Function at 0x40d430
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x298
lea rcx, [0x0041a9a0]
mov edx, 0x428
call fcn.004081e0
mov edx, 0x6c51af84
lea rcx, [0x00415920]
mov rbx, rax
lea rax, [0x0041a960]
mov qword [rbx], rax
call fcn.00407a50
mov edx, 0x15baa504
mov rcx, rax
call fcn.004085b0
xor r8d, r8d
xor edx, edx
mov ecx, 0x40000
call qword [0x0041a958]
mov r8d, 0x1000
mov edx, 8
mov rcx, rax
call qword [0x0041a950]
mov edx, 0x8974ccc
mov dword [rsp + 0x40], 0
lea rbp, [rax + 0x17]
mov rsi, rax
mov qword [0x0041a948], rax
lea rdi, [rax + 0x2e]
mov qword [0x0041a940], rbp
lea rcx, [0x004158e0]
mov qword [0x0041a938], rdi
call fcn.00407a50
mov edx, 0x38d1c54c
mov rcx, rax
call fcn.004085b0
lea rcx, [section..rdata]
test rax, rax
je 0x40ce0d
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
mov rdx, rsi
call fcn.00408d70
mov edx, 0x522de524
lea rcx, [0x004158a0]
call fcn.00407a50
mov edx, 0x3e3996a4
mov rcx, rax
call fcn.004085b0
lea rcx, [section..rdata]
test rax, rax
je 0x40ce4b
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
mov rdx, rbp
call fcn.00408d70
mov edx, 0x23fb7ac
lea rcx, [0x00415860]
call fcn.00407a50
mov edx, 0x18a8242c
mov rcx, rax
call fcn.004085b0
lea rcx, [section..rdata]
test rax, rax
je 0x40ce89
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
mov rdx, rdi
call fcn.00408d70
lea rdi, [rsi + 0xa1]
mov edx, 0x364e23c4
lea rcx, [0x00415830]
mov qword [0x0041a930], rdi
call fcn.00407a50
mov edx, 0x7cb0f144
mov rcx, rax
call fcn.004085b0
lea rcx, [section..rdata]
test rax, rax
je 0x40ced5
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
mov rdx, rdi
call fcn.00408d70
mov edx, 0x41024d8c
lea rcx, [0x00415800]
call fcn.00407a50
mov edx, 0xe8bce0c
lea rdi, [rsi + 0x142]
mov rcx, rax
call fcn.004085b0
lea rdx, [rsi + 0x12b]
lea rcx, [section..rdata]
test rax, rax
je 0x40cf21
cmp qword [rax], 0
lea r8, [rax + 0x10]
cmovne rcx, r8
call fcn.00408d70
mov edx, 0x72155ce4
lea rcx, [0x004157c0]
call fcn.004085b0
lea rcx, [section..rdata]
test rax, rax
je 0x40cf4f
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
mov rdx, rdi
call fcn.00408d70
lea r9, [rsp + 0x40]
mov edx, 0x17
mov rcx, rsi
mov r8d, 0x20
call qword [0x0041a928]
pxor xmm0, xmm0
mov qword [rbx + 0x30], 0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.GetModuleHandleA
mov rcx, rax
call fcn.00409690
lea rcx, [0x004157b0]
mov edx, 9
mov qword [rbx + 0x10], rax
call fcn.00408360
lea rcx, [section..rdata]
test rax, rax
je 0x40cfcd
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
call fcn.00408ae0
lea rdx, str.GetModuleInformation
mov rcx, rax
call fcn.00409690
mov qword [rbx + 0x18], rax
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.CreateFileMappingA
mov rcx, rax
call fcn.00409690
mov qword [rbx + 0x20], rax
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.MapViewOfFile
mov rcx, rax
call fcn.00409690
mov qword [rbx + 0x28], rax
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.FreeLibrary
mov rcx, rax
call fcn.00409690
mov rcx, rbx
mov qword [rbx + 0x30], rax
call fcn.0040ad20
mov edx, 0x54122c6c
lea rcx, [0x00415720]
call fcn.004085b0
mov edx, 0x449bee04
lea rcx, [0x00415500]
call fcn.004085b0
mov r8d, 0x3c8
xor edx, edx
lea rcx, [rbx + 0x60]
call sub.msvcrt.dll_memset
mov edx, 0x577b04c
mov qword [rbx + 0x40], 0
lea rcx, [0x004153a0]
mov qword [rbx + 0x48], 0
mov qword [rbx + 0x50], 0
mov qword [rbx + 0x58], 0
call fcn.004085b0
mov edx, 0x676a87a4
lea rcx, [0x00415200]
call fcn.004085b0
mov edx, 0x70b3872c
lea rcx, [0x00415080]
call fcn.004085b0
mov edx, 0x169dca44
lea rcx, [0x00414f40]
call fcn.004085b0
mov edx, 0x5e65690c
lea rcx, [0x00414f20]
call fcn.004085b0
test rax, rax
je 0x40d410
mov rdx, qword [rax]
lea rcx, [section..rdata]
add rax, 0x10
test rdx, rdx
cmovne rcx, rax
call fcn.00409b20
test rax, rax
mov rsi, rax
je 0x40d125
add qword [rax - 0x10], 8
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x40d148
mov rdi, qword [rax - 0x10]
lea rdx, [rax - 0x10]
lea rcx, [rdi - 8]
cmp rcx, 7
mov qword [rax - 0x10], rcx
jbe 0x40d3f0
mov qword [rbx + 0x38], rsi
lea rsi, [rsp + 0x80]
xor edx, edx
xor ebp, ebp
mov rcx, rsi
mov r8d, 0x20a
mov rdi, rsi
call sub.msvcrt.dll_memset
mov ecx, 0x20a
mov eax, ebp
rep stosb byte [rdi], al
xor ecx, ecx
mov r8d, 0x104
mov rdx, rsi
call qword [0x0041a920]
test eax, eax
je 0x40d41e
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x10000
mov dword [rsp + 0x20], 3
call qword [0x0041a918]
cmp rax, 0xffffffffffffffff
mov r13, rax
je 0x40d41e
lea r12, [rsp + 0x60]
mov ecx, 0x18
mov eax, ebp
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov rdi, r12
mov qword [rsp + 0x70], 0
rep stosb byte [rdi], al
mov rax, qword [rbx + 0x38]
mov r9d, 0x20
mov r8, r12
mov rcx, r13
mov dword [rsp + 0x70], 8
mov edx, 3
mov rax, qword [rax]
mov qword [rsp + 0x74], rax
call qword [0x0041a8f8]
test eax, eax
je 0x40d41e
mov rcx, r13
call qword [0x0041a910]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000
mov qword [rsp + 0x30], 0
mov rcx, rsi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [0x0041a918]
cmp rax, 0xffffffffffffffff
mov r13, rax
je 0x40d41e
mov byte [r12], 0
mov rdi, r12
mov ecx, 1
mov eax, ebp
rep stosb byte [rdi], al
mov edx, 4
mov byte [rsp + 0x60], 1
mov r8, r12
mov rcx, r13
mov r9d, 1
call qword [0x0041a8f8]
test eax, eax
je 0x40d41e
mov rcx, r13
call qword [0x0041a910]
mov rcx, rsi
call qword [0x0041a908]
mov edx, 0x25a45de4
lea rcx, [0x00414e20]
call fcn.004085b0
mov edx, 0x25bfcdec
lea rcx, [0x00414c80]
call fcn.004085b0
mov edx, 0x58f12a84
lea rcx, [0x00414b20]
call fcn.004085b0
mov edx, 0x7a5edcc
lea rcx, [0x00414960]
call fcn.004085b0
mov rsi, qword [0x0041a900]
xor eax, eax
test rsi, rsi
je 0x40d303
mov rax, qword [rsi]
lea rdi, [rsp + 0x50]
xor r8d, r8d
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x48], 0
lea rdx, [rsp + 0x48]
mov r9, rdi
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x44], 4
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x1000
call qword [0x0041a938]
lea rax, [rsp + 0x58]
mov rdx, qword [rsp + 0x48]
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x50]
lea r8, [rsi + 0x10]
mov qword [rsp + 0x58], 0
lea r9, [rax - 1]
call qword [0x0041a940]
mov rax, qword [rsp + 0x48]
mov rcx, rbx
mov qword [0x0041a8f0], rax
mov qword [0x0041a8e8], rax
call fcn.0040b380
mov rax, qword [rsp + 0x48]
mov r8, rdi
mov rdx, r12
mov r9d, 0x20
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
call qword [0x0041a948]
test eax, eax
jne 0x40d41e
call qword [rsp + 0x48]
mov edx, 0xffffffff
mov rcx, 0xffffffffffffffff
call qword [0x0041a8e0]
xor eax, eax
add rsp, 0x298
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, [0x00428628]
call fcn.00405a50
jmp 0x40d148
lea rcx, [section..rdata]
xor edx, edx
jmp 0x40d113
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop dword [rax]
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x00428600]
cmp rax, 0xdab
jg 0x40e31e
lea rcx, [rax + 1]
lea rdx, [0x004218a0]
cmp rcx, 0xdac
mov qword [0x00428600], rcx
lea rdi, [0x00405fc0]
mov qword [rdx + rax*8], rdi
je 0x40e31e
lea rbx, [0x004060b0]
mov qword [rdx + rcx*8], rbx
lea rcx, [rax + 2]
cmp rcx, 0xdac
mov qword [0x00428600], rcx
je 0x40e31e
lea rdi, [0x004060a0]
mov qword [rdx + rcx*8], rdi
lea rcx, [rax + 3]
cmp rcx, 0xdac
mov qword [0x00428600], rcx
je 0x40e31e
lea rbx, [0x00406090]
mov qword [rdx + rcx*8], rbx
lea rcx, [rax + 4]
cmp rcx, 0xdac
mov qword [0x00428600], rcx
je 0x40e31e
lea rdi, [0x00406080]
mov qword [rdx + rcx*8], rdi
lea rcx, [rax + 5]
cmp rcx, 0xdac
mov qword [0x00428600], rcx
je 0x40e31e
lea rbx, [0x00406070]
mov qword [rdx + rcx*8], rbx
lea rcx, [rax + 6]
cmp rcx, 0xdac
mov qword [0x00428600], rcx
je 0x40e31e
lea rdi, [0x00406060]
mov qword [rdx + rcx*8], rdi
lea rcx, [rax + 7]
cmp rcx, 0xdac
mov qword [0x00428600], rcx
je 0x40e31e
lea rbx, [0x00406050]
mov qword [rdx + rcx*8], rbx
lea rcx, [rax + 8]
cmp rcx, 0xdac
mov qword [0x00428600], rcx
je 0x40e31e
lea rdi, [0x00406040]
mov qword [rdx + rcx*8], rdi
lea rcx, [rax + 9]
cmp rcx, 0xdac
mov qword [0x00428600], rcx
je 0x40e31e
lea rbx, [0x00406030]
mov qword [rdx + rcx*8], rbx
lea rcx, [rax + 0xa]
cmp rcx, 0xdac
mov qword [0x00428600], rcx
je 0x40e31e
lea rdi, [0x00405ff0]
mov qword [rdx + rcx*8], rdi
lea rcx, [rax + 0xb]
cmp rcx, 0xdac
mov qword [0x00428600], rcx
je 0x40e31e
lea rbx, [0x00405fd0]
add rax, 0xc
mov qword [rsp + 0x38], 0
mov qword [rdx + rcx*8], rbx
lea rcx, [0x00419120]
mov qword [0x00428600], rax
lea rbx, [rsp + 0x40]
call qword [0x0041a138]
mov rcx, rbx
mov qword [rsp + 0x40], 0
movsxd rdx, eax
call fcn.00409d50
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
call fcn.0040abc0
mov eax, dword [0x00419124]
cmp eax, 6
je 0x40dcc0
cmp eax, 5
jg 0x40d64c
mov dword [0x0041a9f0], 1
lea rcx, [0x004147e0]
mov edx, 0xeb070c
call fcn.00407a50
mov edx, 0x58ac752c
mov rcx, rax
call fcn.004085b0
lea rcx, [0x00419118]
mov rdx, rax
call fcn.00405b10
mov rsi, qword [0x00419110]
mov rcx, qword [0x00419118]
call fcn.004079c0
test rsi, rsi
mov qword [0x00419110], rax
je 0x40d6b2
mov rax, qword [rsi - 0x10]
lea rdx, [rsi - 0x10]
sub rax, 8
cmp rax, 7
mov qword [rsi - 0x10], rax
jbe 0x40dd10
lea rcx, [0x0041a8a0]
mov edx, 0x3d1
call fcn.0040b320
mov r8d, 0x3d1
lea rcx, [rax + 0x10]
mov rsi, rax
lea rdx, [0x004143f0]
call sub.msvcrt.dll_memcpy
lea rcx, [0x0041a900]
mov rdx, rsi
call fcn.00405b10
mov rax, qword [0x0041a900]
xor edx, edx
test rax, rax
je 0x40d6fc
mov rdx, qword [rax]
lea rcx, [0x0041a8a0]
call fcn.0040b320
lea rcx, [0x00419108]
mov rdx, rax
call fcn.00405b10
mov edx, 0x23f438c4
lea rcx, [0x00414340]
call fcn.00407a50
mov edx, 0x5c676bcc
mov rcx, rax
call fcn.004085b0
lea rcx, [0x00419100]
mov rdx, rax
call fcn.00405b10
mov edx, 0x2bc0b064
lea rcx, [0x004142e0]
call fcn.00407a50
mov edx, 0x4f626eac
mov rcx, rax
call fcn.004085b0
lea rcx, [0x004190f8]
mov rdx, rax
call fcn.00405b10
mov edx, 0x4455ad6c
lea rcx, [0x00414220]
call fcn.00407a50
mov edx, 0x23f438c4
mov rcx, rax
call fcn.004085b0
test rax, rax
mov rsi, rax
je 0x40d79c
add qword [rax - 0x10], 8
mov rax, qword [0x004190f0]
test rax, rax
je 0x40d7c2
mov rdi, qword [rax - 0x10]
lea rdx, [rax - 0x10]
lea rcx, [rdi - 8]
cmp rcx, 7
mov qword [rax - 0x10], rcx
jbe 0x40dcf0
mov edx, 0x3ea1994c
mov qword [0x004190f0], rsi
lea rcx, [0x00414180]
call fcn.00407a50
mov edx, 0x2bc0b064
mov rcx, rax
call fcn.004085b0
lea rcx, [0x004190e8]
mov rdx, rax
call fcn.00405b10
call fcn.004084f0
xor edx, edx
mov rcx, rax
call fcn.00408820
lea rdx, str.LdrLoadDll
mov rcx, rax
call fcn.00409320
mov qword [0x0041a9e0], rax
call fcn.004084f0
xor edx, edx
mov rcx, rax
call fcn.00408820
lea rdx, str.RtlInitUnicodeString
mov rcx, rax
call fcn.00409320
mov edx, 0xc526eec
lea rcx, [0x004140c0]
mov qword [0x0041a9e8], rax
call fcn.00407a50
mov edx, 0x79d00d44
mov rcx, rax
call fcn.004085b0
lea rcx, [0x004190e0]
mov rdx, rax
call fcn.00405b10
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.GetCurrentProcessId
mov rcx, rax
call fcn.00409690
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.VirtualProtect
mov rcx, rax
call fcn.00409690
mov qword [0x0041a928], rax
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.OpenProcess
mov rcx, rax
call fcn.00409690
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.GetProcessHeap
mov rcx, rax
call fcn.00409690
mov qword [0x004190d8], rax
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.GetProcAddress
mov rcx, rax
call fcn.00409690
mov qword [0x004190d0], rax
call fcn.004084f0
mov rcx, rax
call fcn.00408ae0
lea rdx, str.RtlAddVectoredExceptionHandler
mov rcx, rax
call fcn.00409320
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.GetModuleHandleA
mov rcx, rax
call fcn.00409690
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.GetThreadContext
mov rcx, rax
call fcn.00409690
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.SetThreadContext
mov rcx, rax
call fcn.00409690
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.CloseHandle
mov rcx, rax
call fcn.00409690
mov qword [0x0041a910], rax
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.OpenThread
mov rcx, rax
call fcn.00409690
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.GetCurrentThreadId
mov rcx, rax
call fcn.00409690
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.WaitForSingleObject
mov rcx, rax
call fcn.00409690
mov qword [0x0041a8e0], rax
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.MultiByteToWideChar
mov rcx, rax
call fcn.00409690
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.Sleep
mov rcx, rax
call fcn.00409690
mov qword [0x004190c8], rax
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.GetTickCount
mov rcx, rax
call fcn.00409690
mov qword [0x004190c0], rax
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.CreateFileA
mov rcx, rax
call fcn.00409690
mov qword [0x004190b8], rax
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.GetFileSize
mov rcx, rax
call fcn.00409690
mov qword [0x004190b0], rax
call fcn.004084f0
xor edx, edx
mov rcx, rax
call fcn.00408820
lea rdx, str.RtlAllocateHeap
mov rcx, rax
call fcn.00409320
mov qword [0x004190a8], rax
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.ReadFile
mov rcx, rax
call fcn.00409690
mov edx, 0x42ceb224
lea rcx, [0x00415980]
mov qword [0x004190a0], rax
call fcn.00407a50
mov edx, 0x37d99bec
mov rcx, rax
call fcn.004085b0
mov rax, qword gs:[0x60]
cmp byte [rax + 2], 0
jne 0x40dc90
call qword [0x004190d8]
mov rsi, rax
call qword [0x004190d8]
cmp dword [rsi + 0x70], 2
jne 0x40dd30
mov eax, dword [rax + 0x74]
test eax, eax
jne 0x40dd30
call fcn.00409160
test al, al
je 0x40dc35
lea rdx, [0x004019f0]
mov ecx, 1
xor esi, esi
call qword [0x004198f8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x80000003
call qword [0x004198f0]
lea rcx, [0x004019f0]
call qword [0x004198e8]
mov edx, 0x195e7b2c
lea rcx, [0x004140a0]
call fcn.00407a50
mov rbp, rax
mov rax, qword [0x00419118]
test rax, rax
je 0x40dba5
mov rsi, qword [rax]
test rbp, rbp
je 0x40e2a0
add rsi, qword [rbp]
lea rcx, [0x00412020]
mov eax, 7
cmp rsi, 7
cmovl rsi, rax
lea rdx, [rsi + 0x11]
call fcn.004081e0
mov qword [rax + 8], rsi
mov rdi, rax
mov qword [rax], 0
mov rsi, qword [0x00419118]
test rsi, rsi
je 0x40e150
lea rcx, [rax + 0x10]
mov rax, qword [rsi]
lea rdx, [rsi + 0x10]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rsi]
mov qword [rdi], rax
lea rcx, [rax + 0x10]
mov rax, qword [rbp]
lea rdx, [rbp + 0x10]
add rcx, rdi
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp]
add qword [rdi], rax
mov rdx, rdi
lea rcx, [0x00419110]
call fcn.00405b10
lea rcx, [0x00413fa0]
mov edx, 0x6ccb7d0c
call fcn.00407a50
mov edx, 0x3bad9c04
mov rcx, rax
call fcn.004085b0
lea rcx, [0x00419098]
mov rdx, rax
call fcn.00405b10
call qword [0x004190c0]
mov ecx, 0x5dc
mov esi, eax
call qword [0x004190c8]
call qword [0x004190c0]
sub eax, esi
cmp eax, 0x513
jg 0x40dd40
xor ecx, ecx
call sub.msvcrt.dll_exit
nop
lea rcx, [0x00413b40]
mov edx, 0x64e4844c
mov qword [rsp + 0x40], 0
call fcn.00407a50
mov rcx, rbx
mov qword [rsp + 0x40], rax
call fcn.0040abc0
xor ecx, ecx
call sub.msvcrt.dll_exit
nop
mov eax, dword [0x00419128]
cmp eax, 2
je 0x40d642
cmp eax, 3
je 0x40d642
test eax, eax
je 0x40d642
cmp eax, 1
je 0x40d642
jmp 0x40d64c
lea rcx, [0x00428628]
call fcn.00405a50
jmp 0x40d7c2
lea rcx, [0x00428628]
call fcn.00405a50
jmp 0x40d6b2
mov ecx, 1
call sub.msvcrt.dll_exit
nop word [rax + rax]
lea rcx, [0x00413b60]
mov edx, 0x5055d9e4
xor esi, esi
call fcn.00407a50
mov rbp, rax
mov rax, qword [0x00419110]
test rax, rax
je 0x40dd65
mov rsi, qword [rax]
test rbp, rbp
je 0x40e230
add rsi, qword [rbp]
lea rcx, [0x00412020]
mov eax, 7
cmp rsi, 7
cmovl rsi, rax
lea rdx, [rsi + 0x11]
call fcn.004081e0
mov qword [rax + 8], rsi
mov rdi, rax
mov qword [rax], 0
mov rsi, qword [0x00419110]
test rsi, rsi
je 0x40e290
lea rcx, [rax + 0x10]
mov rax, qword [rsi]
lea rdx, [rsi + 0x10]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rsi]
mov qword [rdi], rax
lea rcx, [rax + 0x10]
mov rax, qword [rbp]
lea rdx, [rbp + 0x10]
add rcx, rdi
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp]
add qword [rdi], rax
mov rdx, rdi
lea rcx, [0x00419110]
call fcn.00405b10
mov edx, 0x5b2601ec
lea rcx, [0x00413c00]
call fcn.00407a50
mov edx, 0x764c9a4c
mov rcx, rax
call fcn.004085b0
lea rcx, [section..rdata]
xor edx, edx
test rax, rax
je 0x40de36
mov rdx, qword [rax]
lea rcx, [section..rdata]
add rax, 0x10
test rdx, rdx
cmovne rcx, rax
call fcn.00409b20
mov rcx, rax
call qword [0x0041a128]
mov edx, 0xb5941cc
lea rcx, [0x00413bc0]
call fcn.00407a50
mov edx, 0x38b812c
mov rcx, rax
call fcn.004085b0
mov edx, 0x29829424
lea rcx, [0x00413b80]
mov rsi, rax
call fcn.00407a50
mov edx, 0x409c5844
mov rcx, rax
call fcn.004085b0
test rsi, rsi
mov rdi, rax
je 0x40e220
mov rdx, qword [rsi]
lea rcx, [section..rdata]
add rsi, 0x10
test rdx, rdx
cmovne rcx, rsi
call fcn.00409b20
mov rcx, rax
call qword [0x0041a128]
cmp eax, 0xffffffff
je 0x40e1e0
xor edx, edx
mov ecx, 0x1000
movabs r8, 0xffffffff1
call qword [0x0041a120]
test rax, rax
jne 0x40e160
lea rdi, [rsp + 0x20]
movabs rsi, 0x112e0be826d694b3
mov rcx, rdi
call fcn.00401a20
mov rbp, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
call fcn.004070b0
mov rcx, rdi
call fcn.00401a20
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x48], 0
mov r8, qword [rsp + 0x20]
sub rcx, r12
sub r8, rbp
jmp 0x40df55
call fcn.004070b0
mov rcx, rdi
call fcn.00401a20
mov rcx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x20]
mov qword [rbx + 8], 0
sub rcx, r12
sub r8, rbp
mov rax, rcx
imul rsi
mov rax, rcx
sar rax, 0x3f
sar rdx, 0x1a
sub rdx, rax
add r8, rdx
imul rdx, rdx, 0x3b9aca00
sub rcx, rdx
shr rcx, 0x3f
sub r8, rcx
test r8, r8
js 0x40df30
cmp r8, 5
jle 0x40df30
lea rcx, [0x00413de0]
mov edx, 0x472e928c
call fcn.00407a50
mov edx, 0x49d67ec
mov rcx, rax
call fcn.004085b0
lea rcx, [0x00419090]
mov rdx, rax
call fcn.00405b10
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.LoadLibraryA
mov rcx, rax
call fcn.00409690
mov edx, 0x1fcfff44
lea rcx, [0x00413dc0]
call fcn.00407a50
mov edx, 0x909b464
mov rcx, rax
call fcn.004085b0
test rax, rax
je 0x40e300
mov rdx, qword [rax]
lea rcx, [section..rdata]
add rax, 0x10
test rdx, rdx
cmovne rcx, rax
call fcn.00408360
lea rdx, [section..rdata]
test rax, rax
je 0x40e02a
cmp qword [rax], 0
lea rcx, [rax + 0x10]
cmovne rdx, rcx
lea rcx, [0x00419080]
call qword [0x0041a9e8]
lea r9, [0x00419070]
xor edx, edx
xor ecx, ecx
lea r8, [0x00419080]
call qword [0x0041a9e0]
mov edx, 0x1e46f96c
lea rcx, [0x00413da0]
call fcn.004085b0
lea rdx, [section..rdata]
test rax, rax
je 0x40e078
cmp qword [rax], 0
lea rcx, [rax + 0x10]
cmovne rdx, rcx
mov rcx, qword [0x00419070]
call qword [0x004190d0]
mov qword [0x00419068], rax
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.CreateFileW
mov rcx, rax
call fcn.00409690
mov qword [0x0041a918], rax
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.SetFileInformationByHandle
mov rcx, rax
call fcn.00409690
mov qword [0x0041a8f8], rax
call fcn.00408430
mov rcx, rax
call fcn.00408ae0
lea rdx, str.GetModuleFileNameW
mov rcx, rax
call fcn.00409690
mov qword [0x0041a920], rax
mov rax, qword [0x00419068]
mov qword [0x0041a908], rax
call fcn.0040cd40
call fcn.0040cd40
mov edx, 0x62a01364
lea rcx, [0x00413c80]
call fcn.00407a50
mov edx, 0x2f87bc64
mov rcx, rax
call fcn.004085b0
lea rcx, [0x00419060]
mov rdx, rax
call fcn.00405b10
nop
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ecx, 0x10
jmp 0x40dc0b
lea rcx, [0x00413c60]
mov edx, 0x416feac4
call fcn.00407a50
mov edx, 0x4ab89be4
mov rcx, rax
call fcn.004085b0
lea rcx, [0x00419118]
mov rdx, rax
call fcn.00405b10
mov rsi, qword [0x00419110]
mov rcx, qword [0x00419118]
call fcn.004079c0
test rsi, rsi
mov qword [0x00419110], rax
je 0x40dedb
mov rax, qword [rsi - 0x10]
lea rdx, [rsi - 0x10]
sub rax, 8
cmp rax, 7
mov qword [rsi - 0x10], rax
ja 0x40dedb
lea rcx, [0x00428628]
call fcn.00405a50
jmp 0x40dedb
test rdi, rdi
je 0x40e310
mov rdx, qword [rdi]
lea rcx, [section..rdata]
add rdi, 0x10
test rdx, rdx
cmovne rcx, rdi
call fcn.00409b20
mov rcx, rax
call qword [0x0041a128]
jmp 0x40debb
lea rcx, [section..rdata]
xor edx, edx
jmp 0x40dea4
lea rcx, [0x00412020]
cmp rsi, 7
mov eax, 7
cmovl rsi, rax
lea rdx, [rsi + 0x11]
call fcn.004081e0
mov qword [rax + 8], rsi
mov rdi, rax
mov qword [rax], 0
mov rsi, qword [0x00419110]
test rsi, rsi
je 0x40dde6
lea rcx, [rax + 0x10]
mov rax, qword [rsi]
lea rdx, [rsi + 0x10]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rsi]
mov qword [rdi], rax
jmp 0x40dde6
mov ecx, 0x10
jmp 0x40ddcb
lea rcx, [0x00412020]
cmp rsi, 7
mov eax, 7
cmovl rsi, rax
lea rdx, [rsi + 0x11]
call fcn.004081e0
mov qword [rax + 8], rsi
mov rdi, rax
mov qword [rax], 0
mov rsi, qword [0x00419118]
test rsi, rsi
je 0x40dc26
lea rcx, [rax + 0x10]
mov rax, qword [rsi]
lea rdx, [rsi + 0x10]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rsi]
mov qword [rdi], rax
jmp 0x40dc26
lea rcx, [section..rdata]
xor edx, edx
jmp 0x40e00d
lea rcx, [section..rdata]
xor edx, edx
jmp 0x40e1fe
call fcn.00402d40
nop
nop
nop word cs:[rax + rax]