Function at 0x14013cf50
Capabilities:
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov r13, qword [0x14051fa98]
xor eax, eax
mov qword [rsp + 0xb0], r13
mov rbp, rdx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], eax
mov byte [rsp + 0x54], al
mov rsi, qword [0x14051e4d8]
xorps xmm0, xmm0
mov r14, qword [0x14051e4d0]
movabs r15, 0x567e1002cf512045
movzx r10d, byte [rsp + 0xb8]
movabs r12, 0x37a30086df360cf
movups xmmword [rsp + 0x44], xmm0
mov dword [rsp + 0x40], 0x4195d981
mov dword [rsp + 0x54], eax
mov word [rsp + 0x58], ax
nop dword [rax]
mov rax, r14
mov r9, rsi
xor ecx, ecx
nop dword [rax + rax]
mov edi, ecx
cmp rdi, 0x1a
jae 0x14013dafb
movzx ebx, byte [rsp + rdi + 0x40]
mov r8d, ebx
cmp rax, rdi
ja 0x14013daf2
lea rcx, [r9 + 1]
cmp rax, rcx
jae 0x14013d02f
lea r10, [rdi + r15]
movzx ecx, r8b
and cl, r10b
add cl, cl
sub r10b, cl
add r10b, 0x1d
add r10b, bl
jmp 0x14013d068
je 0x14013da8b
inc rcx
cmp rax, rcx
je 0x14013da03
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x14013d9e4
lea rcx, [r9 + 6]
cmp rax, rcx
je 0x14013d9c2
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x14013d980
movzx r11d, dil
nop dword [rax]
cmp r9, rdi
ja 0x14013dae9
lea rcx, [r9 + 0x10]
cmp rax, rcx
jae 0x14013d099
lea edx, [r11 - 0x57]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
add r10b, 0x61
jmp 0x14013d0e0
lea rcx, [r9 + 1]
cmp rax, rcx
je 0x14013d969
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x14013d947
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x14013d917
lea rcx, [r9 + 2]
cmp rax, rcx
je 0x14013d8fb
lea rcx, [r9 + 8]
cmp rax, rcx
je 0x14013d8d1
nop word [rax + rax]
lea rcx, [r9 + rax]
cmp rcx, rdi
jbe 0x14013d64b
nop dword [rax]
lea rcx, [r9 + 0x80]
cmp rax, rcx
je 0x14013d62b
lea rcx, [r9 + 0x41]
cmp rax, rcx
je 0x14013d606
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x14013d5e4
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x14013d5c4
lea rdx, [r9 + 0x10]
cmp rax, rdx
je 0x14013d5a1
lea rcx, [r9 + 0x200]
cmp rax, rcx
je 0x14013d585
lea rcx, [r9 + 0x64]
cmp rax, rcx
je 0x14013d566
lea rcx, [r9 + 0x7a]
cmp rax, rcx
je 0x14013d546
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x14013d518
lea rcx, [r9 + 2]
cmp rax, rcx
je 0x14013d0f0
lea r9, [rdx + 0xa]
mov rax, rdx
lea rcx, [r9 + 9]
cmp rdx, rcx
jb 0x14013dace
lea rcx, [r9 + 0x64]
cmp rdx, rcx
jb 0x14013dab3
lea rcx, [r9 + 0x7a]
cmp rdx, rcx
jb 0x14013d2d2
lea rcx, [r9 + 0x1000]
cmp rdx, rcx
jb 0x14013d2b8
lea rdx, [r9 + 2]
cmp rax, rdx
jb 0x14013d29e
lea rcx, [r9 + 0xa]
cmp rax, rcx
jb 0x14013d4c7
lea rcx, [r9 + 8]
cmp rax, rcx
jb 0x14013d47c
lea rcx, [r9 + 0x42]
cmp rax, rcx
jb 0x14013d43b
lea rcx, [r9 + 0x61]
cmp rax, rcx
jb 0x14013d418
lea rcx, [r9 + 3]
cmp rax, rcx
jb 0x14013d0f0
lea r9, [rdx + 1]
mov rax, rdx
lea rcx, [r9 + 0xa]
cmp rdx, rcx
ja 0x14013d3ea
lea rcx, [r9 + 8]
cmp rdx, rcx
ja 0x14013d3ca
lea rcx, [r9 + 0x42]
cmp rdx, rcx
ja 0x14013d3ab
lea rcx, [r9 + 0x61]
cmp rdx, rcx
ja 0x14013d390
lea rdx, [r9 + 0x400]
cmp rax, rdx
ja 0x14013d36d
lea rcx, [r9 + 1]
cmp rax, rcx
ja 0x14013d353
lea rcx, [r9 + 9]
cmp rax, rcx
ja 0x14013d332
lea rcx, [r9 + 6]
cmp rax, rcx
ja 0x14013d30e
lea rcx, [r9 + 0x40]
cmp rax, rcx
ja 0x14013d2ee
lea rcx, [r9 + 0x1000]
cmp rax, rcx
ja 0x14013d0f0
mov rax, rdx
lea r9, [rdx + 0x3e8]
jmp 0x14013d0f0
lea edx, [r11 + 0x77]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x41
jmp 0x14013d0e0
lea edx, [r11 - 0x13]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x7b
jmp 0x14013d070
add r11b, 0x63
movzx ecx, r11b
and cl, bl
add cl, cl
sub r11b, cl
lea r10d, [rbx + r11]
add r10b, 0x4b
jmp 0x14013d004
lea r8d, [r11 + 0x48]
mov edx, 4
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, bl
add r10b, r8b
jmp 0x14013d999
sub r11b, 0x42
movzx ecx, bl
and cl, r11b
inc r9
add cl, cl
dec rdi
sub bl, cl
lea r10d, [r11 + rbx]
sub r10b, 0x32
inc rdi
jmp 0x14013cff2
add r11b, 0x34
movzx ecx, bl
and cl, r11b
dec rdi
add cl, cl
sub bl, cl
lea r10d, [r11 + rbx]
sub r10b, 0x6c
inc rdi
jmp 0x14013cff2
mov edx, 0x2d
lea r8d, [r11 - 0x56]
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r10d, [rdx + rdx]
jmp 0x14013d88b
add r11b, 0x20
mov edx, reloc.WS2_32.dll_recv
movzx ecx, bl
and cl, r11b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, bl
add r10b, r11b
add rax, r9
jmp 0x14013d92e
sub r11b, 0x6a
movzx ecx, bl
and cl, r11b
add cl, cl
sub bl, cl
lea r10d, [r11 + rbx]
sub r10b, 0x1a
jmp 0x14013d92e
lea r8d, [r11 + 0xc]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
sub r10b, 0x54
add r10b, r8b
jmp 0x14013da25
sub r11b, 0x7e
mov edx, 0x39
movzx ecx, bl
and cl, r11b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, bl
add r10b, r11b
jmp 0x14013da4c
sub r11b, 8
movzx ecx, bl
and cl, r11b
mov edx, 0x1c
sub dl, cl
movzx ecx, byte [rsp + rdi + 0x40]
add rcx, r9
add rdi, rcx
lea r10d, [rdx + rdx]
add r10b, bl
add r10b, r11b
inc rdi
jmp 0x14013cff2
sub r11b, 0x61
movzx ecx, bl
and cl, r11b
add cl, cl
sub bl, cl
lea r10d, [r11 + rbx]
sub r10b, 0x59
mov byte [rsp + rdi + 0x40], r10b
inc rdi
jmp 0x14013cff2
lea r8d, [r11 + 0x15]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
add r10b, 0x6d
add r10b, r8b
cmp r9, 6
jb 0x14013d42e
lea r8d, [r11 + 0x7e]
mov edx, 7
movzx ecx, bl
and cl, r8b
sub dl, cl
add dl, dl
add dl, bl
add dl, r8b
lea r10d, [rdx + rdx]
jmp 0x14013d999
lea r8d, [r11 - 0x75]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
add r10b, 0x33
add r10b, r8b
cmp rax, 0x42
jae 0x14013d874
lea rcx, [r9 + 0x40]
cmp rax, rcx
jbe 0x14013d7f2
mov edx, 0x25
lea r8d, [r11 + 0x1a]
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, bl
jmp 0x14013d452
lea r8d, [r11 + 1]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
sub r10b, 7
add r10b, r8b
lea rcx, [r9 + rax]
cmp rcx, 0x40
je 0x14013d8b4
lea rcx, [r9 + 0x61]
cmp rax, rcx
jbe 0x14013d71c
lea r8d, [r11 + 0x71]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
sub r10b, 0x17
jmp 0x14013d493
sub r11b, 0xa
movzx ecx, bl
and cl, r11b
mov edx, 0x23
sub dl, cl
movzx ecx, byte [rsp + rdi + 0x40]
add rcx, r9
add rdi, rcx
lea r10d, [rdx + rdx]
add r10b, bl
add r10b, r11b
inc rdi
jmp 0x14013cff2
add r11b, 0x6c
mov edx, 6
movzx ecx, bl
and cl, r11b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, bl
add r10b, r11b
jmp 0x14013da4c
lea r8d, [r11 - 0x1e]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
sub r10b, 0x2e
add r10b, r8b
jmp 0x14013da25
add r11b, 0x58
movzx ecx, r11b
and cl, bl
add cl, cl
sub r11b, cl
lea r10d, [rbx + r11]
sub r10b, 0x68
jmp 0x14013d92e
sub r11b, 0x32
mov edx, gethostbyaddr
movzx ecx, r11b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r11b
add r10b, bl
add rax, r9
jmp 0x14013d92e
lea r8d, [r11 + 0x44]
mov edx, reloc.WS2_32.dll_select
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
jmp 0x14013d891
sub r11b, 0x46
dec rdi
movzx ecx, r11b
and cl, bl
add cl, cl
sub r11b, cl
lea r10d, [rbx + r11]
sub r10b, 0x16
inc rdi
jmp 0x14013cff2
add r11b, 0x30
inc r9
movzx ecx, r11b
dec rdi
and cl, bl
add cl, cl
sub r11b, cl
lea r10d, [rbx + r11]
sub r10b, 0x50
inc rdi
jmp 0x14013cff2
lea r8d, [r11 - 0x5a]
mov edx, 0x3b
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
jmp 0x14013d999
lea rdx, [r9 + 3]
cmp rax, rdx
jae 0x14013d66e
lea edx, [r11 + 0x45]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
add r10b, 0x1d
jmp 0x14013d4e1
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x14013d6a1
add r11b, 0x52
movzx ecx, r11b
and cl, bl
add cl, cl
sub r11b, cl
movzx ecx, byte [rsp + rdi + 0x40]
add rcx, r9
add rdi, rcx
lea r10d, [rbx + r11]
sub r10b, 0x3e
inc rdi
jmp 0x14013cff2
cmp rax, rdx
jne 0x14013d6c6
lea r8d, [r11 + 0x66]
mov edx, 0x1b
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
jmp 0x14013da25
lea rcx, [r9 + 4]
cmp rax, rcx
jne 0x14013d6e9
lea edx, [r11 + 4]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x1c
jmp 0x14013d891
lea rcx, [r9 + 2]
cmp rax, rcx
jne 0x14013d4e1
sub r11b, 0x72
mov edx, reloc.WS2_32.dll_ntohs
movzx ecx, r11b
dec rdi
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r11b
add r10b, bl
inc rdi
jmp 0x14013cff2
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x14013d744
lea r8d, [r11 - 5]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
add r10b, 0x23
add r10b, r8b
jmp 0x14013d999
inc rcx
cmp rax, rcx
jne 0x14013d770
sub r11b, 0x7b
movzx ecx, bl
and cl, r11b
inc r9
add cl, cl
dec rdi
sub bl, cl
lea r10d, [r11 + rbx]
add r10b, 0x5d
inc rdi
jmp 0x14013cff2
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x14013d795
lea r8d, [r11 - 0x67]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
sub r10b, 0x2f
jmp 0x14013d88e
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x14013d7bc
add r11b, 0x23
movzx ecx, bl
and cl, r11b
add cl, cl
sub bl, cl
lea r10d, [r11 + rbx]
add r10b, 0xb
add rax, r9
jmp 0x14013d92e
lea rcx, [r9 + 9]
cmp rax, rcx
jne 0x14013d496
add r11b, 0x4b
movzx ecx, bl
and cl, r11b
add cl, cl
sub bl, cl
movzx ecx, byte [rsp + rdi + 0x40]
add rcx, r9
add rdi, rcx
lea r10d, [r11 + rbx]
sub r10b, 0xd
inc rdi
jmp 0x14013cff2
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x14013d824
sub r11b, 0x5c
movzx ecx, bl
and cl, r11b
add cl, cl
sub bl, cl
movzx ecx, byte [rsp + rdi + 0x40]
add rcx, r9
add rdi, rcx
lea r10d, [r11 + rbx]
sub r10b, 0x7c
inc rdi
jmp 0x14013cff2
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x14013d846
lea r8d, [r11 + 0x56]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
sub r10b, 0x5a
jmp 0x14013d88e
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x14013d455
sub r11b, 0x20
movzx ecx, bl
and cl, r11b
dec rdi
add cl, cl
sub bl, cl
lea r10d, [r11 + rbx]
sub r10b, 0x20
inc rdi
jmp 0x14013cff2
lea r8d, [r11 + 8]
movzx ecx, bl
and cl, r8b
movzx r10d, bl
add cl, cl
sub r10b, cl
sub r10b, 0x38
add r10b, bl
add r10b, r8b
add r11b, 0x4d
movzx ecx, r11b
and cl, bl
add cl, cl
sub r11b, cl
sub r11b, 0x1b
add r11b, r10b
add r11b, bl
mov byte [rsp + rdi + 0x40], r11b
add rax, r9
jmp 0x14013d92e
lea r8d, [r11 - 0x6e]
mov edx, 1
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
jmp 0x14013da25
sub r11b, 0x7d
movzx ecx, r11b
and cl, bl
add cl, cl
sub r11b, cl
movzx ecx, byte [rsp + rdi + 0x40]
add rcx, r9
add rdi, rcx
lea r10d, [rbx + r11]
add r10b, 0x6b
inc rdi
jmp 0x14013cff2
sub r11b, 7
movzx ecx, r11b
and cl, bl
add cl, cl
sub r11b, cl
lea r10d, [rbx + r11]
add r10b, 0x31
jmp 0x14013da4c
sub r11b, 0x1b
movzx ecx, r11b
and cl, bl
add cl, cl
sub r11b, cl
lea r10d, [rbx + r11]
sub r10b, 0x43
movzx ecx, r10b
mov rdx, 0xffffffffffffffff
sub rdx, rcx
add rdi, rdx
inc rdi
jmp 0x14013cff2
add r11b, 0x47
dec rdi
movzx ecx, r11b
and cl, bl
add cl, cl
sub r11b, cl
lea r10d, [rbx + r11]
add r10b, 0xf
inc rdi
jmp 0x14013cff2
lea edx, [r11 + 0x33]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x65
jmp 0x14013d999
movzx r11d, dil
lea edx, [r11 + 0x1f]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
add r10b, 0x27
sub r11b, 0x3d
inc r9
movzx ecx, r11b
and cl, bl
add cl, cl
sub r11b, cl
sub r11b, 0x55
add r11b, bl
mov byte [rsp + rdi + 0x40], r11b
dec rdi
inc rdi
jmp 0x14013cff2
lea edx, [rdi - 0x6b]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x13
inc r9
dec rdi
inc rdi
jmp 0x14013cff2
lea edx, [rdi + 0xb]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x4d
dec rdi
inc rdi
jmp 0x14013cff2
movabs rcx, 0x5d727013ab37e1e3
movzx r11d, dil
add rcx, rdi
and r8b, cl
add r8b, r8b
sub cl, r8b
lea r10d, [rbx + rcx]
sub r10b, 0x35
sub r11b, 0x29
movzx ecx, bl
and cl, r11b
inc r9
add cl, cl
movzx edx, bl
sub dl, cl
add dl, 0x1f
add dl, r11b
movzx ecx, dl
mov byte [rsp + rdi + 0x40], cl
add rcx, r9
sub rdi, rcx
lea r8d, [rdi + 0x1c]
movzx ecx, bl
and cl, r8b
inc rax
mov edx, 0x1e
sub dl, cl
mov rcx, 0xffffffffffffffff
sub rcx, rax
add dl, dl
add dl, bl
add dl, r8b
mov byte [rsp + rdi + 0x40], dl
add rdi, rcx
movzx ecx, byte [rsp + rdi + 0x40]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x14013cff2
lea rcx, [rdi + r12]
and r8b, cl
add r8b, r8b
sub cl, r8b
lea r10d, [rbx + rcx]
add r10b, 0x57
movzx ecx, byte [rsp + rdi + 0x40]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x14013cff2
sub r11b, 0x27
movzx ecx, bl
and cl, r11b
add cl, cl
sub bl, cl
lea r10d, [r11 + rbx]
add r10b, 0x11
jmp 0x14013cfe6
add r11b, 0x4f
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0x29
jmp 0x14013cfd9
mov eax, dword [rsp + 0x141ae9c]
jmp 0x14013daff
mov eax, dword [rsp + 0x92cee1]
jmp 0x14013daff
mov eax, dword [rsp + 0x40]
movsxd rcx, eax
mov qword [0x14051e4f8], rcx
rdtsc
shl rdx, 0x20
or rax, rdx
lea rcx, [rcx + rax*8]
mov eax, 0x5a4d
mov qword [0x14051e500], rcx
cmp word [rbp], ax
jne 0x14013dd25
movsxd rdi, dword [rbp + 0x3c]
add rdi, rbp
cmp dword [rdi], 0x4550
jne 0x14013dd25
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x14013dd25
mov r14d, dword [rdi + 0x50]
xor ecx, ecx
mov edx, r14d
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x14013dd25
movzx ecx, word [rdi + 0x14]
mov r12d, dword [rcx + rdi + 0x24]
mov rcx, r13
sub r14d, r12d
mov edx, r14d
call fcn.14013cd90
mov r15, rax
mov rcx, rsi
test rax, rax
je 0x14013dd17
mov r8d, dword [rdi + 0x54]
mov rdx, rbp
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [rdi + 0x14]
xor eax, eax
add rbx, 0x28
mov ebp, eax
cmp ax, word [rdi + 6]
jae 0x14013dbf5
mov r13, qword [rsp + 0xb8]
add rbx, rdi
test dword [rbx + 0x14], 0x80
ja 0x14013dbdf
mov edx, dword [rbx + 4]
mov ecx, dword [rbx - 4]
add rdx, r13
mov r8d, dword [rbx]
add rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rdi + 6]
inc ebp
add rbx, 0x28
cmp ebp, eax
jl 0x14013dbc2
mov r13, qword [rsp + 0xb0]
mov rbp, r15
lea rcx, [rsp + 0x40]
sub r15, r12
mov rdx, rsi
mov rbx, r15
sub rbx, qword [rdi + 0x30]
call fcn.14013e4b0
mov rdx, rbx
mov rcx, rax
call fcn.14013dd40
mov rdx, rsi
mov ebx, r14d
lea rcx, [rsp + 0x40]
call fcn.14013e5f0
mov rdx, rax
mov rcx, r13
call fcn.14013de40
mov rdx, rbp
mov rcx, r13
test al, al
je 0x14013dcb1
lea r8, [r12 + rsi]
mov r9d, ebx
call fcn.140137540
test al, al
je 0x14013dcab
mov r8d, dword [rdi + 0x28]
add r8, r15
mov dword [rsp + 0xb8], 0
rdtsc
shl rdx, 0x20
or rax, rdx
mov r10, rax
rdtsc
mov rcx, qword [0x14051e318]
shl rdx, 0x20
or rax, rdx
lea rdx, [rsp + 0xb8]
mov r9, rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov rcx, r13
mov qword [rsp + 0x20], r10
call fcn.14013e060
test al, al
jne 0x14013dcdd
mov rcx, r13
mov rdx, rbp
mov r8, rbx
mov rdi, rbp
call fcn.140137620
mov r8d, 0x8000
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8d, r14d
mov rdx, rbp
mov rcx, r13
call fcn.140137620
jmp 0x14013dd25
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x14013dcf3
mov eax, dword [rsp + 0xb8]
mov dword [rcx], eax
mov r8, rbx
mov rdx, rbp
mov rcx, r13
call fcn.140137620
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rbp
jmp 0x14013dd27
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret