Function at 0x140036aa0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x348
movaps xmmword [rsp + 0x330], xmm6
mov rax, qword [0x1402db040]
xor rax, rsp
mov qword [rsp + 0x328], rax
cmp qword [rcx + 0x18], 0
je 0x140037b93
mov rsi, rcx
lea r14, [rsp + 0x230]
xorps xmm6, xmm6
movups xmmword [r14], xmm6
mov qword [r14 - 8], r14
lea rbp, [rcx + 8]
mov r12, qword [rcx + 0x10]
cmp r12, rbp
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rbp
je 0x140036ceb
xor r13d, r13d
lea r15, [rsp + 0x132]
lea rdi, [0x1402c75d0]
movabs rbx, 0x9aaaaaa0000aaaa
mov eax, dword [r12 + 0x10]
cmp eax, 2
setb cl
cmp eax, 4
setge al
or al, cl
je 0x140037524
mov r12, qword [r12 + 8]
cmp r12, rbp
jne 0x140036b25
mov rcx, qword [rsp + 0x230]
test r13, r13
je 0x140036ced
mov r14, r13
add r14, 0x10
call fcn.140037e50
test r14, r14
je 0x140036cf2
mov rcx, r14
call fcn.1401aa168
mov rbx, rax
cmp byte [rsi + 0x20], 1
je 0x140037c53
xor eax, eax
mov rsi, rbx
add rsi, 0x10
mov qword [rbx + 8], rax
lea r15, [rsp + 0x228]
mov qword [r15], r13
lea rax, [rsp + 0x90]
mov qword [rax], rsi
mov rax, qword [rsp + 0x58]
mov r12, qword [rax + 0x10]
xor edi, edi
movabs r13, 0xaaaaaaaaaaaaaaaa
movaps xmm6, xmmword [0x140299a90]
jmp 0x140036be2
mov eax, dword [r12 + 0x10]
cmp eax, 2
setb cl
cmp eax, 4
setge al
or al, cl
je 0x140037767
mov r12, qword [r12 + 8]
cmp r12, rbp
jne 0x140036bc4
mov qword [rbx], rdi
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
test rax, rax
je 0x140037b9a
mov rsi, qword [rax]
mov dword [rsp + 0x20], 4
mov rcx, rsi
xor edx, edx
mov r8, r14
mov r9d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x140037c49
mov rdi, rax
lea rax, [rsp + 0x120]
movabs rcx, 0xaaaaaaaaaaaaaaaa
mov qword [rax], rcx
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
mov r9, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140037c34
cmp qword [rsp + 0x120], r14
jne 0x140037c34
mov qword [rsp + 0x88], rdi
lea rax, [0x140279b00]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
lea rsi, [0x1402c75d0]
lea r8, str.NtMapViewOfSection
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
mov rdx, rsi
mov r9d, 1
call fcn.140034b50
lea rax, [0x140279b70]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
lea r8, str.NtUnmapViewOfSection
mov rcx, rdi
mov rdx, rsi
mov rsi, rdi
mov r9d, 1
call fcn.140034b50
jmp 0x140036d15
xor ecx, ecx
call fcn.140037e50
cmp qword [rsi], 0
je 0x140037b9a
mov qword [rsp + 0x88], 0
xor ebx, ebx
cmp qword [rsi + 0x18], 0
je 0x140037477
mov rax, qword [rsi]
test rax, rax
je 0x140037b9d
mov qword [rsp + 0x68], rbx
mov rcx, qword [rax]
mov dword [rsp + 0x20], 1
mov r8d, 0x10000
mov qword [rsp + 0x70], rcx
xor edx, edx
mov r9d, 0x2000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, qword [rsi + 0x18]
shl rsi, 6
lea r13, [rsi + 0x60]
cmp r13, 0x10001
jae 0x140037ba0
mov rdi, rax
mov r14d, 0xffa0
sub r14d, esi
and r14d, 0xffffffe0
inc r14
mov rax, 0xffffffffffffffff
xor edx, edx
div r14
mov r15, 0xfffffffffffffffe
sub r15, rdx
lea r12, [rsp + 0x228]
lea rbx, [rsp + 0x120]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x228], rax
mov qword [rsp + 0x120], r12
mov qword [rsp + 0x128], 8
mov rcx, rbx
call fcn.140148540
mov rax, qword [rsp + 0x228]
cmp rax, r15
ja 0x140036d9c
mov edx, 0x800
mov r9d, 0x1000
mov r8d, 0x800
mov rcx, r9
shr r8, 1
mov r9, rdx
cmp rdx, r13
mov rdx, r8
jae 0x140036de8
xor edx, edx
div r14
mov rbx, rdx
neg ecx
and ebx, ecx
mov eax, ebx
and eax, 0xfffff000
add rdi, rax
add rsi, 0x105f
and rsi, 0xfffffffffffff000
mov dword [rsp + 0x20], 0x40
mov rcx, qword [rsp + 0x70]
mov rdx, rdi
mov r8, rsi
mov r9d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x140037ba3
mov rdi, rax
lea rcx, [rsp + 0x120]
mov r8d, 0x108
mov dl, 0xaa
call fcn.1401e5d50
lea rcx, [0x1402c75d0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x80], rax
test rax, rax
mov rsi, qword [rsp + 0x58]
je 0x140037bb9
movaps xmm6, xmmword [0x140299a90]
movups xmmword [rsp + 0x2d8], xmm6
movups xmmword [rsp + 0x318], xmm6
movups xmmword [rsp + 0x308], xmm6
movups xmmword [rsp + 0x2f8], xmm6
movups xmmword [rsp + 0x2e8], xmm6
mov qword [rsp + 0x2c8], r13
mov dword [rsp + 0x2e0], 0
mov qword [rsp + 0x2d0], Ordinal_41
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x118], rax
movups xmmword [rsp + 0x108], xmm6
movups xmmword [rsp + 0xf8], xmm6
mov rax, qword [rsi]
test rax, rax
je 0x140037ba6
and ebx, 0xfff
add rdi, rbx
mov qword [rsp + 0x78], rdi
mov rax, qword [rax]
lea rcx, [0x14029b7c0]
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], rax
mov byte [rsp + 0x118], 1
mov dword [rsp + 0x11c], 0
lea rcx, [rsp + 0x228]
mov r8d, 0xa0
xor edx, edx
call fcn.1401e5d50
mov r14, qword [rsi + 0x10]
cmp r14, rbp
je 0x14003733d
lea r15, [rsp + 0x98]
lea rdi, [rsp + 0xb0]
lea rsi, [rsp + 0xc8]
mov rax, qword [rsp + 0x78]
lea r10, [rax + 0x20]
mov dword [rsp + 0x4c], 0xaaaaaaaa
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
jmp 0x14003712c
mov rdx, qword [r14 + 0x18]
mov r8, qword [r14 + 0x20]
mov rcx, r15
mov rbx, r10
call fcn.14015b370
mov r10, rbx
jmp 0x140037190
mov rcx, qword [rsp + 0x98]
mov rbx, r10
call fcn.1401a9dc4
mov r10, rbx
jmp 0x140037114
mov r9, qword [rsp + 0xb0]
mov r12, r13
sub r13, qword [rsp + 0x2d0]
movsxd r15, dword [rsp + 0x2e0]
shl r15, 6
mov rdi, r10
add r15, r10
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
lea rbp, [rsp + 0xf0]
mov rcx, rbp
mov rdx, qword [rsp + 0x80]
xor r8d, r8d
call qword [0x1402cbd20]
test eax, eax
js 0x140037aa6
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax + 0x20]
mov rcx, rbp
call qword [0x1402cbd20]
test rax, rax
mov r13, rbp
je 0x140037a92
mov rcx, rax
call fcn.1401aa168
mov rbp, rax
mov rcx, r13
mov rdx, rbp
call fcn.140021f20
test al, al
je 0x140037a99
mov rcx, r13
mov rdx, rbp
mov r8, r15
call fcn.140022080
mov r13d, eax
test rbp, rbp
mov r15, rsi
je 0x14003709e
mov rcx, rbp
call fcn.1401aa100
test r13d, r13d
mov rsi, rbx
js 0x140037aaf
mov r10, rdi
movsxd rax, dword [rsp + 0x2e0]
shl rax, 6
add rax, rdi
movsxd rcx, dword [rsp + 0x94]
mov qword [rsp + rcx*8 + 0x228], rax
inc dword [rsp + 0x2e0]
add qword [rsp + 0x2d0], 0x40
mov bpl, 1
cmp byte [rsp + 0xdf], 0
mov r13, r12
js 0x140037adb
cmp byte [rsp + 0xc7], 0
lea rdi, [rsp + 0xb0]
js 0x140037af3
cmp byte [rsp + 0xaf], 0
js 0x140036fbd
test bpl, bpl
je 0x140037b46
mov r14, qword [r14 + 8]
cmp r14, qword [rsp + 0x60]
je 0x14003733d
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xe0], rax
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0x90], rax
cmp byte [r14 + 0x2f], 0
js 0x140036fa2
lea rax, [r14 + 0x18]
mov rcx, qword [rax + 0x10]
mov qword [r15 + 0x10], rcx
movups xmm0, xmmword [rax]
movups xmmword [r15], xmm0
cmp byte [r14 + 0x47], 0
js 0x140037b0b
lea rax, [r14 + 0x30]
mov rcx, qword [rax + 0x10]
mov qword [rdi + 0x10], rcx
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
cmp byte [r14 + 0x5f], 0
js 0x140037b26
lea rax, [r14 + 0x48]
mov rcx, qword [rax + 0x10]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rax]
movups xmmword [rsi], xmm0
mov rcx, qword [r14 + 0x60]
mov qword [rsp + 0xe0], rcx
movsx rax, byte [rsp + 0xaf]
mov rdx, rax
test rax, rax
jns 0x1400371ef
mov rdx, qword [rsp + 0xa0]
cmp rdx, 9
jne 0x140037a76
test al, al
mov rdx, qword [rsp + 0x98]
mov r8, r15
cmovs r8, rdx
cmp word [r8], 0x6e
jne 0x140037a76
lea r8, [rdx + 2]
test al, al
lea r9, [rsp + 0x9a]
cmovns r8, r9
cmp word [r8], 0x74
jne 0x140037a76
lea r8, [rdx + 4]
test al, al
lea r9, [rsp + 0x9c]
cmovns r8, r9
cmp word [r8], 0x64
jne 0x140037a76
lea r8, [rdx + 6]
test al, al
lea r9, [rsp + 0x9e]
cmovns r8, r9
cmp word [r8], 0x6c
jne 0x140037a76
lea r8, [rdx + 8]
test al, al
lea r9, [rsp + 0xa0]
cmovns r8, r9
cmp word [r8], 0x6c
jne 0x140037a76
lea r8, [rdx + 0xa]
test al, al
lea r9, [rsp + 0xa2]
cmovns r8, r9
cmp word [r8], 0x2e
jne 0x140037a76
lea r8, [rdx + 0xc]
test al, al
lea r9, [rsp + 0xa4]
cmovns r8, r9
cmp word [r8], 0x64
jne 0x140037a76
lea r8, [rdx + 0xe]
test al, al
lea r9, [rsp + 0xa6]
cmovns r8, r9
cmp word [r8], 0x6c
jne 0x140037a76
add rdx, 0x10
test al, al
lea rax, [rsp + 0xa8]
cmovns rdx, rax
xor ebp, ebp
cmp word [rdx], 0x6c
jne 0x140037a71
cmp dword [rsp + 0x90], 1
jne 0x140037a71
cmp byte [rsp + 0xdf], 0
mov rbx, rsi
mov rdx, rsi
jns 0x140037324
mov rdx, qword [rsp + 0xc8]
mov rsi, r15
cmp byte [rsp + 0xc7], 0
mov r9, rdi
jns 0x140036fdd
jmp 0x140036fd5
lea rsi, [rsp + 0x120]
lea rdx, [rsp + 0x228]
mov r8d, 0x100
mov rcx, rsi
call fcn.1401e56b0
mov qword [rsi + 0x100], 1
lea rax, [rsp + 0x90]
movabs rcx, 0xaaaaaaaaaaaaaaaa
mov qword [rax], rcx
lea r8, [rsp + 0x1c0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
mov rcx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebp, Ordinal_46
test eax, eax
mov rbx, qword [rsp + 0x68]
je 0x140037ba9
cmp qword [rsp + 0x90], 0x20
mov rsi, qword [rsp + 0x58]
jne 0x140037473
lea rax, [rsp + 0xf0]
mov dword [rax], 0xaaaaaaaa
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x70]
mov rdx, rdi
mov r8, r13
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rax, qword [rsi]
test rax, rax
je 0x140037bb3
cmp qword [rsp + 0x220], 1
jne 0x140037b41
cmp dword [rax + 0x10], 0
mov rcx, qword [rax]
je 0x140037bf0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x228], rax
lea rax, [rsp + 0x228]
mov qword [rsp + 0x20], rax
lea rdx, [0x140335ad8]
lea r8, [rsp + 0x120]
mov r9d, 0xa0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor ecx, ecx
cmp qword [rsp + 0x228], 0xa0
mov edx, 0x3a
cmove edx, ecx
test eax, eax
mov ebp, 0x39
cmovne ebp, edx
test ebp, ebp
jne 0x1400374dd
mov rax, qword [rsi]
test rax, rax
je 0x140037bb6
cmp dword [rax + 0x10], 0
mov rcx, qword [rax]
je 0x140037bc8
lea rsi, [rsp + 0x120]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsi], rax
mov qword [rsp + 0x20], rsi
lea rdx, [0x140335bc8]
lea r8, [rsp + 0x88]
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor ecx, ecx
cmp qword [rsi], 8
mov edx, 0x3a
cmove edx, ecx
test eax, eax
mov ebp, 0x39
cmovne ebp, edx
test rbx, rbx
jne 0x1400374fc
mov rcx, qword [rsp + 0x328]
xor rcx, rsp
cmp rcx, qword [0x1402db040]
je 0x140037506
call fcn.1401ac870
int3
mov rcx, rbx
call fcn.1401aa100
jmp 0x1400374e2
mov eax, ebp
movaps xmm6, xmmword [rsp + 0x330]
add rsp, 0x348
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [rsp + 0x120]
cmp rax, rdi
seta al
cmp r15, rdi
setbe cl
mov qword [rsp + 0x130], rbx
or cl, al
je 0x140037aa4
movaps xmm0, xmmword [0x1402c75d0]
movaps xmmword [rsp + 0x120], xmm0
mov word [rsp + 0x130], Ordinal_117
movsx rax, byte [r12 + 0x2f]
mov rcx, rax
test rax, rax
jns 0x140037574
mov rcx, qword [r12 + 0x20]
cmp rcx, 9
je 0x140037ce8
lea rsi, [r12 + 0x18]
mov rbx, qword [rsp + 0x230]
test rbx, rbx
jne 0x140037c6d
test al, al
jns 0x140037c18
mov rcx, qword [r12 + 0x20]
lea rbp, [rcx*2 + 0x23]
and rbp, 0xfffffffffffffff8
add rbp, r13
mov rdx, qword [rsp + 0x230]
mov rbx, r14
mov r13, r14
test rdx, rdx
je 0x1400376a7
test al, al
js 0x1400375d3
movzx eax, al
mov rcx, rsi
jmp 0x1400375ef
mov rax, qword [r12 + 0x20]
mov rcx, qword [r12 + 0x18]
jmp 0x1400375ef
mov rdx, qword [r13]
mov rbx, r13
test rdx, rdx
je 0x1400376a7
mov r13, rdx
movsx r10, byte [rdx + 0x37]
mov rdx, r10
test r10, r10
jns 0x140037603
mov rdx, qword [r13 + 0x28]
lea r8, [r13 + 0x20]
mov r11, qword [r13 + 0x20]
cmp rdx, rax
mov r9, rax
cmovb r9, rdx
test r9, r9
je 0x14003763c
test r10b, r10b
mov rdi, r8
cmovs rdi, r11
xor ebx, ebx
movzx r15d, word [rdi + rbx*2]
cmp word [rcx + rbx*2], r15w
ja 0x140037645
jb 0x1400375df
inc rbx
cmp r9, rbx
jne 0x140037626
cmp rax, rdx
jne 0x140037a4d
test r9, r9
lea r15, [rsp + 0x132]
lea rdi, [0x1402c75d0]
movabs rbx, 0x9aaaaaa0000aaaa
je 0x140037683
test r10b, r10b
cmovs r8, r11
xor r10d, r10d
movzx r11d, word [rcx + r10*2]
cmp word [r8 + r10*2], r11w
ja 0x14003768c
jb 0x140037696
inc r10
cmp r9, r10
jne 0x14003766d
cmp rdx, rax
jne 0x140037a66
mov rsi, qword [rsp + 0x58]
jmp 0x140037723
mov rdx, qword [r13 + 8]
test rdx, rdx
jne 0x1400375ef
lea rbx, [r13 + 8]
mov ecx, 0x38
call fcn.1401a9d88
mov rdi, rax
lea rcx, [rax + 0x20]
cmp byte [r12 + 0x2f], 0
jns 0x140037cd5
mov rdx, qword [r12 + 0x18]
mov r8, qword [r12 + 0x20]
call fcn.14015b370
mov rsi, qword [rsp + 0x58]
movups xmmword [rdi], xmm6
mov qword [rdi + 0x10], r13
mov qword [rbx], rdi
mov rax, qword [rsp + 0x228]
mov rax, qword [rax]
test rax, rax
jne 0x14003775a
mov rcx, qword [rsp + 0x230]
mov rdx, rdi
call fcn.14014bcc0
inc qword [rsp + 0x238]
lea r15, [rsp + 0x132]
lea rdi, [0x1402c75d0]
movabs rbx, 0x9aaaaaa0000aaaa
movsx rax, byte [r12 + 0x47]
test rax, rax
js 0x140037c20
movsx rcx, byte [r12 + 0x5f]
test rcx, rcx
js 0x140037c2a
lea r13, [rax + rcx]
add r13, 0x21
and r13, 0xfffffffffffffff8
add r13, rbp
mov rbp, qword [rsp + 0x60]
jmp 0x140036b3e
mov qword [rsp + 0x228], rax
mov rdi, qword [rbx]
jmp 0x1400376f2
lea rcx, [0x1402c75d0]
lea rax, [rsp + 0x120]
cmp rax, rcx
seta al
lea rdx, [rsp + 0x132]
cmp rdx, rcx
setbe cl
movabs rdx, 0x9aaaaaa0000aaaa
mov qword [rsp + 0x130], rdx
or cl, al
je 0x140037aa4
movaps xmm0, xmmword [0x1402c75d0]
movaps xmmword [rsp + 0x120], xmm0
mov word [rsp + 0x130], Ordinal_117
movsx rax, byte [r12 + 0x2f]
test rax, rax
mov r8, qword [r12 + 0x20]
mov rcx, rax
cmovs rcx, r8
cmp rcx, 9
mov qword [rsp + 0x68], rbx
je 0x140037d91
lea rbp, [r12 + 0x18]
mov qword [rsp + 0x130], r13
movaps xmmword [rsp + 0x120], xmm6
test al, al
jns 0x140037e29
mov rdx, qword [r12 + 0x18]
lea rcx, [rsp + 0x120]
call fcn.14015b370
mov cl, byte [r12 + 0x2f]
mov r8, qword [r12 + 0x20]
movzx eax, cl
test cl, cl
cmovs rax, r8
lea rax, [rax*2 + 0x23]
and rax, 0xfffffffffffffff8
mov rcx, qword [rsp + 0x228]
sub rcx, rax
jb 0x140037cce
mov r13, qword [rsp + 0x90]
mov qword [rsp + 0x228], rcx
lea rbx, [rax + r13]
mov qword [rsp + 0x90], rbx
cmp dword [r12 + 0x10], 3
sete byte [r13 + 0x18]
mov qword [r13], rax
mov qword [r13 + 8], rax
mov qword [r13 + 0x10], 0
movsx rax, byte [r12 + 0x2f]
mov rcx, qword [r12 + 0x20]
test rax, rax
jns 0x140037d82
test rcx, rcx
js 0x140037aa4
mov rbp, qword [rbp]
mov r8, rcx
add r13, 0x1a
cmp rbp, r13
jb 0x1400378b8
lea rdx, [r8*2]
add rdx, r13
cmp rbp, rdx
jb 0x140037aa4
test r8, r8
je 0x140037d8a
add r8, r8
mov rcx, r13
mov rdx, rbp
call fcn.1401e56b0
mov dl, byte [r12 + 0x2f]
mov rcx, qword [r12 + 0x20]
movzx eax, dl
test dl, dl
cmovs rax, rcx
mov word [r13 + rax*2], 0
cmp r12, qword [rsp + 0x60]
je 0x140037a06
mov r13, r12
jmp 0x1400379d6
lea rbp, [r13 + 0x18]
test rax, rax
je 0x14003793f
lea r8, [rsp + 0x120]
test cl, cl
jns 0x14003791a
mov r8, qword [rsp + 0x120]
mov rcx, rbp
test dl, dl
jns 0x140037925
mov rcx, qword [rbp]
xor edx, edx
movzx r9d, word [rcx + rdx*2]
cmp r9w, word [r8 + rdx*2]
jne 0x1400379c5
inc rdx
cmp rax, rdx
jne 0x140037927
lea rcx, [r13 + 0x10]
lea rdx, [rsp + 0x90]
mov r8, r15
mov r9, rsi
call fcn.140038220
test al, al
je 0x140037cce
cmp r12, r13
jne 0x140037968
mov r12, qword [r12 + 8]
mov rax, qword [r13]
mov rbx, qword [r13 + 8]
mov qword [rax + 8], rbx
mov rax, qword [r13]
mov qword [rbx], rax
mov rax, qword [rsp + 0x58]
dec qword [rax + 0x18]
cmp byte [r13 + 0x5f], 0
js 0x140037e0d
cmp byte [r13 + 0x47], 0
js 0x140037e1b
cmp byte [r13 + 0x2f], 0
js 0x140037a58
test r13, r13
je 0x140037aa4
mov rcx, r13
call fcn.1401a9dc4
jmp 0x1400379c9
mov r8, qword [r13 + 0x20]
cmp r8, rax
je 0x1400378fd
mov rbx, qword [r13 + 8]
mov rax, qword [rsp + 0x60]
mov r13, rbx
cmp rbx, rax
je 0x1400379fe
movsx rcx, byte [rsp + 0x137]
mov rax, rcx
test rcx, rcx
jns 0x1400379ef
mov rax, qword [rsp + 0x128]
movsx rdx, byte [r13 + 0x2f]
mov r8, rdx
test rdx, rdx
jns 0x1400379bc
jmp 0x1400379b8
mov rbx, qword [rsp + 0x90]
inc rdi
mov bpl, 1
mov rsi, rbx
movabs r13, 0xaaaaaaaaaaaaaaaa
cmp byte [rsp + 0x137], 0
mov rbx, qword [rsp + 0x68]
jns 0x140037a35
mov rcx, qword [rsp + 0x120]
call fcn.1401a9dc4
test bpl, bpl
mov rbp, qword [rsp + 0x60]
jne 0x140036be2
mov ebp, Ordinal_41
jmp 0x1400374dd
jb 0x1400375df
jmp 0x140037645
mov rcx, qword [rbp]
call fcn.1401a9dc4
jmp 0x1400379a5
jb 0x140037696
jmp 0x14003768c
mov r12, r13
jmp 0x140037a7b
mov r12, r13
xor ebp, ebp
mov eax, 2
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x4c], 2
jmp 0x1400370df
xor ebp, ebp
jmp 0x14003706a
mov r13d, 0xc0000035
jmp 0x14003708e
ud2
mov r13d, eax
mov r15, rsi
mov rsi, rbx
mov ecx, r13d
call fcn.140266500
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r10, rdi
mov dword [rsp + 0x4c], Ordinal_41
xor ebp, ebp
mov eax, 2
mov qword [rsp + 0x50], rax
jmp 0x1400370df
mov rcx, qword [rsp + 0xc8]
mov rdi, r10
call fcn.1401a9dc4
mov r10, rdi
jmp 0x1400370f0
mov rcx, qword [rsp + 0xb0]
mov rbx, r10
call fcn.1401a9dc4
mov r10, rbx
jmp 0x140037106
mov rdx, qword [r14 + 0x30]
mov r8, qword [r14 + 0x38]
mov rcx, rdi
mov rbx, r10
call fcn.140118510
mov r10, rbx
jmp 0x1400371ad
mov rdx, qword [r14 + 0x48]
mov r8, qword [r14 + 0x50]
mov rcx, rsi
mov rbx, r10
call fcn.140118510
mov r10, rbx
jmp 0x1400371ca
call fcn.14023bfc0
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x120], eax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x220], rax
cmp rax, 1
je 0x140037366
cmp qword [rsp + 0x50], 2
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
mov ebp, dword [rsp + 0x4c]
je 0x140037473
cmp qword [rsp + 0x50], 0
je 0x140037e48
call fcn.14023bfc0
xor ebp, ebp
jmp 0x1400374e2
int3
int3
int3
int3
int3
mov rsi, qword [rsp + 0x58]
jmp 0x140037473
int3
int3
mov ebp, 7
mov rbx, qword [rsp + 0x68]
jmp 0x1400374dd
test rcx, rcx
jne 0x140037490
cmp dword [rax + 0x14], 0
jne 0x140037490
cmp qword [rax + 8], 0
jne 0x140037490
mov ebp, 8
jmp 0x1400374dd
test rcx, rcx
jne 0x140037419
cmp dword [rax + 0x14], 0
jne 0x140037419
mov ebp, 8
cmp qword [rax + 8], 0
jne 0x140037419
jmp 0x140037473
movzx ecx, al
jmp 0x1400375a1
mov rax, qword [r12 + 0x38]
jmp 0x140037732
mov rcx, qword [r12 + 0x50]
jmp 0x140037741
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ebp, Ordinal_41
jmp 0x1400374dd
mov rax, qword [rsi]
test rax, rax
je 0x140037e4b
mov rax, qword [rax + 0x40]
mov rbp, qword [rsp + 0x60]
jmp 0x140036b85
lea rdi, [rbx + 0x20]
lea rcx, [rsp + 0x120]
mov rdx, rsi
mov r8, rdi
call fcn.1401a85c0
cmp byte [rsp + 0x120], 0
js 0x140037caf
lea rcx, [rsp + 0x120]
mov rdx, rdi
mov r8, rsi
call fcn.1401a85c0
cmp byte [rsp + 0x120], 0
jns 0x140037cc1
add rbx, 8
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140037c6d
mov al, byte [r12 + 0x2f]
jmp 0x140037594
mov rbp, r13
mov rsi, qword [rsp + 0x58]
jmp 0x14003770a
xor ebp, ebp
jmp 0x140037a0f
mov rax, qword [rsi + 0x10]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsi]
movups xmmword [rcx], xmm0
jmp 0x1400376d3
test al, al
js 0x140037cf3
lea rcx, [r12 + 0x18]
jmp 0x140037cf8
mov rcx, qword [r12 + 0x18]
cmp word [rcx], 0x6e
mov rbp, qword [rsp + 0x60]
jne 0x14003757e
cmp word [rcx + 2], 0x74
jne 0x14003757e
cmp word [rcx + 4], 0x64
jne 0x14003757e
cmp word [rcx + 6], 0x6c
jne 0x14003757e
cmp word [rcx + 8], 0x6c
jne 0x14003757e
cmp word [rcx + 0xa], 0x2e
jne 0x14003757e
cmp word [rcx + 0xc], 0x64
jne 0x14003757e
cmp word [rcx + 0xe], 0x6c
jne 0x14003757e
cmp word [rcx + 0x10], 0x6c
jne 0x14003757e
mov rsi, qword [rsp + 0x58]
lea r15, [rsp + 0x132]
lea rdi, [0x1402c75d0]
movabs rbx, 0x9aaaaaa0000aaaa
jmp 0x140036b3e
mov r8, rax
jmp 0x14003789b
mov edx, eax
jmp 0x1400378dc
test al, al
js 0x140037d9c
lea rcx, [r12 + 0x18]
jmp 0x140037da1
mov rcx, qword [r12 + 0x18]
cmp word [rcx], 0x6e
jne 0x1400377e1
cmp word [rcx + 2], 0x74
jne 0x1400377e1
cmp word [rcx + 4], 0x64
jne 0x1400377e1
cmp word [rcx + 6], 0x6c
jne 0x1400377e1
cmp word [rcx + 8], 0x6c
jne 0x1400377e1
cmp word [rcx + 0xa], 0x2e
jne 0x1400377e1
cmp word [rcx + 0xc], 0x64
jne 0x1400377e1
cmp word [rcx + 0xe], 0x6c
jne 0x1400377e1
cmp word [rcx + 0x10], 0x6c
jne 0x1400377e1
mov rbp, qword [rsp + 0x60]
jmp 0x140036bdd
mov rcx, qword [r13 + 0x48]
call fcn.1401a9dc4
jmp 0x14003798f
mov rcx, qword [r13 + 0x30]
call fcn.1401a9dc4
jmp 0x14003799a
mov rcx, qword [rbp + 0x10]
mov qword [rsp + 0x130], rcx
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x120], xmm0
mov ecx, eax
jmp 0x14003781d
int3
int3