Function at 0x140001a30
Capabilities:
Check for debugger via api
Check if process is running under wine
Get memory capacity
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2d8
movzx eax, byte [0x140064141]
mov ecx, 0x330
mov edx, 8
call fcn.140009c00
test rax, rax
je 0x140003c58
mov rbp, rax
lea rdx, str.HKLMHARDWAREDEVICEMAPScsiScsi_Port_0Scsi_Bus_0Target_Id_0Logical_Unit_Id_0IdentifierVMWAREHKLMSOFTWAREVMware__Inc.VMware_ToolsHKLMHARDWAREDescriptionSystemSystemBiosVersionVBOXHKLMSOFTWAREOracleVirtualBox_Guest_AdditionsHKLMHARDWAREACPIDSDTVBOX__QEMUHKLMHARDWAREDescriptionSystemVideoBiosVersionVIRTUALBOXHKLMHARDWAREDescriptionSystemSystemBiosDate06_23_99HKLMHARDWAREDEVICEMAPScsiScsi_Port_1Scsi_Bus_0Target_Id_0Logical_Unit_Id_0HKLMHARDWAREDEVICEMAPScsiScsi_Port_2Scsi_Bus_0Target_Id_0Logical_Unit_Id_0HKLMSYSTEMControlSet001ControlSystemInformationSystemManufacturerSystemProductNameHKEY_LOCAL_MACHINEHARDWAREACPIFADTVBOX__HKEY_LOCAL_MACHINEHARDWAREACPIRSDTVBOX__HKEY_LOCAL_MACHINESOFTWAREOracleVirtualBox_Guest_AdditionsHKEY_LOCAL_MACHINESYSTEMControlSet001ServicesVBoxGuestHKEY_LOCAL_MACHINESYSTEMControlSet001ServicesVBoxMouseHKEY_LOCAL_MACHINESYSTEMControlSet001ServicesVBoxServiceHKEY_LOCAL_MACHINESYSTEMControlSet001ServicesVBoxSFHKEY_LOCAL_MACHINESYSTEMControlSet001ServicesVBoxVideoHKEY_LOCAL_MACHINESOFTWAREVMware__Inc.VMware_ToolsHKEY_LOCAL_MACHINESOFTWAREWineHKEY_LOCAL_MACHINESOFTWAREMicrosoftVirtual_MachineGuestParametersHKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesDiskEnumHKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumIDEHKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumSCSIHKEY_LOCAL_MACHINEHARDWAREACPIDSDTVBOX__C:Windows_system32driversVBoxGuest.sysC:Windows_system32driversVBoxSF.sysC:Windows_system32driversVBoxVideo.sysC:Windows_system32_vboxdisp.dllC:Windows_system32_vboxhook.dllC:Windows_system32_vboxmrxnp.dllC:Windows_system32_vboxogl.dllC:Windows_system32_vboxoglarrayspu.dllC:Windows_system32_vboxoglcrutil.dllC:Windows_system32_vboxoglerrorspu.dllC:Windows_system32_vboxoglfeedbackspu.dllC:Windows_system32_vboxoglpackspu.dllC:Windows_system32_vboxoglpassthroughspu.dllC:Windows_system32_vboxservice.exeC:Windows_system32_vboxtray.exeC:Windows_system32VBoxControl.exeC:Windows_system32drivers_vmmouse.sysC:Windows_system32drivers_vmhgfs.sysC:Windows_system32drivers_vm3dmp.sysC:Windows_system32drivers_vmmemctl.sysC:Windows_system32drivers_vmrawdsk.sysC:Windows_system32drivers_vmusbmouse.sysC:Windows_system32drivers_vmci.sysC:Windows_system32driversVBoxMouse.sysvboxtray.exevmtoolsd.exevmwaretray.exevmwareuser.exeVGAuthService.exevmacthlp.exevmsrvc.exevmusrvc.exeprl_cc.exeprl_tools.exexenservice.exeqemu_ga.exevboxservice.exeKVMKVMKVMMicrosoft_HvVMwareVMwareXenVMMXenVMMprl_hypervVBoxVBoxVBoxregqueryFailed_to_execute_reg_query_cmdsrc_antisandbox.rs
mov qword [rax], rdx
mov qword [rax + 8], 0x51
lea rcx, [0x14004d759]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 0xa
lea rax, [0x14004d763]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], 6
lea r8, [0x14004d769]
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], 0x27
mov qword [rbp + 0x40], 1
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 1
mov qword [rbp + 0x58], 0
lea r8, [0x14004d790]
mov qword [rbp + 0x60], r8
mov qword [rbp + 0x68], 0x32
mov qword [rbp + 0x70], 1
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], 6
mov qword [rbp + 0x90], r8
mov qword [rbp + 0x98], 0x32
mov qword [rbp + 0xa0], 1
mov qword [rbp + 0xa8], 0
lea r9, [0x14004d7c2]
mov qword [rbp + 0xb0], r9
mov qword [rbp + 0xb8], 4
lea r10, [0x14004d7c6]
mov qword [rbp + 0xc0], r10
mov qword [rbp + 0xc8], 0x2f
mov qword [rbp + 0xd0], 1
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xe0], 1
mov qword [rbp + 0xe8], 0
lea r10, [0x14004d7f5]
mov qword [rbp + 0xf0], r10
mov qword [rbp + 0xf8], 0x1e
mov qword [rbp + 0x100], 1
mov qword [rbp + 0x108], 0
mov qword [rbp + 0x110], 1
mov qword [rbp + 0x118], 0
mov qword [rbp + 0x120], rdx
mov qword [rbp + 0x128], 0x51
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0x138], 0xa
mov qword [rbp + 0x140], r9
mov qword [rbp + 0x148], 4
mov qword [rbp + 0x150], rdx
mov qword [rbp + 0x158], 0x51
mov qword [rbp + 0x160], rcx
mov qword [rbp + 0x168], 0xa
lea r10, [0x14004d813]
mov qword [rbp + 0x170], r10
mov qword [rbp + 0x178], 4
mov qword [rbp + 0x180], r8
mov qword [rbp + 0x188], 0x32
mov qword [rbp + 0x190], 1
mov qword [rbp + 0x198], 0
mov qword [rbp + 0x1a0], r9
mov qword [rbp + 0x1a8], 4
mov qword [rbp + 0x1b0], r8
mov qword [rbp + 0x1b8], 0x32
mov qword [rbp + 0x1c0], 1
mov qword [rbp + 0x1c8], 0
mov qword [rbp + 0x1d0], r10
mov qword [rbp + 0x1d8], 4
lea r8, [0x14004d817]
mov qword [rbp + 0x1e0], r8
mov qword [rbp + 0x1e8], 0x31
mov qword [rbp + 0x1f0], 1
mov qword [rbp + 0x1f8], 0
lea r8, [0x14004d848]
mov qword [rbp + 0x200], r8
mov qword [rbp + 0x208], 0xa
lea r8, [0x14004d852]
mov qword [rbp + 0x210], r8
mov qword [rbp + 0x218], 0x2f
mov qword [rbp + 0x220], 1
mov qword [rbp + 0x228], 0
lea r8, [0x14004d881]
mov qword [rbp + 0x230], r8
mov qword [rbp + 0x238], 8
mov qword [rbp + 0x240], rdx
mov qword [rbp + 0x248], 0x51
mov qword [rbp + 0x250], rcx
mov qword [rbp + 0x258], 0xa
mov qword [rbp + 0x260], rax
mov qword [rbp + 0x268], 6
lea rdx, [0x14004d889]
mov qword [rbp + 0x270], rdx
mov qword [rbp + 0x278], 0x51
mov qword [rbp + 0x280], rcx
mov qword [rbp + 0x288], 0xa
mov qword [rbp + 0x290], rax
mov qword [rbp + 0x298], 6
lea rdx, [0x14004d8da]
mov qword [rbp + 0x2a0], rdx
mov qword [rbp + 0x2a8], 0x51
mov qword [rbp + 0x2b0], rcx
mov qword [rbp + 0x2b8], 0xa
mov qword [rbp + 0x2c0], rax
mov qword [rbp + 0x2c8], 6
lea rcx, [0x14004d92b]
mov qword [rbp + 0x2d0], rcx
mov qword [rbp + 0x2d8], 0x33
lea rdx, [0x14004d95e]
mov qword [rbp + 0x2e0], rdx
mov qword [rbp + 0x2e8], 0x12
mov qword [rbp + 0x2f0], rax
mov qword [rbp + 0x2f8], 6
mov qword [rbp + 0x300], rcx
mov qword [rbp + 0x308], 0x33
lea rcx, [0x14004d970]
mov qword [rbp + 0x310], rcx
mov qword [rbp + 0x318], 0x11
mov qword [rbp + 0x320], rax
mov qword [rbp + 0x328], 6
mov eax, 0x28
lea rbx, [rsp + 0x138]
mov qword [rsp + 0xa0], rbp
jmp 0x140001eb1
and bpl, dil
mov rdi, qword [rsp + 0xa8]
lea rax, [rdi + 0x30]
cmp bpl, 1
mov rbp, qword [rsp + 0xa0]
je 0x140002064
cmp rax, 0x358
mov qword [rsp + 0xa8], rax
je 0x140002064
mov rdi, rax
mov r15, qword [rbp + rax - 0x28]
mov r12, qword [rbp + rax - 0x20]
mov rsi, qword [rbp + rax - 0x18]
mov r14, qword [rbp + rax - 0x10]
mov r13, qword [rbp + rax - 8]
mov rdi, qword [rbp + rax]
mov rcx, r15
mov rdx, r12
call fcn.140003d70
mov ebp, eax
mov r8d, 3
mov rcx, rbx
lea rdx, [0x14004e115]
call fcn.14002f100
mov r8d, 5
mov rcx, rbx
lea rdx, [0x14004e118]
call fcn.14002f220
mov rcx, rbx
mov rdx, r15
mov r8, r12
call fcn.14002f220
mov r8d, 2
mov rcx, rbx
lea rdx, [0x14004e168]
call fcn.14002f220
mov rcx, rbx
mov rdx, rsi
mov r8, r14
call fcn.14002f220
lea rcx, [rsp + 0x240]
mov rdx, rbx
call fcn.140027d20
mov r12, qword [rsp + 0x240]
movabs rax, 0x8000000000000000
cmp r12, rax
je 0x140003c1c
mov r14, qword [rsp + 0x248]
mov r15, qword [rsp + 0x250]
mov rax, qword [rsp + 0x258]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x260]
mov qword [rsp + 0x38], rax
mov esi, dword [rsp + 0x270]
mov rcx, rbx
call fcn.140001070
test esi, esi
je 0x140001fd0
xor edi, edi
test r12, r12
jne 0x140002018
jmp 0x140002029
mov rcx, rbx
mov rdx, r14
mov r8, r15
call fcn.1400408e0
mov r15, qword [rsp + 0x140]
mov r9, qword [rsp + 0x148]
mov rcx, r13
mov rdx, rdi
mov r8, r15
call fcn.1400013a0
mov edi, eax
mov rdx, qword [rsp + 0x138]
lea rax, [rdx*2]
test rax, rax
jne 0x14000204f
test r12, r12
je 0x140002029
mov r8d, 1
mov rcx, r14
mov rdx, r12
call fcn.140009c10
mov rdx, qword [rsp + 0x88]
test rdx, rdx
je 0x140001e90
mov r8d, 1
mov rcx, qword [rsp + 0x38]
call fcn.140009c10
jmp 0x140001e90
mov r8d, 1
mov rcx, r15
call fcn.140009c10
test r12, r12
jne 0x140002018
jmp 0x140002029
movzx eax, byte [0x140064141]
mov ecx, 0xf0
mov edx, 8
call fcn.140009c00
test rax, rax
je 0x140003c67
mov r13, rax
lea rcx, [0x14004dc79]
mov qword [rax], rcx
mov qword [rax + 8], 0x2c
lea rax, [0x14004d981]
mov qword [r13 + 0x10], rax
mov qword [r13 + 0x18], 0x2c
lea rax, [0x14004d9ad]
mov qword [r13 + 0x20], rax
mov qword [r13 + 0x28], 0x2c
lea rax, [0x14004d9d9]
mov qword [r13 + 0x30], rax
mov qword [r13 + 0x38], 0x3d
lea rax, [0x14004da16]
mov qword [r13 + 0x40], rax
mov qword [r13 + 0x48], 0x3a
lea rax, [0x14004da50]
mov qword [r13 + 0x50], rax
mov qword [r13 + 0x58], 0x3a
lea rax, [0x14004da8a]
mov qword [r13 + 0x60], rax
mov qword [r13 + 0x68], 0x3c
lea rax, [0x14004dac6]
mov qword [r13 + 0x70], rax
mov qword [r13 + 0x78], 0x37
lea rax, [0x14004dafd]
mov qword [r13 + 0x80], rax
mov qword [r13 + 0x88], 0x3a
lea rax, [0x14004db37]
mov qword [r13 + 0x90], rax
mov qword [r13 + 0x98], 0x35
lea rax, [0x14004db6c]
mov qword [r13 + 0xa0], rax
mov qword [r13 + 0xa8], 0x20
lea rax, [0x14004db8c]
mov qword [r13 + 0xb0], rax
mov qword [r13 + 0xb8], 0x46
lea rax, [0x14004dbd2]
mov qword [r13 + 0xc0], rax
mov qword [r13 + 0xc8], 0x3e
lea rax, [0x14004dc10]
mov qword [r13 + 0xd0], rax
mov qword [r13 + 0xd8], 0x34
lea rax, [0x14004dc44]
mov qword [r13 + 0xe0], rax
mov qword [r13 + 0xe8], 0x35
mov edx, 0x2c
call fcn.140003d70
test al, al
jne 0x1400021ef
mov rcx, qword [r13 + 0x10]
mov rdx, qword [r13 + 0x18]
call fcn.140003d70
test al, al
je 0x140002920
mov byte [rsp + 0x37], 1
movzx eax, byte [0x140064141]
mov r15d, 8
mov ecx, 0x1a0
mov edx, 8
call fcn.140009c00
test rax, rax
je 0x140003c76
mov r12, rax
lea rax, [0x14004e004]
mov qword [r12], rax
mov qword [r12 + 8], 0x29
lea rax, [0x14004dca5]
mov qword [r12 + 0x10], rax
mov qword [r12 + 0x18], 0x29
lea rax, [0x14004dcce]
mov qword [r12 + 0x20], rax
mov qword [r12 + 0x28], 0x26
lea rax, [0x14004dcf4]
mov qword [r12 + 0x30], rax
mov qword [r12 + 0x38], 0x29
lea rax, [0x14004dd1d]
mov qword [r12 + 0x40], rax
mov qword [r12 + 0x48], 0x20
lea rax, [0x14004dd3d]
mov qword [r12 + 0x50], rax
mov qword [r12 + 0x58], 0x20
lea rax, [0x14004dd5d]
mov qword [r12 + 0x60], rax
mov qword [r12 + 0x68], 0x21
lea rax, [0x14004dd7e]
mov qword [r12 + 0x70], rax
mov qword [r12 + 0x78], 0x1f
lea rax, [0x14004dd9d]
mov qword [r12 + 0x80], rax
mov qword [r12 + 0x88], 0x27
lea rax, [0x14004ddc4]
mov qword [r12 + 0x90], rax
mov qword [r12 + 0x98], 0x25
lea rax, [0x14004dde9]
mov qword [r12 + 0xa0], rax
mov qword [r12 + 0xa8], 0x27
lea rax, [0x14004de10]
mov qword [r12 + 0xb0], rax
mov qword [r12 + 0xb8], 0x2a
lea rax, [0x14004de3a]
mov qword [r12 + 0xc0], rax
mov qword [r12 + 0xc8], 0x26
lea rax, [0x14004de60]
mov qword [r12 + 0xd0], rax
mov qword [r12 + 0xd8], 0x2d
lea rax, [0x14004de8d]
mov qword [r12 + 0xe0], rax
mov qword [r12 + 0xe8], 0x23
lea rax, [0x14004deb0]
mov qword [r12 + 0xf0], rax
mov qword [r12 + 0xf8], 0x20
lea rax, [0x14004ded0]
mov qword [r12 + 0x100], rax
mov qword [r12 + 0x108], 0x23
lea rax, [0x14004def3]
mov qword [r12 + 0x110], rax
mov qword [r12 + 0x118], 0x27
lea rcx, [0x14004df1a]
mov qword [r12 + 0x120], rcx
mov qword [r12 + 0x128], 0x26
lea rdx, [0x14004df40]
mov qword [r12 + 0x130], rdx
mov qword [r12 + 0x138], 0x26
mov qword [r12 + 0x140], rcx
mov qword [r12 + 0x148], 0x26
lea rcx, [0x14004df66]
mov qword [r12 + 0x150], rcx
mov qword [r12 + 0x158], 0x28
mov qword [r12 + 0x160], rax
mov qword [r12 + 0x168], 0x27
lea rax, [0x14004df8e]
mov qword [r12 + 0x170], rax
mov qword [r12 + 0x178], 0x28
lea rax, [0x14004dfb6]
mov qword [r12 + 0x180], rax
mov qword [r12 + 0x188], 0x2a
lea rax, [0x14004dfe0]
mov qword [r12 + 0x190], rax
mov qword [r12 + 0x198], 0x24
lea rdi, [rsp + 0x138]
jmp 0x1400024d3
dec rsi
mov edx, 0x18
mov r8d, 8
mov rcx, rsi
call fcn.140009c10
add r15, 0x10
cmp r15, 0x1a8
je 0x14000253e
mov rdx, qword [r12 + r15 - 8]
mov r8, qword [r12 + r15]
mov rcx, rdi
call fcn.14002c4a0
mov rcx, qword [rsp + 0x138]
mov rax, rcx
mov qword [rsp + 0x88], rcx
cmp rcx, 2
jne 0x14000253e
mov rsi, qword [rsp + 0x140]
mov eax, esi
and eax, 3
cmp eax, 1
jne 0x1400024c6
mov r14, qword [rsi - 1]
mov rbx, qword [rsi + 7]
mov rax, qword [rbx]
test rax, rax
je 0x140002524
mov rcx, r14
call rax
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x1400024b0
mov r8, qword [rbx + 0x10]
mov rcx, r14
call fcn.140009c10
jmp 0x1400024b0
mov qword [rsp + 0x78], r12
lea rdx, str.wmicprocessgetnameFailed_to_execute_wmic_cmd
lea rsi, [rsp + 0x138]
mov r8d, 4
mov rcx, rsi
call fcn.14002f100
lea rdx, [0x14004e18c]
mov r8d, 7
mov rcx, rsi
call fcn.14002f220
lea rdx, [0x14004e193]
mov r8d, 3
mov rcx, rsi
call fcn.14002f220
lea rdx, [0x14004e196]
mov r8d, 4
mov rcx, rsi
call fcn.14002f220
lea rcx, [rsp + 0x240]
mov rdx, rsi
call fcn.140027d20
mov r15, qword [rsp + 0x240]
movabs rax, 0x8000000000000000
cmp r15, rax
je 0x140003c85
mov rsi, qword [rsp + 0x248]
mov r12, qword [rsp + 0x250]
mov rdi, qword [rsp + 0x258]
mov r14, qword [rsp + 0x260]
lea rcx, [rsp + 0x138]
call fcn.140001070
lea rcx, [rsp + 0x240]
mov rdx, rsi
mov r8, r12
call fcn.1400408e0
mov r12, qword [rsp + 0x248]
mov rax, qword [rsp + 0x250]
mov qword [rsp + 0x138], 1
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], r12
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x160], 0
mov qword [rsp + 0x168], rax
movabs rax, 0xa0000000a
mov qword [rsp + 0x170], rax
mov byte [rsp + 0x178], 1
mov word [rsp + 0x180], 0
lea rcx, [rsp + 0xb0]
lea rdx, [rsp + 0x138]
call fcn.1400050a0
mov rdx, qword [rsp + 0x240]
lea rax, [rdx*2]
test rax, rax
jne 0x1400028bc
test r15, r15
je 0x1400026c6
mov r8d, 1
mov rcx, rsi
mov rdx, r15
call fcn.140009c10
test rdi, rdi
je 0x1400026dc
mov r8d, 1
mov rcx, r14
mov rdx, rdi
call fcn.140009c10
movzx eax, byte [0x140064141]
mov ecx, 0xd0
mov edx, 8
call fcn.140009c00
test rax, rax
je 0x140003cc1
mov rcx, rax
lea rdi, [0x14004e0c3]
mov qword [rax], rdi
mov qword [rax + 8], 0xf
lea rax, [0x14004e02d]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 0xc
lea rax, [0x14004e039]
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], 0xc
lea rax, [0x14004e045]
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], 0xe
lea rax, [0x14004e053]
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], 0xe
lea rax, [0x14004e061]
mov qword [rcx + 0x50], rax
mov qword [rcx + 0x58], 0x11
lea rax, [0x14004e072]
mov qword [rcx + 0x60], rax
mov qword [rcx + 0x68], 0xc
lea rax, [0x14004e07e]
mov qword [rcx + 0x70], rax
mov qword [rcx + 0x78], 0xa
lea rax, [0x14004e088]
mov qword [rcx + 0x80], rax
mov qword [rcx + 0x88], 0xb
lea rax, [0x14004e093]
mov qword [rcx + 0x90], rax
mov qword [rcx + 0x98], 0xa
lea rax, [0x14004e09d]
mov qword [rcx + 0xa0], rax
mov qword [rcx + 0xa8], 0xd
lea rax, [0x14004e0aa]
mov qword [rcx + 0xb0], rax
mov qword [rcx + 0xb8], 0xe
lea rax, [0x14004e0b8]
mov qword [rcx + 0xc0], rax
mov qword [rsp + 0x48], rcx
mov qword [rcx + 0xc8], 0xb
mov rcx, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xc0]
lea r15, [r14*8]
lea rsi, [r15 + r15*2]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x80], r13
test rsi, rsi
je 0x14000286e
lea rbx, [rcx + 0x18]
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
mov edx, 0xf
mov rcx, rdi
call fcn.1400013a0
add rsi, 0xffffffffffffffe8
mov rcx, rbx
test al, al
je 0x140002840
jmp 0x140002aeb
mov rax, qword [rsp + 0x48]
mov rsi, qword [rax + 0x10]
mov rdi, qword [rax + 0x18]
lea rbx, [r15 + r15*2]
mov rcx, qword [rsp + 0x38]
nop word cs:[rax + rax]
test rbx, rbx
je 0x1400028d8
lea r12, [rcx + 0x18]
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
mov rcx, rsi
mov rdx, rdi
call fcn.1400013a0
add rbx, 0xffffffffffffffe8
mov rcx, r12
test al, al
je 0x140002890
jmp 0x140002aeb
mov r8d, 1
mov rcx, r12
call fcn.140009c10
test r15, r15
jne 0x1400026b5
jmp 0x1400026c6
mov rax, qword [rsp + 0x48]
mov rsi, qword [rax + 0x20]
mov rdi, qword [rax + 0x28]
lea rbx, [r15 + r15*2]
mov rcx, qword [rsp + 0x38]
nop
test rbx, rbx
je 0x140002a61
lea r12, [rcx + 0x18]
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
mov rcx, rsi
mov rdx, rdi
call fcn.1400013a0
add rbx, 0xffffffffffffffe8
mov rcx, r12
test al, al
je 0x1400028f0
jmp 0x140002aeb
mov byte [rsp + 0x37], 1
mov rcx, qword [r13 + 0x20]
mov rdx, qword [r13 + 0x28]
call fcn.140003d70
test al, al
jne 0x1400021f4
mov rcx, qword [r13 + 0x30]
mov rdx, qword [r13 + 0x38]
call fcn.140003d70
test al, al
jne 0x1400021f4
mov rcx, qword [r13 + 0x40]
mov rdx, qword [r13 + 0x48]
call fcn.140003d70
test al, al
jne 0x1400021f4
mov rcx, qword [r13 + 0x50]
mov rdx, qword [r13 + 0x58]
call fcn.140003d70
test al, al
jne 0x1400021f4
mov rcx, qword [r13 + 0x60]
mov rdx, qword [r13 + 0x68]
call fcn.140003d70
test al, al
jne 0x1400021f4
mov rcx, qword [r13 + 0x70]
mov rdx, qword [r13 + 0x78]
call fcn.140003d70
test al, al
jne 0x1400021f4
mov rcx, qword [r13 + 0x80]
mov rdx, qword [r13 + 0x88]
call fcn.140003d70
test al, al
jne 0x1400021f4
mov rcx, qword [r13 + 0x90]
mov rdx, qword [r13 + 0x98]
call fcn.140003d70
test al, al
jne 0x1400021f4
mov rcx, qword [r13 + 0xa0]
mov rdx, qword [r13 + 0xa8]
call fcn.140003d70
test al, al
jne 0x1400021f4
mov rcx, qword [r13 + 0xb0]
mov rdx, qword [r13 + 0xb8]
call fcn.140003d70
test al, al
jne 0x1400021f4
mov rcx, qword [r13 + 0xc0]
mov rdx, qword [r13 + 0xc8]
call fcn.140003d70
test al, al
jne 0x1400021f4
mov rcx, qword [r13 + 0xd0]
mov rdx, qword [r13 + 0xd8]
call fcn.140003d70
test al, al
jne 0x1400021f4
mov rcx, qword [r13 + 0xe0]
mov rdx, qword [r13 + 0xe8]
call fcn.140003d70
mov byte [rsp + 0x37], al
jmp 0x1400021f4
mov rax, qword [rsp + 0x48]
mov rsi, qword [rax + 0x30]
mov rdi, qword [rax + 0x38]
lea rbx, [r15 + r15*2]
mov rcx, qword [rsp + 0x38]
nop word [rax + rax]
test rbx, rbx
je 0x140002aa9
lea r12, [rcx + 0x18]
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
mov rcx, rsi
mov rdx, rdi
call fcn.1400013a0
add rbx, 0xffffffffffffffe8
mov rcx, r12
test al, al
je 0x140002a80
jmp 0x140002aeb
mov rax, qword [rsp + 0x48]
mov rsi, qword [rax + 0x40]
mov rdi, qword [rax + 0x48]
lea rbx, [r15 + r15*2]
mov rcx, qword [rsp + 0x38]
nop
test rbx, rbx
je 0x14000379e
lea r12, [rcx + 0x18]
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
mov rcx, rsi
mov rdx, rdi
call fcn.1400013a0
add rbx, 0xffffffffffffffe8
mov rcx, r12
test al, al
je 0x140002ac0
mov r13b, 1
mov byte [rsp + 0x47], r13b
lea rdx, str.ipconfig_allFailed_to_Exec_ipconfing
lea rsi, [rsp + 0x138]
mov r8d, 8
mov rcx, rsi
call fcn.14002f100
lea rdx, [0x14004e1d8]
mov r8d, 4
mov rcx, rsi
call fcn.14002f220
lea rcx, [rsp + 0x208]
mov rdx, rsi
call fcn.140027d20
mov rcx, qword [rsp + 0x208]
movabs rax, 0x8000000000000000
mov qword [rsp + 0x68], rcx
cmp rcx, rax
je 0x140003cd0
mov rdi, qword [rsp + 0x210]
mov rsi, qword [rsp + 0x218]
mov rax, qword [rsp + 0x220]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x228]
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0x138]
call fcn.140001070
lea rcx, [rsp + 0x108]
mov qword [rsp + 0x90], rdi
mov rdx, rdi
mov r8, rsi
call fcn.1400408e0
mov r12, qword [rsp + 0x110]
mov rbp, qword [rsp + 0x118]
xor edi, edi
xor r15d, r15d
jmp 0x140002bdc
mov rdi, rbx
test r13b, r13b
je 0x140002d7a
cmp rbp, r15
jae 0x140002bf8
mov rcx, r15
jmp 0x140002c63
mov r15, rcx
cmp rbp, rcx
jb 0x140002c63
mov r8, rbp
sub r8, r15
lea rsi, [r12 + r15]
cmp r8, 0xf
ja 0x140002c20
cmp rbp, r15
je 0x140002c60
xor edx, edx
nop
cmp byte [rsi + rdx], 0xa
je 0x140002c34
inc rdx
cmp r8, rdx
jne 0x140002c10
jmp 0x140002c60
mov cl, 0xa
mov rdx, rsi
call fcn.140042f80
cmp rax, 1
jne 0x140002d63
lea rcx, [r15 + rdx]
inc rcx
add r15, rdx
cmp r15, rbp
jae 0x140002bf0
cmp byte [rdx + rsi], 0xa
jne 0x140002bf0
mov r13b, 1
mov rbx, rcx
mov r15, rcx
jmp 0x140002c78
mov rcx, rbp
cmp rbp, rdi
je 0x140002d7a
xor r13d, r13d
mov rbx, rdi
mov r15, rcx
mov rcx, rbp
mov rsi, rcx
sub rsi, rdi
je 0x140002ca0
cmp byte [r12 + rcx - 1], 0xa
jne 0x140002ca2
mov rax, rsi
dec rax
je 0x140002ca0
add rsi, 0xfffffffffffffffe
cmp byte [r12 + rcx - 2], 0xd
cmovne rsi, rax
jmp 0x140002ca2
xor esi, esi
add rdi, r12
mov edx, 0x10
lea rcx, str.Physical_Address_:GlobalMemoryStatusEx_Failed
mov r8, rdi
mov r9, rsi
call fcn.1400013a0
test al, al
je 0x140002bd0
lea rax, [rdi + rsi]
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xe8], rdi
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 0
mov word [rsp + 0x100], 1
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0xc8]
call fcn.140004f40
cmp qword [rsp + 0x130], 2
ja 0x140002ec6
mov rdx, qword [rsp + 0x120]
test rdx, rdx
je 0x140002bd0
mov rcx, qword [rsp + 0x128]
shl rdx, 4
mov r8d, 8
call fcn.140009c10
jmp 0x140002bd0
mov r13b, 1
mov rcx, rbp
mov r15, rbp
test rax, rax
je 0x140002c63
jmp 0x140002c78
mov rdx, qword [rsp + 0x108]
lea rax, [rdx*2]
test rax, rax
jne 0x140002e9d
mov rdx, qword [rsp + 0x68]
test rdx, rdx
mov r15, qword [rsp + 0x80]
je 0x140002db8
mov r8d, 1
mov rcx, qword [rsp + 0x90]
call fcn.140009c10
mov rdx, qword [rsp + 0x70]
test rdx, rdx
mov r12, qword [rsp + 0x78]
je 0x140002dda
mov r8d, 1
mov rcx, qword [rsp + 0x98]
call fcn.140009c10
mov edx, 0xd0
mov r8d, 8
mov rcx, qword [rsp + 0x48]
call fcn.140009c10
test r14, r14
je 0x140002e22
mov rax, qword [rsp + 0x38]
lea rsi, [rax + 8]
jmp 0x140002e09
add rsi, 0x18
dec r14
je 0x140002e22
mov rdx, qword [rsi - 8]
test rdx, rdx
je 0x140002e00
mov rcx, qword [rsi]
mov r8d, 1
call fcn.140009c10
jmp 0x140002e00
mov rax, qword [rsp + 0xb0]
test rax, rax
je 0x140002e47
shl rax, 3
lea rdx, [rax + rax*2]
mov r8d, 8
mov rcx, qword [rsp + 0x38]
call fcn.140009c10
xor ebp, ebp
mov edx, 0x1a0
mov r8d, 8
mov rcx, r12
call fcn.140009c10
mov edx, 0xf0
mov r8d, 8
mov rcx, r15
call fcn.140009c10
mov edx, 0x330
mov r8d, 8
mov rcx, qword [rsp + 0xa0]
call fcn.140009c10
mov eax, ebp
add rsp, 0x2d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, 1
mov rcx, r12
call fcn.140009c10
mov rdx, qword [rsp + 0x68]
test rdx, rdx
mov r15, qword [rsp + 0x80]
jne 0x140002da5
jmp 0x140002db8
mov rbx, qword [rsp + 0x128]
mov rdi, qword [rbx + 0x20]
mov r14, qword [rbx + 0x28]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x20], 1
lea r9, [0x14004e220]
lea rsi, [rsp + 0x138]
mov rcx, rsi
mov rdx, rdi
mov r8, r14
call fcn.140043870
lea rcx, [rsp + 0x208]
mov rdx, rsi
call fcn.140001870
cmp qword [rsp + 0x208], 0
je 0x140003025
mov qword [rsp + 0x38], r14
mov r13d, 1
xor r15d, r15d
lea r14, [rsp + 0x138]
xor r12d, r12d
jmp 0x140002f95
mov r13, qword [rsp + 0x58]
mov byte [r13 + rsi], 0x3a
mov r15, rsi
inc r15
mov qword [rsp + 0x60], r15
lea rcx, [rsp + 0x208]
mov rdx, r14
call fcn.140001870
cmp qword [rsp + 0x208], 0
je 0x140003019
mov rbp, r12
mov r12, qword [rsp + 0x218]
mov rsi, qword [rsp + 0x210]
add rsi, rdi
add rbp, rdi
sub rsi, rbp
mov rax, qword [rsp + 0x50]
sub rax, r15
cmp rax, rsi
jb 0x140002ffd
add r13, r15
mov rcx, r13
mov rdx, rbp
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rsi, qword [rsp + 0x60]
mov qword [rsp + 0x60], rsi
cmp qword [rsp + 0x50], rsi
jne 0x140002f60
mov r8d, 1
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.1400474d0
mov rsi, qword [rsp + 0x60]
jmp 0x140002f60
lea rcx, [rsp + 0x50]
mov rdx, r15
mov r8, rsi
call fcn.1400474d0
mov r13, qword [rsp + 0x58]
mov r15, qword [rsp + 0x60]
jmp 0x140002fbe
mov rax, qword [rsp + 0x50]
mov r14, qword [rsp + 0x38]
jmp 0x140003033
mov r13d, 1
xor eax, eax
xor r15d, r15d
xor r12d, r12d
add r12, rdi
add r14, rdi
sub r14, r12
sub rax, r15
cmp rax, r14
jb 0x14000383c
add r15, r13
mov rcx, r15
mov rdx, r12
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
add r14, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
mov qword [rsp + 0x20], 1
lea r9, [0x14004e221]
lea rdi, [rsp + 0x240]
mov rcx, rdi
mov rdx, r13
mov r8, r14
call fcn.140043870
mov qword [rsp + 0x2a8], 0
mov qword [rsp + 0x2b0], r14
mov word [rsp + 0x2b8], 1
lea rcx, [rsp + 0x2c0]
mov rdx, rdi
call fcn.140004ad0
test rsi, rsi
je 0x1400030cd
mov r8d, 1
mov rcx, r13
mov rdx, rsi
call fcn.140009c10
mov rdx, qword [rsp + 0x120]
test rdx, rdx
mov r12, qword [rsp + 0x78]
je 0x1400030f1
shl rdx, 4
mov r8d, 8
mov rcx, rbx
call fcn.140009c10
mov rdx, qword [rsp + 0x108]
movabs rax, 0x8000000000000000
cmp rdx, rax
je 0x140003120
test rdx, rdx
je 0x140003120
mov rcx, qword [rsp + 0x110]
mov r8d, 1
call fcn.140009c10
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x14000313d
mov r8d, 1
mov rcx, qword [rsp + 0x90]
call fcn.140009c10
mov rdx, qword [rsp + 0x70]
test rdx, rdx
je 0x14000315a
mov r8d, 1
mov rcx, qword [rsp + 0x98]
call fcn.140009c10
mov rbx, qword [rsp + 0x2c0]
movabs rax, 0x8000000000000000
cmp rbx, rax
jne 0x140003193
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x38], rax
mov r14, qword [rsp + 0xc0]
mov r15, qword [rsp + 0x80]
jmp 0x140002dda
mov rax, qword [rsp + 0x2c8]
mov qword [rsp + 0x38], rax
mov rsi, qword [rsp + 0x2d0]
movzx eax, byte [0x140064141]
mov ecx, 0xc0
mov edx, 8
call fcn.140009c00
test rax, rax
je 0x140003d15
mov r13, rax
movzx eax, byte [0x140064141]
mov ecx, 3
mov edx, 1
call fcn.140009c00
test rax, rax
je 0x140003d06
mov rdi, rax
mov word [rax], 8
mov byte [rax + 2], 0x27
movzx eax, byte [0x140064141]
mov ecx, 3
mov edx, 1
call fcn.140009c00
test rax, rax
je 0x140003d06
mov rbp, rax
mov word [rax], 0x500
mov byte [rax + 2], 0x69
movzx eax, byte [0x140064141]
mov ecx, 3
mov edx, 1
call fcn.140009c00
test rax, rax
je 0x140003d06
mov r12, rax
mov word [rax], 0xc00
mov byte [rax + 2], 0x29
movzx eax, byte [0x140064141]
mov ecx, 3
mov edx, 1
call fcn.140009c00
test rax, rax
je 0x140003d06
mov word [rax], 0x1c00
mov r14, rax
mov byte [rax + 2], 0x14
movzx eax, byte [0x140064141]
mov ecx, 3
mov edx, 1
call fcn.140009c00
test rax, rax
je 0x140003d06
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rbx
mov word [rax], 0x5000
mov rbx, rax
mov byte [rax + 2], 0x56
movzx eax, byte [0x140064141]
mov ecx, 3
mov edx, 1
call fcn.140009c00
test rax, rax
je 0x140003d06
mov word [rax], 0x1c00
mov rsi, rax
mov byte [rax + 2], 0x42
movzx eax, byte [0x140064141]
mov ecx, 3
mov edx, 1
call fcn.140009c00
test rax, rax
je 0x140003d06
mov r15, rax
mov word [rax], 0x1600
mov byte [rax + 2], 0x3e
movzx eax, byte [0x140064141]
mov ecx, 3
mov edx, 1
call fcn.140009c00
test rax, rax
je 0x140003d06
mov word [rax], 0xa
mov byte [rax + 2], 0x27
mov qword [r13 + 0xa8], 3
mov qword [r13 + 0xb0], rax
mov qword [r13 + 0xb8], 3
mov qword [r13], 3
mov qword [r13 + 8], rdi
mov qword [r13 + 0x10], 3
mov qword [r13 + 0x18], 3
mov qword [r13 + 0x20], rbp
mov qword [r13 + 0x28], 3
mov qword [r13 + 0x30], 3
mov qword [r13 + 0x38], r12
mov qword [r13 + 0x40], 3
mov qword [r13 + 0x48], 3
mov qword [r13 + 0x50], r14
mov qword [r13 + 0x58], 3
mov qword [r13 + 0x60], 3
mov qword [r13 + 0x68], rbx
mov qword [r13 + 0x70], 3
mov qword [r13 + 0x78], 3
mov qword [r13 + 0x80], rsi
mov qword [r13 + 0x88], 3
mov qword [r13 + 0x90], 3
mov qword [r13 + 0x98], r15
mov qword [r13 + 0xa0], 3
cmp qword [rsp + 0x70], 3
jae 0x1400033f0
xor esi, esi
jmp 0x1400034ca
mov r10, rsi
movzx ecx, word [rdi]
mov r8, qword [rsp + 0x38]
xor cx, word [r8]
movzx edx, byte [rdi + 2]
xor dl, byte [r8 + 2]
movzx edx, dl
mov sil, 1
or dx, cx
je 0x1400034ca
movzx ecx, word [rbp]
xor cx, word [r8]
movzx edx, byte [rbp + 2]
xor dl, byte [r8 + 2]
movzx edx, dl
or dx, cx
je 0x1400034ca
movzx ecx, word [r12]
xor cx, word [r8]
movzx edx, byte [r12 + 2]
xor dl, byte [r8 + 2]
movzx edx, dl
or dx, cx
je 0x1400034ca
movzx ecx, word [r14]
xor cx, word [r8]
movzx edx, byte [r14 + 2]
xor dl, byte [r8 + 2]
movzx edx, dl
or dx, cx
je 0x1400034ca
movzx ecx, word [rbx]
xor cx, word [r8]
movzx edx, byte [rbx + 2]
xor dl, byte [r8 + 2]
movzx edx, dl
or dx, cx
je 0x1400034ca
movzx ecx, word [r10]
xor cx, word [r8]
movzx edx, byte [r10 + 2]
xor dl, byte [r8 + 2]
movzx edx, dl
or dx, cx
je 0x1400034ca
movzx ecx, word [r15]
xor cx, word [r8]
movzx edx, byte [r15 + 2]
xor dl, byte [r8 + 2]
movzx edx, dl
or dx, cx
je 0x1400034ca
movzx ecx, word [rax]
xor cx, word [r8]
movzx eax, byte [rax + 2]
xor al, byte [r8 + 2]
movzx eax, al
or ax, cx
jne 0x1400033e9
lea rcx, [rsp + 0x240]
call fcn.14000a3c0
cmp dword [rsp + 0x250], 0
je 0x1400034ff
mov eax, 1
xor ecx, ecx
mov r8, rbx
cpuid
xchg rbx, r8
and ecx, 0xfffeb7ff
mov eax, dword [rsp + 0x240]
jmp 0x140003504
mov eax, 3
mov r12, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x68]
cmp eax, 3
setne dil
test ecx, ecx
sets bpl
xor eax, eax
xor ecx, ecx
mov r8, rbx
cpuid
xchg rbx, r8
mov dword [rsp + 0x138], r8d
mov dword [rsp + 0x13c], edx
mov dword [rsp + 0x140], ecx
lea rcx, [rsp + 0x138]
call fcn.14000a4b0
mov r9, rdx
lea rcx, [0x14004e0d2]
mov edx, 9
mov r8, rax
call fcn.1400013a0
test al, al
jne 0x14000360d
lea rcx, [rsp + 0x138]
call fcn.14000a4b0
mov r9, rdx
lea rcx, [0x14004e0db]
mov edx, 0xc
mov r8, rax
call fcn.1400013a0
test al, al
jne 0x14000360d
lea rcx, [rsp + 0x138]
call fcn.14000a4b0
mov r9, rdx
lea rcx, [0x14004e0e7]
mov edx, 0xc
mov r8, rax
call fcn.1400013a0
test al, al
jne 0x14000360d
lea rcx, [rsp + 0x138]
call fcn.14000a4b0
mov r9, rdx
lea rcx, [0x14004e0f3]
mov edx, 0xc
mov r8, rax
call fcn.1400013a0
test al, al
jne 0x14000360d
lea rcx, [rsp + 0x138]
call fcn.14000a4b0
mov r9, rdx
lea rcx, [0x14004e0ff]
mov edx, 0xa
mov r8, rax
call fcn.1400013a0
test al, al
je 0x1400038ef
mov bpl, 1
mov rdx, qword [r13]
test rdx, rdx
je 0x140003628
mov rcx, qword [r13 + 8]
mov r8d, 1
call fcn.140009c10
mov rdx, qword [r13 + 0x18]
test rdx, rdx
je 0x140003640
mov rcx, qword [r13 + 0x20]
mov r8d, 1
call fcn.140009c10
mov rdx, qword [r13 + 0x30]
test rdx, rdx
je 0x140003658
mov rcx, qword [r13 + 0x38]
mov r8d, 1
call fcn.140009c10
mov rdx, qword [r13 + 0x48]
test rdx, rdx
je 0x140003670
mov rcx, qword [r13 + 0x50]
mov r8d, 1
call fcn.140009c10
mov rdx, qword [r13 + 0x60]
test rdx, rdx
je 0x140003688
mov rcx, qword [r13 + 0x68]
mov r8d, 1
call fcn.140009c10
mov rdx, qword [r13 + 0x78]
test rdx, rdx
je 0x1400036a3
mov rcx, qword [r13 + 0x80]
mov r8d, 1
call fcn.140009c10
mov rdx, qword [r13 + 0x90]
test rdx, rdx
je 0x1400036c1
mov rcx, qword [r13 + 0x98]
mov r8d, 1
call fcn.140009c10
mov rdx, qword [r13 + 0xa8]
test rdx, rdx
je 0x1400036df
mov rcx, qword [r13 + 0xb0]
mov r8d, 1
call fcn.140009c10
mov edx, 0xc0
mov r8d, 8
mov rcx, r13
call fcn.140009c10
test rbx, rbx
je 0x14000370a
mov r8d, 1
mov rcx, qword [rsp + 0x38]
mov rdx, rbx
call fcn.140009c10
mov edx, 0xd0
mov r8d, 8
mov rcx, qword [rsp + 0x48]
call fcn.140009c10
mov rsi, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0xc0]
test rdi, rdi
mov r15, qword [rsp + 0x80]
je 0x140003772
lea rbx, [rsi + 8]
jmp 0x140003759
add rbx, 0x18
dec rdi
je 0x140003772
mov rdx, qword [rbx - 8]
test rdx, rdx
je 0x140003750
mov rcx, qword [rbx]
mov r8d, 1
call fcn.140009c10
jmp 0x140003750
mov rax, qword [rsp + 0xb0]
test rax, rax
je 0x140002e49
shl rax, 3
lea rdx, [rax + rax*2]
mov r8d, 8
mov rcx, rsi
call fcn.140009c10
jmp 0x140002e49
mov rax, qword [rsp + 0x48]
mov rsi, qword [rax + 0x50]
mov rdi, qword [rax + 0x58]
lea rbx, [r15 + r15*2]
mov rcx, qword [rsp + 0x38]
mov r13b, 1
nop word [rax + rax]
test rbx, rbx
je 0x1400037ec
lea r12, [rcx + 0x18]
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
mov rcx, rsi
mov rdx, rdi
call fcn.1400013a0
add rbx, 0xffffffffffffffe8
mov rcx, r12
test al, al
je 0x1400037c0
jmp 0x140002aee
mov rax, qword [rsp + 0x48]
mov rsi, qword [rax + 0x60]
mov rdi, qword [rax + 0x68]
lea rbx, [r15 + r15*2]
mov rcx, qword [rsp + 0x38]
mov r13b, 1
nop word cs:[rax + rax]
test rbx, rbx
je 0x14000385b
lea r12, [rcx + 0x18]
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
mov rcx, rsi
mov rdx, rdi
call fcn.1400013a0
add rbx, 0xffffffffffffffe8
mov rcx, r12
test al, al
je 0x140003810
jmp 0x140002aee
lea rcx, [rsp + 0x50]
mov rdx, r15
mov r8, r14
call fcn.1400474d0
mov r13, qword [rsp + 0x58]
mov r15, qword [rsp + 0x60]
jmp 0x140003048
mov rax, qword [rsp + 0x48]
mov rsi, qword [rax + 0x70]
mov rdi, qword [rax + 0x78]
lea rbx, [r15 + r15*2]
mov rcx, qword [rsp + 0x38]
mov r13b, 1
test rbx, rbx
je 0x1400038a0
lea r12, [rcx + 0x18]
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
mov rcx, rsi
mov rdx, rdi
call fcn.1400013a0
add rbx, 0xffffffffffffffe8
mov rcx, r12
test al, al
je 0x140003874
jmp 0x140002aee
mov rax, qword [rsp + 0x48]
mov rsi, qword [rax + 0x80]
mov rdi, qword [rax + 0x88]
lea rbx, [r15 + r15*2]
mov rcx, qword [rsp + 0x38]
mov r13b, 1
test rbx, rbx
je 0x140003aeb
lea r12, [rcx + 0x18]
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
mov rcx, rsi
mov rdx, rdi
call fcn.1400013a0
add rbx, 0xffffffffffffffe8
mov rcx, r12
test al, al
je 0x1400038bf
jmp 0x140002aee
and dil, bpl
lea rcx, [rsp + 0x138]
call fcn.14000a4b0
mov r9, rdx
lea rcx, [0x14004e109]
mov edx, 0xc
mov r8, rax
call fcn.1400013a0
or al, sil
or al, dil
movzx ecx, byte [rsp + 0x47]
or cl, byte [rsp + 0x37]
or cl, al
mov bpl, 1
jne 0x140003610
cmp dword [rsp + 0x88], 2
jne 0x140003610
cmp qword [rsp + 0xa8], 0x358
jne 0x140003610
lea rsi, [rsp + 0x138]
mov rcx, rsi
call fcn.140012380
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetSystemInfo]
cmp dword [rsp + 0x158], 2
jb 0x140003610
lea rsi, [rsp + 0x138]
mov rcx, rsi
call fcn.14000a4f0
mov rcx, rsi
call fcn.14000a760
mov rdi, qword [rsp + 0x190]
lea rcx, [rsp + 0x178]
call fcn.140003f70
mov rdx, qword [rsp + 0x150]
movabs rax, 0x8000000000000000
cmp rdx, rax
je 0x1400039d3
test rdx, rdx
je 0x1400039d3
mov rcx, qword [rsp + 0x158]
mov r8d, 1
call fcn.140009c10
lea rcx, [rsp + 0x138]
call fcn.140004650
mov rax, qword [rsp + 0x138]
test rax, rax
je 0x140003a04
mov rcx, qword [rsp + 0x140]
imul rdx, rax, 0x70
mov r8d, 8
call fcn.140009c10
cmp qword [rsp + 0x1c8], 0
je 0x140003a27
lea rsi, [rsp + 0x1c8]
mov rcx, rsi
call fcn.14000a810
mov rcx, rsi
call fcn.140003e80
cmp rdi, 0x33
jb 0x140003610
lea rsi, [rsp + 0x138]
mov rcx, rsi
call fcn.14001b440
mov dword [rsp + 0x138], 0x40
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x140003d24
mov eax, 0x80000001
cmp qword [rsp + 0x140], rax
jb 0x140003610
mov dword [rsp + 0xc8], 0
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
lea rdx, [rsp + 0xc8]
mov rcx, rax
call qword [sym.imp.kernel32.dll_CheckRemoteDebuggerPresent]
test eax, eax
jne 0x140003ac8
call fcn.14001b6f0
mov qword [rsp + 0x140], rax
mov dword [rsp + 0x148], edx
mov qword [rsp + 0x138], 1
test rax, rax
je 0x140003ac8
lea rcx, [rsp + 0x140]
call fcn.140012410
mov bpl, 1
cmp dword [rsp + 0xc8], 1
je 0x140003610
call qword [sym.imp.kernel32.dll_IsDebuggerPresent]
cmp eax, 1
sete bpl
jmp 0x140003610
mov rax, qword [rsp + 0x48]
mov rsi, qword [rax + 0x90]
mov rdi, qword [rax + 0x98]
lea rbx, [r15 + r15*2]
mov rcx, qword [rsp + 0x38]
mov r13b, 1
test rbx, rbx
je 0x140003b36
lea r12, [rcx + 0x18]
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
mov rcx, rsi
mov rdx, rdi
call fcn.1400013a0
add rbx, 0xffffffffffffffe8
mov rcx, r12
test al, al
je 0x140003b0a
jmp 0x140002aee
mov rax, qword [rsp + 0x48]
mov rsi, qword [rax + 0xa0]
mov rdi, qword [rax + 0xa8]
lea rbx, [r15 + r15*2]
mov rcx, qword [rsp + 0x38]
mov r13b, 1
test rbx, rbx
je 0x140003b81
lea r12, [rcx + 0x18]
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
mov rcx, rsi
mov rdx, rdi
call fcn.1400013a0
add rbx, 0xffffffffffffffe8
mov rcx, r12
test al, al
je 0x140003b55
jmp 0x140002aee
mov rax, qword [rsp + 0x48]
mov rsi, qword [rax + 0xb0]
mov rdi, qword [rax + 0xb8]
lea rbx, [r15 + r15*2]
mov rcx, qword [rsp + 0x38]
mov r13b, 1
test rbx, rbx
je 0x140003bcc
lea r12, [rcx + 0x18]
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
mov rcx, rsi
mov rdx, rdi
call fcn.1400013a0
add rbx, 0xffffffffffffffe8
mov rcx, r12
test al, al
je 0x140003ba0
jmp 0x140002aee
mov rax, qword [rsp + 0x48]
mov rsi, qword [rax + 0xc0]
mov rdi, qword [rax + 0xc8]
lea rbx, [r15 + r15*2]
mov rcx, qword [rsp + 0x38]
test rbx, rbx
setne r13b
je 0x140002aee
lea r15, [rcx + 0x18]
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
mov rcx, rsi
mov rdx, rdi
call fcn.1400013a0
add rbx, 0xffffffffffffffe8
mov rcx, r15
test al, al
je 0x140003be8
jmp 0x140002aee
mov rax, qword [rsp + 0x248]
mov qword [rsp + 0xc8], rax
lea rax, [0x14004e170]
mov qword [rsp + 0x20], rax
lea rcx, [0x14004e11d]
lea r9, [0x14004d6d0]
lea r8, [rsp + 0xc8]
mov edx, 0x1f
call fcn.14004c2e0
mov ecx, 8
mov edx, 0x330
call fcn.14004be80
mov ecx, 8
mov edx, 0xf0
call fcn.14004be80
mov ecx, 8
mov edx, 0x1a0
call fcn.14004be80
mov rax, qword [rsp + 0x248]
mov qword [rsp + 0xc8], rax
lea rax, [0x14004e1b8]
mov qword [rsp + 0x20], rax
lea rcx, [0x14004e19a]
lea r9, [0x14004d6d0]
lea r8, [rsp + 0xc8]
mov edx, 0x1a
call fcn.14004c2e0
mov ecx, 8
mov edx, 0xd0
call fcn.14004be80
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x50], rax
lea rax, [0x14004e1f8]
mov qword [rsp + 0x20], rax
lea rcx, [0x14004e1dc]
lea r9, [0x14004d6d0]
lea r8, [rsp + 0x50]
mov edx, 0x18
call fcn.14004c2e0
mov ecx, 1
mov edx, 3
call fcn.14004be80
mov ecx, 8
mov edx, 0xc0
call fcn.14004be80
call fcn.14001b6f0
mov qword [rsp + 0xc8], rax
mov dword [rsp + 0xd0], edx
lea rax, [0x14004e240]
mov qword [rsp + 0x20], rax
lea rcx, [0x14004e222]
lea r9, [0x14004d6b0]
lea r8, [rsp + 0xc8]
mov edx, 0x1b
call fcn.14004c2e0
int3