Function at 0x14007d180
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x5d0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm9
movaps xmmword [rax - 0x68], xmm10
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140321090]
xor rax, rsp
mov qword [rbp + 0x520], rax
xor r14d, r14d
mov edi, 4
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov eax, dword [rdi + rbx]
cmp dword [0x1403b31e8], eax
jle 0x14007d262
lea rcx, [0x1403b31e8]
call fcn.1400effd0
cmp dword [0x1403b31e8], 0xffffffff
jne 0x14007d262
mov qword [0x1403b32f0], r14
mov qword [0x1403b32f8], r14
mov byte [0x1403b31f0], r14b
mov dword [0x1403b3300], r14d
mov r8d, 0xff
lea rdx, [0x140106608]
lea rcx, [0x1403b31f0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [0x1403b32ef], r14b
lea rcx, [0x1403b31f0]
call fcn.1400379f0
nop
lea rcx, [0x1400f6700]
call fcn.1400efdf4
nop
lea rcx, [0x1403b31e8]
call fcn.1400eff70
mov eax, dword [rdi + rbx]
cmp dword [0x1403b30e8], eax
jle 0x14007d2d7
lea rcx, [0x1403b30e8]
call fcn.1400effd0
cmp dword [0x1403b30e8], 0xffffffff
jne 0x14007d2d7
mov qword [0x1403b31b0], r14
mov qword [0x1403b31c0], r14
mov qword [0x1403b31d8], r14
mov dword [0x1403b31e4], r14d
mov qword [0x1403b31b8], r14
movdqa xmm0, xmmword [0x14030a760]
movdqu xmmword [0x1403b31c8], xmm0
mov dword [0x1403b31e0], 0xffffffff
lea rcx, [0x1400f6690]
call fcn.1400efdf4
lea rcx, [0x1403b30e8]
call fcn.1400eff70
mov rdx, qword [0x1403b31b0]
test rdx, rdx
jne 0x14007d2fb
mov dword [rbp + 0x20], edx
xorps xmm0, xmm0
movss dword [rbp + 0x24], xmm0
xorps xmm2, xmm2
movss dword [rbp + 0x28], xmm2
xorps xmm1, xmm1
jmp 0x14007d33b
mov rcx, qword [0x1403b22d8]
test rcx, rcx
je 0x14007d32c
cmp dword [0x1403b223c], 0
je 0x14007d32c
add rdx, 0x90
mov qword [rsp + 0x20], r14
mov r9d, ntohl
lea r8, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm1, dword [rbp + 0x20]
movss xmm2, dword [rbp + 0x28]
movss xmm0, dword [rbp + 0x24]
subss xmm1, dword [0x1403b2fa4]
subss xmm0, dword [0x1403b2fa8]
subss xmm2, dword [0x1403b2fac]
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm1, xmm0
mulss xmm2, xmm2
addss xmm1, xmm2
xorps xmm0, xmm0
ucomiss xmm0, xmm1
ja 0x14007d378
xorps xmm0, xmm0
sqrtss xmm0, xmm1
jmp 0x14007d380
movaps xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
comiss xmm0, dword [0x14030a6d0]
jbe 0x14007d459
mov qword [rbp + 0x1b0], r14
mov qword [rbp + 0x1c0], r14
mov qword [rbp + 0x1d8], r14
mov dword [rbp + 0x1e4], r14d
mov qword [rbp + 0x1b8], r14
movdqa xmm0, xmmword [0x14030a760]
movdqu xmmword [rbp + 0x1c8], xmm0
mov dword [rbp + 0x1e0], 0xffffffff
mov qword [0x1403b31b0], r14
lea rdx, [rbp + 0x1b8]
lea rcx, [0x1403b31b8]
call fcn.140030880
mov rax, qword [rbp + 0x1d8]
mov qword [0x1403b31d8], rax
mov eax, dword [rbp + 0x1e0]
mov dword [0x1403b31e0], eax
mov rdx, qword [rbp + 0x1d0]
cmp rdx, 0x10
jb 0x14007d442
inc rdx
mov rcx, qword [rbp + 0x1b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007d43d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007d43d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400efe14
movdqa xmm0, xmmword [0x14030a760]
movdqu xmmword [rbp + 0x1c8], xmm0
mov byte [rbp + 0x1b8], 0
mov rcx, qword [0x140395278]
mov rax, qword [rcx + 0x4038]
mov byte [rax + 0xc0], 1
mov rax, qword [rcx + 0x4038]
movss xmm1, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x90]
movss xmm6, dword [0x14030a618]
addss xmm1, xmm6
movss xmm0, dword [rax + 0x28]
subss xmm0, dword [rax + 0x8c]
movss xmm10, dword [0x14030a62c]
addss xmm0, xmm10
movss dword [rax + 0x110], xmm0
movss dword [rax + 0x114], xmm1
mov byte [rax + 0x151], 1
mov rax, qword [rcx + 0x4038]
movss xmm0, dword [rax + 0x30]
movss xmm9, dword [0x14030a514]
mulss xmm0, xmm9
subss xmm0, xmm10
movss dword [rbp + 0xa4], xmm0
movss xmm0, dword [0x14030a6cc]
movss dword [rbp + 0xa8], xmm0
movabs rax, 0x4a7230b57dc4430d
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x190], rax
movabs rax, 0xeba8ce2bc7567c04
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x198], rax
movabs r12, 0x6a175cd614ac265b
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x3c0], rax
movabs rdi, 0xeba8ce2bb3251548
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x3c8], rax
movdqa xmm0, xmmword [rbp + 0x190]
pxor xmm0, xmmword [rbp + 0x3c0]
movdqa xmmword [rbp + 0x190], xmm0
lea rdx, [rbp + 0xa4]
lea rcx, [rbp + 0x190]
call fcn.14003e880
movabs rax, 0x6a1734b566cd4308
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x110], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x118], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x3d0], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x3d8], rax
movdqa xmm0, xmmword [rbp + 0x110]
pxor xmm0, xmmword [rbp + 0x3d0]
movdqa xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x54], 0
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rax, [rbp + 0x54]
mov qword [rsp + 0x20], rax
mov r9d, 0x100
lea r8, [0x1403b31f0]
xor edx, edx
lea rcx, [rbp + 0x110]
call fcn.1400729f0
test al, al
je 0x14007d62f
lea rcx, [0x1403b31f0]
call fcn.1400379f0
mov rax, qword [0x140395278]
mov rcx, qword [rax + 0x4038]
movss xmm0, dword [rcx + 0x30]
subss xmm0, xmm6
movss dword [rbp + 0x5c], xmm0
movss xmm0, dword [0x14030a6c0]
movss dword [rbp + 0x60], xmm0
movabs rax, 0x197e10be71fa0578
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x100], rax
movabs rax, 0xeba8ce2bb325153c
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x108], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x3e0], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x3e8], rax
movdqa xmm0, xmmword [rbp + 0x100]
pxor xmm0, xmmword [rbp + 0x3e0]
movdqa xmmword [rbp + 0x100], xmm0
lea rdx, [rbp + 0x5c]
lea rcx, [rbp + 0x100]
call fcn.1400792c0
test al, al
je 0x14007dca1
cmp qword [0x1403b2f90], 0
je 0x14007dc97
lea rdx, [0x1403b2fb0]
lea rcx, [rbp + 0x3a0]
call fcn.140025540
nop
mov rsi, qword [rbp + 0x3a8]
mov qword [rbp + 8], rsi
mov r12, qword [rbp + 0x3a0]
cmp r12, rsi
je 0x14007dc81
add r12, 0x28
movzx ebx, byte [rbp + 0x10]
nop dword [rax]
mov rax, qword [r12 - 0x28]
mov qword [rbp + 0x2e0], rax
lea rdx, [r12 - 0x20]
lea rcx, [rbp + 0x2e8]
call fcn.140010ec0
mov rax, qword [r12]
mov qword [rbp + 0x308], rax
mov eax, dword [r12 + 8]
mov dword [rbp + 0x310], eax
lea rax, [rbp + 0x2e8]
mov r15, qword [rbp + 0x2e8]
mov r13, qword [rbp + 0x300]
cmp r13, 0x10
cmovae rax, r15
movsxd rcx, dword [0x1403b32f0]
test ecx, ecx
jne 0x14007d77f
mov al, 1
jmp 0x14007d7f8
lea rsi, [0x140106608]
test rax, rax
cmovne rsi, rax
mov rdi, qword [0x1403b32f8]
mov r14, rcx
shl r14, 4
add r14, rdi
cmp rdi, r14
je 0x14007d7dd
mov r9, qword [rdi + 8]
mov r8, qword [rdi]
cmp r8, r9
je 0x14007d7d3
mov rcx, rsi
cmp byte [r8], 0x2d
jne 0x14007d7c9
inc r8
call fcn.140036d10
test rax, rax
je 0x14007d7d3
xor al, al
jmp 0x14007d7e7
call fcn.140036d10
test rax, rax
jne 0x14007d7d9
add rdi, 0x10
jmp 0x14007d79e
mov al, 1
jmp 0x14007d7e7
cmp dword [0x1403b3300], 0
sete al
mov rsi, qword [rbp + 8]
xor r14d, r14d
movabs rdi, 0xeba8ce2bb3251548
test al, al
je 0x14007dc2e
movabs rax, 0x6a175cd614ac0f36
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs r15, 0x6a175cd614ac265b
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x3f0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x3f8], rax
movdqa xmm0, xmmword [rbp + 0xb0]
pxor xmm0, xmmword [rbp + 0x3f0]
movdqa xmmword [rbp + 0xb0], xmm0
mov rdx, qword [rbp + 0x2e0]
test rdx, rdx
jne 0x14007d88c
mov dword [rbp + 0x30], edx
xorps xmm1, xmm1
movss dword [rbp + 0x34], xmm1
xorps xmm0, xmm0
movss dword [rbp + 0x38], xmm0
xorps xmm2, xmm2
jmp 0x14007d8cc
mov rcx, qword [0x1403b22d8]
test rcx, rcx
je 0x14007d8bd
cmp dword [0x1403b223c], 0
je 0x14007d8bd
add rdx, 0x90
mov qword [rsp + 0x20], r14
mov r9d, ntohl
lea r8, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm2, dword [rbp + 0x30]
movss xmm0, dword [rbp + 0x38]
movss xmm1, dword [rbp + 0x34]
subss xmm2, dword [0x1403b2fa4]
subss xmm1, dword [0x1403b2fa8]
subss xmm0, dword [0x1403b2fac]
mulss xmm1, xmm1
mulss xmm2, xmm2
addss xmm1, xmm2
mulss xmm0, xmm0
addss xmm1, xmm0
xorps xmm0, xmm0
ucomiss xmm0, xmm1
ja 0x14007d909
xorps xmm0, xmm0
sqrtss xmm0, xmm1
jmp 0x14007d911
movaps xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
cvttss2si edx, xmm0
lea rcx, [rbp + 0x2a0]
call fcn.140001740
mov rdi, rax
movabs rax, 0x6a175cd614ac0e7b
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x140], rcx
movabs rax, 0xeba8ce2bb3251548
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x148], rcx
mov qword [rbp], r15
mov rcx, qword [rbp]
mov qword [rbp + 0x4a0], rcx
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4a8], rax
movdqa xmm0, xmmword [rbp + 0x140]
pxor xmm0, xmmword [rbp + 0x4a0]
movdqa xmmword [rbp + 0x140], xmm0
lea r8, [rbp + 0x140]
lea rdx, [rbp + 0x2e8]
lea rcx, [rbp + 0x2c0]
call fcn.140082210
nop
mov r9, rdi
mov r8, rax
movzx edx, bl
lea rcx, [rbp + 0x260]
call fcn.140082370
nop
lea rax, [rbp + 0xb0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14007d9d0
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x260]
call fcn.140002e70
mov qword [rbp + 0x350], r14
mov qword [rbp + 0x360], r14
mov qword [rbp + 0x368], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x350], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x360], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x278]
cmp rdx, 0x10
jb 0x14007da67
inc rdx
mov rcx, qword [rbp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007da62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007de54
call fcn.1400efe14
mov qword [rbp + 0x270], r14
mov qword [rbp + 0x278], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x260], 0
mov rdx, qword [rbp + 0x2d8]
cmp rdx, 0x10
jb 0x14007dac1
inc rdx
mov rcx, qword [rbp + 0x2c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007dabc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007de5b
call fcn.1400efe14
mov qword [rbp + 0x2d0], r14
mov qword [rbp + 0x2d8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2c0], 0
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 0x10
jb 0x14007db1b
inc rdx
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007db16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007de62
call fcn.1400efe14
mov qword [rbp + 0x2b0], r14
mov qword [rbp + 0x2b8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2a0], 0
mov rax, qword [0x1403b31b0]
cmp qword [rbp + 0x2e0], rax
sete dl
mov qword [rbp + 0x64], 0
lea rcx, [rbp + 0x350]
cmp qword [rbp + 0x368], 0x10
cmovae rcx, qword [rbp + 0x350]
lea r9, [rbp + 0x64]
xor r8d, r8d
call fcn.1400789d0
test al, al
je 0x14007dbc6
mov rax, qword [rbp + 0x2e0]
mov qword [0x1403b31b0], rax
lea rdx, [rbp + 0x2e8]
cmp qword [rbp + 0x300], 0x10
cmovae rdx, qword [rbp + 0x2e8]
mov r8, qword [rbp + 0x2f8]
lea rcx, [0x1403b31b8]
call fcn.140012270
mov rax, qword [rbp + 0x308]
mov qword [0x1403b31d8], rax
mov eax, dword [rbp + 0x310]
mov dword [0x1403b31e0], eax
mov rdx, qword [rbp + 0x368]
cmp rdx, 0x10
jb 0x14007dc07
inc rdx
mov rcx, qword [rbp + 0x350]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007dc02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007de69
call fcn.1400efe14
mov qword [rbp + 0x360], r14
mov qword [rbp + 0x368], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x350], 0
mov r13, qword [rbp + 0x300]
mov r15, qword [rbp + 0x2e8]
cmp r13, 0x10
jb 0x14007dc65
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14007dc5d
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007de70
mov rcx, r15
call fcn.1400efe14
add r12, 0x38
lea rax, [r12 - 0x28]
movabs rdi, 0xeba8ce2bb3251548
cmp rax, rsi
jne 0x14007d720
lea rcx, [rbp + 0x3a0]
call fcn.140002d00
movabs r12, 0x6a175cd614ac265b
call fcn.14003f2f0
call fcn.140048220
call fcn.14003ece0
mov rcx, qword [0x140395278]
mov rax, qword [rcx + 0x4038]
movss xmm2, dword [rax + 0x30]
mov byte [rax + 0xc0], 1
mov rax, qword [rcx + 0x4038]
mulss xmm2, xmm9
addss xmm2, dword [0x14030a5f0]
movss xmm0, dword [rax + 0x28]
subss xmm0, dword [rax + 0x8c]
addss xmm2, xmm0
movss xmm1, dword [rax + 0x2c]
subss xmm1, dword [rax + 0x90]
addss xmm1, xmm6
movss dword [rax + 0x110], xmm2
movss dword [rax + 0x114], xmm1
mov byte [rax + 0x151], 1
mov rax, qword [rcx + 0x4038]
movss xmm0, dword [rax + 0x30]
mulss xmm0, xmm9
subss xmm0, xmm10
movss dword [rbp + 0x6c], xmm0
movss xmm0, dword [0x14030a66c]
movss dword [rbp + 0x70], xmm0
movabs rax, 0x6a6432b97dd8451a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x490], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x498], rax
movdqa xmm0, xmmword [rbp + 0x150]
pxor xmm0, xmmword [rbp + 0x490]
movdqa xmmword [rbp + 0x150], xmm0
lea rdx, [rbp + 0x6c]
lea rcx, [rbp + 0x150]
call fcn.14003e880
cmp dword [0x1403b31e0], 0xffffffff
je 0x14007e410
mov qword [rbp + 0x74], 0
movabs r15, 0x1e6533a671c0430f
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
movabs rax, 0xeba8ce2bb34a6168
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x480], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x488], rax
movdqa xmm0, xmmword [rbp + 0x170]
pxor xmm0, xmmword [rbp + 0x480]
movdqa xmmword [rbp + 0x170], xmm0
lea rdx, [rbp + 0x74]
lea rcx, [rbp + 0x170]
call fcn.14006b320
test al, al
je 0x14007dfdb
mov rdx, qword [0x1403b31b0]
mov rcx, qword [0x1403b22d8]
test rdx, rdx
jne 0x14007de77
mov qword [rbp + 0x3c], rdx
mov dword [rbp + 0x44], edx
jmp 0x14007deaf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
test rcx, rcx
je 0x14007deaf
cmp dword [0x1403b223c], 0
je 0x14007deaf
add rdx, 0x90
mov qword [rsp + 0x20], r14
mov r9d, ntohl
lea r8, [rbp + 0x3c]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1403b31b0]
mov rcx, qword [0x1403b22d8]
movsd xmm7, qword [rbp + 0x3c]
mov esi, dword [rbp + 0x44]
test rdx, rdx
jne 0x14007dec5
mov qword [rbp + 0x48], rdx
mov dword [rbp + 0x50], edx
jmp 0x14007def6
test rcx, rcx
je 0x14007def6
cmp dword [0x1403b223c], 0
je 0x14007def6
add rdx, 0x90
mov qword [rsp + 0x20], r14
mov r9d, ntohl
lea r8, [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403b22d8]
movsd xmm6, qword [rbp + 0x48]
mov edi, dword [rbp + 0x50]
mov rdx, qword [0x1403b2f90]
test rdx, rdx
jne 0x14007df0f
mov rbx, r14
jmp 0x14007df4e
test rcx, rcx
je 0x14007df47
cmp dword [0x1403b223c], 0
je 0x14007df47
add rdx, 0x20
mov qword [rsp + 0x20], r14
mov r9d, 8
lea r8, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1403b2f90]
mov rcx, qword [0x1403b22d8]
mov rbx, qword [rbp + 0x380]
test rdx, rdx
jne 0x14007df58
mov r8, r14
jmp 0x14007df90
test rcx, rcx
je 0x14007df89
cmp dword [0x1403b223c], 0
je 0x14007df89
add rdx, 0x30
mov qword [rsp + 0x20], r14
mov r9d, 8
lea r8, [rbp + 0x378]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1403b2f90]
mov r8, qword [rbp + 0x378]
movsd qword [rbp + 0x1f0], xmm7
mov dword [rbp + 0x1f8], esi
movsd qword [rbp + 0x200], xmm6
mov dword [rbp + 0x208], edi
mov byte [rsp + 0x30], 1
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x200]
mov qword [rsp + 0x20], rax
mov r9, rbx
call fcn.14002f840
movabs rdi, 0xeba8ce2bb3251548
mov qword [rbp + 0x7c], 0
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
movabs rax, 0x8ec4ad42db404368
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
movabs rax, 0xeba154f11960a3dd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x250], rax
movabs rbx, 0x4768e018b393c3a
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x258], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x4c0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x4c8], rax
movabs rsi, 0xeba131bc390fd7fd
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x4d0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x4d8], rax
vmovdqu ymm0, ymmword [rbp + 0x4c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x240]
vmovdqa ymmword [rbp + 0x240], ymm1
lea rdx, [rbp + 0x7c]
lea rcx, [rbp + 0x240]
vzeroupper
call fcn.14006b320
test al, al
je 0x14007e24b
mov rdx, qword [0x1403b2f90]
mov rcx, qword [0x1403b22d8]
test rdx, rdx
jne 0x14007e0d8
mov qword [rbp + 0x338], rdx
mov dword [rbp + 0x340], edx
jmp 0x14007e10c
test rcx, rcx
je 0x14007e10c
cmp dword [0x1403b223c], 0
je 0x14007e10c
add rdx, 0x90
mov qword [rsp + 0x20], r14
mov r9d, ntohl
lea r8, [rbp + 0x338]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403b22d8]
mov rdx, qword [0x1403b31b0]
test rdx, rdx
je 0x14007e24b
movsd xmm6, qword [rbp + 0x338]
mov edi, dword [rbp + 0x340]
movaps xmm7, xmm6
test rcx, rcx
je 0x14007e165
cmp dword [0x1403b223c], 0
je 0x14007e165
add rdx, 0x20
mov qword [rsp + 0x20], r14
mov r9d, 8
lea r8, [rbp + 0x370]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1403b31b0]
mov rcx, qword [0x1403b22d8]
mov r14, qword [rbp + 0x370]
test rdx, rdx
jne 0x14007e176
xor r8d, r8d
jmp 0x14007e1b2
test rcx, rcx
je 0x14007e1ab
cmp dword [0x1403b223c], 0
je 0x14007e1ab
add rdx, 0x30
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rbp + 0x318]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x1403b31b0]
mov r8, qword [rbp + 0x318]
movsd qword [rbp + 0x1a0], xmm6
mov dword [rbp + 0x1a8], edi
movsd qword [rbp + 0x210], xmm7
mov dword [rbp + 0x218], edi
mov byte [rsp + 0x30], 1
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x210]
mov qword [rsp + 0x20], rax
mov r9, r14
call fcn.14002f840
mov rdx, qword [0x1403b31b0]
test rdx, rdx
je 0x14007e241
mov dword [rbp + 0x328], 1
mov rcx, qword [0x1403b22d8]
test rcx, rcx
je 0x14007e241
cmp dword [0x1403b223c], 0
je 0x14007e241
add rdx, qword [0x140395230]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x328]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movabs rdi, 0xeba8ce2bb3251548
mov qword [rbp + 0x84], 0
movabs rax, 0xe3737b57bc0480e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs rax, 0xeba8ce2bb3577a27
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x470], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x478], rax
movdqa xmm0, xmmword [rbp + 0x160]
pxor xmm0, xmmword [rbp + 0x470]
movdqa xmmword [rbp + 0x160], xmm0
lea rdx, [rbp + 0x84]
lea rcx, [rbp + 0x160]
call fcn.14006b320
test al, al
je 0x14007e323
mov rdx, qword [0x1403b31b0]
test rdx, rdx
je 0x14007e323
mov dword [rbp + 0x330], 1
mov rcx, qword [0x1403b22d8]
test rcx, rcx
je 0x14007e323
cmp dword [0x1403b223c], 0
je 0x14007e323
add rdx, qword [0x140395230]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x330]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rbp + 0x8c], 0
movabs rax, 0x57838f67fcf4917
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rax, 0xeba8ce2bb325153a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x460], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x468], rax
movdqa xmm0, xmmword [rbp + 0x130]
pxor xmm0, xmmword [rbp + 0x460]
movdqa xmmword [rbp + 0x130], xmm0
lea rdx, [rbp + 0x8c]
lea rcx, [rbp + 0x130]
call fcn.14006b320
test al, al
je 0x14007e4e1
mov rdx, qword [0x1403b31b0]
test rdx, rdx
je 0x14007e4e1
mov dword [rbp + 0x348], 2
mov rcx, qword [0x1403b22d8]
test rcx, rcx
je 0x14007e4e1
cmp dword [0x1403b223c], 0
je 0x14007e4e1
add rdx, qword [0x140395230]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x348]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x14007e4e1
movabs rax, 0xb3728b571c04308
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
movabs rax, 0x8ec4ad42db406368
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
movabs rax, 0xeb8045cf4b66b1dd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
movabs rbx, 0x4768e018b393c3a
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x4e0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x4e8], rax
movabs rsi, 0xeba131bc390fd7fd
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x4f0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x4f8], rax
vmovdqu ymm0, ymmword [rbp + 0x4e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x220]
vmovdqa ymmword [rbp + 0x220], ymm1
lea rcx, [rbp + 0x220]
vzeroupper
call fcn.14006a9c0
call fcn.14003ece0
mov rcx, qword [0x140395278]
mov rax, qword [rcx + 0x4038]
movss xmm0, dword [rax + 0x30]
mov byte [rax + 0xc0], 1
mov rax, qword [rcx + 0x4038]
movss xmm1, dword [rax + 0x28]
subss xmm1, dword [rax + 0x8c]
mulss xmm0, xmm9
addss xmm0, dword [0x14030a5f0]
addss xmm1, xmm0
movss xmm0, dword [rax + 0x2c]
subss xmm0, dword [rax + 0x90]
addss xmm0, dword [0x14030a68c]
movss dword [rax + 0x110], xmm1
movss dword [rax + 0x114], xmm0
mov byte [rax + 0x151], 1
mov rax, qword [rcx + 0x4038]
movss xmm0, dword [rax + 0x30]
mulss xmm0, xmm9
subss xmm0, xmm10
movss dword [rbp + 0x94], xmm0
movss xmm0, dword [0x14030a6a8]
movss dword [rbp + 0x98], xmm0
movabs rax, 0x6a6430b761df4f0d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x450], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x458], rax
movdqa xmm0, xmmword [rbp + 0xe0]
pxor xmm0, xmmword [rbp + 0x450]
movdqa xmmword [rbp + 0xe0], xmm0
lea rdx, [rbp + 0x94]
lea rcx, [rbp + 0xe0]
call fcn.14003e880
mov qword [rbp + 0x9c], 0
movabs rax, 0x9793da460df431f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
movabs rax, 0x82d03d59e3056729
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x288], rax
movabs rax, 0xeba131bc390fb890
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x290], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x298], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x500], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x508], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x510], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x518], rax
vmovdqu ymm0, ymmword [rbp + 0x500]
vpxor ymm1, ymm0, ymmword [rbp + 0x280]
vmovdqa ymmword [rbp + 0x280], ymm1
lea rdx, [rbp + 0x9c]
lea rcx, [rbp + 0x280]
vzeroupper
call fcn.14006b320
test al, al
je 0x14007e779
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x388], xmm0
mov qword [rbp + 0x398], rax
lea rdx, [0x1403b2fb0]
lea rcx, [rbp + 0x388]
call fcn.140025540
mov rax, qword [rbp + 0x388]
mov rdx, qword [rbp + 0x390]
cmp rax, rdx
je 0x14007e76d
mov r8, qword [0x1403b31b0]
cmp dword [rax + 0x30], 0xffffffff
je 0x14007e715
mov rcx, qword [rax]
cmp rcx, r8
jne 0x14007e720
add rax, 0x38
cmp rax, rdx
je 0x14007e76d
jmp 0x14007e707
test rcx, rcx
je 0x14007e76d
mov dword [rbp + 0x320], 1
mov r10, qword [0x1403b22d8]
test r10, r10
je 0x14007e76d
cmp dword [0x1403b223c], 0
je 0x14007e76d
mov rdx, qword [0x140395230]
add rdx, rcx
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rbp + 0x320]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, [rbp + 0x388]
call fcn.140002d00
movabs rax, 0x6a7339ba76cd481e
mov qword [rbp + 0x318], rax
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x318], rdi
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x318], r12
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x440], rax
mov qword [rbp + 0x318], rdi
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x448], rax
movdqa xmm0, xmmword [rbp + 0x20]
pxor xmm0, xmmword [rbp + 0x440]
movdqa xmmword [rbp + 0x20], xmm0
lea rdx, [0x1403939ac]
lea rcx, [rbp + 0x20]
call fcn.14006d1b0
movabs rax, 0x253739a47bc24112
mov qword [rbp + 0x318], rax
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0xd0], rax
movabs rax, 0xebccab42c350762b
mov qword [rbp + 0x318], rax
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0x318], r12
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x4b0], rax
mov qword [rbp + 0x318], rdi
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x4b8], rax
movdqa xmm0, xmmword [rbp + 0xd0]
pxor xmm0, xmmword [rbp + 0x4b0]
movdqa xmmword [rbp + 0xd0], xmm0
lea rdx, [0x1403939ad]
lea rcx, [rbp + 0xd0]
call fcn.14006d1b0
movabs rax, 0x6a172eb37fde4716
mov qword [rbp + 0x318], rax
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0x318], rdi
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0xc8], rax
mov qword [rbp + 0x318], r12
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x400], rax
mov qword [rbp + 0x318], rdi
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x408], rax
movdqa xmm0, xmmword [rbp + 0xc0]
pxor xmm0, xmmword [rbp + 0x400]
movdqa xmmword [rbp + 0xc0], xmm0
lea rdx, [0x1403939ae]
lea rcx, [rbp + 0xc0]
call fcn.14006d1b0
movabs rax, 0x6a175cd671c14715
mov qword [rbp + 0x318], rax
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x318], rdi
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x188], rax
mov qword [rbp + 0x318], r12
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x410], rax
mov qword [rbp + 0x318], rdi
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x418], rax
movdqa xmm0, xmmword [rbp + 0x180]
pxor xmm0, xmmword [rbp + 0x410]
movdqa xmmword [rbp + 0x180], xmm0
lea rdx, [0x1403939b0]
lea rcx, [rbp + 0x180]
call fcn.14006d1b0
movabs rax, 0xf7432b760df4f1f
mov qword [rbp + 0x318], rax
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x318], rdi
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x318], r12
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x420], rax
mov qword [rbp + 0x318], rdi
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x428], rax
movdqa xmm0, xmmword [rbp + 0x120]
pxor xmm0, xmmword [rbp + 0x420]
movdqa xmmword [rbp + 0x120], xmm0
lea rdx, [0x1403939af]
lea rcx, [rbp + 0x120]
call fcn.14006d1b0
movabs rax, 0x6a175ca47bc04918
mov qword [rbp + 0x318], rax
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0x318], rdi
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x318], r12
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x430], rax
mov qword [rbp + 0x318], rdi
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x438], rax
movdqa xmm0, xmmword [rbp + 0xf0]
pxor xmm0, xmmword [rbp + 0x430]
movdqa xmmword [rbp + 0xf0], xmm0
mov r8d, 0x10260
lea rdx, [0x1403939b4]
lea rcx, [rbp + 0xf0]
call fcn.140075510
call fcn.14003ece0
mov rcx, qword [rbp + 0x520]
xor rcx, rsp
call fcn.1400efb60
lea r11, [rsp + 0x5d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm9, xmmword [r11 - 0x30]
movaps xmm10, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret