Function at 0x140006000
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x3e0], xmm7
movdqa xmmword [rbp + 0x3d0], xmm6
mov qword [rbp + 0x3c8], 0xfffffffffffffffe
mov r15, r9
mov r14d, r8d
mov r13, rdx
mov rsi, rcx
mov rdi, qword [rbp + 0x460]
mov dword [rbp + 0x30c], r8d
mov qword [rbp + 0x20], r9
mov qword [rbp + 0x28], rdi
lea rcx, [rbp + 0x178]
call fcn.140007b60
mov rax, qword [rbp + 0x178]
movabs rbx, 0x8000000000000000
cmp rax, rbx
jne 0x1400065fe
mov qword [rbp + 0x330], r15
mov r12d, dword [rbp + 0x180]
mov dword [rbp + 0x3c4], r12d
lea rax, str.LdrGetProcedureAddressUnderflow_in_address_calculationMemory_allocation_for_GetProcAddressParams_failed
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 0x16
test r12, r12
je 0x140006271
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x160], xmm0
movdqa xmmword [rbp + 0x150], xmm0
movdqa xmmword [rbp + 0x140], xmm0
movdqa xmmword [rbp + 0x130], xmm0
mov dword [rbp + 0x2d0], r12d
mov qword [rbp + 0x2e0], 0
lea rax, [rbp + 0x2e0]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x130]
mov r9d, 0x40
mov rcx, r13
mov rdx, r12
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x14000611b
cmp qword [rbp + 0x2e0], 0x40
je 0x1400061cc
call sub.KERNEL32.dll_GetLastError
mov dword [rbp + 0x2b0], eax
lea rax, [rbp + 0x2d0]
mov qword [rbp + 0x30], rax
lea rdi, [0x140053580]
mov qword [rbp + 0x38], rdi
lea rax, [rbp + 0x2b0]
mov qword [rbp + 0x40], rax
lea rax, [fcn.140053b70]
mov qword [rbp + 0x48], rax
lea rax, str.Error_reading_memory_at_:_Error_Code
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x180], 2
mov qword [rbp + 0x198], 0
lea rbx, [rbp + 0x30]
mov qword [rbp + 0x188], rbx
mov qword [rbp + 0x190], 2
lea r15, [rbp + 0x370]
lea rdx, [rbp + 0x178]
mov rcx, r15
call fcn.14004e4c0
mov rax, qword [rbp + 0x370]
movdqu xmm0, xmmword [rbp + 0x378]
movdqa xmmword [rbp + 0x340], xmm0
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x140006391
movabs rbx, 0x8000000000000000
movzx eax, word [rbp + 0x130]
cmp eax, 0x5a4d
jne 0x1400062cc
mov eax, dword [rbp + 0x3c4]
add eax, dword [rbp + 0x16c]
jae 0x140006623
movzx eax, byte [0x140108f61]
mov ecx, 0x2a
mov edx, 1
call fcn.1400168f0
test rax, rax
mov rdi, qword [rbp + 0x460]
je 0x1400075cb
movups xmm0, xmmword [0x1400c206f]
movups xmmword [rax + 0x1a], xmm0
movups xmm0, xmmword [0x1400c2065]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [0x1400c2055]
movdqu xmmword [rax], xmm0
mov qword [rbp + 0x3a8], 0x2a
mov qword [rbp + 0x3b0], rax
mov qword [rbp + 0x3b8], 0x2a
cmp qword [rbp + 0x3a8], rbx
je 0x140006333
jmp 0x14000717b
movzx eax, byte [0x140108f61]
mov ecx, 0x18
mov edx, 1
call fcn.1400168f0
test rax, rax
je 0x14000758d
movdqu xmm0, xmmword [0x1400c203d]
movdqu xmmword [rax], xmm0
movabs rcx, 0x3020736920737365
mov qword [rax + 0x10], rcx
mov qword [rbp + 0x3a8], 0x18
mov qword [rbp + 0x3b0], rax
mov qword [rbp + 0x3b8], 0x18
jmp 0x14000717b
movzx eax, byte [0x140108f61]
mov ecx, 0x1c
mov edx, 1
call fcn.1400168f0
test rax, rax
mov rdi, qword [rbp + 0x460]
je 0x14000759c
movups xmm0, xmmword [0x1400c2198]
movups xmmword [rax + 0xc], xmm0
movdqu xmm0, xmmword [0x1400c218c]
movdqu xmmword [rax], xmm0
mov qword [rbp + 0x3a8], 0x1c
mov qword [rbp + 0x3b0], rax
mov qword [rbp + 0x3b8], 0x1c
cmp qword [rbp + 0x3a8], rbx
jne 0x14000717b
mov r14d, dword [rbp + 0x3b0]
cmp r14d, r12d
jae 0x140006485
movzx eax, byte [0x140108f61]
mov ecx, 0x20
mov edx, 1
call fcn.1400168f0
test rax, rax
je 0x1400075bc
movups xmm0, xmmword [0x1400c2326]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [0x1400c2316]
movdqu xmmword [rax], xmm0
mov qword [rsi], 0x20
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0x20
jmp 0x14000749a
mov qword [rbp + 0x370], rax
movaps xmm0, xmmword [rbp + 0x340]
movups xmmword [rbp + 0x378], xmm0
lea rax, [rbp + 0x3c4]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x40], r15
lea rax, [0x140001c50]
mov qword [rbp + 0x48], rax
lea rax, [0x1400c21d0]
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x180], 2
mov qword [rbp + 0x198], 0
mov qword [rbp + 0x188], rbx
mov qword [rbp + 0x190], 2
lea rcx, [rbp + 0x2e0]
lea rdx, [rbp + 0x178]
call fcn.14004e4c0
mov rdx, qword [rbp + 0x370]
test rdx, rdx
movabs rbx, 0x8000000000000000
je 0x140006435
mov rcx, qword [rbp + 0x378]
mov r8d, 1
call fcn.140016900
mov rax, qword [rbp + 0x2e0]
movdqu xmm0, xmmword [rbp + 0x2e8]
movdqa xmmword [rbp + 0x310], xmm0
cmp rax, rbx
je 0x1400061d6
movdqa xmm0, xmmword [rbp + 0x310]
movdqu xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3a8], rax
mov rdi, qword [rbp + 0x460]
cmp qword [rbp + 0x3a8], rbx
je 0x140006333
jmp 0x14000717b
mov edx, 0x120
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
call sub.KERNEL32.dll_VirtualAlloc
test rax, rax
je 0x140006eeb
cmp rdi, 0x105
mov r13, rdi
jae 0x1400075da
mov r12, rax
mov rdi, rax
lea r15, [rax + 0x18]
mov rcx, r15
mov rdx, qword [rbp + 0x330]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov qword [r12 + 8], r15
mov word [r12 + 2], 0x104
mov word [r12], r13w
add r12, 0x10
mov qword [rdi + 0x10], 0
mov eax, dword [rbp + 0x30c]
mov dword [rbp + 0x370], eax
mov dword [rbp + 0x374], edi
mov dword [rbp + 0x378], 0
mov dword [rbp + 0x37c], r12d
lea rcx, [rbp + 0x178]
lea r8, [rbp + 0x370]
mov r9d, 4
mov edx, r14d
call fcn.1400107b0
mov rax, qword [rbp + 0x178]
cmp rax, rbx
jne 0x1400065fe
mov eax, dword [rbp + 0x180]
test eax, eax
je 0x1400070ae
mov dword [rbp + 0x2e0], eax
lea rdi, [rbp + 0x130]
mov rcx, rdi
call fcn.140005940
lea rax, [rbp + 0x2e0]
mov qword [rbp + 0x30], rax
lea rax, [0x140053580]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rdi
lea rax, [0x140001c50]
mov qword [rbp + 0x48], rax
lea rax, [0x1400c23d0]
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x180], 2
mov qword [rbp + 0x198], 0
lea rax, [rbp + 0x30]
mov qword [rbp + 0x188], rax
mov qword [rbp + 0x190], 2
lea rcx, [rbp - 8]
lea rdx, [rbp + 0x178]
call fcn.14004e4c0
mov rax, qword [rbp + 8]
mov qword [rsi + 0x10], rax
movdqu xmm0, xmmword [rbp - 8]
movdqu xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x130]
test rdx, rdx
je 0x14000749a
mov rcx, qword [rbp + 0x138]
jmp 0x14000748f
mov ecx, dword [rbp + 0x180]
mov edx, dword [rbp + 0x18c]
mov dword [rsi + 0x14], edx
mov rdx, qword [rbp + 0x184]
mov qword [rsi + 0xc], rdx
mov qword [rsi], rax
mov dword [rsi + 8], ecx
jmp 0x14000749a
mov edx, eax
mov dword [rbp + 0x2a0], eax
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
movdqa xmmword [rbp + 0x100], xmm0
movdqa xmmword [rbp + 0xf0], xmm0
movdqa xmmword [rbp + 0xe0], xmm0
movdqa xmmword [rbp + 0xd0], xmm0
movdqa xmmword [rbp + 0xc0], xmm0
movdqa xmmword [rbp + 0xb0], xmm0
movdqa xmmword [rbp + 0xa0], xmm0
movdqa xmmword [rbp + 0x90], xmm0
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmmword [rbp + 0x70], xmm0
movdqa xmmword [rbp + 0x60], xmm0
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x120], 0
mov dword [rbp + 0x280], eax
mov qword [rbp + 0x340], 0
lea rax, [rbp + 0x340]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x30]
mov r9d, 0xf8
mov rcx, r13
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x1400066e7
cmp qword [rbp + 0x340], 0xf8
je 0x1400067a7
call sub.KERNEL32.dll_GetLastError
mov dword [rbp + 0x2d0], eax
lea rax, [rbp + 0x280]
mov qword [rbp + 0x370], rax
lea rdi, [0x140053580]
mov qword [rbp + 0x378], rdi
lea rax, [rbp + 0x2d0]
mov qword [rbp + 0x380], rax
lea rax, [fcn.140053b70]
mov qword [rbp + 0x388], rax
lea rax, str.Error_reading_memory_at_:_Error_Code
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x180], 2
mov qword [rbp + 0x198], 0
lea rbx, [rbp + 0x370]
mov qword [rbp + 0x188], rbx
mov qword [rbp + 0x190], 2
lea r15, [rbp + 0x2e0]
lea rdx, [rbp + 0x178]
mov rcx, r15
call fcn.14004e4c0
mov rax, qword [rbp + 0x2e0]
movdqu xmm0, xmmword [rbp + 0x2e8]
movdqa xmmword [rbp + 0x310], xmm0
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x140006f48
movabs rbx, 0x8000000000000000
mov rdi, qword [rbp + 0x460]
cmp dword [rbp + 0x30], 0x4550
jne 0x140006e86
mov r15d, dword [rbp + 0xa8]
test r15d, r15d
je 0x140007029
mov eax, dword [rbp + 0xac]
mov dword [rbp + 0x2ac], eax
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x2f0], xmm0
movdqa xmmword [rbp + 0x2e0], xmm0
mov qword [rbp + 0x300], 0
mov r8d, dword [rbp + 0x3c4]
add r8d, r15d
lea rcx, [rbp + 0x178]
lea r9, [rbp + 0x2e0]
mov rdx, r13
call fcn.140005b90
mov r8d, dword [rbp + 0x3c4]
lea rcx, [rbp + 0x370]
lea rdx, [rbp + 0x178]
mov dword [rbp + 0x2a8], r15d
mov r9d, r15d
call fcn.1400056f0
mov rax, qword [rbp + 0x370]
cmp rax, rbx
jne 0x140007085
cmp dword [rbp + 0x2f4], 0
je 0x1400070c1
mov eax, dword [rbp + 0x2f8]
mov dword [rbp + 0x2a4], eax
test eax, eax
je 0x1400070c1
movdqa xmm6, xmmword [str.ProcedureAddressLdrGetProcedureAnnnnnnnnnnnnnnnnllllllllllllllllOk]
movdqa xmm7, xmmword [0x1400c1e90]
xor r15d, r15d
mov dword [rbp + 0x308], r15d
lea eax, [r15*4]
add eax, dword [rbp + 0x300]
jb 0x14000712b
mov dword [rbp + 0x36c], 0
add eax, dword [rbp + 0x3c4]
jb 0x14000712b
mov dword [rbp + 0x3a4], eax
mov qword [rbp + 0x310], 0
mov edx, eax
lea rax, [rbp + 0x310]
mov qword [rsp + 0x20], rax
mov r9d, 4
mov rcx, r13
lea r8, [rbp + 0x36c]
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x1400068ff
cmp qword [rbp + 0x310], 4
je 0x140006a96
call sub.KERNEL32.dll_GetLastError
mov dword [rbp + 0x280], eax
lea rax, [rbp + 0x3a4]
mov qword [rbp + 0x370], rax
lea rax, [0x140053580]
mov qword [rbp + 0x378], rax
lea rax, [rbp + 0x280]
mov qword [rbp + 0x380], rax
lea rax, [fcn.140053b70]
mov qword [rbp + 0x388], rax
lea rax, str.Error_reading_memory_at_:_Error_Code
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x180], 2
mov qword [rbp + 0x198], 0
lea rax, [rbp + 0x370]
mov qword [rbp + 0x188], rax
mov qword [rbp + 0x190], 2
lea rcx, [rbp + 0x340]
lea rdx, [rbp + 0x178]
call fcn.14004e4c0
mov rax, qword [rbp + 0x340]
lea rcx, [rbp + 0x348]
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rbp + 0x2b0], xmm0
cmp rax, rbx
je 0x140006a96
mov qword [rbp + 0x340], rax
movaps xmm0, xmmword [rbp + 0x2b0]
lea rax, [rbp + 0x348]
movups xmmword [rax], xmm0
lea rax, [rbp + 0x308]
mov qword [rbp + 0x370], rax
lea rax, [fcn.140053b70]
mov qword [rbp + 0x378], rax
lea rax, [rbp + 0x340]
mov qword [rbp + 0x380], rax
lea rax, [0x140001c50]
mov qword [rbp + 0x388], rax
lea rax, str.x__f_
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x180], 2
mov qword [rbp + 0x198], 0
lea rax, [rbp + 0x370]
mov qword [rbp + 0x188], rax
mov qword [rbp + 0x190], 2
lea rcx, [rbp + 0x310]
lea rdx, [rbp + 0x178]
call fcn.14004e4c0
mov rdx, qword [rbp + 0x340]
test rdx, rdx
je 0x140006a73
mov rcx, qword [rbp + 0x348]
mov r8d, 1
call fcn.140016900
mov rax, qword [rbp + 0x310]
lea rcx, [rbp + 0x318]
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rbp + 0x2d0], xmm0
cmp rax, rbx
jne 0x140007573
mov qword [rbp + 0x338], r15
mov r8d, 0x104
lea r15, [rbp + 0x178]
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rbp + 0x3c4]
add eax, dword [rbp + 0x36c]
jb 0x1400074bc
mov dword [rbp + 0x29c], eax
mov qword [rbp + 0x2b0], 0
mov edx, eax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
mov r9d, 0x104
mov rcx, r13
mov r8, r15
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x140006b13
cmp qword [rbp + 0x2b0], 0x104
jne 0x140006b13
mov r15, qword [rbp + 0x338]
jmp 0x140006cc3
call sub.KERNEL32.dll_GetLastError
mov dword [rbp + 0x3a4], eax
lea rax, [rbp + 0x29c]
mov qword [rbp + 0x340], rax
lea rax, [0x140053580]
mov qword [rbp + 0x348], rax
lea rax, [rbp + 0x3a4]
mov qword [rbp + 0x350], rax
lea rax, [fcn.140053b70]
mov qword [rbp + 0x358], rax
lea rax, str.Error_reading_memory_at_:_Error_Code
mov qword [rbp + 0x370], rax
mov qword [rbp + 0x378], 2
mov qword [rbp + 0x390], 0
lea rax, [rbp + 0x340]
mov qword [rbp + 0x380], rax
mov qword [rbp + 0x388], 2
lea rcx, [rbp + 0x310]
lea rdx, [rbp + 0x370]
call fcn.14004e4c0
mov rax, qword [rbp + 0x310]
lea rcx, [rbp + 0x318]
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rbp + 0x2d0], xmm0
cmp rax, rbx
mov r15, qword [rbp + 0x338]
je 0x140006cc3
mov ecx, dword [rbp + 0x3c4]
add ecx, dword [rbp + 0x36c]
mov qword [rbp + 0x310], rax
movaps xmm0, xmmword [rbp + 0x2d0]
lea rax, [rbp + 0x318]
movups xmmword [rax], xmm0
mov dword [rbp + 0x3a4], ecx
lea rax, [rbp + 0x3a4]
mov qword [rbp + 0x340], rax
lea rax, [0x140053580]
mov qword [rbp + 0x348], rax
lea rax, [rbp + 0x310]
mov qword [rbp + 0x350], rax
lea rax, [0x140001c50]
mov qword [rbp + 0x358], rax
lea rax, str.Failed_to_read_function_name_at
mov qword [rbp + 0x370], rax
mov qword [rbp + 0x378], 2
mov qword [rbp + 0x390], 0
lea rax, [rbp + 0x340]
mov qword [rbp + 0x380], rax
mov qword [rbp + 0x388], 2
lea rcx, [rbp + 0x2b0]
lea rdx, [rbp + 0x370]
call fcn.14004e4c0
mov rdx, qword [rbp + 0x310]
test rdx, rdx
je 0x140006ca0
mov rcx, qword [rbp + 0x318]
mov r8d, 1
call fcn.140016900
mov rax, qword [rbp + 0x2b0]
lea rcx, [rbp + 0x2b8]
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rbp + 0x280], xmm0
cmp rax, rbx
jne 0x140007580
inc r15d
mov r8d, 0x104
lea rcx, [rbp + 0x370]
lea rdx, [rbp + 0x178]
call fcn.14004ef70
mov rcx, qword [rbp + 0x378]
mov rdx, qword [rbp + 0x380]
jmp 0x140006d03
dec rdx
movzx r8d, r8b
sub rdx, rcx
test r8d, r8d
jne 0x140006d87
test rdx, rdx
je 0x140006db1
mov rax, rdx
add rdx, rcx
movzx r8d, byte [rdx - 1]
test r8b, r8b
jns 0x140006cf0
movzx r9d, byte [rdx - 2]
cmp r9b, 0xc0
jge 0x140006d4c
movzx r10d, byte [rdx - 3]
cmp r10b, 0xc0
jge 0x140006d56
movzx r11d, byte [rdx - 4]
add rdx, 0xfffffffffffffffc
and r11d, 7
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
jmp 0x140006d5e
add rdx, 0xfffffffffffffffe
and r9d, 0x1f
jmp 0x140006d69
add rdx, 0xfffffffffffffffd
and r10d, 0xf
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
shl r9d, 6
and r8b, 0x3f
movzx r8d, r8b
or r8d, r9d
cmp r8d, 0x110000
jne 0x140006cf7
jmp 0x140006db1
cmp rax, 0x16
jne 0x140006db1
movdqu xmm0, xmmword [rcx]
pcmpeqb xmm0, xmm7
movdqu xmm1, xmmword [rcx + 6]
pcmpeqb xmm1, xmm6
pand xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
sete dil
jmp 0x140006db3
xor edi, edi
mov rdx, qword [rbp + 0x370]
lea rax, [rdx*2]
test rax, rax
je 0x140006dd2
mov r8d, 1
call fcn.140016900
test dil, dil
jne 0x140007515
cmp r15d, dword [rbp + 0x2a4]
mov rdi, qword [rbp + 0x460]
jne 0x140006888
lea rax, [rbp + 0x10]
mov qword [rbp + 0x370], rax
lea rax, [0x140012960]
mov qword [rbp + 0x378], rax
lea rax, [rbp + 0x3c4]
mov qword [rbp + 0x380], rax
lea rax, [0x140053580]
mov qword [rbp + 0x388], rax
lea rax, [0x1400c2100]
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x180], 2
mov qword [rbp + 0x198], 0
lea rax, [rbp + 0x370]
mov qword [rbp + 0x188], rax
mov qword [rbp + 0x190], 2
lea rcx, [rbp + 0x3a8]
lea rdx, [rbp + 0x178]
call fcn.140005810
cmp qword [rbp + 0x3a8], rbx
je 0x140006333
jmp 0x14000717b
movzx eax, byte [0x140108f61]
mov ecx, 0x1b
mov edx, 1
call fcn.1400168f0
test rax, rax
je 0x1400075ee
movups xmm0, xmmword [0x1400c217c]
movups xmmword [rax + 0xb], xmm0
movdqu xmm0, xmmword [0x1400c2171]
movdqu xmmword [rax], xmm0
mov qword [rbp + 0x3a8], 0x1b
mov qword [rbp + 0x3b0], rax
mov qword [rbp + 0x3b8], 0x1b
cmp qword [rbp + 0x3a8], rbx
je 0x140006333
jmp 0x14000717b
movzx eax, byte [0x140108f61]
mov ecx, 0x31
mov edx, 1
call fcn.1400168f0
test rax, rax
je 0x1400075fd
movups xmm0, xmmword [0x1400c2356]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x1400c2346]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [0x1400c2336]
movdqu xmmword [rax], xmm0
mov byte [rax + 0x30], 0x64
mov qword [rsi], 0x31
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0x31
jmp 0x14000749a
mov qword [rbp + 0x2e0], rax
movaps xmm0, xmmword [rbp + 0x310]
movups xmmword [rbp + 0x2e8], xmm0
lea rax, [rbp + 0x2a0]
mov qword [rbp + 0x370], rax
mov qword [rbp + 0x378], rdi
mov qword [rbp + 0x380], r15
lea rax, [0x140001c50]
mov qword [rbp + 0x388], rax
lea rax, str.Failed_to_read_NT_headers_at
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x180], 2
mov qword [rbp + 0x198], 0
mov qword [rbp + 0x188], rbx
mov qword [rbp + 0x190], 2
lea rcx, [rbp + 0x340]
lea rdx, [rbp + 0x178]
call fcn.14004e4c0
mov rdx, qword [rbp + 0x2e0]
test rdx, rdx
movabs rbx, 0x8000000000000000
mov rdi, qword [rbp + 0x460]
je 0x140006fff
mov rcx, qword [rbp + 0x2e8]
mov r8d, 1
call fcn.140016900
mov rax, qword [rbp + 0x340]
movdqu xmm0, xmmword [rbp + 0x348]
movdqa xmmword [rbp + 0x2b0], xmm0
cmp rax, rbx
je 0x1400067b8
movdqa xmm0, xmmword [rbp + 0x2b0]
jmp 0x14000708d
mov ecx, 0x25
xor edx, edx
call fcn.140015a10
movabs rcx, 0x7372656461656820
mov qword [rdx + 0x1d], rcx
movups xmm0, xmmword [0x1400c207f]
movups xmmword [rdx], xmm0
movdqu xmm0, xmmword [0x1400c208f]
movdqu xmmword [rdx + 0x10], xmm0
mov qword [rbp + 0x3a8], rax
mov qword [rbp + 0x3b0], rdx
mov qword [rbp + 0x3b8], 0x25
cmp qword [rbp + 0x3a8], rbx
je 0x140006333
jmp 0x14000717b
movdqu xmm0, xmmword [rbp + 0x378]
movdqu xmmword [rbp + 0x3b0], xmm0
mov qword [rbp + 0x3a8], rax
cmp qword [rbp + 0x3a8], rbx
je 0x140006333
jmp 0x14000717b
mov eax, dword [r12]
test eax, eax
je 0x1400070ed
mov dword [rsi + 8], eax
mov qword [rsi], rbx
jmp 0x14000749a
mov ecx, 0x24
xor edx, edx
call fcn.140015a10
movups xmm0, xmmword [0x1400c20a4]
movups xmmword [rdx], xmm0
movdqu xmm0, xmmword [0x1400c20b4]
movdqu xmmword [rdx + 0x10], xmm0
mov dword [rdx + 0x20], 0x64696c61
jmp 0x140007155
mov ecx, 0x24
xor edx, edx
call fcn.140015a10
movups xmm0, xmmword [str.Resolved_function_address_is_invalidFunction_call_failed_with_status:___Error:]
movups xmmword [rdx], xmm0
movdqu xmm0, xmmword [0x1400c2390]
movdqu xmmword [rdx + 0x10], xmm0
mov dword [rdx + 0x20], 0x64696c61
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], 0x24
jmp 0x14000749a
mov ecx, 0x24
xor edx, edx
call fcn.140015a10
movups xmm0, xmmword [str.Overflow_in_name_address_calculationOverflow_in_function_name_address_calculationInvalid_NT_header_signatureInvalid_DOS_header_signatureFailed_to_read_DOS_header_at_base_:]
movups xmmword [rdx], xmm0
movdqu xmm0, xmmword [0x1400c2130]
movdqu xmmword [rdx + 0x10], xmm0
mov dword [rdx + 0x20], 0x6e6f6974
mov qword [rbp + 0x3a8], rax
mov qword [rbp + 0x3b0], rdx
mov qword [rbp + 0x3b8], 0x24
cmp qword [rbp + 0x3a8], rbx
je 0x140006333
mov rax, qword [rbp + 0x3b8]
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x3a8]
mov qword [rbp + 0x370], rax
mov rax, qword [rbp + 0x3b0]
mov qword [rbp + 0x378], rax
lea rax, [rbp + 0x370]
mov qword [rbp + 0x30], rax
lea r12, [0x140001c50]
mov qword [rbp + 0x38], r12
lea rax, str.Error_during_x64_GetProcAddressEx:__n
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x180], 2
mov qword [rbp + 0x198], 0
lea r15, [rbp + 0x30]
mov qword [rbp + 0x188], r15
mov qword [rbp + 0x190], 1
lea rcx, [rbp + 0x178]
call fcn.140033780
mov ecx, r14d
call fcn.14000d400
cmp rax, 1
jne 0x14000729e
mov r14, qword [rdx + 0x30]
lea rcx, [rbp + 0x178]
mov rdx, qword [rbp + 0x330]
mov r8, rdi
call fcn.14004e0f0
mov rdx, qword [rbp + 0x178]
cmp rdx, rbx
je 0x140007388
test rdx, rdx
je 0x140007254
mov rcx, qword [rbp + 0x180]
mov r8d, 1
call fcn.140016900
movzx eax, byte [0x140108f61]
mov ecx, 0x13
mov edx, 1
call fcn.1400168f0
test rax, rax
je 0x1400075ab
movdqu xmm0, xmmword [str.CString::new_failedNtAllocateVirtualMemoryFailed_to_allocate_memory_in_target_process__status:]
movdqu xmmword [rax], xmm0
mov dword [rax + 0xf], 0x64656c69
mov qword [rsi], 0x13
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0x13
jmp 0x14000747c
lea rbx, [rbp + 0x30c]
mov qword [rbp + 0x30], rbx
lea r14, [0x140053580]
mov qword [rbp + 0x38], r14
lea rax, str.8__f_
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x180], 2
mov qword [rbp + 0x198], 0
mov qword [rbp + 0x188], r15
mov qword [rbp + 0x190], 1
lea rcx, [rbp + 0x178]
call fcn.140033780
lea rdi, [rbp + 0x130]
mov rcx, rdi
call fcn.140005940
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], r12
lea rax, str.Failed_to_get_module_handle_from_base_address:_._Error:
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x180], 2
mov qword [rbp + 0x198], 0
mov qword [rbp + 0x188], r15
mov qword [rbp + 0x190], 2
lea rcx, [rbp - 0x38]
lea rdx, [rbp + 0x178]
call fcn.14004e4c0
mov rax, qword [rbp - 0x28]
mov qword [rsi + 0x10], rax
movdqu xmm0, xmmword [rbp - 0x38]
movdqu xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x130]
test rdx, rdx
je 0x14000747c
mov rcx, qword [rbp + 0x138]
jmp 0x140007471
mov rdx, qword [rbp + 0x180]
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0x338], rax
mov rcx, r14
mov qword [rbp + 0x330], rdx
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x1400073bc
mov dword [rsi + 8], eax
mov qword [rsi], rbx
jmp 0x14000745b
lea rdi, [rbp + 0x130]
mov rcx, rdi
call fcn.140005940
lea rax, [rbp + 0x20]
mov qword [rbp + 0x30], rax
lea rax, [0x140012960]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], r12
lea rax, str.GetProcAddress_failed_for___Error:
mov qword [rbp + 0x178], rax
mov qword [rbp + 0x180], 2
mov qword [rbp + 0x198], 0
mov qword [rbp + 0x188], r15
mov qword [rbp + 0x190], 2
lea rcx, [rbp - 0x20]
lea rdx, [rbp + 0x178]
call fcn.14004e4c0
mov rax, qword [rbp - 0x10]
mov qword [rsi + 0x10], rax
movdqu xmm0, xmmword [rbp - 0x20]
movdqu xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x130]
test rdx, rdx
je 0x14000745b
mov rcx, qword [rbp + 0x138]
mov r8d, 1
call fcn.140016900
mov rcx, qword [rbp + 0x330]
mov byte [rcx], 0
mov rdx, qword [rbp + 0x338]
test rdx, rdx
je 0x14000747c
mov r8d, 1
call fcn.140016900
mov rdx, qword [rbp + 0x370]
test rdx, rdx
je 0x14000749a
mov rcx, qword [rbp + 0x378]
mov r8d, 1
call fcn.140016900
movaps xmm6, xmmword [rbp + 0x3d0]
movaps xmm7, xmmword [rbp + 0x3e0]
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 0x2d
xor edx, edx
call fcn.140015a10
movups xmm0, xmmword [0x1400c2144]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [0x1400c2154]
movups xmmword [rdx + 0x10], xmm0
movdqu xmm0, xmmword [0x1400c2161]
movdqu xmmword [rdx + 0x1d], xmm0
mov qword [rbp + 0x3a8], rax
mov qword [rbp + 0x3b0], rdx
mov qword [rbp + 0x3b8], 0x2d
cmp qword [rbp + 0x3a8], rbx
je 0x140006333
jmp 0x14000717b
mov eax, dword [rbp + 0x308]
mov ecx, dword [rbp + 0x3c4]
mov r8d, dword [rbp + 0x2fc]
mov r9d, dword [rbp + 0x304]
mov edx, dword [rbp + 0x2ac]
mov dword [rsp + 0x38], edx
mov edx, dword [rbp + 0x2a8]
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140005c90
mov rdi, qword [rbp + 0x460]
cmp qword [rbp + 0x3a8], rbx
je 0x140006333
jmp 0x14000717b
movdqa xmm0, xmmword [rbp + 0x2d0]
jmp 0x14000708d
movdqa xmm0, xmmword [rbp + 0x280]
jmp 0x14000708d
mov ecx, 1
mov edx, 0x18
call fcn.1400bf820
mov ecx, 1
mov edx, 0x1c
call fcn.1400bf820
mov ecx, 1
mov edx, 0x13
call fcn.1400bf820
ud2
mov ecx, 1
mov edx, 0x20
call fcn.1400bf820
mov ecx, 1
mov edx, 0x2a
call fcn.1400bf820
lea r8, str.srcutils.rs
mov edx, 0x104
mov rcx, r13
call fcn.1400bfe30
mov ecx, 1
mov edx, 0x1b
call fcn.1400bf820
mov ecx, 1
mov edx, 0x31
call fcn.1400bf820
int3