Function at 0x503d80
Capabilities:
Allocate or change rwx memory
Check os version
Execute shellcode via indirect call

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x290
mov rbp, rsp
mov qword [rbp + 0x98], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0x150], 0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0xb8], rbp
lea rcx, [rbp + 0x168]
mov rdx, qword [0x00430b10]
call fcn.00412bc0
nop
lea rcx, [rbp + 0x150]
mov rdx, qword [0x004220f0]
call fcn.00413ec0
lea rcx, [rbp + 0x110]
call sub.kernel32.dll_QueryPerformanceCounter
test eax, eax
je 0x503e50
lea rcx, [rbp + 0x108]
call sub.kernel32.dll_QueryPerformanceFrequency
test eax, eax
je 0x503e50
mov ecx, 0x3e8
mov rax, qword [rbp + 0x108]
cqo
idiv rcx
mov rcx, rax
mov rax, qword [rbp + 0x110]
cqo
idiv rcx
mov qword [0x00b2dcc0], rax
mov rcx, qword [0x00b2dcb0]
lea rdx, [0x005057ec]
call fcn.0041f960
test rax, rax
setne al
mov byte [0x00b2dcc8], al
call sub.kernel32.dll_GetVersion
cmp al, 6
jb 0x503e9b
lea rcx, [0x0050582a]
call sub.kernel32.dll_LoadLibraryA
mov rcx, rax
lea rdx, [0x00505838]
call fcn.0041f960
mov qword [0x00b2dd00], rax
mov rax, qword [0x00bb6470]
lea rcx, [fcn.00503060]
mov qword [rax], rcx
mov rax, qword [0x00bb6dd8]
lea rcx, [0x004bf0a0]
mov qword [rax], rcx
mov rax, qword [0x00bb8d00]
lea rcx, [0x004bfb00]
mov qword [rax], rcx
mov rax, qword [0x00bb7d28]
lea rcx, [0x00503200]
mov qword [rax], rcx
lea rcx, [0x00505850]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x0050586a]
call fcn.0041f960
mov qword [0x00b2dd18], rax
lea rcx, [0x00505880]
call sub.kernel32.dll_GetModuleHandleW
mov rcx, rax
lea rdx, [0x00505894]
call fcn.0041f960
mov qword [0x00b2dd20], rax
lea rcx, [rbp + 0xb0]
mov rdx, qword [0x00b2dcb0]
call fcn.004c6460
lea rcx, [0x00b2f240]
mov rdx, qword [rbp + 0xb0]
call fcn.00415fa0
mov rcx, qword [0x00b2f240]
mov rax, qword [0x00b2f240]
mov rax, qword [rax]
call qword [rax + 0x6d0]
test al, al
je 0x503fe9
mov rcx, qword [0x00b2f240]
mov rax, qword [0x00b2f240]
mov rax, qword [rax]
call qword [rax + 0x6d8]
test al, al
je 0x503fe9
mov rcx, qword [0x00b2f240]
mov rax, qword [0x00b2f240]
mov rax, qword [rax]
call qword [rax + 0x6f0]
test al, al
je 0x503fe9
mov rcx, rbp
mov rdx, qword [0x00b2dcb0]
call fcn.005033f0
mov rcx, qword [0x00b2f240]
mov rax, qword [0x00b2f240]
mov rax, qword [rax]
call qword [rax + 0x18]
cmp rax, qword [0x00b2dcb0]
je 0x503fe9
mov rcx, qword [0x00b2f240]
mov rax, qword [0x00b2f240]
mov rax, qword [rax]
call qword [rax + 0x18]
mov rcx, rbp
mov rdx, rax
call fcn.005033f0
mov rcx, rbp
call fcn.00503c10
lea rcx, [0x00bc37d0]
call sub.kernel32.dll_InitializeCriticalSection
lea rcx, [0x00bc37a8]
call sub.kernel32.dll_InitializeCriticalSection
mov rcx, qword [0x00b2f240]
mov rax, qword [0x00b2f240]
mov rax, qword [rax]
call qword [rax + 0x6d0]
test al, al
je 0x505683
lea rcx, [rbp + 0xf0]
lea rdx, [rbp + 0xc8]
call fcn.004aab30
xor rcx, rcx
call sub.kernel32.dll_SetLastError
call sub.kernel32.dll_GetCurrentProcessId
lea rcx, [rbp + 0xa0]
mov edx, eax
mov r8d, 1
mov r9b, 0x30
call fcn.00425850
lea rcx, [rbp + 0xa8]
lea rdx, [0x005058bc]
mov r8, qword [rbp + 0xa0]
call fcn.00410f60
mov rcx, qword [rbp + 0xa8]
call fcn.00411320
or rcx, 0xffffffffffffffff
lea rdx, [rbp + 0xf0]
mov r8d, 4
xor r9, r9
mov dword [rsp + 0x20], 8
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateFileMappingA
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x158], 0
je 0x504136
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x5040d9
mov rcx, qword [rbp + 0x158]
call sub.kernel32.dll_CloseHandle
jmp 0x504136
mov rcx, qword [rbp + 0x158]
mov edx, 0xf001f
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_MapViewOfFile
mov qword [rbp + 0x1e0], rax
cmp qword [rbp + 0x1e0], 0
je 0x504128
mov rax, qword [rbp + 0x1e0]
lea rcx, [0x00502a00]
mov qword [rax], rcx
mov rcx, qword [rbp + 0x1e0]
call sub.kernel32.dll_UnmapViewOfFile
mov rax, qword [rbp + 0x158]
mov qword [0x00b33b78], rax
call sub.kernel32.dll_GetCurrentProcessId
lea rcx, [rbp + 0x90]
mov edx, eax
mov r8d, 1
mov r9b, 0x30
call fcn.00425ad0
lea rcx, [rbp + 0x98]
lea rdx, [0x005058d8]
mov r8, qword [rbp + 0x90]
call fcn.00410f60
mov rcx, qword [rbp + 0x98]
call fcn.00411320
or rcx, 0xffffffffffffffff
lea rdx, [rbp + 0xf0]
mov r8d, 4
xor r9, r9
mov dword [rsp + 0x20], 0x24
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateFileMappingA
mov qword [rbp + 0x158], rax
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x5042a3
mov rcx, qword [rbp + 0x158]
mov edx, 0xf001f
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_MapViewOfFile
mov qword [0x00b2dd10], rax
mov rax, qword [0x00b2dd10]
mov dword [rax + 0x18], 1
xor rcx, rcx
xor rdx, rdx
xor r8, r8
call fcn.0041f340
mov rcx, qword [0x00b2dd10]
mov qword [rcx], rax
xor rcx, rcx
xor rdx, rdx
xor r8, r8
call fcn.0041f340
mov rcx, qword [0x00b2dd10]
mov qword [rcx + 8], rax
mov rax, qword [0x00b2dd10]
mov qword [rax + 0x10], 0
mov rax, qword [0x00b2dd10]
mov rcx, qword [rbp + 0x158]
mov qword [rax + 0x1c], rcx
lea rcx, [rbp + 0x150]
call fcn.004a9130
cmp qword [rbp + 0x150], 0
je 0x504292
mov rax, qword [rbp + 0x150]
mov eax, dword [rax]
mov dword [0x00b2db30], eax
mov rax, qword [rbp + 0x150]
mov ecx, dword [rax]
xor rdx, rdx
lea r8, [0x005058fc]
xor r9, r9
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
call fcn.004ab870
jmp 0x504314
mov rax, qword [0x00bb8ed8]
mov eax, dword [rax]
mov dword [0x00b2db30], eax
jmp 0x504314
cmp qword [rbp + 0x158], 0
je 0x5042f3
mov rcx, qword [rbp + 0x158]
mov edx, 0xf001f
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_MapViewOfFile
mov qword [0x00b2dd10], rax
mov rcx, qword [rbp + 0x158]
call sub.kernel32.dll_CloseHandle
mov rax, qword [0x00b2dd10]
lea rcx, [rax + 0x18]
call fcn.0041f650
jmp 0x504314
xor rcx, rcx
lea rdx, [0x00505914]
lea r8, [0x0050593b]
xor r9, r9
call sub.user32.dll_MessageBoxA
xor rcx, rcx
call sub.kernel32.dll_ExitProcess
cmp qword [0x00b2dd10], 0
jne 0x50433f
xor rcx, rcx
lea rdx, [0x00505945]
lea r8, [0x0050593b]
xor r9, r9
call sub.user32.dll_MessageBoxA
xor rcx, rcx
call sub.kernel32.dll_ExitProcess
cmp dword [0x00b2db30], 0
jne 0x5043d1
mov rax, qword [0x00b2dd10]
mov rcx, qword [rax + 8]
or edx, 0xffffffff
call sub.kernel32.dll_WaitForSingleObject
nop
mov rax, qword [0x00b2dd10]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x118], rax
cmp qword [rbp + 0x118], 0
je 0x5043a7
mov rax, qword [rbp + 0x118]
mov eax, dword [rax]
mov dword [0x00b2db30], eax
mov rax, qword [rbp + 0x118]
mov rax, qword [rax + 0xc]
mov qword [rbp + 0x118], rax
cmp qword [rbp + 0x118], 0
jne 0x50437c
nop
nop
mov rax, qword [0x00b2dd10]
mov rcx, qword [rax + 8]
call sub.kernel32.dll_ReleaseMutex
cmp dword [0x00b2db30], 0
jne 0x5043d1
mov rax, qword [0x00bb8ed8]
mov eax, dword [rax]
mov dword [0x00b2db30], eax
xor rcx, rcx
call sub.kernel32.dll_GetModuleHandleW
cmp qword [0x00b2dcb0], rax
je 0x5043f0
cmp byte [0x00b2dcc8], 0
jne 0x5043f0
xor rax, rax
jmp 0x5043f2
mov al, 1
mov byte [rbp + 0x12f], al
mov rcx, qword [0x00b2f240]
mov rax, qword [0x00b2f240]
mov rax, qword [rax]
call qword [rax + 0x6d8]
test al, al
je 0x5056c5
lea rcx, [0x00b2dc00]
mov edx, dword [0x00b2dcb0]
call fcn.00503260
lea rcx, [0x00b2dc08]
mov edx, dword [0x00b2dcb0]
call fcn.00503260
lea rcx, [0x00b2dc10]
mov edx, dword [0x00b2dcb0]
call fcn.00503260
lea rcx, [0x00b2dc18]
mov edx, dword [0x00b2dcb0]
call fcn.00503260
lea rcx, [0x00b2dc20]
mov edx, dword [0x00b2dcb0]
call fcn.00503260
lea rcx, [0x00b2dc28]
mov edx, dword [0x00b2dcb0]
call fcn.00503260
lea rcx, [0x00b2dc30]
mov edx, dword [0x00b2dcb0]
call fcn.00503260
lea rcx, [0x00b2dc38]
mov edx, dword [0x00b2dcb0]
call fcn.00503260
lea rcx, [0x00b2dc40]
mov edx, dword [0x00b2dcb0]
call fcn.00503260
lea rcx, [0x00b2dc48]
mov edx, dword [0x00b2dcb0]
call fcn.00503260
lea rcx, [0x00b2dc50]
mov edx, dword [0x00b2dcb0]
call fcn.00503260
lea rcx, [0x00b2dc58]
mov edx, dword [0x00b2dcb0]
call fcn.00503260
lea rcx, [0x00b2dc70]
mov edx, dword [0x00b2dcb0]
call fcn.00503260
lea rcx, [0x00b2dc78]
mov edx, dword [0x00b2dcb0]
call fcn.00503260
lea rcx, [0x00b2dc80]
mov edx, dword [0x00b2dcb0]
call fcn.00503260
lea rcx, [0x00b2dc88]
mov edx, dword [0x00b2dcb0]
call fcn.00503260
lea rcx, [0x00b2dc90]
mov edx, dword [0x00b2dcb0]
call fcn.00503260
lea rcx, [0x00b2dc98]
mov edx, dword [0x00b2dcb0]
call fcn.00503260
lea rcx, [0x00b2dca0]
mov edx, dword [0x00b2dcb0]
call fcn.00503260
lea rcx, [0x00b2dca8]
mov edx, dword [0x00b2dcb0]
call fcn.00503260
cmp qword [0x00b2dc90], 0
je 0x5045ab
cmp qword [0x00b2dc00], 0
je 0x5045ab
cmp qword [0x00b2dc10], 0
je 0x5045ab
cmp qword [0x00b2dc20], 0
jne 0x504ad8
cmp byte [rbp + 0x12f], 0
je 0x504ad8
lea rax, [fcn.004162c0]
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp + 0x1e0]
cmp word [rax], 0x25ff
jne 0x50462b
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x1e0]
movsxd rcx, dword [rcx + 2]
mov rax, qword [rax + rcx + 6]
mov qword [rbp + 0x1e0], rax
mov rcx, qword [rbp + 0x1e0]
lea rdx, [rbp + 0x140]
lea r8, [rbp + 0x120]
mov rax, qword [0x00bb6f40]
call qword [rax]
mov rax, qword [rbp + 0x140]
cmp rax, qword [0x00b2dcb0]
jne 0x50462b
mov qword [rbp + 0x140], 0
mov dword [rbp + 0xc4], 0xf0
mov rcx, rbp
mov rdx, qword [rbp + 0x140]
lea r8, [0x00505980]
mov r9d, dword [rbp + 0xc4]
lea rax, [0x00505990]
mov qword [rsp + 0x20], rax
call fcn.00503760
mov qword [rbp + 0x148], rax
cmp qword [rbp + 0x140], 0
jne 0x50469f
mov rcx, rbp
mov rdx, qword [rbp + 0x148]
lea r8, [0x005059dc]
mov r9d, dword [rbp + 0xc4]
lea rax, [0x005059ec]
mov qword [rsp + 0x20], rax
call fcn.00503760
mov qword [rbp + 0x140], rax
mov rcx, rbp
xor rdx, rdx
lea r8, [0x00505a14]
mov r9d, dword [rbp + 0xc4]
lea rax, [0x00505a28]
mov qword [rsp + 0x20], rax
call fcn.00503760
mov qword [rbp + 0x138], rax
mov rcx, rbp
xor rdx, rdx
lea r8, [0x00505a70]
mov r9d, dword [rbp + 0xc4]
lea rax, [0x00505a80]
mov qword [rsp + 0x20], rax
call fcn.00503760
mov qword [rbp + 0x130], rax
cmp qword [0x00b2dc90], 0
jne 0x5049f3
cmp qword [rbp + 0x140], 0
je 0x5049f3
mov rcx, qword [rbp + 0x140]
lea rdx, [0x00505ac0]
call fcn.0041f960
mov qword [0x00b2dc30], rax
cmp qword [0x00b2dc30], 0
je 0x5049e1
mov rax, qword [0x00b2dc30]
cmp byte [rax], 0xe9
je 0x5049e1
mov rcx, qword [rbp + 0x140]
lea rdx, [0x00505b26]
call fcn.0041f960
mov qword [0x00b2dc38], rax
mov rcx, qword [rbp + 0x140]
lea rdx, [0x00505b90]
call fcn.0041f960
mov qword [0x00b2dc40], rax
mov rcx, qword [rbp + 0x140]
lea rdx, [0x00505be2]
call fcn.0041f960
mov qword [0x00b2dc48], rax
mov rcx, qword [rbp + 0x140]
lea rdx, [0x00505c72]
call fcn.0041f960
mov qword [0x00b2dc50], rax
mov rcx, qword [rbp + 0x140]
lea rdx, [0x00505cd0]
call fcn.0041f960
mov qword [0x00b2dc58], rax
mov rcx, qword [rbp + 0x140]
lea rdx, [0x00505d14]
call fcn.0041f960
mov qword [0x00b2dc60], rax
mov rcx, qword [rbp + 0x140]
lea rdx, [0x00505d5c]
call fcn.0041f960
mov qword [0x00b2dc68], rax
mov rcx, qword [rbp + 0x140]
lea rdx, [0x00505da4]
call fcn.0041f960
mov qword [0x00b2dc70], rax
mov rcx, qword [rbp + 0x140]
lea rdx, [0x00505df2]
call fcn.0041f960
lea rcx, [rbp + 0x240]
mov rdx, rax
call fcn.00437b50
mov byte [rbp + 0x1ef], 0
jmp 0x5049c6
cmp qword [rbp + 0x260], 0
je 0x5049a2
cmp byte [rbp + 0x25a], 0
je 0x5049a2
cmp dword [rbp + 0x278], 4
jne 0x5049a2
cmp byte [rbp + 0x1ef], 0
je 0x50490d
mov byte [rbp + 0x1ef], 0
lea rcx, [rbp + 0x1f0]
mov rdx, qword [rbp + 0x260]
call fcn.00437b50
jmp 0x5048f3
cmp word [rbp + 0x1f2], 0xc7
jne 0x5048cf
cmp byte [rbp + 0x1f4], 0x40
jne 0x5048cf
mov rax, qword [rbp + 0x238]
cmp byte [rax - 5], 4
jne 0x5048cf
mov rax, qword [rbp + 0x238]
mov rax, qword [rax - 4]
mov qword [0x00b2dca0], rax
jmp 0x504907
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x238]
call fcn.00437b50
lea rdi, [rbp + 0x1f0]
lea rsi, [rbp + 0x40]
mov ecx, 0xa
rep movsq qword [rdi], qword [rsi]
cmp byte [rbp + 0x1f0], 0
je 0x504907
cmp word [rbp + 0x1f2], 0xc3
jne 0x50489a
nop
jmp 0x5049a2
mov rax, qword [rbp + 0x260]
mov qword [0x00b2dc90], rax
lea rcx, [rbp + 0x240]
mov rdx, qword [0x00b2dc90]
call fcn.00437b50
jmp 0x50498b
cmp qword [rbp + 0x260], 0
je 0x504967
cmp word [rbp + 0x242], 0xe8
jne 0x504967
cmp byte [rbp + 0x25a], 0
je 0x504967
cmp dword [rbp + 0x278], 4
jne 0x504967
mov rax, qword [rbp + 0x260]
mov qword [0x00b2dc98], rax
jmp 0x50499f
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x288]
call fcn.00437b50
lea rdi, [rbp + 0x240]
lea rsi, [rbp + 0x40]
mov ecx, 0xa
rep movsq qword [rdi], qword [rsi]
cmp byte [rbp + 0x240], 0
je 0x50499f
cmp word [rbp + 0x242], 0xc3
jne 0x504930
nop
jmp 0x5049de
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x288]
call fcn.00437b50
lea rdi, [rbp + 0x240]
lea rsi, [rbp + 0x40]
mov ecx, 0xa
rep movsq qword [rdi], qword [rsi]
cmp byte [rbp + 0x240], 0
je 0x5049de
cmp word [rbp + 0x242], 0xc3
jne 0x504849
nop
jmp 0x5049f3
mov byte [rbp + 0x12f], 0
mov qword [0x00b2dc30], 0
cmp byte [rbp + 0x12f], 0
je 0x504ad8
cmp qword [0x00b2dc00], 0
jne 0x504a48
cmp qword [rbp + 0x148], 0
je 0x504a48
mov rcx, qword [rbp + 0x148]
lea rdx, [0x00505e6e]
call fcn.0041f960
mov qword [0x00b2dc00], rax
mov rcx, qword [rbp + 0x148]
lea rdx, [0x00505eee]
call fcn.0041f960
mov qword [0x00b2dc08], rax
cmp qword [0x00b2dc10], 0
jne 0x504a90
cmp qword [rbp + 0x138], 0
je 0x504a90
mov rcx, qword [rbp + 0x138]
lea rdx, [0x00505f80]
call fcn.0041f960
mov qword [0x00b2dc10], rax
mov rcx, qword [rbp + 0x138]
lea rdx, [0x00505ff6]
call fcn.0041f960
mov qword [0x00b2dc18], rax
cmp qword [0x00b2dc20], 0
jne 0x504ad8
cmp qword [rbp + 0x130], 0
je 0x504ad8
mov rcx, qword [rbp + 0x130]
lea rdx, [0x00506070]
call fcn.0041f960
mov qword [0x00b2dc20], rax
mov rcx, qword [rbp + 0x130]
lea rdx, [0x005060f0]
call fcn.0041f960
mov qword [0x00b2dc28], rax
cmp qword [0x00b2dc00], 0
je 0x504af5
mov rcx, qword [0x00b2dc00]
lea rdx, [0x005008c0]
call fcn.004f5750
cmp qword [0x00b2dc08], 0
je 0x504b12
mov rcx, qword [0x00b2dc08]
lea rdx, [0x00500850]
call fcn.004f5750
cmp qword [0x00b2dc10], 0
je 0x504b2f
mov rcx, qword [0x00b2dc10]
lea rdx, [0x005008c0]
call fcn.004f5750
cmp qword [0x00b2dc18], 0
je 0x504b4c
mov rcx, qword [0x00b2dc18]
lea rdx, [0x00500850]
call fcn.004f5750
cmp qword [0x00b2dc20], 0
je 0x504b69
mov rcx, qword [0x00b2dc20]
lea rdx, [0x005008c0]
call fcn.004f5750
cmp qword [0x00b2dc28], 0
je 0x504b86
mov rcx, qword [0x00b2dc28]
lea rdx, [0x00500850]
call fcn.004f5750
cmp qword [0x00b2dc30], 0
je 0x504ba3
mov rcx, qword [0x00b2dc30]
lea rdx, [0x005007e0]
call fcn.004f5750
cmp qword [0x00b2dc78], 0
je 0x504bc0
mov rcx, qword [0x00b2dc78]
lea rdx, [0x00500940]
call fcn.004f5750
cmp qword [0x00b2dc80], 0
je 0x504bdd
mov rcx, qword [0x00b2dc80]
lea rdx, [0x005009a0]
call fcn.004f5750
mov rcx, rbp
call fcn.00503330
mov rcx, rax
lea rdx, [0x00500ed0]
call fcn.004f5750
cmp qword [0x00b2dc38], 0
je 0x504d35
cmp qword [0x00b2dc40], 0
je 0x504d35
lea rcx, [rbp + 0x168]
mov rdx, qword [0x00b2dc38]
call fcn.00439580
mov rcx, qword [rbp + 0x1a8]
call fcn.00413940
cmp rax, 1
jne 0x504c47
mov rax, qword [rbp + 0x1a8]
mov rax, qword [rax + 0x18]
mov qword [0x00b2dc38], rax
lea rcx, [rbp + 0x168]
mov rdx, qword [0x00b2dc40]
call fcn.00439580
mov rcx, qword [rbp + 0x1a8]
call fcn.00413940
cmp rax, 1
jne 0x504c7e
mov rax, qword [rbp + 0x1a8]
mov rax, qword [rax + 0x18]
mov qword [0x00b2dc40], rax
lea rcx, [rbp + 0x240]
mov rdx, qword [0x00b2dc38]
call fcn.00437b50
jmp 0x504cfe
cmp qword [rbp + 0x260], 0
je 0x504cda
mov rax, qword [rbp + 0x260]
cmp rax, qword [0x00b2dc40]
jne 0x504cda
cmp dword [rbp + 0x278], 4
jne 0x504d34
cmp byte [rbp + 0x25a], 0
je 0x504d34
mov rcx, qword [rbp + 0x268]
lea rdx, [0x00500cd0]
sub edx, dword [rbp + 0x288]
call fcn.004f57a0
jmp 0x504d34
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x288]
call fcn.00437b50
lea rdi, [rbp + 0x240]
lea rsi, [rbp + 0x40]
mov ecx, 0xa
rep movsq qword [rdi], qword [rsi]
movzx rax, word [rbp + 0x242]
sub ax, 0xc0
cmp ax, 7
ja 0x504d29
mov dl, 1
mov ecx, eax
and cl, 0x7f
shl edx, cl
movzx rax, byte [0x00506182]
test dl, al
setne al
jmp 0x504d2c
xor rax, rax
test al, al
je 0x504c93
nop
cmp qword [0x00b2dc70], 0
je 0x504e34
lea rax, [fcn.00408b30]
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp + 0x1e0]
cmp word [rax], 0x25ff
jne 0x504d7d
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x1e0]
movsxd rcx, dword [rcx + 2]
mov rax, qword [rax + rcx + 6]
mov qword [rbp + 0x1e0], rax
lea rcx, [rbp + 0x240]
mov rdx, qword [0x00b2dc70]
call fcn.00437b50
jmp 0x504dfd
cmp qword [rbp + 0x260], 0
je 0x504dd9
mov rax, qword [rbp + 0x260]
cmp rax, qword [rbp + 0x1e0]
jne 0x504dd9
cmp dword [rbp + 0x278], 4
jne 0x504e33
cmp byte [rbp + 0x25a], 0
je 0x504e33
mov rcx, qword [rbp + 0x268]
lea rdx, [0x00500ad0]
sub edx, dword [rbp + 0x288]
call fcn.004f57a0
jmp 0x504e33
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x288]
call fcn.00437b50
lea rdi, [rbp + 0x240]
lea rsi, [rbp + 0x40]
mov ecx, 0xa
rep movsq qword [rdi], qword [rsi]
movzx rax, word [rbp + 0x242]
sub ax, 0xc0
cmp ax, 7
ja 0x504e28
mov dl, 1
mov ecx, eax
and cl, 0x7f
shl edx, cl
movzx rax, byte [0x00506182]
test dl, al
setne al
jmp 0x504e2b
xor rax, rax
test al, al
je 0x504d92
nop
mov rcx, rbp
call fcn.005032a0
lea rcx, [rbp + 0x240]
mov rdx, rax
call fcn.00437b50
mov byte [rbp + 0x1ef], 0
jmp 0x504ebf
cmp byte [rbp + 0x25a], 0
je 0x504e9b
cmp dword [rbp + 0x278], 4
jne 0x504e9b
cmp qword [rbp + 0x260], 0
je 0x504e9b
cmp byte [rbp + 0x1ef], 0
je 0x504e94
mov rcx, qword [rbp + 0x268]
lea rdx, [0x00500b70]
sub edx, dword [rbp + 0x288]
call fcn.004f57a0
jmp 0x504ef5
mov byte [rbp + 0x1ef], 1
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x288]
call fcn.00437b50
lea rdi, [rbp + 0x240]
lea rsi, [rbp + 0x40]
mov ecx, 0xa
rep movsq qword [rdi], qword [rsi]
movzx rax, word [rbp + 0x242]
sub ax, 0xc0
cmp ax, 7
ja 0x504eea
mov dl, 1
mov ecx, eax
and cl, 0x7f
shl edx, cl
movzx rax, byte [0x00506182]
test dl, al
setne al
jmp 0x504eed
xor rax, rax
test al, al
je 0x504e54
nop
mov rcx, rbp
call fcn.005032a0
lea rcx, [rbp + 0x240]
mov rdx, rax
call fcn.00437b50
jmp 0x504f7a
cmp qword [rbp + 0x260], 0
je 0x504f56
mov rax, qword [rbp + 0x260]
cmp rax, qword [0x00b2dc98]
jne 0x504f56
cmp dword [rbp + 0x278], 4
jne 0x504fb0
cmp byte [rbp + 0x25a], 0
je 0x504fb0
mov rcx, qword [rbp + 0x268]
lea rdx, [0x00500e00]
sub edx, dword [rbp + 0x288]
call fcn.004f57a0
jmp 0x504fb0
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x288]
call fcn.00437b50
lea rdi, [rbp + 0x240]
lea rsi, [rbp + 0x40]
mov ecx, 0xa
rep movsq qword [rdi], qword [rsi]
movzx rax, word [rbp + 0x242]
sub ax, 0xc0
cmp ax, 7
ja 0x504fa5
mov dl, 1
mov ecx, eax
and cl, 0x7f
shl edx, cl
movzx rax, byte [0x00506182]
test dl, al
setne al
jmp 0x504fa8
xor rax, rax
test al, al
je 0x504f0f
nop
cmp qword [0x00b2dc90], 0
je 0x50507a
cmp qword [0x00b2dc98], 0
je 0x50507a
lea rcx, [rbp + 0x240]
mov rdx, qword [0x00b2dc90]
call fcn.00437b50
jmp 0x505043
mov rax, qword [rbp + 0x260]
cmp rax, qword [0x00b2dc98]
jne 0x50501f
cmp dword [rbp + 0x278], 4
jne 0x505079
cmp byte [rbp + 0x25a], 0
je 0x505079
mov rcx, qword [rbp + 0x268]
lea rdx, [0x00500e10]
sub edx, dword [rbp + 0x288]
call fcn.004f57a0
jmp 0x505079
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x288]
call fcn.00437b50
lea rdi, [rbp + 0x240]
lea rsi, [rbp + 0x40]
mov ecx, 0xa
rep movsq qword [rdi], qword [rsi]
movzx rax, word [rbp + 0x242]
sub ax, 0xc0
cmp ax, 7
ja 0x50506e
mov dl, 1
mov ecx, eax
and cl, 0x7f
shl edx, cl
movzx rax, byte [0x00506182]
test dl, al
setne al
jmp 0x505071
xor rax, rax
test al, al
je 0x504fe2
nop
cmp qword [0x00b2dc98], 0
je 0x505135
lea rcx, [rbp + 0x240]
mov rdx, qword [0x00b2dc98]
call fcn.00437b50
jmp 0x5050fe
mov rax, qword [rbp + 0x260]
cmp rax, qword [0x00b2dc98]
jne 0x5050da
cmp dword [rbp + 0x278], 4
jne 0x505134
cmp byte [rbp + 0x25a], 0
je 0x505134
mov rcx, qword [rbp + 0x268]
lea rdx, [0x00500e70]
sub edx, dword [rbp + 0x288]
call fcn.004f57a0
jmp 0x505134
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x288]
call fcn.00437b50
lea rdi, [rbp + 0x240]
lea rsi, [rbp + 0x40]
mov ecx, 0xa
rep movsq qword [rdi], qword [rsi]
movzx rax, word [rbp + 0x242]
sub ax, 0xc0
cmp ax, 7
ja 0x505129
mov dl, 1
mov ecx, eax
and cl, 0x7f
shl edx, cl
movzx rax, byte [0x00506182]
test dl, al
setne al
jmp 0x50512c
xor rax, rax
test al, al
je 0x50509d
nop
mov rcx, rbp
call fcn.00503300
lea rcx, [rbp + 0x240]
mov rdx, rax
call fcn.00437b50
cmp word [rbp + 0x242], 0x55
jne 0x5052dc
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x288]
call fcn.00437b50
lea rdi, [rbp + 0x240]
lea rsi, [rbp + 0x40]
mov ecx, 0xa
rep movsq qword [rdi], qword [rsi]
cmp word [rbp + 0x242], 0x53
jne 0x5052dc
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x288]
call fcn.00437b50
lea rdi, [rbp + 0x240]
lea rsi, [rbp + 0x40]
mov ecx, 0xa
rep movsq qword [rdi], qword [rsi]
mov rax, qword [rbp + 0x280]
cmp byte [rax], 0x48
jne 0x5052dc
cmp word [rbp + 0x242], 0x81
jne 0x5052dc
cmp byte [rbp + 0x244], 0xec
jne 0x5052dc
mov rcx, rbp
call fcn.00503300
mov eax, dword [rax]
cmp eax, dword [fcn.005006e0]
jne 0x5052dc
mov rcx, rbp
call fcn.00503300
movzx rax, byte [rax + 4]
cmp al, byte [0x005006e4]
jne 0x5052dc
lea rcx, [0x00506183]
lea rdx, [fcn.005006e0]
mov r8d, 8
mov r9d, 0x20
mov byte [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x7fffffff
mov rax, qword [0x00bb7120]
call qword [rax]
mov dword [rbp + 0x164], eax
cmp dword [rbp + 0x164], 0
jle 0x5052dc
lea rcx, [fcn.005006e0]
mov edx, 0x20
mov r8d, 0x40
lea r9, [rbp + 0x160]
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x5052dc
mov rax, qword [rbp + 0x280]
mov eax, dword [rax + 3]
mov dword [0x005006e5], eax
lea rax, [fcn.005006e0]
movsxd rcx, dword [rbp + 0x164]
mov rdx, qword [rbp + 0x288]
mov qword [rax + rcx], rdx
lea rcx, [fcn.005006e0]
mov edx, 0x20
mov r8d, dword [rbp + 0x160]
lea r9, [rbp + 0x160]
call sub.kernel32.dll_VirtualProtect
mov rcx, rbp
call fcn.00503300
mov rcx, rax
lea rdx, [0x00500700]
call fcn.004f5750
mov rax, qword [0x00bb70c0]
mov qword [0x00b32830], rax
mov rcx, rbp
call fcn.00503300
lea rcx, [rbp + 0x240]
mov rdx, rax
call fcn.00437b50
jmp 0x505356
cmp qword [0x00b32828], 0
jne 0x505332
cmp word [rbp + 0x242], 0x89
jne 0x505332
cmp byte [rbp + 0x244], 0x85
jne 0x505332
mov rax, qword [rbp + 0x280]
mov eax, dword [rax + 3]
mov qword [0x00b32828], rax
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x288]
call fcn.00437b50
lea rdi, [rbp + 0x240]
lea rsi, [rbp + 0x40]
mov ecx, 0xa
rep movsq qword [rdi], qword [rsi]
cmp byte [rbp + 0x240], 0
je 0x5053c8
cmp word [rbp + 0x242], 0xff
jne 0x505392
cmp byte [rbp + 0x244], 0x15
jne 0x505392
mov rax, qword [rbp + 0x288]
mov rcx, qword [rbp + 0x280]
movsxd rcx, dword [rcx + 2]
lea rax, [rax + rcx]
cmp rax, qword [0x00bb70c0]
je 0x5053c8
movzx rax, word [rbp + 0x242]
sub ax, 0xc0
cmp ax, 7
ja 0x5053bd
mov dl, 1
mov ecx, eax
and cl, 0x7f
shl edx, cl
movzx rax, byte [0x00506182]
test dl, al
setne al
jmp 0x5053c0
xor rax, rax
test al, al
je 0x505303
cmp word [rbp + 0x242], 0xff
jne 0x505414
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x280]
call fcn.00437b50
lea rdi, [rbp + 0x240]
lea rsi, [rbp + 0x40]
mov ecx, 0xa
rep movsq qword [rdi], qword [rsi]
mov rax, qword [rbp + 0x280]
lea rcx, [rax + 2]
lea rdx, [0x00b33688]
sub edx, dword [rbp + 0x288]
call fcn.004f57a0
lea rcx, [rbp + 0x240]
lea rdx, [fcn.0040ccc0]
call fcn.00437b50
cmp qword [rbp + 0x260], 0
je 0x505441
mov rax, qword [rbp + 0x260]
mov qword [rbp + 0x1e0], rax
jmp 0x50544f
lea rax, [fcn.0040ccc0]
mov qword [rbp + 0x1e0], rax
mov rcx, rbp
call fcn.00503270
lea rcx, [rbp + 0x240]
mov rdx, rax
call fcn.00437b50
jmp 0x5054c9
mov rax, qword [rbp + 0x260]
cmp rax, qword [rbp + 0x1e0]
jne 0x5054a5
cmp dword [rbp + 0x278], 4
jne 0x5054ff
cmp byte [rbp + 0x25a], 0
je 0x5054ff
mov rcx, qword [rbp + 0x268]
lea rdx, [0x00500f40]
sub edx, dword [rbp + 0x288]
call fcn.004f57a0
jmp 0x5054ff
lea rcx, [rbp + 0x40]
mov rdx, qword [rbp + 0x288]
call fcn.00437b50
lea rdi, [rbp + 0x240]
lea rsi, [rbp + 0x40]
mov ecx, 0xa
rep movsq qword [rdi], qword [rsi]
movzx rax, word [rbp + 0x242]
sub ax, 0xc0
cmp ax, 7
ja 0x5054f4
mov dl, 1
mov ecx, eax
and cl, 0x7f
shl edx, cl
movzx rax, byte [0x00506182]
test dl, al
setne al
jmp 0x5054f7
xor rax, rax
test al, al
je 0x505468
nop
mov rcx, rbp
call fcn.005032d0
mov rcx, rax
lea rdx, [0x00501010]
call fcn.004f5750
cmp qword [0x00b2dc48], 0
je 0x50557f
cmp qword [0x00b2dc58], 0
je 0x50557f
mov rcx, qword [0x00b2dc48]
lea rdx, [0x00500080]
call fcn.004f5750
mov rcx, qword [0x00b2dc58]
lea rdx, [0x004226e0]
call fcn.004f5750
cmp qword [0x00b2dc50], 0
je 0x50556e
mov rcx, qword [0x00b2dc50]
lea rdx, [0x00500100]
call fcn.004f5750
mov rax, qword [0x00bb8018]
lea rcx, [0x004ffff0]
mov qword [rax], rcx
call sub.kernel32.dll_GetCurrentProcess
mov rcx, rax
xor rdx, rdx
xor r8, r8
call sub.kernel32.dll_FlushInstructionCache
call fcn.004f3200
call fcn.004be360
lea rax, [fcn.0040fe70]
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp + 0x1e0]
cmp word [rax], 0x25ff
jne 0x5055d6
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [rbp + 0x1e0]
movsxd rcx, dword [rcx + 2]
mov rax, qword [rax + rcx + 6]
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp + 0x1e0]
mov qword [0x00b33850], rax
lea rcx, [rbp + 0x168]
mov rdx, qword [rbp + 0x1e0]
call fcn.00439580
cmp byte [rbp + 0x168], 0
je 0x505619
mov rax, qword [rbp + 0x178]
movsxd rcx, dword [rbp + 0x180]
lea rax, [rax + rcx]
mov qword [0x00b33858], rax
xor rcx, rcx
call sub.kernel32.dll_GetModuleHandleW
cmp qword [0x00b2dcb0], rax
je 0x505633
cmp byte [0x00b2dcc8], 0
je 0x50563f
mov rcx, qword [0x00b2f240]
call fcn.005020c0
mov rcx, qword [0x00b2f240]
mov rax, qword [0x00b2f240]
mov rax, qword [rax]
call qword [rax + 0x6f8]
test al, al
je 0x50567c
mov rcx, qword [0x00b2f240]
mov rax, qword [0x00b2f240]
mov rax, qword [rax]
call qword [rax + 0x700]
mov dword [0x00b2f660], eax
call fcn.004bec00
call fcn.004f3410
jmp 0x5056c5
lea rcx, [rbp + 0x150]
call fcn.004a9130
cmp qword [rbp + 0x150], 0
je 0x5056aa
mov rax, qword [rbp + 0x150]
mov eax, dword [rax]
mov dword [0x00b2db30], eax
jmp 0x5056b9
mov rax, qword [0x00bb8ed8]
mov eax, dword [rax]
mov dword [0x00b2db30], eax
lea rcx, [0x00b2f240]
call fcn.00415f60
nop
lea rcx, [rbp + 0x90]
mov edx, 4
call fcn.00410190
lea rcx, [rbp + 0xb0]
call fcn.00415f60
lea rcx, [rbp + 0x120]
call fcn.004100d0
lea rcx, [rbp + 0x150]
mov rdx, qword [0x004220f0]
call fcn.00413ec0
lea rcx, [rbp + 0x168]
mov rdx, qword [0x00430b10]
call fcn.00412d60
lea rsp, [rbp + 0x290]
pop rsi
pop rdi
pop rbp
ret