Function at 0x140001030
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x298
mov r15, r9
mov r12, r8
mov r13, rdx
mov r14, rcx
lea rax, [rcx + 0x3c]
mov qword [rsp + 0x1d0], rax
mov rax, qword [rsp + 0x1d0]
movsxd rax, dword [rax]
add rax, rcx
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xd8]
mov esi, dword [rax]
mov ecx, 0x4550
call fcn.1400027f0
mov qword [rsp + 0x30], 0
cmp esi, eax
jne 0x14000240b
mov rax, qword [rsp + 0xd8]
add rax, 4
mov qword [rsp + 0x1d8], rax
mov rax, qword [rsp + 0x1d8]
movzx esi, word [rax]
mov ecx, 0x14c
mov edx, 0x6b
call fcn.1400027f0
mov qword [rsp + 0x30], 0
cmp si, ax
je 0x14000240b
mov rdi, qword [0x1400061d0]
mov rax, qword [rsp + 0xd8]
add rax, 0x18
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0xf8]
add rax, 0x38
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x1e0]
mov ebp, dword [rax]
mov rax, qword [rsp + 0xf8]
add rax, 0x18
mov qword [rsp + 0x1e8], rax
mov rax, qword [rsp + 0x1e8]
mov rsi, qword [rax]
mov edx, 0x59
mov r8d, 0x24
mov rcx, rbp
call fcn.1400027f0
mov rbx, rax
mov ecx, 0x3000
mov r8d, 0xb6
mov edx, ebp
call fcn.1400027f0
mov rbp, rax
mov ecx, 0x40
call fcn.1400027f0
mov rcx, rsi
mov rdx, rbx
mov r8d, ebp
mov r9d, eax
call rdi
mov qword [rsp + 0x1c8], rax
test rax, rax
jne 0x1400011e8
mov rdi, qword [0x1400061d0]
mov rax, qword [rsp + 0x1e0]
mov esi, dword [rax]
mov rcx, rsi
call fcn.1400027f0
mov rbx, rax
mov ecx, 0x3000
mov r8d, 0x7c
mov edx, esi
mov r9d, esi
call fcn.1400027f0
mov rbp, rax
mov ecx, 0x40
mov edx, esi
mov r8d, esi
call fcn.1400027f0
xor ecx, ecx
mov rdx, rbx
mov r8d, ebp
mov r9d, eax
call rdi
mov qword [rsp + 0x1c8], rax
mov qword [rsp + 0x30], 0
test rax, rax
je 0x14000240b
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rsi, rax
mov edx, 0x13
xor ecx, ecx
call fcn.1400027f0
mov rbx, rax
mov ecx, 0x50
mov edx, 0xe6
mov r8d, 0x39
call fcn.1400027f0
mov rcx, rsi
mov edx, ebx
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140001663
mov rdi, qword [rsp + 0x300]
mov rax, qword [rsp + 0x20]
add rax, 8
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
mov rax, qword [rsp + 0x20]
add rax, 0x18
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x20]
add rax, 0x10
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x20]
add rax, 0x1c
mov qword [rsp + 0x278], rax
mov rax, qword [rsp + 0x1d8]
mov rcx, qword [rsp + 0x1f0]
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
movzx ebp, word [rax + 0x12]
mov ecx, 0xd
mov edx, 0x4d
call fcn.1400027f0
mov esi, ebp
mov ecx, eax
shr esi, cl
mov ecx, 1
mov edx, ebp
mov r8d, ebp
call fcn.1400027f0
and eax, esi
mov rcx, qword [rsp + 0x20]
add rcx, 0x20
mov qword [rsp + 0x1f8], rcx
mov rcx, qword [rsp + 0x1f8]
mov dword [rcx], eax
mov rax, qword [rsp + 0x20]
add rax, 0x28
mov qword [rsp + 0x200], rax
mov rax, qword [rsp + 0x200]
mov qword [rax], r13
mov r13, rdi
mov rax, qword [rsp + 0x20]
add rax, 0x30
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x108]
mov qword [rax], r12
mov rax, qword [rsp + 0x20]
add rax, 0x38
mov qword [rsp + 0x208], rax
mov rax, qword [rsp + 0x208]
mov qword [rax], r15
mov rax, qword [rsp + 0x20]
add rax, 0x40
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rax], rdi
mov r15, qword [0x1400061d0]
mov rdi, qword [rsp + 0xf8]
mov ecx, dword [rdi + 0x3c]
call fcn.1400027f0
mov rsi, rax
mov ecx, 0x1000
mov edx, ebp
call fcn.1400027f0
mov rbx, rax
mov ecx, 4
call fcn.1400027f0
mov rcx, qword [rsp + 0x38]
mov rdx, rsi
mov r8d, ebx
mov r9d, eax
call r15
mov rsi, rax
mov r8d, dword [rdi + 0x3c]
mov rcx, rax
mov rdx, r14
call fcn.1400027c0
mov rax, qword [rsp + 0x1d0]
movsxd rax, dword [rax]
lea rcx, [rsi + rax]
mov rdx, qword [rsp + 0x20]
mov qword [rdx], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsi + rax + 0x30], rcx
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xe0]
movzx esi, word [rax + 6]
mov edx, 0xf9
mov r8d, 0xc9
xor ecx, ecx
mov r9d, ebp
call fcn.1400027f0
mov rcx, qword [rsp + 0xe0]
mov qword [rsp + 0x1b8], rcx
cmp si, ax
je 0x1400016c6
mov rsi, qword [rsp + 0xe0]
mov ecx, 0x18
mov rdx, rsi
call fcn.1400027f0
add rax, rsi
mov rcx, qword [rsp + 0xe0]
movzx ecx, word [rcx + 0x14]
add rcx, rax
mov rax, qword [rsp + 0xd8]
add rax, 0x38
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x1c0], rcx
mov dword [rsp + 0x9c], 0
jmp 0x140001561
mov r15, qword [0x1400061d0]
mov esi, dword [rsp + 0xa0]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov edi, dword [rcx + 0xc]
add rdi, qword [rax]
mov rcx, rsi
call fcn.1400027f0
mov rbx, rax
mov ecx, 0x1000
mov rdx, rsi
mov r8, rsi
mov r9, rsi
call fcn.1400027f0
mov rbp, rax
mov ecx, 0x40
mov edx, 0xb9
mov r8, rsi
call fcn.1400027f0
mov rcx, rdi
mov rdx, rbx
mov r8d, ebp
mov r9d, eax
call r15
mov rsi, rax
mov rax, qword [rsp + 0x48]
mov edx, dword [rax + 0x14]
add rdx, r14
mov rax, qword [rsp + 0x210]
mov r8d, dword [rax]
mov rcx, rsi
call fcn.1400027c0
mov rax, qword [rsp + 0x48]
mov dword [rax + 8], esi
mov ecx, 1
mov edx, 0x96
mov r8d, 6
call fcn.1400027f0
add eax, dword [rsp + 0xbc]
mov rcx, qword [rsp + 0x48]
add rcx, 0x28
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx]
mov qword [rsp + 0x110], rdx
mov rdx, qword [rsp + 0x110]
movzx edx, word [rdx + 6]
mov qword [rsp + 0x1c0], rcx
mov dword [rsp + 0x9c], eax
cmp eax, edx
jae 0x140001692
mov eax, dword [rsp + 0x9c]
mov dword [rsp + 0xbc], eax
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
add rax, 0x10
mov qword [rsp + 0x210], rax
mov rax, qword [rsp + 0x210]
mov eax, dword [rax]
mov dword [rsp + 0xa0], eax
mov edx, dword [rsp + 0xbc]
xor ecx, ecx
call fcn.1400027f0
mov ecx, dword [rsp + 0xa0]
cmp ecx, eax
jne 0x140001480
mov rax, qword [rsp + 0x280]
mov eax, dword [rax]
mov dword [rsp + 0x50], eax
mov edx, dword [rsp + 0x50]
xor ecx, ecx
mov r8d, edx
call fcn.1400027f0
mov ecx, dword [rsp + 0x50]
cmp ecx, eax
jle 0x140001509
mov r15, qword [0x1400061d0]
mov esi, dword [rsp + 0x50]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov ebx, dword [rcx + 0xc]
add rbx, qword [rax]
mov r9d, 0xe2
mov rcx, rsi
mov rdx, rsi
mov r8, rsi
call fcn.1400027f0
mov rbp, rax
mov ecx, 0x1000
mov rdx, rsi
mov r8, rsi
call fcn.1400027f0
mov rdi, rax
mov ecx, 0x40
mov edx, 0xb
mov r8, rsi
call fcn.1400027f0
mov rcx, rbx
mov rdx, rbp
mov r8d, edi
mov r9d, eax
call r15
mov rcx, qword [rsp + 0x48]
mov dword [rcx + 8], eax
mov rcx, rax
xor edx, edx
mov r8, rsi
call fcn.1400026a0
jmp 0x140001509
mov edx, 0xb7
xor ecx, ecx
call fcn.1400027f0
mov rsi, rax
mov ecx, 0x8000
call fcn.1400027f0
mov rcx, qword [rsp + 0x38]
mov rdx, rsi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1400023d7
cmp qword [rsp + 0x38], 0
mov rax, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x110]
mov qword [rsp + 0x1b8], rax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0xd0], rcx
je 0x140001a22
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x1e8]
mov rsi, qword [rax]
xor ecx, ecx
call fcn.1400027f0
sub rax, rsi
add rax, qword [rsp + 0x38]
mov qword [rsp + 0x218], rax
mov rax, qword [rsp + 0xe8]
mov esi, dword [rax + 0xb4]
mov edx, 0xb4
xor ecx, ecx
call fcn.1400027f0
mov dword [rsp + 0x2c], 0
mov rcx, qword [rsp + 0xe8]
mov qword [rsp + 0xd0], rcx
cmp esi, eax
je 0x140001a22
mov rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x40]
mov edx, dword [rax + 0xb0]
mov rax, rdx
add rax, qword [rcx]
mov qword [rsp + 0x220], rax
mov rax, qword [rsp + 0x220]
mov eax, dword [rax]
mov dword [rsp + 0xa4], eax
xor ecx, ecx
call fcn.1400027f0
mov ecx, dword [rsp + 0xa4]
mov dword [rsp + 0x2c], 1
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0xd0], rdx
cmp ecx, eax
je 0x140001a22
movabs r14, 0x1fffffff8
mov rax, qword [rsp + 0x218]
mov dword [rsp + 0x130], eax
mov rax, qword [rsp + 0x220]
mov ecx, dword [rsp + 0xa4]
mov dword [rsp + 0x98], ecx
mov qword [rsp + 0x1b0], rax
jmp 0x140001819
mov eax, dword [rsp + 0xac]
mov qword [rsp + 0x1a8], rax
mov rax, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0x120]
lea rdi, [rcx + rax]
mov ebx, dword [rcx + rax]
mov edx, 0xce68f6
xor ecx, ecx
call fcn.1400027f0
mov dword [rsp + 0x98], ebx
mov qword [rsp + 0x1b0], rdi
cmp ebx, eax
je 0x140001a0a
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x120], rax
mov edi, dword [rsp + 0x98]
mov rax, qword [rsp + 0x40]
mov rcx, rdi
add rcx, qword [rax]
mov qword [rsp + 0x228], rcx
mov rax, qword [rsp + 0x120]
add rax, 4
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0x230]
mov ebp, dword [rax]
mov rcx, r14
mov edx, edi
call fcn.1400027f0
mov rbx, rax
add rbx, rbp
mov ecx, 1
mov edx, edi
call fcn.1400027f0
mov ecx, eax
shr rbx, cl
mov edx, 0x13
mov r8d, 0x84
xor ecx, ecx
call fcn.1400027f0
mov qword [rsp + 0x1a8], rbp
cmp ebx, eax
jle 0x1400017df
mov rax, qword [rsp + 0x120]
add rax, 8
mov dword [rsp + 0x94], 0
mov qword [rsp + 0x1a0], rax
jmp 0x140001979
mov eax, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0x228]
mov rdx, qword [rcx + rax]
add rdx, qword [rsp + 0x218]
mov qword [rcx + rax], rdx
mov ecx, 1
mov edx, 0x97
mov r8d, 0x12
call fcn.1400027f0
mov rdi, rax
add edi, dword [rsp + 0xc0]
mov rbp, qword [rsp + 0x258]
add rbp, 2
mov rax, qword [rsp + 0x230]
mov eax, dword [rax]
mov dword [rsp + 0xac], eax
mov esi, dword [rsp + 0xac]
mov r8d, 0xc8771f
mov rcx, r14
mov edx, edi
mov r9d, edi
call fcn.1400027f0
mov rbx, rax
add rbx, rsi
mov ecx, 1
mov edx, edi
mov r8d, edi
mov r9d, edi
call fcn.1400027f0
mov ecx, eax
shr rbx, cl
mov dword [rsp + 0x94], edi
mov qword [rsp + 0x1a0], rbp
cmp edi, ebx
jge 0x1400017d0
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x258], rax
mov eax, dword [rsp + 0x94]
mov dword [rsp + 0xc0], eax
mov rax, qword [rsp + 0x258]
movzx ebx, word [rax]
mov edx, dword [rsp + 0xc0]
mov ecx, 0xc
call fcn.1400027f0
mov edi, ebx
mov ecx, eax
shr edi, cl
mov ecx, 0xfff
mov edx, 0x11
mov r8d, 0x11
call fcn.1400027f0
and eax, ebx
mov dword [rsp + 0xa8], eax
cmp edi, 0xa
je 0x1400018d0
cmp edi, 3
jne 0x1400018ef
mov eax, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0x228]
mov edx, dword [rcx + rax]
add edx, dword [rsp + 0x130]
mov dword [rcx + rax], edx
jmp 0x1400018ef
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x260], rax
mov eax, dword [rsp + 0x2c]
mov rcx, qword [rsp + 0x20]
mov dword [rcx + 0x24], eax
mov rax, qword [rsp + 0x260]
mov esi, dword [rax + 0x94]
xor ecx, ecx
call fcn.1400027f0
cmp esi, eax
je 0x140001e30
mov rax, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov qword [rsp + 0x58], rcx
mov esi, dword [rax + 0x90]
mov rdi, rsi
add rdi, qword [rsp + 0x58]
mov ecx, 0x14
mov edx, esi
call fcn.1400027f0
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
mov ebx, eax
xor ecx, ecx
mov edx, esi
mov r8d, esi
mov r9d, esi
call fcn.1400027f0
mov qword [rsp + 0x198], rdi
cmp ebx, eax
jne 0x140001e30
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
jmp 0x140001b10
mov rsi, qword [rsp + 0x80]
add rsi, 0x14
mov ecx, 0x14
mov edx, 0x1e
mov r8d, 0xb5
mov r9d, 0xbe
call fcn.1400027f0
mov rcx, rsi
mov rdx, rax
call r14
mov edi, eax
xor ecx, ecx
call fcn.1400027f0
mov qword [rsp + 0x198], rsi
cmp edi, eax
jne 0x140001e30
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0xb0], eax
xor ecx, ecx
call fcn.1400027f0
mov ecx, dword [rsp + 0xb0]
cmp ecx, eax
je 0x140001e30
mov rax, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx]
mov ecx, dword [rsp + 0xb0]
add rcx, qword [rsp + 0x58]
call qword [rax]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x1400023cd
mov rax, qword [rsp + 0x100]
mov esi, dword [rax]
mov ecx, 1
mov edx, esi
mov r8d, esi
call fcn.1400027f0
add eax, esi
movsxd rdi, eax
mov ecx, 3
mov edx, esi
call fcn.1400027f0
mov ecx, eax
shl rdi, cl
mov rcx, rdi
call fcn.1400027f0
mov rdi, rax
mov ecx, 0x1000
mov edx, esi
call fcn.1400027f0
mov rsi, rax
mov ecx, 4
mov edx, 0xac
call fcn.1400027f0
xor ecx, ecx
mov rdx, rdi
mov r8d, esi
mov r9d, eax
call rbx
mov qword [rsp + 0x118], rax
cmp qword [rsp + 0x118], 0
je 0x140002379
mov rax, qword [rsp + 0x1f0]
mov rcx, qword [rsp + 0x118]
mov qword [rax], rcx
mov rax, qword [rsp + 0x100]
movsxd rsi, dword [rax]
mov ecx, 1
mov edx, 0xa3
call fcn.1400027f0
add eax, esi
mov rcx, qword [rsp + 0x100]
mov dword [rcx], eax
mov rax, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x78]
mov qword [rax + rsi*8], rcx
mov rax, qword [rsp + 0x80]
mov eax, dword [rax]
mov dword [rsp + 0xb4], eax
mov r8d, 0xd9
xor ecx, ecx
mov edx, esi
call fcn.1400027f0
mov ecx, dword [rsp + 0xb4]
cmp ecx, eax
jne 0x140001c8a
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x10]
add rax, qword [rsp + 0x58]
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x188], rax
jmp 0x140001cb6
mov eax, dword [rsp + 0xb4]
add rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x80]
mov ecx, dword [rcx + 0x10]
add rcx, qword [rsp + 0x58]
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x188], rcx
mov rdi, qword [rsp + 0x188]
mov rbp, qword [rsp + 0x190]
mov rsi, qword [rbp]
mov r8d, 0xc5
xor ecx, ecx
mov rdx, rsi
call fcn.1400027f0
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x178], rdi
mov qword [rsp + 0x170], rbp
cmp rsi, rax
je 0x140001ac7
nop dword [rax + rax]
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x288], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x268], rax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x128], rax
mov edx, 0x84
mov rcx, 0xffffffffffffffff
call fcn.1400027f0
mov rcx, qword [rsp + 0x128]
cmp rcx, rax
jle 0x140001d80
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x128]
mov rbp, qword [rsp + 0x108]
mov rdx, qword [rsp + 0x70]
mov r8, qword [rdx]
lea rdx, [rax + rcx]
add rdx, 2
mov rcx, qword [rsp + 0x78]
call qword [rbp]
jmp 0x140001db7
mov rax, qword [rsp + 0x108]
mov rdi, qword [rax]
mov rax, qword [rsp + 0x70]
mov rsi, qword [rax]
mov ecx, 0xffff
mov edx, 0x46
call fcn.1400027f0
and rax, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x78]
mov rdx, rax
mov r8, rsi
call rdi
mov qword [rsp + 0x168], rax
mov rax, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x268]
mov qword [rcx], rax
test rax, rax
je 0x140002379
mov rdi, qword [rsp + 0x288]
mov rbp, qword [rsp + 0x268]
add rbp, 8
mov rsi, qword [rdi + 8]
add rdi, 8
mov r8d, 0x15
xor ecx, ecx
mov rdx, rsi
mov r9, rsi
call fcn.1400027f0
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x178], rbp
mov qword [rsp + 0x170], rdi
cmp rsi, rax
jne 0x140001d00
jmp 0x140001ac7
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov rsi, qword [rax + 0x30]
movabs rcx, 0xffffffff00000000
mov edx, 0x327c40
call fcn.1400027f0
and rax, rsi
mov qword [rsp + 0x238], rax
mov rax, qword [rsp + 0x60]
movzx esi, word [rax + 6]
xor ecx, ecx
call fcn.1400027f0
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x148], rcx
cmp si, ax
jne 0x140002000
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x240], rax
mov rax, qword [rsp + 0xf0]
mov eax, dword [rax + 0xd0]
mov dword [rsp + 0x54], eax
mov edx, dword [rsp + 0x54]
mov r8d, 0xd2
xor ecx, ecx
mov r9d, edx
call fcn.1400027f0
mov ecx, dword [rsp + 0x54]
mov rdx, qword [rsp + 0xf0]
mov qword [rsp + 0xc8], rdx
cmp ecx, eax
je 0x140001fc6
mov edx, dword [rsp + 0x54]
mov rax, qword [rsp + 0x240]
mov rax, qword [rax + rdx + 0x18]
mov qword [rsp + 0x248], rax
xor ecx, ecx
mov r8, rdx
call fcn.1400027f0
mov rcx, qword [rsp + 0x248]
mov rdx, qword [rsp + 0xf0]
mov qword [rsp + 0xc8], rdx
cmp rcx, rax
je 0x140001fc6
mov rax, qword [rsp + 0x248]
mov rcx, qword [rax]
mov qword [rsp + 0x140], rcx
mov qword [rsp + 0x138], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0xc8], rax
test rcx, rcx
je 0x140001fc6
nop word cs:[rax + rax]
mov rsi, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x140]
mov ecx, 1
call fcn.1400027f0
mov rcx, qword [rsp + 0x240]
mov edx, eax
xor r8d, r8d
call rdi
mov rax, qword [rsi + 8]
add rsi, 8
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x138], rsi
test rax, rax
jne 0x140001f70
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov eax, dword [rax + 0x28]
mov dword [rsp + 0xb8], eax
xor ecx, ecx
call fcn.1400027f0
mov ecx, dword [rsp + 0xb8]
cmp ecx, eax
jne 0x140002335
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x48], 0
jmp 0x140002401
mov rsi, qword [rsp + 0x60]
mov ecx, 0x18
mov rdx, rsi
call fcn.1400027f0
add rax, rsi
mov rcx, qword [rsp + 0x60]
movzx ecx, word [rcx + 0x14]
add rcx, rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x158], rcx
mov dword [rsp + 0x90], 0
lea r15, section..rdata
lea r14, [rsp + 0x294]
mov r12, qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140002107
mov rax, qword [rsp + 0x68]
mov esi, dword [rax + 0x10]
mov rax, qword [rsp + 0x68]
mov ebx, dword [rax + 8]
or rbx, qword [rsp + 0x238]
mov edx, 0xcc
mov rcx, rsi
mov r8d, esi
call fcn.1400027f0
mov rbp, rax
mov ecx, 0xc000
mov r8d, 0x42
mov edx, esi
call fcn.1400027f0
mov rcx, rbx
mov rdx, rbp
mov r8d, eax
call r12
mov ecx, 1
mov edx, 0xa6
mov r8d, 0x76
mov r9d, 0x25
call fcn.1400027f0
add eax, dword [rsp + 0xc4]
mov rcx, qword [rsp + 0x68]
add rcx, 0x28
mov rdx, qword [rsp + 0x20]
mov rdx, qword [rdx]
movzx ebp, word [rdx + 6]
mov qword [rsp + 0x160], rdx
mov qword [rsp + 0x158], rcx
mov dword [rsp + 0x90], eax
mov qword [rsp + 0x148], rdx
cmp eax, ebp
jae 0x140001e8b
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0xc4], eax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x24]
mov dword [rsp + 0x28], eax
mov edx, dword [rsp + 0xc4]
mov ecx, 0x2000000
mov r8d, edx
call fcn.1400027f0
mov rsi, rax
and esi, dword [rsp + 0x28]
xor ecx, ecx
call fcn.1400027f0
cmp esi, eax
jne 0x140002060
mov ecx, 0x1f
call fcn.1400027f0
mov esi, dword [rsp + 0x28]
mov ecx, eax
shr rsi, cl
mov ecx, 0x1e
mov edx, 0x19
mov r8d, esi
mov r9d, esi
call fcn.1400027f0
mov ebx, dword [rsp + 0x28]
mov ecx, eax
shr rbx, cl
mov ecx, 1
mov r8d, 0x1d
mov r9d, 0x46
mov edx, esi
call fcn.1400027f0
and ebx, eax
mov ecx, 0x1d
mov edx, 0x2b
mov r8d, 0xf
call fcn.1400027f0
mov ebp, dword [rsp + 0x28]
mov ecx, eax
shr rbp, cl
mov ecx, 1
mov edx, esi
call fcn.1400027f0
and ebp, eax
shl rbp, 4
add rbp, r15
lea rbx, [rbx*8]
add rbx, rbp
mov ecx, 0x11
mov edx, 0xcd
call fcn.1400027f0
mov ebp, dword [rsp + 0x28]
mov ecx, eax
shr ebp, cl
mov ecx, 0x200
mov edx, esi
call fcn.1400027f0
and eax, ebp
or eax, dword [rbx + rsi*4]
mov dword [rsp + 0x134], eax
mov rax, qword [rsp + 0x68]
mov ebx, dword [rax + 0x10]
xor ecx, ecx
mov edx, esi
mov r8d, esi
call fcn.1400027f0
mov dword [rsp + 0x8c], ebx
cmp ebx, eax
jne 0x1400022dd
mov ecx, 0x40
mov edx, 0x1ccd18
call fcn.1400027f0
mov rsi, rax
and esi, dword [rsp + 0x28]
mov edx, 0xc9
xor ecx, ecx
call fcn.1400027f0
cmp esi, eax
jne 0x1400022a4
mov ecx, 0x80
mov edx, 0x97
mov r8d, 0x2d
call fcn.1400027f0
mov rsi, rax
and esi, dword [rsp + 0x28]
xor ecx, ecx
mov edx, esi
call fcn.1400027f0
cmp esi, eax
je 0x1400020a9
mov rax, qword [rsp + 0x270]
add rax, 0x24
jmp 0x1400022b0
mov rax, qword [rsp + 0x270]
add rax, 0x20
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x150]
mov esi, dword [rax]
mov edx, 0x92
xor ecx, ecx
call fcn.1400027f0
mov dword [rsp + 0x8c], esi
cmp esi, eax
je 0x1400020a9
mov esi, dword [rsp + 0x8c]
mov rdi, qword [0x1400061d8]
mov rax, qword [rsp + 0x68]
mov ebx, dword [rax + 8]
or rbx, qword [rsp + 0x238]
mov edx, 0x72
mov rcx, rsi
call fcn.1400027f0
mov rbp, rax
mov ecx, dword [rsp + 0x134]
mov r8d, 0x96
mov edx, esi
mov r9d, esi
call fcn.1400027f0
mov rcx, rbx
mov rdx, rbp
mov r8d, eax
mov r9, r14
call rdi
jmp 0x1400020a9
mov rax, qword [rsp + 0x1f8]
mov esi, dword [rax]
mov edx, 0xb5
xor ecx, ecx
call fcn.1400027f0
mov ecx, dword [rsp + 0xb8]
add rcx, qword [rsp + 0x38]
mov qword [rsp + 0x250], rcx
cmp esi, eax
jne 0x140002392
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x250]
mov qword [rax + 0x48], rcx
jmp 0x140002401
mov rax, qword [rsp + 0x208]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx]
mov rcx, qword [rsp + 0x78]
call qword [rax]
jmp 0x1400023cd
mov ecx, 1
mov edx, 0xf2a381
mov r8d, 0x37
call fcn.1400027f0
mov rbp, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x38]
mov edx, eax
mov r8, r13
call rbp
mov esi, eax
mov edx, 3
xor ecx, ecx
call fcn.1400027f0
cmp esi, eax
jne 0x1400023e2
mov rcx, qword [rsp + 0x20]
call fcn.140002460
mov qword [rsp + 0x30], 0
jmp 0x14000240b
mov ecx, 1
mov edx, 0xbf
mov r8d, 0x5c
call fcn.1400027f0
mov rcx, qword [rsp + 0x278]
mov dword [rcx], eax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
add rsp, 0x298
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret