Function at 0x140007de0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ecx, 0x104
call fcn.140006fa0
mov rdx, qword [0x14000e8b8]
mov rdi, rax
mov r8, rax
nop word [rax + rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
mov byte [r8], cl
lea r8, [r8 + 1]
test cl, cl
jne 0x140007e10
dec rax
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x140007e25
movsd xmm0, qword [0x140009730]
movsd qword [rax], xmm0
mov ecx, dword [0x140009738]
mov dword [rax + 8], ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, 0x5c
mov rcx, rdi
mov rbx, rax
call sub.ntdll.dll_strrchr
movsd xmm0, qword [0x1400097e8]
movsd qword [rax], xmm0
mov ecx, dword [0x1400097f0]
mov dword [rax + 8], ecx
movzx ecx, word [0x1400097f4]
mov word [rax + 0xc], cx
movzx ecx, byte [0x1400097f6]
mov byte [rax + 0xe], cl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, 0x5c
mov rcx, rdi
mov rsi, rax
call sub.ntdll.dll_strrchr
movsd xmm0, qword [str._vmm.dll]
movsd qword [rax], xmm0
movzx ecx, byte [0x1400098b8]
mov byte [rax + 8], cl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rbx, rbx
je 0x140008a13
test rsi, rsi
je 0x140008a13
test rax, rax
je 0x140008a13
lea rdx, str.VMMDLL_Initialize
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_InitializeEx
mov rcx, rdi
mov qword [0x14000ead0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Close
mov rcx, rdi
mov qword [0x14000ead8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_CloseAll
mov rcx, rdi
mov qword [0x14000eae0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_MemSize
mov rcx, rdi
mov qword [0x14000eae8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_MemFree
mov rcx, rdi
mov qword [0x14000eaf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_InitializePlugins
mov rcx, rdi
mov qword [0x14000eaf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_ConfigGet
mov rcx, rdi
mov qword [0x14000eb98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_ConfigSet
mov rcx, rdi
mov qword [0x14000eb00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_VfsListU
mov rcx, rdi
mov qword [0x14000eb08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_VfsListW
mov rcx, rdi
mov qword [0x14000eb30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_VfsListBlobU
mov rcx, rdi
mov qword [0x14000eb38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_VfsList_AddFile
mov rcx, rdi
mov qword [0x14000eb40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_VfsList_AddFileW
mov rcx, rdi
mov qword [0x14000eb10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_VfsList_AddDirectory
mov rcx, rdi
mov qword [0x14000eb18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_VfsList_AddDirectoryW
mov rcx, rdi
mov qword [0x14000eb20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_VfsReadU
mov rcx, rdi
mov qword [0x14000eb28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_VfsReadW
mov rcx, rdi
mov qword [0x14000eb48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_VfsWriteU
mov rcx, rdi
mov qword [0x14000eb50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_VfsWriteW
mov rcx, rdi
mov qword [0x14000eb58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14000eb60], rax
lea rdx, str.VMMDLL_UtilVfsReadFile_FromPBYTE
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_UtilVfsReadFile_FromQWORD
mov rcx, rdi
mov qword [0x14000eb68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_UtilVfsReadFile_FromDWORD
mov rcx, rdi
mov qword [0x14000eb70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_UtilVfsReadFile_FromBOOL
mov rcx, rdi
mov qword [0x14000eb78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_UtilVfsWriteFile_BOOL
mov rcx, rdi
mov qword [0x14000eb80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_UtilVfsWriteFile_DWORD
mov rcx, rdi
mov qword [0x14000eb88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_MemPrefetchPages
mov rcx, rdi
mov qword [0x14000eb90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_MemRead
mov rcx, rdi
mov qword [0x14000ebe0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_MemReadEx
mov rcx, rdi
mov qword [0x14000ebd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_MemReadPage
mov rcx, rdi
mov qword [0x14000ebd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_MemReadScatter
mov rcx, rdi
mov qword [0x14000ebc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_MemSearch
mov rcx, rdi
mov qword [0x14000ebb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_MemVirt2Phys
mov rcx, rdi
mov qword [0x14000ed68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_MemWrite
mov rcx, rdi
mov qword [0x14000ebf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_MemWriteScatter
mov rcx, rdi
mov qword [0x14000ebe8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Scatter_Initialize
mov rcx, rdi
mov qword [0x14000ebc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Scatter_Prepare
mov rcx, rdi
mov qword [0x14000ebf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Scatter_PrepareEx
mov rcx, rdi
mov qword [0x14000ec00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Scatter_PrepareWrite
mov rcx, rdi
mov qword [0x14000ec08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Scatter_PrepareWriteEx
mov rcx, rdi
mov qword [0x14000ec10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14000ec18], rax
lea rdx, str.VMMDLL_Scatter_Execute
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Scatter_ExecuteRead
mov rcx, rdi
mov qword [0x14000ec20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Scatter_Read
mov rcx, rdi
mov qword [0x14000ec28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Scatter_Clear
mov rcx, rdi
mov qword [0x14000ec30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Scatter_CloseHandle
mov rcx, rdi
mov qword [0x14000ec38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_PidList
mov rcx, rdi
mov qword [0x14000ec40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_PidGetFromName
mov rcx, rdi
mov qword [0x14000ed90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetNetU
mov rcx, rdi
mov qword [0x14000ed88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetNetW
mov rcx, rdi
mov qword [0x14000ed28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetPfn
mov rcx, rdi
mov qword [0x14000ed30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetPfnEx
mov rcx, rdi
mov qword [0x14000ed78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetPool
mov rcx, rdi
mov qword [0x14000ed80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetKObjectU
mov rcx, rdi
mov qword [0x14000ed20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetKObjectW
mov rcx, rdi
mov qword [0x14000ed10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetKDriverU
mov rcx, rdi
mov qword [0x14000ed18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetKDriverW
mov rcx, rdi
mov qword [0x14000ed00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetKDeviceU
mov rcx, rdi
mov qword [0x14000ed08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetKDeviceW
mov rcx, rdi
mov qword [0x14000ecf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetPhysMem
mov rcx, rdi
mov qword [0x14000ecf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetUsersU
mov rcx, rdi
mov qword [0x14000ece8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetUsersW
mov rcx, rdi
mov qword [0x14000ed38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetVMU
mov qword [0x14000ed40], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetVMW
mov rcx, rdi
mov qword [0x14000ed48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetServicesU
mov rcx, rdi
mov qword [0x14000ed50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetServicesW
mov rcx, rdi
mov qword [0x14000ed58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetPteU
mov rcx, rdi
mov qword [0x14000ed60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetPteW
mov rcx, rdi
mov qword [0x14000ec48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetVadU
mov rcx, rdi
mov qword [0x14000ec50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetVadW
mov rcx, rdi
mov qword [0x14000ec58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetVadEx
mov rcx, rdi
mov qword [0x14000ec60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetModuleU
mov rcx, rdi
mov qword [0x14000ec68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetModuleW
mov rcx, rdi
mov qword [0x14000ec70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetModuleFromNameU
mov rcx, rdi
mov qword [0x14000ec78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetModuleFromNameW
mov rcx, rdi
mov qword [0x14000ec80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetUnloadedModuleU
mov rcx, rdi
mov qword [0x14000ec88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetUnloadedModuleW
mov rcx, rdi
mov qword [0x14000ec90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetEATU
mov rcx, rdi
mov qword [0x14000ec98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetEATW
mov rcx, rdi
mov qword [0x14000eca0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetIATU
mov rcx, rdi
mov qword [0x14000eca8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetIATW
mov rcx, rdi
mov qword [0x14000ecb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetHeap
mov rcx, rdi
mov qword [0x14000ecb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14000ecc0], rax
lea rdx, str.VMMDLL_Map_GetHeapAlloc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetThread
mov rcx, rdi
mov qword [0x14000ecc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetHandleU
mov rcx, rdi
mov qword [0x14000ecd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Map_GetHandleW
mov rcx, rdi
mov qword [0x14000ecd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_ProcessGetInformation
mov rcx, rdi
mov qword [0x14000ece0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_ProcessGetInformationAll
mov rcx, rdi
mov qword [0x14000ed98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_ProcessGetInformationString
mov rcx, rdi
mov qword [0x14000eda0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_ProcessGetDirectoriesU
mov rcx, rdi
mov qword [0x14000eda8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_ProcessGetDirectoriesW
mov rcx, rdi
mov qword [0x14000edb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_ProcessGetSectionsU
mov rcx, rdi
mov qword [0x14000edb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_ProcessGetSectionsW
mov rcx, rdi
mov qword [0x14000edc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_ProcessGetProcAddressU
mov rcx, rdi
mov qword [0x14000edc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_ProcessGetProcAddressW
mov rcx, rdi
mov qword [0x14000edd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_ProcessGetModuleBaseU
mov rcx, rdi
mov qword [0x14000edd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_ProcessGetModuleBaseW
mov rcx, rdi
mov qword [0x14000ede0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_WinGetThunkInfoIATU
mov rcx, rdi
mov qword [0x14000ede8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_WinGetThunkInfoIATW
mov rcx, rdi
mov qword [0x14000ee60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_WinReg_HiveList
mov rcx, rdi
mov qword [0x14000ee68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_WinReg_HiveReadEx
mov rcx, rdi
mov qword [0x14000ee18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_WinReg_HiveWrite
mov rcx, rdi
mov qword [0x14000ee20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14000ee28], rax
lea rdx, str.VMMDLL_WinReg_EnumKeyExU
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_WinReg_EnumKeyExW
mov rcx, rdi
mov qword [0x14000ee30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_WinReg_EnumValueU
mov rcx, rdi
mov qword [0x14000ee48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_WinReg_EnumValueW
mov rcx, rdi
mov qword [0x14000ee38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_WinReg_QueryValueExU
mov rcx, rdi
mov qword [0x14000ee50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_WinReg_QueryValueExW
mov rcx, rdi
mov qword [0x14000ee40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_VmGetVmmHandle
mov rcx, rdi
mov qword [0x14000ee58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_VmMemTranslateGPA
mov rcx, rdi
mov qword [0x14000ee70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_VmMemRead
mov rcx, rdi
mov qword [0x14000eea0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_VmMemReadScatter
mov rcx, rdi
mov qword [0x14000ee80], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_VmMemWrite
mov rcx, rdi
mov qword [0x14000ee90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_VmMemWriteScatter
mov rcx, rdi
mov qword [0x14000ee88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_VmScatterInitialize
mov rcx, rdi
mov qword [0x14000ee98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_PdbLoad
mov rcx, rdi
mov qword [0x14000ee78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_PdbSymbolName
mov rcx, rdi
mov qword [0x14000edf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_PdbSymbolAddress
mov rcx, rdi
mov qword [0x14000edf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_PdbTypeSize
mov rcx, rdi
mov qword [0x14000ee00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_PdbTypeChildOffset
mov rcx, rdi
mov qword [0x14000ee08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_ForensicFileAppend
mov rcx, rdi
mov qword [0x14000ee10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_UtilFillHexAscii
mov rcx, rdi
mov qword [0x14000eba0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14000eea8], rax
lea rdx, str.VMMDLL_YaraSearch
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_Log
mov rcx, rdi
mov qword [0x14000ed70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VMMDLL_LogEx
mov rcx, rdi
mov qword [0x14000eba8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14000ebb0], rax
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret