Function at 0x413950
Capabilities:
Create thread
Read file on windows
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x409db8
call fcn.0043c560
sub rsp, rax
lea rbp, [rsp + 0x80]
and rsp, 0xfffffffffffffe00
lea rdx, [0x00518510]
lea rdi, [rsp + 0x290]
mov r8d, 0x170
mov rcx, rdi
call fcn.0043c590
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov r14, qword [rax + 0x20]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x20]
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x248], rax
mov byte [rsp + 0x22e], 0
lea rsi, [rsp + 0x209a00]
mov r8d, 0x200000
mov rcx, rsi
xor edx, edx
call fcn.0043c680
lea rcx, [rsp + 0x409a00]
lea rdx, [0x00518af0]
mov r8d, 0x1e0
call fcn.0043c590
lea rcx, [rsp + 0x2005f8]
mov r8d, 0x9270
xor edx, edx
call fcn.0043c680
lea rbx, [rsp + 0x400]
mov r8d, 0x2001e0
mov rcx, rbx
mov rdx, rsi
call fcn.0043c590
mov qword [rsp + 0x2005e0], rdi
lea rax, fcn.00414ea0
mov qword [rsp + 0x2005e8], rax
mov qword [rsp + 0x2005f0], 1
mov word [rsp + 0x209868], 3
movzx eax, byte [rsp + 0x22e]
mov byte [rsp + 0x20986a], al
lea rdx, str.lnsgkgsnl_1r5b1_ppppppppp_9_9_9_PPPPPPPPP_1B5R1_LNSGKGSNL_b___1
mov r8d, 0x3f
mov rcx, rbx
call fcn.004034c0
lea rdi, [rsp + 0x217]
lea rbx, [rsp + 0x218]
xor eax, eax
mov qword [rsp + 0x240], rax
jmp 0x413ab3
call sub.KERNEL32.dll_GetLastError
movzx eax, ax
cmp eax, 0x3e3
jne 0x4149f1
mov qword [rsp + 0x20], 0
mov rcx, r14
mov rdx, rdi
mov r8d, 1
mov r9, rbx
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x413aa0
cmp dword [rsp + 0x218], 0
je 0x414a07
xor ecx, ecx
movabs r12, 0xaaaaaaaaaaaaaaaa
xor r8d, r8d
xor esi, esi
jmp 0x413b1d
mov rcx, qword [rsp + 0x238]
add rcx, 1
cmp dword [rsp + 0x218], 0
mov r8, r13
je 0x41402e
movzx r15d, byte [rsp + 0x217]
cmp r15b, 0xa
je 0x413ce9
mov qword [rsp + 0x238], rcx
mov r13, r8
inc r13
sete al
sete byte [rsp + 0x218]
sete byte [rsp + 0x217]
test al, al
mov rcx, 0xffffffffffffffff
jne 0x414a21
cmp rsi, r13
jae 0x413c9e
mov rbx, rsi
nop dword [rax]
mov rax, rbx
shr rax, 1
add rax, 8
add rbx, rax
cmovb rbx, rcx
cmp rbx, r13
jb 0x413b70
test rsi, rsi
je 0x413bf0
xor eax, eax
test al, al
jne 0x413bf0
mov rax, qword [rbp + 0x409d78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea rcx, [rsp + 0x290]
mov rdx, r12
mov qword [rsp + 0x230], r12
mov r12, r8
mov r8, rsi
xor r9d, r9d
call fcn.004154b0
mov r8, r12
mov r12, qword [rsp + 0x230]
test al, 1
je 0x413bf0
mov rsi, rbx
lea rbx, [rsp + 0x218]
jmp 0x413c9e
xor eax, eax
test al, al
jne 0x414a21
mov qword [rsp + 0x230], r8
mov qword [rsp + 0x220], rsi
mov rsi, qword [rbp + 0x409d78]
lea rcx, [rsp + 0x290]
mov rdx, rbx
xor r8d, r8d
mov r9, rsi
call fcn.00414ea0
test rax, rax
je 0x414a41
mov rdi, rax
mov rcx, rax
mov rdx, r12
mov r8, qword [rsp + 0x230]
call fcn.0043c590
mov r8, qword [rsp + 0x220]
test r8, r8
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove r12, rax
cmove r8, r8
test r8, r8
je 0x413c80
mov qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x290]
mov rdx, r12
xor r9d, r9d
call fcn.00415630
mov rsi, rbx
mov r12, rdi
lea rdi, [rsp + 0x217]
lea rbx, [rsp + 0x218]
mov r8, qword [rsp + 0x230]
mov byte [r12 + r8], r15b
nop word cs:[rax + rax]
nop dword [rax]
mov qword [rsp + 0x20], 0
mov rcx, r14
mov rdx, rdi
mov r8d, 1
mov r9, rbx
call sub.KERNEL32.dll_ReadFile
test eax, eax
jne 0x413b00
call sub.KERNEL32.dll_GetLastError
movzx eax, ax
cmp eax, 0x3e3
je 0x413cb0
jmp 0x414011
mov qword [rsp + 0x220], rsi
xor esi, esi
test r8, r8
jne 0x413d09
jmp 0x413d18
add rsi, 1
cmp rcx, rsi
je 0x413d3b
movzx eax, byte [r12 + rsi]
cmp eax, 0x20
je 0x413d00
cmp eax, 0xd
je 0x413d00
cmp rsi, r8
jb 0x413d29
jmp 0x413d43
add r8, 0xffffffffffffffff
cmp r8, rsi
jbe 0x413d40
movzx eax, byte [r12 + r8 - 1]
cmp eax, 0x20
je 0x413d20
cmp eax, 0xd
je 0x413d20
jmp 0x413d43
mov rsi, r8
jmp 0x413d43
mov r8, rsi
lea r13, [r12 + rsi]
mov r15, r8
mov rbx, r8
sub rbx, rsi
mov r9d, 4
mov rcx, r13
mov rdx, rbx
lea r8, str.quit
call fcn.00415950
test al, 1
jne 0x414ad5
mov r9d, 4
mov qword [rsp + 0x238], r13
mov rcx, r13
mov rdx, rbx
lea r8, str.stop
call fcn.00415950
test al, 1
je 0x413dc3
movzx eax, byte [rsp + 0x20986a]
and al, 3
cmp al, 1
mov r13, qword [rsp + 0x220]
jne 0x413fcb
mov byte [rsp + 0x20986a], 2
mov byte [rsp + 0x209862], 1
jmp 0x413fcb
cmp rbx, 2
jae 0x413de7
cmp r15, rsi
mov r15, qword [rsp + 0x238]
jne 0x413f2b
mov r13, qword [rsp + 0x220]
jmp 0x413fcb
lea rax, [0x005184ea]
mov r15, qword [rsp + 0x238]
cmp r15, rax
je 0x413e10
cmp byte [r15], 0x67
jne 0x413f2b
cmp byte [r15 + 1], 0x6f
jne 0x413f2b
mov qword [rsp + 0x230], r12
mov rdi, qword [rbp + 0x409d78]
xor eax, eax
test al, al
jne 0x414b5d
mov rcx, qword [rsp + 0x2005e0]
mov rax, qword [rsp + 0x2005e8]
mov rdx, rbx
xor r8d, r8d
mov r9, rdi
call qword [rax]
test rax, rax
je 0x414b5d
mov r12, rax
mov rcx, rax
mov rdx, r15
mov r8, rbx
call fcn.0043c590
call sub.KERNEL32.dll_GetProcessHeap
mov r15w, 0x16
test rax, rax
mov r13, qword [rsp + 0x220]
je 0x414bf6
mov r8d, 0x48
mov rsi, rax
mov rcx, rax
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x414bf6
mov rcx, rax
mov r15, rdi
mov rdi, rax
add rdi, 7
and rdi, 0xfffffffffffffff8
lea rax, [rsp + 0x400]
mov qword [rdi], rax
mov qword [rdi + 8], r12
mov qword [rdi + 0x10], rbx
mov rax, qword [rsp + 0x248]
mov qword [rdi + 0x18], rax
mov byte [rdi + 0x38], 0
mov rbx, rcx
mov qword [rdi + 0x20], rcx
mov qword [rdi + 0x28], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov edx, 0x1000000
xor ecx, ecx
lea r8, [0x00415a60]
mov r9, rdi
call sub.KERNEL32.dll_CreateThread
test rax, rax
je 0x414bdc
mov qword [rdi + 0x30], rax
add rdi, 0x20
mov qword [rsp + 0x250], rdi
mov al, 1
mov qword [rsp + 0x240], rax
mov r12, qword [rsp + 0x230]
jmp 0x413fc3
lea rcx, [rsp + 0x268]
lea rdx, [rsp + 0x400]
mov r8, r15
mov r9, rbx
call fcn.00401d60
movzx r15d, word [rsp + 0x278]
test r15w, r15w
jne 0x414b9b
mov rsi, qword [rsp + 0x270]
test rsi, rsi
je 0x413fbb
mov rdi, qword [rsp + 0x268]
xor ebx, ebx
lea rdx, [rdi + rbx]
mov r8, rsi
sub r8, rbx
mov eax, 0xffffffff
cmp r8, rax
cmovae r8, rax
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x248]
lea r9, [rsp + 0x218]
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x414a53
mov eax, dword [rsp + 0x218]
add rbx, rax
cmp rbx, rsi
jne 0x413f70
mov r13, qword [rsp + 0x220]
lea rdi, [rsp + 0x217]
lea rbx, [rsp + 0x218]
test r13, r13
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove r12, rax
je 0x413ab3
mov rax, qword [rbp + 0x409d78]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x290]
mov rdx, r12
mov r8, r13
xor r9d, r9d
call fcn.00415630
jmp 0x413ab3
cmp eax, 0x26
je 0x41402e
cmp eax, 0x6d
je 0x41402e
cmp eax, 0x40
jne 0x4140b8
mov r15w, 6
jmp 0x4140bd
test rsi, rsi
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove r12, rax
test rsi, rsi
je 0x414066
mov rax, qword [rbp + 0x409d78]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x290]
mov rdx, r12
mov r8, rsi
xor r9d, r9d
call fcn.00415630
cmp byte [rsp + 0x240], 0
jne 0x414075
xor r15d, r15d
jmp 0x4140f2
mov rsi, qword [rsp + 0x250]
mov rcx, qword [rsi + 0x10]
mov edx, 0xffffffff
xor r8d, r8d
call sub.KERNEL32.dll_WaitForSingleObjectEx
cmp eax, 0xffffffff
jne 0x414098
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [rsi + 0x10]
call sub.ntdll.dll_NtClose
movzx eax, byte [rsi + 0x18]
mov r8, qword [rsi]
mov rcx, qword [rsi + 8]
xor r15d, r15d
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x4140f2
mov r15w, 0xc
test rsi, rsi
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove r12, rax
je 0x4140f2
mov rax, qword [rbp + 0x409d78]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x290]
mov rdx, r12
mov r8, rsi
xor r9d, r9d
call fcn.00415630
cmp byte [rsp + 0x200698], 0
je 0x4149b5
mov dword [rsp + 0x238], r15d
mov rsi, qword [rsp + 0x200610]
mov rax, qword [rsp + 0x200620]
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0x200628]
mov qword [rsp + 0x220], rax
mov rax, qword [rsp + 0x200630]
mov qword [rsp + 0x248], rax
mov r15, qword [rsp + 0x200638]
mov rax, qword [rsp + 0x200640]
mov qword [rsp + 0x240], rax
mov rax, qword [rsp + 0x200648]
mov qword [rsp + 0x250], rax
mov r13, qword [rsp + 0x200650]
mov rax, qword [rsp + 0x200658]
mov qword [rsp + 0x260], rax
mov rax, qword [rsp + 0x200660]
mov qword [rsp + 0x258], rax
mov r14, qword [rsp + 0x200670]
mov rbx, qword [rsp + 0x200618]
mov r12, qword [rsp + 0x200668]
mov rdx, qword [rsp + 0x200678]
mov rdi, qword [rbp + 0x409d78]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 8]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0x10]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0x18]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0x20]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0x28]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0x30]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0x38]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0x40]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0x48]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0x50]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0x58]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0x60]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0x68]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0x70]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0x78]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0x88]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0x90]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0x98]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0xa0]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0xa8]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0xb0]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0xb8]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0xc0]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0xc8]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0xd0]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0xd8]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0xe0]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0xe8]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0xf0]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
mov rdx, qword [r12 + 0xf8]
mov qword [rsp + 0x20], rdi
mov r8d, 0x20
mov rcx, rsi
mov r9b, 5
call qword [rbx + 0x10]
test r14, r14
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove r12, rax
lea r8, [r14*8]
cmove r8, r14
test r8, r8
je 0x41454d
mov qword [rsp + 0x20], rdi
mov rcx, rsi
mov rdx, r12
mov r9b, 3
call qword [rbx + 0x10]
mov qword [rsp + 0x20], rdi
mov r8d, 0x80
mov rcx, rsi
mov rdx, qword [rsp + 0x258]
mov r9b, 7
call qword [rbx + 0x10]
mov rdx, qword [r13]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 8]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0x10]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0x18]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0x20]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0x28]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0x30]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0x38]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0x40]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0x48]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0x50]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0x58]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0x60]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0x68]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0x70]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0x78]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0x88]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0x90]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0x98]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0xa0]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0xa8]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0xb0]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0xb8]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0xc0]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0xc8]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0xd0]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0xd8]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0xe0]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0xe8]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0xf0]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rdx, qword [r13 + 0xf8]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
mov rcx, qword [rsp + 0x260]
test rcx, rcx
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove r13, rax
lea r8, [rcx*8]
cmove r8, rcx
test r8, r8
je 0x4148d4
mov qword [rsp + 0x20], rdi
mov rcx, rsi
mov rdx, r13
mov r9b, 3
call qword [rbx + 0x10]
mov qword [rsp + 0x20], rdi
mov r8d, 0x80
mov rcx, rsi
mov rdx, qword [rsp + 0x250]
mov r9b, 7
call qword [rbx + 0x10]
xor r14d, r14d
nop word cs:[rax + rax]
nop dword [rax]
mov rdx, qword [r15 + r14*8]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov r9b, 9
call qword [rbx + 0x10]
add r14, 1
cmp r14, 0x6ae
jne 0x414900
mov rcx, qword [rsp + 0x240]
test rcx, rcx
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove r15, rax
lea r8, [rcx*8]
cmove r8, rcx
test r8, r8
je 0x414960
mov qword [rsp + 0x20], rdi
mov rcx, rsi
mov rdx, r15
mov r9b, 3
call qword [rbx + 0x10]
mov qword [rsp + 0x20], rdi
mov r8d, 0x200
mov rcx, rsi
mov rdx, qword [rsp + 0x248]
mov r9b, 9
call qword [rbx + 0x10]
mov r8, qword [rsp + 0x220]
test r8, r8
movabs rax, 0xaaaaaaaaaaaaaaaa
mov rdx, qword [rsp + 0x230]
cmove rdx, rax
mov r15d, dword [rsp + 0x238]
je 0x4149b5
mov qword [rsp + 0x20], rdi
mov rcx, rsi
xor r9d, r9d
call qword [rbx + 0x10]
test r15w, r15w
je 0x414c2a
movsx rax, r15w
shl rax, 4
lea rcx, [0x0055d9c8]
movups xmm0, xmmword [rax + rcx]
movups xmmword [rsp + 0x280], xmm0
lea rcx, [rsp + 0x280]
call fcn.00414c40
mov ecx, 1
call sub.ntdll.dll_RtlExitUserProcess
cmp eax, 0x26
je 0x414a07
cmp eax, 0x6d
je 0x414a07
cmp eax, 0x40
jne 0x414a2b
mov r15w, 6
jmp 0x414a30
xor esi, esi
movabs r12, 0xaaaaaaaaaaaaaaaa
test rsi, rsi
jne 0x414044
jmp 0x414066
mov r15w, 0x16
jmp 0x4140bd
mov r15w, 0xc
xor esi, esi
movabs r12, 0xaaaaaaaaaaaaaaaa
jmp 0x4140bd
mov r15w, 0x16
mov rsi, qword [rsp + 0x220]
jmp 0x4140bd
call sub.KERNEL32.dll_GetLastError
movzx eax, ax
mov r15w, 0xc
cmp eax, 0x6c
jg 0x414a85
cmp eax, 0x20
mov r8, qword [rsp + 0x220]
jg 0x414aaf
cmp eax, 6
je 0x414b17
cmp eax, 8
je 0x414ace
jmp 0x414b2a
cmp eax, 0x6f7
mov r8, qword [rsp + 0x220]
jg 0x414ac0
cmp eax, 0x6d
je 0x414b1e
cmp eax, 0x3e3
jne 0x414b2a
mov r15w, 4
jmp 0x414b2a
cmp eax, 0x21
je 0x414b25
cmp eax, 0x40
jne 0x414b2a
mov r15w, 6
jmp 0x414b2a
cmp eax, 0x718
je 0x414ace
cmp eax, 0x6f8
jne 0x414b2a
mov r15w, 2
jmp 0x414b2a
movzx eax, byte [rsp + 0x20986a]
and al, 3
cmp al, 1
jne 0x414af3
mov byte [rsp + 0x20986a], 2
mov byte [rsp + 0x209862], 1
mov rsi, qword [rsp + 0x220]
test rsi, rsi
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove r12, rax
jne 0x414044
jmp 0x414066
mov r15w, 0x12
jmp 0x414b2a
mov r15w, 5
jmp 0x414b2a
mov r15w, 0x13
test r8, r8
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove r12, rax
je 0x4140f2
mov rax, qword [rbp + 0x409d78]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x290]
mov rdx, r12
jmp 0x4140ea
mov r15w, 0x16
mov r8, qword [rsp + 0x220]
test r8, r8
movabs rax, 0xaaaaaaaaaaaaaaaa
mov rdx, qword [rsp + 0x230]
cmove rdx, rax
je 0x4140f2
mov qword [rsp + 0x20], rdi
lea rcx, [rsp + 0x290]
jmp 0x4140ea
cmp qword [rsp + 0x220], 0
movabs rax, 0xaaaaaaaaaaaaaaaa
cmove r12, rax
je 0x4140f2
mov rax, qword [rbp + 0x409d78]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x290]
mov rdx, r12
mov r8, qword [rsp + 0x220]
jmp 0x4140ea
call sub.KERNEL32.dll_GetLastError
mov rcx, rsi
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov rdi, r15
mov r15w, 0xc
test r13, r13
movabs rax, 0xaaaaaaaaaaaaaaaa
mov rdx, qword [rsp + 0x230]
cmove rdx, rax
je 0x4140f2
mov qword [rsp + 0x20], rdi
lea rcx, [rsp + 0x290]
mov r8, r13
jmp 0x4140ea
xor ecx, ecx
call sub.ntdll.dll_RtlExitUserProcess
int3