Function at 0x140002da0
Capabilities:
Enumerate process modules
Print debug messages

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb08
movaps xmmword [rsp + 0xaf0], xmm15
movaps xmmword [rsp + 0xae0], xmm14
movdqa xmmword [rsp + 0xad0], xmm13
movdqa xmmword [rsp + 0xac0], xmm12
movaps xmmword [rsp + 0xab0], xmm11
movaps xmmword [rsp + 0xaa0], xmm10
movaps xmmword [rsp + 0xa90], xmm9
movaps xmmword [rsp + 0xa80], xmm8
movdqa xmmword [rsp + 0xa70], xmm7
movdqa xmmword [rsp + 0xa60], xmm6
mov qword [rsp + 0x318], rdx
mov qword [rsp + 0x310], rcx
lea rcx, [rsp + 0x690]
mov r8d, 0x190
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x140045520]
movaps xmmword [rsp + 0x620], xmm0
movaps xmm0, xmmword [0x140045530]
movaps xmmword [rsp + 0x630], xmm0
movaps xmm0, xmmword [0x140045540]
movaps xmmword [rsp + 0x640], xmm0
movaps xmm0, xmmword [0x140045550]
movaps xmmword [rsp + 0x650], xmm0
movaps xmm0, xmmword [0x140045560]
movaps xmmword [rsp + 0x660], xmm0
movaps xmm0, xmmword [0x140045570]
movaps xmmword [rsp + 0x670], xmm0
movdqa xmm0, xmmword [0x140045580]
movdqa xmmword [rsp + 0x680], xmm0
lea rcx, [rsp + 0x620]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
mov edx, 0x208
mov ecx, 8
call fcn.14003d410
test rax, rax
je 0x140006fe7
mov rsi, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x104
call qword [sym.imp.kernel32.dll_GetModuleFileNameW]
test eax, eax
je 0x140002f63
mov ecx, eax
cmp eax, 0x105
jae 0x140007053
lea rax, [rsi + rcx*2]
mov qword [rsp + 0x620], rsi
mov qword [rsp + 0x628], rax
mov word [rsp + 0x630], 0
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x620]
call fcn.140012df0
mov rcx, qword [0x140055160]
xor edi, edi
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
cmp rdi, qword [rsp + 0xf0]
jo 0x140002f75
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x350], rax
movdqu xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x340], xmm0
jmp 0x140002f99
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
mov qword [rsp + 0x340], 0
mov qword [rsp + 0x348], 1
mov qword [rsp + 0x350], 0
lea rax, [rsp + 0x340]
mov qword [rsp + 0xf0], rax
lea rbx, [0x140002010]
mov qword [rsp + 0xf8], rbx
lea rax, [0x140046960]
mov qword [rsp + 0x620], rax
mov qword [rsp + 0x628], 1
mov qword [rsp + 0x640], 0
lea r15, [rsp + 0xf0]
mov qword [rsp + 0x630], r15
mov qword [rsp + 0x638], 1
lea rcx, [rsp + 0x458]
lea rdx, [rsp + 0x620]
call fcn.140018ad0
mov rdi, qword [rsp + 0x458]
mov rsi, qword [rsp + 0x460]
mov r14, qword [rsp + 0x468]
lea rcx, [rsp + 0x620]
mov r8d, 0x200
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp r14, 0xff
mov eax, 0xff
cmovb rax, r14
test r14, r14
je 0x14000310a
lea rcx, [rax - 1]
cmp r14, rcx
cmovb rcx, r14
inc rcx
cmp rcx, 0x11
jae 0x140003074
xor ecx, ecx
mov rdx, rsi
mov r8, rax
jmp 0x1400030d8
mov edx, ecx
and edx, 0xf
mov r8d, 0x10
cmovne r8, rdx
sub rcx, r8
lea rdx, [rsi + rcx]
xor r8d, r8d
pxor xmm0, xmm0
nop word cs:[rax + rax]
movq xmm1, qword [rsi + r8]
movq xmm2, qword [rsi + r8 + 8]
punpcklbw xmm1, xmm0
punpcklbw xmm2, xmm0
movdqu xmmword [rsp + r8*2 + 0x620], xmm1
movdqu xmmword [rsp + r8*2 + 0x630], xmm2
add r8, 0x10
cmp rcx, r8
jne 0x1400030a0
mov r8, rax
sub r8, rcx
add r14, rsi
lea rcx, [rsp + rcx*2]
add rcx, 0x620
xor r9d, r9d
nop dword [rax]
lea r10, [rdx + r9]
cmp r10, r14
je 0x14000310a
movzx r10d, byte [r10]
mov word [rcx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x1400030f0
mov word [rsp + rax*2 + 0x620], 0
lea rcx, [rsp + 0x620]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
test rdi, rdi
je 0x140003139
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
mov ecx, 8
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
inc rax
cmp rax, 1
ja 0x14000319b
call qword [sym.imp.kernel32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
mov esi, 0x535f4f4b
cmovne esi, ecx
cmp qword [rsp + 0x340], 0
je 0x140006e46
mov r8, qword [rsp + 0x348]
mov rcx, qword [0x140055160]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140006e46
lea rcx, [rsp + 0x620]
mov r8d, 0x438
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x620], 0x438
mov eax, dword [0x1400551cc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x48], 0
je 0x1400031fa
mov eax, dword [0x1400551cc]
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx + rax*8]
mov rax, qword [rcx + 0x50]
mov rcx, qword [rcx + 0x58]
jmp 0x14000324b
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xf0], xmm0
lea rcx, [rsp + 0xf0]
mov edx, 0x10
call qword [sym.imp.bcryptprimitives.dll_ProcessPrng]
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xf8]
mov edx, dword [0x1400551cc]
mov r8, qword gs:[0x58]
mov rdx, qword [r8 + rdx*8]
mov byte [rdx + 0x48], 1
mov qword [rdx + 0x58], rcx
lea rdx, [rax + 1]
mov r8d, dword [0x1400551cc]
mov r9, qword gs:[0x58]
mov r8, qword [r9 + r8*8]
mov qword [r8 + 0x50], rdx
movups xmm0, xmmword [0x1400481a0]
movaps xmmword [rsp + 0x360], xmm0
movdqu xmm0, xmmword [0x1400481b0]
movdqa xmmword [rsp + 0x370], xmm0
mov qword [rsp + 0x380], rax
mov qword [rsp + 0x388], rcx
lea rdx, [rsp + 0x620]
mov rcx, rbp
call qword [sym.imp.kernel32.dll_Module32FirstW]
test eax, eax
je 0x140006eb4
mov qword [rsp + 0x3e0], 0
lea r12, [rsp + 0xb8]
mov r13, qword [sym.imp.kernel32.dll_HeapFree]
pxor xmm6, xmm6
pcmpeqd xmm7, xmm7
movaps xmm8, xmmword [str.Handling_ntdll.dll_with_NtOpenFiFailed_to_retrieve_full_path_forSuccessfully_remapped_all_accessible_process_modules_using_NT_functions.Function_not_found_in_export_directory.]
movaps xmm9, xmmword [0x1400455a0]
movaps xmm10, xmmword [0x1400455b0]
movaps xmm11, xmmword [0x1400455c0]
movaps xmm14, xmmword [0x1400455f0]
movaps xmm15, xmmword [0x140045600]
mov qword [rsp + 0xd0], rbp
nop
mov ecx, 0x208
xor eax, eax
nop word [rax + rax]
cmp word [rsp + rax*2 + 0x850], 0
je 0x140003380
cmp word [rsp + rax*2 + 0x852], 0
je 0x140003368
cmp word [rsp + rax*2 + 0x854], 0
je 0x14000336d
cmp word [rsp + rax*2 + 0x856], 0
je 0x140003373
cmp word [rsp + rax*2 + 0x858], 0
je 0x140003379
add rax, 5
add rcx, 0xfffffffffffffff6
jne 0x140003320
mov eax, 0x104
jmp 0x140003380
inc rax
jmp 0x140003380
add rax, 2
jmp 0x140003380
add rax, 3
jmp 0x140003380
add rax, 4
nop dword [rax]
lea rcx, [rsp + 0x850]
lea rax, [rcx + rax*2]
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0xf8], rax
mov word [rsp + 0x100], 0
mov rcx, r12
mov rdx, r15
call fcn.140012df0
mov rsi, qword [rsp + 0xc8]
cmp rsi, qword [rsp + 0x350]
jne 0x1400033e3
mov rdx, qword [rsp + 0x348]
mov rcx, qword [rsp + 0xc0]
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000369e
cmp qword [rsp + 0x378], 0
je 0x1400035c0
movaps xmm0, xmmword [rsp + 0x380]
mov rdi, qword [rsp + 0xc0]
movaps xmmword [rsp + 0x5c0], xmm0
lea rcx, [rsp + 0x5c0]
mov rdx, rdi
mov r8, rsi
call fcn.140014a70
mov r14, qword [rsp + 0x360]
mov r15, qword [rsp + 0x368]
mov r12, r15
and r12, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm12, xmm0, 0
lea r13, [r14 - 0x18]
xor ebp, ebp
movdqu xmm13, xmmword [r14 + r12]
movdqa xmm0, xmm13
pcmpeqb xmm0, xmm12
pmovmskb ebx, xmm0
test ebx, ebx
jne 0x14000349a
pcmpeqb xmm13, xmm7
pmovmskb eax, xmm13
test eax, eax
jne 0x1400035c0
add r12, rbp
add r12, 0x10
add rbp, 0x10
and r12, r15
jmp 0x140003450
lea eax, [rbx - 1]
and ax, bx
mov ebx, eax
je 0x140003468
tzcnt eax, ebx
add rax, r12
and rax, r15
neg rax
lea rax, [rax + rax*2]
cmp rsi, qword [r13 + rax*8 + 0x10]
jne 0x140003490
lea rax, [rax*8]
add rax, r13
mov rdx, qword [rax + 8]
mov rcx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140003490
lea r12, [rsp + 0xb8]
mov qword [rsp + 0x50], r12
lea rbx, [0x140002010]
mov qword [rsp + 0x58], rbx
lea rax, str.Module__already_remapped__skipping...
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 2
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 1
lea rcx, [rsp + 0x4d0]
lea r15, [rsp + 0xf0]
mov rdx, r15
call fcn.140018ad0
mov rdi, qword [rsp + 0x4d0]
mov rsi, qword [rsp + 0x4d8]
mov r14, qword [rsp + 0x4e0]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp r14, 0xff
mov eax, 0xff
cmovb rax, r14
test r14, r14
mov r13, qword [sym.imp.kernel32.dll_HeapFree]
mov rbp, qword [rsp + 0xd0]
je 0x140004490
lea rdx, [rax - 1]
cmp r14, rdx
cmovb rdx, r14
inc rdx
cmp rdx, 0x11
jae 0x14000375e
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x1400037b8
lea r12, [rsp + 0xb8]
mov qword [rsp + 0x50], r12
lea rbx, [0x140002010]
mov qword [rsp + 0x58], rbx
lea rax, str.Processing_module:
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 1
lea rcx, [rsp + 0x488]
lea r15, [rsp + 0xf0]
mov rdx, r15
call fcn.140018ad0
mov rdi, qword [rsp + 0x488]
mov rsi, qword [rsp + 0x490]
mov r14, qword [rsp + 0x498]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp r14, 0xff
mov eax, 0xff
cmovb rax, r14
test r14, r14
mov r13, qword [sym.imp.kernel32.dll_HeapFree]
je 0x14000387a
lea rdx, [rax - 1]
cmp r14, rdx
cmovb rdx, r14
inc rdx
cmp rdx, 0x11
jae 0x1400037f3
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x140003848
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rbx
lea rax, str.Skipping_current_executable:
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 1
lea rcx, [rsp + 0x470]
mov rdx, r15
call fcn.140018ad0
mov rdi, qword [rsp + 0x470]
mov rsi, qword [rsp + 0x478]
mov r14, qword [rsp + 0x480]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp r14, 0xff
mov eax, 0xff
cmovb rax, r14
test r14, r14
je 0x140004490
lea rdx, [rax - 1]
cmp r14, rdx
cmovb rdx, r14
inc rdx
cmp rdx, 0x11
jae 0x140004400
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x140004458
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
nop word [rax + rax]
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x140003780
mov r8, rax
sub r8, rdx
add r14, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
nop dword [rax]
lea r10, [rcx + r9]
cmp r10, r14
je 0x140004490
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x1400037d0
jmp 0x140004490
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
nop dword [rax]
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x140003810
mov r8, rax
sub r8, rdx
add r14, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
nop dword [rax]
lea r10, [rcx + r9]
cmp r10, r14
je 0x14000387a
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x140003860
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
test rdi, rdi
je 0x1400038a1
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
movdqu xmm0, xmmword [rsp + 0xc0]
movdqu xmmword [rsp + 0x88], xmm0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x390], rax
lea rax, [0x140014a50]
mov qword [rsp + 0x398], rax
lea rax, [0x140046368]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x390]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 1
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.140018ad0
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rdi, 0xff
mov eax, 0xff
cmovb rax, rdi
test rdi, rdi
mov rbp, qword [rsp + 0xd0]
je 0x140003a0a
lea rdx, [rax - 1]
cmp rdi, rdx
cmovb rdx, rdi
inc rdx
cmp rdx, 0x11
jae 0x14000397b
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x1400039d8
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
nop word cs:[rax + rax]
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x1400039a0
mov r8, rax
sub r8, rdx
add rdi, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
nop dword [rax]
lea r10, [rcx + r9]
cmp r10, rdi
je 0x140003a0a
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x1400039f0
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0x50], 0
je 0x140003a34
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
mov edx, 0x208
mov ecx, 8
call fcn.14003d410
test rax, rax
je 0x140006fe7
mov rdi, rax
mov rax, qword [rsp + 0x90]
cmp rax, 9
mov qword [rsp + 0x80], rdi
jb 0x140003a91
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rcx + rax - 9]
movabs r8, 0x6c642e6c6c64746e
xor rdx, r8
movzx eax, byte [rcx + rax - 1]
xor rax, 0x6c
or rax, rdx
je 0x140003dbb
lea rax, [rsp + 0x88]
mov qword [rsp + 0x50], rax
lea rax, [0x140014a50]
mov qword [rsp + 0x58], rax
lea rax, [0x1400463a0]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 1
lea rcx, [rsp + 0x4e8]
mov rdx, r15
call fcn.140018ad0
mov rdi, qword [rsp + 0x4e8]
mov rsi, qword [rsp + 0x4f0]
mov r14, qword [rsp + 0x4f8]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp r14, 0xff
mov eax, 0xff
cmovb rax, r14
test r14, r14
je 0x140003bea
lea rdx, [rax - 1]
cmp r14, rdx
cmovb rdx, r14
inc rdx
cmp rdx, 0x11
jae 0x140003b59
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x140003bb8
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
nop word cs:[rax + rax]
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x140003b80
mov r8, rax
sub r8, rdx
add r14, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
nop dword [rax]
lea r10, [rcx + r9]
cmp r10, r14
je 0x140003bea
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x140003bd0
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
test rdi, rdi
je 0x140003c11
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
add rcx, rax
mov qword [rsp + 0x580], rax
mov qword [rsp + 0x588], rcx
mov word [rsp + 0x590], 0
mov dword [rsp + 0x598], 1
lea rcx, [rsp + 0x390]
lea rdx, [rsp + 0x580]
call fcn.1400152b0
mov rsi, qword [rsp + 0x398]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
mov rdi, qword [rsp + 0x80]
je 0x140006ff6
mov rcx, rax
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.kernel32.dll_GetModuleFileNameW]
test eax, eax
je 0x140003cf4
cmp eax, 0x104
mov ecx, 0x104
cmovae eax, ecx
lea rax, [rdi + rax*2]
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xf8], rax
mov word [rsp + 0x100], 0
lea rcx, [rsp + 0x400]
mov rdx, r15
call fcn.140012df0
cmp qword [rsp + 0x390], 0
je 0x140003ee0
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
jmp 0x140003ee0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x98], rax
lea rax, [0x140014a50]
mov qword [rsp + 0xa0], rax
lea rax, str.Failed_to_retrieve_full_path_for
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x98]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 1
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.140018ad0
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rdi, 0xff
mov eax, 0xff
cmovb rax, rdi
test rdi, rdi
je 0x14000467a
lea rdx, [rax - 1]
cmp rdi, rdx
cmovb rdx, rdi
inc rdx
cmp rdx, 0x11
jae 0x1400045ec
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x140004648
mov r8d, 0x1b8
lea rcx, [rsp + 0x138]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmmword [rsp + 0xf0], xmm8
movaps xmmword [rsp + 0x100], xmm9
movaps xmmword [rsp + 0x110], xmm10
movaps xmmword [rsp + 0x120], xmm11
movabs rax, 0x2e0065006c
mov qword [rsp + 0x130], rax
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
lea rax, str.ntdll.dllGetting_full_path_for_module:
mov qword [rsp + 0x560], rax
lea rax, [0x140046381]
mov qword [rsp + 0x568], rax
mov word [rsp + 0x570], 0
mov dword [rsp + 0x578], 1
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x560]
call fcn.1400152b0
mov r12, qword [rsp + 0x58]
mov rcx, r12
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14000708e
mov rcx, rax
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.kernel32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000475a
cmp eax, 0x104
mov ecx, 0x104
cmovae eax, ecx
lea rax, [rdi + rax*2]
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xf8], rax
mov word [rsp + 0x100], 0
lea rcx, [rsp + 0x400]
mov rdx, r15
call fcn.140012df0
cmp qword [rsp + 0x50], 0
je 0x140003ed7
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, r12
call r13
lea r12, [rsp + 0xb8]
nop
lea rax, [rsp + 0x88]
mov qword [rsp + 0x50], rax
lea rax, [0x140014a50]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x400]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
lea rax, str.Full_path_for
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 2
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 2
lea rcx, [rsp + 0x500]
mov rdx, r15
call fcn.140018ad0
mov rdi, qword [rsp + 0x500]
mov rsi, qword [rsp + 0x508]
mov r14, qword [rsp + 0x510]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp r14, 0xff
mov eax, 0xff
cmovb rax, r14
test r14, r14
je 0x14000404a
lea rdx, [rax - 1]
cmp r14, rdx
cmovb rdx, r14
inc rdx
cmp rdx, 0x11
jae 0x140003fba
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x140004018
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
nop word cs:[rax + rax]
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x140003fe0
mov r8, rax
sub r8, rdx
add r14, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
nop dword [rax]
lea r10, [rcx + r9]
cmp r10, r14
je 0x14000404a
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x140004030
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
test rdi, rdi
je 0x140004071
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
lea rax, [rsp + 0x400]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
lea rax, str.___
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
mov qword [rsp + 0x110], 0
lea rsi, [rsp + 0x50]
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0x108], 1
lea rcx, [rsp + 0x5e8]
mov rdx, r15
call fcn.140018ad0
movdqu xmm0, xmmword [rsp + 0x5e8]
movdqa xmmword [rsp + 0x3c0], xmm0
mov rax, qword [rsp + 0x5f8]
mov qword [rsp + 0x3d0], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x50], rax
lea rax, [0x140014a50]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x3c0]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
lea rax, str.NT_native_path_for
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 2
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0x108], 2
lea rcx, [rsp + 0x518]
mov rdx, r15
call fcn.140018ad0
mov rdi, qword [rsp + 0x518]
mov rsi, qword [rsp + 0x520]
mov r14, qword [rsp + 0x528]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp r14, 0xff
mov eax, 0xff
cmovb rax, r14
test r14, r14
je 0x14000425a
lea rdx, [rax - 1]
cmp r14, rdx
cmovb rdx, r14
inc rdx
cmp rdx, 0x11
jae 0x1400041ca
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x140004228
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
nop word cs:[rax + rax]
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x1400041f0
mov r8, rax
sub r8, rdx
add r14, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
nop dword [rax]
lea r10, [rcx + r9]
cmp r10, r14
je 0x14000425a
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x140004240
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
test rdi, rdi
je 0x140004281
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
mov rax, qword [rsp + 0x318]
mov qword [rsp + 0x20], rax
mov r8d, 0xa
mov rcx, r15
lea rdx, [0x14004633d]
mov r9, qword [rsp + 0x310]
call fcn.140002100
cmp dword [rsp + 0xf0], 1
cmp qword [rsp + 0xf8], 0
je 0x1400042d2
mov r8, qword [rsp + 0x100]
mov rcx, qword [0x140055160]
xor edx, edx
call r13
mov edx, 0xa
lea rcx, [0x14004633d]
call fcn.14000ad50
test rax, rax
sete al
test rdx, rdx
sete cl
or cl, al
je 0x1400043be
lea rax, [rsp + 0x88]
mov qword [rsp + 0x390], rax
lea rax, [0x140014a50]
mov qword [rsp + 0x398], rax
lea rax, str.Failed_to_resolve_NtOpenFile_for
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 2
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x390]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 1
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.140018ad0
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rdi, 0xff
mov eax, 0xff
cmovb rax, rdi
test rdi, rdi
je 0x14000457a
lea rdx, [rax - 1]
cmp rdi, rdx
cmovb rdx, rdi
inc rdx
cmp rdx, 0x11
jae 0x1400044eb
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x140004548
mov rsi, rdx
mov rax, qword [rsp + 0x3d0]
test rax, rax
je 0x1400044c0
mov r14, qword [rsp + 0x3c8]
movzx edx, byte [r14]
movzx edi, dl
test dil, dil
js 0x1400046f1
lea rbp, [r14 + 1]
movabs r9, 0xaaaaaaaaaaaaaaab
xor r15d, r15d
jmp 0x140004850
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
nop dword [rax]
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x140004420
mov r8, rax
sub r8, rdx
add r14, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
nop dword [rax]
lea r10, [rcx + r9]
cmp r10, r14
je 0x140004490
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x140004470
nop word [rax + rax]
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
test rdi, rdi
je 0x140005954
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
jmp 0x140005954
mov qword [rsp + 0x320], 0
mov qword [rsp + 0x328], 2
mov qword [rsp + 0x330], 0
xor edi, edi
jmp 0x140004a78
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
nop word cs:[rax + rax]
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x140004510
mov r8, rax
sub r8, rdx
add rdi, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
nop dword [rax]
lea r10, [rcx + r9]
cmp r10, rdi
je 0x14000457a
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x140004560
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0x50], 0
je 0x1400045a4
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
mov esi, 0x80004005
mov r8d, 0x1c
mov ecx, 0x80004005
lea rdx, str.Failed_to_resolve_NtOpenFileFailed_to_resolve_NtCreateSection_for_module:
call fcn.140041340
mov qword [rsp + 0xf0], 0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
mov r14, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0x80]
jmp 0x140005762
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
nop word cs:[rax + rax]
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x140004610
mov r8, rax
sub r8, rdx
add rdi, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
nop dword [rax]
lea r10, [rcx + r9]
cmp r10, rdi
je 0x14000467a
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x140004660
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0x50], 0
je 0x1400046a4
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
call qword [sym.imp.kernel32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
mov eax, 0x535f4f4b
cmove esi, eax
cmp qword [rsp + 0x390], 0
mov rdi, qword [rsp + 0x80]
je 0x1400046e9
mov r8, qword [rsp + 0x398]
mov rcx, qword [0x140055160]
xor edx, edx
call r13
xor r14d, r14d
jmp 0x1400057a0
mov ecx, edi
and ecx, 0x1f
movzx r8d, byte [r14 + 1]
and r8d, 0x3f
cmp dil, 0xdf
movabs r9, 0xaaaaaaaaaaaaaaab
jbe 0x14000480a
movzx edi, byte [r14 + 2]
shl r8d, 6
and edi, 0x3f
or edi, r8d
cmp dl, 0xf0
jb 0x14000481b
lea rbp, [r14 + 4]
movzx edx, byte [r14 + 3]
and ecx, 7
shl ecx, 0x12
shl edi, 6
and edx, 0x3f
or edx, edi
or edx, ecx
mov edi, edx
cmp edi, 0xffff
ja 0x140004830
xor r15d, r15d
jmp 0x140004850
mov r8d, 0x1a8
lea rcx, [rsp + 0x148]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x1400455d0]
movaps xmmword [rsp + 0xf0], xmm0
movdqa xmm0, xmmword [0x1400455e0]
movdqa xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0x110], xmm14
movaps xmmword [rsp + 0x120], xmm15
movaps xmmword [rsp + 0x130], xmm9
movabs rax, 0x2e006c006c
mov qword [rsp + 0x140], rax
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
call qword [sym.imp.kernel32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
mov eax, 0x535f4f4b
cmove esi, eax
cmp qword [rsp + 0x50], 0
je 0x1400047fa
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, r12
call r13
xor r14d, r14d
lea r12, [rsp + 0xb8]
jmp 0x1400057a0
lea rbp, [r14 + 2]
shl ecx, 6
or ecx, r8d
mov edi, ecx
xor r15d, r15d
jmp 0x140004850
lea rbp, [r14 + 3]
shl ecx, 0xc
or edi, ecx
cmp edi, 0xffff
jbe 0x140004752
lea ecx, [rdi + 0xff0000]
shr ecx, 0xa
or ecx, 0xd800
and edi, 0x3ff
or edi, 0xdc00
mov r15d, edi
mov edi, ecx
add r14, rax
lea r13, [r14 + 2]
mov rax, r13
sub rax, rbp
mul r9
shr rdx, 1
cmp r15w, 1
sbb rdx, 0xffffffffffffffff
cmp rdx, 4
mov ebx, 3
cmovae rbx, rdx
movabs rax, 0x3ffffffffffffffe
cmp rdx, rax
ja 0x140007079
inc rbx
lea r12, [rbx + rbx]
movzx eax, byte [0x1400551c8]
xor ecx, ecx
mov rdx, r12
call fcn.14003d410
test rax, rax
je 0x140007064
mov word [rax], di
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf8], rax
mov r12d, 1
mov qword [rsp + 0x3e8], rax
movabs rbx, 0xaaaaaaaaaaaaaaab
jmp 0x1400048eb
mov word [rax + r12*2], r15w
inc r12
mov r15d, edi
mov qword [rsp + 0x100], r12
test r15w, r15w
jne 0x140004990
cmp rbp, r14
je 0x140004a2e
movzx edx, byte [rbp]
movzx r15d, dl
test r15b, r15b
js 0x140004924
inc rbp
xor edi, edi
cmp r12, qword [rsp + 0xf0]
jne 0x1400048e0
jmp 0x1400049a0
mov ecx, r15d
and ecx, 0x1f
movzx r8d, byte [rbp + 1]
and r8d, 0x3f
cmp r15b, 0xdf
jbe 0x14000497a
movzx r15d, byte [rbp + 2]
shl r8d, 6
and r15d, 0x3f
or r15d, r8d
cmp dl, 0xf0
jb 0x1400049e4
movzx edx, byte [rbp + 3]
add rbp, 4
and ecx, 7
shl ecx, 0x12
shl r15d, 6
and edx, 0x3f
or edx, r15d
or edx, ecx
mov r15d, edx
cmp r15d, 0xffff
jbe 0x140004990
jmp 0x1400049f7
add rbp, 2
shl ecx, 6
or ecx, r8d
mov r15d, ecx
nop word [rax + rax]
xor edi, edi
cmp r12, qword [rsp + 0xf0]
jne 0x1400048e0
mov rax, r13
sub rax, rbp
mul rbx
shr rdx, 1
cmp di, 1
sbb rdx, 0
lea r8, [rdx + 2]
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rsp + 0xf0]
mov rdx, r12
call fcn.140043000
mov rax, qword [rsp + 0xf8]
jmp 0x1400048e0
add rbp, 3
shl ecx, 0xc
or r15d, ecx
cmp r15d, 0xffff
jbe 0x140004990
lea ecx, [r15 + 0xff0000]
shr ecx, 0xa
or ecx, 0xd800
and r15d, 0x3ff
or r15d, 0xdc00
mov edi, r15d
mov r15d, ecx
cmp r12, qword [rsp + 0xf0]
jne 0x1400048e0
jmp 0x1400049a0
mov rdi, qword [rsp + 0x100]
mov qword [rsp + 0x330], rdi
movdqu xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x320], xmm0
cmp rdi, qword [rsp + 0x320]
lea rbx, [0x140002010]
lea r15, [rsp + 0xf0]
mov r13, qword [sym.imp.kernel32.dll_HeapFree]
mov rbp, qword [rsp + 0xd0]
jne 0x140004a85
lea rcx, [rsp + 0x320]
call fcn.1400129a0
mov rax, qword [rsp + 0x328]
mov word [rax + rdi*2], 0
inc rdi
mov qword [rsp + 0x330], rdi
mov ecx, edi
add ecx, edi
lea edx, [rdi*2 - 2]
mov word [rsp + 0x428], dx
mov word [rsp + 0x42a], cx
mov qword [rsp + 0x430], rax
mov dword [rsp + 0x390], 0x30
mov qword [rsp + 0x398], 0
lea rax, [rsp + 0x428]
mov qword [rsp + 0x3a0], rax
mov dword [rsp + 0x3a8], 0x40
lea rax, [rsp + 0x3b0]
movdqu xmmword [rax], xmm6
movdqa xmmword [rsp + 0x5d0], xmm6
mov qword [rsp + 0x3f0], 0
lea rax, [rsp + 0x3c0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
lea rax, str.Calling_NtOpenFile_for
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 1
lea rcx, [rsp + 0x530]
mov rdx, r15
call fcn.140018ad0
mov rdi, qword [rsp + 0x530]
mov r12, qword [rsp + 0x538]
mov r14, qword [rsp + 0x540]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp r14, 0xff
mov eax, 0xff
cmovb rax, r14
test r14, r14
je 0x140004c5a
lea rdx, [rax - 1]
cmp r14, rdx
cmovb rdx, r14
inc rdx
cmp rdx, 0x11
jae 0x140004bd5
mov rcx, r12
xor edx, edx
mov r8, rax
jmp 0x140004c28
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [r12 + rdx]
xor r8d, r8d
nop
movq xmm0, qword [r12 + r8]
movq xmm1, qword [r12 + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x140004bf0
mov r8, rax
sub r8, rdx
add r14, r12
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
nop dword [rax]
lea r10, [rcx + r9]
cmp r10, r14
je 0x140004c5a
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x140004c40
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
test rdi, rdi
je 0x140004c81
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, r12
call r13
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 1
lea rdi, [rsp + 0x3f0]
mov rcx, rdi
mov edx, 0x80100000
lea r8, [rsp + 0x390]
lea r9, [rsp + 0x5d0]
call rsi
mov dword [rsp + 0xe0], eax
test eax, eax
je 0x140004e27
lea rax, [rsp + 0x88]
mov qword [rsp + 0x98], rax
lea rax, [0x140014a50]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0xa8], rax
lea rax, [0x14001c4e0]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xf0], 2
mov qword [rsp + 0x100], 2
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0x20
mov byte [rsp + 0x120], 3
mov qword [rsp + 0x128], 2
mov qword [rsp + 0x138], 2
mov qword [rsp + 0x148], 1
movabs rax, 0x400000020
mov qword [rsp + 0x150], rax
mov byte [rsp + 0x158], 3
lea rax, [0x140046778]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 2
lea rax, [rsp + 0x98]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rcx, [rsp + 0x2f8]
lea rdx, [rsp + 0x50]
call fcn.140018ad0
mov rsi, qword [rsp + 0x300]
mov rdi, qword [rsp + 0x308]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rdi, 0xff
mov eax, 0xff
cmovb rax, rdi
test rdi, rdi
lea r12, [rsp + 0xb8]
je 0x140004f9a
lea rdx, [rax - 1]
cmp rdi, rdx
cmovb rdx, rdi
inc rdx
cmp rdx, 0x11
jae 0x140004f0f
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x140004f68
lea rax, [rsp + 0x88]
mov qword [rsp + 0x50], rax
lea rax, [0x140014a50]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rdi
lea rax, [0x140002030]
mov qword [rsp + 0x68], rax
lea rax, str.NtOpenFile_succeeded_for
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 2
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 2
lea rcx, [rsp + 0x548]
mov rdx, r15
call fcn.140018ad0
mov rdi, qword [rsp + 0x548]
mov rsi, qword [rsp + 0x550]
mov r14, qword [rsp + 0x558]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp r14, 0xff
mov eax, 0xff
cmovb rax, r14
test r14, r14
lea r12, [rsp + 0xb8]
je 0x14000516a
lea rdx, [rax - 1]
cmp r14, rdx
cmovb rdx, r14
inc rdx
cmp rdx, 0x11
jae 0x1400050d8
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x140005138
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
nop dword [rax + rax]
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x140004f30
mov r8, rax
sub r8, rdx
add rdi, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
nop dword [rax]
lea r10, [rcx + r9]
cmp r10, rdi
je 0x140004f9a
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x140004f80
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0x2f8], 0
je 0x140004fc7
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
mov esi, dword [rsp + 0xe0]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x50], rax
lea rax, [0x140014a50]
mov qword [rsp + 0x58], rax
lea rax, [0x140046798]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 1
lea rcx, [rsp + 0x440]
mov rdx, r15
call fcn.140018ad0
mov r8, qword [rsp + 0x450]
test r8, r8
mov rdi, qword [rsp + 0x80]
je 0x140005094
mov rdx, qword [rsp + 0x448]
mov ecx, esi
call fcn.140041340
test esi, esi
mov eax, 0x535f4f4b
cmove esi, eax
mov qword [rsp + 0xf0], 0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
mov r14, qword [rsp + 0xf0]
cmp qword [rsp + 0x440], 0
jne 0x1400050b0
jmp 0x140005743
test esi, esi
mov eax, 0x535f4f4b
cmove esi, eax
xor r14d, r14d
cmp qword [rsp + 0x440], 0
je 0x140005743
mov r8, qword [rsp + 0x448]
mov rcx, qword [0x140055160]
xor edx, edx
call r13
cmp qword [rsp + 0x320], 0
jne 0x14000574e
jmp 0x140005762
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
nop word cs:[rax + rax]
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x140005100
mov r8, rax
sub r8, rdx
add r14, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
nop dword [rax]
lea r10, [rcx + r9]
cmp r10, r14
je 0x14000516a
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x140005150
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
test rdi, rdi
je 0x140005191
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
mov rax, qword [rsp + 0x318]
mov qword [rsp + 0x20], rax
mov r8d, 0xf
mov rcx, r15
lea rdx, str.NtCreateSectionNtMapViewOfSectionNtUnmapViewOfSectionNtOpenFileStarting_remapping_of_module:
mov r9, qword [rsp + 0x310]
call fcn.140002100
cmp dword [rsp + 0xf0], 1
cmp qword [rsp + 0xf8], 0
je 0x1400051e2
mov r8, qword [rsp + 0x100]
mov rcx, qword [0x140055160]
xor edx, edx
call r13
mov edx, 0xf
lea rcx, str.NtCreateSectionNtMapViewOfSectionNtUnmapViewOfSectionNtOpenFileStarting_remapping_of_module:
call fcn.14000ad50
test rax, rax
sete al
test rdx, rdx
sete cl
or cl, al
je 0x1400052ce
lea rax, [rsp + 0x88]
mov qword [rsp + 0x98], rax
lea rax, [0x140014a50]
mov qword [rsp + 0xa0], rax
lea rax, [0x140046840]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x98]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 1
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.140018ad0
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rdi, 0xff
mov eax, 0xff
cmovb rax, rdi
test rdi, rdi
je 0x1400055fa
lea rdx, [rax - 1]
cmp rdi, rdx
cmovb rdx, rdi
inc rdx
cmp rdx, 0x11
jae 0x140005568
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x1400055c8
mov r10, rdx
mov qword [rsp + 0xd8], 0
mov rax, qword [rsp + 0x3f0]
mov qword [rsp + 0x600], 0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 2
lea rsi, [rsp + 0xd8]
mov rcx, rsi
mov edx, 4
xor r8d, r8d
lea r9, [rsp + 0x600]
call r10
mov dword [rsp + 0xe4], eax
test eax, eax
je 0x140005490
lea rax, [rsp + 0x88]
mov qword [rsp + 0x98], rax
lea rax, [0x140014a50]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xe4]
mov qword [rsp + 0xa8], rax
lea rax, [0x14001c4e0]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xf0], 2
mov qword [rsp + 0x100], 2
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0x20
mov byte [rsp + 0x120], 3
mov qword [rsp + 0x128], 2
mov qword [rsp + 0x138], 2
mov qword [rsp + 0x148], 1
movabs rax, 0x400000020
mov qword [rsp + 0x150], rax
mov byte [rsp + 0x158], 3
lea rax, [0x140046728]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 2
lea rax, [rsp + 0x98]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rcx, [rsp + 0x2f8]
lea rdx, [rsp + 0x50]
call fcn.140018ad0
mov rsi, qword [rsp + 0x300]
mov rdi, qword [rsp + 0x308]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rdi, 0xff
mov eax, 0xff
cmovb rax, rdi
test rdi, rdi
je 0x1400056ca
lea rdx, [rax - 1]
cmp rdi, rdx
cmovb rdx, rdi
inc rdx
cmp rdx, 0x11
jae 0x140005645
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x140005698
lea rax, [rsp + 0x88]
mov qword [rsp + 0x50], rax
lea rax, [0x140014a50]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rsi
lea rax, [0x140002030]
mov qword [rsp + 0x68], rax
lea rax, str.NtCreateSection_succeeded_for_module:___section_handle:
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 2
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 2
lea rcx, [rsp + 0x98]
mov rdx, r15
call fcn.140018ad0
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rdi, 0xff
mov eax, 0xff
cmovb rax, rdi
test rdi, rdi
je 0x140005a1a
lea rdx, [rax - 1]
cmp rdi, rdx
cmovb rdx, rdi
inc rdx
cmp rdx, 0x11
jae 0x140005995
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x1400059e8
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
nop word cs:[rax + rax]
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x140005590
mov r8, rax
sub r8, rdx
add rdi, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
nop dword [rax]
lea r10, [rcx + r9]
cmp r10, rdi
je 0x1400055fa
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x1400055e0
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0x50], 0
je 0x140005624
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
mov esi, 0x80004005
mov r8d, 0x21
mov ecx, 0x80004005
lea rdx, str.Failed_to_resolve_NtCreateSectionFailed_to_resolve_NtMapViewOfSection_for_module:
call fcn.140041340
jmp 0x14000571c
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
nop
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x140005660
mov r8, rax
sub r8, rdx
add rdi, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
nop dword [rax]
lea r10, [rcx + r9]
cmp r10, rdi
je 0x1400056ca
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x1400056b0
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0x2f8], 0
je 0x1400056f7
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
mov esi, dword [rsp + 0xe4]
mov r8d, 0x16
mov ecx, esi
lea rdx, str.NtCreateSection_failedNtOpenFile_failed_for
call fcn.140041340
test esi, esi
mov eax, 0x535f4f4b
cmove esi, eax
mov qword [rsp + 0xf0], 0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
mov r14, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0x80]
cmp qword [rsp + 0x320], 0
je 0x140005762
mov r8, qword [rsp + 0x328]
mov rcx, qword [0x140055160]
xor edx, edx
call r13
cmp qword [rsp + 0x3c0], 0
je 0x140005781
mov r8, qword [rsp + 0x3c8]
mov rcx, qword [0x140055160]
xor edx, edx
call r13
cmp qword [rsp + 0x400], 0
je 0x1400057a0
mov r8, qword [rsp + 0x408]
mov rcx, qword [0x140055160]
xor edx, edx
call r13
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rdi
call r13
mov qword [rsp + 0x390], r14
mov dword [rsp + 0x398], esi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rbx
lea rax, [rsp + 0x390]
mov qword [rsp + 0x60], rax
lea rax, [0x140040bc0]
mov qword [rsp + 0x68], rax
lea rax, str.Failed_to_remap_module:_._Error:
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 2
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 2
lea rcx, [rsp + 0x4b8]
mov rdx, r15
call fcn.140018ad0
mov rdi, qword [rsp + 0x4b8]
mov rsi, qword [rsp + 0x4c0]
mov r14, qword [rsp + 0x4c8]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp r14, 0xff
mov eax, 0xff
cmovb rax, r14
test r14, r14
je 0x14000591a
lea rdx, [rax - 1]
cmp r14, rdx
cmovb rdx, r14
inc rdx
cmp rdx, 0x11
jae 0x140005890
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x1400058e8
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
nop dword [rax]
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x1400058b0
mov r8, rax
sub r8, rdx
add r14, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
nop dword [rax]
lea r10, [rcx + r9]
cmp r10, r14
je 0x14000591a
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x140005900
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
test rdi, rdi
je 0x140005941
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
mov rcx, qword [rsp + 0x390]
test rcx, rcx
je 0x140005954
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rbp
lea rdx, [rsp + 0x620]
call qword [sym.imp.kernel32.dll_Module32NextW]
test eax, eax
je 0x140006c55
cmp qword [rsp + 0xb8], 0
je 0x140003310
mov r8, qword [rsp + 0xc0]
mov rcx, qword [0x140055160]
xor edx, edx
call r13
jmp 0x140003310
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
nop
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x1400059b0
mov r8, rax
sub r8, rdx
add rdi, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
nop dword [rax]
lea r10, [rcx + r9]
cmp r10, rdi
je 0x140005a1a
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x140005a00
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0x98], 0
je 0x140005a47
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
mov rax, qword [rsp + 0x318]
mov qword [rsp + 0x20], rax
mov r8d, 0x12
mov rcx, r15
lea rdx, [0x140046317]
mov r9, qword [rsp + 0x310]
call fcn.140002100
cmp dword [rsp + 0xf0], 1
cmp qword [rsp + 0xf8], 0
je 0x140005a98
mov r8, qword [rsp + 0x100]
mov rcx, qword [0x140055160]
xor edx, edx
call r13
mov edx, 0x12
lea rcx, [0x140046317]
call fcn.14000ad50
test rax, rax
sete al
test rdx, rdx
sete cl
or cl, al
je 0x140005b8c
lea rax, [rsp + 0x88]
mov qword [rsp + 0x98], rax
lea rax, [0x140014a50]
mov qword [rsp + 0xa0], rax
lea rax, [0x1400468a8]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x98]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 1
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.140018ad0
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rdi, 0xff
mov eax, 0xff
cmovb rax, rdi
test rdi, rdi
lea r12, [rsp + 0xb8]
je 0x140005eea
lea rdx, [rax - 1]
cmp rdi, rdx
cmovb rdx, rdi
inc rdx
cmp rdx, 0x11
jae 0x140005e5f
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x140005eb8
mov r12, rdx
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov rsi, rax
mov qword [rsp + 0x3f8], 0
mov qword [rsp + 0x438], 0
mov rcx, qword [rsp + 0xd8]
mov qword [rsp + 0x610], 0
lea rax, [rsp + 0x438]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x610]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x20], 0
mov rdx, rsi
lea rdi, [rsp + 0x3f8]
mov r8, rdi
xor r9d, r9d
call r12
mov dword [rsp + 0xe8], eax
test eax, eax
je 0x140005d87
lea rax, [rsp + 0x88]
mov qword [rsp + 0x98], rax
lea rax, [0x140014a50]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0xa8], rax
lea rax, [0x14001c4e0]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xf0], 2
mov qword [rsp + 0x100], 2
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0x20
mov byte [rsp + 0x120], 3
mov qword [rsp + 0x128], 2
mov qword [rsp + 0x138], 2
mov qword [rsp + 0x148], 1
movabs rax, 0x400000020
mov qword [rsp + 0x150], rax
mov byte [rsp + 0x158], 3
lea rax, [0x1400466c8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 2
lea rax, [rsp + 0x98]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rcx, [rsp + 0x2f8]
lea rdx, [rsp + 0x50]
call fcn.140018ad0
mov rsi, qword [rsp + 0x300]
mov rdi, qword [rsp + 0x308]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rdi, 0xff
mov eax, 0xff
cmovb rax, rdi
test rdi, rdi
lea r12, [rsp + 0xb8]
je 0x140005fac
lea rdx, [rax - 1]
cmp rdi, rdx
cmovb rdx, rdi
inc rdx
cmp rdx, 0x11
jae 0x140005f30
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x140005f81
lea rax, [rsp + 0x88]
mov qword [rsp + 0x50], rax
lea rax, [0x140014a50]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rdi
lea rax, [0x140012cf0]
mov qword [rsp + 0x68], rax
lea rax, str.NtMapViewOfSection_succeeded_for_module:___base_address:
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 2
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 2
lea rcx, [rsp + 0x98]
mov rdx, r15
call fcn.140018ad0
mov r12, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rdi, 0xff
mov eax, 0xff
cmovb rax, rdi
test rdi, rdi
je 0x1400060cd
lea rdx, [rax - 1]
cmp rdi, rdx
cmovb rdx, rdi
inc rdx
cmp rdx, 0x11
jae 0x140006051
mov rcx, r12
xor edx, edx
mov r8, rax
jmp 0x1400060a2
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
nop dword [rax + rax]
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x140005e80
mov r8, rax
sub r8, rdx
add rdi, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
nop dword [rax]
lea r10, [rcx + r9]
cmp r10, rdi
je 0x140005eea
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x140005ed0
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0x50], 0
je 0x140005f14
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
mov esi, 0x80004005
mov r8d, 0x24
mov ecx, 0x80004005
lea rdx, str.Failed_to_resolve_NtMapViewOfSectionFailed_to_resolve_NtUnmapViewOfSection_for_module:
jmp 0x14000563b
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x140005f49
mov r8, rax
sub r8, rdx
add rdi, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
lea r10, [rcx + r9]
cmp r10, rdi
je 0x140005fac
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x140005f92
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0x2f8], 0
je 0x140005fd9
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
mov rdi, qword [rsp + 0x80]
jne 0x140005ff9
call qword [sym.imp.kernel32.dll_GetLastError]
mov esi, dword [rsp + 0xe8]
mov r8d, 0x19
mov ecx, esi
lea rdx, str.NtMapViewOfSection_failedNtCreateSection_failed_for_module:
call fcn.140041340
test esi, esi
mov eax, 0x535f4f4b
cmove esi, eax
mov qword [rsp + 0xf0], 0
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.oleaut32.dll_GetErrorInfo]
mov r14, qword [rsp + 0xf0]
cmp qword [rsp + 0x320], 0
jne 0x14000574e
jmp 0x140005762
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [r12 + rdx]
xor r8d, r8d
movq xmm0, qword [r12 + r8]
movq xmm1, qword [r12 + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x14000606a
mov r8, rax
sub r8, rdx
add rdi, r12
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
lea r10, [rcx + r9]
cmp r10, rdi
je 0x1400060cd
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x1400060b3
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0x98], 0
je 0x1400060fa
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, r12
call r13
mov rax, qword [rsp + 0x318]
mov qword [rsp + 0x20], rax
mov r8d, 0x14
mov rcx, r15
lea rdx, [0x140046329]
mov r9, qword [rsp + 0x310]
call fcn.140002100
cmp dword [rsp + 0xf0], 1
cmp qword [rsp + 0xf8], 0
lea r12, [rsp + 0xb8]
je 0x140006153
mov r8, qword [rsp + 0x100]
mov rcx, qword [0x140055160]
xor edx, edx
call r13
mov edx, 0x14
lea rcx, [0x140046329]
call fcn.14000ad50
test rax, rax
sete al
test rdx, rdx
sete cl
or cl, al
je 0x14000623f
lea rax, [rsp + 0x88]
mov qword [rsp + 0x98], rax
lea rax, [0x140014a50]
mov qword [rsp + 0xa0], rax
lea rax, [0x140046910]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x98]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 1
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.140018ad0
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rdi, 0xff
mov eax, 0xff
cmovb rax, rdi
test rdi, rdi
je 0x1400064ff
lea rdx, [rax - 1]
cmp rdi, rdx
cmovb rdx, rdi
inc rdx
cmp rdx, 0x11
jae 0x140006483
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x1400064d4
mov r8, rdx
mov rdx, qword [rsp + 0x3f8]
mov rcx, rsi
call r8
mov dword [rsp + 0xec], eax
test eax, eax
je 0x1400063bc
lea rax, [rsp + 0x88]
mov qword [rsp + 0x98], rax
lea rax, [0x140014a50]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xec]
mov qword [rsp + 0xa8], rax
lea rax, [0x14001c4e0]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xf0], 2
mov qword [rsp + 0x100], 2
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0x20
mov byte [rsp + 0x120], 3
mov qword [rsp + 0x128], 2
mov qword [rsp + 0x138], 2
mov qword [rsp + 0x148], 1
movabs rax, 0x400000020
mov qword [rsp + 0x150], rax
mov byte [rsp + 0x158], 3
lea rax, str.NtUnmapViewOfSection_failed_for_module:__with_status:
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 2
lea rax, [rsp + 0x98]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 2
lea rcx, [rsp + 0x2f8]
lea rdx, [rsp + 0x50]
call fcn.140018ad0
mov rsi, qword [rsp + 0x300]
mov rdi, qword [rsp + 0x308]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rdi, 0xff
mov eax, 0xff
cmovb rax, rdi
test rdi, rdi
je 0x1400065c1
lea rdx, [rax - 1]
cmp rdi, rdx
cmovb rdx, rdi
inc rdx
cmp rdx, 0x11
jae 0x140006545
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x140006596
lea rax, [rsp + 0x88]
mov qword [rsp + 0x98], rax
lea rax, [0x140014a50]
mov qword [rsp + 0xa0], rax
lea rax, str.NtUnmapViewOfSection_succeeded_for_module:
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x98]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 1
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.140018ad0
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rdi, 0xff
mov eax, 0xff
cmovb rax, rdi
test rdi, rdi
je 0x1400066a5
lea rdx, [rax - 1]
cmp rdi, rdx
cmovb rdx, rdi
inc rdx
cmp rdx, 0x11
jae 0x140006629
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x14000667a
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x14000649c
mov r8, rax
sub r8, rdx
add rdi, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
lea r10, [rcx + r9]
cmp r10, rdi
je 0x1400064ff
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x1400064e5
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0x50], 0
je 0x140006529
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
mov esi, 0x80004005
mov r8d, 0x26
mov ecx, 0x80004005
lea rdx, str.Failed_to_resolve_NtUnmapViewOfSectionCurrent_executable_path:
jmp 0x14000563b
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x14000655e
mov r8, rax
sub r8, rdx
add rdi, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
lea r10, [rcx + r9]
cmp r10, rdi
je 0x1400065c1
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x1400065a7
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0x2f8], 0
je 0x1400065ee
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
mov rdi, qword [rsp + 0x80]
jne 0x14000660e
call qword [sym.imp.kernel32.dll_GetLastError]
mov esi, dword [rsp + 0xec]
mov r8d, 0x1b
mov ecx, esi
lea rdx, str.NtUnmapViewOfSection_failedNtMapViewOfSection_failed_for_module:
jmp 0x14000600f
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x140006642
mov r8, rax
sub r8, rdx
add rdi, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
lea r10, [rcx + r9]
cmp r10, rdi
je 0x1400066a5
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x14000668b
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0x50], 0
je 0x1400066cf
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x1400066e7
call qword [sym.imp.kernel32.dll_GetLastError]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x98], rax
lea rax, [0x140014a50]
mov qword [rsp + 0xa0], rax
lea rax, str.Successfully_remapped_module:
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x98]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 1
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.140018ad0
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp rdi, 0xff
mov eax, 0xff
cmovb rax, rdi
test rdi, rdi
je 0x140006823
lea rdx, [rax - 1]
cmp rdi, rdx
cmovb rdx, rdi
inc rdx
cmp rdx, 0x11
jae 0x1400067a7
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x1400067f8
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x1400067c0
mov r8, rax
sub r8, rdx
add rdi, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
lea r10, [rcx + r9]
cmp r10, rdi
je 0x140006823
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x140006809
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp qword [rsp + 0x50], 0
je 0x14000684d
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
cmp qword [rsp + 0x320], 0
mov rsi, qword [rsp + 0x80]
je 0x140006874
mov r8, qword [rsp + 0x328]
mov rcx, qword [0x140055160]
xor edx, edx
call r13
cmp qword [rsp + 0x3c0], 0
je 0x140006893
mov r8, qword [rsp + 0x3c8]
mov rcx, qword [0x140055160]
xor edx, edx
call r13
cmp qword [rsp + 0x400], 0
je 0x1400068b2
mov r8, qword [rsp + 0x408]
mov rcx, qword [0x140055160]
xor edx, edx
call r13
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rbx
lea rax, str.Successfully_remapped_module:
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 1
lea rcx, [rsp + 0x4a0]
mov rdx, r15
call fcn.140018ad0
mov rdi, qword [rsp + 0x4a0]
mov rsi, qword [rsp + 0x4a8]
mov r14, qword [rsp + 0x4b0]
mov r8d, 0x200
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp r14, 0xff
mov eax, 0xff
cmovb rax, r14
test r14, r14
je 0x1400069f6
lea rdx, [rax - 1]
cmp r14, rdx
cmovb rdx, r14
inc rdx
cmp rdx, 0x11
jae 0x14000697a
mov rcx, rsi
xor edx, edx
mov r8, rax
jmp 0x1400069cb
mov ecx, edx
and ecx, 0xf
mov r8d, 0x10
cmove rcx, r8
sub rdx, rcx
lea rcx, [rsi + rdx]
xor r8d, r8d
movq xmm0, qword [rsi + r8]
movq xmm1, qword [rsi + r8 + 8]
punpcklbw xmm0, xmm6
punpcklbw xmm1, xmm6
movdqu xmmword [rsp + r8*2 + 0xf0], xmm0
movdqu xmmword [rsp + r8*2 + 0x100], xmm1
add r8, 0x10
cmp rdx, r8
jne 0x140006993
mov r8, rax
sub r8, rdx
add r14, rsi
lea rdx, [rsp + rdx*2]
add rdx, 0xf0
xor r9d, r9d
lea r10, [rcx + r9]
cmp r10, r14
je 0x1400069f6
movzx r10d, byte [r10]
mov word [rdx + r9*2], r10w
inc r9
cmp r8, r9
jne 0x1400069dc
mov word [rsp + rax*2 + 0xf0], 0
mov rcx, r15
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
test rdi, rdi
je 0x140006a1d
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x80], rax
mov rsi, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0xc8]
movaps xmm12, xmmword [rsp + 0x380]
movaps xmmword [rsp + 0x5b0], xmm12
lea rcx, [rsp + 0x5b0]
mov rdx, rsi
mov r8, rdi
call fcn.140014a70
mov r12, rax
cmp qword [rsp + 0x370], 0
je 0x140006c32
mov r15, qword [rsp + 0x360]
mov r13, qword [rsp + 0x368]
mov rax, r12
shr rax, 0x39
mov qword [rsp + 0x418], rax
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm12, xmm0, 0
xor ebp, ebp
xor r14d, r14d
and r12, r13
movdqu xmm13, xmmword [r15 + r12]
movdqa xmm0, xmm13
pcmpeqb xmm0, xmm12
pmovmskb ebx, xmm0
test ebx, ebx
jne 0x140006b1b
cmp r14, 1
mov r14d, 1
je 0x140006af2
pmovmskb eax, xmm13
xor r14d, r14d
test eax, eax
setne r14b
tzcnt eax, eax
add rax, r12
and rax, r13
mov qword [rsp + 0x420], rax
pcmpeqb xmm13, xmm7
pmovmskb eax, xmm13
test eax, eax
jne 0x140006ba8
add r12, rbp
add r12, 0x10
add rbp, 0x10
jmp 0x140006aab
lea eax, [rbx - 1]
and ax, bx
mov ebx, eax
je 0x140006ac6
tzcnt eax, ebx
add rax, r12
and rax, r13
neg rax
lea rax, [rax + rax*2]
cmp rdi, qword [r15 + rax*8 - 8]
jne 0x140006b11
lea rax, [r15 + rax*8]
mov rdx, qword [rax - 0x10]
mov rcx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140006b11
cmp qword [rsp + 0x80], 0
mov r13, qword [sym.imp.kernel32.dll_HeapFree]
mov rbp, qword [rsp + 0xd0]
lea r12, [rsp + 0xb8]
je 0x140006b7b
mov rcx, qword [0x140055160]
xor edx, edx
mov r8, rsi
call r13
mov rcx, rbp
lea rdx, [rsp + 0x620]
call qword [sym.imp.kernel32.dll_Module32NextW]
test eax, eax
lea rbx, [0x140002010]
lea r15, [rsp + 0xf0]
jne 0x140003310
jmp 0x140006fcb
mov rcx, qword [rsp + 0x420]
movzx eax, byte [r15 + rcx]
test al, al
js 0x140006bcb
movdqa xmm0, xmmword [r15]
pmovmskb eax, xmm0
tzcnt ecx, eax
movzx eax, byte [r15 + rcx]
and al, 1
movzx eax, al
sub qword [rsp + 0x370], rax
lea rax, [rcx - 0x10]
and r13, rax
mov rax, qword [rsp + 0x418]
mov byte [r15 + rcx], al
mov byte [r15 + r13 + 0x10], al
inc qword [rsp + 0x378]
neg rcx
lea rax, [rcx + rcx*2]
mov rcx, qword [rsp + 0x80]
mov qword [r15 + rax*8 - 0x18], rcx
mov qword [r15 + rax*8 - 0x10], rsi
mov qword [r15 + rax*8 - 8], rdi
mov r13, qword [sym.imp.kernel32.dll_HeapFree]
mov rbp, qword [rsp + 0xd0]
lea r12, [rsp + 0xb8]
jmp 0x140006b7b
movaps xmmword [rsp + 0x5a0], xmm12
lea rcx, [rsp + 0x360]
lea rdx, [rsp + 0x5a0]
call fcn.140042430
jmp 0x140006a74
call qword [sym.imp.kernel32.dll_GetLastError]
cmp qword [rsp + 0xb8], 0
je 0x140006c7d
mov r8, qword [rsp + 0xc0]
mov rcx, qword [0x140055160]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, rbp
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x140006c90
call qword [sym.imp.kernel32.dll_GetLastError]
lea rcx, [rsp + 0x180]
mov r8d, 0x170
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x140045610]
movaps xmmword [rsp + 0xf0], xmm0
movaps xmm0, xmmword [0x140045620]
movaps xmmword [rsp + 0x100], xmm0
movaps xmm0, xmmword [0x140045630]
movaps xmmword [rsp + 0x110], xmm0
movaps xmm0, xmmword [0x140045640]
movaps xmmword [rsp + 0x120], xmm0
movaps xmm0, xmmword [0x140045650]
movaps xmmword [rsp + 0x130], xmm0
movaps xmm0, xmmword [0x140045660]
movaps xmmword [rsp + 0x140], xmm0
movaps xmm0, xmmword [0x140045670]
movaps xmmword [rsp + 0x150], xmm0
movaps xmm0, xmmword [0x140045680]
movaps xmmword [rsp + 0x160], xmm0
movdqa xmm0, xmmword [0x140045690]
movdqa xmmword [rsp + 0x170], xmm0
lea rcx, [rsp + 0xf0]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
mov rsi, qword [rsp + 0x368]
test rsi, rsi
je 0x140006e22
mov rdi, qword [rsp + 0x378]
test rdi, rdi
je 0x140006deb
mov rbx, qword [rsp + 0x360]
movdqa xmm0, xmmword [rbx]
pmovmskb r15d, xmm0
not r15d
lea r14, [rbx + 0x10]
jmp 0x140006d92
dec rdi
lea eax, [r15 - 1]
and eax, r15d
mov r15d, eax
test rdi, rdi
je 0x140006deb
test r15w, r15w
jne 0x140006dc1
nop dword [rax + rax]
movdqa xmm0, xmmword [r14]
pmovmskb r15d, xmm0
add rbx, 0xfffffffffffffe80
add r14, 0x10
cmp r15d, 0xffff
je 0x140006da0
not r15d
tzcnt eax, r15d
neg rax
lea rax, [rax + rax*2]
cmp qword [rbx + rax*8 - 0x18], 0
je 0x140006d80
lea rax, [rbx + rax*8]
mov r8, qword [rax - 0x10]
mov rcx, qword [0x140055160]
xor edx, edx
call r13
jmp 0x140006d80
lea rax, [rsi + 1]
mov ecx, 0x18
mul rcx
add rax, 0xf
and rax, 0xfffffffffffffff0
add rsi, rax
cmp rsi, 0xffffffffffffffef
je 0x140006e22
mov r8, qword [rsp + 0x360]
sub r8, rax
mov rcx, qword [0x140055160]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x340], 0
je 0x140006e44
mov r8, qword [rsp + 0x348]
mov rcx, qword [0x140055160]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
xor esi, esi
mov eax, esi
movaps xmm6, xmmword [rsp + 0xa60]
movaps xmm7, xmmword [rsp + 0xa70]
movaps xmm8, xmmword [rsp + 0xa80]
movaps xmm9, xmmword [rsp + 0xa90]
movaps xmm10, xmmword [rsp + 0xaa0]
movaps xmm11, xmmword [rsp + 0xab0]
movaps xmm12, xmmword [rsp + 0xac0]
movaps xmm13, xmmword [rsp + 0xad0]
movaps xmm14, xmmword [rsp + 0xae0]
movaps xmm15, xmmword [rsp + 0xaf0]
add rsp, 0xb08
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, qword [sym.imp.kernel32.dll_GetLastError]
call rsi
call rsi
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
mov esi, 0x535f4f4b
cmovne esi, ecx
mov rdi, qword [rsp + 0x368]
test rdi, rdi
je 0x140003170
mov rbx, qword [rsp + 0x378]
test rbx, rbx
je 0x140006f8b
mov r14, qword [rsp + 0x360]
movdqa xmm0, xmmword [r14]
pmovmskb r13d, xmm0
not r13d
lea r15, [r14 + 0x10]
mov r12, qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140006f32
dec rbx
lea eax, [r13 - 1]
and eax, r13d
mov r13d, eax
test rbx, rbx
je 0x140006f8b
test r13w, r13w
jne 0x140006f61
nop dword [rax + rax]
movdqa xmm0, xmmword [r15]
pmovmskb r13d, xmm0
add r14, 0xfffffffffffffe80
add r15, 0x10
cmp r13d, 0xffff
je 0x140006f40
not r13d
tzcnt eax, r13d
neg rax
lea rax, [rax + rax*2]
cmp qword [r14 + rax*8 - 0x18], 0
je 0x140006f20
lea rax, [r14 + rax*8]
mov r8, qword [rax - 0x10]
mov rcx, qword [0x140055160]
xor edx, edx
call r12
jmp 0x140006f20
lea rax, [rdi + 1]
mov ecx, 0x18
mul rcx
add rax, 0xf
and rax, 0xfffffffffffffff0
add rdi, rax
cmp rdi, 0xffffffffffffffef
je 0x140003170
mov r8, qword [rsp + 0x360]
sub r8, rax
mov rcx, qword [0x140055160]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140003170
call qword [sym.imp.kernel32.dll_GetLastError]
mov rcx, rbp
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x140006c90
jmp 0x140006c8a
mov ecx, 2
mov edx, 0x208
call fcn.14004318e
call qword [sym.imp.kernel32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
mov eax, 0x535f4f4b
cmovne eax, ecx
mov qword [rsp + 0xf0], 0
mov dword [rsp + 0xf8], eax
lea rax, [0x1400463b0]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1400460e0]
lea r8, [rsp + 0xf0]
mov edx, 0x2b
call fcn.1400435c0
lea r8, [0x1400462f0]
mov edx, 0x104
call fcn.140043380
mov eax, 2
mov qword [rsp + 0x3e0], rax
mov qword [rsp + 0x3e8], r12
mov rcx, qword [rsp + 0x3e0]
mov rdx, qword [rsp + 0x3e8]
call fcn.14004318e
call qword [sym.imp.kernel32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
mov eax, 0x535f4f4b
cmovne eax, ecx
mov qword [rsp + 0xf0], 0
mov dword [rsp + 0xf8], eax
lea rax, [0x140046400]
jmp 0x14000702e