Function at 0x14016e87b
Capabilities:
Parse pe header

Disassembly:
push rax
pushf
mov eax, 0x80bdafd4
pushf
not eax
add eax, 0x8d334480
xor eax, 0xabf08311
rol eax, 0x7d
popf
pushf
not eax
add eax, 0xef93b104
xor eax, 0x9aa30e0c
rol eax, 0x4c
popf
cmp eax, 4
jne 0x14016e8b8
popf
pop rax
jmp 0x14016eddc
cmp eax, 0
jne 0x14016e8c7
popf
pop rax
jmp 0x14016ea7a
cmp eax, 3
jne 0x14016e8d6
popf
pop rax
jmp 0x14016ec91
cmp eax, 1
jne 0x14016e8e5
popf
pop rax
jmp 0x14016eb41
cmp eax, 0xd
jne 0x14016e8f4
popf
pop rax
jmp 0x14016f24c
cmp eax, 0x1a
jne 0x14016e903
popf
pop rax
jmp 0x14016f9fb
cmp eax, 0xe
jne 0x14016e912
popf
pop rax
jmp 0x14016f2e4
cmp eax, 0xb
jne 0x14016e921
popf
pop rax
jmp 0x14016f1d3
cmp eax, 0x19
jne 0x14016e930
popf
pop rax
jmp 0x14016f97a
cmp eax, 8
jne 0x14016e93f
popf
pop rax
jmp 0x14016f002
cmp eax, 0x1d
jne 0x14016e94e
popf
pop rax
jmp 0x14016fb00
cmp eax, 0x17
jne 0x14016e95d
popf
pop rax
jmp 0x14016f7cd
cmp eax, 0x1c
jne 0x14016e96c
popf
pop rax
jmp 0x14016fab0
cmp eax, 0x12
jne 0x14016e97b
popf
pop rax
jmp 0x14016f54b
cmp eax, 0x18
jne 0x14016e98a
popf
pop rax
jmp 0x14016f8f7
cmp eax, 0x11
jne 0x14016e999
popf
pop rax
jmp 0x14016f4af
cmp eax, 0x1b
jne 0x14016e9a8
popf
pop rax
jmp 0x14016fa4d
cmp eax, 0x16
jne 0x14016e9b7
popf
pop rax
jmp 0x14016f727
cmp eax, 0xa
jne 0x14016e9c6
popf
pop rax
jmp 0x14016f121
cmp eax, 0x14
jne 0x14016e9d5
popf
pop rax
jmp 0x14016f616
cmp eax, 0xf
jne 0x14016e9e4
popf
pop rax
jmp 0x14016f377
cmp eax, 0x13
jne 0x14016e9f3
popf
pop rax
jmp 0x14016f5a9
cmp eax, 0x15
jne 0x14016ea02
popf
pop rax
jmp 0x14016f660
cmp eax, 2
jne 0x14016ea11
popf
pop rax
jmp 0x14016ec0f
cmp eax, 0x1e
jne 0x14016ea20
popf
pop rax
jmp 0x14016fb75
cmp eax, 0xc
jne 0x14016ea2f
popf
pop rax
jmp 0x14016f209
cmp eax, 7
jne 0x14016ea3e
popf
pop rax
jmp 0x14016ef5a
cmp eax, 5
jne 0x14016ea4d
popf
pop rax
jmp 0x14016eea0
cmp eax, 9
jne 0x14016ea5c
popf
pop rax
jmp 0x14016f09a
cmp eax, 0x10
jne 0x14016ea6b
popf
pop rax
jmp 0x14016f407
cmp eax, 6
jne 0x14016ea7a
popf
pop rax
jmp 0x14016ef50
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x140103090]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor ecx, ecx
mov byte [rsp + 0x40], r8b
mov rbp, rdx
jmp 0x14016eab6
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r15, rax
test rax, rax
je 0x14016eb0e
push rax
pushf
mov eax, 0x445bd6a9
pushf
not eax
add eax, 0xb18bd610
xor eax, 0xd1b4713d
rol eax, 0x5e
popf
pushf
not eax
add eax, 0x8c4892d8
xor eax, 0xa5a1ee89
rol eax, 0x94
popf
pushf
not eax
add eax, 0xe3a0c4a7
xor eax, 0xc71d3ea2
rol eax, 0x77
popf
jmp 0x14016e8a9
push rax
pushf
mov eax, 0xcc433678
pushf
not eax
add eax, 0xd95779c3
xor eax, 0xc7a6910a
rol eax, 0xa0
popf
pushf
not eax
add eax, 0xacbf803f
xor eax, 0xe211adfe
rol eax, 0x90
popf
jmp 0x14016e8a9
mov r13d, 0x2e938695
pushf
not r13d
add r13d, 0xf2f01bf7
xor r13d, 0xb1703e3e
rol r13d, 0xf1
popf
pushf
not r13d
add r13d, 0xd8d8ceba
xor r13d, 0xb619e509
rol r13d, 0x46
popf
cmp word [rax], r13w
jne 0x14016ebdc
push rax
pushf
mov eax, 0xedf2ffbb
pushf
not eax
add eax, 0xcf945da4
xor eax, 0xb42d880f
rol eax, 0xea
popf
pushf
not eax
add eax, 0xb0650ca2
xor eax, 0xbf81411f
rol eax, 0xd9
popf
pushf
not eax
add eax, 0x82729986
xor eax, 0x8161e8b9
rol eax, 0xfd
popf
pushf
not eax
add eax, 0xf9b9b226
xor eax, 0xee8834f3
rol eax, 0xd5
popf
jmp 0x14016e8a9
push rax
pushf
mov eax, 0x9435ac1d
pushf
not eax
add eax, 0xb552fc39
xor eax, 0x8e8f07e6
rol eax, 5
popf
pushf
not eax
add eax, 0xd1a32e55
xor eax, 0xdf582d3f
rol eax, 0x5b
popf
jmp 0x14016e8a9
movsxd rdi, dword [rax + 0x3c]
push rax
not rax
sub rdi, rax
pop rax
sub rdi, 1
cmp dword [rdi], 0x4550
jne 0x14016ec5e
push rax
pushf
mov eax, 0x777435b7
pushf
not eax
add eax, 0xc6738ab1
xor eax, 0xcdd53763
rol eax, 0x7b
popf
pushf
not eax
add eax, 0xc8647683
xor eax, 0xf44b23a6
rol eax, 0xba
popf
jmp 0x14016e8a9
push rax
pushf
mov eax, 0xb3115af1
pushf
not eax
add eax, 0xa2fae7f2
xor eax, 0x918207b3
rol eax, 0xde
popf
pushf
not eax
add eax, 0xd00ffdd7
xor eax, 0xf076bb2a
rol eax, 0xb3
popf
jmp 0x14016e8a9
movzx ebx, word [rdi + 0x14]
add rbx, 0x18
mov dword [rsp + 0x50], 0x104
push rdi
not rdi
sub rbx, rdi
pop rdi
sub rbx, 1
jmp 0x14016ecae
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x50]
xor edx, edx
mov rcx, rax
lea r8, [rsp + 0x60]
jmp 0x14016ecc4
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
xor esi, esi
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x75d29acd
pushf
not edx
add edx, 0xbe50de22
xor edx, 0xed1cf176
rol edx, 0xeb
popf
pushf
not edx
add edx, 0xa1e9f0c7
xor edx, 0xade9099e
rol edx, 0xcb
popf
pushf
not edx
add edx, 0xde378ac1
xor edx, 0xff04c074
rol edx, 0xf3
popf
pushf
not edx
add edx, 0xbe8545b0
xor edx, 0xb046c092
rol edx, 0xaf
popf
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 1]
jmp 0x14016ed47
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
mov qword [rsp + 0x48], rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14016ed96
push rax
pushf
mov eax, 0xbaa2c162
pushf
not eax
add eax, 0xe529628f
xor eax, 0xcb96c832
rol eax, 0xc0
popf
pushf
not eax
add eax, 0xd133c353
xor eax, 0xf4235a34
rol eax, 0xc8
popf
jmp 0x14016e8a9
push rax
pushf
mov eax, 0x9ba58556
pushf
not eax
add eax, 0xf14c3def
xor eax, 0xc7ce2428
rol eax, 0xce
popf
pushf
not eax
add eax, 0xd8f3fbd3
xor eax, 0xfa53cbb5
rol eax, 0xb6
popf
pushf
not eax
add eax, 0xf724e8e4
xor eax, 0xced203dc
rol eax, 0x68
popf
jmp 0x14016e8a9
mov qword [rsp + 0x28], rsi
lea r8d, [rsi + 2]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
mov rcx, rax
jmp 0x14016edf2
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test rax, rax
je 0x14016ee5a
push rax
pushf
mov eax, 0xcca5cf0
pushf
not eax
add eax, 0xc845591a
xor eax, 0x8218d75c
rol eax, 0x91
popf
pushf
not eax
add eax, 0x8c4f2695
xor eax, 0xe01a2750
rol eax, 0x41
popf
pushf
not eax
add eax, 0x9fd6d0d6
xor eax, 0xb510112c
rol eax, 0xb5
popf
pushf
not eax
add eax, 0xc8140599
xor eax, 0xe90ecc62
rol eax, 0xf0
popf
jmp 0x14016e8a9
push rax
pushf
mov eax, 0x7e632b37
pushf
not eax
add eax, 0xd18c3bee
xor eax, 0xc1053b4a
rol eax, 0x6e
popf
pushf
not eax
add eax, 0xf1881e20
xor eax, 0xd32ee85a
rol eax, 0x89
popf
pushf
not eax
add eax, 0xf9cd6163
xor eax, 0xada9c4f0
rol eax, 0xc2
popf
jmp 0x14016e8a9
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
lea edx, [rsi + 4]
mov rcx, rax
jmp 0x14016eeb2
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
test rax, rax
je 0x14016ef1d
push rax
pushf
mov eax, 0xc084b540
pushf
not eax
add eax, 0x892b7c43
xor eax, 0x9d11b806
rol eax, 0x79
popf
pushf
not eax
add eax, 0xa6f26639
xor eax, 0xb11448ee
rol eax, 0x20
popf
pushf
not eax
add eax, 0x9fb774ca
xor eax, 0xb4a26649
rol eax, 0xb1
popf
pushf
not eax
add eax, 0x98eb3665
xor eax, 0xf37dacd7
rol eax, 0xf
popf
jmp 0x14016e8a9
push rax
pushf
mov eax, 0x3f3d5b18
pushf
not eax
add eax, 0x92f9cb16
xor eax, 0xac90d661
rol eax, 7
popf
pushf
not eax
add eax, 0x8633f0cf
xor eax, 0xefca224f
rol eax, 0x90
popf
jmp 0x14016e8a9
cmp word [rax], r13w
jne 0x14016fa4d
movsxd rcx, dword [rax + 0x3c]
push rax
not rax
sub rcx, rax
pop rax
sub rcx, 1
cmp dword [rcx], 0x4550
jne 0x14016efbc
push rax
pushf
mov eax, 0x7f75de37
pushf
not eax
add eax, 0xd4b3e220
xor eax, 0xb6e9ff79
rol eax, 0xab
popf
pushf
not eax
add eax, 0xf6fabdca
xor eax, 0xcb03f67f
rol eax, 0xf5
popf
pushf
not eax
add eax, 0xe721af83
xor eax, 0xcc822cc3
rol eax, 0x61
popf
jmp 0x14016e8a9
push rax
pushf
mov eax, 0x2adadb98
pushf
not eax
add eax, 0xd63247f5
xor eax, 0x9b4cd777
rol eax, 0x10
popf
pushf
not eax
add eax, 0x825de883
xor eax, 0xe5432d38
rol eax, 0x41
popf
pushf
not eax
add eax, 0xdc5cc502
xor eax, 0x91b99a43
rol eax, 0xa
popf
jmp 0x14016e8a9
mov eax, dword [rdi + 8]
cmp dword [rcx + 8], eax
jne 0x14016f067
push rax
pushf
mov eax, 0x59da2f3d
pushf
not eax
add eax, 0xef0dde5e
xor eax, 0xfdddde88
rol eax, 0x5b
popf
pushf
not eax
add eax, 0xa705453f
xor eax, 0xa99b976d
rol eax, 0xc3
popf
pushf
not eax
add eax, 0xf192881e
xor eax, 0xd25438d4
rol eax, 0xc6
popf
pushf
not eax
add eax, 0xf02504eb
xor eax, 0xf30a8c0e
rol eax, 0x64
popf
jmp 0x14016e8a9
push rax
pushf
mov eax, 0x175bd951
pushf
not eax
add eax, 0xd3183358
xor eax, 0x9132f55b
rol eax, 0x10
popf
pushf
not eax
add eax, 0x9669e7ef
xor eax, 0xe46cbd60
rol eax, 0x8b
popf
jmp 0x14016e8a9
movzx edx, word [rcx + 6]
cmp dx, word [rdi + 6]
jne 0x14016f0db
push rax
pushf
mov eax, 0x83f30a4a
pushf
not eax
add eax, 0xac408d8e
xor eax, 0xc4ddbf4b
rol eax, 0x4e
popf
pushf
not eax
add eax, 0xf92967d6
xor eax, 0xea2d2cb1
rol eax, 0x90
popf
jmp 0x14016e8a9
push rax
pushf
mov eax, 0xa1a4f4da
pushf
not eax
add eax, 0xf1018ab1
xor eax, 0xfbe69fd7
rol eax, 0x10
popf
pushf
not eax
add eax, 0xfd249de9
xor eax, 0xd1a80a86
rol eax, 0xb4
popf
pushf
not eax
add eax, 0xdeac08b5
xor eax, 0xa429e030
rol eax, 0x3f
popf
jmp 0x14016e8a9
movzx r14d, word [rcx + 0x14]
xor r13b, r13b
add r14, 0x18
mov r9d, esi
push rcx
not rcx
sub r14, rcx
pop rcx
sub r14, 1
mov r10d, edx
test edx, edx
je 0x14016f18d
push rax
pushf
mov eax, 0xbbda70d
pushf
not eax
add eax, 0xc50eafeb
xor eax, 0xfca634b3
rol eax, 0x44
popf
pushf
not eax
add eax, 0xda2a9730
xor eax, 0xd93b8c5a
rol eax, 0xe7
popf
pushf
not eax
add eax, 0x90ff4906
xor eax, 0xdc514034
rol eax, 0x47
popf
jmp 0x14016e8a9
push rax
pushf
mov eax, 0xefdfc489
pushf
not eax
add eax, 0x88429a64
xor eax, 0xcef9977a
rol eax, 0xcf
popf
pushf
not eax
add eax, 0xf320841e
xor eax, 0xce33622f
rol eax, 0xc8
popf
pushf
not eax
add eax, 0xcbbeb215
xor eax, 0xee03b275
rol eax, 0x4a
popf
jmp 0x14016e8a9
nop dword [rax]
push rax
pushf
mov eax, 0x2f876cfd
pushf
not eax
add eax, 0xb95b600a
xor eax, 0xbb259614
rol eax, 0x5e
popf
pushf
not eax
add eax, 0x94db71f5
xor eax, 0x887dd8ae
rol eax, 0xcd
popf
jmp 0x14016e8a9
mov r8, rbp
mov rax, rbx
sub r8, rbx
nop dword [rax]
push rax
pushf
mov eax, 0x7fa6887f
pushf
not eax
add eax, 0xac52d715
xor eax, 0x8e32c978
rol eax, 0x88
popf
pushf
not eax
add eax, 0x93301d8c
xor eax, 0xf4a52fe9
rol eax, 0x30
popf
jmp 0x14016e8a9
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14016f29e
push rax
pushf
mov eax, 0x2f647b22
pushf
not eax
add eax, 0xba38acaf
xor eax, 0xbcb6a36b
rol eax, 0x7a
popf
pushf
not eax
add eax, 0xb676874b
xor eax, 0xbf7f1520
rol eax, 0xc5
popf
pushf
not eax
add eax, 0xadbfbd7d
xor eax, 0xd142f188
rol eax, 0x15
popf
jmp 0x14016e8a9
push rax
pushf
mov eax, 0xe459f814
pushf
not eax
add eax, 0xebd507ee
xor eax, 0x9540edab
rol eax, 0xc9
popf
pushf
not eax
add eax, 0x84df07aa
xor eax, 0xa53fb71e
rol eax, 0x5b
popf
pushf
not eax
add eax, 0xdaf13194
xor eax, 0xfdb0049f
rol eax, 0x1d
popf
jmp 0x14016e8a9
inc rax
test ecx, ecx
jne 0x14016f331
push rax
pushf
mov eax, 0x7e6f4a30
pushf
not eax
add eax, 0xdf58201a
xor eax, 0x8c7bcb15
rol eax, 0x80
popf
pushf
not eax
add eax, 0xa2a6f32a
xor eax, 0xed6e887e
rol eax, 0xcc
popf
pushf
not eax
add eax, 0xc2b821b0
xor eax, 0xecf2ebc4
rol eax, 0xfe
popf
jmp 0x14016e8a9
push rax
pushf
mov eax, 0xf661f360
pushf
not eax
add eax, 0xf3f11e85
xor eax, 0xb8a131d1
rol eax, 0xff
popf
pushf
not eax
add eax, 0x8c6f41b3
xor eax, 0x99bc2c09
rol eax, 0x37
popf
pushf
not eax
add eax, 0xf4443cdd
xor eax, 0xdb8c0ae4
rol eax, 0xfe
popf
jmp 0x14016e8a9
test edx, edx
jne 0x14016f3ae
push rax
pushf
mov eax, 0x2f5b1711
pushf
not eax
add eax, 0xbc7b3313
xor eax, 0x8f7042c9
rol eax, 0xbd
popf
pushf
not eax
add eax, 0xc227610a
xor eax, 0xc1d55530
rol eax, 0xb1
popf
jmp 0x14016e8a9
push rax
pushf
mov eax, 0x7f751ff2
pushf
not eax
add eax, 0x8ba9c096
xor eax, 0xd59c9bd6
rol eax, 0x87
popf
pushf
not eax
add eax, 0x8853e7bd
xor eax, 0xb2373053
rol eax, 0xd
popf
pushf
not eax
add eax, 0xefd0e497
xor eax, 0xb523770c
rol eax, 0x29
popf
pushf
not eax
add eax, 0xc5a83f80
xor eax, 0xfdbe8ecd
rol eax, 0xfa
popf
jmp 0x14016e8a9
test dword [rbx + 0x24], 0x20000000
jne 0x14016f469
push rax
pushf
mov eax, 0xf197ed82
pushf
not eax
add eax, 0xb51b45e1
xor eax, 0x873d28fd
rol eax, 0x34
popf
pushf
not eax
add eax, 0xb05cbb7c
xor eax, 0x88a0b99a
rol eax, 0xd2
popf
pushf
not eax
add eax, 0xda1f50e4
xor eax, 0xd849fd84
rol eax, 0x72
popf
pushf
not eax
add eax, 0x9254aef3
xor eax, 0xe5434a15
rol eax, 0x5b
popf
jmp 0x14016e8a9
push rax
pushf
mov eax, 0x56e3621f
pushf
not eax
add eax, 0xecb04050
xor eax, 0x82a55f61
rol eax, 0x31
popf
pushf
not eax
add eax, 0xbe3be851
xor eax, 0xdf36e5bd
rol eax, 0x2e
popf
pushf
not eax
add eax, 0x9e5d61f4
xor eax, 0xc72d6ec8
rol eax, 0xf7
popf
jmp 0x14016e8a9
inc r9d
add rbx, 0x28
add r14, 0x28
cmp r9d, r10d
jl 0x14016f518
push rax
pushf
mov eax, 0x24c513cf
pushf
not eax
add eax, 0xd8562e04
xor eax, 0x8a49bf98
rol eax, 0xf4
popf
pushf
not eax
add eax, 0x9d0597ba
xor eax, 0xb49678aa
rol eax, 0x6d
popf
pushf
not eax
add eax, 0xbde6be21
xor eax, 0x94839809
rol eax, 0x4d
popf
pushf
not eax
add eax, 0xb75c649d
xor eax, 0xea727b3a
rol eax, 0xfb
popf
jmp 0x14016e8a9
push rax
pushf
mov eax, 0xcb341d5a
pushf
not eax
add eax, 0xb24226a2
xor eax, 0xa54f41ab
rol eax, 0x9a
popf
pushf
not eax
add eax, 0x893e34ed
xor eax, 0xd8352fca
rol eax, 0xe2
popf
jmp 0x14016e8a9
jmp 0x14016f9fb
mov edx, dword [rbx + 0x10]
test edx, edx
je 0x14016f5e3
push rax
pushf
mov eax, 0x2d6eaef6
pushf
not eax
add eax, 0xd15a5546
xor eax, 0x889ad549
rol eax, 0xb2
popf
pushf
not eax
add eax, 0xec187e08
xor eax, 0x9fffd040
rol eax, 0x63
popf
jmp 0x14016e8a9
push rax
pushf
mov eax, 0xf3f8916d
pushf
not eax
add eax, 0xbbe6e8b0
xor eax, 0xba22df8b
rol eax, 0xeb
popf
pushf
not eax
add eax, 0xbf4d1092
xor eax, 0x8b06c4a3
rol eax, 0x45
popf
jmp 0x14016e8a9
nop dword [rax]
push rax
pushf
mov eax, 0x872593b4
pushf
not eax
add eax, 0x8bf398f9
xor eax, 0xa229626f
rol eax, 0x58
popf
pushf
not eax
add eax, 0x890a3652
xor eax, 0xded9b868
rol eax, 0xb
popf
pushf
not eax
add eax, 0x8d25b2d6
xor eax, 0x9f719eb8
rol eax, 0xa7
popf
jmp 0x14016e8a9
mov eax, dword [r14 + 0x14]
mov ecx, dword [rbx + 0xc]
mov edi, esi
push rdi
not rdi
sub rax, rdi
pop rdi
sub rax, 1
push rdi
not rdi
sub rcx, rdi
pop rdi
sub rcx, 1
push r15
not r15
sub rcx, r15
pop r15
sub rcx, 1
movzx ebp, byte [rax + r12]
mov eax, edx
cmp byte [rcx], bpl
je 0x14016f6e1
push rax
pushf
mov eax, 0xfa6cd8a8
pushf
not eax
add eax, 0xad1de7ba
xor eax, 0xb549f419
rol eax, 0x23
popf
pushf
not eax
add eax, 0x8054e615
xor eax, 0xaa6dc665
rol eax, 6
popf
pushf
not eax
add eax, 0xb33474d1
xor eax, 0xfb01d056
rol eax, 0xd6
popf
jmp 0x14016e8a9
push rax
pushf
mov eax, 0xfe08f3d
pushf
not eax
add eax, 0xf5436ef3
xor eax, 0xc74d1530
rol eax, 0x6a
popf
pushf
not eax
add eax, 0xbd88bba4
xor eax, 0x91dff31b
rol eax, 0x3e
popf
pushf
not eax
add eax, 0xed270411
xor eax, 0xe346af10
rol eax, 7
popf
jmp 0x14016e8a9
cmp byte [rsp + 0x40], 0
je 0x14016f774
push rax
pushf
mov eax, 0xf94e0a41
pushf
not eax
add eax, 0xba03c654
xor eax, 0xf025bf31
rol eax, 0x62
popf
pushf
not eax
add eax, 0xb7b09de8
xor eax, 0xbdd63c5e
rol eax, 0xf8
popf
pushf
not eax
add eax, 0xc018830f
xor eax, 0xbacf8061
rol eax, 0x56
popf
jmp 0x14016e8a9
push rax
pushf
mov eax, 0x761431fb
pushf
not eax
add eax, 0xd567fc18
xor eax, 0xaf71cb7b
rol eax, 0xac
popf
pushf
not eax
add eax, 0x9ebb79fa
xor eax, 0x9736d336
rol eax, 0xd
popf
pushf
not eax
add eax, 0x8d23ba60
xor eax, 0xb9aab03b
rol eax, 0xfa
popf
pushf
not eax
add eax, 0xe37322b4
xor eax, 0x877a1b73
rol eax, 0xa1
popf
jmp 0x14016e8a9
mov edx, 0x220bf12f
pushf
not edx
add edx, 0xf0e824e4
xor edx, 0x94884162
rol edx, 0x6a
popf
pushf
not edx
add edx, 0xc34b8a37
xor edx, 0xc90b2bd7
rol edx, 0x63
popf
pushf
not edx
add edx, 0x8d49b7fc
xor edx, 0xe5a4d6d6
rol edx, 0xd0
popf
pushf
not edx
add edx, 0xbce6f2ff
xor edx, 0xb2f6c5ab
rol edx, 0xa0
popf
mov dword [rsp + 0x50], 0x40
lea r9, [rsp + 0x54]
lea r8d, [rdx + 0x3f]
jmp 0x14016f838
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rbx + 0xc]
lea r9, [rsp + 0x50]
push rdi
not rdi
sub rax, rdi
pop rdi
sub rax, 1
mov edx, 0xe2ae2d45
pushf
not edx
add edx, 0xb6462fb3
xor edx, 0xf6bc37db
rol edx, 0xb
popf
pushf
not edx
add edx, 0xb323e6b7
xor edx, 0x9172358d
rol edx, 0x6e
popf
mov byte [rax + r15], bpl
mov ecx, dword [rbx + 0xc]
mov r8d, dword [rsp + 0x54]
push rdi
not rdi
sub rcx, rdi
pop rdi
sub rcx, 1
push r15
not r15
sub rcx, r15
pop r15
sub rcx, 1
jmp 0x14016f8a8
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rbx + 0x10]
push rax
pushf
mov eax, 0xad7cee21
pushf
not eax
add eax, 0xe81198f8
xor eax, 0xbbfcb2c7
rol eax, 0xc8
popf
pushf
not eax
add eax, 0x9752530e
xor eax, 0xfdad2c05
rol eax, 0x45
popf
pushf
not eax
add eax, 0xdbcf24d7
xor eax, 0x88d1739c
rol eax, 0x2f
popf
jmp 0x14016e8a9
mov r13b, 0xc4
pushf
not r13b
add r13b, 0x11
xor r13b, 0x34
rol r13b, 0xc9
popf
pushf
not r13b
add r13b, 0x67
xor r13b, 0x5d
rol r13b, 0xe1
popf
pushf
not r13b
add r13b, 0xa7
xor r13b, 0x70
rol r13b, 0x4b
popf
push rax
pushf
mov eax, 0xe29eb1ec
pushf
not eax
add eax, 0xa024ada3
xor eax, 0x8dd566b2
rol eax, 0x72
popf
pushf
not eax
add eax, 0xe4d371cb
xor eax, 0xafa2f001
rol eax, 0x16
popf
pushf
not eax
add eax, 0xc2ff476e
xor eax, 0xa0876f39
rol eax, 0x3e
popf
jmp 0x14016e8a9
inc esi
mov edx, eax
cmp esi, eax
jb 0x14016f9c8
push rax
pushf
mov eax, 0x4b5edc0
pushf
not eax
add eax, 0x9b87ec4c
xor eax, 0x865a92d7
rol eax, 0xb6
popf
pushf
not eax
add eax, 0x93d0df63
xor eax, 0xefea3c60
rol eax, 0x4f
popf
pushf
not eax
add eax, 0xe56cbb09
xor eax, 0x90f8f175
rol eax, 0xa7
popf
jmp 0x14016e8a9
push rax
pushf
mov eax, 0x1c55ea71
pushf
not eax
add eax, 0xa020b46a
xor eax, 0xa4ee35f0
rol eax, 0x6e
popf
pushf
not eax
add eax, 0xe75062df
xor eax, 0xad0e5915
rol eax, 0xaa
popf
jmp 0x14016e8a9
mov rcx, r12
jmp 0x14016f9ff
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x48]
jmp 0x14016fa0b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, r13b
jmp 0x14016fb75
mov rcx, r12
jmp 0x14016fa51
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push rax
pushf
mov eax, 0x7db6cf36
pushf
not eax
add eax, 0xf68847f7
xor eax, 0x87b21086
rol eax, 0x29
popf
pushf
not eax
add eax, 0xf8a4fa77
xor eax, 0xb3c9a697
rol eax, 0xca
popf
pushf
not eax
add eax, 0x9015fef6
xor eax, 0xbb7c2449
rol eax, 0xee
popf
pushf
not eax
add eax, 0x8bc1be8a
xor eax, 0xf59895a4
rol eax, 0x4a
popf
jmp 0x14016e8a9
mov rcx, r14
jmp 0x14016fab4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0xaf74f656
pushf
not eax
add eax, 0xdab5f1d9
xor eax, 0x8675b5a2
rol eax, 0xe2
popf
pushf
not eax
add eax, 0xc329f93a
xor eax, 0xed4e7d0d
rol eax, 0xa3
popf
pushf
not eax
add eax, 0xca5e105b
xor eax, 0x8b882283
rol eax, 0xe7
popf
jmp 0x14016e8a9
mov al, 0xdb
pushf
not al
add al, 0x42
xor al, 0x7e
rol al, 0xf4
popf
pushf
not al
add al, 0x4e
xor al, 0x8c
rol al, 0x5a
popf
push rax
pushf
mov eax, 0x3d7df1d6
pushf
not eax
add eax, 0xfc213473
xor eax, 0xe35a01f3
rol eax, 0xd
popf
pushf
not eax
add eax, 0xdf93e353
xor eax, 0xd378e79c
rol eax, 0x26
popf
pushf
not eax
add eax, 0xfba9cb7f
xor eax, 0xc78c7424
rol eax, 0xd6
popf
pushf
not eax
add eax, 0xdf2ad0c3
xor eax, 0xfee1d62e
rol eax, 0x5e
popf
jmp 0x14016e8a9
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14027ae25
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret