Function at 0x140001030
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2b8
lea rax, [rcx + 0x3c]
mov qword [rsp + 0x1e8], rax
mov rax, qword [rsp + 0x1e8]
movsxd rax, dword [rax]
add rax, rcx
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
cmp dword [rax], 0x4550
mov qword [rsp + 0x40], 0
jne 0x1400024c0
mov r12, r9
mov r13, r8
mov rbp, rdx
mov r14, rcx
mov rax, qword [rsp + 0xe8]
add rax, 4
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
movzx esi, word [rax]
mov ecx, 0x14c
call fcn.140002ae0
mov qword [rsp + 0x40], 0
cmp si, ax
je 0x1400024c0
mov qword [rsp + 0x290], rbp
mov r15, qword [0x1400071d0]
mov rax, qword [rsp + 0xe8]
add rax, 0x18
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x110]
add rax, 0x38
mov qword [rsp + 0x1f8], rax
mov rax, qword [rsp + 0x1f8]
mov ebp, dword [rax]
mov rax, qword [rsp + 0x110]
add rax, 0x18
mov qword [rsp + 0x200], rax
mov rax, qword [rsp + 0x200]
mov rsi, qword [rax]
mov r8d, 3
mov rcx, rbp
mov edx, ebp
call fcn.140002ae0
mov rbx, rax
mov ecx, 0x3000
mov edx, 0xc9
call fcn.140002ae0
mov rdi, rax
mov ecx, 0x40
mov edx, ebp
call fcn.140002ae0
mov rcx, rsi
mov rdx, rbx
mov r8d, edi
mov r9d, eax
call r15
mov r15, r12
mov r12, r13
mov r13, qword [rsp + 0x290]
mov qword [rsp + 0x1e0], rax
test rax, rax
jne 0x1400011fd
mov rbp, qword [0x1400071d0]
mov rax, qword [rsp + 0x1f8]
mov esi, dword [rax]
mov rcx, rsi
mov edx, esi
mov r8d, esi
call fcn.140002ae0
mov rdi, rax
mov dword [rsp + 0x20], esi
mov ecx, 0x3000
mov edx, esi
mov r8d, esi
mov r9d, esi
call fcn.140002ae0
mov rbx, rax
mov ecx, 0x40
mov edx, 0x61
mov r9d, 0x1d
mov r8d, esi
call fcn.140002ae0
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, eax
call rbp
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x40], 0
test rax, rax
je 0x1400024c0
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rsi, rax
xor ecx, ecx
call fcn.140002ae0
mov rdi, rax
mov ecx, 0x50
mov edx, 0x82
mov r8d, 0x82
mov r9d, 0x11
call fcn.140002ae0
mov rcx, rsi
mov edx, edi
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140001677
mov rdi, qword [rsp + 0x320]
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
mov rax, qword [rsp + 0x30]
add rax, 0x18
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0x30]
add rax, 0x10
mov qword [rsp + 0x208], rax
mov rax, qword [rsp + 0x30]
add rax, 0x1c
mov qword [rsp + 0x298], rax
mov rax, qword [rsp + 0x1f0]
mov rcx, qword [rsp + 0x208]
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
movzx ebp, word [rax + 0x12]
mov ecx, 0xd
call fcn.140002ae0
mov esi, ebp
mov ecx, eax
shr esi, cl
mov ecx, 1
mov edx, 0xdc
mov r8d, ebp
call fcn.140002ae0
and eax, esi
mov rcx, qword [rsp + 0x30]
add rcx, 0x20
mov qword [rsp + 0x210], rcx
mov rcx, qword [rsp + 0x210]
mov dword [rcx], eax
mov rax, qword [rsp + 0x30]
add rax, 0x28
mov qword [rsp + 0x218], rax
mov rax, qword [rsp + 0x218]
mov qword [rax], r13
mov rax, qword [rsp + 0x30]
add rax, 0x30
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x120]
mov qword [rax], r12
mov r12, rdi
mov rax, qword [rsp + 0x30]
add rax, 0x38
mov qword [rsp + 0x220], rax
mov rax, qword [rsp + 0x220]
mov qword [rax], r15
mov rax, qword [rsp + 0x30]
add rax, 0x40
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rax], rdi
mov r15, qword [0x1400071d0]
mov rbx, qword [rsp + 0x110]
mov ecx, dword [rbx + 0x3c]
mov r8d, 0xf6
mov edx, ebp
call fcn.140002ae0
mov rsi, rax
mov ecx, 0x1000
call fcn.140002ae0
mov rdi, rax
mov word [rsp + 0x20], bp
mov ecx, 4
mov edx, 0x9d
mov r8d, ebp
mov r9d, ebp
call fcn.140002ae0
mov rcx, qword [rsp + 0x48]
mov rdx, rsi
mov r8d, edi
mov r9d, eax
call r15
mov rsi, rax
mov r8d, dword [rbx + 0x3c]
mov rcx, rax
mov rdx, r14
call fcn.140002ab0
mov rax, qword [rsp + 0x1e8]
movsxd rax, dword [rax]
lea rcx, [rsi + rax]
mov rdx, qword [rsp + 0x30]
mov qword [rdx], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rsi + rax + 0x30], rcx
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
movzx esi, word [rax + 6]
mov edx, 0x472075
xor ecx, ecx
call fcn.140002ae0
mov rcx, qword [rsp + 0xf0]
mov qword [rsp + 0x1d0], rcx
cmp si, ax
je 0x1400016da
mov rsi, qword [rsp + 0xf0]
mov ecx, 0x18
mov rdx, rsi
mov r8, rsi
call fcn.140002ae0
add rax, rsi
mov rcx, qword [rsp + 0xf0]
movzx ecx, word [rcx + 0x14]
add rcx, rax
mov rax, qword [rsp + 0xe8]
add rax, 0x38
mov qword [rsp + 0x2a0], rax
mov qword [rsp + 0x1d8], rcx
mov dword [rsp + 0xb4], 0
jmp 0x14000158b
mov r15, qword [0x1400071d0]
mov esi, dword [rsp + 0xb8]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov edi, dword [rcx + 0xc]
add rdi, qword [rax]
mov rcx, rsi
mov rdx, rsi
call fcn.140002ae0
mov rbp, rax
mov qword [rsp + 0x20], 0x30
mov ecx, 0x1000
mov rdx, rsi
mov r8, rsi
mov r9, rsi
call fcn.140002ae0
mov rbx, rax
mov ecx, 0x40
mov rdx, rsi
mov r8, rsi
call fcn.140002ae0
mov rcx, rdi
mov rdx, rbp
mov r8d, ebx
mov r9d, eax
call r15
mov rsi, rax
mov rax, qword [rsp + 0x58]
mov edx, dword [rax + 0x14]
add rdx, r14
mov rax, qword [rsp + 0x228]
mov r8d, dword [rax]
mov rcx, rsi
call fcn.140002ab0
mov rax, qword [rsp + 0x58]
mov dword [rax + 8], esi
mov ecx, 1
mov edx, 0xf5
mov r8d, 0x93
call fcn.140002ae0
add eax, dword [rsp + 0xd4]
mov rcx, qword [rsp + 0x58]
add rcx, 0x28
mov rdx, qword [rsp + 0x30]
mov rdx, qword [rdx]
mov qword [rsp + 0x128], rdx
mov rdx, qword [rsp + 0x128]
movzx edx, word [rdx + 6]
mov qword [rsp + 0x1d8], rcx
mov dword [rsp + 0xb4], eax
cmp eax, edx
jae 0x1400016a6
mov eax, dword [rsp + 0xb4]
mov dword [rsp + 0xd4], eax
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
add rax, 0x10
mov qword [rsp + 0x228], rax
mov rax, qword [rsp + 0x228]
mov eax, dword [rax]
mov dword [rsp + 0xb8], eax
mov edx, dword [rsp + 0xd4]
mov dword [rsp + 0x20], edx
mov r8d, 0x75
xor ecx, ecx
mov r9d, edx
call fcn.140002ae0
mov ecx, dword [rsp + 0xb8]
cmp ecx, eax
jne 0x1400014a0
mov rax, qword [rsp + 0x2a0]
mov eax, dword [rax]
mov dword [rsp + 0x64], eax
mov edx, dword [rsp + 0x64]
xor ecx, ecx
mov r8d, edx
call fcn.140002ae0
mov ecx, dword [rsp + 0x64]
cmp ecx, eax
jle 0x140001533
mov rbx, qword [0x1400071d0]
mov esi, dword [rsp + 0x64]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov edi, dword [rcx + 0xc]
add rdi, qword [rax]
mov ecx, 0x1000
mov rdx, rsi
call fcn.140002ae0
mov rbp, rax
mov ecx, 0x40
call fcn.140002ae0
mov rcx, rdi
mov rdx, rsi
mov r8d, ebp
mov r9d, eax
call rbx
mov rcx, qword [rsp + 0x58]
mov dword [rcx + 8], eax
mov rcx, rax
xor edx, edx
mov r8, rsi
call fcn.140002760
jmp 0x140001533
xor ecx, ecx
call fcn.140002ae0
mov rsi, rax
mov ecx, 0x8000
mov edx, 0x270ef388
call fcn.140002ae0
mov rcx, qword [rsp + 0x48]
mov rdx, rsi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140002486
cmp qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x128]
mov qword [rsp + 0x1d0], rax
mov dword [rsp + 0x3c], 1
mov qword [rsp + 0xe0], rcx
je 0x140001a4f
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x200]
mov rsi, qword [rax]
xor ecx, ecx
mov rdx, rsi
mov r8, rsi
mov r9, rsi
call fcn.140002ae0
sub rax, rsi
add rax, qword [rsp + 0x48]
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0xf8]
mov edi, dword [rax + 0xb4]
mov edx, 0x23
mov r9d, 0x75
xor ecx, ecx
mov r8, rsi
call fcn.140002ae0
mov dword [rsp + 0x3c], 0
mov rcx, qword [rsp + 0xf8]
mov qword [rsp + 0xe0], rcx
cmp edi, eax
je 0x140001a4f
mov rax, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x50]
mov r9d, dword [rax + 0xb0]
mov rax, r9
add rax, qword [rcx]
mov qword [rsp + 0x238], rax
mov rax, qword [rsp + 0x238]
mov eax, dword [rax]
mov dword [rsp + 0xbc], eax
mov qword [rsp + 0x20], 0x8b
mov edx, 0xa5
mov r8d, 0x60
xor ecx, ecx
call fcn.140002ae0
mov ecx, dword [rsp + 0xbc]
mov dword [rsp + 0x3c], 1
mov rdx, qword [rsp + 0xf8]
mov qword [rsp + 0xe0], rdx
cmp ecx, eax
je 0x140001a4f
movabs r14, 0x1fffffff8
mov rax, qword [rsp + 0x230]
mov dword [rsp + 0x144], eax
mov rax, qword [rsp + 0x238]
mov ecx, dword [rsp + 0xbc]
mov dword [rsp + 0xb0], ecx
mov qword [rsp + 0x1c8], rax
jmp 0x140001864
mov eax, dword [rsp + 0xc4]
mov qword [rsp + 0x1c0], rax
mov r8, qword [rsp + 0x1c0]
mov rdi, qword [rsp + 0x138]
mov ebx, dword [rdi + r8]
add rdi, r8
mov qword [rsp + 0x20], r8
mov edx, 0x15
mov r9d, 0x4d
xor ecx, ecx
call fcn.140002ae0
mov dword [rsp + 0xb0], ebx
mov qword [rsp + 0x1c8], rdi
cmp ebx, eax
je 0x140001a37
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x138], rax
mov edi, dword [rsp + 0xb0]
mov rax, qword [rsp + 0x50]
mov rcx, rdi
add rcx, qword [rax]
mov qword [rsp + 0x240], rcx
mov rax, qword [rsp + 0x138]
add rax, 4
mov qword [rsp + 0x248], rax
mov rax, qword [rsp + 0x248]
mov ebp, dword [rax]
mov rcx, r14
call fcn.140002ae0
mov rbx, rax
add rbx, rbp
mov ecx, 1
mov r8d, 0xb3
mov edx, edi
call fcn.140002ae0
mov ecx, eax
shr rbx, cl
mov edx, 0xa9
xor ecx, ecx
mov r8d, edi
call fcn.140002ae0
mov qword [rsp + 0x1c0], rbp
cmp ebx, eax
jle 0x14000181f
mov rax, qword [rsp + 0x138]
add rax, 8
mov dword [rsp + 0xac], 0
mov qword [rsp + 0x1b8], rax
jmp 0x1400019be
mov eax, dword [rsp + 0xc0]
mov rcx, qword [rsp + 0x240]
mov rdx, qword [rcx + rax]
add rdx, qword [rsp + 0x230]
mov qword [rcx + rax], rdx
mov ecx, 1
call fcn.140002ae0
mov rdi, rax
add edi, dword [rsp + 0x14c]
mov rbp, qword [rsp + 0x270]
add rbp, 2
mov rax, qword [rsp + 0x248]
mov eax, dword [rax]
mov dword [rsp + 0xc4], eax
mov esi, dword [rsp + 0xc4]
mov r8d, 0xfb
mov rcx, r14
mov edx, edi
call fcn.140002ae0
mov rbx, rax
add rbx, rsi
mov ecx, 1
mov edx, 0xf0
mov r8d, 0x3e
call fcn.140002ae0
mov ecx, eax
shr rbx, cl
mov dword [rsp + 0xac], edi
mov qword [rsp + 0x1b8], rbp
cmp edi, ebx
jge 0x140001810
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x270], rax
mov eax, dword [rsp + 0xac]
mov dword [rsp + 0x14c], eax
mov rax, qword [rsp + 0x270]
movzx edi, word [rax]
mov ecx, 0xc
call fcn.140002ae0
mov edx, edi
mov ecx, eax
shr edx, cl
and edi, 0xfff
mov dword [rsp + 0xc0], edi
cmp edx, 0xa
je 0x140001920
cmp edx, 3
jne 0x14000193f
mov eax, dword [rsp + 0xc0]
mov rcx, qword [rsp + 0x240]
mov edx, dword [rcx + rax]
add edx, dword [rsp + 0x144]
mov dword [rcx + rax], edx
jmp 0x14000193f
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov dword [rsp + 0x3c], 1
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x278], rax
mov edx, dword [rsp + 0x3c]
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x24], edx
mov rax, qword [rsp + 0x278]
mov esi, dword [rax + 0x94]
xor ecx, ecx
mov r8d, edx
mov r9d, edx
call fcn.140002ae0
cmp esi, eax
je 0x140001e88
mov rax, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
mov qword [rsp + 0x70], rcx
mov esi, dword [rax + 0x90]
mov rdi, rsi
add rdi, qword [rsp + 0x70]
mov ecx, 0x14
mov edx, esi
call fcn.140002ae0
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
mov ebx, eax
xor ecx, ecx
mov edx, esi
call fcn.140002ae0
mov qword [rsp + 0x1b0], rdi
cmp ebx, eax
jne 0x140001e88
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
jmp 0x140001b33
mov rsi, qword [rsp + 0x98]
add rsi, 0x14
mov ecx, 0x14
mov edx, 0x33
call fcn.140002ae0
mov rcx, rsi
mov rdx, rax
call r14
mov edi, eax
xor ecx, ecx
mov edx, eax
call fcn.140002ae0
mov qword [rsp + 0x1b0], rsi
cmp edi, eax
jne 0x140001e88
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x68], eax
mov edx, dword [rsp + 0x68]
mov r8d, 0xaebac8
xor ecx, ecx
call fcn.140002ae0
mov ecx, dword [rsp + 0x68]
cmp ecx, eax
je 0x140001e88
mov rax, qword [rsp + 0x218]
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rcx]
mov ecx, dword [rsp + 0x68]
add rcx, qword [rsp + 0x70]
call qword [rax]
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x90], 0
je 0x14000247c
mov rax, qword [rsp + 0x118]
mov esi, dword [rax]
mov ecx, 1
mov edx, esi
call fcn.140002ae0
add eax, esi
movsxd rdi, eax
mov ecx, 3
mov r8d, 0x9dfd7c
mov edx, esi
call fcn.140002ae0
mov ecx, eax
shl rdi, cl
mov edx, 0xb5
mov r8d, 0x3c0949
mov rcx, rdi
mov r9d, esi
call fcn.140002ae0
mov rdi, rax
mov dword [rsp + 0x20], esi
mov ecx, 0x1000
mov edx, esi
mov r8d, esi
mov r9d, esi
call fcn.140002ae0
mov rsi, rax
mov ecx, 4
mov edx, 0x91ff57
mov r8d, 0x80
call fcn.140002ae0
xor ecx, ecx
mov rdx, rdi
mov r8d, esi
mov r9d, eax
call rbx
mov qword [rsp + 0x130], rax
cmp qword [rsp + 0x130], 0
je 0x140002404
mov rax, qword [rsp + 0x208]
mov rcx, qword [rsp + 0x130]
mov qword [rax], rcx
mov rax, qword [rsp + 0x118]
movsxd rsi, dword [rax]
mov ecx, 1
mov edx, esi
mov r8d, esi
call fcn.140002ae0
add eax, esi
mov rcx, qword [rsp + 0x118]
mov dword [rcx], eax
mov rax, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x90]
mov qword [rax + rsi*8], rcx
mov rax, qword [rsp + 0x98]
mov eax, dword [rax]
mov dword [rsp + 0xc8], eax
mov edx, 0xa3
xor ecx, ecx
call fcn.140002ae0
mov ecx, dword [rsp + 0xc8]
cmp ecx, eax
jne 0x140001cd8
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x10]
add rax, qword [rsp + 0x70]
mov qword [rsp + 0x1a8], rax
mov qword [rsp + 0x1a0], rax
jmp 0x140001d04
mov eax, dword [rsp + 0xc8]
add rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x98]
mov ecx, dword [rcx + 0x10]
add rcx, qword [rsp + 0x70]
mov qword [rsp + 0x1a8], rax
mov qword [rsp + 0x1a0], rcx
mov rdi, qword [rsp + 0x1a0]
mov rbp, qword [rsp + 0x1a8]
mov rsi, qword [rbp]
mov edx, 0x62
xor ecx, ecx
mov r8, rsi
mov r9, rsi
call fcn.140002ae0
mov qword [rsp + 0x198], rsi
mov qword [rsp + 0x190], rdi
mov qword [rsp + 0x188], rbp
cmp rsi, rax
je 0x140001af4
nop dword [rax + rax]
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x2a8], rax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x280], rax
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x100], rax
mov rdx, qword [rsp + 0x100]
mov r8d, 0xa
mov rcx, 0xffffffffffffffff
call fcn.140002ae0
mov rcx, qword [rsp + 0x100]
cmp rcx, rax
jle 0x140001de0
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x100]
mov rbp, qword [rsp + 0x120]
mov rdx, qword [rsp + 0x88]
mov r8, qword [rdx]
lea rdx, [rax + rcx]
add rdx, 2
mov rcx, qword [rsp + 0x90]
call qword [rbp]
jmp 0x140001e18
mov rax, qword [rsp + 0x120]
mov rdi, qword [rax]
mov rax, qword [rsp + 0x88]
mov rsi, qword [rax]
mov ecx, 0xffff
call fcn.140002ae0
and rax, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x90]
mov rdx, rax
mov r8, rsi
call rdi
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x280]
mov qword [rcx], rax
test rax, rax
je 0x140002404
mov rdi, qword [rsp + 0x2a8]
mov rbp, qword [rsp + 0x280]
add rbp, 8
mov rsi, qword [rdi + 8]
add rdi, 8
xor ecx, ecx
mov rdx, rsi
call fcn.140002ae0
mov qword [rsp + 0x198], rsi
mov qword [rsp + 0x190], rbp
mov qword [rsp + 0x188], rdi
cmp rsi, rax
jne 0x140001d50
jmp 0x140001af4
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov rsi, qword [rax + 0x30]
movabs rcx, 0xffffffff00000000
mov rdx, rsi
call fcn.140002ae0
and rax, rsi
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x78]
movzx edi, word [rax + 6]
mov qword [rsp + 0x20], rsi
mov r8d, 0x51
xor ecx, ecx
mov rdx, rsi
mov r9, rsi
call fcn.140002ae0
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x160], rcx
cmp di, ax
jne 0x140002071
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x258], rax
mov rax, qword [rsp + 0x108]
mov eax, dword [rax + 0xd0]
mov dword [rsp + 0xcc], eax
mov edx, 0x96
xor ecx, ecx
call fcn.140002ae0
mov ecx, dword [rsp + 0xcc]
mov rdx, qword [rsp + 0x108]
mov qword [rsp + 0xd8], rdx
cmp ecx, eax
je 0x140002037
mov eax, dword [rsp + 0xcc]
mov rcx, qword [rsp + 0x258]
mov rax, qword [rcx + rax + 0x18]
mov qword [rsp + 0x260], rax
xor ecx, ecx
call fcn.140002ae0
mov rcx, qword [rsp + 0x260]
mov rdx, qword [rsp + 0x108]
mov qword [rsp + 0xd8], rdx
cmp rcx, rax
je 0x140002037
mov rax, qword [rsp + 0x260]
mov rcx, qword [rax]
mov qword [rsp + 0x158], rcx
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0xd8], rax
test rcx, rcx
je 0x140002037
nop word cs:[rax + rax]
mov rsi, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x158]
mov ecx, 1
mov edx, 0x3537d57a
mov r8d, 0xb6
mov r9d, 0xf3
call fcn.140002ae0
mov rcx, qword [rsp + 0x258]
mov edx, eax
xor r8d, r8d
call rdi
mov rax, qword [rsi + 8]
add rsi, 8
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x150], rsi
test rax, rax
jne 0x140001fd0
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xd8]
mov eax, dword [rax + 0x28]
mov dword [rsp + 0xd0], eax
xor ecx, ecx
call fcn.140002ae0
mov ecx, dword [rsp + 0xd0]
cmp ecx, eax
jne 0x1400023c3
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x48], 0
jmp 0x1400024b6
mov rsi, qword [rsp + 0x78]
mov ecx, 0x18
mov edx, 0xb7
call fcn.140002ae0
add rax, rsi
mov rcx, qword [rsp + 0x78]
movzx ecx, word [rcx + 0x14]
add rcx, rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x178], rax
mov qword [rsp + 0x170], rcx
mov dword [rsp + 0xa8], 0
lea r15, section..rdata
lea r14, [rsp + 0x2b4]
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14000216b
mov rax, qword [rsp + 0x80]
mov esi, dword [rax + 0x10]
mov rax, qword [rsp + 0x80]
mov ebx, dword [rax + 8]
or rbx, qword [rsp + 0x250]
mov rcx, rsi
call fcn.140002ae0
mov rbp, rax
mov ecx, 0xc000
mov edx, esi
mov r8d, esi
call fcn.140002ae0
mov rcx, rbx
mov rdx, rbp
mov r8d, eax
call rdi
mov ecx, 1
mov edx, 0x1442eefd
mov r8d, 0xcc
call fcn.140002ae0
add eax, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0x80]
add rcx, 0x28
mov rdx, qword [rsp + 0x30]
mov rdx, qword [rdx]
movzx ebp, word [rdx + 6]
mov qword [rsp + 0x178], rdx
mov qword [rsp + 0x170], rcx
mov dword [rsp + 0xa8], eax
mov qword [rsp + 0x160], rdx
cmp eax, ebp
jae 0x140001ef2
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x288], rax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x24]
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x6c]
mov ecx, 0x2000000
mov r8d, 0xd05154
call fcn.140002ae0
mov rsi, rax
and esi, dword [rsp + 0x38]
mov edx, dword [rsp + 0x6c]
mov r8d, 0xb6
mov r9d, 0xc
xor ecx, ecx
call fcn.140002ae0
cmp esi, eax
jne 0x1400020d0
mov ecx, 0x1f
mov edx, 0xd0
mov r8d, 0x33a27435
mov r9d, 0x27957bbb
call fcn.140002ae0
mov esi, dword [rsp + 0x38]
mov ecx, eax
shr rsi, cl
mov dword [rsp + 0x20], esi
mov ecx, 0x1e
mov r8d, 0x4d86af
mov r9d, 0x91
mov edx, esi
call fcn.140002ae0
mov ebx, dword [rsp + 0x38]
mov ecx, eax
shr rbx, cl
mov ecx, 1
mov edx, esi
mov r8d, esi
call fcn.140002ae0
and ebx, eax
mov ecx, 0x1d
mov edx, esi
call fcn.140002ae0
mov ebp, dword [rsp + 0x38]
mov ecx, eax
shr rbp, cl
mov ecx, 1
mov edx, 0x715ead
mov r8d, esi
call fcn.140002ae0
and ebp, eax
shl rbp, 4
add rbp, r15
lea rbx, [rbx*8]
add rbx, rbp
mov ecx, 0x11
mov r8d, 0x9484d9
mov edx, esi
call fcn.140002ae0
mov ebp, dword [rsp + 0x38]
mov ecx, eax
shr ebp, cl
mov ecx, 0x200
call fcn.140002ae0
and eax, ebp
or eax, dword [rbx + rsi*4]
mov dword [rsp + 0x148], eax
mov rax, qword [rsp + 0x80]
mov ebx, dword [rax + 0x10]
xor ecx, ecx
mov edx, esi
call fcn.140002ae0
mov dword [rsp + 0xa4], ebx
cmp ebx, eax
jne 0x140002373
mov ecx, 0x40
mov edx, 0x21
mov r8d, 0xdf
mov r9d, 0xa5
call fcn.140002ae0
mov rsi, rax
and esi, dword [rsp + 0x38]
mov edx, 0x3d
xor ecx, ecx
mov r8d, esi
call fcn.140002ae0
cmp esi, eax
jne 0x14000233a
mov ecx, 0x80
mov edx, 0x223e2f2b
mov r8d, 0x30
call fcn.140002ae0
mov rsi, rax
and esi, dword [rsp + 0x38]
mov edx, 0xc3
xor ecx, ecx
call fcn.140002ae0
cmp esi, eax
je 0x140002113
mov rax, qword [rsp + 0x288]
add rax, 0x24
jmp 0x140002346
mov rax, qword [rsp + 0x288]
add rax, 0x20
mov qword [rsp + 0x168], rax
mov rax, qword [rsp + 0x168]
mov esi, dword [rax]
mov edx, 0x43
xor ecx, ecx
call fcn.140002ae0
mov dword [rsp + 0xa4], esi
cmp esi, eax
je 0x140002113
mov ecx, dword [rsp + 0xa4]
mov rbp, qword [0x1400071d8]
mov rax, qword [rsp + 0x80]
mov esi, dword [rax + 8]
or rsi, qword [rsp + 0x250]
mov edx, 0x61
mov r8d, ecx
call fcn.140002ae0
mov rbx, rax
mov ecx, dword [rsp + 0x148]
call fcn.140002ae0
mov rcx, rsi
mov rdx, rbx
mov r8d, eax
mov r9, r14
call rbp
jmp 0x140002113
mov rax, qword [rsp + 0x210]
mov esi, dword [rax]
xor ecx, ecx
mov edx, esi
call fcn.140002ae0
mov ecx, dword [rsp + 0xd0]
add rcx, qword [rsp + 0x48]
mov qword [rsp + 0x268], rcx
cmp esi, eax
jne 0x140002423
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x268]
mov qword [rax + 0x48], rcx
jmp 0x1400024b6
mov rax, qword [rsp + 0x220]
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rcx]
mov rcx, qword [rsp + 0x90]
call qword [rax]
jmp 0x14000247c
mov qword [rsp + 0x28], 0xe8
mov qword [rsp + 0x20], 0xd2
mov ecx, 1
mov edx, 0xc7
mov r8d, 0xb5
mov r9d, 0x28
call fcn.140002ae0
mov rbp, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x48]
mov edx, eax
mov r8, r12
call rbp
mov esi, eax
mov edx, 0x49
xor ecx, ecx
mov r8d, eax
mov r9d, eax
call fcn.140002ae0
cmp esi, eax
jne 0x140002491
mov rcx, qword [rsp + 0x30]
call fcn.140002510
mov qword [rsp + 0x40], 0
jmp 0x1400024c0
mov ecx, 1
mov edx, 0xee
mov r8d, 0x2850f8f5
mov r9d, 0xd2
call fcn.140002ae0
mov rcx, qword [rsp + 0x298]
mov dword [rcx], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
add rsp, 0x2b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret