Function at 0x140055700
Capabilities:
Enumerate process modules
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa98
mov qword [rsp + 0x148], r9
mov qword [rsp + 0xa8], r8
mov rbx, rdx
test rcx, rcx
je 0x14005575f
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x140055764
dec rbx
movabs r14, 0x8000000000000000
cmp qword [0x140099028], r14
je 0x140055779
mov rdx, qword [0x140099038]
test rdx, rdx
jne 0x140055cf1
jmp 0x140056bb9
test rbx, rbx
jne 0x140055734
xor ebx, ebx
movabs r14, 0x8000000000000000
cmp qword [0x140099028], r14
jne 0x14005574a
mov rax, qword [0x140b8f7e8]
movzx eax, byte [rax]
mov ecx, 0x8c0
mov edx, 8
call fcn.140002610
test rax, rax
je 0x140057150
mov qword [rsp + 0xb0], 4
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 8
mov qword [rsp + 0xf0], 0
mov ecx, 8
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140055bdc
mov rsi, rax
lea rdi, [rsp + 0x660]
mov r8d, 0x438
mov rcx, rdi
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x660], 0x438
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.dll_Module32FirstW
cmp eax, 1
jne 0x140055bd4
mov eax, 8
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x28], rax
jmp 0x140055869
movabs r14, 0x8000000000000000
nop dword [rax]
mov rcx, rsi
lea rdx, [rsp + 0x660]
call sub.KERNEL32.dll_Module32NextW
cmp eax, 1
jne 0x140055bd4
mov eax, 0x208
xor r8d, r8d
nop word cs:[rax + rax]
cmp word [rsp + r8*2 + 0x890], 0
je 0x1400558f0
cmp word [rsp + r8*2 + 0x892], 0
je 0x1400558ce
cmp word [rsp + r8*2 + 0x894], 0
je 0x1400558d3
cmp word [rsp + r8*2 + 0x896], 0
je 0x1400558d9
cmp word [rsp + r8*2 + 0x898], 0
je 0x1400558df
add r8, 5
add rax, 0xfffffffffffffff6
jne 0x140055880
mov r8d, 0x104
jmp 0x1400558f0
inc r8
jmp 0x1400558f0
add r8, 2
jmp 0x1400558f0
add r8, 3
jmp 0x1400558f0
add r8, 4
nop word cs:[rax + rax]
lea rcx, [rsp + 0x190]
lea rdx, [rsp + 0x890]
call fcn.140031400
mov rbp, qword [rsp + 0x198]
mov r8, qword [rsp + 0x1a0]
lea rcx, [rsp + 0x430]
mov rdx, rbp
call fcn.1400554a0
cmp qword [rsp + 0x430], 0
je 0x140055a3a
mov rdi, qword [rsp + 0x438]
mov r14, qword [rsp + 0x440]
mov r15, qword [rsp + 0x448]
mov r9d, 0x40
mov rcx, r14
mov rdx, r15
xor r8d, r8d
call fcn.1400585f0
test rax, rax
je 0x140055a20
cmp rdx, 0x40
jb 0x140055a20
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140055a20
mov r13d, dword [rax + 0x3c]
mov r9d, 0x88
mov rcx, r14
mov rdx, r15
mov r8, r13
call fcn.1400585f0
mov r12, rax
test rax, rax
je 0x140055a20
cmp rdx, 0x88
jb 0x140055a20
cmp dword [r12], 0x4550
jne 0x140055a20
movzx eax, word [r12 + 0x18]
cmp eax, 0x20b
jne 0x140055a20
movzx r9d, word [r12 + 0x14]
cmp r9, 0x70
jb 0x140055a20
add r13, 0x88
add r9, 0xffffffffffffff90
mov rcx, r14
mov rdx, r15
mov r8, r13
call fcn.1400585f0
test rax, rax
je 0x140055a20
mov r8, rdx
mov r9d, dword [r12 + 0x84]
lea rcx, [rsp + 0x430]
mov rdx, rax
call fcn.1400595b0
cmp qword [rsp + 0x430], 0
je 0x140055a5e
nop word cs:[rax + rax]
mov rcx, r14
call sub.KERNEL32.dll_UnmapViewOfFile
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
movabs r14, 0x8000000000000000
mov rdx, qword [rsp + 0x190]
test rdx, rdx
je 0x140055850
mov r8d, 1
mov rcx, rbp
call fcn.140002620
jmp 0x140055850
mov r15, qword [r12 + 0x30]
mov rax, qword [rsp + 0x678]
mov qword [rsp + 0x38], rax
mov r13, qword [rsp + 0x190]
mov rax, qword [0x140b8f7e8]
movzx eax, byte [rax]
mov ecx, 0x10
mov edx, 8
call fcn.140002610
test rax, rax
je 0x14005716b
mov r12, rax
mov eax, dword [rsp + 0x680]
mov qword [r12], r15
mov qword [r12 + 8], rax
lea rax, [rsp + 0x1a0]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x430], xmm0
mov rcx, r14
call sub.KERNEL32.dll_UnmapViewOfFile
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
movabs rax, 0x8000000000000000
cmp r13, rax
je 0x140055842
mov rcx, qword [rsp + 0x38]
sub rcx, r15
mov qword [rsp + 0x200], r13
mov qword [rsp + 0x208], rbp
movaps xmm0, xmmword [rsp + 0x430]
lea rax, [rsp + 0x210]
movups xmmword [rax], xmm0
mov qword [rsp + 0x220], 1
mov qword [rsp + 0x228], r12
mov qword [rsp + 0x230], 1
mov qword [rsp + 0x238], rcx
mov rdx, qword [rsp + 0x28]
cmp rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x30]
jne 0x140055b73
lea rcx, [rsp + 0xe0]
call fcn.14000f9d0
movabs r14, 0x8000000000000000
mov rcx, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0xf0]
jmp 0x140055b7d
movabs r14, 0x8000000000000000
mov rax, rdx
shl rax, 6
movups xmm0, xmmword [rsp + 0x200]
movups xmm1, xmmword [rsp + 0x210]
movups xmm2, xmmword [rsp + 0x220]
movups xmm3, xmmword [rsp + 0x230]
movups xmmword [rcx + rax + 0x30], xmm3
movups xmmword [rcx + rax + 0x20], xmm2
movups xmmword [rcx + rax + 0x10], xmm1
mov qword [rsp + 0x30], rcx
movups xmmword [rcx + rax], xmm0
inc rdx
mov rax, rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0xf0], rdx
jmp 0x140055850
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
movups xmm0, xmmword [rsp + 0xe0]
movaps xmmword [rsp + 0x660], xmm0
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x670], rax
movups xmm0, xmmword [rsp + 0xb0]
movups xmmword [rsp + 0x678], xmm0
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x688], rax
mov rsi, qword [0x140099028]
cmp rsi, r14
je 0x140055cb4
mov rdi, qword [0x140099030]
mov r14, qword [0x140099038]
test r14, r14
je 0x140055c8e
lea r15, [rdi + 0x28]
jmp 0x140055c59
add r15, 0x40
dec r14
je 0x140055c8e
mov rdx, qword [r15 - 0x28]
test rdx, rdx
je 0x140055c71
mov rcx, qword [r15 - 0x20]
mov r8d, 1
call fcn.140002620
mov rdx, qword [r15 - 8]
test rdx, rdx
je 0x140055c50
mov rcx, qword [r15]
shl rdx, 4
mov r8d, 8
call fcn.140002620
jmp 0x140055c50
test rsi, rsi
je 0x140055ca8
shl rsi, 6
mov r8d, 8
mov rcx, rdi
mov rdx, rsi
call fcn.140002620
lea rcx, [0x140099040]
call fcn.140004060
movaps xmm0, xmmword [rsp + 0x660]
movaps xmm1, xmmword [rsp + 0x670]
movaps xmm2, xmmword [rsp + 0x680]
movups xmmword [0x140099048], xmm2
movups xmmword [0x140099038], xmm1
movups xmmword [0x140099028], xmm0
mov rdx, qword [0x140099038]
test rdx, rdx
je 0x140056bb9
mov rax, qword [0x140099030]
mov rcx, rdx
shl rcx, 6
add rcx, rax
xor r15d, r15d
mov r8, rax
mov r10, qword [r8 + 0x28]
mov r9, qword [r8 + 0x30]
mov rbp, qword [r8 + 0x38]
add r8, 0x40
shl r9, 4
nop dword [rax]
test r9, r9
je 0x140055d50
mov r11, r10
add r10, 0x10
mov rsi, qword [r11]
add rsi, rbp
add r9, 0xfffffffffffffff0
cmp rsi, rbx
ja 0x140055d20
add rsi, qword [r11 + 8]
cmp rsi, rbx
jbe 0x140055d20
jmp 0x140055d5d
inc r15
cmp r8, rcx
jne 0x140055d08
jmp 0x140056bb9
mov r14, qword [0x140099050]
test r14, r14
je 0x140055d9a
mov r13, qword [0x140099048]
imul rsi, r14, 0x230
xor ecx, ecx
xor r12d, r12d
nop dword [rax]
cmp qword [r13 + r12], r15
je 0x140055f12
add r12, 0x230
dec rcx
cmp rsi, r12
jne 0x140055d80
cmp rdx, r15
jbe 0x140056d21
mov rcx, r15
shl rcx, 6
mov rdx, qword [rax + rcx + 8]
mov r8, qword [rax + rcx + 0x10]
lea rcx, [rsp + 0x660]
call fcn.1400554a0
cmp qword [rsp + 0x660], 0
je 0x140056bb9
mov r14, qword [rsp + 0x668]
mov r12, qword [rsp + 0x670]
mov r13, qword [rsp + 0x678]
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], 8
mov qword [rsp + 0xd8], 0
mov r9d, 0x40
mov rcx, r12
mov rdx, r13
xor r8d, r8d
call fcn.1400585f0
test rax, rax
je 0x140055ef0
cmp rdx, 0x40
jb 0x140055ef0
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140055ef0
mov esi, dword [rax + 0x3c]
mov r9d, 0x88
mov rcx, r12
mov rdx, r13
mov r8, rsi
call fcn.1400585f0
mov rdi, rax
test rax, rax
je 0x140055ef0
cmp rdx, 0x88
jb 0x140055ef0
cmp dword [rdi], 0x4550
jne 0x140055ef0
movzx eax, word [rdi + 0x18]
cmp eax, 0x20b
jne 0x140055ef0
movzx r9d, word [rdi + 0x14]
cmp r9, 0x70
jb 0x140055ef0
add rsi, 0x88
add r9, 0xffffffffffffff90
mov rcx, r12
mov rdx, r13
mov r8, rsi
mov qword [rsp + 0x28], r9
call fcn.1400585f0
test rax, rax
je 0x140055ef0
mov r8, rdx
mov r9d, dword [rdi + 0x84]
lea rcx, [rsp + 0x178]
mov rdx, rax
call fcn.1400595b0
cmp qword [rsp + 0x178], 0
mov r8, qword [rsp + 0x28]
je 0x140056c04
lea rcx, [rsp + 0xb0]
call fcn.1400061c0
mov rcx, r12
call sub.KERNEL32.dll_UnmapViewOfFile
mov rcx, r14
call sub.KERNEL32.dll_CloseHandle
jmp 0x140056bb9
test rcx, rcx
je 0x140055fab
lea rdi, [r12 + r13]
lea rcx, [rsp + 0x200]
mov r8d, 0x230
mov rdx, rdi
call sub.msvcrt.dll_memcpy
lea rdx, [r12 + r13]
add rdx, 0x230
sub rsi, r12
add rsi, 0xfffffffffffffdd0
mov rcx, rdi
mov r8, rsi
call sub.msvcrt.dll_memmove
lea rsi, [r14 - 1]
mov qword [0x140099050], rsi
cmp rsi, qword [0x140099040]
jne 0x140055f71
mov rcx, rsi
call fcn.1400104a0
mov r13, qword [0x140099048]
lea rcx, [r13 + 0x230]
imul r8, rsi, 0x230
mov rdx, r13
call sub.msvcrt.dll_memmove
lea rdx, [rsp + 0x200]
mov r8d, 0x230
mov rcx, r13
call sub.msvcrt.dll_memcpy
mov qword [0x140099050], r14
sub rbx, rbp
lea r15, [rbx + 1]
mov r12, qword [r13 + 0x1b8]
mov rdx, qword [r13 + 0x1c0]
xor ecx, ecx
test rdx, rdx
je 0x140056005
mov rax, rdx
mov r8, rdx
nop dword [rax]
shr rax, 1
add rax, rcx
mov r9, rax
shl r9, 5
mov r9, qword [r12 + r9]
cmp r9, r15
je 0x140055fff
lea r10, [rax + 1]
cmp r9, r15
cmova r8, rax
cmovb rcx, r10
mov rax, r8
sub rax, rcx
ja 0x140055fd0
jmp 0x140056005
inc rax
mov rcx, rax
cmp rcx, rdx
ja 0x14005715f
mov eax, 3
test rcx, rcx
je 0x14005646f
lea rsi, [r13 + 0x1b0]
shl rcx, 5
lea r14, [rcx + r12]
add r14, 0xffffffffffffffe0
neg rcx
xor edx, edx
jmp 0x14005604e
add r14, 0xffffffffffffffe0
add rcx, 0x20
je 0x14005646f
cmp qword [r14 + 0x18], rbx
jbe 0x140056095
cmp qword [r14 + 8], rbx
jbe 0x140056040
cmp r15, qword [r14]
jbe 0x140056040
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r13 + 0x1d0]
cmp rcx, rdx
jae 0x140056e82
imul rcx, rcx, 0x218
add rcx, qword [r13 + 0x1c8]
mov qword [rsp + 0x668], rcx
mov ecx, 0x10
xor ebp, ebp
mov rdx, r14
jmp 0x14005609d
mov ecx, 8
mov bpl, 1
mov qword [rsp + rcx + 0x660], rdx
mov rdi, qword [rsp + 0x668]
test rdi, rdi
je 0x14005646f
lea rcx, [rsp + 0x200]
mov rdx, rdi
mov r8, rsi
call fcn.14001a440
mov qword [rsp + 0x190], rdi
mov qword [rsp + 0x1a0], rbx
mov qword [rsp + 0x198], rsi
cmp qword [rsp + 0x230], 0
mov qword [rsp + 0x50], r13
je 0x1400561b6
lea rax, [rsp + 0x230]
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x440], rcx
movups xmm0, xmmword [rax]
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x448], rax
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x450], rax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x458], rax
movups xmm1, xmmword [rsp + 0x200]
movups xmm2, xmmword [rsp + 0x210]
movups xmm3, xmmword [rsp + 0x220]
movaps xmmword [rsp + 0x660], xmm1
movaps xmmword [rsp + 0x670], xmm2
movaps xmmword [rsp + 0x680], xmm3
movaps xmmword [rsp + 0x690], xmm0
mov rax, qword [rsp + 0x440]
mov qword [rsp + 0x6a0], rax
mov rax, qword [rsp + 0x448]
mov qword [rsp + 0x6a8], rax
mov rax, qword [rsp + 0x450]
mov qword [rsp + 0x6b0], rax
mov rax, qword [rsp + 0x458]
mov qword [rsp + 0x6b8], rax
jmp 0x1400561df
lea rcx, [rsp + 0x660]
lea rdx, [rsp + 0x190]
lea r8, [rsp + 0x200]
call fcn.14001a9f0
mov qword [rsp + 0x690], 0
mov qword [rsp + 0x430], rbx
mov qword [rsp + 0x438], rdi
mov qword [rsp + 0x440], rsi
mov qword [rsp + 0x448], rsi
mov qword [rsp + 0x450], rbx
mov qword [rsp + 0x458], r15
mov qword [rsp + 0x460], r12
mov qword [rsp + 0x468], r14
mov qword [rsp + 0x470], r15
mov qword [rsp + 0x478], rbx
mov byte [rsp + 0x480], bpl
lea rcx, [rsp + 0x200]
lea rdx, [rsp + 0x660]
lea r8, [rsp + 0x430]
call fcn.14001dad0
cmp byte [rsp + 0x2b0], 2
je 0x140056463
lea r14, [rsp + 0x230]
lea rdi, [rsp + 0x448]
lea r15, [rsp + 0x671]
lea r13, [rsp + 0x190]
lea rbp, [rsp + 0x660]
lea r12, [rsp + 0xe0]
lea rsi, [rsp + 0x200]
nop word [rax + rax]
movups xmm0, xmmword [rsp + 0x200]
movups xmm1, xmmword [rsp + 0x210]
movups xmm2, xmmword [rsp + 0x220]
movaps xmmword [rsp + 0xd0], xmm2
movaps xmmword [rsp + 0xc0], xmm1
movaps xmmword [rsp + 0xb0], xmm0
mov r8d, 0x88
lea rcx, [rsp + 0x430]
mov rdx, r14
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0xb0]
lock dec qword [rax]
jne 0x140056301
lea rcx, [rsp + 0xb0]
call fcn.14000f470
mov rax, qword [rsp + 0x430]
mov rcx, qword [rsp + 0x440]
movzx edx, byte [rax + 0x200]
cmp edx, 0x4b
je 0x140056340
cmp edx, 0x4c
jne 0x140056370
mov byte [rax + 0x200], 0x4b
mov qword [rax + 0x208], 0
jmp 0x140056360
mov r8, qword [rax + 0x208]
test r8, r8
je 0x140056360
mov rcx, qword [r8]
add rcx, 0x10
add r8, 8
mov dl, 2
mov rax, r8
jmp 0x140056369
mov rcx, qword [rcx]
add rcx, 0x10
xor edx, edx
xor r8d, r8d
jmp 0x1400563a0
mov rcx, qword [rax + 0x200]
movzx edx, byte [rax + 0x208]
mov r8d, dword [rax + 0x20c]
mov dword [rsp + 0xe3], r8d
mov eax, dword [rax + 0x209]
mov dword [rsp + 0xe0], eax
mov r8d, 1
mov qword [rsp + 0x660], r8
mov qword [rsp + 0x668], rcx
mov byte [rsp + 0x670], dl
mov ecx, dword [rsp + 0xe0]
mov edx, dword [rsp + 0xe3]
mov dword [r15 + 3], edx
mov dword [r15], ecx
mov qword [rsp + 0x678], rax
mov rcx, r13
mov rdx, rdi
mov r8, rbp
call fcn.14001a9f0
mov qword [rsp + 0x1c0], 0
mov rax, qword [rdi + 0x68]
mov qword [rsp + 0x130], rax
movups xmm0, xmmword [rdi + 0x58]
movaps xmmword [rsp + 0x120], xmm0
movups xmm0, xmmword [rdi + 0x18]
movups xmm1, xmmword [rdi + 0x28]
movups xmm2, xmmword [rdi + 0x38]
movups xmm3, xmmword [rdi + 0x48]
movaps xmmword [rsp + 0x110], xmm3
movaps xmmword [rsp + 0x100], xmm2
movaps xmmword [rsp + 0xf0], xmm1
movaps xmmword [rsp + 0xe0], xmm0
mov rcx, rbp
mov rdx, r13
mov r8, r12
call fcn.14001dad0
mov r8d, 0xb8
mov rcx, rsi
mov rdx, rbp
call sub.msvcrt.dll_memcpy
cmp byte [rsp + 0x2b0], 2
jne 0x1400562a0
mov eax, dword [rsp + 0x200]
mov r13, qword [rsp + 0x50]
add r13, 8
cmp eax, 5
je 0x140056b6b
mov rcx, qword [rsp + 0x238]
mov qword [rsp + 0x70], rcx
mov rcx, qword [rsp + 0x248]
mov qword [rsp + 0x48], rcx
lea rcx, [rcx*8]
mov qword [rsp + 0x68], rcx
lea ecx, [rax - 3]
cmp ecx, 2
mov edx, 2
cmovb edx, ecx
test edx, edx
je 0x1400565b3
mov r8d, dword [rsp + 0x204]
mov r12d, dword [rsp + 0x208]
mov r10d, dword [rsp + 0x20c]
mov r9, qword [rsp + 0x210]
mov qword [rsp + 0x30], r9
mov r9, qword [rsp + 0x218]
mov qword [rsp + 0x38], r9
mov rsi, qword [rsp + 0x220]
mov r9, qword [rsp + 0x228]
mov qword [rsp + 0x140], r9
mov r9, qword [rsp + 0x230]
mov r11, qword [rsp + 0x240]
mov qword [rsp + 0x150], r11
mov r11, qword [rsp + 0x250]
lea rdi, [rsi + 0x60]
lea r14, [rsi + 0x1b8]
mov qword [rsp + 0xa0], r14
cmp edx, 1
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x170], r9
mov qword [rsp + 0x78], r11
jne 0x1400565ba
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x60], r10
mov r13, r10
shl r13, 0x20
or r13, r12
mov eax, 2
mov qword [rsp + 0x28], rax
mov ebp, 3
cmp ecx, 2
jb 0x140056597
cmp qword [rsp + 0x48], 0
je 0x140056597
mov r8d, 8
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
call fcn.140002620
mov r14, qword [rsp + 0x38]
mov r15, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
call fcn.140057500
jmp 0x1400567a4
xor esi, esi
jmp 0x140056b44
mov eax, eax
mov r13, r8
shl r13, 0x20
or r13, rax
mov r15, r10
shl r15, 0x20
or r15, r12
cmp qword [rsp + 0x150], r11
je 0x14005668c
mov rsi, qword [r11 - 8]
mov eax, dword [rsi + 0x28]
mov ecx, dword [rsi + 0x2c]
xor ebp, ebp
mov qword [rsp + 0x58], rax
test eax, eax
setne r14b
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x60], rcx
test ecx, ecx
setne r12b
cmp qword [rsi], 0
je 0x140056767
cmp dword [rdi], 0x2f
je 0x140056767
mov rax, qword [rsi + 8]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x1b0], 0
jne 0x14005671a
lea rcx, [rsp + 0x660]
mov rdx, rdi
call fcn.140019360
lea rcx, [rsp + 0x200]
lea r8, [rsp + 0x660]
mov rdx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x140]
call fcn.14001e070
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x1b0], 0
je 0x1400566f0
lea rcx, [rsp + 0x200]
call fcn.1400065a0
jmp 0x14005671a
mov rax, qword [r9 + 0x28]
test rax, rax
je 0x14005669b
mov rdx, qword [r9 + 0x30]
jmp 0x14005669b
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x60], r10
mov qword [rsp + 0x58], r8
cmp qword [rsp + 0x48], 0
je 0x1400566d3
mov r8d, 8
mov rcx, qword [rsp + 0x70]
mov rsi, rdx
mov rdx, qword [rsp + 0x68]
mov r14, rax
call fcn.140002620
mov rdx, rsi
mov rax, r14
mov ebp, 3
mov rsi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
test rax, rax
jne 0x1400567a4
jmp 0x1400565a1
mov qword [rax + 0x1b0], 1
movups xmm0, xmmword [rsp + 0x200]
movups xmm1, xmmword [rsp + 0x210]
mov rax, qword [rsp + 0xa0]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov rax, qword [rsp + 0xa0]
cmp qword [rax], 0
je 0x140056749
mov rcx, qword [rsp + 0x80]
cmp rcx, qword [rax + 8]
jae 0x140056767
mov rax, qword [rax]
lea rdx, [rcx + rcx*2]
mov rcx, qword [rax + rdx*8 + 8]
mov r8, qword [rax + rdx*8 + 0x10]
jmp 0x140056769
mov rax, qword [rsp + 0x40]
cmp byte [rax + 0x1c0], 0x4b
jne 0x140056bec
mov rax, qword [rax + 0x1c8]
test rax, rax
jne 0x140056728
xor ecx, ecx
add qword [rsp + 0x78], 0xfffffffffffffff8
mov bpl, r14b
mov rax, qword [rsp + 0x28]
mov al, r12b
mov qword [rsp + 0x28], rax
mov rax, qword [rsi + 0x18]
test rax, rax
je 0x140056bce
mov rdx, qword [rsi + 0x20]
mov rsi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x660], r13
mov qword [rsp + 0x668], r15
mov qword [rsp + 0x670], r14
mov qword [rsp + 0x678], rsi
mov qword [rsp + 0x680], rbx
mov qword [rsp + 0x688], rax
mov qword [rsp + 0x690], rdx
mov rax, qword [rsp + 0x148]
mov rax, qword [rax + 0x20]
lea rdx, [rsp + 0x660]
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x80], rax
call rax
mov r13, qword [rsp + 0x50]
mov qword [rsp + 0x138], rdi
jmp 0x140056889
mov r12, qword [rsp + 0x40]
mov r14, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rcx, r13
mov rdx, rbx
call fcn.140057500
mov qword [rsp + 0x660], r15
mov qword [rsp + 0x668], rsi
mov qword [rsp + 0x670], r14
mov qword [rsp + 0x678], r12
mov qword [rsp + 0x680], rbx
mov qword [rsp + 0x688], rax
mov qword [rsp + 0x690], rdx
mov rcx, qword [rsp + 0xa8]
lea rdx, [rsp + 0x660]
call qword [rsp + pe_nt_image_headers64]
lea ecx, [rbp - 3]
cmp ecx, 2
mov eax, 2
cmovb eax, ecx
cmp eax, 1
je 0x140056950
cmp eax, 2
jne 0x140056b41
mov eax, ebp
mov r15, qword [rsp + 0x58]
shl r15, 0x20
or r15, rax
mov eax, dword [rsp + 0x28]
mov rsi, qword [rsp + 0x60]
shl rsi, 0x20
or rsi, rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x150], rax
je 0x14005699e
mov r14, qword [rax - 8]
mov eax, dword [r14 + 0x28]
mov ecx, dword [r14 + 0x2c]
xor ebp, ebp
mov qword [rsp + 0x58], rax
test eax, eax
setne r12b
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x60], rcx
test ecx, ecx
setne r13b
cmp qword [r14], 0
je 0x140056ae0
cmp dword [rdi], 0x2f
je 0x140056ae0
mov rax, qword [r14 + 8]
mov qword [rsp + 0x168], rax
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x1b0], 0
je 0x1400569f9
mov rax, qword [rsp + 0xa0]
cmp qword [rax], 0
jne 0x140056abb
jmp 0x140056a9d
mov eax, dword [rsp + 0x28]
mov r15, qword [rsp + 0x60]
shl r15, 0x20
or r15, rax
mov eax, 2
mov qword [rsp + 0x28], rax
mov ebp, 3
cmp ecx, 2
jb 0x140056820
cmp qword [rsp + 0x48], 0
je 0x140056820
mov r8d, 8
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
call fcn.140002620
jmp 0x140056820
mov rcx, qword [rsp + 0x170]
mov rax, qword [rcx + 0x28]
test rax, rax
je 0x1400569b3
mov rdx, qword [rcx + 0x30]
cmp qword [rsp + 0x48], 0
je 0x1400569dc
mov r8d, 8
mov rcx, qword [rsp + 0x70]
mov r14, rdx
mov rdx, qword [rsp + 0x68]
mov r12, rax
call fcn.140002620
mov rdx, r14
mov rax, r12
mov ebp, 3
mov r12, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
test rax, rax
jne 0x14005683a
jmp 0x14005682f
lea rcx, [rsp + 0x660]
mov rdx, rdi
call fcn.140019360
mov rdi, qword [rsp + 0x40]
lea rcx, [rsp + 0x200]
mov rdx, rdi
lea r8, [rsp + 0x660]
mov r9, qword [rsp + 0x140]
call fcn.14001e070
cmp qword [rdi + 0x1b0], 0
je 0x140056a5d
lea rcx, [rsp + 0x200]
call fcn.1400065a0
mov rdi, qword [rsp + 0x138]
mov rax, qword [rsp + 0xa0]
cmp qword [rax], 0
jne 0x140056abb
jmp 0x140056a9d
mov qword [rdi + 0x1b0], 1
movups xmm0, xmmword [rsp + 0x200]
movups xmm1, xmmword [rsp + 0x210]
mov rax, qword [rsp + 0xa0]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov rdi, qword [rsp + 0x138]
mov rax, qword [rsp + 0xa0]
cmp qword [rax], 0
jne 0x140056abb
mov rax, qword [rsp + 0x40]
cmp byte [rax + 0x1c0], 0x4b
jne 0x140056be7
mov rax, qword [rax + 0x1c8]
test rax, rax
je 0x140056ae0
mov rcx, qword [rsp + 0x168]
cmp rcx, qword [rax + 8]
jae 0x140056ae0
mov rax, qword [rax]
lea rdx, [rcx + rcx*2]
mov rcx, qword [rax + rdx*8 + 8]
mov r8, qword [rax + rdx*8 + 0x10]
jmp 0x140056ae2
xor ecx, ecx
add qword [rsp + 0x78], 0xfffffffffffffff8
mov bpl, r12b
mov rax, qword [rsp + 0x28]
mov al, r13b
mov qword [rsp + 0x28], rax
mov rax, qword [r14 + 0x18]
test rax, rax
je 0x140056b23
mov rdx, qword [r14 + 0x20]
mov r12, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], r8
mov r13, qword [rsp + 0x50]
jmp 0x14005683a
mov r12, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], r8
mov r13, qword [rsp + 0x50]
jmp 0x14005682f
mov sil, 1
cmp ecx, 2
jb 0x140056b66
cmp qword [rsp + 0x48], 0
je 0x140056b66
mov r8d, 8
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
call fcn.140002620
test sil, sil
jne 0x140056bb9
mov rcx, r13
mov rdx, rbx
call fcn.140057500
test rax, rax
je 0x140056bb9
mov dword [rsp + 0x660], 3
mov qword [rsp + 0x668], rax
mov qword [rsp + 0x670], rdx
mov qword [rsp + 0x678], rbx
lea rdx, [rsp + 0x660]
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0x148]
call qword [rax + 0x20]
nop
add rsp, 0xa98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], r8
jmp 0x1400565a1
mov sil, 1
jmp 0x140056bee
xor esi, esi
cmp qword [rsp + 0x48], 0
mov r13, qword [rsp + 0x50]
jne 0x140056b51
jmp 0x140056b66
add r8, rsi
movzx eax, word [rdi + 6]
mov qword [rsp + 0x28], rax
lea eax, [rax*8]
lea rsi, [rax + rax*4]
mov rcx, r12
mov rdx, r13
mov r9, rsi
call fcn.1400585f0
test rax, rax
je 0x140055ef0
cmp rsi, rdx
ja 0x140055ef0
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x160], rax
mov esi, dword [rdi + 0xc]
test rsi, rsi
je 0x140056d30
mov eax, dword [rdi + 0x10]
mov qword [rsp + 0x30], rax
add rax, rax
lea r9, [rax + rax*8]
mov rcx, r12
mov rdx, r13
mov r8, rsi
mov qword [rsp + 0x28], r9
call fcn.1400585f0
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140055ef0
cmp qword [rsp + 0x28], rdx
ja 0x140055ef0
mov r8, qword [rsp + 0x28]
add r8, rsi
mov r9d, 4
mov rcx, r12
mov rdx, r13
mov qword [rsp + 0x28], r8
call fcn.1400585f0
test rax, rax
je 0x140055ef0
cmp rdx, 3
jbe 0x140055ef0
mov eax, dword [rax]
add rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
mov rax, qword [rdi + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 8
mov qword [rsp + 0x98], 0
cmp qword [rsp + 0x30], 0
je 0x140056e8e
mov r10d, 8
xor edx, edx
xor esi, esi
mov r9, qword [rsp + 0x38]
jmp 0x140056dd1
lea r8, [0x140b728c8]
mov rcx, r15
call fcn.140083030
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 8
mov qword [rsp + 0x98], 0
mov ecx, 8
xor eax, eax
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rsp + 0x28], rax
xor esi, esi
xor edx, edx
test rdx, rdx
je 0x140056ea1
bsr rax, rdx
xor rax, 0x3f
jmp 0x140056ea6
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
add rax, qword [rsp + 0x40]
add rdi, rax
mov rax, rdx
shl rax, 4
mov qword [r10 + rax], rdi
mov rcx, qword [rsp + 0x60]
mov qword [r10 + rax + 8], rcx
inc rdx
mov qword [rsp + 0x98], rdx
mov r9, qword [rsp + 0x38]
add rsi, r11
inc rsi
cmp rsi, qword [rsp + 0x30]
jae 0x140056e78
lea rax, [rsi + rsi*8]
movzx r11d, byte [r9 + rax*2 + 0x11]
movzx r8d, word [r9 + rax*2 + 0xc]
test r8, r8
je 0x140056dc0
movzx ecx, word [r9 + rax*2 + 0xe]
and ecx, 0x30
cmp cx, 0x20
jne 0x140056dc0
mov qword [rsp + 0x78], r11
mov qword [rsp + 0x58], r10
mov rdi, rdx
lea rax, [r9 + rax*2]
mov qword [rsp + 0x60], rax
mov eax, dword [rax + 8]
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x178]
lea rdx, [rsp + 0x158]
call fcn.140058c60
cmp qword [rsp + 0x178], 0
jne 0x140057126
mov rdx, rdi
mov rax, qword [rsp + 0x180]
mov edi, dword [rax + 0xc]
cmp rdx, qword [rsp + 0x88]
jne 0x140056d81
lea rcx, [rsp + 0x88]
call fcn.14000fbf0
mov r10, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x98]
jmp 0x140056d86
mov rcx, qword [rsp + 0x90]
jmp 0x140056e95
lea r8, [0x140b6e228]
call fcn.140083030
mov ecx, 8
xor edx, edx
mov rsi, r12
test rdx, rdx
jne 0x140056d74
mov eax, 0x40
mov r9d, 0x40
sub r9d, eax
xor r8d, r8d
call fcn.1400076e0
mov rax, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x160]
mov rdx, qword [rsp + 0x88]
movups xmm0, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x1f0], xmm0
movabs r8, 0x8000000000000000
cmp rdx, r8
je 0x140055ef0
movaps xmm0, xmmword [rsp + 0x1f0]
movups xmmword [rsp + 0xe8], xmm0
mov qword [rsp + 0xe0], rdx
mov qword [rsp + 0xf8], r12
mov qword [rsp + 0x100], r13
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rsi
mov qword [rsp + 0x120], r13
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x190], r8
lea rcx, [rsp + 0x660]
lea rdx, [rsp + 0xe0]
lea r8, [rsp + 0x190]
mov r9, r8
call fcn.140050f60
mov rsi, qword [rsp + 0x660]
movabs rax, 0x8000000000000000
cmp rsi, rax
je 0x140055ef0
lea rdx, [rsp + 0x668]
lea rcx, [rsp + 0x438]
mov r8d, 0x1d8
call sub.msvcrt.dll_memcpy
movups xmm0, xmmword [rsp + 0xb0]
movups xmm1, xmmword [rsp + 0xc0]
movups xmm2, xmmword [rsp + 0xd0]
movups xmmword [rsp + 0x628], xmm0
movups xmmword [rsp + 0x638], xmm1
movups xmmword [rsp + 0x648], xmm2
mov qword [rsp + 0x430], rsi
mov qword [rsp + 0x610], r14
mov qword [rsp + 0x618], r12
mov qword [rsp + 0x620], r13
mov r14, qword [0x140099050]
mov rsi, qword [0x140099040]
cmp r14, 4
jne 0x140057075
mov qword [0x140099050], 3
mov edx, 0x690
add rdx, qword [0x140099048]
lea rcx, [rsp + 0x660]
mov r8d, 0x230
call sub.msvcrt.dll_memcpy
mov r14d, 3
movabs rax, 0x8000000000000000
cmp qword [rsp + 0x668], rax
je 0x140057075
lea rcx, [rsp + 0x668]
call fcn.140006010
mov r14, qword [0x140099050]
mov rsi, qword [0x140099040]
lea rdi, [rsp + 0x668]
lea rdx, [rsp + 0x430]
mov r8d, 0x228
mov rcx, rdi
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x660], r15
cmp r14, rsi
jne 0x1400570a8
mov rcx, rsi
call fcn.1400104a0
mov r13, qword [0x140099048]
test r14, r14
je 0x140057100
lea rcx, [r13 + 0x230]
imul r8, r14, 0x230
mov rdx, r13
call sub.msvcrt.dll_memmove
lea rdx, [rsp + 0x660]
mov r8d, 0x230
mov rcx, r13
call sub.msvcrt.dll_memcpy
inc r14
mov qword [0x140099050], r14
jne 0x140055fab
lea r8, [0x140b728e0]
xor ecx, ecx
xor edx, edx
call fcn.140083030
lea rdx, [rsp + 0x660]
mov r8d, 0x230
mov rcx, r13
call sub.msvcrt.dll_memcpy
mov qword [0x140099050], 1
jmp 0x140055fab
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x140055ef0
shl rdx, 4
mov r8d, 8
mov rcx, qword [rsp + 0x58]
call fcn.140002620
jmp 0x140055ef0
mov ecx, 8
mov edx, 0x8c0
call fcn.140073b10
lea r8, [0x140b6e210]
call fcn.1400894c0
mov ecx, 8
mov edx, 0x10
call fcn.140073b10
ud2