
movsx eax, byte [rsp + rax + 0x4a8]
mov dword [rsp + 0x1a4], eax
mov eax, dword [rsp + 0x9c]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1a4]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x9c]
mov byte [rsp + rcx + 0x4a8], al
jmp 0x1400036e9
lea rax, [rsp + 0x4a8]
mov rdx, rax
mov rcx, qword [rsp + 0x238]
call fcn.140001270
mov qword [rsp + 0x240], rax
mov dl, 1
mov rcx, qword [rsp + 0x240]
call fcn.140002bb0
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x140005011
mov qword [rsp + 0x20], 0
mov r9d, 0x40
lea r8, [rsp + 0x800]
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140003914
lea rax, [rsp + 0x630]
mov qword [rsp + 0x248], rax
lea rax, [rsp + 0xc4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x448]
lea rcx, [0x14000c8e0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1a
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0x19
movsx eax, byte [rsp + rax + 0x448]
test eax, eax
je 0x140003833
mov dword [rsp + 0xf0], 1
jmp 0x14000383e
mov dword [rsp + 0xf0], 0
movzx eax, byte [rsp + 0xf0]
test eax, eax
je 0x1400038a3
mov dword [rsp + 0x60], 0
jmp 0x14000385e
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0x1a
jge 0x1400038a3
movsxd rax, dword [rsp + 0x60]
movsx eax, byte [rsp + rax + 0x448]
mov dword [rsp + 0x1a8], eax
mov eax, dword [rsp + 0x60]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1a8]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x60]
mov byte [rsp + rcx + 0x448], al
jmp 0x140003854
lea rax, [rsp + 0x448]
mov rdx, rax
mov rcx, qword [rsp + 0x248]
call fcn.140001270
mov qword [rsp + 0x250], rax
mov dl, 1
mov rcx, qword [rsp + 0x250]
call fcn.140002bb0
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x140005011
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x2000
xor edx, edx
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
jne 0x140003a92
lea rax, [rsp + 0x650]
mov qword [rsp + 0x258], rax
lea rax, [rsp + 0xd8]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x528]
lea rcx, [0x14000c9c0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x26
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0x25
movsx eax, byte [rsp + rax + 0x528]
test eax, eax
je 0x1400039b1
mov dword [rsp + 0xf4], 1
jmp 0x1400039bc
mov dword [rsp + 0xf4], 0
movzx eax, byte [rsp + 0xf4]
test eax, eax
je 0x140003a21
mov dword [rsp + 0x64], 0
jmp 0x1400039dc
mov eax, dword [rsp + 0x64]
inc eax
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0x26
jge 0x140003a21
movsxd rax, dword [rsp + 0x64]
movsx eax, byte [rsp + rax + 0x528]
mov dword [rsp + 0x1ac], eax
mov eax, dword [rsp + 0x64]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1ac]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x64]
mov byte [rsp + rcx + 0x528], al
jmp 0x1400039d2
lea rax, [rsp + 0x528]
mov rdx, rax
mov rcx, qword [rsp + 0x258]
call fcn.140001270
mov qword [rsp + 0x260], rax
mov dl, 1
mov rcx, qword [rsp + 0x260]
call fcn.140002bb0
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x140005011
mov qword [rsp + 0x20], 0
mov r9d, 0x2000
lea r8, [0x140005030]
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140003c28
lea rax, [rsp + 0x670]
mov qword [rsp + 0x268], rax
lea rax, [rsp + 0xc5]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x418]
lea rcx, [0x14000c638]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x17
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0x16
movsx eax, byte [rsp + rax + 0x418]
test eax, eax
je 0x140003b28
mov dword [rsp + 0xf8], 1
jmp 0x140003b33
mov dword [rsp + 0xf8], 0
movzx eax, byte [rsp + 0xf8]
test eax, eax
je 0x140003b98
mov dword [rsp + 0x6c], 0
jmp 0x140003b53
mov eax, dword [rsp + 0x6c]
inc eax
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0x17
jge 0x140003b98
movsxd rax, dword [rsp + 0x6c]
movsx eax, byte [rsp + rax + 0x418]
mov dword [rsp + 0x1dc], eax
mov eax, dword [rsp + 0x6c]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1dc]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x6c]
mov byte [rsp + rcx + 0x418], al
jmp 0x140003b49
lea rax, [rsp + 0x418]
mov rdx, rax
mov rcx, qword [rsp + 0x268]
call fcn.140001270
mov qword [rsp + 0x270], rax
mov dl, 1
mov rcx, qword [rsp + 0x270]
call fcn.140002bb0
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x140005011
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xb8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x200], rax
cmp qword [rsp + 0x200], 0
jne 0x140003dda
lea rax, [rsp + 0x690]
mov qword [rsp + 0x358], rax
lea rax, [rsp + 0xc6]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x468]
lea rcx, [0x14000c6a8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1c
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0x1b
movsx eax, byte [rsp + rax + 0x468]
test eax, eax
je 0x140003cda
mov dword [rsp + 0xfc], 1
jmp 0x140003ce5
mov dword [rsp + 0xfc], 0
movzx eax, byte [rsp + 0xfc]
test eax, eax
je 0x140003d4a
mov dword [rsp + 0x70], 0
jmp 0x140003d05
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0x1c
jge 0x140003d4a
movsxd rax, dword [rsp + 0x70]
movsx eax, byte [rsp + rax + 0x468]
mov dword [rsp + 0x1b0], eax
mov eax, dword [rsp + 0x70]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1b0]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x70]
mov byte [rsp + rcx + 0x468], al
jmp 0x140003cfb
lea rax, [rsp + 0x468]
mov rdx, rax
mov rcx, qword [rsp + 0x358]
call fcn.140001270
mov qword [rsp + 0x278], rax
mov dl, 1
mov rcx, qword [rsp + 0x278]
call fcn.140002bb0
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x140005011
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x150], 0
cmp qword [rsp + 0x150], 0
jne 0x1400042c7
mov dword [rsp + 0x7f0], 0
lea rdx, [rsp + 0x7f0]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x7f0], 0x103
je 0x140003fda
lea rax, [rsp + 0x6b0]
mov qword [rsp + 0x2b0], rax
lea rax, [rsp + 0xc7]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
mov edx, dword [rsp + 0x7f0]
lea rcx, [rsp + 0x570]
call fcn.140002b90
mov qword [rsp + 0x280], rax
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0x288], rax
mov rax, qword [rsp + 0x288]
mov qword [rsp + 0x2a0], rax
lea rax, [rsp + 0x4c8]
lea rcx, str.BA_VSDK
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1d
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0x1c
movsx eax, byte [rsp + rax + 0x4c8]
test eax, eax
je 0x140003ed3
mov dword [rsp + 0x100], 1
jmp 0x140003ede
mov dword [rsp + 0x100], 0
movzx eax, byte [rsp + 0x100]
test eax, eax
je 0x140003f43
mov dword [rsp + 0x74], 0
jmp 0x140003efe
mov eax, dword [rsp + 0x74]
inc eax
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0x1d
jge 0x140003f43
movsxd rax, dword [rsp + 0x74]
movsx eax, byte [rsp + rax + 0x4c8]
mov dword [rsp + 0x1b4], eax
mov eax, dword [rsp + 0x74]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1b4]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x74]
mov byte [rsp + rcx + 0x4c8], al
jmp 0x140003ef4
lea rax, [rsp + 0x4c8]
mov rdx, rax
lea rcx, [rsp + 0x550]
call fcn.140001270
mov qword [rsp + 0x290], rax
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x298], rax
mov rax, qword [rsp + 0x298]
mov qword [rsp + 0x2a8], rax
mov r8, qword [rsp + 0x2a0]
mov rdx, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2b0]
call fcn.1400017d0
mov qword [rsp + 0x2b8], rax
xor edx, edx
mov rcx, qword [rsp + 0x2b8]
call fcn.140002bb0
nop
lea rcx, [rsp + 0x550]
call fcn.1400011e0
nop
lea rcx, [rsp + 0x570]
call fcn.1400011e0
xor eax, eax
jmp 0x140005011
lea rax, [rsp + 0x840]
mov rdi, rax
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
mov qword [rsp + 0x20], 0
mov r9d, 0x40
lea r8, [rsp + 0x840]
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x860]
mov qword [rsp + 0x150], rax
cmp qword [rsp + 0x150], 0x404040
jne 0x1400041a4
lea rax, [rsp + 0x6d0]
mov qword [rsp + 0x2c0], rax
lea rax, [rsp + 0xc8]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x430]
lea rcx, [0x14000c620]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x17
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0x16
movsx eax, byte [rsp + rax + 0x430]
test eax, eax
je 0x14000409f
mov dword [rsp + 0x104], 1
jmp 0x1400040aa
mov dword [rsp + 0x104], 0
movzx eax, byte [rsp + 0x104]
test eax, eax
je 0x14000410f
mov dword [rsp + 0x68], 0
jmp 0x1400040ca
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0x17
jge 0x14000410f
movsxd rax, dword [rsp + 0x68]
movsx eax, byte [rsp + rax + 0x430]
mov dword [rsp + 0x1b8], eax
mov eax, dword [rsp + 0x68]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1b8]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x68]
mov byte [rsp + rcx + 0x430], al
jmp 0x1400040c0
lea rax, [rsp + 0x430]
mov rdx, rax
mov rcx, qword [rsp + 0x2c0]
call fcn.140001270
mov qword [rsp + 0x2c8], rax
xor edx, edx
mov rcx, qword [rsp + 0x2c8]
call fcn.140002bb0
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x140005011
cmp qword [rsp + 0x150], 0x505050
jne 0x1400042b7
lea rax, [rsp + 0x6f0]
mov qword [rsp + 0x2d0], rax
lea rax, [rsp + 0xc9]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x170]
lea rcx, [0x14000c668]
mov rdi, rax
mov rsi, rcx
mov ecx, 9
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 8
movsx eax, byte [rsp + rax + 0x170]
test eax, eax
je 0x140004218
mov dword [rsp + 0x108], 1
jmp 0x140004223
mov dword [rsp + 0x108], 0
movzx eax, byte [rsp + 0x108]
test eax, eax
je 0x140004288
mov dword [rsp + 0x78], 0
jmp 0x140004243
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 9
jge 0x140004288
movsxd rax, dword [rsp + 0x78]
movsx eax, byte [rsp + rax + 0x170]
mov dword [rsp + 0x1bc], eax
mov eax, dword [rsp + 0x78]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1bc]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x78]
mov byte [rsp + rcx + 0x170], al
jmp 0x140004239
lea rax, [rsp + 0x170]
mov rdx, rax
mov rcx, qword [rsp + 0x2d0]
call fcn.140001270
mov qword [rsp + 0x2d8], rax
xor edx, edx
mov rcx, qword [rsp + 0x2d8]
call fcn.140002bb0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003df4
mov ecx, 0x1400000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x138], rax
cmp qword [rsp + 0x138], 0
jne 0x1400043f1
lea rax, [rsp + 0x710]
mov qword [rsp + 0x2e0], rax
lea rax, [rsp + 0xca]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x3e8]
lea rcx, [0x14000c878]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x16
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0x15
movsx eax, byte [rsp + rax + 0x3e8]
test eax, eax
je 0x14000434b
mov dword [rsp + 0x10c], 1
jmp 0x140004356
mov dword [rsp + 0x10c], 0
movzx eax, byte [rsp + 0x10c]
test eax, eax
je 0x1400043bb
mov dword [rsp + 0x7c], 0
jmp 0x140004376
mov eax, dword [rsp + 0x7c]
inc eax
mov dword [rsp + 0x7c], eax
cmp dword [rsp + 0x7c], 0x16
jge 0x1400043bb
movsxd rax, dword [rsp + 0x7c]
movsx eax, byte [rsp + rax + 0x3e8]
mov dword [rsp + 0x1c0], eax
mov eax, dword [rsp + 0x7c]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1c0]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x7c]
mov byte [rsp + rcx + 0x3e8], al
jmp 0x14000436c
lea rax, [rsp + 0x3e8]
mov rdx, rax
mov rcx, qword [rsp + 0x2e0]
call fcn.140001270
mov qword [rsp + 0x2e8], rax
xor edx, edx
mov rcx, qword [rsp + 0x2e8]
call fcn.140002bb0
xor eax, eax
jmp 0x140005011
mov rdi, qword [rsp + 0x138]
xor eax, eax
mov ecx, 0x1400000
rep stosb byte [rdi], al
cmp dword [rsp + 0x8d8], 0
je 0x140004558
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, qword [rsp + 0x138]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140004558
lea rax, [rsp + 0x730]
mov qword [rsp + 0x2f0], rax
lea rax, [rsp + 0xcb]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x3a0]
lea rcx, [0x14000c678]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x14
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0x13
movsx eax, byte [rsp + rax + 0x3a0]
test eax, eax
je 0x1400044a4
mov dword [rsp + 0x110], 1
jmp 0x1400044af
mov dword [rsp + 0x110], 0
movzx eax, byte [rsp + 0x110]
test eax, eax
je 0x140004529
mov dword [rsp + 0x80], 0
jmp 0x1400044d8
mov eax, dword [rsp + 0x80]
inc eax
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0x14
jge 0x140004529
movsxd rax, dword [rsp + 0x80]
movsx eax, byte [rsp + rax + 0x3a0]
mov dword [rsp + 0x1c4], eax
mov eax, dword [rsp + 0x80]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1c4]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x80]
mov byte [rsp + rcx + 0x3a0], al
jmp 0x1400044c8
lea rax, [rsp + 0x3a0]
mov rdx, rax
mov rcx, qword [rsp + 0x2f0]
call fcn.140001270
mov qword [rsp + 0x2f8], rax
xor edx, edx
mov rcx, qword [rsp + 0x2f8]
call fcn.140002bb0
cmp dword [rsp + 0x8e0], 0
je 0x140004aee
mov rax, qword [rsp + 0xa8]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0xa8]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0xdc], 0
jmp 0x1400045af
mov eax, dword [rsp + 0xdc]
inc eax
mov dword [rsp + 0xdc], eax
mov rax, qword [rsp + 0x40]
add rax, 0x28
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x158]
movzx eax, word [rax + 2]
cmp dword [rsp + 0xdc], eax
je 0x140004aee
mov rax, qword [rsp + 0x40]
cmp dword [rax + 8], 0
je 0x140004ae9
cmp dword [rsp + 0x8f0], 0
je 0x1400045f1
mov dword [rsp + 0x11c], 0
jmp 0x140004727
lea rax, [rsp + 0xcc]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x190]
lea rcx, [0x14000c698]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xb
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0xa
movsx eax, byte [rsp + rax + 0x190]
test eax, eax
je 0x140004643
mov dword [rsp + 0x114], 1
jmp 0x14000464e
mov dword [rsp + 0x114], 0
movzx eax, byte [rsp + 0x114]
test eax, eax
je 0x1400046c8
mov dword [rsp + 0x84], 0
jmp 0x140004677
mov eax, dword [rsp + 0x84]
inc eax
mov dword [rsp + 0x84], eax
cmp dword [rsp + 0x84], 0xb
jge 0x1400046c8
movsxd rax, dword [rsp + 0x84]
movsx eax, byte [rsp + rax + 0x190]
mov dword [rsp + 0x1c8], eax
mov eax, dword [rsp + 0x84]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1c8]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x84]
mov byte [rsp + rcx + 0x190], al
jmp 0x140004667
lea rax, [rsp + 0x190]
mov rax, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x190]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x1400046f8
inc rax
test dl, dl
jne 0x1400046e5
xor eax, eax
jmp 0x1400046fd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14000470e
mov dword [rsp + 0x118], 1
jmp 0x140004719
mov dword [rsp + 0x118], 0
mov eax, dword [rsp + 0x118]
mov dword [rsp + 0x11c], eax
cmp dword [rsp + 0x11c], 0
jne 0x140004948
lea rax, [rsp + 0xcd]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x160]
lea rcx, [0x14000c970]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 9
movsx eax, byte [rsp + rax + 0x160]
test eax, eax
je 0x140004787
mov dword [rsp + 0x120], 1
jmp 0x140004792
mov dword [rsp + 0x120], 0
movzx eax, byte [rsp + 0x120]
test eax, eax
je 0x14000480c
mov dword [rsp + 0x88], 0
jmp 0x1400047bb
mov eax, dword [rsp + 0x88]
inc eax
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0xa
jge 0x14000480c
movsxd rax, dword [rsp + 0x88]
movsx eax, byte [rsp + rax + 0x160]
mov dword [rsp + 0x1cc], eax
mov eax, dword [rsp + 0x88]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1cc]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x88]
mov byte [rsp + rcx + 0x160], al
jmp 0x1400047ab
lea rax, [rsp + 0x160]
mov rax, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x160]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x14000483c
inc rax
test dl, dl
jne 0x140004829
xor eax, eax
jmp 0x140004841
sbb eax, eax
or eax, 1
test eax, eax
je 0x140004948
lea rax, [rsp + 0xce]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x180]
lea rcx, [0x14000c838]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xb
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0xa
movsx eax, byte [rsp + rax + 0x180]
test eax, eax
je 0x14000489b
mov dword [rsp + 0x124], 1
jmp 0x1400048a6
mov dword [rsp + 0x124], 0
movzx eax, byte [rsp + 0x124]
test eax, eax
je 0x14000490b
mov dword [rsp + 0x5c], 0
jmp 0x1400048c6
mov eax, dword [rsp + 0x5c]
inc eax
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0xb
jge 0x14000490b
movsxd rax, dword [rsp + 0x5c]
movsx eax, byte [rsp + rax + 0x180]
mov dword [rsp + 0x1d0], eax
mov eax, dword [rsp + 0x5c]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1d0]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x5c]
mov byte [rsp + rcx + 0x180], al
jmp 0x1400048bc
lea rax, [rsp + 0x180]
mov rax, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x180]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x14000493b
inc rax
test dl, dl
jne 0x140004928
xor eax, eax
jmp 0x140004940
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140004ae9
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x48]
add rdx, rcx
mov rcx, rdx
mov qword [rsp + 0x20], 0
mov r9d, eax
mov r8, qword [rsp + 0x138]
mov rdx, rcx
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140004ae9
lea rax, [rsp + 0x750]
mov qword [rsp + 0x310], rax
lea rax, [rsp + 0xcf]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x3d0]
lea rcx, [0x14000c900]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x15
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0x14
movsx eax, byte [rsp + rax + 0x3d0]
test eax, eax
je 0x1400049f2
mov dword [rsp + 0x128], 1
jmp 0x1400049fd
mov dword [rsp + 0x128], 0
movzx eax, byte [rsp + 0x128]
test eax, eax
je 0x140004a77
mov dword [rsp + 0x8c], 0
jmp 0x140004a26
mov eax, dword [rsp + 0x8c]
inc eax
mov dword [rsp + 0x8c], eax
cmp dword [rsp + 0x8c], 0x15
jge 0x140004a77
movsxd rax, dword [rsp + 0x8c]
movsx eax, byte [rsp + rax + 0x3d0]
mov dword [rsp + 0x1d4], eax
mov eax, dword [rsp + 0x8c]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1d4]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x8c]
mov byte [rsp + rcx + 0x3d0], al
jmp 0x140004a16
lea rax, [rsp + 0x3d0]
mov rdx, rax
lea rcx, [rsp + 0x590]
call fcn.140001270
mov qword [rsp + 0x300], rax
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x308], rax
mov rax, qword [rsp + 0x40]
mov r8, rax
mov rdx, qword [rsp + 0x308]
mov rcx, qword [rsp + 0x310]
call fcn.140009170
mov qword [rsp + 0x318], rax
mov dl, 1
mov rcx, qword [rsp + 0x318]
call fcn.140002bb0
nop
lea rcx, [rsp + 0x590]
call fcn.1400011e0
jmp 0x140004591
cmp dword [rsp + 0x8e8], 0
je 0x140004c47
mov rax, qword [rsp + 0xa8]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0xa8]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0xd4], 0
jmp 0x140004b45
mov eax, dword [rsp + 0xd4]
inc eax
mov dword [rsp + 0xd4], eax
mov rax, qword [rsp + 0x40]
add rax, 0x28
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x158]
movzx eax, word [rax + 2]
cmp dword [rsp + 0xd4], eax
je 0x140004bfb
mov rax, qword [rsp + 0x40]
cmp dword [rax + 8], 0
je 0x140004bf6
mov dword [rsp + 0x880], 2
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x24]
and eax, 0x80000000
test eax, eax
jbe 0x140004b96
mov dword [rsp + 0x880], 4
jmp 0x140004bb2
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x24]
and eax, 0x20000000
test eax, eax
jbe 0x140004bb2
mov dword [rsp + 0x880], 0x20
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x48]
add rdx, rcx
mov rcx, rdx
lea rdx, [rsp + 0x880]
mov qword [rsp + 0x20], rdx
mov r9d, dword [rsp + 0x880]
mov r8d, eax
mov rdx, rcx
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x140004b27
mov dword [rsp + 0x884], 0
mov rax, qword [rsp + 0xa8]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0xa8]
mov eax, dword [rcx + rax + 0x24]
lea rcx, [rsp + 0x884]
mov qword [rsp + 0x20], rcx
mov r9d, 2
mov r8d, eax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, qword [rsp + 0x138]
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140004d92
lea rax, [rsp + 0x770]
mov qword [rsp + 0x320], rax
lea rax, [rsp + 0xd0]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x4e8]
lea rcx, [0x14000c890]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1e
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0x1d
movsx eax, byte [rsp + rax + 0x4e8]
test eax, eax
je 0x140004cde
mov dword [rsp + 0x12c], 1
jmp 0x140004ce9
mov dword [rsp + 0x12c], 0
movzx eax, byte [rsp + 0x12c]
test eax, eax
je 0x140004d63
mov dword [rsp + 0x90], 0
jmp 0x140004d12
mov eax, dword [rsp + 0x90]
inc eax
mov dword [rsp + 0x90], eax
cmp dword [rsp + 0x90], 0x1e
jge 0x140004d63
movsxd rax, dword [rsp + 0x90]
movsx eax, byte [rsp + rax + 0x4e8]
mov dword [rsp + 0x1f8], eax
mov eax, dword [rsp + 0x90]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1f8]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x90]
mov byte [rsp + rcx + 0x4e8], al
jmp 0x140004d02
lea rax, [rsp + 0x4e8]
mov rdx, rax
mov rcx, qword [rsp + 0x320]
call fcn.140001270
mov qword [rsp + 0x328], rax
mov dl, 1
mov rcx, qword [rsp + 0x328]
call fcn.140002bb0
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
jne 0x140004ecf
lea rax, [rsp + 0x790]
mov qword [rsp + 0x330], rax
lea rax, [rsp + 0xd1]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x488]
lea rcx, [0x14000c7c0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1d
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0x1c
movsx eax, byte [rsp + rax + 0x488]
test eax, eax
je 0x140004e1b
mov dword [rsp + 0x130], 1
jmp 0x140004e26
mov dword [rsp + 0x130], 0
movzx eax, byte [rsp + 0x130]
test eax, eax
je 0x140004ea0
mov dword [rsp + 0x94], 0
jmp 0x140004e4f
mov eax, dword [rsp + 0x94]
inc eax
mov dword [rsp + 0x94], eax
cmp dword [rsp + 0x94], 0x1d
jge 0x140004ea0
movsxd rax, dword [rsp + 0x94]
movsx eax, byte [rsp + rax + 0x488]
mov dword [rsp + 0x1e0], eax
mov eax, dword [rsp + 0x94]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1e0]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x94]
mov byte [rsp + rcx + 0x488], al
jmp 0x140004e3f
lea rax, [rsp + 0x488]
mov rdx, rax
mov rcx, qword [rsp + 0x330]
call fcn.140001270
mov qword [rsp + 0x338], rax
mov dl, 1
mov rcx, qword [rsp + 0x338]
call fcn.140002bb0
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x8c0]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
jne 0x14000500c
lea rax, [rsp + 0x7b0]
mov qword [rsp + 0x340], rax
lea rax, [rsp + 0xe0]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x508]
lea rcx, [0x14000c7a0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
mov eax, 1
imul rax, rax, 0x1f
movsx eax, byte [rsp + rax + 0x508]
test eax, eax
je 0x140004f58
mov dword [rsp + 0x134], 1
jmp 0x140004f63
mov dword [rsp + 0x134], 0
movzx eax, byte [rsp + 0x134]
test eax, eax
je 0x140004fdd
mov dword [rsp + 0x98], 0
jmp 0x140004f8c
mov eax, dword [rsp + 0x98]
inc eax
mov dword [rsp + 0x98], eax
cmp dword [rsp + 0x98], 0x20
jge 0x140004fdd
movsxd rax, dword [rsp + 0x98]
movsx eax, byte [rsp + rax + 0x508]
mov dword [rsp + 0x1e4], eax
mov eax, dword [rsp + 0x98]
cdq
mov ecx, 0x33
idiv ecx
mov eax, edx
add eax, 0x32
mov ecx, dword [rsp + 0x1e4]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x98]
mov byte [rsp + rcx + 0x508], al
jmp 0x140004f7c
lea rax, [rsp + 0x508]
mov rdx, rax
mov rcx, qword [rsp + 0x340]
call fcn.140001270
mov qword [rsp + 0x348], rax
mov dl, 1
mov rcx, qword [rsp + 0x348]
call fcn.140002bb0
mov eax, 1
mov rcx, qword [rsp + 0x890]
xor rcx, rsp
call fcn.14000a490
add rsp, 0x8a8
pop rdi
pop rsi
ret