Function at 0x140001030
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2a8
mov r12, r9
mov r13, r8
mov rbp, rdx
mov r14, rcx
lea rax, [rcx + 0x3c]
mov qword [rsp + 0x1d8], rax
mov rax, qword [rsp + 0x1d8]
movsxd rdx, dword [rax]
mov rax, rdx
add rax, rcx
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xe0]
mov esi, dword [rax]
mov ecx, 0x4550
call fcn.1400027a0
mov qword [rsp + 0x38], 0
cmp esi, eax
jne 0x1400023a7
mov rax, qword [rsp + 0xe0]
add rax, 4
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x1e0]
movzx esi, word [rax]
mov ecx, 0x14c
mov edx, 0x56
call fcn.1400027a0
mov qword [rsp + 0x38], 0
cmp si, ax
je 0x1400023a7
mov qword [rsp + 0x280], rbp
mov r15, qword [0x1400061d0]
mov rax, qword [rsp + 0xe0]
add rax, 0x18
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x108]
add rax, 0x38
mov qword [rsp + 0x1e8], rax
mov rax, qword [rsp + 0x1e8]
mov ebp, dword [rax]
mov rax, qword [rsp + 0x108]
add rax, 0x18
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
mov rsi, qword [rax]
mov rcx, rbp
mov edx, ebp
call fcn.1400027a0
mov rbx, rax
mov ecx, 0x3000
mov edx, ebp
call fcn.1400027a0
mov rdi, rax
mov ecx, 0x40
mov edx, ebp
call fcn.1400027a0
mov rcx, rsi
mov rdx, rbx
mov r8d, edi
mov r9d, eax
call r15
mov r15, r12
mov r12, r13
mov r13, qword [rsp + 0x280]
mov qword [rsp + 0x1d0], rax
test rax, rax
jne 0x1400011ef
mov rbx, qword [0x1400061d0]
mov rax, qword [rsp + 0x1e8]
mov esi, dword [rax]
mov rcx, rsi
call fcn.1400027a0
mov rdi, rax
mov ecx, 0x3000
mov edx, esi
mov r8d, esi
call fcn.1400027a0
mov rsi, rax
mov ecx, 0x40
mov edx, 0x59
call fcn.1400027a0
xor ecx, ecx
mov rdx, rdi
mov r8d, esi
mov r9d, eax
call rbx
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x38], 0
test rax, rax
je 0x1400023a7
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rsi, rax
mov edx, 0xba
xor ecx, ecx
call fcn.1400027a0
mov rdi, rax
mov ecx, 0x50
mov edx, 0x11b070
call fcn.1400027a0
mov rcx, rsi
mov edx, edi
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400019a7
mov rdi, qword [rsp + 0x310]
mov rax, qword [rsp + 0x28]
add rax, 8
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
add rax, 0x18
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x28]
add rax, 0x10
mov qword [rsp + 0x1f8], rax
mov rax, qword [rsp + 0x28]
add rax, 0x1c
mov qword [rsp + 0x288], rax
mov rax, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1f8]
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
movzx ebp, word [rax + 0x12]
mov ecx, 0xd
mov r8d, 0xba
mov edx, ebp
call fcn.1400027a0
mov esi, ebp
mov ecx, eax
shr esi, cl
mov ecx, 1
mov edx, ebp
mov r8d, ebp
call fcn.1400027a0
and eax, esi
mov rcx, qword [rsp + 0x28]
add rcx, 0x20
mov qword [rsp + 0x200], rcx
mov rcx, qword [rsp + 0x200]
mov dword [rcx], eax
mov rax, qword [rsp + 0x28]
add rax, 0x28
mov qword [rsp + 0x208], rax
mov rax, qword [rsp + 0x208]
mov qword [rax], r13
mov rax, qword [rsp + 0x28]
add rax, 0x30
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0x118]
mov qword [rax], r12
mov r12, rdi
mov rax, qword [rsp + 0x28]
add rax, 0x38
mov qword [rsp + 0x210], rax
mov rax, qword [rsp + 0x210]
mov qword [rax], r15
mov rax, qword [rsp + 0x28]
add rax, 0x40
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rax], rdi
mov r15, qword [0x1400061d0]
mov rbx, qword [rsp + 0x108]
mov ecx, dword [rbx + 0x3c]
mov edx, ebp
mov r8d, ebp
mov r9d, ebp
call fcn.1400027a0
mov rsi, rax
mov ecx, 0x1000
mov edx, ebp
call fcn.1400027a0
mov rdi, rax
mov ecx, 4
call fcn.1400027a0
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
mov r8d, edi
mov r9d, eax
call r15
mov rsi, rax
mov r8d, dword [rbx + 0x3c]
mov rcx, rax
mov rdx, r14
call fcn.140002770
mov rax, qword [rsp + 0x1d8]
movsxd rax, dword [rax]
lea rcx, [rsi + rax]
mov rdx, qword [rsp + 0x28]
mov qword [rdx], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsi + rax + 0x30], rcx
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
cmp word [rax + 6], 0
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x1c0], rax
je 0x14000166d
mov rsi, qword [rsp + 0xe8]
mov ecx, 0x18
mov rdx, rsi
call fcn.1400027a0
add rax, rsi
mov rcx, qword [rsp + 0xe8]
movzx ecx, word [rcx + 0x14]
add rcx, rax
mov rax, qword [rsp + 0xe0]
add rax, 0x38
mov qword [rsp + 0x290], rax
mov qword [rsp + 0x1c8], rcx
mov dword [rsp + 0xa4], 0
jmp 0x140001543
mov r15, qword [0x1400061d0]
mov esi, dword [rsp + 0xa8]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov edi, dword [rcx + 0xc]
add rdi, qword [rax]
mov rcx, rsi
call fcn.1400027a0
mov rbx, rax
mov ecx, 0x1000
mov rdx, rsi
mov r8, rsi
call fcn.1400027a0
mov rbp, rax
mov ecx, 0x40
mov rdx, rsi
call fcn.1400027a0
mov rcx, rdi
mov rdx, rbx
mov r8d, ebp
mov r9d, eax
call r15
mov rsi, rax
mov rax, qword [rsp + 0x50]
mov edx, dword [rax + 0x14]
add rdx, r14
mov rax, qword [rsp + 0x218]
mov r8d, dword [rax]
mov rcx, rsi
call fcn.140002770
mov rax, qword [rsp + 0x50]
mov dword [rax + 8], esi
mov ecx, 1
mov edx, 0x699bda
call fcn.1400027a0
add eax, dword [rsp + 0xc4]
mov rcx, qword [rsp + 0x50]
add rcx, 0x28
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx]
mov qword [rsp + 0x120], rdx
mov rdx, qword [rsp + 0x120]
movzx edx, word [rdx + 6]
mov qword [rsp + 0x1c8], rcx
mov dword [rsp + 0xa4], eax
cmp eax, edx
jae 0x140001639
mov eax, dword [rsp + 0xa4]
mov dword [rsp + 0xc4], eax
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
add rax, 0x10
mov qword [rsp + 0x218], rax
mov rax, qword [rsp + 0x218]
mov eax, dword [rax]
mov dword [rsp + 0xa8], eax
mov edx, dword [rsp + 0xc4]
xor ecx, ecx
mov r8d, edx
call fcn.1400027a0
mov ecx, dword [rsp + 0xa8]
cmp ecx, eax
jne 0x140001470
mov rax, qword [rsp + 0x290]
mov eax, dword [rax]
mov dword [rsp + 0xac], eax
xor ecx, ecx
call fcn.1400027a0
mov ecx, dword [rsp + 0xac]
cmp ecx, eax
jle 0x1400014f1
mov r15, qword [0x1400061d0]
mov esi, dword [rsp + 0xac]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov edi, dword [rcx + 0xc]
add rdi, qword [rax]
mov rcx, rsi
mov rdx, rsi
call fcn.1400027a0
mov rbp, rax
mov ecx, 0x1000
mov rdx, rsi
call fcn.1400027a0
mov rbx, rax
mov ecx, 0x40
mov rdx, rsi
call fcn.1400027a0
mov rcx, rdi
mov rdx, rbp
mov r8d, ebx
mov r9d, eax
call r15
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 8], eax
mov rcx, rax
xor edx, edx
mov r8, rsi
call fcn.140002630
jmp 0x1400014f1
cmp qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x120]
mov qword [rsp + 0x1c0], rax
mov dword [rsp + 0x34], 1
mov qword [rsp + 0xd8], rcx
je 0x1400019f9
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x1f0]
mov rsi, qword [rax]
mov edx, 0x4d
mov r8d, 0x40
xor ecx, ecx
call fcn.1400027a0
sub rax, rsi
add rax, qword [rsp + 0x40]
mov qword [rsp + 0x220], rax
mov rax, qword [rsp + 0xf0]
mov edi, dword [rax + 0xb4]
xor ecx, ecx
mov rdx, rsi
call fcn.1400027a0
mov dword [rsp + 0x34], 0
mov rcx, qword [rsp + 0xf0]
mov qword [rsp + 0xd8], rcx
cmp edi, eax
je 0x1400019f9
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x48]
mov eax, dword [rax + 0xb0]
add rax, qword [rcx]
mov qword [rsp + 0x228], rax
mov rax, qword [rsp + 0x228]
mov eax, dword [rax]
mov dword [rsp + 0xb0], eax
mov edx, 0x7127e2
xor ecx, ecx
call fcn.1400027a0
mov ecx, dword [rsp + 0xb0]
mov dword [rsp + 0x34], 1
mov rdx, qword [rsp + 0xf0]
mov qword [rsp + 0xd8], rdx
cmp ecx, eax
je 0x1400019f9
movabs r14, 0x1fffffff8
mov rax, qword [rsp + 0x220]
mov dword [rsp + 0x138], eax
mov rax, qword [rsp + 0x228]
mov ecx, dword [rsp + 0xb0]
mov dword [rsp + 0xa0], ecx
mov qword [rsp + 0x1b8], rax
jmp 0x1400017c9
mov eax, dword [rsp + 0xb8]
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x130]
lea rdi, [rcx + rax]
mov ebx, dword [rcx + rax]
mov edx, 0xb6
xor ecx, ecx
call fcn.1400027a0
mov dword [rsp + 0xa0], ebx
mov qword [rsp + 0x1b8], rdi
cmp ebx, eax
je 0x1400019e1
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x130], rax
mov edi, dword [rsp + 0xa0]
mov rax, qword [rsp + 0x48]
mov rcx, rdi
add rcx, qword [rax]
mov qword [rsp + 0x230], rcx
mov rax, qword [rsp + 0x130]
add rax, 4
mov qword [rsp + 0x238], rax
mov rax, qword [rsp + 0x238]
mov ebp, dword [rax]
mov rcx, r14
call fcn.1400027a0
mov rbx, rax
add rbx, rbp
mov ecx, 1
call fcn.1400027a0
mov ecx, eax
shr rbx, cl
mov r8d, 0xfd
xor ecx, ecx
mov edx, edi
call fcn.1400027a0
mov qword [rsp + 0x1b0], rbp
cmp ebx, eax
jle 0x14000178f
mov rax, qword [rsp + 0x130]
add rax, 8
mov dword [rsp + 0x9c], 0
mov qword [rsp + 0x1a8], rax
jmp 0x140001915
mov eax, dword [rsp + 0xb4]
mov rcx, qword [rsp + 0x230]
mov rdx, qword [rcx + rax]
add rdx, qword [rsp + 0x220]
mov qword [rcx + rax], rdx
mov ecx, 1
call fcn.1400027a0
mov rdi, rax
add edi, dword [rsp + 0xc8]
mov rbp, qword [rsp + 0x260]
add rbp, 2
mov rax, qword [rsp + 0x238]
mov eax, dword [rax]
mov dword [rsp + 0xb8], eax
mov esi, dword [rsp + 0xb8]
mov edx, 0x40
mov rcx, r14
call fcn.1400027a0
mov rbx, rax
add rbx, rsi
mov ecx, 1
mov edx, 0x5387ad
call fcn.1400027a0
mov ecx, eax
shr rbx, cl
mov dword [rsp + 0x9c], edi
mov qword [rsp + 0x1a8], rbp
cmp edi, ebx
jge 0x140001780
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x260], rax
mov eax, dword [rsp + 0x9c]
mov dword [rsp + 0xc8], eax
mov rax, qword [rsp + 0x260]
movzx ebx, word [rax]
mov r8d, dword [rsp + 0xc8]
mov ecx, 0xc
mov edx, 0x5f
mov r9d, 0x64
call fcn.1400027a0
mov edi, ebx
mov ecx, eax
shr edi, cl
mov ecx, 0xfff
call fcn.1400027a0
and eax, ebx
mov dword [rsp + 0xb4], eax
cmp edi, 0xa
je 0x140001880
cmp edi, 3
jne 0x14000189f
mov eax, dword [rsp + 0xb4]
mov rcx, qword [rsp + 0x230]
mov edx, dword [rcx + rax]
add edx, dword [rsp + 0x138]
mov dword [rcx + rax], edx
jmp 0x14000189f
mov edx, 0x10
mov r8d, 0xc6
xor ecx, ecx
call fcn.1400027a0
mov rsi, rax
mov ecx, 0x8000
mov edx, 0xfd
call fcn.1400027a0
mov rcx, qword [rsp + 0x40]
mov rdx, rsi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14000237e
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov dword [rsp + 0x34], 1
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x268], rax
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x28]
mov dword [rcx + 0x24], eax
mov rax, qword [rsp + 0x268]
mov esi, dword [rax + 0x94]
xor ecx, ecx
call fcn.1400027a0
cmp esi, eax
je 0x140001e07
mov rax, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
mov qword [rsp + 0x60], rcx
mov esi, dword [rax + 0x90]
mov rdi, rsi
add rdi, qword [rsp + 0x60]
mov ecx, 0x14
call fcn.1400027a0
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
mov ebx, eax
mov r8d, 8
xor ecx, ecx
mov edx, esi
call fcn.1400027a0
mov qword [rsp + 0x1a0], rdi
cmp ebx, eax
jne 0x140001e07
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
jmp 0x140001adc
mov rsi, qword [rsp + 0x88]
add rsi, 0x14
mov ecx, 0x14
call fcn.1400027a0
mov rcx, rsi
mov rdx, rax
call r14
mov edi, eax
mov r8d, 0x11e72c
xor ecx, ecx
mov edx, eax
call fcn.1400027a0
mov qword [rsp + 0x1a0], rsi
cmp edi, eax
jne 0x140001e07
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x58], eax
mov r8d, dword [rsp + 0x58]
mov edx, 0x7f
xor ecx, ecx
call fcn.1400027a0
mov ecx, dword [rsp + 0x58]
cmp ecx, eax
je 0x140001e07
mov rax, qword [rsp + 0x208]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx]
mov ecx, dword [rsp + 0x58]
add rcx, qword [rsp + 0x60]
call qword [rax]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x140002374
mov rax, qword [rsp + 0x110]
mov esi, dword [rax]
mov ecx, 1
mov r9d, 0x71
mov edx, esi
mov r8d, esi
call fcn.1400027a0
add eax, esi
movsxd rdi, eax
mov ecx, 3
mov edx, 0x8d
mov r8d, esi
call fcn.1400027a0
mov ecx, eax
shl rdi, cl
mov rcx, rdi
call fcn.1400027a0
mov rdi, rax
mov ecx, 0x1000
call fcn.1400027a0
mov rbx, rax
mov ecx, 4
mov edx, esi
call fcn.1400027a0
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, eax
call rbp
mov qword [rsp + 0x128], rax
cmp qword [rsp + 0x128], 0
je 0x140002322
mov rax, qword [rsp + 0x1f8]
mov rcx, qword [rsp + 0x128]
mov qword [rax], rcx
mov rax, qword [rsp + 0x110]
movsxd rsi, dword [rax]
mov ecx, 1
mov edx, esi
call fcn.1400027a0
add eax, esi
mov rcx, qword [rsp + 0x110]
mov dword [rcx], eax
mov rax, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x80]
mov qword [rax + rsi*8], rcx
mov rax, qword [rsp + 0x88]
mov eax, dword [rax]
mov dword [rsp + 0xbc], eax
mov r8d, 0x46
xor ecx, ecx
mov edx, esi
call fcn.1400027a0
mov ecx, dword [rsp + 0xbc]
cmp ecx, eax
jne 0x140001c64
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0x10]
add rax, qword [rsp + 0x60]
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x190], rax
jmp 0x140001c90
mov eax, dword [rsp + 0xbc]
add rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x88]
mov ecx, dword [rcx + 0x10]
add rcx, qword [rsp + 0x60]
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x190], rcx
mov rdi, qword [rsp + 0x190]
mov rbx, qword [rsp + 0x198]
mov rsi, qword [rbx]
xor ecx, ecx
mov rdx, rsi
call fcn.1400027a0
mov qword [rsp + 0x188], rsi
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x178], rbx
cmp rsi, rax
je 0x140001a9c
nop
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x298], rax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0xf8], rax
mov rdx, qword [rsp + 0xf8]
mov rcx, 0xffffffffffffffff
call fcn.1400027a0
mov rcx, qword [rsp + 0xf8]
cmp rcx, rax
jle 0x140001d60
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0x118]
mov rdx, qword [rsp + 0x78]
mov r8, qword [rdx]
lea rdx, [rax + rcx]
add rdx, 2
mov rcx, qword [rsp + 0x80]
call qword [rbx]
jmp 0x140001d95
mov rax, qword [rsp + 0x118]
mov rdi, qword [rax]
mov rax, qword [rsp + 0x78]
mov rsi, qword [rax]
mov ecx, 0xffff
call fcn.1400027a0
and rax, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x80]
mov rdx, rax
mov r8, rsi
call rdi
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x270]
mov qword [rcx], rax
test rax, rax
je 0x140002322
mov rsi, qword [rsp + 0x298]
mov rdi, qword [rsp + 0x270]
add rdi, 8
mov rbx, qword [rsi + 8]
add rsi, 8
mov edx, 0xffbedc
xor ecx, ecx
call fcn.1400027a0
mov qword [rsp + 0x188], rbx
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x178], rsi
cmp rbx, rax
jne 0x140001cd0
jmp 0x140001a9c
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov rsi, qword [rax + 0x30]
movabs rcx, 0xffffffff00000000
mov edx, 0x51
call fcn.1400027a0
and rax, rsi
mov qword [rsp + 0x240], rax
mov rax, qword [rsp + 0x68]
movzx edi, word [rax + 6]
xor ecx, ecx
mov rdx, rsi
call fcn.1400027a0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x150], rcx
cmp di, ax
jne 0x140001fd5
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov qword [rsp + 0x248], rax
mov rax, qword [rsp + 0x100]
mov eax, dword [rax + 0xd0]
mov dword [rsp + 0x5c], eax
mov edx, dword [rsp + 0x5c]
xor ecx, ecx
mov r8d, edx
call fcn.1400027a0
mov ecx, dword [rsp + 0x5c]
mov rdx, qword [rsp + 0x100]
mov qword [rsp + 0xd0], rdx
cmp ecx, eax
je 0x140001f96
mov edx, dword [rsp + 0x5c]
mov rax, qword [rsp + 0x248]
mov rax, qword [rax + rdx + 0x18]
mov qword [rsp + 0x250], rax
xor ecx, ecx
mov r8, rdx
call fcn.1400027a0
mov rcx, qword [rsp + 0x250]
mov rdx, qword [rsp + 0x100]
mov qword [rsp + 0xd0], rdx
cmp rcx, rax
je 0x140001f96
mov rax, qword [rsp + 0x250]
mov rcx, qword [rax]
mov qword [rsp + 0x148], rcx
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0xd0], rax
test rcx, rcx
je 0x140001f96
nop word cs:[rax + rax]
mov rsi, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x148]
mov ecx, 1
call fcn.1400027a0
mov rcx, qword [rsp + 0x248]
mov edx, eax
xor r8d, r8d
call rdi
mov rax, qword [rsi + 8]
add rsi, 8
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x140], rsi
test rax, rax
jne 0x140001f40
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov eax, dword [rax + 0x28]
mov dword [rsp + 0xc0], eax
mov edx, 0x630b1b
xor ecx, ecx
call fcn.1400027a0
mov ecx, dword [rsp + 0xc0]
cmp ecx, eax
jne 0x1400022e4
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x48], 0
jmp 0x14000239d
mov rsi, qword [rsp + 0x68]
mov ecx, 0x18
mov edx, 0x22
call fcn.1400027a0
add rax, rsi
mov rcx, qword [rsp + 0x68]
movzx ecx, word [rcx + 0x14]
add rcx, rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x168], rax
mov qword [rsp + 0x160], rcx
mov dword [rsp + 0x98], 0
lea r15, section..rdata
lea r14, [rsp + 0x2a4]
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1400020d2
mov rax, qword [rsp + 0x70]
mov esi, dword [rax + 0x10]
mov rax, qword [rsp + 0x70]
mov ebx, dword [rax + 8]
or rbx, qword [rsp + 0x240]
mov rcx, rsi
call fcn.1400027a0
mov rbp, rax
mov ecx, 0xc000
mov edx, 0xba
mov r8d, esi
call fcn.1400027a0
mov rcx, rbx
mov rdx, rbp
mov r8d, eax
call rdi
mov ecx, 1
mov edx, 0x2389c6
call fcn.1400027a0
add eax, dword [rsp + 0xcc]
mov rcx, qword [rsp + 0x70]
add rcx, 0x28
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx]
movzx ebp, word [rdx + 6]
mov qword [rsp + 0x168], rdx
mov qword [rsp + 0x160], rcx
mov dword [rsp + 0x98], eax
mov qword [rsp + 0x150], rdx
cmp eax, ebp
jae 0x140001e65
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0xcc], eax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x278], rax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x24]
mov dword [rsp + 0x30], eax
mov ecx, 0x2000000
call fcn.1400027a0
mov rsi, rax
and esi, dword [rsp + 0x30]
mov edx, dword [rsp + 0xcc]
xor ecx, ecx
mov r8d, edx
call fcn.1400027a0
cmp esi, eax
jne 0x140002040
mov ecx, 0x1f
mov edx, 0xe8
mov r8d, 0xa2
call fcn.1400027a0
mov esi, dword [rsp + 0x30]
mov ecx, eax
shr rsi, cl
mov ecx, 0x1e
mov r8d, 0x5608fe
mov edx, esi
call fcn.1400027a0
mov ebx, dword [rsp + 0x30]
mov ecx, eax
shr rbx, cl
mov ecx, 1
mov edx, esi
call fcn.1400027a0
and ebx, eax
mov ecx, 0x1d
mov edx, esi
call fcn.1400027a0
mov ebp, dword [rsp + 0x30]
mov ecx, eax
shr rbp, cl
mov ecx, 1
mov edx, 0xe35b6a
call fcn.1400027a0
and ebp, eax
shl rbp, 4
add rbp, r15
lea rbx, [rbx*8]
add rbx, rbp
mov ecx, 0x11
mov edx, 0x7d
mov r8d, esi
call fcn.1400027a0
mov ebp, dword [rsp + 0x30]
mov ecx, eax
shr ebp, cl
mov ecx, 0x200
mov edx, 0xfd
mov r8d, esi
call fcn.1400027a0
and eax, ebp
or eax, dword [rbx + rsi*4]
mov dword [rsp + 0x13c], eax
mov rax, qword [rsp + 0x70]
mov esi, dword [rax + 0x10]
xor ecx, ecx
call fcn.1400027a0
mov dword [rsp + 0x94], esi
cmp esi, eax
jne 0x140002292
mov ecx, 0x40
call fcn.1400027a0
mov rsi, rax
and esi, dword [rsp + 0x30]
xor ecx, ecx
mov edx, esi
call fcn.1400027a0
cmp esi, eax
jne 0x140002259
mov ecx, 0x80
call fcn.1400027a0
mov rsi, rax
and esi, dword [rsp + 0x30]
mov edx, 0xe085d9
xor ecx, ecx
call fcn.1400027a0
cmp esi, eax
je 0x140002080
mov rax, qword [rsp + 0x278]
add rax, 0x24
jmp 0x140002265
mov rax, qword [rsp + 0x278]
add rax, 0x20
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x158]
mov esi, dword [rax]
mov edx, 0x11
xor ecx, ecx
call fcn.1400027a0
mov dword [rsp + 0x94], esi
cmp esi, eax
je 0x140002080
mov ecx, dword [rsp + 0x94]
mov rbp, qword [0x1400061d8]
mov rax, qword [rsp + 0x70]
mov esi, dword [rax + 8]
or rsi, qword [rsp + 0x240]
mov edx, ecx
call fcn.1400027a0
mov rbx, rax
mov ecx, dword [rsp + 0x13c]
mov edx, 0x96
mov r8d, 0x89
call fcn.1400027a0
mov rcx, rsi
mov rdx, rbx
mov r8d, eax
mov r9, r14
call rbp
jmp 0x140002080
mov rax, qword [rsp + 0x200]
mov esi, dword [rax]
xor ecx, ecx
mov edx, esi
call fcn.1400027a0
mov ecx, dword [rsp + 0xc0]
add rcx, qword [rsp + 0x40]
mov qword [rsp + 0x258], rcx
cmp esi, eax
jne 0x14000233e
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x258]
mov qword [rax + 0x48], rcx
jmp 0x14000239d
mov rax, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx]
mov rcx, qword [rsp + 0x80]
call qword [rax]
jmp 0x140002374
mov ecx, 1
mov edx, 0xcd
mov r8d, 0xa9f92a
call fcn.1400027a0
mov rbp, qword [rsp + 0x258]
mov rcx, qword [rsp + 0x40]
mov edx, eax
mov r8, r12
call rbp
mov esi, eax
xor ecx, ecx
call fcn.1400027a0
cmp esi, eax
jne 0x140002389
mov rcx, qword [rsp + 0x28]
call fcn.1400023f0
mov qword [rsp + 0x38], 0
jmp 0x1400023a7
mov ecx, 1
call fcn.1400027a0
mov rcx, qword [rsp + 0x288]
mov dword [rcx], eax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
add rsp, 0x2a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret