Function at 0x140053ee0
Capabilities:
Authenticate hmac

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x388
movdqa xmmword [rsp + 0x370], xmm8
movaps xmmword [rsp + 0x360], xmm7
movaps xmmword [rsp + 0x350], xmm6
mov r15, rcx
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140053f3b
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140057443
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0x4c8
xor edx, edx
call sub.kernel32.dll_HeapAlloc
mov qword [rsp + 0x1b0], rax
test rax, rax
je 0x140057443
lea rax, [0x1402a6bfe]
mov qword [rsp + 0x50], rax
lea r12, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0xd37f816cd2d4084c
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.14002f720
mov rdi, qword [rax]
mov ebx, dword [rax + 8]
movzx ebp, word [rax + 0xc]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140053fbd
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140057434
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0xe
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140057434
mov r13, rax
mov eax, ebp
xor al, 0xe2
shr ebp, 8
xor bpl, 0x8a
movzx ecx, bpl
shl ecx, 8
movzx eax, al
or eax, ecx
movabs rcx, 0x5e7f6eac62405ff3
xor rdi, rcx
xor ebx, 0xc6fc5859
mov qword [r13], rdi
mov dword [r13 + 8], ebx
mov word [r13 + 0xc], ax
lea rax, [0x1402a548f]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xb15e59b57bf2b3ac
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140030fe0
mov rdi, qword [rax]
movzx ebx, byte [rax + 8]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140054069
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140057407
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 9
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140057407
mov rsi, rax
xor bl, 0x70
movabs rax, 0x5c4a09c9bab06f45
xor rdi, rax
mov qword [rsi], rdi
mov byte [rsi + 8], bl
lea rax, [0x14029a445]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xfdb157ece153b7bb
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140030890
mov edi, dword [rax]
movzx ebx, word [rax + 4]
movzx ebp, byte [rax + 6]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x1400540f7
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573bc
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 7
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573bc
mov r8, rax
shl ebp, 0x10
or ebx, ebp
mov eax, ebx
shr eax, 0x10
xor al, 0xd1
movzx eax, al
mov byte [r8 + 6], al
shl rax, 0x30
mov ecx, ebx
xor cl, 0xb8
shr ebx, 8
xor bl, 0xb1
movzx ecx, cl
movzx edx, bl
shl edx, 8
or edx, ecx
movzx ecx, dx
shl rcx, 0x20
or rcx, rax
xor edi, 0x1bfdf406
mov dword [r8], edi
shr rcx, 0x20
mov qword [rsp + 0x1e0], r8
mov word [r8 + 4], cx
lea rax, [0x1402a93d7]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xd28e6cdad1a28fae
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.14002f0a0
mov edi, dword [rax]
movzx ebx, word [rax + 4]
movzx ebp, byte [rax + 6]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x1400541c0
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573bc
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 7
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573bc
mov r8, rax
shl ebp, 0x10
or ebx, ebp
mov eax, ebx
shr eax, 0x10
xor al, 0x55
movzx eax, al
mov byte [r8 + 6], al
shl rax, 0x30
mov ecx, ebx
xor cl, 5
shr ebx, 8
xor bl, 0x53
movzx ecx, cl
movzx edx, bl
shl edx, 8
or edx, ecx
movzx ecx, dx
shl rcx, 0x20
or rcx, rax
xor edi, 0x30c32d15
mov dword [r8], edi
shr rcx, 0x20
mov qword [rsp + 0x1a8], r8
mov word [r8 + 4], cx
lea rax, [0x14029c5ae]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x86e0985e1039dfc8
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140034200
movzx edi, word [rax]
movzx ebx, byte [rax + 2]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140054286
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140057425
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 3
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140057425
shl ebx, 0x10
or edi, ebx
mov r8d, edi
shr r8d, 0x10
xor r8b, 0x82
mov ecx, edi
xor cl, 0x6b
shr edi, 8
xor dil, 0xf
movzx ecx, cl
movzx edx, dil
shl edx, 8
or edx, ecx
mov byte [rax + 2], r8b
mov qword [rsp + 0x1e8], rax
mov word [rax], dx
lea rax, [0x1402a4884]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xec74b5fb3903d9fc
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140030170
mov edi, dword [rax]
movzx ebx, word [rax + 4]
movzx ebp, byte [rax + 6]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140054332
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573bc
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 7
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573bc
mov r8, rax
shl ebp, 0x10
or ebx, ebp
mov eax, ebx
shr eax, 0x10
xor al, 0xb7
movzx eax, al
mov byte [r8 + 6], al
shl rax, 0x30
mov ecx, ebx
xor cl, 0x9c
shr ebx, 8
xor bl, 0x44
movzx ecx, cl
movzx edx, bl
shl edx, 8
or edx, ecx
movzx ecx, dx
shl rcx, 0x20
or rcx, rax
xor edi, 0x16dc48fd
mov dword [r8], edi
shr rcx, 0x20
mov qword [rsp + 0x1d8], r8
mov word [r8 + 4], cx
lea rax, [0x1402a66d9]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xa399b7bf1a41d6a2
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140031b70
mov rdi, qword [rax]
movzx ebx, word [rax + 8]
movzx ebp, byte [rax + 0xa]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x1400543fc
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140057452
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0xb
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140057452
shl ebp, 0x10
or ebx, ebp
mov r8d, ebx
shr r8d, 0x10
xor r8b, 0x2e
mov ecx, ebx
xor cl, 0x50
shr ebx, 8
xor bl, 0xb5
movzx ecx, cl
movzx edx, bl
shl edx, 8
or edx, ecx
movabs rcx, 0xa897389282dea92f
xor rdi, rcx
mov qword [rax], rdi
mov word [rax + 8], dx
mov qword [rsp + 0x1f0], rax
mov byte [rax + 0xa], r8b
lea rax, [0x14029c7fa]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xdcb819c0f81835f0
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.1400327c0
mov edi, dword [rax]
movzx ebx, word [rax + 4]
movzx ebp, byte [rax + 6]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x1400544b7
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573bc
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 7
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573bc
mov r8, rax
shl ebp, 0x10
or ebx, ebp
mov eax, ebx
shr eax, 0x10
xor al, 0x9f
movzx eax, al
mov byte [r8 + 6], al
shl rax, 0x30
mov ecx, ebx
xor cl, 0xdb
shr ebx, 8
xor bl, 0xbb
movzx ecx, cl
movzx edx, bl
shl edx, 8
or edx, ecx
movzx ecx, dx
shl rcx, 0x20
or rcx, rax
xor edi, 0xbfc0b8d6
mov dword [r8], edi
shr rcx, 0x20
mov qword [rsp + 0x1d0], r8
mov word [r8 + 4], cx
lea rax, [0x1402a7422]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xb712092a05d7fd0c
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.1400343e0
mov rdi, qword [rax]
mov ebp, dword [rax + 8]
movzx ebx, byte [rax + 0xc]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140054580
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573e9
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0xd
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573e9
xor bl, 0x4d
movabs rcx, 0xb8bf2600520f9661
xor rdi, rcx
xor ebp, 0xd39e0fdf
mov qword [rax], rdi
mov dword [rax + 8], ebp
mov qword [rsp + 0x1c8], rax
mov byte [rax + 0xc], bl
lea rax, [0x14029facc]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x26544ce1dcfce2f7
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.14002df10
mov rdi, qword [rax]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140054615
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573cb
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 8
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573cb
mov rbp, rax
movabs rax, 0x8878eb01f888de8d
xor rdi, rax
mov qword [rbp], rdi
lea rax, [0x14029b17c]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x61e3a1b0b99b3c61
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.14002eb90
mov rdi, qword [rax]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140054697
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573cb
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 8
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573cb
movabs rcx, 0x5e027e31eca428cf
xor rdi, rcx
mov qword [rsp + 0x1c0], rax
mov qword [rax], rdi
lea rax, [0x14029c58d]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x69f3dfc2d0f431c0
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140033b90
mov rdi, qword [rax]
movzx ebx, word [rax + 8]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140054721
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573da
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0xa
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573da
mov qword [rsp + 0x1a0], rbp
mov edx, ebx
xor dl, 0x89
shr ebx, 8
xor bl, 0xd2
movzx ecx, bl
shl ecx, 8
movzx edx, dl
or edx, ecx
movabs rcx, 0x4ea7bb4ee7b4b273
xor rdi, rcx
mov qword [rax], rdi
mov qword [rsp + 0x1b8], rax
mov word [rax + 8], dx
lea rax, [0x14029e35a]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x8cd267bff6a3765b
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140031f30
mov rdi, qword [rax]
mov ebp, dword [rax + 8]
movzx ebx, byte [rax + 0xc]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x1400547d0
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573e9
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0xd
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573e9
xor bl, 8
movabs rcx, 0x8f909f206d2d7a17
xor rdi, rcx
xor ebp, 0x12eef25a
mov qword [rax], rdi
mov dword [rax + 8], ebp
mov qword [rsp + 0x348], rax
mov byte [rax + 0xc], bl
lea rax, [0x1402a84c4]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x2615a42a5f12b835
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140030f00
mov edi, dword [rax]
movzx ebx, byte [rax + 4]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140054868
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140057416
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 5
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140057416
mov rbp, rax
xor bl, 0x65
xor edi, 0xa10caea9
mov byte [rax + 4], bl
mov dword [rax], edi
lea rax, [0x1402a3b57]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x7527f549ab8e158c
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.14002ddc0
movzx edi, word [rax]
movzx ebx, byte [rax + 2]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x1400548eb
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140057425
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 3
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140057425
shl ebx, 0x10
or edi, ebx
mov r8d, edi
shr r8d, 0x10
xor r8b, 0x3b
mov ecx, edi
xor cl, 0x56
shr edi, 8
xor dil, 0x5c
movzx ecx, cl
movzx edx, dil
shl edx, 8
or edx, ecx
mov byte [rax + 2], r8b
mov qword [rsp + 0x340], rax
mov word [rax], dx
lea rax, [0x1402a25e3]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x843e6f02e75202bd
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140032b90
mov edi, dword [rax]
movzx ebx, word [rax + 4]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140054993
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573a8
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 6
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573a8
mov edx, ebx
xor dl, 0xbe
shr ebx, 8
xor bl, 0xe6
movzx ecx, bl
shl ecx, 8
movzx edx, dl
or edx, ecx
xor edi, 0x1e4cac91
mov dword [rax], edi
mov qword [rsp + 0x338], rax
mov word [rax + 4], dx
lea rax, [0x1402a1407]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xb9092ca8bcaf9855
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140031ba0
mov edi, dword [rax]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140054a2a
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573f8
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 4
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573f8
mov rbx, rax
xor edi, 0x59aab95
mov dword [rax], edi
lea rax, [0x1402a235e]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x4d04bc15e3416b46
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140034840
mov edi, dword [rax]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140054aa2
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573f8
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 4
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573f8
xor edi, 0x23ab256f
mov qword [rsp + 0x330], rax
mov dword [rax], edi
lea rax, [0x1402a2cf0]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x73f161016e3523fa
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140031460
mov edi, dword [rax]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140054b1f
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573f8
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 4
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573f8
mov qword [rsp + 0x328], rbx
xor edi, 0xb9334062
mov qword [rsp + 0x320], rax
mov dword [rax], edi
lea rax, [0x14029c401]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x5f36673b421800e8
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.1400308c0
mov edi, dword [rax]
movzx ebx, word [rax + 4]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140054ba8
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573a8
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 6
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573a8
mov edx, ebx
xor dl, 0x36
shr ebx, 8
xor bl, 0xcb
movzx ecx, bl
shl ecx, 8
movzx edx, dl
or edx, ecx
xor edi, 0x98a181bd
mov dword [rax], edi
mov qword [rsp + 0x318], rax
mov word [rax + 4], dx
lea rax, [0x1402a9c1a]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xc00e51d2110bc376
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140031fd0
mov edi, dword [rax]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140054c3f
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573f8
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 4
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573f8
xor edi, 0x5a540a4a
mov qword [rsp + 0x310], rax
mov dword [rax], edi
lea rax, [0x14029e494]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xa2e61ab2c9aa15eb
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.1400347d0
mov edi, dword [rax]
movzx ebx, word [rax + 4]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140054cc0
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573a8
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 6
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573a8
mov qword [rsp + 0x308], rbp
mov edx, ebx
xor dl, 0xa2
shr ebx, 8
xor bl, 0xea
movzx ecx, bl
shl ecx, 8
movzx edx, dl
or edx, ecx
xor edi, 0x94d095d7
mov dword [rax], edi
mov qword [rsp + 0x300], rax
mov word [rax + 4], dx
lea rax, [0x14029e1ae]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xf7688d189b280dc3
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.14002ece0
mov edi, dword [rax]
movzx ebx, word [rax + 4]
movzx ebp, byte [rax + 6]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140054d67
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573bc
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 7
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573bc
mov r8, rax
shl ebp, 0x10
or ebx, ebp
mov eax, ebx
shr eax, 0x10
xor al, 0x86
movzx eax, al
mov byte [r8 + 6], al
shl rax, 0x30
mov ecx, ebx
xor cl, 0x8f
shr ebx, 8
xor bl, 0x30
movzx ecx, cl
movzx edx, bl
shl edx, 8
or edx, ecx
movzx ecx, dx
shl rcx, 0x20
or rcx, rax
xor edi, 0x2d7b1a75
mov dword [r8], edi
shr rcx, 0x20
mov qword [rsp + 0x2f8], r8
mov word [r8 + 4], cx
lea rax, [0x1402a58bb]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x5586a7a90f0ea85a
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.1400339e0
mov rdi, qword [rax]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140054e29
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573cb
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 8
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573cb
mov rbp, rax
movabs rax, 0x6ee38c9d18ca8fa2
xor rdi, rax
mov qword [rbp], rdi
lea rax, [0x1402a8331]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x1f7704dcbc1ff61b
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140033740
mov rdi, qword [rax]
movzx ebx, word [rax + 8]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140054eaf
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573da
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0xa
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573da
mov qword [rsp + 0x2f0], rbp
mov edx, ebx
xor dl, 0xbd
shr ebx, 8
xor bl, 0xf0
movzx ecx, bl
shl ecx, 8
movzx edx, dl
or edx, ecx
movabs rcx, 0xce1b26770285c941
xor rdi, rcx
mov qword [rax], rdi
mov qword [rsp + 0x2e8], rax
mov word [rax + 8], dx
lea rax, [0x14029e924]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x578013c0003ff6da
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.1400329a0
mov rdi, qword [rax]
mov ebp, dword [rax + 8]
movzx ebx, byte [rax + 0xc]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140054f5e
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573e9
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0xd
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573e9
xor bl, 0x16
movabs rcx, 0x6371a69863b11511
xor rdi, rcx
xor ebp, 0xa3f32469
mov qword [rax], rdi
mov dword [rax + 8], ebp
mov qword [rsp + 0x2e0], rax
mov byte [rax + 0xc], bl
lea rax, [0x1402a4457]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x80a2f8a4b7bb4be9
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.14002f960
mov rdi, qword [rax]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140054ff3
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573cb
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 8
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573cb
mov rbp, rax
movabs rax, 0x3f6f8d4ce23827aa
xor rdi, rax
mov qword [rbp], rdi
lea rax, [0x1402a67d7]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xab7aaaa6094bd2d
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.14002df90
mov edi, dword [rax]
movzx ebx, word [rax + 4]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140055078
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573a8
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 6
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573a8
mov edx, ebx
xor dl, 0xb3
shr ebx, 8
xor bl, 0x4e
movzx ecx, bl
shl ecx, 8
movzx edx, dl
or edx, ecx
xor edi, 0xad3a640e
mov dword [rax], edi
mov qword [rsp + 0x2d8], rax
mov word [rax + 4], dx
lea rax, [0x14029f35a]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x811fbac4fd877a66
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140030840
mov edi, dword [rax]
movzx ebx, word [rax + 4]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140055113
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573a8
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 6
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573a8
mov edx, ebx
xor dl, 0xb5
shr ebx, 8
xor bl, 0x72
movzx ecx, bl
shl ecx, 8
movzx edx, dl
or edx, ecx
xor edi, 0x76921ba
mov dword [rax], edi
mov qword [rsp + 0x2d0], rax
mov word [rax + 4], dx
lea rax, [0x14029b9bf]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x8ddc5b811ba990f2
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.14002f420
mov edi, dword [rax]
movzx ebx, word [rax + 4]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x1400551ae
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573a8
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 6
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573a8
mov edx, ebx
xor dl, 0xdf
shr ebx, 8
xor bl, 0x73
movzx ecx, bl
shl ecx, 8
movzx edx, dl
or edx, ecx
xor edi, 0xc85d4454
mov dword [rax], edi
mov qword [rsp + 0x2c8], rax
mov word [rax + 4], dx
lea rax, [0x14029b039]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xee82b198e3210439
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.14002fb80
mov edi, dword [rax]
movzx ebx, word [rax + 4]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140055249
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573a8
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 6
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573a8
mov qword [rsp + 0x2c0], rbp
mov edx, ebx
xor dl, 0xf4
shr ebx, 8
xor bl, 0x2a
movzx ecx, bl
shl ecx, 8
movzx edx, dl
or edx, ecx
xor edi, 0x93d4a7e0
mov dword [rax], edi
mov qword [rsp + 0x2b8], rax
mov word [rax + 4], dx
lea rax, [0x14029a912]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xb5a96d03aed2feb4
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140033380
mov edi, dword [rax]
movzx ebx, word [rax + 4]
movzx ebp, byte [rax + 6]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x1400552f0
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573bc
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 7
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573bc
mov r8, rax
shl ebp, 0x10
or ebx, ebp
mov eax, ebx
shr eax, 0x10
xor al, 0x29
movzx eax, al
mov byte [r8 + 6], al
shl rax, 0x30
mov ecx, ebx
xor cl, 0x37
shr ebx, 8
xor bl, 0xe2
movzx ecx, cl
movzx edx, bl
shl edx, 8
or edx, ecx
movzx ecx, dx
shl rcx, 0x20
or rcx, rax
xor edi, 0xa5831bac
mov dword [r8], edi
shr rcx, 0x20
mov qword [rsp + 0x2b0], r8
mov word [r8 + 4], cx
lea rax, [0x14029a7ea]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x5292e04b9e2d203d
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.14002e880
mov edi, dword [rax]
movzx ebx, word [rax + 4]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x1400553b5
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573a8
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 6
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573a8
mov rbp, rax
mov eax, ebx
xor al, 0x86
shr ebx, 8
xor bl, 0xa5
movzx ecx, bl
shl ecx, 8
movzx eax, al
or eax, ecx
xor edi, 0x1c90655b
mov dword [rbp], edi
mov word [rbp + 4], ax
lea rax, [0x14029cd7f]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x485dcca64524b6e5
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.1400300f0
mov rdi, qword [rax]
movzx ebx, byte [rax + 8]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x14005544c
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140057407
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 9
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140057407
xor bl, 0xda
movabs rcx, 0x6e8bf85a9b2235d6
xor rdi, rcx
mov qword [rax], rdi
mov qword [rsp + 0x2a8], rax
mov byte [rax + 8], bl
lea rax, [0x1402a80a8]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x5dbeda99534e502b
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140036a00
mov rdi, qword [rax]
movzx ebx, word [rax + 8]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x1400554dc
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573da
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0xa
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573da
mov qword [rsp + 0x2a0], rbp
mov edx, ebx
xor dl, 0x2a
shr ebx, 8
xor bl, 0xa5
movzx ecx, bl
shl ecx, 8
movzx edx, dl
or edx, ecx
movabs rcx, 0x56cf122ffb93e88e
xor rdi, rcx
mov qword [rax], rdi
mov qword [rsp + 0x298], rax
mov word [rax + 8], dx
lea rax, [0x1402a75a2]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xbada707202408f19
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.1400329f0
mov edi, dword [rax]
movzx ebx, word [rax + 4]
movzx ebp, byte [rax + 6]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x14005558b
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573bc
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 7
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573bc
mov r8, rax
shl ebp, 0x10
or ebx, ebp
mov eax, ebx
shr eax, 0x10
xor al, 0x8d
movzx eax, al
mov byte [r8 + 6], al
shl rax, 0x30
mov ecx, ebx
xor cl, 0x9d
shr ebx, 8
xor bl, 0x18
movzx ecx, cl
movzx edx, bl
shl edx, 8
or edx, ecx
movzx ecx, dx
shl rcx, 0x20
or rcx, rax
xor edi, 0x83783d54
mov dword [r8], edi
shr rcx, 0x20
mov qword [rsp + 0x290], r8
mov word [r8 + 4], cx
lea rax, [0x1402a1a35]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x11eab013d1537585
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.14002e340
mov rdi, qword [rax]
mov ebp, dword [rax + 8]
movzx ebx, byte [rax + 0xc]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140055654
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573e9
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0xd
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573e9
xor bl, 0x72
movabs rcx, 0x9d7141635a90e26d
xor rdi, rcx
xor ebp, 0x1ef2026d
mov qword [rax], rdi
mov dword [rax + 8], ebp
mov qword [rsp + 0x288], rax
mov byte [rax + 0xc], bl
lea rax, [0x1402a179d]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x92cbf3ae7b7b242d
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140034f60
mov rdi, qword [rax]
mov ebx, dword [rax + 8]
movzx ebp, word [rax + 0xc]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x1400556f0
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140057434
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0xe
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140057434
mov edx, ebp
xor dl, 0x77
shr ebp, 8
xor bpl, 0x45
movzx ecx, bpl
shl ecx, 8
movzx edx, dl
or edx, ecx
movabs rcx, 0x8578a0fbd943c30a
xor rdi, rcx
xor ebx, 0xbd968148
mov qword [rax], rdi
mov dword [rax + 8], ebx
mov qword [rsp + 0x280], rax
mov word [rax + 0xc], dx
lea rax, [0x14029db07]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x782485e1014013e4
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140036ce0
mov rdi, qword [rax]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x14005579b
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573cb
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 8
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573cb
mov rbp, rax
movabs rax, 0x5ac38385645c893
xor rdi, rax
mov qword [rbp], rdi
lea rax, [0x1402a0b52]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x4978f4d806edc08
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140034130
mov rbx, qword [rax]
mov edi, dword [rax + 8]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140055820
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140057461
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0xc
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140057461
xor edi, 0xb05cce55
movabs rcx, 0xa89040b696a55026
xor rbx, rcx
mov qword [rax], rbx
mov qword [rsp + 0x278], rax
mov dword [rax + 8], edi
lea rax, [0x1402a2fc7]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xa72ffd488ae9e614
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140032450
mov edi, dword [rax]
movzx ebx, word [rax + 4]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x1400558b2
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573a8
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 6
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573a8
mov edx, ebx
xor dl, 0xa4
shr ebx, 8
xor bl, 0x4c
movzx ecx, bl
shl ecx, 8
movzx edx, dl
or edx, ecx
xor edi, 0x2b71c184
mov dword [rax], edi
mov qword [rsp + 0x270], rax
mov word [rax + 4], dx
lea rax, [0x1402a5e98]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xe89ea146bdf168f9
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.1400343b0
mov rdi, qword [rax]
movzx ebx, word [rax + 8]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x14005594e
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573da
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0xa
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573da
mov edx, ebx
not dl
shr ebx, 8
xor bl, 0x51
movzx ecx, bl
shl ecx, 8
movzx edx, dl
or edx, ecx
movabs rcx, 0x58b4493429eb0b7
xor rdi, rcx
mov qword [rax], rdi
mov qword [rsp + 0x268], rax
mov word [rax + 8], dx
lea rax, [0x14029e669]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xaccb9c6b1323e414
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140033f50
mov rdi, qword [rax]
movzx ebx, word [rax + 8]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x1400559f1
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573da
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0xa
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573da
mov qword [rsp + 0x260], rbp
mov edx, ebx
xor dl, 0x91
shr ebx, 8
xor bl, 0xaf
movzx ecx, bl
shl ecx, 8
movzx edx, dl
or edx, ecx
movabs rcx, 0x8d47e102b65f460d
xor rdi, rcx
mov qword [rax], rdi
mov qword [rsp + 0x258], rax
mov word [rax + 8], dx
lea rax, [0x1402a3947]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x8f151bdf8f8e6a5d
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140034de0
mov rdi, qword [rax]
mov ebp, dword [rax + 8]
movzx ebx, byte [rax + 0xc]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140055aa0
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573e9
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0xd
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573e9
xor bl, 0x77
movabs rcx, 0xb25c758211b3fab0
xor rdi, rcx
xor ebp, 0xa1695574
mov qword [rax], rdi
mov dword [rax + 8], ebp
mov qword [rsp + 0x250], rax
mov byte [rax + 0xc], bl
lea rax, [0x14029bafe]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x421e58e134c764ad
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140034f90
mov edi, dword [rax]
movzx ebx, byte [rax + 4]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140055b38
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140057416
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 5
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140057416
mov r14, rax
xor bl, 0xee
xor edi, 0xb0981713
mov byte [rax + 4], bl
mov dword [rax], edi
lea rax, [0x1402a3930]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x20d9f59058b6f453
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.1400348c0
mov edi, dword [rax]
movzx ebx, byte [rax + 4]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140055bba
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140057416
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 5
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140057416
mov rbp, rax
mov qword [rsp + 0x248], rsi
xor bl, 0xc9
xor edi, 0xcee0f7e7
mov byte [rax + 4], bl
mov dword [rax], edi
lea rax, [0x14029b566]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x856d0bb4a708e030
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.1400350e0
mov edi, dword [rax]
movzx esi, word [rax + 4]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140055c44
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573a8
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 6
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573a8
mov rbx, rax
mov qword [rsp + 0x238], r15
mov eax, esi
xor al, 0xbb
shr esi, 8
xor sil, 0xd9
movzx ecx, sil
shl ecx, 8
movzx eax, al
or eax, ecx
xor edi, 0xc402ee39
mov dword [rbx], edi
mov word [rbx + 4], ax
lea rax, [0x14029df42]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x7c5e33df57e1e4f7
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.1400347a0
mov rsi, qword [rax]
movzx edi, byte [rax + 8]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140055ce4
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140057407
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 9
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140057407
mov r15, rax
mov qword [rsp + 0x240], r13
xor dil, 0x39
movabs rax, 0x65439a193bbf33db
xor rsi, rax
mov qword [r15], rsi
mov byte [r15 + 8], dil
lea rax, [0x1402a4bcc]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x51d639a1d6bd2683
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140035310
mov rsi, qword [rax]
movzx edi, byte [rax + 8]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140055d79
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140057407
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 9
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140057407
mov r13, rax
xor dil, 0x53
movabs rax, 0xf03b4fd30fe94ae9
xor rsi, rax
mov qword [r13], rsi
mov byte [r13 + 8], dil
lea rax, [0x14029ff09]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0xae233856b54d9490
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.14002fe50
mov rdi, qword [rax]
mov r12, qword [rax + 8]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140055e0c
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140057470
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 0x10
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140057470
mov rsi, rax
movq xmm0, r12
movq xmm1, rdi
punpcklqdq xmm1, xmm0
pxor xmm1, xmmword [0x14029c740]
movdqu xmmword [rax], xmm1
lea rax, [0x1402a0593]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x4c8073ab3de4075
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.14002fc90
mov edi, dword [rax]
movzx r12d, word [rax + 4]
movzx eax, byte [0x1403ac1f0]
mov rcx, qword [0x1403ac160]
test rcx, rcx
jne 0x140055ea0
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400573a8
mov rcx, rax
mov qword [0x1403ac160], rax
mov r8d, 6
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400573a8
mov ecx, r12d
xor cl, 0x68
shr r12d, 8
xor r12b, 0x93
movzx edx, r12b
shl edx, 8
movzx ecx, cl
or ecx, edx
xor edi, 0x52598fbf
mov dword [rax], edi
mov word [rax + 4], cx
mov rdx, qword [rsp + 0x1b0]
mov qword [rdx], 0xe
mov rcx, qword [rsp + 0x240]
mov qword [rdx + 8], rcx
mov qword [rdx + 0x10], 0xe
mov qword [rdx + 0x18], 9
mov rcx, qword [rsp + 0x248]
mov qword [rdx + 0x20], rcx
mov qword [rdx + 0x28], 9
mov qword [rdx + 0x30], 7
mov rcx, qword [rsp + 0x1e0]
mov qword [rdx + 0x38], rcx
mov qword [rdx + 0x40], 7
mov qword [rdx + 0x48], 7
mov rcx, qword [rsp + 0x1a8]
mov qword [rdx + 0x50], rcx
mov qword [rdx + 0x58], 7
mov qword [rdx + 0x60], 3
mov rcx, qword [rsp + 0x1e8]
mov qword [rdx + 0x68], rcx
mov qword [rdx + 0x70], 3
mov qword [rdx + 0x78], 7
mov rcx, qword [rsp + 0x1d8]
mov qword [rdx + 0x80], rcx
mov qword [rdx + 0x88], 7
mov qword [rdx + 0x90], 0xb
mov rcx, qword [rsp + 0x1f0]
mov qword [rdx + 0x98], rcx
mov qword [rdx + 0xa0], 0xb
mov qword [rdx + 0xa8], 7
mov rcx, qword [rsp + 0x1d0]
mov qword [rdx + 0xb0], rcx
mov qword [rdx + 0xb8], 7
mov qword [rdx + 0xc0], 0xd
mov rcx, qword [rsp + 0x1c8]
mov qword [rdx + 0xc8], rcx
mov qword [rdx + 0xd0], 0xd
mov qword [rdx + 0xd8], 8
mov rcx, qword [rsp + 0x1a0]
mov qword [rdx + 0xe0], rcx
mov qword [rdx + 0xe8], 8
mov qword [rdx + 0xf0], 8
mov rcx, qword [rsp + 0x1c0]
mov qword [rdx + 0xf8], rcx
mov qword [rdx + 0x100], 8
mov qword [rdx + 0x108], 0xa
mov rcx, qword [rsp + 0x1b8]
mov qword [rdx + 0x110], rcx
mov qword [rdx + 0x118], 0xa
mov qword [rdx + 0x120], 0xd
mov rcx, qword [rsp + 0x348]
mov qword [rdx + 0x128], rcx
mov qword [rdx + 0x130], 0xd
mov qword [rdx + 0x138], 5
mov rcx, qword [rsp + 0x308]
mov qword [rdx + 0x140], rcx
mov qword [rdx + 0x148], 5
mov qword [rdx + 0x150], 3
mov rcx, qword [rsp + 0x340]
mov qword [rdx + 0x158], rcx
mov qword [rdx + 0x160], 3
mov qword [rdx + 0x168], 6
mov rcx, qword [rsp + 0x338]
mov qword [rdx + 0x170], rcx
mov qword [rdx + 0x178], 6
mov qword [rdx + 0x180], 4
mov rcx, qword [rsp + 0x328]
mov qword [rdx + 0x188], rcx
mov qword [rdx + 0x190], 4
mov qword [rdx + 0x198], 4
mov rcx, qword [rsp + 0x330]
mov qword [rdx + 0x1a0], rcx
mov qword [rdx + 0x1a8], 4
mov qword [rdx + 0x1b0], 4
mov rcx, qword [rsp + 0x320]
mov qword [rdx + 0x1b8], rcx
mov qword [rdx + 0x1c0], 4
mov qword [rdx + 0x1c8], 6
mov rcx, qword [rsp + 0x318]
mov qword [rdx + 0x1d0], rcx
mov qword [rdx + 0x1d8], 6
mov qword [rdx + 0x1e0], 4
mov rcx, qword [rsp + 0x310]
mov qword [rdx + 0x1e8], rcx
mov qword [rdx + 0x1f0], 4
mov qword [rdx + 0x1f8], 6
mov rcx, qword [rsp + 0x300]
mov qword [rdx + 0x200], rcx
mov qword [rdx + 0x208], 6
mov qword [rdx + 0x210], 7
mov rcx, qword [rsp + 0x2f8]
mov qword [rdx + 0x218], rcx
mov qword [rdx + 0x220], 7
mov qword [rdx + 0x228], 8
mov rcx, qword [rsp + 0x2f0]
mov qword [rdx + 0x230], rcx
mov qword [rdx + 0x238], 8
mov qword [rdx + 0x240], 0xa
mov rcx, qword [rsp + 0x2e8]
mov qword [rdx + 0x248], rcx
mov qword [rdx + 0x250], 0xa
mov qword [rdx + 0x258], 0xd
mov rcx, qword [rsp + 0x2e0]
mov qword [rdx + 0x260], rcx
mov qword [rdx + 0x268], 0xd
mov qword [rdx + 0x270], 8
mov rcx, qword [rsp + 0x2c0]
mov qword [rdx + 0x278], rcx
mov qword [rdx + 0x280], 8
mov qword [rdx + 0x288], 6
mov rcx, qword [rsp + 0x2d8]
mov qword [rdx + 0x290], rcx
mov qword [rdx + 0x298], 6
mov qword [rdx + 0x2a0], 6
mov rcx, qword [rsp + 0x2d0]
mov qword [rdx + 0x2a8], rcx
mov qword [rdx + 0x2b0], 6
mov qword [rdx + 0x2b8], 6
mov rcx, qword [rsp + 0x2c8]
mov qword [rdx + 0x2c0], rcx
mov qword [rdx + 0x2c8], 6
mov qword [rdx + 0x2d0], 6
mov rcx, qword [rsp + 0x2b8]
mov qword [rdx + 0x2d8], rcx
mov qword [rdx + 0x2e0], 6
mov qword [rdx + 0x2e8], 7
mov rcx, qword [rsp + 0x2b0]
mov qword [rdx + 0x2f0], rcx
mov qword [rdx + 0x2f8], 7
mov qword [rdx + 0x300], 6
mov rcx, qword [rsp + 0x2a0]
mov qword [rdx + 0x308], rcx
mov qword [rdx + 0x310], 6
mov qword [rdx + 0x318], 9
mov rcx, qword [rsp + 0x2a8]
mov qword [rdx + 0x320], rcx
mov qword [rdx + 0x328], 9
mov qword [rdx + 0x330], 0xa
mov rcx, qword [rsp + 0x298]
mov qword [rdx + 0x338], rcx
mov qword [rdx + 0x340], 0xa
mov qword [rdx + 0x348], 7
mov rcx, qword [rsp + 0x290]
mov qword [rdx + 0x350], rcx
mov qword [rdx + 0x358], 7
mov qword [rdx + 0x360], 0xd
mov rcx, qword [rsp + 0x288]
mov qword [rdx + 0x368], rcx
mov qword [rdx + 0x370], 0xd
mov qword [rdx + 0x378], 0xe
mov rcx, qword [rsp + 0x280]
mov qword [rdx + 0x380], rcx
mov qword [rdx + 0x388], 0xe
mov qword [rdx + 0x390], 8
mov rcx, qword [rsp + 0x260]
mov qword [rdx + 0x398], rcx
mov qword [rdx + 0x3a0], 8
mov qword [rdx + 0x3a8], 0xc
mov rcx, qword [rsp + 0x278]
mov qword [rdx + 0x3b0], rcx
mov qword [rdx + 0x3b8], 0xc
mov qword [rdx + 0x3c0], 6
mov rcx, qword [rsp + 0x270]
mov qword [rdx + 0x3c8], rcx
mov qword [rdx + 0x3d0], 6
mov qword [rdx + 0x3d8], 0xa
mov rcx, qword [rsp + 0x268]
mov qword [rdx + 0x3e0], rcx
mov qword [rdx + 0x3e8], 0xa
mov qword [rdx + 0x3f0], 0xa
mov rcx, qword [rsp + 0x258]
mov qword [rdx + 0x3f8], rcx
mov qword [rdx + 0x400], 0xa
mov qword [rdx + 0x408], 0xd
mov rcx, qword [rsp + 0x250]
mov qword [rdx + 0x410], rcx
mov qword [rdx + 0x418], 0xd
mov qword [rdx + 0x420], 5
mov qword [rdx + 0x428], r14
mov qword [rdx + 0x430], 5
mov qword [rdx + 0x438], 5
mov qword [rdx + 0x440], rbp
mov qword [rdx + 0x448], 5
mov qword [rdx + 0x450], 6
mov qword [rdx + 0x458], rbx
mov qword [rdx + 0x460], 6
mov qword [rdx + 0x468], 9
mov qword [rdx + 0x470], r15
mov qword [rdx + 0x478], 9
mov qword [rdx + 0x480], 9
mov qword [rdx + 0x488], r13
movabs r15, 0x8000000000000000
mov qword [rdx + 0x490], 9
mov qword [rdx + 0x498], 0x10
mov qword [rdx + 0x4a0], rsi
mov qword [rdx + 0x4a8], 0x10
mov qword [rdx + 0x4b0], 6
mov qword [rdx + 0x4b8], rax
mov qword [rdx + 0x4c0], 6
mov qword [rsp + 0x1f8], 0
mov qword [rsp + 0x200], 8
mov qword [rsp + 0x208], 0
lea rax, [0x1402a4439]
mov qword [rsp + 0x50], rax
lea r13, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
movabs rax, 0x98eca521f1759644
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.1400341a0
movabs rcx, 0xaac5dce8789b6b14
xor rcx, qword [rax]
mov edx, 0x3a425cc4
xor edx, dword [rax + 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], edx
lea rcx, [rsp + 0x180]
lea rdx, [rsp + 0x28]
mov r8d, 0xc
call fcn.14006aab0
cmp qword [rsp + 0x180], r15
jne 0x14005747f
mov rdi, qword [rsp + 0x188]
lea rax, [0x14029bcc7]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x8158ece410f0df0d
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.1400338f0
movabs rcx, 0x63c43d72d32ba825
xor rcx, qword [rax]
movabs rdx, 0xae3ea448692be7a7
xor rdx, qword [rax + 8]
movabs r8, 0xde7a5a262c44bb73
xor r8, qword [rax + 0x10]
mov qword [rsp + 0x180], rcx
mov qword [rsp + 0x188], rdx
mov qword [rsp + 0x190], r8
lea rcx, [rsp + 0x28]
lea r8, [rsp + 0x180]
mov r9d, 0x18
mov rdx, rdi
call fcn.14006ac00
cmp qword [rsp + 0x28], r15
jne 0x1400574a7
mov rbx, qword [rsp + 0x30]
lea rax, [0x1402a66d0]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xb644255b9558baab
mov qword [rsp + 0x50], rax
mov r14, r13
mov rdx, qword [rsp + 0x50]
call fcn.140030110
movabs rcx, 0xd009a7a4df36483c
xor rcx, qword [rax]
mov edx, 0x7b57ee9a
xor edx, dword [rax + 8]
movzx eax, word [rax + 0xc]
mov r8d, eax
xor r8b, 0xd8
shr eax, 8
xor al, 0x56
movzx r8d, r8b
movzx eax, al
shl eax, 8
or eax, r8d
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], edx
mov word [rsp + 0x34], ax
lea rcx, [rsp + 0x180]
lea r8, [rsp + 0x28]
mov r9d, 0xe
mov rdx, rdi
call fcn.14006ac00
cmp qword [rsp + 0x180], r15
jne 0x1400574c9
mov rsi, qword [rsp + 0x188]
mov ecx, 2
xor edx, edx
call rbx
cmp rax, 0xffffffffffffffff
mov qword [rsp + 0x1f0], rax
je 0x1400567fe
mov r15, rax
lea rbx, [rsp + 0x50]
mov r8d, 0x130
mov rcx, rbx
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x50], 0x130
mov rcx, r15
mov rdx, rbx
call rsi
test eax, eax
jne 0x140057171
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x220], xmm0
movdqu xmmword [rsp + 0x214], xmm0
mov rcx, rdi
call sub.kernel32.dll_FreeLibrary
mov ecx, 1
mov qword [rsp + 0x1c8], rcx
test eax, eax
mov rsi, r14
je 0x140056835
xorps xmm6, xmm6
jmp 0x140056868
lea rax, str.Failed_to_free_Module_n
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
lea rax, [0x1403911f0]
mov qword [rsp + 0x60], rax
xorps xmm6, xmm6
movups xmmword [rsp + 0x68], xmm6
lea rcx, [rsp + 0x50]
call fcn.1402682b0
xor eax, eax
mov qword [rsp + 0x1b8], rax
xor eax, eax
mov qword [rsp + 0x1c0], rax
mov dword [rsp + 0x1a0], 0
mov dword [rsp + 0x1d0], 0
movdqa xmm0, xmmword [rsp + 0x210]
movdqa xmm1, xmmword [rsp + 0x220]
movdqa xmmword [rsp + 0x190], xmm1
movdqa xmmword [rsp + 0x180], xmm0
mov eax, 8
mov qword [rsp + 0x1e8], rax
xorps xmm7, xmm7
movdqa xmm8, xmmword [0x14029c750]
xor eax, eax
mov qword [rsp + 0x1a8], rax
xor eax, eax
mov qword [rsp + 0x1e0], rax
jmp 0x140056945
lea rcx, [rsp + 0x1f8]
mov rdx, r12
call fcn.140027c80
mov rcx, qword [rsp + 0x200]
mov r12, qword [rsp + 0x208]
mov qword [rsp + 0x1a8], r14
lea rax, [r12 + r12*2]
mov qword [rcx + rax*8], r13
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsp + 0x1e8], rcx
mov qword [rcx + rax*8 + 0x10], r15
inc r12
mov qword [rsp + 0x1e0], r12
mov qword [rsp + 0x208], r12
mov rbx, rdi
lea rax, [0x14029a468]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xc27e7ae7eaa24f41
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.14002e6a0
mov rcx, qword [rax]
movabs rdx, 0xee3e165e73ef842b
xor rcx, rdx
mov eax, dword [rax + 8]
mov edx, 0xb24dc4a4
xor eax, edx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x48], eax
mov r8d, 0xc
lea r13, [rsp + 0x28]
mov rcx, r13
lea r14, [rsp + 0x40]
mov rdx, r14
call fcn.14006aab0
movabs rbp, 0x8000000000000000
cmp qword [rsp + 0x28], rbp
jne 0x14005729e
mov rdi, qword [rsp + 0x30]
lea rax, [0x1402a5d03]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x98664c2f57ab3c84
mov qword [rsp + 0x50], rax
mov r12, rsi
mov rdx, qword [rsp + 0x50]
call fcn.1400353f0
mov rcx, qword [rax]
movabs rdx, 0x72ebcef4ea94503d
xor rcx, rdx
mov edx, dword [rax + 8]
mov r8d, 0x6d9c26ae
xor edx, r8d
movzx eax, byte [rax + 0xc]
xor al, 0x4a
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x48], edx
mov byte [rsp + 0x4c], al
mov r9d, 0xd
mov rcx, r13
mov rsi, rdi
mov rdx, rdi
mov r8, r14
call fcn.14006ac00
cmp qword [rsp + 0x28], rbp
jne 0x1400572bd
mov r14, qword [rsp + 0x1a8]
test r14, r14
je 0x140056b10
mov rdi, rbx
mov rbx, qword [rsp + 0x30]
movlps qword [rsp + 0x50], xmm6
mov eax, dword [rsp + 0x1d0]
mov dword [rsp + 0x58], eax
movdqa xmm0, xmmword [rsp + 0x180]
movdqa xmm1, xmmword [rsp + 0x190]
lea rcx, [rsp + 0x7c]
movdqu xmmword [rcx - 0x10], xmm1
movdqu xmmword [rcx - 0x20], xmm0
mov r8d, 0x104
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x1f0]
mov rdx, r12
call rbx
mov r13, rbp
cmp eax, 1
je 0x140056f09
mov rcx, rsi
call sub.kernel32.dll_FreeLibrary
test eax, eax
mov rsi, r12
jne 0x140056af5
lea rax, str.Failed_to_free_Module_n
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
lea rax, [0x1403911f0]
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x68], xmm7
mov rcx, rsi
call fcn.1402682b0
cmp r13, rbp
jne 0x140056bf0
jmp 0x140056f7d
mov rbx, qword [rsp + 0x1c0]
test rbx, rbx
je 0x140056b65
js 0x1400573b7
movzx eax, byte [0x1403ac1f0]
mov rax, qword [0x1403ac160]
test rax, rax
jne 0x140056b4b
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14005739b
mov qword [0x1403ac160], rax
mov rcx, rax
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapAlloc
mov rdi, rax
test rax, rax
jne 0x140056b6a
jmp 0x14005739b
mov edi, 1
mov rcx, rdi
mov rdx, qword [rsp + 0x1c8]
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov rcx, rsi
call sub.kernel32.dll_FreeLibrary
test eax, eax
je 0x140056ba2
mov eax, dword [rsp + 0x1a0]
mov dword [rsp + 0x1d8], eax
mov r15, rbx
mov r13, rbx
mov rsi, r12
jmp 0x140056bf0
lea rax, str.Failed_to_free_Module_n
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
lea rax, [0x1403911f0]
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x68], xmm7
mov rsi, r12
mov rcx, r12
call fcn.1402682b0
mov eax, dword [rsp + 0x1a0]
mov dword [rsp + 0x1d8], eax
mov r15, rbx
mov r13, rbx
nop word [rax + rax]
inc r14
mov ebx, 0x10
mov r12, qword [rsp + 0x1e0]
jmp 0x140056c21
add rbx, 0x18
cmp rbx, 0x4d8
je 0x140056eb0
mov rax, qword [rsp + 0x1b0]
cmp qword [rax + rbx], r15
jne 0x140056c10
mov rax, qword [rsp + 0x1b0]
mov rcx, qword [rax + rbx - 8]
mov rdx, rdi
mov r8, r15
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140056c10
mov qword [rsp + 0x1a8], r13
lea rax, [0x14029fb4d]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xb71d86f2071958d0
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.14002eef0
mov rcx, qword [rax]
movabs rdx, 0x32111a1279be2e6b
xor rcx, rdx
mov eax, dword [rax + 8]
mov edx, 0x3b3905db
xor eax, edx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x48], eax
mov r8d, 0xc
lea rbp, [rsp + 0x28]
mov rcx, rbp
lea rbx, [rsp + 0x40]
mov rdx, rbx
call fcn.14006aab0
mov r13, rsi
movabs rsi, 0x8000000000000000
cmp qword [rsp + 0x28], rsi
jne 0x1400572df
mov r12, qword [rsp + 0x30]
lea rax, [0x1402a2678]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0x4aa0a13c58dbef21
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.14002edc0
mov rcx, qword [rax]
movabs rdx, 0x2cda76f2c8e137b9
xor rcx, rdx
movzx edx, byte [rax + 0xa]
movzx eax, word [rax + 8]
mov r8d, eax
shr r8d, 8
xor al, 0xf0
xor r8b, 0xf9
movzx eax, al
movzx r8d, r8b
shl r8d, 8
or r8d, eax
xor dl, 0x84
mov qword [rsp + 0x40], rcx
mov word [rsp + 0x48], r8w
mov byte [rsp + 0x4a], dl
mov r9d, 0xb
mov rcx, rbp
mov rdx, r12
mov r8, rbx
call fcn.14006ac00
cmp qword [rsp + 0x28], rsi
jne 0x14005731e
mov rbx, qword [rsp + 0x30]
lea rax, [0x14029e186]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
movabs rax, 0xdf1c325cbc1af61d
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
call fcn.140034390
movq xmm0, qword [rax]
movq xmm1, qword [rax + 8]
punpcklqdq xmm0, xmm1
pxor xmm0, xmm8
movdqa xmmword [rsp + 0x40], xmm0
mov r9d, 0x10
mov rcx, rbp
mov rdx, r12
lea r8, [rsp + 0x40]
call fcn.14006ac00
cmp qword [rsp + 0x28], rsi
jne 0x14005733d
mov rax, r13
mov r13, qword [rsp + 0x30]
lea rcx, [0x1402a02cb]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x50]
movabs rdx, 0x4a8ae250fc06aad7
mov qword [rsp + 0x50], rdx
mov rdx, qword [rsp + 0x50]
call fcn.14002f200
mov rcx, qword [rax]
movabs rdx, 0x652bd1e4031295b6
xor rcx, rdx
movzx edx, byte [rax + 0xa]
movzx eax, word [rax + 8]
mov r8d, eax
shr r8d, 8
xor al, 0x8f
xor r8b, 0x93
movzx eax, al
movzx r8d, r8b
shl r8d, 8
or r8d, eax
xor dl, 0xfc
mov qword [rsp + 0x40], rcx
mov word [rsp + 0x48], r8w
mov byte [rsp + 0x4a], dl
mov r9d, 0xb
mov rcx, rbp
mov rdx, r12
lea r8, [rsp + 0x40]
call fcn.14006ac00
cmp qword [rsp + 0x28], rsi
jne 0x14005735c
mov rsi, qword [rsp + 0x30]
mov ecx, 1
xor edx, edx
mov r8d, dword [rsp + 0x1d8]
call rbx
mov rbx, rax
mov rcx, rax
mov edx, 1
call r13
mov rcx, rbx
call rsi
mov rcx, r12
call sub.kernel32.dll_FreeLibrary
test eax, eax
lea rsi, [rsp + 0x50]
mov r12, qword [rsp + 0x1e0]
mov r13, qword [rsp + 0x1a8]
je 0x140056ecb
cmp r12, qword [rsp + 0x1f8]
je 0x1400568f0
mov rcx, qword [rsp + 0x1e8]
jmp 0x140056910
lea rax, str.Failed_to_free_Module_n
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
lea rax, [0x1403911f0]
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x68], xmm7
mov rcx, rsi
call fcn.1402682b0
cmp r12, qword [rsp + 0x1f8]
je 0x1400568f0
jmp 0x140056ebe
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x1d8], eax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 0
mov r8d, 0x104
lea rbx, [rsp + 0x28]
mov rcx, rbx
xor edx, edx
call fcn.140028070
mov edi, 0x2c
nop dword [rax]
movzx edx, byte [rsp + rdi + 0x50]
mov rcx, rbx
call fcn.1400276d0
inc rdi
cmp rdi, 0x130
jne 0x140056f50
mov r13, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
jmp 0x140056ab8
cmp qword [rsp + 0x1b8], 0
je 0x140056f9e
mov rcx, qword [0x1403ac160]
xor edx, edx
mov r8, qword [rsp + 0x1c8]
call fcn.14029804c
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x60], rax
movdqu xmm0, xmmword [rsp + 0x1f8]
movdqa xmmword [rsp + 0x50], xmm0
mov rax, qword [rsp + 0x238]
mov r15, qword [rax]
lea rdi, [r15 + 0x10]
mov rcx, rdi
call sub.kernel32.dll_AcquireSRWLockExclusive
mov rax, qword [0x1403ac1e8]
dec rbp
test rax, rbp
jne 0x14005711c
xor r14d, r14d
movzx eax, byte [r15 + 0x18]
test al, al
jne 0x140057135
mov rbx, rbp
lea r12, [r15 + 0xb0]
mov rsi, qword [r15 + 0xb8]
mov r13, qword [r15 + 0xc0]
test r13, r13
je 0x140057044
lea rbp, [rsi + 8]
jmp 0x140057029
add rbp, 0x18
dec r13
je 0x140057044
cmp qword [rbp - 8], 0
je 0x140057020
mov r8, qword [rbp]
mov rcx, qword [0x1403ac160]
xor edx, edx
call fcn.14029804c
jmp 0x140057020
cmp qword [r12], 0
je 0x14005705c
mov rcx, qword [0x1403ac160]
xor edx, edx
mov r8, rsi
call fcn.14029804c
mov rax, qword [rsp + 0x60]
mov qword [r12 + 0x10], rax
movdqa xmm0, xmmword [rsp + 0x50]
movdqu xmmword [r12], xmm0
test r14b, r14b
jne 0x140057087
mov rax, qword [0x1403ac1e8]
test rax, rbx
jne 0x14005724a
mov rcx, rdi
call fcn.1402980c4
mov edi, 8
jmp 0x1400570ad
add rdi, 0x18
cmp rdi, 0x4d0
je 0x1400570d9
mov rax, qword [rsp + 0x1b0]
cmp qword [rax + rdi - 8], 0
je 0x1400570a0
mov rax, qword [rsp + 0x1b0]
mov r8, qword [rax + rdi]
mov rcx, qword [0x1403ac160]
xor edx, edx
call fcn.14029804c
jmp 0x1400570a0
mov rcx, qword [0x1403ac160]
xor edx, edx
mov r8, qword [rsp + 0x1b0]
call fcn.14029804c
movaps xmm6, xmmword [rsp + 0x350]
movaps xmm7, xmmword [rsp + 0x360]
movaps xmm8, xmmword [rsp + 0x370]
add rsp, 0x388
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140248e40
mov r14d, eax
xor r14b, 1
movzx eax, byte [r15 + 0x18]
test al, al
je 0x140056ff4
mov qword [rsp + 0x180], rdi
mov byte [rsp + 0x188], r14b
lea rax, str.src_evasion_process.rs
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1402a70c8]
lea r8, [rsp + 0x180]
mov edx, 0x2b
call fcn.1400ad960
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x1a0], eax
mov qword [rsp + 0x180], 0
mov qword [rsp + 0x188], 1
mov qword [rsp + 0x190], 0
lea rbx, [rsp + 0x180]
mov r8d, 0x104
mov rcx, rbx
xor edx, edx
call fcn.140028070
mov esi, 0x2c
nop dword [rax]
movzx edx, byte [rsp + rsi + 0x50]
mov rcx, rbx
call fcn.1400276d0
inc rsi
cmp rsi, 0x130
jne 0x1400571c0
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x1b8], rax
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x1c8], rax
mov rsi, qword [rsp + 0x190]
movsd xmm6, qword [rsp + 0x50]
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x1d0], eax
movups xmm0, xmmword [rsp + 0x5c]
movaps xmmword [rsp + 0x210], xmm0
movdqu xmm0, xmmword [rsp + 0x6c]
movdqa xmmword [rsp + 0x220], xmm0
mov rcx, rdi
call sub.kernel32.dll_FreeLibrary
test eax, eax
mov qword [rsp + 0x1c0], rsi
je 0x140057261
mov rsi, r14
jmp 0x140056892
call fcn.140248e40
test al, al
jne 0x140057087
mov byte [r15 + 0x18], 1
jmp 0x140057087
lea rax, str.Failed_to_free_Module_n
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
lea rax, [0x1403911f0]
mov qword [rsp + 0x60], rax
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
lea rcx, [rsp + 0x50]
call fcn.1402682b0
mov rsi, r14
jmp 0x140056892
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
movdqu xmm0, xmmword [rsp + 0x28]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, str.src_evasion_process.rs
jmp 0x1400572fc
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
movdqu xmm0, xmmword [rsp + 0x28]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, str.src_evasion_process.rs
jmp 0x140057379
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
movdqu xmm0, xmmword [rsp + 0x28]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, str.src_global_utils.rs
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1402a6fc8]
lea r8, [rsp + 0x50]
mov edx, 0x2b
call fcn.1400ad960
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
movdqu xmm0, xmmword [rsp + 0x28]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, str.src_global_utils.rs
jmp 0x140057379
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
movdqu xmm0, xmmword [rsp + 0x28]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, str.src_global_utils.rs
jmp 0x140057379
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
movdqu xmm0, xmmword [rsp + 0x28]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, str.src_global_utils.rs
mov qword [rsp + 0x20], rax
lea rcx, str.Failed_to_get_ptr
lea r9, [0x1402a6fc8]
lea r8, [rsp + 0x50]
mov edx, 0x11
call fcn.1400ad960
mov ecx, 1
mov rdx, rbx
call fcn.1400a81e0
mov ecx, 1
mov edx, 6
call fcn.1400a81e0
call fcn.1400a81a0
mov ecx, 1
mov edx, 7
call fcn.1400a81e0
mov ecx, 1
mov edx, 8
call fcn.1400a81e0
mov ecx, 1
mov edx, 0xa
call fcn.1400a81e0
mov ecx, 1
mov edx, 0xd
call fcn.1400a81e0
mov ecx, 1
mov edx, 4
call fcn.1400a81e0
mov ecx, 1
mov edx, 9
call fcn.1400a81e0
mov ecx, 1
mov edx, 5
call fcn.1400a81e0
mov ecx, 1
mov edx, 3
call fcn.1400a81e0
mov ecx, 1
mov edx, 0xe
call fcn.1400a81e0
mov ecx, 8
mov edx, 0x4c8
call fcn.1400a81e0
mov ecx, 1
mov edx, 0xb
call fcn.1400a81e0
mov ecx, 1
mov edx, 0xc
call fcn.1400a81e0
mov ecx, 1
mov edx, 0x10
call fcn.1400a81e0
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x60], rax
movdqu xmm0, xmmword [rsp + 0x180]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, str.src_evasion_process.rs
jmp 0x1400572fc
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
movdqu xmm0, xmmword [rsp + 0x28]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, str.src_evasion_process.rs
jmp 0x140057379
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x60], rax
movdqu xmm0, xmmword [rsp + 0x180]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, str.src_evasion_process.rs
jmp 0x140057379