Function at 0x1400856d0
Capabilities:
Enumerate process modules
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x5148
call fcn.140101da0
sub rsp, rax
mov rax, qword [0x1401cf518]
xor rax, rsp
mov qword [rsp + 0x5130], rax
mov dword [rsp + 0x68], 0
lea rdx, [0x140144480]
lea rcx, [rsp + 0x10f0]
call fcn.140003570
nop
lea rdx, [rsp + 0x10f0]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x8b], al
lea rcx, [rsp + 0x10f0]
call fcn.140003860
movzx eax, byte [rsp + 0x8b]
test eax, eax
je 0x140085762
lea rcx, str._nListProcessThreads
call fcn.14000ad70
mov byte [rsp + 0x50], 0
mov rax, qword [rsp + 0x5160]
mov qword [rsp + 0x2b0], rax
mov rax, qword [rsp + 0x2b0]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0x2b0]
mov eax, dword [rax + 4]
mov dword [rsp + 0x124], eax
mov byte [rsp + 0xcc], 1
mov byte [rsp + 0xcd], 1
mov byte [rsp + 0x62], 0
mov byte [rsp + 0x63], 0
mov byte [rsp + 0x61], 0
mov byte [rsp + 0x5a], 0
mov byte [rsp + 0x64], 0
mov byte [rsp + 0x65], 0
mov byte [rsp + 0x5b], 0
mov byte [rsp + 0x5e], 0
mov byte [rsp + 0x52], 0
mov dword [rsp + 0xe4], 0
mov edx, 0x18
lea rcx, [rsp + 0x2e30]
call fcn.1400079b0
lea rcx, [rsp + 0x2e30]
call fcn.140034230
nop
lea rdx, [0x14014449c]
lea rcx, [rsp + 0x1110]
call fcn.140003570
nop
lea rdx, [rsp + 0x1110]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x14008583d
mov dword [rsp + 0x130], 1
jmp 0x140085848
mov dword [rsp + 0x130], 0
movzx eax, byte [rsp + 0x130]
mov byte [rsp + 0x91], al
lea rcx, [rsp + 0x1110]
call fcn.140003860
movzx eax, byte [rsp + 0x91]
test eax, eax
je 0x140085892
mov edx, 4
lea rcx, [0x1401444a0]
call fcn.14004d7e0
mov edx, 0xa
lea rcx, str._n_n_THREADS__n
call fcn.14004d7e0
lea rdx, reloc.WS2_32.dll_WSAStartup
lea rcx, [rsp + 0x1130]
call fcn.140003570
nop
lea rdx, [rsp + 0x1130]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x92], al
lea rcx, [rsp + 0x1130]
call fcn.140003860
movzx eax, byte [rsp + 0x92]
test eax, eax
je 0x1400859a9
mov dword [0x1401d19fc], 0
mov r8d, 0x1000
xor edx, edx
lea rcx, [0x1401d1a00]
call fcn.1401044f0
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d1a00]
add rdx, rcx
mov rcx, rdx
mov r9d, dword [rsp + 0x5170]
lea r8, str._n_button_type_button__class_collapsible__id_dthreads_Threads__button__div_class_contento__
mov edx, eax
call fcn.1400c8230
mov dword [0x1401d19fc], eax
lea rdx, [0x1401d1a00]
lea rcx, [rsp + 0x1150]
call fcn.140003570
nop
lea rdx, [rsp + 0x1150]
lea rcx, [rsp + 0x2e30]
call fcn.1400c1960
nop
lea rcx, [rsp + 0x1150]
call fcn.140003860
lea rdx, str._n_hr_class_categAlertas___p_class_categAlertasColor___THREADS___p__n_table_class_process_table__
lea rcx, [rsp + 0x1170]
call fcn.140003570
nop
lea rdx, [rsp + 0x1170]
lea rcx, [rsp + 0x2e30]
call fcn.1400c1960
nop
lea rcx, [rsp + 0x1170]
call fcn.140003860
mov qword [rsp + 0x310], 0
mov qword [rsp + 0x340], 0
mov qword [rsp + 0x2a0], 0
mov qword [rsp + 0xf8], 0
lea rcx, [0x140144600]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0xf8], rax
cmp qword [rsp + 0xf8], 0
je 0x140085a3f
lea rdx, [0x140144610]
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x2a0], rax
cmp qword [rsp + 0x2a0], 0
je 0x140085a3f
mov rax, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x2a0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x310], rax
cmp qword [rsp + 0xf8], 0
je 0x140085b70
mov qword [rsp + 0xb40], 0
lea rax, [rsp + 0x2768]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov qword [rsp + 0x2778], 0
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x150], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x158], rax
cmp qword [rsp + 0x158], 0
je 0x140085b70
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
mov qword [rsp + 0x150], rax
cmp qword [rsp + 0x150], 0
je 0x140085b62
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x2770], rax
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x2768]
lea r8, [0x1400beaa0]
mov rdx, qword [rsp + 0x150]
lea rcx, [rsp + 0x2778]
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x2770]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x2768]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x340], rax
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueue]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x2e28], 0
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x190], 0
lea rax, [rsp + 0x3a00]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov qword [rsp + 0x2a8], 0
mov byte [rsp + 0x5f], 0
lea r9, [rsp + 0x2e28]
mov r8d, 0x400
lea rdx, [rsp + 0x3a00]
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rax]
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x140085dd9
mov dword [rsp + 0x94], 0
jmp 0x140085c03
mov eax, dword [rsp + 0x94]
inc eax
mov dword [rsp + 0x94], eax
movsxd rax, dword [rsp + 0x94]
mov qword [rsp + 0x3c8], rax
mov ecx, dword [rsp + 0x2e28]
xor edx, edx
mov eax, ecx
mov ecx, 8
div rcx
mov rcx, qword [rsp + 0x3c8]
cmp rcx, rax
jae 0x140085dd4
movsxd rax, dword [rsp + 0x94]
mov r9d, 0x104
lea r8, [rsp + 0x4570]
mov rdx, qword [rsp + rax*8 + 0x3a00]
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rax]
call sub.KERNEL32.dll_K32GetModuleFileNameExA
test eax, eax
je 0x140085dcf
lea rdx, [rsp + 0x4570]
lea rcx, [rsp + 0x3028]
call fcn.140003570
nop
lea rdx, [rsp + 0xb48]
lea rcx, [rsp + 0x3028]
call fcn.1400b5fc0
mov rax, qword [rax]
mov qword [rsp + 0x3d0], rax
mov rax, qword [rsp + 0x3d0]
mov qword [rsp + 0x3e8], rax
lea rdx, [rsp + 0xb50]
lea rcx, [rsp + 0x3028]
call fcn.1400bb5c0
mov rax, qword [rax]
mov qword [rsp + 0x3d8], rax
mov rax, qword [rsp + 0x3d8]
mov qword [rsp + 0x3f0], rax
lea rdx, [rsp + 0xb58]
lea rcx, [rsp + 0x3028]
call fcn.1400b5fc0
mov rax, qword [rax]
mov qword [rsp + 0x3e0], rax
mov rax, qword [rsp + 0x3e0]
mov qword [rsp + 0x3f8], rax
lea rax, [fcn.14010e274]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x3e8]
mov r8, qword [rsp + 0x3f0]
mov rdx, qword [rsp + 0x3f8]
lea rcx, [rsp + 0xb60]
call fcn.14002ea40
lea rdx, [rsp + 0x3028]
lea rcx, [0x140144628]
call fcn.14000fc60
movzx eax, al
test eax, eax
je 0x140085dc2
movsxd rax, dword [rsp + 0x94]
mov rax, qword [rsp + rax*8 + 0x3a00]
mov qword [rsp + 0x2a8], rax
mov rax, qword [rsp + 0x310]
mov rcx, qword [rsp + 0x2a8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x340]
mov rcx, qword [rsp + 0x2a8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x190], rax
lea rcx, [rsp + 0x3028]
call fcn.140003860
jmp 0x140085dd4
lea rcx, [rsp + 0x3028]
call fcn.140003860
jmp 0x140085bf3
mov byte [rsp + 0x5f], 1
mov dword [rsp + 0xa0], 0
jmp 0x140085df6
mov eax, dword [rsp + 0xa0]
inc eax
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0x124]
cmp dword [rsp + 0xa0], eax
jae 0x14008b159
mov dword [rsp + 0x2df0], 0
mov qword [rsp + 0x2780], 0
mov dword [rsp + 0x2e20], 1
mov dword [rsp + 0x2e24], 1
mov qword [rsp + 0x2728], 0
mov eax, dword [rsp + 0xa0]
imul rax, rax, 0x50
lea rcx, [rsp + 0x2790]
mov rdx, qword [rsp + 0x2b0]
mov rdi, rcx
lea rsi, [rdx + rax + 0x100]
mov ecx, 0x50
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0x27c0]
mov dword [rsp + 0x54], eax
mov r8d, dword [rsp + 0x54]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x2720], rax
cmp qword [rsp + 0x2720], 0
jne 0x140085ea5
jmp 0x140085de6
mov qword [rsp + 0x2730], 0
mov rax, qword [0x1401d6fb8]
mov qword [rsp + 0x400], rax
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rsp + 0x2730]
mov edx, 9
mov rcx, qword [rsp + 0x2720]
call qword [rsp + 0x400]
mov eax, dword [rsp + 0x27d8]
lea rcx, str.Executive
mov rdx, qword [rcx + rax*8]
lea rcx, [rsp + 0x2f10]
call fcn.140003570
nop
mov eax, dword [rsp + 0x27d4]
lea rcx, str.Initialized
mov rdx, qword [rcx + rax*8]
lea rcx, [rsp + 0x2ef0]
call fcn.140003570
nop
lea rdx, [0x140143f96]
lea rcx, [rsp + 0x2e68]
call fcn.140003570
nop
lea rdx, [0x140143f97]
lea rcx, [rsp + 0x2e88]
call fcn.140003570
nop
lea rdx, [0x140143fb2]
lea rcx, [rsp + 0x2fc8]
call fcn.140003570
nop
lea rdx, [0x140143fb3]
lea rcx, [rsp + 0x2fe8]
call fcn.140003570
nop
mov qword [rsp + 0x2c0], 0
mov qword [rsp + 0x2b8], 0
lea rax, [rsp + 0x2738]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
cmp qword [rsp + 0x2730], 0
je 0x140087235
lea rax, [rsp + 0x1360]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rax, [rsp + 0x2738]
lea rcx, [rsp + 0x1360]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x30
rep movsb byte [rdi], byte [rsi]
mov rax, qword [0x1401d6f80]
mov qword [rsp + 0x408], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x30
lea r9, [rsp + 0x2738]
xor r8d, r8d
mov rdx, qword [rsp + 0x2730]
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rax]
call qword [rsp + 0x408]
cmp dword [rsp + 0x2760], 0x1000000
je 0x140086eaf
cmp dword [rsp + 0x2760], 0
je 0x140086eaf
mov byte [rsp + 0x62], 1
mov eax, dword [0x1401d19f4]
add eax, 0xa
mov dword [0x1401d19f4], eax
mov rax, qword [rsp + 0x2738]
mov qword [rsp + 0x2b8], rax
mov rax, qword [rsp + 0x2740]
mov qword [rsp + 0x2c0], rax
mov eax, dword [rsp + 0x2748]
and eax, 0xfffff8ff
mov dword [rsp + 0xa4], eax
mov eax, dword [rsp + 0xa4]
dec eax
mov dword [rsp + 0xa4], eax
cmp dword [rsp + 0xa4], 0x7f
ja case.0x1400860d5.3
mov eax, dword [rsp + 0xa4]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x8ba1c]
mov eax, dword [rcx + rax*4 + 0x8b9f8]
add rax, rcx
jmp rax
lea rdx, [0x140144648]
lea rcx, [rsp + 0x2e68]
call fcn.140003940
jmp case.0x1400860d5.3
lea rdx, [0x140144658]
lea rcx, [rsp + 0x2e68]
call fcn.140003940
jmp case.0x1400860d5.3
lea rdx, [0x140144668]
lea rcx, [rsp + 0x2e68]
call fcn.140003940
jmp case.0x1400860d5.3
lea rdx, [0x140144678]
lea rcx, [rsp + 0x2e68]
call fcn.140003940
jmp case.0x1400860d5.3
lea rdx, [0x140144688]
lea rcx, [rsp + 0x2e68]
call fcn.140003940
jmp case.0x1400860d5.3
lea rdx, [0x1401446a0]
lea rcx, [rsp + 0x2e68]
call fcn.140003940
jmp case.0x1400860d5.3
lea rdx, [0x1401446b8]
lea rcx, [rsp + 0x2e68]
call fcn.140003940
jmp case.0x1400860d5.3
lea rdx, [0x1401446d0]
lea rcx, [rsp + 0x2e68]
call fcn.140003940
mov eax, dword [rsp + 0x275c]
and eax, 0xfffff8ff
mov dword [rsp + 0xa8], eax
mov eax, dword [rsp + 0xa8]
dec eax
mov dword [rsp + 0xa8], eax
cmp dword [rsp + 0xa8], 0x7f
ja case.0x1400861dc.3
mov eax, dword [rsp + 0xa8]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x8bac0]
mov eax, dword [rcx + rax*4 + 0x8ba9c]
add rax, rcx
jmp rax
lea rdx, str.PAGE_READONLY
lea rcx, [rsp + 0x2e88]
call fcn.140003940
jmp case.0x1400861dc.3
lea rdx, str.PAGE_READWRITE
lea rcx, [rsp + 0x2e88]
call fcn.140003940
jmp case.0x1400861dc.3
lea rdx, str.PAGE_WRITECOPY
lea rcx, [rsp + 0x2e88]
call fcn.140003940
jmp case.0x1400861dc.3
lea rdx, str.PAGE_EXECUTE
lea rcx, [rsp + 0x2e88]
call fcn.140003940
jmp case.0x1400861dc.3
lea rdx, str.PAGE_EXECUTE_READ
lea rcx, [rsp + 0x2e88]
call fcn.140003940
jmp case.0x1400861dc.3
lea rdx, str.PAGE_EXECUTE_READWRITE
lea rcx, [rsp + 0x2e88]
call fcn.140003940
jmp case.0x1400861dc.3
lea rdx, str.PAGE_EXECUTE_WRITECOPY
lea rcx, [rsp + 0x2e88]
call fcn.140003940
jmp case.0x1400861dc.3
lea rdx, [0x140144768]
lea rcx, [rsp + 0x2e88]
call fcn.140003940
mov eax, dword [rsp + 0x2758]
mov dword [rsp + 0xd8], eax
cmp dword [rsp + 0xd8], 0x1000
je 0x1400862c9
cmp dword [rsp + 0xd8], 0x2000
je 0x1400862df
cmp dword [rsp + 0xd8], 0x10000
je 0x1400862f5
jmp 0x140086309
lea rdx, str.MEM_COMMIT
lea rcx, [rsp + 0x2fc8]
call fcn.140003940
jmp 0x140086309
lea rdx, str.MEM_RESERVE
lea rcx, [rsp + 0x2fc8]
call fcn.140003940
jmp 0x140086309
lea rdx, str.MEM_FREE
lea rcx, [rsp + 0x2fc8]
call fcn.140003940
mov eax, dword [rsp + 0x2760]
mov dword [rsp + 0xdc], eax
cmp dword [rsp + 0xdc], 0x20000
je 0x14008636c
cmp dword [rsp + 0xdc], 0x40000
je 0x140086356
cmp dword [rsp + 0xdc], 0x1000000
je 0x140086340
jmp 0x140086380
lea rdx, [0x1401447a8]
lea rcx, [rsp + 0x2fe8]
call fcn.140003940
jmp 0x140086380
lea rdx, str.MEM_MAPPED
lea rcx, [rsp + 0x2fe8]
call fcn.140003940
jmp 0x140086380
lea rdx, str.MEM_PRIVATE
lea rcx, [rsp + 0x2fe8]
call fcn.140003940
lea rdx, [0x1401447d4]
lea rcx, [rsp + 0x1190]
call fcn.140003570
nop
lea rdx, [rsp + 0x1190]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x1400863bd
mov dword [rsp + 0x100], 1
jmp 0x1400863c8
mov dword [rsp + 0x100], 0
movzx eax, byte [rsp + 0x100]
mov byte [rsp + 0x70], al
lea rcx, [rsp + 0x1190]
call fcn.140003860
movzx eax, byte [rsp + 0x70]
test eax, eax
je 0x140086640
mov ecx, ntohs
call fcn.14007a320
lea rcx, str._n_SUSPICIOUS_THREAD:__Thread_Memory_NOT_MEM_IMAGE__
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0xd4], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x410], rax
movzx edx, word [rsp + 0xd4]
mov rcx, qword [rsp + 0x410]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, 0xa
lea rcx, str._nThread:
call fcn.14004d7e0
mov edx, dword [rsp + 0x54]
lea rcx, str._06d
call fcn.1400c83f0
mov edx, 0xa
lea rcx, str._nThread_Start_address:
call fcn.14004d7e0
mov rax, qword [rsp + 0x2740]
mov qword [rsp + 0x418], rax
lea rdx, [rsp + 0x418]
lea rcx, [0x1401d7050]
call fcn.140041bb0
mov ecx, 0x20
imul rcx, rcx, 4
lea rax, [rax + rcx + 0x2d0]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x420], rax
mov rax, qword [rsp + 0x2730]
mov qword [rsp + 0x428], rax
mov r8, qword [rsp + 0x420]
mov rdx, qword [rsp + 0x428]
lea rcx, str.0x_016llx___S_
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._nState:
call fcn.14004d7e0
lea rcx, [rsp + 0x2f10]
call fcn.1400b3ed0
mov qword [rsp + 0x430], rax
lea rcx, [rsp + 0x2ef0]
call fcn.1400b3ed0
mov qword [rsp + 0x438], rax
mov r8, qword [rsp + 0x430]
mov rdx, qword [rsp + 0x438]
lea rcx, [0x140144864]
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._nBase_Address:
call fcn.14004d7e0
mov rdx, qword [rsp + 0x2b8]
lea rcx, [0x140144880]
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._nAllocation_Base:
call fcn.14004d7e0
mov rdx, qword [rsp + 0x2c0]
lea rcx, str.0x_016llX
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._nAllocated_Memory_Protection:
call fcn.14004d7e0
lea rcx, [rsp + 0x2e68]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x1401448d8]
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._nMemory_Protection:
call fcn.14004d7e0
lea rcx, [rsp + 0x2e88]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x1401448f8]
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._nMemory_State:
call fcn.14004d7e0
lea rcx, [rsp + 0x2fc8]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x140144910]
call fcn.14000ad70
mov edx, 0xa
lea rcx, [0x140144918]
call fcn.14004d7e0
lea rcx, [rsp + 0x2fe8]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x140144928]
call fcn.14000ad70
lea rcx, [0x14014492c]
call fcn.14000ad70
lea rdx, reloc.WS2_32.dll_WSAStartup
lea rcx, [rsp + 0x11b0]
call fcn.140003570
nop
lea rdx, [rsp + 0x11b0]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x71], al
lea rcx, [rsp + 0x11b0]
call fcn.140003860
movzx eax, byte [rsp + 0x71]
test eax, eax
je 0x140086c5a
mov dword [0x1401d19fc], 0
mov r8d, 0x1000
xor edx, edx
lea rcx, [0x1401d1a00]
call fcn.1401044f0
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d1a00]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__font_
mov qword [rsp + 0x20], rdx
lea r9, str._font_color_ff6965___
lea r8, str._n_tr__td_colspan_2___s_SUSPICIOUS_THREAD:__Thread_Memory_NOT_MEM_IMAGE___s__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x2c8], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x2cc], eax
mov eax, dword [rsp + 0x2c8]
mov ecx, dword [rsp + 0x2cc]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d1a00]
add rdx, rcx
mov rcx, rdx
mov r9d, dword [rsp + 0x54]
lea r8, str._n_tr__td_class___nuevoazul__Thread:__td___td___06d__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x2d0], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x2d4], eax
mov eax, dword [rsp + 0x2d0]
mov ecx, dword [rsp + 0x2d4]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov rax, qword [rsp + 0x2740]
mov qword [rsp + 0x440], rax
lea rdx, [rsp + 0x440]
lea rcx, [0x1401d7050]
call fcn.140041bb0
mov ecx, 0x20
imul rcx, rcx, 4
lea rax, [rax + rcx + 0x2d0]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x448], rax
mov rax, qword [rsp + 0x2730]
mov qword [rsp + 0x450], rax
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x458], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d1a00]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x460], rax
mov rax, qword [rsp + 0x448]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x450]
lea r8, str._n_tr__td_class___nuevoazul__Thread_Start_address:__td___td__0x_016llx___S___td___tr_
mov rdx, qword [rsp + 0x458]
mov rcx, qword [rsp + 0x460]
call fcn.1400c8230
mov dword [rsp + 0x2d8], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x2dc], eax
mov eax, dword [rsp + 0x2d8]
mov ecx, dword [rsp + 0x2dc]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x2f10]
call fcn.1400b3ed0
mov qword [rsp + 0x468], rax
lea rcx, [rsp + 0x2ef0]
call fcn.1400b3ed0
mov qword [rsp + 0x470], rax
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x478], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d1a00]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x480], rax
mov rax, qword [rsp + 0x468]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x470]
lea r8, str._n_tr__td_class___nuevoazul__Thread_State:__td___td___s:_s__td___tr_
mov rdx, qword [rsp + 0x478]
mov rcx, qword [rsp + 0x480]
call fcn.1400c8230
mov dword [rsp + 0x2e0], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x2e4], eax
mov eax, dword [rsp + 0x2e0]
mov ecx, dword [rsp + 0x2e4]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d1a00]
add rdx, rcx
mov rcx, rdx
mov r9, qword [rsp + 0x2b8]
lea r8, str._n_tr__td_class___nuevoazul__Base_Address:__td___td__0x_016llX__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x2e8], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x2ec], eax
mov eax, dword [rsp + 0x2e8]
mov ecx, dword [rsp + 0x2ec]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d1a00]
add rdx, rcx
mov rcx, rdx
mov r9, qword [rsp + 0x2c0]
lea r8, str._n_tr__td_class___nuevoazul__Allocation_Base:__td___td__0x_016llX__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x2f0], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x2f4], eax
mov eax, dword [rsp + 0x2f0]
mov ecx, dword [rsp + 0x2f4]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x2e68]
call fcn.1400b3ed0
mov qword [rsp + 0x488], rax
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x490], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d1a00]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x498], rax
mov r9, qword [rsp + 0x488]
lea r8, str._n_tr__td_class___nuevoazul__Allocated_Memory_Protection:__td___td___s__td___tr_
mov rdx, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x498]
call fcn.1400c8230
mov dword [rsp + 0x2f8], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x2fc], eax
mov eax, dword [rsp + 0x2f8]
mov ecx, dword [rsp + 0x2fc]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x2e88]
call fcn.1400b3ed0
mov qword [rsp + 0x4a0], rax
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x4a8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d1a00]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x4b0], rax
mov r9, qword [rsp + 0x4a0]
lea r8, str._n_tr__td_class___nuevoazul__Memory_Protection:__td___td___s__td___tr_
mov rdx, qword [rsp + 0x4a8]
mov rcx, qword [rsp + 0x4b0]
call fcn.1400c8230
mov dword [rsp + 0x1b0], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x1b4], eax
mov eax, dword [rsp + 0x1b0]
mov ecx, dword [rsp + 0x1b4]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x2fc8]
call fcn.1400b3ed0
mov qword [rsp + 0x4b8], rax
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x4c0], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d1a00]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x4c8], rax
mov r9, qword [rsp + 0x4b8]
lea r8, str._n_tr__td_class___nuevoazul__Memory_State:__td___td___s__td___tr_
mov rdx, qword [rsp + 0x4c0]
mov rcx, qword [rsp + 0x4c8]
call fcn.1400c8230
mov dword [rsp + 0x1b8], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x1bc], eax
mov eax, dword [rsp + 0x1b8]
mov ecx, dword [rsp + 0x1bc]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x2fe8]
call fcn.1400b3ed0
mov qword [rsp + 0x4d0], rax
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x4d8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d1a00]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x4e0], rax
mov r9, qword [rsp + 0x4d0]
lea r8, str._n_tr__td_class___nuevoazul__Memory_Type:__td___td___s__td___tr_
mov rdx, qword [rsp + 0x4d8]
mov rcx, qword [rsp + 0x4e0]
call fcn.1400c8230
mov dword [rsp + 0x1c0], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x1c4], eax
mov eax, dword [rsp + 0x1c0]
mov ecx, dword [rsp + 0x1c4]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [0x1401d1a00]
lea rcx, [rsp + 0x11d0]
call fcn.140003570
nop
lea rdx, [rsp + 0x11d0]
lea rcx, [rsp + 0x2e30]
call fcn.1400c1960
nop
lea rcx, [rsp + 0x11d0]
call fcn.140003860
mov edx, 0x18
lea rcx, [rsp + 0x2ea8]
call fcn.1400079b0
lea rcx, [rsp + 0x2ea8]
call fcn.140034230
nop
mov edx, 0x100
lea rcx, [rsp + 0x2ea8]
call fcn.1400c2130
xor edx, edx
lea rcx, [rsp + 0x2ea8]
call fcn.140041c50
mov qword [rsp + 0x4e8], rax
mov rax, qword [rsp + 0x5168]
mov rax, qword [rax]
mov qword [rsp + 0x4f0], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x100
mov r8, qword [rsp + 0x4e8]
lea rdx, [rsp + 0x2730]
mov rcx, qword [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140086e51
movzx eax, byte [0x1401d2a1a]
mov byte [rsp + 0x72], al
movzx eax, byte [0x1401d2a17]
mov byte [rsp + 0x73], al
lea rax, [rsp + 0x1390]
mov qword [rsp + 0x4f8], rax
lea rdx, [0x140144c74]
mov rcx, qword [rsp + 0x4f8]
call fcn.140003570
mov qword [rsp + 0x500], rax
mov rax, qword [rsp + 0x500]
mov qword [rsp + 0x508], rax
xor edx, edx
lea rcx, [rsp + 0x2ea8]
call fcn.140041c50
mov qword [rsp + 0x510], rax
mov rax, qword [rsp + 0x2730]
mov qword [rsp + 0x518], rax
movzx eax, byte [rsp + 0x72]
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x73]
mov byte [rsp + 0x28], al
mov byte [rsp + 0x20], 1
mov r9, qword [rsp + 0x508]
mov r8d, 0x100
mov rdx, qword [rsp + 0x510]
mov rcx, qword [rsp + 0x518]
call fcn.14007a6b0
movzx eax, byte [0x1401d2a1a]
mov byte [rsp + 0x74], al
movzx eax, byte [0x1401d2a17]
mov byte [rsp + 0x75], al
lea rax, [rsp + 0x13b0]
mov qword [rsp + 0x520], rax
lea rdx, [0x140144c78]
mov rcx, qword [rsp + 0x520]
call fcn.140003570
mov qword [rsp + 0x528], rax
mov rax, qword [rsp + 0x528]
mov qword [rsp + 0x530], rax
xor edx, edx
lea rcx, [rsp + 0x2ea8]
call fcn.140041c50
mov qword [rsp + 0x538], rax
mov rax, qword [rsp + 0x2730]
mov qword [rsp + 0x540], rax
movzx eax, byte [rsp + 0x74]
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x75]
mov byte [rsp + 0x28], al
mov byte [rsp + 0x20], 1
mov r9, qword [rsp + 0x530]
mov r8d, 0x20
mov rdx, qword [rsp + 0x538]
mov rcx, qword [rsp + 0x540]
call fcn.14009ee40
lea rcx, [rsp + 0x1270]
call fcn.140034230
mov qword [rsp + 0x548], rax
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x550], rax
lea rdx, [rsp + 0x2ea8]
mov rcx, qword [rsp + 0x550]
call fcn.1400c3850
lea rcx, [rsp + 0x1270]
call fcn.14003d030
mov byte [rsp + 0x50], 1
lea rcx, [rsp + 0x2ea8]
call fcn.14003d030
jmp 0x140087233
lea rdx, [0x140144c7c]
lea rcx, [rsp + 0x11f0]
call fcn.140003570
nop
lea rdx, [rsp + 0x11f0]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x140086eec
mov dword [rsp + 0x138], 1
jmp 0x140086ef7
mov dword [rsp + 0x138], 0
movzx eax, byte [rsp + 0x138]
mov byte [rsp + 0x76], al
lea rcx, [rsp + 0x11f0]
call fcn.140003860
movzx eax, byte [rsp + 0x76]
test eax, eax
je 0x140087056
mov rax, qword [rsp + 0x2740]
mov qword [rsp + 0x558], rax
lea r8, [rsp + 0x558]
lea rdx, [rsp + 0xb68]
lea rcx, [0x1401d7050]
call fcn.1400bc620
mov qword [rsp + 0x568], rax
lea rdx, [rsp + 0xab8]
lea rcx, [0x1401d7050]
call fcn.1400bb510
mov qword [rsp + 0x560], rax
mov rdx, qword [rsp + 0x560]
mov rcx, qword [rsp + 0x568]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x140087056
lea rcx, [rsp + 0x2f10]
call fcn.1400b3ed0
mov qword [rsp + 0x580], rax
lea rcx, [rsp + 0x2ef0]
call fcn.1400b3ed0
mov qword [rsp + 0x588], rax
mov rax, qword [rsp + 0x2740]
mov qword [rsp + 0x570], rax
mov eax, 0x20
imul rax, rax, 4
mov qword [rsp + 0x578], rax
lea rdx, [rsp + 0x570]
lea rcx, [0x1401d7050]
call fcn.140041bb0
mov rcx, qword [rsp + 0x578]
lea rax, [rax + rcx + 0x2d0]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x590], rax
mov rax, qword [rsp + 0x2730]
mov qword [rsp + 0x598], rax
mov rax, qword [rsp + 0x580]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x588]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x590]
mov r8, qword [rsp + 0x598]
mov edx, dword [rsp + 0x54]
lea rcx, str._nThread__06d:_Start_address_0x_016llx___S___State:__s:_s_
call fcn.14000ad70
lea rdx, [0x140144cbc]
lea rcx, [rsp + 0x1210]
call fcn.140003570
nop
lea rdx, [rsp + 0x1210]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x77], al
lea rcx, [rsp + 0x1210]
call fcn.140003860
movzx eax, byte [rsp + 0x77]
test eax, eax
je 0x140087233
mov dword [0x1401d19fc], 0
mov r8d, 0x1000
xor edx, edx
lea rcx, [0x1401d1a00]
call fcn.1401044f0
lea rcx, [rsp + 0x2f10]
call fcn.1400b3ed0
mov qword [rsp + 0x5b0], rax
lea rcx, [rsp + 0x2ef0]
call fcn.1400b3ed0
mov qword [rsp + 0x5b8], rax
mov rax, qword [rsp + 0x2740]
mov qword [rsp + 0x5a0], rax
mov eax, 0x20
imul rax, rax, 4
mov qword [rsp + 0x5a8], rax
lea rdx, [rsp + 0x5a0]
lea rcx, [0x1401d7050]
call fcn.140041bb0
mov rcx, qword [rsp + 0x5a8]
lea rax, [rax + rcx + 0x2d0]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x5c0], rax
mov rax, qword [rsp + 0x2730]
mov qword [rsp + 0x5c8], rax
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x5d0], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d1a00]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x5d8], rax
mov rax, qword [rsp + 0x5b0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x5b8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x5c0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x5c8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x54]
lea r8, str._n_tr__td_colspan_2__class___nuevoazul__Thread__06d:_Start_address_0x_016llx___S___State:__s:_s____td___tr_
mov rdx, qword [rsp + 0x5d0]
mov rcx, qword [rsp + 0x5d8]
call fcn.1400c8230
mov dword [rsp + 0x1c8], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x1cc], eax
mov eax, dword [rsp + 0x1c8]
mov ecx, dword [rsp + 0x1cc]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [0x1401d1a00]
lea rcx, [rsp + 0x1230]
call fcn.140003570
nop
lea rdx, [rsp + 0x1230]
lea rcx, [rsp + 0x2e30]
call fcn.1400c1960
nop
lea rcx, [rsp + 0x1230]
call fcn.140003860
jmp 0x14008728d
lea rcx, [rsp + 0x2fe8]
call fcn.140003860
nop
lea rcx, [rsp + 0x2fc8]
call fcn.140003860
nop
lea rcx, [rsp + 0x2e88]
call fcn.140003860
nop
lea rcx, [rsp + 0x2e68]
call fcn.140003860
nop
lea rcx, [rsp + 0x2ef0]
call fcn.140003860
nop
lea rcx, [rsp + 0x2f10]
call fcn.140003860
jmp 0x140085de6
lea rax, [rsp + 0x39d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
lea rcx, [0x140144d48]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtProtectVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 8
imul rcx, rcx, 0
mov qword [rsp + rcx + 0x39d0], rax
lea rcx, [0x140144d70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140144d60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 8
imul rcx, rcx, 1
mov qword [rsp + rcx + 0x39d0], rax
lea rcx, [0x140144da8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140144d90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 8
imul rcx, rcx, 2
mov qword [rsp + rcx + 0x39d0], rax
lea rcx, [0x140144dd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x140144dc8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 8
imul rcx, rcx, 3
mov qword [rsp + rcx + 0x39d0], rax
lea rcx, str.kernelbase.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.VirtualProtectEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 8
imul rcx, rcx, 4
mov qword [rsp + rcx + 0x39d0], rax
lea rax, [rsp + 0x39c0]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x140]
mov qword [rsp + rax + 0x39c0], rcx
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x190]
mov qword [rsp + rax + 0x39c0], rcx
mov edx, 0x18
lea rcx, [rsp + 0x2ed8]
call fcn.1400079b0
lea rcx, [rsp + 0xce]
call fcn.140003030
mov qword [rsp + 0x5e0], rax
lea rdx, str.KiUserApcDispatcher
lea rcx, [rsp + 0x1300]
call fcn.140003570
nop
lea rdx, str.Callback_of_waitable_Timer
lea rcx, [rsp + 0x1320]
call fcn.140003570
nop
lea rax, [rsp + 0x1340]
mov r8, rax
lea rdx, [rsp + 0x1300]
lea rcx, [rsp + 0x1350]
call fcn.140033310
lea rcx, [rsp + 0xac0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xaf0]
lea rcx, [rsp + 0xac0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x5e0]
lea rdx, [rsp + 0xaf0]
lea rcx, [rsp + 0x2ed8]
call fcn.1400348f0
nop
lea r9, [fcn.140003860]
mov r8d, 2
mov edx, 0x20
lea rcx, [rsp + 0x1300]
call fcn.140102180
mov byte [rsp + 0x51], 0
cmp dword [rsp + 0x27d8], 4
je 0x14008750e
cmp dword [rsp + 0x27d8], 6
je 0x14008750e
lea rdx, [0x140144e64]
lea rcx, [rsp + 0x1250]
call fcn.140003570
nop
mov eax, dword [rsp + 0x68]
or eax, 1
mov dword [rsp + 0x68], eax
lea rdx, [rsp + 0x1250]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x14008750e
mov dword [rsp + 0x104], 0
jmp 0x140087519
mov dword [rsp + 0x104], 1
movzx eax, byte [rsp + 0x104]
mov byte [rsp + 0x78], al
mov eax, dword [rsp + 0x68]
and eax, 1
test eax, eax
je 0x140087542
and dword [rsp + 0x68], 0xfffffffe
lea rcx, [rsp + 0x1250]
call fcn.140003860
movzx eax, byte [rsp + 0x78]
test eax, eax
je 0x140088e33
mov dword [rsp + 0x378], 0
mov dword [rsp + 0x108], 0
mov dword [rsp + 0x37c], 0
mov dword [rsp + 0x380], 0
mov qword [rsp + 0x2e18], 0
mov qword [rsp + 0xad0], 0
lea rax, [rsp + 0x3e70]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
lea rax, [rsp + 0x1720]
mov rdi, rax
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
lea rax, [rsp + 0x3f70]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
lea rax, [rsp + 0x1610]
mov rdi, rax
xor eax, eax
mov ecx, 0x105
rep stosb byte [rdi], al
lea rax, [rsp + 0x34f0]
mov rdi, rax
xor eax, eax
mov ecx, 0x4d0
rep stosb byte [rdi], al
mov qword [rsp + 0x2810], 0
lea rax, [rsp + 0x2818]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
lea rax, [rsp + 0x48a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x890
rep stosb byte [rdi], al
lea rax, [rsp + 0x48a0]
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x3520], 0x10000b
mov dword [rsp + 0x2fb8], 0
lea rax, [rsp + 0x2fbc]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov edx, 0x18
lea rcx, [rsp + 0x2e00]
call fcn.1400079b0
lea rcx, [rsp + 0x2e00]
call fcn.140034230
nop
lea rdx, [rsp + 0x34f0]
mov rcx, qword [rsp + 0x2720]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140088e26
mov rax, qword [rsp + 0x35e8]
mov qword [rsp + 0x2810], rax
mov dword [rsp + 0x281c], 3
mov rax, qword [rsp + 0x3588]
mov qword [rsp + 0x2840], rax
mov dword [rsp + 0x284c], 3
mov rax, qword [rsp + 0x3590]
mov qword [rsp + 0x2830], rax
mov dword [rsp + 0x283c], 3
mov r8d, 1
xor edx, edx
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rax]
call qword [sym.imp.imagehlp.dll_SymInitialize]
mov rax, qword [rsp + 0x98]
mov dword [rax], 0x690
mov edx, 0x18
lea rcx, [rsp + 0x2e50]
call fcn.1400079b0
lea rcx, [rsp + 0x2e50]
call fcn.140034230
nop
mov qword [rsp + 0x40], 0
mov rax, qword [sym.imp.imagehlp.dll_SymGetModuleBase64]
mov qword [rsp + 0x38], rax
mov rax, qword [sym.imp.imagehlp.dll_SymFunctionTableAccess64]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x34f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2810]
mov r8, qword [rsp + 0x2720]
mov rax, qword [rsp + 0x5168]
mov rdx, qword [rax]
mov ecx, 0x8664
call qword [sym.imp.imagehlp.dll_StackWalk64]
test eax, eax
je 0x140087fb1
lea rax, [rsp + 0x4680]
mov rdi, rax
xor eax, eax
mov ecx, 0x220
rep stosb byte [rdi], al
lea rax, [rsp + 0x4680]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov dword [rax], 0x20
mov rax, qword [rsp + 0xf0]
mov dword [rax + 0x18], 0xff
lea rcx, [rsp + 0x2e00]
call fcn.1400c32e0
cmp rax, 0x40
jbe 0x1400877f9
jmp 0x140088497
mov r8, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x2810]
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rax]
call qword [sym.imp.imagehlp.dll_SymGetModuleInfo64]
mov dword [rsp + 0x108], eax
cmp dword [rsp + 0x108], 0
jne 0x14008795a
lea rdx, [0x140144e68]
lea rcx, [0x1401d77a8]
call fcn.14000fc30
movzx eax, al
test eax, eax
jne 0x140087867
lea rdx, [0x140143fb4]
lea rcx, [0x1401d77a8]
call fcn.14000fc30
movzx eax, al
test eax, eax
je 0x1400878ff
lea rdx, [rsp + 0x5170]
lea rcx, [0x1401d7490]
call fcn.1400418d0
add rax, 8
lea rdx, [0x140143fb5]
mov rcx, rax
call fcn.14000fc30
movzx eax, al
test eax, eax
je 0x1400878ff
mov r8, qword [rsp + 0x2810]
lea rdx, str.0x_p___Unknown_module_
lea rcx, [rsp + 0x3f70]
call qword [sym.imp.USER32.dll_wsprintfA]
mov byte [rsp + 0x51], 1
movzx eax, byte [rsp + 0x52]
test eax, eax
jne 0x1400878fd
lea rdx, [0x140144e98]
lea rcx, [rsp + 0xd90]
call fcn.140003570
nop
lea rdx, [rsp + 0xd90]
lea rcx, [rsp + 0x2e50]
call fcn.1400c1960
nop
lea rcx, [rsp + 0xd90]
call fcn.140003860
mov byte [rsp + 0x52], 1
jmp 0x14008791c
mov r8, qword [rsp + 0x2810]
lea rdx, str.0x_p
lea rcx, [rsp + 0x3f70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x3f70]
lea rcx, [rsp + 0xef0]
call fcn.140003570
nop
lea rdx, [rsp + 0xef0]
lea rcx, [rsp + 0x2e00]
call fcn.1400c1960
nop
lea rcx, [rsp + 0xef0]
call fcn.140003860
jmp 0x140087fac
mov qword [rsp + 0xb8], 0
mov r9, qword [rsp + 0xf0]
lea r8, [rsp + 0x2e18]
mov rdx, qword [rsp + 0x2810]
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rax]
call qword [sym.imp.imagehlp.dll_SymGetSymFromAddr64]
test eax, eax
je 0x1400879d0
mov r8d, 0x100
xor edx, edx
lea rcx, [rsp + 0x3e70]
call fcn.1401044f0
mov rax, qword [rsp + 0xf0]
add rax, 0x1c
xor r9d, r9d
mov r8d, 0x100
lea rdx, [rsp + 0x3e70]
mov rcx, rax
call qword [sym.imp.imagehlp.dll_UnDecorateSymbolName]
jmp 0x1400879f2
mov rax, qword [rsp + 0x98]
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x2810]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xb8], rax
mov byte [rsp + 0x58], 0
mov dword [rsp + 0xac], 0
jmp 0x140087a14
mov eax, dword [rsp + 0xac]
inc eax
mov dword [rsp + 0xac], eax
cmp dword [rsp + 0xac], 5
jge 0x140087b7d
movsxd rax, dword [rsp + 0xac]
mov rcx, qword [rsp + 0xf0]
mov rcx, qword [rcx + 8]
cmp qword [rsp + rax*8 + 0x39d0], rcx
jne 0x140087b78
cmp qword [rsp + 0xb8], 0
jne 0x140087ac3
mov rax, qword [rsp + 0x98]
add rax, 0x44
mov rcx, qword [rsp + 0x2e18]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x3e70]
mov r8, rax
lea rdx, str._s__s0x_llx_____Suspicious_call_to_VirtualProtect_class_function_
lea rcx, [rsp + 0x3f70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x3f70]
lea rcx, [rsp + 0xf10]
call fcn.140003570
nop
lea rdx, [rsp + 0xf10]
lea rcx, [rsp + 0x2e00]
call fcn.1400c1960
nop
lea rcx, [rsp + 0xf10]
call fcn.140003860
jmp 0x140087b28
mov rax, qword [rsp + 0x98]
add rax, 0x44
mov r9, qword [rsp + 0xb8]
mov r8, rax
lea rdx, str._s0x_llx_____Suspicious_call_to_VirtualProtect_class_function_
lea rcx, [rsp + 0x3f70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x3f70]
lea rcx, [rsp + 0xf30]
call fcn.140003570
nop
lea rdx, [rsp + 0xf30]
lea rcx, [rsp + 0x2e00]
call fcn.1400c1960
nop
lea rcx, [rsp + 0xf30]
call fcn.140003860
movzx eax, byte [rsp + 0x5e]
test eax, eax
jne 0x140087b6e
lea rdx, [0x140144f68]
lea rcx, [rsp + 0xf50]
call fcn.140003570
nop
lea rdx, [rsp + 0xf50]
lea rcx, [rsp + 0x2e50]
call fcn.1400c1960
nop
lea rcx, [rsp + 0xf50]
call fcn.140003860
mov byte [rsp + 0x5e], 1
mov byte [rsp + 0x58], 1
mov byte [rsp + 0x51], 1
jmp 0x140087a04
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0xf0]
mov rcx, qword [rcx + 8]
cmp qword [rsp + rax + 0x39c0], rcx
jne 0x140087d38
cmp qword [rsp + 0xb8], 0
jne 0x140087c62
xor edx, edx
lea rcx, [rsp + 0x2ed8]
call fcn.140041d40
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x5f0], rax
mov rax, qword [rsp + 0x2e18]
mov qword [rsp + 0x5f8], rax
mov rax, qword [rsp + 0x98]
add rax, 0x44
mov rcx, qword [rsp + 0x5f0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x5f8]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x3e70]
mov r8, rax
lea rdx, [0x140144f90]
lea rcx, [rsp + 0x3f70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x3f70]
lea rcx, [rsp + 0x1090]
call fcn.140003570
nop
lea rdx, [rsp + 0x1090]
lea rcx, [rsp + 0x2e00]
call fcn.1400c1960
nop
lea rcx, [rsp + 0x1090]
call fcn.140003860
jmp 0x140087ce3
xor edx, edx
lea rcx, [rsp + 0x2ed8]
call fcn.140041d40
mov rcx, rax
call fcn.1400b3ed0
mov rcx, qword [rsp + 0x98]
add rcx, 0x44
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xb8]
mov r8, rcx
lea rdx, [0x140144fc0]
lea rcx, [rsp + 0x3f70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x3f70]
lea rcx, [rsp + 0xf70]
call fcn.140003570
nop
lea rdx, [rsp + 0xf70]
lea rcx, [rsp + 0x2e00]
call fcn.1400c1960
nop
lea rcx, [rsp + 0xf70]
call fcn.140003860
movzx eax, byte [rsp + 0x5b]
test eax, eax
jne 0x140087d29
lea rdx, [0x140144ff0]
lea rcx, [rsp + 0x10d0]
call fcn.140003570
nop
lea rdx, [rsp + 0x10d0]
lea rcx, [rsp + 0x2e50]
call fcn.1400c1960
nop
lea rcx, [rsp + 0x10d0]
call fcn.140003860
mov byte [rsp + 0x5b], 1
mov byte [rsp + 0x58], 1
mov byte [rsp + 0x51], 1
jmp 0x140087ef4
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0xf0]
mov rcx, qword [rcx + 8]
cmp qword [rsp + rax + 0x39c0], rcx
jne 0x140087ef4
cmp qword [rsp + 0xb8], 0
jne 0x140087e20
mov edx, 1
lea rcx, [rsp + 0x2ed8]
call fcn.140041d40
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x600], rax
mov rax, qword [rsp + 0x2e18]
mov qword [rsp + 0x608], rax
mov rax, qword [rsp + 0x98]
add rax, 0x44
mov rcx, qword [rsp + 0x600]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x608]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x3e70]
mov r8, rax
lea rdx, str._s__s0x_llx_____Suspicious_call_to__s_
lea rcx, [rsp + 0x3f70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x3f70]
lea rcx, [rsp + 0x10b0]
call fcn.140003570
nop
lea rdx, [rsp + 0x10b0]
lea rcx, [rsp + 0x2e00]
call fcn.1400c1960
nop
lea rcx, [rsp + 0x10b0]
call fcn.140003860
jmp 0x140087ea4
mov edx, 1
lea rcx, [rsp + 0x2ed8]
call fcn.140041d40
mov rcx, rax
call fcn.1400b3ed0
mov rcx, qword [rsp + 0x98]
add rcx, 0x44
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xb8]
mov r8, rcx
lea rdx, str._s0x_llx_____Suspicious_call_to__s_
lea rcx, [rsp + 0x3f70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x3f70]
lea rcx, [rsp + 0x1070]
call fcn.140003570
nop
lea rdx, [rsp + 0x1070]
lea rcx, [rsp + 0x2e00]
call fcn.1400c1960
nop
lea rcx, [rsp + 0x1070]
call fcn.140003860
movzx eax, byte [rsp + 0x5a]
test eax, eax
jne 0x140087eea
lea rdx, [0x140145080]
lea rcx, [rsp + 0x1050]
call fcn.140003570
nop
lea rdx, [rsp + 0x1050]
lea rcx, [rsp + 0x2e50]
call fcn.1400c1960
nop
lea rcx, [rsp + 0x1050]
call fcn.140003860
mov byte [rsp + 0x5a], 1
mov byte [rsp + 0x58], 1
mov byte [rsp + 0x51], 1
movzx eax, byte [rsp + 0x58]
test eax, eax
jne 0x140087fac
cmp qword [rsp + 0xb8], 0
jne 0x140087f47
mov rax, qword [rsp + 0x98]
add rax, 0x44
mov rcx, qword [rsp + 0x2e18]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x3e70]
mov r8, rax
lea rdx, str._s__s0x_lx
lea rcx, [rsp + 0x3f70]
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x140087f73
mov rax, qword [rsp + 0x98]
add rax, 0x44
mov r9, qword [rsp + 0xb8]
mov r8, rax
lea rdx, str._s0x_lx
lea rcx, [rsp + 0x3f70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x3f70]
lea rcx, [rsp + 0x1030]
call fcn.140003570
nop
lea rdx, [rsp + 0x1030]
lea rcx, [rsp + 0x2e00]
call fcn.1400c1960
nop
lea rcx, [rsp + 0x1030]
call fcn.140003860
jmp 0x14008848c
lea rdx, [0x1401450c8]
mov rcx, qword [rsp + 0x5188]
call fcn.14000fe70
movzx eax, al
test eax, eax
je 0x14008848a
mov qword [rsp + 0x3110], 0
lea rax, [rsp + 0x3118]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
mov r8d, 0x2cc
xor edx, edx
lea rcx, [rsp + 0x3220]
call fcn.1401044f0
mov dword [rsp + 0x3220], 0x1003f
mov r8d, 1
xor edx, edx
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rax]
call qword [sym.imp.imagehlp.dll_SymInitialize]
mov rax, qword [0x1401d6fb8]
mov qword [rsp + 0x610], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x2cc
lea r8, [rsp + 0x3220]
mov edx, 0x1d
mov rcx, qword [rsp + 0x2720]
call qword [rsp + 0x610]
mov eax, dword [rsp + 0x32d8]
mov qword [rsp + 0x3110], rax
mov eax, dword [rsp + 0x32e4]
mov qword [rsp + 0x3140], rax
mov eax, dword [rsp + 0x32d4]
mov qword [rsp + 0x3130], rax
mov dword [rsp + 0x311c], 3
mov dword [rsp + 0x314c], 3
mov dword [rsp + 0x313c], 3
mov byte [rsp + 0x5c], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x3220]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3110]
mov r8, qword [rsp + 0x2720]
mov rax, qword [rsp + 0x5168]
mov rdx, qword [rax]
mov ecx, 0x14c
call qword [sym.imp.imagehlp.dll_StackWalk64]
test eax, eax
je 0x140088479
mov edx, 8
lea rcx, [rsp + 0x2df8]
call fcn.1400079b0
lea rdx, [rsp + 0x2df8]
lea rcx, [0x1401d7050]
call fcn.1400b5ef0
jmp 0x140088155
xor r8d, r8d
lea rdx, [rsp + 0xad8]
lea rcx, [rsp + 0x2df8]
call fcn.1400421d0
lea rdx, [rsp + 0xae0]
lea rcx, [0x1401d7050]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x2df8]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x1400883c9
lea rcx, [rsp + 0x2df8]
call fcn.140042060
cmp qword [rax + 0x120], 0
jne 0x1400882db
lea rcx, [rsp + 0x2df8]
call fcn.140042060
mov qword [rsp + 0x618], rax
lea rcx, [rsp + 0x2df8]
call fcn.140042060
mov rcx, qword [rsp + 0x618]
mov rcx, qword [rcx]
add rcx, qword [rax + 0x118]
mov rax, rcx
cmp rax, qword [rsp + 0x3110]
jb 0x1400882d6
lea rcx, [rsp + 0x2df8]
call fcn.140042060
mov rcx, qword [rsp + 0x3110]
cmp qword [rax], rcx
ja 0x1400882d6
lea rcx, [rsp + 0x2df8]
call fcn.140042060
mov ecx, 0x20
imul rcx, rcx, 4
lea rax, [rax + rcx + 0x2d8]
mov rcx, rax
call fcn.140004b60
mov r9, qword [rsp + 0x3110]
mov r8, rax
lea rdx, str._S__0x_lx____Unknown_module_
lea rcx, [rsp + 0x3f70]
call qword [sym.imp.USER32.dll_wsprintfA]
mov byte [rsp + 0x51], 1
lea rdx, [rsp + 0x3f70]
lea rcx, [rsp + 0x1010]
call fcn.140003570
nop
lea rdx, [rsp + 0x1010]
lea rcx, [rsp + 0x2e00]
call fcn.1400c1960
nop
lea rcx, [rsp + 0x1010]
call fcn.140003860
movzx eax, byte [rsp + 0x52]
test eax, eax
jne 0x1400882cc
lea rdx, [0x140145100]
lea rcx, [rsp + 0xff0]
call fcn.140003570
nop
lea rdx, [rsp + 0xff0]
lea rcx, [rsp + 0x2e50]
call fcn.1400c1960
nop
lea rcx, [rsp + 0xff0]
call fcn.140003860
mov byte [rsp + 0x52], 1
mov byte [rsp + 0x5c], 1
jmp 0x1400883c9
jmp 0x1400883c4
lea rcx, [rsp + 0x2df8]
call fcn.140042060
mov qword [rsp + 0x620], rax
lea rcx, [rsp + 0x2df8]
call fcn.140042060
mov rcx, qword [rsp + 0x620]
mov rcx, qword [rcx]
add rcx, qword [rax + 0x120]
mov rax, rcx
cmp rax, qword [rsp + 0x3110]
jb 0x1400883c4
lea rcx, [rsp + 0x2df8]
call fcn.140042060
mov rcx, qword [rsp + 0x3110]
cmp qword [rax], rcx
ja 0x1400883c4
lea rcx, [rsp + 0x2df8]
call fcn.140042060
mov ecx, 0x20
imul rcx, rcx, 3
lea rax, [rax + rcx + 0x2d8]
mov rcx, rax
call fcn.140004b60
mov r9, qword [rsp + 0x3110]
mov r8, rax
lea rdx, str._S__0x_lx___No_unwind_info_
lea rcx, [rsp + 0x3f70]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x3f70]
lea rcx, [rsp + 0xfd0]
call fcn.140003570
nop
lea rdx, [rsp + 0xfd0]
lea rcx, [rsp + 0x2e00]
call fcn.1400c1960
nop
lea rcx, [rsp + 0xfd0]
call fcn.140003860
mov byte [rsp + 0x5c], 1
jmp 0x1400883c9
jmp 0x14008813d
movzx eax, byte [rsp + 0x5c]
test eax, eax
jne 0x140088477
mov r8, qword [rsp + 0x3110]
lea rdx, str.0x_lx___Unknown_module_
lea rcx, [rsp + 0x3f70]
call qword [sym.imp.USER32.dll_wsprintfA]
mov byte [rsp + 0x51], 1
lea rdx, [rsp + 0x3f70]
lea rcx, [rsp + 0xfb0]
call fcn.140003570
nop
lea rdx, [rsp + 0xfb0]
lea rcx, [rsp + 0x2e00]
call fcn.1400c1960
nop
lea rcx, [rsp + 0xfb0]
call fcn.140003860
movzx eax, byte [rsp + 0x52]
test eax, eax
jne 0x140088477
lea rdx, [0x140145168]
lea rcx, [rsp + 0xf90]
call fcn.140003570
nop
lea rdx, [rsp + 0xf90]
lea rcx, [rsp + 0x2e50]
call fcn.1400c1960
nop
lea rcx, [rsp + 0xf90]
call fcn.140003860
mov byte [rsp + 0x52], 1
jmp 0x14008847b
jmp 0x140088486
xor eax, eax
cmp eax, 1
jne 0x1400880b1
jmp 0x140088497
jmp 0x140088497
xor eax, eax
cmp eax, 1
jne 0x14008773b
movzx eax, byte [rsp + 0x51]
test eax, eax
je 0x140088a27
lea rdx, [0x14014518c]
lea rcx, [rsp + 0xed0]
call fcn.140003570
nop
lea rdx, [rsp + 0xed0]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x1400884e1
mov dword [rsp + 0x10c], 1
jmp 0x1400884ec
mov dword [rsp + 0x10c], 0
movzx eax, byte [rsp + 0x10c]
mov byte [rsp + 0x79], al
lea rcx, [rsp + 0xed0]
call fcn.140003860
movzx eax, byte [rsp + 0x79]
test eax, eax
je 0x140088684
mov ecx, ntohs
call fcn.14007a320
mov edx, dword [rsp + 0x54]
lea rcx, str._n_tThread__06d_has_abnormal_calls:
call fcn.14000ad70
lea rax, [rsp + 0x2e50]
mov qword [rsp + 0x300], rax
mov rcx, qword [rsp + 0x300]
call fcn.140008ce0
mov qword [rsp + 0x160], rax
mov rcx, qword [rsp + 0x300]
call fcn.14001c8b0
mov qword [rsp + 0x628], rax
jmp 0x14008857c
mov rax, qword [rsp + 0x160]
add rax, 0x20
mov qword [rsp + 0x160], rax
mov rax, qword [rsp + 0x628]
cmp qword [rsp + 0x160], rax
je 0x1400885bc
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x630], rax
mov rcx, qword [rsp + 0x630]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x1401451b4]
call fcn.14000ad70
jmp 0x140088568
movzx eax, word [0x1401d2a18]
mov word [rsp + 0xe8], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x638], rax
movzx edx, word [rsp + 0xe8]
mov rcx, qword [rsp + 0x638]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, [rsp + 0x2e00]
mov qword [rsp + 0x308], rax
mov rcx, qword [rsp + 0x308]
call fcn.140008ce0
mov qword [rsp + 0x168], rax
mov rcx, qword [rsp + 0x308]
call fcn.14001c8b0
mov qword [rsp + 0x640], rax
jmp 0x140088644
mov rax, qword [rsp + 0x168]
add rax, 0x20
mov qword [rsp + 0x168], rax
mov rax, qword [rsp + 0x640]
cmp qword [rsp + 0x168], rax
je 0x140088684
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x648], rax
mov rcx, qword [rsp + 0x648]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x1401451b8]
call fcn.14000ad70
jmp 0x140088630
lea rdx, reloc.WS2_32.dll_WSAStartup
lea rcx, [rsp + 0xeb0]
call fcn.140003570
nop
lea rdx, [rsp + 0xeb0]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x7a], al
lea rcx, [rsp + 0xeb0]
call fcn.140003860
movzx eax, byte [rsp + 0x7a]
test eax, eax
je 0x140088a1d
mov dword [0x1401d19fc], 0
mov r8d, 0x4000
xor edx, edx
lea rcx, [0x1401d2a20]
call fcn.1401044f0
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp + 0x54]
mov dword [rsp + 0x20], edx
lea r9, str._font_color_ff6965___
lea r8, str._n_tr__td_colspan_2___semsp_emsp_Thread__06d:
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x1d0], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x1d4], eax
mov eax, dword [rsp + 0x1d0]
mov ecx, dword [rsp + 0x1d4]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rax, [rsp + 0x2e50]
mov qword [rsp + 0x350], rax
mov rcx, qword [rsp + 0x350]
call fcn.140008ce0
mov qword [rsp + 0x170], rax
mov rcx, qword [rsp + 0x350]
call fcn.14001c8b0
mov qword [rsp + 0x650], rax
jmp 0x1400887a2
mov rax, qword [rsp + 0x170]
add rax, 0x20
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x650]
cmp qword [rsp + 0x170], rax
je 0x140088862
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x658], rax
mov rcx, qword [rsp + 0x658]
call fcn.1400b3ed0
mov qword [rsp + 0x660], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x668], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x670], rax
mov r9, qword [rsp + 0x660]
lea r8, [0x1401451f8]
mov rdx, qword [rsp + 0x668]
mov rcx, qword [rsp + 0x670]
call fcn.1400c8230
mov dword [rsp + 0x1d8], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x1dc], eax
mov eax, dword [rsp + 0x1d8]
mov ecx, dword [rsp + 0x1dc]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x14008878e
lea rax, [rsp + 0x2e00]
mov qword [rsp + 0x320], rax
mov rcx, qword [rsp + 0x320]
call fcn.140008ce0
mov qword [rsp + 0x178], rax
mov rcx, qword [rsp + 0x320]
call fcn.14001c8b0
mov qword [rsp + 0x678], rax
jmp 0x1400888b2
mov rax, qword [rsp + 0x178]
add rax, 0x20
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0x678]
cmp qword [rsp + 0x178], rax
je 0x140088984
mov rdx, qword [rsp + 0x178]
lea rcx, [rsp + 0x30a8]
call fcn.1400322d0
lea rcx, [rsp + 0x30a8]
call fcn.1400b3ed0
mov qword [rsp + 0x680], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x688], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x690], rax
mov r9, qword [rsp + 0x680]
lea r8, [0x140145200]
mov rdx, qword [rsp + 0x688]
mov rcx, qword [rsp + 0x690]
call fcn.1400c8230
mov dword [rsp + 0x1e0], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x1e4], eax
mov eax, dword [rsp + 0x1e0]
mov ecx, dword [rsp + 0x1e4]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x30a8]
call fcn.140003860
jmp 0x14008889e
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea r9, str.__font_
lea r8, str._n_s__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x1e8], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x1ec], eax
mov eax, dword [rsp + 0x1e8]
mov ecx, dword [rsp + 0x1ec]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [0x1401d2a20]
lea rcx, [rsp + 0xe90]
call fcn.140003570
nop
lea rdx, [rsp + 0xe90]
lea rcx, [rsp + 0x2e30]
call fcn.1400c1960
nop
lea rcx, [rsp + 0xe90]
call fcn.140003860
mov byte [rsp + 0x50], 1
jmp 0x140088e06
lea rdx, [0x140145230]
lea rcx, [rsp + 0xe70]
call fcn.140003570
nop
lea rdx, [rsp + 0xe70]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x7b], al
lea rcx, [rsp + 0xe70]
call fcn.140003860
movzx eax, byte [rsp + 0x7b]
test eax, eax
je 0x140088e06
lea rdx, [0x140145234]
lea rcx, [rsp + 0xe50]
call fcn.140003570
nop
lea rdx, [rsp + 0xe50]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x140088aab
mov dword [rsp + 0x110], 1
jmp 0x140088ab6
mov dword [rsp + 0x110], 0
movzx eax, byte [rsp + 0x110]
mov byte [rsp + 0x7c], al
lea rcx, [rsp + 0xe50]
call fcn.140003860
movzx eax, byte [rsp + 0x7c]
test eax, eax
je 0x140088b8e
mov edx, dword [rsp + 0x54]
lea rcx, str._n_tStack_of_thread__06d:
call fcn.14000ad70
lea rax, [rsp + 0x2e00]
mov qword [rsp + 0x328], rax
mov rcx, qword [rsp + 0x328]
call fcn.140008ce0
mov qword [rsp + 0x180], rax
mov rcx, qword [rsp + 0x328]
call fcn.14001c8b0
mov qword [rsp + 0x698], rax
jmp 0x140088b3c
mov rax, qword [rsp + 0x180]
add rax, 0x20
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x698]
cmp qword [rsp + 0x180], rax
je 0x140088b8e
mov rdx, qword [rsp + 0x180]
lea rcx, [rsp + 0x30c8]
call fcn.1400322d0
lea rcx, [rsp + 0x30c8]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, str._n_t_t_s
call fcn.14000ad70
lea rcx, [rsp + 0x30c8]
call fcn.140003860
jmp 0x140088b28
lea rdx, reloc.WS2_32.dll_WSAStartup
lea rcx, [rsp + 0xe30]
call fcn.140003570
nop
lea rdx, [rsp + 0xe30]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x7d], al
lea rcx, [rsp + 0xe30]
call fcn.140003860
movzx eax, byte [rsp + 0x7d]
test eax, eax
je 0x140088e06
mov dword [0x1401d19fc], 0
mov r8d, 0x4000
xor edx, edx
lea rcx, [0x1401d2a20]
call fcn.1401044f0
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
mov r9d, dword [rsp + 0x54]
lea r8, str._n_tr__td_colspan_2__emsp_emsp_Stack_of_thread__06d:
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x1f0], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x1f4], eax
mov eax, dword [rsp + 0x1f0]
mov ecx, dword [rsp + 0x1f4]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rax, [rsp + 0x2e00]
mov qword [rsp + 0x338], rax
mov rcx, qword [rsp + 0x338]
call fcn.140008ce0
mov qword [rsp + 0x188], rax
mov rcx, qword [rsp + 0x338]
call fcn.14001c8b0
mov qword [rsp + 0x6a0], rax
jmp 0x140088ca2
mov rax, qword [rsp + 0x188]
add rax, 0x20
mov qword [rsp + 0x188], rax
mov rax, qword [rsp + 0x6a0]
cmp qword [rsp + 0x188], rax
je 0x140088d74
mov rdx, qword [rsp + 0x188]
lea rcx, [rsp + 0x30e8]
call fcn.1400322d0
lea rcx, [rsp + 0x30e8]
call fcn.1400b3ed0
mov qword [rsp + 0x6a8], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x6b0], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x6b8], rax
mov r9, qword [rsp + 0x6a8]
lea r8, str._n_br_emsp_emsp_emsp_emsp__s
mov rdx, qword [rsp + 0x6b0]
mov rcx, qword [rsp + 0x6b8]
call fcn.1400c8230
mov dword [rsp + 0x1f8], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x1fc], eax
mov eax, dword [rsp + 0x1f8]
mov ecx, dword [rsp + 0x1fc]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x30e8]
call fcn.140003860
jmp 0x140088c8e
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea r8, str._n__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x200], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x204], eax
mov eax, dword [rsp + 0x200]
mov ecx, dword [rsp + 0x204]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [0x1401d2a20]
lea rcx, [rsp + 0xd10]
call fcn.140003570
nop
lea rdx, [rsp + 0xd10]
lea rcx, [rsp + 0x2e30]
call fcn.1400c1960
nop
lea rcx, [rsp + 0xd10]
call fcn.140003860
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rax]
call qword [sym.imp.imagehlp.dll_SymCleanup]
nop
lea rcx, [rsp + 0x2e50]
call fcn.14003d0d0
nop
lea rcx, [rsp + 0x2e00]
call fcn.14003d0d0
cmp dword [rsp + 0x27d8], 6
jne 0x1400894e0
movzx eax, byte [rsp + 0x51]
test eax, eax
jne 0x1400894e0
mov dword [rsp + 0x384], 0
mov qword [rsp + 0x2e48], 0
mov qword [rsp + 0x2fb0], 0
mov qword [rsp + 0x348], 0
lea rax, [rsp + 0x2920]
mov rdi, rax
xor eax, eax
mov ecx, 0x4d0
rep stosb byte [rdi], al
mov dword [rsp + 0x2950], 0x10000b
movzx eax, byte [rsp + 0x5f]
test eax, eax
je 0x1400894e0
lea rdx, [rsp + 0x2920]
mov rcx, qword [rsp + 0x2720]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1400894e0
lea rax, [rsp + 0x27e0]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov rax, qword [0x1401d6f80]
mov qword [rsp + 0x6c0], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x30
lea r9, [rsp + 0x27e0]
xor r8d, r8d
mov rdx, qword [rsp + 0x29b8]
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rax]
call qword [rsp + 0x6c0]
test eax, eax
jne 0x1400894e0
mov rax, qword [rsp + 0x27e0]
mov rcx, qword [rsp + 0x29b8]
sub rcx, rax
mov rax, rcx
xor edx, edx
mov ecx, 8
div rcx
mov dword [rsp + 0xe0], eax
cmp dword [rsp + 0xe0], 0x2000
jle 0x140088f68
mov dword [rsp + 0xe0], 0x2000
mov dword [rsp + 0xb0], 0
jmp 0x140088f85
mov eax, dword [rsp + 0xb0]
inc eax
mov dword [rsp + 0xb0], eax
mov eax, dword [rsp + 0xe0]
cmp dword [rsp + 0xb0], eax
jge 0x1400894e0
mov eax, dword [rsp + 0xb0]
shl eax, 3
cdqe
mov rcx, qword [rsp + 0x29b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x348], rax
lea rax, [rsp + 0x2fb0]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rsp + 0x2e48]
mov rdx, qword [rsp + 0x348]
mov rax, qword [rsp + 0x5168]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400894d9
mov byte [rsp + 0x5d], 0
lea rdx, [0x1401452c4]
lea rcx, [rsp + 0xe10]
call fcn.140003570
nop
lea rdx, [rsp + 0xe10]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x7e], al
lea rcx, [rsp + 0xe10]
call fcn.140003860
movzx eax, byte [rsp + 0x7e]
test eax, eax
je 0x14008905d
mov dword [0x1401d19fc], 0
mov r8d, 0x4000
xor edx, edx
lea rcx, [0x1401d2a20]
call fcn.1401044f0
cmp qword [rsp + 0x140], 0
je 0x14008923e
mov rax, qword [rsp + 0x140]
cmp qword [rsp + 0x2e48], rax
jb 0x14008923e
mov rax, qword [rsp + 0x140]
add rax, 0x78
cmp rax, qword [rsp + 0x2e48]
jbe 0x14008923e
lea rdx, [0x1401452c8]
lea rcx, [rsp + 0xdf0]
call fcn.140003570
nop
lea rdx, [rsp + 0xdf0]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x1400890d9
mov dword [rsp + 0x114], 1
jmp 0x1400890e4
mov dword [rsp + 0x114], 0
movzx eax, byte [rsp + 0x114]
mov byte [rsp + 0x7f], al
lea rcx, [rsp + 0xdf0]
call fcn.140003860
movzx eax, byte [rsp + 0x7f]
test eax, eax
je 0x14008916d
mov ecx, ntohs
call fcn.14007a320
mov edx, dword [rsp + 0x54]
lea rcx, str._n_tThread__06d:__Thread_Possible_Gargoyle_Foliage_technique_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0xea], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x6c8], rax
movzx edx, word [rsp + 0xea]
mov rcx, qword [rsp + 0x6c8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, dword [rsp + 0x54]
lea rcx, str._n_t_tThread__d_state_Wait:UserRequest_seems_to_be_triggered_by_KiUserApcDispatcher_n
call fcn.14000ad70
mov byte [rsp + 0x50], 1
lea rdx, reloc.WS2_32.dll_WSAStartup
lea rcx, [rsp + 0xdd0]
call fcn.140003570
nop
lea rdx, [rsp + 0xdd0]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x80], al
lea rcx, [rsp + 0xdd0]
call fcn.140003860
movzx eax, byte [rsp + 0x80]
test eax, eax
je 0x14008923e
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__font_
mov qword [rsp + 0x28], rdx
mov edx, dword [rsp + 0x54]
mov dword [rsp + 0x20], edx
lea r9, str._font_color_ff6965___
lea r8, str._n_tr__td_colspan_2___semsp_emsp_Thread__06d:__Thread_Possible_Gargoyle_Foliage_technique__br_emsp_emsp_State_Wait:UserRequest_seems_to_be_triggered_by_KiUserApcDispatcher._s__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x208], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x20c], eax
mov eax, dword [rsp + 0x208]
mov ecx, dword [rsp + 0x20c]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x50], 1
mov byte [rsp + 0x5b], 1
mov byte [rsp + 0x5d], 1
cmp qword [rsp + 0x190], 0
je 0x14008940b
mov rax, qword [rsp + 0x190]
cmp qword [rsp + 0x2e48], rax
jne 0x14008940b
lea rdx, [0x140145430]
lea rcx, [rsp + 0xdb0]
call fcn.140003570
nop
lea rdx, [rsp + 0xdb0]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x1400892a0
mov dword [rsp + 0x118], 1
jmp 0x1400892ab
mov dword [rsp + 0x118], 0
movzx eax, byte [rsp + 0x118]
mov byte [rsp + 0x81], al
lea rcx, [rsp + 0xdb0]
call fcn.140003860
movzx eax, byte [rsp + 0x81]
test eax, eax
je 0x14008933a
mov ecx, ntohs
call fcn.14007a320
mov edx, dword [rsp + 0x54]
lea rcx, str._n_tThread__06d:__Thread_Possible_Ekko_technique_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0xc0], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x6d0], rax
movzx edx, word [rsp + 0xc0]
mov rcx, qword [rsp + 0x6d0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, dword [rsp + 0x54]
lea rcx, str._n_t_tThread__d_state_Wait:UserRequest_seems_to_be_triggered_by_Callback_of_waitable_Timer_n
call fcn.14000ad70
mov byte [rsp + 0x50], 1
lea rdx, [0x1401454cc]
lea rcx, [rsp + 0xd70]
call fcn.140003570
nop
lea rdx, [rsp + 0xd70]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x82], al
lea rcx, [rsp + 0xd70]
call fcn.140003860
movzx eax, byte [rsp + 0x82]
test eax, eax
je 0x14008940b
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__font_
mov qword [rsp + 0x28], rdx
mov edx, dword [rsp + 0x54]
mov dword [rsp + 0x20], edx
lea r9, str._font_color_ff6965___
lea r8, str._n_tr__td_colspan_2___semsp_emsp_Thread__06d:__Thread_Possible_Ekko_technique__br_emsp_emsp_State_Wait:UserRequest_seems_to_be_triggered_by_Callback_of_waitable_Timer._s__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x210], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x214], eax
mov eax, dword [rsp + 0x210]
mov ecx, dword [rsp + 0x214]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x50], 1
mov byte [rsp + 0x5a], 1
mov byte [rsp + 0x5d], 1
movzx eax, byte [rsp + 0x5d]
test eax, eax
je 0x14008945c
lea rdx, reloc.WS2_32.dll_WSAStartup
lea rcx, [rsp + 0xd50]
call fcn.140003570
nop
mov eax, dword [rsp + 0x68]
or eax, 2
mov dword [rsp + 0x68], eax
lea rdx, [rsp + 0xd50]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
je 0x14008945c
mov dword [rsp + 0x11c], 1
jmp 0x140089467
mov dword [rsp + 0x11c], 0
movzx eax, byte [rsp + 0x11c]
mov byte [rsp + 0x83], al
mov eax, dword [rsp + 0x68]
and eax, 2
test eax, eax
je 0x140089493
and dword [rsp + 0x68], 0xfffffffd
lea rcx, [rsp + 0xd50]
call fcn.140003860
movzx eax, byte [rsp + 0x83]
test eax, eax
je 0x1400894d7
lea rdx, [0x1401d2a20]
lea rcx, [rsp + 0xcf0]
call fcn.140003570
nop
lea rdx, [rsp + 0xcf0]
lea rcx, [rsp + 0x2e30]
call fcn.1400c1960
nop
lea rcx, [rsp + 0xcf0]
call fcn.140003860
jmp 0x1400894db
jmp 0x1400894e0
jmp 0x140088f75
mov eax, dword [rsp + 0x5170]
mov dword [rsp + 0x218], eax
lea rdx, [rsp + 0x218]
lea rcx, [0x1401d8408]
call fcn.1400417c0
mov qword [rsp + 0x6d8], rax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x21c], eax
lea rdx, [rsp + 0x21c]
mov rcx, qword [rsp + 0x6d8]
call fcn.140041780
mov rdx, rax
lea rcx, [rsp + 0x3008]
call fcn.140005f30
nop
mov eax, dword [rsp + 0x5170]
mov dword [rsp + 0x220], eax
lea rdx, [rsp + 0x220]
lea rcx, [0x1401d8408]
call fcn.1400417c0
mov qword [rsp + 0x6e0], rax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x224], eax
lea rdx, [rsp + 0x224]
mov rcx, qword [rsp + 0x6e0]
call fcn.140041780
add rax, 0x20
mov rdx, rax
lea rcx, [rsp + 0x2f30]
call fcn.140005f30
nop
mov byte [rsp + 0x53], 0
mov byte [rsp + 0x59], 0
mov byte [rsp + 0x60], 0
lea rcx, [rsp + 0x3008]
call fcn.1400bb3f0
movzx eax, al
test eax, eax
jne 0x1400896fa
lea rdx, [rsp + 0x3008]
lea rcx, [rsp + 0x3048]
call fcn.140005f30
nop
lea rdx, [rsp + 0xae8]
lea rcx, [rsp + 0x3048]
call fcn.1400b6020
mov rax, qword [rax]
mov qword [rsp + 0x6e8], rax
mov rax, qword [rsp + 0x6e8]
mov qword [rsp + 0x700], rax
lea rdx, [rsp + 0xb30]
lea rcx, [rsp + 0x3048]
call fcn.1400bb630
mov rax, qword [rax]
mov qword [rsp + 0x6f0], rax
mov rax, qword [rsp + 0x6f0]
mov qword [rsp + 0x708], rax
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x3048]
call fcn.1400b6020
mov rax, qword [rax]
mov qword [rsp + 0x6f8], rax
mov rax, qword [rsp + 0x6f8]
mov qword [rsp + 0x710], rax
lea rax, [fcn.14010ddbc]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x700]
mov r8, qword [rsp + 0x708]
mov rdx, qword [rsp + 0x710]
lea rcx, [rsp + 0xb08]
call fcn.14002ec30
lea rdx, [0x140145590]
lea rcx, [rsp + 0x3048]
call fcn.14000fe70
movzx eax, al
test eax, eax
je 0x1400896b8
mov byte [rsp + 0x60], 1
mov rcx, qword [rsp + 0x5178]
call fcn.1400bb3f0
movzx eax, al
test eax, eax
jne 0x1400896ed
mov rdx, qword [rsp + 0x5178]
lea rcx, [rsp + 0x3048]
call fcn.140010090
movzx eax, al
test eax, eax
je 0x1400896ed
mov byte [rsp + 0x53], 1
lea rcx, [rsp + 0x3048]
call fcn.140003890
lea rcx, [rsp + 0x2f30]
call fcn.1400bb3f0
movzx eax, al
test eax, eax
jne 0x140089854
lea rdx, [rsp + 0x2f30]
lea rcx, [rsp + 0x3068]
call fcn.140005f30
nop
lea rdx, [rsp + 0xb10]
lea rcx, [rsp + 0x3068]
call fcn.1400b6020
mov rax, qword [rax]
mov qword [rsp + 0x718], rax
mov rax, qword [rsp + 0x718]
mov qword [rsp + 0x730], rax
lea rdx, [rsp + 0xb18]
lea rcx, [rsp + 0x3068]
call fcn.1400bb630
mov rax, qword [rax]
mov qword [rsp + 0x720], rax
mov rax, qword [rsp + 0x720]
mov qword [rsp + 0x738], rax
lea rdx, [rsp + 0xb20]
lea rcx, [rsp + 0x3068]
call fcn.1400b6020
mov rax, qword [rax]
mov qword [rsp + 0x728], rax
mov rax, qword [rsp + 0x728]
mov qword [rsp + 0x740], rax
lea rax, [fcn.14010ddbc]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x730]
mov r8, qword [rsp + 0x738]
mov rdx, qword [rsp + 0x740]
lea rcx, [rsp + 0xb28]
call fcn.14002ec30
movzx eax, byte [rsp + 0x60]
test eax, eax
je 0x140089812
lea rdx, [0x1401455a0]
lea rcx, [rsp + 0x3068]
call fcn.1400100d0
movzx eax, al
test eax, eax
je 0x140089812
mov byte [rsp + 0x59], 1
mov rcx, qword [rsp + 0x5180]
call fcn.1400bb3f0
movzx eax, al
test eax, eax
jne 0x140089847
mov rdx, qword [rsp + 0x5180]
lea rcx, [rsp + 0x3068]
call fcn.140010090
movzx eax, al
test eax, eax
je 0x140089847
mov byte [rsp + 0x53], 1
lea rcx, [rsp + 0x3068]
call fcn.140003890
movzx eax, byte [rsp + 0x53]
test eax, eax
jne 0x14008986a
movzx eax, byte [rsp + 0x59]
test eax, eax
je 0x140089c87
lea rdx, [0x1401455b0]
lea rcx, [rsp + 0xd30]
call fcn.140003570
nop
lea rdx, [rsp + 0xd30]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x1400898a7
mov dword [rsp + 0x120], 1
jmp 0x1400898b2
mov dword [rsp + 0x120], 0
movzx eax, byte [rsp + 0x120]
mov byte [rsp + 0x84], al
lea rcx, [rsp + 0xd30]
call fcn.140003860
movzx eax, byte [rsp + 0x84]
test eax, eax
je 0x140089a08
movzx eax, byte [rsp + 0x53]
test eax, eax
je 0x140089973
mov ecx, ntohs
call fcn.14007a320
lea rcx, [rsp + 0x2f30]
call fcn.140004b60
mov qword [rsp + 0x748], rax
lea rcx, [rsp + 0x3008]
call fcn.140004b60
mov qword [rsp + 0x750], rax
mov r8, qword [rsp + 0x748]
mov rdx, qword [rsp + 0x750]
lea rcx, str._n_t_tThread_Window_StationDesktop:__S_S__Thread_Different_Desktop_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0xc2], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x758], rax
movzx edx, word [rsp + 0xc2]
mov rcx, qword [rsp + 0x758]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movzx eax, byte [rsp + 0x59]
test eax, eax
je 0x140089a08
mov ecx, ntohs
call fcn.14007a320
lea rcx, [rsp + 0x2f30]
call fcn.140004b60
mov qword [rsp + 0x760], rax
lea rcx, [rsp + 0x3008]
call fcn.140004b60
mov qword [rsp + 0x768], rax
mov r8, qword [rsp + 0x760]
mov rdx, qword [rsp + 0x768]
lea rcx, str._n_t_tThread_Window_StationDesktop:__S_S__Thread_Unusual_Desktop_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0xc4], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x770], rax
movzx edx, word [rsp + 0xc4]
mov rcx, qword [rsp + 0x770]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, reloc.WS2_32.dll_WSAStartup
lea rcx, [rsp + 0xcd0]
call fcn.140003570
nop
lea rdx, [rsp + 0xcd0]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x85], al
lea rcx, [rsp + 0xcd0]
call fcn.140003860
movzx eax, byte [rsp + 0x85]
test eax, eax
je 0x140089c82
mov dword [0x1401d19fc], 0
mov r8d, 0x4000
xor edx, edx
lea rcx, [0x1401d2a20]
call fcn.1401044f0
movzx eax, byte [rsp + 0x53]
test eax, eax
je 0x140089b5c
lea rcx, [rsp + 0x2f30]
call fcn.140004b60
mov qword [rsp + 0x778], rax
lea rcx, [rsp + 0x3008]
call fcn.140004b60
mov qword [rsp + 0x780], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x788], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x790], rax
lea rax, str.__font_
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x778]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x780]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x20], eax
lea r9, str._font_color_ff6965___
lea r8, str._n_tr__td_colspan_2___semsp_emsp_Thread__06d:__Thread_Different_Desktop__br_emsp_emsp_Thread_Window_StationDesktop:__S_S_s__td___tr_
mov rdx, qword [rsp + 0x788]
mov rcx, qword [rsp + 0x790]
call fcn.1400c8230
mov dword [rsp + 0x228], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x22c], eax
mov eax, dword [rsp + 0x228]
mov ecx, dword [rsp + 0x22c]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x64], 1
movzx eax, byte [rsp + 0x59]
test eax, eax
je 0x140089c45
lea rcx, [rsp + 0x2f30]
call fcn.140004b60
mov qword [rsp + 0x798], rax
lea rcx, [rsp + 0x3008]
call fcn.140004b60
mov qword [rsp + 0x7a0], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x7a8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x7b0], rax
lea rax, str.__font_
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x798]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x7a0]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x20], eax
lea r9, str._font_color_ff6965___
lea r8, str._n_tr__td_colspan_2___semsp_emsp_Thread__06d:__Thread_Unusual_Desktop__br_emsp_emsp_Thread_Window_StationDesktop:__S_S_s__td___tr_
mov rdx, qword [rsp + 0x7a8]
mov rcx, qword [rsp + 0x7b0]
call fcn.1400c8230
mov dword [rsp + 0x230], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x234], eax
mov eax, dword [rsp + 0x230]
mov ecx, dword [rsp + 0x234]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x65], 1
mov byte [rsp + 0x50], 1
lea rdx, [0x1401d2a20]
lea rcx, [rsp + 0xcb0]
call fcn.140003570
nop
lea rdx, [rsp + 0xcb0]
lea rcx, [rsp + 0x2e30]
call fcn.1400c1960
nop
lea rcx, [rsp + 0xcb0]
call fcn.140003860
mov byte [rsp + 0x50], 1
cmp dword [rsp + 0x27d8], 5
jne 0x140089ca1
mov eax, dword [rsp + 0xe4]
inc eax
mov dword [rsp + 0xe4], eax
mov eax, dword [rsp + 0x124]
cmp dword [rsp + 0xe4], eax
jne 0x140089ecb
mov byte [rsp + 0x61], 1
lea rdx, [0x14014577c]
lea rcx, [rsp + 0xc90]
call fcn.140003570
nop
lea rdx, [rsp + 0xc90]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x140089cf7
mov dword [rsp + 0x128], 1
jmp 0x140089d02
mov dword [rsp + 0x128], 0
movzx eax, byte [rsp + 0x128]
mov byte [rsp + 0x86], al
lea rcx, [rsp + 0xc90]
call fcn.140003860
movzx eax, byte [rsp + 0x86]
test eax, eax
je 0x140089db6
mov edx, 4
lea rcx, [0x140145780]
call fcn.14004d7e0
mov ecx, ntohs
call fcn.14007a320
lea rcx, str._n_SUSPICIOUS_PROCESS_STATE:_SUSPENDED__Process_Suspended__
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0xc6], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x7b8], rax
movzx edx, word [rsp + 0xc6]
mov rcx, qword [rsp + 0x7b8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, 0xa
lea rcx, str._nALL_THREADS_STATE:
call fcn.14004d7e0
lea rcx, str.SUSPENDED
call fcn.14000ad70
lea rcx, [0x140145844]
call fcn.14000ad70
lea rdx, reloc.WS2_32.dll_WSAStartup
lea rcx, [rsp + 0xc70]
call fcn.140003570
nop
lea rdx, [rsp + 0xc70]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x87], al
lea rcx, [rsp + 0xc70]
call fcn.140003860
movzx eax, byte [rsp + 0x87]
test eax, eax
je 0x140089ec6
mov dword [0x1401d19fc], 0
mov r8d, 0x1000
xor edx, edx
lea rcx, [0x1401d1a00]
call fcn.1401044f0
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d1a00]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__font_
mov qword [rsp + 0x20], rdx
lea r9, str._font_color_ff6965___
lea r8, str._n_tr__td_colspan_2___s_SUSPICIOUS_PROCESS_STATE:_SUSPENDED__Process_Suspended___s__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x238], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x23c], eax
mov eax, dword [rsp + 0x238]
mov ecx, dword [rsp + 0x23c]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [0x1401d1a00]
lea rcx, [rsp + 0xc50]
call fcn.140003570
nop
lea rdx, [rsp + 0xc50]
lea rcx, [rsp + 0x2e30]
call fcn.1400c1960
nop
lea rcx, [rsp + 0xc50]
call fcn.140003860
mov byte [rsp + 0x50], 1
mov qword [rsp + 0xb38], 0
lea r9, [rsp + 0x2720]
xor r8d, r8d
mov edx, 8
mov rcx, qword [rsp + 0x2720]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x14008b0c8
lea rcx, [rsp + 0x3088]
call fcn.1400035d0
nop
mov byte [rsp + 0x63], 1
mov eax, dword [0x1401d19f4]
add eax, 0xa
mov dword [0x1401d19f4], eax
lea rax, [rsp + 0x2df0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x2720]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140089f59
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140089f59
jmp 0x14008a13e
mov edx, 0x18
lea rcx, [rsp + 0x2ec0]
call fcn.1400079b0
lea rcx, [rsp + 0xcf]
call fcn.140003030
mov qword [rsp + 0x7c0], rax
mov byte [rsp + 0x88], 0
mov eax, dword [rsp + 0x2df0]
mov qword [rsp + 0x7c8], rax
mov r9, qword [rsp + 0x7c0]
lea r8, [rsp + 0x88]
mov rdx, qword [rsp + 0x7c8]
lea rcx, [rsp + 0x2ec0]
call fcn.140034380
mov eax, dword [rsp + 0x2df0]
mov dword [rsp + 0x240], eax
xor edx, edx
lea rcx, [rsp + 0x2ec0]
call fcn.140041c50
mov qword [rsp + 0x7d0], rax
mov rax, qword [rsp + 0x2720]
mov qword [rsp + 0x7d8], rax
lea rax, [rsp + 0x2df0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x240]
mov r8, qword [rsp + 0x7d0]
mov edx, 1
mov rcx, qword [rsp + 0x7d8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14008a0ea
xor edx, edx
lea rcx, [rsp + 0x2ec0]
call fcn.140041c50
lea rdx, [rsp + 0x2780]
mov rcx, qword [rax]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
mov dword [rsp + 0x2e20], 0x100
mov dword [rsp + 0x2e24], 0x100
xor edx, edx
lea rcx, [rsp + 0x2ec0]
call fcn.140041c50
lea rcx, [rsp + 0x2fc0]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x2e24]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x4470]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x2e20]
lea r8, [rsp + 0x4370]
mov rdx, qword [rax]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
test eax, eax
jne 0x14008a0ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x534
jne 0x14008a0d6
lea rdx, [0x1401458b8]
lea rcx, [rsp + 0x4370]
call fcn.14010e840
jmp 0x14008a0ea
lea rdx, [0x1401458e8]
lea rcx, [rsp + 0x4370]
call fcn.14010e840
lea rcx, [rsp + 0x1288]
call fcn.140034230
mov qword [rsp + 0x7e0], rax
mov rax, qword [rsp + 0x7e0]
mov qword [rsp + 0x7e8], rax
lea rdx, [rsp + 0x2ec0]
mov rcx, qword [rsp + 0x7e8]
call fcn.1400c3850
lea rcx, [rsp + 0x1288]
call fcn.14003d030
lea rcx, [rsp + 0x2ec0]
call fcn.14003d030
lea rax, [rsp + 0x2df0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x11
mov rcx, qword [rsp + 0x2720]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14008a178
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14008a178
jmp 0x14008a2b2
mov edx, 0x18
lea rcx, [rsp + 0x2f98]
call fcn.1400079b0
lea rcx, [rsp + 0xd0]
call fcn.140003030
mov qword [rsp + 0x7f0], rax
mov byte [rsp + 0x89], 0
mov eax, dword [rsp + 0x2df0]
mov qword [rsp + 0x7f8], rax
mov r9, qword [rsp + 0x7f0]
lea r8, [rsp + 0x89]
mov rdx, qword [rsp + 0x7f8]
lea rcx, [rsp + 0x2f98]
call fcn.140034380
mov eax, dword [rsp + 0x2df0]
mov dword [rsp + 0x244], eax
xor edx, edx
lea rcx, [rsp + 0x2f98]
call fcn.140041c50
mov qword [rsp + 0x800], rax
mov rax, qword [rsp + 0x2720]
mov qword [rsp + 0x808], rax
lea rax, [rsp + 0x2df0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x244]
mov r8, qword [rsp + 0x800]
mov edx, 0x11
mov rcx, qword [rsp + 0x808]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14008a25e
xor edx, edx
lea rcx, [rsp + 0x2f98]
call fcn.140041c50
mov rax, qword [rax]
mov qword [rsp + 0x1a0], rax
lea rcx, [rsp + 0x12a0]
call fcn.140034230
mov qword [rsp + 0x810], rax
mov rax, qword [rsp + 0x810]
mov qword [rsp + 0x818], rax
lea rdx, [rsp + 0x2f98]
mov rcx, qword [rsp + 0x818]
call fcn.1400c3850
lea rcx, [rsp + 0x12a0]
call fcn.14003d030
lea rcx, [rsp + 0x2f98]
call fcn.14003d030
lea rax, [rsp + 0x2df0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
mov rcx, qword [rsp + 0x2720]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14008a2ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14008a2ec
jmp 0x14008a427
mov edx, 0x18
lea rcx, [rsp + 0x2f80]
call fcn.1400079b0
lea rcx, [rsp + 0xd1]
call fcn.140003030
mov qword [rsp + 0x820], rax
mov byte [rsp + 0x8a], 0
mov eax, dword [rsp + 0x2df0]
mov qword [rsp + 0x828], rax
mov r9, qword [rsp + 0x820]
lea r8, [rsp + 0x8a]
mov rdx, qword [rsp + 0x828]
lea rcx, [rsp + 0x2f80]
call fcn.140034380
mov eax, dword [rsp + 0x2df0]
mov dword [rsp + 0x248], eax
xor edx, edx
lea rcx, [rsp + 0x2f80]
call fcn.140041c50
mov qword [rsp + 0x830], rax
mov rax, qword [rsp + 0x2720]
mov qword [rsp + 0x838], rax
lea rax, [rsp + 0x2df0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x248]
mov r8, qword [rsp + 0x830]
mov edx, 0xa
mov rcx, qword [rsp + 0x838]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14008a3d3
xor edx, edx
lea rcx, [rsp + 0x2f80]
call fcn.140041c50
mov rax, qword [rax + 8]
mov qword [rsp + 0x198], rax
lea rcx, [rsp + 0x12b8]
call fcn.140034230
mov qword [rsp + 0x840], rax
mov rax, qword [rsp + 0x840]
mov qword [rsp + 0x848], rax
lea rdx, [rsp + 0x2f80]
mov rcx, qword [rsp + 0x848]
call fcn.1400c3850
lea rcx, [rsp + 0x12b8]
call fcn.14003d030
lea rcx, [rsp + 0x2f80]
call fcn.14003d030
lea rax, [rsp + 0x2df0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 8
mov rcx, qword [rsp + 0x2720]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14008a461
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14008a461
jmp 0x14008a5f1
mov edx, 0x18
lea rcx, [rsp + 0x2f68]
call fcn.1400079b0
lea rcx, [rsp + 0xd2]
call fcn.140003030
mov qword [rsp + 0x850], rax
mov byte [rsp + 0x93], 0
mov eax, dword [rsp + 0x2df0]
mov qword [rsp + 0x858], rax
mov r9, qword [rsp + 0x850]
lea r8, [rsp + 0x93]
mov rdx, qword [rsp + 0x858]
lea rcx, [rsp + 0x2f68]
call fcn.140034380
nop
mov eax, dword [rsp + 0x2df0]
mov dword [rsp + 0x24c], eax
xor edx, edx
lea rcx, [rsp + 0x2f68]
call fcn.140041c50
mov qword [rsp + 0x860], rax
mov rax, qword [rsp + 0x2720]
mov qword [rsp + 0x868], rax
lea rax, [rsp + 0x2df0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x24c]
mov r8, qword [rsp + 0x860]
mov edx, 8
mov rcx, qword [rsp + 0x868]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14008a59c
xor edx, edx
lea rcx, [rsp + 0x2f68]
call fcn.140041c50
mov eax, dword [rax]
mov dword [rsp + 0x12c], eax
cmp dword [rsp + 0x12c], 1
je 0x14008a55c
cmp dword [rsp + 0x12c], 2
je 0x14008a572
jmp 0x14008a588
lea rdx, [0x140145908]
lea rcx, [rsp + 0x3088]
call fcn.140003940
jmp 0x14008a59c
lea rdx, [0x140145918]
lea rcx, [rsp + 0x3088]
call fcn.140003940
jmp 0x14008a59c
lea rdx, [0x140145930]
lea rcx, [rsp + 0x3088]
call fcn.140003940
lea rcx, [rsp + 0x12d0]
call fcn.140034230
mov qword [rsp + 0x870], rax
mov rax, qword [rsp + 0x870]
mov qword [rsp + 0x878], rax
lea rdx, [rsp + 0x2f68]
mov rcx, qword [rsp + 0x878]
call fcn.1400c3850
lea rcx, [rsp + 0x12d0]
call fcn.14003d030
nop
lea rcx, [rsp + 0x2f68]
call fcn.14003d030
lea rax, [rsp + 0x2df0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x19
mov rcx, qword [rsp + 0x2720]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14008a62b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14008a62b
jmp 0x14008a8db
mov edx, 0x18
lea rcx, [rsp + 0x2f50]
call fcn.1400079b0
lea rcx, [rsp + 0xd3]
call fcn.140003030
mov qword [rsp + 0x880], rax
mov byte [rsp + 0x8c], 0
mov eax, dword [rsp + 0x2df0]
mov qword [rsp + 0x888], rax
mov r9, qword [rsp + 0x880]
lea r8, [rsp + 0x8c]
mov rdx, qword [rsp + 0x888]
lea rcx, [rsp + 0x2f50]
call fcn.140034380
mov eax, dword [rsp + 0x2df0]
mov dword [rsp + 0x250], eax
xor edx, edx
lea rcx, [rsp + 0x2f50]
call fcn.140041c50
mov qword [rsp + 0x890], rax
mov rax, qword [rsp + 0x2720]
mov qword [rsp + 0x898], rax
lea rax, [rsp + 0x2df0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x250]
mov r8, qword [rsp + 0x890]
mov edx, 0x19
mov rcx, qword [rsp + 0x898]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14008a887
xor edx, edx
lea rcx, [rsp + 0x2f50]
call fcn.140041c50
lea rdx, [rsp + 0x2728]
mov rcx, qword [rax]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
mov r8d, 0x63
mov rdx, qword [rsp + 0x2728]
lea rcx, [rsp + 0x3e00]
call fcn.140112e20
lea rdx, [0x140145940]
lea rcx, [rsp + 0x3e00]
call fcn.14010e910
test eax, eax
jne 0x14008a761
lea rax, [0x140145950]
mov qword [rsp + 0x2728], rax
jmp 0x14008a887
lea rdx, [0x140145988]
lea rcx, [rsp + 0x3e00]
call fcn.14010e910
test eax, eax
jne 0x14008a78d
lea rax, [0x140145998]
mov qword [rsp + 0x2728], rax
jmp 0x14008a887
lea rdx, [0x1401459c0]
lea rcx, [rsp + 0x3e00]
call fcn.14010e910
test eax, eax
jne 0x14008a7b9
lea rax, [0x1401459d0]
mov qword [rsp + 0x2728], rax
jmp 0x14008a887
lea rdx, [0x140145a00]
lea rcx, [rsp + 0x3e00]
call fcn.14010e910
test eax, eax
jne 0x14008a7e5
lea rax, [0x140145a10]
mov qword [rsp + 0x2728], rax
jmp 0x14008a887
lea rdx, [0x140145a48]
lea rcx, [rsp + 0x3e00]
call fcn.14010e910
test eax, eax
jne 0x14008a80e
lea rax, [0x140145a58]
mov qword [rsp + 0x2728], rax
jmp 0x14008a887
lea rdx, [0x140145a88]
lea rcx, [rsp + 0x3e00]
call fcn.14010e910
test eax, eax
jne 0x14008a837
lea rax, [0x140145a98]
mov qword [rsp + 0x2728], rax
jmp 0x14008a887
lea rdx, [0x140145ac8]
lea rcx, [rsp + 0x3e00]
call fcn.14010e910
test eax, eax
jne 0x14008a860
lea rax, [0x140145ae0]
mov qword [rsp + 0x2728], rax
jmp 0x14008a887
lea rdx, [0x140145b28]
lea rcx, [rsp + 0x3e00]
call fcn.14010e910
test eax, eax
jne 0x14008a887
lea rax, [0x140145b38]
mov qword [rsp + 0x2728], rax
lea rcx, [rsp + 0x12e8]
call fcn.140034230
mov qword [rsp + 0x8a0], rax
mov rax, qword [rsp + 0x8a0]
mov qword [rsp + 0x8a8], rax
lea rdx, [rsp + 0x2f50]
mov rcx, qword [rsp + 0x8a8]
call fcn.1400c3850
lea rcx, [rsp + 0x12e8]
call fcn.14003d030
lea rcx, [rsp + 0x2f50]
call fcn.14003d030
lea rdx, [0x140145b78]
lea rcx, [rsp + 0xc30]
call fcn.140003570
nop
lea rdx, [rsp + 0xc30]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x14008a918
mov dword [rsp + 0x134], 1
jmp 0x14008a923
mov dword [rsp + 0x134], 0
movzx eax, byte [rsp + 0x134]
mov byte [rsp + 0x8d], al
lea rcx, [rsp + 0xc30]
call fcn.140003860
movzx eax, byte [rsp + 0x8d]
test eax, eax
je 0x14008ab3a
mov ecx, ntohs
call fcn.14007a320
lea rcx, str._n__Thread_with_Token__
call fcn.1400c83f0
movzx eax, word [0x1401d2a18]
mov word [rsp + 0xc8], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x8b0], rax
movzx edx, word [rsp + 0xc8]
mov rcx, qword [rsp + 0x8b0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, 0xa
lea rcx, str._n_____THREAD_ID:
call fcn.14004d7e0
mov edx, dword [rsp + 0x54]
lea rcx, [0x140145bcc]
call fcn.1400c83f0
mov edx, 0xa
lea rcx, str._n_____State:
call fcn.14004d7e0
lea rcx, [rsp + 0x2f10]
call fcn.1400b3ed0
mov qword [rsp + 0x8b8], rax
lea rcx, [rsp + 0x2ef0]
call fcn.1400b3ed0
mov qword [rsp + 0x8c0], rax
mov r8, qword [rsp + 0x8b8]
mov rdx, qword [rsp + 0x8c0]
lea rcx, str._s:_s
call fcn.14000ad70
mov ecx, ntohs
call fcn.14007a320
mov edx, 0xa
lea rcx, str._n_____DomainUser:
call fcn.14004d7e0
lea r8, [rsp + 0x4370]
lea rdx, [rsp + 0x4470]
lea rcx, [0x140145c04]
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0xca], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x8c8], rax
movzx edx, word [rsp + 0xca]
mov rcx, qword [rsp + 0x8c8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, 0xa
lea rcx, str._n_____Logon_Session:
call fcn.14004d7e0
mov r8d, dword [rsp + 0x198]
mov edx, dword [rsp + 0x19c]
lea rcx, [0x140145c28]
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._n_____Originating_Logon_Session:
call fcn.14004d7e0
mov r8d, dword [rsp + 0x1a0]
mov edx, dword [rsp + 0x1a4]
lea rcx, [0x140145c60]
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._n_____Token_Type:
call fcn.14004d7e0
lea rcx, [rsp + 0x3088]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x140145c84]
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._n_____Integrity:
call fcn.14004d7e0
mov rdx, qword [rsp + 0x2728]
lea rcx, [0x140145c9c]
call fcn.1400c83f0
lea rcx, [0x140145ca4]
call fcn.14000ad70
lea rdx, reloc.WS2_32.dll_WSAStartup
lea rcx, [rsp + 0xc10]
call fcn.140003570
nop
lea rdx, [rsp + 0xc10]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x8e], al
lea rcx, [rsp + 0xc10]
call fcn.140003860
movzx eax, byte [rsp + 0x8e]
test eax, eax
je 0x14008b07d
mov ecx, 0xfa
call fcn.140102250
mov qword [rsp + 0x8d0], rax
mov rax, qword [rsp + 0x8d0]
mov qword [rsp + 0x148], rax
mov r8d, 0xf9
mov rdx, qword [rsp + 0x2728]
mov rcx, qword [rsp + 0x148]
call fcn.140112e20
mov dword [0x1401d19fc], 0
mov r8d, 0x4000
xor edx, edx
lea rcx, [0x1401d2a20]
call fcn.1401044f0
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__font_
mov qword [rsp + 0x20], rdx
lea r9, str._font_color_ff6965___
lea r8, str._n_tr__td__p_style_border_top:_2px_solid_Darknormal____semsp_emsp__Thread_with_Token__s_br__table_class_process_table__
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x254], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x258], eax
mov eax, dword [rsp + 0x254]
mov ecx, dword [rsp + 0x258]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp + 0x54]
mov dword [rsp + 0x20], edx
lea r9, str._tr__td_class___normal__
lea r8, str._n_semsp_emsp_THREAD_ID:__td__td__d__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x25c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x260], eax
mov eax, dword [rsp + 0x25c]
mov ecx, dword [rsp + 0x260]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x2f10]
call fcn.1400b3ed0
mov qword [rsp + 0x8d8], rax
lea rcx, [rsp + 0x2ef0]
call fcn.1400b3ed0
mov qword [rsp + 0x8e0], rax
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x8e8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8f0], rax
mov rax, qword [rsp + 0x8d8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x8e0]
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_semsp_emsp_Thread_State:__td__td__s:_s__td___tr_
mov rdx, qword [rsp + 0x8e8]
mov rcx, qword [rsp + 0x8f0]
call fcn.1400c8230
mov dword [rsp + 0x264], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x268], eax
mov eax, dword [rsp + 0x264]
mov ecx, dword [rsp + 0x268]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, [rsp + 0x4370]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x4470]
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_semsp_emsp_DomainUser:__td__td__s_s__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x26c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x270], eax
mov eax, dword [rsp + 0x26c]
mov ecx, dword [rsp + 0x270]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp + 0x198]
mov dword [rsp + 0x28], edx
mov edx, dword [rsp + 0x19c]
mov dword [rsp + 0x20], edx
lea r9, str._tr__td_class___normal__
lea r8, str._n_semsp_emsp_Logon_Session:__td__td_0x_x:0x_x__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x274], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x278], eax
mov eax, dword [rsp + 0x274]
mov ecx, dword [rsp + 0x278]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp + 0x1a0]
mov dword [rsp + 0x28], edx
mov edx, dword [rsp + 0x1a4]
mov dword [rsp + 0x20], edx
lea r9, str._tr__td_class___normal__
lea r8, str._n_semsp_emsp_Originating_Logon_Session:__td__td_0x_x:0x_x__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x27c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x280], eax
mov eax, dword [rsp + 0x27c]
mov ecx, dword [rsp + 0x280]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x3088]
call fcn.1400b3ed0
mov qword [rsp + 0x8f8], rax
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x900], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x908], rax
mov rax, qword [rsp + 0x8f8]
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_semsp_emsp_Token_Type:__td__td__s__td___tr_
mov rdx, qword [rsp + 0x900]
mov rcx, qword [rsp + 0x908]
call fcn.1400c8230
mov dword [rsp + 0x284], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x288], eax
mov eax, dword [rsp + 0x284]
mov ecx, dword [rsp + 0x288]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
mov rdx, qword [rsp + 0x148]
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_semsp_emsp_Integrity:__td__td__s__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x28c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x290], eax
mov eax, dword [rsp + 0x28c]
mov ecx, dword [rsp + 0x290]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [0x1401d2a20]
lea rcx, [rsp + 0xbf0]
call fcn.140003570
nop
lea rdx, [rsp + 0xbf0]
lea rcx, [rsp + 0x2e30]
call fcn.1400c1960
nop
lea rcx, [rsp + 0xbf0]
call fcn.140003860
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x318], rax
mov rcx, qword [rsp + 0x318]
call fcn.140101c84
cmp qword [rsp + 0x318], 0
jne 0x14008b061
mov qword [rsp + 0x910], 0
jmp 0x14008b07d
mov qword [rsp + 0x148], 0x8123
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x910], rax
mov byte [rsp + 0x50], 1
lea rdx, [0x140145eb8]
lea rcx, [rsp + 0xbd0]
call fcn.140003570
nop
lea rdx, [rsp + 0xbd0]
lea rcx, [rsp + 0x2e30]
call fcn.1400c1960
nop
lea rcx, [rsp + 0xbd0]
call fcn.140003860
nop
lea rcx, [rsp + 0x3088]
call fcn.140003860
mov rcx, qword [rsp + 0x2720]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x2f30]
call fcn.140003890
nop
lea rcx, [rsp + 0x3008]
call fcn.140003890
nop
lea rcx, [rsp + 0x2ed8]
call fcn.14003d0d0
nop
lea rcx, [rsp + 0x2fe8]
call fcn.140003860
nop
lea rcx, [rsp + 0x2fc8]
call fcn.140003860
nop
lea rcx, [rsp + 0x2e88]
call fcn.140003860
nop
lea rcx, [rsp + 0x2e68]
call fcn.140003860
nop
lea rcx, [rsp + 0x2ef0]
call fcn.140003860
nop
lea rcx, [rsp + 0x2f10]
call fcn.140003860
jmp 0x140085de6
lea rdx, [0x140145ecc]
lea rcx, [rsp + 0xbb0]
call fcn.140003570
nop
lea rdx, [rsp + 0xbb0]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x8f], al
lea rcx, [rsp + 0xbb0]
call fcn.140003860
movzx eax, byte [rsp + 0x8f]
test eax, eax
je 0x14008b335
lea rdx, [0x140145ed0]
lea rcx, [rsp + 0xb90]
call fcn.140003570
nop
lea rdx, [rsp + 0xb90]
lea rcx, [rsp + 0x2e30]
call fcn.1400c1960
nop
lea rcx, [rsp + 0xb90]
call fcn.140003860
mov r8d, 0x1000
xor edx, edx
lea rcx, [0x1401d1a00]
call fcn.1401044f0
mov dword [0x1401d19fc], 0
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d1a00]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp + 0x5170]
mov dword [rsp + 0x20], edx
mov r9d, dword [rsp + 0x5170]
lea r8, str._n_h2_style_text_align:center____a_href__dthreads___span_stylefont_size:20px__128281___span___a__a_href__d___span_stylefont_size:20px__128285___span___a___h2___div_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x294], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x298], eax
mov eax, dword [rsp + 0x294]
mov ecx, dword [rsp + 0x298]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [0x1401d1a00]
lea rcx, [rsp + 0xb70]
call fcn.140003570
nop
lea rdx, [rsp + 0xb70]
lea rcx, [rsp + 0x2e30]
call fcn.1400c1960
nop
lea rcx, [rsp + 0xb70]
call fcn.140003860
lea rax, [rsp + 0x2e30]
mov qword [rsp + 0x330], rax
mov rcx, qword [rsp + 0x330]
call fcn.140008ce0
mov qword [rsp + 0x1a8], rax
mov rcx, qword [rsp + 0x330]
call fcn.14001c8b0
mov qword [rsp + 0x918], rax
jmp 0x14008b2f1
mov rax, qword [rsp + 0x1a8]
add rax, 0x20
mov qword [rsp + 0x1a8], rax
mov rax, qword [rsp + 0x918]
cmp qword [rsp + 0x1a8], rax
je 0x14008b329
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x920], rax
mov rdx, qword [rsp + 0x920]
lea rcx, [0x1401d7940]
call fcn.14000f400
jmp 0x14008b2dd
lea rcx, [0x1401d7940]
call fcn.1400bc980
movzx eax, byte [rsp + 0x61]
test eax, eax
je 0x14008b3ea
lea rax, [rsp + 0x13d0]
mov qword [rsp + 0x928], rax
lea rdx, [0x140143fb6]
mov rcx, qword [rsp + 0x928]
call fcn.140003570
mov qword [rsp + 0x930], rax
mov rax, qword [rsp + 0x930]
mov qword [rsp + 0x938], rax
mov rax, qword [rsp + 0x938]
mov qword [rsp + 0x950], rax
lea rax, [rsp + 0x13f0]
mov qword [rsp + 0x940], rax
lea rdx, [0x140145f98]
mov rcx, qword [rsp + 0x940]
call fcn.140003570
mov qword [rsp + 0x948], rax
mov rax, qword [rsp + 0x948]
mov qword [rsp + 0x958], rax
mov r9d, dword [rsp + 0x6c]
mov r8d, 0xa
mov rdx, qword [rsp + 0x950]
mov rcx, qword [rsp + 0x958]
call fcn.140052820
movzx eax, byte [rsp + 0x62]
test eax, eax
je 0x14008b49f
lea rax, [rsp + 0x1410]
mov qword [rsp + 0x960], rax
lea rdx, [0x140143fb7]
mov rcx, qword [rsp + 0x960]
call fcn.140003570
mov qword [rsp + 0x968], rax
mov rax, qword [rsp + 0x968]
mov qword [rsp + 0x970], rax
mov rax, qword [rsp + 0x970]
mov qword [rsp + 0x988], rax
lea rax, [rsp + 0x1430]
mov qword [rsp + 0x978], rax
lea rdx, [0x140145fb0]
mov rcx, qword [rsp + 0x978]
call fcn.140003570
mov qword [rsp + 0x980], rax
mov rax, qword [rsp + 0x980]
mov qword [rsp + 0x990], rax
mov r9d, dword [rsp + 0x6c]
mov r8d, 0xa
mov rdx, qword [rsp + 0x988]
mov rcx, qword [rsp + 0x990]
call fcn.140052820
movzx eax, byte [rsp + 0x63]
test eax, eax
je 0x14008b554
lea rax, [rsp + 0x1450]
mov qword [rsp + 0x998], rax
lea rdx, [0x140143fdd]
mov rcx, qword [rsp + 0x998]
call fcn.140003570
mov qword [rsp + 0x9a0], rax
mov rax, qword [rsp + 0x9a0]
mov qword [rsp + 0x9a8], rax
mov rax, qword [rsp + 0x9a8]
mov qword [rsp + 0x9c0], rax
lea rax, [rsp + 0x1470]
mov qword [rsp + 0x9b0], rax
lea rdx, [0x140145fd0]
mov rcx, qword [rsp + 0x9b0]
call fcn.140003570
mov qword [rsp + 0x9b8], rax
mov rax, qword [rsp + 0x9b8]
mov qword [rsp + 0x9c8], rax
mov r9d, dword [rsp + 0x6c]
mov r8d, 0xa
mov rdx, qword [rsp + 0x9c0]
mov rcx, qword [rsp + 0x9c8]
call fcn.140052820
movzx eax, byte [rsp + 0x5a]
test eax, eax
je 0x14008b609
lea rax, [rsp + 0x1490]
mov qword [rsp + 0x9d0], rax
lea rdx, [0x140143fde]
mov rcx, qword [rsp + 0x9d0]
call fcn.140003570
mov qword [rsp + 0x9d8], rax
mov rax, qword [rsp + 0x9d8]
mov qword [rsp + 0x9e0], rax
mov rax, qword [rsp + 0x9e0]
mov qword [rsp + 0x9f8], rax
lea rax, [rsp + 0x14b0]
mov qword [rsp + 0x9e8], rax
lea rdx, [0x140145fe8]
mov rcx, qword [rsp + 0x9e8]
call fcn.140003570
mov qword [rsp + 0x9f0], rax
mov rax, qword [rsp + 0x9f0]
mov qword [rsp + 0xa00], rax
mov r9d, dword [rsp + 0x6c]
mov r8d, 0xa
mov rdx, qword [rsp + 0x9f8]
mov rcx, qword [rsp + 0xa00]
call fcn.140052820
movzx eax, byte [rsp + 0x64]
test eax, eax
je 0x14008b6be
lea rax, [rsp + 0x14d0]
mov qword [rsp + 0xa08], rax
lea rdx, [0x140143fdf]
mov rcx, qword [rsp + 0xa08]
call fcn.140003570
mov qword [rsp + 0xa10], rax
mov rax, qword [rsp + 0xa10]
mov qword [rsp + 0xa18], rax
mov rax, qword [rsp + 0xa18]
mov qword [rsp + 0xa30], rax
lea rax, [rsp + 0x14f0]
mov qword [rsp + 0xa20], rax
lea rdx, [0x140146010]
mov rcx, qword [rsp + 0xa20]
call fcn.140003570
mov qword [rsp + 0xa28], rax
mov rax, qword [rsp + 0xa28]
mov qword [rsp + 0xa38], rax
mov r9d, dword [rsp + 0x6c]
mov r8d, 0xa
mov rdx, qword [rsp + 0xa30]
mov rcx, qword [rsp + 0xa38]
call fcn.140052820
movzx eax, byte [rsp + 0x65]
test eax, eax
je 0x14008b773
lea rax, [rsp + 0x1510]
mov qword [rsp + 0xa40], rax
lea rdx, [0x140144012]
mov rcx, qword [rsp + 0xa40]
call fcn.140003570
mov qword [rsp + 0xa48], rax
mov rax, qword [rsp + 0xa48]
mov qword [rsp + 0xa50], rax
mov rax, qword [rsp + 0xa50]
mov qword [rsp + 0xa68], rax
lea rax, [rsp + 0x1530]
mov qword [rsp + 0xa58], rax
lea rdx, [0x140146030]
mov rcx, qword [rsp + 0xa58]
call fcn.140003570
mov qword [rsp + 0xa60], rax
mov rax, qword [rsp + 0xa60]
mov qword [rsp + 0xa70], rax
mov r9d, dword [rsp + 0x6c]
mov r8d, 0xa
mov rdx, qword [rsp + 0xa68]
mov rcx, qword [rsp + 0xa70]
call fcn.140052820
movzx eax, byte [rsp + 0x5b]
test eax, eax
je 0x14008b828
lea rax, [rsp + 0x1550]
mov qword [rsp + 0xa78], rax
lea rdx, [0x140144013]
mov rcx, qword [rsp + 0xa78]
call fcn.140003570
mov qword [rsp + 0xa80], rax
mov rax, qword [rsp + 0xa80]
mov qword [rsp + 0xa88], rax
mov rax, qword [rsp + 0xa88]
mov qword [rsp + 0xaa0], rax
lea rax, [rsp + 0x1570]
mov qword [rsp + 0xa90], rax
lea rdx, [0x140146050]
mov rcx, qword [rsp + 0xa90]
call fcn.140003570
mov qword [rsp + 0xa98], rax
mov rax, qword [rsp + 0xa98]
mov qword [rsp + 0xaa8], rax
mov r9d, dword [rsp + 0x6c]
mov r8d, 0xa
mov rdx, qword [rsp + 0xaa0]
mov rcx, qword [rsp + 0xaa8]
call fcn.140052820
movzx eax, byte [rsp + 0x5e]
test eax, eax
je 0x14008b8dd
lea rax, [rsp + 0x1590]
mov qword [rsp + 0xab0], rax
lea rdx, [0x140144014]
mov rcx, qword [rsp + 0xab0]
call fcn.140003570
mov qword [rsp + 0x358], rax
mov rax, qword [rsp + 0x358]
mov qword [rsp + 0x360], rax
mov rax, qword [rsp + 0x360]
mov qword [rsp + 0x388], rax
lea rax, [rsp + 0x15b0]
mov qword [rsp + 0x368], rax
lea rdx, [0x140146080]
mov rcx, qword [rsp + 0x368]
call fcn.140003570
mov qword [rsp + 0x370], rax
mov rax, qword [rsp + 0x370]
mov qword [rsp + 0x390], rax
mov r9d, dword [rsp + 0x6c]
mov r8d, 0xa
mov rdx, qword [rsp + 0x388]
mov rcx, qword [rsp + 0x390]
call fcn.140052820
movzx eax, byte [rsp + 0x52]
test eax, eax
je 0x14008b992
lea rax, [rsp + 0x15d0]
mov qword [rsp + 0x398], rax
lea rdx, [0x140144015]
mov rcx, qword [rsp + 0x398]
call fcn.140003570
mov qword [rsp + 0x3a0], rax
mov rax, qword [rsp + 0x3a0]
mov qword [rsp + 0x3a8], rax
mov rax, qword [rsp + 0x3a8]
mov qword [rsp + 0x3c0], rax
lea rax, [rsp + 0x15f0]
mov qword [rsp + 0x3b0], rax
lea rdx, [0x1401460a8]
mov rcx, qword [rsp + 0x3b0]
call fcn.140003570
mov qword [rsp + 0x3b8], rax
mov rax, qword [rsp + 0x3b8]
mov qword [rsp + 0x5e8], rax
mov r9d, dword [rsp + 0x6c]
mov r8d, 0xa
mov rdx, qword [rsp + 0x3c0]
mov rcx, qword [rsp + 0x5e8]
call fcn.140052820
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x90], al
lea rcx, [rsp + 0x2e30]
call fcn.14003d0d0
nop
mov rcx, qword [rsp + 0x5178]
call fcn.140003890
nop
mov rcx, qword [rsp + 0x5180]
call fcn.140003890
nop
mov rcx, qword [rsp + 0x5188]
call fcn.140003890
movzx eax, byte [rsp + 0x90]
mov rcx, qword [rsp + 0x5130]
xor rcx, rsp
call fcn.140101e00
add rsp, 0x5148
pop rdi
pop rsi
ret