Function at 0x140036b70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x348
movaps xmmword [rsp + 0x330], xmm6
mov rax, qword [0x1402b7040]
xor rax, rsp
mov qword [rsp + 0x328], rax
cmp qword [rcx + 0x18], 0
je 0x140037c63
mov rsi, rcx
lea r14, [rsp + 0x230]
xorps xmm6, xmm6
movups xmmword [r14], xmm6
mov qword [r14 - 8], r14
lea rbp, [rcx + 8]
mov r12, qword [rcx + 0x10]
cmp r12, rbp
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rbp
je 0x140036dbb
xor r13d, r13d
lea r15, [rsp + 0x132]
lea rdi, [0x1402a3620]
movabs rbx, 0x9aaaaaa0000aaaa
mov eax, dword [r12 + 0x10]
cmp eax, 2
setb cl
cmp eax, 4
setge al
or al, cl
je 0x1400375f4
mov r12, qword [r12 + 8]
cmp r12, rbp
jne 0x140036bf5
mov rcx, qword [rsp + 0x230]
test r13, r13
je 0x140036dbd
mov r14, r13
add r14, 0x10
call fcn.140037f20
test r14, r14
je 0x140036dc2
mov rcx, r14
call fcn.14019ce68
mov rbx, rax
cmp byte [rsi + 0x20], 1
je 0x140037d23
xor eax, eax
mov rsi, rbx
add rsi, 0x10
mov qword [rbx + 8], rax
lea r15, [rsp + 0x228]
mov qword [r15], r13
lea rax, [rsp + 0x90]
mov qword [rax], rsi
mov rax, qword [rsp + 0x58]
mov r12, qword [rax + 0x10]
xor edi, edi
movabs r13, 0xaaaaaaaaaaaaaaaa
movaps xmm6, xmmword [0x140275a70]
jmp 0x140036cb2
mov eax, dword [r12 + 0x10]
cmp eax, 2
setb cl
cmp eax, 4
setge al
or al, cl
je 0x140037837
mov r12, qword [r12 + 8]
cmp r12, rbp
jne 0x140036c94
mov qword [rbx], rdi
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
test rax, rax
je 0x140037c6a
mov rsi, qword [rax]
mov dword [rsp + 0x20], 4
mov rcx, rsi
xor edx, edx
mov r8, r14
mov r9d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x140037d19
mov rdi, rax
lea rax, [rsp + 0x120]
movabs rcx, 0xaaaaaaaaaaaaaaaa
mov qword [rax], rcx
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
mov r9, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140037d04
cmp qword [rsp + 0x120], r14
jne 0x140037d04
mov qword [rsp + 0x88], rdi
lea rax, [0x140255470]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
lea rsi, [0x1402a3620]
lea r8, str.NtMapViewOfSection
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
mov rdx, rsi
mov r9d, 1
call fcn.140034c20
lea rax, [0x1402554e0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
lea r8, str.NtUnmapViewOfSection
mov rcx, rdi
mov rdx, rsi
mov rsi, rdi
mov r9d, 1
call fcn.140034c20
jmp 0x140036de5
xor ecx, ecx
call fcn.140037f20
cmp qword [rsi], 0
je 0x140037c6a
mov qword [rsp + 0x88], 0
xor ebx, ebx
cmp qword [rsi + 0x18], 0
je 0x140037547
mov rax, qword [rsi]
test rax, rax
je 0x140037c6d
mov qword [rsp + 0x68], rbx
mov rcx, qword [rax]
mov dword [rsp + 0x20], 1
mov r8d, 0x10000
mov qword [rsp + 0x70], rcx
xor edx, edx
mov r9d, 0x2000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, qword [rsi + 0x18]
shl rsi, 6
lea r13, [rsi + 0x60]
cmp r13, 0x10001
jae 0x140037c70
mov rdi, rax
mov r14d, 0xffa0
sub r14d, esi
and r14d, 0xffffffe0
inc r14
mov rax, 0xffffffffffffffff
xor edx, edx
div r14
mov r15, 0xfffffffffffffffe
sub r15, rdx
lea r12, [rsp + 0x228]
lea rbx, [rsp + 0x120]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x228], rax
mov qword [rsp + 0x120], r12
mov qword [rsp + 0x128], 8
mov rcx, rbx
call fcn.14013baa0
mov rax, qword [rsp + 0x228]
cmp rax, r15
ja 0x140036e6c
mov edx, 0x800
mov r9d, 0x1000
mov r8d, 0x800
mov rcx, r9
shr r8, 1
mov r9, rdx
cmp rdx, r13
mov rdx, r8
jae 0x140036eb8
xor edx, edx
div r14
mov rbx, rdx
neg ecx
and ebx, ecx
mov eax, ebx
and eax, 0xfffff000
add rdi, rax
add rsi, 0x105f
and rsi, 0xfffffffffffff000
mov dword [rsp + 0x20], 0x40
mov rcx, qword [rsp + 0x70]
mov rdx, rdi
mov r8, rsi
mov r9d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x140037c73
mov rdi, rax
lea rcx, [rsp + 0x120]
mov r8d, 0x108
mov dl, 0xaa
call fcn.1401d8720
lea rcx, [0x1402a3620]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x80], rax
test rax, rax
mov rsi, qword [rsp + 0x58]
je 0x140037c89
movaps xmm6, xmmword [0x140275a70]
movups xmmword [rsp + 0x2d8], xmm6
movups xmmword [rsp + 0x318], xmm6
movups xmmword [rsp + 0x308], xmm6
movups xmmword [rsp + 0x2f8], xmm6
movups xmmword [rsp + 0x2e8], xmm6
mov qword [rsp + 0x2c8], r13
mov dword [rsp + 0x2e0], 0
mov qword [rsp + 0x2d0], Ordinal_41
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x118], rax
movups xmmword [rsp + 0x108], xmm6
movups xmmword [rsp + 0xf8], xmm6
mov rax, qword [rsi]
test rax, rax
je 0x140037c76
and ebx, 0xfff
add rdi, rbx
mov qword [rsp + 0x78], rdi
mov rax, qword [rax]
lea rcx, [0x140277720]
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], rax
mov byte [rsp + 0x118], 1
mov dword [rsp + 0x11c], 0
lea rcx, [rsp + 0x228]
mov r8d, 0xa0
xor edx, edx
call fcn.1401d8720
mov r14, qword [rsi + 0x10]
cmp r14, rbp
je 0x14003740d
lea r15, [rsp + 0x98]
lea rdi, [rsp + 0xb0]
lea rsi, [rsp + 0xc8]
mov rax, qword [rsp + 0x78]
lea r10, [rax + 0x20]
mov dword [rsp + 0x4c], 0xaaaaaaaa
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
jmp 0x1400371fc
mov rdx, qword [r14 + 0x18]
mov r8, qword [r14 + 0x20]
mov rcx, r15
mov rbx, r10
call fcn.14014e8d0
mov r10, rbx
jmp 0x140037260
mov rcx, qword [rsp + 0x98]
mov rbx, r10
call fcn.14019cac4
mov r10, rbx
jmp 0x1400371e4
mov r9, qword [rsp + 0xb0]
mov r12, r13
sub r13, qword [rsp + 0x2d0]
movsxd r15, dword [rsp + 0x2e0]
shl r15, 6
mov rdi, r10
add r15, r10
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
lea rbp, [rsp + 0xf0]
mov rcx, rbp
mov rdx, qword [rsp + 0x80]
xor r8d, r8d
call qword [0x1402a7b00]
test eax, eax
js 0x140037b76
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax + 0x20]
mov rcx, rbp
call qword [0x1402a7b00]
test rax, rax
mov r13, rbp
je 0x140037b62
mov rcx, rax
call fcn.14019ce68
mov rbp, rax
mov rcx, r13
mov rdx, rbp
call fcn.140021f20
test al, al
je 0x140037b69
mov rcx, r13
mov rdx, rbp
mov r8, r15
call fcn.140022080
mov r13d, eax
test rbp, rbp
mov r15, rsi
je 0x14003716e
mov rcx, rbp
call fcn.14019ce00
test r13d, r13d
mov rsi, rbx
js 0x140037b7f
mov r10, rdi
movsxd rax, dword [rsp + 0x2e0]
shl rax, 6
add rax, rdi
movsxd rcx, dword [rsp + 0x94]
mov qword [rsp + rcx*8 + 0x228], rax
inc dword [rsp + 0x2e0]
add qword [rsp + 0x2d0], 0x40
mov bpl, 1
cmp byte [rsp + 0xdf], 0
mov r13, r12
js 0x140037bab
cmp byte [rsp + 0xc7], 0
lea rdi, [rsp + 0xb0]
js 0x140037bc3
cmp byte [rsp + 0xaf], 0
js 0x14003708d
test bpl, bpl
je 0x140037c16
mov r14, qword [r14 + 8]
cmp r14, qword [rsp + 0x60]
je 0x14003740d
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xe0], rax
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0x90], rax
cmp byte [r14 + 0x2f], 0
js 0x140037072
lea rax, [r14 + 0x18]
mov rcx, qword [rax + 0x10]
mov qword [r15 + 0x10], rcx
movups xmm0, xmmword [rax]
movups xmmword [r15], xmm0
cmp byte [r14 + 0x47], 0
js 0x140037bdb
lea rax, [r14 + 0x30]
mov rcx, qword [rax + 0x10]
mov qword [rdi + 0x10], rcx
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
cmp byte [r14 + 0x5f], 0
js 0x140037bf6
lea rax, [r14 + 0x48]
mov rcx, qword [rax + 0x10]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rax]
movups xmmword [rsi], xmm0
mov rcx, qword [r14 + 0x60]
mov qword [rsp + 0xe0], rcx
movsx rax, byte [rsp + 0xaf]
mov rdx, rax
test rax, rax
jns 0x1400372bf
mov rdx, qword [rsp + 0xa0]
cmp rdx, 9
jne 0x140037b46
test al, al
mov rdx, qword [rsp + 0x98]
mov r8, r15
cmovs r8, rdx
cmp word [r8], 0x6e
jne 0x140037b46
lea r8, [rdx + 2]
test al, al
lea r9, [rsp + 0x9a]
cmovns r8, r9
cmp word [r8], 0x74
jne 0x140037b46
lea r8, [rdx + 4]
test al, al
lea r9, [rsp + 0x9c]
cmovns r8, r9
cmp word [r8], 0x64
jne 0x140037b46
lea r8, [rdx + 6]
test al, al
lea r9, [rsp + 0x9e]
cmovns r8, r9
cmp word [r8], 0x6c
jne 0x140037b46
lea r8, [rdx + 8]
test al, al
lea r9, [rsp + 0xa0]
cmovns r8, r9
cmp word [r8], 0x6c
jne 0x140037b46
lea r8, [rdx + 0xa]
test al, al
lea r9, [rsp + 0xa2]
cmovns r8, r9
cmp word [r8], 0x2e
jne 0x140037b46
lea r8, [rdx + 0xc]
test al, al
lea r9, [rsp + 0xa4]
cmovns r8, r9
cmp word [r8], 0x64
jne 0x140037b46
lea r8, [rdx + 0xe]
test al, al
lea r9, [rsp + 0xa6]
cmovns r8, r9
cmp word [r8], 0x6c
jne 0x140037b46
add rdx, 0x10
test al, al
lea rax, [rsp + 0xa8]
cmovns rdx, rax
xor ebp, ebp
cmp word [rdx], 0x6c
jne 0x140037b41
cmp dword [rsp + 0x90], 1
jne 0x140037b41
cmp byte [rsp + 0xdf], 0
mov rbx, rsi
mov rdx, rsi
jns 0x1400373f4
mov rdx, qword [rsp + 0xc8]
mov rsi, r15
cmp byte [rsp + 0xc7], 0
mov r9, rdi
jns 0x1400370ad
jmp 0x1400370a5
lea rsi, [rsp + 0x120]
lea rdx, [rsp + 0x228]
mov r8d, 0x100
mov rcx, rsi
call fcn.1401d8080
mov qword [rsi + 0x100], 1
lea rax, [rsp + 0x90]
movabs rcx, 0xaaaaaaaaaaaaaaaa
mov qword [rax], rcx
lea r8, [rsp + 0x1c0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
mov rcx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebp, Ordinal_46
test eax, eax
mov rbx, qword [rsp + 0x68]
je 0x140037c79
cmp qword [rsp + 0x90], 0x20
mov rsi, qword [rsp + 0x58]
jne 0x140037543
lea rax, [rsp + 0xf0]
mov dword [rax], 0xaaaaaaaa
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x70]
mov rdx, rdi
mov r8, r13
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rax, qword [rsi]
test rax, rax
je 0x140037c83
cmp qword [rsp + 0x220], 1
jne 0x140037c11
cmp dword [rax + 0x10], 0
mov rcx, qword [rax]
je 0x140037cc0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x228], rax
lea rax, [rsp + 0x228]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402d0c18]
lea r8, [rsp + 0x120]
mov r9d, 0xa0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor ecx, ecx
cmp qword [rsp + 0x228], 0xa0
mov edx, 0x3a
cmove edx, ecx
test eax, eax
mov ebp, 0x39
cmovne ebp, edx
test ebp, ebp
jne 0x1400375ad
mov rax, qword [rsi]
test rax, rax
je 0x140037c86
cmp dword [rax + 0x10], 0
mov rcx, qword [rax]
je 0x140037c98
lea rsi, [rsp + 0x120]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsi], rax
mov qword [rsp + 0x20], rsi
lea rdx, [0x1402d0d08]
lea r8, [rsp + 0x88]
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor ecx, ecx
cmp qword [rsi], 8
mov edx, 0x3a
cmove edx, ecx
test eax, eax
mov ebp, 0x39
cmovne ebp, edx
test rbx, rbx
jne 0x1400375cc
mov rcx, qword [rsp + 0x328]
xor rcx, rsp
cmp rcx, qword [0x1402b7040]
je 0x1400375d6
call fcn.14019f290
int3
mov rcx, rbx
call fcn.14019ce00
jmp 0x1400375b2
mov eax, ebp
movaps xmm6, xmmword [rsp + 0x330]
add rsp, 0x348
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [rsp + 0x120]
cmp rax, rdi
seta al
cmp r15, rdi
setbe cl
mov qword [rsp + 0x130], rbx
or cl, al
je 0x140037b74
movaps xmm0, xmmword [0x1402a3620]
movaps xmmword [rsp + 0x120], xmm0
mov word [rsp + 0x130], Ordinal_117
movsx rax, byte [r12 + 0x2f]
mov rcx, rax
test rax, rax
jns 0x140037644
mov rcx, qword [r12 + 0x20]
cmp rcx, 9
je 0x140037db8
lea rsi, [r12 + 0x18]
mov rbx, qword [rsp + 0x230]
test rbx, rbx
jne 0x140037d3d
test al, al
jns 0x140037ce8
mov rcx, qword [r12 + 0x20]
lea rbp, [rcx*2 + 0x23]
and rbp, 0xfffffffffffffff8
add rbp, r13
mov rdx, qword [rsp + 0x230]
mov rbx, r14
mov r13, r14
test rdx, rdx
je 0x140037777
test al, al
js 0x1400376a3
movzx eax, al
mov rcx, rsi
jmp 0x1400376bf
mov rax, qword [r12 + 0x20]
mov rcx, qword [r12 + 0x18]
jmp 0x1400376bf
mov rdx, qword [r13]
mov rbx, r13
test rdx, rdx
je 0x140037777
mov r13, rdx
movsx r10, byte [rdx + 0x37]
mov rdx, r10
test r10, r10
jns 0x1400376d3
mov rdx, qword [r13 + 0x28]
lea r8, [r13 + 0x20]
mov r11, qword [r13 + 0x20]
cmp rdx, rax
mov r9, rax
cmovb r9, rdx
test r9, r9
je 0x14003770c
test r10b, r10b
mov rdi, r8
cmovs rdi, r11
xor ebx, ebx
movzx r15d, word [rdi + rbx*2]
cmp word [rcx + rbx*2], r15w
ja 0x140037715
jb 0x1400376af
inc rbx
cmp r9, rbx
jne 0x1400376f6
cmp rax, rdx
jne 0x140037b1d
test r9, r9
lea r15, [rsp + 0x132]
lea rdi, [0x1402a3620]
movabs rbx, 0x9aaaaaa0000aaaa
je 0x140037753
test r10b, r10b
cmovs r8, r11
xor r10d, r10d
movzx r11d, word [rcx + r10*2]
cmp word [r8 + r10*2], r11w
ja 0x14003775c
jb 0x140037766
inc r10
cmp r9, r10
jne 0x14003773d
cmp rdx, rax
jne 0x140037b36
mov rsi, qword [rsp + 0x58]
jmp 0x1400377f3
mov rdx, qword [r13 + 8]
test rdx, rdx
jne 0x1400376bf
lea rbx, [r13 + 8]
mov ecx, 0x38
call fcn.14019ca88
mov rdi, rax
lea rcx, [rax + 0x20]
cmp byte [r12 + 0x2f], 0
jns 0x140037da5
mov rdx, qword [r12 + 0x18]
mov r8, qword [r12 + 0x20]
call fcn.14014e8d0
mov rsi, qword [rsp + 0x58]
movups xmmword [rdi], xmm6
mov qword [rdi + 0x10], r13
mov qword [rbx], rdi
mov rax, qword [rsp + 0x228]
mov rax, qword [rax]
test rax, rax
jne 0x14003782a
mov rcx, qword [rsp + 0x230]
mov rdx, rdi
call fcn.14013f220
inc qword [rsp + 0x238]
lea r15, [rsp + 0x132]
lea rdi, [0x1402a3620]
movabs rbx, 0x9aaaaaa0000aaaa
movsx rax, byte [r12 + 0x47]
test rax, rax
js 0x140037cf0
movsx rcx, byte [r12 + 0x5f]
test rcx, rcx
js 0x140037cfa
lea r13, [rax + rcx]
add r13, 0x21
and r13, 0xfffffffffffffff8
add r13, rbp
mov rbp, qword [rsp + 0x60]
jmp 0x140036c0e
mov qword [rsp + 0x228], rax
mov rdi, qword [rbx]
jmp 0x1400377c2
lea rcx, [0x1402a3620]
lea rax, [rsp + 0x120]
cmp rax, rcx
seta al
lea rdx, [rsp + 0x132]
cmp rdx, rcx
setbe cl
movabs rdx, 0x9aaaaaa0000aaaa
mov qword [rsp + 0x130], rdx
or cl, al
je 0x140037b74
movaps xmm0, xmmword [0x1402a3620]
movaps xmmword [rsp + 0x120], xmm0
mov word [rsp + 0x130], Ordinal_117
movsx rax, byte [r12 + 0x2f]
test rax, rax
mov r8, qword [r12 + 0x20]
mov rcx, rax
cmovs rcx, r8
cmp rcx, 9
mov qword [rsp + 0x68], rbx
je 0x140037e61
lea rbp, [r12 + 0x18]
mov qword [rsp + 0x130], r13
movaps xmmword [rsp + 0x120], xmm6
test al, al
jns 0x140037ef9
mov rdx, qword [r12 + 0x18]
lea rcx, [rsp + 0x120]
call fcn.14014e8d0
mov cl, byte [r12 + 0x2f]
mov r8, qword [r12 + 0x20]
movzx eax, cl
test cl, cl
cmovs rax, r8
lea rax, [rax*2 + 0x23]
and rax, 0xfffffffffffffff8
mov rcx, qword [rsp + 0x228]
sub rcx, rax
jb 0x140037d9e
mov r13, qword [rsp + 0x90]
mov qword [rsp + 0x228], rcx
lea rbx, [rax + r13]
mov qword [rsp + 0x90], rbx
cmp dword [r12 + 0x10], 3
sete byte [r13 + 0x18]
mov qword [r13], rax
mov qword [r13 + 8], rax
mov qword [r13 + 0x10], 0
movsx rax, byte [r12 + 0x2f]
mov rcx, qword [r12 + 0x20]
test rax, rax
jns 0x140037e52
test rcx, rcx
js 0x140037b74
mov rbp, qword [rbp]
mov r8, rcx
add r13, 0x1a
cmp rbp, r13
jb 0x140037988
lea rdx, [r8*2]
add rdx, r13
cmp rbp, rdx
jb 0x140037b74
test r8, r8
je 0x140037e5a
add r8, r8
mov rcx, r13
mov rdx, rbp
call fcn.1401d8080
mov dl, byte [r12 + 0x2f]
mov rcx, qword [r12 + 0x20]
movzx eax, dl
test dl, dl
cmovs rax, rcx
mov word [r13 + rax*2], 0
cmp r12, qword [rsp + 0x60]
je 0x140037ad6
mov r13, r12
jmp 0x140037aa6
lea rbp, [r13 + 0x18]
test rax, rax
je 0x140037a0f
lea r8, [rsp + 0x120]
test cl, cl
jns 0x1400379ea
mov r8, qword [rsp + 0x120]
mov rcx, rbp
test dl, dl
jns 0x1400379f5
mov rcx, qword [rbp]
xor edx, edx
movzx r9d, word [rcx + rdx*2]
cmp r9w, word [r8 + rdx*2]
jne 0x140037a95
inc rdx
cmp rax, rdx
jne 0x1400379f7
lea rcx, [r13 + 0x10]
lea rdx, [rsp + 0x90]
mov r8, r15
mov r9, rsi
call fcn.1400382f0
test al, al
je 0x140037d9e
cmp r12, r13
jne 0x140037a38
mov r12, qword [r12 + 8]
mov rax, qword [r13]
mov rbx, qword [r13 + 8]
mov qword [rax + 8], rbx
mov rax, qword [r13]
mov qword [rbx], rax
mov rax, qword [rsp + 0x58]
dec qword [rax + 0x18]
cmp byte [r13 + 0x5f], 0
js 0x140037edd
cmp byte [r13 + 0x47], 0
js 0x140037eeb
cmp byte [r13 + 0x2f], 0
js 0x140037b28
test r13, r13
je 0x140037b74
mov rcx, r13
call fcn.14019cac4
jmp 0x140037a99
mov r8, qword [r13 + 0x20]
cmp r8, rax
je 0x1400379cd
mov rbx, qword [r13 + 8]
mov rax, qword [rsp + 0x60]
mov r13, rbx
cmp rbx, rax
je 0x140037ace
movsx rcx, byte [rsp + 0x137]
mov rax, rcx
test rcx, rcx
jns 0x140037abf
mov rax, qword [rsp + 0x128]
movsx rdx, byte [r13 + 0x2f]
mov r8, rdx
test rdx, rdx
jns 0x140037a8c
jmp 0x140037a88
mov rbx, qword [rsp + 0x90]
inc rdi
mov bpl, 1
mov rsi, rbx
movabs r13, 0xaaaaaaaaaaaaaaaa
cmp byte [rsp + 0x137], 0
mov rbx, qword [rsp + 0x68]
jns 0x140037b05
mov rcx, qword [rsp + 0x120]
call fcn.14019cac4
test bpl, bpl
mov rbp, qword [rsp + 0x60]
jne 0x140036cb2
mov ebp, Ordinal_41
jmp 0x1400375ad
jb 0x1400376af
jmp 0x140037715
mov rcx, qword [rbp]
call fcn.14019cac4
jmp 0x140037a75
jb 0x140037766
jmp 0x14003775c
mov r12, r13
jmp 0x140037b4b
mov r12, r13
xor ebp, ebp
mov eax, 2
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x4c], 2
jmp 0x1400371af
xor ebp, ebp
jmp 0x14003713a
mov r13d, 0xc0000035
jmp 0x14003715e
ud2
mov r13d, eax
mov r15, rsi
mov rsi, rbx
mov ecx, r13d
call fcn.140241e70
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r10, rdi
mov dword [rsp + 0x4c], Ordinal_41
xor ebp, ebp
mov eax, 2
mov qword [rsp + 0x50], rax
jmp 0x1400371af
mov rcx, qword [rsp + 0xc8]
mov rdi, r10
call fcn.14019cac4
mov r10, rdi
jmp 0x1400371c0
mov rcx, qword [rsp + 0xb0]
mov rbx, r10
call fcn.14019cac4
mov r10, rbx
jmp 0x1400371d6
mov rdx, qword [r14 + 0x30]
mov r8, qword [r14 + 0x38]
mov rcx, rdi
mov rbx, r10
call fcn.14010ba70
mov r10, rbx
jmp 0x14003727d
mov rdx, qword [r14 + 0x48]
mov r8, qword [r14 + 0x50]
mov rcx, rsi
mov rbx, r10
call fcn.14010ba70
mov r10, rbx
jmp 0x14003729a
call fcn.1402178c0
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x120], eax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x220], rax
cmp rax, 1
je 0x140037436
cmp qword [rsp + 0x50], 2
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
mov ebp, dword [rsp + 0x4c]
je 0x140037543
cmp qword [rsp + 0x50], 0
je 0x140037f18
call fcn.1402178c0
xor ebp, ebp
jmp 0x1400375b2
int3
int3
int3
int3
int3
mov rsi, qword [rsp + 0x58]
jmp 0x140037543
int3
int3
mov ebp, 7
mov rbx, qword [rsp + 0x68]
jmp 0x1400375ad
test rcx, rcx
jne 0x140037560
cmp dword [rax + 0x14], 0
jne 0x140037560
cmp qword [rax + 8], 0
jne 0x140037560
mov ebp, 8
jmp 0x1400375ad
test rcx, rcx
jne 0x1400374e9
cmp dword [rax + 0x14], 0
jne 0x1400374e9
mov ebp, 8
cmp qword [rax + 8], 0
jne 0x1400374e9
jmp 0x140037543
movzx ecx, al
jmp 0x140037671
mov rax, qword [r12 + 0x38]
jmp 0x140037802
mov rcx, qword [r12 + 0x50]
jmp 0x140037811
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ebp, Ordinal_41
jmp 0x1400375ad
mov rax, qword [rsi]
test rax, rax
je 0x140037f1b
mov rax, qword [rax + 0x40]
mov rbp, qword [rsp + 0x60]
jmp 0x140036c55
lea rdi, [rbx + 0x20]
lea rcx, [rsp + 0x120]
mov rdx, rsi
mov r8, rdi
call fcn.14019b2c0
cmp byte [rsp + 0x120], 0
js 0x140037d7f
lea rcx, [rsp + 0x120]
mov rdx, rdi
mov r8, rsi
call fcn.14019b2c0
cmp byte [rsp + 0x120], 0
jns 0x140037d91
add rbx, 8
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140037d3d
mov al, byte [r12 + 0x2f]
jmp 0x140037664
mov rbp, r13
mov rsi, qword [rsp + 0x58]
jmp 0x1400377da
xor ebp, ebp
jmp 0x140037adf
mov rax, qword [rsi + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsi]
movups xmmword [rcx], xmm0
jmp 0x1400377a3
test al, al
js 0x140037dc3
lea rcx, [r12 + 0x18]
jmp 0x140037dc8
mov rcx, qword [r12 + 0x18]
cmp word [rcx], 0x6e
mov rbp, qword [rsp + 0x60]
jne 0x14003764e
cmp word [rcx + 2], 0x74
jne 0x14003764e
cmp word [rcx + 4], 0x64
jne 0x14003764e
cmp word [rcx + 6], 0x6c
jne 0x14003764e
cmp word [rcx + 8], 0x6c
jne 0x14003764e
cmp word [rcx + 0xa], 0x2e
jne 0x14003764e
cmp word [rcx + 0xc], 0x64
jne 0x14003764e
cmp word [rcx + 0xe], 0x6c
jne 0x14003764e
cmp word [rcx + 0x10], 0x6c
jne 0x14003764e
mov rsi, qword [rsp + 0x58]
lea r15, [rsp + 0x132]
lea rdi, [0x1402a3620]
movabs rbx, 0x9aaaaaa0000aaaa
jmp 0x140036c0e
mov r8, rax
jmp 0x14003796b
mov edx, eax
jmp 0x1400379ac
test al, al
js 0x140037e6c
lea rcx, [r12 + 0x18]
jmp 0x140037e71
mov rcx, qword [r12 + 0x18]
cmp word [rcx], 0x6e
jne 0x1400378b1
cmp word [rcx + 2], 0x74
jne 0x1400378b1
cmp word [rcx + 4], 0x64
jne 0x1400378b1
cmp word [rcx + 6], 0x6c
jne 0x1400378b1
cmp word [rcx + 8], 0x6c
jne 0x1400378b1
cmp word [rcx + 0xa], 0x2e
jne 0x1400378b1
cmp word [rcx + 0xc], 0x64
jne 0x1400378b1
cmp word [rcx + 0xe], 0x6c
jne 0x1400378b1
cmp word [rcx + 0x10], 0x6c
jne 0x1400378b1
mov rbp, qword [rsp + 0x60]
jmp 0x140036cad
mov rcx, qword [r13 + 0x48]
call fcn.14019cac4
jmp 0x140037a5f
mov rcx, qword [r13 + 0x30]
call fcn.14019cac4
jmp 0x140037a6a
mov rcx, qword [rbp + 0x10]
mov qword [rsp + 0x130], rcx
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x120], xmm0
mov ecx, eax
jmp 0x1400378ed
int3
int3