Function at 0x408eb0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x58], 0
mov word [rsp + 0x20], 0
mov qword [rsp + 0x60], 0
lea r9, [rsp + 0x38]
mov r8w, 1
mov dl, 1
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_RtlImageDirectoryEntryToData]
mov qword [rsp + 0x48], rax
cmp dword [rsp + 0x38], 0
je 0x40914f
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0x10]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.00408770
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x409122
mov rax, qword [rsp + 0x30]
movabs rcx, 0x8000000000000000
mov rax, qword [rax]
and rax, rcx
test rax, rax
je 0x409019
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
and rax, 0xffff
mov word [rsp + 0x20], ax
movzx eax, word [rsp + 0x20]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x58]
call fcn.00408330
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x409001
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
mov qword [rax], rcx
jmp 0x409014
movzx eax, word [rsp + 0x20]
mov edx, eax
lea rcx, [0x0040c9b0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x4090f5
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov dl, 0x5a
mov rax, qword [rsp + 0x68]
movzx ecx, byte [rax + 2]
call fcn.0040ab50
movzx eax, al
test eax, eax
jne 0x409062
mov dl, 0x77
mov rax, qword [rsp + 0x68]
movzx ecx, byte [rax + 3]
call fcn.0040ab50
movzx eax, al
test eax, eax
je 0x409090
mov dl, 0x4e
mov rax, qword [rsp + 0x68]
movzx ecx, byte [rax + 2]
call fcn.0040ab50
movzx eax, al
test eax, eax
jne 0x4090a8
mov dl, 0x74
mov rax, qword [rsp + 0x68]
movzx ecx, byte [rax + 3]
call fcn.0040ab50
movzx eax, al
test eax, eax
jne 0x4090a8
mov rax, qword [rsp + 0x68]
add rax, 2
mov rcx, rax
call fcn.00408c70
mov qword [rsp + 0x60], rax
jmp 0x4090c6
mov rax, qword [rsp + 0x68]
add rax, 2
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call fcn.00408330
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x4090dd
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
mov qword [rax], rcx
jmp 0x4090f5
mov rax, qword [rsp + 0x68]
add rax, 2
mov rdx, rax
lea rcx, [0x0040c980]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
add rax, 8
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
jne 0x408fa4
jmp 0x409133
mov rdx, qword [rsp + 0x40]
lea rcx, [0x0040c950]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [rsp + 0x48]
add rax, 0x14
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
cmp dword [rax], 0
jne 0x408f39
add rsp, 0x78
ret