Function at 0x140071770
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2e8]
sub rsp, 0x3e8
mov rax, qword [0x1400f7060]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
mov qword [rbp - 0x40], r9
mov r13d, r8d
mov qword [rbp - 0x38], rdx
mov r15, rcx
mov qword [rbp + 0x160], rcx
mov r14, qword [rbp + 0x350]
mov qword [rbp - 0x30], r14
xor esi, esi
mov r12d, esi
mov dword [rbp - 0x50], esi
lea rax, [0x1400fba40]
mov qword [rbp + 0x30], rax
lea rcx, [0x1400fba90]
call fcn.14003581c
test eax, eax
jne 0x140072e23
movzx ebx, byte [0x1400fba40]
test bl, bl
sete byte [rbp + 0x38]
test bl, bl
jne 0x1400717fb
inc dword [0x1400fbae0]
lea rcx, [0x1400fba90]
call fcn.140035840
nop
mov dword [rbp - 0x50], 0x203e2d20
mov byte [rbp - 0x4c], 0
movdqa xmm0, xmmword [0x1400d1dd0]
movdqu xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x70], 0x485f7972
mov dword [rbp - 0x6c], 0x6b6f6f
movdqa xmm0, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x220], xmm0
mov byte [rbp + 0x230], 0
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x48]
call fcn.14005e550
lea r8, [rbp - 0x50]
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.140060bb0
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp + 0x2a0]
call fcn.1400613f0
mov dword [rbp - 0x50], 0x202d3c20
mov byte [rbp - 0x4c], 0
movdqa xmm0, xmmword [0x1400d1dd0]
movdqu xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x70], 0x485f7972
mov dword [rbp - 0x6c], 0x6b6f6f
movdqa xmm0, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x220], xmm0
mov byte [rbp + 0x230], 0
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x48]
call fcn.14005e550
lea r8, [rbp - 0x50]
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.140060bb0
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.1400613f0
mov rdi, qword [0x1400fbc38]
mov qword [rbp + 0x40], rsi
lea rax, [rbp + 0x270]
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], rdi
mov qword [rbp + 0x58], rsi
mov rax, qword [rdi]
cmp dword [rax], 0
je 0x140071969
mov qword [rbp + 0x1d0], rsi
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp + 0x1d0]
mov qword [rbp + 0x40], rax
lea rcx, [0x1400e01eb]
mov qword [rsp + 0x28], rcx
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x20], rax
lea r9, str._s_s
mov r8, rcx
xor edx, edx
mov rcx, rdi
call fcn.14007c440
nop
test bl, bl
je 0x14007197d
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140072db3
lea rcx, [rbp + 0x1a0]
call fcn.140074770
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rsp + 0x68], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140071ab2
mov dword [rbp - 0x80], 0x290028
mov dword [rbp - 0x7c], 0x2d0020
mov dword [rbp - 0x78], 0x20
mov dword [rbp + 0x170], 0x650047
mov dword [rbp + 0x174], 0x65006e
mov dword [rbp + 0x178], 0x690072
mov dword [rbp + 0x17c], 0x4c0063
mov dword [rbp + 0x180], 0x61006f
mov dword [rbp + 0x184], 0x4c0064
mov dword [rbp + 0x188], 0x620069
mov dword [rbp + 0x18c], 0x610072
mov dword [rbp + 0x190], 0x790072
mov dword [rbp + 0x194], 0x48005f
mov dword [rbp + 0x198], 0x6f006f
mov dword [rbp + 0x19c], 0x6b
mov dword [rsp + 0x48], 0x44005b
mov dword [rsp + 0x4c], 0x4c004c
mov dword [rsp + 0x50], 0x520050
mov dword [rsp + 0x54], 0x54004f
mov dword [rsp + 0x58], 0x430045
mov dword [rsp + 0x5c], 0x5d0054
mov dword [rsp + 0x60], 0x3a0020
mov dword [rsp + 0x64], 0x20003a
mov word [rsp + 0x68], si
lea r8, [rbp + 0x170]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.14005e680
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.140060d30
mov rdx, rax
lea r8, str.GenericLoadLibrary_Hook_called_with:
xor ecx, ecx
call fcn.14007c5d0
lea rcx, [rbp + 0x1a0]
call fcn.140074770
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rsp + 0x68], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140071bea
mov dword [rbp - 0x80], 0x290028
mov dword [rbp - 0x7c], 0x2d0020
mov dword [rbp - 0x78], 0x20
mov dword [rbp + 0x170], 0x650047
mov dword [rbp + 0x174], 0x65006e
mov dword [rbp + 0x178], 0x690072
mov dword [rbp + 0x17c], 0x4c0063
mov dword [rbp + 0x180], 0x61006f
mov dword [rbp + 0x184], 0x4c0064
mov dword [rbp + 0x188], 0x620069
mov dword [rbp + 0x18c], 0x610072
mov dword [rbp + 0x190], 0x790072
mov dword [rbp + 0x194], 0x48005f
mov dword [rbp + 0x198], 0x6f006f
mov dword [rbp + 0x19c], 0x6b
mov dword [rsp + 0x48], 0x44005b
mov dword [rsp + 0x4c], 0x4c004c
mov dword [rsp + 0x50], 0x520050
mov dword [rsp + 0x54], 0x54004f
mov dword [rsp + 0x58], 0x430045
mov dword [rsp + 0x5c], 0x5d0054
mov dword [rsp + 0x60], 0x3a0020
mov dword [rsp + 0x64], 0x20003a
mov word [rsp + 0x68], si
lea r8, [rbp + 0x170]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.14005e680
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.140060d30
mov r9, r15
lea r8, str.Filename:__s
mov rdx, rax
xor ecx, ecx
call fcn.14007c5d0
lea rcx, [rbp + 0x1a0]
call fcn.140074770
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rsp + 0x68], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140071d23
mov dword [rbp - 0x80], 0x290028
mov dword [rbp - 0x7c], 0x2d0020
mov dword [rbp - 0x78], 0x20
mov dword [rbp + 0x170], 0x650047
mov dword [rbp + 0x174], 0x65006e
mov dword [rbp + 0x178], 0x690072
mov dword [rbp + 0x17c], 0x4c0063
mov dword [rbp + 0x180], 0x61006f
mov dword [rbp + 0x184], 0x4c0064
mov dword [rbp + 0x188], 0x620069
mov dword [rbp + 0x18c], 0x610072
mov dword [rbp + 0x190], 0x790072
mov dword [rbp + 0x194], 0x48005f
mov dword [rbp + 0x198], 0x6f006f
mov dword [rbp + 0x19c], 0x6b
mov dword [rsp + 0x48], 0x44005b
mov dword [rsp + 0x4c], 0x4c004c
mov dword [rsp + 0x50], 0x520050
mov dword [rsp + 0x54], 0x54004f
mov dword [rsp + 0x58], 0x430045
mov dword [rsp + 0x5c], 0x5d0054
mov dword [rsp + 0x60], 0x3a0020
mov dword [rsp + 0x64], 0x20003a
mov word [rsp + 0x68], si
lea r8, [rbp + 0x170]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.14005e680
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.140060d30
mov rdx, rax
mov r9, qword [rbp - 0x38]
lea r8, str.hFile:__x
xor ecx, ecx
call fcn.14007c5d0
lea rcx, [rbp + 0x1a0]
call fcn.140074770
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rsp + 0x68], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140071e5b
mov dword [rbp - 0x80], 0x290028
mov dword [rbp - 0x7c], 0x2d0020
mov dword [rbp - 0x78], 0x20
mov dword [rbp + 0x170], 0x650047
mov dword [rbp + 0x174], 0x65006e
mov dword [rbp + 0x178], 0x690072
mov dword [rbp + 0x17c], 0x4c0063
mov dword [rbp + 0x180], 0x61006f
mov dword [rbp + 0x184], 0x4c0064
mov dword [rbp + 0x188], 0x620069
mov dword [rbp + 0x18c], 0x610072
mov dword [rbp + 0x190], 0x790072
mov dword [rbp + 0x194], 0x48005f
mov dword [rbp + 0x198], 0x6f006f
mov dword [rbp + 0x19c], 0x6b
mov dword [rsp + 0x48], 0x44005b
mov dword [rsp + 0x4c], 0x4c004c
mov dword [rsp + 0x50], 0x520050
mov dword [rsp + 0x54], 0x54004f
mov dword [rsp + 0x58], 0x430045
mov dword [rsp + 0x5c], 0x5d0054
mov dword [rsp + 0x60], 0x3a0020
mov dword [rsp + 0x64], 0x20003a
mov word [rsp + 0x68], si
lea r8, [rbp + 0x170]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.14005e680
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.140060d30
mov rdx, rax
mov r9d, r13d
lea r8, str.Flags:_0x_x
xor ecx, ecx
call fcn.14007c5d0
lea rcx, [rbp + 0x70]
call fcn.140074770
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1b0], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp + 0x1c0], xmm1
mov edi, 5
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007208b
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x80], rax
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp + 0x220], xmm0
mov qword [rbp - 0x80], 0xc
lea rax, [rbp + 0x220]
mov qword [rbp - 0x78], rax
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x50], xmm0
lea rax, str.FuncName:_
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], 0xc
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x170]
call fcn.140094ec0
nop
mov r12d, edi
mov dword [rbp - 0x50], edi
lea rbx, [rbp + 0x170]
cmp qword [rbp + 0x188], 0x10
cmovae rbx, qword [rbp + 0x170]
movdqa xmm0, xmmword [0x1400d1dd0]
movdqu xmmword [rbp + 0x1a0], xmm0
mov dword [rbp + 0x1b0], 0x485f7972
mov dword [rbp + 0x1b4], 0x6b6f6f
movdqa xmm0, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rbp - 0x70], 0
lea r8, [rbp + 0x1a0]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.14005e550
mov rdx, rax
lea rcx, [rbp + 0x1a0]
call fcn.1400678a0
mov rdx, rax
movzx ecx, byte [rax]
mov byte [rbp - 0x80], cl
movzx ecx, byte [rax + 1]
mov byte [rbp - 0x7f], cl
movzx ecx, byte [rax + 2]
mov byte [rbp - 0x7e], cl
movzx ecx, byte [rax + 3]
mov byte [rbp - 0x7d], cl
movzx ecx, byte [rax + 4]
mov byte [rbp - 0x7c], cl
movzx ecx, byte [rax + 5]
mov byte [rbp - 0x7b], cl
movzx ecx, byte [rax + 6]
mov byte [rbp - 0x7a], cl
movzx eax, byte [rax + 7]
mov byte [rbp - 0x79], al
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x78], al
movzx eax, byte [rdx + 9]
mov byte [rbp - 0x77], al
movzx eax, byte [rdx + 0xa]
mov byte [rbp - 0x76], al
movzx eax, byte [rdx + 0xb]
mov byte [rbp - 0x75], al
movzx eax, byte [rdx + 0xc]
mov byte [rbp - 0x74], al
movzx eax, byte [rdx + 0xd]
mov byte [rbp - 0x73], al
movzx eax, byte [rdx + 0xe]
mov byte [rbp - 0x72], al
movzx eax, byte [rdx + 0xf]
mov byte [rbp - 0x71], al
movzx eax, byte [rdx + 0x10]
mov byte [rbp - 0x70], al
movzx eax, byte [rdx + 0x11]
mov byte [rbp - 0x6f], al
movzx eax, byte [rdx + 0x12]
mov byte [rbp - 0x6e], al
movzx eax, byte [rdx + 0x13]
mov byte [rbp - 0x6d], al
movzx eax, byte [rdx + 0x14]
mov byte [rbp - 0x6c], al
movzx eax, byte [rdx + 0x15]
mov byte [rbp - 0x6b], al
movzx eax, byte [rdx + 0x16]
mov byte [rbp - 0x6a], al
movzx eax, byte [rdx + 0x17]
mov byte [rbp - 0x69], al
movzx eax, byte [rdx + 0x18]
mov byte [rbp - 0x68], al
movzx eax, byte [rdx + 0x19]
mov byte [rbp - 0x67], al
movzx eax, byte [rdx + 0x1a]
mov byte [rbp - 0x66], al
movzx eax, byte [rdx + 0x1b]
mov byte [rbp - 0x65], al
movzx eax, byte [rdx + 0x1c]
mov byte [rbp - 0x64], al
movzx eax, byte [rdx + 0x1d]
mov byte [rbp - 0x63], al
movzx eax, byte [rdx + 0x1e]
mov byte [rbp - 0x62], al
movzx eax, byte [rdx + 0x1f]
mov byte [rbp - 0x61], al
movzx eax, byte [rdx + 0x20]
mov byte [rbp - 0x60], al
movzx eax, byte [rdx + 0x21]
mov byte [rbp - 0x5f], al
movzx eax, byte [rdx + 0x22]
mov byte [rbp - 0x5e], al
movzx eax, byte [rdx + 0x23]
mov byte [rbp - 0x5d], al
movzx eax, byte [rdx + 0x24]
mov byte [rbp - 0x5c], al
movzx eax, byte [rdx + 0x25]
mov byte [rbp - 0x5b], al
movzx eax, byte [rdx + 0x26]
mov byte [rbp - 0x5a], al
mov dword [rbp - 0x59], 0x2d202928
mov word [rbp - 0x55], 0x20
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp - 0x80]
xor ecx, ecx
call fcn.14007c2b0
nop
test r12b, 1
je 0x1400720d6
and r12d, 0xfffffffe
mov rdx, qword [rbp + 0x188]
cmp rdx, 0x10
jb 0x1400720d6
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400720d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140072e2b
call fcn.14005be00
lea rcx, [rbp + 0x70]
call fcn.140074770
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rsp + 0x68], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007220b
mov dword [rbp - 0x80], 0x290028
mov dword [rbp - 0x7c], 0x2d0020
mov dword [rbp - 0x78], 0x20
mov dword [rbp + 0x170], 0x650047
mov dword [rbp + 0x174], 0x65006e
mov dword [rbp + 0x178], 0x690072
mov dword [rbp + 0x17c], 0x4c0063
mov dword [rbp + 0x180], 0x61006f
mov dword [rbp + 0x184], 0x4c0064
mov dword [rbp + 0x188], 0x620069
mov dword [rbp + 0x18c], 0x610072
mov dword [rbp + 0x190], 0x790072
mov dword [rbp + 0x194], 0x48005f
mov dword [rbp + 0x198], 0x6f006f
mov dword [rbp + 0x19c], 0x6b
mov dword [rsp + 0x48], 0x44005b
mov dword [rsp + 0x4c], 0x4c004c
mov dword [rsp + 0x50], 0x520050
mov dword [rsp + 0x54], 0x54004f
mov dword [rsp + 0x58], 0x430045
mov dword [rsp + 0x5c], 0x5d0054
mov dword [rsp + 0x60], 0x3a0020
mov dword [rsp + 0x64], 0x20003a
mov word [rsp + 0x68], si
lea r8, [rbp + 0x170]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.14005e680
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.140060d30
mov rdx, rax
mov r9, r14
lea r8, str.CallerAddr:_0x_x
xor ecx, ecx
call fcn.14007c5d0
lea rcx, [rbp + 0x70]
call fcn.140074770
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rsp + 0x68], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x1400724e2
mov qword [rbp + 0x1a0], rsi
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], 7
mov word [rbp + 0x1a0], si
mov r8d, 7
lea rdx, [0x1400d1638]
lea rcx, [rbp + 0x1a0]
call fcn.1400043e0
nop
mov qword [rbp + 0x170], rsi
mov qword [rbp + 0x180], rsi
mov qword [rbp + 0x188], 7
mov word [rbp + 0x170], si
mov r8d, 7
lea rdx, [0x1400d1638]
lea rcx, [rbp + 0x170]
call fcn.1400043e0
nop
lea r8, [rbp + 0x170]
lea rdx, [rbp + 0x1a0]
mov rcx, r14
call fcn.14007a9b0
lea rcx, [rbp + 0x70]
call fcn.140074770
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rsp + 0x68], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007239f
lea rbx, [rbp + 0x170]
cmp qword [rbp + 0x188], 8
cmovae rbx, qword [rbp + 0x170]
mov dword [rbp - 0x80], 0x290028
mov dword [rbp - 0x7c], 0x2d0020
mov dword [rbp - 0x78], 0x20
lea rdx, str.GenericLoadLibrary_Hook
lea rcx, [rbp + 0x220]
call fcn.1400673e0
mov dword [rsp + 0x48], 0x44005b
mov dword [rsp + 0x4c], 0x4c004c
mov dword [rsp + 0x50], 0x520050
mov dword [rsp + 0x54], 0x54004f
mov dword [rsp + 0x58], 0x430045
mov dword [rsp + 0x5c], 0x5d0054
mov dword [rsp + 0x60], 0x3a0020
mov dword [rsp + 0x64], 0x20003a
mov word [rsp + 0x68], si
mov r8, rax
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.14005e680
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.140060d30
mov r9, rbx
lea r8, str.CallerOffset:__s
mov rdx, rax
xor ecx, ecx
call fcn.14007c5d0
lea rcx, [rbp + 0x70]
call fcn.140074770
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rsp + 0x68], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140072483
lea rbx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 8
cmovae rbx, qword [rbp + 0x1a0]
mov dword [rbp - 0x80], 0x290028
mov dword [rbp - 0x7c], 0x2d0020
mov dword [rbp - 0x78], 0x20
lea rdx, str.GenericLoadLibrary_Hook
lea rcx, [rbp + 0x220]
call fcn.1400673e0
mov dword [rsp + 0x48], 0x44005b
mov dword [rsp + 0x4c], 0x4c004c
mov dword [rsp + 0x50], 0x520050
mov dword [rsp + 0x54], 0x54004f
mov dword [rsp + 0x58], 0x430045
mov dword [rsp + 0x5c], 0x5d0054
mov dword [rsp + 0x60], 0x3a0020
mov dword [rsp + 0x64], 0x20003a
mov word [rsp + 0x68], si
mov r8, rax
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.14005e680
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.140060d30
mov r9, rbx
lea r8, str.CallerName:__s
mov rdx, rax
xor ecx, ecx
call fcn.14007c5d0
nop
mov r8, qword [rbp + 0x188]
cmp r8, 8
jb 0x1400724a6
inc r8
mov rdx, qword [rbp + 0x170]
lea rcx, [rbp + 0x170]
call fcn.140004640
mov qword [rbp + 0x180], rsi
mov qword [rbp + 0x188], 7
mov word [rbp + 0x170], si
mov r8, qword [rbp + 0x1b8]
cmp r8, 8
jb 0x1400724e2
inc r8
mov rdx, qword [rbp + 0x1a0]
lea rcx, [rbp + 0x1a0]
call fcn.140004640
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007250b
mov rax, qword [0x1400fbae8]
mov r8d, r13d
mov rdx, qword [rbp - 0x38]
mov rcx, r15
call rax
mov rsi, rax
jmp 0x140072db3
mov qword [rbp + 0x1f8], rsi
mov qword [rbp + 0x208], rsi
mov qword [rbp + 0x210], 7
mov word [rbp + 0x1f8], si
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp word [r15 + r8*2], 0
jne 0x140072535
mov rdx, r15
lea rcx, [rbp + 0x1f8]
call fcn.1400043e0
nop
call fcn.14007f6f0
mov rbx, rax
mov qword [rbp + 0x1d0], rax
lea rdx, [rbp + 0x1f8]
cmp qword [rbp + 0x210], 8
cmovae rdx, qword [rbp + 0x1f8]
movabs r9, 0xcbf29ce484222325
mov rcx, qword [rbp + 0x208]
lea r8, [rcx + rcx]
mov rcx, rsi
test r8, r8
je 0x1400725b3
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1400725a0
lea r8, [rbp + 0x1f8]
lea rdx, [rbp + 0x220]
mov rcx, rbx
call fcn.1400630e0
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400726c2
cmp rcx, qword [rbx + 8]
je 0x1400726c2
lea rax, [rbp + 0x170]
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x170], rsi
mov qword [rbp + 0x180], rsi
mov qword [rbp + 0x188], 0xf
xor r8d, r8d
lea rdx, [0x1400e01eb]
lea rcx, [rbp + 0x170]
call fcn.140004810
nop
lea rax, [rbp - 0x20]
mov qword [rbp + 0x1d0], rax
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.14006ab00
mov rbx, rax
mov qword [rbp + 0x1a0], rsi
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], 7
inc r14
cmp word [r15 + r14*2], 0
jne 0x140072651
mov r8, r14
mov rdx, r15
lea rcx, [rbp + 0x1a0]
call fcn.1400043e0
nop
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x38], rcx
lea rax, [rbp + 0x170]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rbx
mov r9, qword [rbp - 0x40]
mov r8d, r13d
lea rdx, [rbp + 0x1a0]
mov rcx, r15
call fcn.1400782a0
mov rax, qword [0x1400fbae8]
mov r8d, r13d
mov rdx, qword [rbp - 0x38]
mov rcx, r15
call rax
mov rsi, rax
jmp 0x140072da6
lea r8, [rbp + 0x1f8]
lea rdx, [rbp + 0x220]
mov rcx, rbx
call fcn.140064790
mov qword [rbp + 0x170], rbx
lea rax, [rbp + 0x1f8]
mov qword [rbp + 0x178], rax
mov byte [rbp + 0x180], 1
cmp byte [0x1400fbd13], 0
je 0x1400727f8
xor r8d, r8d
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x1a0]
call fcn.140018c40
mov rcx, rax
call fcn.140080ce0
test al, al
je 0x1400727f8
lea rax, [rbp + 0x1a0]
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x1a0], rsi
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], 0xf
xor r8d, r8d
lea rdx, [0x1400e01eb]
lea rcx, [rbp + 0x1a0]
call fcn.140004810
nop
lea rax, [rbp - 0x20]
mov qword [rbp + 0x1d0], rax
lea rcx, [rbp - 0x20]
call fcn.14006aba0
mov r12, rax
mov qword [rbp + 0x220], rsi
mov qword [rbp + 0x230], rsi
mov qword [rbp + 0x238], 7
inc r14
cmp word [r15 + r14*2], 0
jne 0x140072795
mov r8, r14
mov rdx, r15
lea rcx, [rbp + 0x220]
call fcn.1400043e0
nop
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x38], rcx
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], r12
mov r9, qword [rbp - 0x40]
mov r8d, r13d
lea rdx, [rbp + 0x220]
mov rcx, r15
call fcn.1400782a0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140072d96
mov dword [rbp - 0x50], esi
cmp byte [0x1400fbd1a], 0
jne 0x140072871
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [r15 + r8*2], 0
jne 0x140072810
mov qword [rbp + 0x1a0], rsi
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], 7
mov rdx, r15
lea rcx, [rbp + 0x1a0]
call fcn.1400043e0
or r12d, 0x1a
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x1a0]
call fcn.140081810
test al, al
je 0x140072871
cmp dword [rbp - 0x50], 0
je 0x14007286a
cmp byte [0x1400fbd1b], 0
jne 0x140072871
mov byte [rsp + 0x40], 1
jmp 0x140072876
mov byte [rsp + 0x40], 0
test r12b, 2
je 0x140072888
lea rcx, [rbp + 0x1a0]
call fcn.140003e50
cmp byte [rsp + 0x40], 0
je 0x1400728aa
mov rax, qword [0x1400fbae8]
mov r8d, r13d
mov rdx, qword [rbp - 0x38]
mov rcx, r15
call rax
mov rsi, rax
jmp 0x140072d96
mov qword [rbp + 0x1d8], rsi
movdqa xmm0, xmmword [0x1400e3030]
movdqu xmmword [rbp + 0x1e8], xmm0
mov word [rbp + 0x1d8], si
mov qword [rbp + 0x250], rsi
movdqa xmm0, xmmword [0x1400e3040]
movdqu xmmword [rbp + 0x260], xmm0
mov byte [rbp + 0x250], 0
lea rax, [rbp + 0x168]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x250]
lea r8, [rbp + 0x1d8]
mov edx, r13d
mov rcx, r15
call fcn.140076590
mov r12d, eax
lea rax, [rbp + 0x168]
mov qword [rbp + 0x220], rax
mov byte [rbp + 0x228], 1
cmp r12d, 0xa
jne 0x1400729cf
lea rax, [rbp + 0x1a0]
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x1a0], rsi
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], 0xf
xor r8d, r8d
lea rdx, [0x1400e01eb]
lea rcx, [rbp + 0x1a0]
call fcn.140004810
nop
lea rax, [rbp - 0x20]
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x20]
call fcn.14006aba0
mov rbx, rax
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp - 0x80]
call fcn.1400130f0
nop
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbx
mov r9, qword [rbp - 0x40]
mov r8d, r13d
mov rdx, rax
mov rcx, r15
call fcn.1400782a0
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140072d62
test r12d, r12d
je 0x140072b32
test byte [0x1400fbd14], 0x10
je 0x140072a23
lea rax, [rbp + 0x1a0]
mov qword [rbp + 0x160], rax
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x1a0]
call fcn.140004230
mov rdi, rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x20]
call fcn.14006aba0
mov rbx, rax
lea rcx, [rsp + 0x48]
jmp 0x140072ac1
test byte [0x1400fbd14], 0x20
je 0x140072b32
cmp byte [0x1400fbd18], 0
je 0x140072b04
lea rax, [rsp + 0x48]
lea rdx, [rbp + 0x250]
lea rcx, [rsp + 0x48]
mov qword [rbp - 0x80], rax
call fcn.140004230
mov rdi, rax
cmp r12d, 5
jne 0x140072aa3
lea rax, [rbp - 0x20]
mov qword [rbp + 0x160], rax
lea rcx, [rbp - 0x20]
call fcn.14006aba0
mov rbx, rax
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp + 0x1a0]
call fcn.1400130f0
nop
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xa
jmp 0x140072ae1
lea rax, [rbp - 0x20]
mov qword [rbp + 0x160], rax
lea rcx, [rbp - 0x20]
call fcn.14006aba0
mov rbx, rax
lea rcx, [rbp + 0x1a0]
lea rdx, [rbp + 0x1d8]
call fcn.1400130f0
nop
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbx
mov r9, qword [rbp - 0x40]
mov r8d, r13d
mov rdx, rax
mov rcx, r15
call fcn.1400782a0
mov rbx, qword [rbp + 0x1d0]
mov edi, 5
test byte [0x1400fbd14], 0x20
je 0x140072b32
cmp r12d, 5
je 0x140072b19
cmp r12d, 2
jne 0x140072b32
mov eax, 0x7e
cmp r12d, 2
cmove edi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140072d62
lea rdx, [rbp + 0x1d8]
cmp qword [rbp + 0x1f0], 8
cmovae rdx, qword [rbp + 0x1d8]
mov qword [rbp + 0x1a0], rsi
movdqa xmm0, xmmword [0x1400e3030]
movdqu xmmword [rbp + 0x1b0], xmm0
mov word [rbp + 0x1a0], si
nop word [rax + rax]
inc r14
cmp word [rdx + r14*2], 0
jne 0x140072b70
mov r8, r14
lea rcx, [rbp + 0x1a0]
call fcn.1400043e0
nop
lea r8, [rbp + 0x1a0]
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.140064b70
nop
lea rcx, [rbp + 0x1a0]
call fcn.140003e50
mov qword [rbp + 0x1a0], rbx
lea rax, [rbp + 0x1d8]
mov qword [rbp + 0x1a8], rax
mov byte [rbp + 0x1b0], 1
lea rcx, [rbp + 0x70]
call fcn.140074770
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp - 0x60], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140072c75
lea rdi, [rbp + 0x1d8]
cmp qword [rbp + 0x1f0], 8
cmovae rdi, qword [rbp + 0x1d8]
mov dword [rbp - 0x80], 0x290028
mov dword [rbp - 0x7c], 0x2d0020
mov dword [rbp - 0x78], 0x20
lea rdx, str.GenericLoadLibrary_Hook
lea rcx, [rbp - 0x20]
call fcn.1400673e0
mov rbx, rax
lea rdx, str._DLLPROTECT__::
lea rcx, [rsp + 0x48]
call fcn.1400672a0
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.14005e680
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.140060d30
mov r9, rdi
lea r8, str.calling_TrueLoadLibraryExW_with__s
mov rdx, rax
xor ecx, ecx
call fcn.14007c5d0
mov rax, qword [0x1400fbae8]
lea rcx, [rbp + 0x1d8]
cmp qword [rbp + 0x1f0], 8
cmovae rcx, qword [rbp + 0x1d8]
mov r8d, r13d
mov rdx, qword [rbp - 0x38]
call rax
mov r14, rax
lea rcx, [rbp - 0x20]
call fcn.140074770
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp - 0x60], xmm1
mov rcx, qword [rax]
cmp dword [rcx], 0
je 0x140072d52
lea rdi, [rbp + 0x1d8]
cmp qword [rbp + 0x1f0], 8
cmovae rdi, qword [rbp + 0x1d8]
mov dword [rbp - 0x80], 0x290028
mov dword [rbp - 0x7c], 0x2d0020
mov dword [rbp - 0x78], 0x20
lea rdx, str.GenericLoadLibrary_Hook
lea rcx, [rbp + 0x70]
call fcn.1400673e0
mov rbx, rax
lea rdx, str._DLLPROTECT__::
lea rcx, [rsp + 0x48]
call fcn.1400672a0
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.14005e680
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.140060d30
mov qword [rsp + 0x20], r14
mov r9, rdi
lea r8, str.calling_TrueLoadLibraryExW_with__s___dll_p
mov rdx, rax
xor ecx, ecx
call fcn.14007c5d0
mov rsi, r14
lea rcx, [rbp + 0x1a0]
call fcn.14006c070
nop
mov rcx, qword [rbp + 0x168]
cmp rcx, 0xffffffffffffffff
je 0x140072d76
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x250]
call fcn.140004190
nop
lea rcx, [rbp + 0x1d8]
call fcn.140003e50
mov rbx, qword [rbp + 0x1d0]
lea rdx, [rbp + 0x1f8]
mov rcx, rbx
call fcn.14007e280
nop
lea rcx, [rbp + 0x1f8]
call fcn.140003e50
nop
lea rcx, [rbp + 0x40]
call fcn.14006ca40
nop
cmp byte [rbp + 0x38], 0
je 0x140072df5
lea rcx, [0x1400fba90]
call fcn.14003581c
test eax, eax
jne 0x140072e1b
sub dword [0x1400fbae0], 1
jne 0x140072de8
lea rcx, [0x1400fba48]
call fcn.1400c5a7c
lea rcx, [0x1400fba90]
call fcn.140035840
nop
mov rax, rsi
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.14005bde0
add rsp, 0x3e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, eax
call fcn.140035390
nop
mov ecx, eax
call fcn.140035390
nop
call fcn.1400a8018
int3