Function at 0x407200
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
movabs rdi, 0x416c617574726956
mov r12, rcx
mov rcx, rdx
mov r13, rdx
mov dword [rsp + 0x6c], 0
call sub.msvcrt.dll_strlen
lea rbx, [rsp + 0x80]
lea rsi, [rsp + 0xa0]
mov r8d, 0x7845
mov r14, rax
lea rcx, [rsi + 0x10]
movabs rax, 0x32336c656e72656b
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xb0], rax
lea rax, [rbx + 0x10]
mov rbp, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xa0], rcx
mov dword [rax + 8], 0x636f6c6c
mov dword [rcx + 8], 0x6c6c642e
mov word [rax + 0xc], r8w
mov qword [rsp + 0x70], 0
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x88], 0xe
mov byte [rsp + 0x9e], 0
call rbp
test rax, rax
je 0x407981
mov rdx, qword [rsp + 0x80]
mov rcx, rax
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rdi
test rax, rax
je 0x407b70
mov dword [rsp + 0x20], 4
mov r8d, r14d
xor edx, edx
mov rcx, r12
mov r9d, 0x1000
call rax
mov rcx, qword [rsp + 0x80]
mov r15, rax
lea rax, [rbx + 0x10]
cmp rcx, rax
je 0x407322
call fcn.004afa90
mov rcx, qword [rsp + 0xa0]
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x407338
call fcn.004afa90
lea rcx, str.NtWriteVirtualMemory
call fcn.00408420
mov rcx, r12
mov rdx, r15
mov r9d, r14d
mov qword [rsp + 0x20], 0
mov r8, r13
call fcn.004082c0
lea rcx, [rsi + 0x10]
movabs rax, 0x32336c656e72656b
movabs rdx, 0x7262694c64616f4c
mov qword [rsp + 0xb0], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0x80], rax
mov dword [rcx + 8], 0x6c6c642e
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0xa8], 0xc
mov dword [rax + 8], 0x41797261
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x88], 0xc
mov byte [rsp + 0x9c], 0
call rbp
test rax, rax
je 0x407994
mov rdx, qword [rsp + 0x80]
mov rcx, rax
call rdi
mov qword [rsp + 0x58], rax
test rax, rax
je 0x407ab9
mov rcx, qword [rsp + 0x80]
lea rax, [rbx + 0x10]
cmp rcx, rax
je 0x40740c
call fcn.004afa90
mov rcx, qword [rsp + 0xa0]
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x407422
call fcn.004afa90
lea rax, [rsi + 0x10]
lea r14, [rsp + 0x78]
xor r8d, r8d
mov rcx, rbx
movabs rdx, 0x6c642e6c6c64746e
mov qword [rsp + 0xa0], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0xb0], rdx
mov rdx, r14
mov byte [rsi + 0x18], 0x6c
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xa8], 9
mov byte [rsp + 0xb9], 0
mov qword [rsp + 0x78], 0x13
call fcn.0049c8c0
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
movabs rcx, 0x7268547265735565
mov qword [rsp + 0x90], rdx
movabs rdx, 0x74616572436c7452
mov qword [rax + 8], rcx
mov ecx, 0x6165
mov qword [rax], rdx
mov word [rax + 0x10], cx
mov byte [rax + 0x12], 0x64
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov byte [rdx + rax], 0
mov rcx, qword [rsp + 0xa0]
call rbp
test rax, rax
je 0x4079b0
mov rdx, qword [rsp + 0x80]
mov rcx, rax
call rdi
test rax, rax
je 0x407ba2
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x38], r15
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rdx
mov rdx, qword [rsp + 0x58]
mov rcx, r12
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x30], rdx
xor edx, edx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rax
mov rcx, qword [rsp + 0x80]
lea rax, [rbx + 0x10]
cmp rcx, rax
je 0x407556
call fcn.004afa90
mov rcx, qword [rsp + 0xa0]
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x40756c
call fcn.004afa90
cmp qword [rsp + 0x70], 0
je 0x407bd4
lea rax, [rsi + 0x10]
xor r8d, r8d
mov rcx, rbx
movabs rdx, 0x32336c656e72656b
mov qword [rsp + 0xa0], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0xb0], rdx
mov rdx, r14
mov dword [rsi + 0x18], 0x6c6c642e
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x78], 0x15
call fcn.0049c8c0
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
movabs rcx, 0x6a624f656c676e69
mov qword [rsp + 0x90], rdx
movabs rdx, 0x53726f4674696157
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov dword [rax + 0x10], 0x45746365
mov byte [rax + 0x14], 0x78
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov byte [rdx + rax], 0
mov rcx, qword [rsp + 0xa0]
call rbp
test rax, rax
je 0x4079c3
mov rdx, qword [rsp + 0x80]
mov rcx, rax
call rdi
test rax, rax
je 0x407a55
mov r8d, 1
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x70]
call rax
mov rcx, qword [rsp + 0x80]
lea rax, [rbx + 0x10]
cmp rcx, rax
je 0x407679
call fcn.004afa90
mov rcx, qword [rsp + 0xa0]
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x40768f
call fcn.004afa90
lea rax, [rsi + 0x10]
xor r8d, r8d
mov rcx, rbx
movabs rdx, 0x32336c656e72656b
mov qword [rsp + 0xa0], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0xb0], rdx
mov rdx, r14
mov dword [rsi + 0x18], 0x6c6c642e
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x78], 0x11
call fcn.0049c8c0
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
movabs rcx, 0x616572685465646f
mov qword [rsp + 0x90], rdx
movabs rdx, 0x4374697845746547
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov byte [rax + 0x10], 0x64
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov byte [rdx + rax], 0
mov rcx, qword [rsp + 0xa0]
call rbp
test rax, rax
je 0x4079e0
mov rdx, qword [rsp + 0x80]
mov rcx, rax
call rdi
test rax, rax
je 0x407aeb
lea rdx, [rsp + 0x6c]
mov rcx, qword [rsp + 0x70]
call rax
mov rcx, qword [rsp + 0x80]
mov r14d, eax
lea rax, [rbx + 0x10]
cmp rcx, rax
je 0x407786
call fcn.004afa90
mov rcx, qword [rsp + 0xa0]
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x40779c
call fcn.004afa90
test r14d, r14d
je 0x407b4f
mov r8d, dword [rsp + 0x6c]
mov rdx, r13
mov rcx, r12
call fcn.004066f0
mov r13, rax
test rax, rax
je 0x407a87
movabs rax, 0x32336c656e72656b
lea rcx, [rsi + 0x10]
movabs rdx, 0x466c617574726956
mov qword [rsp + 0xb0], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0xa0], rcx
mov dword [rax + 8], 0x45656572
mov dword [rcx + 8], 0x6c6c642e
mov byte [rax + 0xc], 0x78
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x88], 0xd
mov byte [rsp + 0x9d], 0
call rbp
test rax, rax
je 0x4079f3
mov rdx, qword [rsp + 0x80]
mov rcx, rax
call rdi
test rax, rax
je 0x407a23
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, r12
call rax
mov rcx, qword [rsp + 0x80]
lea rax, [rbx + 0x10]
cmp rcx, rax
je 0x40787f
call fcn.004afa90
mov rcx, qword [rsp + 0xa0]
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x407895
call fcn.004afa90
movabs rax, 0x32336c656e72656b
lea rcx, [rsi + 0x10]
movabs rdx, 0x74616e696d726554
mov qword [rsp + 0xb0], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0x90], rdx
mov edx, 0x6165
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xa0], rcx
mov dword [rax + 8], 0x72685465
mov dword [rcx + 8], 0x6c6c642e
mov word [rax + 0xc], dx
mov byte [rax + 0xe], 0x64
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x88], 0xf
mov byte [rsp + 0x9f], 0
call rbp
test rax, rax
je 0x407a10
mov rdx, qword [rsp + 0x80]
mov rcx, rax
call rdi
test rax, rax
je 0x407b1d
xor edx, edx
mov rcx, qword [rsp + 0x70]
call rax
mov rcx, qword [rsp + 0x80]
add rbx, 0x10
cmp rcx, rbx
je 0x407954
call fcn.004afa90
mov rcx, qword [rsp + 0xa0]
add rsi, 0x10
cmp rcx, rsi
je 0x40796a
call fcn.004afa90
mov rax, r13
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x4072d4
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x4073db
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x4074e9
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x40763b
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x40774b
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x407842
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x40791f
mov ecx, 0x10
call fcn.004afc10
lea rdx, str.Invalid_API
mov rcx, rax
mov rbp, rax
call fcn.0048a560
lea r8, [fcn.0048a680]
lea rdx, [0x004eeea0]
mov rcx, rbp
call fcn.004b0320
mov ecx, 0x10
call fcn.004afc10
lea rdx, str.Invalid_API
mov rcx, rax
mov rbp, rax
call fcn.0048a560
lea r8, [fcn.0048a680]
lea rdx, [0x004eeea0]
mov rcx, rbp
call fcn.004b0320
mov ecx, 0x10
call fcn.004afc10
lea rdx, str.invalid_parse_remote
mov rcx, rax
mov rbx, rax
call fcn.0048a560
lea r8, [fcn.0048a680]
lea rdx, [0x004eeea0]
mov rcx, rbx
call fcn.004b0320
mov ecx, 0x10
call fcn.004afc10
lea rdx, str.Invalid_API
mov rcx, rax
mov rbp, rax
call fcn.0048a560
lea r8, [fcn.0048a680]
lea rdx, [0x004eeea0]
mov rcx, rbp
call fcn.004b0320
mov ecx, 0x10
call fcn.004afc10
lea rdx, str.Invalid_API
mov rcx, rax
mov rbp, rax
call fcn.0048a560
lea r8, [fcn.0048a680]
lea rdx, [0x004eeea0]
mov rcx, rbp
call fcn.004b0320
mov ecx, 0x10
call fcn.004afc10
lea rdx, str.Invalid_API
mov rcx, rax
mov rbp, rax
call fcn.0048a560
lea r8, [fcn.0048a680]
lea rdx, [0x004eeea0]
mov rcx, rbp
call fcn.004b0320
mov ecx, 0x10
call fcn.004afc10
lea rdx, str.invalid_parse_remote
mov rcx, rax
mov rbx, rax
call fcn.0048a560
jmp 0x407aa3
mov ecx, 0x10
call fcn.004afc10
lea rdx, str.Invalid_API
mov rcx, rax
mov rbp, rax
call fcn.0048a560
lea r8, [fcn.0048a680]
lea rdx, [0x004eeea0]
mov rcx, rbp
call fcn.004b0320
mov ecx, 0x10
call fcn.004afc10
lea rdx, str.Invalid_API
mov rcx, rax
mov rbp, rax
call fcn.0048a560
lea r8, [fcn.0048a680]
lea rdx, [0x004eeea0]
mov rcx, rbp
call fcn.004b0320
mov ecx, 0x10
call fcn.004afc10
lea rdx, str.rtlThread_error
mov rcx, rax
mov rbx, rax
call fcn.0048a560
jmp 0x407aa3